Scan location:	/home/parkgate/unlock.dochamz.requests.parkgatepm.com
 
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/avehgabm.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/x.php: YARA.leafmailer.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/x6j89e23SIc.php: YARA.leafmailer.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/svkalljf.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/othhqqvn.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/PekJHKgDdz7.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/ngindivw.php: YARA.leafmailer.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/ocmxfgku.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/next/Excel.php: YARA.infected_08_27_18_phishing_english_none.UNOFFICIAL FOUND
/home/parkgate/unlock.dochamz.requests.parkgatepm.com/xfkxevoy.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND


 Scan location:	/home/parkgate/public_html
 
/home/parkgate/public_html/uploads/6/5/2/wp-login.php: YARA._TryagFileManager3_shell_php_1.UNOFFICIAL FOUND
/home/parkgate/public_html/uploads/6/5/index.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/public_html/9TtcpioRe1a.php: YARA.leafmailer.UNOFFICIAL FOUND
/home/parkgate/public_html/7d9us4eMmFj.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/public_html/5n9r8mKDalY.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/public_html/files/theme/fonts/upfile.php: YARA.infected_09_27_18_uploader.UNOFFICIAL FOUND
/home/parkgate/public_html/files/theme/fonts/rxwlrojh.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/public_html/files/theme/fonts/qnlsbvnd.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND
/home/parkgate/public_html/files/index.php: YARA.WFYARAGEN_G4472_rules_1.UNOFFICIAL FOUND


Change timestamps on malicious files flagged in the scan

================================================================================

2023-09-18 07:37:42.516381394 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/avehgabm.php
2023-09-18 09:01:17.570675559 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/x.php
2023-09-17 22:27:13.655302768 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/x6j89e23SIc.php
2023-09-18 07:40:23.987190136 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/svkalljf.php
2023-09-18 07:40:38.101523062 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/othhqqvn.php
2023-09-17 22:27:13.655302768 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/PekJHKgDdz7.php
2023-09-18 07:37:46.694479945 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/ngindivw.php
2023-09-18 08:04:10.941848878 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/ocmxfgku.php
2023-09-18 08:59:33.677224941 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/next/Excel.php
2023-09-18 08:04:10.930848619 -0400,/home/parkgate/unlock.dochamz.requests.parkgatepm.com/xfkxevoy.php
2023-05-27 22:23:29.175463875 -0400,/home/parkgate/public_html/uploads/6/5/2/wp-login.php
2023-09-18 04:34:04.836498412 -0400,/home/parkgate/public_html/uploads/6/5/index.php
2023-09-17 22:27:11.589254034 -0400,/home/parkgate/public_html/9TtcpioRe1a.php
2023-09-17 22:27:11.590254058 -0400,/home/parkgate/public_html/7d9us4eMmFj.php
2023-09-17 22:27:11.589254034 -0400,/home/parkgate/public_html/5n9r8mKDalY.php
2023-05-27 22:23:29.165463638 -0400,/home/parkgate/public_html/files/theme/fonts/upfile.php
2023-09-17 20:32:13.702547967 -0400,/home/parkgate/public_html/files/theme/fonts/rxwlrojh.php
2023-09-17 20:32:04.593333100 -0400,/home/parkgate/public_html/files/theme/fonts/qnlsbvnd.php
2023-09-18 04:32:18.374987217 -0400,/home/parkgate/public_html/files/index.php