Hi Eleos, Many thanks for pointing that out! Will check what the index.php is doing ..
1721811490
Looks like the trojan is creating a user, collects some data and downloads them. Then delete the activities. Do not USE!
1721811908
It sends the data to an email during installation.