On 24/06/2019 19:18, mixed8e--- via Exim-users wrote: > a group from May 20 which is
> before the exploit was announced. Perhaps this is unrelated? There are no
> cron job entries that try to execute these files. I'm not sure what to
> make of them.
Perhaps your system was already compromised by other means.
I'd suggest a reinstall.