On 18 Oct 2022 at 07:18p, Clive Reuben pondered and said...
 
 CR> Hopefully, someone else has seen this... and hopefully Mystic BBS's are
 CR> not being hacked... Thanks, for any help!  

[snip]

 CR> -------->> start concerning entries <<------------
 CR> 2022.10.18 13:36:06 Executing: sh /mystic/temp2/xfer.sh
 CR> 2022.10.18 13:36:06 Execution complete: 32512

I think it is created by a Mystic process but g00r00 will be able to confirm.

Kerr Avon [Blake's 7] 'I'm not expendable, I'm not stupid and I'm not going'
avon[at]bbs.nz | bbs.nz | fsxnet.nz 

--- Mystic BBS v1.12 A47 2021/12/24 (Linux/64)