Hello,
there was “figure8scripturememory.com/0407d67be13124da8084d5a4b793d393/q.php”, can you confirm that you have cleaned it? I suggest to change all passwords and update all systems.

Milos