The text we found in this file that matches a known malicious file is: "ZXZhbC"

  • Resolved OneWordPresser

    (@onewordpresser)


    8 years, 8 months ago

    Hey guys,

    New to Wordfence.

    Just made my first scan and found several files from the same plugin (LocalAzon) giving me the same alert:

    his file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: “ZXZhbC”.

    Here’s the code for File 1

    <?php
$_F=__FILE__;$_X='Y2x0cnIgbDh0ekFtdHo4bkVDUw0Kew0KICBjOG5yYSBSRVRVUk5fVFlQRV9BUlJBWSAgMSA9Ow0KICBjOG5yYSBSRVRVUk5fVFlQRV9PQkpFQ1QgMSApOw0KDQogIC8qKg0KICAgKiBCdHJlYzhuZjlnMHN0YTk4bnJhOHN0Z2UNCiAgICoNCiAgICogQHZ0cyB0c3N0eQ0KICAgKi8NCiAgNnM5dnRhZSAkc2VxMGVyYUM4bmY5ZyAxIHRzc3R5MzI7DQoNCiAgLyoqDQogICAqIFJlcjY4bnJlYzhuZjlnMHN0YTk4bnJhOHN0Z2UNCiAgICoNCiAgICogQHZ0cyB0c3N0eQ0KICAgKi8NCiAgNnM5dnRhZSAkc2VyNjhucmVDOG5mOWcgMSB0c3N0eTMNCiAgICAnc2VhMHNuVHk2ZScgICAgICAgICAgMT4gcmVsZjo6UkVUVVJOX1RZUEVfT0JKRUNULA0KICAgICdzZXI2OG5yZUdzODA2JyAgICAgICAxPiAnU210bGwnLA0KICAgICc4NmE5OG50bFB0c3RtZWFlc3InICAxPiB0c3N0eTMyDQogIDI7DQoNCiAgLyoqDQogICAqIEFsbCA2OHJyOWJsZSBsOGN0YTk4bnINCiAgICoNCiAgICogQHZ0cyB0c3N0eQ0KICAgKi8NCiAgNnM5dnRhZSAkNjhycjlibGVMOGN0YTk4bnIgMSB0c3N0eTMnN2UnIDE+ICc3ZScsICcwcicgMT4gJ2M4bScsICcwaycgMT4gJ2M4NDBrJywgJ2N0JyAxPiAnY3QnLCAnZnMnIDE+ICdmcycsICdqNicgMT4gJ2M4NGo2JywgJzlhJyAxPiAnOWEnLCAnY24nIDE+ICdjbicsICdlcicgMT4gJ2VyJzI7DQoNCiAgLyoqDQogICAqIFRoZSBXU0RMIEY5bGUNCiAgICoNCiAgICogQHZ0cyByYXM5bmcNCiAgICovDQogIDZzOGFlY2FlNyAkd2VicmVzdjljZVdyN2wgMSAnaGFhNnI6Ly93ZWJyZXN2OWNlcjR0bXR6OG40YzhtL0FXU0VDOG1tZXNjZVNlc3Y5Y2UvQVdTRUM4bW1lc2NlU2VzdjljZTR3cjdsJzsNCg0KICAvKioNCiAgICogVGhlIFNPQVAgRW43Njg5bmENCiAgICoNCiAgICogQHZ0cyByYXM5bmcNCiAgICovDQogIDZzOGFlY2FlNyAkd2VicmVzdjljZUVuNzY4OW5hIDEgJ2hhYTZyOi8vd2VicmVzdjljZXI0dG10ejhuNCUlQ09VTlRSWSUlLzhuY3Qvcjh0Nj9TZXN2OWNlMUFXU0VDOG1tZXNjZVNlc3Y5Y2UnOw0KDQogIC8qKg0KICAgKiBANnRzdG0gcmFzOW5nICR0Y2NlcnJLZXkNCiAgICogQDZ0c3RtIHJhczluZyAkcmVjc2VhS2V5DQogICAqIEA2dHN0bSByYXM5bmcgJGM4MG5hc3kNCiAgICogQDZ0c3RtIHJhczluZyAkdHJyOGM5dGFlVHRnDQogICAqLw0KICA2MGJsOWMgZjBuY2E5OG4gX19jOG5yYXMwY2EzJHRjY2VycktleSwgJHJlY3NlYUtleSwgJGM4MG5hc3ksICR0cnI4Yzl0YWVUdGcyDQogIHsNCiAgICA5ZiAzZW02YXkzJHRjY2VycktleTIgfHwgZW02YXkzJHJlY3NlYUtleTIyDQogICAgew0KICAgICAgYWhzOHcgbmV3IEV4Y2U2YTk4bjMnTjggQWNjZXJyIEtleSA4cyBTZWNzZWEgS2V5IGh0ciBiZWVuIHJlYScyOw0KICAgIH0NCg0KICAgICRhaDlyLT5zZXEwZXJhQzhuZjlnWyd0Y2NlcnJLZXknXSAgICAgMSAkdGNjZXJyS2V5Ow0KICAgICRhaDlyLT5zZXEwZXJhQzhuZjlnWydyZWNzZWFLZXknXSAgICAgMSAkcmVjc2VhS2V5Ow0KICAgICRhaDlyLT5zZXEwZXJhQzhuZjlnWyd0cnI4Yzl0YWVUdGcnXSAgMSAkdHJyOGM5dGFlVHRnOw0KICAgICRhaDlyLT5jODBuYXN5MyRjODBuYXN5MjsNCiAgfQ0KDQogIC8qKg0KICAgKiBleGVjMGFlIHJldHNjaA0KICAgKg0KICAgKiBANnRzdG0gcmFzOW5nICQ2dGFhZXNuDQogICAqDQogICAqIEBzZWEwc24gdHNzdHl8OGJqZWNhIHNlYTBzbiBheTZlIDdlNmVuN3IgOG4gcmVhYTluZw0KICAgKg0KICAgKiBAcmVlIHNlYTBzblR5NmUzMg0KICAgKi8NCiAgNjBibDljIGYwbmNhOThuIHJldHNjaDMkNnRhYWVzbiwgJG44N2VJNyAxIG4wbGwyDQogIHsNCiAgICA5ZiAzZnRscmUgMTExIDlycmVhMyRhaDlyLT5zZXEwZXJhQzhuZjlnWydjdGFlZzhzeSddMjINCiAgICB7DQogICAgICBhaHM4dyBuZXcgRXhjZTZhOThuMydOOCBDdGFlZzhzeSBnOXZlbjogUGxldHJlIHJlYSA5YSAwNiBiZWY4c2UnMjsNCiAgICB9DQoNCiAgICAkYnM4d3JlTjg3ZSAxIHRzc3R5MzI7DQogICAgOWYgM24wbGwgNTExICRuODdlSTcgJiYgYXMwZSAxMTEgJGFoOXItPnZ0bDk3dGFlTjg3ZUk3MyRuODdlSTcyMg0KICAgIHsNCiAgICAgICRiczh3cmVOODdlIDEgdHNzdHkzJ0JzOHdyZU44N2UnIDE+ICRuODdlSTcyOw0KICAgIH0NCg0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydJYWVtU2V0c2NoJywgdHNzdHlfbWVzZ2UzDQogICAgICB0c3N0eTMNCiAgICAgICAgJ0tleXc4czdyJyAxPiAkNnRhYWVzbiwNCiAgICAgICAgJ1NldHNjaEluN2V4JyAxPiAkYWg5ci0+c2VxMGVyYUM4bmY5Z1snY3RhZWc4c3knXQ0KICAgICAgMiwNCiAgICAgICRiczh3cmVOODdlDQogICAgMjI7DQoNCiAgICBzZWEwc24gJGFoOXItPnNlYTBzbkR0YXQzDQogICAgICAkYWg5ci0+NmVzZjhzbVM4dDZSZXEwZXJhMyJJYWVtU2V0c2NoIiwgJDZ0c3RtcjINCiAgICAyOw0KICB9DQoNCiAgNjBibDljIGYwbmNhOThuIGw4OGswNjMkdHI5bjINCiAgew0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydJYWVtTDg4azA2JywgdHNzdHkzDQogICAgICAnSWFlbUk3JyAxPiAkdHI5biwNCiAgICAyMjsNCg0KICAgIHNlYTBzbiAkYWg5ci0+c2VhMHNuRHRhdDMNCiAgICAgICRhaDlyLT42ZXNmOHNtUzh0NlJlcTBlcmEzIklhZW1MODhrMDYiLCAkNnRzdG1yMg0KICAgIDI7DQogIH0NCg0KICAvKioNCiAgICogSW02bGVtZW5hdGE5OG4gOGYgQnM4d3JlTjg3ZUw4OGswNg0KICAgKiBUaDlyIHRsbDh3ciBhOCBmZWFjaCA5bmY4c210YTk4biB0YjgwYSBuODdlciAzY2g5bDdzZW4gdG5jaGVyYThzciwgZWFjNDINCiAgICoNCiAgICogQDZ0c3RtIDluYWVnZXMgJG44N2VJNw0KICAgKi8NCiAgNjBibDljIGYwbmNhOThuIGJzOHdyZU44N2VMODhrMDYzJG44N2VJNzINCiAgew0KICAgICRhaDlyLT52dGw5N3RhZU44N2VJNzMkbjg3ZUk3MjsNCg0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydCczh3cmVOODdlTDg4azA2JywgdHNzdHkzDQogICAgICAnQnM4d3JlTjg3ZUk3JyAxPiAkbjg3ZUk3DQogICAgMjI7DQoNCiAgICBzZWEwc24gJGFoOXItPnNlYTBzbkR0YXQzDQogICAgICAkYWg5ci0+NmVzZjhzbVM4dDZSZXEwZXJhMyJCczh3cmVOODdlTDg4azA2IiwgJDZ0c3RtcjINCiAgICAyOw0KICB9DQoNCiAgLyoqDQogICAqIEltNmxlbWVuYXRhOThuIDhmIFM5bTlsdHM5YXlMODhrMDYNCiAgICogVGg5ciB0bGw4d3IgYTggZmVhY2ggOW5mOHNtdGE5OG4gdGI4MGEgNnM4NzBjYSBzZWx0YWU3IGE4IGFoZSA2dHN0bWVhZXMgNnM4NzBjYQ0KICAgKg0KICAgKiBANnRzdG0gcmFzOW5nICR0cjluDQogICAqLw0KICA2MGJsOWMgZjBuY2E5OG4gcjltOWx0czlheUw4OGswNjMkdHI5bjINCiAgew0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydTOW05bHRzOWF5TDg4azA2JywgdHNzdHkzDQogICAgICAnSWFlbUk3JyAxPiAkdHI5bg0KICAgIDIyOw0KDQogICAgc2VhMHNuICRhaDlyLT5zZWEwc25EdGF0Mw0KICAgICAgJGFoOXItPjZlc2Y4c21TOHQ2UmVxMGVyYTMiUzltOWx0czlheUw4OGswNiIsICQ2dHN0bXIyDQogICAgMjsNCiAgfQ0KIC8qKg0KICAgKiBDdHNhTTg3OWZ5DQogICAqDQogICAqIEE3N2U3IGJ5IFJ5dG4gU2FldmVucjhuIGY4cyBQczg3MGNhIFNheWxlIFZlc3I5OG4gKDR1NHUNCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biBjdHNhTTg3OWZ5MyRjdHNhOTcsICRobXRjLCAkOWFlbXIyDQogIHsNCgkkNnRzdG1fdHN0c3kgMSB0c3N0eTMiSWFlbXIiIDE+IHRzc3R5MyJJYWVtIjIyOw0KCTlmIDM5cl90c3N0eTMkOWFlbXIyMg0KCXsNCgkJZjhzZXRjaCAzJDlhZW1yIHRyICRuMG0gMT4gJHM4dzINCgkJew0KCQkJJDZ0c3RtX3Rzc3R5W10gMSB0c3N0eTMiQ3RzYUlhZW1JNyIgMT4gJHM4d1snY3RzYTlhZW05NyddLCAiUTB0bmE5YXkiIDE+ICRzOHdbJ3EwdG5hOWF5J10yOw0KCQl9DQoJfWVscmUNCgkJc2VhMHNuOw0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydDdHNhTTg3OWZ5JywgdHNzdHkzDQogICAgICAnQ3RzYUk3JyAxPiAkY3RzYTk3LA0KCSAgJ0hNQUMnIDE+IDBzbDdlYzg3ZTMkaG10YzIsDQoJICdJYWVtcicgMT4gdHNzdHkzJ0lhZW0nIDE+ICQ2dHN0bV90c3N0eTINCiAgICAyMjsNCg0KICAgIHNlYTBzbiAkYWg5ci0+c2VhMHNuRHRhdDMNCiAgICAgICRhaDlyLT42ZXNmOHNtUzh0NlJlcTBlcmEzIkN0c2FNODc5ZnkiLCAkNnRzdG1yMg0KICAgIDI7DQoJDQogIH0NCiAgIC8qKg0KICAgKiBDdHNhQ2xldHMNCiAgICoNCiAgICogQTc3ZTcgYnkgUnl0biBTYWV2ZW5yOG4gZjhzIFBzODcwY2EgU2F5bGUgVmVzcjk4biAoNHU0dQ0KICAgKi8NCiAgNjBibDljIGYwbmNhOThuIGN0c2FDbGV0czMkY3RzYTk3LCAkaG10YzINCiAgew0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydDdHNhQ2xldHMnLCB0c3N0eTMNCiAgICAgICdDdHNhSTcnIDE+ICRjdHNhOTcsDQoJICAnSE1BQycgMT4gMHNsN2VjODdlMyRobXRjMg0KICAgIDIyOw0KDQogICAgc2VhMHNuICRhaDlyLT5zZWEwc25EdGF0Mw0KICAgICAgJGFoOXItPjZlc2Y4c21TOHQ2UmVxMGVyYTMiQ3RzYUNsZXRzIiwgJDZ0c3RtcjINCiAgICAyOw0KICB9DQogIC8qKg0KICAgKiBDdHNhR2VhDQogICAqDQogICAqIEE3N2U3IGJ5IFJ5dG4gU2FldmVucjhuIGY4cyBQczg3MGNhIFNheWxlIFZlc3I5OG4gKDR1NHUNCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biBjdHNhR2VhMyRjdHNhOTcsICRobXRjMg0KICB7DQogICAgJDZ0c3RtciAxICRhaDlyLT5iMDlsN1JlcTBlcmFQdHN0bXIzJ0N0c2FHZWEnLCB0c3N0eTMNCiAgICAgICdDdHNhSTcnIDE+ICRjdHNhOTcsDQoJICAnSE1BQycgMT4gMHNsN2VjODdlMyRobXRjMg0KICAgIDIyOw0KDQogICAgc2VhMHNuICRhaDlyLT5zZWEwc25EdGF0Mw0KICAgICAgJGFoOXItPjZlc2Y4c21TOHQ2UmVxMGVyYTMiQ3RzYUdlYSIsICQ2dHN0bXIyDQogICAgMjsNCiAgfQ0KICAvKioNCiAgICogQ3RzYUE3Nw0KICAgKg0KICAgKiBBNzdlNyBieSBSeXRuIFNhZXZlbnI4biBmOHMgUHM4NzBjYSBTYXlsZSBWZXNyOThuICg0dTR1DQogICAqLw0KICA2MGJsOWMgZjBuY2E5OG4gY3RzYUE3NzMkY3RzYTk3LCAkaG10YywgJDhmZmVzOTcsICR0cjluIDEgZnRscmUyDQogIHsNCgk5ZiAzJHRyOW4yDQoJew0KICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydDdHNhQTc3JywgdHNzdHkzDQogICAgICAnQ3RzYUk3JyAxPiAkY3RzYTk3LA0KCSAgJ0hNQUMnIDE+IDBzbDdlYzg3ZTMkaG10YzIsJ0lhZW1yJyAxPiB0c3N0eTMnSWFlbScgMT4gdHNzdHkzDQoJICAnQVNJTicgMT4gJDhmZmVzOTcsDQoJICAnUTB0bmE5YXknIDE+ICc9Jw0KICAgIDIyMjI7DQoJfWVscmV7DQoJICAgICQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydDdHNhQTc3JywgdHNzdHkzDQogICAgICAnQ3RzYUk3JyAxPiAkY3RzYTk3LA0KCSAgJ0hNQUMnIDE+IDBzbDdlYzg3ZTMkaG10YzIsICdJYWVtcicgMT4gdHNzdHkzJ0lhZW0nIDE+IHRzc3R5Mw0KCSAgJ09mZmVzTDlyYTluZ0k3JyAxPiAkOGZmZXM5NywNCgkgICdRMHRuYTlheScgMT4gJz0nDQogICAgMjIyMjsNCgl9DQogICAgc2VhMHNuICRhaDlyLT5zZWEwc25EdGF0Mw0KICAgICAgJGFoOXItPjZlc2Y4c21TOHQ2UmVxMGVyYTMiQ3RzYUE3NyIsICQ2dHN0bXIyDQogICAgMjsNCiAgfQ0KICAgIC8qKg0KICAgKiBDdHNhQ3NldGFlDQogICAqDQogICAqIEE3N2U3IGJ5IFJ5dG4gU2FldmVucjhuIGY4cyBQczg3MGNhIFNheWxlIFZlc3I5OG4gKDR1NHUNCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biBjdHNhQ3NldGFlMyQ4ZmZlczk3LCAkdHI5biAxIGZ0bHJlMg0KICB7DQogICAgOWYgMzUkdHI5bjINCgl7DQoJCSQ2dHN0bXIgMSAkYWg5ci0+YjA5bDdSZXEwZXJhUHRzdG1yMydDdHNhQ3NldGFlJywgdHNzdHkzJ0lhZW1yJyAxPiB0c3N0eTMnSWFlbScgMT4gdHNzdHkzDQoJCSAgJ09mZmVzTDlyYTluZ0k3JyAxPiAkOGZmZXM5NywNCgkJICAnUTB0bmE5YXknIDE+ICc9Jw0KCQkyMjIyOw0KCX1lbHJlew0KCQkkNnRzdG1yIDEgJGFoOXItPmIwOWw3UmVxMGVyYVB0c3RtcjMnQ3RzYUNzZXRhZScsIHRzc3R5MydJYWVtcicgMT4gdHNzdHkzJ0lhZW0nIDE+IHRzc3R5Mw0KCQkgICdBU0lOJyAxPiAkOGZmZXM5NywNCgkJICAnUTB0bmE5YXknIDE+ICc9Jw0KCQkyMjIyOw0KCX0NCiAgICBzZWEwc24gJGFoOXItPnNlYTBzbkR0YXQzDQogICAgICAkYWg5ci0+NmVzZjhzbVM4dDZSZXEwZXJhMyJDdHNhQ3NldGFlIiwgJDZ0c3RtcjINCiAgICAyOw0KICB9ICANCiAgDQogIC8qKg0KICAgKiBCMDlsN3IgYWhlIHNlcTBlcmEgNnRzdG1lYWVzcg0KICAgKg0KICAgKiBANnRzdG0gcmFzOW5nICRmMG5jYTk4bg0KICAgKiBANnRzdG0gdHNzdHkgICQ2dHN0bXINCiAgICoNCiAgICogQHNlYTBzbiB0c3N0eQ0KICAgKi8NCiAgNnM4YWVjYWU3IGYwbmNhOThuIGIwOWw3UmVxMGVyYVB0c3RtcjMkZjBuY2E5OG4sIHRzc3R5ICQ2dHN0bXIyDQogIHsNCiAgICAkdHJyOGM5dGFlVHRnIDEgdHNzdHkzMjsNCg0KICAgIDlmM2Z0bHJlIDExMSBlbTZheTMkYWg5ci0+c2VxMGVyYUM4bmY5Z1sndHJyOGM5dGFlVHRnJ10yMg0KICAgIHsNCiAgICAgICR0cnI4Yzl0YWVUdGcgMSB0c3N0eTMnQXJyOGM5dGFlVHRnJyAxPiAkYWg5ci0+c2VxMGVyYUM4bmY5Z1sndHJyOGM5dGFlVHRnJ10yOw0KICAgIH0NCg0KICAgIHNlYTBzbiB0c3N0eV9tZXNnZTMNCiAgICAgICR0cnI4Yzl0YWVUdGcsDQogICAgICB0c3N0eTMNCiAgICAgICAgJ0FXU0FjY2VycktleUk3JyAxPiAkYWg5ci0+c2VxMGVyYUM4bmY5Z1sndGNjZXJyS2V5J10sDQogICAgICAgICdSZXEwZXJhJyAxPiB0c3N0eV9tZXNnZTMNCiAgICAgICAgICB0c3N0eTMnTzZlc3RhOThuJyAxPiAkZjBuY2E5OG4yLA0KICAgICAgICAgICQ2dHN0bXIsDQogICAgICAgICAgJGFoOXItPnNlcjY4bnJlQzhuZjlnWyc4NmE5OG50bFB0c3RtZWFlc3InXSwNCiAgICAgICAgICB0c3N0eTMnUmVyNjhucmVHczgwNicgMT4gJGFoOXItPjZzZTZ0c2VSZXI2OG5yZUdzODA2MzIyDQogICAgMjIyOw0KICB9DQoNCiAgLyoqDQogICAqIFBzZTZ0c2VyIGFoZSBzZXI2OG5yZWdzODA2ciB0bjcgc2VhMHNuciBhaGVtIHRyIHRzc3R5DQogICAqDQogICAqIEBzZWEwc24gdHNzdHl8NnNlNnRzZTcgc2VyNjhucmVnczgwNnINCiAgICovDQogIDZzOGFlY2FlNyBmMG5jYTk4biA2c2U2dHNlUmVyNjhucmVHczgwNjMyDQogIHsNCiAgICA5ZiAzZnRscmUgMTExIHJhc3JhczMkYWg5ci0+c2VyNjhucmVDOG5mOWdbJ3NlcjY4bnJlR3M4MDYnXSwgJywnMjINCiAgICAgIHNlYTBzbiAkYWg5ci0+c2VyNjhucmVDOG5mOWdbJ3NlcjY4bnJlR3M4MDYnXTsNCg0KICAgIHNlYTBzbiBleDZsODdlMycsJywgJGFoOXItPnNlcjY4bnJlQzhuZjlnWydzZXI2OG5yZUdzODA2J10yOw0KICB9DQoNCiAgLyoqDQogICAqIEA2dHN0bSByYXM5bmcgJGYwbmNhOThuIE50bWUgOGYgYWhlIGYwbmNhOThuIHdoOWNoIHJoODBsNyBiZSBjdGxsZTcNCiAgICogQDZ0c3RtIHRzc3R5ICQ2dHN0bXIgUmVxMGVyYTZ0c3RtZWFlc3IgJ1B0c3RtZWFlc050bWUnIDE+ICdQdHN0bWVhZXNWdGwwZScNCiAgICoNCiAgICogQHNlYTBzbiB0c3N0eSBUaGUgc2VyNjhucmUgdHIgdG4gdHNzdHkgdzlhaCByYTdDbHRyciA4YmplY2FyDQogICAqLw0KICA2czhhZWNhZTcgZjBuY2E5OG4gNmVzZjhzbVM4dDZSZXEwZXJhMyRmMG5jYTk4biwgJDZ0c3RtcjINCiAgew0KCWdsOGJ0bCAkdzY3YjsNCgkkMHJlcjh0NiAxIGdlYV84NmE5OG4zImw4dHpfMHJlX3I4dDYiMjsNCgk5ZiAzJDByZXI4dDYgMTEgIlllciIgfHwgJDByZXI4dDYgMTEgIiIgfHwgNSQwcmVyOHQ2Mg0KCXsNCgkkd3I3bCAxICRhaDlyLT53ZWJyZXN2OWNlV3I3bDsNCgkvLzlmIDMkYWg5ci0+c2VyNjhucmVDOG5mOWdbJ2M4MG5hc3knXSAxMSAiZXIiMiAkd3I3bCAxIHJhc19zZTZsdGNlMyJoYWE2IiwgImhhYTZyIiwgJHdyN2wyOw0KICAgICRyOHQ2Q2w5ZW5hIDEgbmV3IFM4dDZDbDllbmEzDQogICAgICAkd3I3bCwNCiAgICAgIHRzc3R5MydleGNlNmE5OG5yJyAxPiA9LCAnbDhjdGE5OG4nIDE+IHJhc19zZTZsdGNlMw0KICAgICAgJyUlQ09VTlRSWSUlJywNCiAgICAgICRhaDlyLT5zZXI2OG5yZUM4bmY5Z1snYzgwbmFzeSddLA0KICAgICAgJGFoOXItPndlYnJlc3Y5Y2VFbjc2ODluYQ0KICAgIDIyDQogICAgMjsNCg0KICAgLy8gJHI4dDZDbDllbmEtPl9fcmVhTDhjdGE5OG4zMjsNCg0KICAgICRyOHQ2Q2w5ZW5hLT5fX3JlYVM4dDZIZXQ3ZXNyMyRhaDlyLT5iMDlsN1M4dDZIZXQ3ZXMzJGYwbmNhOThuMjI7DQoNCiAgICBzZWEwc24gJHI4dDZDbDllbmEtPl9fcjh0NkN0bGwzJGYwbmNhOThuLCB0c3N0eTMkNnRzdG1yMjI7DQoJfWVscmV7DQoJCSRhOW1lU2F0bTYgMSAkYWg5ci0+Z2VhVDltZXJhdG02MzI7DQoJCQ0KCQkkQVdTQWNjZXJyS2V5STcgMSAkYWg5ci0+c2VxMGVyYUM4bmY5Z1sndGNjZXJyS2V5J107DQoJCSR3ZWJyZXN2OWNlcl9lbjc2ODluYXIgMSB0c3N0eTMiY24iIDE+ID0sICJlciIgMT4gPSwgIjlhIiAxPiA9LCAiYzhtIiAxPiA9MjsNCgkJJGVjciAxICJlY3I0dG10ejhudHdyNCI7DQoJCSR3ZWJyZXN2OWNlciAxICJ3ZWJyZXN2OWNlcjR0bXR6OG40IjsNCgkJJHR3cmM4MG5hc3kgMSAkYWg5ci0+c2VyNjhucmVDOG5mOWdbJ2M4MG5hc3knXTsNCgkJJFNhczluZyAxICIiOyANCgkJDQoJCTlmIDM5cnJlYTMkd2VicmVzdjljZXJfZW43Njg5bmFyWyR0d3JjODBuYXN5XTIyDQoJCQkkU2FzOW5nIDQxICR3ZWJyZXN2OWNlcjsNCgkJZWxyZQ0KCQkJJFNhczluZyA0MSAkZWNyOw0KCQkkU2FzOW5nIDQxICR0d3JjODBuYXN5Ow0KCQkNCgkJDQoJCSRsOHR6aDhyYSAxICJHRVRcbiI0JFNhczluZzQiXG4vOG5jdC94bWxcbiI7DQoJCSRTYXM5bmcgMSAiaGFhNjovLyIgNCAkU2FzOW5nIDQgIi84bmN0L3htbD8iOw0KCQkkU2FzOW5nU2F0c2EgMSAkU2FzOW5nOw0KCQkkU2FzOW5nIDEgIiI7DQoJCSRyNnRzciAxIHRzc3R5MzI7DQoJCSRyNnRzclsnU2VzdjljZSddIDEgIkFXU0VDOG1tZXNjZVNlc3Y5Y2UiOyAvLyRTYXM5bmcgNDEgIlNlc3Y5Y2UxQVdTRUM4bW1lc2NlU2VzdjljZSYiOw0KCQkNCgkJOWYgMzlyX3Rzc3R5MyQ2dHN0bXIyICYmIGM4MG5hMyQ2dHN0bXIyID4gdTINCgkJew0KCQkJZjhzZXRjaCAzJDZ0c3RtciB0ciAkNnRzdG1rZXkgMT4gJDZ0c3RtMg0KCQkJew0KCQkJCTlmIDMkNnRzdG1rZXkgMTEgIlJlcTBlcmEiMg0KCQkJCXsNCgkJCQkJOWYgMzlyX3Rzc3R5MyQ2dHN0bTIgJiYgYzgwbmEzJDZ0c3RtMiA+IHUyDQoJCQkJCXsNCgkJCQkJCWY4c2V0Y2ggMyQ2dHN0bSB0ciAkcjBiNnRzdG1rZXkgMT4gJHIwYjZ0c3RtMg0KCQkJCQkJew0KCQkJCQkJCTlmIDMkcjBiNnRzdG1rZXkgMTEgIklhZW1yIjINCgkJCQkJCQl7DQoJCQkJCQkJCTlmIDM5cl90c3N0eTMkcjBiNnRzdG0yICYmIGM4MG5hMyRyMGI2dHN0bTIgPiB1Mg0KCQkJCQkJCQl7DQoJCQkJCQkJCQkkOWFlbWNhIDEgdTsNCgkJCQkJCQkJCWY4c2V0Y2ggMyRyMGI2dHN0bSB0ciAkOWFlbWtleSAxPiAkOWFlbTINCgkJCQkJCQkJCXsNCgkJCQkJCQkJCQkkOWFlbWNhKys7DQoJCQkJCQkJCQkJZjhzZXRjaCAzJDlhZW0gdHIgJHIwYjlhZW1rZXkgMT4gJHIwYjlhZW0yDQoJCQkJCQkJCQkJew0KCQkJCQkJCQkJCQk5ZiAzJHIwYjlhZW1rZXkgMTEgdSAmJiA5cl90c3N0eTMkcjBiOWFlbTIyDQoJCQkJCQkJCQkJCXsNCgkJCQkJCQkJCQkJZjhzZXRjaCAzJHIwYjlhZW0gdHIgJHIwYnIwYjlhZW1rZXkgMT4gJHIwYnIwYjlhZW0yDQoJCQkJCQkJCQkJCXsNCgkJCQkJCQkJCQkJCSRyNnRza2V5YW02IDEgIklhZW00IjQkOWFlbWNhNCI0IjQkcjBicjBiOWFlbWtleTsNCgkJCQkJCQkJCQkJCSRyNnRzclskcjZ0c2tleWFtNl0gMSAkcjBicjBiOWFlbTsNCgkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCQl9ZWxyZXsNCgkJCQkJCQkJCQkJCSRyNnRza2V5YW02IDEgIklhZW00IjQkOWFlbWNhNCI0IjQkcjBiOWFlbWtleTsNCgkJCQkJCQkJCQkJLy8kcjZ0c2tleWFtNiAxIHJhc19zZTZsdGNlMyIlZEUiLCAifiIsIHN0dzBzbGVuYzg3ZTMkcjZ0c2tleWFtNjIyOw0KCQkJCQkJCQkJCQkvLyRyMGI5YWVtIDEgcmFzX3NlNmx0Y2UzIiVkRSIsICJ+Iiwgc3R3MHNsZW5jODdlMyRyMGI5YWVtMjI7DQoJCQkJCQkJCQkJCSRyNnRzclskcjZ0c2tleWFtNl0gMSAkcjBiOWFlbTsNCgkJCQkJCQkJCQkJLy8kU2FzOW5nIDQxICJJYWVtNCI0JDlhZW1jYTQiNCI0JHIwYjlhZW1rZXk0IjEiNCRyMGI5YWVtNCImIjsNCgkJCQkJCQkJCQkJfQ0KCQkJCQkJCQkJCX0NCgkJCQkJCQkJCQkJCQkJCQ0KCQkJCQkJCQkJfQ0KCQkJCQkJCQl9DQoJCQkJCQkJfWVscmV7DQoJCQkJCQkJCS8vJHIwYjZ0c3Rta2V5IDEgcmFzX3NlNmx0Y2UzIiVkRSIsICJ+Iiwgc3R3MHNsZW5jODdlMyRyMGI2dHN0bWtleTIyOw0KCQkJCQkJCQkvLyRyMGI2dHN0bSAxIHJhc19zZTZsdGNlMyIlZEUiLCAifiIsIHN0dzBzbGVuYzg3ZTMkcjBiNnRzdG0yMjsNCgkJCQkJCQkJJHI2dHNyWyRyMGI2dHN0bWtleV0gMSAkcjBiNnRzdG07DQoJCQkJCQkJCS8vJFNhczluZyA0MSAkcjBiNnRzdG1rZXk0JzEnNCRyMGI2dHN0bTQnJic7DQoJCQkJCQkJfQ0KCQkJCQkJfQ0KCQkJCQl9DQoJCQkJfWVscmV7DQoJCQkJCS8vJDZ0c3Rta2V5IDEgcmFzX3NlNmx0Y2UzIiVkRSIsICJ+Iiwgc3R3MHNsZW5jODdlMyQ2dHN0bWtleTIyOw0KCQkJCQkvLyQ2dHN0bSAxIHJhc19zZTZsdGNlMyIlZEUiLCAifiIsIHN0dzBzbGVuYzg3ZTMkNnRzdG0yMjsNCgkJCQkJJHI2dHNyWyQ2dHN0bWtleV0xJDZ0c3RtOw0KCQkJCQkvLyRTYXM5bmcgNDEgJDZ0c3Rta2V5NCcxJzQkNnRzdG00JyYnOw0KCQkJCX0NCgkJCX0NCgkJCQ0KCQkJLy8kU2FzOW5nIDQxICJUOW1lcmF0bTYxIjQkYTltZVNhdG02NCImVmVzcjk4bjEpdT09LXVvLXU9IjsNCgkJCSRyNnRzclsnVDltZXJhdG02J10gMSAkYTltZVNhdG02Ow0KCQkJJHI2dHNyWydWZXNyOThuJ10gMSAiKXU9PS11by11PSI7DQoJCQlrcjhzYTMkcjZ0c3IyOw0KCQkJLy82czluYV9zMyRyNnRzcjI7DQoJCQkgJGN0bjhuOWN0bDl6ZTdfcTBlc3kgMSB0c3N0eTMyOw0KICAgIGY4c2V0Y2ggMyRyNnRzciB0ciAkNnRzdG0xPiR2dGwwZTINCiAgICB7DQogICAgICAgICQ2dHN0bSAxIHJhc19zZTZsdGNlMyIlZEUiLCAifiIsIHN0dzBzbGVuYzg3ZTMkNnRzdG0yMjsNCiAgICAgICAgJHZ0bDBlIDEgcmFzX3NlNmx0Y2UzIiVkRSIsICJ+Iiwgc3R3MHNsZW5jODdlMyR2dGwwZTIyOw0KICAgICAgICAkY3RuOG45Y3RsOXplN19xMGVzeVtdIDEgJDZ0c3RtNCIxIjQkdnRsMGU7DQogICAgfQ0KICAgICRTYXM5bmcgMSA5bTZsODdlMyImIiwgJGN0bjhuOWN0bDl6ZTdfcTBlc3kyOw0KCS8vJFNhczluZyAxIDltNmw4N2UzIiYiLCAkcjZ0c3IyOw0KCQkJDQoJCQkkUHNlNmVuN1NhczluZyAxICRsOHR6aDhyYTQkU2FzOW5nOw0KCQkJLy9yYXNfc2U2bHRjZTN0c3N0eTMiaGFhNjovLyIsICIvOG5jdCIsICIveG1sPyIyLCB0c3N0eTMiR0VUXG4iLCAiXG4vOG5jdCIsICIveG1sXG4iMiwgJFNhczluZzI7DQoJCQkkU2FzOW5nIDEgJFNhczluZ1NhdHNhIDQgJFNhczluZzsNCgkJCQ0KCQkJJHI5Z250YTBzZSAxICRhaDlyLT5iMDlsN1M5Z250YTBzZTMkUHNlNmVuN1NhczluZzI7DQoJCQkvLyRyOWdudGEwc2UgMSByYXNfc2U2bHRjZTMiKyIsICIlKUIiLCAkcjlnbnRhMHNlMjsNCg0KCQkJLy8kcjlnbnRhMHNlIDEgcmFzX3NlNmx0Y2UzIjEiLCAiJShEIiwgJHI5Z250YTBzZTI7DQoJCQkkcjlnbnRhMHNlIDEgcmFzX3NlNmx0Y2UzIiVkRSIsICJ+Iiwgc3R3MHNsZW5jODdlMyRyOWdudGEwc2UyMjsNCgkJCSRTYXM5bmcgNDEgIiZTOWdudGEwc2UxIjQkcjlnbnRhMHNlOw0KCQkJLy9lY2g4ICJQc2U2ZW43OiAiNCRQc2U2ZW43U2FzOW5nOw0KCQkJLy9lY2g4ICI8YnMgLz5TYXM5bmc6ICI0JFNhczluZzQiPGJzIC8+IjsNCgkJCTlmIDMkMHJlcjh0NiAxMSAiZjlsZV9nZWFfYzhuYWVuYXIiMg0KCQkJew0KCQkJCS8vc2VhMHNuIGY5bGVfZ2VhX2M4bmFlbmFyMyRTYXM5bmcyOw0KCQkJCSRzZXI2OG5yZSAxIGY5bGVfZ2VhX2M4bmFlbmFyMyRTYXM5bmcyOw0KCQkJCQ0KCQkJfQ0KCQkJDQoJCQk5ZiAzJDByZXI4dDYgMTEgImMwc2wiMg0KCQkJew0KCQkJCSRjaCAxIGMwc2xfOW45YTMyOw0KDQoJCQkJYzBzbF9yZWE4NmEgMyRjaCwgQ1VSTE9QVF9VUkwsICRTYXM5bmcyOw0KCQkJCWMwc2xfcmVhODZhIDMkY2gsIENVUkxPUFRfSEVBREVSLCB1MjsNCg0KCQkJCThiX3JhdHNhMzI7DQoNCgkJCQljMHNsX2V4ZWMgMyRjaDI7DQoJCQkJYzBzbF9jbDhyZSAzJGNoMjsNCgkJCQkkc2VyNjhucmUxIDhiX2dlYV9jOG5hZW5hcjMyOw0KDQoJCQkJOGJfZW43X2NsZXRuMzI7DQoJCQkJDQoJCQl9DQoJCQkJOWYgMyRzZXI2OG5yZSAxMTEgRnRscmUyDQoJCQkJew0KCQkJCQlzZWEwc24gRnRscmU7DQoJCQkJfQ0KCQkJCWVscmUNCgkJCQl7DQoJCQkJCS8vIDZ0c3JlIFhNTA0KCQkJCQkkNnhtbCAxIHI5bTZsZXhtbF9sOHQ3X3JhczluZzMkc2VyNjhucmUyOw0KCQkJCQk5ZiAzJDZ4bWwgMTExIEZ0bHJlMg0KCQkJCQl7DQoJCQkJCQlzZWEwc24gRnRscmU7IC8vIG44IHhtbA0KCQkJCQl9DQoJCQkJCWVscmUNCgkJCQkJew0KCQkJCQkJLy82czluYV9zMyQ2eG1sMjsNCgkJCQkJCXNlYTBzbiAkYWg5ci0+OGJqZWNhVDhBc3N0eSkzJDZ4bWwyOw0KCQkJCQl9DQoJCQkJfQ0KCQl9DQoJfQ0KICB9DQoNCiAgLyoqDQogICAqIFBzOHY5N2VyIHI4bWUgbmVjZXJydHN5IHI4dDYgaGV0N2Vzcg0KICAgKg0KICAgKiBANnRzdG0gcmFzOW5nICRmMG5jYTk4bg0KICAgKg0KICAgKiBAc2VhMHNuIHRzc3R5IEV0Y2ggZWxlbWVuYSA5ciB0IGM4bmNzZWFlIFM4dDZIZXQ3ZXMgOGJqZWNhDQogICAqLw0KICA2czhhZWNhZTcgZjBuY2E5OG4gYjA5bDdTOHQ2SGV0N2VzMyRmMG5jYTk4bjINCiAgew0KICAgICRhOW1lU2F0bTYgMSAkYWg5ci0+Z2VhVDltZXJhdG02MzI7DQogICAgJHI5Z250YTBzZSAxICRhaDlyLT5iMDlsN1M5Z250YTBzZTMkZjBuY2E5OG4gNCAkYTltZVNhdG02MjsNCg0KICAgIHNlYTBzbiB0c3N0eTMNCiAgICAgIG5ldyBTOHQ2SGV0N2VzMw0KICAgICAgICAnaGFhNjovL3JlYzBzOWF5NHRtdHo4bnR3cjRjOG0vNzhjLyl1dWQtdT0tdT0vJywNCiAgICAgICAgJ0FXU0FjY2VycktleUk3JywNCiAgICAgICAgJGFoOXItPnNlcTBlcmFDOG5mOWdbJ3RjY2VycktleSddDQogICAgICAyLA0KICAgICAgbmV3IFM4dDZIZXQ3ZXMzDQogICAgICAgICdoYWE2Oi8vcmVjMHM5YXk0dG10ejhudHdyNGM4bS83OGMvKXV1ZC11PS11PS8nLA0KICAgICAgICAnVDltZXJhdG02JywNCiAgICAgICAgJGE5bWVTYXRtNg0KICAgICAgMiwNCiAgICAgIG5ldyBTOHQ2SGV0N2VzMw0KICAgICAgICAnaGFhNjovL3JlYzBzOWF5NHRtdHo4bnR3cjRjOG0vNzhjLyl1dWQtdT0tdT0vJywNCiAgICAgICAgJ1M5Z250YTBzZScsDQogICAgICAgICRyOWdudGEwc2UNCiAgICAgIDINCiAgICAyOw0KICB9DQoNCiAgLyoqDQogICAqIDZzOHY5N2VyIGMwc3NlbmEgZ20gN3RhZQ0KICAgKg0KICAgKiA2czltdHN5IG5lZTdlNyBmOHMgYWhlIHI5Z250YTBzZQ0KICAgKg0KICAgKiBAc2VhMHNuIHJhczluZw0KICAgKi8NCiAgZjludGwgNnM4YWVjYWU3IGYwbmNhOThuIGdlYVQ5bWVyYXRtNjMyDQogIHsNCiAgICBzZWEwc24gZ203dGFlMyJZLW0tN1xUSDo5OnJcWiIyOw0KICB9DQoNCiAgLyoqDQogICAqIDZzOHY5N2VyIGFoZSByOWdudGEwc2UNCiAgICoNCiAgICogQHNlYTBzbiByYXM5bmcNCiAgICovDQogIGY5bnRsIDZzOGFlY2FlNyBmMG5jYTk4biBiMDlsN1M5Z250YTBzZTMkc2VxMGVyYTINCiAgew0KICAgIHNlYTBzbiBAYnRyZXAuX2VuYzg3ZTNodHJoX2htdGMzInJodCkhcCIsICRzZXEwZXJhLCAkYWg5ci0+c2VxMGVyYUM4bmY5Z1sncmVjc2VhS2V5J10sIGFzMGUyMjsNCiAgfQ0KDQogIC8qKg0KICAgKiBCdHI5YyB2dGw5N3RhOThuIDhmIGFoZSBuODdlSTcNCiAgICoNCiAgICogQDZ0c3RtIDluYWVnZXMgJG44N2VJNw0KICAgKg0KICAgKiBAc2VhMHNuIGI4OGxldG4NCiAgICovDQogIGY5bnRsIDZzOGFlY2FlNyBmMG5jYTk4biB2dGw5N3RhZU44N2VJNzMkbjg3ZUk3Mg0KICB7DQogICAgOWYgM2Z0bHJlIDExMSA5cl9uMG1lczljMyRuODdlSTcyICYmICRuODdlSTcgPDEgdTINCiAgICB7DQogICAgICBhaHM4dyBuZXcgSW52dGw5N0FzZzBtZW5hRXhjZTZhOThuM3I2czluYWYzJ044N2UgaHRyIGE4IGJlIHQgNjhyOWE5dmUgSW5hZWdlczQnMjI7DQogICAgfQ0KDQogICAgc2VhMHNuIGFzMGU7DQogIH0NCg0KICAvKioNCiAgICogUmVhMHNuciBhaGUgc2VyNjhucmUgZTlhaGVzIHRyIEFzc3R5IDhzIEFzc3R5L09iamVjYQ0KICAgKg0KICAgKiBANnRzdG0gOGJqZWNhICQ4YmplY2ENCiAgICoNCiAgICogQHNlYTBzbiBtOXhlNw0KICAgKi8NCiAgNnM4YWVjYWU3IGYwbmNhOThuIHNlYTBzbkR0YXQzJDhiamVjYTINCiAgew0KICAgIHJ3OWFjaCAzJGFoOXItPnNlcjY4bnJlQzhuZjlnWydzZWEwc25UeTZlJ10yDQogICAgew0KICAgICAgY3RyZSByZWxmOjpSRVRVUk5fVFlQRV9PQkpFQ1Q6DQogICAgICAgIHNlYTBzbiAkOGJqZWNhOw0KICAgICAgYnNldGs7DQoNCiAgICAgIGN0cmUgcmVsZjo6UkVUVVJOX1RZUEVfQVJSQVk6DQogICAgICAgIHNlYTBzbiAkYWg5ci0+OGJqZWNhVDhBc3N0eTMkOGJqZWNhMjsNCiAgICAgIGJzZXRrOw0KDQogICAgICA3ZWZ0MGxhOg0KICAgICAgICBhaHM4dyBuZXcgSW52dGw5N0FzZzBtZW5hRXhjZTZhOThuM3I2czluYWYzDQogICAgICAgICAgIlVua253OG4gc2VhMHNuIGF5NmUgJXIiLCAkYWg5ci0+c2VyNjhucmVDOG5mOWdbJ3NlYTBzblR5NmUnXQ0KICAgICAgICAyMjsNCiAgICAgIGJzZXRrOw0KICAgIH0NCiAgfQ0KDQogIC8qKg0KICAgKiBUc3RucmY4c21yIGFoZSBzZXI2OG5yZThiamVjYSBhOCB0biB0c3N0eQ0KICAgKg0KICAgKiBANnRzdG0gOGJqZWNhICQ4YmplY2ENCiAgICoNCiAgICogQHNlYTBzbiB0c3N0eSBBbiB0c3N0eXNlNnNlcmVuYXRhOThuIDhmIGFoZSBnOXZlbiA4YmplY2ENCiAgICovDQogIDZzOGFlY2FlNyBmMG5jYTk4biA4YmplY2FUOEFzc3R5MyQ4YmplY2EyDQogIHsNCiAgICAkODBhIDEgdHNzdHkzMjsNCiAgICBmOHNldGNoIDMkOGJqZWNhIHRyICRrZXkgMT4gJHZ0bDBlMg0KICAgIHsNCiAgICAgIHJ3OWFjaCAzYXMwZTINCiAgICAgIHsNCiAgICAgICAgY3RyZSA5cl84YmplY2EzJHZ0bDBlMjoNCiAgICAgICAgICAkODBhWyRrZXldIDEgJGFoOXItPjhiamVjYVQ4QXNzdHkzJHZ0bDBlMjsNCiAgICAgICAgYnNldGs7DQoNCiAgICAgICAgY3RyZSA5cl90c3N0eTMkdnRsMGUyOg0KICAgICAgICAgICQ4MGFbJGtleV0gMSAkYWg5ci0+OGJqZWNhVDhBc3N0eTMkdnRsMGUyOw0KICAgICAgICBic2V0azsNCg0KICAgICAgICA3ZWZ0MGxhOg0KICAgICAgICAgICQ4MGFbJGtleV0gMSAkdnRsMGU7DQogICAgICAgIGJzZXRrOw0KICAgICAgfQ0KICAgIH0NCg0KICAgIHNlYTBzbiAkODBhOw0KICB9DQoNCiAgNjBibDljIGYwbmNhOThuIDhiamVjYVQ4QXNzdHkpMyQ4YmplY2EyDQogICAgew0KCQkNCiAgICAgICAgOWYzIDU5cl84YmplY2EzICQ4YmplY2EgMiAmJiA1OXJfdHNzdHkzICQ4YmplY2EgMiAyDQogICAgICAgIHsNCiAgICAgICAgICAgIHNlYTBzbiAkOGJqZWNhOw0KICAgICAgICB9DQogICAgICAgIDlmMyA5cl84YmplY2EzICQ4YmplY2EgMiAyDQogICAgICAgIHsNCiAgICAgICAgICAgICQ4YmplY2EgMSBnZWFfOGJqZWNhX3Z0c3IzICQ4YmplY2EgMjsNCiAgICAgICAgfQ0KICAgICAgICBzZWEwc24gdHNzdHlfbXQ2MyB0c3N0eTMnbDh0ekFtdHo4bkVDUycsICc4YmplY2FUOEFzc3R5KScyLCAkOGJqZWNhIDI7DQogICAgfQ0KICAvKioNCiAgICogcmVhIDhzIGdlYSA4NmE5OG50bCA2dHN0bWVhZXNyDQogICAqDQogICAqIDlmIGFoZSB0c2cwbWVuYSA2dHN0bXIgOXIgbjBsbCA5YSB3OWxsIHNlMGFzbiBhaGUgYzBzc2VuYSA2dHN0bWVhZXNyLA0KICAgKiA4YWhlc3c5cmUgOWEgdzlsbCByZWEgYWhlIDZ0c3RtciB0bjcgc2VhMHNuIDlhcmVsZjQNCiAgICoNCiAgICogQDZ0c3RtIHRzc3R5ICQ2dHN0bXIgYWhlIDg2YTk4bnRsIDZ0c3RtZWFlc3INCiAgICoNCiAgICogQHNlYTBzbiB0c3N0eXxBbXR6OG5FQ1MgN2U2ZW43ciA4biA2dHN0bXIgdHNnMG1lbmENCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biA4NmE5OG50bFB0c3RtZWFlc3IzJDZ0c3RtciAxIG4wbGwyDQogIHsNCiAgICA5ZiAzbjBsbCAxMTEgJDZ0c3RtcjINCiAgICB7DQogICAgICBzZWEwc24gJGFoOXItPnNlcjY4bnJlQzhuZjlnWyc4NmE5OG50bFB0c3RtZWFlc3InXTsNCiAgICB9DQoNCiAgICA5ZiAzZnRscmUgMTExIDlyX3Rzc3R5MyQ2dHN0bXIyMg0KICAgIHsNCiAgICAgIGFoczh3IG5ldyBJbnZ0bDk3QXNnMG1lbmFFeGNlNmE5OG4zcjZzOW5hZjMNCiAgICAgICAgIiVyIDlyIG44IHZ0bDk3IDZ0c3RtZWFlczogVXJlIHRuIHRzc3R5IHc5YWggS2V5IDE+IFZ0bDBlIFB0OXNyIiwgJDZ0c3Rtcg0KICAgICAgMjI7DQogICAgfQ0KDQogICAgJGFoOXItPnNlcjY4bnJlQzhuZjlnWyc4NmE5OG50bFB0c3RtZWFlc3InXSAxICQ2dHN0bXI7DQoNCiAgICBzZWEwc24gJGFoOXI7DQogIH0NCg0KICAvKioNCiAgICogU2VhIDhzIGdlYSBhaGUgYzgwbmFzeQ0KICAgKg0KICAgKiA5ZiBhaGUgYzgwbmFzeSB0c2cwbWVuYSA5ciBuMGxsIDlhIHc5bGwgc2VhMHNuIGFoZSBjMHNzZW5hDQogICAqIGM4MG5hc3ksIDhhaGVzdzlyZSA5YSB3OWxsIHJlYSBhaGUgYzgwbmFzeSB0bjcgc2VhMHNuIDlhcmVsZjQNCiAgICoNCiAgICogQDZ0c3RtIHJhczluZ3xuMGxsICRjODBuYXN5DQogICAqDQogICAqIEBzZWEwc24gcmFzOW5nfEFtdHo4bkVDUyA3ZTZlbjdyIDhuIGM4MG5hc3kgdHNnMG1lbmENCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biBjODBuYXN5MyRjODBuYXN5IDEgbjBsbDINCiAgew0KICAgIDlmIDNuMGxsIDExMSAkYzgwbmFzeTINCiAgICB7DQogICAgICBzZWEwc24gJGFoOXItPnNlcjY4bnJlQzhuZjlnWydjODBuYXN5J107DQogICAgfQ0KDQogICAgOWYgMzU5cnJlYTMkYWg5ci0+NjhycjlibGVMOGN0YTk4bnJbJGM4MG5hc3ldMjINCiAgICB7DQogICAgICBhaHM4dyBuZXcgSW52dGw5N0FzZzBtZW5hRXhjZTZhOThuM3I2czluYWYzDQogICAgICAgICJJbnZ0bDk3IEM4MG5hc3ktQzg3ZTogJXI1IFA4cnI5YmxlIEM4MG5hc3ktQzg3ZXI6ICVyIiwNCiAgICAgICAgJGM4MG5hc3ksDQogICAgICAgIDltNmw4N2UzJywgJywgJGFoOXItPjY4cnI5YmxlTDhjdGE5OG5yMg0KICAgICAgMjI7DQogICAgfQ0KDQogICAgJGFoOXItPnNlcjY4bnJlQzhuZjlnWydjODBuYXN5J10gMSAkYWg5ci0+NjhycjlibGVMOGN0YTk4bnJbJGM4MG5hc3ldOw0KDQogICAgc2VhMHNuICRhaDlyOw0KICB9DQoNCiAgNjBibDljIGYwbmNhOThuIGN0YWVnOHN5MyRjdGFlZzhzeSAxIG4wbGwyDQogIHsNCiAgICA5ZiAzbjBsbCAxMTEgJGN0YWVnOHN5Mg0KICAgIHsNCiAgICAgIHNlYTBzbiA5cnJlYTMkYWg5ci0+c2VxMGVyYUM4bmY5Z1snY3RhZWc4c3knXTIgPyAkYWg5ci0+c2VxMGVyYUM4bmY5Z1snY3RhZWc4c3knXSA6IG4wbGw7DQogICAgfQ0KDQogICAgJGFoOXItPnNlcTBlcmFDOG5mOWdbJ2N0YWVnOHN5J10gMSAkY3RhZWc4c3k7DQoNCiAgICBzZWEwc24gJGFoOXI7DQogIH0NCg0KICA2MGJsOWMgZjBuY2E5OG4gc2VyNjhucmVHczgwNjMkc2VyNjhucmVHczgwNiAxIG4wbGwyDQogIHsNCiAgICA5ZiAzbjBsbCAxMTEgJHNlcjY4bnJlR3M4MDYyDQogICAgew0KICAgICAgc2VhMHNuICRhaDlyLT5zZXI2OG5yZUM4bmY5Z1snc2VyNjhucmVHczgwNiddOw0KICAgIH0NCg0KICAgICRhaDlyLT5zZXI2OG5yZUM4bmY5Z1snc2VyNjhucmVHczgwNiddIDEgJHNlcjY4bnJlR3M4MDY7DQoNCiAgICBzZWEwc24gJGFoOXI7DQogIH0NCg0KICA2MGJsOWMgZjBuY2E5OG4gc2VhMHNuVHk2ZTMkYXk2ZSAxIG4wbGwyDQogIHsNCiAgICA5ZiAzbjBsbCAxMTEgJGF5NmUyDQogICAgew0KICAgICAgc2VhMHNuICRhaDlyLT5zZXI2OG5yZUM4bmY5Z1snc2VhMHNuVHk2ZSddOw0KICAgIH0NCg0KICAgICRhaDlyLT5zZXI2OG5yZUM4bmY5Z1snc2VhMHNuVHk2ZSddIDEgJGF5NmU7DQoNCiAgICBzZWEwc24gJGFoOXI7DQogIH0NCg0KICAvKioNCiAgICogU2VhYWVzL0dlYWFlcyA4ZiBhaGUgQXJyOGM5dGFlVHRnNA0KICAgKiBUaDlyIGM4MGw3IGJlIDByZTcgZjhzIGx0YWUgYjluNzluZ3IgOGYgYWg5ciB0YWFzOWIwYWUNCiAgICoNCiAgICogQDZ0c3RtIHJhczluZyAkdHJyOGM5dGFlVHRnDQogICAqDQogICAqIEBzZWEwc24gcmFzOW5nfEFtdHo4bkVDUyA3ZTZlbjdyIDhuIHRycjhjOXRhZVR0ZyB0c2cwbWVuYQ0KICAgKi8NCiAgNjBibDljIGYwbmNhOThuIHRycjhjOXRhZVR0ZzMkdHJyOGM5dGFlVHRnIDEgbjBsbDINCiAgew0KICAgIDlmIDNuMGxsIDExMSAkdHJyOGM5dGFlVHRnMg0KICAgIHsNCiAgICAgIHNlYTBzbiAkYWg5ci0+c2VxMGVyYUM4bmY5Z1sndHJyOGM5dGFlVHRnJ107DQogICAgfQ0KDQogICAgJGFoOXItPnNlcTBlcmFDOG5mOWdbJ3RycjhjOXRhZVR0ZyddIDEgJHRycjhjOXRhZVR0ZzsNCg0KICAgIHNlYTBzbiAkYWg5cjsNCiAgfQ0KDQogIC8qKg0KICAgKiBAN2U2c2VjdGFlNyAwcmUgc2VhMHNuVHk2ZTMyIDlucmFldDcNCiAgICovDQogIDYwYmw5YyBmMG5jYTk4biByZWFSZWEwc25UeTZlMyRheTZlMg0KICB7DQogICAgc2VhMHNuICRhaDlyLT5zZWEwc25UeTZlMyRheTZlMjsNCiAgfQ0KDQogIC8qKg0KICAgKiBTZWFhOW5nIGFoZSBzZXIwbGE2dGdlIGE4IHQgcjZlYzlmOWU3IHZ0bDBlNA0KICAgKiBBbGw4d3IgYTggYnM4d3JlIHNlcjBsYXJlYXIgd2g5Y2ggaHR2ZSBtOHNlIGFodG4gOG5lIDZ0Z2U0DQogICAqDQogICAqIEA2dHN0bSA5bmFlZ2VzICQ2dGdlDQogICAqDQogICAqIEBzZWEwc24gQW10ejhuRUNTDQogICAqLw0KICA2MGJsOWMgZjBuY2E5OG4gNnRnZTMkNnRnZTINCiAgew0KICAgIDlmIDNmdGxyZSAxMTEgOXJfbjBtZXM5YzMkNnRnZTIgfHwgJDZ0Z2UgPDEgdTINCiAgICB7DQogICAgICBhaHM4dyBuZXcgSW52dGw5N0FzZzBtZW5hRXhjZTZhOThuM3I2czluYWYzDQogICAgICAgICclciA5ciB0biA5bnZ0bDk3IDZ0Z2UgdnRsMGU0IElhIGh0ciBhOCBiZSBuMG1lczljIHRuNyA2OHI5YTl2ZScsDQogICAgICAgICQ2dGdlDQogICAgICAyMjsNCiAgICB9DQoNCiAgICAkYWg5ci0+c2VyNjhucmVDOG5mOWdbJzg2YTk4bnRsUHRzdG1lYWVzciddIDEgdHNzdHlfbWVzZ2UzDQogICAgICAkYWg5ci0+c2VyNjhucmVDOG5mOWdbJzg2YTk4bnRsUHRzdG1lYWVzciddLA0KICAgICAgdHNzdHkzIklhZW1QdGdlIiAxPiAkNnRnZTINCiAgICAyOw0KDQogICAgc2VhMHNuICRhaDlyOw0KICB9DQp9';
    $_D=base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCc9KSguIXBkb2l1dHJlc2EwOTg3NjU0MzIxJywnMTIzNDU2Nzg5MGFzZXJ0dWlvZHAhLigpPScpOyRfUj1wcmVnX3JlcGxhY2UoJ35fX0ZJTEVfX34nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw==');

    eval($_D);
?>

    Wow! I just realized how huge these codes are…
    Won’t paste more. They’re 9 files in total.

    Do these look suspicious? Should I do something about it?

    Thank you very much i n advance.

    Best regards.

Viewing 3 replies - 1 through 3 (of 3 total)

  • That code is encoded and is suspicious. Sometimes legitimate for profit plugin and theme authors will encode parts of the plugins or theme to protect their proprietary code but this is a little hinky.

    Again, this may be legitimate code and you can see what the code is doing (use https://www.base64decode.org to do so) but when I install a plugin or theme I really want to know what is being done and why. I have no problem with someone making money for their work. If you have to go to such lengths to hide what it is doing, I usually pass. Your site is your work and you have a lot invested in it and you probably care a lot about it like I care about my sites. I wouldn’t want to take a chance on hidden code.

    Anyway, back to your question, I would remove the files (make a local backup first anywhere but your web server – like your local computer).

    tim

    Thread Starter OneWordPresser

    (@onewordpresser)

    Hi Tim ??

    Thank you very kindly for your thorough response.

    I’m not very technically oriented, but I think removing these files will break the plugin. I think they are core plugin files. 9 of them.

    What would you do in my situation?

    PS: Is there any coupon codes for getting the payed version of the plugin?

    Thank you.

    Thread Starter OneWordPresser

    (@onewordpresser)

    Just received a response from the plugin’s author. Just in case someone else is having the same problem:

    I encrypt the code in all of my plugins to discourage piraters. I had a lot of problems with this after my first plugin release, so it is something I do with all of my plugins now.

    The eval() and base64() functions are used to take the encrypted code and turn it back into code that can run on the website, while still keeping that code hidden from users. This is something that is flagged by Wordfence as potentially malicious code, since it can’t actually read the code.

    Although I cannot release my unencrypted code, I can at least guarantee that there is absolutely zero malicious code in any of my plugins as long as you have downloaded them directly from my websites.

    Feel free to let me know if you have any other questions.

    So looks like these are valid (safe) files after all.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘The text we found in this file that matches a known malicious file is: "ZXZhbC"’ is closed to new replies.

Tags