ok

Mini Shell

Direktori : /proc/self/root/proc/thread-self/root/proc/self/root/usr/share/i360-php-opts/sigs/5.3/
Upload File :
Current File : //proc/self/root/proc/thread-self/root/proc/self/root/usr/share/i360-php-opts/sigs/5.3/.rulesdump

�$�J �"90�"�'�J��$�J��VBR@	Ud�$�J��$�J@.׺$�JI�$�J�b'�JXe'�J|g'�Jq'�J@78�|'�J �w'�J�'�J��$�J^k �$�J�$�Jk��'�J}�'�Jk�'�Jb�'�J��'�J��'�J+�'�J�'�JC�'�J�'�J]�'�J�'�J��'�J�'�J��'�J�'�JF�'�J|�'�J�'�J��'�J#�'�JՀ'�Jˁ'�J��'�JN�'�J6�'�J�
BRUc�$�JBR$U�k|�$�Jexeced4BRF��$�JBR$U�l�#�$�Jsystemed4BRF�$�JBR,Uト]u�$�Jpassthrued4BR F�$�J��$�J��$�JBR,U����׺$�Jshell_execed4BR,U�䎗�$�Jproc_opened4BR@F�$�Jƻ$�J��$�J��$�JBR$U��0��$�Jpopened4BR$U�!U��$�Jincludeud2BR,Ua�&�$�Jinclude_onceud2BR$UH�KQ�$�Jrequireud2BR�F��$�Jƻ$�J�$�Jҽ$�J%�$�J��$�J��$�JBR,U�{�߼$�Jrequire_onceud2BR,U��pR�$�J��$�Jcurl_initud2BR,U��nRM�$�Jcurl_execud2BR,U<�V��$�J��$�Jcurl_multi_execud2BR4Uo�Jý$�JM�$�Jfile_get_contentsfd3BR4U�O�5�$�J�$�Jfile_put_contentsfd1BR$U4
1�$�Jfopenfd3BR$U��5Q`�$�J��$�Jfwritefs1BRF�$�J��$�Jz�$�J�$�Ja�$�J5�$�J��$�J�$�Jҽ$�J%�$�J��$�J��$�J��$�Jt�$�J�$�J�$�J��$�J@�$�J\�$�JBR$U�f���$�Jsymlinkfd1BR4Upٿ$�Jmove_uploaded_filefd8BR,U�T��$�Jpreg_replacess0BR$U�Ps|?�$�Jtrimss0BR,U��n*v�$�Jstr_replacess0BR,U������$�Jrawurldecodess0BR,UA����$�Jh�$�Jbase64_decodeos0BR,UEw�~�$�Jgzinflateos0BR,Uc��@R�$�Jgzdeflateos0BR,UD���$�Jstr_rot13os0BR$U̷o|��$�Jmailgd0BR,U�s?��$�JN�$�Jfsockopengd0BR,UᙍA&�$�Jƻ$�Jsocket_connectgd0BR4U�E�e�$�Jstream_socket_clientgd0BR,UjIO��$�Jpfsockopengd0BR,Ud�N���$�Jpcntl_execds4BRU�$�J��$�J�$�Ja�$�J�$�J��$�J��$�Jҽ$�J%�$�J��$�J#�$�J��$�JZ�$�Jt�$�J�$�J��$�JG�$�Jv�$�J@�$�J�$�J��$�Jz�$�J*�$�J�$�J��$�J�$�J��$�Js�$�J��$�J��$�J�$�J��$�J4�$�J\�$�JBR<UF�'%�$�J��$�Jregister_shutdown_functionhs0BR4U��".d�$�Jregister_tick_functionis0BR,U���b��$�Jmysql_queryks0BR$UGLlO��$�Jassertld4BR,U�t��$�Jparse_ini_filems0BR,U�f~�8�$�J��$�Jshow_sourceps0BR$U��k|g�$�Jevalqd0BR,U�V&��$�Jcreate_functionrs0BR,U��c��$�Jcall_user_functs0BR4U�uw�$�J��$�Jset_exception_handlerys0BR,UO�V�K�$�Jopenssl_decryptvs0BR$U�{�z�$�Jstrrevws0BR,U�8��$�J5�$�Jgzuncompressxs0BR,U#����$�Jshellx.orgBRF��$�JBR4Uay�:�$�J��$�Jwww.hestonsflorists.comBRU
�$�JBR8U��$�J*�$�J@u�$�J,��$�JBRxU(nc|netcat|bash|sh|zsh|dash|csh|perl|curl|wget|lynx|python|id|who|whoami|cat|echo|gcc|chmod|chown|find|locate|php|cron)BR@UERCP@0}	ncqnetcatqbashqshq	zshqdashq	cshqperlqcurlqwgetqlynxqpythonqidq	whoqwhoamiq	catqechoq	gccq
chmodq
chownqfindqlocateq	phpqcronrrBR,UЫQ0PBR8U��$�J �$�Jd��$�J,��$�JBR&U(cat.{1,20}\/.{0,1}etc\/.{0,1}passwd)BRdUERCPdQcd0}0*cat[/Yetc/Ypasswdr*r0BR,UЫQ0PBR8U	�$�J��$�J���$�J,�$�JBR�U((wget|curl).{1,10}\-((o|O)|s).{1,10}htt(p|ps):\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/([a-zA-Z0-9]{1,20}\.[a-zA-Z0-9]{1,20}|[a-zA-Z0-9]{1,20}).{0,5}\|(sh|bash|perl).{1,10}(\-s|))BR�UERCP�A|0}��
wgetqcurlr[	-oqOrqsr[	httpqpsr://j�h.j�h.j�h.j�h/Sj�������h.j�������hq)j�������hr|[|	shqbashqperlr[		-sqrr�r�BR,UЫQ0PBR8US�$�J��$�J�h�$�J,BRQUphp.{1,10}\-e0\.0\.0\.0.{1,10}\-p[0-9]{4,5}.{1,10}>.{1,10}\/dev\/null.{1,10}2>&1BR�UERCP�Qp10}zphp[	-e0.0.0.0[	-pj�h[	>[	/dev/null[	2>&1rzBR,UЫQtart|logphp.{1,10}\-e0\.0\.BRXU��$�J �$�J��$�J��$�J��$�J?�$�J��$�J�$�J.�$�JT�$�J4�$�J��$�J�$�J�$�J��$�Jo�$�J=�$�Jo�$�Jt�$�Js�$�J+�$�J�$�J��$�J��$�J�$�J��$�J��$�J��$�J��$�JB�$�J��$�J��$�J��$�Jc�$�J��$�J��$�J��$�Jm�$�Js�$�JQ�$�J��$�J�$�J��$�J��$�J��$�J�$�J�$�J��$�J�$�J&�$�JH�$�J*�$�J;�$�J��$�J��$�J�$�Jo�$�J��$�J��$�J�$�Jx�$�J��$�J�$�J��$�JD�$�Jh�$�JS�$�Je�$�J��$�J0�$�J#�$�J��$�Jm�$�J��$�J��$�J8�$�J��$�J��$�J?�$�J��$�J��$�JT�$�J��$�JK�$�J �$�J��$�J��$�J;�$�J��$�J�$�J��$�J��$�JH�$�Jj�$�JBRXU�A%�J�b%�J�^%�JG&�JR�%�J�f%�J�Z%�JE�%�Jҫ%�J�%�JY�%�J��%�J�&�J�8&�J|�%�J"&�J�2%�J7k%�J��%�JsS%�J�%�JW�%�J6�%�J)&�JE%�Jb�%�JwL%�J��%�J��%�J"�%�Jz�%�J�O%�J��$�J�/%�J�3&�J�&�Ji6&�J:�%�JD�$�J�H%�J�$�J&�Jr%�J��$�J��%�JM%�J�&�JY}%�J�u%�J�+&�J��$�JD�%�J�&�J>%&�J�:%�J�N&�Jh?&�J�C&�J�V%�J�%�J"�%�J)G&�J�6%�J&�JB<&�J$�%�J|y%�JS�$�Jo%�J*Q&�J��$�J�%�J8�%�JѤ%�JK&�JD�%�J��%�J��%�J>%�J8�%�J@�%�J<�%�J�$�J�&�J��%�J�&�J�%�J8�%�J�&�Jr�%�Ju�$�J�%�J�/&�J�&�JBR!Uphp.retsoh-tilob-ia/tilob-ia/tpoBR1Uphp.tcerid-metsyselif-pw-ssalc/sedulcni/nimda-pwBRUphp.snoitcnuf/sedulcni-pwBR&Uphp.evihcra-etaerc-ssalc/cni/pupwkcabBRUphp.slitUfw/bil/ecnefdrowBR Uphp.hsaHecnefdrow/bil/ecnefdrowBRUphp.emeht-pw-ssalc/sedulcni-pwBRUphp.etalpmet/ssalc/sedulcniBR#Uphp.elif/revird/ehcac/bbphp/3BBphpBRUphp.rotide-nigulp/nimda-pwBRUphp.gifnoc-putes/nimda-pwBRUphp.csim/sedulcni/nimda-pwBRUphp.elif/sedulcni/nimda-pwBR%Uphp.elif/metsyselif/almooj/seirarbilBR3Uphp.maertSlacoL/repparWmaertS/eroC/lapurD/bil/erocBRUcni.elif/sedulcni/erocBR-Uphp.raTevihcrA/revihcrA/eroC/lapurD/bil/erocBR6Uphp.esnopseReliFyraniB/noitadnuof-ptth/ynofmys/rodnevBR"Uphp.eliF/metsyseliF/crs/seirarbilBR:Uphp.mroFtropxEtnetnoC/mroF/crs/vsc_tropxe_tnetnoc/seludomBR0Uphp.eliF/crs/metsyselif/almooj/rodnev/seirarbilBR)Uphp.snoitcnuf/crs/7rsp/ptthelzzug/rodnevBRGUphp.egarotSeliFtsaFdetcetorPemiTM/egarotSphP/tnenopmoC/lapurD/bil/erocBR(Uphp.LRUc/tropsnarT/stseuqeR/sedulcni-pwBRUcni.srepparw_maerts/sedulcniBRUcni.nommoc/sedulcniBR%Uphp.304/ytiruces-foorptellub/snigulpBR'Uphp.daol/ytiruceSPW/snigulp/tnetnoc-pwBR.Uphp.gifnoCfw/bil/ecnefdrow/snigulp/tnetnoc-pwBR6Uphp.eueuq_lexiptrohs/ssalc/resimitpo-egami-lexiptrohsBR-Uphp.gol/laicos/bil/laicos/snigulp/tnetnoc-pwBRHUphp.rennur.kcap.ssalc/egakcap/sessalc/orp-rotacilpud/snigulp/tnetnoc-pwBR=Uphp.gninedrah-sgnittes/crs/rennacs-irucus/snigulp/tnetnoc-pwBR2Uphp.ehcac/cni/ehcac-tsetsaf-pw/snigulp/tnetnoc-pwBR7Uphp.ehcaCtsetsaFpw/ehcac-tsetsaf-pw/snigulp/tnetnoc-pwBRMUphp.slitUkcoLehcaC/derahS/stiart/sedulcni/crs/ehcac-temoc/snigulp/tnetnoc-pwBR1Uphp.eliF_ehcaC/ehcac-latot-3w/snigulp/tnetnoc-pwBR/Uphp.ehcac-pw/ehcac-repus-pw/snigulp/tnetnoc-pwBRBUphp.ssalc.ksid_relbane_ehcac/cni/relbane-ehcac/snigulp/tnetnoc-pwBR:Uphp.tnemnorivnE_cireneG/ehcac-latot-3w/snigulp/tnetnoc-pwBR4Uphp.bil.tneve/crs/rennacs-irucus/snigulp/tnetnoc-pwBR=Uphp.ssalc.relbane_ehcac/cni/relbane-ehcac/snigulp/tnetnoc-pwBR8Uphp.bil.gninedrah/crs/rennacs-irucus/snigulp/tnetnoc-pwBRKUphp.slitUllatsnI/nigulP/stiart/sedulcni/crs/ehcac-temoc/snigulp/tnetnoc-pwBR6Uphp.2esahp-ehcac-pw/ehcac-repus-pw/snigulp/tnetnoc-pwBR4Uphp.bil.ehcac/crs/rennacs-irucus/snigulp/tnetnoc-pwBR0Uphp.eluR_litU/ehcac-latot-3w/snigulp/tnetnoc-pwBRNUphp.elif/egarots/bil/crs/faw-fw/ecnefdrow/rodnev/ecnefdrow/snigulp/tnetnoc-pwBR6Uphp.bil.dnammoc/crs/rennacs-irucus/snigulp/tnetnoc-pwBR2Uphp.eliFpW_litU/ehcac-latot-3w/snigulp/tnetnoc-pwBR*Uphp.nigulp/ehcac-repyh/snigulp/tnetnoc-pwBR+Uphp.snoitpo/ehcac-repyh/snigulp/tnetnoc-pwBRCUphp.eliF/ehcaC/yfiniM/yfiniM/bil/ehcac-latot-3w/snigulp/tnetnoc-pwBR5Uphp.snigoltsal/crs/rennacs-irucus/snigulp/tnetnoc-pwBR2Uphp.nimda/cni/ehcac-tsetsaf-pw/snigulp/tnetnoc-pwBR0Uphp.eliF_litU/ehcac-latot-3w/snigulp/tnetnoc-pwBR9Uphp.cireneG_eliF_ehcaC/ehcac-latot-3w/snigulp/tnetnoc-pwBR5Uphp.bil.noitpo/crs/rennacs-irucus/snigulp/tnetnoc-pwBR<Uphp.deliaf-snigoltsal/crs/rennacs-irucus/snigulp/tnetnoc-pwBR(Uphp.snoitcnuf/SMS2boM/semeht/tnetnoc-pwBR'Uphp.snoitcnuf/egdirb/semeht/tnetnoc-pwBR)Uphp.snoitcnuf/vc-tfihs/semeht/tnetnoc-pwBR*Uphp.snoitcnuf/rzimotsuc/semeht/tnetnoc-pwBR&Uphp.snoitcnuf/artsa/semeht/tnetnoc-pwBR-Uphp.snoitcnuf/pohs2yrotcaf/semeht/tnetnoc-pwBR-Uphp.slitUfw/bil/ecnefdrow/snigulp/tnetnoc-pwBR3Uphp.hsaHecnefdrow/bil/ecnefdrow/snigulp/tnetnoc-pwBR6Uphp.rennacSecnefdrow/bil/ecnefdrow/snigulp/tnetnoc-pwBRUlmthp.daeh/lmth/egap/etalpmetBR'Uphp.ssalc.llawerif/llawerif/ezylanabewBR
Uphp.bmuhtmitBR$Uphp.gniggol.cnuf/cnuf/edulcni/erotsBRUphp.snoitcnuf/stnofBR+Ussalc.mroftalPyrellaG/sessalc/eroc/seludomBRUphp.reggoLnomE/biLBR1Uphp.elif_etirw_lanretni_ytrams/snigulpsys/ytramsBRUphp.snoitcnunBRUphp.etiL/etiL_ehcaC/RAEP/bilBR)Uphp.lareneg_snoitcnuf/snoitcnuf/sedulcniBRFUphp.cireneg_pami_ebucr/ebucdnuoR/bil/margorp/ebucdnuor-asp/erahs/rsu/BR-Uphp.lareneg_snoitcnuf/snoitcnuf/sedulcni/neZBR#Uphp.ehcacldsw.ssalc/paosun/sessalcBRUphp.gol/yrarbil/metsysBR=Uphp.tuptuOelosnoC/tuptuO/elosnoc/ynofmys/rodnev/resopmoc/nibBR/Uphp.elif_etirw_lanretni_ytrams/snigulpsys/sbilBR6Uphp.elifetirw_emitnur_lanretni_ytrams/snigulpsys/sbilBR.Uphp.boj-ssalc/cni/pupwkcab/snigulp/tnetnoc-pwBR Uphp.reldnah_ehcac/sreldnah_701eBRUphp.metsyseliF/ehcaC/giwTBRUphp.metsyseliF/repleH/emiL/bilBR!Uphp.pmudlqsym-ssalc/cni/pupwkcabBRUphp.slitu_elif_ragus/slituBRUphp.metsyseliF/ehcaCBRUphp.rotiduAfb/krowtenfbBR0U��$�J��$�JG>�$�J,BRSUf\|a[0-9]{1},[0-9]{1}\|s.*?s.*?s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{3},[0-9]{1}\|s.*?oBRGUERCPGQfo0}f|aj�h,j�h|sVsVs|aj�h,j�h|s|aj�h,j�h|sVorBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U��$�J��$�J9�$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0Us�$�J��$�J9��$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U6�$�JC�$�J9��$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U��$�J�$�J9J�$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U��$�J�$�J9
�$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U�$�J��$�J9�$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0UB�$�JO�$�J9��$�J,BRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U�$�J�$�J9V�$�J,8�$�JBRUfBR9UERCP9f0}frBR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U�$�JJ�$�J�8%�J,BRwUf\|a[0-9]{1},[0-9]{1}.*?a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}.*?s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�hVaj�h,j�h|sVaj�h,j�hVsVs|aj�h,j�h|sVaj�h,j�hr�BR,UЫQtart|logphp.{1,10}\-e0\.0\.BR0U�%�J(%�J�%�J,BRsUf\|a[0-9]{1},[0-9]{1}\|t\|a[0-9]{2},[0-9]{2}.*?a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|sBR�UERCP�Qfs0}�f|aj�h,j�h|t|aj�h,j�hVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sr�BR,U��RBR0U�%�J%�J��%�J,BRrUf\|a[0-9]{3},[0-9]{1}\|s\|a[0-9]{3},[0-9]{2}\|f\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|h\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|f|aj�h,j�h|s|aj�h,j�h|h|aj�h,j�hr�BR,U �Rcp0BR0Ue	%�J�	%�J�r%�J,BRbUf.*?s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|sBR�UERCP�Qfs0}afVs|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sraBR,U�RBR0U�%�JT
%�J��%�J,BReUf.*?a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}afVaj�h,j�h|sVaj�h,j�h|sVs|aj�h,j�h|sVaj�h,j�h|sraBR,U�RBR0Uf%�J�%�J�r%�J,BRaUf\|s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|f\|a[0-9]{1},[0-9]{1}\|uBR�UERCP�Qfu0}af|s|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|f|aj�h,j�h|uraBR,U�RBR0U�%�JD%�JG�%�J,BRUUf.*?s\|a[0-9]{2},[0-9]{2}\|s.*?s.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}.*?u.*?sBRGUERCPGQfs0}fVs|aj�h,j�h|sVsVaj�h,j�h|u|aj�h,j�hVuVsrBR,U�RBR0U%�Jy%�J�%�J,BRfUf.*?s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{1},[0-9]{1}.*?a[0-9]{1},[0-9]{1}.*?s.*?s.*?a[0-9]{2},[0-9]{1}.*?sBR�UERCP�Qfs0}]fVsVaj�h,j�hVaj�h,j�hVaj�h,j�hVsVsVaj�h,j�hVsr]BR,U�RBR0U�%�J%�J��%�J,BRrUf\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{3},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U�RBR0Ud%�J�%�J�� %�J,BRrUf\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{1},[0-9]{1}\|t\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|t|aj�h,j�h|u|aj�h,j�hr�BR,U�Qh|BR0UA"%�J�"%�J�M$%�J,BRaUf\|s\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|uBR�UERCP�Qfu0}af|s|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|uraBR,U0)Raj�BR0U�%%�J<&%�J�*(%�J,*%�JBRrUf\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U0)Raj�BR0U�)%�J*%�J�,%�J,BRrUf\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�hr�BR,UP�RBR0Uy-%�J�-%�J��/%�J,BRfUf\|s\|a[0-9]{1},[0-9]{1}\|u.*?s.*?u.*?a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}af|s|aj�h,j�h|uVsVuVaj�h,j�hVaj�h,j�hVs|aj�h,j�hraBR,Up�Q�BR0U�0%�JT1%�J?�2%�J,�%�JBRMUf.*?a[0-9]{2},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{1}\|sBR?UERCP?Qfs0}fVaj�h,j�hVs|aj�h,j�h|sVs|aj�h,j�h|srBR,Up�Q�BR0U4%�J�4%�J�{6%�J,�$%�JBRrUf\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,Up�Q�BR0U�7%�Jj8%�J�X:%�J,L%�JBRrUf\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{3},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U�[R}��Wǘ@�RBR0U�;%�J;<%�J��=%�J,�%�JBRfUf.*?a[0-9]{2},[0-9]{2}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?s.*?a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}afVaj�h,j�h|sVs|aj�h,j�h|sVsVaj�h,j�h|sVaj�h,j�hraBR,U �RBR0UM?%�J�?%�J��A%�J,BRuUf\|a[0-9]{1},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{1},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�hVs|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�hVs|aj�h,j�hr�BR,U �RBR0U-C%�J�C%�JG�D%�J,�%�JBRWUf\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?s.*?s.*?s.*?a[0-9]{2},[0-9]{1}.*?sBRGUERCPGQfs0}f|aj�h,j�h|sVaj�h,j�hVsVsVsVsVaj�h,j�hVsrBR,UP�R,j�BR0USF%�J�F%�J�cH%�J,>,%�JBReUf\|s\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{2},[0-9]{1}.*?s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}af|s|aj�h,j�h|uVaj�h,j�hVsVs|aj�h,j�h|sVaj�h,j�hraBR,UP�R,j�BR0U�I%�JRJ%�J�@L%�J,)%�JBRrUf\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{1},[0-9]{1}\|t\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|t|aj�h,j�h|u|aj�h,j�hr�BR,UP�R,j�BR0U�M%�JN%�J��O%�J,!%�JBRaUf\|s\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|uBR�UERCP�Qfu0}af|s|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|uraBR,U@RBR0U0Q%�J�Q%�J�<S%�J,+%�JBRaUf\|s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|f\|a[0-9]{1},[0-9]{1}\|uBR�UERCP�Qfu0}af|s|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|f|aj�h,j�h|uraBR,U@RBR0U�T%�J!U%�J��V%�J,BRhUf\|a[0-9]{1},[0-9]{1}\|s.*?s.*?s.*?a[0-9]{2},[0-9]{1}.*?u.*?s.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}af|aj�h,j�h|sVsVsVaj�h,j�hVuVsVaj�h,j�hVaj�h,j�hraBR,U@RBR0U3X%�J�X%�J��Z%�J,a(%�JBRrUf\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�hr�BR,U�QEoTr;dB'0&p[[N)y3.''%Oua20,8BR0U\%�J�\%�J�}^%�J,BRtUf\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}\|u.*?s\|a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|f|aj�h,j�h|uVs|aj�h,j�hVaj�h,j�hr�BR,U@RBR0U�_%�Jp`%�J�^b%�J,BRvUf\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}�f|aj�h,j�h|sVaj�h,j�h|sVaj�h,j�hVaj�h,j�h|sVaj�h,j�h|sr�BR,U��Q��QBR0U�c%�Jfd%�J1�f%�J,BR�Uf.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{1},[0-9]{1}\|s.*?s.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{2},[0-9]{1}.*?s.*?a[0-9]{2},[0-9]{2}BR1UERCP1Qf,0}�fVaj�h,j�hVaj�h,j�hVaj�h,j�h|sVsVaj�h,j�hVaj�h,j�hVsVaj�h,j�hr�BR,U`@R
06RBR0Uh%�J�h%�JAk%�J,BR�Uf.*?s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|sBRAUERCPAQfs0}
fVsVs|aj�h,j�h|sVaj�h,j�h|sVaj�h,j�h|s|aj�h,j�hVaj�h,j�h|sVaj�h,j�h|sr
BR,U`@R
06RBR0Url%�J�l%�J9n%�J,BRFUf\|a[0-9]{3},[0-9]{2}\|f\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|BR9UERCP9Qf|0}f|aj�h,j�h|f|aj�h,j�h|u|aj�h,j�h|rBR,U`@R
06RBR0Uyo%�J�o%�J��q%�J,BRtUf.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�fVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�hr�BR,U`@R
06RBR0UXs%�J�s%�J�hu%�J,BReUf.*?s.*?s\|a[0-9]{2},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}afVsVs|aj�h,j�hVs|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�hraBR,Up�RnnqsupersociaBR0U�v%�JWw%�J�Ey%�J,BRrUf\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,Up�RnnqsupersociaBR0U�z%�J4{%�J�"}%�J,BRrUf\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U/RS(A(!@#R#RBR0U�~%�J%�J���%�J,BRrUf\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|f\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|f|aj�h,j�hr�BR,Up1RBR0Uq�%�J�%�J�ބ%�J,BRtUf.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�fVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�hr�BR,U�ER!BR0UP�%�J��%�JG�%�J,BRTUf\|s.*?a[0-9]{2},[0-9]{2}\|s.*?s.*?s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|sBRGUERCPGQfs0}f|sVaj�h,j�h|sVsVsVaj�h,j�h|s|aj�h,j�h|srBR,U�GR�:R�HR:BR0Us�%�J�%�J���%�J,BRcUf\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}af|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�h|sVs|aj�h,j�h|sraBR,U�GR�:R�HR:BR0U�%�J0�%�J� �%�J,BR2Uf.*?a[0-9]{2},[0-9]{1}.*?s\|a[0-9]{2},[0-9]{1}\|sBR�UERCP�Qfs0}�fVaj�h,j�hVs|aj�h,j�h|sr�BR,U�GR�:R�HR:BR0U��%�J�%�J��%�J,BRvUf\|a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}.*?sBR�UERCP�Qfs0}�f|aj�h,j�hVaj�h,j�h|uVaj�h,j�h|s|aj�h,j�h|uVaj�h,j�hVsr�BR,U�GR�:R�HR:BR0Us�%�J�%�J��%�J,BRtUf.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�fVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�hr�BR,ULRBR0UR�%�J��%�J�^�%�J,BRaUf\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|t\|a[0-9]{2},[0-9]{2}\|s\|uBR�UERCP�Qfu0}af|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|t|aj�h,j�h|s|uraBR,U�LRaFRPNRBR0UК%�JM�%�J�;�%�J,BRrUf\|a[0-9]{3},[0-9]{2}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|u|aj�h,j�hr�BR,U�LRaFRPNRBR0U��%�J�%�J���%�J,BReUf.*?a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{1},[0-9]{1}.*?sBR�UERCP�Qfs0}afVaj�h,j�h|sVs|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�hVsraBR,U�R]{1,50}\/[-\w]{3,10}\.log[^=BR0U/�%�J��%�J���%�J,BRrUf\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U�R]{1,50}\/[-\w]{3,10}\.log[^=BR0U�%�J{�%�J��%�J,BRdUf\|a[0-9]{1},[0-9]{1}\|s.*?s.*?s\|a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}af|aj�h,j�h|sVsVs|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�hraBR,U�DR�5RBR0U��%�J��%�J���%�J,BRcUf.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|sBR�UERCP�Qfs0}afVaj�h,j�h|s|aj�h,j�h|sVs|aj�h,j�h|s|aj�h,j�h|sraBR,U�DR�5RBR0U
�%�JM�%�J��%�J,BR5Uf.*?s.*?s\|a[0-9]{2},[0-9]{1}\|s.*?s.*?s.*?s.*?s.*?sBR�UERCP�Qfs0}wfVsVs|aj�h,j�h|sVsVsVsVsVsrwBR,U�DR�5RBR0Uu�%�J�%�J1C�%�J,BR�Uf\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}BR1UERCP1Qf,0}�f|aj�h,j�h|sVaj�h,j�hVaj�h,j�h|sVaj�h,j�hVaj�h,j�h|s|aj�h,j�hr�BR,U�DR�5RBR0U��%�JƳ%�J=�%�J,BRUf.*?sBR=UERCP=Qfs0}	fVsr	BR,U�,RBR0U��%�J��%�J��%�J,BRrUe\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|f\|a[0-9]{1},[0-9]{1}BR�UERCP�Qe,0}�e|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|f|aj�h,j�hr�BR,U�,RBR0U]�%�J߹%�J�ͻ%�J,BRwUf.*?a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}�fVaj�h,j�h|sVaj�h,j�hVaj�h,j�hVaj�h,j�h|sVs|aj�h,j�h|sr�BR,U�DR�5RBR0U?�%�J��%�J���%�J,BRuUf.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}�fVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|sVaj�h,j�hVaj�h,j�h|sr�BR,U`�QTT(%;;QFQ<rY'esCNh$-8 Oxq<JsBR0U�%�J��%�J�+�%�J,BRaUf\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{1},[0-9]{1}\|t\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|sBR�UERCP�Qfs0}af|s|aj�h,j�h|s|aj�h,j�h|t|aj�h,j�h|s|aj�h,j�h|sraBR,U��Qh,j�BR0U��%�J�%�J�
�%�J,BRwUf\|a[0-9]{1},[0-9]{1}.*?a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{3},[0-9]{2}.*?sBR�UERCP�Qfs0}�f|aj�h,j�hVaj�h,j�hVaj�h,j�h|sVs|aj�h,j�h|sVaj�h,j�hVsr�BR,U��Qh,j�BR0U�%�J��%�J���%�J,BRsUf\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{3},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|sVaj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,Up"R@RBR0U]�%�J��%�J���%�J,BRrUf\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,UТRcurl_init    chBR0U:�%�J��%�J���%�J,>n%�JBRrUf\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U�RBR0U�%�J��%�JE�%�J,BR�Uf\|a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{2}BRUERCPQf,0}Kf|aj�h,j�hVaj�h,j�hVaj�h,j�hVaj�h,j�h|s|aj�h,j�h|sVaj�h,j�hVaj�h,j�hrKBR,U`�Q��Q�Wǘ@/p0BR0U��%�J4�%�J�"�%�J,BRrUf\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|h\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|h|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U� RBR0U��%�J�%�J���%�J,BRcUf\|a[0-9]{1},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}.*?sBR�UERCP�Qfs0}af|aj�h,j�h|sVs|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hVsraBR,U`�Q��Q�Wǘ@/p0BR0U�%�J��%�J��%�J,BRrUf\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�hr�BR,U`�QBR0U��%�Ja�%�J��%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�Qsraa�Wǘ@�WǘBR0Us�%�J��%�J���%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�Qsraa�Wǘ@�WǘBR0U��%�Je�%�J��%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�Qsraa�Wǘ@�WǘBR0Uw�%�J��%�J���%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�Qsraa�Wǘ@�WǘBR0U��%�Ji�%�J�	�%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�~R�xR�PBR0U{�%�J�%�J���%�J,BReUf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBR�UERCP�Qfs0}af|aj�h,j�h|uVaj�h,j�h|u|aj�h,j�h|sVaj�h,j�hVsVsraBR,U�~R�xR�PBR0U��%�Jm�%�J�
�%�J,BReUf\|a[0-9]{2},[0-9]{2}.*?f\|a[0-9]{2},[0-9]{2}\|s.*?s.*?s\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}af|aj�h,j�hVf|aj�h,j�h|sVsVs|aj�h,j�h|sVaj�h,j�hraBR,U�~R�xR�PBR0U�%�J��%�J��%�J,BRuUf\|a[0-9]{2},[0-9]{2}\|s.*?s\|a[0-9]{2},[0-9]{2}\|f\|a[0-9]{2},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|sVs|aj�h,j�h|f|aj�h,j�h|sVaj�h,j�hVaj�h,j�hr�BR,U`Rraa�Wǘ@�WǘBR0U_&�J�&�JG&�J,BRTUF\|a[0-9]{2},[0-9]{2}\|s.*?s.*?s.*?s\|a[0-9]{2},[0-9]{1}\|s.*?s\|a[0-9]{2},[0-9]{1}BRGUERCPGQF,0}F|aj�h,j�h|sVsVsVs|aj�h,j�h|sVs|aj�h,j�hrBR,U�~R�xR�PBR0U�&�J�&�J��&�J,BRbUf.*?s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}\|uBR�UERCP�Qfu0}afVs|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�h|s|aj�h,j�h|uraBR,U�~R�xR�PBR0U&�JW&�J=�&�J,BRKUf.*?s\|a[0-9]{2},[0-9]{2}\|u\|a[0-9]{2},[0-9]{1}.*?u\|a[0-9]{1},[0-9]{1}\|BR=UERCP=Qf|0}	fVs|aj�h,j�h|u|aj�h,j�hVu|aj�h,j�h|r	BR,U�~R�xR�PBR0U
&�Jb
&�J}&�J,BRFU(^f\|((s\|a[0-9]{3},[0-9]{1})|a[5,4,1]{1}.,[3,2,8]{1,2}).{1,40}(s|u))BRUERCP0}��f|aYs|aj�h,j�hrYqTaj2h,jhr�['squrr�r�BR,U�~R�xR�PBR0U�&�JC
&�J;�&�J,BRIUf\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s.*?u.*?a[0-9]{2},[0-9]{2}BR;UERCP;Qf,0}f|aj�h,j�h|u|aj�h,j�h|sVuVaj�h,j�hrBR,U�~R�xR�PBR0U�&�Jx&�J�f&�J,BRrUf\|a[0-9]{2},[0-9]{2}\|s\|a[0-9]{1},[0-9]{1}\|f\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|f\|a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}�f|aj�h,j�h|s|aj�h,j�h|f|aj�h,j�h|s|aj�h,j�h|f|aj�h,j�hr�BR,U�~R�xR�PBR0U�&�JH&�J��&�J,BReUf\|a[0-9]{1},[0-9]{1}\|q\|l\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}af|aj�h,j�h|q|l|aj�h,j�h|sVaj�h,j�hVsVsVaj�h,j�hraBR,U�Qsraa�Wǘ@�WǘBR0UZ&�J�&�J�&�J,BR.Uf\|a[0-9]{1},[0-9]{1}\|u.*?a[0-9]{1},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|uVaj�h,j�hr�BR,U�Qsraa�Wǘ@�WǘBR0U�&�J&�J��&�J,BRUf.*?s.*?a[0-9]{2},[0-9]{2}BR�UERCP�Qf,0}[fVsVaj�h,j�hr[BR,U�Qsraa�Wǘ@�WǘBR0U#&�JG&�J��&�J,BRUf\|a[0-9]{3},[0-9]{1}\|fBR�UERCP�Qff0}[f|aj�h,j�h|fr[BR,U�Qsraa�Wǘ@�WǘBR0US&�Jd&�J=�&�J,BRUf.*?kBR=UERCP=Qfk0}	fVkr	BR,U�Qsraa�Wǘ@�WǘBR0U &�J~ &�JG�!&�J,BRUUf\|a[0-9]{2},[0-9]{1}\|u.*?k.*?k\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{1}.*?s.*?sBRGUERCPGQfs0}f|aj�h,j�h|uVkVk|aj�h,j�h|sVaj�h,j�hVsVsrBR,U�Qsraa�Wǘ@�WǘBR0UB#&�J�#&�JJ%&�J,BReUf.{1,100}s.{1,100}a[0-9]{2},[0-9]{2}.{1,100}s.{1,100}a[0-9]{2},[0-9]{2}\|s.{1,100}a[0-9]{2},[0-9]{1}BRJUERCPJQf,0}f[cs[caj�h,j�h[cs[caj�h,j�h|s[caj�h,j�hrBR,U�Qsraa�Wǘ@�WǘBR0Uy&&�J�&&�J��(&�J,BRuUf\|a[0-9]{2},[0-9]{1}\|u.*?k\|a[0-9]{1},[0-9]{1}\|s.*?a[0-9]{2},[0-9]{2}.*?a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|uVk|aj�h,j�h|sVaj�h,j�hVaj�h,j�h|s|aj�h,j�hr�BR,U�Qsraa�Wǘ@�WǘBR0UY*&�J�*&�J�Q+&�J,BR7Uf.*?u.*?a[0-9]{3},[0-9]{2}.*?u.*?s.*?u.*?u.*?s.*?u.*?uBR�UERCP�Qfu0}wfVuVaj�h,j�hVuVsVuVuVsVuVurwBR,U`�Q��Q�Wǘ@/p0BR0U�,&�JT-&�J1�/&�J,BR�Uf.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{1}BR1UERCP1Qf,0}�fVaj�h,j�hVaj�h,j�h|s|aj�h,j�hVaj�h,j�h|s|aj�h,j�h|u|aj�h,j�hr�BR,U`�Q��Q�Wǘ@/p0BR0U1&�J1&�J�m3&�J,BRrUf\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|h\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|u|aj�h,j�h|u|aj�h,j�h|h|aj�h,j�h|u|aj�h,j�hr�BR,U�`RBR0U�4&�J.5&�J�26&�J,BRDUf\|s.*?s.*?s\|a[0-9]{3},[0-9]{2}\|s.*?s.*?s.*?s\|a[0-9]{3},[0-9]{2}BR�UERCP�Qf,0}�f|sVsVs|aj�h,j�h|sVsVsVs|aj�h,j�hr�BR,U`�Q��Q�Wǘ@/p0BR0U�7&�J�7&�J��8&�J,BR-Uf\|s.*?s.*?a[0-9]{3},[0-9]{2}.*?s.*?q\|s.*?sBR�UERCP�Qfs0}of|sVsVaj�h,j�hVsVq|sVsroBR,U`�Q��Q�Wǘ@/p0BR0U�9&�Jk:&�J�<&�J,BRdUf\|a[0-9]{1},[0-9]{1}\|s.*?s.*?f\|a[0-9]{2},[0-9]{1}.*?f\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}af|aj�h,j�h|sVsVf|aj�h,j�hVf|aj�h,j�h|f|aj�h,j�hraBR,U`�Q��Q�Wǘ@/p0BR0U}=&�J�=&�JG1?&�J,BRWUf\|s.*?q\|s.*?a[0-9]{2},[0-9]{2}.*?u.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{1},[0-9]{1}.*?s.*?sBRGUERCPGQfs0}f|sVq|sVaj�h,j�hVuVaj�h,j�hVaj�h,j�hVsVsrBR,U`�Q��Q�Wǘ@/p0BR0U�@&�J7A&�J1sC&�J,BR�Uf.*?s\|a[0-9]{3},[0-9]{2}\|s.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{3},[0-9]{1}.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|uBR1UERCP1Qfu0}�fVs|aj�h,j�h|sVaj�h,j�hVaj�h,j�hVaj�h,j�hVaj�h,j�hVaj�h,j�h|ur�BR,U`�Q��Q�Wǘ@/p0BR0U�D&�JRE&�J��F&�J,BRbUf\|a[0-9]{3},[0-9]{2}\|s.*?q\|s\|a[0-9]{1},[0-9]{1}\|u\|a[0-9]{1},[0-9]{1}\|s\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}af|aj�h,j�h|sVq|s|aj�h,j�h|u|aj�h,j�h|s|aj�h,j�hraBR,U`�Q��Q�Wǘ@/p0BR0UdH&�J�H&�J��J&�J,BRrUf\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}\|f\|a[0-9]{2},[0-9]{1}BR�UERCP�Qf,0}�f|aj�h,j�h|f|aj�h,j�h|f|aj�h,j�h|f|aj�h,j�h|f|aj�h,j�hr�BR,U`�Q��Q�Wǘ@/p0BR0UAL&�J�L&�J��N&�J,BRtUf\|a[0-9]{2},[0-9]{1}\|u.*?a[0-9]{2},[0-9]{1}.*?a[0-9]{2},[0-9]{1}\|s\|a[0-9]{3},[0-9]{2}\|f\|a[0-9]{3},[0-9]{1}\|fBR�UERCP�Qff0}�f|aj�h,j�h|uVaj�h,j�hVaj�h,j�h|s|aj�h,j�h|f|aj�h,j�h|fr�BR,U �RBR0U P&�JNP&�J��P&�J,BR#U^f\|(a[0-9]{1,3},[0-9]{1,3}\|s\|)+BR�UERCP�A|0}ff|[aj�h,j�h|s|s[rfBR,U�Raj�BR0UeR&�J�R&�JGT&�J,BRQUf\|a[0-9]{2},[0-9]{1}\|f.*?s\|f\|a[0-9]{1},[0-9]{1}\|s\|f\|a[0-9]{1},[0-9]{1}\|sBRGUERCPGQfs0}f|aj�h,j�h|fVs|f|aj�h,j�h|s|f|aj�h,j�h|srBR,U��R�BR0U4�U&�J�U&�J�U&�J:V&�J,NV&�J`V&�J@�V&�J,
�V&�J_W&�J �$�JjW&�J �$�JuW&�JBR4ULog all dangerous invokations of move_uploaded_fileBRU^fBR:UERCP:0}frBR,U��Rwp0BRU\.php$BR@UERCP@Q.p0}.phprBR,U��Rwp0BR ULW&�JBR4Up=W&�Jmove_uploaded_fileBRU
W&�JBRUBRUBRUBR0U3�X&�J�X&�JY&�J��Y&�J,�Y&�JZ&�J
Z&�J<Z&�J �$�JGZ&�J �$�JRZ&�JJT&�JBR
UexKILL 23BR1U^(^f.*?a255,[0-9]{1}.*?s.*?a5,5\|q.*?a255,(6|4))BR�UERCP�A,0}ngfVa255,j�hVsVa5,5|qVa255,6q4rrgrnBR,U��Rwp0BRU<?phpBRU.phpBR UBRUBRUBRUBR0U2�[&�J�[&�J�[&�J:\&�J,J\&�Jf\&�JZ�\&�J,]&�J#^&�J �$�J.^&�J �$�J9^&�J�W&�JBRUmalware drops from pic filesBRU^fBR:UERCP:0}frBR,U��Rwp0BRU\.(ico|png|jpg)$BRZUERCPZ.0}&.icoq	pngq	jpgrr&BR,U��Rwp0BR U�]&�JBR4U�O�5]]&�Jfile_put_contentsBRF-]&�JBR$U��5Q�]&�JfwriteBRF]&�JBR$U4
�]&�JfopenBR U-]&�J]&�J�]&�JBRUBRUBRUBR0U1_&�J�_&�J�_&�J:�_&�J,y.`&�J�`&�JXb&�J,Mb&�Jnc&�J �$�Jyc&�J �$�J�c&�J]Z&�JBRUBlock new fakeplugin dropBRU^fBR:UERCP:0}frBR,U��Rwp0BRzU\$plugin_key\h{0,50}=\h{0,50}['"](?:[a-f0-9]{32})?['"];[^\:\^%&@!#\*\|]{499,999}['"]hide_logged_in['"]\h{0,20}\)\h{0,50};BRXUERCPXQ$;0}$$plugin_key[2=[2j��})j�~h  r)j�;k������������������������������h��j�hide_logged_inj�[)[2;r$BR,U��Rwp0BR UCc&�JBR4U�O�5�b&�Jfile_put_contentsBRFxb&�JBR$U��5Q�b&�JfwriteBRF�b&�JBR$U4
4c&�JfopenBR Uxb&�J�b&�Jc&�JBRUBRUBRUBR0U0�d&�J�d&�J�d&�J:=e&�J,te&�J$�e&�J},f&�J,cf&�J�g&�J �$�J�g&�J �$�J�g&�JD^&�JBRUBlock perl.alfa dropBRU^fBR:UERCP:0}frBR,U��Rwp0BR%Ualfacgiapi\/(perl\.alfa|\.htaccess)$BR}UERCP}Qa/0}Ialfacgiapi/perl.alfaq.htaccessr,rIBR,U��Rwp0BR UYg&�JBR4U�O�5�f&�Jfile_put_contentsBRF�f&�JBR$U��5Qg&�JfwriteBRF�f&�JBR$U4
Jg&�JfopenBR U�f&�J�f&�J*g&�JBRUBRUBRUBR0U/�h&�J�h&�Ji&�J:Qi&�J,�i&�J�i&�Jn+j&�J,bj&�J�k&�J �$�J�k&�J �$�J�k&�J�c&�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,U��Rcp0BRUwp-db-ajax-made\/wp-ajax\.php$BRnUERCPnQwp0}:wp-db-ajax-made/wp-ajax.phpr:BR,URcp0BR UXk&�JBR4U�O�5�j&�Jfile_put_contentsBRF�j&�JBR$U��5Q�j&�JfwriteBRF�j&�JBR$U4
Ik&�JfopenBR U�j&�J�j&�J)k&�JBRUBRUBRUBR0U�l&�Jm&�Jm&�J>`m&�J,�m&�J�m&�J �$�J�m&�J �$�J�m&�J�g&�JBRUEvalGzifBase64 Logging RuleBRU^q\|oBR>UERCP>0}
q|or
BR,U��Rcp0BR UBRUBRUBRUBR0U
o&�J<o&�JJo&�J:�o&�J,�o&�J�o&�J �$�J�o&�J �$�Jp&�J�k&�JBRUEmail Logging RuleBRU^gBR:UERCP:0}grBR,U��Rcp0BR UBRUBRUBRUBR0U	Mq&�Jiq&�Jwq&�J:�q&�J,�q&�Jr&�J �$�J)r&�J �$�J4r&�J�m&�JBRURCE Logging RuleBRU^EBR:UERCP:0}ErBR,U��Rcp0BR UBRUBRUBRUBR0Uzs&�J�s&�J�s&�J��t&�J,�t&�J�t&�Ju&�J �$�Ju&�J �$�J$u&�Jp&�JBR(Ufixed 33 rule (solid_best_corp) re-testBR8U^(f\|o\|a1,1\|){1,2}(f\|a2,2\|){0,1}q\|o\|q\|r\|o\|a2,2BR�UERCP�A20}lf|o|a1,1|r�f|o|a1,1|r�f|a2,2|rq|o|q|r|o|a2,2rlBR,U��Rcp0BRU<?phpBR UBRUBRUBRUBR0Ujv&�J�v&�J�v&�J:�v&�J,w&�J<x&�J �$�JGx&�J �$�JRx&�J?r&�JBRUcurl_init/exec testBRU^uBR:UERCP:0}urBR,U��Rcp0BR Ux&�JBR,U��pRfw&�Jcurl_initBRF>w&�JBR,U��nR�w&�Jcurl_execBRF>w&�J�w&�JBR,U<�Vx&�Jcurl_multi_execBR U>w&�J�w&�J�w&�JBRUBRUBRUBR0U��y&�J�y&�J�y&�J:z&�J,Mz&�Jez&�JR�z&�J,�z&�Jv{&�J �$�J�{&�J �$�J�{&�J/u&�JBR Uexternal malware sources lookupBRU^fBR:UERCP:0}frBR,U��Rcp0BR
U(https?|ftp)BRRUERCPRAp0}http%sq	ftprrBR,U��Rcp0BR Uc{&�JBR4Uo�JT{&�Jfile_get_contentsBRU${&�JBRUBRUBRUBR0U��|&�J}&�J}&�J:U}&�J,�}&�J�}&�J@�}&�J, ~&�J#O~&�Jt�~&�J,&�Jr&�J �$�J}&�J �$�J�&�J]x&�JBR%Utheme/plugin installation statisticsBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBRU\.php$BR@UERCP@Q.p0}.phprBR,U��Rcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,URcp0BR U_&�JBR$U4
P&�JfopenBRU0&�JBRUBRUBRUBR0U�/΀&�J��&�J	�&�J:N�&�J,.��&�J��&�J�N�&�J,
��&�J�&�J �$�J
�&�J �$�J�&�J�{&�JBR"UProactive Defence test BLOCK ruleBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBR/Uhttps:\/\/secure\.eicar\.org\/eicar\.com\.txt$BR�UERCP�Qht0}Phttps://secure.eicar.org/eicar.com.txtrPBR,U��RnnqsupersociaBR U�&�JBR4Uo�J�&�Jfile_get_contentsBRU��&�JBRUBRUBRUBR0U>'^�&�J~�&�J��&�J:ф&�J,;�&�JO�&�J��&�J,
!�&�J��&�J �$�J��&�J �$�J��&�J�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBR<U<\?php\s{1,40}\/\*[a-z0-9]{5}\*\/\s{1,40}@include\s{1,40}\"BR�UERCP�Q<"0}\<?php	['	/*j����h*/	['	@include	['	"r\BR,U��RnnqsupersociaBR U��&�JBR4U�O�5|�&�Jfile_put_contentsBRUL�&�JBRUBRUBRUBR0U='��&�J�&�J(�&�J:m�&�J,���&�JB�&�J�1�&�J,
h�&�J�&�J �$�J�&�J �$�J��&�J#�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBR�U<\?php\s{0,10}(\$\w{5,8})\s{0,10}=\s{0,10}\'[\S]{1,50}\';(\$\w{5,8})\s{0,10}=\s{0,10}Array\(\);\2\[\]\s{0,10}=\s{0,10}\1\[\d{1,2}\]\.\1\[\d{1,2}\]BR�UERCP�Q<]0}�<?php[
	$][r[
	=[
	'k�������������������������������h2';$][r[
	=[
	Array();m[][
	=[
	m[[].m[[]r�BR,U��RnnqsupersociaBR UҊ&�JBR4U�O�5Ê&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U<'A�&�Ja�&�Jo�&�J:��&�J,��&�J��&�J5ߎ&�J,
�&�J��&�J �$�J��&�J �$�J��&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBR�U<\?php\s{0,10}\@ini_set\(\'error_log\',\s{0,10}NULL\);\@ini_set\(\'log_errors\',\s{0,10}0\);@ini_set\('max_execution_time\',\s{0,10}0\);@error_reporting\(0\);\@set_timeBR5UERCP5Q<e0}<?php[
	@ini_set('error_log',[
	NULL);@ini_set('log_errors',[
	0);@ini_set('max_execution_time',[
	0);@error_reporting(0);@set_timerBR,U��RnnqsupersociaBR U��&�JBR4U�O�5q�&�Jfile_put_contentsBRUA�&�JBRUBRUBRUBR0U;'�&�J&�&�J6�&�J?��&�J,��&�J&�&�J{o�&�J,
��&�J��&�J �$�Jʔ&�J �$�JՔ&�J�&�JBR,UMalicious theme/plugin installation attemptBRU^f|uBR?UERCP?0}fqurBR,U��RnnqsupersociaBR'Uclass\.(?:theme|plugin)\-modules\.php$BR{UERCP{Qcp0}Gclass.}
themeqpluginr-modules.phprGBR,U��RnnqsupersociaBR U5�&�JBR,U��pR��&�Jcurl_initBRFђ&�JBR4U�O�5K�&�Jђ&�Jfile_put_contentsBRF�&�JBR,U��nR��&�Jcurl_execBR F�&�Ju�&�Jד&�JBR$U��5Q��&�JfwriteBR$U4
&�&�JfopenBR@U�&�Ju�&�Jד&�J��&�JBR4Uo�J��&�J�&�Jfile_get_contentsBRUBRUBRUBR0U:'�&�JR�&�J`�&�J:��&�J,/ܖ&�J�&�J���&�J,�&�JDB�&�J���&�J,
4�&�JU�&�J �$�J`�&�J �$�Jk�&�J��&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,U��RnnqsupersociaBR0U(asus|002bestwifu|Chitoge|autoload_lavup)\.php$BR�UERCP�Ap0}e
asusq002bestwifuqChitogeqautoload_lavuprV.phpreBR,U��RnnqsupersociaBREUvendor\/mockery\/mockery\/library\/Mockery\/Loader\/EvalLoader\.php$BR�UERCP�Qvp0}|vendor/mockery/mockery/library/Mockery/Loader/EvalLoader.phpr|BR,U��RnnqsupersociaBR U*�&�JBR4U�O�5��&�Jfile_put_contentsBRF_�&�JBR$U��5Qљ&�JfwriteBRF��&�JBR$U4
�&�JfopenBR U_�&�J��&�J��&�JBRUBRUBRUBR0U9'��&�J�&�J��&�J:;�&�J,	r�&�J��&�JJܜ&�J,�&�JDc�&�J��&�J,
U�&�Jv�&�J �$�J��&�J �$�J��&�J�&�JBR,UMalicious theme/plugin installation attemptBRU^eBR:UERCP:0}erBR,U��RnnqsupersociaBR
Uwget|curlBRJUERCPJ0}wgetqcurlrBR,U��RnnqsupersociaBREUvendor\/mockery\/mockery\/library\/Mockery\/Loader\/EvalLoader\.php$BR�UERCP�Qvp0}|vendor/mockery/mockery/library/Mockery/Loader/EvalLoader.phpr|BR,U��RnnqsupersociaBR UK�&�JBR$U�l���&�JsystemBRF��&�JBR,U�����&�Jshell_execBRF��&�Jž&�JBR,Uト]<�&�Jž&�JpassthruBR U��&�J�&�JBRUBRUBRUBR0U8'Ҡ&�J	�&�J�&�J:\�&�J,<��&�Jۡ&�J���&�J,Ң&�J#�&�Jt��&�J,
��&�J$�&�J �$�J/�&�J �$�J:�&�Jv�&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,URcp0BR=U\/(blockspluginn|supersociall|wp-(hello|block)-plugin)\.php$BR�UERCP�Q/p0}�/blockspluginnqsupersociallq6wp-helloq
blockr-pluginrp.phpr�BR,URcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,U0�Qo|s|o|f|a1,1r(BR U�&�JBR$U4
�&�JfopenBRU�&�JBRUBRUBRUBR0U7'��&�J��&�Jť&�J:
�&�J,+A�&�Jx�&�J��&�J,I�&�J#x�&�Jt��&�J,
.�&�J��&�J �$�J��&�J �$�J��&�J��&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,URtp0BR,U(rms-script-ini|rms-script-mu-plugin)\.php$BR�UERCP�Qrp0}[!rms-script-iniq+rms-script-mu-pluginrL.phpr[BR,URcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,U0�Qo|s|o|f|a1,1r(BR U��&�JBR$U4
y�&�JfopenBRUY�&�JBRUBRUBRUBR0U6'��&�J�&�J#�&�J:h�&�J,
��&�J��&�JN�&�J,H�&�Jo�&�JWѫ&�J,
�&�Ju�&�J �$�J��&�J �$�J��&�JE�&�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,URtp0BRUwp-load\.php$BRNUERCPNQwp0}wp-load.phprBR,URtp0BRU\/.+\/([^\/]+)\/\.?\1\.php$BRWUERCPWQ/p0}#/W/=/r/%.m.phpr#BR,URtp0BR Ub�&�JBR$U4
S�&�JfopenBRU3�&�JBRUBRUBRUBR0U5'ѭ&�J�&�J��&�J:B�&�J,y�&�J(��&�Jn&�&�J,
]�&�J~�&�J �$�J��&�J �$�J��&�J��&�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,URtp0BR)Uthemes\/[^\/]{1,40}\/config\/class\.php$BRnUERCPnQtp0}:themes//A'//config/class.phpr:BR,U0�Qo|s|o|f|a1,1r(BR US�&�JBR4U�O�5��&�Jfile_put_contentsBRF��&�JBR$U��5Q��&�JfwriteBRFگ&�JBR$U4
D�&�JfopenBR U��&�Jگ&�J$�&�JBRUBRUBRUBR0U4'ڱ&�J�&�J�&�J:W�&�J,(��&�J²&�Jn;�&�J,r�&�J��&�JR�&�J,
!�&�Jq�&�J �$�J|�&�J �$�J��&�J��&�JBRUBlock including malicious fileBRU^uBR:UERCP:0}urBR,URcp0BR)Uthemes\/[^\/]{1,40}\/config\/class\.php$BRnUERCPnQtp0}:themes//A'//config/class.phpr:BR,U0�Qo|s|o|f|a1,1r(BRUfunctions\.php$BRRUERCPRQfp0}functions.phprBR,URcp0BR U�&�JBR,U�{�t�&�Jrequire_onceBRFL�&�JBR$UH�KQ��&�JL�&�JrequireBRF��&�JBR,Ua�&�&�Jinclude_onceBR U��&�JB�&�JBR$U�!Ub�&�J�&�JincludeBRUBRUBRUBR0U3'Ͷ&�J�&�J�&�J:W�&�J,��&�J��&�JX�&�J,G�&�J#v�&�Jt��&�J,
,�&�J��&�J �$�J��&�J �$�J��&�J��&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,URcp0BRUconfig\/class\.php$BRXUERCPXQcp0}$config/class.phpr$BR,URcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,U0�Qo|s|o|f|a1,1r(BR U��&�JBR$U4
w�&�JfopenBRUW�&�JBRUBRUBRUBR0U2'��&�J,�&�J:�&�J:�&�J,���&�J�&�Jj�&�J,+�&�J#Z�&�Jt�&�J,
�&�J}�&�J �$�J��&�J �$�J��&�J��&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,URA0R0�QBR�U(?:distance-lite[^\/]{0,10}\/(?:languages\/namespaces|inc\/polyfill-ctype)|wp-ithemes-sync\/lib\/updater\/ithemes-licenses|itr-popup\/scripts\/jscolor\/itro-admin-scripts|svg-icon-wpvector\/admin\/partials\/wp-svg-icons-custom|wp-tag-groups\/include\/helpers\/class\.languages|wp-tag-groups\/include\/helpers\/class\.languages|profile-organic-block\/block\/profile\/profile_autoload|wp-async-javascript\/lib\/gtmetrix\/class\.Services_WTF)\.php$BRjUERCPjAp0}6}xdistance-liteA
//}+languages/namespacesq'inc/polyfill-ctyperRq[wp-ithemes-sync/lib/updater/ithemes-licensesq[itr-popup/scripts/jscolor/itro-admin-scriptsqksvg-icon-wpvector/admin/partials/wp-svg-icons-customq]wp-tag-groups/include/helpers/class.languagesq]wp-tag-groups/include/helpers/class.languagesqkprofile-organic-block/block/profile/profile_autoloadqiwp-async-javascript/lib/gtmetrix/class.Services_WTFr'.phpr6BR,URcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,U0�Qo|s|o|f|a1,1r(BR Uj�&�JBR$U4
[�&�JfopenBRU;�&�JBRUBRUBRUBR0U1'��&�J��&�J�&�J:J�&�J,��&�J@��&�J���&�J,
��&�J��&�J �$�J��&�J �$�J��&�J��&�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,URA0R0�QBRAUwp-content\/plugins\/(?:helad|monit|ccode|cplugin|mplugin)\.php$BR�UERCP�Qwp0}~wp-content/plugins/}
heladq
monitq
ccodeqcpluginqmpluginrI.phpr~BR,URA0R0�QBR U��&�JBR4U�O�5�&�Jfile_put_contentsBRF��&�JBR$U��5Q^�&�JfwriteBRF>�&�JBR$U4
��&�JfopenBR U��&�J>�&�J��&�JBRUBRUBRUBR0U0'>�&�J^�&�Jl�&�J:��&�J,h��&�J\�&�J�D�&�J,
{�&�J��&�J �$�J�&�J �$�J�&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRiU<\?php\s{1,40}\$[a-z]{1,40}\s{1,40}=\s{1,40}("|\x27)[^"\x27]{1,40}\1;[^;]{1,40};foreach\s{1,10}\(\$_POSTBR�UERCP�Q<T0}�<?php	['	$j���h(	['	=	['	"q'rk����{���������������������������h(m;;A';;foreach	[		($_POSTr�BR,URA0R0�QBR U��&�JBR4U�O�5��&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U/'T�&�Jt�&�J��&�J:��&�J,@��&�JJ�&�J��&�J,
:�&�J��&�J �$�J��&�J �$�J��&�J�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRAU<\?php\s{1,40}(\/\*[a-z0-9]{1,40}\*\/\s{1,40})?\$[_O0]{1,40}\s?=BR�UERCP�Q<=0}z<?php	['	�8/*j����h(*/	['	r8$j��h(Y	=rzBR,UP�Rcp0BR U��&�JBR4U�O�5��&�Jfile_put_contentsBRUe�&�JBRUBRUBRUBR0U.'�&�J3�&�JA�&�J:��&�J,C��&�J�&�J���&�J,
��&�Je�&�J �$�Jp�&�J �$�J{�&�J�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRDU<\?php\s{1,40}\/\*[a-z0-9]{1,40}\*\/\s{1,40}@include\s{1,40}"\\057hBR�UERCP�Q<h0}f<?php	['	/*j����h(*/	['	@include	['	"\057hrfBR,UP�Rcp0BR UR�&�JBR4U�O�5C�&�Jfile_put_contentsBRU�&�JBRUBRUBRUBR0U-'��&�J��&�J��&�J:4�&�J,[k�&�J��&�J���&�J,
��&�J9�&�J �$�JD�&�J �$�JO�&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BR\U<\?php\s{1,5}@system\(\"cd\s\/tmp;mkdir\s\w{1,10};\s?chmod\s777[^;]{1,40};cd[^;]{1,40};wgetBR�UERCP�Q<t0}t<?php	[	@system("cd	/tmp;mkdir	[	;Y	chmod	777;A';;cd;A';;wgetrtBR,UP�Rcp0BR U&�&�JBR4U�O�5�&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U,'��&�J��&�J��&�J:�&�J,;?�&�J��&�Jz�&�J,
B�&�J��&�J �$�J��&�J �$�J��&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BR<U<\?php\s{1,5}goto[^:]{1,40}:\s{1,5}@system[^;]{1,40};\sgotoBRzUERCPzQ<o0}F<?php	[	goto:A'::	[	@system;A';;	gotorFBR,UP�Rcp0BR U��&�JBR4U�O�5��&�Jfile_put_contentsBRUm�&�JBRUBRUBRUBR0U+'�&�J;�&�JI�&�J:��&�J,^��&�J/�&�J���&�J,
'�&�J��&�J �$�J��&�J �$�J��&�JZ�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BR_U<\?php\s{1,5}error_reporting\(0\);\s{1,5}([^;]{1,40};)?\s{0,5}\$randStr\s=\sstr_shuffle\(\'\w+BR�UERCP�Q<'0}�<?php	[	error_reporting(0);	[	�
;A';;r
[	$randStr	=	str_shuffle('Wr�BR,UP�Rcp0BR U��&�JBR4U�O�5��&�Jfile_put_contentsBRUR�&�JBRUBRUBRUBR0U*'�&�J �&�J.�&�J:s�&�J,M��&�J�&�J���&�J,
��&�Ji�&�J �$�Jt�&�J �$�J�&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRNU<\?php\s{1,5}class\sstr_auth\{\s{1,5}var\s\$i_str_n;\s{1,5}function\sstr_authBR�UERCP�Q<h0}s<?php	[	class	str_auth{	[	var	$i_str_n;	[	function	str_authrsBR,UP�Rcp0BR UV�&�JBR4U�O�5G�&�Jfile_put_contentsBRU�&�JBRUBRUBRUBR0U)'��&�J��&�J��&�J:8�&�J,Ro�&�J��&�J�~�&�J,
��&�J2�&�J �$�J=�&�J �$�JH�&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRSU<\?php\s{0,10}[^=]{1,30}=\s{1,10}file_get_contents\(.(\.\.\/\.)?\.\/wp-config\.phpBR�UERCP�Q<p0}r<?php[
	=A==	[		file_get_contents(�
../.r
./wp-config.phprrBR,UP�Rcp0BR U�&�JBR4U�O�5�&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U('��&�J��&�J��&�J:�&�J,�8�&�J��&�J���&�J,
��&�Js�&�J �$�J~�&�J �$�J��&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BR�U<\?php\s{0,5}\$trpath=basename\(\$_FILES[^\(]{1,30}\(move_uploaded_file[^>]{100,200}>\<form\senctype=\"multipart[^<]{10,100}<inputBR�UERCP�Q<t0}�<?php[	$trpath=basename($_FILES(A((move_uploaded_fileCd>Ad>><form	enctype="multipartC
<AZ<<inputr�BR,UP�Rcp0BR U`�&�JBR4U�O�5Q�&�Jfile_put_contentsBRU!�&�JBRUBRUBRUBR0U''��&�J��&�J��&�J:B�&�J,cy�&�J��&�J���&�J,
��&�JN�&�J �$�JY�&�J �$�Jd�&�JS�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRdU<\?php\s{1,10}function\s{1,10}get\(\$url,\s{1,10}\$name\)\s{1,10}\{\s{1,10}\$\w{1,10}\s=\scurl_initBR�UERCP�Q<t0}s<?php	[		function	[		get($url,	[		$name)	[		{	[		$[		=	curl_initrsBR,UP�Rcp0BR U;�&�JBR4U�O�5,�&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U&'��&�J��&�J��&�J:�&�J,T�&�Jk�&�JK��&�J,
��&�Ju�&�J �$�J��&�J �$�J��&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRUmoban\.htmlBRKUERCPKQml0}moban.htmlrBR,UP�Rcp0BR Ub�&�JBR4U�O�5S�&�Jfile_put_contentsBRU#�&�JBRUBRUBRUBR0U"'��&�J��&�J��&�J:D�&�J,H{�&�J��&�J���&�J,
��&�J]�&�J �$�Jh�&�J �$�Js�&�Jo�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRIUwp-admin\/(?:network\/user-privacy|maint\/replace)([-_\.]{1}\w{6})?\.phpBR�UERCP�Qwp0}�wp-admin/}+network/user-privacyqmaint/replacerH�/j`�h]r/.phpr�BR,UP�Rcp0BR UJ�&�JBR4U�O�5;�&�Jfile_put_contentsBRU�&�JBRUBRUBRUBR0U!'��&�J�&�J�&�J:,�&�J,�c�&�J�&�J��&�J,
+�&�J��&�J �$�J��&�J �$�J��&�J��&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BR�U\$lastRunLog[^\/]{1,50}\/[-\w]{3,10}\.log[^=]+=\s{0,5}file_get_contents\(\$lastRunLog[^\{]{1,100}\{\s{0,10}search_file\(\$_SERVERBR�UERCP�Q$R0}�$lastRunLog/A1//j ��������h
.logE==[	file_get_contents($lastRunLog{Ac{{[
	search_file($_SERVERr�BR,UP�Rcp0BR U��&�JBR4U�O�5��&�Jfile_put_contentsBRUV�&�JBRUBRUBRUBR0U '�&�J$�&�J2�&�J:w�&�J,��&�J�&�Jc=�&�J,
t�&�J�&�J �$�J��&�J �$�J�&�J~�&�JBRUMalware drop blockedBRU^fBR:UERCP:0}frBR,UP�Rcp0BRU^(\/tmp\/)?(mn|htht)$BRcUERCPc0}/�/tmp/r	mnqhthtrr/BR,UP�Rcp0BR U�&�JBR4U�O�5�&�Jfile_put_contentsBRU��&�JBRUBRUBRUBR0U'M�&�J��&�J��&�J:�&�J,&�&�J@�&�J{�&�J,��&�J#,�&�Jt��&�J,
�&�J'�J �$�J'�J �$�J)'�J�&�JBR,UMalicious theme/plugin installation attemptBRU^fBR:UERCP:0}frBR,UP�R//0BR'Uclass\.(?:theme|plugin)\-modules\.php$BR{UERCP{Qcp0}Gclass.}
themeqpluginr-modules.phprGBR,UP�Rcp0BR$Uclass\-wp\-filesystem\-direct\.php$BRtUERCPtQcp0}@class-wp-filesystem-direct.phpr@BR,URA0R0�QBR U�'�JBR4U�O�5='�Jfile_put_contentsBRF
'�JBR$U4
'�JfopenBRF
'�J_'�JBR4Uo�J�'�J_'�Jfile_get_contentsBR U
'�J�'�JBRUBRUBRUBR0U'o'�J�'�J�'�J:�'�J, *'�JV'�Jm�'�J,
'�JU'�J �$�J`'�J �$�Jk'�J�&�JBR&UBlock including antivirus cache filesBRU^uBR:UERCP:0}urBR,UP�R/g0BR!U\/\.revisium\_antivirus\_cache\/BRmUERCPmQ//0}9/.revisium_antivirus_cache/r9BR,URA0R0�QBR U�'�JBR,U�{�X'�Jrequire_onceBRF0'�JBR$UH�KQ�'�J0'�JrequireBRFz'�JBR,Ua�&�'�Jinclude_onceBR Uz'�J&'�JBR$U�!UF'�J�'�JincludeBRUBRUBRUBR0U'�'�J�'�J�'�J:"'�J,Y'�J}'�Jj�'�J,
)'�J�'�J �$�J�'�J �$�J�'�J4'�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,UP�R/g0BRU\/\.[a-z0-9A-Z]{6}\.png$BRjUERCPjQ/g0}6/.j�������h.pngr6BR,URA0R0�QBR U�'�JBR4U�O�5�'�Jfile_put_contentsBRUT'�JBRUBRUBRUBR0U'
'�J'
'�J5
'�J:z
'�J,�
'�J�
'�JjJ'�J,
�'�J�'�J �$�J�'�J �$�J�'�Jv'�JBRUBlock including ico filesBRU^uBR:UERCP:0}urBR,UP�R/o0BRU\/\.[a-z0-9A-Z]{6}\.png$BRjUERCPjQ/g0}6/.j�������h.pngr6BR,URA0R0�QBR Uw'�JBR,U�{��'�Jrequire_onceBRF�'�JBR$UH�KQ'�J�'�JrequireBRF�'�JBR,Ua�&h'�Jinclude_onceBR U�'�J�'�JBR$U�!U�'�J@'�JincludeBRUBRUBRUBR0U'-'�JS'�Ja'�J:�'�J,�'�J'�Jep'�J,
�'�Jn'�J �$�Jy'�J �$�J�'�J�'�JBRUcpanel hack via contactxxxBRU^fBR:UERCP:0}frBR,UP�R/o0BRU\.?contact(info|email)$BReUERCPeAt0}1%.contact
infoq
emailrr1BR,UP�R/o0BR US'�JBR4U�O�5'�Jfile_put_contentsBRF�'�JBR$U4
D'�JfopenBRU�'�J$'�JBRUBRUBRUBR0U'�'�J�'�J�'�J:;'�J,Mr'�J�'�J��'�J,�'�J&	'�J{�'�J,
�'�J�'�J �$�J�'�J �$�J�'�J�'�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,UP�R/o0BRNU\/(?:(?:post|functions)|plugins\/(?:helad|monit|ccode|cplugin|mplugin))\.php$BR�UERCP�Q/p0}�/}&}postqfunctionsr q_plugins/}
heladq
monitq
ccodeqcpluginqmpluginrIr�.phpr�BR,UP�R/o0BR'Uclass\.(?:theme|plugin)\-modules\.php$BR{UERCP{Qcp0}Gclass.}
themeqpluginr-modules.phprGBR,UP�R/o0BR U�'�JBR4U�O�5!'�Jfile_put_contentsBRF�'�JBR$U��5Qc'�JfwriteBRFC'�JBR$U4
�'�JfopenBR U�'�JC'�J�'�JBRUBRUBRUBR0U'C'�Je'�Js'�J:�'�J,�'�J'�JTk'�J,�'�J
�'�JL'�J,
I'�J'�J �$�J'�J �$�J&'�J�'�JBRUBlock themes infectionBRU^fBR:UERCP:0}frBR,UP�R/o0BRU\/functions\.php$BRTUERCPTQ/p0} /functions.phpr BR,UP�R/o0BRUwp\-vcd\.php$BRLUERCPLQwp0}wp-vcd.phprBR,UP�R/o0BR U�'�JBR4U�O�5�'�Jfile_put_contentsBRFt'�JBR$U4
�'�JfopenBRUt'�J�'�JBRUBRUBRUBR0U'l'�J�'�J�'�J:�'�J,'�J*'�J@u'�J,
�'�J)'�J �$�J4'�J �$�J?'�J'�JBRUBlock ELF files dropBRU^fBR:UERCP:0}frBR,UP�R/o0BR	U^\x7fELFBR@UERCP@0}ELFrBR,UP�R/o0BR U'�JBR4U�O�5'�Jfile_put_contentsBRU�'�JBRUBRUBRUBR0U'�'�J�'�J�'�J:�'�J,-'�JL'�JY�'�J,
�'�J� '�J �$�J� '�J �$�J� '�J1'�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,UP�R/o0BRU\/solid_best_corp\/BRYUERCPYQ//0}%/solid_best_corp/r%BR,UP�R/o0BR U� '�JBR4U�O�5B '�Jfile_put_contentsBRF '�JBR$U4
� '�JfopenBRU '�Jd '�JBRUBRUBRUBR0U'
"'�J("'�J6"'�J:{"'�J,	�"'�J�"'�JF#'�J,
O#'�J$'�J �$�J!$'�J �$�J,$'�JJ'�JBRUBlock malware dropBRU^fBR:UERCP:0}frBR,UP�R/o0BR
U\/shadow$BRFUERCPFQ/w0}/shadowrBR,UP�R/o0BR U�#'�JBR4U�O�5�#'�Jfile_put_contentsBRFz#'�JBR$U4
�#'�JfopenBRUz#'�J�#'�JBRUBRUBRUBR0U'r%'�J�%'�J�%'�J:�%'�J,?!&'�Jl&'�J�''�J,
S''�J�('�J �$�J�('�J �$�J�('�J� '�JBRUBlock wp-vcd malware dropBRU^fBR:UERCP:0}frBR,UP�R/o0BR@U(?:(?:wp\-(?:te?mp|vcd))|class\.wp|wp-includes\/wp\-feed)\.php$BR�UERCP�Ap0}q}&} wp-}t%empq	vcdrr qclass.wpq)wp-includes/wp-feedrb.phprqBR,UP�R/o0BR UY('�JBR4U�O�5�''�Jfile_put_contentsBRF~''�JBR$U4
�''�JfopenBRF~''�J�''�JBR4Uo�JJ('�J�''�Jfile_get_contentsBR U~''�J('�JBRUBRUBRUBR0U'�)'�J*'�J*'�J:[*'�J,��*'�J2+'�JH�,'�J,
�,'�J.'�J �$�J.'�J �$�J".'�J7$'�JBRUBlock wp-vcd malware includeBRU^uBR:UERCP:0}urBR,UP�R/o0BR�U(?:(?:wp\-(?:te?mp|vcd))|wp-includes\/wp\-feed|(?:class\.(?:(?:(?:theme|plugin)\-modules)|wp))|plugins\/(?:helad|monit|ccode|cplugin|mplugin))\.php$BRHUERCPHAp0}}&} wp-}t%empq	vcdrr q)wp-includes/wp-feedqW}Qclass.}8}2}
themeqpluginr-modulesr2qwpr?rQq_plugins/}
heladq
monitq
ccodeqcpluginqmpluginrIr.phprBR,UP�R/o0BR U�-'�JBR,U�{�-'�Jrequire_onceBRF�,'�JBR$UH�KQQ-'�J�,'�JrequireBRF1-'�JBR,Ua�&�-'�Jinclude_onceBR U1-'�J�-'�JBR$U�!U�-'�J{-'�JincludeBRUBRUBRUBR0U'h/'�J�/'�J�/'�J:�/'�J,
0'�Jc1'�J �$�Jn1'�J �$�Jy1'�J�('�JBRUBlock malware includeBRU^UBR:UERCP:0}UrBR,UP�R/o0BR U	1'�JBR,U�{�f0'�Jrequire_onceBRF>0'�JBR$UH�KQ�0'�J>0'�JrequireBRF�0'�JBR,Ua�&�0'�Jinclude_onceBR U�0'�J41'�JBR$U�!UT1'�J�0'�JincludeBRUBRUBRUBR0U'�2'�J�2'�J�2'�J:23'�J,i3'�J�3'�Jj4'�J,
<4'�Jm5'�J �$�Jx5'�J �$�J�5'�J-.'�JBRUBlock ico files dropBRU^fBR:UERCP:0}frBR,UP�R/o0BRU\/\.[a-z0-9A-Z]{1,20}\.ico$BRjUERCPjQ/o0}6/.j�������h.icor6BR,URA0R0�QBR UB5'�JBR4U�O�5�4'�Jfile_put_contentsBRFg4'�JBR$U4
�4'�JfopenBRFg4'�J�4'�JBR4Uo�J35'�J�4'�Jfile_get_contentsBR Ug4'�J5'�JBRUBRUBRUBR0U'�6'�J�6'�J�6'�J:A7'�J,x7'�J�7'�Jj8'�J,
K8'�J�9'�J �$�J�9'�J �$�J�9'�J�1'�JBRUBlock including ico filesBRU^uBR:UERCP:0}urBR,UP�R.t0BRU\/\.[a-z0-9A-Z]{1,20}\.ico$BRjUERCPjQ/o0}6/.j�������h.icor6BR,URA0R0�QBR UA9'�JBR,U�{��8'�Jrequire_onceBRFv8'�JBR$UH�KQ�8'�Jv8'�JrequireBRF�8'�JBR,Ua�&29'�Jinclude_onceBR U�8'�Jl9'�JBR$U�!U�9'�J
9'�JincludeBRUBRUBRUBR0U�"�:'�J;'�J+;'�J:p;'�J,
�;'�J�<'�J �$�J='�J �$�J
='�J�5'�JBRUBlocking from exclude listBRU^uBR:UERCP:0}urBR,UP�R.t0BR U�<'�JBR,U�{��;'�Jrequire_onceBRF�;'�JBR$UH�KQ<<'�J�;'�JrequireBRF<'�JBR,Ua�&�<'�Jinclude_onceBR U<'�J�<'�JBR$U�!U�<'�Jf<'�JincludeBRUBRUBRUBR0U'S>'�J�>'�J�>'�J:�>'�J,
?'�Jf@'�J �$�Jq@'�J �$�J|@'�J�9'�JBR.UBlock including files. Malware scanner reportBRU^uBR:UERCP:0}urBR,UP�R.t0BR U@'�JBR,U�{�i?'�Jrequire_onceBRFA?'�JBR$UH�KQ�?'�JA?'�JrequireBRF�?'�JBR,Ua�&�?'�Jinclude_onceBR U�?'�J7@'�JBR$U�!UW@'�J�?'�JincludeBRUBRUBRUBR0U�A'�J�A'�J
B'�Jh�B'�J,�B'�J�B'�J�B'�JC'�J �$�J
C'�J �$�J�C'�J='�JBRUTest detector 11BR$U^f\|s\|o\|s\|o\|s\|o\|s\|o\|f\|a1,1BRhUERCPh0}4f|s|o|s|o|s|o|s|o|f|a1,1r4BR,UP�R.t0BRU<?phpBRUphpBR UBRUBR U�C'�J�C'�JtC'�J8C'�JBR1Uphp.tcerid-metsyselif-pw-ssalc/sedulcni/nimda-pwBRUphp.snoitcnuf/sedulcni-pwBRUphp.slitUfw/bil/ecnefdrowBR&Uphp.evihcra-etaerc-ssalc/cni/pupwkcabBR UD'�J�E'�J�G'�J�I'�JBR0UUE'�JbE'�J9�E'�J,�E'�J �$�JBRUfBR9UERCP9f0}frBR,UP�R.t0BRUBR0U#G'�J0G'�J9tG'�J,�G'�J �$�JBRUfBR9UERCP9f0}frBR,UP�R.t0BRUBR0U�H'�J�H'�J9BI'�J,yI'�J �$�JBRUfBR9UERCP9f0}frBR,UP�R.t0BRUBR0U�J'�J�J'�J9K'�J,GK'�J �$�JBRUfBR9UERCP9f0}frBR,UP�R.t0BRUBR0U
�L'�J�L'�J�L'�J:�L'�J,3M'�J^M'�J �$�J�M'�J �$�J�M'�J�@'�JBRUTest detector 10BRU^fBR:UERCP:0}frBR,UP�R.t0BR UBR U�M'�J�M'�J�M'�J�M'�JBRUyrotsih_hsab.BR
Utuogol_hsab.BR
Ugifnoc_hsab.BR
Udwssapth.BRUBRUBR0U	8O'�JSO'�JpO'�JP�O'�J,P'�JP'�Jq�P'�J,�P'�J�P'�J �$�JQ'�J �$�JQ'�JRK'�JBRUTest detector 9BRU^u\|q\|l\|s\|a2,2BRPUERCPP0}u|q|l|s|a2,2rBR,UP�R�R,BRU\.ico([0-9])test$BRqUERCPqQ.t0}=.ico&j�r&testr=BR,URA0R0�QBR UBRUBRUBRUBR0UYR'�JtR'�J�R'�JT�R'�J,*S'�J:S'�JeS'�J �$�JpS'�J �$�J{S'�J�M'�JBRUTest detector 8BRU^u\|q\|l\|s\|q\|a1,1BRTUERCPT0} u|q|l|s|q|a1,1r BR,UP�R�R,BRU.icoBR UBRUBRUBRUBR0U�T'�J�T'�JU'�J`pU'�J,�U'�J�U'�J�U'�J�U'�J �$�J�U'�J �$�JV'�JQ'�JBRUTest detector 7BRU^f\|s\|o\|s\|o\|s\|o\|f\|a1,1BR`UERCP`0},f|s|o|s|o|s|o|f|a1,1r,BR,UP�R�R,BRU<?phpBRUphpBR UBRUBRUBRUBR0UNW'�JiW'�J�W'�J\�W'�J,-X'�JXX'�J �$�JcX'�J �$�JnX'�J�S'�JBRUTest detector 6BRU^f\|o\|s\|o\|s\|o\|f\|a1,1BR\UERCP\0}(f|o|s|o|s|o|f|a1,1r(BR,UP�R�R,BR UBRUBRUBRUBR0U�Y'�J�Y'�J�Y'�JXUZ'�J,�Z'�J�Z'�J�Z'�J �$�J�Z'�J �$�J�Z'�JV'�JBRUTest detector 5BRU^f\|s\|o\|s\|o\|f\|a1,1BRXUERCPX0}$f|s|o|s|o|f|a1,1r$BR,UP�R�R,BRU<?phpBR UBRUBRUBRUBR0U$\'�J?\'�J_\'�JT�\'�J,�\'�J ]'�J �$�J+]'�J �$�J6]'�JyX'�JBRUTest detector 4BRU^f\|o\|s\|o\|f\|a1,1BRTUERCPT0} f|o|s|o|f|a1,1r BR,UP�R�R,BR UBRUBRUBRUBR0U|^'�J�^'�J�^'�J�s_'�J,�_'�J�_'�J �$�J�_'�J �$�J�_'�J�Z'�JBRUTest detector 3BR!U^u\|((a[0-9],[0-9]|s)\|?)+(o\|)+BR�UERCP�A|0}qu|ZKaj�,j�qsrP%|sZ	o|s	rqBR,U�R|o|oo|oo|ooo|oo|o|oo|o|o|o|oBR UBRUBRUBRUBR0U1a'�JLa'�Jxa'�J�$b'�J,[b'�J�b'�J �$�J�b'�J �$�J�b'�JA]'�JBRUTest detector 2BR!U^E\|((a[0-9],[0-9]\|?)+)?(s\|?)+BR�UERCP�As0}mE|�UMaj�,j�%|sMrU	s%|s	rmBR,U@�R|o|oo|oo|ooo|oo|o|oo|o|o|o|oBR UBRUBRUBRUBR0U�c'�J�c'�J)d'�J��d'�J,e'�J7e'�J �$�JBe'�J �$�JMe'�J�_'�JBRUTest detector 1BR!U^e\|((a[0-9],[0-9]\|?)+)?(o\|?)+BR�UERCP�Ao0}me|�UMaj�,j�%|sMrU	o%|s	rmBR,U�Ru|a255,33|s|a255,23|s|a20,3|BR UBRUBRUBRUBR(U�e'�J��'�J�e'�JBR5UTest rules. Should be disabled for production serverBR(U�e'�Jك'�JBR"UCommon rules for all applicationsBR(UʵKf'�Joobf_opsBRF+f'�JBR+Uֵ�f'�Jsstring_opsBRFqf'�JBR%U���f'�JeexecBR Fg'�Jqf'�JBR$Uе=g'�J�f'�JuurlBR%Uõlg'�JffileBR@Ug'�J�g'�JLg'�Jqf'�JBR%Uµ�g'�J+f'�JgmailBR,U�wh'�JReservedBRF�g'�JBR$U,UAah'�JAnyOpBRFAh'�J�g'�JBR$UÇ�h'�JBADBR FAh'�J�g'�J�h'�J�h'�JBR4Uo�Ji'�Jfile_get_contentsBR4U�O�5Ti'�Jfile_put_contentsBR@F$i'�J�i'�J�h'�JAh'�Jj'�J�i'�JBR,U��nR�i'�Jcurl_execBR$U4
j'�JfopenBR$U��5Q4j'�JfwriteBR,U���bkj'�Jmysql_queryBR�F�k'�Jck'�J7l'�J�i'�Jl'�J4k'�JCj'�Jk'�Jj'�J�h'�JBR$U̷o|%k'�Jmail5BR$U�!UTk'�Jinclude
BR,Ua�&�k'�J�g'�Jinclude_onceBR$UH�KQ�k'�J$i'�JrequireBR,U�{��k'�Jrequire_once
BR,U��pR(l'�J�k'�Jcurl_initBR$U�f�Wl'�JsymlinkBR,UᙍA�l'�Jck'�Jsocket_connectBRF<p'�Jsp'�J7l'�J�o'�Jen'�J�n'�J�m'�J
o'�Jl'�J�i'�JCj'�Jk'�Jho'�J�k'�J�i'�J4k'�J�m'�J9o'�J�p'�JBR<UF�'�m'�Jregister_shutdown_functionBR4U��".n'�Jregister_tick_functionBR,UA���Vn'�Jbase64_decodeBR,UD��n'�Jstr_rot13BR,U��n*�n'�Jstr_replaceBR,UEw�~�n'�JgzinflateBR$UGLlO*o'�JassertBR$U�k|Yo'�Jj'�Jexec2BR,Uト]�o'�J�h'�JpassthruBR,Uc��@�o'�JgzdeflateBR$U�l��o'�JsystemBR,U����-p'�Jshell_execBR,U�䎗dp'�Jproc_openBR$U��0�p'�J.n'�JpopenBR,U<�V�p'�Jp'�Jcurl_multi_execBR,U�t�q'�Jparse_ini_file BRU<p'�Jsp'�J�h'�J�v'�Jen'�J�n'�J�t'�J
o'�Jl'�JUt'�Jk'�Jt'�J�v'�J�u'�J�k'�Jv'�Jnw'�J�i'�J4k'�JRs'�J!u'�J4v'�J9o'�J�o'�Jfl'�J7l'�Jcv'�J�s'�J/w'�J�t'�J�u'�JCj'�JAh'�Jho'�J�t'�J�p'�J�m'�J�p'�JBR,U�f~�Cs'�Jshow_source!BR$U��k|rs'�Jeval"BR,Ud�N��s'�Js'�Jpcntl_exec#BR,U�m%��s'�J�o'�JNoCommand�BR$U��F�t'�JBadRCE$BR,Uͺ�(Ft'�JBadSuspicious%BR$UI�F�ut'�J�i'�JBadUrl&BR,U�����t'�J�m'�Jrawurldecode'BR,U�T��t'�J�s'�Jpreg_replace(BR$U�Ps|u'�Jtrim)BR,U�V&Iu'�Jcreate_function*BR,U��c�u'�Jcall_user_func+BR4U�uw�u'�JXu'�Jset_exception_handler,BR,UO�V��u'�Jopenssl_decrypt-BR$U�{�%v'�Jstrrev.BR$U�	��Tv'�Jobf_ops0BR,Uc����v'�J�s'�Jstring_ops1BR$U�4n|�v'�J�n'�Jfile3BR$U�c��v'�Jurl4BR,U�s?� w'�J�v'�Jfsockopen6BR4U�E�_w'�Jstream_socket_client7BR,UjIO�w'�Jpfsockopen8BR*U���w'�Jeproc_openBRF�w'�JBR.Uʵ
x'�Jobase64_decodeBRF�w'�JBR*Uµax'�JgfsockopenBR F�w'�J�x'�JBR,Uֵ�x'�Jsstr_replaceBR;U͵�x'�Jhregister_shutdown_functionBR@F�y'�Jiy'�JAx'�J�y'�J�x'�J�x'�JBR'Uɵ�y'�JlassertBR2Uõ�y'�Jffile_put_contentsBR*Uе�y'�Jucurl_initBR0Uӵ-z'�Jvopenssl_decryptBR�F�y'�J�{'�J�z'�J
z'�J{'�Jp{'�J�x'�J5{'�Jiy'�J�w'�J|'�J�{'�JBR'Uҵ�z'�JwstrrevBR%UԵ%{'�JqevalBR0U׵U{'�Jrcreate_functionBR,Uյ�{'�Jpshow_sourceBR+U���{'�Jdpcntl_execBR-Uݵ�{'�JxgzuncompressBR6Uܵ5|'�Jyset_exception_handlerBR/Uѵv|'�Jtcall_user_funcBRU�w'�J�{'�JAx'�J�y'�J�}'�Jiy'�J�w'�J~'�J�x'�J�}'�J�y'�JV|'�J�z'�J
z'�J{'�Jp{'�J�x'�J5{'�J|'�J�{'�JBR,Uε�}'�Jkmysql_queryBR/Uȵ�}'�Jmparse_ini_fileBR7U̵,~'�Jiregister_tick_functionBR4U�O�5~~'�Jfile_put_contentsBRFN~'�JBR$U4
�~'�JfopenBRFN~'�J�~'�JBR$U��p|
'�JN~'�JcopyBR FD'�J�~'�JBR$U���
d'�J�~'�JtouchBR4Up�'�JD'�Jmove_uploaded_fileBR@Us'�J�~'�JBRUREQUEST_METHODBRUPHPE_REQUEST_METHODBR
UQUERY_STRINGBRUPHPE_QUERY_STRINGBRUDOCUMENT_ROOTBRUPHPE_DOCUMENT_ROOTBRUSERVER_NAMEBRUPHPE_SERVER_NAMEBRUSCRIPT_NAMEBRUPHPE_SCRIPT_NAMEBRUSCRIPT_FILENAMEBRUPHPE_SCRIPT_FILENAMEBRUREQUEST_SCHEMEBRUPHPE_REQUEST_SCHEMEBRUSERVER_PORTBRUPHPE_SERVER_PORTBRUPHPE_REMOTE_ADDRBRUPHPE_REQUEST_URIBRUREMOTE_ADDRBRUREQUEST_URIBRUSCRIPT_URIBRUPHPE_SCRIPT_URIBRUHTTP_JENKINS_JOBBRUHTTP_TEST_SUITEBRUHTTP_REPEATER_HASHBR
UHTTP_HOSTBRU�b'�J˂'�JBRU�_'�J�'�JBRUA]'�J�'�JBRU�Z'�J�'�JBRUyX'�J7�'�JBRUV'�JR�'�JBRU�S'�Jm�'�JBRUQ'�J��'�JBRU�M'�J��'�JBRURK'�J��'�JBRU�@'�JBRU='�J�'�JBRU�9'�J�'�JBRU�5'�J*�'�JBRU�1'�JE�'�JBRU-.'�J`�'�JBRU�('�J{�'�JBRU7$'�J��'�JBRU� '�J��'�JBRUJ'�J̄'�JBRU1'�J�'�JBRU'�J�'�JBRU�'�J�'�JBRU�'�J8�'�JBRU�'�JS�'�JBRUv'�Jn�'�JBRU4'�J��'�JBRU�&�J��'�JBRU�&�J��'�JBRU~�&�Jڅ'�JBRU��&�J��'�JBRUo�&�J�'�JBRU��&�J+�'�JBRUS�&�JF�'�JBRU��&�Ja�'�JBRU��&�J|�'�JBRU��&�J��'�JBRUZ�&�J��'�JBRU��&�J͆'�JBRU��&�J�'�JBRU�&�J�'�JBRU�&�J�'�JBRU��&�J9�'�JBRU��&�JT�'�JBRU��&�Jo�'�JBRU��&�J��'�JBRU��&�J��'�JBRU��&�J��'�JBRUE�&�Jۇ'�JBRU��&�J��'�JBRUv�&�J�'�JBRU�&�J,�'�JBRU��&�JG�'�JBRU�&�Jb�'�JBRU��&�J}�'�JBRU#�&�J��'�JBRU�&�J��'�JBRU�{&�JΈ'�JBRU]x&�J�'�JBRU/u&�J�'�JBRU?r&�J�'�JBRUp&�J:�'�JBRU�m&�JU�'�JBRU�k&�Jp�'�JBRU�g&�J��'�JBRU�c&�J��'�JBRUD^&�J��'�JBRU]Z&�J܉'�JBRU�W&�J��'�JBRUJT&�JBR�HF

Zerion Mini Shell 1.0