!(?:(define)d\(['"]DOCS_VERSION['"]\)[^\}\$=\[]{1,199}\b\1\(['"]DOCS_API_URL['"]\h*,\h*['"]aHR0(?<X2174590>)|(function)\s*\(\s*\w+\s*,\s*\w+\)\s*{\s*!\3\s*\(\w+\s*\)\s*\{\s*\bvar\s*[^\.]{1,32}\.\w*\(['"]+\)\.map[\(\w,\s\)\{]+return\s*\w+\.fromCharCode\([^;]{32,128};\w+\s*\w+[\(\s\)\}\w]+['"]\\x\w{2}\\x\w{2}\\x\w{2}\\x\w{2}[^'"]{1024,4096}['"\s]*,\s*['"]\w*['"\s]*\);(?<X1265922>)|\$(?:_REQUEST\s*\[\s*['"]c99sh_surl['"]\s*\]\s*\)(?<X2100781>)|bots?\h*\[\d+\][^\}\{]{1,99}\{\s*(\$\w{1,40})\h*=\h*gets?_data_yo\h*\([^\)]{1,99}\b\w{1,40}\.dat['"]\h*\)\h*;\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"]\{\$\w{1,9}\}\h*\.\h*\w{1,9}\h*['"]\h*,\h*['"][wa]\+?['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\7\h*,\h*\6\h*\)\h*;(?<X2150342>))|\((?:function\(\)\{var\s*_0x\w{1,9}[\s=]+\[['"]createElement[^%>#=]{99,599}aHR0cHM6Ly9[^%>#]{99,2999}iPhone\|iPad\|iPod\|Android/i\[(_0x\w{1,9})[^%>#\^]{99,2999}document\[\9[^\{\^]+\{_0x\w{1,9}[\(\);\}\^]{5,15}(?<X1256862>)|isset\((?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(['"][^'"]*['"]|\((?:\11|\$\{[^\}]+\})\[[^\]]+\]\)=+['"][^'"]*['"])?[^@]{1,57}hex2bin(?:\(\$_[GPRSC]\w{2,6}|\(\$\{['"][^'"]*['"]\}|\(str\w+)(?:[^@]{1,180}|[^@]{1,600})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252782>))|\s*isset\s*\(\s*\$_SESSION\s*\[\s*(['"]nst['"])\s*\]\s*\)\s*\w{2,3}\s*\$_SESSION\s*\[\s*\13\s*\]\s*[^\w]{2,3}\s*\$\w{1,40}\s*\)\s*\{\s*die\s*\(\s*['"]\s*<title>(?<X2058320>)|async(?:\h*function[\h\(\)\{]+let\s*(\w+)[\h=]+decodeURIComponent[\h\(]+escape[\h\(]+atob[^#]{99,1500}\bdocument\.querySelector[\h\(]+['"]link\[rel=[^#]{99,500}\bawait\h*\w+\.json\(\)\)\.url\}/\?wsid=\$\{[^#]{9,199}\bwindow\.location\.replace\(\15\)\}\}\(\);?(?<X120369751>)|\s*function\(\)(?:[^\[]{1,59}(\$?\w+)=decodeURIComponent\(escape\(atob\(\[['"]aHR0cHM6Ly9[^:]{1,419}parseInt\(o\[1\],\s*10\)\s*:\s*null\s*\}\s*let\s*a\s*=\s*navigator\.userAgent[^\?]{1,1329}\(await\s*\17\.json\(\)\)\.url\}/\?wsid=\$[^@]{1,149}window\.location\.replace\(e\)\}\}\(\)(?<X120356841>)|\{let\s*\w+=(decodeURIComponent)\(escape\(atob\(['"][^"']+['"]\){1,3}[^\{]+\{\w+\s*btoa\(unescape\(encodeURIComponent[^!]+fetch\(\19\(escape\(atob\(['"][^'"]+['"]\){1,4};[^\-]+setItem\(['"](\w+)['"],[^!]+!==localStorage\.getItem\(['"]\20[^,]+,window\.location\.replace\(\w+[\)\}\(]+;(?<X1313173>)))|bot\w{0,9}\s*\([\s\)]+\{\s*echo\s*\w{1,40}\s*\(\s*(\$DOOR_FILE_NAME)\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*(?:\}\s*)+\$\w{1,40}\s*=\s*file_get_contents\s*\([^)]{0,99}\22[^)]*\)\s*;(?<X2131410>)|function(?:[\(\w,\s]{1,16}(\w)\h*\)\h*\{\s*var\s*\w{1,16}\h*=\h*Math\.floor[\(\h]+Date\.now[^'"]{1,128}atob[\s\(''"]+anMub3B0dHJh['"\s\+]+Y2tlci5vbmxpbmU[='"\);]+\(\24[^;]{1,256}\.appendChild\(\24[\)\}\(\s]+document\);(?<X1278511>)|\((\w+),(\w+)\)\{\h*let\s*\w+=\-1!==\26\.cookie\.indexOf\([^\)]+\);\26\.location\.toString\(\)\.includes\(\27\)&&fetch\(\[[^\]]+\]\.map\(function\(\26\)\{\h*return\s*String\.fromCharCode\(\26[\)\}\.]+join[\("'\),\{\h]+method\s*:\s*['"]POST[^;]+;[^;]+\(document[,\s]+['"]checkout['"][\)\s]+;(?<X1263090>)|\(\w(?:,\w)+\)\{const\h*\w+=["']\w{1,40}['"][,\w\h]+=(document)\.cookie;[^\}\?\{\n]{0,99}(\b\w{1,20})=\29\.referrer[^<\+\|]{9,999}if\(!\30[^<&^\}\{]+\30\.indexOf[\('"\h]+(?:google|bing|facebook|yahoo|instagram|naver|pinterest)[\.'"\)]+[^<\|\n]{9,}\bhead['"]\)\[0\]\.appendChild\(\w+[\)\}\(\h]+\29[\)\h]+;(?<X1248891>)|\s*\((_0x\w{1,9})[^\}\n\?&:]{1,499}(_0x\w{1,9})[=\s]+atob\s*\([^\}\?]{1,999}\32[\s\['"]+createElement['"][^\n\}:\?]{1,999}\[['"]src['"]\]\s*=\s*['"]https?:[/'"\s\+]+\33[^\}\n]{1,999}\}[\s\(]+document[\s\)]+;(?<X1264941>)|\s*\((_\w+)\s*\)\s*\{\s*var\s*_\w*\s*=\s*date[^!\}]{1,499}var\s*(_\w+)\s*=\s*\35\.referrer;\s*if\s*\(!\36\)\s*return;\s*var\s*_\w+\s*=\s*\[[\d,\s]+\];[^/]{1,499}fromcharcode[^:]+://[^\}\{]+\35\.createelement\(['"]script[^\}\{]+\35\.getElementsByTagName[^\}]{1,999}\}\(document\);(?<X1257373>)|\s*\([,\w\s\)\{]{4,32}=\s*\w+\.createelement\([^\}]+\}\s*\([^:]{1,99}://chimpstatic\.com/\w+\-\w+/js/users/\w+/dd13878c057168f24ab77a98e\.js['"]\s*\);(?<X1279283>)|\s*\w+\(\)\{\s*\b(var)\s*(\w+)=['"]https?://getfix\.win\b[^\}]{1,999}\40,!\d+\),(\w+)\.send[^{]{1,999}\{\39\s*(\w+)=[^\}]{1,999}\41\.\w+\.[^\}]{1,999}appendchild\(\42\)\}\}\s*catch\(\w+\)\{\}\}\(\);(?<X120338690>))|isset\(\$\w+\[['"](x\-imunify360)\-captcha\-bypass['"]\]\){2}\{goto\s*\w+;\}header\(['"]\44(?<X220326910>)|window\[\w+\(\w[^\]]+\]\s*&&\s*\(\s*window\[[^\]]+\]\s*=\s*\{[^\}/\+\)]{0,499}['"]R_PATH['"]\s*:\s*['"]https?://\w[^;\}]+\}\);(?<X1252100>))
"(?:;(?:@file_put_contents\("\$GLOBALS\[web_root\]temp/(?<X2049300>)|\s*eval\s*/\*[^*]+\*/\s*\(\w{1,30}\s*\(\s*\$\w{1,30}\s*,\s*\$\w{1,30}\s*\)\s*\);\s*\?>(?<X2045940>))|[#\-=\[]{10,12}Priv(?:8|ate)\s*PayPal\s*Scam(?<X2054713>)|User-Agent:\s*\$template"\s*\."\|\$pathToDor"\s*\."\|\$pathOnMyHost"(?<X2044781>))
#(?:!/(?:bin/(?:[^@]{1,999}echo\s*['"]C3Pool\s+mining\s+setup\s+script\b(?<X220353860>)|\w*sh\s*while[^/]{1,99}/dev/null;[^\-]{1,99}\-{2}url\s*['"](?:[\w\-]+)\.supportxmr\.[^\\]{1,999}done\Z(?<X220351381>)|bash\s*while\s*true\s*;\s*do\s*\{\s*if\s*\[\s*"\$\(pidof \w{1,100}\)"\s*\]\s*then\s*sleep\s*60\s*else\s*\.\s*/kswd\s*&\s*fi\s*\}\s*done(?<X2048540>))|usr/bin/(?:(?:ba|z|t)?sh\s*(?:DIR=\$1\s*IFS=\$[^\&]{199,399}\s*permnum=['"]0777['"]\s*permhuman=['"]drwxrwxrw['"][^\?]{500,}\$permcolor\\['"]\},\s*done\s*echo\s*['"]\{\}\]['"](?<X2058360>)|USEFUL\s*=\s*\([^\)]{1,99}\)[^\?]{999,2000}Cant\s*Read\s*\[\s*/etc/named\.conf\s*]\\c['"]\s*fi\s*echo\s*-e\s*['"]['"]\]\}\\c['"](?<X2058350>))|env\s+python[^>]{9,700}(?:auto)?commands?\s*=\s*['"]unset\s+HISTFILE;uname\s+-a;id['"](?<X2124950>)|perl(?:[^:]{1,30}use\s+IO::Socket;[^/]{99,600}(?:\$\w{1,20}\s*=\s*|print\s+)['"]['"Jm7\.3uz]{6,12}['"];(?<X2064121>)|\s*[^\?]{450,600};\s*system\(\s*decode_base64\s*\(\s*\$\w{1,40}\s*\{\s*['"]cmd['"]\s*\}\s*\)\s*\)\s*;\s*print\s*['"]</pre>['"]\s*\}\s*\}(?<X2058340>))|p(?:hp\h+\-q\s+eNrtW(?:mtPW0kS.StMFI2JJtr0|WtPW1cW.SsERTVoUH)(?<X2152511>)|ython(?:[^'"]{1,99}program_name\s*=\s*['"]fpm-worker-main['"][^\\]{0,50}(?:\w{1,20}\s*=\s*['"]https?://[^'"]{9,40}/\w{1,20}\.(?:json|php)['"]\s*){1,3}\w{1,20}\s*=\s*['"]\w{1,9}\.sh['"](?<X2063550>)|[^_]{1,99}_?exploit[^\)]+\b\w+\s*=\s*\w*\(\)\s*token\s*=\s*['"][^'"]{1,128}+['"]\s*chatid(?<X2245490>)))))|#(?:(?:START|END)_DATA##['"][^\?]{1,49}=(?:explode|array)\([^\)]{99}[^\?]{1,999}=['"]adhupemail\.com\b(?<X2202971>)|\s+\w{1,40}\s+(?:Priv8|Private)\s+Webshell(?<X2056721>))|([a-f\d]{6,9}#)\s*if[\s\(]+empty[\s\(]+(\$\w{1,40})[\s\)]+\{\s*\15[=\s]+['"]<script\b[^:]+\bsrc[\h=]+\\?['"]http://[^/]+\.[a-z]{2,9}/[^'"]+['"]\s*>\s*</script>['"];\s*echo\s*\15;\s*\}(?:\s*#/\14)?(?<X1238171>)|([a-z0-9]{4,9}#)\s*(?:/\*\*[^$]{1,}\*/\s*)?if\s*\(\s*empty\s*\(\s*\$\w{1,40}[\)\s]+\{\s*error_reporting\s*\(\s*0\s*\)\s*;[^#\?]{999,2999}@?fsockopen\s*\([^#]{999,1999}echo\s+[\$'"][^;]{1,199};\s*\}(?:\s*else\s*\{[^\}]+)?(?:\s*\}){1,2}\s*#/\17(?<X1133351>)|(\w+)#\s*\w+\(\w+\(base64_decode\(['"][^'"]{99,}['"]\){3};\s*#/\19#\s*\?>\s*(<!\-\-\s\.\s*\-\->)<(script)\s*>\w+\s*(\w+);\w+=\w+\.createTextNode\([^<]{1,999};eval\(\22\([^\)]+\)\);\s*</\21>\s*\20(?<X120351211>)|(\w{1,15}#)[^\{]{9,1500}\bif\h*\(\h*empty\h*\(\h*(\$\w{1,9})[\s\)]+\{\s*if[\(\h]+substr[\(\h]+trim[\(\h]+(\$_SERVER)\[[^\]]+\][^\(]{0,49}\bpreg_match\(\s*['"]/\(googlebot\|\w[^\?]{99,1999}\bfunction\h*__file_get_url_contents\(\s*\$remote_url[^\?]{9,2500}\25(\[[^\]]+\])\h*=\h*\26\27;[^#]{2,499}#/\24(?<X1178971>)|(\w{4,7}#)\s*if\s*\(\s*empty\s*\(\s*(\$\w{1,5})\s*\)\s*\)\s*\{\s*\30\s*=\s*['"]<(script)\s+type\s*=\s*[\\'"tcpservi/jxa]+[^;]+;\w{1,5}\s*=\s*['"\\+document]+;\s*(\w{1,5})\s*=\s*['"\\+split]+;[^:]{9,200}eval[^/]{9,99}['"][\w]{999,7000}\\['"]\[\32\][^<]+\);\s*\}\s*<\/\31>['"];\s*echo\s+\30;\s*\}\s*#/\29(?<X1059342>)|[a-z0-9]{4,9}#\s*(?:/\*\*[^$]{1,}\*/\s*)?if\s*\(\s*empty\s*\(\s*\$\w{1,40}[\)\s]+\{\s*if[\s\(]+substr[\s\(]+trim[\s\(]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\s\)]+,[^\)]+\)\s*==\s*['"]\d+\.\d+['"]\s*\)[^#\?]{999,4999}@fsockopen\s*\([^#]{999,1999}echo\s+[\$'"][^;]{1,299};(?:\s*\}){2,5}\s*#/[a-z0-9]{4,9}#(?<X1133324>)|\$\s*https://telegram\.me/neo_net\b(?<X2208800>)|\-+do\-+not\-change\-+the\-+following\-+content\-+\s*<(FilesMatch)\s+['"]\.\([^\)]{0,99}\b(?:py\|?|exe\|?|php\d*\|?)[^>]{0,199}>\s*Order\s+(Allow[,\s]+deny)\s*Deny\s+(From\s+all)\s*</\36>\s*<\36\h*['"]\^\((?:[^\|]{0,40}\.php\d*\|?)+\)\$['"]>\s*Order\s+\37\s*Allow\s+\38\s*</\36>(?<X1220973>)|\h*(?:Facebook|ICQ):\h*(?:facebook\.com/|@)Ex\.Robotos\s*RewriteEngine\h+On\b(?<X2165623>)|\s*(?:!/usr/bin/python[^>]{1,600}>\s*<methodCall>\s*<methodName>\s*wp\.getUsersBlogs\s*<[^\]]{1,600}passlist\s*=\s*\[\s*['"](?<X2059821>)|BEGIN\s*W0RDPRESS\s*#<IfModule\s*mod_rewrite\s*\.\s*c>\s*#RewriteEngine\s*On\s*#RewriteBase\s*/\s*#RewriteCond\s*%\s*\{\s*REQUEST_FILENAME\s*\}\s*!-f\s*#RewriteCond\s*%\s*\{\s*REQUEST_FILENAME\s*\}\s*!-d\s*#RewriteRule\s*\.\s*/index\s*\.\s*php\s*\[\s*L\s*\]\s*#</IfModule>\s*#\s*END\s*WordPress(?<X1042681>)|Jakarta-Blackhat\s*Hacker(?:`|'|")s(?<X2056940>))|\s+Handle\s+ALL\s*\.xml\s+requests\s+anywhere\s+in\s+the\s+path\s*(RewriteRule)\s*\.\*\\\.xml\$\s+(x\.php)[^\^]{1,49}\44\s*\^\(beima\|robots\)\$\s+\45[^\-]{1,49}\44\s+\^index\\\.php\$\s*\-\s*\[L\](?<X120361370>)|builds\h+random\h+ascii\h+string\s+def\h+buildblock\((?:self\h*,\h*)?size\):[^#]{9,499}print\h+['"][^'"]{0,99}(?:flood|port|attack|worker|udp|dos|hulk|crack|brut)(?<X2150790>)|wordpress\s*rewrite\s*rules\s+<(FilesMatch)\s+['"]\.\(ph[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\48>[^<>\)\(]{0,40}<\48\s*['"]\^\((?:[\w\-\.]+\.php\|?)*\)\$['"]\s*>\s*\49\s*Allow\s+\50\s*</\48>(?<X1218131>))
%24(?:\w{1,14}\s*/%2A(?:%20)*\w{1,14}(?:%20)*%2A/(?:%20)*%3D(?:%20)*/%2A(?:%20)*\w{1,14}(?:%20)*%2A/(?:%20)*(?:%27|%22)?\d{1,5}(?:%27|%22)?%3B(?<X2273130>)|\w{1,40}(?:%20)*%3D(?:%20)*class_exists%28%24\w+%29%3B[^\n\*]{0,499}%24\w+(?:%20)*%3D(?:%20)*new(?:%20)*/%2A[^\*\n'"]+2A/(?:%20)*\w+(?:%20)*%28[^\?\n'"]{9,19999}%28%29%3B%7D(?<X2273141>))
&(?:&\$_POST\[['"](?:password|passwd|pass)['"]\]={3}['"]\d+['"]\)\s*\{\$_SESSION\[['"][^\n]{1,2999}\{\$\w+=php_uname\(\);\$\w+=phpversion\b(?<X2323160>)|(?:amp;)?\.?rand=13vqcr8bp0gud\b(?<X2153013>)|\(isset\(\$_POST\[['"]analyze_system['"]\]\)\s+\|\|\s+isset\(\$_POST\[['"]attempt_autopwn['"]\]\)\)\)\{goto\s+\w+;\}goto\s+\w+;(?<X220338731>)|\.?rand=13InboxLight\.aspx(?<X2148911>)|copy;\s*202[32]\s*&bull;\s*SLOT\d{2}\s*</span>[^:\.\?]{0,99}</body>(?<X2230080>)|lt;\?php\s+(\$\w+)[\s=]+(&#\d+)[^/*]{1,199}\7;;[^\(]{1,99}error_reporting\(0\);\s*ini_set\(\7;log_errors\7;,\s*0\);\s*eval\(\$\w+\(\6\(\7;VTIlpz9l[^;]+\7;\)\)\);(?<X120357101>))
'(?:;\$\w+=str_rot13\('fge_ebg13'\);\$\w+=\$\w+\('onfr64_qrpbqr'\);\$\w+=\$\w+\('[^']+'\);eval\(\$\w+\(\$\w+\(\$\w+\(\$\w+\)\)\)\)(?<X2045391>)|scheduler'\s*=>\s*\[\s*'custom_jobs'\s*=>\s*\[\s*'(\w+)'\s*=>\s*\[\s*'command'\s*=>\s*'/bin/(?:ba)?sh',\s*'args'\s*=>\s*'/tmp/shell\.sh',\s*'at'\s*=>\s*'(\*\s+)\3\3\3\*'[^\]]+\]\s*\],\s*'status'\s*=>\s*\[\s*'\2'\s*=>\s*'enabled'\s*\]\s*\],(?<X120364893>))
(&lt;)script[^:\.>]{1,99}src\s*=(&[^;]{1,5};)https?://magento(?:\.name|core\.net)/[^>\.]{1,40}\.js\2\s*(&gt;)\s*\1/script\3(?<X1127232>)
((\$\{['"]GLOBALS['"]\}\[)['"]\w{1,40}['"]\])=['"]key['"];\$_POST\[\$\{\1\}\]=stripslashes\(\$\{\2[^\]]+\]\}\);[^@\?]{9,99}<title>[^/<]{1,49}\bShell\b(?<X2145110>)
((\$\{['"]GLOBALS['"]\}\[)[^\]]+\])=['"][^\?\n:/@#%&\*\+\\\|<>!]{1,499}=file_get_contents\(['"]php://input['"]\);[^\?\n:/#%&\*\+\\\|<>!]{1,499}\1\}?=(?:\$\{)?\2[^;]+;try\{eval\((?:\$\{)?\1\}?\);\}catch\([^\)]+\)\{[^\}]{0,199}\}{1,2}(?<X1218611>)
(//###==###)(?:[^#]{1000,6000}\}\}\}\}if\(@\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\s*==\s*\w{1,40}\(\w{1,40}\)\)\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\(\$GLOBALS\[['"][^'"]{1,40}['"]\]\[\w{1,40}\]\(\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\s*\)\s*\)\s*;\s*\}\s*echo\s*\$\w{1,40};\s*\}\s*\1(?<X1053603>)|\s*\$GLOBALS\s*\[[^\]]+\][=\s]+Array[\(\s]+base64_decode[\(\s]+['"][^\n\?><]+\?>\h*<\?[ph\h]*function[^\n#]+\}\s*\1(?<X1276800>)|\s+(?:(\$\w{1,40})\s*\.?=\s*['"][asertvl]+['"];\s*){1,3}@\4\s*\(\s*str_rot13\s*\(\s*['"]riny\s*\([^\)]{999,1999}[\s\)]+;['"][\s\)]+;\s*\1(?<X1137863>))
(//###={1,3}###)\s*@?error_reporting\s*\([^#]+\}\s*if\s*\(\s*!\s*empty\s*\(\s*\$_COOKIE\s*\[\w{1,40}\(\d+\)\][\s\)]+die[^#]{1500,5000}?\{\s*@?eval\s*\(\s*\$GLOBALS\s*\[['"]_\w{1,40}_['"]\]\s*\[\d+\]\s*\(\s*\$_REQUEST\s*\[['"]\w{1,40}['"]\][\s\)]+;\s*\}\s*\}\s*\1(?<X1127690>)
(//\h*install_code)\b[^#]{999,19999}\bWP_URL_CD\h*\([^;]{1,99};[\}\s]+if\s*\(\s*\$\w{1,40}\s*=\s*@?file_ge(t_contents\s*\(\s*__FILE__)[\s\)]+\{\s*(\$\w{1,40})\s*=\s*preg_replace\s*\(\s*['"]\W\1\b[^\}]{1,999}\bfile_pu\2\s*,\s*\3\s*\);[\}\s]+\1_end\b(?<X1187130>)
(//\s*EG_TEMP_+RECEIVER)\w+\s*add_action\(['"]init['"],\s*function\(\)\s*\{\s*if[\h\(]+isset\((\$_GET\[['"]\w+['"]\])\)\s*&&\s*\2[^;]{1,49}isset\(\$_POST[^\{]{1,199}(\$\w+)[^\?]{1,99}dirname\((\$\w+)[^@]{1,199}file_put_contents\(\4,\s*base64_decode\(\3[^\}]{1,99}filesize\(\4[^\(]{1,49}wp_die\(['"]READY['"]\);\s*\}\s*\}\);\s*\1\w+(?<X120360840>)
(//\w{1,9})bg[^\*\(\[\{#]{1,49}\./\.htaccess['"];[^\}]{1,599}\}\s*(@?chmod\(\$\w{1,15},\h*\d{3,4}\);)\s*@?file_pu(t_contents)\s*\(\s*\$\w{1,40}\s*,\s*@?file_ge\3\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\2\s*[^\?]{99,1999}\1end(?<X1178782>)
(//i)start\s*(function)\s+\w{1,40}\((\$\w{1,40})\)[^\}]{1,99}glob\(\s*\3[^\)]+/wp\-\*\.php[^@]{99,1999}(\$\w{1,40})\s*=\s*\$_[GCPSR]\w{2,6};\s*(\$\w{1,40})\s*=[^;]{1,40};\s*if[^;]{1,99}@?\4\[\5\]\(@?\4\[[^%]{999,4999}\2\s*decrypt_url\([^\}]{99,499}\}\s*return\s*\$\w{1,40};\s*\}\s*\1end(?<X1137971>)
(//wp\w+)\h*(?:bg|beginning|start)\s*(?:\$\w{1,20}[\h=]+["'][^'"]{1,60}['"];\s*){5,15}\bif[\h\(]+(\$\w{1,20})[&\h]+(file_)exists[\h\(]+(\$\w{1,20})\)\)[\s\{]+[^&\\@]{99,250}\b(\3pu(t_contents)\()\2[,\h]+(\3ge\6\()\4\)\);[^\\\?@]{600,1200}\5[^\)]+\7[^\}]{1,40}\bchmod\([^;]+;[\s\}]+\1\h*(?:end|ed|exit)(?<X1203950>)
(/[\*/\h]+\w+)_start\s*\$\w{1,20}[\h=]+['"]['"filesz\.\h]{8,30}['"];\s*\$\w{1,20}[\h=]+['"][file_xist'"\.\h]{11,30}['"];\s*(\$\w{1,20})[\h=]+['"][file_putcons'\.\h]{17,50}['"];[^\*\?]{300,999}\2[\h\(]+[^;]+\);\s*[@\$]*\w+[\h\(]+[^,]+,\h*\d+\);[\}\s]+\1_end\b(?<X1233490>)
(/\*123\*/)eval\1\(\1base64_decode\1\(file_get_contents\(['"]index\.txt['"]\),\s*true\)\);(?<X120356250>)
(/\*[^\*]{1,30}\*/)\s*@?error_reporting\h*\([,\h'"]*(?:NULL|0|false|off)[\h\)'"]*\);(?:\s*@ini_set\h*\(\s*['"](?:error_log|log_errors|display_errors)['"][,\h'"]+(?:NULL|0|false|off)[\h\)'"]+;)+\s*@eval\(\s*base64_decode\([^\?\*]{99,20000}\1(?<X1040621>)
(/\*[a-f\d]{3,9}\*/)\s*(\$\w{1,40})\s*=\s*['"]/h[^'"]+/\.[^'"/\.]+\.[a-z]{2,5}['"]\s*;\s*if[\(\s]+!\h*isset[\(\s]+\2[\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*else\s*\{\s*@include(?:_once)?(?:\s*/\*+[^\*]*\*+/)?[\(\s]*\2[\)\s;]+\}\s*\1(?<X1280910>)
(/\*[a-f\d]{32}\*/)\s*(\$\w{1,20})\h*=\h*['"][base64_dco\.'"]{16,40}['"]\h*;\s*@?eval\h*\(\h*\2\h*\(\h*['"][^'"]{999,19999}['"]\h*\)\h*\)\h*;\s*\1(?<X1166071>)
(/\*[a-f\d]{4,64}\*/)\s*(function)\h*\w{1,40}\([^\)]+\)\s*\{\s*var\s*(\w{1,9})\h*=\h*document\.create(Element)\(['"]script['"]\);\h*\3\.src=\w{1,40}[^\}]{9,499}\.get\4sByTagName\([^\)]+\)\[\d+\]\.appendChild\(\3\)\h*\}\s*\2\h*(\w{1,40})\([^\)]*\)\s*\{[^\*\v]{999,9999}\b\5\b[^\;]{2,19};(?:\s*\1)?(?<X1188431>)
(/\*\*<\w+>\*/)\w+\s*(\w+)\(\)\s*\{\s*echo\s*['"]<(script)\s*async\s*src\s*=\s*['"]https?://[^'"]+['"][\s></]+\3>['"];\s*\}\s*add_action\(['"]\w+['"],\s*['"]\2['"]\);\1(?<X120332890>)
(/\*\*\s+Go)\s+Theme\s*\*/\s*error_reporting\(0\);\s*(\$\w+)[\s=]+array\([^\{]{1,99}\$_SERVER[^@]{1,299}function\s+(file_get_contents\w+)\((\$\w+)[^;]{1,49}\4[^:]{1,149}(\$\w+)[\s=]+['"]https?://[^'"]+['"][^>]{1,99}\3\(\5[^@]{1,199}explode[^/]{1,149}\2[^\?]{1,49}include[^;]{1,49}\.php[^\}]{1,49}exit;\s*\}\s*\1Theme\s*\*/(?<X120359590>)
(/\*\s*[a-f0-9]{1,32}\s*\*/)\s*var\s*(\w{1,2}x\w{1,9})=\[['"][^_\n]{99,1999}(?:\\x2f|/)(?:i|\\x69)(?:f|\\x66)(?:r|\\x72)(?:a|\\x61)(?:m|\\x6d)(?:e|\\x65)(?:>|\\x3e)[^\n\*]{99,999}(\w{1,2}x\w{1,9})\[\2\[\d+\]+=\w{1,2}x\w{1,9}\[\d+\][^;]{0,99};document(?:\[\2\[\d+\]+)+\(\3\)[;\} ]{1,9}\s*\1?(?<X1133611>)
(/\*\s*\w+\s*\*/)\s*add_action\(['"](?:\w+['"],function\(\)[^%]{1,399}isset\((\$_POST\[['"]\w+['"]\])\)\)\{ob_start\(\);try\{eval\(\2[^%]{1,299}isset\((\$\_POST\[['"]\w+['"]\])\)\)\s*\{\$\w+=@?shell_exec\(\3[^%]{1,199}exit;\},0\);\s*\1(?<X120359950>)|init['"],\s*function\(\)\s*\{\s*(\$\w+)[\s=]+base64_decode\(['"]PD9waHAN[^'"]+['"]\);[^\(]{1,99}(\$\w+)[\s=]+defined\(['"](\w+)['"]\)\s*\?\s*\7[^@]{1,99}\6\s*\.\s*['"][^'"]+\.php['"][^\?]{1,99}(@?file_put_contents)\(\$\w+,\s+\5[^#]{1,899}@?file_get_contents[^&]{1,99}\1[^#]{1,229}\8[^\*]{1,99}\1(?<X120359030>))
(/\*\s+\w+\s*\*/)\s*add_action\(['"]init['"],\s*function\(\)\s*\{\s*\$\w+[\s=]+base64_decode\(['"][^'"]+['"]\);\s*\$\w+[\s=]+defined\(['"](?:WPMU_PLUGIN_DIR|WP_CONTENT_DIR)?['"]\)[^#]{1,999}\.php['"][^#]{1,499}@?file_get_contents[^\?]{1,99}\1[^#]{1,199}rtrim\(substr[^#]{1,99}strlen[^\*]{1,299}\d+\);\s*\1(?<X120363541>)
(/\*\w+)_\w+\*/\s*(\$\w+)[^:]{1,99}https?://[^'"]{1,199}\.php[^\{]{1,199}['"](\w+)['"]\.\2[^;]{1,49}['"]\3['"]\.\2[^\}]{1,99}\$_SERVER\[['"]\w+[^\?]{1,699}file_get_contents\(\$\w+\);\s*preg_match\([^\{]{1,299}/root/\.ssh/['"]\],glob[^@]{1,499}@wp_remote_post[^\}]{1,99}\}\s*\1\w+\*/(?<X120349633>)
(/\*\w{32,64}\*/)(?:\s*;)?\s*(window)\[[^\]]{1,40}\]\[[^\]]{1,40}\]=\[[^\]]{999,9999}\];\s*var\s*[\w=]+=\2\[[^\]]{1,99}\]\[[^\]]{1,99}\],(\w{1,40})=\2;[^\n\)]+\3\[[^\]]{1,40}\]\[[^\]]{1,40}\]\]?\.join\([^\)]{1,9}\);['"]\)+;\s*\1?(?<X1128721>)
(/\?do=kak-)udalit-[^'">]{1,99}['"]>[^</>\v]{4,99}</a>(?:[^\?]{0,499}<a\h+href=['"]https?://[^/]{4,40}/\w{32}\1[^'">]{1,99}['"]>[^</>\v]{4,99}</a>){2}(?<X2148550>)
(;\$b25)\w+[\h=]+0;\s*(\$\w+)[\h=]+function[\h\(]+\$\w+[\s\)\{]+\$\w+[\h=]+array[\h\(]+(?:0x\w+,\h*){99}[^;]+;[^\n\?]{99,199}\$_REQUEST;\h*\$\w+[\h=]+\$_SERVER;[^\n#]{500,3000}\berror_reporting\(0\);\h*try\{\h*@?\2\(true\);\h*\}\h*catch\([^;]+;\h*\w+\(\);\s*\1\w+[\h=]+0;(?<X120350910>)
(<!--[^\w]+-->)\s*<Script>\s*document\.write\s*\(\s*unescape\s*\(\s*['"]%3c%69%66%72%61%6d%65[^'"]{99,300}%22%76%69%73%69%62%69%6c%69%74%79%3a%20%68%69%64%64%65%6e%22[^'"]{1,50}['"]\)\s*\)\s*</script>\1(?<X1062281>)
(<!--service_)start-->\s*<html>(?:</?head>){2}<body>\s*<\?php\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[['"]([^\]]+)['"]\]\D{2,9}['"][^'"]{1,40}['"]\h*\)\s*\{[^#]{999,1999}\}\s*else\s*\{\s*print\h*['"]<(script)\h+type\h*=[^;\?]+\+\h*['"]\h*\?\h*\2\h*=\h*\w{1,40}['"]</\3>['"];\s*\}\s*\?>\s*</body></html>\s*\1end-->(?<X1143710>)
(<!\-\-[a-f\d]{32}\-\->)<\?php\h*@ob_start\(\);\h*@ini_set\(['"]display_(error)s['"][,\h]+0\h*\)\h*;\h*@\2_reporting\(0\);\h*echo\h*base64_decode\(['"]PHNjcmlw[^;=]{4999,9999}(?:=+|\+)['"]\)\h*;\h*\?>\1(?<X1177151>)
(<!\-\-service)_start\h*\-\->[^\?]{1,30}<\?php[^\?]{1,599}(\$\w{1,40}\h*=\h*fopen)\(\$\w{1,20}\.['"]/(?:wp\-(config)|\3uration)\.php['"],[^#]{99,2299}\2(\(dirname\(_(_file)__\))\.['"]/\w{1,12}\.php['",\h]+w\+?['"]\);[^%]{1,350}(?:move_uploaded\5|copy)\(\\\$\5s\[[^#]{1,540}@?touch\4,[^!]{1,299}\1_end\h*\-\->(?<X1172943>)
(<\?(?:php)?\s*(\$GLOBALS\[['"]\w+))[^=]{1,32}=array\((base64_Decode)\(['"]\w+['"]\.['"]\w+['"]\.[^\)]{1,999}\).\3\(['"]+\.['"]\w+[^\}]{1,9999}\}\s*\?>\s*\1['"]\][^\}]+\}\2['"][^\?]{1,999}\?\2[^\\]{1,9999}\2['"]\]\[\d+\]\s*\((round)[^,]{1,99},\4\([^;]{1,99};\}\s*\?>(?<X120331880>)
(<\?(?:php)?\s*\w+\(\w+\)\{/\*\w+\*/\};\s*\?>)<\?(?:php)?\s*\$\w+[^'"]{1,99}"PD9[^'"]+['"]\),\w+[^\}]+\}\?>\1(?<X120332531>)
(<\?(?:php)?\s*while\(\w+\)\{break;\};\?>)<\?(?:php)?\s*\$\w+[^'"]+base64_decode\(['"]PD9[^'"]+['"]\),[^\}]{1,999}\}\?>[^\\]{1,299}\1(?<X120332450>)
(<\?(?:php)?\s+[^\?]{2,99}\?>)<\?(?:php)?[^\}]{1,999}['"]PD9[^@]+\?>\1(?<X120333442>)
(<\?(?:php)?\s+\$\w+=[^;]{1,99};\?>)<\?(?:php)?\s*[^;]{1,999}base64_decode\(['"]PD9[^'"]+['"]\)[^@]+\};{4}\$\w+=\w+[^\?]{1,99}\?>\1(?<X120332430>)
(<\?(?:php)?\s+\$\w+=microtime\(\w+\);\?>)<\?(?:php)?[^?>]{1,999}base64_decode\(['"]PD9[^'"]+['"]\)\);\}\?>\1(?<X120332420>)
(<\?(?:php)\s*)\$\w+=['"](\w+)['"];\$\w+=['"](base64_decode)['"];ini_set[^;]{1,49};echo[^;]{1,29};(error_reporting\(0\);\?>)\1\$\w+=['"]\2['"];\$\w+=['"]str_rot13['"];\$\w+=['"]\3['"];\$\w+=['"]gzinflate['"];echo\s*['"]<html></html>['"];\4(?<X120351091>)
(<\?)php\s*file_(?:ge|pu)t_contents\h*\(\$_[GPRSC]\w{2,6}\[['"]DOCUMENT_ROOT['"]\][\h\.]+['"][^\'"]{0,49}\.php['",\h]+\1\s*(\$_\w{1,20})\h*=\h*['"]chr['"];\s*\&?(\$_\w{1,20})\h*=\h*(?:\2\(\d+\)\.){1,20}[^;]+;\s*(\$_\w{1,20})\h*=\h*\2\(\h*\d+\h*\)\.[^;]{1,199};\s*\$_\h*=\h*\4\(['"\h]+,\3\);[^#]{1,49};\s*\?>(?<X1187271>)
(<\?[ph\s]+)(?:\w+:\s*header\(['"]access\-control\-allow\-origin:\*['"]\);(goto)\s*\w+;\?>[^<]+\1\w+:\s*fwrite\(\$\w+,\$\w+\);\2\s*\w+;\?>(?<X2310320>)|define\(['"]PBOX['"][^;]+;\s*@?[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\bdelayedlinks\.php['"](?:[\)\s]+)?;\s*\?>\s*\1@?[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\.php['"](?:[\)\s]+)?;\s*\?>(?<X1217880>))
(<\?php)(?:\h+\$\w{1,40}\h*=(?:\h*[hsm](?:exdec|ubstr|d5)\h*\(\h*){3}\$_SERVER\[['"]HTTP_HOST['"]\][\h,\d\)]{7,18};[^\->]{0,499}(\$jemenu)\h*=\h*\$app(->get)Menu(\(\));\s*if\h*\(\h*\2\3Active\4\s*=[^\;\{]+\)\s*\{\s*(\$\w{1,40})\s*=\s*rand\4;[^;]+\5;\?>['"][^\*&%:\-]+['"]none['"];\s*\}\s*</script>\s*\1\s*\}\s*\?>(?<X1048382>)|\s*(?:(\$\w+)[\s=]+__DIR__\s*\.\s*['"]/\w+\.php['"];\s*(\$\w+)[\s=]+['"]\1[^%]{1,199}if\s*\(file_exists\(\7\)\s*&&\s*filesize\(\7[^%]{1,99}time\(\)\s*\.\s*['"]\.php[^%]{1,99}file_put_contents\(\7,\s*\8,\s*LOCK_EX[^%]{1,99}die\(['"][^%]{1,99}loader(?<X220365520>)|error_reporting\((?:0|NULL|FALSE)\);\s*function\h*\w{1,15}\((\$\w{1,15})\)\s*\{\s*\$\w{1,15}\h*=\h*curl_init\(\10\);[^\?]{0,299}\bfile_put_contents\(['"][^'"]+\.png['"],\h*['"]\1[^\}]{0,99}\}\s*(?:require|include)(?:_once)?\h*__DIR__\s*\.\h*['"][^'"]+\.png['"];\s*(?:\?>|\Z)(?<X1175041>)|if(?:[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*\$\w{1,40}\h*=\h*['"]\1\s*@?eval[\h\(]+(?:(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\(){3,}['"][^'"]{999,9999}['"][\s\)]+;\s*\?>['"];\s*@?file_put_contents\(['"][^'"]{9,99}\.php['"][,\h]+\$\w{1,40}[\s\)]+;\s*\}\s*\?>(?<X1177670>)|\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\))\h*\W{2,3}\h*(?:md5|sha[1256]{1,3})[\h\(]+\13\h*\S{2,3}\h*(base64_decode)[^\{]{1,99}\{\s*(\$\w{1,9})\h*=\h*\14[\h\(]+\$_[GPRSC]\w{2,6}[^;]+;\s*file_put_contents[\h\(]+(['"]lte?_['"])\h*,\h*['"]\1[\h'"\.]+\15\);\s*\15[\h=]+\16;[^\?]{1,199}\?>(?<X1185781>))))
(<\?php\s*)(?:add_action\(['"][\w\-]+['"],\s*(function)\s*\(\)\s*\{\s*\?>\s*<script>\s*\(\2\(\)\{\s*\w+\s*\(/[^\)]+\w\.test\(\w+\.userAgent\)\)\s*\{\s*\w+\.href[\s='"]+https?://[^;]+;[\s\}\)\(]+;\s*</script>\s*\1\}\);(?<X120357391>)|if\h*\(in_array\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{1,40}\?>\s*<(span)\b[^>]{9,60}>\s*(?:<a\h*href\h*=\h*['"]https?://[^<]{9,99}</a>\s*){3,9}</\4>\s*\1\s*\}\s*\?>\s*\Z(?<X1193041>))
(<Hacked>)\s*(?:<br>\s*){2,6}\1(?<X2174380>)
(?:(?:\$\w{1,20}='.';)+\$\w{1,20}=(?:\$\w{1,20}\.?)+;)+@?eval\(\$\w{1,20}\(\$\w{1,20}\(\$\w{1,20}\(\$\w{1,20}\(["'][^"']+["'](?:\)\s*){5};(?<X1034952>)
(?:(\$\w+\[)\]=['"]Mozilla/[^'"]+['"];){5}[^\}]{1,1499}(\$\w+)=(?:array\(|\[)[^;]*['"]User\-agent[\s:'"\.]+\1[^\{]{0,199}\bfunction\s+(\w+\()\$\w+,(\$\w+)\)\{[^\}]*,CURLOPT_HTTPHEADER,\4\)[^@]{1,999}(\$\w+)=['"]https?://(?:www\.)?google\.com/webmasters/[^;]+;\$\w+=\3\5,\2\)[^@]{1,499}\bunlink\(['"][^'"]+\.php['"]\)[;\?>\}]+\Z(?<X2225960>)
(?:(\$\w{1,25})[\h=]+(\$_SERVER\[[^\]]+\])[\h\.]+['"]/(?:\.htaccess|index\.php)['"];\s*){2}(?:(\$\w{1,25})[\h=]+\2[\h\.]+['"][^'"]+\.(?:html|gif|png|jpe?g)['"];\s*){2}[^\?]{0,400}\b(file_)put(_contents)[\h\(]+\1,\h*\4get\5[\h\(]+\3[\h\)]+;\s*@?chmod[\h\(]+\1,\h*\d{3,4}[\h\)]+;\s*\}\s*\}(?<X1234351>)
(?:(\$\w{1,40})=@?((mysqli?_)query\(\$\w{1,40},)['"]SHOW\h+(?:DATABASES|TABLES|COLUMNS)\b[^\?]{1,199}){3}\bwhile\((\$\w{1,40})=\3fetch_array\(\1\)\)\{if\([pe]reg_match\([^,\)]+,\4\b[^\?]{1,199}=\2['"]SELECT\h*['"]\.\4\[[^\}]{1,199}\becho\h*\$\w{1,40}\[\4\[(?<X2173220>)
(?:(\$\w{1,40})[=\s]+(\$\w{1,40})\[[\s\(]*\d+[\s\)]*(?:[/\+\*%\-]\s*\d+\s*)+\](?:[\.\s]+\2\[[\s\(]*\d+\s*(?:[/\+\*%\-][\s\(/\+\*%\-]*\d+[\s\)/\+\*%\-]*)+\])+;\s*)+\$\w{1,40}[=\s]+['"][^;]{99,}['"]\s*;[^'"\*]{0,99}(\$\w{1,40})[\.=\s]+\1[^'"\*]{0,40}(\$\w{1,40})[=\s]+\$\w{1,40}\(['"]{2}[,\s]+\3[\s\);@]+\4\(\);(?<X1216610>)
(?:(\$\w{1,40})[=\s]+http_get[\(\s]+['"]https?://raw\.githubuser\w+\.com/botersx/[^\;]+;\s*(\$\w{1,40})[\s=]+fopen[\(\s]+(\$\w{1,40}),[^\;]+;\s*fwrite[\(\s]+\2,\s*\1[\)\s]+;\s*fclose[\(\s]+\2[\)\s]+;\s*if\(file\w+[\(\s]+\3[\)\s]+[\{\s]+echo\s*(?:[^\.]{1,100}\.(?:\.|\3\.|;)+)+[^\$]{1,100}(?:\3(?:\d+)?[\s=]+)?[^\;]{1,200};\s*)+(?<X2221961>)
(?:(\$\w{1,40})[=\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]['"\s;:]+){2}\$\w{1,40}[=\s]+\$\w{1,40}[=\s'";\s]+switch[\s\(]+\$\w{1,40}[\s\)\{]+case[^\?]{99,9999}isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^,]+file_put_contents[\s\(]+\1(?<X2225660>)
(?:(\$\w{1,40})\[['"]\w{1,40}['"]\]=['"][^'"]{1,40}['"]\^['"][^'"]{1,40}['"];){3,9}[^\n]{99,1999}\$\w{1,40}\(\1\);(?:if\([^\n;]{1,99})?(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);\2\(\);\}?(?<X1132500>)
(?:(\$\w{1,40})\h*=\h*['"](?:get|file|contents|put)['"]\s*;\s*){3,}(\$\w{1,40})\h*=[^;]*\1[^;]*;\s*(\$\w{1,40})\h*=[^;]*\2[^;]*;[^\}\{]*\breturn\s*(?:\3|\2)[^\}\{;]*;(?<X1265521>)
(?:(\$\w{1,40})\h*=\h*['"][^\n]{1,40}['"]\^['"][^\n]{1,40}['"]\h*;\h*){3,}(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*['"]{2}\h*,[^;]{0,99}\1\h*\((?:\h*'[^']{99,}'\h*\^)+\h*'[^']{99,}'\h*\)(?:\h*\))+;\s*@?\2\h*\(\);(?<X1166221>)
(?:(\$\w{1,40})\h*=\h*\$\w{1,40}\[[\h\(]*\d+\h*[/\+\*\-]\h*\d+\b[^;]{9,9999};\s*)+\$\w{1,40}\h*=\h*['"]{2}[^'"]{999,}['"]{2};\s*(\$\w{1,40})\h*=\h*\$\w{1,40};[^\(\)\{\}]{0,99}\2\h*\.=\h*\1;\s*@?(\$\w{1,40})\h*=\h*\$\w{1,40}[\h\(]+['"]{2}(?:\h*\))?\h*,\h*\(\h*\2[\h\)]+;\s*@?\3\h*\(\)\h*;(?<X1185770>)
(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*){2}function\h*(\w{1,40})\s*\([^;]+;[^\?]{0,499}(\$\w{1,40})[\h=]+\2\b[^;]*\1[^;]*;\s*(\$\w{1,40})[\h=]+tmpfile[\(\);\s@]+fwrite[\(\s]+\4\h*,[^;]*\3[\s\);]+(\$\w{1,40})[\h=]+stream_get_meta_data[\s\(]+\4[^;]*;\s*@?include(?:_once)?[\s\(]*\5\b[^;]*;(?<X1196570>)
(?:(\$\w{1,40})\s*=\s*['"]\{#\w{5,40}\}['"]\s*;\s*)+\$\w{1,40}\s*=\s*@?(file_)ge(t_contents)[\s\(]+(\$\w{1,40})[\s\.'"]+/index\.php[^\{\}]{9,999}(\2pu\3)[\s\(]+\4[\s\.'"]+/\.htaccess['"][^\|]+(\$\w{1,40})[\s=]+explode[^;]+\1[\s\);]+foreach[\s\(]+\6\s*as\s*(\$\w{1,40})[^\?]{9,999}\5[\(\s]+\7\s*,[^;]+;\s*\}(?<X1218310>)
(?:(\$\w{1,40})\s*=\s*\$_SERVER\s*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/[i\.][^;]+[ps]['"][\s;]+)+(\$\w{1,40})[=\s]+['"]['"\h\.base64_dco]{17,40}['"][^\{\}\*]{0,199}(\$\w{1,40})[=\s]+\2[\s\(]+['"]PD9[^'";]{99,}['"][^!]+if[^;\{\}]+\3[^\}]+(@file_put_contents\s*\()[^;]+\3[^\}]+\}\s*\}[^\}]+\4\1[^\}]+\}\s*\}(?:[^\}]*\bunlink[\s\(]+\1[\s\);]+\})?(?<X1279481>)
(?:(\$\w{1,9})\h*=\h*['"]\\x\d[^'"]{9,99}['"];\s*){4}(\$\w{1,9})\h*=\h*['"][^'"]{999,4000}['"];\s*@?eval\((?:\$\w{1,9}\(){3}\1\(\(\2\)+;(?<X1139241>)
(?:(\$\w{3,9})\h*\.?=\h*['"]\h*[qa](?:uestion|nswer)\h*\d*\h*:\h*['"]\.\$_POST\[[^\]]+\]\.['"](?:\\r)?\\n['"];\s*){4}[^\?]{99,499}mail\([^\)]+\1\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][\./]{2,12}\w{1,40}\.txt['"],\h*['"][aw]\+?['"]\);\s*fwrite\(\2,\h*\1[^/]{1,99}cation\.href\h*=\h*['"][^"']{9,199}['"];\s*</script>(?<X2145522>)
(?:(\$m[es][gs](?:sage)?)\.=['"](?:(?:User|login|e\-?mail|id|card)\s*(?:id|address|pass(?:word)?)?|pass(?:word)?|pin|cvv|ssn)\s*:\s*(?:['"]\s*\.\s*)?\$\w{1,40}[^;]{1,20};){2}[^\{]{99,999}(\$\w{1,40})="?\1[^;]{1,9};[^@#`\?\*]{99,999}\b(?:mail|file_put_contents|fwrite|fputs)\([^;\?]{1,199}\2(?<X2139800>)
(?:(\$m[es][gs](?:sage)?)\s*\.=[^;]{1,99};\s*){2}[^\(\{@]{1,99}(\$\w{1,40})\s*=\s*['"][^'"]+['"];[^\}\?]{1,99}\bmail\(\s*\2[^\)]+\1\s*\);\s*\}\s*\?>\s*<script[^>]{0,49}>\s*(?:<!--[^/<=;]{1,99})?\bwindow\.location\s*=\s*['"]https?://[^/]{0,19}(?:bank|gmail|apple?|dropbox|ama?z(?:on)?)(?:\.\w{1,3}){1,3}['"/](?<X2139531>)
(?:,\$\w+\)\{if\(is_writable\((\$\w+)\)+\{(\$\w+)=scandir\(\1\);foreach\(\2\s*as\s*(\$\w+)\)\{(\$\w+)=['"]\1/\3['"];(\$[^=;\w]{0,99})=\4\b[^\?]{0,99}\b(file_put_contents\(\5,\$\w+\);)[^\?]{0,199}\b\6[^\?\[#%:/!@\*<>\{]{0,199}){2}(?<X2220270>)
(?:;(\$\w{1,40})=['"]<meta\h+(?:(?:http\-equiv=['"]?refresh['"]?|content=['"][0-2];)[^>]{1,99}){2}>['"];(?:print|echo)\h*['"]?\1['"]?;(?:die|exit)[^;]{0,19};[^@<\?]{1,199}){3}\}\$\w{1,40}=new\h+\w{1,40}\([^;]{1,99};\s*(?:\?>\s*)?\Z(?<X2183150>)
(?:<!--\s*(?:begin|end)\h+mod:\h+Thanks\h+for\h+posts\h*-->){2}\s*</ul>\s*(?:<(h\d)><a\h*href\h*=\h*['"]#\w{1,5}['"]></a></\1>\s*)?<p[^>]{0,20}><img[^\?]{9,250}<div\h*class\h*=\h*['"]content['"]><blockquote>[^\?]{9,199}onclick\h*=\h*['"]this\.target\h*=\h*['"]_blank['"];['"]>[^<]{0,15}</a></noindex><br>(?<X2141273>)
(?:<(div)\h*style[\h=]+['"]display:\h*none;?['"]>\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,50}\b(?:slot|bocoran)[^<]{0,50}</a>\s*</\1>\s*){3,}(?<X1213401>)
(?:<(div)\h*style[\h=]+['"]position:\h*absolute;\h*left:\h*\-\d+px;\h*['"]><p>[^<]+<a\h*href[\h=]+['"]https?://[^>]+>[^<]*</a></p></\1>\s*){4,20}(?<X120341261>)
(?:<(Files)\s+\*\.(?:ph|s)\*>\s+Order\s+Deny,Allow\s+Deny\s+from\s+all\s+</\1>\s*)+<(\1Match)\s+['"]\^\(\w\.php\.?(?:\|\w{1,5}\.php\.?)+\)\$['"]>\s+Order\s+allow,deny\s+Allow\s+from\s+all\s+</\2>(?<X1218260>)
(?:<(p)><a\h*title[\h=]+['"](posjp33|yuantoto)['"]\h*href[\h=]+['"](https?://[^'"]+)['"]\h*style[\h=]+['"]position:\h*fixed;\h*top:\h*\d+px[^>]+>[</a>]*(?:\2|\3)[</a>]*</\1>\s*){4,20}(?<X120341241>)
(?:<(script)[^\?]{0,49}\bsrc\h*=\h*['"][^/]{0,49}//(?:paxmedia|mwtraf)[^>]{0,99}></\1>)(?<X1185330>)
(?:<(script)\b[^>]{0,99}>\s*var\s+(\w{1,40})\s*=\s*(document\.)createElement\s*\(\s*['"]\1['"]\s*\);\s*\2\.setAttribute\s*\(\s*['"]src['"]\s*,\s*window\.atob\s*\([^;/><]{9,299};\s*\3(?:\w{1,9}\.)?appendChild\s*\(\s*\2\s*\);\s*</\1>\s*){2,}(?<X1190571>)
(?:<(script)\h+data\-cfasync\h*=\h*['"]false['"]\h+(?:type\h*=\h*['"]text/java\1['"]\h+)?src\h*=\h*['"](?:https?:)?//go\.mob(?:trks|isla)\.com/notice\.php\?p=\d{3,}&[^>]{1,99}>\h*</\1>){2}(?<X1185521>)
(?:<(span|div)\h*style\h*=\h*['"]display\h*:\h*none['"]\h*>\h*<a\s*href\h*=\h*['"]https?://[^/'";]{0,49}(?:sport|fashion|jordan|jersey)[^/'";]{0,49}\.com/?['"]>[^</\v]{1,99}</a>\h*</\1>\s*){3,}(?<X1171762>)
(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}><img[^>]{0,99}\btitle[\h=]+['"][^'"]{0,40}\b(?:escort|seks|sex)['"][^>]{0,99}></a>\s*){2,20}(?<X1233140>)
(?:<a\h*href\h*=\h*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^>]{1,99}><img[^>]{0,99}\bsrc\h*=\h*['"]https?://[^'"]{1,199}\.gif[^>]{0,99}></a>\s*){5,10}\Z(?<X1195551>)
(?:<a\h*style[\h=]+['"]color[\h:]+#\d{4};['"]\h*href[\h=]+['"][^>]{9,99}><(strong)>[^<]{0,40}\bslot\b[^<]{0,40}</\1></a>[^\?\n]{199,4000}\b\1>[^<]{0,40}\bslot\b[^<]{0,40}</\1></a>\s*){2,}(?<X1226241>)
(?:<a\s*href[\h=]+['"]https?://[^'"]+['"]>slot\d*\b[^<]*</a>(?:<br\h*/>)?\s*){2,9}(?<X1233114>)
(?:<a\s*style=['"]display[\h:]+none['"\s;]+href=['"]?https?://(?:[^\s'">]{0,199}(?:slot|togel|panen)[^>]{0,199}>|[^>]{0,199}>[^<]{0,49}(?:slot|togel|panen)[^<]{0,199}|(?:\d{1,3}\.){3}\d{1,3}\b[^>]{0,199}>[^</]{0,99})</a>\s*){3,}(?<X1230210>)
(?:<a\s*style[=\h]+['"]display:none;?['"]\h*href[\h=]+['"](https?://[^'"]+)['"][^>]+>\1</a>\s*){3,10}(?<X1212261>)
(?:<a\s+href=['"]https?://[^'"]+['"][^>]{0,49}\btitle=['"]([^'"]{0,49}\b(?:escort|shell|hacklink|paykasa(?:\s*al)?|indoxploit)\b[^'"]{0,49})['"][^>]{0,99}>\s*\1\s*</a>\s*){2,}(?<X1232540>)
(?:<a\s+href=['"]https?://[^>]+>[^</]{0,49}\b(?:slot|poker|bocoran)\b[^</]{0,49}</a>\s*(?:<br\s*/>\s*)?){3,}\Z(?<X1214531>)
(?:<a\s+href\s*=\s*['"]https?://[^/]{3,40}\.[a-z]{2,7}/wp\-(?:en|it|fr|pl|jp|pt|sp|de)\.html['"]\s+title[=\s]+['"](?:fake|replica)[^'"]{1,40}['"]\s+style\s*=\s*['"]position:absolute;(?:left|right):\-\d{4,12}px;['"]>[^><]{0,40}(?:fake|replica)[^><]{0,40}</a>\s*)+(?<X1220610>)
(?:<a\s+style=['"]display[\h:]+none;?['"]\s+href=['"]?https?://[^/'"]+\.(?:sch|ac|go)\.id/[^>]{0,199}>[^<]{0,49}</a>\s*){5,}(?<X1229100>)
(?:<a\s+style=['"]display[\h:]+none;?['"]\s+href=['"]?https?://[^>]+>[^<]{0,49}\b(?:slot|togel|gacor)\b[^<]{0,49}</a>\s*){9,}(?<X1229091>)
(?:<div\b[^>]*\bstyle=['"][^'"]*\b(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^>]*>\s*echo\s*base64_decode[\s\(]+['"]PGE[^'"]+['"][\s\)]+;\s*</div>\s*){2,}(?<X1201500>)
(?:<div\b[^>]{1,99}\bstyle=['"]display:none['"][^>]{0,99}>\h*<a\h+href=['"]https?://[^'"\s]+['"]\h*title=['"]([^'">]{1,49})['"]\h*>\1</a>\h*</div>\s*){2,9}(?<X1172882>)
(?:<div\h*class=['"][^'"]+['"]>\s*){2}<p>\[vc_row\h*full_width=&#[^\?]{99,900}\bstredfinoria\.org['"][^>]{0,50}\bleft:\h*\-\d{4,6}px['"]>[^\^]{9999,27000}\bhref=['"]https?://visitessexma\.com/?['"]\h*style=['"]position:\h*absolute;\h*(?:top|left):\h*\-9999px;[^>]{0,50}>casinon?\b[^<]{0,50}</a>(?<X120357600>)
(?:<div\h+style\h*=\h*['"]display\h*:\h*none\h*;\h*['"]\h*>\h*<a\h+href\h*=[^<]{9,70}\bshell\h*</a>\h*</div>\s*){9,}(?<X1138862>)
(?:<div\s+style=['"][^'">]*?\b(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}px)\b[^>]{0,49}>\s*(?:<a\s+(?:(?:href=['"]?https?://|title=['"]([^'"]+)['"])[^>]{0,49}){2}>\s*\1\s*</a>\s*)+</div>\s{0,4}){3,}(?<X1199894>)
(?:<div\s+style=['"]display[\h:]+none;?['"]>(?:<[ou]l>)?(?:<(?:li|p)>(?:<[^aploud\W]\w+>)?<a\b[^>/:]{0,99}\bhref=['"]?https?://[^>]+>[^<]{0,199}</a>(?:</[^aploud\W]\w+>)?</(?:p|li)>){3,}(?:</[uo]l>)?</div>){3,}(?<X1229162>)
(?:<Files\s*\*\.\w{1,2}\*\s*>\s*Order\s+Deny[,\s]+Allow\s+Deny\s+from\s+all\s*</Files>\s*)+<FilesMatch\s+['"]\^\([^\(\)\|]+\.[ps]h(?:p|tml)(?:\|[^\(\)\|]+\.[ps]h(?:p|tml))+\)\$['"]>\s*Order\s+allow[,\s]+deny\s*Allow\s+from\s+all\s*</FilesMatch>(?<X1280450>)
(?:<h1>[^/]{0,9}(?:H[4a]ck[e3]d|pwn[e3]d)\h*by\b[^/]{1,99}<\h*/h1>\s*){2}(?<X2141302>)
(?:<link\h+href\h*=\h*['"]http://(?:www\.)?cheapjerseys[^/]{1,99}\.com/[^'"]{1,99}\.(?:ico|css)['"]\h+rel\h*=\h*['"]stylesheet['"]\h+type\h*=\h*['"]text/css['"]\h*/>\s*){5}[^&]{99,9999}var\h+http_host\h*=\h*['"]cheapjerseys(?<X2144982>)
(?:<link\h+rel\h*=\h*['"]stylesheet['"]\h+type\h*=\h*["']text/css['"] href=['"]https?://(?:www\.)?cheapjerseys[^/]{1,99}\.\w{2,9}/[^\.'"]{9,99}\.css['"]\h*>\s*){5}[^&]{99,9999}var\h+http_host\h*=\h*['"](?:https?)?:?/?/?(?:www\.)?cheapjersey[^'"]{1,99}['"];(?<X2145033>)
(?:<meta[^>\v'"]{1,99}\bcontent\s*=\s*['"]\s*defaced\s*by\s*[^>\v]{1,99}/>\s*){3}(?<X2139180>)
(?:<meta\s*http\-equiv=\\?['"]refresh\\?['"]\s*content=\\?['"]0;\s*url=https?://u\-?short\.(?:net|today)/\w+\\?['"]\s*/>|<script>\w+\.\w+\.href[\s=]+\\?['"]https?://u\-?short\.(?:today|net)/\w+\\?['"];</script>)(?<X120360230>)
(?:<meta\s*name=['"](?:author|copyright|publisher)['"]\s*content=['"]slot\s*(?:mania|online|bonus|gacor)['"]\s*(?:/\s*)?>\s*){2}(?<X2225383>)
(?:<meta\s+(?:content\h*=\h*['"](?:Defac|hack|stamp|fuck)ed\h*by\b[^>]{1,40}['"]\h*|name\h*=\h*['"][^'"]{1,20}['"]\h*){2}/?>\s*){2}(?<X2139195>)
(?:<p>\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]\h*style[\h=]+['"]display:none['"]>\w+</a></p>\s*<p></p>\s*){40,}(?<X1299580>)
(?:<spam\b[^>]{0,499}>\s*\w\s*</spam>\s*){5}(?<X2172970>)
(?:@(?:error_reporting|ini_set)\h*\((?:['"][^'"]+['"],)?(?:0|NULL|FALSE)\);\s*){2,5}@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1172700>)
(?:@file_put_contents\h*\(['"]?(?:\h*\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/(?:wp\-\w{4,9}/(?:uploads|css|ima?ge?s?)/)?|[\./]{12,60})wp\-[^\.]{1,40}\.php['"]\h*,\h*\$\w{1,40}\h*\)\h*;\s{0,9}){3,}(?<X1150960>)
(?:@include_once\h*\(\h*['"]/[hvt](?:ome|ar|mp)\b[^'"]{0,99}/\w{1,40}\.so['"]\h*\)\h*;)+(?<X1143300>)
(?:@ini_set\(['"](?:display_errors|log_errors)['"],['"]?(?:off|0|NULL)['"]?\);\h*){2,3}[^\?]{0,350}\bmove_uploaded_file\(\$[^\n]{9,799}(\$\w{1,25})\h*=\h*str_i?replace\([^\)]+\);\s*echo\h*['"][^=]{5,40}\b(script)\s*src\h*=\h*['"]{1,2}(?:\.\$\w{1,25}){3}\.\1\.['"]{1,2}></\2>[^;]{5,40};\s*\}(?<X1155541>)
(?:\$(?:message|spam|bilsmg)\s*\.?=\s*['"]\s*(?:\|\s*)?(?:Password|Pass|PWD?|P\b|PIN)[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);)[^\?]{1,700}\$headers\s*\.=\s*\$_POST\[['"]eMailAdd['"]\](?<X2044078>)
(?:\$(\w+)[\s=]+['"][^;]+;\s*){2,3}if\s*\([^;\{]+\{\s*(\$\w+)[\s=]+@?wp_create_user\s*\([^;]+\$\1\b[^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\2[\s\)]+;\s*\3\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[\s\}]+else[\s\{]+\3[\s=]+get_user_by\s*\([^\}]{1,499}\bwp_update_user\s*\([^;]+;\s*\}(?<X1213360>)
(?:\$(\w{0,40}(?:email|pass))\h*=\h*isset\((\$_[GPCSR]\w{2,6}\[['"]\1['"]\])\)\h*\?\h*\2\h*:\h*['"]{2};\s*){2}[^\(\{]{9,299}(\$\w{1,40})\s*=[^;]{0,49}\1[^\(]{1,499}\bmail\([^\);]{0,49}\3\b(?<X2140321>)
(?:\$(index|sitemap)_url\s*=\s*['"]https?://\$\w{1,40}/\1\.php\?[^;]{9,199};\s*){2}[^#%>]{99,2499}\}(?:\s*if\s*\([^\}]{1,99}\)\s*\{\s*@?header\s*\(\s*['"](?:Content-type:\s*text/html\b|HTTP/[123\.]+\h+(?:40[34]|30[12]))[^\}]{1,499}\b[de](?:ie|xit)[^;]{0,19};\s*\}\s*(?:else)?){3}\}?(?<X1188900>)
(?:\$(m[eas][gis](?:l|sage)?)\.=['"](?:Em?|e\-?ma[1i]l\s*(?:add\.?(?:ress)?|pass(?:word)?|id)?|pass(?:wo?r?d|code)?|pasw|pw|cvv\d?|id|(?:online|user|apple?|yahoo!?|login)\s*id|username|pin)\s*(?:\d\s*)?:[^;]{0,49}\$_POST\[[^;]{1,99};){2}[^\@]{9,1499}\b(?:mail|file_put_contents|fwrite|fputs)\([^;\?]{1,199}\$\1(?<X21359822>)
(?:\$(m[es][gs](?:sage)?)\.=['"](?:(?:User|login|e\-?mail|id|card)\s*(?:id|address|pass(?:word)?)?|pass(?:word)?|pin|cvv|ssn)\s*:\s*(?:['"]\s*\.\s*)?\$\w{1,40}[^;]{4,12};){2}[^\{@#`\?\*]{99,1499}\$(subject)=['"](?:Chase|Office(?:365)?)[^\?]{1,99}\bmail\([^\)]+(?:\$(?:\1|\2),){2}(?<X2138586>)
(?:\$(msg|message)\s*\.=\s*['"][^'"]{0,9}(?:(?:Email|login)\s*(?:add[res]{0,4}|id)?|pass(?:wo?r?d)?)\b[^;]{1,49}\$_POST\[[^;]{1,49};\s*){2}[^\?]{499,999}\$(sub|subject)\s*=\s*['"][^'"]{0,19}(?:Paypal|Apple?|AMA?ZO?N|ebay)\s*login[^\?]+\bmail\s*\([^\)]{1,49}(?:\$(?:\1|\2)\s*[,\)]\s*){2}(?<X2141180>)
(?:\$[0O_c6]{6,12}\s*=\s*\(?['"][^'"]{0,99}["']\)?;\s*)+\$[0O_c6]{6,12}\s*=\s*\$[0O_c6]{6,12}[\{\[]\d+[\]\}]\.[^\v]{1999,50000}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1125855>)
(?:\$[mbf](?:essage|sg|ilsmg|[cu]{2}k)\h*\.=\h*['"]\$victimInfo\d*\\n['"];\s*){2}(?<X2167592>)
(?:\$\w+=\$_[GPCSR]\w{2,6};){2}(\$\w+)=implode\(['"]{2},explode\([^;]+;(?:\$\w+=\1\(['"]\w+['"],['"]{2},['"]\w+['"]\);)+(\$\w+)=[^;]*\1\([^;]+;(?:if\([^;\{]{1,499}\{){2}[^\}\{]{1,499}\binclude[\s\(]*\1\([^;]+;\}else\{(\$\w+)=\1\([^;]+;(\$\w+)=\3\(['"]{2},\2\);\4\(\);\}\}(?<X1224050>)
(?:\$\w+[\s=]+(?:file|http)_ge(t_contents)[\s\(]+['"]https?://[^/'"]*\banonymousfox\.to\b[^;]+;\s*)+(?:(?:save|file_pu\1)[\s\(]+['"][^'"]*\.php\d*['"][\s,]+\$\w+[\s\)]+;\s*)+(?<X1197300>)
(?:\$\w+[\s=]+is_(?:spider|referer_search)[\s\(\)]+;\s*){2}\$\w+[\s=]+['"]https?://[^/'"]+\.xyz[/'"][^;]{1,99};\s*(\$\w+)[\s=]+['"]<script\b[^#%&]{999,4999}\bheader[\s\(]+['"]Content\-type:\s*text/html;[^;]{1,99};\s*echo\s*\$\w+;\s*((?:die|exit)\b[^;]{0,19};)[\s\}]+else\s*\{[^\}]{0,199}\becho\s*\1;\s*\2[\}\s]+(?<X1192940>)
(?:\$\w+\s*=\s*['"][\w\\]+?['"]\s*\^\s*['"][\w\\]+?['"];\s*)+\$\w+\(\$\w+\s*,\s*['"][\w\\]+?['"]\^['"][\w\\]+?['"]\s*,\s*['"]\w+['"]\);(?://\w{16,64})?(?<X1035402>)
(?:\$\w{1,10}=['"][str_o13gzinflaebdc64]{9,13}['"];){4}(\$\w{1,10})=['"][^'"]{65000,}['"];\s*eval(?:\(\$\w{1,10}){4}\({2}\1\){6};(?<X1128692>)
(?:\$\w{1,10}\s*=\s*"[^;]+;\s*)+\$\w{1,10}\s*=\s*\$\w{1,10}\((?:\$\w{1,10}\(){5,}.+\)\)\)\)\s*,\s*\$\w{1,10}\);\s*\$\w{1,10}\(\$\w{1,10}\);\s*include_once\(\s*\$\w{1,10}\s*\);(?<X1038991>)
(?:\$\w{1,12}\.?=['"]\\[^'"\s]{2,16}['"];){9,}\$\w{1,12}=(\$\w{1,12})\(\$\w{1,12}\)[^\v\*:\-]{999,9999}(\$\w{1,12})=\1\(\2\);\h*@\$\w{1,12}\(\2\);\h*\}(?:\h*;)?(?<X1171230>)
(?:\$\w{1,15}[\h\=\.]+['"][^'"]+['"];\h*){15,}(?:(\$\w{1,15})[\h=]+\$\w{1,15}\(\1\);\h*){3}\$\w{1,15}[\h=]+['"][^'"=/\+]{999,}Aid29yZHByZXNzX2xvZ2dlZF9p[^'"]+['"];\h*\$\w{1,15}[\h=]+['"]=[^'"]+['"];(?<X1202530>)
(?:\$\w{1,20}[\h=]+\$_SERVER\[(strrev)\(strtoupper\([^\)]+\)\)\];\s*){3,6}if\(!preg_match\([^@#%\}]{9,450}\)\s*\{\s*@?setcookie\h*\([^;]+\);\s*@?header\h*\(\1\h*\([^\.]{0,30}\d\?igc\.[^:]{9,99}[/:'"pth\.]{7,15}\s*:[locatin\.'"]{9,15}\)[^;]{1,150}\$\w{1,20}[\h\)]{1,4};\s*(?:exit|die);(?:\s*\}){3}(?<X1192001>)
(?:\$\w{1,20}\h*=\h*['"][^'"]{19999,}['"];\s*){2}[^\(]{99,300}\b(?:file_put_contents\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.(base64_decode)\(\$\w{1,20}\)\h*,\h*\1\(\$\w{1,20}\)+;\s*){2,3}[^@]{9999,}\}\s*;\s*(\$\w{1,20})\h*=\h*\1\(\2\);\s*@?(\$\w{1,20})\h*=\h*\w{1,9}\(\2,[^\)]+\);\s*@?eval\h*\(@?gzuncompress\(\3[\s\)]{2,5};(?<X1141784>)
(?:\$\w{1,20}\h*=\h*['"]\.ht(?:access|passwd)['"];\s*){2}[^=]{99,400}\bdie\(getimage\(\$_[GPRSC]\w{2,6}\[[^\]]+\][;\)\s\}]{5,9}\$\w{1,20}\h*=\h*DIRECTORY_SEPARATOR;\s*if\h*\(function_exists\(['"]php_uname['"][\)\{\s]{4,9}\$\w{1,20}\h*=\h*\(strtoupper\(substr\(PHP_OS\b(?<X2142280>)
(?:\$\w{1,20}\h*=\h*['"]https?://[^'";]{2,30}/\.\w{1,20}\.php['"];\s*){3}[^\(]{0,99}(\$\w{1,20})\h*=\h*array\([^\)]+\);\s*(\$\w{1,20})\h*=\h*array_rand\(\1\);\s*\$\w{1,20}\h*=\h*\1\[\2\];\s*(\$\w{1,20})\h*=\h*file\h*\(['"][^\.]{0,20}\.txt['"]\);\s*foreach\h*\(\h*\3\b(?<X2169421>)
(?:\$\w{1,20}\h*=\h*\$_SERVER\[strrev[^'"]{0,12}\(['"](?:tnega_resu|tsoh|rerefer)_ptth['"]\)[^;]{0,4};\s*){2}[^/\{]{0,90}\bif\h*\(!preg_match\h*\(['"]/(?:crawl|mobile)[^\?>]{99,900}\bsetcookie\h*\([^\;]+\);\s*header\h*\(strrev\h*\(['"]php[^;\)]+\)\);\s*(?:exit|die)[^;]{0,9};(?:\s*\}){3}(?<X1175381>)
(?:\$\w{1,20}\s*=\s*(?:chr\(\s*(?:\d+|ord\(["']\w+["']\))\s*[\^\+\-/\*]\s*(?:\d+|ord\(["']\w+["']\))\s*\)\.?)+;\s*){2,}.+?exit\(\$\{\w{1,20}\((?<X2035114>)
(?:\$\w{1,40}\[chr\(\d+\)\]\(\w+\("[\w/=]+"\)\);\s?){3,}\s*if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\|\|\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*OR\s*strpos\(\$\w+\s*,\s*\$\w+\)\)\s*\{(?<X1036052>)
(?:\$\w{1,40}\h*=\h*[wg](?:et_site_url|p_login_url)\(\);\s*){2}(\$\w{1,40})\h*=\h*['"][^@]{1,40}@[^/\}\[]{1,299}mail\(\1,[^\)]+\);\s*(\$\w{1,40})\h*=\h*\$_SERVER\[['"]DOC[^;]+/wp-\w{1,12}\.php['"];\s*(\$\w{1,40})\h*=\h*plugin_dir_path\(__FI[^;]+/\w{1,40}\.(?:html?|md|txt)['"];\s*@?copy\(\3,\h*\2\);(?<X1148560>)
(?:\$\w{1,40}\s*="[^"]*"\s*;(?:\s*\$\w{1,40}\s*=\s*str_replace\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;){2,}\s*){3}\$__\w{1,40}\('',"\};"(?<X2048681>)
(?:\$\w{1,40}\s*=\s*'[^']{1,200}';\s*){10,}\$\w{1,40}=str_replace\('[^']{1,50}','',(?:\$\w{1,40}[\s\.\)]+){10,};(?<X2045954>)
(?:\$\w{1,40}\s*=\s*(\$\w{1,40})\s*\[[\(\s]*\d+(?:\s*[/\-\*\+%\(])+\s*\d[^\]]*\](?:[\.\s]+\1\s*\[[\(\s]*\d+(?:\s*[/\-\*\+%\(])+\d[^\]]*\])+\s*;\s*)+(\$\w{1,40})\s*=\s*['"]{2}[^'"]+['"]{2}\s*;[^\.]{0,499}\$\w{1,40}\s*\.=\s*\2\s*;[^\(\)]{0,99}\$\w+\s*\(\s*\)\s*;(?<X1248080>)
(?:\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\s*\1\d+\}\s*\]\s*;\s*)+\$\w{1,40}\s*=[^>\n]{999,9999}foreach[\(\s]+\$\w{1,40}\s*as\s*\$\w{1,40}\s*=>[^>\n@]{999,}try\s*\{\s*\$\w{1,40}[\s=]+@?file_get_contents[\(\s]+\$\w{1,40}[^=]{0,499}(\$\w{1,40})[\s=]+fopen[^\n]{0,199}fclose\(\2\);\s*\}(?<X1200860>)
(?:\$\w{1,40}\s*=\s*['"][^'"]{0,49}(?:wtuds|sotpie)['"];\s*){2}[^#]{0,499}\$\w{1,40}\s*=\s*(?:array\s*\(|\[)(?:\s*['"]([#@/!%\176;])[^'"]{5,30}\1i?['"]\s*,){9}[^\)\]]{99,1999}[\)\]]\s;(?<X2129422>)
(?:\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*[^)]+?\s*\)\s*;\s*){4}\$\w+\s*=\s*\$\w+\(\s*\$\w+\(\s*\$\w+\s*\)\s*,\s*\d+\s*\);\s*\$\w+\s*=\$\w+\(\s*\$\w+\s*\);\s*\$(?<X2047111>)
(?:\$\w{1,40}\s*=\s*\$_POST\s*\[\s*['"](?:log|pwd)['"]\s*\]\s*;\s*){2}(\$\w{1,40})\s*=[^\{\}/]{9,499}(\$\w{1,40})\s*=\s*['"]https://api\.telegram\.org/bot['"]\s*\.\s*\1[^;]+;\s*@?file_get_contents[\s\(]+\2[\s\)]+;(?<X1239520>)
(?:\$\w{1,40}\s*=\s*\\'[^']{1,100}'\^\\'[^']+';\s*){3}\$\w{1,40}\s*=\s*\$\w{1,40}\(\\'\\'\s*,\s*\$\w{1,40}\(\$\w{1,40}\((?<X2050441>)
(?:\$\w{1,9}=['"][GETPOSCKIQUR_]{1,9}['"];){3,6}(\$\w{1,9})=[^;]{1,49};if\([^\$\n;\{]{0,9}\1[^\$\n;\[\{]{0,9}\[[^\]]+\]\)\)\{[^\}]{1,99}(\$\w{1,9})=\$\w{1,9}\(['"]{2},\$\w{1,9}\(\1\[[^;]+;\2\(\);\h*(?:die|exit)[^;]{0,19};\h*\}(?<X1140921>)
(?:\$\w{1,9}\h*=\h*(?:(chr\()\d{2,3}\)\.){2,}\1\d{2,3}\)+;\h*)+if\(\$\w{1,9}\((\$\w{1,9})\)\)\h*\{\2\((?:\1\d{2,3}\)\.){2,}\1\d{2,3}\)+;\h*\}\h*else\h*\{\h*(?:echo|print)[\h\(]+(?:\1\d{2,3}\)\.){2,}\1\d{2,3}\)+;\s*\}(?<X1182200>)
(?:\$\w{5,16} = (?:\d+|"\w+"|""|true|false);){5}\$\w+\s*=\s*"base64_decode";(?:\$\w+\s*=\s*(?:\d+|"\w+"|""|true|false);){5}(?<X2044742>)
(?:\$\{['"](?:\\x47|G)[^'"]{4,20}(?:\\x53|S)['"]\}\[[^\]]+\]=['"][^'"]*['"];){2}function\s*(\w{1,40})\(\$\w{1,40}\)\{[^\?\s@]{99,999}return\s*(?:\$)?\{\$\{['"](?:\\x47|G)[^'"]{4,20}(?:\\x53|S)['"]\}\[[^\]]+\]\}?;\}\s*@?eval\(\1\(['"][^'"]{999,}['"]\)+;(?<X1122240>)
(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{1,40}['"]\h*;\h*)+@?error_reporting\(0\);[^\v:>\*#&%\^]{99,9999}[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\([\$\{]{1,4}['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][^;]{0,9};(?:[^\v\}]{0,9}\})+(?<X1138310>)
(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{1,99}['"];\h*){2,}if[\(\h]+(?:isset[\(\h+])?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^@\v]{0,999}\bif[\h\(]+@[cm]o(?:py|ve_uploaded_File)[\(\h]+\$_FILES\[[^;]+;[^,\v!\*@]{0,499}else\s*\{\s*echo\b[^;]+;(?:\s*\}){2,}(?<X1183910>)
(?:\$_SESSION\[['"]x(?:username|password)['"]\]=\$\w{1,20};){2}[^://]{9,99}\$\w{1,20}=['"]https://idmsa\.apple\.com(?<X2159941>)
(?:\$arr_word\[\d+\]\[\]\s*=\s*['"]\d+["'];){10,}(?<X1037132>)
(?:\$func\d\s*=\s*strrev\(str_replace\('[^']+','','[^']+'\)\);\s*){3,}(?<X2051311>)
(?:\$port.bind\w{0,9}\h*=\h*['"][^'"]{99,1500}['"];\s*){2}\$back_connect\h*=(?<X2189051>)
(?:\((crontab)\s*\-l\s*\d+\s*>\s*(/dev/null)\s*;\s*echo\s*['"]\s*(?:\*\s+){5}(?:wget|curl)\h+\-[qs]\b[\s\-]+(?:\-O[\s\-]*)?http://(?:\d{1,3}\.){3}\d{1,3}/[^\s]{1,99}\.sh\W{1,9}sh\s*>\s*\2[^;\)]{0,19}\)[\s\|]+\1[\s\-]+){1,2};(?<X1197190>)
(?:\(\d{3,}\-\d{3,}\)\.[^\n]+\n(\$\w{1,40})[^\(]+\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\n]+\n).{99,499}?(?:\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\(]+\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\n]+\n).{0,499}\beval\b.{0,199}\(['"]e(?<X2213302>)
(?:\bdefine\h*\(\h*['"]\w{1,9}_bot(?:_id|net|_version)['"]\h*,\h*\d{1,9}\h*\);\h*\v){3}(?<X2139212>)
(?:\becho\b[^;]{1,99};(?:(\$\w{1,40})=(mysqli?_)query\(['"]SELECT\h+value\h+FROM\b[^\);]{0,99}\bcore_config_data\W?\h+where\h+path\h*=[^;]{0,99};[^\}@;#%\*:/<>\.\[\]\+\-]{1,199}\becho\h+Mage::Helper\(['"]core['"]\)\->decrypt\([^;]{1,99};\}\2free_result\(\1\);\}){2,}){3}(?<X2179710>)
(?:\bfunction\s*\w{1,19}Pass\((\$\w{1,40})\)\{if\((\$\w{1,40})=file\(\1\)\)\{foreach\(\2\s*as\s*(\$\w{1,40})\)\{if\([pe]reg\(['"](DB_PASSWORD)['"],\3\)\)\{\3=trim\(\3\);(\$\w{1,40})=(?:[^;]{1,99}\bstrpos\(\3,['"]\4['"]\)\h*\+\h*\d+){2}\)+;[\}\s]+if\(\5\)\{return\s*\5;[^@#!\*&\|:<>\?/]{1,49}){2}(?<X2163470>)
(?:\bRedirect\h*301\h*/(?:gtr\d+|0101a\d+)/\h*https?://[^\n]{9,99}\s*){5,20}(?<X1260570>)
(?:\{(file_put_contents\()[^,]+,base64_decode\(['"]PD9[^'"]{1,4999}['"]\)+;[^\}]{0,99}\b\1[^,]+\.htaccess['"],[^;]{1,99};\}\s*else\s*if\([^\{]{1,99}){3}\{[^:]{99,4999}['"]uggcf?://[^@]{99,4999}\bunlink\(['"][^'"]+\.php['"]\);(?<X2182540>)
(?:Dim\s*shell_\w{1,40}\s*as\s*string\s*=\s*['"][^\v]{1,99}['"]\s*){5,7}(?<X2130014>)
(?:fputs\(\$\w{1,9},['"]\s*(?:join|privmsg|notice|away|nick|part)[^\)]{5,50}\);){5}(?<X2129800>)
(?:function\s*\w{1,20}\([^\)]{9,99}\)\{return\s*str_replace\([^\)]{9,99}\);\}\s*){3}(?:(\$\w{1,20})\s*=\s*['"]\w{9,99}['"];\s*\1\s*=\s*\w{1,20}\(['"]\w{1,15}['"],['"]{2},\1\);\s*){3}[^\?]{99,200}\$\w{1,20}\(["']\w{999,30000}['"]\);\?><\?php(?<X1127890>)
(?:if\(\$\w{1,40}==['"](?:mysql|postgre|oracle)_(?:error|union)['"]\)\{\$\w{1,40}=str_replace\(['"]\$payload_(?:union|error|oracle)['"],[^;]{99,499};\$\w{1,40}=\d+;\$\w{1,40}=\(GetBetween\(file_get_contents\([^\)]+\)\)-\d+\);\}else){3}(?<X2137240>)
(?:if\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=='[^']*'\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\(\s*htmlspecialchars\s*\(\s*file_get_contents\s*\(\s*'[^']*'\s*\)\s*\)\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}\s*){2}(?:\s*//file\s*end)?(?<X1036941>)
(?:include\h+['"][^;]{0,20}\banti(?:\d+|bots?)\.php['"];\s*){5}[^\$\{]{99,999}\bif\h*\(!isset\h*\([^\)]+\)\)\S*\{\s*exit\(header\s*\(['"]Location:\h*https?://(?:www\.)?(?:outlook|gmail|paypal|yahoo)\b(?<X2146031>)
(?:include|require)(?:_once)?\(['"]zip://css#\w+['"]\);(?<X120360640>)
(?:is_file|if\(@stat)\(ABSPATH\s*\.\s*WPINC\s*\.\s*['"]/blocks/navigation/([\w\.\-]+\-link\.php)['"]\)[^;]{1,99}\1[:\s'"]+;(?<X120346710>)
(?:loc_data\([^\)]+\);\s*\$\w{1,40}\h*=\h*){2}[^;]{1,40};\s*(?:\$(to_drop|msg|message|bilsmsg|fuck)\h*\.=\h*['"]\h*\d\h*:\W{1,9}\$_POST\[['"][up]['"]\][^;]{1,49};\s*){2}[^\?]{99,499}\bmail\([^\)]+\$\1(?<X2141611>)
(?:mail\((?:\$\w+,\s*\$\w+,\s*\$\w+(?:,\s*\$header)?\))|(?:stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\)\));(?:\s*\})?)\s*if\(\$\w+\)\s*\{\s*echo\s*'\w+';\s*\}\s*else\s*\{\s*(?:echo)?\s*'\w+\s*:\s*'(?<X2045052>)
(?:Plugin\h+name:\h*Who\h+knows\h+\w+\h+uploader|Plugin\h+URI:\h*https?://t\.me/Moonlightcrow\b)(?<X2314410>)
(?:subject|sub)\h*=\h*['"]\W{0,4}YAHOO\h*LOGINZ\W{0,4}['"];\s*\$\w{1,25}\h*=\h*['"][^'"]{0,49}\bgmail\.com['"];\s*\$\w{0,25}\h*=\h*['"]Visitor\b(?<X2183450>)
(?<!<card>)<title\b[^>]{0,99}>(?:bkkbn\s*\W\s*sulbar\s*\W\s*bkkbn\s*sulawesi\s*barat|desjardins\s*\W\s*log\s*in\s*to\s*your\s*account|frb\s*\W\s*microsoft\s*sign\s*in|login\s*[^\s\w]\s*(?:bank\s*of\s*ireland|opensea)|paypal\s*\W\s*(?:settings|wallet)|scotiabank\s*\W\s*sign\s*in)</title>(?<X2208204>)
(@?ini_set\(['"]display_errors['"],\s*['"]0['"]\);\s*error_reporting\(0\);)\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1\s*\1(?<X120349470>)
(@include_once\()['"](/[^'"]{19,99}/user/\d+/)[^;]{1,99}\.php['"]\);(?:\s*\1['"]\2[^;]{1,99}\.(?:png|gif|jpe?g|ico)['"]\);){1,}(?<X1181920>)
(@system)\h*\(\h*['"]killall\h+\-9\h+['"]\h*\.\h*basename\h*\(\h*['"]\.?/?(\w{1,40}\.so)['"]\h*\)\h*\);\s*@?file_put_contents\h*\(\h*['"]\.?/?\2['"]\h*,\h*['"]\\x[a-f\d]{2}[\\xa-f\d]{9999,}['"]\h*\);\s*@?chmod\h*\(\h*['"]\.?/?\2['"]\h*,\h*0\d{3}\h*\)\h*;[^\?]{9,999}\1\h*\(\h*['"]\./\w{1,9}\.sh['"]\h*\);(?<X1168000>)
(\$(?:log.user|username|uname|user))\h*=\h*(\$_POST\[)[^\]]+\];\s*(\$(?:log.)?pa?s?s?wo?r?d)\h*=\h*\2[^\]]+\];[^\\\{]{99,300}(\$\w{1,20})\h*=\h*['"][^\$]{2,20}\.\1\.[^;]{1,60}\.\3\.[^;]{0,99};[^@/]{9,99}(?:@fwrite\(fopen\([^\)]+\),\4\);\s*){3,6}\s*\}(?<X1174510>)
(\$(?:mail)?subj?(?:ect)?)\h*=\h*['"]We\s*tran?sfer\s+log[sz]?['"];[^\?]{9,299}\bmail\([^\)]+\1[^;]{1,99};\s*(?:\}\s*)?\s*function\s+visitor_country\(\)\s*\{(?<X2148161>)
(\$(?:str|fiti?\w|html|joomla\w{1,20}|wfk))\h*=\h*["']PGRpdiB[^'"]{99,800}['"];\s*echo\h+base64_decode\(\1\);(?<X1157824>)
(\$(\w{1,40}))\h*=\h*\$\h*\{\h*['"]_[GPRSC]\w{2,6}['"]\h*\}\h*;[@\h\(!]+\$\h*\{\h*@*['"]\2['"][\h\}\{]+\[?['"][^'"]+['"]\]?[\h\}@]+\S{2,3}@*(?:\1|\$?\{\h*@*['"]\2['"][\h\}\{]+)[^;\?:]*(?:['"][^'"]+['"][\h\}\)]+)?\?[@\h]*\$[\h\{@]+['"]\2['"]\h*\}\h*:[^;\$]*\$[\h\{@]+['"]\2['"]\h*\}[\h\{@]*\[?['"][^'"]+['"]\]?[\h\}\(]+\1[\{\h\[@]+['"][^'"]+['"]\]?[\h\}\)]+;(?<X1195690>)
(\$(\w{1,40}))\h*=\h*\$\h*\{\h*['"]_[GPRSC]\w{2,6}['"]\h*\}\h*;[@\h\(]+\$\h*\{\h*@*['"]\2['"][\h\}\{]+['"][^'"]+['"][\h\}@]+\S{2,3}@*\1[\{\h@]*['"][^'"]+['"][\h\}\)]+\?[@\h]*\$[\h\{@]+['"]\2['"]\h*\}\h*:[^;\$]*\$[\h\{@]+['"]\2['"]\h*\}[\h\{@]+['"][^'"]+['"][\h\}\(]+\1[\{\h@]+['"][^'"]+['"][\h\}\)]+;(?<X1195660>)
(\$(shell)_source\d*)[\h=]+\$\w{1,20}[\.\s]+['"]/\2_index/\2\d+\.html[""];\s*if[\(\s]+check_remote_file_exists\(\1(?<X2161101>)
(\$[0o]{1,12})\h*=\h*['"][a-f\d]{32,64}['"];\s*if\b[^\{]{0,499}\(\h*!?\h*\(\h*isset\h*\(\h*(\$\w{1,40})\h*\)\h*\S{2,3}\h*(?:md5|sha[1256]{1,3})\h*\(\h*\2\h*\)\h*\S{2,3}\h*\1[\)\s]+\{\s*[^;]{1,20}404\h*not\h*found['"]\h*\)\h*;(?<X2173653>)
(\$[0O]{1,9})\s*=\s*urldecode\([^\)]{9,150}\);\s*\$[0O]{1,9}\s*=\s*(?:\1\{\d{1,2}\}\.){3}[^\?\(]{9,1599};\h*function\h+(alfa)\h*\((\$\w{1,40})\)\s*\{[^a]+,\3\);\s*\}\s*\$[^\(\{\?\}\$]{9999,}(\$\w{1,40})\h*=\h*["'][^'"]{999,}['"];\s*\4\h*=\h*\2\(\4\);\s*@?eval\(\$[0O]{1,9}\(\4\)+;(?:\s*return;)?(?<X1140530>)
(\$[0o_]{1,4})\h*=\h*urldecode\(['"][^'"]{60,}['"]\)\h*;[^/\\\*\v]{99,9999}\bcurl_setopt\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_USERAGENT\h*,\h*\1\{\d+\}\h*\.[^\v`\*]{99,9999}\bfunction\h*(\w{1,40})\h*\([^;]+\bglobal\h*\1;[^\v\*>]{999,}\}\h*\2\(\)\h*;(?<X1188980>)
(\$[^\s=]{1,60})\h*=\h*@?create_function\h*\(\h*(?:['"]{2}|null)\h*,\h*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s)]+;(?:\s*(\$[^\s=]{1,60})\h*=\h*['"]\w{1,40}['"]\s*;)?\s*\W{0,3}(?:\1|\2)(?:\s*\})?\s*\(\)\s*;(?<X1187181>)
(\$[htmlinks]{4,5})\h*=\h*(getContent)\((\$url),[^<]{9,99}(?:\1\h*=\h*str_replace\(['"]<a[^@]{9,200},\1\)\h*;\s*){3}[^\{]{99,1500}echo\s+\1;\s*function\s+\2\(\3,(?<X2138944>)
(\$[o0_]+)\h*=\h*['"][^#]{9,999}\bglobal\h*(\$\w{1,9});\s*\2[\h=]+urldecode\(\1\);[^#]{1,399}(\$\w{1,15})[\h=]+(curl)_init\(\);\s*\4_setopt\(\3,[^#\n]{99,9999}\bdefine\(['"](BASE_PATH)['"][^;]{1,49};\h*file_put_contents\(\5\.['"]/robots\.txt['"],[^#]{1,9999}\bheader\(['"]http\S{2,4}\h*404\b[^;]+;\s*\}(?<X1190862>)
(\$[O_0]+)\s*=\s*urldecode[\(\s]+['"]%[a-f\d%]{40,199}['"][\s\)]+;(?:\s*\$[O_0]+\s*=(?:\s*\1\[\d+\]\s*\.)+\s*\1\[\d+\]\s*;)+\s*\$[O_0]+\s*=\s*\$\{['"]GLOBALS['"]\}\s*\[['"][O_0]+['"]\]\s*\(['"]\$[O_0]+[\s=]+\\?['"]+\\?['"]+\s*,[^\-]{999,9999}\$[O_0]+['"\)\s\};]+\$\{['"]GLOBALS['"]\}\[['"][O_0]+['"]\]\(1\);(?<X1206350>)
(\$\w)[\s=]+base64_decode\b[/\*\w\s]+\([/\*\w\s]+\1,\s*true\);(?<X1313641>)
(\$\w+)(?:;unlink\(\1\);\s*\w+\s*\w+\(\)\s*\{\s*\w+\s*\w+\(\d+,\s*\d+\);\s*\}\s*__halt_compiler\(\);(?:\\[a-fx\d]+){32}\\[a-fx\d\\]{19999,}(?<X220337890>)|=(?:"(?:assert";\1\(['|"]eval\(gzuncompress\(base64_decode\(['|"][^'|^"]+'\)\)\);['|"]\);exit;(?<X2054980>)|base64_decode";assert\(\1\('[\w=]+'\)\);(?<X1035101>))|'(?:';\1\.=['"][^'"]{1,4}['"];\1(?:[^@]{1,99}\1\.[^@]{1,99}(\$\w+)=ABSPATH\.base64_decode\(\1\);if\(file_exists\(\5\)\)(?:@?include|require)(?:_once)?\s*['"]compress\.zlib://['"]\.\5;(?<X120360830>)|\.=['"][^'"]{1,4}['"][^/]{1,199}\1\.=['"][^'"]{1,4}['"];(\$\w+)=__DIR__\.['"]/['"]\.base64_Decode\(\1\);if\(file_exists\(\7\)\)@?(?:include|require)(?:_once)?\s+['"]compress\.zlib://['"]\.\7;(?<X120363520>))|base64_decode';(\$\w+)='create_function';if\(!empty\(\$_REQUEST\['(\w+)'\]\)\){(\$\w+)=strrev\(\$_REQUEST\['\10'\]\);(\$\w+)=\9\('',\1\(\11\)\);\12\(\);}(?<X2054970>)|preg_replace';(\$\w+)='eval\(base64_decode\("[^"]+"\)\);.*?;(\$\w+)="/(\w+)/e";\1\(\15,\14,'\16'\);(?<X2054960>))|(?:['"]\w+['"])?(?:\.chr\(\w+\s*(?:\-|\+|\*|/)?\s*\w+\)\.)+[^;]+;(\$\w+)=(?:['"]\w+['"])?(?:\.?chr\(\w+\s*(?:\-|\+|\*|/)?\s*\w+\)\.)+[^;]+;(\$\w+)=\18\(\1\);(?:\$\w+=\19;)?(?:\$\w+=['"]\d+['"];[^!]+if\(\!\$\w+\)\{class\s*(\w+)\{private[^@]{1,5000}\$\w+=new\s*\20\(\);\$\w+=['"]\w+['"];\})?(?<X1252141>)|(?:sm|d)outdo\(\$\w+\);if\(!stri?str\(\1,['"]nobotuseragent['"]\)+\{(?:if\(stri?str\(\1,['"](?:(?:ok|ping)[^'"]+getcontent['"][^\{;]+\{[^\}]{0,999}\becho\b[^;]{0,49}\1\)*;|getcontent(\d{3})page['"][^\{;]+\{[^\}]{0,999}\bheader\(['"]HTTP/[\d\.]{1,3}\s*\22\b[^\}]{0,999}\b)(?:die|exit)\b[^;]{0,19};\}(?:else\s*)?){3,}\}(?<X1234280>)|(\w+)\.['"][^'"]+\.php['"];\s*if\(file_exists\(\1[^!]{1,49}(\$\w+)=get_option\(['"]\w+[^@]{1,49}@?base64_decode\(\25[^#]{1,199}@?file_put_contents\(\24\.['"][^'"]+\.php['"],\$\w+\);(?<X120365840>)|(curl_)init(?:[\s\(\)]+;\s*\27setopt[\s\(]+\1[,\s]+CURLOPT_URL[,\s]+['"]https?://[^/]+hacklinkmarket\.com\/code\?\w=\d+['"][\s\)]+;\s*\27exec[\s\(]+\1[\s\)]+;(?<X1305142>)|\(\);(?:(\$\w+)=['"]https?://[^'"/;\?]{0,49}\b(?:githubusercontent|paste(?:bin|\.ee)|ghostbin)\b[^\}\?=]{1,199}\b\27setopt\(\1,CURLOPT_URL,\29\);[^\}\?=]{0,499}(\$\w+)=\27exec\(\1\);echo\s*\30;(?<X1229760>)|\27setopt\(\1,CURLOPT_URL,['"]https?://(?:[^;]{0,49}?\.\$\w+\.){2}[^\?\}]{1,999}(\$\w+)=\27exec\(\1\);\27close\(\1\);if\([^;\{]*\32\b[^\{;]{1,99}\{[^\}]*\bhttp_response_code\(40[34]\);[^\}]*(?:die|exit)\b[^;]{0,19};\}[^\?]{0,199}\?><meta\s+http\-equiv=['"]?refresh['"]?\s+content=['"]0;\s*url=[^>]{1,99}>(?<X1225970>)))|(function)\((\$\w+)\)\{(?:include|require)\35;\};\s*(\$\w+)=\[['"]zip://['"]\.\(\34\(\)\{return['"]wp\-\w+['"];\}\)\(\)\.['"]\.zip#['"]\.\(fn\(\)=>['"]\w+['"]\)\(\)\];\s*\1\(\36\[\d+\]\);(?<X120368890>)|(str_rot13)\(['"]uggc://[^'"]+\.pp[^@]{1,99}\$_SERVER\[\38[^@]{1,299}https?['"]:[^\(]{1,49}\1[^!]{1,299}function_exists\(['"]curl_init['"][^@]{1,399}!headers_sent[^@]{1,99}\38[^\$]{1,49}(\$\w+)=strtolower[^\*]{1,299}exit;\}while\(false\);unset\(\1[^;]{1,49}\39\);(?<X120362100>)|[""]zip://[\w\-]+\.php#\w['"];include\s*\1;(?<X120351711>)|['"]+;while\(count\((\$\w+)\)>\d+\)\{(\$\w+)=rand\(\d+,count\(\42\)[\s\-\+\/\*]+\d+\);\1\.=\42\[\43\][^;]+;array\w+\(\42,\43,\d+\);\}if\(strpos\(['"\s]+\.\1,['"]<\?[ph\s]+['"]\)=+\w+\)[^;]+;else\{(\$\w+)=[^;]+;[^@]{1,500}unlink\(\44\);\}(?<X1295650>)|['"](?:[^'"]{32,99}['"];error_reporting\(0\);(\$\w+)=['"]\w+['"];\46=\1\[[^;]{1,512};\46=\46\.\1\[[^;]+\;\46=\46\.\1[^;]+;\46=\46\.\1\[[^;]+;\46=\$_SERVER\[\1\[[^;]+;\46=\$_SERVER\[\1\[[^;]{1,99}\.\1\[\d+\]\];(?<X1277750>)|[^\-]{1,99}/wp\-includes[^\.]{1,99}/[^'"]+\.php['"];\s*if\(file_exists\(\1\)\)\{((?:include|require)(?:_once)?)\s+\1;return;\}\s*(\$\w+)=get_option\(['"]sco_current_location['"],''\);\s*if\(\49&&file_exists\(\49\)\)\48\s+\49;(?<X120358951>)|\w+[^\(]{1,99}\1\(\d+\);(\$\w+)=['"]\w+[^;]+;(\$\w+)[^;]+;(\$\w+)[^;]+;eval\(\51\(\52\(\53\(['"]FZW1EuvYF[^'"]+['"]\)\)\)\);(?<X120348111>)|\w{32,64}['"];[^\}\?]{0,199}\binclude(?:once)?\((?:\$\w+\.)?['"]wp\-config\.php['"]\);[^\?#]{99,999}\bif\(\1!=\$_[GPCSR]\w{2,6}\[[^;]{0,99}\b(?:die|exit)\b[^;]{0,19};(?<X2197062>)|\w{32}['"];[^\?\{]{0,499}\bfunction\s*(\w+)\(\$\w+\)\{[^\}]+(\$\w+)\.?=pack\([^\?]{1,99}\breturn\s*\57;[^\?\{]{1,99}\bif\((?:md5\()+(?:getenv\(|\$_SERVER\[)['"]HTTP_USER_AGENT['"][\]\)]+!=+\1\)\{header\([^\);]+\b40[34]\s*(?:Not|forbidden)\b[^\}]+exit\b[^;]{0,19};\}(\$\w+)=['"]\56['"];(?:\$\w+=\58\([^;]+;){9}(?<X2224071>)|base64_decode['"];(\$\w+)=['"]str_rot13['"];(\$\w+)=['"]gzuncompress['"];eval\(\61\(\60\(\1\(['"]a5x6Rk[^'"]+['"]\)\)\)\);(?<X120367320>)|chr['"];(?:(\$\w+)=(?:\1\([\d\-\.\+\*/%]{0,49}\)\.)+\1\([\d\-\.\+\*/%]{0,49}\);)+eval\([^\)'"]{0,49}\63\([^\)'"]{0,49}['"][\w/\+=]{999}(?<X2224151>)|file_exists['"];(\$\w+)=['"]chmod['"];\$\w+=['"]touch['"];\$\w+=['"]unlink['"];(\$\w+)[^;]{1,99};(\$\w+)[^@]{1,100}(\$\w+)=\$_[GPRSC]\w{2,6}\[[^\]]+\]\.['"]/\w+\.php['"];(\$\w+)=['"](?:\w+(?:\-|/|\.))+\w+['"];if\(\1\(\69\)+\{\65\(\68,\d+\);\$\w+=\67\(\69\);\$\w+=\66\(\68[^;]+;\65\(\68,\d+\);\}\}(?<X1259281>)|https?://(?:(?:\d+\.\d+\.\d+\.\d+|(?:gist|raw)\.githubusercontent\.com)/[^\.'"]{1,999}\.txt['"];(\$\w+)=\w+\(\);\w+\(\71[^;]{1,99}\1\);\w+\(\71[^;]{1,99};(\$\w+)=\w+\(\71\);\s*\w+\(\71\);(?:echo)?\s*eval\(['"]\?>['"]\.\72\);(?<X120329680>)|(?:raw|gist)\.githubusercontent\.com/[^;]+;\$\w+=['"]\w+['"];\$\w+=['"]\w+['"];\$\w+=call_user_func\(\$\w+,['"]allow_url_fopen[^%]{1,999}\1\);\}[^\{]{1,999}\{\?>[^,]+,base64_encode\(\$\w+\)\)(?<X120354430>)|[^'"]+(?:\.php['"];(\$\w+)=(curl)\w+\(\);\76\w+\(\75,\w+,\1\);[^\?]{1,249}(\$\w+)=\76\w+\(\75\);if\(\76\w+\(\75\)\)\{echo\s+['"]\76[^\?]{1,49}\76\w+\(\75\);eval\(['"]\?>['"]\.\77\);(?<X120365911>)|\w+\.txt['"];(\$\w+)=['"]/\w+[^'"]+\.php['"];(\$\w+)=file_get_contents\(\1\);if\(\$\w+!==false\)\{file_put_contents\(\79,\80\);\}(?<X1315111>))|[^;]+;(\$\w+)=curl_init\([^\}\{]{0,199},CURLOPT_URL,\1\)[^\}\{]{0,199}(\$\w+)=curl_exec\(\82\);curl_close\(\82\);(\$\w+)=['"]([^'"]+)['"];file_put_contents\(\84,\83\)[^\{\}]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec)\(['"]\85['"]\);(?<X1228980>)|[^['"]+\.txt['"];(\$\w+)=(curl)\w+\(\1\);\88\w+\(\87,\88\w+,true\);(\$\w+)=\88\w+\(\87\);if\(\89[^<]{1,49}echo[^\?]{1,99}echo\s+\89;\}\s*\88\w+\(\87\);(?<X120359111>)|[^\.]+\.pages\.dev/[^'"]+['"];(\$\w+)=(curl_)\w+\(\1[^=]{1,49}\92\w+\(\91[^\?]{1,129}(\$\w+)=\92\w+\(\91[^\?]{1,49}eval\(['"]\?>['"]\.\93\);(?<X120370230>))|range['"];(?:(\$\w+)=\1\((?:['"\176,\s*]+\);\$\w+=\$\{(?:\95\[[\d+\s*]+\]\.\s*){1,}[^&]{1,299}&&count\([^'"]+['"]\w+['"]\)\)\{[^'"]{1,499}metaphone\(['"\w+/]+\);[^;]{1,199}['"]range['"];[^\?]{1,499}curl_exec\(\$\w+\);return[^\{]+\{\$\w+=array\(['"][^\)]+\);foreach\(\$\w+[^\)]{1,299}\)[^&]+&&die\(\$\w+\[[\d+\s*]+\][^\}]{1,399}die;\}\}\}:\w+\(\);(?<X120369721>)|['"][^'"\w]+['"],['"][^'"\w]+['"]\);(?:includ|requir)e(?:_once)?[\s\(]*(?:\95\[[^\]]+\]\.)+\95\[[^\]]+\][\s\)]*;(?<X1226390>))|\$\w+=\1\(['"]\176['",\s]+\);[^;]+;if\(\([^#]{1,299}md5\(\$\w+\[\d+\]\)[^\{]{1,299}['"+\w+]\)\)\{[^'"]{1,299}metaphone\(['"][^;]+;class\s*\w+[^#]{1,899}\{(\$\w+)=array\(['"][^\)]{1,799}['"]\);foreach\(\98[^\{]+\{(\$\w+)[^&]{1,499}&&die\(\99[^#]{1,199}md5\(\$\w+[^;]+;eval\(\99[^;]+;die;\}\}\}:\w+\(\);(?<X120366863>))|zip://['"];(?:include|require)(?:_once)?\1\.['"]_\(\W{1,}_['"];(?<X120354711>))|['|"]\w+\.zip['|"];\s*(\$\w+)\s*=\s*file_get_contents\(['|"][^'|^"]+['|"]\);\s*file_put_contents\(\1,\s*\102\);.*?pclzip\.lib\.php.*(\$\w+)\s*=\s*new\s*PclZip\(\1\);\s*if\s*\(\103->extract\(\)\s*==\s*0\)\s*{\s*die\("Error\s*:\s*"\.\103->errorInfo\(true\)\);\s*}(?<X1035062>)|[^;]{0,199}\.(?:htaccess|php)['"];(\$\w+)=[^;]{0,199}\.(?:htaccess|php)['"];(\$\w+)=[^;]{0,199}\.(?:css|ttf|js|txt|woff\d*)['"];(\$\w+)=[^;]{0,199}\.(?:css|ttf|js|txt|woff\d*)['"];(?:(?:if\([^;\{]{1,199}\{){2}chmod\((\1|\105),[^;]+;file_pu(t_contents\()\108,file_ge\109(?:\106|\107)\)+;chmod\(\108,[^;]+;\}{2}){2}(?<X1233750>)|[preg_replace'.\s]+;\s*(\$\w+)\s*=.*?\1\(["']\111["']\s*,.*?,\s*["']\w+["']\);(?<X1035870>)))
(\$\w+)(?:=(?:\$(?:\w+\(['"]HTTP_COOKIE['"]\);(\$\w+)=\$\w+\([^\}\{]{1,199}\bforeach\(\2\s*as\$\w+\)\{[^\}]{0,199}\1\[[^\]]+\]+=[^\}]{1,199}\}\((\$\w+\(\1\))==\d+&&in_array\(\$\w+\(\1\)\.\3,\1\)+\?\(+\1\[\d+\]=\1\[[^;:\}\{]{1,199}&&\1\(\)+:\1;(?<X1227150>)|_(?:[GPCSR]\w{2,6}\[[^;]{1,99};[^;]{0,199}\1=file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\?]{19,499}\beval\(\1\);(?:die|exit)\b[^;]{0,19};(?<X2196061>)|COOKIE;(?:(\$\w+)=\d+;(\$\w+)=\d+;(\$\w+)=\[\];\8\[\6\]=[^;]{1,999};while\(\7\)\{[^\{]+\{if\(\!\1\[(?:\d+|\w+)\][^;]{1,999}break;\}\6\++;[^@]{1,999}if\(\!\8\[(?:\d+|\w+)\]\(\6\)+\{\7=\8\[(?:\d+|\w+)\][^}]+\}include\6;(?<X1288713>)|\w+!?\(isset\(\1\[strlen\(gettype\(\1\)\)[\]\)]+\{(\$\w+)=\d+;(\$\w+)=\d+;(\$\w+)=array\(\);\$\w+\[\$\w+\]=['"]['"];while\(\11\)\{\$\w+\[\10\]\.=\1[^\.]+\.\$\w+\[\d+\];[^@]{49,999}\.PHP_EOL\.\12\[\d+\]\(\12\[\d+\]\([^;]{9,99};@?(?:include|require)\(\10\);\}(?<X120333850>))|GET\[['"]\w+['"]\];\w+\(!\(md5\(\1\)={3}['"]sanane['"](?<X2310700>)|REQUEST\[[^\)]{1,999}\)\w+['"];(\$\w+)=array\([\d,\s]+\);foreach\(\15[^\(]+\(['"]noitcnuf_etaerc[^\?]{1,999}\1\){2};\$\w+\(\);(?<X1319750>)|SERVER(?:[^=]{1,49}(\$\w+)[^\(]{1,99}foreach\(\17[^!]{1,99}\1[^\.]{1,99}header\(['"]Location:\s*https?://[^'"]+\.unitru\.edu\.pe/['"][^\}]{1,49}exit\(\);\}(?<X120370102>)|\[['"]\w+(?:['"]\]\.[^\-]{1,99}\1\.['"]wp\-load\.php['"];\s*(\$\w+)=\1[^@]{1,99}\19[^@]{1,99}(@?file_get_contents)[^@]{1,299}\1\.['"]wp\-includes/[^'"]+\.php['"];[^@]{1,199}\20[^@]{1,999}(file_exists)\((\$\w+)\)\)\{\s*\$\w+=\22[^\n]{1,3999}\21[^\n]{1,99}file_put_contents\(\$\w+,\s*\$\w+\);\s+chmod\(\$\w+,\s*0444\);\s*\}\s*\}\s*\}\s*\}(?<X120350422>)|[^\-]{1,99}\1\.['"]wp\-includes[^\-]{1,49}\1[^\?]{1,499}\1[^\{]{1,99}\$\w+="";foreach[^@]{1,99}file_exists\((\$\w+)[^@]{1,99}(@?file_get_contents)[^\&]{1,199}\24[^!]{1,99}\.php[^@]{1,699}\25[^\?]{1,199}require_once[^\?]{1,399}file_put_contents\((\$\w+),\s*\$\w+\);chmod\(\26,\s*0444\);\}\}(?<X120351561>))|\[['"]HTTP_USER_AGENT[^%]{1,99}\$\w+=\[\s*['"]Googlebot[^%]{1,399}stripos\(\1,['"]bot['"][^%]{1,99}\{include\s*['"](?:wp\-)?amp\.php['"];exit;\}\}(?<X120367760>))))|\(['"](?:compress\.zlib://mh\.gz['"]\);\s*include\s+\1;(?<X120347290>)|zip://wp\-(tax)\.zip#\30['"]\);(?:include|require)_once\1;(?<X120353680>))|\[['"]phar://['"],['"]\./\w+['"],['"]\w\.zip['"],['"]/\w+\.php['"]\];include\(implode\('',\1\)\);(?<X120356991>)|__DIR__\.['"]/wp\-includes/[^'"]+\.gz['"];if\(file_exists\(\1\)\)@?include_once\s+['"]compress\.zlib://['"]\.\1;(?<X120352361>)|array(?:\((?:(?:\d+,?){10,}\);\$\w+=['"]['"];for\((\$\w+)=0;\34<count\(\1\);\34\+\+\)\{(\$\w+)\.?=chr\(\1\[\34\]\);\}include\35;(?<X120369940>)|[^;\)\$]{0,199}(?:['"](?:role['"]=>['"]administrator|user_pass['"]=>['"][^'"]+)['"][^;\)\$]{0,199}){2}\);if\([^\{;]+\{(\$\w+)=(wp_insert_user\(\1\);)update(_option\(['"]\w+['"]),\37\)[^\}]{0,99}\}(?:else\{[^\{\}]{1,499}\{(\$\w+)=get\39\);\1\[['"]id['"]\]=\40;\38\}\})?(?<X1225040>))|_merge\([^;]{1,99};(\$\w+)=\[[^;]{1,299};(\$\w+)='';foreach\(\42\s*\w+\s*(\$\w+)\)\s*\{\43\.=\1\[\44\];\}[^@]{1,99}curl_setopt\(\$\w+,\w+,\$\w+\)[^'"]{1,399}['"]\w+['"]\.\w+\(\$\w+\)\);file_put_contents[^;]{1,99};include\((\$\w+\));unlink\(\45;(?:exit|die);\}(?:\?>)?(?<X120342241>))|base64_decode\(['"]L2hvbWUvY[^'"]+mLmpwZw==['"]\);if\(file_exists\(\1\)\)\s*\{@?(?:include|require)(?:_once)?\(\1\);\}(?<X120362200>)|f(?:ile_get_contents\((?:['"][^'"]+\.(?:ttf|otf|woff2?)['"]\);eval\([^;]{0,199}\1\)+;(?<X1229440>)|[^\(]+\);[^@]{1,100}(?:\bfile_put_contents\((['"]\w+['"]),\1\);|\$\w+=new\s*ZipArchive\(\)[^@]{1,100}\->addFromString\(['"](\w+)['"],\1\);)(?:include\s*\49|[^@]{1,400}include\s*['"]\50['"]);(?<X1310351>))|open\(['"]https?://[^%]{1,9}\.acidpoll\.top[^'"]{1,199}['"],['"]r['"]\);\s*\$\w+=['"]['"];\s*while\(!feof\(\1\)\)\$\w+\.=fread\(\1,8192\);\s*eval\(['"]\?>['"]\.\$\w+\);(?<X120361511>)|unc_get_args\(\);if\(!function_exists\((\$\w+)\)+\53=\w+\(\53\);unset\(\1\[[^;]+;(?:return\s*)?call_user_func_array\(\53,\1\)(?<X2224211>))|range\((?:['"\176,\s*]+\);\$\w+=\$\{\1[^;]+;if\(\(in\_array\([^;]{1,999};\}metaphone\(['"][^\)]+\);[^;]{1,599}['"]range['"];[^\}]{1,999}\}return\$\w+\;\}[^=]{1,699}=curl_\w+\(\$\w+\);[^\{]+{\$\w+=array\(['"][^\)]+\);foreach\(\$[\w+\s*\$]+\)\{\$\w+\[\]=:\w+[^#]{1,999};die;\}}\}:\w+\(\);(?<X120369740>)|['"]\W+['"],['"]\W+['"]\);(\$\w+)=\$\{(?:\1\[[^\]]+\]\.){3}[^;]+;if\(+in_array\(gettype\(\56\)[^\{;]{1,199}\{[^;]{0,199}\beval\(\56\[[^\]]+\]\(\$\{\56\[[^;]+;\}(?<X1234340>))|s(?:candir\(\$_SERVER\['DOCUMENT_ROOT'\]\);for\((\$\w+)=0;\58<count\(\1\);\58\+\+\){if\(stristr\(\1\[\58\],'php'\)\){(\$\w+)=filemtime\(\$_SERVER\['DOCUMENT_ROOT'\]\."/"\.\1\[\58\]\);break;}}touch\(dirname\(__FILE__\),\59\);touch\(\$_SERVER\['SCRIPT_FILENAME'\],\59\);.*?(\$\w+)=new ZipArchive\(\).*?\60->extractTo\(\$\w+\);.*?<form enctype="multipart/form-data" method="post" action=""><label><input class="\w+" type="file" name="\w+" /></label><br /><input type="submit" name="submit" class="\w+" value="\w+" /></form></body></html>(?<X2054990>)|tr(?:_replace[\('"]+\.dataablog\.['",]+\.adsguest\.['",]+\1[\);]+goto(?<X2291831>)|rev\([^;]+;eval\((?:\$\w+\(){0,9}\1\((?:\$\w+\(){0,9}['"][^'"]{9999,}['"]\)(?<X2224081>)))|WP_(?:PLUGIN_DIR[^;]{1,49}\.PHP['"];if\(!class(_exists)[^\{]{1,99}file\64\(\1[^;]{1,49}include_once\1;add_action\(['"]init['"],function[^\$]{1,49}(\$\w+)[^\{]{1,99}\65[^\$]{1,49}(\$\w+)=get_option[^\?]{1,199}update_option\(['"]active_plugins['"],\66\);\}\}\},\d+\);\}(?<X120357762>)|remote_post\((?:base64_decode\(['"]aHR0c|['"]https?://)[^;]+;if\(\1\[[^;\{]{1,199}\{eval\(\1\[[^\]]+\]\);\}(?<X1232200>)))|[=\s]+(?:@?fopen([\(\s]+)['"](?:[^'"]{1,99}/)?wp-includes/[^'"]+\.php['"][\s,]+['"][\w\+]{1,4}['"]([\)\s]+);\s*(\$\w+)[=\s]+['"]\s*<\?[ph\s]+@eval\69base64_decode\69['"][^'"]*['"]\70+;\s*['"];\s*@?fwrite\69\1[\s,]+\71\70;\s*@?fclose\69\1\70;(?<X1218421>)|['"](?:\?>['"];\s*eval\(["']\1['"][\s\.]+\w+\(['"]https?://(?:\w+\.)?toronto360\.tv[^'"]+['"]\){2};(?<X1307081>)|https?://[^;]+;\s*(\$\w+)[\s=]+curl_init\(\);\s*\w+\(\74,\s*array\([^;]+\1[^;]+;\s*\$\w+[=\s]+\w+\(\74\);\s*\w+\(\74\);\s*(\$\w+)[=\s]+\w+\(sys_get_temp_dir[^;]+;\s*\w+\(\75,\s*\$\w+\);\s*(?:include|require)(?:_once)?\(\75\);\s*\w+\(\d+\+\d+={2}\d+\)\{\s*exit;\s\s*\}(?<X120341650>))|['"ht\.ps:/]{13};\s*eval\(['"]\?>['"]\.file_get_contents\s*\(\1\.['"][^/]{1,99}/[\-\w]+\.(?:txt|png|jpe?g|gif|ico)['"]\)\);(?<X120335130>)|base64_decode[/\*\w]+/\(/[\*\s\w/]+\1,\s*true\);[/\*\w]+\s*require_once\s*__DIR__\s*\.\s*['"]/wp\-load\w\.[ph]+["'];(?<X1313552>)|wp_remote_get\(str_rot13\(['"]uggcf://[^;]+;[^\}]{1,199}\$\w+[\s=]+wp_remote_retrieve_body\(\1\);\s*\$\w+[\s=]+ABSPATH\s*\.\s*str_rot13\((?<X220354641>)))
(\$\w+)[\h=]+(?:(\$_SERVER\[[^\]]+\])[\.'"/indexph]+;\s*(\$\w+)[\h=]+\2[\.'"/htaces]+;[^\{]{9,299}\{\s*(if\(!file_exists\()\1\)[^\{]+\{\s*chmod\(\1,\h*['"\d]+\);[^\{]{9,199}\{\s*\4\3\)[^\{]{0,99}\{[^\}]{0,199}\bchmod\(\3,\h*['"\d]+\);\s*\}\s*\}(?<X1288140>)|(base64_decode)\(['"][^\{]{1,99}\{\h*\$\w+[\h=]+wp_create_user\(\1,[^\n\?]{9,199}\badd_action\(['"]\w+['"],\h*function\([^\}\n]{1,90}\}\.user_login\h*!=\h*['"]+\.\6\(['"]\w+['"]\)[\h\.'";]+\}\);(?<X120341050>)|(curl_)init(?:[\h\(]+['"]https?://\d+\.\d+\.\d+\.\d+/(?:[^'"]+\.txt['"][\h\)]+;[^\{]{0,150}(\$\w+)[\h=]+\8exec[\h\(]+\1[\h\)]+;\s*if[\h\(]+\9[^\{]+\{\s*(?:\$\w+[\h=]+eval[\h\(]+['"]\?>['"][\h\.]+\9\);\s*\}\s*\8close\(\1\);(?<X120351411>)|eval[\h\(]+['"]\?>['"][\h\.]+\9[^\?]{0,99}\b\8close[\h\(]+\1[\h\)];(?<X120351100>))|z\d+_\d+/[^'"]+\.txt['"][\h\)]+;[^\?]{9,150}(\$\w+)[\h=]+\8exec[\h\(]+\1[\h\)]+;[^\}]{0,99}\beval[\h\(]+['"]\?>['"][\h\.]+\12[\h\)]+;\s*\}\s*\8close[\h\(]+\1[\h\)]+;(?<X120351451>))|\(\);\s*(\$\w+)[\h=]+['"]https:?//\w+\.jpslot186\.vip[^;]+;\s*\8setopt\(\1,[^\)]+\14\);[^\?]{0,199}(\$\w+)[\h=]+\8exec\(\1\);\s*echo\h*\15;(?<X1305620>))|(file_)get(_contents)\(['"]https?://\d+\.\d+\.\d+\.\d+/[\-\w]+\.txt['"]\);\s*\17put\18\(['"]\w+\.php['"],\h*\1\);(?<X120341041>)|@?file_get_contents\((base64_decode\()['"]aHR0cHM6Ly[^'"]+['"][\h\)]+;\s*@?eval\(\20\1[\h\)]+;(?<X120348890>)|@\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*if\(md5\(\1\.\1\)==['"][^'"]+['"]\)\h*@eval\(\$_REQUEST\[\1\]\);(?<X120335750>)|['"\.\hbase64_dco]+;\s*(?:(\$\w+)[\h=]+(\$_SERVER\[[^\]]+\])[\.'"/indexph]+;\s*(\$\w+)[\h=]+\24[\.'"/htaces]+;\s*\$\w+[\h=]+\1\([^\)]+\);[^\{]+\{\s*if\((\!file_exists)\(\23\)[^\{]+\{\s*chmod\(\23,[^\{]+\{\s*if\(\26\(\25\)[^\}]{0,199}\bchmod\(\25,\h*['"\d]+\);\s*\}\s*\}(?<X1288131>)|@[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1[\h\(]+['"]cGhhcjovLy[^'"]{40,99}['"][\h\)]+;(?<X1288120>))|['"\.\hbase64_deco]+;\s*(\$\w+)[\h=]+\1[\h\(]+[^\)]+\);\s*(\$\w+)[\h=]+\29[\h\(]+ABSPATH[\h\.]+call_user_func[\h\(]+\1,[^;]+;\s*(\$\w+)[\h=]+\1[\h\(]+\30[,\h]+true[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\31[\h\)]+;(?<X1291580>)|['"\.base64_dco]+;\s*(\$\w+)[\h=]+['"\.file_putcons]+;\s*(\$\w+)[\h=]+\1[\h\(]+['"][^'"]{99,200}['"][\h\)]+;\s*(\$\w+)[\h=]+dirname\(__DIR__\)[^;]+\.php['"];\s*if[\h\(!]+file_exists[\h\(]+\35[\s\)]+\{\s*@?\33[\h\(]+\35,\h*\34[\h\)]+;\s*\}(?<X120361240>)|['"\h\.base64_dco]+;\s*@[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1\(['"][^'"]{15,99}['"]\);(?<X120334220>)|['"](?:/(?:(?:home\d?|var)/[^'"]+\.\w+\.css['"];\s*if[\h\(]+!isset[\h\(]+\1[\s\)\{]+\w+[\h\(]+\1[\h\)]+;[\s\}]+else[\s\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\1[\h\)]+;\s*\}(?<X1283781>)|[^'"]+/\.\w+\.css['"];\s*if[\h\(]+!isset[\h\(]+\1[^\{]+\{[^\{]{0,99}\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\1[\h\)]+;\s*\}(?<X1305480>))|['"index\.ph]+;\s*\$\w+[\h=]+(base64_decode[\h\(]+[^\)]+\));\s*if[\h\(]+[^\{]+\{\s*@?chmod\(\1,\h*\d+\);\s*\$\w+[\h=]+['"]?[ir][ne][cq][lu][ui][dr]e(?:_once)?\(\40[^\?]{99,700}\bfile_put_contents\(\1,\h*\$\w+[^\)]*\);\s*header\(['"]Location:[^\)]+\);[^\}]+\}\s*\}\s*\}\s*\}(?<X1290210>)|[^'"]+/wp\-(?:admin|content|includes)/[^'"]+\.(?:jpe?g|png|txt|bmp)['"];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\('"]+\1[\h\)'"]+;(?<X120366660>)|[^'"]{0,20}['"];\s*(\$\w+)[\h=]+['"][^'"]{0,20}['"];\s*(\$\w+)[\h=]+['"][^@]{0,20}@example\.com['"];\s*if[\h\(]+![^\{]+\{\s*(\$\w+)[\h=]+wp_create_user[\h\(]+\1,\h*\43,\h*\44[\h\)]+;\s*(\$\w+)[\h=]+new\h*wp_user[\h\(]+\45[\h\)]+;\s*\46\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*\}(?<X120356050>)|[^;]+;\h*(\$\w+)[\h=]+(?:\w+[\h\(]+)?(?:\1\[\d+\][\h\.]+){5,}\1\[\d+\][\h\)]*;\h*(\$\w+)[\h=]+\$\{[^\}]+\1\[\d+\][\h\)]+\}\[[^\]]+\];\h*if\h*\([^;\{]{1,99}\{\h*@?eval[\h\(]+\48[\h\(]+\49[\h\)]+;\h*\}(?!else)(?<X1215510>)|\?>['"]\s*;\s*eval[\h\(]+\1[\h\.]+(?:file_)?get(?:_contents)?[\h\(]+base64_decode[\h\(]+['"]aHR0cHM6Ly9wYXN0ZS5lZS9[^'"]+['"][\h\)]+;(?<X1268251>)|base64_decode['"];\h*(\$\w+)[\h=]++['"]gzinflate['"];[^\(]{0,99}(\$\w+)[\h=]+\1[\h\(]+['"][^'"]{999,1500}['"][\h\)]+;[^\{]{9,99}\{\s*(\$\w+)[\.=\h]+\$\w+[\h\(]+\$\w+[\h\(]+\53\[[^\}]{0,99}\}\h*(\$\w+)[\h=]+\52[\h\(]+\54[\h\)]+;\h*eval[\h\(]+\55[\h\)]+;(?<X120353895>)|file_put_contents['"];\s*\1[\h\(]+['"](\w+)['",\h]+\$_REQUEST[\['"]+\57['"\]\)\h]+;\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\('"]+\57['"\)\h]+;\s*\Z(?<X1305461>)|https?:(?://(?:[^'"]+\.net[^'"]+\.txt['"];\s*(\$\w+)[\h=]+file_get_contents\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\59\);(?<X120354601>)|\w+\.sicp\.me/\w+['"];\s*(\$\w+)[\h=]+@(file_)get(_contents)[\h\(]+\1[\h\)]+;\s*if[\h\(]+\61[^\{]+\{\s*(\$\w+)[\h=]+[^;]+;\s*\$\w+[\h=]+@\62put\63[\h\(]+\64[,\h]+\61[\h\)];\s*if[^\{]+\{[^\}]+(?:\}\s*else\s*\{[^\}]+\}\s*){2}(?<X1254530>)|kurama\.co\.in/[^'"]+\.txt['"];\s*function\h*(\w+)\(\$\w+\)\s*\{\s*\$\w+[\h=]+curl_init\(\);[^\}]{99,400}\}\s*(\$\w+)[\h=]+\66\(\1\);\s*if[^\{]+\{\s*eval\(['"]\?>['"][\h\.]+\67\);\s*\}\s*else\s*\{\s*echo\h*\67;\s*\}(?<X120347180>)|pub\-[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\70setopt\(\69,[^\)]+\1\);\s*\70[^;]+;\s*(\$\w+)[\h=]+\70exec\(\69\);\s*\70close\(\69\);\s*echo\h*eval\(['"]\?>['"][\h\.]+\71\);(?<X120347130>)|tahu\-isi\.store/\w+\.txt['"];[^=]{0,50}(\$\w+)[\h=]+(curl_)init\(\1\);[^\?]{0,300}\$\w+[\h=]+\74exec\(\73\);[^\?]{0,350}\b\74close\(\73\);(?<X120347140>))|[^['"]+\.txt['"];\s+(\$\w+)[^;]{1,99}md5\(\1\)\s+\.\s+['"]\.php['"];\s+function\s+\w+[^;]{1,49}(\$\w+)[\h=]+(curl)\w+\(\);\s+\78\w+\(\77[^!]{1,199}!file_exists\(\76\)[^<]{1,49}\76\)[^@]{1,49}@?unlink\(\76\);\s+\w+\(\1,\s*\76\);\s+\}\s+(?:include|require)\(\76\);(?<X120349564>))|index['"];\s*(\$\w+)[\h=]+wp_upload_dir[\h\(\)]+;\s*(\$\w+)[\h=]+\80\[[^\]]+\][\h\.]+['"]/[^\$]+/\1\.zip/\1\.php['"];\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]phar://['"\h\.]+\81;(?<X1235900>)|zip(?:://(?:[^#]{1,29}/sbb#\w+['"];(?:include|require)\(\1\);(?<X120350932>)|\w+#\w['"];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\1[\h\)]+;(?<X1323450>)|\w+\.zip#\w+['"];\s*include\(\1\);(?<X120330850>))|['"];\h*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1[\h\.]+['"]://[^\.]+\.zip#[^'"]+\.php['"];(?<X120335990>)))|['"]{2};(?:\s*\1[\h\.=]+['"][^'"]+['"];\s*){100}[^\?]{15000,}(\$\w+)[\h=]+\$\w+\(\1\);\s*\87[\h=]+\$\w+\(\87\);[^#]{0,150}\beval\(\87\);(?<X120342680>)|['']https?://[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(file_)get(_contents)[\h\(]+\1[\h\)]+;\s*if[\h\(]+\89[^\{]+\{[^\}]{0,199}\b\90put\91[\h\(]+(\$\w+)[,\h]+\89[\h\)];[^\}]{0,199}\bunlink[\h\(]+\92[\h\)];\s*\}(?:\s*else\s*\{[^\}]+\})?(?<X1293670>)|[\['"]+https?://raw\.githubusercontent\.com/22XploiterCrew\-Team/[^;]+;\s*if[\h\(]+file_exists[\h\(]+\1\[[^\{]+\{\s*include\h*\1\[[^\?]{9,99}\bfwrite[\h\(]+\$\w+,\h*(\w+)[\h\(]+\1\[[^#]{9,199}\bfunction\h*\94\b[^\{]+\{\s*\$\w+[\h=]+curl_init[^\}]{9,299}\}(?<X120362513>)|\$_(?:[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\h\(]+\1[\s\)\{]+@[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1;\s*\}(?<X120367190>)|SERVER;\s*(?:(\$\w+)[\h=]+['"]HTTP_[^;]+;[^\?]{0,99}(\$\w+)[\h=]+\1\[\97\];\s*eval[\h\(]+\98[\h\)]+;\s*\}(?<X120366670>)|[^\{]{0,199}(\$\w+)[\h=]+['"]HTTP_[^'"]+['"];[^\{]{0,199}\bif[\h\(]+isset[\h\(]+\1\[\100[\]\)\s]+\{[^\}]{0,199}\beval[\h\(]+\1\[\100[\]\)]+;[^\}]{0,199}\}(?<X120341060>)))|\[(?:122,\h*105,\h112,\h*58,[^\]]+\];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*implode[\h\(]+array_map[\h\(]+['"]chr['"],\h*\1[\h\)]+;(?<X120366710>)|['",\hzip:/xml\.#]+\];\s*include\h*implode[\h\(]+['"]{2},\h*\1[\h\)]+;(?<X120367620>)))
(\$\w+)(?:[\h=]+(?:A(?:BSPATH[\h\.]+['"][^'"]+\.gz['"];\s*if[\h\(]+file_exists[\h\(]+\1[\s\)]+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]compress\.zlib://['"][\h\.]+\1;(?<X120358360>)|rray[\h\(]+(?:[\d,\h]+\);\s*(\$\w+)[\h=]+['"]{2};\s*foreach[\h\(]+\1\h*as\h*(\$\w+)[\s\)\{]+if[\h\(]+\4[^\{]+\{\s*\3[\h=\.]+(?:['"]|chr\(|\4)?[^\?]{0,299}(\$\w+)[\h=]+\3[\s\(]+(?:file_get_contents|\$\w+)[\s\(]+\3[^;]+;[^\?]{0,99}\beval[\h\(]+\5[\h\)]+;(?<X1269461>)|[^\)]{999,7000}\);\s*(\$\w+)[\h=]+array[\h\(]+[^\)]{99,299}\);\s*(\$\w+)[\h=]+(?:\7\[\d+\]\.){5}[^;]+;\s*(\$\w+)[\h=]+(?:\7\[\d+\]\.){5}[^;]+;\s*(\$\w+)[\h=]+(?:\7\[\d+\]\.){5}[^;]+;\s*eval[\h\(]+(?:\8\(|\9\(|\10\(){3}\1[\h\)]+;(?<X120349000>)))|base64_decode(?:[\h\(]+['"][^'"]{9,199}(?:2h0dHA6Ly8xMDcuMTUwLjQxLjU5L3o0MTAyNl8xNi8nOwpmdW5jdGlvbiBjdXJsX2dldF9jb250ZW50cyg|2h0dHA6Ly8xNzMuMjA4LjE4NC4xMzkvejQxMTI1XzYv)[^'"]{999,6999}['"][,\d\h]*\);\s*eval[\h\(]+\1[\h\)]+;(?<X1287181>)|\(['"](?:[^'"]{999,4000}2V2YWwoaHRtbHNwZWNpYWxjaGFyc19kZWNvZGUoZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJEFwYWFqYSkpKSk7ZXhpdDs=['"],\h*true\);\s*eval\(\1\);(?<X120333380>)|ZnVuY3Rpb24gQlJ0RVRiKCRiaHpRKQ0KeyANCiRiaHpRPWd6[^'"]{9999,20000}S2ZDN0tmOVJ2TzFWRHVwZi95Tkt0SkxEL1AvN3ZQd3I4NTIvNTgyLy84OS8vQWc9PSIpKTs=['"][\h,]+true\);\s*eval\(\1\);(?<X120333940>))|\([^\)]+\);\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\16setopt_array\(\15,\s*array\(\s*\w+[\h=>]+\1,[^\)]{9,199}[\h\)]+;\s*(\$\w+)[\h=]+\16exec\(\15\);[^\{]{9,99}\bfile_put_contents\((\$\w+)[,\h]+\17\);\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\(\18\);\s*if\(\d+\+\d+[^\{]+\{\s*exit;\s*\}(?<X120341020>))|curl_init[\h\(]+['"]https?://[^'"]+\.txt['"][\h\)]+;\s*(curl_)setopt[\h\(]+\1,[^\?]{0,150}(\$\w+)[\h=]+\20exec\(\1\);\s*if[^\{]+\{\s*eval\(['"]\?>['"][\h\.]+\21\);\s*\}\s*\20close\(\1\);(?<X120347120>)|f(?:alse;\s*(\$\w+)[\h=]+array\(\s*['"]Googlebot['"],[^;]+;\s*foreach[\h\(]+\23[^\}]{9,99}\1[\h=]+true;[^\{]{0,99}\bif[\h\(]+\$\w+\h*&&\h*\1[\s\)\{]+[^\{]{0,199}\s*(\$\w+)[\h=]+@?file_get_contents[\s\(]+['"]https?://jeenasikho\.com/[^'"]+\.php[^;]+;[^\}]{0,99}\becho\h*\24;\s*exit;\s*\}\s*\}(?<X120356080>)|ile_get_contents(?:[\h\('"]+\.hta['"\)\h]+;\s*eval[\h\(]+\1[\h\)]+;(?<X1295910>)|[\h\(]+['"]https?://(?:punyakita\.pro/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;(?<X1305450>)|raw\.githubusercontent\.com/css\-wordpress/[^'"]+/js['"][\h\)]+;\s*echo\h*\1;(?<X1237680>)|realestat\.lol/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;(?<X1237670>))|\(['"]https?://(?:(?:[^\.]+\.)?onexgen\.com[^'"]+\.zip['"]\);\s*File::put\(\w+\(['"]([^\.]+\.php)['"]\),\h*\1\);\s*header\(['"]Location:\h*/\30['"]\);\s*exit;(?<X120342520>)|khusus\-discovery\.it\.com/[^'"]+\.txt['"]\);\s*echo\h*\1;(?<X120341090>)|links\-mbslot\.web\.app/\w+\.txt['"]\);\s*echo\h*\1;(?<X120334090>)|pausgundik\.com/[^\.]+\.txt['"]\);\s*echo\h*\1;(?<X120337160>)))|unction(?:[\h\(]+(\$\w+)[\h\)]+\{\h*return\h+strtr[\h\(]+\35\h*,[^;]{1,99};\h*\};\h*\$\w+[\h=]+\1\h*\([^\n\?\+/]{1,499}(\$\w{1,40})[\s=]+\$\w+[\h\(]+['"]{2}[\h,]+(?:\$\w+[\h\(]+){1,}['"][^'"\s]{999,}['"][\s\)]+;\s*\36[\h\(\)]+;(?<X1194091>)|[\s\(\)\{]+\$\w+[\h=]+defined\([^\}]{0,200}\bwp\-includes/blocks/\*\.gz['"],[^\?]{99,500}\bif[\h\(]+file_exists[\h\(]+(\$\w+)[\s\(\)\{]+@?copy[\h\(]+\38,\h*\$\w+[^\?]{99,500}\1\(\);(?<X120356500>)))|tempnam[\h\(]+sys_get_temp_dir[\h\(\),]+['"]c0k1e_['"][\h\)]+;[^\?]{99,1500}(\$\w+)[\h=]+\w+[\h\(]+\$\w+[\h,]+\1[\h\)]+;\s*if[\h\(]+\40[\s\)\{]+eval[\h\(]+['"]\?>['"][\h\.]+\40[\h\)]+;[^\?]{0,99}\bif[\h\(]+file_exists[\h\(]+\1[\s\)\{]+@?unlink[\h\(]+\1[\h\)]+;\s*\}(?<X120350900>))|[\s='"]+[^;]{16,256};\s*(\$\w+)[\s='"]+[^;]{16,256};\s*\w+\s*\(\w+\(\42\)\)\s*\{\s*@?chmod\(\1,\s*\d+\);\s*(\$\w+)[\s=]+(\w+)\(\1\)\;\s*(\$\w+)[\s=]+\44\(\42\);\s*\$\w+[\s=]+base64_decode\([^\}]{1,999}\45\);\s*\w+\s*\(\w+\(str_rot13\(\w+\(\43\){3}[^\}]{1,999}@?chmod\(\1,\s*0444\);[^\}]{1,99}header\(['"]\w+:[^;]{1,99};\s*(?:exit|die)[^\}]{1,32}\}\s*\}(?<X120336740>)|[\s=]+(?:(?:\[|array\()[^\]\)]*\$_[GPCSR]\w{2,6}\b[^;]{0,499};\s*if\s*\([^\)]*\1\[\d+(\]\[\1\[)[^;\{]+\{\s*(\$\w+)[\s=]+\1\[(?:\d+\47[^\]]+\]+\(\1\[){2}[^\}]{0,499}\48\[[^\]]+(\]\(\48\[)[^;]+;\s*(?:requir|includ)e(?:_once)?\s*(?:\(\s*)?\48\[[^;]+;\s*\48\[[^\]]+\49[^;]+;\s*\}(?<X1197790>)|(?:false|true);[^\$]{1,29}file_exists\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/wp\-load\.php['"][^\$]{1,49}(?:include|require)\s*\$_SERVER[^\}]{1,49}\1[^\{]{1,99}\1[^\$]{1,49}(\$\w+)[^\!]{1,199}supe1User[^\!]{1,99}\51\.['"]@gmail\.com['"][^\}]{1,299}set_role\(\s*['"]administrator[^\}]{1,49}(echo)[^!]{1,99}\52\s*[^;]{1,49};\s*\}\s*\}(?<X120350541>)|(\$\w+\->)get_var\(\54prepare\(\s*['"]SELECT\s+option_value[^!]{1,99}if[\h\(]+!\1\)\s*\{\s*die\(['"]Error:[^=]{1,99}(\$\w+)[\s=]+base64_decode\(\1\);\s*if[\h\(]+\55[^\?]{1,149}(\$\w+)[^;]{1,99}\.php['"];[^\(]{1,99}file_put_contents\(\56,\s*\55\);[^\?]{1,149}include\s+\56;\s*\}\s+finally[^\}]{1,99}file_exists\(\56\)\)\s*\{\s*unlink\(\56\);\s*\}\s*\}(?<X120355350>)|(curl)\w+\(\);\s*\58\w+\(\1,(?:[^:]{1,49}['"]https?://[^\.]+\.pages\.dev/[^'"]+\.txt['"]\);\s*\58\w+\(\1,\s*\58\w+,\s*true\);\s*(\$\w+)[\s=]+\58\w+\(\1\);\s*\58\w+\(\1\);\s*echo\s+\59;(?<X120355801>)|\s*\58\w+,\s*['"]https?://[^'"]+['"]\);\s*\58\w+\(\1[^=]{1,99}(\$\w+)[\s=]+\58\w+\(\1\);\s*\58\w+\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\61\);(?<X120360140>))|(curl_)init(?:[\s\(]+(base64_decode)[\s\(]+(?:['"]aHR0c[^'"]+|strrev[\s(]+['"][^'"]+c0RHa)['"][\s\)]+;[^\}]{0,499}\$(\w+)[\s=]+\63exec[\s\(]+\1[\s\)]+;\s*(\$\w+)[\s=]+(?:\64\s*\([^;]*)['"](?:<\?|4zp|pz4)['"][^;]*;@?eval[\s\(]+\66[\s\.]+\$\65[\s\)]+;\s*(?:die|exit)\b[^;]{0,19};(?<X1197730>)|\(['"]https?://[^/]+/\w+(?:togel|slot)/[^;]+(?:/|\.txt)['"]\);\s*\63\w+\(\1,[^;]+;\s*echo\s*\63exec\(\1\);\s*\63\w+\(\1\);(?<X120361910>))|@?f(?:ile_get_contents[\s\(]+['"]https?://pastebin\.com/raw/[^'"]+['"][\s\)]+;\s*@?echo[\s\(]{0,5}\1[\s\)]{0,5};(?<X1225730>)|open[\s\(]+['"][^'"]*\bwp\-links?\.php['"][^;]+;\s*(\$\w+)[\s=]+@?file_get_contents[\s\(]+['"]https?://[^;]+;\s*(?:\$\w+[\s=]+)?@?fwrite[\s\(]+\1[\s,]+\70[\s\)]+;\s*fclose[\s\(]+\1[\s\)]+;(?<X1198580>))))
(\$\w+)[\s=]+['"](?:/(?:home/[^'"]+/\w+\.txt['"];\s*if\s*\(is_file\(\1\)\)\s*\{\s*include\s*\1;\s*\}\s*else\s*\{\s*http_response_code\(404\);\s*echo[^%]{1,99}\1\);\s*\}(?<X120369401>)|posts/[^'"]+['"];\s*(\$\w+)[\s=]+['"]/posts/[^'"]+['"];\s*(\$\w+)[\s=]+['"]/posts/[^'"]+['"];\s*(\$\w+)[\s=]+\$_SERVER\[[^\$]{1,49}if\(\5[\s=]+\3\s+or\s+\5[\s=]+\1\s+or\s+\5[\s=]+\4\)\s*\{\s*eval\(['"]\?>['"]\.file_get_contents\(['"][^\.]+\.txt['"]\)\);\s*\}(?<X120370110>))|<\\x3f[^=]{1,499}\\x\w+['";\s]+(\$\w+)\s*=[^;]+;\s*@?file_put_contents[\s\(]+\7[\s,]+\1[\s\)]+;\s*(?:@?(?:includ|requir)e(?:_once)?[\s\(]*\7[\s\)]*;\s*)?@?unlink[\s\(]+\7[\s\)]+;(?<X1227031>)|['"];\s*if\s*\(isset\((\$_POST\[['"]cmd['"]\]\))\)\s*\{\s*(\$\w+)[\s=]+trim\(\9;\s*\$\w+[\s=]+explode\(['"]\s*['"],\s*\10\)\[\d+\][^%]{1,199}\1[\s=]+shell_exec\(escapeshellcmd\(\10[^#]{999,1800}\bWebShell\h*FileManager<(?<X220353241>)|[\w\-]+['"];\s+(\$\w+)[^\-]{1,99}file_exists[\h\(]+\12[\h\.]+['"]/[\w\-]+\.php[^@]{1,199}dirname[^@]{1,499}(\$\w+_)\w+[\s=]+['"]https?://[^\\]{1,1099}@?file_put_contents[\h\(]+\13\w+[^/]{1,199}function_exists[\h\(]+['"](activate_plugin)[^\.]{1,49}require_once[^@]{1,99}@?\14[\h\(]+\1(?<X220369714>)|[^'"]+\.zip['"];\s*(\$\w+)[\s=]+['"]\w+\.php['"];\s*(\$\w+)[\s=]+new\s+ZipArchive;\s*if[\h\(]+\17\->open\(\1[^;]{1,49}\17\->getFromName\(\16\);\s*\17\->close[^!]{1,49}if[\h\(]+(\$\w+)[^\?]{1,49}eval\(['"]\?>['"]\s*\.\s*\18\);\s*\}\s*\}(?<X120359890>)|[^'"]{1,32}['"];\s*(\$\w+)[\s=]+['"]https?://[^'"[]+\.php(?:\W)['"];[^!]{1,199}(\$\w+)[^!]{1,199}(function)\s+validateEmail\((\w+)[^#]{1,199}\23[^\{]{1,49}decodeBase64[\s=]+\22[^#]{1,499}hash.split\(['"]\{\1\}[^\?]{1,199}window\.location=['"]\{\20\}['"]\+email64;[^\?]{1,99}</script>[^\*]{1,49}echo\s+\21;(?<X120357780>)|[^'"]{9,99}['"];\s*(\$\w+)[\s=]+\$_SERVER;\s*(\$\w+)[\s=]+&?\1;\25\[\26\[\d+[^=]+=\26\[\d[^;]+;\s*\25\[\26\[\d[^\{]{9,1599}\{\s*(\$\w+)\.?=\26\[\d[^\{]{9,1500}\{\s*\27\.?=\(?\26\[\d[^\{]{0,999}\{\s*header\(\26\[\d[^\)]{0,199}\);;(?<X1302028>)|[^;]{16,99};[^;]{1,99}(\$\w+)[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];[^;]{1,999}(\$\w+)[=\s]+md5\(\29\);[^\{]+\30\s*={3}\s*\1\)[^;]{1,99}echo\s*['"]welcome[^\\]{1,999}\.\w+/\w+\.php<br>(?<X220344960>)|\w+[^\{]{1,49}function\s+(\w+)\(\)\s*\{\s*global\s+\1;\s*if[\h\(]+isset\(\$_GET[^\{]{1,49}\1\)\s*\{\s*(?:require|include)(?:_once)?\s+\w+[\h\.]+['"][^'"]+\.php['"];\s*(\$\w+)[\s=]+get_users[^\{]{1,99}\33[^\?]{1,299}\33\->user_login[^\}]{1,199}exit;[^\(]{1,49}add_Action\(['"]\w+['"],\s*['"]\32['"]\);(?<X120367700>)|aHR0(?:[^'"]+['"];\s*(\$\w+)[\s=]+base64_decode\(\1\);\s*echo\s*['"]<script\s+src=['"]['"]\s*\.\s*esc_url\(\35\)\s*\.\s*['"]['"]></script>['"];(?<X120360350>)|cHM6Ly9naXRsYWIuY29tL0[^'"]+['"];\s*\s*\$\w+[\s=]+base64_decode\(\1\);\s*(\$\w+)[\s=]+curl_init\(\);[^%]{1,399}curl_getinfo\(\37,\s*CURLINFO_HTTP_CODE[^%]{1,199}eval\(['"]\?>['"]\s*\.\s*\$\w+\);(?<X120370670>))|http(?:s://[^\.]+\.b\-cdn\.net[^'"]+\.php['"];\s*(\$\w+)[\s=]+file_get_contents\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\39\);(?<X120353841>)|s?://(?:[\w\-]+\.acidpoll\.top[^%]{1,99}['"];\s*(\$\w+)[\s=]+implode\(['"]{2},\s*file\(\1\)\);\s*eval\(['"]\?>['"]\s*\.\s*\41\);(?<X120360601>)|[^%]{1,99}parse_url\(\1[^%]{1,99}https?['"]\)\s*\?\s*443\s*:\s*80[^%]{1,49}ssl://[^%]{1,99}fsockopen\(\$\w+\s*\.\s*(?:\$\w+,\s*){4}\d+[^%]{1,399}if\s*\(!empty\((\$\w+)\)\)\s*@?eval\(['"]\?>['"]\s*\.\s*\43\);\s*\}(?<X120367661>)|[^'"]+(?:(?:\.txt|\.php)['"];\s*(\$\w+)[\s=]+(curl)\w+\(\1\);\s*\46\w+\(\45[^\$]{1,49}(\$\w+)[\s=]+\46\w+\(\45\);\s*if[\h\(]+\46\w+\(\45\)\)\s*\{\s*die\(['"]\46[^;]{1,49}\46\w+\(\45\)\);\s*\}\s*\46\w+\(\45\);\s*eval\(['"]\?>['"]\s*\.\s*\47\);(?<X120364311>)|\.html['"];\s*(\$\w+)[\s=]+file_get_contents\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\49\);(?<X120361650>)|\.pages\.dev/[^;]+\.txt['"];[^\{]{1,99}(function)\s+(is_googlebot)\(\):\s*\w+[^\?]{1,49}\$_SERVER[^\{]{1,199}\52[^\[]{1,99}\51\w+\(['"](curl)\w+['"][^!]{1,299}\53[^@]{1,299}(\$\w+)[\s=]+@?file_get_contents\(\1[^\?]{1,149}echo\s+\54;\s*exit;\s*\}\s*\}(?<X120354830>)|\.php['"];\s*(\$\w+)[\s=]+(?:__DIR__\s*\.\s*['"]/\w+\.php['"];\s*(\$\w+)[\s=]+file_get_contents\(\1\);\s*if[\h\(]+\57[^\(]{1,99}file_put_contents\(\56,\s*\57\);[^\?]{1,99}(echo\s*['"]waduh\s+gagal\s+kaik\.\.\.\\\w['"];)\s*\}\s*\}\s*else\s*\{\s*\58\s*\}(?<X120356280>)|file_get_contents\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\56\);(?<X120362611>))|\.txt['"];(?:(\$\w+)=trim\(file_get_contents\(\1\)\);(\$\w+)=\$_SERVER\[[^&]{1,99}empty\(\61[^\{]{1,99}\62,\61\)[^\?]{1,99}strtolower[^\{]{1,99}isset\(\$_GET[^\-]{1,99}https?://[^'"]+\.(?:html['"];if\(function_exists\(['"](curl)\w+['"]\)\)\{(\$\w+)[^\\]{1,199}\63\w+\(\64\);if\((\$\w+)\)\{echo\65;exit;\}\}\}\}(?<X120357992>)|txt['"][^\?]{1,199}function_exists\(['"]curl\w+['"][^!]{1,259}(\$\w+)[^\}]{1,199}echo\67;exit;\}\}\}\}\}(?<X120358032>))|[^\$]{1,49}(\$\w+)[\s=]+(curl_)\w+\(\1\);\s*\70\w+\(\69[^=]{1,199}(\$\w+)[\s=]+\70\w+\(\69\);\s*\70\w+\(\69\);[^\?]{1,49}eval\(['"]\?>['"]\s*\.\s*\71\);(?<X120364300>)|[^\[]{1,199}strtolower\(\$_SERVER[^\(]{1,99}(function)\s+(\w+)\([^\(]{1,99}\(\73_exists[^;]{1,99}(curl)\w+[^\.]{1,49}\75\w+[^&]{1,299}preg_match[^\?]{1,149}echo\s+\74\(\1\);\s*ob_end_flush\(\);\s*(?:exit|die);\s*\}(?<X120352171>)|[^\{]{1,99}allow_url_fopen['"\)\s\{]+(\$\w+)[^\}]{1,99}\(\1\)[^\?]{1,999}curl_close\(\$\w*\);\s*\}\s*\w+\s*\(\77\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\77\);\s*\}(?<X120350590>)|\s*(\$\w+)[\s=]+(?:(curl)\w+\(\);\s*\80\w+\(\79,\s*\80\w+,\s*\1\);\s*\80\w+[^=]{1,49}(\$\w+)[\s=]+\80\w+\(\79\);\s*\80\w+\(\79\);\s*echo\s+eval\(['"]\?>['"]\.\81\);(?<X120359350>)|file_get_contents\(\1\);\s*if[\h\(]+\79[^\$]{1,49}(\$\w+)[\s=]+trim\(\79\);\s*echo\s*['"]<script\s+src[^\$]{1,49}\83[^;]{1,49}</script>['"];\s*\}(?<X120362220>))))|[^;]+\.(?:pages\.dev[^;]+['"];[^\$]{1,49}(\$\w+)[\s=]+(wp_remote)_get[\h\(]+\1[^\$]{1,99}is_wp_error[\h\(]+\85[^\(]{1,99}(\86_retrieve_)response_code[\h\(]+\85[^'"]{1,99}(echo)\s*['"]<div\s+class=[^\$]{1,99}\88\s+\87body[\h\(]+\85[\h\)]+;\s*\88\s+['"]</div>['"];\s*\}(?<X120354331>)|txt['"];\s*(\$\w+)[\s=]+\w+\(\1\);\s*\w+\(\90,[^\}]{1,299}curl_exec\(\90\);\s*\w+\s*\((\$\w+)[^\}]{1,99}\{eval\(['"]\?>['"]\s*\.\s*\91\);\}\s*curl_close\(\90\);(?<X120343230>))|[^;]{1,99}/[^;]+\.pages\.dev[^;]{1,99}['"];\s*(\$\w+)[\s=]+curl_init\(\1\);[^\?]{1,199}else\s*\{\s*eval\(['"]\?>[^\?]{1,99}curl_close\(\93\);(?<X120367691>)|p(?:astebin\.com/raw/[^'"]+['"];(\$\w+)[\s=]+(curl_)init\(\1\);[^%]{1,99}(\$\w+)[\s=]+\96exec\(\95\);\96close\(\95\);eval\(['"]\?>['"]\s*\.\s*\(['"]\97['"]\)\);(?<X120369770>)|ub-[\w]+\.r2\.dev[^'"]{1,199}['"];[^%]{1,199}(\$\w+)[\s=]+curl_init\(\1\)[^%]{1,799}curl_exec\(\99\)[^%]{1,399}curl_close\(\99\);[^%]{1,99}echo\s+\$\w+;(?<X120362090>))|seo\w+\.b\-cdn\.net[^%]{1,99}['"];\s*(\$\w+)[\s=]+file_get_contents\(\1\);\s*eval\(['"]\?>[\'"]\s*\.\s*\101\);(?<X120360610>)|z\d+_[^'"]+['"];\s*function\s*\w+\(\1\)\s*\{[^%]{1,599}(\$\w+)[\s=]+stream_context_create\(\[['"]https?['"]\s*=>\s*\[['"][^%]{1,99}file_get_contents\(\1,\s*false,\s*\103[^%]{1,599}(return)\s*substr\((\$\w+),\s*strpos\(\105[^\}]+\}\s*\104\s*false;\s*\}(?<X120369960>)))|sulele333@onmail\.com['"];[^\?]{1,499}\$(\w+)[\s=]+\$_[GPSRC]\w{2,6}\[[^\?]{1,199}\$(\w+)\s*\.?=\s*['"][^;]{0,199}\$\107[^\?]{1,999}\bheader[\s\(]+['"][^\?]{1,199}\bmail[\s\(]+['"]?\1\b[^\);]+,\s*\$\108\s*\)\s*;(?<X2228101>)|zip(?:://(?:(\w{1,32})\.zip#\110\.txt['"];(?:include|require)(?:_once)?\(\1\);(?<X120357301>)|['"];\s*@?(?:include|require)(?:_once)?\s*\1\s*\.\s*['"][^'"]{1,99}\.zip#[^'"]{1,99}['"];(?<X120356790>)|cw\d+\.zip#cw\d+\.txt['"];(?:include|require)\(\1\);(?<X120352460>))|['"];include\s*\1\.['"]://\w+#?[^'"]{1,99}['"];(?<X120352510>)))
(\$\w+)[\s=]+(?:\$(?:\w+\(['"]/\^\\s\*<\\\?php\\s\*/['"].\s*['"]+,\s*\1\);\s*try\s*\{\s*eval\s*/\*[^\*]{1,32}\*/\s*\(\1\);\s*\}\s*\w+\s*[^\}]{1,499}\(\w+\(\$_GET\[['"]debug(?<X220360910>)|_(?:GET\[['"]token['"]\][\s\?'"]+;\s*\w+\s*\(\1[\s=!]+['"]uac\-tts\-setup\-\d+['"](?<X220364561>)|SERVER(?:;\s*(\$\w+)[\s=]+['"]HTTP+\w+['"];\s*if[\h\(]+isset\(\1\[\4\]\)\)\s*\{\}(?<X120358731>)|[\['"]+HTTP_USER_AGENT[^\}]{1,32}\1[,\s'"]+\w+['"][^\}]{99,299}setcookie[^\}]+\s*\}\s*echo\s*\w+\(['"](http)s?://\w+\.\w+/cpanel/([^\.]+)\.txt['"]\);\s*(?:exit|die);\s*\?>\s*<\?[ph\s]+\}[^\{]+\{\s*header[\('"\s]+location:\s*\6s?://[^/]+/\7\.html['"][\s\);]+(?:exit|die);\s*\}(?<X1303990>)|[^%]{1,99};\s*\bif\s*\(stripos\(\1,\s*['"]Googlebot['"][^%]{1,99}(\$\w+)[\s=]+['"]https?://qris-pwn\.pages\.dev[^'"]{1,99}['"][^%]{1,299}(\$\w+)[\h=]+@?file_get_contents\(\9[^%]{1,199}echo\s*\10;[^\}]{1,99}\}\s*\}(?<X120361361>)|[^\|]{1,99}(\$\w+)[\s=]+['"]/\(\bbot[^'"]+['"];[^\.]{1,129}https?://[^'"]+\.txt['"][^\{]{1,199}preg_match\(\12,\s+\1[^&]{1,599}(\$\w+)[\s=]+(\w+)[^\.]{1,299}\14[^@]{1,299}\13[\s=]+@?file_get_contents[^\}]{1,699}\13[\s=]+curl_\w+[^\}]{1,49}\}\s*return\s+\13;\s*\}(?<X120366170>)|\[['"]\w+['"]\](?:;\s*(\$\w+)[\s=]+wp_get_current_user\(\);\s*\w+\(!\w+\(['"]administrator['"],\s*\16\->\w+\)\)\s*(echo)\s*['"]<(script)>['"];[^'"]{1,99}base64_decode\(['"][^'"]{99,999}['"]\);\s*\17\s*\1;\s*\17\s*base64_decode\(['"]Ij48L2lmcmFtZT48L2JvZHk[^'"]{99,999}['"]\);\s*echo\s*['"]</\18>['"];(?<X120346420>)|[\?\s*'"]+;\s*(\$\w+)[\s=]+array\(['"](?:bot|google)[^%]{1,99}foreach\s*\(\20[^%]{1,199}if\s*\(stripos\(\1[^%]{1,199}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://[^'"]+workers\.dev[^%]{1,199}echo\s*\21;\s*exit;\s*\}\s*\}(?<X120370770>))|\[['"]HTTP_USER_AGENT(?:[^%]{1,499}if\s*\(preg_match\(['\']/(?:bot|crawl|slurp|bingbot)[^%]{1,199}\1[^%]{1,99}file_get_contents\(['"]https?://[^'"]+\.dev/raw/[^%]{1,99}['"]\);\s*exit;\s*\}(?<X120364050>)|[^%]{1,599}(?:Googlebot|WhatsApp|DuckDuckBot|Google)[^%]{1,199}stripos\(\1[^%]{1,99}//[^%]{1,99}amp\.php[^%]{1,99}header\(['"]Location:[^'"]{1,99}['"]\);\s*exit;\s*\}(?<X120365090>)))))|\(chr\(\d+\)\.chr\(\w+\)\.[^;]+;\s*\$\w+[\s=]+substr[^;]+;\s*\$\w+[\s=]+\1\(['"]\w\*['"],\s*\$\w+\);\s*\$\w+[\s=]+ord\(\$\w+\[0\]\);[^\}]+\}\s*\$\w+[\s=]+substr\([^:]{1,999}::\w+\(\$\w+,\s*\$\w+\);\s*eval\((?<X220366070>)|\[(?:['"](?:compress['"],\s*['"]\.zlib://['"][^%]{1,19}\.gz['"]\];\s*(\$\w+)[\s=]+implode\(['"]['"],\s*\1\);\s*(?:include|require)(?:_once)?\(\26\);(?<X120370730>)|extractedIvs['"][^\[]{1,99}(\$\w+)[\s=]+\[['"]base64_decode['"],['"]gzuncompress['"],['"]file_put_contents['"][^=]{1,99}(\$\w+)[\s=]+['"][^'"]+['"];\s*foreach\(\28[^/]{1,199}\1[^/]{1,199}\29[^'"]{1,129}['"]php_['"][^,]{1,49}(\$\w+)[^;]{1,49}(?:include|require)\s+\30;\s*\$\w+\(\30\);\s*\}(?<X120365480>)|zi['"],['"]p:/['"],['"]/\w+#\d+['"]\];(?:include|require)\s+implode\('',\1\);(?<X120359230>)|zip['"],\s*['"]://['"],\s*['"]w['"],\s*['"]p\-['"],\s*['"]s['"],\s*['"]e['"],\s*['"]t['"],\s*['"]ti['"],\s*['"]n\.['"],\s*['"]zip['"],\s*['"]#p['"],\s*['"]n['"]\];\s*(?:include|require)\s+implode\("",\s*\1\);(?<X120361171>))|[^\]]{1,499}\];\s*(\$\w+)[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\$]{1,49}(\$\w+)[^/]{1,99}\35[^;]{1,99}\35[^\)]{1,49}\.php['"][^\{]{1,49}\34[^\$]{1,49}foreach\s*\(\1[^;]{1,199}(\$\w+)[^;]{1,99}\.php['"];[^\{]{1,49}is_file\(\36[^;]{1,49}require_once\s+\36;\s*exit;\s*\}\s*break;\s*\}\s*\}\s*\}(?<X120352310>)|\d+,\s*\d+[^\]]{1,149}\];\s+(?:include|require)\s+implode\(array_map\(['"]chr['"],\s*\1\)\);(?<X120362400>)|\s*(?:(?:['"]\w+['"]\s*=>\s*\[['"](?:zip:/|/\w+\.zip#|hex)['"]\],?\s*){3}\];\s*include\s*implode\(['"]['"],\s*array_map\(fn\((\$\w+)\)\s*=>\s*\39\[\d+\],\s*\1\)\);(?<X120369391>)|(?:['"]https?://[^%]{1,49}pages\.dev[^'"]{1,49}['"],?\s*){1,}\];\s*foreach\s*\(\1\s+as\s+(\$\w+)\)\s*\{[^%]{1,199}(\$\w+)[\s=]+@?file_get_contents\(\41\);[^%]{1,199}echo\s*\42;\s*\}\s*\}(?<X120357330>)|(?:\[(?:\d+,?)+\],\s*){3,}\];[^%]{1,99}foreach\s*\(\1\s*as\s*(\$\w+)\)\s*\{\s*\$\w+[\s=]+implode\(['"]['"],\s*array_map\(['"]chr['"],\s*\44[^%]{1,999}(?:popen|exec)\(\$\w+\[chr\(\d+\)\]\s*\.\s*['"]\s*2>&1['"],\s*(?<X220369950>)|['"]http(?:s://[^'"]+\.txt['"][^\$]{1,249}(\$\w+)[^\{]{1,129}foreach\s*\(\1[^;]{1,49}(curl)\w+[^\$]{1,99}\47\w+[^&]{1,699}(\$\w+)[\s=]+\47\w+[^\.]{1,299}\46\s*\.[\s=]+\48;[^;]{1,249}\47\w+[^\?]{1,199}echo\s+\46;(?<X120352400>)|s?://[^'"]+\.txt['"],\s*['"]https?://[^'"]+\.txt['"]\s*\];\s*foreach[\h\(]+\1\s+\w+\s+(\$\w+)[^\(]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);\s*\52\w+\(\51,\s*\52\w+,\s*\50\);[^\{]{1,299}(\$\w+)[\s=]+\52\w+\(\51\);\s*\52\w+\(\51\);\s*if[\h\(]+\53\)\s*\{\s*echo\s+eval\(['"]\?>['"]\s*\.\s*\53\);\s*\}\s*\}(?<X120358440>))))|\w+(?:\((?:['"]https?://[^/]{1,99}/z\d+_\d+[^;]+\.txt['"]\);\s*\w+\(\1,[^\{]{1,999}(\$\w+)\s*=\s*curl_exec\(\1\);\s*\w+\s*\(\55[^\{]{1,99}\{\s*eval\(['"]\?>['"]\s*\.\s*\$\w+\);\s*\}[^;]{1,999}\(\1\)\)?;\s*\}\s*\w+\(\1\);(?<X120350321>)|\$_SERVER\[[^\$]{1,99}(\$\w+)[^\{]{1,299}(function)\s+(\w+)[^@]{1,199}@?file_get_contents[^\?]{1,199}\58\w+\(['"](curl)\w+['"][^;]{1,99}\60\w+[^#]{1,599}(\$\w+)[\s=]+\[[^\{]{1,299}foreach[\h\(]+\61[^@]{1,99}\1[^@]{1,49}@?gethostbyaddr\(\57[^>]{1,599}(\$\w+)[\s=]+\59\(['"]https?://[^'"]+\.pages\.dev[^'"]+['"]\);[^\}]{1,449}echo\s+\62;\s*exit;\s*\}\s*\}(?<X120354370>))|\s+\w+[\(\s]+wp_create_user\(['"\s]Bryann['"\s,]+L0n3lyBry4nn['"\)\s]+;\s*\1[\s\->]+set_role[\('"\s]+administrator['"\s]+\)\s*;(?<X1291510>))|A(?:BSPATH\s*\.\s*['"]wp\-content/uploads/[^;]+['"];\s*(\$\w+)[\s=]+new\s+ZipArchive;\s*if[\h\(]+\65\->(?:open|close)\(\1[^\)]{1,99}\.zip['"]\)[^\(]{1,99}\65\->extractTo\(\1[^\(]{1,99}\65\->(?:open|close)\(\);\s*(?:require|include)\s+\1[^;]{1,99}\.php['"];\s*\}(?<X120354121>)|rray\([^;]{1,499};\s*(\$\w+)[\s=]+isset\((\$_SERVER\[['"]HTTP_USER_AGENT['"]\])[^:]{1,49}\68[^\{]{1,49}foreach[\h\(]+\1[^!]{1,49}\67[^;]{1,99}(\$\w+)[^;]{1,49}\.php['"];\s*if[\h\(]+file_exists\(\69\)\)\s*\{\s*require\s+\69;[^\(]{1,49}error_log\([^;]{1,99}\69\);\s*\}\s*exit;\s*\}\s*\}(?<X120359860>))|base64_decode\((?:['"](?:\w+==['"]\);\s*(if[\h\(]+isset)\(\$_GET\[\1\]\)\)\s*\{\s*\71\((\$_FILES)\[['"]\w['"]\][^@]{1,49}@?move_uploaded_file\(\72[^;]{1,99}echo\s*['"]\w+['"];[^<]{1,99}exit;\s*\}\s*echo\s*['"]<form\s+method=['"]POST['"]\s+enctype=[^;]{1,199}</form>['"];\s*exit;\s*\}(?<X120357290>)|aHR0(?:[^'"]+['"]\);\s*(\$\w+)[\s=]+@?file_get_contents\(\1\);\s*if[\h\(]\(trim\(\74\)[^\{]{1,49}['"]\d+['"]\)\s+\{\s*(?:die|exit)\(\);\s*\}(?<X120366613>)|cHM6Ly93d3cua29yZWNjb3Jzby5jei9[^'"]{1,199}['"]\)[^%]{1,599}foreach\s*\(\s*\$_COOKIE[^%]{1,399}preg_match\([^%]{1,599}header\(\s*['"]Location:\s*['"]\s*\.\s*\1\s*,\s*true\s*,\s*302\)[^%]{1,99}exit\s*\(\);\s*\}(?<X120362440>)))|\w{16,}\(\$_COOKIE\[['"]\w{16,}['"]\]\)\);\s*\w+\s*\(\1\)\s*\{\s*@?eval\(\1\);\s*(?:exit|die);\s*\}\s*\}\s*\}\s*(?:\?>|\Z)(?<X220335680>))|curl_init\(\);\s*\$\w+[\s=]+['"]https?://brankascapzcu\.pages\.dev[^'"]{1,99}['"];[^%]{1,199}curl_exec\(\1\);\s*echo\s*\$\w+;(?<X120361351>)|f(?:ile_get_contents\((?:['"](?:\./\w+['"]\);\s+\1[\s=]+base64_decode\(\1\);\s+eval\(['"]\?>['"]\s+\.\s+\1\);(?<X120349611>)|https?:(?://raw\.githubusercontent\.com/(?:Petasanimlek2025|Angpao\-Imlek\-Termanis)/[^'"]+['"]\);\s*echo\s+\1;(?<X120365950>)|[^\.]{1,99}\.com[^'"]+\.txt['"]\);[^\$]{1,99}echo\s+\1;(?<X120358170>)))|\w+\s*\.\s*['"]/wp\-includes/[\w\-]+\.php['"]\);\s*eval\(['"]\?>['"]\s*\.\s*\1\);(?<X120364022>))|unction\s*\(\)\s*\{[^\.]{1,99}defined\(['"]ABSPATH['"]\)[^\{]{1,99}(\$\w+)[^\.]{1,99}\.php['"][^\{]{1,99}foreach[\h\(]+\83[^@]{1,199}basename[^@]{1,99}(file_exists)\(\$\w+[^&]{1,99}\84[^\{]{1,99}md5_file[^@]{1,49}\84\((\$\w+)[^@]{1,49}@?copy\([^\(]{1,99}add_action\([^;]{1,99}\1[^@]{1,199}add_filter[^\[]{1,99}\85[^\?]{1,99}\1\(\);(?<X120357660>))|getallheaders\(\);\s*\w+\(\w+\([^&]{1,99}&&\s*\w+\(['"](\w+\\[^\.]{1,99}\.ico)['"]\)\s*&&\s*\w+\(\1\[[^\)]{1,99}\)[\s>0]+\)\s*(?:include|require)(?:_once)?\s*['"]\87['"];(?<X120335100>))
(\$\w+)(?:[\s=]+(?:is(?:_bot\(\)[^;]+['"]https?:[^;]{1,49}\.txt['"];[^;]{1,99}(\$\w+)[\s=]+@?file_get_contents\(\1\);[^!]{1,49}\2\h*!==[^&]+&&[\s=]+(?:trim)?\(\2\)[^;]{1,49}eval\(['"]\?>['"][\s=]+\.\s*\2\);\s*\}[^\}]{1,49}exit\(['"]\d+\s+\w+\s+\w+['"]\);\s*\}(?<X120348152>)|set\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\](?:[^\{]{1,49}(\$\w+)[^\{]{1,99}\4[^:]{1,99}\1[^:]{1,99}(\$\w+)=['"]https?://[^'"]+\.html['"];[^\{]{1,49}function_exists\(['"]curl_init['"][^@]{1,399}(\$\w+)=file_get_contents\(\5[^/]{1,49}echo\6;exit\(\);\}\}\}(?<X120360855>)|\)\s*\?\s*strtolower\(\$_SERVER\[[^\(]{1,49}(\$\w+)[\s=]+array[^\{]{1,499}(\$\w+)[\s=]+(?:false|true);\s*foreach[\h\(]+\8[^!]{1,49}\1[^\.]{1,99}if[\h\(]+\9\)\s*\{\s*(?:include|require)\(dirname\(__FILE__\)\s*\.\s*['"]/\w+\.php['"]\);\s*exit;\s*\}(?<X120367540>)))|strto(?:k\(\$_SERVER\[['"]\w+['"]\],[^\(]{1,99}if[\h\(]+preg_match\([^\{]{1,99}\1\)\)\s*\{\s*(\$\w+)[\s=]+__DIR__\s*\.\s*['"][^'"]+\.php['"];\s*if[\h\(]+file_exists\(\11\)\)\s*\{\s*require\s+\11;\s*exit;\s*\}\s*\}(?<X120358970>)|lower\((?:(\$_SERVER)\[['"](?:\w+['"]\][^\$]{1,49}if[\h\(]+\13\[['"][^\?]{1,99}\$_COOKIE\[\d+\][^\(]{1,49}preg_match\(['"][^\{]{1,49}\1\)[^@]{1,29}echo\s+@?file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*exit;\s*\}(?<X120364930>)|HTTP_USER_AGENT['"]\][^=]{1,49}(\$\w+)[^\(]{1,29}\(\13[^\$]{1,49}(\$\w+)[^&]{1,49}\16[^\-]{1,49}preg_match[^\)]{1,99}\1\)[^\{]{1,49}\15[^\(]{1,99}echo\s+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*(?:exit|die)\(\);\s*\}(?<X120352150>))|\$_SERVER\[[^\$]{1,99}(\$\w+)[\s=]+['"]Z29vZ2x[^'"]+['"];\s*(\$\w+)[\s=]+['"]aHR0[^'"]+['"];[^\.]{1,99}preg_match[^\{]{1,99}(base64_decode)\(\18[^\{]{1,49}\1\)\)\s*\{[^\{]{1,199}\.php['"][^\(]{1,149}\20\(\19[^\[]{1,99}curl\w+[^\{]{1,299}(\$\w+)[\s=]+\(\20[^\}]{1,199}\20[^\}]{1,99}echo\s+\21;\s*exit;\s*\}\s*\}\s*\}(?<X120354080>))|time\(['"]\-\d+\s*years\s*\-\d+\s*months\s*\-\d+\s*days['"]\)[^\}]+(\$\w+)[\s=]+\1\s*\+\s*rand\(\-3600,\s*3600\);[^\{]+\1\)\s*\{\s*@touch\(\$\w+\->\w+\(\),\s*\23\);\s*\s*\}\s*\}\s*@touch\(\$\w+,\s*\1\);(?<X220364220>)))|[^!]{1,199};add_action\(['"]init['"],(function)\(\)\s+use\(\1[^!]{1,49}!username_exists\(\1[^>]{1,99}\->set_role\(['"]administrator['"]\);update_user_meta\((\$\w+),['"]wp_hidden_user['"][^\}]{1,199}\26[^@]{1,149}\25[^@]{1,299}get_user_by\(['"]login['"],\1[^\?]{1,299}add_filter\(['"][^\?]{1,49}\25\(\$\w+\)[^\?]{1,99}return[^\}]{1,49}\}\);(?:\})?(?<X120362193>)|[^\(]{1,29}bin2hex\(random_bytes\(\d+\)\)\.['"]\.php['"];file_put_contents\(\1,base64_decode\(['"]PD9waHA[^'"]+['"]\)\);if\(file_exists\(\1\)\)\{echo\s*['"]['"];(?:include|require)\1;(?<X120367041>)|\.=(?:(?:\(+(\$\w+\s*&\s*0x)\d{4}\)\?(?:(\(+\29\d{4}\)\?)['"]\w['"][\s:]+['"]\w['"]\)[\s:]+\30)?['"]\w['"][\s:]+['"]\-['"]\)+;\1\.=){8}[^\}]{1,499};return\s*\1;\}\s*echo\b[^;]{1,299}\bBlackhat</(?<X2221100>)|['"]\w{4}['"];[^@]{1,499}\1\.=['"]\w{4}['"];[^\?]{99,999}\1\.=["]\w{4}['"];[^\?]{1,499}(\$\w+)=['"]base['"];(\$\w+)=["]64_decode['"][^\(]{1,18}(\$\w+)=\32\.\33;(\$\w+)=\34[^\?]{1,29}eval\(\35\);(?<X120349132>))|\=array_merge\(\s*\$_[GPRSC]\w{2,6}\s*,\s*\$_[GPRSC]\w{2,6}\);\s*foreach\s*\(\1\s*\w+\s*\$\w+\s*=>\s+(\$\w+)\)\s*\{\s*\37[^\(]+\(\w+\(\w*\(base64_decode\(\37\)[^\}]{1,999}\}\s*elseif\s*\(\37[^\{]{1,999}\{\s*eval\(\37[^\;]+;\s*\}\s*(?:exit|die)[^\}]+\}\s*\}(?<X1248610>)|\[\d+\]\s*=\s*\w+\s*\(\s*array\([\d,\s\)]{4,128};\s*\$\w+\s*=\s*\d+;\s*(\$\w+)\s*=\s*\$_COOKIE;\s*\$\w*\s*=\s*['"]\d+['"];\s*\39\s*=\s*\1\[\d+\]\(\39,\s*\$_POST\)(?<X2297870>))
(\$\w+)(?:\s*=(?:\h*file_get_contents\(['"]https?://imasync\.com/sync['"]\);\s*eval\(['"]\?>['"]\s*\.\h*\1\);\s*unlink\(__FILE__\);(?<X120345580>)|\s*(?:(\$_GET)\[['"]usr['"]\];\s*(\$\w+)\s*=\s*\3\[['"]\w+['"]\];\s*(\$\w+)\s*=\s*\3\[['"]\w+['"]\];[^\$]{1,99}!username_exists\(\1\)[^=]{1,99}=\s*wp_create_user\(\1,\s*\4,\s*\5\);\s*(\$\w+)\s*=\s*\w+\s*wp_user\(\6\w+\);\s*\6\->set_role\(['"]administrator['"]\);\s*print_r\(\6\);\s*\}(?<X120344941>)|@?file_get_contents(?:\((?:(base64_decode)\(['"]aHR0cHM6Ly9oZWRvbmVpem1pcjQuc2l0ZS9wZy5waHA/cSZ0PXQx['"]\)\);\s*@?eval\(\8\(\1\)\);(?<X120347220>)|['"]https?://garuda\-force\.b\-cdn\.net[^'"]{1,99}\.php['"]\);\s*if\(\1\)\s*eval\(['"]\?>['"]\.\1\);(?<X120344640>))|\s*\([^;]{1,256};\s*(\$\w+)\s*=\s*base64_decode[\s\(]+str_rot13[\s\(]+\1[\s\)]+;\s*(\$\w+)\s*=\s*new\s+\w+\b[^;]*;\s*@?eval\s*\(\s*\12\s*\->\s*\w+[\s\(]+\11\s*\)\s*\);(?<X120336131>))|['"]/\w+/[^;]{8,128}\.\w+\.(?:\\x63|c)ss['"];\s*if\s*\(empty[^;]{1,128};\s*\}(?:\s*\w+)?\s*\{\s*@?include(?:_once)?[^\}]{1,99}\(\1\);\s*\}(?<X1269252>)|['"][^"']{999,}['"];(\\n)?\s*if\s*\(!function_exists\(['"](\w+)[^\^]{1,799}strlen\(\$\w+\);[^_]{1,299}file_put_contents\((\$\w+)\s*=\s*tempnam\(sys_get_temp_dir[^\$]{1,99}\16\(\1,\s*['"]\w+['"]\)\);\15?(?:include|require)(?:_once)?\17;\15unlink\(\17\);(?<X1203264610>)|['"][^;]{32,};\s*(\$\w+)\s*=\s*['"][^;]{32,};\s*(\$\w+)\s*=\s*\w+\(str_rot13\(base64_decode\(\1\)\),\s*\19\);\s*\w+\s*add_footer_links\([^\}]+fetch_remote_data\(\20(?<X220336115>)|['"][ht'"\.ps://]{4,16};\s*eval\(['"]\?>['"]\s*.\s*file_get_contents\s*\(\1\s*\.\s*['"][^;]+\.txt\s*['"]\)\);(?<X120340900>)|['"]\w+['"];\s*(\$\w+)\s*=\s*['"]\w+@?\w+['"];\s*(\$\w+)\s*=\s*['"]\w+@example\.com['"];[^\$]{1,99}!username_exists\(\s*\1\s*\)[^;]{1,99}wp_create_user\(\s*\1,\s*\23,\s*\24\s*\);\s*(\$\w+)\s*=\s*\w+\s*wp_user[^\-]{1,49}\25\->set_role\(\s*['"]administrator['"]\s*\);\s*\}(?<X120344761>)|['"]aHR0cHM6Ly9qYXZhc2NyaXB0YmFzaWNzLmNvbS9\w+['"];\s*wp_register_script\((['"]\w+['"]),\s*base64_decode\(\1\),\s*array\(\),\s*null,\s*(?:true|false)\);\s*wp_enqueue_script\(\27\);(?<X220336761>)|['"]https?://raw\.githubusercontent\.com[^'"]{1,99}\.php['"];\s(\$\w+)\s*=\s*file_get_contents\(\1\);\s*(\$\w+)\s*=\s*base64_encode\(\29\);\s*\w+\(file_put_contents\(['"]\w+\.php['"]\s*,base64_decode\(\30\)\)\)\{echo\s*['"]File\s*:\s*\w+\.php[^\{]{1,99}\{echo\s*\w+;\}(?<X120344660>)|\[['"]comp(?:['"],\s*['"]ress\.zl['"],['"]ib:/['"],['"]/wp\-logln\.g['"],['"]z['"]\];\s*include\s+implode\("",\s*\1\);(?<X120346400>)|r['"].['"]ess\.zlib:/['"],['"]/(?:index|wp\-blog)\.g['"],['"]z['"]\];\s*include\s+implode\('',\1\);(?<X120346012>))|\w+\(\$_COOKIE\[(\w+)\(['"]\w{32,}['"][^;]{1,99};\s*file_put_contents\([^\.]{1,99}\.\s*\34\(['"]\w{32,}['"][^;]+\1\);[^\\]{1,999}\$_POST\[\34\(["]\w+[^\}]+\}\s*wp_die\(\s*0\s*\);[^\\]+add_action(?<X220335690>)|\w+\s*Secure\(['"][^;]{1,50}['"]\);\s*(\$\w+)\s*=\s*['"][^;]{999,}['"];\s*\$\w+\s*=\s*\1\->decrypt\(\36\);\s*(?:(\$\w+)\s*=\s*\w+\((\$\w+)\)\{\s*/\W\w+\W\/eval\(\38\);\s*(\$\w+)\s*=\s*["'][^;]{1,150}["'];\s*\w+\s*\39;\s*\};\s*\37\(\$\w+\);(?<X220340971>)|\$\w+\s*=\s*\w+\((\$\w+)\)\{\s*/\W\w+\W\/eval\(\41\);\s*(\$\w+)\s*=\s*["'][^;]{1,150}["'];\s*\w+\s*\42;\s*\};(?<X220342340>))|file_get_contents\(['"]https?://(?:\w+\.(?:rpka\.org|pejuangbola88\.com)/\w+\.php[^\$]+echo\s*\1(?<X1252211>)|khusus-discovery\.it\.com/[^'"]{1,99}['"]\);\s*echo\s*\1;(?<X120348761>))|function\((\$\w+)\)\{include\46;\};\s*(\$\w+)=\w+\(\)=>['"]\w+['"];(\$\w+)=\s*\[['"]zip://['"]\.\47\(\)\.['"]\.zip#['"]\.\47\(\)\];\1\(\48\[\d+\]\);(?<X120360941>)|getallheaders\(\);\s*(?:(\$\w+)[\s=]+\w+;\s*\w+\s*\(\1[^!]{1,99}stripos\(\$\w+,\s*['"]authorization\-bearer['"]\)[^\{]{1,99}\{\s*\50\s*=\s*\$\w+;\s*\w+;\s*\}\s*if\s*\(\50\)\s*\{\s*\$\w+\s*=\s*\50;\s*(\$\w+)[\s=]+proc_open[^\(]{0,32}\(\$\w+[^\;]+(\$pipes)\);[^{]+\{\s*header\(['"][^;]+;\s*echo\s*\w+\(\52[^\}]+proc_close\(\51\);\s*\}\s*exit;\s*\}(?<X120340470>)|\w+\(\w+\(['"]([\w\-]+)['"],\s*\1\)\s*&{2}\s*\w+\((['"]\\[^\.]{1,99}\.\\[^'"]{1,32}['"])\)\s*&{2}\s*substr_count\(\1\[['"]\54['"]\],\s*['"]\d+['"]\)[^;]{1,99}(?:include|required)(?:_once)?\s*\55;(?<X120338961>))|getContent\(['"]https?://z51004_o\.tlalcalli\.shop[^;]{1,29}['"]\);\s*eval\(['"]\?>['"]\s*\.\s*\1\);(?<X120343410>)|range\(['"\176,\s*]+\);\$\w+=\$\{(?:\1\[[\d+\s*]+\]\.\s*){1,}[^&]{1,99}&&md5\([^'"]+['"]\w+['"]\)\)\{[^'"]{1,499}metaphone\(['"\w+/]+\);[^;]{1,199}['"]range['"];[^\?]{1,499}curl_exec\(\$\w+\);return[^\{]+\{\$\w+=array\(['"][^\)]+\);foreach\(\$\w+[^\)]{1,299}\)[^&]+&&die\(\$\w+\[[\d+\s*]+\][^\}]{1,399}die;\}\}\}:\w+\(\);(?<X120369470>)|scandir\(\$_SERVER\['DOCUMENT_ROOT'\]\);\s*for\s*\((\$\w+)=0;\59<count\(\1\);\59\+\+\)\s*{\s*if\(stristr\(\1\[\59\],\s*'php'\)\)\s*{\s*(\$\w+)\s*=\s*filemtime\(\$_SERVER\['DOCUMENT_ROOT'\]\."/"\.\1\[\59\]\);\s*break;\s*}\s*}\s*touch\(dirname\(__FILE__\),\s*\60\);\s*touch\(\$_SERVER\['SCRIPT_FILENAME'\],\s*\60\);\s*chmod\(\$_SERVER\['SCRIPT_FILENAME'\],\s*0444\);(?<X1035051>)|urlencode\(\$_SERVER[^\{]+\{\s*\$\w+\s*\=\s*array\([^\)]+(?:Googlebot|TelegramBot)[^;)]+\);[^\^]+://[^\\}]+\.txt[^\{]+\{\1[^\;]{1,512};\s*[^;]{1,64};\s*echo\s*\$\w+;\s*(?:die|exit);\s*\}(?<X1279222>)))|\s+(?:=\s+(?:['"]http(?:s://garuda\-force\.b\-cdn\.net/\w+[^'"]{1,499}\w+\.php['"];\s+\$\w+\s+=\s+file_get_contents\(\1\);\s+eval\(['"]\?>['"]\s+\.\s+\$\w+\);(?<X120339110>)|s?://swasta\.b\-cdn\.net[^\.]{1,399}\.php['"];\s+(\$\w+)\s=\s+file_get_contents\(\1\);\s+eval\(['"]\?>['"]\s+\.\s+\64\);(?<X120339920>))|file_get_contents\(['"]https?://[^'"]{1,499}\w+\.js['"]\);\s+(\$\w+)\s+=\s+base64_encode\(\1\)[^<]{1,49}(<<<PHP)\s+function\s+(\w+)\(\)\s+\{\s+\\\2\s+=\s+['"]\66['"];\s+echo\s+['"]<script>[^\\]{1,99}atob\(\\['"\.\\\.\s]+\66[^<]{1,249}</script>[^<]{1,49}\67\s+(add_action)\(['"]wp_head['"],\s+['"]\68['"]\);\s+\69\(['"]admin_head['"],\s+['"]\68['"]\);\s+\69\(['"]login_head['"],\s+['"]\68(?<X220339280>))|\=\s+['"]zip://wp\-includes/(\w+)\.zip#\71['"];\s*(?:include|require)(?:_once)?\(\1\);(?<X120332523>))|\s=\s*['"]https?://\d+\.\d+\.\d+\.\d+[^'"]{1,49}\.txt['"];\s*(\$\w+)\s*=[^;]{1,49}['"]\.php['"];[^;]{1,99}(\$\w+)\s*=\s*(curl)\w+\(\);\s*\75\w+\(\74[^\}]{1,119}\75\w+\(\74\);[^@]{1,99}@?unlink\(\73\);\s*create\(\1,\s*\73\);\s*\}\s*include\(\73\);(?<X120346742>))
(\$\w{1,10})\h*=\h*file_get_contents\(['"]https?://usaklubgacor\.com[^'"]+['"]\);[^;]+json_decode\(\1\);[^\}]{1,100}\}(?<X1265851>)
(\$\w{1,12})(?:=\$\w{1,12}\((?:['"]{2}|null),(?:\$\w{1,12}[\(\.]){9,}\$\w{1,12}\){3,};@?\1\(\);(?<X1182430>)|\h*=\h*base64_decode\h*\(\h*['"][a-z=]{3,9}['"]\h*\)\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*(?:\.\h*(?:['"][^'"]*['"]|base64_decode\h*\(\h*['"][a-z=]{3,9}['"]\h*\))\h*)?;\h*@?\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1157870>))
(\$\w{1,14})(?:=(?:['"]/home[^'"]{1,200}['"];\$\w{1,14}=filemtime\(\1\);\$\w{1,14}=file_get_contents\(\1\);\$\w{1,14}=rawurldecode\([^\{]{1,100}\{(\$\w{1,14})=['"][^@]{1,300}file_put_contents\(\$\w{1,14},\2[^@]{1,500}die\(['"][^'"]{1,20}['"]\);(?<X1292810>)|\$_SERVER\[['"](?:HTTP_X_FORWARDED_FOR|HTTP_CF_CONNECTING_IP)['"]\];(\$\w{1,14})=explode\(['"\s,]+\1\);(\$\w{1,14})=\4\[\d\];(\$\w{1,14})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\.gethostbyaddr\(\5\);\$\w{1,14}=preg_match\([^\)]{1,70}yandex[^\)]{1,70}\)/i['",]+\6(?<X2280491>)|urldecode\(['"]https?://volovmart\.ru[^\$]{1,30}\$_GET[^\)]{1,60}file_get_contents\(\1\)\)!=false\)(?<X2280521>))|[\s=]+(?:array[^,]{1,20},['"]server_name['"][\s=>]+\$_SERVER\['HTTP_HOST[^@]{1,750}curl_init\(['"](https?://wyzdy\.com[^'"]{1,100})['"][^@]{1,400}CURLOPT_POSTFIELDS[\s,]+\1\);\s?(\$\w{1,14})[^@]{1,400}\10[\s=]+file_get_contents\(['"]\9[^@]{1,100}eval\(\10\);(?<X1314260>)|curl_init\(['"]https?://riwayat\.lu[^\)]{1,50}\);[^@]{1,150}(\$\w{1,14})[\s=]+curl_exec\(\1\);[^@]{1,50}echo\s*\12;(?<X1322091>)|file_get_contents\(['"]https?://riwayat\.lu[^'"]{1,100}['"]\);\s*echo\s*\1;(?<X1320850>))|\h*=\h*['"]https?://(?:ampwak\.vip[^\$]{1,100}(\$\w{1,14})\h*=\h*['"]https?://bio\.site[^\{]{1,250}\{\s*\$\w{1,14}\h*=\h*file_get_contents\(\1[^&]{1,200}&&[^\}]{1,200}Location:[\h'"\.]+\15\);\s*exit\(\);\s*\}(?<X1288730>)|ip\-api.com/json/\{\$\w{1,14}\}['"];\s*(\$\w{1,14})\h*=\h*file_get_contents\(\1\);\s*(\$\w{1,14})\h*=\h*json_decode\(\17[^\$]{1,25}\18['"\[]+countryCode[^/]{1,100}//ampwak\.vip[^\}]{1,150}\}(?<X1288721>))|\s*=\s*\$_SERVER\[['"]HTTP_(?:USER_AGENT|REFERER)['"]\];\s*if\((?:strpos\(strtolower\(\1\)\s*,\s*strtolower\(['"][w\.]*?(?:google|bing)[^'"]{1,10}['"]\)\)\s*!==\s*false[\|\s\)]+){1,5}\s*\{\s*[^\}]{1,200}(?:\$\w{1,14})\s*=\s*['"]https?://[\w\d./]+['"];[^\}]{1,300}echo\s*['"]?[^;]+['"]?;\s*\}(?<X2274020>))
(\$\w{1,15})(?:=\(gzinflate\(str_rot13\(base64_decode\(['"][^'"]{99,999}['"]\)+;\s*(\$\w{1,15})=fopen\([^\}]{9,90}\}else\{\s*fwrite\(\2,\1\);\s*fclose\(\2\);\s*\}(?<X1147730>)|[\h=]+(?:'[^']{999,5000}';\s*(\$\w{1,15})[\h=]+base64_decode\([^\)]+\);\s*eval\(\4\(\1\)\);(?<X1198540>)|(curl_)init\(\);\s*\6setopt\(\1,\h*CURLOPT_URL,\h*['"]https:?//archive\-h\.org/[^'"]{1,50}\.php['"]\);\s*\6exec\(\1\);(?<X1198260>)|['"\.indexph]{9,20};\s*(\$\w{1,25})[\h=]+['"\-\./wpincludes]{9,20}[^;]+;\s*if[\h\(]+(file_)exists[\h\(]+\8[\h\)]+[^\{]+\{\s*(\$\w{1,25})[\h=]+\9get(_contents)[\h\(]+\8[\h\)]+;\s*\$\w{1,25}[\h=]+\9get\11[\h\(]+\1[\h\)]+;[^#]{99,999}\b\9put\11[\h\(]\1,\h*gzinflate[\h\(]+\10[^;]+;\s*\}(?<X1218030>)|\(\$_SERVER\[[^\]]+\][\h=]+['"]wp_is_mobile['"]\);\s*(\$\w{1,15})[\h=]+\$_COOKIE;\s*\(count\(\13\)[\h=]+\d+\W{1,4}\1\)\h*\?[^;]{1,150}\)\)\h*:\h*\13;(?<X1200990>)|str_replace[\h\(]+(base64_decode)[\h\(]+[^\)]+\)\h*,[^,]+,\h*urldecode[\h\(]+\15[\h\(]+['"][^'"]{999,7000}['"][\h\)]+;\s*(\$\w{1,15})[\h=]+dirname[\h\(]+__FILE__[\h\)]+;\s*(?:file_put_contents[\h\(]+\16[\h\.]+\15[\h\(]+[^\)]+\)\h*,\h*\1[\\h\.]+[^\)]+\);\s*){1,2}(?<X1215110>))|\h*=(?:\h*(?:(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\(['"]{2},\h*\18[^\]]+\]\(\18[^\]]+\]\([^\)]+[\)]+;\s*\1\(\);(?<X1193940>)|(base64_)decode\(['"][^'"]{0,99}['"]\)\.\20encode\((\$\w{1,15})\)\.['"]&[^;]{0,150};\s*(\$\w{1,15})\h*=\h*@?file_get_contents\(\1\);\s*if\(empty\(\22\)\)\{\s*function\h+(\w{1,15})\([^\{]{0,25}\{\s*\$\w{1,15}\h*=\h*curl_[^\}]{0,299}\}\s*\23\(\1\);\}[^#]{0,650}\breturn\h*\21\[\$type\];\}(?<X1184280>)|(base64_decode)\(['"][^;]+;\s*(\$\w{1,15})\h*=\h*\25[^\?]{9,399}@?(chmod)\(\1,\d{3,4}\);[^;]{1,99};\s*@?\27\(\1,\d{3,4}\);[\}\s]+[^\?]{1,599}@?\27\(\26,\d{3,4}\);[\s\}]+(?<X1186681>)|['"][\.'"str_o13]{5,20}['"];[^\(]{0,49}(\$\w{1,15})\h*=\h*\$\{\1\h*\(['"\._PBXVR]+\)\h*\};\s*\(\h*count\h*\(\h*\29\h*\)[^:]{1,150}:\29;\s*(\$\w{1,15})\h*=\h*\1\h*\(['"\.cevag_]{7,19}\)\h*;\s*@?\30\h*\([^\)]+\)\h*;(?<X1166601>)|['"][^']{1,50}'(\^')[^\$]{1,50};\s*(\$\w{1,15})\h*=\h*\1\(['"]{2},['"][^']{9,299}'\32[^\)]{9,299}['"]\);\s*\33\(\);(?<X1176221>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\(\h]+\1\D{2,3}['"][^'"]+['"][\)\s]+\{(\$\w{1,15})\h*=\h*(\$_FILES\[)['"][^;]{1,50};\s*(\$\w{1,15})\h*=\h*\36[^;]{1,50};\s*echo\h*['"]<form[^;]{0,150};\s*@?(?:copy|move_uploaded_file)\(\35,\h*\37\);(?<X1194080>)|\barray\(\$\{['"]_[GPRSC]\w{2,6}[^\]]+\],\h*['"]create_function['"],['"](?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)[^\$]+\$\{['"]_COOKIE['"]\},['"]https?://['"]\.\$\{['"]_SERVER['"]\}\[[^;]+;\s*\$\w{1,9}\h*=\h*\1\[\d+\]\(['"]aHR0cDovLz(?<X2188831>)|array\((?:['"][^'"]{1,9}['"]\h*,\h*){3}[^\)]{99,999}\);[^\.]{1,99}\$\w{1,40}\h*=\h*\1\[\d+\]\h*\.[^\?!]{99,1999}\beval\([^;\}]{2,30}\);\s*(?:\}\s*){0,2}if\(!\$\w{1,15}\)\{(?:\s*(\$\w{1,15})\h*=\h*\1\[\d{1,3}\]\h*\.[^;]+;){3,}\s*\$\w{1,40}\h*\(\$\w{1,40}\);\s*echo\(\40\);\s*\}(?<X1162353>)|file_get_contents\h*\(\h*str_rot13\h*\([^;]{9,49}/blog/\w{1,15}['"]\h*\);\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*['"]\?>['"]\h*\.\h*\1\h*\);(?<X1191941>)|fopen\([^\)]+\);\h*(\$\w{1,15})\h*=\h*@?file_get_contents\(['"]https?://pastebin\.com/[^'"]{9,50}['"]\);\h*fwrite\(\1,\h*\43\);\h*fclose\(\1\);(?<X1138681>)|range\(\d+,\h*\d+\);\s*(\$\w{1,15})\h*=\h*\$\{(?:(chr)\(\1\[\d+\]\)\.){6}[^;]{0,99};\s*(\$\w{1,15})\h*=\h*\45\[\46\(\1\[\d+[\]\)]+;\s*if\(md5\(\47\.\47\)[^\{]{1,99}\{\s*\$\w{1,15}\([^\)]{1,50}\)\h*\.\h*['"]\(\45\[\47\]\)['"][^\}]{1,99}\};(?<X1193970>)|str_replace\([^\)]+\);[^\{\?]{0,250}(\$\w{1,15})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\49\(\1\([^\)]+\)\);\s*(\$\w{1,15})\h*=\h*@?\50\(['"]{2},\h*\51\);\h*@?\52\(\);(?<X1195202>))|\s*function\h*(get_page)\h*\(\$\w{1,15}\)\s*\{[^\}]{9,850}\}\s*\}\s*if\h*\(\$\w{1,15}\h*=\h*\54\h*\(['"]https?://myopencart\.net/[^\}]{9,500}\1\h*=\h*str_replace\h*\(\$\w{1,9},\h*\$\w{1,9},\h*\1\);\s*(?:ini_set|error_reporting)\h*\([^\}]{9,150}\}\s*else\s*\{\s*echo\h*\1;\s*\}(?<X1155790>)))
(\$\w{1,16})(?:\h*=\h*@?preg_replace\h*\(\h*['"]/\[[a-z]{1,9}\]/['"]\h*,\h*['"]['"]\h*,\h*['"]\w{13,}['"]\h*\)\h*;[^\)\(\}\{]{1,499}\$\w{1,9}\h*=\h*(\w{1,40})\h*\(\h*\1\h*\(\h*['"][a-z\+/\d]{4,40}=?=?['"][\h\)]+;[^\+\{\}/,\*]{99,999}\$\w{1,9}\h*=\h*\2\(\1\(['"][^'"]{9999,}['"]\)\);(?<X2176241>)|\s*=\s*(\$\w{1,16})\s*\[[\s\(]*\d+\s*[\-\+\*/]\s*[\d\(][^;]+\4\s*\[[\s\(]*\d+\s*[\-\+\*/]\s*[\d\(][^;]+;[^\{\}]{0,199}\bif[\s\(]+\$\w{1,16}\s*[=!<>]+\s*md5[\s\(]+\1[\s\)]+\{\s*\1\s*=[^\}]+\}\s*return\s*\1[\s\(]+\$\w{1,16}[\s\)]+;(?<X1248823>))
(\$\w{1,16}\[['"](\w{1,33})['"]\])\h*=\h*['"][a-f\d]{32}['"];\s*if\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\h*\[['"]\2['"]\])\h*\)\h*\S{2,3}\h*md5\h*\(\h*\3\h*\)\h*\S{2,3}\h*\1[\s\)]+\{[^;]+\b[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\*\-\?]{1,499}=\h*new\h+Mailer\h*\((?<X2169060>)
(\$\w{1,19})[\s=]+['"][^'"]{9999,}['"];\s*(\$\w{1,15})[\h=]+\$_SERVER\[[^\]]+\]\h*\.\h*['"][^;]{9,99}\.php['"];\s*if\(file_exists\(\2\)\)\s*@?unlink\(\2\);\s*(\$\w{1,15})[\h=]+base64_decode\(\1\);\s*(\$\w{1,15})[\h=]+fopen\(\2[^\)]+\);\s*fwrite\(\4,\h*\3\);\s*fclose\(\4\);(?<X1198110>)
(\$\w{1,20})(?:(=array\()['"]\\['"][pf][^,]+,['"]zilla['"]\);[^\{]{0,250}\bforeach\(\1\h*as\h*\$\w{1,20}\)\s*\{\s*if\([^\{]{1,40}\)[\s\{]+\$\w{1,20}\2[^;]{1,60};(\$\w{1,20})=["'](?:aHR0cH|http)[^;]+;[^\}]{1,60}(\$\w{1,20})=(curl_)init\((?:\3|\$\w{1,20})\);[^\}\?]{99,400}\b\5exec\(\4\);[^\}]{1,30}[\}\s]+(?<X1193770>)|=(?:(base64_decode)\(\$\w{1,20}\);\s*(\$\w{1,20})=\7\([^\)]+\);\s*(\$\w{1,20})=\1\.\8;\s*(\$\w{1,20})=str_rot13\(base64_encode\(\9\)\);[^@\{\}]{0,99}\bmkdir\(([^\)]+images/)['"]\);\s*chmod\(\11[^\.]{1,20}\.(?:jpe?g|png|ico)\b[^\}\{]{9,99}\bfwrite\(\$\w{1,20},md5\(\10(?<X2190512>)|(curl_)init\(\);[^\(]{0,40}\13setopt\(\1,curlopt_url,base64_decode\(['"]aHR0[^;]{9,99}\);\s*\13setopt\(\1[^@\}\{#]{9,99}(\$\w{1,20})=\13exec\(\1\);\s*\13close\(\1\);\s*eval\(\14\);(?<X1205890>)|@?(base64_decode)\([^\)]+\);\s*if[\h\(]+@?function_exists\h*\(\1\)\)\s*\{\s*(\$\w{1,20})[\h=]+@?\1\h*\(["']{2}[\h,]+@?\16\h*\(["'][^'"]{9,1500}['"]\)\);\s*@?\17\(\);\s*\}(?<X1191720>)|["'](?:base64_decode['"];\s*(\$\w{1,20})=["']strrev['"];\s*(\$\w{1,20})=["']file_put_contents['"];[^\(]{0,30}\bif\(!?file_exists\(([^\)]+)\)[^>#@\*]{99,500}\$\w{1,20}=\19\(\1\([^\)]+\)[^\{\}]{99,400}\{\s*\$\w{1,20}=\20\([^\)]+\);\s*\}\s*\$\w{1,20}=\20\(\21,\$\w{1,20}\);\s*\}(?<X1187280>)|https?://[^/'"]{0,19}\brootinjector\.\w{2,6}/[^'";]{1,60}\.(?:txt|php)['"];\s*if\(isset\([^\)]+\)\)\s*\{[^\}]{1,40}\}\s*if\([^\{]{9,99}\)\s*\{\s*(\$\w{1,20})=file_get_contents\(\1\);\s*echo\h*\23;\s*\}(?<X1192481>))|['"](?:[^'"]{1,40}\.php['"];\s*(\$\w{1,20})=['"]wp\-[^'"]{9,99}\.ttc['"];\s*if\([^\{]{1,40}\{chmod\(\1,\d+\);\s*(\$\w{1,20})=(file_get_contents)\(\25\);\s*(\$\w{1,20})=\27\(\1\);\s*(\$\w{1,20})=substr\(\28,strr?pos\(\28,['"]<\?php\s*['"]\)\);\s*file_put_contents\(\1,gzinflate\(\26\)\.\29,LOCK_EX\);\s*\}(?<X1221710>)|[^'"]{9,50}['"];(\$\w{1,20})=['"]{2};(foreach)\([^\)]+\)\s*\{\s*\31\.?=(\1\[[^\]]+\])[^\}]+\}\s*if\(isset\([^\}\n]{30,250}\}\s*\32\([^\)]+\)\s*\{\s*(\$\w{1,20})\.?=\33;\s*\}\s*(\$\w{1,20})=\34\([^\)]+\);(\$\w{1,20})=\35\(['"]{2},\$\w{1,20}\(\$\w{1,20}\)\);\36\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1142630>)|[^;]{9,50}/[^;]{1,30}\.pii['"];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]*['"]?\1['"]?[\h\)]*;(?<X1195970>)|base64_decode['"];\s*eval\(\1\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?<X1194120>)|file_put_contents['"];(\$\w{1,20})\h*=[^;]{2,99};\1\(['"][^'"]+['"],['"]<\?php\h*['"]\.\40\);[^\{]{9,99}\bif\(file_exists\(\40\)\)\{include\(\40\);unlink\(\40\);(?:exit|die)[^;]{0,9};[^<:/]{20,150}\bfunction\h*\w{1,20}\(\)\{echo\h*['"]<script[^:]{1,60}\bsrc=['"]https?://(?<X2177261>)|https?://[^'"]{9,99}/\w{1,20}\.php['"];\s*\1=\1\.[^;]{2,40};\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6};\s*(\$\w{1,20})=\42;\s*\43=str_replace\(['"]base64_decode\([^;]{9,40}\43\);[^\?#&]{99,250}(\$\w{1,20})=stream_context_create\([^;]+;\s*(\$\w{1,20})=file_get_contents\(\1[^\)]+,\44\);\s*echo\h*\45;(?<X1190330>))|[^;]{0,30}\b(file_)ge(t_contents)\((?:\$\w{1,20}|https?://|/)[^;]{0,20};\s*\47pu\48\((?:\w{1,20}\.txt|\$\w{1,20}),\1,LOCK_EX\);\s*header\(['"]Location:https?://[^\?]{9,99}\?\w{1,20}=caixa['"]\);(?<X1200660>)|[^;]{1,30}\.php['"];\s*(\$\w{1,20})=[^;]{1,30}\.htaccess['"];\s*\$\w{1,20}=explode\([^,]+,file_get_contents\([^\)]+\)\);[^,\\/]{9,99}\$\w{1,20}=array\((?:['"]/wp\-(?:includes|admin|content)/[^'"]{1,60}\.php['"],){10}[^@%\*]{400,1500}\btouch\(\50[^;]+\);(?:\s*chmod\((?:\1|\50),\d+\);)+[^\}]{0,9}\}(?<X1192951>)|[^;]{1,40}\bsys_get_temp_dir\(\);\s*\$\w{1,20}=\1\.['"]/sess_\w{32}['"];[^\}]{99,650}[\}\s]+\bfunction\h+do.backdoor[^\(]{0,9}\((?<X2187250>)|\$\{?['"]?_[GPRSC]\w{2,6}['"]?\}?;(?:if)?\(+count\(\1\)[^\)]{0,99}\b(?:md5|in_array|sha\d+)\(gettype\(\1\)[^\{\};\?:]{1,199}[\?\{]\(+\1\[[^\]]+\]=[^;:\?]{1,199}\1=\1\[[^\]]+\]\(\1\[[^;:]{1,199}\1\(\)+:\h*\1;(?<X1191751>)|array\(['"]<[^\?\[\]]{99,1500}\);(if\(strpos\()[^\{]+\)\{[^\{]{9,99}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*(\$\w{1,20})=>\$\w{1,20}\)\{\54\55,['"]wordpress_logged_in['"][^\?\\]{99,400}\bfile_pu(t_contents)\([^\?%#]{9,150}(\$\w{1,20})=ob_ge\56\(\);\57=str_replace\(array_keys\(\1\),\1,\57\)[^\n]{0,20}echo\h*\57;\}(?<X1178530>)|explode\(['"][^,]+,file_get_contents\([^;]{1,40}\);\$\w{1,20}=['"]<\?php\h+copy\(['"]https?://[^'",]{9,99}\.txt['"],['"][^'"]{2,40}\.php['"]\);\?>['"];[^\{\}]{0,99}\bforeach\(\1\h*as\h*\$(?:web.)?shell\)(?<X2181951>)|fopen\((?:["'][^'"]{1,40}\.(?:php|txt)['"],['"]w\+['"]\);\s*(\$\w{1,20})=file_get_contents\(['"]https?://[^\)]{9,99}\.(?:txt|php)['"]\);\s*\$\w{1,20}=fwrite\(\1,\60\);\s*fclose\(\1\);(?<X1191861>)|['"][^'"]{1,20}\.txt['"][^\)]+\);\s*(\$\w{1,20})=fopen\(['"]https?://pastebin\.com/raw/[^\)]+\);[^\{]{1,30}\{\s*(\$\w{1,20})\.?=fgets\(\62\);[\}\s]+fwrite\(\1,\63\);\s*fclose\(\1\);(?<X1200670>))|getcwd\(\);\s*\}\s*\1=str_replace\(['"][^'"]+['"],['"]MrKrT[5s]8x['"],\1\);\s*(\1s?)=explode\([^\)]+\);\s*foreach\(\65\h*as\h*\$key=>\$value\)(?<X2169470>)|ob_get_contents\(\);\s*ob_end_clean\(\);\s*preg_match\(['"]/\-\-(?:prefix|bindir)=\([^,]+,\1,(\$fKi[1l]{2})\);\s*if\(\(isset\(\67\[\d+\][^\{]+\{\s*return\h*\67\[\d+\]\h*\.\h*['"](?:bin)?/php\b(?<X2183141>)|str_replace\(['"][^'"]+\.php['"],['"]{2},__FILE__\);\s*if\(file_exists\((\1[^\)]+)\)\)\s*\{\s*\$\w{1,20}=file_get_contents\(\69\);[^:\\]{99,200}\$\w{1,20}=['"]https?://[^/'"]{1,20}\.ddns\.net/[^'"]{0,20}\.php['"](?<X2183222>))|[=\h]+str_replace\(['"]([^'"]+)["'],["']{2},[^;]{9,99};(?:\s*(\$\w{1,20})[\h=]+\1\(['"]\71['"],[^;]{9,99}\);){1,4}(\$\w{1,20})[\h=]+\1\(['"]\71['",]+(?:\w\71){9,99}[^;]{1,40}\);\s*(\$\w{1,20})=[^;]{1,40};\s*\$\w{1,20}=\72\((\$\w{1,20})\(\74\)[\s,]+\75\(\73\)\);\s*if\([^\?>]{99,999}\bchmod\([^\)]+\);(?<X1194190>))
(\$\w{1,20})(?:[\h=]+(?:(@base64_decode)[\h\(]+[^\)]+\);\s*if[\h\(]+@?function_exists[\h\(]+\1\)\)\s*\{\s*(\$\w{1,20})[\h=]+@\1[\h\(]+['"]{2}\h*,\h*\2\h*\(['"][^'"]{99,300}(?:ZXZhbChiYXNlNjRfZGVjb2Rl|YWwoYmFzZTY0X2RlY29k|dmFsKGJhc2U2NF9kZWNvZGUo)[^'"]{999,3000}["']\)\);\s*@\3\(\);\s*\}\s*\Z(?<X1189690>)|['"][base64_dco\.'"\h]{20,90}['"];\s*(\$\w{1,20})[\h=]+['"][_\.'"POSTGE\h]{6,30}['"];\s*(\$\w{1,20})[\h=]+\$\{\5\};[^\{]{1,60}\bif[\h\(]+isset[\h\(]+\6\[[^\]]+\]\)\)[\s\{]+(\$\w{1,20})[\h=]+\1\(\6\[[^\]]+\]\);\s*@?eval\(\7\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1191820>)|[^;]{9,70}\.php['"];\s*(\$\w{1,20})[\h=]+[^;/]{9,60}/\.htaccess['"];\s*(\$\w{1,20})[\h=]+[^;/]{9,60}/wp\-[^;]{9,90}\.(?:css|txt)['"];\s*(\$\w{1,20})[^\(]{9,150}\bif\(\1[^\)]+\10[\)\{\s]+[^/\\'"]{99,400}\b(file_)pu(t_contents)\(\9[\h,]+\12ge\13\(\11\)\);\s*@?chmod\(\9,[^\)]+\);(?:\s*\}){2}(?<X1192830>)|\$(?:\w{1,20}\[\d+\]\(['"]https?://[^'"]{9,40}\.txt['"]\);\s*(?:\1[\h=]+str_replace\([^\)]+\1\);\s*){5,15}\bclass\h*(\w)[\{\s]+(?:public\h*)?function\h+(\w{1,20})\((\$\w{1,20})\)[\{\s]+@?eval\(\17[^;]+\);[\}\s]+(\$\w{1,9})[\h=]+new\h*\15[\(\)\h]{2,5};\s*\18\->\16[\h\(]+\1[\h\)]+;(?<X1210421>)|_[GPRSC]\w{2,6}(?:[\s;]+(\$\w{1,20})[\h=]+\$_[GPRSC]\w{2,6}[\s;]+(\$\w{1,20})[\h=]+array_merge[\h\(]+\20[\h,]+\1[\h\)];[^\{]{0,999}\bforeach[\h\(]+\21\h*as\h*(\$\w{1,20})[\h=>]+(\$\w{1,20})[\)\s\{]+\$?\w{1,49}[\h\(]+\23[\h,]+\$\w{1,9}[\h,]\22(?<X2254852>)|\[[^\]]+\];\s*(?:(\$\w{1,20})[\h=]+array\(['"][^,]+['"][,\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*uasort[\h\(]+\25[,\s]+base64_decode\(\1\)\);(?<X1215640>)|if\(function_exists\([^\{]{1,20}\{\s*(\$\w{1,20})[\h=]+@?(curl_)init\(\);\s*@?\28setopt\(\27,curlopt_url,\1\);[^\?\{]{20,150}(\$\w{1,20})[\h=]+\28exec\(\27\);\s*@?eval\(\29\)[^\?><]{1,35}(?:exit|die)[^;]{0,9};[\}\s]{1,2}(?<X1212811>))))|array\h*\((?:['"][a-zA-Z0-9\+/]+["'],){200}['"][^\);]{999,}\);\s*(\$\w{1,20})[\h=]+(strrev)[\h\(]+['"]edoced_46esab['"]\);\s*(\$\w{1,20})[\h=]+\32[\h\(]+["']etalfnizg['"]\);\s*@?eval[\h\(]+\33[\h\(]+\31[\h\(]+implode[\h\(]+['"]{2},\1[\h\)]{4};(?<X1190541>)|curl_init[\h\(]+['"]https?://[^/]{0,9}github[^/]{1,20}\.com/[^'"]{0,40}\b(?:shell|backdoor)[^'"]{0,40}\.(?:php|txt)['"]\);\s*(\$\w{1,20})[\h=]+fopen[\h\(]+['"][^;\)]+\);\s*(curl_)setopt\(\1[\h,]+CURLOPT_FILE[\h,]+\35\);[^\{]{1,50}\b\36exec\(\1\);[^\}]{1,99}\}\s*\36close\(\1\);\s*fclose\(\35\);(?<X1215611>)|f(?:ile_get_contents[\h\(]+['"](?:[^'"]{1,40}\.txt['"]\);\s*@?eval[\h\(]+base64_decode[\h\(]+\1[\)\h]+;(?<X1217980>)|https?://[^/]{1,20}(?:github|pastebin)[^\.]{1,20}\.\w{2,6}/[^'"]{0,40}(?:web|reverse)?(?:shell|backdoor)[^'"]{0,40}\.(?:php|txt)['"]\);\s*echo\h*\1;(?<X1216090>))|open\((?:(?:urldecode|base64_decode)[\h\(]+){2,}['"][^'"]{9,99}['"]\)\),['"]\w\+?['"]\);\s*@?constant[\h\(]+eval[\h\(]+fgets[\h\(]+\1[\h\)]{3};(?<X1213000>)))|[\s=]+['"](?:/\w[^'"\\]{0,99}\\x[a-f\d]{2}[^'"]{0,99}/\.[^'"]{1,99}['"];(?:\h*@include(?:_once)?[^;\$]*\1[^;]*;(?<X1253981>)|\s*(?:(\$\w{1,20})[\s=]+\1[\s;]+strpos[\s\(]+\42[,\s]+["']\w{1,10}['"\s\)]+;\s*@include(?:_once)?[^;\$]*\42[^;]*;(?<X1255420>)|strpos[\s\(]+\1[,\s]+["']\w{1,10}['"\s\)]+;\s*@include(?:_once)?[^;\$]*\1[^;]*;(?<X1254400>)))|wp\-\w{1,16}\.php['"];\s+while[\s\(]+!file_exists[\s\(]+\1[\s\)\{]+[^/'"]+\1[\s=]+['"][\./]+['"]\.\1[^\(=]+if[\(\s]+file_exists[\(\s]+\1[\s\)]+require(?:_once)?[\(\s]+\1[\s\)];(?<X2257712>))|\.=\(\((\$\w+)&0x\d+\)\?\(\(\46&0x\d+\)\?[^:]+:\h*['"]x['"]\)\h*:\(\(\46[^;]{1,20}\);\s*return\h*\1;[\}\s]+\?><(?:!doctype\h*)?html>[^\?]{9,99}<title>[^/]{0,20}(?:shell|backdoor)[^/]{0,20}</[^\?]{99,400}<\?[ph\s]+echo\(\(uname\(['"]php_uname['"]\)\)(?<X2217030>))
(\$\w{1,20})\h*(?:=\h*(?:(?:\$\w{1,20}\.?){5,9};\s*if\h*\(\h*\$\w{1,20}\h*\W{2,3}\h*(?:md|sha)[1256]{1,3}\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*\1\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*;\s*\}\s*else\s*\{\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1159931>)|(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/wp\-)[^;]{1,20};\s*(\$\w{1,20})\h*=\h*['"][^'"]{2,20}\.php["'];\s*if\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*\3[^:]{9,99}\bif\h*\(file_put_contents\h*\(\1\.\4[^\(]+\(['"]https?://[^\*>]{99,600}\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)\(\1\.\4\);(?<X1187490>)|(file_)ge(t_contents)\h*\(['"]https?://pastebin\.com/raw\.php\?i=\w{1,20}['"]\);\s*\6pu\7\(['"][^'"]{0,49}\.php['"],\1,FILE_APPEND\);(?<X1188373>)|(str_replace)\h*\(['"]google\-analytics\.com['"]\h*,\h*[""]{2},\h*\1\);\s*\1\h*=\h*\9\h*\(['"]<div[^:/]{9,99}<a\h+href\h*=\h*https?://[^@%#]{300,7500}\bfunction\h+Createlink\h*\((?<X2172800>)|@?\$_[GPRSC]\w{1,20}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*@?\$_[GPRSC]\w{1,20}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*\1\.\11;\s*(\$\w{1,20})\h*=\h*str_replace\h*\(\1\h*,\h*['"]{2}\h*,\h*\12\);\s*\$\w{1,20}\h*=\h*create_function\h*\(['"]{2}\h*,\h*\13\);(?<X1188620>)|['"]['"\.ero_pting]{16,45}['"];\s*\1\h*\((?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*['"][gzuncompres\.'"]{13,30}['"];\s*(\$\w{1,20})\h*=\h*['"]['"base64_dco\._]{14,30}['"];\s*@?eval\h*\(\15\h*\(\16\h*\(['"][^'"]{999,15000}['"][\)\h]+;(?<X1184860>)|['"][^'";]{0,60}/etc/(?:\$\w{1,20}/)?shadow['"];[^\(]{0,60}(\$\w{1,20})\h*=\h*fopen\h*\(\1\h*,\h*['"]w\+?['"]\);\s*fwrite\h*\(\18\h*,\h*\$\w{1,20}\);(?<X2188661>)|['"][^'"]{1,20}\b(sitemap\.xml)['"];[^@]{2,80}@unlink\h*\(\1\);\s*@?(file_put_contents)\h*\(\1,\$\w{1,20}\);\s*\21\h*\(['"][^'"]{0,9}map\.log['"]\h*,\h*['"]#\20[^\?:\\]{99,500}\bfunction\hcurl_get\w{0,6}_from_webpage\h*\((?<X2185131>)|['"][creat_funio'"\s\.]{16,35}['"];\s*(\$b374k)\h*=\h*\1[^;]{0,150};['"]\);\s*\23\h*\((?<X2171650>)|['"]\W{5,20}\W{5,20}\h*Created\h*by\h*\w{1,20}\b[^:]{9,40}:\h*\$(?:email|u(?:ser)?(?:name)?|login)[^:]{9,40}:\h*\$(?:password|pass|pwd|passwd)\b[^\}>]{9,499}\bmail\([^\)]+\1(?<X2153651>)|['"]aHr(?:0c[^'"]{5,50}['"];\s*if\h*\([^\{]{9,99}\{\s*(?:exit|die)[^;]{0,9};\s*\}\s*echo\h+@?file_get_contents\(base64_decode\(\1\)\.\W{1,9}(http_build_query)\([^=]{9,40}\bstream_context_create\(array\([^&]{20,150}=>\h*\26\([^\[]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\s\)]+;(?<X1141751>)|[^'"]{1,40}(?:dGVtcGxhdGV1cGRhdGVyLmRsaW5rZGRucy5j|bXBsYXRldXBkYXRlci5kbGlua2RkbnMuY29t|ZW1wbGF0ZXVwZGF0ZXIuZGxpbmtkZG5zLmNv)[^'"]+['"];\s*\$\w{1,20}\h*=\h*base64_decode\(\1\);(?<X2149470>))|['"]EggShell['"];\s*\$\w{1,20}\h*=\h*['"]\1\h*by\b(?<X2138570>)|['"]https?://(?:[^'"]{2,99}['"];\s*(\$\w{1,20})\h*=\h*['"]\.?/wp-(?:admin|includes|uploads)/[^;\(\)]{2,40}\.php['"];\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);[^\{]{9,150}(\$\w{1,20})\h*=\h*\32exec\(\31\);\s*if\(!?\33\)\s*\{\s*\33\h*=\h*@?(file_)ge(t_contents)\(\1\);\s*\}\s*\34pu\35\(\30,\h*\33\);(?<X2165150>)|[^'"]{9,99}/\w{1,20}\.(?:jpe?g|gif|svg|png|bmp|tiff)['"];\s*(\$\w{1,20})\h*=\h*['"][file_gtcons\.'"]{18,30};\37\h*=\h*\37\(\1\);\s*(\$\w{1,40})\h*=\h*strrev\(['"]stnetnoc_tup_elif['"]\);\s*\38\([^,]+,\h*\37\);(?<X1150540>)|[^/]{2,40}/shell_index/['"]\.\$domain_name\d*\.str_replace\(['"]\.php\d*['"],['"]\.html['"],[^\);]+\);\s*\$\w{1,20}\h*=\h*get_headers\(\1\);\s*if\(file_exists\([^\}@]{9,99}@file_get_contents\(\1\);(?<X2161580>))|\$\w{1,20}\(\(string\)null\h*,\h*\1\);\s*@?unset\(\$\w{1,20}\);\s*\1\(\);\s*\}\s*\}\s*\?>[^/\$]{9,99}<title>\h*404\h+Not\h+Found\h*<(?<X2159450>)|\$\w{1,20}\->getBot\(\);\s*if\h*\((\1\[['"]isbot['"]\])[^\)]+\)\s*\{\s*\$sNbot\h*=\h*['"][^\.]{2,20}\.\42\.(?<X2183390>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*(array)\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*=>\h*['"]\|\.\*\|e['"],\);\s*\45_walk\h*\(\44\h*,\h*\1\h*,\h*['"]{2}\);(?<X1187900>)|\1\h*\+\h*\d+;\s*(\$keyword\d+)\h*=\h*file\(['"][^\.]{1,20}\.php\.txt['"]\);\s*\$\w{1,20}\h*=\h*\47\[\1\];[^<]{99,999}(\$\w{1,20})\h*=\h*['"]<(script)>\s*var\h+keyword=\\['"][^\.]{1,20}\.txt\\['"];\s*</\49>[^\$]{9,99}\bsrc=\\['"]http://[^\$]{9,99}\becho\h+\48;(?<X2155300>)|file_get_contents(?:\([^\)]+\);\s*if\(preg_match\(['"]/IndoXploit\h*-\h*Auto\h+E?Xploiter/[^'"]+['"]\h*,\h*\1(?<X2152750>)|\h*\(['"][\./]{3,9}[^'"]{9,30}/[\w\.]{1,20}\.po['"]\);\s*\$(code_auth)\h*=\h*new\h+\52\(\d+\);\s*(\$\w{1,20})\h*=\h*\$\52->uncode\(\1\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\53\);(?<X1159350>))|fopen\(['"](?:\.htaccess['"]\h*,\h*['"][wa]\+?['"]\);\s*\$\w{1,20}\h*=\h*fwrite\h*\(\1\h*,\h*base64_decode\(\$f[uvck]{3}em\)\);\s*\$\w{1,20}\h*=\h*symlink\((?<X2156740>)|\w{1,20}\.txt['"],['"]?[aw]\+?['"]?\);\s*\$\w{1,20}\h*=\h*fwrite\(\1,[^\?]{99,999}\b(?:meta\h+http-equiv\h*=\h*['"]refresh['"]\h*content\h*=\h*['"]\d;\h*URL\h*=\h*|header\h*\(Location\h*:\h*)(?:https?://)?(?:\w{1,9}\.)?(?:facebook|paypal|gmail|yahoo|instagram|twitter)\.(?<X2148051>))|getenv\(['"]REMOTE_ADDR['"]\);[^\(]{99,500}\$(?:message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"](?:Social\h*security\h*number|SSN)\b[^\(]{99,500}\bmail\([^\)]+\);\s*(\$\w{1,20})\h*=\h*fopen\(['"]\.?/logs/\1\.txt['"]\h*,\h*['"]a['"]\);\s*fwrite\(\57(?<X2146461>)|str_replace\(\w{1,20},['"]{2},['"][^'"]+['"]\);\1\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1187200>)|strtolower\h*\((\$_[GPRSC]\w{2,6}\[strrev\h*\(strtoupper\h*\()['"]tnega_resu_ptth['"]\)\)\]\);\s*\$\w{1,20}\h*=\h*\60['"]tsoh_ptth['"]\)\)\];\s*if\h*\(!?preg_match\h*\([^\)]+,\h*\1\)\)\s*\{[^\}]{9,250}\{\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1176410>)|substr\(str_shuffle\([^;]+\);\s*\}\s*mkdir\h*\(['"](\$\w{1,20})/\1['"]\h*,\h*0?777\);\s*(\$\w{1,20})\h*=\h*base64_decode\(['"][^'"]{999,12000}['"]\);\s*file_put_contents\h*\(['"]\62/\1/\w{1,20}\.(?:zip|php)['"],\63\);(?<X2157960>))|\.=\h*\$\w{1,20}\[mt_rand\([^\]]+\];\s*\}\s*(\$data)\h*=\h*['"]<\?(?:php)?\h*/\*['"]\h*\.\1\.\h*['"]\h*\*/\h*\?>['"][^\{\}]{9,90}\bfile_put_contents\h*\(\$\w{1,20}\h*,\h*\65\);\s*\}\s*function\h+\w{1,20}\h*\(\65\)\s*\{\s*\$\w{1,20}\h*=\h*(array)\h*\([^\}:]{99,300}\66\(['"]url["']=>['"]http:(?<X2172661>))
(\$\w{1,20})\s*=\s*(?:['"](?:[preg_lac.'"]{14,35}['"];\s*\1\s*\(\s*.?['"](.).{0,40}\2e\w?.?['"]\s*,\s*['"](?:\\x[a-z0-9]{2,3}){6}(?<X2125960>)|\.?/[^\/]{1,40}/(?:css|images|js)/[^'"]+['"]\s*\.\s*['"][^'"]{1,30}['"]\s*\.\s*['"].txt['"];\s*(\$\w{1,20})\s*=\s*fopen\(\1\s*,\s*['"]a['"]\)\s*or\s*die\([^\)]+\);\s*(\$\w{1,20})\s*=\s*['"][^'"]{9,999}['"];\s*fwrite\(\4\s*,\s*\5\);\s*fclose\(\4\);(?<X2123741>)|\w{1,20}\.php['"];\s*(\$\w{1,20})\s*=\s*(?:generate_?)?random_?(?:string|number)\(\);\s*(\$\w{1,20})\s*=\s*\7\.['"]\.php['"];[^\$]{0,15}@?copy\(\1\s*,\s*\8\)(?<X2123641>)|\w{32}['"];[^<]{9,300}!=\s*\1\)\s*\)\s*\{\s*die\s*\(['"](?:404|401|403)\s+(?:Not\s*Found|Unauthori[zs]ed|forbidden)\b[^#]{99,3000}(\$\w{1,20}[^=]+)\s*=\s*shell_exec\((\$\w{1,20})\);[^\{]+\{\s*\10=\s*(?:passthru|exec|popen|system|assert|pcntl_exec)\(\11\);(?<X2134291>)|https?://dropsforums\.ru/panel/[^'"]{9,40}['"];\s*\$\w{1,20}\s*=\s*curl_init\(\1\);(?<X2124270>)|PGRpdiB(?:pZD0i|zdHlsZ|jbGFzcz)[^'"]{89,999}['"]\s*;\s*echo\h+base64_decode\s*\(\s*\1\s*\)\s*;(?<X1166996>))|(?:['"creat_funio\.]{20,30};\s*(\$\w{1,20})\s*=\s*@\1\(['"](\$\w{1,20})['"],['"eval\.]{9,15}\(['"][\?>]{2}['"]\.['"gzinflate\.]{14,20}\(\s*['"\.base64_dco]{15,25}\(\16\)\)\);['"]\);\s*@\15\(['"][^'"]{999,5000}['"]\);(?<X1063540>)|\\['"][asert\\.'"\s]{9,15}['"];\s*(\$\w{1,20})\s*=\s*\$\{\\['"][_POST\.'"\\\s]{9,12}['"]\};\s*\1\s*\(\s*\18\[[^\]]+\]\);(?:\s*/[\*/]['"]\);)?(?<X1061801>)|file(?:\(['"]/etc/named\.conf['"]\);\s*(\$\w{1,20})\s*=\s*scandir\(['"]/var/named['"]\);\s*if\s*\((?:\20|\1)[^\}]+posix_getpwuid\s*\(fileowner\s*\(['"]/etc/valiases\b(?<X2132771>)|_get_contents\([^\.]+\.['"]\.info['"]\);[^<]{9,300}(?:[^\$]{0,15}\$\w{1,20}\s*=\s*(explode\(['"]<)([^>]+)>['"],\s*\1\);\s*\$\w{1,20}\s*=\s*\22/\23>['"],[^\)]+\);\s*){5}(?<X2123790>))|implode\s*\(file\s*\(['"]data:[^\.]+\.str_replace\s*\([^\$]+\1\)\)\);[^@]{99,200}\1\s*=\s*@gzinflate\(\1\)\)\s*\D{2,3}\s*\(CRC32\(substr\(\1[^\}]{9,99}\{\s*(\$\w{1,20})\s*=\s*array\([^@]{99,400}@create_function\(['"]['"],['"]\};\s*unset\(.\1,[^\)]+\25\)(?<X2127931>)|trim\s*\(\$_POST\[[^\]]+\]\)\.['"]\.php['"];\s*\$\w{1,20}\s*=\s*file_get_contents\((__FILE__)\);[^\}]{9,150}unlink\s*\(\27\);\s*echo\s+['"](xXsUIssAZ):\s*['"]\s*\.\s*\1\.\s*['"]\s*:\28['"];(?<X2063651>)))
(\$\w{1,24})=rand\(\);\s*\1=md5\(\1\);\s*header\s*\(['"]location:[^&]{15,30}&\w+=\1\1&session=\1\1['"]\);(?<X2119452>)
(\$\w{1,25})(?:=['"][^'"]{32,64}['"];(\$\w{1,25})=(?:\1\[\d+\]\.){5}[^\{]{99,499}\bif\(@?\2\([^\{]+\{(\$\w{1,25})[\h=]+@?\$\w{1,25}\(['"]{2},\s*@?\$\w{1,25}\([^\)]{99,499}[\h\)]+;@?\3[\h\(\)]+;\}(?<X1208710>)|[\h=]+(?:['"](?:['"\h\.creat_funio]{15,40}['"];\s*(\$\w{1,25})[\h=]+['"]['"\h\.gzuncompres]{12,40}['"];\s*(\$\w{1,25})[\h=]+\1[\h\(]+(?:['"]{2}|null)\s*,\s*\5[\h\(]+['"]x.{49,499}?\)[\s\)]+;\s*(?:echo\s*)?@?\6[\h\(\)]*;(?<X1207934>)|[\-\+\|\h]+\[[\h'"\.B4JATX]+\][\h\|\+\-]+[^;]+;\s*\1[\h\.=]+[^;]{9,150};\s*if\(strlen\(\$\w{1,25}\)[^\{]+\{\s*Tools::file_get_contents\(['"\.:/htpsaielgrmo]+[^\(]+\(\1\)[\h\.'"]+\);\s*\}(?<X1201941>)|wpdefault['"];\s*(\$\w{1,25})[\h=]+[^;]+;\s*(\$\w{1,25})[\h=]+['"]wordpress@[^\}]{9,99}\bwp_create_user[\h\(]+\1[,\h]+\9[,\h]+\10[\h\)]+;\s*[^\}]{0,99}\b\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*\}\s*\}\s*\Z(?<X1213310>))|file_get_contents[\h\(]+['"](?:https?://(?:(?:vivapasarantogel\.com|buku303\.gg)/[^'"]+\.(?:txt|js)['"][\h\)]+;\s*echo\h*\1;(?<X1227792>)|[^/]+/paste/[^/]+/raw['"][\h\)]+;\s*echo\h*\1;(?<X1214260>)|info\.ibii\.ac\.id/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;(?<X1237200>)|raw\.githubusercontent[^/]+/(?:benny12311|trioneone311)/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1227301>)|raw\.githubusercontent\.com/(?:subdomain88|subdomain88)/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1237320>)|raw\.githubusercontent\.com/andina8/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1228300>)|twins\-[^/]+\.app/[^'"]+\.(?:txt|js)['"][\h\)];\s*echo\h*\1;(?<X1233890>))|license\.js['"][\h\)];\s*eval[\h\(]+\1[\h\)]+;(?<X1233690>))|getallheaders[\h\(\)]+;\s*if[\h\(]+array_key_exists[\h\(]+[^\)]+\1[\h\)]+\W{2,3}\1\[[^\)]+\)\s*@?include\h*['"][^'"]+\.(?:ico|png|jpe?g|txt)['"];(?<X1219090>)))
(\$\w{1,2})=\$\w{1,40}\[\d+\]\(['"]\\[xa-f\d\\]{3,199}['"][\s\)]+;\s*class\s*(\w{1,2})\s*\{\s*public\s*function\s*(\w+)[\s\(]+(\$\w{1,40})[\s\)]+\{\s*eval[\s\(]+\4[^;]+;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\2[\s\(\)]+;\s*\5\->\3[\s\(]+\1[\s\)]+;(?<X1247410>)
(\$\w{1,30})\s*=\s*(?:['"]\.['"]\s*\.\s*str_replace[\(\s]+['"]\s+['"][,\s]+['"]['"][,\s]+['"][a-z\d\s]{3,}['"][\)\s]+;\s*if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*(\$\w+)\s*=\s*\$\w+[\(\s]+\1[\)\s]+;\s*return\s*!empty[\(\s]+\2[\)\s]*\?\s*\$?\w+[\(\s]+\2[,\s]+true[\)\s]+:['";\s]*\}(?<X1278260>)|array\(\s*[^\)]+\)\s*;\s*if\s*\(\s*\$is_bot[^\w]{2,9}\(\s*FALSE\s*[^\w]{2,3}\s*strpos\(\s*@?preg_replace\(\s*\1[^\.]{20,99}\{\s*(\$\w{1,20})[^\(]{1,40}\4\s*\.\s*basename\(\s*(\$_FILES\[[^\]]+\])[^\(]+if\(\s*move_uploaded_file\(\5[^\]]+\],\s*\4\)\s*\)\s*\{[^\(]{9,50}exit\(\);\s*\}(?<X1062042>))
(\$\w{1,40})(?:(?:\s*/\*[^\*]{0,19}\*/)?\s*=(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*\^(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*;\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*=(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*\((?:\s*/\*[^\*]{0,19}\*/)?\s*chr\b[^;]+\1[^\{\}]{0,99}\{[^\}]+die[^\}]{0,40}\}(?<X1247510>)|([\s=]+)(?:base64_decode([\s\(]+)['"]aHR0c|['"]https?://)[^;]{1,199}(?:\$_POST\[['"](?:log|pwd)['"]\][^;]{1,199}){2};\s*(\$\w+)\3@?file_get_contents\4\1([\s\)]+);\s*if\4[^\{;=]{0,49}\5[^\{=;]{0,49}\{\s*function\s*(\w+)\4\$\w+\6\{[^\}]{0,299}\bcurl_exec\4[^\}]{1,199}\}\s*\7\4\1\6;\s*\}(?<X1192930>))
(\$\w{1,40})(?:=(?:(?:(\$\w{1,40})\[['"]\w\s*['"][\s\+]+\d+\s+[^\]]+\][\.;])+(\$\w{1,40})=(?:\2\[['"]\w\s*['"][\s\+]+\d+\s+[^\]]+\][\.;])+(?:(\$\w{1,40})=[^;]+;)+\$\w{1,40}=\1\(\4,\3\(['"\s]+\),['"][^'"]*['"]\);[^!]{9,3999}(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;\5\(\6\(['"][^'"]*['"]\)+;\$\w{1,40}=\d+;(?<X1224964>)|(?:get|scan)dir\([^;]{1,99};for\([^\{]{1,199}\{[^\}]{1,499}\$(\w{1,40})=file_get_contents\(\1\[[^\}]{1,199};(\$\w{1,40})=openssl_(?:en|de)crypt\(\$\8,[^\}]{1,499};fwrite\([^\),;]{1,99},\9\);[^\}]{0,499}\brename\(\1\[(?<X2192401>)|(\$_[GPCSR]\w{2,6}\[)[^;]{1,99};if\(\1\b[^;\}]{1,99}\b(?:exit|die)[^;]{0,19};\}switch\(\$\w+\)\{case\b[^;:]{1,99}:(\$\w+)=\11[^;]{1,99};[^:\}]{1,199}\$(\w{1,40})=(file_)ge(t_contents\(\12)\);\$\w+=(\w+)\(\$\13\b[^@]{9,499}\bcase\b[^\}\?]{1,499}\b\14pu\15\b[^\}]{1,499}\}break;\}function\h+\16\((?<X2173813>)|(file_)ge(t_contents\(\$\w{1,40})\);\1=base64_decode\(['"]PD9[^'"]{999,}['"]\)\.\1;\18pu\19,\1\);(?<X2184200>)|(socket_)create\(AF_INET,[^\{]{1,499}\bdo\h*(\$\w{1,40})\.=chr\(rand\([^;]{1,99};while\([^\)]+\);[^\{]{1,499}\bdo\{[^\}]{1,499}\b\21sendto\(\1,\22,[^\}]{1,499}\}while\((?:1|True)\);(?<X2181820>)|<<<(?:(\w{1,40})\s*<\?(?:cuc)?\s*@?vav_frg\([^\?]{1,999}\?>\s*\24;(\$\w{1,40})=\w{1,40}\(\1\b[^;]{1,99};(\$\w{1,40})=fopen\((\$\w{1,40}),[^;]{1,99};fwrite\(\26,\25\);fclose\(\26\);header\(['"]Location:(?:['"]\.)?\27['"]?\);(?:\?>)?\Z(?<X2172201>)|['"]\w{1,40}['"]\s*<\?[^@]{999,1999}fwrite\(\$\w{1,40},\1\);[^\?]{99,499}\becho\s*['"]<(apicall\w{1,40}>)[^;]{1,40}</\29['"];\}unlink\(__FILE__\);(?:rmdir\(__DIR__\);)?(?:\?>)?\Z(?<X2140600>))|["'](?:Office365|Live|MSN)['"];(\$\w{1,40})=['"][^;]{1,99};[^\(\?]{1,99}\bmail\([^\)]+\31[^\)]+\1\);file_put_contents\([^;]{1,99};header\(['"]Location:[^;]{1,199};\s*(?:\?>|\Z)(?<X2146550>)|['"](?:<\?[^=]{1,499};(\$\w{1,40})=(fopen\()['"]([^'"]{1,40}\.php)['"],[^;]{1,99};(fwrite\()\33,\1\);fclose\(\33\);(\$\w{1,40})=['"](?:(?:DirectoryIndex|ErrorDocument\h*\d{3})\h*/?\35\s*(?:\\n\s*)?){3}[^;]{1,499};(\$\w{1,40})=\34['"][^'"]{0,99}\.htaccess['"][^;]{1,99};\36\38,\37\);(?<X2179850>)|[^'"]{1,40}['"]\^['"][^'"]{1,40}['"];\1\(\$\w{1,40}\);\$\w{1,40}=@?\$\w{1,40}\(@?\$\w{1,40}\[\$\w{1,40}\]\);(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);(?:if\([^\n;]{1,99})?\40\(\);\}?(?<X1132510>)|[^'"]{999,49999}['"];(\$\w{1,40})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,;]+/\(\.\*\)[^,;\)]+,\42,[^\?]{1,999}\$(\w{1,40})\.=chr\(+ord\(substr\(\1,[^\?]{1,499}\b[ea](?:val|ssert)\(\$\43\);(?:\?>)?\Z(?<X2181750>)|[^;]+\b(?:APPLE?|VBV)\b[^;]+['"];(\$\w{1,40})\.?=[^\(]{99,199}mail\(\$\w+(,\1,(\$\w{1,40}),\45\);)(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;\48\(\49\([^\),;]{9,49}\)\46fclose\(fwrite\(fopen\(['"][^'"]+\.html?['"],[^\)]+\),\47\)\);echo\s*['"]<meta\s+http-equiv=['"]refresh['"](?<X2134260>)|[a-z\d]{1,3}['"];@?include(?:_once)?\h+\1\h*;(?<X1206630>)|\w{1,9}['"];function\s*\w+\s*\(\s*(\$\w+)[\)\s]+\{\$\w+=file_get_contents\(\52[^:\n]+['"]https?://['"]\s*\.\s*\1\s*\.\s*['"]\.[\w\-\.]+(?:\.[a-z]{2,9})+[^'"]*['"];[^\?\n]+\bstrpos[\(\s]+\$\w+[,\s]+['"]pingsitemap\.xml['"][^\n]{99,}echo\s*\$\w+[^;]*;(?:\h*(?:exit|return|die)\b[^;]*;)+(?<X1265130>)|http(?:s://%s/ping\?s[^'"]+['"]\s*;\s*(\$\w{1,40})=sprintf[\(\s]+\1\s*,[^;]+;\s*\$\w{1,40}=\w+[\(\s]+\54[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*var_dump[\(\s]+\54[^\}]+(?:exit|die)\b[^;]*;\s*\}(?<X1305131>)|s?://(?:(?:\w+(?:\.|/))+php\?[\s\w]+=['"](?:\.urlencode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\))+;(\$\w{1,40})=fopen\(\1,[^;]+;if\(\56\)[^;]+;\};if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{eval[^;]+;\}(?<X1217751>)|[^'";]{1,99}\.txt['"];(\$\w{1,40})=['"][^'"]{0,99}/wp\-(?:content|admin|includes)/[^'"]+['"]\.\$\w{1,40}\.['"]\.php['"];[^\?]{1,199}\$(\w{1,40})=(file_)ge(t_contents\()\1\);[^\?]{1,99}\b\60pu\61\58,\$\59\);[^\%#]{1,499}\bunlink\([^\)]+\.php['"]\);(?:\?>)?\Z(?<X2171841>)|[^/'";]+\.xyz\b[^;]{1,299};(?:(?:if\([^\{;]{0,99}\1\b[^\{;]{0,99}|else)\{header\(['"]Content\-type:\s*(?:application|text)/(?:x|ht)ml\b[^\)]{0,99}\);\}){2}echo\b[^;]{0,99}\1\b(?<X2192272>)))|key['"];(\$\w{1,40})=['"]value['"];\$_POST\[\$\{\1\}\]=\w{1,40}\(\$\{\64\}\);\}[^@]{9,99}<title>\W{0,15}Kaito_Shell\b(?<X2144861>))|\$_(?:[GPCSR]\w{2,6}\[(?:['"]\w{1,40}['"]\];if\(\1\)\{(\$\w{1,40})=\1\(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\]\);(\$\w{1,40})=\1\(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\]\);\66\(['"][^'"]+['"],\67,\d{1,4}\);(die|exit)\([^\)]*\);\}else\s*phpinfo\(\);\68;(?<X2129430>)|[^;]{1,99};\?>[^/]{0,99}<title\b[^>]{0,99}>[^/<>]{0,99}\b(?:(?:de?|en)cod(?:e|ing)\h*\W\h*){2}[^@!]{999,2999}\b(?:break;case\h*['"]\w{1,19}['"]\h*:\h*\$\w{1,40}=(?:\w{1,40}\(){2}[^;\)]{0,1999}\1\)+;){6}(?<X2179641>))|(?:[GPRSC]\w{2,6}\[[^\]]+\];(\$\w+)=\w+\(\1\);\$\w+=array\(['"]/https:\\/\\/pastes\\\.io\\\/raw\\/\+[^;:]+:\\/\\/raw\\\.githubusercontent\\\.com\\/[^;]+;(\$\w{1,40})=[^\}]{9,499}(\$\w+)=fopen\(\72,[^;]+;fwrite\(\73,\71[\);\}]+(?:fclose\(\73[\);\}]+)?include\s*\72;(?<X1228270>)|SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,;]+/\(\.\*\)[^,;\)]+,\1,[^\?]{1,999}\$(\w{1,40})\.=chr\(+ord\(substr\([^\?]{1,499}\b[ea](?:val|ssert)\(\$\75\);(?<X2181761>)))|array\((?:(?:['"][^'"]{0,40}\bwp\-config\.php['"],){3}[^;]{99,4999};[^\}\?]{1,199}\bforeach\(\1\h*as\h*(\$\w{1,40})\)\{(\$\w{1,40})=[^;]{0,99}\77\b[^\?\}]{0,199};(?:copy|symlink)\((?:\78|\77),(?<X2182521>)|[^\)]{9,499}['"](?:(?:Apple|user)\s*ID|email|user(?:name)?)['"]\s*=>[^,]{1,99},\s*['"]Pass(?:word)?['"]\s*=>[^\)]{9,499}\);foreach\(\1[^\)]+\)\{(\$\w{1,40})\.=[^;]{1,99};\}[^\?]{99,999}\bf(?:ile_get_contents|open)\(['"]https://api\.telegram\.org/bot[^'"\);]{1,99}\80(?<X2138130>))|base64_decode\(\1\);(header\(['"]Location:\s*[^'"\?]{1,99}\.php\?\w{1,40}=['"]\.md5\([^\)]+\)\.(?:['"]&\w{1,40}=['"]\.rand\(\d+,\d+\)\.){2}['"])&\w{1,40}=['"]\.\1\);\}else\{\82['"]\);\}\s*(?:\?>)?\Z(?<X2171901>)|g(?:et_(?:current_user\(\);(?:(\$\w{1,40})=\$_SERVER\[['"]\w+['"]\];[^\}\?]+(\$\w{1,40})=fopen\(['"]/home/['"]\.\1\.['"]/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w+['"]\);fwrite\(\85,\$\w+\);fclose\(\85\);[^\?!&\{\}]{9,99}\$\w{1,40}=["]?\84[^;]+:2083/resetpass(?<X2131210>)|[^:]{0,199}(\$\w{1,40})=['"]email:[^;]{1,49};(?:(\$\w{1,40})=fopen\(['"]/home/['"]\.\1\.['"]/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w+['"]\);fwrite\(\88,\87\);fclose\(\88\);){2}(?<X2130160>))|users\((?:array\(|\[)['"]role['"]=>['"]administrator['"][\]\)]\);foreach\(\1\h*as\h*(\$\w{1,40})\)\{[^\}]{0,199}\90\->(user_pass)\b[^@]{1,499}\bwp_update_user\([^;]{0,999}['"]\91['"]=>\$_[GPCSR]\w{2,6}\[(?<X2184170>))|zinflate\(base64_decode\(\1\)\);(\$\w+)=0;while\(\(\(\93<strlen\(\1\)+\{\1\[\93\]=chr\(ord\(\1\[\93\]\)\s*\-\s*\d\);\93\+\+;\}return\1;\}(?<X1265620>))|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\?[^;]{9,99};[^\^\}]{1,99}((\$\w{1,40})\[[^\]]+\])=chr\(ord\(\95\)\^\(\(\1[^;]{1,40};\}\$\w{1,40}=gz[^;]{1,40}\96\)[^\{]{1,40}\{setcookie\(['"][^'"]+['"],\1\);(?<X2132960>)|new(?:\h+Api\(\);(?:if\(!file_exists\((\$\w{1,40})\.['"](/wp\-(?:admin|includes)/[^'"]+\.php)['"][^\}\?>]{1,499}\$(\w{1,40})=\98\.['"]\99['"];[^\}\?>]{0,499}\$(\w{1,40})=\1\->get\(base64_decode\(['"]ahr0c[^\)]+\)\.['"]\99['"]\);file_put_contents\(\$\100,['"]?\$\101\b[^;]{1,99};\}){2}(?<X2180791>)|\s+\w{1,40}\(\);(\$\w{1,40})=new\s+Loader\(\1\);\1->set\(['"]\w{1,40}['"],\103\);\$\w{1,40}=new\s+DB\([^\}]{1,600}?\}\}if\(file_exists\(['"](\w{1,40}['"\.ph]{5,9})['"]\)\)\{include(?:_once)?\s*\(?['"]\104['"]\)?;\}(?<X1058660>))|preg_split\(['"]/\{\\\|\}/si['"],\$\w+,\-\d+,PREG_SPLIT_NO_EMPTY\);if[\s\(]+![\s\(]+is_array[\s\(]+\1[\s\)]+\{return\s*(?:false|true);\}if[\s\(]+count[\s\(]+\1[^\n<]{99,}\bheader[\(\s]+(\$\w{1,40})\[0\]\);echo\s*\106\[\d+\];(?:die|exit)\b[^;]*;[\}\s]+\}\h*\w+\(\$\w+,\$\w+\);(?<X1266140>))|[=@\s]+fopen[\(\s'"]+wp\-cli?\.php['"][,\s]+['"][wa]\+?['"][\)\s;]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s'"]+https?://raw\.[^'"/]+\.[a-z]{2,6}/[^'"]+['"][\)\s;]+\$\w{1,40}[=\s@]+fwrite[\(\s]+\1[\)\(,\s]+\108[\)\s;@]+fclose[\(\s]+\1[\)\s]+;(?<X1204190>))
(\$\w{1,40})(?:[=\h]+['"][^'"]{1,9}['"]\h*\^\h*['"][^'"]{1,9}['"]\h*;\h*@?(\$\w{1,40})[=\h]+base64_decode\([\$\{\h]*\1[\h\}]*\[[^\]]+\][\h\)]+;\h*@?eval[\h\(]+['"]{2}[\.\h]+\2[\h\)]+;(?<X1238871>)|[=\s'"]+https?://(\$_SERVER\[)HTTP_HOST\]\4REQUEST_URI\]['"\s;]+(\$\w{1,40})\s*=[^;]+;\s*if[\(\s]+strpos[\(\s]+\1[,\s'"/\.]+wp\-(?:admin|includes)[^><\n]{9,999}if[\s\(]+\5[^\{]{2,9}\{\s*echo[\s\('"]+<(script)\s*src[=\s'"]+https?://[a-z\d]{1,3}\.\w{5,}\.[a-z]{2,8}/[^;\?]+\.js\?[^;]+</\6>['"\s;]+\}(?<X1211020>)|[=\s@\.]+preg_replace[\s\(]+['"](.)[^;]+\8['"]\s*,\s*['"]{2}\s*,\s*\1[\s\);]+(\$\w{1,40})[=\s@\.]+\1[\(\s]+['"][^'"]+['"][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*/\*[^\*]*\*/[\s\(]+\$?(?:\w+[\s\(]+)+(?:['"][\?>]{2}['"]\s*\.\s*)?\9[^;]*;(?<X1254241>)|[=\s@]+(?:(file_get_contents)[\(\s'"]+http://[^;\?]{1,40}\.aspx?\?[^;]+;[^\?]{0,999}\$\w{1,40}\s*=\s*\11[\s\(]+\1\s*\.\s*['"]/[^;\?]{0,999}\.aspx?\?[^;]+;[^\|]{9,9999}\becho\s*\11[\s\(]+\1[^;\?]+\.aspx?[^;]+;[^\?]{0,999}?echo\s*\11[\s\(]+\1[^;\?]+\.aspx?[^;]+;(?<X1221980>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+file_put_contents[\(\s]+\1[,\s]+\13[\)\s]+;(?:\s*echo\s*\13\s*;)?(?<X1223440>)|file_get_contents[\(\s@]+\$_(?:GET|POST)\s*\[[^\]]+\][\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\s]+\1[\)\s]+;(?<X1225130>)|unserialize[\(\s]+base64_decode[\(\s]+(?:trim[\(\s@]+)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\{\}]{0,199}if[\(\s]+@\h*\1\s*\[[^\]]+\][\)\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+(?:trim[\(\s@]+)?\1\s*\[[^\]]+\][\)\s]+;(?<X1239021>))|[=\s]+(?:!\$\w{1,40}\s*;\s*\$\w{1,40}[=\s]+(?:['"][^'"]*['"]|\$\w+)\s*;\s*if[\(\s]+\1[\)\s]+\{\s*class\s*(\w+)\s*\{\s*private\s*\$\w{1,40}\s*;[^\^\n]+\^[^\n\*]+\}\s*\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\17[\(\)\s]+;[^\}]*\}(?<X1254290>)|(\$\w{1,40})(?:[\(\s'"]+svyr_trg_pbagragf['"\)\s]+;\h*\$\w{1,40}[=\s]+\1[\(\s]+\19[\(\s'"]+cuc:\s*//vachg['"\)\s]+;(?<X1214110>)|[\(\s]+\$\w{1,40}[\(\s]+\$\w{1,40}\s*\)\s*\)\s*\(\s*\)\s*;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[\s*\19\s*\([^\}\{;]+\{[^\}@]{0,499}@include(?:_once)?[\s\(]+\1[^;]+;[^\?]{0,999}\becho\s*\19\s*\([^;]+;\s*\}\s*\}(?<X1237780>)|\s*;(?:\s*/\*[^\*]{0,19}\*/)?\s*@include(?:\s*/\*[^\*/]{0,19}\*/)?\s*\((?:\s*/\*[^\*]{0,19}\*/)?\s*\1(?:\s*/\*[^\*]{0,19}\*/)?\s*\)(?:\s*/\*[^\*]{0,19}\*/)?\s*;(?:\s*/\*[^\*]{0,19}\*/)?\s*@\$\w{1,40}(?:\s*/\*[^\*/]{0,19}\*/)?\s*\[\d[^;]+\19[^\}]{0,99}\b(?:die|exit)\b[^;]+;(?<X1247450>))|(\$_SESSION)\[\w+\([^\]]+\][\s;]+if[\(\s]+empty[\(\s]+\23\[[^\]]+\][\)\.\s]+\1\][\)\s]+\{\s*if[\(\s]+isset[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\D{2,9}(?:(?:sha|md)[15][\(\s]+){2}\24\1\][\)\s=!]+\$\w{1,40}[\)\s\{]+\23\[[^\]]+\][\)\.\s]+\1\][^\}]*\}\s*else\s*\{\s*\w+\s*\(\)\s*;[^\}]*\}\s*\}(?<X1222990>)|(\$GLOBALS\[['"]\w+['"]\]\[)\d+(\]\(\$_POST\[\w+\()\d+\)\]\);\s*(\$\w{1,40})[=\s]+\26\d+\27\d+\)\]\);\s*(\$\w{1,40})[=\s]+\26\d+\27\d+\)\]\);\s*\$\w{1,40}[=\s]+\26\d+\27\d+\)\]\);\s*(\$\w{1,40})[=\s]+\26\d+\]\((?:(?:\1|\28|\29)[,\s\)]+){2}[^;]+;\s*if[\(\s]+\30[\)\s\{]+echo[^=\?]{1,99}\30;\s*\}(?<X1227460>)|(base64_decode)(?:[\(\s'"]+L[23][^'"]{1,99}(?:(?:Ly5jYWdlZnMvL|LmNhZ2Vmcy8u|Y2FnZWZzLy4u|Ly5jcGFkZG9ucy8|LmNvbXBvc2VyLy4)[^'"]+|uLi4|Li4u)['"][\s\)]+;\s*if[\s\(]+(?:!(?:is_file|file_exists)[\s\(]+\1[\s\)]+\|+)?filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]\1[\s,]+\33ge\34[\s\(]+\32[\s\(]+['"]aHR0[^;]+['"][\s\)]+;\s*\}(?!\s*else)(?<X1217527>)|[\(\s]+['"](?:aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0[=\+]{0,2}['"][\)\.\s]+\$\w{1,40}[\.\s]+\32[\(\s]+['"][^'"]*['"][\)\.\s]+\$\w{1,40}[\s;]+(\$\w{1,40})[=\s]+json_decode[\(\s]+\1[^;]+;\s*if[\(\s]+empty[\(\s]+\36\[\32[\(\s]+['"][^'"]*['"][\)\s]+\][\)\s\{]+\$\w{1,40}[=\s]+\36\[\32[\(\s]+['"][^'"]*['"][\)\s]+\][\s;]+\}(?<X1257900>)|PD9[^'"]{999,}['"][\)\s]+;\s*(\$\w{1,40})[=\s]+dirname[\s\(]+__FILE__[\s\)]+;\s*(?:@?file_put_contents[\(\s]+\38\s*\.\s*\32[\(\s]+['"]Ly4uLy4u[^'"]{1,999}['"][\)\s]+,\s*\1\s*\.\s*PHP_EOL[\)\s]+;\s*){2}(?<X1222893>)))|(curl_)init[\(\s]+base64_decode[\(\s]+(strrev)[\(\s]+['"][^'"\$]+['"][\)\s]+;(?:\s*\40setopt[^;]+;)*\s*(\$\w{1,40})[=\s]+\40exec[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+base64_decode[\(\s]+\41[\(\s]+['"][\w=]{3,5}['"][\)\s@;]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\43[\.\s]+\42[\)\s]+;(?<X1228030>)|(file_get_contents)[\(\s'"]+\.htaccess['"][\)\s]+;\s*(\$\w{1,40})[=\s]+\45[\(\s'"]+index\.php['"][\)\s]+;[^\{\}]{9,499}if[\(\s]+is_dir[\(\s]+['"]wp\-(?:includes|admin)/[^'"]+['"][\s\)]+\{\s*file_put_contents[\s\('"]+wp\-(?:admin|includes)/[^'"]+\.(?:png|jpg|ico)['"][,\s]+(?:\1|\46)[^\}\{]+\}(?<X1228410>)|(function)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*eval[\(\s]+\49[\)\s]+;\s*\}\s*;\s*\$\w{1,40}[=\s]+\48[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][base64_dco]{9,13}['"]\s*;\s*\$\w{1,40}[\s=]+\50\s*\[[\(\s]*\d+\s*[\-\*\+/][^\?]+\1[\s\(]+\$\w{1,40}[\s\)]+;(?<X1212530>)|@?(file_get_contents)[\(\s"']+https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][\)\s]+;\s*(\$\w{1,40})[=\s]+@?\52[\(\s"']+https?://github\.com/\w+/[^'"]{1,40}\.txt['"][\s\)]+;(?:\s*\$\w{1,40}[=\s]+fwrite[\(\s]+\$\w{1,40}[,\s]+(?:\1|\53)[\)\s]+;)+(?<X1224560>)|@(?:\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+if[\(\s]+isset[\(\s]+\1[\)\s&]+strlen[\(\s]+\1[^;\{\}@]+@hex2bin[\(\s]+\1[^;\{\}]+\{\s*(\$\w{1,40})[=\s@]+fopen[\(\s]+__FILE__[,\s'"]+r['"\)\s;@]+fseek[\(\s]+\55[^;]+;\s*eval[\(\s]+base64_decode[\(\s@]+stream_ge\w+[\(\s]+\55[^\}]+\}\s*@?unset[\(\s]+\1[\)\s]+;(?<X1255540>)|fopen[\(\s'"]+\.htaccess['"][\s,]+['"]w['"][\)\s;]+if[\s\(]+\1[\s\)]+\{[^\|!\?]{9,}(\$\w{1,40})[\s='"]+/tmp/sess_['"\s\.]+md5[\s\(]+\$_SERVER\[['"]REQUEST_URI['"\]\)\s]+;[^\|\?]{9,}\|\|\s*filesize[\s\(]+\57[^\(]+base64_decode[\('"\s]+PD9[a-z\d\+/=]{999,}['"][\s\)]+;[^\?]{199,599};\s*\}\s*\}(?<X1213290>))))
(\$\w{1,40})[=\s]+(?:['"](?:(/home\d*/[^/]+/[^/]+/)[^'"]+/['"][\s;]+\$\w{1,40}[=\s]+['"]\2[^'"]*i\w+\.php['"\s;]+(\$\w{1,40})[=\s]+['"]{2}[;\s]+(?:(\$\w{1,40})[=\s]+\1[\s\.]+['"][^'"\$]+\.png['"\s;]+)+if[\s\(]+\3[\s\)\{]+if[\s\(]+(file_)exists[\s\(]+\3[^,]{0,199}\5get_contents[\s\(]+\4[^\?]{9,999}touch[\s\(]+\3[^;]+;(?:\s*\}){4}(?<X1226181>)|/h[^;'"]+/\.[a-z\d]+\.(?:css|gif|ico)['"]\s*;\s*if[\(\s]+!isset[\(\s]+\1[\)\s]+\{\s*strrev[\(\s]+\1[\)\s;]+\}\s*else\s*\{\s*@include_once(?:\s*/\*[^'"]*\*/)?[\(\s]*\1[\)\s;]+\}(?<X1278880>)|<\?[ph\s]*['"][\s;]+(\$\w{1,40})[=\s]+(\$_SERVER)\[['"]HTTP_HOST['"\]\s\.]+\9\[['"]REQ[^\$]{0,99}\$\w{1,40}[=\s]+['"]https?:[^:\?]+\?['"\s\.]+\8[^\{\}@]+(\$\w{1,40})[=\s'"]+(?:@(?:session\w+|set_time\w+|error_r\w+)[^;]+;\s*){3}[^/]+(\$\w{1,40})[=\s]+\1[\s\.]+\10[^:]+file_put_contents[^:]+\11['"\)\s]+;(?<X1249220>)|['"][\s;]+(?:if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\1[=\s]+(?:md5[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^;]+;[\s\}]+)+if[\(\s]+\1[^'";:]+['"]http://\w{2,9}\.[^'"]+\.txt[^;]+(?:exit|die)\b[^;]+form>['"]\);[\s\}]+else\s*\{\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][=\s]+\1[\s;]+\}(?<X1218290>)|[^'"]{1,20}['"]\s*\^\s*['"][^'"]{1,20}['"]\s*;\s*(\$\w{1,40})[=\s]+&\$\1\s*;\s*(\$\w{1,40})[=\s]+array\s*\([^\n]{99,399}\$\w{1,40}\(\15\)[;\s]+(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s@]+\14\[[^,\n]{0,40},\s*\$\w{1,40}[\s\)]+;\s*if[\s\(]+\16\s*[!=]+\s*\$\w{1,40}[\s\)@]+\$\w{1,40}\(\);(?<X1216730>)|[ba'\."se64_dco]{17,}['"];\s*(\$\w+)\s*=\s*\1[\(\s]+['"]PD9[^'"]+['"][\)\s;]+(\$\w+)\s*=\s*\1[\(\s]+['"]PElm[^'"]+['"][\)\s]+;(?:\s*if[\(\s]+\$\w+\s*&&\s*(?:\18|\19)[\s\)]+\{\s*if[^;]+;[^\}]+\}\s*\})+(?<X1278470>)|[file_xst'"\s\.]{19,40}['"]\s*;[^\n\}@!]{0,499}\bif[\s\(]+!\h*\1[\s\(]+\$\w{1,40}\s*\)[^;]+\$\w{1,40}[=\s]+@\$\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;\s*@[^\}]{0,999}@\$\w+[\(\s]+\$\w+[,\s]+\d+[\)\s]+;\s*\}\s*\}(?!\s*\})(?<X1239160>)|[fz][^'"]+\.[a-z]{2,9}\b[^'"]*['"][\s;]+\1[\s=]+['"]https?://[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1259400>)|[index'"\.]{8,}\.php['"][\s;]+(\$\w{1,40})[=\s]+['"][^;]+\.(?:ttc|gif|jpg|png|ico)['"\s;]+if[\s\(]+!isset[\s\(]+\$\w{1,40}[\s\)&]+(file_)exists[\s\(]+\23[\s\)\{@]+chmod[\s\(]+\1[^\}]{9,199}@\24put_contents[\(\s]+\1[,\s]+gzinflate[\(\s]+\$\w{1,40}[\)\.\s]+\$\w{1,40}[,\s]+LOCK_EX[\)\s;]+\}(?<X1221580>)|[index\.ph'"]{12,40}['"][\s;]+(\$\w{1,40})[=\s]+['"]wp\-[^;]+;\s*if[\(\s]+file_exists[\(\s]+\26[^;\{]+\{\s*(\$\w{1,40})[=\s]+(file_get_contents)[\(\s]+\26[\)\s;]+(\$\w{1,40})[=\s]+\28[\(\s]+\1[\)\s;]+(\$\w{1,40})(?:[=\s,]*[strpoub]{6,7}[\(\s]*\29){2}[^\}]{0,99}\27[\)\s\.]+\30[^\}]{0,40}\}(?<X1204250>)|\.htaccess['"]\s*;\s*\$\w{1,40}[=\s]+@base64_decode[\(\s]+['"]PEZpbGVzTWF0[^;]+;\s*if[\(\s]+(file_)exists[\(\s]+\1[\)\s\{]+\$\w{1,40}[=\s]+\32ge(t_contents)[\(\s]+\1[^,]+@chmod[\(\s]+\1[^;]+;\s*@\32pu\33[\s\(]+\1[^;]+;\s*@chmod[\s\(]+\1[^;]+;(?<X1243550>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"][\s;]+\1[\s=]+['"]https?://[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1259410>)|base64_decode['"]\s*;[^=]{0,199}(?:ini_set[\s\(]+['"](?:error_log|display_errors|log_errors)['"]|error_reporting)[,\s\(]+(?:null|0|off)[\s\)]+;[^=]{0,199}\beval\b[^'"\)]{0,99}\1[\s\(]+(?:\$\w{1,40}[\s\(]+)*['"][a-z\d/\+]{99,}['"][\s)]+;(?<X1238561>)|c(?:lass_exists['"]\s*;\s*(\$\w{1,40})[=\s]+\1[\(\s]+\$\w{1,40}[\)\s]+;\s*\$\w{1,40}[=\s]+\37\s*;\s*if[\(\s]+!\$\w{1,40}[\)\s]+\{\s*class\s*(\w+)\s*\{\s*private\s*\$\w{1,40}\s*;[^\?\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\38[\(\)\s;]+\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248270>)|ount['"];\s*(\$\w{1,40})[=\s]+(\$_[GPRSC]\w{2,6});\s*(\$\w{1,40})[=\s]+['"]\w+['"];\s*if[\(\s]+reset[\(\s]+\40[\)\s]+==['"]\w+['"]\.\42&&\1[\(\s]+\40[\)\s]+[>=<!]+\d+[\)\s]+\{\s*@?eval[\(\s]+base64_decode[\(\s]+(?:\41|\40)\[[^\]]+\][\)\s;]+\}(?<X1224484>)|reate_function['"]\s*;\s*@?error_reporting[\(\s]+(?:0|null|false)[\)\s]+;\s*\1[\(\s]+(?:['"]['"]|null)[,\s]+['"][\s\};@]+eval[\s\(@]+base64_decode[\s\(\\]+['"][^'"\$]{99,}['"][\s\)]+;[\s/]*['"][\s\)]+;(?<X1230370>))|eval[\(\s]+(?:\$\w{1,40}[\(\s]+){2,}(\$\w{1,40})\s*\[\s*\d+\s*\](?:[\.\s]+\45\s*\[\s*\d+\s*\][\s\);]*){9,}['']\s*;[^\?]{0,499}\beval[\s\(]+\1[\s\)]+;(?<X1228820>)|h(?:ex2bin['"];\s*(\$\w{1,40})[=\s]+array[\s\(]+\1[^;]{99,};\s*(\$\w{1,40})[=\s]+\47\[\d+\]\s*;\s*(\$\w{1,40})[=\s]+\48[\s\(]+\47\[\d+\][\s\)]*;[^,]{9,499}(\$\w{1,40})[=\s]+\49[\s\(]+__FILE__\s*,[^\[]+\[['"][^'"]+['"]\][\s\;]+(?:\$\w{1,40}[\(\s,]+)+\50[^_]{0,99}__Halt_CompiLer\b[\(\)\s]+;(?<X2227630>)|ttp://['"][\.\s]+\$goweb[\.\s]+['"]/\w+\.php\?[^;\$]+\$\w{1,40}\s*;\s*\$\w{1,40}[=\s]+trim[\(\s]+\w+[\(\s]+\1[\)\s]+;(?<X1227400>)|ttps://(?:%s/ping\?s[^'"]+['"]\s*;\s*(\$\w{1,40})[=\s]+sprintf[\(\s]+\1\s*,[^;]+;\s*\$\w{1,40}[=\s]+\w+[\(\s]+\53[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*var_dump[\(\s]+\53[^\}]+(?:exit|die)\b[^;]*;\s*\}(?<X1259142>)|raw\.githubusercontent\.com/[^'"]*\bshell/[^'"]*['"]\s*;\s*(\$\w{1,40})[=\s]+wp_upload_dir[\(\s]+[\)\s]+\[\s*['"]basedir['"]\s*\][\.\s]+['"][^'"]+\.php['"]\s*;(?:\s*\$\w{1,40}[=\s]+)?@?\w+[\(\s]+\1[,\s]+\55[\)\s]+;(?<X1242300>))|ttps?://(?:['"][\.\s]+\$goweb[\.\s]+['"]/[^\?;]+\?[^;]+;\s*\$\w{1,40}[\s=]+(\w{1,40})[\s\(]+\1[\s\)]+;[^@]{0,9999}\bfunction\s*\57[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+@file_get_contents[\(\s]+\58[\)\s]+;[^\}]+\}\s*return\s*\59[;\s]*\}(?<X1212230>)|[kc]od\d*\.[\w\-]{2,}(?:\.[a-z]+)+/(?:read|[kc]od)[^;]+;\s*(\$\w{1,40})[=\s]+curl_init[\(\s]+\1[\)\s]+;[^\?\{\}]{0,500}\bcurl_close[\(\s]+\61[\)\s]+;(?<X1259861>)|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/?['"]\s*\.\s*\$\w{1,40}[^\\><\n]{99,9999}(\$\w{1,40})[=\s]+\1[^\n!]{99,9999}(\$\w{1,40})[=\s]+(\w+)[\s\(]+\63\s*,[^\n\*]{99,9999}if[\(\s]+strpos[\(\s]+\64\s*,[^\n\*]{99,9999}(\$\w{1,40})[=\s]+\65\s*\([^\?]+echo\s*\66;[^\}]{0,40}\}\s*\}(?:\s*else\s*\{[^\}]{0,99}\})?(?<X1219981>)|cdn\-jsdelivr\.[^'"]+['"]\s*;\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;\s*curl_setopt[\(\s]+(\$\w{1,40})[,\s]+CURLOPT_URL[,\s]+\1[^=]{0,99}(\$\w{1,40})[=\s]+curl_exec[\(\s]+\68[\)\s]+;\s*curl_close[\(\s]+\68[\)\s]+;\s*eval[\(\s]+['"][^'"]*['"][\.\s]+\69[\)\s]+;(?<X1272431>))))|[rfpc]\w{3,15}[\(\s]+['"]https?://yoast\-schema\-graph\.com/[^'"]*['"][\)\s]+;\s*echo\s*\1\s*;(?<X1234470>)|\!\$\w+;\h*\$\w+[=\s]+(?:['"]\d+['"]|\$\w+);\h*if[\(\s]+\1[\)\{\s]+class\s*(\w+)\s*\{\s*private\s*\$\w+;[^\^\n]{1,9999}\^\s*str_repeat[^<\n]{1,9999}\}\s*\$\w+[=\s]+new\s*\72[\(\)\s]+;[^\}]*\}(?<X1254251>))
(\$\w{1,40})[=\s]+(?:\$(?:\s*\{\s*['"]\\x?\d{2,3}['"\.\s\d\\]{9,999}\}[^\}\n]{1,999}(\$\w{1,40})[=\h]+__DIR__\h*\.[^;]+?\1[^;]+;[^\}\n]{0,499}\binclude(?:_once)?[\s\(]+\2[\s\)]+;\s*@?\$?\w+[\s\(]+\2[\s\)]+;\s*\}(?<X1237441>)|\w{1,40}(?:\(\$\w{1,40}\(["']\\{2}['"]\s*,\s*['"]/['"]\s*,\s*__FILE__[\)\s]+;[^@\-\n]{0,999}\$\w{1,40}\s*=\s*(?:\$\w{1,40}\s*=\s*)+(?:['"]{2}|null);\s*\$\w{1,40}[=\s@]+\$\w{1,40}\((?:['"]{2}|null)[,\s]+(?:['"]{2}|null)\);\s*\1\s*=\s*(?:\$\w{1,40}\s*=\s*)+(?:['"]{2}|null);(?<X1217952>)|\s*;(?:\s*\$\w{1,40}[=\s]+(?:['"][^'"]+['"]|\$\w{1,40})\s*;){0,9}\s*if[\(\s]+!\h*\1[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^\n]{99,}\}\s*\$\w{1,40}\s*=\s*new\s*/\*[^\*]*\*/\s*\5[\(\)\s]{2,};[^\}\n]*\}(?<X2253512>)|\s*;\s*if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\n]{99,}\b(?:exit|die)[\(\);\s]+\}[^\?\n]{0,199}\bnew\s*\7[\s\(\)]+;[^\}]*\}(?<X1252270>))|_[GPRC]\w{2,6}(?:\[[^\]]+\][\s;]+if[\s\(]+!empty[\s\(]+\1[\s\)\{]+\$_[GPRCS]\w{2,6}\[[^>]{9,999}=>\s*\$\w+[\)\s;\}]+(\$\w{1,40})[=\s]+\w+[\s\(]+str_rot13[\s\(]+['"]uggcf?://[^'"]+['"][\.\s\)]+\1[\.\s'"]+\.txt['"\s\);@]+eval[\s\(]+['"]\?>['"][\.\s]+\9[\s\)]+;(?:\s*@?(?:exit|die)\b[^;]*;)?(?<X1261080>)|\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\w+[\(\s]+\1[\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\b[^;]+\11[\)\s;]+\bif[\s\(]+\11[^;]+(\$\w{1,40})[=\s]+['"]/tmp/sess[^;\$]+\1[^\}]+@include(?:_once)?[\(\s]+\12[\);\s]+\}(?!\s*else)(?<X1238110>))|_[GPRSC]\w{2,6}(?:\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+\1[\)\s]+;\s*\$\w{1,40}[=\s]+array[\(\s'"]+/https:\\/\\/pastes\\\.io\\\/raw\\/\+[^;:]+:\\/\\/raw\\\.githubusercontent\\\.com\\/[^;]+;\s*(\$\w{1,40})\s*=[^\}]{9,499}\bfile_put_contents[\(\s]+\15[,\s]+\14[\)\s;\}]+include\s*\15;(?<X1224510>)|\s*,[\(\s]*\$\w{1,40}[^\{\}\[\]]{0,99}function\b[^;]+return[^:\?\]]{9,199}array_merge[\(\s]+\$_[GPRSC]\w{2,6}[,\s]+\1[^>]{9,}(\$\w{1,40})[=\s]+empty[\s\(]+\1\[[^\]]+\][^!\n]{9,}stripos[\s\(]+\17\s*,[^;:]+file_put_contents[\s\(]+(\$\w{1,40})[,\s]+\17[^;\?]+\18\s*\?\s*exit[^'";:]*:(?<X1220461>))|_SERVER\[['"]HTTP_USER_AGENT['"\];\s]+if[\(\s]+preg_match[\(\s]+['"]/x64.\)\s*\(\.\*\)\s*.\(/is['",\s]+\1[,\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+\20\[\d+\][\s;]+\21[=\s]+str_replace[\(\s'"]+WebKit[^'"]+['"][,\s]+['"][^'"]*['"][,\s]+\21[\)\s;\}]+else\s*\{\s*@?(?:exit|die)\b[^;]*;\s*\}(?<X1214320>)|http\w+[\.\s]+['"]://['"][\.\s]+\$goweb\d*[\.\s]+['"]/[\w\-]+\.php\?[^;]+\$lang\h*;\s*\$\w{1,40}[=\s]+trim[\(\s]+\w+[\(\s]+\1[\)\s]+;(?<X1214150>))|\[\]\s*;(?:(?:\s*\$\w{1,40}[=\s]+\d+\s*;)*\s*\1\s*\[\s*\d+\s*\][=\s]+\w+[\(\s]+Array[\(\s]+\d+\s*,[^\)]*\)[\s\)]+;){9,}(?:\s*\$\w{1,40}[=\s]+\d+\s*;)*\s*\$\w{1,40}[=\s]+\$_COOKIE\s*;[^\^]{99,}\b\w+[\s\(]+\1,\1\[[^;]+;\s*\}(?<X2253700>)|\d+\s*;\s*foreach[\(\s]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}[=\s]+>\s*\$\w{1,40}[\)\s]+\{\s*if[\(\s]+strstr[\(\s]+strval[\(\s]+\$\w{1,40}[\)\s,'"]+wordpress_logged_in['"\s\)]+\{\s*\1[^\}]+\}\s*\}\s*if[\s\(]+\1[^;]+\bconst\s*\w{1,40}\s*=[\d\*\s]+;[^<]{9,9999}\}\)\(\)[;\s]*</script>['";\s]*\}(?<X1214972>)|\w{1,40}(?:[\(\s]+(?:(\$\w{1,40})[\)\s]*=>\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+FgEtS[\(\s]+FoPeN[\(\s]+StRrEv[\(\s]+StRtR[\(\s]+\26[,\s]+['"]\\x[\da-f]{2}\\[\\x\da-f]{99,}['"]\s*,\s*['"][\\x\da-f]{99,}['"][\s\),]+\d+[\s\)]+;\s*\1[\s\(]+['"][\\x\da-f]{9,}['"][\s\)]+;(?<X1224940>)|\$\w{1,40}[\)\s;]+if[\(\s]+strstr[\(\s]+\1[,\s]+['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+explode[\(\s]+['"][^'"]*['"][,\s]+\1[\)\s]+;(?:\s*if[\(\s]+\28\s*\[\d+\][^\}]{0,199}\becho\s*\28\s*\[\d+\][^;]*;[^\}]{0,199}\}){2,5}\s*\}(?<X1202900>))|\s*(?:\(\)[;\s]*if[\(\s]+!empty[\(\s]+\1[\)\s]+\{\s*\$\w{1,40}[=\s@]+\w{1,40}\s*\([^\}]{40,499}(\$\w{1,40})[=\s]+curl_exec[\(\s]+\$\w{1,40}[\)\s;]+\}\s*else\s*\{\s*\30[=\s]+file_get_contents[\(\s]+base64_decode[\(\s'"]+aHR0cDovL[a-z\d/\+]{9,99}=?=?['"\)\s;]+\}\s*echo\s*\30\s*;\s*\}\s*\}(?<X1204730>)|\^\s*(['"])[^;]+\32\s*;\s*(\$\w{1,40})[=\s]+['"]([^'"]+)['"]\s*;\s*\1[\s\(]+.?['"](.)\33\35e\w?.?['"]\s*,\s*['"][^\^]+\^[^,]+,\s*['"]\34['"][\s\)]+;(?<X1057382>)))|__DIR__[\.\s]+['"]/[^'"]{3,40}\.(?:png|jpe?g|ico|gif)['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+\1[\)\s]+;\s*if[\(\s]+\37[\)\s]+\{\s*@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\37[\)\s]+;[\s\}\?>]*\Z(?<X1222520>)|array[\(\s'"]+index['"][^;\)]+['"]wp\-config['"\)\s;]+foreach[\(\s]+\1\s*as\s*(\$\w{1,40})[\)\s]+\{\s*\bif[\(\s]+\39\s*==+\s*['"]\.htaccess['"\s\)]+(\$\w{1,40})[^\{\}]+\39\s*\.\s*['"]\.php['"];[^;]+clearstatcache[^;]+\40[\s\);]+(\$\w{1,40})[^\}]+@fclose[\(\s]+\41[\)\s]+;(?:\s*\}){4}(?<X1212700>)|base(?:64_decode(?:[\(\s'"]+L(?:2[^'"]{1,99}(?:(?:Ly5jYWdlZnMvL|LmNhZ2Vmcy8u|Y2FnZWZzLy4u|Ly5jcGFkZG9ucy8)[^'"]+|uLi4|Li4u)['"][\s\)]+;\s*if[\s\(]+!is_file[\s\(]+\1[\s\)]+\|+\s*filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*(\$\w{1,40})[\s=]+@?fopen[\s\(]+\1[,\s]+['"][wa][^;]+;\s*@?fwrite[\s\(]+\43[,\s]+file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0[^;]+['"][\s\)]+;[^\}]{0,99}\}(?!\s*else)(?<X1217990>)|[23][^'"]{1,99}uLg['"][\s\)]+;\s*if[\s\(]+!is_file[\s\(]+\1[\s\)]+\|+filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]\1[\s,]+\45ge\46[\s\(]+base64_decode[\s\(]+['"]aHR0[^;]+['"][\s\)]+;\s*\}(?!\s*else)(?<X1218050>)|i4u['"][^\{\}]{1,499}\{[^,\}\[]{0,999}(\$\w{1,40})\s*=[^;*]+\1\b[^;]*;\s*(\$\w{1,40})\s*=[^;*]+\48\b[^;]*;[^!]{0,999}(\$\w{1,40})\s*=\s*fsockopen[\(\s]+\49[^;]+;[^\[]{0,499}(\$\w{1,40})\s*=[^;]+\50[^\?]{0,499}\becho\s*\51\s*;\s*\}\s*\}(?<X1240142>))|[\(\s]+['"](?:[^'"]{1,99}['"][\)\s;]+\$\w{1,40}[=\s]+file_ge\w+[\(\s'"]+https?:[/'"\.\s]+\1[\.\s]+['"][^'"]+\.php['"][\)\s;]+\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+if[\(\s]+defined[\(\s'"]+PHP[^;\{]+\{\s*\$\w+[\s=]+base64_decode[\('"\s]+PD9[^\}]+\}[^\*:\|]+file_pu[^;]+;(?<X1256110>)|PC9oZWFk\w{0,9}=?=?['"][\)\s;]+(\$\w{1,40})[=\s]+\1[\s;]+(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]PHNjcmlwdD4gZG9jdW1lbnQud3JpdGUoIjxzY3Jpc[^;\)'"]+['"][\)\s;]+(\$\w{1,40})[=\s]+\55\s*\.\s*['"](?:\\r)?\\n[^'"]*['"]\s*\.\s*\54\s*;[^\}]+\bstr_replace[\(\s]+\$\w{1,40}[,\s]+\56\s*,[^:;]+;\s*\}\s*\}(?<X1250900>)|PD9[^'"]{9,40}YmFzZTY0X2RlY29kZSgnUEQ5[a-z\d/\+]{999,}=?=?['"][\s\)]+;(?:\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s'"]+/[^'"]+\.php['"][,\s]+['"][aw]\+?['"][\)\s;]+fwrite[\(\s]+\58[,\s]+\1[\.\s]+PHP_EOL[\)\s;]+fclose[\(\s]+\58[\)\s]+;)+(?<X1229670>)))|name[\(\s]+(?:__FILE__[,\s]+(base64_decode)[\(\s]+['"](LnBocA[=\+]*)['"][\)\.\s]+\60[\(\s]+['"]\61['"][\)\s]+;\s*\$\w{1,40}[=\s]+file_get_contents[\(\s]+\1[\)\s]+;[^/]{0,999}\$\w{1,40}[=\s]+(?:\60[\s\(]+){2,}['"][^'"]+['"][\s\)]+;[^<>]{999,}<\s*rand\s*\([^<>]+\.php\s*>\s*/dev/null(?<X2228190>)|trim[\(\s]+preg_replace[\(\s]+\$\w{1,40}[\(\s]+['"]/\\[\(,\s]+\.\*\$/['",\s\)]+__FILE__[\)\s]+;\s*\1[=\s]+substr[\(\s]+str_repeat[\(\s]+\1[,\(\s]+strlen[\(\s]+(\$\w{1,40})[\)\s/]+strlen\b[^;]+;\s*(?:eval|assert)[\(\s]+(?:\1|\63)\^(?:\1|\63)[\)\s]+;(?<X2230280>))))
(\$\w{1,40})[=\s]+(?:c(?:hr[\(\s]+\d+[\)\.\s]+substr[\s\(]+['"][^'"]+['"][^;]+;\s*(\$\w{1,40})[=\s]+\1[\s\(]+substr[\s\(]+\$\w{1,40}[^;]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\2[\)\s]+;(?<X1222840>)|lass_exists[\(\s]+\$\w{1,40}[\)\s]+;\s*(\$\w{1,40})[=\s]+\1\s*;\s*if[\(\s]+!\4[\)\s\{]+class\s*(\w{1,40})\s*\{[^\n]{99,9999}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\5[\(;\)\s]+\$\w{1,40}[=\s]+NULL[;\s]+\}(?<X1248102>)|url_init(?:[\(\)\s;]+(curl_setopt)[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+['"]https?://[^'"\$]{9,}/\w{1,4}\.txt['"][\)\s]+;\s*\7[\(\s]+\1[,\s]+CURLOPT_RETURNTRANSFER[,\s]+\d+[\)\s;]+(\$\w{1,40})[=\s]+curl_exec[\(\s]+\1[\)\s;]+curl_close[\(\s]+\1[\)\s;]+echo\s*\8[\s;\?>]*\Z(?<X1229801>)|[\(\)\s]+;\h*curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0c[^'"]+['"][\s\)]+;[^\n=]{0,99}curl_setopt[\(\s]+\1[,\s]+CURLOPT_USERAGENT[,\s]+['"]Mozilla/[^\)]+\)['"\)\s]*;[^=\n]{0,999}(\$\w{1,40})[=\s]+curl_exec[\s\(]+\1[\s\)]+;\h*@?eval[\s\(]+\10[\s\)]+;(?<X1235270>)|[\(\s]+base64_decode[\(\s]+['"]aHR0c[^'"]{9,199}["'][\s\)]+;\s*curl_setopt[\s\(]+\1[,\s+]CURLOPT_RETURNTRANSFER[^;]+;\s*(\$\w{1,40})[=\s]+curl_exec[\s\(]+\1[\s\)]+;\s*@?eval[\s\(]+base64_decode[\s\('"]+Pz4[=\+]{0,2}['"][\s\.\)]+\12[\s\)]+;(?<X1223830>)))|explode[\(\s]+['"][^'"]*['"][,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+!\$_COOKIE\[[^\?\n]{9,999}curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s'"]+aHR0c[\w\+/=]+['"][\)\s]+\.['"\s]*\?[^\+\n]{9,299}(\$\w{1,40})[=\s]+file_get_contents[\(\s'"]+https?:[^&\n]+\14[^\}]+(?:exit|die)[^;]*;\s*\}(?<X1238570>)|f(?:ile_get_contents[\(\s]+['"](?:[^'"\$]+\.js['"][\)\s]+;\s*@?(?:passthru|system|exec|shell_exec|popen|eval|assert)[\(\s]+base64_decode[\(\s]+\1[\)\s]+;(?<X1234180>)|https://(?:\w+\.githubusercontent\.com/\w+/wso-webshell[^;]+;\s*file_put_contents[\(\s]+\$\w{1,40},\s*\1[\)\s]+;(?<X1233421>)|raw\.githubusercontent\.com/SilenceIsGold[^'"]{9,199}['"][\)\s]+;\s*echo\s*\1\s*;(?<X1220822>)))|unction[\(\s]+\$\w{1,40}(?:[,\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]*['"][\s;]+\$\w{1,40}[\s=]+['"][^'"]+['"][\s;]+\$\w{1,40}[\.\s=]+\$\w{1,40}\[[\(\s]\d+\s*[\*\-\+/]\s*\d+[^\]]*\]\s*\.[^\?]{999,}\$\w{1,40}[=\s]+['"][a-z\d/\+]{999,}['"][;\s]*(\$\w{1,40})[=\s]+\1[\s\(]+\19[^\?]{0,40}\$\w{1,40}[\s\(]+\19[\s\)]+;(?<X1211070>)|[\)\s]+\{\s*\$\w{1,40}[=\s]+['"](?:['"]\s*;\s*\$\w{1,40}[=\s]+['"]Mozilla/[^\?]{99,9999}\{\s*(\$\w{1,40})[\s=]+['"]aHR0c[^\}]+\}[^\*]{0,999}\becho\s*\1[\s\(]+\21[\s\)]+;\s*\}\s*\}(?<X1237790>)|[^'"]+['"]\s*;\s*\$\w{1,40}[\s=\.]+\$\w{1,40}\s*\[[\(\s]*\d+\s*[\-\*/\+][\s\(]*\d+[^;]+;[^\?]{99,999}\$\w{1,40}[=\s]+\1[\(\s]+(\$\w{1,40})\);\s*\23[=\s]+\$\w{1,40}[\(\s]+\23[\);\s]+\$\w{1,40}[\s\(]+\23[\s\)]+;(?<X1211290>))))|get_(?:contents[\(\s]+str_rot13[\(\s'"]+uggc[^'"]{6,}['"][\)\.\s]+['"][^'"]*['"][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\s]+\1[\)\s]+;(?<X1210550>)|users[\(\s\[]+['"]role['"=>\s]+(administrator)\b[^;]+;\s*foreach[\s\(]+\1\s*as\s*(\$\w{1,40})[\s\)]+\{\s*if[\(\s]+user_can[\(\s]+\27[,\s'"]+\26['"\)\s]+\{\s*if[\(\s]+function_ex\w+[\(\s'"]+(wp_set_cur\w+)['"\)\s]+\{\s*\28[\s\(]+(\27\->id)[^;]+;\s*wp_set_au\w+[\s\(]+\29[^\}]+\}(?:\s*\}){2}(?<X1258340>))|isset[\(\s]+(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\?\s*\31\s*:\s*(?:false|0|null)\s*;\s*if[\(\s]+\1\s*\S{2,3}\s*['"][^'"]+['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]|\1)[,\s]+\$\w{1,40}[^=]{0,99}\}(?!\s*else)(?<X1212900>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\?\s*trim[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+;\s*(\$\w{1,40})[=\s]+(\w{1,40})[\(\s]+['"][^'"]*['"][\.\s]+\1[\)\s]+;\s*@eval[\(\s]+\33[\)\s;]+function\s*\34[\(\s]+\$url\d*[\)\s]+\{\s*(?:(?:else|if)[^\}]+return\s*\$\w{1,40}[\s;]+\}\s*)+\}(?<X1205280>))|md5[\(\s]+\1[\)\s;]+\$\w{1,40}[=\s]+strlen[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+urldecode[\(\s]+base64_decode[\(\s]+\36[\s\);]+\$\w{1,40}[=\s]+strlen[\s\(]+\36[^'"]{1,99}(\$\w{1,40})[=\s]+['"]['"][^#]{99,9999}if\(substr\(\37[^;]+\1[^;]+eval\b[^;]+\37[^\}]{0,40}\}(?<X1219100>)|new\s*\w{1,40}\s*\(\);\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[(\w+::\w+)[\(\s]+['"]\w+['"]\s*[\.,][^\]]+\][\)\s]+&&\s*isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+null\s*;[^%]+\bcase\s*\39[^;]+\40[\s=]+\1\->[^\}]+\}\s*(?:die|exit)[\s\(]+\40[\s;\)]+\}(?<X2221471>)|ob_get_clean[\(\)\s;]+ob_start\(\);\s*(\$\w{1,40})[=\s]+['"].<body[^;]+;\s*if[\(\s]+preg_match[\(\s]+\42[,\s]+\1[,\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+\43\[\d+[\]\s;]+\$\w{1,40}[=\s]+base64_decode[\(\s]+['"]aHR0c[^'"]+['"][^\.]{0,999}\44\s*\.=\s*['"]<script(?:[^\}]+\}){2}\s*echo\s*\1;(?<X1255550>)|preg_replace[\(\s]+(\$\w{1,40})[\(\s]+['"].\\?\(\.\*\$.['"][\),\s]+['"]['"][,\s]+__FILE__[\)\s;]+\1[=\s]+trim[\(\s]+\1[\)\s]+;\s*\46[=\s]+substr[\(\s]+\46[,\s]+\d+[\)\s]+;\s*\1[=\s]+basename[\(\s]+\1[\)\s]+;\s*return\s*\1\s*;(?<X2255310>)|range[\(\s]+chr[\(\s]+\d+(?:(?:[\),\s]+chr[\(\s]+\d+[\)\s]+)+;(?:(?:\s*(\$\w{1,40})\s*=\s*(?:array)?[\$\(@\{]*?\1\[\d+\]\s*(?:[\.\}\[,]+\s*\1\[\d+\]+){5}[^;]+;)+[^\}]+@\48\[\d+\]\(['"]{2}[,\s]+\1\[[^;]+;\s*\b(?:exit|die)\b[^;]{0,19};\s*\}(?<X1210220>)|(?:\s*(\$\w{1,40})\s*=\s*(?:array)?[\$\(@\{]*?\1\[\d+\]\s*(?:[\.\}\[,]+\s*\1\[\d+\]+){5}[^;]+;)+\s*(\$\w{1,40})\s*=\s*@?\50[\s\(]+\1\[\d+\](?:[\.,\s]+\1\[\d+\]){9,}\)\s*;\s*@\51[\s\(]+['"][^'"]{999,}['"][\s\)]+;(?<X1210210>))|(?:[\),\s]+chr[\(\s]+\d+[\)\s]+;\s*(\$\w{1,40})[=\s]+\$[\{\s]+\1\s*\[\d+\](?:\s*\.\s*\1\s*\[\d+\])+[\s\}]+;\s*if[\(\s]+in_array[\(\s]+gettype[\(\s]+\53[\)\.\s]+count[\(\s]+\53[\)\s]+[,\s]+\53[\)\s]+\S{2,3}\s*count[\(\s]+\53[^;]+&&\s*\53\s*\([\s\);]+\}(?<X1214911>)|\s*\)(?:[,\s]+chr[\(\s]+\d+[\)\s]+)+;(?:\s*(\$\w{1,40})[=\s]+\$\{\s*\1\[\d+\](?:\s*\.\s*\1\[\d+\])+\s*\}\s*;)+\s*@\(count\(\55\)\S{2,3}\d+\S{2,3}\bin_array\(gettype\(\55[^;@]+@\55[\s=]+\55\[\d+\][\(\s]+\55\[\d+\][\s,]+\55\[\d+\]\([^:;]+\55[\s\(\)]*:\s*\55[\s\(\)]*;(?<X1211691>)))|s(?:tr(?:rev[\(\s]+base64_decode[\(\s]+strrev[\(\s]+\1[\)\s]+;\s*(\$\w{1,40})[=\s]+tmpfile[\(\)\s]+;\s*(\$\w{1,40})[=\s]+stream_get_meta_data[\(\s]+\57[^:]+;\s*fwrite[\(\s]+\57[,\s]+\1[^\}]{0,99}include(?:_once)?[\(\s]+\58[\)\s]+;\s*\}\s*fclose[\(\s]+\57[\)\s]+;(?<X1221440>)|val[\(\s]+(\$_SERVER\[)['"]HTTP_REFERER['"]\][\)\s;]+\$\w{1,40}[=\s]+\w{1,40}[\(\)\.\s]+\60[^\]]+\][\s;]+if[\(\s]+strpos[\(\s]+\1[^;]+;\s*(\$\w{1,40})[=\s]+array\b[^:\{\}]{9,499}(\$\w{1,40})[=\s]+\w+['"\(\s]+https?://\w+\.\w+(?:\.\w+)+/?['"][^;]+\61[^\?]{99,999}echo\s*\62[^;]+;[^\}]{0,40}\}(?<X1223711>))|ubstr[\(\s]+(?:@\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE['"]\][,\s]+0[,\s]+\d+[\)\s]+;[^\{\}]{0,199}(\$\w{1,40})[=\s]+['"][^'"\$]+['"]\s*;\s*(\$\w{1,40})[=\s]+curl_init\s*\([^:]{0,99}://[^;]+\64[^;]+;[^'"]{0,999},[^:]+\1[^;]+;[^!]+curl_close[\s\(]+\65[\s\)]+;(?<X1239790>)|file_get_contents[\(\s]+__FILE__[\),\s]+\-\d{3,}[\)\s]+;(?:\s*\1[=\s]+str_replace[\(\s]+['"][^'"]*['"][,\s]+['"][^'"]*['"][,\s]+\1[\)\s]+;){2,}\s*(\$\w{1,40})\s*=\s*['"\h\.gzuncompres]{15,40};\s*@?eval[\s\(]+\67[\s\(]+\1[\s\)]+;\s*(?:exit|die)\b[^;]*;(?<X1279751>)))|tmpfile[\(\);\s]+(\$\w+)[=\s]+rawurldecode[\(\s]+base64_decode[\(\s]+\$\w+[\)\s;]+fwrite[\(\s]+\1[\s,]+['"]<\?[ph\s]*["'][\s\.]+\69[\s\);@]+include(?:_once)?\s*stream_get_meta_data[\(\s]+\1[\)\s]+\[[^\]]+\][\s;@]+fclose[\(\s]+\1[\)\s]+;(?<X1249110>)|u(?:niqid[\(\)\s]+;\s*if[\s\(]+@copy[\s\(]+['"]https?://paste\.ee[^\$]+\1[\s\.]+[^\{]+[\{\s]+echo\s*\1[\s\.]+[^\?]+echo\s['"]Fail\.['"];[\s\}]+(?<X1218440>)|pload_shell[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+(?:!empty|isset)[\(\s]+\1[\)\s\{]+(\$\w{1,40})[\[\]=\s]+['"]http://['"][\.\s]+\1[\s;\}]+echo\s*serialize[\(\s]+\72[\)\s]+;(?<X2222130>)))
(\$\w{1,40})\h*=\h*(?:(?:\$\w{1,40}\.){1,9}\$\w{1,40};\s*if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\h*\[\1\([^\]]+\][^\}\n]{9,999}(\$\w{1,40})\h*=\h*\1\(['"][^"']+['"]\);[^\}\n]{0,999}\bmail[\s\(]+\2\h*,[^;]+;\s*\}(?<X1194740>)|(?:bin2hex|hex2bin)\h*\(\h*\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\)\h*;\h*(\$\w{1,40})=['"][^;]{1,99};\h*(\$\w{1,40})\h*=\h*(?:bin2hex|hex2bin)\h*\(\h*\4\h*\)\h*;\h*\5\h*\(\h*(?:bin2hex|hex2bin)\h*\(\h*\1(?:\h*\)){2}\h*;(?<X1189500>)|(?:null|['"]{2}|false);\s*switch\h*\(\h*\$\w{1,40}\)\s*\{[^\$]{0,99}\1\h*=\h*new\h+Flooding\h*\(['"](?:udp|tcp)://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}['"]\h*,\h*(?:80|443|8?53),\h*\d+\h*\)\h*;\s*\1->(?:Udp|Tcp)Flood\h*\(\);(?<X2142021>)|([peas](?:assthru|ystem|xec?(?:ute)?|hell_exec|open))\(['"]gcc\h+\-o\h+(/tmp/\S+)\h+(/tmp/[^\s'"]{1,49})['"]\);\s*@?unlink\(['"]\10['"]\);\s*\1\h*=\h*\8\(['"]\9(?<X2142270>)|(\$\w{1,40})\[\d+\]\h*(?:\.\h*\12\[\d+\]\h*)+;(?:\s*(\$\w{1,40})[\h=]+['"][^'"]{0,40}['"][\h\.]+chr\(\d+\)\h*(?:\.['"][^'"]{0,40}['"][\.\s]+chr\(\d+\)\h*)+(?:\.['"][^'"]{0,40}['"]\h*)?;)+\s*(\$\w{1,40})[\h=]+\$\w{1,40}[\s\.]+\13;\s*\1\(\12\[\d+\]\h*(?:\.\h*\12\[\d+\]\h*)+,\h*\14\h*,[^;]{0,19};(?<X1187950>)|(\$\w{1,40})\h*=\h*substr\h*\(\h*\$_SERVER\h*\[['"]PHP_SELF['"]\]\h*,[^;]{1,99};\s*function\h+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*if\h*\(\h*@?chmod\h*\(\h*\18\h*,\h*\d{3,4}[^;]+;\s*\}[^\}]{1,99}(?:\}\s*)+\17\h*\(\h*(?:\1|\16)\h*\)\h*;(?<X1167070>)|(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*;\s*echo\h*\1\h*;\s*if[\(\s]+!?(?:empty|isset)?[\(\s]+\$(?:auth|s)_pass[\)\s]+\{\s*if[\s\(]+isset[\(\s]+\20[^;]+setcookie[\(\s]+md5[\(\s]+\$[^;]+;[^\}]{0,999}\bws[[o0](?:L[o0]gin)?[\(\s\)]+;\s*\}(?<X1189720>)|(base64_decode)\(['"]Y29weQ=?=?['"]\);[^\?]{99,999}\bif\(\$_[GPRSC]\w{2,6}\h*\[\22\(['"]\w{2,8}[=\+]{0,2}['"]\)\]\h*\D{2,3}\h*\w{2,40}\h*\)\s*\{\s*if\h*\(\h*@?\1\h*\(\h*\$_FILES\[\22\(['"]\w{2,8}[=\+]{0,2}['"]\)\][^;]+;\s*\}\s*else\s*\{[^\}]+\}(?:\s*\}){2}(?<X1163532>)|(curl_)init\h*\(\h*['"]https?://[^/\.]{1,40}\.github(?:usercontent)?\.(?:io|com)/[^;]{1,99};[^\?\}]{1,199}\$(\w{1,40})\h*=\h*\24exec\h*\(\h*\1\h*\);\s*@?(?:eval|assert)\h*\(\h*['"]\?>(?:['"]\h*\.)?\h*\$\25\h*(?:['"]\h*)?\);(?<X1173182>)|(JRequest::getString\()[^;]+(['"]cookie['"])[\)\h]+;\s*if[\s\(]+\1[\s\)\{]+(\$\w{1,40})[\h=]+\1[\h\(]\27[^;]+\28[\)\h]+;\s*(\$\w{1,40})[\h=]+\1[\h\(]\27[^;]+\28[\)\h]+;[^\}]{0,40}(?:\29|\30)[\s\(]+['"].(.{0,40}).e['"][\s,]+(?:\29|\30)[\h,]+['"]?\31['"]?[\h\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190840>)|(str_i?replace)\h*\(\h*['"][^'"]{1,9}['"]\h*,\h*['"]['"][^;]+\)\h*;\s*(\$\w{1,40})\h*=\h*\33\h*\(\h*['"][^'"]{1,9}['"]\h*,[^;]+\)\h*;\s*(\$\w{1,40})\h*=\h*(?:\1|\34)\h*\(\h*\33\h*\([^;]+;[^\{\}\?\[\]]{1,199}\$\w{1,40}\h*\(\h*\1\h*,\h*\35\h*\)\h*;(?:\s*(?:include|unlink)?\h*\(?\1\)?;){2}(?<X1165520>)|@(\$_SERVER\[)['"]HTTP_ACCEPT_LANGUAGE['"\]\s;]+\$\w{1,40}[\s=]+(urlencode)[\(\s]+\1[\)\s;]+(\$\w{1,40})[\s=]+['"]{2}[;\s]+if[\(\s]+isset[\(\s]+(\37[^\]]+\])[\)\s\{]+\39[=\s]+\40[\s;]+\39[=\s]+\38[\(\s]+\39[\)\s;\}]+\$\w+[=\s]+(?:(?:sha|md)[1526]+[\(\s]+)+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X1237350>)|@?((file_)ge(t_contents))\h*\(\h*(\$\w+)\h*\);\s*(\$\w+)\h*=\h*filemtime\h*\(\h*\45\h*\);[^\{@!]{1,99}\b(?:(?:if\([^\)]+\)|else)\s*\{\s*@?\43pu\44\h*\(\h*\45\h*,\h*\1\h*\.\h*['"](?:\?>)?['"]\h*\.\h*\42\h*\([^;]{1,99};\s*@?touch\h*\(\h*\45\h*,\h*\46\h*\);\s*add_option\([^;]{1,99};\s*\}\s*){2}(?<X1170710>)|@?(file_)ge(t_contents\()[^;]{1,99};\s*@?\48pu\49(\$\w{1,40}),\h*\1\);\s*(?:@?chmod\(\h*\50,[^;]{1,99};\s*)?(\$\w{1,40})\h*=\h*['"][^'";]{0,99}\50\h*&?>[^;]{1,99};\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\(\h*\51\b[^;]{1,99};(?<X1183011>)|@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*@?\1[\s\(]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(\$\w{1,40})\h*=\h*@?\1[\s\(]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(?:\53|\54)[\s\(]+.?['"](.).{0,40}\55e\w?.?['"]\s*,\s*\$\w{1,40}\h*,\h*['"]?\w{1,40}['"]?[\s\)]+;(?<X1191620>)|@?trim[\(\h]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;\s*if[\(\h]+\1[\h\)]+\{\s*(\$\w{1,40})[\h=]+strrev[\(\h]+['"]31t[^\}]+\$\w{1,40}[\h=]+\57[\(\h]+['"][^\}]+\1[\)\s\'";]+(\$\w{1,40})=\$\w{1,40}\(\57\([^;]+;\s*(\$\w{1,40})[\h=]+\58\(['"]{2}[^\}]+\59\(\);\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1184040>)|@get_current_user\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*['"]\1['"]\h*;[^\}><\?]{1,499}(\$\w{1,40})\h*=\h*['"]From:\h*<\61>[^;]{0,9};[^;]{0,99}\bmail\h*\([^;]+\62\h*\)(?:[\s\)]+(?:else\s*)?\{\s*echo[^=\}]{1,99}\}){1,2}(?<X1171510>)|@gz(?:inflate|uncompress)[\(\h]+strrev[\(\h]+\$\w{1,40}[\)\h]+;[^\?]{0,499}\bif\s*\(\s*crc32[\s\(]+\1[\)\s]+\S{2,3}\s*\$\w+[\)\s]+\{\s*(\$\w{1,40})\s*=\s*create_function[\s\(]+['']\$\w+['"][,\h]+\$\w{1,40}[\)\s]+;\s*@?\64[\s\(]+['"][^"']+['"][\)\s]+;\s*\}(?<X1038773>)|['"\.preg_lac\h]{14,69};\s*@?\1(?:\h*\(\h*['"](\W)[^,]{1,49}\66e['"]\h*,\h*\$_[GPSCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?<X1147942>)|\s*\(\s*['"](\W)[^,]{1,49}\68e['"]\h*,\h*\$_[GPSCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?:\s*(?:exit|die)[^;]{0,9};)?(?<X1148333>))|['"\s\.creat_funio]{20,40}\h*;\s*(\$\w{1,40})\h*=\h*\1\h*\(\h*['"](\\?\$\w{1,40})['"]\h*,\h*['"][eval'"\.\h]{9,40}['"]\h*\(\h*['"][\?>]{2}['"]\h*\.\h*['"\h\.base64_dco]{20,40}\(\71[\h\)]+;\h*['"]\h*\)\h*;\s*\70\h*\(\h*['"][^'"]{999,}['"][\h\)]+;(?:\s*(?:exit|die)\b[^;]{0,9};)?(?<X1156870>)|['"]['"\h\.base64_ncod]{15,40}['"]\h*;\s*(\$\w{1,40})\h*=\h*\1[\(\h]+\$\w{1,40}[\)\h]+;[^#`]{9999,19999}\.\h*\73;[^!\{]{0,99}if[\h\(]+!\h*strstr\h*\(\h*(\$\w{1,40})[^\*\|]{99,999}\bheader[\h\(]+['"]Location:\h*['"][^;]+\74[\h\)]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\}){3}(?<X1190770>)|['"][^'"]{0,49}\.htaccess['"];\s*(\$\w{1,40})\h*=\h*['"]\1['"];\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*\76[^;]{1,49};\s*(\$\w{1,40})\h*=\h*['"][^'"]{1,199}\b(?:AddHandler\h+cgi\-script\h+\.cin\s*){2}['"];\s*fwrite\h*\(\h*\77\h*,\h*\78\h*\)\h*;(?<X2146420>)|['"][^'"]{1,40}['"]\^['"][^'"]{1,40}['"]\h*;\h*(\$\w{1,40})\h*=\h*\1\h*\(\h*['"]{2}\h*,\h*['"]{2}\h*\^\h*['"]{2}\h*\)\h*;\h*@?\80\h*\(\)\h*;(?<X1166240>)|['"][^'"]{40,499}['"];\s*(\$\w{1,40})\h*=\h*(\$this\h*\->\h*\w{1,40}\h*\()\h*['"]\w{9,99}['"]\s*\);\s*(\$\w{1,40})\h*=\h*\82\h*\(\h*['"]{2}\h*,\h*\83\h*\1[\h\)]+;\s*\84\h*\([\h\)]+;(?<X1187330>)|['"][^'"]{49,99}['"];\s*if\h*\(\h*(version)_compare\(\h*PHP_\86\h*,[^\)]{1,49}[\)\s]+\{\s*@?error_reporting\([^;]{1,199};\h*\}\h*(\$\w{1,40})\h*=\h*str_i?replace\([^\)]+\1\);\s*(\$\w{1,40})\h*=\h*['"][^'"]{9999,}['"];\h*(\$\w{1,40})\h*=\h*\87\(\88\);\s*@?\w{1,40}\(\89[^;]{0,19};(?<X1143881>)|['"][^'"]{9,99}['"];\s*(\$\w{1,40})\h*=\h*(['"]['"]);\s*foreach\(\[[\d,]{9,13}\]\h*as\h*(\$\w{1,9})[\)\s]+\{\s*\91\h*\.=\h*\1\[\93\];\s*\}\s*if\(isset\(\$_[GPRSC]\w{2,6}\h*/\*[^\*\v]{99,}\*/\h*\[[^@:\->]{99,9999}\$\w{1,19}\h*=\h*\$\w{1,19}\(\92,\h*\$\w{1,19}\(\$\w{1,19}[\h\)]+;\s*\}(?<X1140080>)|['"][^'"]{9,99}['"]\h*;\s*\bif\h*\(\h*(version)_compare\h*\(\h*PHP_\95\h*,[^\)]{1,49}[\)\s]+\{?\s*error_reporting\([^;]{1,199};\s*(?:\}\s*)?\$\w{1,40}\s*=\s*str_i?replace\h*\([^\)]+\1\h*\)\h*;(?<X2143871>)|['"][preg_lac'"\.\h]{14,40}['"]\h*;\s*@?\1\h*\(\s*.?['"](.).{0,40}\97e\w?.?['"]\s*,\h*['"][eval\h\.'"]{4,40}\([^;]{1,99}\)\h*;(?<X1191010>)|['"]\\x63\\x72\\x65\\x61\\x74\\x65\\x5f\\x66\\x75\\x6e\\x63\\x74\\x69\\x6f\\x6e['"]\h*;\s*(\$\w{1,40})\h*=\h*@?\1\h*\(\h*['"][^'"]{0,9}['"]\h*,\h*['"][^'"]+['"]\h*\)\h*;\s*@?\99\h*\(\h*['"][^'"]{999,}['"]\h*\)\h*;(?<X1188410>)|['"]\w{1,9}['"];\s*\1\h*=\h*['"]\w{1,9}['"]\h*\.\h*\1\h*\.\h*['"]\w{1,9}['"];\s*if\h*\(\h*\$\w{1,40}\W{2,9}\$\w{1,40}[\s\)]+\{\s*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,[^;\}]+\1\h*\(\h*array\h*\([^\}]+(\$\w{1,40}\);)\s*\}\s*else\s*\{\s*\1\h*\(\h*array\h*\([^;]+\101(?:\s*\}){2}(?<X1165482>)|['"]aHR0cHM6Ly9zZW9oYWNr[^'"]{9,99}['"]\h*;(?:\s*\1[\s=]+(?:base64_decode|file_get_contents)[\s\(]+\1[\s\)]+;)+\s*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\h\(]+(?:(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\1[\s\)]+;(?<X1192670>)|['"]aWYobWQ1K[^;]{9,999}['"]\h*;\h*@?\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)(?:[\h\(]+(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\s*\1[\s\)]+;(?<X1192510>))
(\$\w{1,40})(?:[=\s]+wp_(?:create_user[\(\s]+['"][^'"\$]+['"][,\s]+['"][^'"]+['"][,\s]+['"][^'"]+['"][\)\s]+;\s*\$\w{1,40}[=\s]+new\s*WP_User[\(\s]+\1[\)\s]+;\s*\$\w{1,40}\->set_role[\(\s]+['"]administrator['"][\)\s]+;[\?>\s]*\Z(?<X1210150>)|upload_dir[\(\);\s]+(\$\w{1,40})[=\s]+\1\[['"]basedir['"]\][\s\.]+['"]/\w+['"\s;]+if[\s\(!]+is_dir[\s\(]+\3[\s\)\{]+wp_mkdir_p[\s\(]+\3[\s\);\}]+(\$\w{1,40})[=\s]+tempnam[\s\(]+\3[,\s]+['"][^'"]+['"][\s\);]+if[\s\(]+\4[\s\)\{@]+file_put_contents[\s\(]+\4[^;]+;\s*include[\s\(]+\4[^\}]+\}(?<X1222200>))|[@=\s]+fopen[\(\s]+__FILE__[,\s]+['"]r['"][\)\s;@]+fseek[\(\s]+\1[^;]+;\s*(\$\w{1,40})[=\s]+stream_\w+[\(\s]+\1[\)\s;]+fclose[\(\s]+\1[\)\s;]+\$\w{1,40}[=\s]+create_function[\(\s]+['"][^'"]*['"][,\s]+(?:(?:gz(?:uncompress|inflate)|strrev|substr)[\(\s]+){2,}\6(?<X2205861>)|[\h=]+(?:@?create_(function)[\h\(]+['"]{2}[,\h]+(['"])[^;]{1,99}\b\8\h*(\w{1,40})\b[^\?\n]{1,299}(\$\w{1,40})[\h=]+@?unserialize\(\10\(base64_decode\(\11\),[^\{\}\n]{1,299}\{\s*@?eval\(\11\[[^;]{1,99};\h*@?(?:die|exit)\b[^;]{0,19};\h*\}\h*\9\h*\);\s*@?\1\s*\(\s*\);(?<X1194411>)|['"](?:(?:\w{2,6}[GPCSR]_|_[GPCSR]\w{2,6})['"];\h*(\$\w{1,40})\h*=[^;]{0,99}\1\b[^;]{1,99};\h*if\h*\([^\)]{0,99}\13\b[^;\{\n]{1,99}(?:\{\h*)?@?preg_replace[\h\(]["'](\W)[^,'"]+\14e['"]\h*,[^;]{0,99}\13\b[^;]{0,99};(?:\h*\})?(?<X1193190>)|[^'"]+['"]\h*\^\h*["'][^'"]+['"];\h*(\$\w{1,40})[=\s]+&\$\1;\h*(\$\w+)[=\s]+array[\(\s]+['"]\w+['"]\s*=>\s*@\16\s*\[['"][^'"]+['"](?:\s*\^\s*['"][^'"]+['"])+\s*\]\s*,[^;]+\)\s*;\s*(\$\w{1,40})[=\s]+['"][^'"]+['"](?:\s*\^\s*['"][^'"]+['"])+\s*;\s*\18[\s\(]+\17[\s\)]+;(?<X1231851>)|wp\-includes/[^\;]+\.js['"];[^\)]{1,999}@filesize\((\$\w+)[^\(]+file_get_contents\(\1\)[\)\s\{]+@unlink\(\20\);file_put_contents\(\20[,\s]+base64_decode\(\$\w+[\);\}]+if\(\w+\(\20[\)\s]+require_once\(\20\);(?<X1281821>))|\$_COOKIE;\s*\1[\h=]+(\$\w{1,40})\s*\[\s*\d+\s*\][\s\(]+\1[\s,]+\$_[GPRSC]\w{2,6}[^;]*;[^\*]{0,9999}\w+[\(\s]+\22[,\s]+\22\s*\[\s*\d+\s*\][\(\s]+\22\s*\[\s*\d+\s*\][,\s]+\$\w{1,40}\s*\^[^;]+;\s*\}(?<X1249191>)|array[\h\(]+[^)]{20,80}\);\s*foreach[\h\(]+\1\h*as\h*(\$\w{1,40})[\s\)\{]+\$\w{1,40}\s*\.=\s*\$\w{1,40}\[\24\];\s*\}\s*(\$\w{1,40})[\h=]+strrev[\h\(]+['"\s\.creat_funio]{15,40}[\h\)]+;\s*(\$\w+)[\s=]+\25\(['"\s,]+\$\w+\([^%]{1,99}\26\(\);(?<X1049755>))|[\s="'htps:/]+\b(?:raw|gist)\.githubusercontent\.com/hacker\-d[^;]+;[^\?]{0,19999}(\$\w{1,40})[\s=]+\w+[\s\(]+\1[^;]+;[^\?]{0,999}\becho\s+eval['"\(\?>\.\h]+\28[\s\);]+\}\s*else\s*\{[^\}\{]*\}(?<X1274661>)|[\s='"]+/tmp/\.[a-z_]+\d*['";\s]+if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*\$\w{1,40}[=\s]+fopen[\(\s]+\1[,\s'"]+w['"](?:[^:]{0,199}@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s'"]+cd\b[^\):]{0,99}https?://[^;\-]+\.(?:png|gif|jpe?g)\s*\-o\s+([\w\.]+)[^/\}]{0,40}\./\30[^\)]+\)[\s;]+\})+(?<X1214891>)|[\s=]+(?:(\$\w{1,40})\[\d+(?:\](?:(?:[\.\s]+\32\[\d+\])+\s*;\s*(\$\w{1,40})[\s=]+\32\[\d+\](?:[\.\s]+\32\[\d+\])+\s*;\s*@?eval[\s\(]+\1[\s\(]+\33[\s\(]+(\$\w{1,40})\[\d+\](?:[\.\s]+\34\[\d+\])+[\s\);\?>]+\Z(?<X1226370>)|(?:[\s\.]+\32\[\d+\])+\s*;\s*(\$\w{1,40})[\s=]+\32\[\d+\](?:[\s\.]+\32\[\d+\])+\s*;[^\(\)]{0,499}\beval[\s\(]+(?:(?:\1|\36)[\s\(]+){2,}(\$\w{1,40})\[\d+\](?:[\s\.]+\37\[\d+\]){9}[^\)]{999,}\)[\s\)]+;(?<X1227430>)|(?:\.\32\[\d+\])+[\s;]+(\$\w{1,40})[\s=]+\32\[\d+\](?:\.\32\[\d+\])+[\s;]+(\$\w{1,40})[\s=]+\32\[\d+\](?:\.\32\[\d+\])+[\s;]+if(?:[\s\(]+@?(?:\1|\39|\40))+[\s\)]+\{\s*(\$\w{1,40})[\s=]+@?(?:\1|\39|\40)[\s\(]+['"]{2}[\s,]+@?(?:\1|\39|\40)[\(\s]+['"][^'"]{99,}['"][\s\);]+@\41\(\);\s*\}(?<X1217570>))|\s*[/\*\+\-]\s*\d+[^\]]*\]\s*\.[^;]+;\s*(?:(\$\w{1,40})[\s=]+\32\[\d+\s*[/\*\+\-]\s*\d+[^\]]*\]\s*\.[^;]+;\s*)+\$\w{1,40}[\s=]+['"]\\[a-f\d\\x]{999,}['"];[^\(]{0,999}(\$\w{1,40})[\.=\s]+(?:\1|\43)[\s@\(;]*(\$\w{1,40})[\s=]+(?:\1|\43)[\s\(]+['"]{2}[,\s]+\44[\s\);@]+\45[\s\(\)]+;(?<X1211050>))|(\$_SERVER\[)['"](DOCUMENT_ROOT)['"]\][\s\.]+['"]/ind['"]\s*\.\s*['"]ex\.php['"]\s*;\s*(\$\w{1,40})[\s=]+\47['"]\48['"]\][\s\.]+['"]/\.htac['"]\s*\.\s*['"]cess["'][^\{\}]{0,499}\bif[\s\(]+\1[^\}]+\}[\s\}]*\bif[\s\(]+\49[^\}]+@file_put_contents[\s\(]+\49[,\s]+file_get_contents[^;]+;[^\}]+\}\s*\}(?<X1225030>)|['"](?:(?:%[a-f\d]{2}){9}[%a-f\d]+['"]\s*;\s*\$\w{1,40}[\s=]+['"]http['"]\s*;[^!:]{0,9999}\$(?:goweb|urlshang|web|(?:html_?)?content)[\s=]+str_rot13[\s\(]+urldecode[\s\(]+\1[\s\)]+;(?<X1222213>)|(?:\.+/)*\.htaccess['"]\s*;\s*(\$\w{1,40})[=\s]+strtolower[\(\s]+(file_)ge(t_contents)[\(\s]+\1[\)\s]+;\s*if[\(\s]+preg_match[\("'/\s]+(?:(?:allow|deny)\s+from\s+all|order\s+(?:allow|deny))['",\s/]+\52[^%]{9,9999}(\$\w{1,40})[=\s]+['"]<IfMo[^;]+;\s*@?\53pu\54[\s\(]+\1[,\s]+\55[\s\);]+\}(?<X1218380>)|/(?:var|home\d*)?/[^'"\$]+/\.\w+\.\w*['"][;\s]+(\$\w+)[\s=]+substr[\s\(]+\1[\s,]+\d+[\s@\);]+include_once[\s\(]+\57[\s\)]+;(?<X1258252>)|[^'"]{999,}['"];\s*(\$\w+)[\s=]+str_replace\s*\([^;]{1,199};\s*(\$\w+)[\s=]+['"base64dco_\.]{18,};\s*@?eval[\s\(]+(?:(?:\59|\60)[\s\(]+){2}[^\)]+,\s*\1[\s\)]+;(?<X1194170>)|aWYo[^'"]+['"][\s;]+(\$\w{1,40})[\s=]+['"]['"\h\.streplac_]{11,40}['"][\s;]+(\$\w{1,40})[\s=]+\62[\s\('"]+\w+['"]['"\s,]+['"]\w{5,40}['"][\s\);]+(\$\w{1,40})[\s=]+\62[\s\('"]+\w+['"]['"\s,]+['"]\w{5,40}['"][\s\);]+(\$\w{1,40})[\s=@]+(?:\63|\64)[\s\(]+['"]{2}\s*,[^;]*\1[\s\);@]+\65\(\);(?<X1210540>)|c['"\s\.]+h[\s\.'"]+r['"]\s*;(?:\s*(\$\w{1,40})[\s=]+\1[\s\(]+\d+[\-\+\*/]\d+[\s\)]+(?:\.\s*\1[\s\(]+\d+[\-\+\*/]\d+[\s\)]+)+;)+\s*(?:\$\w{1,40}[\s=\(]+){3}['"][a-z\d\+/]{9999,}={0,2}['"][\)\s;]+(\$\w{1,40})[\s=]+\67[\(\s]+['"]{2}[,\s]+\$\w{1,40}[\)\s;@]+\68\s*\(\s*\)\s*;(?<X1212300>)|https?://raw\.github[^;]+;[^\{\}\?]{0,99}\b(curl_setopt[\s\(]+(\$\w+)[\s,]+CURLOPT_)URL[\s,]+\1[\s\)]+;[^\}\{\?]{0,199}\b\70FILE[\s,]+(\$\w+)[\s\)]+;[^\?\{\}]{0,199}\bcurl_exec[\s\(]+\71[\s\)]+;[^\?\{\}]{0,199}\bfclose[\s\(]+\72[\s\)]+;(?<X1196140>))|['"]{2};\s*\1[=\s]+isset\(\1\)[\s&]+\1[\s'"=]+\?\s*(\$_SERVER)\[['"]SCRI[^;]+:\s*\1;(?:\s*\$\w+[=\s]+\74\[[^;]+;){3,}[^\{\}]{0,199}\{[^\{\}]{0,199}(\$\w+)[=\s]+false[^\*]+\bif[\s\(]+\75\h*!=[^;]+(\$\w+)[=\s]+['"]http[^;]+;\s*(\$\w+)[=\s]+\w+[\s\(]+\76[,\s]+\$\w+[\s\);]+echo\s*\77[^\}]*\}\s*\}(?<X1271930>)|\$_(?:[GPRSC]\w{2,6}\s*;(?:[^\)]{0,40}\bcount[\(\s]+\1[^;]{0,40}&&in_array[\(\s]+gettype[\(\s]+\1[\)\.\s]+count[\(\s]+\1[^:]+\1[\(\)\s]+:\s*\$\{\$\{['"]GLOBALS['"]\}(?:\[[^\]]+\]\}\s*;)?(?<X1227651>)|\s*if[\(\s]+\$\w{1,40}\s*\[[^\]]+\]\s*\S{2,3}\s*[^\s;'"\(\)\$]{1,40}['"\)\s]+\{\s*\1\s*\[[^\]]+\]\s*\S{2,3}\s*[^\s;'"\(\)\$]{1,40}\1\s*\[[^\]]+\][\s\(]+\1\s*\[[^\]]+\][\s\);]+\}\s*@?(?:eval|assert)[\s\('"\?>\.]+file_get_contents[\s\(]+\1\s*\[[^\]]+\][\s\)]+;(?<X1207000>))|COOKIE\b[^\n]{0,40}\bcount[\(\s]+\1[^;]{0,40}\bin_array[\(\s]+gettype[\(\s]+\1[\)\.\s]+count[\(\s]+\1[\)&,\s]+\1[\)\s]+\?[\(\s]+\1\s*\[\d+\][\s=]+\1\s*\[\d+\][^,;]+\1[\s=]+\1\s*\[\d+\][\(\s]+\1\s*\[\d+\][,\s]+\1\s*\[\d+\][\(\s]+\1\s*\[\d+\][\)\s&]+\1[\(\)\s]+:\1\s*;(?<X1212600>))|new\s*KClickClient[\('"\s]+https?://mrricch5\.beget\.tech/api\.php\?['"][,\s]+['"]\w+['"][\)\s]+;[^=\?<]{0,999}\1\->executeAndBreak\s*\(\s*\)\s*;(?<X1212620>)|wp_create_user\s*\([^;]{1,199};\s*(\$\w{1,40})[\s=]+new\s+WP_User\s*\(\s*\1\s*\);\s*\83\s*\->\s*set_role\s*\(\s*['"]administrator['"]\s*\);\s*(?:echo|print|(?:wp_)?mail)\b[^;]{1,199};\s*(?:die|exit)\b[^;]{0,19};(?<X1192020>))|\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];(\$\w{1,40})\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];(\$\w{1,40})\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];@\$\w{1,40}\((?:(?:\1|\85|\86)\(){2,3}(?:\$\w{1,40}\(?)+\){3,};(?<X1140151>)|\[(?:['"](\w{1,40})['"]\]\h*=\h*['"](?:assert|eval)['"]\h*;\s*(\$\w{1,40})\[\h*\]\h*=\h*\1\h*;\s*@?\89\[0\]\[['"]\88['"]\]\h*\(\h*(?:(?:gz(?:uncompress|inflate)|base64_decode)\h*\(\h*){0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;(?<X1166750>)|\]\h*=\h*chr\h*\(\h*ord\h*\(\h*(\$\w{1,40})\h*\[(\$\w{1,40})\]\h*\)\h*\^\h*ord\((\$\w{1,40})\h*\[\h*\92\h*%\h*count\h*\(\h*\93[\h\]\)]+;\s*\}\s*\91\h*=\h*implode\h*\(\h*['"]{2}\h*,\h*\1\h*\)\h*;[^'"]{1,499}\(\h*['"]{2}\h*,\h*\91\h*\)\h*;(?<X2161510>)))
(\$\w{1,40})\h*=(?:(?:\h*(\$\w{1,40}\[)[\h\(]+\d+[\-\+\*/\(]+\d+[\-\+\*/\)][^\]]*\]\h*\.?){3,};(?:\s*\$\w{1,40}\h*=(?:\h*\2[\h\(]+\d+[\-\+\*/\(]+\d+[\-\+\*/\)][^\]]*\]\h*\.?){3,};){1,9}[^\{\}@\?>]{0,999}@?(\$\w{1,40})\h*=\h*@?\1[\(\h]+(?:['"]{2}|null)[\)\h]+,[^;]{2,40};\h*@?\3\(\);(?<X1187001>)|(?:\h*chr\h*\(\d+\)\h*\.){3,}[^;]+;\s*(\$\w{1,40})\h*=\h*\1\h*\((?:\h*chr\h*\(\d+\)\h*\.){3,}[^;]+;\s*(\$\w{1,40})\h*=\h*\5\h*\(\h*(?:['"]{2}|null)\h*,\h*\1\h*\([^\)]+\)[\h\)]+;\s*@?\6\h*\(\h*\)\h*;(?<X1171640>)|(\h*str_i?replace\h*\(\h*['"][^'"]{1,19}['"]\h*,\h*['"]{2}\h*,)\h*\$\w{1,40}\h*\);\s*(\$\w{1,40})\h*=\h*\8[^;]{1,99};\s*(\$\w{1,40})\h*=\h*\9\h*\(\h*\1\h*\);\s*\10\h*=\h*['"]\h*\?>\h*\10\h*['"];\s*@?eval\h*\(\h*\10\h*\);(?<X1169531>))
(\$\w{1,40})\h*=\h*(?:['"]base['"]\h*\.(?:[\h\(]+\d+[\h\*\+\-/]+\d+[\)\h]+\.\h*['"][_decod\.'"\h]{7,}['"]\h*;\s*@?eval\h*\([^;]*\1\h*\(\h*\$[^;\)]+\)\h*\)\h*\)\h*;(?<X1186990>)|\h*3\.2\h*\*\h*20\h*\.\h*['"]_decode['"]\h*;\h*goto\h+\w{3,12};\h*\w{3,12}:\h*return\h*@?eval\h*\([^;]{0,99}\1\h*\((?<X2172450>))|['"]header['"]\h*;\s*\1\h*\(\h*base64_decode\h*\(\h*['"]TG9jYXRpb246[^\;\.]+\.\h*['"]https?://[^'"]+['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,19};(?<X1188570>)|['"]https?://(?:['"]\h*\.\h*(\$_(SERVER)\[)['"](?:\6_NAME['"]\])+[\h\.:'"]{1,12}\5['"]\6_PORT['"]\]\h*\.\h*\5['"]REQ[^;]+;[^\{\(\[]{1,40}(\$\w{1,40})\h*=\h*explode\(\$\w{1,40},\1\);\s*if\(count\(\7\)>\d+\)\s*\{[^\}]{1,99}@\$\w{1,40}\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\);\s*return;\s*\}(?<X1150840>)|\w{1,40}\.com/?['"]\h*;[^\v]{999,9999}(\$\w{1,40})\h*=\h*get\w{1,9}\h*\(\1\b[^\v\*]{99,999}(\$\w{1,40})\h*=\h*str_replace\h*\(\h*['"][^'"]{0,9}['"]\h*,\h*\9\b[^\v\}\?]{9,499}\w?(?:echo|print)\w{0,2}\h+\10\h*;\h*(?:exit|die)\b[^;]{0,9};(?:\h*\}){4}(?<X1169721>)|apigooglee\.com/[^;]+;\s*\$\w{1,40}\h*=\h*wp_remote_get[\h\(]+\1[\)\h]+;(?<X1193880>))|['"]index\.php['"];\s*(\$\w{1,40})[\h=]+@?(file_get_contents)[\(\s]+\1[\)\s;]+(\$\w{1,40})[\h=]+@?\14[\(\s]+['"][^'"]+/\d+['"][\)\s]+;\s*(\$\w{1,40})\h*=[^;]*\15[\s\);]+if[\s\(]md5[\s\(]\13[\s\)]+!=\s*md5[\s\(]+\16[\s\)]+\{\s*(@chmod\()\1[^;]+;\s*@file_put_contents[^;]+\1[,\s]+\16[\);\s]+\17\1[^;]+;\s*\}(?<X1194220>)|['"]PD9(?:[^'"]{999,9999}['"];[^\?]{1,499}\bfile_put_contents\h*\(\h*(\$\w{1,40})\h*,\h*\1\h*\);\s*include(?:_once)?\h*(?:\(\h*)?\19\h*(?:\)\h*)?;\s*unlink\h*\(\h*\19\h*\);\s*(?:\?>\s*)?\Z(?<X2183861>)|[^'"]{9999,30000}['"]\s*;\s*(\$\w{1,40})\h*=\h*fopen[\s\(]+['"]\./[^'"/]+\.php['"]\h*,\h*['"]w['"][\s\)]+;\s*fwrite[\s\(]+\21[,\s]+base64_decode[\s\(]+\1[\s\)]+;\s*fclose[\(\s]+\21[\)\s]+;(?<X1194040>))|['"]ZXZhb[^'"]{99,300}['"];\s*\$\w{1,40}\h*=\h*['"]=[^'"]{9999,20000}['"];\s*@?eval\(htmlspecialchars_decode\(urldecode\(base64_decode\(\1[\)\h]+;\s*(?:die|exit)\b[^;]{0,9};(?<X2138991>)|['"]{2}\h*;\s*for[\(\s]+(\$\w{1,40})=0;\s*\24<strlen[\(\s]+(\$\w{1,40})\)[\-\+\h]+\d+\h*;\s*\24\+=\d+[\)\s]+\{\s*\1\h*\.=\h*chr[\(\h]+hexdec[\(\s]+\25\[\24\][\.\h]+\25\[\24[\+\-\h]+\d+\][\)\h]+;\s*\}\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\26e\w?.?['"]\s*,\h*\1\h*,\h*['"]{2}\h*\)\h*;(?<X1190950>)|\$(?:\{\h*(?:\$\w{1,40}|str_rot13)\h*\(\h*['"]_[PCTE][BR]['"\w\.\h]{1,19}\)\h*\}|\$\w{1,40})\h*;\h*@?\((?:[^;\v#%\{\}/@\-<>]{0,199}\1\h*\[\h*\d+\h*\]\h*\(\h*\1\h*\[){2,}[^;\v\?#%\{\}/@\-!=<>]{1,99}:\1;(?<X1188161>)|\$\w{1,40};(?:\s*\1\h*\.=\h*\$\w{1,40};)+\s*(\$\w{1,40})\h*=\h*\$\w{1,40}[\h\(]+['"]{2}(?:\h*\))?\h*,\h*\(\h*\1[\h\)]+;\s*\29\h*\(\)\h*;(?<X1185762>)|\$\{['"]\\[^'"]+['"]\};\s*@?\(\h*in_array[\s\(]+gettype[\s\(]+?\1[^;]+\1[^\v;@&,\\]{5,}&&[\(\h]+@?\1\h*=\h*\1\[\d+\]\h*\(\h*\1\[\d+\]\h*,\h*\1\[\d+\][^;\v]+\1\[\d+\][^;\v]*;(?<X1188400>)|\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(?:(\$\w{1,40})\h*=\h*str_replace\h*\(\h*array\h*\([^;]+\1[^;]+;\s*(\$\w{1,40})\h*=[^;]+\32[^\?>]{99,499}(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\33\h*\)\h*;(?:\s*\})?\s*\w?(?:echo|print)\w{0,2}['"\h\)]{0,9}\34['"\h\)]{0,9};(?<X1127332>)|if\h*\(\h*empty\h*\(\h*\1\b[^\?>:/]{1,999}(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\1\h*\)\h*;[^\?]{1,499}\36\h*=\h*str_replace\h*\([^\?]{1,40}\?[^;]{1,40}\36\h*\)\h*;[^\}]{1,99}\beval\h*\(\h*\36\h*\)\h*;\s*\}(?<X1172740>))|\$_SERVER\[(?:[^;]{9,40};\s*\$\w{1,40}\s*=\s*['"]PD9[^'"]{999,}['"];\s*(\$\w{1,40})\h*=\h*['"][^;]+['"]\h*;[^\v\?<]{999,9999}\bsubstr_count[\h\(]+\$\w{1,40}[\h,]+\38[\h\(]+['"][^\}\v;]+;\s*\$\w{1,40}\h*=\h*@?fopen\h*\(\h*\1\h*\.[^;]+;\s*@?fwrite[\h\(]+\$\w{1,40}[\h,]+\38\h*\([^\}]{99,199};\s*\}(?<X1188260>)|[^\]]+\];\s*(\$\w{1,20})\h*=\h*['"]https?://[^;]{1,99};\s*\$\w{1,40}\h*=[^;]{1,99}\.xml['"](?:[^@]{99,1999}\$(\w{1,40})\h*=\h*file_get_contents\h*\(\h*\40\b[^\)]+\1\b[^;]{0,49};\s*echo\s*\$\41;\s*(?:exit|die)[^;]{0,19};){2}[\s\}]+else\s*\{(?:\s*\}){2}(?<X1168920>))|\[['"]https?://[^'"]{1,199}\.txt['"][,\s]+['"]/tmp/sess_['"][\s\.]+md5\h*\([^;]+['"]\.php['"\];\s]+if\s*\([^;]+include(?:_once)?[\s\('"]+(\1\[\d+\])[\s\)'";\}]+else[\s\{]+(\$\w{1,40})[\s=]+fopen[\s\('"]+\43[^;]+;[^=\}]{0,199}\bfwrite[\s\(]+\44[,\s]+\w+[\s\(]+\1\[\d+\][^\}]{0,99}\}(?<X1195291>)|\w{1,40}\h*\(\h*\$GLOBALS\s*\[[^\]]+\]\s*\)\s*;\s*@?eval[\s\(]+['"][\?>]{2}['"]\s*\.\s*\1[\s\)]+;(?<X2188331>)|array(?:[\(\s]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\[[^\]]+\]\h*,\h*(?:['"](?:create_function|str_rot13|json_decode|pack|base64_decode|file_get_contents|fopen|curl_\w{1,40})['"](?:\h*,)?\h*){3,}\);[^\}]{9,499}\1\[\d+\][\h(]+['"]{2}\h*,[^;,]{4,40}\)\h*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190580>)|[\h\(]+(base64_decode[\h\(]+str_i?replace[\h\(]+['"]\.['"]\h*,\h*['"]{2}\h*,\h*['"])[a-z\.\d=\+/]{9,99}['"][\h\)]+;\s*foreach[\h\(]+\1\b[^;]{0,99}\1\[\$\w{1,40}\]\h*=\h*s?(?:print|echo)f?\h*\([^\\]{499,999}<script>\h*['"]\h*\.\h*\48[a-z\.\d=\+/]{9,99}['"][\h\)]+\.(?<X2177030>))|base64_decode\h*\([YXNZJd'"\d\.]{9,24}\)\h*;\s*\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)(?:\h*;)?(?<X1140930>)|count\h*\(\h*\$\w{1,40}\h*\)\h*[\+\-/%]\h*\d+\h*;\s*if\h*\(\h*!?\1[\s\)]+\{\s*(\$\w{1,40})\h*=\h*['"]?create_function['"]?\h*;\s*(\$\w{1,40})\h*=\h*\51\h*\(\h*(?:['"]{2}|null)\h*,\h*\$[^;]+;\s*@?\52\(\);\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1188802>)|create_function\h*\(\h*chr\h*\(\h*\d+[/\*\+\-]\h*\d+\h*\)\h*\.[^;]{99,999};\s*@?\1\h*\(\h*base64_decode\h*\([^;]{99,999};(?<X1178171>)|curl_init\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}\?=]{1,999}\b(?:curl_setopt\h*\(\h*\1\h*,\h*CURLOPT_COOKIE(?:JAR|FILE)\h*,\h*\$GLOBALS\[['"]coki['"]\]\h*\);\s*){2}(?:(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\$\w{1,40}\h*\)\h*;\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*\55\);\s*){0,2}(?<X1183571>)|date_default_timezone_get\h*\(\);\s*if[\h\(]+getenv[\h\(]+['"]REM[^\^]{99,9999}if[\h\(]+preg_match[\s\(]+['"]\W{1,9}sitemap[^;]+\1[\)\h]+;\s*(\$\w{1,40})\h*=[^\^\?]{99,9999}\57[\h=]+str_replace\h*\([^;]+\57[\h\)]+;\s*@?header[\h\(]+['"]Location:\h*['"][^;]+\57[\)\h]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\}){2}(?<X1189221>)|explode\h*\(\h*['"]:['"]\h*,\h*\1\h*\)\h*\[0\]\h*;\s*if\h*\(\h*(function)_exists\h*\(\h*['"](curl_init)['"][\)\s]+\{\s*(\$\w{1,40})\h*=\h*(\w{1,40})\h*\(\h*['"]\h*https?://[^;]+\1\b[^>]{99,999}echo\h+\61\h*;\s*\b\59\h+\62\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*\60\h*\([^\}]{9,499}\}(?<X1167310>)|file(?:_get_contents[\(\h]+['"]https?://\w{0,49}[^;]{1,49}\w{1,20}\.(?:txt|php|log|ico|png)['"][\)\s]+;\s*@?eval[\s\(]+['"]\?>\h*\1['"][\)\s]+;(?<X1189143>)|mtime\h*\(\h*(['"][^'"]{0,99}/wp\-config\.php['"])\h*\)\h*;\s*@?chmod\h*\(\h*\65\h*,\h*07\d+\h*\)\h*;\s*@?file_put_contents\h*\(\h*\65\h*,\h*\$\w{1,40}\h*\)\h*;\s*@?touch\h*\(\h*\65\h*,\h*\1\h*,\h*\1\h*\)\h*;(?<X2172370>))|fopen[\s\('"]+wp[^;'"]+\.php['"\s,]+['"][aw]\+?['"\s\;)]+(\$\w{1,40})[\s=@]+file_get_contents[\h\('"]+https?://[a-z]{2,5}bin\.com?/(?:\w{1,40}/)?(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}['"][\s\)'";]+(?:\$\w{1,40}[\s=@]+)?fwrite[\s\(]+\1[\s,'"\(\)]+\67[\s\.'"\(\);]+fclose[\s\(]+\1[\s\)]+;(?<X1196730>)|get\w{0,40}\h*\(\h*['"]https?://[^\}]{1,499}\bfile_put_contents\h*\(\h*['"]([^'"]{0,49}\bwp\-\w{1,40}/[^'"]{0,99}/\.[^'"/]{1,99}\.(?:jpe?g|bmp|png|gif))['"]\h*,\h*\1\h*\);\s*(\$\w{1,40})\h*=\h*explode\h*\([^;\)]{0,99}\b\69\b[^;]{0,99};\s*echo\h*\70\h*\[[^;]{1,99};(?<X1184922>)|get_option\(['"]_transient_feed_[a-z0-9]{1,40}['"]\);\s*\1\h*=\h*base64_decode\(str_rot13\(\1\)\);\h*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"][^'"]+['"]\)\h*\D{2,3}\h*false\h*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?create_function\h*\(\s*['"]{2}\h*,\h*\1\h*\);\h*@\72\(\);\h*\}(?<X1139590>)|getallheaders\h*\(\);\s*if\h*\(\h*!?\h*[ie](?:sset|mpty)\h*\(\h*\1\h*\[[^;\{]+\{\s*(\$\w{1,40})\h*=\h*['"][^;]+;[^\}\{\?]{0,150}(\$\w{1,40})\h*=[^;]{1,99};\s*@?file_put_contents\h*\(\h*\75\h*,\h*\74\h*\)\h*;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\75[\$\}\)'";]{1,3}\h*;[^\{=\}]{0,99}\}(?<X1168951>))
(\$\w{1,40})\s*=\s*(?:['"]['"]\s*;\s*if[\(\s]+time[\(\)\s]+[\-\*\+]\s*\d+\s*[=><][=\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+function_exists[\(\s]+['"]curl_version['"][\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init\b[^:]{0,999}CURLOPT_URL\s*,\s*['"]https?://[^/'"\$]+/[^\*@]{9,9999}\becho\b[^;]+\1[^;]*;\s*(?:exit|die)\b[^;]*;(?<X1240250>)|['"][^'"\$]{1,20}['"]\s*\^\s*['"][^'"\$]{1,99}['"]\s*;\s*@?preg_replace[\s\(]+\1\s*,[^,;]{9,999}['"]\s*,\s*['"][^'"\$]{1,20}['"][\s\)]+;(?<X1215660>)|['"][^'"]{0,9}(?:\\x?\d{2,3}\w){3,20}\([^;]{999,}['"]\h*;\s*@?(?:assert|eval)[\s\(]+\1[\s\)]+;(?<X1194350>)|['"][^'"]{1,40}\.html?['"]\s*;\s*(\$\w{1,4})\s*=\s*fopen\(\s*\1\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*[^;]{0,39}\s*;\s*fwrite\(\s*\5\s*,\s*(\$MESSAGE)\s*\);\s*fclose\(\5\);\s*@?mail\(\$TO,\$SUBJECT,\6,\$HEADER\);(?<X2054251>)|['"][^'"]{1,9}['"]\s*\^\s*['"][^'"]{1,9}['"];\s*(\$\w{1,40})\s*=\s*&\$\1;\s*\$\w{1,40}[=\s]+array[\(\s]+(?:['"][^'"]+['"]=>\s*['"][^'"]{1,49}['"]\s*\^\s*['"][^'"]{1,49}['"](?:\s*,)?\s*)+\s*['"][^'"]+['"]=>@\8\[[^\n]{99,199}(\$\w{1,40})[^;]+['"]['"][^=\n]{0,40}==\$\w{1,40}[\)\s]+\9\(\);(?<X1215540>)|['"][^'"]{3,9}['"]\s*\^\s*['"][^'"]{3,9}["']\s*;\s*(\$\w{1,40})\s*=\s*&\$?\1;\s*(\$\w{1,40})\s*=\s*array\s*\([^\|\n]{99,499}\$\w{1,40}[\s\(]+\12[^\n\[\}]{1,40}\11\[[^\]]+\][^"'\n]{1,40}(\$\w{1,40})\s*=\s*\$\w{1,40}[\s\(]+['"]{2}[\s,]+\$\w{1,40}[\s)]+;[^\n;]+\13\s*\(\s*\)\s*;(?<X1214930>)|['"][asert]{1,5}['"]\s*;\s*\1\s*=\s*['"][asert]{1,5}['"]\s*\.\s*\1\s*;\s*(\$\w{1,40})\s*=\s*['"][_POST]{5}['"]\s*;\s*\$\w{1,40}\s*=\s*strtoupper\s*\(\s*(?:\15\[\d\]\.?){5}\s*\)(?<X2052291>)|['"]\?>['"];\s*@?eval[\(\s]+\1\s*\.\s*\w+[\(\s]+base64_decode[\(\s]+['"](?:aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbn|aHR0cHM6Ly9naXN0LmdpdGh1YnVzZXJjb24)[^'"]+['"][\)\s]+;(?<X1278001>)|['"]\\143(?:\\x65|\\14\d|\\16\d|\\137|\\x74|\\x6e|\\15\d|\.|['"]|\s){20,};\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]\\[^\)]+\)[\s;]+\18[\s\(]+['"][=a-z\d/\+]{99,}['"][\s\)]+;(?<X1202161>)|['"]\\x[a-f\dx\\]{9,40}['"]\s*\^\s*['"][^'"]{9,}['"];\s*(\$\w{1,40})\s*=\s*['"][^'"]+[""](?:\s*\^\s*['"][^'"]+[""])+\s*;\s*\1[\s\(]+\20\s*,[^;\(]{999,},\s*['"][^'"]+['"]\s*\)\s*;(?<X1215280>)|['"]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[fz][^;]+;\s*\1\s*=\s*['"]https?://['"]\s*\.\s*\1[^;]*;[^\n\*]+=\s*getS\w+[\(\s]+\$\w+\s*,\s*\$\w+[\);\s]+echo\s*\$\w+\s*;[^\}]*\bexit\b[^\}]*\}(?<X1286500>)|['"]as+['"]\s*\.\s*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*array\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*@?array_filter[\(\s]+\23[\s,]+\1[\s\)]+;(?<X1195440>)|['"]base(?:64_(?:decode['"][\s;]+if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+(\$\w{1,40})[\s=]+['"]file_put_contents['"\s;]+(\$\w{1,40})[\s=]+\1[\s\(]+\$_[GPRSC]\w{2,6}\[[^=]+\25[\s\(]+['"]([^'"]+)['"]\h*,[^;]+\26[\s\);]+(\$\w{1,40})[\s=]+['"]\27['"][^\}]+include[\s\(]+\28[^=]+;(?:\s*\}){2}(?<X2195860>)|encode['"];\s*(\$smuri)\s*=\s*\1[\(\s]+\$smuri_tmp[\)\s;]+function\s*smrequest_uri[\s\(\)]+\{\s*if[\(\s]+isset[\(\s]+(\$_SERVER\[['"]REQUEST_URI['"]\])[\s\)]+\{\s*\30\s*=\s*\31;[^:]{4,999}\$\w{1,40}\s*=\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\s*\?\s*\32\s*:\s*['"]{2}\s*;(?<X1201310>))|['"];\s*(\$\w{1,40})\s*=\s*['"]?64['"]?\s*;\s*(\$\w{1,40})\s*=\s*['"]decode['"]\s*;\s*(\$\w{1,40})\s*=\s*(?:\1|\34|\35)\s*\.\s*(?:\1|\34|\35)\s*\.\s*['"]_['"]\s*\.\s*(?:\1|\34|\35)\s*;\s*@?(?:eval|assert|system)[\(\s]+\36[\(\s]+file_get_contents[\(\s]+['"][^'"\$]+\.txt['"][\)\s]+;(?<X1250270>)|['"]\s*\.[\s\(]+128[\s/%\*\+\-]+\d[\)\s]*\.\s*['"]_de['"]\s*\.\s*['"][code'"\s]{5,};\s*@?(?:eval|assert)[\(\s]+\1[\(\s]+\$\w{1,40}\s*\.\s*\$\w{1,40}[\s\)]+;(?<X1221680>))|['"]curl_init\+curl_setopt\+curl_exec\|fsockopen\|pfsockopen\|stream_socket_client\|socket_create['"];\s*\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+['"]['"]\s*;[^\?]{0,499}unset[\(\s]+\1[,\s]+\$\w+[\)\s]+;(?<X1247700>)|['"]https?://(?:(?:past[a-z]{1,5}|[a-z]{2,5}bin)\.(?:com?|ee|xyz|top)/(?:raw|download|r)?(?:\.php\?i=|/)[^'"]{1,40}['"][^,]{1,999},\s*CURLOPT_URL\s*,\s*\1[^\}]+\}\s*else\s*\{\s*(\$\w+)\s*=\s*@\bfile_get_contents[\(\s]+\1[^\}]*\}\s*@?eval\b[^;\)]+\40[\)\s]+;(?<X1248131>)|["'];\s*\1\s*=\s*\1\s*\.\s*['"](?:[fz][^'"]+['"];[^\n\*]{99,}(\$data\w*)\s*\[['"]http_user_agent['"]\][^\}]*,\s*\42[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261240>)|\d{1,3}(?:\.\d{1,3}){3}/[zf][^'"]+['"];[^\n\*]{99,}(\$data\w*)\s*\[['"]http_user_agent['"]\][^\}]*,\s*\44[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261230>))|[^/]+\.[a-z]{2,7}/wp\-(?:includes|admin)/[^'"]+/[\w\.\-]+\.txt['"]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+file_get_contents[\s\(]+\1[\s\)]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\46[\)\s]+;(?<X1223400>)|[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*;\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\1\h*\)\h*;\s*@?(?:eval|assert)\h*\([^;]{0,99}\48[\h\)]+;(?<X1166190>)|cdn(?:[^'"/]+/[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+tempnam[\(\s]+sys_get_temp_dir[\s\(\)]+,[^;]+\.['"\s]+\.php['"][\s;]+try\s*\{\s*\$\w+[=\s]+curl_init[\(\s]+\1[^\}]+\binclude(?:_once)?[\(\s]+\50[\)\s;]+\}\s*\}\s*finally\s*\{[^\}]*unlink[\(\s]+\50[\);\s]+\}\s*\}(?<X1280690>)|[^'"]+\.txt['"][\s;]+(\$\w{1,40})[=\s]+(?:(curl_)init[\s\(]+(?:\1)?[;\)\s]+\53setopt[^=]+(\$\w{1,40})[=\s]+\53exec[\s\(]+\52[^\{\}]{0,499}file_pu\w+[\s\(]+(\$\w+)[,\s]+\54[^\*]{0,499}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]{0,3}\55[^\*]{0,499}unlink[\s\(]+\55[\s\);\}]{1,9}(?<X1273891>)|tempnam[^;]+;\s*try[\s\{]+(\$\w{1,40})[=\s]+(curl_)init[\s\(]+\1[^\{\}=]+(\$\w{1,40})[=\s]+\58exec[\s\(]+\57[^=\{\}]+\59\s*(?:&&|and)\s*file_pu\w+[\s\(]+\52[,\s]+\59[\s\)\{]+include[\w\(]*\52[^=]{0,499}unlink[\s\(]+\52(?:[\s\);]*\})+(?<X1273900>)))|pastebin\.com/raw/\w+['"];\s*(\$\w{1,40})\s*=\s*['"]\.+/[\w\-]{1,3}\.php['"]\s*;\s*@?file_put_contents[\s\(]+\61\s*,\s*file_get_contents[\s\(]+\1[\s\)]+;(?<X1250850>))|['"]index\.php\.bak(?:['"\s;]+\$\w{1,40}[=\s@]+(file_)ge(t_contents)[\s\(]+\1[\s\);]+(\$\w{1,40})[=\s@]+['"]/[^'"]{40,}/wp\-(?:admin|includes)\b[^"']*/\d+['"\s;]+if[\s\(]+\63exists[\s\(]+\65[\s\)]+\{\s*(\$\w{1,40})[=\s@]+\63ge\64[\s\(]+\65[^\}]+,\s*\66[\s\);@]+chmod[\s\(]+\1[,\s]+04+[\s\);]+\}\s*\}(?<X1208571>)|['"]\s*;\s*\$\w{1,40}\s*=\s*@?file_get_contents[\(\s]+\1[\)\s]+;[^\{\}]{9,399}if[\s\(]+file_exists[\(\s]+\$\w+[\s\)]+\{[^\{\}]{9,399}if[\(\s]+md5[\(\s]+\$\w+\s*\)[^\{\}]{9,399}\{[^\}]{0,99}\bfile_put_contents[\s\(]+\1[,\s]+\$\w{1,40}(?:[^\}]{0,99}\}){2}(?<X1232650>))|['"]m['"]\s*\.\s*chr[\(\s]+100[\)\s]+\.\s*chr[\(\s]+53[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\}]+\}\s*if[\s\(]+(?:\1[\s\(]+)+\$_[GPRSC]\w{2,6}[^\n\{\}]{99,999}\{\s*(\$\w{1,40})\s*=\s*sys_get_temp_dir[^\n]{99,999}@include[\s\(]+\69[\s\);]+@unlink[\s\(]+\69[\s\)]+;\s*\}\s*\}(?<X1249010>)|['"]p['"\h\.aceglpr_]{15,40}\s*\;\s*\1\s*\(\s*.?['"](.).{0,40}\71(?:["']\h*\.\h*['"])?e['"]\h*,\h*[eval'"\.\h]{5,40}\h*\(\h*['"\h\.base64_dco]{15,40}\(\h*['"][^\)]{999,}['"][\h\)]+['"]\h*,\h*['"][^'"]{1,9}['"]\h*\)\h*;(?<X1185831>)|['"]PD9[^'"]{9,999}(?:ZXhlY|bW92ZV91cGxvYWRlZF9maWx)[^""]+['"]\s*;\s*@?file_put_contents[\s\('"]+\.[\w\-]{1,12}\.php['"]\s*,\s*base64_decode[\s\(]+\1[\s\)]+;(?<X1218541>)|['"]phar://\./[^;]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{0,3}\1[\s\)]*;(?<X1273880>)|['"]range["']\s*;\s*(\$\w{1,40})\s*=\s*\1\s*\([^;]+;\s*include(?:_once)?\s*\75\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*\.\s*\75\s*\[\s*\d+\s*\+\s*\d+\s*\](?<X2217791>)|['"]wp[^'"]+\.css['"];\s*global\s*(\$\w+);\s*if[\s\(]+is_file[\(\s]+\1[\)\s!&]+\77[\)\s\{]+(\$\w+)[=\s]+trim[\(\s]+file_g\w+[\(\s]+\$\w+[\)\s;]+if[\s\(]+\78!=+['"]{2}[\)\s]+\{[^\{\}]+(\$\w{1,40})[\s=]+jso\w+[\s\(]+\78[^=]+foreach[\(\s]+\79\s*as\s*(\$\w+)[\)\s]+\{[^\}]+@chmod\(\80(?:[^\}]*\}){4}(?<X1272320>)|['"]wp\-login\.php['"]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+['"]PD9[^'"]{99,}['"][\s\)]+;\s*file_put_contents\s*\([^,;]*\1\s*,\s*\82[\s\)]+;(?<X2206640>)|['"]{2}\s*;\s*(\$\w{1,40})\s*=\s*urldecode\s*\(\s*['"]%[a-f\d%]{40,}['"]\s*\)\s*;\s*\$\w{1,40}=\s*\84\s*\{\d+\}\s*\.[^\n]{999,}\1\s*!?=+\s*\\?['"]\\?['"][^\n]{999,}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*\(\)\s*;(?<X1206030>))
(\$\w{1,40})\s*=\s*(?:__DIR__\s*\.\s*['"]\.?/[^'"]{1,199}\.(?:png|gif|ico|jpe?g)['"]\s*;\s*if\s*\(\s*!file_exists\s*\(\s*\1[\s\)]+\{\s*(?:die|exit)\b[^;]{0,19};\s*\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\$\{\('"\s]{1,3}\1[\s\$\}\)'"]{0,3};(?<X1196150>)|array\s*\(\s*(\$\w{1,40})\s*,\s*\$ip\s*\)\s*;\s*foreach\s*\(\s*\1\s*as\s*\3\s*\)\s*mail\s*\(\s*\3\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*;(?<X2054410>)|base(?:64_decode(?:[\('"\s]+aHR0[a-z\d/=\+]{9,199}['"][\\s\)\.'"]+\?[^'";]+['"]\s*;\s*(\$\w{1,40})[=\s]+\[\s*['"]User\-agent['"][^\[\{\}\?]{4,99}(\$\w{1,40})[=\s]+wp_remote_post[\(\s]+\1\s*,[^,;]+>\s*\5\s*,[^;]+;\s*@eval[\s\(]+\6\[['"]body['"]\][\s\)]+;(?<X1218430>)|[\('"]+aHR0[^;]+;[^<>\n]{9,9999}\bwhile[\(\s]+\$\w{1,40}\s*[<>]\s*\d+[\)\s]+\{\s*(\$\w+)\s*=\s*\$?\w+[\(\s]+\1[,\s]+\$\w+[\)\s]+;\s*\$\w+\s*=\s*@gz[^;\$\)]+\8[^\}\+]{1,499}@header\s*\([^;]+;\s*\}\s*echo\s*\$\w+[;\s]+(?:die|exit)\b[^;]*;[\}\s]+\$\w+\+\+[;\s]+\}(?<X1255870>)|[\(\s]+['"]JHJlcV9[^'"]{99,}['"]\s*,\s*true[\);\s@]+eval\s*/\*[^;\$]+\1\b[^;]*;(?<X1278500>)|\s*\(['"][QY][a-z0-9]{19}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\1\s*\(\s*['"]{2},\s*@?preg_replace\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]{2}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*@?\11\s*\(\s*\)\s*;(?<X1133260>))|name[\(\s]+trim[\(\s]+preg_replace[\(\s\$]+\w+[\('"\s]+/[^,;]+,\s*['"]{2}\s*,\s*__FILE__[\s\)]+;\s*\1\s*=\s*substr[\(\s]+str_repeat[\(\s]+\1\s*,[\s\(]*strlen[\(\s]+\$\w{1,40}[^\^;]{1,199}(\$\w{1,40})[\s\)]+;\s*\13[=\s]+\13\s*\^[^;]+;\s*@?eval[\s\(]+\13[\s\)]+;\Z(?<X2238511>))|bcsqrt[\(\s]+\d+[\)\s]+;[^\?]+\bcurl_setopt[\(\s]+(\$\w{1,40})\s*,\s*CURLOPT_URL\s*,\s*['"]https?://\1\.\d+\.\d+\.\d+/[^;\?\n]+\?[^;]+;\s*(\$\w{1,40})\s*=\s*@?curl_exec[\(\s]+\15[\)\s]+;[^\}=]+\becho\s*\16;[^\}=]*\}(?<X1200960>)|chr\(\d+\)\h*\.[chr\(\d\)\.\h]{9,199};\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\1[\$\}\)'";]{1,3};(?<X1195391>)|create_(function)\s*\('([\$\w]{1,40})',\s*\w+\s*\(base64_decode\s*\([^)]+\),\s*\$_[GPRSC]\w{2,6}\s*\[[^\;]+\]\)\s*\.\s*'[^']*'\);\s*\1\(\20\);\s*\19\s*\w+\s*\((\$\w{1,40})\s*,\s*(\$\w{1,40})\)\s*\{\s*return\s*\21\s*\^\s*str_repeat\s*\(\22,\s*ceil\s*\((strlen\s*\()\21\)\s*/\s*\23\22\)+;\s*\}(?<X1037502>)|curl_init[\('"\s]+https?://\w\d+\.xsph\.ru/[^\?'"]+\?[^"'\?]+['"]\s*\.[^;\[]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\)\s]+;\s*@?curl_exec[\(\s]+\1[\)\s]+;\s*curl_close[\(\s]+\1[\)\s]+;(?<X1261810>)|dirname\s*\(\s*__FILE__\s*\)\s*\.\s*['"]/['"]\s*\.\s*basename\s*\(\s*__FILE__\s*\)\s*;\s*\$GLOBALS\[[^\]]+\]\s*=\s*['"][^'"]{9999,}['"];\s*function\s+(\w{1,40})\s*\(\$\w{1,40}\)\s*\{\s*global\s+\1[^>#]{599,1999}\b\26\s*\(\s*str_rot13\s*\(\s*['"][^;'"]+;\s*['"]\s*\)\s*\)\s*;(?<X1136800>)|EMAIL;\s*(?:\$\w{1,40}\s*=\s*)?@?mail\s*\(\s*\1\s*,\s*[^\)]{1,120}\s*\)\s*;\s*(?:\?>)?\s*<script\s*type\s*=\s*['"]text/javascript['"]>\s*[^\&]{1,200}&rand\s*=\s*\d+InboxLightaspxn(?<X2054830>)|exif_read_data[\(\s]+['"]https?://\w{1,3}\.googleusercontent\.com/[^'"]+\.(?:jpe?g|png|ico)['"][\)\s;@]+eval[\(\s]+base64_decode[\(\s]+\1(?:\[[^\]]+\])+[\)\s]+;(?<X1199820>)|explode[\(\s]+['"](\w+)['"]\s*,\s*['"][base]+\30[asdcode]+['"][\)\s]+;\s*(\$\w{1,40})[=\s]+\1\s*\[\s*\d+\s*\][\.\s]+['"][^'"]*['"][\.\s]+\1\s*\[\s*\d+\s*\]\s*;\s*(\$\w{1,40})[=\s]+\31[\s\(]+['"][^"']+['"]\s*,[^;]+;\s*\$\w+\s*=\s*(?:(?:\31|\32)[\s\(]+)+['"][^'"]+['"][^;]+;(?<X1265550>)|file_get_contents(?:[\(\s]+(?:['"]https?://(?:backlink\.[^'"]+\.txt['"][\)\s]+;\s*echo\s*\1\s*;(?<X1280400>)|pub\-[^\./"']+\.r2\.dev/[^'"]+['"][\)\s]+;\s*echo[^;]*\1\b[^;]*;(?<X1264880>))|__FILE__[\)\s]+;\s*global\s*(\$\w{1,40})[\s;]+if[\s\(]+!empty[\s\(]+\36[\s\)\{]+\1\s*\.=\s*\36[^\*]+preg_match[\('"\s]+/[^%]{9,9999}if[\s\(]+\$\w{1,40}\s*%[^;]+;[^\+]{9,9999}\b(file_put_contents)[\(\s]+(\$\w{1,40})[^\{\}]{0,199}\$\w+\+\+[^\+]{199,9999}\37[\s\(]+\38[^\}]+\}(?<X1222460>))|\s*\(\s*(?:['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*[^\$]{1,40}\s*\1\s*(?:\s*\)\s*){1,6};(?<X2054672>)|str_rot13\s*\(\s*['"]uggc://[^'"]{3,199}['"][^;]*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^;]*\1\b[^;]+;(?<X1195040>)))|fopen(?:[\(\s]+\$get_sent_type\s*,\s*['"]w['"][\)\s]+;\s*@?fputs[\(\s]+\1[,\s]+\$seopress_social_twitter_card_option[\);\s@]+fclose[\(\s]+\1[\)\s]+;(?<X1219470>)|\s*\((?:\s*['"]/(?:home|etc)/?['"]\s*\.\s*\$\w{1,40}\.){1,2}['"]/?(?:shadow|passwd)['"]\s*,[^\)]+\)\s*;[ ]*fwrite\s*\(\s*\1\s*,[^\)]+\)\s*;[ ]*fclose\s*\(\1\)\s*;(?<X2129852>))|get_(?:option\s*\(\s*['"](?:_site)?_transie\w{30,50}['"]\s*\);\s*\1\s*=\s*base64_decode\s*\(\s*str_rot13\s*\(\s*\1(?:\[[^\]]{1,40}\])?\s*\)\s*\);\s*if\s*\(\s*[^\{]{29,99}\s*\{\s*(\$\w{1,40})\s*=\s*create_function\(\s*['"]['"]\s*,\s*\1\s*\);\s*@?\44\(\);\s*\}(?<X1057033>)|users\s*\(\s*array\s*\(\s*['"]role['"]\s*=>\s*['"]administrator['"][\s\)]+;\s*if\s*\(\s*!\s*count\s*\(\1\)\)\s*(?:die|exit)\b[^\?]{1,299}(\$\w{1,40})\s*=\s*\1\[\d+\];\s*(\$\w{1,40})\s*=\s*\46\->user_login;[^\{\}]{1,299}do_action\s*\(\s*['"]wp_login['"]\s*,\s*\47\s*\);(?<X1135963>))|isset(?:[\(\s]+\$_COOKIE\s*\[\s*(\$\w{1,40})\s*\[\d+\]\s*\][\)\s]*\?\s*\$_COOKIE\s*\[\s*\49\s*\[\d+\]\s*\]\s*:\s*\49\s*\[\d+\];\s*\$\w+\s*=\s*\49\s*\[\d+\][\(\s]+\1[\);\s]*\}\s*@?\w+[\(\s]+\49[,\s]+\$\w+[,\s]+\$\w+[\)\s]+;(?<X2266280>)|[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\?\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*:[^;]+;\s*(\$\w{1,40})\s*=\s*['"]['"\h\.base64_dco]{15,40}['"]\h*;\s*(\$\w{1,40})\s*=[^;]*(?:\1|\51)\h*\(\h*(?:\1|\51)\h*\)[^;]*;\s*@?eval[\s\(]+\52[\s\)]+;(?<X1194000>))|Mage(?:::getModel\(['"]sales/quote_payment['"]\)->getCollection\(\);\s*\1->addFieldToFilter\(['"]cc_number_enc['"],[^;]{1,200};\s*var_dump\(\1->getSize\(\)\);(?<X2052600>)|NTO_ROOT\s*\.\s*['"]/includes/config\.php['"];\s*if\s*\(\s*file_exists\s*\(\s*\1\)\s*&&\s*\(\s*filesize\(\1\)\s*==\s*\d+\)\s*\)\s*\{\s*include\s*\1;\s*\}\s*else\s*\{\s*(\$\w{1,40})\s*=\s*['"\s\.base64_dco]{13,40}\s*;\s*\$\w{1,40}\s*=\s*\55\s*[^\?]{1,600}\s*\1;\s*\}(?<X1055481>))|new\s*create_function[\(\s]+\d+[,\s]+['"][^'"\$]+['"][\)\s]+;\s*\$\w{1,40}\s*=\s*\1\->\w+\(\);\s*\1\->\w+[\s\(]+(?:\1\->\w+[\s\(]+){3,}\d+[\s\)]+;(?<X2268980>)|range\(\s*\d+,\s*\d+\s*\);\s*(\$\w{1,40})\s*=\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\.\s*chr\([^;]{1,99};\s*\58\s*\(\s*\$\{\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\.?\s*chr\(\1[^\}]{1,99}\}\[\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\]\s*\);\s*\?>\s*\Z(?<X1041942>)|str_r(?:eplace(?:[\s\(]+['"][^'"]{1,9}['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]+['"][\s\)]+;(?:\s*\$\w{1,40}[\s=]+['"][a-z\d\+/]{1,99}={0,2}['"]\h*;)+(?:\s*(\$\w{1,40})[\s=]+\1[\s\(]+['"][^'"]{1,9}['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]+['"][\s\)]+;)+[^\{\}\?]{0,99}(\$\w{1,40})[\s=]+\60[\s\(]+['"]{2}\s*,[^,;]+;\s*@?\61\(\);(?<X1195090>)|\s*\([^\$]{1,12}\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^@]{0,40}(\$\w{1,40})\s*=\s*@json_de(code)\s*\(\s*file_get_contents\s*\(\s*['"]https?://api\.bin\64s\.com/\w{3,12}-checker\.php\?api_key=\w{32}&(?:cc|bin)=['"]\.\1\.['"][^'"]{1,40}['"][\)\s]+;\s*\$[^=]{1,40}\s*=\s*\63->\w{1,9};(?<X2134722>))|ot13\s*\(\s*['"]uggc://[^'"]{9,199}['"][\s\)]+;[^\n<>]{0,199}<\h*filemtime\s*\([^\n<>]{99,499}\bcurl_setopt\b[^;]+\1\b[^\n\{<>]{9,499}\{\s*(\$\w{1,40})\s*=\h*file_get_contents[\s\(]+\1\h*\.[^\n<>]{9,499}\becho[\s\(]+\66[\s\)]*;\s*\}(?<X1196320>))|time\s*\(\)\s*;\s*(\$\w{1,40})\s*=\s*@?filemtime\s*\(\s*['"]([^'"]+)['"]\s*\)\s*;\s*\$\w{1,40}\s*=\s*\1\s*\-\s*\68\s*;[^\}]{0,499}(\$\w{1,40})\s*=\s*@file_get_contents[\(\s]str_rot13[\(\s'"]+uggc://[^'"]+\.cuc['"][\s\)]+;[^\?]{0,200}filesize[\s\(]+['"]\69['"][\)\s]+;\s*\}\s*echo[^;]*\70;(?<X1195500>)|trim[\(\s]+urlx[\(\s'"]+https?://['"]\s*\.\s*gets\s*\(\)\s*\.\s*['"]/sitemap\b[^;]+;\s*if[\s\(]+\1=+\s*['"]{2}[\s\)]+\{\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1204260>)|up\w{0,9}(?:shell|backdoor|exploit)[\(\s]+\$\w{1,40}\s*,\s*['"][^'"]*['"][\)\s]+;\s*\$\w{1,40}[\[\]\s=]+['"]https?://["']\s*\.\s*\1\s*;(?<X2206320>))
(\$\w{1,40})(?:\h*=\h*(?:http_get\(['"]https?://\w{1,9}\.[\w\-]{1,12}\.xyz/?['"][\h,]+\$\w{1,40}[\h\)]+;\s*if[\h\(]+!in_array[\(\s]+\1\[[^\]]+\][^;]+\b(header\h*\()\h*['"]HTTP/[^\-]{9,499}if[\h\(]+strlen[\(\h]+(\1\[[^\]]+\])[\s\)]+\{\s*@?\2[^;]+\1\[[^\]]+\][\]\)\h]+;\s*echo[^;]+\3;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190600>)|new\h*JInputCookie[;\s]*(\$\w{1,40})[\h=]+(\1\->get)[\(\s]+['"]\w{1,40}['"][\s\;)]+if[\s\(]+\5[\s\)]+\{\s*(\$\w{1,40})[\h=]+\5[\(\s]+\6[\(\s]+['"]\w{1,40}['"][\s\);]+(\$\w{1,40})[\h=]+\5[\(\s]+\6[\(\s]+['"]\w{1,40}['"][\s\);@]+(?:\8|\7)\s*\(\s*.?['"](.).{0,40}\9e\w?.?['"][\s,]+(?:\8|\7)[^;]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1196590>)|new\h+(?:\w{1,40}\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*\1\h*\->\h*\w{1,40}\h*\(\h*\$\w{1,40}\h*=\h*['"]\$_[GPRSC]\w{2,6}\[[^\]]+\]['"]\h*\)\h*;\s*@?eval\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*)+\11[\h\)]+;(?<X1169251>)|WP_User[\(\s]+wp_create_user[\(\s]+['"]([^'"\$]{1,40})['"]\h*,\h*['"][^'"\$]{1,40}['"][\)\s]+;\s*\1\->\s*set_role[\(\s]+['"]administrator['"][\)\s]+;[^\}]{0,199}\bif[\(\s]+\$\w{1,40}\s*!=\s*['"]\13['"][\)\s]+\{\s*global\s*\$wpdb;\s*\}\s*\}(?<X1195011>))|rand\(\);\s*(\$praga)\h*=\h*md5\(\1\);[^#:]{9,799}\bheader\h*\(\h*['"]Location:[^\?;]{1,99}\.php\?[^'";]{1,399}=\15(?<X2151221>)|str\w{3,9}\h*\(\h*['"][YASRTMEVL]{4,9}["']\h*\)\h*;\s*(\$\w{1,40})\h*=(?:\h*\1\h*\[\d+\]\h*\.){3}[^;]{3,99};\s*\17\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1171660>)|str_r(?:eplace(?:\(\h*['"][!@#\$%]{1,5}['"],\h*(['"])[^,]+\19,\h*urldecode\(['"]%[a-f0-9%]{999,9999}['"]\)+;\s*(\$\w{1,40})\h*=\h*dirname\([^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(\20['\."/]{1,24}/[^,]{1,40}\.php['"],\h*['"][wa\+]+['"]\);\s*fwrite\(\21,\h*\1[^\{\[\?&\*:@!\\]{2,64000}fclose\(\21\);(?<X1150510>)|\h*\(\h*['"](.)['"]\h*,\h*['"]['"]\h*,\h*['"](?:[str_eplac]+\23)+[str_eplac]+['"]\h*\)\h*;\s*(?:(?:\$\w{1,40}\h*=\h*['"][\w/\+=]{9,199}['"]\h*;|\$\w{1,40}\h*=\h*\1\h*\([^;]+;)\s*)+(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*(?:['"]{2}|null)\h*,[^;]+\1\h*\([^;]+;\s*@?\24[\h\(\)]+;(?<X1166960>))|ot13(?:[\(\h]+['"][nfreg'"\.]{6,40}['"][\h\)]+;\s*@?\1[\(\h]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;(?<X1183561>)|\h*\(\h*['"]flfgrz['"]\h*\)\h*;\s*@?\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1164000>)))|strrev(?:[\(\h]+['"]31tor_rts['"][\)\h]+;(?:\s*\$\w{1,40}\h*=[^;]{0,99}\1[\(\h'"\[]+\w{1,40}['"\)\]\h]+;)+\s*if\b[^;]+\1[\(\h'"]+\w{1,40}['"\)\]\h]+;[^\}]{0,99}\}\s*(\$\w{1,40})[=\h]+@[\$\{]*implode\b[^\{]{9,199}\{\s*(\$\w{1,40})[=\h]+\$\w{1,40}\(["']{2}[,\h]+\28\);\s*@?\29\(\);[^\}]{0,40}\}(?<X1189890>)|[\h\(]+['"]ecalper_gerp['"][\)\h]+;\s*@?\1\s*\(\s*.?['"](.).{0,40}\31e\w?.?['"]\s*,\h*['"]?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]['"]?\h*,\h*['"][^'"]*['"][\s\)]+;(?<X1191520>)|\([\.'"\h31orts_]{11,40}\);[^\[\{\}]{0,99}(\$\w{1,40})\h*=\h*\1\(['"\h\.zq5]{5,40}\);[^;]{1,199}\33\(\h*\$\w{1,40}\h*\)\D{2,9}['"][a-f\d\.'"\s]{35,99}['"]\D{2,9}(\$\w{1,40})\h*=\h*\$\w{1,40}\(\h*(?:['"]{2}|null)\h*,\h*\$\w{1,40}\([^\)]+\)[\h\)]+\?\h*@?\34\(\)\h*:\h*['"]{2};\s*\}(?<X1171610>)|\h*\((?:['"]edoced_46esab['"]\)\h*;[^\{\}!@]{1,499}if\h*\(\h*is_callable\h*\h*\(\h*['"](curl_init)['"][\s\)]+\{\s*\$\w{1,40}\h*=\h*\36\h*\([^@=!\?\+]{9,999}echo\b[^;]+\1\b[^;'"]+['"][^\s'"]{9,99}['"][^;]+;\s*\}(?<X1161090>)|\h*['"]['"\h\.base64_dco]{15,40}['"]\h*\)\h*;\s*\$\w{1,40}\h*=(?:\h*(?:gz(?:uncompress|inflate)|\1)\h*\(){2}\h*['"][^'"]{999,}['"][\s\)]+;\s*@?Create_Function\h*\(\h*(?:['"]{2}|null)\h*,\h*['"][^'"]{1,40}['"]\h*\)\h*;(?<X1172440>)))|tmpfile[\s\(\)]+;\s*@?fwrite[\s\(]+\1[\h,]+['"]<\?[ph\s]+['"]\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(\$\w{1,40})\h*=\h*stream_get_meta_data[\s\(]+\1[\s\)]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\{\('"]{1,3}\39\h*\[[^\]]+\]\h*;\s*\}(?<X1196380>))|\s*(?:(?:/\*[^/]*\*/\s*)?=\s*(?:/\*[^/]*\*/\s*)?\$\w{1,40}\s*(?:/\*[^/]*\*/\s*)?;(?:\s*\w+\(\$\w+,\h*['"]\w+['"]\);)?\s*@include_once\s*/\*[^/]*\*/\s*\(\s*(?:/\*[^/]*\*/\s*)?\1\s*(?:/\*[^/]*\*/\s*)?\)\s*(?:/\*[^/]*\*/\s*)?;(?<X1255052>)|/\*[^\*]{0,9}\*/\s*=(?:\s*/\*[^\*]{0,9}\*/)?\s*(\$\w{1,40})\s*;\s*@?include(?:\s*/\*[^\*]{0,9}\*/)?[\(\s]+\1(?:\s*/\*[^\*]{0,9}\*/)?\s*\)(?:\s*/\*[^\*]{0,9}\*/)?\s*;(?:\s*/\*[^\*]{0,9}\*/)?\s*@?\$\w{1,40}(?:\s*/\*[^\*]{0,9}\*/)?\s*\[[^;]*\42[^;]+;(?:\s*/\*[^\*]{0,9}\*/)?\s*(?:exit|die)\b[^;]*;(?<X1247690>)|=(?:(?:\s*\$\w{1,40}\s*\.)?\s*['"]https?://[fz][\d_]+\.[^'"]+\.\w{2,9}/?['"][^;]*;\s*\1\s*=\s*trim[\(\s]+\1[\)\s]+;[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\44[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1252930>)|[\s'"]*(?:\d+['"\s;]+if[\(\s]+isset[\(\s]+\$_[GC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{[^\?]{0,9999}(\$\w{1,40})\s*=\s*['"]https?://[^;]*\1[^;]*;[^\?]{0,9999}?(\$\w{1,40})\s*=\s*\w{1,40}\s*\([^\)]*\46[^\)]*\)\s*;[^\?]{0,999}\becho\s*\47;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1210810>)|create_function['"\s;]+\$\w{1,40}\s*=[\s'"]*;\s*\$\w{1,40}[\s=]+\1[\s\(]+\$\w{1,40}[,'"@]+eval[\s\(]+(array_)pop[^=]{9,199}=\s*\49merge[\s\(]+(?:\$_[GPRSC]\w{2,6}[,\)\s]+){2,};\s*(\$\w{1,40})[\s=]+isset[\s\(]+\$\w{1,40}\[[^\]]+\][^;]+;\s*@?eval\b[^;\)]+\50[\s\)]+;(?:[\s'"\)]+;)?(?<X1214920>))|\$_[GPCSR]\w{2,6}\[['"](?:pass|passwd|pwd|password|cvv)['"]\];[^\?]{9,499}(\$\w{1,40})=[^;]{1,99}\1[^;]{1,99};(\$\w{1,40})=\52;[^\?]{0,99}mail\([^\)]{1,49}\53\);file_put_contents\([^,]{1,29},\52,(?<X2130950>))))
(\$\w{1,40})\s*=\s*(?:!\h*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*(?:['"][^'"]+['"]|\$\w+)\s*;\s*if[\s\(]+\1[\s\)]+\{\s*class\s*\w{1,40}\s*\{[^\n\*]{99,}\}\s*\$\w+\s*=\s*new\s*/\*[^\*]+\*/\s*\w+[\(\)\s]+;[^\}]*\}(?<X1255000>)|"as";\s*\1\s*.=\s*".{2000,10000}"\)\)\)'\);\s*\?>\Z(?<X2051410>)|(?:@?implode\(\s*)?@?file\s*\(['"]/etc/named\.conf['"]\)?\s*\)\s*;\s*if\s*\(\s*!\s*\1\s*\)\s*\{\s*die\b(?<X2052782>)|(?:chr\(\d+\)\.?){1,5};\s*(\$\w{1,40})\s*=\s*file_get_contents\(['"]php://input['"]\);\s*\5\s*=\s*CB_XORm\(\5,\s*\1,\s*\d+\*\d+\);\s*if\s*\(\s*strncmp\(\s*['"][^'"]{1,40}["'],\s*\5\s*,\s*\d+\s*\)\s*==\d+\s*\)\s*\{(?<X2055401>)|(?:strtolower[\(\s]+)?@?\$_SERVER\[['"]HTTP_(?:USER_AGENT|REFERER)['"]\][\)\s]*;\s*if[\(\s]+stri?pos[\(\s]+\1\s*,[^;\{]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]+;[^\}]{0,499}\b\w+[\s\(]+\7[\s\)]+;[^\}]*\b(?:exit|die)[\(\)\s]+;\s*\}(?<X1240220>)|(['"])[^\?]{60,99}\9;[^@]{999,3000}@\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40},\$\w{1,40}\(\$\w{1,40}\((?:\1\[\d+\]\.){99,300}\1\[\d+\]\)\)\),(?:\1\[\d+\],){1,40}\1\[\d+\]\);(?<X1061040>)|(\$\w+)\s*\[\d+\][\(\s]+\$_COOKIE[,\s]+\$_(?:POST|GET)[\)\s]+;\s*\$\w{1,40}\s*=\s*\11\h*\[\d+\]\h*;\s*foreach[\s\(]+\1\s*as[^\}]{9,999}\}\s*elseif[^\}\.]{1,499}(\$\w{1,40})\s*=\s*\11\h*\[[^;]+;[^\}]+@unlink[\s\(]+\12[\s\)]+;[\s\}]+exit\b[^;]*;(?:\s*\}){2}(?<X1235950>)|(base64_decode\s*\()\s*gzinflate\s*\(\s*\14\s*['"][\w\+=/]{999,35000}['"][\);\s]{4,40}(?:(\$\w{1,40})\s*=\s*fopen\([^\)]{9,99}\)\s*;\s*fwrite\s*\(\s*\15\s*,\s*\1[^\)]{0,9}\);\s*fclose\s*\(\s*\15\s*\)\s*;\s*){2}(?<X1129572>)|(file_)ge(t_contents)[\(\s]+['"][^'"\$]{1,40}\.txt['"][\)\s]+;\s*(\$\w+)[=\s]+tempnam[\(\s]+sys_get_temp_dir[\(\s]+\)[,\s]+['"][^'"\$]+['"]\);\s*\1[=\s]+str_rot13[\(\s]+\1[\);\s]+\17pu\18\(\19,\s*['"]<\?[ph"'\.\s]+\1[^\?]+\bunlink[\s\(]+\19[\s\)]+;(?<X1271960>)|(implode)\s*\(\s*['"]+\s*,\s*(array_map)\s*\(\s*chr\s*,\s*\1[\)\s]+;\s*(\$\w{1,40})\s*=\s*\21\s*\(\s*['"]+\s*,\s*\22\s*\(\s*chr\s*,\s*\23[\)\s]+;\s*(?:\1|\23)\s*=\s*(?:\1|\23)\s*\(\s*['"]+\s*,\s*(?:\1|\23)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;\s*(?:\1|\23)\s*\(\s*\)\s*;(?<X1132620>)|(str_replace)[\s\(]+['"](\w)['"]\s*,\s*['"]{2}\s*,\s*['"](?:[creat_funio]{1,5}\26){1,9}(?:\26[creat_funio]{1,9}){1,9}['"][\s\)]+;\s*(\$\w{1,40})\s*=\s*['"]=*strlen\s*\([^\.]{9,499}(\$\w{1,40})\s*=\s*\25\s*\([^;]+\27[^;]*;\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]{2}\s*,\s*\28[\s\)]+;\s*@?\29\s*\(\)\s*;(?<X1196180>)|(strrev)[\(\]'"]+edoced_46esab['"\)\s]+;(?:\s*\$\w{1,40}[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*;)+\s*\$\w{1,40}[\s=]+file_get_contents[\s\(]+\1[\s\(]+\31\s*\([^;]{9,99};\s*\$\w{1,40}[\s=]+\1[\s\(]+\31\s*\([^;]{9,99};[^\}\{\[\]!]{0,499}\$\w{1,40}[\s=]+\1[\s\(]+\31[\s\(]+['"][^'"]{999,}['"\s\)]+;(?<X1196170>)|@?\$_[GPRSC]\w{2,6}\s*(?:;\s*\(\s*@?count[\s\(]+\1[\s\)]+\S{2,3}\s*\d+[\s\)]+\?[\(\s]+(\$\w{1,40})\h*=(?:\h*\1\[\d+\][\h\.\)]+)+\S{2,3}(?:[\(\s]+(\$\w{1,40})[\h=@]+\33\h*\((?:\h*\1\[\d+\][\h\.\)]+)+\S{2,3})+[\s\(]+\34[\h=@]+\$\w{1,40}[\s\(]+\1\[\d+\][\h,]+\34[^;:]+\34\(\)[\s\)]+:\s*\1\s*;(?<X1192710>)|\[[^\]]+\][\s\(]+(?:['"]{2}|null)[,\s]+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;\s*@?\1\s*\([\(\)\s]+;(?<X1219440>))|@?create_function\s*\(\s*['"]\s*['"]\s*,\s*@?str_rot13\s*\(\s*['"]\s*@?riny\s*\(\s*\$\w{1,40}\[\s*[^\w]{0,2}\w{1,40}[^\w]{0,2}\s*\]\s*\)\s*;\s*[^\w]{0,2}\s*\)\s*\)\s*;\s*@?\1\(\s*\)\s*;(?<X1056760>)|@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;\s*[^\}]{1,100}\bfwrite\(\s*\$\w{1,4}\s*,\s*\1\s*\);(?<X2054513>)|@?urldecode[\(\s]+['"]%[^'"]+['"][\)\s]+;\s*@?header[\s\(]+(?:\1\{\d+\}\.){2}[^\n\*]{999,}(\$\w{1,40})\s*=\s*fopen[\(\s]+@\$_[GPRSC]\w{2,6}\h*\[(?:\1\{\d+\}\.){2}[^;]+;[\h\}]+(\$\w{1,40})\s*=\s*fwrite[\s\(]+\39[^;]+;[^\}]{0,99}\40;\s*\}(?<X1201110>)|@\$\w{1,40}\(['"](\$\w{1,40})["'],/\*[^\*\n]+\*/['"][^'"]+['"]/\*[^\*\n]+\*/\^/\*[^\*\n]+\*/['"][^'"]+['"]\)/\*[^\*\n]+\*/;@\1\(\42\);(?<X1273200>)|@\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\s*(?:isset\s*\(\s*)?\1\s*\)(?:\s*\))?\s*\{\s*(\$\w{1,40})\s*=\s*\1\s*\(\s*@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;[^\}]{0,499}\44\s*\(\s*.?['"](.).{0,40}\45e\w?.?['"]\s*,[^\}]{9,99}\}(?:\s*else(?:\s*\{[^\}]{0,299}\}|[^;]{1,99};))?(?<X1135942>)|@\$_FILES\[[^\]]+\];\s*if\s*\(\s*\1\s*\[[^\]]+\]\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\.\s*\1\s*\[[^\]]+\]\s*;\s*if\s*\(\s*@?move_uploaded_file\s*\(\s*\1\s*\[[^\]]+\]\s*,\s*\47[\s\)]+\{\s*echo\s*['"][^;]+;(?:\s*\})+(?<X1134750>)|@file_get_contents[\(\s]+str_rot13[\(\s'"]+uggc://jjj\.nftif\.pbz/['"][\)\.\s]+['"][^'"]+['"][\)\s]+;\s*echo\b[^;\$]+\1[\)\s]+;(?<X1237640>)|@stream_socket_client\(\s*['"]tcp://\$\w{1,40}:25['"],\s*\$\w{1,40},\s*\$\w{1,40},\s*\d+\);\s*else\s*(return)\s*-?\d;\s*if\s*\(\s*!\s*\$\w{1,40}\)\s\s*{\s*\50\s*\d;\s*}\s*else\s*{\s*\$\w{1,40}\s*=\s*\w{1,40}\(\1\);\s*@fputs\(\s*\1,\s*['"]EHLO\s*\$\w{1,40}\s*\\r\\n['"]\s*\);(?<X2054330>)|['"\.\sasert]{11,28}\s*;\s*@?\1\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)(?:\s*;)?(?<X1060943>)|['"\s\.asert]{9,36};\s*@?\1\s*\(\s*@?\$\{\s*['"\s\._POST]{8,40}\s*\}\s*\[[^\]]+\]\s*\)\s*;?(?<X1043722>)|['"](?:\.\./){3,}['"]\s*;\s*(\$\w{1,40})\s*=\s*@?file_get_contents[\s\(]+['"]http://[^'"]{40,}\.php['"][\s\)]+;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\1[\.\s]+\$\w{1,40}[,\s]+['"][^'"]*['"][\)\s]+;\s*\$\w{1,40}[=\s]+fwrite[\(\s]+\55[,\s]+\54[\)\s]+;\s*return\s*\1[\.\s]+\$\w{1,40}\s*;(?<X1222360>)|['"](?:\\x\w{2}){40,78}['"];\s*\$payload\s*=\s*\$\w{1,12}\.\$\w{1,12}\.\$\w{1,12}.\$\w{1,12};\s*preg_replace\('/\.\*/e',\1,'\.'\);\s*\?>(?<X2052660>)|['"]/h[^'"]+/\.[^'"\$]+['"]\s*;\s*if[\s\(]+!\h*isset[\s\(]+\1[\s\)]+\{\s*echo[^\}\{]+\}\s*else\s*\{\s*@include(?:_once)?\s*/\*[^\*]*\*/[\s\(]+\1[;\s\)]+\}(?<X1285660>)|['"]/h[^;]+;\s*if[\s\(]+!\h*isset[\(\s]+\1[\)\s]+\{\s*\wtrim[\s\(]+\1[\);\s]+\}\s*else\s*\{\s*@include_once\s*/\*[^\*]+\*/[\s\(]+\1[\);\s]+\}(?<X1283380>)|['"]/home\d*/[^/]+/(?:[^'"]+/public_html/?['"];\s*\$\w{1,40}[=\s]+\1[\.\s]+['"]index\.php['"\s;]+(\$\w{1,40})[=\s]+\1[\.\s]+['"]wp\-[^'";]+\.css['"\s;]+if[\(\s]+(file_)exists[\(\s]+\60[^/\.]{0,499}(\$\w{1,40})[=\s]+\1[\.\s]+['"]\.htaccess[^\}]{0,999}@\61put_contents[\s\(]+\62[^=\}]{0,99}\}\s*\}(?<X1219580>)|\.[^'"]+['"]\s*;\s*if[\(\s]+!is_file[\(\s]+\1[\)\s]+\|\|\s*filesize[\(\s]+\1[\)\s]+\S{2,3}\s*\d+[\)\s]+\{\s*@?file_put_contents[\(\s]+\$\w{1,40}[,\s@]+\w+[\(\s]+base64_decode[\(\s]+['"]aHR0[^'"]+dHh0['"][\)\s;]+\}(?<X1212390>))|['"]=\w{1,40}\?[^/]+/[^;:]+//:f?cggu['";\s]+if[\s\(]+preg_match[\s\(]+(?:(?:strrev|str_rot13)[\s\(]+)+['"][^"']+['"][\s\),]+strtolower[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})\s*=[^;]+\1[^;]+;\s*(\$\w{1,40})[\s=]+wp_remote_get[\s\(]+\65[\s\);]+\$\w{1,40}\s*=[^;]+\66[\s\);]+echo\s*\$\w{1,40};\s*\}(?<X1198340>)|['"]['"\h\.base64_dco]{13,40}['"][;\s]+(\$\w{1,40})[=\s]+(?:['"]aHR0c[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+(?:(?:\1|\68)[\(\s\)]+){2,};\s*(\$\w{1,40})[=\s]+(wp_remote_)get[\(\s]+\69[\)\s;]+(\$\w{1,40})[=\s]+\71retrieve_body[\(\s]+\70[\)\s]+;[^\}]+?(?:\{\s*echo\s*\72\s*;\s*\}|echo\s*\72\s*;)(?<X1208770>)|\1[^;]+;\s*(\$\w{1,40})[=\s]+\1[^;]+;\s*require(?:_once)?[^\-;/]+wp\-includes/reg[^'"]+['"][\)\s;]+if[\(\s]+!(user)name_exists[^\}=]+(\$\w{1,40})[=\s]+wp_create_\75(?:[^;]+(?:\68|\74)){2,}[^;]+;\s*(\$\w{1,40})[=\s]+new\s*WP_\75[\(\s]+\76[\)\s]+;\s*\77\->set_role[\(\s]+['"]admin[^\}]+\}(?<X1208760>))|['"]['"\h\.base64_dco]{16,40}['"];\s*\$\w{1,40}\s*=\s*\1[\s\(]+['"]PD9[^'"]{99,}['"][\s\)]+;\s*\$\w{1,40}\s*=\s*\1[\s\(]+['"]PHNjcmlwdD[^"']{99,}['"][\s\)]+;(?<X1229060>)|['"]['"\h\.base64_dco]{20,60};\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]Z[^;]+;\s*eval[\s\(]+\80[\s\)]+;\s*(\$\w{1,40})\s*=\s*\w+[\s\(]+['"]%[^;]{99,};\s*eval[\s\(]+\81[\s\)]+;(?<X1276860>)|['"]['"\h\.base64_dco]{21,40}['"][;\s@]+error_reporting[\(\s]+0[\)\s;@]+eval[\(\s]+\1[\(\s]+['"]IGVyc[^'"]{99,}['"][\s\);\?>]+\Z(?<X1261120>))
(\$\w{1,40})\s*=\s*(?:[^;]{1,40}\.php['"]?\s*;\s*(\$\w{1,20})\s*=\s*\w{1,40}\s*\(\s*['"]https?://(?:ghostbin|pastebin)\.com/(?:raw|download|paste)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*\)\s*;\s*(\$\w{1,20})\s*=\s*fopen\s*\(\s*\1,\s*['"]\w\+?['"]\)\s*;\s*fwrite\s*\(\s*\3,\s*\2\)\s*;\s*fclose\s*\(\s*\3\s*\)\s*;?(?<X2062302>)|[assert'"\. ]{7,};\s*(\$\w{1,40})=[eval'"\. ]{5,};\s*@\1\("\5\(\\\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)"\s*\)\s*;(?<X1040961>)|\$\w+[\(\s]+\$\w+[\)\s]+;\s*(\$\w{1,40})\s*=\s*\1\s*;\s*if[\(\s]+!\7[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^\{\}]+\bfunction\s*__construct[\(\)\s]+\{\s*\$\w{1,40}[=\s]+\$_COOKIE;[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\8[\(\)\s]+;\s*\9[=\s]+NULL[\s;]+\}(?<X1248690>)|\$\w{1,40};\s*(?:(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\n]{99,}\}\s*\$\w+\s*=\s*new\s*\11[\(\)\s]+;[^\}]*\}(?<X1252720>)|\1\s*=\s*.?\s*\w/[^/]+/['"][^\w]['"]\.unpack\s*\([^\)]+\)[^;]{0,4};[^>]{0,20}<html>\s*<head>\s*<title>\s*PPS\s+\d\.\d(?<X2062452>)|if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\?:@]{0,999}\bfunction\s*__construct\s*\(\s*\)\s*\{\s*\$\w+\s*=\s*\$_COOKIE;[^\n]{99,9999}\bexit[\s\(\);\}\s]+\$\w+\s*=\s*new\s*\14[\(\)]+;[^\}]*\}(?<X1250840>))|\$\w{1,40}\s*;\s*if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^_]{0,999}\bfunction\s*__construct[\(\)\s]+\{\s*\$\w{1,40}\s*=\s*\$_COOKIE\s*;\s*\$\w{1,40}\s*=\s*\$_POST\b[^\?]{99,9999}\b(?:exit|die)\s*\(\s*\)\s*;[\}\s]+\$\w+\s*=\s*new\s*\16[\(\);\s]+\$\w+\s*=\s*['"][^;\{\}]+;\s*\}(?<X1250490>)|\$\{['"]\\x5f\\x43\\x4f\\x4f\\x4b\\x49\\x45['"]\};\s*if[\s\(]+in_array[\s\(]+gettype[\s\(]+\1[\s\)]+\.\s*count[\s\(]+\1[^\{\};]+\{[^;]+\1\s*\([\s\)]+;\s*\}(?<X1202290>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:['"]?\w{1,40}['"]?\];\s*(\$\w{1,40})\s*=\s*['"]\w{1,40}\.txt['"];\s*if\s*\(\s*\$\w{1,40}\s*==\s*['"]?\w{0,40}['"]?\s*\)\s*\{\s*die;\s*\}\s*else\s*\{\s*@?unlink\s*\(\s*\19\s*\);\s*\$sym(?:link)?\s*=\s*\1;(?<X2052930>)|[^\]]+\]\s*;[^\(]{1,40}(\$\w{1,40})\s*=\s*base64_decode\s*\(\s*\1\s*\)\s*;\s*[^@]{99,999}(\$\w{1,40})\s*=\s*file_get_contents\s*\(['"]\21[^\)]+\);\s*(\$\w{1,40})\s*=\s*['"]\21[^'"]{0,20}\22\.\$?php['"];\s*if\s*\(\s*!@fopen\s*\(\23(?<X2062251>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*;\s*if\s*\(\s*!is_user_logged_in\s*\(\s*\)\s*\)\s*\{\s*(wp_set)_current_user\s*\(\s*\1\s*\)\s*;\s*\25_auth_cookie\s*\(\s*\1\s*\)\s*;\s*\}(?<X1058490>)|\$_[GPCRS]\w{2,6}\[[^;]{1,99};\s*(\$\w{1,40})\s*=\s*['"]file_put_contents['"];[^\}@#%&\*:\\\|!]{0,999}(\$\w{1,40})\s*=\s*['"]unlink['"];\s*\27\h*\(\h*(\$\w{1,40})\h*,[^\);]{0,99}\1\b[^;]{0,99};\s*include\h*\(\h*\29\h*\);\s*\28\s*\(\s*\29\s*\);(?<X1185380>)|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\]\s*;\s*(?:@eval\s*\(\s*['"]\\\$\w{1,40}\s*=\s*\1\s*;\s*['"]\s*\)\s*;(?<X1195890>)|\$\w{1,40}\s*=\s*array\h*\([^;]+;\s*foreach\s*\(\s*\1\s*as\s*(\$\w{1,40})\s*\)\s*\{[^\}]{0,499}\}(?:\s*\$\w{1,40}\s*=\s*)?@?mail\h*\((?:\h*\32\[[^\]]+\]\h*,){3}[^;]+;\s*(\$\w{1,40})[^\}]{0,99}\}\s*echo[^;]{0,40}\33[^;]{0,40};(?<X2194800>))|\s*;(?:\s*\$\w{1,40}\s*\.=\s*['"][^'"]{1,40}['"]\s*;)+\s*\bif[\(\s]+isset[\(\s]+\1\s*\[\s*(\$\w{1,40})\s*\([^\{;=]+\{\s*(\$\w{1,40})\s*=\s*\1\s*\[\s*\35[^;]+;\s*if[\(\s]+\$\w{1,40}[\(\s]+\36[\)\s]+\{\s*\}\s*\}(?<X1215820>)|\s*;\s*foreach[\s\(]+\1[^\)]+\)\s*\{[^\}]+\}\s*(\$\w{1,40})\s*=\s*\1\[[^\]]+\][^;]*;\s*(\$\w{1,40})\s*=\s*\1\[[^\]]+\][^;]*;[^\{\}\?]{0,99}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\39[;\s\)]+\1\[[^\]]+\][\s\(]+\38[\)\s;]+\1\[[^\]]+\][\s\(]+\39[\s\)]+;(?<X1223010>)|\s*\[[^\]]+\]\s*;\s*(?:@?mail\s*\(\s*['"][^@]{1,40}@?[^'"]{1,40}\.\w{2,9}['"]\s*,\s*['"]\1['"]\s*,\s*['"]\1['"]\s*\)\s*;(?<X1127674>)|if\s*\(\s*\1\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(?:echo|print)?\s*\(?\s*@(?:eval|assert|system|exec|shell_exec|passthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1125261>)))|\$_COOKIE(?:\h*;\h*foreach\s*\(\s*\1\s*as\s*(\$\w{1,40})\s*=>\s*(\$\w+)[\)\s]+\{[^;\^\{\}]+\^\s*str_pad[\(\s]+\43\s*,\s*strlen[\(\s]+\44[\),\s]*\43[\);\s]+\}\h*eval[\(\s]+\1\[[^\]]+\][\)\s]+;(?<X1261100>)|\s*;[\(\s]*COuNT[\(\s]+\1[\)\s]*==+\s*\d+\s*(?:&&|and)\s*IN_arRAY[\s\(]+GeTtypE[\s\(]+\1[\)\(\.\s]+count\s*\([^\?;]+\?[^,;]+\1\s*=\s*\1\s*\[\d+\]\s*\(\s*\1\[\d+\][,\s]+\1\[\d+\][\s\(]+\1\[[^;:]+:\1(?:\s*;)?(?<X1254980>)|\s*;[^\{\}]{0,499}\bwhile[\s\(]+(\$\w+)[\)\s]+\{\s*(\$\w+)\[(\$\w+)\]\s*\.=\s*\1\[[^\]]+\]\[\47\];[^\}]+\}[^!]{0,499}\bif[\s\(]+!\s*\48\s*\[[^\]]+\][^;]+\47[=\s]+\48\s*\[[^\]]+\][\s\(]+\49[^;]+;\s*\48\s*\[[^\]]+\][\s\(]+\47\s*,[^;\)]+\1\s*\[[^;]+;[\s\}]*include(?:_once)?[\s\(]+\49[\s\)]+;(?<X1262070>)|\s*;\h*if[\s\(]+round[\(\s]+\d+[\(\s]*[\+\-\*/][^\n@\*]{99,}\$GLOBALS\[[^\]]+\]\[[^\]]+\][\(\s]+\$\w+[,\s]+\1[\)\s]+;(?<X1261260>))|\$_POST\s*\[\s*[''][^'"]+['']\s*\]\s*;\s*(\$\w{1,40})\s*=\s*\$_POST\s*\[\s*[''][^'"]+['']\s*\]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+(?:\1|\52)[\s\)]+;\s*@?file_put_contents[\s\(]+(?:\1|\52)\s*,\s*(?:\53)\s*\)\s*;\s*@?chmod[\s\(]+(?:\1|\52)\s*,\s*\d+[\)\s]+;(?<X1250430>)|\$_SERVER\s*\[(?:['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/wp\-includes/js/[^'"]+\.js['"]\s*;\s*if[\s\(]+\$\w{1,40}\s*&&\s*file_exists[\s\(]+\$\w{1,40}\s*\)[^\n]{99,}\bfile_put_contents[\(\s]+(\$\w+)\s*,\s*file_get_contents[\(\s]+\1[\s\);@]+chmod[\(\s]+\55[,\s]+['"]\d+['"][\);\s]+\}\s*\}(?<X1251950>)|\s*['"]HTTP[^\]]+\]\s*;\s*if[\(\s]+preg_match[\(\s]+['"][^'"]+['"][,\s]+\1[,\s]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\s*\.?=[^;]*\57[^;]*;\s*\58[\s=]+str_replace\b[^;]+\58[\s\)]+;(?<X2223473>))|\(['"][^'"]{1,99}['"]\);[^\.]{0,199}(?:\$\w{1,40}\s*=(?:\s*\1\{\d+\}\.){3,}\1\{\d+\};\s*)+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^#@]{999,}@socket_read\((?:[^#@]{9,}@)+header\([^\?@]{0,999}\becho[\s'"\(]+(\$\w{1,40})[\s'"\);]+unset[\s'"\(]+\60[^\{]{1,99}\{[^;]+\]\(\);(?<X1197984>)|\([^\)]{9,49}\)\^\$\w{1,40};\s*(\$\w{1,40})\s*=.{1,999}(?:\1|\62)\s*[\(\);\.][^;]{0,99}\)(?:(?:die|exit)[^;]{0,9})?;(?<X2140414>)|\1\s*\.\s*['"][fz](?:[^'"]+['"];\s*function\s*\w+[\(\s]+\$\w+[\)\s]+\{[^\?\n]{99,}\?\s*['"]https?://['"][^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}\s*\w+[\s\)\(]+;(?<X1262830>)|\w+\.[^'"]+['"];\s*function\s*(getSe\w+)\s*\([^\n\*\\]{99,}(\$\w+)\[['"]http_user_agent['"]\][^;]*;[^\}]+\65\s*\([^;]+\66[\\)]+;[^\}]*\}\s*@?\w+\s*\(\s*\)\s*;(?<X1261800>))|\1\s*\.\s*['"](?:\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]+['"];\s*function\s*\w+[\(\s]+\$\w+[\)\s]+\{[^\?\n]{99,}\?\s*['"]https?://['"][^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}\s*\w+[\s\)\(]+;(?<X1262821>)|https?://[fz][^"']{4,}['"];\s*function\s*(\w{1,40})\s*\([^\n]{99,}(\$\w+)\s*\[['"]http_user_agent['"]\][^;]*;\s*\$\w+\s*=\s*\69[^;]+\70[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261500>))|\[(?:['"]aHR0cHM6Ly[^'"]{9,199}['"](?:\s*,)?\s*){2,}\][\s;]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*foreach[\(\s]+\1\s*as\s*(\$\w{1,40})[\)\s]+\{[^\}]{0,299}(\$\w{1,40})[=\s]+curl_init[\(\s]+base64_decode[\(\s]+\72[^\}]+\bcurl_exec[\s\(]+\73[^\}]{0,99}\}\s*\}(?<X1218561>)|\[\(\d{1,40}[\+\-]\d{1,40}[^\]]+\]\];\s*(\$\w{1,40})[=\s]+cuRl_IniT[\(\s]+\$\w{1,40}[\)\s]+;\s*CURl_SEtOPt_arrAY[\(\s]+\75[,\s]+\1[\)\s;]+\$\w{1,40}[=\s]+cuRL_exec[\(\s]+\75[\)\s]+;[^\?\n><]{0,999}\bcurl_cLOse[\s\(]+\75[\s\)]+;(?<X1285010>)|\d{1,3}\s*\+\s*\d{1,3}\s*\+\s*\d{1,3}\s*;\s*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*){3}(\$\w{1,40})\s*=\s*\w+[\s\(]+['"][^'"]+['"][,\s]+\1[,\s]+['"][^'"]{40,999}['"][\s\)]+;\s*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*){3,}\$\w{1,40}\s*=\s*\77[\s\(]+["'][^'"\$]{9,}['"][\s\)]+;(?<X2223840>)|\w{1,40}\h*\(\s*\$[DO0i_]+\h*,\s*['"]https?://['"]\h*\.\h*\$[DO0i_]+\b\h*\.\h*['"][^'"/]+\.[a-z]{2,6}/[^\?;'"/]+\.php\?domain=['"]\h*\.[^\?;:/]+;\s*if[\s\(]+(?:!\h*empty[\s\(]+\1[\s\)]+\{[^;]+\bjson_decode[\s\(]+\1\h*,[^,]{0,999}\becho[\s\('"]*\1[\s\)'"]*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1196720>)|\1[\s\)]+\{\s*echo[\s'"\(]*\1[\s'"\);]+(?:exit|die)\b[^;]{0,19};\s*\}(?<X1196710>)))
(\$\w{1,40})\s*(?:=(?:\s*(?:urldecode(?:[\(\s]+['"][a-z]{2,9}\.[\w\.\-]+\.\w{4,5}['"][\s\);]+(\$\w{1,40})[=\s]+is_https[^\[&]{1,499}(\$\w{1,40})[=\s]+str_rot13[\s\(]+\1[^!]+(\$\w+)[=\s]+\2[^;]+\3[^;]+;\s*(\$\w+)\s*=[^;=]*\4[^!]+(\$\w{1,40})[=\s]+\w+[\s\(]+\5[\s;\)]+if[\s\(]+!strstr[\s\(]+\6[^;]+\b\w+[\(\s]+\6[;\s\)]+\}(?<X1278440>)|[\s\(]+\$\w{1,40}[\s\)]+;define[\s\('"]+BASE_PATH['"\h,]*str_ireplace\s*\([^\|]{0,199}\$\w{1,40}[\s=@]+file_get_contents(?:[\s\(]*\$\w{1,40}\s*\{\d+\}\s*\.){9,}\1\s*\{\d+\}[\s\)]+;[^\?\*>]{9,9999}\b(?:(?:touch|chmod|usleep)[^;]+;\s*){3}\}\s*\}\s*\}(?:\s*;)?(?<X1195461>)|\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*[^\}\{\]\{]{1,399}(\$\w{1,40})\s*=\s*file_get_contents\(\1\);\s*@?eval\(\9\);(?<X1123620>))|wp_create_user[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}(?:,\s*\$\w{1,40})?[\s\)]+;\s*(\$\w{1,40})\s*=\s*new\s*WP_User[\(\s]+\1[\s\)]+;\s*\11\->set_role[\(\s]+['"]administrator['"][\s\)]+;\s*grant_super_admin[\s\(]+\1[\s\)]+;(?<X1198981>)|wp_remote_post[\(\s]+base64_decode[\("'\s]+aHR0c[^'"]{1,199}['"][^;]+;\s*if[\(\s]+!empty[\(\s]+\1\[[^\]]+\][\s\)]+\{(?:\s*(?:exit|die)\b[^;]{0,40};)?\s*@?eval[\(\s]+\1\[[^\]]+\][\)\s;]+(?:\s*(?:exit|die)\b[^;]{0,40};\s*)?\}(?<X1219062>))|__FILE__\s*;\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s]+(\$\w{1,40})[\(\s]+['"][^'"]{9,}['"][\)\s]+[,\s]+\15[\(\s]+['"][a-z\d\+/]{99,}['"][\s\)]+;\s*\14[\s\(]+\15\s*,\s*\$\w{1,40}(?:\s*\.\s*\$\w{1,40})+\s*,\s*\1[\s\)]+;(?<X1226750>))|\(\s*(?:.?['"](.).{0,40}\17e\w?.?['"]\s*,\h*\$\w{1,40}\h*,\h*['"]\w{0,9}['"]\h*\)\h*;\s*\1\s*\(\s*.?['"](.).{0,40}\18e\w?.?['"]\s*,\h*\$\w{1,40}\h*,\h*['"]\w{0,9}['"]\h*\)\h*;(?<X1191610>)|\d+(?:\s*(?:[-\+/\*\(\)]+\s*)+\d+)+[\)\s]*\.\s*(?:\1|['"]\d+['"])[^;]+;[^\n]{0,499}\binclude(?:_once)?[\(\s]+(\$\w{1,40})[\)\s]+;\s*\$?\w{1,40}[\(\s]+\20[\)\s;\}]+(?:exit|die)\b[^;]*;[\s\}]*\Z(?<X2238520>))|\.=\s*(?:['"](?:(Rewrite)Rule\s*\^['"]\h*\.\h*(\$\22_index)\h*\.\h*['"]\.php\$\s*\-\s*\[L\][^'";]*['"];(?:\s*\1\s*\.=\s*['"]\22Cond\s*%\{REQUEST_FILENAME\}\s*!\-[fd][^'";]*['"];)+\s*\1\s*\.=\s*['"]\22rule\s*\.\s*/['"]\s*\.\h*\23\h*\.\h*['"]\.php\$?\s*\[L\][^'";]*['"];(?<X1195300>)|Shell[^/]+\bhttps?://['"]\s*\.\s*\$_SERVER\s*\[['"]SERVER_NAME['"]\]\s*\.\s*\$_SERVER\s*\[['"]PHP_SELF['"]\][^;]*;[^\{\}\?,]{0,499}\bmail\s*\([^;]+\1[^;]+;(?<X1255711>))|\$\w{1,40}\s*\[[\s\(]*\d+\s*(?:[\+/\*\-\(\)]+\s*)+\d+\]\s*\.\s*['"]{2}\s*;\s*return\s*\1[\(\s]+\$\w{1,40}[\)\s]+;(?<X1225570>))|\.?=\s*@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\(@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^><]{0,999}\btrigger_error[\s\(]+\1[,\s]+\w+[\s\)]+;(?<X1202500>)|\=\s*['"\s\.base64_dco]{18,40}\s*;(?:\s*(\$\w{1,40})\s*\=\s*['"\s\.creat_funio]{18,45}\s*;|\s*(\$\w{1,40})\s*\=\s*['"\s\.gzuncompres]{18,40}\s*\;\s*){2}(\$\w{1,40})\s*=\s*@?(?:\1|\28|\29)\s*\(['"]{2},(?:\s*(?:\1|\28|\29)\s*\(){2}['"][^'"]+['"][\)\s]+;\s*\30\s*\(\)\s*;(?<X1132921>))
(\$\w{1,40}\h*\->\h*query_where)\h*=\h*str_i?replace\h*\(\h*['"](WHERE\h+(\d+)\h*=\h*\3)['"]\s*,\s*['"]\2\h*AND\h*\{\h*\$wpdb\h*\->\h*users\h*\}\h*\.\h*user_login\h*!==?\h*['"](?!silver_surfer|HK\-Orga|Daniel)[^'"\$]{1,40}['"]\h*['"]\h*,\h*\1\h*\)\h*;(?<X1184584>)
(\$\w{1,40}Moban\w{0,40})\s*=\s*['"]\./wp\-(?:admin|includes)/[^"']+\.(?:png|jpe?g|gif)['"]\s*;\s*if[\(\s]+\$\w{1,40}\s*&&\s*(file_exists)[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!\2[\(\s]+\$\w{1,40}[\)\s]+or[\(\s]+filesize[\(\s]+\$\w{1,40}[^\?]{99,9999}\bchmod[\s\(]+\1[,\s]+\d+[\s\)]+;(?:\s*\}){2,9}(?<X1222350>)
(\$\w{1,4})(?:\d=['"]\w{1,2}['"];(?:\$\w+=['"]\w{1,2}['"];)+(?:(\$\w+)=pack\([^\$]+\1\d(?:\.(?:\1\d+|['"]\d+['"]|['"]\w+['"]))+\);)+[^@]{1,999}\bif\((\$\w+)\)\{[^@]{1,100}\2\(\3\);print[^\}]+\}+(?:exit|die);\}(?<X1314470>)|\s*=\s*fopen\(\s*(?:(?:\$\w{1,4}|['"][\w\.]+['"])\s*,\s*['"](?:a|w)\+?['"]\);\s*fwrite\(\s*\1\s*,\s*[^\)]{1,20}(\$bilsmg)[^\)]{1,20}\s*\)\s*;\s*fclose\(\1\);\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,40}['"];\s*@?mail\s*\(\s*\6[^,]{0,50}\s*,\s*\$\w{1,40}\s*,\s*\5\s*,\s*\$\w{1,40}\s*\)\s*;(?<X2054742>)|['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\);\s*(?:fwrite|fputs)\(\s*\1,\s*(\$(?:message|\w\d))\s*\);\s*mail\(\s*\$\w{1,40},\s*\$\w{1,40},\s*\8\s*(?:,\$\w{1,40}\s*)?\);\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054450>)))
(\$\w{1,50})\s*=\s*(?:'[^']*'\s*;\s*\$\w{1,50}\s*=\s*str_replace\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*,\s*\$\w{1,50}\s*\)\s*;\s*@\$\w{1,50}\s*\(\s*\$\w{1,50}\s*\(\s*\1\s*\)\s*\)\s*;(?<X2047960>)|[^;]{1,9};\s*if\s*\([^\)]+\)\s*@?(file_)put(_contents)\s*\(['"]\w{1,20}\.txt['"],(?:[^\;]{0,99})?\s*@?\3get\4\s*\(['"](php://input)['"]\)\s*\.[^;]{9,99};\s*if\s*\([^\)]+\)\s*\{\s*\1\s*=\s*@?\3get\4\s*\(['"]\5['"]\);(?<X2126551>))
(\$\w{1,5})=(?:['"][^'"a-z0-9]{1,9}["'];\s*\1=\([^;a-z0-9]{5,30}\);\s*if\(isset\(((\$\{[^\}]+\})\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,5})=['"][base64dco\.\*'"\d\h_]{15,35}['"];\s*\3\[[^\]]+\]\(\3\[[^\]]+\],\4\(\2\)\);\s*\}(?<X1175100>)|\$\w{1,5}\(['"]['"],\$\w{1,5}\(\$\w{1,9}\(\$\w{1,5}\[(\$\w{1,5})\((\$\w{1,5}),\d+,\6\(\7,\d+,\d+\)+\],['"\-_\+,/=]{4,18}['"]\)+;\1\(\);(?<X1135060>))
(\$\w{1,60})[\s=]+\$_[GPRSC]\w{2,6}\s*;\s*\$\w{1,60}[=\s]+\d+\s*;[\(\s]*count[\(\s]+\1[\)\s]+[^\w\s]{2,3}\s*\d+\s*[^\w\s]{2,3}\s*in_array[\(\s]+gettype[\s\(]+\1[^:;]+\1\(\)+\s*:\s*\1;(?<X1214011>)
(\$\w{1,9})(?:=(?:(@?strrev\()[preg_replace]{12}\);\s*(\$\w{1,9})=\2[base64_decode]{13}\);\s*@?\1\(\3\(\w{1,9}\),\$_[GPRSC]\w{2,6}\[[^\]]+\],\w{1,9}\);(?<X1133720>)|base64_decode\(file_get_contents\(['"][^\)]{1,99}\)\);(\$\w{1,9})=hex2bin\(['"][^\)]{1,99}\);(\$\w{1,9})=[^(]{1,99}\(\1,\5\);eval\(\6\);(?<X1256380>))|[=\s]+\$_SERVER\[['"]HTTP_USER_AGENT[^\{]{3,99}if[\s\(]+strpos[\(\s]+\1[\s,'"]+bot['"\)\s]+[^<#]+(\$\w{1,20})[\s=]+substr[\s\(]\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE[^\{\}]{3,99}if[\s\(]+\8[^\};]{0,99}\bheader[\(\s'"]+Location[:\shtps/]+[^\)]+\);[\s\}]*\b(?:exit|die)\b[^;]*;(?<X1278011>)|\h*=\h*(?:(\$\w{1,9})\(\h*['"]\w{1,9}['"]\h*,\h*['"]['"]\h*,\h*['"]\w{4,99}['"]\h*\);\s*(\$\w{1,9})\h*=\h*\10\(\h*['"]\w{1,9}['"]\h*,\h*['"]['"]\h*,\h*['"]\w{4,99}['"]\h*\);\s*(\$\w{1,9})\h*=\h*\11\(\h*['"]['"],\h*\1\(\h*\10\((?:\h*['"\$]\w{0,9}['"]?\h*[,\.]?){4,9}\)[\)\h]+;\h*@?\12\h*\(\)\h*;(?<X1054951>)|(base64_decode)\h*\(['"]bWQ1['"]\)\h*;\h*(?:\$\w{1,9}\h*=\h*['"][^'"]{1,99}['"];\h{0,9}){9,}[^=]{0,99}\$\w{1,40}\h*=\h*unserialize\(\14\(['"][^\v%\*@]{4999,14999}\bforeach\h*\(\h*\1\h*as\b[^\)]+\)\h*(\$\w{1,9})\h*=[^;]+;(?:\h*\})+\h*echo\h+\15\h*;(?<X1167390>)|@?\$_[GPRSC]\w{2,6}\h*\[['"]otp\d*['"]\];[^\*]{1,40}(\$\w{1,9})\h*=\h*\$_server\[['"]remote_[^\?]{99,3099}(\$\w{1,9})\h*=[^\:;]{1,20}\:\h*\1[^\}]{1,149}\18\h*\.\h*=[^\:;]{1,20}\:\h*\17[^\(]{1,399}if[\(\h]+@?mail[\(\h]+['"][^\$]{1,59}\$\w+,\h*\18(?<X2178351>)|['"]/home\d*/[^/]{1,40}/public_html[^'";]{1,99}\.php['"];\s*(\$\w{1,9})\h*=\h*['"]/tmp[^;]{1,99}['"];\s*if[\h\(]+(file_)exists[\h\(]+\20\D{2,9}hash[\h\(]+['"](?:sha|md)[1256]{1,3}['"][\h,]+(\21ge(t_contents))[\h\(]+\1[^\}]{1,199}\21pu\23[\h\(]+\1[\h,]+\22[\h\(]+\20[\h\)]+;\s*\}(?<X1173862>)|['"]<\?php\s+@?include(?:_once)?\(\\?['"]+[\h\.]+\$\w{1,40}[\h\.]+['"]\\['"]\);\s*\?>[^'"]{0,9}['"][\h\.]+\$\w{1,40}\h*;\s*file_put_contents\h*\(['"](index\.php)['"][\h,]+\1\);\s*@?chmod\h*\(['"]\25['"][\h,]+\d{3,4}\h*\);(?:\s*\}){2}\s*@unlink\h*\(['"][\w\-]{1,12}\.php['"]\);(?:\s*\?>)?\s*\Z(?<X2176610>)|['"][^/]+/wp-config\.php['"];\s*(\$\w{1,9})\h*=\h*file_get_contents\h*\(\1\);[^\?]{1,199}\bchmod\h*\(\1,\h*\d{3,4}\);\s*\27\h*=\h*trim\h*\(\27\)[\h\.]+['"]\\n[^\(]{0,49}[ir][ne][cq][lu][ui][dr]e(?:_once)\(ABSPATH\h*\.['"]wp-head\.php['"]\);(?<X2187292>)|['"][evalsrt'"\.\h]{7,40}['"];\h*(\$\w{1,9})\h*=\h*\$\{['"][_POST\."']{7,16}\}\h*;\h*\1\h*\(\h*\29\h*\[[^\]]+\]\h*\)\h*;(?<X1139821>)|['"][sape]\w{1,9}['"]\h*;\s*(\$\w{1,40})\h*=\h*trim\h*\(\h*\1\h*,\h*["']\w{1,9}['"]\h*\)\h*\.\h*str_repeat\h*\(\h*['"]\w['"]\h*,\h*\d+\h*\)(?:\h*\.\h*trim\h*\(\h*\1\h*,\h*["']\w{1,9}['"]\h*\))+\h*;\s*\31\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1146070>)|['"]\s*hacked\h*by[^;]{0,49};\s*(\$\w{1,9})\h*=\h*fopen\(['"][^'"]{2,40}\b\w{1,20}\.html['"]\h*,[^\)]+\);\s*fwrite\(\33,\h*\1\);\s*fclose\(\33\);(?<X1188391>)|['"]{2};\s*if\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h\)]+\{\s*\1\h*=\h*\35;\s*\}\s*else\s*\{\s*\1\h*=\h*\w{1,40}\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{1,99}@?eval\h*\(['"]\?>['"]\h*\.\h*\1\);\s*@?eval\h*\(['"](?:exit|die)\b[^;]{0,9};['"]\);\s*@?\w{1,40}\h*\(\1\)(?:\h*;)?(?<X1140850>)|['"asert\.\h]{1,25};\s*(\$\w{1,9})\h*=\h*(array)\h*\(\1\h*=>\h*['"](xc90)['"]\);\s*\$\w{1,9}\h*=\h*\38_keys\h*\(\37,\h*['"]\39['"]\);\s*declare\h*\(ticks\h*=\h*1\);(?<X2188460>)|\$_[GPRSC]\w{2,6}(?:;\s*\bif\h*\(in_array\h*\(gettype\h*\(\1\)\h*\.\h*count\h*\(\1\)[^\?]{99,999}\bfunction\h+\w{1,9}\h*\((\$\w{1,20})\)[^\?]{1,299}\bif\h*\(empty\h*\((\$\w{1,20})\)\)\h*\42\h*=\h*file_get_contents\h*\(\41\);\s*return\h+\42;(?<X2182960>)|\[[^;]+;\s*(\$\w{1,9})\h*=\h*(bin2hex)\([^;]+;\s*\$\w{1,9}\h*=\h*\45\(\1\.['"];['"]\.\44\);[^;]{1,299};\s*(\$\w{1,9})\h*=\h*(curl)_init\(base64_decode\(['"]aHR0[^;]{1,60};\s*\47_setopt\(\46,[^\}]{1,499}\47_close\(\46\);(?<X1183110>))|\$_SERVER\[['"]REMOTE_\w+['"]\];\s*(\$\w{1,9})\h*=\h*substr\((?:md5|sha[1256]{1,3})\h*\(\$\w{1,9}\h*\.\h*\1\),[^;]{1,20};\s*(\$\w{1,9})\h*=\h*\$_COOKIE\[['"]\49['"]\];\s*\bif\(\50\)[\s\{]+(setcookie)\(['"]check['"],\h*\1[^\}]{1,99}\bexit\b[^;]{0,19};\s*\}\s*else\s*\{\s*\51\s*\(\s*\49(?<X2189651>)|\(\h*gzinflate\h*\(\h*str_rot13\h*\(\h*base64_decode\h*\(\h*['"]aENMWMNAEH5hwf[^'"]{199,499}=['"]\){4};\s*(\$\w{1,9})\h*=\h*fopen\h*\(\h*['"]\w{1,40}\.php['"]\h*,\h*['"]w['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\53\h*,\h*\1\h*\)\h*;\s*@?fclose\h*\(\53\)\h*;(?<X1147693>)|\bcreate_function\h*\([^;]{1,129};\s*(\$\w{1,9})\h*=\h*\(!?empty\((\$_FILES\[['"]\w+['"]\])\)+\??file_get_contents\(\56\[['"]tmp_name['"]\]\)\h*\:\$_COOKIE[^;]{1,49};\s*(\$\w{1,9})\h*=\h*(base64_decode\()\$\w{1,9}\)\^\58\55\);\s*\beval\(\57\);['"\)\]]+;\s*\1\h*\((?<X2185290>)|curl_init\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\(]{1,49}if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[[^;]{1,30};\s*\b[fsp](?:tp_exec|ystem|hell_exec|assthru|open|roc_open)\h*\([\'"]cd\s+/tmp;wget[^\?]{9,299}eval\h*\(['"]\?>['"]\h*\.\h*(\$\w{1,9})\);[^\:]{1,30}\:\s*\60\h*=\h*curl_exec\h*\(\1\);(?<X2178250>)|explode\h*\([^\)]{1,99}\);\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6};\s*if\h*\(\h*(?:(?:md|sha)\d{1,3}\h*\(\h*)+(\62\[\1\[)[^\{]{1,20}\{\s*if\h*\(\h*isset\h*\(\63[^\{]{1,20}\{\s*(\$\w{1,9})\h*=\h*base64_decode\(\63[^\)]+\);\s*echo[^\$]{1,4}\64[^;]{1,9};\s*\}\s*\}(?<X1138811>)|str_replace\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*(?:\67|\66)\h*\(\h*['"]{2}\h*,\h*(?:\67|\66)\h*\(\h*\$\w{1,40}[\)\h]+;\s*@?\68\h*\(\h*\)\h*;(?<X1156231>)|strrev\(['"\.stro13_ ]{12,20}\);\s*if\(!empty\(\$\{\1\([^\)]+\)\s*\}\)\)\s*\{\s*(\$\w{1,9})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\1\([^\]\[\*//]{9,99}\(\70\(\$\w{1,9}\)\W{2,3}['"]['"\.a-z0-9\s]{25,40}\W{2,3}(\$\w{1,9})\h*=\h*\$\w{1,9}\(['"]['"],\71\(\$\w{1,9}\)\)\)\?\72\(\):['"]['"];\}(?<X1161860>))|\s*=\s*(?:@?(str_replace\s*\()[^;]{1,99};\s*\$\w{1,9}[\s=]+(['"])[^\n]{99,199}\75;\s*(\$\w{1,9})[\s=@]+\74\s*['"][^'"]{1,5}['"]\s*,\s*['"]{2}\s*,\s*(?:\$\w{1,9}\s*\.\s*){3,}\$\w{1,9}[\s\)]+;\s*(\$\w{1,9})[\s=@]+\1[\s\(]+['"]{2}[\s,]+\76[\s\)]+;\s*\77[\s\(\)]+;(?<X1194144>)|['"][^'"]{1,9}['"][\s\.]+substr[\(\s]+\$\w{1,9}[\s,]+\d+[\s,]+\d+[\)\s]+;\s*\$\w{1,9}[\s=]+@?preg_replace[\(\s]+\1[\s,]+strtr[\(\s]+\$\w{1,9}[\s,]+\$\w{1,9}[\s,]+\$\w{1,9}[\)\s,]+['"][^']{1,20}['"][\s\)]+;(?<X1040501>)|['"]\?['"]\s*\.\s*strtolower\s*\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*if\s*\(\s*\(strpos\s*\(\1\s*,\s*['"]bot['"]\)[^\{]{0,20}\{\s*(?:header\s*\(|echo)\s*['"](?:location:|<Script\s)[^\}]{9,350};\s*(?:exit|die)?[^;]{0,9};?\s*\}(?<X1133341>)|['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"];\s*(\$\w{1,9})\s*=\s*file_get_contents\(\1\);\s*(\$\w{1,9})\s*=\s*fopen\(['"][^'"]+\.php[^;]+;\s*fwrite\(\82,\s*\81\);(?<X2123460>)|\w{1,16}\s*\(\$_[GPRSC]\w{2,6}\);\s*parse_str\s*\(\1\);\s*(\$\w{1,40})\s*=\s*lrtrim\s*\(\84\);\s*(\$smtp_?(?:username|login|usr|email|user))\s*=\s*lrtrim\s*\(\85\);\s*(\$smtp_?(?:password|passwd|pwd|pw|pass))\s*=\s*lrtrim\s*\(\86\);(?<X2127150>)|http_get\(['"]https?://[^'"]{12,99}/\d+\.txt['"]\);\s*(\$\w{1,9})\s*=\s*fopen\((\$\w{1,9}),\s*['"]w['"]\);\s*fwrite\(\s*\88,\s*\1\s*\);\s*fclose\(\88\);\s*if\(file_exists\(\89\)+\s*\{\s*\}(?<X2132940>)))
(\$\w{1,9}path)=(getenv\()['"](SCRIPT_)NAME['"]\);\h*(\$\w{1,40})=\2['"]\3FILENAME['"]\);\h*(\$\w{1,40})=substr\(\4,\d+,strpos\((?:\4|\1)\h*,\h*(?:\4|\1)\)\);\h*@?include_once\(['"]\5['"]\.(?:chr\(\d+\)\.){3,}chr\(\d+\)\);(?<X1179961>)
(\$\w{2,20})\s*=\s*['"]\\x[\\a-z0-9]{8,32}['"]\s*;\s*(\$\w{2,20})\s*=\s*['"]\\x[\\a-z0-9]{8,40}['"];[^\?]{15999,19999}?\)\)\)\.(?:\1\(\2\(){3,}[^_\?\-%\^/@]{9999,20000}die\([^;]{1,999};(?:\s*\}\s*){0,3}(?<X1061960>)
(\$\w{30,})=\d+;(\$\w{30,})=['"][^'"]+['"];(\$\w{30,})=\2;[^\}\?]{1,999}(\$\w{30,})\.=chr\(ord\((?:\3|\2)\[[^\]]+\]\)\^\1\);eval\(['"](?:\?>|<\?)[^;]{0,199}\4\b[^;]{0,199};(?<X1229550>)
(\$\{[""]GLOBALS['"]\})\[[^\]]+\]=['"](doordomain)['"];\s*\1\[[^\]]+\]=['"]linkofdoor["'];[^\\<@]{200,1600}['"]https?://\$\2(?<X2193660>)
(\$\{['"][GOBALS\\x47015327cf]{9,28}['"]\}\[)[^\]]+\]\(\1[^\]]+\][,\s]+0[\s\)]+;\s*\$\w{1,40}\s*=\s*\d+;\s*\$\{['"][GOBALS\\x470156327cef]+['"]\};\s*\1[^\]]+\][\s=]+\1[^\]]+\]\(\);\s*\1[^\+]{99,9999}\$\w\++[\s\)\{]+\1[^\]]+\][^_]{99,}\b(?:exit|die)\b[^;]{0,40};[\s\}]+else[\{\s]+\1[^\]]+\]\(\);\s*\}\s*\}(?<X1220590>)
(\$\{['"]\\\d{3}\\X[a-f\d]{2}[x\d\\a-f]{6,40}['"]\})\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]{6,40}['"]\]\(\1\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]+['"]\][\s,]+0[\s\);]+\1\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]+(['"]\]\(\);)\s*\$\{['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]{6,40}['"]\};\s*\1\[[^\]]+\][\s=]+\1\[[^\]]+\2\s*\1\[[^\]]+\2(?<X1218690>)
(\$\{['"]GLOBALS['"]\}\[['"]\w{1,40}['"]\])=['"]\w{1,40}['"];(\$\{\1\}=(file_get_contents\())[^\?]{99,599}\2[^\?]{99,499}\3[^\)]{9,99}\);\}{3}(?<X2129365>)
(\$\{['"]GLOBALS['"]\}\[[^\]]+\])[\h=]+['"]\w['"];\s*\$\{\1[\s\}=]+file_get_contents[\h\(]+['"]https?://[^'"]+\.txt['"][\h\)]+;\s*echo\h*\$\{\1\s*\}\s*;(?<X1232730>)
(\$\{\$\{['"]GLOBALS['"]\}\[)(?:['"](\w{1,40})['"]\]\}\h*=\h*['"]create_function['"];\1['"](\w{1,40})['"]\]\}\h*=\h*\1['"]\2['"]\]\}\h*\(['"][^'"]{0,9}['"],['"]eval\(gzinflate\([^\)]+\)+;['"]\);\1['"]\3['"]\]\}\h*\(['"](?<X2138411>)|[^\]]+\]\}[=\s]+file_get_contents[\(\s]+['"]php://input['"\)\s;]+if[\(\s]+substr[\(\s]+\1[^\]]+\]\}[,\s]+0[,\s]+\d+[^\{\}]{0,99}\{[^\{\}]{0,40}gzinflate[\(\s]+substr[\(\s]+\1[^\]]+\]\}[,\s]+\d+[^\?\n]{0,499}\beval[\(\s]+\1[^\]]+\]\}[\)\s;\}]+catch[^\}]{0,40}\}[;\s]*\}(?<X1228750>))
(\$_)[\h=]+['"]file_get_contents['"];\s*@?eval[\h\(]+['"]\?>['"][\h\.]+\1[\h\(]+['"]https?://raw\.githubusercontent\b[^'"]+\.php['"][\h\)]+;(?<X1213011>)
(\$_+)(?:[=\s]+['"][^'"]+['"]\s*;\s*\$\w{1,40}[=\s]+['"]==[^'"]+['"]\s*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+html_entity_decode[\(\s]+gz(?:inflate|uncompress)[\(\s]+base64_decode[\(\s]+\1[\)\s]+;\s*(?:exit|die)\b[^;]{0,40};(?<X1211970>)|[\h=]+['"]printf['"];\h*(\$_+)[\h=]+['"]Loading\h*\$[^'"]+['"];[^\{]{9,299}\b(function)_exists\(['"](__lambda)['"][\h\)\{]+\4\h*\5[^\?]{999,4500}\1\(\3[\h\)]+;\s*\$_+[\h=]+\$_+\(\);\s*\$_+\(\);\s*echo\s*\$_+;(?<X120342740>))
(\$_[GPRSC]\w{1,6})\[(['"]\w+['"])\]=\$\w+;[^@]{1,2000}(\$\w+)=\2;(?:(?:\$\w+=[^;]+;)+)?(\$\w+)=\1\[\3\];[^@]{1,199}\4=str_split\(\4\);[^@]{1,100}\4=array_map\(['"][^'"]*['"],\4\);[^@]{1,100}(\$\w+)=\3;[^@]{1,500}unset\(\1\[\5\](?<X2301980>)
(\$_[GPRSC]\w{2,6})\[['"\\]{1,2}(\w{1,20})['"\\]{1,2}\]&&preg_replace\(['"\\]{1,3}[^\\]{1,4}\\['"]ei?s?['"],['"]eval\(\1\[['"\\]{1,2}\2['"\\]{1,2}\]\)['"],['"][^'"]{1,4}['"]\);(?<X1186610>)
(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])\s*\.=\s*['"];['"]\s*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\1[\)\s]+;\s*(?:exit|die)\b[^;]*;(?<X1252871>)
(\$_[GPSCR]\w{2,6}\[[^\]]+\])\h*=\h*str_replace\h*\([^\)]+,\h*\1\h*\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\1\h*\);(?<X1152340>)
(\$_\w{1,8})=\1\h*\^\h*\$_\w{1,8};eval\h*(?:/\*\w{1,8}\*/)?\h*\([^\)]+\)(?:/\*\w{1,8}\*/)?\h*;\s*(?://[\w\176\.%\-]{99,})?\Z(?<X2247756>)
(\$__duis_pass_((?:md|sha)[2561]{1,3}))\h*=\h*['"][^'"]{1,99}['"]\h*;[^;]{9,99}\2\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\S{2,3}\h*\1(?<X2158720>)
(\$_FILES)\s*\[[^\]]+\][^;]+if[\s\(]+\$\w{1,40}\[\d+\][\s\(]+\1\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\1\s*\[[^\]]+\]\s*\[[^\]]+\][^@\^&#]{9,9999}\bCyber\s+Team\b[^<]{0,40}</title>(?<X2218950>)
(\$_GET)\[([^\]]+)\]=\$\w+;[^@\n\?]{1,9999}(\$\w+)=\2;[^@\n\?<\176]{1,999}(\$\w+)=\1\[\3\];[^@\n\?<\176]{1,999}\4=str_split\(\4\);[^@\n\?<\176]{9,999}\4=array_map\([^,]+,\4\);(?<X2274419>)
(\$_getf)\s*=\s*file\s*\(__FILE__\);\s*@?eval\s*\(base64_decode\s*\(['"]\w{99,999}=?=?['"]\)\);\s*@?eval\s*\(base64_decode\s*\(getmal\s*\(\1\)(?<X2126350>)
(\$_headers)(?:[=\s]+getallheaders\(\);\s*if[\(\s]+isset[\(\s]+(\1\[[^\]]+\])[\)\{\s]+(\$\w{1,20})[=\s]+\2[\(\s]+['"]{2}[,\s]+\1\[[^\]]+\][\(\s]+\1\[[^\]]+\][\)\s]+;\s*\3\(\)\s*;\s*\}(?<X1224141>)|[\h=]+array(?:\(\);\h*if\(isset\(\1\[[^\]]+\]\)\)\{(\$\w{1,25})[\h=]+\1\[[^\]]+\]\(['"]{2},\h*\1\[[^\]]+\]\(\1\[[^\]]+\]\)\);\5\(\);\}(?<X1216180>)|\h*\(\);\h*if[\(\h]+isset[\(\h]+\1\[[^\]]+\][\)\h]+\{(\$\w{1,25})[\h=]+['"]\\[^=/]+;\h*\$\w{1,40}\s*=\s*['"]/tmp/\s*\.\s*['"]\s*\.\s*time[\(\)\s]+;\h*@file_put_contents[\(\s]+(\$\w{1,40})[,\s]+\7[\)\s]+;\h*@include[\(\s]+\8[\)\s]+;\h*@unlink[\(\s]+\8[\)\s]+;\h*\}(?<X1240510>)))
(\$_POST\[['"]cmd['"]\])\){3}\{(\$\w+)=\w+\(\1\);\$\w+=shell_exec\(\2\.['"]\s*2>&1['"]\);(?<X220358160>)
(\$_SERVER\[[^\]]+\])\h*=\h*r?trim\([^\)]+\);\h*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1\h*\.\h*['"]/wp\-(?:admin|includes|content)/init\.php['"];(?<X1193390>)
(\$alfa_file)=['"][^'"]{9,99}\.txt['"];\s*(\$\w{1,20})=fopen\(\1,[^\)]+\);\s*fwrite\(\2,[^\;]+\);\s*fclose\(\2\);\s*(\$\w{1,20})=file\(\1\);\s*\$\w{1,20}=array\w{0,20}\(\3\);\s*\2=fopen\(\1,[^\{]{9,40}\{fputs\(\2,\$\w+\);[\}\s]+fclose\(\2\);(?<X1222871>)
(\$auth.?pass)=['"]\w{32}['"];[^\$]{0,20}\bif\(+!?empty\(\1[^\{]{2,99}\{[^\}]{9,99}\becho\h*['"]\s*<form[^>]{9,80}\b\w{1,20}=['"](?:upload|upl)[^\{\?]{250,600}\bif\(isset\(\$_POST\[[^\]]+\]\)\)\s*\{\s*if\(@?[cm](?:opy|ove_uploaded_file)\([^\*\?]{250,500}\$\w{1,20}\(\$\w{1,20}\);\s*echo\h+['"][^;]+['"];\s*\}(?<X1188780>)
(\$auth_pass)\h*=\h*['"][a-f\d]{32}['"];\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if[\(\s]+trim[\(\s]+(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[^;]+(file_)get_contents\(__\3_\);[^\{\}]{1,99}str_replace\(\1[\h,]+md5\(trim\(\2[^\}]{99,499}\}\s*else\s*\{\s*echo\h*['"][^;]+;[\s\}]+exit;\s*\}(?<X1177630>)
(\$b374k)\s*=\s*@\$\w{1,40}\([^\)]{20,99}\)\)\);['"]\);\s*@\1\(['"](?<X2058110>)
(\$backdoor_payload)\s*\)\s*\{\s*\$this\->\w{1,40}\h*=\h*\1\s*;(?<X2195190>)
(\$bilsmg) \.?=\s*['"]card\s*num(?:ber)?\s*:?\s*['"]\.\$_POST\[['"]\w{1,40}['"]\]\s*\.?\s*['"]?\\n['"];\s*\1\s*\.?=\s*['"]\w{1,40}\s*:?\s*['"]\.\$_POST\[['"]ccv2?(?:\-code)?'\]\s*\.?\s*['"]?\\n['"];(?<X2054890>)
(\$blocked_words)\s*=\s*array\([^\)]{99,1999}\);\s*(foreach)\s*\(\s*\1\s*as[^\}]{9,99}((?:exit|die)\b[^;]*;)[\s\}]+(\$banned_?ip)\s*=\s*array\([^\)]{99,9999}\);\s*if\s*\(\s*in_array\s*\(\s*\$_SERVER\[[^\)]+\4\s*\)\)\s*\{?\s*\3\s*\}\s*else\s*\{\s*\2\s*\(\s*\4\s*as[^\}]{9,99}\3(?:\s*\}){3}(?<X1134600>)
(\$body_class)\w+[\s=]+\$_SERVER;\s*\1\w+[\s=]+['"]HTTP_\w+['"];\s*\1\w+[\s=]+isset\(\1\w+\[\1\w+\]\);\s*if[\h\(]+\1\w+\)\s*\{\s*\1\w+[\s=]+\1\w+\[\1\w+\];\s*eval\(\1\w+\);\s*\}(?<X120361180>)
(\$bot_user_agents)[\h=]+array[\s\('"][^\)]{0,99}(?:Googlebot|Googlebot\-)[^\)]+\);[^#]{99,999}(\$\w+)[\h=]+['"]https?://[^/]+\.pages\.dev/[^'"]+\.txt['"];[/\*\s]*if[\h\(]+is_bot[\h\(]+\$\w+,\h*\1[^\{]+\{\s*echo\h*@?file_get_contents[\h\(]+\2[\h\)];\s*(?:exit|die)[^;]{0,9};\s*\}(?:\*/)?(?<X120361060>)
(\$botbotbot)[\h=\."']+mb_strtolower[\s\(]+(\$_SERVER\[HTTP[^\]]+\])[\);\s]+\1[\h=]+str_i?replace\h*\([^\?:]{1,700}\bCURLOPT_URL[\h,]+['"]https?://[^;=]+=\h*(?:\1|\2)[^;]+;\s*(\$\w{1,40})[\h=]+curl_(?:close|exec)[\h\(]+\$\w{1,40}[\h\)]+;[^\}]{0,99}\becho\s*\3;\s*\}(?<X1201072>)
(\$brutePass)\s*=\s*createBrutePass\s*\(\$_POST\[[^\]]+\],[^\)]+\);\s*\$\w{1,20}\[\]\s*=\s*array\([^\)]{9,99},\s*\1\),\s*['"]\w{1,20}['']=>['"]https?://[^/]+/xmlrpc\.php['"]\s*,\s*['"]\w{1,20}['"]=>\1\);(?<X2064500>)
(\$cachetime)\s*=\s*\d+;\s*if\s*\(\(file_exists\((\$target)\)\)\s*&&\s*\(time\(\)\s*-\s*\1\)\s*>\s*filemtime\(\2\)\)\s*\{\s*\$string\s*=\s*file_get_contents\h*\((?<X2051261>)
(\$clean_result)\s*!=\s*['"]rvf['"][\s\)]+\{\s*\1\s*=\s*str_replace\s*\([^;]{1,99}\1\s*\)\s*;(?<X2135050>)
(\$client)\h*=\h*new\h+KClient\h*\(['"]https?://[a-z]{5,30}\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw|club)/\w{1,20}\.php\??['"][^\)]+\);\s*\1->sendAllParams\(\);[^\?\{]{1,499}\1\->forceRedirectoffer\(\);[^\?\{]{1,499}\1\->execute(?:AndBreak)?\(\);(?<X1158034>)
(\$CLOAKING\[['"])(?:OFFER_PAGE['"]\]\s*=\s*['"]https?://[^;]+['"]\s*;[^;\$]{0,499}\1DEBUG_MODE['"]\]\s*=\s*['"]off['"]\s*;(?<X2196830>)|WHITE_PAGE['"]\]\s*=\s*['"][^'"]+\.\w?(?:html?|php)['"];[^;\$]{0,499}\1OFFER_PAGE['"]\]\s*=\s*['"]https?://[^;]+['"]\s*;(?<X2195982>))
(\$code)\h*=\h*(curl_)exec\h*\((\$\w{1,40})\);\s*\2close\h*\(\3\);\s*(\$\w{1,40})\h*=\h*new\h+str_auth\(64\);\s*\1\h*=\h*\4->decode\h*\(\h*\1\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?<X2144731>)
(\$config)\[['"]botnet_cryptkey_bin['"]\]\s*=\s*array\s*\([^;]+\);[^@]{0,20}return\s+\\?\1;(?<X2060773>)
(\$cvv)\s*=\s*\$_[GPCSR]\w{2,6}\[\s*['"]cvv['"]\s*]\s*;[^\(]{1,299}\$(msg|message|body)\s*=\s*['"][^'"]+\1[^'"]+['"];[^\(]{1,99}mail\([^\)]+,\s*\$\2\b[^\)]+\);\s*header\(\s*['"]location:(?<X2131931>)
(\$datas{3,})=base64_decode\(['"]PD9[^'"]{999,}['"]\);(?:(\$\w+)=fopen\([^,;]+\.php['"],[^;]+;fwrite\(\2,\1\b[^;]{0,49};fclose\(\2\);){1,3}(?<X1229921>)
(\$datat)[\h=]+base64_decode[\h\(]+['"](?:PD9waHAgDQovKg0K|PD9waHAgY2xhc3Mg)[^'"]{999,60000}['"][\h\)]+;(?:\s*file_put_contents[\h\(]+\$_SERVER\[[^\]]+\][\h\.]+['"][^'"]+\.php['"],\h*\1[\h\)]+;){2}(?<X1212952>)
(\$define_guard)\h*=\h*strrev\h*\(['"]tressa['"]\);\s*if\h*\(\h*(?:md5\h*\()?[^\{]{2,30}\)\s*\{\s*\1\h*\(\h*stripslashes\h*\(\$\w{1,20}\)\);\s*\}(?<X1165491>)
(\$domain)(?:[\s=]+explode[\(\s]+['"]@['"]\s*,\s*\$email[\s\)]+;\s*(\1\w{1,9})[\s=]+['"]@['"]\s*\.\s*strtolower[\(\s]+\1\h*\[\d+\][\s\)]+;\s*if[\(\s]+(?:stripos[\(\s]+\2\s*,\s*['"]@[^'"]+['"]\s*\)\s*[\S]{2,3}\s*false\s*\|\|\s*){2}[^;\{:]{9,199}\)\s*\{\s*header[\(\s'"]+Location:(?<X2060022>)|\s*=\s*(?:['"](?:Office365|RMG|Billing|Amazon)['"]\s*;\s*(\$\w{1,40})\s*=\s*['"][^;]{1,99};\s*(\$from)\s*=\s*['"]From:\s*\1\s*<west>\s*\\n['"];\s*@?mail\s*\(\s*['"][^'"@]{1,40}@\w{1,20}\.\w{2,7}['"]\s*,\s*\4\s*,\s*\$\w{1,40}\s*,\s*\5\s*(?:,\s*\1\s*)?\)\s*;(?<X2118530>)|\$domains\[\s*array_rand\(\s*\$domains\s*,\s*1\)\s*\]\s*;\s*(\$\w+)\s*=\s*\(\s*preg_match\s*\([^;]+\bsprintf[\(\s]+['"]https?://%s[^:;]+\1[^;]+;\s*@?header[\s\(]+['"]\s*Location\s*:\s*\7['"\s\)]+;(?<X2043813>)))
(\$email)(?:=\$_[GPCSR]\w{2,6}\[[^;]{1,49};(\$pass(?:w(?:or)?d)?)=\$_[GPCSR]\w{2,6}\[[^@]{99,999}\$(\w{1,40})=[^;]{1,199}\1[^;]{1,199}\2[^@]{99,499}\$(subj?(?:ect)?)=['"][^'"]{0,99}\bNew\s*(?:\$\w{1,40}\s*)?User\s*Notification['"];[^\}\{\(]{99,499}\bmail\((?:[^\)]+\$(?:\3|\4)){2}(?<X2153130>)|\s*=\s*(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]|['"]\w{1,50}@\w{1,15}\.\w{1,9}['"])[^\?]{9,99}(\$\w{1,9})\s*=\s*fopen\([^;]{1,25}cpanel/contactinfo[^\?]{9,99}fopen[^;]{1,25}contactemail[^;]{1,15};\s*fwrite\(\6,\s*\1\);(?<X2132201>))
(\$fileArr\[['"]moban['"]\])\h*=\h*filesize\h*\([^\)]{4,18}\)\h*;[^\]]+;\s*\1\h*=\h*[^;]{0,9};\s*\}(?<X2164653>)
(\$fileCheckSum)\s*=\s*['"][a-z0-9]{999,20000}['"];\s*if\s*\(!?function_exists\h*\(['"](\w{1,20})['"]\)[^\?]{9,200}\1\s*=\s*create_function\h*\([^,]+,\h*\2\(\1\)\);\s*\1\(\);(?<X1137850>)
(\$getbank)\h*=\h*json_decode\(file_get_contents\(['"]https?://api\.bincodes\.[^\;]+\);\s*(?:\$\w{1,20}\h*=\h*\1->(?:card|bank|type|level|country);\s*){3}[^\?]{999,4000}mail\((?<X2139081>)
(\$GLOBALS+\[[^\]]+\])\s*=\s*Array\s*\((base64_decode)\s*\([^\)]+\)\s*,\s*\2\([^\)]+\)\);\s*function\s+(\w{1,20})\([^\)]+\)\s*\{[^\}]{20,150}\}\s*(\$\w{1,20})\s*=\s*\1\[\d+\]\(\3\(\d+\)\);[^\}]{9,99}(\$\w{1,20})\.?=\4\[[^\]]+\]\s*;\s*\}\s*echo\s+\5;\s*return;(?<X1130450>)
(\$GLOBALS[ ]*\[[^\]]+\])[ ]*=[ ]*array[ ]*\([ ]*base64_decode\([^\)\.]{1,40}\.[^\)\.]{1,40}[\.\)][^\n]{2999,9999}\{[ ]*if[ ]*\([ ]*@?\1[^\n]{99,999}\}[ ]*\}[ ]*return[ ]*\$\w{1,40};\s*\}(?<X1127901>)
(\$GLOBALS\['\w+'\])=Array\((?:base64_decode\((?:\'[A-Z0-9\/\=]*\'\s*\.?)+\)\,?)+[^#:]*?\[\d+\]\(\$_\w+\),\1\[\d+\]\(\$\w+\)\);\}\s*\?>(?<X2044922>)
(\$GLOBALS\[)(?:['"]WP[_\-][VC]?CD(?:_CODE)?['"]\]\h*=\h*['"][^'"]{999,}['"]\h*;\s*\1[^\]]+\]\h*=\h*@?array\h*\([^;]+\bwp\-(?:includes|admin|content|config)(?<X2157210>)|[^\]]+\]\h*=\h*array\([^\)]+\);(?:\s*\1[^\]]+\][\h=]+base64_dEcOde\h*\([^\)]+\);){4,}\s*class\h*(\w{1,40})[\s\{]+private\h+static\h*(\$\w{1,40});[^\?>]{9,999}\bself::\4\h*=[^;]+;[\s\}]+if[\s\(]+\1[^\]]+\][^;]+,\h*\3::\w{1,40}\(['"][^\)]+\)[\h,]+(\$\w{1,40})[\)\s]+;\s*endif;\s*echo\h*\5\s*;(?<X1184360>))
(\$GLOBALS\[['"][^'"\]]+['"]\])\s*=\s*Array\s*\([^\);]{1,99}[curl'"\s\.]{4,40}_[^,;\)]{1,40},[^;]+;\s*(?:\?>\s*<\?(?:php|=)?\s*)?function\s*(\w{1,40})\s*\([^\n]{999,2000}\2\s*\(\d+(?:\s*\)){3}\{\s*\1\s*\[\d+\]\s*\(['"]Location\s*:\s*\$\w{1,40}\s*['"]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};(?:\s*\}){3}(?<X1130271>)
(\$GLOBALS\[[^\]]+\])(?:=Array\(base64_decode\((?:[^#\n\\]{9999,15000}\\n\{\$\w{1,40}\[round\(0\+[^\)]+\)\]\}['"],(\$\w{1,40})\);\}elseif\(!empty\(\2\)\)\{[^\}]+\}+\s*return\s*\2;\}[^\}]+\}\1\[\d+\]\(\w{1,40}\(\d+\)\);(?<X1125290>)|[^;\n]+;[ ]*(?:\?>[ ]*<\?(?:php|=)?[ ]*)?function[ ]*(\w{1,40})\([^\)]+\)[ ]*\{[^\}\n]+\}[ ]*(?:\?>[ ]*<\?(?:php|=)?[ ]*)?\1[^\n]+\b\4\(\d+\)[^\{\};\?\n]{1,40}\{[^\}]+\}[ ]*\w{1,40}\([^\)]{0,19}\);(?<X1129841>))|[\s=]+\$\w{1,40}[\.\s]+DIRECTORY_SEPARATOR[\.\s]+['"]\w+['"][\.\s]+rand[\(\s]+[01][,\s]+\d+[\)\.'"]+\.php['";\s]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+dirname[\(\s]+__FILE__[\)\s]+\.[^;]+\.(?:png|ico)[^@]{0,199}(\$\w{1,40})[=\s]+@fopen[\s\(]+\1[^;]+;\s*@fputs[\s\(]+\7[,\s]+\6[\s\)]+;(?<X2225881>))
(\$GLOBALS\[[^\]]{1,40}\])=Array\(base64_decode\([^\?]{999,3000}['"]<\?php\s*\$\w{1,9}\[\d+\]\s*\?>['"]\);\1\[\d+\]\(\$\w{1,9}\);\s*include(?:_once)?\s*\(\s*['"][^'"]{1,40}\.php['"]\s*\)\s*;\s*@\1\s*\[\s*\d+\s*\]\s*\(\s*['"][^'"]{1,40}\.php['"]\s*\)\s*;(?<X1058060>)
(\$goweb)(?:[\d\s]*=\s*str_rot13[\(\s]+\$\w+[\)\s]+;[^\{\}/]+\$\w+\s*=\s*\$\w+\s*\.\s*['"]://['"]\s*\.\s*\1\s*\.\s*['"][^\{\}]{0,999}\$\w+\s*=\s*doutdo[\(\s]+\$\w+[\)\s]+;(?<X1286470>)|\s*=\s*str_rot13[\(\s]+urldecode[\(\s]+\$\w{1,40}[\s\)]+;[^\?]{999,}\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*['"]://['"]\s*\.\s*\1\s*\.\s*['"][^'"\?;]+\?[^;]+;[^\*]+return\s*\$file_contents;\s*\}(?<X1212150>))
(\$goweb\d*)[=\h]+['"]https?://(?:\w+\.)?\w+\.(?:top|xyz)['"]\s*;[^\{\}\?]{0,499}(\$\w+)\s*=[^;\{\}]*\1[^\{\}\?]{0,499}\$\w+\s*=\s*@?\w+[\s\(]+\2[\s\)]+;(?<X1240080>)
(\$group_num\d*)[=\s]+['"][^'"]+['"];\s*\$\w{1,40}[=\s]+["']https?://\d+\.\d+\.\d+\.\d+/['"]\s*\.\s*\1\s*\.[^;]+;[^\?]{0,499}\bfunction\s*(\w+)[\(\s]+[\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}[^\n]+\b\2\b[^;]{0,40};\s*\}(?<X1228060>)
(\$handler)\h*=\h*fopen\h*\(\h*ENGINE_DIR\h*\.\h*['"]/data/\w{1,20}\.php['"]\h*,\h*['"]w['"]\h*\);\s*fwrite\h*\(\h*\1\h*,\h*["']<\?php\s+\$[\w\.'"]{2,20}\h*=\h*['"][@eval\.'"\(gzuncomprsb64_d]{35,75}\\['"][^'"]{400,1500}['"]\)[^\+\n]{2,30}=\h*['"][creat_funio\.'"]{17,30};[^\n\{]{2,70}\$[\w\.'"]{2,20}\(\\['"]\\['"]\);(?<X1170810>)
(\$headers)(?:\h*=\h*(?:["']From:\h*(?:Itunes|office\h*(?:365)?\b)\b[^'"]{9,40}['"];\s*\1\h*\.\h*=\h*\$_POST\[['"]emailAdd\b(?<X2139401>)|['"]From[^'"]{1,49}@mox\.fr>\h*['"];\s*@?mail\h*\([^\)]+\1(?<X2141540>))|\s*\.?=\s*(?:['"][^'"]{1,40}['"];\s*mail\([^\)]{1,40}(\$\w{1,40})\s*\);\s*if\s*\(\s*mail\(\s*[^\)]{1,40}\s*\4\s*,\s*\1\s*\)\s*\)\s*\{\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;(?<X2054570>)|\$_POST\[['"]\$ip['"]\]\.?['"]?\\n['"];\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\1\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054490>)))
(\$heker\d*)[\h=]+['"][^'"]{9999,}['"];\s*\1\d*[\h=]+bin2hex\h*\((?<X2198640>)
(\$hell)\h*=\h*(\$_[GPCSR]\w{2,6}\[)[^\]]+\];\s*(\$yeah)\h*=\h*\2[^\]]+\];\s*(\$\w{1,40})\h*=\h*['"]\1/\3['"];\s*(?:if\h*\(\h*)?unlink\h*\(\h*\4\h*\)(?<X2168021>)
(\$hidden_username)[\h=]+['"]system\.[^;]+;[^\?]{0,400}\bwp_create_user[\h\(]+\1,[^\}]{0,99}\bset_role[\(]['"]administrator['"]\);[^\?]{99,999}\bis_author[\h\(]\1[\s\)\{]+wp_redirect[\h\(]+home_url[\h\(\)]+;\s*exit;\s*\}\s*\}\);(?<X120363350>)
(\$htaccess)\s+=\s+get_home_path\(\)\s+\.\s+['"]\.htaccess['"];\s+\$\w+\s+=\s+["']library\-plugin\-imunify360['"];\s+\$\w+\s+=\s+\[\s+['"]<IfModule\s+\w+_imunify360\.c>['"],\s+["'\s]+<(Location)\s+['"]/wp\-admin/\w+\-\w+\.php['"]>['"],\s+['"]\s+(Imunify360_Skip\s+1)['"][^'"]{1,49}['"]\s+</\2>['"],[^<]+<\2\s+['"]/wp\-content/\w+/lib\w+[/">',\s]+\3[^\(]+insert_with_markers\(\s+\1(?<X220333171>)
(\$htaccess_content)\s+=\s+self::remove_old_cloaker_rules\(\1\);\s+[^:]{1,99}\1\s+=\s+self::insert_cloaker_rules\(\1,\s+\$New_cloaker_rules(?<X220363960>)
(\$httpCode\d*)\s*=\s*(curl)_getinfo[\(\s]+(\$\w{1,40})[,\s]+\2INFO_HTTP_CODE[\)\s;]+(?:\2_close[\(\s]+\3[\)\s;]+)?if[\s\(]+empty[\s\(]+(\$\w{1,40})[\s\)]+\|\|\s*\1\s*!==\s*200[\s\)]+\{\s*\4[\s=]+['"]https?://[^/]+\.[a-z]{2,3}/[^'"]+['"]\s*;\s*\}(?<X1197901>)
(\$idx_path)[\h=]+(\$_SERVER\[[^\]]+\])[\h.]+['"/\.\hindexph]+;\s*(\$htc_path)[\h=]+\2[\h\.]+['"/\.\hhtaces]+;[^\?\}]{99,700}\b(call_user_func\()\$\w{1,25},\h*\1,\h*\d+\);[\s\}]+if[\h\(]+\4[^\}\?]{99,500}\b\4\$\w{1,25},\h*\3,\h*\d+\);\s*\}\s*\}\s*\}(?<X1223110>)
(\$in\w+)[\h=]+(\$_SERVER\[['"]DOCUMENT_ROOT['"]\][\h.]+['"]/)index\.php['"];\s*(\$\w+)[\h=]+\2\.htaccess['"];[^\?]{0,700}\b(file_)put(_contents)[\h\(]+(?:\3|\4),\h*\4get\5[\h\(]+\$\w+[\h\)]+;\s*chmod[\h\(]+(?:\3|\4),\h*['"]\d+['"][\h\)]+;[\s\}]+\1[\h=]+['"]{2};(?<X1249360>)
(\$index_path)(?:[\h=]+['"]index\.php[^;]+;\s*\$\w{1,15}[\h=]+(file_)ge(t_contents)\(\1\);\s*(\$\w{1,15})[\h=]+['"]/(?:home|var)/[^;]+;\s*if\h*\(\2exists\(\4[\)\{\s]+(\$\w{1,15})[\h=]+\2ge\3\(\4\);\s*\5[\h=]+base64_decode\([^\)]+\5[\)]+;[^\}]{9,99}\b\2pu\3\(\1,\h*\5\);\s*@?chmod\(\1,\h*\d+\);\s*\}\s*\}(?<X1210500>)|\h*=\h*['"]\w+\.php['"];\s*\$\w{1,15}\h*=\h*(file_get_contents)\(\1\);\s*(\$\w{1,15})\h*=\h*['"]/home[^'"]+['"];\s*if\h*\(\h*file_exists\(\8\)\)\s*\{\s*(\$\w{1,15})\h*=\h*\7\(\8\);[^\}]{9,199}\bfile_put_contents\(\1,\h*\9\);\s*@?chmod\(\1,\h*\d+\);\s*\}\s*\}(?<X1195541>)|\s*=\s*['"][^'"]*index\.php[^'"]{0,12}['"]\s*;\s*\$\w{1,15}[\h=]+(file_)ge(t_contents)\(\1\);\s*(\$\w{1,15})[\h=]+['"]/(?:home|var)/[^;]+;\s*if\h*\(\11exists\(\13[\)\{\s]+(\$\w{1,15})[\h=]+\11ge\12\(\13\);[^\}]{9,199}\bfile_put_contents[\(\s]+\1,\h*\14[\);\s@]+chmod[\(\s]+\1[,\h]*\d+[\);\s]+\}\s*\}(?<X1218330>))
(\$inject)=(str_replace(?:_first)?)\(['"]<\?php\s+['"][,'"]+\1\);[^\?]{99,400}(\$\w{1,20})=\2\(['"]<\?php\s+['",]+<\?php[^\.]{1,20}\.\1,\3\);\s*file_put_contents\(['"][^'"]{1,20}/(?:functions|index)\.php\.old['"],\3\);(?<X2204411>)
(\$ip)\s*=\s*getenv\(['"]REMOTE_ADDR['"]\);\s*}\s*return\s*\1;\s*}\s*\1\s*=GetIPsa\(\);\s*\$\w{1,40}\s*=\s*file_get_contents\((?<X2052200>)
(\$is_human)\h*=\h*@?detectBot\d*\h*\(\h*@?\$(?:_SERVER\[['"]HTTP_USER_AGENT['"]\]|server_user_agent)\h*[^;]+;\s*if\h*\(\h*@?\1\h*\S{2,3}\h*(?:false|true)\h*\)\s*\{(?<X2162641>)
(\$ishuman)\h*=\h*true;\s*foreach\h*\(\h*(\$stop_ip)s_masks\h+as\h+(\2_mask)\h*\)\s*if\h*\(preg_match\(\3\h*,[^!\-@></\|:]{1,999}\1\h*=\h*detectbot\d*\h*\((?<X2162530>)
(\$jump\w{0,9})\h*=\h*['"]<(script)\b[^;]{1,199}src\h*=\h*['"](?:http)?s?[:;]?//[^'"]{1,199}\.js['"]>\s*</\2>['"]\h*;\s*if[\s\(]+\$\w{1,40}\s*\S{2,3}\s*\d+[\s\)]+\{[^\}]{0,199}\$\w{1,40}[\s=]+\$_SERVER\[['"]QUERY_STRING['"]\];[^\}]{0,9999}\}[^\}]{0,199}\}\s*else\s*\{\s*if\h*\([^;]+echo\h*\1\h*;[^\}]+\}\s*\}(?<X1185650>)
(\$jumpcode)\s*=\s*["']<script\b[^;]+;\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\S{2,3}\s*['"][^'"]{1,40}['"][\s\)]+\{(?:[^:]{1,999}\$\w{1,40}\s*=\s*['"]https?://[^;]+['"];[^:]{1,999}header\(['"]Content\-[^\)]+\);)+[^\}]+\}\s*else\s*\{[^\}]+echo\s*\1;(?:[^\}]{0,40}\}){3}(?<X1200480>)
(\$L\w{1,9})=explode\((base64_decode)[\("']+Pz4[="'\),]+file_get_contents/\*+[^\*]*\*/[\(\s]+__FILE__[\)\s;]+(\$\w{1,40})=array\(\2\(['"][^'"]+['"]\),\2\([^\)]+\),\2\(strrev\(str_rot13\(\1\[\d+\][\)\s;]+\$\w+[=\s]+['"]\w+['"];preg_replace\(\3\[\d+\],serialize\([^;]+@eval[^;\(]+\(\3\[\d+[\]\)\s,]+\3\[\d+[\]\);\s]+(?:exit|die)\(\);(?<X1254411>)
(\$license_data)\->success[\s=]+true;\s*\1\->error[\s=]+'';\s*\1\->expires[\s=]+date\(['"]Y\-m\-d['"],\s*strtotime\(['"]\+50\s+years['"]\)\);\s*\1\->license[\s=]+['"]valid['"];(?<X120361480>)
(\$links)(?:[\h=]+(?:array\w*)?[\(\[][^\]\)]{0,250}[\]\)]\h*;[^\\\?>@#%&\+]{1,999}['"][^,]{0,20}big__stat\.txt['"][^@\?]{99,499}\bforeach[\h\(]+\1\h+as\h+\$link\h*\)[\{\s]+\$\w{1,20}[\h=]+stream_context_create[\h\(]+array\h*\((?<X2230431>)|\h*=\h*\[\s*['"][^\];]{9,250}\];\s*shuffle\h*\(\1\);[^\\\?>@#%&\+]{99,999}\bfile_put_contents\h*\([^\{@\?]{99,499}\bforeach\h*\(\1\h+as\h+\$link\h*\)\s*\{\s*\$\w{1,20}\h*=\h*stream_context_create\h*\(\h*array\h*\((?<X2171881>))
(\$log)\s*=\s*['"]\$target(?:nya)?/\$shell['"];\s*(\$ch)\s*=\s*curl_init\(['"]?\1['"]?\);[^=]{9,150}curl_exec\(\2\);(?<X2119670>)
(\$log->lwrite)\(\$IP\);\s*\1\(\$Agent\);\s*\1\(\$browserType\);\s*\1\(\$hostname\);(?<X2051960>)
(\$mess?a[ge]{2}s?)\s*=\s*['"]php_info['"];\s*\1\s*=\s*['"]@['"];[^\\]{9,150}(?:\$(?:mess?a[ge]{2}s?|msg|bilsmsg)\s*\.\s*=\s*['"][^\.]{1,20}\.\$_POST\[['"](?:email|password|pass|username|login)['"]\]\.[^;]{1,20};\s*){2}(?<X2138450>)
(\$message)(?:\h*(?:=\h*['"]Exploit\h*:\h*https?://\h*['"]\h*\.\h*\$_SERVER\[['"]SERVER_NAME['"]\]\h*\.\h*\$_SERVER\[['"]REQUEST_URI['"]\]\h*;\s*@?mail\h*\([^\)]+\1[^\)]+\)\h*;\s*\$\w{1,9}\h*=\h*fopen\h*\(['"]\.\w{1,40}['"]\h*,\h*['"][wa\+]+['"]\h*\)(?<X2146210>)|\.=\h*['"]Others\h+verification\h+Result['"]\h*\.[^(\{\}\)]{99,499}mail\h*\([^;]+\1\h*\)\h*;(?<X2171700>))|\s*(?:=\s*['"][^'"]{0,40}OFFICE\s+365\s+[^'"]{0,40}['"];\s*[^\?]{1,400}\s*\1\s*\.?=\s*['"](?:Password|pwd|pass)(?<X2056111>)|\.=\s*['"](?:[^'"]{1,40}Office365[^;]{1,40}['"];\s*\1\s*\.?=\s*['"]Email\s*:\s*[^;]{1,40}['"];\s*\1\s*\.?=\s*['"](?:Password|Pass|Pwd)\s*:[^;]{1,40}['"];\s*[^`]{1,600}\$send(?<X2056102>)|\W{1,35}W[3E]LL\s+ST[0O]R[E3]\W{1,35}\.['"]?\\n['"];\s*return\s+\1;(?<X2065340>)|User-Agent:\s*['"]\s*\.\s*\$browser\s*\.\s*["'][^;]+;[^@]{1,99}(\$\w{1,40})\s*=\s*['"][^'"@]{1,40}@(?:aol|gmail|yahoo)\.\w{2,7}['"];[^\?]{1,99}\$\w{1,40}\s*=\s*@?mail\(\s*\7\s*,[^'",]{0,40}['"](?:Others?|Outlook|AOL|Office365|Billing|Amazon|Yahoo)\s*\|\s*['"]\s*\.\s*\$ip\s*,\s*\1\);(?<X2118541>))|\.?=\s*(?:['"](?:(?:CC|Card)\s+number\s*:\s*['"]\.\$_POST\[['"]\w{1,40}['"]\]\s*\.?\s*['"]?\\n['"];\s*\1\s*\.?=\s*['"](?:(?:Exp|expiration)\s*month/year/cvv|security)\s*code\s*:\s*['"]\.\$_POST\[['"]\w{1,40}['"]\](?<X2054781>)|[\$\-\s\:+\.=_\w]{10,40}\\n['"]\s*;\s*@?mail\([^\;]{1,200}\)\s*;(?:\s*\})?\s*(\$\w{1,12})\s*=\s*fopen\s*\(\s*['"][^\)]{1,40}['"]\);\s*fwrite\(\10\s*,\s*\1\s*\);\s*fclose\(\s*\10\s*\)\s*;\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054031>)|[^'"]{0,40}LOGS[^'"]{0,40}['"];\s*\1\s*\.?=\s*"Email:\s*"\.\$_POST\['email'\]\."\\n";\s*\1\s*\.=\s*"Password:\s*"\.\$_POST\['pass'\]\."\\n";(?<X2052430>))|[^;]{0,80}['"]\s*CPassword:\s*['"]\s*\.\s*\$_POST\[['"](?:password|pass|passwd)['"]\][^;]{1,40};\s*\1\s*\.?=\s*[^\{]{1,40}\{\$geoplugin->(?<X2054840>))))
(\$message\s*\.=\s*['"])[^'"]{1,9}(['"]\.\$_POST\[['"])(?:email|username|uname|user|login)['"]\]\.[^;]{0,9};\s*\1[^'"]{1,9}\2(?:password|pass|pwd|psw|passwd)['"]\][^\(]{9,200}\1[^'"]{0,9}https?://www\.geoiptool\.com/[^\(]{30,200}@?mail\((?<X2123600>)
(\$msg)\h*=\h*['"][^'"]{0,19}\[\+\][^\[]{1,49}\b(?:DHL|Card\h*INFO|Bill)[^#]{99,1999}\bmail\([^\)]+,\h*\1(?<X2193541>)
(\$my_?inj)\h*=\h*['"]\h*define[\h\(]+['"]WP[^\{\}]{99,199}(\$\w{1,40})\h*=\h*str_i?replace[\(\h]+['"](wp_debug_mode\(\);)['"]\h*,\h*['"]\3[^'"]{0,20}['"]\h*\.[^\$;]*\1[,\h]+\2[\h\)]+;(?<X2182552>)
(\$new_path)\s*=\s*['"]{2};\s*if\h*\(\h*!\h*isset\h*\(\h*(\$_POST\[[^\]]+\])[\)\s]+\{\s*echo\h+['"]\w{1,40}['"];\s*break;\s*\}\s*\1\h*=\h*base64_decode\h*\(\h*\2\h*\)\h*;\s*\1\h*=\h*str_replace\h*\(['"]/['"](?<X2158100>)
(\$Pas[se]walk)\h*=\h*\$\w{1,40}\[\d+\]\h*\.[^>&x]{0,999}\$\w{1,40}\h*=\h*\1\h*\(\$\w{1,40}\);[^!]{999,1999}(\$\w{1,40})\s*=\s*@curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*!\2\s*\)\s*\2\s*=\s*@file_get_contents\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X2176990>)
(\$passwd)\s*=\s*explode\("\\n"\s*,\s*file_get_contents\('/etc/passwd'\)\);\s*foreach\(\1(?<X2051480>)
(\$password)=['"]\w+['"];\$shell_?name=[^@]{1,499}\bfunction\s+(Class_UC_key\()[^\}]{9,199}=pack\([^@]{1,199}\$\w{1,40}=(?:\2[^\)]{1,49}\)\.(?:\$u[ser]{0,3}name|\1)\.){2}\2(?<X2153821>)
(\$path_?to_?dor)=[^;]{1,99};[^\?]{0,199}\$(\w{1,40})=[^;]{0,99}\1[^;]{0,99};[^\?]{0,199}\$(\w{1,40})=file_get_contents\([^\)]+\$\2\b[^;]{1,99};[^\?]{0,199}\becho\h*\$\3;(?<X2178390>)
(\$praga)\h*=\h*rand\(\);\s*(?:\1\h*=\h*md5\(\1\);(?<X2149232>)|goto\s+\w{1,9};\s*\w{1,9}:[^\v]{99,999}\1\h*=\h*md5\(\1\);(?<X2151250>))
(\$proxy)\h*=\h*new\h+PhpReverseProxy\(\)[^\?]{1,299};\1\->output\(\);(?<X2141450>)
(\$root)\h*=\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*if\h*\(is_writable\h*\(\1\)\)\s*\{\s*(\$\w{1,20})\h*=\h*['"]PD9[^'";]{9999,}['"];\s*\$fu?ck\h*=\h*base64_decode\h*\(\2\);(?<X2172220>)
(\$s[he]{2}llcontent)=['"]https?://[^/;]{5,40}/\w{1,20}\.txt['"];\s*(file_)pu(t_contents)\(\$backpathtext\d*,\2ge\3\(\1\)\);\s*chmod\(dirname\(__FILE__\)(?<X2173840>)
(\$s_path)\s*=\s*\$\w{1,40}\s*\.\s*DIRECTORY_SEPARATOR\s*\.\s*\$\w{1,40};\s*if\s*\(\s*file_put_contents\s*\(\s*\1,\s*\$remote_files\[[^\{]{1,99}\{\s*if\s*\(\s*\$\w{1,40}\s*==\s*['"]\w{1,40}['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*timestampGenerate\s*\(\$\w{1,40}\);\s*touch\s*\(\1,(?<X2125420>)
(\$SBYouNet)=['"]<meta\h+http\-equiv=['"]Content\-type['"]\h+content=['"]text/html\b[^@]{1,999}(\$www_669977_Net_\w{1,40})=str_replace\(array\(PHP_EOL,[^;]{1,499};if\((?:md5\(){3,}\2\)+[^\{]{1,99}\{echo\h*\1;(?:die|exit)[^;]{0,19};\}(?<X2183681>)
(\$send)[\s=]+array[\s\(]+['"]PaymentMethod['"]\s*=>[^\{]{999,1999}\bforeach[\s\(]+\1\s*as\s*(\$\w+)\s*=>\s*(\$\w+)[\s\)]+\{\s*\1\s*\.?=\s*\2[\s\.]+['"]=['"][\s\.]+\3[\s\.]+['"][^'"]*['"]\s*;[\s\}]+(\$\w+)\s*\.?=\s*substr[\s\(]+\1\b[^;]+;\s*@?(?:eval|mail)\s*\([^\)]+(?:\4|(?:J(?:HFuZ25mcmFx|GRhdGFzZW5k)|CRxbmduZnJhcS)[\w=]+['"])\)+;(?<X1123983>)
(\$shell)(?:\h*=\h*['"]https?://pastebin\.com/raw/\w{2,9}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\(\1\);\s*@?eval\(['"]\?>["']\.\(htmlspecialchars_(decode)\(url\3\(base64_\3\(\2[\)\s]+;(?<X2147020>)|\s*=\s*file_get_contents\(['"]https?://[^'"]{1,40}/\w{1,40}\.txt['"]\);\s*if\s*\(\s*empty\(\s*\1\s*\)\s*\)\s*\{\s*(?:die|exit)[^;]{0,33};\s*\}\s*echo\s*['"][^'"]*['"];\s*flush\(\);(?<X2122050>))
(\$shell_file)\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*[^\.]+\.['"]/['"]\.\1\.['"]\.html['"];\s*if\h*\(\h*(?:check_)?remote_file_exists\h*\(\2(?<X2186131>)
(\$shellname\d*)\s*=\s*['"][^'"]+['";\s]+(\$\w{1,40})\s*=\s*curl_init\h*\(\)[;\s]+curl_setopt[\(\s]+\2\s*,\s*CURLOPT_URL\s*,\s*['"](https?://[^'"]+)['"][\s\)]+;[^=\{\}]{0,99}\b((file_)pu(t_contents))[\s\(]+\1[,\s]+curl_exec[\s\(]+\2[\s\);]+if\s*[^;\$]+\1[^;\}]+\4[\s\(]+\1[,\s]+\5ge\6[\s\('"]+\3['"][\s\);]+\}(?<X1197920>)
(\$spyhackerz)\h*\.?=\h*['"][^\(]{9,99}\bmail\h*\([^\)]{2,40}\1\);(?<X2170830>)
(\$staticfile)\s*=\s*['"][^'"]+['"];\s*(\$\w{1,20})\s*=\s*generateRandomString\s*\(\);\s*(\$secfile)\s*=\s*\2\.['"]\.php['"];\s*if\s*\(\s*!?copy\s*\(\1\s*,\s*\3\)(?<X2134230>)
(\$subj?(?:ect)?)\h*=\h*['"](Poste)\s+(?:Personal|login)\s+Info\s+for\b[^\(\?]{99,499}\bmail\([^\)]+\1[^\`]{9999,29999}\b\2\s+Italiane\s+20\d{2}\s*\-\s*Partita\s+iva\s*\W\s*\d{11}\b(?<X2147413>)
(\$subject)(?:\h*=\h*['"]\h*(?:(?:bank|apple?|ama?zo?n|cc)\s*(?:result[sz]|info)\b[^\(]{1,99}(\$headers)\s*\.=[^;]+\$_POST\[['"]eMailAdd['"]\][^\?]{1,99}\bmail\([^\)]+\1\b[^\)]+\2\h*\);(?<X2142700>)|Bank\h*infos?[^\(]{9,199}(\$headers)\s*\.=[^;]{0,99}\$_POST\[['"]eMailAdd['"]\][^\(]{9,99}\bmail\((?:[^\)]+(?:\1|\4)){2}\);(?<X2141860>))|\s*=\s*['"]Amazon\s+LogIn\s*Info[^'"]{1,40}['"];\s*mail\(\$\w{1,40},\s*\1,\s*\$\w{1,40}\);\s*header\(['"]Location:(?<X2054861>))
(\$sum)\s*=\s*\(?(?:@base64_decode\s*\(\s*){4}\$\w{1,40}\[\d+\][\s\)]+;\s*[^\}]{1,600}\}[\s\}]+return\s+\$\w{1,40}\s*\.\s*['"]\s*,\s*['"]\s*\.\s*\1;(?<X2120010>)
(\$sys_)\w+[\s=]+['"][^'"]+['"];\s*\1\w+[\s=]+isset\(\$_SERVER\[['"]HTTP_HOST['"][^=]{1,49}\1\w+[\s=]+str_replace\(['"]www\.[^&]{1,129}\1\w+[\s=]+base64_decode\(\1\w+[^'"]{1,99}\1\w+\s*!==\s+trim\(\1\w+\)\)\s*\{\s*header\(''\);\s*exit\(""\);\s*\}\s*\}(?<X120360330>)
(\$tresc_shella)\d*\h*=\h*(?:fopen|(?:url|file)_get_contents)\h*\(['"][^'"]{9,99}\.txt['"]\);[^\?%]{99,300}\bfile_put_contents\h*\(\$\w{1,20}\.['"]/wp\-[^,\)]{9,99}\.php['"]\h*,\h*\1\d*\);(?<X2168940>)
(\$url)\s*=\s*['"]wp\-(?:admin|content(?:/plugins|/themes)?|includes)[^/]{0,99}/\w+\.php['"];\s*(\$\w+)\s*=\s*file_get_contents\(\1\);\s*eval\(['"]\?>['"]\s*\.\s*\2\);(?<X120354201>)
(\$urlz)\s*=\s*lrtrim\(\s*\1\s*\);\s*(\$\w{1,40})\s*=\s*lrtrim\(\s*\2\s*\);\s*(?:\$\w{1,40}\s*=\s*\$_POST\[['"]\w{1,40}['"]\];)?\s*(\$message)\s*=\s*urlencode\(\s*\3\s*\);\s*\3\s*=\s*ereg_replace\(['"]%(?<X2055561>)
(\$user)[\h=]+['"]username['"];\s*(\$pass)[\h=]+['"]Password['"];[^\{]{9,150}\{\s*(\$\w{1,15})[\h=]+wp_create_user[\h\(]+\1[\h,]+\2[^\)]+\);\s*(\$\w{1,15})[\h=]+new\h*WP_User[\h\(]+\3[\h\)]+;\s*\4\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*}(?<X1199110>)
(\$username)(?:[\h=]+['"]newadmin['"];[^\?]{0,99}(\$\w+)[\h=]+['"][^@]+@example\.com['"];[^\?]{0,99}(\$\w+)[\h=]+wp_create_user[\h\(]+\1,[^;]+\2[\h\)]+;[^\?]{0,99}(\$\w+)[\h=]+new\h*WP_User[\h\(]+\3[\h\)]+;\s*\4[\h\->]+set_role[\h\('"]+administrator['"\h\)]+;(?<X120359900>)|[\s=]+['"]newadmin['"];\s*(\$password)[\s=]+['"][^;]{1,29}['"];\s*(\$email)[\s=]+['"]antaklifadi[^;]{1,29}['"];[^,]{1,79}wp_create_user\(\1,\s*\6,\s*\7\);[^>]{1,49}>set_role\(['"]administrator['"]\);\s*\}(?<X120355114>))
(\$v\d+)[\h=]+['"]\./wp-(?:admin|content|includes)/[^'"]+['"];\s*if[\h\(]+(file)size[\h\(]+[^\{;]+\{\s*if[\h\(]+\2_exists[\h\(]+\1[\s\)]+\{\s*(\$\w{1,25})[\h=]+gzinflate[\h\(]+\2_get(_contents)[\h\(]+\1[\h\)]+;\s*if[^#;]{0,99}\b\2_put\4[\h\(]+['"][^'"]+['"],\s*\3[\h\)]+;\s*\}\s*\}(?<X1213031>)
(\$var\_\w{16,})\.['"]\?['"]\.\$var_\w{16,};\s*setcookie\(['"]\w+[^\}]{1,999}base64_decode\(['"]d2luZG93LmxvY2F0aW9uLmhyZWY[^\}]{1,999}\1(?<X220335050>)
(\$VERSION)\s*=[^;]+;\s*\$REDIRECT_[^@#]{999,4999}\$(\w+)[\s=]+array[\s\(]+['"]https?://[\d\.]+/router\d+\.php\?[^;]+\1[\s\)]+;\s*shuffle[\s\(]+\$\2[\s\)]+;[^\?]{1,499}\bforeach[\s\(]+\$\2\s*as\s*(\$\w+)\b[^\}]{1,99}(\$\w+)[\s=]+@?file_get_contents[\s\(]+\3\b[^\?]{1,999}\becho\s*\4;(?:\s*(?:die|exit)\b[^;]{0,99};\s*\}?)+(?<X1195655>)
(\$watchdog_file)[\h=]+ABSPATH[\h\.]+['"]www\.php[''];\s*if[\h\(]+file_exists[\h\(]+\1[\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1;\s*\}(?<X120359970>)
(\$web)[\h=]+\$\w+[\h\.]+['"]://['"][^;]+;\s*(\$\w+)[\h=]+trim\(\w+\(\1[\h\)]+;\s*if[\h\(]+!(strstr)\(\2,[^\{]+\{\s*if[\h\(]+\3\(\2,[^\{]+\{\s*@header\([^\)]+\);\s*\2[\h=]+str_replace\([^;]+;\s*echo\h*\2;\s*(exit\(\);)\s*\}\s*else\h*if\([^\{]+\{[^\}]{9,199}\becho\h*\2;\s*\4\s*\}\s*\}(?<X1262700>)
(\$wp\w{0,40})\h*=\h*['"][a-f\d]{0,64}['"]\h*;\s*function\h*(\w{1,40})\h*\([^\)]*\1[^\?]{99,1999}(\$\w{1,40})\h*=\h*\2\h*\([^\)]*\1[\h\)]+;\s*if[\h\(]+isset[\h\(]+\3[\s\)]+\{\s*@?(?:eval|asset)[\h\(]+\3[\h\)]+;\s*\}(?<X1179921>)
(\$wp_(file)system)\s*=\s*array\h*\(\h*\)\h*;\h*\$\w{1,40}\h*=\h*\d+;\s*\1\h*\[[^\]]+\]\h*=\h*\2size\h*\(\h*__\2__[\h\)]+;\s*if[\h\(]+\2_exists[\h\('"\.]+/template\.html?['"][\)\s\)]+\{\s*\1\h*\[(?<X2179130>)
(\$wp_4meta_arr)[=\s]+array[\(\s'"]+comment["']\s*=>[^;]+;\s*\$\w{1,40}[\s=]+(?:(\$\w+)\s*\->\s*query[\(\s'"]+SELECT[^;%]+\bLIKE\s*['"]recovery_pages_%['"\s\)]+;[^\176]{9,999}(\$\w{1,40})\s*=\s*str_replace[\s\(]+\1[^>]{9,9999}@touch[\s\(]+\3[^;]+;[\s\}]*\2\->close[\(\);\s]+unset[\s\(]+\2[s\)]+;(?<X1222440>)|(\$wpdb)[^'";]+['"]SELECT[^;%]+\bLIKE\s*['"]recovery_pages_%[^;]+;[^\176]{9,999}(\$\w{1,40})\s*=\s*str_replace[\s\(]+\1[^>]{9,9999}@touch[\s\(]+\6[^;]+;[\s\}]*\5\->close[\(\);\s]+unset[\s\(]+\5[s\)]+;(?<X1222490>))
(\$wp_\w+)[\h=]+explode[\h\(]+['"]function['"],[^;]+;\s*(\$wp_\w+)[\h=]+\1[^;]+;[^\?]{9,99}(\$wp_\w+)[\h=]+\2\([^\)]+\);\s*\$\w+[\h=]+\2[\h\(]+\3[\h\(]+\2[\h\(]+[^;]+;(?<X1266040>)
(\$wp_\w{1,9})\s*=\s*getcwd\(\);\s*if\s*\(\s*isset\s*\(\s*\$_FILES\[['"](wp_\w{1,9})['"]\]\)\)\s*\{\s*\$wp_\w{1,40}\s*=\s*basename\(\$_FILES\[['"]\2['"]\]\[['"][^\$]{1,40}\$_FILES\[['"]\2['"]\]\[['"][^'"]{1,40}['"]\],\s*\1(?:[^\?]{200,300})\?path\s*=\s*\1[^\;]{1,200};(?<X1056241>)
(\$wp_default_logo)(?:=['"]<img\h*src=["']data:image/\w{1,7};[^'"]{600,2200}['"]>['"];\s*preg_match\(["'][^,]{5,40},\1,(\$\w{1,20})\);\s*(\$\w{1,20})=\2\[\d+\];\s*(\$\w{1,20})=pre_term_name\(\3\);\s*if\(isset\(\4\)\)[\{\s]+eval\(\4\);\s*\}(?<X2203772>)|\s*=\s*['"](<img\s*src)[^>]{9999,30000}>['"];\s*preg_match\s*\(['"][^<]{0,9}\6[^,]+,\s*\1\b(?<X2134480>))
(\$wp_template_css)\h*=\h*get_option\([^\)]+\);\s*if\h*\(\h*isset\h*\(\h*(\1\[[^\]]+\])[\s\)]+@\2\h*\(\h*null,\h*\1\[[^\]]+\]\h*\(\h*\1\[[^\]]+\][\s\)]+;(?<X1194440>)
(\$wpautop)\h*=\h*\w{1,40}\h*\([^;]+;\s*(if\h*\(\h*isset\h*\()\h*\1\h*\)\h*\)\h*\{\s*\2\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+@setcookie\h*\(\h*['"]f_pp['"]\h*,\h*\3\h*\);\s*(\$\w{1,40})\h*=\h*create_function\h*\(\h*['"]{2}\h*,\h*\1\h*\);\s*unset\h*\([^\)]+\1\h*\);\s*\4\(\);\s*\}(?<X2144010>)
(\$wpautop\d*)\s*=\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+;\s*if[\s\(]+isset[\s\(]+\1[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]create_function['"];\s*\2[\s\(]+['"]{2}\s*,\s*['"]\}['"]\s*\.\s*\1\s*\.[^;]+;\s*\}(?<X1200470>)
(\$wpdb\->)query\h*\(['"]INSERT\h*into\h*\1users\h*\([^\\\?\*]{99,900}\$\w{1,20}\h*=\h*file_get_contents\h*\(['"]https?://(?:paste|ghost)bin\.\w{2,6}/(?<X2181282>)
(\$xmailer)=explode\([^\)]+\);\s*\$gmailer=\1\[array_rand\(\1\)\];[^%&\+]{99,900}\bmail\([^\)]+\);\s*\}\s*foreach\h*\(\$_POST\h*as\h*\$key=>\$[^\)]{0,3}value\)(?<X2174520>)
(\$xmlname)=\[[^\?]{1,199}(\$\w+)=\$_SERVER\[['"]HTTP_HOST['"]\]\?[^@]{1,99}is_https[^!]{1,99}\2;\$\w+=file_exists[^!]{1,99}[^\(]{1,49}preg_match\(['"][^'"]+\.php[^@]{1,499}str_replace[^@]{1,299}(\$\w+)=request\(\1[^=]{1,49}\3[^@]{1,999}Location:\s*['"]\.\3[^@]{1,1199}\.txt[^\?]{1,499}https?://[^@]{1,899}(\$\w+)\[\d+[^!]{1,299}\4\[\d+\]\.['"]\d+['"]\);\}(?<X120364661>)
(\$Z118_)SUBJECT\s*\.?=\s*['"](?:CC|VBV|CVV|Pin|Login|PPL|Paypal|Gmail|Ymail)(?:'s)?\s*(?:Info)?\s+FROM\s+(?:.\s+['"]\.\$_SESSION\[[^\]]+\]\.['"]['"]?\s*){1,2};\s*\1HEADERS\s*\.?=\s*['"]From:\s*Dexter(?<X2063062>)
(\.(\w{1,40}\()['"]http)s?://[^;]{1,199};(?:echo\b[^;]{1,199}\1s?://[^;]{1,199};){1,}\}?function\h*\2(\$\w{1,40})\)\{(\$\w{1,40})=file_get_contents\(\3\);if\(!?\4\b[^\}]{1,499}\}return\h*\4;\}?(?:exit|die)[^;]{0,19};\}?(?:\?>)?\Z(?<X2178570>)
(\/\*\h*\w{32}\h*\*\/)\s*(\$\w{1,15})\h*=\h*(?:chr\(\d{1,3}\)\h*\.\h*){15}[^;]{0,699};\s*(\$\w{1,15})\h*=\h*(?:\2\[\d{1,3}\]\h*\.\h*){8}[^;]{0,199};\s*(\$\w{1,15})\h*=\h*(?:\2\[\d{1,3}\]\h*\.\h*){8}[^;]{0,199};\s*\3\h*\(\h*\4\h*\(\h*null,\h*(?:\2\[\d{1,3}\]\h*\.\h*){145}[^;]+;\s*\1(?<X1183670>)
(createFolder)\s*\(\s*\$\w+\s*\)\s*;function\s+\1\s*\(\s*(\$\w+)\s*\)\s*\{[^\{]{1,20}\{\1\s*\(\s*dirname\s*\(\s*\2(?:\s*\)){2}\s*;\s*mkdir\s*\(\s*\2\b[^`]{99,999};\s*header\s*\(\s*['"]\s*content\-type\s*:[^'"]{1,99}charset\s*=\s*gb2312[^'"]{0,99}['"]\s*\)\s*;(?<X2128001>)
(define\(['"])(TG_TOKEN)[^%]{1,99}\1TG_CHAT[^%]{1,99}\bfunction\s+sendToTelegram\(\$\w+\)\s*\{\s*\$\w+[\s=]+['"]https://api\.telegram\.org/bot['"][\s.]+\2[\s\.]+['"]/sendMessage[^%]{1,1999}\$(otp)\s+=\s+(?:trim)?\(\$_POST\[['"]\3(?<X220348051>)
(function)\s*\w+\((\)\{)[^\{]+\{\1\s*\w{1,40}\([^\;]{1,50};(?:(curl_)setopt\([^;]+;){3,4}(\$\w+)=\3exec\(\$\w+\);return\s*['"]<\?php\s*/\*['"]\.(?:md5\(time\(\){2}\.){2}['"]\*/\?>['"]\.\4;\}\1\s*(\w+)[^\}]{99,199}\}\1\s*(\w+)\([^\}]{9,99}\{(\$\w+)=[^;]+;if\(\7\2\5\([^\)]+,\7,\d\);\}{3}\6\(\$_[GPCSR]\w{2,6}\[(?<X2129260>)
(function\s+)upload\d+Fsociety\d*\(\)\{\s*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\{]{1,49}\{\s*\1\w+(\(\$\w+,\s*(\$\w+)\))\s*\{\s*\3\s*=[^;]+(md5\(rand\([^\)]+\)\))\s*\.\s*\4[^;]+;\s*file_put_contents\2;\s*\}\s*\1\w+\s*(\(\$\w+\))\s*\{\s*(\$\w{1,40})\s*=\s*rawurldecode\5;\s*return\s*\6;\s*\}(?<X2131912>)
(fwrite\(\s*fopen\(\s*['"]\s*\.\s*contactemail\s*['"]\s*,\s*['"](?:w|a)\+?['"]\s*\)\s*,\s*['"][\w\.\-]+@[\w\.\-]+\.[a-z]{2,6}['"]\);)[^;]{1,60};\s*\1(?<X2118703>)
(g\d{2}b_crypt\()(\$_[GPCSR]\w{2,6}\[['"])\w{1,40}['"]\](,['"]\w{2,5}['"]\s*\)\s*:\s*false\s*;)(\2\w{1,40}['"]\])=\(isset\(\4\)\)\?\1\4\3(?<X2130090>)
(header\()['"](?:(Content\-)Length:\s*['"]\.(\$\w{1,40}\[)\d{1,3}\]\((uhex\([\$_[GPSCR]\w{1,6}\[[^\]]{1,42}\]\))\){2};\1['"]\2disposition:\s*attachment;filename=[^;]{1,99}\4[^;]{1,99};\3\d{1,3}\]\(\4\);\}(?:\?>|\Z)(?<X2128800>)|WWW-Authenticate:\s*Basic\s+realm\s*=\s*(?:['"](?:php|c99|wso|r57)\s*shell[^\)]{0,20}\);\s*\1['"]HTTP/\d\.\d\s+(?:401|403)\s+(?:Unauthorized|forbidden)(?<X2129140>)|[^\)]{1,15}\);\s*\1['"]HTTP/1\.\d\s+(?:401|403)\s+(?:Unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};[^\\]{99,500}\$\w{1,20}\s*=\s*['"]/etc/passwd['"];(?<X2123850>)))
(if\(isset)\((\$\w{1,10})[\)\s]+\{\s*\$\w{1,10}\h*=\h*[eas](?:xec|hell_exec|val|ssert)\(\2\);[^\}]{1,99}\}\s*\1\((\$eval)[\)\s]+\{\s*eval\(['"]\3['"]\);\s*\}(?<X2173233>)
(ob_)start\(\);\s*(\$\w{1,9})\s*=\s*\\['"]['"]\.\$(?:data|payload)\.['"]\\['"];\s*@?eval\s*\(gz(?:uncompress|inflate)\s*\(base64_decode\s*\(\2\)\s*\)\s*\);\s*\$\w{1,9}\s*=\s*\1get_contents\(\);\s*\1end_clean\(\);\s*\?>['"];(?<X2121671>)
(touch)\s*\(\s*(dirname)\s*\(\s*(__FILE__)\s*\)\s*,\s*\$\w{1,40}\s*\);\s*\1\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*\$\w{1,40}\s*\);\s*if\s*\(\s*(substr)\s*\(\s*(PHP_OS)\s*,\s*0\s*,\s*3\s*\)\s*\D{2,3}\s*'[^']*'\s*\|\|\s*\4\s*\(\s*\5\s*,\s*0\s*,\s*3\s*\)\s*\D{2,3}\s*'[^']*'\s*\)\s*\{\s*(chmod)\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*0444\s*\);\s*\6\s*\(\s*\2\s*\(\s*\3\s*\)\s*,\s*0555\s*\);\s*\}(?<X2046941>)
(unlink)\s*\(['"]([^\.]{0,9}\.pl)['"]\);\s*\1\s*\(['"](php\.ini)['"]\);\s*\$\w{1,20}\s*=\s*fopen\(['"]\3['"],[^\.]{9,99}\$\w{1,20}\s*=\s*['"]perl\s+\2\s+\$\w{1,20}['"];(?<X2124340>)
,(?:(\$\w{1,40})[=\s]+function[\(\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})\s*=\s*['"]['"][\)\s]+\{\s*return\s*empty[\s\(]+\2\[\3[^&\n]{1,199}\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}[\)\s]*&&[^:\?\n]+include\s*\$\w{1,40};[^\?:\n]{0,199}\1[\s\(]+\$\w{1,40}\s*,\s*\4\[\d+\][^:\n]{1,999}:\s*['"]{2}(?<X1222530>)|0444\)\);\}\}[^\{]{1,99}\{exit\(00\);\}\}\w+[^;]+sleep\(03\);\}\}\s*\Z(?<X220357151>)|\s*(?:['"](?:\^[^'"]+['"]\s*,\s*["']\^[^'"]+["']\s*,\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*in_array\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]+['"]\s*\]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{[^\}]+header\s*\(\s*'HTTP/1\.0 404 Not Found'\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*else\s*\{[^\}]+foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{(?<X2046322>)|index\.html\.bak\.bak[^\?]{1,600}\$is_(?:wp|wordpress)\s*=\s*(?:false|0);\s*\$is_(?:jm|joomla)\s*=\s*(?:false|0);(?<X2056770>))|basename\(\$_FILES[^\$]{1,40}\$_POST\[['"]?(\w{1,40})['"]?];[^`]{1,400}<input\s+name\s*=\s*['"]\9['"][^>]{1,40}value\s*=\s*['"]\.php['"]\s*/>(?<X2052880>)|function\s*\(\s*\)\s*{\s*add_object_page\s*\(\s*"UBH"\s*,(?<X2049960>)|sprintf\((\w{1,40})\('[^']{1,40}'\),\s*constant\(\12\('[^']{1,40}'\)\)\s*,\s*Config::get\(\w{1,40}\((?<X2050540>))|CURLOPT_(?:POSTFIELDS,['"]<(method)call>\s*<(\14(name))>\s*wp\.getUsersBlogs\s*</\15>\s*<(param)s>\s*(?:<\17>\s*<(value)>[^\-]{1,60}</\18>\s*</\17>\s*){2}[^\?#%@&\*:]{1,199}\bpreg_\w{1,19}\(['"](\W)<\16>isAdmin</\16>\19(?<X2179601>)|URL,['"]https?://(?:[^\./'"]{1,19}\.)?admailer\.[\w\.]+/[^'"]{3}[^\}\?=]{1,499}\$(\w{1,40})=curl_exec\([^\}\?]{1,499}\bfile_put_contents\(['"]([^,\)'"]+\.php)['"],\$\21\);(?:requir|includ)e\w{0,5}\h*\(?['"]\22['"]\)?;[^@#%&\\]{499,1999}\}new\h+\w{1,40}\(\);(?:\?>)?\Z(?<X2180480>)))
-\s*Process\s*Faker\s*,[^\n]{1,200}\s+Options:\s+-s\s+string\s+Fake\s+name\s+process(?<X2055960>)
/(?:#s"\s*,\s*\$\w{1,40}\(\s*""\s*,\s*\$\w{1,40}\(__FILE__\s*\)\s*\)\s*,\s*\$match\s*\)\s*\?\s*\(\s*\$match\[\s*\d+\s*\]\s*\)\s*:\s*""\s*\)\s*\.\s*"//"\s*\)\s*;(?<X2049100>)|(\*\w{32}\*)/;\(function\(\)\{var\s*(\w{1,15})=['"]{2};var\s*\w{1,15}=['"]\w{99,2200}['"];for\s*\(var[^\}]{9,199}\}\s*\3=\3\.substring\(\d,\3\.length\-\d\);\s*(eval\()\4['"]String\.fromCharcode\(['"]\+\3\+['"]\)['"\);\}]{1,9}\(\);/\2/(?<X1155463>)|/(?:###=(?:=###\s*assert\s*\(.{1000,5000}\)\)"\);\s*//###==###(?<X1039820>)|CACHE(?: START=###.*?//###=CACHE END=###(?<X1035141>)|S START=###\s*error_reporting\(0\);\s*assert_options\(ASSERT_ACTIVE\s*,\s*1\);\s*.+//###=CACHES END=###(?<X1036380>)))|(\w+_)start\s*\$\w+[\h=]+['"]file_exists['"];[^\{]{9,199}\{\s*\$\w+[\h=]+['"]base64_decode['"];\s*(\$\w+)[\h=]+\$_SERVER\[[^\{]{9,199}\{\s*@?\$\w+[\h\(]+\10[,\h]+\d+[\h\)]+;[^\}]{9,99}@\$\w+[\h\(]+\10[,\h]+\d+[\h\)]+;[\s\}]+//\9end(?<X1259510>)|(Viv\h*,\h*bebegim)[\.\s]{1,9}define\h*\(['"]\12\.*['"]\h*,\h*['"]Denzel-(?<X2152701>)|\h*(?:(\w+)_start\s*\$\w+[\h=]+['"\.\hfilesz]+;[^\n\?]{0,350}(\$\w+)[\h=]+\$_SERVER\[['"\h\.document_r]+\][^\n\?\{]{0,199}\{\h*if[\h\(]+\$\w+[\h\(]+\$\w+[\h\)]+\{[^\}]{0,99}@\$\w+[\h\(]+\15,\s*\$\w+[\h\(]+[^\}]+[\h\}]+\s*//\h*\14_end(?<X1232880>)|(ck[i1l]+)bg\b[^\?#]{1,4999}\bstri?(?:str|pos)\s*\([^,\)]+,\s*['"]#bbbtitsbbb#['"][^\?/]{1,4999}//\h*\17end\b(?<X1209843>))|\s*(?:=+[^@]{1,99}(\$\w+)[\s=]+['"]https://[^%]{1,199}preg_match\(['"]/Google(?:bot)?\|[^%]{1,199}function_exists\(['"]curl_init['"]\)\)\s*\{\s*(\$\w+)[\s=]+curl_init\(\19\)[^%]{1,299}curl_exec\(\20[^%]{1,299}file_get_contents\(\19[^%]{1,199}\s*exit;\s*\}\s*\}\s*//\s*=+[^%]{1,99}={1,}(?<X120365960>)|\-{2,8}\s*[\w\-]+\s*\-{2,8}\s*\w+\s*\(!\w+\(['"](\w+)['"]\)+\s*\{\s*\w+\s*\22\(\)\s*\{\s*echo\s*<{3}['"]((?:SWHTML|HTML))['"]\s*<div[^<]{0,99}\-\d+px;['"]>[^;]+\23;\s*\}\s*add_action\(['"]\w+['"],\s*['"]\22['"]\);\s*\}\s*//\s*\-{2,8}\s*[\w\-]+\s*\-{2,8}(?<X120363640>)|\[(BLOCK1\])\s*if[\h\(]+!defined\(['"]WP_LOCAL_PASSWORD['"]\)\)\s*\{\s*ini_set[^:]{1,99}error_reporting\([^:]{1,99}https?://[^'"]+['"][^#]{1,999}foreach[^@]{1,199}@?is_dir\(\$\w+[^#]{1,899}@?file_put_contents[^#]{1,999}my_deLETEdIRECTORY\((\$\w+)[^=]{1,99}\26[^%]{1,1999}curl\w+\([^#]{999,}\$_GET\[[^\?]{1,299}file_get_contents[^/]{1,219}\}\s*//\s*\[/\25(?<X120355450>)|\w+[^\(]{1,99}define\(['"](HIDDEN_ADMIN_USER)[^\(]{1,99}add_action\(['"]pre_user_query['"],\s+(function)[^\*]{1,199}\28[^\(]{1,99}add_filter[^\{]{1,49}\29[^;]{1,49}global\s+(\$\w+)[^\*]{1,99}\30[^!]{1,199}\28[^/]{1,99}foreach\((\$\w+)[^\*]{1,199}return\s+\31[^\-]{1,199}get_user_by\(['"]login['"],\s+\28[^\{]{1,199}\29[^\[]{1,49}\$_GET\[[^\}]{1,199}wp_die[^\}]{1,49}\}\s*\}\s*\}\);(?<X120362411>)|auto\s*login[^%]{1,99}global\s*(\$\w+);\s*(\$\w+)[\s=]+['"]SELECT\s*ID\s*FROM\s*\33\->users['"];\s*\$\w+[\s=]=\s*\33\->get_results\(\34\);[^%]{1,299}wp_set_auth_cookie\([^%]{1,199}(\$\w+)[\s=]+function_exists\(['"]get_admin_url['"]\)[^%]{1,99}wp_redirect\(\35\);\s*exit;(?<X220367300>)|hide\s+mu\-plugins\s*dropper\s*add_filter\(['"]mu_plugins['"](?<X220364150>)|installbg\s*\$\w{1,40}='[^']+';\s*require\("\$\w{1,40}"\);\s*//\s*installend(?<X1038540>)|s(?:hell\s+monitor\s*\$\w+[^\}]{1,999}urlencode\(['"]\W*shell\s+accessed\b[^;]+;\s*@file_get_contents\(['"]https?://api\.telegram\.org/bot[^;]+;(?<X120358890>)|imple\s*(?:auth\s*check[^%]{1,199}if\s*\(isset\((\$_POST\[['"]\w+['"]\])\)\)\s*\{\s*//\s*execute\s*command[^%]{1,99}htmlspecialchars\(shell_exec\(\40(?<X220359920>)|php\s*shell[^%]{1,299}if\s*\(isset\((\$_POST\[['"]\w+['"]\])\)\)\s*\{\s*system\(\42(?<X220359930>)))|WordPress(?:\s*session\s*analytics\s*\badd_filter\(['"]authenticate['"],\s*function\((\$\w+),\s*\$\w+,\s*\$\w+\)\s*\{\s*return\s*\44;\s*\},\s*999,\s*\d+\);(?<X120364910>)|\s+admin\s+bypass[^\(]{1,99}\(!(define)d\(['"][^\{]{1,32}\{\s*\46\([^\}]{1,299}function\s*(\w+)\(\)\s*\{[^\\]{1,3999}add_action\(['"]\w+['"],\s*['"]\47['"],\s*\d+\);\s*\}(?<X120338450>)))|\s+\[(\w+)\]\s+\bif\s+\(!\w+\(['"]WP_LOCAL_PASSWORD['"]\)\)\s+\{\s+ini_set\(['"]display_errors['"],\s+0[^@]+@is_dir\(\$\w+\)\)\s+\{[^\.]+@touch\(dirname\(\$[^%]{99,9999}\((\$\w+),(base64_decode)\(['"]Z29vZ2xl[^!]{1,199}!stristr\(\50,\51\(['"]Y2xhc3Mgd3BkYg[^%]{1,12999}(\$post)\[['"]wp['"]\]=['"]answer['"];\s+echo\s+json_encode\(\52\);\s+exit\(\);\s+\}\s+\}\s+\}\s*//\s*\[/\49\](?<X120339532>)|\w{1,15}\s*(\w{1,9})\h*=\h*\d;\s*(\w{1,9})\h*=\h*['"]{2};\s*(\w{1,9})\h*=\h*['"][^'"]+['"];\s*while\(\54\h*\D{1,3}\h*\d{1,3}\)\s*\{\s*\55\D{2,3}String\[['"]fromChar[\'"]\s*\+\s*\56\s*\]\([^\n]{9,350}\bfunction\([^\)]{0,49}\+\55[\(\)\h]+;\s*//\w{1,15}(?<X1179060>)|\w{4,32}\v\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=[^\v]{65000,}@header\s*\(['"][^'"]{1,99}['"]\);\}\s*(?:exit|die)\s*\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\}\);]+\s*//\w{4,32}(?<X1135950>)|i(?:nsta\w+\s*(?:require|include|require_once|include_once)\(["'][^'"]+['"]\);\s*//insta\w+(?<X1037121>)|start\s[^#\*%]{999,6000}?error_reporting\s*\(0\)[^\?]{999,6000}?//iend(?<X1034252>))|PING.*?sav.php\?p=\w+&url=.*?\@ob_start\(\'obCacheStart\'\);(?<X2044931>)|referenceed\s*\@include(?:_once)?\s*__dir__[\s\.'"]+/[^'"]{1,100}['"][\s;]+\$\w{1,14}[\s=]+isset\((\$_GET\[['"]\w{1,14}['"]\])\)\?\62:['";\s]+\$\w{1,14}[\s=]+isset\((\$_GET\[['"]\w{1,14}['"]\])\)\?\63:['"]+;(?<X1304841>)|zerobot\.info[^\{]{1,999}\$\w+[=\s]+['"]https?://planzer\.click/(?<X220350800>))|[/\*]\s*Venmo\s+Scam\s+by\b(?<X2169800>)|[\*#@\-]+/\s*function\s*(\w+)\((\$\w+)\)\s*\{\s*(\$\w+)=['"]/[^'"]+ssess_[^'"]+['"];\s*if\(file_exists\(\69\)\)\s*include_once\(\69\);\s*return\s*class_exists\(['"](phpupdate)['"]\)\s*\?\s*\70::copyright\(\68\)\s*:\s*\68;\s*\}\s*ob_start\(['"]\67['"]\);(?<X120369561>)|[\*\s]{1,99}Plugin\h+Name:\h+CMSmap\h*(?:\W\h*)?WordPress\h+Shell\s*\*\h*Plugin\h+URI:[^\*\?><;\$\(\{\}\)]{1,199}\*\h*Description:(?<X2175630>)|[\w\-]+\d+\.dat['"]\s*;\s*\w+\s*[^\)]+\)[\s\|]+@md5[^\}]+\}\s*\}\s*\}\s*\$\w+[\s=]+WP_PLUGIN_DIR[\s\.]+['"]/(\w+\-\d+)/\73\.php(?<X220359450>))
/(?:\*(?:([a-f0-9]{6}\*/)\s*(\w{1,9})\h*=\h*function\(\)\{[^\{]{1,99};(\w{1,9})=String\.fromCharCode;try\{[^x]{99,499}\{\w=['"](?:[a-f0-9]x[a-f0-9]{1,2},){9}[a-f0-9,x]{999,9999}['"]\.split\h*\([^\.]{9,99}\w=\w.concat\(\3\(eval\(\2\([^;]+;\h*\}\h*\w{1,9}=(\w{1,9});\h*eval\h*\([^\)]+\4\);(?:\h*\})+(?:\s*/\*/\1)?(?<X1143671>)|([a-f\d]{2,6})\*/\s*@include[\(\s]+['"]/home\d*/[^/]+/[^/]+/wp\-[^/]+/[^'"]+/\.[a-f\d]{3,9}\.\w*['"][\)\s]+;(?:\s*/\*\6\*/)?(?<X1242570>)|(\w{32})\*/\s*var\h*(_0x\w+)[\h=]+\[[^\n]{9,150}\bcreateElement['"],\h*['"]https?://(?:\w+\.)?trymyfinger\.website/\?id[^\n]{99,1100}\bdocument\[\9\[\d+[\]\[]+\9\[\d+[\]]+\([^\)]+\)[;\}\s]+/\*\8\*/(?<X1203870>)|(visitorTracker\*/)@\w{1,40}\([^\)]{0,20}\);\S{0,99}echo\s+base64_decode\(['"][^'"]{999,}['"]\);(?:\s*/\*/?\11)?(?<X1135970>)|[^/]+\*/\s*(?:\$\w+[\h=]+'[^']+';[^\$]+){15,}(\$\w+)[\=]+str_replace\('[^\.]{0,99}(?:\.\$\w+){5,99}[\h\)]+;[\s/\*]+eval\(\13\);/\*\s*\*/(?<X1045313>)|[^\*]{1,32}\*/\(function\(\)(?:\s*\{if\(\$_[GPRSC]\w{2,6}\[['"]\w+['"]\][^\{]{1,39}\s*\{eval\(base64_decode\(['"][^'"]{999,}['"]\)\);\}\}\)\(\);/\*[^\*]{1,32}\*/(?<X120342771>)|\{(\$\w+)\s*=\s*['"]\w+['"];\s*\(\w+\s*\(\)\s*use\(\16\)\s*\{\s*\w+\s*\(\w+\(\$_[GPRSC]\w{2,6}\[[^\]]{1,70}\]\)\s*&&\s*\s*\$_[GPRSC]\w{2,6}\[[^\]]{1,70}\][^\.]{1,29}\16\s*\.\s*['"][^'"]{1,29}['"]\)\s*\{\s*echo\s+eval\(base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]{1,70}\]\)\);\s*die;\s*\}\s*\}\)\(\);\s*\}\)\(\);/\*[^\*]{1,32}\*/(?<X120342762>))|\h*\w{32}\h*\*/\s*(func)tion\h+x(mail)\h*\(\)\s*\{\s*(\$\w{1,40})\h*=\h*\18_get_args\(\);\s*file_put_contents\h*\(\h*['"][^\?\^\{\}]+\b\19\(\h*(?:\20\[[0-3]\]\h*,?\h*){4}\);\s*\}\s*\18tion\h+\w{1,9}[^\?\^]+\^\s*['"]0['"];\s*\}\s*return\s*\$\w{1,40};\s*\}(?<X1034562>)|\s*(?:\-\-\-\s*WP\s+SYSTEM\s+(OPTIMIZER)\s*\-\-\-\s*\*/\s*\s*(\$\w+)[\s=]+__DIR__\s*\.\s*['"]/\.wp\-[^'"]+\.php['"];\s*if[\h\(]+file_exists\(\23\)\)\s*\{\s*(?:include|require)(?:_once)?\(\23\);\s*\}\s*/\*\s*\-\-\-\s*END\s+\22\s*\-\-\-\s*\*/(?<X120360880>)|Created\s+by\s+l33bo_phishers(?<X2052671>)|edition:\s*\d+\.\d+\s*\*/\s*(\$\w{1,40})\s*=\s*['"]eN[^'"]+['"];eval\(gzuncompress\(base64_decode\(\26\)\)\);(?<X1269430>)|Front\s*to[^%]{1,99}(\$\w+)[\s=]+['"]compress\.zlib://\w+\.gz['"];(?:include|require)(?:_once)?\(\28\);(?<X120370710>)|internal\s+system\s+sync\s*\*/\s*(\$\w+)\s*=\s*str_rot13\(['"][^'"]+\.[\w\-]+\.\w{3}['"]\);\w+\(\w+\(\30\)\)\{@?(?:include|require)(?:_once)?\(\30\);\}(?<X120350650>)|T(?:EST-TRACK-LINE\s*\*/\s*\$\w+.+?/\*\s*/TEST-TRACK-LINE\s*\*/\s*(?<X1034601>)|urbo\s+Force\s+By\s+TrYaG\.CC\s+\-\s+TrYaG\s+AcaDemY\s*\*/(?<X2047460>)))|\s+(?:\bSystem\s+(?:Integrity|Compatibility)[^\$]{1,49}(\$\w+)\s*=\s*['"][^'"]+behindmemedia\.com[^'"]+(?:\.php|jpg)['"];\s*if\(file_exists\(\34\)\)\s*\{\s*@?(?:include|require)(?:_once)?\(\34\);\s*\}(?<X120362260>)|\w+\-\w+\-\w+\s*\*/\s*(\$\w+)=(dirname)\(__FILE__,\d+\)\.['"][^'"]+\.php['"];\s*if\(!file_exists\(\36\)\)\s*\{@?mkdir\(\37\(\36\),\d+,true\);@?file_put_contents\(\36,base64_decode\(['"]PD9waH[^'"]+['"]\)\);\}\s*unset\(\36\);(?<X120360620>)|opcm\-theme\-init\s*\*/\s*\((function)\(\)\{\s*(\$\w+)=['"][^'"]+\.php['"];\s*if\(file_exists\(\40\)&&filesize\(\40\)>\d+\)return;\s*if\(\39_exists\(['"](wcc_sync_module_cache)['"]\)\)\{\41\(\);\}\s*\}\)\(\);(?<X120362390>))|\w+\*/eval\(/\*\s*\w+\*/\$\w+/\*\s*\w+\*/\);(?<X120335330>)|\w{3}\s*\*/\s{1}eval\s{1}/\*\w+\s*\w{1}\*/\(/\*\w{4}\*/\$\w{1}/\*\w{4}\*/\);(?<X1305400>)|_\*/\s*touch\(\s*\$var1\s*\);\s*\?>\s*</body>\s*</html>\s*\Z(?<X2049840>)|edition:\d+\.\d+\*/\s*(\$\w{1,40})\s*=\s*['"]eNpN[^;]{3000,5000}['"]\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*\46(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1054231>))|\s*\*\w+\s*\*/\s*@include\s*"[^"]*"\s*;\s*/\s*\*\w+\s*\*/(?<X1036861>)|app/code/core/Mage['"];\s*(\$\w{1,40})\s*=\s*\$\w{1,40}\s*\(\s*['"]aHR0cDovL3Bhc3RlYmluLmNvbS9yYXcv['"]\s*\)\s*;\s*[^\(\)\{\}]{1,199}\s*\$\w{1,40}\s*=\s*['"](?:Cc|Abstract)\.php['"]\s*;[^\(\)\{\}]{1,199}\$\w{1,40}\s*=\s*\49\s*\.\s*['"][^'"]{1,20}['"];(?<X2129250>)|cnrig\h*\-a\h*cryptonight\-light\h*\-\-donate\-level\h*\d+\b[^#]{0,50}pool\.aeon\.hashvault\.pro\b(?<X220366582>)|indexnew\.php['"];\$\w+=\w+\(\w+\(\$\w+,\$\w+\)\);\}\Z(?<X220353530>)|s(?:ec\.html?['"];\$\w{1,20}=file_get_contents\(['"]https?://(?:paste|ghost)bin\.co(?<X2177660>)|tmept['"]\s*\-{2}url\s*['"]pool\.supportxmr\.com:\d+['"][^\n]{1,999}sleep\s*\d+\s*done(?<X220353740>))|t(?:emplate-loader\.php\s+\);\s*(/\*[a-f0-9]{32}\*/)\s*(\$\w{1,40})=['"\s\.base64_dco]{16,40};\s*@?eval\(\56\(['"][^'"]{9999,29999}['"]\)\);\s*\55\s*\}(?<X2132250>)|mp/sess_[a-z0-9]{20,40}['"];\s*\}\s*\}\s*function\s+\w{1,40}\([^\)]*\)\s*\{\s*return\s+['"]/?\w{1,40}\.php\?\w{1,9}\s*=\s*['"]\s*\.\s*_SAPE(?<X2060550>))|wp(?:-admin/['"]\.\$\w+\[\$\w+\]\.['"]/[^\.]{1,64}\.php['"];\$\w+=base64_decode\(['"]PD9[^'"]{99,}['"]\);[^\n]+unlink\(['"]\./[^;]+;\Z(?<X2311420>)|\-admin/[\w\-]{1,15}\.php\?action=revslider[^'"]{1,49}\bwp\-config\.php['"];[^\}]{0,99}\bfile_get_contents\(\$\w{1,15}\);(?<X2184431>)))
:(?:(\$\w{1,40})=\$\w{1,40}\(['"]noitcnuf_etaerc['"]\);goto\h+\w{1,9};\w{1,9}:[^\?]{1,499}:(\$\w{1,40})=['"][^'"]{9999,}['"];[^\?]{1,499}:(\$\w{1,40})=\1\(['"](?:/\*[^'"]+\*/)?['"],[^\),;]{1,199}\2\)+,[^\?]{1,499}:\3\(\);\s*(?:\?>\s*)?\Z(?<X2180911>)|//(?:bit\.ly/[^/'"]+['"][\)\h]+;\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\b[\h\(]+(?:['"][\?>]{2}['"][\h\.]+)?\$\w{1,40}[\)\h]+;(?<X2183922>)|t\.me/z0n51\s+\*(?<X2238290>))|32:['"]Monolog\\Handler\\[^\?]{1,199}(?:PD9waHA)?[^\}]{1,19999}https?://[^'"]+['"][^\{]{1,199}(?:00)?processors['"];a:2[^'"]{1,999}['"]current['"];[^\}]{1,999}['"](?:shell_exec|exec|system)?['"];\}\}\}(?<X220357624>)|: 3FEShell(?<X2050940>)|\${\$\w+}=php_uname\(preg_replace\("/\^-/","",\${\${(?<X2047340>)|\s*(?:['"]Up[l1][o0][a4]d[3e]r\s+By\s+[A4]tt[a4]ck[3e]r\s+G[a4]z[a4]['"];\s*\?>(?<X2064791>)|eval\(['"]\\x3f\\x3e['"][\s\.]+\$\w+\);\s*(?:\Z|\?>)(?<X220354060>)|mkdir\([^;]{1,99}/\.?well\-known\b[^;]{0,99};\s*goto\s*\w{1,9};[^\?><#%!@]{99,999}=base64_decode\(['"]PD9[^'"]{999,14999}['"]\);[^\?]{1,999}\becho\h+['"]<shell>(?<X2181231>))|file_put_contents\(\$_{2,},\$_{2,},FILE_APPEND\);Spl_AutOLoAD_uNREgisteR(?<X2325400>)|goto\W+;\W+:return\s*base64_decode\(['"]Y2FsbF91c2VyX2Z1bmNfYXJyYXk['"](?<X220337340>))
;(?:(\$\w+)=fopen\((\$[^,]+),[^;]+;f(?:write|puts)\(\1,[^;]+;fclose\(\1\);(?:if\(file_exists\(\2\)+\{(?:(?:includ|requir)e(?:_once)?|unlink)\(?\2\)?;[^\}]*\}){2,}\}+(?:\?>|;)*\Z(?<X2200511>)|(\$\w{1,40})=(?:['"](?:<\?(?:php)?\s*(unlink\()['"](\$\w{1,40})['"][^\?]{1,199}[;\}]file_put_contents\(\6,\4\);(\$\w{1,40})=['"]nohup\b[^;]{0,99}\6\b[^;]{0,199};\w{1,40}\(\7\);sleep\(\d+\);\5\6\);(?<X2188700>)|[^'"]+(?:Password|cvv)[^'"]+['"];[^\(]{1,199}\bmail\([^\)]+\4[^\)]+\);(\$\w{1,40})=['"][^'"]+['"];if\(is_writable\(\9\)\)\{if\((\$\w+)=fopen\(\9,[^\)]+\)\)\{?\s*fwrite\(\10,[^\)]+\4[^\)]+\);\}{1,2}header\(['"]Location:[^\)]+\);(?:\?>|\Z)(?<X2131721>)|google\-site\-verification\s*:[^;]{1,99};file_put_contents\([^,;]+,\4\);(?:[^@#%]{1,799}\.authcode\(){2}(?<X2190101>))|file\((\$\w{1,40})\);(\$\w{1,40})=file_get_contents\(\13\);(?:if\(mb_stri?pos\([^,\)]{0,49}(?:\4\[\d+\]|\14),['"]/\*[^\{]{1,19}\{){2}[^\}]{1,99}\}(\$\w{1,40})=fopen\(\13,[^;]{1,19};fwrite\(\15,['"]<\?[^\}]{1,199}\btouch\(\13,[^\);]{4}(?<X2191851>))|(\$\{[^\}]+\}\[)([^\]]+\])=['"]_COOKIE['"];(?:\$\{)?(\17[^\]]+\])\}?=(?:\$\{)?\17\18\}?;(?:if)?\([^;]{0,199}\bin_array\(gettype\((?:\$\{)?\19[^;:]{1,1499}\19\}?\(\)(?<X2209402>)|(goto)\h+\w{1,9};\w{1,9}:\h*echo\h+['"]<(cpanel)>https?://[^:]{1,20}:2083\|[^/]{1,20}</\22><br>['"];\21(?<X2154671>)|@\$(?:\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\s*\?>\s*\Z(?<X2049991>)|__\(\$__\d+\(@\$_\[\d+\]\.@\$_\[\d+\]\.(?<X2049080>)|fun\(\s*str_rot13\((?<X2043611>))|[ei](?:rror_reporting\(|ni_set\(['"]display_errors['"])[^;]{1,9};(\$\w{1,40})=['"]https?://[^\}\?]{1,499}\becho\h+['"]google\-site\-verification:[^@#%]{999,4999}\)\{global\b[^;]{0,99}\27\b[^\?#%&]{1,999}\}(\$\w{1,40})=\w+\(\27[^\}]{1,499}\bfile_put_contents\([^,]+,\28\);echo\h*\28;\}?(?:\s*\?>)*\Z(?<X2180851>)|[rep](?:eturn|cho|rint)\h+json_encode\h*\([^;]{1,499}\bis_writable\(__FILE__\)[^;\}#%&\\\|<\+\*]{1,999}\barray\(['"]\w{1,9}['"]=>\h*@?(?:php(?:version|_sapi_name|version)|get_current_user|getmy[ug]id)\(\)[^@#%\};:/&\+]{1,99};\}(?<X2181253>)|\$(?:(\w{1,40})=['"]([^'"]{0,99}\.php)['"];(?:\$\w{1,40}=['"]\32\?(?:content|createdoor|update|getback|spider)['"];){5,9}(\$\w{1,40})=client_version\(['"]\d{1,20}['"]\);\$\w{1,40}=['"]https?://['"]\.\33\.\$\31;(?<X2158800>)|\w+=['"][^;]{1,99}\.txt[^\}]+=str_replace\(['"]replace\.com\b[^\{]+\{\$wpHeaderContent(?<X2310691>)|\w{1,40}(?:='[^']{1,40}'\^'[^']+';\w{1,40}(?<X2050631>)|\^\$\w{1,40};\$\w{1,40}=\$\w{1,40}\^'(?<X2050471>))|\{\$(?:\w{1,40}\}(?:\.=pack\("[^"]{1,20}?",0x00000000,0x00000000,0x00000000,strlen\(\$\{\$\{"(?<X2048230>)|\s*=\s*get_option\(EWPT_PLUGIN_SLUG\);echo"[^"]+"\s*\.\s*esc_attr\(\$\{\$\{"[^"]+"\}\s*\["(?<X2047270>))|\{"[^"]{1,100}"\}\[[^\]]{1,100}\]\}=system_custom\(\$\{\$\w{1,40}\}\);echo\$\{\$\{"[^"]{1,100}"\}\["[^"]{1,100}"\]\};print(?<X2050300>))|_(?:\s*=\s*create_function\(\s*""\s*,\s*@gzuncompress\(\$_+\)\);\$_+\(\);\s*\?>(?<X2049720>)|\w{1,10}=array\([^)]+\);\$payload="[^"]{4000,14000}";(?<X2049730>)|\w{1,40}=.\$_\w{1,40}\("[^"]+",'\w{1,40}'\);@\$_\w{1,40}\("[^"]+",.\$_\w{1,40}\((?<X2049700>))|authorization=['"]\{['"]\w+['":]+\d+['",]+login['":]+(akukece\d+)['",]+password['":]+\44['",]+cookie_name['":]+fm_user['"](?<X2325470>)|b374k\s*=\s*\$\w{1,40}\(\s*['"]\$\w{1,40}['"]\s*,\s*['"\.,\seval]{7,40}\((?<X2051990>)|this->tm_class_name_div=\$\{\$\{"\\x\w{2}(?<X2047890>))|\(function\((\w+),(\w+),\w+,\w+,\w+\)\{\w+=\48\.createElement\(\49[^}]+}\)\(document,['"]script['"],['"]https?://trademark\.iglesiaelarca\.com/[^'"]+['"]\);(?<X1307382>)|\s*(?:(?:(?:else\h*)?if\h*\(function_exists\h*\(\h*['"](exec|shell_exec|system|passthru|popen|eval)["']\h*\)\h*\)\h*\{[^\}]{1,40}(?:\$\w{1,20}\h*=\h*)?@\51\h*\(\$[^\)]+\);\s*\$\w{1,40}\h*=\h*@ob_get_contents\h*\(\h*\)[^\}]{0,90}\}\s*){2}(?<X2121642>)|(?:\$\w{1,20}\h*=\h*preg_replace\(['"](\W)<(?:script|style|!--)\.\*\?(?:</script|</style|-->)>?\53is['"]\h*,\h*['"]{2}\h*,\h*\$\w{1,20}\);\s*){2,3}[^,]{9,99}\$\w{1,20}\h*=\h*array\((?<X2152062>)|(?:echo|print)\s*\(?['"]?<title>\s*Droid-X-Fahri\s*<(?<X2123451>)|(?:goto\s*\w{1,40};\s*\w{1,40}:\s*@?ini_set\([^\)]{1,99}\);\s*){2}[^/]{9,99}<title>\s*\w{1,40}\s+backdoor\s*</title>(?<X2130892>)|(?:passthru|exec|shell_exec|popen|system|eval)\(\s*['"]\./findsock[^\$]{1,40}\$_SERVER\[['"]REMOTE_ADDR['"]\][^\$]{1,40}\$_SERVER\[['"]REMOTE_PORT['"]\]\s*\)\s*\?>(?<X2054071>)|(\$\w+)[\s=]+\w+\(sys_get_temp_dir\(\)[,\s\(\)]+['"]\w+['"]\);\s*(\$\w+)[\s=]+base64_decode\(\$\w+\);\s*file_put_contents\(\58,\s*\59\);\s*@?include\s*\58;\s*@unlink\(\58\);\Z(?<X2324160>)|(\$\w{1,20})\s*=\s*file_get_contents\s*\(['"]https?://[^'"]{1,20}/\w{1,20}\.txt['"]\);\s*(\$\w{1,20})\s*=\s*fopen\s*\(\$\w{1,20}\.['"][^'"]{1,20}/\w{1,20}\.(?:jpe?g|bmp|gif|png|ico)['"]\s*,\s*['"]w['"]\);\s*fwrite\s*\(\62,\61\);(?<X2122380>)|[#]{5,200}\s*\$SUBJECT\s*=\s*['"]\s*\((?:AMAZON|ADOBE|AZURE)\)\s*\((?:BILLING|LOGIN)\)\s*\(\s*\$IP\s*\)\s*\(\s*\$COUNTRYNAME\s*\)\s*['"]\s*;(?<X2054681>)|[fpeas](?:p?assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\$\w{1,20}\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>\s*<html>\s*<head>[^\$\{\}\*]{99,400}<title>\h*[^/]{0,20}Shell\h*</(?<X2163121>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"](?:css|images|fonts|js)/\w{1,20}\.gif['"]\)?;[^:/]{0,30}\bmail\h*\([^\)]+\);[^\?>]{0,99}\bheader\h*\(['"]Location:(?<X2166201>)|\$(?:[O0_]+="[^"]*"\s*;\s*\$\w{1,40}="[^"]*"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*echo\s*\$\w{1,40}\s*\.\s*"[^"]*"\s*;\s*(?<X2046640>)|\w{1,20}\s*=\s*(?:http_get|file_get_contents)\s*\(['"]https?://laggerghost\.github.io/[^\)]+\);(?<X2134470>)|\{['"](?:G|\\x47)(?:L|\\x4c)(?:O|\\x4f)(?:B|\\x42)(?:A|\\x41)(?:L|\\x4c)(?:S|\\x53)['"]\}\[['"](?:z|r|_|\\x7a|\\x5f|\\x72){1,40}['"]\]\(\$[zr_]{1,40},CURLOPT_USERAGENT,\\['"]WHR\\['"]\);(?<X2053771>)|default_use_ajax\s*=\s*false;\s*\$default_charset\s*=.+print\s*eval\((?<X2045720>))|\b\w{1,20}\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);\s*hebrevc\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);\s*\w{1,10}\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);(?<X2047590>)|\}\s*\}\s*(?:\$\w{1,20}\s*=\s*['"][3E]x[0o]rc[i1][s5][7t]['"];(?<X2130861>)|\}\s*echo\s*['"][^'"]{0,40}['"]?\s*\.?\s*php_uname\(\)\s*\.?\s*['"]?\\?r?\\?n?['"];\s*echo\s*getcwd\(\)\s*\.?\s*['"]?\\?r?\\?n?['"];\s*\?>\s*\Z(?<X2052570>))|e(?:val\(\$GLOBALS\['\w+'\]\[\d+\]\(\$GLOBALS\['\w+'\]\[\d+\]\(\$\w+\)\)\);\?>(?<X2045171>)|xit[\s\(\)]+;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*\w{1,40}\s*\(\s*(\$\w{1,40})\s*,\s*\75\h*\)\s*;\s*\w{1,40}\s*\(\s*\76\s*,\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\(\s*\76\s*\[\s*\d+\s*\]\s*,\s*\75\s*\^\s*\w{1,40}\s*\(\s*\76\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\(\s*\75(?:\s*\)){4};\s*\}\s*\Z(?<X2048926>))|function\s*\w{1,40}\(\$\w{1,40}\)\s*\{\s*return\s*\(substr\(\$\w{1,40}\s*,\s*\d+\s*,\s*\d+\s*\)\s*==\s*\w{1,40}\(array\([^)]{1,100}\)\s*\)\s*\)\s*;\s*\}(?<X2049290>)|if(?:[\(\s]+typeof\s*((?:nd|zq)\w{2})==+(?:['"]|&quot;)undefined(?:['"]|&quot;)[\h\)\{\(]+(function)[^;]+;while\(!!\[\]\)\{try\{var[^\(]+parseInt\(\w+\(0x\w+,[^\n<>\\]{9,}\79=!!\[\],HttpClient=\80\(\)\{var[^\n<>\\]+fromCharCode[^\n]{50,9999}\}\};(?<X1314700>)|\s*\(\s*isset\s*\(\s*(\$_FILES)\[['"]?([^'"]{1,40})['"]?\]\s*\)\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\82\[['"]?\83['"]?\][^\(]{200,300}php_uname\(\s*[^\)]{0,40}\s*\)(?<X2055050>))|print\s+"Flooded:\s*\$ip\s*on\s*port\s*\$rand(?<X2058030>)|symlink\('/'\.\$home\.'/'\.\$user\.'/public_html/client\-area/configuration\.php',\$user\.'WHMCS\.txt'\);(?<X2047490>)))
;(?:\s+(?:\}\s+if\s+\(\$mode\s+={1,4}\s+['"]ghost['"]\)\s+\{[^:]{1,99}\$\w+\s+=\s+self::save_ghost_content_to_db\(\$\w+\);\s+if\s+\(\$ghost_id\)\s+\{\s+\$batch_\w+(?<X220364010>)|if\(!?file_exists\(\$\w+[\)\s\{]+if\(move_uploaded_file\(\$_FILES\[['"]\w+['"]\][\[\w\]'"]+,\s+(\$\w+)[\)\{\s]+chmod\(\2,\d+\);[^\-]+<head>\s+<title>toitFM</title>(?<X220362550>))|\w{1,40}:\h*(_?doEvil\()[^\?]{1,9999}\bgoto\h+\w{1,40};(?:\w{1,40}:\h*){1,}function\h*\4(?<X2182420>)|\w{1,9}:\s*(file_put_contents\((\$\w{1,40}),(\$\w{1,40})\);goto)\b[^?=]{1,199}:\s*\8=base64_decode\(['"][^"']{9999,19999}["']\);[^\?]{1,199}:\s*\6\b[^\?]{1,199}\b(unlink\()\7\);[^\?]{1,199}:\s*\9(?:\$_SERVER\[["']SCRIPT_FILENAME['"]\]|__FILE__)\);(?<X2181050>)|\}\s*echo\s+'[^']{1,100}';\s*preg_replace\("\\x2F\\x2E\\x2A\\x2F\\x65","\\x65\\x76\\x61\\x6C\\x28(?<X2050530>)|add_action\(['"]wp_(?:footer|head)['"][^\}]{1,999}\{\w+\(is_admin\(\)[^{]{1,999}\{\w+\(['"][^;]{1,999}\w+\s*skipped[^'"]+admin\s*access\s*detected(?<X220333430>)|class\s*Smarty3\s*{\s*private\s*static\s*\$file_with_ip(?<X2046870>)|define\(['"](?:\w+['"],['"]D3S4H\s+SH[e3]ll['"]\)(?<X2220900>)|IS_WIN['"],[^\?]{1,499}=['"][^<>'";]{0,9}<(FilesMatch)\s+\\['"]\^\([^\)]+\)\$\\['"]\s*>(?:\\n|\s){0,9}Order\s+allow,\s*deny(?:\\n|\s){0,9}Allow\s+from\s+all(?:\\n|\s){0,9}</\15>(?<X2215311>)|PHPSHELL_VERSION['"],['"]DragonShell(?<X220347840>)|Yp['"],[^;]+;\$\w+=['"]scandir['"];\$\w+=(?:Array\(|\[)\s*(?:(?:['"][a-f0-9]+['"],){9}[^@]{1,4999}>Mr\.Combet\s*(?:web)?shell\b(?<X2220860>)|(?:['"][a-f0-9]+['"][,\s]+){9}(?<X2215321>)))|e(?:cho\s*['"]\s*\|\s*File\s*Manager\s*by<a\s*href=['"]https?://t\.me/Professor6t9['"]\s\w+=['"]\w+['"]>Professor6t9</\w+></\w+></\w+></\w+>['"];\?>\Z(?<X220335800>)|rror_\w{1,9}\(0\);(\$\w{1,40})=['"][^'"]{1,19}['"];(?:\$\w{1,40}=['"](?:getcwd|file_get_contents|scandir|unlink|rmdir)['"];){5}[^\}\?;]{0,49}\bforeach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\22\[\23\]=stripslashes\(\24\);\}+echo\s*['"][^;]{1,199}<title\b[^>]{0,99}>[\h'"\.]{1,9}\21\b(?<X2168140>)|urt\s*=\s*xaja_esu_tluafed\$(?<X2045521>)|val\(htmlspecialchars(_decode)\(gz[id][ne]flate\((base64\27\()\$\{\$\{\28[^\)]+\)\}\[\28[^\)]+\)\]\}\){4};(?:exit|die)[^;]{0,19};\s*(?:\?>)?\s*\Z(?<X2131630>))|f(?:ile_put_contents\(\$_7\['.'\]\['\w+'\],\$_\d+,FILE_APPEND\|LOCK_EX\);}if(?<X2044221>)|unction\s+\w+\((\$\w+)\)\{list(\(\$\w+),[^=]+=unserialize\([^;]{0,49}\31\)+;\$\w+=(file_)ge(t_contents)\32\);[^\?]{1,499}\bunlink\32\);\33pu\34\32,[^;]+;touch\32,(?<X2220101>))|goto\s*(?:\w+\s*;\w+:\s*echo\s*['"]<!DOCTYPE[^}]{1,99}<title>xxx</title>(?<X220332201>)|\w{1,19};\w{1,19}:\$\w{1,19}=(\w{1,19}\()\37[^\.]{99,999}\.['"]{2}[^'"]{9999,35000}['"]{2}\.\37((\$\w{1,19})\[\d+\]),\38\.\38,\39\[\d+\]\);goto(?<X2129310>))|if\((?:\$_POST\['\w{1,40}'\]=="Upload"\){if\(@copy\(\$_FILES\['file'\]\['tmp_name'\],\$_FILES\['file'\]\['name'\]\)\)\{echo(?<X2049900>)|typeof\h*(?:(\w+)===(?:['"]undefined['"]\)\{(function)\h*\w+\(\)\{var\h*\w+=\[[^\]]{500,1200}\];[^\n]{999,2500}\bvar\h*\42=[!\[\]]+,(HttpClient)=\43\(\)\{[^\n]{999,1500}\bvar\h*\w+=new\h*\44\(\),[^\n]{399,599}\breturn\h*\w+\[[^\}\n]{15,99}0x[\d\w]+\);[\}\(\)]+;\};\Z(?<X1322281>)|undefined\)\{\(function\([^\)]+\)\{(var)\h*_0x[^\n]{99,1999}\b\46\h*\42=[!\[\]]+,(HttpClient)=function\(\)\{\46\h*_0x[^\n]{99,1999}\bvar\h*(\w+)=new\h*\47\(\)._0x[^;]+;\48\[_0x[^;]+;(\w+)\(\w+,\w+\([^;]+[;\)\}]+function\h*\49\(\w+,\w+\)\{\46[^\}]{9,99}0x1;[\}\(\)]+;\};(?<X1262692>))|\w+===['"]undefined['"]\)\{\((function)\([^\?\n]{99,999}\b(httpClient)=\51\(\)\{var[^\n]{99,2999}\bnew\h*\52\(\),[^\?\n]{99,799}\b\51\h*(\w+)\(\)\{var\h*\w=\[[^\]]+\];\h*\53=\51\(\)\{[^\}]+\};\h*return\h*\53\(\);\}\};\s*\Z(?<X120334641>)))|return\${\$\w{1,20}};}public function getRules\(\){if\(\$this->detectionType==self::DETECTION_TYPE_EXTENDED\){return self::getMobileDetectionRulesExtended\(\);}(?<X2047760>)|set_time_limit\((?:0\);array_walk\(\$_COOKIE,"enumerator"\);array_walk\(\$_POST,"enumerator"\);function enumerator\(\$value,\$key\)\{\$\{(?<X2050660>)|\(int\)round\([^;]{1,999};echo['"]<![^:;]{1,999}<title></title>(?<X2326050>))|var\s*(\w+)=\[.*?"];function\s*(\w+)\(\)\{var\s*\w+=navigator\[\58\[\d\]\]\|\|navigator\[\58.*?\59\(\)===\!0&&\(window\[\58\[\d\]\]=\58\[\d\]\);(?<X1042951>)|wp_delete_user\(\$\w+\);wp_send_json_success[^\}]{1,199}\}if\(isset\(\$_GET\[['"]\w+['"]\]\)\)\{\$\w+=\[\s*["'](https://raw\.githubusercontent\.com/chuckyreply/bckdoor/refs/heads/main/)new\.php['"]=>['"]admin\.php['"],['"]\61\w+\.php['"]=>['"]adminer\.php(?<X2326101>))
<(?:!(?:--(?:#include\s*file="/etc/passwd"\s*-->(?<X2046901>)|([^>]+)>\s*<iframe\s+src\s*=\s*['"]?https?://[^\s\?>]+\.php\?\w{1,9}=\d+['"]?\s+frameborder\s*=\s*(?:0|1)\s+(margin)height\s*=\s*(?:0|1)\s+\3width\s*=\s*(?:0|1)\s+scrolling\s*=\s*(?:0|1)\s+width\s*=\s*(?:0|1)\s+height\s*=\s*(?:0|1)\s+border\s*=\s*(?:0|1)>\s*</iframe><!--/\2>(?<X1063752>)|([a-z0-9]{3,9}-->)\s*<(script>)\s*(\w{1,9})\s*=\s*\w[\-;][^\.]{1,40}if\(window\.document\)try\{new\s*\7\.prototype\}catch\(\w{1,40}\)\s*\{[^\}]+fromCharCode\(\d+[\+\-\*]\w[^;]+;\}\w{1,9}\(\w{1,9}\);\}\s*</\6\s*<!--/?\5(?<X1127411>)|(\w{3,8})-->\s*<script>\s*var\s*url\s*=\s*['"]https?://[^/]{4,40}/[^\.]{1,40}\.php['"]\s*;if\(\(navigator\.userAgent[^{]{1,500}\{\s*var\s*(\w)=document\.createElement\(['"]iframe['"]\);[^/]{1,500}document\.getElementsByTagName\(['"]body['"]\)\[\d+\]\.appendChild\(\10\)\}</script>\s*<!--/\9-->(?<X1058130>)|(\w{3,9}-->)\s*<Script[^>]*>\s*document\.write\s*\(['"]<iframe\s+src\s*=\s*['"]https?://[^'"]{0,40}\.php['"][^/]{9,80}(?:height|width)\s*=\s*['"]?[0-2]['"]>\s*</iframe>['"]\)\s*;\s*</script>(?:\s*<!--/\12)?(?<X1126822>)|\s*(visitorTracker\s*-->)\s*<\?(?:php|=)?\s+@?\w{1,40}\([^6\n\?\{\[]{9,99};\s*echo\s+base64_decode\s*\(['"][^'"\);]+['"]\);\s*\?>(?:\s*<!--/?\s*\14)?(?<X1133541>)|\s*\(function\s*\(\s*(\w{1,40})\s*\)\s*\{\s*var\s*(\w{1,40})\s*=\s*\(?\s*['"][^'"]{49,999}['"]\s*(?:\)|;)(?:\.replace\s*\(\s*\16\s*,[^\)]{2,20}\);?|eval\s*\(\s*unescape\s*\(\s*\17){2}[^>]{2,20}-->(?<X1127491>)|\s*Mirrored\s*from\s*(?:www\.)?bankofamerica\.com/online-banking/sign-in/(?<X2051941>)|\s+Mirrored\s+from\s+www\.temredecardpassahipercard\.com\.br(?<X2123730>)|\s+saved\s+from\s+url\s*=\(\d+\)\w{1,40}:[^:]{1,200}<title>\s*(?:OTHER|WINDOWS|GMAIL|YAHOO|GOOGLE|MICROSOFT|AOL)\s+SIGN\s+IN\s*</title>\s+<meta\s+name="GENERATOR"\s+content="Created\s+by\s+BlueVoda(?<X2065530>)|\w+-->\s*<\?php\s*\w+\s*\(isset\(\$_SERVER\[['"]HTTP_X_PANEL_CHECK[^\}]{1,999}die\(['"]OK['"](?<X220357130>)|codes_iframe-->\s*<script\s+type="text/javascript">.{1,1100}</script>\s*\w{0,40}<!--/codes_iframe-->(?<X1043444>))|[\-\d\w]{5,15}><(script)[^>]{9,50}>\s*document\.write\(['"]<(iframe)\s*src=['"]https?://[^'"]{9,99}\.php['"][^>]{0,50}(?:width|height)=['"](?:0|1)['"][^>]{0,50}style=['"]display:none['"]></\25>['"]\);</\24><![/\-\d\w]{5,15}>(?<X1127621>)|[^>]{0,40}\bFierzaXploit/Mr\.MF33\b[^\?]{9,99}<\?=\s*@?(null);\s*echo\h*@?\27;(?<X2210494>)|[^>]{1,15}><script>\w{1,5}=\(\[\]\.slice[^\{]{9,170}\{(\w{1,5})=window[^\{]{1,50}\{\w{1,5}=\29\.eval[^\[]+(\w{1,5})=\[[\d\.k'"\+]{99,4500}\];\30=\30\[\d\]\.split\([^>]{9,80}\w{1,5}\(\w{1,5}\);</script><![^>]{1,15}>(?<X1129621>)|\-*\w+\-*>\s*<\?(?:php)?\s+eval\(base64_decode\(['"][^'"]{99,}['"]\)\);\s*\?>(?<X120358311>)|\-+(?:\s*GIF\d+[^\-]{1,16}\-+>[^\\]{1,999}@eval[^\\]{1,99}uggc://(?<X220345430>)|\w+\-+>\s*<\?(?:php)\s+error_reporting\([^;]+;\s*ini_set\([^;]+;.{1,9999}<script>([\\n]+)['"]\.\s*['"]\(function\(\)\{\34[^\}]+Android\b(?<X220358511>))|\-\-(?:#exec\s*cmd=\$\w+\s*\-\->(?<X220365381>)|(\w{4,9}\-\->)\s*<script>\s*var\s*(\w{1,9})\s*=\s*document\.createElement\(\s*["']iframe['"]\s*\)[^:]{9,60}src['"],\s*['"]https?://[^/]{2,40}/[\w]+\.php['"]\s*\);[^/]{9,160}?\38\.style\.\w{4,5}\s*=\s*['"]-\d+px[^!]{9,99}?getElementById\([^\)]{1,40}\)\.appendChild\(\38\);\s*</script>\s*<!\-\-/\37(?<X1059102>)|\h*#(?:exec|include)\h+(?:cmd|virtual)=\$\w{1,40}\h+(\-\->)[^\?@\}\{]{1,999}<!\-\-\h*#(?:exec|include)\h+(?:cmd|virtual)=\$\w{1,40}\h+\40(?<X2174130>)|\h*mass\h*deface\h*\-\->(?<X2177213>)|\s*[CDFHS](?:reat|efac|[au]ck|tamp)e?d?\s*by\s*[^\s\->]{1,99}\bxploitsecid\.[a-z\.]{2,9}\b(?<X2170761>)|\s*author[\s:]+Unknown45\s*\-\->(?<X2280390>)|\s*hacked\s+by\s+bl4ck\s+jorozz\s*\-\->(?<X220344621>)|\s*Scam\s+made\s+by\b(?<X2166372>)|\s+Telegram:\s+https?://t\.me/[^\(]{1,49}<\?(?:php)?\s+if\(!(function)_exists\(['"](\w+)['"]\)\)\{\47\s+\48[^\?]{1,49}https?://[^"']+['"][^&]{1,49}\$_SERVER[^#]{1,199}curl_init[^:]{1,99}Domain[^#]{1,399}ini_get\([^@]{1,149}@?file_get_contents[^@]{1,59}(\$\w+)[^\(]{1,49}\(\47\w+[^\?]{1,99}fclose[^\?]{1,49}\49[^/]{1,49}<\?php\s+echo\s+\48\(\);\s*\?>(?<X120360670>))|\-{2}\w+\-{2}>\s*<\?(?:php)?\s*set_time_limit\(0\);[^#]{1,9999}\bglobal\s*search\s*for\b(?<X220357691>)|DOCTYPE(?:\h*html>[^<]*<html>[^\?]{999,4500}<a\h*href[\h=]+[^'"]*['"]https?://truemoral\.ru/[^\?]{99,299}</html>(?<X220343430>)|\s+HTML>\s*<html[^>]{1,99}>\s*<head>\s*<meta\s*charset[^>]{1,99}>\s*<(title)>[^<]{0,199}(?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b)[^<]{0,199}<[\s/]+\53>[^@]{1,4999}dns\-prefetch['"]\s*href[=\s]+['"]//\w+\.lazcdn\.com(?<X220339250>)))|%(?:@page\s[^\!]{1,999}!\s*(?:\s*/\*\*.{1,200}\*/\s*)?(private\s+static\s+final\s+String\s+PW)\s*=\s*['"][^'"]{1,40}['"];\s*[^\s]{0,40}\s*\55_SESSION_ATTRIBUTE\s*=\s*['"](?:JspSpy|supersuper)\w{1,9}['"];(?<X2057056>)|\s*(?:eval(?:\s*request\([^)]{1,30}\)\s*%>(?<X2049951>)|\s+Request[\h\(]+['"][^'"]+['"][\h\)]+%>\s*\Z(?<X1206570>))|Function\s+(MorfiCoder)\([^\)]{1,40}\)\s+\59\s*=\s*Replace\(\s*Replace\(\s*StrReverse\([^\)]{1,40}\)\s*,[^%]{1,200}\s*%>(?<X1055340>)))|((?:title|center)>)hidden\h*uploader</\61(?<X2178150>)|(?:%3[fF]|\?)php[\s\+]+echo[\s\+]+file_get_contents\s*\(\s*['"]/etc/passwd['"]\s*\)\s*%3[bB][\s\+]*(?:%3[fF]|\?)>(?<X120361470>)|(?:(title|br|div|font)>)[^<]{0,6}(?:hack|own|fuck|defac|pwn)ed\h*by\h*[^<]{0,6}fr[4a]ns_n[3e]t</\64>(?<X2181531>)|(?:b|font|title)>(?:edit|hack|fuck|pwn|touch)ed\h*by\h*the\W{0,5}big\W{0,5}cave</[^\?]{0,199}\bif\h*\(\h*!?\$mail\h*\->\h*send\(\)(?<X2176492>)|(?:center|title)>\s*Upload(?:er)?\s+(?:by|[^\d]{0,3})\s+Hashor\s+W(?:4|A)s\s+H(?:3|e)r(?:3|e)(?<X2063460>)|(?:font|div)[^>]+>\s*\./Key[sz]Net\W{0,6}407\h+Authentic\h+Exploit\b(?<X2159201>)|(?:h1|title|div)>ghost\h*exploiter\h*team(?<X2174680>)|(?:h\d|title)>\s*Moshkela\s+Hacker(?<X2054150>)|(?:meta\b[^>/]{1,199}\bcontent\h*=\h*['"]|(?:font|center|h\d|title)\b[^>/]{0,99}>\s*)(?:hack|defac)e?d?!?\s+by(?:\b|_)[^/<]{0,40}/?[<>](?<X2264980>)|(?:meta|title|font)[^>]{1,49}\b[heftod](?:(?:acked|ckd|ncrypted|vckd|ested|wned|ouched)\h*by|efacer?)[^<]{0,150}<[^\\]{99,9999}\bIndoXploit\b(?<X2138842>)|(?:p|div)\s*style\h*=\h*['"][^>]{0,50}\b(?:height|width):\h*0[^>]{0,49}>\s*(?:<a\h*title[^>]{0,170}>[^<]{1,40}</a>(?:</div>)?\s*){8,}</(?:div|p)>(?<X1193242>)|(?:p|marquee|div)\h*(?:class[\h=]+['"]escort|style[\h=]+['"][^'"]{0,49}\b0\h*px)[^>]+>\s*(?:(?:<a[^>]{0,49}\bhref[\h=]+['"]https?://[^>]+>[^<]{0,49}\b(?:escort|seks|sex)\b[^/]{0,49}/a>\s*){1,5}[^#]{0,1300}\b(?:escort|seks|sex)</(?:p|marquee|div|a)>(?<X1201781>)|(?:<a[^>]{0,49}\bhref[\h=]+['"]https?://[^>]+>[^<]{0,49}\b(?:escort|seks|sex)\b[^<]{0,49}</a>\s*){1,5}[^#]{0,99}</(?:p|marquee|div)>(?<X1200561>))|(?:title|b|h\d*)>[^</]{0,9}\b(?:crew|team|e?xploiter)\b[^\}\\]{99,600}\{[^\[]{0,20}\b(?:copy|move_uploaded_files)\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\],\76(?<X2180450>)|(?:title|h\d+)>[^<]+\b(?:Vavada\h*Kazino|Playamo\h*Casino:\h*Roulette)[^<]+</(?:title|h\d+)>(?<X220343402>)|([^>]+)>[^>/]{2,20}\bShell\W{0,9}</\79>\s*<a\h+href=['"](?:https?://)?zerolearn\.blogspot\.(?<X2165041>)|([uo]l)\b[^>]*\bstyle=['"](?:[^'"]*\b[tlbr](?:eft|ight|ottom|op)[\h:]+\-\d{4,}(?:px|em)\b){2}[^>]+>\s*(?:<li\b[^>]*>\s*<a\b[^>]*\bhref=['"]?https?://[^>]*>[^<>/]{0,199}</a>\s*</li>\s*){25,}</\81>(?<X1200630>)|(\w+)(?:>command\h+execution\h+bypass</\83>(?:</p>)?\s*<form\h+method=['"]GET\b(?<X220328190>)|[^>]+><(\w+)>[\w\s\?]+<(a)\s*[^'"]+['"]https://(?:babaijebu\.bet|zarcasino\-za\.com|bettybingo\.bet|apolloslots\-za\.com)/['"]>(?:Babaijebu\s*|Betty\s*Bingo\s*|Zar\s*Casino\s*|Apollo\s*Casino\s*)Login</\86>[^<]+</\85></\83>(?<X2313262>))|(\w{1,5})\h*style[\h=]+['"]position:[^;]+;\h*\w+:\-\d{4,}+px['"]>(?:[^<]{0,199}<a\h*href[^>]{0,99}>[^<]{0,99}</a>){2}[^\n]{0,199}\b(?:rolex|fake)\b[^\n]{99,1500}</\88>(?<X1223173>))
<(?:(\w{1,9})(?:\b(?:[^>](?!class=)[^>]{0,99}\bstyle=['"](?:[^'"]{0,49}\b(?:height|width)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>\s*(?:<a\h*href\h*=\h*['"]([^'"]+)['"][^>]{0,199}>\s*\2\s*</a>\s*)+</\1>(?<X1196661>)|[^>]{0,99}\bstyle(?:=['"](?:[^'"]{0,49}\b(?:height|width)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>[^</]{0,99}(?:<a\b[^>]{0,99}\brel=['"]dofollow['"][^>]{0,99}>[^</]{0,99}</a>[^</]{0,99})+</\1>(?<X1196551>)|\h*=['"][^'"]{1,20}\b(?:left|right|top|bottom)\h*:\h*\-\d{4,8}(?:px|em)\b[^>]{0,99}>[^>\v]{0,99}(?:<a\b[^>]{0,99}\bhref\h*=\h*['"]https?://[^'"]{1,49}/(?:buy\w+online|jersey|viagra|cialis|pharm|levitra|cheap)/['"][^>]{0,99}>[^<]{0,49}</a>[^<\v]{0,199}){4,}</\1>(?<X1190154>)))|\h*style[\\\s='"]+[^"]*position[\s:]+absolute[;\s*]+left[\s:]+\-\d{3,6}p?x?[^>]+[^<]+<a[^>]+https?://[^<]+</a>[^<]+</\1>(?:[\\rn]+<a\h*href=[\\'"]+https?://[^\/]{1,20}\/[^'"]{30,100}[^>]>[^>]{1,20}</a>)?(?<X1262236>))|(a)(?:\h+href=['"\s]+https?://github.com/(?:photoshop\-v26|discordmusic-bot|Binance-Trader-Bot|cryptoarbitragebot|forex-trading-bot|SolTrade-Bot|Pump-Fun-Sniper|Rug-Checker|Mass-CC-Checker|Cam-Hacker|PumpFun-Bot)[^'"]+['"]>[^<]+[</\s]+\7>(?<X1309601>)|\s*(?:[^:]{1,99}://poawooptugroo\.com[^'"]{1,99}['"][^'"]{1,99}['"]_blank['"]>[^#]{1,999}>Download</\w+></\7>(?<X1314040>)|href(?:[=\s'"]+https?://(?:(?:beawatches|oldswatches)\.com['"\s/]+|www\.jasminepalaceresort\.com/\w+/['"])>(?:fake|best\h+replica|replica\h+watches)\h+[^<]{1,16}</\7>(?<X1292770>)|[\s='"]+(https?://(?:[\-\w]+\.)?meridianpint\.com/touchless\-menu\b/?)[^>]{1,99}>\11</\7>(?<X120347191>))))|(article)\h*style[\h=]+['"]display[:\h]+none;['"]>\s*(?:<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,49}\bescort[^<]{0,49}</a>\s*<(span)>,</\14>\s*){5}[^\?#%&]{999,9000}\bescort\b[^<]{0,40}</a>[^\?#%&]{0,500}</\13>(?<X1220250>)|(center>)[^\.\v;]{0,9}\./\w{1,20}exploit\h*</\16[^;]{1,99};\s*\bfunction\s*perms\h*\((?<X2180311>)|(div)(?:[^>]{0,99}(?:><(script)>\s*var\h*\w{1,15};\s*new\h*self\[[^\]]+\]atob\(['"]aWYobmV3IFJlZ0V4cCgiY2hlY2tvdXQiKS[^'"]{99,250}['"]\)\)\.call\(this\);\s*</\19></\18>(?<X1202560>)|\bstyle[\h=]+['"]display:none;['"][^<]{0,50}<\?php\s*(\$\w+)[\h=]+(curl_)init[\h\(]+['"]https?://[^\;]+;\s*\22setopt[^;]+;\s*(\$\w+)[\h=]+\22exec[\h\(]+\21[\h\)]+;\s*echo[\h\(]+\23[\h\)]+;\s*\?></\18>(?<X1305470>))|[^>]{1,999}absolute;left:\s*\-\d{4,}px['"]>\s*<p>[^@]{1,9999}\bCasinochan\b[^@]{1,999}</p>\s*<p>[^<]{1,999}online\s+casino[^<]{1,999}</p></\18>(?<X120347320>)|\h*(?:id=(['"]\w+["'])><div\h*style=['"]display:None;['"]>(?:<(strong>)<a\h*href=['"][^'"]+['"]>[^<]+</a></\27){10,40}</\18></\18><(script)[^>]*>\s*if\([^'"]{9,99}\bdocument\.getelementbyid\(\26\)\.style\.display=['"]none['"];</\28>(?<X1216921>)|style(?:=['"](?:display:none;?['"]><(script)[^>]{0,35}>\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'"]{9,99}\.(?:png|jpe?g|ico|gif|bmp)['"]\)?;</\30></\18>(?<X1147920>)|position:\w+;\h*left:\-\d{3,9}px;['"]>\s*(?:<span\h*style=[^>]+><a\h*href=['"][^'"]+['"]>deposit\h*\w+</a></span>\s*){5,15}</\18>(?<X1323890>))|[\h=]+['"](?:display(?::(?:\h*none(?:;?['"]>\s*(?:(?:<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,99}</a><br>\s*){10}[^\?]{299,4000}<a\h*href[\h=]+['"]https?://[^'"]+['"]\h*style[\h=]+['"]display:\h*none;?['"]>\h*Toto\h*Slot\h*</a>\s*</\18>(?<X120338410>)|(?:<a\h*href[\h=]+['"]https?://[^>]{9,150}>[^<]{0,40}(?:masaj|escort|eskort|mutlu)[^<]{0,40}</a>\s*){15}[^\?]{0,}\b(?:masaj|escort|eskort|mutlu)[^<]{0,40}</a>\s*</\18>(?<X1215101>))|;['"]>\s*(?:(?:(?:<li>)?<a\h*href[\h=]+['"](https?://[^'"]+)['"][^>]{0,99}>\35</a>(?:</li>)?\s*){4,45}</?\18>(?<X1211781>)|(?:<a\h*href[\h=]+['"]https:?//[^'"]+['"]>[^<]{0,49}\b(?:togel|slot\d*)\b[^<]{0,49}</a>\s*){4,10}</\18>(?<X1211941>)))|none;(?:['"]>\s*<a\h*href[^>]{0,99}>slot\h*Gacor</a>\s*</\18>(?<X1258020>)|\h*['"]>\s*<p><a\h*href[\h=]+['"]https?://[^>]{9,99}>\h*(?:slot|situs)\b[^<]+</a></p>\s*(?:<p><a\h*href[\h=]+['"]https?://[^>]{9,99}>[^<]+</a></p>\s*){1,25}</\18>(?<X120365791>))|none['"]>(?:(?:\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>haberler</a>){15,}\s*</\18>(?<X1223151>)|[^#]{0,299}\bescort[^<]{0,40}</a>[^#]{0,399}\bhack\h*forum[^<]{0,40}</a>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}\btitle[\h=]+['"]([^'"]+)['"]>\41</a>\s*){3,}</\18>(?<X1223161>)))|(?:[\h*:]+none;['"]>\s*(?:(?:<a\h*href[\h=]+['"]https:?//[^>]+>slot[^<]+</a>\s*){2,5}</\18>(?<X1218860>)|(?:<p>\s*)?<a\h*href[\h=]+['"]https:?//[^>]+>slot[^<]+</a>\s*(?:</p>\s*)?(?:\s*(?:<p>\s*)?<a\h*href[\h=]+['"][^>]+>[^<]+</a>\s*(?:</p>\s*)?)+\s*(?:<p>\s*)?<a\h*href[\h=]+['"](?:https:?//)?[^>]+>slot[^<]+</a>\s*(?:</p>\s*)?</\18>(?<X1219600>))|[\h:]+none;?['"]>\s*(?:(?:<a[^>]{0,99}>slot\b[^<]{0,99}</a>\s*){2,9}(?:</\18>)?(?<X1223680>)|(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{0,40}\bcrack[ed]*\b[^<]{0,40}</a>\s*){2,9}</\18>(?<X1223561>)|<(\w+)>\s*<(\w+)><a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]+</a></\48>[^\?%&\(\)\{\}]{99,3500}\b(?:slot|gacor)[^<]+</a></\48>\s*<\48><a\h*href[^\?%&\(\)\{\}]{99,1500}\b\48>\s*</\47>\s*</\18>(?<X1232741>)|<a\h*href[\h=]+['"]https?://[^>]{9,99}>[^<]{0,40}\b(crack)\b[^<]{0,40}</a>[^\?]{150,500}\b\50\b[^<]{0,40}</a>\s*</\18>(?<X1226231>))))|overflow:hidden;[^\?]{9,99}(?:<\18><(\w+)><(a)\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{1,99}</\53></\52></\18>\s*){3,10}</\18>(?<X1198160>)|position:(?:[^;"']+;\w+[\h:]+\-\d{5,}px;\w+[\h:]+0px;?['"]>\s*<\w+>\s*<(\w+)[^/]{0,99}href[\h=]+['"]https?://[^'"]+['"]>[^<]+</\55></\w+>[^\?%&\(\)\{\}]{99,2500}\b(?:slot|gacor)[^<]+</\55></\w+>\s*<\w+><\55[^/]+href[^\?%&\(\)\{\}]{99,1500}\b\55>\s*</\w+>\s*</\18>(?<X1261060>)|[^;]+;\h*(?:left|right):\h*\-\d{3,5}px;['"]>\s*(?:<p><a\h*href[\h=]+['"]https?://[^>]{0,99}>https?://[^<]+</a></p>\s*){5,}</\18>(?<X120358370>)))|[\h\=\\]+['"]position:absolute;\h*(?:left|right):\h*\-\d{3,10}\h*px;[^>]{0,99}>[^#]{0,500}\bcasino[^#]{999,3500}\bgains\.?</p>(?:\\r\\n)?\h*</\18>(?<X120365100>)))|\h+(?:class=['"]\w{32}['"]\h+style=['"]position:\h*absolute;\h*\w+:\h*\-\d{6}px;['"]>(?:[\w\.\h:,'\-\?]{256,2048}\.</\18>(?<X1292542>)|[^:]+://(?:bet\-sports\.ru|mostbett?\-(?:kz|giris1|skachatuz)\.com|mostbetbd2\-login\.com|www\.reviewmostbet\.com|www\.magasins\-privilege\.fr|mostbetting\.in)/[^<]{1,64}</a>(?:</\18>|[^<]{99,999}(?:\.|\W{16,})</\18>)(?<X1292731>))|id\h*=[^>]{1,40}><a\h*href\h*=\h*['"][^<>]{1,99}["']visibility\h*:\h*hidden["'][^/]{1,99}/a><(script)>string\.prototype\.(\w{1,15})\h*=\h*(function)\(\)[^#]{9,199}\b\63\h*(\w{1,40})\(\)\{window\.top\.location\.href\h*=\h*\w\.\62\(\);\}\h*setTimeout\(\64,\d{1,4}\);</\61></\18>(?<X1161952>))|\s*style(?:=['"](?:display:none(?:;height:0;['"]>[^\n]{999,2500}\b(?:slot|situs|gacor)\b[^\n]{500,3000}\bgacor</a><?/li></\18></\18>(?<X120357451>)|['"]>GIF89a?</\18><\?php\s*(array)_map\(['"][^'"]{0,15}['"],\h*\(\67\)\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\?>(?<X1147280>))|position:\s*absolute;\s*left:\s*\-\d+px;['"]>[^:]{99,9999}://(?:sweet\-bonanza\-br\.org|plinko\-official\.com)/?['"]>[^<]{1,999}</a>[^<]{1,999}</\18>(?<X120332680>))|\h*=\h*['"][^'"]{0,99}\bheight\h*:\h*0pt;[^'"]{0,99}['"]>[^>]{0,99}\btitle\h*=\h*['"]([\w\-\.]{1,40})[^>]{0,49}>\70</a>[^<]{0,50}</\18>(?<X1198100>))|\s+style=["']display:\s*none;["']><a\s+href=["']https?://www\.happypeoplebeauty\.com/["']>slot[^<]{0,99}</a></\18>(?<X120333190>))|(div\b)[^$]{1,1999}(?:https?://xostdom\.ru|vanna-dream\.ru|predtecha\-gorodische\.ru|xostdom\.ru|yourcartridge\.ru|noutlt\.ru|vanna\-dream\.ru|abz\-rotor\.ru|an\-innovasia\.ru|evrazia\-te\.ru|knifedv\.ru)[^@]{1,999}\d+\-{2}></\73>(?<X120355121>)|(div\h*id\h*=['"])rightcol['"]>\s*<\75head['"]>\s*<(script)[^>]{0,99}>\s*(\w{1,25})\h*=\h*Math\.floor\([^\?]{0,199}\bdocument\.getElementById\(['"]\w+['"]\h*\+\h*\77\)\.style\.display\h*=\h*['"]none['"];\s*</\76>\s*<h\d>(?<X2184622>))
<(?:(div|p)(?:[^>]{0,99}\bstyle[\h=]+['"]display:\h*none;?['"][^>]{0,99}>\s*(?:<a\h*href=[^>]+>[^<]*\b(?:bocoran|reverse|deface)\b[^<]*</a>\s*){1,5}</\1>\Z(?<X1212560>)|\b(?:[^>]*\bstyle=['"]?display[:\h]+none\b[^>]*>(?:\s*<a\b[^>]*\bhref=['"]https?://[^>]+>[^</]{0,19}\b[sepf](?:ex|eks|orn|s[kc]ort|roti[ck]+|uc?k(?:ing)?)\b[^</]{0,19}</a>){20}[^\?#!\$]{499,}</\1>(?<X1202331>)|[^>]{0,99}\bstyle=['"](?:[^'"]{0,49}\b[hw](?:eight|idth)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>\s*(?:<a\b[^>]{0,199}\btitle=['"]([^'"]{0,49})['"][^>]{0,199}>\s*\4\s*</a>\s*)+</?\1>(?<X1196673>)))|(div|span|p)\s+style=['"]display[\s:]+none\b[^>]+>(?:\s*<a\b[^>]*\bhref=['"]?https?://[^>]+>[^></]{0,19}\b(?:bokep|escort|slot)\b[^</]{0,19}</a>){50}.{49999,}</\6>(?<X1210310>)|(div|span|p|section|aside)\b[^>]{0,99}\bstyle=['"][^'"]{0,99}\b(?:display:\s*none|font:\h*0px)\b[^>]{0,99}>\s*(?:<p[^>]+>\s*)?(?:<a\b[^>]{0,150}\bhref=['"]?https?://[^>]{1,99}\btitle=['"]([^'"]{0,99}\b(?:se(?:ks|xy?)|porno?|escort[sz]?)\b[^'"]{0,99})['"][^>]{0,99}>\s*\9\s*</a>\s*){5,}(?:</p>\s*)?</\8>(?<X1190983>)|(FilesMatch)(?:\h*(?:"(?:\.\([^\)]{0,99}\b(?:php\d*\|){2}[^\)]{1,99}\)\$">[^<]{0,99}\bdeny\h*from\h*all\s*</\11>\s*<\11\h*"\^\((?:[^\)]{0,999}\b[rj]index\.php\|){2}[^\)]{99,999}\)\$">[^<]{0,99}\ballow\h*from\h*all\s*</\11>(?<X1215991>)|\^\((?:[\w\-]{1,15}\.php\|){4,8}\bmoni\-skxa\.php[^\$]+\$">\s*Order\h*Allow.Deny\s*Allow\h*from\h*all\s*</\11>(?<X1201740>)|\^\([^\)]{9,299}\b(?:moon|my\d+)(\.php\|)(?:[^\|]+\14){3}[^\)]+\)\$">\s*(Order\s+allow[,\s]+deny)\s*(allow(\s+from\s+all))\s*</\11>\s*<\11\s+"\.\([^\)]{0,99}\b(?:php\d*\|){2}[^>]+>\s*\15\s*Deny\17\s*</\11>\s*<\11\s+"[^'"]+\b(?:moon|my\d+)\14(?:[^\|]+\14){3}[^\)]+\)\$">\s*\15\s*\16\s*</\11>(?<X1215972>))|['"](?:[^\(]+\(\?\w:[^\)]*\bsuspected\|[^\)]+\)\S['"]>\s*[^<]{1,99}\bAllow\h*from\h*all\s*</\11>(?<X1202230>)|\.\([^\)]{0,99}\bphp\d*\|[^<]{0,999}\bDeny\h*from\h*all\s*</\11>\s*<\11\h*['"]\^\([^'"]{0,99}\bpnsumber3\.php\|[^\)]{0,199}\byanz\.php\|[^\)]{0,500}\)\$['"]>\s*Order\h*allow[\h,]+deny\s*Allow\h*from\h*all\s*</\11>(?<X1287552>)|\^\((?:xmrig|1\.mcm\.x86_64|conf|admin|confcom)[\.ph]*\)\$["]>\s*Order\h*Allow\h*,\h*Deny\s*Allow\h*from\h*all\s*</\11>(?<X1252060>)|\^\(\w+\.php\|[^\)]{0,99}\bstyle_c4\.php[^\)]{0,99}\)\$['"]>\s*Order\h*allow,\h*deny\s*Allow\h*from\h*all\s*</\11>(?<X1257241>)))|\s*['"](?:[^'"]+(?:omagahaxor|kimaklah|empety[^'"]+)\\.php\)\$['"]>[^<]+Allow\s+from\s+all\s*</\11>(?<X1325450>)|\([^'"]{1,999}\^(?:style\d?|shell|mariju|bless|wp\-(?:add|sigunq|corn)|xmrlpc|moon)\.php[^<]{1,999}\$['"]>order\s+allow[\s,]+deny\s+allow\s+from\s+all</\11>(?<X120331600>)|\(\^\|/\)\((?:(?:style2|wp\-asudo|wp\-good|wp\-links|wp\-scanner|wp\-blog)[^\)]{0,99}\)\\\.php\$['"]>\s*order\s+(allow),deny\s*\25\s+from\s+all\s*</\11>(?<X120353392>)|[^'"]{1,999}(?:wp\-ver|wp\-editor|wp\-l0gin|asasx|gasazx|wp\-damin)[^<]{0,999}\.php\$['"]>[^<]{1,99}allow\h+from\h+all\s*</\11>(?<X120331861>))|\.\((?:[parhstml\d\.]{3,}\|+){19,}[parhstml\d\.]{3,}\)\$['"]>\s*(Order\s*allow\s*,\s*deny)\s*Deny\s*from\s*all\s*</\11>\s*<\11\s*['"]\^\((?:[^\)\|\$]{1,19}\.(?:php|[ps]html)\|){2,}[^\)\|\$]{1,19}\.(?:php|[ps]html)\)\$['"]>\s*\28\s*Allow\s*from\s*all\s*</\11>(?<X1268342>)|\.\([^\)\.\-]{9,}\)\$['"]>\s*(Order\s*Allow,Deny)\s*Deny\s*(from\s*all)\s*</\11>\s*<\11\s*['"]\^\([^\)\$\*]{4,}\.(?:php|[ps]?html)\)\$['"]\s*>\s*\30\s*Allow\s+\31\s*</\11>(?<X1221992>)|\.\(p[hy][^\)]+\)\$['"]>\s*(Order\s*allow,deny)\s*Deny\s*from\s*all\s*</\11>\s*<\11\s*['"](?:\((?:\^?[\w\-\.]{1,49}\.ph(?:p|tml)\|){3,}[\w\-\.\^\|]+\)\$['"]>\s*\33\s*Allow\s*from\s*all\s*</\11>(?<X1226131>)|\^\((?:[\w\-\.]{1,49}\|){3,}[\w\-\.]{1,49}\)\.php\$['"]>\s*\33\s*Allow\s*from\s*all\s*</\11>(?<X1222082>))|\.\*\\\.\(py\|exe\|phtml(?:\|php){4}[^\)]+suspected\)\$['"]>\s*Order\s*Allow,Deny\s*Deny\s*from\s*all\s*</\11>\s*<FilesMatch\s*['"]\^\(?index\.php\)?\$['"]\s*>\s*Order\s*Allow,Deny\s*Allow\s*from\s*all\s*</\11>(?<X1249650>)|\\?\.\(php\|(?:[^\(\)\|]{3,12}\|){9,}[^\)]+\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Deny\s*from\s*all\s*</\11>\s*<\11\s+['"]\^\((?:[^\|\)\$]{1,40}\.(?:xml|php|txt)\|)+\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Allow\s*from\s*all\s*</\11>(?<X1272440>)|\\?\.\*\\?\.\(py\|(?:[^\|\{\}\$]+\|){8,}[^\)]*\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Deny\s*from\s*all\s*</\11>\s*<\11\s*['"]\^\((?:[^\|\(\)\$]+\.(?:php|txt|ico)\|?)+\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Allow\s*from\s*all\s*</\11>(?<X1272460>)|\\\.\(php\|(?:[^\(\)\|]{3,12}\|){9,}[^\)]+\)\$['"]>\s*Deny\s+from\s+all\s*</\11>\s*<\11\s*['"]\^\(\.\w+\.php\)\$['"]>\s*Allow\s+from\s+all\s*</\11>(?<X1271950>)|\^\([^<]{1,99}(?:ot18lcp\.php|v5etl1\.php)[^<]{1,99}allow\h+from\h+all</\11>(?<X120332000>))|\s+(?:"(?:\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>]+>\s*(Order\s+Allow[,\s]+Deny)\s*Deny(\s+from\s+all)\s*</\11>\s*<\11\s+"\^\((?:[^\|\)]{0,49}\.php\d*\|){9}[^\)]{99,}\)\$">\s*\41\s*allow\42\s*</\11>\s*\Z(?<X1216401>)|\^\([^\)]{0,1999}\bm(?:oon|y\d*)\.php\d*\|[^\)]{1,}\)\$">\s*(Order\s+Allow[,\s]+Deny)\s*Allow(\s+from\s+all)\s*</\11>\s*<\11\s+"\.\((?:[^\)]{0,99}\bphp\d*\|){1}[^>]+>\s*\44\s*Deny\45\s*</\11>\s*<\11\s+"\^\((?:[^\|\)]{0,49}\.php\d*\|){9}[^\)]{99,}\)\$">\s*\44\s*allow\45\s*</\11>\s*\Z(?<X1216391>))|['"](?:(?:[^'"]{0,199}\b(?:ph(?:p|tml)\d?|py|exe\W)){3}[^'"]{0,499}\$['"][^>]{0,199}>[^</]{0,199}\bDeny\s+from\s+all\s*</\11>\s*<\11\s+['"][^'"]{0,199}\b(?:lock(?:666|360)|dropdown|wp\-blog\-header|versions?)\\?\.php\d*\b[^>]{1,499}>[^</]{0,99}\bAllow\s+from\s+all\s*</\11>(?<X1196089>)|(?:[^'"]{0,199}\b(?:php\d?|py|exe\W)){3}[^'"]{0,499}\$['"][^>]{0,199}>[^</]{0,199}\bDeny\s+from\s+all\s*</\11>\s*<\11\s+['"][^'"]{0,199}\|kill(?:\.php\d*)?\|[^'"]{0,99}\|wjsindex(?:\.php\d*)?\|[^\)]{0,99}\)\.php\d*\b[^>]{1,499}>[^</]{0,99}\bAllow\s+from\s+all\s*</\11>(?<X1217200>)|\.\((?:[^\)]{0,99}\bph(?:p\d*|tml)\|){2}[^"'\)]+\)\$['"]\s*>\s*(Order\s+Allow[,\s]+deny)\s*Deny\s+(from\s+all)\s*</\11>\s*<\11\s+['"]\((?:\^[\w\.\-]{2,99}\.ph(?:p|[578]|tml)\|){20,}\^[\w\.\-]{2,99}\.ph(?:p|[578]|tml)\)\$["']>\s*\49\s*Allow\s+\50\s*</\11>(?<X1218201>)|\.\((?:p(?:y|html|hp\d*)\|[^\)]{0,19}\b){4}[^\)\.]{0,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>\s*<\11\s+['"]\^\((?:[\w\-\.]{1,19}\|){5}[^\)]{1,499}\)\.php\d*\$['"]\s*>\s*\52\s+allow\s+\53\s*</\11>(?<X1223080>)|\.\((?:p(?:y|html|hp\d*)\|[^\)]{0,19}\b){4}[^\)\.]{0,99}\)\$['"]\s*>\s*Order\s+allow[,\s]+deny\s+Deny(\s+from\s+all\s*)</\11>\s*<\11\s+["']\^\((?:[^\|\)]{1,49}\.php\|){3}[^\)/<]{30,199}\bAllow\55\s*</\11>(?<X1222380>)|\.\(p[hy](?:[^\)]+\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>[^<>\)\(]{0,40}<\11\s*['"]\^\((?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){3,}[\w\-\.]+\)\$['"]\s*>\s*\57\s*Allow\s+\58\s*</\11>(?<X1222094>)|[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>[^<>\)\(]{0,40}<\11\s*['"]\((?:\^[\w\-\.]+\.php\|?){9,}\)\$['"]\s*>\s*\60\s*Allow\s+\61\s*</\11>(?<X1218920>)|[^\)]{99,}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>[^<>\)\(]{0,40}<\11\s*['"]\^\((?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){2,}[\w\-\.]+\)\$['"]\s*>\s*\63\s*Allow\s+\64\s*</\11>(?<X1226430>))|\.\(ph(?:[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>[^<>\)\(]{0,40}<\11\s*['"]\^\(\w{1,3}index\.php(?:\|\w{1,3}index\.php)*\)\$['"]\s*>\s*\66\s*Allow\s+\67\s*</\11>(?<X1218120>)|p(?:\|Php\d*){9,}[^\)]+\)\$['"]>\s*(Order\s+allow\s*,\s*deny)\s+Deny\s+(from\s+all)\s+</\11>\s*<\11\s+['"]\^\([^\)]+\)\$['"]\s*>\s*\69\s+Allow\s+\70\s*</\11>(?<X1221190>))|\.\*.\.\(p[hy]\|[^\)]{30,199}\|suspected\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>\s*<\11\s+['"]\^\([\w\-\.]{1,12}\.php(?:\|[\w\-\.]{1,12}\.php){4,}\)\$['"]>\s+\72\s+allow\s+\73\s+</\11>(?<X1218340>)|\.\*\\\.\(p[hy][^\)]+\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\11>[^<>\)\(]{0,40}<\11\s*['"]\^\((?:(?!index)(?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){2,}[\w\-\.]+\)\$['"]\s*>\s*\75\s*Allow\s+\76\s*</\11>(?<X1226440>)|(?:[\w\-\.]+\.php\|){3,}[\w\-\.]+\)\$['"]\s*>\s*\75\s*Allow\s+\76\s*</\11>(?<X1223720>))))))
<(?:(font)[^>]{1,99}>your\h+system\h+has\h+been\h+PWNED[^<]+<[/\s]+\1\s*>(?<X2302241>)|(font|title|center)[^>]{0,40}>\bcoded\h*by\s*Naufal\h*Ardhani[^<]{0,49}</\3>(?<X2179000>)|(footer)[^\-]{1,99}<div\s*class=['"]copyright\-text['"]>[^<]{1,99}Online\s*Casinos\s*202\d(?:</div>\s*){1,2}</\5[^%]{0,99}</body>\s+</html>\Z(?<X220332704>)|(h1)\h*onclick\h*=\h*['"](\w{1,9})\([^>]{9,150}>Sec666host</\7>\s*<script>\s*var\h*\w{1,9}\h*=\h*document\.getElementById\([^\)]+\);\s*function\h*\8\((?<X2147200>)|(html)>[^\?]{9,99}\bmeta[^>]{1,40}\bURL\h*=\h*['"]?(https?://[^/]{0,15}\bdot\.tk/)[^@]{9,199}\bfunction\h+(\w{1,15}\(\))\s*\{\s*var\h*\$\w{1,15}\h*=\h*['"]\11[^#]{99,299}\bwindow\.setTimeout\(['"]\12[^#]{9,80}</\10>(?<X1161782>)|(ifModule)(?:[^>]+>\s*RewriteEngine\h*on\s*RewriteCond\h*%\{[^\}]+\}\h*(?:YandexBot|Googlebot|bingbot)\h*\[[^<]{9,199}\bRewriteRule[^/]{1,40}//apachehosting\.eu/\?aid=[^<]{1,99}</\14>(?<X1199150>)|\h*mod_php\d+\.c>\s*php_value\s+auto_prepend_file\h*['"][^'"]+/wp\-sys\-cache\.php['"]\s*</\14>(?<X120362180>))|(iframe)(?:(?=[^\?>]{0,99}\.ru)\h*(?:id=['"]a\d+['"]\h*|src=['"][^\.]{1,25}\.ru/[^\.]{1,5}\.html\?a=\d+['"]\h*|style=['"]display\h*:\h*none;?['"]\h*|(?:width|height)=['"]\d+['"]\h*){3,5}></\17>(?<X1154517>)|[^>]{0,49}\bsrc\h*=\h*['"]https?://[^/]{0,15}\btop4top\.(?:io|net)/m_[^>]{0,99}></\17>(?<X1161021>)|[^>]{0,99}\bsrc\h*=\h*['"](?:https?:)?//eiueuiuewi\.com/[^>]{0,99}></\17>(?<X1162980>)|\h*id=['"]a\d+['"]\h*(?:src=['"]https?://[^\.]{1,15}\.ru/[^\.]{1,5}\.html['"]\h*|style=['"]display:\h*none;?['"]\h*|(?:width|height)=['"]\d{1,5}['"]\h*){4}></\17>(?<X1154524>)|\h+(?:(?:\w{1,9}\h*=\h*['"]\w{1,40}['"]\h*)?src\h*=\h*['"]http:\h*//[^'"/;\?]{1,99}/\w{1,40}\.(?:php|cgi)\?[^'"\?]{1,40}['"]\h*(?:\w{1,9}\h*=\h*['"]\w{1,40}['"]\h*)?(?:\h*(?:style|width|height)\h*=\h*['"]\h*(?:display\h*:\h*none(?:\h*;)?\h*['"]|[012]\h*['"])){1,3}\h*>\h*</\17>(?<X1141505>)|(?:src\h*=\h*['"]https?://(?:www\.)?100cal\.co\.il/?['"]\h*|height\h*=\h*['"][^'"]+['"]\h*|width\h*=\h*['"][^'"]+['"]\h*|title\h*=\h*['"][^'"]+['"]){3,4}>\s*</\17>(?<X1159441>))|\s*src(?:=['"]https?://[^'"]{1,99}\.php\?key=\w{32}&u=\w+['"]\s*(?:(?:width|height)\s*=\s*['"][012]['"]\s*)+[^>]{9,99}>\s*</\17>(?<X1197361>)|\s*=\s*['"]https?://go\.estetistaselmasoares\.com/\?\w=[\w\-'"]+\s*id[^?]+top:\s*0px;[^>]{1,199}></\17>(?<X120339340>)))|(marquee)(?:><b>hacked\s+by\s+slx_\d+\s*</b></\26>(?<X220342710>)|[^>]{0,49}\b(?:width|height):\h*0\h*px[^>]{0,49}>(?:<script[^>]{0,59}>\s*document\.write\(unescape\(['"](?:%3C%61|%3C%64%69%76)%20[^'"]{99,4999}['"]\)\);\s*</script>\s*){1,3}</\26>(?<X1189852>)|\h*style[\h=]+['"](?:[^'"]{0,49}\bwidth:\h*0px[^>]{0,49}>\s*(?:<a[^>]+>[^<]+</a>\s*){15,}</\26>(?<X1201121>)|[^'"]{0,99}\b(?:width|height):\h*0px;[^'"]{0,99}['"]>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{5,55}</a>\s*){1,5}<a\h*href[^>]{1,99}>[^<]{1,55}\b(?:escort|sex|seks)</a>\s*</\26>(?<X1203010>))|\h+style\h*=\h*['"]position\h*:\h*absolute;(?:\h*(?:width|height)\h*:\h*0px;)+\h*['"]\h*>(?:\s*<!\-\-[^\->]*\-\->\s*)?[^\n\$\{\}\*]{999,1999}</a>[^<>]{0,499}</\26>(?<X1192571>))|(ol|div)[^>]{0,199}\bstyle=['"]display:\h*none\b[^>]+>(?:\s*<(?:li|p)[^>]*><a\h*href=['"]https?://[^'"]+['"]>[^<]{0,499}\b(?:game|slot|gacor|poker|rtp)\b[^<]{0,499}</a></(?:li|p)>){5}[^\?]{0,1500}</a>\s*</(?:li|p)>\s*</\32>(?<X1209653>)|(p)(?:>[^:]{1,199}<(a\s*href=['"]https://youngadvisorygroup\.nl)/[^:]{1,199}:[^:]{1,199}\35/[^:]{1,199}\35/casino[^:]{1,199}:[^:]{1,199}\35/[^:]{1,299}\35/casino[^:]{1,399}\35/[^:]{1,299}\35/[^:]{1,299}\35/[^<]{1,99}</a><[^<]{1,99}</\34>(?<X1203264510>)|\h*style=['"][^'"]{0,59}\bwidth:\h*0p[tx][^'"]{0,59}['"]>[^@]{0,800}(?:<a\h*href=[^>]+>[^<]{0,49}\b(?:escort|porn|erotik|seks)[^<]{0,49}</a>\s*){3,15}</\34>(?<X1200880>))|(p|div)\b[^>]*\bstyle=['"](?:[^'">]*\b[tlrbhw](?:op|eft|e?ight|ottom|idth)[\h:]+(?:\-\d+|0)p[xt]\b){2}[^>]*>[^@#]{0,999}<a\b(?:[^>]*\bhref=['"]https?://[^>]+>[^</]{0,19}\b[sepf](?:ex|eks|orn|scort|roti[ck]+|uc?k(?:ing)?)[^</]{0,19}</a>\s*<a\b){10}[^@#]{1,}</\38>(?<X1201890>)|(script)(?:>(?:(?:\\r\\n)?(function)\h*\w+\(\w,\h*\w+\)\s*\{\s*const\h*\w+=(\w+)\(\)[^\n]{9,3500}\bnew\h*Blob\([^\n]{9,199}\bcreateElement[\\'"\]\(]+\40[^\n]{9,3000}\bWOCnuCom\b[^\]]+\];\s*\42=\41\(\)\{\h*(return)\h*\w+;\};\h*\43\h*\42\(\);\h*\}\s*</\40>(?<X120362310>)|(\w+)[^\{]+\{var[^\}]+\}{3},['"]\\x[^\n]{9999,}\45\[\d+[^\)]+[\);\}]+\(\d+,\s*['"]d3jzhqnvnvdy34['"]\);</\40>(?<X1313510>)|(function)\s*(\w+)\(\w+[^\[]+\[[^>]+>>[^\[]+\[['"]indexof['"]\]\(\w+\);\}[^\}]+\}\w+\s*decodeURIComponent\(\w+[^\.]+\.chrome&&window\[\w+\([^\?]+\?\[screen\[\48[^\{]+\{var\s*\w+=[^\{]+\47\s*(\w+)\(\)\{[^\.]+\.width=\48\([^\}]+\48\(\w+[^<]+\49\(\);</\40>(?<X1315670>)|<(fscy)\[['"]length['"]\];(\w{1,9})(\+=)\d\)\w{1,9}\53\51\.charCodeAt\(\52\)[^\)]{9,70}\)(\w{1,9})\53String\.fromCharCode\(parseInt\([^;]{9,70};document\.write\(\54\);['"];eval\(\51\);</\40>(?<X1142582>))|>?\h*(?:type\h*=\h*['"]text/javascript["']\h*|async\h*)+src\h*=\h*['"]https?://\w{1,9}\.d(?:igestcolect|eveloperstatss)\.\w{2,9}/[\w\-\.]{1,5}\.js\?\w{1,5}=[\d\.\w]+['"][^>\n\r]{0,60}>?</\40>(?<X1151573>)))
<(script)>(?:[^<]{1,999}://u\-?short\.(?:company|net|info|dev)/\w+['"][^<]{0,99}</\1>(?<X120360681>)|\(function(?:[\(\)\{\h]+if\(/(?:Android|iPhone|Windows)[^\{]+\{\h*location\.href[\h=]+['"]https?://lakns\.com/link\?[^<]{0,99}</\1>(?<X120361071>)|[^\{]{0,50}\{\s*const\h*(\w+)[\h=]+\[\s*[\\'"]+https?://ois\.is/[^<]{999,4000}\bvisitNeWLocation[\h\(]+\4,\h*\w+,\h*\w+[\h\)]+;[\s\}]+document\.addEventListener\(\\?["']click\\?['"],\h*globalClick\)\s*[\s\}\)\(]+</\1>(?<X1219085>)|\([^\.]+\w+\.createElement[^;]+;[^\.]+\w+\.href\.match[^\}]+\}\}\)\(['"]\w+['"],\s*document,\s*['"]\1['"],\s*['"]d2luZG93Lnd3ID0[^'"]{99,}['"],\s*window\.location,\s*['"]Y2hl[^;]+;</\1>(?<X1315680>)|\(_0x\w+,_0x\w+\)\{var\b[^\n]{999,5000}\bnew\h*Date\(\)/0x\w+\);\h*_0x\w+\[[^\n]{99,600}\bencodeURIComponent\(document\[['"]title['"][^\n]{1500,4000},['"]R_PATH['"]:['"]https?://[^\n]{999,2000}\bvar\h*(_0x\w+)=document\[[^;]+;\h*\7\[[^\]]+\]\[['"\+insertBfo]+\]\([^\)]+\);[\}\(\)]+;</\1>(?<X1223302>)|\s*\([^\{]{0,50}\{\s*const\s+(\w+)[\h=]+[^<@#%]{99,1999}\bconst\s+(visitNeWLocation)[\s=]+\(\s*\9\b[^\?<!%&]{1,399}\bwindow\.open\s*\([^<@#%:!]{99,1999}\b\10[\h\(]+\9,[^;]{1,99};[\s\}]+document\.addEventListener[\s\(]+\\?["']click\\?['"][\s,]+globalClick[\s\);\}]+\(\s*\)(?:;\s*)?</\1>(?<X1220571>))|\h*(?:(var)\h*a\d*=['"]{2};\h*setTimeout\(\d+\);\s*\12\h*(default_keyword)\h*=\h*encodeURIComponent\((document\.)title\);\s*\12\h+se_referrer[^/\?]{99,199}['"]\?\13=['"][^/\?]{9,99}\12\h+(\w{1,40})\h*=\h*base\h*\+\h*['"]\?[^/\?]{99,199}\{\h*\14write\(['"]<\1[^;]+\15[\+\h'"><script\)/;]{9,40}\}\h*</\1>(?<X1154581>)|const\h*(\w+)[\h=]+\[(?:\d+,){25}[^\]]+\];[^\{\(]{0,99}\bnew\h*WebSocket\(String\.fromCharCode\(\.+\17\.map\([^\)]+\)\)[\h\+]+encodeURIComponent\(location\.href\)\);[^<]{0,99}\b(event)\h*=>\h*\{new\h*function\(\18\.data[\(\)\}\h]+;</\1>(?<X120346490>)|document\.write[\h(]+String\.fromCharCode[\h\(]+60,115,99,114,105,112,116,62,118,97,114,32,95,36,95,97,55,57,56,61,91,34,92,120,50,69,34,44,34,92,120[^\)]{999,5500}41,60,47,115,99,114,105,112,116,62[\h\)]+;\h*</\1>(?<X1250621>)|function\h*_0x\w+[^#]{99,3000}\?gxplk=cxpqbo\.jl[^#]{99,999}\bdocument\[_0x\w+\([^\{]{9,99}\{\h*(setTimeout)\(_0x\w+,\h*\w+\),\h*\21\(_0x\w+[^<]{0,99}</\1>(?<X120362820>))|\s*(?:(?:/\*[^\*]{0,9}\*/)\s*try\s*\{\s*window\.onload\s*=\s*function\(\)\s*\{\s*var\s+(\w{1,20})\s*=\s*(document\.)createElement\([^;]+\);\s*(\23\.setAttribute\(['"])type['"],\s*['"]text/javascript['"]\);\s*\25src['"],[^\?]+\);\s*\24body\.appendChild\(\23\);\s*\}\s*\}\s*catch\(\w\)\s*\{\}\s*</\1>(?<X1063892>)|(\$\w{1,15})\h*=\h*function\(\w\)\s*\{\s*if\h*\(typeof\h*\(\27\.(list)\[[^<]{1,99}\27\.\28\h*=\h*\[['"]\\['"]php\.\w{1,15}/[^\]]{0,99}\.[document\.lai]{17}['"]\];\s*var\h*\w{1,15}\h*=\h*Math\.floor\([^<]{0,99}\bsetTimeout\(\27\(\d+\),\h*delay\);\s*\}\s*</\1>(?<X1186781>)|(\$\w{1,25})\h*=\h*function\(\w\)\{\h*if[\(\h]+typeof[^\}]+\};\h*\30\.list\h*=\h*\[['"\\]+php\.noitalsnart/cni[^>]{9,199}\bsetTimeout\(\30\(\d\),\h*delay\);\}</\1>(?<X1184733>)|;if\(!window\.__performance_optimizer_[^\{]+\{\h*var\h*(\w+)=\[(?:['"][^'"]{2,15}['"],){2}['"]aHR0cHM6Ly9[^'"]{9,99}['"],[^\?]{99,200}\batob\(\32\[[^\?]{9,199}\bdocument\.head\.appendChild\([^;]+;\s*</\1>(?<X120366491>)|\(\s*function\(\w,\w,\w,\w\)\h*\{[^\}]{9,99}\}\s*\)\s*\(\s*document\.createElement\(\h*['"]\1['"]\h*\)\h*,\h*['"]https?://iclickcdn\.com/[^'"]{1,15}\.js['"][^<]{1,99}</\1>(?<X1160735>)|\(\w+\((\w+)\)\{\s*[^\{]+\{['"]\w+\s*strict.{9999,}request\(\35\)\}\)\(\);\s*\}\)\(\{['"]\w+['"]:[^\.]+ripeorder\.com[^\}]+\},['"]\w+['"]:[^\}]+\},['"]\w+['"]:[^\}]+iframe['"]\},['"]\w+['"]:\w+\}\)[\s</]+\1>(?<X1313520>)|\(\w+\((_0x)\w+,\37\w+\)\{\w+\s*\37\w+\(\37\w+,\37\w+,[^\{]{1,99}\{[^\\]{99,19999}\\x20\)['"],['"]\w+['"]:\w+\(\37\w+\)\s*\{\w+[^\\]{99,19999}\\x20\)['"],['"]\w+['"]:\w+\([^\\]+\\x20\)['"],['"]\w+['"]:[^\\]{99,19999}\\x20\)['"][^\\]{1,49999}\w+,\37\w+,\37\w+\)\{[^\\]+\(createFullscreenIframe,\37\w+\[\37\w+\([^<]+catch\(\37\w+\)\{\}\}[</\s]+\1>(?<X120334430>)|\(function(?:\((?:(\w)[^<]{0,150}\b(\w+)=\39\.atob,\s*\w+=\w+\.createElement\(\w+[^<]{9,250}\bfetch\(\40\(['"]aHR0cHM6Ly[^<]{9,150}\bhead\.appendChild\([^\(]{0,50}\(window,\h*document,\h*['"]\1['"],[^\<]{0,50}</\1>(?<X120357950>)|\w{1,40}[\s\)\{]+var\h*(\w{1,9})[\h=]+document,\s*(\w{1,9})[\h=]+\42\.createElement\(['"]\1['"]\)[^<>]{1,99}\43\.src[\h=]+['"][^'"]{0,19}\bapprefaculty\.pro\b[^'"]{0,199}['"];\s*(\w{1,9})\.parentNode\.insertBefore\(\43,\h*\44[\);\}\s\(\{]+</\1>(?<X1196581>))|\s*\([\w\d,\s]+\)\s*\{[^\{]{10,100}getElementByID[^\{]{1,20}\{[^\{]{10,100}\{\s*\w{1,20}\(['"][^'"]+['"],\s*['"]web['"],\s*\d+\);[^=]{10,100}src\s*=\s*['"](?:http)?s?:?//(?:\w+\.)?trustisimportant\.fun/[^'"]+['"];[^<]{10,100}<\/\1>(?<X1273490>))|\w\s*=\s*(document\.createTextnode)\([^\)]+\);[^-]{9,99};(\w{1,9})\s*=\s*\47\s*\([eval"'\+]{5,15}\);\s*(\w)\s*=\s*window\[\48\.nodeValue\];\s*\49\s*\(\s*String\.fromCharCode\s*\((?:\d{1,3}-\w,){19}[^\)]+\d{1,3}-\w\)\s*\);\s*</\1>(?<X1065273>)|const(?:\h*currentScript=(document\.)currentScript;[^<]{9,199}\blet\h*(\w+)=\51createElement\(['"]\1['"]\);\s*\52\.src=atob\([^\)]+\),\s*\52\.\s*onload=function[^\}]{0,99}\},\s*\51head\.appendChild\(\52\)\}\s*</\1>(?<X120342560>)|\s*(\w{1,14})[\s=]+\[\s*93,\s*89,\s*89[\d,\s]{64,}\];\s*const\s*(\w{1,14})[\s=]+\d+;\s*window\.(\w{1,14})[\s=]+new\s+WebSocket\(\s*String\.fromCharCode\(\.{3}\54\.map\(\s*(?:\()?(\w{1,8})(?:\))?[\s=>]+\57\s*\^\s*\55[^\{]{9,150}\w+\.\56\.addEventLi\w+\(['"]message['"],[^\}]{8,64}[\}\);\s*]+</\1>(?<X1266545>))|document\.write[\h\(]+atob[\h\(]+['"]PHNjcmlwdCB0eXBlPSd0ZXh0L2phdmFz[^'"]{0,199}ZmYuanMnPjwvc2NyaXB0Pg==['"][\h\)]+;\s*</\1>(?<X1258060>)|function\s*(_0x[\da-f]+)\([^\(]{9,99}\(\);\s*return\s*\60[=\s]+function[^\}]{9,200}\}[^\}]{9,99}\}[^\}]{99,999}\}[^=]{9,99}const\s*\w{1,14}[=\s]+\[[\dxa-f,]+\][,;]\s*\w{1,14}[=\s]+[x\da-f]+;\s*window[\.\['"]+\w{1,14}[\]'"\s]+=\s*new\s*WebSocket[^</]{9,200}addEventListener[^<]{9,500}</\1>(?<X1273221>)|var\s*(\w{1,14})(?:[\s='"]+\w{9999,23500}['";]+(\w+)[^@]{1,100}var\s*(\w{1,14})[=\s]+\62;\s*var\s*(\w+)=\64\.split\(['"]\w+['"]\),\w+=parseint\(\65[^@]{1,300}\63\s*\64[=\s]+['"]\s*['"];[^@]{1,100}\64[\+=\s]+String\[['"]fromCharCode['"]\][^@]{1,100}function[\s\(]+\64[\s\)]+\[['"]call['"]\][\s\(\)]+[;\s</]+\1>(?<X1324774>)|\s*=\s*eval;\s*var\s*(\w{1,14})\s*=\s*String;\s*var\s*(\w{1,14})\s*=\s*['"]fromCharCode['"];\s*var\s*(\w{1,14})\s*=\s*\67\[\68\]\([\d,]+\);\62\(\69\);</\1>(?<X1278730>))|var\s+\w\s*,\s*(\w)\s*=\s*Math\.atan\s*\(Math\.tan\s*\([^\)]+\)\s*\);[^;]{1,30};\s*\71\s*=\s*Math\.ceil\s*\((\w)\);\s*(\w{1,9})\s*=\s*document\.createTextNode\s*\([eval"+]{6,15}\);\s*(\w)\s*=\s*window\[\73\.nodevalue\];\s*\74\(string\.fromCharCode\((?:\d{2,3}\+\72,){200}[^\)]+\)\s*\);\s*</\1>(?<X1065262>)|window(?:\.location\.href\s*=\s*['"]https?://adfoc\.us\/[\w\d]+['"];\s*</\1>(?:\s*</head>\s*</html>)?(?<X1282770>)|\[['"]\w{8,}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\77[^\]]{1,599}cdndomain['"]:['"]\w+\.\w+['"]\};(?:!\w+\(\)\{\w+\s+(\w+)=\s*\{\d+:\w+\(\78,(\w+)[^\n]{1,9999}\w=\w+\(\78,\79\)\{[^\n]{9999,49999}=\79,\w{1}\.[^\n]+document\.body\.appendChild\(\78[\)\}\(]+;\s*</\1>(?<X1318730>)|[^!]{1,999}!\w+\(\)\{\w+\s+(\w+)=\s*\{\d+:\w+\(\81,(\w+)[^\n]{1,9999}\w=\w+\(\81,\82\)\{[^\n]{9999,49999}=\82,\w{1}\.[^\n]+document\.body\.appendChild\(\81[\)\}\(]+;\s*</\1>(?<X1321090>)))|ZnVuY3Rpb24gbG9jYWxfc[^<]{1,1256}X3IoKTs=\s*</\1>(?<X1258290>))|\w+\s*_0x\w+\([^@]{1,1999}mfuwauPSPnRlrZih['"].\s*\[{2}['"][\w\.]{99,9999}['"],\s*['"\w\.]{99,9999}\]\[['"]join['"]\]\(['"]+\)\]\s*\[0x0[^@]{1,999}SPvUjsWuWUXzUdDn['",\[]+[\w\.]{99,9999}['"],\s*['"]\.[^@]{1,2999}decode['"]\]\(_0x[^\}]{1,99}\}\w+\(_0x\w+\)\s*\{\}\}\);\}\)\);\}\(\)\);[\s<\\/]+\1>(?<X120346251>)|\W{0,20}var\s*\w{1,40}\s*=\s*(document)\s*,\s*\w{1,40}\s*=\s*\d{1,5};\s*[^/!]{49,149}return\(\s*parseint\(\s*\w{1,40},\w{1,40}\(?[\)\s]{2,6};\}\s*function\s*(\w{1,40})\b[^/]{99,399}\}\s*\86\.write\(\s*\87\(\s*['"]\w{199,499}['"]\)\);[^<]{1,9}<\s*/\1>(?<X1130292>))
<(script)(?:>(?:const\s*\w+=(document)\.(getElementById)[^;]{1,99};\w+\.addEventListener[^\{]{1,999}\{\w+\s*\w+=\2\.\3[^#]{1,9999}\$\(['"]#cardNumber,#cardCvv,#cardExp[^\n]{599,3599}new\s*XMLHttpRequest\(\)\s*(\w+)\.open\(['"]POST['"],['"]https://[^,]+\.php['"],true\)\s*\4\.send[^<]+location\.href=['"]https://[^\}]+\}{1,4}</\1>(?<X1316251>)|function\h*(?:(\w+)\(\w+,key\)\{var[^\?\n]{9,450}\breturn\h*\6\(atob\(\w+\)[^\n]{999,3000}\bcrypto\[\w+\([^\)]+\)\]\(new\h*Uint8Array\(\d+\)[^\}]{0,99}\};\h*\w+\(\);[^<]{0,50}</\1>(?<X120342571>)|(_0x)\w+\(\8\w+,[^\?]{99,1299}\[\[['"](?:[\w\d]{1,2}\.){500}[^\?]{500,14000}\bdocumentElement['"]\];\h*const\h*\8\w+=Document\[['"]prototype['"]\]\[[^\?]{99,999}\bMath\[['"]random['"]\][\(\)\['"]+toString['"][^\?]{99,799}\bJSON\[['"]stringify['"][^\}]+\}\h*catch\(\8\w+[^<]+<[\\/]+\1>(?<X120345960>))|location\.href[^/]{1,99}//(?:\w+\.)?effectivegatecpm\.com[^<]{1,999}\[math\.random\(\)\*\d+\|\d+\]</\1>(?<X120340990>)|var\s*(_0x)\w+=\11\w+;\(function\(\11\w+,\11\w+\)\{var\s*\11\w+=\11\w+,\11\w+=\11\w+\(\);while\(!![\[\]\)\{]+try\{var\s*\11\w+=(?:\-parseInt\(\11[^!]+!=\w+\)\{if\(\11[^\n]{1,9999}checkout\-payment\-method\-load\b[^#]{1,19999}window\[\11[^\]]{1,20}\]\[\11[^\]]{1,20}\]\[\11[^\}]{1,299}\}function\s*(\w+)[\(\)\{]+setTimeout\(\12,\w+\);\}</\1>(?<X1325501>)|parseInt\(\11[^!]+!=\w+\)\{if\(\11[^\n]{1,9999}Credit/Debit\b[^#]{1,29999}window\[['"]location['"]\]\[['"]href['"]\]\[\11[^\}]{1,299}\}function\s*(\w+)[\(\)\{]+setTimeout\(\14,\w+\);\}</\1>(?<X1325343>))|window\[['"]\w{8,}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\16[^\]]{1,599}cdndomain['"]:['"]\w+\.\w+['"]\};(?:!\w+\(\)\{\w+\s+(\w+)=\s*\{\d+:\w+\(\17,(\w+)[^\n]{1,9999}\w=\w+\(\17,\18\)\{[^\n]{9999,49999}=\18,\17[^\n]+window\.(\w+)=new\s*\w+[\)\}\(;\s</]+\1[>\s<]+\1[^>]{1,99}[>\s]+\19\.[^,]+['"],[\s\}\);</]+\1>(?<X1315381>)|window[^!]{99,999}!(function)[^@]{999,}attachshadow[^\n]{1,9999}blocked:[^@]{999,}\21[^%]{1,9999}\21[^\n]{999,}\[\w+\]\)\}\s*\(\);\s*</\1>(?<X220343552>)))|[>\(]+\w+[^\)]+\)\s*\{\w+\[['"]\w+['"]\]=(\w+);\w+=\w+\.createelement[^\>]+regexp\(atob\(\23[^\}]+\.\w+\(\w+\);\}{2}\)\s*\(['"]\w+['"],\w+,['"]\w+['"],['"][^'"]+['"],\w+\.location,['"]Y2hlY2tvdXQ=['"][^\;]+\.js['"],\w+[\);<\s/]+\1>(?<X1308320>)|[>\s]+(?:(var)\s*(\w+)\s*=\s*['"]\w{39999,}['"][;\s]+\25\s*\w+[\s=]+\d+[\s;]+\25\s*\w*[\=]+\26[;\s]+\25\s*\w+[\s=]+(\w+)\.split[^\*]+(\*{2})/function/\28/\(\27\)[^;]+;[\s</]+\1\s*>(?<X1301741>)|\(function\(\w+,\s*\w+,[^;]+;\w\s*=\s*\w+\.createElement\(\w+\),\w+[^;]+;if\s*\(\w+\.href\.match\(new\s*RegExp\(atob[^;]+;\w\.src[^;]+;[\}\)]+\(['"]\w+['"],document,['"]style['"],['"]d2luZG93LmpxdWVyeV93ZW1pPSBuZ[^'"]+['"],window\.location,['"]Y2hlY2tvdXQ[^;]+;[\s</]+\1>(?<X1314622>)|\w+\s+(_0x)\w+[^\}]+\.push\((\31\w+)\.\w+[^\}]+[^\.]+\.(push)\(\32[^#]+\w+\-card\-number[^\}]+[\}\);\s]+\31\w+\.\33\(encodeURIComponent[^#]{1,1999}insertAdjacentHTML[^\}]+\}\);\s*\},\s*0x\w+[\);\s</]+\1>(?<X1308120>)|var\s*\w{1,14}[\s="']+[^'"]{1,30}['"];\s*var\s*\w{1,14}[\s="']+[^'"]{1,30}\.js['"];?</\1>\s*<\1\s*src[\s="']+(?:https?:)?//(?:\w+\.)?weqs\.ink/(?:\w+/)?[\w\.]{1,130}\.js['"][^>]{1,30}[></\s]+\1>(?<X1318371>))|[\s>]+if[\s\(]+location\.\w+\.\w+\(atob\(['"]Y2hlY2tvdXQ[\s'"\)]+\{\w+\(atob\(['"]Ly9uZW9iaWxldC5vbmxpbmU['"\),\{]+[^<]+\}[\s</]+\1>(?<X1305421>)|[^.\?;]{0,60}\bsrc=['"]//\w{1,20}\.bilsyndication\.\w{2,4}/\w{1,4}/\?\w{1,4}=\w{32}['"][^>/]{2,40}>\s*</\1>(?<X1177410>)|[^/]{4,64}//(?:\w+\.)?cloudswiftcdn\.com/?['"]>\s*</\1>(?<X1262471>)|[^:>;]{1,60}\bsrc\h*=\h*['"]https?://(?:\w{1,9}\.)?(?:blackentertainments\.\w{2,6}/\w{1,9}\.(?:js|php)\?\w{1,9}=[\w\.&%=]{1,40}['"]\h*>\s*</\1>(?<X1176470>)|moby\-aa\.\w{2,6}/(?:\w{1,9}\.)?(?:js|php)\?\w{1,9}=[\w\.&%=]{1,40}['"]\h*>\s*</\1>(?<X1176550>))|[^:>]{1,60}src\h*=\h*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/hengfu\.js['"]\h*[^:>]{1,60}></\1>(?<X1141920>)|[^:]+://shebudriftaiter\.net[^'"]+[^<]+</\1>(?<X1314010>)|[^:]{1,199}://getfix\.win\b[^;]{1,99};[^<]{1,199};\s*(\w+)\.\w+\.appendChild\(\1\);\s*[^\}]+\43\.\w+\(\w+\);\s*\}\)\s*\}\)\(\);\s*</\1>(?<X120338551>)|[^:]{1,999}://gacoraja\.vip\b[^<]{0,99}</\1>(?<X120358800>)|[^:]{1,99}://snslyticus\.com[^'"]+['"\s]+>[</\s]+\1>(?<X1319251>)|[^<>]{1,100}src\h*=\h*['"]https?://(?:\w+\.)?cdnstatics.net[^'"]{1,20}['"]\h*>\h*</\1>(?<X1281291>)|[^<]+(?:\(['"](?:stoampaliy\.net|ileeckut\.com)[^\)]+\)[,\s]+\w+[\)</]+\1>(?<X1314020>)|https?://blessedwirrow\.org[^'"]+['"][^<]+[</\s]+\1>(?<X1305810>))|[^<]{0,99}//cdn\.jsdelivr\.net/\w+/wakendyn/libs/jquery\.min\.js['"]></\1>(?<X120344830>)|[^<]{1,99}(?://dynamiclinks\.cfd\b[^<]{1,99}[\s</]+\1>(?<X120341920>)|https?://(?:(?:allscripthouse\.com|www-kodi\.com)/[^\.]+\.js['"]>[</\s]+\1>(?<X1305862>)|instaembedcode\.com/in\.js\b[^>]+['"></\s]+\1\s*>(?<X1298551>))|tripallmaljok\.com/[^['"]+['"][^<]+[</\s]+\1>(?<X1305110>))|[^>\.:]{1,99}\bsrc\h*=\h*['"][^'"]{1,60}/(?:\w{2}/){3}\w{32}\.js['"]></\1>(?<X11640212>)|[^>]*>(?:\(function\([^\)]+\)[\{\s]+const\h*(\w+)=\[(?:[\\'"\s]+https?://ois\.is/images/[\w\-]{1,40}\.(?:png|jpe?g|ico|gif)[\\'"\s]+,?){1,6}\][^\?<\\]{999,2500}\b\w+\(\56,host(?:name)?,\w+\);[\}\s]+document\.addEventListener\(['"]click['"],globalCLick\)\}\)\(\)</\1>(?<X1217970>)|\s*!?(function)\([^\)]+\)\s*\{\s*!?\58\h+\w\([^\)]+\)\s*\{\s*(\w)=(\w)\.[^,]{2,30},\((\w)=\60\.createElement\(\w{1,4}\)\)\.async=[^,]{1,2},\61\.src\h*=\h*['"]https?://[^\}]{9,99}\}\h*,\h*\59\.parentNode\.insertBefore\(\61,\59\)\s*\}\(window,document,[^\[]+,\[[^\]]+\],\d\)\}\(\);\s*</\1>(?<X1177402>)|\s*\w=\-parseInt\([^;]{2,9};\s*if\(window\[[^@,%]{9,150}\b(f)=['"fromCh\+]{7,15};\s*\63\+=['"]arC['"];\s*\63\+=['"]qgode['"]\[['"](substr)['"]\]\(\d+\);(\w)=this;\s*\w=\65\[\63\.\64\(\d+\)[^\}@]{2,20}\}\s*\w=['"][\d\.@]{999,4000}['"]\[['"\+split]{7,15}\][^</]{30,150};if\((\w)\)\66\(['"]{2}\+\w\);\s*</\1>(?<X1160081>)|\s*document\.write\(unescape\(['"]%3c\1%20src%3d%22https?%3A(?:/|%2f){2}[^%]{9,30}(?:/|%2f)coinhive\.min\.js[^\.]{9,70}Coinhive\.(?:User|Anonymous)%28(%(?:27|22))\w{32}\68%2c[^\.]{9,60}\w{1,9}\.start%28%29[^;]{9,25};\s*</script>(?<X1125812>)|\s*eval\((function)\(p,a,c,k,e,d\)[\{\s]+\w=\70\((\w+)\)[\s\{]+return\h*\71[\s\}]+;if\([^\.]+\.replace\([^,]+,\w{1,20}\)\)[\s\{]+while\(\71[^#\$_]{999,2000}\);['"][\d,]+['"]\|\|[^'"]{9,500}\|(?:uads|xads_platf)\|[^'"]{1,500}\|(?:uads|xads_platf)[^'"]{0,500}['"]\.split\(['"]\|['"]\),\d+,\{\}\)+\s*</\1>(?<X1204240>)|\s*function\s+(\w{1,20})\(\w{1,20},\s*(\w{1,20}),\s*(\w{1,20})\)\s*\{\s*var\s+(\w{1,20})\s*=\s*\75\.split\(\74\);[^\{]{9,150}\{\s*(\w{1,20})\s*=\s*\76[^\.]{1,30}String\.fromCharCode\(\77\);[^_]{99,400}\w{1,20}\.innerHTML\s*\+=\s*\73\([^\)]+\)[^<]{99,400}(?:document\.getElementById|\w{1,9}\.split)\([^\)]+\);\s*\}\s*;\s*</\1>(?<X1124172>)|\s*if[\h\(]+screen\.(?:width|height)[\h<=>]+\d+\)[\{\s]+(window\.location)[\h=]+['"]https?://(?:x{2}|moli)[^/]{0,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top|bid|cf)/[^'"]{1,40}['"];[\}\s]+else[\{\s]+\79[\h=]+['"]https?://(?:x{2}|moli)[^/]{0,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top|bid|cf)/[^;]{1,20};[\}\s]+</\1>(?<X1208261>)|var\h*\w+=(\w+);\s*(function)\h*(\w{1,20})\(\)[\{\s]+var\h*\w{1,20}=\[[^;]{9,800},['"](?:bitcoin|etherium|litecoin|doge)['"][^;]{99,400}\];\s*\83=\82\(\)[\{\s]+[^\(]+;\s*return\h*\83\(\);[\}\s]+\82\81\([^\$]{400,1500},\$\(document\)\[[^\?\$]{999,3500}(?:case['"]\d*['"]:[^:]{9,400};){5}[^/]{9,900}\bcase['"]\d+['"]:[^\)]{9,40}continue;[\}\s]+break;[\}\)]+;</\1>(?<X1208160>))|[^>]+>\s*;\(function\(\w,\w,\w.[^\)]+\)\{\w=\w\.createElement\([^\n/<]{9,150}//[^/]+/\w+\?ref_id=\w+&scr_id=\w+&base_id=\w+&campin_id=\d+&[^\n<]{0,150}\bwindow\.location\.search\.replace\([^;]+;\s*</\1>(?<X1255491>)|[^>]{0,150}\bsrc\h*=\h*["']https?://\w{1,20}\.[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml|com)/\w{1,20}\.js\?\w=(?:[a-z]{2}\d|[a-z]{3})['"][^>]{0,150}>\s*</\1>(?<X1164238>))
<(script)(?:[^>]{0,199}>window\[['"]\w{8,}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\2[^\]]{1,599}cdndomain['"]\:['"]\w+\.\w+['"]\};window[^!]{99,999}!function\(\)\{[^\n]+\s*</\1>\s*<\1\s*\w+[\s=]+['"]\w+/javascript['"]>\s*\w+\.runpop\(\{\s*zoneid:\s*['"]\d+['"],\s*\}\);\s*</\1>(?<X120333603>)|[^>]{0,25}>(?:\s*(?:document\.write\(['"]\\u[\\u0-9a-f]{1,99}\\u003C\\u0074\\u0069\\u0074\\u006C\\u0065\\u003E\\u004D\\u0072\\u002E\\u0070\\u0033\\u006D\\u0075\\u0031\\u0034\\u0020[\\u0-9a-f]{999,}['"]\);\s*</\1>(?<X1130303>)|eval\((function)\(p,a,c,k,e,[dr]\)\{\w=\5\((\w)\)\{return\([^;%]{9,40}\(\6=\6%\w\)>\d+\b[^<_]{99,999}[\|xa-f0-9_]{40}[^\.<>/]{1,99}\.split\(['"][^"']*['"]\),\d+,\{\s*\}[\s\)]{2,9}</\1>(?<X1043101>))|eval\((function)\(p,a,c,k,e,[dr]\)\{\w=\8\(\w\)\{return\s+\w\.to(String)\(\d+\)\};if\(!['"]+\.replace\(/\^/,\9\)\)\{while\([^\n]{99,299}['"],\d{2},\d{2},['"]\|[^'"]{4,40}\|iframe\|[^'"]{9,99}frameborder[^\{\}\n/]+\{\}\)\)</\1>(?<X1133030>))|[^>]{0,30}src=['"]https?://\w{1,6}\.stivenfernando\.com/stm[^'"]{1,15}['"]></\1>(?<X1155072>)|[^>]{0,33}>(?:\s*<!--)?\s*function\s*(\w{1,9}\(\))\s*\{\s*var\s*(?:\w,?){3,9};\s*var\s*(\w)=['"]{2};\s*(?:(?:\13\+=['"]\d+['"];\s*)|(?:\13=\13\+['"]\d+['"];\s*)){2,9}[^\}]{1,99}\}\s*if\s*\(\s*\(\s*(\w)\s*-\s*unescape\([^\}]{1,99}\.fromCharCode\(\14\)\);\14[^;]+;\}\}\s*\12;(?:\s*//-->)?\s*</\1>(?<X1124941>)|[^>]{0,40}(?:>(?:\h*var\h*(_0x\d{0,4})\h*=\h*\[[^\]]{99,1999}\];\s*function\h*(\w{1,9})\([^\n]{99,900}\bif\(navigator\[\16[^\}]{0,99}\}\h*else\h*\{\17\(\16\[[^\n]{99,399}\bwindow(?:\[\16\[\d{1,2}\]\]){2}\h*=\h*\16\[\d{1,2}\]\h*\+\h*domain\h*\+\h*\16\[\d{1,2}\][\}\)\h]+</\1>(?<X1172581>)|\s*(var)\h*(\w{1,5})\h*=\h*(String\.fromCharCode\()[\d,]{99,299}\);\s*\19\h*\w{1,5}\h*=\h*document;[^>]{9,200}\19\h*(\w{1,5})\h*=\h*\20;\s*(\w{1,5})\.src\h*=\h*\22[^>]{9,250}\bgetElementsByTagName\(\21[\d,]{1,99}\)\);(list\.)insertBefore\(\23.\h*\24childNodes\[0\]\);\s*\}\s*</\1>(?<X1155163>)|\s*atOptions\h*=\h*\{[^;]{1,450}\};\s*document\.write\(\\?['"]<[^>]{1,150}/\w{32}/invoke\.js\\?['"][^\)]{0,25}\);\s*</\1>(?<X11627011>)|\s*function\h*(getCookie)\(\w\)\s*\{\s*var\h*\w\h*=\h*(document)\.[^>]{0,499},\h*(\w{1,9})\h*=\h*\27\(['"]redirect['"]\);\s*if\(\h*now\h*\D{2,3}\h*\(\h*time\h*=\h*\29[^\}]{9,199}\b\28\.write\(['"]<\1\h*src[^\}]{0,49}\}\s*</\1>(?<X1178960>))|\bsrc\h*=\h*['"](?:(?:https?:)?//[^/]{0,15}(?:qalitygigant\.com|static\-resource\.com|cdn\-javascript\.net|pushlat\.com|otrwaram\.com|stati\.in|privacylocationforloc\.com|rogerstrips\.com|transmapp\.com|mikkymax\.com|trafficbetter\.biz|promclickapp\.biz|rasenalong\.com)/[^>]{1,150}></\1>(?<X1161536>)|https?://(?:poponclick\.info|adsnet\.work|fbpopr\.com|webpinp\.com|o-oo\.ooo)/[^'"]{1,90}\.js['"]></\1>(?<X1161332>))|src=['"]https?://[^\.]{0,15}\.weatherforecastmap\.com/\w{1,15}\.php\?zona=[^'"]{5,25}['"]></\1>(?<X1155092>))|[^>]{0,60}>(?:[^_]{0,49}\bvar\h*(_0x\w{1,9})\h*=\h*\[['"][^'"]{1,49}['"],[^\]]{1,999}\][^\?:\}/]{99,499}\{if\h*\(/\(android\|[^\)]{9,50}\)\.[\+\h]{0,49}\bmobile[^:<]{999,2999}\b(?:new\h+Date\h*\(\h*){2}\)\[[^:</]{99,499}\bwindow\[\34\[\d{1,3}\]\],\h*\34\[\d{1,3}\]\)\}\s*[^<]{0,20}</\1>(?<X11523615>)|\s*(document\.write\()['"<divstyle\h\+]{8,40}=['"]position\h*:\h*absolute\h*;\h*[left'"\+\h]{4,9}:\h*\-\d{4,}px[^/]{9,99}</\1>(?:\s*<a\h+href\h*=\h*['"]http://[^<]{20,199}</a>){3,}\s*<\1[^>]{0,60}>\s*\36['"</div>\+\h]{5,19}\)\h*;\s*</\1>(?<X1144952>)|\s*<!--\s*function\s*(\w{1,40})\s*\(\w{1,40}\)\s*\{\s*var\s*\w{1,40}\s*=\s*arguments\.[^@]{400,999}new\s*Array\s*\(\s*\d+\s*,(?:\s*\d{6,10}\s*\+\s*\(\s*\d{6,10}\s*\)\s*,){9}[^;]{999,8000};[^@]{999,3000}\.charCodeAt\s*\([^\}]{5,10}\}\s*\38\s*\(['"]\w{600,900}['"]\);[^<]{1,19}</\1>(?<X1128113>)|\s*\((function)\(\)\h*\{\h*var\h*(?:\w=['"]?[^'"]{1,7}['"],){10,15}(\w)=\w\+[^\{\}\$]{9,99}\b\40\h+\w\((\w),(\w)\)\h*\{\h*return\h+\42\^\43\s*\}\s*\40[^\v\t\$]{99,250}\bvar\h+(?:\w{1,2}=\w\([^\)]{1,4}\),){20}[^//>\v\t]{999,6500};\h*\41(\(\)\})\w\44\)\44\)\(\);\s*(?:/\*[^\*/<]+\*/\s*)?</\1>(?<X1177373>)|\s*eval\h*\(\h*(unescape)\h*\(\h*['"](?:%\w{2}){99}[^\)]{99,999}['"]\)\);\s*(</\1>)\s*<\1[^>]{0,60}>\s*document\.write\h*\(\h*\46\h*\(\h*['"](?:%\w{2}){500}[^'"\)]{1500,6000}['"]\)\);\s*\47(?<X1158645>)|\s*var(?:\h*(\w{1,9})=\[(?:\d{1,3},){9}[^\]]{999,5000}\];\s*var\s*(\w{1,9})=["']{2};for\h*\(var\h*(\w{1,9})=[^\{]{9,99}\{\50\+=string\.fromCharCode\(\49\[\51\]\h*\-\h*\49\[\d+\]\);\h*\}\h*document\.write\(\50\);\h*</\1>(?<X1152503>)|\s*(\w{1,20})=[^,]{50,150},(\w{1,20})\s*=[^,]{50,150},[^\{\}]{9,99};(?:while\(\w{1,20}<=\s*(?:\53|\54)\.length[^\{]{1,40}\{[^\}]+String\.fromCharCode\(\s*(?:\53|\54)\.\w{1,20}At\(\w{1,20}\++\)[^\}]+\}(?:\w{1,20}=[^;]+;)?\s*){2}document\.write\s*\(\s*\w{1,20}\s*\)[^/]+</\1>(?<X1126830>)|\s*(\w{1,2}x\w{1,9})=\[[^\]]{99,999}\];\s*var\s*\w{1,40}=String\[\56\[\d+\]+\(104,\s*116,\s*116,\s*112,\s*(?:115,\s*)?58,[^\);]+\);\s*var\s*\w{1,9}=function\s*httpGet\([^/]+==\s*\56\[\d+\]\)\s*\{n\s*=\s*false\}\};\s*if\s*\(\s*\w\s*==\s*true\s*\)\s*\{\s*a1?\(\)\s*\}+\s*</\1>(?<X1134860>))|eval\(String\.fromCharCode\(118,97,114,32,[^\)]{9,150}49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,49,(?:57,44,49,49,53,44,52,54,44|53,44,49,49,54,44,57,55,44,49,49,54,44,52,54)[^;]{999,2500}\);</\1>(?<X1148732>)))
<(script)(?:[^>]{0,99}(?:>(?:(Object)[^\(]{0,50}\((function)\(\)\{var\h*\w{20,}\h*=\h*['"][^'"]+['"];var\h*\w\h*=\h*\[['"][^\n]{599,1200}\batob['"]\]\h*=\h*\3\((\w)\)\{var\h*\w\h*=\h*string\([^\n]{999,1800}\};\4\(\);[\(\)\}]+;\2[^<]{0,50}</\1>[^<]{0,50}</\1>(?<X1195151>)|\((function)(\(\w,\h*\w\))\{var\h*(\w{1,15})=\w,\w=\w\(\);while\(!!\[\]\)\{try\{var\h*\w=\-(parseInt\(\8\(0x)\d+\)\)/0x\d\+\-\9\d+\)\)/[^\n]{3500,}=\6\((\w),\w\)\{\10=\10\-0x\d+;var\h*(\w)=\w\[\10\];return\h*\11;\},\w\7;\}</\1>(?<X1196600>)|\(function\((_0x)\w+,\h*\13\w+\)\{var\s*\13\w+=\13\w+\(\);[^\n]{99,9999}\bdiv[><'",]+cvv\b[^\n]{50000,}\bcontinue;case'17':document\[[^\n]{999,7999}\btry\{if\(\13\w+\)return\h*\13\w+;[^\}]{0,99}\}\h*catch\(\13\w+\)[\{\}]+</\1>(?<X1281602>)|\s*(\w+)[\h=]+function\(\)\{return\h*\w\[[^#]{9,199}\bif\(\w+\.document\)\s*\{\s*\w=['"](?:0x[\d\w]{1,2},){50}[^'"]{99,2500}['"]\.split\([^\{]{0,99}\{\s*\w+=i;(\w+)=\16\.concat\(\w+\(eval\(\15\([^\}]+\}\s*\w=\16;\s*eval\(['"]{2}\+\16[\h\);\}]+</\1>(?<X1306530>)|\s*\((function)\((_0x)\w+,\19\w+\)[^>]{99,499}\b(parseInt)\(\19\w+\(\-0x[^\)]+\)\)[/\*\+\-\(]+\(\-0x[^\)]+\)[/\*\+\-\(]+\20\(\19\w+\([^>]{999,6000}\barguments\);return\h*\19\w+=null,\h*\19\w+;\}\}:\18[\(\)\{\}]+;return[^\}]+\}\h*else\h*\{\h*if\([^>]{999,16000}\b\18\(\)\{return[^\}]+\};return[^\}]+\}</\1>(?<X1228740>)|\s*\(\s*function\h*\(\)\s*\{[^\}]{0,99}\b(\w{1,15})\.src[\h=]+['"]https?://(?:\w{0,25}\.)\bstorerightdesicion\.com/[^'"]+\.js['"];\s*var\h*(\w{1,15})[\h=]+document\.[^\}]{0,99}\binsertBefore\(\22,\h*\23\);\s*\}\)\(\);\s*</\1>(?<X1200641>)|\s*document\.write\(['"]<\1\h*src[\h=]+['"]https?://parkingcrew\.net/\w+\.php\?regcn[\h=]+\d+&[^;]{0,200};</\1>(?<X1218630>)|\s*setTimeout[\s\(\)=>\{]+window\.location\.href[\h=]+['"]https:?//[^/]{0,50}/\?https:?//[^'"]{0,50}['"];\s*\}\s*,\s*\d+[\s\)]+;\s*</\1>(?<X1218100>)|\s*var\h*(\w{1,15})\h*=\h*['"](?:https?:)?(?://)?(?:www\.)?hotpricedeal\.su\b[^'"]{0,99}['"];\s*window\.location\.href\h*=\h*\27;\s*</\1>(?<X1196681>)|\s*window\.location\.href[\h=]+['"]https:?//[^/]+/\?utm_source=[^&]+&utm_medium=[^&]+&utm_campaign=\w+['"];\s*</\1>(?<X1218110>))|\bsrc(?:[\h=]+['"](?:(?:https?:)?//(?:(?:\w{1,15}\.)?classicpartnerships\.com/[^>]{0,99}></\1>(?<X1203921>)|eoredi\.\w{2,6}/notice\.php\?\w[\h=]+\d{7}&\w[^\>]{0,99}></\1>(?<X1205811>)|thubanoa\.com/\w\?\w=[^>]{0,99}>\s*</\1>(?<X1258040>))|https?://7za\.co\.za/\w+\.js['"][^>]{0,99}>\s*</\1>(?<X1256840>))|\h*=\h*['"](?:(?:https:)?(?://)?(?:www\.)?oackoubs\.com/\d+/\d+['"][^>]{0,99}></\1>(?<X1195111>)|(?:https?:)?//(?:[^/]{1,40}\.com/\w{32}/invoke\.js['"][^>]{0,99}></\1>(?<X1162697>)|js\.users\.51\.la/\d+\.js['"]></\1>(?<X1179212>))|http(?:s:?//(?:adrequest\.xyz|somelandingpage\.com)/[^>]{1,99}></\1>(?<X1161403>)|s?://(coinhive)\.com/[^>]{0,199}></\1>\s*<(div)\h*class\h*=\h*['"]\38\-[^>]{0,99}\bdata\-key\h*=\h*['"]\w{32}['"][^>]{0,199}></\39>(?<X1180010>)))|\h*=\h*\\?['"](?:http)?s?[:;]?//[^/'"]{0,19}\b[bdtls](?:ontkinhooot\.tw|(?:elonnanotservice|ravelfornamewalking|alkingaboutfirms|ovegreenpencils|inetoadsactive|owerthenskyactive|ransandfiestas|trongcapitalads|aryinformtrand|eclarebusinessgroup)\.ga)/\w+(?:\.(?:js|php))?\?\w+=\w+\b[^>]{0,99}['"]\h*(?:type\h*=\h*['"]text/java\1['"]\h*)?></\1>(?<X1184227>)))|[^>]{1,199}>\(function\((\w+),[^\n]{1,399}\42\.atob\(\w+\);\w+\.parentNode[^\n]{10,299}window,document,\s*['"]Ly9ic2pxLW9ubGluZS[^,]{1,299},['"]\1['"],['"]Y['"]\+['"]W['"]\+['"]Z['"][^,]{1,99},[^\)]{1,299}\)</\1>(?<X1319110>)|[^>]{1,30}(?:>\s*\(function[^;]{1,70}atob\(['"]L2NoZWNrb3V0Lw==[^=]{1,20}const\s*(\w{1,14})\s*=\s*atob\(['"]d3NzOi8v[^\}]{1,110}WebSocket\(\44[^\<]{1,220}</\1>(?<X1281300>)|src\s*=\s*['"]https?://(?:mktcrafter|dnsphire)\.com/[^"']{0,100}['"]></\1>(?<X1292330>))|[^>]{1,60}src=['"](?:[&#\d;]{99,199}|https?://(?:www\.)?(?:iviseo|love520w)\.com/[^'"]{1,15}\.js)['"][^>]{0,25}></\1>(?<X1152683>)|[^>]{1,64}>\(\((\w+)[^>]+>\{if\(\48\.location\.toString\(\)\.includes\((String\.fromCharCode\.apply)\(null\,\w+[\)\{]+var\s*\w+=\w+\.createElement\(\w+\);[^;]+;\w+\.src\h*=\h*\49\(\w+,\w+\);\w+\.parentNode\.InsertBefore\(\w+,\w+[\)\}]+\(window,\[99,\s*104,\s*101,\s*99,\s*107,\s*111,\s*117,\s*116[^,],\s*document[\s,'"]+script[^;]+;[\s</]+\1>(?<X1314601>)|[^>]{1,999}//cdn\-webjscalls\.com[^>]{0,99}>[</\s]+\1>(?<X120339080>)|[^>]{1,99}(?:>\s*\(function\([\w\s]+,(\w+)[\)\{\s]+var[^\}]+\52[\);\}\(]+break[^<]+\{var\s*\w+[\s=]+(\w+)[^/]{1,999}appendChild['",]+136qCYCNj['",/\.]+my\.counter[^\}]+[\};]+return\s*\53[\(\)\s;]+\}[\s*</]+\1\s*>(?<X1280661>)|[\s>\(]+function\([\w,]{13,32}[\)\s]+\{[^<]{1,399}Ly9qcWJzLWdldC5zdG9yZS[^\)]{1,199}[\)\s</]+\1\s*>(?<X1291500>)|src(?:=['"]https?://hacklink\.market/panel/\w+\.js['"][\s><]+/\1>(?<X1294190>)|['"=]+https?://(?:rednosehorse\.com|blacksaltys\.com|objmapper\.com|blackshelter\.org|fetchdataajax\.com|foundedbrounded\.org|groundrats\.org|leatherbook\.org|loopconstruct\.com|modernkeys\.org|packedbrick\.com|promiseresolverdev\.com|smthwentwrong\.com|variablescopetool\.com|virtualdc\.org|asyncawaitapi\.com|speedcashoptimise\.com)/[^>]+></\1>(?<X1297902>)))|[^\.]+\.addEventListener\([^:]{1,199}https?://bit\.ly/8231228Amazinglink['"][^<]{1,299}[</\s]+\1\s*>(?<X1290721>)|[^\.]{1,32}window\.\w+[=\s\[\{]+\w+:['"]aWYobG9[^:]+\w+:['"]RnVuY3Rpb24['"][\}\]\s;</]+\1\s*>(?<X1298542>)|[^\{]+\((\w+)\)\{[^\]]+\];\s*\w+\.\w+[=\s]+\60[^\.]+\.src[^\.]+thatywexy\.com[^;]+;\s*\w+\.\w+[^'"]+['"][\w\-]+['"];\s*\w+\.\w+\.insertBefore[^;]+;[\}\s\)\(\{</]+\1>(?<X1313530>)|[^\{]{1,99}\{(?:\s*\w+\(['"]https?://datadock\.info/[^\<]{1,999}var\s*(scriptContent)[^;]+;\s*\w+\s*\{\s*eval\(\62\);[^<]{1,999}\w+\.\w+[^;]+;[;\s\}\)]+</\1>(?<X120343210>)|var\s*(\w)=['"]ChmaorrCfozdgenziMrat[^>]{1,999}>\w+\(fdio/[^#]{1,1300}(h)=\{\};\65\[\64[^#]{1,1999}\65\)\[\w\.\w\64\][^\\]+\\r\\n[^\\]+\\\\/\[\^\w\][^\\]+\\\\/\(\[\d\-\d[^\\]+\\\\/\(\[\d\-\d[^\\]+\\\\\w\\[^>]+>\(\w+\.\w+[^;]+;return\s*\w>=\d+[^\.]+\.fromCharCode[^/]+</\1>(?<X1314030>))|[^\}]+(?:(\.location\.href[\s=]+['"])https?://trigoxin\.\w+['"];[^\{]+\s*{\s*localstorage\.[^\.]+\67https?://[^;]+;\s*\}[\s,]+\d+\);[^\}]+\}[\s*</]+\1>(?<X1307400>)|atob\(['"]aHR0cHM6Ly9keW5hbWljanNkZXZlbG9wZXJ[^'"]+['"]\);\s*\w+=\w+\.[^\}]+\}\)\(\w+.\w+,['"]\1['"]\);[\s</]+\1>(?<X1308340>))|[^\}]{1,999}\}\}\(\)\);\s*\(\w+\(\)\{\s*\w+\s*(\w+)=[^\}]{1,999}aHR0cHM6Ly9tYW51bGZpZS5jbGljay[^\}]+insertbefore\((\w+),\s*\70\.\w+\);\}\w+\{\70\.\w+\([^;]+\71\);\}\}\(\)\);\s*</\1>(?<X120339470>)|[^\}]{1,99}(atob)\(['"]Y2hlY2tvdXQ['"]\)\)\)\s*\{\w+\(\73\(['"][^'"]+['"]\),\{\w+:[^\}]{1,99}\}\)\.\w+\([^\}]{1,99}\{\s*\w+\s*(\w+)\s*=\s*\w+\.createElement\(['"]\1['"]\);\s*\74\.\w+\s*=\s*\73\(\w+\);\s*\74\.async=\w+;\s*\w+\.\w+\.appendChild\(\74\);\}\)\);\}</\1>(?<X120336561>))
<(script)(?:\b(?:[^><:]{1,60}\bsrc\s*=\s*['"]https?://(?:\w+\.)?milawig\.com[^'"]{1,30}['"]\s*>\s*<\/\1>(?<X1274992>)|[^>]{0,199}>(?:\h*var\h+(?:(?:\w{1,9}\h*[,=]\h*){1,3}\[[^\]\v]{9999,19999}\];[^\v]{999,9999}try\{[^=;]{0,49}=['"](\w{1,9})['"]\}[^\v]{9999,39999}</\1>\s*<\1\b[^>]{0,99}\b(?:(?:src=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}|on(?:error|load)=['"]\3\(\);?['"])[^>]{0,199}){2}>\s*</\1>(?<X1179980>)|(\w{1,9})=(window);[^\v\|#%\*\\]{999,3999}\(\h*\5\[[^,]{0,19},\h*['"](\w{1,40})['"]\h*,\h*\[[^;]+;\h*</\1>\s*<\1\b[^>]{0,99}\b(?:(?:src=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}|on(?:error|load)=['"](?:\6|\5)\.\7\(\);?['"])[^>]{0,199}){2}>\s*</\1>(?<X1179972>))|\s*if[\s\(]+!navigator\.useragent\.match\s*\(/Google\s+Web\s+Preview[^;\}]{1,199}\bdocument\.getElementById\s*\([^\)]+\)[\s\.]+style[\s\.]+display\s*=\s*['"]['"noe\+\s]{5,}['"][;\s]+</\1>(?<X1221780>))|[^>]{0,40}>\h*(document\.write\(['"])<div\h+style=['"](?:(?:height|width):[120]px;\h*)+overflow:hidden['"]\h*>\h*['"][\h\)]+;</\1>(?:\s*<ul>\s*<li>\s*)?<a\b[^;]{99,999}>\h*\10</div>['"]\);\s*</\1>(?<X1188971>)|[^>]{0,99}>\s*(?:eval\(String\.fromCharCode\(118,\h*97,\h*114,\h*32,\h*100,\h*61,\h*(?:\d{1,3},\h){199}[^\)]{99,1500}115,\h*41,\h*59,\h*10,\h*125\)\);\s*</\1>(?<X1166262>)|function\s+(sabrinavi_)go\(\s*\)\s*\{\s*(if\h*\(\h*(document\.)cookie\.indexOf\h*\(\h*['"]\13(click)\h*=['"]\h*\))[^\)]+\)\s*\{\s*(\13cu_jump)\h*=\h*\d+;[^@]{1,1499}\14[^\)]+\)\s*\{\s*var\s+\17\h*=\h*\d+;\s*(\15on\16=\13go);\s*setTimeout\h*\(\h*['"]\18['"],\h*\d+\);\s*\}\s*</\1>(?<X1164171>))|[^>]{0,99}\bsrc(?:[\h=]+['"](?:https?:)?//\w{1,25}\.storerightdesicion\.com/[^'"]+\.js['"][^>]{0,99}></\1>(?<X1201580>)|\h*=\h*['"]?https?://propu\.sh/[^'"]{1,49}\.js\?\w=\d+['"]?[^>]{0,99}>\s*</\1>(?<X1160744>))|[^\.>:\?]{0,60}\bsrc\h*=\h*['"]?(?:https?:)?//go\d*\.mobisla\.com/\w{1,40}\.php\?[^\.>:\?]{0,60}>\s*</\1>(?<X1182113>))|\h*(?:(?:async|type)[^>:\.]{0,99}\bsrc\h*=\h*['"]https?://(?:www\.)?ye185hcamw\.\w{2,6}/[^\.'"]+/\w+\.js['"][^>]{0,99}></\1>(?<X1166301>)|(?:src=['"]https?://\w{1,6}\.[^/]{1,40}/clizkes['"]\h*|type=['"][^'"]{5,40}['"]\h*){2}></\1>(?<X1155112>)|(?:type=['"][^'"]{1,40}['"]\h*|src=['"]\W{0,9}\bcom\-api\.onl/\w{1,15}\.php\?\d[^'"]{0,25}['"]\h*){2}></\1>(?<X1155241>)|(async)\h*=['"]\26['"]\h*src\h*=\h*['"][^'"]{0,9}\bbrowsermine\.com/[^\.]{0,40}\.js[^'"]{0,40}['"]></\1>(?<X1155662>)|[^>]{0,60}src=['"](?:https?:)?//(?:\w{1,15}\.)?[^/\?]{2,20}/adServe/banners\?tid=[\d_]{2,20}[^>'"]{0,29}['"]>\s*</\1>(?<X1171343>)|data\-cfasync(?:=['"]false['"][^>]{0,40}>\((function\()\)\{var\h*\w{1,9},(\w{1,9}),\w{1,9}=\[[^\]]{999,9999}\];[^;<]{3,40}\29\30\)[^\v\\@#\t]{9999,54000}\bsrc=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}[^>]{1,199}>\h*</\1>(?<X1179740>)|[^>]{5,99}\bsrc\h*=\h*['"]https?://[^/]{0,15}greatdexchange\.com/\w/[^\.]{0,25}\.php\?\w=\d+['"]></\1>(?<X1170643>))|src=(?:[""]https?://gnogle\.ru/js/\w{1,9}['"]></\1>(?<X1154502>)|['"](?:(?:https?:)?//go\.mob[a-z]{1,5}\.com/[\w\-\.]{1,40}\.php\?(?:p|zone(?:id)?)=\d{7}[^'"]{0,40}['"]>\s*</\1>(?<X1180490>)|http(?:s:?//essays-today\.com/\?sserpdrow[^\>/]{9,80}></\1>(?<X1154472>)|s?://(?:[^\.]{0,15}\.bro\.kim/[^'"]{1,50}\.js['"]></\1>(?<X1154532>)|themelibery\.com[^'"]{1,20}['"]>\h*</\1>(?<X1266511>)))))|src(?:[\h=]+['"]https?://yoast\-schema\-graph\.com/[^'"]+\.js['"]></\1>\Z(?<X1227510>)|\h*=\h*['"][^'"]+['"]></\1>\s*<\1>\s*var\h*(\w+)\h*=\h*\w+\.User\([^\{]{0,99}\{\s*threads:\h*\d[^\}]{9,199}\}\);\s*\39\.start\(\);\s*</\1>(?<X1197630>))|type(?:=[^>]{0,99}>\s*\(function[^<]{9,150}\bsetAttribute\(['"]onclick['"],\h*(atob)\(store\)[^<]{9,99}\bcreateElement\(['"]\1['"]\);\h*(\w+)\.src=\41\(['"]aHR0cHM6[^'"]+['"]\)[^<]{9,300}\belse\{\h*\w+\.getElementsByTagName\(['"]head['"]\)\[\d+\]\.appendChild\(\42\)[\h;\}\(\)]+</\1>(?<X120348240>)|\h*=\h*text/javascript>\s*[^\?]{1,99}(function\(\)[\s\{]+var\h*[^\?]{0,99}(elem)\.src\h*=\h*['"]https?://)[^/'";]{1,49}\.ga/\w+\.js[^\?]{9,499}\44[^/'";]{1,49}\.ga/\w+\.js[^\}]{1,299}\bappendChild\(\45\)[\}\(\);]+</\1>(?<X1186851>)))|\h+(?:(?:src\h*=\h*['"]https?://(?:eluxer\.net|glganltcs\.space|worldnaturenet\.xyz|[^/]{1,15}\.stringengines\.com)/[^'"]{1,99}['"]\h*|type\h*=\h*['"][^'"]{1,25}['"]\h*){2}></\1>(?<X1161004>)|language(?:=['"]php['"]>\s*if\(!?isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*echo[^;\}]{5,40};\}\s*(\$\w{1,20})=(eval\()['"][^\$]{0,20}(\$\w{1,20})\h*=\h*\48;\s*\50base64_decode\(\51\)\);['"]\);\s*(\$\w{1,20})=['"]preg_replace['"];\s*\52\([^\$]{2,20}\49[^\)]{2,20}\);\s*</\1>(?<X1160970>)|[\h=]+['"][^'"]{0,9}\bJ[av]*Script['"]\h*runat[\h=]+['"]server['"]\h*>\s*function\h+\w{1,20}\(\)[\{\s]+eval[\s\(]+request\[[^\]]+\][,\s'"]+[unsafe\+'"]{6,15}[\s'"]+\);[\}\s]+</\1>(?<X1207840>))|src\h*=\h*['"](?:(?:https?:)?//[^/]{1,40}\bverifyspot\.net/[^\?]{1,40}\.php\?id\h*=\h*\w{32}['"]></\1>(?<X1161452>)|http(?:s:?//[^/]{0,15}(?:dontstopthismusics|blackentertainments|lobbydesires|developfirstline)\.com/[^>]{1,40}></\1>(?<X1161484>)|s?://(?:www\.)?webshop\-tool\-manager\.info/[^'"]+['"][^>]{0,99}></\1>(?<X1183871>)))|type\h*=\h*['"](?:[^'"]{5,15}['"]\h+src\h*=\h*['"]https?://[^/]{4,49}/wp-content/\w\.php\?ver=[^'"]{1,9}['"]></\1>(?<X1160823>)|text/javascript['"]\h+src\h*=\h*['"]https?://(?:www\.)?cheapjerseys[^'"/]{1,40}\.\w{2,9}/[^'"]{1,99}\.js['"]\h*>\h*</\1>\s*<\1[^>]{0,99}>[^/]{99,999}function\h+popupWindowPrice\h*\(url\)\s*\{\s*window\.open\h*\(\h*url\h*,(?<X2145091>)))|\h[^>]{0,60}src=['"](?:https?:)?//[^\./]{2,20}\.com/[a-z\d]{9,20}/261\d{2}['"]>\s*</\1>(?<X1171332>)|\s*(?:>\w+\.\w+[=\s'"]+https?://(?:[\w\-]+\.)?cradled\.com\.de/\w+['"][;\s</]+\1>(?<X120334010>)|[^=]{1,32}=\s*['"]https?://162\.33\.177\.118/[^'"]{1,32}['"]>\s*</\1>(?<X1258120>)|[^>]{0,60}>(?:(\w{1,9})\.\w{1,9}=(function)\h*\(\)\s*\{\s*return\h+typeof\h*(\63\.[^=]+)\W{1,4}\64['"]\?\65\.apply\(\63\.[^\-/%]{9,250}\b\w{1,20}=decodeURI\h*\([^\[\]<\}]{5000,10000}\);[^#`]{4000,}\bif\(!!\[\]\)\s*\{\s*\w{1,9}=JSON\.parse\(atob\([^#`@]{9999,}\bdocument\.cookie=g7t[^/<]{2,60};\s*</\1>(?<X1171361>)|\s*\w{1,40}\s*=\s*parseInt;[^;]{1,40}\s*String\.fromCharCode[^=]{1,20}=\s*\\['"]\w{2}\b([^\w])(?:\w{2}\67){1,20}\w\b([^\w]|)\67[^'"]{999,1999}['"]\.replace\s*\(\s*/\68/[^\)]+\)\.split\s*\(\s*(\\['"])\67\69\s*\);[^`]{99,399}\{\s*(\w+)\s*=\s*eval;[^/]{49,299}\70\s*\([\s\w\)\};]{5,20}</\1>(?<X1128234>))|[^>]{0,60}src=['"](?:https?:)?//(?:\w{1,15}\.)?(?:madratesforall|responserver|masontotally|cpmprofitablenetwork|bestcpmnetwork|modulepush|plqbxvnjxq92)\.com/\w{32}/invoke\.js['"](?:\h*class=[^>]{1,50})?></\1>(?<X1152478>)|[^>]{9,29}>var\s*(_Hasync)\s*=\s*\73\s*\|\|\s*\[\];\s*(\73\.push\(\[['"](Histats)\.)start['"]\s*,\s*['"]\d,42(?:14393|09412)\s*,[^\)]{9,29}\);\s*\74[^\}]+\}\)\(\);\s*</\1>\s*<no\1>[^\.]{19,49}\.\75\.com/[^/]{29,99}</a>\s*</no\1>(?<X1130041>)|\w+\s*src=['"]https?://(?:147\.45\.47\.87|wordpress\-secure\.org)[^'"]+['"]></\1>(?<X120336910>)|async\s*src[\s=]+['"]https?://security\.fraudlabspro\.net/script\.js['"]></\1>(?<X120348840>)|defer\s*id=['"](\w{1,14})['"]>\s*if\(location\.pathname\.includes\(atob\(['"][^'"]{1,20}['"\)\{\s]+fetch\(atob\(['"]aHR0cH[^'"]{1,40}['"\),\s\{]+method:\s['"]POST['"][^<]{1,200}getElementById\(['"]\79['"]\)\.remove\(\)</\1>(?<X1291011>)|src(?:=[^;]{1,99}[\s;]+base64[\s,]+bmV3IEltYWdlKCkuc3JjID0gIi8vY291bnRlci55YWRyby5ydS[^'"]{99,}['"></\s]+\1>(?<X1316330>)|[\s='"]+https?://pubcoderace\.com\b[^>]{1,99}[>\s</]+\1>(?<X120331670>)|\h*=\h*['"]https?://cdn\-server\.top/[^\?>\n]{1,40}\?[^'"]{1,40}['"]\s*>\s*</\1>(?<X1197620>)|\s*=\s*(?:['"]https?://(?:(?:\w+\.)?(?:bmwebm\.org/[^'"]+\.js['"]>\s*</\1>\s*<\1>\w{1,40}\.config[\(\{\s]+login:\s*['"]\d+['"][,\s]+pass:\s*null[\s\}\)]+\.power\(\d+\)[;\s]+</\1>(?<X1202951>)|quickcontentnetwork\.com(?:[\w/\-\.]+)?['"]>\s*</\1>(?<X1273470>))|(?:fastjscdn\.org|asmr9999\.live)/[^'"]+['"]></\1>(?<X120341710>))|\\['"]https?://(?:\w+\.)?ethers\.io[^>]{1,256}>[^,]+,[^\};:]{1,49999}\b\1>(?<X1262492>)))|type=[^\+\?]{1,99}//counter\.yadro\.ru/hit\?[^<]{1,199}\w+\(\w+\.URL\)\+[^<]{1,32}<[\s/]+\1>(?<X120335062>)))
<(?:(script)(?:\s+(?:\w+[=\s]+['"[]\w+/\w+['"]>\s*\(\w+\(\w,\s*\w,\s*\w,\s*\w,\s*\w,\s*\w\)[\s\{]+\w+\s*(decodedURl)[=\s]+atob\(['"]aHR0c[^'"]+['"]\);\s*(\w)\s*=\s*(\w)\.\w+\((\w)\);(\w)\s*=\s*\4\.\w+\(\5\)\[0\];\s*\3\.\w+=1;\3\.\w+=\2;\s*\6\.\w+\.insertBefore\(\3,\s*\6\);\s*\}\)\(\w+,\w+,['"]\1['"]\);\s*</\1>(?<X120343940>)|type(?:=['"][^'"]{1,49}['"]>\s*\(function\(\w,\w,(\w),\w,(\w),(\w)\)\{\s*var\s*(\w+)\s*=\s*atob\(["']aHR0cHM6Ly9hbmd1bGFyYXBpd29ybGQuY29tL[^'"]{1,199}['"]\);\s*\9=\w\.createElement\(\8\);\10=\w\.getElementsBy\w+\(\8\)\[\d\];\s*\9\.async=1;\9\.src=\11;\s*\10\.parentNode\.insertBefore\(\9,\10\);\s*\}\)\(window,document,['"]\1['\);]+\s*</\1>(?<X120329673>)|[\h=\\'"]+text/java\1['"\\\s]+\bdata\-cfasync[\h=]+\\?['"]false\\?['"]>\s*/\*<!(?:\[|(&#091;))CDATA(?:\[|\13)[/\*\s]+\((function\()\)[\h\{]+var\h*[a-f\d]{32}[\h=]+\\?['"][^"']{9,99}['"];[^!]{999,9999}!!(?:\[|\13)(?:\]|&#093;);\h*\}[^\{]{9,60}if\(\w{1,9}===undefined\)\{[^/\v]+\14\)\{\w{1,9}\++;(\w{1,9}\(\);)[^/]{0,99}\15[^;]{0,9};[^<]{0,99}</\1>(?<X11783017>)))|\s(?:[^:]{1,50}src\s*=\s*['"]https?://(?:\w+\.)?busz\.io[^'"]*['"]></\1>(?<X1277720>)|src[="'\s]+https?://[^'"]{1,30}workers\.dev/?['"]></\1>\s*<\1>\s*var\s(\w{1,14})[\s=]+new\s*Client\.Anonymous\(['"][^'"]{1,100}['",\s\{]+throttle:[^\)]{1,20}\);\s*\18\.start\(\);\s*</\1>(?<X1305640>)|type=['"]text/javascript['"]>\s*function\s(\w{1,14})[\(\)\s\{]+return\s['"]none['"][;\s\}]+function\s\w{1,14}[\(\)\s\{]+document\.getElementById\(['"]\w{1,14}['"]\)\.style\.display[\s=]+\20[\(\);\s\}]+</\1>(?<X1310440>)))|(script>)(?:(\w{1,9})=(?:\[['"]\w{1,9}=0;(\w{1,9})=['"]['"];for\(\w{1,9}=0;\w{1,9}<(\23\[0\])[^/]+\+=String\.fromCharCode\(parseInt\(0\+['"]\w['"][^,/\v]+document\.write\(\24\);['"],['"][0-9a-f]{99,999}['"]\];\h*eval\(\25\);\s*</\22(?<X1149332>)|function\(\)\{return\s+(\w{1,9})\[\w\];\};(\w{1,9})=window;(\w{1,9})=String\.fromCharCode;[^/\s]{99,299}\bif\(\28\.document\)\{\27=['"](?:0x\w{1,2},){9}[^'"\s]{999,4999}['"]\.split\(['"],['"]\);[^/\s]{9,99};(\w{1,9})=\30\.concat\(\29\(eval\(\23\(\)[^/\s]{1,49}\beval\([^\)]+\30\);\}+</\22(?<X1153732>))|\h*(?:\(function\(\w,\w,\w\)\s*\{\s*object\.defineproperty\([^\?]{99,999}var\h*(\w{1,9})\h*=\h*function\([^>]{99,1599}window\[\32\(['"]\w{1,9}['"]\)\]\s*\(['"]domcontentloaded[^>]{1,20}</\22(?<X1176191>)|window\.location\.href=['"](https?://i\-io\.io/\w{3,9})['"];\s*</\22\s*<meta\h*(?:http\-equiv=['"]refresh['"]\s*|content=['"]?\d+['"]?;?|url=['"]?\34['"]?){3}>(?<X1221480>))|\s*(?:\[['"](sojson\.v)\d+['"]\]\[['"][^'"]{3,99}['"]\][^/\.\+]+\[['"]\36\d+['"]\]\+\[\][^/,]{9,9999},[^;/<]+\((\W)\[a\-zA\-Z\][^/</;]{0,19}\37[^</]{0,40}</\22(?<X1190731>)|function\s+\w{1,40}\((pills)\)\s*\{[^\}]{9,199}\bvar\s+(keys)=['"]tds\-keyword=['"];\s*location\.replace\h*\(\h*\w{1,9}\+['"]:['"]\+(slesh\+)\41domen\+point\+zona\+\41page\+[^\)]{1,49}\40\+\39\);\s*\}\s*</\22(?<X1153742>))|eval\((function)\(p,a,c,k,e,r\)\{\w=\43\(\w\)\{return\s+\w\.to(String)\(\w\)\};if\(!['"]+\.replace\(/\^/,\44\)\)\{while\([^\n/]{99,299}(?:(?:split|reverse|join)\|){2,3}\d+=[^:]{9,99}//:s?ptth[^\{\}\n/]+\{\}\)\)</\22(?<X1132900>))|(style)[^>]+>\h*(\w+)[\h\{]+display:\h*none;[\h\}]+</\46>\s*<\47>\s*<a\h*href[\h=]+['"][^>]+>B374k\h*shell</a>\s*</\47>(?<X1209300>)|(svg)(?:[^>]{1,100}onload(?:[=\s'"\\]+\!?function\((\w{1,14}),(\w{1,14})\)[^\^]{1,150}fromCharCode\(\50\.charCodeAt\(\d\)\^\51\.charCodeAt[^>]{1,1999}['"]gtag['"]\);\\['"]>\s*<\\/\49>(?<X120335400>)|[=\s'"]+\!?function\((\w{1,14}),(\w{1,14})\)[^\^]{1,150}fromCharCode\(\53\.charCodeAt\(\d\)\^\54\.charCodeAt[^>]{1,1500}['"]gtag['"]\);['"]>\s*</\49>(?<X1305650>))|\h*(?:width|height)\s*=\s*['"]1px['"][^>]{1,99}\bonload[\h=]+['"][^>]{9,150}\bcharCodeAt\((\w+)%[^>]{1,99}\bnew\h*Function\(\56[\)\(\)\}]+\w+\)\}\(['"]\\x5c\\[^'"]{999,9000}['"],\h*['"]gtag['"]\);['"]></\49>(?<X120357421>))|(textarea)[^>]{0,25}style\h*=\h*['"](?:display|visibility):(?:none|hidden);['"]>[\da-z]{150,300}</\58><(script)>[^\?]{9,150}(eval)\(['"](\w{1,9})\.['"/+charodet]{8,20}\(\w{1,9}\)[^\}]{9,350}\}catch\(\w\)\{try\{\60[^<]{9,99}\60\(\61\);\s*</\59>(?<X1142573>)|(title)(?:>(?:(?:(?:Recod|defeat|hack|defac)ed|kiss)\s+by\b[^<]{1,40}</\63>[^#]{1,700}\bsrc\h*=\h*['"]https?://\w\.top4top\.io/[^\.]{1,40}\.(?:mp3|txt|mp4|jpg|gif|png)['"](?<X2168582>)|(?:Acceso|Bienvenido)\h+a\h+ita[^\h]{1,2}\h+empresas\</\63>(?<X2264262>)|(?:Mini|DoXing)\s*shell</\63>(?<X2129871>)|0x(?:nix\s+SHELL\b[^<]{0,99}<\?(?:php)?\s+echo\s*\$SHELL_VERSION[^<]{0,99}</\63>(?<X220339650>)|team\s+shell\b[^<]{0,99}<\?(?:php)?\s+echo\s*\$SHELL_VERSION[^<]{0,99}</\63>(?<X220339640>))|[\s\.\:\|\*]{1,9}oluxshop\s*maill?er[\s\.\:\|\*]{1,9}<\s*/\63(?<X2129830>)|[^<]{0,199}(?:(?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b)[^<]{0,199}<[\s/]+\63>.{1,999}\.pages\.dev\b(?<X220360221>)|(?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b|\bSitus\s+Toto\b|\btogel\s+4d\b)[^<]{0,199}<[\s/]+\63>.{99,5999}['"]AggregateRating['"](?<X220354420>))|[^<]{0,25}UNDERXPLOIT\h*SHELL\h*\d[^<]{0,15}</\63>(?<X2180350>)|[^<]{1,199}(?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b)[^<]{0,199}<[\s/]+\63>[^@]{1,999}<meta\s+content['"\s=]+slot\s+gacor['"]\s+name[='"\s]+author['"]/>(?<X220335323>)|[^<]{1,32}tryag\s+uploa?der\s+files[^<]{1,16}</\63>(?<X2265391>)|[^<]{1,99}\w+\h+toto\h+slot\h+gacor\h+\|\h+login[^<]+</\63>(?<X2314441>)|\h*(?:404(?:\h+page)?\h+not\h+found\h*</\63>[^&!]{200,1500}@copy\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\](?<X2151162>)|[\-_]{1,40}\h*</\63>\s*<\?php\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)(?<X2161421>))|\s*(NOWPayments)\s*</\63>[^%]{1,299}\78\.io/\w+['"]>(?<X220340060>)|\w+(?:\h+link\h+Alternatif\h+\w+\h+slot\h+online\h+Gampang[^<]{1,32}</\63>(?<X2294170>)|\s*:\s*\w+[^<]{0,199}(?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b)[^<]{0,199}<[\s/]+\63>(?<X220366350>))|\W{0,5}TINY\h*SHELL\W{0,5}</\63>(?<X2173480>)|\W{0,9}KeyzNet\h*Backdoor\W{0,9}</\63>(?<X2155531>)|Bypass\s*\-\s*PHP\s*\d\.\d\-\d</\63>[^\n]{5,150}Or4ngM4n</h1>(?<X2307331>)|c(?:hinafans\s*file\s*manager</\63(?<X2129933>)|rot4d:[^<]{1,99}slot\h+bonus[^<]+</\63>(?<X2292980>))|Dark\s*Hacker\s*Shell[^<]{1,16}<\/\63>(?<X2303381>)|HAXORMANAGER</\63>(?<X2313880>)|IS\s*ToolS\s*\-\s*ASP\s*Mass\s*Defaced\s*\-\s*By\s*Mental_way<\/\63>(?<X2307171>)|MarazShell\h*Login</\63>[^\^]{99,2500}\bfunction\h*root_scanner_scan[\h\(]+\$\w+,(?<X220356061>)|Neirra\s*Shell\s*</\63>(?<X2307490>)|o(?:r0toshell</\63>(?<X2306380>)|verthinker1877\s*\-\s*\$H3LL<\/\63>(?<X2307320>)|wned\h+by\h+lern[^<]{1,99}</\63>(?<X220342470>)))|[>\s]+@SukaBintang01\h+priv8\h+Shell\s*<\/\63>(?<X2303720>))|(title>)(?:&#87;&#101;&#98;&#109;&#97(;&#105;&)#108;&#32;&#76;&#111;&#103\97#110;\s*</\96(?<X2207411>)|(?:Database|db)\s*e?mails?\s*extract(?:or)?</\96(?<X2130570>)|0wn[e3]d\W{0,9}</\96(?<X2176500>)|[^/;]{0,40}\bAntichat\h*Shell\h*</\96(?<X2151481>)|[^/<]{0,10}(?:hack|fu?ck|defac)\w+\h*shell\h*upload</\96(?<X2181332>)|[^/]{0,99}\b[B8]yp[a4][s$5]{2}\s*[s$5]h[e3][1l]{2}</\96(?<X2044842>)|[^/]{0,9}E?Xploit\h*</\96[^\.:]{9,99}href\h*=\h*['"]https?://\w{1,9}\.top4top\.io/(?<X2168511>)|[^/]{1,9}\bZerr?[o0]+Err[0o]r\s+v[\d\.]+</\96(?<X2133501>)|\h*(?:([^</]{5,60})\h*</\96[^\?\*&]{2,400}<meta\h+name\h*=\h*['"](?:keywords|description)['"]\h+content\h*=\h*['"]\106['"]\h*/?>[^\?\*&]{400,25000}>\s*(?:<a\h+href\h*=\h*https?://[^>\n]{9,150}>[a-z0-9]{5,20}</a>\h*,\h*){9}[^\v]{999,9999}</a>,\h*</div>(?<X2155713>)|['"]\.\$[shel]{1,5}name\.['"]</\96[^\\;\{\$]{9,99}<link\h+href\h*=\h*['"](?:https?:)?//zerobyte\-id\.github\.[^/]{1,20}/PHP.(?:Backdoor|webshell)\b(?<X2189370>)|shutdown57\h*ransomware[^\<]{0,20}</\96(?<X2179051>))|\S{1,40}\h+m[i1]n[i1]\h+sh[e3][1l][1l]\h*</\96(?<X2152190>)|Amazon\s+Billing\s+Center\s*</\96[^\^\\\|\176\`]{30000,40000}\$cvv2?c?=\$_[GPCSR]\w{2,6}\[['"]cvv2?c?['"]\];(?<X2133490>)|g[a4][l1i][e3]rz\s*[s\$x]h[e3]{1,2}[l1i]{1,2}\s*[b6][a4]ckd{1,2}[oO]r[szx\$]?</\96(?<X2130610>)|hun(?:te|73)r\h*uploader</\96['"];[^\{]{9,299}\{\s*if\h*\(\h*(?:copy|move)_uploaded_file\b(?<X2174401>)|iserver\h+kit\h*</\96(?<X2175011>)))
<(?:(title|center|h\d|font)(?!\s*class\s*=\s*['"]woo)[^>]{0,99}>[^<]{0,14}m[i1]n[i1]\h*[5s]h[e3]ll[^a-z\d]?\b[^<\n/]{0,10}</\1>(?<X2176704>)|/?dortxt>(?<X2189582>)|/(?:a>\s*Deface\s+Mirror\s+Priv(?:\d+|ate)?\s+Shell\b(?<X2121581>)|dd>\s*(?:<dd><a(?:\s*(?:href|title)\s*=\s*['"]?https?://[^'"\s]{9,99}\d{1,5}\.php\?\d{1,5}\.html['"\s]){2}[^>]{9,99}>https?://[^'"\s]{9,99}\d{1,5}\.php\?\d{1,5}\.html\s*</a>\s*</dd>\s*){4}(?<X2129648>)|form>(?:";\s*move_uploaded_file[\s\(]+\$saw1[\s,]+\$saw2[\s\)]+;(?!\s*exit)(?<X2049224>)|\s*<\?php\s*\$(\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\7['"]?\];\s*(\$\w{1,40})\s*=\s*(?:passthru|exec|shell_exec|popen|system|eval)\(['"]\$\7['"]\);\s*echo\s*['"][^\$]{0,40}\8[^\$]{0,40}['"];\s*\?>(?<X2052440>))|h(?:ead>\s*<body>.{1,9999}\bfunction\s+\w{1,40}\(\)\s*\{\s*\w{1,40}\s*=\s*\w{1,40}\(\);\s*\w{1,40}\s*=\s*\[(?:\d+,){20,100}\d+\];\s*return\s*\w{1,40}\(\w{1,40},\w{1,40}\);\s*\}(?<X2050431>)|tml>\s*<(?:\?php\s*(\$\w{1,40})\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\}\{]{1,999}\$\w{1,40}\s*=\s*@?fopen\s*\(\s*['"]\w{1,40}\.txt['"]\s*,\s*['"]a\+?['"][^\-]{1,999}\$(\w{1,40})\s*=[^;]{0,40}\11[^\(]{1,499}\bphpversion\s*\(\s*\)\s*;\s*@?mails*\([^\;]{1,40}\b\12\b[^;]+;\s*(?:\?>|\Z)(?<X2136220>)|SCRIPT[^=]{1,40}=\s*VBScript\s*><[^\w]{0,40}\w{1,40}\s*=\s*['"]svchost\.exe['"](?<X2055131>)))|noembed>\s*<title>\s*-J\.B\.O\.Y-(?<X1059810>)|pathshell>(?<X2202541>)|s(?:cript>(?:";exit;}}}function\s+\w{1,40}\(\){\$\w{1,40}='http://';if\(\$_SERVER\["SERVER_PORT"\]!="80"\){\$\w{1,40}\.=\$_SERVER\["HTTP_HOST"\]\.":"\.\$_SERVER\["PHP_SELF"\];}else{\$\w{1,40}\.=\$_SERVER\["HTTP_HOST"\](?<X2048090>)|\s*<meta\b(?:[^>]{0,99}(?:http\-equiv=['"]?refresh['"]?|content=['"]\d+;\s*url=https?://[^"']{1,99}/\.\w{99})){2}(?<X2190252>))|tyle>\s*<title>\s*x-Mailer</(?<X2120910>))|title>\s*(?:(?:<meta\h[^/]{0,40}content\h*=\h*|<script[^/]{0,40}\()['"](?:hacked|s[7t][a4]mp3d)\h*by\h*xL[0o]n[e3][l1]y\b(?<X2138531>)|<meta\h*content=['"]Hacked\h+By\h+\S{1,40}\b[^/>]{1,199}name=['"]description['"](?<X2167133>)))|<(?:<['"]PHP['"]\s*<\?(?:php)?\s*error_reporting\(0\)[^\{]{1,999}\$\w+[\s=]+['"[]https?://\d+\.\d+\.\d+\.\d+/j\d+_\d+/['"];(?<X220344970>)|\?(?:php)?\s*@?set_time_limit\(3600\);[^\[]{1,99}(base64_encode\(@?\$_SERVER\[)[^\?]{1,99}\$\w+[\s=]+\$_SERVER[^@]{1,299}\23[^!]{1,499}\23[^#]{1,299}['"]https?://['"][^@]{1,49}@?\$_GET[^!]{1,199}(\$\w+)[^%]{1,699}file_exists[^/]{1,99}\24[^@]{1,799}\24[\s=]+@?file_get_contents[^/]{1,199}file_put_contents[^/]{1,99}/\*\s+Rc\s+cx\d+\s*\*/\s*\?>(?<X120354523>))|[\?ph\s]+(\$\w{1,14})[\s=]+(?:url|file)_get_contents[\('"\s]+https?://(?:www\.)?eafincas\.com[^'"]{1,50}['"\);\s]+[^<]{1,50}echo\s['"]<(script)[^>]{1,50}async\ssrc[^>]{1,30}\26[^/]{1,20}</\27>['";\}\s]+\?>(?<X1311880>))
<\?(?:(?:=|php)?\s*\(\s*\$(\w{1,20})\s*=\s*@?\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\[[^]]{1,10}\s*\]\s*\)\s*\.\s*@?\$\1\(\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\[[^]{1,10}]\s*\]\s*\)\s*(?:\?>|\Z)(?<X1040451>)|(?:=|php)\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\h*\?>(?<X1216550>)|(?:[ph\s]+|=\s*)(file_)put(_contents)[\h\(]+['"][^'"]+/\w+\.php['"][\h,]+\4get\5[\h\(]+['"]https?://8\.217\.34\.158/[^'"]+['"][\h\)]+;\s*\?>(?<X1316620>)|(?:php)?(?:(?:\s*@?error_reporting\s*\(\s*0\s*\)\s*;)?\s*(\$\w{1,40})\h*=\h*str_replace[\s\(]+\b\w\s*,\s*['"]{2}\s*,\s*['"]?\w{5,19}['"]?[\s\)]+;\s*@?\7[\s\(]+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1186202>)|[ ]{99,}\$\w{1,40}[\s=]+class_exists[\s\(]+['"](\w+)['"][\s\)]+;\h*if[\s\(]+!\$\w+[\s\)]+\{\h*class\h*\9\h*\{(?:[^:\n]{9,999}\b(?:substr|str_repeat|strlen|is_array)[\s\(]+\9::)+[^\?\n<\*]{9,999}\binclude(?:_once)?\h*\$\w+;\h*@\9::[^\n\?>]{0,199}\bnew\s*\9[\s\(\)]+;[^\?>\n]{0,99}(?:\?>|\Z)(?<X1238160>)|[\s=]+(\$\w+)[^\$]{1,99}(\$_SERVER)\[['"]HTTP_USER_AGENT['"]\][^\(]{1,99}(\$\w+)[^;]+\];\s*(\$\w+)[^\{]{1,99}foreach\h*\(\13[^!]{1,99}\11[^;]{1,49}\14[^&]{1,99}\14[^:]{1,99}(\$\w+)[\s=]+\12[^;]+\.html['"];\s*\w+[\s=]+\(file_exists\(\15\)\)[^\}]{1,99}readfile\(\15\);\s*exit;\s*\}\s*\}\s*\?>(?<X120348391>)|[\s\*/]+@package\s*0xshallbyp@22\b(?<X220339403>)|[\t]{40,}if[\(\s]+!\h*class_exists[\(\s]+['"]([^'"]{1,40})['"][\s\)]+\{[^\}]{1,99}\bis_user_logged_in\h*\(\)[^\n]{999,9999}\}\h*(\$\w{1,40})\h*=\h*new\h+\18;\h*\19\->init\h*\([^;]+\$is_bot[\)\h]+;\h*\}\s*(?:\?>|\Z)(?<X1193500>)|[^#]{1,499}goto\s*\w+;\s+\w+:[^#]{1,999}\\56\\x74\\170\\164['"];[^#]{999,}\\[a-fx\d]+['"];\s*(?:\?>|\Z)(?<X120335501>)|[^#]{1,999}goto\s*\w+;\s*\w+:(?:[^#]{1,999}\$_GET\[['"]\\145\\144\\x69\\x74['"]\];[^#]{99,}goto\s*\w+;\s*\w+:\s*\w+:\s*(?:\?>|\Z)(?<X120335511>)|[^#]{99,}echo\s*['"]\\x3c\\x2f\\x62\\x6f\\x64\\x79\\76\\x3c\\x2f\\150\\164\\155\\154\\x3e['"];\s*(?:\?>|\Z)(?<X120335432>))|[^'"]{1,99}include\s*['"](?:compress\.zlib://[^;]{1,99}['"];\s*\?>\Z(?<X220342421>)|php://filter/zlib\.inflate/[^;]{1,99}['"];\s*\?>\Z(?<X220342411>))|[^:]{1,32}plugin\s+name:[^:]{1,99}plugin\s+uri:\s*(https?://example\.com/?)[^/]{1,199}author\s+uri:\s*\26[^\$]{1,199}\w+\s*\w+\(\)\s*\{\s*if\s*\(is_admin\(\)\)\s*\{\s*return\s*true(?<X220339630>)|[^:]{1,49}\bPlugin\s+Name:[^:]{1,49}Description:[^\{]{1,99}(function)\s+\w+\(\)\s*\{\s*\?>[^\{]{1,99}\28\(\)\{var\s+(\w+)[^'"]{1,49}['"][^'"]{999,}['"];\28[^\?]{1,399}\29\);\(new\s+\28[^<]{1,99}</script>\s*<\?php[^;]+\d+\);(?<X220355081>)|[^:]{1,99}Plugin\s+Name:\s*WPB\s+Malwarescanner[^\{]{1,199}Text\s+Domain:\s*wpb\-malwarescanner[^\.]{1,99}(define\(['"]WPBMS_PLUGIN)_FILE['"],\s*__FILE__\);\s*\31_DIR['"][^/]{1,99}define\(['"]WPBMS_PAYLOAD_FILENAME['"],\s*['"]vdconnect\-\w+\.php['"]\);(?<X220353970>)|[^;]{1,299}(goto)\s+(\w+_)\w;\s*\34\w:\s*function\s+\w+\(\)\s*\{\s*\33[^'"]{1,49}array\(['"]\\107\\x6f\\157\\x67\\154\\x65[^'"]+['"][^\{]{1,399}\{\s*\33[^\[]{1,99}\$_SERVER[^@]{1,599}curl\w+[^'"]{1,99}['"]\\x68\\x74\\164\\x70[^'"]+['"];\s*\33\s+\w+;\s*\w+:\s*\w+:\?>(?<X120358100>)|[^;]{1,399}error_reporting\(\s*0\s*\)[^\{]{1,99}\((\$\w+)\)\s*\{[^;]{1,99}['"]ABCDEFG[^'"]+789\+/=['"];[^\{]{1,69}\36\);[^\{]{1,99}strlen\(\36\)\)[^\?]{1,499}url_get_content[^'"]{1,49}array[^\{]{1,299}['"]ssl://['"][^\[]{1,499}fsockopen[^'"]{1,29}['"]host['"]\][^\?]{1,599}eval\s*\(['"]\?>['"]\s*\.\s*\$\w+\);\s*\?>(?<X120346882>)|[^;]{1,49}(goto)(?:[^@]{1,99}base64_decode\(substr[^@]{1,199}@\$_SERVER\[['"]\\x48\\124\\124[^'"]+['"]\];\s*\38[^\{]{1,49}(function)[^#]{1,999}@dirname\(__FILE__\);\s*\38[^#]{1,1799}foreach[^#]{1,3999}header\(['"]\\x43\\157\\x6e\\164[^'"]+['"]\);[^\(]{1,49}\39[^@]{1,699}echo\s*['"]\\x3c\\x73\\x63\\162[^'"]+['"];\s*\?>(?<X220355232>)|\s+\w+;\s+\w+:\s+(function)[^'"]{1,99}\41[\h\(]+(\$\w+)[^!]{1,99}!\s*\(\42\[['"]\\164\\171\\160\\145['"]\][^\?]{1,199}strcasecmp\(\42[^@]{1,1999}\$_FILES\[[^\.]{1,99}['"]\\74\\150\\x72\\x3e\\74[^'"]+['"][^@]{1,2999}unlink[^'"]{1,49}['"]\\x66\\x30\\126[^'"]+['"];\s*\38[^\[]{1,99}\$_SERVER[^#]{999,}echo\s*['"]\\40\\40\\x3c[^'"]+['"];\s*\?>(?<X220355251>))|[^;]{1,599}\bgoto\s+\w+[^\(]{1,299}function\s+(\w+)\((\$\w+)\)\s*\{[^\{]{1,999}foreach\s*\(\45[^@]{1,4199}include\s+\$\w+[^\.]+http_response_code\(404\);[^!]{1,999}!empty\((\$\w+)[^=]{1,99}strtolower\(\46[^@]{1,319}@?file_get_contents[^!]{1,999}!\(\44[^>]{1,199}goto\s+\w+;\s*\w+:\s*\w+:\?>(?<X120348631>)|[^;]{1,999}(goto)\s*(?:(\w+);\s*\49(?:[^'"]{1,399}array\(["']\\x62\\157\\x74['"][^\[]{1,99}[^\?]{1,199}file_get_contents\(['"]\\x68\\164\\x74\\x70\\x73\\x3a\\x2f\\x2f\\154\\x61\\163[^'"]+\\x37\\67\\x2e\\150\\164\\x6d\\x6c['"]\);\s*goto[^\?]{1,99}echo\s*\$\w+;\s*\48\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X120344071>)|[^'"]{1,99}array\(['"]\\x62\\157\\164[^\?]{1,999}\48[^!]{1,99}echo\s*\$\w+;[^'"]{1,499}file_get_contents\(['"]\\150\\164\\164\\x70\\x73\\x3a[^'"]+\\x2d\\167\\x6f\\x72\\x6b\\163\\56\\164\\x78\\x74['"]\);\s*\48\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X120344061>))|\w+;\s*(\w+):[^'"]{1,99}\48\s*\52[^\(]{1,99}eval\(['"]\\x3f\\76['"][^%]{1,9999}\$\w+\s*=\s*['"]\\160\\145\\x6e\\147\\145\\x6e\\142\\145\\x6c\\x69\\x2e\\171\\141\\x63\\150\\164\\163['"];[^&]{1,299}echo\s*['"][^'"]{999,}\\xbd['"];\s*\?>(?<X120344041>))|[^;]{1,999}goto\s*\w+;\s*(\w+):\s*\w+\s*(\$\w+);[^@]{999,}@disk_total_space\s*[^;]{1,999}\\x70\\x61\\163\\x73\\x74\\150\\162\\x75(\$\w+)[^#]{999,}\56\[['"]\\123\\105\\122\\126\\105\\x52\\137\\123\\x4f\\106\\x54\\127\\101\\122\\105['"]\];[^#]{999,}\55\s*=[^#]{999,}goto\s*\54;[^=]{1,999}foreach\s*[^@]{1,999}print\s*['"][^;]{1,99}['"];\Z(?<X220342211>)|[^;]{1,99}(?:(\$\w+)\s*=\s*['"]\w+\.+zip['"];\s*(\$\w+)\s*=\s*['"]\w+\.+log['"];\s*(\$\w+)\s*=\s*['"]\w+://['"]\s*\.\s*\58\s*\.\s*['"]/['"]\s*\.\s*\59;\s*@include\s*\60;(?<X220342350>)|(goto)\s+\w+;[^!]{1,1999}if[\h\(]+(\$\w+)\s*!==\s+false\)\s*\{\s*\62[^'"]{999,}\62\s+\w+;\s*\w+:\s*(\$\w+)[\s=]+['"]\\150\\x74\\164\\x70\\x73[^'"]+['"];\s*\62[^\?]{1,7999}\63[\s=]+strpos[^\?]{1,8999}(\$\w+)[\s=]+substr[^!]{1,2999}eval\(['"]\\77\\x3e['"]\s*\.\s*\65\);[^@]{1,4999}file_get_contents\(\64[^\?]{1,999}\w+:\s*\?>(?<X220355301>)|;\s*\w+\s*(\w+)\(\$\w+\)[^\}]{1,999}\}\w+\([^@]{1,999}github[^;]+;\$\w+=\67\(\$\w+\);eval\(['"]\?>['"]\.\$\w+[^@]{1,999}<title>403\s+Forbidden<(?<X220339061>)|\b(?:require|include)(?:_once)?\s*\w+\(\w+\)\s*\.\s*['"]/[\w\-]+\.php['"];(\$\w+)=new\s*\w+\([['"]https?://[^'"]+['"],['"][^'"]{8,32}['"]\);\69\->\w+\(\);\69\->forceRedirectOffer\(\);\69\->\w+\(['"]\w+['"]\);\69\->\w+\(\);\69\->\w+\(\);\?>(?<X120338180>)|error_reporting\(0\);if\(isset\(\$_REQUEST[^\$]{1,99}function_exists\(['"](\w+)['"]\)\)\{\71[^/]{1,149}hash\(['"]sha256['"][^\.]{1,599}https?://[^\.]+\.txt[^;]{1,49}(\$\w+)=(curl)\w+\([^\}]{1,299}(\$\w+)=\73\w+\(\72\);\73\w+\(\72\);return\74;\}(?<X120369131>)|ob_start\(\);\s*#\s*\w+\(base64_decode\(['"]aHR0cDov[^'"]{1,99}['"]\)\);\s*eval\(['"]\?>['"]\.ob_get_clean\(\)\);\s*\?>\Z(?<X220342391>)|session_start\(\);[^!]{1,199}!\(isset\((\$_SESSION\[['"]\w+_token['"]\])[^@]{1,599}https?://[^'"]+\.com['"][^@]{1,399}\77[^@]{1,1999}file_get_contents[^\}]{1,99}exit;\}[^@]{1,5999}<title>Vivid\s+Workspace\s+Manager</title>(?<X220364940>))|[^>]{1,99}\$startArgs[\s='"]+\-{2}url[^\.]{1,32}\.supportxmr\.com:\d+(?<X220351820>)|[^@]{1,99}class\s+\w+\{(function)[^;]{1,49}\80_exists\(['"](curl_)\w+['"][^!]{1,99}\81\w+[^\-]{1,99}file_get_contents\([^@]{1,149}(\$\w+)=['"]https?://[^'"]+\.txt['"][^\?]{1,99}(\$\w+)\->invoke\((\$\w+),\82[^\*]{1,99}eval\(['"]\?>['"]\.\83\->\w+\(\84,\$\w+\)\);\?>(?<X120366420>)|[^\$]{0,199}(\$\w+)[^\$]{0,99}\86[^']{0,399}\bmkdir\(\86,[^\]]{0,299}\];\s*foreach[^=]{0,399}(\$\w+)[^"]{0,599}\braw_input[^\$]{0,199}(\$\w+)[^!]{0,499}\!empty\(\87[^@]{0,699}\88[^;]{0,99}LOCK_EX\);(?<X220352213>)|[^\$]{1,999}(\$\w+)[\s='"]+https?://hcxseo\.com[^;]{1,99}raw['"];[^%]{1,1999},\s*0444\);[^%]{1,999}\(\90,\s*\$\w+,\s*\$\w+\);\s*\?>(?<X120346220>)))
<\?(?:php)?(?:[^\$]{1,99}(?:(\$\w+)=['"]PThLRkhMQ[^'"]+['"];(\$\w+)=['"]MGhjK3B5[^'"]+['"];(\$\w+)=['"]VW9DND[^'"]+['"];(\$\w+)=['"]NUhZUW[^'"]+['"];\s*(\$\w+)=chr\(\d+\)\.[^\?]{1,349}eval\([^\.]{1,99}\5\(\1\.\2\.\3\.\4\)\)\)\)\)\);\s*\?>(?<X120354480>)|\$\w+[\s=]+(\$_SERVER\[)[^\$]{1,49}(\$\w+)[\s=]+isset\(\7[^\{]{1,199}https\?:\\/\\/\(www\\\.\)[^\{]{1,49}\8[^\[]{1,99}\7[^\(]{1,99}header\(['"]Location:[^'"]+\.php['"]\);\s*exit\(\);\s*\}\s*\}\s*\?>(?<X120352961>)|\$\w+\s*=\s*strtolower\(\$_[GPRSC]\w{2,6}[^>]{1,399}\w+\s*ambilkonten\((\$\w+)\)[^@]{1,199}(@?file_get_contents)\(\10[^=]{1,199}\$\w+\s*=\s*(curl)\w+\(\10\);\s*\12\w+[^@]{1,399}\11\(\10[^\-]{1,999}['"]https?://[^;]{1,49}['"]\);[^\}]{1,499}exit;\s*\}\s*\}\s*\?>(?<X120343661>))|[^\(]{1,29}header\(['"]Location:\h*https?://zamzamcity\.co['"]\);\s*exit;\s*\?>(?<X120346940>)|[^\(]{1,49}header\(['"]Location:\s*https?://wepackglobal\.com[^'"]+['"],\s*true,\s*301\);\s*exit\(\);\s*\?>(?<X120357501>)|[^\(]{1,99}(?:(\$\w+)[\s=]+gzdecode\(base64_\w+\(['"]H4sIAA[^'"]+['"]\)\);\s*error_reporting\(0\);\s*set_time_limit\(0\);[^\(]{1,99}(\$\w+)[\s=]+gzdecode\(base64_\w+\(['"][^;]{1,2699}\)\);[^\(]{1,29}explode\('\+\)',\17\);[^#]{1,29}#',\16\);[^>]{1,119}\w+\.php['"];\s*\?>(?<X120354840>)|(header)\(['"]HTTP/1\.1\s+301[^\(]{1,99}\19\(['"]Location:\s*https?://diskan\.bekasikab\.go\.id[^'"]+['"]\);\s*exit\(\);\s*\?>(?<X120352970>)|if\(isset\((\$_SERVER\[['"]\w+['"]\])[^\-]{1,99}foreach\(\[['"]Googlebot[^\]]{1,399}\]\s+\w+\s+(\$\w+)\)[^\[]{1,49}\21,\22\)!==false\)\{(?:include|require)[^;]{1,49}\.html['"];exit;\}\}\}\s*\?>(?<X120351120>))|[^\-]{1,259}class\s+(\w+)\s*\{\s*private[^#]{1,299}(\$\w+)\)[^;]{1,99}\25;[^\{]{1,299}\{\s*(\$\w+)[^\{]{1,99}\26[^;]{1,299}eval\(['"]\?>['"][^\?]{1,599}(\$\w+)[^\{]{1,229}foreach\s*\(\27[^@]{1,1499}@?file_get_contents[^#]{1,2999}@?shell_exec\(\$\w+[^#]{1,2499}https://[^'"]+['"];[^;]{1,99}\24[^\?]{1,49}\?>(?<X120349980>)|[^\.]{1,49}Magento,\s+Inc\.[^\(]{1,99}(function)\s+(get_data)\((\$\w+)[^\(]{1,49}\$_REQUEST;\s*if\(isset\((\$\w+)\[\31\][^\[]{1,49}\32\[\31[^\?]{1,49}\29\s+get_cli[^'"]{1,49}hash\(['"]sha256['"],\s+\30[^=]{1,49},\s*['"][^'"]{1,16}['"][^\?]{1,99}(\$\w+)[\s=]+base64_decode[^\?]{1,99}\33[\s=]+get_cli\(\);\s+return\s+eval\(\33\);(?<X120357230>)|[^\?]{0,500}\$\w{1,15}\h*=\h*@?(?:get_current_user|getcwd)\(\);[^\?]{0,500}(\$\w{1,15})\h*=\h*fopen\(['"]/(?:home|var)[^\)]{0,45}contact(?:email|info)['"],\h*['"]w['"]\);\s*fwrite\([^\)]{0,15}\35(?<X2147353>)|[^\?]{1,39}(goto)\s+\w+;[^\[]{1,499}\((\$\w+)\)\)\s*\{\s*\37[^@]{1,499}(\$\w+)[\s=]+explode[^@]{99,}\38[\s=]+@fsockopen\(['"]\\x73\\x73\\154\\72\\57\\x2f['"][^'"]{999,}eval\(['"]\\x3f\\x3e['"]\s*\.\s*\39\);[^'"]{1,999}['"]\\107\\x45\\124[^'"]+['"];\s*\37[^!]{999,}!\38\)\s*\{[^\?]{1,1199}fclose\(\38\);[^\?]{1,99}\w+:\s*\?>(?<X220355281>)|[^\?]{1,49}(goto)[^\(]{1,199}:\s*(\w+)\(['"]\\143\\x75\\162\\x6c[^\)]+['"]\);\s*\41[^\(]{1,199}md5[^\?]{1,299}error_reporting[^\{]{1,199}(function)\s+\42[^\?]{1,999}\43_exists\((\$\w+)[^@]{1,399}@\44[^!]{1,599}!file_exists[^\?]{1,149}['"]\\107\\111\\x46\\x38\\x39[^'"]+['"];\s+\41[^'"]{1,99}include\s+['"]\\57\\x74\\x6d\\x70\\x2f\{\$\w+\}['"];\s*\?>(?<X220355261>)|[^\?]{1,99}\?>\s*oVaNvKFxtWvLtWS9F[^'"]+iVPEcLaL7sD==['"]\)\);['"]\)\);[\s/#=]+\?>(?<X120348671>)|[^\?]{2,99}\?><\?(?:php)?[^\}]{1,999}PD9[^'"]+['"]\)\);\}\?>(?<X120333450>)|[^\[]{1,39}\$\w+[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*(\$\w+)[\s=]+gzdecode\(base64_decode[^\)]{1,2699}\)\);[^#]{1,1799}explode\(['"]\)#['"],\48\);(?<X120356000>)|[^\[]{1,99}(?:(\$\w+)[^\?]{1,299}isset\(\$_SERVER\[[^\{]{1,299}(\$\w+)[\s=]+(?:false|true);\s*foreach[\h\(]+\50[^&]{1,199}\51[^:]{1,99}header\(['"]Location:\s+https://[^'"]+\.pages\.dev/['"]\);\s*exit;\s*\}\s*\?>(?<X120366010>)|error_reporting\(0\);\s*\$\w+\s*=[^\?]{1,199}empty\(\$_GET\[['"]\w+['"]\]\)[^/]{1,99}(\$\w+)\s*=\s*curl_init\(\);[^\(]{1,49}curl_setopt\(\53[^/]{1,29}['"]https?://box\.fingerling\.org[^\?]{1,149}curl_exec\(\53[^\?]{1,99}define\(['"]DISALLOW_FILE_MODS['"],\s*!\d+\);\s*\?>(?<X120345080>)|if[\h\(]+\$_SERVER[^\?]{1,99}(\$\w+)[\s=]+strtolower[^!]{1,199}(\$is_google_)\w+\s*=[^'"]{1,49}\55[^\^]{1,199}\56\w+[\s=]+preg_match[^&]{1,199}\56\w+[^\.]{1,99}file_exists\((__DIR__\s*\.\s*['"][^'"]+\.html['"])[^\}]{1,199}readfile\(\57\);\s*exit;\s*\}\s*\}\s*\?>(?<X120362780>))|[^\\]{1,299}['"]font['"]=>['"]aHR0c[^'"]+['"],['"]endpoint['"]=>['"]aHR0c[^'"]+[^\\]{1,1999}new\s*wp_user[^;]+set_role\(['"]admin(?<X220357201>)|[^\n]{1,119}\(['"]SCRIPT_FILENAME['"]\);(\$\w+)=substr\((\$\w+),\d+.\w+\(\61,\$\w+\)\);include_once\(\60\.['"]/\w+[^;]+\);\?>(?<X120346361>)|[^\{]{1,159}class\s+(\w+)\s*\{\s*(?:public|private)\s+(?:static|function)?[^#]{1,9999}(init\d+)\(\)[^\$]{1,99}\$\w+[\h=]+['"][^'"]+['"][^@]{1,99}[\s=]+@?gzinflate[^\?]{1,599}md5[^#]{1,2199}base64_decode\([^\?][^#]{1,999}\63::\64\(\);(?<X220349671>)|[^\{]{1,199}(function)\s+(is_bot)[^\$]{1,49}(\$\w+)[\s=]+\$_SERVER[^\(]{1,99}(\$\w+)[^\{]{1,449}foreach[\h\(]+\69[^!]{1,49}\68[^@]{1,199}\66\s+(\w+)[^@]{1,199}curl_init[^@]{1,899}\67[^\$]{1,49}(\$\w+)[\s=]+\70\(['"]https?://[^'"]+\.html['"]\);[^;]{1,49}echo\s+\71;\s*exit;[^\?]{1,49}\}[^\?]{1,149}\?>(?<X120361580>)|[^\{]{1,49}class\s+(\w+)(?:[^:]{1,99}https?://cw\.acidpoll\.top[^'"]+['"];[^\{]{1,49}((?:public|private)?\s+static\s+function)\s+(\w+)[^;]{1,99}:(\w+)[^/]{1,199}\74\s+\76[^\?]{1,119}(curl)\w+[^\[]{1,49}\$_SERVER[^@]{1,699}\77\w+[^\?]{1,299}eval\(['"]\?>[^@]{1,299}@?unlink[^:]{1,49}\73::\75\(\);\s*\?>(?<X120351250>)|\{\s*function\s*(\w+)\((\$\w+)\)\{\s*(\$\w+)=(curl)\w+\(\80\);\s*\82\w+\(\81[^>]{1,119}['"]\73['"]\);[^;]{1,99}['"]\79['"]\);[^;]{1,99}newinstance\(\);[^//]{1,49}https?://\d+\.\d+\.\d+\.\d+[^'"]+['"];\s*eval\(['"]\?>['"]\.\$\w+\->invoke\(\$\w+,\$\w+\)\);\s*\?>(?<X120346950>))|[^\{]{1,99}(?:(\$\w+)\s*=\s*function\s*\(\)\s*\{\s*\w+\s*include\s*['"]http://manzdrive\.com[^'"]{1,99}['"];\s*\};\s*(\$\w+)\s*=\s*\w+\s*\w+\(\84\);\s*\85\->invoke\(\);\s*\?>(?<X220342430>)|function\s+(?:(\w+)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\(]{1,49}return[\h\(]+strpos\(\88,\s*['"](\w+)['"][^\{]{1,49}if[\h\(]+\87\([^\(]{1,49}header\(['"]HTTP/\d+\.\d+\s+\d+[^\}]{1,99}echo\s*['"]<p>\89[^;]{1,99}</p>['"];\s*exit;\s*\}\s*\?>(?<X120357530>)|(is_mobile)\(\)\s*\{\s*(\$\w+)[\s=]+(\$_SERVER)\[[^\$]{1,49}(\$\w+)[^\{]{1,49}foreach[\h\(]+\94[^!]{1,49}\92[^&]{1,99}\91\(\)\s*&&\s*\93[^\(]{1,49}(\$\w+)[\s=]+file_get_contents\(['"][^'"]+\.cert['"]\);\s*echo\s+\95;[^\}]{1,99}exit;\s*\}\s*\?>(?<X120357541>)))|[^\{]{5,50}\bfunction\h*(\w{1,15})\(\$\w{1,15}\)\{(eval)\(['"](\W{0,5}\$\w{1,9})=['"\h\.\(gzinflatesr_o13b64dc]{9,300}[^;]{1,25};\98\(\99\);['"]\);\}\s*\97\(['"][^'"]{99,999}['"]\);[^\?]{0,50}\?>(?<X1147723>)|[^\}]{1,49}class\s+(\w+)\s*\{\s*p(?:rivate|ublic)[^\]]{1,399}(\$\w+)\)\)[^;]{1,29}eval\(\102\);[^'"]{1,119}(r\d+)\(\)\s*\{\s*(\$\w+)\s*=\s*['"][^'"]{999,}['"];\s*\104[\s=]+\w+\(\104,\s*\d+\);\s*\$\w+[\s=]+hex2bin\(\104[^'"]{1,49}\(base64_decode[^@]{1,459}@?gzinflate[^/]{1,1199}\101::\103\(\);\s*//\s*EOF\Z(?<X220349582>)|\h*(?:(\$\w{1,40})\h*=\h*(file_)ge(t_contents)\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\h\)]+;\s*if\h*\(\h*\107pu\108\h*\(\h*['"][^"']{1,40}\.php['"]\h*,\h*\106\h*\)[^;]+;[^\?>]{0,99}\?>(?<X1187140>)|\$\w+=\h*urldecode\h*\([^;]{1,999};\h*(?:(\$\w+)[\h\.=]+\$\w+\[[^;]{1,999};\h*){1,20}eval[\h\(]+\110[\h\(]+['"][^'"]{1,29999}['"][\h\)]+;(?:\?>|\Z)(?<X1324781>)|system(?:\(['"][ba]*sh\s*\-i\s*>&\s*/dev/tcp/\d+\.\d+\.\d+\.\d+/\d+\s*0>&1['"]\);\?>(?<X120342702>)|\h*\(['"]\\[\\\da-fx]{799,999}['"]\);\h*\?>(?<X1175720>)))|\h+eval\(['"]\?>['"]\.file_get_contents\(['"][^'"]+(?:tmp/awstats|_?cpanel_usr_bin_f)[^;]+;\?>(?<X1325380>)|\n{0,9}[ ]{200,}function\h*\w{1,40}\h*\((?:\h*\$\w{1,40}\h*,?)+\)\h*\{\h*return\h+str_replace\h*\([^\?\v\.\[]{499,9999}(\$\w{1,99})\h*=[^;\v]+;['"]\);\h*\115\h*\(['"][^'"\v]+['"]\h*\)\h*;\h*(?:\?>|\Z)(?<X1157692>))
<\?(?:php)?\s*(?:(function)\s+(is_bot)\((?:[^\$]{1,99}\$_SERVER\[[^\$]{1,99}(\$\w+)[^\(]{1,99}(\$\w+)[^\{]{1,99}foreach[\h\(]+\4[^!]{1,99}\3[^\?]{1,99}\1\s+(\w+)[^/]{1,99}curl\w+\([^\{]{1,199}\1\s+(\w+)[^/]{1,99}\2\([^:]{1,99}\5\(['"]https?://[^'"]+['"]\);[^@]{1,199}header\(['"][^\?]{1,199}echo\s+\6\(\);\s*\?>(?<X120355770>)|\)[^\$]{1,49}(\$\w+)[\s=]+\$_SERVER\[[^\$]{1,99}(\$\w+)[^\}]{1,599}return\s+preg_match\(\9,\s*\8\);\s*\}\s*\1\s+(\w+)[^&]{1,99}file_exists[^\]]{1,199}(curl)\w+\([^\(]{1,99}\11\w+[^\}]{1,199}file_put_contents[^\{]{1,99}\2\(\)\)\s*\{\s*echo\s+\10\(['"]https?://[^'"]+['"]\);\s*\}\s*\?>(?<X120355750>)|\)[^\$]{1,99}isset\(\$_SERVER[^\(]{1,199}(\$\w+)[\s=]+array\([^\{]{1,199}foreach[\h\(]+\13[^&]{1,199}\1\s+(\w+)[^&]{1,99}\1_exists\(['"]file_get_contents['"]\)[^\?]{1,199}curl\w+[^\?]{1,499}\2\([^\(]{1,99}(\$\w+)[\s=]+\14\(['"]https?://[^'"]+\.txt['"]\);\s*echo\s+\15;\s*exit;[^\}]{1,49}\}\s*\?>(?<X120355650>))|(function)\s+\w+[^\[]{1,199}(\$\w+)[^\(]{1,399}foreach\s*\(\18[^\?]{1,199}(\$\w+)[^@]{1,199}(\$\w+)[^@]{1,99}@?file_get_contents\(\20\);[^\{]{1,339}\17\s+(\w+)[^:]{1,399}geturlcontent\(['"]https?://[^\}]+\19\}['"][^:]{1,399}https:?//[^'"]+\.html['"][^\*]{1,499}\21[^\$]+(\$\w+)[^\$]+\22\);\s*exit;\s*\}\s*\?>(?<X120348612>)|(function)\s+\w+\((\$\w)[^\?]{1,99}\25[^\$]{1,49}\$_SERVER[^\(]{1,99}\24[^=]{1,99}\24_exists\(['"](file_get_contents)[^@]{1,499}@?\26[^>]{1,199}curl_exec['"][^@]{1,599}\24_exists[^@]{1,399}ssl://['"][^#]{1,699}(\$\w+)[\s=]+explode[^\[]{1,49}\(\27[^\|]{1,199}check_user_agent[^:]{1,199}echo\s+get_content\(['"]https?://[^'"]+\.txt['"]\);\s*die;\s*\}\s*\?>(?<X120362760>)|(goto)[^\(]{1,49}foreach[\h\(]+\$\w+\s+\w+\s+(\$\w+)[^\(]{1,49}if\s*\(stripos\((\$\w+),\s+\30[^\(]{1,49}header\(['"]\\110\\x54\\124\\x50[^'"]+['"]\);\s+die\([^@]{1,999}foreach[\h\(]+\$\w+\s+\w+\s+(\$\w+)[^\=]{1,49}\32[^@]{1,399}\31[\s=]+isset\(\$_SERVER\[['"]\\x48\\124\\x54\\x50\\137[^'"]+['"]\]\)[^;]{1,99};\s+\29\s*\w+;\s+\w+:\s*\?>(?<X120357050>)|(goto)[^\(]{1,99}(fclose\(\$\w+)\[\d+\]\);[^'"]+passthru\(['"]\\143\\x75\\162[^'"]+['"]\);\s*\34[^'"]{1,49}echo\s+['"]\\160\\162\\157[^'"]+["];[^@]{1,299}system\(['"]\\143\\165\\x72\\x6c[^'"]+['"]\);\s*\34[^!]{1,49}\35[^@]{1,999}exec\([^@]{1,899}shell_exec[^@]{1,2999}proc_open\(['"]\\143\\165\\162[^\)]+\);\s*\34[^\?]{1,39}\w+:\s*\w+:(?<X220354511>)|(goto)\s*\w+;(?:[^=]{1,299}private\s+function\s*\w+[^\-]{1,199}(\$\w+)\s*\+\s*strlen[^'"]{1,199}[^'"]{1,499}\38[\s=]+['"]\\161\\111\\124\\63[^'"]+['"];[^@]{1,2999}[^@]{999,}@?gzinflate\(\$\w+\);\s*\37[^#]{1,1999}\$_GET[^@]{1,999}@?ini_set[^!]{1,699}!function_exists[^#]{1,1999}\37\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X220350030>)|\w+:(\$\w+)=['"]https?://[^'"]{1,999}\.(?:txt|jpe?g|png|gif)['"];\w+\s*\w+;\w+:(\$\w+)=\w+\(\40\);\w+\(\41,\w+,\w+\);\w+\(\41,\w+,\w+\);\w+\(\41,\w+,\d+\);\$\w+=\w+\(\41\);\w+\s*\w+;\w+:\s+\w+\(\w+\(\41\){2}\{(echo)\s*['"][^'"]+['"]\.\w+\(\41\);\w+\(\41\);\37\s+(\w+);\}\w+\(\41\);\37[^\{]{1,99}\{eval\(['"]\?>['"]\.[^\{]{1,32}\{\42[^\}]+\}\43:\?>(?<X120328960>))|(goto)\s+(\w+);\s*(\w+)[^\{]{1,99}(is_bot)[^\$]{1,49}(\$\w+)[\s=]+file_get_contents\(['"]\\x68\\164\\x74\\x70[^'"]+['"]\);\s*echo\s+\49;\s*die;\s*\}\s*\45[^:]{1,49}\46:\s*function\s+\48[^\[]{1,99}\$_SERVER\[['"]\\110\\x54\\124[^'"]+['"]\];\s*(\$\w+)[^!]{1,99}foreach\s*\(\50[^\?]{1,99}\45\s+\47;\s*\w+:\s*\?>(?<X120355860>)|(goto)\s+\w+;(?:\s*(\w+):\s*echo\s*['"]\\x3c\\x66\\157\\x72[^'"]+['"];\s+\52[^\$]{1,49}\$_POST[^@]{1,99}@?copy\(\$_FILES[^\?]{1,99}echo\s+['"]\\125\\160\\x6c\\157[^'"]+['"];[^\?]{1,99}['"]\\x46\\141\\x69[^'"]+['"];[^\?]{1,49}\52[^\*]{1,49}<title>SEKIP</title><\?php\s+\52\s+\53;\s+\w+:\s*\?>[^\?]{1,49}</html>(?<X120359260>)|\s+\w+:\s+(curl)\w+\((\$\w+)[^;]{1,99};\s+\52[^\(]{1,49}eval\(['"]\\77\\76['"]\s*\.\s*\55\w+\(\56\)\);\s+\52[^=]{1,99}\56[\s=]+\55\w+\(['"]\\x68\\164\\164\\x70[^'"]+['"]\);\s*\52[^\(]{1,49}\55\w+\(\56\);\s*\?>(?<X120357060>))|(header)\(['"]HTTP(?:/1\.1\s+301[^'"]+['"]\);\s*\58\(['"]Location:\s*https?://smabeqi\.baitulquransragen\.sch\.id/['"]\);\s*exit\(\);\s*\?>(?<X120355871>)|[^;]{1,29};\s*\58\(['"]\w+:\s*https?://rvzschildervakwerken\.nl['"]\);\s*(?:exit|die)\(\);\s*\?>(?<X120343641>))|(header)\(['"]Vary:[^\$]{1,99}(\$\w+)[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\(]{1,199}(\$\w+)[\s=]+trim\(file_get_contents\(['"]https?://[^'"]+['"]\)\);[^=]{1,99}(\$\w+)[^\{]{1,299}if[\h\(]+preg_match\(\64,\s*\62\)\)\s*\{\s*\61\(['"]Location:\s*\63['"],\s*true,\s*\d+\);\s*exit;\s*\}\s*\?>(?<X120356271>)|(header)\([^;]+;\s*\66\(['"]location:\s*https?://(?:\w+\.)?whatsitlike\.me[^;]+;\s*exit\(\);\s*\?>(?<X120341230>)|(include)\s*['"]\\x2fvar\\x2fchr\\x6fot[^'"]+\\x63t\.p\\x68p['"];\s*error_reporting\(0\);ini_set[^\?]{1,99}(\$\w+)=getenv\(['"]SCRIPT_FILENAME['"]\);\$\w+=substr\(\69,[^\$]{1,29}\69[^\.]{1,99}\68_once\(\$\w+\.['"]/\w{16,}\.zip['"]\);\s*\?>(?<X120346371>)|//\s*xsgekgg[^\(]{1,99}if\(!empty\(['"]blusgae5['"]\)\)\?>(?<X120344210>)|//\s+(\w+\s+\w+\s+\w+)\s*if[\h\(]+!\s*(function)_exists\(\s*['"](\w+)['"][^=]{1,49}\73\s+\74\(\)\s*\{\s*(\$\w+)[^\?]{1,99}\75[\s=]+base64_decode\(strrev\(\75\)\);[^\}]{1,49}echo\s+\75;[^\(]{1,49}(add_action)\(\s*['"]wp_head['"],\s*['"]\74[^\(]{1,49}\76\(\s*['"]login_footer['"],\s*['"]\74['"],\s*\d+\s*\);\s*\}\s*//\s*End\s+\72(?<X120359140>)|//obfuscate\s+by\s*https?://uutool\.cn/php/\s*goto\b(?<X220354610>)|//shell\s+backdoo?r\s+bypass(?<X220335670>)|/\*\*\*\s*WebShellOrb\b(?<X220356911>)|/\*\*\s*\*\s+(?:AODZJPYGEWKRdfv\s+core\s+library\s*\*\s*[^\*]{1,99}\s+\*\s+author:\s*XAFSawDT\s*[^/]{1,99}/(?<X220342190>)|drupal\s+module\s*\-\s*pluginiywv71proruj90[^\-]{1,99}@?author\s+authorfsttz43[^/]{1,99}/\s*class\s*\w+\s*\{[^@]{1,99}@?var\s+string\s*\*/(?<X220342230>)|zend\s+framework\s+module\s*\-\s*pluginaull64proqng38[^\-]{1,99}@?author\s+authordmdnb41[^/]{1,99}/\s*class\s*\w+\s*\{[^@]{1,99}@?var\s+string\s*\*/(?<X220342220>))|/\*\s*[^/]{1,99}(//example\.com)/\w+\s*\w*:\s*auto\-\w+\h+obfuscated\h+wordpress\-[^\*]+author\h+\w+:\s*https?:\84(?<X220332710>)|/\*\s*C2_SIGNATURE[^\?]{1,299}(\$\w+)=gzinflate\(base64_decode\(['"]Jd[^'"]{1,499}['"]\)\);eval\(\86[^\?]{1,199};\s*\?>(?<X120353300>)|/\*\s*plugin(?:\h+name:[^@]{1,999}ABSPATH['"]\)\)\s*exit;[^@]{1,999}define\(['"]TG_BOT_TOKEN(?<X220333130>)|\s+name:(?:[^\\]{1,9999}\w+[\s=]+['"]\\x68\\x74\\x74\\x70\\x73:\\(?<X220337310>)|[^\}]+\$\w+_email\s*=\s*['"]\w+@wordpress\.org['"[];\s*//\s*provision\s*hidden\s*admin(?<X220343182>)|\s*(wordpress\s+core)\s*description:\s*\91[^@]{1,99}\s*[\w\-]+@wordpress\.com\b(?<X220353100>)))|/\s*\*\s*plugin\s+name:[^:]+description:[^:]+version:[^\*]{4,16}\s*\*/\s*(function)\s*\w+\((\$\w+)\)\s*\{\s*\$\w+[\s=]+['"]+;\s*\w+\s*\(\93_exists\(['"](exec)[^\}]{1,99}@\95\(\94(?<X220343450>)|@?(?:include(?:_once)?|require)\(\s*['"][^;\?]{1,80}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip|jpeg|gz|log|key)['"]\s*\);\s*\?>(?<X1042296>)|@?(\$_SERVER\[['"]\w+['"]\])[\s=]+\98;[^!]+(!function_exists)[^\$]{1,99}\$_SERVER[^\.]{1,99}['"]\d+\.\d+\.\d+\.\d+[^/]{1,999}\99\(['"](\w+)['"]\)\)\s*\{\s*function\s+\100\(\)[^:]{1,229}urlencode\(\$_SERVER[^/]{1,129}\$\w+[^\(]{1,199}curl_init\(\)[^:]{1,99}['"]https?://['"][^\(]+\.php['"]\);[^\}]{1,499}http_response_code\(\d+\);\s*die;[^\*]{1,499}exit;\s*\}\s*\?>(?<X120348751>)|@?error_reporting\(0\);\s*class\s+(\w+)[^=]{1,199}private\s+function[^\}]{1,99}defined\(['"]DEBUG_MODE[^<]{1,199}foreach\((\$cache_)\w+[^#]{1,2999}(\$\w+)[\s=]+\[\d+,\d+[^;]{1,99};[^\}]{1,99}foreach\(\104[^'"]{1,99}\103\w+[^\\]{99,}array_map[^:]{1,599}try[\h\{]+eval[^\?]{1,499}\102::\w+\(\);(?<X220365240>)|@?eval\s*\(\s*file_get_contents\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1055151>)|@?ob_start\(\);\s*header[^\$]{1,99}(\$\w+)[\s=]+['"]https?://[^'"]+(?:\.txt|\.html)['"];[^\[]{1,149}\$_SERVER[^\(]{1,49}function\s+(\w+)\((\$\w+)[^\[]{1,99}(\$\w+)[\s=]+\w+[^@]{1,299}@?file_get_contents\(\109,\s*(?:false|true),\s*\110[^@]{1,99}echo\s+\108\(\107\);\s*@?ob_end_flush\(\);\s*exit;\s*\}\s*\?>(?<X120353020>)|@?preg_replace\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s* \$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*['"]['"]\s*\);\s*\?>(?<X1038091>))
<\?(?:php)?\s*(?:@?unlink\([^;]{1,99};\s*(\$\w{1,40})\s*=[^;]{1,199};\s*(\$\w{1,40})\s*=\s*@?(file_)ge(t_contents\s*\()\s*\1\s*\);[^\{\?]{0,399}\bwhile\s*\(\s*True\s*\)\s*\{[^\}]{1,999}\b\3pu\4\s*\1\s*,\s*\2\s*\);\s*@?touch\s*\(\s*\1\s*,[^\)\-;]{0,49}\-\d+\h[^\?%:/#&\+\\\*/]{9,499}\}\s*(?:\?>|\Z)(?<X1185911>)|@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(str_rot13\s*\('\w*\s*\(\s*\$_\w*\["\w*"\]\s*\);'\s*\)\s*\);\s*\?>(?<X1035621>)|[^'"]{1,32}(?:include|require)(?:_once)?\h*['"]compress\.zlib://(?:\w{1,4}|index)\.gz['"];(?:\?>)?(?<X120352672>)|[^;]{1,99}error_reporting\(\d+\);\s*\$\w+\s*=\s*(\w+)\s*\.\s*['"]/iptables\.zip['"];\s*(\$\w+)\s*=\s*\8\s*\.\s*['"]/automatically\-ssl['"];\s*\$\w+\s*=\s*\8\s*\.\s*['"]/iptables\.tar\.gz['"];[^\{]{1,99}\w+\s*\(\Wis_dir\(\9\)\)\s*\{\s*mkdir\(\9,\s*\d+,\s*\w+\);\s*\}(?<X220342330>)|[^;]{1,99}session_start\(\);\s*(\$\w+)\s*=\s*\$\w+\[['"]\w+['"]\]\s*\?\?\s*['"]https?://manzdrive\.com[^'"]+\.log['"];\s*\11\w+\s*=\s*['"]https?://manzdrive\.com[^'"]+\.log['"];[^\{]{1,49}\w+\s*load_payload\((\$\w+)\)\s*\{[^\}]{1,99}\s*\}\s*\}\s*catch[^@]{1,99}@file_get_contents\(\12\)\;\s*\}(?<X220342320>)|[^\$]{1,49}(\$\w+)[\s=]+['"]https?://bokunosekai\.site/\w+\.\w+['"];[^\{]{1,189}(lph_requests)\((\$\w+)\)[^\}]{1,59}(\$\w+)[\s=]+curl_init[^\}]{1,209}curl_exec\(\17[^\{]{1,119}\{\s*return[^\$]{1,19}contents\(\16[^\{]{1,79}{\s*echo\s*\15\(\14[^\{]{1,79}(?:exit|die);\s*}\s*\?>(?<X120354952>)|[^\$]{1,99}(\$\w+)\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\];[^\$]{1,99}(\$\w+)\s*=\s*['"]https?://de\.etfworld\.com['"]\s*\.\s*\19;[^_]{1,199}header\(['"]\w+:\s*['"]\s*\.\s*\20\);\s*(?:exit|die)\(\);\s*\?>(?<X120343620>)|[^\{]{1,99}function\s+\w+\(\$\w+\)\s*\{\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\23\w+\(\22[^=]{1,99}(\$\w+)[^\}]{1,99}return\s+\24;\s*\}[^=]{1,99}(\$\w+)[^\(]{1,49}eval\(base64_decode\(file_get_contents\(['"]https://[^'"]+['"]\)\)\);[^\?]{1,99}eval\(['"]\?>['"]\s*\.\s*\25\);\s*\?>(?<X120349031>)|[ri](?:equir|nclud)e(?:_once)?\(?['"][^'"]{0,19}\b[ba](?:lock(?:er|_detector)|ntibot)[sz]?\.php['"]\)?;[^\?]{0,99}\$(\w{1,40})=glob\([^;]{1,99};foreach\(\$\27\s*as\s*(\$\w{1,40})\)\s*unlink\(\28\);copy\((?:['"][^'"]+\.php['"][,\)]){2};[^\?]{1,999}\bheader\(['"]Location:\s*\$secfile\b(?<X2170860>)|\$(\w+)\s*=\s*["']https?://paste\.\w+[^'"]{1,99}['"];\s*\$(\w+)\s*=\s*curl_init\(\$\30\);\s*curl_setopt\(\$\31[^;]{1,99};\s*\?>(?<X120351280>)|\$(\w+)\s+\=\s+\$_GET\[['"]\33['"]\];\s+system\(['"]ping\s+\-c\s+\d\s+['"]\s+\.\s+\$\33\);\s*(?:\?>|\Z)(?<X120335551>)|\$[^;]{9,99};if\(!empty\(\$\w+\[['"]\w+['"]\]\)&&!empty\((\$\w+)\[['"]\w+['"]\]\)&&md5\(\35\[['"]\w+['"]\]\.md5\(\35\[['"]\w+['"]\]\)\)==\(['"]\w+['"]\)\)\{eval\(\35\[['"]\w+['"]\]\);(?:exit|die);\}\?>(?<X120333830>)|\$[o0_]{8,16}\h*=\h*urldecode\(['"]%[^;]{1,999};[^\*\v\?]{99,9999}\$[o0_]{8,16}\h*=\h*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)\?]+\$\{['"][GOBALS\\x471532cf]{9,28}['"][^\->\*\v]{99,999}\becho\h+\\?['"]wp\-[^;]+;[^;]{0,9};\h*@?\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);[^\?]{0,40}\?>(?<X1168680>)|\$\w+=['"](?:\w+['"];while\(ob_get_level\(\)>\d+\)\s*\{ob_end_clean\(\);\}ob_start\(null,\d{4,}\);\?>(?<X120362950>)|range['"];[^\&]{1,999}&&(md5\()\39\39\39[^=]{1,499}={1,3}['"]\w{32}[^;]+;eval\(\$\w+[^\?]{1,1499}curl_exec\(\$\w+\);return\s*empty\(\$\w+[^\}]+\}\w+\s*function\s*(\w+)[^&]+INPUT_GET,['"]of['"]\)={1,3}1&&(?:exit|die)[^\}]{1,999}eval\(\$\w+[^;]{1,499};(?:exit|die);\}\}\}:\40\(\);\?>(?<X120332291>))|\$\w+=\w+\([^;]{1,99};\$\w+=\[[\d,]{16,}\];\$\w+=['"]+;\w+\([^\{]{1,999}\{\$\w+\.=\$\w+[^\?]{1,999};(\$\w+)=curl_exec\([^?]{1,999}\w+\s*(gzcompress)\((gzdeflate)\(\43\(\44\(\43\(\44\(\42\)\)\)\)\)\);\}\?>\?>(?<X120346210>)|\$\w+[=\s\[]+base64_decode\(['"]emlwOg==['"]\),[^;]{1,99};\s*(\$\w+)[^\?]{1,199}(\$\w+)[\s=]+\$\w+\(\46\);\s*include\s*\47;\s*\?>(?<X120351741>)|\$\w+[\s=]+(\$_SERVER)\[['"][^\$]{1,49}(\$\w+)[\s=]+\49[^&]{1,99}strpos\(\50[^\{]{1,99}\49[^\$]{1,99}(\$\w+)[\s=]+strtolower\(\49[^&]{1,99}\51[^\{]{1,99}\$_COOKIE\[['"](\w+)['"]\][^'"]{1,29}['"](\w+)['"][^\(]{1,49}setcookie\(['"]\52['"],\s*['"]\53['"][^'"]{1,99}[^\}]{1,99}\}\s*echo\s+file_get_contents\(['"]https?://[^'"]+\.html['"]\);\s*exit;\s*\}\s*\?>(?<X120364781>)|\$\w+[\s=]+['"]http(?:s://[^'"]+['"];\s*(\$\w+)[\s=]+(?:true|false)?;[^\{]{1,49}(\$\w+)\)\s*\{[^!]+!function_exists\(['"](\w+)['"]\)\)\s*\{[^;]+\56\);\s*curl_setopt[^/]{1,249}\57\(\56\);[^/]{1,55}(\$\w+)[^;]{1,49}\55;[^,]{1,399},\58\)[^\}]{99,1999}\58\)\)[^\$]+(\$\w+)[^\?]{1,4999}\59[\s=]+base64_decode\(\59\)[^\*]{1,1199}\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;]{1,99}echo[^\}]+exit;\s*\}\s*\?>(?<X120348801>)|s?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\62\w+\(\61[^\{]{1,199}(\$\w+)[\s=]+\62\w+\(\61\);\s*if[\h\(]+\62\w+\(\61\)\)\s*\{\s*echo\s*['"]\62\s+error:\s*"\s*\.\s*\62\w+\(\61\);\s*\}[^\$]{1,99}echo\s+\63;\s*\}\s*\62\w+\(\61\);\s*\?>(?<X120356540>))|\$\w+[\s=]+\[\s*['"][^\}]{1,999}\s*\}\s*(\$\w+)[\s=]+(curl_)\w+\(\);\s*\66\w+\(\65,\s*\w+,\s*['"]https?://(?:server\.)?p86\.shop\b[^\}]{1,999}(\$\w+)\s*=\s*\66exec\(\65\);\s*\67[^\?]{1,999}\67\[['"]\w+['"]\]\);\s*exit;\s*\}\s*\}\s*\?>(?<X120338740>)|\$\w+[^:]{1,29}https://[^'"]+\.pages\.dev[^'"]+\.txt['"][^@]{1,49}(\$\w+)[\s=]+@file_get_contents[^!]{1,99}if[\s=]+\(\69[^\(]{1,49}\(\69,\s*['"]<\w['"]\)\s*!==\s+false\)[^\(]{1,99}str_replace\(['"](_\w+)['"],\s*['"]\w+=['"]\70"',\s*\69\);[^\?]{1,49}\?>(?<X120352922>)|\$\w+[^\$]{1,999}(\$\w+)=strtolower\(\$\w+[^;]{1,999};\s*(\$\w+)[^\.]{1,999}\73[^@]{999,}return\s*\w+[^@]{1,999}@error_reporting\(\d+\);\s*\$\w+\s*=\s*implode\(array_map\([^@]{999,}\72[^\.]{1,999}\$GLOBALS\[['"]\s*x61\s*151[^;]{1,999};\s*if\s*\(\(\w+\(\72[^\?]{1,500};\s*\?>(?<X120342491>)|\$\w+\s*=(?:(?:\s*chr\(\s*\d+\s*\)\s*\.?\s*)+\s*;\s*(?:\s*\$\w+\s*=(?:\$\w+\(\s*\d+\s*\)\s*\.?\s*){10,};\s*){2,}\$\w+=\$\w+\s*\(\s*["']+\s*,\s*\$\w+\s*\)\s*;\s*@\$\w+\(\s*\);\s*\?>(?<X1038261>)|\s*@?\$_SERVER\["HTTP_USER_AGENT"\].+?@?eval\(\s*\$\w+\[\w+\]\s*\);\s*echo\s*"[^"]+";\?>(?<X1035542>)|\s*['"]https?:(?://thecpediscountstore\.com[^;]{1,49}['"];\s*(\$\w+)\s*=\s*(curl)_\w+\(\);\s*\78\w+\(\77[^=]{1,99}(\$\w+)\s*=\s*\78_\w+\(\77\);[^!]{1,99}\79[^\?]{1,99}eval\(['"]\?>['"]\s*\.\s*\79\);\s*\}\s*\?>(?<X120343350>)|[^;]{1,49}\.txt['"];[^;]{1,49}(\$\w+)\s*=\s*(curl)\w+\(\);\s*\82\w+\(\81[^=]{1,299}(\$\w+)\s*=\s*\82\w+\(\81\);[^=]{1,99}\83[^'"]{1,99}echo[^;]{1,49};\s*\}\s*\w+\s*\{\s*echo\s*\83;\s*\}\s*\82\w+\(\81\);\s*\?>(?<X120343471>))|\s*['"]YawHERt0Yce[^'"]+vdbLQf=X=['"];\s*function[^\}]{1,199}isset\(\$_[GPRSC]\w{2,6}\[['"]urlerr['"]\][^\?]{1,199}(curl)\w+\+\85\w+\+\85\w+[^\(]{1,99}foreach[^@]{1,999}\85\w+\(\$\w+\);\s*echo[^@]{1,599}[^#]{999,}(base64_decode)[^@]{1,199}@?gzuncompress\(\86[^\n]{999,}die[^\?]{1,49}\(\$\w+\);\s*\?>(?<X120346930>)|\s*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\];\s*(\$\w+)\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\];[^:]{1,199}\bheader\(['"]Location:\s*https?:[^\$]{1,49}\88\);\s*(?:exit|die);\s*\}\s*\?>(?<X120343611>)|\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\](?:[^&]{1,199}(\$\w+)\s*=\s*\[[^\]]{1,699}\];[^;]{1,99}(\$\w+)[^\}]{1,99}\90[^\}]{1,99}\91[^&]{1,99}\91[^\}]{1,59}\91\s*=\s*(?:true|false);\s*\}[^&]{1,99}\91[^;]{1,99}include[^;]{1,49}['"]/amp\.php['"];\s*(?:exit|die);\s*\}\s*\}\s*\?>(?<X120345711>)|[^&]{1,99}(\$\w+)\s*=\s*\[[^\]]{1,699}\];[^;]{1,99}(\bisbot\b)[^\}]{1,99}\93\s*\w+\s*\$\w+\)\s*\{[^\}]{1,99}\94\s*=\s*\w+\s*;\s*\w+;\s*\}\s*\}[^\}]{1,999}\94\s*\|{2}[^\}]{1,999}header\(['"]location:\s*/[\w\-]+\.php['"]\);\s*(?:exit|die)[\(\)]*;\s*\}\s*\?>(?<X120345223>))|\s*isset\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)[^&]{1,49}(\$\w+)\s*=\s*\[[^\]]{1,199}\];\s*foreach\s*\(\96[^<]{1,99}echo[^\?]{1,399}['"]https?://giris\.holiganbet\-com\.live/['"]/>[^;]{1,799}<title>(Holiganbet)[^<]{1,99}\97[^<]{1,19}</title>[^\?]{1,4999}\97[^;]{1,199}html;\s*exit;\s*\}\s*\}\s*\?>(?<X120345241>))|\$\w=['"]\w{16,32}['"];\w+\((\w+\(\$_\w+\[)[^\{]+\{\w+\(!\99[^\{]+\{(\$\w+)=\d+;\}\w+\{\100=\$_\w+[^\{]+\{case\$\w+=\w+\(['"]https?://[^'"]+['"]\);break;[^\?]+\$\w+=['"]<\?\s*php[^\{]+\{die\(['"]get[^\n]+unlink\(\$\w+\){2}\{\w+[\s'"]+<(script)[^<]+</\101>['"];\}\w+\{echo[^\n]+\101>['"];\}{3}\?>(?<X1323110>))
<\?(?:php)?\s*(?:(?:(?:(?:echo\s*)?(?:ini_get|ini_restore)\(.{1,2}(?:open_basedir|safe_mode).{1,2}\);\s*){0,4}include\(\s*\$_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\]\s*\);\s*){1,2}\s*(?:\?>|\Z)(?<X1042108>)|(?:(?:set_time_limit|display_errors|error_reporting)\h*\([^;]{0,19};\s*){1,}class\h+(pbot)\s*\{\s*var\s*\$config\h*=\h*array\([^@]{999,9999}(\$\w{1,40})\h*=\h*new\h*\2;\s*\3\h*\->\h*\w{1,40}\h*\(\h*\);\s*(?:\?>|\Z)(?<X1184272>)|(?:echo\h+)?@?eval\h*\(\h*(?:@?\w{1,40}\h*\(\h*){2,}@?file_get_contents\h*\(\h*(?:@?\w{1,40}\h*\(\h*){1,}['"]ahr0c[^'"]{1,199}['"]\)\h*\.\h*['"]\w{1,199}['"][\h\)]{1,199};\s*(?:\?>|\Z)(?<X1188250>)|(?:echo\s+file_get_contents\(['"]https?://pastebin\.com/raw/\w+['"]\);\s*)+\?>(?<X120355071>)|(?:include|require)(?:_once)?\s*['"](?:\\[a-fx\d]{2,3}){4,}['"];\s*\?>(?<X120335260>)|(?:require|include)(?:_once)?\s*\(['"]/dev/shm/[\w\-\.]+['"]\);\s*\?>(?<X120349791>)|(?:session_start\(\);[^\{]{0,99})?function\s+(random_number\s*\(\))\s*\{[^\}]{9,300}\}\s*\$\w{1,15}\s*=\s*(?:\9\.){3,6}(date\([^\)]+\))\.(?:md5\(\10\)\.?){3,6};(?<X2134275>)|(\$[o0_]{1,12})\h*=\h*urldecode\h*\(\h*['"]%[^;]+;(?:\h*\$[o0_]{1,12}\h*=\h*\12\h*\[\d+\]\h*\.[^;]+;)+[^>\v]{9999,}\barray\h*\(\h*['"]domain['"]\h*=>[^;]+;[^\?]{9,999}\b(?:exit|die)\b[^;]{0,9};[\h\}]+@?\$?[o0_]{1,12}\h*\(\h*\$[o0_]{1,12}\h*\)\h*;\s*(?:\?>|\Z)(?<X1171600>)|(\$\w)+\s*=\s*['"]https?://validlogs\.com/[\w\-]+\.txt['"];\$\w+\s*=\s*curl_init\(\14[^\}]{1,199};if\((\$\w+)\)\s*eval\(['"]\?>['"]\.\15\);\s*\?>(?<X120341072>)|(\$\w)=['"]\176\+\w\(\)['"]\^['"]!\{\+\{\}['"];(\$\w)=\$\{\17\}\[\w\];eval\(['"]\\n['"]\.\18\);\?>(?<X120331350>)|(\$\w+)=['"](https?://)[^'"]+\.txt['"];(\$\w+)=get_headers\(\20\);if\(\22\[[^\{]{1,49}\{\$\w+=[^:]{1,29}\21[^'"]+['"][^\(][^\?]{1,99}(\$\w+)=implode[^\?]{1,99};echo\23;\}\?>(?<X120351323>)|(\$\w+)=['"]\w+(?:['"];(\$\w+)=shell_Exec\(\25\);echo\s*['"]<\w+>executed[^@]{1,99}\26</pre>['"];\?>(?<X120354731>)|\(\d+;\]whcx\)\d+\$\w+\s*[^@]{1,999}\.\25\[\(\d+/\d+\)\]\.\s*[^=]{999,}\.\25\[\(\d+\*\d+\)\];\$\w+=\s*["'][^;]{999,}['"];\s*\?>(?<X120341531>))|(\$\w+)=['"]https?://['"];eval\(['"]\?>['"]\.\w+\(\29\.['"][^'"]+\.txt['"]\)\);\?>(?<X120332410>)|(\$\w+)=['"]MNOst\.uvw<xyTe7C12Rjk4\+Hlmn/op-qrDY[^@]+\31\[\d+\]\];\s*\?>(?<X120346890>)|(\$\w+)=\$_SERVER\[[^\.]{1,49}if[\h\(]+\33[\h=]+['"]\d+\.\d+\.\d+\.\d+['"][^\{]{1,99}\33==[^\.]{1,199}<title>\s*Wartung\s*</title>[^\$]{1,599}<small>\33</small>[^\}]{1,49}</html>['"]\);\s*die;\s*\}\s*\?>(?<X120369641>)|(\$\w+)=\w*\(\);curl_setopt\(\35[^'"]{1,99}\$_GET\[['"][^;]+;\w+\(\35[^;]+;(\$\w+)=curl_exec\(\35\);\w+\(\35\);(?:echo)?\s*eval\(['"]\?>['"]\.\36\);(?:\Z|\?>)(?<X1326381>)|(\$\w+)=base64_decode\(['"]CiR4bWxuYW1lI[^'']+['"]\);\s*eval\(\38\);(?<X120349300>)|(\$\w+)=file_\w+\(['"]\w+\.txt['"]\);\40=str_rot13\(\40\);\w+\(['"]\w+['"],\40\);(?:include|require)(?:_once)?\s*['"]\w+['"];(?:\Z|\?>)(?<X120327712>)|(\$\w+)=str_ireplace\([^\}]{1,99}\{\42=['"][^'"]{1,99}['"];include(?:_once)?\s*['"]zip://[^#]{1,32}#['"]\.\42;\}(?:\Z|\?>)(?<X120327730>)|(\$\w+)[\h=]+['"]https://raw\.githubusercontent\.com[^'"]+\.txt['"];\s*echo\s+\w+\(file_get_contents\(\44\)\);\s*\?>(?<X120350950>)|(\$\w+)[\s=]+"";\s*\46[^'"]{1,49}['"][^'"]{1,6}['"];[^@]{1,999}\46\s*\.=\s*['"]\w+['"];[^\?]{1,699}['"]ba['"];\s*\$\w+[\s=]+['"]se['"]\.['"]64['"]\.['"]_de['"]\.['"]co['"]\.['"]de['"];[^\(]{1,99}(\$\w+)[\s=]+\$\w+[^\?]{1,49}eval\(\47\);\s*\?>(?<X120355011>)|(\$\w+)[\s=]+&?file_get_contents\(base64_decode\(['"]aHR0cHM6Ly9rbWFhM[^\$]{1,39}(?:eval|echo)\s*\49;\?>(?<X120355141>)|(\$\w+)[\s=]+(\$_\w+\[)[^;]+;\s*(\$\w+)[\s=]+\52[^;]+;\s*move_uploaded_file\(\53,\s*\51\);\s*\?>\s*<form[^>]{1,99}>\s*<input[^>]{1,99}>\s*<input[^>]{1,99}>\s*</form>\s*\Z(?<X220358220>)|(\$\w+)[\s=]+(curl_)\w+\(['"]https?://[^'"]+['"]\);\s*\56\w+\(\55[^\$]{1,99}(\$\w+)[\s=]+\56\w+\(\55\);\s+\56\w+\(\55\);\s*eval\(['"]\?>['"]\s*\.\s*\57\);\s*\?>(?<X120365620>)|(\$\w+)[\s=]+['"]\\x73\\x65\\x73\\x73[^'"]+\\x6c\\x3e\\x22\\x3b['"];\s*eval\(\59\);\s*\?>(?<X220359620>)|(\$\w+)[\s=]+['"]\bgoogle[^'"]+['"];\s*if[\h\(]+isset\(\$_SERVER[^\?]{1,199}\61[^\(]{1,49}(function)\s+\w+\((\$\w+_)[^\?]{1,99}\62_exists\(['"](curl)\w+['"][^\(]{1,49}\64\w+[^&]{1,899}file_get_contents[^&]{1,399}file_exists[^=]{1,199}base64_decode[^\{]{1,49}\63\w+\)\s*\{\}\s*\}\s*\}(?<X120370150>)|(\$\w+)[\s=]+['"]base64_decode['"];\s*(\$\w+)[\s=]+\66\s*\(['"][^'"]{1,99}['"],\w+\);\s*(\$\w+)[\s=]+\67\s*\(\$[^\.]+\.\s*['"]/['"]\s*\.\s*call_user_func\s*\(\66,['"][^'"]{1,99}['"]\)\);\s*(\$\w+)\s*=\s*\66\s*\(\68,\w+\);\s*eval\s*\(['"]\?>['"]\s*\.\s*\69\);(?<X120338810>)|(\$\w+)[\s=]+['"]https?://[^'"]+(?:['"];\s*(\$\w+)[\s=]+(curl)\w+\((?:\);\s*\73\w+\(\72,\s*\73\w+,\s*\71\);[^\{]{1,499}\73\w+\(\72,\s*\73\w+,\s*['"]\w+\.txt['"]\);\s*(\$\w+)[\s=]+\73\w+\(\72[^\?]{1,99}echo\s*['"]Gagal[^\?]{1,49}echo\s+\74;\s*\}\s*\73\w+\(\72\);\s*\?>(?<X120359610>)|\71\);\s*\73\w+\(\72[^=]{1,149}(\$\w+)[\s=]+\73\w+\(\72\);\s*\73\w+\(\72\);\s*if[\h\(]+\76[^;]{1,99}echo\s+\76;\s*\}\s*\?>(?<X120359550>))|\.json['"];\s*(\$\w+)[\s=]+json_decode\(file_get_contents\(\71[^\[]{1,49}(\$\w+)[\s=]+\$_SERVER[^!]{1,49}\79[^\[]{1,99}\78[^!]{1,99}(\$\w+)[\s=]+\78[^\(]{1,69}(\$\w+)[\s=]+\80[^\}]{1,99}['"]Location:\s*\81[^:]{1,99}(\$\w+)[\s=]+\78[^\?]{1,149}\82[^\?]{1,49}exit;[^\?]{1,49}\}\s*\?>(?<X120357560>)|\.php['"];[^/]{1,99}\$_SERVER[^\$]{1,99}(\$\w+)[^!]{1,49}!file_Exists\(\84\)\)\s*\{[^>]{1,99}(\$\w+)[^@]{1,399}(\$\w+)[\s=]+stream_context_create\(\85\)[^@]{1,99}@?file_Get_contents\(\71[^;]{1,49}\86[^@]{1,99}@?file_put_contents\(\84[^\}]{1,49}\}\s*\}\s*\?>(?<X120362890>)|\.txt['"];(?:(\$\w+)[\s=]+(curl)\w+\(\71\);\89\w+\(\88,\s*\89\w+,\s*true\);(\$\w+)=\s*\89\w+\(\88\);\89\w+\(\88\);eval\(['"]\?>['"]\s*\.\s*\(['"]\90['"]\)\);\?>(?<X120356570>)|[^@]{1,49}(\$\w+)[\s=]+@?file_Get_contents\(\71\);\s*if[\h\(]+\92[^\(]{1,49}die\(['"]\bGagal[^=]{1,99}(\$\w+)[\s=]+tempnam\(sys_get_temp_dir[^;]{1,49}\.php['"];\s*file_put_contents\(\93,\s*\92\);[^;]{1,99}include\s+\93;[^\?]{1,49}unlink\(\93\);\s*\?>(?<X120362830>)|[^\?]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);[^\(]{1,49}\96\w+\(\95,\s*\96\w+,\s*\71\);[^\{]{1,299}(\$\w+)[\s=]+\96\w+\(\95\)[^\{]{1,49}if[\h\(]+\96\w+\(\95[^'"]{1,49}echo\s*['"]\96[^\?]{1,99}eval\(['"]\?>['"]\s*\.\s*\97\);\s*\}[^\?]{1,49}\96\w+\(\95\);\s*\?>(?<X120359120>)|\s*(\$\w+)[\s=]+(curl)\w+(?:[^\$]{1,49}\100\w+\(\99,\s*\100\w+,\s*\71\);[^=]{1,199}(\$\w+)[\s=]+\100\w+\(\99[^\(]{1,49}\100\w+[^\{]{1,99}if[\h\(]+!\$\w+[^\}]{1,49}echo\s+\101;\s*\}\s*\?>(?<X120360310>)|\(\);\s*\100\w+\(\99,\s*\100\w+,\s*\71[^=]{1,99}(\$\w+)[\s=]+\100\w+[^\?]{1,49}echo\s+eval\(['"]\?>['"]\.\103\);\s*\?>\s*<\?(?:php)?\s+wp_footer[^:]{1,99}\100\w+,\s*['"]https?://[^'"]+\.txt['"]\);[^=]{1,99}(\$\w+)[\s=]+\100[^\?]{1,49}echo\s+\104;\s*\?>(?<X120357220>)|\(\);\s*\100\w+\(\99,\s*\100\w+,\s*\71\);[^\?]{1,149}(\$\w+)[\s=]+\100\w+\(\99\);\s*\100\w+\(\99\);\s*if[\h\(]+\106[^'"]{1,199}if[\h\(]+\$\w+[^\|]{1,49}['"]php['"][^;]{1,99}eval\(['"]\?>['"]\s*\.\s*\106[^:]{1,99}echo\s*['"]error:[^;]{1,99};\s*\}\s*\?>(?<X120356580>)|\(\71\);\s*\100\w+\(\99,\s*\100\w+,\s*true\);\s*echo\s+\100\w+\(\99\);\s*\100\w+\(\99\);\s*\?>(?<X120356560>))|\s*(\$\w+)[\s=]+(?:(curl_)\w+\(\71\);\s*\110\w+\(\109[^\{]{1,99}(\$\w+)[\s=]+fopen\(['"][^'"]+\.php['"][^\(]{1,49}fwrite\(\111,[^\(]{1,49}fclose\(\111\);\s*(?:include|require)\(['"][^'"]+\.php['"]\);\s*\?>(?<X120364290>)|ABSPATH[^\(]{1,49}md5\(\$_SERVER[^!]{1,99}!?file_exists\(\109[^\[]{1,99}stream_context_create\([^@]{1,99}(@?file_get_contents)\(\71[^\?]{1,199}\109\)[^@]{1,99}echo\s+\113\(\109[^@]{1,799}<a\s+href=['"]https?://[^'"]+['"]>situs\s+toto</a></p>(?<X120370840>)|file_get_contents\(\71\);\s*if[\h\(]+\109[^\?]{1,189}eval\(['"]\?>['"]\s*\.\s*\109\);[^\?]{1,99}echo\s*['"]\w+['"];\s*\}\s*\?>(?<X120367080>)|implode\(['"]['"],\s*file\(\71\)\);\s*eval\(['"]\?>['"]\s*\.\s+\109\);\s*\?>(?<X120369210>))))|(\$\w+)[\s=]+['"]zip://(zj)\d+\.zip#\118\d+\.txt['"];(?:include|require)\(\117\);\?>(?<X120356370>))
<\?(?:php)?\s*(?:(\$\w+)[\s=]+\$_SERVER(?:[^\{]{1,99}(\$\w+)[\s=]+(?:false|true);\s*(\$\w+)[^\{]{1,299}foreach[\h\(]+\3[^!]{1,49}stripos\(\1[^\?]{1,299}\2[^:]{1,99}(?:require|include)\(['"]https?://[^'"]+\.txt['"]\);\s*exit;\s*\}\s*\}\s*\?>(?<X120365680>)|\[['"](?:\w+['"]\][^-]{1,99}(\$\w+)[^\]]{1,249}\];[^;]{1,99}\5\);\s*(\$\w+)[\s=]+preg_match[^\$]{1,29}implode[^=]{1,49}\1\)[^\$]{1,29}(\$\w+)[^&]{1,99}\7[\s=]+rtrim\(\7[^\{]{1,99}\7[^\{]{1,49}\6\)\s*\{\s*include\s+__DIR__[^;]{1,49}\.html['"];\s*exit;\s*\}\s*\?>(?<X120351150>)|HTTP_USER_AGENT['"]\](?:;\s*(\$\w+)[^\{]{1,99}foreach[\h\(]+\9[^!]{1,49}\1[^\}]{1,99}header\(['"]Location:\s*https?://[^'"]+['"]\);\s*exit\(\);\s*\}\s*\}\s*\?>(?<X120359390>)|[^\[]{1,49}(\$\w+)[\h=]+\[[^\(]{1,99}foreach[\h\(]+\11[^:]{1,49}stripos\(\1[^:]{1,49}['"]Location:\s*https?://siakad\.pgribrebes\.sch\.id/['"][^\}]{1,49}exit;\s*\}\s*\}\s*\?>(?<X120354580>)))|\[[^\$]{1,49}(\$\w+)[^\(]{1,49}function\s+(\w+)\(\13[^/]{1,99}['"]https?://[^;]+\13['"];[^;]{1,99}(file_get_contents)[^\}]{1,199}\}\s*(\$\w+)[\s=]+\14\(\13\);[^\[]{1,49}\$_GET[^\}]{1,129}\1;[^\}]{1,99}\13[^\{]{1,149}\1[^\{]{1,49}\16[^\(]{1,99}echo\s+\15\(['"]https?://[^'"]+\.pages\.dev[^'"]+['"]\);\s*exit;\s*\}\s*\?>(?<X120354460>)|\[[^\[]{1,49}(\$\w+)(?:[^;]{1,99}\];\s*foreach\s*\(\18\s*\w+\s*(\$\w+)\)\s*\{\s*if\s*\(stripos\(\1,\s*\19[^'"]{1,99}(header)\(['"]HTTP/1\.1\s+301[^\(]{1,99}\20\(['"]Location:\s*https?://jurnal\.feb\.unila\.ac\.id/['"]\);\s*exit\(\);\s*\}\s*\}\s*\?>(?<X120352990>)|[^\{]{1,799}function\s+(\w+)\(string\s+(\$\w+)[^;]{1,99}\23[^\{]{1,49}foreach[^/]{1,199}preg_match\(['"]/\(\bbot[^\{]{1,99}\23[^\?]{1,99}return\s+(?:false|true);\s*\}\s*(\$\w+)[\s=]+\22\(\1,\s+\18\);\s*if[\h\(]+\24\)\s*\{\s*\?>(?<X120370720>)))|(\$\w+)[\s=]+\[\s+['"]https?://[^,]{1,39}/[\w\-]+\.txt['"],[^\$]{1,119}foreach\s+\(\26\s*as\s*(\$\w+)\)\s+\{\s+(\$\w+)[\s=]+@file_get_contents\(\27\)[^\}]{1,119}\28[\s=]+str_replace[^\}]{1,69};\s*\}\s*\}\s*\?>(?<X120355061>)|(\$\w+)[\s=]+\w+\(\);\s*(\$\w+)[\s=]+['"]https?://[^;]{1,99}\.txt['"];\s*\w+\(\30,\s*[^;]{1,99}\31\);[^\?]{1,199}(\$\w+)[\s=]+\w+\(\30\);\s*echo\s*\32;\s*\?>(?<X120346440>)|(\$\w+)[\s=]+base64_decode\(['"]aHR0c[^'"]+['"]\);\s*\$\w+[\s=]+['"]https?://['"]\.(\$_SERVER)\[['"]HTTP_HOST['"]\][^\(]{1,49}(\$\w+)=strtolower\(\35[^\(]{1,49}if\(strstr\(\36,['"]\w+['"]\)\s*or\s+strstr\(\36,['"]\w+['"][^\{]{1,49}\36[^\(]{1,49}header\(['"]Location:\s*\34['"]\);\s*exit;\s*\}\s*\?>(?<X120357520>)|(\$\w+)[\s=]+function\((\$\w+)\)\s*\{\s*(?:include|require)\s+\39;\s*\};\s*(\$\w+)[\s=]+\[['"]zip://(cw)\.zip#\41['"]\];\s*\38\(\40\[\d+\]\);\s*\?>(?<X120358850>)|(\$\w+)[\s=]+isset\(\$_get[^=]{1,49}(\$\w+)[^\{]{1,49}\43[^;]{1,49}(\$\w+)[\s=]+['"]\w+\.txt['"];[^\{]{1,49}file_exists\(\45[^\}]{1,129}(\$\w+)[\s=]+strtolower\(\43\);\s*foreach[^;]{1,99}\46[^\}]{1,99}\44[^\}]{1,29}break[^\{]{1,99}\44[^\}]{1,99}include\s*['"]\w+\.php['"];\s*exit;\s*\}\s*\?>(?<X120353720>)|(\$\w+)[\s=]+strtolower\(\$_SERVER\[['"]\w+['"]\][^\{]{1,49}function\s+(\w+)\(\$\w+\)\s*\{\s*(\$\w+)[^\(]{1,149}foreach\s*\(\50[^\.]{1,499}\49\(\48[^:]{1,49}https?://[^'"]+\.pages\.dev[^'"]+\.txt['"][^@]{1,299}(\$\w+)[\s=]+@?file_get_contents[^\}]{1,199}echo\s+\51[^\*]{1,99}exit;\s*\}[^\?]{1,99}\?>(?<X120353260>)|(\$\w+)[^\+]{1,99}error_reporting[^/]{1,49}preg_match[^@]{1,1999}@?\$_SERVER[^@]{1,99}urlencode\(\@?\$_SERVER[^#]{99,1999}exit\(\);\}[^\n]{1,399}\53[^@]{1,1999}@?file_get_contents[^!]{1,199}curl_setopt[^@]{1,1199}@?file_put_contents[^\?]{1,199}\\\w+\.txt['"][^\}]{1,99}\}exit\(\);\w+;\}\}\w+\{\};\?>(?<X120348971>)|(\$\w+)[^\.]{1,99}(\$\w+)=['"]//cw\d+\.\w+[''];(\$\w+)[^\.]{1,49}(\$\w+)=[^\\]{1,99}\.\57\.\56\.\58\.\55[^\(]{1,99}error_reporting\(0\);[^\?]{1,1500}\w+[^@]{1,599}@?file_get_contents[^#]{1,999}(\$\w+)[^#]{1,1999}(\.txt)['"],\59\);\}[^\{]{1,99}\{\w+\(['"][\w-]+\60['"],[^;]{1,32};\}[^\?]{1,99}\}\s*\?>(?<X120349352>)|(\$\w+)[^\?]{1,199}(\$\w+)[\s=]+(?:\$_SERVER[^&]{1,49}\63[^\{]{1,49}preg_match\(\62,\s*\63\)\)\s*\{\s*(\$\w+)[\s=]+['"]https?://[^'"]+['"];[^;]{1,49}(\$\w+)[\s=]+file_get_contents\(\64[^\}]{1,99}echo\s+\65;\s*exit;\s*\}\s*\?>(?<X120359800>)|strtolower\(\$_SERVER[^\{]{1,99}foreach[\h\(]+\62[^!]{1,49}\63[^/]{1,99}(\$\w+)[\s=]+\$_SERVER[^\{]{1,99}\67[^\{]{1,49}\.html[^@]{1,49}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://[^'"]+\.txt['"][^\}]{1,129}echo\s+\68;\s*exit;\s*\}\s*\}\s*\?>(?<X120359792>))|(\$\w+)[^\}]{1,399};(\w+)\(['"](?:wget|curl)[^'"]{1,99}gunzip\{\70\}\.gz['"]\);[^@]{1,399}chmod\(\70[^;]{1,99};\w+\(\70[^;]{1,99};die\(['"][^;][^\}]+\}\}\w+\s*\71\(\$\w+\)\s*[^\}]{1,99}\}die\(['"][^;]{1,99};(?<X120339523>)|(\$\w+)\s*=\h*\$_SERVER\[['"]REQUEST_URI['"]\][^\$]{1,29}(\$\w+)[^,]{1,69}\73[^:]{1,299}\74\)\)\s*\{[^/]{1,49}(\$\w+)\s*=\s*['"]https?://link\-studiobet78\.pages\.dev[^'"]{1,29}['"];\s*(\$\w+)\s*=\s*@?file_get_contents\(\75\);\s*[^!]{1,29}\76[^\}]{1,69}echo\h*\76;\s*exit;\s*\}\s*\}\s*\}\s*\?>(?<X120345270>))
<\?(?:php)?\s*(?:(\$\w+)\s*=\s*(?:(curl)\w+\(\);\s*\2\w+\(\1[^:]{1,49}['"]https?://[^'"]+['"]\);\s*\2\w+\(\1[^=]{1,49}(\$\w+)[\s=]+\2\w+\(\1\);\s*\2\w+\(\1\);\s*echo\s+\3;\s*\?>(?<X120349530>)|@?file_get_contents\(base64_decode\(['"]aHR0cHM6Ly9oZ[^'"]+3EmdD10MQ==['"]\)\);\s*@?eval\(base64_decode\(\1\)\);\s*\?>(?<X120344780>)|['"](https?://beneath\.us\.com)[^;]{1,29};\s*(\$\w+)\s*=\s*(curl)\w+\(\1\);\s*\8\w+\(\7[^!]{1,129}(\$\w+)\s*=\s*\8\w+\(\7\);\s*\8\w+\(\7\);\s*\w+\s*\(\9[^\{]{1,49}\{\s*echo\s+\9;[^!]{1,49}echo[^:]{1,49}\bgagal[^/]{1,49}\6[^;]{1,49};\s*\}\s*\?>(?<X120347270>)|['"][^;]{1,200}['"];\s*(\$\w+)\s*=\s*['"]https?://[^;]{1,199};\s*(\$\w+)\s*[^\}]{1,99}\1\}\s*\{\11\}['"]\);\s*\w+\s*[^&]{1,199}if\s*\(file_exists\(\1\)\s*&&\s*\w+\(\1\)\s*==\s*\12\)\s*\{\s*@?(?:chmod|touch)\(\1,[^;]{1,32};\s*[^\}]{1,99}[\}\s]+\w+\s*\w+\(\$\w+\)\{(?:eval|trim)\(\);\}\s*(?:exit|die)\(['"]!?\w+!?['"]\);(?<X120341543>)|['"][^\^]{1,29}['"]\^['"]!\{\+\{\}['"];\s*(\$\w+)\s*=\s*\$\{\1\}\[['"]pass['"]\];\s*eval\(['"]\\\w+['"]\.\14\);\s*\?>(?<X120344261>)|['"]http(?:s?://(?:(?:ww|cw)\.acidpoll\.top[^;]{1,49}['"];(\$\w+)=(curl)\w+\(\);\17\w+\(\16.[^;]{1,49}\1\);[^\{]{1,179}\{echo\h*['"]\bgagal[^\.]{1,49}\.\s*\17\w+\(\16\);\}else\{eval\(['"]\?>['"]\.\$\w+\);\}\17\w+\(\16\);\?>(?<X120347333>)|[^'"]{1,199}\.pages\.dev[^;]{1,49}\.txt['"];(\$\w+)\s*=\s*(curl)\w+\(\1\);\20\w+\(\19[^\?][^\$]{1,99}(\$\w+)=\s*\20\w+\(\19\);\20\w+\(\19\);eval\(['"]\?>['"]\s*\.\s*\(['"]\21['"]\)\);\s*\?>(?<X120344132>)|[^'"]{1,256}/[\w\-]+\.txt['"];\s*(\$\w+)=\s*(curl)\w+\(\)\s*;\24\w+\(\23,\s*\w+,\s*\1\);\24\w+\(\23,\s*\w+,\s*\d+\)\s*;(\$\w+)[\s=]+\24\w+\(\23\);\24\w+\(\23\);(?:echo)?\s*(?:eval\(\s*)?\25;\s*\)?\?>(?<X120336272>)|ampungue\.xyz[^;]{1,29}['"];\s*(\$\w+)\s*=\s*curl_init\(\1[^\.]{1,399}curl_close\(\27\);[^=]{1,99}(\$\w+)[^\?]{1,99}echo\s*\28;\s*\}\s*\?>(?<X120343320>)|j251[^/]{1,99}(?:zgoban|zpollich)?[^;]{1,49};[^;]{1,99}['"]\.php['"];\s*function\s*create[^;]{1,49}(\$\w+)\s*=\s*(curl)\w+\(\);\s*\31\w+\(\30[^\}]{1,99}\31\w+\(\30\);[^@]{1,99}@?unlink[^\}]{1,49}\1[^\?]{1,99}(?:include|require)\(\$\w+\);\s*\?>(?<X120344380>)|paste\.lix\.st/raw[^;]{1,49};(\$\w+)\s*=\s*(curl)\w+\(\1\);\34\w+\(\33[^\$]{1,49}(\$\w+)=\s*\34\w+\(\33\);\s*\34\w+\(\33\);eval\(['"]\?>['"]\s*\.\s*\(['"]\35['"]\)\);\s*\?>(?<X120344171>)|raw\.githubusercontent\.com/rendihidayat683[^;]{1,99};\s*(\$\w+)\s*=\s*curl_init\(\1\);\s*curl_setopt\(\37[^\.]{1,399}echo[^\?]{1,199}eval\(['"]\?>['"]\s*\.\s*\$\w+\);\s*\}\s*curl_close\(\$\w+\);\s*\?>(?<X120343121>))|s['"];\s*(\$\w+)\s*=\s*['"]www\.fcalpha\.net['"];[^:]{1,99}\1[^;]{1,49}\39[^'"]{1,99}case\s*['"]\w+(_get_contents)['"]:[^\}]{1,79}\w+\40\((\$\w+)\);\s*\}[^\?]{1,299}fopen\(\41[^\}]{1,99}\w+\40[^!]{1,299}foreach[^\?]{1,199}eval[^&]{1,49}echo\s*['"]\s*['"];\s*\}\s*\?>(?<X220344350>))|['"]PD9waHANCnNlc3Npb25[^'"]+0Pg0KDQo8L2JvZHk\+DQo8L2h0bWw\+['"];\s*(\$\w+)\s*=\s*base64_decode\(\1\);\s*file_put_contents[^\$]{1,49}\43\);\s*echo[^\?]{1,299};\s*\?>(?<X220344220>)|\$_SERVER\[['"]REQUEST_URI['"]\][^!]{1,99}\1,\s*[''"]/[\w\-]+/['"]\)\s*!==\s*(?:false|true)\)[^;]{1,499};[^:]{1,99}https?://[^\.]{1,99}\.pages\.dev[^'"]{1,49}['"];\s*(\$\w+)\s*=\s*@?file_get_contents\(\$\w+\);\s*if\s*\(\45[^\$]{1,99}echo\h*\45;\s*exit;\s*\}\s*\}\s*\}\s*\?>(?<X120345781>)|\[['"](?:googlebot|google\-instepctiontool)?[^;]{1,49}['"]\];[^\{]{1,119}(\$\w+)\h*=\h*(?:false|true)?;\s*foreach\h*\(\1[^/]{1,112}\47\)\s*\{\s*(\$\w+)\s*=\s*['"]https?://[\w\-]+\.lol/[^'"]{1,99}['"];[^@]{1,599}@?file_get_contents\(\48[^!]{1,99}echo[^\}]{1,49}exit;\s*\}\s*\?>(?<X120345531>))|(\$\w{1,10})\h*=\h*array_merge\h*\(\h*\$_[GPRSC]\w{2,6}\h*,[^;]{1,49};\s*(\$\w{1,10})\h*=\h*isset\h*\(\h*\50\h*\[[^;]{1,299};[^\?]{0,40}\beval\h*\(\h*(?:(?:strrev|base64_decode)\h*\(\h*){2,}\51[\)\s]+;\s*\}\s*(?:\?>|\Z)(?<X1173121>)|(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);\s*\55setopt\h*\(\54\h*,\h*curlopt_url\h*,\h*base64_decode\h*\(['"]aHR0cH[^\)]{6,99}\)\.\53\);\s*\55exec\h*\(\54\);\s*(?:\?>|\Z)(?<X1185942>)|(\$\w{1,40})\h*=[\h'"base64_dco\.\d/\+\-%\^\(\)]{18,49};\s*(\$\w{1,40})\h*=\h*(?:\(\h*)?['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\58\h*\);\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*(?:\(\h*)?\57\h*\(\h*\59(?:\h*\)){2,3};\s*(?:\?>|\Z)(?<X1170853>)|(\$\w{1,40})\h*=\h*['"][^'"]+\.php['"];\s*(\$\w{1,40})=\h*(http_get)\h*\(\h*['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*\61\b[^;]{1,99};\s*fwrite\h*\(\h*\64\h*,\h*\62\h*\);[^\{\}\?]{1,199}\bfunction\s+\63\h*\(\h*\$\w{1,40}\h*\)\s*\{[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1170890>)|(\$\w{1,40})\s*=[^;]{99,999};\s*@?file_put_contents\s*\([^,;]+,\s*\66\s*\);[^\?]{0,499}\$(\w{1,40})\s*=\s*(\w{1,40})\s*\(\s*\$\w{1,40}\s*\);\s*@?eval\s*\(\s*['"]\?>['"]\s*\.\s*\$\67\s*\);\s*function\h+\68\b[^\}]{1,499}\bcurl_exec\s*\([^;]{1,49};\s*return\s+\$\w{1,40};\s*\}\s*(?:\?>|\Z)(?<X1185990>)|(\$\w{1,40})\s*=\s*(?:(?:array\s*\(|\[)[^;]{1,99}\$_[GPCSR]\w{2,6}\b[^;]{1,99};\s*if\s*\([^=;\{]{1,99}\70\[[^=;\{]{1,99}\{\s*(\$\w{1,40})\s*=\s*\70\[[^;]{1,99}\(\70\[[^;]{1,99};\s*(?:(\71\[)[^\]]+\]\s*(?:=\s*\72[^\]]+\]\s*\(|\(\s*\72)[^\}]{1,99};\s*){3,}\}\s*(?:\?>|\Z)(?<X1189270>)|["']https?://[^;]{1,199};\s*\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]cd\s*/tmp;curl\s*-O\s*['"]\.\70\.['"](\w+);perl\s*\74;rm\s*\-\w+\s*\74(?<X2186104>)|['"][^;]{1,99};\s*(\$\w{1,40})\s*=\s*explode\s*\([^;]{0,99}\70\b[^;]{1,99};[^\}\?]{0,499}\$(\w{1,40})\s*=(?:\s*\76\s*\[[^\]]+\]\s*\.){3}[^;]{0,199};\s*\$\77\s*\(\s*\$_[GPCSR]\w{2,6}\[[^;]{1,199};\s*(?:\?>|\Z)(?<X1186410>))|(\$\w{1,9})=['"]lave['"];\s*(\$\w{1,9})=['"]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)['"];\s*\79=strrev\(\79\);\s*@?(?:eval|assert|shell_exec|exec|popen|system|passthru)\(\79\.\80\);\s*\?>(?<X1133050>)|(\$user.?agents?.?to.?filter)=array\(['"]#[^\)]{300,1500}\);[^!]{0,20}\bif\(!empty\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\W{0,3}\([^\(]{0,9}\bstri?pos\(preg_replace\(\82,[^:/]{9,200}\bif\(\$isbot\)\{[^>#]{99,900}\b(curl_)exec\([^\)]+\);\83close\([^\)]+\);echo\h*\$\w{1,20};\}\s*\?>(?<X1178472>)|(\$user.?agents?.?to.?filter)[\h\=]+array[\h\(]+['"]#[^\)]{300,1500}[\h\)]+;[^!]{0,20}\bif[\h\(]+!empty[\h\(]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\h\)]+\W{0,3}\([^\(]{0,15}\bstri?pos[\h\(]+preg_replace[\h\(]+\85,[^:/]{9,200}\bif[\h\(]+\$isbot\b[^\?]{99,550}\bheader[\h\(]+[""]Location[^\}]+\}\s*\?>(?<X1240110>)|(function)\s+(\w+)[^\$]{1,29}\$\w+[\s=]+\$_SERVER[^\{]{1,299}\87[^&]{1,129}file_exists[^;]{1,99}file_get_contents\([^\(]{1,49}curl_\w+[^\{]{1,399}(\$\w+)\)\s*\{\s*file_put_contents[^\{]{1,49}return\s+\89[^\{]{1,49}\88\([^\(]{1,49}echo\s+fetch_content\(['"]https?://[^'"]+['"]\);\s*exit;\s*\}\s*\?>(?<X120366310>)|(function)\s+(\w+)\((\$\w+)(?:[^'"]{1,49}\91_exists\(['"](curl)\w+['"][^\}]{1,49}\94\w+\(\93\);\s*\94\w+[^\}]{1,299}\94\w+[^'"]{1,99}\(\$_SERVER[^\$]{1,49}(\$\w+)[^:]{1,199}https?://301\-family\.club[^'"]+\.txt['"];[^\{]{1,49}\95[^;]{1,49}\92[^\{]{1,49}trim[^;]{1,49}echo\s+\$\w+;\s*exit;\s*}\s*\}\s*\?>(?<X120351180>)|[^<]{1,99}<strlen\(\93[^&]{1,599}\91\s+stream_open\([^\+]{1,99}(base64_decode)\(substr[^/]{1,999}explode\([^\?]{1,299}include\s*['"]\w+://['"]\.base64_encode\(['"]<\?php[^\(]{1,49}\97\(['"][^'"]+['"]\);\s*\$\w+=\97[^\-]{1,99}(\$\w+)=\92[^!]{1,299}gzuncompress\(\98[^\?]{1,159}invoke\((?<X220369171>))|(function)\s+(is_bot)[^\[]{1,99}\$_SERVER[^\$]{1,99}(\$\w+)[^\{]{1,599}foreach[^!]{1,99}\102[^\{]{1,99}\100\s+(\w+)[^@]{1,599}\101\([^@]{1,239}@?file_get_contents\(['"]https?://[^'"]+['"]\);[^\$]{1,49}(\$\w+)[^\}]{1,99}echo\s+\104[^\?]{1,199}echo\s+\103\(\);\s*(?:exit|die);\s*\}\s*\}\s*\?>(?<X120355730>))
<\?(?:php)?\s*(?:\$\w{1,40}\s*=\s*['"](?:[^'"]{30000,}['"];\s*[^\%]+%\d+\)\s*\)\s*;\s*\}\s*(\$\w{1,40})\s*=\s*@?gzinflate[^\{]{40,100}\s*\{\s*(\$\w{1,40})\s*=\s*create_function\(['"]\$\w{1,40}['"],\1\);\s*\2\(['"][^'"]{40,99}['"]\);\s*\}\s*(?:\?>|\Z)(?<X1056260>)|\w{32}['"];\s*\$\w{1,40}\s*=\s*['"]#df5['"];\s*\$\w{1,40}\s*=\s*['"]FilesMan\b(?<X2046016>))|\$cmd\s*=\s*\$_[GPCSR]\w{2,6}\h*(?:\\\s*)?\[\h*['"]-cmd['"]\h*\];\s*\?>[^/]{1,99}<title>[^/]{0,99}\bShell\b(?<X2142470>)|\$GLOBALS\[['"](\w+)['"]\]=array\((base64_decode)\([^,]{1,32},\7\([^,]{1,32},\7\([^\\]{1,5999}\6['"]\]\[\d+\]\s*\(\$\w+\);die\(\);\$\w+=round\([^\)]{1,99}\);\}\?>(?<X120331390>)|\$ip\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*.{1,400}\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$mensaje\s*,\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2052101>)|getenv\(['"]REMOTE_ADDR['"]\)\s*;\s*(\$\w{1,40})\s*=\s*fopen\(['"]\w{1,40}\.\w{1,8}['"],\s*['"]a['"]\);\s*fwrite\(\10,\$ip[^;]{1,60}\);\s*\$\w{1,40}\s*=\s*rand\(\d+,\s*\d+\);(?<X2052141>))|\$ipv?\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\s*\.?=\.?\s*[^;]{1,80}\s*;\s*){0,3}\s*\$(?:mensaje|message)\s*\.?=\s*['"](pass|passwd|password)[^\w]{1,40}\$_POST\[['"]?\w{0,20}\12['"]?\]\.?['"]?\\n['"];(?<X2054441>)|\$sh[e3]ll_color\h*=\h*['"][^'"]{0,40}['"]\h*;(?:\s*(?:error_reporting|set_time_limit)[\h\(]+(?:0|false|off)[\h\)]+;){2}[^\\]{0,499}\bphp_uname\h*\((?<X2181640>)|\$user_agent_to_filter\h*=[^\?]{999,4999}\bif\(\h*@\$is_?bot\h*\)\s*\{[^\}]{1,499}\becho\h*\$result;\s*\}\s*(?:\?>|\Z)(?<X1177800>)|\?>\)\)['"]https?:[^/]+/\w+\.txt\b\s*\w+\s*\w+\(\$\w+[^\)]+\)\s*\{\w+\{(\$\w+)=\w+\(\);\w+\(\16,[^\}]+\16\);\w+\$\w+;\}catch\(\w+\$\w+\)\{\}\w+\s*\d;\}(?<X1323660>)|\[function\((\$\w+)\)\{include_once\(\18\);\}\]\s*\[\d+\]\(['"]zip://css\.zip#index\.php['"]\);\?>(?<X120341250>)|\\(\$\w+)[\s=]+['"][^'"]+\\x41\\x41\\x3d\\x3d['"];\s*\\\$\w+[\s=]+['"]==w1uO5lD[^'"]+['"];\s*eval\(htmlspecialchars_decode\(gzinflate\(base64_decode\(\\\1\)\)\)\);\s*\?>(?<X220356920>)|\b(function)\s+(is_bot)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER[^\{]{1,299}\24[^!]{1,99}foreach[^\?]{1,199}\22\s+(\w+)[^;]{1,99}(curl)\w+\(\);\s*\26\w+[^\}]{1,299}echo[^\}]{1,99}\26\w+[^:]{1,99}return\s+\$\w+[^:]{1,99}https?://[^'"]+['"];[^\{]{1,99}\23\(\)[^;]{1,99}\25[^\{]{1,99}(\$\w+)\)[^;]{1,99}echo\s+\27;[^\?]{1,99}exit;\s*\}\s*\?>(?<X120355476>)|\bif\s*\((?:\$_[GPRSC]\w{2,6}\[['"]\w+['"]\]\)\{\s*(\$\w+)\s*=\s*shell_exec[^;]{1,30};\s*echo\s*['"]<pre>\29</pre>['"];\s*\}\s*\?>(?<X120342691>)|\w+\((\$\w+)\[['"]\w+['"]\]\)\s*&&\s*(?:!\w+\(\31\[['"]\w+['']\]\)\)\s*\{\s*[^\}]{1,150}\s*\$\w+\s*=\s*get_option\(\$\w+\);[^@]{1,499}\s*(foreach)\s*\(\$\w+\s*\w+\s*\$\w+\)\s*\{\s*[^#]{1,280}\32\s*[^\}]{1,120}strpos\([^@]{1,499}\s*@?file_put_contents\([^%]{1,140};\s*\}\s*\}\s*\?>(?<X120341281>)|\31\[[^@]{1,350}\s*\$\w+\)\)\s*\{\s*(wp_send_json_error)[^@]{1,999}\w+\s*\([^@]{1,499}@?file_put_contents[^#]{1,499}curl_setopt\(\$\w+,\s*\w+,\s*\w+\);[^@]{1,9999}@?\w+[^\?]{1,999}@chmod\([^\}]+\}\s*\34[^\}]{1,99}\}\s*\34[^;]+;\s*\}\s*\}\s*\?>(?<X120341272>)))|\binclude(?:_once)?\(['"]zip://[\w\-]{1,8}#\d+['"]\);\s*(?:\Z|\?>)(?<X120326541>)|\w+\(!\w+\((\$_POST\[['"][\w\W]{2,16})['"]\]\)\)\{\s*\$\w+[=\s]+\w+\([^;]{1,199}sys_get_temp_dir\(\)\]\);\s*\$\w+[\s=]+hex2bin\(\37['"]\]\);[^\}]{1,99}\}\s*\w+[^\}]{1,199}(\$\w+)[\s=]+\w+\([^\}]{1,199}\{\s*\w+\s*\38;\s*unlink\(\38\);\s*(?:exit|die);\s*\}\s*\}\s*\}\s*\}(?<X120332401>)|\w+\(\w+\(\$_(?:COOKIE\[['"][^\}]{1,99}\}\w+\s*\w{32,}\((\$\w{32,})\)\s*\{\w+\(\w+\(['"]\w+['"]\)\)\s*\{(\$\w{32,})=(curl_)\w+\(\);\42[^\}]{1,999}CURLOPT_USERAGENT,(base64_decode)\(['"][^'"]{32,}['"]\)\);\42\w+\(\41[^\}]+\}\w+\s*file_get_contents\(\40[^\?]{1,999}\.['"]\?\w+['"];echo\s*\43\(['"][^\.]{1,199}\.\40\.[^\?]{1,199}\.\43\(['"][^'"]{4,}['"]\);\}\?>(?<X120328981>)|SERVER\[(base64_decode)\([^\]]{1,99}\],\45\(['"][^'"]{1,99}['"]\)\)[^'"]{1,999}['"]aHR0[^'"]+['"]\);\$\w+=\w+\(\$\w+\);\$\w+=\w+\(\$\w+,\w+\);\$\w+=array[^\}]{1,499}str_replace\(\45\(['"][^,]{1,99},\45[^\}]{1,99}\}echo\s*\w+\(\45\([^,]{1,99},\$\w+\);\}(?:\Z|\?>)(?<X120326960>))|\w+\s*(\w+)\((\$\w+)(?:,\s*\$\w+\)\{(\$\w+)=['"]+;\w+\((\$\w+)=[^\}]{1,99}=ord\(\48\[\50\s*\+\s*\d\]\);\w+\(\$\w+>[^}]{1,99}\$\w+\.=chr\(\$\w+[^\}]{1,99}\}\w+\49;\}\w+\(!\w+\(['"]ABSPATH['"]\)\)\{include\s*\47\(['"][\w\-]+['"],\d+\);\}(?<X120342110>)|\)\s*\{\s*\w+\s*\(\w+\(['"]allow_url_fopen['"\)\s\{]+\w+\s*\w+\(\48\);\s*\}[^\{]{1,99}\w+['"\)\s\{]+(\$\w+)[^\}]{1,999}\w+\(\52\);[^\{]{1,999}(\$\w+)\s+=\s*\w+\(\$_[^;]+;\s*(\$\w+)[\s'"=]+https?://[^'"]+['"];\s*\$\w+[\s=]+\47\(\54\);\s*\$\w+[^\{]+googlebot[^\}]+preg_match\(\$\w+,\s*\53\)\)\s*\{\s*echo\s*\$\w+;\s*exit;\s*\}\s*\?>(?<X120340230>)|\)\{(\$\w+)=\w+\(\);\w+\(\56,\[\w+=>\48,\w+=>\w+[^\}]{1,999};\(\w+\s*\w+\(\56\)\);\w+\(\56\);\}\w+\(\47\(base64_decode\(['"]aHR0[^'"]+['"]\)\)\s*\w+(\$\w+)\)\{eval\(['"]\?>['"]\.\57\)\;\}(?:\Z|\?>)(?<X120326950>))|\w+\s*(\w+)\(\)(?:\s*\{\s*\$\w+[^;]{1,256}Googlebot[^\}]+\}\s*\w+\s*\w+;\s*\}\s*\w+\s*\(\59\(\)\)\s*\{\s*(\$\w+)[^;]+\.txt['"]\);\s*echo\s*\60;\s*(?:exit|die);\s*\}\s*\w+\s*\{\s*(?:include|require)(?:_once)?\(['"][^'"]{1,99}\.php['"]\);\s*(?:exit|die)[\(\)]*;\s*\}\s*\?>(?<X120339301>)|\{[^>]{1,999}(\$\w+)=['"]['"];\w+\(function_exists\(['"](curl_init)['"]\)\)\{\$\w+=\63[^\}]{1,999}\}if\(empty\(\62\)\)\{\62=file_get_contents\(\$\w+\);\}\w+\(\62\)\s*eval\(['"]\?>\62['"]\);\}\59\(\);\?>(?<X120337530>))|\w+\s+requesthandler\s*\{\s*\w+\s*\$\w+\s*=\s*['"]https?://\d+\.\d+\.\d+\.\d+/z\d+_\d+[^;]{1,49}['"];[^+]{1,999}(curl)\w+\(\$\w+\)\s*\{\s*(\$\w+)\s*=\s*\65\w+\(\);\s*\65\w+\(\66[^@]{1,599}\65\w+\(\66[^@]{1,799}@?file_get_contents\(\w+\s*\.\s*['"]/robots\.txt['"]\);[^\*]{1,3999}process\(\);\s*\?>(?<X120344472>)|add_action\(['"]after_switch_theme['"][^\}]{1,49}get_theme_root[^!]{1,49}\.php['"];[^!]{1,39}if[\h\(]+!file_exists\((\$\w+)[^@]{1,199}@?file_get_contents\(\68\);\s*\$\w+[\s=]+base64_decode\(['"][^'"]+['"]\);[^!]{1,299}\$\w+[\s=]+strpos\([^@]{1,1299}preg_replace[^:]{1,49}Plugin\s+Name:(?<X220369350>)|class(?:\h*_\s*\{\s+public\s+static\s*(\$\w+)[^'"]{1,49}['"]\\145\\x72\\x72\\157\\x72['"]\)[^=]{1,49}\70\s*=\s*\$\w+;\s*@?eval\([^\]]{1,299}chr\(hexdec[^@]{1,199}hextostr\(@?\$_POST\[['"]\\154\\141\\x6c\\141\\x62\\x65\\141\\162['"]\]\);\s*\$\w+\s*=\s*\w+\s*_\(\$\w+\);\?>(?<X120346720>)|\s*(\w+)\s*\{\s*p(?:ublic|rivate)\s*(function)[^'"]{1,1999}p(?:rivate|ublic)\s*\w+\s*\73\s+(\w+)\(\)\{\$\w+=['"][^;]{2999,};[^\{]+base64_decode\(\$\w+\);\$\w+=gzinflate[^\{]+\{(\$\w+)=gzuncompress\(\$\w+[^\{]+\{\75=\$\w+;\}\$\w+=\73\(\)\s*\w+\(\75\)\{eval\(\75[^\{]+\73\s*(\w+)\(\)\{self::\74\(\);\}\}\72::\76\(\);(?<X120339150>)|\s+(\w+)\s*\{\s*(private\s+function)\s+\w+\(\)[^=]{1,99}\79\s+\w+\(\)\s*\{\s*(\$\w+)[\h=]+['"][^'"]{999,}['"];\s*(\$\w+)[\s=]+base64_decode\(\80\);\s*(\$\w+)[\s=]+@?gzinflate\(\81\);[^;]{1,49}\82[\s=]+\81;[^\?]{1,599}\79[^\}]{1,199}include\s+\$\w+;\s*fclose[^:]{1,199}\78::\w+\(\);\s*\?>(?<X220350061>))|date_default_timezone_set\(['"]UTC['"]\)[^>]{1,219}\$\w+=['"]\w+['"];\$\w+=\$_SERVER\[['"]QUERY_STRING['"]\];(\$\w+)=curl_init\(\);\$\w+=array\(104,116,116,112,115,[^'"]+112,104,112\);\$\w+="";foreach[^&]{1,499}curl_Setopt\(\84[^#]{1,999}\$\w+\[\d+\]\);\}\}\}\}\?>(?<X120344750>))
<\?(?:php)?\s*(?:define(?:\(['"](?:\w+['"],\s*['"]aes\-256\-cbc['"][^\{]{1,99}(\$\w+)[^\-]{1,99}\1\[strlen\(\1[^\{]{1,99}function\s+\w+\((\$\w+),\s*(\$\w+)[^\}]{1,99}\3\s*=\s*eval\(\2[^\{]{1,99}(\$\w+)[^\}]{1,249}(\$\w+)[\s=]+openssl_decrypt[^\{]{1,99}\5[^;]{1,29}return[^\-]{1,149}\}\s*\4\s*=\s*['"][^'"]\w{999,}['"];\s*\w+\(\4\);(?<X220351920>)|MENU_API_PASSWORD['"],\s*['"]\d+['"]\);\s+\$\w+[\s=]+realpath\(dirname\(__FILE__\)\);[^\?]{1,49}isset\(\$_SERVER\[[^&]{1,199}(\$\w+)[\s=]+\$\w+[^@]{1,999}case\s+['"]list['"]:\s*\w+\(array\(['"]GET['"][^:]{1,49}\7[^#]{1,2299}@?file_get_contents[^\n]{1,2999}@?move_uploaded_file\(\$\w+\[['"]tmp_name['"]\](?<X220369490>))|\h*\(\h*['"]WP_CACHE['"]\h*,\h*true\h*\)\h*;\s*if\s*\((?:\s*!)?\s*isset\h*\(\s*(\$\w{1,40})[\s\)]+\{\s*(?:\$\w{1,40}\h*=\h*['"][^'"]{1,99}['"]\h*;\s*){1,9}function\h+[a-fliox0-9_]{1,16}\h*\([^#`\176]{999,9999}\{\s*\}\s*\}\s*\9\h*\h*=\d+\h*;\s*\}\s*\?>(?<X1156881>))|echo(?:\h*['"]hii['"];\s*exit;\s*\?>(?<X120345830>)|\s*null;\s*(\$\w+)=['"][^'"]{999,}['"];function\s*(\w+)\(\12\)\{(\$\w+)=sys_get_temp_dir\(\);(\$\w+)=\14\.['"]/['"]\.\$_SERVER\[['"]HTTP[^\(]{1,49}\(md5_file\(\15\)[^\{]{1,49}['"]\w+['"]\)\{(?:include|require)(?:_once)?\s*['"]zip://\{\15\}#[^\}]{1,49}\}[^\?]{1,199}extract\(\13\(\12\)\);\?>\Z(?<X120327011>))|error_reporting(?:[^\$]{1,199}\$\w+\s*=\s*\[\s*['"]\w+['"]\s*=>\s*['"]https?://gtag\-cdn\.work[^'"]{1,99}\.html['"],[^\(]{1,89}is_search_bot\(\)\s*\{\s*(\$\w+)[^!]{1,499}(foreach)\s*\(\17[^\}]{1,79}\s*\}[^@]{1,399}\18[^#]{1,499}\w+\s*get_remote_content[^\]]{1,499}\s*\]\);\s*\$\w+\s*=\s*curl_exec[^@]{1,999}@?file_get_contents[^\.]{1,299}cache_content[^#]{1,2999}serve_bot_content[^:]{1,299}\w+\([^\)]{1,49}\);\s*\w+\([^\)]{1,29}\);\s*\?>(?<X120342810>)|[^\$]{1,99}(\$\w+)[\s=]+['"]\w+['"];\s*(\$\w+)[\s=]+['"]\w+['"];[^@]{1,329}['"]HTTP/[^;]{1,99}\20[^;]{1,49}\21;\s*(exit;)\s*[^:]{1,99}\$\w+[\s=]+['"]https?://[^;]{1,49};[^\{]{1,299}foreach[^/]{1,459}base64_encode[^\*]{1,1299}['"]User\-agent[^\?]{1,299}\$_SERVER[^;]{1,99}(\.txt)[^\}]{1,99}echo[^;]{1,19}\23[^\}]{1,99}\22\s*\}\s*\}\s*\?>(?<X120349120>)|\(0(?:[^:]{1,899}(\$\w+)[\s=]+TOKEN;[^\?]{1,199}(\$\w+)[\s=]+\w+;\s*foreach[^\-]{1,199}\26\)\s*\{\s*\$_SESSION\[['"]\w+['"]\][\s=]+['"]Please\slog[^@]{1,399}api[^>]{1,499}telegram\(\25[^'"]{1,49}echo\s*['"]<script>\s*window\.location\.replace\(['"]\./\w+\.php['"][^\}]{1,49}exit;\s*\}\s*\?>(?<X120356632>)|\);[^'"]{1,99}['"]/robot\.txt['"];[^\(]{1,49}\h*ip_in_range\((\$\w+),[^\}]{1,69}\28[^\[]{1,399}curl_setopt\([^&]{1,999}\(['"]https?://www\.gstatic\.com[^\)]{1,99}\);[^\*]{1,999}\{\s*echo\s*base64_Decode\(['"]PG1ldGEgaHR0cC1l[^'"]+mRldi9hbXAuaHRtbCI\+['"]\);\s*exit;\s*\}\s*\}\s*\?>(?<X120345250>)|\);[^:]{1,199}['"]https:?//[^'"]+\.txt['"][^\{]{1,99}function[^\[]{1,29}(\$\w+)[^@]{1,499}\$_SERVER[^\(]{1,49}foreach\s*\(\30[^\.]{1,399}[^\[]{1,99}['"]\d+\.\d+[^@]{1,999}curl_init[^@]{1,1499}@?(file_get_contents)[^&]{1,999}\31[^#]{1,1999}\$_SERVER[^>]{1,599}header\(['"]\w+\-[^;]{1,29};\s*\?>(?<X120350311>)|\);[^:]{1,99}https?://fg\w+\d+\.['"];(function)[^@]{1,99}@?(\$_SERVER\[\$\w+\])\?\s*\34[^\)]{1,99}bytespider[^\?]{1,499};exit;\}[^\?]{1,99}(\$\w+)=array[^!]{1,99}foreach\(\35[^#]{1,799}\33[^>]{1,199}(curl)\w+\([^\?]{1,499}\36\w+[^#]{1,899}@?file_put_contents[^\-]{1,399}\$\w+,\$\w+\);\}\?>(?<X120350761>)|\);[^;]{1,99}['"]/robot\.txt['"][^\$]{1,99}(\$\w+),\s*(\$\w+)\)[^\}]{1,99}\38\s*===\s*\39;\s*\}[^\{]{1,319}\{[^@]{1,499}foreach[^:]{1,999}https?://www\.gstatic\.com[^@]{1,399}foreach[^@]{1,999}echo\s*base64_decode\(['"]PG1ldGEga[^'"]+bXAuaHRtbCI\+['"]\);\s*exit;\s*\}\s*\}\s*\?>(?<X120345771>)|\);[^\{]{1,49}(function)[^:]{1,399}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*\41[^!]{1,799}(\$\w+)[\s=]+file_get_contents\(\42[^\}]{1,119}\43[^\.]{1,199}(curl)\w+[^\}]{1,599}\43[\s=]+\44\w+[^\?]{1,379}foreach[^&]{1,249}\$_SERVER[^>]{1,799}exit[^:]{1,49}https:?//[^'"]+['"];\s*\?>(?<X120351990>)|\);\s*(\$\w+)[\s=]+['"]https?://[^'"]+(?:/raw/[^'"]+['"];\s*(\$\w+)[\s=]+file_get_contents\(\46\);\s*eval\(['"]\?>['"]\s*\.\s*\47\);\s*\?>(?<X120355001>)|\.txt['"][^\(]{1,99}(function)[^/]{1,99}explode[^@]{1,199}\49\s+\w+[^;]{1,49}file_get_contents[^@]{1,299}foreach[^:]{1,299}https?://[^'"]+['"];[^@]{1,1299}(\$\w+)[\s=]+strtolower\(\$_SERVER[^\{]{1,49}strpos\(\50[^\?]{1,299}echo\s+implode[^;]{1,49}\46\)\);\s*die\(\);\s*\}\s*\}\s*\?>(?<X120362740>))|\);\s*(\$\w+)(?:[^\$]{1,299}(\$\w+)[\s=]+isset\(\$_SERVER[^\{]{1,99}foreach[\h\(]+\52[^\}]{1,49}strpos\(\53[^:]{1,199}https?://[^'"]+['"];\s*\$\w+[\s=]+(curl)\w+[^\{]{1,299}(\$\w+)[\s=]+\54\w+[^\}]{1,79}if[\h\(]+ob_\w+[^\}]{1,99}echo\s+\55;\s*exit;\s*\}\s*\}\s*\?>(?<X120365920>)|[^\?]{1,49}\$_SERVER\[['"]HTTP_\w+[^\.]{1,599}(\$\w+)[\s=]+preg_match[^\|]{1,49}implode[^:]{1,199}if[\h\(]+\57[^\{]{1,99}\.php[^;]{1,49}(curl)\w+[^:]{1,49}https?://\52['"][^\}]{1,599}(\$\w+)[\s=]+str_replace[^\}]{1,59}echo\s+\59[^\?]{1,99}\58\w+[^\?]{1,29}\?>(?<X120367531>))|\);\s*(?:\$\w+\s*=\s*['"]\w+['"];\s*\$\w+\s*=\s*['"]\w+['"];\s*if\s*\(\$_\w+\[['"]\w+['"]\]\s*[^{]+\{\s*(\$\w+)\s*=\s*isset\((\$_\w+)\[['"]\w+['"]\]\)\s*&&\s*\62[^\?]+\?\s*rtrim\(\62[^:]+:\s*dirname\(\w+\)[^@]+@mkdir\(dirname\(\61\),\s*\d++,\s*\w+\);\s*\$\w+\s=\smove_uploaded_file\(\$_\w+\[['"]\w+['"]\]\[['"]\w+['"]\],\s*\61\);\s*if\s*\(isset\((\$_\w+)\[['"]\w+['"]\]\)\s*&&\s*\63\[['"]\w+['"]\][^\)]+\)[^#]{49,399}if\s*\(isset\(\63\[['"]\w+['"]\]\)\)\s*\{\s*die\((?<X220366591>)|http_response_code\(\d+\);\s*eval\([^\.]{1,49}(urldecode)\([^\(]{1,99}file_get_contents\([^\(]{1,49}\65\([^:]{1,49}['"]https?://[^'"]+\.txt['"]\s*\)\s*\)\s*\);\s*\?>(?<X120356621>)|ini_set[^=]{1,99}(\$\w+)[\s=]+['"]\w+['"];[^=]{1,99}(\$\w+)[\s=]+['"][^'"]{999,}['"];[^\$]{1,99}\s*(\$\w+)[\s=]+openssl_decrypt\(\68[^;]{1,49}\67,\s*\d+\);[^\?]{1,49}eval\(['"]\?>['"]\s*\.\s*\69\);\s*\?>(?<X220349991>)|set_time_limit\(0\);[^\?]{1,99}\$_GET\[['"]dir['"]\][^@]{1,199}move_uploaded_file[^@]{1,299}shell_exec\(['"]cd\s*['"]\s*\.\s*escapeshellarg\((\$\w+)[^\-]{1,99}isset\((\$_GET\[['"]\w+['"]\])[^\.]{1,99}\71\s*\.\s*DIRECTORY_SEPARATOR\s*\.\s*basename\(\72[^\?]{1,299}\?>[^/]{1,49}<title>Shell</title>(?<X220356902>)|set_time_limit\(0\);\s*(\$\w+)[\h\.=]+['"][^'"]+['"];\s*\74[^\?]{10000,}\74[^\$]{1,29}(\$\w+)[\h=]+[^;]{1,32};\s*(\$\w+)[\h=]+['"][^;]{1,32};\h*(\$\w+)[\h=]+\75\h*\.\h*\76;\s*(\$\w+)[\s=]+\77\(\74\);\s*eval\(['"]\?>['"]\h*\.\h*\78\);\s*\?>(?<X220349912>)|set_time_limit\(0\);\s*(\$\w+)[\s=]+['"]https?://[^'"]+['"];\s*(\$\w+)[\s=]+['"]https?://[^'"]+['"];[^;]{1,49}(curl)\w+\(\80\);\s*if[\h\(]+defined\([^;]{1,99}\81[^\(]{1,49}\82\w+[^\?]{1,199}(\$\w+)[\s=]+tmpfile[^\[]{1,49}stream_get_meta_data\(\83\);\s*(\$\w+)[^\(]{1,49}fprintf\(\83[^\?]{1,49}include\s+\84;\s*\?>(?<X120359820>)|set_time_limit\(0\);\s*\w+\(isset\(\$_GET\[['"][\w\-]+['"]\]\)\)\s*\{[^\}]{1,999}move_uploaded_file\([^\}]{1,99}\}\s*\w+\(isset\(\$_POST\[['"]([\w\-]+)['"]\][^\}]+proc_open\(\$\86,[^;]+pipes\);[^\}]+proc_close\(\$\w+\);\s*echo[^\}]+\\n['"];\s*\}\s*\}\s*\?>(?<X120341871>))|\);ini_set(?:[^\$]{1,49}(\$\w+)\)\{return\s+(base64_decode)\(\88[^!]{1,99}\89\(str_rot13\([^\?]{1,499}function\s+call\(\$\w+[^\?]{1,99}(function)_exists\([^!]{1,199}(\$\w+)=new\s+class\{\90[^\?]{1,99}\$_SESSION\[['"]\w+[''"]\]\?\?array\(\);\}\};\91\->add[^&]{1,99}if\(isset\(\$_POST[^@]{1,699}\$_GET\[['"]\w+['"]\]\?\?\$\w+;call\(['"]cd['"](?<X220366910>)|\([^!]{1,999}if\(!file_exists\([^!]{1,899}!?isset\((\$\w+)[^=]{1,49}(\$\w+)=base64_decode\(\93[^\}]{1,49}function_exists\(\94\)\)\{return\s+call_user_func_array\(\94[^&]{1,1999}return\s+\w+(_barista)\([^\(]{1,99}function\s+\w+\95\(\)\s*\{if\(isset\(\$_SESSION\[(?<X220366901>)))|\([^\.]{1,99}file_exists[^\{]{1,49}\.php[^\?]{1,299}\$_SERVER\[[^:]{1,399}domainDecode[^\*]{1,299}echo\s+(\w+)[^:]{1,99}\97\(['"]https?://[^'"]+\.txt['"]\);[^'"]{1,49}(\$\w+)[\s=]+str_replace[^:]{1,99}header\(['"]Location:\h*['"]\h*\.\h*\98\);\s*exit;\s*\}\s*\}\s*\}\s*\?>(?<X120366000>)))
<\?(?:php)?\s*(?:eval\((?:(urldecode)\(['"]\?>['"]\)\.file_get_contents\(\1\(['"]https?://(?:\w+\.)?barbarslot\.cv/[^;]+;\?>(?<X120341220>)|['"]\?>['"]\.base64_decode\(['"]PD9waHANCiAgICBmdW5jdGlvbiBnZXRVc2VySVAoKSB7DQogICAgICAgIG[^'"]{99,9999}['"]\)\);\s*\?>(?<X120329780>)|['"]\\77\\x3e['"]\s*\.\s*base64_decode\(gzinflate\(str_rot13\(convert_uudecode\(gzinflate\(base64_decode\(['"]\\120\\132\\170\\110[^'"]+['"]\){7};\s*\?>(?<X120354821>)|['"]https?://raw\.githubusercontent\.com/rendihidayat683[^\)]{1,99}\.php['"]\)\);\?>(?<X120342981>)|base64_decode\(['"](?:\\103\\151\\102\\156\\142\\63\\122\\x76\\111\\110\\x52\\x31\\121\\126\\[^'"]+\\127\\121\\x37\\111\\x45\\x70\\152\\x55\\63\\x56\\x6b\\x4f\\x69\\101\\x3d['"]\)\);\s*\?>(?<X120347250>)|CiBnb3RvIEJsQVl0OyBhaT[^'"]+['"]\)\);\s*\?>(?<X120349900>)|CiBnb3RvIFdRQ[^'"]+IEI4dWtJOiA=['"]\)\);\s*\?>(?<X120344031>)|CiBnb3RvIFV4[^'"]+gd0J3RWI6IA==['"]\)\);\s*\?>(?<X120344161>))|gzinflate\(base64_decode\(['"]tVdtU9s4EP6emf[^'"]+['"]\)\)\);\s*\?>(?<X120351110>))|function(?:[^;]{1,129};\s*(\$\w+)\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\];\s*(\$\w+)\s*=\s*['"]https?://[^;]{1,99};[^\{]{1,299}\11[^\{]{1,99}\{\s*(\$\w+)\s*=\s*curl_init\(\12\);\s*curl_setopt\(\13[^\{]{1,99}\{\s*echo\s*['"][^\(]{1,99}\(\13\)[^'"]{1,199}include[^;]{1,29};\s*exit;\s*\}\s*\}\s*\w+\(\);\s*\?>(?<X120343002>)|\h*getuserip[^=]{1,99}(\$\w+)\s*=\s*\$_SERVER\[['"]HTTP_CLIENT_IP['"]\];[^/]{1,199}\15;[^/]{1,99}['"]https?://ip\-api\.com[^'"]{1,19}\15\}['"];[^@]{1,229}(\$\w+)\s*=\s*@?file_get_contents[^&]{1,399}json_decode\(\16[^\?]{1,129}include\s*['"]readme\.html['"];[^\?]{1,59}exit\(\);\s*\}\s*\?>(?<X120345290>)|\h+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*['"]{2};[^\}]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\19\h*,[^\?:/#%&@]{1,199}\breturn\h+\20;\s*\}[^;]{1,199}\b\18\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1184061>)|\h+(isInString\d*)\h*\(\h*(\$haystack)\h*,\h*\$needle\h*\)\s*\{\s*\23\h*=[^\}]{9,99}\}\s*(\$\w{1,20})\h*=\h*strpos\h*\(\h*\$_SERVER\[['"]HTTP_REFERER['"]\]\);\s*if[\h\(]+\22[\h\(]+\24\b[^\?\(]{9,99}\bheader\h*\(\h*['"]Location:\h*https?://[^'"]+['"]\);\s*\}\s*(?:\?>|\Z)(?<X1179171>)|\s*(\w+)[^\[]{1,39}\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*(\$\w+)[^\}]{1,199}\27[^\{]{1,99}fetch_content\((\$\w+)\)\s*\{[^;]{1,99}md5\(\28[^\}]{1,199}file_get_contents\((\$\w+)\);[^\-]{1,299}file_put_contents\(\29[^\{]{1,99}\26[^\}]{1,99}['"]https?://jiedesainrumah\.id[^;]{1,99};\s*\}\s*\?>(?<X120346450>)|\s*(\w+)\(\$\w+\)\{[^=]{1,99}(\$\w+)=curl_init[^=]{1,399}(\$\w+)=curl_exec\(\32\);curl_close\(\32\);return\33;\}\}(?:echo)?\s*eval\(['"]\?>['"]\.\31\(['"]https://[^'"]{1,199}\w+\.txt['"]\)\);(?<X120331190>)|\s*(\w{1,14})[\(\)\s\{]+\$\w{1,14}[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*(\$\w{1,16})[\s=]+array\(['"](?:(?:bot|ahrefs|google)[^;]{1,120};\s*foreach\s*\(\36[^@]{1,99}if[\s\(]+\35[^\$]{1,20}(\$\w{1,16})[\s=]+file_get_contents\(['"]wp\-links\.php['"]\);[^\$]{1,49}echo\s*\37;\s*(?:exit|die);[^\)]{1,99}\)\s*\}\s*\?>(?<X120342060>)|(?:Googlebot|Telegram|bingbot|adsense|slurp|Google\-Site)[^;]{1,120};\s*foreach\s*\(\36[^@]{1,100}if[\s\(]+\35[^\$]{1,20}(\$\w{1,16})[\s=]+file_get_contents\(['"]https?://[^/]{1,30}/[^'"]{1,30}['"]\);\s*//\s*echo\s*\39;\s*\((?:exit|die)\);\s*\}\s*\?>(?<X120341960>))|\s*(\w{1,40})\h*\(\h*\$\w+\h*,\h*\$\w+\h*\)\s*\{[^\}]{99,499}\}\s*if\h*\(\h*\41\h*\(\h*['"]https?://[^/'"]{1,99}bin\.com/(?:raw|download)[/\?][^,\)]+,\h*['"][^'"]+\.php['"]\h*\)\h*\)\s*\{\s*echo\b[^;]{1,99};\s*\}\s*(?:else\s*\{\s*echo\b[^;]{1,99};\s*\}\s*)(?:\?>|\Z)(?<X1171270>)|\s*(is_bot)\(\)\s*\{\s*\$\w+[\s=]=[\shttp\.'"_useragn;]+[^\}]+(?:(\$\w+)\s*=\s*array\([^\}]+\w+;[^\{]{1,99}foreach\s*\(\44[^\?]{1,199}function\s*get_remote_content[^/]{1,399}\$\w+\s*=\s*['"]https?://raw\.githubusercontent\.com[^;]{1,99}['"];\s*\w+\s*\(\43[^\}]{1,199}echo\s*\$\w+;\s*\}\s*\w+\s*\{\s*echo\s*['"][^;]{1,99}['"];\s*\}\s*exit;\s*\}\s*\?>(?<X120342960>)|(bots)\s*=\s*array\([^\}]+\w+\s*\(\$\46\s*\w+\s*(\$bot)[^\}]{1,999}\47\)[^\?]{1,999}\43\(\)\)\s*\{[^;]+fetch_message_from_url\(['"]https?:[^;]{1,99}['"]\);\s*[^'"]{1,49}echo[^\}]{1,29}\s*\}\s*[^\?]{1,49}echo\s*[^\}]{1,29}\}\s*(?:exit|die);\s*\}\s*\?>(?<X120343460>)|(bots)\s*=\s*array\([^\}]+\w+\s*\(\$\49\s*\w+\s*(\$bot)[^\}]{1,999}\50\)[^\?]{1,999}\43\(\)\)\s*\{[^;]+file_get_contents\(['"]https?://[^;]+;[^\}]{1,32}\s*\}\s*\?>(?<X120343340>)|(bots)\s*=\s*array\([^\}]+\w+\s*\(\$\52\s*\w+\s*(\$bot)[^\}]{1,999}\53\)[^\?]{1,999}\43\(\)\)\s*\{[^;]+file_get_contents\(['"]https?://[^;]+;[^\}]{1,32}exit\)?;[^\}]{1,32}\s*\}\s*\?>(?<X120342621>))|\s*is_bot\(\)[^\[]{1,49}\$_[GPRSC]\w{2,6}\[['"]HTTP_USER_AGENT['"]\][^;]{1,29};\s*(\$\w{1,16})[\s=]+array\(\s*['"][^;]{0,220}\bgooglebot[^;]+;[^=]{1,99}foreach\s*\(\55[^%/]{1,650}//raw\.githubusercontent\.com/fadlipul69/[^;]{1,99}['"];[^\?]{1,199}exit;\s*\}\s*\?>(?<X120342863>)|\s+(\w+)[^\$]{1,29}(\$\w+)[\s=]+\$_SERVER\[[^\$]{1,29}(\$\w+)[\s=]+(gethostby)\w+\(\58[^\-]{1,99}\59[^\?]{1,99}\60\w+\(\59[^\{]{1,99}\57[^\$]{1,29}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"][^@]{1,199}(\$\w+)[\s=]+@?file_get_contents\(\61[^\?]{1,149}echo\s+\62;\s*\}\s*(?:exit|die);\s*\}\s*\?>(?<X120353030>)|\s+(\w+)[^\$]{1,49}(\$\w+)(?:[\s=]+strtolower\(\$_SERVER\[[^\[]{1,49}(\$\w+)[^\{]{1,299}foreach[\h\(]+\66[^!]{1,49}\65[^\?]{1,199}\$\w+[\s=]+\$_SERVER[^\{]{1,99}\64[^@]{1,99}(\$\w+)[\s=]+@?file_get_contents\(['"]https://[^'"]+\.html['"]\);[^;]{1,49}echo\s+\67;\s*exit;\s*\}\s*\}\s*\?>(?<X120364401>)|[^\{]{1,199}foreach\s+\(\65[^\[]{1,99}\$_SERVER[^\{]{1,99}\64[^\$]{1,49}(\$\w+)[\s=]+base64_decode\(\s+['"]aHR0c[^'"]+['"]\s*\);[^;]{1,99}(\$\w+)[\s=]+file_get_contents\(\69\);\s+echo\s+\70;\s*exit;\s+\}\s+\?>(?<X120353312>))|\s+(\w+)[^\$]{1,49}(if\s*\(isset\(\$_SERVER)[^\?]{1,199}\73[^\(]{1,99}(\$\w+)[\s=]+explode[^\}]{1,99}\74[^:]{1,199}return\s+['"]\d+\.\d+\.\d+\.\d+['"];[^\$]{1,49}(\$\w+)[\s=]+\72[^:]{1,49}https?://[^'"]+['"][^;]{1,49}\75[^@]{1,149}@?file_get_contents[^\?]{1,699}(\$\w+)[^\$]{1,99}echo\s+\76;\s*exit;\s*\}\s*\}\s*\?>(?<X120352950>)|\s+(\w+)\((\$\w+)(?:[\s=]+['"]https?://[^'"]+\.txt['"][^@]{1,299}@?file_get_contents\(\79[^\{]{1,499}ssl://['"][^\{]{1,49}if[\h\(]+(\$\w+)[^!]{1,199}fwrite\(\80[^<]{1,199}function\s+(\w+)[\h\(]+(\$\w+)[^\}]{1,199}eval[\h\(]+\82[^\?]{1,299}\81[\h\(]+['"]\?>['"]\.\78\(\s*\)\s*\);(?<X120369160>)|[^;]{1,99}file_get_contents\(\79[^\{]{1,99}function_exists[^;]{1,99}(curl)\w+\(\);\s*\84\w+[^\-]{1,399}\$_SERVER\[[^:]{1,49}(\$\w+)[\h=]+['"]https?://[^'"]+\.txt['"];[^;]{1,99}\78\(\85[^\.]{1,299}\.php[^\}]{1,49}echo\s+\$\w+;\s+exit;\s*\}\s*\}\s*\?>(?<X120351930>)|\)[^@]{1,99}file_get_contents\(\79\);[^%]{1,219}\$\w+=curl_exec[^:]{1,99}\78\(['"]https?://[^'"]+['"]\);[^;]{1,199}\.php['"];[^<]{1,129}file_put_contents[^@]{1,99}chmod\((\$\w+)[^\{]{1,49}\87[^@]{1,29}include\87;\}\}\?>(?<X120348932>)|\)\h*\{[^@]{1,99}(@?file_get_contents)\(\79\);[^\{]{1,49}function_exists\(['"](curl)\w+['"]\)\)[^;]+\90\w+\(\);\s*\90\w+\([^:]{1,599}(\$\w+)[\s=]+['"]https://[^;]+['"];[^@]{1,339}@?json_decode\(\89\(['"]https?://[^\)]+\)[^\?]{1,199}\78\(\91\);\s*echo[^\}]+exit;\s*\}\s*\}\s*\?>(?<X120348181>)|\)\s*\{\s*(\$\w+)(?:[\s=]+(?:false|true);\s*(\$\w+)[\s=]+(curl_)\w+\(\);\s*\95\w+\(\94,\s+\w+,\s+\79[^\?]{1,299}eval\(['"]\?>['"]\s*\.\s+\93\);[^\(]{1,99}call_user_func\(['"]\78['"],\s*['"]https?://[^'"]+\.txt['"]\);\s*\?>(?<X120369120>)|[^\$]{1,99}(\$\w+)[^:]{1,99}https?://[^'"]+['"][\h\.]+\93[^;]{1,49}\97[^>]{1,99}urlencode\(\79[^\(]{1,49}(curl_)\w+\([^\}]{1,199}(\$\w+)[\s=]+\98\w+[^\}]{1,99}return\s+\99;\s*\}\s*\78\(\$\w+\);\s*\?>(?<X120370470>)))|\s+(\w+)\(\$\w+[^\(]{1,49}(curl)\w+[^\{]{1,299}(\$\w+)[\s=]+\102\w+[^\{]{1,49}\102\w+[^:]{1,49}\103[^/]{1,99}return\s+\103;\s*\}[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+['"];\s*(\$\w+)[\s=]+\101\(\104\);\s*eval\(['"]\?>['"]\s*\.\s*\(\105\)\);\s*\?>(?<X120360170>)))
<\?(?:php)?\s+(?:(?:@?echo\s*)?@?eval\s*\(\s*['"]\?>['"]\s*\.\s*@?file_get_contents\s*\(\s*['"]https?://[^\)]{3,}\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1056182>)|(?:function\s*\w+\(\)\s*\{\s*(\$\w+)[\s=]+['"]\w+['"];\s*(\$\w+)[\s=]+strrev\(\2\);\s*//\s*\w+\s*return\s*md5\(\3\);\s*\}\s*){5}(?<X220335170>)|(?:include|require)(?:_once)?\s+['"][^:]{1,32}(?:zip|zlib)://[\w\-]+\.zip['"];\?>(?<X120349661>)|(\$\w+)=['"][a-fx0-9]{16,}['"];(\$\w+)=hex2bin\(\6\);eval\(['"]\?>['"]\.\7\);\?>(?<X120334680>)|(\$\w+)=['"]\d+\.\d+\.\d+\.\d+['"];(\$\w+)=\d+;\w+\(['"]/bin/(\w+)[^;]{1,32}\11\s+\-i>&/dev/tcp/\9/\10[^;]{1,32};['"]\);\?>(?<X120333820>)|(\$\w+)=['"]\w+['"];(\$\w+)=['"]zip://['"]\.__DIR__\.['"]/wp\-includes/['"]\.\13\.['"]#['"]\.\13;(?:require|include)(?:_once)?\14;\?>(?<X120357680>)|(\$\w+)=['"]\w(?:['"];(\$\w+)=['"]\w['"];(\$\w+)=['"]\w['"];(\$\w+)=['"]\w['"];(\$\w+)=\16\.\17\.\18\.\19;\s*\20\((base64_decode)\(\21\(\$_POST\[['"]\w+['"]\]\)\),(\$\w+),\$\w+\);print_r\(\22\);\s*\?>(?<X120357180>)|\(\d;\]whcx[^#]{1,999}\.\16\[[^'"]{1,999}\s*"['"][^'"]{999,}['"]";\s*\?>(?<X120343730>))|(\$\w+)=['"]compress\.zlib://['"];(?:require|include)_once\25\.\(['"]cw\d+\.gz['"]\);\s*(?:\Z|\?>)(?<X120353641>)|(\$\w+)=['"]https?://(?:(?:\d+\.\d+\.\d+\.\d+|(?:gist|raw)\.githubusercontent\.com)/[^\.'"]{1,999}\.txt['"];(\$\w+)=\w+\(\);\w+\(\28[^;]{1,99}\27\);\w+\(\28[^;]{1,99};(\$\w+)=\w+\(\28\);\s*\w+\(\28\);(?:echo)?\s*eval\(['"]\?>['"]\.\29\);(?:\Z|\?>)(?<X120326932>)|[^\'"]{1,999}\.txt['"];(\$\w+)=\w+\(\27\);\w+\(\31[^;]{1,99};(\$\w+)=\w+\(\31\);\w+\(\32[^:]{1,99}:\s*PD9waHA=['"]\.\w+\(\31\);\}\w+\{(\$\w+)=\w+\(\w+[^;]{1,99};\w+\(\33,\32\);\w+\33;unlink\(\33\);\}\w+\(\31\);(?:\Z|\?>)(?<X120326940>)|paste(?:\.[^;]{1,99}/raw/[^;]+;\$\w+=curl_init\(\27\);\w+\((\$\w+)[^\}]{1,999}\35\);\}[^\}]{1,999}\}\w+\{eval\(['"]\?>['"]\.\$\w+\);\}\w+\(\35\);\?>(?<X120347970>)|bin\.com/raw/\w+['"];(\$\w+)=\w+\(\);\w+\(\37,\w+,\27\);\w+\(\37,\w+,\w+\);(\$\w+)=\w+\(\37\);[^\?]{1,999}eval\(['"]\?>['"]\.\38\);(\$\w+)=\w+\(\);echo\39;\}\w+\{[^\}]{1,999}\}\}\w+\(\37\);\?>(?<X120334550>)))|(\$\w+)=[^;]{1,99};(\$\w+)=[^;]{1,99};(\$\w+)=[^;]{1,99};(\$\w+)[^;]{1,99};(\$\w+)=[^;]{1,99};(\$\w+)=[^;]{1,99};\$\w+=\41\.\42\.\43\.\44\.\45\.\46;[^;]{1,99};error_reporting\(0\);[^\}]+\}\$\w+=\w+\([^%]+file_get_contents\(\$\w+\);\w+\(\w+\((\$\w+)\)\)\s*\{[^%]{1,999}\{\w+\(['"]robots\.txt['"],\47\);\}\w+\(\);\w+;\}\}\w+\{\}\?>(?<X120331712>)|(\$\w+)[\s='"][^;]+;\s*(\$\w+)[\s=]+str_rot13\(strrev\(\49\)\);[^\}]{1,999}(\$\w)\s*=\s*curl_exec\([^\?]{1,999}\51\s*=\s*file_get_contents\(\50,\s*\w+,[^\?]{1,99}\51\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\51\);\s*\}\s*\?>(?<X120340960>)|(\$\w+)[\s=]+(function)[^'"]{1,99}\54[^'"]{1,99}(\$\w+)=['"]UWxTy[^'"]+['"];\s+return\s+\55;[^=]{1,49}(\$\w+)=['"]D4M3Wzi[^'"]+['"];[^\{]{1,49}\54[^/]{1,99}\54[^\?]{1,99}\53[^\?]{1,99}(\$\w+)\[\(\d+\-\s*\d+\)/\s*\d+\]\s*\.\57[^\?]{1,299}\54[^\?]{1,99}return\s*['"]AomBO[^'"]+['"];\s*\}[^\?]{1,99}eval[\h\(]+\56\);\s*\?>(?<X120355520>)|(\$\w+)[\s=]+[ht'"\.ps:\s/]+[^\?]{1,1999}\59\);\s*\w+\([^\}]{1,999}\s*\}[^\?]{1,99}eval\(['"]\?>['"]\s*\.\s*[^\?]{1,299}echo\s*['"]g['"]\.['"]a['"]\.['"]g['"]\.['"]a['"]\.['"]l['"]\.['"][^;]+;\s*\}\s*\?>(?<X120341341>)|(\$\w+)[\s=]+\w+\(['"]https?://jpcode\.xyz/?['"]\);echo\s*\61;\s*\?>(?<X120340590>)|(\$\w+)[\s=]+curl_init\(hex2bin\(['"][^'"]{1,199}['"]\)\);\s*curl_setopt\(\63,\s*CURLOPT_RETURNTRANSFER,\s*\d\);\s*(\$\w+)[\s=]+curl_exec\(\63[^%]{1,99}eval\(['"]\?>['"]\s*\.\s*\64\);\s*\}\s*curl_close\(\63\);\s*\?>(?<X120366101>)|(\$\w+)[^;]{1,99};(\$\w+)[^;]{1,99};\67\(['"][\w\-]+\.php['"],\s*\66\(['"]PD9[^'"]+PnJ1bigkYXBwKTs/Pgo[^;]{1,16}\);\s*\?>(?<X120341940>)|(\$\w+)\s*=\s*['"](?:https?://[^;]{1,256}\.txt['"];\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\71\w+\(\70,\s*\w+,\s*\69\);[^\}]{1,999}(\$\w+)\s*=\s*\71_exec\(\70\);\s*\71\w+\(\70\);\s*\w+\s*\(\72[^\{]{1,99}\{\s*echo\s*\72;\s*\}(?<X120336320>)|zip['"];include\s*\69\s*\.\s*['"]://[\w\-]+#\d+['"];\?>(?<X120346391>))|(\$\w+)\s*=\s*\w+\(\w+\(['"]aHR0c[^'"]{1,256}['"]\)\);\s*\w+\s*\(\75\s*!==\s\w+\)\s*\{echo\s*\75;\}\s*\?>(?<X120336300>)|(function)\s+(isbot)\(\)[^\$]{1,49}(\$\w+)[^\[]{1,49}(\$\w+)=\$_SERVER[^!]{1,49}foreach\(\79[^!]{1,49}\80[^:]{1,99}\78[^:]{1,49}(\$\w+)=file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\81=explode[^\|]{1,499}preg_replace_callback[^\[]{1,49}\77[^\?]{1,399}echo\$\w+;echo\s+['"]</div>['"];\}\?>(?<X120358082>)|(goto)\s*(\w+);\s*(?:(\w+):[^\]]{1,999}(\$_SESSION)\[['"]\\[a-fx0-9]+\\[^'"]+['"]\]\)\)[^\\]{1,999}\84:\s*echo\s*['"]\\[a-fx0-9]+\\[^'"]+['"];\s*\83\s*[^\}]{1,999}\85;[^\}]+\}\s*\83[^\}]+file_get_contents\(\86\[['"]\\[a-fx0-9]+[^>@]{1,999}\83\s*\w+;\s*\w+:\s*\w+:\s*(?:\Z|\?>)(?<X120334341>)|\w+:\s*[^\^]{1,1999}\83\s*\w+;\s*\w+:\s*\$\w+[\s=]+['"]\\[\\a-fx0-9]{999,}['"][^\?]{1,1999}\84:\s*\$\w+[^\?>]{1,99}\83\s*\w+;\s*\w+:\s*eval\(\$\w+\);\s*(?:\Z|\?>)(?<X120334360>))|(goto)\s*(\w+)[^\\]{1,999}str_replace\(['"]\\\w+\\\w+[^'"]+['"],\s*[^#]{1,1999}\{\s*goto\s*(\w+);[^#]{1,999}\90:\s*\$\w+[\s=]+['"]\\\w+[^'"]{99,}\\\w+['"];\s*\89[^\(]{1,999}\(['"]\\\w+[^'"]+\\\w+['"],[^\?]{1,7999}\89\s*\w+;\s*\w+:\s*\91:(?<X120349391>)|(goto)\s*\w+;\s*\w+:[^@]{1,99}@@+\(include\s*(\$\w+)\);[^\}]{1,9999}\\\w+['"]\);\s*\}\s*\}\s*\93[^}]{1,999}\94,[^\}]{1,9999}\\\w+['"]\)\);\s*\}\s*\}\s*goto[^\?]{1,999}\93\s*\w+;\s*\w+:\s*\?>(?<X120349240>)|(goto)\s+\w+;\w+:\$\w+(?:[^\{]+\{(?:\$\w+=)?(?:exit|false);\}\96\s+\w+;\w+:\$\w+\.=['"]\\?\d+['"];\96\s+\w+;\w+:\$\w+\.=['"]\\\d+['"];\96\s+\w+;\w+:[^\[]+\$_SERVER\[\$\w+\];\96\s+\w+;\w+:[^\?]{1,2999}\96\s+\w+;\w+:;\?>(?<X120343531>)|[^\{]{1,999}\{\$\w+=(?:true|false);\}\96\s+\w+;\w+:\$\w+\.=['"]\\?\d+['"];\96\s+\w+;\w+:\$\w+\.=['"]\\\d+['"];\96\s+\w+;\w+:[^\[]+\[\$\w+\];\96\s+\w+;\w+:\$\w+\.=['"]\\\d+[^\?]+\96\s+\w+;\w+:;\?>(?<X120343510>))|//\s*\W+(?:\w+\s*fake\s+png\s+header[^\(]{1,99}\(\w*\s*hide\s+payloads[^\{]{1,999}\w+\s*generateFakePng\((?<X220338232>)|ShadowGate[\s\-\|]+auto\s+deploy[\s\+]+shell\b(?<X220332370>))|//\s+fake\s+png\s+header[^\{]{1,99}generateFakePng\(\)\s*\{(?<X220341411>)|/\*[^:]{1,99}plugin\s+name:(?:[^\{]{1,999}author:\s*wordpress\s*\*/\s*add_action\((?<X220337670>)|\s+[\w\-]+[^:]{1,99}:\s+https?://example\.com/?[^#]{1,9999}Googlebot\b(?<X220350340>))|/\*\*/@?eval\(base64_decode\(['"](?:aWYoZnVuY3Rpb25fZXhpc3RzKCJvYl9zdGFy|ZihmdW5jdGlvbl9leGlzdHMoIm9iX3N0YXJ0)[^'"]{99,2000}(?:Z3ppbmZsYXRlKHN1YnN0|aW5mbGF0ZShzdWJzdHIo|emluZmxhdGUoc3Vic3Ry)[^'"]{99,1500}(?:b2Jfc3RhcnQo|X3N0YXJ0|Yl9zdGFy)[^'"]+['"]\)\);\s*\?>(?<X1119432>)|/\*\s*plugin\s*name:\s*php\s+console\s*v\.\d+\.\d+\.\d+\s*\*/[^{]{1,99}add_action\(['"]admin_menu['"],\s*['"](\w{2})\w+\105['"]\);\s*\s*register_uninstall_hook\(__FILE\w+,\s*['"]\105\w+\105['"]\);\s*register_activation_hook\(\w+,\s*['"]\105\w+\105['"]\);\s*\w+\s*\105\105\105\((?<X220338082>)|/\*{2}[^:]{1,99}plugin\s+name:[^:]{1,99}description:[^:]{1,99}version:[^:]{1,99}author:\s*wordpress\s+core\s+team\s*\*/(?<X220347960>)|@?eval[\h\(]+['"]\?>['"]\.hex2bin[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\?>(?<X1195780>)|@?session_start[^{]{1,99}@?error_reporting\(0\);\w+\s*(\w+)\((\$\w+)[^\}]{1,999}\}\w+\s*\110;\}[^\}]{1,999}\109\((\$\w+),\$\w+\);\}class\s*\w+\{[^\{]{1,999}\{@?eval\(['"]/\*[\w\-]+\*/['"]\.\111\.['"]+\);\}\}\s*\w+\s*\w+\(\111\);(echo)\s*\w+\(md5\(\$\w+[^;]+;\112\s*base64_encode\([^\\]{1,999}=\109\(\$\w+,\s*\$\w+\);\}\s*\}\s*\}(?<X120353802>)|@include_once\s+['"]\w+\.css['"];\s*\?>(?<X120340400>)|[^\}]{1,999}preg_match\(['"]/google/[^\}]+\{(\$\w+)=['"]https?://[^'"]{1,999}\.(?:txt|html|jpe?g|png)['"][^\}]{1,999}file_get_contents\(\115[^\?]{1,999}curl_close\(\$\w+\);echo\$\w+;\}(?:exit|die);\}\?>(?<X120333460>)|\$\w+=['"](?:(?:\\\d+|\w)['"];((?:\$[o0]+|\$_\d{3}))[^\}]{1,999};\117\.=['"](?:\\155|>)['"];[^\}]{1,999}\117\.=['"](?:\\155|>)['"];\117\.=['"](?:\\76|<)['"];\$\w+[^\?]{1,999}md5\(\$\w+\);\$\w+=substr\(\$\w+,0,6\);\?>(?<X120338196>)|str_rot13['"];\$\w+=['"]base64_decode['"];echo\s*['"]<html></html>[''];(ini_set)\(['"]log_errors['"],\d+\);\119\(['"]display_errors['"],\d+\);error_reporting\(\d+\);\?>(?<X120357080>)))
<\?(?:php)?\s*(?:function(?:\s+(\w+)\(\)(?:[^\(]{1,49}(\$\w+)[^\?]{1,199}(\$\w+)[\s=]+\$_SERVER\[[^\{]{1,49}foreach[\h\(]+\2[^!]{1,49}\3[^\.]{1,99}\1[^;]{1,49}(\$\w+)[^;]{1,49}\.txt['"];[^&]{1,49}file_exists\(\4[^;]{1,49}(echo)\s+file_get_contents\(\4[^\(]{1,99}http_response_code\(\d+[^'"]{1,99}\5[^;]{1,49}\4;\s*exit;\s*\}\s*\}\s*\?>(?<X120357570>)|\s*\{[^;]{1,29}\$_SERVER\[[^\$]{1,29}(\$\w+)[^\?]{1,319}(\$\w+)\s*=[^\(]{1,529}\8[^;]{1,149}\7\);\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\10\w+\(\9[^\[]{1,199}isset\(\$_GET\[['"]\w+['"]\]\)\)\s*\{[^\(]{1,39}\10\w+[^\?]{1,199}eval\(['"]\?>['"]\.\$\w+\);\s*\}\s*\}\s*\1\(\);\s*\?>(?<X120348731>)|\s*\{[^\$]{1,299}\$_SERVER\[['"]\w+['"]\][^\{]{1,99}(\$\w+)[^\]]{1,999}\];foreach\(\12[^<]{1,299}(\$\w+)[^\}]{1,499}\13;\}\w+\(\1[^@]{1,139}(\$\w+)\s*=\s*@?file_get_contents\(['"]https?://[^'"]+['"]\);\w+\(\14\)\s*\{echo\14;(exit;)[^\{]{1,99}\.xml[^\}]{1,99}echo\s*\w+\(\);\15\}\}\?>(?<X120348602>)|\s*\{[^\(]{1,49}\$_SERVER\[['"]\w+['"]\][^!]{1,199}(\$\w+)[^;]+\];\s*foreach\s*\(\17[^@]{1,129}(\$\w+)[\s=]+@?gethostbyaddr[^@]{1,129}@?gethostbyname\(\18\);[^:]{1,119}\1\(\)\)[^:]{1,49}['"]https?://[^'"]+['"];[^;]{1,99}(exit;)[^;]{1,49}curl_init\(\);[^\}]{1,529}\}\s*echo\s+\$\w+;\s*\19\s*\}\s*\?>(?<X120348563>)|\s*\{\s*(\$\w+)(?:[\s=]+array[^\{]{1,199}foreach[\h\(]+\21[^:]{1,199}\1\([^\$]{1,99}\$\w+[\s=]+['"]https?://[^'"]+\.txt['"];[^;]{1,49}(curl)\w+\([^\(]{1,49}\22\w+[^\?]{1,399}(\$\w+)[\s=]+\22\w+[^\}]{1,99}echo\s+\23;\s*exit;\s*\}\s*\?>(?<X120356120>)|[^\{]{1,199}foreach[\h\(]+\21[^\-]{1,199}\1[^\$]{1,49}(\$\w+)[\s=]+['"]https?://[^/]+\.pages\.dev/[^'"]+['"];\s*(\$\w+)[\s=]+(curl_)\w+\(\25\);\s*\27\w+\(\26[^=]{1,49}(\$\w+)[\s=]+\27\w+[^\?]{1,49}echo\s+\28[^\}]{1,49}exit;\s*\}\s*\?>(?<X120370250>)))|\s+(is_bot)[^\{]{1,49}:\s+(\w+)[^\[]{1,49}\$_SERVER[^:]{1,99}\31[^\{]{1,199}\30[^:]{1,99}(\$\w+)[\s=]+['"]https?://[^'"]+\.php['"];[^;]{1,99}(curl)\w+\(\32[^&]{1,399}\33\w+[^!]{1,199}echo\s+str_replace[^!]{1,99}http_response_code\(\d+\)[^'"]{1,49}echo[^\?]{1,99}exit;\s*\}\s*\?>(?<X120362210>)|\s+(is_bot)\(\):\s+(\w+)\s*\{\s*(\$\w+)[\s=]+strtolower\(\$_SERVER[^!]{1,49}!\37[^\(]{1,49}return[\h\(]+\36[^\{]{1,199}\35[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+\.html['"];[^;]{1,49}curl\w+\(\38[^@]{1,499}echo\s+str_replace\([^!]{1,49}http_response_code[^/]{1,49}\s*echo[^/]{1,49}<title>\w{2}[^\?]{1,49}exit;\s*\}\s*\?>(?<X120359330>)|\s+(is_mobile)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"][^\$]{1,49}(\$\w+)[^\{]{1,99}foreach[\h\(]+\42[^!]{1,99}\41[^&]{1,99}if[\h\(]+\40\(\)\s*&&\s*\$_SERVER[^\(]{1,99}(\$\w+)[\s=]+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*echo\s+\43;\s*exit;\s*\}\s*\?>(?<X120358450>)|\s+(isGoogleBot)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];[\s=]+\$\w+[^\]]{1,999}\];[\s=]+foreach[^!]{1,99}\46[^;]+return\s+(?:true|false)?;[^\{]{1,99}\45\(\)\)[\s=]\{[^:]{1,99}['"]Location:[\s=]+https://[^'"]+['"]\);[\s=]+exit;\s*\}\s*\?>(?<X120348361>)|\s+\w+\((\$\w+)\)(?:[^\$]{1,99}\$_SERVER[^!]{1,49}\48[^\$]{1,49}(\$\w+)[^\^]{99,}(\$\w+)[\s=]+\[\s*['"]\bAndroid['"][^;]{1,249}\];\s*foreach\s+\(\50\s+\w+\s+\48\)\s*\{\s*if\s*\(check_user_agent\(\48\)\)\s*\{\s*echo\s+\49;\s*exit;\s*\}\s*\}\s*\?>(?<X120352980>)|\s*\{\s*\$\w+[\s=]+(curl_)\w+\(\);[^=]{1,299}\$\w+[\s=]+\52\w+[^\?]{1,349}(\$\w+)[\s=]+['"]\?>['"];\s*\48\d+[\s=]+base64_decode\(['"]aHR0[^'"]+['"]\);\s*(\$\w+)\d+[\s=]+get[^'"]{1,199}eval\(\53\s*\.\s*\54\d+\);[^\?]{1,99}\}\s*\?>(?<X120367310>))|\s+\w+\(\)(?::[^\$]{1,29}(\$\w+)[^\$]{1,29}\$_SERVER\[['"]\w+['"]\][^=]{1,29}\56[^\[]{1,49}(\$\w+)[^\]]{1,399}\];\s*foreach\s*\(\57\s*\w+\s*(\$\w+)\)[^!]{1,29}\56,\s*\58\)[^@]{1,299}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://[^;]{1,49}\.txt['"][^;]+;\s*echo\s*\59;\s*exit;\s*\}\s*\?>(?<X120350201>)|\s*\{[^'"]{1,99}\$_SERVER\[['"]HTTP_CLIENT_IP['"][^/]{1,299}(\$\w+)\s*=\s*\w+\(\);[^/]{1,29}['"]https?://ip\-api[^'"]{1,29}\61\}['"];[^;]{1,49}file_get_contents[^\?]{1,299}exit\(\);[^!]{1,899}foreach[^:]{1,399}['"]Location:[^;]{1,29}\.php['"]\);\s*exit;\s*\}\s*\?>(?<X120344741>)|\s*\{\s*(\$\w+)[^\?]{1,99}\$_SERVER\[[^\{]{1,99}foreach[\h\(]+\63[^\?]{1,199}gethostbyaddr\((\w+)[^\[]{1,199}\64[^@]{1,499}@?file_get_contents[^\{]{1,49}function_exists\(['"]curl_[^<]{1,1999}(\$\w+)[\s=]+['"]https?://[^'"]+['"][^\{]{1,99}\65[^\}]{1,399}https?://[^\\]{1,599}exit;\s*\}\s*return;\s*\?>(?<X120369180>))|\s+\w{1,14}[^\[]{1,49}\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\}]{1,59}(\$\w+)\s*=\s*\[[^\]]{1,299}\];\s*foreach\s*\(\67[^&]{1,299}['"]https?:/anakbondan\.com[^;]{1,49}['"];\s*(\$\w+)\s*=\s*(curl)\w+\(\);\s*\69\w+\(\68[^\?]{1,299}\69\w+\(\68\);\s*echo\h*\$\w+;\s*exit;\s*\}\s*\?>(?<X120345210>)|\s+is_googlebot_id\(\)\s*\{\s*\$\w+\s*=\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\}]{1,99}(\$\w+)\s*=\s*\[[^;]{1,249}\];[^\{]{1,49}foreach\s*\(\71[^@]{1,599}['"]https?://ipinfo\.io[^'"]{1,49}['"];[^@]{1,279}@?file_get_contents[^:]{1,149}https?://korengtekupas\.com[^'"]{1,49}['"];[^@]{1,349}exit;\s*\}\s*\?>(?<X120345800>))|global\s*(\$\w+);\s*\73[\s=]+array\(\);\s*/\*+\d+\*+/\s*add_action\(['"]\w+[^\}]{1,999}global\s*\73;\s*\w+[^\{]{1,999}administrator['"],\s*\$\w+\->roles\)\)\s*\{(?<X220358341>)|header\((?:['"](?:\bVary:[^=]{1,99}(\$\w+)[\s=]+strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*(\$\w+)[\s=]+['"]https?://[^'"]+['"];[\s=]+(\$\w+)[^\]]{1,499}\];\s*foreach\s*\(\77[^:]{1,99}\75[^:]{1,99}['"]Location:\s+\76['"][^\}]+exit;\s*\}\s*\}\s*\?>(?<X120348341>)|Location:(?:\h*https?://(?:corumtemizlik\.com['"]\);\s*exit;\s*\?>(?<X120356350>)|maharaja\.ramco\.tg[^;]{1,19}true,\h*\d+\);\s*exit\(\);\s*\?>(?<X120345201>))|\s+https://www\.academichelpstore\.com/['"]\);\s*exit\(\);\s*\?>(?<X120366730>))|Vary:(?:[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+\.html['"][^\?]{1,149}\$_SERVER[^\{]{1,49}(function)\s+(\w+)[^'"]{1,99}\83_exists[^;]{1,49}curl\w+[^@]{1,399}file_get_contents[^\?]{1,199}echo\s+\84\(\82\);\s*exit;\s*\}\s*\?>(?<X120362620>)|[^\?]{1,149}\$_SERVER[^:]{1,49}https?://[^\}]{1,199}(function)[^\.]{1,699}getenv\(\s*['"]HTTP_\w+['"][^\.]{1,499}return\s+['"]\d+\.\d+\.\d+\.\d+['"];\}\86[^@]{1,99}@?file_get_contents[^\|]{1,899}(\$\w+)=make_request\(['"]https?://pub\-[^'"]+\.txt['"][^@]{1,699}echo\87;exit;\}\?>(?<X120365872>))|Vary[^\$]{1,99}(\$\w+)\s*=\s*strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*(\$\w+)\s*=\s*['"]https?://fsda\.gov\.gh/['"];\s*(\$\w+)\s*=\s*\[[^;]{1,329};\s*foreach\s*\(\91[^:]{1,99}\89[^:]{1,49}Location:\h*\90['"],\s*(?:true|false),\h*\d+\);\s*exit;\s*\}\s*\}\s*\?>(?<X120345790>))|[^=]{1,99}(\$\w+)\s*=\s*['"]https?://shyfilms\.co\.uk[^;]{1,39};\s*(\$\w+)\s*=\s*strtolower\(\$_[GPRSC]\w{2,6}[^=]{1,49}(\$\w+)\s*=\s*\[[^;]{1,199}\];\s*foreach\s*\(\95[^!]{1,99}\94[^;]{1,99}\93[^;]{1,49};\s*exit;\s*\}\s*\}\s*\?>(?<X120344410>)|[^@]{1,99}@?set_time_limit\(0\);[^\-]{1,399}do\s*\{\s*\$\w+[\s=]+false;\s*(\$\w+)[^;]+wp[\w-]+\.php['"];\s*if\(file_exists\(\97\)\)\s*\{\s*require\(\97[^\\]{1,399}(\$\w+)[\s=]+array\(['"]user_login['"]\s*=>\s+\$_GET[^;]{1,99}role['"]\s*=>\s*['"]administrator['"]\);\s*\$\w+[\s=]+wp_insert_user[\h\(]+\98\s*\);(?<X220366891>))|if[\h=]+\((\$_GET)\[['"][^\{]{1,99}\100[^\$]{1,49}(\$\w+)=popen\(\100[^\;]{1,29};\s*echo[^/]{1,99}stream_get_contents\(\101[^\$]{1,99}\101\);\s*die;\s*\}\s*\?>(?<X120351781>)|if[\h\(]+!empty\(\$_SERVER[^\$]{1,29}(\$\w+)[\s=]+\$_SERVER\[[^\[]{1,99}(\$\w+)[^\|]{1,899}if[\h\(]+preg_match[^\|]{1,49}implode\(['"]\|['"],\s+\104\)[^\{]{1,49}\103\)\)\s*\{\s*(\$\w+)[\s=]+(?:true|false);\s*\}\s*if[\h\(]+\105\)\s*\{\s*include\s+__DIR__[\h\.]+['"]/\w+\.php['"];\s*exit\(\);\s*\}\s*\?>(?<X120367710>)|if[\h\(]+(\$_SERVER\[['"]REQUEST_URI['"]\])[^\[]{1,49}\107[^\)]{1,49}\.php['"]\)\s*\{\s*header\(['"]Location:\s*https?://besthealthtrendss\.com[^'"]+['"]\);\s*exit\(\);\s*\}\s*\?>(?<X120357511>))
<\?(?:php)?\s+(?:error_reporting(?:[^\$]{1,99}(\$\w+)[^;]{1,49};\s+(\$\w+)[^\$]{1,99}(\$_SERVER)\[['"]\\122E\\121\\125[^'"]+['"][^\}]{1,299}\}\s*(echo)[^\}]{1,99}\1[^;]{1,29}\2;\s+(\w+)[^@]{1,599}foreach[^\-]{1,199}\3[^#]{1,399}curl_init[^%]{1,1299}\4\s+['"]\\162\\157bo\\164[^'"]+['"];\s+\5;\s+\}\s+\}\s+\?>(?<X120350012>)|[^\{]{1,99}function\s+(\w+)[^\}]{1,199}\}\s+(\$\w+)\s+=\s+['"]proc_open['"];\s+if\s+\(function_exists\(\8\)\)\s+\{\s+\$\w+\s+=\s+@?\8[^\-]+file_exists\(['"](/tmp/\$\w+)['"]\)[^\-]{1,199}\7\(['"]curl\s+\-{2}\w+\s+\9\s+https://[^'"]{1,199}\.txt['",\s]+/tmp['";\)\s]+\}\s+include\(['"]\9['"]\);\s+\?>(?<X120340660>)|\(0\);(?:(\$\w+)=['"]\w{2}\d+['"][^\{]{1,999}/\w{2}\d+/\w{2}['"],\$\w+[^\\]{1,999}\11;\$\w+=\w+\(['"]\w+[^\\]{1,999}curl_exec\((\$\w+)[^\\]{1,99}\12\);\w+\(\w+\(\$\w+\)[^\\]{1,999}ping['"]\)\{[^\\]+Allow:/['"]\.(PHP_EOL);\$ping_[^\}]+\13;\}(\$\w+)=fopen\(\$_SERVER\[[^;]+;fwrite\(\14[^\}]+echo\s*['"]robots\.txt[^;]+;exit;\}\}\?>(?<X120339491>)|[^\}]{1,999}\}\w+\s*['"][^'"]+(404)[^;]+;(?:exit|die);\}[^\}]+\}\w+\{\$\w+=\w+\(\$_SERVER\[[^;]+;\}(\$\w+)=\w+[^\}]+\.\17;\}(\$\w+)=\$\w+\.\$\w+;\$\w+=\w+\(\);\w+\((\$\w+),\w+,\18\);\w+\(\19,\w+[^\}]{1,999}\19\);\w+[^\}]{1,999}\18\);\}\$\w+=\w+\(\$\w+\);\$\w+=\w+\([^{]+\{header\(['"][^'"]+\16[^;]+;(?:exit|die);\?>(?<X120333590>)|\s*(?:ini_set\(['"]display_errors['"],\s*0\);\s*\$config[\s=]+\[\s*['"]bot_url['"][\s=>]+['"]https?://[^'"]+\.txt['"],(?<X220354441>)|set_time_limit\(0\);\s*(\$bot_content_file)[^\?]{99,999}\22\);[^\?]{99,999}exit\(\);\s*\}\s*\?>(?<X120358540>)|set_time_limit\(0\);\s*header\(['"]x\-xss\-protection:\s*0['"]\);(?<X220358231>))|\s+ini_set\(['"]\w+['"],\s+0\);\s+(\$\w+)\s+=\s+['"][^'"]{999,}['"];\s+(\$\w+)\s+=\s+tempnam\(sys_get_temp_dir\(\),\s+['"]\w+['"]\);\s+file_put_contents\(\26,\s+base64_decode\(\25\)\);\s+include\s+\26;\s+unlink\(\26\);\s+\?>(?<X120338790>)|function\s+(\w+)\(\)\s*\{[^\$]{1,99}\$_SERVER\[['"]HTTP_CLIENT_IP['"]\][^\$]{1,99}(\$\w+)[^\?]{1,219}return\29;\}\29=\28\(\);(\$\w+)=['"]https?://[^\{]{1,99}\{\29\}['"];\$\w+=file_get_contents\(\30\)[^\?]{1,139}include[^;]{1,99}\.txt['"];[^\}]{1,99}exit\(\);\}\?>(?<X120348352>)|ini_set[^!]{1,49}!?(function)\w+\(['"](\w+)['"]\)\)\s*\{\s*\32\33[^\.]{1,149}(\$\w+)=\[\s+['"]Mozilla/[^\[]{1,399}\34\[[^\{]{1,49}\32_exists\(['"]curl_\w+['"][^>]{1,299}https?://[^>]{1,399}file_get_contents[^\?]{1,299}\33\(['"]\w+['"][^@]{1,99}@?eval\(['"]\?>[^\?]{1,49}\}\?>(?<X120369444>))|\(round\(0\+0\+[^\[]{1,149}\$_SERVER[^\{]{1,129}\{\s*\w+\(preg_match[^\}]{1,199}\}\s*echo[^\}]{1,99}exit;[^@]{1,999}(\$\w+)=base64_encode\([^'"]{1,49}\36=str_replace[^\{]{1,199}(\w+)\((\$\w+)[^;]{1,99};\s*\37\(\38[^\?]{1,999}foreach[^\?]{1,299}\\\d+\\\d+\\\d+['"];\s*exit;\s*\}\s*\}\s*\?>(?<X120349052>)|\s*\(0\);\s*\w+\(0\);\s*\$bot\w+\s*=\s*\w+\s*\.\s*['"]/\w+\.php['"]\;\s*\w+\s*(\w+)\(\)\s*\{\s*\$\w+\s*=\s*\[\s*['"]google['"][^\]]{1,199}\]\;\s*(\$\w+)[^!]{1,299}\41\,\s*\$\w+\)[^\(]{1,99}\(\40\(\)\)\s*\{\s*[^;]{1,99}\;\s*[^"]{1,150}\s*header\(['"]HTTP/1\.0\s*(404\s+Not\s+Found)['"]\);\s*exit\(['"]\42\.?['"]\);\s*\}\s*\}\s*\?>(?<X120338723>))|eval\((?:['"]\?>['"]\s*\.\s*\({2}(\$\w+)\s*=\s*@?file_get_contents\(\(\$\w+=\w+\(['"]aHR0c[^'"]+['"]\){2}\s*\.['"]([\w\-]+\.txt)['"]\){2}\s*\?\44:[^&]+\45['"]\){2}[^;]+\((\$\w+)\s*=\s*curl_exec\([^;]+\46:['"]+\){3};\s*\?>(?<X120341930>)|\s*(/\*\*_\*\*/)\s+(urldecode)\([^\(]{1,49}file_get_contents\(\s*\48\s+\49\(\s*\48\s*['"]https?://[^'"]+['"]\s*\)\s*\)\s*\);\s*\?>(?<X120360200>)|base64_decode\(file_get_contents\(['"]https?://amaterasunphysical\.com[^'"]+\.txt['"]\)\)\);\s*\?>(?<X120370260>))|file_exists\((\$_SERVER\[['"]\w+['"])\]\.['"]/\w+\.\w+['"&\)]+(?:include|require)\(['"]g?zip://['"]\.\52\]\.['"][/\.\w+#]+['"]\);\$\w+=\52\]\.['";/]+\$\w+=\$\w+\.['"]robots\.txt[^<]+&&(?:include|require)\(['"]g?zip://['"\.\\]+\52[^%]{1,299}file_put_contents\(\$\w+,\$\w+\);chmod\(\$\w+,\d+[\);\}]+\?>(?<X120361540>)|function(?:\s*(\w+)\((\$\w+)[^=]{0,99}(\$\w+)[^/]{0,199}\55\/\56[^\?]{0,99}\?\s*\54[^=]{0,99}\54\(['"]ALFA_DATA[^>]{0,99}curl[^]]{0,199}VERIFYPEER\s*=>\s*false[^|]{0,99}exec[^>]{0,199}eval\(['"]\?>['"]\s*\.\s*\$\w+\);\s*\?>(?<X120352623>)|\s+(\w+)\(\)\s+\{\s+\$\w+\s+=\s+array[^=]+(\$\w+)\s+=\s+\$_SERVER\[['"]HTTP_USER_AGENT[^\{]+\{\s+if\s+\(strpos\(\59,\s+\$\w+[^\:]+if\s+\(\58\(\)\)\s+\{\s+\$\w+\s+=\s+curl_init\(['"]https://[^'"]{1,499}\w+\.txt['"]\);[^\}]+(\$\w+)\s+=\s+curl_exec\(\$[^\}]+echo\s+\60;\s+exit;\s+\}\s+\?>(?<X120338020>)|\s+(is_bot)\(\)\s*\{\s*\$\w+[^)]{1,199}\)[^@]{1,199}\62\(\)\)\s*\{[^\}]{1,999}(?:\.txt|/raw)['"]\)[^\}]{1,199}exit;[^\}]{1,32}\s*\}\s*\?>(?<X120338667>)|\s+\w+\(\)(?:[^\[]{1,99}\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\)[^\{]{1,99}(\$\w+)[^\]]{1,499}\];\s*foreach\s*\(\64\s+\w+\s+(\$\w+)\)[^!]{1,99}\65[^@]{1,899}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://[^'"]+\.txt['"]\);[^;]+echo\s+\66;[\s=]+exit;[^\{]{1,99}\.\w{3}['"][^\}]{1,99}exit;\s*\}\s*\}\s*\?>(?<X120348301>)|\s+\{\s+if\s+\(!\w+\(\$_SERVER\[['"]\w+['"]\]\)\)[^:]{1,999}(\$\w+)\s+=\s+['"]https?://ip\-api\.com/\w+/\{\$\w+\}['"];\s+\$\w+\s+=\s+(file_get_contents)\(\68\);[^:]+ob_start\(\);\s+\w+\s+\69\(['"]https?://[^'"]{1,499}['"]\);[^;]{1,299};\s+echo\s+\$\w+;\s+die;\s+\}(?<X120339880>)))|goto\s*\w+;(?:[^\}]{1,199}if\s+\(rmdir\(\$_GET\[['"]\\151\\x74\\x65\\155['"]\]\)\)(?<X220356241>)|\s*\w+:[^\>]{999,9999}stristr\(\$\w+,\s*['"]\\x47\\x6f\\157\\147\\154\\x65\\x62\\x6f\\164['"]\)\)\s*\{\s*return\s*\d+;\s*\}[^\}]{1,32}\d+;\s*\}\s*\}(?<X120341160>))|header(?:\(['"](?:(vary):[^\}]{1,99}\73:\s*user\-agent['"]\);\s*\w+\s*(\w+)\(\)\s*\{[^\\]{1,1399}return\s*['"]127\.0\.[^\\]{1,999}\74\(\);\s*\$bot_url[^;]{1,99}\.txt['"];\s*(\$\w+)[\s=]+['"][^;]{1,99}\.php['"];[^\\]{1,999}\75\);\s*exit\(\);\s*\}\s*\?>(?<X120344950>)|Vary:\s+User\-Agent[^@]{99,1999}\w+\s+@?file_get_contents\(\$\w+\);\s+\}\s+\w+\s+\(function_\w+\(['"]curl[^@]{99,1499}preg_match\(['"]/\(googlebot[^%]{1,699}header(\(['"]Location:\s+https?:)//[^;]{1,199};\s+(?:exit|die)\(\);[^%]{99,9999}header\77//[^;]{1,199};\s+(?:exit|die)\(\);\s+\}\s+\}\s+\}\s+\?>(?<X120363250>))|\s*\(\s*['"]Location\s*:\s*https?://apolloquiboloy\.com[^'"]+[\'"][^;]{0,99};\s*(?:exit|die)\b[^;]{0,19};\s*\?>(?<X120357170>))|if\(!defined\(['"](\w+)['"]\)\)define\(['"]\80['"],['"]DATA['"]\);\$globals\[\80\]=explode\([^,]{1,49},['"][^'"]{999,}['"]\);\w+\s+(\w+)\(\)\{goto\s*\w+;\w+:\$\w+=[^\*]+goto\s*\w+;\w+:return\s*pack\(['"]H\*['"],\$\w+\);\}eval\(\81\(\)\);\?>(?<X120335890>)|if\(\$_SERVER\[['"]\w+[^\?]{1,149}(function)\s+(\w+)[^@]{1,399}\83\s+\w+\((\$\w+)[^@]{1,49}@?file_get_contents\(\85[^\(]{1,29}\(\83_exists\(['"](curl)\w+[^=]{1,99}=\86\w+[^:]{1,399}\84[^:]{1,99}https?://[^'"]+\.txt['"];[^:]{1,49}https?://[^'"]+['"];(\$\w+)[^!]{1,399}echo\s+\87;exit[^\?]{1,149}exit\(\);\}\}\s*(?:\?>)?(?<X120352200>)|if\(isset\((?:(\$_[GPRSC]\w{2,6})\[['"](\w+)['"][^\(]{1,99}class\s+(\w+)\{\w+\s+\w+\s+function\s+(\w+)\(\$\w+\)\{eval\(\$\w+\);\}\}\s+\91::\92\(\89\[['"]\90['"]\]\);\s+\}\s+\?>(?<X120349740>)|(\$_GET\[['"]pass['"]\])\)\s*&&\s*\(\94\s*==\s*['"]nezz['"][^@]{1,299}\{(\$\w+)[^@]{1,99}move_uploaded_file\(\$_FILES\[['"]file['"]\]\s*\[['"]tmp_name['"]\],md5\(strtotime\(['"]now['"]\)\)\.['"]\.\95['"]\);(?<X220356890>))|include\s*\(['"]blocker\.php['"]\)\s*\;\s*\$DIR\s*\=\s*md5\s*\(\s*rand\s*\(\s*\d+\s*\,\s*\d+\)\s*\)\s*\;(?<X2051650>)|ob_start\s*\(\);\s*(\$\w+)[=\s]+['"]https?://graybyte\.host[^;]+\.txt['"];\s*(\$\w+)[^;]+\.txt['"];[^#]{1,9999}unset\s*\(\$\w+,\99,\s*\98\);\s*\?>(?<X120345040>)|require\s+['"]wp\-load\.php['"];\s*\w+\s*\(\$_SERVER\[['"]REQUEST_METHOD['"]\]\s*={3}\s*['"]POST['"][^{]{1,99}\{\s*(\$\w+)[^\}]{1,99}(\$\w+)\s*=\s*\w+[^\}]+wp_set_password\(\102[^\}]+\101\}[^\}]{1,99}\}[^;]{1,99}get_users\((?<X220338160>)|session_start\(\);(\$\w+)=\$_SESSION[^;]{1,499};\$\w+=['"]https://[^'"]{1,499}\w+\.log['"];\w+\s+(\w+)\((\$\w+)\)\{if\(preg_match[^\{]+\{\$\w+=file_get_contents\(\106\);if\(\$\w+\)return\$\w+;[^\{]+\{\$\w+=curl_init\(\106\);[^\}]+\}\}\w+['";\}]+(\$\w+)=\105\(\104[^\,]{1,399},\107\)\)eval\(['"]\?>\107['"]\);\?>(?<X120339700>))
<\?(?:php)?\s*(?:if[\h\(]+isset\((?:(\$_GET\[['"]\w+['"]\])[^\{]{1,49}\1\s*===\s*['"]upload['"]\)\s*\{\s*echo\s+['"]<form\s+method[^\}]{1,299}(echo)\s+['"]</form>['"];\s*\}\s*if[\h\(]+isset\((\$_FILES\[['"]\w+['"]\]\[['"]\w+['"]\])[^;]{1,49}(\$\w+)[\s=]+\3[^\{]{1,49}file_exists\(\4[^\?]{1,199}copy\(\4,\s+(\$\w+)[^'"]{1,49}\2[^;]{1,49}\5['"];\s*\}\s*\}\s*\?>(?<X120359250>)|(\$_SERVER\[['"]HTTP_USER_AGENT['"])[^\{]{1,49}\7[^\$]{1,49}if[\h\(]+(\$_SERVER\[['"]REQUEST_URI['"]\])[^\{]{1,49}\8[^\{]{1,49}\.php['"]\)\s*\{\s*(?:include|require)\s*['"][^\.]+\.txt['"];\s*exit\(\);\s*\}\s*\}\s*\?>(?<X120359870>)|\$_GET\[(?:['"]\w+['"]\]\)\)[^\$]{1,99}(\$_SERVER)\[['"]DOCUMENT_ROOT['"]\][^:]{1,49}echo\s*['"]Script\s+Filename[^\[]{1,49}\10\[[^@]{1,129}realpath\(__FILE__\)[^@]{1,99}scandir\(__DIR__\)\);\s*echo\s*['"]</pre>['"];\s*exit;\s*\}\s*\?>(?<X120362850>)|[^;]{1,129}<input\s+type=[^\$]{1,199}if[\h\(]+!empty\((\$_FILES\[['"]\w['"]\]\[['"]\w+['"]\])[^;]{1,49}(\$\w+)[\s=]+basename[^\{]{1,99}move_uploaded_file\(\12,\s*\13[^;]{1,99}echo[^;]{1,49}\13\}</a>['"];\s*\}\s*\}\s*\}\s*\?>(?<X120360180>)))|if[\h\(]+md5\(@?\$_GET\[[^\{]{1,99}['"][^'"]{1,32}['"]\)\s*\{\s*(echo)\s+php_uname\(\)[^;]{1,49}getcwd[^\{]{1,49}if[\h\(]+file_exists\(['"](\.htaccess)['"]\)\)\s*\{\s*\15[^;]{1,99}htmlspecialchars\(file_get_contents\(['"]\16['"][^@]{1,99}@?(\$\w+)[\s=]+(\$_FILES\[['"]file['"])[^@]{1,99}@?(\$\w+)[\s=]+\18[^!]{1,199}move_uplo[^\(]{1,99}\(\17,\s*\19\);\s*\}(?<X220357630>)|if\(!?defined\(['"]\w+['"]\)\)call_user_func[^@]{1,99}\$_SERVER\);@?set_time_limit\(0\);error_reporting\(0\);[^!]{1,99}(\$\w+)=base64_decode\(\21[^#]{1,2499}json_decode\(\$\w+,\w+\);\$\w+=urlencode[^#]{1,2999}\$\w+=curl_\w+\(\);[^@]{1,999}@?file_get_contents[^#]{1,1999}\$GLOBALS\[[^/]{1,699}(\$\w+)=\[\];foreach[^\*]{1,1999}https\?://[^\?]{1,99}array_unique\(\22\)\);\}\s*\?>(?<X120367250>)|if\((isset)\(\$_GET\[['"]admin0pt1m4l['"]\]\)\)\s*\{\s*\$\w+\s*=[\h=]+\$_FILES\[['"]\w+['"]\][^\.]{1,199}echo[^\}]{1,149}(\$\w+)\)[^\{]{1,29}\{\s*echo[^;]{1,49}\25;\s*\}\s*\w+\(\24[^\;]{1,49}function_exists\(['"](\w+)['"]\)\)\{\s*(\$\w+)[^<]{1,49}\26\(['"]\27['"]\);\s*echo[^\?]{1,49}\}\s*\?>(?<X120347260>)|if\((strpos\(strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)),\s*['"]\w+['"]\)\s*>\s*\d+[^\(]{1,49}\29,\s*['"]\w+['"]\)\s*>\s*\d+\)\s*\{\s*echo\s+implode\('',\s*file\(['"]https?://short\.ix24\.site[^'"]+['"]\)\);\s*exit;\s*\}\s*\?>(?<X120352900>)|if\(isset(?:[\h\(]+\$_GET\[['"][^'"]+['"]\]\)\)\{(echo)[^\.]+\.php_(uname)\(\)\.['"]\[/\32\]['"];\31[^@]{1,199}@?array\(\$_FILES\[['"]\w+['"]\][^\}][^\}]{1,99}\}else\{\31['"]<b>\bgagal['"];\}\}\}\?>(?<X120348721>)|\(\$_GET\[['"]:\d+['"]\]\)&&\(int\)\$_COOKIE\[['"]alfa_fakepage_counter\d+['"]\]<\d+\)\s*\{@?include\(['"][^;]{1,99};\s*exit\s*;\s*\}\s*\?>(?<X120345281>))|if\(preg_match\(['"]\/Google\s*Web[^'"]{1,99}['"],\s*\$_Server\[['"]HTTP_USER_AGENT['"]\]\)\)\s*\{\s*echo['"]\s*(?:<a\s*href=['"]http://[^>]{9,99}>[\sa-z]{0,30}<\/a>\s*){3,}['"];\s*\}\s*(?:\Z|\?>)(?<X2125332>)|if\h*\(\h*(?:isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*echo\s*['"]\h*<form[^;]{9,199};\s*if\h*\(\h*isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*@?(?:copy|move_uploaded_file)\h*\([^;]{1,99};\s*(?:echo[^;]{1,99};\s*)?\}\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1140971>)|preg_match\h*\(\h*['"][^'"]{0,99}\bgoogle(?:bot)?\b[^;\{:]{1,999}[\{:]\s*(\$\w{1,40})\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^;]{1,199};\s*@?eval\s*\(\s*@?\w{1,40}\s*\(\s*\37(?:\s*\)){2};\s*(?:endif;|\})\s*(?:\?>|\Z)(?<X1188650>))|if\s*\((?:\(!(\$_POST\[[^\]]+\])\)\s*\D{1,5}\(\39[^\)]+\)\)\s*\{\s*\39\s*=\s*['"]uname\s+-ar\s*;\s*pwd\s*;\s*id\s*;[^\}]{0,15}\}[^\$]{9,99}echo\s+[^\.]{1,20}\.(?:eval|system|passthru|assert|exec|shell_exec)\(\39\)(?<X2121450>)|\s*[^\w]?\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)[^\}]{40,200}\s*\}\s*else(?:if)?\s*\{\s*(\$\w{1,40})\s*\=\s*[\\'"\s\.aceglpr_]{12,80}\s*;\s*@?\41\s*\(\s*.?['"](.).{0,40}\42e\w?.?['"]\s*,\s*[^\}]{1,40}\s*\}\s*(?:\?>|\Z)(?<X1056190>)|\s*is_bot\s*\(\s*\)\s*\)\s*\{\s*(\$\w+)\s*=\s*file_get_contents\s*\(\s*['"]https?://besiamp\.xyz[/\w\-\.]+\.[\w+]{2,4}['"]\s*\)\s*;\s*echo\s*\44\s*;\s*(?:exit|die);[^\}]{1,99}\}\s*\?>(?<X120354541>)|\s*isset\s*\(\s*(?:(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w{1,40}['"]\s*\])\s*\)\s*\)\s*@?(?:system|exec|passthru|shell_exec|popen)\s*\(\s*\46\s*\)\s*;\s*\?>(?<X1041932>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?(\w{1,40})['"]?\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?create_function\s*\(\s*['"]['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\48['"]?\]\s*\);\s*\49\(\s*\);\s*\}\s*(?:\?>|\Z)(?<X1056161>))|\w+\(\)\)\s*\{\s*echo\s+file_get_contents\(['"]https?://[^\.]{1,99}\.pages\.dev/[^'"]+\.txt['']\);\s*exit;\s*\}\s*\?>(?<X120352911>)|is_bot\(\)\)\s*\{\s*(\$\w+)[\h=]+file_get_contents\(['"]https?://raw\.githubusercontent\.com[^'"]+\.txt['"]\);[^\$]{1,29}echo\s+\52;\s*(?:exit|require);\s*\}\s*\?>(?<X120351070>)|isset\(\$_SERVER\[['"]HTTP_REFERER['"]\]\)\)\s*\{\s*(\$\w+)\s*=\s*\$_SERVER\[['"]HTTP_REFERER['"]\];[^\$]{1,49}\54[^:]{1,99}['"]Location:\s*https?://sahabet1483\.com/['"]\);\s*exit\(\);\s*\}\s*\}\s*\?>(?<X120345810>))|if\s+\(is_bot\(\)\)\s*\{\s*(\$\w+)\s*=\s*file_get_contents\(['"][\w\-]+\.txt['"]\);\s*echo\s+\56;\s*exit;[^\?]{1,49}\s*\?>(?<X120346431>)|include\(\$_SERVER[^\}]{100,600}->Authorize\([^\)]{1,40}\);\s*header\(['"]location:[^'"]{1,40}['"]\);\s*die\(\);\s*\}\s*else\s*\{[^\}]{1,600}\s*\}\s*(?:\?>|\Z)(?<X1053751>)|ini_set\(['"]display_errors['"][^=]{1,99}error_reporting[^\$]{1,99}(\$\w+)[\s=]+\$_SERVER\[[''"][^\-]{1,99}(\$\w+)[^\$]{1,399}(\$\w+)[^\?]{1,169}(\$\w+)[\s=]+preg_match[^\|]{1,49}implode[^\.]{1,49}\60[^;]{1,49}\59[^\{]{1,99}(\$\w+)[\s=]+strpos[^\?]{1,99}\61[^\{]{1,49}\62[^\?]{1,99}\63\)\s*\{\s*include\s+['"][^'"]+\.php['"];\s*exit;\s*\}\s*\?>(?<X120364350>))
<\?(?:php)?\s*(?:ob_start\((?:\);(?:[^;]{1,99}header\(['"]\w+:\s*user-agent['"]\);\s*\$\w+[\s='"]+https?://goodshot1\.com/[^\}]{1,399}function\s*(\w+)\((\$\w+)\)\s*\{[^\}]{1,999}\}\s*\w+\s*\(\w+\(['"]allow_url_fopen['"]\)[^\}]{1,999}@?\w+\(\2\);[^<]+\1\(\$\w+\);\s*ob_end_flush\(\);\s*exit;\s*\}\s*\w+\s*\{\s*\}\s*\?>(?<X120342752>)|\s*header(?:[^\{]{1,99}(function)\s+\w+[^\[]{1,49}(\$\w+)[^\{]{1,199}foreach[\h\(]+\5[^\.]{1,199}\w+\s*['"]\d+\.\d+\.\d+\.\d+['"][^@]{1,149}@?file_get_contents[^\?]{1,99}\4_exists[^#]{1,999}['"]https?://[^'"]+['"][^#]{1,799}\$_SERVER[^:]{1,99}https?://[^'"]+\.txt['"][^@]{1,789}(\$\w+)[^\?]{1,239}echo\s+\6[^\?]{1,99}ob_end_flush\(\);\?>(?<X120357241>)|\(['"]Vary:(?:[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+['"];\s*(\$\w+)[^\{]{1,99}strtolower\(\$_SERVER[^\{]{1,49}(function)\s+(\w+)[^\?]{1,49}\10_exists\(['"]curl_init['"]\)\)\s*\{[^@]{1,299}file_get_contents\([^\{]{1,99}\9[^;]{1,49}\11\(\8[^\}]{1,49}ob_end_flush\(\);\s*exit;\s*\}\s*\?>(?<X120360931>)|[^:]{1,99}['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[^\[]{1,199}(\$\w+)[\s=]+isset\(\$_SERVER[^@]{1,129}(function)\s+(\w+)[^\?]{1,49}\(\15_exists[^@]{1,799}@?file_get_contents[^!]{1,199}preg_match\(\13,\s*\14[^!]{1,99}(\$\w+)[\s=]+\16[^\?]{1,99}echo\s+\17[^\?]{1,49}exit;[^\?]{1,49}\}\s*\?>(?<X120357270>)|[^\$]{1,49}(\$\w+)[\s=]+['"]https?://['"];[^\[]{1,99}(\$\w+)[\s=]+['"][^'"]+\.html['"];[^;]{1,99}\19[^;]{1,99}\20;[^;]{1,49}\$_SERVER[^\.]{1,199}implode[^\{]{1,49}(function)[^=]{1,49}\21_exists\(['"]curl\w+[^@]{1,399}@?file_get_contents[^\?]{1,199}ob_end_flush\(\);\s*exit;\s*\}\s*\?>(?<X120358040>)|[^\$]{1,59}(\$\w+)[\s=]+['"]https?://[^'"]+['"];\s*(\$\w+)[^\[]{1,99}strtolower\(\$_SERVER[^\{]{1,49}(function)\s+(\w+)[^!]{1,49}\25_exists\(['"]curl\w+['"][^@]{1,399}file_get_contents\([^\?]{1,79}\24[^\(]{1,49}echo\s+\26\(\23\);\s*ob_end_flush\(\);\s*exit;\s*\}\s*\?>(?<X120359410>))))|(?:\)[^\{]{1,99}amacoy\.txt['"];\s*(\$\w+)[^\$]{1,99}(\$\w+)[^;]{1,29}\$_SERVER\[[^\?]{1,99}(\$\w+)\s*=\s*(curl)\w+\(\);\s*\31\w+\(\30[^\]]{1,239}file_get_contents[^@]{1,139}@?json_decode\(file_get_contents\(['"]https?://[^\)]{1,49}['"][^\.]{1,199}\28,\s*\29\)\)[^\?]{1,229}exit;\s*[^<]{1,79}\?>(?<X120346900>)|function\((\$\w+)[^\$]{1,49}\$_COOKIE[^@]{1,99}base64_decode\(['"]aHR0[^'"]+['"]\);\s*\$\w+[\s=]+@?file_get_contents[^\}]{1,299}\}\s*\}\s*return\s+\33;\s*\}\);\s*\?>(?<X120366720>)))|require(?:_once)?\s*['"]zip://([\w\-]{1,32})\.php#\35['"];\s*(?:\Z|\?>)(?<X120326531>)|session_start(?:[^:]{1,99}(\$\w+)[\s=]+['"]https?://[^\.]+\.pages\.dev/[^'"]+\.txt['"][^&]{1,99}if[\h\(]+\$_SERVER[^#]{1,599}function_exists\(['"]curl_init[^@]{1,399}@?file_get_contents\(\37[^\?]{1,49}eval\(['"]\?>['"][^\|]{1,399}<title>Terminal\s*\|\s*Mr\.Q\s+Authorization</title>(?<X220359830>)|[^\{]{1,99}if[\h\(]+isset\(\$_POST\[['"]login['"]\]\)\)\s*\{\s*if[\h\(]\((\$_POST)\[['"]user['"]\]\s*===\s*['"]123['"][^'"]{1,49}\39\[['"]pass['"]\]\s*===\s*['"]123['"]\)[^;]{1,49}\$_SESSION\[['"]admin['"]\]\s*=\s*true;(?<X220361031>)|\(\);\s*(?:(function)\s+(\w+)[^&]{1,99}\$_SESSION\[['"][^\?]{1,59}\$\w+[\s=]+['"]\w+['"];\s*(\$\w+)[\s=]+['"][^'"]{1,60}['"];[^\?]{1,199}\$_POST[^\+]{1,399}\43[^\?]{1,199}\41\s+(\w+)[^\?]{1,399}\44[^\?]{1,199}curl\w+\([^@]{1,799}['"]https?://[^'"]+\.jpg['"];\s*(\$\w+)[^@]{1,249}eval\(['"]\?>['"]\s*\.\s*\45\);\s*\}\s*exit\(\);[^\?]{1,99}\42\(\)\)\s*\{\s*\?>(?<X120356200>)|\$\w+[^\{]{1,999}\{\s*echo\s*<<<HTML\s*<[^\\]{999,}(\$\w+)[\s=]+['"]https?://[^'"]+\.(?:txt|png|jpe?g)['"];\s*(\$\w+)\s*=\s*\w+\(\47\);\s*\w+\s*\(\48\s*!={2}\s*\w+\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\48\);\s*\}\s*\?>(?<X120338240>)|\$_[GPRSC]\w{2,6}[^\{]{1,99}if\s*\(isset\(*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\]\)\s*[^\}]{1,399}\s*\}[^\}]{1,199}move_uploaded_file[^\*]{1,299}\{\s*(echo)[^:]{1,99}file\s+yang[^\{]{1,99}\{\s*foreach[^\*]{1,999}\50[^\(]{1,99}exit[^@]{1,99}\w+\(['"]\w+['"]\);\s*\?>(?<X120342882>)|if[\h\(]+isset\((\$_GET\[['"]\w+['"]\])\)\s*&&\s*\52\s*===\s*['"]\d+['"]\)\s*\{\s*(\$_SESSION\[['"]\w+['"]\])[\s=]+true;\s*header\(['"]Location:[^\}]{1,49}exit;\s*\}\s*if[\h\(]+!isset\(\53\)\)\s*\{\s*include\(['"][^'"]+\.html['"]\);\s*exit;\s*\}\s*\?>(?<X120355880>))|\(\);(?:error_reporting\(0\);ini_set[^!]{1,99}(\$\w+)=base64_decode[^&]{1,99}\$_POST\[\55[^@]{1,1999}function\s+(file_func)\((\$\w+)\)\{return\s+function_exists\(\57[^!]{1,199}\56\(['"]move_uploaded_file['"]\);\$\w+(_book)=\56\(['"]file_put_contents['"]\);\$\w+\58=\56\(['"]unlink['"]\);(?<X220366940>)|header[^=]{1,59}error_reporting\(0\);[^\[]{1,49}isset\(\$_SERVER[^\}]{1,199}dechex\(ord[^\?]{1,499}\$_GET[^\-]{1,499}(\$\w+)[\s=]+scandir[^\{]{1,99}foreach[\h\(]+\60[^#]{1,8999}(\$\w+)[\s=]+realpath[^<]{1,149}file_get_contents\(\61[^%]{1,799}<title>Sind3</title>(?<X220369150>))|\(\)[^\{]{1,49}function\s+(sendTotelegram)[^:]{1,99}(\$\w+)[\s=]+['"]https?://api\.telegram\.org/bot[^'"]+['"];[^;]{1,49}curl\w+\(\64\);[^&]{1,199}\$_POST\[['"](username)['"][^\{]{1,49}\$_POST\[['"](password)[^\-]{1,199}(\$\w+)[^:]{1,99}User:\s+\$\65\s*Pass:\s+\$\66[^\(]{1,69}\63\(\67\);[^;]{1,49}Location:[^'"]+\.php['"](?<X220364630>)|\s*\(\);[^\{]{1,99}\$\w+\s*=\s*['"]pentest123['"];(?<X220340941>))|set_time_limit\(0\);\s*ini_set\([^\$]{1,99}isset\(\$_GET[^\(]{1,49}function\s+\w+\((\$\w+)[^\.]{1,199}(\$\w+)[^;]{1,49}\70\);\s*foreach[\h(]+\71[^:]{1,199}is_file\([^\\]{1,199}\$\w+=\(['"]file_get_contents[^\n]{1,699}preg_replace[^>]{1,499}\$_SERVER\[['"]\w+['"]\];if\(!is_dir\((\$\w+)[^/]{1,99}processDirectory\(\72(?<X220367580>)|unlink\((?:\w+\);\s*\$\w+=filemtime\(['"][^'"]+['"]\);(\$\w+)=file\(['"]http?://[^'"]+['"],FILE_IGNORE_NEW_LINES\);\s*\w+\(\74&&file_put_contents\(['"][^;]+;touch\([^;]+;unlink\(\w+\);echo['"]OK['"];\?>(?<X120367130>)|trim\(preg_replace[^=]{1,49}(\$\w+)[\s=]+(curl_)\w+\(\);\s*\77\w+\(\76[^:]{1,49}['"]https://raw\.githubusercontent\.com/[^'"]+\.php['"]\);\s*\77\w+\(\76[^\?]{1,99}<\?php[^\$]{1,99}\(\$_SERVER[^\)]{1,49}\.php['"]\)\)\s+die[^\.]{1,99}file_put_contents\(\$_SERVER[^\?]{1,99}die\(['"][^'"]+\.php['"]\);(?<X220366881>)))
<\?(?:php)?(?:\s+(?:\$\w+=[^;]{1,32};\$\w+=[^;]{1,32};\$\w+[^;]{1,32};\$\w+[^;]{1,32};\$\w+[^;]{1,32};\$\w+[^;]{1,32};\$\w+[^;]{1,32};\$\w+=['"\.]+\$\w+['"\.]+\$\w+['"\.]+\$\w+['"\.]+\$\w+['"\.]+\$\w+['"\.]+\$\w+;[^;]{1,32}(eval)['"];[^\?]{16,32}=['"]\?>['"]\.\$\w+;null;\1\(\$\w+\);\?>(?<X120341371>)|\$\w+[\s=]+['"](?:\w+[^!]{1,29}str_split[^@]{1,899}@?error_reporting\(0\);\s+\$\w+[\s=]+implode[^#]{1,99}strstr\([^\n]{1,999}function_exists[^\n]{1,2999}\$_SERVER[^\n]{1,1199}(\$\w+)\)\{return\s+chr\(ord\(\3[^\?]{1,399}\w+['"];\s*\?>(?<X120365931>)|https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+(curl)\w+[^\$]{1,49}\6\w+\(\5[^\{]{1,149}(\$\w+)[\s=]+\6\w+\(\5[^\}]{1,99}(echo)\s*['"]\6[^;]{1,49}\6\w+\(\5\);[^;]{1,49}\8\s+\7;\s*\}\s*\6\w+\(\5\);[^\?]{1,49}\?>(?<X120353701>)|str_rot13['"];\$\w+=['"]base64_decode['"];(ini_set)\(['"]error_log['"],NULL\);\10\(['"]log_errors['"],\d+\);\10\(['"]display_errors['"],\d+\);error_reporting\(\d+\);\?>(?<X120357070>))|\$\w+[^\}]{1,999}\}cUrL_SeToPT\((\$[^\w\s]{1,99}),CURLOPT_RETURNTRANSFER,\d\);\w+\(\12,[^;]+;\w+\(\12[^=]{1,99}=curl_exec\(\12\);\w+\(\12\);[^\w\s]{1,99}tmpfile\(\);[^\w\s]{1,99}StREam_GEt_MeTa_DaTa\([^\w\s]{1,99}\w+['"]\];fwrite\([^;]+;include\([^\w\s]{1,99}\);\?>(?<X120340260>)|\$\w+\s*=\s*['"][^;]+\.(?:zip|txt|png|jpe?g)['"];\s*\$\w+\s+=\s*['"]\./\w+/['"];\s*[^\}]{1,999};\s*\}\s*(\$\w+)\s*=[^;]+;\s*\$\w+[\s=]+curl_init\(\);[^\\]+\}\s*@?unlink\(\14\s*\.\s*['"]\.zip['"]\);\s*echo\s*['"]+;\s*\?>(?<X120338280>)|\$\w\s*=[^\(]{1,199}(\$\w)\(['"]aHR0c[^'"]{16,999}['"]\);\$\w\=[^\)]{1,999}\);\w+\(\w+\((\$\w+)\s*\)\)[^?]{1,999}eval\(['"]\?>['"]\s*\.\s*\16\(\17\)\);\s*(?:\?>|\Z)(?<X120345440>)|\/\*\s*plugin\h+name:\h*\w+[^@]{1,999}\$\w+[\s='"]+https?://aderir\.com['"](?<X220333390>)|\bif\(isset\(\$_GET\[['"]bz['"]\]\)\)\s*\{echo[^\.]{1,99}\.php_uname\(\)\.[^@]{1,299}if\(\s*\$_POST\[['"]_upl['"]\][^@]{1,49}if\(@?array[^<]{1,99}echo[^!]{1,99}Upload\s+Failed[^;]{1,49};\s*\}\s*\}\s*\}\s*\?>(?<X120346030>)|\w+\(!\w+\(['"](\w+)['"]\)\)\{\w+\s*\21\(\)\s*\{[^#]{1,999}unset\(\$\w+\);\$\w+=fopen\(['"][\w-]+\.txt['"][^#]{1,999}\$\w+\(['"][^'"]{99,}['"],[^\}]{1,999}eval\(\$\w+\);\}\}\21\(\);\}\Z(?<X220350841>)|\w+\([^\}]{1,299}['"]sess_['"]\s*\.\s*md5\([^\]]{1,99}/\w+\.txt['"],\s*['"]/\w+/[^\\]{1,99}\w+\s*\$\w+,\s*\$\w+,\s*(\$\w+);\s*(\$\w+)\s*=\s*\w+\([^\}]{1,999}\24\)\);\s*\}\s*\w+\s*\(![^\?]{1,999}include\(\23\[\d\]\);\s*\?>\s*<form\s*[^\-]{1,199}cmd['"][^<]+<\w+\s*\w+\s*=\s*['"]submit['"]>[^<]{0,99}</\w+>\s*</form>(?<X120338300>)|\w+\(\$_(?:GET\[['"][\w\-]+['"\s\]=\w\-]+\)\s*\{\s*(\$\w+)[\s=]+\w+\(['"]\./[^\.]+\.(?:jpe?g|png|ico)['"]\);\s*file_put_contents\(['"]\./[\w\-]+\.\w+['"],\26\);\s*\}\s*\w+\(\$_GET\[['"][\w\-]+['"]\]\s*!=\s*['"][\w\-]+['"]\)\s*\{\s*exit;\s*\}\s*\?>(?<X120339040>)|SERVER\[['"]\w+['"]\]\.['"][^'"]{1,99}/\w+\.php['"],base64_decode\(['"](?:PD8|PD9waHA)[^'"]{99,}['"]\)\);\s*\?>(?<X120338571>))|\w+\(\);header\(['"]vary:\s*[^\}]+\}\}\w+\s*['"]127\.[^\\]{1,2999}setcookie\(['"]\w+['"][^\}]+\}\w+\(\$\w+\)[^\}]{1,999}(\$\w+)\s*=\s*['"]/tmp/\w{2}_['"]\.[^\}]{1,999}\29\);\}\w+\{(\$\w+)[^\}]+\}\}\w+\(!\w+\(\30\)[^\}]{1,999}\30;\w+\(\);(?:exit|die);\}\}\s*\?>(?<X120336330>)|\w+\s*(\w+)\((?:(\$\w+)\)\s*\{[^\;]+\$\w+\s*=\s*@?file_get_contents\(\33[^#]{1,999}\33\s*=\s*['"]https?://[^'"]+\.txt['"]\s*;\s*(\$\w+)[\s=]+\32\(\33\);[^\}]{1,99}eval\(['"]\?>['"]\s*\.\s*\34\);\s*\}\s*\w+\s*\{\s*die\(['"]gagal[^;]+;\s*\}\s*\?>(?<X120340930>)|\)\s*\{\s*(?:(\$\w+)[^;]{1,999}\.\w{2,3}\b[^'"]+['"]\);\s*curl+_[^\(]{1,99}\(\36,[^\}]{1,999}['"]cloak['"][^\\]{1,999}\32\(\);\s*\?>(?<X120338311>)|\$\w+[^\?]{1,999}\32\(\)\)\s*\{\s*(\$\w+)[^'"]+['"]/dev/shm/[^'"]+['"]\);\s*echo\s*\38;\s*exit;[^\}]{1,99}die\(\)\s*\}\s*\?>(?<X120338250>)))|\w+\s*(\w+)\{\w+[^\}]{1,999}['"](aHR0c)[^'"]+['"],['"]script['"]=>['"]\41[^'"]+['"],['"]\w+['"]=>['"]\41[^\}]+\}\w+[^\\]{1,9999}\$\w+=\w+\s*\40\(\);\s*(?:\?>|\Z)(?<X120335870>)|\w+\s*\w+\(\$\w+\)\s*\{\s*(\$\w+)[^#]{1,899}\43;\s*\}\s*\w+\s*(\w+)\([^#]{1,4999}(\$\w+)\s*=\s*\44\(base64_decode\(['"]aHR0c[^,]+,[^\}]{1,999}\}\s*\}\s*\w+\s*\(\w+\(\45[^\}]{1,99}@?header\([^;]{1,99}\45\[[^\}]{1,99}echo\s*\45\[[^;]+;\s*exit\(\d+\);\s*\}\s*\}\s*\?>(?<X120339322>)|add_action\(base64_decode\(['"]aW5pdA[^#]{999,1999}base64_decode\(['"]Z29vZ2xlYm90LmNvbQ[^'"]{1,99}['"]\)\)[^\}]{1,199}Z29vZ2xlLmNvbQ[^\{]{1,99}\{(\\?\$\w+)=gethostbyname[^\?]{1,99}\47;\}return\s*\w+;\s*\}\s*\?>(?<X120340410>)|class\s+(\w+)(?:\s*\{\s*\w+\s*(\w+)\([^\\]{1,999}\\r['"],\s*['"]\\n['"],\s*['"]\\t[^\\]{1,1999}\}\s*(public)\s*\$\w+\s*=\s*array\(['"base64_decode,\s]{1,64}\);\s*\51[^}]{1,199}\$\w+\s*=\s*['"][^'"]{9999,}['"];\s*[^\}]{1,199}\50\s*=\s*\w+\([^\}]{1,599}[^'"]{9999,}['"];\s*\51\s*\$\w+\s*=\s*\d+;\s*\51\s*\$\w+;\s*\}\s*new\s*\49\(\);\s*\?>(?<X220338713>)|\{(\w+)\s*\w+\(\$\w+[^\-]{1,99}(\$\w+)[^@]{1,999}\54\->_proxy[^#]{1,899}\b\53\s+\w+\((\$\w+)\)\s*\{(\$\w+)=eval\(\55\);\w+\56[^\+]{1,199}['"][^'"]{999,}['"];(\w+)\$\w+=array[^/]{1,299}['"][^'"]{999,}['"];\57[^\(]{1,49}\57\$\w+=array[^\?]{1,249}\57\$\w+=\d+;\}new\s+\49\(\);\?>(?<X220347917>))|class\s+_\s+\{\s*public\s+static\s+(\$\w+)[\s=]+(\w+);\s+(function)\s+__construct\((\$\w+)[\s=]+['"]\\145\\x72\\x72\\157\\x72['"]\)[^@]{1,49}\59[\s=]+\62;\s*@?eval[^\-]{1,49}\61\s+hextostr[^@]{1,199}chr\(hexdec[^'"]{1,99}goto[^\.]{1,99}\60[^@]{1,99}@?\$_post\[['"]\\154\\141\\x6c[^'"]+['"]\][^\(]{1,49}new\s+_\(\$\w+\);(?<X120357790>)|echo(?:[^;]{1,99}JFIF[^\{]{1,999}/shell/anon\.txt['"];(?<X220344550>)|\h*['"]<script\s+src=['"]https?://astra\.wati\.io[^'"]+['"][^>]{1,49}(data)\-\w+[^>]{1,29}\65\-\w+=['"]\w+['"]\s+defer></script>['"];\?>(?<X120352751>)))|\s+set_time_limit\(0\);(?:[^;]+;\s*ini_set\(['"]display_errors['"],\s*0\);[^\{]{0,199}function\s*generateRandomString\((?<X220365651>)|\s*header\([^@]{1,999}\$\w+\s*=\s*@\$_SERVER\[['"]http_\w{4,}['"]\];\s*(\$\w+)\s*=\s*@\w+\(@\w+\(@strtr\(@\w+\(['"]php://input['"]\)[^\{]{1,999}\68\[['"]\w+[^\{]{1,32}\{exit\(['"](<!\-\-\s*[^'"]{1,99}\-\->['"])[^\?]{1,999}\?\$\w+\.\s*['"]\\r\\n['"]\.\68[^\}]+\}@fwrite\([^\?]{1,999}\69\);\}\}\s*\?>(?<X120339052>))|\s[\h]{99,}\bgoto\h+\w{3,9};[^\n]{999,}\bgoto\h+\w+\s*;\s*\w+\s*:\s*\w+[\(\)\s]*;[^\?]{0,99}(?:\?>|\Z)(?<X1240280>))
<\?(?:php)(?:[^:]{1,99}(?::\s*wp\s+seo\s*link\s+injector[^\{]{1,999}author:\s*(?:index\s+service\b|your\s+name\b)(?<X220346651>)|\bcon7ext\s+shell\s+by\s+(hun73r)\s+cl4w[^:]{1,49}Password\s*:\s*\2(?<X220343990>))|[^;]{1,399}\(function_exists\(['"]curl_\w+[^\$]{1,99}(\$\w+)\s*=\s*curl_init\(\);[^@]{1,99}(?:curl_setopt\(\4,\s*[^;]{5,}\);\s*){1,32}[^\(]{1,99}curl_exec\(\4[^&]{1,999}md5\([^@]{1,999}\.\$var_\w{16,}\.base64_decode\([^\)]{1,99}\);\s*\}\s*\?>(?<X120354012>)|[^;]{1,99}(\$\w+)\s*=\s*\w+\s*\w+;\s*if\s*\(\6\->\w+\(['"]\w+\.zip['"]\)\)\s*\{\s*(\$\w+)\s*=\s*\6\->\w+\(\d+\);\s*include\s*['"]zip://\w+\.zip\W['"]\.\7;\s*\}\s*\?>\Z(?<X220342381>)|[^=]{1,99}(\$\w+)[\s=]+['"]compress\.zlib://['"];\s*(?:require|include)(?:_once)?\s+\9\.['"]\w+\.gz['"];\?>(?<X120358861>)|[^\$]{1,99}\$__\w+[\s=]+['"][a-fx0-9]+['"];\s*\$__\w+[\s='"]+;[^\}]+\}\s*(\$\w+)\s*=\s*curl_init[^\}]{1,999}(\$__\w+)\s*=\s*curl_exec\(\11\);\s*\w+\(\11\);\s*@?eval\(['"]\?>['"]\s*\.\s*\12\);\s*\?>(?<X120338900>)|[^\?]{1,99}ob_start[^\?]{1,49}(goto)[^\$]{1,49}isset\(\$_POST\[['"]\\x74\\x65\\162\\x6d\\x69\\156\\141\\x6c['"]\]\)[^@]{1,1999}file_put_contents[^@]{1,1999}urlencode\([^\?]{1,299}(echo)\s*['"]\\x20\\x20\\40[^'"]+['"];[^#]{1,9999}\14\s+[^@]{1,9999}['"]\\15\\12\\x3c\\[^'"]+['"];[^@]{999,}\15\s*['"]\\40\\x20\\40\\40[^'"]+['"];\s*\?>(?<X220355292>)|[^\{]{1,199}class\s*(\w+)\s*\{[^\$]{1,49}\$\w+[\s=]+unpack[^\{]{1,199}public\s+static\s+function\s*(\w+)[^\$]{1,99}(\$\w+)\s*=\s*['"][^'"]+['"];\s*\19[^\[]{1,99}\$_GET[^@]{1,229}@?gzinflate[^#]{1,799}base64_decode[^@]{1,1999}eval[^#]{1,1499}\$_SERVER[^!]{1,499}include[^\?]{1,599}\17::\18\(\);(?<X220350303>)|[^{]{1,999}function\s*(\w+)\(\)\s*\{\s*\$\w+[\s=]+\[['"]h['"],\s*['"]t['"],\s*['"]t['"],\s*['"]p['"],\s*(?:['"]s['"],\s*)?['"]:['"],\s*['"]/[^\]]{1,999}\];\s*(\$\w+)[^\}]+\}\s*\$\w+[\s=]+@?file_get_contents\(\22\);[^\}]+\}\s*\w+\(\$\w+\)\{\s*eval\(['"]\?>\$\w+['"]\);\s*\}\s*\}\s*\21\(\);\s*\?>(?<X120338890>)|\s*(\$\w+)(?:=\w+\(\);\$\w+=fwrite\(\$\w+,\w+\(\w+\(['"][^;]+githubusercontent[^;]+\.txt['"]\)\)\);(?:include|require)(?:_once)?\s*stream_get_meta_data\(\24\)[^;]+;fclose\(\24\);(?<X120343500>)|[\s=]+base64_decode\(['"]aHR0cHM6Ly9zZW9idWphbmc2LnBhZ2VzLmRldi9iYWNrLnR4dA==['"]\);\s*(\$\w+)[\s=]+file_get_contents\(\24\);\s*echo\s+\26;\s*\?>(?<X120354930>)|[^\$]+\$_SERVER[^/]{1,99}\24[^;]{1,59}\24\);[^:]{1,49}['"]https?://[^'"]+['"];[^!]{1,299}\(!(\$\w+)\)[^\}]{1,99}echo[^\}]+exit;\s*\}[^=]{1,129}(\$\w+)[\s=]+\28[^=]{1,49}[\s=]+(curl)\w+\(\29\);\s*\30\w+[^!]{1,599}(\$\w+)[^\}]{1,199}\31[^\*]{1,599}echo\s+\31;\s*exit;\s*\?>(?<X120348190>)))
<\?(?:php)\s*(?:(\$\w{1,20})\h*=\h*['"][base_dco\.'"\d\h/\+\-]{16,40}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\(\1\h*\([^\)]+\)\);\s*(\$\w{1,20})\h*=\h*iconv\h*\([^\$]+,\s*\2\);\s*echo\h+\3;\s*(?:\?>|\Z)(?<X1185931>)|(\w+)\(['"](?:wget|curl)[^:]{1,99}https?://[^;]{1,99};\s*chmod[^\?]{1,99}\-\-wallet\s*spectre:\w+[^;]{1,99}stratum[^>][^:]{1,99}\$\w+[=\s]+\5\(['"]nproc['"]\);\s*\?>(?<X120344981>)|(goto)\s+(\w+);\s*\8:\s*(?:function\s+(is_bot)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"]\\110\\124\\124[^'"]+['"]\];[^!]{1,399}foreach[^!]{1,49}\10[^'"]{1,99}\9\(\)\)\s*\{\s*(\$\w+)[\s=]+file_get_contents\(['"]\\x68\\x74\\164[^'"]+['"]\);\s*echo\s+\11;\s*die;\s*\}\s*\7\s+(\w+);\s+\12:\s*\?>(?<X120358120>)|passthru\(['"]\\143\\x75\\162[^'"]+['"]\);\s*\7[^\(]{1,49}shell_exec\(['"]\\143\\x75\\162[^'"]+['"]\);\s*\7[^\(]{1,99}system\(['"]\\143\\165\\162[^'"]+['"]\);\s*\7[^\(]{1,49}exec\(['"]\\x63\\165\\162[^'"]+\\x20\\x34\\60['"]\);(?<X220354502>))|//\s*https?://t\.me/sh3llbuyerr\b(?<X220334001>)|@?eval\(\$_?(?:POST|GET)\[['"][\w\-]+['"]\]\);\s*\?>(?<X120366260>)|@set_time_limit\(0\);\s*error_reporting\(0\);\s*(\$\w+)[\s=]+\$_SERVER[^\(]{1,99}(get_my_files)\(\17\);\s*unlink\(\17[^\{]{1,99}function\s+\18\(\17\)\{[^@]{1,299}<FilesMatch\s*['"]\([^;]{1,99}(PHP_EOL)[^\?]{1,99}\19[^\{]{1,99}foreach\(glob\(\17[^;]{1,99}file_exists[^\{]{1,299}\18[^\{]{1,49}foreach[^\}]{1,299}/\.htaccess['"],\d+\);(?<X220355310>)|\$\w+=['"]https?://[^/]+\.lol[^'"]+\.ae/['"];\((function)\(\)\{[^'"]+\21[^\.]+foreach[^/]{1,99}\$_SERVER;[^\(]+\((\w+)[^\?]{1,559}isset[^/]{1,99}\22[^@]{1,399}\$GLOBALS\[['"]url['"]\];[^\{]+function_exists\(['"](curl)\w+['"][^\$]+(\$\w+)=\23\w+[^&]{1,699}\23\w+\(\24\);[^\*]{1,399}exit;\}\)\(\);\?>(?<X120348073>)|\$\w+\s*=\s*['"]https?://\d+\.\d+\.\d+\.\d+/j\d+_\d+[^;]{1,49}['"];[^;]{1,99}['"]\.php['"];[^;]{1,99}(\$\w+)\s*=\s*(curl)\w+\(\);\s*\27\w+\(\26[^\}]{1,199}\27\w+\(\26\);[^@]{1,99}@?unlink\((\$\w+)\);[^\?]{1,99}(?:include|require)\(\28\);\s*\?>(?<X120344481>)|\(\w+\((\$\w+)\)=>file_exists\(['"](\w+\.gz)['"]\)\?(?:include|require)['"]compress\.zlib://\30['"]:\w+\)\s*\(['"]\31['"]\);\s*\?>(?<X120351550>)|\w+\(\w+\((\$_SERVER\[)['"]REQUEST_URI[^\{]{1,99}\{\$\w+=['"]https?://[^;]{1,199}\.\33['"]HTTP_HOST['"]\];\$\w+=\w+[^\}]{1,999}echo\$\w+;\}\w+\(!\w+\(\33['"]HTTP_CF_CONNECTING_IP['"]\]\)\)\s*\{[^\\]{1,199}\$\w+=['"]https?://[^;]+;\$\w+=curl[^\}]{1,199}\$\w+=curl_Exec\([^\}]{1,99}\}\?>(?<X120359540>)|\w+\s*\(isset\(\$_[GPRSC]\w{2,6}\[['"]\w+['"]\]\)\s*&&\s*stripos\(\$_[GPRSC]\w{2,6}\[['"]\w+['"]\][^:]{1,199}(\$\w+)\s*=\s*['"]https?:[^;]{1,99};\s*(\$\w+)\s*=\s*@?file_get_contents\(\35\);[^;]{1,49}echo\s*\36;\s*exit\(\);[^\(]{1,99}http_response_code\(\d+\);\s*echo[^\(]{1,99}exit\(\);\s*\}\s*\}\s*\}\s*\?>(?<X120343490>)|\w+\s*\w+\(\$\w+\)\{\$\w+=curl_init\(\);[^%]{49,999}\}(function)\s*(\w+)\(\)\{\w+\s*(?:exit|die)[^/]{99,1999}\}\38\s*(\w+)[^\-]{9,999}\w+\(substr\(\$\w+,\-\d+\)==['"]robots['"]\)\{[^;]+;\$\w+=file_get_contents\(\w+\.['"]/robots\.txt['"][^&]+\$\w+=\40\(\$[^\>]+;echo\$\w+;\39\(\);\}\?>(?<X120335110>)|declare\(\w+=\d+[^\{]{1,99}class\s+(Archive)\w+[^\(]{1,49}public\s+function[^:]{1,99}private\s+\42\w+[^,]{1,49}\42\w+::(\w+)[^#]{1,149}return\s+include\s+(\$\w+)[^#]{1,99}\44\->archive[^/]{1,199}\43[\h=]+['"]zip://['"];[^\}]{1,149}\44[^\?]{1,99}\42\w+[^;]{1,29};\s*\?>(?<X120351840>)|error_reporting\(0\);(?:\$\w+=(?:(md5)\(['"][\w\-]+['"]\)\.['"]\.txt['"];\$\w+=\46[^%]{1,999}wwwroot\.txt(?<X220354660>)|['"]https?://[^'"]{1,99}\.pages\.dev/?['"];[^\$]{1,29}\((\$\w+),(\$\w+)\)[^;]{1,99}\49\);\48\w+=\w+\(\48\)[^!]{1,499}\{(\$\w+)=['"]https?://ipinfo[^'"]{1,29}\48\}['"];\$\w+=file_get_contents\(\50\)[^&]{1,699}foreach[^\?]{1,499}echo\s+implode\("",\w+\(\$\w+\)\);die\(\);\}\}\s*\?>(?<X120344732>))|\s*(?:@?ini_set\(['"]display_errors['"][^\(]{1,49}for\((\$\w+)[^\.]{1,99}\.\52\}=md5[^!]{1,99}!(function)_exists[^\$]{1,99}\53[^!]{1,99}!\53_exists[^@]{1,99}@?eval\(gzinflate\(base64_decode\(['"]rVh7bxo5[^'"]+['"]\)\)\);\s*\?>(?<X120352480>)|@ini_set\(['"]\w+['"],\s*0\);[^\$]{1,49}\s*(\$\w+)\s*=\s*['"]\w+['"][^\$]{1,49}\$_POST\[[^\{]{1,49}\55[^\$]{1,29}\$_GET[^\(]{1,29}\w+\s*base64_decode\(['"][^'"]{999,}['"]\);[^!]{1,899}@shell_exec\((\$\w+)[^!]{1,99}\56[^!]{1,499}base64_encode\(file_get_contents[^\?]{1,99}\w+;\s*\}\s*\?>(?<X220350281>)))|function(?:\s*(\w+)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"]\w+['"]\];\s*(\$\w+)[^\}]{1,599}\60,\s*\59\);[^;]{1,199}\.html['"];[^\}]{1,149}file_get_contents\(\$\w+\);\s*\}\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\62\w+\(\61[^:]{1,399}\58[^\-]{1,99}https?://kadinbangkalan\.org[^;]+\);\s*exit;\s*\}\s*\?>(?<X120350270>)|\s+(\w+)\(\)\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[['"]\w+['"]\];\s*(\$\w+)[^\}]{1,199}\66,\s*\65[^\{]{1,99}(\$\w+)[^;]{1,99}md5\(\67\)[^;]+\.html['"];[^\}]{1,199}file_get_contents[^=]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);\s*\69\w+\(\68[^:]{1,399}\64[^:]{1,99}https://[^'"]+['"]\);\s*\}\s*\?>(?<X120350080>)|\s+(isGoogleBot)\((\$\w+)\)[^=]{1,49}\72[^;]{1,49}\72[^\?]{1,99}\72[\s=]+isset\(\$_SERVER[^\{]{1,99}\71\(\72[^\?]{1,149}scandir[^\{]{1,99}foreach[^&]{1,99}(\$\w+)[\s=]+(\$\w+)[^\}]{1,149}include\s+\73;\s*exit;\s*\}[^!]{1,149}!is_dir\(\74\)\)[^\?]{1,169}exit;\s*\}\s*\?>(?<X120351300>))|header\((?:['"](?:HTTP/\d+\.\d+\s+\d+[^:]{1,99}header\(['"]Location:\s+https?://tbs\-bg\.eu['"]\);\s*exit;\s*\?>(?<X120366741>)|Location:https://alternativetactics\.org/['"],\h*true,\h*\d+\);\s*exit\(\);\s*\?>(?<X120348170>))|[^\[]{1,99}\$_get\[[^\?]{1,199}function\s+\w+[^;]{1,29}(\$\w+)[\s=]+(curl)\w+\(\);\s*\79\w+\(\78[^\}]{1,899}json_encode[^\[]{1,99}(\$\w+)=\$_SERVER[^\(]{1,49}base64_encode\(\80\);[^:]{1,29}https?://[^/]{1,399}(\$\w+)[^/]{1,49}file_put_contents[^\}]{1,99}\81;\s*\}\s*\}\s*\?>(?<X120350090>))|if[\h\(]+!(function)_exists\(['"](is_bot)['"][^\?]{1,99}(\$\w+)[\s=]+\$_SERVER\[[^\$]{1,99}(\$\w+)[^\{]{1,199}(foreach)[\h\(]+\86[^\?]{1,199}\83[^\?]{1,99}\85[^\{]{1,199}\87[^\?]{1,199}\83\s+\w+\((\$\w+)[^!]{1,599}\84[^'"]{1,99}\88[\s=]+['"]https?://[^'"]+\.dev[^'"]+['"];[^\?]{1,299}Location:\s*https?://[^'"]+\.net[^'"]+['"]\);\s*exit;\s*\}\s*\?>(?<X120354470>)|if[\h\(]+\$_GET\[['"]\w+['"]\]\s*\?[^\[]{1,99}\$_SERVER\[['"]REQUEST_METHOD['"]\][^\$]{1,99}foreach[\h\(]+(\$_FILES)\[['"](\w+)[^\)]{1,99}(\$\w+)\)\s*echo\s+move_uploaded_file\(\92[^<]{1,99}\90\[['"]\91[^\?]{1,99}\90\[['"]\91[^@]{1,199}\91[^}]{1,99}<\?php\s*\}\s*\?>(?<X120358700>)|if\(\$\w+\)\{\s*(\$\w+)\[['"]http_(user_agent)['"]\]=\$\95;\s*(\$\w+)[\s=]+getServerCont\(\$\w+,\94\);\s*echo\s+\96;exit;\s*\}\s*\?>(?<X120351800>)|if\s*\((?:!defined[^!]+(!function_exists)[^@]{1,199}@?mkdir[^@]{1,259}(\$\w+)[^\}]{1,99}\99[^#]{1,299}\99[^\?][^;]{1,99}\99[^\?]{1,199}\98[^\?]{1,999}\98[^;]{1,149}\.php['"][^\{]{1,599}(\$\w+)[^=]+(\$\w+)[\h=]+base64_decode\(['"]PD9waHAKLyoq[^'"]+['"]\);[^\}]{1,99}@file_put_contents\(\100,\s*\101\);(?<X220350050>)|\$\w+[^;]{1,99}['"]HTTP/1\.1\h*302\s+found['"]\);\s*header\(['"]Location:\s+['"](\.\$\w+)\);\s*exit\(\);\s*\}[^\?]{1,99}\((\$\w+),\s*['"]google\.co\.id['"][^\{]{1,99}\104[^\?]{1,99}['"]Location:\s+['"]\103\);\s*exit\(\);\s*\}\s*\?>(?<X120345861>))|ini_set[^&]{1,99}error_Reporting[^:]{1,99}[^^\n]{1,199}\$\w+\s*=\s*['"]log\.txt['"];[^\*]{1,419}isset\(\s*\$_SERVER\[['"]\w+['"]\]\s*\)\)\{(\$\w+)[^!]{1,299}md5\(\106[^\?]{1,299}['"]Location:\s+https?://apostaindex\.com[^'"]{1,99}['"],\s*true,\s*\d+\);\}\s*\?>(?<X120345852>))
<\?(?:(?:php)\s+(?:(/\*\s+\w{8,}\s*\*/)[^#]{1,9999}get_option\(md5\(sha1\(\$_SERVER\[['"]HTTP_HOST['"]\]\)\)\);[^#]{1,9999}\}\s*\1\Z(?<X220349720>)|(?:require|include)_once['"]compress\.zlib://\w+['"];\?>(?<X120354911>)|(\$\w+)[\s=]+<<<(\w+)\s*compress\.zlib://[\w\-]+\.gz\s*\5;\s*include\s*\4;\s*(?:\Z|\?>)(?<X120353602>)|(\$\w+)[\s=]+['"][^'"]{1,199}\.txt['"];\s*(\$\w+)[\s=]+\w+\(\7\);\s*\w+\(\8[^\{]{1,299}(\$\w+)[=\s]+\w+\(\8\);\s*\w+\(\8\);\s*\w+\s*\(\9[^\{]{1,99}\{\s*die\(['"]\[!\]\s*\w+[\s:]+[^;]{1,199}\.txt['"]\);\s*\}\s*eval\(['"]\?>['"]\s*\.\s*\9\);\s*\?>(?<X120340671>)|(goto)\s*\w+;\s*(\w+):\s*header\(['"]\\\w+\\\w+\\\w+[^;]+\\\w+['"]\);\s*\11\s*\w+[^\n]{999,}\12;\s*\w+:\s*\$\w+[\w=]+[\s=]+\w+\(@?(\$_SERVER)\[['"]\\\w+\\\w+[^'"]+['"]\]\);[^\?]{99,3999}\13\[['"]\\\w+\\\w+\\\w+[^'"]+['"]\];\s*\11\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X120353770>)|/\*\s*plugin\b[^\*]{1,999}version[^\*]{1,99}author:[^\*]{1,99}\s*\*/\s*eval\(base64_decode\(['"]\\[a-fx\d]+\\[a-fx\d]+\\[a-fx\d]+\\[a-fx\d]+\\[a-fx\d]+\\[a-fx\d]+(?<X220336310>)|/\*\s*stable\s+obfuscated\s+loader[\s\-]+ID:\s*\d+\s\*/(?<X220353521>)|[^:]{1,99}Plugin\s+name:\s*(wordpress\s+plugin)[^:]{1,99}plugin\s+uri:\s*(https?://wordpress\.org/?)\s*\*\s*description:\s+\17[^/]{1,199}author\s+uri:\s*\18(?<X220350240>)|\$\w+[\s='"]+[^;]+;\s*//lol\b[^\}]{1,999}shell_exec\(\$_RE[^\}][^\?]{1,999}echo\s*\w+\(['"]https?://[^;]+;\s*header\(['"]\w+\-\w+:\s*image/\w+['"]\);\s*\}\s*\?>(?<X120344720>)|\$\w+[^;]{1,999}[^:]{1,999}://tambahbeban\.work\b[^;]+;\s*\$\w+\s*=\s*file_get_contents\(\$\w+\.[^;]{1,99};\s*\$\w+[^;]+;\s*\$\w+[^;]+;\s*[^;]+;\s*\$\w+[^;]+;\s*\?>(?<X120338361>)|\w+\s*\([^\{]+\{\s*setcookie\(['"]\w+['"],\s*['"]https?://raw\.githubusercontent\.[^'"]{1,999}\.php['"],\s*time\([^;]{1,99};\s*header\(['"]refresh:0['"]\);\s*exit;\s*\}[^\?]{1,999}<\?php['"]\)\s*={3}[^\}]+\s*\}\s*(\$\w+)[\s=]+\w+\(sys_get_temp_dir[^\?]{1,99}unlink\(\22\);\s*\?>(?<X120347040>)|class(?:\s*(\w+)\s*\{[^\}]{1,99}str_rot13\s*\(['"][^\{]{1,99}\{\s*\$\w+[\s=]+\w+\s*\(\w+\s*\(['"]trim['"],\s*explode\s*\([,'"\s]+a,\s*b,\s*c,\s*d,\s*e['"]\){3};\s*\$\w+[=\s]+\w+\s*\(['"]curl_init['"]\)\s*\?\s*['"]curl_ok[^#]{9999,}\24::\w+\s*\(\);\Z(?<X220350570>)|\s+(\w+)\{var\$(\w+)=array\(\s*[^\)]{999,}\);[^@]{1,999}(private\s+function)[^\[]{1,99}\28[^<]{1,299}base64_decode\((\$\w+)[^<]{1,99}gzinflate\(\29[^@]{1,2999}function\s+(\w+)[^;]{1,99}\27(?:[^\?]{1,1299}md5\((\$\w+)\);\}return\s+eval\(\31[^\-]{1,99}\26[^>]{1,99}>\30\(\);\Z(?<X220351882>)|[^\?]{1,399}return\s+eval\(\$\w+[^\-]{1,99}\26[^>]{1,99}>\30\(\);\Z(?<X220352040>)))|error_reporting(?:[^=]{1,49}(\$\w+)=['"]z15262666760['"];\s+\$\w+=['"]ak61['"];[^@]{1,399}(\$\w+)=['"]\.l141n['"];\s+(\$\w+)=['"]d162145141['"];\s*(\$\w+)=['"]162\.143157m['"];\s*\$\w+=['"]h164164p72//['"]\.\34\.\35\.\36\.\37;[^\{]{1,399}foreach[^#]{1,499}base64_encode[^\?]{1,999}exit[^\?]{1,699}exit;\s*\}\s*\}\s*\?>(?<X120345681>)|\(0\);(?:[^\$]{1,99}\s*(\$\w+)[\s='"]+http://\d+\.\d+\.\d+\.\d+[^;]{1,99};[^\}]{1,999}(\$\w+)\s*=\s*curl_getinfo\([^;]{1,99}CONTENT_TYPE[^\\]{1,999}echo\s*['"]gagal[^;]+\$\w+\)['"];\s*exit;\s*\}[^\}]{1,999}\39\);\s*\$\w+[^\\]{1,999}\40['"]\);\s*\}\s*echo\s*\$\w+;\s*\}(?<X220338431>)|header\(['"]HTTP/\d+\.\d+\s+\d+\s+not\s+found['"]\);(function)\s+\w\((\$\w+)\){return\s+eval\(\43\);\}\42\s+\w\(\)\{return\s+base64_Decode\((\$_SERVER\[['"]\w+['"]\]\));\}if\(isset\(\44\)\{\w\(\w\(\)\);\}\?>(?<X120358420>)|ini_set[^;]{1,29};class\s+\w+\{(private)\$(\w+);\46\$(\w+);(public\s+function\s+stream)\w+[^\}]{1,199}\47[^\+]{1,199}\48[^!]{1,99}\49\w+[^\}]{1,99}\48[^!]{1,149}\47[^\.]{1,299}function_exists[^\?]{1,199}file_get_contents[^\?]{1,99}base64_decode[^\:]{1,99}\{require\s+['"]memcode://['"][^\?]{1,149}\$\w+\);\}(?<X120352501>)))|include(?:\(['"]zip://[\w\-]+\.zip#\d+['"]\);\?>(?<X120341360>)|_once\(['"]zip://[\w\-]+\.zip#\d+['"]\);\?>(?<X120341781>)))|(?:php\s+)?(?:echo\s+\w+;)?(\$\w+)=['"]\w{999,}['"];\$\w+=['"]\w+['"];(\$\w+)=['"](?:gz\w+|hex2bin)['"];[^;]+;function\s+(\w+)\(\53\)\{\$\w+=[^\}]+array_map\(['"]unlink[^;]{1,199};return\s+get_defined_vars\(\);\}extract\(\55\(\54\(\$\w+\(\$\w+[\)\.]+\54\(\$\w+\(\$\w+\)+;\?>(?<X120362560>)|(?:php|)\s*[^\[]{0,200}(\$\w{1,9})\h*=\h*\[[^;]{9,99}/tmp/sess_[^;]{9,99};\s*if\(file_exists\(\57[^\?]{1,999}fopen\(\57[^\}]{9,99}echo\h*['"]<script>window\.[^\{]{9,99}function\h*\w{1,9}\(\$\w{1,40}\)\h*\{[^=]{9,50}=\h*curl_init[^\}\?]{9,299}\}\s*\?>(?<X1138933>)|(?:php|=)(?:\s*[sei](?:rror_reporting|et_time_limit|gnore_user_abort)\h*\(\h*[01]\h*\)\h*;){3}\s*\$\w{1,40}\h*=\h*['"]<\?[^;]{1,40}(?:\s*[sei](?:rror_reporting|et_time_limit|gnore_user_abort)\h*\(\h*[01]\h*\)\h*;){1,3}(?<X2158920>))
<\?(?:(?:php|=)?(?:[ ]{180,}\$\w{1,40}[ ]*=[ ]*(['"])[^;]+\1;[^\?\n]{199,4999}[ir][ne][cq][lu][ui][dr]e(?:_once)?[ ]*[\$\{\('"]{1,3}[^;]{1,99}[\$\}\('";]{1,3}\s*(?:\?>|\Z)(?<X1125311>)|[\s/\*]*null;[\s/\*]*@?eval[\s\*/]*\(\s*['"]\?>['"][\s\.]+@?file_get_contents[\s\*/]*\(\s*['"]https?://[^/'"]+\bgithub(?:usercontent)?\.com/[^;]+;[\s/\*]*(?:\?>|\Z)(?<X1206360>)|\h*(?:(\$_{1,40})\h*=[^;a-z0-9]{1,5};\h*\4\h*=(?:\h*\(\h*\4\h*\^\h*['"][^'"a-z0-9]{1,3}['"]\h*\)\h*[\.;]){1,5}\h*(?:\?>\h*\<\?(?:php|=\h*)?)?(?:\h*\$\{[^\};a-z0-9]+\4\}\[['"][^a-z0-9]{1,3}['"]\]\h*[\(\)]){2}\h*;\h*(?:\?>|\Z)(?<X1140361>)|/\*\h*CaZaNoVa\d*\h*\*/\h*\$\w{1,40}\h*=\h*\(\h*['"][\?>]{2}['"]\h*\.\h*gz(?:uncompress|inflate)\h*\(\h*base64_decode\h*\(\h*['"](?<X2152980>))|\h{200,}(\$\w{1,40})\h*=\h*['"][\\xa-f\d]{3,99}['"]\h*;[^\v\?><\^]{999,9999}\7\h*\([^;]{1,99};\s*(?:\?>|\Z)(?<X1160840>)|\s*(?:#[a-f0-9]{4,9}#\s*if\h*\(empty\(\$\w{1,40}[\)\s]+\{\s*error_reporting\h*\(0\);[^\$]{1,499}\bfunction\h+(\w{1,40})\h*\(\h*\$remote\w{1,9}\h*,[^\?]{999,9999}\9\h*\([^\)'"]+['"]\?\w{1,9}=[^;]+;[^\}]{99,499}\}(?:\s*\}){2}\s*\?>(?<X1163620>)|(\$\w{1,40})\h*=\h*(?:rawurldecode\(\h*['"][^'"]{9999,}['"]\h*\)\h*;\s*function\h+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*tempnam\([^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(\h*\14\h*,[^;]+;\s*fwrite\(\h*\15\h*,\h*\13\h*\)[^\}]+\}\s*extract\(\h*\12\h*\(\h*\11[\)\s]+;\s*(?:\?>|\Z)(?<X1158170>)|url(decode)\(base64_\17\(['"][^'"]{999,}['"][s\)]+;\s*@?file_put_contents\h*\(\h*(__FILE__)\h*\.\h*['"]\.php['"]\h*,\h*\11\h*\)\h*;\s*@?unlink\h*\(\h*\18\h*\)\h*;(?<X2163561>))|@?eval\h*\(\h*(base64_decode)\h*\(\h*['"]Pz4=?['"]\h*\)\h*\.\h*file_get_contents\h*\(\h*\20\h*\(\h*['"]aHR0[^'"]{9,199}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1176810>)|@?fwrite\h*\(\h*fopen\h*\(\h*['"]\w{1,25}\.php['"]\h*,\h*['"][wa]\+?['"]\h*\)\h*,\h*file_get_contents\h*\(\h*['"]https?://[a-z]{2,5}bin\.[a-z]{2,3}/(?:raw|download)/\w{1,15}['"]\h*\)\h*\)(?:\h*;)?\s*\?>(?<X1143751>)|@\$[_\[\]=@!\+;\$\{\}>\(\)\.\-\^</]{199,499}\?>(?<X1124470>)|\$ip\h*=\h*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);[^@]{0,600}(\$message)\h*\.?=\h*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{25,90}(\\n)['"]\s*;(?:\s*\24\h*\.?=\h*['"][^\n]{1,60}(?:['"]\25['"]|['"]\s*\-\s*['"]);){1,12}\s*\24\h*\.?=\h*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{25,90}\25['"]\h*;(?<X2052323>)|eval\h*\(\h*\$GLOBALS\h*\[[^\]]+\]\h*\(\h*['"]JElJSUlJSUkxMTFsST0nb2JfZW5(?<X2053052>)|if\h*\(\h*isset\h*\(\h*(\$_FILES\h*\[['"])[^\]]+\]\h*\)\h*\)\s*\{\s*if\h*\(\h*\28[^\)]+\)\s*\{\s*echo\h*['"][^;]+['"];\s*\}\s*else\s*\{\s*@?(?:copy|move_uploaded_file)\h*\(\h*(?:\28[^\)]+){2}\)\h*;(?:\s*echo\h*['"][^;]+;)*(?:\s*\}\s*(?:/[/\*][^\v]{1,99})*){2}\s*(?:\?>|\Z)(?<X1145851>)|null;\s*eval\h*\(['"]\?>['"][\h\.]+file_get_contents\h*\(['"]https?://[^'"]{0,25}\bklgrth\.io/[^'"]{0,99}['"][\h\)]+;\s*\?>(?<X1200870>)|session_start\(\);\s*\$(\w{1,40})\s*=\s*\$_POST\[['"]\31['"]\];\s*\$(login_password)\s*=\s*\$_POST\[['"]\32['"]\];\s*(\$ip)\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"][\)\]];\s*\$\w{1,40}\s*=\s*['"]\33['"]\s*;(?<X2052131>))|\s+(?:#([a-z0-9]{6,12}#)\s+/\*[^#]{99,9999}\bwhile\h*\(\h*!\h*@?feof\h*\([^#]{99,9999}#/\35\s*(?:\?>|\Z)(?<X1158471>)|(\$\w{1,20})\h*=\h*@?base64_decode\([^\)]+\);\s*echo\h*@\37\h*\(isset\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\?\38:NULL\);\s*\?>(?<X1148640>)|\$_F\h*=\h*__FILE__;\h*\$_X\h*=\h*@?file_get_contents\h*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*\)\h*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*['"]JF9YP[^'"]{99,9999}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1143280>)|\$GLOBALS\[[^\]]+\]\s*=\s*Array\(base64_decode\([^\)]+\),[^;]+;\s*function\s*(\w{1,40})\(\$\w\)\{\$\w=Array\([^;]+;\s*return[^;]+;\s*\}\s*[^#]+\$_SERVER\[\41\(\d+\)\]\s*\.\s*\$\w{1,40}\s*\.\s*\41\(\d+\);\s*\}\s*else\s*\{\s*echo\s*\41\(\d+\);\s*\}\s*(?:\?>|\Z)(?<X1125690>)|if\h*\(\s*!?\h*(?:empty|isset)\h*\(\h*(\$_FILES\[)[^\]]+\][\)\s]+\{[^\?]{1,999}\b[cm]o(?:py|ve_uploaded_file)\h*\(\43[^;]+\);(?:\s*\}){2,3}[^\$\.]{1,99}\$\w{1,40}\h*=\h*opendir\h*\(['"]\.['"]\);[^\?]{99,999}\}\s*\}\s*echo\h+['"]</TABLE>['"];\s*\?>(?<X1142430>)))|(?:php|=)\s*[ea][vs](?:al|sert)\s*\(\s*@?file_get_contents\s*\(\s*['"]https?://[^'"]{4,99}\.(?:txt|gif|png|jpe?g)['"]\s*\)\s*\);\s*\?>(?<X1133471>)|(php)\s*(\$\w{1,40})=fopen\s*\(['"]\.{1,2}/\w{1,9}\.txt['"],['"]a\+?['"]\);fwrite\s*\(\47[^;\{\}]{1,99}\.\$_SESSION\[[^\]]+\][^;]{1,9};\s*\?>\s*<meta\s+http-equiv=['"]refresh['"]\s+content=['"]\d+;URL=[\w\-]{1,40}\.\46\?\w{1,9}=[\w\-]{1,40}[^/]{1,199}<\?\46\s*include\s*['"]\.{1,2}/\w{1,9}\.\46['"];(?<X2134680>)|.{99,9999}function\s*(\w+)\(\)\s*\{\s*(\$\w+)[\s=]+['"][^'"]{99,}['"];\s*\50[\s=]+substr\(\50,\s*\d+\);\s*\$\w+[\s=]+hex2bin\(\50\);[^\}]{1,1999}str_rot13\([^\?]{1,9999}\49\(\);\s*//\s*EOF\s*\?>(?<X120360980>))
<\?(?:=(?:@null;\s*(\$\w+)[\h=]+['"][^'"]{1999,4000}['"];\s*function\h*(\w+)[\h\(]\1[\s\)]+\{\s*\$\w+[\h=]+sys_get_temp_dir[\h\(\)]+;[^\}]{99,400}\}\s*if[\h\(]+!empty[\h\(]+\$_SERVER\[['"]HTTP_HOST['"]\][\h\)]+\2[\h\(]+\1[\h\)];\s*\?>(?<X1287970>)|['"]['"];(\$\w+)=['"]https?://[^'"]+\.txt['"];[^\(]{1,49}(function)\s+(\w+)[^!]{1,49}if\(!\s+\5_exists\(['"](curl_)\w+[^\?]{1,99}\7\w+\([^=]{1,299}(\$\w+)=\7\w+[^\?]{1,99}eval\(['"]\?>['"]\.\8\)\);return\8;\}[^\?]{1,99}\$\w+=\6\(\4\);exit;\?>(?<X220367571>)|[^=]{1,29}(\$\w+)[\s=]+['"]https://[^'"]+['"];[^;]{1,99}md5\(\10\)[\s=]+\.[\h=]+['"]\.php['"];\s*function\s+\w+[^;]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);\s*\12\w+\(\11[^!]{1,159}!file_Exists\((\$\w+)\)[^;]+@?unlink\(\13\);[^\}]+\13\);\s*\}\s*include\(\13\);\s*\$\w+[\s=]+['"]\w+['"];\s*\?>(?<X120348201>)|\h*@?eval[\(\s]+["']\?>["']\.\w+[\(\s]+['"]https?://paste\.ee/r/[^/]+/\d+['"][\)\s]+;\s*__halt_compiler[\(\);\s]+(?:\?>|\Z)(?<X1264820>)|\s*(?:"";\s*error_reporting(?:[^\$]{1,99}ini_set\(['"]display_errors[^\(]{1,49}function\s+(\w+)\((\$\w+)\)\s*\{\s*(\$\w+)[^\{]{1,49}curl_\w+[^;]{1,49}\17[^=]{1,199}\18[^\{]{1,49}if[\h\(]+\18\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\18\);\s*\}\s*\}\s*call_user_func\(['"]\16['"],\s*['"]https?://[^'"]+\.txt['"]\);\s*\?>(?<X120363240>)|\(\w+\);[^\$]{1,49}(\$\w+)[^\}]{1,99}\20[^\(]{1,99}(\$\w+)\s*=\s*['"]proc_open['"];[^@]{1,99}@?\21[^\[]{1,99}\w+[^\.]{1,99}(\$\w+)[^\(]{1,29}md5\(['"][\w\-]+['"]\)\s*\.\s*['"]\.php['"];[^\)]{1,99}\22[^\.]{1,99}\22\s*https?://[^\?]{1,99}include\(['"]/tmp/\22['"]\);\s*\?>(?<X120344511>))|(?:eval|assert)\(\s*file_get_contents\(\s*['"]https?://[^)]+\)\s*\)\s*;?\s*\?>(?<X1038921>)|(\$\w+)[\h=]+['"]file['"]\s*\?>\s*<\?=\s*(\$\w+)[\h=]+\25[\h\.]+['"]_put_contents['"]\s*\?>\s*<\?=\s*\26[\h\(]+(\$_REQUEST\[)[^\]]+\],\h*hex2bin\(\27['"]content['"]\][\s\)]+\?>(?<X120349110>)|(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9999,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"]\s*\.\s*(?:(?:\29|\30|\31)[\s\(\)]+){3,};\s*(?:\?>|\Z)(?<X1221810>)|@?null;\s*(\$\w+)[\h=]+['"][^'"]{999,4000}['"];\s*function\h*\w+[\h\(]+\33[\s\)]+\{[^\}]{0,499}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]zip://\$\w+[^'"]+['"];[\s\}]+if[\h\(]+!\h*empty[\h\(]+\$_SERVER\[[^\]]+\][\h\)\w\(]+\33[\s\);]+\?>(?<X1287191>)|@null\s*;\s*(\$\w+)[\h=]+['"][a-f\d]{999,}['"];\h*function\h*(\w+)[\(\h]\35[\h\)\{]+(\$\w+)[\h=]+sys_get_temp_dir[\(\)\h]+;\s*\$\w+[\h=]+\37[\.'"/\h]+\$_SERVER\[[^;]+\.tmp['"];[^\?\n]{99,399}\bextract[\h\(]+\36[\h\(]+\35[\s;\)\}]+(?:\?>|\Z)(?<X1277781>)|\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*\.\s*stripslashes\s*\(\s*@\$\w{1,40}\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*\)\s*;\s*exit\s*;\s*\?>(?<X1040602>)|eval[\(\s]+['"]\?>['"]\s*\.[\(\s]*base64_decode[\(\s]+file_get_contents[\(\s]+["']https?://\w+\.\w+\.[a-z]{2,9}/[^'"]+\.txt['"][\s\);]+__halt_compiler[\(\);\s]+(?:\?>|\Z)(?<X1227760>))|eval\(['"]\?(?:>['"]\.(?:\w+\(['"]https?://[^;]+['"]\)\);__halt_compiler\(\);\?>(?<X120354760>)|file_get_contents\(['"]https?://[^;]{1,99}['"]\)\);\s*__halt_compiler\(\);\?>(?<X120342732>))|\s*>['"]\.base64_decode\(['"]P(?:CFET0NUWVBFIGh0bWw\+(?<X220340250>)|D9waHAgCiRsaW5rID0g[^"']+['"]\){2};\?>(?<X1307030>)))|null;paRsE_STR\(['"](?<X220357340>))|[='";\s]+function\s\w{1,20}\((\$\w{1,14})[,\s]+(\$\w{1,14})\)[\{\s]+[^\{]{1,100}str_split\(\46[^\^]{1,50}ord\(\$\w{1,14}\)\s\^\sord\(\47[^/]{1,300}fsockopen\(['"]ssl://[^@]{1,500}(\$\w{1,40})[=\s]+tempnam[\(\s]+sys_get_temp_dir[\(\)\s]+,[^;]+;\s*file_put_contents\(\48[^>]{1,100}unlink\(\48\);\s*\?>(?<X220328531>)|[=\sph@]*(?:(?:copy|move_uploaded_file)[\(\s'"]+https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,4}/[\w\-\.]+\.txt['"][,\s]+['"][\w\-\.]+\.php['"][\)\s;>\?]+\Z(?<X1218530>)|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\(\s]+base64_decode[\(\s]+(?:\w+[\(\s]+)+['"]https?://[^'"]+\.aspx['"][\)\.\s]+['"][^'"]+\.txt['"][\)\s;]+__halt_compiler[\(\)\s;]+(?:\?>|\Z)(?<X1228210>))|[=ph\s@]*(?:`[\s\('"\{]*\$_[GPRSC]\w{2,6}\s*\[[^\]]*\]['"\s;\)\}]*`[\s;\}]*(?:\?>|\Z)(?<X1209170>)|eval[\("'\s]+\?>['"][\.\s]+\(\s*base64_decode[\s\(]+(?:\w+[\s\(]+)+['"]https?://[^/]+/\d+\.aspx['"\)\s]+\.\s*['"][^'"\$]+\.txt['"][\s\)]+;[^\?]{0,40}(?:\?>|\Z)(?<X1236940>)|NULL;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][=\s]+['"][^'"]+['"]\s*;\s*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[\s=]+['"][^'"]{99,}['"][\s;@]+eval[\(\s]+htmlspecialchars_decode[\(\s]+gz(?:inflate|uncompress)[\(\s]+base64_decode[\(\s]+['"][^'"]{9,}['"][\s\);]+(?:\?>|\Z)(?<X1227900>))|[=ph\s]*@null\s*;\h*(\$\w+)[=\s]+['"][^'"]+['"]\s*;\s*function\s*(\w+)\s*\([^\n\?]+\beXtRaCt[\s\(]+\56[\s\(]+\55[\s\)]+;\s*(?:\?>|\Z)(?<X1281410>)|[[ph\s]+(\$\w+)=['"]base64_decode['"];(\$GLOBALS)[^\$]{1,29}\58[^;]{1,29};\59[^;]{1,99};if\(md5\(\$_GET\[\59[^\$]{1,29}\59[^=]{1,99}(\$\w+)[^\$]{1,129}\60\(\$_REQUEST[^\]]{1,49}\]\)\);\};\?>(?<X120348291>)|[\sph=@]+file_put_contents[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][,\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s;\)]+(?:\?>|\Z)(?<X1199050>)|[\sph@=]+(/\*[^\*\n]{0,40}\*/)\s*null\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{9,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{9,}['"]\s*;\s*@?eval[\(\s]+strrev[\(\s]+htmlspecialchars_decode[\(\s]+gzinflate[\(\s]+base64_decode[\(\s]+(?:\65|\64)[\s\);]+\63?[\s;\)]*(?:\?>|\Z)(?<X1198441>)|[\sph@]+(?:(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\s=]+['"][^'"]{9,}['"];\s*)+@(?:(?:ini_set|set_time_limit)\s*\([^;]+;[@\s]*)+header\s*\([^\)]+\)\s*;[^\?]+\[['"]REMOTE_ADDR['"]\][\.\s]+['"][^'"]+['"][\);\s]+(?:\?>|\Z)(?<X1208590>)|[ea](?:val|ssert)[\s\(]+base64_decode[\s\(]+file_get_contents[\s\(]+str_rot13[\(\s]+['"]uggc[^'"]{9,}['"][\s\);]+(?:\?>|\Z)(?<X1196790>))|[\sph]*(?:(?:\$\w{1,40}[=\s]+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+)+switch[\s\(]+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*case\s*['"]\d+['":\s]+(\$\w{1,40})[=\s]+@\$_FILES\[[^\]]+\][^\}]+if[\(\s]+(?:move_uploaded_file|copy)[\(\s]+\69\[[^\?\n]{99,499}else\s*\{[^\}]{0,99}\}[\s\}]+(?:exit|die)[^\?]{0,40}\?>(?<X1214990>)|(\$\w{1,40})\s*=\s*['"]aHR\d[^'"]+['"]\s*;[^\{\}!]{0,999}\bif[\(\s]+!\s*empty[\(\s]+\71[\)\s]+\{\s*(\$\w{1,40})[=\s]+\71\s*;\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\w{1,40}[\s\(]+\72\b[^;]+;\s*if\s*\([^;]+\badmin\b[^\{]{0,99}\{[^\}]{0,99}\73\->\w{1,40}\(\);(?<X2204000>)|@(header)[\(\s]+['"]Content[^\)]+\)\s*;[^@]+if[\(\s]+stristr[\(\s]+@file_get_contents[\(\s]+\$\w{1,40}[\s\),]+(\$\w{1,40})\{\d+\}(?:\s*\.\s*\76\{\d+\}[\s\)]*)+[\{;][^<\n]{999,}\b\75[\s\(]+\76\{\d+\}(?:\s*\.\s*\76\{\d+\}[\s\)]*)+;[\s\};]*(?:\?>|\Z)(?<X1204290>)|goto\s*(\w{3,9});\s*\78:\s*if[\s\(]+(file_)exists[\s\('"]+\\x2f\\(?:x74|164)\\x6d\\x70\\(?:57|x2f)\\x2e[^'"]+['"][\s\)\{]+goto[^\}]{0,40}\}[^\(\{\$=]{0,99}\79pu(t_contents)[\s\('"]+\\(?:57|x2f)\\(?:x74|164)(?:\\x6d|155)(?:\\x70|160)[^;'"]+['"][\s,]+\79ge\80[\s\(]+base64_decode[^;]+;[^\?]{0,40}\?>(?<X1203431>)))
<\?(?:[\sph]+(?:(?:if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*)+@?(?:copy|move_uploaded_file)[\s\(]+\$_FILES\s*\[[^;]+;[^\}]{0,199}\}\s*else\s*\{\s*echo[\s'"\(]+<form\b[^;]+</form>['"];[\s\}]+(?:\?>|\Z)(?<X1198004>)|(\$\w{1,40})(?:\h*=\h*str_rot13[\(\s]+['"]ugg[^'"]+['"][\)\s]+;\s*(\$\w{1,40})\h*=\h*curl_init\(\);[^\?]{0,999}curl_setopt[\s\(]+\3[,\s]+CURLOPT_URL[,\s]+\2[\)\s]+;[^\?]{0,999}\b(?:echo|print)[\s'"\(]+curl_exec[\s\(]+\3[\)\s]+;\s*(?:\?>|\Z)(?<X1195530>)|\s*=\s*['"]<\?[\sph]+@?eval[\s\(]+gzinflate[\s\(]+base64_decode[\s\(]+['"][^'"]{99,}['"][\s\)]+;[\?>\s'";]+(\$\w{1,40})[\s=]+['"]H[a@]ck[e3]d\s*by\b[^;]+;(?:\s*\$\w{1,40}[\s=]+fopen[\s\(]+['"][^'"]+\.(?:php|txt)['"][\s,]+['"]w\+?['"][\s\)]+;)+(?:\s*fwrite(?:[\s\(]+\$\w{1,40}[\s,]+(?:\2|\5))[\s\)]+;)+(?:\s*fclose[\(\s]+\$\w{1,40}[\)\s]+;){2}\s*(?:\?>|\Z)(?<X1198330>)|\s*=\s*popen[\s\(]+base64_decode[\s\(]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s,]+['"]r\+?['"\)\s;]+while[\s\(]+!feof[\s\(]+\2[\s\)\{]+(\$\w{1,40})\s*\.=\s*fread[\s\(]+\2[\s,]+1024[\)\s;]+\}\s*echo\b[^;]*\7[^;]*;\s*pclose[\s\(]+\2[\s\)]+;\s*(?:\?>|\Z)(?<X1198750>))|(function)\h*(\w{1,40})\s*\(\)\s*\{\s*\9\s*\w{1,40}\s*\([^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*curl_init\h*\(\)\h*;\s*curl_setopt\s*\(\s*\11\s*,[^,]+,\s*str_rot13[\s\(]+['"]uggc[^;]+;[^\}=]+\$\w{1,40}\h*=\h*curl_exec[\s\(]+\11[\s\)]+;[^\?]{0,999}\b\10\s*\(\s*\)[\s;\}]+(?:\?>|\Z)(?<X1195810>)|\$\w{1,40}(?:\h*=\h*base64_decode[\s\(]+['"][^'"]*['"][\)\s]+;(?:\s*\$\w{1,40}\h*=(?:\h*\$\w{1,40}\{\d+\}\s*\.){3,}\s*\$\w{1,40}\{\d+\}\h*;)+\s*echo[\s\('"]+wp\-[^;]+;[^\?]{9,999}\$\w{1,40}\h*=\h*(\$\{['"][GOBALS\\x471532cf]{9,28}['"]\})[^;:]+:(?:\\?['"]){2};[^\?]{0,999}\13\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1195450>)|\s*=\s*\(\s*["'][^'"]{9,199}['"][\s\)]+;\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+(?:@?(?:gz(?:inflate|uncompress)|base64_decode|urldecode)[\(\s]+){0,5}['"]cmVhZGZpbGUoc3RyX3JvdDEzKCd1Z2d[^'"]+['"][\)\s]+;\s*(?:\?>|\Z)(?<X1196430>))|echo[\s'"]+<meta\s+http\-equiv\s*=\s*['"]refresh['"]\s+content\s*=\s*['"]0;\s*URL\s*=\s*https?://(?:bit|molingvarballheart|xxxconent|allowww)\.(?:ly|cf|biz|com)/(?:\w{1,39}/?\s*){1,2}['"]>['"]\s*;\s*\?>(?<X1202911>)|if[\s\(]+!isset[\s\(]+(\$\w{1,40})[\s\)]+\{(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,99}['"]\s*;){1,3}\s*@eval[\s\(]+gzuncompress[\s\(]+base64_decode[\s\(]+['"]eN[^;'"]{999,}['"][\s\)]+;\s*\17=\d+\s*;\s*\}\s*(?:\?>|\Z)(?<X1198320>))|[^#]{1,999}\$\w+[\s=]+['"]hello\s*world[^'"]{999,}['"];\s*\$\w+[\s=]+preg_split[^\{]+\{\s*\$\w+[\s=]+unpack\(['"]\w\*['"],\s*\$\w+[^#]{1,999}(\$\w+)[\s=]+sys_get_temp_dir\(\)[^;]+\.php['"];\s*\w+\s*\(\w+\(\19[^\}]{1,999}unlink\(\19\);\s*\}\s*\}\);\s*include\s*\19;\s\s*\}\s*\};\s*\$\w+\(\);\s*\}\s*\?>(?<X120351580>)|[^:]{1,99}plugin\s+name:(?:[^:]{1,99}plugin\s+uri:\s+https?://example\.com/[^\}]{1,199}author:\s+your\s+name\b[^@]{1,999}return\s+self::\$\w+(?<X220353120>)|[^\^]{1,999}if\s*\(defined\(['"]\\x41\\x42\\123\\x50\\101\\x54\\x48['"](?<X220353050>))|[^;]{1,99};(?:\s*\$(?:mysite|filename|fromsite)[\s=]+['"](?:https?://[^;]+|\s*['"]);){3}[^@]+?\$(\w{1,40})[\s=]+@?file_get_contents[\s\(]+\$fromsite\b[^@]+?echo\s*\$\23;\s*((?:exit|die)[^;]{0,19};)[\s\}]+else[\s\{]+\$tiaourl\s*=[^\?]{1,999}\24[\s\}]+(?:\?>|\Z)(?<X1195800>)|[^<]{1,999}\{\s*echo\s*<<<(HTML)[^\}]{1,999}\bcasino\b[^'"]+['"]>[^;]+\26;\s*\}\s*\?>(?<X120358351>)|[^=\$\(\{]{0,49}(?:(\$\w+)[\s=]+\(?@?\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*|if\s*\([^;\{]{0,99}(?:\28\b|\$_[GPSRC]\w{2,6}\[)[^\{;]{1,199}\{\s*){2}[^\}]{0,199}\b[peas](?:assthru|ystem|xec|hell_exec|val|ssert)([\s\("]+)(?:@?\w+\29){0,9}\28\b[^;]{1,99};[^\?=\(]{0,99}\b(?:(?:(?:exit|die)[^;]{0,19};|\})\s*){2}(?:\?>|\Z)(?<X1191035>)|[^\$/\*\{]{0,99}\bfwrite\(fopen\(['"][^'"]+\.php['"],[^\)]+\),file_get_contents\(['"]https?://(?<X2216511>)|[^\$=/\*]{0,199}\berror_reporting\(0\);[^\?]{1,499}\bif\(preg_match\(['"](\W)\-\-check\-alive\-\-\32[^\}]{1,99}\bexit\b[^;]{0,19};\}[^@]{999,}\b(stri?pos\()\w+\(\),['"]\-\-jumpshop\-\-['"]\)[^\?]{1,99}\$(\w+)=\$_SERVER\[['"]HTTP_REFERER['"]\];\s*return\s*\((?:\33\$\34,['"]\w+['"]\)\s*\|\|\s*){5}[^;]+;[\s\}]+\?>(?<X1216170>)|[^\$\?\}\+;]{0,299}\b[sape](?:val|ssert|ystem|hell_exec|xec|open|roc_open|assthru)\s*(?:/\*[^\*]{0,4999}\*/\s*)?\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)[\s\(@'"]+){0,5}\$\h*_\h*[GPRSC]\w{2,6}\h*\[[^\]]+\]['";]?\h*\)[^\?]{0,49}(?:\?>|\Z)(?<X10343118>)|[^\$]{1,99}(\$\w+)[\s=]+\w+\(\w+\);\s*\w+\s*\(\37[\s!=]+\w+\(\37\)\)\s*\{\s*\w+\s*\(\w+\(\37\s*(\.\s*['"]/wp\-load\.php['"])\)\)\s*\{\s*(?:include|require)(?:_once)?\(\37\s*\38\);\s*break;\s*\}\s*\37(?<X220357801>)|[^\(]{1,999}persistent\s+backdoor\s*\(http\s+only\)[^\{]{1,999}auto_prepend_file\b(?<X220353760>)|[^\}]{1,99}function\s*\w+\((\$\w+)\)\s*\{\s*(\$\w+)\s*=\s*['"]+;\s*for\s*\([^\}]{1,99}\42\s*\.=\s*chr\(hexdec\(substr\(\41,[^;]+;\s*\w+\s*\42;\s*\}\s*\w+\s*\w+\(\)\s*\{\s*\w+\s*isset\(\$_COOKIE\[(?<X220361900>)|[^\}]{32,199}\$bypass_cookie_name[^\}]{1,999}@?file_get_contents\(['"]http://ip\-api\.com\b[^>]{1,999}header\(['"]location:[^;]+;\s*exit;\s*\}\s*\}\s*\}\s*\}\s*\?>(?<X120356642>)|[ph=\s]*@null;\h*\$\w+\s*=\s*['"]\w+['"]\s*;\h*function(?:[^:]+\binclude(?:_once)?\s*["']zip://)+[^\?>]+\?>(?=\s*<)(?<X1287341>)|[ph=\s]+(?:@?eval[\s\(]+(?:(?:str_rot13|base64_decode|gz(?:inflate|uncompress)[\s\(]+)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\);]+(?:\?>\s*)?\Z(?<X1041911>)|['"]\?>['"][\s\.]+\w+[\s\(]+['"]https?://[^;]+;\s*(?:\?>|\Z)(?<X1198610>))|eval[\s\(]+['"][\?>]{2}['"]\h*\.\h*file_get_contents[\s\('"]+https?://bit\.ly/[^'"]{1,40}['"\)]+;\s*(?:\?>|\Z)(?<X1193910>))|[ph\h]*/\*[^\*\n]{1,40}\*/\h*(\$\w{1,40})\h*=\h*['"](?:['"\h\.base64_dco]{15,40}|[str_o13'"\.\h]{10,40}|[strev'"\.\h]{9,})['"]\h*;[^\?\n]{0,199}?\beval\s*\([^'";]*\49[^;'"]*\(['"][=a-z\d\+/]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1223290>)|[ph\h]+(?:(?:@?echo\h*)?(\$\w{1,40})\h*=\h*['"]https?://xxx\.[^;]{1,199};\h*(\$\w{1,40})[\h=]+(?:['"][file_gtcons]+['"][\h\.]{0,9}){2,};\h*\$\w+[=\h]+\52[\h\(]+\51[\h\)]+;\h*(\$\w+)[\h=]+(?:['"][file_putcons]+['"][\h\.]{0,9}){2,};\h*\53[\(\h]+[^,;]+,\52\h*\);+\h*(?:\?>|\Z)(?<X1192190>)|(?:\$\w{1,40}\h*=\h*@\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*)+switch[\s\(]+\$_[GPRSC]\w{2,6}\[[^;]+case\h*['"][^;]+(\$\w{1,40})[\h=]+\$_FILES\[[^\]]+\];\s*if[\s\(]+\55\[[^\]]+\]\D{2,9}['"]{2}[\s\)]+\{[^\}]+if[\s\(]+@?(?:copy|move_uploaded_file)[\(\s]+\55\[[^\n\?]{99,499}\b(?:exit|die)\b[^;]{0,19};[\h\}]+\?>(?<X1194560>)|(\$\w+)\s*=\s*array\(\s*['"]\w+['"]\s*=>\s*['"][a-z0-9'",\s=>]+\);\s*function\s*\w+[^\?]+\57\);\s*\$\w+[^\?]+hex2bin\(['"]\w+['"]\){2};\s*\$\w+\(\$\w+\);\s*(?:\?>|\Z)(?<X1294180>)|/\*Leafmail\d+\*/\h*goto\h[^@\n]+@\$\w+\h*\([^\?\n]+\bgoto\h+\w+\s*;(?:\s*\w+:)*\s*(?:\?>|\Z)(?<X1286220>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"\(]*[^/]+/(?:\d+|template)\.(?:jpe?g|bmp|ico|txt)['"\)]*;\h*\?>(?<X1204511>))|[ph\s*]+(?:(\$\w+)[\h=]+\[['"]https?://klik\.lol/[^'"]+\.txt['"]=>['"][^\]]+\];\s*foreach[\h\(]+\61\h*as\h*(\$\w+)=>(\$\w+)[\s\)\{]+(\$\w+)[\h=]+(file_)get(_contents)\(\62\);\s*if[\h\(]+\64\W{2,3}[^\{]+\{\65put\66[\h\(]+\63,\h*\64[\s\);\}]+\?>(?<X1265730>)|try\{[^(]+(\$\w+)=['"]file_put_contents[^\(]+sys_get_temp_dir[^\{]+\{\68[^\{]+\{\$\w+[^\$]+\$\w+=serialize\(\$_COOKIE[^\?]{1,999}http?://[^']+\.js['"];\68[^\}]+[^\?]+catch\(\w+\$\w+\)\{\}\?>(?<X1250990>)))
<\?(?:[ph\s=]*(?:(?:\$\w+=['"]\w+['"];){1,19}(\$\w+)=['"]https?://[^;]{1,199};eval\((?:\$\w+\()+file_get_contents\(\1\)+;\s*(?:\?>|\Z)(?<X1229151>)|(\$\w{1,40})(?:[\s=]+['"]\\x[a-f\d]{2}[\\x\da-f]{999,}['"]\s*;\s*(\$\w{1,40})[\s=]+['"]\\x[a-f\d]{2}[\\x\da-f]{9,}['"];\s*@eval[\s\(]+['"][\?>]{2}['"][\.\s]+(?:\4[\s\(]+)+\3[\s\)]+;\s*(?:\?>|\Z)(?<X1224270>)|\s*=\s*['"]\\(?:x?[\da-f]{2,3}\\[\\xa-f\d]{9999,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?[\da-f]{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?[\da-f]{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*@?eval[\s\(]+(?:(?:\3|\6|\7)[\s\(\)]+){3};[\s\?>]*\Z(?<X1221830>)|x[a-f\d]{2}[\\x[a-f\d]{9,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]{9,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"]\s*\.\s*(?:(?:\3|\9)[\s\(\)]+){4,};\s*\?>(?<X1225200>)))|\(?(\$\w+)=\$_[GPCSR]\w{2,6}\[[^\]]+\]\)?\.\11\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:\?>|\Z)(?<X1224410>))|[ph\s=]+(\$\w+)="";\13\.=['"]\w+['"];\13\.=['"]\w+['"];\13\.=['"]\w+['"];\13\.=['"]\w+['"];[^:]{1,499}(\$\w+)\.=['"]\w+['"];\14\.=['"]\w+['"];[^\?]{1,99}eval\(['"]\?>['"]\.\13\(['"]https?://[^'"]+\.php[^'"]+['"]\)\);\?>(?<X120365272>)|[ph\s@]*(?:(?:(?:error_reporting|set_time_limit|ignore_user_abort)[\(\s]+(?:\d+|true|false)[\)\s;@]+){3}\$\w{1,40}\s*=\s*['"]/(?:var/www/|home\d*/)[^'"]+['"]\s*;\s*\$\w{1,40}\s*=\s*base64_decode[\(\s'"]+PD9[^'"]+['"][^\\]{999,}\$\w{1,40}\s*=[^\}]+\btouch\s*\([^;]+;\s*\}\s*(?:\?>|\Z)(?<X2221761>)|(?:(?:set_time_limit|error_reporting)[\(\s]+(?:0|null)[\)\s;@]+)+function\s*(\w+)[\(\s]+(\$\w{1,40})[\)\s\{]+(\$\w{1,40})[@=\s]+curl_init[\(\s]+\18[\)\s;]+curl_setopt[\(\s]+\19[,\s]+CURLO[^\}]+\}\s*(\$\w{1,40})[@=\s]+\17[\s\('"]+https://raw\.gith\w+\.c[^'"]{1,199}['"][\s\);]+echo\s*\20[;\s]+(?:\?>|\Z)(?<X1241410>)|(?:move_uploaded_file|copy)[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][,\s]+basename[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1228220>)|(?:session_start|error_reporting)\s*\([^\?\{'"]{0,199}\b(?:include|unlink\s*\()\s*['"][\.]{1,2}/[^'"]+\.(?:php|txt)[^=]{0,99}bots?\.(?:php|txt)['"]\)?;[^\n\\]{0,399}\bheader[\s\('"]+location\s*:\s*[\w\-]+\.php(?:\?\w+[=\s]+\{\s*\$_SESSION\[[^\]]+\]\s*\})?[^\}]{0,99}(?:exit|die)\b[^\?]{0,150}\?>(?<X2204093>)|(\$\w{1,40})(?:[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if[\(\s]+isset[\(\s]+\24[\)\s\{@]+preg_replace\s*\(\s*.?['"](.).{0,40}\25e\w?.?['"][,\s]+['"][^'"]*['"][,\s]+base64_decode[\(\s]+['"][^'"]*['"][\)\s;\}]+(?:\?>|\Z)(?<X1227390>)|[\s=]+['"][^;]{20,}['"]\s*;(?:\s*\$\w{1,40}[\s=]+\24\s*\[\d+\](?:\s*\.\s*\24\s*\[\d+\])+\s*;)+\s*if[\s\(]+isset[\s\(\$\{]+\24\s*\[\d+\](?:\s*\.\s*\24\s*\[\d+\])+[^\?>]+\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\24\[\d+\][^;]{1,99};[\s\};]*(?:\?>|\Z)(?<X1213540>)|[\s=]+['"][base'"\s\.]{4,9}['"]\s*\.\s*\d+\s*/\s*\d+\s*\.\s*['"][_deco\s'"\.]{4,20};\s*(\$\w{1,40})[\s=]+['"]/['"];\s*(\$\w{1,40})[\s=]+\$_SERVER\s*\[[^\]]+\][\s;]+if[\(\s]+(?:\28|\29)\s*\S{2,3}\s*(?:\28|\29)[\)\s]+\{\s*echo[\(\s]+\24[\(\s]+['"]P[a-z\+/\d]{999,}={0,2}['"][\s\);\}]+(?:\?>|\Z)(?<X1214781>))|(\$_(?:GET|POST|REQUEST|SESSION))\s*\[[^\]]+\][\(\s]+\31\s*\[[^\]]+\][\);\s]+(?:\?>|\Z)(?<X1263830>)|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+/\*\d+\*/\s*(?:chr[\(\s]+\d+\s*\)[\.\s\)]+)+;\s*(?:\?>|\Z)(?<X1229931>)|\beval[\(\s]+['"]\?>['"][\s\.]+file_get_contents[\(\s]+['"]/home\d*/[^/]+/\.cagefs/[^'"]+/\w+['"][\s\);\{\}]+(?:\?>|\Z)(?<X1273960>)|copy[\(\s]+['"]https?://[^'"]+\.txt['"],['"][^'"]+\.php['"][\);\s]*\?>(?<X1278301>)|e(?:rror_reporting(?:[\(\d\);\s]+(\$\w{1,40})\s*=\s*['"]https?://[^'"]+\.php['"];\s*\$\w+\s*=\s*file_get_contents[\(\s]+\36[\);\s@]+eval[\(\s]+['"]\?>['"]\s*\.\s*\$\w+[\);\s]+\?>\s*<div\s*style\h*=\h*['"]display\s*:\s*none["']\s*>(?:\s*<a\h+href[^>]{9,}>[^<>]{1,199}</a>)+\s*</div>(?<X1264280>)|[\(\s]+0[\)\s;]+\$\w{1,40}\s*/\*[^\*]{1,40}\*/\s*=[^\n]{999,2999}\d+(?:\W\d+){9}[^\n]{999,4999}/\*[^\*]{1,40}\*/\s*@\$\w{1,40}[\s\(]+['"][^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1216651>)|[\(\s]+\d+[\)\s;]+(?:\$\w{1,40}\s*=\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}[=\s]+str_replace[\(\s]+array[\(\s]+(base64_decode)[\(\s]+['"][^'"]*['"][^;]+;\s*(\$\w{1,40})[=\s]+\39[\('"\s]+aHR0[^\{\}]{0,999}\{[^\}]*(\$\w{1,40})[^;]+\40\b[^\?\n]{0,499}\becho\s*\41;\s*(?:\?>|\Z)(?<X1203091>)|if[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s\{]+(\$\w{1,40})[=\s]+\43[^\]]+\][\s;]+preg_match_all\s*\([^;]+,\s*\44[\s,]+(\$\w{1,40})(?:[^:]{0,499}(\$\w{1,40})[=\s]+parse_url[\s\('"]+http[^;]+\45\[[^;]+;\s*echo[\s'"]+http[^;]+\46[^;]+;)+(?:[^\}]{0,40}\}){2}\s*(?:\?>|\Z)(?<X1228570>))|[\s\(]+0[\)\s]*;\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*=\s*/\*[^\*]+\*/\s*['"][^'"]{1,40}['"]\s*\.[^\n]{4999,7999}/\*[^\*]+\*/\s*@\$\w{1,40}\s*\(\s*['"][^'"]{999,}["'][\s\)\};]+(?:\?>|\Z)(?<X1216800>)|\b[^;]{0,19};\s*\$\w{1,40}\s*=\s*(base64_decode)[\s\(]+['"]aHR0c[^;]+;\s*(\$\w{1,40})[^,]{9,199}preg\w+[\(\s]+\49[\(\s]+['"][^;,]+,\s*\$_[GPRSC]\w{2,6}\[\s*\49[^\?]{1,999}\bcurl_exec\b[^\?]+\$_[GPRSC]\w{2,6}\[\s*\49[\s\(]+['"][^'"]+['"][\)\s\]]+=+\s*\50\w+[\)\s;]+(?:\?>|\Z)(?<X1202392>)|\s*\(\s*\(\s*int[\s\)]+round[^;]+;[^@\n]{0,9999}@\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\n]+(?:\?>|\Z)(?<X1249240>))|val[\(\s]+openssl_decrypt[\(\s]+(base64_decode)[\(\s]+['"][^'"\$]{99,}['"][\s\)]+,\s*['"]AES\-256\-\w*['"]\s*,\s*\53[\s\(]+['"][^'"\$]{9,}['"][\s\)]+,\s*OPENSSL_RAW_DATA[,\s]+\53[\s\(]+['"][^'"]{1,99}['"][\s\\);]+(?:\?>|\Z)(?<X1240130>))|parse_str[\h(]+[^\)]{99,499}\);[\s@]*eval[\h\(]+(\$\w{1,25})[\[\d\]\h]+[\(\h]+\55[\h\[\d\]]+[\(\h]+\55[\[\d\]\h\(]+['"]WaomRuw/[^'"]{6000,20000}['"][\h\)\.]+['"\h]+//['"\h]+[\h\)]+;\s*(?:\Z|\?>)(?<X1209921>)|require(?:_once)?(?:[\(\s]+ABSPATH)?[\.\s'"/\(]+wp\-(?:includes|admin)[^'"]+\.(?:svg|png|jpe?g|gif)['"\)\s;]+(?:\?>|\Z)(?<X1214770>)|se(?:ssion_start[\(\)\s;@]+(require(?:_once)?)\s*['"]([^\!]{0,20})(\w*)\.php['"][;\s]*\58\s*['"]\59(\w*bots?)\.php['"][;\s]*(\$\w{1,40})[=\s]+new\s*\60[;\s]*(\$\w{1,40})[=\s]+new\s*\61[;\s]*if[\(\s\!]+\62\->checkToken[\(\)\{\s]+echo\s*\63\->throw404[\(\)\s]+;\s*(?:die|exit)\b[^;]{0,19};(?<X2204122>)|t_time_limit[\(\s]+\d+[\)\s;@]+ignore_user_abort[\(\s]+\d+[\)\s;]+\$\w{1,40}[\s=]+['"]%[a-f\d%]{9,}['"]\s*;\s*\$\w{1,40}[=\s]+['"]https?['"]\s*;[^\*]{99,}/\*[^\n\*]{1,40}\*/\s*(?:\?>|\Z)(?<X1231100>))))
<\?(?:[ph\s@]+(?:(?:error_reporting\(0\);\h*)?(\$\w{1,40})[=\h]+array\(@\$\{['"]\\x[^'"]+['"]\}\[[^\]]+\][^;]+;(?:\h*\$\w{1,40}[=\h@]+\1\[\d+\]\([^;]+;)+\h*\1\[\d+\]\D{2,9}\d\D{2,9}die\(\1\[\d+\]\(__FILE__[\s\)]+;[^=;]+\bmd5\(md5\(\$\w{1,40}\[\d+\][\)\s]+==+[^\}]{0,199}@\1\[\d+\]\(['"]{2}\s*,[^\}]{1,60}\}\s*(?:\?>|\Z)(?<X1209631>)|(\$\w{1,40})\s*=\s*(?:\$\s*\{['"]_[GPRC]\w{2,6}["']\}[;\(\s]+(count)\s*\(\s*\3\s*\)[^;]+\bmd5[\(\s]+gettype[\(\s]+\3[\)\.\s]+\4[\(\s]+\3[^:;]+:\s*\3\s*;\s*(\$\w{1,40})\s*=[^;'"]+['"]_[GPRC]\w{2,6}['"][^\?]+\5\s*\[\d+\]\s*\(\s*['"]{2}\s*,[^;]+;\s*(?:die|exit)\b[^;]*;[\s\};]+(?:\?>|\Z)(?<X1204940>)|array\s*\([\)\(\s'",\$base64_dcogzunmprifltv;]{40,99}(\$\w{1,40})\s*=\s*create_function[\s\(]+['"].?['"](?:\s*\.\s*['"][^'"]+['"])*\s*,(?:\s*\3\[\d+\]\s*\.){6,}\s*\3\[\d+\][\s\)]+;\s*\7[\s\(]+['"][a-z\d\+/]{999,}={0,2}['"][\s\);]+(?:\?>|\Z)(?<X1205040>))|(header)\s*\([^\)]+\)[;\s@]+error_reporting\s*\([^;]+;\s*(\$\w{1,40})\s*=\s*['"]%[a-f\d%]{99,}['"]\s*;[^\n]{0,99}(\$\w{1,40})\s*=\s*urldecode[\(\s]+\10[\)\s]+;[^\n\*]{999,}\b\9\s*\(\s*(?:\11\[\d+\]\s*\.\s*){2,}\11\[\d+\][\s\);\]\}]+(?:\?>|\Z)(?<X1202781>)|\$\w{1,40}\s*=\s*['"]\d+['"]\s*;(?:\s*\$\w{1,40}\s*=\s*['"][\\xa-f\d]{9,}['"]\s*;){3,}\s*\$\s*\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\]\s*\(\d+\)\s*;[^\n]{999,}\$\s*\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\]\s*\(\d*\)[\s;\}]+\?>(?<X1204950>)|error_reporting(?:[\(\d\);\s]+(\$\w{1,40})[=\s]+\$\{['"]\\[xa-f\d\\]{1,99}['"]\}[\s;]+if[\s\(]+in_array[\s\(]+gettype[\s\(]+\14[\s\)]+\.\s*count[\s\(]+(?:\$?\{?\14[\s\),\[\]\{\}\.\d\(=;@]+){9,}(?:\?>|\Z)(?<X1197890>)|\s*\((?:0\);\s*(\$\w{1,40})[=\s]+range[\s\(]+chr\(\d+\)(?:[\s,]+chr\s*\(\d+\))+[\s\);]+(\$\w{1,40})[=\s]+\$\{\s*\16\[\d+\](?:[\s\.]+\16\[\d+\])+[\}\s;]+if[\s\(]+in_array[\s\(]+gettype[\s\(]+\17[^;]+\17\[\d+\];\s*\17\[\d+\][=\s]+\17\[\d+\]\(\17\[\d+\][^\>\?]{0,199}\17\s*\(\)[\s;\}]+(?:\?>|\Z)(?<X1218930>)|\s*\([\s\(]*int[\)\s]+roUND[\s\(]+\-?\d+(?:\.\d+)?\s*[\+\-\*/][^\n]{99,}\bexit\b[^;]*;[\}\s;]*(?:\?>|\Z)(?<X1261530>)))|file_put_contents[\(\s]+\$_SERVER\s*\[\s*['"]DOCUMENT_ROOT['"]\s*\]\s*\.\s*['"][/\.]*wp[^'"]+\.php['"][,\s]+base64_decode[\(\s]+['"]PD8[^'"]{1,40}(?:KS5jaHI|LmNocg|Y2hyK)[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1258860>)|include(?:_once)?[\h\('"]+/tmp/sse['"\.]{0,4}ss_\w{32}['"][\h\)]+;\s*if\h*\(\h*class_exists[\h\(]+['"](\w{1,4})['"][\)\s]+\{\s*(\$\w{1,20})\h*=\h*new\h*\21[\(\)\s]{2,};\s*echo[\h\('"]*\22\->exec[\(\)\s]{2,};[\s\};]+(?:\?>|\Z)(?<X1181451>))|[ph\s\(]*(\$\w{1,40})[\s\)]*\[[^\]]+\]\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\?+\s*\d+\s*;\s*if[\(\s]+\24[\)\s]*\[[^\]]+\][\)\s\{]+@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\24[\)\s]*\[[^\]]+\][^:]+;[\s\}]*(?:\?>|\Z)(?<X1237270>)|[ph\s]*(?:(//###==###)\s*(?:@?error_reporting[\(\s]+0[\)\s]+;[^\n>]{99,}\}\s*\26\s*(?:\?>|\Z)(?<X1260970>)|if[\(\s]+(?:!\h*)?(?:isset|empty)[^\n]{99,}\}\s*\26\s*(?:\?>|\Z)(?<X1261090>))|(//[#=]+)\s*error_reporting\(0\);\s*ini_set\([^\.]{1,99}array\(base64_Decode[^#]{999,4999}!empty\(\$_COOKIE\[_\d+\(\d+\)\]\)\)die[^@]{999,4999}@?\$_REQUEST\[_\d+[^#]{1,999}echo\s*\$\w+;\s*\}\s*\29\s*\?>(?<X120344544>)|(?:(?:error_reporting|set_time_limit|ignore_user_abort)\([01]\);){2,}(\$\w+)=fopen\(['"][^'"]+['"],[^;]+;fwrite\(\31,file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+;(?:fclose\((?:\31)\);?)?\s*(?:\?>|\Z)(?<X1229080>)|(?:(\$\w+)[\h=]+\$_SERVER\[[^\]]+\][\h\.]+['"]/wp\-(?:includes|admin|content)[^'"]+['"\h]+;\s*\$\w+[\h=]+http_get[\h\(]+['"]https?://15\.206\.14\.77(?::|/)[^'"]+\.txt['"\h\)]+;[^\{]{0,99}\bif\(file_exists\(\33[\s\)\{]+\}\s*){2,5}\?>(?<X120336660>)|(?:@?(?:error_reporting|ignore_user_abort|sleep)\s*\((?:\d+|true)\)[;\s]+){2,}\$\w+[\s=]+scandir[\s\(]+(base64_decode)[^!\n]+\$\w{1,40}!=+\35[^\?\n\+]{9,999}\$\w{1,40}[\s=]+(?:\35[\s\(]+){2}['"][^'"]{9,}['"][^\n\+]{9,}\$\w{1,40}\+[^\}\n]+\}\s*(\$\w+)[\s=]+basename[^\?\n]{99,}\bunlink\(['"]\36['"\);\s]+\?>(?<X1220981>)|(?:@?(?:error_reporting|set_time_limit|ignore_user_abort)[\s\(]+\d+[\s\)]+;\s*){3}(\w{1,40})[\s\(]+\$_[GPRSC]\w{2,6}[\s\)]+;[^=]{0,99}\$\w{1,40}\s*=\s*['"]https?://\d{1,3}(?:\.\d{1,3}){3}/[^\*\\]{999,19999}\bfunction\s+\38\s*\([^\{\}]{1,40}\{[^\*]{99,9999}\breturn\s*(?:false|true);\s*\}\s*(?:\?>|\Z)(?<X1218660>)|(?:@?(?:set_time_limit|ignore_user_abort)[\(\s]+\d+[\)\s;]+)+(\$\w{1,40})[=\s]+['"][^'"]*['"][\s;]+\$\w{1,40}[=\s]+base64_encode[\(\s@]+\$_SERVER\[['"]HTTP_[^\]]+\][^:]{9,9999}(\$\w{1,40})[=\s]+\40\s*\.[^;]+;[^\?:]+\$\w{1,40}[=\s]+['"]https?://['"][\s\.]+\41[^;]+;[^\?]{99,9999}/\*[^\*]*\*/\s*\?>(?<X1218061>)|(?:@include(?:_once)?\s*base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;\s*)+\$(?:group_num|inter_domain)\h*=\h*['"][^'"]+['"]\h*;[^\+\n]{0,999}\bfunction\s+(\w+)[\(\s]+\$[^\n]{999,}\becho\s+\43\w*[\s\(]+\$\w{1,40}\s*,\s*\$\w{1,40}[\s\)]+;\s*\w+[\(\)\s;]+\}[^\n]*(?:\?>|\Z)(?<X1237380>)|(?:\$\w+[\h=]+['"][gzinflate]['"];\s*){9}(\$\w+)\h*=[^\n]{0,599}\beval\(\45\(\$\w+\(['"][^'"]{99,}['"][\)]+;\s*\?>(?<X1255531>)|(?:\$\w{1,40}[\s=]+['"]\d+['"];\s*)+(?:/[/\*]|@)header\s*\([^\)]+\)\s*;(?:\s*\$\w{1,40}[\s=]+['"]\\x[x\\a-f\d]{9,}['"]\s*;)+\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^\n]{999,}\b(?:exit|die)\b[^;]*;[\}'"\)]+;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1209060>)|(?:\$\w{1,40}\s*=['"][^'"]+['"]\s*;\s*)?\$\w{1,40}[=\s]+["'](?:https?)?:?//[^;\n]{1,99}['"];\s*function\h*(\w+\(\))[\{\s]+\b(?:return\s*)?(?:exit|die)[^;]*;\s*\}[^\n]{999,}\becho\s*\$\w{1,40};\s*\48;\s*\};?\s*(?:\?>|\Z)(?<X1230953>)|(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?\$\w{1,40}[=\s]+["'](?:https?)?:?//[^;\n]{1,99}['"];\s*function\h*\w+[\s\(]+\$\w{1,40}[\s\)\{]+\$\w{1,40}\s*=\s*curl_init\s*\([^\}]+\}[^\n]{999,}\becho\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*else\s*\{\s*\}\s*(?:\?>|\Z)(?<X1231070>)|(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=\s*['"][^'"]+['"]\s*;\s*)+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}\s*=\s*urldecode[\s\(]+['"]%[^;]+;[^\n]{99,}\[\d+\];\h*(?:die|exit)[\(\);\}\s]+\w+[\(\$\{\s]+['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^;]+;\s*(?:\?>|\Z)(?<X2241440>)|(?:echo\h*file_get_contents[\h\('"]+https?://pastebin\.com/raw/\w+['"\)\h]+;\s*){3,10}\?>(?<X120350700>)|(\$\w)[^;]+;\s*\$\w\s*=\s*\w+;\s*\$\w\s*=\s*['"]\w+['"];\s*(\$\w)\s*=\s*\53\.\$\w\.[^;]+;\s*eval\(\54\(file_get_contents\(\'\w\.txt['"]\){3};\s*\?>(?<X1247722>)|(\$\w+)=['"](?:[\w\-/\\]+\.\w+(?:\.\w+)?['"];(\$\w+)=['"]\w?['"];(\$\w+)=['"]https?://(?:\w+\.)?\w+(?:\.\w+)+(?:/\w+)+\.php\?url=['"]\.\56\.[^;]+\57[^;]+;(\$\w+)=curl_init\(\58\);[^\?]+curl_close\(\59\);\?>(?<X1259892>)|[^;]{1,199};\56=\w+\([^;]{0,199}\56\b[^;]{0,199};(\$\w+)=file_get_contents\(['"][^;]{1,199};eval\(\56\(\61\)+;?(?:\?>|\Z)(?<X1234850>)|base64_decode['"];(?:(?:ini_set\(['"](?:(?:log|display)_errors|error_log)['"],|error_reporting\()(?:0|NULL|False)\);|echo\s*['"]<html>\s*</html>['"];){2,6}(\$\w+)=['"]create_function['"];(\$\w+)=\63\(['"]{2},\56\(['"]IGVycm9yX3JlcG9ydGluZygwKTs[^'"]{9999,}['"]\)+;\64\(\);(?:\?>|\Z)(?<X1229891>))|(\$\w+)=\$_(?:[GPCSR]\w{2,6};[^\?\{]{1,99}\{(\$\w+)\[\$\w+\]\.=\66\[[^\?]{1,299}\{(\$\w+)=\67\[\d+\]\((\$\w+),\67\[[^;]+;\67\[\d+\]\(\68,[^;]{0,49}\67\[\d+\]\(\66\[[^;]+;\}(?:includ|requir)e(?:_once)?[\s\("]+\69[\s\)"]+;(?:\?>|\Z)(?<X1231900>)|SERVER\[['"]HTTP_USER_AGENT['"]\];if\(stri?pos\(\66,[^\{;]{1,199}\{(\$\w+)=['"]aHR0c[^'"]+['"];(\$\w+)=base64_decode\(\71\);echo\s*\$\w+\(\72\);\}(?:\?>)?\Z(?<X1232250>))))
<\?[ph\s]*(?:(\$\w{1,40})(?:\s*=\s*['"\h\.str_o13]{17,40};\s*(\$\w{1,40})\s*=\s*['"\h\.base64_dco]{17,40};[^\(]{0,199}\bini_set[\(\s]+['"](?:display_errors|error_log|log_errors)['"][,\s]+0[\s\)]+;[^=]{0,199}eval\s*\([^'";\)]{0,39}(?:\1|\2)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1230020>)|\s*=\s*['"\h\.stro13_]{14,40};\s*(\$\w{1,40})\s*=\s*['"\h\.base64_dco]{17,40};[^\(]{0,99}\berror_reporting[\(\s]+0[\)\s;@]+eval\s*\([^'";\)]{0,39}(?:\1|\4)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1229940>)|\s*=\s*['"](?:(?:[base64_dco\s'"\.]{16,}|[strev'"\.\s]{9,})['"]\s*;[^\+\n]{0,299}\beval\s*\([^'";]{0,199}\1[^'";]{0,199}['"][=a-z/\+\d]{999,}['"][\s\);]+(?:\?>|\Z)(?<X1239150>)|['"\h\.base64_dco]{13,40}['"];\s*(?:(\$\w{1,40})\s*=\s*['"]['"\h\.str_o13]{11,40}['"];\s*@?error_reporting[\(\s]+(?:null|0)[\)\s]+;\s*ini_set[\s\('"]+error_log['",\s]+(?:null|0)[\s\)]+;\s*@?eval[\s\(]+(?:(?:\1|\7)[\s\(]+)+['"][^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1229050>)|@?error_reporting[\(\s]+0[\)\s]+;\s*ini_set[\s\('"]+error_log['",\s]+(?:null|0)[\s\)]+;\s*@?eval[\s\(]+\1[\s\(]+['"]IGVycm9yX3JlcG9ydGluZ[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1229041>))|[^'"\$]+['"]\s*\^\s*(?:pack[\(\s]+['"]H\*['"]|hex2bin)[,\s\(]+['"][a-f\d]{9,}['"][\)\s]+;(?:\s*\$\w{1,40}[=\s]+['"]['"]\s*;)?(?:\s*\$\w{1,40}[\.\s=]+\1[\(\s]+['"][^;]+;){9,}[^,\{\}\.]{0,499}\bpreg_replace(?:\s*/\*[^\*]*\*/)?\s*\((?:\s*/\*[^\*]*\*/)?\s*\1(?:\s*/\*[^\*]*\*/)?\s*\((?:\s*/\*[^\*]*\*/)?\s*['"](?<X2240601>)|ba['"]\s*\.\s*['"]se['"]\s*\.\s*\d+\s*[/%\*\+]\s*\d+\s*\.\s*['"]_['"]\s*\.\s*['"]de['"]\s*\.\s*['"]co['"]\s*\.\s*['"]de['"]\s*;\s*echo\s*\1[\s\('"]+PHAgc3R5bGU9InBvc2l0aW9u[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1215830>))|\s*=\s*\$\{['"][GOBALS\\x4791532cf]{9,28}['"]\};\s*if\(in_array\(gettype\(\1[^\{]{0,40}\{\s*@?\1\[\d+\]\s*=\s*(?:\1\[\d+\]\s*\.?)+;\s*@?\1\[\d+\]\s*=\s*\1\[\d+\][\s\(]+\1\[\d+\][^\?&>\n]{9,999}&&\s*die\((\$\w{1,40})\[[^;]*;[^\n]{9,499}\12\[\d+\]\([^;]+;\s*die\b[^;]*;[\s\}]*(?:\?>|\Z)(?<X1209580>)|\s*=\s*file_get_contents[\(\s]+['"]https?://[^'"]+/backlink\b[^;]+;\s*echo\s*\1;\s*(?:\?>|\Z)(?<X1235551>))|(\$\w{1,8})[=\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][;\s]*if[\(\s]+\15\s*!=\s*['"]\w{32,64}['"][\)\{\s]+(?:die|exit)[^\[]{5,99}(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^%:_\?]{20,199}\bif[\(\s]+\16\s*==+\s*["']\w+['"][^\}]+\bmkdir\s*\([^!%\^&:\?]{20,199}\bif[\(\s]+\16\s*==+\s*["']\w+["'](?<X2254001>)|(\$\w{1,9})\s*=\s*curl_init[\(\)\s]+;\s*curl_setopt[\(\s]+\18\s*,\s*CURLOPT_URL\s*,\s*['"]https?://[^/\$]+/\w+\.php/?['"][\)\s]+;\s*curl_setopt[\(\s]+\18\s*,\s*CURLOPT_RETURNTRA[^;]+;\s*(\$\w)\s*=\s*curl_exec[\(\s]+\18[\)\s]+;\s*curl_close[\(\s]+\18[\)\s;\?><ph]+\becho\s*\19[;\s]*(?:\?>|\Z)(?<X1255350>)|(\$\{['"]GLOBALS['"]\})(\[[^\]]+\])[\h=]+['"]\w+['"];[^\?]{9,399}\bCURLOPT_URL,\h*['"]https?://[^'"]+\.(?:jpe?g|png|txt)['"]\);\s*curl_setopt\(\$\{\21[^;]+;\s*(\$\{\21\[[^\]]+\]\})[\h=]+curl_exec\(\$\{\21\22\}[^\?]{9,99}\beval\(['"\?>\.\h]+\23\);\s*\?>(?<X1266450>)|(\$_\w+)[\h=]+curl_init\((base64_decode)\(['"][^\?\n]{9,150}\beval\(\26\(['"][^\n\?]{9,99}\bcurl_close\(\25\);\h*\?>(?<X1321550>)|(\$GLOBALS\[[^\]]+\])(?:=Array\([^;]+;[^@#]{1,199}(?:\28\[[^\]]+\]\([^;]+;\s*@?){2,}(\$\w+)[\s=]+@?\28\[[^\]]+\]\([^;]+;\s*@?eval[\s\(]+\29[\s\)]+;\s*(?:\?>|\Z)(?<X1216762>)|[\h=]+['"]https?://glot\.io/[^'"]+/\w+\.php['"];[^\?]{99,999}(\$\w{1,40})\s*=[^;]+\28[^;]+;\s*@?eval[\h\('"\?>\.]+\31[\h\)]+;\s*(?:\?>|\Z)(?<X1206971>)|[\h=]+array[\h\(]+base64_decode[^\n]{999,5500}\bif[\h\(]+(round)\([^\)]+\)\W{1,3}\33\([^\)]+[\)\W]+\28\[\d+\]\([^\)]+[\)]+\28\[\d+\]\([^\)]+\);[^\n]{999,5500}\)\28\[\d+\]\(\$\w+,\h*\$_COOKIE\);\s*\?>(?<X1260740>))|(\$group\w{1,40})\s*=\s*['"]\w{1,40}['"]\s*;\s*\$\w{1,40}\s*=\s*['"]http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/*['"][\.\s]+\35[\.\s]+['"][^'"]*['"]\s*;[^\n@]{99,9999}\bif[\(\s]+stristr[\(\s]+@file_get_contents\s*\([^\n]{99,9999}\}\s*else\s*\{\s*\}\s*\?>(?<X1225280>)|(\$on_hot_redirect)[\h=]+true;[^\?]{99,1500}\bif[\h\(]+\37[\h\)]+\{[^\}]{0,199}\bprepare\(\s*['"]SELECT\h*\*\h*FROM[^\?]{99,2200}\bif[\h\(]+empty[\h\(]+\$_COOKIE\[base64_decode\([^#]{9,199}\bfunction\h*\w+[\s\(\)\{]+[^#]{9,299}\bgetElementsByTagName\(\w+[^#]{0,99}\badd_action\([^;]+;(?:\s*\?>)?(?<X120365200>)|(\$pa?s?s?wo?r?ds?)[\s=]+['"][^'"]*['"][^=]{0,99}if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}\39[\)\s\{]+if[\(\s]+(\$_[GPRSC]\w{2,6})[\)\s\{]+(\$\w{1,40})[=\s]+fopen[\(\s]+\40\[[^\}]{0,40}if[\(\s]+fwrite[\(\s]+\41[,\s]+\40\[[^\}]{0,40}echo\s*['"][^'"]*['"][\s;]+(?:else[\s\{]*echo\s*['"][^'"]*['"][;\s\}]+)+(?:\?>|\Z)(?<X1226500>)|(\$var_)\w+=[^;]+;\h*\43\w+=[^;]+;\h*\43\w+=dirname\(__FILE__\)\.(base64_)decode\([^\n\?]{999,3500}\bfwrite\((\43\w+),\44encode\((\43\w+)[\h\)]+;fclose\(\45\);\h*return\h*\46;\h*\}\h*return\h*\w+;\h*\}\h*\?>(?<X1254100>)|(file_)put(_contents)\(\$_[GPRSC]\w{2,6}\[[^\]]+\],\h*\48get\49\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;\s*\?>(?<X120341030>)|(file_put_contents)[\(\s]+['"](\w+\.php\d*)['"][,\s]+['"]<\?[ph\s]*['"][\.\s]+['"][^'"]+['"][,\s]+(FILE_APPEND)[\)\s]+;[^\+]{0,499}['"]\$\w{1,40}\s*=\s*\\?["']e[^'"]{99,}['"][^\?]{9,9999}\?>[^;]+;\s*\51[\s\('"]+\52['"][,\s]+['"][^;]+\53[\s\)]+;[^\?]{0,199}(?:\?>|\Z)(?<X1228441>)|(function)\h*(\w+)(?:[\s\(\)\{]+\$\w+[\h=]+\$_SERVER\[['"]HTTP_[^#]{99,599}\b\55\h*(\w+)[^\{]+\{\s*\$\w+[\h=]+curl_init\(\);[^#]{99,500}(\$\w+)[\h=]+['"]https?://alliancenetworkcompany\.pages\.dev/['"];\s*if[\h\(]+\56[\s\(\)\{]+(\$\w+)[\h=]+\57\(\58\);\s*if[\h\(]+\59[\s\)\{]+echo\h*\59;[^\?]{0,99}\?>(?<X120349010>)|\h*\([^\{]+\{\s*if[\h\(]+preg_match_all[^\n]{0,50}\s*\{\s*\$\w+[\h=]+abs\(crc32\(\$_SERVER\[[^\?]{0,199}\55\h*\w+[\s\(\)\{]+(\$\w+)\[\][\h=]+['"]<a[^>]{0,50}href=['"]\{https?://[^\?]{0,1500}\bforeach\(\61[^\)]+\)\s*(\$\w+)[\.=\h]+\56[^;]+;\s*echo\h*['"]\62</div>\\n['"];\s*\}\s*\?>(?<X120354250>))|(function)\h*(?:(is_bot)[^#]{99,550}\64\h*(\w+)\(\$\w+[\s\)\{]+\$\w+[\h=]+curl_init\(\);[^#]{99,450}(\$\w+)[\h=]+['"]https?://[^'"]+(?:\.txt|\.dev/?)['"];\s*if[\h\(]+\65[\s\(\)\{]+(\$\w+)[\h=]+\66\(\67\);\s*if[\h\(]+\68[\s\)\{]+echo\h*\68;[^\?]{0,99}\bexit;\s*\}\s*\?>(?<X120349443>)|\w+[\h\(]+(\$\w{1,25})[\s\)\{]+return\h*gzinflate[\h\(]+\70[\h\)]+;[\s\}]+\64\h*\w+[\h\(]+(\$\w{1,25})[\s\)\{]+(\$\w{1,25})[\h=]+['"][base64_dco]+['"];\s*(\$\w{1,25})[\h=]+(?:['"]b['"]|\72\[)[^;]+;\s*return\h*\73[\h\(]+\71[\h\)]+;[\s\}]+\?>(?<X1228790>)|curl_get_contents\((\$\w+)\)\{\$\w+=curl_init\(\);[^\{]+\64\h*(?:(getServerCont)\(\75,\$\w+=array[\(\)]+\{\75=str_replace\([^\n]{999,4500}\bmain_shell['"]\][^\n]{99,999}\becho\h*\76\d+\(\$\w+,\$\w+\);[^\{\n]{0,99}\{\h*[^>]{1,99}\b(?:exit|die);(?:\}\s*\w{2}\(\);\})?\s*\?>(?<X1253563>)|getServerCont\(\75,\$\w+=array[\(\)]+\{\75=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+;\h*\}\h*\w+[\(\)\h]+;(?:\h*\$\w+[\h=]+['"]{2};)?\h*\?>(?<X1261541>)|getServerCont\(\75,\$\w+=array[\(\)]+\{\75=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+\h*;\h*\$\w+\h*=['"\h]*\w+['"];\w+\(\)[\s;\}]+(?:\?>|\Z)(?<X1272520>)|getServerCont\(\75,\$\w+=array[\(\)]+\{\75=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+\h*;\s*\w+[\(\)\h]+;[^\}]+\}\s*\?>(?<X1279930>)))|(function)\s*(?:\w+[\(\s]+(\$\w{1,40})[\s=]+['"]['"][\)\s]+\{\s*(\$\w{1,40})[\s=]+['"]\w{1,5}['"][\s;]+\83\s*\.=\s*['"]\w{1,5}['"][^\?\n]{9,199}\82\?[^;]+;[^\+]{9,499}\b(?:\w{1,40}[\s\(]+)+['"][^'"]{999,}['"][^@]{0,999}@eVaL\(\$\w+[^\?]{9,499}\81\s*\w+[\(\s]+(\$\w{1,40})[\)\s\{]+return\s*\84[\};\s]+\?>(?<X1220050>)|\w{1,40}[\(\s]+(\$\w{1,40})(?:[=\s]+['"]['"][\)\s]+\{\s*return\s*explode[\(\s]+['"].['"][,\s]+(\w+)[\(\s]+\86[\.\s]+['"][^'"\$]*['"][\)\s;\}]+\81\s*\87[^/]{9,9999}\}\s*(\w+)\s*\([^;'"]+['"][a-z\d/\+]{999,}['"][^\?@]{0,999}\81\s*\88[\s\(]+(\$\w{1,40})[\s\)@\{]+eval[\s\(]+\89[^\?]{0,199}\?>(?<X1219520>)|\s*=\s*['"]['"][\)\s]+\{\s*(return)\s*explode[\(\s]+['"],['"][,\s]+\w{1,40}[\(\s]+\86[\.\s]+['"][^'"]+['"][\)\s;]+\}\s*\81\s*\w{1,40}[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s\{]+define[^<]{99,9999}<[^=\[]{0,50}(\$\w{1,40})\[[^\]]+\]\s*=[^\?>]{1,499}\b\91\s*\92[^\?]{0,99}\?>(?<X1220501>))))
<\?[ph\s]*(?:(\$\w+)(?:[=\h]+['"]https?://pub\-[^'"]+/css/[^\.]+\.txt['"];\h*(\$\w+)[\=]+(curl_)init\(\1\);[^\?]{0,199}\b\3close\(\2\);\s*\?>(?<X120335720>)|[=\s]+['"][^'"]+['"]\s*\^\s*['"][^'"]+['"];\h*(\$\w+)[=\s]+\$_COOKIE\h*;\h*foreach[\(\s]+\5\s*as\s*(\$\w+)\s*=>\s*\$\w+[\)\h]+\{\h*\5\h*\[\6\][=\h]+\1[\(\h]+[^;]+;\h*\}\h*eval[\h\(]+\5\h*\[[^\]]+\][\)\h]+;\s*(?:\?>|\Z)(?<X1234681>)|[\h=]+'[^']{32,64}';(?:\s*\$\w+[\h=]+(?:\1\[[^\]]+\]\.){3}[^;]+;){2,5}\$\w+[\h=]+"[^"]{999,2500}['"];\s*\?>(?<X1297130>)|[\h=]+(file_)get(_contents)[\h\(]+['"][^'"]+\.txt['"][\h\)]+;\s*(\$\w+)[\h=]+tempnam[^\?]{0,99}\b\9put\10[\h\(]+\11[\h,]+['"<\?ph\.\h]+\1[\h\)]+;\s*include\h*\11;\s*unlink[\h\(]+\11[\h\)]+;\s*\?>(?<X1271210>)|[\h=]+(function)[\s\(\)\{]+(\$\w+)[\h=]+\13[\h\(]+\14[\s\)\{]+(\$\w+)[\h=]+array\(\);\s*\$\w+[\h=]+[^;]+;\s*\$\w+[\h=]+preg_split\(['"]//u['"][\h,]+\14[^:]{0,99}:\s*\$\w+[\h=]+unpack\(['"]C\*['"],[^\?]{9,1800}\barray_push\(\15[^\?]{99,800}\bendif;\s*\};\s*\1\(\);(?:\s*\?>)?(?<X120353921>)|[\h=]+['"][^'"]{15000,38000}['"];\s*class\h*(\w+)\s*\{\s*public\h*static\h*function\h*(\w+)[\h\(]+\1[\s\)\{]+\$\w+[\h=]+base64_decode[\h\(]+\1,[^\?]{99,450}\b(?:\beval[\h\(]+\$\w+[\h\)];\s*\}[^\?]{99,299}\bunpack\(['"]\w+['"],\s*substr[^\?]{99,1500}\b\17::\18[\h\(]+\1[\h\)]+;\s*\Z(?<X220358941>)|eval[\h\(]+\$\w+[\h\)];\s*\}[^\?]{99,299}\bunpack\(['"]\w+['"],\s*substr[^\?]{99,1500}\b\17::\18[\h\(]+\1[\h\)]+;\s*\Z(?<X220360781>))|[\h=]+['"][^'"]{2999,9999}['"];\s*(\$\w+)[\h=]+hex2bin[\h\(]+\1[\h\)];\s*eval[\h\(]+['"]\?>['"][\h\.]+\21[\h\)]+;\s*\?>(?<X1293260>)|[\h=]+['"]base['"];\s*(\$\w+)[\h=]+['"]decode['"];\s*(\$\w+)[\h=]+\1[\h\.]+['"]64_['"][\h\.]+\23;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\24[\h\(]+file_get_contents[\h\(]+['"][^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233570>)|[\h=]+['"]compress\.zlib://[\w\-]+\.gz['"];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\1[\h\)]+;\s*\?>(?<X120366680>)|[\h=]+['"]file_get_contents['"];\s*(\$\w+)[\h=]+['"]https?://cubitpipi\.sbs/[^'"]+\.txt['"];[^\?]{0,99}\becho\h*\1\(\27\);[^\?]{0,59}\?>(?<X120337690>)|[\h=]+['"]https?://(?:(?:\w+\.)?acidpoll\.top/[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\30setopt\(\29[\h,]+\w+[\h,]+\1\);[^;]+;\s*(\$\w+)[\h=]+\30exec\(\29\);[^;]+;\s*eval\(['"]\?>['"][\h\.]+\31\);\s*\?>(?<X1268300>)|[\w\-]+\.pages\.dev/[^'"]+\.txt['"];\s*\$\w+[\h=]+true;\s*function\h*(\w+)\((\$\w+)\)[^\}]{0,99}\bcurl_init\(\34\);[^#]{99,9000}\bif[\h\(]+\w+[\h\(]+\$_SERVER\[[^\{]+\{\s*echo\h*\33[\h\(]+\1[\h\)];\s*exit;\s*\}\s*\?>(?<X120348141>)|pub\-[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(]+\1[\h\)]+;[^\?]{9,199}(\$\w+)[\h=]+\37exec[\h\(]+\36[\h\)]+;\s*\37close[\h\(]+\36[\h\)]+;\s*eval[\h\(]+['"]\?>['"\h\.]+\38[\h\)]+;\s*\?>(?<X1307970>)|raw\.(?:[^/]+/MadExploits/[^'"]+['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\41setopt[\h\(]+\40,[^,]+,\h*\1[^\?]{0,199}\b\41close[\h\(]+\40[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\$\w+[\s\);]+\?>(?<X1235511>)|githubusercontent\.com/(?:iPotacy|angelineuniverse)/[^'"]+['"];[^#]{9,699}(\$\w+)[\h=]+@?(file_)get(_contents)[\h\(]+\1,[^;]+;\s*if[\h\(]+\43[^\{]+\{\s*@?\44put\45[\h\(]+(\$\w+),\h*\43[\h\)]+;\s*@?touch[\h\(]+\46,\h*strtotime[\h\('"]+\-\d+\h*days['"\h\)]+;[\s\}]+\?>(?<X120357590>)))|[\h=]+\$_SERVER\[[^\]]+\];\s*(?:(\$\w+)[\h=]+\1[\h\.]+['"][^'"]+\.php['"];\s*(\$\w+)[\h=]+['"](https?://)[^'"]+\.jpg['"];\s*(\$\w+)[\h=]+\1[\h\.]+['"][^'"]+\.php['"];\s*(\$\w+)[\h\=]+['"]\50[^'"]+\.jpg['"];[^\{]{0,199}\{\s*copy[\h\(]+\49[,\h]+\48[^\{]{0,99}\{\s*copy[\h\(]+\52[,\h]+\51[\)\};\s]+\?>(?<X1237620>)|file_put_contents\(['"]\./\w+\.txt['"],\s*\1[\h\)]+;\s*\?>(?<X1320890>))|[\h=]+\[['"]zip://\w+#\w['"]\];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*implode[\h\(]+['"]{2},\h*\1[\h\)]+;\s*\?>(?<X120347100>)|[\h=]+\[\s*(?:base64_decode\([^\)]+\),\s*){3}[^\]]+\];\s*(\$\w+)[\h=]+\[implode[\h\(]+['"]{2},\h*\1[\h\)\]]+;\s*(\$\w+)[\h=]+function\([^\?]{9,199}(\$\w+)[\h=]+\57[\h\(]+\56[\h\)]+;\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\58;\s*\?>(?<X120359990>)|[\h=]+base64_decode\(['"]aHR0cHM6[^'"]+['"]\);\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\61setopt[\h\(]+\60,[^\)]+\1\);[^\?]{9,99}(\$\w+)[\h=]+\61exec[\h\(]+\60[\h\)]+;\s*\61close[\h\(]+\60[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\62[\h\)];\s*\?>(?<X120349450>)|[\h=]+curl_init[\h\(\)]+;[^\{\?]{0,99}\bcurl_setopt[\h\(]+\1[\h,]+CURLOPT_URL[\h,]+['"]https?://(?:yoast\-schema\-graph|poixo)\.com/[^\{]{0,199}(\$\w+)[\h=]+curl_exec[\h\(]+\1[\h\)]+;[^\?]{0,99}\becho\h*\64;[^\?]{0,49}\?>(?<X1236701>)|[\h=]+file_get_contents(?:[\(\h]+['"]https?://(?:\w+\.)*(?:rtpgalakx100\.xyz|mazimill\.com)/[^'"]+\.txt['"][\h\)]+;\s*\?>\s*<\?=\h*\1;\s*\?>(?<X1279940>)|[\h\('"]+https?://(?:infocakrawala\.online/[^'"]+\.txt['"\)]+;\s*if[\h\(]+\1\h*\W{2,3}\h*false[\s\)\{]+echo\h*\1;\s*\}(?:\s*else\s*\{[^\}]{0,99}\})?\s*\?>(?<X120338400>)|pecel\-lele\.online/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;\s*\?>(?<X120337700>))|[\h\(]+(base64_decode)[\h\(]+[^\)]+[\h\)]+;\h*(\$\w+)[\h=]+json_decode[\h\(]+\1,\h*true[\h\)]+;\h*if[\h\(]+empty[\h\(]+\70[^\{]+\{\h*return;\h*\}\h*foreach[\h\(]+\70[^\{]+\{[^\}]{9,500}\b\69\([^\)]+\)\.\$\w+\.\69\([^\)]+\);\h*\}\s*\?>(?<X1303980>)|[\h\(]+['"]https?://(paste)\.bingner\.com/\72[^'"]+raw['"][\h\)]+;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\1[\h\)]+;\s*\?>(?<X120361660>)|\(['"]https?://pasmarque\.com/[^'"]+\.txt['"]\);\s*echo\h*\1;\s*\?>(?<X120341080>))|[\h=]+function[\h\(]+(\$\w+)[\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\75;[^#]{0,99}\.zip#[^;]+;\s*\1\([^\)]+\);\s*\?>(?<X120366650>)|[\h=]+r?trim\(\$_SERVER\[[^\)]+\);\s*if[\h\(]+\1[^\{]+\{\s*header\(['"]Location:\h*https?://letsmakeparty3\.ga['"]\);\s*exit;\s*\}\s*\?>(?<X120347160>)|[\h=]+str_i?replace[\h\(]+[^\)]{0,50}\$_SERVER\[[^\]]+\][\h\)]+;\s*if[\h\(]+!empty[\h\(]+\1[\h\)]+\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]zip://[^'"]+['"][\h\.]+\1;\s*\?>(?<X1290550>)|[\h=]+urlencode\(\$_SERVER\[[^\]]+\]\);\h*if\(preg_match\(['"]/google/i['"],\1[\h\)]+\{(?:\$\w+[\h=]+[^;]+;\h*){7}[^\n]{0,199}\buseragent=['"]\.\1\);[^\}]{0,50}\s*echo\h*@?\$\w+;\h*\}\s*\?>(?<X1303230>)|\s*=\s*\w+\s*pijacloaker\(\);\s*(\$\w+)\s*=\s*\1\->kontrol\(\);\s*\w+\s*\(\80\[['"]cloak['"]\][^\(]{1,49}(?:include|require)\(['"]btk\.php['"]\);\s*(?:exit|die);\s*\}\s*class\s+pijacloaker\s*\{(?<X220343852>))|(\$\w{1,25})[\h=]+(?:(curl_)init(?:[\(\)]+;\83setopt[\h\(]+\82,[^,]+,\h*['"]https?://pastebin\.com/raw/\w{1,9}['"]\);[^\?]{40,99}\b\83close[\h\(]+\82[\h\)]+;\s*echo\h*\$\w{1,25};\s*\?>(?<X1226670>)|[\h\(\)]+;\s*\83setopt[\h\(]+\82,[^,]+,\h*['"]https?://vivapasarantogel\.com/[^'"]+\.txt['"][\h\)]+;[^\?\}\{=]{0,199}(\$\w{1,25})\s*=\s*\83exec[\h\(]+\82[\h\)]+;\s*\83close[\h\(]+\82[\h\)]+;\s*echo\h*\85;\s*\?>(?<X1228291>)|[\h\(]+['"]https?://raw\.githubusercontent[^/]+/cantikalinda/[^'"]+['"][\h\)]+;[^\?]{9,199}(\$\w{1,25})[\h=]+\(?\83exec[\h\(]+\82[\h\)]+\)?;\s*\83close[\h\(]+\82[\h\)]+;\s*echo\h*\87;\s*\?>(?<X1227810>))|(file_)get(_contents)[\h\(]+['"]https://raw\.githubusercontent\.com/[^/]+/web\Wshell/[^'"]+\.php['"][\h\)]+;\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\{]{0,199}\bif[\h\(]+\89put\90[\h\(]+\91,\h*\82[\h\)]+\{[^\?]{0,199}\?>(?<X1250300>)|['"\.base64_dco]{9,40};\s*(\$\w{1,25})[\h=]+['"\.gzuncompres]{9,40};\s*error_reporting\((?:0|NILL)\);\s*ini_set\([^\)]+\);\s*eval\(\93\(\82\(['"][^'"]{300,3000}\bv77t\+IrxeM99onjv\+3fxLc=['"][\h\)]+;\s*\?>(?<X1226710>)))
<\?[ph\s]*(\$\w{1,40})(?:[=\h@]+urldecode[^;]+;(?:\$\w{1,40}[=\h]+(?:\1\[[\d]+\](?:\.|\;))+\h*){3,}[^\;]+;[^\(\)\n]{0,499}\bfunction\h*\w{1,40}[\(\h]+\$[^#`\n]{999,}\bheader[\(\h]+\$\w{1,40}[^;]*;\h*echo[\h\(]*\$\w{1,40}[^;]*;\h*die[^;]*;[\h\}]+\w{1,40}[\h\(]+\$\w{1,40}[,\h]+\$\w{1,40}[\)\h]+;\s*(?:\?>|\Z)(?<X1208514>)|[=\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s;@]+\1[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1216640>)|[=\s]+<<<EOD\b[^;]{499,}\vEOD;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+gz\w+[\(\s]+\4[\)\s]+;\s*(\$\w{1,40})[=\s]+tempnam\b[^;]+;\s*@?file_put_contents[\(\s]+\6[,\s]+\5[\)\s;@]+include(?:_once)?[\s\(]*\$\w{1,40}[;\s@]+unlink[\(\s]+\6[\)\s;]+(?:\?>|\Z)(?<X1250890>)|[=\s]+@(\$_FILES)\[[^\]]+\][\s;]+if[\(\s]+\1\[[^\]]+\][^'"\w]{1,9}['"][^'"]*['"][\)\s\{]+(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s]+(?:\1|\8)\[[^\]]+\][\s;]+if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+(?:\1|\8)\[[^\]]+\][,\s]+\9[^\}]+\}[\s\}@]*(?:exit|die)\b[^;]*;\s*(?:\?>|\Z)(?<X1237150>)|[=\s]+['"]([^'"\$]+)['"]\s*;\s*\$\w{1,40}[=\s]+class_exists[\(\s]+\1[\)\s]+;[^\{\}\n]{0,99}\bif[\(\s]+!\$\w{1,40}[\)\s]+\{\s*class\s*\11\s*\{\s*private\s*\$\w{1,40}[\s;]+public\s*static\s*\$\w{1,40}\s*=[^\n\?]{999,}\}\s*\$\w{1,40}[=\s]+new\s*\11[\s\(\)]+;[^\?\n]{0,40}(?:\?>|\Z)(?<X1239920>)|[=\s]+['"](\w{1,40})['"]\s*;\s*(\$\w{1,40})[=\s]+class_exists[\(\s]+\1[\)\s]+;\s*(\$\w{1,40})[=\s]+\14\s*;\s*if[\(\s]+!\h*\15[\)\s]+\{\s*class\s*\13\s*\{[^\?]{99,}(\$\w{1,40})[=\s]+new\s*\13[\(\)\s]+;\s*\16[=\s]+(?:NULL|['"]{2}|false)\s*;\s*\}\s*(?:\?>|\Z)(?<X1240690>)|[=\s]+['"]<img\s+src[=\s'"]+data:image/(?:pn|jpe?)g;[^;]{99,}['"]\s*>\s*['"][\s;@]+preg_match[\(\s]+['"]\W<img[^,]+,\s*\1[,\s]+(\$\w{1,40})[\)\s;]+(\$\w{1,40})[=\s]+\18\s*\[\s*\d+[\]\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\19[\)\s;]+(?:\?>|\Z)(?<X1233660>)|[=\s]+['"]['"\h\.base64_dco]{16,40}['"][;\s@]+(?:(?:error_reporting[\s\('"]+(?:null|0)[\s\);]+)+[^=\.\n]{0,199}(\$\w{1,40})[=\s]+['"]['"\h\.creat_funio]{15,40}['"][\s;]+(\$\w{1,40})[=\s]+\21[\s\(]+['"]{2}[,\s]+\1[\s\(]+['"][^'"]+['"][\s\);]+\22[\s\(\);]+(?:\?>|\Z)(?<X1229780>)|(?:ini_set[\s\('"]+(?:error_log|display_errors)['",\s]+(?:null|0)[\s\);]+)+[^=\.\n]{0,199}(\$\w{1,40})[=\s]+['"]['"\h\.creat_funio]{15,40}['"][\s;]+(\$\w{1,40})[=\s]+\24[\s\(]+['"]{2}[,\s]+\1[\s\(]+['"][^'"]+['"][\s\);]+\25[\s\(\);]+(?:\?>|\Z)(?<X1229770>))|[=\s]+['"]['"\h\.base64_dco]{16,40}['"]\s*;\s*(\$\w{1,40})[=\s]+['"]['"\h\.gzuncompresiflate]{13,40};[^\(]{0,99}\berror_reporting[\s\(]+0[\)\s]*;[^\+]{0,499}(\$\w{1,40})[=\s]+\$\w{1,40}[\s\(]+['"]{2}\s*,[^'";]{0,99}(?:(?:\1|\27)[\s\(]+)+['"][^'"]{99,}['"][\s\);@]+\28[\s\(\);]+(?:\?>|\Z)(?<X1229840>)|[=\s]+['"][^'"]{2,9}['"][\s;]+\$\w{1,40}[=\s]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}/?['"][\.\s]+\1[^:]+;\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s\{]+\$\w{1,40}[=\s]+curl_init[\s\(\)]+;[^@]{99,}\?.{0,9}sitemap=[^;]+;[^&]{99,}(?:&&\s*substr|\bstrtolower[\(\s]+isset)[\s\(]+\$_SERV[^>]+Not\s*Found['"\);\s\}]+(?:\?>|\Z)(?<X1217801>)|[=\s]+['"][file_put_cons\s'"\.]{17,99}["']\s*;\s*(\$\w{1,40})[=\s]+['"][file_gt_cons\s'"\.]{17,99}["']\s*;\s*\$\w{1,40}\s*=[^;]+;\s*if[\s\(]+isset[\s\(]+(\$_FILES)\s*\[[^\]]+\][\s\)]+\{\s*\1[\s\(]+\32(?:\s*\[[^\]]+\]){2}[,\s]+\31[\s\(]+\32(?:\s*\[[^\]]+\]){2}[^\?]{9,199}(?:\?>|\Z)(?<X1218960>)|[=\s]+['"]\w+['"](?:[\s\.]+/\*[^\*]*\*/\s*['"]\w+['"])+;\s*\1[\s\(]+\d+[^\(\n]{0,199}ini_set[\s\(]+\1[^!]{0,999}\bif[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+\1[\(\s]+['"][^'"]*['"][\)\s]*!==\s*false[\)\s]+\{[^\?]{0,199}\{\s*(\$\w{1,40})\s*=[chr\(\)\d\.]{999,};\s*echo\s*\34[;\s\}]*(?:\?>|\Z)(?<X1228660>)|[=\s]+['"]https?://(?:['"];\s*\$\w{1,40}[=\s]+\1\s*\.\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\!]{1,99}(\$\w{1,40})[=\s]+urldecode[\(\s]+(?:base64_\w*[\(\s]+)?\$\w{1,40}[\)\s]+;\s*(\$\w{1,40})[=\s]+['"]\?>['"];\s*(\$\w{1,40})[=\s]+(?:(?:\37|\36)[\.\s]*){2,};\s*@?eval[\(\s]+\38[\)\s]+;\s*\?>(?<X1203710>)|[^'"]{9,40}\.txt['"\s;]+(\$\w{1,40})[=\s]+['"](?:[_tfegoclnis'"\.\s]{17,}|[_tnrclui'"\.\s]{9,})['"\s;]+(\$\w{1,40})[=\s]+\40[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+strrev[\(\s]+['"][_tpfeoculnis\s'"]{17,}['"][\)\s;]+\42[\(\s]+['"][^'"]+\.php['",\s]+\41[\)\s;]+(?:\?>|\Z)(?<X1206580>))|[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*(\$\w{1,40})[=\s]+\1\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\1\s*\[[^\]]+\]\s*;\s*if[\(\s]+isset[\(\s]+\44[\)\s@]+\44[\(\s]+\45[\)\s;]+(?:\?>|\Z)(?<X1238860>)|[=\s]+base64_decode(?:[\(\s]+['"][YZcUQR][^'"\$\(\)]+['"][\)\s]+;\s*@?\1[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1234700>)|[\s\(]+['"][^;]+;\s*@?error_reporting[\(\s]+0[\)\s]+;[^\n]{99,}\$\w{1,40}[=\s]+explode[\s\(]+\1\[\d+\][^,;]+,\s*trim[\s\(]+\w+[\s\(]+\$\w{1,40}\s*\.\s*\$\w{1,40}[\s\);]+(?:\?>|\Z)(?<X1259840>)|\s*;\s*(\$\w{1,40})[\s=]+\1[\(\s'"]+YXNzZXJ0['"\)\s;]+\49[\(\s]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1214080>))|[=\s]+curl_init\s*\(\s*\)\s*;\s*curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0cHM6L2xpbm[^'"\n]{9,99}['"][\)\s]+;[^=\?\n]{0,99}\becho\s*curl_exec[\(\s]+\1[\)\s;]+(?:\?>|\Z)(?<X1217680>)|[=\s]+fopen[\(\s]+(base64_decode)[\(\s]+['"][^'"]+['"][\)\s]+[,\s]+\52[\(\s]+['"][^'"]+['"][\)\s;]+(fwrite)[\(\s]+\1[,\s]+\52[\(\s]+['"]PD9[^'"]+['"][\)\s;]+\53[\(\s]+\1[,\s]+\52[\(\s]+['"][^'"]+['"][\)\s;@]+fclose[\(\s]+\1[\)\s]+;\s*(?:\?>|\Z)(?<X1208600>)|[=\s]+function[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]+['"]\s*;\s*\$\w{1,40}[\s=]+\$\w{1,40}\s*\[\s*\d+\s*[\-\*\+/]\s*\d+[^@\*\?]{999,}(\$\w{1,40})[=\s]+\1[\s\(]+\55[\s\);@]+eval[\s\(]+\55[\s\);]+(?:\?>|\Z)(?<X1212380>)|[=\s]+sys_get_temp_dir[\(\)\.\s]+['"][^'"]*['"][\.\s]+(?:(?:md|sha)[5261]+[\(\s]+)+rand[\(\s\d,\)\s;@]+file_put_contents[\(\s]+\1[,\s]+gz\w+[\(\s]+pack[\(\s'"]+H\*['"][,\s]+['"][^'"\n]{999,}['"][\)\s;@]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\{\('"]{1,3}?\1[^\?\n]{0,199}(?:\?>|\Z)(?<X1256070>)|[\s=]+['"](?:\\x?[\da-f]{2,3})+['"]\s*;\s*(?:(\$\w{1,40})[\s=]+['"](?:\\x?[\da-f]{2,3})+['"][\s;]+)+@eval[\s\(]+\1\s*\([^;\)]*file_get_contents[\s\(]+\58[\)\s;]+(?:\?>|\Z)(?<X1227380>)|[\s=]+['"][^'"\$]{1,9}['"]\s*;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\1[,\s]+['"]r['"][\)\s]+;\s*if[\(\s]+\60[\)\s]+\{\s*(\$\w{1,40})[=\s]+fread[\(\s]+\60[,\s]+filesize[\(\s]+\1[\)\s]+;\s*@?eval[\(\s]+base64_decode[\(\s]+\61[\)\s]+;\s*fclose[\(\s]+\60[\)\s;\}]+(?:\?>|\Z)(?<X1230030>)|[\s=]+\$_SERVER\[[^\]]+\][\s;]+(?:\$\w{1,40}[\s=]+\1[\.\s]+['"][^'"]+php['"][;\s]+\$\w{1,40}[\s='"]+http:/[^'"]{4,}\.txt['"\s;]+)+(?:if[\(\s]+!file_exists[\(\s]+(\$\w{1,40})[\)\s\|]+filesize[\(\s]+\63[\)\s<]+\d+[\)\s\{]+unlink[\s\(]+\63[\s\);@]+copy[\s\(]+\$\w{1,40}[,\s]+\63[\s\);\}]+)+\?>(?<X1238090>)|\s*=['"\h\.strev]{11,40};\s*(\$\w{1,40})\s*=['"\h\.base64_dco]{15,40};\s*(\$\w{1,40})\s*=['"\h\.gzuiflatncompres]{15,40}\;\s*error_reporting[\(\s]+0[\)\s]+;\s*@?eval[\s\(]+(?:(?:\1|\65|\66)[\s\(]+){3}['"][^'"]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1228590>)|\s*=[\s\(]*\$_(?:GET|POST|COOKIE|REQUEST)\s*\[[^\]\$]+\][\s\)]*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*\1(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057441>)|\s*=[^;\-\+\(\)]{0,9}\bchr[\(\s]+\d+\s*\-\s*\d[^;]+;\h*(\$\w{1,40})[=\s]+class_exists[\(\s]+\1[\)\s]+;\h*(\$\w{1,40})[=\s]+\69[;\s]+if[\s\(]+!\h*\70[\)\{\s]+class\s*\w+\s*\{[^\n]{99,}\b(?:exit|die)\b[^;]*;(?:\s*\}){3}\s*\$\w{1,40}[=\s]+new\s*\w+[\(\s]+[\)\s]+;[^\}\n]*\}\s*(?:\?>|\Z)(?<X1242291>)|\s*=\s*['"\h\.base64_dco]{17,40};(?:[^\(]{0,199}\bini_set[\(\s]+['"](?:display_errors|error_log|log_errors)['"][,\s]+0[\s\)]+;[^=]{0,199}eval\s*\([^'";\)]{0,39}\1[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1230010>)|[^\(]{0,99}\berror_reporting[\(\s]+0[\)\s;@]+eval\s*\([^'";\)]{0,39}(?:\1)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1229950>)))
<\?[ph\s]*(?:(goto)\h*\w+;\s*\w+:\s*\1\s+\w+[^#]{1,9999}\1[^#]{1,9999}\$_REQUEST[^#]{1,19999}curl_setopt[^@]{1,7999}foreach\(explode[^@]{999,}isset\(\$_REQUEST\[[['"]\w+['"]\]\)\)\{\1[^@]{1,2999}\1[^\?]{1,49}\$\w+\);\?>(?<X120362472>)|(header)\(['"]HTTP/\d+\.\d+\h*\d+\h*Moved[^;]+;\s*\3\(['"]Location:\h*https?://vikramuniv\.net/\?go=[^;]+;\s*exit\(\);\s*\?>(?<X120342910>)|(ob_)start\(\);\s*header\([^\n]{99,1800}=\$_COOKIE\[['"]cloak['"]\][^\n]{99,599}\bsetcookie\(['"]cloak['"],[^\n]{9,499}\bfile_put_contents\(\$\w+[^\?]{0,99}\bexit;[\s\}]+\5end_flush\(\);\s*\?>(?<X120360500>)|/(?:/(###==\s*\d+\s*==###)\s*@?ini_set[\(\s]+['"]display_errors['"][,\s]+(?:false|0)[\)\s]+;\s*@?error_reporting[\(\s]+\d+[\)\s]+;[^\?=\}]{0,499}(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;[^#>]+\becho\s*\8\s*;[\s\}]*//\7\s*(?:\?>|\Z)(?<X1229110>)|\*[\s\*]*Plugin\s*name:[^:]{1,99}Plugin\s*uri[:\s]+https?://example\.com[^:]+:\s*Enhanced\s*security(?<X2286692>)|\*[^\*]+\*/\s*@?error_reporting[\s\(]+0[\)\s]+;\s*/\*[^\*]+\*/\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*=\s*/\*[^\*]+\*/[^\n]{999,9999}@\$\w{1,40}[\s\(]+['"][\da-z\+/]{999,}['"][\s\);]+(?:\?>|\Z)(?<X1221741>)|\*\s*<=====street\s+magic=====>\s*\*/\s*/\*\s*<David\s+Blaine>:[^\$]+(\$GLOBALS\[[^\]]+\])=Array\(base64_decode\([^#]{99,9999}\12\[\d+\]\((?:\$\w{1,40},?)+[\s\)]+;[\s\}]*/\*[^\*]+\*/\s*(?:\?>|\Z)(?<X1222120>)|\*\s*Visit\s+our\s+shop\s+orvx\.pw\b[^/]+\*/\s*@?eval\s*\([^\n]+?\b__halt_compiler[\s\(\)]+;(?<X2200593>))|;;+error_reporting\(0\);\$\w+=str_replace[^;]+;+\$\w+=\(\$\_[GPRSC]\w{1,6}\[[^\n@]{999,}\belse\s*\{\s*(\$\w{1,40})\s*=\s*\$\w+[;\}\s]+return\s*\15[;\s]*\}[;\s]*\?>(?<X2257561>)|@?file_exists\((\$_SERVER\[[^\]]+\])\.['"](/css/[^'"]+\.zip)['"]\)\W{2,3}include\(['"]zip://['"]\.\17\.['"]\18#client['"]\);[^\n]{99,500}(\$\w+)[\h=]+gzinflate\(base64_decode\(['"][^'"]{999,1999}['"][\h\)]+;\h*eval\(\19\);\h*if\(false\)\{[^\}]+\};\s*\?>(?<X120353581>)|@(?:['"]\$\s*\w{1,40}=\s*\w{1,40}=https?://[^'";]{40,}['"]\s*;\s*\$\w+\s*=\s*explode\s*\([^\n]{999,}\}\s*\w+[\(\);\s]*(?:\?>|\Z)(?<X1260650>)|\$_SERVER\[([^\]]+)\][=\s]+\$_SERVER\[\22\]\s*;\s*if[\(\s]+in_array[\(\s]+['"]curl['",\s]+get_loaded_extensions\([\)\s]+\{[^\n\?]{999,}\?['"][\s\.]+urldecode[^\}]+\}\s*else\s*\{\s*header[\("'\s]+Location\s*:\s*https?://[^;]+;\s*\}\s*(?:exit|die)\b[^;]*;\s*\}\s*(?:\?>|\Z)(?<X1232640>)|\s*['"]\s*\$\s*\w{1,40}\s*=\s*\w{1,40}\s*=\s*https?://[^'"]+['"]\s*;\s*\$\w+\s*=[^\n]{99,}\b(?:exit|die)\b[^;]*;(?:\s*\}\s*)+\w+[\(\)\s]+;\s*(?:\?>|\Z)(?<X1261470>)|header[\(\s'"]+Content\-[^\)]+\)\s*;\s*@?error_reporting\(0\)[\s;]+(\$\w{1,40})\s*=\s*['"]%[a-f%\d]{99,9999}[""]\s*;\s*global\s*(\$\w{1,40});\s*\26[\s=]+urldecode\s*\(\s*\25[^\n\*#]{999,}\bheader[\s\(]\26\{\d+\}(?:\s*\.\s*\26\{\d+\})+\s*\)[\s;\}]+(?:\?>|\Z)(?<X1215700>)|include(?:_once)?\s*base64_decode[\(\s]+['"](?:[^'"\$]{9,299}['"][\)\s;]+\$(?:group_num|inter_domain|i[tfn]_do(?:main)?)\d*\s*=\s*['"]{2}[\s;]+\?>(?<X1237930>)|L2hvb[^'"]{9,199}['"][\)\s;]+\?>(?<X1238680>))|ini_set[\(\s'"]+max_execution_time['",\s]+0[\)\s;]+while[\(\s]+True[\)\s\{]+if[\(\s]+!(file_)exists[\(\s'"]+(/home\d*/[^/]+/public_html)['"\)\s\{]+mkdir[\(\s'"]+\31[^=]{0,599}=\s*base64_encode[\s\(]+\30get_contents[\s\('"]+/tmp/\.sessions/\.L2[^'"]+['"][^%]{0,999}['"]%o['",\s]+fileperms[^\?]{0,40}(?:\?>|\Z)(?<X1228730>))|[^#]{0,99}\$_SERVER\[['"]HTTP_REFERER['"]\][^#\&]{99,799}(\$\w+)[\h=]+preg_match\(['"]/['"][^#&\*]{99,700}\bif[\h\(]+\33[\h\|]+\$\w+[\h=]+['"]TR['"][^\{]+\{\s*include\h*['"]wp\-corc\.php['"];\s*exit;\s*\}\s*\?>(?<X1320410>)|[^\?]{2,49}\binclude[\h\(]+['"]zip://(\w+)#\35['"][\h\)]+;\s*\?>(?<X120367630>)|[^\?]{9,199}opcache_reset[\h\(\)]+;[^\?]{1,299}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*__DIR__[\h\.]+['"]/wp\-load\.php['"];\s*wp_cache_flush\(\);[^\?]{1,199}unlink\s*\(\s*__FILE__\s*\);\s*\?>(?<X120360050>)|[^\[]{0,50}(\$\w+)[\h=]+\[['"]compr['"],['",es\.zlib:/vg]+\];\s*require\h*implode\(['"]{2},\h*\38\);\s*\?>(?<X120348850>)|[^\{]{0,99}\b(?:function\h*(\w+)\(\$\w+[\s\)\{]+\$\w+[\h=]+curl_init[^\?]+\bforeach\(\40\(base64_decode\(['"]aHR0cDov[^'"]{1,99}['"]\)\)\s*\w+\s*(\$\w+)\)\s*\{\s*eval\(['"]\?>['"]\.\41\);\s*\}\s*\?>(?<X220342401>)|if[\h\(]+isset[\h\(]+\$_GET\[[^\{]+\{\s*phpinfo\(\);[^\}]{0,99}\}\s*\?>(?<X120337140>))|[^\{]{0,99}class\h*(\w+)[\s\{]+static\h*function\h*(\w+)[\s\(\)|{]+(\$\w+)[\h=]+['"]compress\.zlib://[\w\-]+\.gz['"];\s*return\h*\46;[^\?]{0,199}\b\44::\45[\h\(\)]+;\s*\?>(?<X120360560>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]compress\.zlib://zj\d+\.gz['"];\s*\?>(?<X120341720>))
<\?[ph\s]*\$(?:(?:group_num|inter_?domain\d*|it_domain|i[ftn]_do)[=\h]+['"][^'"]+['"]\h*;[^,\n]{0,999}\bcurl_setopt[\s\(]+\$\w+\s*,[^\n]{999,}(?:\?>|\Z)(?<X1236418>)|(?:group_num|inter_domain|i[tfn]_do(?:main)?)\d*\s*=\s*['"][^'"]+['"]\s*;\s*if[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+['"]\.php['"\)\s]+\{\s*\$main_shel\w+\s*=\s*\$\w{1,40}\s*\.[^\n>]{99,9999}\bgetServerCont\d*[\(\s]+\$\w+[,\s]+\$\w+[\)\s;]+\}\s*else\s*\{\s*\}\s*\?>(?<X1237950>)|(GLOBAL)S\[['"](\w+)['"]\];\3(\$\4);\$\4=\$\3s;\5\[[^\]]+\]=['"]\\x[a-f\d\\x]{99,9999}['"];\5\[\5\[[^\]]+\]\[\d+\]\.\5\[[^\?\n]{99,}if[\s\(]+(\$\w{1,40})\[\5\[[^\]]+\]\[\d+\]\][^\s\w;]{2,3}\5\[[^\]]+\]\[\d+\][\s\(\)\{\};]+eval[\s\(]+\6\[\5\[[^\]]+\][^;]*;[\s\}]+(?:exit|die)\b[^;]{0,40};[\s\}]*\?>(?<X1217500>)|[o0]{1,9}[=\s]+['"]\w{1,9}['"];\s*\$goweb=['"]{2};\s*if[\(\s]+is_https\s*\(\)\s*\)\s*\{\s*\$\w+\[['"]http['"]\][=\s]+['"]https['"];\s*\}\s*else\s*\{\s*\$\w+\[['"]http['"]\][=\s]+['"]http['"];\s*\}\s*(?:\?>|\Z)(?<X1216930>)|[o0_]{1,40}[\s=]+@?urldecode[\(\s]+['"]%[a-f\d%]{99,}['"](?:[\s\);]+\$[o0_]{1,40}[\s=]+\$[o0_]{1,40}\{\d+\}\.\$[^\n<]{999,}@\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\$[o0_]{1,40}[,\s]+\$[o0_]{1,40}[\s\);]+\}['"\)\s;]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\([01][\);\s]+(?:\?>|\Z)(?<X1232710>)|[\s\)]+;[^\n<]{999,}@\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\$[o0_]{1,40}[,\s]+\$[o0_]{1,40}[\s\);]+\}['"\)\s]+;\h*@?\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\([01][\);\s]+(?:\?>|\Z)(?<X1232480>))|\w+=['"][^;]+;\$\w+=['"]http['"];if\(is_https\(\)[^@]{499,1999}(\$\w+)=(\w{1,4}outdo\(\$)[^\}]{1,199}=str_i?replace\(['"]ok(?:ht|x)mlget(content)['"],['"]{2},\11\);echo\s*\11;(?:exit|die)\b[^;]{0,19};[^@]{499,1999}\bfunction\s+\12(\w+)\)\{[^\?/]{0,499}(\$\w+)=file_get_\13s\(\$\14\)[^\?]{1,199}\breturn\s*\15[;\}\s]+(?:\?>|\Z)(?<X1232030>)|\w+=function[^\n]{999,7000}=\w+\(['"]https?://hello\.[^'"]+/[^'"/]+\.txt['"][^@]{1,1999}=stri?_replace\(['"](?:okhtmlgetcontent|getcontent\d+page)['"],['"]{2},(\$\w+)\);echo\s*\17;(?:exit|die)\b[^;]{0,19};[^\n]{999,2000}\bLocation:\h*['"\.]+\17[^\?]{99,900}\breturn\h*\$\w+;\s*\}\s*\?>(?<X1204493>)|\w+[=\s]+['"]https?://\d+\.\d+\.\d+\.\d+/\w+/?['"]\s*;\s*function\s*(\w+)[\(\)\s]+\{\s*(?:exit|die)\b[^;]{0,40};\s*\}[^\n\*]{999,}\becho\s*\$\w+\s*;\s*\19[\s\(\)]+;[\s\};]*(?:\?>|\Z)(?<X1229651>)|\w+[\h=]+['"](https?://[^'"]+\.txt)['"];[^\{]{0,99}\{\s*(\$\w+)[\h=]+['"]\21['"];\s*\$\w+[\h=]+@?file_get_contents[\h\(]+\22[\h\)]+;[^\}]{0,99}(\$\w+)[\h=]+implode\([^;]+;\s*echo\h*\23;\s*\}\s*\?>(?<X120351530>)|\w+[\h=]+['"]https://tahu\-isi\.store/[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);[^\{]{0,299}(\$\w+)[\h=]+\26exec\(\25\)[^\{]{0,99}\{\s*echo\h*\27;\s*\}\s*\?>(?<X120336380>)|\w+[\h=]+[\h\(]+(\w+)[\h\(]+[^&@]{99,1999}=\s*\29\([^\.]{1,32}/\w+\.\w+\.mod/\w+\.ihpp['"]\);\w.{1,999}\29\(['"]abes46e_cndoe\b[^&@]{99,3500}\bfunction\h*\29[\h\(]+(\$\w+)[\h\)]+[^\?]{0,350}=\h*\30;\h*\}\h*return\h*\$\w+;\h*\}\h*\?>(?<X1310851>)|\w+[\h=]+\$_SERVER\[['"]HTTP_[^><]{99,299}(\$\w+)[\h=]+['"](HTTPS?://giris\-casibom\.org)/[^<]{9,299}\bfile_get_contents\(\32,[^%#]{99,350}\bheader\(['"]Location:\h*\33/['"][^\;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X120337810>)|\w+\s*=\s*(?:chr|['"]\\|['"]\w)[^\{\}]{99,399}\{\s*function\h*\w+[\(\)\h]+\{\s*return[^\{]{0,99}\bclass\h*(\w+)\s*\{\s*(?:public|private)[^\n]{9,699}\b_POST;\h*\$\w+[\h=]+\$_COOKIE;\h*\$\w+[^\n]{9,1599}\bnew\h*\35[\(\d\)\h]+;[^\}]+\}\s*\?>(?<X1256855>)|\w{1,19}\s*=\s*['"]f[^'"]{1,9}['"][\s;]+\$\w{1,40}\s*=\s*['"]https?://[^'"]{1,40}\.(?:top|xyz|ga)['"][\s;]+function\s*?\w{0,9}(get_content)s[\(\s]+\$\w{1,40}[\)\s]+\{[^\*\\]{999,}\becho\s*\$\w{0,9}\37s?[;\s@]+(?:exit|die)\b[^;]{0,19};[\s\}]+else\s*\{\s*@?header\b[^;]*Not\s*Found['"\)\s;\}]+\?>(?<X1208030>)|\w{1,25}[\h=]+['"](?:error_reporting|display_errors)['"];[^\?]{99,399}\bif[\h\(]+\$\w{1,25}\h*\D{2,3}[^\{]+\{\s*(\$\w{1,25})[\h=]+['"]\h*<(script)[^>]{0,99}\bsrc[\h=]+['"]https?:\s*//track\.violetlovelines\.com/[^>]{0,99}></\40>\h*['"];\s*echo\h*\39;\s*\}\s*\?>(?<X1227840>)|\w{1,2}[\h=]+['"]error_reporting['"];\$\w{1,2}[\h=]+['"][^'"\$]{9,}['"];\$\w{1,2}[\h=]+['"]base64_encode['"];\$\w{1,2}[\h=]+['"]base64_decode['"];\$\w{1,2}[\h=]+['"]convert_uuencode['"];\$\w{1,2}[\h=]+['"]convert_uudecode['"];[a-z\d=\$;'"\+/\h]{99,999}\?>(?<X1237851>)|\w{1,40}=\w{1,40}\([^;]{1,40};;+error_reporting\(0\);+\$\w+=\(((\$\_[GPRSC]\w{1,6}\[)[^\]]+\])\!=['"]+\&+\43\!=['"]off['"]\)\|+\44[^|]+\|+\44[^/]+https://['"]:['"]http://['"];[^@]{1,250};\$\w+=(str_replace)[^;]+;+(\$\w+)=\45[^@]{1,3200}(\$\w+)=\46[^\n]{99,9999}\btouch\(\47,strtotime[^>\?]+\?>(?<X2257554>)|\w{1,40}[=\h]+['"][zfd]\w{1,9}['"]\h*;\h*@set_time_limit[^/=\n:]{0,499}\bdefine[^;]+;\h*define\(['"](\w+)[^;]+;\h*function[\s\w\(]+(\$\w{1,40})[\)\s]+\{return\h*@\$_[GPRSC]\w{2,6}\[\50\][^%\n@]{1,3500}\bif[\(\s]+strpos[\(\s]+\49[^\n]{9,9999}\b(?:die|exit)[\(\s]+\$\w{1,40}[^>\?\n]+(?:\?>|\Z)(?<X1239211>)|\w{1,40}[=\s'"]+https?://(?:\d{1,3}(?:\.\d{1,3}){3}|z\d)[^'"]*['"][;\s]+(?:\$\w{1,40}[=\s]+['"]['"\s;]+)?function\s*\w+[\(\s]+\$\w{1,40}[\)\h\{]+\$\w{1,40}[=\s]+curl_init[^>\n]{9,}if[\(\s]+strpos[\s\(]+\$\w+[,\s'"]+\.ph[^\n]{99,}echo\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^\?]*\?>(?<X1242282>)|\w{1,40}[=\s]+explode[\(\s]+(base64_decode)[\(\s]+['"]Pz4=['"][@\),\s]+file_get_contents[\(\s]+__FILE__[\)\s;]+(\$\w{1,40})[=\s]+array[\(\s]+\53\s*\([^\?\n]{1,999}\bpreg_replace[\(\s]+\54\s*\[\d+\][,\s]+serialize[\(\s]+eval[\(\s]+\54\s*\[\d+\][\),\s]+\54\s*\[\d+\][\)\s@;]+(?:exit|die)\b[^;]*;\s*\?>(?<X1280670>)|\w{1,40}[=\s]+file_get_contents[\(\s'"]+http://\d{1,3}(?:\.\d{1,3}){3}/[^'"]+['"][\)\s;]+(\$\w{1,40})[=\s]+['"][^'"\$]+['"][^>]{9,999}(function)\s*\w+[\(\s]+(\$\w{1,40})[\)\s]+\{[^\(\)]{0,99}if[\(\s]+\57_exists[\(\s'"]+exec['"\)\s\{@]+exec[\s\(]+\58[^\?]+sleep[^=\?]{0,99}unlink[^;]+\56[^\?]{0,99}\?>(?<X1222780>)|\w{1,40}[\s=]+['"]\w{1,5}\d+['"][\s;]+\$\w{1,40}[\s=]+['"]http[^'"]+['"][\s;]+function\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init\(\);(?:[^\*]{0,9999}\bif[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+['"](?:\.php|map|\.xml)['"][\s\)]+>)+[^>]{0,9999}\becho\s*\$\w{1,40};[^\?=]{0,40}\?>(?<X1203140>)|\w{1,40}\[['"][\\x\da-f]{9,}['"]\][\s=]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\\?['"]aHR0c[^;]+;\s*if[\(\s]+isset[\(\s]+\$\{[^;/]+/index\.php[^\n\?]{9,9999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\)[\s;]*(?:\?>|\Z)(?<X1236905>)|\w{1,40}\s*=\s*['"]http(?:://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/(?:[^'"]*['"]\s*;[^\{\}]{0,199}\bfunction\s*(\w{1,40})\s*\([\s\)\{]+(?:exit|die)\b[^\}]*\}[^\n]{999,}\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*\62[\(\s]+[\)\s;\}]+(?:\?>|\Z)(?<X1240610>)|[^'"]+['"]\s*;\s*(function)\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\}]+\}\s*\64\s+(\w+)\s*\([^\n\*]{99,}\becho\s+\65\s*\([^;]+;\s*@?(?:exit|die)\b[^;]*;\s*\}\s*\?>(?<X1231190>))|s?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^'"]+/['"]\s*;\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\n]{999,}echo\s*\$\w+;[^\}]{0,40}\}\s*define[\(\s]+['"]WP_USE_THEMES['"][,\s]+true[\)\s]+;\s*(?:\?>|\Z)(?<X1231060>))|\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\s=]+['"][\\xa-f\d]{6,199}['"][\s;]+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}[^\}]+\}[\s=]+['"][^'"]{499,}['"]\s*;\s*@?eval[\s\(]+htmlspecialchars_decode[\s\(]+gz(?:inflate|uncompress)[\s\(]+base64_decode[\s\(]+["'][^'"]{99,999}['"][\s\);]+(?:\?>|\Z)(?<X1222190>)|password=['"][^;]+;[^\?]{1,499},CURLOPT_URL,(?:base64_decode\(['"]aHR0c|https?:)[^\?@#:&]{1,499}?(\$[^=;\(\)]{1,199})=curl_exec\([^\?]{1,499}\beval\((?:base64_decode\(['"]Pz4=*['"]\)|['"]\?>['"])\.(?:\69|[\$\{'"]*GLOBALS['"\[])[^;]+;\s*(?:\?>|\Z)(?<X1227140>))
<\?[ph\s]*(?:\/\*\h*C2_SIGNATURE:[^\?]{0,99}\berror_reporting\([^\n]{99,2000}\bexit\(['"]##okresponse##['"]\);\}\h*(\$\w+)[\h=]+['"]https?://(?:\w+\.)?aihack\.top/api/proxy/[^'"]+['"];\h*(\$\w+)[\h=]+\w+\(\1\);[^\n]{99,999}\bexit\(\2\);[\h\}]+echo\h*\2;\h*\}\h*\w+\(\);\s*\?>(?<X120353570>)|\b(?:(?:diE|exit)[\(\s]+REQUiRe\176RAWUrLDEcODe[\(\s]+['"]%[^;\)'"]{40,}['"][\)\s]+\.\s*__File__\s*\.\s*['"]/['"]\s*\.\s*\176\s*['"][^'"]+['"][\s\);]+__HALT_COMPILER[\(\);\s]*\?>(?<X2253240>)|define[\(\s]+['"]\w['"]\s*,\s*['"][^'"]+['"][\s\)]+;\s*goto\s+\w+;[^\n\\]{0,9999}\bpreg_match[\(\s]+['"]\\[^\n\?]+\?\s*\$_SERVER\s*\[[^\n\*]{9,}\bgoto\s*\w+\s*;\s*\w+:\s*\w+[\(\)\s;]+(?:\?>|\Z)(?<X1284150>)|error_reporting(?:\(0\);\s*(\$\w+)[\h=]+['"]https?://[^'"]+/raw[^;]{1,29}['"];[^\$]{0,99}(\$\w+)[\h=]+(curl_)init\(\6\);[^\?]{9,399}(\$\w+)[\h=]+\8exec\(\7\);[^\?]{99,399}\bisset\(\$_COOKIE\[[^\{]+\{echo\h*\9;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X120343330>)|\s*\(\d+\);\s*(\$\w{1,40})[=\s]+['"]range['"];\s*\$\w{1,40}[=\s]+\11[\s\(]+['"]\176['"],['"]\s+['"]\);\s*\$\w{1,40}[=\s]+[^:]{99,700}:(?:[^>]{99,1000}>)?[^>]{99,1500}>0[^>]{99,9999}\);\s*(?:\?>|\Z)(?<X1271202>))|function\s*(\w+)[\s\(]+\$\w+[\s\)\{]+if[\h\(]+function_exists\(['"](\w+)['"][\s\)\{]+\$\w+[\h=]+\14\(\);[^\?]{1,900}\becho\s*\13[\h\(]+['"]https://justikail\.github\.io/dumb\.js['"]\);\s*\?>(?<X1304610>)|goto\s+\w+\s*;\s*\w+\s*:\s*(?:exit|die)\b[^;]*;[^\n@]{99,}@file_put_contents[\(\s]+['"][^\n\?]{99,}\bgoto\h+\w+;(?:\h*\w+:)+\s*(?:\?>|\Z)(?<X1273560>)|header\(['"]Location:\s*https?://t\.me/\w+_bot['"]\);\s*exit;\s*\?>(?<X120367061>))|\s*(\$\w+)[\h=]+['"][^'"]+['"];\s*(\$\w+)[=\h]+['"]\d*['"];\s*(\$\w+)[\h=]+['"]https?://kod\.themelicense\.net/[^\?]+\.php\?url=['"\.]+\18[\.'"]+&type[='"\.]+\19[\.'"]+;\s*(\$\w+)[\h=]+curl_init[\h\(]+\20[\h\)]+;[^\?]{0,499}\bcurl_close[\h\(]+\21[\h\)]+;\s*\?>(?<X1258030>)|add_action[\h\('"]+\w+['"],\h*function[\s\(\)\{]+if[^\{]+\{\s*echo\h*['"]<a\h*href=['"]https?://[^>]{9,99}\bleft:\h*\-\d{3,6}px;[^\?]{9,700}\bleft:\h*\-\d{3,6}px;['"]>[^;]+;[\s\}\)]+;\s*\?>(?<X120367370>)|c(?:lass\h*(?:(\w+)[\h\{]+function[^\n]{999,2000}\bconf\((\$\w+)(\->path)\);\h*return\h*\25\26;[^\n]{99,999}\b(?:var\h*\$\w+[\h=]+array\([^\)]+\);\h*){3,5}var\h*\$\w+[\h=]+['"][^'"]{15000,30000}['"];\h*var\h*\$\w+[\h=]+['"][^'"]{199,1500}['"];\h*\}\s*new\h*\24\(\);\s*\?>(?<X120346500>)|\w[\h\{]+var\h*(\$\w+)[\h=]+['"]demo['"];[^\{]+\{\s*\$\w+[\h=]+['"]\-*BEGIN\h*PUBLIC\h*KEY[^\?]{99,499}\becho\h*['"]hello\h*thai['"];[^\}]{0,199}\}\s*eval[\h\(]+\28[\h\)\};]+\$[^\}]+\}['"];\s*unserialize[\h\(]+\$\w+[\h\)]+;\s*\?>(?<X1305770>))|opy\(['"]https?://[^'"]+\.txt['"],['"][^'"]+\.php['"]\);?\?>(?<X1228970>))|de(?:clare[\h\(]+strict_[^\)]+\);\h*if[\h\(!]+function_exists[\h\(]+['"]str_contains['"][^\?\n]{99,800}\bdefine[\h\(]+['"]__(?:DLOADER_ACTIVE__['"],\h*true[\h\)]+;[\s\}]+\$\w+[\h=]+['"]DLOADER_SIG_V\d+['"];\s*const\b(?<X220366850>)|WP_CACHE_INIT__['"],\h*true[\h\)]+;\s*\}\s*if[\h\(!]+isset[\h\(]+\$GLOBALS\[['"](__ldr_sig)['"]\][\s\)]+\$\32[\h=]+['"]CSEC_MODULE_V2\b(?<X220369730>))|fine[\h\(]+['"]A['"],[^#]{99,350}(\$\w+)[\h=]+['"]{2};\s*\$\w+[\h=]+curl_init\(\);[^\?]{9,399}\beval[\h\(]+['"]\?>['"][\s\.]+\34[\s\)]+;\s*\?>(?<X120368900>))|echo(?:\b[^;]{0,40}<form\b[^;]+;\s*@(?:copy|move_uploaded_file)[\(\s]+(\$_FILES)\[[^\]]+\]\s*\[[^\]]+\][,\s]+\36\[[^\]]+\]\s*\[[^\]]+\][\)\s]+;(?:\s*echo\b[^;]+;)?\s*(?:\?>|\Z)(?<X1228200>)|\h*['"](?:<!DOCTYPE\b[^\^]{99,999}\bisset\(\$_GET\[['"](?:del|rename|edit|read)['"][\h\]\)]+\{[^\^]{999,3500}\bempty\((\$_POST\[['"]cmd['"])[\]\h\)\{]+[^\}]{9,150}\b[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\38\][^\?]{9,99}\becho\h*['"]</pre></body></html>['"];\s*\?>(?<X120336030>)|vulnn?['"];[^\?]{9,99}<title>Caterscam[^<]+</title>[^\^]{999,2500}\becho\h*move_uploaded_file\(\$\w+\[['"]tmp_name['"]\],[^\^]{999,3000}\bsystem\(\$_POST\[['"]cmd['"]\]\);\s*echo[^;]+;\s*\}\s*echo\h*['"][^'"]+</html>['"];\s*\?>(?<X120360900>))|\h*file_get_contents[\h\(]+['"]http(?:s://[^'"]+\blinks\.txt['"][\h\)]+;\s*\?>(?<X1230540>)|s?://[^/]+/wp\-(?:includes|content|admin)/[^\.'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233591>)|s?://[^/]+\.jepara\.go\.id/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233860>)|s?://animenews\.biz/[^'"]{0,99}\.txt['"][\h\)]+;\s*\?>(?<X1237090>)|s?://bcklink\.xyz/[^'"]+\.php['"][\h\)]+;\s*\?>(?<X1227800>)|s?://ja\-panik\.[^/]+/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1223670>)|s?://qris\-pwn\.pages\.dev/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X120351671>)|s?://vwm88\.com/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1234230>))|\s*(?:@?eval[\(\s'"]*\\(?:77\\x3e["']\s*\.\s*@?file_get_contents[\s\('"]+\\150\\x74\\x74\\160\\x73[^'"]{9,199}['"][\s\);]+(?:\?>|\Z)(?<X1223740>)|x3f\\76["']\s*\.\s*@?file_get_contents[\s\('"]+\\x68\\164\\164\\160\\x73[^'"]{9,199}['"][\s\);]+(?:\?>|\Z)(?<X1223730>))|['"]<form\b[^;]+['"]\s*;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*['"][^'"]*['"][\)\s]+\{\s*echo[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\?[^;:]+:[^;:\?]+;\s*\}\s*(?:\?>|\Z)(?<X1217480>)|['"][^'"]*['"]\s*\.\s*php_uname\s*\(\s*\)\s*\.\s*['"][^'"]*['"]\s*\?>\s*<form action\s*=\s*['"]\?[^\?]+<\?[ph\s]*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\?>[^=]{0,999}\beval[\(\s]+(?:\w+[\(\s]+)+['"][^'"]{99,}['"][\s\)]+;\s*\?>\s*<\?[ph\s]*\}\s*\?>(?<X2228120>)|['"][^'"]{0,12}['"]\s*;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+['"]class[^'"]*\.php['"][,\s]+['"]w['"][\)\s@;]+fwrite[\(\s]+\53[,\s]+base64_decode[\(\s]+['"]PD9[a-z\d\+/]{999,}={0,2}['"][\)\s]+;\s*fclose[\(\s]+\53[\)\s;\}]+(?:\?>|\Z)(?<X1213640>)|file_get_contents(?:[\(\s]+['"]https?://[^'"/]+/\.well-known/[^'"\$]+\.txt['"][\)\s;]+(?:\?>|\Z)(?<X1238210>)|[\h\(]+['"]https?://(?:\w+\.)?menyalaabangkuh\.xyz/\w+\.txt['"\h\)]+;\s*\?>(?<X1257700>)|[\s\(]+['"]https?://[^'"]+/links?\d*\.txt['"][\s\)]+;\s*(?:\?>\s*)?\Z(?<X1230200>)|\(['"]https?://(?:raw|user\-images)\.githubusercontent\.com/[^\)]+\);?(?:\?>|\Z)(?<X1233870>)))))
<\?[ph\s]*error_reporting(?:[\(\s]+\d+[\)\s;]+foreach[\(\s]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}\s*=>\s*(\$\w{1,40})[\)\s]+\{\s*\$_[GPRSC]\w{2,6}\s*\[(base64_decode)[\(\s]+['"][^;]+=\s*\1;[^\n]{999,}\{\s*(\$\w{1,40})[=\s]+str_replace[\(\s]+\2[\(\s]+['"][^,;]+,\s*['"]<title>\$[^\}]{1,99}\}\s*echo\s*\3[;\s\?>]*\Z(?<X1231110>)|[\h\(]+round[^\?]{0,600}\bhttps?://['"\h\.]+\$\w+[\.\h'"]+jewishleave\.com['"];[^\^]{999,2000}\bfclose[\h\(]+\$\w+[\h\)]+;\s*echo\h*['"]robots\.txt\h*done['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*else\s*\{\s*\}\s*\?>(?<X1295770>)|[\s\(]+0[\)\s]+;(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;){2}\s*\$\w{1,40}[\s=]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}['"]\;\s*\$\w{1,40}[\s=]+['"]/wp\-content/\w{1,40}['"\s;]+\$\w{1,40}\s*=\s*['"](?:\w*,){9,}\w*['"];[^\^\}\.]{0,499}\$\w{1,40}\s*\.=\s*\S{1,40}\s*\^\s*\S(?<X2203550>)|\((?:0|NYLL)\);\s*(\$\w+)[\h=]+['"]https?://x\-projetion\.org/dpantek/[^'"]+['"];[^#]{99,1600}\becho\h*implode[\h\(]+['"]{2},\h*file[\h\(]+\7[\h\)]+;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X120337720>)|\(0\);(?:[^\n\^%#]{1,350}\belse[\s\{]*\$\w{1,4}[\h=]*\$\w{1,4}\[\d+\]\s*;\s*\$\w{1,4}[\h=]*['"]moban['"]\s*;\s*\}\s*if[\s\(]*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}[\s\]\)\{]+\$\w+[\s=]+\$_SERVER[^\?\n]{9,250}\becho\s*['"][^'"]{0,50}['"][\s;\}]+\?>(?<X1318390>)|\s*(\$\w+)[\h=]+(?:['"\h\.range]+;\s*\$\w+[\h=]+\10\(['"]\176['"],[^\n#]{999,7000}\bheader\(['"]Content\-Type:[\h\.'"]+(\$\w+)\[[^;]+;\h*echo\h*\11\[['"]content['"]\];\h*(?:exit|die)[^;]{0,9};\h*\}\h*\?>(?<X1323460>)|['"]https?://[^'"]+/raw['"];[^\$]{0,99}(\$\w+)[\h=]+(curl_)init\(\10\);[^\?]{9,399}(\$\w+)[\h=]+\14exec\(\13\);[^\?]{99,399}\bisset\(\$_COOKIE\[[^\{]+\{\s*echo\h*\15;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X120342160>))|\s*(echo)\h*['"]<!DOCTYPE\b[^\?]{0,99}<title>Caterscam\b[^\*]{99,2000}\bisset[\h\(]+\$_GET\[['"]edit['"]\],\h*(\$_POST\[)['"]content['"]\][^#\*%]{999,5000}\bsystem[\h\(]+\18['"]cmd['"][\h\)\]]+;\s*\17\h*['"]</textarea>[^;]+;\s*\}\s*\17\h*['"]</div>[^;]+;\s*\?>(?<X120355890>)|define\(['"][^'"]+['"],['"][^'"]+['"]\);\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]=explode\(['"]\|[^'"\|]{0,8}\|[^'"\|]{0,8}\|[^'"\|]{0,8}['"],gzinflate\(substr\(['"][^\n]{999,11111}=\$_[GPCSR]\w{2,6}(?:\[[^\]]+\])+\((?:\$_[GPCSR]\w{2,6}\[){2}[^\]]+\]\[[\dxa-f]+\](?<X2221950>))|\([^\?]{9,399}\bconst\h*(targets)[\h=]+\[(?:['"]https:?//[^'"]+['"],?\s*){5,20}\][^\?]{999,3500}\bvisitNewLocation[\h\(]+\21[\h,]+\w{1,25}[\h,]+\w{1,25}[\s\);\}]+document\.addEventListener[\h\(]+[^,]+,\h*globalClick[\s\)\}\(]+</script>['"];[\s\}]+\?>(?<X1226691>))
<\?[ph\s]*(?:f(?:ile_pu(t_contents\()['"][^'"]+\.php["'],file_ge\1['"]https?://[^'"]+\.txt['"]\)+;unlink\(__FILE__\);\s*\?>(?<X1228990>)|unction\h*(\w+)(?:[\h\(]+(?:(\$\w+)[\s\)\{]+\{\s*\$\w+[\h=]+base64_decode[\h\(]+\4[^\?]{9,250}\bif[\h\(]+isset[\h\(]+(\$_POST\[[^\]]+\])[\s\)\{]+eval[\h\(]+\3[\h\(]+\5[\h\)]+;[^\?]{0,50}\?>(?<X120346170>)|\$\w+[\s\)\{]+(?:(\$\w+)[\h=]+!?empty\(\$_[GPRSC]\w{2,6}\[[^;]+;\s*return\h*\7;\s*\}\s*if[\h\(]+(\3[\h\(]+['"])[^\{]+\{\s*@?eval[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)];\s*exit;\s*\}\s*if[\h\(]+\8[^\{]+\{\s*echo[^;]+;\s*exit;\s*\}[^\?]{0,50}\?>(?<X120349020>)|return\h*strrev\([^\}]+\}\s*\$\w+[\h=]+\$GLOBALS\[str_replace\([^\?]{0,199}\$\w+[\h=]+\3[\h\(]+['"]lave['"][\h\)]+;[^\?]{9,199}\$\w+[\h\(]+\$\w+[\h\)]+;\s*\?>(?<X120369080>)))|(?:[\s\(\)\{]+if[\h\(!]+empty\(\$_SERVER\[['"]HTTP_[^#]{99,550}\b\3[\h\(\)]+;\s*(\$\w+)[\h=]+false;[^#]{99,500}\bif[\h\(]+\11[^\{]+\{\s*include\h*__DIR__[^;]+\.php['"];[^#]{99,700}\becho\h*['"]<(script)\h*src[\h=]+['"]https?://991fa\.com/[^'"]+\.js['"]></\12\>['"];\s*\}\s*\?>(?<X120367200>)|[^\?]{9,200}\bcurl_init\([^#]{99,450}\b(?:googlebot|bingbot|slurp)[^\?]{9,300}\bpages\.dev/[\w\-]+\.txt[^#]{99,1500}\bheader[\h\('"]+Location:\h*\$\w+['"][\h\)]+;[^\?]{0,99}\bif[\h\(]+preg_match[^\{]+\{\s*(\$\w+)[\h=]+\3\([^;]+;\s*echo\h*\14[^;]*;\s*exit;[\s\}]+\?>(?<X120360581>)|\(\$\w+[\)\s\{]+if[\h\(]+ini_get[^\?]{99,899}(\$\w+)[\h=]+['"]https?://paste\.hexaspaces\.com/raw/[^'"]+\.html['"];\s*\$\w+[\h=]+\3\(\16[^\?]{99,999}\bheader\(['"]Location:\h*https?://[^/]+\.workers\.dev/['"][^;]+;\s*exit;\s*\}\s*\?>(?<X120361750>)|\(\)\s*\{\s*\$\w+[\h=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^#]{99,799}\bif[\h\(]+\3[\s\(\)\{]+(\$\w+)[\h=]+['"]https?://dahgilalu\.com/[^'"]+\.txt['"];\s*\$\w+[\h=]+\w+\((?:\18|[^\(]*\(\18)[^\?]{0,199}\becho[^;]+;\s*exit;[\s\}\);]+\s*\?>(?<X120348230>)))|unction(?:\h*(?:(is_mobile\(\))\s*\{\s*\$\w+[\h=]+\$_SERVER\[[^\]]+\];\s*\$\w+[\h=]+array\(['"]bot['"],[^\?]{9,250}\bif[\h\(]+\20[\h&]+\$_SERVER\[[^\{]+\{\s*(\$\w+)[\h=]+file_get_contents[\h\('"]+[\w\-]+\.(?:php|txt)['"][\h\)];\s*echo\h*\21;\s*exit[\h\(\)]*;\s*\}\s*\?>(?<X120344451>)|\w+[\h\(]+\$\w+[\h\)\{]+\$\w+[\h=]+curl_init[^\}]+\}\h*function\h*(\w+\(\))[\h\{]+return\h*exit;\h*\}[^\n]{99,5000}\b(main_shell)['"]\][\h=]+\$\24;[\h\}]+\$\w+[\h\=]+isset[\h\(]+\$_SERVER\[['"]HTTP_[^\n]{99,999}\b\23;\?>(?<X1260560>)|\w+\([^\{]+\{\s*\$\w+[\h=]+curl_init[^#]{999,5000}\b(main_shell)[\h=]+\$\w+\.\$[^;]+;\h*(\$\w+)\[['"]\26['"]\][\h=]+\$\26;[^#]{99,999}(\$\w+)[\h=]+\w+\(\$\w+,\h*\27\);\h*echo\h*\28;\h*exit\(\);\s*\}\s*\?>(?<X120333960>)|curl_get_contents[^\{]+\{\s*\$\w+[\h=]+curl_init[^\n]{999,4500}\bmain_shell['"]\][\h=]+\$main_shell;\s*\}[^\n]{99,999}\becho\h*\$\w+;\s*exit;[^\}]*\}\s*\?>(?<X1295921>))|\s*(\w+)(?:[\(\)\s]+\{\s*file_put_contents[\(\s]+['"][^'"]+\.php['"][,\s]+file_get_contents[\(\s]+['"]https?://gitlab\.com/[^'"\-]+/\-/[^'"\-]+\.php['"][^\}]+\}\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\31[\(\)\s;]+\}\s*(?:\?>|\Z)(?<X1227880>)|[\(\s]+(\$\w{1,40})[\)\s\{]+(?:\$\w{1,40}[=\s]+strlen[\(\s]+trim[\(\s]+\33[\)\s]+;[^\}]+\+\s*hexdec[\(\s]+substr[\(\s]+\33[,\s]+\$\w[^\}]+\}[^'"]{0,99}eval[\s\(]+\31[\s\(]+['"][^'"]+['"][\s\)]+\.\s*['"][a-z\d/\+]+\\?['"]['"][\s\.]+\31[\s\(]+['"][\da-f]{9,}['"][\s\)]+\.[\s'"\);\?>]+\Z(?<X1227440>)|\33[=\s]+gzinflate[\(\s]+base64_decode[\(\s]+\33[\)\s;]+for[\(\s]+(\$\w{1,40})\s*=[^\{\}\+]+\35\+\+[\)\s\{]+(\$\w{1,40})\[\35\][=\s]+chr[\(\s]+ord[\(\s]+\36\[\35\][\d\-\)\s;\}]+return\s*\36[^\(\)]{9,499}\beval[\(\s]+\31[\(\s]+['"][^'"]+['"][\)\s;]+(?:\?>|\Z)(?<X1231050>)))|\s*(?:(\w+\()[^\?]{1,499}\}function\s*(\w+\()(\$\w+)\)\{[^\}]{1,499}(\$\w+)=file_get_contents\(\40\);[^\}]{0,499}(\$\w+)=\38\41\);return\s*\42;\}(\$\w+)=\39[^;]+\.(?:jpe?g|png|ico|gif|bmp)['"]\);if\([^;\}]{1,49}\beval\(\43\);(?:(?:echo|die|exit)\b[^;]{0,49};|\}){0,3}(?:\?>|\Z)(?<X1231910>)|(\w{1,40})\((?:\$\w{1,40}[,\)\s]+)+\{\s*\$\w{1,40}[=\s]+['"][^'"]{40,}['"];[^\{]{0,99}(\$\w{1,40})[=\s]+(base64_decode)\(\46[^\}]*\}[\s\}]+return\s*\47[^\}]*\}[;\s]*(?:(\$\w{1,40})[\s=]+['"][^'"]+['"];\s*)+(\$\w{1,40})[=\s]+\45\(\48[,\s]+\$\w{1,40}[\)\s;@]+eval[\(\s]+\49[\)\s;]+(?:\?>|\Z)(?<X1210190>)|(_is_ssl)[\(\)\s]+\{\s*(\$\w+)\s*=\s*\$\s*\{\s*['"]\\[^\?\n]{99,999}\52\[[^\]]+\][\s\)]*\?[^@\n]{9,9999}(\$\w{1,40})\s*=\s*\$\w{1,40}[\(\s]+\52\s*\[[^\]]+\][\)\s;]+if[\(\s]+@\$\w{1,40}[\(\s]+\$\w{1,40}[,\s]+\53[\)\s]+\{[^>]+\bexit\(['"][^'"]+['"]\);[\}\s]+\51\s*\(\)[\s;]+(?:\?>|\Z)(?<X1241450>)|\w+[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*\$_COOKIE\[\55\][=\s]+\$\w{1,40}\s*;\s*setcookie\b[^\-]{9,999}(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+\$_SERVER\[['"]HTTP_HOST['"]\].['"]/well\-known/[\w\-]+\.txt[^\*\?]{99,9999}\bdownloadFile[\(\s'"]+\56[^;]+;[\s\}]*(?:\?>|\Z)(?<X1217330>)|\w+\((\$\w+)\)\{(\$\w+)=[^;]+;(\$\w+)=[^;]+;(\$\w+)=[^;]+;\58=\61\(\59\(\60\(\58\)+;return\58;\}[^@!:]{1,1100}\bfunction\s*(\w+)\(\58\)[^@\*]{1,1100}\b\62\(\58\);\}die\(\);\}{3}(?<X2256732>)|\w+\s*\([^;\{\}]{1,40}\{\s*\$\w{1,40}\s*=\s*['"]https?://%s/['"]\s*\.[^\n]{99,}@header[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;[\}\s]*(?:\?>|\Z)(?<X1251690>))|\s+(?:curl_get_contents[^\.\n\*]{1,9999}\breferbots[^:]{1,999}:[/\w]+\.qaybet[^\n\*]+\[['"]http_user_agent['"]\][^\?\n]*\?>(?<X1274721>)|is_bot\s*\([^)]*\)\s*\{[^#]{9,599}\bstrpos\s*\(\s*\$request_uri\s*,\s*['"]/portofolio/?['"]\s*\)[^;]{9,99}\bfile_get_contents\s*\(\s*["']https://tapfuse\.io/[^\}]{0,99}\bexit;[\s\}]+\?>(?<X120360481>))))|goto(?:\h*[a-z\d]{3,9};\h*[a-z\d]{3,9}:\h*@ini_set[\(\s]+['"]display_errors['"][,\s]+0[\)\s]+;\h*goto[^\n!]{0,99}\bif[\s\(]+!\h*file_exists[\s\('"]+/[^'"]+\.js['"\)\s]+\|\|\s*trim\s*\([^\?\n]+\?[^;]+</script>['"];[\s\}]*(?:\?>|\Z)(?<X1237400>)|\s*(?:\w+;\s*\w+:\s*function\s*\w+[\(\s]+\$\w+[\)\s]*\{\s*goto\s*\w+;\s*\w+:\s*if[\s\(]+is_array[\(\s]+\$\w+[\)\s]+\{\s*goto\b[^@\n]{1,999}@preg_split[\(\s]+['"]\\[^\n]{99,}\bif[\(\s]+isset[\(\s]+\$_SERVER\h*\[[^\]]+\][^\?]{1,999}(?:\?>|\Z)(?<X1259090>)|\w{2,12};\s*\w{2,12}:\s*@header[\(\s]+['"]\\[^@\n]{9,999}@set_time_limit\b[^\n]{99,}\bif[\(\s]+is_dir[\(\s]+\$\w+\s*\.\s*['"]\\[^\?\n]+\b\w+:\s*(?:\?>|\Z)(?<X1259850>))|\s+\w{3,8};\s*\w{3,8}:\s*ob_implicit_flush\b[^\n]{3,299}\bgoto\s+\w{3,8};\s*\w{3,8}:\s*(\$botbot[bot]+)\s*=\s*str_replace\s*\([^;]+\70(?:[^\n\^\?>!]{1,9999}\b(?:while|if)[\s\(]+!){2}[^\n]+goto\s+\w{3,8};\s*\w{3,8}:\s*(?:\?>|\Z)(?<X1235301>))|header(?:[\h\('"]+Location:\h*https?://(?:w+\.)?graphotism\.com/[^'"]+['"][\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X120337730>)|[\h\(]+['"]Location[\h:]+https?://kundeservice\-postnord\.info/[^'"]+['"][\h\)]+;\s*\?>(?<X1226930>)|\(['"]Location(?::\h*https?://istitutoeuropeodelturismo\.it['"],\h*true[^\)]+\);\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X120337170>)|[\s:]+(?:https?:)?//combustus\.net/[^'"]+['"]\);(?:(?:exit|die)\b[^;]{0,49};)?\s*(?:\?>|\Z)(?<X1227950>))))
<\?[ph\s]*if(?:[\(\h]+isset[\(\h]+\$_[GPC]\w{2,6}\[[^\{]+\{\s*(\$\w+)[\h=]+['"]https?://snippet\.host[^'"]+/raw['"];\s*(\$\w+)[\h=]+file_get_contents[\h\(]+\1[\h\)]+;\s*eval[\h\('"\?>]+\2[\h<\?ph'"\)]+;\s*\}\s*\?>(?<X1279970>)|[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]+\{\s*echo(?:(?:\s*['"][^'"]*['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1221410>)|\s*['"][^'"]*['"][\.\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\.\s]+['"][^'"]*['"])?\s*;\s*echo\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1221400>))|\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s@]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\6\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\{\s*echo\s*['"][^'"]*['"][\s;\}]+else\s*\{\s*echo\s*['"][^'"]*['"][;\s\}]+(?:\?>|\Z)(?<X1218970>))|[\(\s]+!function_exists[\(\s'"]+explode['"\)\s]+\{\s*function\s*explode[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{\s*return\s*split[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;[^\n@]{0,99}@ini_set\h*\([^\n]{99,9999}\}\s*goto\s*\w+;\s*(?:\w+:[\}\s]*)+(?:\?>|\Z)(?<X1237610>)|[\(\s]+(?:!\s*)?(?:empty|isset)[\(\s]+(\$_FILES\[)[^\]\$]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+basename[\(\s]+\9[^\]\$]+\]\s*\[[^\]\$]+\][\)\s]+;\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+\9[^\]]+\]\s*\[[^\]\$]+\][,\s]+\10[\)\s\{]+\becho\b[^;]+;[\s\}]+else[\s\{]+echo\b[^;]+;[\s\};]*(?:\?>|\Z)(?<X1229991>)|[\(\s]+(\$_[GPRSC]\w{2,6})[\)\s]+\{\s*(\$\w{1,40})[=@\s]+fopen[\(\s]+\12\s*\[[^\]]+\][,\s]+['"][wa]\+?['"][\)\s;]+if[\(\s@]+fwrite[\(\s]+\13[,\s]+\12\s*\[[^\]]+\][\)\s]+echo\b[^;]+;\s*else\s*echo\b[^;]+;\s*\}\s*(?:\?>|\Z)(?<X1203970>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\)\s]+\{\s*echo\s*['"][^'"]{0,40}['"][\.\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\15[\)\s;\}]+(?:\?>|\Z)(?<X1221250>)|[\(\s]+(\$_FILES)[\)\s\{]+if[\(\s]+(function_exists)[\(\s'"]+(move_uploaded_file|copy)['"\)\s\{]+if[\(\s]+\19[\(\s]+\17\[[^\]]+\]\[[^\]]+\][,\s]+\17\[[^\]]+\]\[[^\]]+\][\)\s]+\{[^\}]+\}[^=\[]{0,49}elseif[\(\s]+\18[\(\s'"]+(move_uploaded_file|copy)['"\s\)\{]+if[\(\s]+\20[\s\(]+\17[^\}]+\}[^\?]{0,40}\?>(?<X1228580>)|[\(\s]+\$_(?:[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*if[\(\s@]+(?:copy|move_uploaded_file)[\s\(]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\22\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1222250>)|[GPRSCF]\w{2,6}\s*\[[^\]]+\][^\{;]{0,40}\{\s*(?:if|foreach)[\s\(]+\$_[GPRSCF]\w{2,6}\s*\[[^\]]+\][^,\}]{0,199}\b(?:move_uploaded_file|copy)[\(\s]+(\$_FILES\[)[^\]]+\]\s*\[[^\]]+\](?:\s*\[[^\]]+\])?[,\s]+\24[^\]]+\]\s*\[[^\]]+\](?:\s*\[[^\]]+\])?\s*\)[^\}]{0,199}\}[\s\};]*(?:\?>|\Z)(?<X1223230>)|SERVER\[[^\]]+\]\s*===\s*['"][^'"]{1,100}['"][\)\s]+\{\s*if[\(\s]+preg_match[\(\s]+['"]/google/i['"][,\s]+\$_SERVER\[['"\s]+HTTP_USER_AGENT['"\s]+\][\)\s]+\{[^\^\}]{9,999}\}[^\?]{0,99}\?>(?<X1239871>))|[\(\s]+isset(?:[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s\{@]+(?:copy|move_uploaded_file)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][\}\)\s;]*\?>(?<X1223261>)|[\)\s]+\{\s*@?(?:copy|move_uploaded_file)[\(\s]+\$_FILES\[[^\]]+\]\s*\[\s*['"][^'"]*['"]\s*\][,\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][\}\);\s\?>]*\Z(?<X1217900>))|[\(\s]+(?:(\$_FILES\[)[^\]]+\][\)\s]+\{[^\{\}\[]{0,99}(\$\w{1,40})[=\s]+\29[^\]]+\]\[[^\]]+\][\s;]+(\$\w{1,40})[=\s]+\29[^\]]+\]\[[^\]]+\][\s;]+@(?:move_uploaded_file|copy)[\(\s]+(?:\30|\31)[,\s]+(?:\30|\31)[\)\s;\}]+(?:\?>|\Z)(?<X1228600>)|(\$_FILES\[[^\]]+\])[\)\s]+\{\s*(?:(\$\w{1,40})[=\s]+count[\(\s]+\33\[[^\]]+\][\)\s;]+for[\(\s]+(\$\w{1,40})[=\s]+\d+;\s*\35\s*<\s*\34\s*;\s*\35\+\+[\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}\[\d+\][\(\s]+\33\[[^\]]+\]\[\35\][,\s]+\33\[[^\]]+\]\[\35\][\)\s;]+\}[^\?]{9,999}\36[^\?]{9,999}\?>(?<X1223850>)|date_default_timezone_set\b[^;]+;[^\}\-]{0,99}(\$\w{1,40})[=\s]+strtolower[\(\s]+substr[\(\s]+\33\[[^\]]+\][,\s]+\-\d[^\}\-]{0,99}(\$\w{1,40})[=\s]+date[\(\s]+['"][^'"]+['"][\)\.\s]+\38[^\[\}]{0,99}move_uploaded_file[\(\s]+\33\[[^;]+\39[^\}]+\}\s*\?>(?<X1222590>))|\$_[GPRSC]\w{2,6}(?:\[[^\]]+\][\)\s]+\{(?:(?:\s*echo\s*['"]<[^;]+;)+\s*if[\(\s]+(\$_FILES\[[^\]]+\]\[)[^\]]+\][^;\{]+\{\s*echo[^;]+;\s*\}\s*else\s*\{[^=\?]{0,499}\b(?:move_uploaded_file|copy)[\s\(]+\41[^\]]+\][^;]+\41[^\]]+\][\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1207251>)|\s*(\$\w{1,40})[=\s]+@fopen[\(\s]+['"][^'"]+\.php['"][,\s'"]+w['"][\)\s;]+if[\(\s]+!\43[\)\s]+(?:exit|die)\b[^;]*;\s*fwrite[\(\s]+\43[,\s]+base64_decode[\(\s'"]+PD9[^'"]+['"][\)\s;]+fclose[\(\s]+\43[^\}=]+(?:exit|die)\b[^;]*;[\s\};]*(?:\?>|\Z)(?<X1214450>))|\h*\[[^\]]+\](?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]https?://raw\.githubusercontent\.com/[^'"/]+exploit[^/]*/[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+(curl_)init[\(\)\s]+;\s*\47setopt[\s\(]+\46[^;]+\45[^\}=]+(\$\w{1,40})[=\s]+\47exec[\s\(]+\46[^\?\}]{0,99}eval[^;]+\48[^\}]+\}\s*\?>(?<X1237240>)|[\)\s]+\{\s*\$\w{1,40}[='"\s;]{6,}(\$\w{1,40})[=\s'"]+/tmp/sess_['"\.\s]+md5\s*\([^;]+;\s*if[\s\(]+(file_)exists[\s\(]+\50[^\};]+include(?:_once)?[\(\s]+\50[\)\s\};]+else[\s\{@]+\51put_contents[\s\(]+\50[^\}]+\}\s*(?:die|exit)[^\?=]{0,99}(?:\?>|\Z)(?<X1237590>))|\s*\[[^\]]+\](?:[\)\s\{@]+\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+stripslashes[\(\s@]+\$_(?:POST|get|REQUEST|COOKIE)\s*\[[^\]]+\][^;]+;[;\s\}]*(?:\?>|\Z)(?<X1223780>)|[\)\s\{]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]+['"][\.\s@]+file_get_contents[\(\s]+['"]https?://[^'"]*['"][\)\s]+;[;\}\s]+(?:\?>|\Z)(?<X1204020>)|[\s\)]+\$mailTo\s*=\s*base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^\?]+if[\(\s@]+mail[\(\s]+\$MailTo\s*,\s*\$MessageSubject\s*,\s*\$MessageBody\s*,\s*\$MessageHeader\s*\)\s*\)(?<X2046832>)|[\s\)]+\{[^\{\}]+\bif[\(\s]+@?(?:move_uploaded_file|copy)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$\w+[^\?>]+\?>\s*<form[^\n\?]{9,499}/>\s*<\?[ph\s]*\}(?:\s*;)?\s*(?:\?>|\Z)(?<X1261560>)|[\s\)]+\{\s*echo[\s'"\(]*<(form)\s*method[=\s]+['"]POST['"]\s*enctype[=\s]+['"]multipart/\57\-[^;]+</\57>['"]\s*;\s*@(?:copy|move_uploaded_file)[\(\s]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][\s,]+\58\s*\[[^\]]+\]\s*\[[^\]]+\][\);\s\}]*(?:\?>|\Z)(?<X1209540>)))))|[\(\s]+str(?:istr[\(\s]+\$_[GPRSC]\w{2,6}\[[^\);]+['"][^'"]+['"][\)\s]+\S{2,3}\s*false[\)\s]+\{\s*(\$\w{1,40})[\s=]+['"][filegtcons_'"\.\s]{17,40}['"][\s;]+(\$\w{1,40})[\s=]+\60[\s\('"]+http://[\w\-\.]{3,}\.(?:hu|xyz|ly)/[^'"]+['"][\s\);]+(\$\w{1,40})\s*=[<\?ph\s'"\.]{15}[^;]+\61[^\}]+\62[^\}]+\}[\s\};]+\?>(?<X1212690>)|pos[\(\s]+\$\w{1,40}[,\s]+['"]\.php['"][\)\s]+\{\s*(\$\w{0,9}shell)[=\s]+\$\w{1,40}[\.\s]+\$\w{1,40}[\.\s]+\$\w{1,40}\s*;\s*\$\w{1,40}\s*\[\s*['"][^'"]*['"]\s*\][=\s]+\64\s*;\s*\}[^>]{99,999}\}\s*else\s*\{\s*\}[;\?>\s]+\Z(?<X1226770>))|[\h\(]+!\h*file_exists[\h\(]+(['"][^'"]+\.(?:jpg|php)['"])[\h\)]+[^\{]+\{\s*chmod[\h\(]+\66[\h,]+\d+[\h\)]+;\s*@?(?:copy|move_uploaded_file)[\h\('"]+[^'"]+['"][\h,]+\66[\h\)]+;\s*chmod[\h\(]+\66[\h,]+\d+[\h\)];\s*\}\s*\?>(?<X120344201>)|[\h\(]+\$_SERVER\[[^\{]+\{\s*header[\h\(]+['"]Location:\h*https?://(?:Scantest|letsmakeparty3)\.ga['"]\);[^\}]{0,99}\bexit;\s*\}\s*\?>(?<X120347170>)|[\h\(]+isset[\h\(]+(?:(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)\{]+\$pass\d*[\h=]+['"]\w{32,64}['"];\s*\$\w+[\h=]+\69[^\]]+\];[^\{]{0,199}\{\s*\?>(?:<\w+>)?<form\h*action=[^\}]{0,399}\bif[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^,]+,\h*\$\w+[\h\)]+echo\h*['"][^\}\n\{]{0,99}[\}\s]+\?>(?<X1251300>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)\{]+(?:\?>\s*<form[^\?]{9,199}<\?[ph\s]*\}\s*if[\h\(]+!empty[\h\(]+(\$_FILES\[[^\]]+\])[\s\)\{]+[^\{]{0,99}\bif[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\71\[[^\]]+\][^\?]{0,250}\?>(?<X1255412>)|chmod\([^;]+;\s*if[\h\(]+(file_)put(_contents)[^,]+,\h*\73get\74[\h\(]+['"]https?://raw\.githubusercontent\.com/bukan\-hengker/[^\{]+\{\s*echo[^;]+;\s*\}\s*else\s*\{\s*echo[^;]+;\s*\}\s*\}\s*\?>(?<X120345560>))))
<\?[ph\s]*(?:if(?:[\h\(]+md5[\h\(]md5[^&]+&&\h*trim[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{;]+\{\s*(file_)put(_contents)[\h\(]+['"][^'"]+\.php['"],\h*\1get\2[\h\(]+['"]https?://[^\)]+\.txt['"][\h\)]+;\s*echo[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1233481>)|[\s\(]+!\s*empty[\s\(]+(\$_FILES)\s*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+['"][^'"\$]+['"][\s;]+\5[\s=]+\5[\s\.]+basename[\s\(]+\4\s*\[[^\]]+\]\s*\[[^\]]+\][\s\);]+if[\s\(@]+(?:copy|move_uploaded_file)[\s\(]+\4\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\5[\s\)]+\{\s*echo[^\}]+\}[^=\$\?<>]{0,499}(?:\?>|\Z)(?<X1217930>)|[\s\(]+isset[\(\s]+\$_GET\s*\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}\s*=\s*['"][^'"]+\.txt['"];\s*\$\w+\s*=\s*file\s*\([^>]{99,4999}\belse\s*\{\s*\$\w{1,40}\s*=\s*['"]SLOT\s[^;]*;[^\?]{9,199}(?:\?>|\Z)(?<X1273802>)|\([^;\$\{]{0,199}\$_[GPCSR]\w{2,6}\[[^;\{]{1,199}\{file_pu(t_contents\(\$_[GPCSR]\w{2,6}\[)[^\]]+\],file_ge\8[^\]]+\]\)+;(?:die|exit)\b[^;]{0,19};\}\s*(?:\?>|\Z)(?<X1236220>)|\([^;\{]{0,199}\bmd5_file\(["']([^'"]+/\.htaccess)['"]\)!=['"]\w{32}['"][^\{;]{1,199}\{chmod\(['"]\10['"],\d+\);copy\(['"][^'"]+/\.\w{1,9}(?<!/\.htaccess|/\.htaccess\.txt)['"],['"]\10["']\);chmod\(['"]\10['"],\d+\);\}\s*(?:\?>|\Z)(?<X1229001>)|\([^\{;]*(\$_[GPCSR]\w{2,6}\[)[^\{;]+\{[^@]{1,999}(\$\w+)=[^;]*\12[^;]+;(\$\w+)=fopen\(['"]([^'"]+)['"],['"]w['"]\);fwrite\(\14,[^;]*\13\b[^\?]{0,199}\bif\(preg_match\([^,]+,\$_SERVER\[['"]HTTP_USER_AGENT['"][^\};]+\becho\s*(file_get_contents\()['"]\15\b[^\?]{0,199}\bfwrite\((\$\w+),\16\12[^;]+;fclose\(\17\);\}+(?:\?>|\Z)(?<X1228960>)|\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{echo[\s\(]*base64_decode\(["'][^;]+;(?:copy|move_uploaded_file)\((\$_FILES\[)[^,;]+,(\19[^\]]+\]\[[^\]]+\])\);echo\b[^;]{0,99}\20[^;]{0,99};\}(?:\?>|\Z)(?<X1229430>)|\(preg_match\(['"][^'"]+['"],\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)+\{echo\s*['"](?:<a\b[^>]{0,199}\btitle=['"]([^'"]+)['"][^>]{0,199}>\22</a>\s*){5}[^;\?\}\{]{999,}</a>['"];\}\s*\?>(?<X1232550>)|\(strpos\(\$_SERVER\[(base64_decode)\([^\{]+\{\s*(\$\w+)[\h=]+\24\([^\)]+\);\s*\$\w+[\h=]+file_get_contents\(\25\);[^\{]{0,300}\{\s*(\$\w+)[\h=]+substr\(str_shuffle\(\24\([^;]+;\s*echo\h*['"]<a\h*href[\h=]+['"]\$\w+['"]>\26</a>\s*['"];[\s\}]+\?>(?<X120342920>)|\s*\(\s*isset[\s\(]*\$_[GPCSR]\w{2,6}\s*\[[^\]]+\][\s\)]+\{\s*if[\s\(@]+(?:copy|move_uploaded_file)\s*\(\s*(\$_FILES\[[^\]]+\]\s*\[)\\?['"]tmp_name\\?['"]\]\s*,\s*\28\\?['"]name\\?['"]\][\s\)]+\{\s*echo[^;]{1,99};\s*\}\s*(?:else\s*\{\s*echo[^;]{1,99};\s*\}\s*)?\};?\s*(?:\?>|\Z)(?<X1137941>))|i(?:gnore_user_abort[\(\s]+true[\)\s]+;\s*(ini_set)[\(\s]+['"]memory_limit['"][,\s]+['"]\-1['"][\)\s;]+(?:(?:set_time_limit|error_reporting)[\(\s]+\d+[\)\s;]+)+(?:\30[\(\s]+['"](?:display_errors|max_execution_time)['"][,\s]+\d+[\)\s;]+)+\$\w{1,40}\s*=\s*['"][^;]+\bFileManager\b(?<X2226580>)|nclude(?:_once)?[\(\s]+['"]zip://\./[^"']+\.php['"][\)\s]+;\s*(?:\?>|\Z)(?<X1263220>))|ob_start\(\);\s*function\s*(\w+)\(\$\w+[^#]{99,2200}\bsetcookie\(['"]cloak['"][^;]+;\s*(\$\w+)[\h=]+\33\(\$\w+\);[^\?]{9,150}echo\h*\34;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X120360510>)|pclose[\(\s]+popen[\(\s]+['"]/bin/\w{0,3}sh\b[^;>]{1,40}>&\s*/dev/tcp/(?!10\.|172\.[123]\d\.|192\.168\.)\d+\.\d+\.\d+\.\d+/\d{4,}\s+0>&1['"]+\s*,\s*['"]r['"][\s\);]+(?:\?>|\Z)(?<X1206871>)|set_time_limit[\(\s]+0[\)\s]+;(?:\s*@?error_(?:reporting|log)[\(\s]+0[\)\s]+;)+\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^;]+\.\s*php_uname\s*\(\s*\)[^\?]{1,999}(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s;@]+fwrite[\s\(]+fopen\b[^;]+\37[\s\)]+;[\s\};]+(?:\?>|\Z)(?<X1203910>)|while[\(\s]+True[\)\s]+\{\s*if[\(\s]+!file_exists[\('"\.\s]+(\$_SERVER)\[[^\]]+\][\.'"\)\s]+\{\s*CoPy[\('"\.\s]+\$\w{1,40}['"\.\s,]+\39\[[^\]]+\][\.'"\)\s;\}]+if[\(\s]+(?:FiLe)?PeRmS[\('"\.\s]+\39\[[^\]]+\][\.\)\s'"]+!=\s*['"]\d+['"\)\s]+\{\s*ChMoD[\('"\.\s]+\39\[[^\]]+\][\.'",\s]+\d+[\)\s;\}]+\?>(?<X1222540>))
<\?[ph\s]+(?:#+\s*(\w+)\s*#\s*if[\s\(]+empty[\s\(]+(\$\w+)\b[^;]{1,499}\berror_reporting[\s\(]+(?:0|NULL|False)[\)\s]+;[^\?]{1,999}\bcurl_exec\s*\([^#]{499,4999}\2[\s=]+['"]<(script)\b[^;]+</\3>['"];\s*echo\s*\2;[\s\}]*#+\s*/\1\s*#+\s*(?:\?>|\Z)(?<X1208490>)|(//[^\n]+|/\*[^\*]+\*/)\s*@?error_reporting[\h\(]+(?:0|NULL|FALSE)\);\s*@?ini_set\h*\([^\>?\\//]{999,2500}\beval\h*\(\$GLOBALS\[[^\(]{1,20}\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);(?:\s*\})+\s*\5(?:\s*\?>)?(?<X1194860>)|(//\s*[^\s\w]+)\s*error_reporting[\s\(]+(?:0|NULL|False)[\s\)]+;[^\n]{999,}\beval[\s\(]+\$GLOBALS(?:\[[^\]]+\])+[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;[\s\}]*\7\s*(?:\?>|\Z)(?<X1195030>)|(/\*\w{32}\*/)\s*(\$\w+)_\w{2}[=\s]+(array)\s*\(['"][^\*\\]{999,9999}\10_\w{2}\s*=\s*\11\s*\(['"][^;]{32,999};\s*\10_\w{2}[^\}\\]{99,9999}eval[^;]+;\s*\9(?<X120332440>)|(/\*Generated\s*by\s*Jetpack\s*\w+)[^\<]{1,50}echo\s*['"]\s*<script[^>]+>\s*if\s*[\(\s]+\!(window\.KTracking)[\)\s]+[\{\s]+\14[=\s][\{\s]+[^\?]{1,50}(https?://(?:\d+[\./])+keitaro)/[^\%]{1,100}\15/\?postback[^\%]{1,1300}function[^\{]+(\$\w{1,40})[^\%]{1,220}file_put\w+[\(\s]+\16[^\?]+\13\s*End\*/\s*\?>(?<X1227850>)|(?:(?:\$\w{1,40}\s*=\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\s*\(\s*\$GLOBALS\[[^\]]+\]\s*\);\s*){2,}(?:\?>|\Z)(?<X1190960>)|(?:(file_)pu(t_contents)\([""][^'"]{1,20}\.(?:php\d*|py|sh)\d*['"],\19ge\20\(["']https?://[^'"]{9,99}/[^'"]{0,20}\.txt['"]\)\);\s*unlink\(__FILE__\);\s*){2,6}\s*\?>(?<X1234880>)|(?:@?(?:error_rep\w+|ini_set)\s*\([^;]+;\s*){3,}header\s*\([^\{]{1,199}\bdefine[\s\(]+['"]Viv[,\s]+bebegim\b[^;]+;\s*(function\s+)(\w+)\s*\([^\?]{1,199}\b\22(\w+)[\s\(]+\)[\s\{]+(\$\w+)[\s=]+['"][^'"]{9999,}['"];\s*\$\w+[\s=]+\23[\s\(]+\25[\s\)]+;[^\?]{1,499}\beval\s*\([^;]+;[\s\}]+@?\24[\s\(]+\);\s*(?:\?>|\Z)(?<X1218880>)|(?:@?(?:error_reporting\s*\(|ini_set[\s\(]+['"][^'"]*error[^'"]*['"]\s*,)\s*(?:0|NULL|False)[\s\)]+;\s*)+if[\s\(]+!(?:move_uploaded_file|copy)[\s\(]+(\$_FILES\[)[^,]+,\s*\27[^\)]+[\s\)\{]+@?(?:move_uploaded_file|copy)[\s\(]+\27[^,]+,\s*\27[^\)]+[\s\)\}]+;\s*(?:\?>|\Z)(?<X1220290>)|(?:@?(?:set_time_limit|error_reporting|ignore_user_abort)[\h\(]+[^\)]+\);\s*)+(\$\w{1,15})[\h=]+['"][^'"]+['"];[^#]{899,1499}\$goweb[\h=]+\29\h*\.[^;]+\.top['"];[^%]+\bfile_put_contents\(\$\w{1,15},\h*\$\w{1,15}\);\s*\}\s*/\*\h*Rc\h*cx046\h*\*/\s*\?>(?<X1215790>)|(?:\$\w+=(?:(?:['"]\w+['"]\.)?chr\(\d+[^;]+;))+[^\{]+\{class\s+(\w+)\{private\$\w+;(public\s*static)\$\w+=['"](?:\w+[-"])+;\32[^>]+this\->\w+\(\)[^>]+(\$\w+)=new\s*\31\(\);\33=NULL;\}\?>(?<X1248470>)|(?:\$\w+=(function)\((?:\$\w+(?:,\$\w+){0,4})?\)\{[^\}]{0,199}\};)+(\$\w+)=\35\((\$\w+)\)\{eval\(\37\);\};\35\s*\w+\([^\{;]+\{[^\}]{1,999}\}(\$\w+)=['"][^'"]{999}[^\?]{999,4999}\36\(\38\);(?:\?>|\Z)(?<X1223880>)|(?:\$\w+=['"](?:str_rot13|base64_decode|gzuncompress)['"];\h*){2,4}[^\\]{0,150}\berror_reporting\((?:0|FALSE|NULL)\);[^\\]{0,99}(\$\w+)=["']create_function['"];\s*(\$\w+)=\40\(['"]{2},(?:\$\w+\(){2,4}['"][^\)]{2000,}['"][\)\s]+;\s*\41\(\);\s*(?:\?>)?\Z(?<X1229490>)|(?:\$\w+=[^\.]{1,99}\.chr\([^\)]+\)[^;]+;){2}(\$\w+)=[^;]+;class\s*(\w+)\{private\s*function[\w\s]+\(\43\)\{if\(is_array\(\44::(\$\w+)\)+[^@\n\*]{1,1999}\bpublic\s*static\45=[^;]+;\}(?:[^\?]+)?\?>(?<X1273512>)|(?:\$\w+[\h=]+['"][^'"]+['"];\h*)?\$\w+[\h=]+urldecode\h*\([^;]+;\h*(?:(\$\w+)[\h\.=]+\$\w+\[[^;]+;\h*)+@?eval[\h\(]+\47[\h\(]+['"][^'"]+['"][\h\)]+;\s*(?:\?>|\Z)(?<X1214390>)|(?:\$\w{1,40}\h*=\h*@?\$_[GPCSR]\w{2,6}\[[^;]{1,99};\h*){3}[^#%:/\*\v\?]{999,}\bcurl_setopt\h*\(\h*(\$\w{1,40})\h*,\h*CURLOPT_URL\h*,([^\)]+)\)[^\}\?]{1,199}(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\49\h*\);\h*\}\h*else\h*\{\h*\51\h*=file_get_contents\h*\(\50[\h\);\}]+echo\h+\51;[\h;\}]+(?:\?>|\Z)(?<X1189480>)|(?:\$\w{1,40}\s*=\s*['"]\d+['"];\s*)+(\$\w{1,40})\s*=\s*urldecode[\s*\('"]+%[^\)]+\);\s*\$\w{1,40}\s*=\s*\53\{\d+\}\s*\.[^:\-\n]{99,9999}\bheader\(['"]Content\-Type:[^;]+;(?:[^%\n#]{99,9999}%host%/)+[^;]+;[^\?\n]{9,999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1199121>)|(?:\$\w{1,40}\s*=\s*['"]\d+['"];\s*|(\$\w{1,40})\s*=\s*['"][\w\-:/]{20,99}['"];\s*)+\$\w{1,40}\s*=\s*\55\{\d+\}\s*\.(?:[^%\n]{99,30000}%(?:host|\{))+[^;]+;(?:[^\n\*]{99,30000}\*\.xml\b)?[^\?]{99,30000}[^\\]['"]\);\h*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1199130>)|(?:echo\s+)?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec|cntl_exec)\([^\)]{0,99}\bngrok\.io/\d+\h*0>&1[^\?]{0,99}\?>(?<X1210741>)|(?:if[\s\(]+[^\)]{0,19}\$_[GPCSR]\w{2,6}\[[^\{;]{1,99}\{\s*(?:@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^\}]{3,99}))[^\{]{1,99}\bif[\h\(]+(\$_[GPRSC]\w{2,6}\[['"](\w+))[^{]{1,49}\{\s*file_put_contents[\h\(]+['"]\w+\.php['"][,\h]+\58[^\?]{1,99}\?\h*\59\h*=\h*\d+['"][^;]{9,1199};\s*\?>(?<X1190822>)|(?:if\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]+\)\{@?(?:eval|copy)\(base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{0,99}\}|if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,3}\d+\)\{(?:print|echo)\([^\)]+\);\s*\}){2,6}\s*(?:\?>|\Z)(?<X1039383>)|(?:include\h*\([^\)]{1,49}\.php['"]\);\s*)[^\?;]{0,99};\s*\$p(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\];[^;]{0,199};\s*\$\w{1,9}\h*=\h*\$_SERVER\[['"]REMOTE_[^\{]{1,199}\bif\(1\h*\S{2,3}\h*1\)[\s\{]+(\$\w{1,9})\h*=\h*[^;]{1,40};\s*\$\w{1,9}\h*=\h*@?fopen\h*\(\62,[^\?]{9,199}\?>(?<X1190901>)|(?:include|require)(?:_once)?\(__DIR__\s*\.\s*['"]/seo-proxy\.php['"]\);\s*\?>(?<X120367681>)|(\$\w+)=(?:(?:['"]\w+['"][\.\s]+|chr[^\)]+\)[\.\s]+['"]?|['"]\\x?\w+['"][\s\.]+|['"]\w+['"];)[^;]+;(?:\$\w+=[^;]+;)?\$\w+=class_exists\(\65\);\65=[^;]+;[^@]{1,150}\bclass\s*(\w+)\{(public)\s*function\s*\w+\(\)\{echo\s*['"]\d+['"];\}[^@]{1,100}\67\s*static(\$\w+)=\d+[^@]{1,820}\66::\68[^;]+;(?:eval\(|include)?\$\w+[^@]{1,200}(\$\w+)=new\s*\66\(\);\69=substr[^;]+;\}\?>(?<X1254961>)|(range\([^\;]+;)(\$\w+)=\$\{\65\[[^;]+;if\(+in_array\(gettype\(\72\)\.count\(\72\)[^;]+;\}class(\w+)\{(?:\w+\s*)?(?:static\s*)?function[^;\{]{1,99}\{\$\w+=\71[^@]{1,999}\bdie[^;]{0,19};(?:endif;)?\}+\73::\w+\(\);\?>\s*(?:SeoOk\s*)?\Z(?<X1218412>)|['"](image/jpeg;base64),\w{999,}['"];if\(strpos\(\65,['"]\75,['"][^'"]{1,29}die[^!]{1,99}\75[^!]{1,49}hex2bin[^@]{1,99}tempnam\(sys_get_temp_dir\([^\(]{1,49}\.php['"];file_put_contents\((\$\w+)[^\?]{1,49}(?:include|require)\76;unlink\(\76\);(?<X220365261>)|['"]\d+['"];(\$\w+)=[^;]+;(?:\$\w+=(?:\78\[\d+\][\.;])+)+if\(\!function_exists\(['"](str_i?replace)['"]\)+\{function\s*\79[^@]+(\$\w+)=isset\(\$\{['"]\w+['"]\}[^@]+(\$\w+)=(\$\{['"]GLOBALS['"]\})\[['"]\w+['"]\]\(\$\w+\);echo\81;(?:exit|die)\(\);[^@]+\65,\82[^@]+unset\(\81[^;]+\80\);(?:exit|die)\(\);\}+;\?>(?<X1250010>)|['"]\w+['"];[^\{]{1,99}\65\w+=[''](_REQUEST)['"][^\}]{1,99}\$\84;(\$\w+)=[^\{]{1,99}function\s+decrypt_(aes)[^\-]{1,99}base64_decode\((\$\w+)[^\}]{1,99}\85[^\-]{1,99}openssl_encrypt\(\87[^\?]{1,149}if\((\$\w+)\)\{ob_start\(\);system\(\88\);\$\w+=ob_get_clean\(\);echo\s+\w+\86\(\$\w+,\85,\$\w+\);\}\}\?>(?<X220367420>)|['"]base64_decode['"];(\$\w+)=['"]strrev['"];error_reporting\(0\);\$\w+=array\(['"]https?://elnn-me\.screenconnect\.com/Bin/ConnectWiseControl\.Client\.exe[^@]+\beval\(\90\(\65\(['"][^\$'"]*['"]\)+;\?>(?<X1274030>)|['"]PD9[^'"]+['"];file_put_contents\(['"][^'"]+\.php\d*['"],base64_decode\(\65\)+;\s*(?:\?>|\Z)(?<X2201021>)|[^;]+;(\$\w+)=[^;]+;\$\w+=\93\(\65\);\93=['"]\d+['"];[^@]{1,200}class\s*(\w+)\{private[^@]{1,4500}(\$\w+)=new\s*\94\(\);\95[^;]+;\}\?>(?<X1251980>)|[^;]+;if\(mail\(\$_[GPCSR]\w{2,6}\[[^\]]+\],['"][^'",]{0,199}\bShell\b[^;\{]{1,199}\{\65=[^;]+;\}\s*echo\s*\65;(?:\?>|\Z)(?<X1214100>)|urlencode\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);if\(preg_match[^\{]{1,49}\65[^\.]{1,49}(\$\w+)[^\?]{1,49}strlen\(\98[^@]{1,199}@?\$\w+=(curl)\w+\(\);\99\w+[^:]{1,49}https?://['"][^@]{1,149}\$_SERVER\[['"]HTTP_HOST['"]\]\.'&useragent[^@]{1,49}(@?\$\w+)=\99\w+[^\?]{1,49}echo\s+\100;\}\?>(?<X120359270>)))
<\?[ph\s]+(?:(\$\w+)(?:[=\s]+(file_get_contents)\(['"]https?://\w+\.vip[^'"]+['"]\);echo\s*\1[;\s]+(\$\w+)[=\s]+\2\(['"]https?://\w+\.vip[^'"]+['"]\);echo\s*\3;\Z(?<X1313250>)|[\h=]+['"]https?://nagabin\.com/[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\6setopt\(\5,[^\)]+\1\);[^\{]{9,200}(\$\w+)[\h=]+\6exec\(\5\);[^\?]{9,199}\becho\h*\7;\s*\}\s*\6close\(\5\);\s*\?>(?<X120348680>)|[\h=]+\[(?:['"][^'"]+\.php['"],\h*){20}[^\}\]]{99,999}\];\s*(\$\w+)[\h=]+basename[\h\(]+\$_SERVER\[[^\]]+\][\h\)]+;\s*if[\h\(]+!?in_array[\h\(]+\9,\h*\1[^\{]+\{\s*header[\h\(]+['"]HTTP/[^\?]{0,150}\bexit[\h\(]+['"]HTTP/\d+\.\d+\h*\d+\h*Forbidden['"][\s\);\}]+\?>(?<X120345090>)|[\h=]+file_get_contents[\h\(]+['"]https?://[^/]+/[^\.]+\.js['"][\h\)]+;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+base64_decode[\h\(]+\1[\h\)]+;\s*\?>(?<X1215900>)|[\s=]+(curl_)init(?:[\s\(\)]+;\s*\12setopt[\s\(]+\1[,\s]+CURLOPT_URL[,\s]+['"]https?://[^'"]+['"][\s\)]+;\s*\12exec[\s\(]+\1[\s\)]+;\s*\?>(?<X1202322>)|\b[^\?\{\}]{1,499}\b\12setopt[\s\(]+\1[\s,]+CURLOPT_URL[\s,]+['"]https?://[^/'"\s\?]*\bhacklink\.us/[^><\{\}]{1,499}\$(\w+)[\s=]+\12exec[\s\(]+\1[\s\)]+;[^\?\{\}]{0,499}\becho\s*\$\14;[^\w\?]*(?:\?>|\Z)(?<X1209450>))|[\s=]+@?create_function[\s\(]+['"]{2}[\s,]+(?:\w+\s*\(|\$_[GPCSR]\w{2,6}\[)[^;]+;\s*@?\1\s*\(\s*\)\s*;\s*(?:\?>|\Z)(?<X1215710>)|[\s=]+['"][^'"]*\b(?:fcggu|uggcf)\b[^;]+;[^\}\?;]+(\$\w+)\s*=[^;]*\1\b[^\}\?]{1,499}=\s*@?(file_get_contents[\s\(]+\17\b[^;]+;)[^\?;]+(\$\w+)[\s=]+@?\18[^;]*\becho\s*\19;[^;\?]{1,199}\becho\s*['"][^\}\?\$]{1,199};\W+(?:\?>|\Z)(?<X1200770>)|[\s=]+['"][^'"]+\.php['"];\s*\$\w+[\s=]+curl_init[\s\(]+(\$_[GPCSR]\w{2,6}\[[^\]]+\])[^\?\{\}]{1,499}\bif\s*\([^\{;=]+\{\s*(\$\w+)[=\s@]+(file_)ge(t_contents)[\s\(]+\21[\s\)]+;\s*@?\23pu\24[\s\(]+\1[,\s]+\22[\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1221330>)|[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*if\s*\([^;\{]+\{\s*(\$\w+)[\s=]+wp_create_user\s*\((?:[^\);]*(?:\1|\26|\27)){3}[^\)]*\);\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\28[\s\)]+;\s*\29\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1204180>)|[\s=]+['"][^;]{0,199}\$(\w+)[\s=]+(@?fopen[\s\(]+)['"]php://input['"][^;]+;\s*(\$\w+)[\s=]+\32\$_[GPCSR]\w{2,6}\[[^\}\?]{0,199}\$(\w+)[\s=]+@?f(?:gets|read)[\s\(]+\$\31\b[^\?]{0,199}\bf(?:write|puts)[\s\(]+\33[\s,]+\$\34[\s\)]+;[^;]{0,199};\s*@?eval[\s\(]+\1[\s\)]+;\s*(?:\?>|\Z)(?<X1205980>)|[\s=]+['"][^;]{1999,}['"];\s*(function\h+)(\w+)[^\{]{1,99}(\{\s*global\s+\1;)[^\}]{1,499}\}\s*\36(\w+)[\s\(\)]+\38[^%]{1,999}\btouch\s*\(\s*__FILE__\s*,[^;]{5}[^\?]{1,999}\bif\s*\(\s*\1\b[^\?;\{]{1,99}\{\s*@?ob_start[\s\(]+['"]\37['"]\s*\);[\}\s]+\39[\s\(\)]+;\s*(?:\?>|\Z)(?<X1191920>)|[\s=]+['"]aHR0cDovL3Jlc3NpbS5uZXQv[^;]+;\s*(\$\w+)[\s=]+base64_decode[\s\(]+\1[\s\)]+;\s*(\$\w+)[\s=]+@?file_get_contents[\s\(]+\41[\s\)]+;\s*echo\s*\42;\s*(?:\?>|\Z)(?<X1207350>)|[\s=]+['"]https?://[^'"]+\.(?:pages\.dev/['"];\s*header\(['"]HTTP/\d+\.\d+[^\(]{1,99}header\(['"]Location:\h*\1['"]\);\s*exit;\s*\?>(?<X120366021>)|txt['"];\s*(\$\w+)[\s=]+(?:@?get_headers[\s\(]+\1[\s\)]+;\s*if[\s\(]+\45\[[^;]+(\$\w+)[\s=]+@?file_get_contents[\s\(]+\1[\s\)]+;\s*@?echo\s*\46;\s*(?:\}\s*)?(?:\?>|\Z)(?<X1212460>)|['"][^\.]+\.php['"];\s*(\$\w+)[\s=]+file_get_contents\(\1\);\s*if[\h\(]+\48[^\(]{1,49}file_put_contents\(\45,\s*\48\);\s*\}\s*\?>(?<X120360110>)))|[\s=]+['"]phar://['"]+\.\$_SERVER\[['"]\w+['"\]]+\.['"][^'"]{1,199}/(\w+)\.zip/\50\.php['"];\w+\(\1\);\?>(?<X1320110>)|[\s=]+\$_[GPCSR]\w{2,6}\[[^;]+;\s*if\s*\([^\);]*\1[\s\)]+(?:\{\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\1\b[^;]+;\s*(?:\}\s*)?(?:\?>|\Z)(?<X1205600>)|[\s=]+file_get_contents\(['"]https?://shop\.omiland\.co\.id[^'"]+\.txt['"]\);\s*echo\s+\1;\s*\?>(?<X120359280>)|[\s=]+range[\s\(]+chr[\s\(]+\d+[\s\)]+[\s,]+chr[\s\(]+\d+[\s\)]+;\s*@?include\s*(?:\1\[\d+\]\.){5,}\1\[\d+\];\s*(?:\?>|\Z)(?<X1216291>)|\s*=[^;]*\$_SERVER\[["']HTTP_USER_AGENT['"]\][^;]+;\s*if\s*\([^\{;]{0,499}\1\b[^;\{]{0,499}\{\s*@?echo\s*@?file_get_contents[\s\(]+['"]https?://[^;]+;[\s\}]+\?>(?<X1209230>)|\s*=\s*['"]http(?:s://hxbdoor\.one[^'"]{1,49}['"];\s*(\$\w+)\s*=\s*file_get_contents\(\1\);\s*\w+\s*\(\56\s*!==\s+false\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\56\);\s*[^;]{1,99}echo\s+['"]error['"];\s*\}\s*\?>(?<X120346601>)|s?://[^'"]{1,99}\.pages\.dev/?['"];\s*(\$\w+)\s*=\s*(curl)\w+\(\1\);\s*\59\w+\(\58[^=]{1,199}(\$\w+)\s*=\s*\59\w+\(\58\);\s*\59\w+\(\58\);\s*eval\(['"]\?>['"]\s*\.\s*\60\);\s*\?>(?<X120346731>)))|(\$\w{1,12})\h*=\h*['"]\w{0,9}['"](?:[\h\.]+(?:chr\(\d+\)[\.\h]+['"]\w{0,6}['"][^;]{0,99})?)?;\s*\$\w{1,12}[\h=]+\62[\h\(]+['"]{2}[\h,]+array[\s\(]+['"][^;]+;\s*(\$\w{1,12})[\h=]+['"]\w{0,15}['"](?:[\.\h]+chr\(\d+\)[^;]+)?;\s*(\$\w{1,12})\h*=[^,]{0,999}(\$\w{1,12})\h*=[^;]*(?:\63|\64)[\s\(]+[^;]+;\s*@?\65\h*\(\);\s*(?:\63|\64)\h*\([^;]+;\s*(?:\?>|\Z)(?<X1182354>)|(\$\w{1,14})[\s=]+\$_POST\[['"]\w{1,14}['"]\];\s*(\$\w{1,14})[\s=]+\$_POST\[['"]\w{1,14}['"]\];\s*\$\w{1,14}[\s='"]+jeffreyroush\d+@gmail\.com[^@]{1,100}@BELOW[\s\\n]+Email[:\s]+\67[\s\\n]+Password[:\s]+\68['"];(?<X2304562>)|(\$\w{1,15})[\h=]+(?:(curl_)init\(\);\s*\71setopt\(\70,\h*CURLOPT_URL,\h*['"]https://thevenon\-blois\.com/['"]\);\s*\71exec\(\70\);\s*\?>(?<X1198080>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\h\(]+!empty[\h\(]+\70[\s\)\{]+file_put_contents[\h\(]+['"]wp_\w{1,25}\.php['"],\h*\70[\h\)]+;\s*echo[^;]+;[\s\}]+\?>(?<X1206460>))|(\$\w{1,20})(?:=['"]https?://\$_SERVER\[[^\(\)]{1,40};\s*(?:if\(strpos\(\74,['"]/?(?:wp|rest)[\-_][^;\}]{1,40};\}\s*){3,6}if\([^\)]+\)[\{\s]+echo\h+['"]<script\h*src=['"]https?://\w{1,9}\.[^\?]{5,60}\.js\?\w=[\d\.]+['"][^;]{0,50};[\}\s]+(?:\$\w{1,20}=\d+;)?\?>(?<X1212490>)|[\h=]+(curl_)init\(\);\s*\76setopt[\h\(]+\74[\h,]+curlopt_url[\h,]+['"]https?://[^'"]{9,20}/seo/[^'"]{1,40}\.php['"]\);[^\?><\{\}]{0,60}(\$\w{1,20})[\h=]+\76exec[\h\(]+\74\);\s*\76close[\h\(]+\74\);\s*echo\h+\77;\s*\?>(?<X1193450>)|[\h=]+["']copy['"];\s*\74[\h\(]+['"]https?://[\d\.]{5,12}/[^'"]{1,40}\.txt['"][,\h]+['"][^'"]{1,40}\.php\d*['"][\h\)]+;\s*(?:\?>|\Z)(?<X1233021>)|[\h=]+file_get_contents[\h\(]+['"]https?://paste\.ee/\w/\w{1,9}['"]\);\s*echo\h*\74;\s*\?>(?<X1233510>))|(\$\w{1,25})[\h=]+(?:['"\.creat_funio]+;\s*(\$\w{1,25})[\h=]+['"\.base64_dco]+;\s*(\$\w{1,25})[\h=]+\81[\h\(]+['"]{2},\h*\82[\h\(]+[^\)]{9,250}[\h\)]+;\s*\83[\h\(\)]+;\s*\?>(?<X1213320>)|['"][^'"]+\.php['"];\s*(\$\w{1,25})[\h=]+['"][^'"]+/images/[^;]+;\s*if[\h\(]+\81\D{2,7}(file_exists)[\h\(]+\85[\s\)\{]+if[\h\(]+!\86[\h\(]+\81[^\{]+\{\s*@?chmod[\h\(]+\81,\h*\d+[\h\)]+;\s*@?(file_)put(_contents)\(\81,\h*\87get\88\(\85[\h\)]+;[^\}]+\}\s*\}\s*\?>(?<X1223320>)|geturlsinfo[\h\(]+['"]https?://bitbucket\.[^'"]{0,40}\bbackdoor/[^'"]{0,99}/wso\d*\.php['"][\h\)]+;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+['"]\?>['"\.]+\81[\h\)]+;(?:\?>|\Z)(?<X1222920>))|(\$\w{1,40})=['"](?:https?://api\.rexue\.org['"][^\@]{1,2200}\91(?<X2221970>)|range['"];(\$\w{1,40})=\91\([^;]+;include(?:\93\[\d+[\-\+/\*]\d+\]\.){4,}\93\[\d+[\-\+/\*]\d+\];\?>(?<X1224262>))|(\$\w{1,40})[=\s]+(?:['"][^'"]*['"]\^['"][^'"]*['"];\s*(\$\w{1,40})[=\s]+['"][^'"]*['"]\^['"][^'"]*['"];\s*\95[\(\s]+['"]\96['"][,\s]+['"][^'"]{99,999}['"]\^['"][a-z]{99,400}['"],\s*['"][a-z]+['"][\)\s]+;\s*\?>(?<X1214881>)|file_get_contents[\(\s]+['"]https?://luzlunatarotista\.com/[^'"]+\.txt['"][\)\s]+;\s*echo\s*\95;\s*\?>(?<X1233252>)))
<\?[ph\s]+(?:(\$\w{1,40})(?:[\h\=]+['"]https?\://youngmodel\.info/['"];[^\-]{0,700}\1\.urldecode([\(\s]+)\$\w{1,40}[\[\s]+\d[\]\s]+[\)\s]+;\h*((?:die|exit)\2[\)\s]+)[^\-]{0,145}Location\:\s*['"]\.\$\w{1,40}\);\s*\3;[\}\s]+\?>(?<X1206502>)|[\s='"\(]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s'"\);]*if[\s'"\(]+(?:!?(?:isset|empty)[\s'"\(]+)?\1[\s'"\)]*\{(?:\s*echo[\s='"\(@]+(?:eval|assert|system|shell_exec|exec|popen|passthru|proc_open)[\s\(]+(?:base64_decode\s*\(){0,5}\s*\1[\s'"\)]+;)+(?:\s*(?:exit|die)\b[^;]*;)?[\s\};]+(?:\?>|\Z)(?<X1198210>)|[\s=]+(array_)merge\s*\((?:\s*\$_[GPCSR]\w{2,6}\s*[,\)]){2,};\s*if\s*\(\s*\1\s*=[^\{;]{1,199}\{[^\}]{1,499}(\$\w{1,40})[\s=]+\6values\s*\(\s*\7\s*\);\s*\1[\s=]+\7\[[^\]]+\]\s*\(\s*['"]{2}\s*,\s*\7\[[^\]]+\]\s*\(\s*strrev\s*\(\s*\7\[[^;]{1,99};\s*\1\s*\(\s*\)\s*;\s*\}\s*(?:\?>|\Z)(?<X1190140>)|[\s=]+['"](register_shutdown_(function))['";\s]+\$\w{1,40}[\s=]+['"](\10_exists)['";\s]+\10\s*(\w{1,40})[\s\(\)\{]+\$\w{1,40}[\s='"]+\9['";\s]+\$\w{1,40}[\s='"]+\11['";\s]+(\$\w{1,40})[\s=]+['"]['"\h\.base64_dco]{13,40};\s*\$\w{1,40}[\s=]+\13[^;]+;[^\?]{9,999}\1\(['"]\12[\s'"\);]+(?:\?>|\Z)(?<X1207460>)|\h*=\h*@?\$_[GPRSC]\w{2,6}\h*;\h*@?\1\h*\[[^\]]+\]\h*\([^,;\n]+\1\h*\[[^\]]+\]\h*,[^,;\n]*\1\h*\[[^\]]+\][\s\)]+;\s*(?:die|exit)\b[^;]{0,19};\s*(?:\?>|\Z)(?<X1194780>)|\h*=\h*['"]base[^\v\\]{0,99}\(\h*str_replace\h*\([^\v\*]+\bsetcookie[\h\(]+['"]\w+['"]\h*,\h*\$_[GPRSC]\w{2,6}\b[^\v]+\bcreate_function[\h\(]+(?:['"]{2}|null)\h*,\h*\1[^\v]+</form>(?<X2044531>)|\s*=\s*@?urldecode\s*\(['"]%[a-f\d%]{99,999}['"][\s\)]+;\s*\$\w{1,40}\s*=\s*['"]\d+['"]\s*;\s*\$\w{1,40}\s*=(?:\s*\1\{\d+\}\s*\.){3}[^\n]{999,}\$htContents[\s\)]+;[^\?]{0,999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1204700>)|\s*=\s*['"]c['"\h\.creat_funio]{13,60}n['"]\s*;\s*(\$\w{1,40})[=\s@]+\1[\s\(]+["'](\$\w{1,40})['"]\s*,\s*['"]e[val'"\s\.]{3,19}\(['"\h\.base64_dco]{13,60}\(\s*\19[\s\);'"@]+\18[\s\(]+['"][a-z\d\+=]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1206310>)|\s*=\s*basename[\s\(]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][\s\)]+;\s*if[\s\(]+@?(?:move_uploaded_file|copy)[\s\(]+\21\s*\[[^\]]+\]\s*\[[^\]]+\][\s,]+\1[\s\)]+\{\s*echo\s*basename[\s\(]+\21\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\)[^;]{0,40};\s*\}\s*(?:\?>|\Z)(?<X1192650>)|\s*=\s*curl_init\([^;]{1,99};\s*curl_setopt\s*\(\s*\1[\s,]+CURLOPT_URL[\s,]+['"]https?://[^'"/]+/(?:hack|link){1,}/[^;]{1,99};\s*curl_exec\s*\(\s*\1\s*\);\s*(?:\?>|\Z)(?<X1191780>)|\s*=\s*exif_read_data[\(\s]+['"]https?://[^/]{3,99}/[^'"]+\.(?:jpe?g|png|ico)['"][\)\s;@]+eval[\(\s]+base64_decode[\(\s]+\1(?:\[[^\]]+\])+[\)\s]+;\s*(?:\?>|\Z)(?<X1200930>))|(\$\w{1,9})[\h=]+['"]\W{1,4}\^\W{1,4}['"];\s*(\$\w{1,9})[\h=]+['"]\W{1,4}\^\W{1,4}['"];\s*(\$\w{1,9})[\h=]+(?:\([^\w\.]+\)\h*\.?\h*){1,5};\s*\$\{\27\}\[\25\]\(\$\{\27\}\[\26\]\);\s*(?:\?>|\Z)(?<X1211550>)|(\$\{['"]GLOBALS['"]\})[^\(]{9,99}\berror_reporting\((?:0|NULL|FALSE)\);[^\{]{0,40}(\$\{\29\[[^\]]+\]\})=curl_init\(\);\s*curl_setopt\(\30,curlopt_url,(base64_decode\()['"]aHr0c[^\?>]{99,400}\beval\(\31[^\.]{1,9}\.\$\{\29\[[^\]]+\]\}\);\s*(?:\?>\s*)?\Z(?<X1232231>)|(\w)\s*\(\);\s*(\w)[\s\(]+array[\s\(]+(?:\d+\s*,\s*){9,}\d+[\s\)]+;\s*(function)\s*\34\s*\(\s*(\$\w)[\s\)]+\{\s*\$\w\s*=\s*(\w)[\s\(]+\36[^@]{99,9999}\35\s*\33\s*\([\s\)]+\{\s*if\s*\([^\?\-]+\35\s*\37\s*\((\$\w)[\s\)]+\{\s*\$\w[\s=]+array_shift[\s\(]+\38[^\}]+\}\s*return\s*\$\w[;\}\s]+(?:\?>|\Z)(?<X1201870>)|(error_reporting[\(\s]+)['"](?:\\\d+)+['"][\)\s]+;\s*define[\(\s]+['"][^'"]+['"][\s,]+['"][^'"]+['"]\s*\);\s*(\$GLOBALS\[[^\s\w]{1,40}\]?)[=\s]+array[\(\s]+[^@]{1,4999}\40\d+[\)\s]+;[^%]{1,510}\b(function)[^%]{9999,14999}\42[^\}]+\}\s*(\$\w{1,40})\s*=[^;]+;\s*(\w+)[^%]{1,6999}\41[\[\s]+\w+[\]\s]+,\s*\43[\)\s]+;\s*goto\s*\44;(?<X2222942>)|(file_)put(_contents)[\h\(]+['"][^'"]+['"][\h,]+\46get\47[\h\(]+['"]https?://raw\.githubusercontent\.com/ptacid/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1253170>)|(function)(?:\h+(\w{1,40})\(\$\w{1,40}\)[\{\s]+\$\w{1,40}[\h=]+file_get_contents\(['"]php:/[^;]+;[^\}]{49,499}\breturn\h+urldecode\([^\?>\*]{1,499}(\$\w{1,40})[\h=]+\50[^\?>\*]{99,300}(\$\w{1,40})[\h=]+\w{1,40}\([^;]+\51\);\s*(\$\w{1,40})[\h=]+create_\49\((?:null|['"]+)[,\h]+\52\);\s*@?\53[\(\);\}\s]+\?>(?<X1189800>)|\s*\w+\(\)\{\$\w+=(?:['"][^'"]*['"];print_r[^;]+;\}(\$\w+)=[^;]+;\$\w+=\$_[GPRSC]\w{2,6};(?:\$\w+=[^;]+;)+\49\s*\w+\((\$\w+),\$\w+\)\{global\55;\$\w+=['"]+;for[^@]{1,300}\49\s*(\w+)\s*\(\)[^@]{1,99}\49\s*\w+\((\$\w+),\56\)\{global\55;[^@]{1,700}\49\s*(\w+)\s*\(\56,\58[^\)]*\)[^@]+\59\(\56,\58[^\)]*\);[^\?]+\57\(\);\?>(?<X2259521>)|[^;]+;print_r[^;]+;\}(?:[^@]{1,500}\49\s*\w+\((\$\w+)[^@]{1,500}\49\s*\w+\((\$\w+),\61\)[^@]{1,800}\49\s*(\w+\(\61,\62,\$\w+\))[^@]+\63;[^\?]+\?>(?<X2259540>)|\$\w+=[^;]+;\49\s*\w+\(\)\{\$\w+=\d+;[^@]{1,100}\49\s*\w+\((\$\w+)[^@]{1,500}\49\s*\w+\((\$\w+),\65\)[^@]{1,1000}\49\s*(\w+\(\65,\66,\$\w+\))[^@]+\67;\}\?>(?<X2259530>)))|\s*curl_get_contents\((\$\w+)[^\}]+\}\49\s*getServerCont\(\69[^\}]+\}return\s*\$\w+;\}\49[^\}]+\}\49\s*(\w+)\(\69[^%]{1,9999}\70[\s\(]+\$\w+[,\s]+(\$\w+)\);[^>]+\71\);echo[^\}]{1,64}['"];\}\?>(?<X1299570>))|(goto)\s*\w{5,6};\s*\w{5,6}:\s*\$\w{5,6}[^;]+;\s*\73[^\?\n]{0,9999}\?\s*\d+[^\(]+unset\(\$\w+\);\s*\73[^@\n]{0,999}(\$\w+)\s*=\s*@preg_replace_callback\([^\)]+\74\);\s*\73[^\n]+\73\s*\w{5,6};\s*\w{5,6}:\s*\w{5,6}\(\$\w{5,6},\s*\$\w{5,6}\);\s*\?>(?<X1257112>)|//(?:\s*hiden\h*shell\b[^!]{0,9999}\bif[\(\s]+@?(?:copy|move_uploaded_file)[\(\s]+\$_FILES\h*\[[^\?]{0,999}chmod[\(\s]+['"][^'"]{1,40}\.php['"]\s*,\s*\d{1,4}\s*\)\s*;\s*\}[^;]{0,99}(?:\?>|\Z)(?<X1195120>)|\w{1,40}\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\](?:\h*=\h*['"][^'"]{1,199}['"]\h*;[^\n]{9999,}\burlencode\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\}\)\s]+;[\s\}]+//\w{1,40}\s*(?:\?>|\Z)(?<X1194680>)|\s*=\s*['"][^'"]+['"]\s*;[^\n]{999,}@header\s*\([^\)]+\)\s*;\s*echo\$\s*\{\s*\$\w{1,40}\s*\}\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*\}\s*\}\s*//\w{1,40}\s*(?:\?>|\Z)(?<X1206740>))))
<\?[ph\s]+(?:@?(?:(?:set_time_limit|error_reporting)\([^\{]{9,99}\{\s*echo\h*['"]<[^'"]+['"][\h\.]+php_uname\(\)[\h\.]+['"]<[^\?]{99,250}(\$\w{1,15})[\h=]+(\$_FILES\[['"]FUCK['"]\]\[)[^\?]{99,399}\bif\(@?(?:copy|move_uploaded_file)\(\2[^\]]+\],\h*\1[\s\)]+\{\s*(echo)[^\{]{9,99}\{\s*\3[^;]+;\s*[\}\s]+\?>(?<X1202521>)|(\w+)[\s\(]+['"][^'"]*(\.php)['"],[^;]+;\s*function\s*\5\s*\([^\{]+\{\s*(\$\w+)([\s=]+)['"]https?://[^;]+;\s*\$\w+[\s=]+@?(file_get_contents[\s\(]+)\7([\s\)]+;)\s*if\s*\([^\{;]+\{[^\}]+\}[^\}]*\$(\w+)\8[^;]+/lock\d+\6['"];[^\}]*echo\s*\9\$\11\10\s*\}\s*\?>(?<X1200820>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]\w+\.(?:avi|ogv|wav|m(?:4a|pg|kv|ov|3u8?)|jp[x2]|wbmp|tiff)['"]\)?;\s*\?>(?<X12068911>)|[peas](?:assthru|ystem|xec|hell_exec)[\s\(]+['"](?:ba)?sh\h+-[ic]\s+[^/]+/dev/tcp/\d{1,3}(?:\.\d{1,3}){3}/\d{1,5}\h+0>&1['"]*[\s\)]+;\?>(?<X120359880>)|[pes](?:assthru|ystem|xec|hell_exec)[\s\(]+(?:@?\w+[\s\(]+){0,4}\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1214230>)|echo\s*(?:(?:\(\s*)?\w+[\s\(\)]+\?\s*['"]\s*<(\w+)\b[^>]{0,99}\bstyle=['"][^'"]*font\-size:\h*0(?:p[tx]|em)?\b[^>]{0,199}>[^</>]{0,199}(?:<a\b[^>]{0,99}\bhref=['"]https?://[^>]{0,199}>[^<>/]{0,199}</a>[^></]{0,199}){1,}</\16>['"][^;]{0,99};\s*(?:\?>|\Z)(?<X1195700>)|@?file_get_contents[\s\(]+['"]https?://[a-z\-\.]{1,25}\d{2,}\.com/Backlink\d{0,4}\.txt['"][\s\)]+;\s*(?:\?>|\Z)(?<X1221380>))|echo\s+file_get_contents[\s\(]+['"]https?://[^/'"]{0,19}\bblinku12\.us/[^;]+;\s*(?:\?>|\Z)(?<X1213820>)|error_reporting(?:[\h\(]+(?:(?:0|NULL|FALSE)[\h\)];\s*(\$\w{1,20})[\h=]+@?create_function[\h\(]+['"]{2}[,\h]+base64_decode[\h\(]+['"][^'"]+["'][\h\)]+;\s*@?\20\h*\(\);\s*\?>(?<X1209591>)|0[\h\)]+;\h*@?touch[\h\(]+__(FILE)__\h*,[^;]+;\h*function\h+(\w+)\h*\([^\n\?]{1,299}\$(\w+)[\h=]+@?\22_ge(t_contents)\h*\([^;"']+['"](?:cGhwOi8vaW5wdXQ=+|php://input)['"][^\n\?]{1,1499}\b\22_pu\25\h*\([^,]+,\h*\$\24\b[^\n\?]{1,4499}\b\23\h*\([^;]+;[^\?\w\n]{0,9}(?:\?>|\Z)(?<X1207300>))|\(0\);(?:\s*session_start\s*\(\);\s*if[\(\h]+get_magic_quotes_gpc[\(\h]+\)[\)\h]+\{\s*foreach[\(\h]+(\$_POST)\h+as\s*(\$key)=>(\$value)[\s\)]+\{\s*\27\[\28\]\h*=\h*stripslashes\(\29\);\s*\}\s*\}\s*echo\s*'<!DOCTYPE\b[^']+<title></title>[^']+;[^\*]{999,}</HTML>\s*\Z(?<X1190420>)|session_start\(\);\s*(\$\w+)[^\[]{1,49}\$_SESSION\[['"]\w+['"]\]=\31[^:]{1,49}(\$\w+)=file_get_contents\(['"]php://[^'"]+['"]\);[^;]{1,49}base64_decode['"][^\?]{1,99}\32=openssl_decrypt\(\32[^\|]{1,49}explode[^\?]{1,49}echo\s+system\(\$_GET\[['"]\w+['"]\]\);die\(['"]\w+['"]\);\?>(?<X120365970>))|\h*\(0\);@?header\(['"](Content)\-Type:text/html;[^;\)]+\);define\(['"][^@\n]{999,}\breturn\h+@file_get_\34s\h*\([^\n]{999,}\{\h*@unlink[\h\(]+\$\w{1,40}[\)\h]+;[\s\}]+else\s*\{[^\?]{1,199}(?:\?>|\Z)(?<X1190164>))|eval\s*\([^;]{0,199}\bfile_get_contents[\s\(]+['"]https?://[^'"]+\.(?:gif|png|ico|jpe?g|txt)['"][^;]+;\s*(?:\?>\s*)?\Z(?<X1222630>)|file_put_contents[\s\(]+['"][^'"]+\.php['"][,\s]+(['"])<form\b[^;]{1,499}\b[cm]o(?:py|ve_uploaded_file)[\s\(]+(\$_FILES\[)[^,]+,\s*\38[^;]{1,499};[^\)]{0,499}\37\);\s*(?:\?>|\Z)(?<X1210330>)|header\s*\(['"]Content\-[^\)]+\)[;\s@]+error_r[^=\$]{1,40}\$\w{1,40}[\s=]+['"]\d+['"];\s*(\$\w{1,40})[\s=]+urldecode\(['"][^'"]{99,}['"]\);\s*function\s*(\w{1,40})\([^\[]{9,9999}isset[\s\(]+\$_[GPRSC]\w{2,6}\[\40\{\d+\}\.[^;]+;[^>]{99,}\{\s*\$\w{1,40}[\s=]+\41\([^\}]+\}[\s\};]*\w{1,40}[(\);\s]+\?>(?<X1200460>)|mail\([""][^'"]+['"],['"][^'"]{0,19}\byakpro\b[^'"]+['"],\$_SERVER\[[^\)]+\);\s*(?:\?>|\Z)(?<X1219000>)|ob_end_clean\(\);echo[^\(]{1,49}if\(isset\((\$_POST\[['"]\w+['"]\])[^\$]{1,29}(\$\w+)=\44;if\(\45===['"]\w+['"]\)\{echo\s+['"]\w+['"];die\(\);\}@?exec\(\45\);die\(\);\}\s+\?>(?<X120366402>))|@require_once\h*\([^;'"]{0,9}['"]/wp\-(?:includes|admin)/[^'"]+\.(?:css|ico)['"][\)\s]+;\s*\?>(?<X1190381>)|['"](?:\$\s*(?:\w+=)+https?://(?:\w+\.\w+/?)+\s*\w+=\d+\s*\w+=\[\d:[^\]]+\][^;]+;\$\w+=(explode)\(['"][^'"]+['"],[^;]+;(foreach)[^\}]+\};\$\w+=__FILE__;\$\w+=\48[^;]+;\49[^\}]+\};(?:function[\w\s]+[^@]{1,900}\})+(?:\$\w+=(\$GLOBALS)[^;]+;)+\49[^;]+;\};extract\(\$\w+\);(\50\[[^\]]+\])[^@]{1,4300}(\$\w+)[^>]+if\(\51[^>]+echo['"]\52['"];die;\}+[^>]+>(?<X1260620>)|error_reporting['"]\(0\);if\((isset\()(\$_[GPRSC]\w{2,6})(\[[^\]]+\])\)\&+\54\55[^\$]+\54\55(\[[^\]]+\])\)+[^@]{1,100}\beval\((?:\w+\()+['"]https?://['"]\.\55\57\.['"](?:\w+\.\w+[/\?])+\w+=['"]\.\55\56\)+;die\(\);\}elseif[^\}]+\}(?:function[\w\s]+[^\}]+\})+return[^>]+>(?<X1260610>))|[^;]+curl_init\(\$\w{1,50}\);\s{1,99}[^%]+\$result(\h{1,50})=\59curl_exec\(\$\w{1,30}\);[^%]+\$url\59=\59(['"])https://hypocriteseo\.info/shell/antidel\.txt\60;[^%]+eval\(\60\?>\60\h{1,30}\.\59\$encoded_code\);[^\>]+\?>(?<X2297120>)|[^@]{1,200}(\$\w+)=[^;]+;class\s*(\w+)\{private\s*function[\w+\s]+\(\62\)\{if\(is_array\(\63::(\$\w+)\)+[^@]{1,1400}\bpublic\s*static\64=[^;]+;\}(?:[^\?]+)?\?>(?<X1273520>)|[^\$]+(\$\w+)=['"]3c3f7068700d0a20676f746f2045497937793b2061696e[^'"]+['"][;\s]+(\$\w+)=hex2bin\(\66[\);\s]+eval\(['"]\?>['"]\.\67\);(?:\?>|\Z)(?<X2307042>)|[^\?;\$]{0,99}\bSasKraXploit\h*shell\h*V(?<X2210252>)|[^\[]{10,499}\[sys_get_temp_dir[^;]{10,999};\$\w+=hex2bin\(\$_[GPRSC]\w{2,6}\[[^/]+implode\(['"]/['"],[^=]+=file_put_contents\((\$\w+),[^\{]+\{include\70;unlink\(\70\);(?:exit|die);\}{4}\Z(?<X1319130>)|[^\\]+echo\s*['"]\\[^;]+;\s*\$\w+\s*=\s*['"]\\[^'"]{99,}['"];\s*\$\w+\s*=\s*base64_decode\(file_get_contents\(\$\w+\)\);\s*eval\(\$\w+\);\s*echo\s*['"]\\[^'"]{99,}['"];\Z(?<X1315032>)|[^\{=]{0,49}\bif\s*\(\s*\$_[GCPSR]\w{2,6}\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[\s*['"][^'"]{1,40}['"]\s*\]\s*\[\s*['"][^'"]{1,40}['"]\s*\][^`]{1,200}\s*\}\s*else\s*\{\s*echo\s*['"][^`]{0,40}gagal[^`]{0,40}['"]\s*;\s*\}\s\}\s*else\s*\{\s*[^`]{0,200}\s*\}\s*(?:\?>|\Z)(?<X1042221>)|[^_]{1,20}ini_set\(['"]display_errors['"],\s*0\);[^&]+&&\s*\(strpos\(@?\$_SERVER\[['"]REQUEST_URI['"]\],\s*['"]/wp\-admin/admin\-ajax\.php['"]\)\s*={3}\s*false[^\{]+\{\s*print\(base64_decode\(['"]PHNjcmlwd[^'"]+['"][\);]+\s*\}[\s\*/]*(?:\?>|\Z)(?<X1308671>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\h\(]+['"]wp\-[^/]+/images/[\w\h\\]+\.txt['"][\)\h]+;\s*\?>(?<X1206431>)|[\h\(]['"]/(?:home|var)[^'"]+\bpublic_html/\w+\.txt['"][\h\)]+;[^\?]{0,99}\?>(?<X1217220>)|\(?['"]img/\w+\.(?:jpe?g|gif|bmp|txt|ico)['"]\)?;\s*\?>(?<X1212240>)))
<\?[ph\s]+(?:\$(?:(?:bot){1,3}[\h=]+['"]?\d+['"]?;\s*error_reporting\((?:0|NULL)\);\h*ignore_user_abort\(true\)[^\n\?]{6000,20000}\b(?:include|unlink)[\h\(]+[^\)]+[\h\)]+;\s*\?>(?<X1213330>)|\w+=['"]\%\{\d+\}\%['"];(\$\w+)=['"][^'"]*['"];(?:\$\w+=(?:\2\[\d+\][\.;])+)+if\(\!function_exists\(['"](\w+)['"]\)+\{function\s*\3\((?:\$\w+[,\)])+\{return\s*trim\(preg_replace[^;]+;[^\n>]{99,9999}(\$\w+)=\$\{['"]_SERVER['"]\}[^\n&]{999,}\bunset\(\$\w+,\$\w+,\4,\$\w+,\$\w+[\)\h;]+exit[^>]+\?>(?<X2259011>)|\w+=['"]base64\w+['"];\$\w+=['"]file_put\w+['"];\$\w+=[^;]+;\$\w+=['"]\.\w+['"];[^@]{1,5400}(\$\w+)=explode\([^;]+;if\(\w+\s*\(\6\[\d+\],\6[^@]{1,1400}\b(global)(\$\w+);[^@]{1,20000}\6\);\}+\7\8;[^@]{1,1000}(\$\w+)=rand[^@]{1,1000}\8->\w+[^@]{1,1550}(\$\w+)\[[^\]]+\][^@]{1,1000}\9,\10\)+;\}\?>(?<X1265862>)|\w+=['"]http[^;]+;function\s*\w+\([^%]{1,100}(\$\w+)=curl_init\(\);[^@]{1,200}(\$\w+)=(?:curl_(?:exec|close)\(\12\);)+return\13[^@]{1,600}func\w+\s(\w+)[^@]{1,1000}(\$\w+)=\$_[GPRSC]\w{2,6}[^;]+;[^@]{1,100}(\$\w+)=\$\w+\.['"]/\w+.php[^@]{1,200}(\$\w+)[^@]{1,100}\17\[[^\]]+\]=\15;[^@]+echo\s*\14\(\16,\17\);(?:return|exit);\}\?>(?<X1247671>)|\w+=['"]str(?:_rot13['"];\$\w+=['"]base64_decode['"];ini_set\(['"]error_log['"][^\?]{1,49}error_reporting\(0\);\?><script>(function)(_0x)\w+\(\20\w+[^\-]{1,99}\19\(\20\w+[^/]{1,99}\20\w+,\20\w+\);\}\s*</script>(?<X120367291>)|rev['"];\$\w+=['"]base64_decode['"];(?:\$\w+=['"]str_rot13['"];\$\w+=['"]gzinflate['"];ini_set\(['"]error_log['"],NULL\);error_reporting\(0\);\?>\Z(?<X120342020>)|error_reporting\(0\);\?>(?<X120355050>)))|\w+=[^;]+;(?:(?:[^;]+;)?function\s*\w+\((\$\w+)\)\{global\$\w+;[^(]+\(\24\s*(?:as\$\w+)?\)\{(\$\w+)[^}]+\}return\25;}(\$\w+)=\[\];[^@]+(\$\w+)=\$_COOKIE;[^@]+foreach\(\27\s*as\$\w+=>(\$\w+)\)\{function\s*(\w+)\(\26[^@]+\28\^\29\(\26,\$\w+,\26\[\w+\]\(\28\)+;\}(?<X2251351>)|function\s*\w+\((\$\w+)\)\{(\$\w+)=[^;]+;(\$\w+)=[^;]+;(\$\w+)=[^;]+;\31=\34\(\32\(\33\(\31\)+;return\31;\}function\s*\w+\(\$\w+,(\$\w+)\)[^@\n]{99,}(\$\w+)=['"]serialize['"];echo\36\(\35\);\}[^\}]+\}(?<X2259551>)|seT_time_limiT\(+int\)round\((?:\d+[\+\)])+[^;]+;deFIne\(['"]\w+['"],['"]https?://[^;]+;define\(['"]\w+['"],(\w+)\(\)\);(function)\s*(\w+)[^@]+(\$\w+)=\40[^;]+;\39\38[^@]+\39\s*(\w+)\(\$\w+=null[^@]+(\$\w+)=array\([^@]+\42\(\)[^\(]{1,100}\40[^@]+\41[^@]+\43\[['"]\w+['"]\]=['"]\d+['"];\};\?>(?<X1250030>))|\w+=[^\.]{1,99}\.chr\([^\)]+\)[^;]+;\$\w+=['"]class_exists['"];(\$\w+)[^;]+;class\s*(\w+)\{private\s*function[\w\s]+\(\45\)\{if\(is_array\(\46::(\$\w+)\)+[^@\n\*]{1,1999}\bpublic\s*static\47=[^;]+;\}\?>(?<X1273503>)|\w+=array\([^;]{9999,};if\(!isset\(\$_COOKIE\[['"](\w+)['"]\]\)+\{?echo\s*['"]<(script)\b[^>]{0,49}\bsrc=(?:https?:)?//127\.0\.0\.1/\49\.php\b[^>]{0,99}>\s*</\50>['"];(?:exit|die)\b[^;]{0,19};[^\?/]{1,499}\beval\([^;]{999,};(?:\?>)?\Z(?<X2220420>)|\w+=explode\([^#@]{999,9999}=(\$GLOBALS\[)[^\]]+\]\(\52[^\)]+\)\?\52[^\]]+\]\([^:;\{]{1,99}:\52[^\]]+\]\(\52[^\?]{1,999}\}function\s*(\w+\(\))\{eval\(\$\w+\[[^;]+;\w+\(\);\}\53;?(?:\?>|\Z)(?<X2223541>)|\w+['"=]+[^;]+;\$\w+[^:]+://(kod)\d+\.themelicense\.net/\55/\w+\.php\?[^;]+;(\$\w+)=\w+[^;][^\n]{1,99}(\$\w+)=curl_exec\(\56\);\w+\(\56\);echo\57;\?>(?<X1304300>)|\w+[\h=]+['"]https?://[^'"]+['"];(?:\h*\$\w+[\h=]+['"][^'"]*['"];)?\h*(function)\h*(\w+\(\))\{[^\}]+\}\h*\59\h*curl_get_contents\b[^\n]{99,4999}\b(main_shell)['"]\][\h=]+\$\61;\}\h*\$referer[^\n]{99,999}\bgetServerCont\d*\([^\)]+\);[^;]{0,9}\60;+\}\s*\?>(?<X1240631>)|\w+[\s='"]+PHNjcmlwdD[^'"]{1,128}1zczUoIlkyOXVjM1FnYUdwMmNpQTlJRn[^'"]+['"];\s*\w+['"\(]+\w+['",\s]+\$\w+\s*\);\s*\?>(?<X1304092>)|\w+[\s=]+['"]https?://[^'"]+(?:\.txt|text)['"];\s*(\$\w+)[\s=]+(curl)\w+\([^\(]{1,49}\65\w+\(\64,[^=]{1,99}(\$\w+)[\s=]+\65\w+\(\64\);\s*\65\w+\(\64\);\s*echo\s+\66;\s*\?>(?<X120357672>)|\w+[\s=]+array_merge[\s\(]+(?:\$_[GPSRC]\w{2,6}[,\s\)]+){2,};\s*(\$\w+)[\s=]+['"][^'"]+['"];\s*\$\w+[\s=]+strtoupper[\s\(]+['"]HTTP_['"][\s\.]+\68[\s\)]+;[^\}]{1,499}\bfile_put_contents[\s\(]+(\$\w+)[^,;]*,\s*['"]<\?[^;]+;\s*@?include[\s\(]*\69[\s\)]*;[^;]*\bunlink[\s\(]+\69[\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1213670>)|\w+[\s=]+strtolower\(\$_SERVER[^\{]{1,229}(\$\w+)[\s=]+(?:false|true);\s*foreach[^\.]{1,199}\71\)\s*\{\s*if[\h\(]+file_exists\(['"][^\.]+\.html['"][^!]{1,119}echo[^;]{1,99};\s*\}\s*exit;\s*\}\s*\?>(?<X120365391>)|\w+\h*\(['"]Location:\h*https?://(?:[\w\-]+\.)?travelfornamewalking\.ga/[^'"]+['"]\);\s*\?>(?<X120343820>)|\w+\s*=\s*(?:(['"])https?://eljonwiguna\.shop[^?]{99,}curl_close\(\$\w+[);\s]+eval\s*\(\74\?>\74\.\$\w+\);\s*(?:\?>\Z|\Z)(?<X1299553>)|['"]9c5940281e3f5c62a066a56e7c2a88fc['"][^\$]{1,29}(\$_SERVER)\[['"]HTTP_USER_AGENT['"]\]\)\)\s*\{[^\(]{1,29}array[^\}]{1,199}\(['"]HTTP/\d+\.\d+[^'"]+['"]\);\s*exit;[^\{]{1,29}function\s+(\w+)[^\?]{1,239}unix[^\[]{1,399}\[(md5)\(\76[^!]{1,129}\78\(\76\[['"]HTTP_HOST['"][^\?]{1,29}\77\(\);\s*\?>(?<X120346870>))|\w{1,15}[\h=]+\$_COOKIE;\h*(\$\w{1,15})[\h=]+\d+;[^\n]{0,99}\bbreak;\h*\80\+\+;\h*(\$\w{1,15})\[\80\]=[^\n]{0,99}\81\[\d+\]\(\81\[\d+\]\(\$\w{1,15}\[\d+\][\h\)]+;\h*\}\h*[ir][ne][cq][lu][ui][dr]e(?:_once)?\(\80\);\s*\?>(?<X1215090>)|\w{1,25}[\h=]+file_put_contents\(['"](\w{1,25}\.php)['"],\h*['"]<\?php\h*['"]\h*\.\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\.\h*['"]\h*\?>['"]\);\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]\83['"];\s*\?>(?<X1201790>)|\w{1,40}=['"]\w+['"];\$\w{1,40}=\d+;\$\w{1,40}=['"](?:\w[/\-])+\w+\.\w+['"];\$\w{1,40}=\d+;(?:\$\w{1,40}=((\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\])\([^;]+\)+;)+[^@]{1,12689}\$(\w{1,40})=\86\w+['"]\][^@]+\85[^@]+\bexit\(\);\}['"]\);\86\87['"]\]\(\);function[\w\s]+\(\$\w{1,40},(\$\w{1,40})[^\?]+,\d+,\88\);\}\?>(?<X1233091>)|\w{1,40}[=\s]+['"][^"'\$]{1,9}['"]\s*;\s*\$\w{1,40}[=\s]+['"]https?://['"]\s*\.\s*\$\w{1,40}\s*\.\s*['"][^'"]+\.(?:xyz|top)['"]\s*;\s*function\s*\w{1,12}get_contents\s*\((?:[^>]{9,9999}>){6,8}\s*0[^>]+else\s*\{\s*@?header\(['"]HTTP/\d+\.\d+\s*404\s*Not\s*Found['"][\);\s]+\}\s*\?>(?<X1205200>)|\w{1,40}[\s=]+['"]\d+['"][\s;]+(\$\w{1,40})\s*=[\s\("']+[^'"\)\s]{18,}["'\)\s]+;(?:\s*\$\w{1,40}\s*=(?:\s*\91\[\d+\]\s*\.)+\s*\91\[\d+\];)+\s*@?header\([^\)]+\);\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^\*]{999,}\bunset\b[^;]+;\s*exit\b[\(\)\}'"\s;]+\$\{['"][^;]+\(\);\s*\?>(?<X1206100>)|\w{1,40}\h*=\h*base64_decode\h*\(\h*['"]ZnVuY3Rpb24gcGgo[a-z\d\+/]{999,1999}=*['"][\h\)]+;\s*@?eval[\(\h]+\$\w{1,40}\)\h*;\s*(?:\?>|\Z)(?<X1189070>)|\w{1,40}\s*=\s*(?:"[^"]*"\s*;\s*if\s*\(\s*\$_(?:GET|POST)\s*\[\s*pass\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}[=\s]+"[^"]*"\s*;\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\][=\s]+"[^"]*"\s*;[^\v]{999,5000}/>\s*</form>\s*<\?[ph\s]+\}\s*\?>(?<X1036761>)|\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*if[\(\s]+preg_match[\(\s]+['"]/[\(\s]+android\|[^:\n]{99,9999}\bheader[\s\(]+['"]Location:\s*https?://(?:bit|molingvarballheart|xxxconent)\.(?:ly|cf|biz)/(?:\w{1,39}/?\s*){1,2}['"][\s\)]+;\s*\?>(?<X1202920>))|\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{3,40}['"]\h*;\h*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=[^\n]{9999,}\bappend_each\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\},[^;\.]+\.\h*urlencode\([^;]+;[\}\s]+(?:\?>|\Z)(?<X1194510>)|\{['"]\\[^\n]{1,999}\$\w+=['"]ch['"];\s*\$\{['"]\\[^\n]+eval\(\$\{\$\{['"]\\[^\}]+\}\[[^\{]+\.\$\{\$\{[^\}]+\}\s*\[[^\}]+\}\);\}\w+\{echo['"][^\\]+\\x[^;]+;\}{2}\s*\?>(?<X1309170>)|upgrading[\s=]+time\(\);exit;\s*\?>(?<X120362631>))|\@touch[\(\s]+(['"]\w*\.(?:txt|php|js)?['"])[\)\s]+;(\s*echo\s*\@eval[\(\s]+\@file_get_contents\()\@\$_[GPRSC]\w{2,6}[^;]+;\100\99[\)\s]+;\s*\?>\s*<\!\-+Null\_Route\-+>(?<X1216780>)|\beval\((?:(str_rot13)\(gzinflate\(\102\(base64_decode\(['"]LUnFEu3IDf2a[^\)]+\){5};\s*\?>(?<X1262152>)|base64_decode\(['"]JGM9In4rZCgpIl4iIXsre30iOyRiPSR7JGN[^'"]{10,999}['"]\)\)\?>(?<X1319311>))|\h*echo\h*file_get_contents[\h\(]+['"]https?://raw\.githubusercontent\.com/[^/]{0,15}e?xploit/[^'"]{1,40}\.txt['"]\);\s*\?>(?<X1220940>))
<\?[ph\s]+(?:\s*(?:(\$\w+)[\s=]+file_get_contents[\h\(]+['"]h?https?://[^\.]{1,99}\.pages\.dev[^'"]+\.txt['"][\h\)]+;\s*echo\s+\1;\s*(?:\?>)?(?<X120352414>)|/\*\*\s*Build:[^%]{1,199}if\(function_exists\(['"](error_reporting)['"]\)\)\{\s*@?\3\(0\);\s*\}\s*(?:\$\w+[\s=]+\d+;\s*){5,}(?:if\(!defined\(['"]\w+['"]\)\)\s*define\(['"]\w+['"],\d+\);\s*){4,}class\s*\w+\s*\{\s*function\s*__call\((?<X220369590>))|\w+\s*(?:\(isset\(\$_GET\[[^\}]{1,199}['"\);\s]+echo\s*\$\w+\(['"]ls\s*\-al[^=]{1,99}=\s*['"]PD9[^'"]{999,}['"];\s*file_put_contents\(['"][^\.]{1,32}\.php['"],\s+base64_decode\([^\}]+done!['"];\s*\w+[;\s]+\}\s*(?:die|exit)\(\);\s*\}\s*\?>(?<X1316891>)|\w+\([^\{]{1,99}\{\w+\(\w+\(['"]\w+['"]\){2}[^\}]+\}\w+\(\w+\(['"]\w+[^\}]+\}[^>]+//view\.repair/\w+\.php[^>]{1,999}><\?[^?]+\?print['"]<(div)[^?]+\6>['"];\}{2}\?>(?<X1321980>))|add_(?:action\(['"](?:send_headers|pre_user_query|init)['"],function[^@]{1,899}hash_hmac\(['"]sha256['"],['"]magic_login['"],AUTH_KEY\.SECURE_AUTH_KEY\);if\(!hash_equals[^!]{1,199}(\$\w+)=intval\(get_option[^\?]{1,199}\8,['"]administrator['"]\)\)return;wp_(?:set|clear)_auth_cookie\((?<X220366294>)|filter\(['"]pre_update_option_active_plugins['"],\s*function\([^%]{1,399}@?file_put_contents\(\$\w+,\s*base64_decode[^\?]{1,99}get_option\(['"](active_plugins)[^\}]{1,99}update_option\(['"]\10[^\?]{1,99}\$_GET\[[^@]{1,499}hash_equals\((?<X220366330>))|class(?:\h*(\w+)(?:[\{\s]+public\h*function\h*(\w+\(\))[\{\s]+(\$\w{1,20})[\h=]+['"\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]['"\s]+;\s*return\h*\14;[\}\s]+\14[\h=]+new\h*\12\(\);\s*(\$\w{1,20})[\h=]+\14[\h\->]+\13;\s*@?eval[\h\(]+\15[\h\)]+;[^\?]{0,30}(?:\?>|\Z)(?<X1233031>)|\h*\{(?:[^\?]{99,700}\bstream_wrapper_register[\h\(]+['"](mem)['"],\h*['"]\12['"][\h\)]+;\s*(\$\w+)[\h=]+['"]PD9waH[^'"]+['"];\s*(\$\w+)[\h=]+base64_decode[\h\(]+\18[\h\)]+;\s*\$GLOBALS\[['"](malicious_code)['"]\][\h=]+\19;\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]\17://\20['"];\s*\?>(?<X120369090>)|\h*private\h*\$\w+;[^\n]{99,999}\breturn\h*\[\h*['"]encryption['"][\h=>]+substr\(\$\w+,[^\n]{99,399}(\$\w+)[\h=]+new\h*\12\(['"][^'"]{1,99}['"]\);\h*(\$\w+)[\h=]+['"][^'"]{3000,7000}['"];\h*(\$\w+)[\h=]+\22\->decrypt\(\23\);\h*eval\(\24\);\h*\?>(?<X1318170>)))|(?:\h+(\w+)\s*\{[^\?]{1,999}\bfunction\h+(\w+)[\s\(\)]+\{\s*(\$\w+)[\s=]+\$_[GPCSR]\w{2,6};\s*\(\s*\28\b(?:[^;]{0,99}\28\[\26::\w+\(\d+\)\]){2}[^;:]+:\s*\28;\s*return\s*\26\s*::\s*\w+\(\d+\);\s*\}\s*\27\(\);\s*(?:\?>\s*)?\Z(?<X1213471>)|\s*(\w+)\{private\$(\w+);public\s*function__construct\(\)\{(\$this)\->\31=hex2bin\(addslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;\}+(\$\w+)=function\(\)\{return\32\->\31;\};eval\(\33\->call\(new\s*\30\)+;\?>(?<X1269440>)|\s*\w{1,20}[\{\s]+private\s*static[^;]{1,30};\s*(?:public\h*static\h*)?(function)\s*\w+\([^\{]+[^;]{0,60}\bself::(\w+\(\));[^\{]{0,60}\b\35\s*\36[\{\s]+[^\{]{9,199}\35\s*(\w+)\([^\}]{99,400}\beval\([^;]+;\s*return\s*\w+::\w[^\};]+;\s*\}\s*\37\(\);\s*(?:\?>)?\Z(?<X1253971>)|\w+\{private\s*static(\$\w+);static\s*function\s*\w+\((\$\w+),(\$\w+)\)\{if\(\!self::\39\)self::(\w+)\(\);\$\w+=strlen\(\41\);(\$\w+)=base64_decode\(self::\39\[\40\]\);for[^@]{1,200}return\43;\}([^@]{1,100}function\s*\42\(\)\{self::\39=array\()(?:['"]_\w{0,4}['"]=>['"][^\,]+,)+\);\}+class[^@]{1,100}\39\[\40\];\}\44(?<X2304750>)))|clearstatcache\(\);\s*\$\w+[^\?]{1,199}(\$\w+)[\s=]+@fopen\(['"]\w+\.txt['"],\s*['"]\w+['"]\);\s*if[\h\(]+\46[^\\]{1,99}(\$\w+)[\s=]+str_replace[^;]+\47\);\s*\47[\s=]+html_entity_decode\(\47\)[^\(]{1,49}echo\s+\47[^@]{1,399}(\$\w+)[\s=]+explode[^\{]{1,49}mysqli_connect\(\48\[\d+\](?<X220370200>)|echo(?:[\h\('"]+<form\b[^;]{4,99}['"]post['"][^;]+;[^\}\?\{]{0,99}(\$\w{1,40})[\h\=]+(\$_FILES\h*\[[^\]]+\])\[[^\]]+\];[^\}\?\{]{0,99}if[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\?]{0,499}\bif[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\51[^,;]+,\h*\50\b[^\?=]{4,499}\}(?:\s*;)?\s*(?:\?>|\Z)(?<X1189960>)|[\h\(]+is_front_page\(\)\)[\h\?]+['"]<span\h+style=['"]display:block;\s*(?:(?:font\-size|height):0;\s*){2}['"]><[^/\?]{9,150}<a\h+href=['"]https?://anabol\-it\.com/[^:\?]{99,400}</span>['"][:'";\h]{3,7}\s*\?>(?<X1196880>)|[\s\('"]+<[^;\.]{0,99}\.\s*php_uname\s*\(\)[^\?]{99,9999}\bdeface[\W]{0,9}<[^;]*;\s*(?:\?>|\Z)(?<X1195350>)|\h*file_get_contents[\h\(]+['"]https:?//[^/]+/link\.txt['"][\h\)]+;\s*\?>(?<X1215850>)|\s*(?:@?file_get_contents[\(\s'"]+https?://\w+\.blinku12\.us/api\.php['"\);\s]+(?:\?>|\Z)(?<X1213121>)|['"]live\s+site\s*\-\s*version\s+check\s*['"]\s*\.[^\?]{1,99}(?:exit|die);\s*\?>(?<X120346920>)|[^\(;]+getcwd\([^\(;]+php_uname\([^\(;]+\.implode\([^\(;]+scandir[^@]{1,250}<input[^>]+value=['"]Up[^\?]+<\?[ph\}\s]+if[\(\s]+\!empty\((\$_FILES\[[^\]]+\])[\)\{\s]+(\$\w+)[^;]+;[;\s]+\59[=\s]+\59[\.\s]+basename[\(\s]+\58[^;]+;[;\s]+if[\(\s]+(?:move_uploaded_file|copy)[\(\s]+\58[^\);]+\59[^\?]+\?>(?<X1255333>)|file_get_contents[\(\s]+['"]https://[^/]{0,20}slotonline[^/]{0,20}\.\w{2,3}[^'"]+\.(?:php|txt)['"][\s\)]+;\s*\?>(?<X1232691>))))
<\?[ph\s]+e(?:rror_reporting(?:[\(\s]+(?:0[\)\s;@]+header[\(\s'"]+Content\-Type[^\$]{1,999}(?:\$\w{1,40}[=\s]+['"][^\|]{1,190};)+(?:\$\w{1,40}[=\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\]\s*;)+\$\w{1,40}[=\s]+[\(\s]+isset[\(\s]+\1[^:\n]{99,9999}://[^\n]{99,}(\$\w{1,40})[=\s@]+fopen[^>\n]+fclose[\(\s]+\2[^>\n]+(?:\?>|\Z)(?<X1239731>)|\d[\)\s]+;(\$\w{1,40})[=\s]+[^;]+;(\$\w{1,40})[=\s]+\4[\(\s]+(?:['"][^'"]*['"][,\)\s]+)+;\$\w{1,40}[=\s]+\$[\{\s]+(?:\5[\[\s]+\d+\+\d+[\]\s]+[\.\}\s]+)+;[^\%]{1,300}class\s*(\w+)[^\%]{1,600}static\s*func\w+\s*(\w+)[^\%]{1,1200}\b\6::\7[^;]+;eval[\(\s]+base64\w+[^\)]+[^;]+;\?>(?<X1226120>))|(?:[\h\(]+(?:0|NULL)[\h\)]+;\s*(?:(\$\w+)[\h=]+['"]https?://paste\.ee/\w/\w+['"];[^#]{999,2000}\bisset[\h\(]+\$_COOKIE\[[^\]]+\]\)\h*or\s*in_array\([^\{]+\{\s*echo\h*implode[\h\(]+['"]+,\s*file[\h\(]+\9[\h\)]+;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1295000>)|(\$\w{1,25})[\h=]+\$\{['"][_COOKIE\\xfb5439]{7,28}['"]\};\s*if[\h\(]+in_array[\h\(]+gettype[\h\(]+\11[^\}]{9,199}\(\$\{\11\[\d+\]\}\[\d+\][\h\)]+;\s*\11[\h\(\)]+;\s*\}\s*(\$\w{1,25})[\h\=]+array[\h\(]+\$\{['"][^\?]{99,599}\?\h*\12\[\d+\]\h*\([^\?]{0,99}\?>(?<X1207992>))|[\s\(]+(?:0|NULL|False)[\s\)]+;\s*@?header[\s\(]+['"]content\-type[:\h]+text/html;[^;]+;\s*\$\w+[\s=]+['"](\w+)['"];[^#]{1,1999}=\s*['"]https?://\14\.[^'"\?]+\.php\?[^\?]{1,999}\bstri?str[\s\(]+\$\w+[,\s]+['"]okhtmlgetcontent['"][^#]{1,9999}=\s*fwrite\s*\([^;]+;[^\}]{0,99}\}\s*(?:\?>|\Z)(?<X1213100>)|\((?:0|NULL)\);\s*(?:@?session_start\(\);\s*class\h*(crawler)\s*\{\s*private[^%`]{999,7500}\bcurl_close\(\$\w{1,15}\);\s*return\s*\$\w{1,15};[\s\}]+(\$\w{1,15})[\h=]+new\s*\16\(\);\s*\17->doAction\(\);\s*\?>(?<X1210751>)|\$\w{1,25}[\h=]+['"][^\?]{9,399}(\$\w{1,25})[\h=\.]+chr[\(\h]+\$\w{1,25}\h*\^\h*ord\([^\)]+[\h\)]+;\s*(\$\w{1,25})[\h=]+\19[\h\(]+['"]{2},\h*\$\w{1,25}[\h\(]+[^\)]+[\h\)]+;\s*\20[\h\(\)]+;(?<X2207963>)|if[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+base64_decode[\h\(]+stripslashes[\h\(]+\22[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1211670>))|\((?:0|NULL)\)[^\{]{0,99}\bfunction\h*(\w{1,25})\(\$\w{1,25}\)\{[^\{]{1,199}\{\s*(\$\w{1,25})[\h\.=]+pack[\h\(]+['"]\w['"],\h*hexdec\b[^\}]+\}\s*return\h*\25;\s*\}\s*(\$\w{1,25})[\h\=]+\24\([^;]{1000,};['"];[^;]{0,250};\s*(\$\w{1,25})[\h=]+@?\$\w+\(['"]{2},\h*\26\);\s*\27[\h\(\)]+;\s*\?>(?<X1211321>)|\(0\);(\$\w+)=(?:['"](?:[^\$'"]*['"];(\$\w+)+=['"]hex2bin['"];(\$\w+)+=explode\([^\$]+\30\(['"][^$'"]*['"]\)+;eval\(\31\[\d+\]\(\31\[\d+\]\(\31\[\d+\]\(\29\)+;\?>(?<X1253643>)|https://[^;]+;function\s+\w+\((\$\w+),(\$\w+)\)\{list\((\$\w+),\$\w+\)=explode[^@]{1,20}\34\);\$\w+=ip2long\(\33\);\$\w+=ip2long\(\35\);[^@]{1,1300}isset\(\$_COOKIE[^@]{1,10}[or\s]+in_array[^\{]+\{echo\s+implode[^;]+file\(\29\)+;(?:die|exit)\((?:[^(]+)?\);\}+\?>(?<X1322840>))|isset(\(\$_[GPRSC]\w{1,6}\[[^\]]+\]\))\?urlencode\37[^;]+;function\s*\w+\(\)\{foreach\(\[(?:['"](?:HTTP_\w+|REMOTE\w+)?['"][,\]])+[^@]{1,400}\bstr_rot13[^@]{1,90}\29[^;]+;(?:curl_setopt[^;]+;)+(\$\w+)=json_decode[^@]{1,100}\bheader\(['"]Location:\s*['"]\.\38\->\w+,\w+,\d+\);exit;\}+(?<X1265440>))|\(0\);(?:(\$\w+)[^:]{1,99}https?://[^'"]+\.txt['"][^!]{1,199}\$_SERVER\[[^=]{1,49}(\$\w+)[^!]{1,99}foreach\(\41[^:]{1,299}User\-Agent:\s+['"]\.\40\[['"][^\[]{1,99}file_get_contents\(\40\[[^\[]{1,149}\40\[[^\}]{1,49}exit;\}\?>(?<X120370240>)|\s*http_response_code\(404\);\s*eval\([^\(]{1,99}(urldecode)\([^\(]{1,99}file_get_contents\([^\(]{1,99}\43\([^:]{1,99}https?://[^'"]+\.txt['"]\s*\)\s*\)\s*\);\s*\?>(?<X120370121>)|header\([^\)]+\);(\$\w+)=[^;]+;(\$\w+)=(?:[^;]+;){2}(\$\w+)=urldecode\(\46\);[^@]{1,100}(\$\w+)=\$_[GPRSC]\w{2,6}\[[^\]]+\];[^@]{1,1000}\b\w+\(\47,\45[^;]+;\}if\(strstr\(\48,[^\)]+\)+[^@]{1,4000}\bfunction[\s\w]+\(\47,(?:\$\w+[,\)])+\{(\$\w+)=fopen\(\$\w+[^\)]+\)[^;]+;(\$\w+)=fwrite\(\49[^;]+;fclose\(\49\);return\50[^>]+>(?<X1260690>)|ini_set[^\?]{1,49}(\$\w+)=['"]shell_exec['"];\$\w+=\$_GET[^<]{1,199}if\(move_uploaded_file\(\$_FILE[^%]{1,299}(\$\w+)=explode[^<]{1,49}foreach\(\53[^%]{1,499}if\((function_exists)\(\52\)\)\{echo\52\((\$\w+)\);\}elseif\(\54\((\$\w+)\)\)\{\56\(\55\);\}[^!]{1,599}file_put_contents(?<X220367610>))|\(0\)[;\s]+\$\w+[=\s]+getcwd[^@]+@?rmdir\(\$\w+\)[;\s]+@?(shell_exec)\(['"]rm[^;]+[;\s]+@\58[^@]+if\s*\(@?mkdir\(\$\w+\.['"]/['"]\.\$\w+[^@]+@?shell_exec\(\$\w+\)[^@]+@\58\(['"]wget[^\.]+\.php_uname[^\+]+\+[^/]+/script></body></html>(?<X1312460>)))|val[\(\s]+['"]\s*function\s*(\w+)[\(\s\)]+\{(?:\s*(\$\w{1,40})[=\s]+['"]ba['"]\.['"]s['"][^'"\$]+['"]ode['"];){2,}[^%]{1,700}\61[\s\(]+['"][^'"]+['"][^\?]{1,150}\bcatch[\s\(]+Exception\s*\$\w+\)[\s\{\}]+add_action[\s\(]+['"]\w+['"][\s,]+['"]\60['"][\s\)'";]+\?>(?<X1229641>)|val\((?:[^\(]{1,29}(urldecode)[^:]{1,99}\63[^\.]{1,49}['"]https?://\d+\.\d+\.\d+\.\d+[^'"]{1,99}\.txt['"]\s*\)\s*\)\s*\);\s*\?>(?<X120346642>)|[^\(]{1,49}(urldecode)\([^/]{1,49}file_get_contents\\*\([^\(]{1,49}\65\([^'"]{1,49}['"]https?://[^'"]+\.txt['"]\s*\)\s*\)\s*\);\s*\?>(?<X120347240>)|base64_decode\((?:['"]Ly9NYXUgYXBh[^'"]+ZqRlM6IA==['"]\)\);\s*\?>(?<X120357710>)|file_get_contents\(['"]https?://debugilaton\.com[^'"]+['"]\)\)\);\s*\?>(?<X120348251>))|file_get_contents\(['"]https?://recaptcha\-in\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml)/[^'"]{1,40}['"][\)\h]+;\s*\?>(?<X1203990>)))
<\?[ph\s]+(?:function(?:[\w\s]+\((\$\w+)\)\{(\$\w+)=curl_init\(\);(curl_setopt)\(\2[^@]{1,500}\3\(\2[^\$]+\$\w+=curl_exec\(\2\);curl_close\(\2\);return[^@]{1,700}\bfunction\s([\w\s]+)\(\1,\$\w+=array\(\)[^@]{1,1400}(\$\w+)\[\]=array\(\);(?:\5\[[^\]]+\]=\$\w+;)+if[^@]{1,9999}\$\w+=\4\(\$\w+,\5\);[^>]+>(?<X1286080>)|\h*(?:(\w{1,40})\h*\(\)\s*\{\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*str_rot13\s*\(\s*['"]uggc[^;]+;\s*echo[\h'"\(]+\8[\h'"\)]*;\s*\}\s*\7[\(\s\)]+;\s*(?:\?>|\Z)(?<X1195741>)|(isreferrerfromgoogle)\(\)\s*\{[^\[]{1,99}isset\(\$_[GPRSC]\w{2,6}[^\(]{1,199}(\$\w+)lower\s*=\s*\w+\(\11\);[^\$]{1,99}\11\w+[^\(]{1,99}(?:true|false);\s*\}\s*\w+\s*\(\10\(\)\)\s*\{\s*header\(['"]Location:\h*https?://[^'"]{1,99}['"]\);\s*(?:exit|die);\s*\}\s*\?>(?<X120345671>))|\h+(?:(\w+)[\h\(]+(\$\w+)[\h\)]+\{\h*(\$\w+)[\h=]+@?file_get_contents[\h\(]+\14[\h\)]+;\h*return\b[^;]+\15\b[^\n]+\b(echo\h*@?\13[\h\(]+['"][^'"\?]+(?:\\x3f|\?))(?:\w|\\?\w+)=\d+['"][\h\)]+;[^\n]+?\b\16(?:\w|\\?\w+)=\d+['"][\h\)]+;[^\n\w\?]+(?:\?>|\Z)(?<X1206860>)|(\w{1,40})\([^\)]+\)[\{\s]+\$\w{1,20}=file_get_contents\([^;]+[^\}]{9,99}\}\s*(\$\w{1,20})=\$_SERVER\[["']HTTP_USER_AGENT['"]\];\s*\$\w{1,20}=array\(['"](?:bing|google)[^><]{99,299}\bforeach\(\$\w{1,20}\h*as\h*\$\w{1,20}\)[\s\{]+if\(strpos\(\19[^\/\\]{1,90}\becho\h+\18\(['"][^;]+;[\}\s]+(?:\?>)?\Z(?<X1205610>))|\s*(?:(\w+)\([^\)]+\)\s*\{\s*\$\w+[\h=]+curl_init\(\);[^\}]{9,500}\}\s*echo\h*\21[\h\(]+str_rot13[\h\(]+['"]uggc://frectbb\.[^'"]+['"][\h\)]+;\s*\?>(?<X1213260>)|(\w+\()\$\w+\)\{\$\w+=curl_init\([^\}]{1,999}\breturn\s*\$\w+;\}(\$\w+)=['"]https?://[^;]+;(\$\w+)=(?:\w+\()*\23\24\)+;eval\(\25\);(?:\?>|\Z)(?<X1224430>)|(\w+\(\))\{\$user_agent=\$_SERVER\[[^\$]+(\$\w+)=array\([^;]+;foreach\(\28[^!]+!={2}\w+\)\{[^\(]+\(\27\)\{(\$\w+)=file_get_contents\(['"]https?://[^'"]+\.txt['"]\);echo\29;(?:exit|die);\}\?>(?<X1310270>)|(\w{1,20}\(\))[\s\{]+\$\w{1,14}\s*=[^;]{1,20}HTTP_USER_AGENT['"]\][\?\s'"]+;[^@]{1,100}Google[^@]{1,700}if\s*\(\31\)[\s\{]+\$\w{1,14}[\s='"]+https?://[^'"]{1,100}\.txt['"];\s*\$\w{1,14}[\s=]+curl_init[^@]{1,300}User\-Agent:\s*Googlebot[^@]{1,150}exit;\s*\}\s*\?>(?<X120331410>)|(is_mobile)\(\)\s*\{\s*\$\w+[\s=]=[\shttp\.'"_useragn;]+[^\}]{1,99}(\$\w+)\s*=\s*array\([^\}]{1,99}foreach\s*\(\34[^;]\w+\s*(\$\w+)\)\s*\{\s[^,]{1,99}\$\w+,\s*\35\)[^\}]{1,99}(?:true|false);\s*\}\s*\}\s*[^&]{1,99}\33[^\}]{1,99}(?:include|require)\s*['"][\w\-]+\.txt['"];\s*exit;\s*\}\s*\?>(?<X120344101>)|\w+\(\)\s*\{[^\$]{1,99}\$_SERVER\[['"]HTTP_REFERER['"]\]\)\)\s*\{[^\(]{1,129}(\$\w+)\s*=\h*strtolower\(\$\w+\);[^,]{1,99}\37,\s*['"]google['"]\)[^;]{1,99}(?:true|false);[^\(]{1,49}(?:false|true);[^:]{1,59}['"]Location:\h*https?://pgbet888\.vip[^;]{1,19}['"]\);\s*exit;\s*\}\s*\?>(?<X120345300>)|is_google_bot\(\)\s*\{\s*(\$\w+)[\s=]=\s*array\([^\}]+foreach\s*\(\39\s*\w+\s*(\$\w+)\)\s*\{\s*[^,]{1,99},\s*\40\)[^\}]{1,99}(?:true|false);[^'"]{1,99}(\$\w+)\s*=\s*file_get_contents\(['"][^;]{1,29}\.txt['"]\);\s*echo\s*\41;\s*(?:exit|die);\s*\}\s*\?>(?<X120343860>))|\s+(\w+)(?:[^\$]{1,49}(\$\w+)[^\$]{1,199}\44[^\[]{1,99}strpos\(\$_SERVER\[['"][^\{]{1,99}if[\h\(]+\43[^=]{1,99}(\$\w+)[\s=]+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);echo\s+\45;exit;\}\s*\?>(?<X120363610>)|\((\$\w+),\s*(\$\w+),\s*(\$\w+)[^;]{1,99}\48[\s=]+(base64_decode)\(\48\);\s*\49[\s=]+\50\(\49\);\s*(\$\w+)[\s=]+\50\(\47[^\(]{1,99}substr\(\51[^\?]{1,99}openssl_decrypt[^\-]{1,99}aes\-256\-gcm[^\}]{1,99}\48[^\}]{1,99}gzinflate[^/]{1,99}['"][^'"]{999,}['"];eval\(['"]\?>['"]\.\43(?<X220363221>)|\((\$\w+)\)\s*\{\s+\53[\s=]+gzinflate\(base64_decode\(\53[^\{]{1,49}strlen\(\53[^\[]{1,49}(goto)[^'"]{1,99}\54[^\}]{1,49}\53;\s*\}\s*eval\(\43\(['"]\\116\\x56\\x58[^'"]+['"]\)\);\?>(?<X120365880>)|\(\$\w+\)\{(\$\w+)[^\.]{1,99}foreach\(\56[^\-]{1,49}chr\([^\*]{1,199}strrev\([^\*]{1,49}(\$\w+)[\s=]+array\([^\.]{1,799}foreach[\h\(]+\57[^'"]{1,99}['"]Fg0QQhZ[^'"]+['"][^\+]{1,99}\43[^\.]{1,49}\{(\$\w+)[^\}]{1,99}\}trim\(\58\);(?<X220369860>)|\(\)\{(\$\w+)=strtolower\(\$_SERVER\[[^!]{1,199}strpos\(\60[^:]{1,69}\43\(\)\)\{header\(['"]Location:\s+https?://[^'"]+\.id/['"][^\}]{1,49}exit\(\);\}\?>(?<X120369630>)|\b[^\{]+\{\s*(\$\w+)\s*=([^;]*\$_[GPCSR]\w{2,6}\[)[^;]+;\s*(\$\w+)\s*=\63[^;]+;\s*(\$\w+)[\s=]+(curl_)init\s*\([^;]*\62\b[^\}]{0,499}\$(\w+)[\s=]+\66exec[\s\(]+\65[\s\)]+;[^\}]{0,199}\bfile_put_contents[\s\(]+\64[\s,]+\$\67[\s\)]+;[^\?]{0,199}\b\43\s*\([^;]+;[^\?;\(\)]{0,99}(?:\?>|\Z)(?<X1198960>))|\s+(?:(\w+\()(\$\w+)\)\{(\$\w+)=file_get_contents\(\70\);[^\?]{1,499}\breturn\s*\71;\}(\$\w+)=\69['"]https?://[^\?]{1,499}\bf(?:write|ile_put_contents)\([^,;]+,\72\);(?:fclose\([^;]+;)?\}*(?:\?>|\Z)(?<X1224040>)|(\w{1,40})[\h\(\)]+\{\s*(\$\w{1,40})[\s=]+@?file_get_contents\s*\([^\)]{0,99}['"](?:https?|uggcf?)://[^;]{1,199};\s*(?:echo|print|return)\s*\75;\s*\}\s*(?:(?:echo|print)\s*)?\74[\s\(\)]+;\s*(?:\?>\s*)?\Z(?<X1192140>)|(is_google_crawler)[\h\(]+(\$\w+)[\s\)\{]+\$\w+[\h=]+['"]https?://[^'"]+/common-crawlers\.json[^\}]{9,300}\bip2long\s*\(\78\);[^#]{9,500}(\$\w+)[\h=]+\$_SERVER\[['"]HTTP_X_FORWARDED_FOR['"]\][^#]{9,99}\bif[\h\(]+\77[\h\(]+\79[\s\)\{]+echo[^;]+;\s*\b(?:exit|die);\s*\}\s*\?>(?<X120356660>)|\w+\((\$\w+)\)\{(\$\w+)=(curl_)\w+\(\);\83\w+\(\82[^\?]{1,99}\81\);(\$\w+)=\83\w+\(\82\);[^\?]{1,29}return\84;\}(\$\w+)=['"]\?>['"];eval\(['"]\85['"]\.get\(['"]https?://[^'"]+/raw['"]\)\);\?>(?<X120366640>)|\w+\(\)\{if\(!empty\(\$_SERVER[^:]{1,199}return\s+explode[^\?]{1,99}(\$\w+)=['"]https?://[^'"]+['"];(\$\w+)=file_get_contents\(\87[^\.]{1,49}function_exists\(['"]curl_\w+['"][^&]{1,199}json_decode\(\88[^\?]{1,199}include\s+['"]\w+(?:\.html|\.php)?['"][^\?]{1,99}exit\(\);\}\}(?:\})?\?>(?<X120367780>)|\w\(\)\{(\$\w+)=\[\s*['"][^'"]{1,4}['"],['"][^'"]{1,4}['"][^\$]{1,149}(\$\w+)=\[\d+,[^\(]{1,99}foreach\(\91\s+\w+\$\w+\)\$\w+\.=\90\[[^\*]{1,99}file_get_contents[^\n]{1,299}\$_GET[^@]{1,599}new\s+XMLHttpRequest\(\)[^!]{1,299}echo\$\w+[^!]{1,299}\$_SERVER[^\$]{1,49}(\$\w+)[^\n]{1,199}json_encode[^\-]{1,99}\92(?<X220366393>)))|global(?:\h*(?:(\$\w{1,20});\s*if\(!?\94\)[\{\s]+function\h*(ob_start\w*)\((\$\w{1,20})\)[\{\s]+(?:\$\w{1,20}[\h=]+array\([\d,\h]{99,6000}\);\s*){2}[^\}]{1,80}\}\s*\$\w{1,20}[\h=]+str\w{1,20}\(\96\);[^@]{0,40}\b(?:if\([^\)]+\)[\{\h]+[^\}]{9,99}[\}\s]+){4,10}[^\}@]{9,60}\breturn\h*\96;[\}\s]+[^@]{0,30}@?ob_start\(['"]\95['"]\);[\}\s]+\?>(?<X1211480>)|\$searchsite\h*,[^;]+;[^\{\}]{0,499}\bbuymskey\b[^@\^]+\bsetcookie\h*\([^;]+;\s*\}\s*set_time_limit\([^\)]+\)\h*;\s*(?:\?>|\Z)(?<X1193031>))|\s+(\$ob_starting);\s*if[\s\(]+!\99[\s\)\{]+function\s+(\w+)[\s\(]+(\$\w+)[\s\)\{]+\$\w+[\s=]+Array[\s\(]+\d+\s*,[^<>/@\?]{1,9999}?\$(?:(\w+[\s=]+stri?pos[\s\(]+\$\w+[,\s]+['"])</\w+['"][\s\)]+;[^;]+\$\102>['"][^;]+;[^;]+\$){5}[^\?@]{1,499}\breturn\s+\101;[\s\}]+\99\s*=[^;]+;\s*@?ob_start[\s\(]+['"]\100['"][\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1209992>))|goto(?:\b[^\n]{1,999}=\h*['"][^'"]{0,199}\b64\h+group\h+of\h+zain\h+bani['"];[^\n]{999,};\s*(?:\?>|\Z)(?<X1216600>)|\h*(?:\w{3,8}[;:]\h*)+@?error_reporting\(0\);(?:[^\v]{0,1999}\$botbotbot\h*=[^;]*\b(?:str_replace|mb_strtolower)\h*\([^;]+;)+[^\v\?>]{0,99}\?>(?<X1189900>)|\s(\w+);\106:(\$(?:bot)+)=\.mb_strtolower[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;\s*goto\s*\w+;(\w+):\s*if\(strpos\(\107,[^\n]{99,350},\107\);\h*goto\h*\108;\h*\w+:\s*\?>(?<X2221512>)|\s+(\w+);\s*\110:\s*error_reporting[\s\(]+0[\s\)]+;[^\n]{0,999}\bwelcome\s+visitor\s+64\s+group\s+of\s+zain\s+bani['"];[^\n]{0,499}\beval\s*\([^;]{19999,}\\['"][\h\)]+;\h*['"][\h\)]+;\s*(?:\?>|\Z)(?<X1215050>)))
<\?php(?:(?:[^\(\$\?]{1,49})error_reporting\((?:0|NULL)[^;]{1,19};(?:\h*@?ini_set\([^;]+;){2,3}\h*@?eval\(\h*base64_decode\(['"](?:ZXJyb3JfcmVwb3J0aW5n|cnJvcl9yZXBvcnRpbmco)[^'"\s]{999,2999}['"][\h\)]+;(?:\h*@?ini_restore\([^;]+;){2}(?:[^\(\$\?]{1,49})\?>(?<X1134210>)|(?:\h*/\*[^\v\*]{3,16}\*/\h*(?:[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)|stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev|\(|['"][\w\+=/]{9,9999}['"]|\.)){5}\h*/\*[^\v\*]{3,16}\*/\h*[^\$]{99,1999}\h*/\*[^\v\*]{3,16}\*/\h*;\h*/\*[^\v\*]{3,16}\*/\h*\?>(?<X1140132>)|(?:\s*(?:error_reporting|set_time_limit)\h*\(0\);){2}[^\$]{0,40}\$e?xpl[o0][i1]t(?:sec)?\-?id\h*=\h*['"](?<X2173967>)|(?:\s*(?:error_reporting|set_time_limit|ignore_user_abort)\s*\(\s*\w{0,40}?\s*\)\s*;){3}(?:\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,210}?['"]\s*;){2}\s*do\s*\{.{100,300}@?copy\s*\(\s*\$\w{1,40}\s*,\s*\4\s*\)\s*\;\s*chmod\s*\(\s*\$\w{1,40}\s*,\s*\d+\s*\)\s*;\s*\}\s*sleep\s*\(\s*\d+\s*\)\s*;\s*\}\s*while\s*\(\s*true\s*\)\s*;\s*\?>(?<X1041771>)|(?:\s*(\$\w{1,40})\h*=\h*['"][asert]{1,5}['"];){2,}\s*(\$\w{1,40})\h*=\h*array\h*\([^;]{0,99}\6[^;]{0,99}\)[\s;]+(\$\w{1,40})[\s=]+array_\w{1,9}\h*\([^;]{0,99}\7[^;]{0,99}\)[\s;]+(\$\w{1,40})\h*=[^\$]{0,9}\8[^;]*;\s*@?\9[\s\(]+(?:base64_decode[\(\s]+)?@?\$_[GPRSC]\w{2,6}\s*\[[^;]{0,40};\s*(?:\?>|\Z)(?<X1185730>)|(?:\s*@?[si][eg](?:t_time_limit|nore_user_abort)\(\d+\);)+\s*\$\w{1,40}[\h=]+['"]map[^;]+;[^\{\}\?>]{0,999}\bif[\s\(]+is_https[\s\(\)]+\{\s*\$\w{1,40}[\h=]+['"]https?['"];[^\.\?>]{9,999}(\$\w{1,40})['"=\h\.base64_dnco]{20,40};\s*\$\w{1,40}[\h=]+\11\(\$\w{1,40}\);[^#]{99,50000}\breturn\h*\$\w{1,40};[\s\}]+\?>(?<X1187961>)|(?:\s*\$\w{1,40}\s*\=\s*\$_REQUEST\[['"][^'"]{1,40}['"]\]\;){15,30}\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);(?<X2052081>)|(?:\s*\$\w{1,9}\h*=\h*chr\(\d+\)\h*\.[^;]+;){2,}\s*\$\w{1,9}\h*=\h*(?:\$\w{1,9}\(){2}chr\(\d+\)\h*\.[^;]{99,999};\s*(\$\w{1,40})\h*=(?:\h*chr\(\d+\)(?:\h*\.)?)+;\s*@?file_put_contents\(\14[\h,]+chr\(\d+\)\h*\.[^;]+;\s*@?include(?:_once)?\(\$\w{1,40}\);\s*@?unlink\(\14\);\s*(?:\?>|\Z)(?<X1183650>)|(?:\s*\$\w{3,9}\h*=\h*['"][^\v\?"']{33,99}['"];)+[^\(]{0,99}function\h+(\w{1,40})\([^=]{5,99}(?:(\$\w{3,9})\h*=\h*(?:\16\()+(?:\$\w{3,9}(?:[\[\{]\d+[\]\}])?|['"]{2})[,\.][^;]+\);\s*){6,}(\$\w{3,9})\h*=\h*(?:\16[\h\(]+)+[^;]+\17\)+;[^\?]{999,9999}\18\(\$\w{3,9}\h*,\h*array\([^\)]+\)+;[^\v\?]{0,9}(?:\?>|\Z)(?<X1154361>)|(?:\s*goto\h+\w{3,9};\h*\w{3,9}:\h+(?:header\h*\(['"]\\[^\)]+\);|if\h*\(!\(strpos\(\$key,[^;]+;\h*\})){2}[^\?\v]{299,999}goto\h+\w{3,9};\h*\w{3,9}:\h+\$\w{1,40}\h*=\h*file_get_contents\h*\(base64_decode\h*\(['"]\\[^;]+\.\h*\$ua\h*\)\h*;\h*goto\h+\w{3,9};(?:\h*\w{3,9}:)+\s*\?>(?<X1153570>)|.{100,2000};include\s*\$\w{1,40}\(\$\{\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\}\)\[\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\];\}\s*\?>(?<X1040030>)|.{7100,9000}if\s*\(\$\w{1,10}\s*->\s*is_robots\(\)\)\s*\{\s*\$\w{1,10}\s*\[\s*'cache_code'\s*\]\s*=\s*\$\w{1,10}\s*->\s*code\s*;\s*\}\s*\}\s*\}\s*\}\s*\?>(?<X1039300>)|[ ]+/\*[ ]*vers[^:]{1,4}[ ]*:[ ]*\d+\.\d+\*/[ ]*(?:\$\w{1,40}[ ]*=[ ]*\w{1,40};[ ]*)?if[ ]*\(!(?:defined|function_exists)[ ]*\(['"][^'"]+['"]\)[^\{]{1,40}\{[^\n<]{999,9999}\);\}{1,4};?[ ]*\?>(?<X1132131>)|[ ]{200,}(?:\s*(?:\$\w{1,40})\s*\=\s*(?:['"\s\.base64_dco]{13,99}|['"\s\.gzuncompres]{12,99})\s*;){2}@?eval(/[^/]{0,40}/)\(\24\$\w{1,40}\24\(\24\$\w{1,40}\(['"][^'"]+['"](?:\s*\)\s*){1,6};?\s*(?:\?>|\Z)(?<X1058700>)|[ ]{99,}(?:/\*)[^\*\n]+\*/\s*(\$[1li]{1,40})\s*=\s*[^;]+;(\$GLOBALS\[[^\]]+\])\s*=\s*['"][^'"]+['"];\26\s*=\s*pack\([^,]+,\s*substr\(\27[^;]+;\s*if\s*\(!(function)_exists\(['"](\w+)['"]\)\)\s*\{\s*\28\s+\29\([^\}]{9,499}\}+;\s*eval\(\s*\26\s*\(\s*['"][^'"]{1999,4999}['"]\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1131951>)|[/\*\s=]+tiny\s*file\s*manager\s*\(no\s*login\)(?<X220364861>)|[\h]{99,}if\h*\(\h*\(\h*!(?:\h*@file_exists\h*\(\h*['"][^'"]{4,499}['"]\h*\)\h*\S{2,3}\h*@md5_file\h*\(\h*['"][^'"]{4,499}['"]\h*\)\h*\S{2,3}\h*['"][^'"]{4,499}['"]\h*\)\h*(?:\S{2,3})?)+\{[^\?\v]{1,9999}@chmod\h*\(\h*['"][^'"]{1,499}['"]\h*,\h*0?444\h*\)\h*;\h*\}\s*(?:\?>|\Z)(?<X1169410>)|[\s\w\(\)\{\}\$\'\"\=\/\*\+\;]{1,200}\$(\w{1,14})\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*=\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*[\'\"]\33[\'\"]\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\^\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*[\'\"][^\'\"]*[\'\"];(?<X2264911>)|[^/]{9,300}/\*\s*Bloodninja:\s*I\s+lick\s+your\s+earlobe,?\s*and\s+undo\s+your\s+watch\.\s*\*/[^#]{99,1999}?Bloodninja:\s*Smack,\s*Smack,\s*yeeeaahhh\s*\.\s*\*/\s*(?:\?>|\Z)(?<X1127781>)|[^\$\(]{1,99}\bif\s*\(\s*isset\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\][\)\s]+\{[^\}]{9,199}\$(subj?(?:ect)?)\h*=\h*['"][^'"]{1,99}\bApple\s*ID\b[^'"]{0,99}\biCloud\b[^\}]{9,999}\bif\s*\(\s*mail\([^\)]+\$\36[^\)]+\)\s*\)\s*\{\s*echo\b[^;]{1,99};\s*\}\s*else\s*\{\s*echo\b[^;]{1,99};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1152790>)|[^\$]{0,99}(\$bot_token)[\s=]+['"][^\}]{1,999}//api\.telegram\.org/\w+\38/[^@]{1,1999}(\$\w+)\s*=\s*['"]Gmail\s*Auth\s*Code[^\]]{1,999}@?mail\(\s*\$\w+,\s*\$\w+,\s*\39,\s*\$\w+\);[^;]{1,199}\38\);[^\?]{1,199};\s*\}\s*\}\s*\?>(?<X120353375>)|[^\$]{1,199}(?:(\$\w{1,40}\[)[^\]]+\]\h*\.?=['"](?:\\[x1]6[382]|[chr])['"];){3}(?:\41[^\]]+\]\.?=\41[^;]+;){9}[^\v@]{99,999}@?eval\(\41[^\]]+\]\(\41[^\]]+\]\(['"][^'"]{9999,49999}['"]\)+;\s*(?:\?>|\Z)(?<X1137980>)|[^\$]{1,40}(\$\w{1,40})=wp_remote_get\(['"]https?://[^\?\{]{9,99}\{(?:file_put_contents\(['"]([^'"]+)['"],\43\[['"]body['"]\]\);if\(file_exists\(['"]\44['"]\)\)\{echo[^;]{1,49};unlink\(__FILE__\);(?:exit|die)[^;]{0,19};\}+){2,5}(?:else\{(?:echo[^;]{0,19};)?(?:exit|die)[^;]{0,19};\})?\s*(?:\?>|\Z)(?<X2144341>)|[^\$]{1,40}@?(?:(?:set_time_limit|error_reporting)\([^\)]+\);\s*){1,2}[^\$]{9,99}\$\w{1,20}\s*=\s*['"]\w{1,20}\.xml['"];[^\(]{9,20}(\$\w{1,20})\s*=\s*\w{1,20}\(\);[^\}]{9,50}\}\s*\$\w{1,20}\s*=\s*base64_encode\(\46\);[^%]{99,500}urldecode\([^\(]{99,600}eval\(\$[0o]{1,20}\(['"][^'"]{999,40000}['"]\)\);\s*\?>(?<X1128011>)|[^\$]{1,499}\$[a-z]{4,15}\s*=\s*['"][^\v]{5000,11000}['"];\s*\$\w{1,40}\h*=\h*explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=(?:\s*substr[\(\s]+\$\w{1,40})?[,\(\s]+\d+\h*\-\h*\d+[\)\d\(,\h\-]*;[^\?]{0,499}\$[a-z]{4,15}\h*=\h*\48\h*\-\h*1;[^\$\?\{\}]{0,499}\?>(?<X1056629>)|[^\$]{1,50}(\$_[GPSCR]\w{2,6}\s*\[)\s*['"]?([^'"]+)['"]?\s*\][^'"]{1,50}(wp_\w+_dl)\([^\)]+md5\s*\(\s*\50['"]?\51['"]?[^;]{30,99}\;[^\?]{99,300}function\s*\52\((\$\w+)\)\s*\{[^\?]{1,500}(\$\w{1,40})\s*=\s*file_get_contents\s*\(\s*\53\s*\);\s*\}\s*return\s*\54;\s*\}\s*(?:\?>|\Z)(?<X1127121>)|[^\$]{1,999}ubuntu\s+php\s+configuration[^\$]{1,999}class\s*(\w+)\s*\{\s*public\s*\w+\s*(\w+)\(\)\s*\{\s*(\$\w+)\s*=\s*['"]\w{199,}['"];\s*(\$\w+)\s*=\s*\w+\(\58\);\s*\w+\s*\59;\}\}\$\w+\s*=\s*new\s*\56\(\);[^\-]{1,99}\->\57\(\);eval\([^@]{1,999}\.=chr\(hexdec\([^;]{1,99};\}\s*\w+\s*\$\w+;\s*\}\Z(?<X220346532>)|[^\$]{1,99}\$\w{1,40}\s*=\s*\$_[GPCSR]\w{2,6};\s*(\$\w{1,40})\s*=\s*str_replace\([^;]+;\s*(?:(\$\w{1,40})\s*=\s*\61\([^;]+;\s*){1,3}[^\$]{1,99}\$\w{1,40}\s*=\s*[^;]+;\s*(\$\w{1,40})\s*=\s*\62\(["']{2},[^;]+;\s*\63\(\);[^\$]{1,99}(\$\w{1,40})\s*=\s*\62\(["']{2},[^;]+;\s*@?\64\(\);\s*(?:\?>|\Z)(?<X1133763>)|[^\(\)]{0,99}\$xNamashell\h*=(?<X2167040>)|[^\(]{0,99}(\$\w{1,15})\h*=\h*['"]https?://[^/]+/wp\-config\.php['"];\s*@?(?:error_reporting|set_time_limit)\([^\{]{0,499}(\$request)\h*=\h*['"]POST\h*\{\67\[[^\]]+\]\}\h*\?\h*bot_ip\h*=[^\;]+;\s*\68\h*\.=\h*['"]Host:\h*\{\67\[[^;]+;(?<X2185470>)|[^\(]{1,60}@?eval\s*\(\s*base64_decode\s*\(['"][^'"]{99,500}(?:aXRsZT5OZXJkU3F1YWQgSGFDa2Vy|PHRpdGxlPk5lcmRTcXVhZCBIYUNrZXJz|dGl0bGU+TmVyZFNxdWFkIEhhQ2tlcnM8)[^'"]{4000,20000}['"]\)\)\s*\?>(?<X1118761>)|[^\?\$]{1,99}(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];\s*){2}if\s*\(\$\w{1,40}[^\}]{1,40}\}\s*else\s*\{\s*\$\w{1,40}\h*=\h*getcwd\(\);\s*\}[^\$]{1,999}if\h*\(\71\)\s*\{[^\}]{1,999}\}\s*else\s*\{\s*@?[sape](?:ystem|assthru|hell_exec|xec|val|ssert)\h*\(\h*\71\b[^;]+;(?:\s*\}){2}\s*\?>(?<X2140641>)|[^\{\}]{99,200}\$\w{1,20}=['"]\.Exorcised['"];\s*\$blacklist=(?<X2198511>))
<\?[ph\s]+if(?:([\(\s]+)isset\1\$_[GPRSC]\w{2,6}\[[^\]]+\][^>]+>\s*<(script>)\s*window\.add\w*\1[^,]+,function\1([\)\s]+)[\{\s]+(let\s*)(\w{1,40})[=\s]+(document\.createElement\1)[^;]+;\5\.\w*[^,]+,\5\.\w*[^\-]+[^'"]+['"];\s*\4\w{1,40}[=\s]+\6[^;]+;[^;]+;\s*\4\w{1,40}[=\s]\6[^;]+;[^;]+appendchild\1\5\3[^;]+;\s*</\2(?<X1216941>)|[\(\h]+isset[\h\(]+(\$_[GPRSC]\w{2,6})\[[^\]]+\][^\{]+\{\s*(\$\w{1,40})[=\h]+fopen[\h\(]+['"][^'"]+\.css['"],['"]\w['"][\)\s;]+(\$\w{1,40})[=\h]+['"]{2};\s*foreach[\h\(]+\8\h*as\h*(\$\w+)[^\{]+\{\s*\10[\h\.=]+\11[^\?]{99,499}\bfwrite\(\9,\10\.['"][^'"]+['"][\h\)]+;\s*\}\s*\?>(?<X1209441>)|[\(\s]+!\s*(file_)exists[\(\s'"]+(/home\d*/[^/]+/\.[^'"/]+\.txt)['"\)\s\{@]+\13pu(t_contents)[\(\s'"]+\14['",\s@]+\13ge\15[\(\s]+base64_decode[\(\s'"]+aHR0[^'"]{9,99}['"][\)\s;\}]+(?:\?>|\Z)(?<X1203220>)|[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*echo\b[^;]+\.\s*php_uname\s*\(\)[^;]*;[^\}]+\bif[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;\{\}\(]+\bif[\s\(]+@[cm]o(?:py|ve_uploaded_file)[\s\(]+\$_FILES\[[^\]]+\]\[[^\]]+\][\s,]+\$_FILES\[[^\]]+\]\[[^\]]+\]\s*\)[^;\{\}]+;\s*\}\s*(?:\?>|\Z)(?<X1189240>)|[\s\)]+\{\s*if[\(\s]+isset[\(\s]+(\$_FILES\[[^\]]+\])\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[=\s\(]+\18\[[^\]]+\][;\s\)]+(\$\w{1,40})[=\s\(]+\18\[[^\]]+\][;\s\)]+@(?:move_uploaded_file|copy)[\(@\s]+(?:\20|\19)[,\s\(@]+(?:\20|\19)[\s\)]+;[^\}]{0,99}\}[^\?\$]{0,499}(?:\?>|\Z)(?<X1198250>))|[\(\s]+md5[\(\s]+@\$_[GPRSC]\w{2,6}[\[\s]+['"]sid[^\w]+\w+[^\w]+(\$\w{1,40})[=\s]+[^\@]+@file_put_contents[\(\s]+\22,base64\w+[^\@]+@chmod[\(\s]\22,[^\?]+\?>(?<X1212270>)|[\h\(]+!?defined\(['"]\w+['"][^:]{1,99}define\(['"]\w+['"],\s*['"]https?://[^\.]+\.com['"]\)[^#]{49,59999}function\s+uploadRangeOfFiles\(\$\w+,\s+(\$\w+)[^\-]{1,99}explode\(['"]\-['"],\s*\24\);\s*if[\h\(]+!makeDir[^@]{1,2999}base64_decode[^:]{1,499}CustomDbHandler::getInstance\(\)\->getOption(?<X220367021>)|[\h\(]+!is_writable[\h\(]+(['"]/[^'"]+/\w{1,25}\.php['"])[\s\)]+\{\s*chmod[\h\(]+\26,\h*\d+[\h\)]+;\s*\}\s*if[\h\(]+file_exists[\h\(]+(['"]/tmp/\w{1,25}\.txt['"])[^\{]+\{\s*(file_)put(_contents)[\h\(]+\26,\h*\28get\29[\h\(]+\27[\h\)]+;\s*\}\s*\?>(?<X1207941>)|[\h\(]+isset[\h\(]+\$_(?:[GPCSR]\w{2,6}\[[^\]]+\][\)\s\{]+(?:\$\w{1,40}[\h=]+@?(?:shell_exec|exec|passthru|system|popen)[\h\(]+['"]rm\h+[\-\w\s]{2,}(?:\.(?:php|html?)(?:\.bak)?\s+[\w\-]{2,}){3}[^'";&]{1,99}['"][\s\);]+echo\b[^;]{2,49};\s*){2,3}\}\s*(?:\?>|\Z)(?<X1152774>)|[GPRSC]\w{2,6}\[[^\]]+\](?:[\s\)]+\{\s*(?:\$\w{1,15}[\h=]+fsockopen\(\$_[GPRSC]\w{2,6}\[[^\]]+\][,\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h]+;\s*exec[\(\h]+['"]/bin/bash[^'"]+['"][\)\h]+;[\}\s]+\?>(?<X1204081>)|echo[\h\(]+base64_decode[\h\(]+[^\)]+[\h\)]+;\s*@?@?(?:copy|move_uploaded_file)[\h\(]+(\$_FILES\[[^\]]+\])[^;]+;\s*echo[\h\(]+['"]<a\h*href=['"]\.?\33[^;]+;\s*\}\s*\?>(?<X1254540>))|[^\{]+\{\s*(\$\w{1,25})[\h=]+['"]base64_decode['"];\s*(\$\w{1,25})[\h=]+['"]create_function['"];\s*(\$\w{1,25})[\h=]+\36[\h\(]+['"]{2},\s*\35[\h\(]+['"][^'"]{99,299}['"][\h\)]+;\s*\37[\h\(\)]+;\s*\}\s*\?>(?<X1207950>)))|[\s\(]+isset[\s\(]+(\$_FILES\[['"]uk45['"]\])[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]+\39\[[^\]]+\][,\s]+@?\40ge\41[\s\(]+\39\[[^;]+;\s*(?:if[\s\(]+\40exists\s*\([^;\{]{1,199}\{\s*echo\b[^;]+;[\s\}]+(?:else[\s\{]+echo\b[^;]+;[\s\}]+)?)?(?:\?>|\Z)(?<X1221390>)|\((strpos\(strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)),\s*['"]bot['"]\)\s*>\s*0\s*\|\|\s*\43,\s*['"]tool['"]\)\s*>\s*0\)\s*\{\s*echo\s+implode\('',\s*file\(['"](?:https?://)?[^'"]+(?:txt|php|js|\.pages\.dev/)['"]\)\);\s*exit;\s*\}\s*\?>(?<X120355834>)|\([^\{;]+\)[\{\s]+\$\w{1,20}=\Wuname\h*\-a\W;[^\\@\*]{99,500}\bif\([^\)]+\)[\{\s]+(\$\w{1,20})=(file_)ge(t_contents)\(['"]https?://raw\.githubusercontent\.com/[^'"]{6,99}\.\w{2,6}['"]\);\s*(\$\w{1,20})=\46pu\47\(['"]([^'"]+)['"],\45\);\s*if\(\48\)[\{\s]+echo\h*['"]<a\h*href=['"]\49[^\\\?]{9,150};[\}\s]+(?:\?>)?(?<X1220851>)|\(\!?(function)_exists\(['"](\w+)['"]\)+\{\51\52\((\$\w+)\)\{(\$\w+)=sys_get_temp_dir\([^;]+md5\(\53[^\)]+\);\$\w+=file_exists\(\54[^@]{1,400}(\$\w+)=\52[^>]+eval\(\55[^>]+>(?<X1258210>)|\(\!?function_exists\(['"](\w+)['"]\)+\{function\s*\57\(\$\w+\)\{\$\w+=['"]https?://[^;]+;[^\}]+\}[^@]{1,99}(\$\w+)=\57\([^\)]+\);if\(\!?isset(\(\58\[['"]\w+['"]\]\))\)\{eval\59;\}+\?>(?<X1258521>)|\(\$_SERVER\[['"]SCRIPT_NAME['"]\][^\{]{1,49}\.php[^\n]{1,49}echo\s*base64_decode\(['"]PCFET0NUWVBFIEhUTUwg[^'"]+wvaHRtbD4=['"]\);die\(\);\s*\}\s*\?>(?<X120346910>)|\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[\h&]+\62[\h=]+['"][^'"]+['"][\s\)\{]+\$\w+[\h=]+(mysqli_)connect\(.{9,99}\);\s*\$\w+[\h=]+\63query\([^\)]+\);\s*(\$\w+)[\h=]+\63[^;]+;\s*(\$\w+)[\h=]+['"\.creat_funio]+;\s*(\$\w+)[\h=]+\65\([^,]+,\h*['"\.eval]+\([^\}]{1,99}\66\(\64\[[^\?]{0,99}\?>(?<X1223101>)|(\$_SERVER\[[^\]]+\])\)[\h\D]{2,5}strpos\(\68,['"]google\.['"]\)[\h!=]+false\)\s*\{\s*header\(['"]Location:\h*https:?//[^'"]+['"]\);\s*\}\s*\?>(?<X1211930>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+\{if\(strpos\(\$_[GPRSC]\w{2,6}\[[^\]]+\],['"]\w+['"]\)\!==?\w+\)\{class\s*(\w+)\{[\w\s]+(\$\w+);[\w\s]+(\w)\(\$\w+\)\{if\(\!(self::\71)\)\s*self::\w+\(\);[^=]+\73=array\((?:\d+[,\)])+;\}+function\s*(\w+)[^{]+\{(\$\w+)=\$_COOKIE;[^@]{1,300}\75;return\s*\70::\72\(\d+\);\}\74[^}]+\}+(?<X2250701>)|\$_GET\[(?:(base64_decode)\(['"][^'"]{1,199}['"][\)\]]+\{error_reporting\(0\)[^\$]+\$\w+=\77\(['"]aHr0[^'"]{1,299}['"]\);\$\w+=file_get_contents\(\$\w+\);[^\{]+\{(\$\w+)=tempnam\([^;]+;file_put_contents\(\78,\$\w+\);include\78;unlink\(\78[\);\}]+else\{echo[^\}]{1,199}\}(?:exit|die);\}\?>(?<X1323201>)|[^\(]{1,49}file_put_contents\(\$_SERVER[^\(]{1,99}\.php['"],\s+base64_decode\(\$_POST[^:]{1,49}echo\s*['"]https?://['"][^;]{1,99}\.php['"];[^!]{1,199}input\s+type=['"]file['"][^!]{1,129}\$_FILES\[(?<X220366870>)))|\(stri?str\(\$_[GPRSC]\w{1,6}\[['"]\w+['"]\],['"][^"']*['"]\)[^\}@]{1,199}(\$\w+)=\$\w+\(['"]https?://[\w\-\.]+\.[a-z]{2,9}\b[^'"]*['"]\);(\$\w+)=[^;]+\81;(\$\w+)=[^;]+;(\$\w+)=[^;]+;if\(\84\(\83,\82\)+\{echo\83;exit;\}+\?>(?<X1258231>)|\h*\([^;\{]{0,99}\$_SERVER[\h\[]+['"]HTTP_USER_AGENT['"][^\{;]{0,199}\{\s*@?echo\s*['"]\s*(?:<a\b[^>]{0,99}(?:\b(?:title=['"]([^'"]+)['"]|rel=['"]?dofollow['"]?)[^>]{0,99}){2}>\s*\86\s*</a>\s*){5,}['"]\s*;\s*\}\s*(?:\?>|\Z)(?<X1196240>)|\h*\(\$_[GPRSC]\w{2,6}\)\s*\{\s*\bif[\h\(]+@?[cm]o(?:ve_uploaded_file|py)[\h\(]+\$_FILES\[['"]\w+['"]\]\[['"]tmp_name['"]\]\h*,[^\?]{1,299}__halt_compiler\h*\(\)\h*;\s*(?:\?>|\Z)(?<X2183991>)|\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*echo\h+['"]<form[^;]+;[^\(\{\?@:]{1,299}if\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{[^\{@\}]{1,99}if\h*\(\h*@?(?:move_uploaded_file|copy)\h*\(\h*\$_FILES\[[^\?]{1,299}\{\s*echo\h+[^;]+;\s*(?:\}\s*){3}\?>(?<X1143631>)|\s*[\(\s]+\!class_exists[\(\s]+['"]([^'"]*)['"][\)\s]+[^:]+:+[^=]+\$\w{1,40}[=\s]+['"]base64['"][^\-]+@unserialize[^\?]+new\s*\90[\(\)\s]+;\$\w{1,40}[=\s]+NULL;[\}\s]+\?>(?<X1217381>)|\s*\([^;\{\$]*\$_[GPCSR]\w{2,6}\[[^\{;]+\{[^\}]{0,199}\$(\w+)\s*=[^;]*\$_[GPCSR]\w{2,6}\[[^;]+;\s*@?file_put_contents[\s\(]+(\$\w+)[\s,]+\$\92[\s\)]+;\s*@?(?:includ|requir)e(?:_once)?\h*(?:\(\h*)?\93\h*(?:\)\h*)?;\s*@?unlink[\s\(]+\93[\s\)]+;\s*(?:exit|die)\b[^;]*;\s*\}\s*(?:\?>|\Z)(?<X1198670>)|\s*\([^;\{\)]{0,49}\$_SERVER\[[^\{;\?]+\{\s*\?>\s*<(\w+)\b[^>]{0,99}\bstyle=['"][^'"]*\b[lrtbhw](?:(?:eft|ight|ottom|op)[\h:]+\-\d{4,}|(?:eight|idth)[\h:]+[012])px\b[^>]{0,99}>[^</]{0,49}(?:<a\b[^>]{0,99}\bhref=['"]https?://[^>]+>[^<\?]{0,49}</a>[^</]{0,199}){5,}</\95>\s*<\?[ph\s]+\}\s*\?>(?<X1220440>)|\s*\([^;\{]{0,99}\$_[GPCSR]\w{2,6}\[[^\{;]{1,99}\{\s*echo\s*['"]<[^;]{1,499};\s*(\$\w+)[\s=]+(?:@\s*)?\$_FILES\[[^\}]{0,299}\b[cm]o(?:ve_uploaded_file|py)[\s\(]+\97\[[^\{]{1,99}\{\s*echo\s*['"][^;]{1,99}<a href='(?:\\)?\$fullpath'>\s*OK\-Click\s*here\b[^;]{1,99};[\s\}]+\?>(?<X1192730>)|\s*\([^;\{]{1,499}['"](/[^'"]+/wp\-admin/images/\.[^'"/]+)['"][^\{;]{1,499}\{\s*(?:@?(?:chmod|copy)\s*\([^\)]{0,99}['"]\99['"][^;]{0,9};\s*){2,}\}\s*(?:\?>\s*)\Z(?<X1191841>))
<\?(?:[ph\s]+(?:if(?:\s*\([^\)]*(?:(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*(echo)\s+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\1[\s\)]+;\s*\2\b[^\}]+\}\s*(?:else\s*\{[^\}]{0,99}\}\s*)?\?>(?<X1201775>)|\$_[GPCSR]\w{2,6}\[[^\{;]+\{\s*(\$\w+)[\s=]+wp_create_user\h*\([^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\4[\s\)]+;\s*\5\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1206130>))|\s*\([^\{;]{1,199}\{\s*(\$\w+)[\s=]+(curl_)init[\s\(\)]+;[^\}]{0,499}\b\8setopt[\s\(]+\7[\s,]+CURLOPT_URL[\s,]+str_rot13[\s\(]+['"]uggcf?://[^\}=]{1,499}\$(\w+)[\s=]+\8exec[\s\(]+\7[\s\)]+;[^\}=]{0,499}\becho\s*\$\9;\s*\}\s*\?>(?<X1197000>)|\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*==["'][^'"]*["']\s*\)\s*\{\s*echo\s*\w+\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if\s*\(\s*\$\w{1,40}!=['"][^"]*['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@?eval\s*\(\s*["'][^"']*["']\s*\)\s*;\s*\}\s*\}\s*\?>(?<X1037093>))|set_time_limit\((?:0\);(?:[^/]{1,999}sys_get_temp_dir\(\)[\.\s'\w;/_]+\.php['"];[^(]{1,999}curl_init\((["'])https\:\/\/\$\w+\$\w+\12\);[^%]{1,999}unlink\(\$\w+\);\s*(?:\?>|\Z)(?<X2297261>)|error_reporting\(E_ALL\);[^\)]{1,50}\);\$\w{1,14}[\s='"]+stristr[^@]{500,1000}(okwinapp\.vip)[^@]{200,600}\14[^;]{1,10};\s*exit;\s*\?>(?<X1304551>))|\d+\);ignore_user_abort\(1\);(\$\w{1,40})[=\s]+['"](?:(?:\w+(?:\.|['"]))+(?:['"])?;(?:[^\;]+;){3}(\$\w{1,40})[^\@]{1,1800}\16[^\@]{1,1600}\17[^>]+goto\s*\w+;\w+:\}\?>(?<X1217770>)|(?:\w+(?:\.|['"]))+['"]*[^\@]{1,410}\$\w{1,40}[=\s]+str_rot13\(urldecode\(\16\)+;function[\s\w]+[^@]{1,610}\bif\(\!strstr\((\$\w{1,40})[^@]{1,1000}\19\);exit[^#]{99,650}(\$\w{1,40})[=\s]+file_get_contents\(\$\w{1,40}\);\}return\20;\}\?>(?<X1217581>)))|try[\s\{]+(\$\w+)[\s=]+(?:array\s*\(|\[)[^;]{49,499};(?:\s*\$\w+[\s=]+\22\[[^;]{1,199};){12}[^%]{999,3999}\bstream_context_create\((\$\w+)\);\s*(\$\w+)[\s=]+@?file_get_contents\([^;]{0,99}\23\b[^;]{1,49};[^\}]{1,99}\becho\b[^;]{0,99}\24[\)\s]+;[\s\}]+catch\s*\([^\{;=]{1,99}\{[\}\s]+(?:\?>|\Z)(?<X1193700>))|[ph\s][^\{]{1,49}(function)\h*(is_bot)[^#]{99,550}\26\h*(\w+)\(\$\w+[^\$]{1,49}\$\w+[\h=]+curl_init\(\);[^#]{99,450}(\$\w+)[^\}]{99,299}echo[^;]{1,49}curl_error\(\29\);[^\?]{1,599}\26\s+(\w+)[^\$]{1,49}\27[^!]{1,199}(?:\.txt|\.dev?)['"];[^=]{1,99}\$\w+[\s=]+\28[^>]{1,499}echo\s+\30\(\);\s*\?>(?<X120350960>)|[ph]+(?:[^%]{1,999}base64\_decode\((\$\w+)\);[^r]{1,999}return\h{1,300}\32;[^@]{1,999}\@file_get_contents\(\$\w+\);[^%]{1,999}\(__DIR__[\s\."]+[/"\w\/\s\.]{1,9999}\);[^@]{1,999}\@[peas](?:assthru|ystem|xec|hell_exec|val)[\(\s]+\$\w{1,40}[\)\s]+;\s*\}(?<X2297302>)|\s*(?:\$_{2,}=['"]printf['";]+\$_=['"]loading\h+wordpress['"];\s{199,}\$_{2,}=['"\s]+\w+['"];[^\}]+__lambda\(\$\w+[^\{]+\{return\s*eval\([^/]+\$_=['"][^'"]{999,}['"];\s*\$_{2,}\(\);\$_{2,}\(\$_{2,}\(\$[^;]+\){3};\s*\$_{2,}=\$_{2,}\(\);\s*\$_{2,}\(\);\s*echo\s{999,}\$_{2,};\s*\?>(?<X1302450>)|eval\(base64_decode\(['"]CiBnb3RvIGJJM[^\)]+tdID0gJHByZWZp[^\)]+CX1VLOiA=['"]\){2};\s*\?>(?<X1297880>)))|\s*(?:=\s*\(\$\w+\);\s*die\s*\(include\176RAWurLdecODE\s*\(['"]%(?<X220344850>)|\$(?:_="";\$_\[\+""\]='';\$_="\$_.*\$_}\['__'\]\);\?>(?<X1034411>)|adddate=date\("D M d, Y g:i a"\);\s*\$ip\s*=\s*getenv\("REMOTE_ADDR"\);\s*\$country\s*=\s*visitor_country\(\);(?<X2050920>)|GLOBALS\[(?:'_\d+_'\]=Array(?:.{400,1000}?\(\d+\)\)\s*eval\s*\(\s*base64_decode\s*\(\s*\$_POST\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*\?>(?<X1040080>)|\(base64_decode\((?:\s*'[\w=]+'\s*\.?)+\)\);\s*\?><\?\s*function\s*(_\d+)\((\$\w+)\)\{(\$\w+)=Array\((?:\s*'[\w=]+'\s*\.?,?)+\);return\s*base64_decode\(\42\[\41\]\);}\s*\?><\?php\s*\$password=\40\(\d+\);\$GLOBALS\['_\d+_'\]\[\d+\]\(\40\(\d\),\40\(\d\),\40\(\d\)\);\s*\?>(?<X1035841>))|['"]_\d{1,9}_['"]\]\s*=\s*Array\(base64_decode\(['"]\w{1,9}['"][^\{]{6000,7000}function\s*(_\d{1,15}\()[^/]{5000,15000}\$_SERVER\[\44[^/]{0,9}/title>[^\*]{500,25000}else\{\s*echo\s*\44[^;]{1,50};\s*(?:exit|die)[^;]{0,9};\}\s*(?:\Z|\?>)(?<X2132120>))|ip = getenv\("REMOTE_ADDR"\);.+?\$headers \.= \$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['eMailAdd'\]\."\\n";.+?header\("Location:.+?\?>(?<X1034881>)|lin=\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["link"\];\s*switch \(\$lin\) {(?<X2044611>)|random=rand\(0,100000000000\);\s*\$md5=md5\("\$random"\);\s*\$base=base64_encode\(\$md5\);\s*\$dst=md5\("\$base"\);(?<X2047060>))|eval(?:\((?:base64_decode\('.{76}'\.\s*'.{76}'\.(?<X1040040>)|gzuncompress\(base64_decode\('.{22000,25000}'\)\)\);(?<X2045211>))|\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>(?:\s*<\?\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>){2,}(?<X1037953>))|https?://[^\(]+\.txtphp\s*function\s+(\w+)\(\)\s*\{[^\[]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];[^\(]+array[^\{]+foreach[^&]{1,169}\52\(\)[^:]{1,99}(\$\w+)[\s=]+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*echo\s+\53;\s*exit;\s*\}\s*\?>(?<X120348621>)|if\((?:!isBot\(\)\)\{\s*if\(isset\(\$_SERVER\['HTTP_REFERER'\]\)\s*AND\s*!isset\(\$_COOKIE\["\w+"\]\)\)\s*\{setcookie\(".{300,7000}\$botname\s*=\s*\$bot;\s*return\s*true;\s*\}\s*return false;\s*\}\s*\?>(?<X1040280>)|\$\w{1,40}\s*!=\s*""\)\s*print\s*Shell_Exec\(\$\w{1,40}\);\s*\?>(?<X1040400>))|include\s*\([^\)]+/bitrix/images/iblock/ib\.php['"]\s*\)\s*;\s*\?>(?<X1038501>)|php\s*(?:\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*function\s*\w+\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*global\s+\$\w.+@\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*\(\s*\$\w{1,40}\s*,\s*FALSE\s*,\s*\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*\)\s*;\s*return\s*\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*;\s*\}(?<X1037110>)|\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\.\s*@\$\w{1,40}\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\?>(?<X1036811>)|if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"login"\s*\]\s*=="[^"]*"\s*\)\s*\{\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;.+?<\s*form\s*enctype\s*="[^"]*"\s*method\s*="[^"]*"\s*>\s*<\s*input\s*name\s*="[^"]*"\s*type\s*="[^"]*"/\s*>\s*<\s*input\s*type\s*="[^"]*"\s*value\s*="[^"]*"/\s*>\s*<\s*/form\s*>(?<X1037210>))|set_time_limit\(\d+\);\s*error_reporting\(0\);\s*\$\w+\s+=\s*'[^']+';\s*eval\(gzinflate\(str_rot13\(base64_decode\(\$rhs\)\)\)\)\;\s*\?>(?<X1034481>))|\s+@?eval\(base64_decode\(\\['"][^'"]{400,500}(?:bWFpbC|YWlsKA|aWwo)[^'"]{9,49}(?:aGVsb|U2hlbGw|ZWxs)[^'"]{9,49}\\['"][\s\)]+;\s*(?:\?>|\Z)(?<X1118661>)|error_reporting\(0\);(?:\$\w+=(?:urldecode\()?\$_COOKIE\[["']\w+["']\]\)?;\s*){10,}(?<X2045373>)|php (?:\$a = str_replace\(x,"","\w+"\);\$a\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["\w+"\]\); \?>(?<X1034721>)|eval\("[^"]+"\.\$_REQUEST\['.'\]\."[^"]+"\);\?>(?<X1034141>)))
<\?php(?:[^\{]{0,30}if\s*\(\s*!?isset\s*\((\$eva1fYlbakBcVSir)\s*\)\s*\)\s*\{\s*\1\s*=\s*['"][^'"]{999,9000}['"];\s*(\$eva[l1]\w{2,9}S[i1j]r)\s*=[^\?]{200,1500}=\s*\2\.\2;\s*\$eva[l1]\w{2,9}S[i1j]r\s*=\s*\2;\s*\}\s*(?:\?>|\Z)(?<X1134250>)|[^\{]{1,70}if\([^\)]+\)\s*\{\s*(?:\$\w{1,20}\s*=\s*@?(?:(get)_current_user|\4cwd)\(\);\s*){2}preg_match_all\([^\{]{9,150}(\$\w{1,20})\s*=\s*fopen\(['"][^\.]+/\.contactemail['"],['"]w['"]\);\s*fwrite\(\5\s*,[^\)]+\);[^\}]{1,120}(?:unlink\([^\)]+\);\s*){2}\}\s*(?:\?>|\Z)(?<X1134890>)|\h*(\$[\w\-]{1,40})=base64_decode\(['"][^'"]{999,3999}["']\);\h*eval\(["']return\h*eval\(\\["']\7\\['"]\);['"]\);?\h*\?>(?<X1036091>)|\h*class\h*[^\{]{0,25}\{\h*private[^/]{99,299}/\*(Bloodninja)\b[^\n]{999,3000}curl_close\(\$_[^/]{9,50}/\*\9:[^/]{9,50}/\?>(?<X1146991>)|\h*function\h*\w{1,14}\((\$\w{1,14})\)\h*\{\h*while\h*\(\11\h*!==\h*['"]\/['"]\)[\w\W]{1,500}base64_decode\(substr[\w\W]{1,300}wp-load\.php[\w\W]{1,2000}file_get_contents\(['"]https?:\/\/\w{1,14}\.mystiqueapi\.com\/\?\w{1,14}\=['"]\.\$_SERVER\[['"]HTTP_HOST['"]\]\)\;\h*\?>(?<X1263901>)|\h*header\(['"]Content\-Type:text/html;\h*charset=utf\-8['"]\);\s*error_reporting\(0\);\s*\$[o0_]+\h*=\h*['"][^\*/#`>]{999,10999}\bif\h*\(\h*preg_match\h*\([^\.]{0,99}\$[o0][^\*\v]{999,}@(?:header|chmod|file_put_contents)\h*\([^;]+;(?:\s*\})+(?:\s*[o0]+\(\);)?\s*(?:\?>|\Z)(?<X1184521>)|\h*if(?:[\(\h]+isset[\(\h]+(\$_[GPRC]\w{2,6}\[[^\]]+\])[\h\)]+\{\s*function\h*(\w{1,40})\(\)\s*\{\s*global\h*\$wpdb;\s*(\$\w{1,40})[\h=]+array\(\);\s*(\$\w{1,40})\h*=\h*json_d[^;]*\14[^;]+;\s*foreach\(\17[^<]{199,999}<div\b[^>:]+style[\h=]+['"]display:none;['"][^;]+\16[^;]+;[^\}]{0,99}\}\s*\15\(\);\s*\}\s*\?>(?<X1179590>)|\h*\(\h*(?:md|sha)[5126]{1,3}\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;\{]{1,99}\{[^@\v\}]+if\h*\(\h*\s*@[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\]]+\]\[[^\]]+\],[^\}]+(?:\}\s*else\s*\{[^\}]+)?(?:\}\s*)+(?:\?>|\Z)(?<X1161410>)|\h*\(\h*@is_uploaded_file\h*\(\h*((\$_FILES\[[^\]]+\]\[)['"]tmp_name['"]\])\h*\)\h*\)\h*\{\h*(?:copy|move_uploaded_file)\h*\(\20,[^\)]+\21['"]name['"]\]\h*\)\h*;(?:\h*echo[^;\?\}]{1,99};)?\h*\}\h*\?>(?<X1137800>)|\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*function\h+get_web_page\h*\([^#]{999,1999}echo\h+implode\(\h*['"]\|['"]\h*,\h*\$\w{1,40}\h*\)\h*;\s*(?:die|exit)[^;]{0,9};\s*\}\s*\?>(?<X1157600>))|\h+(\$\w{1,20})\h*=\h*file_get_contents\h*\(['"]https?://shellerim\.[^'"]{2,20}\.txt['"]\);\s*(\$\w{1,20})\h*=\h*iconv\([^\$;]{2,20},\24\);\s*echo\h+\25;\s*(?:\?>|\Z)(?<X1158540>)|\h+(\$_+)\h*=(?:\h*\(\h*['"].{1,2}['"]\h*\^\h*['"].{1,2}['"]\h*\)\h*\.){3,}\h*\(\h*['"].{1,2}['"]\h*\^\h*['"].{1,2}['"]\h*\)\h*;\h*(\$_+)\h*=\h*\(\h*['"].{1,2}['"]\h*\^[^\?;]+;\h*@?(?:\27|\28)\((\$\{(?:\27|\28)\})\[[^\]]+\][\h\)]+;\h*@?(?:eval|assert|system)\h*\(\29\[[^\]]+\][\h\)]+;\s*(?:\?>|\Z)(?<X1141480>)|\h+@?eval\(html_entity_decode\(base64_decode\(['"][a-z0-9\+/]{999,9999}=?=?['"]\)+;\s*(?:\?>|\Z)(?<X1138460>)|\h+\$\w{1,20}\h*=\h*(?:(chr\()(?:98|97|115|101|54|52)\)\.|[base64]){6}[^&%\?]{99,600}\bfile_put_contents\(\32[^;]{9,99}\);@?include\([^\)]+\);@?unlink\([^;]{9,99}\);\s*\?>\s*<(script)\h+(?:type\h*=\h*['"]text/java\33['"]\h*|src\h*=\h*['"]https?://[^\?]{4,30}/\w{1,9}\.js\?v=[\d\.]+['"]\h*){2}></\33\>(?<X1148580>)|\h+echo\h+(?:file_put_contents\(['"]\w{1,40}\.php['"],\s*)?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*(?:,\h*true\h*)?\)\)?\h*;\h*\?>(?<X1139252>)|\h+error_reporting\h*\((?:0|NULL|FALSE)\);\s*\?>[^/]{9,99}<title>[^/<]{2,15}\b(?:private|web)\h*shell\b(?<X2174330>)|\h+function(?:\h+(\w{1,40})\h*\((\$\w{1,9})\)\h*\{\h*\$\w{1,9}\h*=(?:\h*chr\h*\(\d{2,3}\)\h*\.)+\h*chr\h*\(\d{2,3}\)\h*;[^\}\v\?]+\bunlink\h*\(\38\)\h*;\h*\}[^\?\{\}><\v]{1,99}\{[^\?\v\*]{99,499}\37\h*\(['"](?:/var)?/tmp[^;]+;[\h\}]+(?:exit|die)\b[^;]{0,9};\h*\}\s*(?:\?>|\Z)(?<X1157620>)|\s+\w{1,40}\h*\(\h*(\$fu)\h*,\h*(\$ck)\h*,\h*(\$you)\h*\)\s*\{\s*return(?:[^;\$]{0,49}(?:\40|\41|\42)){3}\h*;\h*\}(?<X2144141>))|\h+goto\h+\w{5};\h+\w{5}:\h*if\h*\(\h*mb_stripos\h*\(\h*\$botbotbot\d*\h*,\h*['"]\\[^\?\v]{9,999}=\h*curl_exec\h*\(\h*\$\w{1,40}\h*\)\h*;[^\?\v]{9,999}\bgoto\h++\w{5};\h*\w{5}:\s*\?>(?<X1182920>)|\h+if\h*\(\h*(?:!?\h*[ie][sm](?:set|pty)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[\h*chr\h*\(\d+\)\h*\.[^;\{\}\?\v]{99,999}\{\h*(\$\w{1,40})\h*=\h*chr\h*\(\d+\)\h*\.[^@\}\?\v]{99,999}@\$\w{1,40}\h*\(\h*\45\h*,\h*\$\w{1,40}\h*\)[^\v\}\?]{99,999}\45\h*\)\h*;\h*(?:exit|die)\b[^;\h]{0,9};\h*\}\s*(?:\?>|\Z)(?<X1139420>)|isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)+\h*\{\h*@?[ir](?:nclud|equir)e(?:_once)?\h*\(\h*['"][^"']{1,40}\.(?:png|ico|jpe?g|gif|bmp)['"]\h*\)\h*;\h*(?:die|exit)[^;]{0,9};\h*\}\h*\?>(?<X1147771>))|\h+if\h*\(SERVICEMODE\)\h*:\h*\?>\s*<script>window\.alexusMailerServiceMode=true;\s*</script>\s*<\?php\h+echo\h+\$googleCounter;\h*\?>(?<X2141930>)|\s*#([a-f0-9]{6,9}#)\s*if\h*\(\h*!?\h*(?:empty|isset)\h*\(\h*(\$\w{1,40})[\s)]+\{\s*\50\h*=\h*['"]<(script)\b[^;:>\v]+\bhttps?://[^'"\v]{8,99}['"]>\h*</\51>\h*['"]\h*;\s*echo\h*\50\h*;\s*\}\s*#/?\49\s*(?:\?>|\Z)(?<X1160430>)|\s*#\d{1,32}#\s*if\s*\(\s*empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*"<script.{10,200}?"\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}\s*#/\d{1,32}#\s*\?>\s*(?<X1039700>)|\s*#\s*IndoXploit[^\[]{1,150}\$\w{1,9}\s*=\s*\[['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*,(?<X2130054>)|\s*#\w{1,49}#[^\$]{499,1999}if\([^\{]{9,49}\{\s*if[\(\s]+substr\([^\{]+preg_match\([^,]+,\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\)\{\}\s]+else\s*\{\s*error_reporting\([^\{]{9,199}if\(\s*!(function)_exists\(\s*['"](__url_get_contents)['"][\)\s]+\{\s*\55\s+\56\([^\?]{999,4999}(?:\?>)?\s*\Z(?<X1134431>)|\s*(//ckII)\w+\s*\$\w{1,15}\h*=\h*['"]([^'"]+)['"];\s*\$\w{1,15}\h*=\h*['"]\./\59/\.htaccess['"];\s*\$\w{1,15}\h*=\h*['"]\./\59/moban\.html['"];[^\?]{999,2500}\bfile_get_contents\((\$\w{1,15}Moban\d+)[\)\h]+;\s*@?chmod\(\60,\h*\d+\);[\}\s]+\58end\s*\?>(?<X1197240>)|\s*(/\*[^\*]{0,9}\*/)\s*(?:@?error_reporting\((?:0|NULL|false)\);\s*)?@eval\(base64_decode\(['"][^'"]{99,4999}['"]\)\s*\)(?:\s*;)?\s*\62\s*(?:\?>|\Z)(?<X1124160>)|\s*(?:(?:(shell_exec)\(['"]chmod\h*\d{3,4}\h*[\.?\w\-]{1,15}['"]\);\s*)?\64\(['"]wget\h*https?://phpshel[^'"]{5,15}/([\-\.\w]{1,15}\.txt)['"]\);\s*\64\(['"]mv\h*\65\h*[\-\.\w]{1,15}['"]\);\s*){2,}\?>(?<X1143451>)|\s*(?:(?:session_start|error_reporting)\([^;]{1,9};\s*){2}[^=]{9,99}(?:@?ini_set\([^\)]{1,29}\);\s*){4,5}\$\w{1,40}\s*=\s*['"]\w{32}['"];[^;]{0,40}\beval\((?:@?(?:(?:base64_|convert_uu|rawurl)decode|gz(?:inflate|uncompress)|str_rot13)\(){9,13}['"][^'"]{65000,}['"][\)\s]{9,13}\s*;\s*(?:\?>|\Z)(?<X1131081>)|\s*(?:(?:set_time_limit|error_reporting)\(0\);\s*){2}if\([^:]{99,180}<title>\s*0byt3m[i1]n[i1]<\/title>(?<X2129330>)|\s*(?:(\$\w{1,20})=\69\.substr\([^\)]+\);\$\w{1,20}=[lr]?trim\([^\)]+\);){2,6}(?:(\$\w{1,20})=\70\.(?:\69|substr)\([^\)]+\);\$\w{1,20}=(?:[lr]?trim|str\w{2,9})\([^\)]+\);){5,20}[^\{]{99,400}\w\(\)\{\};[^\?]{99,300}(?:[lr]?trim|str\w{2,9})\([^\)]+\);\?>(?<X1135260>)|\s*(?://header\('Content-Type:text/html; charset=utf-8'\);\s*)?(?:\$[O0_]{2,16}=(?:'[^']*'|\d+);\s*){3,}\s*\$[O0_]{2,16}=array\([^\?>\{\}\*\[\(]{300,500}\?>(?<X1041072>)|\s*(?://header\('Content-Type:text/html; charset=utf-8'\);\s*)?\$\w{1,40}='\d+';\s*\$\w{1,40}=urldecode\("%.{20000,}\}\}'\);\$\{"[^"]{3,99}"\}\["[^"]{3,99}"\]\(\);\s*\?>(?<X1040221>)|\s*(?:/\*[^\(=\{\?'"/]{99,999}\*/\s*)?(?:\$\w{1,9}\h*=\h*substr\([^\)]+\);\s*){3}(\$\w{1,9})\h*=(?:\h*\$\w{1,9}[\.;]){3}\s*(?:\$\w{1,9}\h*=\h*\74\[\d+\][^;]{1,49};\s*){3}(\$\w{1,9})\h*=(?:\h*\$\w{1,9}[\.;]){3}\s*\75\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\s*\?>(?<X1155760>)|\s*(?:@?ini_set\h*\([^;]{1,49};\s*){3}[^\$]{9,199}(\$\w{1,40})\h*=['"\hcreat_funio\.]{17,49};\s*(\$\w{1,40})\h*=['"\hasert\.]{8,49};\s*(?:(\$\w{1,40})\h*=[^;]{1,99};\s*){2,3}(?:if\(isset\(\h*(\$\{\h*\79\h*\}\[)[^\]]+\][\h\)]+\{\h*(?:\77|\78)\h*\([^\)]{0,49}\80[^;]{1,99};\}\s*){1,2}[^\$\?]{1,99}\?>(?<X1151490>))
<\?php(?:\s*(?:\$\w+\s*=\s*stripslashes\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\);\s*){3,}\$result\s+=\s+@?mail\(stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\)\);\s*if\(\$result\)\{echo 'thank you';\}(?<X2045002>)|\s*(?:\$\w{1,30}\s*=[^;]+;\s*){2,}error_reporting\(0\);\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(.+echo\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*exit\s*;(?<X1039420>)|\s*(?:\$\w{1,40}\s*=\s*['"][^\?]{1,200}['"];\s*){2}\$\w{1,40}\s*=[^\?]{1,999}\$\w{1,40}\h*=\h*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1039202>)|\s*(?:\$\w{1,40}\s*=\s*\$_SERVER\h*\[['"][^'"]{9,11}['"]\]\h*;\h*){3}(\$\w{1,40})\h*=\h*base64_decode\h*\(\h*['"][^'"]{1,99}['"]\h*\)\h*;\s*(\$\w{1,40})\h*=[^;]{1,99}\.\h*php_uname\(\)\h*\.[^;]+;\s*@?mail\h*\(['"]?\4['"]?\s*,[^;]{1,99},['"]?\5['"]?\h*\)\h*;\s*(?:\?>|\Z)(?<X1142450>)|\s*(?:\$\w{1,9}=['"][base64_dco_gzinfltrv]['"];){19}(?:\$\w{1,9}=(?:\$\w{1,9}\.?){1,15};){3}eval\(\$\w{1,9}\(\$\w{1,9}\(\$\w{1,9}\(['"][^'"]{999,6000}['"]\){4};\s*(?:\Z|\?>)(?<X1134640>)|\s*(?:\$\w{1,9}\s*=\s*["'][_COKIERQUSTGPV]{1,4}['"];\s*){2,9}(\$\w{1,9})\s*=\s*\$\{[^\}]{5,30}\};\s*(\$\w{1,9})\s*=\s*\8\[[^;]{4,40};\s*(\$\w{1,9})\s*=\s*\8\[[^;]{4,40};\s*(\$\w{1,9})\s*=\s*\9\s*\(['"]['"],\10\s*\(\8\[[^\]]+\]\)\);\s*\11\s*\(\);\s*(?:\Z|\?>)(?<X1132724>)|\s*(?:\$\w{1,9}\s*=\s*chr\([^;]{1,20}\);\s*){4,}(\$\w{1,9})\s*=[^;]{1,20};\s*forward_static_call_array\(\13,\s*array\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*(?:\Z|\?>)(?<X1129080>)|\s*(?:\$\{['"](?:\\x47|G)[^'"]{4,24}['"]\}\[[^\]]+\]=['"][^'"]{1,40}['"];){19}[^\)]{9,1499}if\(\(isset\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^%]{40000,}\]\}\);\}\}\}echo['"](?:<|\\x3c)(?:!|\\x21)--[^'"]{2,40}['"]\.[^\.]{41,99}\.['"]--(?:\\x3e|>)['"];\}\s*(?:\?>|\Z)(?<X1118242>)|\s*(?:\$\{['"][GOBALS\\x123457cf]{9,28}['"]\}\[[^\]]+\]\s*=[^;]{1,49};){3}[^\?\v]{4999,9999}if\(strpos\((?:\$_SERVER\[|gethostbyaddr\(getenv\()['"][REMOTE_AD\\x1245df]{11,44}['"]\)\),['"]google(?:bot)?['"][^\{]{1,99}\{header\(['"][HTP4850\\x]{4,16}[^'"\v]+[0134\\x]{3,12}[^\)]+\);exit\(\);\}\s*\?>(?<X1134590>)|\s*(?:\$arrUrlId\[['"][^'"]{0,99}['"]\]=['"][^']{0,40}['"];\s*){10}(?<X1036481>)|\s*(?:echo[^;]{1,49};\s*){1,3}@?(?:copy|move_uploaded_file)\h*\(\h*['"]https?://[^'"]{1,99}['"],\h*['"][^'"]+\.php['"]\h*\);\s*(?:@?unlink[^;]{1,99};\s*){1,3}(?:\?>|\Z)(?<X1140181>)|\s*(?:echo|print_r)\((\$_COOKIE)\);\s*if\h*\(\h*\19\[[^\]]+\]\h*\D{2,3}['"]?\w{1,32}['"]?\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*\19\[[^\]]+\]\.\h*\19[^;]{0,99};\s*\20\h*=\h*base64_decode\(\20\);\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\20\);\s*\}\s*(?:\?>|\Z)(?<X1189510>)|\s*(?:eval\((?:\$\w{1,40}\(){1,3}"[^"]+"\){1,3};\s*){4,}(?<X1039570>)|\s*(?:if\(isset\(\$_[GPRSC]\w{2,6}\["\w+"]\)\)\s*\$\w+ = base64_decode\(\$_[GPRSC]\w{2,6}\["\w+"\]\);\s*else\s*\{\s*echo "indata_error";\s*exit;\s*\}\s*)+if\(mail\(\$\w+,\$\w+,\$\w+,\$\w+\)\)\s*echo "sent_ok";\s*else\s*echo "sent_error";\s*\?>(?<X1034533>)|\s*(?:if\(isset\(\$_POST\["\w+"\]\)\)\{\$\w+=base64_decode\(\$_POST\["\w+"\]\);\}\s*else\{echo\s*"indata_error";\s*exit;\}\s*)+\s*if\(system\("echo\s*'"\.\$MessageBody\."'\s*\|\s*mail\s*-s\s*'"\.\$MessageSubject\."'\s*"\.\$MailTo\.""\)\)\{\s*echo\s*"sent_ok";\s*\}\s*else\{echo\s*"sent_error";\}(?<X1035961>)|\s*(?:include\s+\(?['"][^'";]+/anti(?:bots?)?\d*\.php['"]\)?;){4,9}(\$\w{1,40})=(?:array\(|\[)[^\]\)]{9,999}[\]\)];(\$\w{1,40})=mt_rand\([^;]+;(\$\w{1,40})=\25\[\26\];\?><meta[^>]{1,99}content=['"][^'">]{1,49}\27(?<X2134121>)|\s*(?:system|passthru|shell_exec)\(\s*"\$\w{1,40}"\s*\)\s*;\s*\?>(?<X1040140>)|\s*(\$[O_0]{2,12})\h*=\h*file\(__FILE__\)\h*\;\s*(eval\h*\(\h*base64_decode\h*\()\h*['"][a-z0-9]{99,999}={0,2}['"]\)\);\s*\31([Il]{2,12})\(\30\[0\],\d+\)+;\s*eval\([O_0]{2,12}\(\32\(\30\[\d+\],\d+\)\h*,\h*\32[^;]{1,99};\h*__halt_compiler\(\);\s*[^\s\$\?]{999,}\s*\Z(?<X1159872>)|\s*(\$\w+)[\h=]+(?:(curl_)init[\h\(]+['"]https?://(?:paste\.mangsud\.org/raw/|nabila2\.pages\.dev/txt/)[^'"]+['"][\h\)]+;[^\?]{9,199}(\$\w+)[\h=]+\35exec[\h\(]+\34[\h\)]+;\s*\35close[\h\(]+\34[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\36[\h\)];\s*\?>(?<X120366602>)|['"]https?://[^'"]+\.txt['"];[^\{]{0,99}(\$\w+)[\h=]+(curl_)init\(\34\);[^\{]{0,299}(\$\w+)[\h=]+\39exec\(\38\);[^\?]{0,199}\becho\h*\40;[^\?]{0,99}\b\39close\(\38\);\s*\?>(?<X120345070>))|\s*(\$\w+)[\s=]+(realpath)\(__DIR[_\s*\.'"/]+\);\s*//\s*starting\s*directory[^%]{1,69}(\$\w+)[\s=]+\43\(\42[^%]{1,499}foreach\s*\(scandir\(\44[^%]{1,999}echo\s*['"]Invalid\s*file\s*or\s*access\s*denied\.['"];\s*\}\s*\}\s*\?>(?<X120349100>)|\s*(\$\w+)[^%\?]{99,999}(\$\w+)=\$\w+\((\46\(['"]PD9waHA\w+\+['"])\),\$\w+\((__FILE__)\)\);if\((\$\w+)\(\47\[\d+\]\)!=['"|]+\50\(\47\[\d+\][)!='"]+\s*\{(\$\w+)\(__DIR__,\h*0755\);\51\(\49,0644\);\$\w+\(\49,\48\)\.\47\[\d+\]\.\48[\);\}\h*]+\?>(?<X120337281>)|\s*(\$\w+)\s*=\s*(?:["'][^"']{1,999}["'];\s*\$\w+\s*=\s*["'][^"']{99,}["'];\s*eval\s*\(\s*htmlspecialchars_decode\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(\s*\53\s*\)\s*\)\s*\)\s*\)\s*;\s*exit\s*;\s*\?>(?<X120349371>)|['"][^;]{1,99}/wp-includes/[^\.]+/[\w\-]+\.php['"];\s*\w+\s*\(@?touch\(\53[^\{]{1,49}\{\s*die\(['"]!success!['"]\);\s*\}\s*die\(['"]!failed!['"]\);(?<X120344711>)|\[['"]\\x01\\x68\\x15\\[^'"]+['"]\];\s*foreach\(\53\s+as\s+(\$\w+)\)\{\s*@?eval[\('"\?>]{1,}\s*\.\s*gzuncompress\(strrev\(gzinflate\(\56[\);\}]{1,}\s*__halt_compiler\(\);\s*\?>(?<X120337260>))|\s*(\$\w{1,10})=['"][^;]{1,50};if\(isset\(\$_[GPRSC]\w{2,6}\[[^\}]{1,500}\b[cm]o(?:py|ve_uploaded_file)\(\$_files\[[^\?]{1,500}\bfile_get_contents\(['"]php://input['"]\);[^\?]{1,99}\b(curl)_setopt\([^\),]+,\59OPT_URL,['"]https?://[^;\)]+\58\b[^\?]{1,999}=['"]Origin:\s*chrome\-extension://(?<X2170221>)|\s*(\$\w{1,14})\s*=\s*base64_decode\(['"]aHR0cDovL21[^'"]{1,50}RvcC9saWJyYXJ5LnBoc[^'"]{1,100}['"]\);\s*eval\(['"\?>\.]+file_get_contents\(\61\)\s*\);\s*\?>(?<X1280500>)|\s*(\$\w{1,15})[\h=]+(curl_)init\(\);\s*\64setopt\(\63,\s*CURLOPT_URL,\h*['"]https?://yavapaiblock\.com/[^'"]+\.txt['"]\);[^\?]{0,99}(\$\w{1,15})[\h=]+\64exec\(\63\);[^\?]{0,99}\bfwrite\((\$\w{1,15}),\h*\65\);\s*fclose\(\66\);\s*\?>(?<X1201250>)|\s*(\$\w{1,15})\h*=\h*(?:(file_)get(_contents)\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*@?\69put\70\(['"][^'"]+['"],\h*\68\);\s*echo\h*['"]<script[^\?]{9,199}\bredirect\(\);['"]>['"];\s*\}\s*\?>(?<X1195590>)|['"][^'"]{9,99}['"];\s*function\h*(\w{1,15})\([^\}]{9,199}\}\s*\$\w{1,15}\h*=\h*\72\(\68\[\d{1,3}\][^\)]{9,99}\);[^\?]{99,2500}\72\([^\)]+\)\)\s*\.\s*['"]{2}[^'"]{999,30000}['"]{2}\s*\.\s*\72\(\68\[[^\}]{9,99}array\(['",\}\s]{1,9}\.\s*\$\w{1,15}\s*\.\s*['"/]{1,9}\)\);\s*(?:\Z|\?>)(?<X1145211>)|['"]jUjbZaJAEP0Vy7KKsG7JMNzL8sF5WcR1b6LGmJctICAKCghlMeW[^'"]{99,999}['"];\s*eval\((?:str_rot13\(|gzinflate\(|base64_decode\(){4}['"]\68['"]\)+;\s*(?:\Z|\?>)(?<X1147180>)|\$_SERVER\[[^\]]+\]\h*\.\h*['"]/?wp\-load\.php['"];\s*if\h*\(\h*file_exists\h*\(\h*\68\h*\)\h*\)\s*\{\s*(?:require|include)(?:_once)?\h*\(\h*\68\h*\);\s*wp_set_auth_cookie\h*\(\h*\d\h*,\h*\d\h*\);\s*\}\s*\?>(?<X1175020>)|array\((?:['"][^'"]{20,40}['"],\h*){15}[^\)]{999,9999}\);\s*(\$\w{1,15})\h*=\h*(strrev)\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\77\([^\)]+\);\s*eval\(\78\(\76\(implode\(['"]{2},\h*\68[\h\)]+;\s*\?>(?<X1190200>)|str(?:_rot13\((?:['"]uggcf://[^\)]+\.gkg['"]\);\s*(\$\w{1,15})\h*=\h*(curl_)init\(\);[^\?]{0,99}\b\81setopt\(\80,\h*CURLOPT_URL,\h*\68\);[^\?]{99,500}\becho\h*\81exec\h*\(\h*\80\h*\);\s*\?>(?<X1195281>)|[^\)]+\);\h*if\(!(\$SESSION\[[^\]]+\])\)\{if\h*\(function_exists\(['"]curl_[^\n]{99,299}\belse\{\83\h*=\h*file_get_contents\(\68\h*\.\h*\$_SERVER\[[^\n]{1,199}\becho\h*['"][^'"]+['"];\h*\}\s*\?>(?<X1195260>))|tolower\(\$_SERVER\[[^\]]+\]\);\s*if\h*\(strpos\(\h*\68\h*,\h*['"][^'"]*['"]\h*\)[^\?\{\)]{1,40}\)\s*\{\s*\?>\s*<div\h+[^\}]{9,399}jerseys\b[^\}]{0,40}</a>[^\}]{99,15000}</div>\s*<\?php\h*\}\h*\?>(?<X1147054>))))
<\?php(?:\s*(\$\w{1,15})\s*=\s*['"][^'"]{50,200}['"];\s*\$\w{1,15}\s*=\s*['"][^'"]{999,}['"];\s*@?eval\((?:htmlspecialchars_(decode)\(|url\2\(|base64_\2\(){3}\1\)+;\s*(?:exit|die)[^;]{0,9};\s*(?:\Z|\?>)(?<X1130122>)|\s*(\$\w{1,20})\s*=\s*php_uname\(\);\s*(\$\w{1,20})\s*=\s*\(\s*strtolower\s*\(\s*substr\s*\(\4[^'"]+['"]win['"]\)[^\(]{9,30}if\(\5\)[^\?]{99,500}move_uploaded_file\(\$_FILES\[[^\?]{99,400}(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?(?:passthru|system|eval|popen|shell_exec)\(\6\);[^\?]{0,30}\?>(?<X1133910>)|\s*(\$\w{1,25})[\h=]+(?:['"\.mb_ergplac]{15,40};\s*(\$\w{1,25})[\h=]+['"\.base64_dco]{13,30};\s*\8[\h\(]+(chr)[\h\(]+\d+[\h\)]+,\h*\9[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+,\h*\d+,\h*\10[\h\(]+\d+[\h\)]+;\s*(?:\?>|\Z)(?<X1216971>)|file_get_contents\(['"]https:?//fikrirasy\.id/[^'"]+\.txt['"]\);\s*\?>\s*<\?[ph=\s]+\8;\s*\?>(?<X1200550>))|\s*(\$\w{1,25})\h*=\h*['"][^'"]{1,99}['"];\h*(\$\w{1,25})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*(\$\w{1,25})\h*=\h*base64_decode\(\14\);\h*file_put_contents\(\13,\h*['"]<\?php\s*['"]\.\15\);\h*include\(\13\);\h*unlink\(\13\);\s*(?:\Z|\?>)(?<X1138700>)|\s*(\$\w{1,25})\s*=\s*['"]https?://pastebin[^'"]{9,50}['"];\s*(\$\w{1,25})\s*=\s*['"]/tmp[^'"]{0,50}["'];\s*@?(file_)put(_contents)\(\18,\s*['"]<\?php\s*['"]\.@?\19get\20\(\17\)\);\s*include\(\18\);\s*@?unlink\(\18\);\s*(?:\Z|\?>)(?<X1138560>)|\s*(\$\w{1,40})=(?:"[^;\$\(\)\v`!@#%\^\+:\->]{1,99}";eval\(\22\("[\w\+/=]{9999,19999}"\)\);(?<X2044392>)|(?:str_rot13\((?:base64_decode|gzinflate|convert_uudecode|gzuncompress)\(){2}['"][^'"]{4999,}['"]\)+;\22=create_function\((?:null|['"]{2}),\22\);\22\(\);\?>(?<X2133011>)|['"](?:miss2021\.fun|ipsfacade\.ge)/[^'"]{0,9}['"];\$pdom=['"]https?://[^;]{1,199};echo\h*['"]<img\b[^/>]{0,99}\bsrc=['"]?https?://['"]\.\22\.['"]tracker\.(?:jp|pn)g\b[^/>]{0,99}\bdisplay:none\b[^\?@#%\*!\\\|]{99,999}=\22\.['"]/\w\.js\.php\?\w=['"](?<X2179902>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\22\D{2,3}['"][^'"]*['"]\)\{echo\s*[^;]{0,40}php_uname\s*\(\)[^;]{0,40};[^\}]+if\s*\(@?move_uploaded_file\s*\([^\?]{1,999}</form></body></html>['"];\s*\}\s*[\?>]{2,4}(?<X1125720>)|\$_POST\[[^\]]+\];(\$\w{1,40}=getenv\([^;]+;)[^\?]{1,99}\27([ri][en][qc][ul][iu][rd]e(?:_once)?\s*['"\(])[^;]+;\$\w{1,40}(=['"]UPDATE[\s\w]+SET)\s+[^;]+\22[^;]+;\$\w{1,40}=(mysqli?_query\()[^;]+;[^\?'"]{1,49}\$_?GRABAR_SQL\d?\29[^;]+\22[^;]+;\30[^;]+;\28[^;]+;(?:\?>|\Z)(?<X2134151>)|range\(1,\d+\);\s*(\$\w{1,40})=chr\(\22\[[^;]+;\s*\32\(\$\{chr\(\22\[[^;]+;\s*\?>(?<X1041380>))|\s*(\$\w{1,40})[\h=]+\$_COOKIE;\s*\$\w{1,40}[\h=]+\d+;\s*\(count\(\34\)==\d+&&in_array\(gettype\(\34\)\.count\(\34\),\h*\34[\h\)\?\(]+\34[^:;]{0,600}:\34;\s*\?>(?<X1212180>)|\s*(\$\w{1,40})\h*=\h*(?:(?:array\s*\(|\[)\s*['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^\?]{1,199}\bfwrite\h*\(\h*\$\w{1,40}\h*,\h*(\w{1,40})\h*\(\h*\36\[0\][^\?\{]{1,199}\bfunction\h+\37\h*\([^\{]{1,99}\{\s*\$\w{1,40}\h*=\h*curl_init\(\);[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1172760>)|(['"]false['"]);\s*if\(preg_match\(['"][^;]+\36\h*=\h*['"]true['"]\h*;\s*\}\s*if\h*\(\h*\36\h*\W{2,3}\h*\39\h*\)\s*\{[^\}]+\$\w{1,40}\h*=\h*\$matche?s?\[\d+\];(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*['"]<script[^:;>]+\bhttps?://[^:;>]+;[^\?\}]{99,199}\becho\h*\40;\s*\}\s*\?>(?<X1157911>)|@?file_get_contents\h*\(\h*['"]https?://(?:www\.)?[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\h*echo\s+['"]?\36['"]?;\s*\?>(?<X1151591>)|@?md5\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*if\h*\(\h*\36\h*\D{2,3}\h*['"]\w{32}['"]\h*\)\s*\{[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\([^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1164100>)|['"]base64_decode['"];\s*(\bif\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\))[^;\{\}]{0,99}\36\h*\(\h*['"]\w{32,50}[^\[]{1,45}(\$\w{1,10})\h*=\h*\36\h*\(\h*\$_[GPRSC]\w{2,6}[^\}]{1,499}\}\s*else[\{\s]+@?eval\h*\(\h*\36\h*\(\h*\45[^\{]{1,99}\{\s*\44[^\?]{1,99}(?:\?>|\Z)(?<X1173581>)|['"]https?://(?:[\d\.]+(?::\d+)?/[^;]{1,99};\s*(\$\w{1,40})\h*=['"\hfile_gtcons\.]{19,49};\s*\47\h*=\h*\47\(\36\);\s*(\$\w{1,40})\h*=\h*strrev\(['"]stnetnoc_tup_elif['"]\);\s*\48\([^,\)]+\.php['"],\h*\w{1,19}\(\47[\h\)]+;\s*(?:(?:echo|die|exit)\b[^;]{0,19};\s*)?(?:\?>|\Z)(?<X1164030>)|[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*;[^\$]{0,49}(\$\w{1,15})\h*=\h*['"][^'"]+\.php['"];[^\{]{0,49}\bfunction\h*(\w{1,15})\(\$\w{1,15},\h*\$\w{1,15}\)\{[^\+]{99,1500}\}\s*\51\(\50,\h*\36\);\s*\?>(?<X1176711>))|\$\{['"][GOBALS\\xa-f\d]{9,40}['"]\};\h*@[\(\h]+(count)\((?:\$?\w{1,40}\S{2,9}){2}(?:in_array\()?gettype[\h\(]+\36[\h\)\.]+\53\(\36[^\v\+\*/]{99,999}(\$\w{1,40})[\h=]+['"]\\x?\d+\\[^;]+;\s*(\$\w{1,40})[\h=]+@?\54\(['"][^'"]{0,40}['"],['"]\\[^'"]+['"]\);\s*@?\55\([^;]+;\s*(?:\?>|\Z)(?<X1188081>))|\s*(\$\w{1,40})\s*=(?:[^;]{1,40};\s*\$\w{1,40}\s*=['"base64_doc\.\s]{13,49};\s*\$\w{1,40}\s*=(?:\s*\57\[\d+\]\s*\.){4}[^;]{1,40};\s*if\b[^\{]{1,99}\{\s*(\$\w{1,40})\s*=\s*(array)\s*\([^;]{1,40};\s*\59_walk\s*\(\s*\58,\s*strval\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\][^;]{1,9};\s*\}\s*\?>(?<X1140461>)|\s*(\w{1,9});\s*(\$\w+)\s*=\s*\$_SERVER\[[^;]+;(?:\s*if\(strpos\(\62\b[^\{]{1,99}\{\s*\57\s*=\s*\w{1,9};\s*\}\s*else){3}[^\?@:></]{9,999}\bif\(\57\D{2,4}\61\)\{\s*(\$\w+)\s*=\s*['"]https?://[^;]+;\s*(\$\w+)\s*=\s*@?file_get_contents\(\63\);\s*echo\s*\64;[^\}]{9,499}[\s\}]+(?:\?>|\Z)(?<X1139501>)|\s*(chr\()104\)\h*\.\h*\66\b101\)\h*\.\h*\66\b97\)\h*\.\h*\66\b100\)\h*\.\h*\66\b101\)\h*\.\h*\66\b114[\)\h]+;\h*\57\h*\(\h*chr\(\d{2,3}\)\h*\.[chr\(\)\.\h\d]{99,999}\)\h*\)\h*;\s*\?>(?<X1184530>)|\s*(file_)ge(t_contents\()([^\)]+\bwp\-config\.php['"])\s*\);\s*(?:\57\s*=\s*str_replace\(\h*['"]define\(['"]DISALLOW_FILE_(?:EDIT|MODS)['"],\h*true\);['"]\h*,\h*['"]{2}\h*,\h*\57\);\s*){2}[^\?]{9,49}\68pu\69\70\h*,\h*\57\h*\);\s*touch\(\70[^;]{1,19};\s*echo[^;]{1,19};\s*(?:\?>|\Z)(?<X1144970>)|\s*['"](?:assert|eval)['"];\s*@?\57\s*\(\s*@?\$\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\]\s*\)(?:\s*;)?\s*(?:\?>|\Z)(?<X1131110>)|\s*['"][^'"]{32,99}['"];\h*\$\w{1,40}[\h=]+(?:\57\{\d+\}\s*\.\s*)+\57\{\d+\};\h*\$\w{1,40}[\h=]+\57\{\d+\}\s*\.[^\\\[]{999,1999}\$\w{1,40}[\h=]+\$\{\s*['"][GOBALS\\x471532cf]{9,28}['"]\s*\}[^>]{9,1999}\beval\([^;]+;['"]\);\h*\$\{['"][GOBALS\\x471532cf\s]{9,28}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1182220>)|\s*['"][^'"]{999,4999}['"]\s*;\s*(?:@?fwrite\(\s*@?fopen\(\s*\$_[GPCSR]\w{2,6}\[[^\)]+\)\s*,\s*@?base64_decode\(\57\)\s*\);\s*){3,9}echo[^;]{1,99};\s*(?:\?>|\Z)(?<X1137960>)|\s*[^;]{1,40}\s*;\s*if\s*\(isset\(\s*\$_REQUEST\[\57\]\)\)\s*\{\s*@?(?:system|exec|passthru|shell_exec|popen)\(\$_REQUEST\[\57\]\);\s*\}\s*(?:\?>)?\s*\Z(?<X2052790>)|\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]{0,40};\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]{0,40};+[^\?@]{99,499}@?mail\s*\(\s*(?:\57|\76)\s*,\s*(?:\57|\76)\s*,[^;]+\);\s*(?:\?>|\Z)(?<X1126270>)|\s*array\(\s*['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\s*=>\s*['"]([^'"]{1,40})['"]\s*\);\s*(\$\w{1,40})\s*=\s*array_keys\(\57,\s*['"]\78['"]\);\s*declare\(ticks=\d+\);\s*register_tick_function\(\79\[\d+\],\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\s*\?>(?<X1153640>)|\s*file_get_contents\s*\(\s*['"][^'"]*['"]\s*\)\s*;\s*\57\s*=\s*base64_decode\s*\(\s*\57\s*\)\s*;\s*file_put_contents\s*\(\s*['"]([^'"]+)['"]\s*,\s*\57\s*\)\s*;\s*include\s*\(\s*['"]\81['"]\s*\)\s*;\s*unlink\s*\(\s*['"]\81['"]\s*\)\s*;\s*(?:|\?>|\Z)(?<X1058520>)|\s*fopen\(__FILE__,\s*['"]\w['"]\);\s*fseek\(\s*\57,\d+\);\s*(\$c)\s*=\s*['"]['"];\s*while\s*\(\s*!feof\(\s*\57\s*\)\s*\)\s*\{\s*\83\s*\.?=\s*fread\(\s*\57,\d+\);\s*\}\s*@?(?:system|exec|passthru|shell_exec|popen|eval)\s*\(\s*bzdecompress\(\83\)\);\s*__halt_compiler\(\);\s*\?>(?<X2053802>)|\s*substr_replace\s*\(\s*['"][^'"]{5,9}['"]\s*,\s*['"][^'"]*['"]\s*,\s*\d\s*,\s*\d\s*\)\s*;\s*@?\57\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;\s*(?:\?>|\Z)(?<X1186760>)))
<\?php(?:\s*(\$\w{1,9})\h*=\h*(?:@\$_SERVER\[[^\]]+\];\s*(\$_REQUEST\[)['"](\w{1,9})['"]\]\h*=[^#]{99,599}\binclude(?:_once)?\h*\$PATH\h*\.\h*\1\h*\.\h*['"]\.php['"];\s*class\h*(\w{1,9})\h*\{\s*[^\{]{1,49}\$\3\h*=\h*false\)\s*\{[^\}]{0,99}(new)\h*\$\w{1,9}\(@\2[^\}]{0,99}[\}\s]+\5\h*\4\(\1\);\s*(?:\?>|\Z)(?<X1177702>)|['"]base64_decode['"];\s*(\$\w{1,9})\h*=\h*\1\(["']aHR[^'"]{1,99}['"]\);\s*(\$\w{1,9})\h*=\h*[""][^'"]{1,99}['"];\s*@?(file_)put(_contents)\(\8,\h*['"]<\?php\h*['"]\.\1[^\?]{0,99}\beval\(\1\(@?\9get\10\(\7[\h\)]+;\s*\?>(?<X1176421>)|['"]str_rot['"][\h\.]+\(\d+[^;]+;\s*\bif\h*\(!?empty\h*\(\$\{\1\h*\(['"]_CBFG['"][\)\}]+[^\?]{1,109}(\$\w{1,9})\h*=\h*\1\h*\(['"]perngr_shapgvba['"]\);[^\?]{1,165}(\$\w{1,9})\h*=\h*\12[^\?]{1,49}\?\h*\13\h*\(\)\h*:\h*['"\h]+;\s*\}(?<X2183181>)|file_get_contents\h*\(\h*['"]https?://pastebin\.com/raw(?:\.php\?i=|/)?[^'"]{5,10}['"]\h*\);\s*(?:eval\(base64_decode\(\1\)\);\s*)?(?:\Z|\?>)(?<X1142330>))|\s*(\$\w{99,})\h*=\h*['"][^'"]{9999,}['"];\s*(\$\w{99,})\h*=\h*(?:(?:str_rot13|base64_decode|gz(?:inflate|uncompress)|convert_uudecode|htmlspecialchars_decode|urldecode)\h*\(\h*)+\16[\h\)]+;\s*@?[sape](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(\h*\17\h*\)\h*;\s*(?:\?>|\Z)(?<X1140021>)|\s*(\$auth_pass)\h*=\h*['"][a-f\d]{32}['"];[^\{\}]{0,499}\bif[\(\h]+!empty[\(\h]+(\$_POST\[[^\]]+\])[\)\s]+\{\s*if[\(\h]+md5[\(\h]+\20[\h\)]+\S{2,3}\h*\19[\)\s]+\{[^\+\*,]{999,1999}<(title>)Db</\21(?<X2177580>)|\s*(\$BOT_TOKEN)[^@]{1,59}\$CHAT_ID[^@]{1,39}if\s*\(\$_SERVER\[['"]REQUEST_METHOD['"][\]=\s*'"]+(POST)['"]\)\s*\{\s*(?:\$\w+\s*\=\s*trim\(\$_\24\[['"]\w+['"]\][\s*\?'"\);]+){7}[^@]{1,699}New\s*Card[^@]{1,599}https?://api\.telegram\.org/bot\{\23\}/sendMessage[^%]{1,1999}exit;\s*\}\s*\?>(?<X120348470>)|\s*(\$GLOBALS\[)[^\]]+\]=['"]\w{99,999}['"];[ ]*if[ ]*\([ ]*!function_exists[ ]*\(['"](\w{1,40})['"]\)[ ]*\)[ ]*\{[ ]*function[ ]*\w{1,40}[ ]*\([ ]*\$\w{1,40},[ ]*\$\w{1,40}[ ]*\)[ ]*\{[ ]*\$\w{1,40}=\26[^\]]+\];[ ]*\$\w{1,40}=pack[ ]*\([^\}]+\};\s*@?eval\s*\(\27\s*\([^;]+;\};\s*(?:\?>|\Z)(?<X1128320>)|\s*(\$wp[_\-][\w\-]{2,40})\h*=\h*['"](<img\h+src=['"]data:image/\w{3};)[^'"]{4,9999}['"]>['"];\s*preg_match\h*\(['"](.)\30\(\.\*\)['"]>\31['"],\h*\29,\h*(\$\w{1,40})\)[^\[]{1,40}\32\[\d+\];[^\}@]{99,399}(\$\w{1,40})\h*=\h*strrev\(['"]etalfnizg['"]\);\s*return\h+@\33\(\$\w{1,40}\);\s*\}\s*(?:\?>|\Z)(?<X1140220>)|\s*(echo)\h*['"]Raiz0WorM\h*(exploit)er[^\{]{9,199}if\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\{\s*if\s*\(\s*@?array\s*\(\s*\$_FILES\[[^\{]{9,99}\{\s*\35\h*['"]\36ing\h*done[^\?\(\$]{9,70}\?>(?<X1149701>)|\s*(function)\h*(\w{1,15}\(\))\{\s*if\(getenv\(['"]HTTP[^\?]{9,350}\}\s*(\$\w{1,15})\h*=\h*base64_decode\([^\)]+\)\h*\.\h*\39\h*\.\h*['"]\-['"][^\?]{9,399}\b\38_exists\(['"](file_get_contents)['"][\)\h]+\{\s*@?\$\w{1,15}\h*=\h*\41\(\40\);\s*\}\s*\?>(?<X1187930>)|\s*(function)\s+(\w{1,40})(?:[^\}]{1,99}(\$\w{1,40})=['"]https?://api\.telegram\.org/[^;]{1,99};(\$\w{1,40})=\45[^;]{1,99};file_get_contents\(\46\);[^@\?]{1,99}\bif\((\w{1,40})\((\$_[GPCSR]\w{2,6}\[[^\]]+\])\)+\{\44\(\48[^@\?]{99,499}\b\43\s+\47\((?<X2152240>)|\((\$\w{1,40})\)\{\s*\50\h*=\h*substr\(\50,[^\?]{9,499}\$(\w{1,40})\h*=\h*['"]base64_decode['"];\s*\43\s+(\w{1,40})\((\$\w{1,40})\)\{[^\}]{9,499}\breturn\s+strrev\(gzinflate\(\$\51\(\44\(\53\)+;\s*\}\s*@?(?:eval\(){9,49}\52\([^\)]{999,4999}\)+;\s*(?:\?>|\Z)(?<X1156940>))|\s*(function)\s+(?:(_check_isactive_widget)\(\)\{[^\@]{999,1999}\}\s*@?eval\(@?file_get_contents\(['"]https?://[^'"]{9,99}['"]\)\);[^/]{999,1999}(add_action\()[^,]{4,49},\s*['"]\56['"]\);\s*\55\s*(_getsprepare_widget)\(\)\{[^|]+\57[^,]{4,49},\s*['"]\58['"]\);\s*[^\?]{999,1499}\}\s*\?>\s*\Z(?<X1131030>)|(_verify(?:_is)?activate_(widget)s)\(\)\{[^\*#\|\^%]+\}\s*\55\s*_get_all\61s_?cont\(\$\w+,\$\w+=array\(\)+\{[^\?#:\*\\]+\}\s*(add_action\(['"])admin_head['"],\s*['"]\60['"]\);\s*\55\s*(_(?:get)?prepare_)\61s?\(\)\{[^\*\|]+\}\s*\62init['"],\s*['"]\63\61s?['"]\);\s*[^\?\|:]+?\?>(?<X1036304>))|\s*(goto)[^\{]{1,50}\b[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*base64_decode\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\h]+;[^!]{1,50}\bif\h*\(\h*!?isset\h*\(\h*\66[\)\s]+\{\s*\65[^\?]{1,99}\s*\?>(?<X1170211>)|\s*(goto)\h*\w{1,9};\h*\w{1,9}:[^\{\(\)]{0,70}\bfunction\h*\w{1,15}\([^\n]{99,600}:\h*\$\w{1,9}\h*=\h*['"]Base64_decode['"];\s*\68\h*\w{2,9};[^\n]{1,499}\b(?:eval\(){6}\w{1,9}\(['"][^'"]{1500,}['"][\)\h]+;(?<X1175411>)|\s*(goto)\h+(?:[a-z\d]{4,9};\h+[a-z\d]{4,9}:\h+@?eval[\h\(]+(?:['"][\\xa-f\d]{6,8}['"]\h*\.\h*)?(\$\w{1,40})[\h\)]+;[^=\$]{1,99}\71[\h=]+(curl_)exec[\h\(]+(\$\w{1,40})[\h\)]+;[^\{\}\?\>\<\[]{1,199}:\h+\73[\h=]+\72init[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;\h*\70\h+[a-z\d]{4,9};\h+[a-z\d]{4,9}:\s*(?:\?>|\Z)(?<X1175760>)|\w{3,9};\h+\w{3,9}:[^=\\]{1,99}(\$\w{1,40})\h*=\h*['"]\\(?:1(?:50|10)|x(?:68|48))\\[^'"]{19,40}['"](?:\h*\.\h*(\$_SERVER\[)[^\]]+\])+\h*;\h*\70\b[^\?>\v]{1,999}\75\h*\.\h*['"]\\[^'"]{1,99}['"]\h*\.\h*\76[^;]+\$\w{1,40}\h*\)\h*;[^\?>\v]{1,999};(?:\h*\})?\h*\70\h+\w{3,9};(?:\h+\w{3,9}:)+\s*\?>(?<X1168380>))|\s*(goto\h+)\w+;\h*\w+:\h*if\h*\(\h*[!\(\h]*strpos\h*\(\h*(\$\w{1,40})\b[^\?>]{99,499}\79\h*=\h*strtolower\h*\(\h*\$_SERVER\[[^\?>]{199,999}echo\s*(\$\w{1,40});[^\?>]{1,299}\80\h*=\h*file_get_contents\h*\(\h*base64_decode\h*\([^\?>]{199,999}\78\w+;(?:\h*\w+:){1,2}\s*\?>(?<X1134411>)|\s*(header)\h*\(['"]Content\-Type:text/html;\h*charset=utf\-8['"]\);\s*error_reporting\h*\(0\);\s*\$[o0_]+\h*=\h*['"][^\{]{1,499}\{\s*(\$\w{1,20})\h*=\h*curl_init\h*\(\);\s*curl_setopt\h*\(\83,[^#]{99,7099}\82\h*\([^\;]{0,49}404\h*not\h*found['"]\);[\}\s]+\?>(?<X1187800>)|\s*(if\h*\(\h*isset\h*\(\h*)\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+\{\s*echo\b[^\}]{1,199}\becho\h+get_current_user\h*\(\h*\);[^\}]{1,499}\b\85(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\h*=\h*\86;\s*@?(?:eval|assert)\h*\(\h*\87\h*\);\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1179110>)|\s*//(?:=+//\s*//=+\+\+\+Dhanush\+\+\+=+//\s*//=+//\s*//=+\+\+\+Coded\s*By\s*Arjun\+\+\+===//\s*//=+//\s*//=+\+\+\+An\s*Indian\s*Hacker\+\+\+=====//\s*//=+//\s*//====\s*Ashvin-2069/Oct-2012\s*====//\s*//\s*Set\s*Username\s*&\s*Password\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*//\s*Malware\s*Site\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*//\s*"[^"]*"\s*Base64\s*encoded\s*"[^"]*"\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*"[^"]*"\s*\.\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*\?>(?<X2046470>)|[^)]+\);\s*(?:\$[O0_]+=(?:'[^']+'|\d+);\s*){2,10}[^\v]+"]\(\);\?>(?<X1038311>)|[^@]{1,99}Telegram[^@]{1,19}if\s*\(\$_SERVER\[['"]REQUEST_METHOD['"]\][\s*=]+['"]POST['"]\)\s*\{\s*(?:\$\w+\s*\=\s*\$_POST\[['"]\w+['"]\][\s*\?'";]+){5}[^@]{1,1199}https?://api\.telegram\.org/bot\{\$BOT_TOKEN\}/sendMessage[^@]{1,499}header\(['"]Location:\s*payments\.php['"]\);\s*exit;\s*\}\s*\?>(?<X120348451>)|\s*\w{1,40}\s*shell\b[^&\*\+\\]{99,2999}\$(\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\([^;]{1,99};\s*fwrite\h*\(\h*\93\h*,\h*\$\92\h*\);\s*fclose\h*\(\h*\93\h*\);\s*(?:header\h*\([^;]{1,199};\s*(?:\}\s*)?)?(?:\?>\s*)?\Z(?<X1175221>)|\s*FILE:\s*explorer\.php\s*function\s*(\w+)\((\$\w+)\)\{\s*\$\w+[\s=]+scandir\(\96[^%]{1,199}is_dir\(\96\.['"]/['"]\.(\$\w+)\)\)\s*\95\(\96\.['"]/['"]\.\97[^%]{1,199}\95\(['"]\.['"]\);\s*\?>(?<X220349040>)|header\(.{30000,40000}@\$\{"[^"]*"\}\["[^"]*"\]\(\$\w{1,40},\$\w{1,40}\);\}\s*\}@\$\{"[^"]*"\}\["[^"]*"\]\(\$\w{1,40},0444\);\}\}'\);\$\{"[^"]*"\}\["[^"]*"\]\(\);\s*\?>(?<X1041210>))|\s*/[\*\s]+\w+\s*CLEANER[^%]{1,199}\$\w+[\s=]+\[\s*(?:['"](?:\w+)?\-?file\-manager['"],\s*){1,}[^%]{1,799}function\s*\w+\((\$\w+)\)\s*\{\s*\$\w+[\s=]+@?file_get_contents\(\100\);\s*if\s*\(!\$\w+\)\s*return;\s*(\$\w+)[\s=]+\[(?:['"]DISALLOW_FILE_(?:EDIT|MODS)['"],?\s*){1,}\];\s*foreach\s*\(\101(?<X220367650>)|\s*/[^:]{1,99}plugin\s+name:[^\{]{1,999}\bauthor:\s*wordpress\s+team\s*\*/(?<X220357140>))
<\?php(?:\s*/\*(?:[ ]*\w+[ ]*\*/\s*if\s*\(\s*function_exists\s*\(['"]ob_start['"]\)\s*\D{2,3}\s*!isset\s*\((\$GLOBALS\[[^\]]+\])\)\)\s*\{\s*\1\s*=\s*['"][^'"]+/\w{1,40}\.php['"];\s*if\s*\(\s*file_exists\s*\(\s*\1\s*\)\s*\)\s*\{\s*include(?:_once)?\s*\(\1\);[^\}]+ob_start\s*\([^\)]+\);(?:\s*\}){2,3}\s*\?>(?<X1124600>)|[^*]+\*/\s*\$\w+\s*=['"][^'"]+['"];\s*\$\w+\s*=\s*str_rot13\s*\(\s*gzinflate\s*\(\s*str_rot13\s*\(\s*base64_decode\s*\(\s*\$\w+\s*\)\s*\)\s*\)\s*\)\s*;\s*eval\s*\(\s*\$\w+\s*\)\s*;\s*\?>(?<X1037880>)|[^*]{1,100}\*/\s*\$GLOBALS.{3000,5000}function\s+\w{1,40}\(\$a\s*,\s*\$b\){\s*\$c=\$GLOBALS\['\w{1,40}'\];\$d=pack\('H\*',[^)]+\);\s*return \$d\(substr\(\$c, \$a, \$b\)\);};eval\(\w{1,40}\(\d+,\d+\)\);};\?>(?<X1040160>)|[^\(]{0,40}if\(!(function)_exists\(['"](_\d{3,15})['"]\)\h*and\h*!defined[^\{]{1,40}\{\5\h*\6\(\$\w{1,15}\)\{\$\w{1,15}=Array\((?:['"][\w=]{0,40}['"],){5}[^\n]{99,4000}\$_SERVER\[\6\(\d[^\n]{9,999}\$\w{1,50}\h*\.\h*\6\(\d{1,3}[\);\}]+\h*\?>(?<X1151461>)|[^\*/]{299,999}(?:Fu|ha)Cked\s*by[^\*]{1,999}\s*https?://(?:www\.)?facebook\.com/[^/]{0,119}/L34K\.C0de/?\s*\*/(?<X21299110>)|\*[^/]+/\s*if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]/tmp/[^'"]+['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1201130>)|\*\s*\*\s*(?:(Plugin)\s*Name:\s*(Cache)\s*\*\s*\10\s*URI:\s*https?:///?\11(?<X220365990>)|@package[^%]{1,299}//\s*Build:[^%]{1,99}str(?:_pad|toupper)\(['"]\w+['"][^%]{1,99}array_(?:merge|flip)\(array\([^%]{1,199}interface\s*\w+\s*\{\s*(?:public\s*function\s*\w+\(\);\s*){4,}(?<X220367341>)|Core\s*WordPress[^%]{1,999}define\(['"]\w+['"],\s*['"]https?://[^'"]+/vitrina/[^'"]+['"]\);\s*//(?<X220368962>)|File:\s*wp\-[^%]{1,3999}public\s*function\s*run\(string\s*(\$\w+)\):\s*void\s*\{\s*(\$\w+)[\s=]+\$this\->\w+\->\w+\(\15[^%]{1,399}eval\(['"]\?>['"]\s*\.\s*\16\)(?<X220364830>)|Plugin\s*Name:(?:[^@]{1,2999}(\$\w+)=@?json_decode\(\$\w+,true[^%]{1,199}isset\(\18\[['"]\w+['"]\]\)\)\s*\{ob_start\(\);@?(?:eval|passthru)\(\18(?<X220363420>)|\s*(\w+)[^%]{1,199}Author:\s*\20[^%]{1,199}function\s*(\20_on_activate)\(\)\s*\{\s*add_option\s*\(['"]\w+_plugin_installed['"],\s*time\(\)\);\s*\}\s*register_activation_hook\((__FILE__),\s*['"]\21['"]\);[^%]{1,199}register_deactivation_hook\(\22(?<X220367350>)|\s*Clean\s*Router\s*\w+\s*\*/\s*if\(!defined\(['"]ABSPATH['"]\)\)\s*\{exit;\}\$GLOBALS\[['"]\w+['"]\]=array\(['"]\\x(?<X220366920>))|Standalone\s+updater[^*]{1,29}DELETE\s+plugin\b[^#]{1,299}(\$\w+)\s*=\s*preg_replace[^;]{1,29}\25\);\s*if\s*\(\w+\(\25[^#]{1,129}\25\s*=\s*['"]\w+.php['"];\s*return\s*\25;\s*\}(?<X220366831>)|WordPress[^%]{1,1199}strtolower\(preg_replace\(['"]/\^www\\\..['"],['"]['"],\$_SERVER[^%]{1,199}hex2bin\(substr\(hash\(['"]sha256[^&]+(file_put_contents\((\$\w+),\$\w+\))\)\s*\{\28=__DIR__\.['"]/\.['"]\.substr\(md5\(microtime[^%]{1,99}\27;\}\s*@?include\s*\28;@?unlink\(\28\);(?<X220370680>))|\s*\*\s*Plugin\s*Name:[^%]{1,1199}eval\(base64_decode\(['"]aWYgKCFmdW5jdGlvbl9leGlzdHMoJ2(?<X220365590>)|\s*\w+\s*\*/\s*header\s*\(\s*"Location:\s*http[^"]*"\s*\)\s*;\s*/\*\s*\w+\s*\*/\s*exit\s*;\s*\?>(?<X1037450>)|\s*\w{1,40}\s*\*/\s*\?>\s*<\?php\s*error_reporting\(E_ALL\);\$DOMAIN.{2500,4500}enc\(\$str\);fwrite\(\$file,\$str\);fclose\(\$file\);\}\?>\s*<\?php\s*/\*\s*\w{1,40}\s*\*/\s*\?>(?<X1040880>)|\s*AthenaHTTP\s*\*/(?<X2052500>)|\s*b374k\s*shell\b[^\$;\*]{1,99}\*/\$GLOBALS\[['"]pass['"]\]=(?<X2161750>)|\s*Plugin\s*Name:(?:[^%]{1,99}Version[^%]{1,499}private\s*\$\w+[\s=]+\[\s*(?:['"]ht['"]\.['"]tp['"]\.['"]s://[^,]{1,199},\s*){5}(?<X220355500>)|\s*(Demowp\.shop)[^%]{1,99}\36(?<X220354870>)|\s*Create\s*Admin[^%]{1,99}Description[^%]{1,199}add_action\(['"]plugins_loaded[^%]{1,1199}wp_insert_user\(\$\w+(?<X220355510>)|\s*Index\s*(?:Monitor)?[^%]{1,299}Author:\s*WPsafe\s*[^@]{1,599}private\s*\$\w+[\s=]+['"]https?['"];(?<X220356481>))|\s*WSO\s*\[\s*2\s*\.\s*\d+\s*\](?<X2046060>))|\s*/\*{2}\s*\*\s*plugin\s+name:[^{]{1,999}defined\(\s*['"](\w+)['"\s\)]+\{\s*define\(['"\s]+\w+['"],\s*['"]\w+['"][^\\]{999,12000}return\s*(\w+)(?:\(\42){3,}\(['"]+,(?:\s*\41\),){3,}\s*\41\);(?<X220335651>)|\s*@?(?:eval|assert|system|popen|exec|shell_exec|passthru)\s*\(\s*["'](?:wget|curl|lwp-download|lynx|fetch|GET)\s*\-O\s*\S{1,40}\.php\s*https?://[^'"]{1,49}['"]\s*\)\s*;\s*(?:\Z|\?>)(?<X1125163>)|\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*(?:['"]wget\s*https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\s\-O\s*\w{1,40}\.php\s*['"]\s*\)\s*(?:\?>|\Z)(?<X1127261>)|base64_decode\s*\(\s*['"]d2dldCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcv[^'"]+['"][\s\)]+;\s*(?:\?>|\Z)(?<X1127271>))|\s*@?(?:include|include_once|require|require_once)\s*\(?\s*['"]https?://[^`]{1,200}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip)['"]\s*\)?\s*;\s*\?>(?<X1042210>)|\s*@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(['"](?:[^\?]{0,25}wget\h*https?://raw\.githubusercontent[^'"]{0,50}marijuana\.php['"]\);\s*\?>(?<X1146351>)|cat\h*/etc/passwd['"]\);\s*\?>(?<X1146331>))|\s*@?copy\(@?(\$_FILES\[[^\]]+\])\[[^\]]+\],\s*@?\50\[[^\]]+\]\);\s*\?>(?<X1129771>)|\s*@?e(?:rror_reporting(?:\((?:0\);\s*(?:(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\h*\(\h*\52\s*\D{2,3}\s*['"][^'"]{1,40}['"][\s\)]+\{\s*[^\}]{1,499}=\h*fopen\s*\([^\)]{1,99}/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w{1,4}['"]\s*\);[^\?\}]{1,499}(?:unlink\(\$\w{1,40}\);\s*){2,}\}\s*(?:\?>|\Z)(?<X1142110>)|include_once\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp\-apps\.php['"];\s*\?>(?<X1180300>))|E_ERROR\);\s*(?:(\$remote_path)\h*=\h*['"]http://[^'"]+['"]\h*;\s*(\$\w{1,40})\h*=\h*['"][^'"]{0,99}['"]\h*;\s*(\$\w{1,40})\h*=\h*['"][^'"]{0,99}['"]\h*;[^\?\.>]{99,499}\{\s*echo\h+file_get_contents\h*\(\h*\55\h*\.\h*(?:\56|\57)\h*\)\h*;\s*(?:exit|die)[^;]{0,9};\s*\}(?:\s*\?>)?\s*\Z(?<X1162230>)|\$remote_path\h*=\h*['"]http://(?<X2103042>)))|\h*\(\h*[\$'"]?\w{1,40}[\$'"]?\h*\^\h*[\$'"]?\w{1,40}[\$'"]?\h*\)\h*;\s*define\h*\([^\)]+\)\h*;\s*\$\w{1,40}\h*\[[^\]]{0,40}\]\h*=\h*explode\h*\(\h*['"]\|[^;]{1,499}\bgzinflate\(substr\((?<X2172390>))|val\s*\(\s*base64_decode\s*\(\s*['"]IGlmICggaXNzZXQoICRfQ09PS0lFWy[^'"]{1,500}['"]\s*\)\s*\)\s*;\s*\?>(?:\s*<!--[a-z,0-9]{1,40}-->)?(?<X1054290>)|xtract(?:\h*\(\h*\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?\h*\)\h*;\s*@(?:die|exit)\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}[\)\h]+;\s*\?>(?<X1188890>)|\s*\(array\s*\(\w=>create_function\s*\(NULL,(\w{1,9}\s*\(\s*\))\s*\)\s*\)\s*\);[^\{]{1,50}function\s*\63\s*\{(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6};\s*return\s*@?\s*\(\64\s*\[[^\]]+\]\);\s*\}\s*(?:\Z|\?>)(?<X1129101>)))|\s*@?file_put_contents\s*\(\s*(['"][^'"]*['"])\s*,\s*['"][^'"]*['"]\s*\.\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*;\s*@?include\s*\(\s*\66\s*\)\s*;\s*@?unlink\s*\(\s*\66\s*\)\s*;\s*\?>(?<X1041670>)|\s*@?header[\h\(]+['"]Conte[^\)]+\)\h*;\h*(\$\w{1,40})[\h=]+['"]\w{1,40}@gmail\.com['"];\h*(\$\w{1,40})[\h=]+['"]http://['"][\h\.]+\$_(SERVER)\h*\[['"]\70[^\]]+\][\h\.]+\$_\70\h*\[[^;]+;\h*(\$\w{1,40})\h*=[^;]+\69[^;]+\$_\70\h*\[[^;]+;\s*@?mail[\h\(]+\68[^\$;]+\71[^;]+\bphp_uname\(\)[^;]+;\s*(?:\?>|\Z)(?<X1177940>)|\s*@?ini_set\(['"]display_errors['"][^;]+;\s*error_reporting\(0\);\s*(\$\w+)[\s=]+['"]\w+['"];\s*\$\w+[\s=]+['"]\w+['"];\s*(\$\w+)[^\(]{1,49}\73[\s=]+str_replace\([^;]+\73\);\s*[^\.]+\73\.\74;[^\(]+str_replace[^=]{1,29}=\s*['"]md5['"];\s*\$\w+[\s=]+['"]\w+==['"];\s*\?>(?<X120348660>)|\s*@?preg_replace(?:\('/[^/]{1,40}/e'\s*,\s*'[^,]+,\s*'[^']+'\s*\);\s*\?>(?<X1041120>)|\s*\(\s*.?['"](.).{0,40}\77e\w?.?['"]\s*,\s*['"][^'",]{9,}['"][^'"]{999,}['"][^\?>\n]{0,49}\)\s*;\s*\?>(?<X1135111>))|\s*@?set_time_limit\(0\);\s*error_reporting\(0\);[^%]{1,199}</body></html>['"];[^%]{1,199}if\s*\(isset\(\$_POST\[['"]\w+['"]\]\)\)\s*\{\s*\$\w+[\s=]+stripslashes\(\$_POST\[['"]\w+[^%]{1,299}<title>Mailer\s*Pro\s*202\d</title>(?<X220362580>))
<\?php(?:\s*@error_reporting\s*\((?:0\);\s*(?:@ini_set\s*\([^\)]+\);\s*){3}[^\?]+\{\s*\w{4,15}\s*\(?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\)?;\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1124350>)|\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^"']*['"]\s*\]\s*;\s*if\s*\(\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*base64_decode\s*\(\s*\w+\s*\)\s*;\s*\}\s*\?>(?<X1037730>))|\s*@in(?:clude_once\("index\.php"\);\s*\?>(?<X1036580>)|i_set(?:[^%]{1,999}\s*\.=\s*chr\(hexdec\(substr[^%]{1,999}(\$\w*)\s*\=\s*(curl)_exec\((\$\w*)\);\s*\5_close\(\6\);\s*return\s+\4;[^%]+if\s*\((\$\w*)\s*!==\s*(?:false|true)\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\7\);\s+\}\s*(?:exit|die);\s*\}\s*\?>(?<X120336151>)|\("(?:display_errors.{1600,1900}fwrite\((\$\w{1,40})\s*,\s*"<\?php\\n\$\w{1,40}\[1\]\\n\?>"\);\s*fclose\(\9\);\s*include\(([^)]{1,50})\);\s*unlink\(\10\);\s*\$\w{1,40}\s*=\s*"\w{1,40}";\s*\}\s*\?>\s*(?<X1040890>)|log_errors", false\);@ini_set\("display_errors.{500,1200}gzuncompress\(base64_decode\(\$_POST\["\w{1,40}"\]\)\)\);\s*@fclose\(\$\w{1,40}\);\s*include\s*\$\w{1,40};\s*\};\s*\?>(?<X1040870>))))|\s*@move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\?>(?<X1038380>)|\s*@set_time_limit\((?:0\);\s*\$xmlname\s*=\s*'\w{1,40}\.xml.{300,1000}\};eval\(\$[O0]{1,20}\("[^"]{5000,}"\)\);\s*\?>(?<X1040900>)|\d+\);\s*if\(isset\(\$_(GET|POST|COOKIE|REQUEST)\['\w{1,40}'\]\)\)\s*system\(base64_decode\(\$_\15\['.'\]\)\);\s*\?>(?<X1040420>))|\s*[^\$\(\s]{1,99}\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]{1,99};\s*\$\w{1,40}\s*=\s*explode\([^\)]+\17\);\s*if\([^\{;]{1,49}\{\s*(\$\w{1,40})\s*=\s*base64_decode\([^;]{1,99};\s*@\18\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);[^\?]{1,49}\?>(?<X1149260>)|\s*[^\}]{1,599}\}\s*function\h*(\w{1,20})\(\)\s*\{[^\?]{1,199}(\$\w{1,9})\h*=\h*\[(?:['"]https?://xn--[^'"]{9,99}['"][,\];\}]){1,99};[^\{]{1,99}\{\s*header\(['"]location\:\h*['"]\.\21\[array_rand\(\21\)\]\);\s*exit\(\);[^;]{1,49}add_action\(\h*['"]\w{1,20}['"],\h*['"]\20['"]\h*\);\s*(?:\?>|\Z)(?<X2182380>)|\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)(?:\(['"]pkill\h*\-\d[^\?]{9,80}(file_)put(_contents\(['"])[^'"]{1,40}['"],\h*\23get\24https?://(?:\d{1,3}\.){3}\d{1,3}:\d{4}/[^'"]{1,40}/\w{1,9}\.js['"]\h*\)\h*\)\h*;\s*\?>(?<X1148362>)|\s*\(\s*['"]\s*(?:wget|curl|lwp-download|lynx|fetch|GET)\s*[^:]{0,19}https://(?:laggerghost\.github[^\)]{0,40}\.txt|ghostbin\.[^'"]{1,20}/raw)[^\)]{0,9}\w{1,40}\.php['"]\);\s*(?:\Z|\?>)(?<X1137921>))|\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]\w+\.(?:tif|bmp)['"]\)?;\s*\?>(?<X1206700>)|\s*\$(?:auth|s)_?pass\s*=\s*['"][^'"]+['"]\s*;\s*\$\w{1,40}=@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*\?>(?<X1132972>)|\s*\$(?:username|user|userId|login)\s*=\s*\$_POST\[['"][^'"]*['"]\];\s*\$(?:password|pass|pwd|pw)\s*=\s*\$_POST\[[^\]]*\];\s*\?>\s*<\?php[^\}]{9,200}@?move_uploaded_file\((?<X2124811>)|\s*\$(\w+)[\s=]+(?:(\$_REQUEST)\[['']\30['"]\];\s*\$(\w+)[\s=]+\31\[['"]\32['"]\];[^%]{1,399}(?:chino\-df@hotmail\.com|jeffreyroush\d+@gmail\.com)[^%]{1,99}web\b(?<X220340054>)|['"]https?://\w+\.\w+/ws\.php\?host\=https?://[^%]{1,1199}if\(!\$\w+\)\{return;\}\s*(\$\w+)[\s=]+\$GLOBALS\[['"]\30[^%]{1,1199}file_get_contents\(\34[^%]{1,99}exit[\s;\}\(\)]+\?>(?<X120348280>))|\s*\$(\w{1,40})\s*=\s*['"](PGgyPjxkaXYgc3R5bGU9InBvc2l0aW9uOiBhYnNvbHV0ZT)[^'"]{100,600}['"];\s*echo\s+base64_decode\(\s*\$\36\s*\);\s*\?>\s*<\?php\s+\s*echo\s+base64_decode\(['"]\37[^'"]{100,600}['"]\);\s*\?>(?<X1053532>)|\s*\$.{1,100}\$\w\s*=\s*"[^"]{50000,}";\s*@\$\w\([^)]+\);"\);\s*\Z(?<X1040170>)|\s*\$[O0_]+='[^']+';\s*\$[O0_]+=\("[^"]+"\);\$[O0_]+=\$[O0_]+\{.{20000,30000};\$\{"[^"]+"\}\["[^"]+"\]\(\);\?>(?<X1041320>)|\s*\$[O0_]{1,40}='(?:.{30000,}Content-Type:text/html;charset=utf-8\\'\);echo\s+"\$[O0_]{1,40}";exit\(\);\}'\);\$\{"[^"]+"\}\["[^"]+"\]\(\);\$[O0_]{1,40}="[^"]+";\?>(?<X1041490>)|[^']+';\s*\$[O0_]{1,40}=\d+;\s*\$[O0_]{1,40}='index\.php.{30000,}range\(1,\$p\);\s*\}\s*\$numbers\s*=\s*range\(1,\$p\);\s*shuffle\(\$numbers\);\s*return\s*array_slice\(\$numbers,0,\$n\);\s*\}\s*\?>(?<X2051090>))|\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*="[^"]*"\s*;(?:.+?\s*;\s*eval\s*\(\s*\$\s*\{\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*\}\s*\?>(?<X1037840>)|\s*\$\s*\{\s*.+?\s*;\s*eval\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1036730>)|\s*\$\w{1,40}\s*="[^"]*"\s*;\${.+?;\s*@\$\s*\{\s*\$\w{1,40}\s*\}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\?>(?<X1037560>))|\s*\$\w+=(?:'[^']+';\s*\$\w+=(?:\$\w+\{\d+\}\.?){3,};(?:\s*\$\w+\s*=(?:\$\w+\{\d+\}\.?)+;)+\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1036921>)|(?:[.]?chr\(\d+\)[.;])+\s*eval\(\$\w+\(\$_REQUEST\[\w+\]\)\);\s*$(?<X2044772>)|['"](?:file_get_contents|exit|str_replace|gzuncompress|substr)['"];\$\w+=['"](?:file_get_contents|exit|str_replace|gzuncompress|substr)['"];\$\w+=['"](?:file_get_contents|exit|str_replace|gzuncompress|substr)['"];\$\w+=['"](?:file_get_contents|exit|str_replace|gzuncompress|substr)['"];\$\w+=['"]+;\?>(?<X220357351>)|\$_POST;if\(!\w+\((\$\w+)\[['"]\w+['"]\]\)&&md5\(\49\[['"]\w+['"]\]\.md5\(\49\[['"]\w+['"]\]\)\)={1,4}['"]\w{32}['"]\)\{\$\w+=!\w+\(\49\[['"]\w+['"]\]\)\?\49\[['"]\w+[^\)]+\)\)(\$\w+)=\$_SERVER[^;]+;(\$\w+)=['"]file_put_contents['"];(\$\w+)=['"]base64_decode['"];if\(\51\(\50,\52\(\49[^;]{1,199}(?:exit|die)\(\$\w+\);\}\?>(?<X120338051>)|curl_[^;]+\.txt['"][^\}]{1,999}eval\(['"]\?>['"][^?]{1,999};\}\?>(?<X120370880>)|strrev\("edoced_46esab"\);\$\w+="[^"]+";eval\(\$\w+\(\$\w+\)\);\s*$(?<X2045381>))|\s*\$\w+(?:[\s=]+['"][^%]{1,99}['"];\s*\$\w+[\s=]+(<<<(STR))[^%]{1,14999}\56\s*new\s*Image\(\)\.src[\s=]+['"]//counter\.yadro\.ru[^%]{1,599}\57;\s*\}\s*\?>(?<X120354880>)|\s*=\s*"(?:[base64_decode".\s]+";\s*assert\(\$\w+\('[^']+'\)\);\s*\?>(?<X1036040>)|\w+";\s*if\(isset\(\$_REQUEST\[\$\w+\]\)\)\s*{\s*eval\(\s*stripslashes\(\s*\$_REQUEST\[\$\w+\]\)\);\s*exit\(\);\s*};\s*\?>\s*(?<X1034591>))|\s*=\s*\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\];\s*if\s*\(\$\w+\s*!=\s*['"]['"]\)\s*\{\s*\$\w+=base64_decode\(\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\);\s*@?eval\s*\(['"]\\\$\w+\s*=\s*\$\w+;['"]\);\s*\}\s*\?>(?<X1035302>)|\s*=\s*Array\((?:'\w+'=>'\w+',?\s*){20,}\s*\);\s*function\s*\w+\(\$\w+,\s*\$\w+\)\{\$\w+.+?base64_decode.+eval\(\w+\(\$\w+,\s*\$\w+\)\);\?>(?<X1035122>)|\s*=\s*base64_decode\('.+?;@?\$c\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w+['"]?\]\);\s*\?>(?<X1035521>)|\s*=\s*file_get_contents\(\s*"http://.+?"\s*\);\s*if\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["\w+"\]=="\w+"\){\s*eval\(\$\w+\);\s*exit;\s*}\s*\?>\s*(?<X1034811>))|\s*\$\w{1,14}=['"](?:/home/[^'"]{1,50}public_html['"];\s*(\$\w{1,14})\s*=\s*<<<['"]PHP['"]\s*<\?php[^<]{1,450}(\$\w{1,14})\s*=\s*<<<['"]PHP['"]\s*<\?php[^\}]{1,350}\}[^\}]{1,150}md5_file[^\}]{1,100}file_put_contents[^\)]{1,10}\65\);[^\}]{1,50}\}[^\}]{1,100}\66(?<X2280511>)|str_repeat['"];+\$\w{1,14}=['"]pack['"];+function\s*\w{1,14}\(\)\{(\$\w{1,14})=Array\([^\$]{1,200};[^@]{1,150}\$\w{1,14}=Array\(\68,\$_COOKIE,\68,\$_POST[^\)]+\);[^@]{1,300}eval\(\$\w{1,14}\);+die\(\);+(?<X2294630>)))
<\?php(?:\s*\$\w{1,14}(?:[\s=]+["'](\w{1,14})['"];\s*\$\w{1,14}[\s=]+["']\1['"];\s*\$\w{1,14}[\s=]+['"][0-9a-f]{1,100}['"];\s*function\s\w{1,14}\((\$\w{1,14})\)[^@]{1,150}chr\(\w{1,14}\(\2\[(\$\w{1,14})\][\s\.]+\2\[\3\+1\][^@]{1,100}function\s(\w{1,30})\(\$\w{1,14}\)[^@]{1,800}\$\1[\s=]+\4[^@]{1,500}eval\(['"\?>\.]+\$\1\);\s*echo[\s'"]+;(?<X1319331>)|\s*=\s*['"]https?://[^'"]{1,50}\.(?:php|txt|css)['"];[^>]{1,600}(\$\w{1,14})\s*=\s*tempnam\(sys_get_temp_dir\(\),\s*[^;]{1,20};\s*(\$\w{1,14})\s*=\s*fopen\(\6[^;]{1,20};\s*fwrite\(\7,\s*['"]<\?php[^;]{1,20};\s*fclose\(\7\);\s*(?:echo|include)\(?\s*\6(?<X2286530>))|\s*\$\w{1,15}[\h=]+(\$_SERVER\[)[^#]{99,2500}\bget_url_con\(['"]https?://(?:\w+\.)?fingerling\.org/[^\.]+\blinks\.php\?gethost[^#]{599,2500}\bfile_put_contents\(\9[^\]]+\][\h\.]+['"]/sitemap\.xml['"],\h*\$\w{1,15}\);[\s\}]+\?>(?<X1197831>)|\s*\$\w{1,16}\s*=\s*(stripslashes\()\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w{1,16}\s*=\s*\11\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w+\s*=\s*\11\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w+\s*=\s*@?mail\(\11\$\w+\),\s*\11\$\w+\),\s*\11\$\w+\)\);\s*if\(\$\w+\)\s*\{\s*echo\s*(?:trim\()?'\w+'\)?;\}\s*else\s*\{\s*echo\s*'\w+\s*:\s*'\.\$\w+;\}\s*(?:\?>|\Z)(?<X1045042>)|\s*\$\w{1,20}(?:=\$_POST\[\w{1,20}\];echo\s*eval\(\$\w{1,20}\);echo "404 Not Found";\s*\?>(?<X1036620>)|[^;]{1,20};\s*function\s+(\w{1,20})\([^\)]+\)\s*\{\s*(\$\w{1,20})\s*=\s*["']{2};[^\{]+\)\s*\{\s*\15[^\}]{9,200}\}\s*\$\w{1,20}\s*=\s*['"rawuldeco\s\.]{13,25};[^\{]{999,4000}\$\w{1,20}\s*=\s*Array\([^\)]+\);\s*\$\w{1,20}\s*=\s*\14\([^\)]+\);\s*(\$\w{1,20})=[^\?]{99,200}\16\([^\?]{9,40}\);\s*(?:\?>|\Z)(?<X1129131>)|\s*=\s*Array\('\w'=>.+sprintf\(\w{1,20}\(\$\w{1,20}\s*,\s*\$\w{1,20}\)\);(?:\Z|\?>)(?<X1034452>))|\s*\$\w{1,40}=(?:"\w{32}";.{20000,30000};\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\s*\?>(?<X1040370>)|'###.+\'\)\);';\s*\$\w+=str_replace\('#', '', \$\w+\);\$\w+=create_function\('',\$\w+\);\$\w+\(\);\s*\?>(?<X1034391>)|['"]\w{1,40}['"];if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{(?:echo[^;]{9,199};){1,2}if\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\D{2,3}['"]\w{1,40}['"]\)\{if\([cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,]{1,49},\21[^\)]{1,49}\)+\{(?:(?:else\{)?echo[^;]{0,49};\}){2}\}\}(?:\?>|\Z)(?<X1149730>)|gzinflate\(base64_decode\('[^']{20000,}'\)\);\s*preg_replace\([^\?]{1,50}\?>(?<X1040180>))|\s*\$\w{1,40}\h*=(?:[^;]{1,49};\s*\$\w{1,40}\h*=[^;]{30000,};[^@>]{99,499}(\$\w{1,40})\h*=\h*['"]{2};\s*for\h*\([^\)]+\)\s*\24\h*\.=[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?fopen\((['"][^'"]{1,99}['"])[^;]{1,40};\s*@?fputs\(\25,['"]<\?php\h+\24\h+\?>['"]\);[^\?>=]{1,99}\bunlink\h*\(\h*\26\h*\);\s*(?:\?>|\Z)(?<X1151870>)|\h*(array)\h*\((?:\h*['"][^'"]{1,40}['"]\h*,){5}[^\);\v]{99,}\);\s*(?:\$\w{1,40}\s*=\s*\28\s*\(['",base64_dcgzumnopr\s]{16,49}\);\s*){2}(\$\w{1,40})\s*=[^;]+;\s*(?:\$\w{1,40}\s*=\s*\29\s*\([^;]+;\s*){2,3}\s*(?:eval|assert)\s*(?:\(\s*\$\w{1,40}\s*){2,3}\(\s*\29\s*\([^;]+;\s*\?>(?<X1142640>))|\s*\$\w{1,40}\s*="(?:.{100,1000}\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"",[^;]+;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\?>(?<X1040340>)|[^"]*"\s*;\s*(?:\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*=\s*str_rot13\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*\.\s*='[^']*'\s*\.\s*\$\w{1,40}\s*;\s*@\$\w{1,40}\s*\(\s*\$\w+\s*\(.+?\)\);(?<X1037310>)|\s*(?:\$\w{1,40}\s*\[\s*\d+\s*\]\s*\.?\s*){3,};\s*\$\w+\((?:\$\w{1,40}\s*\[\s*\d+\s*\]\s*\.?\s*){3,}\s*,\s*\$\w+\s*,\s*['"]+\s*\);(?<X1037001>))|\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1037780>))|if\s*\(\s*\$(?:\w{1,40}\s*='[^']*'\|'[^']*'\s*\)\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*'[^']*'\|'[^']*'\s*\)\s*;(?<X2049510>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*@set_time_limit\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*="[^"]*"\s*\.\s*"[^"]*".+?<\s*form\s*method\s*="[^"]*"\s*enctype\s*="multipart/form-data"\s*>\s*<\s*input\s*name\s*="[^"]*"\s*type\s*="[^"]*"\s*>\s*<\s*input\s*type\s*="[^"]*"\s*value\s*="[^"]*"\s*>\s*<\s*/form\s*>\s*<\?php\s*\}\s*\?>(?<X1037030>)))|[^"]{200,}"\s*;\s*(?:\$\w{1,40}\s*=\s*str_replace\s*\(\s*['"][^;]+;\s*)+preg_replace\(\s*['"][^;]+;\s*\?>(?<X1036991>)|create_function"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*\)\s*;(?<X1039320>))|\s*\$\w{1,40}\s*='(?:[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*@?eval.+'\)\);\s*/\*,\*/\s*\?>(?<X1041530>)|[^;]+\s*;\s*@?eval\(\$\w{1,40}\([^)]{5000,}\)\);(?<X1039760>)))
<\?php(?:\s*\$\w{1,40}\s*=(?:.{1,100}str_replace\('[^']+'\s*,\s*''\s*,\s*base64_decode\(\s*'[^']+'\s*\)\s*;\s*call_user_func\([^;]+;\s*\?>(?<X1041460>)|[^;]{1,100};\s*\$\w{1,40}\s*=\s*"[^"]{1,500}"\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\?>(?<X1040550>)|\$_GET\s*\[\s*"[^"]*"\s*\]\s*;\s*switch\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*case\s*"[^"]*":\s*\$\w{1,40}\s*="[^"]*"\s*;\s*break\s*;\s*\}\s*Header\s*\(\s*'[^']*'\s*\)\s*;\s*Header\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1039410>)|\s*"[^"]*"\s*(?:;\s*(?:\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*for\s*\(\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*<\s*strlen\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\+\+\s*\)\s*\{\s*\$\w{1,40}\s*\.\s*=\s*chr\s*\(\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\^\s*ord\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*\}\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*\?>(?<X1039400>)|eval\s*\(\s*gzuncompress\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038370>))|\^\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^"[^"]*"\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*[^)]+,\s*"[^"]*"\s*\)\s*;\s*\?>.+?<\?php\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^"[^"]*"\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*[^)]+,\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1039050>))|\s*"(?:[^;]+"\s*;\s*\$\w{1,40}=@?\$\w{1,40}\(.+?\)\s*;\s*@?\$\w{1,40}\(\s*"[^"]+"\);(?<X1039720>)|\\x.{50000,}\(\s*\$\w{1,40}\s*\(\s*"[^"]{1,20}"\s*\)\s*\)\s*\.\s*"[^"]*"\s*\)\s*;\s*die\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}\s*\}(?<X2048390>)|\w{1,40}";\s*\$\w{1,40}\s*=\s*"";\s*foreach\s*\(\s*\$_POST\s*as\s*\$\w{1,40}\s*=>\s*\$\w{1,40}\)\s*\{\s*if\s*\(\s*strlen[^\?]{999,2000}strlen\(\$\w{1,40}\s*\)\s*\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}\s*\}(?<X2050382>))|\s*'[^']*'\s*;\s*(?:\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*"[^"]*"\s*\)\s*\)\s*;(?<X1041220>)|include_once\s*\(\s*"config\.php"\s*\)\s*;\s*\?>\s*<!DOCTYPE\s*html(?<X2042600>))|\s*['"](?:[^'"]+['"];\s*function\s*(\w{1,40})\([^\{]+\{\s*return\s+['"\.\$\w]{2,99};\}[^\n]{999,1999}\$\w{1,40}\s*=(?:\s*\12\s*\(){3}[^;]{99,399}['"]{2}[^'"]{20000,30000}['"]{2}\.\$\w+\)\)\s*;\s*\$\w+\(\$\w+,array\([^;]+\)\);(?:\Z|\?>)(?<X1131691>)|https?://[fz][^;]+;[^\{\}]{0,99}\bfunction[^;]+curl_init[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent[^;]+;[^;]+\14[\s\)]+;[^\}]*(?:exit|die)(?:[^\}]{0,40}\})+\s*(?:\?>|\Z)(?<X1248171>))|\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(?:"[^"]*"\s*\]\s*;\s*if\s*\(\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*&&\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1041520>)|'[^']*'\s*\]\s*;\s*echo\s*file_get_contents\s*\(\s*"[^"]*"\s*\)\s*;\s*exit\s*;\s*\?>(?<X1037710>))|[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(\$\w{1,40}\s*==\s*'[^']*'\)\s*\{(?:\s*\$\w{1,40}\s*=\s*base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);){2}\s*\$\w{1,40}\s*=\s*curl_init\(\);.+?curl_close\(\$\w{1,40}\);\s*if\(\$\w{1,40}\)\s*\{\s*print\s*"[^"]*";\s*print\s*\$\w{1,40};\s*\}\s*else\s*\{\s*print\s*"[^"]*";\s*\}\s*\}\s*\?>(?<X1038001>)|[GPRSC]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*exit\s*;\s*\?>(?<X1041421>)|POST\s*\[\s*'[^']*'\s*\]\s*;\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*rtrim\s*\(\s*\$\w{1,40}\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*;\s*@move_uploaded_file\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\.\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\)\s*\?\s*print\s*"[^"]*"\s*:\s*print\s*["'][^"']*["']\s*;\s*\}\s*/\*[^\*]+\*/\s*print\s*['"][^']+['"]\s*;(?<X1038220>))|\s*\d+\s*;\s*\$GLOBALS\s*\['\w{1,40}'\]\s*=\s*Array\(\s*\);global\s*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*\$GLOBALS.{4000,}?\$\w{1,40}\s*\[\d+\]\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\}\s*\}\s*\?>(?<X1039650>)|\s*\w+;\$GLOBALS\['\w+'\]=Array\(\);global\s*\$\w{1,40};\$\w{1,40}=\$GLOBALS;\$\{"\\x[^"]{10,100}"}\['\w+'\]="\\x.{4000,7000}\);\}\}\s*\?>(?<X1040020>)|\s*\w{1,40};\s*function\s*\w{1,40}\s*\(\s*\$\w{1,40},\s*\$\w{1,40}\)\s*\{\s*(\$\w{1,40})\s*=\s*['"]['"];[^\}]+\}[^\}]+['"\s\.rawuldeco]{15,40}\s*;return\s+\$\w{1,40}\(\23\);\s*\}\s*\$\w{1,40}\s*=\s*(?:['"][\w%]+['"]\s*\.\s*){3}[^;]{1999,};\s*(?:\?>|\Z)(?<X1125760>)|\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*file_put_contents\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*include\s*\(\s*\$\w{1,40}\s*\)\s*;\s*unlink\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X1039770>)|\s*chr\(.{400,600};include\(\$\w{1,40}\);\$\w{1,40}\(\$\w{1,40}\);\s*\Z(?<X2051220>)|\s*getenv\("REMOTE_ADDR"\);\s*include\s*'antibots\.php';\s*\$message\s*\.=\s*"--(?<X2050930>)|\s*m(?:ail\s*\(\s*(?:stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*,\s*){2}stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*echo\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*echo\s*'[^']*'\s*\.\s*\$\w{1,40}\s*;\s*\}(?<X1038801>)|d5\s*\(\s*"[^"]*"\s*\)\s*;\s*\?><\?php\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*"[^"]*"\s*\)\s*\)\s*\)\s*;\s*\?>(?<X2047360>)))|\s*\$\w{1,9}(?:\h*=\h*['"]base[^;]{9,70}ode['"];\s*\?>(?<X1179430>)|\s*=\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val)\(['"]cd\s*(/tmp);\s*wget\s+[^;]{9,40}/(\w+)\s*;\s*perl\s+(\31/\32);\s*rm[^/]{1,9}\33\*\s*['"]\s*\)\s*;\s*\?>(?<X1135371>)|\s*=\s*array\([^\)]{5,20}\);\s*(\$\w{1,5})\s*=\s*curl_init\(['"]https?://[^'"]{9,80}\.php[^\{]{9,190}\$\w{1,9}\s*=\s*curl_exec\(\35\)[^\}]{9,80}foreach\(\$\w{1,9}\s*as\s*(\$\w{1,9})\)\s*\{echo\s*['"]<iframe\s*src=["']{2}\.\36\.['"]{2}\s*(?:width|height)\s*=\s*0[^\}]{1,30}\}\}\s*\?>(?<X1128141>)|\s*=\s*new\s*PDO\(['"]mysql:host=(?:\d{2,3}\.?){4};\s*dbname=evalueconsultores['"],\s*['"][^\)]{9,99}\);\s*(?:\?>\s*<html>\s*<head|if\(isset\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]|session_start\(\);\s*\$\w{1,9})(?<X2128890>))|\s*\$\{['"](?:(?:\\x47|G)[^!]{99,2000}curl_init\s*(\(\$\{\$\{)['"](?:\\x47|G)[^:]{9,99}curl_setopt\s*\39['"](?:\\x47|G)[^:]{9,400}curl_exec\s*\39['"](?:\\x47|G)[^!]{99,5000};\s*unlink\s*\([^\)]+\);\s*(?:echo|print)\s*\(?['"][^'"]+['"]\)?;?\s*(?:\?>|\Z)(?<X1059643>)|[^`]{1000,4000}\]\}=trim\(urldecode\(\$_REQUEST\["f"\]\)\);\$\{\$\{[^`]{1000,4000}"\]\}\)\{exit\(\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\}\);\}else\{@header\("[^"]{1,80}"\);\}\}\s*\?>(?<X1042060>)|[^`]{1000,6000}(\$\w{1,40})=base64_decode\(\$\{\$\w{1,40}\}\[\d+\]\);(\$\w{1,40})=create_function\(\s*['"]['"],\42\);\43\(\);\}\s*\?>(?<X1041970>)|[^`]{1000,8000}if\(preg_match\(["']/["']\.\$\{\$\{["'][^"']{1,40}["']\}\[["'][^"']{1,40}["']\]\}\.["']/["'],\$_SERVER\[["'][^"']{1,40}["']\]\)\)\{header\(["'][^"']{1,80}["']\);die\(["']<[^"']{1,300}["']\);\}\}\}\s*\?>(?<X1042020>)|[^`]{500,2000}\?>[""];file_put_contents\(['"][^'"]{1,20}\.php['"],\$\{\$\{[""][^'"]{1,40}[""]\}\[['"][^'"]{1,40}['"]\]\}\);\}\}\s*\?>(?<X1041980>)|\w+['"]\}[\s=]+\[['"]z['"],['"]i['"],['"]p['"][^\]]{1,99}\];\s*\$\{['"]\w+['"]\}[\s=]+function\((\$\w+\))\s*\{\s*return\s*\[implode\(['"]['"],\s*\47[^%]{1,99}include\s*\$\{['"]\w+['"]\};\s*\?>(?<X120352490>))|\s*\$\{\h*[ep][cr](?:ho|int)\h*\([^;\}]+\)\h*\}\h*\.\h*\$\{\h*@?[sape](?:ystem|assthru|hell_exec|open|xec|val|ssert)\h*\(\h*\w{4,40}\b\h*\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\}\h*\?>(?<X1140210>)|\s*\$_\[['"]heading_title['"]\]\s*=\s*['"]Shell['"](?<X2128561>))
<\?php(?:\s*\$a(?:lphabet\s*=\s*"[^"]+";\s*(\$string)\s*=.{50000,};\s*\$(\w{1,40})\s*=\s*\$\w{1,40}\(""\s*,\s*\$array_name\(\1\)\);\s*\$\2\(\);\s*\Z(?<X2050480>)|rchive_path\s*=\s*'(?:[^']*'\s*;\s*\$extract_path\s*=\s*'[^']*'\s*;\s*if\s*\(\s*!file_exists.+}\s*}\s*echo\s*"OK"\s*;\s*\?>(?<X1038820>)|\./id\.zip';\s*\$extract_path\s*=\s*'\./';(?<X2048620>)|\w+\.zip';\s*\$extract_path = '[^']+';\s*.+touch\(\s*\$extract_path\s*\.\s*\$value\s*,\s*filemtime\(\$archive_path\s*\)\s*\);\s*}\s*}\s*echo\s*"Ok!";\s*\?>(?<X1039270>))|uth_pass='.{32}';preg_replace\("/\.\*/(?<X2051180>))|\s*\$GLOBALS(?:(?:\[[^\]]{1,42}\]){2}=['"][bi](?:374k|ndoxploit)\s*shell\s*packer['"];(?<X2156170>)|\[[^\]]+\]=Array\h*\(\h*(?:base64_decode\h*\(\h*['"]\w{1,9}['"]\h*\.[a-z=\.'"\h]{1,99}\)\h*,?){2,9}\)\s*;\s*function\s*(\w{1,16})\s*\(\s*(\$\w{1,9})\s*\)\s*\{[^\}]{99,199}\[\10\]\);\s*\}[^\?\}]{1,99}(\$\w{1,9})\s*=\s*\9\s*\([^\?\}]+\}\s*echo\s*\11;\s*\?>(?<X1128601>))|\s*\$password=.+?if\s*\(!empty\s*\(\$_FILES\['\w+'\]\)\)\s*{\s*move_uploaded_file.+?<input type="submit" name="login" value="go!" /\s*></form>\s*<\?php\s*}\s*\?>(?<X1035430>)|\s*\$r6\s*=\s*pow\(2,6\);\s*\$stringus\s*=(?<X2044421>)|\s*\$str\s*=\s*'PGRpdi[^']+';\s*echo\s+base64_decode\(\$str\);\?>(?<X1037100>)|\s*\$target_urls\s*=\s*array.+?\$n\s*=\s*mt_rand\(0,count\(\$target_urls\)-1\);.+?\$rand_url;\?>\s*">\s*(?<X2044301>)|\s*\$user_agent_to_filter\s*=\s*array\s*\(\s*"#Ask\\s\*Jeeves.{2000,4000}\$_SERVER\[HTTP_HOST]"\s*\)\s*;\s*\$result\s*=\s*curl_exec\(\s*\$ch\s*\);\s*curl_close\s*\(\s*\$ch\s*\)\s*;\s*echo\s*\$result\s*;\s*}\s*\?>(?<X1039800>)|\s*\$zip\s*=\s*new\s*ZipArchive\s*\(\s*\)\s*;\s*\$zip_status\s*=\s*\$\w{1,40}-\s*>\s*open\s*\(\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*===\s*true\s*\)\s*\{.+\."\)"\);\s*}\s*;\s*\?>(?<X1038830>)|\s*\${"\\x[^"]+"}\["[^"]+"\]=.+?\);\s*exit\(\s*\);\s*}\s*\?>(?<X1037740>)|\s*\(\$\w{1,40}\s*=\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\)\s*&&\s*@preg_replace\(\s*'/ad/e'\s*,\s*'@'\s*\.\s*str_rot13\(\s*'riny'\s*\)\s*\.\s*'\(\$\w+\)'\s*,\s*'add'\);\s*\?>\s*(?<X1034131>)|POST\[[^]]+\]\)\s*&&\s*@?preg_replace\('/ad/e',[^;]{1,200};\s*\?>(?<X1041000>))|\s*\?>\)\)'https?://seo\.\w+"=\.\w+\$;\w+\/\w+\/\w+\.txt\s*function\s+\w+\(\$\w+=''?\)\{\s*(\$\w+)=curl_init\(\);\s*(?:curl_setopt\(\22,[^;]{1,80};\s*){4,6}\$\w+=curl_exec\(\22\);\s*curl_close\(\22\);\s*return\s*\$\w+;\s*\}(?<X120337645>)|\s*\becho\h*['"][^'"]{0,49}\bUploader\h*\W{0,9}</title>[^;]{0,49};[^\?]{99,999}\balert\h*\(\h*['"]Exploit\h*by[^\}\?]{1,999}\}\s*\}\s*\?>(?<X1168061>)|\s*\bfunction\s*\w+\((?:\$\w+,?\s*){2,}\)\s*{\s*(\$\w+[\s=]+['"]aes\-256\-cbc['"];)[^%]{1,199}\25[^%]{1,1999}\bfunction\s*\w+\((\$\w+),\s*(\$\w+)\)\s*\{\s*switch\s*\(\26\)\s*\{\s*(\w+)\s*\d:\s*(\$\w+)[\s=]+shell_exec\(\27\);\s*(break);\s*\28\s+\d:\s*\w+\(\);\s*eval\(\27\);\s*\29[\s=]+\w+\(\);\s*\30(?<X220340311>)|\s*\bif\h*\((\$\w{1,9})\h*=\h*implode[\h\(]+['"]{2}[,\h]+\$_[GPRSC]\w{2,6}[\)\s\{]+(\$\w{1,9})\h*=\h*tmpfile[\h\(]+\)\h*;\s*@?fwrite[\h\(]+\33[\h,]+(?:raw)?url(decode)[\h\(]+(?:(?:strrev|str_rot13|base64_\34)[\h\(]+)+\32[\)\h]+;\s*\$\w{1,9}\h*=\h*stream_get_meta_data[\h\(]+\33[\)\h]+;[^\?]{1,99}(?:\?>|\Z)(?<X1183543>)|\s*add_action\(['"]\w+['"],\s*function\(\)\s*\{\s*(\$\w+)[\s=]+['"]pro\-\w+['"];\s*(\$\w+)[\s=]+get_theme_root\(\);\s*(\$\w+)[\s=]+\37\s*\.\s*['"]/['"]\s*\.\s*\36\s*\.\s*['"]/\w+\.php[^%]{1,199}file_get_contents\(\38\);\s*\$\w+[\s=]+base64_decode\(['"]Je(?<X220366950>)|\s*class(?:\h+(\w{1,40})(?:\h*\{(function)\h+__construct\(\)\h*\{(\$\w+)\h*=[^;]{1,99};\42[\h=]+(\$this\->)(\w+)\(\43(access|core)\(\42\)\);[^\v\?]{99,999}\b(?:\41\h+(?:\44|\45)\((\$\w+)\)\h*\{\h*\$\w+[\h=]+\43[^;]{1,99};\h*\$\w+[\h=]+@\$\w+\(\46\);\h*return\h+\$\w+;\h*\}){2}[^\v]{999,}\bnew\h*\40\(\);\s*(?:\?>|\Z)(?<X1171584>)|\s*\{\s*public\h+\$(\w{1,40})\h*=\h*['"]{2};\s*function\h+__destruct\h*\(\h*\)\s*\{\s*@?(?:assert|eval)\h*\(\h*['"]\$this\->\48['"]\h*\);(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*new\h+\40;\s*(\49\h*\->\h*\48)\h*=\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*(?:echo\s*\50;\s*)?(?:\?>|\Z)(?<X1172630>))|\s*(?:(\w{1,40})\s*\{\s*public\s*\$data\s*=\s*'[^']*'\s*;\s*public\s*function\s*__destruct\s*\(\s*\)\s*\{\s*echo\s*base64_decode\s*\(\s*\$\w{1,40}-\s*>\s*data\s*\)\s*;\s*\}\s*\}\s*\$\w{1,40}\s*=\s*new\s*\52\s*\(\s*\)\s*;\s*\?>(?<X1040940>)|\w+\{\w+\(\$\w+,(\$\w+)\)\{return\s*file_get_contents\(\54\[\d+\][^%]{1,99}(\$\w+)=['"]https?://[^%]{1,99}\.top/[^%]{1,99}eval\(['"]\?>[^%]{1,99}\55\)\);\?>(?<X120359300>)|cryptRSA\s*extends\s*php_user_filter\s*\{\s*private\s*\$\w+=0[^%]{1,199}(\$\w+)=['"]str_['"]\.[""]\\x72\\x6f\\x74['"]\.\(string[^@]{1,999}\57\(str_replace\(array\((?:['"]\\x0\w[""],?){1,}(?<X220369620>)))|\s*copy\s*\(\s*['"]https?://[^'"]+['"]\s*,\s*['"][^'"]+\.php['"]\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*\w{4,19}\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\(\59\)\);\s*(?:exit|die)\s*\([^;]{1,19};\s*\}\s*echo[^;]{1,19};\s*(?:\?>|\Z)(?<X1134540>)|\s*define\([^\{]{0,150}\bfunction\h*getCurl\([^\)]+\)\s*\{[^\}]{9,399}\}\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\]]+\];\s*if\(strpos\(\61[^\{]+\{\s*(\$\w{1,25})[\h=]+file_get_contents\([^\)]+\);\s*echo\h*\62[^\{]{9,199}\{\s*echo\h*['"]<script[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?:\s*\?>){1,4}(?<X1200543>)|\s*echo(?:[^;]+;\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*\)\s*;\s*array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1038321>)|[^;]{9,50};\s*function\s*(\w{5,20})\([^\)]+\)\{\$\w{1,9}=curl_init[^\}]{99,300}\}(?:(\$\w{1,9})=\$_SERVER\[[^;]+\.php['"];\$\w{1,9}=\65\(['"]https?[^'"]{9,99}\.txt['"]\);(\$\w{1,9})=fopen\(\66[^\}]{9,99}fclose\(\67\);if\(file_exists\(\66\)\)\{echo\66[^\?]{9,99}done\s*\.\s*['"];){1,5}\s*(?:\Z|\?>)(?<X1126251>)|[^\.;\v]{1,25}\.\h*php_uname\h*\(\)\h*\.[^@]{1,20}\$\w{1,40}\h*=\h*@ini_get\h*\(\h*['"]disable_functions['"]\h*\)\h*;[^\?]{1,350}if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+[^\{]{1,20}\{\s*if\h*\(\h*@[cm]o(?:py|ve_uploaded_file)\h*\(\h*(\$_files\h*\[[^\]]+\])\[[^\]]+\]\h*,\h*\69(?<X2171692>)|\h*['"]<html>\h*<title>\h*Null\h*</title>(?<X2159840>)|\s*"(?:<pre>"\s*;\s*(?:system|exec|eval|assert|shell_exec|passthru)\(\$_(?:GET|POST|COOKIE|REQUEST)\[[^]]{1,20}\]\)\s*;\s*echo\s*"</pre>"\s*;\s*\?>(?<X1040530>)|[^"]+";\s*\$payload\s*=\s*base64_decode.{900,1500}fputs\(\s*\$f\s*,\s*\$payload\s*\);\s*fclose\(\$f\);\s*unlink\(__FILE__\);\s*\?>(?<X1040930>)|PHP\s+Uploader.{200,500}echo "Failed to Upload\.";\s*\}\s*\}\s*\?>(?<X1040780>))|\s*'(?:<b><br><br>'\.php_uname\(\s*\).+echo\s*'<b>Upload[^<]+</b><br><br>';\s*}\s*}\s*\?>(?<X1035471>)|RxR\s+HaCkEr(?<X2051210>))|\s*['"](?:[^"]*['"]\s*;\s*@?move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*['"][^']*['"]\s*\]\s*\[\s*['"][^']*['"]\s*\]\s*,\s*\$\w{1,40}\s*\[\s*['"][^']*['"]\s*\]\s*\[\s*['"][^']*['"]\s*\]\s*\)\s*;\s*@?(?:passthru|system|shell_exec|popen)\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*\?>(?<X1041561>)|[^'"]+['"];\s*preg_replace\s*\(['"][^'"]+['"]\s*,\s*["][^"]+["]\s*,\s*["][^"]+["]\s*\);\s*\?>(?<X1037690>)|\w+['"];\s*error_reporting\(0\);\s*if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*['"]\w+['"]\s*\D{2,3}\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(\$\w{1,40})\s*=\s*strtr\(\$_[GPRSC]\w{2,6}\[[^\]]+\],\s*['"]-_,['"],\s*['"]\+/=['"]\);@?eval\(base64_decode\(\79\)\);\s*echo\s*['"]\w+['"];\s*\?>(?<X1034892>))|\s*[^;]+;\s*\$\w{1,40}\s+=[^;]+;\s*@\s*\$\w{1,40}\s*\([^;]+;['"]\s*\)\s*;\s*\?>(?<X1038330>)|\s*\(?['"]\s*<form\s*[^>]{1,49}\s*method\s*=\s*['"]post['"][^\$]{100,200}\s*if\s*\(\s*@?\$_POST\[['"]?[^'"]{1,40}['"]?\]\s*[^\w]{1,3}\s*['"][^'"]{1,99}['"]\s*\)\s*\{\s*if\s*\(\s*@?copy\(\s*\$_FILES\[['"][^'"]{1,40}['"]\]\[['"][^'"]{1,40}['"]\],[^\?]{1,200}\s*\}\s*\}\s*\?>(?<X1056931>)|\s*hex2bin\s*\(\s*['"][^'"]*['"]\s*\)[^;]{0,99};\s*echo\s*['"]<form\b(?<X2184841>)))
<\?php(?:\s*error_reporting(?:\((?:(?:0|NULL)\);(?:[^\(]{0,40}\bfunction\h*(\w{1,15})\h*\(\h*\$\w{1,15}\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*curl_init\(\);[^\}]{9,399}\bcurl_close\(\2\);\s*return\h*\$\w{1,15};\s*\}\s*echo\h*\1\(str_rot13\(['"]uggc://[^\)]{1,50}\)\);\s*\?>(?<X1196020>)|[^\{]{0,49}\bif\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\{]{1,70}\{\s*(\$\w{1,15})\h*=\h*base64_decode[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*file_put_contents\([^\)]{1,19}\4\);[^\{]{0,40}\{(?:\s*(?:include|unlink)\(\4\);){2}(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1162221>)|\s*\$\w{1,15}\h*=\h*['"]https?://[^\?]{0,599}\bfwrite\(\$\w{1,40}\s*,\s*file_get_contents\(\$\w{1,40}\.['"]\w\-['"]\.\$_GET\[['"]\w{1,40}['"]\]\)\);\s*fclose\(\$\w{1,40}\);\s*\}[^\?]{0,99}\?>(?<X1049075>)|\s*function\h*(\w{1,25})\(\$\w{1,15}\)\s*\{\s*\$\w{1,15}[\h=]+@?curl_init[^\}]{99,500}\}\s*return\h*\$\w{1,15};\s*\}\s*(\$\w{1,15})[\h=]+\7\(str_rot13\(['"]uggc://[^;]+;\s*eval\(['"]\?>['"][\h\.]+\8\);\s*\?>(?<X1198043>)|\s*session_start\(\)[^#]{99,999}<h(?:1|2)>(?:Copy\s*of\s*)?XATHENA\s*V\d+(?<X2126013>))|(?:0|NULL|false)\);[^%@!\*,]{499,999}(\$\w{1,40})=explode\([^;]+;foreach\(\11\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=\12;\}[^\{\}\?]{9,99}(\$\w{1,40})=file\(\13\);for\([^\}]{99,199}\14\[\$\w+\]=['"][^;]+\$_[GPCSR]\w{2,6}\[[^\}]{9,199}\}(\$\w{1,40})=fopen\([^;]+;fputs\(\15,[^\)]+\14\)+;(?<X2134330>)|0\);(?:(\$\w{1,40})="[^"]+";\17=str_replace.{14000,19000}=chr\(hexdec\(\$\w{1,40}\[\$\w{1,40}\]\.\$\w{1,40}\[\$\w{1,40}\+1\]\)\);return\s*\$\w{1,40};\s*\}\s*\?>(?<X1041230>)|.{1,200}?\$root_path=substr\(\$absolutepath,0,strpos\(\$absolutepath,\$localpath\)\);include_once\("\$root_path"\."[^"]+"\);\s*\?>(?<X1040190>)|[^;]+;\$\w+=['"]https?://[^;]+\.txt['"];\s*\$\w+=['"]Mozilla/[^\\]{32,999}\\r\\nHost:\{\$[^?]{32,999}\?\?['"]+;\}\}[^\?]{99,999}\);eval\(['"]\?>['"]\.\$\w+\);\}\?>(?<X120367840>)|\s*(?:require\s*['"](?:(?:\.\./){0,2}(?:check|email)\.php)['"]\s*;\s*){2}\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;\s*)?if\s*\(\s*(?:trim|isset)\s*\(\s*\$_POST\s*\[\s*['"]submit['"]\s*\]\)\)\{\s*if\((?<X2052181>)|\s*(\$\w+)\s*=\s*['"]https?://amp\.iceamericano\.life[^'"]{1,99}['"];[^\(]{1,49}(curl)\w+\(\22\);\s*\23\w+[^\}]{1,499}foreach[^\[]{1,99}(\$\w+)=\[['"]\d+\.\d+\.\d+\.\d+['"][^\[]{1,99}\(\$_SERVER[^\?]{1,199}\24\)\s*\)\s*\{\s*echo\s*\$\w+;\s*die\(\);\s*\}\s*\}\s*\?>(?<X120344701>)|\s*\$nonce=\(isset\(\$_GET\["nonce"\]\)\s*&&\s*!empty\(\$_GET\["nonce"\]\)\)\?\$_GET\["nonce"\]\s*:\s*die\(["']Silence\s+is\s+golden\.["']\);(?<X220337511>)|\s*echo\s*file_get_contents\(\$_GET\['filename'\]\);(?<X2049540>)|\s*if \(!isset\(\$_COOKIE\['\w+'\]\)\)\s*deny\(\);\s*\$cookieData(?<X2045281>)|\s*if\(isset\(\$_GET\['ms-load'\]\)\s*&&.{100,1000}\}\s*\}\s*endif;\?>(?<X1040350>)|\s*if\(isset\(\$_GET\[\w{1,40}\]\)\)\s*\{\s*echo.{100,1000}-->"\.\$_FILES\["\w+"\]\["\w+"\];\}else\{echo"<b>";\}\}\}\s*\?>(?<X1040730>)|\s*ignore_user_abort\(true\);\s*set_time_limit\(0\);\s*function str_1replace\(\$needle(?<X2044641>)|\s*ini_set\(['"]display_errors[^\[]{9,99}\$GLOBALS\[[^\]]{1,20}\]=Array\(base64_decode\(['"][^\}]{999,2400}\}\s*if\(!isset\((\$\w{1,9})\)\)\s*\{if\(!empty[^#]{999,2800}\}echo\s*\32;\s*\}\s*(?:\Z|\?>)(?<X1128410>)|\s*ini_set\(['"]max_execution_time['"],0\);[^\$'"]{0,499}\beval\((base64_decode\()['"][^'"]{999,}['"]\)\);\s*(\$\w{1,9})\h*=\h*str_split\(['"][^\)]{9999,29999}\);\s*(\$\w{1,9})=['"]{2};\s*foreach\(\35[^\}]{99,499}[\}\s]+@?eval\(['"][\?>]{2}['"]\.gz[^\)]+\34\36[\)\s]+;\s*(?:\?>|\Z)(?<X1152621>)|\s*set_time_limit\(\d+\);\s*function id2str\(\$id\)\s*\{.{1000,3000}curl_close\(\$curl\);\s*echo\s*\$content;\s*\?>(?<X1040640>)|ini_set\("display_errors", 0\);\$localpath=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$\w+=substr\(\$\w+,0,strpos\(\$absolutepath,\$localpath\)\);include_once\(\$root_path\."/\w+.zip"\);\s*\?>(?<X1035780>))|[^;]{1,19};\s*function\s*\w+\([^\}]{1,49}\}\s*(\$\w{1,40})\s*=\s*(str_rot13\()[^;]+;\s*\$\w{1,40}\s*=\s*['"]\w{32}['"]\s*;\s*(\$\w{1,40})\s*=\s*\41\s*strrev\([^;]+;\s*(eval\(\40\(\42\()[^\)]{99,199}\)+;\s*\43[^\)\v]{25000,50000}\)+;\s*(?:\?>|\Z)(?<X1133640>)|[^\)]{1,19}\);[^\{]{0,49}\s*function\s+(get_random_string\()[^:>%@]{199,1999}(\$\w{1,40})\s*=\s*\45[^\)]+\);\s*\46\s*=\s*md5\(\46\);[^\?]{0,49}\s*@?(?:copy|move_uploaded_file)\([^\)]+\46[^\)]+\);\s*header\([^\)]+\46\b[^;]+\);\s*(?:die|exit)\b[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1131730>)|\d+[\-\s]+\d+\);[^\}]{1,300}dataablog\.com[^\}]{1,200}(\$\w{1,14})\s*=\s*file_get_contents[^>]{1,400}strlen\(\48\)>[^>]{1,40}>[^\>]{1,100}exit\(\48\);\}\};\?>(?<X2280480>)|\d+\);\s*\$filename\s*=\s*"\w+";\s*\$task_id="\w+";\s*if\(\s*!file_exists\(\$filename\)\s*&&\s*function_exists\(\s*"parse_url"\s*\)\s*&&\s*function_exists\(\s*"socket_create"\s*\).+?\$f\s*=\s*@fopen\(\s*\$filename\s*,\s*"w"\s*\);\s*fclose\(\$f\);\s*}\s*socket_close\(\s*\$fp\s*\);\s*}\s*\?>(?<X1038410>)|\s*E_ALL\s*&\s*.E_NOTICE\s*\);.+?exit\s*\(\s*">\|1\|<"\s*\)\s*;\s*\}\s*\}\s*\}\s*else\s*\{\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1038350>))|\s*\((?:0\);\s*echo[^;]{1,99};\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\}\?]{1,99}['"][aw]\+?['"]\);\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*['"]<\?php\s*if\s*\([^\{\}]{20,99}\{\s*@?eval\s*\([^\};\?\)]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\);\}]+\?>['"][^=\?\}]+\}\s*\?>(?<X1128310>)|\s*\d+\s*\)\s*;\s*(?:\$\w{1,40}\s*=\s*['"]jquery['"]\s*;\s*\$\w{1,40}\s*=\s*['"]var(?<X2046490>)|if\s*\(\s*function_exists\s*\(\s*'[^']*'\s*\)\s*\)\s*\{\s*set_time_limit\s*\(\s*\d+\s*\).+?echo\s*\$\w{1,40}\s*;\s*@file_get_contents\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\?>(?<X1036780>))|\s*E_ALL\s*\)\s*;\s*ini_set\s*\(\s*'[^']*'\s*,\s*1\s*\)\s*;\s*function\s*str_between.+magento\s*not\s*found'[^']*'Content-type:\s*application/json'\s*\)\s*;\s*echo\s*json_encode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1037350>)))|\s*eval\((?:\s*strrev\(.{30000,}\(\s*rqbprqhh_geriabp\s*\(\s*ynir\s*\\'\s*\(\s*31tor_rts\s*\(\s*lave'\s*\)\s*\)\s*;\s*\Z(?<X2048800>)|base64_decode\('IGVycm9yX3JlcG9ydGluZygw(?<X2047520>)|gzinflate\((?:base64_decode\("DZZH(?<X2045161>)|str_rot13\(base64_decode\('[a-zA-Z0-9+/\s]+AQ=='\)\)\)\);\s*\?>(?<X1034181>)))|\s*eval\s*\(\s*(?:\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*(?:\?>|\Z)(?<X1036882>)|base64_decode\s*\(\s*(?:'[^']*'\s*\)\s*\)\s*;\s*\?><\?php\s*eval\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*==\s*"[^"]*"\s*\)\s*\{\s*@unlink\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*\?>(?<X2047530>)|\w+[^)]{1000,}\)\s*\);\s*\?>(?<X1037430>))|gzinflate\s*\(\s*base64_decode\s*\(\s*["']FZc10sXamkPn8q[^"']{99,}["']\s*\)\s*\)\s*\)\s*;\s*\?>(?<X120349361>)|trim\s*\(\s*base64_decode\s*\(\s*["'][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>(?<X1037770>))|\s*extract\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*,\s*\d+\s*\)\s*;\s*strripos\s*\(\s*@sha1\s*\(\s*\$\w{1,40}\s*\)\s*,\s*"[^"]*"\s*\)\s*==\s*\d+\s*&&\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1037010>)|\s*file_put_contents\s*\(\s*['"][^"]*['"]\s*,\s*file_get_contents\s*\(\s*['"][^"]*['"]\s*\)\s*\)\s*;\s*echo\s*["'][^"]*['"]\s*;\s*unlink\s*\(\s*__FILE__\s*\)\s*;\s*(?:\?>|\Z)(?<X1039222>))
<\?php(?:\s*function(?: botcheck\(\s*\)\s*{\s*\$spiders\s*=\s*array\((?<X2047001>)|\h*(\w{1,15})(?:\([^\}]{9,99}\}\s*(\$\w{1,15})\h*=\h*['"][^'"]{9,99}['"];\s*\$\w{1,15}\h*=\h*\2\((?:\3\[\d{1,3}\][^\)]{9,99}\);[^\?]{99,2500}\2\([^\)]+\)\)\s*\.['"]{2}[^\[]{999,30000}['"]{2}\s*\.\2\(\3\[[^\}]{9,99}array\(['",\}]{1,9}\.\$\w{1,15}\.['"/]{1,9}\)\);\s*(?:\Z|\?>)(?<X1145063>)|\h*\3\[\d{1,3}\][^\)]{9,99}\);[^\?]{999,30000}['"]{2}\s*\.\$\w{1,15};\s*\2\h*\([^\)]{9,99}\)\)\(['",\}\h]{1,9}\.\$\w{1,15}\.['"/]{1,9}\);\s*(?:\Z|\?>)(?<X1145101>))|\h*\((\$\w{1,9})\)\s*\{\s*\$\w{1,9}\h*=\h*curl_init\h*\(['"]\6['"]\);[^\}]{1,499}\}\s*(\$\w{1,9})\h*=\h*\2\h*\(['"]https?://bit\.ly/[^;]+;\s*eval\h*\(['"]\?>['"]\h*\.\h*\7\);\s*\?>(?<X2184001>))|\h*(\w{1,15}\()[^\)]+\)\{\s*(\$\w{1,15})\h*=\h*(\$\w{1,15})\h*\.\h*\$\w{1,15};\s*@?touch\(\10\);[^\?]{0,599}\bif\(@?(\$_REQUEST\[[^\]]+\])\)\{\s*(\$\w{1,15})\h*=\h*@?\12;[^\}]{0,99}\becho\s*\9\11,\h*\$\w{1,15},\h*\13\);[\}\s]+(\$dosya)[^\?]{0,99}\bprint\(\14[^\)]+\);\s*\?>(?<X1185270>)|\h*(\w{1,15}\(\))\s*\{[^\}]{1,399}\bcurl_exec\(\$\w{1,15}[\)\h]+;\s*return\h*\$\w{1,15};\s*\}[^\?]{1,1499}\bif\(@?(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\{\s*@?eval\([^\)]{0,15}\bfile_get_contents\(\17[\)\h]+;\s*\}\s*(\$\w{1,15})\h*=\h*\16;\s*\w{1,15}\(\18\);\s*\}\s*\?>(?<X1166611>)|\h+(\w{1,40})\(\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\([^#%\*]{999,9999}\becho\h+\20[^@]{999,9999}=\h*@file_get_contents\(\$\w{1,40}\);[^\^\*]{999,9999}?\bif\h*\(\h*\$\w{1,40}\h*==\h*['"]\w{1,40}['"]\h*\)\s*\{\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1153612>)|\h+(\w{1,40}\(\))\{\$\w{1,40}=['"]\w{1,40}['"];(\$\w{1,40})=['"]https://[^\}]{1,499}\b(file_)pu(t_contents\()([^\s,]+),['"]<\?[^\;]{0,99}\b\24ge\25\h*\23[\h\)]+;(?:\s*(?:include|unlink)\(\26\);){2}[^#]{1,999}\b\22;\24pu\25[^;]{1,99};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1181030>)|\s(\w{1,40})\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*[^;]+;\s*\$\w{1,40}\s*=\s*&\$\w{1,40}\s*;.{1,300};\28\s*\(\s*\$_(?:GET|POST|COOKIE)\s*\[\$d\]\s*\);\s*\?>(?<X1041331>)|\s*(\w+)(?:[^\{]+\{\s*(?:\$\w+\s*=\s*(?:(?:isset|trim)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\s*[\?:]\s*){2}['";\s]{4,8}){2}[^\{]{9,99}(\$\w+)\s*=\s*curl_exec\([^\{]{9,29}\{\s*file_put_contents\([^,]+,\s*\31\s*\);\s*\}[^\{]{9,49}\{\s*echo[^;]{1,19};[\}\s]{2,9}\30\(\);\s*\?>(?<X1129370>)|\s*\([^\{]{1,30}\{\s*(\$\w+)\s*=\s*(curl_)[^;]{1,10};(?:\s*\34setopt\s*\(\s*\33\s*,[^;]{1,50};){6,10}\s*(\$\w+)\s*=\s*\34exec\s*\(\s*\33\s*\)\s*;\s*\34close\s*\(\s*\33\s*\)\s*;\s*return\s*\35\s*;\s*\}[^@]{99,199}(\$\w+)\s*=\s*\30[^;]{1,99};\s*echo\s*\36\s*;(?:\s*\?>)+(?<X1127970>))|\s*(\w{1,15})\((\$\w{1,15})\)\s*\{\s*if\s*\(\s*\39\h*\D{2,3}\h*['"](indoxploit)['"]\)\s*\$\w{1,15}\h*=\h*array\(['"]https?://pastebin\.com/raw[^\}]{9,600}\}\s*\38\(\40\);\s*\?>(?<X1151080>)|\s*(\w{1,40}\()\$\w{1,40}\)\{\s*(\$\w{1,40})=(curl_)init\([^\}]{99,999}\$(\w{1,40})=\44exec\(\43\);\s*return\s*\$\45;\}\s*(\$\w{1,40})=\42['"]https?://[^'"]{1,99}\.txt['"]\);(?:eval|assert)\([^\)]+(?:\46|\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\]\h*\})[\)\h]+;?(?:\?>)?\Z(?<X2129954>)|\s*\w+\((\$\w+)\)(?:\s*\{\s*if\s*\(ini_get\(['"]\w+['"]\)\)\s*\{\s*return\s*@?file_GET_Contents\(\48[^%]{1,2199}https?://slotamp69\.pages\.dev[^%]{1,299}script>['"];\s*exit;\s*\}\s*\}\s*\}\s*\?>(?<X120348823>)|\{if\(function_exists\(['"](\w+)['"]\)\)\s*\{\$\w+=\50\(\48[^%]{1,99}file_get_contents\([^=]{1,32}=['"]https?://awscloud\.icu/[^\{]{1,99}\{eval\(['"]\?>['"]\s*\.\s*\$\w+\);\}\s*\?>(?<X120350164>))|\s*clear_folder\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*is_dir\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*if\s*\(\s*\$\w{1,40}\s*=\s*opendir\s*\(\s*\$\w{1,40}\s*\)\s*\).+\s*\(\s*is_dir\s*\(\s*'[^']*'\s*\)\s*\)\s*rmdir\s*\(\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*is_dir\s*\(\s*'[^']*'\s*\)\s*\)\s*echo\s*"[^"]*"\s*;\s*else\s*echo\s*"[^"]*"\s*;\s*exit\s*;\s*\}\s*\?>(?<X1036950>)|\s*encode\(\s*\$string\s*\)\s*\{.{500,800}=\s*function\(\s*\)\s*\{\s*'\.\$b\['code'\]\.'\}'\s*\)\s*;\s*\?>(?<X1040580>)|\s*isGoogleBot\(\)\s*\{\s*\$\w+[\s=]+\$_SERVER\[['"]\w+[^%]{1,1399}header\(['"]Location:\s*https?://fafawawa\.xyz['"],\s*true,\s*301\);\s*exit;\s*\}\s*\?>(?<X120348811>)|\s*strcode\(\$str\s*,\s*\$passw=""\)\s*{\s*\$salt.+?lmp_client\(strcode\(base64_decode\("[^"]{1,100}"\)\s*,\s*'\w{1,100}'\)\);\s*\?>(?<X1039550>)|\s+(\w{1,20})\(\$\w{1,14}\)\s*\{\s*\$\w{1,14}[\s=]+curl_init\(\)[^@]{1,2450}@file_get_contents[^#]{1,950}stristr\(@?\56\(\$\w{1,14}\)\s*,\s*['"]successfully['"][^#]{1,2200}#[^>]{1,100}(\$\w{1,14})[\s=]+getSeCont[^>]{1,40}\57;\w{1,14}[\(\);\}\s]+(?:\?>|\Z)(?<X1284131>)|\s+(\w{1,40}\(\))\s*\{\s*(\$\w{1,40})\h*=\h*['"]aHR0c[^;]{1,99};\s*(\$\w{1,40})\h*=\h*file_get_contents\([^\)]+\60[^;]{1,40};\s*return\s+\61;\s*\}\s*(\$\w{1,40})\h*=\h*(?:\w{1,40}\h*\(\h*){1,3}\59\h*\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\62\h*\);\s*(?:\?>|\Z)(?<X1144910>)|\s+file_to_include_unknown_cms(?<X2047540>)|\s+gethttpcnt\(\$url\s*,\s*\$timeout\s*=(?<X2048350>))|\s*goto\h*(?:\w{1,40};\s*\w{1,40}:\s*(\$botbotbot)\s*=[^;]+mb_strtolower[\(\h]+\$_SERVER\h*\[['"]?HTTP_USER_AGENT\b[^;]+;[^\[]{99,999}\66[^;]+;\s*(\$\w{1,40})[\h=]+curl_exec[\h\(]+\$\w{1,40}\h*\)[^\}]+echo\h*\67\h*;\s*\}[^\?]{0,99}(?:\?>|\Z)(?<X1178021>)|O\d+;\s*O\d+:[^\n>\-<]{499,}exec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\)[^\n>\-<]{999,1999}exec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\)(?<X2133301>))|\s*goto\h+(?:\w{1,40};\h*\w{1,40}:\h*\$\w{1,40}\h*=\h*file_get_contents\h*\(['"][^\?]{999,9999}mt_rand\h*\([^;]+;(?:\h*goto\h*\w{1,40};(?:\h*\w{1,40}:\h+)+)+\}(?:\h*goto\h*\w{1,40};(?:\h*\w{1,40}:\s+)+)+\?>(?<X1160511>)|\w{3,9};\h*\w{3,9}:\h+if\h*\(!\(strpos\(\$[^\?>]{99,}!(?:empty|isset)\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\?\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\?>]{99,}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*==[^>]{99,}\bhtmlspecialchars_decode\(\$\w{1,40}\);\h*goto\h*\w{1,40};\h*\w{1,40}:\s*\}\s*\?>(?<X1160491>)|\w{4,9};\h*\w{4,9}:\h+(\$botbotbot\d*)\h*=\h*str_replace\h*\([^\v\?<>]{99,999}\72\h*=[^;]{0,99}\bmb_strtolower[\(\h]+\$_SERVER\[['"]?HTTP_USER_AGENT['"]?\][^\?\v><]{1,499}\?>(?<X1181980>))|\s*goto(?:\s(\w+_\w+);\74:\$\w+=[^;]{1,99}https?://[^'"]+.php['"]+\;\$\w+=(\w+_)\w+\(\$\w+\);\75\w+[^=]{1,99}=\75\w+[^;]{1,89};\75\w+[^;]{1,99};eval[^;]{1,99};\?>(?<X120366571>)|\s*(\w{1,40});\s*\w{1,40}:[^\?]{1499,}\77:\s*(\$\w{1,40})\s*=\s*['"](?:\\(?:[a-fx0-9]){2,3}){3}[^\?]{499,9999}\78[^;]{9,99};\s*\}?\s*goto\s*\w{1,9};\s*\w{1,40}:[^\?;]{1,99}(?:\?>|;)\s*\Z(?<X1124801>)|\s*\w{1,40};\w{1,40}.{24000,28000}goto\s*\w{1,40};\w{1,40}:\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\?>(?<X2055030>)|\s*\w{1,9};\s*\w{1,9}:[^\?]{1,99}\bstrtolower\h*\(\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*\);[^\?]{9,4999}\bfile_get_contents\h*\(\h*['"]https?://[^/'";]{0,99}\bfingerling\.org/[^'";]+\.php['"][^\?]{1,999};\s*goto\s*\w{1,9};\s*(?:\w{1,9}:\s*){1,3}\s*(?:\?>|\Z)(?<X1160231>)|\s*\w{4,8};\s*\w{4,8}:\s*(\$\w{1,40})\s*=\s*str_replace\(["']\\[\\xa-f\d]{2,40}['"]\h*,\h*['"]{2}\h*,\h*['"]\\[\\xa-f\d]{99,999}['"]\);[^\.\v]{999,9999}\$\w{1,40}\h*=\h*\$\w{1,40}\(\h*(?:['"]{2}|null)\h*,\h*\$\w{1,40}\h*\(\82\([^\)]+\)+;[^\?\.\v\+?%&]{9,2999}\b\w{2,8}:\h*\?>(?<X1179770>))|\s*header(?:[\('"]+location:\s*https?://[^'"]+['"\)]+;[^:/]+://www\.geoplugin\.[^%]{1,99}\$\w+\s*=\s*fopen\(['"]\w+\.txt['",\s]+a['"]\);fwrite[^;]{1,99};\s*\?>\Z(?<X2307211>)|\s*\(\s*'[^']*'\s*\)\s*;\s*(?:@set_time_limit\s*\(\s*\d+\s*\)\s*;\s*define\s*\(\s*'[^']*'\s*,\s*\d+\s*\.\s*0\s*\)\s*;\s*define\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*if\s*\(\s*file_exists\s*\(\s*PASSWORD_FILE\s*\)\s*\)\s*\{\s*@unlink\s*\(\s*PASSWORD_FILE\s*\)\s*;\s*\}\s*(?<X2046500>)|\$\w{1,40}\s*=\s*'[^;]{5,100};\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*\?>(?<X1040120>))))
<\?php\s*if(?:[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^;]{1,49};\s*(\$\w{1,9})\h*=\h*['"]PD9waHA[^;'"]{9999,}["'];\s*(\$\w{1,9})[^;]{1,20};\s*fwrite\(\2,\h*base64_decode\(\1\)[^\176]{1,699}\.php_uname\(\)\.[^\?\}\{]{1,99}\$\w{1,40}\h*=\h*@?ini_get\(['"]disable_functions['"]\);[^\*&#]{1,799}\?>(?<X1181542>)|[\s\(]+(isset)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*echo[\s\(]*['"]<form\b[^;]+['"][\)\s]*;\s*if[\s\(]+\4[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{(?:\s*\$\w{1,40}\h*=\h*\$_FILES\[[^;]+;){2}\s*if\s*\(\s*@?(?:move_uploaded_file|copy)\s*\((?:\s*\$\w{1,40}[,\h\)]+)+\{[^\?]{0,499}\?>(?<X1187940>)|[\s\(]{2,4}isset(\(\$_[GPCSR]\w{2,6}\[\s*(base64_decode\()['"]\w+['"]\)\])\)[&\s]{2,4}\6\s*==\s*\7[^%]{300,900}array_filter\(glob\((\$\w{1,20}\.\7)[^%]{99,999}file_put_contents\s*\(\8[^%]{99,600}gzinflate\(\7\7['"][^\?]{30000,}\)\.base64_encode\(implode\(\7[^\.]{1,20}\.\7[^\)]+\);\s*\}\s*\?>(?<X1129483>)|\(!(define)d\(['"]PHP_EOL['"]\)\)\{\10\(['"]PHP_EOL['"],['"][^'"]+['"]\);\}if\(!\10d\(['"](DIRECTORY_SEPARATOR)['"]\)\)\{\10\(['"]\11['"],['"].['"]\);\}function\s*generateRandomString\(\$\w{1,40}=\d+\)\{[^\}]{99,999}\}return[^;\}]+;\}\$payload(?<X2130001>)|\(!?\(?isset\(\$_[GPCSR]\w{2,6}\[(chr\()\d+\)\]\)\h*\D{2,3}\h*md5\(\$_[GPCSR]\w{2,6}\[\13\d+\)\]\)\h*\D{2,3}\h*['"]\w{32}['"]\)+\h*(?:exit|die)[^;]{0,19};\h*(\$\w{1,40})\h*=\h*(?:\13\d+\)\h*\.){5}[^\?\v]{9,999};@?include\(\14\);\h*@?unlink\(\14\);\s*(?:\?>|\Z)(?<X1138640>)|\(!\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\){\s*header\('HTTP/1\.1 404 Not Found'\);\s*exit\(\);.+?}\s*\?>(?<X1035151>)|\(!empty\(\$_FILES\['\w+'\]\['\w+'\]\) && \(md5\(\$_POST\['\w+'\]\) == '\w{32}'\)\)\s*{\s*\$sc = \(empty\(\$_POST\['\w+']\)\).+<br/>Security Code: <br/><input name="\w+" value=""/>\s*<br/>Name:\s*<br/><input name="name" value=""/>\s*<br/>\s*<input type="submit" value="Sent" />\s*</form>\s*</body>\s*</html>';(?<X1036570>)|\(!hash_equals\([^%]{1,99}md5\(md5\((\$_REQUEST)[^%]{1,199}(chr\(\d+\));passthru\(\18\[['"][^%]{1,99}\19[^%]{1,19}SHELL(?<X220364611>)|\((md5\()\$_[GPRSC]\w{2,6}\[[^\]]+\]\)!?==['"]\w{32}['"]\)\{http_response_code\(\d+\);(?:exit|die);\}(\$\w{1,40})=\$_[GPRSC]\w{2,6}\[[^\]]+\];if\(!((file_)get(_contents))\(\22\)\)\{[^\{]{99,199}\{\24put\25\((\21\22\)),\23\(\22\)\);\}include\s*\26;unlink\(\26\);\s*(?:\?>|\Z)(?<X1130241>)|\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\s*\{\s*\$\w+\s*=\s*(curl_)init\(\);[^\?]{299,599}(\$\w+)=\28exec\((?:[^\}]{99,299}(fwrite\()(\$\w+),\29\);\s*(fclose\()\31\);\s*\}){2}[^;]{9,39};\s*\30\31,\29\);\s*\32\31\);[^\{]{1,49}(?:\{\s*echo[^;]+;\s*\}\s*(?:else|exit)\s*){2}[^\?]{2,9}\?>(?<X1129472>)|\(\$_SERVER\[(base64_decode)\([^\n]{99,1500}\bif\(file_exists\((\$\w{1,15})\)\)\{(\$\w{1,15})=file_get_contents\(\35\);[^\n]{99,299}\bheader\(\34\([^\)]+\)\.\$[^\;]+;echo\h*\36;\h*(?:exit|die)[^;]{0,9};\}\?>(?<X1194390>)|\(\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\)\)\s*\{\s*(\$\w{1,19})\h*=\h*fopen\(['"]\w{1,19}\.php['"],\h*['"]\w['"]\);[^\?]{0,199}\bfclose\(\38\);\s*\}\s*\?>(?<X1173870>)|\(\s*empty\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'ineedthispage'\s*\]\s*\)\s*\)\s*{\s*ini_set\(\s*'display_errors'\s*,\s*"Off"\s*\)\s*;\s*ignore_user_abort\(1\)(?<X2044581>)|\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*{\s*echo\s*"[^"]+";\s*}\s*\$f\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$id=\$f;\s*\$current\s*=\s*file_get_contents\("[^"]+"\);\s*file_put_contents\(\$\w+\s*,\s*\$\w+\);(?<X1035421>)|\(\w+\(\$_\w+\[["']\w+["']\][^\$]{1,29}\$\w+\s*=\s*file_put_contents\((\$_\w+)[^\?]{1,49}['"]wp\-[\w\-]+\.php['"],\s*base64_decode\(\$_\w+[^\}]{1,39}echo\s*['"]https?://['"]\s*\.\s*\42\[['"]\w+['"]\]\s*\.\s*['"]/wp\-[\w\-]+\.php['"];[^\?]{1,399}echo[^;]+;\s*\}\s*\}\s*\}\s*\?>(?<X120366814>)|\(isset\((?:(\$_GET\[['"]\w{1,14}['"]\])\)\s*&&\s*\44[\s=]+['"][^\(]{1,50}base64_decode\(['"]aHR0cHM6Ly81MWxhLnp2bzIueHl6[^>]{1,1000}die\(\);\?>(?<X1318411>)|\$(?:\w{1,40}\['[^']*'\]\)\s*&&\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=='[^']*'\)\s*\{\s*\$\w{1,40}\s*=\s*array\s*\('[^)]+\);\s*echo\s*\$\w{1,40}\[chr\(\d+\)\]\(\$\w{1,40}\['[^']*'\]\['[^']*'\],\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*exit;\s*\}\s*\?>\s*<form.+?</form>(?<X1038341>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\w+\]\)\)\s*{\$\w+="[^"]{2000,}";(?<X2044881>)|_GET\[(?:['"]\w{1,10}['"]\].{60,70}\$disable_functions\s*=\s*@ini_get\(['"]disable_functions['"]\);\s*.{320,350}echo['"]<b>\s*gagal[\s\w]{0,15}['"];\s*\}\s*\}\s*\}\s*\?>(?<X1041780>)|php\]\)\)\s*\{(?<X2103221>))))|\(md5\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["ms\-load"\]\)==".{32}"\){\s*\$p=\$_SERVER\["DOCUMENT_ROOT"\];(?<X2044821>)|\h*\((?:\h*isset\h*\()?\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+\{[^\}]{1,99}\$\w{1,40}\(\h*\51\h*\);\s*\}\s*if\h*\((?:\h*isset\h*\()?\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{?\s*echo\h*['"]<form[^\}\?]{1,499}\b(?:copy|move_uploaded_file)\h*\(\h*\$_FILES\[[^;]+;(?:\s*\})?\s*(?:\?>|\Z)(?<X1139760>)|\h*\(\h*!?empty\h*\(\h*(\$_[GPCSR]\w{2,6}\[)[^\}:/]{1,199}\$(\w{1,40})\h*=\h*['"]https?://['"]\h*\.\53[^;]{1,99};\h*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\$\54\h*\);[^\}\?:/><]{1,199}\$(\w{1,40})\h*=\h*\55;\h*fwrite\h*\([^\);]+\$\56\h*\);\h*fclose\h*\([^;]{1,99};[\}\s]+\?>(?<X1178860>)|\h*\(\h*!(?:\h*(define)d\h*\(['"](\w{1,40})['"][\s\)]+\{\s*\58\h*\(['"]\59['"][^;]+;\s*if\h*\(\h*!\h*\58d\h*\(['"]\w{1,40}['"][\s\)]+\{\s*error_r[^&]{999,9999}(\$\w{1,40})\[\]\h*=\h*sys_get_temp[^\}]+\}[^;]{1,40}\barray_merge\h*\(\h*\60\h*,[^@]{4999,15000}\b\w{1,40}\([^;]+\);(?:\s*\}){2,3}\s*(?:\?>|\Z)(?<X1164123>)|current_user_can\h*\(\h*['"]administrator['"][\s\)\{]+(?:echo\h*strrev\h*\([^\)]+\);\s*){3,4}}\s*\?>(?<X1194501>)|file_exists\(['"](?:/|\\x2f)(?:\\x68|h)(?:o|\\x6f)(?:\\x6d|m)(?:e|\\x65)[^'"]{60,199}['"]\)\D{2,9}md5_file\(['"][^"';\)\$]+['"]\)\D{2,9}['"][a-f\d]{32}['"][\)\s\{]+(@?chmod\(['"])[^"';\)\$]{60,199}['"][,\h]+\d{3,4}\);\s*@[mc]o(?:py|ve_uploaded_file)\([^;]{99,999}\);\s*\63[^;]+;\s*\}\s*\?>(?<X1185880>))|\h*\(\h*(isset)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*if\h*\(\h*\65\h*\((?:\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*[,\)]){2}[\h\)]+\{[^\}]{1,199}\beval\h*\((?:\h*(?:gzuncompress|base64_decode)\h*\(){2}\h*\66[\h\)]+;[^\$\(\?]{1,99}[de](?:ie|xit)[^;]{0,19};[\s\}]+(?:\?>|\Z)(?<X1148700>)|\h*\(\h*\$_(?:[GPCSR]\w{2,6}\[[^\]]+\][^\)]{0,49}\)\h*\{\h*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"][^'"]{0,49}\bhttps?://(?:[rw][aw]w\.)?(?:github(?:usercontent)?|pastebin)\.com/[^'"]{1,99}['"]\h*\);\h*\}\s*\?>\s*\Z(?<X1145940>)|[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\S{2,3}\h*['"][^'"]{1,64}['"][\)\s]+\{\s*\?>\s*<(title>)[^/<]{0,99}</\69[^\*!@]{1,999}<\?php[^\?@]{1,999}\bif\h*\(\h*@[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\h*\[[^;]+;\s*\}\s*else\s*\{\s*echo[^;]+;[^\v]{0,99}\}\s*(?:\?>|\Z)(?<X1174000>))|\h*\(\h*\(\h*isset\(\$_[GPCSR]\w{2,6}\[[^\v]{999,1999}\$shell_data\h*=\h*gzinflate\(\h*(base64_)decode\([^\)]{9999,39999}\)[^\v\?]{1999,4999}\becho\h*['"]<!\-\-\h*\w{1,40}['"]\h*\.\71encode\([^\)]+[\)\h]+\.\h*['"]\-\->['"];\h*\}\s*\?>(?<X1146680>)|\h*\(\h*file_exists\h*\(\h*['"](/tmp/sess_)['"]\h*\.\h*md5\h*\(\h*\$_SERVER\[[^\{]{1,99}\{\s*include\h*\(\h*['"]\73['"][^\;]{0,49}\.php['"]\h*\);\s*\}[^\}]{9,450}\}\s*function\h*\w{1,50}\h*\(\h*\$\w{1,50}\h*\)\s*\{[^\}]{0,550}\bcurl_close\h*\(\h*\$\w{1,50}\h*\);\s*\}\s*(?:\?>|\Z)(?<X1180421>))
<\?php\s*if(?:\h*\(\h*isset\h*\((?:\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*define\(['"](ADMIN_REDIR_URL)['"],['"]https?://[^'"]{1,99}\.php['"]\);[^\*]{999,9999}(function\h+geturl)_?\d*\([^\)]+\)\s*\{[^\?]{99,999}\2_?\d*\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\(\1\);[^\}]+\}\s*exit\b[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1162970>)|\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+(?:\{\s*)?echo\b[^;]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\4\h*\)[^;]{1,99};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1179120>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h\)]+\s*\{\s*(\$\w{1,15})\[(['"]\w{1,15}['"])\]\h*=\h*strrev\([^\)]{9,49}\);\s*(\$\w{1,15})\[\]\h*=\h*\7;[^\?\{]{0,99}\9\[\d{1,2}\]\[\8\]\(\6\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1176600>)|\h*(\$_REQUEST\[[^\]]+\])\h*\)\h*\D{2,3}\11\h*\D{2,3}[^\{]+\{\s*ini_set\(['"]display_errors[^\?]{199,599}\bif\h*\(\h*isset\h*\(\h*\$_REQUEST\[['"]run_shell['"][^\{]+\{\s*print\h*\(\h*shell_exec[^\?]{0,199}\?>(?<X1189310>)|\h*\$_(?:[GPCSR]\w{2,6}\[(?:[^\]]+\][\)\s]+\{\s*(\$\w{1,40})\h*=\h*unlink\(__FILE__\);\s*if\h*\(\h*\13\h*\)\s*\{\s*echo\b[^;]{1,49};\s*\}\s*else\s*\{\s*echo\b[^;]{1,49};[\s\}]+(?:\?>|\Z)(?<X1152970>)|[^\{]{1,49}\{\s*echo[^;]{1,49};\s*return;\s*\}\s*if\s*\(\s*count\h*\((\$_FILES\[[^\]]+\])\)[^\}\?]{99,499}\bisset\h*\(\s*\15\s*\)\s*\?\s*\(\s*@?is_uploaded_file\h*\(\s*\15[^\)]{1,49}\)\s*\?\s*\(\s*@?copy\h*\(\s*\15[^\)]{1,49}[\):\d\s]{7,19};\s*\}\s*\?>(?<X1139142>))|[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*echo\h*['"]<div[^;]{1,99}\buploade?d?\h*files?[^\?]{9,400}\bif\h*\(\h*@?(?:copy|move_uploaded_file)\h*\([^\)]+[\)\s]+\{\s*echo\h*['"]<a\h*href[^\;]{1,99};[\}\s]+\?>(?<X1192720>)))|\s*\(!empty\s*\(\$_[GPRSC]\s*\w{2,6}\s*\[[^\]]+\]\)\)\s*\{\s*\$\w{1,40}\s*=\s*['"]\w{32,40}['"];[^\(\{]{1,99}if\s*\(md5\s*\(\$\w{1,40}\)\s*\D{2,3}\s*\$\w{1,40}[^\)]+\)+\s*\{\s*@?eval\s*\(base64_decode\s*\(\$_[GPRSC]\s*\w{2,6}\s*\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1125750>)|\s*\(!function_exists\('(_[^']*)'\)\)\s*\{\s*\$\w{1,40}\['[^']*'\]\s*=\s*Array\('[^']*'\);\s*.+?\$\w{1,40}\['[^']*'\]\[\d+\]\s*\(\19\(\d+\),\s*\$_[GPRSC]\w{2,6}\[\19\(\d+\)\],\s*\19\(\d+\)\);\s*exit;\s*\}\s*\}(?<X1053281>)|\s*\((isset\()(\$_FILES\[['"]\w+['"]\]\[)[^\)]+\)\)\s*\{\s*\$\w{1,40}\s*=\s*\21(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\s*\?\s*urldecode\(\23[^;]{1,49};\s*if\s*\(@?(?:move_uploaded_file|copy)\(\22[^;\{]+\{\s*(echo\s*)[^;]+;\s*\}\s*else\s*(?:\{\s*)?\24[^;]{0,19};\s*\}\s*(?:\Z|\?>)(?<X1131551>)|\s*\(\$_(?:FILES\['F1l3'\]\) {move_uploaded_file.+? forbidden!'; } \?>(?<X2044151>)|GET\s*\[(?:'ch'\]\)\s*\{\s*echo "OK";\s*exit;\s*\}.{100,400}echo\s*"An error occured";\s*\}\s*\?>(?<X1040810>)|\s*'ch'\s*\]\s*\)\s*{\s*echo\s*"OK"\s*;\s*exit\s*\(\s*\)\s*;\s*}(?<X2048940>)))|\s*\(\s*!(?:\s*(function)_exists\s*\(\s*['"]([^'"]+)['"][\s\)]+\{[^\}]{1,99}\bif\s*\(\s*(\$\w+)\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^\)]+\)+\s*\{\s*\29\s+\30\s*\(\s*(\$\w+)\s*\)\s*\{[^\}]{1,199}fwrite\s*\([^\)]+\32\s*\);[^\}]{1,199}\}\s*@?extract\s*\(\s*\30\s*\(\s*\31[\s\)\};]+(?:\?>|\Z)(?<X1134300>)|isset(?:\(\s*\$GLOBALS.+\$\w{1,40}\s*=\s*substr\s*\(\s*\$\w{1,40}\s*,\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*,\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*NULL\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\-1\s*;[^\?\{\}]{0,99}\?>(?<X1034923>)|\s*\(\s*(\$sRetry)\s*\)\s*\)\s*\{\s*global\s*\35\s*;[^>]+(\$\w{1,40})\s*=\s*@?curl_exec\s*\(\s*(\$\w{1,40})\s*\);\s*if\s*\(\s*\36\[[^\}]+\}\s*@?curl_close\s*\(\s*\37\s*\);\s*\}\s*\}\s*\?>(?<X1124487>)))|\s*\(\s*"[^"]*"==\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*,\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\}\s*\?>(?<X1038080>)|\s*\(\s*(?:md|sha)\d+\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*@?preg_replace\s*\((?:\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,?){3}\)(?:\s*;)?\s*\}(?<X1040572>)|\s*\(\s*(\$_FILES\[[^\]]{1,40}\])\[[^\]]{1,40}\]\s*[^\w]{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*if\s*\(\s*\41[^\}]+exit\(?\)?\s*;\s*\}[^\$\(\{\}\)]+if\s*\(\s*is_(uploaded_file)\s*\(\s*\41\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_\42\s*\(\s*\41[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}\s*(?:\?>|\Z)(?<X1059531>)|\s*\(\s*@?(?:(\$_SERVER)\[['"](HTTP_X_)\w{1,40}['"]\]\)\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*if\s*\(\s*@?\44\[['"]\45\w{1,40}['"]\]\)\s*\{\s*file_put_contents\s*\(\s*@?\44\[['"]\45\w{1,40}['"]\],\s*@?\44\[['"]\45\w{1,40}['"]\]\s*\);\s*\}\s*\}\s*(?:\?>|\Z)(?<X1053781>)|file_put_contents\s*\(['"][\./]{3,}wp[_\-]\w{1,40}\.php['"]\s*,\s*['"\s\.base64_dco]{13,40}\s*\(['"][^'"]{65000,}['"][\s\)]+;?\s*(?:\$?\w{1,40}\s*[^;]+;\s*)?unlink\(__FILE__\);\s*(?:die|exit)[^;]{0,9};\s*(?:\?>|\Z)(?<X1137130>)|isset\(\s*(\$_POST)\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*\{[^\?]{1,4999}\btouch\(\$_SERVER\[['"]?DOCUMENT_ROOT['"]?\]\s*\.\s*base64_decode\s*\(\48\[['"]?\w{1,40}['"]?\]\)\s*,\s*strtotime\(['"]\-\d+\s*\w{0,5}['"]\)\);\s*die\([^\)]{1,40}\);\s*\}\s*(?:\?>|\Z)(?<X1053792>))|\s*\(\s*\!\s*function_exists\s*\(\s*['"](\w{1,25})[^\}]{1,250}file_get_contents\(['"]https?://(?:www\.)?dolsh\.com[^\+]{1,200}tempnam\(sys_get_temp_dir[^,]{1,20},\s*['"]\50[^>]{1,240}\?>(?<X1288551>)|\s*\(\s*\$(?:\w{1,40}\s*=='upload'\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*,\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*;\s*\}\s*\}\s*\?>(?<X1037080>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^"']*['"]\s*\]\s*\)\s*\{\s*\$\w{1,40}="[^;]+"\s*;\s*preg_replace\s*\(\s*"/[^/]+/e"\s*,\s*\$_\s*\(\s*"[^"]{1,500}"\s*\)\s*,\s*0\s*\)\s*;\s*\}\s*\?>(?<X1040920>)|_[GPCSR]\w{2,6}\[[^\{\?]{1,49}\{\s*echo[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}\s*(\$\w{1,40})\s*=\s*['"\w\s\.]{15,40};\s*(\$\w{1,40})\s*\=\s*['"\s\.\w]{13,40};\s*register_shutdown_function\s*\((?:\54|\55)\s*\(['"]{2}\s*,\s*(?:\54|\55)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^;]{1,49};\s*(?:\?>|\Z)(?<X1144771>))|\s*\(\s*function_exists\s*\(\s*['"]([^'"]+)['"][\s\)]{2,4}\{\s*@?\57\s*\(\);\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=[^;]{1,99};\s*eval\s*\([^\)]{1,99}file_get_contents\s*\(\s*['"]https?://pastebin\.com/[^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1133752>))
<\?php(?:\s*if(?:\s*\(\s*isset(?:\(\s*\$_GET\[\s*"ms-load"\s*\]\s*\)\s*&&.{100,1000}print "Error:n";\s*\}\s*\}\s*\}(?<X1040310>)|\s*\(\s*\$(?:\w{1,40}\s*\[\s*\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*tmp_name\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*tmp_name\s*\]\s*,\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*name\s*\]\s*\)\s*;\s*\}\s*\}\s*\?>\s*<form.{50,200}</form>(?<X1039950>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(?:'[^']*'\s*\]\s*\)\s*\)\s*die\s*\(\s*pi\s*\(\s*\)\s*\)\s*;\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*="[^"]*"\s*;.+eval\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1037340>)|['][^'"]*['"]\s*\]\s*\)\s*\)\s*\{\s*phpinfo\s*\(\s*\)\s*;\s*\}(?<X1039520>))|_(GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]?([^'"]{1,40})['"]?\s*\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_\5\s*\[\s*['"]?\6['"]?\s*\]\s*;\s*preg_replace\s*\(\s*['"](.)[^`]{0,40}\8e['"]\s*,\s*\7\s*,\s*['"]\w{1,10}['"]\s*\)\s*;\s*exit\s*;\s*\}\s*\?>(?<X1042160>)|_[GPCSR]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*function\s+(\w{1,40})\s*\([^\}]{99,499}\bcurl_close\(\$\w{1,40}\);\s*\}[^\}\?]{1,99}(\$\w{1,40})\s*=\s*\10\s*\(\s*['"]https?://[^/;]+\.paste\.se/[^;]{1,49};[^\?\}]{1,99}\bfwrite\((\$\w{1,40}),\s*\11\);\s*fclose\(\12\);\s*\}\s*(?:\?>|\Z)(?<X1152740>)|[^\{]{0,99}\)\s*\{[^\}]{1,600}(\$\w{1,40})\s*=\s*array\s*\([^\)]{0,39}\$_[GPCSR]\w{2,6}\[[^\]]+\][^\)]{0,39}\)[^;]{0,40};\s*array_walk\s*\(\s*\14\s*,\s*strval\s*\(*\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\)\s*,\s*['"][^'"]*['"]\s*\)\s*;[\s\}]+(?:\?>|\Z)(?<X1129820>))|_[GPRSC]\w{2,6}(?:\s*\[[^\]]+\])?\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*\16\s*\)\s*;\s*\}\s*\?>(?<X1128610>)|_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:(?:\$\w{1,40}\s*=\s*['"][^;]+;\s*){2,}\$\w+\(\$\w+\([^)]+\)\s*\)\s*;\s*\}(?<X1039241>)|\$\w{1,40}=\s*explode\s*\(\s*["][^"']*["']\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@die\s*\(\s*\$\w+\[\d+\]\(\$\w+\[\d+\]\)\);\s*}\s*\?>(?<X1038271>))|_[GPRSC]\w{2,6}\s*\[(?:[^\]]+\]\)[^\{\};]{0,99}\)\s*\{\s*foreach\s*\(\s*glob\s*\(['"][^'"]+/cache/\*['"],\s*32\s*\)\s*as\s*(\$\w{1,40})\)\s*\{[^\}\{@]+@?unlink\s*\(\20\);\s*\}[^\}]+\}\s*error_reporting\s*\(\s*round\s*\([^\)]+\)\s*\)\s*;(?<X2124303>)|\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*\{\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);(?:\s*\$\w{1,40}\s*=\s*[^;]{1,40};){0,5}\s*\$\w{1,40}\s*=\s*rand\((?<X2052271>))|_GET\[[\s\.\w']+]\s*\)\s*\)\s*{\s*copy\s*\([^)]+\)\s*;\s*exit;\s*}\s*\?>(?<X1039460>)|_POST\s*\[\s*'comment'\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*md5\s*\(\s*\$_POST\s*\[\s*'comment'\s*\]\s*\)\s*==\s*"[^"]*"\s*\)\s*\{(?<X2050011>))|\s*\(\s*\[\s*'[^']{1,10}'\s*\]\s*\)\s*\)\s*\{\s*(?:system|shell_exec|exec|passthru|popen)\s*\(\s*\[\s*'[^']{1,10}'\s*\]\s*\)\s*;\s*\}\s*\?>(?<X1040541>))|\s*\(\s*md5(?:\(\s*\$_(GET|POST|COOKIE|REQUEST)\['\w{1,40}'\]\)\s*===.{100,1000},\);array_walk\(\$\w{1,40}\s*,\s*strval\(\$_\26\['\w{1,40}'\]\)\s*,\s*''\)\s*;\s*\}\s*\}\s*\?>(?<X1040440>)|\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w{1,40}['"]?]\)\s*==\s*['"]\w{1,40}['"]\)\{\s*\}\s*\?>(?<X1053661>))|\s*\(\s*substr\s*\(\s*md5\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\{]{1,49}\{\s*(\$\w{1,40})\s*=\s*str_replace\([^\)]+\$_[GPCSR]\w{2,6}\[[^\)]{1,49}\);\s*@?(?:system|exec|shell_exec|passthru)\s*\(\s*\29\s*\);\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1131770>)|\s*\(file_exists\s*\((['"]/tmp/[^/]+/sess_[^'"]{1,40}['"])\)\)\s*@?include(?:_once)?\s*\(\31\);\s*else\s*echo\s*\(?['"]?[^'"]{0,40}['"]?\)?;\s*\$\w{1,40}\s*=\s*"https?://"\.getenv\("SERVER_NAME"\)\.getenv\("SCRIPT_NAME"\);(?<X2053443>)|\s*\(isset(?:\(\$_REQUEST\[\w+\]\)\)\s*\{\s*stripslashes\(\$_REQUEST\[\w+\]\(\$_REQ.+?\?>(?<X1054921>)|\s*\(\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\)\)\s*{\s*\$\w+="Fil.+?\s*\$default_use_ajax\s*=\s*true(?<X220369290>)|GET\['check'\]\)\)\s*\{\s*echo\s*"checked.{300,600}echo\s*'<a href='\.\$file\.'>'\.\$file\.'</a>';\s*\}\s*else\s*\{\s*echo\("FILE"\);\s*\}\s*\?>\s*</body>\s*</html>(?<X1041050>))))|\s*ignore_user_abort\(true\);[^%]{1,99}error_reporting\(0\);[^%]{1,999}function\s*\w*\(\)\s*\{\s*return\s*\[\s*(?:['"][^'"]+\.php['"],\s*){10}[^%]{1,999}<title>Shell\s*Deployer</title>(?<X220369420>)|\s*include(?:\s*(?:'check_is_bot\.php'\s*;\s*if\s*\(\s*empty\s*\(\s*\$is_bot\s*\)\s*\)\s*\{\s*echo(?<X2048140>)|(dirname\()\38\38\38\38\w+\){5}\.['"]/wp\-load\.php['"];\s*\w+\(wp_hash\(\$_COOKIE\[(?<X220362960>)|['"]compress\.zlib://index\.gz['"]\?>(?<X120344420>))|\s+'antibots\.php';.{3000,5000}<title>Paypal(?<X2049200>))|\s*ini_set\((?:"log_errors", false\);ini_set\("display_errors", false\);error_reporting\(0\);if\s*\(isset\(\$_REQUEST.{1,1000};file_put_contents\(\$tmp, "<\?php "\.gzuncompress\(base64_decode\(\$_POST\["\w+"\]\)\)\);include \$tmp;\};\s*\?>(?<X1040720>)|['"]display_errors['"],\h*['"]0['"]\);error_reporting\(\w+\);if\(!function_exists\(['"]\w+['"]\)\)[^#]{1,859};return['"]https:?//rpc\.adspect\.net/\w+/\$\w+\?\$\w+['"];(?<X220366821>))|\s*ob_start\(\);\s*(?:header\(['"]\w+:\s*User\-Agent['"]\);\s*\$\w+[\s=]+['"]https?://aula\-nuevohorizonte\-2026\.web\.app/[^%]{1,1499}else\s*if\(\s*(\$\w+)\[['"]\w+['"]\]\s*==\s*['"]\w+['"]\s*\)\{\s*\$\w+[\s=]+\$\w+\.\44\[['"]description['"]\];\s*\}\s*\}\s*\?>(?<X120349150>)|require_once\s*['"]antibot\.php['"];[^%]{1,2699}(\$\w+)[\s=]+['"]\\n[\s=]+OTP[^@]{1,299}sendToTelegram\(\46[^@]{1,1799}\]\);\s*\}\s*exit;\s*\}\s*\?>(?<X120348690>))|\s*preg_replace(?:\("/\w+/e"\s*,\s*"e["'.va]+l\('"\.\$_REQUEST\['\w+'\]\."'\)"\s*,\s*"[a-zA-Z\s0-9_]+"\);\s*\?>(?<X1034161>)|\s*\(['"]/\.\*/e['"]\s*,\s*['"](?:\\x[a-fA-F0-9]+){5,}.+['"]\s*,\s*['"]['"]\);\s*(?:\?>|\Z)(?<X1034802>))|\s*require(?:\s*'call\.php';\s*\$md5\s*=\s*md5\(\s*uniqid\(\s*time\(\s*\)\s*\)\s*\);(?<X2047010>)|\s+__DIR__\s*\.\s*['"]/\w\.html['"];\s*exit;\s*\?>(?<X120367052>)|_once\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\.\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}-\s*>\s*Authorize\s*\(\s*1\s*\)\s*;\s*require_once\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\.\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1037021>))|\s*session_start\((?:\);\$pass=['"][^;]+;\w+\(!isset\(\$_SESSION\[[^@]{1,599}<img\s*src=['"]https://raw\.githubusercontent\.com/AlvaXPloit(?<X220365670>)|\s*\);\s*\$mail\s*=\s*\$_SESSION\['mail'\]\s*=\s*\$_POST\['mail'\];\s*\$pass\s*=\s*\$_SESSION\['pass'\]\s*=\s*\$_POST\['\w+'\];\s*\$IP\s*=\s*\$_SERVER\['REMOTE_ADDR'\];(?<X2047310>))|\s+#(\w{1,15}#)\s*error_reporting\(0\);[^:]{99,199},\s*(\$\w{1,40})\s*\)\s*&&\s*!preg_match\s*\(['"]/bot/\w['"],\s*\56\)[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]{69,400}\56[^\}]+(\$\w{1,40}),\s*CURLOPT_URL,\s*\57[^\}]+(\$\w{1,40})\s*=\s*curl_exec\s*\(\58\);[^#\?]+\59;\s*\}\s*#/\55\s*(?:\?>|\Z)(?<X1124050>)|\s+(?:/\*[^\*]+\*/)?if(?:/\*[^\*]+\*/)?\((?:/\*[^\*]+\*/)?isset\(\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/\*[^\*]+\*/)?\)(?:/[^/]+/)?\)(?:/[^/]+/)?\{(?:/[^/]+/)?\$\w{1,20}(?:/[^/]+/)?=(?:/[^/]+/)?["'][assert'".\s]+["'];[^_]{1,40}\$_[GPRCS]\w{2,6}\[[^\]]+\]\)(?:/[^/]+/)?;(?:/[^/]+/)?(?:exit|die)[^;]{0,9};(?:/[^/]+/)?\}(?:\?>|\Z)(?<X1036602>)|\s+(?:@?(?:error_reporting|set_time_limit)\s*\((?:0|NULL)\);\s*){1,2}\$(?:s_name|name|shell|title)\s*=\s*['"]b374k(?:\s*shell)?['"](?<X2121661>)|\s+(?:\$\w{1,20}\s*=\s*base64_decode\s*\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\);\s*)+@?eval\s*\(\$\w{1,20}\s*\(\$_POST\[base64_decode\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\)\]\)\);.+base64_decode\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\)\]\);\s*\};\s*\?>(?<X1036461>)|\s+(?:\$\w{1,40}\[['"]\w{1,9}['"]\]\h*=\h*['"][^'"]{1,40}['"];\s*){9,}if\s*\(\s*isset\s*\(\s*(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\s\)]+\{\s*foreach\s*\(\s*str_split\s*\(\s*\64[^\(]{9,99}(\$\w{1,40})\s*=\s*create_function\s*\(['"]{2}\s*,\s*[^;]{2,40};\s*\65\s*\(\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1137010>))
<\?php(?:\s+(?:\$\w{1,40}\s*=(?:\s*chr\(\d+\)\s*\.[^;]{9,999}chr\(\d+\));\s*){2,5}[^,]{49,99},\s*@?array\s*\([^;]{1,99};\s*@?(?:include|include_once|require|require_once)\s*\(\s*\$\w{1,40}\);\s*@?unlink\(\s*\$\w{1,40}\s*\);\s*(?:\?>|\Z)(?<X1056882>)|\s+(?:\$\w{1,40}\s*=\s*['"][^'"]{9,99}['"];\s*){5,}.+CURLOPT_RETURNTRANSFER\s*, TRUE\s*\)\s*;\$\w{1,10}\s*=\s*\$\w{1,10}\(\s*\$\w{1,10}\s*\)\s*;\s*\$\w{1,10}\(\s*\$\w{1,10}\s*\)\s*;\s*echo\s*\$\w{1,10};\s*\}[^\?]{0,99}\?>(?<X1038911>)|\s+(?:class\s*(\w+)\s*\{[^\{]{0,99}(?:[\w\s]+function\h*_\w+\s*\([^\)]*\)[\s\{]+[^\}]{9,}[\}\s]+)+){2,4}\berror_reporting\(\3::[^\}]{99,900}\bdie\((\w+)::[^\d]{9,200}\bregister_shutdown_function\(\4::(\w+)\([^\\/@#'\*]+;\w+\(\4::\5\([^\-\d]{99,400}\}\s*echo\s*\4::\5\([^\)]+\);[^\(]{0,20}\}[\?>\s;]*\Z(?<X2256451>)|\s+(?:die|exit)\b[^;]{1,9};\s*\}\s*[^/]{1,200}<title>\s*Sign\W{1,9}in\W{1,9}Google\W{1,9}Accounts\s*</(?<X2065493>)|\s+(?:error_reporting|set_time_limit)\s*\((?:0|NULL)\);(?:\s*@?ini_restore\s*\([^\)]+\);)?\s*if\s*\(\s*!isset\s*\(\s*\$_SESSION\[['"]bajak['"]\]\)\s*\)\s*\{(?<X2119332>)|\s+(?:ini_set\([^;]+\);){1,4}[^&]{0,50}if\((?:\s*empty\(\$_(?:G|P|R|C|S)\w{2,4}\)\s*\&?\&?){1,5}\)\s*\{\s*exit\(file_get_contents\([^;]+\);[^#]{999,7000};\s*if\(@?mail\([^\)]+\)\)\{[^']{99,};\s*function\s+\w{1,20}\((\$\w{1,9})\)\s*\{(\$\w{1,9})=array\([^`]{999,2000}\);return\s+\10\[\9\];\}(?<X1064832>)|\s+(\$\w+)=['"]\w+\.php['"];(\$\w)=['"]https://raw\.githubusercontent[^;]{1,199};if\(\(\$\w+=@?file_get_contents\(\13[^;]{1,199};@?file_put_contents\(\12,\$\w+\);@?chmod\(\12,\d{4}\);(\$\w+)=mktime\(rand\(\d+,\d+\),[^;]{1,199};@?touch\(\12,\14,\14\);\}\}\s+\?>(?<X1326081>)|\s+(\$\w+)[\s=]+\w+\(\)\{\s*\$\w+=\w+\((\$\w+)\)\s*\{\s*\$\w+\s*=\s*array\(\);\s*\17[\s=]+['"]\W{999,}['"];\s*\$\w+=\s*preg_split\(['"]//u['"],\17,\s*\-1,\s*PREG_SPLIT_NO_EMPTY\);[^\?]{1,1999}sys_get_temp_dir\(\)\.\w+\.['"]temp_[^\?]{1,999}endif;\s*\};\s*\16\(\);\s*\?>(?<X120351810>)|\s+(\$\w+)\s*\=\s*array\((?:['"]\w+(?:\-)?\w+['"],\s*){5}[^(]+\);\s+(\$\w+)\s*\=\s*isset\((\$_SERVER\[['"]\w+['"]\])\)\s*\?\s*\21[^%]+is_bot\(\20,\s*\19[^%]+(?:exit|die);\s*\}\s*(?:\?>|\Z)(?<X120335631>)|\s+(\$\w+)\s+\=\s+isset\((\$_GET\[['"]\w+['"]\])\)\s+\?\s+base64_decode\(\24\)\s+:\s+getcwd\(\);\s+\23\s+\=\s+str_replace\(['"\\]{1,},\s+["'/]{2,},\s+\23\);\s+\$\w+\s+\=\s+explode[\('"\/]{2,}\s*,\s+\23\);[^@]+isset\((\$_POST)\[['"](\w)(\w)['"][^'"]+\25\[['"]\26['"][^'"]+\25\[['"]\27[^%]{1,299}script>['"];\s+\}\s+\}\s+\?>(?<X120335560>)|\s+(\$\w{1,15})[\h=]+['"]https?://[^;]{1,40}(?:pl|jp|in|ru|xyz|pw|or|ga|ml|top)['"];\s*function\h+\w{1,20}\([^#]{99,1999}\$\w{1,20}[\h=]+\29\.['"]/(?:words|robots)\.php[^&\*#]{99,2499}\bmain_shell['"]\]\h*=[^#\*]{400,1500}\bheader\(['"]HTTP/\d\.\d\h*404\h*not\h*found['"]\);[\s\}]+(?:\?>){1,2}(?<X1193073>)|\s+(\$\w{1,20})(=isset\()[^\}]{30,150}\}\s*if\((?:md5\()+\31\)\)==["']\w{32,64}['"]\)[\{\s]+(\$\w{1,20})\32[^;]{2,50};\s*if\(empty\(\33\)\)[\{\s]+\33\32(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\?\34:['"]{2};[\s\}]+eval\(\33\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1201431>)|\s+(\$\w{1,20})=(?:["']https?://(?:ghost|paste)bin\.com?/[^'"]{1,40}['"];\s*(\$\w{1,20})=['"][^'"]{1,20}\.php['"];\s*(\$\w{1,20})=fopen\(\37,['"][wa]\+['"]\);[^_]{0,99}(\$\w{1,20})=(curl_)init\(\36\);[^\{\}]{9,99}\40exec\(\39\);[^\?>]{1,150}\40close\(\39\);fclose\(\38\);\s*\?>(?<X1193810>)|['"]\w{32,40}['"];\s*(\$\w{1,20})=['"]create_function['"];\s*\$b374k=\42\(['"][^'"]*['"],["'][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]\\?\36=(?<X2159330>)|['"]{2};\s*\$domain[^\(!_]{9,99}\bif\(!(function)_exists\(['"](_is_(curl)_installed\(\))['"]\)\)\{\44\45\{if\(in_array\(['"]\46['"],get_[^\?\*]{999,1800}\b\46OPT_URL,['"]https?://[^'"]+\.php[^\?>]{99,300}\.\36[^_\?]{9,50}(\$\w{1,20})=\46_exec\([^\)]+\);\46_close\([^\)]+\);echo\47;\s*\?>(?<X1157663>))|\s+(\$\w{1,20})\h*=\h*(?:(?:chr\(98\)\.|b)(?:chr\(97\)\.|a)[^;]{9,99};\s*(\$\w{1,20})\h*=\h*(?:chr\(102\)\.|f)(?:chr\(105\)\.|i)[^;]{9,99};\s*(\$\w{1,20})\h*=\h*\49\(\50\(chr\([^;]{99,600}\)\);\s*@?eval\(\51\);\s*\?>(?<X1145991>)|(strrev)\(['"\._base64dco]{13,55}\);\s*(\$\w{1,20})\h*=\h*\53\(['"\.gzinflate]{12,35}\);\s*@eval\(\54\(\49\(['"][^'"]{9000,30000}['"][\)\s]+;\s*\?>(?<X1141770>)|['"][^'";]{999,5000}['"];\s*(\$lol)\h*=\h*\((?:(?:str_rot13|gzinflate|base64_decode|gzuncompress)\h*\(){3,9}\49(?:\h*\)\h*){3,9};\s*@?eval\h*\(\56\);\s*(?:\?>|\Z)(?<X1161520>)|['"][^'"]+['"];\s*if\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*==\h*\49\)\s*\{\s*if\h*\(\$_POST\)\s*\{\s*(\$\w{1,20})\h*=\h*fopen\h*\([^,]+,\h*['"]w+?['"]\);\s*if\h*\(fwrite\h*\(\58,[^\)]+\)[^%\*\{]{99,400}\becho\h+str_replace\h*\(['"](\.php)['"],['"]\w{1,20}\59['"],(?<X2171770>))|\s+(\$\w{1,40})\h*=\h*(?:(['"])[^\v]{70,99}\62;\h*(?:\$\w{1,40}\h*=\h*\61\h*\[\d+\]\h*\.[^;\('"\)\{\}\v]{4,9999};\h*){2,9}(?:\$\w{1,40}\h*=\h*\61\h*\[[^;]{1,99};\h*)?(?:@\$\w{1,40}\(){1,9}\$\w{1,40}[^;]{1,5000}\);\s*(?:\?>|\Z)(?<X1064973>)|@\$_FILES\h*\[[^\]]+\]\h*;\s*if[\h\(]+(\61\[[^\[]+\])[^\[\)]+\)\s*\{\s*\$\w{1,40}[\h=]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\.\h*\64;\s*if[\h\(]+@?[mc]o(?:ve_uploaded_file|py)[\h\(]+\61\[[^\{]{1,199}\{\s*echo\b[^\}\v]{1,199};(?:\s*\}){2,3}\s*(?:\?>|\Z)(?<X1177022>))|\s+(\$\w{1,40})\s*=\s*(?:(?:array\s*\(|\[)[^\)\]]{9,999}[\)\]]\s*;\s*(\$\w{1,40})\s*=\s*mt_rand\s*\([^;]+;\s*(\$\w{1,40})\s*=\s*\66\s*\[\s*\67\s*\]\s*;\s*(?:\?>|echo\s*['"])\s*<\s*meta\b[^>]+url\s*=\s*<\?php\s*echo\s*\68\s*;\s*\?>\s*[^>]+>\s*(?:['"]\s*;\s*\?>)?(?<X1133581>)|\$_FILES\[[^\]]+\];\s*(\$\w{1,40})\s*=\s*['"][^\.]+\.php?[2-6]?(?:tml|t)?['"];\s*if\s*\(\s*file_exists\s*\(\s*['"][^\$]{0,30}\70\)\s*\)\s*unlink\s*\([^\$]{0,30}\70\);\s*move_uploaded_file\s*\(\66\[[^\]]+\],[^\$]{0,30}\70['"]\);\s*(?:\?>|\Z)(?<X1061143>)|array\s*\(['"][^'"]{1,40}['"],[^\);]{9999,65000}['"]\)\s*;\s*(?:\$\w{1,40}\s*=\s*array\s*\((?:['"\s,base64_dco]{13,40}|['"\s,gzuncompres]{12,40}|['"\s,gzinflate]{11,40})\)\s*;\s*)+[^'"]{1,99}eval\s*\([^\);]*\66[\s\)]+;\s*(?:\?>|\Z)(?<X1126380>)|curl_init\(\);[^\$]{1,99}curl_setopt\(\s*\66\s*,\s*CURLOPT_URL\s*,\s*base64_decode\(['"][^'"]{1,999}(?:Ly9wYXN0ZWJpbi5jb|Oi8vcGFzdGViaW4uY|L3Bhc3RlYmluLmNv)[^'"]{1,999}['"][\s\)]+;[^\?:/]{1,99}\s*(\$\w{1,40})\s*=\s*curl_exec\(\s*\66\s*\);\s*@?eval\(\s*\73\s*\);\s*(?:\?>|\Z)(?<X1118850>))|\s+(\$\w{1,9})\s*=\s*['"][^\$]{9,99}['"];\s*(\$\w{1,9})\s*=\s*(?:\75\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*(?:\75\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*(?:\75\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*\77\.[^\n\(\)|{\}\?]{999,4000}\78;\s*@?\76\(\79\);\s*(?:\?>|\Z)(?<X1130695>)|\s+(\$btt)\s*=[^\?]{200,400}\s*if\s*\(\s*!is_user_logged_in\(\)\s*[^\w]{1,3}\s*get_option\s*\(\s*['"]ame_ip['"]\s*\)\s*[^\w]{1,3}\s*\$ip\s*&&\s*\81\s*[^\w]{1,3}\s*(?:false|0)\s*\)\s*\{[^\}]{1,99}\}\s*\?>(?<X1056920>)|\s+(\$filesman)\h*=\h*['"][^'"]+['"];\s*if\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\W{2,4}\83\)\s*\{[^\?@]{99,300}\b(?:copy|move_uploaded_file)\h*\([^\?@]{99,1500}</html>['"];\s*\}\s*(?:\?>|\Z)(?<X1176260>)|\s+(echo)\h+['"][^'"]{1,20}\bUploader[^'"]{0,9}['"];\s*\85\h+['"][^\(]{1,9}\.php_uname\(\)\.[^\{]{99,400}\{\s*if\(is_writable\(\$\w{1,20}\)\)\s*\{\s*if\(@?(?:array|copy)\(\$_FILES\[[^\?]{99,500}\b\85\h+['"][^;]{1,20}['"];[\s\}]+\?>(?<X1147130>)|\s+(goto)\h+(\w{3,9});\h*\88:\h*\$\w{3,9}\h*=\h*strtolower\(\$_SERVER\[['"][^;]+;\h*\87\h+\w{3,9};\h*\w{3,9}:\h*(\$\w{3,40})\h*=\h*file_get_contents\h*\((base64_decode)\h*\([^\)]{1,499}\)\h*\.\h*\90\h*\([^\?\v]{999,1299}\89;\h*\87\h+\w{3,9};(?:\h*\w{3,9}:){2}\s*(?:\?>|\Z)(?<X1149300>)|\s+(goto)\s*\w{1,7};\s*\w{1,5}:\s*echo\h+exec\([^:/]{2,30}\bhttps?://raw\.githubusercontent\.com/[^\?>]{200,999}\b\92\s*\w{1,7};\s*\w{1,7}:\s*(?:\Z|\?>)(?<X1195930>))
<\?php(?:\s+(goto)\s+(?:(\w+);(\w+):if\(\$_POST\[[^\]]+\][^\{]+\{\s*if[\h\(]+@copy[\h\(]+\$_FILES\[[^\]]+\]\[[^\]]+\],\$_FILES\[[^\]]+\]\[[^\]]+[\]\[\)\{\}]+\1\s+(\w+);\2:\?>\s*<(form)[^>]+>[^/]{0,199}</\5><\?php\s*\1\h*\3;\h*\4:\s*\?>(?<X1250690>)|(\w{2,9});[^\?]{1,999}\7:\s*error_reporting\([^\)]{1,40}\);[^\?]{1,999}\1\s+\w{2,9};\s*\w{2,9}:[^;]{0,99};?(?:\s*\?>)?\s*\Z(?<X1119377>)|\w+;\s*\w+:\s*\w+\(['"]\\x72\\x6f\\x62\\157\\164\\163\\x2e\\164\\170\\x74['"],[^%]{1,999}preg_match\(['"]\\57\\50\\120\\x79\\x74\\x68\\x6f\\x6e[^%]{999,15000};\s*\1\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X120338121>)|\w+;\w+:\$\w+[^\[]{1,1599}\1\s+\w+;\w+:\$\w+=(?:\$_SERVER)?[^\{]+\1\s+\w+;\w+:if\(\$\w+={1,4}\$\w+\)\{\$\w+=(?:true|false);\}\1\s+\w+;\w+:\s*\$\w+\.=['"]\\\d+['"];\1\s*\w+;\w+:[^\?]{1,2999}\1\s+\w+;\w+:;\?>(?<X120341674>))|\s+//(?:\s+HacKerD\s+By\s+aDriv4(?<X2051370>)|\w{0,2100}\s*eval\(base64_decode\("[a-zA-Z0-9/\+=]+"\)\);\s*\?>(?<X1034361>))|\s+/\*(?:\s*plugin\s+name:(?:[^@]{999,9999}(\$\w+)[=\s]+['"]\\x68\\x74\\x74\\x70[^;]+;\s*\$\w+[\s=]+wp_remote_get\(\13(?<X220352771>)|\s*(wp\s+core\s*plugin)\s*description:\s*\15\s*default\s+wordpress[^\*]{1,999}author:\s*wordpress\s*\*/(?<X220351600>))|\W{2,99}\bScam\s*page\s*(?:(?:Creat|updat|clean)ed\s*(?:,\s*|and\s*)?){1,5}by\b(?<X2154281>))|\s+@?\$_GET\[['"]\w['"]\]\(\$_GET\[['"]\w['"]\][\s\);]+(?:\?>|\Z)(?<X1217130>)|\s+@?e(?:rror_reporting\((?:(?:0|false|NULL)\);\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\19e\w?.?['"]\s*,\s*['"]\s*@?(?:eval|assert|system|shell_exec|exec|passthru)\s*\((?:\s*(?:base64_decode|gz(?:inflate|uncompress))\s*\(){0,5}\s*['"][^'"]{9,}['"][\s\)]+\;\s*['"]\s*,\s*['"]{2}\s*\)\s*;\s*(?:\?>|\Z)(?<X1124610>)|(?:0|NULL|FALSE)\);(?:\s*(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\{]{0,30}\{\s*@?eval\s*\(base64_decode\s*\(\21\)\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\(\s*@?copy\s*\((\$_FILES\[[^\]]+\])\[[^\]]+\]\s*,\s*\22\[[^\]]+\]\)\s*\);\s*\?>(?<X1124660>)|foreach\(\$_POST\h*as\h*\$key=>(\$value)\)\{\$\w{1,20}=(?:base64_decode\(\24\)|\24);\}[^\[]{1,99}\$_SERVER\[['"]HTTP_HOST['"]\];[^\?]{99,1500}\bif\(checkdnsrr\(\$\w{1,20},\h*['"]MX['"]\)\)\{\$log\.=(?<X2148351>)))|val\(['"]\?>['"]\.base64_decode\(['"](?:PD9waHANCiAgICRkaXppbj|PD9waHANCi8vPCEt)[^"']{99,999}['"]\)\s*\);\s*\?>(?<X1056002>)|val\h*\(\h*['"]\?>['"]\h*\.\h*(?:(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev|trim)\h*\(\h*){1,}file_get_contents\h*\(['"][^'"]{1,40}\.(?:txt|css|png|jpe?g)['"][\)\h]+;\s*(?:\?>|\Z)(?<X1187532>)|val\s*\((?:['"][?>]{2}['"]\s*\.\s*base64_decode\s*\(\s*['"]PD9waHA[^'"]{9,60}(?:JGRlZmF1bHRfYWN0aW9uID0g(?:J0ZpbGVzTWFu|IkZpbGVzTWFu)|ICRkZWZhdWx0X2FjdGlvbiA9I(?:CdGaWxlc01hbg|CJGaWxlc01hbg))(?<X2061520>)|\s*base64_decode\s*\(['"]JEl(?:JSUl){3}[^'"]{1,40}['"]\)+;\s*(?:\?>\s*<\?php\s*)?(\$[O_0]{1,12})\s*=\s*urldecode\(['"][^\?]{99,499}=\s*\29\{\d+\}\s*\.[^;]+;[^\]]{99,499}\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\([^\)]+\)\][^\?]+@?eval\(['"]\\?\$\w{1,40}\s*=\s*\$\w{1,40};['"]\);\}\s*(?:\?>|\Z)(?<X1126220>))|xtract\s*\(\$_[GPRSC]\w{2,6}\s*,\s*\d\);\s*@?(\$\w{1,9})\s*\D{1,3}\s*@?\31\s*\(\$\w{1,9}\s*,\s*\$\w{1,9}\);\s*\?>(?<X1123900>))|\s+@?file_put_contents\h*\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/wp\-(?:admin|contents|includes)/[^'",\)]{1,49}\.(?:php|js)['"]\h*,\h*base64_decode\(['"]PD9waHAN[^'"]{5000,15000}['"]\)\);\s*(?:\?>|\Z)(?<X1175253>)|\s+@?set_time_limit\(0\);\s*if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]+\]\)\)\s*\{[^\}]{1,200}\s*(\$email)\s*=\s*\$_POST\[[^\]]+\];[^\}]{1,200}\}\s*else\s*\{\s*[^\}]{1,300}\}[^\?\{]{1,600}(\$\w{1,40})\s*=\s*\34[^\(]{1,99}(\$\w{1,20})\s*=\s*['"][^;]+\35[^;]+;\s*mail\([^\)]+\36[^\)]+\);\s*(?:\Z|\?>)(?<X1061761>)|\s+[^'"]{1,999}(define)\(['"](\w+)['"],\s+['"]https?://[^'"]+['"]\);\s+\38\(['"]\w+['"],\s+(?:true|false)\);\s+\38\(['"]\w+['"],\s+(?:true|false)\);\s+[^%]+\$wp_remote_content\s+\=\s+wp_execute_remote_content\(\39\);\s+eval[\('"\?>$]{1,}wp_remote_content['"]\);\s*(?:\?>|\Z)(?<X120335543>)|\s+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(getenv\(['"]HTTP_\w{1,50}['"]\)\);[^\?]{0,200}\?>(?<X1041092>)|\s+\$(?:auth_)?(?:pa|pass|password|pwd)\h*=\h*['"]\w{32}['"];[^\}\*%]{0,200}\b(?:(?:gzinflate|base64_decode|eval|str_rot13|preg_replace)\(){1,5}(?<X2160121>)|\s+\$\w{1,30}\s*=\s*array[\s\(]+['"]Googlebot[^\)]{1,700}\);[^<]{99,750}\bgeoplugin\.net/[^\}]{0,299}\}\s*(\$\w+)[\h=]+['"]https?://\w+\.pages\.dev/[^'"]+\.txt['"];[^\{]{9,199}\{\s*\becho\s+@?file_get_contents[\h\(]+\43[\h\)]+;\s*exit\s*;\s*\}\s*\?>(?<X120359910>)|\s+\$\w{1,40}=(?:'[^;]+;if\(isset\(\$\{\$\w{1,40}\[[^}]+}\[\$\w{1,40}[^)]+\)\)\{eval\(\$\{[^)]+\);\}\s*\?>(?<X1041540>)|['"][^'"]{499,999}['"];(?:\$\w{1,40}\.?=["'][^'"]{1,49}['"];){9,29}@?(?:\$\w{1,40}\(){4,9}\$\w{1,40}\)+;\s*\?>(?<X1133600>))|\s+\$\w{1,40}\s*=\s*\$_POST\[[^\]]+\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"](?:password|pass|pw|pwd|passwd)['"]\];[^\/]{1,99}<title>\s*Google\s+Accounts\s*</(?<X2065540>)|\s+\$_{1,9}\s*=\s*\(\s*\$_{1,9}\s*=\s*@[a-z]\)\.[^;]{1,40};[;\+\$_\.=@]{99,}\s*@?eval(?:\s*\(\s*\$_{1,9})+\(['"][^'"]{999,9999}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1118500>)|\s+\$Class_WP_Index\s*=\s*"(?<X2054941>)|\s+\$links\h*=[^@]{2999,4999}\bsetcookie\h*\(\h*['"]haircki['"][^;]{1,49};\s*\}\s*(function)\s+\w{1,40}\((\$\w{1,40})\)\s*\{\s*if\h*\(\h*\50_exists\(['"]curl_init['"]\)\h*\)\s*\{[^\}]{99,499}\}\s*else\s*\{\s*return\s+@?file_get_contents\h*\(\h*\51\h*\);[\s\}]+(?:\?>|\Z)(?<X1147291>)|\s+\$qV="stop_.+?\]\);\}\?>\s*(?<X1034041>)|\s+\$sF="\w+_.+?\)\);\}\?>\s*(?<X1034051>)|\s+\w+\s*(\w+)\((\$\w+)\)\s*\{(\$\w+)=\w+\(\56\);\w+\(\57[^\)]{1,32}\)\s*\{die\(['"][^\}]{1,99}\}\$\w+[^\?]{1,999}/\w+\.txt['"];\$\w+=\w+\([^\}]{1,999}\}eval\(['"]\?>['"]\.\$\w+\);\}\56=['"]https?://[^'"]+['"];\55\(\56\);__halt_compiler\(\);\?>(?<X120329770>)|\s+class\s+\w+\s*\{\s*(const)\s*MAGIC[\s=]+['"]WPEN['"];\59\s*version=['"]\W+['"];\59[^@]{1,1999}(\$\w+)=openssl_decrypt[^;]{1,999};eval\(\60(?<X220346681>)|\s+echo(?:['"]<script\h+(?:type\h*=\h*['"]text/javascript['"]\h+)?src\h*=\h*['"]https?:\s*//[^'"]{1,99}\.js['"]\h*>\s*</script>\s*['"]\h*;\s*/\*\h*Bloodninja:[^\*]{1,99}\*/\s*(?:\?>|\Z)(?<X1141430>)|[\h'"]{2,4}<script\h+type=['"]text/javascript["']>\s*var\h+(\w{1,20})[\h=]+Element;\s*\63\.prototype\.appendAfter[\h=]+function\([^\[\]\?>]{99,400}\b(string\.fromCharCode\()[^\?><]{150,500}\b\64[^\.]{5,60}\.appendChild\([^\)]+\);[\}\(\);]{3,6}</script>['"];\s*\?>(?<X1196360>)|\h+['"]<[^\-/]{2,20}>\h*black\h*Illusion\h*Security\b(?<X2165200>)|\h+copy\(['"]https?://[^/]{0,15}8haiao\.com/[^'"]{0,49}\.txt['"],\h*['"]\w{1,25}\.php['"]\);\s*(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1160790>)|\s*['"][^;]{1,40};\s*(\$\w{1,40})\s*=\s*create_function\s*\(['"][^'"]*['"]\s*,\s*base64_decode\s*\(\s*['"][^'"]{99,999}['"]\s*\)\s*\)\s*;\s*\68\s*\(\s*\)(?:\s*;)\s*(?:\?>|\Z)(?<X1131510>)|\s+["']RCE:["']\s*\.\s*php_uname\s*\(\s*\)\s*;\s*\?>(?<X120361460>)|\s+['"](?:(?:Raiz[o0]w[0o]rm|JSSPWNED!?)['"<](?<X2130791>)|<b>\s*<font\s+color\s*=\s*\w{1,20}>\s*Command\s+Shell(?<X2062271>)|\w{1,40}["'];[^;\(\[\{\$]{1,99}if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\{]{1,99}\{[^\}]{1,199}file_put_contents\(['"][\./]{3,}wp\-[^'"]{1,99}['"]\.\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\);\s*@?(?:exec|system)\s*\([^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1137000>))|\s+\d+[\+\-\*\/]\d+;\$\w{1,40}=base64_decode.{100,2000}\)]\);};\s*\?>(?<X1040970>))|\s+eval(?:\(\s*eval\("\\\$_(?<X2044041>)|\s*\(['"]\?>['"]\s*\.\s*base64_decode\s*\(['"]Z2lmODlhPD9w[^'"]{999,15000}['"]\)\s*\);\s*(?:\?>|\Z)(?<X1127361>))|\s+exit\(\);\s*endif;(?:\s*\?>\s*<\?php\s*)(\$\w{1,40})\s*=\s*['"][a-z0-9]{9999,65000}['"];\s*\$\w{1,40}\s*=(?:\s*\77\[\d+\]\s*\.){3,}\$[^@\*]{99,999}(\$\w{1,40})\s*=\s*\$\w{1,40}\(['"]\w\*['"],\s*\$\w{1,40}\([^\)]+\)+;\s*@?eval\(\78\)\s*;(?<X2132950>))
<(?:\?php(?:\s+function(?: (\w+)\(\$file_url,.+?file_get_contents\(\$file_url\);\1\('https://dl\.dropboxusercontent\.com.+?unlink\(\$_SERVER\['SCRIPT_FILENAME'\]\);\?>(?<X1034351>)|\s*(is_google_bot)\(\)\s*\{\s*\$\w+\s*=\s*array\(\s*(?:['"][^'"]{1,29}['"],?\s*){5}[^%]{1,299}\3\(\)\)\s*\{\s*(\$\w+)\s*=\s*file_get_contents\(['"][^'"]+['"]\);\s*echo\s*\4;\s*(exit|die);\s*\}\s*else\s*\{\s*include\s+['"][^'"]+['"];\s*\5;\s*\}\s*\?>(?<X120336651>)|\s+(\w+)\(\)\{\$\w+=\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\$\w+=array[^\}]{1,499}\}\}return\s+false;\}if\(\7\(\)&&\$_SERVER\[[""]REQUEST_URI['"]\]==['"]/['"]\)\{(\$\w+)=file_get_contents\(['"]https?://[^'"]{1,399}['"]\);echo\8;(?:exit|die);\}\?>(?<X120339910>)|\s+(\w{1,20})\s*\([^\)]+\)\s*\{\s*(\$\w{1,9})\s*=\s*['"][^'"]*['"];[^@]{99,200}\11\s*=\s*\11\.chr\s*\(hexdec\s*\(substr[^@]{9,30}return\s*\(\11\);\s*\}\s*\((@?\$\w{1,20})\s*=\s*\10\([^\.]+\.\12\(\10\([^\)]+\)\s*\);\s*\?>(?<X1134170>)|\s+(wp_run_xcore)\s*\(\)\s*\{[^%]{99,400}eval\s*\(\$\w{1,20}\);\s*\}\s*\}\s*error_reporting\s*\([^\)]+\);\s*wp_update_xcore\s*\(\);\s*\14\s*\(\);[^\?]{0,90}\?>(?<X1125820>)|\s+\w+\(\$\w+\){\s*\$\w+\s*=\s*'[base64decode_\.']+';\s*\$\w+\s*=\s*gzinflate\(\$code\(\$\w+\)\);\s*for\(\$i=0;\$i<strlen\(\$\w+\);\$i\+\+\)\s*{\s*\$\w+\[\$i\]\s*=\s*chr\(ord\(\$\w+\[\$i\]\)-1\);\s*}\s*return\s+\$\w+;\s*}eval\(\w+\("[^"]+"\)\);\?>(?<X1035491>))|\s+global\s*(\$\w{1,20});\s*if\s*\(!?\17\)\s*\{\s*function\s+(\w{1,20})\s*\((\$\w{1,20})\)\s*\{\s*(?:\$\w{1,20}\s*=\s*array\([^\)]{99,5000}\);\s*){2}[^\?]{99,999}return\s+\19;\s*\}\s*\17\s*=\s*time\(\);\s*@?ob_start\(['"]\18['"]\);\s*\}\s*\?>(?<X1127180>)|\s+goto(?:\h*\w{3,9};[^\?\(]{1,99}\bgoto\h*\w{3,9};\s*\w{3,9}:\s*\$\w{3,9}\s*=\s*['"]?FilesMan['"]?\h*[;\)](?<X2162150>)|\s+(\w{1,9});\s+\22:\s+header\([^\(]{99,999}file_get_contents\(base64_decode\(['"][\\xa-f0-9]{99,}['"]\)\s*\.[^\n\?&%]{99,999}goto\s+\w{1,9};(?:\s+\w{1,9}:\s*)+(?:\?>|\Z)(?<X1133560>)|\s+\w{1,9};\s+(\w{1,9}):\s+\$\w{1,40}\s*=\s*@?file_get_contents\(base64_decode\(['"][\\xa-f0-9]{99,}['"]\)\s*\.[^\n\?&%]{999,2999}\24;.[^\n\?&%]{1,99}goto\s+\w{1,9};(?:\s+\w{1,9}:\s*)+(?:\?>|\Z)(?<X1133550>))|\s+header\([^\)]{9,99}\);\s*(\$\w{1,40})\s*=(?:\s*\$_SERVER\[['"]?(?:(HTTP_)USER_AGENT|\27REFERER)['"]?\]\.?){2};\s*if\s*\(\s*strpos\(\26,[^\}\?]{99,999}(\$\w{1,40})\s*=\s*@?file_get_contents\((base64_decode\()['"]aH[^'"]{9,99}['"]\)\s*\.\s*\29[^;]+;\s*echo\s+\28\s*;(?:\s*return\s*;)?\s*\}\s*\?>(?<X1133570>)|\s+if\((?:!isset\(\$_COOKIE\[['"][a-z0-9]{32,}['"]\]\)\)\s*\{header\(['"]HTTP/\d+\.\d+\s+404\s+Not\s+Found['"]\);(?:exit|die)[^;]{0,9};\}\s*\?>\s*<\?php[^\{]{99,999}\bdo\{\w{1,40}\(\);\}while\(\d+\D\d+\)(?<X2132560>)|isset\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"](?:[^@\?\*]{9,499}\bif\h*\(\h*@[cm]o(?:py|ve_uploaded_files)\h*\(\h*\$_FIles\[[^\]]+\][^\}]+\}\s*else\s*\{[^\}]{1,99}\}\s*\})+(?:\s*\})+\s*(?:\?>|\Z)(?<X1154331>))|\s+if(?:\h*\(isset\h*\(((\$_FILES\[['"](?:azzatssins|assasins)['"]\]\[)[^\]]+\])\)\)\s*\{\s*(\$\w{1,20})\h*=\h*\33;\s*(\$\w{1,20})\h*=\h*\34['"]tmp_name['"]\];\s*@?(?:copy|move_uploaded_file)\h*\(\36\h*,\h*\35\);[^\?]{9,150}\}\s*\?>(?<X1172190>)|\s*\(\s*\$_SESSIONs*\[[^\]]+\]\s*\D{2,3}\s*['"][\w',\s\-]{1,40}['"]\)\s*\{\s*\?>\s*<span\s+title\s*=\s*['"]<\?php\s+echo\s+\$ca?rd_?se?c?re?t;\s*\?>(?<X2134761>)|\s*\(\s*\(\s*isset\s*\((\$_(?:G|P|R|S|C)\w{2,6}\[)[^\]]+\]\)\s*[^\w]{2,3}\s*\(\s*md5\s*\(\39[^\]]+\]\)\)\s*[^\w]{2,3}['"][^'"]+['"]\)\)\s*\{\s*if[^;]+@?eval\(gzinflate\(base64_decode\(rawurldecode\(\$_(?:G|P|R|S|C)[^\}]{9,150}\}\s*else\s*\{\s*header\(['"]HTTP/1.\d\s+404[^\}]+;\s*\}\s*\?>(?<X1064401>)|\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,9}\]\s*\)\s*\)\s*(?:echo|print)\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,9}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1060000>))|\s+move_uploaded_file\s*\(\s*\$_FILES\[[^\]]{1,40}\]\[[^\]]{1,40}\]\s*,\s*\$_FILES\[[^\]]{1,40}\]\[[^\]]{1,40}\]\s*\)\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru|pcntl_exec)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1061240>)|\s+ob_start\(\);header\(['"]vary:[^\?]{1,999}exit\(\);\}ob_end_flush\(\);\?>(?<X120370900>)|\s+readfile\s*\(\s*['"]/etc/(?:passwd|shadow)['"]\s*\)\s*;\s*(?:\?>|\Z)(?<X1131920>)|\s+session_start\(\);\s*function\s*\w+\(\)\s*\{\s*return\s+\!empty\((\$_SESSION\[['"]\w+['"]\])\)\s+\&\&\s*\45\s*[=]{1,}\s*(?:true|false);[^%]{1,699}function_exists\(\$\w+\[\d\]\)\)\s*\{\s*(\$\w+)\s*=\s*(curl)_init\((\$\w+)\);\s*\47_setopt\(\46,\s*\47OPT_RETURNTRANSFER[^%]{1,799}\48\s*=\s*['"]https?://[^'"]+['"];\s*(\$\w+)\s*=\s*geturlsinfo\(\48\);\s*if\s*\(\49\s*\!==\s*(?:true|false)\)\s*\{\s*eval[('"\?>]{1,}\s*\.\s*\49\);[^%]{1,299}\45[^%]{1,199}(?:exit|die)\(\);\s*\}\s*\}\s*\?>(?<X120336440>)|\s/\*\s*--\s*enphp.+(?:unset\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*echo\s*\$\w{1,40}\s*;\s*\?>(?<X1037150>)|}\{\d+\}\(E_ALL\^E_NOTICE\);\$_SERVER{(?<X2046230>))|\s\$\w{1,14}=['"]/home/[^'"]{1,200}['"];[^@]{0,200}\$\w{1,14}=rawurldecode[^\{]{1,200}\{(\$\w{1,14})=[^}]{1,300}file_put_contents\((\$\w{1,14}),\53\);include\(\54\);unlink\(\54\);\}[^\{]{1,50}\{echo[^\}]{1,50}\}die\([^;]{1,20};(?<X1292760>)|\s\h{199,}/\*[^\*\n]{0,99}\*/\s*(function)\h*\w{1,40}\h*\(\h*\)\h*\{\h*\$\w{1,40}\h*=\h*func_get_args\h*\(\);\h*file_put_contents\h*\([^;]+;\h*(return)\h*@?mail\h*\((?:\h*\$\w{1,9}\[\d+\],?){3,}\);\h*\}\h*\56\h*\w{1,40}\h*\([^\}\n]{1,99}\}\h*\^\h*['"]\d+['"];\h*\}\h*\57\h*\$\w{1,9};\h*\}\s*(?:\?>|\Z)(?<X1135130>)|\sdefine\(['"A,]+[^'"]+['"]\);\s*\$\w{1,14}=dirname[\(\)_FILE]+;unlink[\(\)_FILE]+;set_time_limit[^>]{1,750}die\(['"]\->ok<\-[^\!]{1,50}\!is_array\(\$\w{1,14}\)\s*\|\|\s*time\(\)[^\|]{1,700}(\$\w{1,14})\((\$\w{1,14}),0755\);unlink\(\$\w{1,14}\);\59\(\60,0555\)(?<X2290980>)|\sfunction(?:\s(\w{1,14})\((\$\w{1,14})\)\{(\$\w{1,14})=array\(['"]eXPloDE['",]+base64_DECODE['"\);)]+return\64\[\63[^\{]{1,100}\{\$\w{1,14}=\62[^,]{1,50},\$\w{1,14}\(['"]+aHR0cD[^@]{1,1000}YmFzZTY0X2VuY29kZX[^\?]{1,1000}return\$\w{1,14};\}\?>(?<X1292800>)|\s*\w{1,14}\(\)\{(\$\w{1,14})=Array\([^\$]{1,200};[^@]{1,150}\$\w{1,14}=Array\(\66,\$_COOKIE,\66,\$_POST[^@]{1,300}eval\(\$\w{1,14}\);+die\(\);+(?<X2294621>)|\s\w{1,14}\(\)\{echo\s['"][^'"]+['"];\}function\s(\w{1,14})\(\$\w{1,14}\)\{\$\w{1,14}=0;\$\w{1,14}=['"][^\$]+;\$\w{1,14}=substr[^@]{1,250}\68\(Array\([^@]{1,1500}\$\w{1,14}=\$_COOKIE;[^@]{1,1500}\w{1,14}\(\$\w{1,14},\$\w{1,14},\$\w{1,14}\);\}(?<X2294611>))|\s{1000,}\$\w{1,40}\s*=\s*\$_POST\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\[\w{1,40}\]\s*;(?<X2051570>))|\d+@qq\.com>[^\}]{1,1999};\$GLOBALS(?<X220361851>)|\h*title\h*>\h*40[34]\h*(?:Not\h*Found|Forbidden)\h*(?:web\h*)?Shell\b(?<X2165370>))
<(?:\s*(?:(script)[^/]{1,40}/{2}[^\.]{1,40}\.balantfromsun\.com/\w{1,40}\.js[^>]{1,99}>\s*<\s*/\1\s*>(?<X1129041>)|\?\s*(?:\$\w{1,40}\s*="[^"]*"\s*;\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*pass\s*\]\s*==\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*getcwd\s*\(\s*\)\s*;\s*Echo.+?<input\s+type="submit" name="\w+"\s+value="go!"\s+/></form>\s*<\?php\s*}\s*\?>(?<X1037440>)|error_reporting\s*\(\s*\d+\s*\)\s*;\s*assert_options\s*\(\s*ASSERT_ACTIVE\s*,\s*1\s*\)\s*;.+?\$\w{1,40}\s*\(\s*str_rot13\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*\?>(?<X1038460>)|eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(\s*'[^']{1000,}'\s*\)\s*\)\s*\)\s*\?>(?<X1036770>)|if\s*\(\s*(?:!isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@import_request_variables\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\}\s*if\s*\(\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*!='[^']*'\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*else\s*\{\s*if\s*\(\s*get_magic_quotes_gpc\s*\(\s*\)\s*\)\s*\$\w{1,40}\s*=\s*stripslashes\s*\(\s*\$\w{1,40}\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*;\s*return\s*;\s*\?>(?<X1037290>)|\$_FILES\['F1l3'\]\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*echo\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*echo\s*'[^']*'\s*;\s*\}\s*\?>(?<X1037750>))|require\s*\(\s*\$_SERVER\s*\[\s*"[^"]*"\s*\]\s*\.\s*"[^"]*"\s*\)\s*;\s*global\s*\$\w{1,40}\s*;\s*\$\w{1,40}-\s*>\s*Authorize\s*\(\s*[^)]+\)\s*;\s*LocalRedirect\s*\(\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1037920>))|IfModule\s*mod_rewrite\s*\.\s*c\s*>\s*Options\s*\+FollowSymLinks\s*RewriteEngine\s*on\s*RewriteBase\s*/\w+\s*RewriteRule\s*\^c\s*\(\\d\+\)\[-/\].+?</IfModule>(?<X1042691>)|script\s*(?:>\s*var\s*s\s*=\s*document\s*\.\s*referrer\s*;\s*if\s*\(\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\)\s*\{\s*self\s*\.\s*location\s*=\s*['"][^"']*['"]\s*;\s*\}\s*<\s*/script\s*>(?<X1043181>)|type\s*="[^"]*"\s*src\s*="http://unslider.com/unslider.min.js"\s*>\s*<\s*/script\s*>(?<X1043141>))|title\s*>\s*(?:404-server!+\s*<\s*/title\s*>(?<X2036851>)|<\s*\?\s*=\$Z118_title\s*\.\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*;\s*\?><\s*/title\s*>(?<X2046270>)))|a(?:[^>]+href[\s=]+['"][htps:/]+westalabamaicehouse\.com[^<]+</\s*a>(?<X1255930>)|\b(?:(?:[^>]{0,199}\b[sh](?:ref=['"]https?://|tyle=['"](?:[^'"]{0,199}\b(?:height|width|left|right)[\s:]+(?:[0-3]|\-\d{4})p[tx];){3})){2}[^>]+>[^</]{0,49}\breplica\b[^</]{0,49}</a>(?<X1215473>)|[^>:/]{0,49}\bhref=['"]?https?://(?:trabzon|gebze)escort\.com\b[^>]+>[^</]{0,49}</a>(?<X1219020>)|[^>]{0,99}\bhref=['"]https?://(?:(?:\w{1,40}\.)?hackingtool\.net/download/[^>]{1,199}>[^</]{0,99}</a>(?<X1181890>)|(?:www\.)noktashop\.org['"/][^>]{0,99}>[\w\h]{0,40}\bsex\h+shop\b[\w\h]{0,40}</a>(?<X1173152>)|[^/'"\s]{0,99}\b[sp](?:hellx\.org|(?:hp|ro)shell\.xyz)['"/\s][^>]{0,199}>[^</'";]{0,19}</a>(?<X1189432>)))|\h*href(?:=\\?['"]https?:[\\/]+polisaevo\.ru[^'"]*['"]>1xbet<\\?/a>(?<X120346820>)|[\h=]+['"]https?://(?:[^'"]+['"]\h*(style[\h=]+['"]display:none['"]>\w+</a>)\s*(?:<a\h*href[\h=]+['"]https://[^'"]+['"]\h*\21\s*){40,100}(?<X1311940>)|[^>]{0,99}\bleft[\h:]+\-\d{2,5}px;?['"]>\h*rolex[^<]+</a>(?<X1230560>)))|\h+(?:href(?:=(?:['"]https?://(?:(?:vsenaberu\.ru|fitsparta\.ru|saas24\.ru|school34\-tomsk\.ru|degtyrsk\.ru|almamaterwear\.com)[^<]+</a>(?<X1292711>)|(?:www\.)?cheapjersey[^'"]{1,20}['"]>[^<\v]{1,99}</a>\h*&nbsp;(?<X1145474>))|[\\'"]+https?://(?:\w{1,14}\.)?(?:(?:sportdrama\.co\.in|dafabet-pk\.com|1bettv\.com|casinononaams\.it|exycasinos\.com|nonaamscasino\.com)(?:[^'"]{1,50})?[\\'"][^>]{1,50}>\s*[^<]{1,20}\s*<\/a>(?<X1264224>)|(?:superr\.info|sevecenn\.info|resimm\.info|vipistanbul\.net|hisarr\.info|viagraif\.com|kaliteliblog\.com)(?:[^'"]{1,50})?[\\'"][^>]{0,50}>\s*[^<]{1,50}\s*<\/a>(?<X1281431>)))|['"\h=]+https?://[^/]+/(?:toto|produk)['"/>]+situs\h+toto[<\h]+/a\h*>(?<X1283450>)|\h*=\h*(?:['"]https?://(?:[w\.]{0,3}facebook\.com/spyus\.teamx\b(?<X2140570>)|mirror\-h\.org/search/[^\?@]{9,99}<a\h+href\h*=\h*['"]https?://defacer\.id/(?<X2164391>))|\\?['"]https?://[^/'"]{0,99}\wjerseys[^'"]{1,40}\\?['"]\h*>[\w\s]{1,40}\bjerseys?[\w\s]{0,15}</a>(?<X11527310>)))|name\h*=\h*['"]metka\d*['"]\h+href\h*=\h*['"]#download['"]\h+onClick\h*=\h*['"]red\(['"][^'"]{9,99}['"]\)\h*;\h*['"]>\h*<b>[^\x00-\x7F]{7}<.b>\s*</a>(?<X2157180>)|style\h*=\h*['"]display\h*:\h*none[;\h]*['"]\h+href[=\h]+['"]https?://unila\.ac\.id/[^'"]+['"]\h*rel[=\h'"]+dofollow['"\h]*>[^><]*</a>(?<X1264790>))|\s*(?:(?:style[\s="']+display\s*:\s*none[\s;"']+)?[^/]+href[=\s'"]+https?://(?:\w+\.)?(?:thesoap2day\.com|movies123\.dad|mmovies123\.org|movies123\.hair|movies123\.gift|123movies\.college|crackstreams\.day|ytmp3converter\.sbs|soap2dayhd\.to|movies123\.mov|123movie\.mov|soap2day\.lat|sy2day\.com|123moviesfee\.com|123movieshdtv\.com|vokestream\.com|movies123tv\.net|nilesmitchell\.com|bflix\.fyi|crackstreamm\.com|movies123\.sbs|movies123free\.top|1123movies\.net|streameast\.ing)\b[^<]{1,99}[</\s]+a\s*>(?<X1287545>)|[^>]{1,99}style[\s="]+display[:\s]+none['";]+[^>]{1,99}>(?:soap2day|123\s*movies?|crack\s*streams?|soap\s+\d|movies?123|watch\s+movies|youtube\s+to\s+mp3|nilesmitchell\.com|b\s+flix)[^>]+>(?<X1288100>)|href(?:=['"]https?://(?:(?:chickenroadapp|aviatorapp|balloonapp|plinkoapp)\.(?:win|vip)/?['"]>[^<]{1,99}</a>(?<X1322800>)|(?:kalbe\-kjsa\.com|fortunetiger\.org|sweet\-bonanza\-uk\.com)[^<]{5,50}</a>(?<X1307290>)|[^@]{1,30}\banonsec\-team\.org/?['"]\s*[^>]+>AnonSec\s*Team</a>[^;]+;(?:exit|die)\(\);(?<X2319631>)|hollywoodbet\.app/['"]>Hollywoodbets\s*mobile\s*\-\s*horse\s*racing[^<]+</a>(?<X2313351>)|hornyhookup\.org/['"][^<]{1,29}horny\s+woman</a>(?<X120350682>)|www\.swimkidswaco\.com/wristbands/['"]>[^<]{1,99}</a>(?<X120367740>))|\s*=\s*['"](?:(https?://)yeezy\-(?:slidess|supply)\.\w+/['"]\s*style=['"]display:none;['"]><+\42[^>]+</a>+(?<X1256011>)|https?://(?:(?:antalyaescortsitesi|secretajans)\.com\b[^>]*>[^<>\n]{3,99}</a>(?<X1204010>)|(?:buyviagraonlinefree|buycialisonlinefree)\.[^'"]{1,16}['"]\s*[^>]+>\w+</a>(?<X1261870>)|refpasrasw\.world\b[^>]+>[^><]{1,90}</a>(?<X1204390>))))|style=(?:['"]color:\s*#ffffff;['"]\s*title=['"](slot\d+)['"][^>]{1,99}>\47</a>(?<X120356600>)|[^=]+=['"]https?://www\.1337games\.io[^<]{20,100}</a>(?<X1307391>))|title=['"]log\h+in\h+via\h+cpanel\h+id['"]\h+(?:class=external\-)?auth\-link\b(?<X2296141>))|\s+(?:href(?:=(?:["']https://turkishlampsnmore\.com/["']\s+target=["']_blank["']\s+rel=["']nofollow["']>slot\s+depo\s+\d+k</a>(?<X120333202>)|['"]https?://exposedgsmatmskimmers\.com['"]\s+style=['"]color:[^;]{1,9};\s*font\-size:\s*\d+px;\s*text\-decoration:\s*none['"]\s*>[^<>]{0,40}</a>(?<X1213140>)|[^/]{1,29}\bteam\s+MazaratHackTeam</a>(?<X220350990>))|[=\s]+['"](?:(?:https?:?)?//whyaboveweather\.top\b[^'"]{9,199}['"]\s*>(?:[^</]{0,49}</a>)?(?<X1221211>)|https?://(?:www\.)?replicheorologi\.it/['"]\s+title[=\s]+['"][^'"]+['"]\s+style[=\s]+['"]position\s*:\s*absolute;\s*(?:left|right):\s*\-\d+p[xt];['"]\s*>[^><\n]{0,40}</a>(?<X1235200>)))|style[=\h]+['"]display\s*:\s*none;['"]\s*href[=\h]+['"]https?://[^'"]{9,}['"]>https?://[^<>\n]+</a>(?<X1236061>))|\shref=['"][^\{][^"']+['"]\sstyle=['"]position:\sfixed[^>]{0,120}text-decoration:\s?none;?[^>]{0,}['"]\s?>[^<]{0,}(?:slot|gacor|togel|situs|4d|\shk|hk\s|macau|toto|mahjong)[^<]{0,}</a>(?<X1311453>)))
<(?:b(?:>(?:-{5,20}[^'"]{1,4}\s*(?:PPL|paypal)\s+SCAM\s+20\d{2}\s*[^'"]{1,4}-{5,10}(?<X2060344>)|\.::\[Shell functions\]::\.</b>(?<X2050850>)|\bhacked\s+by\s+(?:bky992</b>(?<X220352721>)|R13S[^<]{1,49}</b>(?<X220352701>))|Black\s*Space\s*Mailer\s*201(?<X2049240>)|Upload\s*Complate\s*!!!(?<X2049551>))|ase(?:\h+(?:(href\h*=\h*['"]https?://(?:www\.)?(\w{0,40}[^\-w_]jerseys\w{0,40}\.\w{2,9})/?)['"]\h*>(?:\s*<link\h+rel\h*=\h*['"](?:canonical|stylesheet)['"][^:>]*\7[^'"]{1,199}\.(?:html|ico|css)['"]>){5}[^&]{99,9999}var\h+http_host\h*=\h*['"]https?:?/?/?(?:www\.)?\8['"]\h*;(?<X2145261>)|href\h*=\h*['"](https?://(?:www\.)?[^'"]{0,40}[^\-w_]jerseys[^'"]{0,40}\.\w{2,9}/?)['"]\h*>\s*<link\b[^:>w]+\10[^:>]+\.(?:css|ico)['"]\h*>[^&]{99,9999}<a\h+href\h*=\h*['"]\10(?<X2273232>))|\s+href\s*=\s*['"](http://[^'"]{1,40}jerseys[^'"]{1,40}\.\w{2,3})/?['"]>\s*<link\s+rel\h*=\h*['"]canonical['"]\s+href\s*=\s*['"]\12[^\{\}\?]{1499,2499}\bfunction\h+popupWindow\s*\([^#]{999,1999}\?main_page\h*=\h*recheckout\b(?<X2157020>))|i(?:g>\s*Symlink\s+Bypass\s+Tool\b(?<X2126520>)|MO@2m\.ma>\\r\\n['"];\s*\$headers\h*\.?\h*=['"]MIME-Version:(?<X2152480>))|r(?:/>Mr Secretz</center>(?<X2052830>)|>(?:\[\+\]\s*Uname:'\.php_uname\(\)(?<X2051280>)|\s*(?:<a[ ]+href=\W{0,8}https?://[^\?\n]{9,99}\.(?:php|html)(?:\?\w{1,9}\s*=[^>\n]{9,150})?>[^\n<]{1,65}</a>[ ]*,[ ]*){10}[^\n]{0,9999}<a[ ]+href=\W{0,8}https?://[^\?\n]{9,199}\.(?:php|html)(?:\?\w{1,9}\s*=[^>\n]{9,150})?>[^\n<]{1,65}</a>[ ]*,[ ]*(?:&nbsp;[ ]*)?</(?:h\d|p|div|time|em|span|b|strong)>(?<X2263620>)|\s*(?:\[info\])?\s*Gaza\s+HaCKeR\s+Team\s*<(?<X2059321>)|\s*[S5]py\s+us\s+priv\s*(?:8|ate)\s+M[a4][i!l]{2}[3e]r\b(?<X2127070>)|hacked\s+by\s+(handala)\s*</div>[^@]{999,}\21\s+team[^\.]{1,99}https?://\21\-hack\.[^'"]+['"](?<X220365461>))))|c(?:enter>(?:&copy;\h+\S{1,40}(?:\h+)?e?Xpl[o0]it\h+\d{4}\h*</(?<X2166702>)|<b>[^<]{1,9}Alien\s*Hack[^<]{1,9}<\/b><\/center>(?<X2128150>)|<h\d>(?:\h*priv(?:8|ate)\h+sh[e3][1l]{2}\h*[v\.\d]{0,9}</(?<X2157411>)|HacKeD\h*By\h*TeaM\h*Mosta(?<X2147310>))|\$\s+root@x48(?<X2051700>)|\.:Cyber Shell(?<X2050960>)|\s*Coded\s+By\s+Unkno0?wn\s+Kesdemar(?<X2061270>)|config\s*root\s*man</center>(?<X2047580>))|ode>\s*Trying\s*\$ServerName\.\.\.<br>\s*Connected\s*to\s*\$ServerName(?<X2050150>))|d(?:c:format>application/pdf</dc:format>\s*<dc:description>\s*<(\w+):Alt>\s*<\32:li\s*xml:lang=['"]x\-default['"]>https?://github\.com/[^'"]+eicar-standard-antivirus-test-files</rdf:li>(?<X2295960>)|d\d+>\s*<div\b[^>]{1,199}\bstyle=['"](?:[^'">]{0,199}\b(?:width\h*:\h*\-?\dpx|(?:text\-)?overflow\h*:\h*hidden)\b){2}[^\v=]{1,499}(?:<a\s*href=['"]?https?://[^>]{1,199}>[^/<]{1,199}</a>\s*[\w\s]{0,99}\s*){5}[^\v]{9999,}</div>\s*<dd\d+>(?<X1164932>)))
<div(?: class[="'\s]+dc['"\s>]+<\?php\sif\s\(\$_[^\)]{1,30}\)[\s\{\?>]+<a\shref[\s="']+https?://(?:www\.)?sugarmummy\.com\.au/?['"]>[^>]{1,20}>\s*[^/]{1,30}</div>(?<X1305750>)|[^<]+overflow:hidden;height:1px\\?['"]><a\h*href[\h=]+\\?['"]https?://[^<]{9,199}</a></div>[^\?]{99,2200}\bhttps?://mirniy\-sp\.ru/[^>]+>\h*1win[^<]+</a>(?<X120367451>)|[^>]{0,40}>\h*Zeux.H[a4]x[o0]r\h+Encode\h*&\h*decode\b(?<X2167350>)|[^>]{1,40}\bstyle\h*=\h*['"][^'"]{0,19}\bdisplay:\h*none\b[^>]{1,40}>\s*(?:<a\h+(?:\bhref\h*=\h*['"]https?://[^'"]{1,49}['"][^>]{0,99}|\btitle\h*=\h*['"]([^'">]{1,20})['"][^>]{0,99}|\brel=['"]dofollow['"][^>]{0,99}){3}>\h*\4\h*</a>\s*)+</div>(?<X1145505>)|[^\-]{0,20}\bstyle=['"](?:[^:]{1,20}:\h*(?:\-\d{3,5}|\dpx|hidden);){2,6}[^>]{1,90}>(?:<a\h*href=['"]https?://[^>]{9,99}>[^<]{0,60}(?:akun\h*[prws]{2}o|slot)[^<]{0,60}</a>\s*){10,}</div>(?<X1232170>)|\b[^>]*\bstyle=['"][^'"]*\b(?:(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^>]*>[^<>/=]{0,99}(?:<a\b[^>]*\bhref=['"]?https?://[^/'"]*(?<!a)(?:cheap|(?<!new[_\-]|new)jersey|bag)[^>]*>[^/\n<]*</a>\s*[^<>/=]{0,99}){5,}</div>(?<X1201213>)|display[\h:]+none\b[^>]+>\s*(?:<a\b[^>]+\bhref=['"]https?://[^>]+>[^</]{0,199}</a>\s*){9,12}<a\b[^>]+>[^></]*[ts](?:ogel|lot)\s+(?:online|terpercaya)\b[^</]*</a>\s*(?:<a\b[^>]+\bhref=['"]https?://[^>]+>[^</]{0,199}</a>\s*)+</div>(?<X1206250>))|\b[^>]{0,99}\b(style=)['"](?:[^'"]{0,99}\b[hw](?:eight|idth)\h*:\h*0[\w%]{0,2};){2}[^>]{0,99}>\s*(?:<a\b[^>]{0,99}\b\9['"][^'"]{0,99}\bfont\-size:\h*[\d\.]{2,9}[\w%]{0,2};[^>]{0,199}\bhref=['"]https?://[^>]{0,499}>[^><,]{0,49}</a>\s*(?:,\s*)?){2,}</div>(?<X1178441>)|\h*class\h*=\h*['"]hacke[rd]['"]>[^<]{0,20}hacked\h*by(?<X2140171>)|\h*id=(['"]\w+["'])>[^a]{0,30}<a\h*href=['"]https?://[^'"]{0,20}(?:fake|watches|replica|jersey)[^'"]{1,20}['"][^>]+>[^'"]{0,40}(?:fake|watches|replica|jersey)[^'"]{0,40}</a>[^\.]{1,40}<(script)[^>]*>[^'"]{0,99}\bdocument\.getelementbyid\(\12\)\.style\.display=['"]none['"];?</\13>(?<X1216913>)|\h*style(?:=\\\\['"]position:\h*absolute;\h*(?:left|right):\h*\-\d{4,}p[tx];\\\\['"]>(?:\\\\n)?<h2>[\w\-]{6,40}\.[a-z]{3}[^<]{1,50}<\\\\/h2>(?:\\\\n)?[^<]{1,500}(?:<a href=\\\\['"]https?:\\\\/\\\\/[\w\-]{6,40}\.[a-z]{3}\\\\/\\\\['"]>[\w\-]{6,40}<\\\\/a>)?[^<]{1,950}<\\\\/div>(?<X1264702>)|[\h=\\]+['"]display:\h*none;\h*[\\]*['"]><span[^>]{9,99}\boverflow:\h*hidden;[^\?]{9,99}<p><a\h*href=[^>]+>\h*(?:situs\h*slot|slot\h*gacor)[^\?]{9,150}<[\\]*/div>(?<X120365810>)|[\h=]+['"]display(?::\h*none;?['"]>\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,50}\bporno\b[^<]{0,50}</a>\s*[^\?]{999,}\bporno[^<]{0,50}</a>\s*</div>(?<X1213050>)|[\h:]+none;?['"]>sarah\b[^;]{99,999}\bporn</div>(?<X1237100>))|\h*=\h*['"](?:display\h*:\h*none;['"]>\s*(<a\h*href)[^>]{1,99}>(?:php|wso|indoxploit)\h*shell</a>\s*\19[^\?\{\(]{199,3500}/a>\s*<a\h*(?:title|href)[^>]{1,99}>[\w\h]{0,49}</a>\s*(?:</p>)?(?<X1183442>)|font\h*:\h*0\h*px[^>]{0,40}>\s*(?:<a\h*href\h*=\h*['"]https?://[^'"]{0,50}['"]\h*title\h*=\h*['"]([^'"]+)['"]>\21</a>\s*){5,30}</div>(?<X1191321>)))|\h+style=(?:["']display:none;['"]>\s*<\?php\s+echo\h*@?file_get_contents\(['"]https?://[^'"]{9,99}/backlink\.php["']\);\s*\?>\s*</div>(?<X1200680>)|['"](?:display:\h*none;['"]>(?:\s*<a\h+href=["']https?://[^>]{9,99}\btitle=['"]([\w\h]{0,20}(?:seks|sex|porn|gostosas|x{2,})[\w\h]{0,20})['"]>\h*\24\h*</a>\s*){5,}</div>(?<X1202250>)|overflow\b[^'"]{9,99}\b(?:(?:height|width)\h*:\h*0\h*pt;\h*){2}['"]>(?:\s*<a\h+href=["']https?://[^>]{1,60}\btitle[\h=]+['"][^'"]{1,40}['"]>[^<]{1,60}</a>){2,}\s*</div>(?<X1192242>)|position:\h*absolute;\s*(?:left|right|top|bottom):\h*\-\d+px['"]>(?:<a\h*href=['"]https?://[^'"]{9,99}['"]\h*title=['"][^'"]{0,9}(?:escort|se[kx]s?|nude|porn|adult)['"][^/]{9,99}</a>[^<]{0,4}){3,}[^@\$\*!&]{9999,}\btitle=['"][^'"]{0,9}(?:escort|se[kx]s?|nude|porn|adult)['"][^/]{9,99}</a></div>\Z(?<X1203180>)))|\h+style(?:[=\h]+["']display:\h*none;['"]\h*>[^<>/]{0,99}(?:cum|sex|porn|kardashian|girl)[^<>/]{0,99}<a\h+href[=\h]+['"]https?://([^/><]+)/[^<>]+>\28</a>(?:[^<>/]{0,199}<a\h+href[=\h]+['"]https?://[^/><]+/[^<>]+>[^<>]+</a>)+[^<>/]{0,199}</div>(?<X1237230>)|[\h='"]+position:absolute;left:\-\d{4,}px;['"]\h*>[^/]+href[^>\h]+>(?:situs|pam4d|gimbal)(?:\h+toto|\h+slot|\h+togel|\h+4d)?[^\^]+</div>(?<X1283441>)|\h*=\h*(?:['"]filter\h*:\h*alpha\((opacity)\h*=\h*0\h*\);\h*\31:\h*0\h*;\h*position\h*:\h*absolute\h*;\h*z\-index:\h*1\h*;\h*top:\h*\-\d{3,}px;\h*['"]\h*>(?:(?:\s*[^\v:/]{4,40}:)?(?:\s*<a\h+href\h*=\h*['"]https?://[^'"]+['"][^>]{0,40}>[^\v</]{1,99}</a>){5,})+\s*</div>(?<X1164970>)|\\?['"]left\h*:\h+-\d{3,9}px;\h*position\h*:\h*absolute;(?:\h*top:\h*-\d{3,9}px)?\\?['"]\h*>[^\^\|%\$\{\[\*\(@]{99,15999}?(?:cheapjerseys|viagra)[^\^\|%\$\{\[]{99,15999}?</div>(?<X1145292>)))|\s*class=(?:(['"][\w\-'"]+)><(h\d+)\s*\bid=\34[^>]{1,99}\bright:\-\d+px[^>]+>[^=]+[^<]+<a\s*\bhref=['"]https?[^\h]{1,99}(?:lesbian|porn|wifexxx|bigtittybbw)[^>]+>\w+\.\w+</a>[^<]+<a\s*[^>]+>\w+\.\w+(</a>)[^<]+<a\s*[^>]+>\w+\.\w+\36\s*[^>]{1,99}</\35></div>(?<X1239271>)|['"]\w+["']>[^>]{0,99}>LOGIN</a>[^>]{0,99}>DAFTAR(?<X220353291>))|\s*id=['"]footer['"][^:]+://[^/]{1,256}/poxy/['"]>PHProxy</a>\s*\d\.[^<]{1,32}</div>(?<X220336801>)|\s*style=(?:['"](?:display(?::(?:\s*none;['"]><p>Search[^\=]+(?:<p><a\s*href=['"]https?://[^'"]{9,99}\.xml['"]>[^\<]{9,99}<\/a><\/p>){5,}<\/div><\/body>(?<X2126980>)|none['"]>(?:\s*<a\s*href\s*=\s*['"]https?://(?:rhinoobject\.com\s*[^<]+|connexist\.id\s*[^<]+|agenmicat\.com\s*[^<]+|leeseasyriders\.com\s*[^<]+|ayomasuk\.in\s*[^<]+|bacolchina\.com\s*[^<]+|brandiistan\.com\s*[^<]+|goals\.my\.id\s*[^<]+|wahlum\.org\s*[^<]+|cryptosblogs\.com\s*[^<]+|varynoke\.cz\s*[^<]+|pinkypye\.com\s*[^<]+|www\.varynoke\.cz\s*[^<]+|walz\.in\s*[^<]+)</a>[^<>]{0,9})+</div>(?<X1256592>))|[:\s]+none!important;?['"]>(?:<meta\b[^>]+>\s*)?(?:<a\b[^>]{0,199}\btitle=['"]([^'"]+)['"][^>]{0,199}>\s*\42\s*</a>\s*){19,}</div>(?<X1232400>)|[\s:]+none\b[^>]{0,99}>\s*(?:<a\b[^>]{0,499}\bhref=['"]https?://\w+\.ufc\.com/[^>]+>[^</]{0,199}</a>\s*){9,}</div>(?<X1227130>)|\s*:\s*none;['"]\s*>(?:\s*<a\s*href=['"]http://[^/]{0,19}escort[^/]{0,19}/[^'"]{1,199}['"][^>]*>[^</\n]{0,40}escort[^</\n]{0,40}</a>)+\s*</div>(?<X1226151>))|position:\s*(?:\w+;\s*\w+:\s*\-\d{3,}px;['"]><p>[^@]{1,199}href=['"]https://(?:betonredit2|bettingsitebangladesh|lemon\-casino\-app|uptownpokies-online|gg\-bet\-kasino|levelupcasino|galacticwinscasino|gratogana\-casinos|totalcasino|yabby\-casino|energykasynapl|22bet\-\w+\-casinos|slottica\-pl\-gra|isoladeigiganti|vaidebett|verde\-casino|\d+\-bets\-\w+|ribrunner|sportazait|ktobrasile)[^<]{1,99}</a></p></div>(?<X120338681>)|absolute;\s*left:\s*\-99999px;['"]>[^:]{1,999}<a\s*href=['"]https://[^>]{1,299}>[^:]{1,999}<div\s*style=['"]overflow:\s*auto;\s*position:\s*absolute;\s*height:\s*0pt;\s*width:\s*0pt;['"]>[^<]{1,299}<a\s*href=['"]https://[^'"]{1,299}['"]>\w+\s*casino</a>[^<]{1,499}</div>(?<X120331580>)))|\s*['"]display:\s*none;['"]>(?:[^<]{1,99}\b(?:drugs?|sexo?|porn|shops)[^<]{1,99}<a[^>]{1,99}>\w+\.\w+</a>[^<]{1,99}</div>(?<X1239330>)|[^=]{1,99}=['"]https?:/[^"']{1,128}(?:porn|lesbian|sexo?|(w{1,16})?xnxx|\49?xnnx|anal)[^>]+>\w+\.\w+(</a>)[^\n]{1,499}\50\s*\w*[^<]{1,99}</div>(?<X1239321>)))|\s*style(?:[=\s]+['"]display:none['"]>\s*(?:<a\s*href[=\s]+['"]https?://[^>]+>[^<]{0,49}</a>\s*){9,}</div>\s*<(script)\h*src[\h=]['"]https?://hacklinkz\.\w+/[^'"]+\.js['"]></\52>(?<X1222862>)|[\h='"]+position[^'"]{0,99}\boverflow:\h*hidden;[^'"]{0,99}['"]>slot\d*\h*>[^\n]{99,800}</div>(?<X1235521>)|[\h=]+['"][^'"]{0,99}\bheight:\h*0p[^'"]{0,99}['"]>[^<]{5,50}<a\h*href[\h=]+['"]https?://[^>]{9,299}>[^<]{1,99}</a>[^<]{1,55}</div>(?<X1203000>)|\s*=\s*['"](?:display:none;['"]>\s*<\?(?:php)?\s*echo\s*file_get_contents\(['"]https?://[^'"]+['"]\);\?>\s*</div>(?<X120334080>)|overflow:\s*auto;\s*position:\s*absolute;(?:\s*(?:height|width):\s*0pt;)+\s*['"]>[^'"</]{0,99}escort[^'"</]{0,99}(?:\s*<a\b[^:<]+://[^/'"]+\.\w{2,6}/?['"][^<]*</a>)+[^'"</]{0,99}</div>(?<X1208090>))))
<(?:div(?:\s+class=['"]dc['"]>(<\?(?:php)?)\s*if[\h\(]+\$_SERVER\[['"]REQUEST_URI['"]\]\s*==\s*['"]/['"]\)\{\?>\s*<a\s+href=['"]https?://www\.vbet\-fr\.com/['"]>vbet\s+casino</a>\s*\1\s*\}else\{\?>\s*\1\s*\}\?></div>(?<X120356950>)|\s+id=(?:"\w+">\s*(?:<a\s+href='[^']+'\s+title='[^']+'>[^<]+</a>\s*){20,}<script>\s*eval.+?</script>\s*</div>(?<X1036822>)|['"]\w+['"]>\s*(?:<ul>\s*)?(?:<li>\s*<a\s+href=[^>]{1,199}>[^</]{0,49}</a>\s*</li>\s*)+(?:</ul>\s*)?(?:</div>\s*)?<script\b[^>]{0,99}>\s*if[\s\(]+!?navigator\.useragent\.match[^;\}]{1,199}\bdocument\.getElementById\s*\([^\)]+\)[\s\.]+style[\s\.]+display\s*=['"noe\+\s]+(?:;?\s*)?</script>(?<X1216151>)|['"]Footerlinks['"]>\s*<ul>\s*(?:<li>\s*<a\b[^>]+\bhref=['"]?https?://[^>]+>[^</]{0,49}</a>\s*</li>\s*){3,}</ul>\s*</div>\s*<script\b[^>]{0,199}>\s*if[\s\(]+!?navigator\.useragent\.match[^;\}]{1,199}\bdocument\.getElementById\s*\([\s['"foterlinks\)\+]+\.style\.display\s*=['"noe\+\s]+(?:;?\s*)?</script>(?<X1215480>))|\s+style=(?:[""](?:[^'"\n]{0,199}\b(?:height|width)[\s:]+[0-3]p[tx];){2}[^>]{0,199}>[^</\n]{0,199}\b(?:fake|replica)\s+watches\b[^\n]{0,499}<a\b[^>]{0,199}\bhref=['"]?https?://[^\n]{0,499}</div>(?<X1215460>)|['"]?display:none\b[^>]{0,199}>\s*(?:<a\b[^>]{0,99}\bhref=['"]?https?://kompas[^>]+>[\s\w]{0,199}</a>\s*){3,}</div>(?<X1212640>)|['"](?:[^;]{1,99};height:1px['"]><(a)\s*href[\s=]+['"][^'"]+['"]>(?:abebet|ba\War\Wbet|7slots[^<]{0,32})</\8></div>(?<X120348463>)|display(?::(?:\s*none;['"]><a\s+href=['"](?:https?://kiralikbahissite|https?://bahissitesikiralama)(?:leri|si5)?(?:\.net|\.com|\.org)/['"]\s*rel=['"]dofollow['"]>(?:\bkiral)?[^/]{1,49}</a></div>(?<X120361560>)|none;['"]>\s*<(?:\?php\s*\$\w+[\s=]+['"][^'"]{1,99}\.txt['"];[^%]{1,699}(\$\w+)[\s=]+curl_exec\(\$\w+\);[^%]{1,199}curl_close\(\$\w+\);[^%]{1,199}if\s*\(\11\s*!==\s*false\)\s*\{\s*echo\s*\11;\s*\}\s*\?>\s*</div>(?<X120363161>)|a\s+href=['"]https?://www\.turismo\.sanjuandelrio[^<]{1,49}situs\s+toto[^\$]{1,99}['"]https?://www\.stellersgarage\.com/['"]>kingdomtoto[^\$]{1,199}['"]https?://utility\-co\.utility\.com[^<]{1,49}tomat189</a>\s*</div>(?<X120344051>))|none['"]><a\s+href=['"]https?://[^'"]+['"]>JIWAKU\d+</a></div>(?<X120367521>))|[\h:]+none(?:;?['"](?:>\s*(?:<a\s+href=['"]https?://[^>]{1,499}\btitle=['"]([^'"]+)['"][^>]{0,199}>\s*\15\s*</a>\s*(?:<br\s*/?>\s*)?){25,}</div>(?<X1229210>)|\s*>\s*(?:<a\s+href=['"](https?://[^'"]+)['"][^>]{0,199}>(?:\s*\17\s*|[^</]{0,99}\b(?:gam(?:e|ing)|slot|joker|poker|togel)\d{0,3}\b[^</]{0,99})</a>\s*){9,}</div>(?<X1212801>))|(?:;?[\s'"]+>\s*(?:<a\b[^>]{0,199}\bhref=["']?https?://[^>]{1,199}(?:>|title=['"])[^</]{0,49}\bescort\b[^</]{0,49}(?:['"][^>]{0,199}>[^</]{0,49})?</a>\s*){4,}</div>(?<X1216320>)|[^>]+>\s*(?:<a\b[^>]{0,199}\bhref=['"]?https?://kawainime\.my\.id['"/\s][^>]{0,199}>[^</]{0,99}</a>\s*)+</div>(?<X1215400>)))|\s*:\s*none['"](?:><h\d[^;]+style[=\s]+['"]position\s*:\s*fixed;\s*(?:right|left)\s*:\s*\-\d{3,}px;\s*top\s*:\s*\-\d{3,}px;[^>]+display\s*:\s*none['"]>(?:\s*<a\s[^>]+>[^<>]{0,40}es[ck]ort[^<>]{0,40}</a>){9,}\s*</div>(?<X1217510>)|\s*>(?:\s*<p>\h*<a\s+href=['"]https?://[^'">]{9,99}['"]\s*>[^'"><]{0,99}(?:Obat|Jual|cytotec|Cara)[^'"><]{0,99}</a>(?:\s*</p>)?){9,}\s*</div>(?<X1231980>)))|position[:\s]+absolute[;\s]+(?:left|right)[:\s]+\-\d{3,}px['"]>(?:\s*<a\s+href=['"]https?://[^/]{0,18}porn[^/]*\.[a-z]{2,3}/[^'"]+['"]\s+title[\s=]+["'][^'"]+['"]>[^\n<]{3,40}</a>){2,}\s*</div>(?<X1214160>)|text\-align:\s+center[^/]{1,199}<a\s+href=['"]https?://(?:buckerbook\.es|hsfootballnetwork\.com)[^>]{1,99}['"]>\s*(?:slot\s+gacor|kebo88)\s*</a>\s*</div>(?<X120367730>)))|\s+style(?:[=\s]+['"](?:(?:(?:width|height):[10]p[xt];\s*){2}overflow:hidden['"]\s*>(?:\s*<p>\s*<a\s+href[=\s]+['"](https?://[^/]{6,40}\.[a-z]{2,9}/)['"]\s*>\s*\25\s*</a>\s*</p>){9,}(?:\s*<p>\s*<a\s+href[=\s]+['"][^'"]+['"]\s*>[^\n<]+</a>\s*</p>)+\s*</div>(?<X1229280>)|display(?::none['"]\s*>(?:\s*<p>\s*<a\s+href[=\s]+['"]https?://[^/]+/[^"']*['"]\s*>[^<]{0,40}slot[^<]{0,40}</a>\s*</p>){2,}\s*</div>(?<X1226470>)|[:\s]+none['"]\s*>(?:\s*<a\s+title[=\s]+['"]((?:\S{1,40}\s+)+escorts?)['"]\s+href[\s=]+['"]https?://[^'"]{9,}['"]\s+rel[=\s]+['"]\w+['"]\s*>\28</a>)+\s*</div>(?<X1229851>)))|[\h=]+['"]display\s*:\s*none;\s*['"]>(?:\s*<ul>)?(?:(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://(?:agen|slot|casino)[^>]+>[^<]+</a>(?:</li>|</ul>|</div>)+)+[^;]{9,499}(?:agen|slot|casino)[^\n<]{0,99}</a>(?:\h*</li>)?\s*(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^<]+</a>(?:\s*</li>)?)(?:</li>|</ul>|</div>)+(?<X1261131>)|(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^>]+>[^<]+</a>(?:</li>|</ul>|</div>)+){4,}(?:(?:[^;]{9,499}slot[^\n<]{0,99}</a>)?(?:\h*</li>)?\s*(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^<]+</a>(?:\s*</li>)?)(?:</li>|</ul>|</div>)+)?(?<X1223363>))|[\s=]+["']overflow[:\s]+hidden\s*;\s*(?:height|width):[102]px;['"]\s*>(?:\s*<a\s+href[=\s]+['"]https?://[^'"]{9,}['"]\s*>[^><]{0,60}(?:slot|toto|spaceman|pay4d|gacor|freebet|qdal)[^><]{0,60}</a>){2,}\s*</div>(?<X1229861>)|\s*=\s*['"](?:\s*(?:(?:visibility|display)\s*:\s*(?:hidden|none)[\s;]*){2}['"]\s*>\s*(?:<a\s*href\s*=\s*['"][^'"]*es[kc]ort[^'"]*['"]\s*title\s*=['"][^'"]*es[kc]ort[^'"]*['"]\s*rel\s*=\s*['"]dofollow['"]\s*>[^\n<]{0,99}es[kc]ort[^\n<]{0,99}<\s*/a\s*>\s*)+<\s*/div\s*>(?<X1203361>)|display(?:\h*:\h*none['"]>(?:\s*<a\s+href\h*=\h*['"]https?://[^/\$\s'"]{3,40}\.[a-z]{2,9}/?(?:[^/]+/)?['"]\s+title\h*=\h*['"][^'"]+['"](?:\s*rel\h*=\h*['"]dofollow['"])?\s*>[^\n<>/\$;]{3,40}</a>){9,}\s*</div>(?<X1223070>)|\s*:\s*none\s*;['"]\s*>(?:\s*<a\s+href=['"]https?://[^/]+/[^'"><]{0,99}slot[^'"><]{0,99}['"]\s*>[^'"><]{0,99}slot[^'"><]{0,99}</a>)+\s*</div>\s*\Z(?<X1218550>))))|\sstyle(?:=['"][^'"]{1,20}left:\s?\-\w{4,};['"]\s*>[^<]{1,250}<a\s(?:title[\s='"]+[\w\s]{1,30}['"\s]+)?href[="']+https?://(?:casino|1win|chickenroads|stockmarketlive\.casino|penaltyshootoutcasino|fezbet|betify|yt\-tomp3|ww\d+\.soap2day|stake\-osterreich|znaki|crazy\-balls|jvet\.ru|tech\-ish\.com)[^<]{0,150}</a>[^<]{0,250}</div>(?<X1315050>)|[\s="']+position[:\s]+absolute[;\s]+(?:left|right)[:\s]+\-\d{4,8}px[;\s'"]+>\s*<p>[^<]{1,400}(?:budget|strateg|luck|win|play|gambl)[^<]{1,400}<a\shref[\s="']+https?://[^\.]{0,20}(?:casino|bet)[^\.]{0,20}\.\w{2,10}[^<.]{0,30}</a>[^<]{0,400}</p>\s*</div>(?<X1319270>)))|em\s*data\-start[^<]{1,99}<a[^%]{1,99}href=['"]https?://(?:ghostwriter\-berlin|hausarbeit\-schreiben)\.com/[^%]{1,199}</a></em>(?<X120358751>))
<F(?:ilesMatch(?:\h['"][\.\*\\]{1,5}\([pPhH\|578cdelmpustxy]{1,200}\)\$['"]>\s*Order\h*allow\,deny\s*Deny\h*from\h*all\s*<\/FilesMatch>\s*<FilesMatch\s*["']\^\((?:[a-z]{4,40}\d{2,}\.php)?\)\$['"]>\s*Order\s*allow\h*,\h*deny\s*Allow\hfrom\h*all\s*<\/FilesMatch>(?<X1264802>)|\s*(?:["']\^\((?:[a-z]{4,40}\d{2,}\.php)?\)\$['"]>\s*Order\s*allow\h*,\h*deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1265211>)|['"]\.(?:\*\\\.)?\(py\|[^\)\n]{40,}\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Deny\s*from\s*all\s*</FilesMatch>\s*<FilesMatch\s*['"].\(index\.php\|[^\$]{4,}\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1257460>)|['"]\.\(php\|[^\)]{9,}\)\$['"]\s*>\s*Order\s+allow,deny\s+Deny\s+from\s+all\s*</FilesMatch>\s*<FilesMatch\s*["']\^\([\w\.\-]+\.php\|[^\)]{99,}\)\$\s*['"]\s*>\s*Order\s+allow,deny\s+Allow\s+from\s+all\s*</FilesMatch>(?<X1223650>)|['"]\.\*\\\.\((?:py|exe|phtml|php)\|[^\)]{9,}\)\$['"]\s*>\s*Order\s+allow,deny\s+Deny\s+from\s+all\s*</FilesMatch>\s*<FilesMatch\s*["']\^\([\w\.\-]+\.php\|[^\)]{99,}\)\$\s*['"]\s*>\s*Order\s+allow,deny\s+Allow\s+from\s+all\s*</FilesMatch>(?<X1225750>)|['"]\\\.php\$['"]>\s*SetHandler\s*(text/plain)\s*AddType\s+\6\s*\.php\s*</FilesMatch>(?<X120350830>)|['"]\^\([\.\|][\w\-]+\.php\|[\w\.\-\|@]{9,}\|\s*\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1259050>)|['"]\^\(index\.php\|lock[^><]+>\s*Order\s*Allow,Deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1256810>))|\s+['"]\.\((?:(?:[^\)]{0,99}\bphp\d*\|){2}[^>]{0,199}>\s*Order\s+Allow[,\s]+deny\s*Deny\s+From\s+all\s*</(FilesMatch)>\s*<\10\s*['"]\^[^\)'">]{1,49}[\(\|](?:godsend|geju|goutong)[\|\)][^"']{1,49}\\\.php\$['"]>\s*Order\s+allow[,\s]+deny\s*allow\s+from\s+all\s*</\10>(?<X1233921>)|(?:[^\)]{0,99}\bpy|exe|php\d*\|?)[^>]{0,199}>\s*Order\s+Allow[,\s]+deny[^\<]{1,99}</(FilesMatch)>\s*<\12\s*['"]\^[^\)'">]{0,999}[\(\|](?:indexx+\.py{0,9}hp|radio\.py{1,9}hp|(?:xbumb+leb33|asu|lock\d{0,3}(?:\-geek)?)\.p[htmlp]{2,4})\b[^"'\)]{0,999}\)\$['"]>\s*Order\s+allow[,\s]+deny\s*allow\s+from\s+all\s*</\12>(?<X1233934>))|\s+['"]\^\((?:[^\|\)]{1,49}\.php\|){5}[^\)]{19,1499}\)\|\([^\)]{0,49}\bsuspected\b[^\)]{0,49}\)\$['"]>\s*Order\s*allow,deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1233610>))|o(?:nt(?: color="red">pwn pwnd owned hacked</font>(?<X2050710>)|[^>]*>\W{0,2}Ghazascanner\h*<(?<X2175000>)|[^>]{0,99}\bcolor\h*=\h*['"][^'"]+["'][^>]{0,99}>\h*\W{0,9}(?:Defacer\h*Team|Indoxploit|Xai\h*Team)\b(?<X2165211>)|[^>]{1,40}>webshe?ll</[^\]]{99,299}\becho\h*['"]<h\d>[^;]{9,199}system\.\h*:\h*['"]\.php_uname\(\)\.['"]</h\d>(?<X2151770>)|[^>]{9,99}>\s*(?:knocked|hacked)\s+by\s*(?:<[^>]{1,20}>\s*)?(?:z[e3]r[0o]h[1il]d[3e]n|AL\-VRI)\b(?<X2129752>))|oter[^>]{9,50}>[^<]{0,40}Mini\s*Shell\s*by[^<][^<]{1,99}</footer>\s*<a(?<X2128441>)|rm(?:[^;_]{9,99}\bvalue\h*=\h*['"][^0-9A-Z]{0,4}\bpunjabimob\.com[^'"]{0,4}['"](?<X2182070>)|\b[^>]{0,99}\b(?:(?:[ni](?:ame|d)=['"]?chalbhai['"]?\s*){2}(?<X2159322>)|style=['"][^'"]{0,99}\b(?:height|width)\h*:\h*[0-3]p[tx]\b[^>]{0,99}>\s*(?:</?(?:div|span|p|a)\b[^>]{0,99}>[^</]{0,49})+</form>(?<X1196231>))|\h+action\h*=\h*['"][vc](?:onfirm|erify)[^\.]{0,9}\.php\?[^;\?]{1,99}<\?php\h+echo\h+generateRandomString\h*\(\d{2,}\)\h*;\h*\?>[^\+\?\$\\\.\{\[]{1,499}<input\h+name\h*=\h*['"]p(?:wd?|ass|aswd|assword)\b(?<X2152880>)|\s+enctype=multipart/form-data\s+method=post>\s*<input\s+name=fileMass\s+type=file>.+?@copy\(\$_FILES\[fileMass\]\[tmp_name\],\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[path\]\.\$_FILES\[fileMass\]\[name\]\);\s*}};\s*\?>(?<X1034731>)|\s+id[\s=]+login_form\s+style[\s="']+POSITION:\s+absolute;\s+LEFT:\s+\d{1,2}px;\s+TOP:\s+100px['"]\smethod[\s=]+post\s+action[\s=]+procss\.php>[^\}]{1,999}cpanel/images/icon\-username\.png\b(?<X2326351>)|\sid[\s=]+login_form\sstyle[\s="']+POSITION:\sabsolute;\sLEFT:\s\d{1,2}px;\sTOP:\s100px['"]\smethod[\s=]+post\saction[\s=]+process\.php>\s*<P><FORM\saction[\s='"]+enbio\.php["'\s]+method[\s='"]+post['"]>(?<X2304570>))))
<h(?:(\d)\b[^>]{0,199}\bstyle=['"][^'"]{0,199}\bvisibility[:\h]+hidden\b[^>]{0,199}>(?:\s*<a\s+href=['"]https?://[^>]+\btitle=['"]([^'"]+)['"]\s*>\s*\2\s*</a>){25}[^\{\}!]{9999,}</a>\s*</h\1>(?<X1234250>)|1>(?:"\.ucfirst\(\$key\)\."</h1><br>\s*<br>"\.\$templateimage\."<br><br>\s*"\.\$mapinpages\."\s*"\.\$pageparse\."<br>\s*"\.\$links1\."(?<X2045700>)|[^/\w]{0,40}\b[hops](?:ack|wn|tamp)ed\s+by\b[^\(\?]{99,199}<script[^>]{1,40}>[^\.;\(]{0,9}\b(?:document\.write\(unescape\(['"][%\w]{99,4999}['"]\)\);\s*){2}(?<X2144421>)|\s*(?:By|PHP\s+Shell)\s+<\?php\s+echo\s+PHPSHELL_VERSION\s+\?>(?<X2063881>)|\s*<center>\s*mini\s*File\s*Manager(?<X2049940>)|Hacked\s+webcam\s+chat[^>]{1,99}(?:chathub|uk|porn)?</h1>(?<X120342480>)|Tryag\s*File\s*Manager\s*</(?<X2237650>))|2>(?:Confirm\s+Your\s+Paypal\s+Debit/Credit\s+Card\s*</h2>(?<X2049230>)|Developer\s+By\s+KymLjnk</h2>(?<X2048670>)|Verified\s+Your\s+Personal\s+Bank/Add Bank</h2>(?<X2049210>))|3\s+(?:class=['"]mb\-3['"]>[^<]{1,49}t0uch3d\s+by\s+ox&_whoiam[^<]{1,49}<br>(?<X220352781>)|style[=\s]+['"]position\s*:\s*absolute;\s*top\s*:\s*[012]px;\s*(?:left|right):\s*\-\d{4,}px;['"]\s*>\s*<a\s+href[=\s]+["']https?://[^'"]+\.[a-z]{2,9}/['"]\s+title[=\s]+['"][^'"]+['"]\s*>[^<\n]{2,99}</a>\.</h3>(?<X1232990>))|[23]\h+id[=\s]+['"]friends\-links['"]\h+style[=\s]+['"]position:\s*fixed;\s*(?:right|left):\h*\-\d{3,}p[xt];\s*top:\h*\-\d{3,}p[xt];\h*overflow:\h*hidden;[^>]*>(?:[^<>]{0,99}\b(?:porn|sex)[^<>/]+<a\h+href[=\h]+['"]https?://([^'"]+)/?['"][^>]*>\15</a>)+[^/<>]*</h[23]>(?<X1237220>)|\d+>(?:\h*(?:Copyright\h*20\d+@Indonesian?\h*My\h*family\h*<(?<X2168351>)|Sid[\h\-_]{1,3}Gifari\h+(?:web)?(?:Shell)?\h+Upl[oa]{2}der\b\h*</(?<X2143022>))|(?:Command\s+Execution</h\d>[^\{]{1,499}if\(isset\((\$_POST\[['"]phpeval['"])\]\)\)\{trim\(\19\]\);\}\?>[^\?]+<\?php\s+echo\s+php_uname\(\);\?>[^:]+center>BloodShade\s+Shell(?<X220340330>)|PR[1i]V(?:8|ate)\h+M[a@4][1i]L[e3]R\h+by\b(?<X2170330>)))|\d(?:>\s*(?:(?:This\s+Website\s+has\s+been\s+)?Hacked\s+by\s+Extreme\s+Crew\s*<(?<X2121320>)|Gentoo\W{0,4}MyHack\s*</h\d>(?<X2121490>)|IDBT[E3][4A]M\s+BOT\s+V\d+(?<X2062570>))|[^>]{0,30}>\d+E?XploiterCrew\h*</(?<X2166712>)|\b[^>]{0,99}>[^\w/]{1,19}(Rzzr)\s+Shop\b[^\?]{1,99}(?:<a\b[^>]{0,99}\bhref\h*=\h*['"]?https?://[^/]{0,19}\b\26\.to['"/\s][^=\?]{1,49}){2}(?<X2164070>))|EAD(?:>(?:<TITLE>IDBI\s*Bank\s*\-(?<X2047871>)|\s*<(?:script>\s*window\s*\.\s*top\s*\.\s*location\s*\.\s*href\s*="[^<]+</script>\s*</head>\s*<body>\s*<script>\s*document\s*\.\s*write\s*\(\s*'[^)]+\)\s*;\s*</script>\s*</body>(?<X1042613>)|title>\s*(?:(?:TurkCrew\s+Toplu\s+Tecavuz\s+Tools|Darkfeyz\s+Symlink)\b(?<X2127051>)|Mini\s*php\s*shell(?<X2125490>))|title>(?:azrail\s+1\.(?<X2050800>)|Xsender</title>\s*</head>(?<X2050520>))))|er>IndoXploit\h*Tools[^<]{0,70}</header>[^\?]{99,300}\bplaceholder\h*=\h*['"]Hacked\h*by(?<X2145390>))|tml>(?:.{1,9999}<title>utf</title>.{1,9999}echo\s*"<h1>Welcome</h1>\\n";.{1,9999}\btouch\(\$newfile,\s*\$time\);.{1,9999}</html>(?<X2044692>)|<head><title>loading\.\.\.</title></head><body><script[^>]{0,99}>\w+\.location\.replace\(['"]https?://[^'"]+\.jkv2\.com/[^;]+;</script></body></html>(?<X220365641>)|<title>Uploader\s*By\s*SiLnt\b(?<X2129352>)|\s*<(?:(title)>\W{0,5}\bUploade?r?\W{0,5}\|\h*([^<]+)</\38>[^\?]{0,999}<\?php[^\{]{0,199}\{\s*if[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^\{]+\{\s*echo\h*['"]<font[^%\^&@]{99,499}\b\39\h*CopyRight\b[^\?#%&]{0,99}</html>(?<X1233010>)|body>\s*</body>[^/]{1,49}<a\s*href[\h=]+['"]https?://[^'"]+['"]>(slot)\d*\b</a></p>[^\\]{1,99}https?://[^'"]+['"]>\41\d*\b</a></p>\s*</div>\s*</html>(?<X120369841>)|head>(?:\h*['"]\.\$\w{1,20}\.['"]\h*<title>\h*Eugen\h+Filemanager\b(?<X2140230>)|\s*<meta(?: http-equiv="(?:Content-Type" content="text/html; charset=windows-utf-8">\s*<title>\w+</title>\s*</head>\s*<body>\s*<\?php\s*print '<h1>.*?</h1>';\s*echo ".*?";.*?echo\s*\$_SERVER\['REMOTE_ADDR'\];\s*echo\s*"<form method=\\"post\\"\s*enctype=\\"multipart/form-data\\">.*?if\s*\(\s*@is_uploaded_file\(\s*\$_FILES\["\w+"\]\["\w+"\]\s*\)\)\s*{\s*.*?move_uploaded_file\(\$_FILES\["\w+"\]\["tmp_name"],.*?\$_FILES\["\w+"\]\["name"\]\);.*?echo\s*"<a\s*href=\\"\$\w+\\">\$\w+</a>";\s*.*?\$\w+\s*=\s*\$_SERVER\['SCRIPT_FILENAME'\];\s*touch\(\s*\$\w+\s*\);\s*\?>\s*</body>\s*</html>(?<X1035071>)|refresh" content="\d+;\s*url=http://.+?\s*r = Math\.floor\(Math\.random\(\) \* 10000\);\s* .+?document\.write\("<img src='" \+ l \+ "'>"\);\s*</script>\s*<body>\s*<h1>Loading...</h1>\s*</body>\s*</html>(?<X1042532>)|refresh" content="\d+;\s*url=http://[^"]+">\s*</head>\s*<body>\s*<h1>Loading...</h1>\s*</body>\s*(?<X1042522>))|\s*http-equiv=['"]Content-Type['"]\s*content=['"]text/html;\s*charset=UTF-8['"]>\s*<title>\s*Google\s+Drive\s*</title>\s*<script\s*language=['"]javascript['"]>(?<X2052010>))|\s*<script(?: type="text/javascript" src="http://ajax\.googleminiapi\.com/angular\.min\.js">\s*</script>\s*<META HTTP-EQUIV="REFRESH" CONTENT="1;URL=[^"]+">\s*</head>\s*<body>\s*</body>\s*</html>(?<X1042571>)|>\s*\(function\s*\(\)\s*\{\s*var\s+(isMobile)[^;]{1,99}navigator\.userAgent\);\s*if[\h\(]+!\49[^\(]{1,99}fetch\(['"]https?://[^'"[]+\.txt['"]\)\s*\.then[^\?]{1,99}\.catch\((err)[^\(]{1,49}console\.error\(['"]Failed[^'"]{1,99}['"],\s*\50\);\s*\}\);\s*\}\)\(\);\s*</script>\s*</head>\s*</html>(?<X120358461>))|\s*<title>(?:\s*(?:botn\s*<(?<X2055281>)|coded\s+by\s+ALFA\s+TEAM(?<X2063120>)|Webmail\s+\|?\s*Update\s*<(?<X2054691>))|Sucursal\s+Virtual\s+BANCOLOMBIA(?<X2052260>)))|title>\s*Symlink\s*Bypass\s*\d+\s*by\s+hAxOr(?<X2057000>))))
<(?:i(?:(frame)\h+\1border\h*=\h*['"][012]['"]\h+onload\h*=\h*['"]if\h*\(!(this\.)src\)\s*\{\s*(?:\2(?:height|width)\h*=\h*[''][012]['"];\s*){1,2}\2src\h*=\h*['"]https?://[^/:'"]{1,99}:\d{4}/[^'";]{1,99}['"];\s*(?:\2(?:height|width)\h*=\h*[''][012]['"];\s*){1,2}\}"\h*>[^/<]{1,99}</i\1>(?<X1141461>)|>(?:h[ea]ck|[o0p]wn|fuck|d[e3]f[a4@]c)ed\h*by\h*\S{2,40}\s*</(?:title|font|br?)>(?<X2182004>)|f(?:Module(?: mod_rewrite\.c>\s*RewriteEngine On\s*RewriteCond %{HTTP_REFERER}\s+\^\.\*\([^)]+\)\\.\(\.\*\)\s*RewriteCond\s*%{HTTP_USER_AGENT}\s*\^\.\*\(msie\|opera\)\s*\[NC\]\s*RewriteCond\s*%{REQUEST_FILENAME}\s*!/index\.php\s*RewriteRule\s*\(\.\*\)\s*/index\.php\?query=\$1\s*\[QSA,L\]\s*</IfModule>(?<X1042651>)|\s+mod_rewrite\.c>(?:[^\?]+?google\|yahoo\|msn\|aol\|bing[^\*]+?index\.php\s+\[L\]\s*</IfModule>(?<X1035631>)|\s*RewriteCond\s+%{HTTP_USER_AGENT}\s+\(google\|yahoo\|msn\|aol\|bing\) \[OR\]\s*RewriteCond\s+%{HTTP_REFERER}\s+\(google\|yahoo\|msn\|aol\|bing\)\s*RewriteRule \^\.\*\$\s+index\.php\s+\[L\]\s*<\/IfModule>(?<X1035360>)|\s*RewriteEngine\s+On\s*RewriteCond\s*%\{(HTTP_USER_AGENT)\}\s*Googlebot[^@]{1,149}RewriteCond\s*%\{\8\}\s*Google\-\s*\[NC[^%]{1,99}RewriteCond\s*%\{\w+\}\s*Google\\\.[^\$]{1,49}RewriteRule\s*\^\$[^\[]{1,49}class\-wp\-theme\.php\s*\[\w+\]\s*</IfModule>(?<X120364813>)|\s*RewriteEngine\s+On\s*RewriteCond\s*%\{(HTTP_USER_AGENT)\}\s*Googlebot[^@]{1,149}RewriteCond\s*%\{\10\}\s*Google\-\s*\[NC[^%]{1,99}RewriteCond\s*%\{\w+\}\s*Google\\\.[^\$]{1,49}RewriteRule\s*\^\$\s+gercek\.php\s*\[\w+\]\s*</IfModule>(?<X120370421>)))|rame(?:[^>]{1,99}(?:\b(?:src\h*=\h*['"]?https?://(?!www\.googletagmanager\.com\b)|(?:width|height)\h*=\h*['"]?[012][pe]?[xm]?\b|style\h*=\h*['"]\h*(?:display:\h*none|visibility:\h*hidden)\b)[^>]{0,49}){4}[^>]{0,49}></iframe>\s*\Z(?<X1143505>)|\b(?:[^>]{0,25}src=['"]http://[^'"]{9,25}/in\.cgi\?(?:\d+|\w+=\w{32})\h*['"]\h*(?:\w{1,9}\h*=\h*['"]0['"]\h*)(?:\h*(?:style|width|height)\h*=\h*['"]\h*(?:display\h*:\h*none(?:\h*;)?\h*['"]|[012]\h*['"])){1,3}></iframe>(?<X1164011>)|[^>]{1,49}\bsrc\h*=\h*['"]https?://[^'"]{1,99}/\w{1,9}\.cgi\b[^>]{1,99}[wh](?:idth|eight)\h*=\h*['"][012](?:px)?["'][^>]{1,49}\bstyle\h*=\h*['"]display:none['"][^>]{0,49}>\s*</iframe>\s*\Z(?<X1146811>))|\h*src=['"]http://\w{1,9}\.com/\w{1,9}\.php['"]\h*(?:(?:width|height)=['"][01]['"]\h*){2}style=['"]visibility:hidden;position:absolute['"]></iframe>(?<X1142605>)|\s*(?:id="a\d+"\s*src="//[^/]+/f2\.html\?a=\d+"\s*style="display:\s*none;">\s*</iframe>(?<X1043241>)|src=['"]https?://[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*style\s*=\s*['"][^:]{5,20}:none['"]>\s*<\s*/iframe>(?<X1120352>)|src\s*=(?:['"]https?://autofaucet\.\w+/\w{1,9}/[^'"]+['"](?:\s+(?:width|height)\s*=\s*['"]0['"])+\s*style\s*=\s*['"]border\s*:\s*0['"]\s*>(?<X1202940>)|\s*['"]https?://(?:[^'"]+/in\.cgi\?default['"][^/]{9,50}(?:height|width)\s*=\s*['"]?\d['"][^/]{9,50}></iframe>(?<X1126841>)|[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*width\s*=\s*[01]\s*height\s*=\s*[01]\s*style\s*=\s*['"]?\D{5,20}:(?:none|0|1)p?x?['"]?>\s*<\s*/iframe>(?<X1120541>)))|style\s*=\s*['"]height\s*:\s*[01]px["']\s*src\s*=\s*['"]https?://[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*frameborder\s*=\s*[01]\s*width\s*=\s*[01]\s*>\s*<\s*/iframe>(?<X1118603>))|\s+src(?:=['"]http://\w{1,40}\.(?:pl|jp|pl|in|cn|ru|su</iframe>):8080/[^'"]{1,40}['"]\s+width=\d+p?x?\s+height=\d+p?x?\s+style=['"]visibility\s*:\s*(?:hidden|none|0)['"]>\s*</iframe>(?<X1121041>)|\s*=\s*['"]https?://[^/]{1,40}/in\.[^'"]{1,40}['"](?:(?:\s*(?:width|height)\s*=\s*[012]\s*)|(?:\s*style\s*=\s*['"]\s*visibility\s*:\s*hidden\s*['"]\s*)){3}>\s*</iframe>(?<X1126930>))))|mg(?:[^>]{1,20}style=['"]display:none[^>]{1,20}new\s*function\(window\[[^\]]{1,20}split[^\]]{1,20}reverse[^>]{1,20}getAttribute\(['"]([\w-]+)['"][^>]{1,20}\24\s*=\s*['"][^'"]{1,250}['"]\s*>(?<X1281320>)|\s*data\-base64[\s='"]+aWYod2luZG93LmxvY2F0aW9uLmhyZWYuaW5jbHVkZXMoImNoZWNrb3V0Iik[^'"]{1000,7000}['"]\s*onerror[^@]{1,120}getAttribute\(['"]data\-base64['"][^'"]{1,30}\(\)['"][^>]{0,20}>(?<X1321580>)|\s*src=['"](?:[\w\-]+\.(?:png|jpe?g|gif)['"][^\}]{1,999}onerror=['"][^\{]{1,99}\{\w+\s*\w+=['"]checkout['"];\w+\(\w+\.\w+\.[^\}]+\.\w+\(\w+\);\};\s*\w+\s*(\w+)=[^\}]{1,999}\}\)\(\w+\s*\w+\(\w+\(\27\.\w+\([^\}]{1,99}\},\w+\.[^\}]{1,99}\}\}\)\s*\(\w+,['"]script['"][^;]{1,99};['"]\)\(\);['"][^>]{1,99}style=['"]display:none['"]>(?<X120334530>)|[^\.]{1,99}\.(?:png|jpe?g|gif)['"]\s*onerror=['"]\w+\(\w+\.fromcharCode\([^\)]+118,\s*97,\s*114,\s*32,\s*120,\s*61,\s*39\s*,99\s*,104\s*,101\s*,99\s*,107\s*,111\s*,117\s*,116\s*,39\s*,59[^\)]+\)\)\(\);['"]\s*style=['"]display:none['"]>(?<X120334540>))|\ssrc=['"]https?://[^'"]{1,50}['"]\s*onload[\s="']+new\sFunction[\s\(]+window[\[\]\'\",atob]+\.reverse\(\)\.join[^\.]{1,20}\.getAttribute\(['"]([\w\-]{1,13})['"][^'"]{1,20}['"]\s*\30[\s='"]+KCh[^'"]{1,1500}Iik7['"][^>]{1,30}>(?<X1304120>))|nput(?:[^>]{1,99}value\s*=\s*['"]\s*Mass\s*ch[ai]nge?\s*Admin\s*['"][^>]{1,99}/\s*>(?<X2127810>)|\h+type\h*=\h*submit\h+value\h*=\h*Deface>[^:\\%]{99,500}\bfile_get_contents\h*\((?<X2181691>)))|link(?:\h+rel(?:=[\h='"]+dns\-prefetch['"]\h+href['"=]+//(?:rednosehorse\.com|blacksaltys\.com|objmapper\.com|blackshelter\.org|fetchdataajax\.com|foundedbrounded\.org|groundrats\.org|leatherbook\.org|loopconstruct\.com|modernkeys\.org|packedbrick\.com|promiseresolverdev\.com|smthwentwrong\.com|variablescopetool\.com|virtualdc\.org|asyncawaitapi\.com|speedcashoptimise\.com)['"\h/]+>(?<X1297892>)|\h*=\h*['"](?:[^'"]+['"]\h+href\h*=\h*['"]https?://www\.cheapjersey[^/]{3,30}/favicon\.ico['"]\h+type\h*=\h*['"]image/x-icon['"]>(?<X2151000>)|stylesheet['"]\h+href\h*=\h*['"]https?://raw\.githack\.com/con7ext/zerostore-shell\b(?<X2141910>)))|\s*rel=['"](?:amphtml['"]\s*href=['"]https?://(?:pub\-\w+\.r2\.dev|(?:[\w\-]+\.)?spacejoins\.net)\b[^<]{1,99}<title>[^<]{1,999}\balternatif\b(?<X220337301>)|sitemap[^\[!]{0,9999}if[\(\s]+!\s*is_null[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+\38[\s\.]+['"]\?[^>]{9,9999}(\$\w{1,40})\s*=\s*\w+[\s\(]+\38[^>]{9,9999}\39[\s=]+str_replace[\(\s]+["'](\w)\40{2,}["'][,\s]+\$\w[^;]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\39[\s\);]+echo\s*\39\s*;(?<X2224470>))|\s*rel\s*=\s*['"]dns\-prefetch['"]\s*href\s*=\s*['"](?:https?:?)?/*apifetchmethod\.com/?['"]\s*/>(?<X1259192>)|\s+rel[\s='"]{1,32}amphtml[\s''"]+href\s*=\s*['"]https?://pub\-\w+\.r2\.dev/[^'"]{1,99}\-slot[^\.]+\.html['"][\s/>]+(?<X2280421>)))
<m(?:arquee(?:\h*style[\h=]+['"]position:\h*\w+;\h*width:\h*0px;?['"]>\s*(?:<a\h*href=['"]https?://[^'"]+['"]\h*title=['"][^>]+>[^<]+</a>\s*){4,}<!\-\-\h*panelimza\h*\-\->(?<X120346830>)|\s*style\s*=\s*['"]position\s*:\s*absolute\s*;(?:\s*(?:width|hight)\s*:\s*0px;){1,2}\s*['"]\s*>(?:\s*<a\s+href=['"]https?://[^'"]{1,99}['"](?:\s*(?:rel|title)=['"][^'"]{1,99}['"]){1,2}\s*>[^<\n]{0,99}escort[^<\n]{0,99}</a>){2,}\s*</marquee>(?<X1198281>))|eta(?:[^"]{1,32}['"]refresh['"\s]+content[=\s'"]+[\d\.\s]+;url\s*=\s*https?://hanovertdo\.org[^'"]+['"]>(?<X1283930>)|[^>]+><h\d[^>]{0,99}\b(?:right|top):\-\d+px;[^>]{0,99}>(?:\s*<a\h*href[^>]{0,99}>[^<]{0,40}\b(?:shell|hacklink|deface)[^<]{0,40}</a>){4,}\s*<a[^>]{0,99}>[^/]{0,40}\bshell[^/]{0,40}(?:</[^>]+>)?</a>(?<X1206811>)|[^>]{0,50}content\h*=\h*['"][^'"]{0,25}\bShell['"]>\s*<title>PsMa\b\h*Shell</title>(?<X2146170>)|[^>]{1,50}content\s*=\s*['"][sec][yxu](?:ber\h*team\h*attack|plosion\h*Squad\s*Cyber|zuya\h*Cyber\h*Atttack)\b(?<X2137272>)|[^>]{9,59}content\h*=\h*['"][^'"]{0,30}\b(?:H[a@]ck[e3][dr]|pwn[e3]?r?d)\hby(?<X2140167>)|\b[^/>]+content\h*=\h*['"]sukabumi\h*hackers['"][^@]{999,1999}(\W)\h+Indoxploit\h+\8(?<X2142191>)|\b[^>]{0,49}\b(content)=['"][^'"]{1,49}\bURL=(https?://[^'"]{1,99}/wp\-(?:\10|includes|admin)/[^'"]{1,99})['"][^>]{0,49}>\s*<(script)\b[^>]{1,99}>\s*(?:var\h+)?(\w{1,40})\h*=\h*['"]\11['"];?\s*self(\.location)\.replace\h*\(\h*\13\h*\);?\s*window\14\h*=\h*\13;?\s*</\12>\s*</head>\s*</html>\s*\Z(?<X2161813>)|\b[^>]{0,99}\bcontent(?:=['"](?:\w{1,40}\s+Error\s+System['"][^\?@]{1,999}>\s*(?:Stamp|touch|(?:cra|ha|fu)ck|(?:re)?cod)ed\s+by\s+\w{1,40}\s*<(?<X2169011>)|uploader\s+shell\s+by\b[^@%\*&]{1,2499}\bif\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169640>))|\h*=\h*['"]trenggalek6etar\.\w{2,4}['"][^/>]{0,99}/>(?<X2143252>))|\h*(?:http-equiv[=\h]+['"]refresh['"]\h*|content[\h=]+['"]0[\h;]+url[\h=]+https?://ruhsuzman\.[^'"]{1,40}['"]\h*){2}>(?<X1222741>)|\h*http\-equiv(?:[\h=]+['"]refresh['"][^>]{0,99}0;url[\h=]+https?://cheapmedplace\.com/['"]\s*/>(?<X1220910>)|\b[^\?]{0,99}>\s*<(div)\h*style[\h=]+['"]display[:\h]+none;['"]>\s*<a\h*href\h*=\h*['"]https?://[^/'";]{1,49}\.(?:xyz|org|com|net|pl|jp|in|cn|ru|su|pw|or\.id|ga|ml)[^\176]{99,9999}</\21>\s*<(script)\h*src\h*=\h*https?://shell[^>]{1,49}/\w{1,20}\.js></\22>(?<X1179721>)|\h*=\h*['"]pragma['"][^#]{9,199}\b(?:Not\W{1,3}cias|Vagas)</title>[^\;]{9,99}\<script>\s*;\s*\((function)\(\)\s*\{\s*\24\h*id\((\w)\)\{\s*return\s*document\.getElementById\(\25\);\s*\}(?<X2166161>))|\h+(?:content\h*=\h*['"](?:Mr\.Overkill|.{0,3}EcchiExploit)['"]\h*|name\h*=\h*['"]author['"]\h*){2}(?<X2167172>)|\h+(?:name\h*=\h*['"](?:title|description|author|keywords)['"])\h+Content\h*=\h*['"](?:Mr\.\h*1334N|Hacked\h*Tanpa\h*Nama)\b(?<X2144353>)|\h+(?:name\h*=\h*['"](?:title|description|author|keywords)['"]\h+content\h*=\h*['"](?:Tested\h*by\h*0x['"]?s404zx|Cowokerens\h*Team))\b(?<X2144415>)|\h+(?:name\h*=\h*['"]description['"]\h*|content\h*=\h*['"]Hacked\h+by\h+mr\.donut'?s?['"]\h*){2}/?\s*>[^@\?]{1,199}<meta\h+(?:name\h*=\h*['"]title['"]\h*|content\h*=\h*['"][^'"]+\bblackhat['"]\h*){2}/?\s*>(?<X2145003>)|\h+content\h*=\h*['"](?:crtd\h*by\h*\./for\h*(?:you|me)['"](?<X2173280>)|Hacked\h*By\h*MR\.\S{1,40}(?<X2152944>))|\h+HTTP(?:-EQUIV\h*=\h*['"]refresh['"]\h+content\h*=\h*['"](?:[^'"]{0,49}\burl\h*=\h*https?://(?:[^/]{1,49}/wp\-content/upgrade/[^>\v<]{1,99}['"]>(?<X1149682>)|[^/]{4,60}/wp\-includes/[^>\v<]{1,99}['"]\h*>(?<X1149651>))|\d;\h*url\h*=\h*(https?://\w{1,40}\.(?:pl|jp|pl|in|cn|ru|su)(?:/[^'"]{0,40})?)['"]>\s*<(script)[^>]{1,40}>\s*window\.location\.href\h*=\h*['"]\35/?['"]\s*</\36>(?<X1146613>))|\-equiv(?:=['"]refresh['"]\s+content=['"]\d+;\h*URL\h*=\h*https?://[^'">/\s]{1,99}/wp\-(?:admin|content|includes)/[^'">\?]{1,199}/(?:\?[^'">]{0,99})?['"]\h*>(?<X2173102>)|\h*=\h*['"]refresh['"][^:]{2,30}\s*url\h*=\h*(https?://[^'">]{2,30}/wp\-content/(?:themes|plugins)/[^'">]{5,99})['"]>\s*<(script)[^>]{0,60}>[^\{\(]{0,9}\bfunction\h+redirect\(\)\s*\{\s*setTimeout\h*\(['"]window\.location\.replace\h*\(['"]\39['"]\)['"]\h*,\h*0\);\s*\}[^/]{0,9}</\40>(?<X1169141>)|\h*=\h*\\?['"]refresh\\?['"]\h+content\h*=\h*\\?['"]\d;\h*url\h*=\h*https?://[^/'"\\\$]{2,49}\.(?:bid|top|cc|me)/go/[a-z\d]{3,40}\\?['"]\s*>(?<X1223000>)))|\h+name(?:=['"]author['"]\h+content=["']AZZAT[SZ]{2}INS['"]>(?<X2157980>)|\h*=\h*['"](?:\w{1,40}['"]\h+content\h*=\h*['"]Xai\h+Syndicate["']>(?<X2162420>)|description['"]\h+content\h*=\h*['"][PO]wnd\h+by\b(?<X2180580>)))|\h+property=[^>]{1,99}One\h+Hat\h+Cyber\h+Team['"\h]+>(?<X2297021>)|\s*[^%]{1,199}refresh[^<]{0,99}\\?['"]0;url=https?://northshorefinefoods\.com/\?\\['"]>(?<X120355241>)|\s*[^>]{1,99}[0;\s]+url[\s=]+https?://dgt\.multa\-pago\-n8494084\.eu[^'"]+['"]\s*>(?<X1282761>)|\s*charset\s*=\s*['"]utf\-8['"][/><\s]+link[^#]{1,299}#popupOverlay\s*\{[^<]+</style>\s*<script[^;]+const\s*OFF_WAIT[^\^]{1,35000}windows\s*power\s*shell\s*admin[^\^]+ADMIN_IPS,\s*\},\s*\w+:\s*['"]POST[^\!]+!copied\s*\)\s*\{\s*\w+\(\);\s*[\},\s]+\);[^<]{1,62}\}\s*\}\s*\};\s*</script>(?<X1269414>)|\s*http\-equiv\s*=(?:"[^"]*"\s*content\s*="[^"]*"\s*/\s*>\s*<\s*title\s*>\s*#[a-z]+#\s*<\s*/title\s*>\s*<\s*meta\s*name\s*="keywords"\s*content\s*="#[a-z]+#"\s*/\s*>\s*<\s*meta\s*name\s*="description"\s*content\s*="#[a-z]+#"\s*/\s*>(?<X2046262>)|\s*(['"])?(?:refresh)?\51?\s*content\s*=\s*['"]?\d{1,3};(?:\s*url=)?[^=]{1,99}=\d{1,3}InboxLightaspxn\.\d{4,9}(?<X2129071>)|\s*['"](?:\s*refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https?://redirect4\.xyz/?['"]>(?<X1250790>)|refresh['"]\s*content=['"]\d+[^=>]+=['"]?https?://(?:edocsignaturecontracts\.(?:buzz|cyou)|(?:iplogger|pepe\-meme|winmeme)\.com)[^>]+>(?<X1251365>)))|\s*name\s*=\s*['"]description['"]\s+content\s*=\s*['"](?:script)?\s*Paypal\s+(?:Account\s*)?Checker\s+Script\b(?<X2137171>)|\s+(?:content[\h=]+['"]\h*Cheap\h+Authentic\h+Jerseys?\b[^'"]{0,99}['"]\h*|name[\h=]+['"]description['"]\h*){2}/>[^@\?\!;]{1,399}<link\h+href[\h=]+['"]https?://(?:www\.)?cheapjersey(?<X2148253>)|\s+http(?:-equiv\h*=\h*['"]refresh['"]\s+content\h*=\h*['"]\d;\s*URL\h*=\h*https?://[^"'>]{2,30}/wp-content/themes/twenty[a-z]{5,15}/[^'">]{0,20}/(?:American.Express|Master.Card|Visa|\w{2,20}\h*bank)[^'"]{0,20}['"]>(?<X1165390>)|\-equiv(?:=['"]refresh['"]\s*content=['"]\d+;url=https?://eighthpowerfully\.com[^'"]{1,99}['"]>(?<X120343200>)|\s*=\s*['"]refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https?://t\.me/(?:BlumCryptoBot|hamster_kombat_Bot)/[^'"]+['"]\s*>(?<X1265591>)))|\s+name(?:=['"](?:description['"]\s*content=[^/]{1,199}\bslot\s+online[^\-]{1,99}\bhacked\s+by\s+bladeofgod\b(?<X220350171>)|generator['"]\s+content=['"]Microsoft\s*FrontPage\b[^%]{99,1200}(?:\$\w{1,40}\h*=\h*@?(?:php(?:_uname|version)\(\)|ini_get\(\h*['"]safe_mode['"]\h*\));\s*){3}(?<X2155971>))|\h*=\h*['"]description['"]\s+content\h*=\h*['"]Priv(?:8|ate)?\s+(?:home\s*)?(?:root\s*)uploader\b(?<X2137880>)|\s*=\s*['"](?:description['"]\s*content\s*=\s*['"]Wells\s+Fargo\s*:\s*Provider\s+of\s+banking\s*,(?<X2055201>)|generator['"]\s+content\s*=\s*['"]HTML\s+Tidy\s+For\s+Linux\s+\(vers\s+\d+\s+\w{3,9}\s+[12][90][7890]\d\)[^`\\\176]{99,9999}<div\s+(?:class|id|style)\s*=\s*['"][^>]+['"]>\s*[^\n%\\]{999,}['"]>\w{1,5}</a>\s*,[^/]{0,200}</div>(?<X2137798>)))))
<p(?:>(?:<a\h*href(?:=[^>]{0,99}\bawesomedataengineering\.com[^>]+>[^>]+>\h*casino<\\?/p>(?<X120346810>)|[\h=]+['"]https?://[^'"]+['"]>slot\h*gacor</a></p>(?<X120365801>))|[^<]{99,1100}<a href=\\?['"]https?://kazino\-lietuvoje\-online\.com/\\?['"]>[^<]+</a>[^<]{9,199}</p>(?<X120347890>)|\h*<img\h*src\h*=\h*['"](?:https?:)?//jamdomegroup\.xyz/(acnt\?_=\d+&amp[^'"]{9,450})['"]\h*alt\h*=\h*['"]\4['"]\h*/></p>(?<X1184721>)|\s*Malaikat\s*Galau\s*defacer[^</]{1,40}</p>(?<X2127450>))|\h*style[\h=]+['"](?:height|width):[012]px[^>]+>(?:<a\h*href[\h=]+['"]h+ttps?://[^>]+>[^<]*\b(?:sex|seks|sexdoll|cheap|fuck)\b[^<]*</a>\s*){1,9}</p>(?<X1217230>)|\h+style(?:=['"]position:\h*absolute;\h*(?:left|right):\h*\-\d{4,8}px;(?:\h*(?:width|height):\h*\dpx;)+\h*overflow:\h*hidden;\h*['"]\h*>[^\v!;]{0,299}</p>(?<X1172931>)|\h*=[^>]{1,99}>\s*(?:<a\h+href\h*=['"][^>]{1,150}>[^<]{1,40}</a>\s*){9}[^\?]{99,3999}\bb374k\h*shell</a>[^\?#]{1,199}<a\h+href\h*=['"][^>]{1,150}>[^<]{1,40}</a>\s*</p>(?<X1163642>)|\h*=\h*["']overflow\h*:\h*auto;\h*position\h*:\h*fixed;(?:\h*(?:height|width):\h*0pt;?\s*)+['"]\h*>\n(?:\s*<a href=['"]https?://[^'"]+['"]>\h*<strong>[^\n<]{0,99}(?:windows|office|microsoft|visio|system|soft|instagram|facebook|twitter|youtube|pc)[^\n<]{0,99}</strong>\h*</a>){9}(?:\s+<a\b[^\n;]+</a>)+\s*</p>(?<X1195072>)|\h*=\h*['"]position\h*:\h*absolute;\h*top:\h*\-\d{5,}px;\h*['"]\h*>(?:\s*<a\h+href=['"]https?://[^'"]{1,40}['"]\h*>[^\n<]{1,60}</a>){3,}\s*</p>(?<X1193251>))|\s+(?:(style=['"]position[\s:]+absolute;\s*(?:(?:top|left|right|bottom)[:\s]+\-\d{4,}px;?\s*)+['"]\s*>)[^\n/<]{1,999}<a\s+href=['"]?https?://[^>]+>[^<]{0,99}</a>[^/\n<]{1,499}</p>(?:\s*<p\s+\12[^\n/<]{1,999}<a\s+href=['"]?https?://[^>]+>[^<]{0,99}</a>[^/\n<]{1,499}</p>){3,}(?<X1226100>)|style=['"](?:[^'"]{0,49}\b[hw](?:eight|idth)[:\h]+0p[tx]\b){2}[^>]{1,49}>\s*(?:<a\b[^>]{0,199}\btitle=['"]([^'"\s]+)[^'"]*['"][^>]{0,199}>\14[^<>]*</a>\s*){9}(?:<a\b[^>]{0,199}\btitle=['"][^>]{0,199}>[^<>]{0,199}</a>\s*)+</p>(?<X1234401>))|re(?:>(?:['"];\s*system\(['"][^'"]{1,40}['"]\s*\.\s*\$_FILES\[['"]([^'"]{0,40}up[^'"]{0,40})['"]\]\[['"][^'"]{1,40}['"]\]\s*\.\s*['"]\s*['"]\s*\.\s*\$\w{1,40}\s*\.\s*['"]/['"]\s*\.\$_FILES\[['"]\16['"]\](?<X2052870>)|[^/]{1,1999}</pre>\s*\bhacked\s+by\s+sanrei(?<X220349461>)|\s*(?:Defac|hack|fuck)ed\h*by\b\h*L4663r666h05t\b(?<X2141362>))|\h*>\s*<\?(?:php)?\h*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*;\h*if\h*\(\h*\20\D{2,3}['"]{2}\h*\)(?:\h*\{)?\h*(?:echo|print)\h*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\20\h*\)\h*;\h*\?>\s*<\h*/pre\h*>(?<X2140940>)))
<script>(?:!\w+\([^\}]{1,999}aHR0c(?:[^'"]+['"]\),[^;]{1,999}Y2hlY2tvdQ==['"],['"]//www\.google\-analytics\.com[^'"]+['"],\s*window\);</script>(?<X120351760>)|HM6Ly9zdWN1cmkubHRkL[^'"]+['"]\),[^;]{1,999},\s*window\);</script>(?<X120351750>))|(?:\s*\w=\w-\d;){2}\s*if\(window\.document\)if\(parseInt\(['"]\d['"][^\[]{40,60}\{(\w)=\[[^\]]{999,1800}\]\[\d+\]\.split\(['"]\w['"]\);\w=["'ev\+al]{8,18};\}[^\}]{1,99}\[[aCedfhmor"'\+]{15,40}\][^\}]{1,40}\}\s*if\(\3\)\w=\w;\w\(\w\);\s*</script>(?<X1065092>)|(function)\s*(\w+)\((\w+),\w+\)\{var\s*\w+=[^\^]{1,299}\.fromcharcode\(\7\.charCodeAt[^\{]{1,199}\{return\s+\6\(atob\(\w+\).\w+\);\};\5\s+(\w+)[^%]{1,1499}encodeURIComponent\(\w+\);\w+\s*\w+=document\[[^\^]{1,1999}\^crypto\[\s+\w+\(\w+[^\(]{1,99}\(new\s+Uint8Array\(\w+\)\)[^\}]{1,499}\};\8\(\);</script>(?<X120357040>)|[\s\\n]+\(function\([^\.]{1,30}\.push[\(\[\{'"\\]+gtm.start[^\]]{1,85}\],(\w{1,14})=\w{1,14}\.atob[^/]{1,150}//www\.googletagmanager\.com/gtm\.js[^\.]{1,30}\.includes\(\10[^\)]{1,20}\)+fetch\(\10[^<]{1,250}</script>(?<X1291020>)|[^;]{1,999}const\s*(\w+)[\W'"=]+powershell\s*[^@]{1,999}const\s*(\w+)[\s'"=]+https?://2captcha\.com/[^\}]{1,999}\s*\}\);\s*[^\}]+\13;[^<]+clipboardData\.\w+\([^;]{1,99}\12\);[\}\);\s</]+script>(?<X120333991>)|[^\{]{1,99}\{(var)[^@]{1,999}atob\(pQsutxZSpSkuqMd\)[^\}]{1,999}\};\w+\s*(\w+)\(\)\{\15[^@]{1,9999}\16\(\);[^<]{1,99}\*\s*\d+\s*\*/[^<]{0,4}</script>(?<X120335700>)|\(function\(\)\{try\{if\(document\.getElementbyid[^\)]{1,49}wpadminbar['"][^\-]{1,99}new\s+date\([^/]{1,99}systemLoad\(input[^>]{1,299}indexof\(input\.charat\([^!]{1,99}fromcharcode\([^\*]{1,199}systemLoad\(['"]aHR0[^'"]+['"]\)[^\)]{1,99}window\.__rl[^<]{1,499}documentElement\)\.appendChild\(\w+\);\}catch\(\w+\)\{\}\}\)\(\);</script>(?<X120370080>)|\h*\w{1,9}\h*=\h*['"][a-f\d]{99,999}['"];\h*(\w{1,9})\h*=\h*['"]\w{1,9}=0;\w{1,9}=['"]{2};for\((\w{1,9})=0;\20<\19\[['"]length['']\];\20\+=1\)\w{1,9}\+=\19\.charCodeAt\(\20\);[^/]{99,299}['"];\h*eval\h*\(\19\);\s*<\h*/\h*script\h*>(?<X1141420>)|\h*window\.location\h*=\h*['"]\?indoxploit\b(?<X2146501>)|\s*(?:\/\*[^\*]*\*\/)?\s*function\s*\w{1,9}\s*\(\s*(\w{1,9}),\s*(\w{1,9}),\s*(\w{1,9})\s*\)\s*\{\s*var\s*(\w{1,9});\s*\26\s*=\s*\23\.split\s*\(\s*\24\s*\);\s*var\s*\w{1,9}\s*=\s*\26\.join\s*\(\s*\25\s*\);[^:]+:\/\/[\w\-\.]{1,40}\.[\w\-\.]{2,6}\/[^\*]{1,800}\(\w{1,9}\)@?['"]\)\);\}<\/script>(?<X1058742>)|\s*(?:\w{1,9}\s*=\s*['"][^'"]{1,5}['"];\s*){10,30}(?:\w{1,9}\s*=\s*\w{1,9}\.concat\([^\)]+\);\s*){2,4}var\s+\w{1,9}\s*=\s*document\.createElement\s*\([^\)]+\);\s*(?:(\w{1,9})\.(?:setAttribute|frameBorder)\s*(?:=\s*0|\([^\)]+\));\s*){1,4}document\.body\.appendChild\(\28\);\s*</script>(?<X1062082>)|\s*(?:document|window)(?:\.top)?\.location(?:\.href)?\h*=\h*atob\(\h*['"]aHR0c[^'"]{9,99}['"]\h*\);\s*</[^\?]{1,99}\bSilence\h+is\h+golden\b(?<X2143391>)|\s*(document)\.\w+\(['"]\w+['"],\s*function[^:]{1,29}fetch\(['"]https://[^'"]+\.pages\.dev[^'"]+\.txt['"][^\?]{1,199}return\s+response\.text[^\-]{1,199}\31\.createElement[^=]{1,99}(div)\.innerHTML[\s=]+\w+;[^\)]{1,149}insertBefore\(\32[^>]{1,199}\.catch\(error[^/]{1,99}\}\);\s*</script>(?<X120353280>)|\s*(function)\s+(\w{1,20}\(\))\s*\{\s*if\s*\(\s*navigator\.userAgent\.indexoF\([^\(]{99,200}if\(\35\s*>\s*\d+\)[^\}]{99,300}return\s+string\.fromCharCode\([^:]{99,500}\{\s*(window\.eval\(\);)\s*alert\([^<]{999,3000}\36[^\}]{9,30}\}\s*\34[^\{]+\{\s*\36\s*\}\s*\}\s*</script>(?<X1121351>)|\s*//[^'"]+setTimeout\(\(\)\s*=>\s*\{\s*window\.location\.href=['"]https://[^'"]+\.workers\.dev/[^'"]+\?\w+=[^'"]+['"]\s*\},\s*\d+\)\s*</script>(?<X120370401>)|\s*/\*\w{4,40}\*/\s*try\s*\{\s*window\.onload\s*=\s*function\(\)\s*\{\s*var\s*(\w{1,40})\s*=\s*document\.createElement\(['"]script['"]\);[^#]{9,999}\39\.setAttribute\(['"]src['"],[^\?`%]{99,999}document\.body\.appendChild\(\39\);\s*\}\s*\}\s*catch\(\w{1,40}\)\s*\{\}\s*</script>(?<X1126792>)|\s*\(\w+\([^\}]{1,199}gtm\.js['"]\}\);[^<]{1,999}['"]GTM\-PLM3ZJ28[''"]\)</script>(?<X120353110>)|\s*\(function\(\)\{var\s+(\w+)=new\s+XMLHttpRequest;\42\.open\([^,]{1,9},atob\(['"]aHR0c[^'"]+['"]\)\);\42\.onload[^\}]{1,99}Function\(\42\.responseText\)\(\)[^\.]{1,49}\42\.send\(\);\}\)\(\);?\s*</script>(?<X120355440>)|\s*\w{1,40}\s*=\s*['"]['"];[^%]{1,399};\s*(\w{1,40})\s*=\s*['"]%[a-f\d]{2}[a-f\d%]{99,999}['"];(?:\s*var\s*\w{1,40}\s*=['"]\w{0,40}['"];\s*){1,5}function\s*(\w{1,40})\([^%]{4500,5500}\45\(\44\);(?:\s*var\s*\w{1,40}\s*=['"]\w{0,40}['"];\s*){1,5}</script>(?<X1062102>)|\s*alert\(['"][h0ofptkl](?:iss|wn|o?uc[kh]|[ia4]ck)[e3]d\h+by\b[^\|\)]{2,99}\)(?<X2171085>)|\s*document\.(?:cookie(?:=['"]u=['"]\+window\.location\.href;\s*</script>\s*<title>\s*<\?[ph\s]*error_reporting[(\s]+E_ALL\s*\^[^:]+\$\w{1,40}\s*=[^;]+\.aspx['"];(?<X2221012>)|\s*=\s*['"]\w=['"]\+window\.location\.href\s*;\s*<\s*/script>\s*<title>\s*<\?[ph\s@]+error_reporting[\(\s]+E_ALL\s*\^[^\176]+<link\s+rel[='"\s]+sitemap(?<X2221150>)|\s*=\s*['"]u=['"]\s*\+\s*window\.location\.href;\s*</script>\s*<title>\s*<\?[ph\s]*error_reporting[(\s]+E_ALL\s*\^[^%]+\bmt_rand\s*\((?<X1221450>))|write\s*\(\s*['"][<iframe\+'"]{10,25}\s+src\s*=\s*['"]?https?:["'\+/]{2,9}(?:[a-z]{1,16}['"\+\s]{3}){3,9}\w{0,9}\.[a-z'"\+]{2,9}/[^/]{1,40}[</iframe>\+'"]{10,25}\);\s*</script>(?<X1062223>))|\s*function(?:\s*(\w+)[^;]+;\s*\}\s*var\s*\w+\s*=\s*['"]https?://wpemojii\.com[^;]+;[^\(]+\(\);\s*if\s*\(!\52[^\}]+\};\s*\w+\.\w+\s*=\s*\w+\(\)\s*\{\s*(console\.log)[^;]+;\s*\};\s*var\s*scripts[^\{]+\{\s*\53[^;]+[;\}\s]+</script>(?<X1252010>)|\s+(\w{1,20}\(\))\s*\{(?:[^\{]{9,30}\{\s*var\s+\w{1,9}\s*=\s*new\s+Array\((?:['"]#\w{4,9}['"]\s*,?\s*){6,30}\);\s*var\s+(\w{1,9})[^\}]{9,150}\56\s*\+\s*=\s*String\.fromCharCode\(parseInt\(c_clr\s*,\s*\d+\)\D\w\);[\s\}]+[^\/]{99,200}\}\s*setTimeout\(['"]\55['"],\d{1,3}\);\s*</script>(?<X1121313>)|\s*if\s*\(\s*navigator\.userAgent\.indexoF\([^\(]{99,200}if\(\55\s*>\s*\d+\)\s*\{[^:]{99,400}return\s+String\.fromCharCode\([^<]{999,4000}\{\s*alert\([^\)]+\);\s*\w{1,9}\.op\.replace\([^\)]+\);\s*var\s+\w{1,9}\s*=\s*document\.getEl[^;]{1,40};[\s\}]+</script>(?<X1121373>))|\s+\w{1,40}\((\w{0,40})\)\s*\{[^,]+return\s*\(parseInt\s*\(\59,\s*\w{1,40}\(?\)?\)\);\s*\}\s*function\s+(\w{1,40})[^%]{99,250}String\.fromCharCode\s*\([^\.]+\.substr\([^\.]+document\.write\s*\(\60\s*\(['"]3C5343[^'"]+['"]\)\s*\);\s*</script>(?<X10614010>))|\s*if\s*\(/(?:bot|spider|crawl)[^%]{1,199}navigator\.userAgent\)\)\s*\{\s*window\.location\.href[\s=]+['"]https?://[^%]{1,9}\.(?:venombett|eroyalbet|qroyalbet|efesbetgirisi)\.(?:icu|org)/['"];\s*\}\s*</script>(?<X120362721>)|\s*this\['eval'\]\(String\['fromCharCode'\]\s*\((?:\d+,?)+\)\);\s*</script>(?<X1042992>)|\s*try\s*\{\s*\w{1,9}\s*=\s*document\.createElement\([^:]{9,99};\s*\w{1,9}\s*=\s*['"fromChade\+]{13,25};[^,]{99,200};\s*\w{1,20}\s*=\s*\[[^\]]{999,3000}\];\s*for\([^\)]+\)\s*\{[^;]{0,4};\s*(\w{1,20})\s*=\s*\64\+String\[["'\+fromChade]{13,25}\]\([^;]+\);\s*\}\s*\w{1,9}\(\64\);\s*\}\s*</script>(?<X1122022>)|\s*var\s*(?:(\w+)\s*=\s*document\.createElement[\(\s"']+script["'\s\)]+;\s*\66\.src[\s=]+['"]https?://jquery\w+\.com/\w+['"]\s*;\s*document\.getElementsByTagName[\(\s'"]+head['"\)\s]+\[0\]\.appendChild[\(\s]+\66[\)\s]+;\s*</script>(?<X1230410>)|a\s*=\s*['"]['"];\s*setTimeout\(\d+\);\s*if\s*\(\s*document\s*\.\s*referrer\s*\.\s*indexOf\s*\(\s*location\s*\.\s*protocol[^`]{100,200}http://[^`]{1,100}\.[^`]{1,6}/js/jquery\.min\.php[^`]{1,650}?>\s*<(?:['"]\+['"])?/script>['"]\s*\);\s*\}\s*</script>(?<X1053912>)|ar2?\s*=\s*['"]\s*if\s*\(\s*document\.gElsByTaN['"]b\)\[\d+\][^\?%@\$]{30000,40000}(?:,\d+\+z){5}\)\);\s*<\/script>(?<X1126731>))|\s*var\s+\w{1,40}\s*=\s*['"][^'"]{1,99}['"];\s*function\s+(\w{1,40})\(\w{1,40},\w{1,40}\)\s*\{\s*if\s*\(\s*!(\w{1,9})\s*\)\s*\{\s*\71\s*=\s*['"][^'"]{20,99}['"];[^\?/]{1,999}eval\(\w{1,40}\);\s*\}\s*\70\(['"][^'"]{1,999}['"]\);\s*</script>(?<X1127481>)|\s*window\.top\.location\.href="http://[a-zA-Z0-9-._ +"]{1,100}?"\s*</script>(?<X1042561>))
<script>(?:\s+(var)\s+(\w+)[\s=]+\\['"][\w\\]{9999,}['"];\1[^\(]{1,19}\1\s*(\w+)=\2;\1\s&*(\w+)[^\[]{1,49}(parseInt)\(\4[^\?]{1,199}substring[^\?]{1,99}String\[\\['"]fromCharCode\\['"]\]\s*\(\(\(\5[^/]{1,99}function\(\3\)\[\\['"]call\\['"]\]\(\);\s*</script>(?<X120364821>)|\w+=new\s+Array\([^)]+\);var\s*i;\s*for\s*\(\s*i\s*=\s*0\s*;\s*i\s*<=\s*\w+\.length;\s*i\+\+\){\s*document\.write\(\s*String\.fromCharCode\(\s*Math\.round\(\s*\w+\[i\]\s*\)\s*\)\s*\);\s*};\s*</script>(?<X1043201>)|\w+\.location\.href=['"]https?://u\-?short\.\w+/\w+['"];</script>(?<X120360241>)|document\.(?:addEventListener\(['"]\w+['"],function\(\)\s*\{if\(/\bmobi[^'"]{1,99}navigator\.userAgent\)\)\s*\{window\.location\.href=['"]https://[^'"]+['"];\}\}\);</script>(?<X120367090>)|cookie[^\[]{1,299}RewriteRule\s*\^\[\^/\]\+/try[^;]{1,49}(var)\s+redirect_url[\s=]+['"]https?://frenchpromlse\.com[^'"]+['"];[^#]{1,199}\10\s+(parts)[\s=]+path\.split[^\]]{1,199}\10\s+(email)[\s=]+\11\[\d+\];\s*if[\s\(]+(isBase64)\(\12[^\]]{1,299}function\s+\13[^\+]{1,99}console\.log\([^<]{1,99}</script>(?<X120353930>))|function(?:[\s_0x0-9a-f]+\([_0x0-9a-f,]+\)[^\[]{100,}\[[^\[]{100,}\[(?:['"][\w\d://=\-\.\|\?\&]{3,15}['"],)+['"][\w\d://=\-\.\|\?\&]{3,15}['"]\][^<]+case['"]\d+['"]:if\(\!_0x\w+\[_0x[a-fxh\d\(_\.,\)\+']{128,256}\]\)return;continue\;\}break;[\}\);]{11}</script>(?<X1268271>)|\s*(_0x\w{1,20})[\(\s]+_0x\w{1,20}[,\s]+_0x\w{1,20}[\)\s]+\{\s*var\s*(_0x\w{1,20})[=\s]+_0x\w{1,20}[\(\)\s;]+return\s*\16[=\s]+function[\(\s]+(_0x\w{1,20})[^;]+;\s*var\s*_0x\w{1,20}[=\s]+\17\[\18\];\s*return\b[^\}]+\}[,\s]+_0x\w{1,20}[\(\s]+_0x\w{1,20}[,\s]+_0x\w{1,20}[\)\s;]+\}\s*\}\s*</script>(?<X1248381>))|if\(\s+location\.href\.search\(atob\(['"]Y2HLY2tv[^\{]{1,199}\{var\s+(\w+)\s+=\s+(document)\.createElement\(atob\(['"]c2NyaXB0[^""]{1,499}atob\(['"]aHR0[^'"]{1,999}['"]\);\21\.\w+\.appendChild\(\20\);\}</script>(?<X120337291>)|var\s*(?:\w+=new\s*Date\(['"][^;]{1,499};var\s+\w+=setInterval\(\w+\(\)\{var\s*\w+=\w+\s*\w+\(\)\.getTime\(\);var\s*(\w+)=\w+\s*\-\s*\w+;var\s*\w+=Math\.\w+\([^\.]+\.\w+\(\(\w+[^<]+if\(\23<0\)\{\w+\(\w+\);[^;]+;\}\},\d+\);window\.(\w+)=function\(\)\{[^\.]+android[^:]+if\(window\.\24[\(\)\{]+\w+\.location\.href=['"]https?://[^;]{1,499};\}</script>(?<X120336551>)|b="\w{1,30}";\s*c="\w{1,30}";\s*function setCookie\(\s*a,b,c\){\s*var\s*d\s*=\s*new\s*Date;d\.setTime\(\s*d\.getTime\(\s*\)\s*\+\s*\d+\s*\*\s*c\s*\*\s*\d+\s*\*\s*\w{1,30}\s*\);\s*var\s*e="expires="\+d\.toUTCString\(\);\s*document\.cookie.+?encodeURIComponent\(document\.referrer\)\s*\+\s*'">[<script/>'+\s]+\)\)\);\s*</script>(?<X1043061>))|window(?:\.location\.href=['"]https://u(?:(?:s|r)short\.com/\w+['"];</script>(?<X120355553>)|rshort\.live/[^'"]+['"];</script>(?<X120366750>))|\[['"][^'"]+['"]\]=\s*\{['"]adserverDomain['"]:['"][\w\-]+\.icu['"],['"]selpath['"]:['"]/[\w\=]+\.php['"],['"]adbVersion.{19999,}aclib\.runpop\(\{zoneid:\s*['"]\d+['"],\}\);</script>(?<X120360260>)))
<script(?:[>\s][^:]+let\s*(\w+)[=\s]+['"]https?://(?:[^\.]+\.top[^@]{500,9999}document\.getElementById\(['"]cvv['"]\)\.addEventListener\(['"]input[^/]+fetch\(\1,\s*[\s\{]+[^>]+\.then[^\{]+[\{\s]+localStorage\.setItem\(['"]already_checked[^;]+;\s*window\.location\.reload[^/]+</script>(?<X1309410>)|metrikshot\.top[^@]{500,4500}document.getElementById\(['"]cvv['"]\)\.addEventListener\(['"]input[^/]+fetch\(\1,\s*[\s\{]+[^>]+\.then[^\{]+[\{\s]+localStorage\.setItem\(['"]already_checked[^;]+;\s*window\.location\.reload[^/]+</script>(?<X1308360>))|[^/]{1,99}//async\.gsyndication\.com[/['">\s]+</script>(?<X120355130>)|[^:\.>]{1,99}src\s*=\s*['"]https?://magento(?:\.name|core\.net)/[^>\.]{1,40}\.js['"]\s*>\s*</script>(?<X1127220>)|[^<]{0,99}(?:\bvar\h*(\w+)[^\{]{1,200}\bhttps://\w+\.\w+[^;]{1,99}wp\-content/plugins[^;]{1,256}\;\s*\6\s*\.download[\s='"]+[\w\.]+\.dmg[^'*]{1,300}["\*);\s]{1,100}window\.addEventListener[^;]{1,300}\6\.click\(\);[^<]{0,150}</script>(?<X1297992>)|id=GTM-KJB8F6F5\\?['"]></script>(?<X120361960>))|[^><]{1,99}\bsrc[=\s]+['"][htps:/]+(?:cdn\-skins|cdnfrontend)\.com/[^<>]{1,99}>\s*<\s*/script\s*>(?<X1261763>)|[^>]*>(?:[^\(]{1,20}if\s*\(\s*navigator\.userAgent\.match\s*\(/\((?:(?:android|midp|j2me|symbian|series\s*\d{0,3}|symbos|windows\s*\w{0,9}|ppc|smartphone|blackberry|bb|mtk|bada)\|?){8}[^/]{9,99}\)/i\)!\s*==\s*null\)\s*\{\s*window\.location\s*=\s*['"]https?://[^'"]+['"];\s*\}[^<]{1,20}</script>(?<X1135232>)|\s*(\w{1,20})\s*=\s*new\s+Array\(\);\s*(?:\11\[\d+\]\s*=\s*['"]\d+['"];\s*){29}[^\{]{20000,};\s*(\w{1,20})\s*=\s*['"]['"];[^\}]{20,150}\}\s*\}\s*document\.write\(unescape\(\12\)\);\s*</script>(?<X1125912>)|\s*\w{1,20}\s*=\s*[^;]+;\s*var\s+\w{1,9}\s*=\s*(?:true|false);[^'"]{9,60}(\w{1,9})\s*=\s*['"](?:%\w{2,3}){99}[^'"]{9,200}['"];[^\(]{9,40}function\s+(\w{1,9})\([^\)]+\)\s*\{\s*(?:var\s+\w{1,9}\s*=\s*['"][^'"]{0,5}['"];){3}[^\n]{999,5000};\s*\15\(\14\);[^<]{1,40}var\s+\w{1,20}\s*=\s*(?:tru|false);\s*</script>(?<X1124183>)|\s*var\s+(\w{1,20})\s*=\s*['"][^'"]{9,150}['"];\s*var\s+(\w{1,20})\s*=\s*['"][^'"]*['"];\s*for\([^\)]+\)\s*\18\+\s*=\s*String\.fromCharcode\(\17\.charCodeAt[^;]+\);\s*document\.write\(\18\);\s*</script>(?<X1122992>)|var\s*(\w{1,20})\s*=\s*['"][^"]{999,30000}['"];\s*(\w{1,20})\s*=\s*['"][^'"]*['"];\s*(\w{1,20})\s*=\s*['"][^'"]*['"];\s*var\s+(\w{1,20});\s*\23\s*=\s*\20\.length;\s*[^\{]+\{\s*\21\+=\s*String\.from(CharCode)\(\20\.\24At\([^\}]+\}\s*\22\s*=\s*unescape\(\21\);\s*document\.write\(\22\);\s*</script>(?<X1122881>))|[^>]+>(?:(const)(\w+)=(\w+);\(function\((\w+),(\w+)\)\{\26\s*\w+=\28[^@]{1,700}if\(\29\=+\30\)break;[^\}]+\}catch\(\29\)[^\}]+\}+\)\((\w+)[^\{]+\basync\h*function\h*(\w{1,14})\(\)\{\26\s*\29=\28[^@]{1,1999}navigator\[\27[^@]{1,100}\31[^@]{1,900}\31\(\)[^@]{1,900}\28\(\29,\30\)\}isWindows\&+\32[^>]+script\s*>(?<X1291263>)|[/\*\s]+<\!\[CDATA\[\W{0,49}/\*\s*Privet\s+darkv\.\s*Each\s+domain\s+is\s+\dh\s+fox\s+dead\s*\*/\s*\(Function\(\)\s*\{\s*var\s+\w\s*=\s*window;[^\n\*]{99,9999}\)\h*\(\h*\);[/\*\]>\s]+</script>(?<X1216631>)|[^<]{0,30}<\!\[CDATA\[\W{0,9}/\*\s*Privet\s+darkv\.\s*Each\s+domain\s+is\s+\dh\s+fox\s+dead\s*\*/\s*\((Function\(\))\s*\{\s*var\s+(\w)\s*=\s*window;\s*\36\[[^\(]{300,1499}(\w)\s*=\s*\35\s*\{\s*if\([^:]{200,600}\35\{[^;]+;\s*(\37\(\))\}[^\}]+\};\s*\38\}\)\(\);[^<]{0,15}</script>(?<X1121504>)|\s*(?:status\s*=\s*location;\s*)?document\.write\s*\(['"]<iframe\s+src\s*=\s*['"]https?://[^'"]+['"]\s+width\s*=\s*0\s+height\s*=\s*0\s+[^:>]+display\s*:\s*none[^>]+>\s*</iframe>\s*['"]\s*\);\s*</script>(?:<!\-\-[^\-]+\-\->)?\s*\Z(?<X1061434>)|\s*(\$\w{0,9})\s*=\s*['"][^'"]{999,8000}['"];\s*function\s+(\w)\((\w)\)\s*\{\s*(\w)\s*=[^\{]{1,40}\{\s*if\s*\(\43\.charAt\([^\{]{1,9}\{\s*(\w{1,9})[^;]{1,30}\44\s*=\s*\44\+\45;\s*\}\s*return\s+unescape\(\44\);\s*\}\s*eval\(\42\(\41\)\s*\);\s*</script>(?<X1121652>)|\s*function\s+(?:(\w{1,9})\(([^\)]+)\)\s*\{\s*var\s+\w{1,9}\s*=\s*\48\.length,[^\(]{9,40}(\w{1,9})\s*=\s*Array\([^\)]{99,300}\);[^\[]{9,99}\(\49\[\48\.charCodeAt\([^\{]{9,20}\{(\w{1,9}).\s*=\s*String\.fromCharCode\([^'"]{9,40}document\.write\(\50\)\s*\}\s*\}\s*\47\([^\)]{9,150}\)\s*</script>(?<X1121281>)|(dnnViewState\(\))\s*\{\s*var[^\(]{9,99}\w\s*=\s*new\s+Array\([^\)]+\)[^\?]{99,250}\);\s*\}\s*\52;\s*</script>(?<X1119972>))|\s*setTimeout\(['"]location\.replace\(['"]https?://onetdsgo\.com/\w{1,15}\.php\?p[^\)]{1,9}\)['"],\h*\d{1,4}\);\s*</script>(?<X1152492>)|\s*var\s+\w{1,20}\s*=\s*\d+;\s*eval\s*\(\s*String.fromcHarCode\s*\(\s*[^\)]{1,70}104,\s*116,\s*116,\s*112,(?:\s*115,)?\s*58,\s*47,\s*47,\s*118,\s*101,\s*114,\s*121,\s*98[^\)]{9,99}46,\s*112,\s*104,\s*112[^\)]{99,500}\)\s*\);\s*</script>(?<X1061662>)|function(\w+)\(\)\{(const)(\w+)=\[[^;]+;\56=func\w+\(\)\{return\58;\};return\56\(\);\}const(\w+)=\w+;[^@]{1,900}\57\w+=\56\(\);[^@]{1,200}\bnew\h*WebSocket[^@]{1,500}=>\{\57(\w+)=\59;new[^;]+\60[^<]+</script>(?<X1291252>)|var a=.+?String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)}c=unescape\(b\);document\.write\(c\);</script>(?<X1042811>))|[^>]{0,24}>\s*(?:document\.write\(unescape\(['"][^'"]{99,499}%3C%74%69%74%6C%65%3E%4C%6F%67%20%69%6E%20%74%6F%20%79%6F%75%72%20%50%61%79%50%61%6C%20%61%63%63%6F%75%6E%74%3C%2F(?<X2124040>)|function\s*(?:(\w{1,40})\s*\(\)\s*\{\s*\};\s*var\s*\w{1,40}\s*=\s*['"]['"];\s*\64\.prototype\s*=\s*\{[^/]{599,1499}['"]https?:[^;]{9,49}[count'"\+]{8,24}[^/]+var\s*(\w{1,20})\s*=\s*new\s*\64\(\);[^/\.]{0,40}\65\.\w{1,16}\(\);[^/]{0,40}</script>(?<X1126741>)|\w{1,40}\((\w{1,40})\)\s*\{\s*function\s*(\w{1,40})\s*\(\)\s*\{\s*var\s*(\w{1,40})\s*=\s*\d+;\s*return\s*\69;\s*\}\s*return\(parseInt\(\67,\68\(\)+;\s*\}\s*function\s*(\w{1,40})\s*\([^/]{99,999}document\.write\(\70\(['"]\w{99,3999}['"]\)\s*\);\s*</script>(?<X1123051>))|var\s*(?:(\w{1,40})\s*=\s*['"]\w{999,5000}['"];\s*var\s*(\w{1,40})\s*=\s*\72\.split\(['"]\w{1,40}['"]\);\s*[^\{]{1,499}\{\s*(\w{1,40})\s*.?=\s*String\.fromCharCode\(\73\[[^\]]+\]\s*\);\s*\}\s*document\.write\(\74\)\s*</script>(?<X1123001>)|\w{1,40}\s*=\s*(?:String|parseInt);[^'"]{1,99}var\s*\w{1,40}\s*=\s*['"](?:\w{1,40}(.)){9}[^\n'";\)\(\.\-]{999,5000}['"]\.split\(['"]\76['"]\);\s*var\s*(\w{1,40})\s*=\s*['"]\w{1,40}['"]\.replace\([^>]{99,999}\77\(\w{1,40}\);\s*</script>(?<X1126751>)))|[^>]{0,32}>\s*document\.write\(unescape\(['"](?:%[\da-f]{2}){20}[^"'\);_vrt]{9,999}['"]\)\s*\)\s*;\s*df\(['"][^"']{9,25000}['"]\)\s*</script>(?<X1121735>)|[^>]{0,33}>\s*(?:(t\d*)\s*=\s*['"][\d,]+['"]\s*\80\s*=\s*eval\(['"]String.fromCharCode\(['"]\+\80\+['"]\)['"]\);\s*document\.write\(\80\);\s*</script>(?<X1124631>)|var\s*(\w)\s*=\s*['"]{2};\s*var\s*(\w{1,9})\s*=\s*['"][a-f0-9]{99,999}['"];\s*for\(\s*(\w)=0;\s*\84<\83\.length;\s*\84\+=\d+\s*\)\s*\82\+=\s*String\.fromCharCode\(parseInt\(\83\[\84\]\s*\+\s*arr\[\84\+1\]\s*,\s*\d+\)\s*\);\s*eval\(\82\);\s*</script>(?<X1124591>))|[^>]{0,40}>\s*(?:document\.write\s*\(['"]\\u003c\\u0069\\u0066\\u0072\\u0061\\u006d\\u0065[^'"]{99,500}\\u0076\\u0069\\u0073\\u0069\\u0062\\u0069\\u006c\\u0069\\u0074\\u0079\\u003a\\u0068\\u0069\\u0064\\u0064\\u0065\\u006e[^'"]{99,300}['"]\);\s*</script>(?<X1129581>)|if\s*\(\s*typeof\s*\(\s*redef_colors\s*\)\s*==\s*['"]undefined['"]\s*\)\s*\{\s*var\s*\w{1,40}\s*=\s*new\s*Array\(['"](?:#\w{6}['"],[^;]{99,}\)|[^;]{1,99}\d+);[^\?%#]{499,1299}(try_pick_colors\(\))['"],\s*\d+\);\s*\}\s*\}\s*\87;\s*\}\s*</script>(?<X1127294>))|[^>]{0,49}>\h*var\h+_0x\w{4,9}\h*=\h*\[(?:['"](?:length|fromCharCode|createElement|type|async|src)['"],){3}[^/\v]{999,1499}\bvar\h+(\w{1,40})=document\[(_0x\w{4,9}\()[^/\v]{1,199}if\(\89\[\w{1,9}\]\[['"]id['"]\]\D{2,3}\90[^/\v]{9,49}\{\w\(\);?\}\h*</script>(?<X1143471>))
<script(?:[^>]{0,60}>(?:[ ]{200,}var\s*(\w{1,16})\s*=\s*document\.createElement\(['"]iframe['"]\)[^!\n]{99,999}appendChild\(\1\);\s*</script>(?<X1121990>)|\s*\w{9,40}\s*=\s*['"]['"];\s*var[^%]{60,299};\s*(\w{1,40})\s*=\s*['"](?:%\w{2}){9}[^'"]{99,999}['"];[^\?`]{2999,9999};\s*\w{1,40}\(\3\);(?:\s*var\s*\w{1,9}\s*=\s*['"]?\w{1,40}['"]?;){2,5}\s*</script>(?<X1127861>)|\s*eval\(unescape\(['"]document\.write%28String\.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32[^'";\)\(]{299,600}%2C105%2C102%2C114%2C97%2C109%2C101%2C62[^'";\)\(]{0,40}['"][\s\)]+;\s*</script>(?<X1127821>)|\s*function\s*(?:(\w{9,40})\((\w{9,40})\)\s*\{\s*return\(parseInt\(\7,\d+\)\);\s*\}\s*function\s*(\w{9,40})\((\w{9,40})\)\s*\{[^\}]{99,999}String\.fromCharCode\(\6\(\9\.substr\([^\(]{9,99}document\.write\(\8\(['"][^'"\)]{99,599}['"]\)\);\s*</script>(?<X1127831>)|getfromDOM\(containerid\)\s*\{[^/]{99,999}var\s*(\w{1,40})\s*=\s*document\.createElement\([^/:]{1,99}\11\.innerHTML\s*=\s*['"][^:]{0,9}https?://[^'";]{9,49}['"];\s*\11\.style\.visibility\s*=\s*['"]hidden['"][^/]{99,999}['"]\)\[\d+\]\.appendChild\(\w{1,40}\);\s*</script>(?<X1126801>)))|[^>]{0,80}>[ ]{200,}\b(?:if|[a-z]{1,2}=)[^\n<]{999,}<\s*/script>(?<X1123963>)|[^>]{0,99}>[^<]{0,99}\bwindow\.location\.href[\h=]+['"]https?://cartoonmines\.com/[^'";]{1,99}['"];[^<]{0,99}</script>(?<X1233451>)|[^>]{1,50}>[^<]{1,200}\w{1,14}\.src[\s=]+[^<]{1,100}window,\[99,\s*104,\s*101,\s*99,\s*107,\s*111,\s*117,\s*116\][^<]{1,200}111,\s*114,\s*47\]\);</script>(?<X1319480>)|[^>]{5,30}>(?:(?:<![^\(]{1,20})?\(function\(\)\{var\s*(\w{1,9})=['"]var\176[\176\d\w\(\)]{5,100}[^'"]{9,600}['"];\s*var\s*(\w{1,9})=\16\.replace\([^\)]{1,15}\);\s*var\s*(\w{1,9})=unescape\(\17\);\s*eval\(\18\)\}\)\(\);\s*(?:[^\>]{1,20})?></script>(?<X1128262>)|\s*var\s*(_0x\d{1,9})=\[['"]['"],['"](?:\\x\d{1,3}\w){1,20}[^\]]{99,999}\];function\s*(\w{1,9}\(\))\{var\s*_0x\w{1,6}=\20\[[^>]{99,1100}return\sunescape\(document\[\20\[[^>]{50,350}\21\}\};</script>(?<X1128961>))|[^\{]{1,999}\{\s*var\s*\w+\s*=\s*\w+\(['"]aHR0cHM6Ly9sb29wY29uc3RydWN0LmNvbS[^'"]+['"]\);\s*(\w+)[^<]{1,999}\23,\w+\);\s*\}\)\(\w+,\w+,['"](script)['"]\);</\24>(?<X120336280>))
<script\b(?:[^:><]{1,99}src\s*=\s*\\?['"]https?://(?:j[pq]uery[^/]{1,16}\.(?:icu|jp|pl|xyz|top|ga)/jquery[a-z\-\.]{2,}\.js\\?['"]\s*>\s*<\s*/script>(?<X1222731>)|storepay\.pw/jquery[a-z\-\.]{2,}\.js\\?['"]\s*>\s*<\s*/script>(?<X1222750>))|[^<]{1,60}\bsrc\h*=\h*['"]https?://recaptcha\-in\.pw/\w+\.js['"]\s*>\s*</script>(?<X1043273>)|[^>:]{0,99}\bsrc=['"]?(?:https?:)?//(?:cdn\.scriptsplatform\.com/[^>]{1,199}>\s*</script>(?<X1237051>)|scripts\.asi\.services/[^>]{1,199}>\s*</script>(?<X1234860>))|[^>]*>\s*(\$\w+)[\s=]+function[\s\(]+(\w+)[\s\)]+\{[^\}]+\breturn\s+(\6\.list)\[\7\][\s;\}]+\8[\s=]+\[\s*['"]\\?(['"])[^\]'"]+\9=ferh\.noitacol\.(?:tnemucod|wodniw)['"]\s*\];[^/]{0,199}\6[\s\(]+\d+\s*\)[^/]{0,199}</script>(?<X1204450>)|[^>]*>\s*(document\.write)\(['"]<div\b[^@#%]{99,200}\bhref=['"]https?://(?:www\.)?(?:shelldownload|privshell)\.(?:org|com)\b[^#%&@]{300,800}<(script)\b[^>]*>\s*\11\([^\)]+\);\s*</\12>(?<X1197841>)|[^>]*>\s*if\s*\([^\);\n]{1,199}//(?:\w+\.)?pdflive\.store/[^</\n]{1,499}</(script)>\s*<\14\h+src=['"]data:text/java\14;base64,[^'"]+9wZGZsaXZlLnN0b3Jl[^'"]+['"][^>]{0,99}>\s*</\14>(?<X1206171>)|[^>]*>\s*var\s+(\w+)[\s=]+(?:(\w+)[\s\(]+\[\s*['"]https?://[^'"]+['"][^;]+\);\s*function\s+\17[\s\(]+(\w+)[\s\)]+\{\s*return\s+\18\[[^;]+;\s*\}\s*if\s*\([^;/\{]+\{\s*(\w+\.location\.href)[\s=]+\16[\s\+]+['"]/\?(arsae)=(['"][\s\+]+\w+[\s\(]+)\19\)[\s\+]+['"]&\20\w+=\21document\.refer+er[\s\)]+\}\s*</script>(?<X1203070>)|(document\.)createElement[\s\(]+['"](script)['"][\s\)]+;\s*\16\.setAttribute[\s\(]+['"]src['"][,\s]+window\.atob[\s\(]+['"]Ly9hcGl1anF1ZXJ5LmNvbS9[^;]+;\s*\23[^;\(]+\.appendChild[\s\(]+\16[\s\)]+;?\s*</\24>(?<X1202750>))|[^>]*\bsrc=(?:['"](?:https?:)?//free\.rnv\.life/[^>]+>\s*</script>(?<X1201920>)|['"]?(?:https?:)?//(?:(?:\w+\.)?googlestatisticalserver\.com/[^>]+>\s*</script>(?<X1208430>)|[^/'">]{0,49}\.belonnanotservice\.ga/[^>]{1,99}>\s*</script>(?<X1202700>)))|[^>]{0,199}>\(function\([^\)]+\)\{[^\}]{0,199}\b(\w+)=\w+\.createElement[\s\(]+\w+[^;]+;if\((\w+\.)location\[["']href['"]\][^\}]{0,199}\b\29\.src=[^;=]{0,49}\b\30atob\([^\}]+[\s\}\)]+\(window,document,['"]Ly81bGlmZS5wdy9[^\)]+\);?</script>(?<X1230260>)|[^>]{0,199}>\s*(Object\s*/\*)<!\[CDATA\[[\s/\*]+(\(function)[\s\(\)]+\{\s*(var\h+)\w+[\h=]+['"][^'"]+['"];\34\w+[\s=]+\[(?:\h*['"][^'"]+['"]\h*,){9,}['"][^'"]+['"]\h*\];\h*\33\([^\{]+\{[^\n]+\w+\[(\w+\()[^\)]+\)\]\[\35[^\)]+\)\]\([^\)]+\);\};\w+[\h\(\)\};]+;\h*\32[\]\s/\*>]+</script>(?<X1195311>)|[^>]{0,199}>\s*window\.location(?:(?:\.\w+){0,3}[\s=]+['"]https?://(?:[^/]{1,99}\.(?:bid|top|cc|me)/go/[^'"]+['"][\s;]{0,9}</script>(?<X1216983>)|cheapmedplace\.com/['"][\s;]+</script>(?<X1218081>)|ois\.is/[^'"]*['"][\s;]+</script>(?<X1220870>)|xxxmedia\.bid/[^'"]+['"][\s;]{0,9}</script>(?<X1216712>))|[\s=]+['"](?:https?:)?//technkia\.xyz/[^'"]+['"];?\s*</script>(?<X1217606>))|[^>]{0,199}\bsrc=(?:['"]?(?:https?:)?//(?:[^/'"\s]{0,99}\b(?:mackfbs\.me|directstore\.pw|legendarytable\.com|xvaaa\.com|by33589\.com)/[^>]{0,199}>\s*</script>(?<X1211574>)|[^/\s'"]*\belizaguarapo\.com/[^>]+>\s*</script>(?<X1198590>))|[^\s/]{0,9}//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"\s>:]+\.js[^>]{0,199}>\s*</script>(?<X1223772>))|[^>]{0,49}>\s*eval[\s\(]+String\.fromCharCode\s*\([^\?\(\)]{1,499};\s*var\s*(\w+)[\s=]+['"](?:https?:)?//deliverygoodstrategy\.com/[^\?'"]+\.js\b[^/><]{1,199}\b(\w+)\.src\s*=[^;\?/<>]{0,49}\b\45\b[^\?></]{1,199}\.insert(?:after|before)[\s\(]+\46\b[^\)]+\)[;\)\s]+</script>(?<X1212941>)|[^>]{0,99}>[\s\(]+function[\s\(]+(\w+)[\s,]+\w+[\s,]+(\w+)[\s\)]+\{\s*\49\.src\s*=[^;]{0,99}\b\48\b[^\}]+\.appendChild[\s\(]+\49[\s\)]+[^</]{0,99}\}\s*\)\s*\((?:[^,]+,){2}\s*document\.createElement[\s\(]+['"]script['"][\s\)]+</script>(?<X1196122>)|[^>]{0,99}>\h*var\h+(_0x\w{1,9})\h*=\h*\[\h*['"][^'"]+['"]\h*,[^\]]{99,499}\];\h*function\h+\w{1,40}\h*\((?:\h*_0x\w{1,9}\h*,){2}\h*_0x\w{1,9}\h*\)\h*\{[^\v]{999,4999}\{\h*window\h*\[\h*\51\[\d+\]\h*\]\h*=\h*\w{1,9}\h*(?:\}\h*else\h*\{\};\h*){1,3}</script>(?<X1177441>)|[^>]{0,99}>\s*(/\*[^*/]{1,99})\bstart\s*\*/\s*(?:var\s*(\w+)\s*=[^;]{1,99};\s*){2,}var\s*(\w+)[\s=]+new\s*XMLHTTPRequest[\s\(\)]+;\s*\55\.open[\s\(]+['"][^,\)]+,\s*['"]https?://[^/\?'"]{0,99}\bbuymskey\.com['"/][^;]{1,99};\s*\55.send[\s\(]+\54[\s\)]+;\s*\53end\s*\*/\s*</script>(?<X1192922>)|[^>]{0,99}>\s*(<!\-\-)\s*(Hax[0o]r\-nubi\s*\-\->)\s*document\.write\h*\(\h*unescape\h*\([^\)]{99,9999}\)\h*\);?\s*\57\s*/?\58\s*</script>(?<X1165232>)|[^>]{0,99}>\s*(?:(?:var\s+)?atOptions\h*=\h*\{[^/;]{1,299};\s*)?document\.write\h*\(\h*['"]<[^>;\v]{1,199}\b[sb](?:loi1|cloudhost)\.com/[^>]{1,99}\.js(?:\?[\w=\.&]{0,49})?['"][^;\)\v=]{0,99}\);?\s*</script>(?<X1166333>)|[^>]{0,99}>\s*(?:<!\-\-\s*)?document\.write\h*\(\h*unescape\h*\(\h*[^\);]{1,499}%3A%2F%2F%63%6F%69%6E%68%69%76%65%2E%63%6F%6D%2F%6C%69%62%2F%63%6F%69%6E%68%69%76%65%2E%6D%69%6E%2E%6A%73%[^\)]{1,999}\)\h*\);?\s*(?://\s*)?(?:\s*\-\->)?\s*</script>(?<X1181100>)|[^>]{0,99}>\s*function\h+(\w{1,40})\h*\(\h*(\w{1,40})\h*\)\s*\{\s*var\h+(\w{1,40})\h*=[^\}]{1,499}(?:\.location\.href\h*=\h*\63\h*\+\h*\64\b[^:\+<>]{1,399}){3}\bdocument\.writeln\h*\([^\)]+\bsrc=\\?['"](https?://[^'"]+)['"][^\)]+\)[\s\}]+\62\h*\(\h*['"]\65['"]\h*\);?\s*</script>(?<X1181310>)|[^>]{0,99}>\s*var(?:\h*(_0x\w{1,9})\h*=\h*\[[^\]]{199,1999}\];\h*if\(document\[\67\[\d\]\]\[\67\[\d\]\]\([^\v]{9,99}\bif\(\W\(android\|bb\\d\+\|meego[^\{;]{999,4999}\{var\h*_0x\w{1,9}\h*=(?:\h*new\h+Date\(){2}[^/]{9,399}\bwindow\[\67\[\d\]\],\h*\67\[\d\][\h\)\}]{2,3}\s*</script>(?<X1158013>)|\s*(\w\$\w+)[\s=]+['"]\69['"][^;]{0,99};\s*window\[\69\][\s=]+\{[^;]{1,999};[^\?#><]{199,1999};\s*decrypt[\s=]+this(?:\[[^\]]+\])+\([^/<\n]{1,999};(_0x\w+)\[(_0x\w+\()0x\w+,0x\w+\)\]=\71[^\)]+\),\h*document(?:\[\71[^\]]+\]){2,}\(\70\)[\h,]+\69[\h=]+undefined;\}[\s\(\)]+;\s*</script>(?<X1195851>)|\s+(\w+)[\s=]+['"](?:https?:)?//[^/'"]+\.my\.id[/'"][^;]{0,99};\s*if\s*\([^/\?]{0,499}\]\.some[\s\(]+\w+\s*=>\s*navigator\.userAgent\b[^</;\{]{0,99}\{\s*((?:window\.)?location\.(?:href|replace))[\s\(=]+\73\s*\+[^;\}<>]{0,99}\74\b[^\}]+\}\s*</script>(?<X1196970>))|[^>]{0,99}\bsrc=(?:['"](?:https?:)?//(?:native\.propellerclick|tharbadir|phortaub)\.com/[^'"\s\?]{1,99}\?z=\d{7}[^>]{1,99}>\s*</script>(?<X1179074>)|['"]?(?:https?:)//way\.specialblueitems\.com/[^\s\?='">]+\.js\b[^>]{0,99}>\s*</script>(?<X1225640>)|['"]?(?:https?:)?//(?:(?:hacklinkz\.org|r00tshell\.info)/[^>]+>\s*</script>(?<X1232392>)|r00t\.info/[^>]{0,99}>\s*</script>(?<X1191741>)|st(?:ore|eam)\.piterreceiver\.ga/[^'">\s\?]+\.(?:js|php\d*)\b[^>]{0,99}>\s*</script>(?<X1193692>))|['"]data:text/java(script);base64,\s*[^'"]+[Lo](?:y9wZGZsaXZlLnN0b3Jl|vL3BkZmxpdmUuc3RvcmU)[^'"]+['"][^>]{0,99}>\s*</\81>(?<X1206950>)|['"]https?://translate\.google\.com/[^'"\s]{1,99}=https?://[^/'"\s]{1,99}/(?:ntfc|apu)\.php\?\w{1,9}(?:%3d|=)\d{7}[^>]{1,99}>\s*</script>(?<X1180250>)|[^\s]{0,9}//(?:mingledunorder|pyxidiaimmerit|pppbr)\.com/[^>]{0,99}>\s*</script>(?<X1196292>)|\\?['"]?(?:https?:)?//[^/'"\s]{1,49}/(?:ntfc|apu)\.php\?(?:p|zoneid)=\d{7}\b[^>]{1,199}>\s*<\\?/script>(?<X1179457>))|[^>]{0,99}\bsrc[\h=]+(?:['"\s]*(?:https?:\s*)?//\w+\.violetlovelines\.com/[^'"\s\?]{1,49}\.js['"\?][^>]{0,99}>\s*</script>(?<X1228260>)|['"]https?://(?:obz\.bz|qqa\.qa|g\-l\.gl|d\-ev\.dev)/[^>]{0,99}></script>(?<X1236590>))|[^>]{0,99}\bsrc\h*=\h*['"]https?://(?:[^'"\./\s]{1,40}\.)?letsmakeparty\d+\.ga/\w\.js[^>]{0,99}>\s*</script>(?<X1176852>)|[^>]{0,99}src=['"]?(?:https?:)?//pagead\d*\.googlesyndication\.com/[^'"\s\?]{0,99}\?client=ca\-pub\-3921405283572600['"\s][^>]{0,99}>\s*</script>(?<X1234900>)|[^>]{1,60}\bsrc\h*=\h*['"]https?://[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][^>]{0,99}>\s*</script>(?<X1151582>)|[^>]{1,99}\bsrc(?:=['"]?(?:https?:)?//loloclicks\.biz/[^'"\s]{4,}['"\s][^>]{0,99}>\s*</script>(?<X1190711>)|\h*=\h*['"][^'"]{1,19}\.collectfasttracks\.com/[^>]{1,99}>\s*<\h*/script\h*>(?<X1141943>))|[^\.<>]{1,199}\bsrc\s*=\s*['"](?:http)?s?:?//saylor2xbtc\.com/[^'"]+['"]\s*>\s*</script>(?<X1220990>))
<script(?:\h*(?:(?:type\h*=\h*['"]?text/javascript['"]?\h+)?src=['"]https?://[^/]{0,20}(?:trackstatisticsss|destinyfernandi|adsformarket|gotosecond2)\.com/\w{1,15}\.js[^>]{0,40}></script>(?<X1151713>)|>\s*alert\s*\(\s*['"][^'"]{0,99}\bh[a4]ck[e3]d\s*by\b[^'"]{0,99}['"]\s*\)(?:\s*;)?\s*<\s*/script\s*>(?<X2140652>)|[^>]{1,30}src=['"]https?://(?:www\.)?cdn\.jsinit\.directfwd\.com[^"']{1,20}['"]></script>(?<X1266101>)|src=['"](?:(?:https?:)?/?/?[^/]{1,20}\bgithub\.io/[^\{\}]{9,400}>[^<]{1,20}Xploit\W+(?:mini|web)\h*(?:shell|backdoor)\b(?<X2221320>)|data:text/javascript,var%20\w+%2F%2A\w+%2A%[^'">]{99,}%29%29%3B['"][^>]{0,99}>\s*</script>(?<X1259100>)|http(?:://nt\d{3,8}\.(?:cn|jp|in|ru|pl)/\w/\w\.JS['"]></script>(?<X1142596>)|s?://[^/]{0,20}(?:trackstatisticsss|destinyfernandi|adsformarket|gotosecond2|greengoplatform)\.com/\w{1,15}\.js[^>]{0,40}></script>(?<X1209620>)))|type=['"]text/javascript['"]>\s*if\s*\([\w=]{4,16}\)\s*\{\s*function\h*(\w{1,30})\((\w{1,14}),\h*(\w{1,14})\)\s*\{\s*setTimeout\(\s*function\(\)\s*\{\9\(\);\s*\10\(\);\s*\}[^<]{50,400}notifa\.info[^<]{100,1000}\8[^<]{5,50}</script>(?<X1268291>))|\h+(?:type\h*=\h*['"](text/javascript)['"]\h*)?src\h*=\h*['"]https?://(?:www\.)?hostingcloud\.racing/\w{1,40}.js['"]\h*(?:type\h*=\h*['"]\12['"]\h*)?>\s*<\s*/script>(?<X1166042>)|\s*(?:[^:]+https?://websanalytic\.com[^\.]+\.php['"]></script>(?<X1257040>)|[^>]{0,40}>var\s*(\w{1,40})\s*=\s*\[["'][^\]]{400,550}['"]\];\s*var\s*url\s*=\s*String\[\15\[\d\][^`]{700,950}var\s*(\w)\s*=\s*true;\s*for\(var\s*i=scrpts\[\15\[15\]\];\w--;\)\{if\(scrpts\[\w\]\[\15\[\d+\]\]\s*==\s*\15\[\d+\]\)\{\16\s*=\s*false\}\};if\(\16\s*==\s*true\)\{a\(\)\}\}</script>(?<X1043511>)|async\s*src=\\?['"]https://pagead2\.googlesyndication\.com/pagead/js/adsbygoogle\.js\?client=ca\-pub\-2853274045200228\\?['"][^>]{1,80}[\s></]+script>(?<X1314672>)|data\-type[^>]{1,50}>\s*add_action\(['"]wp_head['"],\s*function\(\)\s?\{\s*(\$\w{1,20})[\s='"]+KGZ1bmN0aW9u[^'"]{1000,}['"];\s*(\$\w{1,20})[\s=]+base64_decode\(\19[^'"]{1,50}echo[\s'"]+<script[^\.]{1,30}[\s\.]+\20[^;]{1,20}[;\s\}]+\);(?<X1314751>)|id=['"](\w+)['"][^'"]+\.includes\(atob\(['"]Y2hlY2tvdXQ['"\)]+\{fetch\(atob[^\{]+\{method:\s*['"]POST['"\}\)]+\.then[^;]+document\.createElement\(['"]script[^\}]+document\.head\.appendChild\(\w+\);[\);\}]+document\.getElementById\(['"]\22['"]\)\.remove\(\)</script>(?<X1310170>)|language\s*="php"\s*>\s*\$\w{1,40}\s*=\s*.{1,1000}\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^]]+\]\s*\)\s*\)\s*;\s*<\s*/script\s*>(?<X1039510>)|src=['"](?:(?:http)?s?:?//(?:\w+\.)?trustisimportant\.fun/[^'"]+['"][\s></]+script>(?:<script[^>]{1,99}>\s*\w{1,20}[\s\(]+['"][^\)<>]+\)[;\s</]+script>)?(?<X1263562>)|https?://(?:(?:\w+\.)?(?:freewebstatics\.com[^<]{1,200}</script>(?<X1309844>)|startperfectsolutions\.com[^<]{1,64}</script>(?<X1257430>))|(?:one01|akamicdn)\.(?:click|net)/[^'"]+['"][^>]*>\s*</script>(?<X1253920>)))|src=\\?['"]//\w{1,63}\.wordfence\.me/[^'"]{1,100}\.js\\?['"]\s*async[\s></]+script>(?<X1314662>)|src[=\s'"]+https?://fastjscdn\.org/\w+\.js\?\w+=\w+["']>\s*</script>(?<X1225990>)|src[\s="']+https?://cdn\.jsdelivr\.net/gh/FrostFoe/[^"']{1,100}['"][\s></]+script>(?<X1316371>)|src\s*=(?:['"](?:https?:?)?//pop\.dojo\.cc[^'"]*['"]\s*>\s*<\s*/script\s*>(?<X1255611>)|\s*['"]?https?[^'"]{1,19}(?:6tws\.us|expoilt\.com)[^'"]{1,9}\.js['"]?><\/script>(?<X1123694>)|\s*['"]http(?:[s:/]+(?:\w{0,20}\.)?descriptionscripts\.com[^'"]*['"][^>]{5,100}>\s*<\s*/script\s*>(?<X1240031>)|s?://(?:(?:\w+\.)?lainstree\.com[^'"]+['"]\s*type\s*=\s*['"]text/javascript['"]></script>(?<X1251520>)|cdn\.tutorialjinni\.com[^'"]+['"]\>\s*</script>(?<X1252820>)|storejscdn\.pw/[^"']+\.js['"]>\s*</script>(?<X1217650>))|s?:\/\/\w{1,14}\.gdcstatic\.com['"]\s*>\s*<\/script>(?<X1264162>)))|type=(?:"text/javascript"\s*src="https?://[^/]{5,50}/\w{5,10}\?frm=script&se_referrer=<\?php\s*echo\s*\$_SERVER\['HTTP_HOST'\];\s*\?>&default_keyword=<\?php\s*echo\s*\$_SERVER\['REQUEST_URI'\];\s*\?>"></script>(?<X1043421>)|['"]\w+['"]\s*data\-rocket\-src=['"]https://firmkoacocos\.com/[^>]+></script>(?<X120369970>))|type(?:[=\s]+['"]text/(javascript)['"]\s*language[=\s]+['"]\41['"]\s*>[^;=]{0,199}\b(?:(\w{1,40})[=\s]+['"][^'"]*['"]\s*;\s*){2,}for[\s\(]+(\w+)[=\s]+\d+\s*;[^=\};]{0,199};\s*\43\+\+[^\}]{0,199}\{\s*\42\s*\+=\s*\w{1,40}\.[^;]+;\s*\}\s*document\.write[\(\s]+\42[^<]{0,99}</script>(?<X1240150>)|\s*=['"]text/javascript['"](?:>\s*function\s*\w+\(\)[^;]+;\s*var\s*\w+\s*=\s*window\.location\.href\.replace[^\}]{1,99}\}\);[^\}]{1,32}\s*\}[^:]{1,99}https?://\w*\.ipfs\.\w*\.\w*\/\?\w+\s*=[^'"]+(?:html?|js)['"];[^\}]{1,299}\},\s*\d+\);\s*</script>(?<X1251200>)|\s*src\s*=\s*['"]//facepage\.co\.za(?:/[\w\-]+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250780>)|\s*src\s*=\s*['"]//nidoasia\.org(?:/\w+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250770>)|\s*src\s*=\s*['"]//pontiarmada\.com(?:/\w+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250760>))|\s*=\s*['"]text(?:/javascript['"]\s*>\s*document\.write\(\s*['"]\\u00[^'"]{999,5000}['"]\)\s*<\s*/script>\s*<\?php\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]{1,999}c2l4X2dldHB3dWlkKC[^'"][^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058310>)|\/javascript['"]\s*src\s*=\s*['"]https?://[^'"]{9,50}/dot\.php\?id=\d{1,9}['"]><\/script>(?<X1126722>)))))
<title(?:>(WDBOS\s*\$\s*DAFTAR\s+SLOT\s+ONLINE\s+GACOR)[^\<]{1,99}</title>[^\$]{1,1999}['"]name['"]:\s*['"]\1[^\[]{1,999}@type['"]:\s*['"]AggregateRating['"](?<X220355100>)|>(WINTER4D)[^<]{0,80}\bslot\s+gacor[^<]{0,80}</title>\s*<meta\s+name=["']description["'][^>]+content=["'][^"']{0,90}\3(?<X220339290>)|>-\$\$Ar\s*ab_money\$\$-</title>(?<X2049790>)|>0xshell</title>.{1,1999}\.urlencode\(\$\w+\)\.['"]+>Shell</a(?<X220359680>)|>40(?:3\h*Forbidden</[^#]{99,800}<input[^\>]{0,99}shell['"]>[^#]{99,400}\$\w{1,15}\h*=\h*file\(['"]https?://pastebin\.com/(?:raw|download)\b[^\)]{5,50}\);(?<X2141231>)|4\h+Not\h+Found<[^\?%#]{99,1500}<title>[^<]{5,15}(?:Uploader|webshell|backdoor|cracker)\b(?<X2146932>)|4\s+Not\s+Found(?:</(?:[^=]{1,600}</body>\s*</html>[^=]{1,600}(?:\s*<a\s+href=https?://[^>]{1,200}>[\w\s]{0,90}</a>,){24}[^\\]{99,9999}</body>\s*</html>(?<X2120294>)|title>[^\\]{1,999}@?setcookie\(['"][\w\-]+['"],\s*md5\(['"]bypass\d+['"](?<X220349882>))|\s*<[^\(\)\?]{99,999}['"]\);\}\}(\$\w{1,40})=\$_[GPRSC]\w{2,6}\[[^\]]+\];if\(\11\D{2,3}['"][^'"]*['"]\)\{\$\w{1,40}=pathinfo\(['"]\11(?<X2125510>))|[34]\s*(?:Forbidden|Not\s*Found)</(?![^\.]{0,99}Directory\s*access\s*is\s*forbidden)[^@]{99,999}\b(?:copy|move_uploaded_file)\(\$_FILES\[(?<X2143181>))|>7inc[^<]{0,20}</title>[^:]{9,99}https?://[^/]{1,20}/7inc-shell(?<X2132270>)|>::\s+Priv8\s+vHost\s+Config\s+Grabber(?<X2048250>)|>['"]\.\$_SERVER\['\w+['"]\]\.['"][\s\-]+wsox\s+enc\s+\d+\.\d+\.\d+</title>(?<X220332220>)|>[<\?'";ph\s]*error_reporting[\s\(]+E_ALL\s*\^\s*E_NOTICE\s*\^\s*E_WARNING[\)\s]+;\s*echo\$\w{1,40}[^<]{0,40}<\s*/title\s*>\s*<meta\b[^&]{1,999}\btitle\s*=\s*['"]sitemap(?<X2223620>)|>[\.:\h]*dosa\h+shell[:\.\h]*</title>(?<X220328950>)|>[\176\h]+\w+\s*Was\s*here[\176\h]+</title>[^%]{1,1199}function\s*\w+\((\$\w+)\)\s*\{\s*if\(function_exists\(['"](shell_exec|system|passthru|exec)['"]\)\)\s*return\s*\20\(\19[\s\.]+['"]\s*2>&1\s*['"]\);(?<X220361301>)|>[\sx]*[^\w]{0,3}GH[O0][5S]T[\sx]+S?H[E3]LL[^\w]{0,3}</title>(?<X2063932>)|>[\w\s]{1,99}\|\s*eBay\s*</[^\{]{99,999}['"]canonical['"]\s+href\s*=\s*['"]https?://signin\.ebay\.[^/]{2,6}(?<X2131740>)|>[^'"<\?\v/]{1,40}\bJersey[^'"<\?\v/]{1,99}</title>[^&]{999,9999}\bvar\h+http_host\h*=\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}jersey[^\.]{0,40}\.[^'"]{2,9}['"]\h*;(?<X2145082>)|>[^/<>]{0,9}\bcgi\h*(?:web\h*)?shell\b[^&\*`]{99,400}\$\w{1,20}\h*=\h*['"]\.htaccess['"];(?<X2185200>)|>[^/<>]{10,99}\bBulletproof\s+Botnet\s+Hosting\s+Service\s*</title>(?<X2146561>)|>[^/<]{0,20}\bc[o0]nfi?g?\h*[3e]xpl[o0]it[3e]r\b[^/<]{0,20}</[^\}\\\?]{99,800}\(['"]/etc/passwd['"](?<X2178581>)|>[^/<]{0,6}(?:hack|own|fuck|defac|pwn)ed\h*by\h*[l1][0o]c[4a][l1]h[3e][a4]dz\b(?<X2174752>)|>[^/]{0,15}\b(?:cyberwar\h*404|Mr\.K1m0ch1)\b(?<X1175360>)|>[^/]{0,30}(?:hacked|defaced)\s+by\s+KurdoXploit\s*</(?<X2130670>)|>[^/]{0,40}Mass\s*Mailer[^/]{0,15}by\b(?<X2047482>)|>[^/]{0,90}hacked\s+by\s+iranhack\s+security\s+team[^/]{1,49}</title>(?<X220357210>)|>[^/]{0,99}\bhacked\s+by\s+yiix103</title>(?<X220358140>)|>[^/]{1,99}\bHacked\s+by\s+(?:Ahmed\s+01</title>(?<X220354800>)|tokeichun</title>(?<X220354810>))|>[^:]{1,30}:hacked\s+by\s+mdx[^<]{1,30}turkish\s+hacker\s+mdx[^>]{1,30}</title>(?<X220342670>)|>[^<]{0,199}\bhacked\s+by\s+aptisme[^<]{0,99}</title>(?<X220346661>)|>[^<]{0,20}(?:&#\d+;\h*Trend\h*Frontline</title>[^\?]{9,299}\btitle=['"]Trend\h*Frontline\h*&raquo;(?<X220342371>)|(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|tadalafil|sildenafil|xenical|acomplia|phentermine)[^<]{9,150}</[^\$]{5000,}</div>\s*(?:<a[ ]+href[ ]*=[ ]*['"]https?://[^>\n]{9,200}title[ ]*=[ ]*['"]((?:[^'"]{0,20}[ ]*)(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|xenical)[ ]*(?:[^"']{0,20}))['"]>[ ]*\39[ ]*</a>\s*){5}(?<X2127025>)|(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|tadalafil|xenical|acomplia|phentermine)[^<]{9,150}</[^\$]{5000,}</div>\s*(?:<a[ ]+href[ ]*=[ ]*['"]https?://[^>\n]{9,200}title[ ]*=[ ]*['"]((?:[^'"]{0,20}[ ]*)(?:viagra|cialis|pharmacy|tadalafil|sildenafil|acomplia|phentermine)[ ]*(?:[^"']{0,20}))['"]>[ ]*\41[ ]*</a>\s*){5}(?<X2127041>))|>[^<]{0,32}\balfa\s+team\s+shell\b[^<]{0,99}</title>(?<X220340870>)|>[^<]{0,40}(?:\b[cs](?:h[e3]ll|r[e3]w)\h*(?:p[a@][s5]+w[o0]rd|b[a@]ckd[o0]+r|up[l1][oa0@]{2}d(?:er|s|5)|p[a@][s5]t[e3]b[i1]n|w[e3]b[5s]h[e3][l1]+)\b[^<]{0,40}<\h*/title>(?<X2138034>)|Seja\s+bem-vindos[^<]{0,40}</title>\s*<Script\s+language\s*=['"]javascript['"]\s+src\s*=\s*['"][^/]{0,9}/(?:dataverifica|validar_(?:tabela|campos))\.js['"]>(?<X2123770>))|>[^<]{0,4}\bIDBTE4M\b[^<]{0,4}<(?<X2141161>)|>[^<]{0,99}(?:(?:\(blitz\s*red\s+casino\)|\(casino\s+wilder\)|\bCasino\s+Hype\s*\-)[^<]{0,99}</title>(?<X220359161>)|\bbypass\s*(?:web)?shell\b[^<]{0,99}<\?(?<X220360522>)|\bSlot\s+Gacor\b[^<]{0,120}</title>[^\}]{1,199}squarespace\.com/universal/default\-favicon\.ico[^\\]{1,999}postimg\.cc\b(?<X220339501>))|>[^<]{1,149}\bHacked\s+by\s+(?:Lizard[^<]{1,49}</title>(?<X220349760>)|xploitednoob[^<]{1,49}</title>(?<X220348991>))|>[^<]{1,199}\bhacked\s+by\s+fattah[^<]{1,49}</title>(?<X220348581>)|>[^<]{1,32}\bHacked\s+by\s+Lost32x</title>(?<X220352690>)|>[^<]{1,49}\b(?:Hacked\s+By\s+SinaTria</title>(?<X220352711>)|Pawned\s+By\s+RipperSec[^<]{1,49}</title>(?<X220352731>))|>[^<]{1,50}Jojobet Mobil[^<]{1,50}</title>\s+?<meta\sname[\s='"]+description['"\s]+content[\s='"]+Jojobet\s2025(?<X2311900>)|>[^<]{1,99}\b(?:Jersey(?:[^'"<\?\v/]{0,120}</title>[^&]{999,2499}src\h*=\h*\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}[^w]jerseys[^\.]{0,40}\.[^'"]{9,199}['"]></script>\s*</head>(?<X2145195>)|[^'"<\?\v/]{0,99}</title>[^@%]{999,9999}var\h+(http_host)\h*=\h*\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}[^w]jerseys[^'"]{1,40}['"]\h*;[^;]{9,199}\+\h*\58\h*\+[^;]{1,40};\h*\}(?:\s*//-->)?\s*</script>\s*</head>(?<X2145233>))|website\s+was\s+hacked\s+by\s+ayesh\s+jkr\s+and\s+surf\s+the\s+eye[^<]{1,49}</title>(?<X220344601>))|>[^\-\$]{0,40}CGI[\- ]Telnet[^/<\$]{0,40}</title>\s*\$\w{1,40}\s*</head>(?<X2128300>)|>[^\<]{0,50}\bto\h*blackhole[^\?]{9,999}<\?php\s*goto\s*\w{1,9};(?<X2139682>)|>[^\?]{1,149}\bhacked\s+by\s+weedsec\s*[^<]{1,99}</title>(?<X220342461>)|>[^\w\s]{9,15}\bUpl[0o][a4]d[e3]r\h+By\h+\w{1,40}\b[^</]{1,99}</(?<X2167263>)|>[^\w]{0,15}\b[hd](?:[a4]ck[e3]d\hby|efacer)\h(?:Peyman\h*Siyahi|Kura\hLinux|\./Java\hDot)[^/]{0,55}</title>(?<X2140751>)|>[^\w]{1,5}Gu[e3][s5]{2}Who\?\s*M[4a]il[e3]r(?<X2064061>)|>[a@]n[o0]n[5s][e3]c\s[^<>]{1,40}</title>(?:[^\?]{1,199}<meta\b[^>]+content=['"]we\s*are\s*party\s*at\s*your\s*security\b){2}(?<X2221142>)|>[csk](?:iss|ecur|od|reat)ed\h+By\h+\./[^/<\v]{1,40}</(?<X2167851>)|>\(\.\*\)</title>[^_]{9,99}file_get_contents\(decodes\(['"][a-z0-9=]{9,99}['"]\)\.(?<X2133530>)|>\./(?:(kyukazami404)</title><center>[^,]{1,199}\h*by\s*\./\70(?<X220344611>)|[^</]{5,12}\bWas\h+here\b[^<]{0,4}</(?<X2175231>))|>\.:\s*hacked\s+by\s+colombian\s+hackers</title>(?<X220342440>)|>\b(?:bigbos4d[^<]{0,70}\bsitus\s+casino[^<]{0,70}</title>(?<X220343140>)|H4cked\s+by\s+(?:omgsmok</title>(?<X220354790>)|victus\s*\-\s*wyxreez</title>(?<X220360250>))|Hacke(?:d\s+by\s*\./(?:Fell\s+Ganns[^<]{1,99}</title>(?<X220355600>)|meicookies</title>(?<X220355590>)|RAZOR</title>(?<X220355610>))|R\h*INDO\h*SHELL[^\(]{9,50}\b(?:system|eval|passthru|popen)\((?<X2143561>))|Page\s+not\s+found\s*\-\s*(Bitcoin\s+Casino\s+No\s+Deposit\s+Bonus)</title>[^@]{1,599}https?://bitcoin\-casino\-no\-deposit\-bonus\.com[^'"]+['"][^!]{1,2499}<meta\s+name=['"]application\-name['"]\s*content=['"]\81['"](?<X220356880>)|RTP\s+live\s+dan\s+bocoran\s+pola\s+slot\s+gacor\s+hari\s+ini\s*+\-\s*(KUDALAUT88)</title>[^/]{1,299}<meta\s+name=['"]description['"]\s*content=['"]\83(?<X220348024>)|sahabat38\s+situs\s+bandar\s+slot\s+gacor\s+rtp[^<]{1,29}</title>(?<X220350180>)|touched\s+by\s+\w+[\h\-]+bekasi\s+root\s+sec</title>(?<X220366220>))|>\D{0,10}(?:cpanel|whm)\s+[^`]{0,9}\s*(?:crac|brut|Config\s+Grab|Finder\D{1,9}Cracker)(?<X2064074>)|>\D{0,4}(?:Bobyhikaru\s+Shell\s+Area\D{0,4}<(?<X2122770>)|Mini\s+Mass\sAuto\s+E?Xploiter\s+Only\s+Tools\b(?<X2123882>)|UM[A4][IL1]{2}[E3]R\b(?<X2122910>)))
<title>\s*(?:(?:(?:Y|&#89;)(?:A|&#65;)(?:H|&#72;)(?:0|&#48;){2}|(?:0|&#48;)(?:T|&#84;)(?:H|&#72;)(?:E|&#69;)(?:R|&#82;)|(?:A|&#65;)(?:O|&#79;)(?:L|&#76;))?(?: |&#32;)?(?:S|&#83;)(?:1|&#49;)(?:G|&#71;)(?:N|&#78;)(?: |&#32;)(?:1|&#49;)(?:N|&#78;)(?<X2061214>)|(?:0byteV\d\W{1,4}PHP\s+Backdoor|Keisatsu\s+Shell\s+V\d+)\s*<(?<X2130331>)|(?:[s5]h[4a]n[9g][1]\s*&\s*(?:&nbsp;)?\s*n[3e]u[7t][2r][4a][1l][1i][5s][3e]|m[2r]\.c[2r][4a]ck[3e]d\S{0,6}\s*[4a]c{2}[3e][5s]{2})\s*<(?<X2126643>)|(?:ANZ|bank\s*of\s*new\s*zealand)\W{1,9}(?:Internet\s*banking\s*)?(?:Log|sign)\s*(?:in|on)\s*<[^\?]{99,1500}<form\s+(?:name\s*=\s*['"][^'"]+['"]\s*|method\s*=\s*['"]post['"]\s*){1,2}[^>]{9,99}action\s*=\s*['"][^'"]+\.php['"](?<X2129860>)|(?:cPanel\s+)?Turbo\s+Force[^<]{3,19}</title>(?<X2046122>)|(?:G|&#71;)(?:M|&#77;)(?:A|&#65;)(?:1|&#49;)(?:L|&#76;)(?:\.|,|&#76;|&#44;)?[^\[]{99,400}<img\s+src\s*=\s*['"]data:image/(?<X2061220>)|(?:Hacked\s+by\s+)?F[i1]r[3e]\s+H[a4@]wk\s+(?:plugin)?\b(?<X2123310>)|(?:Magic|MySQL|Peterson|indoxploit|CIH\.)\s*[^\?]{0,15}\s*(?:Web)?Shell(?<X2057211>)|(?:MyShell|CCCP\s+Modular\s+Shell)\s*<(?<X2061642>)|(?:OpenBank|Bankinter|ABANCA)\s*justificante\s*de\s*Ingreso\s*</title>(?<X2201830>)|(?:Phpspy|jshell)\s+Ver(?:sion)?\s+[\d\.]{3,4}\s*</(?<X2124921>)|(?:priv(?:ate|8))?\s*VHOST\s*(?:config)?\s*grabber\s*</(?<X2127390>)|(?:Priv8|Private)?\s*(?:Mister|Mr)\s+Spy\s*</(?<X2055901>)|(?:Priv8|Private)\s+Mailer(?<X2055911>)|(?:PUBG\s+(?:Mobile|PC)|Free\s+Fire\s+Indonesia)[^\?]+<\?php\s*eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(['"]jY9La8JAEMfvgXyHYRE2lvgol[^'"]{99,500}['"]\)\s*\)\s*\);?\s*(?:\?>|\Z)(?<X2061601>)|(?:Sign\s+On|Email|Access)[^\|]{1,40}\s*\|\s*Wells\s+Fargo\s*</title>(?<X2126110>)|(?:Small|PHP)\s*Web\s*Shell\s*by(?<X2057611>)|(?:Wordpress|Joomla|magento)\s*mass\s*defacer\s*(?:private|priv8|privat)?\s*by\b(?<X2133130>)|([^<]+)\s*</title>[^\\]{99,2000}<(h\d)\s+[^>]+>\s*\19\s*</\20>\s*</header>\s*<div[^>]+>[^\n]{999,40000}</div>\s*<footer\s+[^>]+>\s*(?:<a[ ]+href=['"]?https?://[^\?]{9,99}\.(?:php|html)(?:\?\w{1,3}\s*=[^>]{9,150})?>\w{0,3}</a>\s*,\s*){15}(?<X2125220>)|(\(c\))\s*private\s+mail(?:-|\s*)worker\s*\22(?<X2062360>)|(CaixaBank)[^\w]{1,5}banca\sdigital\s*\24Now<\/title>(?<X2128921>)|(JAKARTAHOKI)\b[^@]{0,399}content=['"]\26(?<X220352140>)|-\s*r\s*w\s*-\s*r\s*-\s*-\s*r-\s*-<(?<X2051810>)|0by[t7][3e]\s*m[1i]n[1i]\s*(?:web\s*shell\s*)?</(?<X2133200>)|0x1999\s*</title>\s*\$\w{1,40}\s*</head>\s*<body\s+onLoad(?<X2061981>)|403\s*-\s*Forbidden\s*</title>[^'"]{1,600}['"];\s*(?:exit|die)\b[^;]{0,40};\s*\}\s*function\s+random_number\(\)\s*\{[^\{]{1,600}=\s*visitor_country\(\);(?<X2122831>)|404\s+Not\s+Found\s*<(?:/(?:[^\-\*\|=\(]{99,500}system\(['"]rm\s+\-rf(?<X2119422>)|title>[^%]{99,600}\$\w{1,20}\s*=\s*stream_socket_client\s*\(['"]udp://[^'"]+['"]\);(?<X2125080>)|title>[^=]{9,400}(?:\{\s*echo\s+['"])?<form\s+(?:action\s*=\s*['"][^'"]*['"])?\s*method\s*=\s*['"]?post\b(?<X2061153>))|[^=]{99,300};\s*\$\w{1,20}\s*=\s*['"]safe_mode\s*=\s*off\b(?<X2126530>))|40[43]\s*(?:\W\s*)?[FN](?:orbidden|ot\s*Found)\b[^\?]{499,1499}\$m(e?sg|essage)\h*=\h*['"][^;]{1,199}\$username[^;]{1,99}\$passw?(?:o?r?d)?\b[^\?]{9,499}\bmail\([^\)]+\$m\36(?<X2154260>)|:.Spade\s*Mini\s*Shell(?<X2051760>)|::\s+AventGrup\s+::\.\.(?<X2051540>)|:\s*:\s*Inbox\s*:\s*:\s*Unlimited\s*</title>\s*<\?\s*@?eval\s*\(\s*base64_decode\s*\((?<X2056990>)|</title>(?:[^:"']{1,40}<\w+>\h*40[34]\h*(?:Not\h*Found|Forbidden)\h*</\w+>[^\?]{9,9999}\$perms&(?<X2227251>)|\s*<script>\s*var\s*\w{1,16}\s*=\s*['"][^'"]{0,33}\b[S5]h[e3]{1,9}[l1]{1,9}\b[^'"]*['"];(?<X2122330>))|<\?=?(?:php)?os\(['"]Postman[^\?]{9,50}by\s+r[3e]v[3e]ng4ns\b(?<X2129150>)|<\?[ph\s@]*error_reporting[\(\s]+E_ALL\s*\^[^#`]{99,9999}(\$\w{1,40})[=\s@]+mt_rand\s*\([^>\?]+(\$\w{1,40})\s*\.?=[^;]+\44[^>\?]+(\$\w{1,40})[\s\.=@]+file_get_contents[\s\(]+\45[^>\?]+echo\s*\46\s*;(?<X2221570>)|<\?php(?:\s*echo\s*(?:(\$\w{1,40});\s*\?>\s*</title>[^\{\}\?]{99,499}</html>\s*<\?php\s*\}\s*else\s*\{\s*\48\s*=\s*['"][^;]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2124530>)|\$_SERVER\[['"]HTTP_HOST['"]\]\s*\.\s*['"]\s*-\s*Inbox\s+Mass\s+Mailer";\s*\?>\s*</title>(?<X2124060>))|\s+echo(?:\s*getenv\s*\(['"]HTTP_HOST['"]\);\s*\?>\W{0,9}(?:c99\w{0,4}shell|31NH0)\W{0,9}<(?<X2121472>)|\s+str_replace\s*\(['"][^'"]+['"],['"]['"],['"][Validtor\.-_,]{10,25}['"]\);\s*\?>(?<X2129731>)))|['"\.\h]*getcwd\(\s*\)['"\.\h]*<(?<X2052531>)|['"]\s*\+\s*os\.environ\[['"]SERVER_NAME['"]\]\s*\+\s*['"]\s*-?\s*LSDSHELL\s*['"](?<X2060892>)|['"]\s*\.\s*(?:\$_SERVER(?:\[['"]HTTP_HOST['"]\]\s*\.\s*['"]\s*-\s*WebShellOrb_\s*['"](?<X2062780>)|\s*\[\s*['"]HTTP_HOST['"]\s*\]\s*\.\s*['"]\s*-\s*Bypass\s*\d+\s*</title>(?<X2203400>))|getenv\(['"]HTTP_HOST['"]\s*\)\s*\.\s*['"]\s*.\s*Shell\s+I\s*</title>(?<X2060600>))|[+\[]{0,2}\s*Powered\s*by\s*KcB\s*[\]+]{0,2}(?<X2051830>)|[-:\[]{1,3}\s*GreenwooD\s*[-:\]]{1,3}\s*WinX\s+Shell(?<X2053481>)|[:\.]{0,5}\s*Mailer\s+Inbox\s+(?:(?:-?\s*Dejector)|\d+)(?<X2054651>)|[:]{0,2}\s*eBuKa\s*mAx\s*INbOx\s*sEnDeR(?<X2052400>)|[\[]{0,1}\s*RileyWilder\s*(?:\'\s*s)?\s*Mailer(?<X2053950>)|[\w-]{0,9}\s*(?:cpanel|whm)\s+[^`]{0,9}\s*(?:crac|brut)(?<X2057111>)|[\w\^\.\|]{0,3}\s+Private\s+Shell\s(?<X2058670>)|[^/]{1,49}\s+Edited\s+By\s+KingDefacer\s*</title>(?<X2057041>)|[^><]{1,9}\s*\bAni\-Shell\b(?<X2122552>)|[^\<]{0,19}\s*r57c99\.com(?<X2057200>)|[^\w\s]{0,3}\s*T\.C\.T\s*[^\w\s]{0,3}\s*</(?<X2057820>)|[^\w]{0,3}\s*BYSCRA3ZY\s*[^\w]{0,3}\s*</title>(?<X2058690>)|[^\w]{1,3}\s*Trenggalek\s+Mafia(?<X2058171>)|[^\w]{1,3}Mr\.Cr[0o][7t][^\w]{1,3}\s*</title>(?<X2063510>)|[A4]LM[0O][S5][T7]H[3E]v[i!]L\W{0,4}H[!i]dd[3e]n\s+Gh[o0][s5][7t]\s+[7T][3e][a4]m\s*<(?<X2121510>)|[o0]wn[e3]d\s+By\s+[o0]*R[o0]+T[o0]*(?<X2122690>)|[S5]PYU[5S]\s+M[A4]IL[3E]R\s+2[K0][12]\d</title>(?<X2118480>)|[th][oa](?:uched|cked)\s*by\s*[0o]xyg[e3]n\W\s*</(?<X2141852>)|\$\w{1,15}\s*\-\s*Perl\s*Web\s*Shell(?<X2128061>)|\.:{2}.\s*BLACKUNIX\s*.:{2}\.\s*</title>(?<X2063310>)|\[?Mister\]?\s*\[?Spy\]?\s*Masse\s*-\s*S3ND3R(?<X2053432>)|\[\s*D912\s*Browser\s*\]\s*</title>(?<X2048640>)|\[S\]uper\[BAD\]\s*Mailer(?<X2051870>)|\W{0,3}\s*TurkisH\W{0,9}RuleZ\s+SheLL(?<X2121890>)|\W{0,9}(?:Bypass|Vhosts\s+Config\s+Grabber)(?:\D{0,15}|by)\s*TN\.DESTROYER(?<X2118735>)|\w{1,40}\.php\s+-\s+Edited\s+By\s+KingDefacer(?<X2062641>)|Al-Marhum\s+CGI\s+Shell\b(?<X2121681>)|Andro(?:\s*Ghost\s*69(?<X2055451>)|Gh[o0]st\s+PHP\s+Backdoor\s*</(?<X2124710>))|Ani\s*-\s*Shell(?<X2057550>)|Anon(?:Ghost\s+Cgi-Telnet(?<X2120180>)|ymousFox(?<X2055831>))|aramex\s*Postal\s*Services?\s*<\s*/title\s*>(?<X2226510>)|ASPX\s*spy\s*</(?<X2125520>)|Back\s*Connect\s*Shell\b[^@]{9,499}\bfsockopen\h*\((?<X2152330>)|Banco(?:\s*De\s*Oro\s*Update\s*Online\s*Banking[^\/]+<\/title>(?<X2122760>)|\s+De\s+Oro\s*</[^%]{999,15000}<form\s[^>]{0,90}method\s*=\s*['"]?post['"]\s*action\s*=\s*['"]\w{1,20}\.php['"]>(?<X2124820>))|Bing\s+Dorker\b(?<X2128330>)|bk\-code\s*shell\s*</title></head(?<X2130140>)|Black(?:hat\s*Code\s+Backdoor(?<X2056330>)|Tools\s*Folder\s*Mass\s*Defacer(?<X2051691>))|BraIn\s+Inc\D{1,3}\s*Sh[3][l1]{2}\s*-\s*By\D{1,3}cyberwarror(?<X2119380>)|BruteForcer\s+v\d+\.\d+(?<X2122600>)|Bypass(?:\s*Root\s*Path\s*by\s*Mauritania\s*Attacker(?<X2052700>)|\s+404\s+by\s+0x1999\s*<(?<X2122200>))|C99\s*(?:mad)?\s*shell(?<X2056390>)|cgi-shell\.py(?<X2057650>)|Ch?[a4][o0][s5]\s+Sh[3e][1l]{2}\s*</(?<X2125210>)|Cmd\s+by\s+ghz(?<X2055880>)|Config\s+Grabber\s+by\s+ResCooL[l1][3e]{2}[t7]\b(?<X2121620>)|Created\s+By\s+IndoXploit\s+(?:Just)?\s+FOr\s+(?:Wordpress|Joomla|Magento|Drupal)(?<X2061101>)|D-Evil\s+Mailer\b(?<X2121360>)|Dark Shell\s*</title>.+clearstatcache(?<X2045561>)|dis\s+Shell\s+Commander(?<X2055660>)|Documentation\s*</title>[^\&]{600,999}<h\d*>DOCUMENT\s+MANAGEMENT\s+SYSTEM\s*</h\d*>(?<X2060031>)|Dr\s*H[e3]x\s+(?:web)?shell\s*</(?<X2130080>)|Dr\s+HeX\s*</(?<X2056850>)|DropBox\s+Buisness\s*</title>(?<X2052750>)|EgY_SpIdEr\s+ShElL(?<X2057190>)|eMail[^\w]{2,9}RealUnix\.net[^\w]{2,9}Edited\s+By\s+WebCrac?ker(?<X2062630>)|Facebook\s*</title>\s*<\?php\s*include(?:_once)?\s*\(?['"][^\.]{1,99}\.php['"]\);(?<X2058260>)|Fastest\s+Zone-H\s*Mass\s+Deface\s+Poster(?<X2054140>))
<(?:script(?:\s+(?:\w+=['"]\w+['"]>(function)\s+(_0x)\w+\(\2\w+,\2[^\}]+\},\2\w+\(\2\w+,\2\w+\);\}\1\s+(\w+)\(\)\{var\s+\2\w+=\[[^\]]+\];\3=\1\(\)\{\w+\s+\2\w+;\}[^\^]+\2\w+\^\2\w+\);\}\)\[\2[^\[]+(window\[['"]ww)['"]\]=new\s+WebSocket\(\2\w+\+encodeURIComponent\(location\[['"]href['"][\]\),]+\4[^<]{99,499}0x\w+\],0x\w+\);\}\(\)\)\);</script>(?<X120340211>)|async=['"]async['"]\s+src=['"]//\w+\.sq88\.press[^'"]+['"]>\s*</script>(?<X1232490>)|language(?:=javascript>\s*eval\(\s*String\.fromCharCode\((?:\d+\s*,\s*){3}[^\)]+\)\s*\)\s*;</script>(?<X1043472>)|\s*=\s*['"]php['"]\s*>\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}(?:\s*\()?\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\](?:\s*\)\s*){1,6};?\s*</script>(?<X1058601>)|\s*=\s*VBScript\s*>[^`]{0,999}\bDropFileName\s*=\s*['"]svchost\.exe['"]\s*WriteData\s*=\s*['"][^\?]{64000,}</SCRIPT>\s*(?:<!--[^\r]{1,850}-->)?(?<X1055214>))|src=\\?['"]https?://blueeyeswebsite\.com/ad\.js\\['"]\s+type=\\?['"]text/javascript\\?['"]></script>(?<X120364842>)|src[=\h]+['"]https?://asmr9999\.live/\w+\.js\?\w+[=\s]+\w+['"]\s*>\s*<\s*/script>(?<X1220651>)|src[^>]{0,99}//dojo\.cx/4\.js\b[^>]{0,99}>\s*</script>(?<X120348541>)|src\s*=\s*['"](?:\.\./){1,5}www1\.bac-assets\.com/online-banking/spa-assets/(?<X2051950>)|type=['"](?:\w+['"][^>]{1,499}>\s+\(function\(\w,(\w),(\w),\w,(\w),(\w)\)\{\s+var\s+(\w+)\s+=\s+atob\(['"]aHR0cHM6Ly9ub2RlYXBpaW50ZWdyYXRlLmNvbS9QM3JTYT[^;]+;\s+\16=\14\.createElement\(\15\);\17=\14\.\w+\(\15\)[^;]+;\s+\16\.async=\d;\16\.src=\18;\s+\17\.parentNode\.insertBefore\(\16,\17\);\s+\}\)\(\w+,\w+,['"]\w+['"]\);\s+</script>(?<X120332061>)|text(?:/javascript['"](?:>(function)\s+\w+[^\[]{1,99}(var)[^\+]{1,49}undefined\)\{\21[^\{]+\20[^@]{1,299}string\[['"]fromCharCode[^@]{1,1999}async\s+\20\(\)\{\21[^\-]{1,49}https://[^'"]+\.io['"][^!]{1,499}method['"]:['"]eth_call['"][^@]{999,}insertBefore[^@]{1,1199}\20[^:]{1,99}</script>(?<X120370270>)|\s+src=['"]https?://backgroundsnow\.top[^'"]{1,49}['"][^>]{1,99}></script>(?<X120346381>))|\\/javascript['"]>\\\w+\((function)\(\w+[^:]{1,99}script>\\n['"]\},['"]\d+['"]:\{['"]content[^%]{1,1299}for\((var)\s+\w+=\-(0x)\w+[^\.]{1,1999}\26\w+\)\)\+parseInt[^!]{1,599}\25\s+\w+=\s*\[['"]https:\\/\\/[^'"]+\.io[^!]{1,499}method['"]:['"]eth_call[^@]{999,}insertBefore[^@]{1,1199}\24[^:]{1,99}script>(?<X120370220>)))|type(?:=[^\(]{1,49}eval\((\w+)\(\w,\w,\w,\w,(\w),\w\)\{\29=\28[^@]{1,149}\28\(\29\)\{\w+[^\?]{1,99}regExp\(['"]\\\\b['"]\+\29\([^\}]{1,99}\}\}\s*return\s*\w+\}\s*\(['"]\w\(\w\.\w\(\w\.\w\(\w,[^'"]+['"],\d+,\s*\d+,['"]116[^\.]{1,999}eval\|write\|123\|117[^.]+\.split\(['"\|\),\d]+\{\}\)\)</script>(?<X120350493>)|[=\s]+['"]text/javascript['"]\s*>\s*document\.write\(atob\(['"]PHNjcml[^'"]{99,2999}MlNTMlNzQlNkYlNzIlNjElNjc[^'"]{999,}['"][\s\)]+</script>(?<X1225920>)|\s*=\s*['"]text/javascript['"]\s+src\s*=\s*['"]https?://\w{1,2}\.cnzz\.com/[^'"]+['"]>\s*</script>(?<X1232500>)))|\sasync\ssrc[\s='"]+https://pagead2\.googlesyndication\.com/pagead/js/adsbygoogle\.js\?client=ca\-pub\-9035780560703580['"][^>]{1,50}></script>(?<X1320901>))|s(?:ource\h+src\h*=\h*['"]https?://hyi?dra[^\.]{3,9}\.(?:com|onion)/hydra\.mp4\b(?<X2171530>)|pan(?:[^>]*>\h*[hfdo](?:ack|wn|uck|efac)ed\h+by\b[^\.:]{99,300}<audio[^://]{1,99}\bsrc\h*=\h*['"]https?://\w\.top4top\.io/(?<X2169391>)|\s*class(?:=['"]\w{5,9}['"]>\s*PHP\s*eMailer\s*<br>\s*made\s*by[^\/]+\/span>(?<X2120240>)|[^>]{1,15}>\D{2,5}PHP\s*Mailer\D{2,5}</span>(?<X2129241>)|\s*=\s*["']titulo['"]>\W{1,9}spamer\s*php\W{1,9}</span>(?<X2118631>))|\s*style\s*=\s*['"]overflow\s*:\s*auto;\s*position\s*:\s*absolute;\s*(?:(?:height|width)\s*:\s*[01]p[tx];\s*)+['"]\s*>\s*<ul>(?:\s*<li>\s*<a\s*href\s*=\s*['"]https?://[^/]+/['"]\s*title=['"][^'"]{0,99}escort[^'"]{0,99}['"]\s*>[^'">/]{0,99}escort[^'"/<]{0,99}</a>\s*</li>){9,}\s*</ul>\s*</span>(?<X1197974>)|\s+style[=\s]+['"]overflow[:\s]+auto\s*;\s*position[:\s]+absolute\s*;(?:\s*(?:height|width)\s*:\s*[10]p[tx]\s*;){2}\s*['"]\s*>(?:[^<>]{3,88}<a\s+href[\s=]+['"]https?://[^'"]+['"]\s+title[=\s]+['"][^"']+['"]\s*>[^<>]{3,88}</a>){3,}[^><]{0,88}</span>(?<X1226490>)|\sstyle=[\\'"]+color:\s*#[a-f0-9]{6};?\s*[\\'"]+><a\shref=[\\'"]+[^'"]{10,50}[\\'"][^>]{0,50}>[^<]{0,30}(?:slot|gacor|togel|situs|4d|\shk|macau|toto|mahjong|pafi|adktla|rumahberkat|kimiafarmabali\.com)[^<]{0,50}</a></span>(?<X1310146>))|t(?:rong>[\s_]+(bye)\s*\42\s*Litespeed[^<]+\./Heartzz\b(?<X2305990>)|yle(?:>\.nofollow\s*\{\s*display[^?]{1,75}(?:<(span>)\h*<(a)\h*href\h*=\h*['"]https?://\w{1,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml|tk|com)[^\?]{1,49}\.php\?\w{1,49}/\w{1,40}\.html['"]>[^\?]{0,99}</\45>\h*</\44<br>){4}[^#\v!@]{999,12999}</div>(?<X1190050>)|\b[^>]*>\s*(\w+)\s*\{\s*(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^\}]{0,19}\}\s*</style>\s*<\47>[^<>/=]{0,99}(?:<a\b[^>]*\bhref=['"]?https?://[^>]*>[^/\n<]*</a>\s*[^<>/=]{0,99}){5,}</\47>(?<X1200711>)))|vg(?:>\s*<use\s*href\h*=\h*['"]dAta\h*:\h*image/s\s*vg\+xml;\s*base64\s*,\s*PHN2Z[a-z\d\+/]{9,199}(?:bGVydC|YWxlcnQ|ImFsZXJ0K|J2FsZXJ0K)[a-z\d\+/]{9,40}=?=?#\w{1,9}['"]\s*>(?<X1251080>)|\s*style=\\?['"]display:none;\\?['"]?><\w+\s*onbegin=\\?['"]var\s*(\w+)\s*=\s*\\?['"]\w{999,}\\?['"];var\s*\w+=\d+;\s*var\s*\w+=\50;var\s*\w+=\w+\.split\(\\?[^=]+=parseint\(\w+\[[^#]{1,999}\]\(\);\\?['"]\s*attributeName=\w></svg>(?<X120358490>)))|td>(?:\$\s*execute\s*a cmd</td>(?<X2043661>)|\D{0,9}(?:Anonymous\s+cyber\s+team|Hacked\s+by\s+SPAIROW\s+DA_?VINCCI)\D{0,9}</td>\s*</tr>\s*</body>(?<X2123651>)|\s*Exorcism404\W{0,2}@\W{0,2}hackermail\.com\b(?<X2137210>)|Hati\s+Mantan\s*[^'"]{1,10}['"];\s*[^\$]{1,40}\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?[^'"]{1,40}['"]?\](?<X2055641>)))
<title(?:(?:\b|__)[^>]{0,99}>(?:a(?:cceso\s*clientes\s*banca\s*online\s*\|\s*bankinter|pple(?:\s*\-\s*my\s*apple\s*|\.itunes\-)id)|copyright\s*(?:center|help)?\h*\W{1,19}\h*(?:(?:buss?ines?s|help)\h*)?[1i]nstagram|banco\s*do\s*brasil\s*\-\s*autoatendimento\s*pessoa\s*fisica|web\.de\s*kundencenter)</title>(?<X2176863>)|>&#(?:66;&#97;&#110;&#107;&#32;&#111;&#102;&#32;&#65;&#109;&#101;&#114;&#105;&#99;&#97|86;&#101;&#114;&#105;&#102;&#121;)[^>]{20,300}>\s*<script>\s*settimeout[^=\}]{10,100}=\s*["']password['"](?<X2119442>)|>((?:Luxbet|Hiltonbet|Rinabet|Winxbet))\b[^<]{0,99}\bGiri[^<]{0,99}</title>[^@]{1,1999}content=['"]\3(?<X220363031>)|>((NSA)\-T1MS)</title>[^\?]{1,99}content=['"]Stamped\s+By\s+\6[^>]{1,99}\5\s+HACKER\s+TEAM['"]/>(?<X220352001>)|>(<\?php\s*echo\s*\$\w{1,14}\s*\?>)[^<]{1,100}(?:togel|lotto)[^<]{1,100}</title>\s*<meta\sname[^@]{1,50}content[\s='"]+\8[^>]{1,300}(?:togel|lotto)[^>]{1,300}>(?<X220327761>)|>(?:0|o)wn(?:3|e)d\h+by\h+BlackHat\h+cyber\h+Crew</title>(?<X220328200>)|>(?:[rc]\d{2}|(?:marco\s*)?priv(?:\s*\d|ate)?(?:\s*[mi1n]{4})?)\s*[5s]h[e3][li1]{2}(?:\s*(?:cgi|\d{4}))?<\/title>(?<X2126707>)|>(?:\s*[\|]{1,2})?\s*(?:Ombre|xGhost|InboX\s+Mass|Don\s+Cordoba)\s+Mailer(?<X2059782>)|>(?:\w+)?\s*bypass\s+403[^<]{1,99}zildan\s+security</title>(?<X220332230>)|>(?:a(?:mericanas\.com\s*\-\s*a\s*maior\s*loja\.\s*os\s*menores\s*pre[^/<o\s]{1,19}os\.|ctivation\s*\-\s*at&t\s*mail\s*services|dobe\s*document\s*cloud\s*\|\s*for|t&t\s*\-\s*home)|connectez\-vous\s*[^/<\s]{1,19}\s*votre\s*compte\s*paypa[1il])</title>(?<X2157274>)|>(?:byp4a55|bypass)\b[^<]{0,99}</title><\?=null;(?<X220367870>)|>(?:JAGOWIN404|MIO88|CNN303)[^<]{0,99}platform\s*online[^<]{0,99}</title>(?<X220361810>)|>(?:Login|Web)\s*Shell[^@]{1,5999}\bif\(!empty\((\$_POST\[['"](\w+)['"]\])[^%]{1,99}shell_exec\((?:\$\18|\17)\.['"]\s*2>\&1(?<X220354571>)|>(?:NANASTOTO|CPO333)\s*\W+\s*(?:login\s+Alternatif\s*slot\s+online\b|situs\s+online\s+resmi\b|tempat\s+hiburan\s+online)[^<]{0,99}</title>(?<X220349250>)|>(?:Nanastoto|TIKTAKTOGEL)[^<]{0,99}toto\s+slot[^<]{0,99}</title>(?<X220354000>)|>(?:TN\-SN!PER|DR!V3R\h+PRIV3T)\h+Mailer</title>(?<X2148191>)|>(?:Touched|Hacked|Touch3d)\s+By\s+Legion\s+OF\s+BekasiRootSec</title>(?<X220352682>)|>(?:WHM|cpanel)\h*resellers\h*finder\b[^\\\}\{]{99,1500}\bfile\h*\(\h*['"]/etc/trueuserowners['"]\);(?<X2198140>)|>(\w+)(?:(\s*\$\s*\bLogin\s+Situs\s+slot\s+4D\s*&\s*Panduan\s+Jackpot\s+Hari\s+ini)</title>\s*<meta\s+content=['"]\25\26['"][^:]{1,299}\bslot\s+online,\s*\25,[^\.]{1,149}https?://[^'"]+['"][^\$]{1,49}<meta\s+content=['"]\25['"](?<X220349750>)|[\h:]+\bLink\s+Gacor\s+Bet\s+\d+[^<]{1,99}RTP\s+Live[^/]{1,199}</title>[^\-]{1,299}meta\s+name=['"]description['"]\s+content=['"]\25\s+slot\s+gacor(?<X220369500>)|[^&]{1,49}\bagen\s+bandar\s+toto\s+slot\s*&\s*situs\s+togel[^<]{1,49}[^@]{1,299}<meta\s+name=['"]description['"]\s*content=[^\?]{1,49}\25(?<X220350461>)|[^&]{1,99}\b(?:Link|Daftar)\s+(?:Login|Situs)\s+slot\s+online\s+(?:terbaru|gacor)[^'"]{1,99}<link\s+rel=['"]amphtml['"]\s+href=['"]https?://[^>]{1,99}\.dev[^>]{1,49}>[^@]{1,299}<meta\s+name=['"]description['"]\s+content=['"]\25(?<X220346581>)|[^;]{1,49}\bsitus\s+(4D)\s+slot\s+gacor\s+online\s+&amp;\s+prediksi\s+\31\s+togel\s+\31\s+hari\s+ini</title>[^/]{1,99}https?://pinocchio\-amp[^>]{1,49}/>[^&]{1,199}content=['"]\25(?<X220347800>)|[^<]{0,99}\bSlot\s+Gacor[^<]+</title>\s*<link[^>]{0,50}\bhref[\h=]+['"]https?://pub\-[^/]+\.r2\.dev/[^\?]{0,50}\?view=\25['"]>(?<X220358691>)|[^<]{0,99}Situs\s+(?:Togel|Slot)[^<]+</title>\s*<link[^>]{0,50}\bhref[\h=]+['"]https?://pub\-[^/]+\.r2\.dev/[^\?]{0,50}\?view=\25['"]>(?<X220358740>)|[^>]{1,99}\bsitus\s+slot\s+online\s+gacor\s+hari\s+ini\s+maxwin\s+slot777</title>[^/]+['"]https?://amp\-terbaru\-c00\.pages\.dev/['"]>[^;]{1,299}<meta\s+name=['"]description['"]\s*content=['"]\25(?<X220348030>)|\s*:\s*\b(?:link\s+viral\s+Gampang\s+Jackpot\s+Maxwin\s+Anti\s+Nawala\s+2026</title>[^#]{1,499}<meta\s+name=['"]keywords['"]\s+content=['"]\25\s*\|\s+SITUS\s+\25(?<X220364620>)|situs\s+link\s+slot\s+gacor\s+maxwin[^<]{1,49}\s+slot88[^<]{1,49}</title>[^:]{1,49}https?://beber\-doerkali\.pages\.dev/\25\s*['"]>(?<X220351370>))|\s*:\s*situs\s+slot\b[^<]{0,99}</title>[^>]{1,999}content=['"]\25(?<X220335490>)|\s*[:>#<@%\*\|\-\$]\s*(?:link\s+resmi|link\s+bandar|link\s+slot|Situs)[^%]{1,99}(?:Online|Slot)[^%]{1,99}</title>[^%]{1,99}content=['"]\25(?<X220336611>)|\s*[:>#<@%\*]\s*(?:\w+)?\s*(?:Situs|Alternatif)\s*(?:\w+)?\s*slot\b[^<]{0,99}</title>[^\\]{1,199}content=['"](?:\w+\s*)?\25(?<X220335641>)|\s*[^<]{0,99}\bslot\h*gacor[^<]{1,99}</title>[^%]{1,99}content=['"]\25(?<X220338580>)|\W{0,3}(?:Situs|Alternatif)\s+slot\s+Gacor[^<]{0,80}</title>[^%]{1,199}(?:Online|slot)[^%]{1,99}content=['"]\25(?<X220337195>))|>(\w+:)[\s\w]*\bslot\s+(?:online)?\s+gacor\b[^\}]{1,99}content=['"]\43(?<X220339242>)|>(\w{1,20})[^@]{1,300}(?:jackpot|win|slot|freespin|casino)[^@]{1,300}</title>[^@]{1,300}<link rel[\s=]+['"]icon["'] type[\s=]+['"]https?://cdn\.soladump\.fun[^@]{1,300}<meta property[\s=]+['"]og:site_name['"] content[\s=]+['"]\45['"](?<X2320860>)|>(\w{1,40})\s*injector</title>[^\@]{99,499}echo\s*['"]\47[^;]{1,9};(\$\w{1,40})=@?PHP_OS;echo[^;]{0,19}\48(?<X2141191>)|>(Betebet)[\h\|]+\50[^<]{1,99}\50[^/]{1,49}adresi</title>[^\-]{1,199}<meta\s+name=['"]keywords['"]\s+content=['"]\50,\s*\50\s+giri[^>]{1,99}\50\s+bonus(?<X220367550>)|>(bets\d+)[^<]{0,99}\52[^<]{0,99}</title>.{1,1999}https://(?:[\w\-]+\.)?\52(?<X220358520>)|>(DEWA4DKU)[^<]{0,99}\bsitus\s+gacor\s+slot[^<]{0,70}</title>\s*<meta\s+name=['"]description['"]\s*content=['"]\54(?<X220344120>)|>(GACOR4D)[^<]{0,70}\bsitus\s+bandar\s+game[^<]{0,70}</title>\s*<meta\s+name=['"]description['"]\s*content=['"]\56(?<X220342180>)|>(GOAL555)[^<]{0,80}\bstrategi\s+menang[^<]{0,80}</title>\s*<meta\s+name=["']description["']\s*content=['"]\58(?<X220340371>)|>(HOKIBET88)[^<]{0,80}\braja\s+slot88[^<]{0,80}</title\s*>\s*<meta\s+name=["']description["'][^>]+content=["'][^"']{0,90}\60(?<X220339690>)|>(isparta\s+escort)[^<]{1,49}\62\s+bayan[^<]{1,49}</title>[^\$]{1,499}\62(?<X220343970>)|>(Kiral\Wk\s+Hacker)[^<]{1,99}\s+\Wcretli\s+hacker[^<]{1,49}</title>\s*<meta\s+name=['"]description['"]\s*content=['"]\64(?<X220343890>)|>(maeltoto)[^<]{0,70}\bkamus\s+togel\s+online[^<]{0,70}</title>\s*<meta\s*content=['"]\66(?<X220343021>)|>(meja777)[^;]{1,99}\bsitus\s+slot\s+4d\s+gacor\s+daftar[^<]{1,99}</title>[^;]{1,399}content=['"]\68['"]/>(?<X220349520>)|>(olxgg)[^<]{0,70}\btoto\s+macau[^<]{0,70}</title>\s*<meta\s+name=['"]description['"]\s*content=['"]\70(?<X220343110>)|>(PENIDABET)\b[^<]{0,99}</title>[^@]{1,99}content=['"]\72(?<X220352130>)|>(SCBET88)[^<]{0,70}\blink\s+situs\s+gacor[^<]{0,70}</title>\s*<meta\s+name=['"]title['"]\s*content=['"]\74(?<X220342580>)|>(SKY99IDN)[^<]{1,99}\bsitus\s+slot\s+online[^<]{1,99}</title>\s*<meta\s+name=['"]description['"]\s+content=['"]\76(?<X220349620>)|>(SLOT\s+DANA)[^<]{0,80}\blink\s+situs[^<]{0,80}</title>\s*<meta\s+name=['"]description['"][^>]+content=['"][^"']{0,90}\78(?<X220339570>)|>(SODA88)[^<]{0,80}\bvip\s+platform\s+podcast[^<]{0,80}</title>\s*<meta\s+name=["']description["']\s*content=["']\80(?<X220340980>)|>(tambet)\s+resmi\s+adresimiz\s+2026[\s\-]+\82[^<]{1,99}</title>[^#]{1,799}<meta\s+name=['"]keywords['"]\s+content[^>]{1,199}\82\s+bonus[^@]{1,1199}https?://[^'"]+guncelgirisimiz\.vip/\82[^'"]+['"](?<X220367410>)|>(Timebet)[\h\-]+\84[^<]{1,49}\84\s+Resmi[^<]{1,49}</title>[^#]{1,1999}<meta\s+\w+=['"]og:description['"]\s+content=['"]\84[^\.]{1,99}bahis\s+ile\s+casino(?<X220368990>)|>(TOTOBET\d+)[^'"]+</title>\s*<meta\s*name=['"]description['"]\s*content=['"]\86(?<X220370000>)|>(vio5000)[^/]{1,99}(?:Situs|Link)\s+Slot\s+Gacor[^:]{1,99}</title>[^:]{1,49}https?://\88\-bo\-lawan\.pages\.dev/['"]>[^;]{1,299}content=['"]\88(?<X220354781>)|>(vslots88)[^<]{1,99}\blink\s+daftar\s+situs\s+slot\s+online\s+gacor[^<]{1,49}</title>[^:]{1,99}['"]https://[^=]{1,99}<meta\s+content=['"]\90(?<X220349071>))
<title(?:>\D{0,9}Ninja.Shell\D{0,9}</(?<X2126130>)|>\h*(?:(?:ki[s$]{1,2}[e3]d|h[a4]ck[e3]d|pwned)\h*by\h*[^/<]{1,49}</title>\s*<(iframe)[^>]{1,99}>\h*</\2>\s*<script[^>]{1,99}\bsrc\h*=\h*['"]https?://(?<X2140831>)|(?:Pwne?d|hacked|fucke?d)\h+by\h+D[es35]{2}[7t]r[0o]y[3e]r\b(?<X2141311>)|(\w+)\h*:?\h*(?:Akses\h*(?:Jackpot|Game)|Situs\h*(?:Andalan|Gambling)|Gerbang\h*Main|Gambling\h*Premium)\b[^#]{99,900}<meta\h*name[\h=]+['"](?:copyright|publisher)['"]\h*content[\h=]+['"]\5\b(?<X220367830>)|404\h+Not\h+Found(?:\h*</title>[^\}]{99,999}<\?(?:php|=)?\s*(?:exit|die)\b[^;]{0,9};(?:\s*\})*\s*define\h*\((?<X2152140>)|\W{0,4}uplo?a?de?r\h*<(?<X2172810>))|[3e]xp[l1]o?r[e3]?r?\h+[cs5]yb[e3]r\h*[a@]rmy\h*</(?<X2147470>)|[OPHJF](?:wn[e3]|[0o]{2}ne|acke|ucke)d\h+by\h+407\h+Authentic\h+Exploit<(?<X2159211>)|[pO]wn[3e]d\h*(?:by|\-)\h*[l1][e3]{2}[t7]</title>[^@]{1,99}<meta[^>]+(?:\b(?:content\h*=['"]r[0o]{2}[t7]|name\h*=\h*['"]author['"])\h*){2}(?<X2143331>)|Jingklong\h+sh[e3]ll\b(?<X2141000>)|MINI\s+\w{0,15}\h*SHELL\b\h*</title>\s*<style>(?<X2049251>)|PHP\h*mailer\h*Dev\h*by\b(?<X2143581>)|Sign\s+In\s*</title>[^>]{1,40}(?:signin_?files|images)/\w{1,40}\.ico['"](?<X2054752>)|SQL\b[^><]{1,40}\b(?:[e3]xpl[o0][i1]t|cr[a@]?ck|brut)[^/]{1,99}</(?<X220352761>)|SSI\h+[Tm]in[iy]\h+webshell\h*</(?<X2150860>)|Woody's\h+private\h+tool\b(?<X2140690>)|WP\h*Backdoor\h*User\h*v(?:<\?php|\.?\d)\b(?<X2194060>)|x?Mail(?:er)?\h+[xz]?B[o0]mb[e3]r\b(?<X2167060>))|>\s*#(?:bbbtitsbbb#\s*</title>(?<X2124571>)|htitleh#\s*</title>(?<X2176660>))|>\s*(?:File\s*</\s*[^\?]{1,200}<form\s+method\s*=\s*['"]post['"][^\?]{1,200}<\?php\s*if\s*\(\s*is_uploaded_file\(\s*(\$_FILES\[)(['"][^'"]{1,40}['"])(\]\[['"][^'"]{1,40}['"])\]\s*\)\s*\)\s*\{\s*move_uploaded_file\(\23\24\25\],\s*\23\24(\]\[['"][^'"]{1,40}['"]\])\s*\)\s*;\s*\$file\s*=\s*\23\24\26(?<X2056790>)|Folder\s*mass\s*defacer\s*by[^/]{1,49}</title>(?<X2130740>)|Gamma\s+Web\s+Shell\s*<(?<X2124310>)|GFX\s+\|\s*GForce\s*X-Sender\s*by\s*Mr-Anobs\s*2018(?<X2052460>)|Ghost\s*by\s*dandan(?<X2052580>)|H[a4@]ck[3e]d!?\s+by\s+(\./\S{1,40})\s*</title>[^#\-;]{1,99}<meta\h*(?:name=['"]description['"]\s*|content=['"][^'"]{0,40}\32[^'"]{0,40}['"]\s*){2}(?<X2121552>)|H[a@]ck[e3]d\s+by\s+(?:Dr\.SiLnT\s*HilL|your\s+HaxorsteinBD|Mo[E3]Gza|KIWIL0736|AssasinCyber|Totaled_Crixu|3xp1r3|x1x1pezo1x1x|takisik|\.\s*/[s5][i1l]N[i1l]CH[il1]|mr\W{0,5}gae\w{0,24}|Baku\s+Hantam\s+Crew|GR[0o]v|xMySQLz|Deni\W{0,2}Nax\W{0,2}Daz)\b(?<X20592113>)|H[ae]c?ked\s+(?:by\s+Ajob\s+Ekkhn\s+Pola|Bay\s+BlekHoll)\s*</(?<X2120021>)|Handanovix\s*X_Shell\s*GTA(?<X2056350>)|HMBr57\s+Shell\s*</(?<X2125870>)|HOTMAIL\s*\(W33\.INFO\)\s*</title>(?<X2047070>)|HTTP\s+404\s+Not\s+Found\s*</title>[^`]{1,600}\$\w{1,40}\s*=\s*file_get_contents\(\s*['"](?:\.\./){5,9}?wp-config\.php['"](?<X2057310>)|Impots\.gouv\.fr\s*-\s*Accueil\s*</title>(?<X2047040>)|INBOX\s+(?:by\s+LiGeiRo(?<X2060780>)|To\s+All\s+-\s+MAILER\s*</t(?<X2122300>))|Indo(?:e?Xploit\s*<\/title>(?<X2048121>)|xploit(?<X2056380>))|jahat\s*</title>[^\)]{1,499}php_uname\(\)(?<X2058680>)|jawa\s*\w{0,5}.\w{0,5}\s*Shell\s*</title>(?<X2121900>)|K[a4]iz[e3]n\s+Sh[3e][l1]+(?<X2119680>)|kacak\s+shell\s*<(?<X2126180>)|L[0O]ck[3e]d\s+By\s+L[a4][7T]y[a4]\s*</(?<X2118151>)|M[4a][5s]+\s+[5s]h[3e][il1]+\s*</title>(?<X2124360>)|M[a4]iler(?:\s*BY\s*Th[e3]\s*M4RoC[o4]in\s*Ghost</title>(?<X2128281>)|\s+SQLC[A4]RD(?<X2059366>))|M[e3]g[a4]\W{0,3}M[a4][il1]{2}\s+v[\d\.]{1,4}\s*</(?<X2130800>)|madnet\s+pri(?:vate|8)\s+mail\W{0,9}worker(?<X2122410>)|Mailer\s+By\s+ME(?<X2054020>)|MakMan\s*[-\s]{0,3}\s*Root\s*Exploiter(?<X2051780>)|ManToed\s*Shell(?<X2051880>)|Mini(?:\s*Shell\s*(?:Moded|Coded)?\s*\w{0,9}\s*[&nbsp\|':\.,]{0,80}\s*(?:TiGER|Sl0vv)(?<X2051902>)|\s+(?:Web)?\s*shell(?:\s*by)?\b[^<]{0,40}</title>(?<X2131161>))|Mr\s*Secretz\s+Shell(?<X2052820>)|MulCiShell\s+v\d+\.\d+(?<X2124520>)|NIX\s+REMOTE\s+WEB-SHELL(?<X2059500>)|Not\s+Found\b[^\*%]{999,2500}\$\w{1,40}\s*=\s*['"]a:1:\{s:13:['"]administrator['"];b:1;\}['"];(?<X2122541>)|nShell\s+\w?\d+\.\d+(?<X2057020>)|nsT\s*View(?<X2057740>)|One\s+Drive\s+Cloud\s+Document\s+Sharing\s*</title>[^\n#\*\$%&\^@\[\]]{9,1999}>\s*Login\s+with\s+Office\s+365\s*</button>(?<X2132070>)|PHP[^>]+ExpDoor\.com(?<X2124860>)|PHP\s*(?:Jackal(?<X2056270>)|Shell\s*<\?(?:php)?\s*echo\s*(?:offend|attack|hack)(?<X2121880>))|PHP\s+(?:(?:Web\s+)?Shell\s+(?:Ver|version)?\s*[\d.]{1,3}[^<]{0,20}<(?<X2125541>)|sender\s*</title>[^\$]{1,99}\$manda(?<X2124730>))|priv(?:(?:8|ate)\s+home\s+root\s+uploader\s+by\s+mr\.\s*error(?<X2060790>)|8\s+Tools(?<X2051920>))|RST\s+MySQL\s*</(?<X2060611>)|s72\s*Shell[^\w](?<X2053491>)|Safe\s+Mode\s+Shell(?<X2053620>)|Santander\s*-\s*Internet\s+Banking\s*</title>(?<X2123710>)|Scan\s+Shell\s+v?\d+\.\d+\s*</title>(?<X2122340>)|Script\s+Reset\s*pass\s+(?:CP|Cpanel)(?<X1060860>)|Security007\s+webshell(?<X2056410>)|SexCrime\s*-\s*Shell(?<X2055790>)|Sign(?:\s*in\s*(?:-\s*Google\s+Accounts\s*</title>[^\?]{1,99}lecollagiste\.com/collanews/extlib/favicon\.php(?<X2124691>)|to\s*your\s*Microsoft\s*account\s*</title>(?<X2055726>))|\s+in\s*(?:-\s*Google\s+Drive</title>\s*<style>(?<X2052030>)|</title>(?:.{350}\s*<\s*script type\s*=\s*['"]\s*text/javascript\s*['"]>\s*function unhideBody\(\)(?<X2052050>)|\s*<meta\s+name\s*=\s*['"]description['"]\s+content\s*=\s*['"]outlook\.com\s+is(?<X2060311>)))|\s+in\s+to\s+your\s+account<[^:]{99,500}<link\s+rel\s*=\s*['"][^'"]*['"]\s+href\s*=\s*['"]https?://secure\.aadcdn\.microsoftonline-p\.com/ests/[^'"]+/favicon(?:_\w)?\.ico['"]>(?<X2119961>))|Sim\s*Shell\s*-?\s*Simorgh(?<X2053502>)|smoker\s*backdoor\s*</(?<X2133140>)|spyus\s*mailer\b[^<]{1,49}\bby\s*\W?\s*toolz\b[^<]{1,49}</title>(?<X2131520>)|SST\s*Sheller(?<X2057011>)|STNC\s+Web\s*Shell\b(?<X2125050>)|Symlink(?:(?:_|\s)\s*Sa\s+\w?\d+\.\d+(?<X2056830>)|\s*[^\w]*\s*(?:Auto)?\s+C\-?panel\s+Cracker(?<X2061912>))|SyRi[a4]N\s+[3E][l1][e3]c[t7]r[0o]nic\s+[A4]rmy\s+Sh[3e][l1]{2}\W{1,4}S[3E][4A]\s+Sh[3e][l1]{2}(?<X2118360>)|SYSTTEM(?:-|\s+)32\s*-\s*20\d{2}(?<X2062390>)|Tiagow?\s+Own[zs]\b(?<X2126230>)|To0?olz\s+\d+\s*-\s*Cyb3r-dz(?<X2054220>)|UnKnown\s*-\s*Simple\s*Shell</title>(?<X2120260>)|unzip\s*file\s*by\s*ahwak2000(?<X2058381>)|Up[1l][o0][a4]d[3e]r\s+by\s+[T7][0o]P-H[A4]CK[3E]R(?<X2065250>)|Upl[o0]ad[e3]r\s+by\s+[dzx]{0,2}\-?gh[o0]st(?<X2125790>)|Uploader\s+By\s+[^<]{2,40}</title>\s*</head>(?<X2127280>)|UTS\s+M[a4][5s]{2}\s+M[a4]i[1l][3e]r\s*</title>(?<X2065280>)|View\s*Document\s*-\s*Sign\s+In</title>\s*</head>\s*<script\s*type="text/javascript">\s*(?:<!--)?\s*function popupwnd\((?<X2052800>)|w&#101;&#108;&#108;s\s*f&#97;&#114;&#103;o\s*</title>(?<X2152851>)|Webshell\s+Mass\s+Checker\b(?<X2124400>)|Wordpress\s+Mass\s+(?:(?:Changer?|Password)\s*){2}</title>(?<X2130370>)|Wp\s*Mass\s*by\s*Rooted\s*Syntax\s*<(?<X2127321>)|Xai\s+Syndicate[^<]{0,99}<(?<X2119691>)|YAHOO\W{1,9}SIGN\s+IN\s*</(?<X2065511>)|YassineHd\s+File\s+Manager\b(?<X2118251>)|Yrid06\s*Shell(?<X2061610>)|ZeroByte(?:.|\s+)ID\s+PHP\s+Backdoor(?<X2062770>)|ZETHA\s+WEB\s*SHELL(?<X2056670>))|>\W*\w+\d+\W*\b(?:situs\s+toto|toto\s+togel)\b(?<X220365720>)|>\w+(?::[^%]{1,199}(Situs\s*(?:Toto)?)\s*Slot[^%]{1,199}</title>[^%]{1,2999}content=['"]\117(?<X220370520>)|[\h:]+\|[^/]{1,199}(?:Gacor|Ini)</title>[^@]{1,1999}meta\s+property=['"]og:\w+['"]\s+content=['"]\w+\s*SLOT\s*ONLINE[""]>(?<X220369761>)|togel(?::[^<]{0,99}</title>\s*<link[^>]{0,99}=['"]https://upload\.wikimedia(?<X220365730>)|[^<]{0,99}</title>\s*<link\s*\w+=['"]amphtml['"]\s*href=['"]https?://\w+\.pages\.dev/?['"]\s*/>(?<X220364140>)))|>\W\w\W</[^@]{99,1999}<input\b[^>]{1,99}\bvalue=['"][^'"]{1,9}\bSpam\s*Now\b[^@]{1,199}\bfunction\s+genrand?(?:om)?str(?:ing)?\([^\)]+\)\{\$\w{1,40}=['"][\w\.]{63,100}['"];(?<X2159340>)|>\W{0,20}\bN[3E]TW[A4]R\h+[S5]P[A4]MM[3E]R\W{0,20}</(?<X2161080>)|>\W{0,5}(?:OuNeT|ghost\h*spy)\W{1,5}\bshell\W{0,15}</title>(?<X2146181>)|>\W{0,6}(?:Chmod\h*X\h*BlackDeath|Akses\h*by\h*Chmod)\b(?<X2165851>))
<title(?:>\W{0,9}(?:\bx?GH[o0]st\h+x?(?:M[a@][i1]l|brut|cr[a@]ck)[e3]?r?\b(?<X2165051>)|DDOS\W{1,19}InCoders\b(?<X2120561>)|DESERTSUN\s+SERVER\s+CRASHER\W{0,9}</(?<X2124970>)|incr[30eo]{2}\.?([a4]tx)\W{1,6}Bl[a4]ck\.?\4\b(?<X2145950>)|M[il1]n[il1]\s*[5S]h[e3][il1]+\s+By\s[^\<]{1,99}</title>(?<X2128940>)|Php\h*Shell\h*v?\d+\.\d+\W{0,9}</title>(?<X2154550>)|Walkers404\sFile\s*Manager\W{0,9}</title>(?<X2135000>))|>\w{1,40}</title><form\s+enctype=multipart[^>]+method=post><input\s+name=\w+\s+type=file><input\s+type=submit\s+name=\w+>(?:\s*<br>\s*)+<input\s+name=path\s+type=text\s+value=<\?php\s+echo\s+@getcwd\h*\(\h*\)\h*;\s*\?>\s*/>(?<X2046721>)|>\|#\|\s*BW\s*Inbox\s*Mailer\s*\|#\|\s*</title>(?<X2047370>)|>A(?:b0110\s+rolex\s+replica\s+submariner\s+watch\s+valley</title>(?<X220345002>)|CEH4D[^<]{0,199}\bslot\s+gacor\b[^<]{0,199}</title>(?<X220346232>)|CEHBOLA[^&]{1,49}\bsitus\s+toto\s+slot\s+gacor[^<]{1,49}</title>\s*<link\s+rel=['"]\w+['"]\s*href=['"]https?://www\.dondecarlos\.com[^>]{1,19}>(?<X220344821>)|dvanced\s*Shell(?:\s*Access)</title>[^\176]{1,5999}function\s*\w+\((\$\w+)\)\s*\{\s*\$\w+[\s=]+['"]['"];\s*if\s*\(function_exists\(['"](system)['"]\)\)\s*\{\s*ob_start\(\);\s*\15\(\14\)(?<X220360890>)|nonymous\s+indonesia</title>(?<X220342450>)|ntarest\s+xpl01t</title>(?<X220332380>))|>b(?:374k\h*(?:[v\.\d]{1,9}\h*)?</(?<X2157770>)|\s+4ja\s+S!h\s+\-\s+<\?=\s+htmlspecialchars[^:]{1,499}:\w+['"]\s+content=['"]Devil\s+Mind['"]>(?<X220338030>)|ackdoor shell(?<X2051120>)|anca\s*Digital\s*</title>\s*<link\s*rel=['"]stylesheet['"]\s*type=['"]text/css['"]\s*href=['"]\./web/app\.css['"]>(?<X2208790>)|anco\h+de\h+Venezuela</title>(?<X2282151>)|ank\-id</title>\s*<link\s*rel[\s=]+['"]icon['"]\s*href[\s=]+['"]https?://[^/]+\.mzstatic\.com/image(?<X220345481>)|ank\s+spamming\s+tools</title>(?<X220340680>)|D\-XR(?:oo|00)T\s*(?:web)?shell[^<]{1,99}</title>(?<X220354300>)|dkr28\s+is\s+here</title>(?<X220342940>)|DKR\d+\h+\-?[\h\$S]+H3LL</title>(?<X220328940>)|LACK(?:PHOENIX\s+WEBSHELL</title>(?<X220370070>)|Tools(?:\.io)?\b\h+(?:[ex]?m[a4][i1]l|shell|brut|crack|upl)(?<X2167570>))|locked\h*\bBy\h*\bX\-5L0W(?<X2144590>)|OTEYE\b[^\.<>]{1,9}V\h*\d+\.\d+\b[^<]{0,40}</title>(?<X2179800>)|ypassServ\s+By\s+(?:Its_R00T</title>(?<X220334280>)|Unknownme69</title>(?<X220340000>)))|>C(?:[o0]nf[il1]g\s+F[u@]ck[e3]r\s+By[^/]{1,40}</title>(?<X2135090>)|ardiman\s+Asooooh(?<X2046781>)|arouseo\s+SSI\s+Shell</title>(?<X220370060>)|asper\s*webshell</title>(?<X220341010>)|hecking\b[^<]{0,99}\bhuman</title>[^@]{1,999}/cloudflare\-logo\-main\.png['"]>\s*<style>(?<X220358320>)|hedoya\h+cyber\h+team</title>(?<X220327381>)|r[a4]zy\s*H[a4]?ck\s*Team(?:\s*Shell)?</title>(?<X2156160>)|reated\h*\bBy\h*\bIndoxploit(?<X2144580>)|yber\h+Attack\h+System</title>(?<X2142500>))|>D(?:\.R\.S\s+Dz</title>(?<X2046630>)|arkStealth\s*shell</title>(?<X220341420>)|asha\s*\dx\s*Vinca</title>(?<X2128642>)|D[o0][s5]!?\h+(?:UD|TC)P\h+Fl[o0]{2}d[^/]{0,40}</title>(?<X2193160>)|irectory\s*Scanner\s*(?:and|&)\s*File\s*Creator</title>[^&]{1,3999}if\s*\(\$_SERVER\[['"]REQUEST_METHOD['"]\][\s=]+['"](POST)['"]\)\s*\{\s*\$(\w+)[\s=]+rtrim\(\$_\48\[['"]\49['"]\]\s*\?\?\s*['"]['"],\s*['"]/\\\\['"]\);(?<X220353180>)|ive\s+Shell(?<X2050980>)|r\.\s*[^/]{1,40}\s*file\s*manager</title><style>body\{(?<X2128370>))|>E(?:kin0x Shell(?<X2051010>)|x[a4][s5]\s+Sh[e3][l1]{2,}(?<X2119700>))|>F(?:[i1]l[e3]\s*Upl[o0][a4@]?d[e3]r!?\s*by\s*[e3][a4@]?gl[e3][^<>\n]*</title>(?<X2233804>)|adly\s*31337\s*SSI\s*Shell</title>(?<X220365342>)|ier+za(?:\s*e?)?Xploit</title>(?<X2215561>)|ile\h+Manager\h+Sederhana</title>(?<X220327023>)|ile\s+Manager\s+\|\s+Team\s+IT\s+Suka\s+Suka</title>(?<X220337100>)|oxAuto[^\w/]+\bV\d+\h*</title>\s*</head>(?<X2191280>)|oxDrop\s+File\s+Manager</title>(?<X220333150>)|reakzbrothers\h*\-\h*panel\s+login</(?<X2145880>)|ree\h*Spam\h*Tools?\b(?<X2166430>))|>g(?:33k\s*shell\b[^<]{0,32}</title>(?<X220349510>)|aLers\s+xh3LL\s+Backd00r</title>(?<X2046880>)|ood\h+bye\h+litespeed</title>[^\]]{1,999}\]\);\$\w+=\w+\(\w+\);\w+\s*\w+\((\$\w+)\)\s*\{\w+\s+\w+\(\66\);\}\w+\s*\w\(\66\)\{[^\.%]+\$_FILES\[['"]fileToUpload\b(?<X2325390>)|yokka\s+File\s+Manager\s+\-\s+Login</title(?<X220331210>))|>h(?:(?:[e3]x[1i]d|[o0]m[e3])\s+sh[e3]ll\s*</title>(?<X2226310>)|4CK3d\s+by\s+TechX011\s*\-\s*LulzSec</title>(?<X220361590>)|[A4]X+[O0]R\s+[^\s<>]{1,40}[^<>]{0,40}</title>(?<X2221920>)|acked(?: by NG689Skw</title><center>(?<X2045101>)|\h+by\h+MR\.green</title>(?<X2313490>)|\s+by(?:\s*\./[\w\-\.]+</title>(?<X220356291>)|\s+/Rayzky_\s*</title>(?<X220351392>)|\s+\-\s*yildirim\s+ordulari[^<]{1,99}</title>(?<X220342890>)|\s+Turkz\.org[^\?]{1,29}</title>(?<X220365110>)))|ackerAI\s*Shell[^&]{1,1999}phpversion\(\)[\s*\.\|'"]+get_current_user\(\)(?<X220353440>)|entai\h*c[0o]de\h*</title>[^\?]{0,599}<\?php\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^\?]{9,99}\b@?[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES(?<X2166721>))|>i(?:amH4CKEERRRRRRRRRRRS</title>(?<X220340271>)|NDOWIN\s*:\s*(?:link\s+login\s+situs\s+gacor\b|daftar\s+situs\s+gaming\s+slot\b)[^<]{0,99}</title>(?<X220349221>)|nfernalXploit\s+\-\s+Mass\s+File\s+Sender</title>(?<X220335480>)|ntrusion\h+exploit\h+shell</title>(?<X220329801>))|>JustBrain\s+Exploit</title>(?<X220333871>)|>K(?:A_uShell\h*\d{1,2}[^<]{0,9}</title>(?<X2141970>)|ID\s*-\s*Dr\.JEeNTeL\s*SheLL(?<X2050130>)|UCIYOSE\s+BACKDOOR\s+By\s+OBS</title>(?<X220369231>))|>Le(?:af\s+PHPMailer</title>(?<X2049780>)|onz\s+shell\s+login</title>(?<X220347031>))|>M(?:[a4@][s5][s5]\h*D[e3]f[a4]c[e3](?:r|\h*tools)(?<X2049392>)|ahkota118\s*:\s*[^<]{0,99}\bslot\s+gacor\b[^<]{1,99}</title>(?<X220339930>)|ail\s+form\s+HTML\s+v\d+[^<]+</title>(?<X2048000>)|ass\s*file\s*uploader</title>(?<X220341560>)|egawaty\s*File\s*Manager</title>(?<X220332940>)|ister\s+Spy</title>(?<X2051340>)|r[^<\n]{1,40}\s*Webshell[^<\n]{0,40}</title>(?<X2226300>)|rKaktus[\s/]*astroboy</title>(?<X220354750>)|ySQL\s*Web\s*Interface</title>\\n(?<X2127790>))|>Netflix</title>(?:[^@]{99,9999}<meta[^>]{1,99}\bcontent=['"]nflx://(?<X2152420>)|[^@]{999,19999}<input[^>]{1,499}\btype\h*=\h*['"]password['"](?<X2152402>)|[^\?]{9,999}<meta[^>]{1,99}\bcontent=['"][^'"]{0,99}\bhttps?://(?:www\.)?netflix\.com/(?<X2152440>)|\s*<[lms!/][^\`\\]{499,9999}<input[^>]{0,99}\bname=['"]?(?:is_)?cvv['"\s](?<X2159684>))|>o(?:ne\s+hat\s+cyber\s+team</title>(?<X220350790>)|VO88[^<]{1,99}\bsitus\s+slot\s+gacor[^<]{1,49}</title>(?<X220344140>)|wl\s+phpmailer[\s'";]+goto\s*\w+;\w+:(?<X2307660>)|YO88[^<]{1,99}\blink\s+situs\s+slot[^<]{1,99}</title>(?<X220344360>))|>p(?:[o0]wny[@\s]shell[^<]{0,9}</title(?<X2130510>)|a?wned\h+By\h+[ED]XPLOIT</title>(?<X2291090>)|anda\s+Webshell</title>(?<X220335070>)|ENIDABET\b[^<]{0,99}\btoto\s+togel\b[^<]{0,99}</title>(?<X220352614>)|EREBA_r0x(?<X2049850>)|hoe?nix\h+Mini\h+Shell</title>(?<X2148081>)|HP-FILES\.ME</title>(?<X2045810>)|hp\s*shell(?:\s+|\.)xyz</title>(?<X2128031>)|HP\s*WEB\s*Shell</title>[^@]{1,599}\$(\w+)[\s=]+\$\_POST\[['"]\115['"]\];[^%]{1,99}shell_exec\(\$\115\s*\.\s*['"]\s*2>&1['"]\)(?<X220353190>)|hpshell\.xyz[^/]{0,9}\bspyhackerz\.com\b(?<X2172610>)|riv(?:8|ate)!?\h+Up[l1!][o0][a4@]d(?:er)?\b(?<X2171870>)|ro\s*Mailer\s*V2</title>(?<X2045122>)|romo\s+Bonus\s+Slot\s+Gacor\s+profit303[^<]{1,29}</title>(?<X220346291>)|ropaganda\s+Mail!\s+v\d+(?<X2048910>)|wnd\s+by\s+(?:1337\s+BlackHat\s+Syndicate</title>(?<X220354280>)|Mr\.Agency</title>(?<X220361230>)|vinzxploit</title>(?<X220359380>)|Xjung2722</title>(?<X220355840>))|wned\s+(?:By\s+Mr\.Clay</title>(?<X220361600>)|SukaJanda01</title>(?<X220352810>)))|>QT777\s+link[^<]{0,99}\bslot\b[^<]{0,99}</title(?<X220358210>)|>R10TEXEC</title[^\?]{1,1999}\w+\s+=\s+php_uname\(\);\s+\$\w+\s+=\s+function_exists\(['"]posix_getuid(?<X220340320>))
<title(?:>se(?:curity\s+verification</title>\s*<link[^:]{1,32}://images\.icon\-icons\.com[^'"]{1,99}cloudflare_icon(?<X220338850>)|KOLAHTOTO[^<]{1,999}Togel\h+\w+</title>(?<X220334071>)|NA99\s*>\s*\bLogin\s+Agen\s+Situs\s+Slot\s+Online\s+Resmi\s+Terpercaya\s+Terlengkap\s+Gampang\s+Menang</title>(?<X220349770>)|nder Anonym Email :: FLoodeR :: SpameR</title>(?<X2044471>))|>sh(?:3ll\b[^</\n]{0,40}</(?<X2225870>)|ELL(?:\h+BEPASZ</title>(?<X220328171>)|\s+Login</title>[^!]{1,2399}!empty\((\$_POST\[['"]foldername)['"]\]\)\)\s+\{\s+mkdir\(\7(?<X220338000>)|\s+vinzxploite</title>(?<X220352791>)))|>Si(?:gn\s*in\s*to\s*your\s*account[^\176]{999,}<li>\s*<a>\s*&?copy;\s*\d{1,4}\s*Microsoft\s*</a>\s*</li>\s*</ul>\s*</footer>(?<X2132261>)|lent\s+killer\s+tool</title>(?<X220332340>)|mple(?:\h+PHP\h+Mysql\h+client\h*</title>(?<X2139231>)|\s+php\s+cmd\s+executor</title>(?<X220338600>)|\s+webshell</title>(?<X220351610>)))|>S(?:LOT777[^&]{0,49}\bsitus\s+toto\s+slot\s+gacor[^<]{0,49}</title>\s*<link\s+rel=['"]\w+['"]\s*href=['"]https?://cumaorangbiasa\.shop\b(?<X220345181>)|olevisible\s+hidden\s+shell</title>(?<X220340880>)|SI\s+W[e3]b[s5]h[e3]ll\b(?<X2228400>)|tamped\s+by\s+0x6ick(?<X220344290>)|ubscriptions\s*and\s*Billing[^<]{0,9}\bOfficial\s*Apple[^<]{0,9}\bSupport</title>(?<X2307841>)|ystem\s+preview\s*\-\s*<\?=\s*htmlspecialchars\(\$\w+\[['"]\w+['"]\]\)\s*\?></title>[^\\]{99,999}\bFilename</th>\s*<th>Size\b(?<X220342361>))|>T(?:34M_(?:3YE</title>(?<X220347760>)|C4RT3L</title>(?<X2319240>))|ampan\s*BlackHat\s*\-\s*Control\s*Panel</title>(?<X2263020>)|ERMINAL_ARCHITECT_v[\d\._]+ULTRA</title>(?<X220353780>)|GD\s+Team\s+donkey</title(?<X2135141>)|igerxcode\h+Shell</title>(?<X2323770>)|oto\d+\h+website\h+official\h+Pembangunan\h+Gedung\h+DPR\h+Anti\h+Korupsi</title>(?<X2307430>)|ouch(?:\s+by\s+legion\s+of\s+bekasirootsec</title>(?<X220359710>)|ed\s+By\s+RapperXploit</title>(?<X220353630>))|ryag\s+File\s+Manager</title>(?<X2049761>)|urki(?:c|sh)\s*Hackers?\s*Rulez</(?<X2131361>))|>Upl(?:[o0][a@4]d[e3]r!?\h+by\h+[^</\v]{1,40}</(?<X2169200>)|oader\s+By\s+IndoXploit(?<X2051630>))|>V(?:aRVaRa\s*Searcher</title>(?<X2044121>)|ivo500[^&]{1,49}\bsitus\s+slot[^<]{1,99}</title>(?<X220347070>)|uln!!\s+patch\s+it\s+Now(?<X2051421>))|>W(?:3LL\s+M!N!\s+SH3LL</title>(?<X2050590>)|eb\s*Login\s*Service\s*-\s*University\s*of\s*Florida</title>(?<X2048010>)|eb\s+Shell</title>[^\$]{1,499}if\(isset\((\$_POST\[['"]\w+['"]\])\)\)\{\s*system\(\39[^/]{1,99}if\(move_uploaded_file\(\$_FILES\[['"]\w+[^\$]{1,49}(\$\w+)\)\)\{\s*echo\s*['"]Uploaded:\s+\40['"];(?<X220365510>)|ebshell(?:\h+by\h+\w+</title>(?<X2281961>)|\s*\w+\s+Team</title>(?<X220334790>)|\s+GARUDAOFSECURITY</title>(?<X220335361>))|INNING303[^<]{0,70}\bsitus\s+slot\s+gacor[^<]{0,70}</title>(?<X220343740>)|P\h*Backdoor\h*User\h*v\h*<\?php\s*echo\b(?<X2193731>)|SO\-Like\s+Web\s*Shell</title>(?<X220335081>))|>x(?:NightR(?:oo|00)T\s*(?:File\s*Manager|shell|webshell)</title>(?<X220354290>)|VMpanel[\h\-]+Login</title>[^\^]{999,5000}(\$_POST\[[^\]]+\])[\h!=]+['"]delete['"][\s\)\{]+if[\h\(]+\49[\h=]+['"]chmod['"][\h\)]+\{(?<X220357460>))|>Y(?:ahoo</title>\s*<\s*meta http-equiv\s*=\s*['"]refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https://yahoo\.com['"]\s*>(?<X2052040>)|oCHI\s*Admin\s*Panel(?<X2233823>)|our\s*University\s*Grant\s*Information</title>(?<X2047881>))|>{0,99}(Sekabet|milanobet)\b[^<]{0,99}\54[^<]{0,99}</title>[^@]{1,999}://(?:\w+\.)?\54(?<X220359511>)|[^>]*>\s*WeTransfer\s*</title>[^,]{99,200}<script[^\.]{1,30}async\s*=\s*["'][^'"]*['"]\s+src\s*=\s*['"]./\w{1,20}/analytics\.js\.download(?<X2119941>)|[^>]{0,99}>(?:(?:federal\s*reserve\s*bank\s*of\s*new\s*york|log\s*in\s*(?:to\s*your\s*p[^\sy</]{1,19}yp[^\sl</]{1,19}l\s*[^\sc</]{1,19}ccoun|\|\s*smartshee)t|owa\s*outlook\s*\-\s*outlook\s*owa|n[^\st</]{1,19}tfiix\s*poland\-sign\s*in|copyright\s*\|\s*instagram|becu\s*online\s*banking)</title>(?<X2159404>)|\h*BDVenl[^n]+nea Personas\h*</title>(?<X2288751>))|[^>]{1,99}>((?:dinartogel|disinitoto|pututogel|Gedetogel))[^<]{1,70}</title>\s*<meta\s+charset=['"]utf\-8['"]\/>[^#]{1,199}\59(?<X220343880>)|[^\?>/]{0,99}>\s*QuixoticXploit\b[^>]{0,99}</(?<X2181093>)|\\>hackedbyserseridelikan\\</title\\>(?<X220343560>)|\b[^>]*>(?:[^</]{0,29}\./Fake\s*Root\b(?<X2201331>)|\W+Yah[o0]{2}\W+</title>[^\?]{1,9999}>\s*Sign\s+in\s+to\s+Yahoo!?\s+mail\s*<(?<X2203703>)|Sign\s*In\s*\W\s*Luno</title>(?<X2202811>)|Undangan\s+Gro?up\s+WhatsApp</title>[^@]{99,}<input\b[^>]*type=['"]?password\b(?<X2208242>)|Zimbra\s*Web\s*Client\s*(?:\W\s*)?Sign\s*In</title>(?<X2203892>))|\b[^>]{0,199}>(?:Avinash\s*Kumar\s*Thapa</title>[^#%:]{1,499}\b[cm]o(?:py|ve_uploaded_file)\(\$_FILES\[[^%:\?]{1,499}>Acid</marquee>(?<X2220300>)|Netflix\s*\S\s*Your\s*account\s*(?:has\s*been\s*)?\w+</title>[^\?]{0,499}<meta\b[^>]{0,199}\b[hc](?:ttp\-equiv=['"]?refresh|ontent=['"][^'"]+url=https?://[^/'"]{0,199}\bnetflix\.(?:com|fr|co\.uk|in|de))\b(?<X2213572>)|Office\s*365\s*(?:[^\s\w]{0,5}(?:One|live|Microsoft)</title>[^\?@]{99,4999}<input\b[^>]{0,99}\btype=['"]?password\b(?<X2213271>)|for\s*business</title>[^\?@\+%\*\\]{1,9999}<input\b[^>]{0,199}\btype=['"]?password\b(?<X2211601>)))|\b[^>]{0,49}>\s*Microsoft\b[^\?:=]{0,99}<meta\b(?:[^>/:;]{0,9}\b(?:http\-equiv[\s=]+['"]?refresh\b|content[\s=]+['"][0123][;\s]+url[\s=]+https?://ksquarecreators\.in/)){2}(?<X2221351>))
<title\b[^>]{0,99}>(?:(?:(?:(?:hsbc\s*uk\s*\-\s*personal\s*&|log\s*on\s*to|santander|personal)\s*online\s*bank|acceso\s*clientes,\s*)ing|tienda\s*online\s*de\s*correos|bienvenue\s*sur\s*facebook)</title>(?<X2165342>)|(?:(?:(?:s(?:tandard\s*bank|untrust)|natwest)\s*online\s*|login\s*online\-)banking|telus\s*\|\s*online\s*update\s*\|\s*verify\s*sitekey)</title>(?<X2148483>)|(?:(?:[^\so]{1,9}oinbase\s*\.com\s*login\s*\W\s*sign\s*on|bank\s*of\s*america\s*\W\s*credit\s*union)|[^\sm]{1,19}minio\s*login\s*\W\s*sign\s*in|rogers\s*yahoo\s*\W\s*sign\s*in|login\s*\W\s*nubank)</title>(?<X2240733>)|(?:(?:[^\w\s]{0,9}secure\.online\s*citi[^\w\s]{0,9}\s*client\s*logi|rbfcu:\s*online\s*banking\s*logo)n|#1\s*social\s*media\s*auto\s*poster\s*and\s*scheduler\s*\-\s*dlvr\.it|[^\w\s]{0,9}bancolombia\s*sucursal\s*virtual\s*personas[^\w\s]{0,9}|absa\s*bank)</title>(?<X2178042>)|(?:(?:[^a\s/<]{1,9}ank\s*of\s*[^m\s/<]{1,9}merica\s*\|\s*create\s*sitekey\s*challenge\s*questions\s*and\s*answer|amazon\s*\-\s*confirm\s*your\s*billing\s*adres)s|<title>login\s*authorization\s*failed\s*\|unathorized\s*access\.<\/title>|\(pl\)\s*log\s*in\s*to\s*your\s*account)</title>(?<X2158762>)|(?:(?:b(?:ank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*your\s*billing\s*inform|npparibas\s*net\s*identific)|south\s*state\s*bank\s*\|\s*profile\s*verific)ation|1&1\s*ionos\s*(?:e\-mail\s*login|webmail)|at&t\s*mail)</title>(?<X2166572>)|(?:(?:banking\s*&\s*insurance\s*for\s*individuals\s*and\s*professionals\s*\|\s*ing\s*belgiu|entrar\s*[^\si</t]{1,19}\s*instagra)m|hsbc\s*india\s*\-\s*credit\s*cards,\s*nri\s*services,\s*saving\s*and\s*deposit|at&t\s*yahoo\s*mail|login\s*\-\s*ionos)</title>(?<X2169912>)|(?:(?:betaalpas\s*\W\s*abn\s*amro\s*\W\s*online\s*een\s*vervangende\s*betaalpas\s*aanvrag|abn\s*amro\s*\W\s*(?:online\s*pincode\s*bijwerk|gegevens\s*invull))en|se\s*connecter\s*[^\s</tv]{1,19}\s*votre\s*compte\s*microsoft)</title>(?<X2167292>)|(?:(?:coinbase\s*[^\s</tb]{1,29}\s*buy\s*&\s*sell\s*bitcoin,\s*ethereum,\s*and\s*more\s*with\s*trus|[1il]nstagram\s*\W\s*objection\s*to\s*copyrigh)t|b(?:anco\s*de\s*la\s*provincia\s*de\s*buenos\s*aires\s*login|us+ines+\s*\W\s*[1il]nstagram)|anz\s*\W\s*internet\s*banking\s*log\s*on)</title>(?<X2183932>)|(?:(?:connexion\s*\W\s*la\s*banque\s*postal|post\s*office\s*login\s*pag)e|wells\s*fargo\s*\W\s*please\s*confirm\s*your\s*identity|excel\s*online\s*\W\s*secure\s*documents\s*sharing|mobile\s*banking\s*\W\s*login)</title><[lsm!/](?<X2171304>)|(?:(?:credit\s*unions\s*in\s*florida\s*\W\s*suncoast\s*credit\s*unio|bitcoin\s*wallet\s*from\s*blockchai)n|echtzeit\s*\W\s*[^\sb</t]{1,19}berweisung\s*\W\s*sparkasse\s*musterstadt|sign\s*in\s*\W\s*chase\s*bank|yahoo!\s*mail)</title><[!lms/](?<X2166293>)|(?:(?:currently\.com\s*\W\s*at&t\s*yahoo\s*email,\s*news,\s*sports\s*&\s*mor|personal\s*banking\s*\W\s*online\s*banking\s*\W\s*bbva\-reserv)e|spectrum\s*billing\s*information\s*verifications\s*process|verified\s*badges\s*\W\s*instagram\s*help\s*center)</title>(?<X2181572>)|(?:(?:docusign\s*electronic\s*signature\s*applicatio|gmail\s*logi)n|centurylink\s*verification\s*required|excel\s*online\s*\|\s*user\s*account)</title>(?<X2157733>)|(?:(?:eigenheim\s*\-\s*immobilie\s*finanzieren\s*\||internet\-filiale\s*\-)\s*sparkasse\s*musterstadt|b(?:uy\s*and\s*sell\s*bitcoin\s*online\s*\|\s*paxful|nl\s*\-\s*gruppo\s*bnp\s*paribas)|cr[^\sd</t]{1,19}dit\s*agricole\s*\-\s*banque\s*et\s*assurances)</title>(?<X2165502>)|(?:(?:enter\s*your\s*card\s*details|pay\s*your\s*council\s*tax)\s*\W\s*gov\.uk|(?:confirm\s*your\s*apple\s*id|manage\s*your\s*account)\s*\W\s*apple|(?:billing\s*details|register)\s*\W\s*my3)</title>(?<X2167692>)|(?:(?:facebook\s*hack\s*news\s*\|\s*how\s*to\s*hack\s*facebook\s*account\s*quickly\s*and\s*for\s*fre|c(?:hase\s*online\s*\-\s*get\s*identification\s*cod|itibank\s*onlin))e|ho(?:(?:w\s*to\s*hack\s*an\s*facebook\s*account\s*online\s*in\s*\d{4}\s*\|\s*facebook\s*hack\s*new|me\s*page\s*\|\s*barclay)s|stpoint\.ch))</title>(?<X2159182>)|(?:(?:huntington\s*national\s*bank\s*\-\s*step\s*\d+\s*verify\s*account\s*informat|reset\s*password\s*\-\s*meridian\s*credit\s*un)ion|l(?:loyds\s*bank\s*\-\s*personal\s*banking,\s*personal\s*finances\s*&\s*bank\s*accounts|ogin\s*\-\s*meridian\s*credit\s*union))</title>(?<X2169102>)|(?:(?:icici\s*bank\s*(?:\-\s*email\s*authent|online\s*verif)icat|first\s*tech\s*federal\s*credit\s*un)ion|log\s*(?:in\s*to\s*my\s*account\s*\|\s*american\s*express\s*us|on\s*to\s*online\s*banking)|dhl\s*express\s*\|\s*track\s*shipment)</title>(?<X2165952>)|(?:(?:insurance,\s*banking,\s*investments\s*&\s*retireme|confirm\s*your\s*accou)nt|(?:usaa\s*verificatio|enter\s*your\s*pi)n)\s*\|\s*usaa</title>(?<X2151324>)|(?:(?:itau\s*card\s*\|\s*promo[^\s</to]{1,39}o\s*descont..o\s*com\s*suas\s*milha|keybank\s*profile\s*and\s*preference)s|login\s*in\s*to\s*your\s*paypal\s*account|wells\s*fargo[^</tv]{1,19}verify\s*your\s*identity|bradesco\s*\-\s*cota[^\s</to]{1,39}o\s*de\s*plano|update\s*accounts\s*\-\s*paypal)</title>(?<X2162032>)|(?:(?:keybank\s*\|\s*banking,\s*credit\s*cards,\s*mortgages,\s*and\s*loan|fidelity\s*investment)s|(?:log\s*in\s*\|\s*my\s*account\s*\|\s*telus\.co|copyright\s*\|\s*help\s*instagra)m|einloggen\s*oder\s*neu\s*anmelden\s*\|\s*ebay)</title>(?<X2150613>)|(?:(?:keycredit\s*online\s*\W\s*banking,\s*credit\s*cards,\s*mortgages,\s*and\s*loan|bnp\s*paribas\s*banque\s*\W\s*acceder[^\s</tm]{1,19}mes\s*compte|payment\s*\W\s*usp)s|centre\s*de\s*s[^\s</tc]{1,19}curit[^\s</tw]{1,19}\s*webmail)</title>(?<X2173052>)|(?:(?:linktree\s*\W\s*blocked\s*accou|online\s*banking\s*enrollme)nt|completa\s*il\s*tuo\s*profilo\s*\W\s*intesa\s*sanpaolo|postfinance\s*for\s*private\s*customers)</title>(?<X2167492>)|(?:(?:log(?:in\s*\-\s*my\s*account\s*\-\s*telstr|\s*in\s*\-\s*bank\s*of\s*americ))a|getting\s*started\s*\-\s*online\s*enrollment\s*\-\s*chase\.com)</title>(?<X2151434>)|(?:(?:mon\s*easy\s*banking,\s*ma\s*banque\s*en\s*ligne\s*\|\s*bnp\s*paribas\s*forti|wells\s*fargo\s*mortgage,\s*auto,\s*banking\s*service)s|online\s*payment,\s*merchant\s*account\s*\-\s*paypal|instagram\s*help\s*center|log\s*in\s*instagram)</title>(?<X2157743>)|(?:(?:ncb\s*personal\s*online\s*banking\s*\W\s*internet\s*banking\s*logi|tangerine\s*bank\s*\W\s*change\s*questio)n|sign\s*in\s*(?:with\s*yahoo\s*account|\W\s*google\s*accounts)|raiffeisen\s*online)</title>(?<X2182312>)|(?:(?:payment|check\s*your)\s*details|welcome|about\s*the\s*TV\s*licen[sc]e\s*holder)\s*\-\s*Update\s*\-\s*TV\s*Licensing\b[^</\w]{0,19}</title>(?<X2166741>)|(?:(?:Paypal\s*safety\s*&\s*security|Yahoo!?\s*\-\s*login)|[\W\S]ank\s*of\s*[\W\S]merica\s*\|\s*create\s*sitekey\s*challenge\s*questions\s*and\s*answers)</title>(?<X2150635>)|(?:(?:security\s*question|email\s*detail)s\s*\|\s*usaa|update\s*accounts\s*\-\s*paypal)</title>(?<X2161852>)|(?:(?:sign\s*in\s*using\s*government\s*gateway\s*\-\s*gov\.u|erste\s*netban)k|log\s*on\s*to\s*online\s*banking|office\-?365\s*\|\s*login|[^\s\w]{1,4}\s*freexman\s*mailer\s*[^\s\w]{1,4})</title>(?<X2166392>)|(?:(?:sign\W*in\s*\W\s*)?appeal\s*to\s*the\s*tax\s*tribunal\s*\W\s*gov\.uk|wells\s*fargo\s*\W\s*identification\s*)</title>(?<X2181434>)|(?:(?:wells\s*fargo\s*online[^i</tn]{0,19}informatio|raiffeisen\s*bank\s*\-\s*logi)n|national\s*bank\s*online)</title>(?<X2166102>)|(?:(?:you\s*are\s*eligible\s*for\s*a\s*tax\-refund|(?:personal|card)\s*details|tax\s*refund\s*form|successfully)\s*\-\s*gov\.uk|aol\s*mail\s*login|banco\s*ita[^</\st]{1,19})</title><[lms!/](?<X2159603>)|(?:(westpac\s*online\s*banking)\s*\-\s*personal\s*banking\s*\-\s*\34|facebook(?:\s*\-\s*lepj\s*be,\s*vagy\s*regisztr[^l\s</t]{1,19}lj!?|\.com\s*\-\s*home)|raiffeisen\s*bank\s*\-\s*bejelentkezes|contact\s*information\s*\|\s*usaa)</title>(?<X2170352>)|(?:0range|activate\s*\W\s*myat\s*\W\s*t,sign\s*in|bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*log\s*in\s*\W\s*user\s*id|microsoft\s*\W\s*sign\s*in|netbank\s*\W\s*log\s*on\s*to\s*netbank|onedrive\s*file|region\s*bank\s*online\s*banking\s*\W\s*log\s*in)</title>(?<X2209132>))
<title\b[^>]{0,99}>(?:(?:<title>chase\s*personal\s*banking\s*investments\s*credit\s*cards\s*home\s*auto\s*commercial\s*small\s*business\s*insurance<\/title>|absa\s*(?:\|\s*overdraft\s*\|\s*banking\s*for\s*individuals\s*and\s*businesses|online))</title>(?<X2150653>)|(?:<title>chase\s*personal\s*banking\s*investments\s*credit\s*cards\s*home\s*auto\s*commercial\s*small\s*business\s*insurance<\/title>|bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*forgot\s*online\s*id\s*&\s*passcode)</title>(?<X2150605>)|(?:<title>dhl\s*\|\s*worldwide\s*delivery<\/title>|excel\s*online\s*\|\s*user\s*account|td\s*bank\s*online\s*banking|aol\s*mail\s*login|bulbank\s*online)</title>(?<X2158302>)|(?:[^\-<]{5,50}\-\s*(?:official)?\s*apple\s*support|quickbooks\s*login\s*\W\s*sign\s*in\s*to\s*access\s*your\s*account)</title>(?<X2281333>)|(?:[^\se]{1,9}emini\s*\W\s*login\s*\W\s*sign\s*in\s*\W\s*|c(?:[^\si]{1,9}inb[^\ss]{1,9}se\s*pro\s*login\s*\W\s*buy,sell\s*\W\s*spend\s*crypto\s*on\s*strikingly|oin[^\sa]{1,9}ase\s*\W\s*sign\s*in\s*\W\s*sign\s*\W\s*in\s*\W\s*)|e\-form\s*bank\s*BNI)</title>(?<X2249063>)|(?:[^\se]{1,9}emini\s*\W\s*login\s*\W\s*sign\s*in|dkb\s*\W\s*deutsche\s*kreditbank\s*ag|edd\s*prepaid\s*debit\s*card\s*\W\s*sign\s*in|loginatt\s*\W\s*at\s*\W\s*t|metam(?:[^\ss]{1,9}sk\s*\W\s*login|ask\s*login\s*\W\s*metamask)|sign\s*in\s*\W\s*microsoft\s*onedrive)</title>(?<X2238692>)|(?:[^\sm]{1,39}\s*\W\s*my\s*softbank\s*\W\s*[^\s]{1,59}|b(?:anco\s*hipotecario\s*argentina|rimo\s*\W\s*bank\s*bri)|santander\s*way\s*\W\s*resgatar\s*esfera|verif(?:ication\s*\W\s*lnstagram|y\s*your\s*card\s*\W\s*capital\s*one))</title>(?<X2218622>)|(?:[^\so]{1,9}oinbase\s*\W\s*sign\s*in|c(?:onsumer\s*payments\s*prepaid\s*card\s*\W\s*verify\s*your\s*identity|raigslist\s*\W\s*account\s*log\s*in)|facebook\s*[^\sl]{1,9}\s*log\s*in\s*or\s*sign\s*up)</title>(?<X2231212>)|(?:[^\so]{1,9}oinbase\s*pro\s*\W\s*(?:\W\s*login|login)|cb\s*\W\s*outlook\s*365\s*login|kr[^\sk]{1,9}ken\s*(?:\W\s*login|login\s*\W\s*log\s*in)|log\s*in\s*\W\s*sbc|scotiabank\s*\W\s*internet)</title>(?<X2238411>)|(?:[^\so]{1,9}oinbase\s*pro\s*\W\s*login\s*\W\s*sign\s*in|acceder\s*[^\sm]{1,9}\s*mes\s*comptes\s*\W\s*credit\s*agricole\s*centre\s*ouest|bank\s*of\s*america\s*\W\s*sign\s*in)</title>(?<X2218812>)|(?:[^\so]{1,9}oinbase\s*wallet\s*\*\s*login\s*\W\s*us\s*\W\s*us\s*\W\s*untitled|absa\s*(?:electronic\s*banking\s*services|internet\s*banking)|b[^\so]{1,9}ockchain\s*login\s*\W\s*sign[^\sn]{1,9}n\s*\W\s*create\s*account)</title>(?<X2248662>)|(?:[^\sp]{1,9}phold\s*\W\s*login\s*\W\s*login\s*to\s*my\s*account|gemin\s*login\s*\W\s*gemin\s*\W\s*login|log\s*in\s*\W\s*r[^\sb]{1,9}binhood[^\s]{1,9}|sign\s*in\s*to\s*id\s*\.me\s*\W\s*id\s*\.me)</title>(?<X2254822>)|(?:[^\sp]{1,9}phold\s*\W\s*login|(?:chase\s*)?(?:credit\s*\W\s*debit\s*card|email\s*account|pers?onal\s*information)\s*verf?ification\s*\W\s*chase\s*\.com|dropbox\s*\W\s*login)</title>(?<X2232353>)|(?:[^\sw]{1,79}\s*wallet\s*\W\s*\W\s*sign\s*in|at\s*\W\s*t\s*email\s*verification|irs\s*taxation\s*payment\s*\W\s*pointgenerating|metamask\s*login\s*\W\s*community\s*platform\s*\W\s*met[^\sm]{1,9}mask\s*login|wells\s*fargo\s*\W\s*enroll\s*in\s*wells\s*fargo\s*online)</title>(?<X2239222>)|(?:\(\d+\)\s*new\s*file\s*\W\s*dropbox\s*login\s*\W\s*sign\s*in\s*to\s*your\s*dropbox\s*to\s*view\s*the\s*document\W?|a(?:uthor\s*guidelines\s*\W\s*adobe\s*developer\s*connection|cedi\s*o\s*registrati\W\s*ebay)|bank\s*of\s*scotland\s*\W\s*mobile\s*banking\s*\W\s*login)</title>(?<X2173972>)|(?:\s*\W\s*banco\s*\W\s*nacional\s*de\s*costa\s*rica|lnstagram\s*destek|mediacom\s*login\s*my\s*account\s*\W\s*mediacom\s*webmail\s*login|security\s*question\s*\W\s*usaa|usaa\s*military\s*home,life\s*\W\s*auto\s*insurance\s*\W\s*banking\s*\W\s*investing)</title>(?<X2204882>)|(?:\s*\W\s*trust\s*wallet|banco\s*ita[^\sp]{1,9}\s*\W\s*paraguay|acesso\s*online\s*\W\s*net24\s*app)</title>(?<X2208913>)|(?:_?(?:trade\s*me\s*(?:\-\s*new\s*zealand\s*online\s*auctions\s*and\s*classifieds|secure\s*payment)|buy\s*online\s*and\s*sell\s*with\s*nz's\s*#1\s*auction\s*&\s*classifieds\s*site\s*\|\s*trade\s*me)_?|alaska\s*usa\s*federal\s*credit\s*union|tracking\s*made\s*easy[\s\.]{1,9}\|\s*dhl)</title>(?<X2175302>)|(?:a(?:(?:sb\s*bank\s*\W\s*personal\s*&\s*business\s*banking\s*in\s*new\s*zealan|rrange\s*a\s*redelivery\s*\W\s*royal\s*mail\s*group\s*lt)d|t&t\s*yahoo\s*mail\s*\W\s*login)|espace\s*client\s*:\s*accedez\s*[^\s<t/]{1,19}\s*vos\s*comptes\s*\W\s*boursorama\s*banque)</title>(?<X2180972>)|(?:a(?:bout\s*copyright\s*\W\s*facebook\s*help\s*center\s*\W\s*facebook|merican\s*express\s*\W\s*login)|login\s*on\s*facebook\s*\W\s*facebook|fedex\s*\W\s*tracking\s*system|paiement\s*s[^\s/<c]{1,19}curis[^\s/<to]{1,19}\s*ovh|identif[^\s/<c]{1,19}cate\s*en\s*ebay)</title>(?<X2163273>)|(?:a(?:c(?:c(?:eso:\s*cuentas\s*de\s*google|ueil\s*\|\s*identifiez\-vous)|esse\s*a\s*sua\s*conta\s*do\s*paypal))|bb&t\s*bank\s*\|\s*personal\s*banking,\s*business\s*banking,mortgages,\s*investments|cembra\s*money\s*bank)</title>(?<X2177603>)|(?:a(?:cc[^\ss]{1,9}s\s*lcl\s*\W\s*credit\s*lyonnais|t\s*\W\s*t\s*(?:\W\s*mail\s*\W\s*home|billing))|banca\s*online\s*para\s*particulares\s*\W\s*caixabank|cross\s*\W\s*border\s*banking\s*for\s*canadians\s*in\s*the\s*u\s*\.s\s*\.\s*\W\s*rbc\s*bank)</title>(?<X2211375>)|(?:a(?:cceder\s*\W\s*cursos\s*experto\s*instagram|nmelden\s*\W\s*my\s*upc)|cashapp\s*\W\s*account\s*verification|d(?:ebank\s*\W\s*official\s*airdrop|hl\s*\W\s*logistyka\s*globalna\s*i\s*transport\s*mi[^\sd]{1,9}dzynarodowy\s*polska))</title>(?<X2259072>)|(?:a(?:cceso\s*clientes\s*bankia\s*online|nmeldung\s*\-\s*raiffeisen)|confirm\s*your\s*personal\s*informations\s*paypal|<title>dhl\s*\|\s*worldwide\s*delivery<\/title>)</title>(?<X2158202>)|(?:a(?:cceso\s*seguro\s*a\s*linea\s*abierta|nmeldung\s*zum\s*digital\s*banking\s*\W\s*commerzbank)|facebook\s*\W\s*lepj\s*be,vagy\s*regisztr[^\sl]{1,9}lj\s*\W\s*|inicie\s*sesi[^\sn]{1,9}n\s*en\s*su\s*cuenta\s*de\s*microsoft|redelivery\s*\W\s*postoffice|vitejte\s*na\s*facebooku)</title>(?<X2207642>)|(?:a(?:ccount\s*verification\s*\W\s*paypal|merican\s*express\s*\W\s*don't\s*do\s*business\s*without\s*it)|email\s*login\s*page\s*\W\s*bt\s*email\s*login|login\s*\.microsoft\s*\.com|signin\s*tomicrosoftaccount|wells\s*fargo\s*create\s*new\s*password\s*\W\s*identification)</title>(?<X2217352>)|(?:a(?:ccueil\s*orange\s*mail|llegro\s*logowanie\s*\W\s*moje\s*allegro)|banking,\s*investing,\s*home\s*loans\s*\W\s*auto\s*finance\s*\W\s*ally|facebook\s*log\s*in\s*or\s*sign\s*up|gruppo\s*bper\s*\W\s*smart\s*mobile\s*\W\s*login|welcome\s*to\s*linkedin)</title>(?<X2205313>)|(?:a(?:cerca\s*de\s*wells\s*fargo|dministre\s*cuentas\s*con\s*la\s*banca\s*por\s*internet\s*wells\s*fargo\s*online[^\s]{1,9})|bouygues\s*telecom\s*\W\s*espace\s*client)</title>(?<X2214732>)|(?:a(?:d(?:obe\s*pdf\s*\W\s*sign\s*in|resse\s*best[^\st]{1,9}tigen\s*\W\s*die\s*post)|llianz\s*customer\s*portal|ol\s*\W\s*new\s*page|pple\s*findmy|t\s*\W\s*t\s*(?:mail\s*\W\s*at\s*\W\s*t\s*desk|upgrade)|uthentification\s*\W\s*orange\s*bank)|bank\s*of\s*montreal\s*online\s*banking)</title>(?<X2212062>)|(?:a(?:irdrop\s*\W\s*pancakeswap\s*cake\s*\W\s*exchange|ol\s*\W\s*login\s*to\s*aol)|bitcoin\s*exchange\s*\W\s*cryptocurrency\s*exchange\s*\W\s*binance|connect\s*wallet\s*\W\s*home\s*\W\s*wallet\s*connect\s*\W\s*gitbook)</title>(?<X2267391>)|(?:a(?:libaba[^/<tm]{1,9}manufacturer[^/<td]{1,9}directory[^/<ti]{1,9}\-[^/<ts]{1,9}suppliers,[^/<tm]{1,9}manufacturers,[^/<te]{1,9}exporters[^/<ti]{1,9}&[^/<ti]{1,9}importers|dobe:\s*creative,\s*marketing\s*and\s*document\s*management\s*solutions\.)|banc[^/<td]{1,9}de\s*credito\s*>>\s*bcp\s*>>)</title>(?<X2160912>)|(?:a(?:libaba\s*manufacturer\s*directory\s*\-\s*suppliers,\s*manufacturers,\s*exporters\s*&\s*importers|pple\s*\-\s*confirm\s*your\s*account|mazon\.com\s*billing\s*information)|bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*accounts\s*overview)</title>(?<X2160653>))
<title\b[^>]{0,99}>(?:(?:a(?:merica\s*first\s*credit\s*union\s*\W\s*utah\s*personal\s*and\s*business\s*banking\s*and\s*loan\s*services|rvest\s*\W\s*personal\s*\W\s*arvest\s*online\s*banking\s*\W\s*online\s*banking)|banco\s*do\s*brasil|citizens\s*\W\s*personal\s*\W\s*business\s*banking,student\s*loans,retirement)</title>(?<X2215362>)|(?:a(?:nz\s*internet\s*banking(?:\s*\-\s*logon)?|laska\s*usa\s*services\s*for\s*you|mazon\s*billing\s*center|ol\s*\-[^l</]{1,9}login)|<title>alaska\s*usa\s*services\s*for\s*you<\/title>)</title>(?<X2156363>)|(?:a(?:pple\s*\W\s*itunes\s*clients|tt\s*valid\s*verification\s*\W\s*linktree)|b(?:an(?:co\s*itau\s*\W\s*feito\s*com\s*voce|k\s*al\s*habib\s*ltd\s*\W\s*ibanking)|uy\s*and\s*sell\s*online\s*\W\s*amazon\s*pay))</title>(?<X2255852>)|(?:a(?:t(?:&t\s*security\s*server(?:\s*:\s*Login)?|tachments\s*\-\s*onedrive)|ppie\s*\-\s*update\s*your\s*lnformations)|dropbox\s*\|\s*sign\s*in\s*\-\s*secure\s*file\s*sharing\s*and\s*cloud\s*storage|blockchain\.com\s*wallet\s*\-\s*exchange\s*cryptocurrency)</title>(?<X2151115>)|(?:a(?:uthenticat(?:or\s*\-(?:\s*runescape\s*\|)?\s*old\s*school\s*runescape|ing\s*account\s*information)|mazon\s*\-\s*update\s*info)|banque\s*&\s*assurance\s*\-\s*cr[^\s</td]{1,19}dit\s*agricole)</title>(?<X2167482>)|(?:acc?ount\s*information\s*\W\s*m\s*\W\s*t\s*bank|internet\s*banking\s*fio\s*bank|oberbank\s*kundenportal|tele[^\so]{1,9}om\s*login|verifikasi\s*\W\s*facebook|bnp\s*paribas\s*\W\s*ma\s*banque\s*en\s*ligne|boa\s*\W\s*secure\s*access)</title>(?<X2207154>)|(?:acc[^\sd<t/]{1,19}der\s*[^\sm<t/]{1,19}\s*mes\s*comptes\s*\-\s*cr[^d\s</t]{1,19}dit\s*agricole\s*nord\s*de\s*france|internet\s*banking\s*\-\s*primabanka|log\s*on\s*to\s*online\s*banking|ch[^\ss<t/]{1,19}se\s*bank\s*\-\s*chase\.com)</title>(?<X2165132>)|(?:acce(?:de\s*a\s*creditos,\s*cuenta\s*corriente,\s*beneficios\s*y\s*m[^\st</s]{1,19}s\s*\W\s*banco\s*falabella|so\s*a\s*ita[^\s</t]{1,19}\s*personas)|b(?:b&t\s*\W\s*account\s*verification|anco\s*del\s*pacifico)|edd\s*debit\s*card\s*\W\s*(?:forgot\s*username|sign\W*in|verify\b[\w\s]{0,99}|(?:activate\s*)?my\s*card|email|security))</title>(?<X2182034>)|(?:acceso\s*\W\s*bbva\s*colombia|best\s*islamic\s*bank\s*in\s*the\s*uae\s*\W\s*dubai\s*islamic\s*bank|dropbox\s*sign\s*in|microsoft\s*\W\s*login\s*page|re\s*\W\s*confirmation\s*\W\s*american\s*express)</title>(?<X2216853>)|(?:acceso\s*banca\s*electr[^\sn]{1,9}nica\s*abanca|credit\s*unions\s*in\s*florida\s*\W\s*suncoast\s*credit\s*union|espace\s*client\s*\W\s*gerer\s*son\s*compte\s*\W\s*nickel)</title>(?<X2214222>)|(?:account\s*security\s*notification|navy\s*federal\s*credit\s*union\s*\W\s*(?:Banking\s*,\s*loans\s*,\s*mortgages?\s*&\s*credit\s*cards?|We\s*serve\s*where\s*you\s*serve\s*\W{0,19})|security\s*\|\s*help\s*instagram)</title>(?<X2171223>)|(?:account\s*summary\s*\W\s*m\s*\W\s*t\s*bank|confirm\s*your\s*account\s*\W\s*id\s*\.spectr[ou]m\s*\.net|la\s*banque\s*postale,citoyenne\s*\W\s*la\s*banque\s*postale)</title>(?<X2207513>)|(?:account\s*update\s*\W\s*amazon\s*sign\s*\W\s*in|ing\s*\W\s*banco\s*online\s*\W\s*do\s*your\s*thing|login\s*\W\s*(?:axie\s*infinity|tangerine)|societe\s*generale\s*\W\s*banque\s*et\s*assurance|welcome\s*to\s*atb\s*online)</title>(?<X2218992>)|(?:accueil\s*\|\s*credit\s*agricole|banco\s*de\s*oro|login\s*wirecard)</title>(?<X2173773>)|(?:activate\s*\W\s*linkedin\s*login,sign\s*in|internetove\s*bankovnictvi\s*\W\s*fio\s*banka|login\s*\W\s*american\s*express\s*card|outlook\s*web|profile\s*\W\s*american\s*express|verificaci[^\sn]{1,9}n\s*\W\s*netflix|yahoo\s*\W\s*mail\s*\W\s*the\s*best\s*web\s*\W\s*based\s*email\s*\W\s*)</title>(?<X2209412>)|(?:activation\s*du\s*dsp2\s*\W\s*banque\s*populaire|debank\s*\W\s*web3\s*app\s*portfolio\s*tracker|welcome\s*to\s*\W\s*[^\sn]{1,9}nb\s*finansbank)</title>(?<X2264152>)|(?:adobe\s*\W\s*online\s*pdf\s*reader|ems\s*portal\s*login\s*\W\s*smart,operational\s*guide\s*and\s*website\s*\W\s*cas\s*[^\sc]{1,9}\s*central\s*authentication\s*service)</title>(?<X2254902>)|(?:affordable\s*low\s*down\s*payment\s*mortgage\s*options\s*\W\s*chase\s*\.com|metamask\s*\W\s*recover\s*account|sign\s*in\s*(?:\W\s*chase\s*\.com|to\s*irs\s*forms\s*portal)|uk\s*post\s*office\s*\W\s*redelivery\s*service)</title>(?<X2208183>)|(?:airbnb\s*reviews\s*\W\s*log\s*in|log\s*in\s*to\s*\W\s*facebook|pnc\s*online\s*banking\s*\W\s*my\s*account|sparkasse\s*\W\s*produkte\s*und\s*services)</title>(?<X2205142>)|(?:akademia\s*esg\s*banku\s*bnp\s*paribas|maybank2u\s*\.com\s*\W\s*welcome|numero\s*securise\(certicode\)\s*\W\s*la\s*banque\s*postale|pages\s*\W\s*facebook\s*help\s*centre|sign\s*in\s*to\s*get\s*started\s*\W\s*id\s*\.spectr[uo]m\s*\.net)</title>(?<X2207504>)|(?:alaska\s*usa\s*federal\s*credit\s*union\s*\W\s*log\s*in|cibc\s*online\s*banking|guardtrack\s*\W\s*login|log\s*into\s*facebook|m(?:oderators\s*academy\s*\W\s*discord|y\s*files\s*\W\s*onedrive)|onedrive\s*login|swisscom\s*privatkunden\s*\W\s*mobile,tv,internet\s*\W\s*festnetz\s*\W\s*swisscom)</title>(?<X2204902>)|(?:alibaba\s*\.com\s*\W\s*manufacturers,suppliers,exporters\s*\W\s*importers\s*from\s*the\s*world's\s*largest\s*online\s*b2b\s*marketplace)</title>(?<X2255862>)|(?:amazon\s*\.com\s*update\s*account|o(?:ffice\s*365\s*\W\s*sign\s*in|nline\s*(?:\W\s*citizens\s*bank|banking\s*santander))|signin\s*\.att\s*\.com\s*\W\s*new\s*page|verification\s*\W\s*m\s*\W\s*t\s*bank|wells\s*fargo\s*bank\s*\W\s*financial\s*services\s*\W\s*online\s*banking)</title>(?<X2208942>)|(?:amazon\s*\W\s*sign\s*in|coinbase\s*pro\s*login|de\s*\W\s*mail\s*login|internetfiliale\s*\W\s*bw\s*\W\s*bank|login\s*to\s*student\s*finance\s*england)</title>(?<X2216862>)|(?:america\s*first\s*credit\s*union|focused\s*on\s*what\s*matters\s*\W\s*nbt\s*bank|identifiez\s*\W\s*vous\s*avec\s*votre\s*webmail\s*orange\s*\W\s*home|moje\s*ing\s*\W\s*ing\s*bank\s*[^\sl]{1,9}l[^\ss]{1,9}ski\s*\W\s*moje\s*ing)</title>(?<X2205323>)|(?:american\s*express\s*(?:\-\s*account\s*(?:verificatio|sign\s*i)n|credit\s*card)|banco\s*(?:del\s*pacifico\s*\-\s*iniciar\s*sesi|bhd\s*le)[^n/<t]{1,19}n|log\s*on\s*to\s*online\s*banking)</title><[lms!/](?<X2166813>)|(?:americanas\.com\s*\-\s*a\s*maior\s*loja\s*da\s*internet\s*com\s*os\s*menores\s*pre[^\s/<o]{1,19}os\s*do\s*mercado|(?:mbna\s*\-\s*enter\s*memorable\s*informatio|frontier\s*mail\s*logi)n|claim\s*your\s*refund\s*\-\s*gov\.uk|hanmail\s*email\s*settings)</title>(?<X2160523>)|(?:anmeldung\s*\W\s*swisspass|facebook\s*advertising\s*support\s*\W\s*meta\s*business\s*help\s*center|help\s*centre\s*\W\s*hsbc\s*uk|irs\s*\W\s*identity\s*verification|metamasks\s*\W\s*restore)</title>(?<X2237522>)|(?:anz\s*\W\s*internet\s*banking|banca\s*web\s*\W\s*banca\s*electronica|bmo\s*\W\s*verify\s*your\s*information|complete\s*redelivery\s*\W\s*australia\s*post)</title>(?<X2213503>)|(?:anz\s*personal\s*[^\sb]{1,9}\s*bank\s*accounts,\s*home\s*loans,\s*credit\s*cards\s*\W\s*more(?:\s*\W\s*anz)?|intuit\s*accounts\s*\W\s*sign\s*in|la\s*banque\s*postale\s*\W\s*banque\s*et\s*citoyenne\s*\W\s*la\s*banque\s*postale|office365\s*title\s*password\s*authorization)</title>(?<X2204853>)|(?:aol\s*\W\s*sign\s*in|m(?:eta(?:[^\sa]{1,9}ask\s*login\s*\W\s*metamask|mask\s*login\s*\W\s*metamask)|y\s*sunrise\s*l\s*sunrise\s*support))</title>(?<X2229973>)|(?:app\s*\W\s*nubank|bmo\s*\W\s*personal\s*banking,credit\s*cards,loans\s*\W\s*investing|cash\s*app\s*\W\s*sign\s*in\s*to\s*your\s*account|l(?:ive\s*\W\s*coinbase\s*admin|og(?:\s*in\s*\W\s*excel|in\s*\W\s*excel))|update\s*your\s*cox\s*billing\s*account\s*\W\s*cox\s*communications)</title>(?<X2205162>)|(?:appeal\s*request\s*\W\s*(?:authenticate\s*\W\s*|case\s*\W\s*\d+\s*\W\s*|reauthenticate\s*\W\s*|two\s*\W\s*factor\s*\W\s*)|docusign\s*\W\s*login|instagram\s*telif\s*hakki\s*[^\sh]{1,9}hlali)</title>(?<X2204813>)|(?:apple\s*pay\s*\|\s*sparkasse\s*musterstadt|banca\s*personas\s*\|\s*bac\s*credomatic|credit\s*cards\s*&\s*loans\s*\|\s*mbna|int_e_r\-n_+et_+b_anking\-+|log\s*into\s*my\s*vodafone)</title>(?<X2164513>))
<title\b[^>]{0,99}>(?:(?:arvest\s*portal\s*\W\s*login|breaking\s*\W\s*major\s*business\s*updates\s*and\s*analysis\s*\W\s*ifeednews|discord\s*\W\s*(?:signup|welcome)|excel\s*\W\s*sign\s*in|kucoin\s*\W\s*login|spotify\s*\W\s*web\s*player\s*\W\s*quran\s*for\s*everyone|welcome\s*\W\s*instagram\s*verified\s*badge)</title>(?<X2266332>)|(?:at(?:\s*\W\s*t\s*mail\s*service\s*\W\s*linkiee|t\s*\W\s*login\s*\W\s*page\s*\W\s*my\s*business)|binance\s*\W\s*cryptocurrency\s*exchange\s*for\s*bitcoin,ethereum\s*\W\s*altcoins|fuckbook\s*\W\s*connect\s*with\s*women\s*around\s*you\s*on\s*fuckbook)</title>(?<X2278352>)|(?:at\s*\W\s*t\s*\W\s*mail\s*\W\s*at\s*\W\s*t\s*\W\s*login|banka\s*inspirovan[^\sk]{1,9}\s*klienty\s*\W\s*raiffeisenbank|hmrc\s*\W\s*credit\s*\W\s*debit\s*card\s*information|login\s*to\s*your\s*account\s*\W\s*paxful)</title>(?<X2217843>)|(?:at\s*\W\s*t\s*mail\s*\W\s*login|bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*authorization\s*code\s*request)</title>(?<X2222183>)|(?:at\s*\W\s*t\s*mail\s*and\s*currently\s*\.com\s*\W\s*my\s*business|contact\s*us\s*\W\s*microsoft\s*support|l(?:nstagram\s*\W\s*verified\s*badges|ogin\s*snapchat)|w(?:allets\s*\W\s*walletconnect|ise\s*\W\s*connexion))</title>(?<X2227272>)|(?:at\s*\W\s*t\s*mail\s*support\s*\W\s*home|lnstagram\s*support\s*center|portal\s*f[^\sr]{1,9}r\s*privatkunden\s*\W\s*volksbank\s*raiffeisenbank|windows\s*security\s*\W\s*defender,antivirus\s*\W\s*more\s*\W\s*microsoft)</title>(?<X2204792>)|(?:atb\s*personal\s*banking|cibc\s*personal|dhl\s*sign\s*in|framegroep\s*\W\s*login|login\s*\W\s*dhl\s*ecommerce|mag[^\sn]{1,9}nszemelyek\s*\W\s*unicredit\s*bank|sign\s*in\s*to\s*office\s*365\s*teams)</title>(?<X2213982>)|(?:att\s*\W\s*login|copyright\s*\W\s*infringement|email\s*verification\s*[^\sw]{1,9}\s*wells\s*fargo|hancock\s*whitney\s*\W\s*online\s*banking|s(?:harepoint\s*fileshare\s*\W\s*linktree|wisspost))</title>(?<X2204922>)|(?:att\s*\W\s*sign\s*in|bilkent\s*university\s*webmail\s*\W+\s*welcome\s*to\s*bilkent\s*university\s*webmail|dhl\s*\W\s*confirmez\s*votre\s*paiement\W*|log\s*in\s*op\s*je\s*persoonlijke\s*my\s*t\s*\W\s*mobile\s*omgeving|permanent\s*tsb\s*online\s*banking|welcome\s*to\s*ebay\s*\W\s*sign\s*in)</title>(?<X2208173>)|(?:att\s*login\s*\|\s*att\s*email\s*&\s*webmail\s*login\s*\|\s*at\s*&\s*t\s*sign\s*in|(?:blue|verified)\s*badge\s*\|\s*instagram\s*help\s*center|facebook\s*\-\s*verifikasi\s*account|identifiant\s*\|\s*desjardins|cisco\s*webex)</title><[lms!/](?<X2177533>)|(?:australia\s*mypost\s*\W\s*pay\s*a\s*bill|google\s*pay\s*mobile\s*payments\s*\W\s*keybank|signout\s*\W\s*outlook)</title>(?<X2219503>)|(?:authent\s*forte\s*dsp2\s*par|verification\s*par\s*code)\s*sms\s*\-\s*cr[^\sd</t]{1,19}dit\s*agricole\s*brie\s*picardie</title>(?<X2172523>)|(?:autoatendimento\s*pessoa\s*f\s*\W\s*sica\s*\W\s*banco\s*do\s*brasil|banc(?:a\s*intesa\s*sanpaolo|o\s*bradesco\s*\W\s*entre\s*n[^\ss]{1,9}s,voc[^\sv]{1,9}\s*vem\s*primeiro))</title>(?<X2236542>)|(?:axis\s*bank\s*splash\s*2024\s*\W\s*register|banco\s*ita[^\sb]{1,9}\s*\W\s*banca\s*personas\s*\W\s*banco\s*ita[^\sb]{1,9}\s*colombia\s*\W\s*banco\s*ita[^\sb]{1,9}|ziraat\s*bankasi\s*\W\s*bankkart\s*ba[^\sv]{1,9}vurusu)</title>(?<X2290612>)|(?:azure\s*rtos\s*contact\s*us|copyright\s*center\s*\W\s*lnstagram|dhl\s*\W\s*best[^\st]{1,9}tigen\s*sie\s*ihre\s*zahlung\s*[^\w\s</]{0,19}|login\s*\W\s*td\s*canada\s*trust|p(?:assword\s*\W\s*ent\s*online\s*banking|ersonal\s*cloud\s*storage\s*[^\sm]{1,9}\s*microsoft\s*onedrive)|sign\s*in\s*onedrive)</title>(?<X2211764>)|(?:b(?:an(?:co\s*(?:av\s*villas\s*\-\s*banca\s*perso|origi)nal|kofamerica\s*\|\s*update\s*your\s*account)|illing\s*\-\s*my3)|a(?:bout\s*copyright\s*\|\s*help\s*center|cc[^\ss<t/]{1,19}s\s*cr\s*\-\s*credit\s*agricole)|[^b\s<t/]{1,19}berpr[^f\s<t/]{1,19}fen\s*sie\s*die\s*apple\s*id\s*\-\s*login)</title>(?<X2178592>)|(?:b(?:an(?:co\s*(?:popular\s*dominicano|de\s*c[^\sr</t]{1,19}rdoba)|escoonline\(bol\))|ci\s*internetbanking\s*(?:particulare|empresa)s|etaal\s*bevestiging)|acesso\s*celular\s*::\s*itaucard\s*::|claim\s*a\s*vehicle\s*tax\s*refund)</title><[lms!/](?<X2178053>)|(?:b(?:an(?:orte\s*\|\s*el\s*banco\s*fuerte\s*de\s*m..xico|que\s*populaire)|ienvenidos\s*a\s*la\s*banca\s*en\s*l[^n\s/<]{1,19}nea\s*\|\s*bbva\s*m[^x\s/<]{1,19}xico)|home\s*\-\s*(?:sbccp\s*\-\s*sociedade\s*brasileira\s*de\s*cirurgia\s*de\s*cabe[^a\s/<]{1,19}a\s*e\s*pesco[^\s/<ot]{1,19}osbccp|first\s*national\s*bank\s*\-\s*fnb))</title>(?<X2163105>)|(?:b(?:anca\s*intesa\s*sanpaolo\s*\-\s*conto\s*corrente\s*per\s*famiglie,\s*giovani\s*e\s*aziende|t\.com(?:\s*(?:business|log\s*in))?|ox\s*\|\s*login)|claim\s*your\s*\$\d{1,3}(?:\s*free)?\s*netflix\s*card)</title>(?<X2156814>)|(?:b(?:anco(?:lombia\s*(?:\W\s*sucursal|banca)|\s*de\s*credito\s*bcp)|nl\s*\W\s*mobile\s*banking)|_?a(?:rea\s*clienti\s*\W\s*hosting\s*aruba|nz\s*login.?)|connectez\s*vous[^</tv]{1,19}votre\s*compte\s*paypal)</title>(?<X2175833>)|(?:b(?:anco(?:lombia\s*sucursal\s*virtua1(?:\s*personas)?|1ombia\s*sucursa1\s*virtua1\s*personas)|illing\s*information\s*\-\s*paypal)|confirm\s*billing\s*information\s*\-\s*paypal)</title>(?<X2151273>)|(?:b(?:anco\s*bradesco\s*\W\s*pessoa\s*fisica,exclusive,prime\s*e\s*private|bva\s*net\s*cash)|citi\s*online|die\s*post\s*tracking[^\sr]{1,9}\s*results|login\s*\W\s*dhl\s*to\s*you\s*\W\s*member|office\s*365\s*\W\s*(?:inicio\s*de\s*sesi[^\sn]{1,9}n|sign\s*in\s*to\s*continue))</title>(?<X2206402>)|(?:b(?:ank\s*of\s*america\s*\W\s*event\s*registration\s*system\s*admin\s*portal|ome\s*international\s*plc\s*\W\s*personal\s*banking\s*\W\s*bank\s*accounts,credit\s*cards,home\s*loans(?:\s*\W\s*bome)?)|mashreq\s*online\s*banking|securipass\s*\W\s*ma\s*banque)</title>(?<X2230352>)|(?:b(?:anorte\s*\W\s*el\s*banco\s*fuerte\s*de\s*mexico|lockfi\s*login\s*[^\sb]{1,9}\s*blockfi\s*account\s*login)|coinbase\s*login|exodus\s*login|prihl[^\ss]{1,9}senie\s*do\s*internet\s*bankingu\s*\W\s*v[^\sb]{1,9}b\s*banka\s*\W\s*internet\s*banking)</title>(?<X2216672>)|(?:b(?:anque\s*et\s*assurance\s*credit\s*agricole\s*\W\s*servicesascamobi|illing\s*details\s*\W\s*royal\s*mail\s*group\s*ltd)|ing\s*login)</title>(?<X2181182>)|(?:b(?:ei\s*ihrem\s*microsoft\s*\W\s*account\s*anmelden|illing\s*informations\s*\W\s*mygov)|c(?:alifornia\s*edd\s*debit\s*card|hase\s*\W\s*online|itizens\s*bank\s*online|o(?:inbase\s*wallet\s*\W\s*remove\s*suspicious\s*applications|nfirma\s*sesi[^\sn]{1,9}n\s*en\s*tu\s*cuenta\s*microsoft)))</title>(?<X2212052>)|(?:b(?:ienvenue\s*sur\s*facebook\s*\W\s*connectez\-vous,\s*inscrivez\-vous\s*ou\s*d\Wc?ouvrez\W?|anco\s*bradesco\s*s\Wa)|c(?:onfirm\s*personal\s*information\s*\W\s*facebook\s*help\s*center|redit\s*swiss\s*\W\s*i?bank\s*login)|dhl\s*express\s*\W\s*verification)</title>(?<X2183462>)|(?:b(?:mo\s*banque\s*de\s*montr[^\s/<ta]{1,19}al\s*\-\s*services\s*bancaires\s*en\s*ligne|a(?:sic\s*file\s*mananger|nco\s*ita[^\s/<t]{1,19})|ejelentkez[^\s/<ts]{1,19}s\s*\-\s*google\s*accounts)|c(?:ibc\s*banking(?:\s*sign\s*on)?|laim\s*a\s*refund\s*\|\s*hmrc|urrently\.com\s*\-\s*home))</title><[lms!/](?<X2162256>)|(?:b[^\sm]{1,9}mcell\s*\W\s*tl\s*y[^\sk]{1,9}kle|excel\s*online\s*\W\s*secure\s*documents\s*sharing\s*|identifier\s*vous\s*avec\s*votre\s*compte\s*orange|mts\s*mail\s*\W\s*login|paiement\s*securise\s*\W\s*\W\s*chronopost)</title>(?<X2205464>)|(?:ba(?:[^\so]{1,19}\s*of\s*america\s*\W\s*o[^\si]{1,9}ii[^\si]{1,9}e\s*ba[^\so]{1,19}i[^\si]{1,9}g\s*\W\s*log\s*in\s*\W\s*user\s*id|nco\s*bradesco)|coinbase\s*pro\s*\W\s*login|dbs\s*bank\s*gold|(?:login|sign\s*in|\.\d*)\s*\W\s*aol)</title>(?<X2231003>)|(?:ba(?:n(?:co\s*ita[^\|\s<!]{1,9}\s*\|\s*o\s*que\s*voc[^\se<!]{1,9}\s*est[^\sb<!]{1,9}\s*buscando?|k\s*austria)|by\s*feeder\s*booster\s*seat\s*\|\s*ebay)|at&t\s*(?:\-\s*login\s*\-\s*home|login))</title>(?<X2148754>))
<title\b[^>]{0,99}>(?:(?:ba(?:nco(?:lombia\s*\W\s*desbloqueo\s*de\s*clave\s*din[^\s</tm]{1,19}mica|estado\s*personas)|rgeldloses\s*bezahlen\s*\W\s*online\s*shopping\s*\W\s*paypal\s*de)|log(?:\s*in\s*op\s*je\s*paypal\s*\W\s*rekening|in\s*\W\s*vodafone)|maersk\s*line\s*shipping\s*\W\s*b/l\s*&\s*shipping\s*documents|check(?:\s*\W\s*instagram|out\s*\W\s*ebay))</title>(?<X2185264>)|(?:bamvirtual\s*personas\s*\W\s*banco\s*agromercantil|c(?:ar(?:ousell\s*singapore\s*\W\s*buy\s*\W\s*sell\s*goods,cars,services\s*and\s*property|rinho\s*\W\s*boss\s*store\s*br)|on(?:firma[^\so]{1,19}o\s*de\s*recebimento\s*do\s*mercado\s*pago|nexion\s*[^\sl]{1,9}\s*la\s*banque\s*en\s*ligne)))</title>(?<X2225522>)|(?:ban(?:ca\s*web\s*\W\s*banca\s*electronica\s*de\s*banco\s*pichincha\W?|king\s*with\s*us\s*\W\s*online\s*banking)|c(?:hase\s*online\s*banking\s*\W\s*account\s*validation|opyright\s*center\s*\W\s*help\s*[1li]nstagram)|hsbc\s*\W\s*online\s*banking)</title>(?<X2169092>)|(?:ban(?:co\s*ita[^\s/<b]{1,9}\s*\-\s*feito\s*para\s*voc[^\s/<]{1,9}|k\s*of\s*guam)|confirmation\s*de\s*compte\s*\-\s*paypal\s*community)</title>(?<X2156653>)|(?:ban(?:co\s*nacional\s*de\s*costa\s*rica\s*\.inicio\s*de\s*sesion|k\s*of\s*america\s*\W\s*(?:log\s*in|online\s*banking\s*\W\s*log\s*in\s*\W\s*online\s*id))|pinduoduo\s*\W\s*together,more\s*savings,more\s*fun|sign\s*in\s*[^\sg]{1,9}\s*google\s*accounts|transferwise\s*\W\s*login)</title>(?<X2207653>)|(?:ban(?:k(?:\s*of\s*america\s*\W\s*banking,\s*credit\s*cards|ia\s*online\s*log\s*in)|ca\s*en\s*linea\s*\W\s*banco\s*general)|a(?:merican\s*express\s*\W\s*confirm\s*and\s*set\s*up\s*your\s*car|adobe\s*document\s*clou)d|covid\-19\s*stimulus\s*check\s*registration)</title>(?<X2175312>)|(?:ban(?:k\s*of\s*america\s*\-\s*confirm\s*your\s*credit\s*card\s*\W?|co\s*ita[^\s/<t]{1,19}\s*\|\s*todo\s*para\s*ti)|a(?:(?:ol\s*my\s*account\s*\-|mazon)\s*sign\s*in|rc\s*internet\s*banking)|excel\s*online\s*(?:\-\s*purchase\s*order\s*preview|\|\s*user\s*account))</title>(?<X2159273>)|(?:ban(?:que\s*\-\s*banque\s*en\s*ligne\s*\-\s*la\s*banque\s*postale\s*[^\sl<!]{1,19}\s*la\s*banque\s*postale|orte\s*\|\s*el\s*banco\s*fuerte\s*de\s*m[^\sx<!]{1,19}xico)|asb\s*bank\s*\-\s*log\s*in)</title><[/lms\!](?<X2150149>)|(?:banc(?:a\s*(?:p(?:ersonal\s*\W\s*banco\s*scotiabank\s*rep[^\sb<t/]{1,19}blica\s*dominicana|or\s*internet\s*\W\s*interbank)|online\s*ing)|o\s*bpm\s*\W\s*conti,\s*mutui,\s*carte,\s*prestiti\s*e\s*assicurazioni)|at&t\s*\W\s*sign\W?in)</title>(?<X2174785>)|(?:banca\s*m\s*p\s*s|customer\s*success\s*in\s*our\s*email\s*solutions\s*\W\s*mimecast|forget\s*password\s*\W\s*dhl\s*to\s*you\s*\W\s*member|inicia\s*sesion\s*en\s*tu\s*cuenta\s*de\s*microsoft|mi\s*account\s*\W\s*sign\s*in|security\s*checkup\s*\W\s*facebook)</title>(?<X2204862>)|(?:banca\s*mediolanum\s*s\s*\.p\s*\.a\s*\.\s*\W\s*accesso\s*clienti)</title>(?<X2258202>)|(?:banco(?:\s*(?:d(?:o\s*brasil\s*\-\s*p[^\s/<g]{1,19}gina\s*inicial\s*\|\s*voc[^\s/<t]{1,19}|e\s*la\s*naci[^\s/<n]{1,19}n\s*\-\s*multired\s*virtual)|ita[^\s/<\-t]{1,9}\s*\-\s*feito\s*pra\s*voc[^\s/<t]{1,19}|av\s*villas)|estado\s*personas\s*\|\s*banca\s*en\s*l[^\s/<n]{1,19}nea)|aol\.com\s*\-\s*welcome\s*to\s*aol)</title>(?<X2149554>)|(?:banco(?:\s*de\s*credito\s*\W\s*\W\s*bcp\s*\W\s*\W\s*|lombia\s*\W\s*panel\s*informativo)|cred(?:em\s*home\s*banking|ito\s*pessoal\s*\W\s*santander\s*way))</title>(?<X2239352>)|(?:banco\s*(?:ita[^\s</tr]{1,19}\s*\W\s*rela[^\s</t]{1,49}es\s*com\s*investidores|de\s*credito\s*[^\w\s]+\s*bgp\s*[^\w\s]+)|\w{1,40}\s*airport\s*(?:\W\s*)?sign\s*in|a(?:dministra\s*tu\s*id\s*de\s*app[1li]|ccount\s*home\s*\-\s*appl)e|excel\s*online\s*\W\s*secure\s*documents\s*sharing|connexion\s*[^\w\s]+\s*snapchat)</title>(?<X2180611>)|(?:banco\s*cuscatlan|connexion\s*[^\sv]{1,9}\s*votre\s*espace\s*client\s*\W\s*credit\s*mutuel|masuk\s*(?:ke\s*facebook|pusat\s*bantuan\s*\W\s*facebook)|netflix\s*(?:[\w\s]+)?[^\sw]{1,9}\s*watch\s*tv\s*(?:programme|show)s\s*online,watch\s*(?:films|movies)\s*online\b[^/>]{0,49})</title>(?<X2205054>)|(?:banco\s*d(?:e\s*la\s*naci[^\sn/<]{1,9}n\s*\-\s*multired\s*virtual|o\s*brasil(?:\s*\-\s*auto\s*atendimento)?)|autoatendimento\s*pessoa\s*f[^\ss/<]{1,19}sica\s*\-\s*banco\s*do\s*brasil)</title><[!lms/](?<X2150017>)|(?:banco\s*ita[^\sm/<t]{1,9}\s*\W\s*mobile\s*\-\s*cartoes\s*\-\s*consulte\-sua\-fatura\-acesso\s*\-\s*feito\s*para\s*voc[^\s</t]{1,9}|a(?:uthentification\s*\-\s*acc[^\sd</t]{1,19}der\s*[^\s/<tm]{1,19}\s*mon\s*compte\s*\|\s*bred|ccueil\s*chronopost\.fr)|centurylink\s*[^s\s</t]{1,29}\s*secure\s*login)</title>(?<X2158932>)|(?:banco\s*ita[^\ss]{1,9}\s*\W\s*servi[^\so]{1,9}os\s*\W\s*comprovantes\s*\W\s*email\s*\W\s*feito\s*para\s*voc[^\st]{1,9}|f(?:acebook\s*\W\s*log\s*masuk\s*atau\s*daftar|tx\s*us)|kantonalbank\s*\W\s*home|m(?:obile\s*banking\s*\W\s*accesso|y\s*account\s*apple)|orange\s*\W\s*login)</title>(?<X2208362>)|(?:banco\s*macro\s*\W\s*banca\s*internet\s*personas|adobe\s*account\s*(?:[^\s\w]\s*)?login|s(?:ign\s*in\s*to\s*your\s*account\s*\W\s*office365|trato\s*kunden\s*\W\s*login\s*\W\s*schneller\s*zugang\s*zu\s*ihren\s*produkten))</title>(?<X2215593>)|(?:bancolombia\s*\W\s*sucursal\s*virtual|d(?:e\s*\W\s*ups|hl\s*\W\s*gpi)|leboncoin\s*\W\s*connexion|multifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|uphold\s*(?:\W\s*login\s*\W\s*login\s*\W\s*uphold\s*on\s*strikingly|login\s*\W\s*login\s*on\s*strikingly))</title>(?<X2254372>)|(?:bank\s*millennium\s*sa\s*\W\s*internetowe|ihr\s*online\s*\W\s*banking\s*muss\s*aktualisiert\s*werden\s*\W\s*psd2\s*\W\s*eu\s*\W\s*richtlinie|postin\s*palvelut\s*henkil[^\sa]{1,9}asiakkaille\s*\W\s*posti|send\s*money,pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\W\s*paypal\s*ca)</title>(?<X2206382>)|(?:bank\s*of\s*america\s*(?:[^\s/<b]{1,9}\s*banking,\s*credit\s*cards,\s*mortgages\s*and\s*auto\s*loans|login\s*&\s*sign\s*in\s*to\s*online\s*banking\s*\|\s*tmb|\|\s*online\s*banking\s*\|\s*your\s*information)|c(?:enturylink\s*\|\s*login|apital\s*one))</title>(?<X2149545>)|(?:bank\s*of\s*america\s*(?:\W\s*online\s*banking\s*\W\s*sign\s*[1li]n\s*\W\s*online\s*[1li]d|\W\s*banking,\s*credit\s*cards,\s*loans\s*and\s*investing)|sign\s*in\s*to\s*bank\s*of\s*america\s*online\s*&\s*mobile\s*banking\s*to\s*manage\s*your\s*accounts)</title>(?<X2148406>)|(?:bank\s*of\s*america\s*\-\s*banking,\s*credit\s*cards,\s*home\s*loans\s*and\s*auto\s*loans|equa\s*bank)</title>(?<X2151424>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*update\s*your\s*account|(?:Security\s*)?bug\s*bounty\s*\W\s*discord|verification\s*\W\s*fifth\s*third\s*bank)</title>(?<X2207133>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking\s*\|\s*(?:forgot\s*online\s*id&passcode|confirmation)|a(?:t&t\s*(?:\W\s*account\s*activity|residential)|ggiorna\s*informazioni\s*\W\s*ubi\s*banca)|24\s*horas\s*\W\s*ita[^</t\s]{1,19})</title>(?<X2181172>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking|pt\s*\.bank\s*rakyat\s*indonesia\(persero\)\s*tbk\s*\.)</title>(?<X2218023>)|(?:bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*sign\s*in\b[^/<]{0,49}|acceder\s*[^/t<v]{0,19}\s*votre\s*compte\s*en\s*ligne\s*\|\s*cibc|excel\s*online\s*\-\s*secure\s*documents\s*sharing|outlook\s*\|\s*office\s*365|wetransfer\s*pro)</title>(?<X2179382>)|(?:bank\s*of\s*america\s*banking\s*credit\s*cards\s*loans\s*and\s*merrill\s*investing|coinbase\s*\W\s*sign\s*in|firstbank\s*puerto\s*rico\s*\W\s*log\s*in|login\s*(?:\W\s*credit\s*suisse\s*direct\s*\W\s*csx|into\s*your\s*outlook\s*webapp\s*account)|member\s*account\s*login\s*\W\s*usaa)</title>(?<X2208342>)|(?:bank\s*of\s*america\s*debit\s*card\s*\W\s*sign\s*in|(?:edd|new\s*jersey)\s*debit\s*card\s*\W\s*(?:2\s*\W\s*step\s*verificati?on|security\s*information)|join\s*the\s*moderator\s*(?:team\s*)?\W\s*discord|panam\s*post)</title>(?<X2205354>)|(?:bank\s*of\s*baroda|help\s*and\s*support\s*center\s*\W\s*ups\s*\W\s*united\s*states|login\s*\W\s*(?:deutsche\s*telekom|swisspass)|verify\s*your\s*identity\s*\W\s*national\s*bank)</title>(?<X2229963>))
<title\b[^>]{0,99}>(?:(?:banking,auto,loans,credit\s*cards,mortgages\s*\W\s*rbfcu\s*\W\s*texas|hong\s*kong\s*paypal\s*\W\s*login\s*interface|login\s*to\s*customer\s*portals\s*and\s*tools\s*\W\s*dhl\s*\W\s*|my\s*unitccredit\s*banking|office365\s*account|verified\s*emails\s*account|yahoo\s*mail\s*[^\sh]{1,9}\s*home)</title>(?<X2217822>)|(?:banking\s*services\s*for\s*wealth\s*management\s*\W\s*chase\s*uk|dana\s*\W\s*dompet\s*digital\s*indonesia|paypal\s*\W\s*sie\s*m[^\ss]{1,9}ssen\s*sich\s*verifizieren\s*\W\s*|sky\s*\W\s*sign\s*in)</title>(?<X2249352>)|(?:bbpeoplemeet\.com\s*\W\s*the\s*big\s*and\s*beautiful\s*dating\s*network|quick,easy,and\s*secure\s*login\s*with\s*nord\s*account\W?|mbna\s*\W\s*welcome\s*to\s*internet\s*banking|sign\s*in\s*\W\s*strato\s*webmail|anz\s*\W\s*my\s*account)</title>(?<X2168202>)|(?:benefits\s*online\s*\W\s*login|kucoin\s*login\s*\W\s*access\s*your\s*account\s*easily|s(?:ign\s*in\s*your\s*aol\s*account\s*\W\s*home|tate\s*bank\s*of\s*india\s*\W\s*pan\s*update)|wells\s*fargo\s*[^\so]{1,9}\s*online\s*banking,credit\s*cards,loans,mortgages\s*\W\s*more)</title>(?<X2257051>)|(?:benvenuto\s*su\s*ebay\s*\W\s*accedi|girokonto\s*er[^\sf]{1,9}ffnen,g[^\sn]{1,9}nstige\s*kredite,sparen\s*und\s*anlegen\s*\W\s*postbank|sign\s*in\s*\W\s*chase\s*online|wells\s*fargo\s*\W\s*account\s*authentiction)</title>(?<X2207024>)|(?:bienvenido\s*a\s*tu\s*banca\s*online|citadele\s*internet(?:\s*bank|ipank)|das\s*online\s*\W\s*portal\s*der\s*sbb\s*f[^\sr]{1,9}r\s*zug\s*und\s*[^\sv]{1,9}v\s*\W\s*sbb|faysal\s*bank\s*internet\s*banking|log\s*on\s*to\s*personal\s*internet\s*banking\s*\W\s*username\s*\W\s*hsbc)</title>(?<X2228492>)|(?:binance\s*\W\s*dex\s*trading\s*\W\s*decentralized\s*exchange\s*\W\s*binance\s*\.org|enroll\s*in\s*online\s*banking\s*\W\s*verify\s*account\s*\W\s*m\s*\W\s*t\s*bank|sign\s*in\s*\.shaw)</title>(?<X2207663>)|(?:bittrex\s*global\s*\W\s*log\s*in|l(?:nterac\s*e\s*\W\s*transfer|og\s*in\s*\W\s*tangerine)|onedrive\s*sign\s*in|rbc\s*royal\s*bank\s*[^\s]{1,9}\s*secure\s*sign\s*in|webmail\s*login\s*\W\s*ionos)</title>(?<X2211165>)|(?:blackboard\s*learn|absa\s*e\-receipts?|emaii\s*securlty|0utl[o0]{2}k|RBC\s*Royal\s*bank|Apple\s*\-\s*MyApple\s*ID|Sign\s*in\s*\|\s*Scotiabank)</title>(?<X2163876>)|(?:bnp\s*paribas\s*securite\s*\W\s*assistance|argenta\s*bankieren|dhl\s*\|\s*email\s*login|vous\s*avez\s*re[^u\s</t]{1,19}u\s*des?\s*(?:l'argent|fonds\s*\W\s*paypal\s*france))</title>(?<X2178982>)|(?:buscar\s*mi\s*iphone\s*de\s*icloud|checking,savings,mortgages\s*\W\s*loans\s*\W\s*bethpage\s*federal\s*credit\s*union|discord\s*moderators\s*academy|microsoft\s*\W\s*\W\s*onedrive|portal\s*de\s*negocia[^\so]{1,19}o\s*\W\s*bradesco|wells\s*fargo\s*advanced\s*access\s*code)</title>(?<X2205132>)|(?:business\s*bank\s*\W\s*your\s*business\s*matters\s*\W\s*bendigo\s*bank|i\s*\W\s*bank|k(?:aznapro\s*\W\s*banking,credit\s*cards,loans\s*and\s*merrill\s*investing|ey\s*bank\s*login\s*[^\sw]{1,9}\s*www\s*\.key\s*\.com\s*[^\sw]{1,9}\s*key\s*bank\s*online\s*sign\s*in)|orange\s*bank)</title>(?<X2240092>)|(?:c(?:[^\si]{1,9}inbase\s*pr[^\si]{1,9}\s*l[^\si]{1,9}gin\s*\W\s*digital\s*asset\s*exchange|odeatnow\s*\W\s*netflix\s*landing\s*page)|log\s*on\s*to\s*netbank|met[^\sm]{1,9}m[^\ss]{1,9}sk\s*l[^\sg]{1,9}g[^\sn]{1,9}n\s*\W\s*the\s*crypto\s*wallet\s*for\s*defi,web3)</title>(?<X2239722>)|(?:c(?:anada\s*revenue\s*agency\s*\-\s*validate\s*your\s*identity|ommbox\s*login)|microsoft(?:\-windows\-official\s*services\w{0,5}|\s*\-\s*official\s*home\s*page)|s(?:ign\s*in\s*to\s*your\s*account\s*\|\s*ebay|lgn\s*ln\s*outlook)|dhl\s*express)</title><[lms!/](?<X2160053>)|(?:c(?:apital\s*one\s*credit\s*cards,\s*bank,\s*and\s*loans\s*\W\s*personal\s*and\s*business|opyright\s*[^\sl1i<t/]{1,19}\s*[li1]nstagram)|(?:lloyds\s*\W\s*mobile\s*banking\s*|adobe\s*document\s*)\W\s*login|indentifiez\-vous\s*avec\s*votre\s*compte\s*orange\W?)</title>(?<X2173542>)|(?:c(?:art[^\se]{1,9}es\s*hipercard|redit\s*card,mortgage,banking,auto\s*\W\s*chase\s*online)|e(?:bay\s*shipping\s*security|mpresas\s*\W\s*bbva\s*espa[^\sa]{1,9}a)|fedex\s*\W\s*verify\s*your\s*informations[\s\.]*|log\s*in\s*\W\s*ent\s*online\s*banking)</title>(?<X2210574>)|(?:c(?:h(?:ristian\s*mingle\s*\W\s*login)|ua\s*personal\s*banking\s*\W\s*bank\s*accounts,\s*credit\s*cards,\s*home\s*loans)|home\s*\W\s*btconnect|my\s*telus\s*\W\s*log\s*in\s*to\s*manage\s*your\s*telus\s*account\s*\W\s*telus)</title>(?<X2204834>)|(?:c(?:hase\s*bank\s*\-\s*information\s*verified|onnexus\s*credit\s*union)|b(?:radesco\s*seguros\s*\-\s*sa[^\sd</t]{1,19}de|mo\s*bank\s*of\s*montreal)|acc[^\sd</t]{1,19}der\s*[^\sm</t]{1,19}\s*mes\s*comptes\s*\-\s*cr[^\sd</t]{1,19}dit\s*agricole|dhl\s*\-\s*besta[^\s/t<]{1,19}tige\s*deine\s*zahlung\.?)</title>\s*<(?:[ms!/]|link\s*[^>]{5})(?<X2159473>)|(?:c(?:hase\s*online\s*\-\s*(?:(?:full\s*log\s*on\s*identificatio|logging\s*i)n|customer\s*center|done\s*!)|redit\s*card,\s*mortgage,\s*banking,\s*auto\s*\|\s*chase\s*online\s*\|\s*chase\.com)|dhl\s*\|\s*(?:tracking|ezybill))</title>(?<X2149573>)|(?:c(?:hase\s*online\s*\W\s*confirm\s*your\s*identity|onferma\s*dati\s*\W\s*che\s*banca)|b(?:ank\s*of\s*america\s*[^b/<t]{1,29}\s*banking,|usiness\s*online\s*\W\s*westpac)|zoosk,\s*the\s*romantic\s*social\s*network\s*(?:\([^\)/<]{0,19}\))?|fifth\s*third\s*bank)</title>(?<X2171632>)|(?:c(?:heck\s*your\s*phone\s*\W\s*log\s*on\s*\W\s*vanguard|oin[^\sa]{1,9}ase\s*\W\s*sign\s*in)|digibank\s*\W\s*login|gemini\s*\W\s*sign\s*in|login\s*\W\s*log\s*in\s*kucoin|metamask\s*login\s*\W\s*login|r[^\sb]{1,9}binhood\s*\W\s*login\s*\W\s*r[^\sb]{1,9}binhood\s*\W\s*login)</title>(?<X2234602>)|(?:c(?:o(?:mplete\s*\|\s*tangerine|nfirm\s*banking\s*info)|art..es\s*de\s*d..bito\s*\|\s*netbanco)|e(?:xcel\s*online\s*\-\s*secure\s*documents\s*sharing|asyweb\s*login)|my\s*account\s*login\s*\-\s*optus|apple\s*\-\s*my\s*id\s*apple)</title><[lsm!/](?<X2172494>)|(?:c(?:on(?:nect\s*with\s*earthlink\s*\|\s*verify\s*your\s*billing|firmation\s*\|\s*tangerine)|heckout\s*\-\s*xuperweb|etelem\s*\|\s*login)|<title>(?:dhl\s*\|\s*worldwide\s*delivery|mot\s*de\s*passe\s*\-\s*paypal)<\/title>|bred\s*\-\s*banque\s*et\s*assurance)</title>(?<X2158042>)|(?:c(?:onfirm\s*your\s*(?:personal|card)\s*information\s*\-\s*chase\.com|redit\s*card\s*login\s*\|\s*discover\s*card)|bank\s*of\s*ireland\s*365\s*online\s*\|\s*login\s*\-\s*step\s*\d+\s*of\s*\d+)</title>(?<X2179392>)|(?:c(?:onsulte\s*sua\s*fatura\s*\W\s*cart[^\so]{1,9}o\s*credicard|redit\s*agricole\s*bank\s*polska\s*s\s*\.a\s*\.)|dhl\s*\W\s*potvr[^\st]{1,9}te\s*svou\s*platbu\s*\.|erhalt\s*einer\s*sendung\s*\W\s*dhl\s*express\s*\W\s*adressbest[^\st]{1,9}tigung|home\s*\W\s*cart[^\so]{1,9}o\s*luiza)</title>(?<X2215182>)|(?:c(?:ontact\s*information\s*\W\s*navy\s*federal\s*credit\s*union\s*membership\s*verification|redit\s*card\s*\W\s*chase\.com)|l(?:og\s*in\s*[kj]e\s*rekening\s*paypal\s*anda|inkedin\s*\W\s*log\s*in\s*or\s*sign\s*up)|inland\s*revenue\s*\W\s*tax\s*return|home\s*\W\s*netflix)</title>(?<X2182302>)|(?:c(?:opyright\s*notice\s*\|\s*help\s*instagram|hase\s*secure\s*protection\s*online)|bank\s*of\s*america[^/<tb]{1,19}banking\s*,\s*credit\s*cards\s*,\s*mortgages\s*and\s*investing|halifax\s*\-\s*mobile\s*banking\s*\-\s*login|account\s*verification\s*\|\s*hsbc)</title>(?<X2163442>)|(?:c(?:urrently\.com\-\s*at&t\s*yahoo\s*email,\s*news,\s*sport\s*&\s*more\s*\-\s*login\s*screen|hase\s*online\s*\-\s*confirm)|gmx\s*\-\s*mein\s*gmx|dhl\s*express)</title><[lms!/](?<X2158773>)|(?:ca(?:ixa\s*autoatendimento|pital\s*one\s*shopping|rt[^\so]{1,9}o\s*de\s*credito\s*\W\s*credicard)|die\s*post\s*\W\s*best[^\st]{1,9}tigen\s*zahlung|edd\s*home\s*\W\s*home|facebook\s*\W\s*appeal\s*form|interbank\s*te\s*da\s*la\s*bienvenida\s*\W\s*interbank\s*per[^\s]{1,9})</title>(?<X2211362>)|(?:ca(?:pital\s*one\s*branch,atm\s*&\s*caf[^\sl</t]{1,19}\s*location\s*finder)|facebook\s*\-\s*meld\s*je\s*aan\s*of\s*registreer\s*je|excel\s*online\s*\-\s*secure\s*documents\s*sharing|dhl:\s*login)</title>(?<X2159633>))
<title\b[^>]{0,99}>(?:(?:l(?:inkedin\s*india\s*\W\s*log\s*in\s*or\s*sign\s*up|og\s*in\s*\W\s*shopify)|member\s*account\s*\W\s*usaa|paypal\s*\W\s*confirm\s*your\s*account|verify\s*identity\s*\W\s*onedrive\s*secure\s*file|wells\s*fargo\s*\W\s*(?:email\s*verification|please\s*confirm\s*your\s*identity))</title>(?<X2223922>)|(?:l(?:loyds\s*bank\s*\-\s*welcome\s*to\s*internet\s*banking|iberbank\s*\-\s*banca\s*a\s*distancia\s*login)|internal\s*revenue\s*service)</title>(?<X2148463>)|(?:l(?:og(?:in\s*\|\s*(?:carrefour|tangerine)|\s*in\s*\|\s*at&t)|loyds\s*bank\s*\-\s*mobile\s*banking\s*\-\s*login)|kindly\s*update\s*your\s*0ptimum\s*billing\s*service)</title>(?<X2156634>)|(?:l(?:og\s*(?:in(?:\s*to\s*my\s*account\s*\|\s*american\s*express\s*us|[^\sm<t]{1,29}my\s*virgin\s*media)|on\s*to\s*online\s*banking\s*:\s*username\s*\|\s*hsbc)|nstagram\s*blue\s*tick\s*form)|g(?:mx:\s*e\-mail\-adresse,freemail,de\-mail\s*&\s*nachrichte|oogle\s*drive\s*:\s*sign\-i)n|facebook\s*\|\s*(?:inicia\s*sesi[^\s<tn]{1,19}n\s*o\s*registrate|help\s*center))</title>(?<X2178082>)|(?:l(?:og\s*(?:in\s*to\s*(?:your\s*paypa|mybel)l|on\s*to\s*online\s*banking)|loyds\s*bank\s*\-\s*mobile\s*banking\s*\-\s*phone\s*number|nstagram\s*help)|m(?:ortgages\s*\|\s*natwest\s*premier|essagerie\s*\-\s*orange\s*mail)|natwest\s*\|\s*login)</title>(?<X2176892>)|(?:la\s*banque\s*postale\s*\-\s*banque\s*et\s*assurance\s*en\s*ligne\s*[^\s/<tl]{1,19}\s*la\s*banque\s*postale|internet\-filiale\s*\-\s*sparkasse\s*jena\-saale\-holzland|online\s*banking\s*\|\s*bank\s*of\s*montreal|sign\s*in\s*to\s*webmail\s*\|\s*cogeco|user\s*account\s*\|\s*eawibp)</title>(?<X2158563>)|(?:la\s*banque\s*postale\s*\W\s*espace\s*client|multifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|royal\s*bank\s*of\s*canada|steam\s*workshop\s*\W\s*\W\s*awp\s*\W\s*ancient\s*heritage|trezor\s*suite\s*app(official)\s*\W\s*set\s*up\s*your\s*trezor\s*\.io)</title>(?<X2273372>)|(?:lo(?:g(?:\s*in\s*\W\s*office|in\s*\.live\s*\W\s*microsoft)|ttery\s*\W\s*pancakeswap)|m(?:etamask\s*extension\s*\W\s*your\s*gateway\s*to\s*decentralized\s*finance|ultifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|y\s*netzero\s*sign\s*in\s*\W\s*netzero))</title>(?<X2258082>)|(?:Lock|hack|cod)ed\W?\s*by\b[^/]{0,99}\bindonesian\s*error\s*system</title>(?<X2165860>)|(?:log(?:\s*(?:in\s*t(?:d\s*bank|o\s*my3)|on\s*to\s*online\s*banking)|in\s*\-\s*my3)|facebook\s*\-\s*[^n\s</t]{1,19}ng\s*nh[^p\s</t]{1,29}p\s*ho[^c\s</t]{1,29}c\s*[^n\s</t]{1,49}ng\s*k[^i\s</t]{1,29}|mijn\s*login\s*regiobank|instagram\s*copyright)</title>(?<X2165772>)|(?:log(?:\s*(?:in\s*to\s*your\s*account\s*\|\s*facebook|on\s*\|\s*desjardins)|in\s*to\s*instagram\s*to\s*continue)|o(?:g[^\s/o<t]{1,19}oszenia\s*\-\s*sprzedam\s*,\s*kupi[^\s/n<t]{1,19}\s*na\s*olx\.p|range\s*\|\s*espace\s*client\s*voca)l)</title>(?<X2177322>)|(?:log(?:\s*[io]n\s*to\s*personal\s*internet\s*banking|in\s*onboarding\s*\|\s*bbva\s*per[^/\s<t]{1,19})|direct\s*pay\s*\|\s*internal\s*revenue\s*service|navy\s*federal\s*credit\s*union\s*signin|email\s*login\s*\-\s*mweb|at\s*&\s*t\.net)</title>(?<X2163012>)|(?:log(?:\s*in\s*\|\s*western\s*union|in\s*\|\s*immowelt)|p(?:hishing\s*simulator|nc\s*online))</title>(?<X2157543>)|(?:log(?:\s*on\s*to\s*online\s*banking\s*:\s*with\s*secure\s*key\s*log\s*o|i)n\s*\W\s*hsbc|keybank\s*\W\s*banking\s*,\s*credit\s*card\s*,\s*mortgages\s*,\s*and\s*loans|paypal\s*\W\s*confirm\s*identity)</title>(?<X2180992>)|(?:log(?:in\s*(?:\-\s*(?:postbank\s*banking\s*&\s*brokerage|spotify)|sunrise\s*mail)|\s*in\s*to\s*my\s*delta)|m(?:ise\s*a\s*jour\s*de\s*securit[^\|\s</]{1,9}\s*\|\s*bnp\s*paribas|yaccount\s*\-\s*apple))</title>(?<X2148845>)|(?:log\s*(?:in\s*\-\s*(?:anmelden\s*bei\s*ebay\s*kleinanzeigen\.|entra\s*\-\s*intesa\s*sanpaolo)|in\s*with\s*western\s*union\s*in\s*the\s*united\s*states)|o(?:ffice\s*365\s*document\s*\|\s*log\s*in|nedrive\s*online\s*security\s*for))</title>(?<X2157123>)|(?:log\s*[oi]n\s*to\s*online\s*banking|s(?:ign\s*in\s*to\s*your\s*m[^\sc/<]{1,9}crosoft\s*account|tripe\s*\-\s*profile)|rabobank\s*\-\s*particulieren|keybank\s*online)</title>(?<X2156993>)|(?:log\s*in\s*\W\s*att|metamask\s*\W\s*airdrop|personal\s*\W\s*santander\s*uk|s(?:ell\s*your\s*home\s*fast\s*ohio\s*\W\s*dynamic\s*home\s*buyers\s*\W\s*we\s*buy\s*houses\s*fast\s*\W\s*|ign\s*in\s*\W\s*sky\s*mail)|telegram\s*\W\s*cikgu\s*viral\s*melayu|yahoo\s*\W\s*mailservice)</title>(?<X2254712>)|(?:log\s*in\s*\W\s*forum\s*decorators[^\sw]{1,9}wordpress|neteller[^\ss]{1,9}security\s*check|red\s*label\s*aidan\s*e\s*blue\s*men\s*casual\s*shoes\s*8\s*uk(8599131)\s*\W\s*amazon\s*\.in\s*\W\s*office\s*products|wells\s*fargo\s*\W\s*verification)</title>(?<X2288522>)|(?:log\s*in\s*to\s*(?:my\s*account\s*\W\s*american\s*express\s*u|fidelity\s*investment)s|ing\s*belgium\s*\W\s*rekeningnummer\s*verificatie|mobile\s*banking\s*login\s*\W\s*huntington\s*bank|pakete\s*versenden\s*\W\s*die\s*post\W?)</title>(?<X2182572>)|(?:log\s*in\s*to\s*your\s*paypa\s*account|m(?:\s*\.facebook\s*\.com\s*\W\s*login\s*to\s*continue\s*\.|icrosoft\s*\W\s*offici[^\sl]{1,9}le\s*startpagina)|office\s*365\s*login\s*\W\s*microsoft\s*office|(?:quick\s*check[^\sc]{1,9}\s*)?credit\s*card\s*eligibility\s*checker\s*\W\s*capital\s*one\s*canada)</title>(?<X2210453>)|(?:log\s*on\s*to\s*online\s*banking\s*with\s*password\s*\|\s*hsbc|jpmorgan\s*\|\s*email\s*settings|identif[^/<tc\s]{1,19}cate\s*en\s*ebay|sberbank\s*online)</title>(?<X2163452>)|(?:log\sin\s*\W\s*excel\s*sheet|m(?:eta[^\sa]{1,9}ask\s*login\s*\W\s*m[^\st]{1,9}tamask\s*l[^\sg]{1,9}gin|y\s*files\s*\W\s*\W\s*onedrive\s*\W\s*)|navy\s*federal\s*credit\s*union\s*\W\s*login|onlinebanking\s*\W\s*businessnet\s*login\s*\W\s*anmeldung\s*\W\s*bank\s*austria)</title>(?<X2248193>)|(?:login\s*(?:\.yahoo\s*\W\s*my\s*business|in\s*to\s*your\s*western\s*union\s*ch\s*profile)|managed\s*cloud\s*hosting\s*platform\s*simplified\s*\W\s*cloudways|micosoft\s*\W\s*login|schedule\s*a\s*redelivery\s*\W\s*usps)</title>(?<X2220384>)|(?:login\s*(?:\W\s*(?:anz\s*internet\s*banking|microsoft\s*365)|screen\s*\W\s*at\s*\W\s*t)|sign\s*in\s*\W\s*at\s*\W\s*t|update\s*your\s*wellsfargo\s*account\s*\W\s*resolve\s*help|wells\s*fargo\s*(?:\W\s*verify\s*identity|enter\s*your\s*security\s*questions))</title>(?<X2222002>)|(?:login\s*[^\st]{1,9}\s*tinker\s*federal\s*credit\s*union|pa(?:ge\s*regulatory\s*documents\s*\W\s*banco\s*itau|iement\s*en\s*cours\s*\W\s*leboncoin)|ton\s*\W\s*the\s*open\s*network|u(?:phold\s*login\s*\W\s*sign\s*in\s*your\s*account|sa\s*uphold\s*\W\s*login))</title>(?<X2276822>)|(?:login\s*\.bol\s*\.com|m(?:elden\s*sie\s*sich\s*bei\s*ihrem\s*microsoft\s*\W\s*konto\s*an|icrosoft\s*(?:hesabinizda\s*oturum\s*a[^\si]{1,9}in|sign\s*in\s*\W\s*playtika))|national\s*westminster\s*bank;card\s*services,banking\s*\W\s*loans)</title>(?<X2225502>)|(?:login\s*\W\s*anmelden\s*bei\s*kleinanzeigen|n(?:dax[^\sl]{1,9}\s*login\s*\W\s*canada's\s*most\s*secure\s*crypto\s*exchange|etflix\s*brasil\s*\W\s*assistir\s*series\s*online,assistir\s*filmes\s*online)|rackspace\s*webmail\s*\W\s*hosted\s*email\s*for\s*business)</title>(?<X2297272>)|(?:login\s*\W\s*charles\s*schwab|nordea\s*\W\s*identifis?ering|online\s*login\s*\W\s*citizens\s*bank|r(?:aiffeisenbank\s*pfaffenhofen\s*a\s*\.d\s*\.glonn\s*eg\s*\W\s*startseite|bfcu\s*\W\s*sign\s*in)|facebook\s*\W\s*verifikasi)</title>(?<X2206203>)|(?:login\s*to\s*view\s*document\s*\W\s*wetransfer|[li1]nstagram\s*\W\s*copyright|navy\s*federal\s*credit\s*union\s*membership\s*application|parcel\s*details\s*\W\s*royal\s*mail\s*group\s*ltd|rbc\s*bank\s*\W\s*online\s*banking)</title>(?<X2182042>)|(?:m&t\s*bank\s*\-\s*personal\s*&\s*business\s*banking,\s*mortgages,\s*&\s*more\s*\|\s*m&t\s*bank|pay\s*for\s*goods\s*and\s*shop\s*online\s*globally\s*\-\s*paypal\s*india|k(?:tb\s*netbank\s*:\s*internet\s*banking|eybank\s*online)|sign\s*in\s*\-\s*onedrive|orange\s*\-\s*contact)</title>(?<X2159292>)|(?:m&t\s*bank\s*\-\s*personal\s*&\s*business\s*banking,\s*mortgages,\s*loans\s*&\s*investments|personnal\s*banking\s*\|\s*sign\s*on|icloud\s*\-\s*find\s*my\s*iphone)</title>(?<X2167942>))
<title\b[^>]{0,99}>(?:(?:cart[^\so]{1,9}o\s*de\s*credito\s*\W\s*ban_co\s*i__t\s*\.a[^\st]{1,9}|join\s*the\s*hypesquad|let's\s*verify\s*your\s*citi\s*account\s*email\s*address\s*\W\s*citibank|net?flix\s*\W\s*watch\s*tv\s*(?:show|programme)s\s*online,watch\s*(?:movie|film)s\s*online|sign\s*on\s*to\s*your\s*citi\s*account\s*\W\s*citibank)</title>(?<X2205063>)|(?:chainlink\s*wallet\s*\W\s*link\s*wallet\s*\W\s*best\s*chainlink\s*wallet|mbank\s*serwis\s*transakcyjny|natwest\s*online\s*\W\s*bank\s*accounts,mortgages,loans\s*and\s*savings\s*\.|santander\s*\W\s*quita[^\so]{1,19}o\s*online|welcome\s*to\s*cimb\s*clicks\s*malaysia)</title>(?<X2226212>)|(?:change\s*your\s*contact\s*information\s*[^\sst/<]{1,29}\s*step\s*1|account\s*(?:restored|disable)|sign\s*on)\s*\|\s*cibc\s*online\s*banking</title>(?<X2149564>)|(?:charles\s*schwab\s*brand\s*portal|discord\s*\W\s*hypesquad|excel\s*online\s*spreadsheet[\s\W]+sign\s*in|home\s*\W\s*bt\s*email\s*login\s*page|ita[^\sc]{1,9}\s*cons[^\sr]{1,9}rcios\s*\W\s*cons[^\sr]{1,9}rcio\s*digital|log\s*in\s*\W\s*robinhood)</title>(?<X2210463>)|(?:chase(?:\s*bank\s*\-\s*credit\s*card,\s*mortgage,\s*auto,\s*banking\s*services|\.com)|find\s*a\s*chase\s*atm\s*or\s*branch\s*near\s*you\s*\|\s*chase\s*bank|update\s*your\s*account\s*\-\s*chase\s*online|sign\s*in\s*\-\s*chase(?:\.com)?[\.,]{0,2})</title>(?<X2148426>)|(?:chase\s*(?:bank\s*\-\s*synchronize\s*your\s*email|online\s*\-account\s*update)|(?:instagram\s*[^\s/<tml]{1,9}(?:\s*mail)?|office365\s*\|)\s*login|facebook\s*[^\s/<tz]{1,29}\s*zaloguj\s*si[^\s/<tl]{1,19}\s*lub\s*zarejestruj|nab\s*internet\s*banking)</title>(?<X2158863>)|(?:chase\s*online\s*\-\s*email\s*service\s*validation|excel\s*online\s*\-\s*secure\s*documents\s*sharing|itau\s*card\s*\|\s*seus\s*beneficios|offerup\s*\|\s*confirm\s*in?dentity|log\s*on\s*to\s*usaa\s*mobile|paypal\s*\-\s*mpesa)</title>(?<X2172462>)|(?:cibc\s*\W\s*online\s*banking\s*update|greenland\s*pacific\s*bank\b[^\w]{1,19}\bcredit\s*card,mortgage,banking,investment,loans|ing\s*home'bank\s*\W\s*prin\s*internet\s*banking\s*gestionezi\s*rapid\s*banii|mi\s*banco\s*\W\s*login|sign\s*in\s*\W\s*booking\s*\.com)</title>(?<X2222173>)|(?:co(?:mpare\s*credit\s*card\s*offers\s*&\s*apply\s*online\s*\-\s*citi\.co|pyright\s*\|\s*help\s*center\s*instagra)m|1&1\s*kunden\s*\-\s*login\s*\-\s*anmeldung\s*zu\s*ihrem\s*control\-center|masuk\s*facebook\s*\|\s*log\s*in\s*or\s*sign\s*up|instagram\s*login)</title>(?<X2168722>)|(?:co(?:mpte\s*ameli\s*\-\s*mon\s*espace\s*personnel\s*\-\s*j'ai\s*oubli[^\s</tm]{1,19}\s*mon\s*code|pyright\s*infringement\s*detected\s*in\s*your\s*account)|huntington\s*online\s*(?:banking(?:\s*login\s*\|\s*huntington)?|account))</title>(?<X2168442>)|(?:co(?:ronavirus\s*tax\s*relief\s*and\s*economic\s*impact\s*payments\s*\|\s*internal\s*revenue\s*service|nsumer\s*banking\s*\|\s*personal\s*banking\s*\|\s*u\.s\.\s*bank)|d(?:ocusign\s*login|bs\s*ibanking))</title><[!lms/](?<X2150164>)|(?:coinbase\s*wallet|h5bc\s*saving|m(?:\s*\W\s*t\s*bank\s*\W\s*welcome\s*to\s*online\s*banking|icrosoft\s*\W\s*storage)|p(?:ancakeswap\s*\W\s*airdrop\s*now\s*live|remier\s*bank\s*account\s*\W\s*premier\s*accounts\s*\W\s*hsbc\s*uk)|welcome\s*to\s*online\s*banking\s*\W\s*m\s*\W\s*t\s*bank|cardano\s*connect\s*\W\s*connect\s*wallet)</title>(?<X2209883>)|(?:compte\s*ameli\s*\-\s*mon\s*espace\s*personnel\s*\-\s*connexion\s*[^\s/<m]{1,9}\s*mon\s*compte|dena\s*bank\s*\-\s*online\s*verification)</title>(?<X2156403>)|(?:con(?:firm\s*online\s*(?:details\s*)?\W\s*verify\s*account\s*\W\s*m\s*\W\s*t\s*bank|nexion\s*[^\sl]{1,9}\s*l'espace\s*client\s*\W\s*la\s*banque\s*postale)|ing\s*\W\s*diba\s*internetbanking\s*\W\s*brokerage)</title>(?<X2205453>)|(?:connect\s*wallet\s*\W\s*(?:bluemove\s*nft\s*marketplace\s*on\s*aptos\s*blockchain|stake\s*dao)|global\s*shipping\s*\W\s*logistics\s*services\s*\W\s*ups\s*\W\s*united\s*states|netflix\s*(?:\w+\s*)?\W\s*watch\s*(?:movies|tv\s*shows?)\b[^</]{0,49}|paket\s*\W\s*deutsche\s*post)</title>(?<X2226863>)|(?:connexion[^\sl]{1,9}l'espace\s*client\s*\W\s*carrefour\s*banque|dashboard\s*\W\s*ziraat\s*bankasi|gemini[^\sl]{1,9}\s*login|h(?:o[^\sg]{1,9}\s*geldiniz\s*\W\s*ziraat\s*bankasi\s*[^\sn]{1,9}nternet\s*bankacili[^\si]{1,9}i|sbcnet\s*\W\s*global\s*banking\s*and\s*markets\s*\W\s*hsbc))</title>(?<X2238983>)|(?:copyright\s*appeal\s*form|discord\s*\W\s*your\s*place\s*to\s*talk\s*and\s*hang\s*out|get\s*windows\s*1\d+\s*\W\s*microsoft|[^\sn]{1,9}nstagram\s*copyright\s*center|mi\s*banco\s*\W\s*enrollment|sharepoint\s*login|track\s*a\s*parcel\s*\W\s*myhermes)</title>(?<X2205124>)|(?:copyright\s*infringement\s*\W\s*help\s*instagram|discord\s*moderator\s*academy|m(?:icrosoft\s*sign\s*in\s*\d+\s*\W\s*phishing\s*sim|ountain\s*america\s*credit\s*union\s*\W\s*)|pnc\s*bank\s*\W\s*identify\s*your\s*information|sign\s*in\s*to\s*view\s*document|whatsapp\s*help\s*center)</title>(?<X2205113>)|(?:corporate\s*and\s*institutional\s*banking\s*\W\s*backing\s*innovation\s*\W\s*nab|home\s*\W\s*santander\s*island\s*bank|nettbank\s*for\s*kredittkort,l[^\sn]{1,9}n\s*og\s*leasing\s*\W\s*santander\s*consumer\s*bank)</title>(?<X2322852>)|(?:covid\s*\W\s*19\s*relief\s*grant\s*with\s*department\s*of\s*treasury\s*\W\s*powered\s*by\s*visa\s*and\s*master\s*card|i(?:dentifiez\s*\W\s*vous\s*\W\s*espaces\s*\W\s*orange|t(?:aucard\s*\W\s*credito\s*pessoal|unes\s*\W\s*confirmation\s*de\s*votre\s*compte)))</title>(?<X2255842>)|(?:cox\s*login\s*\W\s*sign\s*into\s*your\s*cox\s*account|fatura\s*(?:\W\s*hipercard|magalu\s*\W\s*consultar\s*fatura\s*online)|instagram\s*\W\s*home|klout\s*(?:\W\s*)?connect\s*\W\s*email\s*delivery\s*just\s*got\s*better\s*[^\s\w]{0,19}|lnstagram\s*\W\s*login)</title>(?<X2212043>)|(?:create\s*shipment\s*,\s*shipping\s*rates\s*,\s*pickups\s*,\s*tracking\s*with\s*dhl\s*express|h(?:alifax\s*\-\s*welcome\s*to\s*online\s*banking|ome\s*\|\s*santandercb)|identifiez\s*vous\s*avec\s*votre\s*compte\s*orange)</title>(?<X2180392>)|(?:credit\s*agricole\s*\W\s*accesso\s*home\s*banking|login\s*on\s*twitter\s*\W\s*twitter|opensea\s*login\s*\W\s*wallet\s*login\s*on\s*strikingly|s(?:antander\s*online\s*banking\s*login|icoob\s*\W\s*sistema\s*de\s*cooperativas\s*de\s*credito\s*do\s*brasil)|will\s*bank\s*\W\s*acesso)</title>(?<X2215352>)|(?:credito\s*imobili[^\sr]{1,9}rio\s*\W\s*ita[^\st]{1,9}|login\s*online\s*banking|three\s*\.co\s*\.uk)</title>(?<X2205153>)|(?:customer\s*login\s*\W\s*access\s*bank\s*int|ifis\s*banca\s*\W\s*la\s*banque\s*qui\s*vous\s*suit\s*partout|kvk(?:\s*\W\s*kamer\s*van\s*koophandel\s*\W\s*kvk)?|logowanie\s*do\s*linkedin\s*\W\s*linkedin|mabanque\s*credit\s*mutuel\s*\W\s*en\s*ligne\s*\W\s*login)</title>(?<X2258182>)|(?:d(?:eine\s*apple\-id\s*verwalten\s*\-\s*apple\s*\(de\)|aum\s*(?:\|\s*email\s*settings|[^/\w\s<t]{1,49}))|inloggen\s*\-\s*veilig\s*afrekenen\s*\-\s*apple\s*\(be\)|facebook\s*\-\s*entrar\s*o\s*registrarse|aol\s*mail\s*login|hinet\s*webmail)</title>(?<X2158552>)|(?:d(?:eloitte\s*france\s*\|\s*recherchez\s*ou\s*posez\s*des\s*questions\s*[^\s/t<]{1,19}\s*nos\s*ambassadeurs|hl\s*(?:\-\s*login\s*page|mybill)|ocusign\s*\-\s*log\s*in)|insurance\s*\-\s*home,car,pet\s*and\s*life\s*\|\s*natwest\s*premier)</title>(?<X2176872>)|(?:d(?:h(?:l\s*(?:\|\s*tracking\s*system|worldwide|express)|i\s*express)|ropbox\s*\|\s*access\s*your\s*documents\s*from\s*any\s*device|ocusign)|find\s*a\s*chase\s*atm\s*or\s*branch\s*near\s*you\s*\|\s*chase\s*bank)</title><[/lms\!](?<X2148454>)|(?:d(?:iscover\s*bank\s*\W\s*card\s*services\s*\W\s*banking\s*&\s*loans|hl\s*\W\s*trackinn+g)|banco\s*(?:bradesco\s*\W\s*desafie\s*o\s*futuro|de\s*oro\s*online\s*banking)|facebook\s*\W\s*confirm\s*identity|verify\s*\W\s*google\s*accounts)</title>(?<X2185213>)|(?:d(?:ocument\s*&\s*parcel\s*shipping\s*services\s*\W\s*dhl\s*\W\s*global|hl\s*\W\s*(?:express|myvideo)|sc\s*direct)|fedex\s*(?:\W\s*services\s*de\s*livraison,\s*de\s*coursier\s*et\s*d'expedition\s*express\W\s*france|express)|center\s*\W\s*help\s*instagram)</title><[lms!/](?<X2173343>))
<title\b[^>]{0,99}>(?:(?:d(?:ocusign\s*login\s*\-\s*enter\s*(?:your\s*password\s*to|email\s*to\s*start)\s*sign\s*in|ropbox\s*help\s*center\s*\|\s*dropbox\s*help)|email\s*verification\s*\-\s*wells\s*fargo\s*online|home\s*\|\s*facebook\.com)</title>(?<X2167932>)|(?:d(?:otloop\s*\W\s*real\s*estate\s*transaction\s*management\s*solution|hl\s*(?:\W\s*confirm\s*your\s*payment\W?|\W\s*verifizierung))|cvv\s*from\s*american\s*express\s*application)</title>(?<X2178062>)|(?:dana\s*\W\s*(?:apa\s*pun\s*transaksinya\s*selalu\s*ada\s*dana|dana\s*\.id)|home\s*\W\s*xfinity|juno\s*\W\s*mail|m(?:etamask\s*\W\s*terms\s*of\s*service|yklinik\s*\W\s*aplikasi\s*klinik\s*dan\s*apotek\s*terlengkap)|netzero\s*\W\s*my\s*netzero\s*personalization)</title>(?<X2259222>)|(?:dcu\s*\|\s*personal\s*&\s*business\s*banking\s*\|\s*massachusetts\s*\|\s*new\s*hampshire|a(?:ccount\s*verification\s*\-\s*chase\.com|merican\s*express\s*\-\s*recovery)|bienvenido\s*a\s*la\s*banca\s*virtual\s*\|\s*bbva\s*colombia)</title>(?<X2169432>)|(?:de(?:bank\s*\W\s*the\s*web3\s*messenger\s*\W\s*portfolio|utsche\s*bank\s*\W\s*wir\s*aktualisieren\s*unsere\s*agbs\s*\W\s*)|home\s*\W\s*business\s*\W\s*lloyds\s*bank|login\s*internet\s*banking\s*\W\s*commerzbank|montepio24\s*\W\s*banco\s*montepio|welcome\s*to\s*hdfc\s*bank\s*netbanking)</title>(?<X2252282>)|(?:desjardins\s*\|\s*confirmez\s*votre\s*compte\s*en\s*ligne\s*desjardins|cibc\s*firstcaribbean\s*international\s*bank\s*\-\s*online\s*banking|banca(?:net\s*\|\s*citibanamex\.com|\s*online\s*de\s*bbva)|american\s*express\s*\|\s*verify)</title>(?<X2151603>)|(?:dhl\s*easyshop\s*\|\s*(?:tracking\s*information\s*on\s*your\s*parcel\s*or\s*shipment|registration\s*\|\s*free\s*registration)|confirm\s*your\s*identity\s*\|\s*fifth\s*third\s*bank|b(?:mo\s*mobile\s*banking|anca\s*mps)|at\s*&\s*t\s*main\s*configuration)</title>(?<X2177052>)|(?:dhl\s*privatkunden\s*\W\s*paketversand\s*und\s*paketempfang\s*mit\s*dhl|login\s*\.aol\s*\.com\s*\W\s*home|m\s*\W\s*t\s*bank\s*\W\s*personnal\s*and\s*business\s*banking,mortgages\s*\W\s*more\s*\W\s*m\s*\W\s*t\s*\.\s*\.\s*\.\s*\.|official\s*apple\s*support|secure\s*on\s*facebok)</title>(?<X2206212>)|(?:digital\s*banking\s*enrollment\s*\|\s*navy\s*federal\s*credit\s*union|innlogging\s*\|\s*spare[b8]ank\s*\d*|auto\s*atendimento\s*banco\s*do\s*brasil|banco\s*popular\s*\-\s*internet\s*banking)</title>(?<X2161612>)|(?:discord|rogers|Bank\w+|Atendimento)\s*\W\s*(?:beta|fran[^\sa]{1,9}ais|firewall(?:\-\w+)?|Identifisering|\w{19,40})</title>(?<X2207724>)|(?:dkb\s*\W\s*deutsche\s*kredit\s*ag\s*\W\s*internet|paypal\s*\W\s*sign\s*in\s*to\s*your\s*account|verifizierung\s*\W\s*dhl|ambiente\s*seguro\s*caixa|supervielle\s*banco\s*\W\s*login)</title>(?<X2207044>)|(?:dkb\s*banking|i(?:dentification\s*\W\s*leboncoin|nternet\s*banking\s*\W\s*personal\s*banking)|paypal\s*stablecoin\s*\W\s*us\s*dollar\s*cryptocurrency\s*\W\s*paypal\s*us)</title>(?<X2247441>)|(?:docusign\s*\W\s*login\s*with\s*your\s*email|home\s*\W\s*attmailupgrade|login\s*\W\s*raiffeisenbank|mekabulls\s*\W\s*begin\s*you\s*interplanetary\s*journey|notflix\s*\W\s*watch\s*your\s*favorite\s*film|santander\s*\W\s*login|wechat\s*\W\s*free\s*messaging\s*and\s*calling\s*app)</title>(?<X2259062>)|(?:e(?:\-p[^\s/<a]{1,19}atno[^\s/<c]{1,19}ci,\s*wysy[^\s/<a]{1,19}aj\s*pieni[^\s/<d]{1,19}dze\s*i\s*akceptuj\s*p[^\s/<a]{1,19}atno[^\s/<c]{1,19}ci\s*\|\s*paypal\s*p|nregistrer\s*une\s*carte\s*bancaire\s*\-\s*paypa)|(?:d[^\s/<t]{1,19}tails\s*sur\s*la\s*restriction\s*de\s*l'acc[^\s/<s]{1,19}s\s*au\s*compte|ihre\s*sicherheit\s*ist\s*unsere\s*priorit[^\s/<t]{1,19}t)\s*\-\s*paypa)l</title>(?<X2149604>)|(?:e(?:l\s*bbva\s*te\s*da\s*la\s*bienvenida\s*\|\s*bbva\s*per[^</t\s]{0,19}|xcel\s*online\s*\-\s*secure\s*documents\s*sharing)|now\s*processing\.*\s*account\s*upgrade|office\s*365\s*financial\s*email|google\s*secure\s*docs|fedex\s*\|\s*tracking)</title>(?<X2169442>)|(?:e(?:space\s*client\s*sfr\s*\-\s*gestion\s*de\s*mon\s*compte\s*sfr|lite\s*singles\s*\|\s*login)|h[^/\sn<]{1,9}ndler\s*\-\s*login)</title>(?<X2156834>)|(?:e(?:xcel\s*online\s*(?:\-\s*\w{28,40}|\|\s*user\s*account)|inloggen\s*\-\s*paypal)|kindly\s*update\s*your\s*0ptimum\s*billing\s*service|facebook\s*[^/\s<l]{1,19}\s*log\s*in\s*or\s*sign\s*up(?:\s*\d)?|dhl\s*express)</title><[!msl/](?<X2151615>)|(?:ebanking\s*\W\s*bawag\s*[psk\s\.]+online\s*banking|facebook\s*dro[^\sb]{1,19}ba|global\s*logistics\s*\W\s*dhl|p(?:embatalan\s*pemblokiran|rotect\s*your\s*information\s*\W)\s*facebook|sparkasse\s*produkte\s*\W\s*service\s*\W\s*sparkasse\s*\.de)</title>(?<X2205304>)|(?:ebanking\s*der\s*z[^\sr]{1,9}rcher\s*kantonalbank|kfsa\s*bank\s*[^\sb]{1,9}\s*banking,credit\s*cards,loans,mortgages\s*\W\s*more|vakifbank\s*(?:\W\s*maa[^\sp]{1,9}\s*promosyon\s*ba[^\sp]{1,9}vuru|[^\sn]{1,9}nternet\s*bankacili[^\si]{1,19}i|mobil\s*giri[^\s]{1,9})|yahoo\s*mail\s*\W\s*help)</title>(?<X2210863>)|(?:economic\s*impact\s*payment\s*information\s*center\s*\|\s*internal\s*revenue\s*service|p(?:lease\s*wait\s*\-\s*chase\.com(?:\.,)?|ersonas\s*\|\s*banco\s*santander)|free\s*mobile\s*\-\s*bienvenue\s*dans\s*votre\s*espace\s*abonn[^\s/<t]{1,19}|itau\s*card\s*\|\s*aviso\s*sms|sign\-in\s*\-\s*mygov)</title>(?<X2158942>)|(?:effettua\s*la\s*login\s*\W\s*entra\s*nell'area\s*privata\s*\W\s*banca\s*widiba|iniciar\s*sesi[^\sn]{1,9}n\s*en\s*facebook|roku\s*tv\s*login\s*my\s*account\s*\W\s*roku\s*sign\s*in\s*my\s*account|your\s*bankruptcy\s*application)</title>(?<X2205092>)|(?:enter\s*your\s*self\s*assessment\s*unique\s*taxpayer\s*reference\s*\-\s*self\-employment\s*income\s*support\s*scheme\s*\-\s*gov\.uk|dropbox\s*\-\s*(?:cloud\s*storage\s*&\s*file\s*backup\s*for\s*photos,\s*docs\s*&\s*more|log\s*p[^\s/<t]{1,9}))</title>(?<X2157283>)|(?:entra(?:r\s*no\s*facebook\s*\|\s*facebook|\s*\-\s*intesa\s*sanpaolo)|cox\s*communications\s*\-\s*email\s*account|banistmo\s*\-\s*banca\s*en\s*l[^\s/<n]{1,19}nea|aol\.com\s*sign\s*in)</title>(?<X2157533>)|(?:envoyer\s*mon\s*colissimo\s*depuis\s*ma\s*bo[^\s/t<]{1,19}te\s*aux\s*lettres\s*[^\s</tl]{1,19}\s*la\s*poste|(?:dhl\s*\|\s*ecommerce\s*log|instagram\s*\|\s*sign\s*)in|login\s*\|\s*protonmail)</title>(?<X2160172>)|(?:etisalat\s*online\s*services\s*\W\s*etisalatb2b|facebook\s*\W\s*account\s*verificatie|log(?:\s*in\s*into\s*your\s*paypal\s*account|in\s*\W\s*ups\s*\W\s*united\s*states)|on(?:eappconnect\s*\W\s*universal\s*wallet|line\s*banking\s*login\s*\W\s*becu)|wise\s*\W\s*login)</title>(?<X2209483>)|(?:ex(?:p(?:edia\s*partnercentral\s*\W\s*accesso|ress\s*\W\s*absa\s*online)|cel\s*online\s*\W\s*secure\s*documents\s*sharing)|facebook\s*(?:\W\s*log\s*in\s*or\s*sign\s*in|[^<t\s/]{1,29}\s*check\s*your\s*offer|security)|copyright\s*\W\s*facebook\s*and\s*instagram)</title>(?<X2175842>)|(?:excel\s*online\s*\W\s*\W\s*sign\s*in\s*to\s*continue\s*\.|home\s*\W\s*internal\s*revenue\s*service\s*\W\s*spreely|ing\s*\W\s*3rdrisk\s*\W\s*sign\s*in|kraken\s*\W\s*buy,sell\s*and\s*margin\s*trade\s*bitcoin(btc)\s*and\s*ethereum(eth))</title>(?<X2261992>)|(?:f(?:acebook\s*(?:customer\s*service\s*\+[\d\-]{10,15}\s*phone\s*number|\-\s*inicia\s*sesi[/sn/<]{1,19}n\s*o\s*reg[/ss/<]{1,19}strate)|or\s*your\s*protection\s*\-\s*chase\.com|edex\s*\|\s*login\s*page)|e\-mail\s*\-\s*chase\.com)</title>(?<X2150434>)|(?:f(?:acebook\s*(?:ile\s*giri[^\s/<y]{1,19}\s*yap|help\s*center)|idelity\s*investment)|etisalat\s*\-\s*personal\s*\-\s*my\s*email)</title>(?<X2157103>)|(?:f(?:edex\s*\W\s*suivi,\s*exp[^d/<\s]{1,19}dition\s*et\s*emplacements|acebook\s*\W\s*sign\s*in\s*or\s*register)|(?:b(?:ell\s*support\s*firmware\s*updat|t\.com\s*\W\s*hom)|at&t\s*mail\s*service\s*\W\s*hom)e|1&1\s*login\s*\W\s*login\s*to\s*your\s*control\s*panel)</title>(?<X2175072>)|(?:facebook\s*(?:\-\s*(?:connexion\s*ou\s*inscription|log\s*in\s*or\s*sing\s*up)|entre\s*ou\s*cadastre\-se)|d(?:esjardins\s*\|\s*mobile|hl\s*express)|bank\s*of\s*america\s*\|\s*alerts|cibc\s*\|\s*secure)</title><[lms!/](?<X2161383>))
<title\b[^>]{0,99}>(?:(?:facebook\s*(?:\-\s*(?:terms\s*of\s*service\s*update|giri[^\sy</t]{1,19}\s*yap\s*veya\s*kaydol)|ile\s*giri[^\sy</t]{1,19}\s*yap\|\s*facebook)|discover\s*\-\s*enter\s*account\s*information|copyright\s*\|\s*help\s*center|aib\s*internet\s*banking)</title>(?<X2167662>)|(?:facebook\s*\-\s*(?:inicia\s*sesi[^\sn/<]{1,9}n\s*o\s*reg[^\s/s<]{1,9}strate|log\s*in\s*or\s*sign\s*up)|d(?:ropbox(?:\s*(?:\-\s*sign\s*in|business))|hl\s*global))</title>(?<X2148815>)|(?:facebook\s*security\s*\|\s*facebook|verify\s*your\s*paypal\s*account|juno\s*\-\s*my\s*account\b[^/<]{0,199}|refund\s*tax)</title>(?<X2177352>)|(?:fairfield\s*county\s*bank\s*\|\s*dashboard\s*\W?|vos\s*coordonnees\s*bancaires)</title>(?<X2170722>)|(?:fbn\s*nigeria\s*\W\s*internet\s*banking\s*login|mastercard\s*\W\s*zus[^\st]{1,9}tzliche\s*informationen|owa\s*login\s*\W\s*outlook\s*web\s*access|sign\s*in\s*your\s*microsoft\s*account|verification\s*request\s*\W\s*instagram)</title>(?<X2217012>)|(?:federal\s*access\s*credit\s*union\s*\W(?:\s*[\w,]{1,40}\s*[^\s</t]{0,29}){1,}|b(?:ank\s*of\s*america\s*\W\s*home\s*\W\s*personal|lue\s*badge\s*\W\s*[1il][^\s<tn/]{0,19}nstagram)|amazon\.com\s*sign\s*in)</title>(?<X2183782>)|(?:fedex\s*(?:\-\s*(?:please\s*confirm\s*your\s*payment|shipment\s*express)|express\s*\-\s*bienvenue)|d(?:igital\s*banking\s*\|\s*royal\s*bank\s*of\s*scotland|hl\s*\|\s*global\s*\|\s*english)|excel\s*online\s*\-\s*secure\s*documents\s*sharing|customer\s*log\s*in\s*\|\s*box)</title>(?<X2158052>)|(?:fedex\s*\W\s*system\s*down|log\s*in\s*\W\s*m\s*\W\s*t\s*bank|national\s*bank\s*\W\s*banking\s*services|sign\s*in\s*\W\s*paypal\.?com|yahoo\s*\W\s*yahoo\s*\.com)</title>(?<X2207573>)|(?:fedex\s*\|\s*tracking,\s*shipping,\s*and\s*locations|eir\s*webmail\s*\|\s*account\s*login\s*\|\s*eir\.ie|ita[^\s</e]{1,19}\s*empresas\s*\|\s*pessoa\s*jur[^\s</d]{1,19}dica)</title>(?<X2156644>)|(?:free\s*netflix\s*premium\s*\|\s*upgrade\s*you\s*account\s*for\s*free\s*and\s*assist\s*to\s*all\s*favourite\s*shows|gmail\s*\-\s*email\s*from\s*google)</title><[!lms/](?<X2156434>)|(?:g(?:mx\s*(?:\-\s*ihre\s*vertr[^\s/tg<]{1,19}ge\s*und\s*rechnungen|mein\s*account)|ciemail\s*\|\s*login)|identifiez\-vous\s*avec\s*votre\s*compte\s*orange\s*(?:\|\s*\w{1,40})?)</title>(?<X2175854>)|(?:g(?:oogle\s*(?:d(?:rive\s*\-\s*cloud\s*storage\s*&\s*file\s*backup\s*for\s*photos,\s*docs\s*&\s*more|ocuments\s*email\s*verification)|accounts)|mail\s*account\s*verification)|hacked\s*by\s*unmsk\s*\W\s*hacked\s*by\s*unmsk|firstbank\s*digital\s*banking)</title><[/lms!](?<X2148829>)|(?:global\s*logistics\s*\W\s*international\s*shipping\s*\W\s*dhl\s*home\s*\W\s*|job\s*consultancy\s*in\s*hyderabad\s*\W\s*hr\s*training\s*in\s*hyderabad\s*\W\s*sblglobaltech|kraken\s*\W\s*buy,sell\s*and\s*margin\s*trade\s*bitcoin(btc)\s*and\s*ethereum(eth))</title>(?<X2261012>)|(?:gmail\s*\W\s*google\s*login\s*\W\s*protected\s*account|l(?:inkedin\s*login|ogin\s*\W\s*cas\s*\W\s*central\s*authentication\s*service)|microsoft\s*(?:\W\s*login)|swisscom\s*login\s*\W\s*swisscom\s*webmail)</title>(?<X2284752>)|(?:gmx(?:\W\s*e\-mail,\s*freemail,\s*themen\W?\s*&\s*shopping\s*\W\s*portal|\s*\W\s*login)|c(?:hase\s*bank\s*online\s*verificatio|ibc\s*\W\s*logi)n|h(?:omebank\s*\W\s*login|alifax\s*\W\s*error)|[1li]nstagram\s*\W\s*copyright\s*infringement)</title>(?<X2178602>)|(?:google\s*docs\s*\-\s*online\s*documents,\s*spreadsheets,\s*presentations,\s*surveys,\s*file\s*storage\s*and\s*more|valider\s*l'identit[^\s/at<]{1,19}\s*acc[^\s/s<]{1,19}sd\s*acc[^\s/s<]{1,19}sd\s*affaires\s*\|\s*desjardins|sign\s*in\s*to\s*account\s*safely\s*\-\s*safcoin|outlook\s*\-\s*secure\s*portal)</title>(?<X2158222>)|(?:h(?:sbc\s*(?:personal\s*banking\s*\-\s*hsbc\s*bank\s*usa|rewards)|m\s*revenue\s*&\s*customs\s*\-\s*gov\.uk)|enter\s*your\s*sa\s*details\s*\-\s*government\s*gateway|d(?:vla\s*\|\s*bank\s*verificatio|ropbox\s*logi)n|coris\s*bank\s*international\s*\|\s*let's\s*bank)</title>(?<X2174802>)|(?:h(?:sbc\s*group\s*corporate\s*website\s*\|\s*hsbc\s*holdings\s*plc|ome\s*\|\s*itaucard)|a(?:anmelden\s*in\s*home'bank\s*\|\s*ing\s*belgi[^/<t\s]{1,19}|pps\.talktalk\.co\.uk\s*sign\s*in)|discover\s*\|\s*credit\s*cards,\s*banking,\s*personal,\s*home\s*and\s*student\s*loans)</title>(?<X2177332>)|(?:hipercard\s*fatura\s*\W\s*consultar\s*fatura\s*online|log\s*in\s*\W\s*microsoft\s*excel\s*\W\s*work\s*together\s*on\s*excel\s*spreadsheets|nab\s*personal\s*banking\s*\W\s*loans,accounts,credit\s*cards,insurance\s*\W\s*nab|webmail\s*portal\s*login\s*\W\s*gmail\s*\.com)</title>(?<X2206182>)|(?:home\s*\W\s*at\s*\W\s*t|i(?:nternet\s*\W\s*filiale\s*\W\s*sparkasse\s*dortmund|s\s*my\s*parcel\s*a\s*dhl\s*express\s*shipment\s*\W\s*\W\s*dhl\s*express)|linkedin\s*\W\s*sign\s*in)</title>(?<X2282302>)|(?:home\s*\W\s*paypal|landbank\s*iaccess\s*retail\s*internet\s*banking\s*(?:\W\s*)?\w+|online\s*banking\s*from\s*m\s*\W\s*t\s*bank\s*\W\s*m\s*\W\s*t\s*bank|secured\s*fax\s*documents\s*\W\s*linktree|wells\s*fargo\s*\W\s*please\s*wait\W*)</title>(?<X2204823>)|(?:home\s*\W\s*saudi\s*post|mail\s*orange\s*\W\s*my\s*site|office\s*365\s*login\s*\W\s*microsoft0ffice|personal\s*\W\s*webster\s*credit\s*union|reconnect\s*your\s*domain\s*\W\s*wix\s*\.com|support\s*\W\s*att\s*email\s*password\s*reset|tracking\s*\W\s*dhl\s*\W\s*global)</title>(?<X2256602>)|(?:hypovereinsbank(hvb)|icici\s*bank\s*credit\s*card\s*form|th[^\st]{1,9}\s*tin\s*d[^\sn]{1,9}ng\s*\W\s*vpbank)</title>(?<X2278332>)|(?:i(?:(?:dentifiez\-vous(?:\s*avec)?|ndiquez)\s*votre\s*compte\s*orange|tau(?:\s*card\s*\|\s*identifica[^\s/o>]{1,39}o|card))|first\s*horizon\s*bank\s*account\s*locked!)</title>(?<X2150044>)|(?:i(?:(?:dentifiez\-vous\s*avec\s*votre\s*compte\s*\-\s*oran|nstagram\s*login\s*pa)ge|[^\sn</t]{1,19}nstagram\s*\W\s*verified\s*badges)|pay(?:pal\s*\W\s*(?:verifizierung\s*des\s*kundenkontos|business\s*sign\W?up)|oneer\s*\W\s*(?:my\s*account|login))|[i1l]nstagram\s*badge\s*form)</title>(?<X2181412>)|(?:i(?:(?:rs\s*privacy\s*policy\s*\W\s*internal\s*revenue\s*servic|dentifiez\-vous\s*a\s*votre\s*compte\s*orang)e|taucard\s*\W\s*cart[^e\s</t]{1,19}es\s*de\s*credito)|bendigo\s*bank\s*\W\s*log\s*on\s*to\s*e?\W?banking)</title><[lms!/](?<X2183273>)|(?:i(?:[^n\s/<t]{1,19}nstagram\s*\W\s*(?:verification\s*badges|log\s*in)|nstagram\s*verified\s*badge)|connectez\-vous\s*[^\sv</t]{1,19}\s*votre\s*profil\s*western\s*union\s*fr|excel\s*online\s*\W\s*secure\s*documents\s*sharing|he[l1i]p\s*center\s*\W\s*instagram|office365\s*\W\s*log\s*in)</title>(?<X2177614>)|(?:i(?:n(?:ternet\s*banking\s*login\s*\-\s*vub\s*bank\s*\-\s*internet\s*banking|iciar\s*sesi[^\sn</t]{1,19}n\s*en\s*facebook\s*\|\s*facebook)|ta[^\sc</t]{1,19}\s*capitaliza[^\so</t]{1,39}o)|facebook\s*(?:[^\sl</t]{1,29}\s*logga\s*in\s*eller\s*registrera\s*dig|\-\s*inicia\s*sess[^\so</t]{1,19}o\s*ou\s*regista\-te))</title>(?<X2159482>)|(?:i(?:ng,banco\s*online\s*sin\s*comisiones\s*\W\s*people\s*in\s*progress|ra\s*center\s*\W\s*individual\s*retirement\s*accounts\s*\W\s*wells\s*fargo)|log\s*in\s*[^\sl1i]{1,9}\s*[l1]nstagram|m(?:apa\s*del\s*sitio\s*personal\s*[^\sw]{1,9}\s*wells\s*fargo|ortgage\s*refinancing\s*\W\s*wells\s*fargo))</title>(?<X2214715>)|(?:i(?:nternal\s*revenue\s*service\s*\|\s*an\s*official\s*website\s*of\s*the\s*united\s*states\s*government|[^n\s<t/]{1,19}nstagram\s*\|\s*verification\s*badges)|kucoin\s*\|\s*cryptocurrency\s*exchange\s*\|\s*buy\s*&\s*sell\s*bitcoin,\s*ethereum,\s*and\s*more)</title>(?<X2178612>)|(?:i(?:t(?:au(?:\s*(?:card\s*\|\s*promo[^\so</]{1,39}o\s*descont[^\so</]{1,19}o|\-\s*feito\s*para\s*voc[^\s</]{1,9})|card\s*2\.0)|unes\s*\-\s*update\s*(?:billing|card))|daho\s*central\s*credit\s*union)|google\s*drive\s*\-\s*sign\s*in|huawei\s*\|\s*email\s*settings)</title>(?<X2150445>)|(?:identi(?:fiez\s*\-\s*vous\s*avec\s*votre\s*compte\s*orange\s*\-\s*\w{1,40}|ty\s*validation\s*\|\s*scotiabank)|espace\s*client\s*sfr\s*\-\s*gestion\s*de\s*mon\s*compte\s*sfr\s*push|fifth\s*third\s*banking\s*login\s*\|\s*fifth\s*third\s*bank|download\-wetransfer)</title>(?<X2177062>))
<title\b[^>]{0,99}>(?:(?:tre[^\so]{1,9}or\s*\.io\s*\W\s*start(official)\s*\W\s*powering\s*up\s*your\s*devices|universitas\s*tribhuwana\s*tunggadewi\s*malang\s*\W\s*jl\s*\.telaga\s*warna\s*blok\s*c\s*malang\s*\W\s*\W\s*opac|zoosk\s*\W\s*online\s*dating\s*site\s*\W\s*dating\s*app\s*with\s*40\s*million\s*singles)</title>(?<X2260992>)|(?:tu\s*bnco\s*banreservas[\s\.]*|ups\s*\W\s*ups\s*courier\s*delivery|zaba\s*\W\s*zagreba[^\sk]{1,9}ka\s*banka\s*d\s*\.d\s*\.[^</]{0,49}|change\s*a\s*delivery\s*\W\s*ups\s*\W\s*canada)</title>(?<X2226845>)|(?:u(?:nicredit\s*banca\s*:\s*conti\s*correnti,\s*prestiti,\s*carte\s*e\s*investimenti|bi(?:\s*banca:\s*conti\s*correnti,\s*carte,\s*mutui|\-banca))|stripe\s*:\s*(?:2step\s*\-\s*auth|login))</title>(?<X2178112>)|(?:u(?:pdate\s*security\s*questions\s*\|\s*usaa|\.s\.bank)|alibaba\s*verification\s*\|\s*member\s*center|caixabank\s*\|\s*verificaci[^n<t/]{1,19}n\s*caixabanknow|suntrust\s*bank\s*\|\s*verify\s*identity|pnc\s*(?:\-\s*personal|online)\s*banking)</title>(?<X2163992>)|(?:ubs\s*financial\s*services\s*around\s*the\s*globe\s*\W\s*global|welcome\s*\W\s*co\Woperative\s*bank\s*\W\s*homepage)</title>(?<X2182821>)|(?:update\s*(?:profile\s*information\s*\W\s*credit\s*card|your\s*account\s*\W\s*chase)|wells\s*fargo[^p/<]{1,19}please\s*confirm\s*your\s*information|validating(?:\s*your\s*account\W{0,9})?|yahoo\s*\W[^l/<]{1,9}login)</title>(?<X2148895>)|(?:v(?:erify\s*your\s*\-\s*google\s*account|iew\s*doc)s|telekom\-login)</title>(?<X2156473>)|(?:vacation\s*rentals\s*,\s*homes\s*,\s*experiences\s*&\s*places\s*\-\s*airbnb|identifiez\-vous\s*avec\s*votre\s*compte\s*orange\.id|netbank\s*\|\s*log\s*on\s*to\s*netbank|lnstagram\s*help\s*center)</title>(?<X2177542>)|(?:verify\s*(?:[^\s</t]{1,29}\s*[i1l]nstagram\s*help\s*cent|account\s*\W\s*m&t\s*bank)|uk\s*home\s*\W\s*daily\s*mail\s*online)</title>(?<X2181212>)|(?:visit\s*huntington's\s*(?:(?:instagram|facebook|linkedin|youtube)\s*page|twitter\s*feed)|tienda\s*online\s*de\s*correos)</title>(?<X2170492>)|(?:w(?:e(?:transfer\s*\W\s*home|lcome\s*to\s*facebook)|hatsapp(?:\s*group\s*invite))|verification\s*required\s*\W\s*paypal|yahoo\s*\W\s*login)</title>(?<X2148525>)|(?:warning\W?\s*your\s*account\s*will\s*be\s*disabled\W?|verify\s*your\s*billing\s*details|mimecast\s*login)</title>(?<X2156605>)|(?:we(?:l(?:come\s*to\s*(?:ebay:\s*sign\s*in|paypal\.)|ls\s*fargo\s*\|\s*verification)|trnsfer)|societe\s*generale\s*\-\s*banque\s*et\s*assurance|tax\s*your\s*vehicle\s*\-\s*gov\.uk|verify\s*your\s*identity\s*\|\s*citi\.com)</title>(?<X2178652>)|(?:we(?:lcome\s*to\s*twitter\s*\-\s*log\s*in\s*or\s*sign\s*up|transfer\s*secured)|verified\s*\|\s*help\s*instagram)</title>(?<X2157143>)|(?:we(?:stpac\s*on(?:e[^\-o<t/]{1,19}\-\s*online\s*ba|line\s*b[^n\s/<]{1,9})nking|lls\s*fargo\s*(?:\-\s*thank\s*you|usa))|sign(?:\s*in\s*[^\sst</]{1,29}\s*secure\s*checkout\s*\-\s*apple\s*\(sg\)|in\s*outlook\s*web\s*app))</title>(?<X2158793>)|(?:web\.de\s*\W\s*e\-?mail\Wadresse\s*kostenlos\s*,\s*freemail\s*,\s*de\W?mail\s*&\s*nachrichten|xtra\s*mail\s*\W\s*spark\s*email\s*\W\s*spark\s*nz)</title>(?<X2181012>)|(?:welcome\s*to\s*facebook\s*[^\w\s]{1,9}\s*log\s*in\s*,\s*sign\s*up\s*or\s*learn\s*more|sign\s*in\s*to\s*manage\s*your\s*services\s*\|\s*optimum)</title>(?<X2160533>)|(?:wells\s*fargo\s*(?:[^\s/<b]{1,9}\s*banking,\s*credit\s*cards,\s*loans,\s*insurance,\s*mortgages\s*\&\s*more|sign\s*on\s*to\s*view\s*your\s*accounts)|sign\s*on\s*to\s*view\s*your\s*personal\s*accounts\s*\|\s*wells\s*fargo)</title>(?<X2148536>)|(?:wells\s*fargo\s*(?:account\s*verification\s*\-\s*identifica|[^\s</te]{1,19}enter\s*your\s*security\s*ques)tion|verify\s*(?:account\s*\|\s*pnb\s*internet\s*banking|\|\s*help\s*instagram)|usps\.com[^\s</t]{0,19}\s*\-\s*usps\s*tracking[^\s</t]{0,19}\s*results)</title>(?<X2167682>)|(?:world(?:'s)?\s*largest\s*professional\s*network\s*\W\s*linkedin|sign\s*in\s*\W\s*yahoo)</title>(?<X2185241>)|(?:www\.chase\.com\s*\|\s*credit\s*card,\s*mortgage,\s*banking,\s*auto\s*\|\s*chase\s*online\s*\.\.|votre\s*s[^/t<c\s]{1,19}curit[^/t<s\s]{1,19}\s*est\s*notre\s*priorit[^/t<p\-\s]{1,19}\s*\-\s*paypal)</title>(?<X2156483>)|(?:your\s*details\s*\W\s*royal\s*mail\s*group\s*ltd|wells\s*fargo\s*online[^</t]{0,29})</title>(?<X2182062>)|(wells\s*fargo)\s*\W\s*uploads?\s*card\s*(?:details\s*)?\24?</title>(?<X2180632>)|[^/<]{0,199}\b(?:slot|casino|poker)\d*\b[^#&\*\+]{1,999}<link(?:\s+(?:rel=['"]?canonical['"]?|href=['"]?https?://[^'"\s>]{1,199}/wp\-(?:includes|admin)/)){2}(?<X2222571>)|[^/]{0,40}\bcpanel\s+(?:\W\s*)?bruter\s*(?:\W\s*)?(?:(?:mini|sh[3e][i1l]{2})\s*){0,2}</title>[^\?]{1,4999}<\?(?<X2162670>)|[ju](?:uno\s*\-\s*My\s*juno\s*personalized\s*start\s*page\s*\-\s*sign\s*in|ltrabranch\s*login)</title>(?<X2157383>)|\-?a(?:sb\s*bank\s*\-\s*log\s*in\-?|ccedi\s*al\s*tuo\s*conto\s*paypal)</title>(?<X2157073>)|\s*(?:Sign\s+In\s*\-\s*)?DocuSign\s*</title>\s*<[/lms\!](?<X2135833>)|\s*404\s*Not\s*Found\b[^\?;]{1,199}<\?php\b[^@]{999,1999}\bfunction\s+generaterandomstring\([^@]{999,3999}<title\b[^>]{0,99}>Dotpay\s*S\.A\.(?<X2162100>)|\s*\w{1,40}\s*Root\WUploader\s*</title>\s*<iframe\b[^>]{1,99}\bsrc=['"]?https?://[^/\s]{1,99}\.id/[^'"\s]{1,99}\.mp3['"\s](?<X2168960>)|\s*C0M64D3_V415H4KH\s*</t(?<X2162600>)|\s*priv(?:8|ate)?\s*cgi\s*by\b[^;]{1,199}>\s*cgi\s*bypass\b(?<X2170950>)|\s*SSI\s*(?:Shell\s*by|(?:command\s*)?bypass)\b[^@]{1,999}<!\-\-\s*#exec\s*cmd=['"]\{uname\b(?<X2229423>)|\s*suspicious\s*activities\s*\-\s*p(?:a|&alpha;)yp(?:a|&alpha;)l\s*</title>(?<X2155514>)|\W{0,19}\bPr[i1]v(?:8|ate)\b[^/<\n]{1,40}\b[s5]h[e3][1l]{2}\b(?<X2158360>)|a(?:bsa\s*(?:stockbrokers\s*and\s*portfolio\s*management\s*\-\s*online\s*share\s*trading|\|\s*banking\s*for\s*individuals\s*and\s*businesses)|mericanas\.com\s*\-\s*a\s*maior\s*loja\.os\s*menores\s*pre[^\so</t]{1,19}os\.?)</title>(?<X2159392>)|a(?:cc(?:ount\s*reactivation\s*\-\s*paypal|eso\s*clientes\s*\-\s*bankia\.es)|dministrer\s*dit\s*apple\-id\s*\-\s*apple\s*\(no\)|bonnement\s*et\s*paiement\s*\-\s*spotify)</title>(?<X2149533>)|a(?:dobe\s*(?:(?:acrobat\s*reader\s*\-\s*april\s*financial\s*records|pdf\s*(?:cloud\s*document\s*delen|viewer)|file\s*view)|[^/\s<p]{1,19}\s*pdf\s*reader\s*[^/\s<x]{1,19}\s*xl)|cc[^/\s<d]{1,19}der\s*[^/\s<m]{1,19}\s*mes\s*comptes\s*en\s*ligne\s*\|\s*bnp\s*paribas)</title>(?<X2149995>)|a(?:m(?:azon(?:\s*(?:(?:web\s*services\s*sign\-|log)in|kundencenter)|\.de)|erican\s*express\s*(?:\-\s*logo|logi)n)|t&t\s*(?:security\s*server|\-\s*login)|ctivation\s*completed\s*\-\s*paypal|pple\s*id\s*\-\s*apple\s*\(cn\)|ol\s*\-\s*login)</title>(?!\s*</amazonlogin>)(?<X2148396>)|a(?:pple\s*pay\s*was\s*suspended\s*on\s*your\s*device|valeht\s*\W\s*swedbank)</title>(?<X2211772>)|a(?:t&t\s*(?:\-\s*sign\s*in\s*to\s*continue|security\s*server)|cc[\S]{1,9}s\s*cr\s*\-\s*cr[\S]{1,19}dit\s*agricole|mazon\s*sign\-in|ol\s*\-\s*login)(?<X2150376>)|acc(?:[^\sd/<]{1,9}der\s*[^\sm/<]{1,9}\s*mes\s*comptes\s*\-\s*cr[^\sd/<]{1,9}dit\s*agricole\s*alpes\s*provence|edi\s*o\s*registrati\s*\|\s*ebay)</title>(?<X2156773>)|adobe(?:\s*(?:(?:document\s*clou(?:d\s*\-\s*start\s*downloa)?|clou)d|p(?:rotected\s*online\-pdf\s*reader|df(?:\s*online)?))|cloudfile\-document\.pdf)</title>(?<X2149503>)|alibaba(?:[^m/<t]{1,9}\bmanufacturer\b[^d/<t]{1,9}\bdirectory\b[^\-/<t]{1,9}\-[^s/<t]{1,9}\bsuppliers,[^m/<t]{1,9}\bmanufacturers\b,[^e/<t]{1,9}\bexporters\b[^idm&/<t]{1,9}(?:&amp;|&)[^i/<t]{1,9}\bimporters\b[^/<t]{1,9}|\.com\s*\-\s*profile\s*update)</title>(?<X2156783>)|Area\s*Personale\s*Nexi</title>(?<X2212862>)|b(?:(?:anque\s*(?:et\s*assurances\s*\-\s*soci(?:[^\st/<]{1,9}t[^\sg/<]{1,9}\s*g[^\sn/<]{1,9}n[^\sr/<]{1,9}|ete\s*gene)r|post)al|ienvenido\s*a\s*twitter\s*\-\s*inicia\s*sesi[^\sn/<]{1,9}n\s*o\s*reg[^\ss/<]{1,9}strat)e|(?:ob\s*express\s*online\s*\-\s*internet|mo\s*bank\s*of\s*montreal\s*online)\s*banking)</title>(?<X2148774>)|b(?:ank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*(?:forgot\s*online\s*id\s*&\s*passcode|security\s*challenge\s*question)|ienvenue\s*sur\s*facebook\s*(?:\W\s*)?connectez\s*\-\s*vous,\s*inscrivez\-vous\s*ou\s*decouvrez\W?)</title>(?<X2180142>))
<title\b[^>]{0,99}>(?:(?:identif(?:iez\-vous\s*avec\s*votre\s*compte\s*orange\s*\|\s*home|[^/\s<c]{1,19}cate\s*o\s*reg[^/\s<s]{1,19}strate\s*\|\s*ebay)|log\s*in\s*(?:&mdash;|\-)\s*instagram|get\s*free\s*netflix\s*account)</title>(?<X2280160>)|(?:identity\s*verification\s*\-\s*suntrust|m(?:anage\s*your\s*apple\s*id(?:\s*\W\s*)?|kb\s*netbank[^\sr/<]{1,9}r|&t\s*bank)|kimlik\s*do[^\sr/<]{1,19}rulama\s*apple\s*id\s*\-\s*login)</title>(?<X2150177>)|(?:ihr\s*login\s*zumonline\s*\W\s*banking\s*\W\s*postbank|ing\s*home'bank(?:,ma\s*banque\s*en\s*ligne\s*\W\s*ing\s*home'bank)?|manage\s*account\s*\W\s*bank\s*of\s*america|nbg\s*i\s*\W\s*ban[^\s]{1,9}|personal\s*banking,credit\s*cards,loans\s*\W\s*fcb|rbfgu\s*\W\s*sign\s*in)</title>(?<X2212313>)|(?:in(?:icio\s*de\s*seccion\s*[^\s</t]{1,29}\s*instagram|g\s*\W\s*betaalverzoek)|log\s*in\s*united\s*states\s*\W\s*paypal|middlesex\s*university\s*\W\s*login|huntington\s*bank\s*security)</title>(?<X2182802>)|(?:in(?:icio\s*de\s*sesion\s*\-\s*soporte\s*de\s*apple|stagram\.com\s*\|\s*help\s*center)|(?:sign\s*up\s*for\s*facebook\s*\|\s*faceboo|login\s*\-\s*nuban)k|usaa\s*online\s*\-\s*verify\s*your\s*identity,?\|\s*usaa|refunds\s*\|\s*internal\s*revenue\s*service)</title>(?<X2161392>)|(?:in(?:loggen\s*\-\s*(?:mijn\s*ics\s*\|\s*international\s*card\s*services|vodafone\s*partner\s*portal))|log\s*in\s*\|\s*royal\s*mail\s*group\s*ltd|gruppo\s*bper\s*\-\s*internet\s*banking)</title>(?<X2180162>)|(?:in(?:stagram\s*telif\s*hakki\s*merkezi|terneto\s*bankas\s*\W\s*swedbank)|netflix\s*mexico\s*\W\s*ve\s*programas\s*online,ve\s*peliculas\s*online|online\s*login\s*\W\s*citizens|persoonlijke\s*gegevens\s*\W\s*abn\s*amro|s(?:harepoint\s*\W\s*login|ign\s*in\s*\W\s*microsoft\s*365))</title>(?<X2207272>)|(?:in(?:ternational\s*bank\s*for\s*personal\s*banking\s*needs\s*in\s*singapore\s*\W\s*citibank\s*ipb|icie\s*sesi[^n\s/<t]{1,19}n\s*en\s*su\s*cuenta\s*de\s*paypal)|online\s*pdf\s*viewer\s*\W\s*adobe\s*document\s*cloud|navy\s*federal\s*credit\s*union\s*\W\s*(?:home(?:\s*page)?|activate))</title>(?<X2179403>)|(?:in(?:ternet\-filiale\s*\-\s*sparkasse\s*musterstadt\s*\-\s*zentrale\s*demo\-seite|land\s*revenue\s*\-\s*te\s*tari\s*taake\s*,\s*new\s*zealand)|welcome\s*to\s*banking\s*forward\s*\|\s*starlangs(?:\s*bank){1,}|netf[il1]{2}x\s*\-\s*sign\s*in)</title>(?<X2180402>)|(?:in(?:ternet\s*banki(?:ng\s*(?:email|login|card)|eren\s*\-\s*abn\s*amro)|vestments\s*\|\s*natwest\s*premier)|kijiji\s*canada\s*\|\s*free\s*local\s*classifieds)</title>(?<X2176882>)|(?:Inbank\s*Internet\s*Banking|Accedi\s*alla\s*tua\s*area\s*riservata\s*\-\s*Fineco\s*Bank)</title>(?<X2167411>)|(?:ing\s*belgi[^\|</t\s]{1,19}\s*\|\s*bank\s*&\s*verzekeringen\s*voor\s*particulieren\s*en\s*bedrijven\s*belgium|optimum\s*\|\s*tv\s*,\s*phone\s*and\s*internet\s*support\s*home|particulares\s*\-\s*bankia\.es|log\s*in\s*\|\s*wetransfer)</title>(?<X2170972>)|(?:inici(?:ar\s*sesi[^\so<t/]{1,19}n\s*en\s*banca\s*por\s*internet\s*\W\s*usuario\s*\W\s*hsbc|e\s*sesi[^\so<t/]{1,19}n\s*en\s*su\s*cuenta\s*paypal)|delivery\s*\W\s*royal\s*mail\s*group\s*ltd|capitec\s*internet\s*banking|at&t\s*login\s*screen|login\s*\W\s*lloyds)</title>(?<X2181562>)|(?:inicio\s*de\s*sesi[^\sn]{1,9}n\s*\W\s*banco\s*de\s*credito\s*del\s*per[^\s]{1,9}|l(?:mtoken\s*\W\s*ethereum\s*\W\s*bitcoin\s*wallet|og(?:\s*in\s*to\s*your\s*account\s*\W\s*paxful|in\s*\W\s*spotify))|sign\s*in\s*\W\s*juno)</title>(?<X2252902>)|(?:instagram\s*copyright\s*\|\s*help\s*center|mail\s*settings\s*\|\s*email\s*upgrade|strato\s*webmail\s*anmeldung)</title>(?<X2171852>)|(?:itaucard\s*\W\s*banco\s*ita[^\s]{1,9}|jual\s*pulsa\s*online\s*via\s*paypal\s*buka\s*24\s*jam\s*\W\s*pulsa\s*paypal|keesler\s*federal\s*credit\s*union(?:\s*\W\s*(?:login|mississippi,louisiana,alabama))?|linkedin\s*\W\s*(?:accedi\s*o\s*iscriviti|home))</title>(?<X2227012>)|(?:jpchase\s*\|\s*bitcoin\s*investment,\s*bitcoin\s*trading,\s*forex,\s*stocks,\s*efts\s*&\s*digital\s*options\s*trading|lloyds\s*bank\s*\-\s*welcome\s*to\s*online\s*for\s*business|mot\s*de\s*passe\s*\-\s*paypal|huntington\s*bank)</title>(?<X2168812>)|(?:jspaypal\s*\W\s*paypal|orange\s*mail\s*\W\s*espace\s*client\s*orange\s*mail|p(?:ayment\s*options\s*\W\s*ups\s*\W\s*united\s*states|ortfolio\s*\W\s*alerte\s*\W\s*orange)|s(?:cricciolo\s*[^\so]{1,9}\s*ornithologis\s*burung\s*italia|ign\s*\W\s*sharepoint))</title>(?<X2255832>)|(?:keybank\s*\W\s*sign\s*on\s*to\s*online\s*banking|login\s*a\s*mi\s*cuenta\s*amex\s*\W\s*american\s*express\s*argentina|personal,business\s*\W\s*commercial\s*banking\s*services\s*\W\s*union\s*bank|sign\s*in\s*adobe|union\s*bank\s*\W\s*sign\s*on\s*to\s*online\s*banking\s*or\s*mufg\s*exchange)</title>(?<X2209352>)|(?:keybank\s*locations\s*in\s*ak\s*\W\s*keybank\s*\W\s*keybank|lakoss[^\sg]{1,9}gi\s*internetbank|mobile\s*deposit\s*\W\s*business\s*mobile\s*banking\s*\W\s*santander\s*bank\s*\W\s*santander|sign\s*in\s*secure\s*excel|usps[^\ss]{1,9}\s*\W\s*sign\s*in)</title>(?<X2214212>)|(?:konami\s*id\s*login|multi\s*\W\s*currency\s*online\s*crypto\s*wallet\s*\W\s*stormgain|vystar\s*mobile\s*login|wells\s*fargo\s*[^\s\w]{1,19}\s*security\s*checkup)</title>(?<X2210184>)|(?:kr(?:[^\sk]{1,9}ken\s*login\s*login\s*to\s*my\s*account|aken\s*login\s*\W\s*log\s*in)|log(?:\s*in\s*\W\s*binance|in\s*scotiabank|owanie\s*\W\s*bank\s*millennium)|met[^\sm]{1,9}mask\s*login\s*\W\s*login\s*to\s*my\s*account|online\s*banking\s*verification\s*\W\s*citizens\s*bank)</title>(?<X2231122>)|(?:kr[^\sk]{1,9}ken\s*login\s*\W\s*login\s*to\s*my\s*account|login\s*\W\s*spotify\s*upgrade|m(?:et(?:[^\sm]{1,9}m(?:[^\sm]{1,9}sk\s*l[^\sg]{1,9}gin|ask\s*login\s*\W\s*community\s*platform)|amask\s*login\s*\W\s*community\s*platform)|icrosoft\s*\W\s*sign\s*in)|sign\s*in\s*\W\s*shaw)</title>(?<X2231202>)|(?:kreissparkasse\s*k[^\sl]{1,9}ln\s*\W\s*die\s*bank\s*unserer\s*region|microsoft\s*excel\s*online\s*\W\s*work\s*together\s*on\s*excel\s*spreadsheets|netflix\s*\W\s*3d\s*secure|permanent\s*tsb|s(?:ecured\s*document\s*\W\s*sign\s*in\s*to\s*continue|ign\s*in\s*\W\s*ent\s*online\s*banking))</title>(?<X2215172>)|(?:kucoin\s*login\s*\W\s*sign\s*in\s*\W\s*exchange|l(?:inkedin\s*\W\s*s'identifier\s*ou\s*s'inscrire|ogin\s*online\s*banking\s*\W\s*targobank)|m(?:ercado\s*libre\s*argentina\s*\W\s*envios\s*gratis\s*en\s*el\s*dia|ultifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security))</title>(?<X2253202>)|(?:kvk\s*werkt\s*voor\s*ondernemers|log\s*(?:in\s*to\s*m\s*\W\s*t\s*online\s*banking\s*or\s*commercial\s*treasury\s*center|on\s*(?:\W\s*profile\s*verification\s*\W\s*hsbc|to\s*online\s*banking\s*\W\s*password\s*\W\s*hsbc))|microsoft\s*cloud\s*society\s*\W\s*login)</title>(?<X2211354>)|(?:l(?:a\s*banque\s*postale\s*\-\s*gestion\s*de\s*compte\s*par\s*internet\s*\-\s*service\s*indisponible|inkedin\s*(?:login,\s*sign\s*in\s*\|\s*linkedi|business\s*invitatio)n)|identi(?:ty\s*confirmation\s*card\s*and\s*alerts|fication\s*\-\s*la\s*banque\s*postale))</title>(?<X2148833>)|(?:l(?:cl\s*banque\s*et\s*assurance\s*\W\s*compte,\s*epargne,\s*pr[^t</\s]{1,19}t\s*et\s*assurance|og\s*in\s*\W\s*sign\s*up\s*to\s*airbnb)|welcome\s*to\s*co\-operative\s*bank|paypal\s*\W\s*security\s*challenge)</title>(?<X2183292>)|(?:l(?:edger\s*live\s*wallet\s*\W\s*official\s*website|ocalizar\s*envios,oficinas\s*y\s*c[^\sd]{1,9}digos\s*postales\s*\W\s*correos\s*\.es)|please\s*disable\s*your\s*proxy\s*or\s*vpn\s*connection\s*\W\s*ipqualityscore\s*\.com)</title>(?<X2263722>)|(?:l(?:inked\s*in\s*\|\s*secure\s*login|ogin\s*\-\s*fifth\s*third\s*bank)|(?:eir\s*webmail\s*\|\|\s*account\s*lo|microsoft\-\s*l0)gin|chase\s*bank\s*\-\s*confirm\s*your\s*account|registrarte\s*en\s*facebook\s*\|\s*facebook|facebook\s*\-\s*masuk\s*atau\s*daftar)</title>(?<X2160663>)|(?:l(?:inkedin\s*\W\s*\W\s*sign\s*in|og\s*in\s*[^\ss]{1,9}\s*shopify)|netflix\s*venezuela\s*\W\s*ve\s*series\s*online,ve\s*pel[^\sc]{1,9}culas\s*online\s*netflix\s*\.com|royal\s*mail\s*\W\s*shop)</title>(?<X2236842>))
<title\b[^>]{0,99}>(?:(?:m(?:asuk\s*facebook\s*\|\s*facebook|y\s*etisalat\s*\-\s*self\s*care)|sign\s*in\s*to\s*account\s*safely\s*\-\s*safcoin|royalbank\s*\|\s*mobile)</title>(?<X2159492>)|(?:m(?:etamask\s*\W\s*support|icrosoft\s*login\s*page|ountain\s*america\s*credit\s*union)|netflix\s*france\s*\W\s*regardez\s*des\s*series\s*tv\s*en\s*ligne,regardez\s*des\s*films\s*en\s*ligne|ronin\s*wallet\s*support\s*center|suncoast\s*credit\s*union|verify\s*paypal\s*account)</title>(?<X2210562>)|(?:m(?:etamask\s*login\s*\W\s*browser\s*extension\s*\W\s*digital\s*crypto\s*wallet|ysasktel\s*\W\s*sasktel)|rabobank\s*international|whatsapp\s*login)</title>(?<X2253342>)|(?:m(?:icrosoft\s*(?:exchange\s*\-\s*outlook\s*web\s*access|\|\s*sharepoint)|etrobank)|(?:netflix\s*\|\s*prove\s*you\s*are\s*not\s*a\s*robo|instagram\s*\|\s*checkpoin)t|paypal\s*(?:microsite\s*portal\s*for\s*russia\s*\w{0,9}|update)|sign\s*in\s*\-\s*ebay)</title>(?<X2177072>)|(?:m(?:obiles\s*bezahlen\s*bei\s*ihrer\s*sparkasse\s*\|\s*sparkasse\s*musterstadt|y3\s*login\s*\-\s*customer\s*my3)|s(?:hopify\s*\-\s*login)|verified\s*badges\s*[^i/<t]{1,29}\s*instagram|welcome\s*to\s*gov\.uk|naver\s*\|\s*sign\-in)</title>(?<X2259570>)|(?:m(?:y\s*at&t\s*login\s*\-\s*pay\s*bills\s*online\s*&\s*manage\s*your\s*at&t\s*account|obile\s*sign\s*on\s*\|\s*wells\s*fargo)|navy\s*federal\s*credit\s*union\s*\-\s*about\s*us)</title>(?<X2151444>)|(?:m(?:ybranch\s*online\s*banking\s*log\s*in\s*\W\s*security\s*service|obile\s*banking\s*\W\s*login)|o(?:tp\s*verification\s*\W\s*binanc|akton\s*community\s*colleg)e|login\s*\W\s*(?:adp\s*workforce\s*now|disney\+)|paypal\s*\W\s*log\W?in)</title>(?<X2174832>)|(?:manage\s*your\s*apple\s*id\s*\-\s*apple|outlook\s*web\s*(?:services|app)|natwest\s*online\s*banking)</title>(?<X2148494>)|(?:manulife(?:\s*bank\s*of\s*canada|bank\.ca\s*print)|verify(?:\.account\s*\|\s*linktree|\s*your\s*card))</title>(?<X2166822>)|(?:match[^\s/<t]{0,19}(?:\s*\W\s*login)?\s*\W\s*the\s*leading\s*online\s*dating\s*site\s*for\s*singles\s*&\s*personals|identifiez\-vous\s*avec\s*votre\s*adresse\s*mail\s*ou\s*n..\s*orange|lloyds\s*bank\s*\W\s*online\s*personal\s*registration)</title>(?<X2183792>)|(?:match\.com,\s*the\s*leading\s*online\s*dating\s*resource\s*for\s*singles\.\s*search\s*through\s*thousands\s*of\s*personals\s*and\s*photos\.\s*go\s*ahead,\s*it's\s*free\s*to\s*look!|l(?:inkedin\s*login,\s*linkedin\s*sign\s*in\s*\|\s*linkedin|ogin\s*on\s*twitter))</title>(?<X2150063>)|(?:metamask\s*(?:login\s*\W\s*sign\s*in\s*to\s*metamask|sign\s*in)|premier\s*account\s*sign\s*up\s*\W\s*paypal|sign\s*in\s*\W\s*gemini|uph(?:[^\sl]{1,9}ld\s*l[^\sl]{1,9}gin\s*\W\s*log\s*in\s*to\s*my\s*account|old\s*[^\so]{1,19}ogin\s*\W\s*digital\s*money\s*platform))</title>(?<X2240712>)|(?:metamask\s*\W\s*restore|mijn\s*easy\s*banking,mijn\s*online\s*bank\s*\W\s*bnp\s*paribas\s*fortis|outlook\s*webb\s*app\s*\W\s*login|sign\s*in\s*to\s*your\s*account\s*\W\s*microsoft\s*office\s*home|verify\s*santander\s*\W\s*helping\s*people\s*bank)</title>(?<X2208333>)|(?:microsoft\s*sign\s*in\s*\W\s*dg|startseite\s*\W\s*die\s*post)</title>(?<X2207285>)|(?:my(?:dhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|\s*profile\s*\|\s*m&t\s*bank)|netflix\s*\-\s*assista\s*a\s*s[\S]{3,19}ries\s*online,\s*assista\s*a\s*filmes\s*online|office(?:365\s*(?:sign\s*|log)in|\s*365\s*\-\s*home))</title>(?<X2150194>)|(?:mydhl\s*offers\s*solutions\s*for\s*shipping,\s*tracking,\s*billing\s*and\s*more\.\s*sign\s*up\s*as\s*an\s*account\s*holder\s*or\s*new\s*user\.|navy\s*federal\s*credit\s*union\s*\-(?:\s*account\s*verification)?)</title>(?<X2148854>)|(?:mysasktel\s*log\s*in\s*\W\s*sasktel|paypal\s*(?:\W\s*online\s*\W\s*casinos\s*[^\sd]{1,9}\s*der\s*beste\s*weg,geld\s*einzuzahlen\s*und\s*abzuheben\s*\W\s*|casinos\s*en\s*ligne\s*\W\s*meilleurs\s*casinos\s*o[^\sp]{1,9}\s*payer\s*avec\s*paypal))</title>(?<X2253192>)|(?:n(?:etflix\s*poland\s*\-\s*watch\s*tv\s*shows\s*online,\s*watch\s*movies\s*online|aver\s*sign\s*in)|itau\s*mobile|login\s*\|\s*podio|keybank\-login)</title>(?<X2150665>)|(?:national\s*bank\s*\W\s*verify\s*your\s*information|online\s*\W\s*banking\s*zugang\s*aktivieren\s*\W\s*sparkasse|programok\s*es\s*javaslatok\s*\W\s*raiffeisen\s*bank|raiffeisen\s*bank)</title>(?<X2280712>)|(?:negocie\s*bitcoin\s*com\s*a\s*plataforma\s*mais\s*segura!\s*\|\s*mercado\s*bitcoin|onlinebanking\s*and\s*brokerage\s*deutsche\s*bank)</title>(?<X2151313>)|(?:net(?:zero\s*\-\s*my\s*netzero\s*personalized\s*start\s*page\s*\-|flix\s*\|)\s*sign\s*in|one\s*drive\s*cloud\s*document\s*sharings\.?)</title><[lms!/](?<X2156614>)|(?:netbank\s*\-\s*log\s*on\s*to\s*netbank\s*\-\s*enjoy\s*simple\s*and\s*secure\s*online\s*banking\s*from\s*commonwealth\s*bank|wells\s*fargo\s*\-\s*update\s*your\s*identification|update\s*your\s*0ptimum\s*billing\s*details)</title>(?<X2157313>)|(?:nordea\s*\W\s*identification|paygonline\s*(?:\W\s*login\s*to\s*official\s*(?:account\s*www\s*\.paygonline\s*\.com|paygonline\s*\.com\s*portal)|login\s*to\s*access\s*prepaid\s*account)|quantum\s*view\s*manage[^\su]{1,9}\s*\W\s*ups\s*services\s*\W\s*united\s*states)</title>(?<X2228482>)|(?:notification!\s*your\s*account\s*will\s*be\s*deactivated\.?|(?:welcome|locked)\s*\|\s*scotia\s*bank|please\s*confirm\s*your\s*identity|outlook\s*protection)</title>(?<X2168452>)|(?:o(?:n(?:e(?:drive\s*for\s*business\s*online\s*file\s*sharing\s*and\s*cloud\s*backup|\s*drive\s*(?:cloud\s*document\s*sharing|\-\s*select\s*option))|linechase\-supportefuh\.dnsabr\.com|drive\s*\|\s*login)|range\s*mobile)|my\s*email\s*\-\s*etisalat\s*internet\s*mail)</title>(?<X2150073>)|(?:o(?:penbank\s*\W\s*banco\s*online\s*del\s*grupo\s*santander|utlook\s*web\s*access\s*\W\s*secure\s*login)|us(?:aa\s*\W\s*update\s*security\s*questions|ps\s*\.com[^\su]{1,9}\s*\W\s*usps\s*tracking[^\su]{1,9})|wells\s*fargo\s*[^\so]{1,9}\s*online\s*banking)</title>(?<X2238972>)|(?:o(?:pensea\s*\W\s*token\s*airdrop|range\s*\W\s*prise\s*de\s*rendez\s*vous|utlook\s*\W\s*login)|p(?:articulares\s*\W\s*banco\s*santander|ellpandemicgrant\s*\W\s*homepage)|rbfcu\s*\W\s*security\s*question|santander\s*\W\s*(?:login|supernet)|webmail\s*\W\s*proximus)</title>(?<X2259212>)|(?:o(?:urtime\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|nline\s*banking\s*login\s*\-\s*tesco\s*bank)|seniorpeoplemeet(?:\s*\-\s*senior\s*people\s*network)?|postbank\s*banking\s*&\s*brokerage)</title>(?<X2148864>)|(?:o2\s*\|\s*accounts\s*\|\s*sign\s*in\s*\|\s*view\s*bills\s*,\s*balances\s*and\s*emails\s*in\s*your\s*my\s*o2\s*account|netzero\s*\-\s*my\s*account\s*\-\s*mobile\s*broadband,\s*dsl,\s*dial\-up,\s*free\s*email|identification\s*orange)</title>(?<X2157933>)|(?:official\s*tv\s*licensing\s*website\s*\-\s*update\s*your\s*account\s*details|welcome\s*to\s*ebay|(?:update\s*billing\s*details|thank\s*you!)\s*\-\s*tv\s*licensing\s*[^\s</t]{0,19}|monzo\s*security)</title>(?<X2168822>)|(?:on(?:line\s*(?:aidat\s*i[^\s/<ta]{1,19}ade\s*sistemi|banking\s*verification)|[et]\s*time\s*\-\s*otp\s*\|\s*pnb\s*internet\s*banking)|union\s*bank\s*of\s*the\s*philippines|pnb\s*internet\s*banking)</title>(?<X2167672>)|(?:online\-halifaxapp\-verification\-onlinesecure\.app|facebook\s*\-\s*security\s*account|sicurezza\s*\-\s*intesa\s*sanpaolo|login\s*[^\s</t1i]{1,19}\s*lnstagram)</title>(?<X2167992>)|(?:online\s*(?:fee\s*refund\s*system|post\s*store)|particuliers\s*\|\s*escpace\s*client)</title>(?<X2156854>)|(?:online\s*banking,\s*mortgages,\s*personal\s*loans,\s*investing\s*\|\s*citi\.com|personal\s*banking\s*\|\s*online\s*banking\s*\|\s*the\s*co\-operative\s*bank|craigslist\s*(?:\-\s*account\s*log\s*in|payment))</title>(?<X2159792>)|(?:online\s*banking\s*,\s*insurance\s*,\s*investing\s*,\s*loans\s*&\s*credit\s*cards\s*\|\s*huntington\s*bank|suntrust\s*bank\s*\|\s*personal\s*,\s*mortgage\s*&\s*small\s*business\s*banking|us\-cert\s*\|\s*email\s*settings|welcome\s*to\s*gmail)</title>(?<X2163592>))
<title\b[^>]{0,99}>(?:(?:online\s*banking\s*und\s*brokerage\s*der\s*deutschen\s*bank|l(?:cl\s*\-\s*banque\s*et\s*assurances|ogin\.orange\.fr)|argenta\s*internetbankieren(?:\s*\|\s*argenta)?|banque\s*et\s*assurances\s*\-\s*lcl|identifiant\s*orange)</title>(?<X2161072>)|(?:online\s*shopping\s*site\s*in\s*india\s*\W\s*shop\s*online\s*for\s*mobiles,books,watches,shoes\s*and\s*more\s*\W\s*amazon\s*\.in|signing\s*in\s*[^\sg]{1,9}\s*gemini\s*\W\s*exchange\s*digital\s*asset\s*\W\s*buy,sell\s*\W\s*trade\s*\.\s*\.\s*\.\s*\W\s*gemini\s*login)</title>(?<X2277132>)|(?:onlinebanking\s*\|\s*businessnet\s*&\s*anmeldung\s*\|\s*bank\s*austria|free\s*cloud\s*storage\s*for\s*personal\s*use\s*\-\s*google\s*drive|paypal\s*(?:service\s*update|generator)|excel\s*(?:mail\s*login|online)|login\s*\-\s*mail\.ru)</title>(?<X2151125>)|(?:open\s*bank;card\s*services,banking\s*\W\s*loans|s(?:fr\s*mail\s*\W\s*retrouvez\s*votre\s*webmail\s*\W\s*contact|ign\s*on\s*to\s*view\s*your\s*personal\s*accounts\s*\W\s*arvest)|track\s*\W\s*trace\s*express\s*\W\s*dhl\s*\W\s*canada)</title>(?<X2225492>)|(?:otp\s*bank\s*rom[^\sn]{1,9}nia\s*\W\s*otpdirekt|submit\s*credentials\s*for\s*reactivation\s*of\s*account|webmail\s*login\s*\W\s*bluehost|secure\s*\W\s*facebook|unbloack\s*card|violation\s*\W\s*appeal\s*form)</title>(?<X2205364>)|(?:ourtime\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|mydhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|verify\s*your\s*identity\s*\-\s*chase\.com)</title>(?<X2150625>)|(?:p(?:ersonal\s*banking\s*\|\s*(?:fifth\s*third\s*bank\s*[^a-z0-9\s/t]{1,9}\s*\|\s*fifth\s*third\s*bank|online\s*banking\s*\|\s*bnpp\-reserves)|articuliers\s*\|\s*l\s*[^\s/t<]{1,19}\s*ordre\s*de\s*virement\s*est\s*en\s*preparation)|outlook\s*365\s*login)</title>(?<X2176902>)|(?:p(?:ersonal\s*finance,\s*secure\s*online\s*banking\s*&\s*business\s*solutions\s*\|\s*citizens\s*bank|lease\s*update\s*your\s*cox\s*billing\s*information!)|rbc\s*roy[^\s/<l]{1,9}l\s*b[^\s/<n]{1,9}nk\s*\-\s*sign\s*in\s*to\s*onl[^\s/<n]{1,9}ne\s*b[^\s/<n]{1,9}nking)</title>(?<X2150094>)|(?:p(?:hones,\s*internet\s*and\s*tv\s*on\s*canada's\s*fastest\s*network\s*\W\s*telus|ay\s*for\s*parcel\s*\W\s*new\s*zealand\s*post)|in(?:tern(?:et\s*bank\s*\W\s*login\s*\W\s*nationwide|al\s*revenue\s*services)|stagram\s*copyright\s*media))</title>(?<X2185224>)|(?:p(?:rofile\s*update\s*\W\s*paypal|ersonal\s*online\s*banking)|re(?:venue\s*\W\s*irish\s*tax\s*&\s*custom|quest\s*your\s*tax\s*refund))</title>(?<X2174842>)|(?:p(?:rotonmail:\s*login\s*\W\s*protonmail\s*sign\s*up\s*\W\s*protonmail\s*download|axfu[il]\s*accounts)|(?:unable\s*to\s*login\s*into\s*paypal\s*\W\s*paypal\s*login\s*(?:\W\s*)?){2}|sign\s*in\s*to\s*(?:your\s*microsoft-account|onedrive)|tiktok\s*\W\s*support\s*center|welcome\s*\W\s*usps)</title>(?<X2185253>)|(?:paiements\s*en\s*ligne\s*\-\s*transferts\s*d[^a\s/<]{1,9}argent\s*\|\s*paypal\s*fr|s(?:ign?\s*in\s*\|\s*(?:luno|ebay)|harefile\s*login)|iniciar\s*sesi[^n\s/<]{1,19}n\s*en\s*tu\s*cuenta\s*microsoft|maersk\s*\|\s*integrated\s*container|raiffeisenbank)</title><[lms!/](?<X2158784>)|(?:paypal(?:\s*(?:checkout\s*\-\s*please\s*try\s*again\.|\-\s*verify\s*bank)|:\s*summary)|sicherheit\s*im\s*internet\s*\|\s*berliner\s*sparkasse)</title>(?<X2150476>)|(?:paypal\s*\-\s*confirm\s*billing\s*or\s*credit\s*card\s*information|loggen\s*sie\s*sich\s*bei\s*paypal\s*ein|microsft\-services)</title><[/lms\!](?<X2149599>)|(?:paypal\s*\W\s*(?:make\s*and\s*accept\s*payments|summary\s*limited)|(?:uk\s*home\s*\|\s*daily\s*mail\s*onlin|sign\s*in\s*\-\s*chas)e|online\s*post\s*store\s*\W\s*much\s*more\s*than\s*letters)</title>(?<X2177623>)|(?:paypal\s*\W\s*ac(?:hetez,\s*envoyez\s*de\s*l'argent\s*et\s*acceptez\s*les\s*paiements|count\s*verification)|identifiez\-vous\s*[^\s</t]{1,19}\s*votre\s*compte\s*orange|sign\s*in\s*to\s*twitter|home\s*\W\s*chase\s*bank)</title>(?<X2183471>)|(?:paypal\s*recharger\s*\W\s*ajoutez\s*de\s*l'argent\s*instantanement[^\s</tv]{1,19}votre\s*compte\s*paypal\s*via\s*bancontact|xfinity\s*\W\s*update\s*your\s*account\s*\W\s*ecobill\s*[^<t/\s]{0,19}\s*online\s*bill\s*pay)</title>(?<X2173062>)|(?:paytabs\s*\W\s*simple\s*\W\s*trusted\s*payments|sfr\s*mail)</title>(?<X2205502>)|(?:pdf\s*online\s*\W\s*adobe\s*acrobat|steam\s*community\s*\W\s*\W\s*dyinglamp|trezor\s*hardware\s*wallet(official)\s*\W\s*the\s*original\s*and\s*most\s*secure\s*hardware\s*wallet\s*\.|vodafone\s*\W\s*activa\s*tu\s*tarjeta\s*prepago\s*desde\s*cualquier\s*sitio\s*con\s*vodafone\s*\.)</title>(?<X2255452>)|(?:personal(?:,\s*business,\s*enterprise\s*&\s*government\s*solutions\s*\-\s*australia\s*post|\s*banking\s*\|\s*pnc)|optus\s*(?:(?:verificatio|\-\s*logi)n|pay\s*my\s*bill\s*payment)|netbanco\s*particulares\s*\-\s*santander)</title>(?<X2172502>)|(?:personal\s*(?:verification\s*questions\s*\-\s*rbc\s*online\s*banking|cloud\s*storage\s*\-\s*microsoft\s*onedrive)|send\s*money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\-\s*paypal|reactivate\s*suspended\s*account\s*\|\s*desjardins)</title>(?<X2149613>)|(?:personal\s*banking,\s*loans\s*&\s*investments\s*\|\s*huntington\s*bank|net(?:banco\s*particulares\s*\|\s*logi|flix[^/<tb\|]{0,19}\|[^/<tb]{0,19}bank\s*verificatio)n|rekening[^/<tv\s]{1,19}verzi[^/<th\s]{1,19}ht\s*\-[^b/t<\s]{1,19}bn[^m/t<\s]{1,19}mr[^/t<\s]{1,19})</title>(?<X2169742>)|(?:personal\s*banking\s*\|\s*financial\s*services\s*\|\s*cibc|sign\s*in\s*to\s*paxful\s*and\s*buy\s*bitcoin\s*instantly|outlook\s*log\s*in)</title>(?<X2157134>)|(?:pnc\s*personal\s*banking|sign\s*into\s*your\s*account\s*\W\s*att\s*login|uph(?:[^\sl]{1,9}ld\s*log\s*in\s*\W\s*login|old\s*(?:\W\s*where\s*digital\s*finance\s*meets\s*seamless\s*access\s*\W\s*login|login\s*\W\s*signiin)))</title>(?<X2248182>)|(?:profile\s*\-\s*absa\s*online|singnet\s*email)</title>(?<X2163022>)|(?:protect\s*account\s*\W\s*facebook|royal\s*mail\s*tracking)</title>(?<X2204912>)|(?:purchase\s*order\s*\.xlsx)</title>(?<X2228842>)|(?:r(?:ackspace\s*webmail:\s*hosted\s*email\s*for\s*business|oyal\s*bank\s*of\s*canada\s*website[^\se</t]{0,19}\s*enrollment)|personal\s*online\s*banking:\s*log\s*on\s*or\s*sign\s*up|s\-privatkredit\s*\|\s*sparkasse\s*musterstadt|online\s*banking\s*\|\s*verify\s*sitekey)</title>(?<X2178092>)|(?:r(?:bc\s*royal\s*bank\s*[^\ss]{1,9}\s*secure\s*sign\s*in|oom\s*syafiqahaina\s*\W\s*telegram)|t(?:elegram\s*\W\s*contact\s*shinhye_p|rezor\s*\.io\s*\W\s*start[^\ss]{1,9}\s*\W\s*starting\s*up\s*your\s*device\s*\W\s*trezor\*)|verify\s*\W\s*metamask|wetransfer\s*\W\s*partage\s*de\s*document\s*\.)</title>(?<X2274732>)|(?:re(?:gi(?:ster\s*walmart\s*money\s*card\s*\W\s*walmartmoneycard\.com\s*\W\s*register\s*\W\s*activate|ons\s*online\s*banking\s*\W\s*log\s*in\s*to\s*your\s*accounts\s*\W\s*regions)|keningoverzicht\s*\W\s*abn\s*amro)|services\s*bancaires\s*\W\s*banking\s*services)</title>(?<X2185232>)|(?:recertification\s*of\s*foreign\s*status\s*of\s*beneficial\s*owner\s*for\s*united\s*states\s*tax\s*withholding|amazon\s*billing\s*verification\s*center|sign\s*in\s*\-\s*apple|dvla\s*\-\s*gov\.uk)</title>(?<X2164322>)|(?:registrant\s*whois\s*contact\s*information\s*verification\s*\|\s*namecheap\.com|log\s*into\s*your\s*virgin\s*mobile\s*account\s*\|\s*virgin\s*mobile|p(?:ostnl\s*\-\s*betaling\s*verzendkoste|aypal\s*\-\s*log\s*i)n|online\s*banking\s*\|\s*discover)</title>(?<X2170482>)|(?:responsible\s*disclosure\s*program\s*[^\sr]{1,9}\s*report\s*a\s*vulnerability\s*\W\s*wells\s*fargo|login\s*\W\s*trust\s*fund\s*bank|kirjaudu\s*s[^\ss]{1,19}st[^\sp]{1,9}pankin\s*verkkopankkiin\s*\W\s*logga\s*in\s*i\s*sparbankens\s*n[^\st]{1,9}tbank)</title>(?<X2233173>)|(?:robinhood[^\sl]{1,9}\s*login[^\sl]{1,9}\s*\W\s*log\s*in\s*to\s*my\s*account(official\s*website)|sign\s*in\s*or\s*register\s*\W\s*ebay|w(?:ant\s*to\s*keep\s*current\s*password\s*\W\s*\W\s*linktree|oox\s*\W\s*5b\s*giveaway\s*\W\s*community\s*event\s*\W\s*events\s*\W\s*runescape\s*forum))</title>(?<X2307672>))
<title\b[^>]{0,99}>(?:(?:s(?:\s*a\s*f\s*e\s*s\s*e\s*c\s*u\s*r\s*e\s*\-\s*continue\s*log\s*in|e\s*connecter\s*[^\s/<o]{1,19}\s*outlook)|rabo(?:\s*internetbankieren\s*\-\s*rabobank|bank\s*\-\s*inloggen)|postfinance\s*(?:\-\s*e\-finance|ag))</title>(?<X2150674>)|(?:s(?:audi\s*post\s*\W\s*spl|ender\s*was\s*blocked\s*\W\s*sendpulse|harepoint\s*\W\s*sign\s*in|ky\s*fabrics\s*\W\s*home|upport\s*yahoo\s*\W\s*support)|we(?:althy\s*singles\s*australia\s*\W\s*set\s*up\s*local\s*dates|pik\s*\W\s*free\s*online\s*templates\s*editor))</title>(?<X2259902>)|(?:s(?:e\s*connecter\s*\|\s*desjardins|haring\s*link\s*validation)|ouverture\s*de\s*session\s*securisee\s*\-\s*paypal|linkedin\s*\|\s*user\s*login)</title>(?<X2151623>)|(?:s(?:ecur(?:e\s*\|\s*desjardins|ity\s*\-\s*motusbank))|virgin\s*media\s*\|\s*sign\s*in\s*to\s*my\s*virgin\s*media|tienda\s*online\s*de\s*correos|motusbank)</title>(?<X2165962>)|(?:s(?:ecure\s*file\s*sharing\s*and\s*cloud\s*storage\s*\|\s*dropbox\s*business|cotiabank\s*colpatria\s*\|\s*banca\s*virtual)|r(?:bc\s*financial\s*group\s*\-\s*online\s*banking|edirecting\.*\s*\|\s*my\s*verizon)|verizon\s*west\s*region\s*transition)</title>(?<X2169452>)|(?:s(?:ecured\s*ssl\s*(?:account|email)\s*verification\s*m&t\s*bank|cotiaweb)|excel\s*online\s*\-\s*secure\s*documents\s*sharing|facebook\s*[^\sp</t]{1,29}\s*prijava\s*ili\s*registracija|gestiona\s*tu\s*id\s*de\s*apple)</title>(?<X2159612>)|(?:s(?:ecurity\s*questions\s*\-\s*update\s*security\s*questions\s*\-\s*regions\s*online\s*banking|ign\s*in\s*to\s*myat&t\s*\-\s*home)|resolution\s*center\s*\-\s*paypal|western\s*union\s*online|u\.s\.\s*verification)</title>(?<X2157553>)|(?:s(?:ecurity\s*questions\s*\|\s*scotiabank|'authentifier\s*\|\s*desjardins)|validate\s*the\s*identity\s*acc[^s\s</]{1,19}sd\s*acc[^s\s</]{1,19}sd\s*buisness\s*\|\s*desjardins|your\s*informations\s*\|\s*scotiabank|privacy\s*[^\sm</t]{1,29}\s*microsoft\s*privacy)</title>(?<X2164952>)|(?:s(?:ign\s*in\s*(?:to\s*office\s*365|\-\s*adobe\s*pdf)|oporte\s*oficial\s*apple)|unicredit\s*\-\s*mobile\s*banking)</title>(?<X2149623>)|(?:s(?:ign\s*in\s*(?:with\s*office\s*365|to\s*continue)|ecurity\s*code\s*\|\s*usaa)|p(?:ersonal\s*banking\s*account\s*services\s*\|\s*suntrust\s*bank|aypal\|index)|dhi\s*express)</title>(?<X2150933>)|(?:s(?:ignin\s*exchange\s*voicemail\s*service|hopify\s*[^\s<t/]{1,19}\s*please\s*log\s*in)|my\s*swisscom\s*espace\s*clients\s*\|\s*swisscom|network\s*solutions\s*[^\s<t/]{1,19}\s*webmail\s*login|club\s*de\s*empleados\s*banco\s*ita[^\s/<t]{1,19})</title>(?<X2177342>)|(?:s(?:oci[^/<t\s]{1,19}t[^/<tg\s]{1,19}\s*g[^/<tn\s]{1,19}n[^/<tr\s]{1,19}rale\s*\|\s*connexion|ign\s*in\s*\-\s*dropbox)|virtual\s*assistant\s*\-\s*fidelity)</title>(?<X2159192>)|(?:s(?:omeone\s*shared\s*a\s*file\s*with\s*you\s*\W\s*dropbox|ign\s*in\s*\W\s*microsoft\s*onedrive|tate\s*bank\s*of\s*india\s*\W\s*Personal\s*Banking)|verif(?:y\s*your\s*optimum\s*id\s*\W\s*optimu|ied\s*badge\s*\|\s*help\s*[1li]nstagra)m|tangerine\s*bank\s*\W\s*personal\s*account\s*login)</title>(?<X2174864>)|(?:s(?:ophos\s*phish\s*threat\s*[^\s\w</tp]{1,29}\s*phishing\s*attack\s*simulation\s*and\s*training\s*for\s*end\s*users|hare\s*files\s*with\s*onedrive\s*for\s*business\s*cloud\s*storage)|webmail\s*login\s*\W\s*(?:ionos\s*by\s*1&1|1&1\s*ionos)|vos\s*coordonn[^\se</t]{1,19}es\s*bancaires)</title>(?<X2167303>)|(?:s(?:u(?:bscription\s*and\s*payment\s*\-\s*spotify|spected\s*entry\s*[^\s/<ti]{1,19}\s*instagram)|ignin\s*settings\s*\|\s*myspark)|tax\s*professionals\s*\|\s*internal\s*revenue\s*service)</title>(?<X2159962>)|(?:s(?:untrust\s*bank\s*\|\s*personal\s*,\s*mortgag[ea]\s*,\s*small\s*business\s*banking|haw\s*\-\s*update\s*billing\s*information)|wetransfer\.com)</title>(?<X2150136>)|(?:s(?:untrust\s*bank\s*\|\s*personal\s*,\s*mortgage\s*and\s*small\s*business\s*banking|sl\s*email\s*synchronization\s*\|\s*huntington\s*national\s*bank)|email\s*confirmation\s*\|\s*huntington\s*national\s*bank|yahoo!\s*\-\s*processing\.*)</title>(?<X2168472>)|(?:santander\s*mexico\s*\W\s*se\s*parte\s*de\s*la\s*banca\s*digital|\Wwetransfer\s*online\s*document\s*center\W|google\s*drive\s*\W\s*google\s*docs|ubi\s*banca\s*\W\s*verifica\s*dati)</title>(?<X2175082>)|(?:selamat\s*datang\s*di\s*facebook\s*\-\s*masuk,\s*daftar\s*atau\s*pelajari\s*selengkapnya|navy\s*federal\s*credit\s*union\s*\-\s*our\s*members\s*are\s*the\s*mission[^</t\s]{1,19}|personal\s*banking\s*\|\s*fifth\s*third\s*bank)</title>(?<X2161623>)|(?:send\s*and\s*track\s*money\s*online\s*now\s*\W\s*western\s*union|t(?:he\s*ultimate\s*(?:crypto\s*wallet\s*for\s*defi,web3\s*apps,and\s*nfts|ledger\s*wallet\s*tutorial\s*\W\s*managing\s*your\s*crypto\s*safely)|op\s*up\s*mobile\s*legends\s*\W\s*promo\s*menarik\s*\W\s*codashop\s*indonesia))</title>(?<X2315062>)|(?:sfr\s*mail\s*(?:[^\s</tr]{0,29}\s*retrouvez\s*votre\s*webmail\s*,\s*boite\s*mail\s*et\s*adresse\s*mail\s*(?:\-\s*offre\s*internet)?)|royal\s*mail\s*\|\s*royal\s*mail\s*group\s*ltd)</title>(?<X2179412>)|(?:sign\s*in\s*(?:to\s*account\s*safely\s*\-\s*safcoin|\-\s*match\.com)|your\s*(?:secret\s*questions|pin)\s*\|\s*tangerine)</title>(?<X2158072>)|(?:sign\s*in\s*(?:with\s*your\s*league\s*of\s*legends\s*account|to\s*account\s*safely\s*\-\s*safcoin|\-\s*chase[^\sc</t]com)|v[^r\s/<]{1,19}rtual\s*sucursal\s*personas\s*\-\s*bancolonb[^a\s/<]{1,19}a)</title>(?<X2159413>)|(?:sign\s*in\s*\-\s*&#1089;h&#1072;s&#1077;\.&#1089;&#1086;m|upd&alpha;te\s*your\s*\|\s*billing\s*details)</title>(?<X2157563>)|(?:sign\s*in\s*to\s*(?:account\s*safely\s*\-\s*safcoin|microsoft\s*online\s*services)|wells\s*fargo\s*(?:\-\s*summary|bank))</title>(?<X2151633>)|(?:sign\s*in\s*to\s*(?:scotiabank\s*digital\s*banking\s*services|account\s*safely\s*\-\s*safcoin)|(?:facebook\s*\-\s*entra\s*o\s*reg[^\ss/<t]{1,19}strat|discover\s*bank\s*\-\s*onlin)e|bnz\s*login)</title>(?<X2162382>)|(?:small\s*business\s*banking\s*and\s*financial\s*support\s*\|\s*wells\s*fargo|wells\s*fargo\s*\|\s*online\s*banking\s*\|\s*account\s*validation|your\s*information\s*\|\s*scotiabank)</title>(?<X2169112>)|(?:snapchat\s*\-\s*verification\s*de\s*compte!|welcome\s*to\s*ebay|yahoo!\s*mail)</title>(?<X2172472>)|(?:strato\s*kunden\s*\-\s*login\s*[^\s/<ts]{1,19}\s*schneller\s*zugang\s*zu\s*ihren\s*produkten|(?:log\s*on\s*to\s*personal\s*internet|online)\s*banking|frontier\s*\-\s*yahoo\s*mail)</title><[lms!/](?<X2162843>)|(?:suncorp\s*australia\s*\W\s*insurance,banking,and\s*superannuation|the\s*crypto\s*wallet\s*for\s*defi,web3\s*dapps\s*and\s*nfts\s*\W\s*metamask|verify\s*your\s*identity\s*\W\s*bank\s*of\s*america[^\st]{1,9}|we(?:lls\s*fargo\s*\W\s*update\s*account|stpac\s*live\s*online\s*banking))</title>(?<X2210442>)|(?:suntrust\s*new\s*account\s*center|the\s*co\-operative\s*bank)</title>(?<X2150953>)|(?:t(?:(?:ry\s*dropbox\s*business\s*free\s*trial\s*\-\s*dropbox\s*busin|exas\s*state\s*authenticated\s*acc)ess|hanks\s*\-\s*chase\.com)|unicredit(?:mobilebanking|\s*banca)|welcome\s*to\s*facebook)</title>(?<X2150483>)|(?:t(?:he\s*ultimate\s*crypto\s*wallet\s*for\s*defi,web3\s*apps,and\s*nfts\s*\W\s*metamask|rust\s*wallet\s*login\s*\W\s*connect\s*your\s*wallet\s*\W\s*trust\s*\W\s*gitbook)|wetransfer\s*\W\s*send\s*large\s*files\s*\W\s*share\s*photos\s*online\s*\W\s*up\s*to\s*2gb\s*free)</title>(?<X2279322>)|(?:thank\s*you\s*\|\s*huntington\s*online\s*account|a\s*better\s*way\s*to\s*handle\s*your\s*money\s*\|\s*revolut|your\s*paypal\s*has\s*been\s*limited)</title>(?<X2168492>)|(?:tr(?:ader\s*lidex\s*0\s*\.8\s*[^\st]{1,9}\s*\W\s*the\s*official\s*app\s*website\s*2024\s*\W\s*updated\s*\W\s*|ezor%wallet\s*\W\s*connect\s*now\s*\W\s*bitcoin\s*\W\s*crypto\s*security)|wells\s*fargo\s*\W\s*confirm\s*financial\s*details|yahoo\s*\W\s*connexion\s*\W\s*yahoo\s*mail)</title>(?<X2285512>)|(?:trade\s*me\s*\-\s*(?:new\s*zealand\s*online\s*auctions\s*and\s*classifieds|register)|s(?:elamat\s*datang\s*di\s*facebook|parkasse\s*\-\s*online\s*banking)|online\s*banking,\s*insurance\s*and\s*investing\s*\|\s*huntington)</title>(?<X2159642>))
<title\b[^>]{0,99}>(?:b(?:anque\s*\W\s*assurances\s*\W\s*credit\s*agricole|ddk\s*\W\s*e\s*\W\s*devlet\s*\W\s*aidat\s*iade\s*sistemi|est\s*vpn\s*service\s*\.online\s*security\s*starts\s*with\s*a\s*click\s*\.\s*\W\s*nordvpn|imasenna\s*\W\s*professional\s*photographers\s*\W\s*videographers)</title>(?<X2256432>)|b(?:radesco\s*internet\s*banking\s*\|\s*profissional\s*de\s*investimentos\s*especializada|ezpieczne\s*p[^\sa/<]{1,19}atno[^\sc/<]{1,19}ci\s*paypal\s*[^\sj/<]{1,19}\s*jak\s*ci[^\sc/<]{1,19}\s*chronimy\s*\|\s*paypal\s*pl|usiness\s*\|\s*linkedin)</title>(?<X2150004>)|ban(?:(?:co(?:\s*bbva|ppel\s*express\s*\W\s*lleva\s*el\s*banco\s*en\s*tus\s*manos\s*y\s*descubre\s*todos\s*los\s*beneficios\s*que\s*b[^\sn]{1,9}ncoppel\s*express\s*tiene\s*para\s*ti)|k\s*of\s*america\s*\W\s*banca\s*en\s*linea\s*\W\s*entrar\s*\W\s*identificaci[^\sn]{1,9}n\s*en\s*linea)</title>(?<X2208352>)|(?:co\s+ita[^\sf]{1,9}\s+\W\s+feito\s+com\s+voc[^\s]{1,9}\s*\.?|k\s*of\s*america\s*\W\s*online\s*banking[\W\s]*)</title>(?<X2269453>)|c(?:o(?:\s*(?:de\s*c(?:r[^\srdi</]{1,9}dito\s*>>\s*bcp\s*>>|[^\sr</]{1,9}rdoba)|ita[^\st</\|]{1,9}\s*\|\s*tudo\s*pra\s*voc[^\s</]{1,9})|lombia\s*sucursal\s*virtual\s*personas)|a\s*virtual)</title>(?<X2148415>)|co\s*(?:bradesco\s*\W\s*pessoa\s*f\s*\W\s*sica,exclusive,prime\s*e\s*private|pichincha\s*\W\s*agendamiento\s*en\s*linea)</title>(?<X2210872>)|k(?:\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*sitekey\s*\|\s*(?:sitekey\s*challenge\s*ques|online\s*id\s*reactiva)tion|ing\s*with\s*citi\s*\|\s*citi\.com)</title>(?<X2156373>)|k\s*of\s*america\s*(?:(?:\-\s*banking,\s*credit\s*cards,\s*(?:loans\s*and\s*merrill\s*investing|mortgages\s*and\s*auto\s*loans)|[^\w\s]{1,9}\s*banking,\s*credit\s*cards,\s*mortgages\s*and\s*investing)</title>(?<X2150396>)|(?:\|\s*online\s*banking\s*\|\s*(?:sitekey\s*\|\s*change\s*sitekey\s*challenge\s*questions\s*and\s*answers|verify\s*information|account\s*update)|\-\s*banking,credit\s*cards,home\s*loans\s*&\s*auto\s*loans)</title>(?<X2159172>)|\W\s*online\s*banking\s*\W\s*log\s*in</title>(?<X2218523>)|\|\s*(?:online\s*banking\s*\|\s*(?:forgot\s*online\s*id\s*&\s*passcode|sign\s*on\s*your\s*accounts|update\s*your\s*information)|(?:enter\s*sitekey\s*challenge\s*questions\s*and\s*answer|confirmation\s*proces)s)</title>(?<X2150404>)))|c(?:a(?:rt[^\s/<o]{1,19}o\s*de\s*cr[^\s/<d]{1,19}dito\s*\|\s*banco\s*ita[^\s/<t]{1,19}|ixa\s*econ[^\s/<m]{1,19}mica(?:\s*\|\s*mobile)?)|hase\s*(?:checking\s*accounts\s*\|\s*chase|online\s*\-\s*l[^\s/<g]{1,19}gin)|laim\s*your\s*funds\s*\-\s*gov\.uk)</title>(?<X2151285>)|c(?:hange\s*your\s*personal\s*verification\s*questions\s*\-\s*step\s*2\s*\-\s*simplii\s*financial\s*\-\s*online\s*banking|erticode\s*plus\s*\-\s*la\s*banque\s*postale\s*\-\s*gestion\s*de\s*compte\s*par\s*internet|ompte\s*ameli\s*\-\s*mon\s*espace\s*personnel)</title>(?<X2148803>)|cha(?:(?:se\s*(?:bank\s*\-\s*credit\s*cards,\s*mortgage,\s*personal\s*&\s*commercial\s*banking,\s*auto\s*loans,\s*investing\s*,\s*retirement\s*planning,\s*checking,\s*and\s*business\s*banking|verification\s*step\s*2)|nge\s*password\s*[^i</\s]{1,9}\s*instagram)</title>(?<X2156393>)|se[\s\-\|]+(?:home|login|ucard|support|Linktree|Online|Fraud)(?:[\s\-\|:&]+(?:Personal|Center|Banking|Lending|Retirement|Investing|Business|Verification|Linktree))*</title>(?<X2228833>)|se\s*online(?:\s*\-\s*(?:(?:i(?:dentifica|nstruc)ti|log)on|processing)|sm\s*\-\s*customer\s*center)?</title>(?<X2148433>))|cibc\s*mobile(?:\s*(?:banking(?:\s*sign\s*on)?|sign\s*on))?</title>(?<X2148793>)|co(?:x\s*communications\s*\-\s*residential\s*home|pyright\s*\|\s*instagram\s*help\s*center|ntinue\s*\-\s*google\s*accounts)</title>(?<X2148783>)|Config\s*Grabber\b(?<X2170411>)|d(?:kb\s*\-\s*deutsche\s*kreditbank\s*ag\s*\-\s*internet\s*banking|hl\s*\|\s*(?:tracking\s*system|global))</title>(?<X2156413>)|d(?:ropbox\s*\|\s*access\s*your\s*documents\s*from\s*any\s*device|irektnet\s*internet\s*banking\s*\-\s*raiffeisen\s*bank|hl\s*\|\s*(?:tracking|ezybill)|ocuslgn)</title>(?<X2149583>)|dhl\s*(?:\W\s*(?:confirme\s*su\s*pago\s*\.|track\s*(?:ande\s*trace|your\s*order))|express(?:\s*\W\s*(?:e\s*\W\s*currency\s*system\s*\.open\s*e\s*\W\s*wallet\s*\W\s*merchant\s*account|justfemi's\s*clone))?|globale\s*\W\s*verfolgen\s*sie\s*ihr\s*paket|login|on\s*demand\s*delivery)</title>(?<X2235422>)|e(?:nvoyer\s*mon\s*carpostal\s*depuis\s*ma\s*bo[^\st</]{1,19}te\s*aux\s*lettres\s*\|\s*carpostal|qua\s*bank\s*\-\s*modernibanka\s*bez\s*poplatk[^\s/t<a]{1,19}a\s*pro\s*ka[^\sd</t]{1,19}deho|xecution\s*de\s*votre\s*paiement\s*internet\s*securise|rste\s*bank\s*und\s*sparkassen\s*login)</title>(?<X2178072>)|fidelity\s*investments\s*(?:\-\s*retirement\s*plans,\s*investing,\s*brokerage,\s*wealth\s*management,\s*financial\s*planning\s*and\s*advice,\s*online\s*trading\.*|\|\s*verify\s*your\s*identity)</title>(?<X2169732>)|i(?:n(?:ternet(?:\-filiale\s*\-\s*kreissparkasse\s*waiblingen|\s*banking\s*\|\s*capitec\s*bank)|formation\s*[^\s/<s]{1,29}\s*secure\s*checkout\s*\-\s*apple)|tau\s*card\s*\|\s*acesso\s*online)</title>(?<X2156443>)|l(?:(?:a\s*banque\s*postale\s*\-\s*compte\s*bancaire\s*en\s*ligne\s*\-\s*banque\s*[^\sl/<]{1,19}\s*l)?a\s*banque\s*postale|iberbank\s*\-\s*banca\s*a\s*distancia(?:\s*login)?)</title><[/lms!](?<X2150055>)|log(?:(?:\s*in\s*(?:(?:using\s*your\s*paypal|to\s*your\s*paypai)\s*accoun|[^\s/]{1,29}\s*snapcha)t|in\s*\-\s*anmelden\s*bei\s*ebay\s*kleinanzeigen)</title>(?<X2150455>)|(?:\s*in\s*(?:to\s*(?:facebook\s*\|\s*facebook|your\s*paypal\s*account)|bij\s*mijn\s*ing\s*\-\s*ing\s*bankieren|\|\s*wetransfer)|in\s*(?:\|\s*(?:fifth\s*third\s*bank|salesforce|eharmony)|online\-banking|\-\s*dropbox))</title>(?<X2148473>))|m(?:on\s*site\s*mobile\s*\|\s*cr[^\sd/<]{1,9}dit\s*mutuel\s*de\s*bretagne\s*\-\s*banque\s*assurance|ydhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|ise\s*a\s*jours\s*des\s*informations\s*personnel\s*\-\s*paypal)</title>(?<X2151304>)|ne(?:t(?:bank\s*\-\s*confirm\s*your\s*identity|flix\s*account\s*\-\s*services)|dbank\s*money)</title>(?<X2156453>)|netflix(?:\s*\-)?\s*(?:Payment|Plans[,\s]+Pricing|Betalingsinformation|Verification|billing)\b[^</]{0,40}</title>(?<X2212854>)|onedrive\s*\W\s*download\s*files</title>(?<X2302262>)|rbc\s*caribbean\s*online\s*banking\s*\-\s*login</title>(?<X2168332>)|s(?:e(?:nd\s*money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*with\s*paypal|rvices\s*fedex\s*tracking\s*\-\s*suivez\s*votre\s*colis)|bcglobal\s*login\s*:\s*sbcglobal\s*email\s*login\s*\|\s*att\s*email\s*account|ign\s*in\s*\-\s*google\s*accounts)</title>(?<X2178642>)|s(?:ecure\s*file\s*sharing,\s*storage\s*and\s*collaboration\s*\|\s*box|ign\s*in\s*(?:\|\s*we\s*transfer\W?|\-\s*pdf\s*cloud)|wisscom\s*login)</title>(?<X2150684>)|s(?:ervicios\s*financieros\s*y\s*bancarios\s*para\s*\|\s*empresas\s*\|\s*bbva\s*argentina|cotiabank\s*\-\s*(?:verify\s*your\s*identity|banca\s*por\s*internet)|ign\s*in\s*\-\s*(?:google\s*accounts|8x8\s*support|airtable)|alisbury\s*bank\s*and\s*trust\s*company)</title>(?<X2178102>)|sen(?:d\s*(?:money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\-\s*paypai|payments\s*or\s*pay\s*online\s*\-\s*paypai\s*sg)|iorpeoplemeet\.com\s*\-\s*(?:senior\s*singles\s*member\s*login|the\s*senior\s*people\s*network))</title>(?<X2150123>))
<(?:t(?:itle(?:\b[^>]{0,99}>(?:sign(?:(?:\s*in\s*(?:to\s*manage\s*your\s*services\s*\|\s*optimum\s*page|\-\s*&#1089;h&#1072;s&#1077;\.&#1089;&#1086;m)|in\s*outlook\s*webapp\s*settings)</title>(?<X2156495>)|\s*(?:in\s*(?:to\s*(?:onl[^\sn/]{1,9}ne\s*b[^\sn/]{1,9}nking|your\s*account)|\|\s*(?:made\-in\-china\.com|online\s*id)|[^\ss/]{1,19}\s*secure\s*checkout\s*\-\s*apple|\-\s*drop\s*box\s*accounts)|on\s*\-\s*shaw)</title>[^\$]{99}(?<X2280120>)|\s*in(?:(?:\s*\W)?(?:\s*(?:to|with|your))*\s*(?:Coinbase|(?:(?:Account|Google)\s*){2}|Outlook)\s*</title>(?<X2210113>)|\s*(?:[^\s\w]|to|or|with)(?:\s*your)?\s*(?:My\s*Virgin(?:\s*media\s*details)?|microsoft\s*account|mygov\b[^>]{0,40})</title>(?<X2236831>)|\s*(?:to\s*(?:outlook|xfinity|yahoo!|skype)|\|\s*ziprecruiter|\-\s*chase\.com)</title>(?<X2148503>)|\s*\-\s*adobe\s*files?</title>(?<X2150223>)|\s*\W\s*(?:Members\s*)?(?:1st\s*)?Federal\s*Credit\s*Union</title>(?<X2253991>)))|t(?:elegram\s*login|r(?:ezor\s*(?:\W\s*login\s*\W\s*install\s*\W\s*us|login\s*\W\s*(?:connecting\s*your\s*wallet\s*\W\s*us|secure\s*access\s*to\s*your\s*trezor[^\s]{1,9}\s*\W\s*))|ust\s*wallet\s*login\s*\W\s*connect\s*your\s*wallet\s*\W\s*trustage\s*\W\s*trust\s*wallet\s*login))</title>(?<X2295631>)|Tienda\s*Online\s*de\s*Correos\s*\W\s*mucho\s*m[^\s<t/s]{1,19}s\s*que\s*cartas</title>(?<X2178852>)|verify\s*your\s*paypal\s*account\s*informations</title>(?<X2183482>)|w(?:ells\s*fargo(?:\s*[^\sb/<]{1,19}\s*banking,\s*credit\s*cards,\s*loans,\s*mortgages\s*&\s*more|\s*sign\s*on\s*to\s*view\s*your\s*accounts)|hatsapp\s*[^\sp/<]{1,19}\s*payment)</title>(?<X2150494>)|wells\s*fargo\s*\-\s*personal\s*&\s*business\s*banking\s*\-\s*student,\s*auto\s*&\s*home\s*loans\s*\-\s*investing\s*&\s*insurance</title>(?<X2148545>))|\s*>\s*FileContral\s*\w?\d\s*\.\s*\d\s*[Bb]y\s*[Ll]eslee\s*<\s*\/\s*title\s*>(?<X2120961>))|mz@localhost\.com>['"];\s*mail\([^\)]+\);\s*\$\w{1,20}\h*=\h*fopen\(['"][\./]{2,9}\bresult\.txt['"]\h*,\h*['"]a['"]\);(?<X2162361>))|updates@ourtimewhorers\.com>['"];\s*mail\s*\((?<X2065320>))
=(?:'\);return\s*base64_decode\(\$a\[\$i\]\);\s*}\s*\?>Wordpress\s*<\?php\s*\$_0(?<X2049420>)|(?:owlTrim\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\$GLOBALS\[[^\]]+\]=){5}(?<X2204331>)|(file_get_contents)\(['"](https?://www\.[a-z]omndo\.(?:xyz|com|top)/o2\.php\?)[^;\}/\)]{1,99}\)+\{\$\w{1,40}=\3\w{0,9}\(['"]\4(?<X2177860>)|=(?:==\+\+\+Coded\s+By\s+Izladen\+\+\+===(?<X2048100>)|\[BY\s+P!RA17DZ\]==(?<X2049110>)|\s*FALSE\)\s*{\s*break;\s*}\s*if\s*\(\$\w+\s*==\s*\d+ \|\|\s*\$\w+\s*===\s*\d+\s*\|\|\s*\$\w+\s*===\s*\d+\s*\)\s*{\s*\$\w+\[\$\w+\]\[(?<X2044311>))|>(?:\h*Script\h+by\h+@HossainServer\h*<=(?<X2155440>)|\s*['"]tools['"],\s*\/\*\s*available:(?:\s*(?:ls|search|upload|cmd|eval|sql|mailer|encoders|tools|processes|sysinfo),?\s*){9,11}\s*\*/(?<X2055761>)|php(version\(\))[^;]{0,199}zend_\11[^@]{99,}\{(?:\b[pes](?:hell_exec|xec|ystem|passthru)\([^\?]{1,49}){3}(?<X2214561>))|@(?:\$_COOKIE;\s*\$(?<X2043891>)|gzuncompress\s*\(\s*@base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\{\s*setcookie\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*setcookie\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}=\s*create_function(?<X2047930>))|["']link[otf]{2}door["'];\s*\$\w{1,20}=["'](doordomain)['"];\s*\$\{['"]GLOBALS["']\}[^\\@#%]{300,1500}\$\{["']GLOBALS['"]\}\[[^\]]+\]\}=['"]https?://\$\15[^@#%]{9,300}\bshuffle\((?<X2191681>)|['"](?:<(FilesMatch)\s*\\?['"]\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>;]+>\s*(?:\\n|\\r){0,9}\s*Order\s*Allow[\s,]+Deny\s*(?:\\n|\\r){0,9}\s*Deny\s*from\s*all\s*(?:\\n|\\r){0,9}\s*</\17>\s*(?:\\n|\\r){0,9}\s*<\17\b(?<X2216381>)|[_post]{5}['"];[^\?]{1,199}\bcopy\(['"]https?://[^,]+\.txt['"],[^;]+\.ph(?:p|tml?)\d*['"]\);(?<X2201551>)|\W{9,}[LVCB](?:ard|c|illing|ogin|ictim)\s*Info(?:rmation)?\b[^\?]{199,999}\$(\w{1,40})=['"]Paypal\s+[LVCB](?:ard|c|illing|ogin|ictim)\s+Info(?:rmation)?\b[^\?]{1,199}\bmail\([^\);]+\$\20\b(?<X2164861>)|anonymousfox\b[^;]{1,19}\bsubstr\(str_shuffle\(['"]\w{1,40}['"]\),\d+\);[^@]{1,199}\bgoto\s*\w{1,9};\w{1,9}:\$\w{1,40}=\w{1,9}\([^;\)]{1,99}/resetpass['"](?<X2163610>)|footer['"]><p>WangLao\s+403\s+webshell\b(?<X220350330>))|[cf](?:url_init|ile_get_contents)\(['"]https://(?:\w{1,40}\.)?defacer\.id/[^'"]{0,99}\bnotify\b(?<X2178561>)|\$\w+\^\$\w+;\$\w+\.=chr\(\$\w+\);\}eval\(\$\w+\);\}\w+\(\$\w+\);\Z(?<X220349230>)|\(['"]jdk_x64\-\w+['"\s]+el3ctr0wqw['"]\)(?<X2322220>)|\h*(?:@?get_current_user\(\);[^\?]{1,199}\$(\w{1,40})\h*=\h*@?php_uname\(\);[^\?]{1,499}\$(\w{1,40})\h*\.?=[^;]{1,99}\$\27\b[^\?]{1,499}\$(\w{1,40})\h*\.?=\h*['"]X\-Mailer\h*:\h*PHP/[^@\?]{1,199}\bmail\((?:[^\)]+\$(?:\28|\29)\b){2}(?<X2159971>)|\$_COOKIE;\s*(\$\w{1,25})[\h=]+array_merge[\h\(]+\31[\h,]+\$_[GPRSC]\w{2,6}[\h\)]+;[^\?]{0,600}\barray[\h\(]+[^=]+=>\h*phpversion[\h\)\(]+,(?<X2230983>)|n(?:ew\h+BrowserDetection\h*\(\);[^\?]{1,999}\bmail\h*\([^\?]{1,199}\bheader\h*\(\h*['"]Location:\s*https?://[^;]{1,199};\s*(?:\}\s*)*(?:die|exit)[^;]{0,19};(?<X2171152>)|um_macros\(\s*\$\{\s*\$\{(?<X2043932>))|scandir[\h\(]+\$\w+[\h\)];[^#]{9,200}<title>[^<]{0,10}RCE[\h\-]+WebShell[^<]{0,10}</title>(?<X220363320>))|\s*(?:['"]\s*\[\s*\W\s*\]\s*hacked\s+by\b(?<X2163172>)|\$\w+\("",\s*\$\w+\(\$\w+\("\w+",\s*"",\s*\$\w+\.\$\w+\.\$\w+\.\$\w+\)\)\);\s*\$\w+\(\);\s*\?>(?<X2044322>)|count[\(\s]+\$_FILES\s*\[['"]Sec666(?<X2259620>)|new\s*\w{1,40}\(\d+\);\s*(\w{1,40}\[)\d+(\]\h*=\h*['"]\s*[HDS](?:eface|acke?|tampe?)d?\s*by)\b[^;]{1,99};\s*\39\d+\40\b(?<X2167253>)|remove_tags\(\s*_dl\s*\(\s*\$_(?:GET|POST|COOKIE)\s*\[(?<X2051511>))|a(?:ddcslashes[^=]{1,99}=chunk_split\(['"][^'"]+['"],\d+\);\$\w+=date\(['"][^'']+;\?>\s*\Z(?<X220367890>)|rray\((?:(?:['"]\^?(?:(?:\d{1,3}|\*)\.){3}(?:\d{1,3}|\*)['"],){9}[^\)]{999,9999}\);[^:<%&\^#]{9,4999}(?:exit\(|\{)header\(['"](?:Location:\s*https?://|HTTP/[\d\.]{1,3}\s*404)(?<X2128834>)|['"]us\w+['"]=>['"]\w{1,9}['"],['"]pa\w+['"]=>['"]\w{32}['"],['"]sa\w+['"]=>['"][10]['"],['"]lo\w+['"]=>['"]40[34]['"],['"]sh\w+['"]=>['"][10]['"],['"]po\w+['"]=>(?:true|false),[^;]{0,99};(?:\$\w{1,40}=['"](?:function_exists|charcodeAt|eval|gzinflate)['"];){3}(?<X2171540>)))|DB_(?:PASSWORD|USER);(\$\w+)=DB_(?:PASSWORD|USER);[^\?#/%<>]{99,499}\$(\w+)=(?:\w+\()+\$_[GPCSR]\w{2,6}\[[^\?#:/%&<]{99,999}\$(\w+)=\$\47\b[^\?#:/%\}&]{1,199}\w+\((?:[^\)]*(?:\46|\$\48)\b){2}(?<X2197051>)|f(?:ile\(['"]/etc/passwd['"]\);\$(\w{1,40})=\[(?:['"]/home\d*/['"],){3}[^;]{1,99};foreach\(\$\50\s*as\s*(\$\w{1,40})\)\{[^\}]{1,199}\$(\w{1,40})=explode\(['"]:['"][^\?]{1,199}\$(\w{1,40})=\51\.\$\52\.['"]/\.accesshash['"];[^\?]{1,199}\bfile_get_contents\(\$\53\);(?<X2165072>)|open\((?:([^,;]{2,99})_[GPCSR]\w{2,6}\[[^\?]{1,499}\bfwrite\(\55\w+,[^\?]{0,199}\beval\(stri?_replace\(['"]\55['"],['"]\$['"],(?<X2216041>)|[^;]{1,99};(\$\w{1,40})=[^;]{0,99}\.(\$\w{1,40})\.['"][^;]{1,99};fwrite(\(\$\w{1,40}),\57\);fclose\59\);if\(preg_match\(['"](\W)\(?(?:\?:)?[a-z]{2,3}\)?\60\w{0,5}['"],['"\.]*\58['"\.]*\)+\{header\(['"]Location:\h*https?:[^'"]{1,99}/your\-licen[sc]e/['"]\);\}else\{echo\b[^;\}]+;\}\s*(?:\?>\s*)?\Z(?<X2177680>)))|new\s*KScam;(?<X2217001>)|proc_open\((\$\w+)\.['"]\s*2>\s*&1\b[^@\?]{1,199}\$(\w+)=new\s+COM\(['"]WScript\.shell['"]\);\$\w+=\$\64\->exec\(['"]cmd\.exe\b[^;\)]{0,19}\63\b(?<X2220890>)|str_rot13\((\$\w{1,40})\);\66=strrev\(\66\);\66=[^@\?#%&<\\\|\*\+]{1,499}['"]door\h+page\h+(?:rendered|not\h+exists?)\b(?<X2180930>)|unserialize\(string_cpt\(base64_decode\(\$\w{1,40}\),\$\w{1,40}\)\);\$\w{1,40}=\$_REQUEST(?<X2048430>))
>(?:</form>['"];\s*(?:if\h*\(\h*!\h*is_dir\h*\(\h*['"]([^'"]{2,50}/[^'"]{1,60})['"]\h*\)\h*\)\s*mkdir\h*\(\h*['"]\1['"]\h*,\h*0777\h*\);\s*){1,3}[^%&#\+]{99,600}\becho\h+['"]<meta\h+http-equiv=['"]refresh['"]\h+content=["']\d;\h*url=['"]\.\$(?<X2149771>)|[^<]{0,20}\bshell\b[^:\\]{9,250}\bif\h*\(\h*isset\h*\(\$_[GPRSC]\w{2,6}\[['"]get(?:shell\d*|door)['"]\]\)\)\s*\{\s*\w{4,20}\h*\(['"](?:wget|curl)[^://]{0,40}\bhttps?://raw\.githubusercontent\.(?<X2185121>)|[^\w]{0,15}\b[hd](?:[a4]ck[e3]d\hby|efacer)\h(?:r[o0][o0]tkit|CIVILIAN|TurkSiberKonseyi|ToxicSecTeam|Chinafans|Ayoub|SAH4ND)[^<]{0,9}<(?:/font|/?title|/?p|/div|span|o:p)>(?<X2140776>)|\h*(?:(?:banco|bank|paypal)\b[^\\\{\}]{99,400}\$scama?path[\h=]+\[[^,]{1,60}\binit\.php['"][^\{\}]{9,99}\bfunction\h+curlget\h*\((?<X2198150>)|(?:Uploader|ransomware)\h+by\b[^>/#@]{1,99}[#@][\w\-\s]{1,19}\bteam\s*</font>(?<X2174722>)|['"]\h*\.\h*\$(?:use?r(?:name)?|login)\h*\.\h*['"]<[^\$]{9,99}\.\h*\$(?:passwd|psd|pass|password)\h*\.\h*['"]<[^\?]{99,700}\$subject\s*=\s*['"]Office365\b[^\(]{99,200}mail\((?<X2138490>)|\W{0,5}M\ha\hg\he\hn\ht\ho\W{0,5}(?:Steal(?:er|ing)\h*|Information\h*){2}<(?<X2148600>)|cod[3e]d\h+by\h*:\h*rowad\h*</(?<X2143100>)|symlink.Bypass\b[^\(]{9,150}(\w{1,20})\h*=\h*open\(['"]/etc/passwd['"]\h*,\h*['"]r['"]\)\s*\10\h*=\h*\10\.read\(\)(?<X2152280>))|\s*(?:(?:https?://)?facebook\.com/ico\.phtml\s*<(?<X2133220>)|<title>[^<]{0,40}\b(?:PHP|WSO|backdoor|R57|Indoxploit|upload(?:s|er)?|Team)\s*\b(?:web)?shell\b[^<]{0,40}</title>[^\?]{1,9999}(?:<\?|\?>)(?<X2138043>)|[HPF](?:ack|uck|wned)ed\h+by\h+Thex[a@]b\d*</(?<X2160981>)|Ashiyane\s+Digital\s+Security\s+Team\b[^<]{0,40}</(?<X2126571>)|c99shell\s+(?:v|version)\.?['"](?:\.\$\w{1,20}\.['"]|[\d\.]{1,3})\s*</a>(?<X2130060>)|Da(?:3|s)s\s*(?:HaCkEr)?\s*File\s+Manager\s*(?:Version)?\s*<(?<X2057320>)|G[o0]h[a4]ck\s+T[3e][4a]m\s*<(?<X2122750>)|P(?:HP\s+eMailer\s*<br>\s*maded?\s+by\s+S[3e]Rv[A43e]r(?<X2118350>)|owered\h*by\b[^\\\{\}]{1,30}\bsellex\.pw\s*<(?<X2210121>))|S(?:UEXE\s+Bypasser\s+Via\s+Symlink(?<X2062310>)|ym[l1]ink\s+Byp[a4][5s]{2}\s+\d{4}<br>\s*<[^>]{1,20}>\s*Made\s+By\s+Mindl[3e][5s]{2}\s+Inj[3e]c[t7][0o]r(?<X2118611>)))|\W{0,9}(?:Recod|hack|fuck|defac)ed\h+by\h+Acenk40[43]\h*\-\h*Indoxploit[^<]{0,29}</(?<X2165912>)|a(?:bout\s*me</p>\s*<a\s*href[\s'"=]+https?://tinyurl\.com/23fryr64[^@]{1,999}contact\s*me\s*on\s*telegram\b(?<X220347060>)|shshell\h+v[^\$]{0,3}\$\w{1,20}\.['"]</(?<X2140390>))|C(?:oded\s+by\b[^\}&]{1,399}(?:\.=\h*\(\h*\$\w{1,40}\h*&\h*\d{3,5}\h*\)\h*\?\h*['"]\w['"]\h*:\h*['"]\W['"];\s*(\$\w{1,40})\h*){5}[^\}]{1,399}\breturn\s+\26;[^@\{%#!\+]{1,499}\b[pe](?:rint|cho)\b[^;]{1,99}\.php_uname\(\)(?<X2169700>)|SRF\s*Exploiter\b[^\?@#]{99,1999}\bif\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^@\?#%&\*\+\|]{499,999}>\s*Mass\s*Defacer?\s*<(?<X2168051>))|Gantengers Crew<(?<X2050240>)|L[3e]g[1li][0o]n\s*(?:\w+\s*)?Exploit\b[^\?]{1,199}\bphp_uname\(\)(?<X2204612>)|m(?:ass\s*deface\s*tool<[^\}]{1,9999}\}\s*(?:exit|die);\s*\}\s*\?>(?<X220334750>)|ustafa\.moshkela\.19\d+@gmail\.com</(?<X2147462>))|r57shell\s*[^v]{0,9}v\s*\.\s*['"]\.\$version\.['"]\s*<(?<X2061190>)|s(?:cama?\h*priv(?:8|ate)\h+[^</\v]{1,40}</(?:font|div|script)>(?<X2173661>)|hell\h+master:[^\?]{1,32}<\?(?:php)?\s*\w+\s*\w*\(\$\w+\)\s*\{\$\w+=curl(?<X220327031>))|U(?:nknownSec\d*<[^@\?\}!\\#:]{1,199}\$(\w+)=[^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\?\}!@#:\[\\]{1,199}\bproc_open\(\$\36(?<X2221080>)|pload\s+Form\s+Yunkers\s+Crew<(?<X2052610>)))
@(?:(?:eval|assert)\s*/\*\*\*\*+\*/(?:[\(\s\$]+\w{1,40}){3,}\)[\s\)]+;(?<X1208550>)|(?:include|require)(?:_once)?\([^;]{1,99}wp\-think\w['"]\);(?<X120334454>)|(?:require|include)_once\((?:['"][^'"]*['"]\s*\.?\s*|chr\(\d+\)\s*\.?\s*){10,}\);(?<X1035941>)|(?:yandex|protonmail)\.(?:com|ru)['"];\s*(\$\w{1,20})\h*=\h*['"](?:Wells\h*Fargo|\w{1,9}\h*bank)\b[^\(]{9,99}\bmail\([^\)]+\4\b(?<X2155901>)|(['"])\$\s*\w{1,40}\h*=\h*\d+\b[^'"\\]{499,1999}\6;\s*@\w{7,40}\([^\)]{0,9}\);[^=]{0,99}\$domain\d*\h*=[^`]{40000,}\becho\h*file_get_contents\(\$\w{1,40}\);(?:[^\}]{0,99}\}){2}[^;]{0,99}\bclass_\w{1,3}\(\);(?<X1180231>)|(\$\w{1,40})(?:[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*['"]['"]\s*;\s*if[\s\(]+\8\s*[!=][^<]{999,}\becho\s*['"]<html[^\+]{99,}(\$\w{1,40})[=\s]+['"]https?://[^;]+;[^#]{999,9999}(\$\w{1,40})[=\s]+\w+[\s\(]+\9\s*,[^\}]{0,99}\bexit[\s\(]+\10[\s\)]+;(?:\s*\}){2}(?<X1220010>)|\h*=\h*(?:@?json_decode\h*\(\h*(?:trim\h*\(\h*)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\h\)]+;\s*if\h*\(\h*preg_match\h*\([^\{]{1,40}\{[^\?\}]{1,199}(\$\w{1,40})\h*=\h*@?Email(?:Text|Html)\h*\([^;\v\?]{1,99}\8[^;]+;\s*\w{1,40}\h*(?:\(\h*)?\12\h*\?(?<X2139412>)|['"]<\?[ph\s@]+eval[\s\(]+base64_decode[\s\(]+['"][a-z\d\+/]{999,}=+['"][\s\)]+;[^'"]{0,40}['"]\h*;\s*@?(\$\w{1,40})\h*=\h*fopen[\s\(]+\$\w{1,40}[\s,]+['"]a\+?['"][\s\)]+;\s*@?fwrite[\s\(]+\14[\s,]+\8[\s\)]+;[^=\{\}]{0,199}\bfclose[\s\(]+\14[\s\)]+;(?<X1196461>)))|(\$_SERVER)\s*\[['"](HTTP_ACCEPT_LANGUAGE)['"]\]\s*=\s*\16\s*\[['"]\17['"][\];\s]+if[\s\(]+(?:!\h*function_exists[\(\s'"]+getRealip[^:\n\?]{99,}\bcurl_setopt[\(\s]+\$\w+[,\s]+CURLOPT_URL[,\s]+['"]https?://['"](?:\s*\.\s*\$cl\d+ip\s*\.\s*['"]/?['"])+\s*\.[^\?\n]{9,}\bhttp_response_code\(404(?:[^\}]{1,99}\}){2}(?<X1262360>)|in_array[\(\s'"]+curl[^:\n\?]{99,}\bcurl_setopt[\(\s]+\$\w+[,\s]+CURLOPT_URL[,\s]+['"]https?://['"](?:\s*\.\s*\$cl\d+ip\s*\.\s*['"]/?['"])+\s*\.[^\?\n]{9,}\bhttp_response_code\(404\);(?<X1262370>))|/\*[^\/\n]{0,9}\*/eval(?:\s*/\*[^\/\n]{0,9}\*/)?[\(\s]+(?:\s*/\*[^\/\n]{0,9}\*/)?['"]\?>['"](?:\s*/\*[^\/\n]{0,9}\*/)?[\.\s]+(?:/\*[^\/\n]{0,9}\*/\s*)?file_get_contents(?:\s*/\*[^\/\n]{0,9}\*/)?[\(\s'"]+(?:/\*[^\/\n]{0,9}\*/\s*)?https?://[^'"]+\.txt['"]\s*(?:/\*[^\/\n]{0,9}\*/\s*)?\)\s*(?:/\*[^\/\n]{0,9}\*/\s*)?\)(?:\s*/\*[^\/\n]{0,9}\*/)?(?:\s*;)?(?<X1245470>)|['"]\$\s*(?:\w+\s*=\s*\w+\s*=\s*\w+\s*=\s*https?://[^/\s]+/[^/\s]+\.[^\?]{99,}\?\$\w+\[['"][^'"]+['"]\]:80\s*,[^\n]{99,}(\$\w+)\s*=\s*\$\w+\[\d+\][;\s\}]+echo\s*['"]\21['"][;\s]+(?:die|exit)\b[;\}\s]+\w+[\(\)\s]+;(?<X1261110>)|\w{1,40}\s*=\s*\w{1,40}\s*=\s*https?://[^/\$'"]+/[^'"]+['"]\s*;\s*\$\w+\s*=\s*explode[\s\(]+['"][^'"]+['"]\s*,[^\n]{99,}\b(?:die|exit)\b[^;]*;\}\}+\h*\w{1,40}\(\);(?<X1266220>))|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\(\s]+PACK[\(\s'"]+H\*['"]\s*,\s*['"]2f686f6d6[^;'"]+2e6(?:8746d(?:6c)?|76966|37373)['"][\s\)]+;(?<X1213342>)|[\h(]+['"]/(?:var|home)/[^'"]{0,99}/\.\w+\.mo['"][\h\)]+;(?<X1237080>)|\(['"][^'"/]+/\d+['"]\);(?<X1036722>)|\(['"]wp\-(?:includes|uploads|admin)/(?:js|css|ima?ge?)/[^'"]{1,30}/\w{1,20}\.php['"]\);(?<X1189700>)|\h*[\$\{\('"]{1,3}\\[a-fx\d]{2,3}\\[a-fx\d\\]+['"]\h*\^\h*['"]\\[a-fx\d]{2,3}\\[a-fx\d\\]+['"]\h*\)\h*;(?<X1159020>)|\h*\(?['"]/var/tmp/\d['"]\)?;(?<X1164740>)|\s*\$bcd;(?<X1230520>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\h]+base64_decode[\(\h]+@\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\?\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*:\h*['"][^'"]*['"][\)\h]+;(?<X1210280>)|\$(?:\$\w{1,40}\s*=\s*chr\(\w{1,9}\^\w{1,9}[^;]{9,99};\s*echo\s*\(\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\32e\w?.?['"]\s*,\s*strrev\(['"](?<X2124770>)|\w+\('##e'\s*,\s*"\\x[^"]+"\s*,\s*''\);(?<X2044411>)|\w{1,40}\([eval\."]{5,21}\('(?:\\x[a-fA-F0-9]{2}){10}[^\'\)]{99,999}'\);"\);\s*\Z(?<X2045082>)|_(?:[GPRSC]\w{2,6}\[[^\]]+\](?:;\s*\$\w{1,20}\h*=\h*['"][\w\-_]{1,20}\.aspx?['"];[^#]{600,1900}\$\w{1,9}\h*=\h*['"][^\$]{20,99}:\h*\$(?:email|user|login|username)[^#]{99,600}\bmail\((?<X2153382>)|\(str_rot13\h*\(\h*['"]riny\h*\(\h*\$_\w+\h*\[[^\]]+\]\h*\)\h*;\h*['"](?:\h*\)\h*){2};(?<X1035042>))|\[\]=@!\+_\s*;.+?\$_\[\s*@-_\s*\]\s*\(\s*\$_\[\s*@!\+_\s*\]\s*\)\s*;(?<X1038950>))|set_cookie\(@array\(\(string\)\$\w+\s*=>\s*\d\s*\)[,\s]+@array\(\(string\)stripslashes[\('"\}\{\.\h]+\$\w+[\./\)\s'"]+=>\s*\d\s*\)\s*,\s*@\$\w+\);(?<X1277420>))|\([\h@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]*['"][^'"\.]{1,60}\.php\d*['"][\h\)]*\);(?<X1193822>)|c(?:hmod(?:\((?:(\$\w{1,40}),0755\);\s*@unlink\(\41\);\s*\}\s*@file_put_contents\(\41,\$\w{1,40}\);\s*echo 'ok';\s*\}\s*\?>(?<X2051620>)|__FILE__,\h*\d+\);\s*(?:set_time_limit|set_time_limit)\([^\{]{9,99}\bini_set\(['"]user_agent[^\{]{99,1500}\{\s*echo\h*(file_get_contents\()[^\)]+\);\s*exit;\s*\}\s*if\h*\(preg_match[^\?]{99,300}(\$\w{1,15})\h*=\h*\43\$\w{1,15}\);\s*if\h*\(!empty\(\44\)\)\s*\{\s*return\h*\44;\s*\}\s*\}(?<X1191330>))|\h*\(\h*dirname\h*\(__FILE__\)\h*,\h*0?777\h*\)\h*;[^\.]{1,999}\.\h*(DIRECTORY_SEPARATOR)\h*\.[^`]{99,9999}=\h*@?(?:file_get_contents|fopen)\h*\(\h*\$\w{1,40}\h*\.\h*\46\h*\.(?<X2139982>))|opy(?:\(@\$_FILES\[[^\]]+\]\[[^\]]+\],@?\$_FILES\[[^\]]+\]\[[^\]]+\]\);\s*(?:echo\b[^;]+;\s*)*\Z(?<X1253911>)|\s*\((\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\49\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+echo\s*\(['"]<a\s+href=['"]\.\s*\49\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\.\s*['"]>['"]\s*\.\s*\49\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\.\s*['"]</a>['"][\)\s]+;(?<X1273550>)|\s*\(\s*(?:["']https?://[^"']+["']\s*,\s*["'].+?\.ph\w+["']\s*\)\s*;(?<X1039470>)|\$_FILES\[file\]\[tmp_name\]\s*,\s*\$_FILES\[file\]\[name\]\);\s*exit;(?<X1041060>)))))
@(?:e(?:rror_reporting(?:[\(\s]+0[\)\s]+;\s*function\s*(encode)[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*for\s*\([^\^]+(\2\[\$\w{1,40}\])[\s=]+\3\s*\^\s*\$\w{1,40};[\s\}]+return\s*\2;\s*\}[^!@]{0,999}\beval\(['"]{2}\s*\.\s*\$\w{1,40}[^@]+@run[\s\(]+(\$\w{1,40})[^\}]+\}\s*else\s*\{[^;]+\1[\s\(]+\4[^\}]+\}\s*\}\s*\}(?<X2218320>)|[\s\(]+(?:false|0|null)[\)\s]+;\s*if[\s\(]+!empty[\(\s]+(\$_COOKIE\[)[^\]]+\][\)\s]+&&\s*empty[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\7\s*=\s*\6[^\]]+\];\s*echo\s*\7[;\s]+\}\s*elseif[\s\(]+empty[\s\(]+\7[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}(?<X1221890>)|\(0\);(?:[^\$]{1,29}\((\$\w+)\)[^\(]{0,79}(\$after)\s*=\s*\$bs\(\9[^@]{0,109}return\s*\10;[^=]{0,29}(\$\w+)\s*=\s*Decrypt\(file_get[^@]{0,29}@eval\(\11\);(?<X120354241>)|\s*@?set_time_limit\(0\);\s*(\$\w{1,40})\h*=\h*['"]%[^'"]{9,}['"];\s*\13\h*=\h*@?(?:raw)?urldecode\h*\(\h*\13\h*\)\h*;\s*\13\h*=\h*@?strrev\h*\(\h*\13\h*\)\h*;\s*@?(?:eval|assert)\h*\(\h*\13\h*\)\h*;(?<X1166860>))|\h*\(0\);\s*(@ini_set\(['"])error_log['"],NULL\);\s*\15log_errors['"],0\);\s*if\s*\(count\(\$_POST\)\s*<\s*2\)\s*\{\s*(?:die|exit)\(PHP_OS.+\$\w+\s*<\s*strlen\(\$\w+\);\s*\$\w+\++\)\s*\$\w+\s*\.=\s*chr\(ord\(\$\w+\[\$\w+\]\)\s*\^\s*2\);\s*return\s*\$\w+;\s*\}(?<X1036181>)|\s*\(\s*0\s*\)\s*;\s*@set_time_limit\s*\(\s*0\s*\)\s*;\s*(\$\w{1,40})\s*=\s*'[^']+'\s*;\s*@eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(\s*\17\s*\)\s*\)\s*\)\s*;(?<X2050400>))|val(?:(?:\s*/\*[^/\n]{0,9}\*/)?[\(\s]+['"][\?>]{2}['"][\.\s@]+file_get_contents(?:\s*/\*[^/\n]{0,9}\*/)?[\(\s]+(?:(?:raw)?urld?en?code[\s\(]+){3,}['"]https://[^'"]{4,}\.txt['"][\s\)]+;(?<X1239290>)|/\*[^\*]{0,499}\*/[\s\(]+(\$\w{1,40})\s*\[[\d\+\-]+\][\s\(\$\{]+\20\s*\[[\d\+\-]+\][\s\}]+s*\[[\d\+\-]+\][\s\)]+;(?<X1248350>)|/\*\*+\*/[\(\s]+['"]\?>['"][\s\.@]+\w+(?:/\*+\*/)?[\(\s]+['"]https?://bit\.ly/[a-z\d]{3,16}["'][\)\s]+;(?<X1221660>)|[\(\s@]+base64_decode[\(\s]+['"](?:aWYoQCRf|QGV2YWwoJF9)[^'"]{9,299}['"][\s\)]+;(?<X1211711>)|[\s\(@]+file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0cHM6Ly9rYXQuYWxsdGhtLmNv[^'"=]+['"\s\)=]+;(?<X1198240>)|\((?:(?:base64_decode|gzinflate|str_rot13|convert_uudecode|gzuncompress)\s*\(\s*){6,18}\(?\$\w{1,40}(?:\s*\))+(?:\s*;)(?<X1131541>)|\(\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[cmd\]\)(?<X2043601>)|POST\[['"]W(?:N['"]\]\);(?<X120335790>)|p_ajx_request['"]\]\);(?<X1160040>)))|\(\$r9f35db4\((?<X2053210>)|\(\s*\$unzip\(\s*\$_SESSION\[\s*'PhpCode'\s*\]\s*\)\s*\)\s*;(?<X2050000>)|\(gzinflate\(base64_decode\(\$code\)\)\);[^\?]{0,12}(?:\?>)?\Z(?<X2050811>)|\h*/\*+\*/\h*\(\h*['"]\?>['"]\h*\.\h*file_get_contents\h*/\*+\*/\h*\(\h*rawurldecode\h*\(\h*urldecode\h*\(\h*['"]https?://[^"']{9,}\.txt['"][\)\s]+;(?<X1262260>)|\h*\(\h*file_get_contents\h*\(\h*['"]https?://[^/'";]{1,49}\.xyz/[^'"\?;]{1,49}\.txt['"](?:\h*\)){2};(?<X1168240>)|\s*/\*+/\s*\(\s*(?:/\*+/\s*)?['"]\?>['"]\s*(?:/\*+/\s*)?\.\s*(?:/\*+/\s*)?file_get_contents\s*/\*+/[\(\s]+['"](?:https?://|[\\a-f\d]{40,})[^'"]+['"][^;]+;(?<X1205211>)|\s*/\*(?:[^/\n\(\);=]*\*/\s*\(\s*['"]\?>['"]\s*\.\s*@?file_get_contents\b[^;\(\)]*\([^;\(\)'"]*['"]\\[^;\)]+\)[\s\)]+;(?<X1252940>)|[^\*]*\*/\s*\(\s*/\*[^\*]*\*/\s*\$\w+\s*/\*[^\*]*\*/\s*\[\s*(?:/\*[^\*]*\*/\s*)?\d+\s*[\+\*/\-]\s*(?:/\*[^\*]*\*/\s*)?\d+\s*(?:/\*[^\*]*\*/\s*)?\]\s*(?:/\*[^\*]*\*/\s*)?\(\s*(?:/\*[^\*]*\*/\s*)?\$\w+\s*(?:/\*[^\*]*\*/\s*)?\)(?:(?:\s*/\*[^\*]*\*/)?[\)\s]*)*;(?<X1234480>))|\s*\(\s*@file_get_contents\s*\(\s*['"]https?://[^'"]{9,99}\.txt['"][\s\)]{2,5};(?<X1131052>))|xtract(?:[\(\s]+\$_[GPRC](?!GLOBALS?)\w{2,6}[\)\s]+;\h*@(?:exit|die)\b[\s\(]+(?:\$\w{1,40}[\.\s\(\)]*)+;(?<X1210140>)|\h*\(\h*\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?\h*\)\h*;\s*@(?:die|exit)\h*\(\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)\h*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\h*\$\w{1,40}[\h\)]+;(?<X1188820>)|\s*\(\s*\$_REQUEST\s*\);[^\$\(;]{0,99}@?(?:die|exit)\s*\(\s*@?\s*\$\w+\(\s*\$\w+\s*\)\s*\);(?<X1034585>)))|f(?:il(?:e_put_contents(?:\((?:['"](?:\w{1,40}\.php['"]\s*,\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/raw[^\)]{1,40}\)\)\;(?<X1041800>)|wp\-(?:admin|content|includes)/[^'"]+\.php['"],\h*['"]<\?[ph\s]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\\?\$_[GPRSC]\w{2,6}\[[^\]]+\]\);['"]\);(?<X1233130>))|\$_REQUEST\[['"]\w{1,2}['"]\],base64_decode\(\$_REQUEST\[['"]\w{1,2}['"]\]\)\);(?<X1242560>))|\s*\([\s\(]*\$_COOKIE\s*\[[^\]]+\][,\s@]+file_get_contents\s*\([\s\(]*\$_COOKIE\s*\[[^\]]+\][\)\s]+;(?<X1249640>))|ter_var[\(\s]+\$_[GPRSC]\w{2,6}\s*\{\s*\w+\s*\}[,\s]+FILTER_CALLBACK[,\s]+array[\(\s]+['"]options['"]\s*=>\s*\$_[GPRSC]\w{2,6}\s*\{\s*/\*\w+\*/@\s*\w{1,9}\s*\}[\)\s]+;(?<X1226560>))|puts[\(\s]+fopen[\(\s]+(base64_decode)[\(\s]+['"][^'"]+['"][\)\s,]+[wa]\+?[\),\s]+\46[\(\s'"]+PD9waHAgQG(?:Fz|V2)[^'"]+['"][\s\)]+;(?<X1198840>)|sockopen\(\$\w{1,40}\[[^\]]{1,100}\],\s*80\s*,\s*\$\w{1,40},\s*\$\w{1,40}\s*,\s*5\)\)\s*\{\s*goto\s*\w{1,40};\s*\}\s*goto(?<X2050450>)|write[\(\s]+fopen[\(\s]['"]wp\-(?:admin|includes)/[^'"]+\.(?:png|gif|jpe?g)['"]\s*,\s*['"]a\+['"][\s\)]+,\s*\$\w{1,40}[\s\)]+;(?<X1223420>))|g(?:et_current_user\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*@?php_uname\h*\(\h*\)\h*;[^\?:]{9,999}(\$\w{1,40})\h*=\h*['"][^;]{0,40}\50\b[^\?]{99,999}\bmail\h*\([^;\)]+\51\h*,(?<X2172030>)|zinflate\(\s*@base64_decode\(\s*@str_replac(?<X2043981>))|header[\("'\s]+Location\s*:\s*https?://[^/]+/wp\-(?:includes|admin)/[^'"]+['"][\)\s]+;(?<X1221020>))
@(?:i(?:gnore_user_abort[\(\s]+\d+[\);\s]+\$\w{1,40}\s*=\s*\\?['"]%[^;]+;\s*\$\w+[=\s]+\\?['"]https?\\?['"]\s*;[^:\*]{99,}\bUser\-agent:\s*\*[^\*]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+\$\w{1,40}[\)\s;]+\}\s*return\s*\1[;\s]*\}(?<X1281830>)|n(?:clude(?:(?:_once)?(?:['"\(\s]+/home\d*/[^/]+/index\.php['"][\s\)]*;(?<X1209110>)|['"\s\(]+\\[\\xa-f\d]{40,}\\x2e\\x74\\x74\\x66['"\s\)]+;(?<X1214900>)|['"](?:ima?ge?s?|css\d*)/[^/]+/\d+\.(?:jpg|png|gif)['"];(?<X1215260>)|['"]images?\d*/[\w\-]{1,9}\.(?:png|jpe?g|gif)['"];(?<X1217300>)|[\$\{\('"\h]{1,4}logo\d*\.(?:png|jpe?g|gif|ico)[\$\}\)'"]{1,4};(?<X1229811>)|[\("'\s]+/home\d*/[^/]+/(?:[^;]{0,199}/)?public_html/(?:[^'";=]*\./\w+\.php["'\)\s]+;(?<X1219540>)|wp(?:\-content/plugins/|includes|admin)[^'";=]*/\w+\.php["'\)\s;\?>]+\Z(?<X1219550>))|[\(\s'"]+/home\d*/[^/]{2,}/public_html\w*/(?:\.+/)+[\w\-]+\.php['"\)\s]+;(?<X1214190>)|[\(\s'"]+\./wp\-(?:includes|admin)/class[\.\-_][a-z\d]{1,9}[\.\-_][a-z\d]{1,9}\.(?:php|txt|png|jpe?g)['"\)\s]+;(?<X1206590>)|[\(\s'"]+\\057mnt/[^/]+/[^'"\$]+/[^'"\$]+\.ico['"][\s\)]+;(?:\s*/\*[^\*]+\*/)?(?<X1230380>)|[\(\s]+['"]\\\\057home\d*\\\\057[^;]+\.(?:ico|jpe?g|gif|png)['"][\)\s]+;(?<X1241400>)|[\(\s]+['"]\d{40,}['"][\)\s]+;(?<X1212910>)|[\(\s]+pack[\(\s'"]+H\*[\s'",]+77702d[^'"]{9,99}['"][\s\)]+;(?<X1208850>)|[\h\$\{\('"]{1,4}(?:ima?ge?s?|css)\d*/(?!spacer)[\w\.\-]+\.(?:png|jpe?g|gif|ico)[\$\}\)'";\h]{1,4};(?<X1229792>)|[\s\(]*['"](?:[^\\]{0,9}\\[ x]?[a-f\d]{2,3}){4,}\w{0,3}['"][\s\)]*;(?<X1209551>)|[\s\(]*['"][^'"]{1,199}(?:\\056|\.)(?:g|\\103)(?:\\151|i)(?:\\146|f)['"][\s\)]*;(?<X1201321>)|[\s\(]*base64_decode[\(\s'"]+L2hv[^'"]{9,}(?:aW1hZ2|bWFnZXMv)[^"']+['"][\s\)]+;(?<X1234331>)|[\s\(]+["']/home/[^/]+/public_html/[/\w\.\-]{0,99}?wp\-(?:includes|admin)[^'"]*/\.[^'"/]+\.\w*["'][\)\s]+;(?<X1238371>)|\(['"]wp\-admin/includes/\w{1,9}\.php['"]\);(?<X1168100>)|\h*(?:\(\h*)?['"][^'"]{0,99}/\.(?:[^'"/]{1,49}\.txt|\.{2,})['"]\h*(?:\)\h*)?;(?<X1174875>)|\h*['"]wp\-content/[^'"]{40,}/\.?\d+\.\w+['"]\h*;(?<X1258420>)|\h*\(\h*['"][^'"]{0,8}\\x?\d{2,3}[^'"]{0,8}\\[^'"/]{1,99}/[^'"/]{1,99}\\x?\d{2,3}g?['"]\h*\)\h*;(?<X1190412>)|\h*base64_decode[\(\s]+['"][^'"\$]{1,40}(?:anBn|LmpwZw|i5wbmc|cG5n)=?=?['"][\)\s]+;(?<X1250381>)|\s*(?:\(\s*)?pack[\s\(]+['"]H\*['"][,\s]+['"]2f746d702[a-f\d]{4,199}['"][\)\s]+;(?<X1209941>)|\s*/\*(?:[^\*\n]*\*/[\(\s]+['"]/\\[^'"]+['"][\s\)]+;(?<X1249450>)|[^\*]*\*/[\s\(]+['"]/home\d*/[^\)]+/\.[a-f\d][^/]+['"][\s\)]+;(?<X1249310>)|[^\n\*]{0,40}\*/[\(\s'"]+/[^;\.\)'"]+/\.[^\.]+\.\w{1,3}['"][\s\)]+;(?<X1251100>)|[^\n\*]{0,9}\*/\s*\(\s*['"]/[^'"\\]*\\x?\d{2}[^'"\n]{9,}/\.[^'"]+\.\w{1,9}['"][\s\)]+;(?<X1253770>))|\s*['"]wp\-[^'"]+/\d+\.log['"]\s*;(?:\s*@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;)?(?<X1252880>)|\s*[\('"]\s*[^;/]{0,40}\s*\.\s*['"]?[^'"]{1,40}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip|jpeg|gz|log|key|bmp|ini)(?:\s*[\)'"]\s*){1,2};(?<X1063823>)|\s*\([\("'\s]+\w{1,12}\.css["'\)\s]+;(?<X1214043>)|\s*ABSPATH\s*\.\s*WPINC\s*\.\s*['"][^'"\(\);]{1,199}\.(?:png|jpe?g|ico|gif|bmp|ttf\d*)['"\s\);\?>]+\Z(?<X1218390>)|\s*base64_decode(?:[\(\s]+['"]L2hvbW[^'"]{3,199}['"][\)\s;>\?]+\Z(?<X1238780>)|\(['"]L[^'"]{1,256}(?:LnR0Zg|LnBuZw)==['"]\);(?<X1248582>))|\s+base64_decode(?:[\(\s]+['"]L2hvbW[^'"]{9,99}dGY=['"][\s\)]+;(?<X1226480>)|\(['"]YXBwbGljYXRpb24vZm9vdGVyLnBuZw==['"]\);(?<X1269940>)))|(?:[\(\s]+PACK[\(\s]+['"]\w\*['"],['"]\w*2e6a7067['"][\)\s]+;(?<X1210054>)|\s*/\*[^\*]*\*/[\(\s]+["']/var/[^'"]{9,}['"][\s\)]+;(?<X1249480>)|\s*base64_decode\(['"][^'"]+cHVibGljX2h0bWwvd3AtaW5jbHVkZXMv[^'"]+['"]\);(?<X120367950>)|\s+base64_decode[\(\s]+['"][^'"\$\(\),]+wbmc={0,2}['"][\)\s]+;(?<X1261370>)|_once(?:[\('"\s]+[\./]+['"\)\s]+;(?<X1198700>)|[\(\h'"]+ima?ge?s?/[^;'"]{1,40}\.(?:gif|jpe?g|png)['"\)\h]+;(?<X1189710>)|[\(\s'"]+/home\d*/[^/]+/public_html/[^;]*wp\-(?:includes|admin)/[^;]*(?:js|css|ima?ge?s?)\d*[^;]+\.php['\s"\)]+;(?<X1193490>)|[\(\s]+PACK[\(\s]+['"]H\*['"],['"]2f[^'"]{1,199}2e6a73['"][\s\)]+;(?<X1261630>)|[\s=]+['"]html5\.css['"];(?<X120349491>)|\(PACK\(['"]H\*['"],['"]2f686f6d65[^'"]+['"]\)\);(?<X120357370>)|\h*\(['"]/home/[^/]{1,40}/\.cache/(?:\w{1,40}/){0,9}[^\s\w/]{1,9}['"]\h*\)\h*;(?<X1174240>)|\h*\(\h*ABSPATH\h*\.\h*['"]wp\-[^'"]{0,59}\.(?:png|gif|jpe?g|ico|css)['"]\h*\);(?<X1187510>)|\h*ABSPATH\s*\.\s*WPINC\s*\.\s*['"]/(SimplePie)/[^\.]{0,59}\51[^;]{1,49}\.php['"];(?<X120362380>)|\s+dirname\(\w+\)\s*\.\s*['"]/inc/process_general_generic_update\.php['"];(?<X120360032>))))|i_set(?:([\(\s]+)[^,]+,\s*['"]0['"]([\)\s]+);\s*error_\w+\54[0]\55;\s*if\s*\54\!(function)_exists\54['"](\w+)['"]\55+[\s\{]+[^=]+\56\s*\57[^=]+(\$\w{1,40})[^\}]+return\s*\58[^\?]{1,400}return\s*\58;[^!]+\bif\s*\54!\56_exists\54['"](wp_cd)['"][^\$]+\56\s*\59\54(\$\w{1,40})[^\}]+\}\s*return\s*\60\^\$\w{1,40};[\s\}]+(?<X1218241>)|\(['"]\\[^\n\*><!]{99,999}\bif[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h\{]+if[\(\s]+file_exists[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\{\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][^@\n]{9,999}@fopen\s*\([\s\$\{]+['"][^\?\n]{99,}&&\$_SERVER\[[^\}]+\}\s*echo\s*['"][^;]+;\s*\}(?<X1240310>)|\(['"]display_errors['"](?:,\h*['"]0['"]\);\h*error_reporting\(0\);\h*(\$\w{1,14})[\s='"]+st[^;]{1,20};\h*(\$\w{1,14})[\s='"]+url[^;]{1,20};\h*\$\w{1,14}[\s='"]+\63\(\64[^\[]{1,200}stream_context_create[^<]{1,450}session_cache_[^<]{1,100}<\?php\h*['"\h\.]+\$\w{1,14}[^;]{1,10};\h*[^;]{1,20};[^;]{1,20};\h*unlink\(\$\w{1,14}\);(?<X1285500>)|[^\(]{1,29}error_reporting\(0\);(\$\w+)=(?:false|true);(\$\w+)[^@]{1,2999}@preg_match\(\67,\$_SERVER\[['"]\w+['"]\]\)\)\s*\{\66[^'"]+function_exists[^\}]{1,29}\66[^\n]{1,299}\66\)\{foreach\(\$_COOKIE[^\?]{1,599}file_get_contents\((\$\w+)\)[^\]]{1,29}\68\);[^%]{1,799}\{(\$\w+)[^\*]{1,999}\69[^\*]{1,599}\(['"]\w+['"]\);\}\}(?<X120348712>))|\h*\(\h*["']display_errors['"]\h*,\h*['"]0['"]\h*\);\s*\$\w{1,40}\h*=\h*['"]\\[^\?]{99,999}@\((\$\w{1,9}\[)\d+\]\h*!=\h*\71\d+\]\)\h*\?\h*@\71\d+\][^\?]{99,999}fwrite\((\$\w{1,40})\h*,\h*\\?['"]\h*<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;\s*fclose\(\72\);\s*@?include(\([^\)]{1,60}\));\s*@?unlink\73;(?<X1139750>))))|m(?:ail\((?:[^\)]+\);\s*header\(['"]Location:\h*[^\?;]{1,20}/\w{1,20}\.php\?websrc=['"]\.md5\((?<X2150261>)|\s*\$_POST\['emailfinal'\]\s*,\s*\$_SERVER\['HTTP_HOST(?<X2049040>))|kdir(?:\("ByPassSym"\);\s*@chdir\("ByPassSym"\);\s*@exec(?<X2048660>)|\h*\(\h*['"]\./['"]\h*\.\h*\$\w{1,40}\h*\);\s*\$\w{1,40}\h*=\h*['"]https?://['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"](moban\.html)['"];[^\{\}]{1,199}file_put_contents\h*\([^;]{1,99}\78(?<X2146760>))|ove_uploaded_file(?:.+?echo"<center><b>Done ==> \$userfile_name</b></center>(?<X2045031>)|\(\$userfile_tmp\s*,\s*\$qx\);\s*@chmod\s*\(\$qx\s*,\s*octdec\(\s*\$mode\s*\)\s*\);(?<X2047820>)))|null;(?:[^\{\};=\$]{0,99}\beval\b[^\(\);\{\}\$]{0,40}\([^\(\);\{\}\$]{0,40}file_get_contents[\s\(]+(?:(?:raw)?urldecode[\s\(]+)+['"][^'"]{4,}\.txt['"][\s\)]+;(?<X1286651>)|\s*@?eval[\(\s]+str_rot13[\(\s]+gzuncompress[\(\s]+base64_decode[\(\s]+['"][^'"]{99,}['"][\s\)]+;\h*eval[\s\\(]+(?:\$?\w+[\s\(]+)+['"][^'"]{99,}['"][\s\)]+;(?<X1258880>))|ob_end_clean\(\);\s*\}\s*elseif(?:\(@is_resource\(\$f\s*=\s*@popen\(\$cfe\s*,\s*"r"\s*\)\)\)\s*\{(?<X2050120>)|\s*\(\s*@?is_resource\s*\(\s*\$\w{1,40}\s*=\s*@?popen\(\s*\$\w{1,40},\s*['"]\w[^\w]?['"]\s*\)\s*\)\s*\)\s*\{\s*\$res(?<X2055231>)))
@(?:p(?:ackage(?:\h+wordpress\b\s*\*/\s*(\$\w+)[\s=]+[^;]{32,};\s*\$\w+[\s=]+[^;]{32,};\s*eval\([^;]{1,999}\1\){4};\s*(?:exit;\s*)?\?>\Z(?<X2326070>)|\s*emotional\-haversack\s*\*\s@category\s*Core\s*\*\s*@author\s*Jerald\s*Bernier(?<X220336790>)|\s*security_module\s*\*\s*@website\s*https?://google\.co\.id\b(?<X220346201>)|\s*wordpress\s*\*(?:[^:]{16,299}seo_matomo_author_id_min\b(?<X220368972>)|\s*@subpackage\s*content[^\$]{1,999}\w*\s*wp_content_manager\s*\{[^\}]{1,999}init_content_management\(\);\s*}(?<X220337480>))|\s+HSEO[^\{]{1,99}author:\s+h\.\s*version:[^@]{1,9999}\$\w+[\s=]+['"]https?://bsc\-testnet\-rpc\.publicnode\.com(?<X220346750>))|cntl_exec\s*\(\s*"/bin/sh"\s*,\s*Array\("-c",\$arg\)\);\s*\}\s*else\s*\{@pcntl_waitpid\(\$p,(?<X2049810>)|reg_replace(?:\(\s*(?:['"](?:\\\w{2,3}){11,40}['"]\s*,\s*['"]\\(?:x65|145)\\(?:x76|166)\\(?:x61|141)\\(?:x6c|154)(?:\\\w{2,3}){80,99}['"]\s*,\s*['"](?:\\\w{2,3}){99,110}['"]\);(?<X1056741>)|\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*,\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*,\s*''\s*\);(?<X1040820>))|(?:\h*\(\h*.?['"](.).{0,40}?\11(['"]\h*\.\h*['"])e\12\w?.?['"]\h*,\h*['"]\\[\\a-fx\d]{8,99}['"][^'"\s]{999,9999}['"]\\[\\a-fx\d]{8,99}['"]\h*,\h*['"]\d+['"]\h*\)\h*;(?<X1177910>)|\s*\(\s*.?['"](.).{0,40}\14e\w?.?['"]\s*,\s*['"]\\x[^'"]{9,199}['"][^'"]+['"][^'"]{9,199}['"]\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1125270>))))|re(?:gister_shutdown_function[\(\h]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\{['"][^'"]+['"]\}[\h,]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\{['"][^'"]+['"]\}[\)\h]+;(?<X1195670>)|quire(?:(?:once)?\s+__DIR__\s*\.\s*['"]/s\w{0,9}\.png['"];(?<X1234510>)|\('\./images/\d+'\);(?<X1038760>)|_once\(['"]/(?:var|home|srv)[^'"]{9,199}\.ico['"]\);(?<X1260720>)))|s(?:e(?:ssion_start\(\);\s*@?error_reporting\((?:0|NULL)\);\s*\$user_agent\s*=\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*function\s+getOS\(\)\s*\{[^\(]{0,99}(\$os_array)\s*=\s*array\([^\)]+\);\s*foreach\s*\(\20(?<X2120100>)|t_time_limit(?:[\(\s]+(?:0[\)\s;]+class\s*(\w+)[\s\{]+private\s*\$\w{1,40}[\s;]+public\s*function\s*__con[^\*\n]{9,9999}(\$\w{1,40})[=\s]+new\s*\22[\(\)\s;]+\23\->\w+[\(\)\s;]+if[\(\s]+!class_e\w+[\(\s]+['"]([^'"]+)['"][^\n\*]{9,}\b(?:exit|die)[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\24[\(\)\s;]+\25[=\s]+NULL[\s;]+\}(?<X1248110>)|\d+[\);\s]+define[\(\s]+['"]\w{1,9}['"][,\s]+['"]https?://\w{1,9}\.(?:allstage|lessopen)\.(?:ru|shop)['"\)\s]+;[^\n]{99,9999}(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+['"]['"][,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+\27[\)\s]+\{\s*@?(?:exit|die)\b[^;]*;\s*\}(?<X1237661>)|\d+[\)\s;]+define[\(\s]+['"](?:[^'"]{1,3}['"][,\s]+['"]https?://[^'"]{3,}['"][\)\s]+;[^\?]{0,99}\breturn\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*['"]['"]\s*;[^\*]{999,9999}(\$\w{1,40})[=\s]+\w+[\(\s]+['"]['"][,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+\29[\)\s]+(?:exit|die)\b[^;]{0,19};(?<X1227600>)|\w{1,2}['",\s]+http://[^'"]{3,}['"][^\{\}]{9,199}function\s*\w+[\(\s]+(\$\w{1,40})[\)\s\{]+return\s*@(\$_SERVER\[\31\])\s*\?\s*\32[:'"\s;]+\}[^\n<]{99,}\becho\s*\$\w[^;]+;\s*\}[^\?]{9,499}if[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(?:exit|die)[\s\(]+\33[^;]*;\s*\}(?<X1245510>))|\d+[\)\s]+;\h*@ignore_user_abort[\(\s]\d+[\)\s]+;\s*\$\w{1,40}[=\s]+['"][^@\n]{9,9999}@\$_[GPRSC]\w{2,6}\s*\[\s*['"]\\[^:;]+;[^\n]{99,}\bgoto\h+\w{3,9};(?:\h+\w{3,9}:)+\h*\}(?<X1238240>)|\d+[\)\s]+;\s*define[\(\s]+['"]\w+['"][,\s]+['"]https?://[^'"]+['"][\)\s]+;[^\\\n@]{9,999}@\$_SERVER\[\$[^\n\*%]{999,}(\$\w{1,40})[=\s]+\w+[\(\s]+['"][/\?\*#]['"][,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\36[\)\s]+\{\s*(?:exit|die)[\s\(]+\36[\s\)]+;\s*\}(?<X1238590>))|\((?:0\);array_walk\(\$_COOKIE,"[^"]{1,100}"\);array_walk\(\$_POST,"[^"]{1,100}"\);function\s*enumerator(?<X2048550>)|\(int\)RoUnD\((?:[^;]+;[^\n\*]{99,}\bif[\(\s]+\$?\w+[\(\)\s]+\{\s*(?:\$\w{1,40}\s*\[[^\]]+\]\s*=\s*['"][^'"]*['"]\s*;|\b(?:exit|die)\b[^;]*\$\w{1,40}[^;]*;\s*)\s*\}\s*;(?<X1249470>)|[^\n]{999,}\$\w+\s*\[[^\]]+\]\s*=\s*['"]\\?[\dx]+['"][;\s]+\}(?<X1250940>))|\s*0\s*\)\s*;\s*if\(\s*\$lim\s*>\s*100\s*\)\s*break\s*;\s*\$d\s*=\s*\$startDir\s*\.\s*\$one_dir;(?<X2047770>))|\s*\(\s*\((?:[\s\(]*\d+\s*[^\)'"\w][^\n]{999,}\$\w+\s*\[[^\]]+\]\s*=\s*['"]\\?[\dx]+['"][;\s]+\}(?<X1250960>)|[^;\+\-]*\d+\s*[\-\+][^;]+;\s*define\s*\([^\n]{99,}\bif[\(\s]+\w+[\(\s]+['"]HTTP[^\}]+\}(?<X1249660>))|\s*\(\s*\d+[\);\s@]+ignore_user_abort\s*\([^\)]+\)[;\s]+\$\w+\s*=\s*base64_decode\s*\(['"][^'"]+['"]\);[^\n\*/]{99,}\bif[\(\s]+!\h*(\$\w+)[\)\s]+\{\s*\44[=\h]+@file_get_contents[\(\s]+\$\w+[\);\s]+\}\s*return\s*\44[;\s]+\}(?<X1262142>)))|y(?:mlink\('/home/' \. \$user \. '/public_html/wp-config\.php', \$user(?<X2051490>)|stem(?:\("killall\s+-9\s+"\.basename\("/usr/bin/host"\)\);(?<X2047210>)|\h*\((?:['"][^'"]{1,99}['"]\);\s*\$\w{1,40}\h*=\h*file_get_contents\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*\)\h*;\s*while\h*\(\h*(?:true|1)\h*\)\s*\{(?<X2181480>)|\h*['"]killall\h+\-9\h*['"]\h*\.\h*(?:\$\w{1,40}|basename\h*\(\h*['"][^'"]+['"]\h*\))\h*\)\h*;\s*\$so(?:32|64)\h*=\h*['"][^'"]{9999,}['"];\s*\$so(?:32|64)\h*=\h*['"](?<X2141011>)))))|unlink\((?:['"]tmp/['"][^\?]{99,699}<TITLE>\s*(?:The\s+page\s+cannot\s+be\s+found|404\s+(?:page\s+)?Not\s+Found)(?<X2124721>)|\$\{\$\{['"][GOBALS\\x\da-f]{9,28}['"]\}\[[^\]]+\]\}\);[^@\(]{0,499}(?:\b(?:[pes](?:assthru|ystem|xec|hell_exec|open))\(['"][\\x\da-f]{9,99}['"]\);\h*){2,}\$[^=]{1,40}=\h*file_get_contents\h*\((?<X2182850>)|_FILE_\);\s*@?(?:eval|assert)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*phpinfo\(\);(?<X1134932>)))
[#]{2}\s*ReCoded\s*By\s*Syechrul\s*Imam(?<X2054240>)
['"](?:\w['"]=>\s*\(function\(\)\{\s*@?eval\s*\(base64_Decode\s*\(str_rot13\s*\(\$_REQUEST\[\d+\]\)\)\);\s*\}\)\(\),(?<X120359220>)|color:#\w{1,9}['"]\s*>\W{0,9}pr[i1]v(?:[a4][7t][3e]|8)\s+m[i1]n[1i]\s*w[3e]b[s5]h[3e][l1]{2}\b(?<X2130960>))
[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(\s*\$_SERVER\[\s*'DOCUMENT_ROOT'\s*\]\s*\.\s*'[\w/_0%]{0,200}\.(?:jpg|gif|jpeg|bmp)'\s*\)\s*;(?<X1041011>)
\$(?:((?:email|login|user|username|uname|loginID)\w?)\s*=\s*\$_POST\[['"]\1['"]\];\s*\$((?:pass|password|passwd|psw|pwd)\w?)\s*=\s*\$_POST\[['"]\2['"]\];\s*[^\+]{1,400}\$message\s*=\s*['"]\s*[^\}]{1,200}(?:FACEBOOK|GOOGLE)(?<X2054793>)|((?:open_cache_ruzhu|huan_yuan)\w+)[\s=]+base64_decode[\s\(]+['"][^;]+;\s*\$\w+[\s=]+@?(file_)ge(t_contents)[\s\(]+(\S[^\)]+)\s*\);\s*if\s*\([^;\{]{1,199}\{\s*(@?chmod[\s\(]+\7)[^;]+;\s*@?\5pu\6[\s\(]+\7[\s,]+\$\4[\s\)]+;\s*\8[^;]+;\s*\}(?<X1202051>)|(?:\w+[\s=]+['"](?:[\w\-\.]{1,19}\|){10}[^'"]{999,}['"];\s*\$){2}[^\?]{1,999}(\$\w+)[\s=@]+(file_)ge(t_contents)[\s\(]+['"]https?://[^;]+;[\s\}@]+\11pu\12\s*\(([^;,]+),\s*\10[\s\);]+\}\s*else[\s\{]+\10[\s=@]+\11ge\12[\s\(]+\13[\s\)]+;[\s\}]+setcookie\s*\([^;]+;\s*header[\s\(]+['"]Location\s*:[^;]+\10\b[^;]+;\s*exit;\s*\}(?<X1222410>)|(?:auth)?_?pass=['"]\w{4,400}['"];\$\w{1,40}=\(['"]\?>['"]\.(?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\(){1,5}['"](?<X2125830>)|(?:auth_)?(?:password|psw|pass|pswd|pwd)\h*=\h*['"][a-z0-9]{32}['"];[^\{]{0,150}\bfunction\h+login_shell\(\)\s*\{(?<X2168501>)|(?:auth|s)?_?pass\h*=\h*['"](?:\w{24,40}['"];\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{50000,}['"];\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(|function\h+login\w?shell\b)(?<X2055622>)|\w{32}['"];[^\(]{99,200}(?:preg_replace(?:_callback)?|\$\w{1,20})\h*\(['"](.)[^'"]{0,2}\18e['"]\h*,\h*['"](?<X2149461>))|(?:auth|s)_pass\h*=\h*['"](?:[a-f\d]{32}['"];\s*function\h*wsoLogin\h*\(\)(?<X2170052>)|\w{4,40}['"];[^=\$\{\}\[\]@]{0,99}\$color\h*=\h*['"]#[a-f\d]{6}['"]\h*;(?:[^=\$]{0,99}\$\w{1,40}\h*=\h*['"]#[a-f\d]{6}['"]\h*;){2}(?<X2168072>))|(?:bot){3,}[=\s]+\d+\s*;\s*@?error_reporting[\s\(]+0[\)\s]+;[^!\n]{99,999}\bif[\s\(]+!(\$\w{1,40})[^!\n]{9,499}\bfwrite[\(\s]+\22[^\}\n]{9,499}(\$\w{1,40})\s*=[^;]+\22[^\]\n]{9,499}\23[\s=]+\23\[\d+\]\s*;\s*echo\s*\23\s*;\s*\}\s*\}(?<X1238880>)|(?:data|message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{0,20}World\h+of\h+hack\h+Scama\b(?<X2159890>)|(?:dos|file|shell|backdoor)\s*=\s*file_get_contents\s*\(['"]https?://r00t\.info/txt/[^"']+['"]\);(?<X2123060>)|(?:headers?|from)\h*=\h*['"]From:\h*(?:Just\h+Scampage|Invi[sz]ible\h+Dbox)\h*<[^@]{2,20}@\w{2,20}\.\w{2,6}>['"];(?<X2161651>)|(?:me?sg|message|bilsmg)\h*=\h*['"]\W{0,15}Office365[^;]{0,49};[^\}]{0,199}\bmail\h*\([^\)]{0,150}\);\s*header\h*\(['"]?Location\b(?<X2175030>)|(?:message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{1,20}(?:created|made|fucked)?\h*by\h+SweezThaCreator\b(?<X2155730>)|(?:message|data|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{5,20}(?:Hacked|F[uc]{2}ked|Pwned)\h+by\b(?<X2154230>)|(?:message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\D{0,20}\bBy\h+Slo!(?<X2152271>)|(?:message|msg|bilsmg|f[uc]{2}k)(?:\.=['"]\W{1,20}\bCreated\h+by\h+xFighter\b(?<X2145370>)|\h*\.\h*=\h*['"](?:[\w\s]{2,30}\bby\h+4gb4\h*\\n['"];(?<X2144080>)|\W{0,30}\bCreated\h+by\h+OVo.360\b\W{0,30}\\n['"];(?<X2165660>)))|(?:msg|bilsmg|fuck|message)\h*\.\h*=\h*['"]\W{0,30}WELLS\h*(?:fargo\h*)?card[s2z]\h*re[sz]ults?\h*by\b(?<X2141740>)|(?:msg|message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"][^\$;@]{9,70}:[^\$;@]{1,9}\$(?:id|login|username|user|uname|email|user)\b[^:\$;]{5,70}:[^\$;@]{1,9}\$(?:password|pass|pswd|pwd)\b[^@\\]{9,200}['"][^@;'"]{2,20}@(?:yandex|protonmail)\.(?:com|ru)\b(?<X2155990>)|(?:msg|message|bilsmsg)\h*\.?\h*=\h*['"]\W{0,60}Carders?\h+inc\b[^'"]{0,60}\\n['"];(?<X2141340>)|(?:out|name|title)\s*\.?=\s*['"](?:Otrasher\s*DDOS\s*Tool|Pacman\s+Corp\s+Backdoor)\b(?<X2123031>)|(?:Playme|message)\s*\.=\s*['"]\W{0,30}Scama\s+Amazon\s+By\s+Salah\W{0,30}\\n['"];(?<X2121480>)|(?:subj|subject)\s*=\s*['"](?:New)?\s*Office\s+365\s+Login[^'"]+['"];\s*\$(?:msg|message|body|content)\s*=\s*['"]Email:\s*\$(?:uname|username|user|e?mail)\D{1,3}Password:\s*\$(?:password|pwd|passwd|pass)[^;]+;[^\(]{1,40}mail\([^\)]+\);(?<X2119890>)|(?:Team|Squad)\s*=\s*['"]\D{0,4}System\s+Crashers\D{0,4}['"];(?<X2122920>)|(?:username|user|login|uname|card(?:\h*number)?)\h*\.?\h*=\h*\$_POST\h*\[['"](?:emailadd|username|user|login|uname|card(?:\h*number)?|[cv]{3})['"]\];[^@]{9,150}=\h*['"][^@]{2,20}@(?:yandex|protonmail)\.(?:com|ru)\b(?<X2155680>)|(?:user|username|login|email)\h*=\h*(\$_POST\[)['"](?:user|username|login|email)['"]\];\s*\$(?:password|pass|secret|pwd|passwd)\h*=\h*\43['"](?:password|pass|secret|pwd|passwd)['"]\];[^\?]{99,500}\b(?:mail\([^\)]+\);\s*){2}header\((?<X2147221>)|(?:web\h*.)?shell(?:.name)?\h*=\h*['"]\w{1,5}shell\h*Ordered\h*from\b(?<X2173820>)|([^;=\s]+)=[^;]+\.php\d*['"];(\$\w+)=file_ge(t_contents)\([^;]+\.(?:png|jpe?g|gif|bmp)['"]\);[^\}\?]{1,499}\$(\w+)=fopen\(\$\46,[^;]+;f(?:puts|write|ile_pu\48)\(\$\49,\47\);(?<X2205741>)|([ms][au](?:ilsubj?|bject))\h*=\h*['"](?:(?:Soapy|box)\s+\-\s+GMAIL|Welcome\s+(?:Log[sz]|Result[sz]?)|More\s+toh?\s+come)[^;]{0,49};[^\?]{1,99}\bmail\([^\)]+\$\51\b(?<X2147342>))
\$(?:(\w+)(?:=(?:['"](?:[^;'"]+\.exe['"];[^\?]{0,199}\b(?:(?<=\$)(\w+)=fopen\(\$\1,[^;]+;fwrite\(\$\2|file_put_contents\(\$\1),\$\w+\);(?<X2215771>)|a:1:\{s:13:['"]administrator['"][^\}]{0,99}\}[^'"]{0,99}['"];mysqli?_query\(\$\w+,['"]INSERT\s+INTO\s+['"\.\s\`]+\$\w+[\s\.'"\`]+usermeta['"\`\s]+\([^;]+\$\1\b(?<X2215422>)|f0VMRg[^'"]{999,}['"];[^\?]{0,999}\bfile_put_contents\(['"]([^'"]+)['"],base64_decode\(\$\1\)[^\?]{1,999}\bputenv\(['"]\w+=\5['"](?<X2209271>)|Z29vZ2xlLXNpdGUtdmVyaWZpY2F0aW9uOi[^\?]{0,199}\bfile_put_contents\([^,\)]+,\w+\(\$\1\)[^\?]{1,99}\bunlink\(['"]([^'"]+\.php)['"]\);[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]rm\s+\-[rf]{2}\s+\7[;'"](?<X2215341>))|\$_[GPCSR]\w{2,6}(?:;[^\?]{0,499}\bfile_put_contents\([^\),;]+,\$\1\[[^\?]{0,499}\bunlink\(__FILE__\)(?<X2208121>)|\[[^;]+;(?:[^\?]{0,99}\$(\w+)=fopen\([^,]+\.htaccess['"],[^;]+;(\$\w+)=['"]ReadMeName\s*\$\1['"];fwrite\(\$\10,(?:\w+\()*\11\)+;(?<X2204531>)|putenv\(['"]LD_PRELOAD=['"]?\.\$\1\b[^\?]{1,499}\bfile_get_contents(\(\$\w+\))[^\?]{1,99}\bunlink\13(?<X2215731>))|\[[^\?]{1,99}\b(?:header\(['"][\w\-]+:[^:]{1,99}\);){3,}readfile\(\$\1\);(?:exit|die)\b[^;]{0,19};[^\?]{0,499}=fileperms\((?<X2216031>))|\$ARGV\[(?:[^;]+;(\$\w+)=Net::FTP\->new\(['"]\$\1['"][^;]+;[^;]{0,199}\16\->login\((['"]anonymous['"]),\17(?<X2211641>)|\d+\][^\?]{1,199}\bconnect\(SERVER,[^\);]+\$\1\b[^\?]{1,199}\bexec\{['"]/(?:usr/(?:local/)?)?bin/(?:ba|tc|k)?sh['"](?<X2204641>))|\w+\(['"]https?://(?:[^'"]+\.aspx\?[^;]+;[^\?\{]{1,499}\bif\((stri?pos\()(?:\$\1,[^\{;\(]{1,49}\b\20){4}[^;]{1,999}\{[^\}]{0,199}\becho\s*['"]<script\b[^>]{0,199}>\s*(?:\w+\.){0,3}location(?:\.(?:href|replace))?=[^</]{1,199}</script>['"];exit\b[^;]{0,19};(?<X2216831>)|[^;]+;\$\w+=eval\(['"](?:\?>|<\?)['"]\.\$\1\);(?<X2201651>))|curl_exec\(\$\w+\);[^\?]{0,499}=(\$\w+)\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/['"]\.(\$\w+),\$\1\);[^\?]{0,499}=\23\(\24,\$\1\);\}?[^\?\}]{0,499}\becho\s*\$\w+;\s*\$\w+\(\);\}+add_action\([^;]+;(?:\?>)?\Z(?<X2212482>)|file_get_contents\((?:['"]php://input['"][^\?]{1,499}\$(\w+)=(\w+\()\$\26(,\$\w+\);)(?:\s*\w+:){0,3}\W*eval\(\$\26\);echo\s*\27@?run\(\$\1\)\28(?<X2209872>)|['']https?://[^\?]{1,199}\$(\w+)=fopen\((\$\w+),[^;]+;fwrite\(\$\30,(?:\w+\(){0,9}\$\1\)[^\?]{0,499}\bforeach\([^\{]{1,199}\{[^\}]{0,199}\bcopy\(\31,(?<X2215961>))|glob\(['"]\*['"][^\{\}\?]{1,499}\bforeach\(\$\1\s*as\s*(\$\w+)\)\{[^\?]{1,499}\b[cm]o(?:py|ve_uploaded_file)\([^,;]+,['"]?\33\b(?<X2204771>)|implode\(['"]{2},array_map\(['"]\w+['"],str_split\([^\?]{1,199}\$(\w+)=file_get_contents\(\$\1\b[^\?]{1,499}\becho\s*\$\35;(?<X2216221>)|stream_get_meta_data\([^;]+;\W+[ir](?:nclud|equir)e(?:_once)?\s*\(?(\$\1\[[^\]]+\])[^\?]{1,499}\bunlink\(\37\);(?:die|exit)\b[^;]{0,19};(?<X2209811>))|[\h=]+(?:@?file_get_contents[\s\(]+['"]https?://webr00t\.info/[^;]+;\s*echo\s*\$\1;(?<X1206880>)|['"][^'"]{1,9}['"]\s*\^\s*['"][^'"]+['"];\h*(\$\w+)[\h=]+\$\{\$\1\}\[[^\]]+\];\h*@?eval[\h\(]+(?:['"]{2}[\h\.]+)?\40[\h\)]+;(?<X1216080>))|[\s=]+(?:(?:\$\w+\s*\.){3,}\$\w+;\s*if\s*\([^\{;]+\$_[GPCSR]\w{2,6}\[[^\{;]+\{\s*(?:(\$\w+)[\s=]+\$?\w+[\s\(]+['"]https?://[^/'"]+\.(?:top|xyz|cn|pl)/[^'"]+\.txt['"][\s\)]+;\s*)+(\$\w+)[\s=]+\$_[GCSPR]\w{2,6}\[[^;]+;[^\?]{0,199}\$\1[\s\(]+\43\b[^,;]+\.(?:php|htaccess)['"][\s,]+\42[\s\)]+;\s*\}(?<X1210650>)|(?:\$\w+|str_rot13)[\s\(]+['"]uggcf?://[^;]+;[^\?\{\}]{0,199}\b(curl_)setopt[\s\(]+(\$\w+)[,\s]+CURLOPT_URL[\s,]+\$\1[\s\)]+;[^\?\{\}]{0,199}\$(\w+)\s*=[^;]{0,199}\45exec[\s\(]+\46[\s\)]+;[^\}\{\?]{0,199}\bif\s*\([^\{;]{0,199}\$\47\b[^\{;]{1,199}\{\s*@?eval[\s\(]+\$\47[\s\)]+;\s*\}(?<X1212500>)|(?:\[|Array\s*\()\s*['"]https?://[^/]*\bgithub[^'"/]+/[^\?]{1,499}\bfwrite[\s\(]+\$\w+[,\s]+(\w+)[\s\(]+\$\1\[0\][^\?]{1,499}\bfunction\s+\49\s*\([^\{]{1,99}\{[^\}]+\bcurl_exec\s*\([^\}]+\}(?<X1202001>)|@?(?:(curl_)init[\s\(]+(?:\$?\w+[\s\(]+)*\$_[GPCSR]\w{2,6}\[[^\?\}=]{1,499}\$(\w+)[\s=]+@?\51exec[\s\(]+\$\1[\s\)]+;\s*@?eval\s*\([^\);]*\$\52\b[^;]*;\s*(?:die|exit)\b[^;]{0,19};(?<X1209760>)|\$_[RGPCS]\w{2,6}\[[^;]+;\s*(?:(\$\w+)[\s=]+['"][^;]+;\s*)+\54\s*=[^;]+['"]ukey['"];[^\?]{0,499}\54\s*\([^;]+,\s*@?\$\1[\s\)]+;[\s\}]+else[\s\{]+@?\54\s*\([^;]+,\s*@?\$\1[\s\)]+;(?:\s*\}){1,2}(?!\s*else)(?<X1213900>)|filemtime[\s\(]+['"]([^'"]{0,49}\bwp\-(?:admin|includes)\b[^'"]{0,49})['"][\s\)]+;(?:\s*if\s*\([^\)'"]{0,49}['"]((\56\b[^'"]{0,49})/[^'"/]{0,199})['"][\s\)]+\{\s*@?unlink[\s\(]+['"]\57['"][\s\)]+;\s*@?touch[\s\(]+['"]\58['"][\s,]+\$\1[\s\)]+;\s*\}){5,}(?<X1197910>)|fsockopen[\s\(]+['"][^'"]+\.ngrok\.io['"][,\s]+\d+[\s\)];\s*\$\w+[\s=]+@?proc_open\s*\([^;,]+,\s*(?:array\(|\[|\{)[^,;]*\$\1\b[^\]\}\);]+[\]\}\)][^;]+;(?<X1211180>)|str_replace[\s\(]+["'][^,;\)]+,\s*['"]{2}[\s,]+(?:\$\w+\s*\.\s*){4,}\$\w+[\s\)]+;\s*(\$\w+)[\s=]+@?(?:\$\w+|create_function)[\s\(]+['"]{2}[,\s]+\$\1[\s\)]+;\s*@?\61\s*\(\s*\);(?<X1203190>))|['"]https?://[^;]+;\s*(\$\w+)[\s=]+@?(file_)ge(t_contents)[\s\(]+\$\1[\s\)];\s*if\s*\([^;\{]+\{[^;]*\b\64pu\65[\s\(]+['"][^'"]+\.php['"][,\s]+(?:\64ge\65[\s\(]+['"]https?://|\$\1\b)[^\}]+\}\s*(?:\}\s*)+else[\s\{]+echo\s*\63;?\s*\}(?<X1208040>)|\$_[GPCSR]\w{2,6}\[[^;]+;\s*(\$\w+)[\s=]+get_user_by\s*\([^,]+,\s*\$\1[\s\)]+;[^\{;]{0,199}\bif\s*\([^\{;]{1,199}\{[^\}]{0,199}\b(?:wp_set_(?:current_user|auth_cookie)[\s\(]+\67\->ID[\s\)]+;\s*){2}(\$\w+)\s*=[^;]+;\s*wp_safe_redirect[\s\(]+\68[\s\)]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1212160>)|\(array\)\s*wp_authenticate[\h\(]+\$\w+[\h,]+(\$\w+)[\h\)]+;\s*if\h*\([^\{;]*\$\1\[['"]allcaps['"]\]\[['"]administrator['"]\][^;\{]+\{\s*(\$\w+)[\s=]+['"][^\}]{1,499}\$(\w+)\s*=[^;]*\70\b[^;]*;\s*\71[\s\.=]+http_build_query[\s\(]+\$\72[\s\)]+;\s*(\$\w+)[\s=]+(curl_)init[\s\(]+\71\b[^\}]+\b\74close[\(\s]+\73[\s\)]+;\s*\}(?<X1208841>)|\[[^\?]{0,499},\s*function\s*\([\s\)]+\{[^\?]{0,999}\$\1[\s\[]+\d+[\s\]]+\(\s*\);(?<X1214420>)|base64_decode[\s\(]+['"][^'"]{99,}['"][\s\)]+;\s*(\$\w+)[\s=]+@?create_function\s*\([^;\)]+\$\1\b[^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+\$_[GPCSR]\w{2,6};\s*\77[\s\(]+\79[\s,]+\78[\s\)]+;(?<X1212420>)|false;\s*if[\s\(]+!(function)_exists[\s\(]+['"](\w+)['"][\s\)\{]+\81\s*\82\s*\(\s*\)\s*\{[^\?]{499,}\bfile_put_contents\s*\([^#]{1,499}\bvar_dump[\s\(]+move_uploaded_file[\s\(]+\$_FILES\[[^#]{99,1999}</html>\s*<\?[ph\s]+(?:die|exit)\b[^;]{0,19};[\s\}]*\$\1[\s=]+\82[\h\(]+\);(?:\h*\})*(?<X1209430>)|wp_upload_dir\s*\(\s*\);\s*(\$\w+)[\s=]+\$\1\s*\[[^;]+;\s*@?[ir](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"]phar://[\s\.']+\84[\s\)"]+;(?<X1209291>))|[\s\=]+@?\$_[GPCSR]\w{2,6}\[[^;]+;[^\{]{1,499}\bforeach\s*\([^\{;]+\{\s*(\$\w+)\s*\.=[^;]+;\s*\}\s*(\$\w+)[\s=]+@?(?:\$\w+|create_function)[\s\(]+['"]{2}[\s,]+\86[\s\(]+\$\1[\s\)]+;\s*@?\87\s*\(\s*\);\s*@?(?:die|exit)\b[^;]{0,19};(?<X1202060>)|\h*=[^;]*\$_[GPCSR]\w{2,6}\[[^;]+;\s*if\h*\([^\{;]{1,499}\{\s*(\$\w+)[\h=]+wp_cre(ate_user[\h\(]+)\$\1\b[^;]+;\s*(\$\w+)[\h=]+new\h+WP_User[\h\(]+\89[\h\)]+;\s*\91\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*(\$\w+)[\h=]+Array\s*\([^;]*['"]id['"]\s*=>\s*\89\b[^;]+;\s*wp_upd\90\92[\h\)]+;\s*\}(?<X1208690>)|\s*=\s*\1;\s*\$(\w+)\s*=\s*\94;\s*(eval\(\w+\(['"]JOKA)[^'"]+['"]\)\);\s*\95(?<X220335661>))|(\w{1,20})(?:[\h=]+@?fopen[\h\(]+["'][^'"]{1,20}\.php['"][\h,]+[^;]{1,9}\);\s*(\$\w{1,20})[\h=]+@?file_get_contents[\h\(]+['"]https?://(?:\w+\.)?(?:githubusercontent|pastebin)\.com/[^'"]{9,99}["']\);\s*\$\w{1,20}[\h=]+@?fwrite[\h\(]+\$\97[,\h]+\98\);\s*@?fclose[\h\(]+\$\97\);(?<X1204151>)|\h*=\h*ninjaxTrim\(\$_POST\[['"]\97['"]\]\);(?<X2140561>))|(\w{1,25})[\h=]+fopen[\h\(]+['"][^'"]+\.php['"][^\)]+\);\s*(\$\w{1,25})[\h=]+@?file_get_contents[\h\(]['"]https?://raw\.githubusercontent\.[^\)]+\);\s*\$\w{1,25}[\h=]+fwrite[\h\(]+\$\101[\h,]+\102[\h\)]+;(?:\s*fclose[\h\(]+\$\101[\h\)]+;)?(?<X1212551>))
\$(\w{1,40})(?:=(?:(\w{1,40}\()\d+\)(\.['"]{2}\.)(?:\2\d+\)\3){2}[^@]{99,399}\.location\.href=[^;\s\?&=]{1,99}\.php\?\$\1\b(?<X2178731>)|(curl_)init\(\$\w{1,40}\.['"]\/\w*\.php\?key=['"]\.\$\w{1,40}\.['"]\&api=['"]\.\$\w{1,40}\.['"]\&ip=['"]\.\$\w{1,40}\b[^\?=]{0,200}\$(\w{1,40})=\5exec\(\$\1\);(?:if\(stri?pos\(\$\6\,[^\)]+\)\!==?(?:true|false)\)\{){5}[^\}]{1,499}(?:\}else\{exit\(header\(['"]HTTP/[\d\.]+\s+40[34]\b[^;]+;\}){5}(?<X2204283>)|(mysqli?_)query\([^,\)]+,['"][^'"]+\bFROM\s+alfa_bc\b[^;]{1,99};(\$\w+)=\8fetch_assoc\(\$\1\);(\$\w+)=['"]create_function['"];(\$\w+)=\10\([^,\)]+,['"]eval\(['"]\?>['"][^\}\?]{1,99};\11\(\9\[[^;]{1,99};(?:die|exit)[^;]{0,19};(?<X1171470>)|['"](?:(?:\./)?wp\-content/(?:plugins|themes|uploads)['"];if\(!\h*is_dir(\(\$\1\))\)\{mkdir\13;\}(\$\w{1,40})=\$\1[^;]{1,49}\.php['"];if\(!(file)_exists\(\14\)[^\{\};]{1,49}\{(\$\w{1,40})=\w{1,40}\(['"]https?://[^;]{1,49};(\15_put_contents\()\14,\16\);\17\$\w{1,40},md5_\15\(\14\)\);(?<X2156960>)|<\?(?:php)?\s*if\((?:md5\(){1,}\$_[GPCSR]\w{2,6}\[[^\]]+\]\)[^;]{1,99}\.php_uname\(\)\.[^@]{49,499}\bfunction\h+(\w{1,40}\()\$\w{1,40}\)\{unlink\(['"]([^'"]{1,99})['"]\);file_put_contents\(['"]\20['"],\$\1\);\}\s*\19\$\1\);\s*(?:\?>\s*)?\Z(?<X2178830>)|[^'"\s]{999,9999}['"];(\$\w{1,40})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,'"]{1,49}['"],\22,(\$\w{1,40})\)\)\{(\$\w{1,40})=[^;]{1,99}\23\[[^;]{1,99};\}[^\?]{1,99}\$(\w{1,40})=\w{1,40}\(\$\1,\24\);eval\(\$\25\);\s*(?:\?>)?\Z(?<X2177121>)|[^'"]{20000,}['"];(\$\w{1,40})=\w{1,40}\(\$\1,\$\w{1,40}\);\$\w{1,40}\(['"](\w{1,40})['"],\27\);(\w{1,40}\()['"]chmod\h+\+x\h+\28['"][^;]{1,99};echo\h+\29\h*['"]\./\28\b[^;]{1,99};\$\w{1,40}\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/\28['"]\);(?:\?>)?\Z(?<X2178740>)|\s*Options\s*(?:[\-\+]?Indexes\s*)?\+?FollowSymLinks\b[^;]{9,499};file_put_contents\(['"][^'"]{0,49}\.htaccess['"],\$\1\b[^@\}\?]{9,499}\b(?:symlink\(['"]/home/[^;]{9,199};){9}[^\v\}]{999,}symlink\(['"]/home/[^;]{9,199};\}(?<X2156521>)|openssl_decrypt['"];(\$\w{1,40})=\$\1\([^@\?]{1,199}\$(\w{1,40})=explode\([^,\)]+,\32\);(?:(\$\w{1,40})=\$\33\[[^;]{1,99};){1,4}class\h*(\w{1,40})\{public\h*function\h*__\w{1,9}\((\$\w{1,40})\)\{eval\([^\)]{0,49}\36\b[^;]{1,99};\}+new\h*\35\(\34\);\}?(?:\?>)?\Z(?<X2177040>))|\(?\$_[GPCSR]\w{2,6}\[[^;]{1,99};[ps](?:assthru|ystem|xec|hell_exec|open)\(\$\1\b[^\?#%&:!@]{1,99}\bif\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\D{2,3}['"][^\{]{1,99}\{echo\b[^;]{1,99};include\h*(?:\(\h*)?['"]/etc/(?:passwd|shadow)['"](?<X2178124>)|base64_decode\(\$_[GPSRC]\w{2,6}\[[^;]{1,99};(\$wpdb\->)query\(\$\1\);(?:echo|printf)\(['"][^'"]{1,199}['"],(?:DB_(?:NAME|USER|PASSWORD|HOST),){4}\39prefix\);(?<X2180802>)|f(?:ile_get_contents\((?:['"]php://input['"]\);[^@\?]{1,199}\$\1=openssl_decrypt\(\$\1,[^\?]{1,199}\bclass\s*(\w{1,40})\{[^\$\(;]{1,40}\bfunction\s*__construct\((\$\w{1,40})\)\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\42\b[^;]{1,49};\}+new\s*\41\([^;]{1,99};\}?\s*(?:\?>)?\Z(?<X2163240>)|[^;]{1,99};if\((preg_\w{1,9}\()['"]\Wclass\h+JConfig\b[^,\);]+,\$\1\)+\{(?:\44['"]\W\\\$(?:host|user|password|db|dbprefix)=[^;]{1,99};){5}[^/:]{1,999}=mysqli?_query\(['"]UPDATE\b[^;]{0,99}\busers\h+SET\h+username=[^,=;]{1,19},password=['"]\w{32}['"](?<X2180661>))|open\([^,\);]+\.txt['"],[^;]{1,99};(?:(\$\w{1,40})=['"](?:U(?:ser)?(?:name)?|Pass(?:wo?r?d)?):\s*\$[^;]{1,99};){2}fwrite\(\$\1,[^\)]+\46\b[^;]{1,99};fclose\([^;]{1,99};header\(['"]Location:\s*https?://[^;]{1,99};(?:die|exit)\([^\)]{0,99}\);?(?:\?>)?\Z(?<X2165980>))|hash\([^\),]+,\s*\$\w{1,40}\);if\(\$\1\b[^\)]+\)\{unlink\((\$\w{1,40})\);file_put_contents\(\48\b[^;]{1,99};touch\(\48,strtotime\(['"]\-\d{2,5}\s+days['"],time\(\)+;chmod\(\48,\d{3,4}\);[^@]{1,499}<title>[^/<]{1,199}</title>(?<X2158392>))|[\s=@]+file_get_contents[\s\('"]+php://input['"\)\s;]+((\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\])[\s='"]+\1['";\s]+if[\s\(]+substr\(\$\{\50[^\{;]{0,99}\{(?:\s*(\51\w+['"]\])[\s=]+['"]\w+['"];)+\D{0,99},\d+[\s\);\(\$\{]+(\51\w+['"]\])\}[\s=]+\$\{\52[\s\}\);]+try[\s\{]+eval\(\$\{\53\}[^\{]{0,99}\{\}\}(?<X1218750>)|[\s=]+['"](\w{1,60})['"];\s*(\$\w+)[\s=]+['"]\55['"];[^\{\}\(\)]{0,199}\bif\s*\([^\{;]+\{\s*(\$\w+)[\s=]+wp_create_user\s*\((?:[^\)]*(?:\$\1|\56)){2}[^\}]{1,499}\$(\w+)[\s=]+new\s+WP_User[\s\(]+\57[\s\)]+;\s*\$\58\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}(?<X1203841>)|\[['"](\w{1,40})['"]\][=\s]+(base64_decode)[\(\s]+['"]Zml[^'"]*['"](?:[\.\s]+['"][^'"]+['"])+[\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^\$;]{0,40}\$GLOBALS\s*\[['"]\1['"]\]\s*\[['"]\60['"]\][\(\s]+\61[\(\s]+['"]aHR0[^'"]*['"](?:[\.\s]+['"][^'"]+['"])+[\)\s]+;(?<X1209950>)|\h*=\h*(?:(@file_ge(t_contents)\h*\(\h*['"]https?://[^;]{1,199};\s*@?file_pu\64\h*\()([^\.\)]{1,99}\.\h*['"]/)(\w{1,40}\.php)['"],\h*\$\1\h*\);(?:\s*\$(\w{1,40})\h*=\h*\63\65(?:wp\-(?:includes|content|admin)/(?:[^'"]{1,99}/)?)\66['"]\h*,\h*\$\67\h*\);){1,3}(?<X1177830>)|(array)\((?:\s*['"]\w{1,40}['"]\s*,){9}[^;]{9999,};\s*(\$\w{1,40})\h*=\h*\69_rand\h*\(\h*\$\1\h*,[^@]{99,999}<\?=(?:\s*\$\1\h*\[\h*\70\h*\[\h*\d+\h*\]\h*\]\h*;\s*\?>\s*<\?=){9}(?<X2166632>)|@?(file_)ge(t_contents)\h*\(\h*['"]https?://[^/;]{0,19}\b[ghp](?:aste|host)bin\.[\w\.]{1,9}/[^;]{1,99};\s*@?\72pu\73\h*\([^,\);]+\.php['"]\h*,\h*\$\1\h*\);(?<X1163141>)|@?fopen\([^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\(\h*['"]https?://[^/]{0,49}bin\.com/(?:raw|download)/[^;]{1,99};\s*@?fwrite\(\h*\$\1\h*,\h*\75\h*\);[^\?\*:]{1,999}/etc/passwd\b(?<X2157711>)|['"][^@'"\);]+@(?:gmail|ya(?:ndex|hoo)|(?:proton|hot)mail|live|outlook)\.[\w\.]{1,9}['"];[^\?]{0,199}\bmail\h*\(\h*\$\1\h*,[^\?]{1,499}(\$experience_login)\h*=\h*@?file_get_contents\h*\([^;]{1,99}\.(?:html?|txt)['"]\h*\);(?:\s*\77\h*=\h*str_i?replace\h*\([^;\)]{1,99},\s*\77\h*\);){2}(?<X2168890>)|['"]header['"];\s*\$\1\h*\(\h*['"]Location:\h*https?://[^/\?;]{0,99}\blovegreenpencils\.ga/[^'"\s]{1,99}['"]\h*\);(?<X1180050>)|\$_[GPCSR]\w{2,6}\[[^\?>]{1,499}\b[pes](?:assthru|ystem|xec|hell_exec)\s*\(\s*['"][^\)]{0,99}\$\1\h+[\d&]\h*>\h*(/tmp/[^\h'"\);]{1,49})\b[^\)'"]{0,99}\brm\b[\h\-\w]{0,19}\80\b(?<X2157353>)|\$_POST\[['"]log['"]\];\s*\$(\w{1,40})\h*=\h*\$_POST\[['"]pwd['"]\];[^\}\?]{9,199}\$([bm](?:essage|e?sg|ilsmg))\h*=\h*['"](?:[^;]{1,499}\$(?:\1|\82)\b){2}[^\?\}>@]{1,499}@mail\([^\)]+\83\b[^;]{1,99};(?<X1159241>)|\$wpdb\h*\->[^;]{1,99};\s*foreach\h*\(\h*\$\1\s*as\s*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*\85\h*\->\h*ID;\s*if\h*\(\h*user_can\h*\(\h*\86\h*,\h*['"]administrator['"](?:\h*\)){2}\s*\{[^\}]{1,199}\bwp_set_current_user\h*\(\h*\86\b[^\?>]{1,499}\}\s*(?:die|exit)[^;]{0,19};(?:\s*\}){2}(?<X1170981>)|file_get_contents\(['"]https?://[^;]{1,99}/core/install/(upgrade)\.php['"][^\{\}\?]{1,99}\bif\(stri?pos\(\$\1,['"]begin\s*\88['"]\)[^\}]{1,99}\breturn\s*['"]\w{32}['"];[^@\?\(\)]{1,199}\bpreg_match(?:_all)?\(['"](\W)var\s*CUSTNUMBER=['"]\([^\)]+\)['"];\89['"],\$\1\b(?<X2163671>)|fopen\h*\(\h*(?:\$\w{1,40}\h*\.\h*)?['"]([^,'"]{1,99}/wp\-(?:includes|admin)/[^'",]+\.php)['"][^;]{1,99};\s*fwrite\h*\(\h*\$\1\h*,[^\?]{1,499}\bif\h*\(\h*file_exists\h*\(\h*['"]([^'"]{1,99})['"](?:\h*\)){2}\s*\{\s*touch\h*\(\h*['"]\91['"]\h*,\h*filemtime\h*\(\h*['"]\92['"]\h*\)(?<X2174120>)|hex2bin\([^;]{1,199};\s*if\h*\(\h*(\$_POST\[\h*['"]log['"]\h*\])\h*\)\s*\{[^\}]{1,199}(\$\w{1,40})\h*=\h*\94;[^\}]{1,199}\$(\w{1,40})\h*=\h*\$\w{1,40}\[['"]administrator['"]\];\s*if\h*\(\h*\$\96\b[^\}]{1,199}\bwp_remote_post\h*\(\h*\$\1\h*,[^;]{1,199}\95[^;]{1,199};(?:\s*\}){2}(?<X1159760>)|new\s+PclZip\h*\(\h*['"]([^'"]+\.zip)['"][^;]+;\s*if\h*\(\h*\$\1\b[^\?]{1,199}\$\w{1,40}\h*=\h*explode\h*\([^\)]+['"]\98['"]\h*\);[^\?]{1,499}\btouch\h*\(['"]\98['"]\h*,[^\}\?]{1,199}\bunlink\h*\(['"]\98\b[^;]{1,199};\s*die\h*\(\h*['"]\d+['"]\h*\);\s*\}(?<X1165420>))|\s*=\s*urldecode\('%\d+[^;]+;\s*\$\1\s*=\s*\$\1\(''\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\);\s*\$\1\(\s*\);(?<X2049661>))
\$(?:(\w{1,9})(?:\h*=\h*['"]create['"];\s*\$\1\h*\.\h*=\h*['"]_function['"];\s*(\$\w{1,9})\h*=\h*@?\$\{\h*\1\h*\}\h*\(\h*null\h*,\h*str_rot13\h*\(\h*(['"])\h*(?:riny|nffreg)\h*\(\h*\$_[TCPFE]\w{2,6}\[[^\]]{1,20}\]\h*\);\h*\3(?:\h*\)){2};\s*@?\2\h*\(\h*\)\h*;(?<X1175542>)|\s*=\s*(?:fsockopen\(['"]udp://['"]\.\$host,[^\)]+\);\s*if\((\$\1)\)\s*\{\s*fwrite\(\5\s*,\s*\$\w{1,9}\);\s*fclose\(\5\);\s*\}\s*\}\s*(?:echo|print)\s*\(?['"]?[^'"]{0,9}>\s*UDP\s+Flood\b(?<X2123211>)|getenv\(['"]REMOTE_ADDR['"]\);[^\$]{0,40}\$(?:subject|subj)\s*=\s*['"](?:New)?\s*Office\s+365\D{1,9}\.\$\1\.[^;]+;[^/]{9,40}\$(?:message|body|content)\s*=\s*body\((\$_POST\[(['"]))(?:login|username|user)\8\]\s*,\s*\7(?:passwd|pass|password)['"]\]\);(?<X2120091>)))|(\w{2})[\s=]+['"]\10['"];\s*include\(\$\10\);(?<X120358821>)|(auth_pass)\s*=\s*['"][^'"]*['"];\s*function\s+(loveLogin\(\))\s*\{\s*(?:exit|die)[^;]{9,150};\s*\}\s*if\s*\(!empty\s*\(\$\12\)\)\s*\{[^\}]{9,80}lovesetcookie\s*\(md5\s*\([^,]+,\s*\$\12\);[^\}]{9,150}\13;\s*\}(?<X2065190>)|(backdoor)\h*=\h*(array\()\h*(?:['"][^'";,]+\.php['"]\h*(?:,\h*)?){1,9}\);\s*\$\15_contents\h*=\h*\16\h*['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*\(['"]{2}(?<X2162810>)|(bilsub|subject)\s*=\s*['"][^;]{0,99}(?:Wells(?:\h*Fargo)?|apple?|AMA?ZO?N)\h*Login\h*(?:Re[zs]ult[sz]?)\b[^@\?]{1,199}\bmail\([^\)]+\18[^;]{0,49};\s*header\s*\(\s*['"]Location:(?<X2140820>)|(data|me?sg|message)\h*=\h*['"]\s*\W{9,49}Mr\.?Professor\b[^;]{9,999}\$VictimInfo\d?\b[^@>!%\*]{1,999}\bmail\([^\)]+\$\20\b(?<X2163490>)|(data|msg|message|f[uc]{2}k)\h*=\h*['"](?:[^'";]{1,99}(?:(?:Apple?|login|user)\s*id|pass(?:word)?)\h*:\h*\$\w{1,40}\b){2}[^\(\?]{99,299}\bmail\([^\)]+\$\22[^;]+;\s*header\(['"]Location:(?<X2141893>)|(DCH_MESSAGE)\h*\.?=\h*['"][^%\?]{1,1999}\bVictime?\s*Information\b[^%]{1,1999}\$(DCH_HEADERS)\h*\.?=\h*['"]\h*DCH\-version:[^\?]{1,499}\bmail\h*\((?:[^\)]{1,99}\$(?:\24|\25)\b){2}(?<X2165020>)|(defacer)\h*=\h*(?:&\h*\27\27::getInstance\([^\)]{0,99}\);(?<X2167600>)|\$_[GPRSC]\w{2,6}\[['"]\27['"]\];(?<X2166641>))|(dox)\h*\.=\h*['"][^@;]{2,60}\[\h*\w.\30\h*\][^@;]{2,60}\\n['"];[^\(]{9,450}\bmail\h*\((?<X2171561>)|(email|user|username|login)\s*=\s*\$_POST\[['"](?:email|user|username|login)['"]\];\s*\$((?:\32)?(?:pass|password|passwd))\s*=\s\$_POST\[['"]\33['"]\];\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*\$message\s*=\s*['"][^\$]{0,250}facebook(?<X2054471>)|(fone)\s*=\s*\$_POST\[['"]\35['"]\];\s*\$(emailaddr)\s*=\s*\$_POST\[['"]\36['"]\];\s*\$(emailpass)\s*=\s*\$_POST\[['"]\37['"]\];\s*\$(token)\s*=\s*\$_POST\[['"]\38['"]\];(?<X2054900>)|(GLOBAL)S\[(?:['"]\w+['"]\];\40\$\w+;\$\w+=\$\40S;\$\{['"](?:\\x\w{2,3})+['"]\}\[['"]\w+['"]\]="(?:\\x\w{1,3})+";[^\v]+\]\)\{@?eval\(\$\w+\[\$\w+\[["']\w+["']\]\[\d+\]\]\);\}(?:exit|die)\b[^;]{0,19};\}(?<X1035823>)|[^\]]+\];\40\s*(\$\w+);\42=\$\40s;ini_set\([^\?]{1,1499}\$(\w+)\[['"]ak['"]\][^\?]+?=Array\(['"]pv['"]=>phpversion\(\)[^\?]+?\{@?eval\(\$\43\[[^;]+;\W+(?:die|exit)\b[^;]{0,19};\}(?<X1202273>))|(GLOBALS)\[['"](?:(\w+)['"]\]=\w+\((base64_decode)\([^,]{4,64},\47\(['"]+\.['"]\w+['"]\).\w+\(['"\w\.=]+\),\47[^\n]+\45\[['"]\46['"]\]\[\d+\]\(\$_\w+\[(\w+)\(\d+\)\],round\([\d\+]*\)[^\{]+\{(\$_\d+)[^\}]+\48[\d\(\)\];}]+return\s*\49;\}(?<X1264000>)|[^'"]+['"]\][=\s]+base64_decode[\(\s'"]+aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29t[^'"]+['"][\s\)]+;[^\.]{99,9999}\$\{\$\{['"]\45['"]\}\[[^\]]+\]\}=curl_init\(\$\45\[[^\]]+\][\.\s]+\$\{\$\{['"]\45['"]\}[^\?]{99,9999}\beval[\s\(]+['"]\?>['"][\s\.]+\$\{\$\{['"]\45['"]\}\[[^\]]+\][\}\);\s\?>]+\Z(?<X2221172>))|(headers)\h*\.?=\h*['"]From:[^;@>]{1,199}@anoxyty\.com\b[^\?]{1,499}\bmail\([^\)]+\$\52\b(?<X2165450>)|(headers?)\h*\.?=\h*['"]From:(?:[^;@]{1,99}@correos\.es\h*>[^\?]{1,199}\bmail\([^\)]+\$\54\b[^\?]{1,199}\bheader\h*\(\h*['"]Location:(?<X2164760>)|\h*Boteye\h*v\h*[\d\.]+\b[^;]{1,99};\s*@?mail\h*\([^\)]+\$\54\b[^;]{1,99};(?<X2166623>)|\s*DH[a4]\-?viper\b[^\?\(]{1,199}\bmail\h*\(\h*(?:(\$\w{1,40})\h*,\h*){3}\$\54\h*\);\s*@?fclose\h*\(\h*@?fwrite\h*\(\h*@?fopen\h*\([^\);]+\)\h*,\h*\57(?:\h*\)){2};(?<X2167320>)|\s*JAYd?\b[^\?\(\.]{1,199}\$(Redirect)\h*=\h*['"][^\?'";]{1,99}\.php\b[^;]{1,199};\s*if\h*\(\h*mail\h*\([^\)]+\$jayd\h*,\h*\$\54\b[^\)]{0,99}[\)\s]+\{\s*header\h*\(\h*['"]Location:\s*\$\59['"]\h*\);(?<X2167010>))|(kimcilware)\->\w{1,20}\(\$\w{1,20}\);\s*\}[^\?]{1,45}\61\h*ransomware\b(?<X2174712>)|(m(?:e?sg|essage)|bilsmg)\h*\.=\h*['"]P(?:in|ass(?:wo?r?d)?)\b[^\?]{1,499}\$(subj?(?:ect)?)\h*=\h*['"]\W{0,9}Ne[dw](?:bank)?\s*[\w\-]{1,40}\s*access\b[^\?]{1,199}\bmail\h*\(\h*['"][^'";@]+@[gyohlp](?:mail|ahoo|andex|rotonmail|utlook|otmail|ive)\.[\w\.]{2,9}['"](?:\h*,\h*\$(?:\63|\64)){2}(?<X2164242>)|(m(?:e?sg|essage)|bilsmg)\h*\.?=\h*['"]\h*CVV\b[^\?!/\(\{\}]{1,199}\$(subj?(?:ect)?)\h*=\h*['"]\h*(?:(?:ABSA|Amex|American\s*Express|CVV|CCN|CARD(?:\s*Num(?:ber)?)?)\h*(?:\W\h*)?){3}[^;]{1,99};[^\?!:/]{1,999}\bif\h*\(\h*mail\h*\((?:[^\)]+\$(?:\66|\67)){2}\b(?<X2163830>)|(m(?:e?sg|essage)|bilsmg)\h*\.?=\h*['"]\W{9,49}sf\-?express\s+re[zs]ult[sz]?\b[^;'"]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,499}\bmail\([^\)]+\69\b(?<X2162821>)|(me?s(?:g|sage))\h*\.=\h*['"]\W{9,}by\s+[md]r\.don\b[^\?]{9,399}\bmail\([^\)]+\$\71\b[^\?]{1,199}\bfwrite\([^\)]+\$\71\h*\);(?<X2166400>)|(me?s(?:g|sage))\h*\.?=\h*['"]([^\s\w]{9,49})\s*Secret\b[^;]{1,99}\74[^\?\}]{499,1499}\b(?:mail\h*\([^\)]+\$\73\b[^;]{1,99};\s*@?){2}[^\?>]{1,199}\$(\w{1,40})\h*=\h*@?fopen\h*\([^\),;]+\.txt['"]\h*,[^;]{1,99};\s*@?f(?:write|puts)\h*\(\h*\$\75\h*,\h*\$\73\h*\);[^\?@>]{0,99}\bheader\h*\(\h*['"]Location:(?<X2167371>)|(me?s(?:sage|g))\h*\.?=[^;]{1,99}\bpass(?:wo?r?d)?\b[^@]{1,999}\$(subj?(?:ect)?)\h*=\h*['"][^;]{1,99}\bSPYUS\b[^\?@]{1,199}\bmail\((?:[^\);]{1,49}\$(?:\77|\78)){2}\b(?<X2163300>)|(me?s(?:ssage|g))\h*\.=\h*['"]\W{1,99}Prince\h*du\h*scama?\b[^\?]{9,499}\bmail\([^\)]+\$\80\b(?<X2153071>)|(me?sg|message)\h*=\h*['"](?:[^'"]{1,499}\bn?Pass(?:wo?r?d|code)?\s*\W\s*\$pass(?:wo?r?d|code)?\b[^\?]{9,499}\bmail\([^\)]+\$\82\b[^@/]{1,499}<meta\b[^>]{0,199}\bcontent\h*=\h*['"]\d+;\h*url=['"]?https?://[^/]{0,99}\b[lshonm](?:ive|ffice|sbc|f\-express|aver|ate|aersk)\.com[/"'](?<X2157261>)|[^;]{1,999}\bPass(?:wo?r?d|code)?\s*\W\s*\$pass(?:wo?r?d|code)?\b[^!@#%,]{1,999}\bmail\h*\([^\)]+\$\82\b[^\?]{1,299}\bheader\(['"]Location:\s*https?://[^/'";]{0,99}\b[shonm](?:ffice|sbc|f\-express|aver|ate|aersk)\.com[/"'](?<X2156933>))|(me?sg|message|bilsmg)\h*(?:=\h*['"](?:[^;]{1,199}\$_[GPCSR]\w{2,6}\[['"]pass(?:wo?r?d)?['"]\][^\?@]{99,499}\$(\w{1,40})\h*=[^;]{1,199}\$\85\b[^\?@]{99,499}\bcurl_setopt\([^;]{1,99}\$\86\b[^\?@]{1,499}\bcurl_exec\([^\?@]{1,499}\bheader\(['"]Location:(?<X2160221>)|[^;]{1,99}\b(pass(?:wo?r?d)?)\b[^;]{0,40}\$\88\b[^\{\}\?]{1,199}\$(subject)\h*=\h*['"]\h*New\h+Visitor\b[^;]{0,49}\bowa\h+log\b[^@]{99,999}\$(me?sg|message|bilsmg)\h*\.=[^;]{1,99}\$\85\b[^\?]{99,499}\bmail\h*\([^\)]+\$\89\h*,\h*\$\90\b(?<X2159510>))|\.=\h*['"]\W{1,19}Created\s+(?:by|in)\b[^;]{9,99};\s*\$(subj?(?:ect)?)\h*=\h*['"]\h*OWA\h*(?:True\h*)?login\b[^@\?]{1,199}\bmail\((?:[^\)]+\$(?:\85|\92)){2}\b[^@\?]{1,199}\bf(?:write|puts)\h*\([^\),;]+,\h*\$\85\h*\);(?<X2163920>)|\.?=[^;]{1,99}\$pass(?:wo?r?d)?\b[^\?]{1,499}\bmail\h*\([^\)]+\$\85\b[^;]{1,99};\s*@?header\h*\(\h*['"]Location:\s*https?://(?:\w{1,9}\.)?office(?:365)?\.com\b(?<X2162921>))|(me?sg|message|bilsmg|result[sz]?)\h*=\h*['"][^;]{1,99}\bpass(?:wo?r?d|wd)\b[^@]{1,499}\$(subj?(?:ect)?)\h*=[^;]{0,99}\b(Seniorpeoplemeet)\b[^\?]{1,499}\bmail\((?:[^\)]+\$(?:\95|\96)\b){2}[^\?]{1,499}\bheader\(['"]location:\s*https?://(?:www\.)?\97\.com\b(?<X2159590>)|(message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{2,40}(?:D[o0]m[a4]in|L[o0]gin)\h+ReZult\W{2,40}\\n['"][^@]{99,1999}\bmail\([^\)]+\$\99\b(?<X2155701>)|(message|me?sg|bilmsg)\h*=\h*['"][^;]{1,99}\b(?:(?:Exp\s*Date|C[CV]V|SSN)\h*:[^:;]{1,99}){2}[^@]{1,599}\bmail\([^\)]+\$\101[^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][^'"]+\.txt['"]\h*,[^;]{1,49};\s*fwrite\(\h*\102,\h*\$\101\);\s*header\(\h*['"]Location:(?<X2148310>))
\$(?:(msg|message)\.=['"][^;]{1,99}\$_POST\[[^\(]{99,299}\bmail\([^\)]+\1[^;]{1,49};file_get_contents\(['"]https?://api\.telegram\.org/bot\d{1,9}[^;]{9,99}\1[^;]{1,49};header\(['"]Location:(?<X2136280>)|(MyShell)Version\s*=\s*[""]\3\s*v?[\d\.]{0,5}\b(?<X2133900>)|(pass(?:wo?r?d)?)=\$_[GPCSR]\w{2,6}\[['"]pass(?:wo?r?d)?['"]\];[^@\?\{\}]{1,199}\$(subj?(?:ect)?)=['"]Excel(?:\s*(?:log(?:in)?|detail|result)[sz]){1,2}\b[^;]{1,99};\$(\w{1,40})=[^;]{1,99}\$\5[^@]{1,99}\bmail\([^\)]+\$\6,\$\7\b(?<X2159620>)|(pony_db)\s*=\s*new\s*\9\(\);(?:\s*if\s*\(\s*!)?\s*\$\9->connect(?<X2123072>)|(scriptTitle)\s*=\s*['"]PHP\s*Shell['"];\s*\$\w{1,20}\s*=\s*['"]\$\11\s+(?:created|made)?\s*by\s+[HM][a4]ck[3e]r['"];(?<X2119300>)|(smtpname)=['"]\w{1,40}\b[^;]{1,99}substr\(str_shuffle\(['"]\w{1,40}['"]\),\d+\);[^@]{1,499}\b(?:mkdir\(['"]/home[^;]{1,99}/\$\13/\.\w{1,40}['"]\);\s*){3}[^@]{999,2999}\$(\w{1,40})=array\((?:['"](?:action|user|password)['"]=>[^,\)]+,){3}[^;]{1,99};\$\w{1,40}=\w{1,40}\(['"][^'",]+/resetpass['"],\$\14\b(?<X2163770>)|(sub(?:j?ect)?)\h*=\h*['"][^;]{0,49}\bCh[a4][s$][e3]\s*c[a4]rd\s*[1i]nf[0o]\b[^\?]{1,199}\bmail\([^\)]+\$\16\s*,\s*(\$\w{1,40})\b[^\?]{1,99}\bfwrite\([^,\)]+,\s*\17\s*\);(?<X2161130>)|(subj?(?:ect)?)=['"]Encoder\h*\-\h*https?://['"]\.\$target\.['"]\h*by\h*['"]\.\$visitor;(\$\w{1,40})=[^\?\}]{1,199}\bmail\([^\);]+\$\19,\20\);(?<X2170340>)|(subj?(?:ect)?)=\W{1,19}\$scamname\b[^\?]{1,299}\bmail\h*\([^\)]+\22\b(?<X2167781>)|(subj?(?:ect)?)\h*=\h*['"](?:[^;]{0,49}p(?:anel|restashop)\b){1,2}[^\}]{1,199}\$(\w{1,40})\h*=[^;]{0,199}\$passwd\b[^;]{0,199}\bbajatax\b[^\{\}%\*!&\|\?><]{1,199}\bmail\((?:[^\)]+(?:\24|\$\25)){2}[^;]{1,99};(?<X1162990>)|(subj?(?:ect)?)\h*=\h*['"][^'"]{0,49}\b[Lof](?:inkedIn|utlook|acebook|ffice(?:365)?)\b[^'"]{1,99}\bRe[sz]ult[sz]?\b[^\?]{99,999}\bmail\h*\([^\)]+\$\27\b(?<X2156910>)|(subj?(?:ect)?)\h*=\h*['"][^;]{0,99}\$ip\s+(?:Rezult|LOGING)[sz]?\b[^\}]{1,999}\bheader\h*\(\h*['"](Location:)[^;]{1,99};\s*\}\s*else\s*\{\s*(?:mail\([^\);]+\$\29,[^;]{1,99};\s*){2}[^\}]{1,199}\bheader\h*\(\h*['"]\30(?<X2171351>)|(subj?(?:ect)?)\h*=\h*['"]\h*Ch[a4][s5][e3]\h+(?:VBV|Billing|Login|Access|[cv]{3})\h*[\W\S]\h*New\b[^\?]{99,499}\bmail\h*\([^\)]{1,99}\32\b(?<X2151151>)|(subj?(?:ect)?)\h*=\h*['"]\h*Netflix\s+Login\b[^\?]{1,499}\$(\w{1,40})\h*\.?=[^;]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,199}\bmail\((?:[^\)]+\$(?:\34|\35)\b){2}[^\?]{1,199}\bfwrite\([^\)]+\$\35\b(?<X2165161>)|(subj?(?:ect)?)\h*=\h*['"]\h*New\h+Victim\b[^\?]{9,499}\bmail\h*\([^\)]{1,199}\$\37\b(?<X2151721>)|(subj?(?:ect)?)\h*=\h*['"]\W{1,19}CVV\s+by\b[^@\(]{1,199}\$(\w{1,40})\h*=\h*['"]\w{1,40}@(?:(?:g|proton|hot)mail|ya(?:hoo|ndex)|live)\.[\w\.]{1,9}['"];[^@\}\?]{1,199}@?mail\h*\((?:[^\)]{0,99}\$(?:\39|\40)){2}\b(?<X2163910>)|(subj?(?:ect)?)\h*=\h*['"]Gift\h+from\h*(?:\(\h*)?i\-team\h*(?:\)\h*)?['"];[^@]{0,199}\bmail\([^\)]+\$\42\b(?<X2159911>)|(subj?(?:ect)?)\h*=\h*['"]Re[sz]ult[sz]?\b[^\?]{1,199}\$(headers)\h*\.=\h*\$_POST\[['"]emailadd['"]\][^\?]{1,199}\bmail\([^\)]+\$(?:\44|\45)\b[^@]{1,199}<script\b[^\}\?<]{1,99}\.location(?:\.href)?\h*=\h*['"]\h*https?://[^/;'"]{0,99}(?:office|gmail)\.com['"/](?<X2164251>)|(subj?(?:ect)?)\h*\.?=\h*['"][^a-z]{0,9}\bNew\h*log(?:\s*in|[sz])?\b[^\?]{1,199}\bmail\h*\((?:[^\)]+\$(?:\47|me?s(?:g|sage)?)){2}\b[^\?]{1,999}\bfunction\s+visitor_country\h*\(\h*\)\s*\{(?<X2165580>)|(user_agent)_to_filter\s*=\s*array\s*\([^\)]{999,9999}\)\s*;\s*if\h*\([^\)]+\$_SERVER\[['"]HTTP_\49['"]\][^\{;]{1,199}\{\s*(\$isbot)\h*=[^\@/]{1,499}\bif\h*\(\h*\50\h*\)\s*\{(?:[^@%#!:]{99,999}\bcurl_setopt\h*\(\h*\$\w{1,40}\h*,\s*CURLOPT_URL\h*,\h*['"]https?://[^/;]{1,99}\.pw/){2}(?<X2173900>)|(VictimInfo\d*)\h*(?:\.=[^\?]{99,999}\$(\w{0,9}m(?:e?sg|essage))\h*=[^;]{99,999}\$\52[^;]{99,999};\s*@?mail\([^\)]+\$\53[^;]{1,99};\s*header\h*\(\h*['"]Location:(?<X2154620>)|\.?=[^\?]{99,999}\$(m(?:e?sg|essage)|result[sz]?)\h*=[^;]{99,4999}\$\52[^;]{99,4999};\s*@?file_get_contents\h*\(\h*['"]https://api\.telegram\.org/bot[^;]{1,99}\$\55(?<X2154650>))|.\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST);\s*@\(\$.\[\d\]\s*!=\s*\$.\[\d\]\)\s*\?\s*@\$.\[\d\]\(\$.\[\d\]\)\s*:\s*\(int\)\$.;(?<X1034151>)|[0o_]{1,40}[=\s]+(?:\w{0,16}[\(\s]+['"]?\$[0o_]{1,40}[=\s]+['"]['"]['"]?\s*[),]\s*['{"]\$[0o_]{1,40}[=\s]+array\(\);\s*\$[0o_]{1,40}\[[^\]]+\][=\s]+(?:(str_replace)[\s\(]+){2,}['"][\s/'",]+(\$\{['"]_SERVER['"]\})\s*\[['"]PHP_SELF['"]\][\s\)]*,\s*['"]{2}[,\s]+\58[^;\$]{0,99}\59\s*\[['"]SCRIPT_F\w+['"]\][\s\)]+;(?<X1233382>)|create_function[\(\s]+['"]\$[0o_]{1,40}[=\s]+['"]['"]['"]\s*,\s*['"]\$[0o_]{1,40}[=\s]+array\(\);\s*\$[0o_]{1,40}\[[^\]]+\][=\s]+(?:(str_replace)[\s\(]+){2,}['"][\s/'",]+(\$\{['"]_SERVER['"]\})\s*\[['"]PHP_SELF['"]\][\s\)]*,\s*['"]{2}[,\s]+\61[^;\$]{0,99}\62\s*\[['"]SCRIPT_F\w+['"]\][\s\)]+;(?<X1231990>))|[0OI1]{10,32}=\d{4};eval\(base64_decode\(['"]LypTczlON[^'"]+7cmV0dXJuOw==['"][\h\)]+;\s*return;\s*\?>[^\n<>]{999}(?<X2263852>)|[1li]nj[3e][ck]t[o0]r\s*=\s*gethostbyname\s*\(\s*\$_SERVER\s*\[\s*['"](?:REMOTE|SERVER)_ADDR['"]\s*\]\s*\)\s*;\s*@?mail\s*\((?<X2124280>)|[\{"']{0,2}[GOBALS\\x471532cf]{7,28}[\}"']{0,2}\[[^\]]+\]\h*=\h*['"][^'"]{99,999}['"];[^\?\(\}@#&:/<>!%]{0,499}(\$GLOBALS\[)(\66['"]\w+['"]\])\[\d+\]\.\66[^`\*#/]{999,19999}\67\[\d+\]\h*\)\s*\{[^\}]+\}\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1160881>)|[^\=\w;'"\{\(\[]{1,40}=\s*['"]\w{8,99}['"];[^\$]{0,99}(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{99,}['"];)+\s*@?eval\s*\((?:(?:str_rot13|base64_decode|gzinflate|convert_uudecode|gzuncompress|htmlspecialchars_decode|urldecode)\s*\(\s*){2,}\$\w{1,40}[\)\s]+;(?:\s*(?:exit|die)\b[^;]{0,9};)?(?<X1134981>)|[mb](?:essage|sg|ilsmsg)(?:\h*\.?\h*=\h*['"]\W{0,20}thanks\h+to\h+cybermonk\b(?<X2140711>)|\s*\.\s*=\s*['"]\W{0,20}C[o0]d[e3]d\s*by\s*D[a4]n\b(?<X2137731>))|[mbf](?:(?:essage|ilsmg|e?sg|[uc]{2}k)\h*\.\h*=\h*['"][^'";]{5,40}\bDr\.Spam[^'";]{5,40}\\n['"];(?<X2162861>)|(?:essage|sg|ilsmg|f[uc]{2}k)\h*\.=\h*['"]\W{5,20}\bVictim\h*Information\W{5,20}[^;]{0,5}\\n['"];(?<X2169990>)|(?:essage|sg|ilsms?g|[cu]{2}k)\h*\.?\h*=\h*['"][^\$]{2,40}\$p(?:assword|asswd|wd|sw)[^;]{0,30}\\n['"];[^\{\}]{9,200}\bmail\([^\?>\}]{99,300};\s*(?:else\h+if\(\$\w{1,20}\W{1,9}['"](?:hotmail|vip|gmail|yahoo|1[632]{2}|naver|aol|rediff)['"]\)[^\(]{2,40}){2}(?<X2159040>)|(?:essage|sg|ilsmsg|[cu]{2}k)\h*\.?\h*=\h*['"]\W{0,20}\bLogin\h+Infos?\h+by\h+Metri\b(?<X2158971>))|[md](?:essage|ata)\h*\.\h*=[^\(]{9,150}\$subject\h*=\h*['"](?:Ned|chase|scotia)\h*bank\b(?<X2155322>)|[O0_]+\s*=\s*urldecode[\(\s'"]+%[\d%a-f]{40,}['"][\s\);@]+header\s*\([^\)]+\)\s*;\s*\$[O0_]+\s*=\s*['"][^'"]+['"]\s*;\s*date_default_timezone_set[\(\s]+\$[O0_]+\{\d+\}(?:\s*\.\s*\$[O0_]+\{\d+\})+[\s\)]+;[^\*\n]{999,}\bor\s*(?:die|exit)\b[^;]{0,19};[\s\}]+(\$\w{1,40})[\s=]+fwrite\b[^\}]{9,99}\breturn\s*\77[;\s]*\}(?<X1214950>)|[V_FP]{4,12}\s*=\s*['"]\d+['"]\s*;\s*(\$[V_FP]{1,12})\s*=\s*['"][^;]{39,};\s*\$[V_FP]{4,12}\s*=\s*\79\s*\[\d+\]\s*\.\s*\79[^\n@]{99,}\$[V_FP]{4,12}\s*=\s*@\s*\$\s*\{[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\};]+\$\s*\{\s*['"][^'"]+['"]\s*\}\s*\[\s*['"][^'"]+['"]\s*\][\(\)\s]+;(?<X1251850>)|[xr]?sh[e3]ll_?(?:n[a4]me|v[e3]rsi[o0]n)\d*=[^\(]{1,99}\beval\h*\((?<X2170010>)|\$(?:\w{1,40}\h*=\h*@?RandAbcs\h*\(\h*\)\h*;\s*\$strRand\h*\[\d+\]\h*=\h*['"][a-z\d]{8,64}['"]\h*;[^\}]{999,9999}\bfile_exists\h*\([^;]+\bwp\-config\.php\b(?<X2179951>)|wp\w{1,40}=\$\w{1,40};[^\?@\{#%&:/\|\+\*]{1,499}\bif\((?:!\()?(isset\()\$\w{1,40}\)[^\{\}\?;]{1,199}\{header\(['"]HTTP/\d\.\d\h+40[34]\b[^\}]{1,199}\}(if\((?:!\()?\83\$\w{1,40}\))[^\{;]{1,99}\$(\w{1,40})\)+\{if\(file_exists\(\$\85\)+\{echo\b[^;]{1,99};\}\}\84[^\{;]{1,99}\{echo\b[^;]{1,99};\}(?<X2177163>))|\(cat\s+\w{1,9}\.txt\s*\|\s*sort\s+-R\s*\|\s*head[^\)]+\)\s*ngecek_email\(\)\s*\{[^\(]{0,20}local\s+jsessionid\s*=\s*\$\(curl[^:]{1,15}https?://ams\.apple\.com/pages/SignUp\.jsf(?<X2118720>)|\h*\w{1,9}\h*=\h*(\$\h*\w{2,9});[^\[]{1,49}(\$\h*\w{1,9})\h*=\h*\$\h*_[GPRSC]\w{2,6}[^;]+;\s*file_put_contents\h*\(\h*['"]htaccess['"],\h*\89,\h*FILE_APPEND\);[^\?]{99,8499}\(\h*['"/]+\.\88\.[^\.]+(?:wp\-config|configuration)\.php[^;]{1,99};(?<X2188770>))
\$(?:\s*\{\s*['"][^'"]{1,40}['"]\s*\}\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*=\s*[^`]{1300,1600}\]\}\);\}catch\(Exception\$e\)\{\}echo\$\w{1,40};define\(\s*['"][^'"]{1,40}['"]\s*,\s*['"][^'"]{1,4}['"]\);\}(?<X1042070>)|\w+(?:=(?:'';\s*(\$\w+)[\s=]+pack\(['"]H\*["'][^;]{1,69};(\$\w+)[\s=]+pack\(['"]H\*["'][^;]{1,159};if\(isset\(\$_POST\[\3\]\)\)\{\3=pack\(['"]H\*["'][^&]{1,499}&&function_exists\(\$\w+\)&&function_exists\(\2\)\)\s*\{(\$\w+)[^\}]{1,119}\2\(\4[^\}]{1,29}\}\}(?:exit|die);\}(?<X120355022>)|(str_rot13)\(['"]uggc://[^/]+\.arg/['"]\);(\$\w+)=\6[^\$]{1,99}\$_SERVER\[[^>]{1,399}['"]https?['"][^>]{1,99}http_build_query\(array\(\6[^\{]{1,199}function_exists\(['"]curl\w+['"]\)[^\.]{1,599}strpos\([^\}]{1,199}script\s+src=['"]['"]\.\7[^\(]{1,99}exit;[^\.]{1,29}unset\([^;]{1,49}\7[^\)]{1,49}\);(?<X120370090>)|['"](?:[^'"]{0,299}['"];\$\w+=['"]\.htaccess['"];(\$\w+)=__FILE__;\$\w+=realpath\(dirname\(\9\)+;[^@]{1,3999}\bfunction[\sw+]+\w+\((\$\w+),(\$\w+)\)\{(unlink\(\10\);)chmod\(\10,\d+\);\12file_put_contents\(\10,\11\);chmod\(\10,\d+\);usleep\(\d+\);[^\n\?]{199,599}/html>['"];\s*exit;\}\h*echo\h*\$_SERVER\[[^\]]+\];(?<X1316352>)|[^'"]{200,}['"];\$\w+=hex2bin\(\$\w+\);eval\(['"]\?>['"]\.\$\w+\);\Z(?<X1319081>)|\w+[^\(]{1,99}(\$\w+)=['"]http['"];if[^\$]{1,49}(\$\w+)=['"]https['"];\}else\{\16[^@]{1,199}\$_SERVER[^@]{1,699}(extension_loaded\(['"]zlib['"])[^\.]{1,49}urlencode[^\?]{1,99}function[^@]{1,399}file_Get_contents[^\?]{1,49}\17[^/]{1,99}\15[^@]{1,499}str_replace[^\?]{1,499}(\$\w+)\);header[^;]{1,49}\18\);exit;\}\}\}\}\}\}(?<X120363020>)|bnWF4jv6[^'"]+['"];function\s+(\w+)\((\w+)(\$\w+)\){\22[^\{]{1,99}\22_\w+=str_replace[^@]{1,199}CryptoCore\{[^@]{1,299}\21(\$\w+)[^;]{1,99}\20\(\23\)[^\[]{1,499}\[\];foreach\(\22[^\(]{1,99}implode[^/]{1,399}\23,true\);eval\(['"]..['"]\.\$\w+\);\}catch\(\w+\$\w+\)\{\}(?<X120350380>)|er['"]\.['"]ror['"]\.['"]_r['"]\.['"]epor['"]\.['"]ti[^\$]{1,29}\$\w+[^=]{1,29}(\$\w+)=[^=]{1,29}(\$\w+)[^;]{1,49};(\$\w+)[^\(]{1,29}eval\(\25\(\26\(\27\(['"]FZW1EuvYFkQ[^'"]+NurOX//77/7\+Pw==['"]\)\)\)\);(?<X120346860>)|https?(?:://[^/'"]+\.xyz[/'"](?:[^\}]+\bheader\(['"]Content\-type[\h:]+(?:application|text)/(?:ht|x)ml;[^\)]+\);\}){3,}echo\s+\w+\([^,\)]+,\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*(?:\?>)?\Z(?<X2200522>)|['"];\$\w+=['"][^;]+;\$\w+=['"]/\w+\.txt['"];[^\}]+(\}break;case)\s*['"]curl[^\}]+\30\s*['"]stream[^\}]+\}break;(return\s*\w+;)\}\31\}\$\w+=array\(['"]file_get_contents([\s,'"]+)curl\32stream['"]\);\$\w+=false;[^?]{1,256}\{eval\(['"]\?>['"]\.\$\w+\);\}else\{echo\s*['"][^;]+;\}(?<X1314390>))|O['"];\$\w+=['"]K['"];\$\w+=['"]_['"];\$\w+=['"]co['"];\$\w+=['"]ase['"];[^\(]{1,499}\(['"]['"],array\(\$\w+,\$\w+\(\d+\),\$\w+,[^\}]{1,499}\$wrj8fj\(\$\w+\);echo\s+['"]jj['"];\}if\(\$n1o\[['"]\w+['"]\]\)\{echo\s*['"]bb['"];\}(?<X1322340>))|base64_decode\((?:['"]JHJlcV91cmkg[^'"]{999,}c2VyX2NvbnQ7CglleGl0KCk7Cn0=['"],true\);(?<X1309200>)|[^;]+;header\(['"]Content\-type:text/html;[^\)]+\);error_reporting\((?:0|NULL|false)\);[^#]{9999,}=['"]https?://www\.google\.co(?:m|\.(?:in|jp))/webmasters/(sitemap)s/ping\?\36=[^#]{999,}\bunset[\s\(]+(?:\$\w+[\s,]+){4,}\$\w+[\s\)]+;\s*@?(?:exit|die)\b[^;]*;[^\n\w\$]+\$[^\(;\?>]+\(\);(?<X1206160>)))|['"\s=]+['"]admin_['"]\s*\.\s*(\$rand)[^\}]{1,99}\38\s*\.\s*['"]@wp\-\w+\.local['"];[^@]{1,999}\$api_user\-[^@]{1,999}@file_put_contents\b(?<X220359720>)|[=\s]+['"]https?://[^;]{1,999}\.txt['"];\s*(\$\w+)[^\{]{1,199}\(\40\);\s*if\s*\((\$\w+)[^\{]{1,99}\{\s*eval\s*\(['"]\?>['"]\s*\.\s*\41\);\s*\}(?<X120349200>)|[\.=\s]+['"]victim\s+IP:[^\}]{1,999}\w+\.txt['"][^\}]+header\(['"]location:\s*https://account\.juno\.com/(?<X220340500>)|[\h=]+(?:['"](?:https?://(?:(?:[\w\-]+\.)?acidpoll\.top/[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);[^\?]{9,150}(\$\w+)[\h=]+\45exec[\h\(]+\44[\h\)]+;\s*\45close[\h\(]+\44[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\46[\h\)]+;(?<X120350890>)|[^;]+;\s*function\h*(\w+)\h*\([^#]{99,3500}\bif[\h\(]+strpos\b[^\{]+\{\s*(\$\w+)[\h=]+[^;]+;\s*(\$\w+)\[['"]main_shell['"]\][\h=]+\49;[^\^]{99,999}\bif[\h\(][^\{]+\{\s*\50\[['"]http_user_agent['"]\][\h=]+\$\w+;\s*(\$\w+)[\h=]+\48[\h\(]+\$\w+,\h*\50\);\s*echo\h*\51;\s*exit;(?:\s*\})?(?<X120348881>))|Mozilla[^'"]+['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\54setopt[\h\(]+\53,[^,]+,\h*['"]https?://vivapasarantogel\.com/[^'"]+\.js['"][\h\)]+;[^\?]{99,300}(\$\w+)[\h=]+\54exec[\h\(]+\53[\h\)]+;\s*\54close[\h\(]+\53[\h\)]+;\s*echo\h*\55;(?<X1235660>)|zip://(\w+)#\57['"];(?<X120344810>))|\[['"]compr['"],['"]ess\.zlib:/['"],['"/s\.g,z]+\];(?<X120344801>))))
\$(?:\w+(?:[\s=]+(?:@?(?:eval[\s\(]+base64_decode[\s\(]+['"]ZnVuY3Rpb24[^'"]+Ly9teW9wZW5jYXJ0Lm5ldC9[^'"]+['"](?:\s*\)){2}\s*;(?<X1206540>)|file_get_contents\(base64_decode\(['"]aHR0cHM6Ly9sb2dvcy50b3BpbWFnZS5jZ[^'"]{1,99}['"]\)\)[^%]{1,99}require\s+__DIR__\s*\.\s*['"]/\w+\.php['"];\s*if\(class_exists\(['"](\w+)['"][\s\)\{]+new\h*\2\(['"]/\?\w+=[^\)]+\);\s*\}(?<X120361331>))|['"](?:(\w)['"];\s*\$\w+[\s=]+['"]\4[^;]+;\s*(?:\$\w+[\s=]+\$_[GPCSR]\w{2,6};\s*){2}(\$\w+)[\s=]+implode\s*\([^\}\{]{1,499}(?:\{[^\}\{]{1,499}){2}\binclude(?:_once)?\b[^;]{0,49}\5\s*\([^;]+;\s*\}\s*else\s*\{\s*(\$\w+)[\s=]+@?\5\s*\([^;]+;\s*(\$\w+)[\s=]+\6\s*\([^;]+;\s*@?\7[\s\(]+\);\s*(?:\}\s*){2}(?<X1220550>)|[^'"]{1,99}['"];\s*\$\w+[\s=]+['"]https?://(?:www\.)?glasbiltinteriors\.com[^'"]{1,199}['"];\s*\$\w+[\s=]+['"]https?://[^'"]{1,199}['"];\s*(\$\w+)[\s=]+<<<(EOD)[^%]{1,1199}\10;\s*echo\s*\9;(?<X120356680>)|https?://[^'"]+\.txt['"];(?:[^;]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);[^\(]{1,49}\13\w+\(\12[^\?]{1,249}(\$\w+)[\s=]+\13\w+\(\12\);[^\{]{1,49}if\(\13\w+\(\12\)\)\{\s*echo\s*['"]Request\s+Error:\s*'\s*\.\s*\13\w+\(\12\);\s*\}\s*\13\w+\(\12\);[^;]{1,49}echo\s+\14;(?<X120356550>)|\s*(\$\w+)[\s=]+(curl)\w+\((?:[^\(]{1,49}\17\w+\(\16[^=]{1,299}(\$\w+)[\s=]+\17\w+\(\16[^:]{1,49}echo\s*['"][^\?]{1,49}eval\(['"]\?>['"]\s*\.\s*\18\);\s*\}\s*\17\w+\(\16\);(?<X120361640>)|\);\s*\17\w+\(\16[^=]{1,99}(\$\w+)[\s=]+\17\w+\(\16[^\{]{1,49}\20[^;]{1,49}echo[^\?]{1,149}is_string\(\20[^;]{1,99}ob_start[^\?]{1,99}eval\(['"]\?>['"]\.\20[^\?]{1,249}\}\s*\17\w+\(\16\);(?<X120352300>))))|\$_SE(?:RVER\[(?:'HTTP_USER_AGENT'[^\}]{1,199}stripos\(\$\w+,\s*['"]Googlebot['"][^\}]{1,199}\$\w+[\s=]+['"]https?://[^\.]+\.pages\.dev[^'"]{1,299}\.txt['"][^\}]{1,199}stream_context_create[^\}]{1,199}@file_get_contents\(\$\w+[^\}]{1,199}echo\s+\$\w+;\s*exit;\s*\}\s*\}(?<X120355681>)|['"]\w+['"]\];\s*if\s*\(strpos\(\$\w+\s*,\s*['"]Googlebot['"][^%]{1,199}header\(['"]Location:\s*https?://movingtransferandstorage\.com[^'"]{1,99}['"],\s*true\s*,\s*301\);\s*exit\(\);\s*\}(?<X120362120>)|['"]HTTP_USER_AGENT[^\.]{1,99}(\$\w+)\s*=\s*\[[^\|]{1,499}preg_match[^;]{1,99}implode[^\.]{1,49}\24\)[^\{]{1,49}\$_SERVER\[['"][^\.]{1,49}(?:include|require)\s+__DIR__\s*\.\s*['"][^'"]+\.php['"];\s*exit;\s*\}(?<X120364992>))|SSION\[['"]tan['"]\][^\}]{1,999}by\s+fsociety\b(?<X220341430>))|A(?:BSPATH\s*\.\s*['"]wp\-admin/[\w-]+\.txt['"];\s*\w+\s*\(!file_exists(?<X220369320>)|rray(?:\(\s*(?:['"](?:exec|eval)['"]\s*[\=>\s]+\[['"](?:system|exec|shell_exec|eval)['"][^%]{1,99}\],\s*){2}[^%]+<title>File\s*Manager\s*\-\s*@?\w+ROOT\-WORDPRESS</title>(?<X220360540>)|_merge[\s\(]+(?:\$_[GPSRC]\w{2,6}[,\s\)]+){2,};\s*(\$\w+)[\s=]+['"][^'"]+['"];\s*(\$\w+)[\s=]+strtoupper[\s\(]+['"]HTTP_['"][\s\.]+\29[\s\)]+;\s*define\s*\([^,;]+,\s*\30\b[^\}]{1,999}\bfwrite[\s\(]+\30\b[^\}]{1,199}\bfclose[\s\(]+\30[\s\)]+;[\s\}]+return\s+\30;(?<X1213660>)))|base64_decode(?:['"\s\(]+JHJlcV91cmkg[^\)]{999,9999}b250KCRpbmRhdGExLCAkZGF0YTEpOwoJZWNobyAkc2VyX2NvbnQ7CglleGl0KCk7Cn0=['"\s,]+1\);(?<X1288270>)|\(['"]aHR0c[^'"]+['"]\);\s*(\$\w+)[\s=]+curl_init\(\);\s*\w+\(\33,\s*array\([^\)]{1,199}\)\);\s*(\$\w+)[=\s]+curl_exec\(\33\);\s*\w+\(\33\);\s*\$\w+[\s=]+\w+\(sys_get_temp_dir[^\}]{1,99}file_put_contents\((\$\w+),\s*\34\);\s*(?:include|require)(?:_once)?\(\35\);[^\}]{1,32}\{\s*exit;\s*\}(?<X120341150>)|\(['"]PD9[^'"]{999,}['"]\);\$\w+[=\s]+\$_SERVER[^\.]+\.[\s/'"]+index\.php['"];[^\}]+(?:\};[^'"]+strtotime\(['"]\-\d+[^\}]+0444\);sleep\(\d+\);\}(?<X1320381>)|file_put_contents\(\$\w+,\s*\$\w+\);@?chmod\(\$\w+,\s*0444\);sleep\(\d+\);\}(?<X1320401>))|\(['"]QHNldF90a[^'"]+DkgKi8=['"],\s*true\);(?<X120357020>))|file_get_contents\(base64_decode\(['"]aHR0cHM6[^'"]+lbnQudHh0['"]\)\);(?<X120356380>)|json_encode\([^\}]{1,999}https?://[^'"]+\.icu/\w['"][^\{]{1,99}\{\s*\$\w+[\s=]+wp_remote_post\((?<X220361890>)|md5\(['"]\w+['"\.\s]+\w+\(\)\);\s*(\$\w+)[\s=]+str_rot13\(['"]uggcf://[^;]+;\s*(\$\w+)[\s='"]+;\s*\w+\s*\(\w+\(['"]\w*['"]\)\)\s*\{\s*\$\w+\s*=\s*curl_init\(str_rot13\(\42\)\);[^\}]+\43[\s=]+curl_exec[^\}]+\}\s*\w+\(\43\)[^;]+\43\);(?<X120366083>)|shell_exec\(['"]bash\s*\./[^'"]{1,99}\.sh['"]\);\s*ini_set\(['"]max_execution_time['"],\s*\d+\);\s*echo\s*shell_exec\([^\)]{1,99}\);(?<X120363551>)|wp_mail\(\s*(\$\w+)\[['"](email)\w+['"]\],\s*\46\[['"]\47\w+['"]\],\s*\46\[['"]\47\w+['"]\],\s*\$\w+\s*\.\s*\$\w+\s*\);\s*\$\w+[\s=]+['"]s['"]\.['"]t['"]\.['"]r['"]\.['"]_['"]\.['"]rot13['"];\s*\$\w+[\s=]+['"]bas['"]\.['"]e64['"]\.['"]_decod['"]\.['"]e['"];\s*error_reporting\(0\);(?<X120357091>))|[^;]{1,49}['"](\w+)['"]\s*error_reporting\(0\);[^!]{1,299}['"]https?://[^'"]+['"]\);[^@]{1,199}function_exists\(['"](\w+)['"][^@]{1,99}(mkdir)[^#]{1,599}\.php['"]\)[^@]{1,999}\51[^@]{1,129}base64_decode[^@]{1,249}file_put_contents[^>]{1,399}\50[^\?]{1,2399}\$_SERVER[^%]{99,4099}\49;\s*eval\(\$\w+\);(?<X120349282>)|\(\$\w+,\s*['"]<\?php\\nclass\s+(\w+)\s*\{\};\\n\$\w+\(['"]\$\w+['"]\s*\.\s*['"]/\53\.[\w\-]+\.jgz['"]\);\\n\$\w+\\n\?>['"]\);\s*\$\w+\(\$\w+\);\s*\$\w+=new\s*\53\(\);(?<X220365221>)|\->(?:executeAndBreak\(\);\s*\?>.{1,3999}<title>[^<]{0,99}\bcasino\b(?<X220359190>)|set_role\s*\(['"]administrator['"][^,]{1,199},\s*\d+\);\s*add_action\s*\(['"]wp_footer['"],\s*function\s*\(\)\s*\{\s*echo\s*['"]<!\-{2}\s*mu\-auto\s*\-{2}>['"];\s*\$\w+[\s=]+\[['"]aHR0c(?<X220348002>))|\s*=\s*(?:"\w+"\s*;\s*\$\w+\s*=(?:(?:\s*\$\w+\[\d+\]\s*\.?){3,};\s*\$\w+\s*=\s*\$\w+\s*\((?:\s*\$\w+\[\d+\]\s*\.?){3,}\)\s*;.+?eval\s*\(\s*\$\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*;\s*\}(?<X1035571>)|\s*strtolower\s*\((?:\s*\$\w+\[\s*\d+\s*\]\s*\.?)+\)\s*;.+?eval\s*\(\s*\$\w+\s*\w+\s*\(\s*\$\s*\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*\)\s*;\s*\}(?<X1035561>))|@?include_once\(sys_get_temp_dir\(\)\.['"]/database\.conf['"]\);(?<X120347230>)|['"]aHR0cHM6Ly9ibGFja3NhbHR5cy5jb20[^'"]+['"];\s*wp_register_script\b(?<X2266300>)|['"]https?://blacksaltys\.com[^'"]{1,99}['"];\s*wp_register_script\([^\;]+;\s*wp_enqueue_script\((?<X2279270>)|\w+\(\$\w+,\s*['"]INSERT\s+INTO\s+\140[^\{]{1,199}a:1:\{s:13:\\?"administrator\\?";s:1:\\?"1\\?";\}['"]\)['"]\);[^\}]{1,199}(\$\w+)[\s*=]+\w+\(['"]\w+\.txt['"],['"\s*\w+]+\);\s*\w+\(\62,\s*\$\w+\);\s*\w+\(\62\);(?<X220370161>)|new\s*\w+['"\s\(]+1337r0j4n\b(?<X2288091>))|\s+=\s+file_get_contents\(['"]\./\w+['"]\);\s+(\$\w+)\s+=\s+base64_decode\(\65\);\s+file_put_contents\(['"](/tmp/\w+)['"],\65\);\s+(\$\w+)\s+=\s+['"]\66['"];\s+(?:inlude|require)(?:_once)?/\*\w+\*/\(\67\);\s+unlink\(\67\)(?<X120339721>))|\w[\s=]+geturlsinfo\(['"]https?://\d+\.\d+\.\d+\.\d+/[^\}]+unlink\(\$\w+\);[^;]+['"]gagal\s*\w+[^;]+;\s*\}\s*(?:\?>|\Z)(?<X220341860>)|\w{0,9}name\h*=\h*['"](Cazanova)[^'"]{1,40}['"]\h*;[^\}\[]{9,99}\{if\(isset\(\$_[GPRSC]\w{2,6}\[['"]?\70\d*['"]?\](?<X2153240>)|\w{1,10}\s*=\s*(?:\$\w{1,10}\s*\+\s*1;\s*\$txtspamed\s*=\s*['"]\w{1,40}['"];\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\{(?<X2055672>)|Array\s*\(\s*str_rot13\s*\([^;]+;\s*\$\w{1,40}\s*=\s*Array\s*\([^;]+;\s*@\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038140>))|\w{1,12}\s*(?:=\s*call_user_func\s*\(\s*function\(\$\w{1,40}\)\s*\{\s*return\s+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*\}\s*,['"][^'"]*['"]\);\s*@?eval\s*(?:/[^\/\)]{0,40}/)?\(\s*(?:/[^\/\)]{0,40}/)?\(\s*(?:/[^\/\)]{0,40}/)?\$\w{1,40}(?:/[^\/\)]{0,40}/)?\s*\)(?:/[^\/\)]{0,40}/)?\s*\)(?:/[^\/;]{0,40}/)?\s*;(?<X1126260>)|\.\s*=\s*['"][^'"]{0,20}Social\s+Security[^'"]{0,20}\s*['"]\s*\.?\s*\$_POST\s*\[\s*['"]ssn['"]\s*\]\s*\.\s*[^;]{1,40}\s*;(?<X2054810>)))
\$(?:\w{1,14}(?:=(?:["'](\w{1,14})['"];\s*\$\w{1,14}=["']\1['"];\s*\$\w{1,14}=['"][0-9a-f]{1,100}['"];\s*function\s\w{1,14}\((\$\w{1,14})\)[^@]{1,150}chr\(\w{1,14}\(\2\[(\$\w{1,14})\][\s\.]+\2\[\3\+1\][^@]{1,100}function\s(\w{1,30})\(\$\w{1,14}\)[^@]{1,800}\$\1=\4[^@]{1,500}eval\(['"\?>\.]+\$\1\);\s*echo[\s'"]+;(?<X1322660>)|explode\(['"]\w+[\'",]+\w{99,}['"]\);\s*foreach\(\$\w+\s*as\$\w+[^%]{1,999}\$GLOBALS\[["']\w+['"][^\n]{1,3999}foreach\(\$(\w+)\s*as\$[^\n]{999,9999},['"]\\xef\\xbb\\xbf['"]\){2};\}\6\(\);(?<X12909910>))|[=\s]+\[['"](?:bot|ahrefs|google)['"][^/]{1,200}if\(\$_SERVER\[['"]REQUEST_URI['"]\][\s=]+['"]/['"][\)\{\s]+(\$\w{1,13})[^$]{1,20}\$_SERVER\[['"]HTTP_USER_AGENT[^$]{1,20}strpos\(\8[\s,]+\$\w{1,14}[\)\s]or\s*\$\w{1,14}[^\{]{1,100}\{\s*include\(['"]/home/[^'"]{1,40}['"]\);\s*die\(\);[\s\}]+\}(?<X1321560>)|[\s=]+strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^@]{1,1000}file_get_contents\(['"]https?://(?:ipwho\.is|ip\-api\.com)[^@]{1,1000}\.b\-cdn\.net[^\}]{1,400}echo\s*\$\w{1,14};\s*exit;\s*\}\s*\}(?<X1319323>)|\h*=\h*['"]7642425930:AAHff6b6zLsxSBhj9VxSwwbDsOsoNcI7N14['"];[^'"]{1,50}\$\w{1,14}\h*=\h*['"]\d+['"];(?<X2282162>)|\s*(?:=\s*filemtime\(['"]wp-config\.php[^\}]{1,250}\}[^\?]{1,400}\$\w{1,14}\s*=\s*['"]wp-content/uploads/wp['"][^<]{1,1650}\$\w{1,14}\s*=\s*['"]wp_frmfunct['"];[^\}]{1,120}substr\(pack\(['"]H\*['"],(?<X2285670>)|\/\*\s*\w{1,14}\s*\*\/\s*=\s*\/\*\s*\w{1,14}\s*\*\/\s*['"]?\d{1,5}['"]?;(?!/)(?<X2265102>)))|\w{1,15}(?:\h*=\h*(?:['"](?:[^\$]{9,150}(\$\w{1,15})\h*=\h*['"]/tmp/sess_[^\{]{9,99}function\h*(\w{1,9}\(\))\h*\{\s*\$\w{1,9}\h*=\h*@?file_get_contents\([^\?]{99,300}echo\h*['"]<script>window\.location[^\{]{9,99}if\(file_exists\(\14\)\)\h*\{[^\?]{9,150}else\h*\{\s*\15;\s*\}(?<X1138963>)|Shell\h*with\h*Exploit\h*by[^\(]{9,250}@?mail(?<X2140910>))|getenv\h*\(['"]REMOTE_ADDR['"]\);[^\?]{1,450}\bsubject\h*=\h*[""]Keylogger\h+Wordpress[^;]{0,40};\s*mail\h*\(\h*\$\w{1,15}[^\)]{1,40}\);(?<X1163692>))|\s*=\s*['"][^'"]{1,99}['"][^\(]{9,40}foreach\(\[(?:\d{1,3},?){4}\]\s*as\s*(\$\w{1,15})\)\{[^\}]{9,50}\}\s*if\(isset\(\$(REQUEST)[^\{]{9,200}\{\s*(\$\w{1,15})\s*=\s*\$_\20[^\?]{99,999}\19\s*=\s*\$\w{1,15}\(['"\.creat_funio]{20,}\);\s*\$\w{1,15}\s*=\s*\19\(['"]{2},\s*\$\w{1,15}\(\21\)\);\s*\}(?<X1134811>)))
\$\w{1,20}(?:=(?:['"](?:defe?xploit\w{2,15}\.com['"];\$x.?path=['"]http://(?<X2179490>)|Hacked\h+by\b[^\{]{20,200}\{\s*(\$\w{1,20})=curl_init\(['"]https?://(?:www\.)zone\-h\.com/[^=\}&]{20,150}\bcurl_setopt\(\2,curlopt_postfields,['"]defacer=\$(?<X2195430>)|xsec(?:shell|team)['"];\$\{['"]GLOBALS\b(?<X2146870>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\([^\$]{0,20}\$\w{1,20}[^/]{9,300}\bhttps://github\.com/[^/]{9,300}<title>[^/]{0,9}(?:web\h*shell|backdoor)[^/]{0,9}</(?<X2217630>))|[\h=]+(?:['"]\.\w{1,20}['"];[^\(\)\{\}]{0,150}\$ransom(?:ware)?[\h=]+['"](?<X2194110>)|[^;]{9,60}\.(?:php|htaccess)['"];\s*(?:\$bk(?:index|ht)[\h=]+[^;]{9,60}\.(?:png|ico|jpe?g|gif|tiff)['"];\s*){2,}(?:if\((\$\w{1,20})[^\{]{9,40}\)[\s\{]+if\([^\{]{9,99}\)[\{\s]+@?chmod\(\7,\d+\);\s*@?(file_)pu(t_contents)\(\7,\8ge\9\(\$bk\w{1,20}\)\);\s*@?chmod\(\7,\d+\);[\s\}]+){1,4}(?<X1210600>)|getcwd\(\);\s*\$\w{1,20}[\h=]+explode\h*\([^\?><#]{50,150}(\$\w{1,20})[\h=]+fopen\h*\([^,]{2,30}/(?:\.cpanel|\$?user)/(?:contactinfo|.contactemail)['"]\h*,\h*['"]w+?['"]\);\s*fwrite\h*\(\11[\h,]+\$\w{1,20}\);[^\?\{#]{0,90}\bfclose\h*\(\11\);(?<X1190550>))|\[[^\]]+\]\s*=\s*['"]Xgr[0o]upVn\s*[5S]h[e3][l1]{2}\b(?<X2127110>)|\h*(?:=\h*(?:(?:getenv|\$_SERVER)(?:\(|\[)['"]?REMOTE_ADDR['"]?(?:\)|\]);\s*\$subject\h*=\h*['"]Apple\h*(?:Account)?\s*(?:info(?:rmation)?|details?|login)\b(?<X2138760>)|(\$_SERVER\[['"]DOCUMENT_ROOT['"]\])\.['"]/upload/tmp\w/['"];\s*if\(!file_exists\([^\?@]{99,500}(\$\w{1,20})\h*=\h*\15;\s*\$\w{1,20}\h*=\h*['"]<\?(?:php|=)?\h*@?\binclude(?:_once)?\h*\(\h*['"]['"]?\.\16\.['"]/bitrix/images/iblock/ib\.\w{2,4}['"]\h*\)\h*;[^@!&%]{99,500}include_once\([^\)]+\);(?<X1163325>)|@\$_POST\[['"]recipient['"]\];[^\*\+`]{300,15000}>\s*&copy;\h*Scotia\h*Bank\h*Canada\h*(?:202\d\s*)?<(?<X2169760>)|['"](?:alcustomer19814|preciousdestinyontheway|jbroughton49)@(?:gmail|usa)\.com\b(?<X2167751>)|['"]1nb0x[l1i]\w{1,3}\b[^#%&\*]{99,400}\becho\h+["']b[1i]tch(?<X2184290>)|['"]<html>\s*<head>\s*<title>\h*Rz[l1][3e]{2}[7t]</(?<X2154430>)|['"]?<<<EOD[^\.@/;]{9,200}\W{1,4}\h*FUD\h*Scripts\b[^;@#&%]{1,40}\b(?:ICQ|Jabber|Skype)\b(?<X2192060>)|['"][^'";]{0,30}\balcustomer19814@gmail\.com\b(?<X2175730>)|['"][^'";]{5,40}['"];\s*(\$\w{1,20})\h*=\h*['"];\)[^';"]{1,99}\bynir['"];\s*(\$\w{1,20})\h*=\h*strrev\h*\(\h*\24\h*\);\s*(\$\w{1,20})\h*=\h*str_rot13\h*\(\h*\25\h*\);\s*@?eval\h*\(\h*\26\h*\);(?<X1187631>)|['"][^'"]{9,99}['"];\s*(\$\w{1,20})\h*=\h*['"];[\)]{3}\w{1,20}\$\((?:\w{1,20}\()+\w{1,20}['"];\s*(\$\w{1,20})\h*=\h*strrev\h*\(\28\);\s*\29\h*=\h*str_rot13\h*\([^\)]+\);\s*@?eval\h*\(\29\);(?<X1185660>)|['"][^'"]{9,99}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2156050>)|['"][^\$]{1,30}<(method)call>\s*<(\32name)>\s*wp\.getUsersBlogs\s*</\33>\s*<params>\s*(?:<(param)>\s*<(value)>\s*<string>['"]\.htmlspecialchars\((?:\$user|\$username|\$pass|\$password)\)\.['"]</string></\35>\s*</\34>\s*){2}(?<X2149970>)|['"][^\$]{9,99}\$(?:email|user|login|username|uname)\b[^\$]{2,30}\$(?:password|pass|pwd|passwd)\b[^\(]{9,200}\bmail\([^\)]+\);\s*\?>\s*<meta\h+http-equiv\h*=\h*['"]Refresh['"]\h+content\h*=\h*['"]0;(?<X2158900>)|['"][Filesma?n\.'"]{10,20};[^\}]{99,999}\}\s*if\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*\$_[GPRSC]\w{2,6}\b(?<X2145930>)|['"]\W{1,30}\bIndramayu\h*Cyber\W{1,30}['"];(?<X2159650>)|['"]Amazone\h+billing[^'"]{0,9}spyus\b(?<X2140383>)|['"]cardservices@natwest\.co\.uk['"];(?<X2172430>)|['"]cmd\.exe['"];\s*//\W{0,20}\bphpspy\b(?<X2158290>)|['"]From:(?:[^<]{2,20}<\w{1,20}@spyus\.org>(?<X2173020>)|[^@]{3,30}@sidshell\.com['"];(?<X2143030>)|\h*Paypal\h+RZLT\h*<paypal@support\.com\b(?<X2141560>))|['"]kefiex63@gmail\.com['"];(?<X2175140>)|['"]lanadelraa@yahoo\.com['"];(?<X2140010>)|['"]logmx2013@gmail\.com['"];(?<X2163090>)|['"]magatrust-3D@server\d\.cn['"];(?<X2150290>)|['"]moban['"];[^\{]{9,99}\bget\h*\(\$url\h*,\h*(\$dir)\);\s*if\h*\(file_exists\h*\(\50\)(?<X2181490>)|['"]Office\h*365['"];\s*(?:\$\w{1,20}\h*=\h*\$_POST\[['"](?:login|u[ser]{0,3}name|pass[wor]{0,3}d)['"]\];\s*){2}(?<X2140450>)|['"]UPDATE\h[^=\\]{9,99}\bset\h+(\w{1,20})\h*=\h*CONCAT\(\53\h*,\h*\\['"]<(script)[^>]{1,150}src\h*=\h*["']https?://[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml)/\w{1,20}\.js\?\w=[a-z]{2,3}\d['"][^>]{1,150}>\s*</\54>\\['"]\)[^\?]{9,300}\bfunction\h+search_\w{1,20}\((?<X2164210>)|[fch][tiu](?:le_get_contents|rl_init|tp_request)\(['"]https?://api\.indoxploit\.(?<X2139092>)|\$_GET\[['"](?:email|username)['"]\];\s*\$\w{1,20}\h*=\h*\$_GET\[['"](?:password|passwd|pass|pwd)['"]\];[^\{]{9,99}\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\(]{9,99}\bfile_get_contents\(['"]https?://api\.db-ip\.[^;]{1,99};[^\$]{1,49}\$subject\h*=\h*['"]\s*Office365(?<X2142011>)|\$_POST\[['"]veio['"]\];(?<X2147252>)|\$_SERVER\[['"]REMOTE_ADDR['"]\];[^%\*\{]{20,400}\$\w{1,20}\h*=\h*array\((?:['"]\d{1,2}['"]=>['"].['"]\h*,?\h*){5}[^\)]{99,300}\);[^\?\\%]{99,999}\bmail\h*\([^\)]+\);\s*header\h*\(['"]Location:(?<X2149162>)|\$this->get\(['"]https?://api\.indoxploit\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw|or\.id)/bin/(?<X2158140>)|\176\h*s([^\w\s])\(\\\{mn\\\-fakeip\\\}\)\61\$ipinicial\61g;(?<X2168541>)|array\s*\(\s*(?:['"][\h\w\-\+]{0,30}(?:cialis|viagra|levitra|kamagra|priligy|propecia|lasix|amoxil|clomid|stromectol|vidalista)[\h\w\-\+]{0,30}['"],\s*){5}[^\?@]{4000,}(?:(\$\w{1,20})\[\d+\]=['"][^\$]+\.\$\w{1,20}\[[^;]+;\s*){20}[^\?@]{4000,}\$keywords?\h*=\h*\63\[\h*rand\((?<X2186630>)|file(?:\h*\(dirname\(__FILE+__\)\.['"]/pills\.txt['"]\);[^&#@]{999,3000}\bheader\h*\(\h*['"]Location\h*:\h*https?://[^;]{2,70}/\.\w{1,20}['"]\)\.['"]/\?\w{1,20}=(?:no_)?pill\b(?<X2183241>)|_get_contents\h*\(['"]https?://pastebin\.com/raw\.php\?i=PcrgRMTp['"]\);(?<X1186501>))|fopen\h*\(['"]b0x/b0x\.shtml\b(?<X2179570>)|new\h+phpsploit\(\);(?<X2187641>))|\.=\h*['"][^'"]{2,20}\b(?:log|result|full|detail)z['"];[^:/]{9,999}\bheader\h*\(\h*['"]Location:(?<X2170450>)|\.?\h*=\h*['"](?:\W{0,20}Yahoo\h*Scampage\b(?<X2140510>)|\W{1,30}\b(?:Created|phish|made)\h+by\h+(?:venza|jokamer)\b(?<X2143691>)|From:[^<]{2,20}<mailru@mailruphish\.com>(?<X2159130>)|Powered\h+by\b[^;"']{2,20}\bphpnuke\.ir\b(?<X2162401>))|\.\h*=\h*\$_POST\[['"]eMailAdd['"]\][^;]{0,9};[^\(]{9,99}\b(mail)\([^\)]+\);[^\$]{1,30}\b\74\([^\)]+[\)\h]+\s*\{\s*\?>\s*<(script)[^>]*>[^/]{9,99}window\.location\h*=\h*['"]\w{1,20}\.(?:php|html)['"];\s*</\75>(?<X2143310>)))
\$(?:\w{1,20}\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;[^@]{1,200}(?:(?:\$(?:message|msg|blismsg)\s*\.?=\.?[^\$]{1,40}\$_POST\[['"](?:email|pass)['"]\][^;]{1,80}\s*;\s*){2}[^/\?]{9,400}@?\bmail\([^\?]{9,99}\$\w{1,20}\s*=\s*fopen\(["'][^\.]+\.txt['"]\s*,\s*['"]a['"]\);(?<X2138051>)|\$\w{1,20}\h*=\h*['"](?:Yahoo|Office365|Hotmail|Gmail|Aol)['"];[^@]{1,200}(?:\$\w{1,40}\s*\.?=\.?[^\$]{1,40}\$_POST\[['"](?:passwd|oldpass)['"]\][^;]{1,80}\s*;\s*){2,}[^/]{9,400}@?\bmail\((?<X2138790>))|(?:getenv|\$_SERVER)(?:\(|\[)['"]?REMOTE_ADDR['"](?:\)|\]);[^%]{9,300}(?:\$(?:message|msg|bilsmsg|addss)\s*\.\s*=\s*['"](?:CARD(?:number|no)|cvv|exp|(?:atm)?pin)\b[^\.]{1,20}\.\$_POST\[[^;]{1,20};\s*){2,4}[^\/]{99,999}mail\((?<X2138420>)|(?:getenv|\$_SERVER)\h*(?:\(|\[)['"]REMOTE_ADDR['"](?:\)|\]);[^&]{9,400}(?:(?:\$(?:mess[ae]ge|msg|bilsmg|f[cua]{2}k)\s*\.\s*=\s*['"][^;]{1,150};\s*){2,}[^&#%\?]{0,1499}\bmail\h*\([^%\?!@]{9,1500}\b(?:header\h*\(['"]Location:|echo\s*['"](?:(?:<Script>\s*)?location\.(?:replace\(|href=)|<meta\s+http-equiv\h*=\h*['"]refresh))(?<X21360022>)|(?:\$(?:mess[ae]ge|msg|bilsmg|f[cua]{2}k)\s*\.\s*=\s*['"][^;]{1,150};\s*){2,}[^&#%\?]{0,1499}\btelegram_send\h*\([^%\?!@]{9,1500}\b(?:header\h*\(['"]Location:|echo\s*['"](?:(?:<Script>\s*)?location\.(?:replace\(|href=)|<meta\s+http-equiv\h*=\h*['"]refresh))(?<X2239490>))|(base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s]+;\s*\$\w{1,40}\h*=[^;]{0,99}\6[^;]{0,99};[^\}\{<>!\*,/:%&\^]{0,250}(\$\w{1,20})\s*=\s*(?:imap_)?mail\s*\([^;]{9,99}\);\s*if\s*\(\s*\7\s*\)\s*\{[^\}]{9,79}\}\s*else\s*\{\s*(?:echo|print)\s+['"][^'"]{1,16}['"]\s*\.\s*\7;\s*\}(?<X1064947>)|['"](?:\\x30|0)(?:\\x62|b)(?:\\x79|y)(?:\\x74|t)(?:\\x33|e|3)(?:\\x6d|m)(?:\\x31|1|i)(?:\\x6e|n)(?:\\x31|i|1)['"](?<X2063491>)|['"][^<]{9,60}<\s*(?:sohai\s+hacker|\w{1,20}@billybill\.com)\s*>['"];(?<X2129881>)|['"]\w{32}['"];\s*if\s*\(\s*\!\s*empty\s*\(\s*\$_SERVER\[.HTTP_USER_AGENT.\]\)\)\s*\{[^\}]+\}\s*\}\s*(?:@(?:ini_set|set_time_limit)\([^\)]+\);\s*){3,5}[^\\]{99,900}<form[^>]{1,50}method=\\['"]POST\\['"][^//]{1,50}type=\\['"]file\\['"][^;]+;\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1062053>)|['"]cmd\.exe['"];[^@]{9,200}@extract\s*\(\$_[GPRSC]\w{2,6}(?<X2126140>)|['"]Vshell\s+v[\d\.]{2,4}['"];(?<X2127080>)|\$\w{1,20}\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;\s*@?eval\s*\(\s*\$\w{1,20}\s*\)\s*;\s*\}\s*else\s*\{(?<X2046051>)|\$_SERVER\[['"]REMOTE_ADDR['"]\];(?:[^\?]{99,500}\$\w{1,20}\s*=\s*['"]From:\s*(?:Itunes|Apple)(?:ID)?\b[^\(]{9,99}mail\([^\)]+\);\s*header\s*\(['"]Location:(?<X2135270>)|\s*\}\s*\$email\w{0,9}\s*=\s*['"][^'"]{1,20}['"];\s*(?:\$(message|msg|bilsmsg)\s*\.?\s*=\s*['"](?:email|pass|password|pwd)[^;]{1,99}\.\s*\$_POST\[[^\]]+\]\s*\.\s*['"]\\n['"];\s*){2}[^\(\}\{]{1,199}\bmail\s*\([^\);]+\16\s*\);(?<X2137752>))|array\s*\(\s*['"]file['"]\s*=>\s*['"]@\$shell['"],\s*['"]name['"]\s*=>\s*\$nama_shell,\s*\);(?<X2125680>)|fsockopen\s*\(['"]udp://[^\)]+\);[^\?]{99,300}\}\s*(?:else\s+)?if\s*\(\s*\$_GET\[[^\]]+\]\s*==\s*['"]slowloris['"]\)(?<X2063860>)|getenv\s*\(['"]REMOTE_ADDR['"]\);(?:[^?]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|(?:PIN|CC)\s*(?:number)?|(?:Expir(?:ation|y)|EX)?\s*(?:date|month|year)|CVV|Card\s*(?:Number|Code))[^'"]{0,50}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){2}[^\?]{50,900}mail\((?<X2239740>)|[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|(?:PIN|CC)\s*(?:number)?|(?:Expir(?:ation|y)|EX)?\s*(?:date|month|year)|CVV|Card\s*(?:Number|Code))[^'"]{0,50}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){2}[^\?]{50,900}mail\((?<X2133821>)|[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|FULL\s*(?:number|name)?|CVV|Card\s*(?:Number|Code)|Exp\-(?:MM|YY))[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2133870>)))|\w{1,25}[\h=]+['"][^'"]+['"];\s*(\$\w{1,25})[\h=]+['"][^'"]+\.php['"];\s*(\$\w{1,25})[\h=]+['"]\./wp\-admin/images/[^'"]+['"];\s*if\(file_exists\(\24[\s\)\{]+[^\}]{9,299}\}\s*(\$\w{1,25})[\h=]+gzinflate\((file_)get(_contents)\(\24[\h\)]+;\s*\26put\27\(\23,\h*\25\);\s*chmod\(\23,\h*\d+\);\s*\}\s*\}(?<X1223130>)|\w{1,30}\s*=\s*(?:@?file\s*\(['"]/etc/passwd['"]\);[^></]{50}(?<X20496111>)|str_ireplace\(\s*"\w{1,30}"\s*,\s*""\s*,\s*"[^"]+"\s*\);\s*\$\w{1,30}\s*=\s*"[^"]+"\s*;\s*function\s+\w{1,30}\(\s*\$(err)no\s*,\s*\$\30str\s*,\s*\$\30file\s*,\s*\$\30line\s*\)\s*\{\s*array_map\(\s*create_function\s*\(\s*''\s*,\s*\$\30str\)\s*,\s*array\s*\(\s*''\s*\)\s*\);\s*\}\s*set_error_handler\(\s*'\w{1,30}'\s*\);\s*\$\w{1,30}\s*=\s*\$\w{1,30}\(\s*\$\w{1,30}\s*\)\s*;\s*(?:user|trigger)_error\(\s*\$\w{1,30}\s*,\s*E_USER_ERROR\s*\);(?<X2045931>))|\w{1,40}(?:-\s*>\s*\w+\s*=@file_get_contents\s*\(\s*\$\w{1,40}-\s*>\s*\w+\s*,\s*false\s*,\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}-\s*>\s*\w+\s*===\s*false\s*\)\s*\{\s*\$\w{1,40}\s*=\s*[^;]+\s*;(?<X2046530>)|=(?:"(?:\s*";\$\w=substr\(0,1\);for\(\$i=0;\$i<\d+;\$i=\$i\+\d+\)\s*{\$\w+\.=chr\(bindec\(str_replace\(chr\(9\),1,str_replace\(chr\(32\),0,substr\(\$d,\$i,\d+\)\)\)\)\);}eval\(\$s\);(?<X1036100>)|\w{1,20}";if\(!empty\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\){\$[^@]+@\$\w+\(stripslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);}else\s*@unlink\(__FILE__\);(?<X1036631>)|create.+?return\([^}]+};for\(\$\w+=-\d+;\+\+\$\w+<\d+;\$\w+\('','}'\.\$\w+\[\s*\$\w+\s*\]\s*\.\s*'{'\)\);};unset\(\$\w+\);(?<X1035611>))|'(?:[^']{1,40}'\^'[^']+';\s*\$\w+='[^']+';\s*(?:\$\w+='[^']+'|\$\w+=\d+);(?<X2045473>)|[^;]+;\$\w{1,40}=(?:\$\w{1,40}\[\d+\]\.?){4,};if\(isset\(\$\{(?:\$\w+\[\w+\]\.?)+}\[(?:\$\w+\[\w+\]\.?)+\]\)\){eval\(\$\w{1,40}\(\$\{(?:\$\w+\[\w+\]\.?)+\}\[(?:\$\w+\[\w+\]\.?)+\]\)\);\}(?<X1039560>)|\w+\(\!\w+\("\w+"\)\).*?;return\s+\$module->content\.html;\}(?<X1034901>)|base64_decode';\$\w+=\$\w+\(\$_[POST|GET]+\['\w+'\]\);file_put_contents\('\w+','<\?php\s*'\.\$\w+\);include\('\w+'\);unlink\('\w+'\);(?<X1034852>))|@gzinflate\(\$\w+\)\){\$\w+=create_function\('',\$\w+\);unset\(\$\w+,\$\w+\);\$\w+\(\);}}(?<X2045461>)|['"](?:[\w\-]{2,16}\.pw['"];(?:\$\w{1,40}=\$_[GPCSR]\w{2,6}\[[^;]{1,49};)?(if\(isset\(\$_)[GPRSC]\w{2,6}\[[^\]]+\]\)+\{\h*echo\h*['"]<form\b[^@]{99,499}\b[mc]o(?:ve_uploaded_file|py)\(\$_FILES\[[^@]{9,199}\b\41[GPCSR]\w{2,6}\[[^\]]+\]\)+\{unlink\(__FILE__\);(?<X2152051>)|[^'"]+['"];\s*\$\w{1,20}=(?:\$\w{1,40}\[\d+\]\s*\.?){5,};\s*\$\w{1,20}=[^;]+;\$\w{1,20}=['"][^'"]+['"];\s*\$\w{1,20}=\$\w{1,20}\.['"](?<X2045532>)|[^'"]{1999,4500}['"];(?:\$\w{1,40}=['"](?:\\x?[0-9a-f]{2,3}){1,9}['"];){2,5}(?:(\$\w{1,40})\.?=['"][^'"]{1,99}['"];)+@(?:\$\w{1,40}\(){2,5}+\44\)+;(?<X1123530>)|[^'"]{999,9999}['"];\$\w{1,40}=['"][^'"]{9,99}['"];(?:\$\w{1,40}\.?=['"][\\a-z0-9\+]{1,99}['"];){5,}@(?:\$\w{1,40}\(){3,}\$\w{1,40}\){4};(?<X1132930>)|https?://[^/]{0,9}\bbin(?:lists?|codes|db)\.\w{2,3}/[^@]{99,499}(\$\w{1,40})=fopen\(['"][^'"]{1,99}\.txt['"][^;]{1,99};(\$\w{1,40})=['"][^'"]{1,49}\bNew\s+OTP\b[^'"][^;]{1,99};fputs\(\47,\48\);(?<X2147390>))|\$_(?:[GPCSR][a-z]{2,6};\s*\$\w+\s*=\s*\$\w+\[\s*\w+\s*\];\s*if\s*\(\s*\$\w+\s*\)\s*\{\s*\$\w+=\s*\$\w+\s*\(\$\w+\s*\[\s*\w+\s*\]\s*\);\s*\$\w+\s*=\s*\$\w+\s*\(\s*\$\w+\s*\[\s*\w+\s*\]\s*\);\s*\$\w+\s*=\s*\$\w+\s*\(""\s*,\s*\$\w+\s*\);\s*\$\w+\s*\(\s*\);\s*\}(?<X1035732>)|COOKIE;\h*if\(\$GLOBALS\[[^\]]+\]\[\d+\]\(\w+\(\w+\),[^;]+;\s*\$\w+=\w+\(\d+\);\h*if[\(\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-]+\s*\d+(?:\.\d+)?[^\n]{99,}\*/(?:\v*\$GLOBALS\[[^\]]+\]\[\d+\][^\n]{99,}\*/)+(?<X1257480>))|strrev\('edoced_46esab'\);\$\w+=gzinflate\(\$\w+\('[^']+'\)\);create_function\('',"}\$\w+//"\);(?<X1035980>))|[=\s@]+(?:strtolower[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s;]+if[\(\s]+stri?pos[\(\s]+\$\w{1,40}[,\s'"]+(?:bing|yahoo|google)['"][^;]+(\$\w{1,40})[=\s]+['"]aHR0c[^'"]{3,99}['"][\s;]+\53[=\s]+base64_decode[\(\s]+\53[\)\s;]+\$\w{1,40}[=\s]+\$\w{1,40}[^\}]{9,499}\becho\b[^;\$]+\$\w{1,40}[^\}]+\}(?<X1220640>)))
\$\w{1,40}[=\s]+(?:(\$\w{1,40})[\(\s]+\$\w{1,40}[\)\s]*\|\|\s*\1[\(\s]+\$\w{1,40}[\)\s;]+(\$\w+)[=\s]+\$_REQUEST[\s;]+\$\w+[=\s]+(\$_FILES)[\s;]+\$\w+[=\s]+(!empty[\(\s]+)\2[\)\s]*\|\|\s*\4\$\w+[\)\s;]+if[\(\s]+!\$\w+\s*&&\s*\$[^;\{]+\{\s*(?:\$_[GPRSC]\w{2,6}[=\s]+)+\3[=\s]+array[^\+]{1,199}['"]w\+['"\)\s]+;(?<X1278870>)|(function)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(?:@?(?:eval|assert)[\(\s]+\7[\)\s;\}]+\b\6\s*\w{1,40}[\(\)\s]+\{\s*return\s*['"]\w+['"]\s*;\s*\}[^\+]{0,999}\$\w{1,40}\s*\[[\s\(]*\d+(?:\s*[\*\+/\-][\s\(\)]*\d+){2}[\s/\)\(\-\+\*]+\d[^\}]{0,999}\}(?<X1214130>)|eval[\(\s]+\7[\)\s;]+(\$\w{1,40})[\s=]+['"][^'"\$]+['"][\s;]+(return)\s*\9[\s;\}]+\$\w{1,40}[=\s]+\6[\(\s]+(?:\$\w{1,40}[\)\s,]+)+\{\s*\10\s*['"][^'"\$]+['"][\s;\}]+(\$\w{1,40})[\s=]+['"][^'"]{99,}['"]\s*;(?:\s*(?:\11[=\s]+)?\$\w{1,40}[\(\s]+\11[\)\s]+;)+(?<X1214640>))|(OPENSSL_)RAW_DATA;\s*(\$\w{1,40})[=\s]+\13cip\w+[\(\s]+\$\w{1,40}[=\s]+['"]AES[^'"]*['"]\.[^;]+;\s*\$\w{1,40}[=\s]+(substr\()(\$\w{1,40})[,\s]+\d+[,\s]+\14[\)\s;]+(\$\w{1,40})[=\s]+\15\16[,\s]+\14[^\{\}]{0,499}(\$\w+)[=\s]+hash_equals[\(\s]+\17[^;]*;\s*if[\(\s]+\18[\)\s\{@]+eval[\(\s]+\$\w+[\)\s]+;(?<X1260790>)|['"](?:['"]\s*;\s*(\$\w{1,40})\s*=[^;]{3,99}\.aspx['"]\s*;\s*(\$\w{1,40})[=\s@]+(file_get_contents)[\(\s]+\20[^%]{999,}(\$\w{1,40})[=\s@]+\22[\(\s]+\21[^\?]+(\$\w{1,40})\s*=[^;]+\23[^>]{9,}(\$\w{1,40})[\s=@]+\22[\s\(]+\24[^>]{9,}\becho\s*\25;(?<X1221460>)|\d+['"];\s*(\$\w{1,40})[=\s]+['"][^'"]{40,}['"]\s*;(?:\s*\$\w{1,40}[=\s]+\27\[\d+\](?:[\s\.]+\27\[\d+\])+\s*;)+\s*if[\(\s]+!function_exists[\(\s]+['"][^\n]{999,}\bunset\s*\([^\)]+\)\s*;\s*\b(?:exit|die)\b[^;]*;[\};\s'"\)]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1228381>)|http(?:s://[^'"]{8,40}\.(?:xyz|top)/?['"]\s*;\s*function\s*\w{1,40}\s*\([\)\s]+\{[^\}\{]{0,40}\bif[\(\s]+isset[\(\s]+\$_SERVER[\)\s]+\{[^@<]{999,}\bif[\(\s]+strlen[\(\s]+\$\w{1,40}[\)\s\d<>]+\{[^\}]{9,999}Not\s*Found['"][\)\s;]+(?:exit|die)\b[^;]{0,40};\s*\}\s*echo\s*\$\w{1,40}[^;]*;(?<X1206080>)|s?://(?:[^'"/]{4,}/[fz][^"']+['"]\s*;\s*function\s*(\w+)\s*\([^;\{\}]*\{\s*\$\w{1,40}[=\s]+['"](?:exit|die)['"][^<]{99,}<\?xml[^\*]{9,}\bpreg_match\b[^;\{\}]+\{\s*echo\s*\w+\s*\([^;]+;\s*\30[\s\(\)]+;\s*\}(?<X1261520>)|[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+\w{1,40}[\(\)\s;]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^;\|]+\|\|\s*\32[^;]+empty[\s\(]+\$_[GPRSC]\w{2,6}\[[^/]{9,999}(\$\w{1,40})[=\s]+\32\b[^;]+;\s*(\$\w{1,40})[=\s]+\w+[\s\('"]+https?://[^;\$]+\33[^;]+;[^\}]{0,99}echo\s*\34;[^\}]{0,99}\}\s*\}(?<X1203570>)|[fz][^'"]+\.[a-z]{2,9}\b[^'"]*['"][\s;]+function\s*\w+[^\{;]+\{[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1258141>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"][\s;]+function\s*\w+[^\{;]+\{[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1258361>)|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[fz][^'"/]+/['"];\s*function\s*is_crawler\s*\([^\n]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]+\b\w+[\(\s]+\$\w+[,\s]+\38[\s\)]+;[^\}]+\}(?<X1268991>)|cdn[^;]+;\s*(\$\w{1,40})[=\s]+(curl_)init[\(\s]+(\$\w+)?[\)\s;]+\41setopt[\s\(]+\40[^;]+;[^\{\}]{0,99}(\$\w+)[=\s]+\41exec[\(\s]+\40[\)\s;]+\41close[\s\(]+\40[\s\);]+\$\w+[=\s]+tempnam[\(\s]+sys_get[^;]+;\s*if[\s\(]+(\42|\43)\s*&&\s*file_put[^;\{\}]+\44[\s\)\{]+include\((\$\w+)[\s\);]+unlink\(\45[\s\);]+\}(?<X1284701>)))|wp\-[^'"]+\.php['"];\s*\$\w+\[\][=\s]+(\$\w+);\s*if[\(\s]+strlen[\(\s]+\47[^;]+\47[=\s]+dirname[\(\s]+__FILE__[\)\s;\}]+if[^,;]+PHP_OS[^\{'";]+['"]WIN['"\)\s]+\{[^#]{99,9999}\bexplode['"\s\(/#\*]+,[^\[]{1,40}(\$\w{1,40})[\s=]+(\$\w{1,40})\[\d+\][^\[]+\48[\.\s]+\49\s*\[[\d\]\s\)]+;\s*/\*\*/(?<X1232980>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"]perl\s+bc\.pl['"\s\.]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2223800>)|\$\w{1,40}(?:[\(\s]+\$\w{1,40}(?:[\)\s]+;\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+\$\w{1,40}[\)\s;]+\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;\s*function\s*\w{1,40}[\(\s]+(\$\w{1,40})[\)\s]+\{\s*@?eval[\(\s]+\52[\)\s]+;[^\[]{0,499}(\$\w{1,40})[\.=\s]+\$\w{1,40}\[\d+\][^\}]+\breturn\s*\53[\(\s]+\$\w{1,40}[\);\s]*\};(?<X1211300>)|\(\)[,\s]+\$\w{1,40}[\(\s]+0,100[\)\s]+;\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+['"]\\n['"]\s*;\s*\55[=\s]+\55[\.\s]+\$\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;(?<X1220340>))|\s*;\s*if[\(\s]+!\h*\$\w{1,40}[\)\s]+\{\s*class\s*(\w+)\s*\{[^\{\}]+__construct[\(\)\s]+\{[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\57[\(\)\s]+;\s*\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248490>))|\$GLOBALS\[[^\]]+\][\.\s]+(\$_SERVER\[\$GLOBALS)[^\]]+\]\];\s*\$\w{1,40}[=\s]+curl_init[\(\s]+\$\w{1,40}[^\n]{99,1999}\bfile_put_contents[\(\s]+\59[^\]]+\]\s*\][\.\s]+\$GLOBALS\[[^\]]+\][,\s]+fopen[\(\s]+\$\w{1,40}[,\s]+\$GLOBALS\[[^\]]+\][\)\s;]+\}(?<X1232320>)|\[(?:\]\s*;\s*while[\(\s]+(\$\w{1,40})\s*<\s*sizeof[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+\62\[\61\]\[\d+\]\s*==\s*['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}\s*\[\61\]\s*;[^\{\}]{0,499}\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*['"]://[^:]+\63\s*;[^\176]{99,}\beval\(.?\$_POST\[[^\]]+\](?<X2221770>)|\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}[,\s]+(\$\w{1,40})[=\s]+['"][^'"]*['"][,\s]+(\$\w{1,40})[=\s]+['"][^'"]*['"][,\s]+[\(\s]+\$\w{1,40}[=\s]+function[^<\n]{99,999}(\$\w{1,40})[=\s]+empty[\(\s]+\65\s*\[[^\]]+\][\)\s]+\?[^;]+;[^:\n]{9,99}file_put_contents[\s\(]+(?:\66|\67)[,\s]+\68[^;]+;(?<X1217660>))|array(?:[\(\)\s;]+(?:(\$\w+)[=\s]+json_encode[\(\s]+\$_[GPRSC]\w{1,6}[^\?\+]{1,99}for[^\{]+\{\s*\70[=\s]+curl_init[^>]{1,350}\$\w+[=\s]+curl_exec[\(\s]+\70[^:]{1,550}if[\(\s]+is_array[\(\s]+\70[^<]{1,150}header[^\{]{1,99}if[\(\s]+isset[\(\s]+(\$\w+)[^;]+echo\s*\71;\s*exit;[^\}]*\}\s*break;(?:\s*\}){2}(?<X1253655>)|if[\(\s]+isset[\(\s]+\$\w{1,40}\s*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+(['"])<\\[xa-f\d\\]{2}[^\}]{9,299}\74[\s;]+(\$\w{1,40})[\s=]+['"]/tmp/\.['"\s\.]+time[\(\)\s;@]+file_put_contents[\(\s]+\75[,\s]+\73[\)\s]+;\s*@include(?:_once)?[\(\s]+\75[\)\s;@]+unlink[\(\s]+\75[\)\s;]+\}(?<X1210830>))|[\(\s]+['"]title['"]\s*=>\s*['"]B[4a@]TM[4a@]N\s+SH[3e]LL['"][,\s]+['"]subtitle\b(?<X2220160>))|base64_decode[\(\s]+['"]aHR0[^'"]+['"][\)\s;]+function\s*(\w{1,20})_uri[\(\s\)]+\{[^/\n]{9,999}://['"][^\*]{99,999}\bsitemap[^\?]+\{\s*(\$\w{1,40})\s*=\s*strtolower\s*\([^;]+;\s*if[\s\(]+!empty[\s\(]+\79[\s\)]+\{[^\?]{999,}\}\s*\78_init\s*\(\s*\)\s*;(?<X1208611>)|isset[\(\s]+(?:(?:\$_SERVER\[['"](?:\81USER_AGENT|\81REFERER|\81HOST|REMOTE_\w+|(HTTP_)ACCEP\w+)['"]\][\)\s\?"':]+){2,};\s*if[\(\s]+is_http[^\+\n]{99,}\b(sitemap)[^:\}]+(\$\w{1,40})\s*=[^\?;]+/\?\82[^;]+;[^\(]{0,99}(\$\w{1,40})[=\s]+\w+[\s\(]+\83[^#@\n]{99,}\84[\s=]+@file_g[^\}]+\}\s*return\s*\84;\s*\}(?<X1220000>)|(\$_SERVER\[['"]HTTP_USER_AGENT['"]\])[\)\s]+\?\s*(urlencode)[\(\s]+\86[^\}/]+(\$\w{1,40})[=\s'"]+https?://[^/]{4,30}\.ru/[^\?\.;'"]{1,30}\.php\?\w+[='"\s\.]+\87\s*\([^\}]{0,199}(\$\w{1,40})[=\s]+(curl_)init[\s\(]+\88[^\}]+(\$\w{1,40})[=\s]+\90exec[\s\(]+\89[^\?]{0,499}\becho\s*\91;(?<X1214070>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*\d+\s*;\s*if[\(\s]+!(function)_exists[\(\s]+['"](isHttps?)['"][\)\s]+\{\s*\93\s*\94[^\+]{99,9999}(\$\w{1,40})[=\s]+['"]PD9[^'"]{999,}['"][^\?]{99,9999}file_put_contents[^;]+\95[^;]+;(?<X2222480>))|md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{0,499}(\$\w{1,40})[\s=]+\$\w{1,40}[\.\s]+(\$_FILES)\[[^\]]+\]\[[^\]]+\][;\s]+if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+\98\[[^\]]+\]\[[^\]]+\][,\s]+\97[\)\s\{]+echo[^\}]+\}\s*else[\{\s]+echo\b[^;]+;[\s\}]+echo[\s'"]+<form[^\}]+\}(?<X1225770>)|substr[\(\s]+(?:@\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE[^;]+;[^\(\):]{0,199}\b(curl_)init[\s\(\);]+\100setopt[\s\(]+(\$\w{1,40})[^!\{\}]+(\$\w{1,40})[=\s]+\100exec[\(\s]+\101[\)\s;]+\100close[\(\s]+\101[\)\s;]+if[\(\s]+\102[^;]+;[\s\}]*else[\s\{]+header[\s\('"]+Location[^\}]+\}\s*(?:exit|die)[^;]*;\s*\}(?<X1233790>)|md5[\(\s]+microtime[\(\)\s,]+rand[\(\s,\d\)]+;\s*\$\w{1,40}[=\s]+['"]<\?[ph\s]*(\$\w{1,40})\s*=\$_COOKIE\s*;[\(\s]+count[\(\s]+\$\w{1,40}[\)\s]+==\s*['"][^;]+\bin_array[\(\s]+gettype[\(\s]+\104\b(?<X2204440>)))
\$\w{1,40}(?:[=\s]+urldecode[\(\s]+['"](?:\d[^;]+;\s*\$\w{1,40}[=\s]+is_https[\(\)\s]+\?[^\*]+\$\w+\s*=\s*['"]User\-agent:\s*\*[^>]+\bfunction\s+doutdo\s*\([^\?]+\?\s*['"]pingok[^\}]+\}\s*return\s*\$\w+[;\s]*\}(?<X1283950>)|\s*\d+\s*(?:[\+\-/\*]+\s*\d+\s*)*['"][\)\s]+;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;[^\-]{9,9999}(\$\w{1,40})[=\s]+['"]http://['"][\.\s]+\2[^;]+;\s*(\$\w{1,40})[=\s]+\w+[\s\(]+\3[^\|]{0,1499}\becho\s*\4\s*;\s*(?:exit|die)\b[^;]{0,40};\s*\}(?<X1229830>))|[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;\s*(\$\w{1,40})[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;(?:\s*(\$\w{1,40})[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;)?\s*(\$\w{1,40})[=\s]+['"][a-z\d\+/]{999,}={0,2}['"][\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:\6|\7)[\(\s]+(?:\7|\8)[\)\s]+;(?<X1212291>)|[\h=]+class_exists[\(\s]+['"]([^'"]+)['"][\)\s]+;[^\{\n]{0,99}\{\s*class\h*\10[\s\{]+private\h*\$\w+;[^\{]+\{\s*(\$\w+)[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;\s*\$\w+[\h=]+@\11\[substr\(\10::[^\n]{99,1199}\bnew\h*\10\(\);\s*\$\w+[\h=]+NULL;\s*\}(?<X1238723>)|[\s=]+(?:['"](?:c[urlint_\.'"\s]{8,};\s*\$\w{1,40}[\s=]+['"]c[urlintseop_\.'"\s]{9,};\s*(\$\w{1,40})[\s=]+['"]c[urlex_\.'"\s]{8,}c['"]\s*;[^\?]{0,99}if[\(\s]+isset[\(\s]+\$_[GPC]\w{2,6}[^\?]{0,199}(\$\w{1,40})[\s=]+\13[\(\s]+\$\w{1,40}[\)\s;]+eval[\(\s'"]+\?>['"][\.\s]+\14[\)\s;@]+(?:exit|die)\b[^;]*;\s*\}(?<X1210910>)|f\w{2,9}['"]\s*;\s*\$\w{1,40}[\s=]+['"]http[^;'"]+\.(?:top|zyx)[^;]*;\s*function\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\*\\]{499,}\becho\s*\$\w{1,40}(?:[\s;]+(?:exit|die)\b[^;]*;)?[\s\};]+else\s*\{\s*header[\(\s]+['"][^'"]*Not\h*Found['"][\)\s]+;\s*\}(?<X1206040>))|\$_[GPRSC]\w{2,6}[\s;]+\$\w{1,40}[\s=]+\w+[\(\s]+\d+[\)\(\s;]+round[\(\s]+\d+\s*[\+\*/%][^\n\?]{0,999}\?(\$GLOBALS\[)[^\]]+\]\[\d+\][\(\s]+\$\w{1,40}[,\s]+(?:\$_[GPRSC]\w{2,6}[,\s\):]+)+\17[^\]]+\]\[\d+\][\(\s]+round[^@]{9,9999}\17[^\]]+\]\[\d+\]\(\$_[GPRSC]\w{2,6}\);\$\w+[=\s]+round\([^\)]+\);(?<X1229300>)|function[\s\(]+(\$\w{1,40})[\)\{\s]+EVaL[\s\(]+\19[\);\s]+(\$\w{1,40})[\s=]+['"]\w{40,}['"][;\s]+return\s*\20[^\?\-\+\*%/]{1,440}\$\w{1,40}\[\d+\s*[\-\+\*%/][^\?@\^]{1,440}(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;(?:\s*\21[\s=]+\$?\w+[\s\(]+\21[\s\)]+;)+\s*\$\w{1,40}[\s\(]+\21[\s\)]+;(?<X1213770>))|\((?:(?:\([^\)]{1,9}\^[^\)]{1,9}\)\.){3}[^@]{1,999}<title\b[^>]{0,99}>40[34]\h+(?:Not\h+found|forbidden)</title>(?<X2183701>)|\$\w{1,40}\);(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);if\([^\n]{0,16}\$\w{1,40}\(@\$\w{1,40}\[\$\w{1,40}\][^\n;\{\}]{1,99}\)\{?\24\(\);\}?(?<X1132530>)|\);\s*\}\s*\}\s*\?>\s*<html>\s*<head><title>404\s+Not\s+Found(?<X2053831>)|\s*''\s*,\s*'\}'\s*\.\s*\$\w{1,40}\s*\.\s*'//'\s*\);\s*\Z(?<X2051581>))|\.=\$\w+\(\$\w+\(\$\w+\)&0xFF\);}eval\(\$\w+\);exit\(\);\s*$(?<X2044751>)|\[(?:['"]\\[^'"]+['"]\]\s*=\s*isset[\(\s]+\$\{['"]\\[^'"]+['"]\}\[[^\]]+\][^;]+;[^<\n@]{9,}@gzuncompress[\(\s]+base64_decode[\(\s]+\$[^\n]+\bheader[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1252580>)|\w{1,40}\]\s*=\s*['"][^'"]{1,40}['"];(?:\s*(?:system|shell_exec|exec|popen|passthru)\s*\(\)\s*;){3}(?<X2056071>))|\h*(?:=\h*(?:(\$\w{1,40})\h*\(\h*['"]Sy5KTSxJjU8rzUsuyczPAwA=+['"]\h*\)\h*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\h*\(\h*(?:['"]{2}|null)\h*,\h*\31\h*\(\h*\$\w{1,40}[\h\)]+;\s*\$\w{1,40}\h*\(\h*\)\h*;\s*@?\w{1,40}\(\h*['"]\w{2,40}['"]\h*,\h*['"]\w{2,40}['"]\h*\)\h*;(?<X1159250>)|['"]@?[eval\h'"\.]{7,40}\([^;\v/\+]{1,99}\(['"][^"'\v]{99,9999}['"][\h\)]+;\h*['"]\h*;(\$\w{1,40})\h*=\h*['"]['"\h\.creat_funio]{17,40}['"];\h*@?(\$\w{1,40})\h*=\h*\33\h*\([^\)]+\);\h*@?\34\h*\([^\)]*\);(?<X1159140>)|['"][a-z]{2}_\d+\w{0,40}\.(?:doc|exe)['"]\h*;\s*\$\w{1,40}\h*=\h*['"]application/[^'"]+['"]\h*;[^\$\-=]{0,99}\bheader\h*\(\h*\$this\->(?<X2161470>)|['"]get_data_ya['"];[^\?]{99,9999}\bfunction\h*wp_v?cd\([^\}]+\}[^\?][^\?]{99,9999}<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;[^\?@=\{\}]{9,99}(\{\$\w{1,40}\})[^;]+;[^\?=]{0,99}\btouch\(['"]\37['"][,\h]+\$\w{1,40}[\s\)]+;(?<X1191600>)|['"]gz(?:inflate|uncompress)['"];(?:\s*\$\w{1,40}\h*=\h*['"](?:base64_decode|create_function)['"]\h*;){2}\s*\$\w{1,40}\h*=(?<X2177931>)|['"]https?://[^'"]{5,99}\b(?:css\d*|ima?ge?s?\d*)[^'"]{0,40}['"];\s*@?[efsp](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|xec)\(\s*['"]cd\h+/tmp;\h*(?:w?get|curl|lwp\-download|fetch|lynx)[^;]{1,99}['">]\h*([^;'">]{1,40}\.txt);\h*perl\h+\40(?:[^\)\v]{1,199}\)\h*)?;(?<X1168650>)|['"]spamtools\.be[^\v]{0,9}['"]\h*.\h*mt_rand\h*\(\d+,\d+\)\h*;(?<X2167280>)|['"]str_rot['"]\h*\.\h*3\.25\h*\*\h*4\b(?<X2172351>)|\$_[GPRSC]\w{2,6}\h*\[(base64_decode)[\h\('"]+\w{1,99}['"\h\]\)]+;\s*if[\s\(]+(?:preg_match[\h\(]+(?:\$\w{1,40}[,\s\)\|\(\{]+)+)+(\$\w{1,40})[\s=]+\44[\s\(]+['"]aHR0[^'"]{4,99}['"][\s\)]+;\s*@?header[\s\(]+\44[\s\(]+['"][^'"]+['"][\s\)\.]+\45[\s\)]+;\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1190010>)|\$_SERVER(?:\[\h*strrev\h*\(\h*strtoupper\h*\(\h*['"](?:iru_tseuqer|tnega_resu_ptth)['"](?:\h*\)){2}\s*\];[^@]{99,999}@setcookie\h*\(\h*['"]?\$?\w{1,40}['"]?\h*,[^;]+\);(?:\h*(?:exit|die)[^;]{0,9};)?(?:\h*\}){3}(?<X1160351>)|\h*\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp-(?:includes?|admin|content)/[^'"]{1,99}\.php['"];\s*\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*['"]https?://[^'"]+/(?:wso|c99|r57|b374k)(?:\\?\h*[-_]?shell)?\.txt['"]\h*\)\h*;\s*\$\w{1,40}\h*=\h*@?fopen\h*\((?<X2147161>))|\d+;\s*\$GLOBALS\[[^\?]{99,999}(\$\w{1,40})\h*=\h*Array\(\s*['"]\w+['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\49\h*\);\s*\}\s*elseif\s*\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*@?eval\h*\(\h*\50[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1160831>)|array\(\$\w{1,40}\(\h*['"]tmhapbzcerff['"][^\?\}]{1,199}\$(\w{1,40})\h*=\h*str_i?replace\(['"]//(<\?php)['"],\h*['"]\53['"],\h*\$\52\);[^\?]{1,499}\bfile_put_contents(\((\$\w{1,40}),\h*\$\52\);)[^\}\?;><=]{0,99};?\bunlink\(\55\);\s*@?unset\54\s*\}(?<X1162490>)|base64_decode[\(\s]+['"]fHstLi0hISF9fA['"][\)\s]+;\s*@?mkdir\h*\(\h*\$\w{1,40}\h*\.\h*['"](?:images|css|inlcudes|update|upgrade|upload)/?['"]\h*\)\h*;\s*\$\w{1,40}\h*=\h*['"][^'"]{1,40}\.(?:png|jpe?g|ico|gif)['"]\h*;(?<X2188610>)|chr\(\d+\)[^/]+?@\$\w{1,30}\(\s*@\$\w{1,30}\(\s*['"][^\)]{999,}\)\)\)?;(?<X2045974>)|explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=\h*\(\h*\d+\h*\-\h*\d+\h*\)\h*;\s*\$[a-z]{4,15}\h*=\h*\59\h*\-\h*1;[^\$\?\{\}]{0,499}(?=\?>)(?<X1280230>)|file_get_contents\((['"]\./wp\-load\.php['"])\h*,\h*['"]r['"]\h*\)\h*;\s*if\h*\(\h*@?strpos\(\$\w{1,40}\h*,\h*['"](\w{1,40}\.php)['"]\h*\)[^@\;\{]{1,40}@?filesize\([^;]{1,99}\62['"]\h*\)\h*>\h*\d+\s*and[^\*]{999,9999}(\$\w{1,40})\h*=\h*@?fopen\(\61\h*,\h*['"]a\+?['"][^\}]+\63\);(?:\s*\}){2}(?<X1160100>)|implode[\h\(]+['"]{2}[\h,]+array_keys[\h\(]+\$_[GPRSC]\w{2,6}[\)\s]+;\s*if[\(\s]+preg_match\s*\([^;]+;[^&]{99,9999}\bif[\s\(]+\$isHuman\h*&&[^;]+;[^\?]{0,199}\bgetHtml\d*[\s\('"]+https?://[^;]*(?:bingstyle|saleforyou|zctrack)[^\+]{9,1999}\{\h*setcookie\h*\([^;]+time\(\)[\h\+]+3600[^;]+;\h*\}(?<X1193980>)|md5\h*\(\h*\$\w{1,40}\h*\.\h*['"][^'"]{1,40}['"]\h*\);(?:\s*(\$\w{1,40})\h*=\h*str_rot13\h*\(['"](?:tmhapbzcerff|fge_ebg13|onfr64_qrpbqr)['"]\);){3}\s*@?(?:eval|preg_replace)\b[^;]{1,299}\66\h*\(\h*['"][^;]{9999,}['"](?:\s*\)\s*){4}[^;]{0,40};(?<X1148320>)|str_replace(?:\(basename\((\$_SERVER\[['"]SCRIPT_(FILE)NAME['"]\]\))[\s,]+['"]{2}[,\s]+\68\h*\.\h*['"]/['"];\s*if\s*\(\h*\69_exists\((['"]index\.php['"])\)+\s*\{\s*@?touch\(\h*__\69__\h*,\h*\69mtime\(\70\)+;\s*\}(?<X1177180>)|\h*\([^\$\[\.;]{0,19}(\$_SERVER\[)[^\]]+\][\h\.]+\72[^\]]+\][\h\)]+;\s*\$\w{1,20}[\h=]+['"]_shaesx_['"];\s*\$\w{1,20}[\h=]+['"]get_data_ya['"];[^@]{99,999}@require_once[\h\(]+\72[^;]+;[^\*,\{\}]{99,999}\bmysqli_connect\h*\([^\[@]{99,999}=\h*\w{1,40}\h*\([^;\[]+\72[^;]+;(?:\s*\}){3}(?<X1190370>)))|\->\h*\w{1,40}\h*\(\h*['"]SELECT\b[^;]{1,99}\border\s*by\s*deface\b(?<X2165321>)|\.?=\h*['"]From:\h*Neww\h*one\h*\176<Troj>(?<X2142490>)))
\$\w{1,40}\s*/\*(?:[^\*]+\*/\s*=\s*/\*[^\*]+\*/\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*\([^\n]{999,9999}/\*[^\*]+\*/\s*@\$\w{1,40}\(['"][^'"=]{999,}=?=?['"][\s\)]+;(?<X1225010>)|[^\*]{0,40}\*/\s*=\s*/\*[^\*]{0,40}\*/\s*\$\w{1,40}\s*/\*[^\*]{0,40}\*/\s*\[[^\]]*\][^\n]{99,9999}@\$\w+[\s\(]+['"][^'"]{999,}['"][\s\)]+;(?<X1257940>))
\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*(?:\$\w{1,40}\s*=\s*str_ireplace\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=.{3000,30000}\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*user_error\s*\(\s*\$\w{1,40}\s*,\s*E_USER_ERROR\s*\)\s*;(?<X2050890>)|echo\s*\$\w{1,40}\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\$\w{1,40}\s*=\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*(?<X2046080>))|(?:\s*\$\w{1,40}\s*\.)?\s*['"]https?://(?:[fz](?:[\d_]+\.[^'"]+\.\w{2,9}/?['"][^;]*;(?:[^,]{0,199}\bfunction\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\3[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1252890>)|[^\{\}]{0,199}\bfunction\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\5[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1248023>))|\w+\.[^'"]+\.\w{2,9}/?['"][^;]*;[^\{\}]{0,199}\bfunction\s*\w{1,40}\s*\([^\}!]*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+(\$\w{1,40})\[['"]http_user_agen[^;]+;\s*echo\s*getSer\w+[\(\s]+\$\w{1,40}[,\s]+\7[^\n\}]{0,199}(?:exit|die|return)?\b(?:[^\}\{\n]*\}){1,2}(?:\s*(?:exit|die|return)\b[^;]*;)?(?<X1254321>))|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]+['"][^;]*;[^\{\}]{0,199}\bfunction\s*\w{1,40}(?:[\s\(]+\$\w{1,40}[\s\)]+\{\s*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+(\$\w{1,40})\[['"]http_user_agen[^;]+;\s*echo\s*getSer\w+[\(\s]+\$\w{1,40}[,\s]+\9[^\n\}]{0,199}(?:exit|die|return)\b(?:[^\}\{\n]*\}){1,2}(?<X1247782>)|\s*\([^\}!]*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+\$?\w{1,40}\[['"]http_user_agen[^;]+;(?:[^\}\n\*@/]{0,199}\}){2}(?:\s*@?\w+[\s\(\)]+;)?(?<X1254312>)))|[\(\s]*isset[\(\s]+\$_[GPRSC]\w{2,6}(?:\[[^\]]+\][\.\s]+(\$\w{1,40})\[\d+\][\.\s]+\12\[\d+\][^;]+;[^\*&]{999,}\bif[\(\s]+\$\w{1,40}\s*!=+\s*['"][^'"]*['"]&&\s*preg_match\b[^\?]{9,9999}\?header[\s\(]+\12\[\d+\][\.\s]+\12\[\d+\][^;]+;(?:[^\}\n\[:>\*]{0,149}\}){5}(?<X1217670>)|\s*\[\s*(\$\w{1,40})\s*[\[\{]\d+[\]\}](?:\s*\.\s*\14\s*[\[\{]\d+[\]\}])+\s*\][^\*\n\\]{999,}\bheader[\s\(]+\14\s*[\[\{]\d+[\]\}](?:\s*\.\s*\14\s*[\[\{]\d+[\]\}])+[\s\)]+;\s*\}(?<X1207262>))|[\s\(]*isset[\(\s]+(?:(\$_SERVER[\[\s'"]+HTTPS)['"\]\)\s]*&&\s*\16['"\]\s]+!==\s*['"]off['"\)\s]+\?\s*["']https?://['"]\s*:\s*['"]https?://[\)\s'"]+;[^\n]{99,}(\$\w{1,40})\s*\[['"]http_user_agent['"]\][^\{\}]{0,199}\b\w+[\s\(]+\$\w{1,40}\s*,\s*\17[^\}]+\}[^\n\?\{\}\(\)]{0,40}\b\w+\s*\(\s*\)\s*;(?<X1264250>)|\$_SERVER\[(\$\w+)\[\d+\][\.\s]+\19\[\d+\][^\|]{9,999}\|\|\s*\$\w{1,40}\s*==+\s*\19\[\d[^\*\%\\]{99,9999}explode[\s\('"]+\\n['"][,\s]+\$\w{1,40}[^:]{0,9999}:\s*(?:print|echo)\s*\$\w{1,40}[\s\;]+((?:exit|die)\b[^;]{0,40};)[\s\}]+else[^\}]+echo\s*\$\w{1,40}[\s;]+\20(?:\s*\}){3,6}(?<X1232310>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*;\s*if\s*\(\s*in_array\s*\(\s*"wp-config\.php"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*file_put_contents\((?<X2046240>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if\s*\(\s*\$\w{1,40}!='[^']*'\s*\)\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@eval\s*\(\s*"[^"]*"\s*\)\s*;\s*\}(?<X1036801>)|\s*!empty[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+\?\s*\24\s*:\s*['"]index\.html?['"][\s;]+function\h*(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)]+\{\s*\$\w{1,40}[\s=]+file_get_contents[\s\(]+\26[^\176]{99,}\b(preg_match)[^\*]+\27[^;]+;[^:]{0,999}(\$\w{1,40})[\s=]+\25[^;]+;[^\}]+\becho\s*\28;[^\}]{0,40}\}(?<X1196040>)|\s*""\s*;\s*(?:\$\w{1,40}\s*\.=\s*"[^"]{0,2000}"\s*;\s*){3}.{100,7000}\$\w{1,40}\s*=\s*create_function\s*\(\s*null\s*,\s*\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;(?<X1041141>)|\s*".{32}";\s*if\(isset\(\$_REQUEST\['\w+'\]\)\)\s*{\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*eval\(\$\w+\);\s*exit\(\);\s*}\s*if\(isset\(\$_REQUEST\['\w+'\]\)\)\s*{\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*\$\w+\s*=\s*fopen\(\$\w+,\s*'w'\);\s*\$\w+\s*=\s*fwrite\(\$\w+,\s*\$\w+\);\s*fclose\(\$\w+\);\s*echo\s*\$\w+;\s*exit\(\);\s*}(?<X1034551>)|\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*strtoupper\s*\([^)]{1,100}\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*(?:assert|eval)\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\}(?<X1040670>)|\s*"[preg_replace\s\.\"]+";\s*\$\w+\("/\[discuz\]/e",\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\],"[^\"]+"\);(?<X1035341>)|\s*"\w+";\s*(?:@?preg_replace\(['"](?:\\x?[a-f0-9]{2,3})+['"]\s*,['"](?:\\x?[a-f0-9]+)+['"]\s*,['"](?:\\x?[a-f0-9]{2,3})+['"]\);(?<X1034332>)|\$\w+\s*\.=\s*"\w+";\s*@\$\w+\(\$\w+\(\'[a-zA-Z0-9/=+]{100,200}(?<X2045512>))|\s*"\w+"\s*;\s*\$\w+\s*=\s*strtolower\s*\(\s*(?:\s*\$\w+\[\d+\]\s*\.?\s*)+\)\s*;\s*.+?eval\s*\(\s*\$\w+\s*\(\s*\$\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*\);\s*\}(?<X1034743>)|\s*"\w{1,40}";\s*\$\w{1,40}\s*=\s*"c[^;]+;\$\w{1,40}=@\$\w{1,40}\([^@]+@\$\w{1,40}\("[^"]{2000,}"\s*,\s*\$\w+\);(?<X1039710>)|\s*'['\s\.aceglpr_]{12,40}';\s*\$call_user_func_array\(\s*\$\w+\s*,\s*array\('/\[\w+\]/\w+'\s*,\s*(\$_REQUEST)\["\w+"\]\s*,\s*"[^"]+"\s*\)\);@?\w+\(\s*\38\s*\)(?:\s*;)?(?<X1045324>)|\s*'[^']*'\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*;\s*if\s*\(\s*@?md5\s*\(\s*\$_REQUEST\s*\[\s*'[^']*'\s*\]\s*\)\s*==\s*'[^']*'\s*\)\s*@?\$\w{1,40}\s*\(\s*\$_FILES\[\s*'\w+'\s*\]\s*\[\s*'\w+'\s*\]\s*,\s*\$_POST\s*\[\s*'\w+'\s*\]\s*\.\s*\$_FILES\[\s*'\w+'\s*\]\s*\[\s*'\w+'\s*\]\s*\)\s*;(?<X1040563>)|\s*'[^']+'\s*(?:;\s*\$\w{1,40}\s*=\s*create_function\s*\(\s*''\s*,\s*(?:\$\w{1,40}\{\s*\d+\s*\}\s*\.\s*)+'.{1,300}?'\s*\)\s*;\s*\$\w{1,40}\(\s*\)\;(?<X1039641>)|\^\s*'[^']+'\s*;\s*\$\w{1,40}\(""\s*,\s*"};"\s*\.\s*\$\w{1,40}\(\s*preg_match\(\s*"[^"]+"\s*,\s*\$\w{1,40}\(\s*""\s*,\s*file\(\s*__FILE__\s*\)\s*\)\s*,\s*\$match\)\s*\?\s*\(\s*\$match\[1\]\s*\)\s*:\s*""\s*\)\s*\.\s*"//"\s*\);(?<X2050580>))|\s*'[^;]+;(?:\$\w{1,40}\s*=\s*(?:\$\w{1,40}\[\d+\]\.?){3,};)+.+?;\$\{(?:\$\w{1,40}\[\d+\]\.?)+\}\(\);\}(?<X1038582>)|\s*'[assert\'\.\s]+';\s*\$\w+\s*=\s*sprintf\('[\!\(\)evalbase64_decode\s\.\']+\("%s"\)\)'\s*,\s*\$\w+\);\s*\$\w+\(stripslashes\(\$\w+\)\);(?<X2045361>)|\s*(@\$_SERVER\[)['"]HTT\w+['"]\][\s\.]+\45['"]PH\w+['"]\][\.\s]+\45['"]QUE\w+['"]\];[^@\+]{0,999}\$\w+\s*=\s*['"]Mozilla[^;]+\bcompatible;[^\{\}]+if[\s\(]+function_exists[\('"\s]+curl_init['"\)\s]+\{\s*try\s*\{[^#]{99,9999}\becho\s*\$\w+[\(\s]+\$ur\w+[\);\s]+\}\s*\}(?<X1262350>)|\s*(\$_SERVER\[)['"]REMOTE_ADDR['"]\];\s*\$\w{1,40}\s*=\s*['"](https?://)[^;]{0,49}\47[^;]{1,49};[^\{\?\}]{9,199}\{\s*(\$\w{1,40})\s*=\s*array\([^;]{1,99};\s*\$\w{1,40}\s*=\s*stream_context_create\(\49\);\s*@file_get_contents\(['"]\48[^;]{1,99};\s*\}\s*setcookie\(['"]haircki['"][^;]{1,49};(?<X1144850>)|\s*(base64_decode\()[^\(]{9,99}(\$\w{1,40})\s*=\s*\51['"]PHNjcmlwdD[^'"]{99,599}['"]\);\s*(\$\w{1,40})\s*=\s*\52[^\{]{1,99}(DIR_CATALOG)[^\{]+\{\s*(\$\w{1,40})\s*=\s*\54[^;]+;\s*if\s*\(strpos\((file_ge(t_contents\(\55)\))[^\{]+\{\s*file_pu\57,\s*str_replace\([^,]+,\s*\53,\s*\56\)+;(?:\s*\}){2}(?<X1131381>)|\s*(str_replace)[\s\(]+['"][^'"]*['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]{15,}['"][\)\s;]+(\$\w{1,40})[\s=]+\59[\s\(]+['"][^,]*['"][\s,]+['"][^'"]*['"][\s,]+(?:\$\w{1,40}(?:\s*\.)?\s*){3,}\)[\s;]+(\$\w{1,40})[\s=]+\$\w{1,40}[\(\s]+['"]{2}[\s,]+\60[\)\s;]+@?\61\s*\(\)\s*;(?<X1201591>)|\s*1;\s*\$\w+\s*=\s*get_userdata\(\$\w+\);\s*\$\w+\s*=\s*\$\w+->\w+;\s*wp_set_current_user\(\$\w+\s*,\s*\$\w+\);\s*wp_set_auth_cookie\(\$\w+\);\s*do_action\('wp_login'\s*,\s*\$\w+\);(?<X2045201>)|\s*@?\$_SERVER\[[^\]]+\];\s*if[\s\(]+\$\w+\s*==+\s*['"]\w+['"][\)\s]+\{\s*\$\w+\s*=\s*@?\$_REQUEST\[[^\]]+\];[^%<]+\bexit\s*\([^#]+if[\(\s]+strstr[\(\s]+(\$\w+)\s*,[^\*]+\64[\s\);\(]+\b(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1283430>)|\s*@?fopen\s*\(\s*['"]\w{1,40}://['"]\s*\.\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1126280>))
\$\w{1,40}\s*=(?:\s*@?getcwd\s*\(\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*@chdir\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*@?getcwd\s*\(\s*\)\s*;(?<X2046101>)|\s*@?urldecode[\s\(]+['"]\-%[^\{\}!:]{0,499}\{\s*global\s*\$\w{1,40};\s*if[\s\(]+!preg_match\b[^\[;\{\}]+\{\s*if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^>]+\bsocket_read\b[^>]{999,}\becho[\s'"\(]+(\$\w{1,40})[\s'"\);]*unset[\s\(]+\2[^;]+;\s*(?:exit|die)[^;]{0,19};[\s\}]+\w+\(\);(?<X1197230>)|\s*@\$\w{1,40}\(''\s*,\s*strrev\(';\)\)\]\w{1,40}\[REVRES_\$\(edoced_46esab\(lave'\s*\)\s*\);\s*@\$\w{1,40}\(\s*\);(?<X1040800>)|\s*@\$_COOKIE\['\w+'\];\s*if\s*\(\$\w+\) {\s*\$\w+\s*=\s*\$\w+\(@\$_COOKIE\['\w+'\]\);\s*\$\w+=\$\w+\(@\$_COOKIE\['\w+'\]\); \$\w+\("/\w+/e",\$\w+,\w+\);}(?<X1034491>)|\s*["']<\?php\s*\(["']\s*;.+?\$\w{1,40}\s*=\s*@fopen\s*\(\s*["'][^'"]*["']\s*,\s*["'][^'"]*["']\s*\)\s*;\s*@fwrite\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;(?<X1037540>)|\s*["']<FilesMatch\s*\\['"]\.\(py\|exe\|phtml\|php\|PhP\|php5\|suspected\)\$\\['"]>\\n\s*Order\s+Allow,Deny\\n\s*Deny\s+from\s+all\\n\s*</FilesMatch>\s*\\n\s*<FilesMatch\s*\\['"]\s*\^[\(\s'"]*index\.php['"]\s*;(?<X2217320>)|\s*["']https?://(?:[fz]\w+\.\w+\.[a-z]{2,9}/*["']\s*;\s*function\s*getSe\w+\s*\([^\n\*]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\b\w+\(\$\w+[,\s]+\8[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1257681>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"]\s*;\s*function\s*getSer\w+\s*\([^\n]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\b\w+\(\$\w+[,\s]+\10[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1257770>))|\s*['"](?:\|wp\-[\w\.\-]+\.php)+['"];\s*\$\w{1,40}\s*=\s*['"]https?://\w{1,5}\.[\w\-]+\.[a-z]{2,9}/?['"];\s*\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*chdir[\(\s]+\$\w{1,40}[\)\s]+;[^\*]+\bshell\b(?<X2227870>)|\s*['"][^'"]*['"](?:;\s*if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*if\s*\(\s*md5\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*\$\w+\s*\)\s*@?eval\s*\(\s*base64_decode\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\);\s*exit;\s*\}\s*if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*phpinfo\(\s*\);\s*\}(?<X1035722>)|\s*;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*=\s*>\s*\$\w{1,40}\s*\)\s*\{\s*if.{1,200}\s*echo\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}(?<X1041680>))|\s*['"][^'"]{1,9}(?:xml|map)\d*['"];[^#]{9999,19999}@?header\(['"]HTTP/\d\.\d\s+404\s+Not\s+Found['"]\);\s*(?:exit|die)[^;]{0,19};[^#]{99,499}\bfunction\s+\w{1,40}is_?bot\(\)\s*\{[^@]{99,499}\bfunction\s+\w{1,40}other_?bot\(\)\s*\{[^#]{999,1999}return\s*\$\w{1,40};\s*\}(?<X1194532>)|\s*['"][^;]+['"];(?:\s*\$\w{1,40}\s*=(?:\$\w{1,40}\[\d+\]\s*\.\s*){2}[^;]{1,99}\$\w{1,40}\[\d+\];\s*){2}if\s*\(\s*isset\s*\(\s*\$\{\s*\$\w{1,40}\[\d+\][^\}]+\}[^\{]{99,200}\{\s*@?eval\s*\(\s*\$\{\s*\$\w{1,40}\[\d+\]\s*\.[^\}]+\}\[\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\[\d+\]\s*\.[^\)\};]+\)\s*\]\s*\);\s*\}(?<X1037891>)|\s*['"]\*/['"]\s*\.\s*['"]@?eval[\(\s]+file_get_contents[\(\s]+base64_decode[\(\s]+['"]\$\w{1,40}['"][\)\s]+;\s*/\*+['"]\s*;[^\?]{0,999}\$\w{1,40}\s*\.?=\s*['"]<\?[ph\s]+['"][^@]{9,999}\bFront\s+to\s+the\s+WordPress(?<X2217460>)|\s*['"]\w+['"];(\$\w+)[^\.;]{1,64}\.['"/ind\.exph]{9,};\s*\$\w{1,40}\s*=\s*\$_SERVER[^\.]{4,16}\]\.['"/\.htaces'"]{9}[^%]{1,399}file_put_contents[\(\s]+\18[,\s]+\w+[^\{\}\n>\?]{1,999}\b\w+\s*\(\18[^\%\n]{9,256}\bchmod[\(\s]+\$\w+[\s,]+['"]\d+['"][\s\);]+\}\s*\}(?<X1263291>)|\s*['"]a:1:{s:13:"administrator";b:1;}['"];\s*if\s*\(\s*isset\(\s*\$_GET\[['"][^'"]{1,40}['"]\]\s*\)\s*\)\s*\{\s*echo\s*['"]<!--\s*Silence\s*is\s*golden\.?\s*-->['"];\s*\}(?<X2055820>)|\s*['"]https?://(?:[^'"]+\.txt['"]\s*;\s*\$\w+\s*=\s*\[\s*CURLOPT_[^!]+=\s*tempnam[\(\s]+sys_get_temp_dir\b[^;]+;\s*if[\s\(]+file_put_contents[\(\s]+(\$\w+)\s*,\s*\$\w+[\)\s]*!=+\s*false[\)\s]+\{\s*include\s*\21[;\s]+unlink[\s\(]+\21[^=\*\?]+\}\s*curl_close[\(\s]+\$\w+[\)\s]+;(?<X1283420>)|[fz][^'"\.]+\.[^'"\$]+\.[a-z]{2,12}/?['"][^:]*;\s*function\s*\w+[\(\s]+\$[^\n]{99,}\$\w+\s*\[['"]http_user_agent['"]\][^\}\{\n]+\}(?<X1272540>)|[fz]\w+\.[^'"]+['"]\s*;[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\24[\s\)]+;[^\}]+\$\w{1,40}\s*=\s*['"][^'"]*['"]\s*;\s*\}(?<X1279290>)|[zf]\w+\.[\w\-]+\.[a-z]{2,9}[^'"]*['"]\h*;\h*(function)\s*(\w+)[\(\)\s\{]+(?:(?:return|echo|print)[\s;]*(?:(?:exit|die)\b[^\}]*)?)?\}\s*\26\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\28[\)\s;<\?>ph]+(?:\27[\(\)\s;]+|(?:exit|die)\b[^\}]+)?\}(?<X1248874>)|\d{1,3}(?:\.\d{1,3}){3}/(?:[^'"]+['"]\s*;\h*function\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\30[^\}]{1,199}\}(?<X1248040>)|[zf]\w+/?['"\s;]+function\s*(\w+)[\s\(\)\{]+(?:return\s*)?(?:exit|die)[^;]*;\s*\}[^\n]{99,}\bif[\(\s]+\$\w{1,40}[\)\s\{]+(\$\w{1,40})\s*\[['"]http_user_agent['"]\][=\s]+\$\w{1,40}[\s;]+echo\s*\w+[\(\s]+\$\w{1,40}[,\s]+\33[\)\s;\?><ph]+\32[\(\)\s;]+\}(?<X1248521>))|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/(?:[fz][^'"]+['"]\s*;[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\35[\s\)]+;[^\}]+\$\w{1,40}\s*=\s*['"][^'"]*['"]\s*;\s*\}(?<X1279490>)|[zf][^'"]+['"]\h*;(?:[^,]{0,499}function\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\37[\)\s;<\?>ph]+(?:exit|die|return)\b[^\}\?;]*;(?<X1249490>)|\h*(function)\s*(\w+)[\(\)\s\{]+(?:(?:return|echo|print)[\s;]*(?:(?:exit|die)\b[^\}]*)?)?\}\s*\39\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\41[\)\s;<\?>ph]+(?:\40[\(\)\s;]+|(?:exit|die)\b[^\}]+)?\}(?<X1248883>))))|\s*['"]unlink['"]\s*;\s*\$\w+\s*=\s*['"]base64_decode['"]\s*;\s*\$\w+\s*=\s*\$_SERVER\s*\[['"]D[^\]]+\][^!\n]{9,499}\bif[\(\s]+!\$\w+[\(\s]+(\$\w+)\s*\)[^@]{9,499}@(\$\w+)[\s\(]+\43\s*,[^\}]+@\44[\s\(]+\43[,\s]+\d?444[\);\s]+\}\s*\}(?<X1272310>)|\s*['"]wp_v?cd['"]\s*;\s*\$\w{1,40}\s*=\s*__FILE__\s*;[^\\]{99,9999}\bif[\(\s]+fwrite[\(\s]+\$\w{1,40}[,\s"'']+<\?[ph\s]+\\n[^\*>]{999,9999}\bextract[\(\s]+\w{1,40}[\(\s]+\$\w{1,40}[\s\);]+\}(?:\s*\}){1,2}(?<X1217291>)|\s*[^;]{1,99};\s*if\s*\(\s*[^\$]{40,99}(\$\w{1,40})\s*\)\s*and\s*isset\s*\(\s*\47[^!]{20,400}?(\$\w{1,40})\s*=\s*[^;]+;\s*if\(\s*!\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\49(?:e|\\x65)\w?.?['"]\s*,\s*\48[^\)]{1,9}\)\s*\)\s*;\s*die\s*\([^\)]{0,40}\)\s*;?(?<X1059542>)|\s*\$\w+\((?:'[^']+'\);\s*\$\w+=\$\w+\(\$\w+\(\)\);\$\w+\(\);\s*\$\w+\(\$\w+,"\$\w+\((?<X2045352>)|\s*""\s*,\s*\$\w+\(\s*\$\w+\(\s*array\(\$\w+\{\d+\}\s*,\s*"\\n"\s*\),\s*"",\s*"[^"]+"\s*\)(?<X2045331>))|\s*\$\w{1,40}\(\s*null\s*\.\s*\$\w{1,40}\s*\((?<X2050620>)|\s*\$\w{1,40}\s*(?:\(\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*,\s*'[^']*'\s*\)\s*;(?<X2046310>)|\.\s*['"]\d{1,3}(?:\.\d{1,3}){3}/[fz]\w+/?['"];[^\*\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}[^\?>\n]{0,199}\b\w+\s*\(\s*\)\s*;(?<X1263310>)|\[\s*\(int\)rOuND\s*\([\-\s]*\d+\.\d+\s*[\+\-/\*][^;]+;[^\n]{99,}(\$\w+)\s*=\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+!empty[\(\s]+\56[\)\s]+\{\s*echo\56\s*;\s*(?:exit|die)[^\}=\n\$]*\}\}\}\}(?<X1253320>))|\s*\$_(?:GET|POST|COOKIE|REQUEST);.{100,300}var_dump\(\$\w{1,40}\(\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\);\s*\}\s*\?>(?<X1040481>)|\s*\$_[GPRC]\w{2,6}\s*;[\s\(]*count[\s\(]+\$\w{1,40}\s*\)[^;\(]*in_array\s*\(\s*gettype\s*\(\s*(\$\w{1,40})[\s\)\.]+count[\s\(]+\59[^:;]{40,999}:\s*\59\s*;(?<X1205550>))
\$\w{1,40}\s*=(?:\s*\$_[GPRSC]\w{2,6}(?:\[[^\]]+\](?:;(?:\s*\$\w{1,40}\s*=\s*['"][^"']*['"];){2}\s*(\$\w{1,40})\s*=\s*array\((?:\d+,){2,}\s*\d+\);\s*foreach\(\1\s*as\s*(\$\w{1,40})\)\{\s*(\$\w{1,40})\s*\.\s*=\s*\$\w{1,40}\[\2\];\s*\}\s*(\$\w{1,40})\s*=\s*strrev\([^)]+\);\s*\$\w{1,40}\s*=\s*\4\("[^"]*",\s*\3\(\$\w{1,40}\)\);\s*\$\w{1,40}\(\);\s*return;(?<X1037061>)|\s*;\s*echo\s*(\$\w{1,40})\s*=\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\?\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*[^\?]{9,99}ob_start\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\6\s*\)\s*\{\s*echo\s*\6\s*;\s*\}\s*ob_end_flush\s*\(\s*\)\s*;(?<X1037571>))|\s*;\s*\$\w{1,40}[=\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-\*]\s*\d[^\n\*]{99,}/\*\s*<(?:[^@#\?]{9,9999}\?\s*\$GLOBALS\s*\[)+[^@#!]{99,}!=[^@#!]{99,}\bif[\(\s]+!\s*\$\w+\s*\[[^\>\?]{99,}\bwhile[\(\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-\*]\s*\d[^;\{\}]+;(?<X1258430>)|\s*\['\w+'\]\s*\(\s*''\s*,\s*\$_[GPRSC]\w{2,6}\s*\[\s*'\w+'\s*\]\s*\(\s*\$_POST\[\s*'\w+'\s*\]\s*\)\s*\)\s*;[^`]+?iterator_apply\s*\(\s*\$\w+\s*,\s*\$\w+,\s*array\s*\(\s*\$\w+\s*\)\s*\)\s*;(?<X2036192>)|\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*iconv\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*file_get_contents\s*\(\s*"http://[^"]*"\s*\)\s*\)\s*;(?<X1038171>))|\s*\$_COOKIE(?:[;\s\(\)]*(\$\w{1,40})[\s\)]*=+\s*\d+[\s&]+in_array[\s\(]+serialize[\s\(]+\11[\s\)\.]+count[\s\(]+\11[^;\?]+\?[\s\(]+\11\[\d+\]\s*=[^;:]+:\s*\11\s*;(?<X1248390>)|\s*;(?:\s*\$\w{1,40}\s*=\s*round\s*\(\s*\d+(?:\.\d+)?\s*[\+\-\*/][^:]+;)+\s*if[\s\(]+round[\s\(]+\d+(?:\.\d+)?\s*[\+\-\*/][^;]+;[^@#%]{999,}\$GLOBALS\[[^\]]+\]\[[^\]]+\]\(\$_COOKIE,[^:]+;\s*\}(?<X1261220>))|\s*\$_SERVER(?:\[['"]HTTP_HOST['"]\];\s*if[\s\(]+\$\w{1,40}\s*==+\s*['"][^'"]+['"][\)\s]*\{\s*\$\w{1,40}\s*=\s*@\$_REQUEST\[[^\]]+\];[^#]{99,9999}\$\w+\s*=\s*str_replace[\(\s]+['"]\[[^\*]{9,9999}\}\h*/\*[^\*\n]{0,32}\*/(?<X1259041>)|\s*\[['"]HTTP_ACCEPT_LANGUAGE['"]\];\s*\$\w{1,40}\s*=\s*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^;\?]+\?\w+=['"]\s*\.\s*\$\w+;\s*(\$\w+)\s*=\s*curl_init\(\);[^!]{1,999}(\$\w+)\s*=\s*curl_exec[\(\s]+\15[^\}]+\bheader[\(\s]+['"]Location\s*:\s*\16['"][\);\s]+\}(?<X1284970>))|\s*\$dir\.DIRECTORY_SEPARATOR;\s*chmod\(\$\w+\.DIRECTORY_SEPARATOR\.'index\.php', 0644\);\s*\$\w+\s*=\s*fopen\(\$\w+\.DIRECTORY_SEPARATOR\.'index\.php'\s*,\s*"r"\);(?<X2046770>)|\s*\$GLOBALS\s*\[\s*\w+\s*\(\s*['"][^;%]{0,19}%[^;]+(\$\w+)[^;]+;[^\{\}]{0,999}\{\s*\$\w+\s*=\s*\$\w+\s*\[\s*\19\s*\]\s*;[^\{\}]+(\$\w{1,40})\s*=\s*\$\w{1,40}\s*;\s*include(?:_once)?[\(\s]+\20[\)\s]+;[^\{\}]{0,99}\}(?<X1255300>)|\s*\(\s*mktime\s*\(\s*\)\s*-\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\|\|\s*\$\w{1,40}\s*\)\s*\{\s*return\s*array\s*\(\s*'NO'\s*,\s*\$\w{1,40}\s*,\s*implode\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*else\s*\{(?<X2048210>)|\s*\d{1,10};\s*\$GLOBALS\[['"](\w{1,40})['"]\]\s*=\s*Array\(\);\s*global\s*\$\23;[^\176]{9,199}(?:[^;]{0,49};\$\23\[['"]\w+['"]\]\h*=\h*\$_[GPRSC]\w{2,6};[^\{]{1,499}\{\s*define\s*\(\s*['"]ALREADY_RUN_\w*['"]\s*,\s*\d\s*\);[^`]{99,999}eval[^\}]{1,40}\}\s*(?:exit|die)[\s\(\)\};\d]{5,19}(?<X1128098>)|[^;]{0,999};(?:\$\23\[)+['"]\w+['"]\]\[\d+\][^;]+;[^\*]{9,}\{@?eval/\*[^\*]+\*/\(\$\w+\[\$\w+\[[^\]]+\]\[[^\]]+\]\]\);\}@?exit\(\);\}\}(?<X1263803>))|\s*\w{1,40}[\(\s]+(base64_decode)[\(\s]+['"]aHR0cHM6Ly90Lm1lL3[^'";]+['"][\s\)]+;(?:\s*if[\s\(!]+\$\w+[\)\s]*\{\s*\})?\s*if[\s\(!]+(\$\w+)[\)\s]*\{\s*(\$\w+)[=\s]+fopen[\s\(]+\$\w+[\s,]+\26[\s\(]+['"]dy[^'"]+['"][\s\);]+fwrite[\s\(]+\28[,\s]+base64_encode[\s\(]+\27[\s\);]+fclose[\s\(]+\28[^\}]+\}(?<X1259180>)|\s*Array\((?:[^;]+;\$\w{1,40}\s*=\s*Array\([^;]+;\s*@\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038290>)|\s*(?:(?:'\w'\s*=>\s*'\w'\s*,\s*){25}[^\)]{9,999}\);\s*@?eval(?:/\*[^\*]{0,40}\*)?/\(\s*\w{1,40}\(\$\w{1,40}\s*,\s*\$\w{1,40}\)\s*\);(?<X2045275>)|[^;]+;\s*\$\w+\[chr\(\s*\d+\s*\)\s*]\(bd\(\s*['"][^'"]+['"]\s*\)\s*\);\s*\$\w+\[\s*chr\(\s*\d+\s*\)\s*\]\(\s*\w+\(\s*['"][^'"]+['"]\s*\)\s*\);(?<X2046180>)))|\s*array\s*\((?:[^)]+\)\s*;\s*\$\w{1,40}\s*=\s*implode\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;(?<X1038590>)|[^;]{1,499}\b[cpv](?:ialis|iagra|enis)\b[^;]{1,499};[^\{\}\?:/]{1,499}\bwhile\s*\([^\?#%>]{1,1499}\bheader\s*\(\s*['"]location\s*:[^;]{1,199};[^@#%><]{1,999}\b(?:die|exit)[^;]{0,19};[\}\s]+\$\w{1,40}\s*\++;\s*\}(?<X1188554>))|\s*base64_decode(?:[\('"\s]+aHR0[^;]+;\s*\$\w{1,40}\s*\[[^\]]+\][=\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]*\?[^;]+;[^\n%]{99,}\$\w{1,40}[=\s]+["']https?://%s/ping\?[^\n@]{99,}@gzuncompress\s*\([^\n]+\$\w+\+\+;\s*\}(?<X1253050>)|[\(\s]+["']aHR0c[^;]+;\s*\$\w+\[[^\]]+\]\s*=\s*isset[\(\s]+(?:\$_SERVER\s*\[[^\]]+\][\s\)\?:]*){2,};[^@\n]{0,999}(\$\w+)[=\s]+@preg_split[\(\s]+['"](.)\{\\\|\}\37\w+['"]\s*,[^@\n]{1,999}@header[\s\(]+\36\[[^\}]+\b(?:die|exit)\b[^;]*;[\s\}]*\$\w+\+\+[;\s]*\}(?<X1276850>)|\s*\(\s*\$(?:\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*substr\s*\(\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*,\s*0\s*,\s*strlen\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*\.\s*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*'gzinflate'\s*;(?<X2047430>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*header\s*\(\s*"Pragma: hack"\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\.\s*\(\s*string\s*\)\s*\(\s*filesize\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*header\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*readfile\s*\(\s*\$\w{1,40}\s*\)\s*;\s*exit\s*;(?<X1037600>)))|\s*class_exists(?:[\(\s]+\$\w+[\)\s]+;(?:(?:\s*\$\w{1,40}[=\s]+(?:['"][^'"]+['"]|\$\w+|false)\s*;)*\s*if[\s\(]+\$\w+\s*==+\s*\$\w+[\s\)]+\{[^:\n]{0,499}\bclass\s*(\w+)\s*\{[^\*\n]+\}\s*\$\w+\s*=\s*new\s*/\*[^\*\n]*\*/\s*\41\s*\([^\}\n]{0,199}\}(?<X1258270>)|[^\n\*]{9,}\$\w{1,40}\s*=\s*new\s*/\*[^\*\n]*\*/\s*\w+\s*\([^\n<]{99,}\}\h*\w+[\h\(\);]+\}(?<X1265510>))|\(\$\w+\);(?:[^\n\*]{0,499}\$\w+\h*=\h*new\h*/\*[^\*]*\*/\h*\w+\h*\([^\?\n]{9,19999}\b\w+[\(\);\s]+\}(?<X1265821>)|\s*(?:\$\w+\s*=\s*(?:['"][^'"]+['"]|\$\w+|false|0|null|!1)[\s;]*)*\bif[\s\(]+\$\w{1,40}\s*==+\s*\$\w{1,40}[\s\)]+\{[^\n\*]{99,}\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\$?\w+\s*\([^;]+;[^\}]*\}(?<X1258642>)))|\s*count[\s\(]+\$\w{1,40}[\)\s]+;\s*if[\s\(]+\$\w{1,40}[^\)]*\)\s*\{\s*@?header[\s\(]+(\$\w+)\[\d+\]\s*\.\s*\46\[\d+\][^;]+;[^\n]{9,}\46\[\d+\]\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1256160>)|\s*date\("D M d, Y g:i a"\);\s*\$ip\s*=\s*getenv\(\s*"REMOTE_ADDR"\s*\);\s*\$username\s*=\s*\$_POST\[\s*['"][^"']+['"]\s*\];\s*\$password(?<X2047840>)|\s*explode(?:\(\s*["']\|["']\s*,\s*(?:\s*base64_decode\(){3,}\s*\$\w+\s*(?:\)\s*)+;(?<X2046291>)|\s*\(\s*'\|'\s*,\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*mail\s*\(\s*stripslashes\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*,(?<X2048630>))|\s*fopen\(\s*"temp1-1\.php"\s*,\s*"w"\s*\);\s*fputs\(\$\w+\s*,\s*"<\?php(?<X2047180>)|\s*fsockopen\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*30\s*\)\s*;\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\{\s*print(?:it|r)?\s*\(\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*exit\s*\(\s*\d?\s*\)\s*;\s*\}\s*//\s*Spawn\s+shell\s+process(?<X2054380>))
\$(?:\w{1,40}\s*=(?:\s*get(?:cwd\(\);\s*(\$\w{1,40})\s*\=\s*['"\s\.base64_dco]{13,40}\s*;\s*\$\w{1,40}\s*=\s*['"]/app/code/core/Mage['"];\s*\$\w{1,40}\s*=\s*\1\(['"][^'"]{1,40}['"]\);(?<X2055490>)|env\("SCRIPT_NAME"\);\s*\$\w+\s*=\s*getenv\("SCRIPT_FILENAME"\);\s*\$\w+\s*=\s*substr\(\$\w+,\s*0,\s*strpos\(\$\w+,\s*\$\w+\)\);\s*\$\w+\s*=\s*\$\w+\s*\.\s*'/xm1rpc\.php';\s*if\s*\(!file_exists\(\$\w+\)\s*\|\|\s*file_exists\(\$\w+\)\s*&&\s*\(filesize\(\$\w+\)\s*<\s*3000\)\s*\|\|\s*file_exists\(\$\w+\)\s*&&\s*\(time\(\)\s*-\s*filemtime\(\$\w+\)\s*>\s*60\s*\*\s*60\s*\*\s*1\)\)\s*{\s*file_put_content.+?\$enc1\s*=\s*\$enc2\s*=\s*\$enc3\s*=\s*\$enc4\s*=\s*"";\s*}\s*while\s*\(\$i\s*<\s*strlen\(\$\w+\)\);\s*return\s*\$\w+;\s*}(?<X1035640>))|\s*glob[\(\s]+['"]/home\d*/\*['"]\s*,\s*\w+[\)\s]+;[^\?]+\$\w{1,40}[=\s]+['"]<\?php[^#]{999,}@?file_put_contents[\(\s]+(\$\w+)\s*,\s*\$\w+[\)\s]+;\s*@?include(?:_once)?\s*\4\s*;\s*@?unlink[\(\s]+__FILE__[\)\s]+;(?<X1279530>)|\s*http_get\s*\('https://pastebin\.com/raw(?<X2049000>)|\s*JOkEr7\('https://www\.paypal\.com/(?<X2048150>)|\s*MIME::Base64::decode\s*\(\s*\$cheataer\s*\)\s*;(?<X2051910>)|\s*new\s*(?:Get_links\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}-\s*>\s*return_links\s*\(\s*\$\w{1,40}\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*(?<X1037800>)|PclZip\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}-\s*>\s*extract\s*\(\s*\)\s*==\s*\d+\s*\)\s*\{\s*die\s*\(\s*"[^"]*"\s*\.\s*\$\w{1,40}-\s*>\s*errorInfo\s*\(\s*true\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*die\s*\(\s*"[^"]*"\s*\)\s*;\s*\}\s*\?>(?<X2046280>))|\s*pack[\(\s]+(?:["']H\*['"][\s,]+(?:['"]\$?\w+['"]\s*\.\s*['"\$][^;]+;\s*if[\s\(]+isset[\s\(]+\$_POST\s*\[\s*(\$\w+)\s*\][\s\)]+\{\s*\11\s*=\s*pack[\s\(]+['"]H\*['"][,\s]+\$_POST\s*\[\s*\11[^\\]+\bjoin[\s\(]+['"]\\[^\*>\?<#@]+\bprint\s*\$\w+\s*;\s*\}\s*\}\s*(?:exit|die)\b[^;]*;\s*\}(?<X1287690>)|\$\w{1,40}[\.\s]+\$[^;]+;\s*if[\(\s]+isset[\(\s]+\$_POST\s*\[\s*(\$\w+)\s*\][\s\)]+\{\s*\13[\s=]+pack[\s\(]+["']H\*['"][\s,]+\$_POST\s*\[\s*\13\s*\][\s\)]+;[^\\]+\bjoin[\(\s]+['"]\\n[^>\*\?%#\^]+print\s*\$\w+[;\s]*\}\s*\}\s*(?:exit|die)\b[^;]*;\s*\}(?<X1287681>))|['"]H\*['"]\s*,\s*(?:[\$'"]\w{1,40}['"]?|['"]\d+['"])\s*\.[^;]+\)\s*;\s*if[\(\s]+isset[\(\s]+(\$_POST)\[(\$\w+)+\][\)\s]+\{\s*\16[=\s]+pack[\(\s]+['"]H\*['"]\s*,\s*\15\[\16\][\)\s]+;(?:[^\}]+\$\w+[\(\s]+\16[\);\s]+\})+\s*(?:exit|die)\b[^;]*;\s*\}(?<X1284451>))|\s*posix_getpwuid\(@?fileowner\(['"]/etc/valiases/['"]\.\$domains?\[\d\]\[\d\]\)\);\s*echo(?<X2052740>)|\s*range[\(\s]+['"]\w{1,2}['"]\s*,\s*['"]\w{1,2}['"][\)\s]+;\s*\$\w{1,40}[=\s]+explode[\(\s]+['"],['"],\s*['"]\d{1,2},\d{1,2},[^;]+;\s*(\$\w{1,40})[=\s]+['"]{2}\s*;[^,]{0,999}(?:(\$\w{1,40})[=\s]+\19\s*\([^;]+;\s*)+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\b[^;]*\20\s*;(?<X1274690>)|\s*str(?:len\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*for\s*\(\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*<\s*\$\w{1,40}\s*;\s*\$\w{1,40}\+\+\s*\)\s*\$\w{1,40}\s*\.\s*=\s*chr\s*\(\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\^\s*\$\w{1,40}\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X2047990>)|rev\s*\(\s*"(?:[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*"[^"]*"\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*\)\s*\)\s*;\s*eval(?<X2047600>)|edoced_46esab"\s*\)\s*;\s*include_once\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;(?<X1038890>))|rev\s*\(\s*'(?:[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\s*create_function\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*new\s*ArrayIterator\s*\(\s*array\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*iterator_apply\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*array\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1039040>)|[^)]*'\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST)\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*"[^"]*"\s*\)\s*;\s*error_reporting\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*str_replace.+?\s*\{\s*echo\s*\$\w{1,40}\s*;\s*\}\s*die\s*;\s*\}(?<X1038901>)))|\s*system\("wget\s+http:.+?;chmod\s+\d+\s+\w+;\./\w+"\);\s*echo\s+\$\w+;\s*system\("rm\s+\w+"\);(?<X2044251>))|\w{1,9}(?:[\s=]+\w{1,9}[\s\(]+@?\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE['"]\][^\}]+curl_setopt[\s\(]+\$\w{1,40}[,\s]+CURLOPT_URL[,'"\s]+https?://['"]\s*\.\s*\$cl\d+ip\s*\.[^\]>]{9,999}header[\s\(]+['"]Refresh[:\s]+\d+;[^?>!\]\(]{9,99}exit[;\s\}]+(?<X1259371>)|\h*(?:=\h*(?:((?:pwd|password|passwd|pass)\h*\(\));[^\}]{1,99}\}\s*(?:copy|move_uploaded_file)\h*\(\$_files\[['"]\w+['"]\]\[['"]tmp_name['"]\],[^\?]{9,799}function\h*\29\s*\{\s*(\$\w{1,9})\h*=\h*getcwd\h*\(\);\s*if\h*\(\$\w{1,9}\h*=\h*strrpos\h*\(\30,\h*['"]/['"]\)\)(?<X2178701>)|['"](\$\w{1,9})\h*=\h*fopen\(['"]\w{1,20}\.php['"],\h*['"]w['"]\);\s*fputs\h*\(\32,\h*['"]<\h*\?\h*php\s*error_reporting[^\{]{1,99}\{\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*=\h*stripslashes\h*\(\33\);[^;]{0,49};\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\33\);\s*\?>(?<X2185740>)|['"](rcs\-castore)['"];\s*\$\w{1,20}[\h=]+(array)[\s\(]+["']\35['"][\h=>]+\36\h*\((?<X2191230>)|['"]\w{1,20}['"];[^\(]{0,30}(\bif\h*\(isset\h*\(\h*)\$_COOKIE\[[^\.;\}]{1,99}\.\h*getcwd\h*\(\h*\)[^\}]{1,99}\}\s*(?:\38(\$_[GPRSC]\w{2,6}\[[^\)]+\)\))\s*\{\s*[@&]?eval\h*\(\h*base64_decode\h*\(\h*\39;[^\}]{0,49}\}\s*){2,4}(?<X1188282>)|\$header\.\$(?:password|pass|pwd)\.['"].(\$\w{1,9})\h*=\h*['"\\\._creatfunio]{17,39};.(\$b374k)\h*=\h*.\41\([^,]{5},['"eval\.]{4,11}[^\}]{1,30}\42(?<X2178403>)|\d+\h*;\s*(@?chmod[\h\(]+(['"]\./index\.php['"])[,\h]+)\d{3,4}[\)\h]+;[^#\*]{99,1999}\$\w{1,9}\h*=\h*@?(file_get_contents[\h\(]+)\45[\)\h]+;\s*\$\w{1,9}\h*=\h*@?\46['"]https?://api\.\w{0,49}\.xyz[^\?]{1,599}\}\s*\44\d{3,4}[\)\h]+;(?<X1189615>)|create_function\h*\(\$\w{1,9},['"](\$\w{1,9})\h*=\h*\(!empty\((\$_FILES\[['"]\w+['"]\])[\h\)]+\?file_get_contents\(\49\[['"]tmp_name['"]\]\)\s*\:\$_COOKIE[^#]{1,129}(\$\w{1,9})\h*=\h*(base64_decode)\(\48\)\^\51[^;]{1,40};\s*eval\(\50\);(?<X2184670>)|isset\h*\((\$_[GPRSC]\w{2,6})(\[['"]f_pp['"]\])\)\h*\?\h*\53\54\h*:\h*\(isset\((\$_COOKIE)\54\)\h*\?\h*\55\54\h*:\h*(?:null|0)\);[^\?>]{9999,25000}(\$\w{1,20})\h*=\h*create_function\h*\(['"]{2},[^\)]+\);\s*unset\h*\([^\)]+\);\s*\56\(\);(?<X2185711>)|pathinfo\h*\(\$\w{1,9}\h*=\h*strtok\h*\(\$\w{1,9}\h*=\h*@\$_SERVER\[[^#/]{99,999}(\$\w{1,9})\h*=\h*curl_getinfo\h*\([^\)]+\);\s*if\h*\(\58\h*\D{2,3}\d{3}\)\h*\{[^#]{99,500}\58\h*==\h*30\d+[\s\)]+\{\s*header\h*\(['"]Location:[^;]{0,40}\58\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1146222>))|\.=\h*['"]\W{1,40}priv(?:8|ate)\h*paypal\b(?<X2185353>))|\s*=\s*(?:(?:getenv\(|\$_SERVER\[)\s*['"]REMOTE_ADDR['"]\s*[\)\]][^\?]{1,999}(\$\w{1,20})\s*\.=\s*['"]\W{0,9}(?:CVV|CSC|SSN|CVN)\d?[^'"]{0,50}:[^;]{1,29}\$_POST\s*\[\s*['"](?:cvv|ssn)\d?['"]\s*\][^\{\}]{99,999}\bmail\s*\([^\)]{0,99}\61[^\)]{0,99}\)\s*;(?<X2134405>)|@ARGV;\s*print\s+['"]\W{0,9}ConnectBack\s+Backdoor\s+by\s+Rocu(?<X2120470>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=\s*getenv\s*\(['"]REMOTE_ADDR['"]\);[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|Card\s*(?:number|CVV|Exp)?|SSN)[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,900}mail\((?<X2133880>)|\\['"][a-z0-9=/\+]{16,8192}\\['"];\s*(?:\$\w{1,9}\s*=\s*\\['"][a-z0-9=/\+]{16,8192}\\['"];\s*){2,5}(?:@?file_put_contents\s*\((base64_decode\()[^\)]+\),\65[^\)]+\)\s*\);\s*){3,5}@?unlink\(__FILE__\);[^\)]+\);(?<X1061502>)|array\s*\(['"]Files['"]=>['"]FilesMan['"]\s*,\s*['"]Console(?<X2125530>)|getenv\s*\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,9}\s*=\s*json_decode\s*\(\s*file_get_contents\s*\([^\(]{9,250}(?:\$\w{1,40}\s*\.?=\s*['"](?:Username|Password):\s*['"]\.\$(?:login\[')?(?:username|password)(?:["']\])?\.['"]\\\w['"];\s*){2}[^\}]{9,999}(curl_)exec(\(\$\w{1,20}\);)\s*\68close\69(?<X1060043>)|MDgetIp\(\);[^@]{9,300}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|CVV|SSN|PIN|Exp)[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2134061>))|panel\h*=\h*['"]\s*try\s*\{\s*\$\w{1,40}\h*=\h*apply_filters\(\s*\\?['"]wp_authenticate_user\\?['"]\h*,[^;]+\);\s*if\(wp_check_password\([^\}]{9,499}\}\s*\}\s*catch\h+\(\h*Exception\h+\$\w{1,40}\)\s*\{(?<X2162930>)))
\$(?:\w{1,}\s*=\s*[\s_.GET"']+;\s*if\s*\((?:!empty|isset)\(\s*\$\{\s*\$\w+\s*\}\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*preg_replace\(\s*[^,]+\s*,\s*[\s"e.'Val]+\(\s*\$['"]\s*\.\s*\$\w+\s*\.\s*['"]\[\s*['"]\w+['"]\s*\]\)['"]\s*,\s*['"]['"]\);(?<X1036591>)|\w{1}=base64_decode\(['"]JHJlcV91[^'"]+oJGluZGF0YTEsJG[^'"]+['"],true\);(?<X1312490>)|\w{2,14}\s*\/\*\s*\w{1,14}\s*\*\/\s*=\s*\/\*\s*\w{1,14}\s*\*\/\s*['"]?\d{1,5}['"]?;(?<X2264926>)|\w{2,16}\.=['"][\\xa-f0-9_]{4,99}['"];\s*if\s*\(\s*function_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?\$\w{1,40}\s*\(\s*['"]{2}\s*,\s*@?\$\w{1,40}\s*\(\s*@?\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)+;(?:\s*if\s*\([^;\}\{]+\{?\s*)?@?\4\(\)\s*;(?:\s*\})?(?:\s*else\s*\{[^\}]+\})?(?:\s*;)?(?<X1133590>)|\w{200,4999}\s*=\s*['"][^'"]+['"]\s*;(?:\s*\$\w{200,4999}\s*=\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev|convert_uudecode)\s*\([^\$]{0,99}\$\w{200,4999}\s*\)\s*;){2}[^\?{\}]{0,65000}\beval\s*\(\s*\$\w{200,4999}\s*\)\s*;(?<X1126391>)|\{(?:"(?:[^"]+"\}\["[^"]+"\]="[^"]+";\$\{"[^"]+"\}\["[^"]+"\]="[^"]+";\$\{"[^"]+"\}\["[^"]+"\]="[^"]+";(?:\$\w+="[^"]+";){2,}\$\{\$\w+\}.+"\)\);return;(?<X1035951>)|\\x\d+\\x[^;]+;\$\{\$\{.+\]\}\["\w"\]\);\}\}(?<X1054912>))|['"](?:(?:\\x47|G)(?:[^'"]{7,16}['"]\}\[[^\*]{1000,8000}\]\}\(\$\{\$\{["'][^'"]{1,40}["']\}\[["'][^"']{1,40}["']\]\}\);break;\}CASE\s+\d+:\{call_user_func_array\(["'][^"']{1,40}["'],array\(\$_REQUEST\[["'][^'"]{1,40}["']\]\)\);break;\}\}\}\}(?<X1042031>)|[^\}]+\}\[[^\]]+\]\s*=\s*['"][^'"]+['"];[^@]{400,3000}@ob_start\(\);\s*error_reporting\([^\)]*\);\s*(?:@ini_set\([^\)]+\);\s*){2,3}[^\?]{99,1500}</[^>]+>['"];\s*move_uploaded_file\s*\(\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\s*\}\s*,\s*\$\{\$\w{1,20}\}\);\s*\}(?<X1124740>))|(GLOBALS)['"]\}\[['"]\w+\${['"]\11['"]\}\["\w+['"]\]=['"]_COOKIE['"];\$\{['"]\11[^:]{99,}://\d+\.\d+\.\d+\.\d+\/api[^\.]+\.\$\{\$\{['"]GLOBALS['"]\}[^!]+http['"]\)!==false\)\{header\(['"]Location:\$\{\$\{['"]\11['"]\}\[['"]\w+['"]\]\}['"]\);\}{3}(?<X1297030>)|GLOBALS['"]\}\[(?:['"]\w{4,9}['"]\]=['"]crack_?ftp['"];(?<X2123680>)|[^\]]+\]=['"](?:[^'"]+['"];\$\w{1,20}=['"]default_action['"];\$\{[^\}]+\}\[[^\]]+\]=['"](?:auth|s)_pass['"];(?<X2134383>)|auth_pass['"];\$[^=]{1,40}=['"]root['"];[^@%\?]{399,999}\bfunction\s+is_?(?:joomla|drupal|wp|wordpress)_?root\h*\((?<X2151861>))|[^\]]+\][=\s]+['"]_HEADERS['"]\s*;\s*(\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\])\s*\}[=\s]+getallheaders[\(\)\s;]+if[\(\s]+isset[\(\s]+\16\s*\}\s*\[[^\]]+\][\s\)]+\{[^\?<]{0,499}\}[\s=]+['"]<\?[^\}]+@eval[\(\s]+\$_HEADERS\[[^\]]+\][\)\s;]+["']\s*;[^=]+=\s*['"]/tmp/\.["']\s*\.\s*time[\(\)\s]+;(?<X2228010>)))|\$(?:\w{1,40}\}=unserialize\(\w+\(base64_decode\([^;]+;if\(isset\(\$\{\$\w{1,40}\}\[['"]ak['"]\]\)[^\?]{99,199}(\$\{\$\{['"]GLOBALS['"]\}\[)['"]\w+['"]\]\}=Array\(['"]pv['"]=>phpversion\(\),[^\?]{9,99}eval\(\18['"]\w+['"]\]\}\[['"]\w+['"]\]\);\}\}(?:\?>)+\Z(?<X2131860>)|\{['"](?:[^'"]{1,60}['"]\}\[['"][^'"]{1,60}['"]\]\}=['"]/['"]\.uniqid\(\)\.uniqid\(\);(?<X2052550>)|[GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[=\s]+curl_init\s*\(\);\h*curl_setopt[\(\s]+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[,\s]+CURLOPT_URL[,\s]+['"]https?://\w+\.[a-z]{2,3}/[^'"]+\.txt['"][\s\)]+;[^\n\?]{99,999}\becho\s*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\};(?<X1231810>)|GLOBALS['"]\}\[[^\]]+\]\}\s*=\s*['"]FilesMan['"];\s*\$\{(?<X2129462>))))|_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[.p1.\]\); else @unlink\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?<X2043862>)|(GET|POST|REQUEST|COOKIE)\[\s*"\w{1,40}"\s*\]\s*\?\s*\$_\24\[\s*"\w{1,40}"\s*\]\s*\(\s*\$_\24\[\s*"\w{1,40}"\s*\]\s*\)\s*:\s*null;(?<X1040380>))|_+\s*=\s*"[^;]+;\s*eval\(\$_+\(\$_+\)\);(?<X2049640>)|_?(?:passw?o?r?d?|auth_pass)\h*=\h*["']\w{32}['"];[^\$]{0,60}\$h[ea]c?ker\h*=(?<X2172170>)|_(?:[GPRSC]\w{2,6}\s*\[(?:'\w+'\]\(\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\(\s*'',\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\s*\)\s*\)\s*\)\s*;(?<X1036031>)|[^\]]+\]\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\(["']["']\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\);(?<X1035581>))|[O0]*="[a-f0-9]{32}";\$_[O0]*=str_rot13\(.*?eval\(strrev\('.*?'.*?eval\(_[0O]*\(_[0O]*\(".*"\),\$_[0O]*\)\);eval\(_[0O]*\(\$_[0O]*\)\);\$\w+='.*?';(?<X1034831>)|\d=\$_(?:REQUEST|GET|POST)\['id'\];\s*(?:\$_\d=["']\w{1,5}['"];\s*)?\$_\d=curl_init\(\);\s*\$_\d='http(?<X2050041>)|\w{1,40}\s*=\s*basename\s*\(\s*trim\s*\(\s*preg_replace\s*\(\s*rawurldecode\s*\(\s*"[^"]{1,200}"\s*\)\s*,\s*''\s*,\s*__FILE__\s*\)\s*\)\s*\)\s*;(?<X2055011>)|_=hex2ascii\(\$_+\);\s*\$.="\$_+";\s*\$.=[eval\."'\s]+\(\$.\)';\s*assert\(\$.\);(?<X2045401>)|COOKIE(?:\[["']fm_lang["']]\)\)\?[^\{]{1,99}\{\$\w+=file_get_contents\(['"][^'"]{1,99}github[^/]{1,99}/bayu123\-cpu/(?<X220332350>)|\s*=\s*WSOstripslashes(?<X2043911>))|F(?:=__FILE__;\$_X='P2lCPz5NY2VXKDxlbk1bVV85TTJPOU0oJzhDcjA5Qy5(?<X2047500>)|ILES\[[^\]]+\]\[[^\]]+\][\);\s@]+passthru[\(\s@\\]+\$_GET\s*\[(?:\s*['"])?\s*cmd[\]\s\)'"]+;(?<X2259610>))|POST(?:\[(?:"pwd"\]="Weak\s*Liver(?<X2048420>)|(['"]botID['"])\]\)\)\s*\$id\s*=\s*filterString\(\$_POST\[\39\]\);\s*if\s*\(\s*isset\s*\(\s*\$_POST\[['"]track['"]\](?<X2056460>)|['"](?:c(?:v[vc]|ardnumber)['"]\][^\?]{1,999}/sendMessage\?.{0,499}?\$_POST\[['"]otp['"]\](?<X2226520>)|d_b['"]\][^\{]+\{\s*echo\h*json_encode[\h\(\[]+DB_USER,\s*DB_PASSWORD,[^#]{9,399}\bwp_set_password\(\$\w+,\h*(\$\w+)\->(ID)\)[^\?]{9,399}\bif[\h\(]+isset[\h\(]+\$_GET\[['"]d_l['"]\][\s\S]{9,399}wp_set_auth_cookie\(\$\w+\->\43,[^#]{9,399}\42\->set_role\(['"]administrator['"]\);(?<X220361980>)|password['"]\][^\?]{499,1999}\$(headers)\h*=\h*['"][^;]{1,999}\bx\-mailer\h*:\h*PHP/['"]\h*\.\h*@?phpversion\(\);\s*@?mail\h*\([^\)]+\$\45\b[^;]{1,99};\s*(?:\?>\s*|echo\s*['"])<meta\b[^>]{1,99}\bhttp\-equiv=['"]refresh['"][^>]{1,99}\bcontent=['"]\d{1,5};\h*URL=[^\s]{0,9}\bthanks\.html?['"](?<X2155571>)|ssn1['"]\]\s*(?:\.\s*['"][^'"]*['"]\s*)?\.\s*\$_POST\[['"]ssn2['"]\]\s*(?:\.\s*['"][^'"]*['"]\s*)?\.\s*\$_POST\[['"]ssn3['"]\][^;]{0,99};[^\(]{1,2999}mail\s*\((?:\s*\$\w{1,40}\s*,?){4}\)\s*;(?<X2129900>)))|\h*\[['"]P(?:asswo?r?d|a?s?wd?)['"]\][^\?]{1,499}\bExcel\b(?:[^\?>]{1,499}\$\w{1,40}\->(?:ip|city|region|countryName|countryCode)\b){2}(?<X2166420>))|p(?:roxify\s*=\s*array\s*\([^\)]+\);\s*\$_version\s*=\s*['"]Ketika\s+Sahabat Menjadi\s+BANGSAT['"];(?<X2063320>)|wsa(?:.{99,6999}\bwebdmonitor\.io['"\s;]+\$\w+[\s=]+get_option[^\}]+\}[^\$]+\$\w+[\s=]+\w+[^\}]+[\}\s]+catch[^%]{1,699}wp_redirect[\(\s]+\$\w+[\s\);]+exit;[^\}]+[\}\s]+add_action[\s\(]+['"]\w+['"][,\s'"]+\w+['"\s\)]+;\s*\}(?<X1288940>)|[=\s]+['"]\w+['"];\s*\w+\(['"]\w+['"][^;]{1,256};\s*\w+[^\?]{1,9999}(_red)['"]\)\)\s*\{\s*error_reporting\(0\)[^\}]+_gcookie\(\$\w+\)\s*\{\s*return\s*isset\((\$_COOKIE\[\$\w+\])\)\s*\?\s*base64_decode\(\52\)\s*:\s*['"]+;[^\*#]+add_action\(['"]\w+['"],\s*['"]\51['"]\);\s*\}(?<X1324950>)))|REQUEST\[.\]\s*\?\s*eval\(\s*base64_decode\(\s*\$_REQUEST\[.\]\s*\)\s*\)\s*:\s*exit;(?<X1034441>)|S(?:=".{3000,20000}\);\$\w{1,40}=strrev\([^)]+\)[^(]+\("[^)]+\);\$\w{1,40}=\$\w{1,40}\('\$_S',\$_X\);\$\w{1,40}\(\$_S\);(?<X1039620>)|E(?:RVER\[['"](?:HTTP_USER_AGENT['"]\]\)\)\s*\{\s*header\(['"]HTTP/\d\.\d\h+404\h+Not\h*Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}\s*\?>[^/]{9,50}<title>[^/<]{0,40}\bUploader\b(?<X2158260>)|SERVER_NAME['"]\]\s*\.\s*['"]\W{0,9}PHP\s+Uploader(?:\s+by)?\s+M[0o]J[0o]['"];(?<X2121440>))|SSION\['(?:_ip_'\];\s*//+\s*\$LOGS\s*=\s*"\["\s*\.\s*date\(\s*'Y-m-d[^;]+;\s*file_put_contents\(\s*'[^']+'\s*,\s*\$LOGS\s*\.\s*PHP_EOL\s*,\s*FILE_APPEND\s*\);(?<X2046340>)|codeMethod'\]\['singleencoder'\]\s*=\s*'on';(?<X2261740>))|SSION\[['"]_LOOKUP_CNTRCODE_['"]\]\h*\.[^;]{1,99};\s*\?>(?<X2183522>))))|_{1,}=getallheaders\(\);if\(\w+\(\$_{1,}\[['"][^:]{1,99}:\$_{1,}="<\?(?:php)?\s*eval\(\$_HEADERS\[['"][^'"]+['"]\]\);['"];\$_{1,}=['"][^;]+;fIlE_pUT_contENTs\(\$_{1,},\$_{1,}\);\w+\(\$_{1,}\);unlink\(\$_{1,}\);endif;(?<X2324940>)|_{2,}\s*=\s*['"]PD9waHA[^'"](?<X220337910>))
\$(?:_{4,}[=\s]+['"]\d+['"];\s*(\$_{4,})[\s=]+['"][^\$'";]{40,}['"]\s*;\s*\$\w{1,40}[\s=]+['"][^'"\$]{9999,}['"]\s*;\s*@?(?:eval|assert)[\s\(]+html_entity_decode[\s\(]+(?:gz(?:inflate|uncompress))[\s\(]+base64_decode[\s\(]+\1[\s\)]+;(?<X1217110>)|a(?:\s*=\s*[\.\sbase64decode_"]+;\s*assert\(\$a\((?<X2044811>)|D(?:conn\s*=\s*new\s*adLDAP;\s*if\(\$ADconn->existingUser\(\$user\['username'\]\)\){\s*section\("Active\s*Directory",2\);\s*content\(\);(?<X2046740>)|min\[['"]p(?:ass(?:wo?r?d)?|wd?)['"]\]\h*=\h*['"]\w{1,60}['"];[^\(]{0,20}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*['"]ZXJyb3JfcmVwb3(?<X2159901>))|l(?:fa(?:\w{0,9}\->exec[\s\('"]+cmd\.exe(?<X2222470>)|_P(?:ass)?(?:wo?r?d)?\h*=\h*['"][a-f\d]{32}['"]\h*;[^\?]{1,999}\$\w{1,40}\h*=\h*file_get_contents\h*\(\h*__FILE__\h*\)\h*;(?<X2168670>))|lowed_referers\h*=\h*array\(["']m4st3r['"]\h*,\h*["']m1st3r['"]\);(?<X2171550>))|p(?:iurl=['"]https?://(?:[\d\.]{1,99}/\176x|ex\-)robotos(?:\.com)?/[^'"]{1,99}\.php['"];\$titlesArray=array\((?:['"](?:Verify|Confirm|(?:sign|log)\s*in\s*to)\s*your\b[^'"]{1,99}['"],){3}(?<X2177691>)|p=JFactory::getApplication\(\);\s*\$option5=\$app.+\(\$layout5=='default'\)\){echo\s*base64_decode\('[^']+'\);\s*}(?<X1038550>))|R(?:GC\s*!\s*=\d+\s*\)\s*\{\s*print\s+['"]\\n\+\s*mazacrew-bot\\n";(?<X2123660>)|r\s*=\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER);\s*foreach\s*\(\s*\$arr\s*as\s*\$\w{1,40}\s*=>\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*\$\w{1,40}\s*==\s*"\w{1,40}"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*end\(\$\w{1,40}\);.{1,100}echo\s*\$\w{1,40};\s*\}\s*\}(?<X1040461>))|su="move_";\s*\$asu\.="uploaded_";\s*\$asu\.="file";(?<X2048960>)|uth_pass(?:\h*=\h*(?:['"]|base64_decode\h*\()[^%\\\*]{999,2500}\bfunction\h+login_shell\h*\(\)\s*\{(?<X2180030>)|\s*=(?:.+;eval\("\\x65(?<X2045770>)|\s*"[^"]*"\s*;\s*\$color\s*=\s*"[^"]*"\s*;\s*\$default_use_ajax\s*=\s*true\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*"[^"]*"\s*\)\s*;(?<X1041440>)|\s*['"][^'"]*['"];[^\$]{1,600}(\$\w{1,40})\s*=\s*['"][^'"]{99,9999}['"];[^\$]{1,600}@?eval\(\s*gz(?:uncompress|inflate)\(\s*base64_decode\(\17\)\s*\)\s*\);(?<X2123180>)|\s*md5\s*\([^;]+;(?:\s*(\$\w{1,40})\h*=\h*str_rot13\h*\(\h*\\['"](?:tmhapbzcerff|fge_ebg13|onfr64_qrpbqr)\\['"]\h*\)\s*;){3}\s*@eval\s*\([^;'"]+\19\s*\(\s*['"][a-z\d\+/]{9999,}['"][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};(?<X1196410>))))|b?cc\h*=\h*['"]chiziahu['"]\h*\.\h*['"]@['"]\h*\.\h*['"]yandex\.com['"];(?<X2165900>)|b(?:ackdoor\h*=\h*['"]<\?php\h+goto\b(?<X2156260>)|c+\s*=[^;:]{1,199}https?://rei\.my\.id/(?<X2222420>)|ilsmg\h*\.\h*=\h*['"][^:]{0,20}\bwells\h*(?:fargo|card|email|[3e]pin|fullz)[^:]{1,40}\b(?:login|password|re[zs]ult)\b[^\*&]{99,999}mail\((?<X2155372>)|keyword_bez\h*=\h*['"][^'"]{3,199}['"];(?:\s*\$nick[1-4]\h*=\h*['"][^'"]{3,12}['"];){4}\s*\$date01\h*=(?<X2149340>)|lo(?:cked_words\s*=\s*array\([^\)]{99,900}\);[^/]{99,400}header\s*\(['"]\S{1,9}\s+(404\s+Not\s+Found)['"]\);\s*die\(['"]\S{1,9}\26[^\)]{9,60}\);\s*\}\s*\}\s*\$Bot\s*=\s*array\([^\)]{2000,9000}\);(?<X2065332>)|ginAttemptCaptured\(\$curPeriodEndingDate,\$quota_info\);(?<X1220330>))|ot\[['"]server['"]\]=\$servban\[rand\(0,count\((?<X2106251>))|c(?:a(?:che\w{0,9}\h*=\h*['"]wtuds['"]\h*;(?<X2171090>)|m(inhoMailer)\)\{include\s*\$cam\31;[^@]{99,499}\$mail->password=\$SendSenha;(?<X2125191>))|gish[3e]{1,2}ll\)\);\s*fclose\(\$wtf2\);\s*chmod\(\$file,0755\);(?<X2118831>)|heck_copyright\s*=\s*create_function[^\{\}]{0,599}\$global_version\s*=\s*array_walk\b(?<X2048292>)|o(?:de\s*=\s*'\s*<\?php\s*\$user_agent_to_filter = array\( \\'#Ask\\s\*Jeeves(?<X2046020>)|lor\s*=\s*"#df5";(?:.+?ololo_VERSION.+'\)\)\);\s*exit;(?<X1038730>)|\s(?<X2043552>))|nfig(?:\[['"]title['"]\]\h*=\h*['"][s5]h[e3]ll\h+C[o0]ntr[o0]ll[e3]r\h*['"]\h*\.(?<X2176080>)|\s*=\s*(?:\[\s*['"]\w+['"]\s*=>[^,]+,\s*['"]\w+['"]\s*=>\s*['"]\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65['"],(?<X220341000>)|array\(\s*['"]title['"]\s*=>\s*['"]B[A4]TM[A4]N\s+SH[e3]LL['"]\s*,(?<X2064280>)))|ntent(?:\h*=\h*gethttpcnt\h*\(\h*['"]https?://[^;]{1,99};\s*if\h*\(\h*stri?str\h*\(\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{\};]{99,199}\{\s*echo\h*\$content;\s*\}(?<X2154250>)|\s*=\s*http_request\(\s*"http://"\.\$_SERVER\['SERVER_NAME'\]\s*\.\s*"/\w+"\);\s*\$content\s*=\s*str_replace\(\s*"/\w+"\s*,\s*\$uri\s*, \$content\s*\);\s*exit\(\s*\$content\s*\);(?<X2047780>)|_mb=(?:getHTTPS?(?:Page)?|file_get_contents|Gethtml)\(\$\w{1,16}\.['"]/index\.(?:(?:x|p)?html?|php)\?(?:host|type)\b(?<X2045586>))|pyright\h*=\h*['"]&copy;\h*Rush\h*Security\h*Team\b(?<X2182100>)))|d?doss(?:tr)?;\s*\}\s*while\s*\(\s*\w{1,40}\s*\)\s*\{\s*\$[o0]{5,60}\s*=\s*@?include(?:_once)?\s*\(?\$[o0]{5,60}\)?;\s*if\s*\(\s*\$[o0]{5,60}\s*==\s*['"][^'"]{0,60}['"]\s*\)\s*\{\s*\$[o0]{5,60}\+\+;(?<X2052960>)|d(?:ata(?: = curl_get_from_webpage_one_time\(\$url(?<X2045601>)|(?:Table)?\s*=\s*\$LokiDbCon->(?<X2051771>)|\s*=\s*file_get_contents\('php://input'\);\s*if\s*\(strlen\(\$data\)\s*<=\s*4\)\s*d\('e0'\);(?<X2047690>))|efault_(?:action(?:=[FilesMan'\.]+;\s*\$color=['#df5\.]+;\s*\$default_use_ajax=true;(?<X2045341>)|\s*=\s*(?:['"\.]{0,4}['"]FilesMan['"];\s*(?:[^/]{1,199}\s*header\(['"]HTTP/1\.\d*\s*404\s+Not\s+Found['"]\);(?<X2125430>)|\$default_use_ajax\s*=\s*(?:true|1);(?<X2046892>))|['"]FilesMan['"];[^\(]{0,40}preg_replace\s*\(['"](.)[^'"]{1,5}\52e['"]\s*,(?<X2123430>)))|charset.*=\h*\.*\$dc\.\$dc2(?<X2043703>)|use_ajax\s*=\s*(?:true|1);(?:[^;]{0,50};\s*\$default_action\s*=\s*['"\.]{0,4}['"]FilesMan['"];(?<X2063440>)|\s*\$default_(?:action\s*=\s*['"][FilesMan'"\.]{9,25}['"];\s*\$default_charset\s*=\s*['"]['"\.Windows\-\d]{10,30}['"];(?<X2126921>)|charset\s*=\s*['"]['"\.Windows\-\d]{10,30}['"];\s*\$default_action\s*=\s*['"][Brutefoc'"\.ilsMan]{8,25}['"];(?<X2272500>))))|F[s5]Cmd\d*\s*=\s*array[\s\('"]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?<X2251050>)|ir\.[\'"]/[\'"]\.\$f\.[\'"]/wp\-config\.php(?<X2102781>)|l(?:\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['dl'\][\)\s]+;\s*\$cp\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['cp'\][\)\s]+;\s*\$cd\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['cd'\][\)\s]+;(?<X2047711>)|e['"]\s*\.\s*['"]_lic\s*=\s*['"]@E[^\n;]+;[^\}]+\$dle['"]\s*\.\s*['"]_conf\s*=\s*\$\w+['"]\s*\.\s*['"]\w+['"]\s*\.\s*['"]\w+\s*\(\s*\\?['"]\\?['"]\s*,\s*['"]\$dle_lic;?['"][\);\s]+\$dle_['"]\s*\.\s*['"]conf[\(\s]+\\?['"]\\?['"][\)\s]+;(?<X1212520>))|o(?:mains_dir\s*=\s*estimate_current_path\(\s*\);\s*process\s*\(\s*\$domain\s*,\s*\$domains_dir\s*\);\s*foreach\s*\(get_valid_dirs(?<X2049010>)|or(?:id|url)[\h=]+md5\h*\([^\$]{2,50};\s*\$door(?:id|url)\h*=(?<X2194201>)|p_query\s*=\s*@?file_get_contents\s*\(\s*\$\w{1,40}[^,\);]+\.ini['"]\s*,\s*FILE_IGNORE_NEW_LINES\s*\)\s*;(?<X2124420>)|uble\s*=\s*1;\s*}\s*\$email\s*=\s*urlencode\(\$email\);\s*if\s*\(!empty\(\$_SERVER\["HTTP_CF_CONNECTING_IP(?<X2049020>))|root=\$_SERVER\['DOCUMENT_ROOT'\];\s*\$link="<\?php\s*setcookie.{500,}?unlink\(\s*\$path\s*\.\s*"/footer\.php"\s*\);\s*rmdir\s*\(\s*\$path\s*\);(?<X1039680>))|e(?:mailusr\s*\.?=\s*['"][^@]{1,40}@protonmail\.com['"]\s*;(?:\s*\{)?\s*@?mail\([^;]{1,200}\)\s*;(?:\s*\})?\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2053961>)|n(?:coder57txt\h*=\h*['"]ZXZhbC[^'"]{99,300}['"];\s*\$r57txt\h*=(?<X2140250>)|gines\)\s*\{\s*if\s*\(preg_match\(\s*"/\$engines/"\s*,\s*\$_SERVER\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*echo\s*file_get_contents\(\$target(?<X2051250>))|x(?:_links\h*=\h*['"][^'"]{5,15}['"];[^\*`\^]{200,25000}\$\w{1,20}\h*=\h*['"]https?://promogoogledos\.\w{2,6}/['"];\$\w{1,20}\h*=\h*['"]https?://[^\?'";]{5,20}\?\w=\d['"];\s*\$\w{1,20}\h*=\h*['"]https?://[^/]{2,15}\.ru/\w{1,20}\.txt\b(?<X2159430>)|py\s*=\s*\$_POST\['expy'\];\s*\$cvv\s*=\s*\$_POST\['cvv'\];\s*\$ip\s*=\s*\$_SERVER\['REMOTE_ADDR'\];(?<X2048170>)|tention\s*==\s*'js'\s*\)\s*\)\s*\{\s*\$content\s*=\s*@file_get_contents\(\$dirname\s*\.\s*\$sobs(?<X2049370>))))
\$(?:f(?:f\s*=\s*\$f1\s*\.\s*\$f2\s*\.\s*\$f3;\s*if\s*\(file_exists\(\$ff\)\)\s*chmod\s*\(\$ff\s*,\s*0777\);(?<X2047390>)|il(?:e(?:\s*=\s*(?:"N-Cool-\$date\.sql\.gz";\s*\$gzip\s*=\s*TRUE;\s*\$silent\s*=\s*TRUE;(?<X2050830>)|\$exec_path\.\$drop_name;\s*drop_file\(\$file\s*,\s*\$\w{1,40}\);\s*\}\s*@chmod\(\$file\s*,\s*0777\);(?<X2051200>))|_content\s*=\s*httpget3\(REMOTE_FILE\s*,\s*\$context\);\s*\$file_name_array\s*=\s*explode(?<X2049870>)|_path = dirname\(__FILE__\) \. '/' \. basename\(\$_FILES\["file"\]\["name"\]\);\s*move_uploaded_file\(\$_FILES\["file"\]\["tmp_name"\], \$file_path\);\s*\$file_name = basename\(\$file_path\);(?<X2044591>)|sMan[\h=]+[^;]+;\s*if[\h\(]+\$_GET\[['"]hackncorp['"]\][^\{]+\{\s*if[\h\(]+isset[\h\(]+\$_POST\[['"]uploaded['"]\][\)\{\s]+\$file[\h=]+\$_FILES\[['"][^\n]{899,1200}\bUploader\h*Hidden\h*\W*</\w*>\h*<form\h*action=[^\n\?\}]{9,199}</html>['"];\h*\}(?<X1265741>))|ter\s*=\s*['"][^'"]{0,40}['"];\s*\$\w{1,40}\s*=\s*['"]\s*From\s*:\s*kay\s*<\s*mailist@mailist\.com\s*>\s*['"];(?<X2055750>))|inish_result\s*=\s*array_unique\(\$finish_result\);\s*foreach\s*\(\$finish_result(?<X2048510>)|older = str_replace\(\$_SERVER.+ http_build_query.+function http_parse_headers.+\$s \.= \$m\[2\]\.\$m\[3\];(?<X2044671>)|rom(?:\h*=\h*['"]ani-shell\b\$\w{1,20}@fbi\.gov['"];(?<X2140120>)|\s*=\s*['"][^'"]{1,40}['"]\s*;\s*\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:user|username|login))\s*=\s*\$_POST\[['"]\11['"]\];\s*\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:pass|password|passwd))\s*=\s*\$_POST\[['"]\12['"]\];(?<X2054801>))|u(?:ck_crawler\h*=\h*['"]\w{1,40}['"]\h*;[^\?\{\}\[\]>]{0,9999}\bfunction\h+\w{1,40}\h*\(\h*\)\s*\{\s*date_default_timezone_set\h*\((?<X2168391>)|llurl\s*=\s*""\s*\.\s*\$\w+\s*\.\s*"<br><p>Emails:<br><TEXTAREA.*?>"\s*\.\s*\$\w+\s*.\s*"</TEXTAREA></p><p>Engenharia:<br><TEXTAREA.*?>"\s*\.\s*\$mensagem\[\d+\]."</TEXTAREA>(?<X2045111>)))|g(?:___g_\s*=\s*\$(?<X2043571>)|et_size_of_file[\h=]+['"\h\.filesz]{5,35};[^\n]{99,200}(\$change_mode)[\h=]+['"\.\hchmod]{5,35};[^\n]{999,2000}\bcall_user_func[\h\(]+\17,\h*\$ht_path,\h*[\d\+\h]+\);\}\}(?<X1218040>)|host_homepage_title\s+=\s+(\$options)\[['"](ghost_homepage)_title['"]\]\s+\?\?\s+['"]Ghost\s+[\w\W]{1,20}\$\20_slug\s+=\s+\19\[['"]\20_slug['"]\]\s+\?\?\s+['"]content\-merkezi(?<X220364030>)|if=file\(dirname\(__FILE__\)\.'/images/\w+\.gif',2\);\$gif=\$gif\[\d+\]\("",\$gif\[\d+\]\(\$gif\[\d+]\)\);\$gif\(\);(?<X1034501>)|LOBALS(?:\[(?:'(?:\w+'\]\s*=\s*\$_SERVER;\s*function\s+\w+\(\$\w+\)\s*{\s*\$\w+\s*=\s*"";\s*global\s*\$\w+;\s*for\(\$\w+=intval\('\w+'\);.+?\${\w+\([^}]+}\s*=\s*@?\${\w+\([^}]+}\(\$\w+,\s*FALSE,\s*\${\w+\([^}]+}\);\s*return\s*\${\w+\(\s*[^}]+};\s*}(?<X1036111>)|_\d+_'\]\[\d+\]\(\$default_charset,\$auth_pass,\$color,\$default_charset\)(?<X2044541>)|Alfa_Protect_Shell'\](?<X2046070>))|['"](?:\w{1,13}["'\]\s=]+https?://(?:\w+\.)?(?:rorories|dermaxot|winbigprize)\.top['"];(?<X2284460>)|\w{1,9}['"]\]\[['"]b374k['"]\]\s*=\s*['"](?<X2124451>)|_XML_['"]\]\s*=\s*(Array)\s*\([^\)]{99,999}\);\s*\?>\s*<\?\s*function\s*XML\s*\(\$\w{1,20}\)\s*\{\s*\$\w{1,9}\s*=\s*\28\(['"](?:md\d|sha\d{1,3})['"]\s*,[^,]+,['"][^'"]{20,64}['"],\s*['"]ivanov['"],['"]vasil(?<X2122500>)|resources['"]\]\[['"](?:mime|gping\.c|xhide\.c|logs\.c|system_so_x64|system_so_x32)['"]\]\h*=\h*['"][^'"]{700,6000}['"];(?<X2266270>)|ver['"]\]\h*=\h*['"][\d\.]{1,9}['"];\s*\$GLOBALS\[['"]title['"]\]\h*=\h*['"]b374k['"];(?<X2151791>)|WP[_\-][VC]?CD(?:_CODE|_CD)?['"]\][\s\)]{1,40}\{\s*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"]wp[_\-]v?cd['"]\h*\)(?<X2157221>))|(?:[^=]+=array\((base64_decode)[^,]+,\33[^\,]+,\33[^\,]+,\33[^;]+;\s*\w+\s*[^\{]+\{\$\w+=array\(['"]\w+[^\}]+\}\s*eval\(gzuncompress\(\w+\(['"]+[\w/\-\+]{99,}['"]\){3};(?<X1306480>)|[^\?]{47500,48000}>404\s+Not\s+Found[^\?]{900,1000}\)\)\);\}else\{echo\s*\w{1,40}\(\d+\);\}\s*\Z(?<X2052480>)|[^\]]+\]=Array\(base64_decode\((?:[^#\n\\]{999,9999}\[round\(0\+[^\)]+\)\]\s*\.\s*\w{1,40}\s*\(\d+\)\s*,\s*\d+\s*\);\s*\}(?<X1126950>)|[^;]+;\s*(?:\?>\s*<\?(?:php|=)?\s*)?function\s*(\w{1,40})\((\$\w{1,40})\)\{(\$\w{1,40})=Array\([^;]+;\s*return\s*base64_decode\(\39\[\38\][^;]+;\s*\}\s*(?:\?>\s*<\?(?:php|=)?\s*)?\$\w{1,40}=[^;]+\37[^\n]+\37\(\d+\)[^;\n]+;(?:die|exit)[^;]{0,9};[^\}\n]{0,40}\}(?:endif;)?(?<X1124150>))|[^\]]+\]\h*=\h*(?:md|sha)\d+\(['"]aghacker['"]\);(?<X2162880>)|[^\]]+\]\s*=\s*(Array\()(?:base64_decode\([^\)]+\),?){9}[^;]{99,999}\);\s*(?:\?>\s*<\?)?\s*function\s+(\w{1,20})\((\$\w)\)\s*\{\s*(\$\w)\s*=\s*\42[^\)]{99,999}\);\s*return\s+base64_decode\(\45\[\44\]\);\s*\}[^\-]{999,3500};\s*(?:echo|print)[^;]+\43\(\d+\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1119631>)|[^]]+\]\s*=\s*\$_SERVER;\s*function\s*\w+\(\$\w+\)\s*{\s*\$\w+\s*=\s*["']['"]\s*;\s*global.+?\(\s*\$url\s*,\s*FALSE\s*,\s*\${\s*\w+\(\s*[^)]+\)\s*}\s*\);\s*return\s*\${\s*\w+\(\s*[^)]+\)\s*}\s*;\s*}(?<X1037220>)))|\h*\[\h*(\w{1,40})\h*\(\d+\)\h*\]\h*=\h*\48\h*\(\h*\d+\h*\)\h*;[^\?]+\$\w{1,40}\h*=\h*\48\h*\(\h*\d+\h*\)\h*;\s*\$\w{1,40}\h*=\h*\w{1,40}\h*\([^;]+\$pathtodor\h*,(?<X1177920>))|oweb\s*=\s*['"][\w\-\.]{4,}\.[a-z]{2,6}['"]\s*;\s*(\$\w{1,40})\s*=\s*(?:md5[\s\(@]+)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*if[\(\s]+\50\s*\S{2,3}\s*['"][a-f\d]{32}['"][\)\s]+\{[^%]{999,}\$\w{1,40}(?:\[\d+\])?\s*%[^\}]+\}[^\*]{9,}\breturn\s*\$file_contents[;\s]*\}(?<X1210950>)|roup_num[=\s]+['"][^'"]+['"];[^:]{0,199}\$\w{1,40}[=\s]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}/?['"][^\n]{999,9999}\becho\s*\$\w{1,40}[;\s]+\b(?:exit|die|return)\b[^;]{0,40};(?:\s*\})+(?:\s*else\s*\{[^\}]*\})?(?<X1223372>))|h(?:eader(?:\h*=\h*[^\}\(;]{1,20}<(title>)['"]\.getenv\(['"]http_host['"]\)\.[^<;]{1,20}\w{1,40}\h+shell\h*v[\d\.]+\h*</\53(?<X2173271>)|\s*\.?\s*=\s*quoted_printable_encode\s*\(\s*\$\w{1,40}\)\s*\.?['"]?(?:\\r)?\\n['"];\s*mail\s*\([^\)]{1,40}\);\s*print\s*['"]Spammed(?<X2052410>)|s\h*(?:=\h*['"]From:(?:[^<]{0,20}<codewizard@approject\.com\b(?<X2139320>)|\h*xAmericans\b[^\(\)]{9,99}\bmail\h*\((?<X2164380>))|\.?=\h*['"]From:(?:\h*C33\-O44\h*<(?<X2175150>)|\W{1,9}\bBGfullz\h*<(?<X2173680>))|\.?\h*=\h*['"]From:\h*myhack@hacks\.com['"](?<X2153630>))|s\s*=\s*(?:"From:\s*MafioZo0(?<X2046750>)|['"](?:[^'"]{0,40}DHL['"];\s*(\$\w{1,40})\s*=\s*array\s*\(\s*(\$\w{1,40})\s*\)\s*;\s*foreach\s*\(\s*\62\s*as\s*\63\s*\)\s*if\s*\(\s*mail\s*\(\s*\63\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*!=\s*false\s*\)\s*\{\s*header\s*\(\s*['"]Location:(?<X2054600>)|From:\s*Office['"];\s*\$str=array\((?:\$send)\);\s*foreach(?<X2054871>)))|s\s*\.?=\s*['"]From:\s*[^'"]{0,40}(?<!\$)Spam[^'"]{0,40}['"];(?<X2056128>))|idden_cmd[\s=]+['"]\w+['"];[^\}]{32,999}//\s*anti\-tespit:(?<X220365322>)|ost\h*=\h*['"]https?://[^;]+;\s*(\$\w{1,15})\h*=\h*\d;\s*\$goshop\h*=\h*empty\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{999,2999}\bif\((\$_SERVER\[)[^\]]+\]\h*==\h*['"]/['"]&&\68\)\s*\{\s*header[^<]{0,199}\becho\h*['"]<script[^#]{99,999}\bunlink[\(\s]+\69['"]DOCUMENT_ROOT['"]\]\h*\.\h*["']/xmlrpc\.php['"][\s\)]+;(?<X1197160>)|t(?:access\s*=\s*"https://pastebin\.com/raw/\w+";\s*\$file\s*=\s*file_get_contents\(\$htaccess(?<X2051290>)|ml\s*=\s*curl_exec\s*\(\$ch\);\s*curl_close\(\$ch\);\s*if\s*\(strstr\(\$id\s*,\s*"\.css"\s*\)\s*\)\{\s*header\('Content(?<X2049321>))))
\$(?:i(?:=strpos\(\$im,'\[UPD_CONTENT-'\);(?<X2044461>)|mgData\s*=\s*@\$p2\(@\$p1\(\$imgData\)\);(?<X2044261>)|n(?:dex[\h=]+(\$_SERVER\[[^\]]+\]\.['"]/)index\.php['"];\h*(\$\w{1,25})[\h=]+\3\.htaccess['"];\h*\$\w{1,25}[\h=]+[^;]+;\h*(\$\w{1,25})[\h=]+\3wp\-[^'"]+\.(?:gif|png|jpe?g)['"];[^\n]{0,599}\b(file_)put(_contents)[\h\(]+\4,\h*\6get\7[\h\(]+\5[\h\)]+;\h*\@?chmod[\h\(]+\4,\h*\d+[\h\)]+;\h*\}\h*\}(?<X1218870>)|stall_code\s*=\s*str_replace\s*\(\s*'\{\$PASSWORD\}'\s*,\s*\$install_hash\s*,\s*base64_decode\s*\(\s*\$install_code\s*\)\s*\);(?<X2048136>)|ter_domain(?:[\h=]+['"]https?://[^;]+;\$\w+[\h=]+['"][^'"]*['"];function\s*curl_get_contents\([^\?\n]{99,9999}\bbots[\h=]+['"]googlebot\|[^\n]{999,3000}=(getServerCont)\(\$\w+,\$\w+\);\h*header\([^\)]+\);[^\n]{99,}\b\10\(\$\w+,\$\w+\);\h*return;\}\h*echo\h*['"]<!DOCTYPE\h*html>['"];(?<X1233193>)|\s*=[^;]{9,};\s*function\s+\w+\s*\([^\}]+\}\s*function\s*(\w+)\s*\(\s*\$\w{1,40}[^\n]{999,}\$\w{1,40}\s*=\s*\12\s*\([^\n]{9,999}\}(?<X1232460>)))|p(?:[\h=]+getenv[\h\(]+[^\)]+\);\h*(\$\w+)[\h=]+isset[\h\(]+\$_POST\[['"]log['"]\]\)[^;]+;[^\n\{]{0,199}\{\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\16setopt[\h\(]+\15,[^,]+,\s*(base64_)decode\([^\)]+\)[\h\.]+\17encode[\h\(]+[^\)]{0,99}:\14\|[^\n]{0,199}\b\16close[\h\(]+\15[\h\)];\s*\}(?<X1236820>)|\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])(?:;(?:.{0,600}(\$(?:message|spam|bilsmg))\s*\.?=\s*['"][\[\]<>\!\*\&\s\:\|+\.=_\w\$'"]{7,99}\\n['"]\s*;(?:\s*\19\s*\.?=\s*['"]\s*(?!(?:Subscr|news))[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){1,12}\s*\19\s*\.?=\s*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{9,99}\\n['"]\s*;(?<X2052079>)|\s*.{0,600}\s*(\$data)\s*\.?=\s*['"][-\s\w]{10,90}\\n['"]\s*;(?:\s*\21\s*\.?=\s*['"](?:Email|Password|IP(?:Address)?)[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){2,3}\s*\21\s*\.?=\s*['"][-\s\w]{10,90}\\n['"]\s*;(?<X2056011>)|\s*//\s*\w{1,40}\s*(?:\s*\$\w{1,40}\s*=\s*\$_POST\[['"][^'"]{1,40}['"]\];){2,16}\s*\$fw2\s*=\s*fopen\((?<X2052161>)|\s*[^\?]{200,600}Social\s*Security\s*Number\s*:\s*\$ssn(?<X2054461>)|\s*\$(?:\w{1,40}\s*=\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*\$\w{1,40}\s*=\s*date\(['"][^'"]{1,40}['"]\);\s*(\$message)\s*\.?=\s*['"]Email[^\n]{1,40}\\n['"];\s*\25\s*\.?=\s*['"]Password(?<X2054060>)|datamasii\s*=\s*date\(['"][^'"]{1,40}['"]\);\s*\$(user|userid|login|email)\s*=\s*\$HTTP_POST_VARS\s*\[\s*['"]\27['"]\s*\]\s*;\s*\$(pass|password|pwd)\s*=\s*\$HTTP_POST_VARS\s*\[\s*['"]\28['"]\s*\]\s*;\s*[^\?]{1,600}\s+@?mail\s*\((?<X2053971>)|from\s*=\s*['"]From:\s*\w{0,39}\s*<?hacker@(?<X2054640>))|\s*\}(?:\s*session_destroy\(\);)?\s*(\$fp)\s*=\s*fopen\(['"][^'"]{1,40}['"],\s*['"]a\+?['"]\);\s*fwrite\(\31[^;><\?'"]{1,40}['"]<\?[ph\s]*echo\b[^\?]+\bcv[vc]\d*(?<X2052221>))|\s*;\s*(?:\$\w{1,40}\s*\.?=\.?\s*[^;]{1,80}\s*;\s*){4,8}\s*@?mail\([^)]{1,80}\)\s*;\s*header\s*\(\s*['"]Location\s*:[^)]+\);\s*exit;\s*\?>(?<X2052360>))|\$_SERVER\['REMOTE_ADDR'\];\s*\}\s*\$referrer = urlencode\(@\$_SERVER\['HTTP_REFERER'\]\);\s*\$url = "http://\d+\.\d+\.\d+\.\d+/api\.php\?is_api=1&action=get&api_key(?<X2049770>)|get(?:_?Client_?Ip\h*\(\)\h*;.{0,600}(\$(?:message|spam|bilsmg))\s*\.?=\s*['"][\[\]<>\!\*\&\s\:\|+\.=_\w\$'"]{9,99}\\n['"]\s*;(?:\s*\35\s*\.?=\s*['"]\s*(?!(?:Subscr|news))[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){1,12}\s*\35\s*\.?=\s*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{9,99}\\n['"]\s*;(?<X2193371>)|env\((?:"REMOTE_ADDR"\);\s*\$\w{1,40}\s*=\s*json_decode\(file_get_contents\([^\)]{1,99}\)[^\}]{99,499}(\$\w{1,9})=array\((?:['"][^'"]{1,3}['"]=>['"][^'"]{1,3}['"],){9}[^\);]{99,150}\);(\$\w{1,9})=(?:\37\[['"][^'"]{1,3}['"]\]\.){9}[^;]+;[^\}\(\)\{,\->\s]+mail\(\38,[^\)]+\);(?<X1124070>)|['"]REMOTE_ADDR['"]\)(?:;(?:[^\.]{0,90}(\$message\s*\.)\s*=\s*['"][^\\]+\\n['"];[^/]{1,200}\40\s*=\s*['"](?:Password|pwd|pass|psw)[^/]{1,200}\40\s*=\s*['"][^/]{0,30}https?://www\.geoiptool\.com[^'"]+["'];[^\(]{9,300}@?mail\s*\([^\)]+\);[^\{]{30,150}\{\s*header\s*\(['"]Location:[^\)]+\);(?<X2065041>)|\s*\$file\s*=\s*fopen\("[^'"]{0,9}ip\.txt","a"\);\s*fwrite\(\$file,\$ip\."\s*-\s*"\.gmdate\s*\("Y-n-d"\)\."\s*@\s*"\.gmdate\s*\("H:i:s"\)\."\\n"\);\s*(?:\?>|\$)(?<X2118580>))|\s*;\s*\$(country)\s*=\s*\w{0,40}\43\(\);\s*\$(region)\s*=\s*\w{0,40}\44\(\);\s*\$(city)\s*=\s*\w{1,40}\45\(\);(?:\s*\$\w{1,40}\s*=\s*date\(['"][^'"]{1,40}['"]\);)?\s*\$\w{1,40}\s*=\s*\$_POST\[['"]username['"]\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"]password['"]\];(?<X2054390>))|\s*"REMOTE_ADDR"\s*\);\s*\$browser\s*=\s*getenv\s*\(\s*"HTTP_USER_AGENT"\s*\);\s*\$message\s*\.=\s*"(?:-+\|\s*Full\s*Infos(?<X2047080>)|\s*-+\|\s*CC\s*Infos(?<X2047050>)))))|\w{0,20}\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];\s*\$(?:from_)?sh[e3]llcode\s*\.?=\s*['"]?[^\(]{0,20}gethostbyname\s*\((?<X2055191>)|s?\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"\]\s;]+\$\w{1,40}[\s=]+['"]https?://[^;]+;\s*\$\w{1,40}\s*=(?:[^;\[]*\$_[GPRSC]\w{2,6}\[[^\]]+\])+[^;\[]*;\s*if[\s\(]+![^>;]+(\$\w{1,40})[\s=]+array\s*\([^;]+;\s*(\$\w{1,40})[\s=]+stream_context_create[\s\(]+\50[\s\)@;]+file_get_contents[\s\(]+['"]http[^;]+\51[\s\)]+;(?<X1201140>))|s(?:_(?:google_bot[^\}]{1,499}include\s*\$\w+;\s*exit;\s*\}\s*\}\s*\}\s*\}[^;]{1,99}plugin\.\s*new\s*\w+\(\);\Z(?<X220350350>)|human\)\h*foreach\((\$stop_agents_mask)s\h+as\h+\54\h*\)\h*if\h*\(\h*preg_match\h*\(\h*['"]/['"]\h*\.\h*\54\h*\.\h*['"]/i['"]\h*,\h*@\$server_user_agent\h*\)\h*\)\h*\{(?<X2162510>))|human\h*=\h*(detectbot)\d*\h*\([^\}]{9,499}\}\s*function\h+\56\h*\([^\)]+\)\s*\{\s*\$stop_ips_masks\h*=\h*array\s*\((?<X2162542>)))|J(?:hon_?Coders\s*=\s*['"][^'"]{99,300}['"];\s*\$Black_?Coders\s*=\s*['"](?<X2137810>)|SubMenuHelper\s*=\s*create_function\('',\s*\$JSubMenu\);\s*unset\(\$\w+,\s*\$JSubMenu\);\s*\$JSubMenuHelper\(\s*\);(?<X2048770>))|l(?:ang\[['"]SSN['"]\]\s*=\s*['"][^\)]{300,1500}jQuery\(function\([^\)]+\)\s*\{\s*(?:\$\(['"]\.cc-(?:number|exp|cvc|cvv|ssn|vbv)['"]\)\.payment\([^\)]+\);\s*){2,4}(?<X2063113>)|eaf\[(?:'version'\]="2\.7";\s*\$leaf\['website'\]="leafmailer\.pw";(?<X2045860>)|['"]website['"]\]\h*=\h*['"]leafmailer\.pw['"]\h*;(?<X2153690>))|i(?:cense\s*=\s*\$_POST\s*\[\s*'[^']*'\s*\]\s*\(\s*''\s*,\s*\$_POST.+?;\s*\$License\s*\(\s*\)\s*;(?<X2048850>)|nks(?:0000\h*=\h*@?file_get_contents\h*\(\h*\$cache_dir\h*\.\h*\$md5_url\h*\.\h*['"]\.tmp['"]\h*\)\h*;(?<X2162481>)|\s*=\s*new\s+Get_links\(\);\s*\$links\s*=\s*\$links->get_remote\(\);\s*echo\s*\$links;(?<X1041430>)))|o(?:calpath(?:=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$root_path=substr\(\$absolutepath,\d+,strpos\(\$absolutepath,\$localpath\)\);\$\w+=\$root_path\.'/\w.+touch\(dirname\(\$\w+\)\s*,\s*time\(\)\s*-\s*mt_rand\(\d+\*\d+\*\d+\*\d+, \d+\*\d+\*\d+\*\d+\)\);\s*}(?<X1035890>)|\s*=\s*getenv\("SCRIPT_NAME"\);\s*\$absolutepath\s*=\s*getenv\("SCRIPT_FILENAME"\);\s*\$root_path\s*=\s*substr\(\$absolutepath,\s*0,\s*strpos\(\$absolutepath, \$localpath\)\);\s*\$xml\s*=\s*\$root_path\s*\.\s*'/xm1rpc\.php'.*?\$chr1\s*=\s*\$chr2\s*=\s*\$chr3 =\s*"";\s*\$enc1\s*=\s*\$enc2\s*=\s*\$enc3\s*=\s*\$enc4\s*=\s*"";\s*}\s*while\s*\(\$i\s*<\s*strlen\(\$input\)\);\s*return\s*\$output;\s*}(?<X1035851>))|g(?:_file(?:\h*=\h*dirname\h*\(\h*__FILE__\h*\)\h*\.\h*['"]/proxy_log\.txt['"];[^\+\?&]{299,499}\bif\h*\(\h*preg_match\h*\([^\{]{1,99}\{\s*if\s*\(\s*function_exists\s*\(\h*['"](opcache_invalidate)['"][\)\s]+\{\s*\68\h*\(['"](conf\.php)['"]\);\s*\}\s*@?include(?:_once)?\h*\(['"]\69['"]\)\h*;(?<X2155780>)|_name\s*=\s*GetDocRoot\(\)\s*\.\s*"/\s*"\s*\.\s*"\w+\.log"\s*;\s*if\s*\(\s*isset\(\s*\$_POST\[(?<X2048810>))|in="\w+";\s*\$\w+=str_rot13\("\w+"\);\s*\$\w+\s*=\s*str_rot13\('\w+'\);\s*\$\w+="\w{32}";\s*eval\(\$mdh\(\$md\(strrev\('(?<X2045301>)|in\s*=\s*(?:['"][^;]+;(?:\s*//[^\n]+\n)?\s*\$pass\s*=\s*['"][^;]+;(?:\s*//[^\n]+\n)?\s*\$md5_pass\s*=\s*['"][^;]*;(?:\s*//[^\n]+\n)?\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(\s*base64_decode\s*\(\s*['"][^'']{30000,}['"][\s\)]+;(?<X1038941>)|\$_SESSION\['clientemail'\];\s*\$passwd\s*=\s*\$_POST\['passwd'\];\s*\$own\s*=(?<X2050910>)))|kiDBCon\s*=\s*new\s+LokiDB\((?<X2124200>))))
\$(?:m(?:(?:e?sg|essage)\h*\.?=\h*['"][^;]{1,99}\b(oluxshop)\b[^\?]{1,199}\$subj?(?:ect)?\h*=\h*['"][^;]{1,99}\1\b(?<X2160141>)|(e?sg|essage)\h*(?:=(?:[^;]{1,99}\$pass(?:wo?r?d)?\b[^;]{1,99};\s*@?mail\(\h*['"][^@'"]{1,99}@(?:yahoo|yandex|aol|gmail|protonmail)\.[^,\)]+,\h*['"][^'"]+\bPa(xful|ypal)\h*(?:inf[0o]|l[0o]g)[^\)]+\$m\3\b[^;]{1,99};\s*header\(\h*['"]Location:\s*https?://[^/]{0,99}\bpa\4\.(?<X2161660>)|\h*['"][^;]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,199}\bmail\([^\)]+\$m\3[^;]{1,49};\s*\?>\s*<script[^/]{1,199}\blocation(?:\.href)?\s*=\s*['"]https?://(?:www\.)?[mhlo](?:ive|utlook|otmail|icrosoft|ffice(?:365)?)\.com\b(?<X2154303>))|(?:\.=[^;]{1,49}\$pass(?:wo?r?d)?\b[^@]{1,99}\bmail\([^\)]+\$m\3\b[^@]{99,999}<(title>)\s*Wrong\s*Password\s*</\7(?<X2154600>)|\.?=\h*['"](?:[^;]{1,199}\$pass(?:wo?r?d)?\b[^#!%&\*\}\{]{1,499}\bmail\([^\)]+\$m\3[^;]{1,49};\s*(?:@?f(?:close|open|write)\s*\(\s*){3}[^\)]+\)\s*,\s*\$m\3\)\s*\);\s*[^\?]{1,99}<(script)\b[^/]{0,99}\blocation(?:\.href)?\s*=\s*['"][\w\-/\.]{1,49}\.(?:php|html?)['"]</\9>(?<X2154310>)|\W{1,49}created\s*by\s*\w{1,49}\W{1,49}\\n['"];[^\}\?]{1,499}\bmail\([^\)]+\$m\3[^;]{1,49};[^\?]{1,199}fwrite\([^\)]+\$m\3\);\s*fclose\(\s*\$\w{1,40}\s*\);\s*\?>\s*<(script)\b[^/]{0,199}\blocation(?:\.href)?\s*=\s*['"][\w\-/\.]{1,49}\.(?:php|html?)['"];?\s*</\11>(?<X2154321>))))|ai(?:ler->send\(\$_POST\[[^\]]{1,40}\],\$subject,\$(?:messages?|msgs?)\);\s*\}\s*echo\s*json_encode\(\$\w{1,40}\);\s*\}\s*else\s*\{\s*header\s*\(\s*\$_SERVER\[[^\]]{1,40}\]\s*\.\s*['"]\s+404\s+Not\s+Found['"]\s*\);\s*\}\s*class\s+Mailer\s*\{(?<X2059590>)|n[\h=]+\[\s*['"][A-Z0-9]+['"],\s*['"][A-Z0-9]+['"][^\?]{9,399}\bif[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+\?>\s*<(html)>[^#]{999,2500}\becho\([^/]+\bUpload[ed]*\h*file[^#]{99,799}\b\14>\s*<\?php\s*\}(?<X1206670>))|cdata=array\(\);\$mcdata\[0\]=base64_decode\('[.a-zA-Z0-9_/=]+'\);array_filter\(\$mcdata, base64_decode\('[.a-zA-Z0-9_/=]+'\)\);\?>(?<X2044901>)|e(?:ssage(?:;\s*\}\s*\?>\s*<\?php\s+system\(\s*['"]chmod\s+\d+\s+(\w{1,40})\.php['"]\s*\);\s*\?>\s*<\?php\s+chmod\(\s*['"]\17\.php['"]\s*,\s*\d+\s*\);\s*\?>(?<X2055691>)|\s*=\s*stripslashes\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["body"\]\);\s*set_time_limit\s*\(\d+\);\s*@ignore_user_abort\s*\(true\);\s*\$to_ar = explode\(',',\s*\$to\);(?<X2044981>)|\s*=\s*wordwrap\(\$MESSAGE,\d+\)\s*;\s*[#]{50,80}\s*\$SUBJECT\s*=\s*["']\(\$\w{1,40}\)\((?:BILLING|LOGIN)\)\(\$IP\)\(\$(?:nama_negara|country)\)['"];(?<X2054160>)|\s*\.=\s*"(?:-+Vict!m Info-+\\n";(?<X2050230>)|CVV(?::\s*"\s*\.\s*\$_POST\['cvv'\]\s*\.\s*"\\n";\s*\$message\s*\.=\s*"PIN:\s*"\s*\.\s*\$_POST\['cvv0'\]\s*\.\s*"\\n";(?<X2047680>)|\d?\s*:\s*"\s*\.\s*\$_POST\[(?<X2048841>)))|\s*\.?=\s*['"][^\w]{1,15}FUDPAGES\s*\[?\.\]?\s*RU(?<X2062261>))|thod=[""]move_uploaded_file['"];\}else\{(\$\w+)=file_get_contents\((\$\w+)\);if\(\25!==false\)\{if\(file_put_contents\((\$\w+),\25[^%]{1,99}copy\(\26,\27[^%]{1,399}<title>Simple\s*Upload</title>(?<X220353410>))|isterklioProtect\h*=\h*array\((?<X2159720>)|sg\s*\.=\s*"P\s*:\s*"\s*\.\s*\$_POST\['psw'\]\s*\.\s*"\\n";(?<X2050190>))|n(?:content=gethttpcnt\((?<X2103692>)|ombre_\w{1,20}\s*=\s*['"]L[1i]fk[4a]\s+Sh[3e]ll['"];(?<X2119660>))|out\s*\.=\s*['"](?:<title>Config\h*Symlink\h*</title>['"]\h*;(?<X2196650>)|phpddos['"];\s*\}\s*while\([^\)]+\)\s*\{\s*\$packets\+\+(?<X2121390>))|p(?:(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\][^\?]{9,9999}\$\w{1,40}\s*=\s*\$_POST\[['"]\w{0,9}phrase[^\]]+\][^\?]{0,999}\bif[\s\(@]+mail[\s\(]+(?:\$\w{1,40}\s*,?)+\)(?<X1201720>)|=strpos\(\s*\$tx,'{#',\$p2\+2(?<X2043641>)|a(?:ger\s*=\s*new\s*ADODB_Pager\(\s*\);\s*\$pager->render_pagelinks\(\s*\);\s*\Z(?<X2047860>)|rams[=\s]+array\(\s*['"]\w+['"=>\s]+\w+['"],\s*['"]\w+['"=>\s]+[^,]{1,99},\s*['"]role['"]['"=>\s]+administrator['"],\s*['"]\w+['"=>\s]+\w+@wordpress\.org['"](?<X2325261>)|sswd\s*=\s*fopen\(\s*'/etc/passwd'\s*,\s*'r'\s*\);(?<X2049620>)|th_(?:to_dor\s*=\s*"(?<X2110691>)|wordpress\[\]\h*=\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\][^;]{0,9};\s*\$\w{1,20}\h*=\h*['"]\s*try\s*\{\s*\$bajatax[^=]{0,4}=\h*apply_filters\h*\(\h*\\['"]wp_authenticate_user\b(?<X2172830>))|tt\s*=\s*['"]\W?(?:(?:safe_mode|open_basedir|(?:r57|c99)shell|[dlrwx-]{10})\|){8}(?<X2126602>)|y(?:load(?:\s*=\s*"[^"]{100,9000}"\s*;\s*preg_replace\s*\(\s*'/.*/e'\s*,\s*"[^"]{1,300}"\s*,\s*'\.'\s*\)\s*;(?<X1040690>)|_file\s*=\s*['"][%\w]{1,99}GLOBALS[%\w]{1,99}Array[%\w]{1,999}\.[^;]{999,}eval[^;]{32,99}(?:exit|die)%\d+%\d+[^'"]{1,128}['"];\s*srand\((?<X2264121>))|tm\w{1,30}\h*=\h*['"]https?://pubg\.\w{1,30}[^/]{0,49}/\w{1,20}\.php['"];(?<X1189880>)))|h_id\(\$backdrop,\$user_ini_filename\);(?<X1220350>)|lugin_key\h*=\h*['"](?:[a-f0-9]{32})?['"];[^\:\^%&@!#\*\|]{499,999}['"]hide_logged_in['"]\)\h*;(?<X2156181>)|ng\w{1,12}\h*\=\h*dirname\(__FILE__\)\h*\.\h*['"]/(\w{1,20}\.(?:png|jpe?g|ico|gif|bmp))['"];[^\.\?>]{0,99}\b@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?\h*['"]\48['"]\);(?<X1163852>)|ostpass=randString\(['"]\d+['"]\);\$res=insertToBD\([^\.;\)\(\[]{1,99}\.urlencode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\.['"]{3},\$wpdb(?<X2126450>)|r(?:a[ga]{0,2}\h*=\h*rand\([^\)]+\);\s*if\(!empty\(\$_POST\[['"](?:username|password)['"]\]\)\)[^\}]{99,600}\bmail\h*\((?:\$\w{1,20},?){4}\);[^\{]{1,99}\bheader\h*\(['"]Location:(?<X2149220>)|oduct\->(ghost_lokal_product_image)\s+=\s+\$ghost_content\->\52\s+\?\?\s+['"]['"];\s+\$schema\s+=\s+\\GPLRock\\Content::generate_schema_markup\(\$product,\s+0\);\s+[^\.]{1,499}str_replace\(['"]panel(?<X220364041>))|wdump2\s*=\s*"TVqQAAMAAAAEAAAA(?<X2049600>))|query\s*=\s*isset\(\$_SERVER\['QUERY_STRING'\]\)\?\s*\$_SERVER\['QUERY_STRING'\]:\s*'';\s*if\s*\(false\s*!==\s*strpos\(\$query,\s*'[\w-]+'\)\)\s*{\s*__\w+_\w+\(\);.+?stream_context_create\(\$options\);\s*\$contents\s*=\s*@file_get_contents\(\$url,\s*false,\s*\$context\);\s*}\s*}\s*}\s*return\s*\$contents;\s*}(?<X1035660>)|r(?:(?:oot|eal)ShellUrl\h*=(?<X2168111>)|an(?:dAddName\h*=[\h\(]+KEYJG\h*\+\h*\$id\d+[\h\)]+%\h*\d+\h*[\+\-]\h*\d+\h*;(?<X2180210>)|som_(?:de|en)crypt\b(?<X2189301>))|card\s*=\s*\$m->getRandcards\(\s*\$id\s*,\s*\$idsum\s*\);(?<X2048030>)|E(?:DIRECT_FILENAME[\s=]+['"]\w+['"];\s*if[\s\(]+(session)(_start)[\s\(]+\)[\s!=]+(?:true|false)[\s\)]+\{\s*(die|exit)\b[^;]{0,19};[^@#%]{99,2999}(?:\$_\60[\s\[]+['"](?:__redirect_was\61|doc_name)["'][\s\]]+=[^;]+;\s*){2}[^%]{99,19999}\bheader[\s\('"]+Content\-disposition[:\s]+attach[^\}]{1,499}\b\62;[\s\}]+(?://\s*)?\62[\s\(]+['"]Try\s+again\.?['"][\s\)]+;(?<X1220371>)|link\s*=\s*['"][^'"]{1,15}file\s*manager\s*(?:r57|c99|wso|b374k)\s*shell\b(?<X2129541>)|port\s*=\s*new Report\(\$DBData,\s*file_get_contents\('php://input'\), intval\(\$_SERVER\['CONTENT_LENGTH'\]\), ENCKEY_, TEMP_\);\s*\$Report = NULL;(?<X2051790>)|q_uri\s*=\s*'http://'\.\$req_uri\."\?req="\.urlencode\(\$full_uri\)\."&gzip="\.\$is_gzip\."&host=\$host&ip=\$ip&rip=\$reverse_ip&ua=\$ua&ref=\$ref";(?<X2045830>)|sult\s*=\s*dns_get_record\(\s*\$domain\s*\.\s*"\.multi\.uribl\.com"\);(?<X2045091>)|turn = smtpmail\(\$smtp_host, \$smtp_port, \$smtp_login, \$smtp_passw, \$email_polucha, \$telo_pisma, \$headers\);(?<X2044601>))|q\s*=\s*\$_GET;\s*\$sid\s*=\s*"\w+";.{2000,3000}?echo\s*"<a\s*href=\\\'\$link\\\'>\$name</a><br>";\s*}\s*}\s*}(?<X1039391>)|un_ioncubetesterplus\s*=\s*create_function(?<X2048560>)))
\$(?:s(?:(?:hell)?_?title\h*=\h*\$s(?:hell)?_?name\h*\.\h*['"][^'"]{0,9}['"]\h*\.\h*\$s(?:hell)?_?ver(?:sion)?\b(?<X2305150>)|_pass\s*=\s*"\w{32}";\s*//\s*password\s*\(.{1,100}\)\s*eval\("\?>"\.gzinflate\(base64_decode\((?<X2050820>)|a(?:lesforce_Desk_1\s*=\s*stristr\(\$finish_result(?<X2048450>)|ndyKey=\$_POST\['SandyKey'\];(?<X2049050>))|c(?:am(?:a(?:url|name)\h*=\h*['"][^\?\[\]\{\}]{99,999}(?:\$fuck_(?:tor|vpn|crawler)\h*=\h*['"][^'"]+['"];\s*){2,3}(?<X2181131>)|name\h*=(?:[^\(\{\?@#%!&\|\}\)]{1,499}\$(?:fuck_\w{1,40}\h*=[^;]{1,99};\s*\$){2}(?<X2167761>)|\h*["'][^'"]{1,40}['"];[^\}]{1,199}\}\s*function\h+\w{1,20}[^\{]{1,49}\{\s*(\$\w{1,9})\h*=\h*['"]https?://api\.telegram\.org/bot[^\)]{1,99}\);\s*\$\w{1,9}\h*=\h*curl_init\h*\(\);\s*\$\w{1,9}\h*=\h*array\h*\(CURLOPT_URL\h*=>\h*\7,(?<X2181970>)))|riptver\s*=\s*["']\s*Private\s*Exploit\s*["']\s*;(?<X2121920>))|e(?:rver\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST).{100,300}exec\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{\s*echo\s*substr_replace\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*0\s*,\s*1\s*\)\s*\.\s*"[^"]*"\s*;\s*\}(?<X1039310>)|ss\s*=\s*md5\(\s*@\$_COOKIE\[ssid\]\);(?<X2044521>)|x\s*\.=\s*[^\n]{40,100}\s*@mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*(\$\w{1,40})\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"][^'"]{1,20}\.html['"]\s*,\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\12(?<X2054731>))|h(?:[e3]ll(?:\h*=\h*base64_decode\h*\(\h*['"]PD9(?<X2187741>)|\s*=\s*base64_decode[\(\s'"]+PD9(?<X2228110>))|_name = base64_decode\(\$sh_id\)\.\$sh_ver;(?<X2044431>)|ell(?:\w+[\s=]+\w+[\s\(]+base64_decode[\s\('"]+aHR0cDovL2hlbGxv[^;]+;(?<X1211380>)|\w{0,9}\h*=\h*pathinfo\h*\(\h*\$_SERVER\h*\[['"]REQUEST_URI['"]\]\h*,\h*PATHINFO_DIRNAME\h*\)\h*;(?<X2160010>)|_?name=[^;]{1,99};\$(?:auth_)?pass(?:word)?=['"]\w{32}['"];(?:\$\w{1,40}=['"]https?://pastebin\.com/(?:raw|download)\b[^;]{1,99};){1,3}[^\?\}\{]{1,499}\$\w{1,40}=['"][^'"]{25000}(?<X2178840>)|_\w{1,20}\s*=\s*\$_[GPRSC]\w{2,6}\[['"]priv(?:8|ate)['"]\];(?<X2133020>)|_data=gz[di][en]flate\(base64_decode\(['"][^'"]{9999}(?<X2174110>)|_mode\s*\)\s*\{\s*\?>\s*[^\?]{1,99}\s*<title>\s*<\?php\s+echo\s*\(?\s*['"]?\s*\$shell_title;(?<X2057242>)|_name\s*=\s*(?:"devilzShell";(?<X2049450>)|['"](?:Mr|ph)[^'"]{1,20}shell['"];(?<X2130341>))|_url\h*=\h*['"]https?://[^/'"]{0,99}\bgithub(?:usercontent)\.[\w\.]{2,9}/[^\?]{99,1499}\bfsockopen\h*\(\h*\$shell\h*,\h*\$port\h*,\h*(?<X2172180>)|Folder\h*=\h*dirname\(\$shellPath\);\s*echo\h*['"]\$shellUrl(?<X2139390>)|Manager->add\(['"]r57['"]\s*,\s*new\s*R57\(\)\);(?<X2121260>)|name=[^\?]{0,199}eval\([^;]{9999}(?<X2224031>)|ololol\h*=\h*['"]PD(?<X2156243>)))|ql\s*=\s*['"][^\?]{1,40}\s*,\s*['"]\s*<\?(?:php)?\s*system\s*\(\\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\w{1,12}\]\s*\);\s*exit;\s*\?>['"](?<X2052680>)|sn=\$_SESSION\['ssn'\]=\$_POST\['ssn'\];(?<X2049121>)|trFileBody=GetFileContent\(\$strUrl\);\s*\$strFileBody=str_replace(?<X2045790>)|u(?:\s*=\s*str_replace\('\$name'\s*,\s*\$n\s*,\s*stripslashes\(\s*base64_decode\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'z2'\s*\]\s*\)\s*\)\s*\);(?<X2045611>)|b(?:j?(?:ect)?\h*=\h*['"]\h*\w{1,40}\h*Victim\h*info\b[^\?\{\}#!@&\*%\|]{1,199}\bfwrite\h*\([^,\)]+,\h*(\$\w{1,40})\h*\);[^\?\{\}#@!&\*%\|]{1,99}\b[fc](?:ile_get_contents\h*\(\h*|url_setopt\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_URL\h*,\h*)['"]https?://api\.telegram\.org/bot[^;]{1,199}\34\b(?<X2177000>)|ject\h*=\h*(?:["']Billing\h+(?:Netflix|Hotstar|Disney)\b\W{0,4}['"]\.\$xname\.['"][^\(]{99,250}\bmail\h*\((?<X2144220>)|['"](?:[^;'"]{2,20}\blogin\b[^;\\]{5,60}['"];[^\}\[\]]{99,600}\bfopen\h*\(['"][^'"]{2,20}\.txt['"]\h*,\h*['"]a\+?['"]\);[^\[@]{99,600}\bif\h*\(\$send.log[^\)]+\)\s*\{\s*if\h*\(\$Encrypt[^\)]+\)\s*\{\s*@?mail\h*\((?<X2173620>)|\h*Xjok\h*ertn\h+(?:SSN|CC|card)\b(?<X2139150>)|\W{0,5}R3M0T[^;]{9,99};\s*\$headers\h*=\h*['"]From:\h*r3m0t(?<X2143741>)|AMA[Zo]{2}NE?\h*(?:billing|full\h*credit|v[\d\.]+)\b[^\{]{20,250}mail\([^\)]+\);\s*@?fclose\(@?fwrite\(@?fopen\((?<X2138770>)|APPLE(?:ID)?\h+LOGIN:\h*\$\w{1,40}\b(?<X2138400>)))|ject(?:\h*\.?\h*=\h*['"](?:(Mail\.ru|y[a4]h[0o]{2}|VIP163|H[0o][7t]m[4a]il|a[0o]l|Domains)\b[^;]{0,20};\s*\$body\h*=\h*['"]\W{4,20}\42[^\$]{9,50}\$(?:email|username|user|login)\b(?<X2153390>)|Apple\h+(?:VBV|CC|C[CV]V)\b[^;]{0,20};(?<X2140580>))|\s*=\s*"PayPal\s+(?:B(?:ank\s+Info(?<X2049160>)|illing\s+Info(?<X2049170>))|PP\s+LOGIN\s+FROM(?<X2049150>))|\s*=\s*['"](?:[^'"]{0,99}(?:Amazon|Apple|Billing)[^;]{1,99};(?:\s*\$\w{1,40}\s*\.?=[^\?]{1,99};){1,5}[^\$\w\(\)\?\{\};]{999,4999}(\$\w{1,40})\s*=[^;]{1,99};\s*(\$\w{1,40})\s*=\s*fopen\(\48[^;]{1,99};\s*fwrite\(\49(?<X2138240>)|[^\$]{1,40}['"]\.\$ip\.[""]\\n['"];\s*\{?\s*@?mail\([^\;]{1,200}\)\s*;(?:\s*\})?\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054051>))))))|t(?:ags=array\("p","div","span"\);\$tags=\$tags\[rand\(0,count\(\$tags\)-1\)];\s*array_push\(\$body,"%1\$tags%3",\$text,"%2\$tags%3"\);(?<X2047650>)|e(?:legram_\w+[\s=]+['"]AMEX\-[^;]+\w+:\s*\$cc\b(?<X2325693>)|stcloack\s*=\s*cloack\(\$ip\);(?<X2103701>)|xt(?:\d+\s*=\s*http_get\('https://ghostbin\.com/paste/\w+/raw(?<X2049400>)|Name\h*=\h*['"]ElZero['"];[^\[\{\?]{1,999}\$(?:fuck_(?:vpn|tor|crawler)=[^;]{0,99};\s*\$){2}(?<X2168301>)))|his(?:->(?:createfile\(['"]\.htaccess['"]\h*,[^\)]+\);[^%&\*@]{999,2500}\bfunction\h+\w{1,20}\([^\)]+\)\s*\{[^\}\[/]{20,450}\$\w{1,20}\h*\.=\h*['"]<title>\h*\h*(?:Hack|pwn|f[uc]{2}k|touch)ed\h+by\b(?<X2183350>)|pluginList\h*=\h*Array\h*\(\s*['"]wp-hps/wp-sph\.php\b(?<X2149490>))|\->(?:log[\(\s]+['"]DD[o0][s5]!?\h+(?:UD|TC)P\h+Fl[o0]{2}d\h*completed['"][\)\s]+;(?<X2193170>)|server\s*=\s*['"]http://['"]\.\$this\->server\.['"]/img/\?q=(?<X2102991>)|test\s*=\s*['"]<div\s*style\s*=\s*['"]display:none;['"]>\w+:\d+</div>['"];\s*if\(isset\((\$_POST)\[[^>]{1,64}>file_put\(\61(?<X2250831>)))|itle(?:="NetworkFileManagerPHP";(?<X2051530>)|[\s=]+['"]cpanel(?:\s*tools?)?\s*[^\x00-\x7F]+['"]\s*;[^\?\}]{0,499}['"]<form\s+action[=\s]+['"]\?(?<X2228041>)|\h*=\h*['"]Security\h*Exploded\s*Shell\s*Backdoor[^\?]{99,350}<title>Hacked\h*By\b(?<X2144061>)|\s*=\s*['"]\s*[^\w]{1,3}MALING\s+SHELL[^\w]{1,3}['"];(?<X2061110>))|ofile='[^']{1,50}';\s*\$\w{1,40}\s*=\s*base64_decode\(strtr\(\$_POST\[[^)]+\)\);\s*\$\w{1,40}='<\?php(?<X2051612>)|ujuanmail\h*=\h*['"][^'"]{2,20}\.\w{2,6}['"];\s*\$x_path\h*=(?<X2181121>))|u?[3e]xp[l1][o0]it\s*=\s*['"][^'"]{9,400}['"];\s*\$An[0o]n_[3]xp[l1][0o]it[3e]r\s*=\s*['"](?<X2063676>))
\$(?:U(?:nixTimeLastEdit\s*=\s*"[^"]{1,100}";\s*\$MenuAcoAuthor\s*=\s*"[^"]{1,100}";.{100,2000}?echo\s*eval\s*\(\s*base64_decode\(\s*\$SystemJoCode\s*\)\s*\);(?<X1039890>)|rl(?:\s*=\s*".*?";\s*if\s*\(isset\(\$_SERVER\['HTTP_REFERER'\]\)\s*AND\s*!isset\(\$_COOKIE\["\w+"\]\)\)\s*{\s*setcookie\("\w+",\s*"1",\s*time\(\)\+\d+\);\s*\$urls\s*=\s*array\("google\.",\s*"yandex\.",\s*"yahoo\.",\s*"aol\.",\s*"msn\.",\s*"rambler\.",\s*"mail\.",\s*"ya\.",\s*"bing\.",\);\s*for\s*\(\$i=0;\s*\$i\s*<\s*count\(\$urls\);\s*\$i\+\+\)\s*if\s*\(strpos\(\$_SERVER\['HTTP_REFERER'\],\s*\$urls\[\$i\]\)!==false\)\s*exit\('<script>document\.location\.href\s*=\s*"'\.\$url\.'";</script>'\);\s*}(?<X1035250>)|_to\s*=\s*['"](?:h|\\x68|chr\(104\))(?:\W{1,3}(?:t|chr\(116\)|\\x74)){2}[^\$]{30,300}(\$\w{1,40})\s*=\s*['"][^/]{1,50}\(\3\s*=\s*['"]/tmp['"][^#]{200,1200}(\$f_res)\s*=\s*\3[^>]{1,400}(\$res)\s*=\s*file_get_contents\(\4\);\s*\}\s*(?:print|echo)\s*['"]?\5['"]?;(?<X2064892>)|s\[\]\s*=\s*trim\(\$domains_for_work\[\$\w{1,40}\]\);\s*\}\s*\$mcurl\s*=\s*new\s+MCurl\(\);(?:\s*\$mcurl->\w{1,40}\([\$\w]{0,9}\);\s*){0,9}\s*\$\w{1,40}\s*=\s*\$mcurl->\w{1,40}\([\$\w]{0,9}\);\s*\$finish_result\s*=\s*array\(\);\s*for(?<X2059631>)|s\s*=\s*array\s*\(.+?\);\s*\$URL\s*=\s*\$urls\[rand\(0,\s*count\(\$urls\)\s*-\s*1\)\];\s*header\s*\("Location:\s*\$URL"\);(?<X1034471>))|ser(?:->set_role\(\s*'administrator'\s*\);\s*\}\s*\}\s*wpb_admin_account\(\);\s*\}\s*\?>\Z(?<X2051460>)|\h*=[^;]{1,49};\s*\$pass\h*=\h*['"]\w{32}['"];[^\^]{39999,}\bswitch\h*\([^\{]{1,49}\{\s*(?:case\h*['"](\w{1,9})['"]:\s*\10\((?:\$_[FGPCSR]\w{2,6}\[[^\]]+\]\h*(?:,\h*)?){0,4}\);\s*break;\s*){15}(?<X2152901>)|\s*-\s*>Authorize\s*\(\s*\$\w{1,40}\[\s*"ID"\s*\]\s*\);\s*LocalRedirect\s*\("/bitrix/[^"]{1,40}"\);(?<X2049460>)|\s*=\s*(shell_exec)\s*\(['"]whoami['"]\);\s*\$host\s*=\s*explode\s*\(['"][^'"]+["'],\s*\13\(["]uname\s+-n['"]\)\s*\);[^\}]{0,80}\}\s*function\s+checkPassword\s*\(\$(?:passwd|password|pwd|pass)(?<X2119350>)|_agent\s*=\s*"ConBot";(?<X2044101>)|ful\s*=\s*array\(['"]gcc['"],['"]lcc['"],['"]cc['"],['"]ld\b(?<X2050391>)|name\s*=\s*['"]\bdeleted\-['"]\s*\.\s*gen_str[^'"]{1,199}(\bmysqli_query)[^;]{1,99}\$prefix['"]\h*\.\h*['"]users[^;]{1,299}(\W{1,4})\s*\17[^;]+\18\s*\17[^'"]+['"]\binsert[^;\}]+\bcapabilities[^;"\}]{1,99}['"]\badministrator(?<X2239301>)))|v(?:ar= \$_SERVER\['PHP_SELF'\];\s*\$form =<<<HTML\s*<form enctype="multipart/form-data" action="\$var" method="POST">\s*<input name="uploadFile" type="file"/><br/>\s*<input type="submit"\s+value="Upload"\s*/>\s*</form>\s*HTML;\s*if \(!empty\(\$_FILES\['uploadFile'.+?print\s*"OK";\s*}\s*else\s*{\s*print\s*\$form;\s*}(?<X1035790>)|ERSION\s*=\s*'Gamma\s+Web\s+Shell(?<X2051550>)|ictimInfo\d*\s*\.?=\s*['"][^@]{499,999}\bmail\(\h*\$\w{1,40}\h*,\h*['"][^'"]{1,49}\bfrom\b[^,\)]{1,19}\$_SERVER\[[^\]]+\]\h*,\h*(\$\w{1,40})\);\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"][^'"]{1,49}\.txt['"][^\)]{1,99}\);\s*fwrite\h*\(\h*\23\h*,\h*\22\h*\);\s*fclose\h*\(\h*\23\h*\);(?<X2154721>))|w(?:eff_client\s*=\s*new\s+TWeffClient\(\);(?<X2045591>)|p(?:_(?:4meta_arr[=\s]+array[\(\s'"]+comment["']\s*=>[^\*]{1,499}(\$\w{1,40})\s*=\s*glob(?:[\(\s\$]+ABSPATH\s*\.\s*['"]\*\.hfm['"][^>]{9,999}\bforeach[\(\s]+\26\s+as\s+(\$\w{1,40})[\)\s]+\{[^@]{9,9999}(\$\w{1,40})\s*\->[^;]+;[\s\}]*@unlink[\s\(]+\27[\s\);\}]+\28\->close[\s\(\);]+unset[\s\(]+\28[^;]+;(?<X1222500>)|[\(\s]+\$ABSPATH\s*\.\s*['"]\*\.hfm['"][^>]{9,999}\bforeach[\(\s]+\26\s+as\s+(\$\w{1,40})[\)\s]+\{[^@]{9,9999}(\$\w{1,40})\s*\->[^;]+;[\s\}]*@unlink[\s\(]+\30[\s\);\}]+\31\->close[\s\(\);]+unset[\s\(]+\31[\s\);]+\}(?<X1222451>))|_wp\s*=\s*\$wp__wp[\(\s]+str_i?replace(?<X2103081>)|enc_file\s*=\s*'<\?php eval\("\?>"\s*\.\s*base64_decode\("'\.\$wp_code\.'"\)\);\s*\?>';(?<X2044621>)|nonce=isset\(\$_POST\[\$_SERVER{\$_SERVER{.+?unset\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*echo\s+\$wp_auth_check;(?<X1036870>))|autop\s*=\s*pre_term_name[\(\s]+\$wp_kses_data\s*,\s*\$wp_nonce[\s\)]+;[^\}]*\$shortcode_unautop\(\);(?<X2045991>)))|X(?:_\w{1,20}\h*=\h*['"]From:[\w-]{1,20}<Xphisher>(?<X2147590>)|BALTI_EMAIL\h*[,=][^;]{6,99}[\)'"]\h*;(?<X2179831>)|mlname=array\([^\n]{1,1999}getcontent500page['"]\)\)\{header\(['"]HTTP/\d\.\d+\s*500[^:]+header\(['"]Location:\s+['"]\.\$\w+\);(?:exit|die);\}else\{if\(strstr\(\$\w+,['"]okxml[^\n]{1,2999}return\$\w+;\}\}\}return\s+['"]nobotuseragent['"];\}function\s*\w+\(\)\{\$\w+=range\(['"][^\)]{1,99}\);(?<X1322373>))|y3=['"]iizrepwhcf96c22q['"][^\/]{1,1459}SSL_VERIFYPEER,false\);[^\}]{1,429}Location:https?://[^\)]{1,29}['"]\);exit\(\);\}(?<X220356021>)|z0\s*=\s*\$_REQUEST.{10,300}?(\$\w{1,40})\s*=\s*\$\w{1,40}\(\s*""\s*,\s*\$\w{1,40}\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\41\(\);(?<X1040100>))
\${['"]_GET['"]\}\s*\[\$\w+\s*\[[\d\+\s\]=&]+die[^]]+\]\(__FILE[^:]{1,99}\((md5)\(\1\([^=]+={3}['"]\w{32}['"]\){2}:\$\w+=self[^\?]+die;endif;\}{2}\w+[\s:]+\w+\(\);\?>\Z(?<X2299337>)
\&nbsp\&nbsp\&nbsp\&nbsp\&nbspCant\s+Edit\s+>>(?<X2048110>)
\((?:"/usr/local/apache/bin/httpd -DSSL","/sbin/syslogd","\[eth0\]","/sbin/klogd(?<X1038400>)|(\$\w+)\)\s*\{\s*(\$\w+)[\h=]+plugin_basename\s*\(\s*__FILE__\s*\)[^<]{1,399}unset\s*\(\s*\$\w+\[\s*\3\s*\]\s*\);\s*\}\s*\w+\s*\2;\s*\}(?<X220366991>)|(\w+)\((_0x)\w+,\6\w+\)\{\5\s*\6\w+\((?:\6\w+,){4}\6\w+\)\{(\w+)\s*\6\w+[^\]]+\w+\(!!\[\]\)\{\w+\{\w+\s*\6\w+[^\(\w]+[^\{]+\{\6\w+\[['"]push[^\n]{59999,}!!\[\];\}\[\6\w+\((?:(0x)\w{3},){4}\8\w{3}\)\+_\8[^\n]{1999,}\{\7\s*\6\w{6}\([_a-z0-9\-,\s]{32,}\);\}[^\[]+\[\6\w{6}\((?:\8\w{2,3},){4}[^\}]{1,199}\*\8\d\);\}catch\(\6\w{6}\)\{\}\}\Z(?<X1305180>)|(function)(?:[\(\)|{]+const\s*(\w+)=['"]https?://westernstatesarbor\.com[^\{]{1,199}\10\s*(\w+)\(\)\{\w+\s*\w+=\w+\.userAgent[^&]+\w+\s*\w+=\w+\.includes\(['"]win['"]\)[^\n]{1,499}\w+=(document)\.createElement\(['"]iframe['\);]+\w+\.src=\11[^\{]+\{\13\.addEventListener\(['"]\w+['"],\12[;\)\}]+else\{\12\(\);\}\}\)\(\);(?<X120331551>)|\((?:(_0x)\w+,\15\w+\)\{\10\s*\15[^\n]+return/android/\w\[\15\w+\(0x[^\n]+0x\w+\)\]=redirectIfAndroid;(?<X1305980>)|[^\-]+(return)\s*\w+\((\w+)\-\s*\-0x\w+,\w+\);[^\n]+\+\18/\18\)[^\n]+\10\\x[\*,\da-z\\\\()]+['"],['"]QeNFk[^\n]+track_url['"],['"]\\\w+\+\\\w+\+\\\w+\*\([^\]]+\]\[[^;]+\w+['"]\];(\w)=\10\(\)\{return\s*\w+;\};\s*\17\s*\19\(\);}(?<X1314582>)|_[^\{\n]+\{\10\s*(_\w+)\(_[^\}\n]+\}var[^\}]+\}\10[^%\n]+\21[^\^\n]{1,999}\bcatch[^\}\n]+\}{3}[^;\n]+\;\10\s*(_\w+)\([^:\n]+:\_\w+[^\n:]+:\10\(_\w+[^\}]+\},['"]\w+['"]:[^\}\n]+\},['"]\w+['"]:\10[^>\n]+>{2}\([^>\n]+&&\22\(['"]+\);(?<X1257022>)))|(function\(\))\s*\{\s*try\s*\{\s*var\s+\w{1,20}\s*=\s*window\.(localStorage);\s*var\s+(\w{1,20})\s*=\s*document\.createElement\([^&]{9,150};\s*\26\.style\.visibility\s*=\s*['"]hidden['"];[^:]{99,999}\.src\s*=\s*["']https?://[^\}]{99,400}\}\s*setTimeout\s*\(\s*\24\s*\{\s*\25\.setItem\([^\s]+\}\)\(\);(?<X1134972>)|<a\s*href\s*=\s*['"](https?://urlzs\.com)[^>]{1,128}\28[^>]{1,256}>\28/\w{1,16}</a>\)(?<X1261891>)|['"](?:ABSPATH['"]\)\)\s*\{exit;\}\$GLOBALS\[['"]\w+['"]\]=array\(['"]\\(?<X220367261>)|CiR4bWxuYW1lI[^'"]{999,}['"]\)\);\s*\}\s*\Z(?<X220338820>)|https?://[^;]{1,99}/xmlrpc\.php\b[^\}]{1,999}\bisAdmin</name>(?<X2192071>)|safe_mode['"]\)\D{1,4}(?:0|OFF)\)\s*\?\s*\$\w{1,9}\D{1,4}['"](?:0|off)['"]\s*:\s*die\([^\)]+\);\$\w{1,9}\((?:0|NULL)\);\$\w{1,9}=\$\w{1,9}\(['"]/etc/passwd['"],[^\)]+\);(?<X2123291>))|\$(?:\w+\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'\w+'\s*\]\)\s*&&\s*@preg_replace\('/\w+/e'\s*,\s*'@'\s*\.\s*base64_decode\(\s*"[\w=+/]+"\s*\)\s*\.'\s*\(\s*\$\w+\s*\)'\s*,\s*'\w+'\s*\);(?<X1035221>)|\w{1,40}[\(\s'"]+e['"]\s*\.\s*\$\w{1,40}[\(\s]+\d+[\)\s]+\.\s*['"]\*\./['"][\)\s]+,(?<X2214301>))|\(\)=>\{let\s*(\w+)=decodeuricomponent\(atob\(['"]PGh0bWwgbGFuZz0iZW4tVVMiIGRpcj0ibHRyIj4KICA8aGVhZD4KICAgIDx0aXRsZT5KdXN0IGEgbW9tZW50Li4uPC90aXRsZ[^'"]+['"]\)\.\w+[^\\]{1,9999}\.write\(\36\),\w+\.\w+\.\w+\.\w+\(\)+\}\)\}\)\(\);(?<X120341570>)|\h*(?:[cm]o(?:ve_uploaded_file|py)\s*\(\s*\$_FILES\[[^@]{99,499}<meta\s+http\-equiv\h*=\h*['"]refresh['"]\h+content\h*=\h*['"][^'"]{1,99}\burl=https?://outlook\.office\.com/(?<X2151171>)|[ir](?:nclud|equir)e(?:_once)?\s*['"][^'"]{1,99}\.php['"]\h*\);[^@]{99,999}<(title>)\s*(?:Verizon\b[^/]{1,99}\bconsenting\b[^/]{0,99}|Yahoo!?\s*)</\39(?<X2151183>)|function(?:\(\)\h*\{\s*var\h*(\w{1,40})[\h=]+(document\.)createElement[\('"\h]+script['"][^\}]{0,99}\41\.src[\h=]+['"](?:https?:)?//[^/]{0,15}(?:resolutiondestin|storerightdesicion)\.com/[^<;\}]{0,99};(?:\h*var\h*(\w{1,40})\h*=)?\h*\42getElementsByTagName[^\}\n]+\.(?:appendChild|insertBefore)[\(\h]+\41(?:,\43)?[\h\);]+\}[\h\)]+\(\)\h*;(?<X1163383>)|\h*\(\)\h*\{\s*var\h*(\w{1,40})[\h=]+(document\.)createElement[\('"\h]+(String\.fromCharCode)\(115[,\s]+99[,\s]+114[,\s]+105[,\s]+112[,\s]+116[^\}]+\b\46getElementsByTagName\(\47\(104,101,97,100\)\)\.appendChild\(\45\);\}\)\(\);(?<X1258890>)))|\s*(?:\$(?:_\d+,\d+\s*,\s*array\s*\("IP:\s*{\$_SERVER\[_\d+\(\d+\)\s*]\s*}"\s*\)\s*\)\s*;\s*\$GLOBALS(?<X2048600>)|google_n=0;\s*\$google_n<\d+;\s*\$google_n=\$google_n\+\d+\)\s*{\s*\$ch\s*=\s*curl_init\(\s*\);(?<X2048480>))|function(?:[\s\(]+(\$\w+)[\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\51;[\s\}\)\(]+['"]zip://wp\-[^'"]+['"]\s*\)\s*;(?<X120367161>)|\s*\((?:[a,n_lytics\s]{1,32}\)\s*\{\w\[\[\w+\[\d+\][^:]{1,9999}://www\.google\-analytics\.com/\w+\.js['"\s,]+window[,'"\s]+tecdnaomlrbL9hsiEvHR0[^'"]{1,199}t3q0o3U7['"]\);(?<X1277950>)|\)\s*\{\s*var\s*\w{1,40}\s*=\s*['"]([^'"]+)['"];\s*if[\s\(]+!(window\.\54)\s*\)\s*\{\s*\55[\s=]+\{[^;\}]+,\s*(\w{1,40}):\s*['"]https?://[^'"]+['"][\s,]+\}[\s;]+\}[^\[\]]{0,9999}\b(\w{1,40})\.src[\s=]+\55\.\56[^;]*;\s*var\s*(\w{1,40})\h*=\h*document\.[^;]+;\s*\58\.[^;]+\57\b[^;]+\}\s*\)\s*\(\)\s*;(?<X1195181>)))|k[il1]{3}UA(SHk)\s*\|\60\d{3,6}\s*\)\s*\*/(?<X2128770>))|\w+(?:\((?:(\$\w+)\)\{(?:include|require)(?:_once)?(?:\(\62\);\}\)\(['"]phar://([\w\-]+)\.zip/\63\.php['"]\);(?<X120354220>)|\62;\}\)\(['"]zip://\d+#\d+['"]\);(?<X120360950>))|(_0x)\w+,\w+\)\{const\s*\66\w+=[^\}]{1,999}\w+\)\w+;\w+\[['"]\w+['"]\]\(\w+[^\\]{1,399}\((\66\w+),0x\w+\),async\s*\w+\s*\w+\(\)\{\w+[^\\]{99,9999}\bverifed\.run/[^\}]{1,999}\67=\w+\(\)\{\w+;\};\w+\(\);\}(?<X120329760>)|\)\{var\s*(\w+)=\w+[^\}]{1,999}aHR0cHM6Ly9lYXN0dHJhY2suY2hhdC[^\}]{1,999}insertBefore\(\69,\w[\(\)\};]+\w+\.\w+\.remove\(\);(?<X120334050>))|\s*\(\)\s+[\{\(]+\s+\(['"]\w+\s*\w+['"]\);\s*(\w+)\s*_0x\w+\s*=[^;]{1,99};\s*\71[^%]{1,9999}\.call\(_0x[^;]{1,399};\s*\}[^\}]{1,999}\}[^%]{1,999}\w+[\(\)\s\{]+[^\.]{1,399}\.\w+\([^\(]{1,399}\(['"]aHR0[^\}]{1,399}\}\s*\w+[^\}]{1,399}\}\s*\}[^\}]{1,399}\}\s*;\s*\71[^\}]{1,399}\}[,\s]+\d+\);[^\}]{1,399}\}\s*\w+\s*(\w+)\([^\}]{1,399}\([^%]{1,999}\(window[,\s]+\w+\);\s*\72\(\);(?<X1321802>))|async[^\{]+\{[^&]+(document)[^&]+&&localStorage\.getItem\(['"]already_checked[^\\]+\74\.(getElementById)\(['"]exp[^//]+/[^;]+;\w+\(value\.length={1,4}\d&&\w+\.key!==['"]backspace[^;]+;[\};\)]+const\s*\w+=\74\.\75\(['"]cvv[^\-]+(xhr)\.open\(['"]POST['"][^!]+!={1,4}[^\{]+\{\76\.send[^;]+;\}[^\.]+console\.log[^;]+;\Z(?<X1315610>))
\(f(?:ile_exists\([^;]{0,99}(/wp\-load\.php)[^\?]{1,199}\binclude\b[^;]{0,99}\1\b[^\?]{1,999}\$(\w+)=[^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\?]{1,499}\$(\w+)\[['"]post_content['"]\]=\$\2\b[^\?]{0,99}\bwp_update_post\((?:\w+\(){0,5}\$\3\)[^\?]{1,199}\b[de](?:xit|ie)\b[^;]{0,19};(?<X2224011>)|unction(?:[\(\)\s]+\{try\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*)?\s*\w+\s*=[^;\[]{0,40}\5\s*\[\s*['"][fromChadesting'"\+\.]{20,40}\([^\n!#]{999,9999}\{\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\}\s]*catch[\s\(]+\w+[\)\s]+\{\s*\}[^\}]*\}[\)\s]+\(\)(?:\s*;)?(?<X1250650>)|[\(\h]+parameters[\)\h]+\{\s*const\h+(target)s[=\s]+\[['"]https?://[^/]+/[^'"\$]{3,9}['"](?:[\s,'"]+https?://[^/]+/[^'"\$]{3,9}['"]){3,}\s*\][^\{\}]{39,499}\bconst\h*save\w+[\s=]+\(\7s\)\s*=>[\s\{]+\7s\.forEach[\(\s]+\7[,\s]+index[\)\s]+=>\s*\{[^/]+/\s*ms[^\?]{9,4999}\,\s*globalClick[\s\}\)]+\(\);?(?<X1237571>)|[\(\s\)]+\{\s*const\s*(\w+)[\s=]+['"]https?://t\.me/Tarnkappe_info['"];[^\}]{1,999}\w+\.\w+\.replace\(\9\);\s*\}\s*\}\s*\}\)\(\);(?<X120351311>)|[\(\s]+_0x\w{1,9}[,\s]+_0x\w{1,9}[\)\s]+\{\s*function\s*_0x\w{1,9}[\(\s]+_0x\w{1,9}\s*,[^;]{0,199},\s*_0x\w+[^!]{0,999}\bwhile[\s\(]+!!\[\][\s\)\{]+try[\s\{]+var\s*_0x\w+[\s=]+parseInt\([^\|\n]{9,9999}\[['"]split['"]\]\(['"]\|[^/]{99,}/java[^\]\|\n]{9,999}['"]R_PATH[^\n]+return\s*_0x\w+[\(\);\s]+\}(?<X1228760>)|[\s\(\)]+\{\s*var\s*\w{1,40}[=\s]+['"](\w{1,40})['";\s]+if[\s\(]+!(window\.\12)[\)\s]+\{[^\}/;]+(\w{1,4}PATH)[\s:]+['"]https?://[\w\-\.]+\.\w{2,6}/[\w]{3,9}\b[^\[]{99,}\bvar\s*(\w{1,40})[\s=]+document\.createElement[\(\s'"]+script[^;]+;[^\+]{0,99}\b\15\.src[\s=]+\13\.\14\s*\+[^;]+;[^\},]+\15\s*,[^;]+;(?<X1203450>)|\((\$\w+)\)\{(?:include|require)(?:_once)?(?:\(\17\);\}\)\(['"](?:phar://wp\-[^'"]+\.zip/[^'"]+['"]\);(?<X120364800>)|zip://\w+\.zip#\w+(?:['"]\);(?<X120368920>)|\.php["']\);(?<X120333030>))|zip://wp\-\w+/[^%]{1,99}['"]\);(?<X120369580>))|\17;\}\)\(['"]zip://(?:(?:#|@)['"]\);(?<X120354691>)|\w+#\w['"]\);(?<X120333021>)))|\((\$\w+)\)\{include_once\(\24\);\}\)\(['"]zip://wp\-\w+\.zip#\w+['"]\);(?<X120362371>)|\((\w),(\w)(?:,(\w)\)\{\28\.src=[''](?:https?)?:?//['"]\+\26\+['"]/[^'";\+]+['"]\+\27;\h*try\h*\{\h*\(document\.body\|\|document\.documentElement\)\.appendChild\(\28\)\h*\}\h*catch\h*\(\w+\)\h*\{[\}\)\(\s]+['"][\w\-\.]{3,19}\.[a-z]{2,9}['"],\d+,document\.createElement\(['"]script['"][\)\h]+;(?<X1235610>)|[^\)]+\)\{(?:\26|\27)\[['"]GoogleAnaly\w+['"]\]=(\w+);\s*\w=(\w)\.createEl\w+[\s\(]+\w[\),\s]+\w+=(?:\27|\30|\31)\.getEl\w+\(\w\)\[\d\];if\([^\);]+\b(atob\()\30[^\}]+(\w)\.async=\d+;(?:\32|\33)\.src=['"][^;]+\b(?:\31|\32)[^\}]+\.insertBefore\((?:\32|\33)[^\}]+\}[\s\}\)\(]+\([^;]{0,199}['"](?:aWo|dWI)[^;]+;(?<X1248364>)|\)\{(var)\s*\w+={\26:(0x)\w+,\27:\36\w+,[^\\]+\27=\{['"]\\x[^\{]+\{return\s*\w<\w;\},['"]\\x[^%]{1,13999}setTimeout[^\{]+\{\35\s*\w+=\[['"\\xa-f\d,]+\];(\w{3})\w+=[^%]+\37\w+,\w+=\{['"]['"\\xa-f\d,]+:\27\(\36[^\n]+return\s*json\[\27\(\36\w+\)\]\(\w\);\}break;\}{2}\s*\37\w+\(window,\37\w+\),\37\w+\(\);(?<X1313380>))|\((\w{1,9})\)\{let\s*(\w{1,9})\h*=\h*\39\.createElement\(['"]script['"]\);(?:\h*\40\.async=true;)?\h*\40\.src[=\s]+['"]https://[a-z\-]{3,30}\.[a-z]{2,8}/[^'"\?]{9,99}\.js\?h=[^'"]+['"];\h*\39\.head\.appendChild\(\40\);[\}\)\(\h]+document[\)\s]+;(?<X1235600>)|\((_[01]x[a-f\d]{2,9})[,\s]+_[01]x[a-f\d]{2,9}\)\{var\s*_[01]x[a-f\d]{2,9}=_[01]x[a-f\d]{2,9}[,\s]+_[01]x[a-f\d]{2,9}=\42\(\);while\(!!\[\]\)\{try\{var\s*_[01]x[a-f\d]{2,9}=parseInt\([^!\n]{9,999}while[\s\(]+(?:!!?\[\][^!\n]{9,999}=)+str\(\[[^\*\n]{9,499}=string;return\b[^\}]{1,99}\(null,\w+\);\s*\}(?<X1229870>)|\([\w,\s]+\)\s*\{(\w+)\[\[[^;]{1,999};(\w+)\.async\s*=\s*true;\s*\44\[\[\w+\[[^@]{1,999}\.appendChild\(\45\)\}\)\)\}\)\)\}\)\s*\([^,]{1,999},\s*window[,\s\\'"]+tecnadomrpbEv[^'"]{1,199}YRPW\\?['"]\);(?<X120346970>)|\([\w,]+\)\{\w\[['"]Google['"][^%]{1,199}parentNode\[['"]insert['"]\+['"]Before[^%]{1,99}window,document,['"]Ly9[^%]{1,199}//www\.google\-analytics\.com/[^%]{1,99}\.js['"],['"]\w+['"]\);(?<X120369481>)|\([^;]{1,64};\w=\w\.createelement[^\{]{1,256}atob[^\}]{1,256}\}{2}\)\s*\(\w+\h*,\h*document\h*[\h,'"]*Ly9saXF1aWR6LmluLm5ldC[^,]+[\h,'"]*script[^\)]{1,99}\);(?<X1252730>)|\([^\)]{1,29}\)\{(\w+)\[['"]Google['"]\+['"]Analytics['"][^;]{1,49};(\w+)=\w+\.createElement\s*\([^\)]{1,9}\)[^;]{1,49};\s*if\(\49\.location[^;]{1,49}\49\.atob\([^\{]{1,19}\{[^\}]{1,149}['"]insert['"]\+['"]Before['"]\]\(\50[^\}]{1,29}[\}\)\(\s]+window,document,['"]Ly9tdXNtY[^\)]{1,199}['"ga['"]\);(?<X120355343>)|\(\$,(document)\)\{for\((\$\.\w{1,9})=\$\.\w{1,40};\53<\$\.\w{1,40};\53\+=\$\.\w{1,40}\)\{switch\(\53\)\{case[^\n]{9999,}(?:\(\52\.body\|\|\52\.\52Element\)\.appendChild\(\w+\)[\};][^/'"]{0,299}\(['"][\w\-]{1,40}\.[a-z]{2,3}['"]\h*,[^/;'"]{0,99}['"]script['"]\)\h*,\h*\w{1,40}\h*\)(?<X1194053>)|\breturn\h*_;\}\)\(\52\)\)(?<X1196311>))|\(\)[\s\{]+var\s*\w+=(document\.)createelement\((String\.fromCharCode)\([^\}\[]{1,200}\57\(104,116,116,112,[^;]+\);\s*(\w{1,20})\.append\w+\((\56\w+\(\57)\([^;]+\);[^\}=]{9,150}\59\([^\.]{1,60}\.appendChild\(\58[\}\)\(]+;(?<X1250350>)|\(\)\h*\{\h*var\h*\w{1,9}=document\[(\w{1,40})\(['"]cmVmZXJyZXI=?=?['"]\)[^/\n]{99,999}\b(\w{1,9})\.type=['"]text/javascript['"];[^\{\}\n\[\]]{0,999}\b\62\.src=\61\(['"]aHR[^;]+;[^\}]+\.insert(?:Before|after)\(\62[,\h]+\w{1,9}\);\}\}[^\n/:]{0,999}?;\h*\}\h*\}\h*\)\h*\(\);(?<X1192441>)|\(\)\s*\{\s*(?:\w+\s*(urlprovider)[\s=]+['"]https?://corsproxy\.io/\?url=https?://pastebin\.com/raw/\w+['"];\s*fetch\(\64[^\^]{99,999}\.createelement\(['"]iframe[^\.]+\.src[\s=]+iframeUrl[^\^]+\.removechild\(textarea\);\s*\}\s*\}\s*\}\)\(\);(?<X1308830>)|const\s*(\w+)[^;]+\.WebSocket[^%]{99,512}['"]tetsted\.com[^\)]+\)[^\?]+\66\([^;]+;[\s\};]+\)\(\);(?<X1294800>)|var\h*(\w{1,9})\h*=\h*document\.createElement\(['"]script[^\}]{9,60}\68\.src\h*=\h*\(?['"][^'"]{0,25}\b(?:adcdnx\.com|developerstatss\.ga)/\w{1,15}\.js[^'"]{0,15}['"][^\}]{1,90}\.insertBefore\(\68,\h*\w{1,15}\);\s*\}\)\(\);(?<X1161805>))))
\((?:function(?:\(\)\{(?:&?try\s*\{\s*var(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\1\s*\[\s*['"]fromCharCode[^\}]+\}\s*else\s*\{\s*\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}[\}\s\)]+\(\s*\)\s*;(?<X1251290>)|(var)\s*(_0x\w+)=\d+;\3\s*(_0x\w+)=['"][^'"]{999,}['"];\s*\w+\s*\w+\((\w+),\s*\w+\)\{\6=atob\(\6\);\3\s*\w+=\6\.\w+[^\\]{1,999}\5,\4\);\(new\s*\w+\(_0x\w+\)\)\(\);\}\)\(\);(?<X120359701>)|[^'"]{1,99}(\$\w+)\s*=\s*['"][^;]{1,99}\.php['"];\s*(\$\w+)\s*=\s*['"][^;]{1,30}['"];[^\{]{1,99}use\(\9\)\s*\{\s*\w+[^\{]{1,199}\s*\{\s*echo\s*eval\(base64_decode\(\$\w+\[['"][^;]{1,99};\s*die;[^=]{1,299}===\s*\9[^@]{1,1999}@\(require_once\s*\8\);[^/]{1,999}/\W\w+\W/(?<X120342502>)|[^]]{1,999}const\s*(\w+)[^\}]{1,999}://go\.estetistaselmasoares\.com\b[^@]{1,999}createelement[\(\s'"\\]+iframe[^@]{1,9999}\-9999px[^@]+\11\.\w+\);[^@]{1,999}domcontentloaded[\\'",]+start\);[^;]{1,32}\}\)\(\);(?<X120339350>)|\s*try\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\13\s*\[\s*['"][fromCharCode'"\+]{15,40}\][^;\[]+\+\s*\13\s*\[[^\n]{999,}\{\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\}\s]*catch[\s\(]+\w+[\)\s]+\{\}[^\}]*\}[\)\s]+\(\)(?:\s*;)?(?<X1250552>)|\s*var\s*(?:\w=navigator\[\w\(['"][^"']+['"]\)\];\s*var\s*\w=document\[\w\(['"][^"']+['"]\)\];\s*if\s*\(\s*\w\s*\(\s*\w\s*,\s*\w\s*\([^>]{9,4000};\s*for\s*\(\s*var\s*\w=\w\.length\-1;\s*\w>=0;\s*\w\-\-\s*\)\s*\{\s*\w\+=\w\[\w\];\s*\}\s*return\s*\w;\s*\}\s*\}\s*\)\s*\(\);(?<X1043403>)|\w{1,40}[\s='"]+(\w{1,40})['";\s]+if[\(\s]+!(window\.\16)[\)\s]+\{\s*\17\s*=[^;_/\}]+(R_PATH)[\s:'"]+https?://[^/]+\.\w{2,6}/[\w\-=&,\.]+['"][^\[]{99,9999}\b(\w{1,40})\.src[\s=]+\17\.\18[^;]*;[^;\(]+\(['"]script['"\)\[]+0\][\s;]+(\w{1,40})\.parentNode\.insertBefore\(\19,\20[\}\h\(\)]+;(?<X1204381>))|try\{var\h*(?:(\w{1,9})=\[['"][a-z\d=\+]{9,36}['"],['"][^'"\s=]{9999,19999}={0,2}['"],[^\v]{99,9999}=\22\[\w{1,16}\];if\((\w{1,9})\[[^\]]+\]===undefined\)\{[^\v]+\b(\w{1,9})=atob;(\w{1,9})=\24\([^;]{0,40}\b\23\([^;]+;var\b[^;]+(\w{1,9})=new\h*\w{1,9}\(\25\);\26\(\);\}[\(\);\}]+catch\(e[\(\);\}\{]+;(?<X1180460>)|(_0x)\w+=(document)\.cookie,\h*\28\w+=navigator\.userAgent\.[^\n]{99,200}\bif\(/bot\|crawl\|slurp[^\n]{999,1500}\bopen\(['"]GET['"],\h*\28[^\{]+\{\h*var\s*\28\w+=\29\.createElement\(['"]script['"]\);[^\n]{0,99}\b\29\.head\.appendChild\([^\}]+\}\}\h*catch\(\28\w+\)\{\}\}\)\(\);\Z(?<X120349180>))|var\h*\w{1,9}=(document\.)referrer;(?:\h*var\h*\w{1,9}=(?:window\.location\.href|navigator\.userAgent);)+\h*var\h*\w{1,9}=new\h*RegExp\((\w{1,9})\([^\}]+\}\s*var\h*(\w{1,9})=\31createElement\(['"]script[^:\n]{9,199}\33\.src=\32\([^\)]{40,199}\);[^\n,]{9,199}\.insertBefore\(\33[^\n]{0,99}\}\)\(\);(?<X1213970>)|var\s*(?:(\w{1,40})=['"](.)[^'"]{99,999}['"];\s*var\s*(\w{1,40})=unescape\(\35\.replace\(/\36/g,['"]%['"]\)\);eval\(\37\)\}\)\(\);(?<X1122631>)|\w{1,40}=(document\.)head\|\|\39getEle\w+\(['"]head['"]\)\[\d+\],\w+=['"]script['"],\w+=atob\(['"]aHR0[^;]+;\w+\+=[^\(\);]+\(['"]\?['"]\)[\?'"&]+:['"]\?['"];\w+\+=(location\.)[\.\w]+\(\d+\);\w+=\39createEl\w+\(\w+\);\w+\.src=\w+;\w+\.\w+=btoa\(\40origin\);\w+\.appendChild\(\w+\);\}\)\(\);(?<X1274000>)|\w{1,40}=['"]{2},[^\}\n]{1,499}\}[^\,\n]{1,999}(\w{3})=(\w{3})\(['"]rynuunpjqsrkbdte[^'"]{1,99}['"]\)\.substr[^\n]{1,999}\43\[\42\];var\s*\w+[^\n]{1,256}\43\(['"]![^\n]{1,1999};var\s*(\w+)=\w+\([^;]+;\44\(\d+\)\;return\s*\d+[\}\(\)]+\(\)(?:\s*;)?(?<X1257494>)))|\(\){var\s.="\(\w+\(\w+\)f\.\w+,=\w+\/\)\w+\)'\w+\/\)\w+\)'.\)\w+\('=\)\w+\/\[;\(\w+\?\!1=\w+'\)\]\w+\(\w+=\w+,=\w+\.\w+'=\w+\(\w+\(\w+\+\)\w+'.=\w+\+\w+\!'\w+!\w+&\w+\(\w+\)-\{\w+\(\w+\(\w+\.\w+\..+?eval\(\w+\);\}\(\)\);(?<X1042911>)|\(\w+,(?:(\w+),(\w+),[\w,]+\)\{\47\[{2}(?:\48\[\d+\],\48\[\d+\],){5,}\48[^\.]{1,99}(\.\w+)\(['"\)\]]+\([^\.]{1,99}\49[^\{]{1,}[\{\w\s]+(\w+)=\47[^;]{1,999};\50\.\w+=\w+;\47\[+\48\[[^;]{1,999}=\w+;\47\[{2}\48[^\.]{1,399}\49[\(\)'"\]]+\.\w+\.\w+\(\50[\)\}]+\(['"][^/]{1,32}//\w+\.facebook\.net/[^,]{1,99},\w+,['"]te[^'"]{99,}['"]\);(?<X120351792>)|\s*(\w+),\s*(\w+)[^\}]{1,99}\}\);\w+\s*\w+=\52\.getElementsByTagName\(\53\)\[[^\}]{1,999}\}\)\(\w+,\w+,['"]script['"][^;]+GTM\-PZHHCPS['"]\);(?<X120360131>))|\(\w,(\w)(?:(?:,\w)+\)\{\w+=\55\.createElement\((\w+)\);\w+=\55\.getElementsByTagName\(\56\)\[[01]\];[^\}]+\}\)\(window,document,['"]script['"],['"]https?://(?:limeerror|emperorplan)\.(?:org|com)[^'"]*['"]\);(?<X1253680>)|,(\w),(?:(\w),(\w),(\w)(?:(?:\w,)?)+\)\{\60=\55\.createElement\(\58\);\61=\55\.getElementsBy\w+\(\58\)\[\d+\];\60\.async=\d+;\60\.src=\59;\61.parentNode\.insert\w+\(\60,\61\);\}\)\s*\((?:(?:\w+|['"]\w+['"])[,"])+['"]https?://(?:eeatgoodx|tnoodlezy)\.com[^'"]+['"][^@]{1,150}\bwindow\.location[^;]+;(?<X1255391>)|\w,(\w),(\w)\)\{\63=\55\.createelement\(\58\);(?:\64=\55\.getelementsbytagname\(\58\)\s*\[\d+\];\63[^\(]{1,99}insertbefore\(\63,\64\);\}[^/]{1,99}['"]https?://trademark\.iglesiaelarca\.com[^'"]{1,99}['"]"[^/]{1,99}https?://trademark\.iglesiaelarca\.com[^'"]{1,99}['"]</\w>\);(?<X120343571>)|\w=\55\.getElementsByTagName\(\58\)\[\d\];\63\.async=\d;\63\.src=\w;\64\.parentNode\.InsertBefore\(\63,\64\)\}\)\(\w+,\w+,['"]\w+['"],['"]https?://[^/]{16,199}/[\w\-]{32,}['"][^\{]+\{var\s+\w+=atob\(['"]aHR0cH[^'"]{1,499}['"]\);\63=\55\.createElement[^,]+\63,\64\)\}\)\(\w+,\w+,['"]script['"]\);(?<X120336524>))))|\(\w,[^\{]+\{\w=\w\.createElement\([^\}]{1,99}\}\)\(document,\h*['"]script['"],\h*['"]https?://content\-website\-analytics\.com/[^'"]+\.js['"]\);(?<X120341500>)|\(_0x[a-f\d]{6},(_0x[a-f\d]{6}),[^\)]+\)\{var\h*_0x[a-f\d]{6}=_0x[a-f\d]{4}(?:,_0x[a-f\d]{6}=_0x[a-f\d]{4})+;_0x[a-f\d]{6}=\68\[['"]createElement['"]\]\(_0x[a-f\d]{6}\),(_0x[a-f\d]{6})=[^\}\n]+\69\);\}\s*\(window,document,_0x[a-f\d]{6}\(0x[a-f\d]{2},['"]Y4n5['"]\),_0x[a-f\d]{6}\(0x[a-f\d]{2}\)\)\);(?<X1260550>)|\(window\)\s*{\s*"use\s*strict"\s*;\s*var\s*Miner\s*=\s*function.+miner\.start\(\);(?<X1043262>)|\s*\((\$\w+)\)\s*\{\s*(?:include|require)_once\s*\72;\s*\}\)\s*\(['"]zip://[\w\-]+\.zip#\w['"]\);(?<X120357011>)|\s*\([^\{;]{1,49}\{\s*var\s+\w+[\s=]+\{[^\}]+\bformat[:\s]+['"]pusher\-universal['"][,\s]+domain[\s:]+['"]([^'"]+)['"][^@\?]{99,1499}\.src[\s=]+['"](?:https?:)?//\74/ntfc\.php\?[^\?#]{1,1499}\bwindow\.opener\.postMessage[\s\(]+['"]popupRunStage#\w['"][^;]+;[\s\}]+catch\b[^\{;]{0,9}\{[\}\s]+\(['"]\{\\['"][^\n]{999,},\h*['"]abcdef\w+['"]\)\);(?<X1220841>)|\s+\(\w,\s+\w,\s+(\w),\s+\w,\s+(\w),\s+(\w)\)\s+\{\s+\77\s+=\s+\w\.createElement\(\76\);\s+\78\s+=\s+\w\.getElementsByTagName\(\76\)\[\d\];\s+\77\.async\s+=\s+\d;\s+\77\.src\s+=\s+\w;\s+\78\.parentNode\.insertBefore\(\77,\s+\78[;\)\s\}]+\(window,\s+document,\s+['"]script['"],\s+[`'"]https?://es6featureshub\.com/\w+['"`]\);(?<X120336081>)|_exists\(['"]pThumb(\.dbsthru)['"]\)\)\{@?pdb\80\([^\)=\}]{1,199}\bhttps?://pastebin\.com/(?:raw|download)/[^\)]{2,40}\);(?<X2174940>))|isset\(\$_(?:[GPCSR]\w{2,6}\[[^\]]+\]\)+\{function\s*(\w{1,40})\(\$\w{1,40},(\$\w{1,40})\)\{(\$\w{1,40})=fopen\(\83,[^\}]{1,299}\bcurl_setopt\(\$\w{1,40},CURLOPT_FILE,\84\);[^\}\?]{1,299}\}if\(\82\(['"]https?://[^/;]{0,99}\bgithub(?:usercontent)?\.com/[^,]{1,99},['"][^'"]+\.php['"]\)(?<X2168590>)|POST\['execl'\]\)\)\s*{\s*echo\s*\$_POST\['execl'\]\s*\.\s*'<br>'\s*;\s*echo\s*myshellexec\(\$_POST\['execl'\]\);\s*}\s*if\s*\(isset\(\$_POST\['pcntl_exec'\](?<X2047910>))|mail\([^\)]+\)+\{echo\s*['"][^;]+>Spam+ed\b(?<X2221061>)|str(?:len\(['"]ab['"]\),['"]\w+==['"](?<X220367921>)|str\((\$\w+),['"](getcontent301page)['"]\)\)\{header\(['"]HTTP/1\.1\s*301\s*\w+\s*\w+['"]\);\$\w+=str_replace\(['"]\90['"],['"]['"],\89\);header\(['"]Location:\s*['"]\.\89\);(?:exit|die);\}\}\}\}\}\Z(?<X220340301>)))
\)(?:;(?:\$\w+=\w+\(\$\w+\);\w+\(\$\w+\);\$\w+=array\(\s*(?:['"][^'"]{32,}['"],\s*){32}\s*['"][^\}]{9999,};\}eval\([^;]{1,99}\);__halt_compiler\(\);\Z(?<X220337900>)|\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?://|#|['"])+(?<X1191895>)|\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\w+\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*,\s*"[^"]*"\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*(?://?[^/]{0,150}/?\s*)?\Z(?<X2048822>)|goto\W+;\W+:return\s*base64_decode\(str_rot13\(['"](?<X220337330>))|\)(?:\s*\{\s*echo\s+'<b>Shell\s+Uploaded(?<X2051430>)|\s*{\s*echo\s*PHP_OS\.\$(?<X2043871>))|\s*(?:(\w{1,9})\s*=\s*['"]options\s+Indexes\s+FollowSymLinks[^'"]{9,40}(AddType\s+txt)\s+\.php\\r\\nAddHandler\s+txt\s+\.php\\r\\n\8\s+\.html[^'"]{9,80}['"]\s*\+\s*\w{1,9}\s*(\w{1,9})\s*=\s*['"]echo[^'"]+"'\+\7\+'"\s+>\s+\.htaccess['"]\s*os\.system\(\9\)\s*\w{1,9}\s*=\s*opener\.open\((?<X2063660>)|,\s*array\(\s*\$resf,\s*\$ltime,\s*\$delp\s*\),\s*base64_decode\s*\(\s*['"][^'"]{999,5000}['"]\s*\)\s*\);\s*file_put_contents\s*\((?<X2053463>)|;\s*foreach\s*\(\s*\$blocked_words\s*as\s*\$word\s*\)\s*\{\s*if\s*\(\s*substr_count\s*\(\s*\$hostname\s*,\s*\$\w{1,40}\s*\)\s*>\s*0\s*\)\s*\{\s*header\s*\((?<X2048165>)|\)\s*;\s*\}\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"]block-mail\.txt['"],\s*['"]r['"]\);(?<X2053980>)|eval\(gzuncompress\(base64_decode\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?<X2044001>))|\{header\(['"]Content\-type:\s*text/xml\b[^;]{1,99};die\(Mage::app\(\)\->getConfig\(\)\->getNode\(\)\->asXML\(\)\);\}(?<X2169672>))
\*(?:/(?:\s*(?:/\*\w+\*/function\s*[^\]]{1,999}\w+['"]=>['"]aHR0c(?<X220360440>)|["'](?:\\x2f|/)[\\\-\*\sa-zA-Z0-9_/\.]+?(?:\.|\\x2e)(?:p|\\x70)(?:h|\\x68)(?:p|\\x70)["'];\s*/\*(?<X1037862>)|\$GLOBALS\['_\d+_'\]=Array\(base64_decode\(.{10000,15000};\$GLOBALS\['_\d+_'\]\[\d+\]\(\$_\d+,\$_\d+\);\$GLOBALS\['_\d+_'\]\[\d+\]\(\$_\d+,\$_\d+\);\}\}\}\s*/\*(?<X1039960>)|preg_replace(?:\(['"]/\[[a-z]{1,40}\]\*\.\+\[[a-z]{1,40}\]\*/ei?['"],str_replace\(['"]\s*['"],['"]\s*['"],['"].{100,2100}"\),'\w+'\);\s*\?>\s*\Z(?<X2052730>)|\s*\(\s*"\\[^"]{10,30}"\s*,\s*"\\[^"]{10,110}"\s*,\s*"\\[^"]+"\s*\)\s*;\s*/\*(?<X1040010>)))|extract\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\)\s*;/\*(?<X1041710>)|include\h*['"]jquery\-1\.11\.3\.min\.jpg['"];(?<X120344561>))|\/\s*@\$\w{1,20}\s*\D{2,3}\s*@\$\w{1,20}\s*\(\s*\$\w{1,20}\s*\(\s*\$\w{1,20},\s*\$\w{1,20}\)+;\s*\/\*(?<X1122701>)|\s*(?:@license\s*https?://(?:\w+)?\.imunify\.com/[^\*]{1,99}\*/\s*session_start\((?<X220331591>)|\*\s*arkei\s+stealer(?<X2056840>)|author:\s*wordpress(?:(?:\s+developer)?\s*\*/\s*define\(['"]\w+[^;]{1,999}\.txt['"]\);(?<X220335410>)|\h+core\s*\w+\s*\*/\s*[^\{]{1,99}\{\s*\bprivate\s*\$\w{1,14}[\s=]+['"]aHR0cHM6Ly9jbG91ZGZsYXJlLmNvbS(?<X2324370>)))|\s+Website:\s+(https://wordpress\.org)\s+\*\s+Version:[^:]{1,99}Author:\s+GraybyteSec\s+Team\s+\*\s+Author\s+URI:\s+\13[^/]{1,499}please\s+contact:\s+https://t\.me/rex_cc\s+\*/(?<X220339590>))
\+\+\$o\]\]\)\);}}eval\(\$d\)(?<X2043831>)
\-(?:>(?:is(?:Crawler|Bot)\(\)+\{header\(['"]HTTP/[\d\.]{1,3}\s*40[34]\b[^;]+;(?:die|exit)\b[^;]{0,19};[^@]{1,9999}(?:<form\b[^>]{0,199}\baction=['"][^'"]+\.php['"][^@]{1,9999}\b(?:type=['"]?password|name=['"](?:cvv|pin|ssn))['"](?<X2213091>)|\.(?:text|html)\(['"]Verify\s+your\s+(?:gmail|hotmail|outlook)\b(?<X2213081>))|leak\d*\(\h*\$function_zval\h*,\h*\$\w{1,9}\h*\*\h*8\)\);\s*\}[^\$]{0,99}(\$this->)write\h*\(\h*\3\w{1,40}\h*,\h*\$\w{1,19}\h*\+\h*\d+x\d+\h*\+\h*\d+x\d+,\h*\$zif_system\h*\)\h*;(?<X2138110>))|\-\h*script\-deface\-generator\.prinsh\.com\b(?<X2245460>)|\sWSO\s+['"]\s*\.\s*WSO_VERSION\s*\.\s*['"]\s*</title>(?<X2061933>))
\.(?:(?:chr\(\d+\)\."[a-z0-9/\\ ]*?"\.){5}[^;,]+;(?<X2044874>)|(\$\{\$\{)['"](?:\\x47|G)(?:\\x4c|L)[^\}]+\}\[[^\]]+\]\}\.(\$this->CRLF);\s*\}\s*return\s+(?:false|true);\s*\}\s*fputs\(\$this->smtp_conn\s*,\s*base64_encode\(\2['"](?:\\x47|G)(?:\\x4c|L)[^\}]+\}\[[^]]+\]\s*\}\s*\)\.\3\);(?<X2124680>)|(\$GLOBALS\{[0O]{2}\})\[\wx\w{1,20}\]\);\$global_version=\5\{\wx\w{1,20}\}\(\s*\$register_key,\$check_copyright\);\s*(?:\?>)?\s*\Z(?<X2065061>)|/(?:\*-/\*-\*/"(?<X2046130>)|L(?:1|i)ght_R(?:00|OO)t['"],\s*['"]Indonesian\s+Code\s+Party(?<X2061080>))|['"]getdomain(\.aspx)\?[^;]{1,199};(\$\w+)=\$\w+\.['"]\w+\9\b[^\?]{1,499}\becho\s*['"](<script\b[^>;'"]*>document\.location=)["'\.\s]{0,9}\10\b[^;]+;((?:exit|die)\b[^;]{0,19};)[^\?;]{1,199}(\$\w+)=str_i?replace\(['"]\w+\9['"],['"]{2},\10\)[^;]+;echo\s*['"]\11['"\.\s]{0,9}\13\b[^;]+;\12(?<X2225391>)|[\s@]*file_get_contents[\(\s]+['"]/etc/passwd['"]\s*\)(?<X1199140>)|\$(?:_(?:(?:REQUEST|COOKIE|SERVER|GET|POST)\[['"]rat['"]\];\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:echo|print)\s*\(?['"]php\s+20\d{2}\s+Terminator['"]\)?;(?<X2064360>)|SERVER\[['"]SERVER_ADDR['"]\];\s*if\h*\((file_exists)\h*\(['"]C:/WINDOWS/repair/sam['"]\)\)\s*\{[^\}]{9,150}\}\s*if\h*\(\17\(['"]/etc/passwd['"]\)\)\s*\{(?<X2139100>))|bin\.['"]@MrProfessor\.com\b(?<X2153420>))|\((file_)put(_contents)\s*\(\s*['"][^'"]+\.php['"],\h*\20get\21[\h\(]+['"]https?://pastein\.vercel\.app/api/raw\?[^'"]+['"][\h\)]+\.['"]{2}(?<X120361690>)|\s*(?:/sss\s*\.\s*pl\s*<\s*local_host\s*>\s*<\s*local_port\s*>\s*\[\s*auth_login\s*\(\s*:auth_pass\s*\)\s*\](?<X2046850>)|php_uname\(\s*\)\s*\.\s*['"][^'"]{0,40}['"]\s*\.?\s*getcwd\(\s*\)\s*\.\s*['"][^'"]{0,40}['"];\s*eval\(\$_POST\[['"]?\w{1,40}['"]?\]\);[^`]{1,800}curl_exec\s*\(\$\w{1,40}\);\s*\}?\s*\?>\s*\Z(?<X2052450>))|createElement\(['"]iframe['"][^\}]{1,999}\}\w+\([^;]+;</script>['"];\s*\}\s*\);\s*\w+\(['"]\w+['"],\s*\w+\((\$\w+)\)\s*\{\s*unset\(\25\[plugin_basename[^;]+;\s*\w+\s*\25;\s*\}\s*\);\s*\Z(?<X220353550>)|gethostbyaddr\(getenv\(['"]REMOTE_ADDR['"]\)\)\.['"][^\$]{0,99}\$\w{1,20}\h*=\h*['"]\h*yassinox\b(?<X2141700>)|openssl_error_string\(\)\);\}eval\(\$\w+\);\}\}(\$\w+)=['"][^'"]+['"];\$\w+=new\s*\w+\([^;]{1,99};\$\w+\->\w+\(\28\);\Z(?<X220349270>)|php(?:['"];\s*[ir](?:nclud|equir)e(?:_once)?\s+['"][^'"]{0,49}\banti(?:bot[sz]?)?\d?\.php['"];[^/]{9,199}<title>\s*Netflix\s*</title>(?<X2153181>)|\?sslchannel=true&(?:amp;)?sessionid=(?<X2166124>)|_uname\(\)\.(?:[^\?]{1,199}\.get(?:myuid|mygid|_current_user)\(\)\.){3}[^@]{1,4999}\(['"](?:SELECT\s+(?:table|schema|column)_name\s+from\s+information_schema\.(?:columns|schemata|tables)\b[^@`]{1,999}\(['"]){3}(?<X2223951>))|se(?:lf::\$(?:file|html)Class\->webShellScan\s*\(\)(?<X2225860>)|nd\h*\(\(['"]b374k\h+shell\h*:\h*connected\b(?<X2184982>))|Visible=true;\s*Bin_H2_Title\.InnerText="File Manager(?<X2050781>))
\/\*\w+\*\/[^%]{1,99}define\(['"]\w+['"],\s+['"]\w+['"]\);[^%]{1,199}(\$\w+)\s+\=\s+@openssl_encrypt\(\1.\s+['"](AES\-\d{3}\-\w{3})['"],\s+(base64_decode)[^%]{1,399}md5\(\3[^%]{1,999}openssl_decrypt\(\$_REQUEST\[['"]\w+['"]\],\s+[""]\2['"],\s+\3[^%]{1,599}code_ex\(\);\s+\}\s+\/\*\w+\*\/(?<X120334462>)
\<\?(?:[ph\s]+(?:ini_set\(['"]display_errors['"],\d+\);error_reporting\([^\)]+\);(function)\s*(\w+)\(\)\{(return)[^\}]+\}\1\s*(\w+)[^\}]+\}[^\}]+\3[^\}]+\}\1\s*(\w+)[^@]{1,200}\1\s*(\w+)\((\$\w+)\)\{\3\s*base64\w+\(\7\);\}\7\w+=['"][^'"]*['"];\$\w+=\6\(\7\w+\);\$\w+=\2\(\);try\{\$\w+=\4[^;]+;\$\w+=\5[^\{]+eval[^\{]+catch[^\}]+echo[^\}]+\}unlink[^;]+;(?<X2258510>)|ob_(?:end_)?clean\(\)(?:(?:;die|\.die)|(?:;exit|\.exit))\((?:require|include)?(?:_once)?\s*\176[^\(]+(?:hex2bin|urldecode)\([^\)]+\)\.__file__\.(?<X2300449>))|php(?:[^%]{1,99}(?:Hello\s+cecaf[^%]{1,999}http\:\/\/cecaf\.com(?<X220332050>)|Js\s+Code\s+Injector[^%]{1,999}register_activation_hook\(__FILE__(?<X220332040>)|Plugin\s+Name\:\s+Stealth\s+Admin[^%]{1,999}STEALTH_ADMIN_USERNAME(?<X220332030>))|\s*\$\w+[\s=]+sha1\(md5\([^%]{1,199}<title>\w+\s*Shell</title>[^%]{1,999}htmlspecialchars\(shell_exec\(\$_POST\[['"]\w+['"]\](?<X220369450>)))
\?(?:>(?:<\?php\s*(?:function\s*\w{5,20}\(\$\w{1,10}\)\s*\{\$\w{1,10}\s*=\s*Array\([^g]{1,40}(?:gzinflate|gzuncompress)['"](?:,\s*['"]_f_wp['"]){4}\s*,\s*['"]<form\s*method\s*=\s*['"]?post['"]?\s*action\s*=\s*(?:['"]){2}?\s*>(?<X2122671>)|set_time_limit\(\d+\);ignore_user_abort\(1\);\$[^%]{1,999}\{\$\w+=strtolower\(\$\_\w+\[['"]HTTP\_USER\_AGENT['"]\]\);\$\w+=\[['",\w+\s*]+\];[^%]{1,2399}['"]\w+\.cvberriesoy\.site['"];[^%]{1,2999}if\(file_put_contents\(\$\w+,\$\w+\)\)\{[^\}]{1,999}\}else\{\$\w+=['"][^'"]+['"];[^&]{1,}file_get_contents\(\$\w+\);[^%]{1,999}echo\$\w+;exit\(\);\}}\?>(?<X120369113>))|\s*(?:<(?:(div)\s*[^>]{1,99}hidden;height:1px;\w*:1px;['"]>[^<]{1,999}<(a)\s*href=['"]https?://[^'"]+['"]>[^<]{1,999}</\4>[^\n]+</\3>\Z(?<X1319231>)|\?(?:php)?\s*eval\(base64_decode\(['"][^'"]{1000,3000}['"]\)\);\s*\?>\s*</title>(?<X2053581>)|\?php(?:\s*(\$\w{1,15})[\h=]+@?\$_FILES\[[^\]]+\];\s*if[\h\(]+\7[^\{]+\{\s*(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\h]+\7[^;]+;\s*if[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\7\[[^\]]+\][\h,]+\8[\)\s\{]+echo[^\}]{0,99}\}\s*\}\s*echo\h*['"]<(html)>[^;]{9,250}</\9\>['"];\s*\?>(?<X1201492>)|\s+/\*\s*Obfuscation\s+provided\s+by\s+FOPO(?<X2064770>)))|\|\s+GODSpy\s*</title>(?<X2061892>)))|getlinkofdoor=(?:["']\.urlencode\([^\}\?]+\$_[l1o0]{1,40}\.['"]\?gendomain=['"]\.\$_[l1o0]{1,40}\.[^\}@%]{99,1500}\barray\((?:['"]wp\-[^'"]{2,20}['"],){2,5}(?<X2191670>)|['"]\.urlencode\([^;]+\);\s*if\(isset\(\$_[^:\$]+\):\$\w{1,20}=array\(['"]wp\-(?:config|load|header|settings|blog\-header)\.php['"](?<X2170820>)))
\[(?:(BLOCK\h*\d*)\]\s*(?:\$\w+[\h=]+filemtime\(__DIR__\);\h*(\$\w+)[\h=]+str_replace\([^\?]{99,2500}\becho\h*['"]DELETED\h*ALL\h*CONTENT['"];[^\n%]{999,5500}\bfile_put_contents\(\2\.['"]\w+\.css['"][^\n%]{999,9000}\btitle['"]=>['"]\w+['"],['"]content['"]=>\$\w+[\);\}/\s]+\[/\1\](?<X1317280>)|if\(!stristr\(\$_SERVER\[[^\n]{99,999}\bstyle=['"]position:\w+;left:\-['"]\.mt_rand\(\d{3,6},\d{3,6}\)\.['"]px;['"]>\h*Sitemap[^\n]{999,8500}\bfunction\h*my_get_root_path\(\)\h*\{[^\n\?]{99,900}\breturn\h*\$\w+;[\s\}/]+\[/\1\](?<X1317320>)|if\(\$\w+[\h&]+(?:!?is_file\((\$\w+)\.md5\((\$\w+)\)[\h\.'"]+css['"]\)\)\{[^\n%]{99,4999}\bfile_get_contents\(\5\.md5\(\6[\)\.\h'"]+css['"]\)[^\n%]{999,6500}\->write_\w+\(\5\.md5\(\6\)[^\}]{0,50}\}[\s\}/]+\[/\1\](?<X1317300>)|is_array\(\$\w+\)[^\n]{9,200}\->(\w+)[\h=]+\bfile_get_contents\(\$\w+\.['"]\8\.css['"][\s\)\};/]+\[/\1\](?<X1317290>))|public\h*function\h*\w+\((\$\w+),[^\n%]{999,8000}\bjson_decode\(file_get_contents\(\10\.["']good_links\.css['"]\)[^\n%]{999,7000}\bfclose\(\$\w+\);\h*return\h*\$\w+;[\s\}/]+\[/\1\](?<X1317310>))|['"]?(cmd)['"]?\]\s*\)\s*;\s*@?system\s*\(\s*\$\12\s*\)\s*;\s*echo\s*\(?\s*['"][^'"]{1,40}['"]\s*\)?\s*;\s*if\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\12['"]?\]\s*[^\w]{1,2}=\s*['"][^'"]{1,40}['"]\s*\)\s*\{\s*\?>\s*</?pre>(?<X2056470>)|\s*function\h*\((\$\w+)[\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\14;[\s\}\]\[]+\d\]\h*\(['"]zip://[^\.]+\.zip#\w+['"]\);(?<X120345050>)|function\((\$\w+)\)\{(?:(?:include|require)(?:_once)?\(\16\);\}\]\s*\[0\]\(['"]zip://\w+\.zip#\w+['"]\);(?<X120354741>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\(\16\);\}\]\[\d+\]\[\(['"]zip://[^#]+#[^'"]+\.php['"]\)\];(?<X120343520>)))
\\(?:n['"]\s*;\s*\$(?:message|data|msg)\s*\.?=\s*['"]\s*(?:Pass|PWD?)[^\n></]{1,60}(?:['"]?\\n['"]|['"]/['"]);[^\*\+%\^#`]{1,1999}\b(?:mail|telegram_send)\s*\([^\?]{1,600};\s*(header\s*\(\s*['"]location:)[^;]{1,99};\s*(?:\}\s*else\s*\{\s*\1|\?>)(?<X2273301>)|x\w\w"\]}=@?unserialize\(sh_decrypt\(@?base64_decode\(\${\$(?<X2047941>))
\](?:\(NULL\);\s*@\$GLOBALS\[(?<X2043771>)|\);\s+(add_action)\(['"]init['"],\s+\[__CLASS__,\s+['"]register_ghost_rewrite['"]\],\s+\d+\);\s+add_filter\(['"]query_vars['"],\s+\[\s+\$\w+,\s+['"]register_ghost_query_vars['"]\s+\]\);\s+\2\(['"]template_redirect['"],\s+\[\s+\$\w+,\s+['"]ghost_template_redirect(?<X220363970>)|\[\d+\]\(\$_\d+\);include\("\{\$_\d+\}\w{1,40}\.php"\);@?\$GLOBALS\['_(?<X2053312>)|\}=(?:"";class\h+BaseJsonRpcServer\h*\{\h*const\h+ParseError(?<X2048731>)|mail_utf8_html_attch\(\$\{\$\{(?<X2048370>)|pre_term_name\(\$\{\$\{(?<X2050500>)))
\A(?:!\+3v\+!\(%[^\$\n]{9,99}\$\s*cloudav\s+test\s+file\s*\Z(?<X2235100>)|#(?:!(?:/(?:(?:usr/)?bin/perl\b[^&_%@]{99,999}\b(?:symlink\h*\(\h*['"]/home/['"][^\)]{9,99}\);\s*){19}(?<X2155230>)|[^$]+perl\b[^\$]{1,49}\$\w{1,40}\s*=\s*['"]CGI\s*Shell['"];[^;]{9,199};\s*\$(?:Password|pass|pwd?)\s*=(?<X2131942>)|bin/bash\s*(?:(\w+)=['"]x86_64[^'"]{1,99}['"][^\$]{1,299}for\s*(\w+)\s+\w+\$\4\s+\w+\s+\bwget\s+http://\d+\.\d+\.\d+\.\d+/(\w+)\.\$\5[^\-]{1,99}\-O\s*\6\.\$\w+\s+chmod[^\n]{1,99}\s+\bdone\Z(?<X2240181>)|PATH=\$PATH:/usr/bin[^;]{1,999}wget\h+(http://\d+\.\d+\.\d+\.\d+)/\w+/(\w+);\h+curl\h+\-O\h+http://\d+\.\d+\.\d+\.\d+/bins/\9;/bin/busybox\h+wget\h+\8/\w+/\9;\h+chmod\h+777\h+\9;\h+\./\9;rm\h+\9\h+##(?<X2323232>)|URLS=\(\s*(['"]https?://[^\.]+\.pages\.dev/webshell)[^'"]+\.txt['"][^\?]{1,299}\11[^'"]+\.js['"]\s*\)\s*COUNT=10[^\.]{1,12}(\w+)[^\-]{1,99}find\s*['"]\$\12['"][^!]{1,219}target_file=['"][^'"]{1,99}\.php['"](?<X220356190>))|usr/bin/perl(?:[^\$@!]{99,300}\bprint\h+['"]<title>\h*Alfa\h+team\b(?<X2198770>)|\b[^\*/\-]{1,40}\bmy\h+\$\w{1,40}\h*=\h*['"][\*\h/\d]{5,20}python\h+\-c\s*\\{3}['"]import\b\h[^\\\v]{99,999}os\.system\h*\(['"][^'"]{99,9999}['"]\.decode\(['"]base64['"]\)\h*\+\h*eval\([^\v\\>]{99,999}\\{3}['"](?:\h*\d*>&?\d*(?:\h*/dev/null)?)?['"];(?<X2162180>)))|[^;]{1,99}/perl\s*use[^\{]{1,299}(my)\s*(\$\w+)[\s=]+['"]\d+\.\d+\.\d+\.\d+['"];\s*\16\s*(\$\w+)[^\{]{1,99}\16\s*\$\w+[\s=]+['"]\\x00['"]\s*x\s*\d+;.{999,}\w+\(\\\2,\s*\\\3\);\Z(?<X220343780>))|\!/bin/\w+\h*\w+\h*=\$\([^'"]+['"](linuxsys)[^\)]+\)[^\+]+wget[^/]+\20[^;]+;chmod\h*\+x\h\20;\./\20#kill\h*all\b(?<X2256260>))|((<\?[ph\s]+)\$\w+[\s=]+date[\('"\s]+Y\-m\-d['"]\);\s*\?>)\23\s*\$\w+=explode\((base64_decode)\(['"]PD9[^;]+;\w+\(\w+[^\{]{1,99}\{(chmod)\([^;]+;\25\([^;]+;file_pUT_coNTEntS\([^,]+,\24\(["]PD9[^;]+;\}\?>\23eval\(['"]\?\s*>['"]\.\24\(['"]PD9[^'"]{999,}['"]\){2}\?>\22\Z(?<X2306460>)|(<\?[ph\s]+)(?:(\$\w+=\d+;)\s*\?>\27\s*\$\w+=explode\(bAse64_deCOde\(['"]PD9[^\n]+strtotime\(['"]\-\d+\s*days[^;]+[;\}\s]+\?>\27\28\s*(?:\?>|\Z)(?<X1308810>)|(error_reporting\(E_\w+\^E_\w+\^E_\w+\));\$\w+=\(\(isset\(\$_SERVER[^<]+str_replace\(['"]iid=['"],['"]idno=\w+['"],\$\w+\);\w+\(['"]Content\-type:text/xml['"]\);echo\$\w+;(?:exit|die)[^\^]{1,4999}\27[^<]+\27\s*\30[^\{]{1,499}\{\$\w+=curl_init\(\$\w+\);[^\?]{1,999}\$\w+={1,4}200\)\{\w+\(\);\}\w+\(\);\?>\Z(?<X1322361>)|define[\(\s'"]+PBOX['",\s]+\d+[\)\s;@]+include(?:_once)?[\s\(]+['"]\w*link\w*\.php['"][\s\);]+\?>\s*\27checkpost[\s\(]+\d+[\s\);\s]+\?>(?<X2211192>))|(<\?php)\s*(?:(\$\w{1,40})\h*=\h*['"]header['"];\s*\34\h*\(['"]Location:\h*https?://\w{2,6}\.[\w\-]{1,40}\.ga/\w{1,40}(?:\.php)?\?[\w\.&=]{1,16}['"]\);(?:\s*\?>)?\s*(?:\33\s*)?if[\h\(]+!\h*(class)_exists[\h\(]+['"]([a-f\d]{32,})['"][\h\)]+\{\s*\35\s*\36\s*\{(?<X2179141>)|if\(!(isset\(\$_)[GPRSC]\w{2,6}\[[^\]]+(\]\)\)\{)header\(['"]HTTP/\d\.\d\s+404[^;]{2,19};(?:die|exit)[^;]{0,19};\}\?>(?:\33\s*\?>)?\33\s*(?:if\(\38[GPRSC]\w{2,6}\[[^\]]+\39echo\s*[^;]{0,19};(?:die|exit)[^;]{0,19};\})?\$\w{1,40}=['"][^'"]{1,99}['"];function\s*\w+\(\$\w+,\$\w+,\$\w+\)\{return(?<X2130762>))|(<\?php\s*)(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;function\s*(\w{1,40})\([^>]{100,600}(\$\w{1,40})=\44[^\?]+(\?>)[^!]{1,150}<form[^>]+action=['"]\41\s*echo\s*\42;[^!]+<input\s*name=['"]\41\s*(echo\s*md5\()\45\);\46['"]\s*value=['"]\41\s*\47\43\);\46['"]>(?<X2127341>)|(?:<![\-\w]+>\s+){1,4}<\?(?:php)?\s+if\(!empty\(\$_FILES\[['"]\w+[^;]{1,499};\s+if\(move_uploaded_file\(\$_FILES\[[^\?]{1,399}}\s+@unlink\(__FILE__\);\s+\}\s+\?>\Z(?<X120363271>)|(?:<\?[ph\s]*\?>\s*){0,3}<\?[ph\s]+eval\(["']\?>['"]\.file_get_contents\(['"]https?://[^/]+/r(?:aw)?/\w+['"]\)+;?(?:\?>\s*){0,5}\Z(?<X2220701>)|(?:<\?[ph\s]+)?if\(!?empty\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(\$\w+)=base64_decode\(['"]PD9[^;]+;(\$\w+)=['"]/[^;]+;function\s+(\w+)\((\$\w+),(\$\w+)\)\{[^\}]+file_put_contents\(\54,\55\);[^\?]{0,99}\b\53\(\52,\51\);[^\?]{0,99}\53\(["'][^'"]{0,99}\.htaccess['"],[^;]{19,};\}+(?:\?>)?\Z(?<X2216490>)|(?:<a\h*style=['"]display:None;?['"]\h*href=['"]https?://[^>]+>[^<]{0,60}(?:togel|slot|gacor)[^<]{0,60}</a>\s*){10,}['"]?;?\Z(?<X2226040>)|(?:<script>)?window\[['"]\w{8,}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\58[^\]]{1,599}cdndomain['"]:['"]\w+\.\w+['"]\};window[^!]{99,999}!function\(\)\{\w+\s+(\w),\w,\w,\w,\w=\{\w+:\w+\(\59,(\w+)[^\n]{1,9999}\w=\w+\(\59,\60\)\{.{1,}\59\.paused&&\59\.\w+\(\)\.\w+\(\(\59[^\}]{1,99}blocked:['"],\59\)\}\)\)\}\}\}\}\)\)\}\(\)\}\(\);(?:</script>)?\Z(?<X220340861>)|(?:\s*<\?php\s*(?:\/\*[^\*]{100,600}\*/)?\s*error_reporting\((?:0|false)\);\s*ini_set\(\s*['"]max_execution_time['"]\s*,\s*(?:0|false)\);\s*eval\(\s*base64_decode\(['"][^\?]{1000,2500}break;\s*\}\s*\}\s*\}\s*eval\(\s*gzinflate\(\s*base64_decode\(\s*\$\w{1,40}\s*\)\s*\)\s*\);\s*\?>){3}(?<X2055501>)|(?:\s*return;[=\s]+function[\(\s]+(\w+)[\)\s]+[\{\s]+\63\.\w+\.insertBefore[\(\s]+\w+,\s*\63\.\w+[^\?]{1,110}\b(elem)\.type[=\s]+(String\.fromCharCode[\(\s]+)(?:\d+[,\)]+)+;\s*\64\.src[=\s]+\65\b104,(?:\d+[,\)\s]+){37,}115[\)\s]+;[^\?]{1,200}\bdocument\.get\w+[\(\s]+\65[^\)]+\)+\[[^\]]+\]\.append\w+[\(\s]+\64[\s\}\);]+\(\s*\);?)+(?<X1225821>)|(Element)\.prototype\.(?:(append)After\h*=\h*(function\()\67\)\h*\{\h*\67\.parentNode\.insert[^\{]{9,99};\h*\(\69\)\h*\{\h*var\s*(\w{1,40})\h*=\h*(String\.fromCharCode\()104,116,116,112[^\)]+\);[^\}]+(\w{1,40})\.src\h*=\h*\70;[^\}]{99,999}\(\71[^\)]+\)+\[\d+\]\.\68Child\(\72\);\h*\}\h*\)\h*\(\);(?<X1184103>)|appendAfter\h*=\h*function\((\w{1,40})\)\s*\{\s*\74\.parentNode[^:]{1,99}var\h*\w{1,40}\h*=\h*https?://\w{1,9}\.\w{9,24}\.\w{2,6}/[^;]+\bvar\h*(\w{1,9})\h*=\h*document\.create\67\(script[^\v#]+else\h*\w{1,9}\(\75,\w{1,9}\)\h*\}\h*\((\w{1,9}),window\.lazyLoadOptions\),\76\}\h*\);(?<X1176350>))|.{0,10}GIF8[79a]+<\?php\s*eval\((?<X2050220>)|.{32,99}(###ex###)[^\n]{8999,}\79\h*(?:<li>\h*<a\b[^>/:]{0,99}\bhref=['"]?https?://[^>]+>[^<#\n]{0,199}</a>\h*</li>\h*){3,}###link###\s*\Z(?<X2290921>)|<(?:!(?:[\-\s]+SEO\s*\w+[\s\-]+>\s*<!DOCTYPE\s*html>[^:]{1,99}:wormhole=[^@]{2,2999}\bdns\-prefetch['"]\s*href=['"][^'"]+\.lazcdn\.com['"](?<X220359772>)|\-{2}[\w\-]+\-{2}>\s*<\?php\s+class\s*\w+[^\\]{1,999}chr\(ord\([^\{]{1,999}\s*\{\s*self::\$\w+[\s=]+array\([^\)]{999,49999}\);\s*\}\s*\}\s*class(?<X220346770>)|DOCTYPE(?: HTML><html\h+xmlns=['"][^'"]+['"]><head><title>\h*[cwd](?:iscount|heap|holeSale)[^>/]+Jersey[^>/]*</title>[^:#\?]{1,299}<meta\h+name\h*=\h*['"]description['"]\h*content=['"][^"']{1,499}\bJerseys\b(?<X2148760>)|\s+html>\s+<html>\s+<head>[^/]{1,249}<(title)>[^<]{0,199}((?:\bSitus\s+Slot|\bSlot\d*\s+Gacor\b|\bslot\d*\s+Gampang\b))[^<]{0,199}<[\s/]+\84>\s+<meta\s+name=['"]description['"]\s+content=['"]\85(?<X220339550>)))|\!(\-{2})\s*\w{1,10}\s*\87>\s*<\?php\s*(\$\w{2,3})=['"][base64dco_]+[^\)]{1,99}\$_[GPRSC]\w{2,6}[^;]+\bdie\([^=.]{1,99}(\$\w{2,3})=['"][base64dco_]{1,10}['"]\.\88[^;\(]+;eval\(\89\(\$_[GPRSC]\w{2,6}[^;]{1,16};\?>\Z(?<X2239630>)|\?(?:=|php)\s*null;\s*eval\(['"]\?>['"]\.file_get_contents\(base64_decode\(["']aHR0cH[^'"]{1,70}LnR4dA==['"][\);]+\s*\?>(?<X1193740>)))
\A<\?(?:php)?(?:.{0,80}\$ipv?[\h=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\h*\.?=\.?\h*[^;]{1,80};\s*){4,8}@?mail\([^\)]{1,80}\)\s*;\s*header[\h\(]+['"]Location\h*:[^\)]+\);\s*\?>(?<X2052302>)|[^=]{1,199}=str\w+\(\$_SERVER\[['"]HTTP_USER_AGENT[^!]{1,399}!preg_match\(['"][^>]{1,999}(header)\(['"]Expires:\s+0['"],true\);\2\(['"](?:Link|Location):\s?[<|"]https?://[^\)]+\);(?:include|require)__\w+__\.['"]/\w+\.\w+[^\.]{1,199}(?:include|require)\w+\.['']/[\w\-]+\.txt['"];(?:exit|die);\?>(?<X120349642>)|[^\$]{1,99}(\$\w+)\s*=\s*isset\(\$_SERVER\[['"]HTTP_REFERER['"]\]\)[^!]{1,99}\4[^:]{1,199}\w+\(['"]Location:\s*https?://uzmanhacking[^;]{1,29}['"]\);\s*exit\(\);\s*\}[^;]{1,299}(\$\w+)[^;]+\.html['"];[^\\]+include\s*\5;\s*\}\s*exit\(\);\s*\}\s*\}\Z(?<X220343921>)|[^\{]{49,99}(if\(isset\()((\$_[GPCSR]\w{2,6}\[)[^\]]+\][\h\)]+)&&[\(\h]+sha1\((base64_decode\()\8(\^\$\w+\))[^;]+echo[^;]+;\7\9[^\]]+\][\h\)]+\{(\((\$\w+)=[\(\h]+\10\9[^\]]+\][\h\)]+\11[\)\.\h]+\13\(+\10\9[^\]]+\][\h\)]+\11)[^;]+;[\h\}\{els]+\12[\h\)]+;[\h\}]+echo[^;]+;[\h\}\{els]+echo[^;]+;\h*\}(?<X2134143>)|[^\}]{1,99}\$isPasswordProtected\s*=\s*false;\s*\$hashedPassword\s*=[^;]+;[^\}]{1,99}allowRemoteDownload\s*=\s*true;(?<X220336240>)|\s*(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{[^\}]{1,199}\b(?:header\(['"]Location:|eval\()[^\)]{1,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(?:die|exit)[^;]{0,19};\}+){2}\s*(?:\?>|\Z)(?<X1181881>)|\s*(\$\w+)=['"][^'"]{99,}['"];\w+\s*\w+\(\w+\$\w+,\w+\$\w+\)[\s:]+\w+\{\$\w+=['"]AES\-[^;]+;\$\w+=hash\(['"][^=]{1,199}=base64_decode\(\$\w+\);\w+[^=]+=explode\(['"][^\{]{1,999}\{\$\w+=\w+\([^;]+;eval\(\$\w+\);\}\w+\(\17,\d+\);\?>\Z(?<X2323840>)|\s*(\$\w{1,40})=(curl_)init\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:\20setopt\(\19,[^;]{1,199};){1,}(\$\w{1,40})=\20exec\(\19\);(?:eval|assert)\(['"]\?>['"]\.\21\);\s*(?:\?>)?\Z(?<X2178670>)|\s*(\$\w{1,40})=['"](?:\w{32,64}['"];error_reporting\([^;]{1,99};function\h*\w{1,40}\(\)\{global\h*\23;[^@#%/]{4999,9999}\bfile_put_contents\(\23,\$_[GPCSR]\w{2,6}\[[^@#%/]{999,4999}\bforeach\([^\{]+\bas\s*(\$\w{1,40})\)\{header\(\24\);\}\s*(?:\?>|\Z)(?<X1186640>)|https?://[^;/\?=&]{0,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(\$\w{1,40})=file_get_contents\(\23\);(?:echo|print)\(?['"]?\26['"]?\)?;?(?:(?:die|exit)\b[^;]{0,19};)?(?:\?>)?\Z(?<X2185613>))|\s*(\$\w{1,40})=urldecode\([^;]{1,199};\$\w{1,40}=(?:\28\{\d+\}\.){3}[^\v\?@#%&:]{999,4999}\[['"](?:del|trojan|shell_link)['"]\][^\?]{1,199}=(\$\{['"]GLOBALS['"]\}\[)[^\]]+\]\(\$\w{1,40}\);[^\v\?@#%]{1,4999}\29[^\]]+\]\(\d+\);\s*(?:\?>|\Z)(?<X1185970>)|\s*(file_)pu(t_contents\()['"][^'"]+\.php['"],\31ge\32['"]https?://[^'"]{1,99}['"]\)\);?\s*(?:\?>|\Z)(?<X1175170>)|\s*(goto)\s*\w+;\s*\w+\s*:\s*(\$\w+)[\s=]*\w+\(\);\s*\34\s*\w+;\s*\w+:\s*\w+\(\35\);\s*\34\s*\w+;\s*\w+:\s*(\$\w+)[=\s]+['"]\\[^'"]+\\x2e\\x74\\170\\x74['"];\s*\34[^:]+:\s*eval\(['"]\\77\\x3e['"][^\?]+\36\);\s*\34[^\?]+\34\s*\w+;\s*\w+:\s*\?>\Z(?<X2325650>)|\s*//[^;]{1,999}shadow\-dominion[^\)]{1,99}random\s*smtp\s*&\s*retry(?<X220343910>)|\s*/\*\*\s*\*\s*@package\s*haxor\.group\b(?<X220326900>)|\s*/\*\s*\*\s*(?:Advanced\s*Web\s*Application\s*(Framework)\s*\*\s*generated:\s*\d+\-\d+\-\d+\s*\d+:\d+:\d+\s*\*\s*version:\s*\d+\.\d+\.\d+\s*\*\s*license:\s*mit\s*license\s*\*\s*original\s*size:\s*\d+\s*bytes\s*\*\s*encoded\s*size:\s*\d+\s*chars\s*\*/\s*//\s*framework\s*constants.{9999,}//\s*\40\s*footer\s*//\s*\w+\s*of\s*\40[^\?]{1,99}\?>\Z(?<X220337650>)|shadow\-dominion[^\*]+cpanel\s+email\s+bulk\s*\w+\s*\w+\s*\(unique\s*random\s*users\)\s*\*\s*master(?<X220343900>))|\s*/\*\s*plugin\h+name:[^:]{1,99}:\s*(http://wordpress\.org/#)\s*\w+:\h+official\s*wordpress\h+plugin\s*author:\s*wordpress\b\s*version:[^\*]{1,99}URI:\h+\43(?<X2323790>)|\s*\$\w+=(?:['"][^'"]{1499,}['"];eval\(implode\(['"]{2},\[['"]\?>['"],gzinflate\(gzuncompress\(base64_decode\(\$\w+\)\)\)\]\)\);(?:\$\w+=['"]\w{30}['"];){5,}\Z(?<X120337830>)|\[\s*['"]https://[^'"]{1,299}\w+\.txt['"][^\n]+\(unlink\)\.?</\w+>['"];\s*\?>\Z(?<X220333082>))|\s*\$\w+[\s=]+parse_ini_file\(['"]Anticonfig\.ini\b(?<X220370511>)|\s*\$new_user_login[^;]{1,99};\s*\$new_user_pass[^;]{1,99};\s*\$new_user_email[\s=]+['"]admin@example\.com['"];[^\\]{1,999}Fungsi(?<X220338842>)|\s*\((?:include|require)\s*\176\s*rawurldecode\((?<X2323820>)|\s*\w+\(!\w+\(['"]ABSPATH['"]\)\)\s*\w+;\s*add_action\(['"]\w+['"],\w+\(\)\{\w+\(is_admin.{99,9999}script>['"];\},99999\);\Z(?<X220361220>)|\s*\w+\s*(\w+)\((?:(\$\w+)\)\s*\{(\$\w+)=\w+\(\);\w+\(\53[^;]{1,99};\w+\(\53[^;]+;curl_setopt\(\53,\w+,\52[^\}]{1,999}\}(\$\w+)=['"]\?>['"];eval\(['"]\{\54\}['"]\.\51\(['"]https?://[^'"]+['"]\){2};\?>\Z(?<X2323830>)|\$\w+\)\s*\{(\$\w+)=\w+\(\);\w+\(\56,[^;]{1,32};\w+\(\56[^;]+;\w+\(\56[^;]{1,32};(\$\w+)=\w+\(\56\);\w+\(\56\);\w+\57;\}(\$\w+)=['"]\?>['"];eval\(['"]\s*\{\58\}['"]\.\51\(['"](?:https?:)?//[^'"]+['"]\)\);\?>\?>\Z(?<X220328180>))|\s*class(?:\h+(\w{1,40})\{function\s*__construct\(\)\{\$\w{1,40}=(\$this\->)\w{1,40}\(\61(\w{1,40})\);[^\?]{199,999}\$(\w{1,40})=(ord\()(\$\w{1,40}(\[\61\w{1,40}\]))\)\s*[\+\-/\*]\s*\64\$\w{1,40}\66\);\65=chr\(\$\63\W[^\?]{19999,29999};var\s*\$\62=['"][^;]{99,999};\}\s*new\h+\60\(\);\s*(?:\?>|\Z)(?<X1188710>)|\s*(\w{1,40})\{\s*(?:var\s*)?\$\w{1,40}=['"][^'"]{25000,}['"];[^\?#@]{9999,35000}\}(\$\w{1,40})=new\s*\68\([^\)]{0,99}\);[^\?]{1,499}\b(eval\(\69\->)\w{1,40}\);\}else\{\70\w{1,40}\);\}+(?:\?>)?\Z(?<X2187100>)|\s*(Foo\w+)\{private\s*\w+\s*\w+\(\)\{\$\w+=\d+\s*\+\s*\d+;\w+\(isset\(\$unused\)[^@]{1,999}function \s*(\w+)\(\)\s*\{\$\w+=['"][^'"]{999,}['"];(\$\w+)=substr\(\74,\d+\);\$\w+=base64_decode\(\74\);\$\w+=\w+\(\$\w+\)[^\}]+\}[^:]{1,999}null;\}\}\72::\73\(\);\Z(?<X220340421>)|\s*\w+\{private\s*\w+\s*\w+\(\)\s*\{\$\w+=\d+;\$\w+=isset\((\$_SERVER\[['"]HTTP_USER_AGENT['"]\])\)\?\76\s*:\s*['"]none['"];.{9999,}ob_end_clean\(\);\w+\(!\$_\w\(['"]DISABLE_EVAL['"]\)&&(\$\w+)!={2}false\)\{return\s*eval\(\77\);\}{3}\$\w+=\d+;:\w+\(\);\Z(?<X220345690>))|\s*define\(['"](\w+)['"],(\w{1,40}\(\))\);ob_start\(['"](\w+)['"]\);(function\h+)\81\([^\{]{0,99}\{\$\w+=\79;\$\w{1,40}=abs\(crc32\(\$_[GPSRC]\w{2,6}\[[^@]{99,999}\82\80\{\$\w{1,40}(?:\[\])?=['"]<a\b[^>]{0,99}\bhref=['"]\{?https?://[^/'"]{0,19}(?:viagra|cialis|casino|pharm|jersey)[^;]{9999}(?<X2180821>)|\s*echo\s*['"]<form[^\}]+if\s*\(\$_[GPRSC]\w{2,6}\)\{\s*\$\w+=proc_open\(['"]curl\h*\-\-output\s*['"]\.\$_[GPRSC]\w{2,6}\[['"]\w+['"]\]\.[^,]{1,99}\$_[GPRSC]\w{2,6}\[['"]\w+['"]\][^\(]{1,29}array\([^;]{1,99};\s*echo\s*['"]\w+['"];\s*\}\s*\?>\Z(?<X220343081>)|\s*error_reporting\([^;]{1,9};header\(['"]Content\-type:\h*text/html\b[^@#]{999,1999}=(['"]https?://[^/;]{1,99}\.xyz/)[^@#%\+]{999,2999}\{(?:if\(\$_[GPCSR]\w{2,6}\[[^\]]+\][^\)]+\)\{echo\h*\85[^@]{99,999}\b){2}=(?:f(?:write|close)\([^;]{1,99};){2}return\b[^;]{1,99};\}(?:\?>)?\Z(?<X2180722>)|\s*eval\((?:urldecode|base64_decode|hex2bin|str_rot13)\(['"]\?>['"]\)\.file_get_contents\((?:urldecode|base64_decode|hex2bin|str_rot13)\(['"]https://[^'"]{1,399}['"]\)+;\Z(?<X120362590>)|\s*function\s*(\w+)\(\)\{if\(!isset\((\$_SERVER)\[['"]HTTP_USER_AGENT['"][^!]+!?\w+\(\89\[['"]HTTP_REFERER[^\}]+\}(\$\w+)=\89\[[''"]HTTP_REFERER['"]\];\w+\s*strpos\(\90,['"]google[^%]{1,1499}(\$\w+)=['"]https://[^\'"]{1,499}\.txt['"];if\(\88\(\)\)\{\$\w+=\w+\(\91\);echo\$\w+;[^\?]{1,499}include\(\$\w+\);\}\}\?>(?<X120340640>)|\s*goto[^@]{99,1799}@?file_get_contents\((\$\w+)[^!]{1,999}\93[^@]{1,3999}@?header[^#]{999,8999}preg_match[^&]{999,}\_SERVER\[['"]\\x48\\x54\\124\\120\\123['"]\]\)\s*&&\s*strtolower\(\$_SERVER\[['"]\\110\\x54\\124\\x50\\123['"]\]\)[^#]{999,9999}\$_SERVER\[['"]\\[^'"]+\\\d+['"]\]\);\s*goto[^\?]+goto\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X120348962>)|\s*if\([^;\{]{0,99}\$_[GPCSR]\w{2,6}\[[^;\{]{1,99}\{header\(['"]HTTP/[\d\.]+\h+40[34]\b[^;]{1,99};(?:(?:die|exit|echo|print)\b[^;]{0,19};)\}else\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}(?:\?>)?\Z(?<X2185630>))
\A<\?(?:php)?(?:\s*include\s*['"](?:sc|bots?|antibots?|blocker[sz]?){1,2}\.php['"];[^\$]{1,99}if\((?:strpos\([^,]{1,49},['"](?:google|msn|mozilla)['"]\)[^\)\|]{1,49}(?:\|\||\))\s*){1,5}\{header\(['"]HTTP/\d\.\d\s+404\s*Not\s*Found['"]\);(?:die|exit)\([^;]{1,19};\}(?<X2133930>)|\s+(\$\w+)[=\s]+new\s+ZipArchive;\w+[\(\s]+\2\->open\([^\?]{1,299}eval\(['"]\?>['"][\.\s]+\$\w+[^\?]{1,199}\2\->close\(\)[;\}\s\w\{'"]+\?>\Z(?<X120363041>)|\s+(\$\w+)\s+=\s+['"](?:/[^\(]{1,499}\(file_put_contents\(\4,\s+(?:gzdecode\()?base64_decode\(['"][^'"]{999,}['"\)\{\s]+\$\w+\s+=\s+filesize\(\4\);[^\{]+\{\s+@?chmod\(\4,[^=]+@?touch\(@dirname\(\4\),[^@]+@unlink\(\4\);[\}\s]+(?:die|exit)\(['"][^'"]{1,499}['"]\);(?<X120335151>)|[^'"]{1,199}['"];\s+(\$\w+)\s+=\s+['"][^'"]{1,199}['"];\s+if\s+\(filesize\s+\(\6\)\s+!=\s+\d+\s+&&\s+(\$\w+)\s+=\s+file_get_contents\s+\(\4[\)\{\s]+unlink\s+\(\6\);\s+file_put_contents\s+\(\6,base64_decode\s+\(\7\)\);\s+\}\s+\?>\Z(?<X120337870>)|https?://[^'"]{1,399}\.\w+['"];\s+(\$\w+)\s+=\s+file_get_contents\(\4\);\s+eval\(['"]\?>['"]\s+\.\s+\9\);\s*(?:exit|die)?;?\s+\?>(?<X120353791>))|\s+(\$\w+\s)=\s+get_template_directory\(\);\s+(\$\w+)\s+=\s+\11\.\s+['"]/includes/core['"];\s+[^/]{49,499}(\$\w+)\s+=\s+\12\s+\.\s+['"]/['"]\s+\.\s+\$\w+;[^!]{1,399}!file_exists\(\13[\)\{\s]+\$\w+\s+=\s+['"]<\?php['"]\s+\.\s+PHP_EOL;\s+(\$\w+)[^\?]+file_put_contents\(\13,\s+\14\);\s\}\s+\?>(?<X120334140>)|\s+(function)\s+\w+\((\$\w+)[^@]{1,499}\16\s+(\w+)\(\17,\s+\$\w+[^\.]+\16\s+(\w+)\(\$\w+,\s+\$\w+\)\s+\{\s+if\s+\(\$\w+\s+=\s+@?opendir[^\}]+if\s+\(is_link\(\17[\)\{\s]+\w+;\s+\}\s+\w+\s+\(is_dir\(\17[^\]]+\];\s+if\s+\(is_writable\((\$\w+)\)\)\s+\{\s+\18\(\20,\s+\20\);\s+\}\s+\19\(\20,\s+\20\);\s+die\(['"]!\w+!['"]\);(?<X120340630>)|\s+/\*\*(?:\s*\*\s*webshell\b[^/]{1,99}hacker\s+technology(?<X220340783>)|\s+\*\s+Plugin\s+Name:\s+\w+\s+\*\s+Plugin\s+URi:\s+https://google\.com[^;]+;\s+\}[^\(]{1,99}define\(['"]GPLROCK_PLUGIN_VERSION['"],\s+['"][\d\.]+['"]\);\s+define\(['"]GPLROCK_\w+['"],\s+__FILE(?<X220363840>))|\s+/\*\s*plugin\s+name:[^\*]{1,999}author:\s*wordpress\s*author\s+URI:\s+https?://wordpress\.org\s*\*/(?<X220338440>)|\s+/\*\s+(?:\bPlugin\s+Name:\s+Seo[^:]{1,199}URI:\s+(http://wordpress\.org)/plugins/[^:]{1,199}Description:\s+Security[^:]{1,199}Version:[^/]{1,199}(Author):\s+WordPress\s+\26\s+URI:\s+\25/(?<X2325490>)|Plugin(?:\s*Name:\s*Silent\s*Index\s*Guard\s*Description:[^:]+Version:\s*2\.\d+\.\d+\s*Author:\s*WPsafe\s*Plugin\s*URI:\s*https://wordpress\.com/plugins/browse/indexing\s*\*/\s*[^\{]{1,299}function_exists\(\s*['"]hex2bin(?<X220335470>)|\s+Name:\s+Backlink\s+Footer\s+Injection\s+Description:\s+[^\*]{1,499}Author:\s+Custom\s+\*/(?<X220339960>)))|\s+/\*{2}\s*\*\s+plugin\s+name:[^\}]{1,999}!\s*defined\(\s*['"](\w+)['"]\s*\)\s*\)\s*\{\s*define\(\s*['"]\30['"],\s*['"]\w+['"]\s*\);\s*\}[^@]{1,999}hex2bin\([^\}]{1,999}\.=\s*chr\(ord\([^@]{999,}CURLOPT_USERAGENT\s*=>[^\{]{1,999}\30\),\s*CURLOPT_AUTOREFERER.{999,}is_checkout\(\)\)\s*\{\s*\w+\(\);\s*\}\s*\}\s+\}\Z(?<X220340140>)|\s+@unlink\(\w+\);\s*\w*\(0\);\s*define\(['"]PHPBOT_BACK['"],\s*base64_decode\(['"]aHR0c(?<X220338871>)|\s+[^\&]{9,399}\bif\(\$_SERVER\[['"]\w+['"]\]={1,4}['"][GPRSC]\w{2,6}['"]\s+&&\s+isset\(\$_FILES\[['"]\w+['"]\]\[['"]\w+[^\.]+(\$\w+)=\$\w+\.['"]/['"]\.basename\(\$\w+\);\s+if\(move_uploaded_file\(\$\w+,\33[\)\{]+\s+\$\w+=\(!empty\(\$_SERVER\[['"]HTTPS[^<]{1,499}<a\s+href=[^%]{1,699}</form></\w+></html>\Z(?<X120363820>)|\s+[^\(]{1,999}powered\s*by\s*privdayz\.com\b(?<X220333570>)|\s+[^\{]{1,999}date_default_timezone_set\(['"]\\[a-fx\d+]+\\[^;]{1,99};\s*goto\s*\w+;\s*\w+:\s*\w+\s*\w+\([^\{]{1,999}\{\s*\w+\s*(preg_match)\([['"]\\[^;]+;\s*\}\s*goto\s*\w+[^\{]{1,999}\{\s*\w+\s*\36\(['"]\\[a-fx\d+]+\\[^\^]+[a-fx\d+]+\\[a-fx\d+]+['"][,\s]+\$\w+\);\s*(?:exit|die);\s*\w+:\s*\?>(?<X120333770>)|\s+[^\}]+class\s*\w+\s*\{\s*private\s*\$\w+[^@]{99,3999}\}\s*\w+\s*\w+\((\$\w+)\)\s*\{\s*(\$\w+)[\s=]+base64_encode\(\38\);\s*(\$\w+)[\s=]+str_rot13\(\39\);\s*//\s*\w{8,}\s*\w+\s*\(\w+\(\40\)\s*>\s*\d+\)\s*\{\s*//\s*\w{8,}\s*\w+\s*\w+\(['"]\w+['"],\s*\40\);\s*\}\s*\w+\s*\w+;\s*\}\s*(?:function\s+\w+\(\)\s*\{\s*(\$\w+)[=\s]+['"]\w+['"];\s+(\$\w+)[\s=]+strrev\(\41\);\s+//\s+\w{16,}\s+return\s+md5\(\42\);\s+\}\s{3,}){2}(?<X220335291>)|\s+[^\}]{1,99}plugin\s+name:[^:]{1,99}\bfile\s+manager\b[^/]{1,99}//example\.com\b(?<X220338932>)|\s+\$\w+=(?:['"]\w+['"];(?:[^\{]{1,299}\{\$[^\{]{1,599}\{return\s*hex2bin\(\$\w+\);\}[^\}]{1,599}\}return\s+\$\w+;\}function\s+(\w+)[^\}]{1,599}\{\$\w+=\w+[^\}]{1,999}\}\$\w+=['"][^'"]{999,}['"];\$\w+=\45\([^\{]{1,199}\{eval\(['"]\?>['"]\.\$\w+\);\}else\{echo['"][^'"]{1,299}['"];\}\s+\?>\Z(?<X2325351>)|function\s+(\w+)\(\$[^:]{1,999}:\s+\$\w+;\}\$\w+\s+=\s+\47\(hex2bin\(\$\w+\),\$\w+\);(return)\s+strrev\(\$\w+\);\}\s+\$\w+\s+=\s+json_decode\(\47\(hex2bin\(['"]\w{999,}['"][^%]{1,2499}str_rot13\(urldecode[^!]+curl_init\(\);\s+curl_setopt[^&]+&&\s+strtolower\(\$_SERVER[^\?]{1,499}\48\s+false;\s+\}\?>(?<X120339580>))|hexdec\(['"]\w+['"]\);\$\w+=base64_decode\(['"][^'"]{999,}['"]\);\$\w+=hex2bin\(['"][^;]+;\$\w+=hex2bin\([^\-]+openssl_decrypt\(\$\w+,['"]AES-\w+[^;]+;@?eval\(['"]\?>['"]\.\$\w+\);(?:exit|die);\?>\Z(?<X120336410>))|\s+\/\*{2}\s*\*\s+plugin\s*name:[^\}]{1,999}\s*\}\s*\w+\s*\w+\([^\}]+hex2bin\([^\}]{1,999}\.=\s*chr\(ord\([^\\]{999,}@curl_exec\([^\\]+\$_COOKIE\[\$\w+\]\s*=\s*base64_encode\(\$\w+\);\s*return\s*\$\w+;\s*\}\Z(?<X220340100>)|\s+\w+\s+(\w+)\(\)\s*\{(\w+)\(\);\}(\$\w+)=\w+\.['"]/([\w\-]+\.txt)['"];\w+\(\w+\(\54\)\)\s*\{(?:include|require)(?:_once)?\w+\.['"]/\55['"];\}\w+\(\w+\(['"]\53['"]\)\)\s*\{\$\w+=\w+\s*\w+\(\);\w+\(\$\w+\->\w+\(\)\)\s*\{add_action\(['"]\w+['",\s]+\52['"]\);\}\}\Z(?<X220335311>)|\s+define\(['"](\w{1,40})['"],(\w{1,40}\(\))\);ob_start\(['"](\w{1,40})['"]\);(function\h+)\59\(\$\w{1,40}\)\{\$\w{1,40}=\57;\$\w{1,40}=abs\(crc32\(\$_[GCSR]\w{2,6}\[[^@]{1,999}\b\60\58\{\$[^=]{1,99}=['"](?:[^;]{0,99}\b(?:viagra|cialis|online|casino|game|sale|pharm|herb|jersey)\b){5}(?<X2184230>)|\s+error_reporting\(0\);(?:\$\w+=(?:['"]sad\.php['"];(?<X220332361>)|\w+\(\$\w+\[[^>\.]{1,999}eval\(['"]\?>['"]\.\w+\(\$\w+\.['"][^'"]+\.txt['"]\){2};\w+\s*['"]\./[^\.]{1,99}\.php['"];[^\n]{1,999}error_reporting\(0\);\w+\(\);\Z(?<X2323621>))|\s*\$\w+\s*=\s*['"]https://[^'"]{5,299}['"];[^\-]{1,299}ip2long\(\$\w+\);[^\{]{1,999}function\s+\w+[^@]{1,999}@?(file_get_contents)\(\$\w+\);[^\{]{1,499}function_exists\(['"]curl_init['"][^/]+https?://\w+\.\w+/googles\.json[^\@]{1,9999}@?\64[^\?]{1,999}echo\s+\$\w+;\s+(?:exit|die)\(\);\s*\}\s*\}\s*\?>(?<X120336433>))|\s+eval\((?:(?:urldecode|hex2bin|base64_decode|str_rot13)\(['"]\?>['"]\)\.\w+\((?:hex2bin|urldecode|base64_decode|str_rot13)\(['"][^'"]{1,999}["'\);]+function\s+\w+\(\$\w+\)\{goto\s+\w+;\w+:\s+if\(!?empty\(\$\w+\)\)\{goto[^\{]+curl_\w+\(\$\w+\)\)\{goto\s+\w+;\}goto\s+\w+;[^\}]+\w+:\s+goto\s+\w+;\w+:\}(?<X120362600>)|base64_decode\(hex2bin\(['"]436d6c6d4b475a70624756665a\w{999,}['"]\)\)\);\Z(?<X120340080>))|\s+function\s+(?:(\w+)\((\$\w+)\)\{if\(function_exists\(['"]\w+['"]\)\)\{\$\w+=curl_init\(\)[^\}]{1,499}\}curl_close\(\$\w+\);return\$\w+;\}[^\}]+\}\w+\s+(\w+)\(\$\w+\)\{(\$\w+)=\68\(\69\);if\(\$\w+[^\?]{1,399}\}eval\(['"]\?>['"]\.\71\);\}try\{\$\w+=base64_decode\(['"]ahr0[^'"]{1,299}['"]\);\70\(\69\)[^>]{1,499}>\w+\(\);\}(?<X120339990>)|(is_mobile)\(\)\s+\{\s+\$\w+\s+=\s+(\$_SERVER)\[['"]HTTP_USER_AGENT['"]\];\s+\$\w+\s+=\s+array[^/]{99,499}if\s+\(\73\(\)\s+&&\s+\74\[['"]REQUEST_URI['"]\]\s+==\s+['"]/['"]\)\s+\{\s+(\$\w+)\s+=\s+file_get_contents\(['"]https?://[^'"]{9,199}\.txt['"]\);\s+echo\s+\75;\s+(?:exit|die);\s+\}\s+\?>(?<X120340220>)|\w+\(\$\w+\)\s+\{[^\|]{1,999}function\s+(\w+)\(\$\w+\)\s+\{\s+\$\w+\s+=\s+base64_decode\(\$\w+,\s+true\);[^#]{1,1599}\}\s+(\$\w+)\s+=\s+['"][^'"]{999,}['"];\s+(\$\w+)\s+=\s+\77\(\78\);\s+eval\(\79\);\Z(?<X120363300>)))
\A<\?[ph\s]+(?:(?:(?:includ|requir)e(?:_once)?\b[^;]+\bwp\-(?:blog-header|includes/registration)\.php['"][^;]*;){1,2}(\$\w+)=['"][^;]+;(\$\w+)=['"][^;]+;[^\?]{1,499}(\$\w+)=wp_create_user\(\1,\2\b[^;]{0,49};[^\?]{0,199}(\$\w+)=new\s*WP_User\(\3\);\4\->set_role\(['"]administrator['"]\);[^=\?><\(\)]{0,499}\}(?:\?>)?\Z(?<X2222310>)|(?:(?:ini_set\(['"]display_errors['"],|error_reporting\()0\);){2}(\$\w+)=(?:\(['"][^'"]['"]\^['"][^'"]['"]\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=\7\(\8\(['"]eJ[^'"]{65000,}['"]\)+;(\$\w+)=\9\(['"]{2},\10\);\11\(\);\Z(?<X2219990>)|(?:(\$\w+)=['"](?:header|function_exists)['"];){2}if\([^\)]*\13\b[^;\}=:\?]{1,99}tion:\s*https?://[^;\)]+\);\}else\{['"][^\}'"]+\bvar\s*(\w+)[\s=]+String\.fromCharCode\([^;\}]+;(?:(?:window|document)\.location\.(?:href=\14|replace\(\14\));?){2}</script>['"];\s*\}\s*(?:\?>|\Z)(?<X1203931>)|(?:(\$\w+)=file_get_contents\(['"]https?://[^'";\)]+\.txt['"]\);(\$\w+)=fopen\(['"][^'"]+\.php['"],[^;]+;fwrite\(\17,\16\);(?:fclose\(\17\);)?)+(?:\?>)?\Z(?<X2222641>)|(?:error_reporting\([^;]+;)?if\(!((function)_exists\()['"](hex2bin)['"]\)+\{\20\s+\21\([^@]{1,999}\b(?:if\(\19['"]((?:shell_)?exec|passthru|system)['"]\)+\{[^\}]{0,199}\b\22\([^\{]{1,199}){3}\{[^@]{9999,}\bmkdir\([^;]*\bwell\-known/acme\-challenge/[^;]{9,};[^\?]{1,999}\bpreg_match\([^\)]+\)+\{echo\b[^;]+;\}+(?:\?>\s*)+\Z(?<X2220310>)|(?:goto|function)\h*\(?[^\*%@&]{99,300}\bif\(strpos\([^'"]{1,9}["'].{0,3}cl[4a]wm[a4][5s]{2}.{0,3}\)[^,@\*]{9,99}\barray_diff\(scandir\((?<X2203490>)|(?:if\([^\{;]{1,199}\{)?if\(+@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\{;]{1,99}\{?\b(echo|print)\b[^;]{1,99};[\}\)]{0,2}else[\{\(]{0,2}\25\b[^;]{1,199};[\}\)]{0,2}(?:else[\(\{]{0,2}\25\b[^;]{1,199};[\}\)]{0,2})?;?\s*(?:\?>)?\Z(?<X1192121>)|(?:ini_set|error_reporting)\([^\{]{0,200}\bclass\h*\w{1,20}[\{\s]+static\h*private\h*\$\w+=\d+;[^@]+\{if\((\$\w{1,20})[^\)]+doorway\d*['"]\)[\{\s]+[^#&]+\{eval\(\27\[[^\}]+[\}\s]+(\$\w{1,20})=new\h*\w{1,20}\(\);\s*if\(\28\->\w{1,20}\(\)\)[\{\s]+\28[^\}]+\}\s*(?:exit|die)[^;]*;(?:\s*\?>)?\Z(?<X2240100>)|(\$[0_O]+)=urldecode\(['"]%[^'"]+['"]\);\s*\$\w+=\30\[.{1,39400}\{@?header\(\$[O0_]+\);\}echo[^;]+;(?:die|exit)[\(\);\}]+[O0_]+\(\$[O0_]+\);\s*(?:\?>|\Z)(?<X1292222>)|(\$\w+)=(file_)ge(t_contents\()['"]https?://[^;]+;\33pu\34['"][^'"]{0,199}\.php['"],\32\);(?:\?>)?\Z(?<X2212650>)|(\$\w+)=['"]\w+\.zip['"];[^\?=]{0,199}\$(\w+)=new\s+ZipArchive;\$\w+=\$\37\->open\(\36\);[^\?\}/:]{0,99}=\$\37\->extractTo\([^;]+;[^;\?\}/:]{0,99}\bunlink\(\36\);header\(['"]Location:(?<X2205381>)|(\$\w+)=['"]\w{9999,}['"];\s*(\$\w+)=hex2bin\(\39\);\s*eval\(['"]\?>['"]\.\40\);\?>\Z(?<X2306170>)|(\$\w+)=['"]file_get_contents['"];eval\(['"]\?>['"]\.\42\(['"]https?://[^/'"]+\.blogspot\.com/[^;]+;\s*(?:\?>\s*)?\Z(?<X2214550>)|(\$\w+)=['"]https?://(?:[^'"]+/raw/\w+['"];(\$\w+)=\w+\(\);\w+\(\45,\w+,\44\);\w+\(\45,\w+,\w+\);(\$\w+)=curl_Exec\(\45\);\w+\(\45\);echo\h+eval\(['"]\?>['"]\.\46\);\?>\Z(?<X2311441>)|[^'"]{8,256}['"];\s*(\$\w+)=curl_init\(\44\);[^\?]{2,999}(\$\w+)=curl_exec\(\48\);curl_close\(\48\);eval\(['"]\?>['"]\.\49\);\?>(?<X1317960>))|(\$\w+)=['"]{2};[^\{\?]{1,49}(\$\w+)=[^;]{0,49}\51\b[^@#:/\^]{1,1999}(\$\w+)=file_get_contents\([^;]+\.(?:png|jpe?g|gif|bmp)['"]\);[^\?]{1,499}\53=\52\(\53\);[^\?\}]{1,199}(\$\w+)=fopen\(([^,]+),[^\?\}]{1,199}\bf(?:puts|write)\(\54,\53\);[^\?]{1,199}\binclude(?:_once)?\b[^;]{0,9}\55[\)\};]+(?:\?>)?\Z(?<X2221070>)|(\$\w+)=[^;]+;(\$\w+)=\57;function\s*(\w+)[^@]{1,500}\$\w+=\$\{\59[^@]{1,1500}(\$\w+)=\$\w+\[\59[^;]+\58\)\];(\$\w+)=\60;include\(\61\);\}(?:\?>|\Z)(?<X2301972>)|(\$\w+)=file_get_contents\((?:['"]https?://[\d\.]+/[^\?\{]{1,499}=fopen\(([^,;]+),[^;]+;fwrite\(\$\w+,\63\);[^\?\{]{1,499}=(\w+\()\64\);[^\{\?]{0,499}\bfunction\s+\65(\$\w+)\)\{(\$\w+)=[^;]+;(?:if\(function_exists\(['"]((?:shell_)?exec|passthru|system)['"]\)+\{[^\}]*\b\68\([^\)]*\66\b[^\}]+\}else){2}[^\?]{1,499}\breturn\s*\67;\}(?:\?>)?\Z(?<X2219961>)|\w+\(['"]https?://pub\-\w+\.r2\.dev/[^'"]+['"\)]+;\63=['"]\?>['"]\.\$\w+;eval\(\$\w+\);\Z(?<X2306680>))|(\$\w+)=fopen\(['"](?:[^"']+\.(?:p?html|php\d*)['"],[^;]+;(\$\w+)=file_get_contents\(['"]https?://[^'"]+/raw['"\?/][^;]+;(?:\$\w+=)?fwrite\(\71,\72\);fclose\(\71\);(?:\?>)?\Z(?<X2222280>)|[^'"]+\.php\d*['"],[^;]+;fputs\(\71,\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:fclose\(\71\);)?(?:\?>)?\Z(?<X2220561>))|(\$\w+)=isset\([\$_[GPRSC]\w{1,6}\[['"]command['"]\]\)[^@]{1,100}\bexec\(\75[^>]+>Exploit[^;]+;[^@]{1,100}echo\s*['"]</pre>['"];\?>\Z(?<X2318721>)|(\$\w+)=rand\((?:[^;]+;if\(\77\b[^;\{]+\$\w+(=base64_decode\(['"]PD9)[^@]{999,4999}\bunlink\([^;]+;(\$\w+)\78[^\?]{999,}\$(\w+)=fopen\(([^,]+),[^;]+;fwrite\(\$\80,\79\);[^\?]{1,99},CURLOPT_URL,['"]https?://[^;\)]+\81[^\?]{1,999}\b[pes](?:xec|assthru|hell_exec)\(\81\);?(?:\?>)?\Z(?<X2223700>)|[^\)]+\)\.['"]\.php['"];(\$\w+)=fopen\(\77,[^@]{199,}\bfwrite\(\83,[^;]+;(?:fclose\(\83\);)?header\(['"]Location:\s*['"]\.\77\);\s*(?:\?>|\Z)(?<X2212121>))|(\$\w+)=range\(['"]\W['"],[^;]+;(\$\w+)=(?:\$\{)?(?:\85\[[\d\+\-\*/]+\]\.){3}[^;]+;if\(+in_array\(gettype\(\86\)[^;]+&&\86\(\)+;\}+(?:class\s+(\w+)\{(?:\w+\s+){0,2}function\s+\w+\([^\{;]+\{(\$\w+)=["']range['"];\$\w+=\88\(['"]\W['"],[^@]{99,}\}\87::\w+\(\);?)?(?:\?>\s*)?\Z(?<X2220710>)|(\$\w+)['"\s=]+/\w*/\w*[^\;]+\.php['"];\s*\$\w+[\s=]+@filemtime\(\90\)[^\.]{1,99}\.rawurldecode[^;]+unlink[%\w]+['"]\)\.['"]\\n[^\}]+[\s\}]+(?:exit|die)\(['"]!success!['"]\);(?:\?>|\Z)(?<X1292550>)|(\$\w+)[=\s]+['"]/(?:[^'"]+['"];\s*if\(move_uploaded_file\(\$\_FILES\[['"]\w+['"]\]\[['"]\w+['"]\],\s*\92[\)\{\s]+echo\s*['"][^'"]+['"];\s*@?touch\(\92,\s*\d+[\);\}\s]+(?:exit|die)\(['"][^'"]+['"]\);\Z(?<X1308000>)|[^;]+;\s*(\$\w+)[=\s]+rawurldecode\(['"][^'"]{999,}['"]\);\s*if\s*\(file_put_contents\(\92,\s*\94[\)\{\s]+echo\s*['"][^'"]+['"];\s*@?touch\(\92,\s*\d+\);\s*\}\s*die\(['"][^'"]+['"]\);\Z(?<X1312911>))|(\$\w+)[=\s]+['"]wp\-includes[^;]+;\s*(\$\w+)[=\s]+['"]wp\-admin[^;]+;\s*if\(\s*@?filesize\(\97\)!=2203\s*&{2}\s*(\$\w+)=file_get_contents\(\96[\)\{\s]+@?unlink\(\97\);\s*@?file_put_contents\(\97,\s*base64_decode\(\98[\);\}][;\)\}]+\?>(?<X1307360>)|(\$\w+)[\s=]+['"][^'"]{99,}['"];\s*(\$\w+)[\s=]+base64_decode\(\100\);\s*(\$\w+)\s*=\s*gzinflate\(\101\);\s*eval\(\102\);\Z(?<X2295900>)|(\$\w+)\s*=\s*['"]https?://yourbusinessrealm\.au[^:]{1,199}function\s*(\w+)[^\{]+\{\s*(\$\w+)\s*=\s*['"]https?://[^'"]{1,199}['"];[^@]{1,99}\$\w+\s*=\s*curl_init\(\106\)[^?]{1,3999}\s*if\(\105[^:]{1,99}(header\(['"]\w+:)\s*https://google\.com['"][^\?]{1,299}\107\s*\104['"]\);\s*(?:exit|die)\(\);\s*\?>\Z(?<X1318632>)|(\$\w+)\s=\s+['"]/[^;]{1,499};\s+\$\w+\s+=\s+@?filemtime\(\109\);\s+\$\w+\s+=\s+(file_get_contents)\(\109\);\s+\$\w+\s+=\s+rawurldecode\(['"]if[^<]{1,1999}<\?php['"],\s+['"]<\?['"]\];[^!]+\110\(\109\);\s+if\s+\(strstr\(\$\w+,\s+\$\w+[\)\{\s]+(?:exit|die)\(['"][^\}]{1,499}[\}\s]+(?:exit|die)\(['"][^'"]{1,99}['"]\);\s{1,32}\Z(?<X1322393>)|(\$\w+)_\w{2}=array\(['"][^\)]{1,299}\);\112(_\w{2})=array\(['"]\w[,'"\s]+[\w'",]{99,299}\);\112(_\w{2})=\112\113\[\d+\]\.\112\113\[\d+\]\.\112\113\[\d+\]\.[^\;]+\112\113\[\d+\];\112(_\w{2})=\112\113\[\d+\]\.[^;]+;\112(_\w{2})=\112\113\[\d+\]\.[^\;]+\112\113\[\d+\];eval\(\112\114\(\112\115\(\112\116\(\112\_\w{2}\){4};\Z(?<X2316310>)|(\$\w{1,13})[=\s]+['"base_64deco\s\.]+;\s*(\$\w{1,14})[\s=]+\118\(['"]ZmlsZV9nZXRfY29udGVudHM=[^\$]{1,10}(\$\w{1,14})[\s=]+\119[^;]{1,150};\s*(\$\w{1,14})[\s=]+\118\(\120[^;]{1,10};\s*eval[^\)]+\121\);\s*\?>(?<X1301931>)|(\$\w{1,20})(=["']header["']);\s*\123?\(["'][lo]{0,2}cation:\h*https?://\w{1,20}\.[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml)/[^;>]{1,99}\);\s*\?>\s*<\?[ph\s]+\$\w{1,20}\124[^,!]{99,200}\bvar\h+(\w{1,20})[\h=]+[^\?<>]{99,300}\bwindow\.location\.replace\(\125\);\s*</script>['"];[\}\s]+\?>(?<X1203980>)|(\$\w{1,20})=(curl_)init\(['"]https?://[^/]{0,6}\bgithub[^\.]{0,12}\.com/[^'"]{1,20}Shell[^'"]{1,99}\.(?:php|txt)['"]\);[^\?]{9,99}\b\128exec\(\127\);\s*\128close\(\127\);\s*fclose\([^\)]+\);\s*(?:\?>\s*)?\Z(?<X2207311>))
\A<\?(?:(?:php)?\s+if\((?:!\s*class_exists\(['"]HTTP[^\?]{1,499}ini_set\(['"]error_reporting['"],0[^\}]{1,999}\}function\s*(\w+)[^\{]+\{(\$\w+)=hex2bin\(['"]\w+['"]\);\?><script[^\{]+\{fetch\(['"]<\?php\s*echo\s*esc_url\(\2\);\?[^\?]+var\s*(\w+)=[^;]+;try\{eval\(\3[^,]+add_action\(['"]\w+['"],['"]\1['"]\);\}\?>\Z(?<X2324272>)|isset\(\$_(?:COOKIE\[['"]\w+['"]\]\)\)\{(\$\w+)=['"]/[^'"]{1,199}['"];include\(\5\);exit;\}\s+\?>(?<X120340550>)|GET\[['"\s+]+\w+['"\]\s]+\)\)\{try\{if\(\!\s+str\w+\((file_get_contents)\(\$\w+=['"]wp\-\w+/\w+\.php['"]\),[^&]{1,499}isset\(\$_SERVER\[[\\\s'"]+HTTP_USER_AGENT[^\{]+\{\$\w+=[^#]{1,799}array_map\(urldecode\(\\['"]base64_decode[^%]{1,999}\7[^\[]+isset\(\$_GET\[[\s'\w]+\]\)\)\{echo\s+['"]\w+['"];\}\Z(?<X120363290>)))|(?:php)\s*(?:#\s*\d+\s*\$\w+\s*=\s*curl\(['"]https?://[^\;]{1,99}fox\-bdkr\-shel\.txt['"]\);(?<X220344870>)|//\s+this\s+file\s+is\s+part\s+of\s+imunify[\s\-]*https?://www\.imunify\.com\b(?<X220346190>)|\$xmlname=[^/]{1,399}file_exists\(\$_SERVER\[['"]\w+['"]\]\.['"]/\.?(?:htaccess|robots\.txt)['"]\)[^\[]{1,399}range\(['"\w,]+\);return\s*array\(\$\w+\[\d+\]\.[^\)]{1,399}\);\}(?<X120351011>)|foreach\((\$_POST)\s+as\s*(\$\w+)\s*=>\s*(\$\w+)\)\{\s*(\$\w+)[\s=]+(@pack\(['"]\w\*['"]),\s*\13\);\s*\12\[\15\]=\16,\s*\14\);(?<X220354531>))|(?:php)\s+(\$\w+)(?:=['"]compress\.zlib://['"];(?:require|include)(?:_once)?\18\.['"]index\.gz['"];\?>\Z(?<X220369192>)|\s+=\s+['"][^'"]{99,}['"];\s+if\s+\(!\w+\(['"](\w+)['"][\s\)\{]+function\s+\20\(\$\w+,\s+\$\w+\)\s+\{[^\{]+\{\s+\$\w+\s+=\s+strpos\([^\?]{99,999}file_put_contents\((\$\w+)\s+=\s+tempnam\(sys_get_\w+\(\),[^,]{1,49},\s+\20\(\18,[^\(]{1,99}(?:include|require)(?:_once)?\s+\21;\s+unlink\(\21\);\s+\?>\Z(?<X120333631>))|(?:php)\s+/\*(?:\s*\*[\s\w\-]+\bcagefs\s+(?:exploitation|bypass)\s+toolkit\b(?<X220340954>)|\s+(?:[^:]{1,99}NovaShell\s+v\d\s+\W{1,8}\s+Stealth\s+PHP\s+Shell(?<X220335841>)|Plugin\s+Name:\s+Search\s+Nulled\s+Plugin\s+Themes\s+Plugin\s+URI:\s+https://www\.google\.com/\s+Description:\s+WordPress\s+Plugin\s+\&\s+Theme\s+Search\s+Version:\s+\d+\.\d+\s+\*/(?<X220334510>)))|(?:php)\s+(?:\$\w+\s*=\s*['"]([^'"]{1,32})['"];\s*\$\w+[\s=]+['"]\26['"];\s*\$\w+\s*=\s*['"][^@]{1,99}@(?:example|wordpress)\.(?:org|com)['"];[^@]{1,999}wp_update_user(?<X220337941>)|\w+\(function_exists\(\(['"]ini_se['"]\.chr\(\(49\)\+\(67\)\)\)\)\)\{\(['"]\w(?<X220367900>)|ini_set\(['"]memory_limit['"],\s*['"]\-1['"]\);\$\w[^\?]{1,999}\$\w\s*=\s*['"][^'"]{999,}['"];\s*eval\(\$\w\(\$\w\)\);\$\w=['"]\w+['"];\$\w\s*=\s*0;\?>\Z(?<X220345460>)|ob_start[^:]{1,499}https?://[^'"]{1,499}\w+\.txt['"];[^\{]{1,499}\w+\s+(\w+)[^\[]{1,499}curl_init\(\$\w+\);[^\{]+\{\s+\$\w+\s+=[^@]{1,499}return\s+@?file_get_contents[^\|]+\}\s+(\$\w+)\s+=\s+\w+;\s+\$\w+\s+=\s+\[\s+['"]\30[^\?]+try\s+\{\s+eval\(['"]\?>\31['"]\);\s+\}[^;]{1,199};\s+(?:exit|die);\s+\}\s+ob\w+\(\);(?<X120334470>)|session_start\(\);\s*\$\w+[=\s'"]+evilcorp['"];(?<X220344110>))|(?:php|=)?(?:\h*null;\s*echo\h*['"]<(script)\h+src=['"]https?://[^'"]{9,99}/[^'"]{1,20}\.txt['"]></\34>['"];\s*\?>(?<X1191200>)|\s*(\$[^=\s]{1,40})=\$\{[^a-z0-9;\^]{2,}['"]\^['"][^a-z0-9;]{2,}\};(?:\36\[[^\]]+\]\()+\36\[[^\]]+\]\)+;?(?:\?>)?\Z(?<X2221310>)|\s*null;\s*eval\(['"]\?>['"]\.file_get_contents\(['"]https?://bit\.ly/\w{1,9}['"]\)\);\s*\?>(?<X1198390>))|.{0,40}\$ip[\s=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])[\s;]+\$\w{1,40}[\s=]+date\([^)]{1,40}\)[\s;]+\$\w{1,40}[\s=]+['"][^'"]{80,120}['"][\s;]+(?:\$\w{1,40}[\s\.=]+[^;]{1,80}[\s;]+){2,5}@?mail\([^)]{1,80}\)\s*;\s*header[\s\(]+['"]Location\s*:(?<X2052332>)|=(?:[\s\(]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]+/etc/passwd[\$\}\)'";\?>]*\Z(?<X2222070>)|\(['"]{2}\);(?:exit|die)\((?:include|require)(?:_once)?\s*\176\s*urldecode\(['"]%[^'"]{32,}['"]\)\.__FILE(?<X220331362>)|null;\$\w+=['"]['"];if\(!empty\(\$_SERVER\[['"]HTTP_HOST['"]\]\)\)\$\w+=['"]\w+\.\w+['"];include(?:_once)?\(['"](?:zip|phar):/[^'"]{1,199}['"]\);\?>\Z(?<X1318710>))|[\sph=@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}[^;]{1,99}\.(?:bmp|gif|png|jpe?g|ico|pdf|mp[34e]?g?)[\$\}\)'";\s\?>]+\Z(?<X2202893>)|[\sph@]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\s'"\(]+phar:/+home[^;]+;\s*(?:\?>\s*)?\Z(?<X2198690>)|[\sph]*\$shell\w{0,40}\s*=\s*['"][^'"]{0,40}Cyber\s*Team[^'"]{0,40}['"];(?<X2218790>)|[\sph]+class\s*(_?Wp_\w{4,40})\s*\{\s*private\s*(\$\w{1,40})\s*;\s*const\s*(\w{1,40})\s*=[^>@#]{2,10}_[GPRSC]\w{2,6}['"]\s*;\s*public\s*function\s*__construct[\(\s]+\47[\s=]+null\b[^;:\}]+::\48[^\+]{99,499}\$\w{1,40}\++[^\}]+\}[\};\s]+\$\w{1,40}[\s=]+new\s*\46;[\s\?>]*\Z(?<X2199025>)|[^\$]{1,99}\$\w+[^;]{1,999}/[\w\-]+\.txt['"];[^\\]{1,999}gagal[^\{]{1,999}eval\(['"]\?>['"]\s*\.\s*\$\w+\);(?<X220337930>)|[^\}]{1,199}http_response_code\(404\);\s*exit;\s*\}\s*\w+\s*(get_ip\(\))[^\}]+\}\s*(\$\w+)\s*=\s*\51[^@]{1,199}\$\w+[=\s]+['"]haxcash['"]\s*\.\s*\52;[^@]{1,999}<title>system\s+preview(?<X220338881>)|[hp\s]*function\s*(\w+\()\$\w+\)\{[^\{\}]{1,999}\}(\$\w+)=\54\d+[\-\+\*/%]\d+\)(?:\.\54[^;]{1,299})?;(?:(\$\w+)=\54\d+[\-\+\*/%]\d+\)(?:\.\54[^;]{1,299})?;){1,19}(\$\w+)=\$\{\56\.(?:\$\w+\.)+\$\w+\};[^\{\}\?]{0,299}\beval\(\55\(\57\[\$\w+\]\)+;(?:\?>|\Z)(?<X1234050>)|[ph=\s]*(?:null[;\s]+)?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s\.'"\?>]+file_get_contents[\(\s]+['"]https?://raw\.githubusercontent\.com/[^/]+/(?:d[e3]f[a4]c[e3]|sh[e3]ll|b[a4]ckd[o0][o0]r|expl[o0]it)/[^'"]+\.php['"][\s\);\?>]+\Z(?<X2223750>)|[ph=\s]+null;\s*eval[\s\(]+['"][\?>]{2}['"]\h*\.\h*file_get_contents[\s\('"]+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"\)]+;(?:\s*\?>)?\s*\Z(?<X2193900>)|[ph\h*]+if\(\$_SERVER\[['"]REQUEST_METHOD['"]\]={3}['"]POST['"]\)\{\$\w+=\$_POST[['"]['"](\w+)['"]\];if\(preg_match[^\)]+\61\){2}\{echo\h*shell_exec\(\$\61\);\}else\{\w+\h*[^\}]\w+\h*command[\.'";}]+else\{\w+\h+['"][a-z\h]+\.['"];\}(?<X2253751>)|[ph\h]*\$\w+\h=\h+['"]/\w+/\w+[^:]+://(?:185\.147\.124\.223|185\.198\.69\.94)/\w{32}['"];[^\n]{1,999}\bdie\(['"]_upload_failed_['"]\);\Z(?<X2292781>)|[ph\h]+(?:/[\*]+\s+\*[^\?]+\$\w+\h+=\h+['"](?:SELECT|UPDATE)\h+(?:\*|\w+)\h+(?:FROM|SET)[^\}]{1,99}(\$\w+)\h+=\h+['"]\w{10}['"];\s*\$\w+\h+=\h+substr\(\64,\h+\d+,\h+\d+\);[^\}]{1,99}hash\(['"]sha256(?<X2279010>)|eval\((?:(rawurldecode)\(['"]%20[^;]{1,256}\.php[^'"]+\66[^;]+file_put_contents[^\)]{1,999}(?:die|exit)[^\)]{1,64}['"]\){2};\h*(?:\?>|\Z)(?<X2256020>)|rawurldecode\(['"][^;]{1,256}\-(?:content|includes|config|settings)[^'"]+\.php[^'"]+file_put_contents[^\)]{1,999}(?:die|exit)[^\)]{1,64}['"]\){2};\h*(?:\?>|\Z)(?<X2255443>)))|[ph\s*]+(?:///\s*coder\h*\w+\h*\w*[^[^\$]+(\$\w+)\h*=\h*fopen[^$]+\(\69[^;]+;\s*header\(['"]location:[^;]+;\s*(?:\?>|\Z)(?<X1252240>)|[^'"]{1,16}['"]fucker\.php['"];\?>(?<X2247631>)|\bsession_start[^\$\+]+\berror_reporting\(0\)[^\?>]{1,999}\$(pass)=['"]\w{8,32}['"][^\?>]{1,99}\bif\(isset\(\$_POST\[\$\72[^\$]+\$data=encode\(base64_decode[^\?>]{1,999}\?>\Z(?<X2240200>)|eval\(\s*base64_decode\(\s*file_get_contents\(['"]\.\w+['"]\),\h*\d+\s*\)\s*\);\Z(?<X1251941>)|goto\h+\w+;\h+\w+:\h+if\h*\(@?\$_GET\[['"abcdefx\d\\]+\][^?]{1,999}file_put_contents[^\}]+\}\s*else[^=]+\(sha1\(sha1\(@?\$_GET[^:]+:\s*\w+\s*pingmap[^:]+:\s*[^\}]+\}[^\?]{1,2999}stristr\(\$\w+[^\?]{1,1999}goto\h+\w+;\h+\w*:\s*//\w{1,8}\h*\?>(?<X1252350>))|[ph\s=]*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:\w+[\(\s]+)*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\?>]+\Z(?<X2273210>)|[ph\s@]*(?:copy|move_uploaded_file)[\(\s"']+https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][,\s]+['"][^'"$]+\.php['"][\)\s;\?>]+\Z(?<X2208542>)|[ph\s@]+include(?:_once)?[\$\{\('"\s]{1,3}\.+/js\d*/[^;]{1,199}\.(?:js|gif|ico|je?pg|png)[\$\}\)'"]{0,3};(?:\h*\?>)?\s*\Z(?<X2196161>))
\A<\?[ph\s]*(?:(?:(?:goto\s+|\w{1,6}:\s+)[^;]{1,199};[\s\)\]\}]*){5}[^#]{99,1499}(?:(?:goto\s+|\w{1,6}:\s+)[^;]{1,199};[\s\)\]\}]*){3}\w+:\h*echo\h*['"][^'"]+['"];\s*(?:\?>|\Z)(?<X1126436>)|(?:(\$\w)[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*){2,}if[\(\s]+!empty[\(\s]+(\$_GET)[\)\s]+foreach[\(\s]+\3\s*as\s*(\$\w)\s*=>\s*(\$\w)[\)\s]+\2\[\4\][=\s]+\5\s*;\s*\$\w{1,40}[=\s]+function[^:]{9,}:\s*['"]PD9[^'"]{99,}['"][\s\);]+touch[\s\(]+(\$\w).+\6[=\s]+\$\w\s*\.\s*\$\w[\s\(]+\$\w\[[^\]]+\][^;]+;\s*\Z(?<X2218580>)|(?:[pes](?:assthru|ystem|xec|hell_exec|open)\(['"][^'":\)]{0,99}\b[cwlf](?:url|get|wp\-download|ynx|etch)\h+[^'";]{9,99}(?:/|>\h*)([^'";]{1,99});\h*[pbskt](?:erl|ython|hp|[ac]?sh|h)[\d\.]*\h+\8\h*;\h*rm\b[^'"\)]{1,99}['"]\);){5}(?<X2178204>)|(?:\$group_num=['"][^;]+;)?\$inter_domain=['"]https?://[\d\.]+/[^;]+;function\s*(\w+\()[^\{;]+\{[^\}=]*=curl_init\([^@]{499,2999}(\$\w+)=['"]https?://www\.google\.co(?:m|\.jp)/ping\?sitemap=[^\?]{1,499}\b(?:file_get_contents\(|\10)\11\)[^;]+\bSubmitting\b[^@]{99,1999}\becho\s*\$get_content;(?:return)?[;\}\s]*(?:\?>|\Z)(?<X1228801>)|(?:echo|print(?:f|_r)?|var_dump|var_export|vprintf|vsprintf|vfprintf|fprintf)[\s\(]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]+/etc/passwd[\$\}\)'";\?>]*\Z(?<X2222060>)|(?:include|require)\h+['"]compress\.zlib://[\w\-]+\.gz['"];\s*(?:\Z|\?>)(?<X120341910>)|(\$[O0]+)\s*=\s*urldecode\([^\)]+\);(\$[O0]+)\s*=\s*\15\{\d+}[^;]+;\$[O0]+[^'"]{1,999}\15\{\d+}\h*;\s*eval\(\16\([^\)]+\){2};\?>(?<X1256391>)|(\$\w+)=(function)\([^\)]+\)\{[^\}]*\};\19\s*(\w+)\(\$\w+\)\{[^\}]*\}(\$\w+)=['"][\w/\+=]{499,}['"];(\$\w+)=\19(\(\$\w+\))\{eval\23;[^\}]*\};?(?:\21=(?:\18|\20)\(\21\);){2,}\22\(\21\)[;\?>]+\Z(?<X2228530>)|(\$\w+)=['"][^;]+;(\$\w+)=dirname\(__FILE__\);[^\?\{]{1,499}\bfile_put_contents(\(\26[\./'"]+\25),[^;]+;\bfunction\s+(\w+)\((\$\w+)\)\{[^\}]{0,99}(?:\(function_exists\(['"]([peas](?:assthru|ystem|xec|hell_exec|open|val|ssert))['"]\)+\{[^\}]{0,99}\b\30\(\29\b[^@#\?]{1,99}){3}\(\29\b[^\?]{1,499}\28\27\);unlink\27\);(?:unlink\(\26\.[^;]+;){0,5}(?:\?>)?\Z(?<X2234271>)|(\$\w+)=[^;]+;file_put_contents\([^,;]{0,49}\32[^,;]{0,49},[^;\)]{0,99}\barray_slice\(file\((?:\w+\(){0,3}__file__\)[^;]+;(?:includ|requir)e(?:_once)?\b[^;\?\$]{0,49}\32\b[^\?;\$=]{0,49};?(?:\?>)?\Z(?<X2231871>)|(\$\w+)=base64_decode\(['"]PD9[^@]{9999,}\b(?:if\((strpos\((\$\w+),)['"](<\?(?:php)?)['"][^\{;]{1,99}\b\35['"]COOKIE\[[^\{;]{1,99}\{[^\}=]*\36=str_replace\w*\(['"]\37['"],\34,\36\);(file_put_contents\()[^,]+,\36\);[^\}]*\}+if\([^\}]{1,199}){2}\38[^@]{1,499}\b\38(__FILE__),['"]{2}\);unlink\(\39\)[;\?>]+\Z(?<X2225950>)|(\$\w+)[\s=]+curl_init[^:]+://wordajax\.com/[^>]+(\$\w+)[=\s]+curl_exec\(\41[^>]+echo\s*\42;[^>]{1,32}>\Z(?<X2298081>)|(\$\w{1,40})[=\s]+['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\s*;\s*echo\b[^;\$]*\44[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\?>;]+\Z(?<X2222040>)|(\$\w{1,40})[=\s]+['"]range['"][;\s]*(\$\w{1,40})[=\s]+\46[\s\('"]+\176['"][\s,]+['"][^'"]*['"][\s\);]+(\$\w{1,40})[\s=\$\{\(]+\47\[[\s\(]*\d+[\+\*\-/\s\(\)]+\d+[^\]]*\](?:[\s\.]+\47\[[^\]]+\])+[\s\)\}\(;]*(?:count|if)[^;\n]+in_array[\(\s]+gettype[\s\(]+\48[^\n\176]{9,499}\bclass\s*(\w{1,40})\s*\{[^\n]+\49::\w{1,40}[\s\(\);\?>]+\Z(?<X2223251>)|(\$\w{1,40})[=\s]+['"]str_rot13['"\s;]+(\$\w{1,40})[=\s]+['"]base64_decode['"\s;]+(\$\w{1,40})[=\s]+['"]gzinflate['"\s;]+@?error_reporting[\(\s]+\d+[\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:(?:\51|\52|\53)[\(\s]+){3}['"][^'"]{99,}['"][\)\s;\?>]+\Z(?<X2225911>)|(\$\w{1,40})[=\s]+file_get_contents[\(\s]+['"]php://input['"\)\s;]+if[\(\s]+substr[\(\s]+\55[,\s]+\d+[,\s]+\d+[\)\s]*==+['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+gz\w+[\(\s]+substr[\(\s]+\55[,\s]+\d+[\)\s]+;(?:\s*(\$\w{1,40})\b[^;]+\56)?[^\}\?]{0,99}\b(?:eval|assert)[\(\s]+(?:\56|\57)[^=]{0,99}\Z(?<X2228360>)|(\$\w{1,40})[=\s]+range(?:[\s\('"]+\176['"][\s,]+['"][^'"]*['"][\s\);]+(\$\w{1,40})[\s=\$\{\(]+\59\[[\s\(]*\d+[\+\*\-/\s\(\)]+\d+[^\]]*\](?:[\s\.]+\59\[[^\]]+\])+[\s\)\}\(;@]*count[\s\(]+\60[^\(;\n]+in_array[\(\s]+gettype[\s\(]+\60[^\n\176]{9,499}\bclass\s*(\w{1,40})\s*\{[^\n]+\61::\w{1,40}[\s\(\)]+;\s*\?>(?<X1221752>)|[\s\(]+['"]\176['"][\s,]+['"][ ]+['"][\s\);]+(\$\w{1,40})[=\s]+\$\{\59\[\d+\+\d+\](?:[\.\s]+\59\[\d+\+\d+\])+[\}\s;]+if[\s\(]+(?:(?:(?:in_array|gettype)[\(\s]+)+\$\w{1,40}[\)\.\s]+['"]\d+['"][,\s]+\63[\)\s]+\{\s*\63\[\d+\][=\s]+\63\[\d+\][\.\s]+\63[^:\?]{9,}\?[^;]+;[^\?]{9,}\w+::\w+\s*\(\);[\?>\s]*\Z(?<X2217960>)|(?:(?:in_array|gettype)[\(\s]+)+\$\w{1,40}[\)\.\s]+['"]\d+['"][,\s]+\63[\)\s]+\{\s*\63\[\d+\][=\s]+\63\[\d+\][\.\s]+\63[^\?\+%]{9,}\?[^\{]{0,199}\bfunction\s*(\w+)\s*\([^\?]{9,}\w+::\65\s*\(\)[;\?>\s]*\Z(?<X2224440>)))|(\$\w{1,40})\s*=\s*(?:['"]/home\d*/[^;"']+/wp\-(?:admin|includes)/images/['"\s]+;[^\{\}]{0,199}(\$\w{1,40})\s*=\s*\67\s*\.\s*['"][^'"]+\.(?:png|jpe?g|gif)['"]\s*;[^\}]{0,199}\}\s*else\s*\{[^;]+\bfile_get_contents[\s\(]+\68[\s\)]+;(?<X2203800>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*[^1]{1,400}while\s*\(\s*1\s*\)\s*\{[^\d]{1,99}\$\w{1,40}\s*=\s*fsockopen\(['"]\67['"],\s*(?:80|443),[^\?]{99,999}echo\s+['"]HTTP\s+flood[^;]+;(?<X2122211>))|(\$\{['"]GLOBALS['"]\}\[)[^\]]+\][\s=]+['"]_(HEADERS)['"]\s*;\s*\$\{\71[^\]]+\][\}\s=]+getall\72[\(\s]+[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$\{\71[^\]]+\]\s*\}\s*\[[^\]]+\][\)\s]+\{\s*\71[^\]]+\][\s=]+['"][GPRSC]\w{2,6}['"]\s*;\s*\$\w{1,40}[\s=]+['"]_\72['"]\s*;[^\?]{9,499}\71[^\]]+\]\}?\(\)[;\s\}\?>]*\Z(?<X2228330>)|(create_shells_and_report\(\));\s*function\h*\74[\{\s]+[^\?]{0,99}\bini_set\(['"](?:log|error)_(?:errors|log)['"],(?:0|NULL|FALSE)\);[^\{]{99,300}\bif\(function_exists\(['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\)\)(?<X2217610>)|(function)\s*search_files\(\$\w+[^\?]{500,1100}\b\76\h*load_file\(\)\s*\{\s*\$shellbase[\h=]+array\([^;]+;\s*(\$shellsuffix)[\h=]+array\([^#]{999,2000}(\$\w+)[\h=]+\b(fixslashes)[\h\(]+\$\w+[\h\.]+\77\[[^\?]{99,999}\bif[\h\(]+\78[\s\)\{]+(\$\w+)[\h=]+\79\([^;]+;\s*}\s*return\h*\80;\s*\}\s*\?>(?<X1307830>)|/\*\*[^@]{1,99}@package\h+wordpress\s*\*/\s*eval\(\w+\(\)\);\Z(?<X2265530>)|[^%]{1,256}\$\w+[\s=]+\d+;\s*(\$\w+)[\s=]+curl_init[^%]{99,199}(\$\w+)[\s=]+curl_exec\(\83\);\s*curl_close\(\83\);\s*echo\s*\84;\s*\?>\Z(?<X2299211>)|[^\[]+\[sys_get_temp_dir[^\$]+(\$\w+)=rawurldecode\(\$_POST\["\w+['"]\][^\}]+\}/\.\w+['"];if\(file_put_contents\((\$\w+),\86\){2}\{include\s*\$\w+;@unlink\(\87\);(?:exit|die);\}{3}(?:exit|die)\(['"]!notwrtbl!\s*['"]\);\s*(?:\?>|\Z)(?<X2292790>)|[^\n]{1,9999}\.rawurldecode\(['"]eval[^\n]+file_put_contents\((\$\w+)[^\;]+;touch\(\89[^\}]+\}{2}die\(['"]!success!['"]\);\Z(?<X2293640>)|\$\w*\h*=[^\.]+\.\w+[^\n]{1,999}base64_encode\(\$uname[^\n]+win['"]\s*:\s*['"]linux[^\n]+shell_exec\([^\n]+\$\w+\s*\.=\s*fread[^\}]+\}\s*return\s*\$out;\s*\}\Z(?<X2292851>)|\$\w+[=\s]+['"]https?://www\.onofrio\.com[^\n]+\$\w+[\s=]+\d+;\s*(\$\w+)[\s=]+curl_init[^%]{99,199}(\$\w+)[\s=]+curl_exec\(\92\);\s*curl_close\(\92\);\s*echo\s*\93;\s*\?>\Z(?<X2307992>)|\$\w+\s*=\s*(base64_decode)\(\95\(['"]Q2dvS0NtbG1LQ0ZwYzNObGRDZ2tYME5QVDB0SlJWc(?<X2266050>)|\$\w{1,40}=['"][^'"]{999,}['"];(\$\w{1,40})=['"]chr['"];(?:(\$\w{1,40})=\97\(\d+\-\d+\)(?:\.\97\(\d+\-\d+\)){3,};){2,}\s*eval\s*\([^'";]+\98[\(\s]+['"][^'"]+['"][\)\s;]+\Z(?<X2218350>)|\$\w{1,40}\s*=(?:[^\(]{0,99}\bchr[\s\(]+\d+\s*[\+\-/%\*]\s*\d+\s*\)[^,]+(\$\w{1,40})[=\s]+array_slice[\(\s]+str_split[\(\s]+str_repeat[\(\s]+\100[^\*]{9,9999}\$\w{1,40}[=\s]+glob[\(\s]+\$\w{1,40}[\.\s]+['"][^'"]+['"][,\s]+GLOB_ONLYDIR[^%]{99,999}?\becho\s*\$[^\}]{0,199}(?:exit|die)\b[\(\);\s\}]+\Z(?<X2220801>)|\s*\$_(?:COOKIE|POST)\s*;\s*(\$\w{1,40})[=\s]+0\s*;\s*(\$\w{1,40})\s*=[\(\s]*\d+(?:\s*[\-\+/\*\(\)]\s*\d+)+[\)\s]*;\s*(\$\w{1,40})[=\s]+array[\(\)\s]+;[^\{\}]{0,99}\bwhile[\s\(]+\103[\s\)]+\{\s*\104\s*\[\s*\102[^\n]+\binclude(?:_once)?[\s\(]+\102[\s\);\?>]+\Z(?<X2238500>))|\$files\s*=\s*\[['"][^;]+;\s*foreach[^;]+@?run\(["]pgrep\b[^!]+!preg_match[^\}]+die\([^\(]+die\(['"]!ended![^\n]+shell_exec[^\.]+\.=\s*fread[^\}]{1,99}\}\s*return\s*\$\w*;\s*\}\Z(?<X2292841>))
\A<\?[ph\s]+(?:[^\{]{0,30}\bfunction\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}=['"][a-z0-9]{5,64}['"];\s*(\$\w{1,20})=['"]base64_decode['"];\s*(\$\w{1,20})=\2\([^\}]{9,99}\}\s*return\h*\3;[\}\s]+(\$\w{1,20})=\1\(file_get_contents\(['"]php://input['"]\)\);\s*eval\(\4\);\s*(?:\?>|\Z)(?<X2232890>)|[^\{]{1,999}\{echo\s*['"]<(\w+)>['"]\.basename\(\$\w+\)\."</\6>['"];\}die\(['"]!ended!['"]\);\Z(?<X2293651>)|[^\}]+upload_tmp_dir[^\n]{1,512}\w+(\$\w+);unlink\(\8\);exit;\}{3}die\(['"]!\w+!['"]\);\Z(?<X2308880>)|\$(?:bot){2,}\d*=(?:['"][^'"]+['"];\s*(?:\$\{['"]GLOBALS['"]\}\[[^\]]+\]=['"][^'"]+['"];\s*){5,}\berror_reporting\((?:0|NULL|FALSE)\);[^@>]{1,}[,=](?:CURLOPT_URL,|fsockopen\()[^\?]+/\?useragent=[^\?]{1,999}\becho\s*fgets\([^;]{1,99};\W{0,9}fclose\([^;]{1,99};[\s\}]+(?:\?>|\Z)(?<X1201950>)|[^\?]+(?:(\$\w+)=(?:\w{1,9}\()?\d+\)?;){3,}(\$\w+)=[^;]{1,99};(\$\w+)=['"]https?://[^/'"]+\11/\12\b[^@>]{1,499}[,=](?:CURLOPT_URL,|fsockopen\()\13\b[^\?]+/\?useragent=[^\?]{1,499}\becho\s*fgets\([^;]{1,99};\W{0,9}fclose\([^;]{1,99};\W{1,9}(?:\?>|\Z)(?<X1193200>))|\$[\w'";\s=]+[^%]{1,199}error_reporting\(0\);\s*if[\s\(]+preg_match[^:]+is_file\(['"]\w+(\.txt)["'\)\s\{]+(\$\w+)[^\}]{1,99}\$\w+[\s=]+fetchURLContent\(\16[^%]{1,1200}pingsitemap[^%]+\15['"][,\s]+\$\w+\);\s*\}\s*(?:die|exit)\(\);[\s\}]+\?>(?<X1297110>)|\$[^:]{8,128}https?://[^'"]{8,256}['"][^;]{8,64};\s*(\$\w+)[=\s]+curl_init\(\$[^<]{64,699}(\$\w+)[=\s]+curl_exec\(\18\);\s*(\$\w+)[=\s]+curl_getinfo\(\18[^\{]{8,128}if\s*\(\20[=\s]+200[\)\{\s]+echo\s*\19;[^\?]{8,128}\?>\Z(?<X1316970>)|\$\w+(=\$_SERVER\[)[^;]{1,99};\$\w+=(function)\([^\)]+\)\{(\$\w+)=['"]{2};[^\{]{0,99}\bif\(\23_exists\(['"](?:curl|file)[^\->]{99,900}\}return\h*\24;\};(?:(?:\$\w+\22[^;]{1,99};\s*)?if\(strpos\([^\{]+\)\{[^\?]{0,200}(\$\w+)=['"]aHR0[^;]+;\25=base64_decode\(\25\);[^\}]{9,400}\b(?:exit|die)[^;]{0,9};\}+){1,4}\?>(?<X1232241>)|\$\w+=['";]+(\$\w+\.=['"])\w+['";]+\27\w+['";]+\27\w+['"];\27\w+['";]+\27\w+[^\?\n\{\}]{9999,}eval\(['"]\?>['"]\.\$\w+\);\?>\Z(?<X2296131>)|\$\w+=['"]/(?:[^!]{10,499}explode\([^\n]{10,299}file_exists\([^\n]{1,299}file_get_contents\(\$\w+\);\w+\(!?strstr\(\$\w+,\$\w+\)\)\{print\s*['"]<[^;]+;\}{1,5}(?:exit|die)\(['"][^'"]{1,99}['"]\);\Z(?<X1319140>)|[^&]{1,199}(isset\(\$_COOKIE)[^\)]{1,199}\)&&\30[^\n]{1,999}file_put_contents\([^!]{1,199}\{die\(['"]!\w+![^;]{1,199}\);\}{4}die\(['"]!\w+!['"]\);(?<X2294984>)|[^;]{1,299};\$\w+=[^<]+file_exists\(\$\w+[\)\{]+\$\w+=file_get_contents[^\{]+\{if\(strstr\(\$\w+,(\$cms)\)\)\{(?:exit|die)\(['"]<(\w+)>\{\32\}</\33>['"]\);\}{4}(?:exit|die)\(['"]<\w+>unknown</\w+>['"]\);\Z(?<X1318750>))|\$\w+=['"](?:[^'"]+['"];[^\{]+\{\$\w+=['"]['"];[^\{]+\{\$\w+\.=chr\(hexdec[^\{]+\{if\(ini_get[^\{]+\{return\s*file_get_contents[^\{]+\{[^\{]+\{\$\w+=curl_init[^\?]+\}eval\(['"]\?>['"]\.\$\w+\);(?:\?>|\Z)(?<X1313650>)|[^\(]+error_reporting\(0\);\s*\w+\(\w+\(['"]/\(\w+\|\w+[^\{]+\{\s*header\(['"][^;]+403\s*\w+[^@]+\w+\(@\$_SERVER[^:]+\$(\w{3})[\s=\d;]+\$\w+[=\s]+['"]\36(\.txt)['"][^\?]+\w+\);[^\?]+pingsitemap[^\n]+\36&(\w+)=\$\38[^\n]+['"]<\?xml[^\.]+(['"]\w+\37)['"][^\?]+\39[^;]+;\}\s*(?:exit|die)[^\?]+\w+;[\s\}]+\w+[\{\s]+\}\s*\?>(?<X1314592>)|https?['"][^\{]+\{switch\(\$\w+[\)\{]+case\s*['"](file_get_contents)[^\{]+\{return\s*\41[^\{]+\{\$\w+=curl_init[^:]+:\s*if\(\$\w+=fopen[^\{]+\{\$\w+=stream_get_contents[^\?]+\{eval\(['"]\?>['"]\.\$\w+\);\}else\{echo[^\}]+\}(?:\?>|\Z)(?<X1313371>))|\$\w+=[^\|]{1,1999}if\(\$\w+\(\$\w+\[\d\][^;]+;\$\w+\(__FILE__,\d{4}\);\$\w+\(__FILE__,[^\?]{1,999}\?><\?[ph\s]+eval\(['"]\?>['"]\.base64_decode\(['"]PD9waHAgZXZhbCgnPz4nLmJhc2U2NF9kZWNvZGUoJ1BEOXdhSEFnSkY5ZlgxOWZJR[^'"]{999,}['"]\)\)\?><\?[ph\s]+\$\w+=\w+\(\);\s*\?>\Z(?<X1320222>)|\$\w+=uniqid[^;]{1,99};\$\w+=openssl_decrypt\(['"][^'"]{999,}['"],[^,]{1,99},base64_decode\(['"][^;]{1,99};file_put_contents\(__DIR__\.[^;]{1,299};if\(is_readable\(__DIR__\.['"]/['"]\.(\$\w+)[\)\{\)]+include__DIR__\.['"]/['"]\.\44;\}\?>\Z(?<X1319731>)|\$\w+[=\s]+['"]/[^@]+\$\w+[=\s]+@filemtime\(\$\w+\);\s*\$\w+[=\s]+(file_get_contents)[^;]+;\s*\$\w+[=\s]+rawurldecode\(['"][^'"]+['"]\);[^\?]+\$\w+[=\s]+\[['"]<\?[ph\s]+[^\.]+\.str_repeat\([^\(]+\(file_put_contents\([^\(]+\46[^;]+;[^;]+;[\}\s]+(?:exit|die)\(['"][^'"]+['"]\);(?<X1314071>)|\$\w+[\h=]+['"][^=\$]{1,99};\s*(\$\w+)[\h=]+array\([^\?]{1,4999}=\h*\48\[\d+\]\((?:\$_[GPCSR]\w{2,6}[,\)\h]+)+;[^\?]{1,999}\b[ir](?:nclud|equir)e(?:_once)?\s*\(([^\)]+)\);\s*@?unlink\(\49\);\s*\}\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1201600>)|\$\w+[\s='"]+https://paste\.zone\-xsec\.com/raw/[^?]{99,}curl_close[\$\w;\(\);]+\s*eval\s*\(['"]\?>['"]\.\$\w+\);\s*(?:\?>|\Z)\Z(?<X2297221>)|\$\w+[^\n]{1,299}\((\$\w+)\);[^\n]+rawurldecode\([^=]+=getallheaders[\(\);]+if\(\w+\(\$_HEADERS[^\n]+file_put_contents\(\52[^!]+die\(['"]!\w+![^;]+;\}{4}die\(['"]!\w+!['"]\);(?<X2294991>)|\$\w+\s*=(?:.{99,1999}\b(\w+)\(['"]\w+/:\w/\w+\.\w+\.mod/\w+\.\w+['"]\);[^\n]{1,99}\(\54[^\}]{1,999}sjnoe_cndoe[^%]{1,4999}\?>(?<X1310418>)|\s*\d;[^!]{1,999}!empty\(\$\w+[\)\s\{]+array_multisort[^\n]{1,499}@?opendir\(\$\w+[\)\{\s]+while\s*\(false[^/]+(\$\w+)\s*=\s*\$_SERVER\[['']DOCUMENT_ROOT['\]\s;]+if\s*\(is_writable\(\56[\)\{\s]+\w+\(\56,\s*\56[\);\}\s]+\w+\(['"]/['"],\s*\56\);\s*(?:die|exit)\(['"][^']{1,99}['"]\);\s{1,32}\Z(?<X1322820>))|\$\w+\s+=\s+['"]/[^\[]{1,499}(file_get_contents)\(\$\w+\);\s+\$\w+\s+=\s+rawurldecode\(['"]if[^\n]{1,1499}touch\(\$\w+,\s+\$\w+\);\s*\$\w+\s+=\s+\58\(\$\w+\);\h*if\h+\(strstr\(\$\w+,\h+\$\w+\)\)\s*\{\s*(?:exit|die)\(['"][^'"]{1,499}['"]\);[\h\}]+(?:exit|die)\(['"][^'"]{1,199}['"]\);\Z(?<X1321374>)|\$\w=['"]eval\(hex2bin\([^\?]{99,256};echo\s*['"][^'"]{1,32}['"];unlink\(__FILE__\);\?>\Z(?<X2306420>)|\$\w{1,20}=['"](\w{1,20})['"];\s*\$\w{1,20}=['"]https?://\61\.[^'"]{1,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top)/?['"];\s*function\h+(?:curl|file)_get_contents\([^\\@#%]{1500,5000}\becho\h*\$\w{1,20};\s*(?:exit|die)[^;]{0,9};[\}\s]+else[\{\s]+header\(['"]HTTP/\d\.\d\h*(?:40[43]|500)[^\)]+\);[\}\s]+\s*(?:\?>|\Z)(?<X1205800>)|\$\w{1,20}=\[['"]https?://[^'"]{9,99}/[^'"/]{0,40}(?:\.txt|raw)['"],['"]/tmp/sess\w{1,15}['"]\.md5\([^;]{1,40}\.php\d?['"]\];\s*if\(!?file_exists\([^\?]{200,600}\b(curl_)exec\((\$\w{1,20})\);\s*\63close\(\64\);[\s\}]+(?:\?>)?\Z(?<X2203651>)|\$\w{1,20}=base64_decode\(['"]aHR[^\)]+\);[^\(]{0,20}\b(?:else)?if\(function_exists\(["'](?:curl_version|file_get_contents)['"]\)+[^\{]{0,40}\{[^!<\?]{99,300}\bif\([^\)]+\)[\{\s]+eval\(preg_replace\(['"]/\^?<\\\?php\(\.\*\)[^;]{9,99},\$\w{1,20}\)+;[\}\s]+(?:\?>)?\Z(?<X2204170>)|\$\w{1,40}=(?:['"]?\w[^\.]{1,15}['"]?\.){3}[^;]+;\$\w{1,40}=\d+;[^\{]{9,150}(?:\$\w{1,40}=Array\([^;]+\);(?:\$\w{1,20}=\d+;)?){2}[^\?\}]{99,900}\bif\([^\{]+\{[^\(]{1,70}(\$\w{1,40})=[\w\$]\w+\([^\)]+\);(?:\$\w+=\d+;)?eval\(\67\);(?:\$\w+=\d+;)?(?:exit|die)[^;]{0,9};[\}\s\?>]+\Z(?<X2250400>)|\$\w{1,40}=['"]https?://[^;]{1,199};function\h+(\w{1,40})\([^\?]{9,499}=\69\(\);\?>[^@]{1,499}<input\b(?:[^/]{0,99}\b(?:name|value)=['"]<\?[ph=\s]+(?:echo\s*)?(?:(?:md5|sha1)\(){1,5}\$\w{1,40}\)+;\?>['"]){2}(?<X2190892>)|\$\w{1,40}[\s=]+chr\(112\)[chr\(\)\d+\./\*;\s"']+\$\w{1,40}[\s=]+chr\(98\)[\.chr\d\(\)]+\/(\*1\*)\/[chr\d\(\)\.]+[\s\/]+\71\/[\.chr\(\)\d]+;\$\w{1,40}[\s=]+["'\w\.]+[\s;]+\$\w{1,40}[chr\(\d\(\)\.]+[\,\s]+\$\w{1,40}[\(\$\w\)\,\.]+chr\(56\){2};\Z(?<X1034964>)|\$\w{1,50}=array_filter\(\[sys_get_temp_dir\(\)[^=]{1,500}=rawurldecode\(['"][^"]{1,9999}"\);[^_]{1,999}is_dir(\(\$\w{1,50}\))[&\h+]{1,300}is_writable\73[^\.]{1,300}\.\w{1,50}['"];if\(file_put_contents[^@]{1,300}@unlink\(\$\w{1,50}\);sleep\(\d+\);exit;\}{3}die[^;]{1,32};+\Z(?<X2297582>)|\bclass\s*(\w+)\{[^\{\}]{0,199}\b(function)\s*__construct\([^\{]+\{[^\}]+\$this\->(\w+\(\));\}[^\{\}]{0,199}\b\76\s*\77\{(\$\w+)=\$GLOBALS\[[^;]+;(\$\w+)=count\(\78\);if\(\79\b[^;\{]+\bin_array\(gettype\(\78\)[^\?]{1,499}\breturn\s*\$\w+\(\);\}+;?\$\w+=new\s*\75;\s*(?:\?>\s*)?\Z(?<X2223530>)|\s*class\s*(\w+)\{[^^;]+\$\w+=curl_init\(\);[^\}]+curl_close\(\$\w+\);[^\?]+eval\(['"]\?>['"]\.\$\w+\);\}\}try\{\$\w+=new\s*\81[^:]+https?://\w+\.\w+/shell/\w+\.txt['"]\);\}catch[^>]+>\w+\(\);\}(?<X1313661>))
\A<\?[ph\s]*(?:class\s*(\w{0,4}wp\w{0,40})\s*\{\s*private\s*(\$\w{1,40})\s*;\s*const\s*(\w{1,40})[=\s]+['"][^'"]{0,9}_COOKIE['"]\s*;[^\}\?]{0,400}\?\s*\1\s*::\s*\3\s*:\s*\2\s*;[^\}\?]{0,400}\$this\->\s*\w+\s*\(\s*\)\s*;\s*\}[^\?]{0,999}\bnew\s*\1\s*;[\s\?>]*\Z(?<X2203370>)|define\(['"](\w+)['"],['"][^;]{99,499};function\s*(\w+\()\$\w+\)\{\$\w+=\5;[^\?]{1,499}?\breturn\s*\$\w+;\}function\s*(\w+\()(\$\w+)\)\{[^\}]{0,199}=file_get_contents\(\8\)[^\}]{0,499}(\$\w+)=\6\$\w+\);return\s*\9;\}(\$\w+)=\7[^;]+\.(?:ico|gif|png|jpe?g)['"]\);if\([^;]+\beval\(\10\);\}?\Z(?<X2230130>)|echo\s*['"]<form\b[^;]+;if\(\$_(?:GET|POST|FILES)\)\{if\((?:copy|move_uploaded_file)\((\$_FILES\[['"][^a-z0-9]+['"]\]\[)[^\]]+\],\12[^\]]+\]\)+\{?echo\b[^;]{1,199};\}?(?:else\{echo\b[^;]{1,199};\})?\}\?>(?<X1235920>)|error_reporting(?:[^\{]{1,599}\$config_antibot\[['"]\w+['"]\]\s*=\s*['"]https://(?:activauto\.de|appleunlock\.24\-gute-taten\.de|shahid\-vip\.com)(?<X2256581>)|\(0(?:[\)\s;]+ignore_user_abort[\s;]+sleep[\(\s]+\d+[\)\s;]+\$\w{1,40}[=\(\s]+!empty[\(\s]+\$_SERVER\[[^\]]+\][\)\s]+\?[^\{\}\?]{399,999}\$\w{1,40}[\s='"]+<\?[^='"]{0,199}\$botbotbot\s*=[^\+]+,['"]\?>['"\s\)]+\+\d+[\s\);]+\}[^&]+\bexec[\s\('"]+php\s+\-f[^;]+;\s*unlink[^;]+;[\?>\s]+\Z(?<X2218481>)|\);[^@]{999,9999}(\$\w+)\.=['"][^<;'"]{0,9}<FilesMatch\s*['"]\.\([^\)'"]{0,49}\bsuspected\b[^>]{0,49}>['"];(?:\16\.=['"][\\nr]*(?:Order\s*allow,deny|deny\s*from\s*all)[\\nr]*['"];){2}[^@]{49,999}\bfile_put_contents\((\$\w+),\16\);(?:(?:touch\(\17,[^;]+|\w+\(\)|chmod\(\17,[^;]+);\}*){2,}(?:func[^\}]{0,99}\})?(?:\?>|\Z)(?<X1232912>)|\);\s*(?:(\$\w+)[\h=]+['"][^'"]+['"];[^#]{99,299}\$\w+_website[\h=]+['"]https?://['"\h\.]+\19[\h\.]+base64_decode\([^;]+;[^%]{999,2000}\bif[\h\(]+\$cmd_info[\h=]+['"]\w+['"][\s\)]+\{\s*(\$\w+)[\h=]+['"]User\-[^\{]{0,299}\{\s*\20\.*=['"]Sitemap:[^\?]{0,299}\b(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1307820>)|if\(\$_GET\[['"]Fox['"]\][^\?]{99,250}</form>";\s*move_uploaded_file[\s\(]+\$saw1[\s,]+\$saw2[\s\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1324180>))))|eval\(['"]\?>['"]\.base64_decode\(['"]PD9waHAgZXZhbCgnPz4nL[^'"]{9999,}['"]\){2}\s*\?>\Z(?<X2265800>)|function(?:\s*(?:(\w{1,40})[\(\s]+(\$\w{1,40})(?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]chr['"\s;]+return\s*\26[\s\(]+\25[\s\);]+\}(?:\s*(\$\w{1,40})[=\s]+\24[\s\(]+\d+[\s\)]+(?:\.\s*\24[\s\(]+\d+[\s\)]*)+;)+\s*(\$\w{1,40})[=\s]+\$\{\24[\s\(]+\d+[^;]+;\s*(\$\w{1,40})[=\s]+\24[^;]+;\s*(?:\25|\27|\28)\b[^;]+\29[;\)\?>\s]*\Z(?<X2237460>)|[\)\s]+\{\s*\25[=\s]+(?:(?:gzinflate|base64_decode)[\(\s]+){2}\25[\)\s;]+for[\(\s]+(\$\w)[=\s]+\d+[\s;]+\31<strlen[^=]+(\25\[\31\])[=\s]+(?:(?:chr|ord)[\(\s]+){2}\32[^=]{0,40}return\s*\25[^\(\)]{0,99}\beval[\(\s]+\24[\(\s]+['"][^'"\$=]{999,}=?=?['"][\)\s;\?>]+\Z(?<X2218650>))|\w{1,40}[\(\s]+(?:\$\w{1,40}[,\s\)]+){2}\{\s*\$\w{1,40}[=\s]+curl_init\s*\(\)[^/\?]{0,999}file_put_contents[\('"\s]+\./[^\\]{0,999}exec[\s\(]+\$\w{1,40}[^/]{0,999}(?:curl|wget)\s+\-o\s*\./[^:]{0,999}://(?:\d{1,3}\.?){4}/(\w+)[^\+]+chmod\s+\+x[^\n]{0,999}unlink[\s\(\./'"]+\34[^=]{0,99}\Z(?<X2218770>)|\w{1,40}[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*\36[=\s]+urldecode[\(\s]+\36[\)\s;]+(\$\w{1,40})[^\^]{9,199}\37\[[^\]]+\]\s*\^[^\}]{1,99}\}[^%]{9,999}(?:\$\w{1,40}[\s=]+['"][^'"]{9,}['"][;\s]+){2}(\$\w{1,40})[^\?]{9,199}(?:(?:include_once|unlink)[\s\(]+\38[\s\);]+){2}exit[\s\(\);\?>]+\Z(?<X1220750>))|\s+(?:\w+(\(\$\w+\))\{\$\w+=file_ge(t_contents)\40[^\?]{1,4999}(\$\w+)=['"]<\?[^\?]{1,999}(\$\w+)=[^;]*\42\b[^\?]{1,99}\bfile_pu\41\((\$\w+),\43\)[^\?]{1,199}\bcrontab\s*\-l[&>]+(\w+)[&;]+echo\b[^;]+\44[^;]*>>\45[&;]+crontab\s*\45\b[^@]{999,19999}=writehtaccesstoalldirs\(\);[^\}:]{0,199}\bcase\b[^\?]{1,499}break;\}(?:\?>)?\Z(?<X2227220>)|feedback404\([^\}]{64,256}\}\s*if\s*\(isset\(\$_GET\[['"]\w+['"][\]\)]+\s*\{\s*\$\w+\s*=\s*['"]\w+\.txt['"];(?<X2268653>)))|goto\s*\w{2,6};[^;]{0,99}if[\(\s]+(file_)exists[\(\s]+['""](/tmp/\.\w+)['"][\s\)]+\{\s*goto\s*\w{2,6};\s*\}[^\}\.]{0,99}\b\48pu(t_contents)[\s\(]+['"]\49['"][,\s]+\48ge\50[\s\(]+base64_decode[\s\(]+['"]aHR0[^'"]+['"][\s\)]+;[^\?]{0,499}include(?:_once)?[\s\('"]+\49['";\)\s\?>]+\Z(?<X1203130>)|http_response_code[\(\s]+\d+[\)\s]+;\s*(\$\w{1,40})\s*=\s*(['"])[^\$\n]+?\\?\53\s*;(?:\s*\$\w{1,40}\s*=\s*\52\[\d+\](?:\s*\.\s*\52\[\d+\])+\s*;)+[\?>\s]*\Z(?<X2226550>)|if[^@]{1,99}@(\$_SESSION)\[['"](\w+)['"]\]\)\s*\55\[['"]\56['"]\]\s*=\s*\(!empty\(\$_POST\[[^\(]{1,99}(md5\(){4,}hash\(['"]sha256['"\s,]+(?:\57){3,}\$_POST(?<X2282751>)|if\([^;\?]{1,199}\bfile_put_contents\(['"][^'"]+\.ph(?:p\d*|tml?)['"],[^\)]*\$_[GPCSR]\w{2,6}\[[^\]]+\][^;]{1,49};\}?\s*(?:\?>\s*)?\Z(?<X2200741>)|if\(\$_[GPCSR]\w{2,6}\[[^\]]+\]!=+['"]\w{32,64}['"]\)\{?exit\b[^;]{0,19};\}*function\s*(\w+\()[^@]{19,499}\{(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]+;(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]+;(?:(\$\w+)=(?:\w+\()+(?:\61|\62)\);)?file_put_contents\((?:\63|\61|\62),(?:\63|\61|\62)\);[^\}]{0,199}\b\60[^\)]+[\);\}\?>]+\Z(?<X2228160>)|include(?:_once)?\s*['"]/tmp/sess[^'"]+['"][;\s\?>]*\Z(?<X2226250>))
\A<\?[ph\s]+(?:(\$\w{1,20})=["'][^\n]{4999,}['"];\s*class\h*(\w{1,20})[\{\s]+var\h*\$cd_str;\s*function\h*\w{1,20}\(\)[\s\{]+(\$this\->)[^\?!]{499,2700}\3add\([^\?\-]{9,99}(\$\w{1,20})=new\h*\2\(\d+\);\s*eval\(\4\->unport\(\1\)\);(?:\s*\?>)?\Z(?<X2218890>)|(\$\w{1,20})=['"][^'"]+['"];\s*file_put_contents\(\6,base64_decode\(implode\(array_\w{2,9}\(File\([^\)]{0,15}__FILE__\)+,[\d,]+\)+;\s*[ir][ne][cq][lu][ui][dr][e](?:_once)?\h*\6;\s*(?:\?>|\Z)(?<X2221701>)|(\$\w{1,20})=['"][^'"]{1,20}['"]\^['"][^;]{0,9};[^\?>]{99,999}(\$\w{1,20})=array_merge\(\9,\$_[GPRSC]\w{2,6}\);[^\?@#]{99,999}\{\s*(\$\w{1,20})=sprintf\(\.?[^\$]{0,9}\8\([^\}]{99,600}\binclude\(\10\);\s*\$\w{1,20}\(\10\);[\}\s]+(?:exit|die)[^;]{0,9};(?:\s*\}){2}\s*(?:\?>\s*)?\Z(?<X2234063>)|(\$\w{1,20})=['"][^'"]{9,99}\.txt['"];\s*(\$\w{1,20})=['"][^'"]{9,99}\.txt['"];[^\(]{1,20}\bsystem\(['"]kill[^\)]+\);goto[^\(]{1,20}\btouch\(\12,[^\?>#]{99,400}\berror_reporting\([^\)]+\);[^\(]{1,60}\b(file_)pu(t_contents)\(\12,\14ge\15\(\13\)[^@\?]{9,250}\bchmod\(\12,\d+\);[^\?]{1,50}\bgoto\h*\w+;\w+:\h*\w+:\s*(?:\?>|\Z)(?<X1216271>)|(\$\w{1,20})=['"]https?://[^'"]{2,60}\.(?:txt|php)['"];\s*(\$\w{1,20})=['"]/tmp/sess_[^;]{9,99};\s*if\(file_exists\(\18\)\)[\s\{]+include(?:_once)?[\(\h'"]+\18[\)\h'"]+;[^_]{0,29}\b(file_)pu(t_contents)\(\18,\19ge\20\(\17\)\);[^\}]{1,60}\}\s*(?:\?>)?\Z(?<X2202600>)|(\$\w{1,20})=['"]w3bane\h*v\d\.\d['"][^;\$]{9,150}<title><\?php\h*echo\h*\22;(?<X2202590>)|(\$\w{1,20})=['"]{2};\s*if\(isset\([^\\\?!]{300,600}\bcutterimg\([^\{]{9,99}\{\s*\24=['"][^'"]{99,200}['"];\s*if\((\$\w+)=[^\{]{2,20}\{(\$\w+)=["']\};['"]\.gzinflate\(base64_decode\([^;]{9,99};\s*create_function\(['"]{2},\26\);\s*\}[^\?>]{99,200}\bjson_encode\(array\([^\)]+\25\)\);[\}\s]+(?:\?>|\Z)(?<X2227340>)|(\$\w{1,20})=\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]wget[^:]{1,9}https?://(?:raw\.)?pastebin\.[^'"]{9,99}\.\w{2,4}['"]\);\s*if\(\28[^\)]+\)[\{\s]+[^\}]{1,99}[\}\s]+else[\{\s]+[^\}]{1,99}[\}\s]+(?:\?>)?\Z(?<X2208290>)|(\$\w{1,20})=file_get_contents\(['"][^'"]{1,60}\.(?:js|txt)['"]\);\s*\30=base64_decode\(\30\);\s*class\h+(\w{1,20})[\{\s]+public\h+function\h*(\w{1,20})\((\$\w{1,20})\)[\{\s]+eval\(\33\.['"]{2}\);[\}\s]+(\$\w{1,20})=new\h+\31\(\);\s*\34\->\32\(\30\);\s*(?:\?>|\Z)(?<X2207330>)|(\$\w{1,20})=range\(['"]\W['"],['"\h]+\);\s*(\$\w{1,20})=\$\{\36\[[^\}]{9,99}\]\};\s*if\(\(?in_array\(gettype\(\37[^\?]{60,150}\37\(\)\);[\}\s]+class\h*(\w{1,20})[\{\s]+[^<#\*]{400,1500}\b(?:exit|die)[^;]{0,9};\s*(?:endif;)?[\}\s]+\38::\w{1,9}\(\);\s*(?:\?>\s*)?\Z(?<X2216533>)|(\$\w{1,40})=['"]base64_decode['"];if\([^\)]+\$_[GPCSR]\w{2,6}\[[^\}\?]{1,499}(\$\w{1,40})=\40\(\$_[GPCSR]\w{2,6}\[[^\}]{1,499}\b[ri](?:nclud|equir)e\w{0,5}\(?\41\)?;unlink\(\41\);(?:die|exit)[^;]{0,19};\}(?:else\{eval\(\40\(\41\)+;\})?\}(?:else\{[^\};]{0,99};\})?\s*(?:\?>|\Z)(?<X1189490>)|(\$\w{1,40})=['"]range['"];(\$\w{1,40})[=\s]+\43\(['"]\W['"],['"]\W['"]\);include(?:_once)?[\s\('"]{0,5}(?:\44\[[^\]]+\]\.){4,}\44\[[^\]]+\];?\?>\Z(?<X2220763>)|(\$\w{1,40})[\s=]+base64_decode[^;]{8,64};(if[\(\s]+isset)\(\$_GET\[\46([\]\)\{]+)if[\(\s]+(\$_FILES)[\)\s]+\{move_uploaded_file\(\49[^\}]{16,128}\}\47\((\$_POST\[['"]cmd['"])\48[^\}]{16,200}shell_exec\(\50\]\)[^\)]{16,64}[\)\s]+\{file_put_contents[^\.]{1,500}\.(htmlspecialchars)\(\$_GET[^_]+\51\(file_get_contents[^\?]{1,200}\?>\Z(?<X2303471>)|(\$\w{1,60})=['"]\w{5,60}['"];\s*function\h*(\w+)\((\$\w+),(\$\w+)\)[\{\s]+[^\(]{0,99}(\$\w{1,60})=urldecode\(\55\);\s*(\$\w{1,60})=substr\(\56,[^\}]{9,99};\s*return\h*\57\^\58;[^\[]{1,300}\bif\([^\{]+\)[\{\s]+(\$\w{1,60})=\$\w+\[\53\];\s*(\$\w{1,60})=\59\[\54\([^;]{1,50};\s*include\(\60\);[^\}]{0,99}\}\s*(?:\$\w{1,40}=['"][^;]+;)?(?:\?>|\Z)(?<X1232262>)|(define)\(['"]\w+['"],getcwd\(\)\);\62\(['"]\w+['",]+https?://tableinhouse\.com[^%]{1,999}CASINO\b(?<X2319590>)|(define\()[^,]+,['"]\w{32}['"]\);\s*if\(md5\([^\{]+\)[\{\s]+header\([^\}]{9,99}\}\s*\64['"]([^,]+)['"],['"]https?://[^\(]{9,99}\bif\([^\{]+\)[\{\s]+(\$\w{1,20})=\65\.['"]\?file=["'][^;]{1,40}\.txt[^!<]{9,99}\bfile_get_contents\(\66[^#%\*]{200,999}(\$\w{1,20})=(curl_)exec\(([^\)]+)\);\s*\68close\(\69\);return\h*\67;\s*\}(?:\s*\?>)?\Z(?<X2210960>)|(echo)[\h'"]+<[^>]+\bhtml>[\h'"]+;\s*\71\h+eval\(['"]\?>['"][.,]file_get_contents\(['"]https?://bit\.ly/[a-z0-9]{1,40}['"]\)\);\s*(?:\?>|\Z)(?<X1204670>)|(function)\h*(?:file_)?(?:get|put)(?:_contents)?\([^\)]+\)[\{\s]+[^\\//]{9,300}\bfile_[gp][ue]t_contents\([^;]+;[\}\s]+\73\h*(\w{1,20})\([^\{]+\{[^//\\]{9,400}\b[ps](?:assthru|ystem|xec|hell_exec|open)\([^@#]{200,999}(?:\b\74\([""]pkill[^;]+;\s*){2,4}[^@\*]{99,300}\b(?:unlink\([^;]+\);\s*){2,4}(?:\s*\?>)?\Z(?<X2215230>)|(function)\h*(\w+)[\h\(]+[^\{]{1,40}\{\s*\$\w{1,20}=['"][^\$]{20,60}['"];[^,]{9,99}(\$\w{1,20})=Array\(\);[^\(]{0,15}(?:\78\s*\[\]=\77\(Array\([^\;]{1,150}\);\s*){10}[^\?]{99,600}\b\76\h*(\w{1,20})\([^\}]{20,250}[\s\}]+(\$\w{1,20})=[^;]+;\s*\79\(\78,\78\[\d+\]\([^\)]{5,40}\78\[\d+\]\(\80[\)\s]+;\s*\}(?:\s*\?>)?\Z(?<X2249512>)|(function)\h*\w+\(\$\w+\)\s*\{\s*(\$\w+)\s*=\s*rawurldecode\(\$\w+\);\s*(return)\s*\83;[^\^]{1,199}\b\82[^\$]+(\$\w+)[^\w]+eval\(\85\)[^%]+\82[^\$]+(\$\w+)[^\w]+\84\s*array_sum\(\86\);\s*\}\s*\w+\(\);\s*\$\w+\s*=\s*\w+\(\[[\d,\h]{10,32}\]\);\Z(?<X2277761>)|(function)\s*(\w+)\(\)\{(\w+)\(\);\}(\$\w+)=[^;]+\.txt['"];if\(file_exists\(\91\)+\{?include[\s"\(]+\91["\s\)]+;\}?if\(\88_exists\(['"]\90['"]\)+\{(\$\w+)=new\s*\w+\(\);if\(\92\->\w+\(\)+\{add_action\(['"]\w+['"],['"]\89['"]\);\}+\Z(?<X2223521>)|(function)\s*(\w{4,16})\((\$\w+)\)\{\$\w+=\w+\(\96\);\$\w+=\w*\(\96,\$\w+\);return\$\w+;\}\94\s*\w+\((\$\w+)\)\{return\s*array_sum\(\97\);\}\94[^=]{1,64}=hash\(['"]sha256['"],\$\w+,TRUE\);[^\(]{1,99}\94\s*(\w+)\(\$\w+[^\]]+str_pad\([^\\%]+rawurldecode\([^\]]+\$_COOKIE\[[^\\]{1,999}\95\([^\]]{1,999}\98\(\[\d+,\d+,\d+,\d+,\d+,\d+\]\);\Z(?<X2278450>)|(function\s+)\w+\(\$\w+\)\{[^\}\{]{1,199}\{\$\w+\.=[^;]+;\}(return\s*)\$\w+;\}\100(\w+)\(\$\w+,\$\w+\)\{[^\}\{]+\{\101(\$\w+)\^[^;]+;\}[^\{\}]+\{\103\[[^;]+;\}\101\103;\}(\$\w+)=['"][^'"]{9999,}['"];[^\?\(]{0,99}\$(\w+)=\102\(\104,\$\w+\);eval\(\$\105\);(?:\?>)?\Z(?<X2212751>)|(goto)\h*\w{1,20};\h*\w{1,20}:[^,]+(file_)pu(t_contents)\((["']/tmp/[^\.]{0,20}\.(?:txt|config)['"]),\108ge\109\(base64_decode\(['"]aHR0c[^\{]{20,200}\bif\(\108exists\(\110\)\)[\s\{]+[^\?]{1,40}\b\107\h*\w{1,20};\h*\w{1,20}:\s*include\h+\110;\s*(?:\?>|\Z)(?<X2204660>)|(goto)\h*\w{1,9};\w{1,9}:\h*\w{1,9}:\h*\112\h*\w{1,9};[^\{]{9,150}\bif\([^'"]{1,15}['"]\w{32,64}['"]\)\)[\{\s]+[^\\\?]{99,499}\b[mc](?:opy|ove_uploaded_file)\([^\?@\\]{9,150}['"];\s*\112\h*\w{1,9};\h*\w{1,9}:\h*\w{1,9}:\s*(?:\?>\s*)?\Z(?<X2208741>)|(goto)\s*(\w+);\s*\w+:\s*\$\w+[\s=\('"]+\w+['"]\)\[\d+\]\.[^\?]+\115:\s+\$\w+[\s=]+\$_SERVER;\114[^\n]{1,499}:(\$\w+);\114[^\n]{999,1999}echo\s*['"]<['"]\.\(['"]\w+['"]\)\[\d+[^\n]+\116;;?\114\s*\w+;\s*\w+[:;\s]+\?>(?<X1306590>)|(goto)\s*\w+;\s*\w+:(?:[^\?]+\?\s*(\$_SERVER)\[['"]\\[^'"]+['"]\][^@]+curl_init\(\);\s*\118\s*\w+;\s*\w+:[^\.]+\.\s*\$\w+\s*\.\s*['"]\\\w+[^\|]+\|\|\s*strpos\(\$\w+,\s*['"]\\[^\n]{50,1500}urlencode\(\119[^;]+;\s*\118\s*\w+;\s*\w+:\s*fwrite\(\$\w+,[^\?]+error_reporting\(0\);\s*\118\s*\w+;[^\?]+(?:\Z|\?>)(?<X1314480>)|\s*(\$\w+)[\s=]+curl_init[\s\)\(;]+\118\s+[^%]{1,499}header\(['"]\\[^%]{1,999}\118\s*\w+;\s*\w+:[^=]+[=\s]+(\$_SERVER)\[['"]\\[^%]{1,2999}cURL_clOse\(\121[^!]+!preg_MatcH\(['"][\\a-z0-9]{99,}['"],\s*\122[^%]{1,3999}urleNCODe\(\122\[[^;]+;\s*\118\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X1301910>))|(goto)\s*\w+;\w+[^\{]+\{\124\s*\w+;\}[^=]+\$\w+=UrLEncODe\(\$_SERVER\[['"]REQUEST_URI[^:]+:\s*hEAdER\(['"]HTTP/\d+\.\d+\s*500[^\-]+HeADER\(['"]Content\-type:text/xml[^\!]+\$\w+=curl_init\(\);goto[^/]+HTTP/\d+\.\d+[^/]+STR_ReplaCe\(['"]/['"],[^\.]+fopeN\(['"]robots\.txt[^\?]+\w+:(?:\?>|\Z)(?<X1314080>)|(header\()['"]HTTP/[\d\.]+\s+30[21]\b[^;]+;\126['"]Location:\s*https?://[^;]+/wp\-(?:includes|admin)/[^\)]+\);?(?:\?>)?\Z(?<X2220451>))
\A<\?[ph\s]+(?:(if\(isset\()\$_GET\[['"](\w{3})['"\]\)\{\s]+\1(\$_POST)\[['"](\w+)['"\]\)\h&]+trim\(\$_POST\[['"]\4[^;]{1,99}(\$\w+)\h*=\h*trim\(\3\[['"]\4[^_]+\3[^;]{1,32};\s*if\(file_put_contents\(\5,\$\w+[\)\{\s]+echo\h+["']\w+['"];[\s\}]+[^\}]{1,512}\?\2=[^\}]{1,512}</html>['"];\s*(?:exit|die);\s+\}\s*\?>\Z(?<X2279771>)|/[\*\s@]+\w+\s*\bWordpress_core[^\?]{1,999}hex2bin[^\$]+\$\w+[\s=]+file\(['"]+\./\w+\.txt[^\?]+eval\(\$\w+[\);\s]+\?>\Z(?<X2286722>)|/[\*\s]+Loads\s*\w+\s*(wordpress)\s*\w+\s*[^\.]{1,99}template\.[^/]{1,99}@package\h+\8\s*\*/\s*(goto)\s*\w+;\s*\w+:\s*\$?\w+.{999,9999}\9\h+\w+;\h+\w+:\h+;\s*(?:\?>|\Z)(?<X2291372>)|/\*[^\*]+Official\h+wordpress\h+plugin\s*author:\h+wordpress\b[^*]+(?:\*/\s*function\s*\w+\(\)\s*{\s*global\s*(\$\w+);\s*if[\s!\(]+isset\(\11\){2}\s*\{\s*return;\s*}\s*\$\w+[\s=]+array\(['"][\w\-]+/index\.php['"]\);[^\?]+function\s*(\w{3})\([^\}]+\w{1}\s*\.=\s*chr\(\$\w+\s*\-[^\?]+(?:require|include)(?:_once)?\s*\12\(['"]\w{8,}['"],\s*\d+\);\s*\}\s*\Z(?<X1304831>)|Author\h+URI:\h*http://wordpress\.org/#\s*\*/[^\?]+[^%]+\$\w{1}\s*\.=\s*chr\([^\{]+function\s*(\w+)[^\}]+wp_die\(\);\s*\}\s*(add_action)[^;]+\14['"]\);\s*\15\([^;]+\14['"]\);\Z(?<X1304960>))|@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+['"][^'"]{0,499}\b(?:\d+e?xploitercrew|ge14y|backdoor|shell)\b[^'"]{0,499}['"]\);?(?:\?>)?\Z(?<X2222611>)|[^%]{1,199}(\$_SESSION)\[(['"])otp_code\19[^%]{1,100}\18\[\19\w+\19\][\s=]+\$\w+;[^?]{1,499}file_get_contents\(['"]https?\:\/{2}api\.telegram\.org\/bot\b[^}]{1,999}[}\s]{1,64}header\(['"]Location[:\s]{1,32}[^;]{1,99}[\s;]+(?:exit|die)\(\);(?<X2298205>)|[^:]{1,99}[:\h]+\w+\h+\w+\s*plugin\s*URI[:\h]+https?://\w{2}\.\w+[^/]+/\s*if\([^\.]+\{(\$\w+)[^\.]+\.['"]assets/\.htaccess['"];[^;]+file_get_contents\(\21\);\$\w+=base64_decode[^'"]+\(['"]UTF\-16LE(?<X2292031>)|[^:]{32,512}https?://unlockcontent\.net[^\)]{32,512}\);\$\w+=curl_init[^\:]{9,}Authorization:\s*Bearer[^;]{8,64};\s*(\$\w+)=curl_exec\(\$\w+\);[^\-]{64,512}\23=json_decode\(\23[^\{]{8,64}\{\$\w+=\23->\w+;[^;]{8,128}header\(['"]Location:\s*[^;]{16,128};(?:exit|die)\(\);[^;]{8,128};\}(?:\Z|\?>)(?<X1317261>)|[^:]{8,256}https?://raw[^'"]{10,99}\w+\.php['"];[^\{]{50,999}(\$\w+)=curl_exec\(\$\w+\);if\(\25={1,4}false\)\{echo[^\{]{10,200}\{(\$\w+)=tempnam\(sys_[^;]{5,99};if\(file_put_contents\(\26,\25\)[^\{]{5,299}\{include(?:_once)?\26;unlink\(\26\);\}else\{echo[^\?]{50,99}(?:\?>|\Z)(?<X1317541>)|[^;]+;(\$\w+)=['"]base64_decode[^=]+=explode\(\28[^,]+,file_get_contents\(__FILE__[\);\s]+\$\w+=\(\28\(['"][^'"]+['"][\);]+eval\(\$\w+\);(?:\?>|\Z)(?<X1311131>)|[^;]+;\$\w+=rawurldecode\(['"]<\?[ph\s]+\s*if\(\w+\(\$_COOKIE[^%]+if\(file_put_contents\(\$\w+,\$\w+\){2}\{echo\s*[^;]+;touch\([^;]+;\}die\(['"]!\w+!['"]\);(?<X2294971>)|[^;]{1,299};chdir\([^;]{1,399};\w+\(file_exists\(['"](\w+/wp\-load\.[ph]+)['"]\)\)\{(?:include|require)(?:_once)?\s*['"]\31['"];[^\n]{1,999}new\s*WP_User_Query\([^\n]{1,399}Administrator[^\{]{1,999}\{wp_set_auth_cookie\(\$\w+\[0\]\);wp_redirect\(admin_url[^\{]+\{(?:die|exit)\(['"][^'"]{1,499}['"]\);\}\?>\Z(?<X1319340>)|[^<]+\$\w+=['"]<FilesMatch\s*['"]\\\.\([ph\s]+[^\?]+\$\w+=['"]<\?[ph\s]+//\s*['"]\.(rand\()[^\052]+\052\$_['"]\.\33\)\.[^\n]{50,2000}mkdir\((ABSPATH)\.\$\w+[^!]+(unlink)\(\34\.\$\w+[^!]+if\(!is_dir\(\34[^!]+if\(!is_file\(\$\w+\)[\)\s]+file_put_contents[^\?]+\35\(\$\w+\.\$\w+\);(?:\?>|\Z)(?<X1313230>)|[^=]+=str_rot13\(['"]\w+://\w+\.\w+[^>]+wp_remote_get\([^&]+&&isset\(\$\w+[^/]+WP_CONTENT_DIR\.['"]/\w+/[^=]+=file_put_contents[^\{]+\{include\$\w+;unlink\(\$\w+\);\}\}\}(?<X1313751>)|[^\$]{0,60}(\$\w{1,20})=rand\([^\)]+\);\s*(?:if\(\38\W{1,3}\d+\)[\{\s]*\$\w{1,20}=(?:base64_decode\()+['"][^\)]{400,2500}\)\);\s*){1,4}\$\w{1,20}=fopen\((base64_decode)\([^\?//\\]{999,2500}\bfwrite\(([^,]+),\$\w+\);\s*fclose\(\40\);\s*e(?:val|xec)\(\39[^>]+php>(/dev/null)[\h\d>]+\41&?[^\)]+\);\s*unlink\([^\)]+\);(?:\s*\?>)?\Z(?<X2218830>)|[^\$]{0,99}\$\w{1,20}=['"]unknownsec['"];[^\}]{0,99}\bfunction_exists\(['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\)\)\s*\{(?<X2217270>)|[^\$]{1,60}\berror_reporting\((?:0|NULL|FALSE)\);[^\$]{0,60}\$auth_pass=['"]\w{32,64}['"];\s*if\(get_magic_quotes_gpc\(\)\)[\{\s]+[^<//\\]{99,200}\bfunction\h+login\(\)[\{\s]+die\([^@\\\*]{999,4500}\btitle=['"][cfhp](?:oded|ucked|acked|wned)\h+by\b(?<X2204050>)|[^\$]{1,64}error_reporting\(0\);[^\$]{1,99}if\s*\(\$_POST\)\s*\{\s*\$\w+\s*=\s*\$_SESSION\[[^:]+://ip\-api\.[^%]+tiktok\b(?<X2295932>)|[^\(\{]{0,150}\bfunction\h*(\w+)\([^\)]+\)[\{\s]+[^\^]{1,60}(\$\w+)=urldecode\([^\^]{1,99}\47\^\$\w+;[^\{]{1,99}(\$\w+)=\$\{\46\([^\{]{9,99}\bif\([^\{]+\{\s*(\$\w+)=\48\[[^;]+;[^\[]{1,50}\49\[\46\([^\}]{9,99}\binclude\([^\}]{0,40}\}(?:\$\w+=[^;]+;){0,4}\Z(?<X2251740>)|[^\(]+\$\w+=base64_decode[^;]+;\s*file_put_contents\(\$\w+,base64_decode[^,]+,\w+\);[^;]+;\s*(touch)\(\$\w+,\s*\$\w+\);\s*\?><\?[ph\s]+[^\?]+system\(['"]\$\w+[^\-]+strtotime\(['"][^;]+;\s*\51\(\$\w+[^\-]+\-[^;]+;\s*\51\(\$\w+,\s*\$\w+\);\s*(?:\Z|\?>)(?<X1314490>)|[^\(]{0,60}(function)\h*(\w{1,40})\(\)[\{\s]+(?:\$\w{1,20}=[^;]{2,40};){1,9}\$\w{1,20}=\$GLOBALS\[(\w+)\([^\{]{1,200}\bif\([^\{]+\{[^\}]{9,99}\$\w{1,20}=\$\w+\[\55\([^\{]{9,150}\b\53\h*\55\([^\}]{99,300}\breturn\h*\$\w+;[^\}]{0,40}\}[^\(]{0,40}\54\(\);(?:\$\w{1,20}=[^;]+;){0,3}\Z(?<X2251672>)|[^\(]{0,60}function\s*(\w{1,40})\([^\{]{0,40}\)[\{\s]+\$\w{1,20}=urldecode\([^\^]{9,150}\^[^\{]{9,150}(\$\w{1,40})=\$\{\57\([^\{]{1,60}\bif\(isset\([^<]{9,99}(\$\w{1,20})=\58[^\(]{9,99}(\$\w{1,20})=\59\[\57\([^;]+;include\(\60\);[^\}]{0,40}\}\Z(?<X2251710>)|[^\(]{1,199}error_reporting\(0\);[^\n]{1,699}\burlencode\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^:]{99,999}strpos\(\$\w+,['"]pingsitemap[^\n]{99,999}\bcurl_init\([^\?]{99,999}<\?xml['"]\)\{header\(['"]Content\-Type[^\?]{1,499}echo\$\w+;(?:exit|die)\(\);return;\}\}else\{\}\?>(?<X1320670>)|[^\(]{1,32}\(\w+[^\}]{1,99}\}(\$\w+)=md5\(\$_SERVER\[['"]http_host['"]\]\)\.['"]\w+['"];\w+\(!isset\((\$_COOKIE)\[\63\][^\n]+\64\[\63\]!==\$\w+\)\{showPasswordForm\(\);\}\}\Z(?<X2316300>)|[^\.=]{0,60}(\$\w{1,20})=[\('"]+[^;]{1,999}[\)'"]+;\s*(\$\w{1,20})=(?:\66\([^\)]+\)\.?){5}[^;=]+;\s*(\$\w{1,20})=(?:\66\([^\)]+\)\.){5}[^;=]+;[^/\?]{99,600}(\$\w{1,20})=\67\(\68\(['"][^'"]{5000,}['"]\)\);\s*(\$\w{1,20})=\$\w+\(['"]{2},\69\);\70\(\);\s*(?:\?>)?\Z(?<X2220676>)|[^\.]{1,999}<(script)>\w+\.\w+\.\w+\([^\n]{1,199};\w+\s*(\w+)\(\)[^\n]{1,299}\w+\s*browser[^!]{1,99}vulnerabilities!\s*\w+\s*update[^\{]{1,299}\{\w+\.\w+\.href=['"]https?://[^;]+;\}{2}[^\n]+\72>['"];\}add_action[^\)]+\73['"]\);(?<X2312191>)|[^\.]{99,999}\.implode\(['"]['"],[^=]{1,399}=base64_encode\(\$\w+\);class\s*(\w+)[^!]{99,999}\w+\s*function\s*(\w+)\(\)\{[^\{]+\{\$\w+=curl_init[^\?]+new\s*\75\(base64_decode\(\$\w+\)\);[^/]{99,999}\76\(\);eval\(['"]\?>['"]\.\$\w+\)[^\?]{9,199}\?>\Z(?<X1318771>)|[^\[]+error_reporting\(0\);\w+\(preg_match\(['"]/[^\{]+\{Header\(['"][^'"]+403\s*[^;]+;(?:exit|die);\}[^=]+=urlencode[^\.]+\w+\.txt[^\.]+(strpos)\(\$\w+,['"]favicon\.ico[^,]+\78\(\$\w+,['"]robots\.txt[^,]+,['"]pingsitemap[^<]+\)\)\{\?>(?<X1314721>)|[^\d]{0,40}(\$\w{1,20})=['"][a-z\d]{5,20}['"];[^\(]{0,60}\bfunction\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}=urldecode\([^\{]{20,200}(\$\w{1,20})=\$\{\81\([^\(]{0,40}\bif\(!?isset\((\82\[\80\])[^\[]{1,99}(\$\w{1,20})=\83;\s*\$\w{1,20}=['"]\w{1,20}['"];\s*(\$\w{1,20})=\84\[\81\([^\(]+;\s*[ir](?:nclude|equire)\(\85\);[^\}]{0,90}\}\s*\Z(?<X2239852>)|[^\w]{1,16}CREATED?\h+BY\h+MATIGAN1337\b(?<X2290730>)|[^\{]+\{unset\(\$\w+\[\w+[^;]+;return\$\w+;\}\);[^\{]+\{global\$\w+;[^;]+officialwp[^<]+file_put_contents\(\$\w+,['"]<\?[ph]+[^\{]+\{include\$\w+;unlink\(\$\w+\);[^>]+(str_rot13)\(['"][^;]+;\s*\$\w+=wp_remote_get[^/]+\88\(['"]\w+://[^!]+register_rest_route[^\n]{50,999};\}\}\}(?<X1315361>)|[^\{]+imunify360\.\w+['"],false\)[^\{]+\{\w+\(\w+\(['"]curl_init[^\?]+file_get_contents[^\?]+\?>https?://[^\?]+\?>\Z(?<X2295570>))
\A<\?[ph\s]+(?:\w+\s*(\w+)\{\w+\$\w+;\w+\$\w+=array\(['"]\w+['"\s=>]+(aHR0)[^'"]{1,999}['",]+\w+['"\s=>]+\2[^'"]{1,999}['"\s,]+\w+['"\s=>]+\2[^'"]{1,999}['"\);]+\w+[^%]{1,999}\w+\(\)\{\w+\(get_option\(['"](\w+)['"],[^,]{50,999}wp_create_user[^\}]+\w+\(['"]administrator[^%]+\3['"]\);\}\);\w+\s*\1\(\);\Z(?<X2317161>)|\w+\s*\(\w+\((\$_COOKIE)\[(\d+)[\s\-]+\6\]\)[^\{]+[\{\s]+(\$\w+)[\s=]+\5[^\}]+sys_get_temp_dir[^\{]+[\{\s]+\$\w+[=\s]+\w+[^\n]{99,256}\w+\(\w+\(\7[^\n]{99,}true\){2}\s*\{\s*(?:die|exit);\s*\}\s*\}\s*\}(?:\?>|\Z)(?<X2307930>)|\w+\s+(\w+)[^\}]{99,256}\}\s*(\$\w+)[\s='"]+\?>['"\s]+;\s*eval[\(\s]+\10[\s\.]+\9[^'"]+['"]aHR0[^'"]+['"][\s\)]+;\s*(?:\?>|\Z)(?<X2291071>)|class(?:\h*(\w{1,20})[\{\s]+var(?:\$\w{1,40}[\s=]+['"][^"'\n]{999,}['"];var\$\w{1,40}[\s=]+array[\s\(]+(?:\d+,){9,}\d+[\s\)]+;[^\?\n]{999,}\$\w{1,40}[=\s]+(isset)[\(\s]+\$_[GPRSC]\w{2,6}\[[^;\?]+\?[^&\n]{9,}\13[\(\s]+\$_SERVER\[[^\*]+new\s+\12\s*\(\);[^\n]+eval[\s\(]+\$\w{1,40}\->\w+[\s;\}\)\?>]+\Z(?<X2218911>)|\h*\$cd_str;\s*(function)\h*\w{1,20}\(\)[\{\s]+\$this\->\w{1,30}\(\d+\);[\}\s]+\15\h*\w{1,20}\([^\)]+\)[\{\s]+[^\?#]{999,5000}(\$\w{1,20})=['"][^\n]{4999,}['"];(\$\w{1,20})=rawurldecode\(\16\);(\$\w{1,20})=new\h*\12\(\d+\);\s*eval\(\18\->\w{1,20}\(\17\)\);(?:\s*\?>)?\Z(?<X2218980>))|\s*(\w+)[\s\{]+private\s*static\s*(\$\w{1,40});[^\d]{1,499}\21=array\([^\)]+\);[\s\}]+(\$\w{1,40})=\$_[GPRSC]\w{2,6};\(\22&&isset\(\22\[[^\]]+\b\20::(\w+\()[^#><!%@\*\}\{]{1,1999}\b\20::\23[\d\]\)\s]+&&eval\(\$\w{1,40}\)+\s*:\s*\22;\s*(?:\?>\s*)?\Z(?<X2222934>)|\s*(\w+)\{[^\{]{1,99}\{\$\w+=['"][^'"]{999,}['"];[^\n]{1,99}new\s*\25[^\n]{1,299}eval\([^\[]{1,499}chr\(hexdec\(\$\w+\[\$\w+\]\.\$\w+\[\$\w[^\}]{1,299}\}return\$\w+;\}\Z(?<X1319150>)|\s*\w+\{private\s*(?:static)(\$\w+);static\s*function\s*triggerCallback\((\$\w+)\)\{[^\}]+\}return\s*(?:hex2bin)?\(((self::\27)\[\28\])\);\}[^@]{1,500}\breturn\s*\29;\}[^@]{1,300}\30=array\([^\)]+\);\}+(\$\w+)=\$_COOKIE;(\$\w+)=(SystemManager)[^;]+;\28=\33[^;]+;[^@]{1,999}\31\[\33[^\}]+\}include\32;\Z(?<X2312450>)|\s+(\w+)\{[^\}]+(function)\s*__construct\(\)\{(\$[^=;]+)=['"][^;]+;(\$[^;=]+)=(\w+)\(\37\);eval\([^\)]*\38\b[^;]+;\}+new\s*\35\(\);\36\s*\39\((?<X2209801>)|\s+(MimeTypeDefinitionService)\{(public\s*function\s*)addData(\(\$\w+),[^\)]+\)\{if\(!is_scalar\43\)[^\}]+\}\42(\w+)[\s\(\)]+\{(\$\w+)=\$_SERVER\[[^;]+;\$\w+=\$this\->(\w+)\(\45\);[^@#]{999,4999}\42\46\(\45\)\{[^\?]{1,399}\}\}(\$\w+)=new\s+\41\(\);\47\->\44\(\);\s*(?:\?>\s*)?\Z(?<X2202760>))|echo(?:[^\;]+;error_\w+\([^\)]+\);(\$\w{1,40})=isset\((\$_[GPRSC]\w{2,6})[^\;]+;\$\w{1,40}=\49\.\50[^\;]+mt_rand\(\d+,\d+\)[^\;]+;\$\w{1,40}[^\;]+;[^\?]+(?:\$\w{1,40}=getCurl\((?:['"]http://ly7\.zqhdya\.\w+[^\;]+;|\$\w{1,40}\);))+(?:(\$\w{1,40})=str_replace\([^\)]+\);)+echo\51;echo[^\;]+</html>['"];\Z(?<X2220771>)|\h*['"]<html>\s*<head>\s*<title>\s*Wordpress\h*Mass\h*User\b[^\|\+]{99,999}[ie](?:rror_reporting\(|ni_set\(['"]error_log['"],)(?:0|NULL|FALSE)\);(?<X1213060>)|\h*eval\(['"]\?>['"]\.file_get_contents\(['"]https?://bit\.ly/\w{3,8}['"]\)\);\s*(?:\?>)?\Z(?<X2202150>)|\s*['"]%pdf\-[^;]+;class\s*(\w+)\{\w+_{2}\w+\w+\(\)\{\$\w+=(\$\w+)\->\w+\(\56[^\n]{999,};var\$\w+=['"][^;]{99,};\}new\s*\55\(\);\?>\Z(?<X2305801>)|\s*['"]<title>[^</;]{0,49}\bUploader\b[^;]{1,299}\.php_uname\(\)[^\?:,]{1,499}\b[cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,;\)]+,\58(?<X2222330>)))
\A<\?[ph\s]+(?:eRror_REpOrTing(?:[^\{]+\{return\$_SERVER\[\$[^>]+\$\w+=cuRl_iNIT\(\);[^=]+round[^>]+>['"]https?://['"]\.\$\w+\.chR\(\(int[^\}]+\}else\{break;\}\}[^\}]+\}\$\w+=cUrL_gEtinfO\(\$\w+,\(int[^/]+preG_sPLiT\([^\{]+\{[^\-]+Content\-Type[^\}]+\}echo\s*TriM\(\$\w+\);(?:die|exit)\(\)[\};]+(?:\Z|\?>)(?<X1312230>)|\((?:(?:0|NULLFALSE)\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\{]{1,50}\{\s*(?:\$\w{1,20}=ABSPATH\.['"]wp\-[^'"]{2,40}\.php['"];\s*){3,9}echo\h*['"][^'"]{1,20}E?Xploit[^'"]{1,20}['"];[^\.]{2,40}\.php_uname\(\)\.(?<X2202580>)|(?:0|NULL|FALSE)\);[^'"]{0,40}\bdefine\([^,]+,['"][^'"]{1,10}\b(?:cyb|hack)er\h*team['"]\);[^@%`]{999,3500}<title>\h*40[43]\h*(?:Not\h*Found|Forbidden|UnAuthorized)\b(?<X2203480>)|(?:0|NULL|FALSE)\);[^://]{1,60}\bunlink\(__FILE__\);[^://]{9,99}\bexplode\([^:]+,['"]https?://[^\\@#]{99,1200}\bdefine\([^,]+,(\w{1,4}Wordpress)\(\)\);\bfunction\h+\4\(\)\s*\{[^@#\*\\]{300,1500}\bbase64_encode\(['"]<filesMatch\b(?<X2213530>)|(?:0|NULL|FALSE)\);[^\$\?]{99,300}\bdocument\.write\([^'"]{0,20}['"]anonymousfox\.\w{2,6}['"]\)(?<X2202130>)|(?:0|NULL|FALSE)\);\s*(?:(?:\$(?:MEMEK|JEMBUT|LONTE)_CY(?:BER|NA)=['"][^'"]+['"];\s*){4}(?<X2203880>)|\$(?:bot){3,}=\d+;\$\w{1,20}=(base64_decode)\([^\?#\*]{600,2500}\b\8\([^;]{1,60};(?:\$\w{1,20}=\$\w{1,20}\.[^;]{1,60};|fwrite\([^\}]{9,99}\}\s*fclose\([^;]{1,20}\);\}+)\s*\?>(?<X1203250>)|if\([^\)]+\)[\{\s]+[^\?\.\\]{200,600}\bfile_[pg][ue]t_contents\([^;]+\);\s*chmod\([^\)]+\);\s*(\$\w{1,20})=['"][^>]{1,20}(>/dev/null)\h*\d+\11&['"];\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\10\);[^\}]{0,20}[\}\s]+(?:\?>|\Z)(?<X2204650>))|(?:0|NULL|False)\);function\s+(\w+\(\))\{(\$\w+)=['"][^;]+;(\$\w+)=(?:\14\[\d+\]\.){4}[^;]+;return\s*\15;\}eval\(\13\.['"][^;]{999}(?<X2207451>)|0\);(\$\w+)=(?:[^;]{999,};[^@#:%&]{9999,}\$(\w+)\.=[^;=\)]{0,49}\17=[^;=\)]{0,49}\17\b[^@:%&]{999,4999}\b(file_put_contents\()(\$\w+),\$\18\b[^@#>]{1,999}\b\19\20,["']([^'"]+)['"]\);unlink\(\20\);\}+(?:(?:echo|die|exit)\b[^;]{0,19}['"]\21['"][^;]{0,19};)?(?:\?>)?\Z(?<X2224361>)|isset\(\$_SERVER[^\}]+\}{2}echo\s*eval\(['"]\?>['"]\.\w+\(\17\.['"][^'"]+\.txt['"]\){2};\Z(?<X2306080>))|0\);[^/]+\$\w+=['"]/[^'"]+['"];\$\w+=base64_decode\(['"][^'"]{999,}['"]\);\$\w+=file_get_contents[^;]+;if\(md5\(\$\w+[^;]+;file_put_contents[^;]+;touch\(\$\w+[^;]+;chmod\(\$\w+[^\{]+\{\$\w+=['"][^'"]{999,}['"];chmod\([^;]+;file_put_contents[^\n]{50,999}filectime\(\$\w+\)\);\}(?<X1313470>)|0\);[^\?\}]{1,4999}\b(file_)pu(t_contents\()[^,;]+\.htaccess['"],[^\?>]{999,};(\$\w+)=\25ge\26(\$\w+)\);(\$\w+)=fopen\((\$\w+)\b[^,]+,[^;]+;fwrite\(\29,\27\);[^/\?]{1,49}\b[pes](?:assthru|ystem|xec|hell_exec)\(['"][^\)]+\30\b[^;]+;unlink\(['"]?\28['"]?\);(?:\?>)?\Z(?<X2222372>)|0\);[^\?]{0,199}\becho\s*['"]<form\b[^\?]{1,499}\bmove_uploaded_file\(.{1,99}\Z(?<X2213931>)|0\);\$\w+=disk_free_space\(\);if\(!(function)_exists\(['"](\w+)['"]\)+\{\33\s*\34\([^@#>]{1,4999}\bsetcookie\(['"](whatsup)['"],['"]\35man['"],[^;]+;\w+[\s:]+define\(['"]DISALLOW_FILE_MODS['"],[^\)]+\);(?:\?>)?\Z(?<X2220540>)|0\);\s*(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2,}function\h+(\w)\([^\)]+\)[\{\s]+(\$\w{1,20})=['"][^\}\{]{9,60}\38\.=[^;]{1,20};\s*return\h*\38;[\}\s;]+(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2}eval\(\37\(base64_decode\([^\)]{9999,}\),["'][a-z,]+['"]\)\);(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2,}(?:\?>|\Z)(?<X2203791>)|0\);function\s*(\w+\()\$\w+\)\{\$\w+=curl_init\([^@\^]{999,}\$(\w+)=[^;\)]{0,99}\b\40[^@\^]{999,}(file_put_contents\()[^,;]+,\$\41\)[^@\^]{999,}\$(\w+)\.?=['"][^'"<]*<FilesMatch\s*['"]\^\(['"\.]+\$\w+['"\.]+\)\$[^\?]+\b\42(\$\w+),\$\43\);(?:(?:touch|chmod)\(\44,[^;]+;){0,2}\}+\?>\Z(?<X2224340>)|0\)[^\\]{1,999};define\(['"]IS_WIN['"],[^\?]{1,499}=['"][^<>'";]{0,9}<(FilesMatch)\s+\\['"]\^\([^\)]+\)\$\\['"]\s*>(?:\\n|\s){0,9}Order\s+allow,\s*deny(?:\\n|\s){0,9}Allow\s+from\s+(?:all|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?:\\n|\s){0,9}</\46>[^@]{1,4999}\bunlink\(\$\w+\);(?:exit\b[^;]+;\}+){2};?\Z(?<X2216502>)|0\)[^\{\?]{0,499}\bif\(isset\(\$_[GPCSR]\w{2,6}\[[^\{;]+\{(\$\w+)=[^;]{0,199}\$_[GPCSR]\w{2,6}\[[^;]+;for\([^\}]{0,199}\bfile_put_contents\(['"]([^'"]+)['"],[^;]{0,199}\48\);(?:includ|requir)e(?:_once)?[\s\(]*['"]\49['"][\s\)]*;unlink\(['"]\49['"]\);exit;\}+(?:\$\w+\(\);)?(?:\?>)?\Z(?<X2223970>)|[^\-]{9,150}\bheader\(["']content\-type:[^\)]+\);\s*\$\w{1,20}=['"][a-z0-9]{32,64}['"];\s*class\h*\w{1,20}[\{\s]+[^\{]{1,20}\{\s*(\$\w+)=array\([^;]{1,40};\s*eval\(\51[^\{]{9,40}\bfunction\h*(\w+\(\))[\{\s]+\$\w{1,20}=['"][a-z0-9]{9999,}['"];[^\?]{9,150}\52;\s*(?:\?>|\Z)(?<X2233962>)|[^\[]{0,90}(\$\w{1,20})=['"]{2};\s*if\(isset\([^!@]{300,2500}\bfunction\h*\bcutterimg\([^\{]{9,99}\{\s*\54=['"][^'"]{999,}["'];\s*if\((\$\w+)=[^\{]{2,20}\{(\$\w+)=["']\};['"]\.gzinflate\(base64_decode\([^;]{400,2000};\s*create_function\(['"]{2},\56\);\s*\}[^\?>]{99,200}\bjson_encode\(array\([^\)]+\55\)\);[\}\s]+(?:\?>|\Z)(?<X2227351>)))|eval\(gzuncompress\(str_rot13\(hex2bin\(['"][^'"]{999,}['"]\){4};(?:\?>|\Z)(?<X1319701>)|exec\(['"]\w+[^\.]{1,999}\.php['"]\)[^\.]{1,999}\.\$\w+\[\$\w+\][^\}]+\}{5}sleep\(\d+[^\]]{1,999}base64_decode\(['"][^'"]{99,}[^\?]+\.['"]index\.php['"],\d+\+\d+[^?]+dev/null[\s&'",]+\$\w+\);\?>\Z(?<X2320510>))
\A<\?php(?:\s*(\$\w{1,15})\h*=\h*(?:['"][^'"]{32,99}['"];\s*(\$\w{1,15})\h*=\h*(?:\1\[\d+\]\.){9}[^;]+;\s*@?\2\(\1\[\d+\]\.\1\[[^\(]{0,199}\(['"]\.\1\[\d+\]\.\1\[[^\(]{0,199}\(['"][^'"]{599,2500}['"\)]+;['"],['"]\.['"]\);\s*(?:\?|\Z)(?<X1184780>)|array\((?:['"][^'"]{9,99}['"],\h*){15}(?:[^\)]{999,30000}\);\h*(\$\w{1,15})\h*=\h*(array|strrev)\(['",\s\.base64_dco]{9,70}\);\h*(\$\w{1,15})\h*=\h*\5\(['",\s\.gzinflate]{11,40}\);\h*eval\h*\(\h*\6\h*\(\h*\4\h*\(\h*implode\h*\(\h*["']{2},\h*\1\)+;\h*\?>(?<X1141241>)|[^\)]{999,8000}\);\s*\$\w{1,15}\h*=\h*(array)\(['",\sbase64_dco]{9,70}\);\s*\$\w{1,15}\h*=\h*\8\(['",\sgzuncompres]{9,70}\)[^\?]{9,199}eval\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}\h*\(\h*['"]{2},\h*\1[\s\)]+;\s*\?>(?<X1139260>)))|\s*(\$\w{1,40})(?:(=str_rot13\()[^;]{1,49};\$\w{1,40}=['"]\w{32}['"];(\$\w{1,40})\11strrev\(['"]\w{13}['"]\)\)(;eval\(\10\(\12\()[^;]{99,299}\13['"][^'"\);]{40000,50000}['"]\)+;(?:\?>|\Z)(?<X1134040>)|=(?:str_rot13\((?:base64_decode|gzinflate|convert_uudecode|gzuncompress)\(){2}['"][^'"]{1,40}['"]\)+;function\s*\w{1,40}\([^\?\n]{99,4999};\10\(['"](?<X2133071>)|=(curl_)init\(['"]https?://[^;]{1,99};(?:\16\w{1,19}\(\10,[^;]{1,99};){1,9}(\$\w{1,40})=curl_exec\(\10\);(?:eval|assert)\(['"]\?>['"]\h*\.\h*\17\);?(?:\?>)?\Z(?<X2164090>)|=['"][^;]{1,99};(\$\w+)=(fopen\()[^,;]{0,99}\10\b[^\?]{1,299};while\([^\)]+\bfread\(\19\b[^\?]{1,499}\bextract\((\w+)\(\$\w+\)+;function\h+\21\([^\}]{1,499}(\$\w{1,40})=\20(\$\w+),[^;]{1,99};fwrite\(\22,[^\?]{1,99}\b(?:inc|req)\w+\s*\23;unlink\(\23\);return\b[^;]{1,19};\}\s*(?:\?>|\Z)(?<X1187410>)|=['"]https?://(?:[^'"]{9,99}['"];eval\([^\)]{0,9}file_get_contents\(['"]?\10['"]?\)\);\s*(?:\?>|\Z)(?<X1130680>)|[^;]{1,199};(\$\w{1,40})=['"][^'"]+\.php['"];function\s*(\w{1,40})\(\$\w+,(\$\w+)\)\{[^\}]{0,199}\$(\w{1,40})=file_get_contents\(\28\);[^\?]{0,499}\bfwrite\([^,;]{1,99},\$\29\);[^@]{1,499};\}+\27\(\26,\10\);\s*(?:\?>|\Z)(?<X1187420>))|=['"]strrev['"];(\$\w{1,40})=array\([^\)]+\);(?:(\$\w{1,40})=\10\(['"]\w{1,40}['"]\);)+eval\([^;]{0,39}\32\([^;]{0,39}\31\)+;(?:\s*\?>)?\s*\Z(?<X2133671>)|=[^;]{1,99}\.png['"];(\$\w{1,40})=['"][^'"]{4999,}['"];if\(!file_exists\(\10\)\)\{file_put_contents\(\10,(?:(?:base64_decode|gz[di][en]flate|rawurldecode|str_rot13)\(){2,}\34\)+;\}(?:includ|requir)e(?:_once)?\(?\10\)?;(?:\?>)?\Z(?<X2166590>)|=[^\?]{99,2999}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{1,40};chdir\(\w{1,40}\(\36\)\);include\(\36[^\{]{1,40}\{(?:echo|printf?)\10[^\?]{1,40}\?>\Z(?<X2126772>)|=\$_[GPCSR]\w{2,6}\[(?:[^#]{99,999}(?:\$(msg|message)\.=['"]\W{0,5}(?:ID|email|pass(?:word)?|user(?:name)?|pin|cvv)\b[^;]+(?:\$_[GPCSR]\w{2,6}\[|\10)[^;]+;){2}[^#]{999,1999}(\$headers)\.?=\$_POST\[['"]eMailAdd['"]\][^;]{1,49};if\(mail\([^\)]+\$\38,\39\)\)\{mail\([^\)]+\$\38,\39\);(?<X2137820>)|[^;]{1,49};(?:\10=[^;]{1,49};){1,2}if\(class(_exists\()['"]Reflection(Function)['"]\)\)\{[^\}]{1,199}\}(?:elseif\(\42\41['"](\w{1,40})['"]\)\)\{\43\(['"]([peas](?:assthru|ystem|xec|hell_exec|open|val|ssert))['"][^;]{1,49};\}){1,2}else\{\44\(\10\);\}(?:\?>)?\Z(?<X2137950>))|=file_get_contents\([^;]{1,99};\10=(?:\w{1,40}\(){1,3}\10\)+;(?:eval|assert)\(\10\);(?:\?>)?\Z(?<X2174740>)|=fopen\(['"]https?://[\d\.]+/[^;]{1,199};(\$\w{1,40})=['"]{2};while\(false!=\((\$\w{1,40})=fread\(\10,[^\{]{1,99}\{\47\.=\48;\}(?:echo|print)\(eval\(\48=\47\)\);fclose\(\10\);\s*(?:\?>|\Z)(?<X1174070>)|=strrev\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:assert|eval|system|passthru|shell_exec|exec|popen)\(\10\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\);(?:\?>|\Z)(?<X1131491>)|\s*=\s*(?:passthru|system|(?:shell_)?exec)[^\$]{1,10}(\$_[GPCSR]\w{2,7}\[[^\]]{1,40}\])[^\?]{40,150}\10\(\51\)[^\?]{1,20}(?:\?>|\Z)(?<X2126632>))|\s*(\$\w{1,9})\s*=\s*['"][^'"]{32}['"];\s*if\s*\(\s*md5\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\D{2,3}\s*\53\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\);\s*\}\s*\?>(?<X1135670>)|\s*(\$\w{25,90})\h*=\h*\d{1,3};\s*(\$\w{25,90})\h*=\h*['"][^\n]{99,1999}['"];\s*(\$\w{25,90})\h*=\h*\56;\s*\$\w{25,90}\h*=\h*strlen\(\57\);[^\?]{9,299}\+\)\s*(\$\w{25,90})\h*\.=\h*chr\(ord\(\57\[\$\w{25,40}\]\)\h*\^\h*\55\);\s*eval\(['"]\?>['"]\h*\.\h*\58\.['"]{2}\);\s*\?>\Z(?<X2180771>)|\s*(\$\{['"]GLOBALS['"]\}\[)['"](?:[^'"]{1,40}['"]\]=[^@]{35000,45000}(?:(?:symlink|copy)\([^\)]{1,99}\60[^\)]{1,99}\);){9}(?<X2130850>)|\w{1,40}['"]\]=['"](roin)['"];\60[^<]{999,2999}<(title>)\62[\s\W]{1,9}exploit</\63(?<X2130640>))|\s*(\w{1,40}\(\));function\s*\65\{if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\{(?:\$\w{1,40}=\$_[GPCSR]\w{2,6}\[[^\]]+\];){2,4}[^\}]{99,199}\}else\{(\$\w{1,40})=(file_)ge(t_contents)\([^;]+;\}\67pu\68\([^\)]+,\66\);[^\}]{1,49}(?:die|exit)[^;]{0,19};\}\}(?:\?>)?(?:<!--[\w\s]{1,99}-->)?\Z(?<X2136900>)|\s*(echo)\h*['"](?:[^'"]{1,50}IndoXploit[\w<>'"]{0,25};\s*\70\h*['"]<b>['"]\.php_uname\(\)\.['"]</b>[^\?]{99,700}\{\s*if\(@?(?:copy|move_uploaded_file)\h*\([^{]{1,99}\{\s*(?:echo[^;]{1,99};\s*)?\}\s*else\h*\{\s*(?:echo[^;]{1,99};\s*)?[\}\s]+(?:\Z|\?>)(?<X1141210>)|\h*Auto\h+Exploit[^<]{9,40}<br>[\'"]\.php_uname\(\)\.[\'"]<br>['"];\s*\70\h*['"]<form[^\{]{9,150}if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\h*\{\s*if\h*\(\h*@?array[^\}]{9,99}\}\s*else\s*\{[^\}]{0,35}\}\s*\}\s*\?>(?<X1142511>))|\s*(function)\s*(\w{1,40}\()(\$\w{1,40})\)\{[^\?]{1,499}\{\$\w{1,40}=(file_)ge(t_contents\()\75\);[^\?]{1,499}\b\73\h+(\w{1,40}\()\75[^\{;]{1,99}\{\$\w{1,40}=\76pu\77[^;]{1,99},\75\);[^\?]{1,499}\$(\w{1,40})=\74\$_[GPCSR]\w{2,6}\[[^;]{1,99};\78\$\79,[^;]{1,99};[\s\}]+(?:\?>)?\Z(?<X2173251>)|\s*(goto)\s*\w{1,9};\s*\w{1,9}:\s*header\(['"]\\[\w\d][^\?]{99,799}\$\w{1,9}\h*=\h*file_get_contents\((base64_)decode\(['"]\\[\w\d][^\?]{99,700}\$\w{1,9}\h*=\h*\82encode\(\$_SERVER\[['"][^'"]{9,99}['"]\]\);\s*\81\h*\w{1,9};\s*\w{1,9}:\s*\w{1,9}:\s*(?:\Z|\?>)(?<X1138850>)|\s*@?(?:(unlink)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[^\{]{9,150}(?:(\$\w{1,9})\h*=\h*['"]\w{1,15}\.(?:txt|php)['"];[^\{]{0,50}){3}(\$\w{1,9})\h*=\h*(file_)get(_contents)\(\85\);[^\{]{0,50}@?\84\(\85\);[^\?]{99,400}\87put\88\(\$\w{1,15},\h*\86\)[^\?]{9,150}usleep\(\d{1,7}\);[^\;]{0,50}\};\s*(?:\Z|\?>)(?<X1141112>)|[ero_p]{11}ting\([^%]{3,200}header\(['"]content-type:\s*text/html[^\)]{1,25}\);(\$\w{1,40})=[^\{]{20,200}\{(\$\w{1,40})=['"]\w{60000,}['"];\91=str_rot13\(\91\);(\w{1,40})\(\91\);\}function \92\((\$\w{1,40})\)\{global\90\;(\$\w{1,40})=['"]{2};eval\(\94\.pack\([^,]+,\93\)\.\94\);\}(?<X2127500>)|[eropting_]{15}\((?:0|NULL)\);\$\w{1,40}=[^;]{9,99};\$\w{1,40}=(?:array\(|\[)[\d,]+(?:\)|\]);(\$\w{1,40})=['"][^'"]{9999,65000}['"];[^\}]{1,99}\}assert\(['"]eval\s*\((?:(?:base64_decode|gz[id][ne]flate)\(){3,6}\96\),\d+\){3}["']\);(?:\Z|\?>)(?<X2129281>)|error_reporting\(0\)[^'"]{9,99}(\$\w{1,15})=['"]/[^'"]{9,299}['"];(\$\w{1,15})=['"]/[^'"]{9,299}['"];[^\?]{99,600}\{@?(chmod)\(\99,\d{3,4}\);@?copy\(\98,\99\);@?\100\(\99,\d{3,4}\);\}if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\?]{9,159}\.txt['"],\s*time\(\)\);\}while\(true\);\}\s*(?:\Z|\?>)(?<X1138880>)|system\(['"]cat\s*/etc/passwd\h*>\h*(\w{1,15}\.txt)['"]\);\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]\102['"]\)(?<X2140500>))|\s*@session_start\(\);@error_reporting\(0\);[^\%]{1,1500}file_put_contents\(\$_POST\['\w'\],\$_POST\['\w'\]\);\s*\}[^\^]{1,9999}echo\s*['"]</body></html>['"];\Z(?<X220336683>)|\s*[^\$\(]{0,99}(?:\$\w{1,15}\h*=\h*(base64_decode)\s*\([^\;]{9,199}\);\s*){4}[^\{\?]{99,1500}\bif\h*\((\$\w{1,15})\h*\D{2,3}\h*\105\h*\([^\{]{0,99}\{\s*if\h*\(\h*\$\w{1,15}\h*\(\h*\105[^\}]{9,500}\}\s*\}\s*else\s*\{\s*echo\h*\106;\s*\}\s*\?>(?<X1175662>)|\s*[^\$]{9,99}(\$\w{1,9})=['"][^'"]+['"];\s*(\$\w{1,9})=(str(_replace))\(['"](\w{1,5})['"],['"]{2},['"](?:[base64_dco]|\112){9,50}['"]\);\s*(\$\w{1,9})=\110\(['"](\w{1,5})['"],['"]{2},['"](?:[gzinflate]|\114){9,50}['"]\);\s*preg\111\([^\(]{5,50}\(\113\(\109\(\108\)+['"],[^\)]{1,9}\);\s*(?:\?>|\Z)(?<X1134461>)|\s*[^\$]{99,199}\bfunction\s*(\w{1,40})\((\$\w{1,40})\)\{(\$\w{1,40})=(dirname\()\117\);(\$\w{1,40})=min\([^;]+;foreach\(scandir\(\119\118[^\?>]{99,199}return\s*touch\(\117,\120,\120\);\}\$\w{1,40}=[^;]+;(\$\w{1,40})=[^;]+\$_[GPCSR]\w{2,6}\[[^;]+;if\(\116\(\121\)\)\{[^\$\?]{1,99}\b(?:die|exit)[^;]{1,19};+\?>(?<X1137670>))
\A<\?(?:[ph\s]+(?:function(?:\h*(?:(\w+)\([^\{]{1,9}\{\$\w+=['"][^"]{25,60}['"];[^#@]{9,150}(?:\$\w+\s*\[\]=\1\(Array\([^;]{4,150}\);\s*){5}[^#@%\*&]{200,999}\}function\h*(\w{1,20})\([^\!#@]{9,999}\2\([^\(]{1,20}\([^;\)]{1,40}\[\d+\]\([^\)]+[\)\s]++;\s*\}(?:\s*\?>)?\Z(?<X2250680>)|(\w{1,20})\([^\)]+\)[\{\s]+(\$\w{1,20})=md5\([^:<]{1,60}(\$\w{1,20})=urldecode\(\6\);[^\/\\:]{200,800}\}\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(preg_match\(['"][^\.]{1,9}(?:Apple|blackberry|samsung|Android|google|ios)\([^,]+,\7[^\{]{2,9}[\{\s]+(?:\5=[^;]+;\s*){3,9}eval\(\4\(\6,\5\)\);[\}\s]+else[\{\s]+[^\}]{1,50}\}(?:\s*\?>)?\Z(?<X2208140>)|(\w{1,20}\(\))[\{\s]+(\$\w{1,20})=\$_[GPRSC]\w{2,6};\s*\(\10[^\?]{1,20}\?\(\((\$\w{1,20})=(?:\10\[\d+\]\.?)+\)&&\([^\}]{1,99}\((\$\w{1,20})=\12\(\11\(\10\[\d+\]\)\)\)&&eval\(\12\)\)[\h:]+\10;\s*return[^;]+;[\}\s]+\9;(?:\s*\?>)?\Z(?<X2218850>))|\s*(\w+)(?:[^\!]+\!\w+[\(\)]+\{header\(['"]Location:\s*['"]\.\$\w+,true[^\}]+\}(?:exit|die)[^\{]+\{if\(isset\(\$_SERVER\[['"]HTTP_CF_CONNECTING_IP[^:]+\$\w+=sprintf\(['"]https?://[^/]+\.com[^,]+,urlencode\(\$\w+[^;]+;\$\w+=curl_init[^\?]+\14\(\$\w+,false\);(?:\?>|\Z)(?<X1311182>)|\(\)\{(\$\w+)=WP_CONTENT_DIR\.['"]/mu\-plugins['"][^\{]+\{if\(mkdir\(\16,\d{3,4},true[^/]{1,299}bin2hex\(random_bytes[^\n]{50,599}file_put_contents\(\$\w+,\$\w+\)\)[^\n]{1,999}unlink\(['"]\$\w+/\$\w+['"]\);\}return\s*rmdir\(\$\w+\);\}register_activation_hook\(__FILE__,['"]\14['"]\);\Z(?<X1319460>))|\s*(?:(\w+\()\$\w+\)\{(\$\w+)=curl_init\(\)[^\}]{1,499}(\$\w+)=curl_exec\(\19\);(?:curl_close\(\19\);)?return\s*\20;?\}(?:(\$\w+)=['"]\?>['"];)?eval\(['"]?(?:\?>|\21)['"]?\.\18['"]https?://[^\)]+\)+;?\s*(?:\?>\s*)?\z(?<X2223640>)|(\w{1,40})\((\$\w{1,40})[,\)][^\{]{1,199}\{(\$\w{1,40})=curl_init\(\24\);[^\}]{1,499}(\$\w{1,40})=curl_exec\(\25\);[^\}]{0,99}\breturn\s*\26;\}[^\?]{0,99}(\$\w{1,40})=\23\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};echo\s*\27;\s*(?:\?>\s*)?\Z(?<X2191770>)|\w+\((\$\w+)\)[^\(]{1,99}[\(\s]+ini_get['"\s\(]+allow_url_fopen[^;]+file_get_contents\(\29[\);\}\s]+else[^\}]+[\}\s]+eval\s*\(\s*['"]\?>[\s'"]+\.\s*\w+[\('"\s]+https?://[^'"]+\.txt['"\);\s]+(?:\?>|\Z)(?<X2288081>)|\w+\(\)\{\$\w+=\$_\w+\[['"]REMOTE_ADDR['"]\];\$\w+=['"]https?://ip\-api\.[^;]+;\$\w+=(curl_init)\(\);[^\|]{1,999}\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);return\(strpos[^\{]+\{\$\w+=\31[^\}]+echo\$\w+;\}else\{(?:include|require)\s*(?:_once)?\s*['"]\w+\.php['"];\}\?>\Z(?<X1321961>)|curl_get_contents\([^\?]{1,299}getServerCont[^%]+(indata)\.php[^%]+jump\.php[^%]+\33\d[^;]+;echo\s*\$\w+;\$\w+[='"\s]+\w+['"\s]+;(?:die|exit);\}(?:\?>|\Z)(?<X1290160>))|\s+(?:(\w+)\(\$\w+,\$\w+\)\{[^\?]{1,499}\}return\s*\$\w+;\}(\$\w+)=['"][^'"]{19999,}['"];(\$\w+)=['"]\w+['"];(\$\w+)=\35\(base64_decode\(\36\),\37\);eval\(\38\);(?<X2204311>)|\w+(\(\$\w+\))\{(\$\w+)=base64_decode\40;(\$\w+)=openssl_decrypt\(['"]?\41['"]?,['"]AES\-[^;]+;return\s*\42;\}(?:\?>)?\Z(?<X2221341>)|wp[_\-](clearline+)_start\(\)\{(?:[^\?]{1,999}\binclude(\([^\)]+/wp\-\44/)[^'"]+\.p(?:hp|ot)['"]\);(?:(?:die|exit)\b[^;]{0,19}|unlink\45[^'"]+\.p(?:hp|ot)['"]);){3}[^@]{1,1999}</script>\s*(?:<\?[ph\s]+|['"];)\}(?:add_action\(['"][^'"]+['"],['"](?:wp|save)[_\-]\44_\w+['"]\);){3}(?:\?>)?\Z(?<X2220880>)))|goto\s*\w+;\w+:(?:[^/]+\$\w+=fopen\(['"]robots\.txt[^=]+\$\w+=['"]https?://['"];goto[^\-]+header\(['"][^:]+:\s*text/plain['"]\);goto[^=]+(\$\w+)=urlencode\(\$_SERVER[^:]+:\s*if\(strpos\(\47,['"]favicon\.ico[^/]+HTTP/\d+\.\d[^@]{50,3000}(\$\w+)=str_replace\(,['"]\-['"],\48\);[^\?]+(?:\?>|\Z)(?<X1312930>)|\s*error_reporting\(0\);[^\-]+header\(['"]Content\-type:text/xml['"]\);goto[^!]+if\(!empty\(\$_SERVER[^\.]+if\(strpos\((\$\w+),['"]favicon\.ico[^\.]+\$\w+=base64_encode[^@]{50,1500}fopen\(['"]robots\.txt[^\174]+\50=urlencode[^\?]+\w+:(?:\?>|\Z)(?<X1312750>))|header\(['"]location:\s+https?://megacarepharm\.com/auth/['"][)\s]+;\s*\?>\Z(?<X1305380>)|if\(!(?:\s+defined\(['"]ABSPATH['"][^\.]{1,999}(\$redirect_file)=\$plugin_dir\.[^;]+;if\(file_exists\(\53[\)\{]+include\53;exit;[^\+]+setcookie\(['"]_redirect_[^\n]{1,2999}if\(isset\(\$\w+\[['"](deactivate)['"\]\)\{]+unset\(\$\w+\[['"]\54['"\];\}\)]+return\$\w+;[\}\);]+register_activ\w+\(__FILE__,['"]activation['"]\);\Z(?<X1323610>)|defined\(['"](DOLLY_WAY)['"]\)+\{define\(['"]\56['"],['"][^'"]{0,19}\bDomination\b[^@]+\bif\((?:md5\()+\$_SERVER\[['"][^\{;]+\{if\(hello_check_sig\([^\)]+\)+\{echo\s*\$\w+;\}+(?:die|exit)\b[^;]{0,19};\}+\Z(?<X2218820>)|empty\((\$_SERVER\[['"]HTTP_USER_AGENT['"])\]\)\)\{\$\w+=\58[\];\}]{3,16}[^/]{1,512}/[^!]{8,128}strpos\(\$\w+,['"]google[^\{]{8,128}\{if\(\$_SERVER\[['"]REQUEST_URI['"]\]={1,4}['"]/['"]\)\{include(?:_once)?\s*['"]\w+\.php['"];(?:exit|die)\(\);\}\}(?:\?>|\Z)(?<X1316790>))|if\((?:\w+\()+\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+==+['"][^'"]+['"]\)\{[^\}]{0,499}\b[cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,]+,\60[^;]+;\W*echo\s*['"]\s*<form\b[^;]+;(?:die|exit)\b[^;]{0,19};\}else\{header\(['"]HTTP/[\d\.]+\s*40[34]\b[^\}]{1,499}\b(?:die|exit)\b[^;]{0,19};\}\s*(?:\?>\s*)?\Z(?<X2211130>)|if\([^\{;]+\{add_action\([^,]+,['"](\w+)['"]\);\}function\h+\62\([^\}]{1,499}\$(\w+)=['"][^'"]+\.php\d*['"];(\$\w+)=(?:\w+\()+['"][^'"]{999,}['"]\)+;\$\w+=[^;]{0,99}\bwp\-(?:admin|includes)\b[^;]{0,99};[^\}]{1,199}\bfile_put_contents\([^,]+\$\63,\64\);[^\?:%]{1,499}\bdie\([^;]+\$\63\W+\Z(?<X2194980>)|if\(isset\((?:(\$_GET)\[['"](\w{1})['"]\]\)[&\s]+\66\[['"]\67['"]\][\s=]+\d{4}\)\s*\{\s*\?>\s*<for[^/]+/form\-data['"]>[^>]+name=['"](\w{1})['"]>[^\}]+<\?[ph\s]+\}\s*if\s*\(isset\(\$_FILES\[['"]\68['"\]\[]+tmp_name['"\]\)\s]+move_uploaded_file[^,]+,\s*basename[^\)]+\]\)\);\Z(?<X2294601>)|\$_GET[^{]+{\becho['"]<\bfont\h+color\=[#\d]{1,7}>mrBOTORUPLOADS[^>]{1,32}>\[(uname)\](['"])\.php_uname\(\)\.\71\[\/\70\]\71;echo\71[^.]{1,128}\.getcwd\(\)\.\71\[\/dir\]\71;[^@]{1,512}\bif\(@array\((\$_FILES)(\[\71\w+\71\])\[\71\w+\71\]\,\72\73[^.]{1,256}\.\72\73[^?]{1,32}\?>(?<X1299080>))|ini_set\(['"]display_errors['"],(?:0\);error_reporting\(0\);(\$\w+)=['"]chr['"];(\$\w+)=(?:(?:\75\(\d+[\-\+\*/]\d+\)\.)+\75\(\d+[\-\+\*/]\d+\);(\$\w+)=)+\76\([^;]{9999,};(\$\w+)=\$\w+\(['"]{2},\77\);\78\(\);\Z(?<X2212732>)|\h+0\);error_reporting\(E_[^;]{1,99};header\(['"]Cache\-\w+:[^\.]{1,299}\$\w+\h+=\h+['"]\w+\.txt['"];[^>]{1,699}\$_SERVER\[['"]HTTP_USER_AGENT[^:]+,['"]hash\h+mismatch[^\?]+header\(['"]Location:\h+https?://[^'"]{1,299}forms\.html['"],\h+true,\h+301\);\}\?>(?<X1323570>))|new\h*(Pwn)\(['"]find[^\)]+\);[^_]{0,40}\bclass\h*\81[\s\{]+const\h*Logging=(?<X2213680>)|parse_str\(['"](?:[\d=%a-f&]{99,200}['"],(\$\w{1,20})\);\s*eval\((?:\83\h*\[\h*\d+\h*\]\(){3,}['"]=[^\)\.\$\s]{15000,}['"]\)\)\.['"]//['"]\)\);\s*(?:\?>\s*)?\Z(?<X2201520>)|[^'"]+['"],(\$\w+)\);eval\((?:\85\[\d+\]\(){2,}['"][^'"]{999,}['"]\)+(?:\.['"]\W{1,9}['"]\)+)?;(?:\?>)?\Z(?<X2194951>))|session_start\(\);function\s+(\w+)[^\{]{1,199}\{if\((function_exists)\(['"]curl_exec[^&]+&&\88\(['"]stream_get_contents['"]\)\)\{[^:]{1,799}\87\(['"]https://paste\.ee[^;]{1,199};eval\(['"]\?>['"]\.\$\w+\);\}(?:\?>|\Z)(?<X1322381>)|system\(['"]pwd['"]\)(?:\?>)?\Z(?<X2057921>)|unlink\((?:[^;]+;if\(!file_exists\([^{]+\{(die)\(['"]!success!['"]\);\}\91\(['"]!\w+!['"]\);\Z(?<X2293630>)|__FILE__\);[^'"]{0,40}\bif\h*\(!?function_exists\(['"]file_put_contents['"]\)[\s\)\{]+[^#%]{99,900}(?:\$\w{1,20}[\h=]+['"]/\*\h*@?locale\-joomla\h*\*/["'];\s*|\$\w{1,20}[\h=]+['"]/\*\s*@?class\h*Joomla\h*Locale\h*\*/['"];\s*){1,2}\$\w{1,20}[\h=]+base64_decode\((?<X2203641>)))|[ph]*\s*\$\w+[='"]+/\w*/[^;]+;[^\n]+rawurldecode\(['"](?:<\?php)?\s*\$_HEADERS=getallheaders\([^\n]+(?:file_put_contents\([^\}]+[\}]+(?:['"]\);)?(?:die|exit)\(['"]!(?:ended|failed)!['"]\);\Z(?<X2292870>)|touch\([^\}]+[\}]+(?:die|exit)\(['"]!(?:ended|failed)!['"]\);\Z(?<X2292861>)))
\A<\?(?:[ph]+(?:[/\s\*]+PHP[^/]+/\s*class\s*\w+\{public\$\w+=['"]+;\w+__destruct\(\)\{eval\(['"]\{\$this\->(\w+)\}['"]\);\}{2}\$\w+=new\s*\w+\(\);\$\w+=\$_POST\[['"]\w+['"]\];\$\w+\->\1=\$\w+;echo\s*['"]\w+['"];\Z(?<X2306450>)|\s*(\$\w+)[\s=]+['"]https?://j\d{6}_\d{2}\.monkeyes\.[^\}]{1,99}function\s*(\w+)\([^\n]{1,1800}\4\(['"]\\[^\}]+preg_match\(['"]\\[^\n]{1,1500}\4\(['"]\\[^\n]{1,1999}(\$\w+)\s*=\s*\3\s*\.\s*['"]\\[^\n]+\5[\,\s]+\$\w+\)\);\s*\w+:\?>(?<X1302440>)|\s*(function)\s*\w+\(\)[\s\{]+wp_enqueue_script[\('"]+[\-\w]+['"][^;]+[\-\w]+\.min\.js[\s'",]+array\([^\|]+\7\s*\w+[\(\)\{\s]+\$\w+[=\s]+rand\(\d+[\s,]+\d+\);\s*(\$\w+)[=\s]+\w+\(\d+[,\s]+\d+\);\s*(\$\w+)[\s=]+0;\s*[^<]+<\s*\8;[^\}]+\9[\+\s=]+\([^;]+\*\s*3\);\s*\}\s*//\s+[^a-z\s0-9]{8,32}\s+[^a-z\s0-9]{8,32}\s+\9[^;]+\8[\s<]{4,}1\);[\s\w]+\9[;\s\}]+\Z(?<X2303003>)|\s*\$\w+[\s='"]+/\w+/\w+[^:]+://185\.147\.124\.223/\w+[^\}]+[\s\}]+(?:exit|die)\(['"]_upload_failed_[^\n]+\$\w+[\.=\s]+\w+\(substr[^\}]+[\s\}]+fclose\(\$\w+\);[\s\}]+return\s*false;\s*\}\Z(?<X2292833>)|\s*\$\w+[\s=]+urlencode\(\$_SERVER\[[^;]{1,199};if\(preg_match[^\{]+\{\$\w+=['"]\.{8,}['"];\$\w+=['"\.]+;[^\}]{1,299}curl_exec\(@\$\w+\);echo\s*@\$\w+;[\s\}]+(?:\?>|\Z)(?<X1302254>)|\s*function\s*\w+\(\)\h+\{\s*(\$\w+)[\s=]+['"][^'"]{512,}['"];\s*(\$\w+)[=\s]+['"][^=]+==['"];\s*(\$\w+)[=\s]+['"][^=]+==['"];\s*(\$\w+)[\s=]+\w+\(\14\);\s*\$\w+[\s=]+\w+\(\13\);\s*(\$\w+)[\s=]+\w+\(\$\w+[,\s]+\16[,\s]+\15\);\s*(\$\w+)[\s=]+['"]\(async\(\)=>\{['"]\s*\.\s*\17\s*\.\s*['"]\}\)\(\)['"];\s*\w+\([^;]+\18\);\s*\}\s*\Z(?<X2302990>))|\s*(?:\$ip\s*=\s*getenv\("REMOTE_ADDR"\);\s*\$message\s*\.=\s*"---------.{100,3000}mail\((?<X2049191>)|if\(isset\(\$_SERVER\[['"]HTTP_USER_AGENT["']\][\s\)\{]+if\(strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"\],\s]+\d{1,13}['"\)\s\!\=]+false[\)\s\{]+class\s*(\w{1,14})[^_]{1,14}__construct[\(\)\{\s]+(\$\w{1,14})\s*=[^@]{1,400}if\(is_array\(\22[\)\s\{]+list\([^\)]{1,100}[\)\s=]+\22;[^#]+var\$\w+=['"][^'"]{99,}['"];\}new\s*\21\(\);[\}\s]+\Z(?<X2304132>)))
\A<\?php(?:(?:\s*[ero_ptings]{7,15}\([^;]{2,29};){2}\s*(eval\()(base64_decode\()['"][^'"]{999,1999}['"]\)\);\s*(\$\w)=str_split\((['"])[^\)]{35000,}\4\);\s*(\$\w{1,40})\s*=['"]{2};\s*foreach\(\3\s+as\b[^\?]{49,149}\1gzinflate\(\2\5\){3};\s*(?:\?>|\Z)(?<X1130630>)|[^#]{200,650}(\$\w{1,40})\s*=\s*['"]range['"]\s*;\s*\$\w{1,40}\s*=\s*\7[\(\s]+['"]\176['"],['"][^#]{99,999}\bfunction\h*(\w+)[\s\(\)\{]+\$\w+[\h=]+array[\h\(]+[^\?]{99,1200}\b(?:exit|die)[^;]{0,9};[\s\}:]+\8[\h\(\)]+;\s*\?>\Z(?<X2306701>)|[^/\?]{2,40}<h\d*>\h*IDBTE[A4]M\b(?<X2167710>)|[^\$<]{9,60}\$(?:s|webshell)name=["']<[^;]{1,40}>milw[0o]rm['"];(?<X2199610>)|[^\$\?]{1,99}\b(?:[ir][ne][cq][lu][ui][dr]e(?:_once)\(?['"][^'";]+(?:blocker|anti(?:bot)?)[sz]?\d?\.php['"]\);){2}[^@]{999,3999}(?:\$(msg|message)\.=['"][#!]\h*(?:(?:CC|card)\h*(?:no|number)?|Expir(?:y|ed?)(?:\h*date)?|cvv)\h*:[^;]{0,99}\$_POST\[[^;]{1,99};){3}[^@]{99,4999}\bmail\([^\)]+\$\12(?<X2141030>)|[^\$]{1,49}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^\{]{99,199}(\$\w{1,40})=['"]\w{32}['"];if\(isset\((\$_FILES\[)[^\{]{9,49}\{@?(?:copy|move_uploaded_file)\(\16[^\}]{9,99}\}if\((?:md5\(){1,2}\$_[GPCSR]\w{2,6}[^\)]+\)+\D{2,3}\15[^\}]{99,199}\}else\{[^;]+;\}echo\s*['"]<form\s+action=\14[^;]+;(?:\?>)?\Z(?<X2138000>)|[^\$]{1,49}if\(\$_[GPCSR]\w{2,6}\[[^\)]+\)\{echo\s*['"][^;]{99,499};if\(!empty\((\$_FILES\[['"]\w+['"]\])\)\)\{(\$\w{1,40})=[^;]+;\19=\19\.basename\(\18[^;]+;if\(move_uploaded_file\(\18[^,\)]+,\19\)\)\{echo[^;]{9,99};\}else\{echo[^;]{9,99};\}+(?:\?>)?\Z(?<X2134791>)|[^\$]{1,99}(\$\w{1,40})=['"]{2};(if\(isset\()(\$_[GPCSR]\w{2,6}\[)[^\{]{1,49}\{\21=\23[^;]+;\}\22\23[^\{]{1,49}\{\21=file_get_contents\(\23[^\}]{9,299}\}+if\(strlen\(\21[^\)]*\)\)\{(?:assert|eval)\(\21\);((?:exit|die)[^;]{0,9};)\}(?:header\([^;]{1,49};){2,3}echo[^;]{1,499};\24(?:\?>)?\Z(?<X1134850>)|[^\$]{9,99}if\(empty\(\$_[GPCSR]\w{2,6}\)\)\{echo[^;]+;(?:exit|die)[^;]{0,9};\}else\{(\$\w{1,40})=['"][^'"]+['"];(\$\w{1,40})=strtoupper\((?:\26\[\d+\]\.){4}[^;]+;(\$\w{1,40})=(\$\{\27\}\[)[^\]]+\]\(['"]+,\29[^\]]+\]\(\29[^;]{9,49};\28\(\);\}(?:\?>)?\Z(?<X2134820>)|[^\(\)]{9,99}\berror_reporting\((?:0|NULL|FALSE)\);[^@&\*]{99,300}<option>(?:cpanel\h*reset|b374k|wp\-backdoor|c99|r57)\b(?<X2185090>)|[^\{\?]{1,99}(?:\$\{["']GLOBALS['"]\}\[['"]\w{1,40}['"]\]=[^;]{1,49};){9,}[^/]{1,99}<(title>)WHM\s*Remote\s*(?:shell|access)</\32(?<X2141291>)|\b[^\$/]{1,199};(\$\wname)=[^;]{1,40};(?:\$\w{1,40}=['"](?:getcwd|file_get_contents|scandir|unlink|rmdir)['"];){5}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPSCR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\35\[\36\]=stripslashes\(\37\);\}\}echo\s*['"][^;]{1,199}<(title>)\W+\34\W+</\38(?<X2168910>)|\h*eval\(['"]\?>['"]\.file_get_contents\(['"]/\w+/\w+\/tmp/\w+['"]\){2};\?>\Z(?<X1268281>)|\h*if\(!(class)_exists\(['"]([a-f\d]{32,64})['"]\)\)\{\41\h*\42\{\h*private\h*static\h*\$[a-f\d]{32,64}=null;[^_]{999,1999}\bfunction\h*__construct\(\)\{\$this\->[a-f\d]{32,64}=new\h*std\41\([^/\?\v]{1,19999}=['"]upl?\w{1,16}['"];(?<X2179651>)|\h+(x_iso)\h*\(\)\h*;\h*function\h+\44\h*\(\)\h*\{\h*if\h*\(\h*(isset)\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\h*unlink\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\);\h*(?:exit|die)[^;]{0,9};\h*\}\s*if\h*\(\h*\45\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\h*\$\w{1,40}=\$_[GPRSC]\w{2,6}\[[^\]]+\];(?<X2144630>)|\h+/\*Leafmail\d+\*/goto\h+(\w+)[^%]{999,}\47[^>]{99,}goto\h+\w+;\h+\w+:\h+\w+:\h+\?>(?<X1277250>)|\h+eval\(pack\(['"]H\*['"],['"](?:0a23[a-f0-9]{3999,4300}['"]\)\);\s*(?:\?>|\Z)(?<X1143460>)|2024[67][a-f0-9]{999,9999}['"]\)\);\s*(?:\?>|\Z)(?<X1143374>))|\h+goto\h+\w{2,9};\h*\w{2,9}\h*:\h*if\h*\(\h*!isset\h*\((\$\w{2,9})[\)\h]+\{\h*goto\h+\w[^:]{1,99}:\h*\51\h*=\h*str_rot13[^,]{1,40},\h*strrev\h*\(\51[^\?]{9,499}create_function\h*\(\w{2,9}\([^,]{1,9},\h*\51[^\.]{9,499}\51\h*=\h*\w{2,9}\(\w{2,9}\([^\.]{1,9}\.[^;]+;[^\?]{1,99};(?:\h*\w+:){1,2}\s*\?>(?<X1141690>)|\s*((\$\{['"]GLOBALS['"]\}\[)['"][^'"]{1,40}['"]\])=[^\*]{99,999}=str_rot13\(pack\(['"]\w\*['"],strrev(\(\$\{\53\}\))\){2};if\(isset\(\$\{\54['"]\w+['"]\]\}\){2}\{@?eval\55;\}{2}\s*(?:\Z|\?>)(?<X1130911>)|\s*(?:(?:error_reporting|set_time_limit)\(\d+\);){2}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\57\[\58\]=stripslashes\(\59\);\}\}[^@\*]{999,3999};if\(fwrite\(\$\w+,\57\[[^\]]+\](?<X2130780>)|\s*(?:(\$\w{1,40})=['"][^'"]{0,99}['"];){1,3}\$\w{1,40}=(?:\61[\[\{]\d+[\]\}]\.){5}[^#%&\*!@:/\v]{999,9999}\bheader\(['"]Content\-type:\h*text/html\b[^%\?#&@\*\v]{499,1999},CURLOPT_USERAGENT,\\['"]WHR\\['"][^%@\*\v]{999,9999}\$\{['"]GLOBALS['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1181790>)|\s*(?:(\$\w{1,40})=substr\(['"]\w{9,49}['"][^;]{4,9};){3}(\$\w{1,40})=[^;]{1,99}\63[^;]{0,99};(?:(\$\w{1,40})=(?:\64\[\d+\][\.;]){1,5}){1,9}(\$\w{1,40})=[^;]{1,99}\65[^;]{0,99};\66\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\s*(?:\?>)?\Z(?<X2136020>)|\s*(?:(\$GLOBALS\[["'](packer)['"]\]\[)[^\]]+\]=[^;]{1,49};){4}[^\?]{1,499}\$\w{1,40}\.=\69_read_file\(\68(?<X2141280>)|\s*(?:/[/\*][^/\v]{1,199}\s*)?(\$\w{1,40})\s*=\s*(?:strrev\()?['"\.base64_dcogztunmprs13v]{9,52}\)?;\s*eval\(\71\(gz[di][en]flate\(\71\(['"][^'"]{9999,19999}['"][\)\s]{4,9};\s*(?:\?>|\Z)(?<X1132290>)|\s*(?:\$[O0_]{1,40}\s*=[^;]{1,300};+\s*){3,5}.{50000,};exit\(\);\}'\);\$\{"[^"]+"\}\["[^"]+"\]\(\);\$[O0_]{1,40}="[^"]+";\?>(?<X1041510>)|\s*(?:\$\w{1,12}=[^\(\s;'"]{2,12}\([^\)]{4,60}\);){9,}(\$\w{1,12})=\$\w{1,12}\(['"]['"],\$\w{1,12}\(\$\w{1,12}\)+;[^\?\n!><]{1,999}\74\(\);[^\?\n!><]{1,499}\?>\s*\Z(?<X2132742>)|\s*(?:\$\w{1,18}=['"].{1,18}['"];){17}[^\?#>]{99,999}(?:\$\w{3,18}=(?:\$\w{3,18}[\['"]*\d*[\]'"\.]*){1,18};){2,4}\$\w{3,18}=(?:\$\w{3,18}\((?:\$\w{3,18}(?:\[['"]?\d*['"]?\])?[,\.]){9}[^;\s\)\(\*\{\}=/:!%&]+\);)+\Z(?<X20644618>)|\s*(?:\$\w{1,19}\s*=\s*[^'";]{1,40}(?:[\^\|]['"][^\v\$]{1,19}['"])?;\s*)?\$\w{1,40}\s*=\s*['"][^\v]{1,40}['"][\^\|]['"][^\v]{1,40}['"];[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}\s*(?:\)\)\h*[^\w\s]{2,3}\h*\$\w{1,19}\h*)?\.\s*\$\w{1,19}\s*[\)\.](?:[^\{\[\?]{60,199})\);\s*\Z(?<X1142201>)|\s*(?:\$\w{1,30}=['"][a-z0-9]{0,19}['"];){3}[^@]{99,299}\}@?(\$_[GPSCR]\w{2,6}\[[^\]]+\])=\78;(?:if\(!(function)_exists\(['"](getReal)\w+['"]\)\)\{\79\s*\80\w+\([^\|]{9,999}\}{2}\$\w+=\80\w+\(\);){3}[^/]{1,199}(?:(curl_)setopt\([^\)]+\);){4,6}(\$\w{1,40})=\81exec(\([^\)]+\);)\81close\83echo\82;(?<X2129290>)|\s*(?:\$\w{1,40}=['"][_GPCSRETORVQUIK]{1,7}['"];){3,5}(\$\w{1,40})=\$\{(?:\$\w{1,40}[\.\}]){3,5};if\(isset\(\85[^\{]{1,29}\{(?:\$\w{1,40}=(?:\85\[[^\]]+\][\.;]){2,5}){2,5}(\$\w{1,40})=\$\w{1,40}\(['"][^'"]*['"],[^;]{1,99}\);\86\(\);\}(?<X1131140>)|\s*(?:\$\w{1,40}=base64_decode\([^\)]+\);){9}[^\?]{3999,5999}(\$this->)\w+=array\(\);(?:\88\w+=\$\w+\(['"][^'"]{2999,29999}['"]\)\.[^;]{1,49};){2}[^#@]{4999,6999};if\(\w+\([^,]+['"]/\.htaccess['"],['"]\w+['"],['"][^'"]{1,99}(?:Add(?:Type|Handler)\s*[^\\]{1,19}\.php\\n){2}(?<X2131483>)|\s*(?:if\(\$_[GPCSR]\w{2,6}\[[^\{]{1,40}\{(?:echo|move_uploaded_file)\b[^;]{1,299};){2}\$\w{1,40}=\$_FILES\[[^\{]{99,299}mail\((?:\$\w{1,40}[,\)]){3};(?:\Z|\?>)(?<X1129890>)|\s*(?:include|require)(?:_once)?\h*['"][^'"]{0,49}\.php['"];\s*file_put_contents\([^\)]+\);\s*header\(['"]Location:\h*\w{0,15}\.php\?path=['"]\h*\.\h*md5\(time[\(\)]+;\s*\?>(?<X2185160>)|\s*(\$[0o]{1,19})=['"][^'"]+['"];function\s+([0o]{1,19})\([^\)]+\)\{return[^;]+;\}(?:\$[1l]{1,19}=\93\(\92\[\d+\][^;]+;)+(\$[1l]{1,19})=\93\(\93\([^\?]{499,1499}(\$[1l]{1,19})=\93\(\93[^;]{99,499};\94\([^\)]+\95\b[^\)]{1,9}\)\);(?:\?>)?(?<X1136950>)|\s*(\$\w)=[^;]{1,99};\s*(\$\w)=['"]file_ge(t_contents)['"];\s*(\$\w{1,40})=\97\(\98\(['"]https?://[^'"]+\.txt['"][^;]{1,49};file_pu\99\(['"]([^'"]{1,40})['"],['"]<\?php\s*['"]\.\100\);(?:(?:include|unlink)\(['"]\101['"]\);){2}[^@>]{1,499}\binclude(\(\$\w\);)unlink\102(?:die|exit)\(?\)?;\}?(?:\?>)?\Z(?<X2151890>))
\A<\?php(?:\s*[^\{]{0,99}(\$\w{1,9})\h*=\h*['"]https?[^\{]{9,150}(\$\w{1,9})\h*=\h*['"][^'"]{1,99}\.php['"][^\{]{9,99}function\s*(donlot)\(\1,\h*\2\)\{[^\}]{9,99}\}\s*while\(\d{1,3}\)\s*\{\s*if\(!file_exists\(\2\)\)\s*\{\s*\3\(\1,\h*\2\);\s*\}\s*sleep\(\d{1,3}\);\s*\}\s*\?>(?<X1138981>)|\s*[^\{]{1,299}(?:\$door_(?:domain|type|folder|file|param|tpl)=[^;]{1,49};){3}[^%#\^\v]{9999,15000}(\$door\w+)=(?:\$door_\w+\.){3}[^;]+;(\$spam\w+)\.?=[^;]+\5\b[^;]+;\}+return\s*\6;(?<X2133456>)|\s*[ir][ne][cq][lu][ui][dr]e(?:(?:_once)?\(?['"](?:block(?:er)?|(?:anti-?)?bot|helper|api|mail|info)\.php['"]\)?;[^\}]{9,2999}<title>[^/]{0,99}DHL\s*(?:\||Express|\s){0,4}Tracking</title>(?<X2129030>)|(?:_once)\((?:[^;]+;function\s+(\w+)\((\$\w+),(\$\w+)\)\{\$\w+=opendir\(\10\);mkdir\(\11\);[^\}]+\}else\{(?:(?:copy|chmod)\((?:\10|\11)[\.'"/]{5}\$\w+,[^\)]+\);){2}[\}]{3}[^\{]{99,499}\9\(\10,\11\);header\(['"]location:[^\)]+\);(?:\?>|\Z)(?<X1129392>)|[^\)]+\);if[^\{]{9,99}\{header\(['"]HTTP/[\d\.]{1,3}\s*404[^\}]{9,29}\}(session)_start\(\);(\$\w+)=\$_[GPCR]\w{2,6}\[['"](\w+)['"]\];\$_\13\[['"]\15['"]\]=\14;(\$\w+)=[^;]{9,49};if\(\16\)\{header\(['"]location:\16[^'"]{9,49}['"]\);\}\?>(?<X1129401>)))|\s*\$(?:\w+\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w+['"]\];\s*\$\w+\s*=\s*\$\w+\s*\.\s*basename\([^\(]{1,99}\(move_uploaded_file\([^\{]{1,99}\{\s*echo\s*['"]\w+['"];\s*\}\s*\w+\s*\{[^;]{1,119}echo\s*['"]\w+['"];\s*\}(?:\s*\?>)?\Z(?<X220343192>)|\w{1,14}=['"]str_repeat['"];+\$\w{1,14}=['"]pack['"];+function\s*\w{1,14}\(\)\{(\$\w{1,14})=Array\([^\$]{1,200};[^@]{1,150}\$\w{1,14}=Array\(\19,\$_COOKIE,\19,\$_POST[^\)]+\);[^@]{1,300}eval\(\$\w{1,14}\);+die\(\);+(?<X2304850>)|\w{1,40}="[^";\s\.]{30000,}";eval\(base64_decode\("[^"\n\)]+"\)\);return;\s*\?>\Z(?<X2050601>)|\w{1,40}='[^']+'\s*\^\s*'[^']+'\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\(\s*'',.{1000,3000}'\);\s*\$\w{1,40}\(\);\s*\Z(?<X1040300>)|\w{1,40}=['"]['"];[^\n\*\?]{0,1999}do\{[^\n\?@]{3999,9999}(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);\23\(\);(?<X2132864>)|\w{1,40}=['"][^'"]{9999,19999}['"];[^\?\&]{99,499}function\s*\w+\((\$\w+),&(\$\w+),(\$\w+)[^\)]*\)\{\26=(file_)ge(t_contents\()\25\);\26(=preg_replace\()['"]\W<script[^>\);]+>\s*(document\.body\.innerhtml)=\31[^><\);]+<iframe[^,]+,['"]{2},\26\);if\(\27\)\{\26\30[^\}]+\}return\s*\28pu\29\25,\26\);\}(?<X2134110>)|\w{1,40}=['"]\w{32}['"];(?:[ero_ptingsml]{14,15}\(\d+\);){2}function\s*\w+\(\)\{[^@]{8999,10999}<!--_{19,49}Recoded?\b[^>]{9,99}_{19,49}-->(?<X2131300>)|\w{1,40}=['"]https?://(?:[^;]{1,99};\s*(\$\w{1,40})=['"][^'"]{1,49}\.php['"];\s*function\s*_doEvil\(\34,\$\w{1,40}\)\{(?<X2168320>)|pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][^\?]{1,299}\$(?:auth)?_?pass=['"]\w{4,400}['"];(?<X2131900>))|\w{1,40}=array\([^;]{1,99};if\(isset(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\)\{switch\37\{[^\}]{0,199}\bcase\s*['"](\w{1,40})['"]:\s*if\(\38\(\$_POST\)\)[^\?]{1,399}\bfunction\s*\38\(\$\w{1,40}\)\{[ri](?:equir|nclud)e(?:_once)?[^;]{0,99}\bwp\-load\.php['"];[^\}]{1,299}\bwp_insert_post\((?<X2170541>)|\w{1,40}\s*="[^"]{20000,}"\s*;\s*eval\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\?>\s*\Z(?<X1040070>)|\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*@?eval\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*\?>\s*(?<X1040050>)|\w{1,9}\h*=\h*\[\s*['"]head['"]\h*=>\h*['"]COVID\-19(?<X2193551>)|\{['"][^`]{1000,4000}['"]\]\};if\(@?file_exists\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\)and\s*empty\(\$_REQUEST\[['"][^`]{1000,4000}\]\}\)\{exit\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\);\}else\{@?header\(['"][^'"]{1,200}['"]\);\}\}\s*\?>(?<X1042040>)|\{['"][^`]{1000,6000}[^\x00-\x7F]{20,25}";[^`]{300,500}mail\(\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^'"]{1,40}"\}\["[^'"]{1,40}"\]\}\);\s*\?>(?<X1042050>)|_[GPRSC]\w{2,6}\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*(?:\Z|\?>)(?<X1138890>)|filesman=[^;]{1,99};if\(\$_[GPCSR]\w{2,6}\[[^;\?\}]{1,99}\$(\w{1,40})=(\$_FILES\[)[^;]{1,99};\$(\w{1,40})=\47[^;]{1,99};[^\}\?\{\(]{0,99}\bif\([cm]o(?:ve_uploaded_file|py)\(\$(?:\46|\48),[^\)]{0,99}\$(?:\46|\48)\)(?<X2169650>)|send=['"][^'"]{9,99}['"];[^\?]{9,199}/\w{1,9}\.php['"];function\s+randomCha\(\$\w{1,40}\)(?<X2133234>))|\s*\w+\s*(\w+)\(\)\{\s*return\s*['"]phar://readme.md/[\w\-]+\.(?:php|txt|png|jpe?g)['"];\s*\}\s*\s*(\$\w+)[\s=]+\51\(\);\s*include\s*\52;\s*\Z(?<X220344860>)|\s*class\s*(?:(\w{1,40})\{(?:const\s*PLATFORM_(?:UNKNOWN|ANDROID|APPLE|LINUX|WINDOWS)=\d+;){5}private\s*\$(\w{1,40})=['"][^'"]{5000,19999}['"];[^%]{1000,4000}(?:header\([^)]+\);){6}return\s*gz(?:in|de)flate\(base64_decode\(\$this->\55[^%]{1,150}(\$\w{1,40})=new\s*\54\(\);echo\s*\56->\w+\((?<X2127371>)|(text_auth)\{var\s*\$n_iter;function\s*\58\(\)\{[^!]{99,2999}(\$\w{1,40})=new\s*\58\(\d{2,4}\);(\$\w{1,40})=\59->decrypt\(\60,['"]\w+['"]\);eval\(\60\);(?:\Z|\?>)(?<X2129170>))|\s*define\(['"]PHPSHELL_VERSION['"],['"][^'"]{1,9}['"]\);\s*\?>\s*<html>(?<X2139741>)|\s*error_reporting\((?:(?:0|NULL)\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h\{]+[^\}]{0,299}\bfile_put_contents\([^\)]+\);\s*(header\(['"]Location:\h*https?://facebook\.com['"]\);)\s*(?:exit|die)[^;]{0,9};\s*\}\s*\63\s*\}\s*\63\s*\?>(?<X2185151>)|(?:0|NULL|False)\);(?:[^\$\?\{=]{1,199}\$(\w{1,40})=['"]https?://[\d\.]{7,15}/[^'"]{1,99}\.php['"];\s*(\w{1,40})\(\$\65\);[^\?\{]{1,199}\bfunction\s*\66\((\$\w{1,40})\)\{[^\}]{1,499}\$(\w{1,40})=file_get_contents\(\67\);[^\?>]{1,499}\becho\s*\$\68;(?:exit|die)[^;]{0,19};(?<X2166001>)|\s*function\h*(\w{1,40}\()(\$\w{1,40})(?:=\d{1,3})?\)\{http_response_code\(\71\);exit;\}(?:if\([^\)]+\$_[GPCSR]\w{2,6}\[[^;]{1,99}\70\d+\);){1,3}if\(copy\(\$_FILES\[[^,\)]{1,99},\$_[GPCSR]\w{2,6}\[[^;\?]{1,99}\70\d+\);(?:\70\);)?(?:\?>)?\Z(?<X2177190>))|[^;]{1,19};function\s*\w+\([^\{]+\{\$\w{1,40}=['"]\w{52,99}['"];[^\?/>!]{99,199}\bif\(stri?pos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],[^\{;]{1,49}\{if\(!isset\(\$_(COOKIE)\[[^\{;]{1,99}\{set\73\([^;]+;header\(['"]Location:\s+https?://[\d\.]{7,15}/[^;]+;\}+;(?:\?>|\Z)(?<X1134020>)|\d\);set_time_limit\(\d\);((\$\w{1,40})=base64_decode\()['"][^'"]{65000,}['"]\)(?:;\76=[ep]reg_replace\([^\)]{6,19},\76\)){3,5};\75\76\);eval\(\76\);(?:\Z|\?>)(?<X1130420>))|\s*f(?:ile_put_contents\s*\(\s*['"]\./index\.back\.php['"],\s*base64_decode\s*\(\s*['"][^'"]{99,1999}['"]\s*\)\);\s*(?:\Z|\?>)(?<X1138590>)|unction(?:\h*(\w{1,15})\(\$\w{1,15}\)\s*\{\s*GLOBAL[^\n]{99,1100}\bget_var\((\$\w)\[\d+\]\.(\$\w)\.\80\[\d+\]\);\$wpdb\->update\(\81,array\(\80\[\d+\]=>\$[^\n]{99,1500}\breturn\h*\$\w;\}add_filter\(['"][^'"]+['"],['"]\79['"]\);(?<X1194450>)|\s*(?:(\w+)\((\$\w+)\)[^\}]{9,99}(\$\w+)=(?:sub(?:str))\(\84,\d+,\$\w+\);\h*return\h*\85;\}function\s*(\w+)\((\$\w+)\)\h*\{(\$\w+)=substr\(strrchr\(\87,['@"]{2,3}\),\d+\);\h*return\h*\88;\h*\}(\$\w+)=\$_[GPCSR]\w{2,6}\[[^\]]{3,40}\](?:;\$\w+=(?:\83|\86|str(?:len|rev))\(\89\)){4};(?<X2128972>)|(\w{1,40})\((\$\w+)\)\{(\$\w{1,40})=sub(str)\(\94rchr\(\92.['"@]{2,3}\),\d+\);return\93;\}(\$\w{1,40})=\$_[GPSCR]\w{2,6}\[[^\]]{3,42}\];(\$\w{1,40})=\91\(\95\);\{header\(['"]Location:\s*https?://\96['"]\);\}\s*(?:\?>|\Z)(?<X2128980>)|(\w{1,40})\((\$\w{1,40})\)\{\99=gzinflate\(base64_decode\(\99\)\);for\([^\{]{9,99}\)\{\99(\[\$\w{1,40}\])=chr\(ord\(\99\100\)\-1\);\}return\99;\}eval\(\98\(['"][^'"]{65000,}['"]\)\);(?:\?>|\Z)(?<X1129630>))))|\s*goto\s+(?:(\w{1,9});(\w{1,9}):\s+function\s*\w+\([^\?]{99,499};\102:\$GLOBALS\[[^\]]+\]=array\((?:['"](?:str_rot13|pack|strrev)['"],?){3}\);goto\s+\103(?<X2131611>)|\w{1,40};[^\?]{49,299}\b\w{1,40}:\s+(exec\((['"])pkill)[^'"]{9,99}\106(\);goto)[^\?]{99,999}\105[^'"]{9,99}\106\107(?<X2131013>)))
\A<(?:\?php(?:\s*if(?:[\(\h]+isset[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?(strrev)[\h\(]+['"]edoced_46esab['"][\h\)]+;\s*(\$\w{1,40})\h*=\h*@?\2[\h\(]+['"]sserpmocnuzg['"][\h\)]+;\s*@?eval[\h\(]+\3[\h\(]+\1[\h\(]+['"]eN[^'"]{999,49999}['"][\h\)]+;\s*\}\s*(?:\?>|\Z)(?<X2181850>)|\(!(function)_exists\(['"]([^'"]+)['"]\)\)\{\5\s*\6\([^\@]{99,499}\}(\$\w{1,40})=[^;]+;(\$\w{1,40})=\6\([^\)]+\$_[GPCSR]\w{2,6}\[[^;]+;file_put_contents\([^\)]+\b(RC4)::De(crypt)\(\7,\8\)[^@]{99,499}\bclass\s*\9\{[^@]{99,499}\b\5\s*de\10(\([^\{]{1,9})\{return\s*\9::en\10\11;\}\}(?:\?)?\Z(?<X2139200>)|\((\$_[GPCSR]\w{2,6})\)\{(\$email)=\13\[[^;]{1,49};(\$pass(?:w(?:or)?d)?)=\13\[[^@]{99,999}\$(m(?:e?sg|essage))=[^;]{1,199}\14[^;]{1,199}\15[^@]{1,1499}\bmail\([^\)]+\$\16[^\(\?\{]{1,199}\bheader\(['"]Location:\s*https?://(?<X2153111>)|\((\$_[GPCSR]\w{2,6}\[[^\]]+\])\)\{?(?:exit|die)\(\18\);[^\?]{1,499}/\*Bloodninja:\s*I\s*lick\s*your\s*earlobe\b[^#@]{999,4999}\*/\]['",]{6}\);\$[^;\.]{99,499}\.['"]{2}[^'"]{20000,30000}['"]{2}[^@]{99,999}\*/(?:\?>)?\Z(?<X2138513>)|\(file_put_contents\(['"][^'"]{1,99}['"],base64_decode\(['"][^'"]{65000,}['"]\)+(?:echo[^;]{1,99};)?(unlink\()__FILE__\);(?:\20[^;]{1,99};){1,3}\s*(?:\?>|\Z)(?<X1136070>)|\(isset(?:(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\)\{(\$\w{1,40})\[['"](\w+)['"]\]=(?:strrev\()?['"](?:tressa|assert)['"]\)?;(\$\w{1,40}\[)\]=\23;\25\d+\]\[['"]\24['"]\]\22;(?:exit|die)[^;]{0,49};\}(?:\?>|\Z)(?<X1133480>)|\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{(\$\w{1,40})=\27;for\((\$\w{1,9})=\d+;\29<strlen\(\28\);\29\+\+\)\{\28\[\29\]=\28\[\29\]-\d+;[^\(]{1,99}\$\w{1,40}=base64_decode\(['"][^'"]{999,9999}['"]\);(\$\w{1,40})\s*=\s*['"][^'"]+['"];for\([^\}]{39,199}\28\[\d+\]\);\}eval\(\30\);(?<X2130621>)|(\$_FILES\[[^\]]+\])\)\)\{\s*\$\w{1,15}=['"]\./['"]\.\32\[['"]\w{1,15}['"]\];\s*if\(@?(?:move_uploaded_file|copy)\(\32[^\}]{9,99}echo\h*['"]\w{1,9}[^<]{9,50}<(form)[^\?]{9,150}</\33><\?php\h*\}\h*\?\>(?<X1142991>)|\$_[GPCSR]\w{2,6}\[(?:[^\]]+\]\){2}\{?die\(\w{1,40}\(\)[\+\-\*\%/]\d+\);\}?(?:\s*\?>)?\s*\Z(?<X2131601>)|[^\{\?;]{1,99}\{(\$\w{1,40});(\$\w{1,40})=explode\(['"]\W["'],\$_[GPCSR]\w{2,6}\[[^;]{1,99};(\$\w{1,40})=\37\[\d+\];(\$\w{1,40})=\37\[\d+\];\38\(\39,\36\);foreach\(\36[^\)]+\)\{[^\};]{1,199};\}\}\s*(?:\?>)?\Z(?<X2172870>))))|\h*\(!(function)_exists\(['"](set_magic_quotes_runtime)['"]\)\)\s*\{\s*\41\h*\42\([^\(]{1,40}(\$\w{1,40})\h*=\h*(str_rot13)\([^\)]{9,25}\);[^;]{9,99};(\$\w{1,40})\h*=\h*\44\(strrev\(['"][^'"]{9,20}['"]\)\);\s*(?:eval\(\43\(\45\(['"][^'"]{99,}['"]\)+;\s*){2}\?>(?<X1139280>)|\h*\(\h*isset\h*\(\h*(\$_FILES\[[^\]]+\])\h*\)\h*\)\s*\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"][^'"]{0,50}\w{1,15}\.php['"][^\{]{9,150}if\h*\(\h*@?(?:move_uploaded_file|copy)\h*\(\47[^\{]{9,50}\{\s*chmod\h*\([^\)]{5,25}777\h*\);\s*\}\s*echo[^\}]{9,70}\}\s*else\s*\{[^\}]{9,70}\}\s*\?>(?<X1142951>))|\s*include(?:_once)?\s*['"][^'"]{0,49}wp\-config\.php['"];[^\$]{99,499}(\$\w{1,40})=new\s*mysqli?\((?:DB_(?:HOST|USER|PASSWORD|NAME)[,\)]){4};[^&\^#]{999,1999}\$\w{1,40}=\49->real_escape_string\(['"]a:1:\{s:13:['"]administrator['"];b:[01];\}['"]\);(?<X2131040>)|\s*namespace(?:[^;]+;\s*class\h*(\w{1,15})\s*\{[^#]{9,2300}\bfunction\h*save\h*\(\$\w{1,15}\)\s*\{\s*(\$\w{1,15})\h*=\h*tempnam\(sys_get_temp_dir\(\),\h*__CLASS[^\}]{0,99}\binclude\h*\52;\s*@?unlink\(\52\)[^\{]{0,99}\{\s*echo\h*<<<HTML[^\\]{0,49}404\h*Not\h*Found</title>[^\?]{0,299}\bnew\h*\51\b(?<X2185531>)|\s*InnStudio\\Prober\\(?<X2158612>))|\s*set_time_limit\(0\);\s*header\([^\$]{9,99}(\$\w{1,15})\h*=\h*['"]https?://[^;]{9,50};\s*(\$\w{1,15})\h*=\h*['"]https?://[^;]{9,50};\s*(\$\w{1,15})\h*=\h*file_get_contents\(\55\.['"][^'"]{1,35}['"]\.\56\.[^;]{9,80};\s*echo\h*\57;\s*(?:\Z|\?>)(?<X1141090>)|\s*unlink\(\s*['"]([^'"]+)['"]\s*\);\s*(\$\w{1,40})\s*=\s*base64_decode\(\s*['"][^'"]{99,500}['"]\s*\)\s*;\s*file_put_contents\s*\(\s*['"]\59['"]\s*,\s*\60\s*\);\s*(?:\?>|\Z)(?<X1129442>)|\s+(?:\w{5,20}\([^\)]+\);\s*)+(?:\$arr\w{1,20}\[\]=['"]\d+['"];\s*){5,20}(?:\$arrBread\[\]=['"][^'"]*['"];\s*){99}(?<X2203601>)|\s+(\$\w{1,20})=(curl_)init\(['"]https?://(?:\d+\.?){4}/[^\)]+\);\s*\64setopt\(\63,[^\)]+\);\s*(\$\w{1,20})=\64exec\(\63\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]\?>['"]\.\65\);\s*(?:\Z|\?>)(?<X1153582>)|\s+(\$links)=['"](?:<a\h+href=[^>]{9,99}>[^<]{2,60}</a>\h*){5,15}['"];\s*function\h+\w{1,20}\([^\)]+\)\s*\{\s*global\h*\67;\s*\$\w{1,20}=preg_replace\(["'][^,]+,["']<div\h+style=['"](?:left|right|top|bottom)\s*:\s*\-\d+px;(?<X2193670>)|\s+(function)(?:\h*(\w{1,20})\(\)[\{\s]+[^\}]+[\}\s]+(add_action\(['"]init['"],['"])\70['"]\);[^\|\?]{99,400}\b\69\h+(\w{1,20})\(\)[\{\s]+[^\{]{0,80}\bif\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\{\s]+[^\}]{99,700}\bif\([^\)]+\)[\{\s]+\$\w+=file_put_contents\([^\}]{9,99}\bexit\(\);[\}\s]+\71\72['"]\);(?:\?>|\Z)(?<X2204420>)|\h+(authcode)\([^/\\]{200,600}\b\69\h+(Root_login\d*)\([^\)]+\)[\{\s]+print\h*<<<END\h*<html[^@\\%]{400,1500}\b\75\([^\)]+\);[\s\}]+else[\s\{]+\$\w{1,20}=\74\((?<X2201380>))|\s+/\*(?:\*\s+\*\s+Security\s+Plugin:\s+PHP\s+Code\s+Protection\s+Tool\s+\*\s+Function:\s+Detect\s+and\s+defend\s+against\s+code\s+hijacking[^:]{1,199}Version:\s+\d+\.\d+\.\d+\s+\*\s+Plugin\s+Name:\s+PhpShield\s+\*\s+Author:\s+Security\s+Development\s+Team\s+\*\s+Email:\s+\w+@guardian\.com(?<X220334240>)|\s+Plugin\s+Name:\s+Yadvanced\s+Crons\s+Description:\s+WooCommerce\s+report\s+Version:\s+\d+\.\d+\s+Author:\s+Dero\s+\*/\s+define\(['"]YAD_Login(?<X220334230>))|\s+\$(?:web)?ShellName=["']Infinity.{0,2}[5s]h[3e][l1]{2}['"];(?<X2202410>)|\s+class\h*(\w{1,6})[\s\{]+private\h+static\h*(\$\w{1,6});\s*static\h+(function)\h*(\w{1,20})\([^\)]+\)[\s\{]+if\(!self::\81\)[^@%\+]{99,500}\);[\}\s]+\82\h*(\w{1,20}\(\))[\s\{]+(\$\w{1,6})=\$_[GPRSC]\w{2,6};\s*\([^@%\*]{200,999}:\85;\s*return(?:\h*.?\80::\83\(\d+\)){5,10};[\s\}]+\84;\s*(?:\?>\s*)?\Z(?<X2201511>)|\s+e(?:cho\h+['"][^'"/]{2,30}<title>\w{0,9}\h*(?:Cpanel|Whm)\h*mass\h*Defacer\b(?<X2168851>)|rror_reporting\((?:0|NULL|FALSE)\);\s*function\h+(\w{1,20})\(([^\)]+)\)[\s\{]+(\$\w{1,20})=base64_decode\(\89\);\s*(\$\w{1,20})=openssl_decrypt\(['"]\90['"],['"]AES\-[^\)]+\);\s*return\h*\91;[\s\}]+\$\w{1,20}=['"][^'"]{9999,}['"];\s*if\(!?function_exists\([^\?#%]{200,500}\beval\(\88\([^\)]+\)\);(?:\s*\?>)?\Z(?<X2198380>))|\s+goto\s+\w+;(?:\s*\w+:\s*curl_setopt\([^\n]{999,2999}\$\w{1,40}\s*=\s*parse_url\(\s*rawurldecode\s*\(\$_[GPCSR]\w{2,6}\[[^\n]{499,999}fwrite\(\s*(\$\w+),\s*(\$\w+)\);[^\n]{499,999}\93\s*=\s*fopen\([^\n]+\94\s*=\s*curl_exec\([^\n\?>]{999,4999}(?:\?>|\Z)(?<X1132321>)|\s+\w+:[^'"]{1,32}['"](?:\\[a-fx\d]+){4}\\(?:[^;]{1,999}\\[a-fx\d]+['"]\);\s*goto[^@]{1,999}@\((md5\()\96\96\96[^\n]{1999,};\s*goto\s+\w+;\s+\w+\s*:\s*\w+::\w+\(\);\s*\?>\Z(?<X220338351>)|[^\n]{19999,};\s*goto\s+\w+;\s*\w+:\s+\$\w+\s*=\s*['"](?:\\[a-fx\d]+){4}\\[^'"]+['"];\Z(?<X220335301>)))|\s+if\(!(function)_exists\(["'](hex2bin)[''"]\)\)[\s\{]+\99\h+\100\((\$\w{1,20})\)[\s\{]+\$\w{1,20}=strlen\(\101\);[^\(]{0,20}\bwhile\([^\}]{2,60}\bpack\(['"]H\*['"],[^@#%]{9,400}\breturn\h*strrev\(gzinflate\([^;]{1,30};[\s\}]+(?:eval\()+\w{1,9}\(['"][^'"]{999,6000}['"][\)\s]+;\s*(?:\?>|\Z)(?<X2202020>)|\s+unlink(?:\(['"](wp\-config\.php)['"]\);\s*copy\(['"][^'"]{2,20}\.php['"],['"]\103['"]\);(?<X2181113>)|\h*\(__FILE__\);[^:]{0,99}\$x.domains?[\h=]+explode\h*\([^\?;]{2,20}(?:pill|med|drug|rxfactory)(?<X2178383>)))|\w[^/]{4,49}>function\h+(\w{1,40})(\(\w{1,40}\))\{var\h+(\w{1,40})=document\.getElementById\107;(\108\.value)=btoa\(\109\)[^\?]{1,99}<\?(?:php)?[^\?]{1,199}\bfwrite\(fopen\([^;]{1,99},\w{1,40}\(\$_[GPSRC]\w{2,6}\[[^\?]{1,199}<form\b[^>]{1,99}\bonsubmit=['"]\106\([^\}]{1,499}</form>['"];\}{1,2}(?<X1175600>)|form\b[^\?]{1,499}<\?[^\?]{0,199}(\$\w+)(=['"]file_)pu(t_contents['"];)(\$\w+)\112ge\113[^\?\}]{1,999}\111(\(\$_FILES\[)[^,;]+,\114\115[^;]+;\s*(?:if\([^\}\{;]+\{echo\b[^;]+;\}else\{echo\b[^;]+;\}+)?(?:\?>\s*)\Z(?<X2220690>))
\A(?:<(?:html>.{100,1500}echo\(""\);\s*\}\s*\$filename = \$_SERVER\[SCRIPT_FILENAME\];\s*\?>\s*</body>\s*</html>\s*\Z(?<X2050250>)|script\s+type="text/javascript">\s*location\.replace\("http://[^"]+"\);\s*</script>\s*\Z(?<X1042541>))|[^!]{0,99}<!DOCTYPE\s*html>[^@]{1,1999}['"]amphtml['"]\s*href=['"]https?://pub\-\w+\.r2\.dev/[^@]{99,1999}<title>(\w+(?:togel|slot))[^<]{0,99}</title>[^@]{1,299}\3/favicon\.webp['"](?<X220361950>)|[^<\?]{0,12}<\?php\s+class(_\w+)[\{\s]+function\s*\w+construct\s*\(\)\s*\{[^\}]{99,500}[\}\s]+function\s*_\w+\s*\([^\)]{1,999}\)[\{\s]{1,999}[^#&\}]{1,999}\}?[^\n]{0,15}\}\s*[^\n]{99,2499}\bp(?:ublic|rivate)\s*\$\w+=array\s*\(["'\w,]{9,99}\);(?:p(?:ublic|rivate)\$\w+=['"][^'"]{99,}['"];){2}\}new\5[\(\);\?>\s]{1,99}\Z(?<X2256472>)|[^\n/!\?#]{9,199}(###ex###)[^\n]{8999,}\7\h*(?:<li>\h*<a\b[^>/:]{0,99}\bhref=['"]?https?://[^>]+>[^<#\n]{0,199}</a>\h*</li>\h*){3,}###link###\s*\Z(?<X2273152>)|[^\n]{1,99}\022(?:[^\$]{99,}\022[^;]+;if\(isset\(\$_GET\[[^\n]{1,999}data\-gdpr\-consent\-prompt(?<X2310330>)|[^\n]{1,999}(<\?[ph\s]+)\w+:[^\n]+goto\s*\w+;\?>[^\022]+\022[^\n]+\10\s*\w+:\w*\s*\w+:\?>(?<X2310360>))|\$(?:\w+[^\n]{1,64}chr[\s\(]+[^\n]{1,999}\b(public\s*function)\s*__destruct\(\)\{(\w+)::(\$\w+)\s*=\s*@?unserialize\(\13::\14[);\s]{1,16}\$\w+(?:[^\}]{1,256}[}\s]+\12\s*\w+\((\$\w+)\,\s*(\$\w+)[)\s]+{return\s*\15\s*[[\]\d]+\s*\^\s*str_repeat\(\16[,\s]+intval\(strlen\(\15[^\n]{1,999}\$_COOKIE;\$\w+[^\n]+;\}\}public\s*static\s*\14[\s=]+\d+;\}\w+\(\);\}\Z(?<X2304291>)|[^}]{1,256}[}\s]+\12\s*\w+\((\$\w+)\,\s*(\$\w+)[)\s]+{return\s*\18\s*[[\]\d]+\s*\^\s*str_repeat\(\19[,\s]+intval\(strlen\(\18[^\n]{1,999}\$_COOKIE;\$\w+[^\n]+;\}\}public\s*static\s*\14[\s=]+\d+;\}\w+\(\);\}\Z(?<X2301997>))|\w{1,40}[\s=]+[^;]{16,128};\s*\$\w+[\s=]+chr[\s\(]+[^\n]{1,999}\b(public\s*function)\s*__destruct\(\)\{(\w+)::(\$\w+)\s*=\s*@?unserialize\(\22::\23[);\s]{1,16}\$\w+[^}]{1,256}[}\s]+\21\s*\w+\((\$\w+)\,\s*(\$\w+)[)\s]+{return\s*\24\s*[[\]\d]+\s*\^\s*str_repeat\(\25[,\s]+intval\(strlen\(\24[^\n]{1,999}\$_COOKIE;\$\w+[^\n]+;\}\}public\s*static\s*\23[\s=]+\d+;\}\w+\(\);\}\Z(?<X2302823>)|GLOBALS\[[^=]+=aRRAY\((base64_decode)[^,]+,\27[^,]+,\27[^;]+;\s*function[^\{]+\{\$\w+=Array\([^\}]+\}\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\(gzuncompress\(\27\(['"][^'"]{200,}['"]\){1,4};\Z(?<X1312020>)|xmlstring=['"][^=]{1,999}\s*\$\w+=explode\h*\([^;]{1,499};\s*(\$\w+)[\h=]+is_https[\h\(\)]+[^#]{99,1999}\bshuffle\h*\(\$\w+[^{]{9,99}\{\s*(\$\w+)[\h=]+str_rot13\h*\(urldecode\h*\(\30\)\);\s*\$\w+[\h=]+\29[\h\.'"://]+\30[^#]{99,1500}strstr\(\$\w+,['"]okhtmlgetcontent[^\{]+\{header\(['"]Content-type:[^'"]+['"]\);\Z(?<X1321852>))|\<\?(?:[ph\s]+(?:(\$\w{1})=(array)\(\$_[GPRSC]\w{2,6}['"\[]+\w{1}['\]]+=>['"]\d{1}['"\);\s]+(\$\w{1})=\33_keys\(\32\)\[0[\];\s]+\beval\(\34\)[;\s]+\?>\Z(?<X2305740>)|error_reporting\(0\);(\$\w+)=['"]https?://[^'"]+\.\w+['"];(\$\w+)=\w+\(\36\);\w+\(\37,\w+,1\);(\$\w+)=\w+\(\37\);\w+\(\37\);(\$\w+)=\w+\(sys_get_temp_dir\(\),['"]php['"]\);file_put_contents\(\39,\38\);require\s*\39;unlink\(\39\);\Z(?<X2317571>))|php\s*(\$\w{1,40})\h*=\h*file_get_contents\(['"]https?://[^'"]{9,99}['"]\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][^'"]{1,99}\.php['"],[^;]{1,9};\s*fwrite\(\42,\h*\41\);\s*fclose\(\42\);\s*(?:\?>|\Z)(?<X1130723>))|\a*<\?php[^\{\?]{0,99}\bby\h*mr\.Combet\h*\W\h*one\h*hat\h*cyber\h*team\b[^\?\{]{9,199}\becho\h*eval\b(?<X2210510>)|\d+['"]\];\}elseif\(isset\(\$\{['"]\\x5f\\x53\\x45\\x52\\x56\\x45\\x52['"]\}[^\n]{1,999}\$_REQUEST\[[^;]+;exit\(\);\}[^@]{1,599}@?\$\{['"]\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53['"]\}\[['"]\\x4f\\x30\\x30\\x4f\\x4f\\x4f\\x5f\\x5f\\x5f\\x30['"]\][^#]{99,2119}\\['"]www\\['"][^\*]+exit\(\);\}\}['"]\);\$\{[^;]{1,99}\]\(\);\s*\?>(?<X120348261>)|\h*<(?:\?[ph\h]*\$\w{1,40}\h*=\h*\d+[;\s]*\$GLOBALS\[[^\?]{99,999}(\$\w{1,40})\h*=\h*Array\(\s*['"]\w+['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\46\h*\);\s*\}\s*elseif\s*\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*@?eval\h*\(\h*\47[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}(?<X2266180>)|script>document\.location=['"]https?://[\w\-]{1,40}\.com/[^/'"]{1,40}/?['"]</script>\h*\Z(?<X2189872>)))
\A\s*(?:#(?:!(?:(/bin/bash)\s+\((?:(?:wget|curl)\s*-(?:U|A)\s*Mozilla/(?:wget|curl)[^:]{0,20}(https?://[^\|]{9,40}\.php)\s*\|\|\s*){1,2}python\s+-c\s+['"]from[^'"]{9,99}['"]\2[^\}]{9,99}\}\s*\)\s*\)\.read\(\)\);\s*['"]\)\s*\|\s*\1\s*rm\s+-rf\s+\$0\Z(?<X1127590>)|(?:/usr)?/s?bin/bash\b[^&\+]{9,99}\bwget\h+\-O\h+(/usr/bin/(\w{1,20}))\h+https?://api\.licensehosts\.com/api/elf/[^>\s]{9,30}\5\h*(?:&\h*>+\h*/dev/null|>+\h*/dev/null\h*\d\h*>\h*&\d);?\s*chmod\h+\w*\+x\h*\4(?<X2180760>)|/[^\.>\?#]{1,99}\./\w{1,40}\b[^\?]{1,499}\bnohup\h+[^\s]{1,40}\h+(?:[^$>&\?\v]{0,99}\-\-(?:donate\-level|http\-(?:host|port))=){3}[^\?\$]{1,99}\becho\h+\$!\h*&?>+\h+[\w\.\-]{1,40}\s*\Z(?<X2181671>)|/bin/bash(?:[^\?%<>]{99,200}cd\h+\$\{[^\}]+\}/[^;]+;\s*rm\h+-f\h+(wp\-(?:class|index\w{0,9})\.txt);\s*wget\b[^:]{0,35}\bhttps?://[^&]{9,60}/\8\h*&&\h*mv\h*\8\h+\w{1,20}\.php;(?<X2191472>)|\s+(?:\w{1,20}\(\)\s*\{[^%]{9,200}\}\s*){4,9}\w{1,20}\(\)\s*\{\s*(?:nohup|screen)[^\(]{1,20}php[^%]{99,999}new\h+Coinhive\.(?:Anonymous|User)\((?<X2137651>))|/usr/bin/p(?:erl(?:[\s#]{3,30}\bPerl\h+Dd?os\h+script\b(?<X2152030>)|[^!]{99,400}chop\s*\(\s*my\s+\$\w{1,40}\s*=\s*['"]darkCrew['"]\);(?<X2064431>)|[^$]{10,150}Xai\s+Syndicate\s+Team(?<X2059573>)|[^:]{0,50}#\s*Coded\s+By\s+General\s+Deir\s+Ezour(?<X2125901>)|[^;]{1,99}#\s*UDP\s+FLOOD(?<X2125101>)|[^>]{99,300}>\s*Ayna\.pro\W{0,4}CGI-Telnet\s*<(?<X2121611>)|[^\$]{0,50}\$\w{1,20}\s*=\s*['"][^;]{0,40}Connect.Back\s*(?:Shell)?(?:\s*mod[iy]f[yi]ed\s+)?by\b(?<X2125551>)|[^\$]{0,99}\$\w{1,20}\s*=\s*['"]CGI[-\s]Telnet\s*Version\b(?<X2126150>)|[^\$]{1,600}if\s*\(\s*length\s*\(\s*\$ENV\{['"]QUERY_STRING['"]\}\s*\)\s*>\s*0\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$ENV\{['"]QUERY_STRING['"]\};[^\.]{1,600};\s*\}\s*\}\s*\$\w{1,40}\s*=\s*\$\w{1,40}\{['"]user['"]\};\s*symlink\([^\),]{1,40},['"][^'"]{1,40}['"]\);(?<X2122821>)|[^\$]{99,400}<title>\W{0,9}Cyb[3e]r\W{0,2}DZ\s*Config\b(?<X2135320>)|[^\(]{9,300}(?:#\s*){4}\s*cgi\s*http\s*shell\b(?<X2134510>)|[^\(]{99,900}opendir\(my\s*(\$\w{1,20})\s*,\s*['"]([^'"]+)['"]\);\s*foreach\([^\)]{0,9}readdir\s+\22\)\s*\{[^\(]{1,60}(\$\w{1,20})\s*=\s*\$\w{1,9};\s*(?:symlink\(['"]\23['"]\.\24\.['"][^\.]+/(?:wp-)?Conf(?:ig|igure|iguration|ig\.inc)?\.php["'],\24\.['"]-[^\.]{1,20}\.txt['"]\);\s*){10}(?<X2134900>)|\b[^%]{99,500}<title>[^%]{99,500}\{\s*\((\$\w{1,20})\)=[^;]+;\s*(\$\w{1,9})=\w{1,9}\{pwd\};\s*\$\w{1,20}=\27\.[^\.]+\.\26;[^\(]{0,20}(?:symlink\([^\)]{9,99}\.txt['"]\);\s*){5}(?<X2133103>)|\b[^:;]{0,40}\b(use)\h*MIME::Base64;\s*\29\h*(Compress::Zlib);\s*eval\(\30::memGunzip\(decode_base64\(['"][^'"]{999,3999}['"]\)\)\);\s*\Z(?<X2174761>)|\b[^\$]{1,499}my\h*\$alfa\w{0,12}\h*=\h*['"]ALFA\w{0,12}['"];\s*eval\h*\(\h*Compress::Zlib::memGunzip\h*\(\h*decode_base64\h*\(\h*['"](?<X2176111>)|\b[^\{\}]{99,400}<title>\h*Priv(?:8|ate)\b[^\?&]{99,400}\bsymlink\h*\((?<X2175810>)|\s*[^;]{1,200}use\s+strict;\s*undef\s+\$modules::Module::var;\s*my\s+\(\$Password,[^\)]{1,200}\$WinNT,\$NTCmdSep,\$UnixCmdSep(?<X2057090>)|\s*[^\(]{1,40}\s*opendir\(\s*my\s(\$\w{1,40})\s*,\s*['"](/var/www/vhosts/)['"]\s*\);\s*foreach\(\s*sort\s*readdir\s*\35\s*\)\s*\{\s*my\s\$\w{1,40}\s*=\s*\d+;\s*\$\w{1,40}\s*=\s*\d+\s*if\s*-d\s*(\$_);\s*(\$\w{1,40})\s*=\s*\37;(?:\s*symlink\(['"]\36['"]\.\38[^\)]+['"]\)\s*;)+\s*\}(?<X2058510>)|\s*use\s+Socket;\s+print\s+['"]Data\s+Cha[o0]s\s*Connect\s+(?:Back\s*)+door(?<X2120500>)|\s+-w\s*my\s+\$Password="\w+";\s*\$\w+\s*=\s*['"](?:\d+;)(?<X2046151>)|\s+use\h+(Socket);\s*\$ARGC\h*=\h*@ARGV;[^\_\-&]{99,300}\b\42\h*\(crazy\h*,\h*PF_INET\h*,\h*SOCK_DGRAM\h*,\h*\d+\);(?<X2168340>))|ython(?:[^:]{1,20}ChickenLittle\s+Shell(?<X2059652>)|[^:]{1,40}sec\s*(?:4|for)ever\s+shell(?<X2060480>)|[^\*\+\[]{99,200}(\w{1,20})\h*=\h*form\.getvalue\([^\)]+\)[^<\+\*]{9,200}\+['"]<pre>['"]\s*(child_std)in,\h*\47out\h*=\h*os\.(?:popen\d?|system|exec\w{0,3})\(base64\.b64decode\(\46(?<X2155151>))))|[^\v]{1,49}/perl[^@]{9,299}\b(socket)\h*\(\h*\49,\h*PF_INET,\h*SOCK_STREAM[^;]{1,49};\s*connect\h*\(\h*\49,[^;]{1,99};\s*(?:open\h*\(\h*STD(?:IN|OUT|ERR),\h*['"]>&\49['"]\h*\);\s*){3}system\h*\(\h*['"][^\s'"]{1,49}/(?:ba)?sh\b(?<X2149380>)|\-+do\-not\-change\-the\-following\-[^<]+<(FilesMatch)\h*['"]\^\((?:[\w\-]+\.php){1,5}[^\)]*\)\$['"]>\s*Order\s*(?:deny,allow|allow,deny)\s*allow\s*from\s*all\s*</\51>\s*\Z(?<X120361441>)|\h*Coded\h*by\h*Sole[^\.]{0,99}\bDirectoryIndex\h*solevisible\.(?:php\d*|p?html?)\b[^#]{0,99}\bReadmeName\b(?<X2227162>))|%pdf[\d\-]+<\?[ph\s]+class\h*(\w{1,20})[\{\s]+function\h*_+construct\(\)[\{\s]+\$\w{1,20}[\h=]+\$this\->[^\-]{1,9}\->(\w{1,20})[^\?#&\*]{4000,}\bvar\h*\$\55[\h=]+['"][^'"]{99,400}['"];[\}\s]+new\h*\54\(\);\s*(?:\?>)?\s*\Z(?<X2225540>)|(<!DOCTYPE (HTML)>)<\58[^>]{1,99}>\s*<(head>)\s*<(body>)\s*<(script)\h+src\h*=\h*['"]https?://goo\.gl/U5ny7C['"]>\h*</\61>\s*</\60\s*</\59\s*</\58>\s*\57[^\}]{99,999}progid:DXImageTransform\.Microsoft\.gradient\(startColorstr(?<X2145241>)|(<\?php)\h+(?:/\*(?:[a-z\h]{5,60}\*/\?>\s*\63[^://]{200,900}\bcurl_setopt\h*\([^,]{1,20},\h*CURLOPT_URL,\h*['"]https?://[^\.]{1,15}(?:pill|med|drug)shop\.\w{2,6}[^\)]+\);[^\+]{200,700}\bfile_put_contents\h*\([^;]+\);\s*\w{1,20}\(['"]chmod\h*\+x\b(?<X2178370>)|\h*\w{20}\h*\*/\s*\?>\s*\63\s*(\$\w{1,20})\h*=\h*\$_(SERVER)\[['"]\66_ADDR['"]\];\s*\65\h*=[^\?\}@]{99,600}\}\s*if\(\$_[GPRSC]\w{2,6}\[\65\]\)\s*\{\s*(\$\w{1,20})=['"]var\h+\w{1,20}\h*=[^"\$#]{400,2000}["];\s*echo\h+['"]\67['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*echo\h+["']<scr[^;]{9,99};\?>(?<X1163331>))|@?file_put_contents\(['"][^'"]{1,20}['"]\h*,\h*['"]\63\h+@?extract\h*\(\$_[GPRSC]\w{2,6}(?:\[[^\]]+\])?\);\s*\$\w{1,20}\((\$\w{1,20})\h*,\h*\$\w{1,20}\);\s*@?\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]?\69['"]?\)?;\s*\?>['"]\);\s*(?:\Z|\?>)(?<X1155330>))|(<\?php\s*echo\h*['"]\W{1,20}\.(rand\(0,\d+\))\.[^\?]{1,20}\?>)[^#]{1,199}(?:\$\w{1,40}\h*\.=\h*['"]\w{1,9}\d?\s*:\h*['"]\h*\.\h*\$_POST\[["'][^;]+;\s*){3}[^\?]{1,399}\?>\s*\71[^>]{1,49}>\s*window\.top\.location\.href\h*=\h*[^\.]{1,20}\.php\?sessionid[^\(]{1,20}(?:md5|sha[1256]{1,3})\(\72[^#]{1,99}\71(?<X2180742>)|(?:(<\?php)\s*/\*[^\*\n]{1,49}\*/\s*\?>){1,2}\74[^\{]{99,299}if\(\s*\$_[GPCSR]\w{2,6}\[\s*['"]\w+['"]\s*\]\s*\)\s*\{[^\}\{]{1,99}\bcopy\(\s*(\$_FILES\[\s*['"]\w+['"]\s*\]\[)['"]\w+['"]\s*\]\s*,\s*\75\s*['"]\w+['"]\s*\][\)\s]{2,9}(?<X2131200>)|(?:<\?[ph\s]*)?(\w+)\(['"]YTo[^'"]+['"]\);function\s*\77(\(\$\w+\))\{list\([^\)]*(\$\w+)\b[^=]+=unserialize\(base64_decode\78\)+;(\$\w+)=file_get_contents\((\$\w+)\);[^\?]{1,199}(\$\w+)=str_i?replace\([^,]+,[^,]*\79\b[^,]*,\80\b[^\?]{1,199}\bunlink\(\81\);file_put_contents\(\81,\82\);touch\(\81\b[^;]+;\}\s*(?:\?>\s*)?\Z(?<X2226061>)|(?:<a\h+href=['"]?http?://[^>]+>[^</]{0,49}</a>\s*(?:&nbsp;\s*)?){1,10}<\?[ph\s]+(?:\$\w+[\s=]+['"][^'"]+['"];\s*){2,}(\$\w+)[\s=]+base64_decode\s*\([^;]+;\s*\$\w+[\s=]+(?:\84[\[\{]\d+[\]\}]\s*\.\s*){10}[^#]{9999,}\bunset[\s\(]+(?:\$\w+[\s,]+){4,}\$\w+[\s\)]+;\s*@?(?:exit|die)\b[^;]*;[^\n\w\$]+\$[^\(;\?>]+\(\);\s*\?>(?<X1206150>)|(?:<a\s+href=['"](\w{1,40}\.html?)['"]\h*>\s*\86\s*</a>\s*(?:<br\s*/?>\s*)?){9}[^\?:\$\+%!\-\+&\*#@\{\}\(\),\|;]{65000,}<a\s+href=['"](\w{1,40}\.html?)['"]\h*>\s*\87\s*</a>\s*(?:<br\s*/?>\s*)?\Z(?<X2170731>)|(?:window\.location\.(?:replace\(|href=)['"]https?://(?:\w{1,19}\.)?cartoonmines\.com/[^'"]+['"]\)?;){2}(?<X1233550>)|(Order\s+allow[\s,]+deny\s*)Deny(\s+from\s+all)\s*<(FilesMatch)\s+['"]\^\((?:[^\)]{0,199}\.php\d*\|){3}[^>]+>\s*\90\s*Allow\91\s*</\92>\s*(?:ErrorDocument\s+40[43]\s*['"][^\n]{0,499}<meta\s+http\-equiv=['"]?refresh['"]?\s+content=['"]\d+;\s*URL=https?://[^:@]{1,199}>[\s'"]{0,9})+\Z(?<X2216340>)|/(?:/\s*Some\.devices\.are\.designed\b[^@\*]{499,1499}\bfunction\s+setCookie\([^@]{99,999}//\s*Finally,\s*every\b[^/;\*\{\(@=]{1,99}\bsoftware\.patents\.(?<X1155292>)|\*\w{5,50}\*/\s*<\?(?:php|=)?\s*(\$_\w{1,9})\h*=\h*chr\(\d{1,3}\)\.[^;]{9,50};\s*(?:(\$_\w{1,9})\h*=\h*(?:\95\(\d{1,3}\)\.){9}[^;]{9,99};\s*){2}(\$_)\h*=\h*\96\(,\$_\w{1,9}\);\s*@?\97\(\);\s*(?:\?>|\Z)(?<X1156321>)))
\A\s*<\?(?:(?:php|=)\s*if\h*\(\h*\$_GET\h*\[[^\]]+\]\h*\D{2,3}\h*['"][\w\s]{1,40}['"][\s\)]+\{\s*@?(?:eval|assert)\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*){1,5}['"][^'"\v\}]{299,999}['"][\h\)]+;\s*\}\s*\?>(?<X1161922>)|(?:php|=)\s+(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\2\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\2\);\s*\}[^\?>]{0,40}\}\s*(?:\?>|\Z)(?<X1153320>)|.{0,40}\$ipv?[\s=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\s*\.?=[^;]{1,200};\s*){3,8}@?mail\([^)]{1,80}\)\s*;\s*(?:\?>|\Z)(?<X2052314>)|[=ph\s]+@null;\s*(\$\w+)[\h=]+['"](?:\\x[a-z0-9]{2}){100}[^'"]{9999,}['"];\s*(\$\w+)[\h=]+['"](?:\\x[a-z0-9]+){9,99}['"];\s*@?eval[\(\h]+['"]\?>['"]\.\6[\(\h]+\5[\)\h]+;\s*(?:\?>)?\Z(?<X2226940>)|[^;\$\(\{!,\?<>'"]{0,49}\berror_reporting[\h\(]+(?:0|NULL|False)[\h\)]+;[^\n\$\r]{0,199}\bdefine[\h\(]+['"]\w+['"][\h,]+__FILE__[\h\)]+;\h*if[\h\(]+!(function)_exists[\h\(]+['"]([^'"\w]{1,199})['"][\h\)\{]+\8\h+\9\h*\([^\n\r@]{1,4999}\beval\h*\([^\n\r]{19999,};\s*(?:\?>\s*)?\Z(?<X2220320>)|[^;\(\)/]{49,}//[^/'"\$;\(\)\s]{0,19}\b(?:fb\.me|facebook\.com)/chlboo9\b(?<X2213610>)|[^\$;]{0,99}\$(xNot)\d?[=\s]+['"][^\(;]{600,4000};\s*@?eval[\s\(]+(?:\w+[\s\(]+)+\$\12[\s\)]+;\s*(?:\?>\s*)?\Z(?<X2207291>)|[^\$\?><=]{9,99}\?>\s*<(form)\s+method\s*=\s*['"]POST['"][^\?]{69,99}?</\14>\s*<\?[ph\s]+(?:echo\s*)?(?:\(\s*)?@?copy[\s\(]+(\$_FILES\[['"][^'"]{1,40}['"]\]\[)['"][^'"]{1,40}['"]\][\h,]+\15[^;]{9,60};\s*(?:\?>|\Z)(?<X1057081>)|[^\$]{0,199}\berror_reporting[\h\(]+(?:0|Null|False)[\h\)]+;[^\$]{0,499}://github\.com/EagleTube\b(?<X2216280>)|[^\]]{0,600}\$(?:login|user|uname|username|email)\s*=\s*\$_POST\[[^\]]+\];\s*\$(?:pw|passwd|psw|password|pwd)\s*=\s*\$_POST\[[^\]]+\];[^\?]{0,149}\$message\s*[\.\+]?=[^\?]{90,999}\bmail\s*\((?<X2122748>)|[hp\s]*error_reporting[\(\s]+0[\)\s]+;\h*\w+['"]<form\h*method[\h=]+['"]POST['"]\h*enctype[\h=]+["']multipart/form-data['"]>[^\$\?\[]{9,99}<\s*/form>['"][\s;]*@?(?:move_uploaded_file|copy)[\h\(]+\$_FILES\[['"]\w['"]\][^;]*;\s*echo[\s\(]*['"]\s*<a\s*href[\h=]+['"][\h\.]+\$_FILES[^;]*;(?<X2264810>)|[hp\s]+(\$\w+)[\s=]+['"]https?://[^'"]*(?:se(?:ks|xy?)|porno?|escort[sz]?)[^;]+;\s*if\s*\([^\}\{;]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;\{\}]+\{[^\}]+\bheader[\s\(]+['"]Location:\s*(?:['"][\s\.]+)?\20['"]?[\s\)]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\})+[^\?\{=\$]{0,49}\?>(?<X1202860>)|[hp\s]+@?require(?:_once)?\h*['"](?:images?|imgs?)/\w{1,3}\.(?:png|jpe?g|ico)['"]\h*;\s*(?:\?>|\Z)(?<X1189630>)|[hp\s]+[^\$;]{1,499}\bphpscam\.com\b(?<X2202960>)|[ph=\s]+@?null;[^\(]{0,199}(\$\w{1,15})[\h=]+\$\w{1,15}\([^\)]+\);\s*(\$\w{1,15})[\h=]+(?:\24\{\d+\}\.){3}[^;]+;\s*[^\(]{99,199}\25[\h\.=]+(?:\24\{\d+\}\.){3}[^;]+;\s*eval\(\25\(['"][^'"]{9999,}['"]\)\);\s*(?:\?>|\Z)(?<X1210480>)|[ph=\s]+false;\s*parse_str[\s\(]+['"]\d+=%[^&=;'"]+&[^;]+;\s*(\$\w{1,40})\[\d+\][\s\(]+\27\[\d+\][\s,]+(array)\s*\(\)[,\s]+\28\s*\(\s*['"][^'"]*['"]\s*\.\s*\27\[\d+\][\s\(]+\27\[\d+\][\s\(]+\27\[\d+\][\s\(]+['"]=?=?[a-z\d/\+]{99,}['"][\s\)]+\.\s*['"][^'"]*['"][\s\);]+(?:\?>\s*)?\Z(?<X2202641>)|[ph@\s]*require(?:_once)?\s*__DIR__\s*\.\s*['"]/filter\.php['"][;\s*](?:\?>|\Z)(?<X1273460>)|[ph@\s]+(?:(?:eval|assert|system|shell_exec|exec|popen|passthru|pcntl_exec)\([^\)]+\);){40}\s*[^\?\$=<>\{\}]{9,9999}exit[^;]{0,9};?\s*(?:\?>|\Z)(?<X1061184>)|[ph@\s]+include\s*['"][^'"\.]+\.(?:png|jpe?g|ico)['"]\s*;(?:\s*\?>)?\s*\Z(?<X2198350>)|[ph\h@]*require(?:_once)?[\(\h'"]+/home\d*/[^/\n]+/[^'"\n]+/[^'"\n]{1,40}\.txt['"\)\h]+;\s*/\*\s*[a-f\d]{32,64}\s*\*/\s*\?>(?<X1219571>)|[ph\h]+if[\h\(]+strpos[\h\(]+\$\w+,\h*['"]\.php['"][\s\)]+\{\h*\$(main_shell)[\h=]+\$[^;]+;\h*(\$\w+)\[['"]\34['"]\][\h=]+\$\34;\h*\}\h*else\h*\{\h*\$\34[\h=]+[^\n]{99,599}\bgetServerCont[\h\(]+\$\w+,\h*\35[\h\)];\h*\}[^\?]{0,19}\?>(?<X1238610>)|[ph\s*]+error_reporting\(0\);\s*if\(function_exists\([^\?]{99,199}\bcurl_init\(\);\h*curl_setopt\(\$\w+,[^%#\n]{199,1600}\bbase64_encode\(\$\w+\.(\$_SERVER\[)[^\]]+\]\.\37[^\]]+\]\);\h*(\$\w+)=urlencode\(\37[^;]+;\h*if\(strpos\(\38,\h*['"]favicon\.ico['"]\)\h*\W{2,5}false\)\{\s*\?>(?<X1312010>)|[ph\s=]*(?:\$_+\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]+['"]\s*;\s*)+(\$\w{1,40})\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]{999,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"][\s\.]+\$\{['"][\\xa-f\d]{4,}+[""]\}(?:[\s\(]+\$\{['"][\\xa-f\d]{4,}+['"]\})+\(\40[\s\)]+;[^=]{0,499}\Z(?<X1225190>)|[ph\s=]+(\$\w+)[\h=]+['"]PD9waHAK[^'"]{600,1500}['"];\s*\?>\s*<\?[ph\s=]+@?eval[\h\(]+['"]\?>["'][\h\.]+[\h\(]*base64_decode[\h\(]+\42[\h\)]{2,3};\s*__halt_compiler[\h\(\)]{2,6};\s*\?>\s*\Z(?<X2232021>)|[ph\s@=]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*base64_decode[\s\(]*['"][^'"\$]{2,40}['"][\s\);\?>]*\Z(?<X2266472>)|[ph\s@]*(\$\w{1,40})[=\s]+['"][^\v]{40,199}['"]\s*;\s*(\$\w{1,40})[=\s]+\45\[\d+\](?:[\.\s]+\45\s*\[\d+\])+\s*;\s*(\$\w{1,40})[=\s]+\45\[\d+\](?:[\.\s]+\45\s*\[\d+\])+\s*;\s*@?eval[\s\(]+(?:(?:\46|\47)[\s\(]+){2,}\45\[\d+\](?:[\.\s]+\45\s*\[\d+\])+[\s\)\?>;]+\Z(?<X2221590>)|[ph\s@]*(\$\w{1,40})\s*=\s*strrev\s*\(['"\.base64_dcogztunmprs13v]{9,52}\)?\s*;\s*@?eval\s*\(\49\([^\)]{1,199}\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1132332>)|[ph\s@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*__DIR__[\h\.]+['"][^'"\$]+\.txt['"];\s*/\*\s*[a-f\d]{14,64}\s*\*/\s*\?>(?<X1224105>)|[ph\s@]*require_once[\(\s'"]+/tmp/[^'"]+['"][\)\s]*;\s*(?:\?>|\Z)(?<X1209090>)|[ph\s\(@]*include(?:_once)?\s*\176\s*uRlDeCoDe\s*\(\s*['"]%[%a-f\d]{9,}['"][\)\s]+\.\s*__filE__(?<X2266240>)|[ph\s]*(?:\$\w{1,20}[\h=]+['"]?(?:\w|\\|chr\(|\.)[^'"]{0,9}['"\)]\.[^;]{9,};\s*){5}[^\^\n]{99,999}\barray_slice\b[^\?#\n]{99,9999}@\$\w{1,20}[\h\(]+(\$\w{1,20})[^\)]+\);\s*echo[^\(]{2,40}\bsubstr[\h\(]+\54[,\h]+strlen[^;]+;\s*(?:exit|die)\b[^;]*;[\}\s\?>]+\Z(?<X2241011>)|[ph\s]*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?\$\w{1,40}\s*=\s*['"]https?://\d+\.\d+\.\d+\.\d+[^;]+;\s*function\s*\w+\s*\([^\n]{999,}\becho\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;[\s\}]+else\s*\{\s*@?header[\(\s]+['"]HTTP/\d+\.\d+\s+404[^'"]*['"][\)\s;\}]+(?:\?>|\Z)(?<X1231140>)|[ph\s]*(\$\w+)=['"]https?://['"]\.\$_SERVER\[['"]HTTP_HOST['"][^;]+;(\$\w+)=file_get_contents\(\57\);(?:\58=preg_replace\([^;]+,\58\);){4}[^#@&]{1,1999}\$\w+=['"](https?://[^'"/]+/)[^;\?]{0,99}\.php\b[^#:/@]{1,499}\becho\s*['"]<script\b[^>]{0,99}\bsrc=['"]?(?!\59)https?://[^;]+;\}else\{echo\s*['"]<script\b[^>]{0,99}\bsrc=['"]?\59(?<X2233392>)|[ph\s]*(\$\w+)=file_get_contents\(['"]/home/[^;]{1,199};(\$\w+)=\w+\([^;]{0,99}\61\b[^;]{1,99};eval\(\62\);(?:\?>|\Z)(?<X1226950>)|[ph\s]*(\$\w+)=range\([^;]+;(\$\w+)=\$\{(?:\64\[\d+\]\.)+\64\[\d+\]\};if\(in_array\(gettype\(\65\)[^;\{]{1,199}\{(?:\65\[\d+\]=\65\[[^;]{1,199};)+\65=\65\[[^;\(\}]{1,199}\(\65\[[^;]{1,199};\65\(\);\}\s*(?:\?>|\Z)(?<X1211460>)|[ph\s]*(\$\w+)=urldecode\(['"][^;]+;\$\w+=(?:\67\[\d+\]\.){3}[^@#:/\*]{999,9999}\67\[\d+\]\.\67\[\d+\];(\$\w+)=['"][^@]{4999,14999}=\w+\(['"]https?://google\.co(?:m|\.jp)['"/][^\?]{1,199}\bheader\(\$\w+[\);\}]+echo\s*\$\w+\[[^;]+;(?:die|exit)\b[^;]*;\}*\w+\(\68\);\s*(?:\?>|\Z)(?<X1228770>)|[ph\s]*(\$\w+)[\h=]+['"][^'"]+['"];\h*function\h*(\w+)[\h\(]+\70[\h\)\{]+\$\w+\h*=[^\?\n]{99,2999}\bforeach[\h\(]+\$_POST\h*as\h*\$\w+\h*=>\h*(\$\w+)[\h\)\{]+[^\{]{0,99}\{\h*\72[\h=]+\71\(\72\);[^\?\n]{0,550}\bdie[\h\(\);\}]+\Z(?<X2259773>)|[ph\s]*(\$\w+)[\h=]+\$(?:\{['"]_COOKIE['"]\};\s*if[\h\(]+isset[\h\(]+\74\h*\[[^\{]+\{\s*\$\w+[\h=]+\74\h*\[[^\}]{0,199}(\$\w+)[\h=]+__DIR__[\h\.]+\$\w+[\h\(]+\$\w+[\h\(]+\74\h*\[[^\]]+\][\h\)]+;\s*\$\w+[\h\(]+\75[\h,]+\$\w+[\h\(]+\$\w+[\h\(]+\74\h*\[[^\]]+\][\h\)]+;\s*include[\h\(]+\75[\h\)]+;[^\}]{0,99}\}\s*\Z(?<X2236972>)|_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\h\(]+\74\h*\W{2,3}['"]\w{32,64}['"][\h\)\{]+[^\n\?]{9,399}\bfile_put_contents[\h\(]+[^\)]+\);\h*(chmod)[\h\(]+[^\n\?]{0,199}\bmkdir[\h\(]+(\$\w+)[\h\)]+;\s*\77[\h\(]+\78,\h*\d+[\h\)]+;[^\}]{0,99}[\}\s]+(?:\Z|\?>)(?<X1251341>)|_COOKIE[\s;]+(\$\w+)[\h=]+['"][^'"]+['"][\s;]+if[\h\(]+\74\[\80\[[^\{]+\{\s*eval[\h\(]+base64_decode[\h\(]+str_rot13[\h\(]+\74[\h\[]+\80[\h\[]+\d+[\]\)\h]+;[\s\}]+(?:\?>|\Z)(?<X2239071>)))
\A\s*(?:;\(function\([^\)]+\)\{\w=\w\.createElement\(\w\);\w=\w\.getElementsByTagName\([^\}]{1,99}\}\)\(window,document,['"]script['"],['"]https?://[^/]+\.asi\.services/[^'"]+['"]\);(?<X1234370>)|<(?:!DOC(?:\w+\s*(HTML)>\s*<\2\s*lang=[^><]+>\s*<(head>)\s*<meta\s*charset=['"][^<>]+>\s*<meta\s*(http)\-equiv=['"]refresh['"]\s*content=['"]0;\s*url=\4[^<>]+>\s*<(script)[^<>]*>\s*window\.loc[^'";]+['"]\4[^<>]+</\5>\s*<(title>)Loading[^<>]*</\6\s*</\3\s*<body>[<\?ph\s]*header\(['"]Location:\s*\4[^=]{9,99}\Z(?<X2284680>)|TYPE(?: html>\s*<!--\s+saved\s+from\s+url=.{200,600}https?://login\.live\.com(?<X2052000>)|[^>]{0,100}>\s*<html>\s*<head>\s*<title>\s*Hacked\s+By\b(?<X2049632>)|[^\?]{0,99}\bhref\h*=\h*['"]https?://(?:www\.)[^\.]{0,40}(jerseys)[^\.]{0,20}\.com/['"]>\h*cheap\h*(?:\w+)\h*\10[^\?]{1,49}</html>\Z(?<X2184680>)|[^\?]{1,400}<title>\s*(?:Sign\s+In\s*-)?\s*DocuSign\s*</title>(?<X2052863>)|[^\?]{1,99}<title>[^'"\?]{9,50}<form\b[^!\(\?]{9,299}<\?php\s*if\(!empty\((\$_FILES\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,15})\h*=[^=]{1,40}=\h*\14[\h\.]+basename\(\h*\13\[[^\]]+\]\);[^\{]{0,99}if\(@?(?:move_uploaded_file|copy)\(\13\[[^\]]+\],\h*\14[\)\s]+(?:\{\s*echo[^\}]{0,99}\}(?:\s*else)?\s*)+\}\s*\?>\s*\Z(?<X2143179>)|\h+HTML>\s*<html\h+xmlns\h*=\h*['"](http)s?:[^:]{1,99}<(script)\h+src\h*=\h*['"]\16s?://goo\.gl/\w{6,8}['"]>\s*</\17>\s*</body>[^\[#]{9,999}<(title>)\s*[^/]{9,99}</\18[^\[#:!]{9,999}<link\h+href\s*=\s*['"]\16s?://(?:www\.)?[^/]{0,40}(?:jersey|viagra|cialis|pharm|cheap)[^/]{0,40}\.\w{2,9}/(?<X2145982>)))|%\s*(?:Server\.ScriptTimeout=\s*\d+\s*)?UserPass\s*=\s*"[^"']+"[^:]{9,199}mName(?:title)?\s*=\s*"[^"']+"[^:]{1,299}"[^'"]{0,19}7jyewu\.cn(?<X2124911>)|(?:!Doctype\h*)?html\b[^:\\]{9,150}<meta\h+http\-equiv\h*=\h*['"]refresh['"]\s+content\h*=\h*['"]\d;\s*url\h*=\h*https?://cyb3r\-3rr0r\.com\b(?<X2183510>)|(?:\?php)?\s*(\$\w{1,40})\h*=\h*(error_reporting\h*\()\);\s*\23(?:\d|NULL|False)\);[^\|]{1,4999}\$(\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{0,99};[^\?]{1,499}\}\s*else\s*\{\s*@?file_put_contents\h*\([^,\);]+,\h*\$\24\h*\);[^\?]{1,199};\s*@?\23\h*\22\h*\);\s*\}\s*(?:\?>|\Z)(?<X1180840>)|(FilesMatch)\s+['"]\.\(php\|php5\|phtml\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s*Deny\s+(from\s+all)\s*</\26>\s*<\26\s+['"]\^\(index\.php\)\$['"]\s*>\s*(?:#[^</]{0,19})?\b\27\s*Allow\s+\28\s*</\26>\s*\Z(?<X2220781>)|(html>)\s*<div\h+id\h*=\h*['"][^'"]{9,99}['"]\h+style\h*=\h*['"]\h*(?:left|right|top)\h*:\h*\-\d{4,8}px\h*;\h*position\h*:\h*absolute\h*;\h*top\h*:\h*\-\d{4,8}px\h*;\h*['"]\h*>\s*<p>[^\?@\!\*\$\[\{]{99,9999}?(?:viagra|jerseys|pharm|cheap)[^\?@\!\*\$\[\{]{99,9999}?</p>\s*</div>\s*</\30(?<X1147440>)|(script)(?:[^>:\v]{0,60}\bsrc\h*=\h*['"](?:http:)?//[1-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}/[a-z\d]{1,3}\.js['"]\h*>\h*</\32>(?<X1172530>)|\b[^:>\.]{1,60}\bsrc\h*=\h*['"]https?://(?:\d*\.){3}\d*/[^'">]{2,60}/[jw]{0,2}(?:player|query)\.js['"][^>]{0,60}>\s*</\32>(?<X1161202>)|\h+(?:type\h*=\h*['"]text/javascript['"]\h*|async\h*|src\h*=\h*['"]https?://[^\?]{4,30}/\w{1,9}\.min\.js\?\w{1,9}\h*=\h*\w{1,9}&['"]){2,3}></\32\>(?<X1147743>)|\h+(?:type\h*=\h*['"]text/javascript['"]\h*|async\h*|src\h*=\h*['"]https?://[^\?]{4,30}\.(?:pl|jp|pl|in|cn|ru|su|xyz)/\w{1,9}\.js&['"]){2,3}></\32\>(?<X1148232>)|\h+(?:type\h*=\h*text/javascript\h*|src\h*=\h*['"]https?://(?:track|stats)\.[^=\?]{2,30}/\w{1,3}\.js\?\w{1,4}=\d+\h*|async\h*){2,3}['"]>\s*</\32>(?<X1157044>))|(script>)\h*var\h*(\w{1,40})[\h=]+['"]https?://(?:www\.)?sale\w+\.\w{2}/\?\w{1,9}=\w+['"];\h*window\.location\.href[\h\=]+\39;\h*</\38(?<X1192521>)|(span)\h*class[\s=]+['"][^/?]{1,150}\b(?:height|width):\h*(?:0|1)px[^\?]{1,150}\bhref[\h=]+['"]https?://(?:\w*\.)?xpsoccer\.\w*[^>]{1,5}>important\s*source[^\?]{1,20}</\41>(?<X1209161>)|(title>)[^/<]{0,20}\bRansomware\h*</\43(?<X2174990>)))
\A\s*<\?(?:[ph\s]*class\s*(\S+)\s*\{\s*private\s*\$\S+\s*=\s*['"]cookie['"]\s*;\s*private\s*\$\S+\s*=\s*['"]call['"]\s*;[^\n]{40,}\}\s*(?:\$\w{1,40}\s*=\s*)?new\s*\1[^;]*;[\s\?>]*\Z(?<X2249530>)|[ph\s]*echo\s*@?file_get_contents[\(\s]+['"]https://raw\.githubusercontent\.com/[^/]+/backlink/[^'"]+\.txt['"][\)\s]+;\s*\?>(?<X1221790>)|[ph\s]*error_reporting[\(0\)\h]+;\s*(\$\w{1,25})[\h=]+['"]range['"];\s*(\$\w{1,25})[\h=]+\4[\h\(]+['"]\176['"][^\)]+\);\s*(\$\w{1,25})[\h=]+\$\{\5\[\d[^;]+;\s*\(count[\h\(]+\6[\h\)][\h=\(\)\d&\+]+in_array[\h\(]+gettype[^;:]+:\h*\6;\s*class\h*(\w+)\h*\{\s*[^#]{999,1700}\7::\w+[\h\(\)]+;\s*\?>(?<X1227833>)|[ph\s]*eval[\(\s]+base64_decode[\(\s]+str_rot13[\(\s]+\$_POST\s*\[[^\]]+\][\)\s;]+(?:exit|die)[;\s]*\Z(?<X2279541>)|[ph\s]*extract\(\$_[GPCSR]\w{2,6}\);if\(function_exists\((\$\w+)\)+\{\10\((\$\w+)\);\}else\{(\$\w+)=\11;[^\}]{0,499}\$(\w+)=popen\(\12,[^\}]{1,499}\$(\w+)\.?=fread\(\$\13,[^\?]{0,199}\becho\s*\$\14;\}*(?:die|exit)\b[^;]{0,19};\?>(?<X1229580>)|[ph\s]*function(?:\h*\w+[\s\(\)\{]+echo\h*\d+;\s*\}\s*\$\w+[\h=]+['"][^\}]{99,999}[\s\}]+return\h*\$\w+;[\s\}]+(\$\w+)[\h=]+\$_COOKIE;\s*(\$\w+)[\h=]+\$_POST;\s*\$\w+[\h=]+array_merge\(\17,\h*\16\)[^\}]+\}\s*elseif\h*\([^\{]+\{\s*(\$\w+)[\h=]+sprintf\([^\}]{9,399}\$\w+\(\18\);\s*\}\s*exit[\s\(\);\}]+\Z(?<X2238712>)|\s*(\w+)[\(\s]+(\$\w{1,40})[\)\s\{]+\21[=\s]+gzinflate[\(\s]+@base64_decode[\(\s]+\21[\)\s;]+for[\(\s]+(\$\w{1,9})[=\s]+\d+;\s*\22<strlen[\(\s]+\21[\)\s;]+\22\++[\)\s\{]+\21\[\22\][=\s]+chr[\(\s]+ord[^=]{0,99}return\s*\21[;\s\}]+define[^;\$]+;\s*@?eval[\(\s]+\20[\(\s]+['"][^'"]{999,}['"][\)\s;>\?]+\Z(?<X2225891>)|\s*(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s\{]+(\$\w{1,40})[=\s]+(curl_)init[\s\(\);]+\27setopt[\s\(]+\26[\s,]+CURLOPT_URL[,\s]+\25[^=]{1,199}\$\w{1,40}[=\s]+\27exec[\s\(]+\26[^=:]+\}\s*\25[\s='"]+http://[^/]{1,40}/[^'"]{1,199}\.txt['"\s;]+(\$\w{1,40})[=\s]+base64_decode[\s\(]+\24[\s\(]+\25[\s\);]+eval[\s(]+\28[\s\);]+\?>(?<X1221930>))|[ph\s]*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{(\$\w+)=fopen\(['"][^'"]+\.php['"],[^;]+;fwrite\(\30,file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+;fclose\(\30\);\}\s*(?:\?>|\Z)(?<X1226900>)|[ph\s]*require(?:_once)?[\(\s]+['"][^'"\$]+\.mo['"][\)\s;\?>]+\Z(?<X2234560>)|[ph\s]+(/\*[\s\w]+\*/)\s*(\$user_auth_cookie)[\s=]+['"][^;]{64000,};\s*@?(?:assert|eval)[\s\(]+\34[\s\)]+;\s*\33\s*(?:\?>\s*)?\Z(?<X2212250>)|[ph\s]+(?:@?(?:error_reporting|set_time_limit)[\s\(]+(?:0|NULL|False)[\s\)]+;\s*)+(function)\s+(\w+)\s*\([^:/]{1,499}\}\s*@?header[\s\(]+['"]Content\-type[\s:]+text/html\b[^\)]+\);\s*(\$\w+)[\s=]+\37\s*\([^;]{999,};[\}\)\s'";]+(\$\w+)[\s=]+create_\36[\s\(]+['"]{2}[,\s]+\38[\s\)]+;\s*\39\(\);\s*(?:\?>|\Z)(?<X1210660>)|[ph\s]+(?:@?(?:ignore_user_abort|set_time_limit)[\s\(]+\d+[\s\)]+;\s*){2}[^%!<>\+]{1,1999}\b(?:if\(stri?str\(\$\w+\[[^;\{]{1,499}\{[^\}]{1,199}\bexit;[\s\}]+){3}[^\?]{1,499}['"]Sitemap\s+Notification\b[^\?]{1,1499}\bfunction\s+\w+\s*\([^\{;]+\{\s*@?file_put_contents\s*\([^;]+;[\s\}]+(?:/[/\*][^;\?]{1,99})?(?:\?>|\Z)(?<X1213920>)|[ph\s]+(?:\$\w{1,20}[\h=]+['"]?(?:\\\d|chr|\\x|\w|\.)[^\.]{0,10}['"]?\.[^;]{4,200};\s*){5}[^\?&!]{999,2500}@\$\w{1,20}[\h\(]+(\$\w{1,20})[^\)]+\);\s*(\$\w{1,20})[\h=]+[^\(]{1,40}\bsubstr[\h\(]+\42[,\h]+strlen[\h\(]+[^;]{1,40}\);\s*echo\h*\43;\s*(?:exit|die)[^;]{0,9};[\}\s]+\Z(?<X2249821>)|[ph\s]+(?:\$\w{1,25}[\h=]+['"][^'"]{2,150}['"];\s*){1,3}\$\w{1,25}[\h=]+\$_POST;\s*\$\w{1,25}[\h=]+\$_COOKIE;\s*(?:\$\w{1,25}[\h=]+['"][^'"]{2,150}['"];\s*){1,3}(\$\w{1,25})[\h=]+implode\([^\)]+[\h\)]+;[^#]{99,799}\binclude[\h\(]+\45[\h\(]+[^\{]{1,99}\{\s*\$\w{1,25}[\h=]+\@?\45[\h\(]+[^\?]{0,99}\?>(?<X1226680>)|[ph\s]+(?:if[\s\(]+!?(file_)exists[\s\(]+['"]([^'"]{0,49}/wp\-\w{1,9}/[^'"]+)['"][\s\)]+\{\s*(\$\w+)[\s=]+@?\47ge(t_contents[\s\(]+)['"]https?://[^;]{1,99};\s*@?\47pu\50['"]\48['"][\s,]+\49\s*\);[\s\}]+){3,}(?:\?>|\Z)(?<X1190521>)|[ph\s]+(?:if\s*\([^;\{]{0,99}\$_SERVER\[["']HTTP_USER_AGENT['"][^\{;]+\{\s*){2}class\s+(\w+)\s*\{[^\?]+\bfunction\s+(\w+)\s*\([^\{;]+\{\s*(\$\w+)[\s=]+\$_COOKIE;[\s\(]+\54\s*&&[^;]+&&\s*@?eval[\s\(]+\$\w+[\s\)]+:\s*\54;\s*return\s+\52::\w+\s*\([^;]{19,};[\s\}]+\53\(\);\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1222680>)|[ph\s]+(\$\w+)=(?:array\(|\[)[^\?]{0,499}\$(\w+)=curl_exec\([^;]+;(\$\w+)=[^;]*\$\57\b[^\?]{0,499}\56\[[^\]]+\]\(['"]{2},[^\)]*\58\b[^;]+;(?:die|exit)\b[^;]{0,19};\W*(?:\?>|\Z)(?<X1208460>)|[ph\s]+(\$\w+)=ABSPATH\.['"]/?wp\-(?:admin|includes)/[^'"]+\.php['"];if\(file_exists\(\60\)+\{?(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?\60\s*(?:\)\s*)?;\s*(?:\}\s*)?(?:\?>\s*)?\Z(?<X2210701>)|[ph\s]+(\$\w+)[=\s]+['"][^'"]+\.php['"];\s*\$\w+[\s=]+@?(file_)ge(t_contents)[\s\(]+\62[\s\)]+;\s*(\$\w+)[\s=]+['"]/[^;]+;[^\}\?]{0,499}(?:\$(\w+)\s*\.?=[^;]*(?:\$\66|\65)\b[^;]*;\s*){2}if\s*\([^\{\};]+\{\s*(@?chmod[\s\(]+\62\s*,)[^;]+;\s*@?\63pu\64[\s\(]+\62[,\s]+\$\66[\s\)]+;\s*\67[^;]+;[\s\}]+(?:\?>|\Z)(?<X1211080>)|[ph\s]+(\$\w+)[\h=]+["'](?:[base64_dco'"\.]{16,40}|[stro13'"\._]{12,25});[^\(]{0,40}\berror_reporting[\h\(]+(?:0|NULL|FALSE)[\h\)]+;\s*@?eval[\h\(]+(?:\$\w+\()?\69[\h\(]+['"][^'"]{400,1500}['"][\h\)]+;\s*(?:\?>|\Z)(?<X2227290>)|[ph\s]+(\$\w+)[\h=]+[^;]+;[^\{]{9,699}\{\s*global\s*\71;\s*(\$\w+)[\h=]+[^\}]{0,399}[\}\s]+return\s*\72;\s*\}\s*(\$\w+)[\h=]+\$_COOKIE;\s*\73[\h=]+array_merge\(\73,\s*\$_POST\);[^\?]{99,1100}\((\$\w+),\h*['"]<\?[^\}]{0,199}\binclude\(\74\);\s*\$\w+\(\74\);\s*\}\s*exit[\(\)\h]+;[\s\}]+(?:\?>)?\Z(?<X2233462>)|[ph\s]+(\$\w+)[\h=]+\$_COOKIE;\s*\((count)\(\76\)==\d+&&in_array\(gettype\(\76\)\.\77\(\76\),[^:]{99,699}:\76;\s*\?>(?<X1207440>)|[ph\s]+(\$\w+)[\s=]+@?file[\s\(]+['"]https?://[^;]+;\s*echo\b[^;]*\79\b[^;]*;\s*(?:\?>|\Z)(?<X1197801>)|[ph\s]+(\$\w+)[\s=]+['"][^'"]{1,199}['"][\s;]+@?file_put_contents[\s\(]+\81\s*,[^;]{0,199}\barray_slice[\s\(]+file[\s\(]+(?:\w+[\s\(]+){0,9}__file__\s*\)[^;]{0,199};\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}\81[^;]{0,99};\s*/\*\s*PD9[\w\s/\+=]+(?:\*/\s*)?(?:\?>\s*)?\Z(?<X2215442>)|[ph\s]+(\$\w+)[\s=]+\$_(?:[GPCSR]\w{2,6}\[[^;]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+['"]wget\b[^;]{0,19}\83\b[^;]+;\s*(?:\?>|\Z)(?<X1221280>)|SERVER\[['"]HTTP_USER_AGENT['"]\];\s*if[\s\(]+preg_match\s*\([^\),]+,\s*\83[\s\)\{]+header[\s\(]+['"]Location:[^;]+;\s*(?:die|exit)\b[^;]*;[\s\}]+else\s*\{[^\?]{1,999}\$(\w+)[\s=]+['"]https?://kppli\.com/[^\?]{4999,}<i?frame\b[^>]+\bsrc=[^>=]*\$\85\b[^\?]{1,99}(?:\?>|\Z)(?<X1206110>))|[ph\s]+(\$\w+)[\s=]+range(?:[\s\(]+chr\s*\([^;]+;\s*(\$\w+)[\s=]+\$\{\87\[[^;]+;\s*if[\s\(]+in_array[\s\(]+gettype[\s\(]+\88\s*\)[^\{;]+\{[^;\?]{1,199}\88[\s\(\)]+;\s*\}\s*(?:\?>|\Z)(?<X1214380>)|\s*\([^;]{1,99};\s*@?(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?(?:\87[\h\[]+\d+[\h\]]+\.\h*){4,}\87[\h\[]+\d+[\h\]]+(?:\)\s*)?;\s*(?:\?>|\Z)(?<X1210671>))|[ph\s]+(\$\w+)[\s=]+urldecode\s*\([^;]{9,499};\s*header[\s\(]+['"]Content\-type:\s*text/html\b[^\?\{]{1,999}\{\s*global\h+\91;[^\n]{9999,};\h*unset[\h\(]+\$\w+\h*,[^;]{1,999};\h*(?:die|exit)\b[^;]{0,19};[\}\h]+[0o1li]+[\h\(\)]+;\s*\?>(?<X1196920>)|[ph\s]+(\$\w+\[)\]\s*=[^;]+;\s*(?:\93\]\s*=[^;]+;\s*)+if\s*\([^;\{]{0,199}\93\d+(\]\[\93)[^\{;]{1,199}\{\s*(\$\w+)[\s=]+(?:\93\d+\94[^;]+\(\s*){2}\93\d+\94\d+[\s\]\)]+;[^\}]{0,999}\b[ir](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?\95\[[^;]+;\s*\95\[[^\]]+\][\s\(]+\95\[[^\]]+\][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1212140>)|[ph\s]+(\$\w{1,20})[\h=]+[^\$]{0,20}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)?;\s*(\$\w{1,20})[\h=]+fopen\(['"][^'"]{1,20}shell\.php\d?['"][,\h]+['"]w['"]\)[^;]*;\s*fwrite\(\98[,\h]+\97\);\s*fclose\(\98\);\s*(?:\?>)?\Z(?<X2226890>)|[ph\s]+(\$\w{1,25})[\h=]+(curl_)init\((base64_decode)\(['"]aHR0cHM6Ly9wYXN0ZWJpbi5jb20[^\)]+[\)\h]+;\s*\101setopt\(\100,[^\)]+\);\s*(\$\w{1,25})[\h=]+\101exec\(\100\);\s*eval\(\102\([^\)]+\)[\h\.]+\103\);\s*\?>(?<X1204580>)|[ph\s]+(\$\w{1,25})[\h=]+function[\s\(]+\$\w{1,25}[\s\)]+[\s\{]+(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*\$\w{1,25}[\h\=]+\106[\h\[\(]+\d+[\h\-\+]+\d+[\h\)]+[\h/\*]+\d+[\s\]\.]+\106[^\?]{999,6000}=\105[\h\(]+(\$\w{1,25})[\h\)]+;\s*\$\w{1,25}[\h\(]+\107[\s\);]+\?>(?<X1214250>))
\A\s*<\?(?:(?:=NULL;|php)\s*\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\][\h=]+['"][^'"]{1,90}['"];\s*\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\}[\h=]+['"][^'"]{400,2500}['"];\s*@?eval[\h\(]+(?:(?:htmlspecialchars_decode|gzinflate|base64_decode)\(){1,5}['"][^'"]{99,400}['"][\)\h]+;\s*(?:\?>\s*)?\Z(?<X2221292>)|(?:=|php)[^;]{1,40}\bnull;\s*echo\h*(@null);\s*goto[^\(]{200,900}\beval\([^\)]{9999,}[\)\h]+;\s*\2;\s*(?:\?>)?\Z(?<X2206680>)|(?:php)?[ ]{200,}if\s*\(\s*!\s*isset\s*\(\s*\$_[^\?]{40,150}\s*\?>\s*<\?(?:php)\s*\$\{[^\?]{60000,64000}['"],['"](?:\\x2e|\.)['"]\s*\);\s*\?>\s*\Z(?<X2055930>)|(?:php)?[^@]{150,350}\bJ7-@live\.com[^\(]{15,45}\bsession_start\(\);(?<X2144240>)|(?:php)?[^\?]{0,199}\bscam\h*was\h*created\h*by[^\n]{1,25}\boreoo(?<X2173161>)|(?:php)?[^\{]{1,1200}class\s+pBot\s*\{\s*var\s*\$(?<X2057294>)|(?:php)?\h*(\$\w{1,40})\h*=\h*['"][^'"]+['"];\h*function\h*(\w{1,40})\([^\)]+\)\{return[^;]{1,40};\}(?:\h*\$\w{1,40}\h*=\h*\9\((?:\8\{\d+\})[^;]{1,99};){4}[^\?\v]{999,1999}(\$\w{1,40})\h*=(?:\h*\9\h*\(){2}[^;]+\.\9\h*\(\h*\8\{\d+\}[^;]{1,49};\h*\$\w{1,40}\h*\([^\)]+\10\h*\.['"]//['"]\)+;\h*\?>(?<X1141070>)|(?:php)?\s*(?:(?:/(?:\*|/)[^\n/]{0,20}(?:/|\n))|\s+)\s*\$[O0]{6,12}=urldecode\(['"]%[^'"]{1,200}['"]\);(?:\s*\$[O0]{6,12}\.?=\$[O0]{6,12}\{?\d*\}?\.[^;]{2,};){2,9}\s*\$_\w{1,20}=__FILE__;\s*\$\w{1,40}=['"][^'"]{60000,}['"];\s*@?eval\(\$[O0]{6,12}\(['"]JF9[^'"]{1,999}['"]\)\);\s*(?:\?>|\Z)(?<X1057871>)|(?:php)?\s*(?:/[/\*][^\$;=]{1,999})?(\$\w{1,40})\s*=\s*file_get_contents\h*\(\h*['"]https?://[^;]{1,99};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"](?:\?>|<\?)[^'"]{0,19}['"]\h*\.\h*\13\h*\);\s*(?:\?>|\Z)(?<X1185400>)|(?:php)?\s*(?:@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]+/(?:anti)?b(?:ot|locker)[sz]\d*\.php['"];\s*){2}[^\?]{1,499}\bfunction\s+recurse_copy\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{(?<X2171261>)|(?:php)?\s*(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){2}[^@]{9,1499}<title\h*>[^/<>]{1,99}(?:Apple?|Samsung|Ama?zo?n)\h*(?:ID|Secure)[^/]{0,49}<\h*/title\h*>(?<X2141051>)|(?:php)?\s*(?:\$\w{1,40}\s*=\s*['"]\w{24,40}['"];)?\s*(\$\w{1,40})\s*\=\s*['"\s\.aceglpr_]{13,40}\s*\;\s*\17\s*\(\s*['"](.).{0,40}\18e\w?['"]\s*,[^\)]{30000,50000}(?:\s*\)\s*){1,5};[^;]{1,40};\s*\?>\s*\Z(?<X2055630>)|(?:php)?\s*(?:echo\b[^;]{1,99};\s*)?(\$\w{1,40})(\h*=\h*@?(file_)ge(t_contents)\h*\(\h*['"])[^'"]+(\.php['"]\h*\);\s*@?\22pu\23\h*\(\h*\$_SERVER\[\h*['"]DOCUMENT_ROOT['"]\h*\]\h*\.\h*['"])(/[^'"\./]+\.php['"]\h*,\h*)\20\h*\);\s*(\$\w{1,40})\21[^'"]+\24[^'"]+\25\26\h*\);\s*(?:\?>|\Z)(?<X1179631>)|(?:php)?\s*(?:echo|error_reporting|print(?:_r)?|var_dump)\s*['"\(][^;]{1,99};\s*(?:(?:(?:echo|print)\h*(?:\(?\h*)?)?@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*){1,5}(?:(?:echo|error_reporting|print(?:_r)?|var_dump)\s*['"\(][^;]{1,99};\s*)?\?>\s*\Z(?<X2172081>)|(?:php)?\s*(\$\w{1,40})\h*=\h*(?:@?fopen\([^;]{1,99};\s*@?fwrite\(\h*\29\h*,\h*['"](?:(?:[H][4a]|fu)ck|st[o0a4]mp|t[ou]ch)[3e]d\s+by\b[^;]{1,99};\s*@?fclose\(\h*\29\h*\);\s*(?:echo\b[^;]{1,99};\s*)?(?:\?>|\Z)(?<X1161180>)|['"]email:[^;]{1,99};\s*(?:(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"][^'"]{1,99}/\.(?:cpanel/)?contact(?:info|email)['"][^;]{1,99};\s*(?:(?:echo|var_dump|print_r)\h*[\('"][^;]{1,99};\s*)?fwrite\h*\(\h*\31\h*,\h*\29\h*\);\s*fclose\h*\(\h*\31\h*\);\s*){1,2}(?:\?>|\Z)(?<X1173400>)|['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\29\h*\);\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*(?:\(\h*)?(?:@?\w{1,40}\h*\(\h*){1,4}\33[\)\h]+;\s*(?:\?>|\Z)(?<X1171240>)|\$_SERVER\[[^;]{1,99};\s*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*(\$target)\h*=\h*['"]https?://(?:[^;]{1,99}(?:\29|\35)){2}[^;]{0,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\36\h*\);\s*(?:echo|print)\s*\37;\s*(?:\?>|\Z)(?<X1170630>)|file_get_contents\(\h*['"][^'"]{1,99}['"]\h*\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\h*\(\h*\29\h*\)\h*\)\h*;\s*(?:\?>|\Z)(?<X1149821>)|popen\h*\(\h*(?:\w{1,40}\h*\(\h*){1,3}\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*echo\h*fread\h*\(\h*\29\h*,\h*\d+\h*\);\s*pclose\h*\(\h*\29\h*\);\s*(?:\?>|\Z)(?<X1177280>))|(?:php)?\s*(\$\w{1,40})\s*=\s*(?:(file_)ge(t_contents)\h*\(\h*['"]https?://raw\.githubusercontent\.com/[^'"]{1,99}['"]\h*\);\s*@?\42pu\43\h*\(\h*(?:['"][^'"]+\.php['"]|\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*,\h*\41\h*\);\s*(?:\?>|\Z)(?<X1141882>)|@?file_get_contents\s*\(\s*['"]https?://[^'"]{1,99}['"]\s*\)\s*;\s*(?:var_dump|print_r|echo|eval|assert)\s*\(\s*\41\s*\)\s*;\s*(?:echo\b[^;]{0,99};\s*)?\?>(?:\s*<a\h*href[^<]{0,50}</a>)?\s*\Z(?<X2140793>)|\$_POST\[[^\]]+\];\s*if\s*\(\s*\41\s*[^\w]{2,3}\s*['"]\w{1,40}['"]\s*\)\s*\{[^\{\}]{1,600}\s*if\s*\(\s*move_uploaded_file\s*\(\s*\$_FILES\[[^\]]+\][^<]{250,999}<form\s+action=[^=]{1,40}method\s*=\s*['"]post[^\?]{300,600}</form>\s*\Z(?<X2061920>))|(?:php)?\s*(\$GLOBALS\[)(['"][^'"]{1,29}['"]\])=Array\([^\$]{1,999}function\s+(\w{1,40})\(\$\w{1,40}\)\s*\{[^:]+:\s*\47\s*\49\([^\)]{1,40}\)\s*\][^\?]+\47\s*\49\([^\)]{1,40}\)\s*\]\[[^\]]+\]\s*\((\$\w{1,40}),\50,\$_POST\);\s*\50=\47\48\[[^\]]{1,40}\]\([^;]{1,40}\);?\s*(?:\?>|\Z)(?<X1061330>)|(?:php)?\s*/[\*/][^\$\(\{;]{1,49}\bShell\b[^/\$\(;\.]{1,99}//[^/\s]{0,99}\bgithub(?:usercontent)?\.[\w\.]{2,9}/(?:n00py|leonjza)\b(?<X2172110>)|(?:php)?\s*/\*(?:[^/]{1,499}\bBypass\s+Shell\b(?<X2171520>)|[^\$\(;]{0,199}\bOffice\h+Scam(?:page)?\b[^\$\(;]{0,499}\berror_reporting\((?:0|NULL|False)\);\s*include(?:_once)?\(?['"][^'";]{0,99}\b[ab](?:ntibot|locker)[sz]?\d*\.php['"]\h*\);(?<X2178800>))|(?:php)?\s*@?(file_)pu(t_contents)\h*\(\h*['"](?:[^'"]{1,99}\.ph(?:p|tml?)\d*[^,]{0,99},\h*\55ge\56\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)\b[^;]{1,99};\s*(?:\?>|\Z)(?<X1177290>)|[^\),'"]{1,99}['"]\h*,\h*base64_decode\h*\(\h*['"]PD9[^;]{1,99};\s*(?:echo|print(?:_r)?)\h+\55ge\56\h*\(\h*['"][^;]{1,99};\s*(?:\?>\s*)?\Z(?<X1173880>))|(?:php)?\s*@?eval[\s\(]+base64_decode[\s\(]+['"]?bW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNb[^\)]+[\s\)]+(?:\?>|\Z)(?<X1197880>)|(?:php)?\s*[^\?]{1,200}=\s*@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*@?(?:eval|assert|system)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}(?:\s*\()?\s*\$\w{1,40}(?:\s*\))?(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1054544>)|(?:php)?\s*[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,49}\b[ab](?:locker|ntibot)[sz]?\.php['"]\h*\);(?:[^@]{99,999}<title>\s*Sign\s+in\s+to\s+your\s+M(?:i|&icirc;)crosoft\s+account\s*</title>(?<X2151201>)|[^\$]{9999,49999}&copy;\s*20\d{2}\h+Microsoft(?:\h+Corp(?:oration)?)?\b(?<X2151210>))|(?:php)?\s*[ri](?:equir|nclud)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,19}\b[ba](?:lock(?:er|_detector)|ntibot)[sz]?\.php['"]\h*\)?;\s*\$\w{1,40}\h*=\h*glob\h*\([^\?@#:&%\|<]{1,499}\bfunction\h+recurse_copy\h*\((?<X2170841>)|(?:php)?\s*\$\w{1,40}\h*=\h*['"][^\v]{999,9999}(?://[\w\-\h]{0,19}\bscp\-\d{3}\s*(?:\?>|\Z)(?<X1179273>)|\$\w{1,40}\h*\(\h*\$\w{1,40}\h*,\h*array\h*\(\h*['"]{2}\h*,\h*['"]\}['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]//['"][\)\h]+;\h*//wp\-blog\-header\h*(?:\?>\s*)?\Z(?<X2180061>))|(?:php)?\s*error_reporting(?:\((?:(?:0|NULL)\);\s*/\*\s*Loader(?:['"]?[sz])?\s*(?:Web\s*shell|pro\-hack\.ru)\b(?<X2142300>)|0\);\s*ini_set\(['"]display_errors[^\(]{5,15}if\(isset\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]\)\)\s*\{[^\$]{1,80}(\$\w{1,9})=array_pop\(@?preg_split\([^\)]{1,20}\)\);\s*echo\s*eval[^\)]{1,25}file\(['"][\w/]{9,19}\67['"]\)\)[^\}]{1,15}(?:die|exit)[^;]{0,9};\s*\}(?:\Z|\?>)(?<X1128531>))|\h*\(\h*(?:0|NULL|False)\h*\);[^@>#<%\^\+]{99,999}\bfunction\s+get.?Html\([^@>#<%\^\+]{99,999}\b[ed](?:xit|ie)[^;]{0,19};\s*(?:\}\s*)?(?:define\h*\(\h*['"]DISALLOW_FILE_\w{1,9}['"]\h*,\h*\w{1,5}\h*\);\s*){2}\s*(?:\?>|\Z)(?<X1174982>)))
\A\s*<\?(?:(?:php)?\s*function\s*(isInString1)[\s\(]+(\$\w{1,40})[\s,]+(\$\w{1,40})[\s\)]+\{\s*\2[\s=]+['"][^'"]*['"][\s\.]+\2;\s*return[\s\(]+bool[\s\)]+strpos[\s\(]+\2[\s,]+\3[\s\)]+;\s*\}\s*(\$\w{1,40})[^;\$]+\$_SERVER\[[^\]]+\][\s\)]+;\s*if[\s\(]+\1[\s\(]+\4[\h,]+['"]googlebot['"][\)\s\{\}]+else\s*\{(?<X2178222>)|(?:php)?\s*header\s*\(["'][^'"]{0,60}['"]\);\s*(?:if\s*\((\$_(?:P|G|S|C|R)\w{2,6}\[['"]\w{1,20}['"]\])\s*\D{2,3}\s*[^;]+base64_decode\(\6\);\s*\}\s*@?eval\(\6\);\s*\}\s*){0,3}if[^\{]+\{\s*@?include(?:_once)?\s*["'][^'"]{5,50}\.php['"];\s*\}\s*(?:\Z|\?>)(?<X1122431>)|(?:php)?\s*if\((?:(?:strpos\([^,]+,['"](?:google|mozilla)['"]\)\s*!?==?\s*(?:true|false)\s*\D{2,3}){1,3}[^/]{1,99}google[^<]+\bsh[3e]ll\b[^<]+</title(?<X2132451>)|isset\(\$_[GPSCR]\w{2,6}\[[^\{]{1,99}\{\bini_set\(strrev\(['"]gnitroper_rorre['"][^\?]{1,199}\bheader\(['"]Content\-type:\h*text/html\b[^@\v]{1,999}\binclude\h*\$\w{1,40}\b[^;]{0,99};(?:\s*echo\b[^;]{1,99};)?[\s\}]{0,19}(?:\?>|\Z)(?<X1184460>))|(?:php)?\s*if(?:\h*\(\h*isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\v\b@\}\?]{1,99}\bpopen\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\v\?>]{1,199}(?:\?>|\Z)(?<X1173040>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]{1,12}\]\s*==\s*['"](?:clear|remove|delete)['"]\s*\)\s*\{?\s*(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\(\s*['"][^']{0,40}[^\w]b(?:o|0)t[^\w][^']{0,40}['"]\s*\);\s*echo(?<X2052621>))|(?:php)?\s*session_start\(\);[^\$]{0,49}(?:(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){3}[^%]{999,8999}\$subject\h*=\h*['"][^'"]{0,99}\bNEW\h+(?:APPLE?|AMA?ZO?N?)\h+LOGIN\b(?<X2141080>)|(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){3}[^\*%\|]{9999,19999}function\s*\w{1,40}\s*\(\s*(cardnumber)\s*\)\s*\{\s*(?:var\s*\w{1,40}\s*=\s*\13\.charAt\s*\(\s*\d+\s*\)\s*;\s*){4}(?<X2141041>))|(?:php)?\s+(?:@eval\h*\(\h*\$_[GPRSCH]\w{2,6}\[[^\]]+\]\h*\);\s*){2,4}(?:\?>\s*)?\Z(?<X1177220>)|(?:php)?\s+(?:\$\w{1,40}=[^;]{1,9}\^[^=]{1,9};){1,}(\$\w{1,40})=(?:\([^\)]{1,9}\^[^\)]{1,9}\)\.){2}[^=]{1,99};(\$\{\16\}\[)\$\w{1,40}\]\(\17\$\w{1,40}\]\);\s*(?:\?>|\Z)(?<X1183690>)|(?:php)?\s+(?:echo\s*[^;]{1,99};\s*)?\s*\$\w{1,40}\s*=\s*getcwd\(\);\s*echo\s*['"][^'";]{1,40}<form\s+method\s*=\s*['"]post['"][^;]{1,255}['"];\s*if\s*\(\s*!empty\s*\(\s*(\$_FILES\[[^\]]{1,40}\])\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\19[^\}]{1,600}\19\[[^\]]{1,40}\];\s*\}\s*(?:\?>|\Z)(?<X1060090>)|(?:php)?\s+(\$\w{1,40})\s*=\s*(['"])[^\}]{1,400}\22;\s*(\$\w{1,40})\s*=(?:\s*\.?\s*\21\[\d+\]){90,150}\s*;[^\?]{420,600}(\$\w{1,40})\s*=\s*\23\s*;[^\?]{1,200}\24\)\);\$\w{1,40}\s*;\s*(?:\?>|\Z)(?<X1056560>)|(?:php)?\s+(\$to)\s*=\s*['"][^'"@]{1,40}@[^'"]{1,40}['"];\W{1,99}\$\w{1,40}\s*=\s*\$_POST\[['"](?:username|login|user|email)['"]\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"](?:password|pwd|pw|pass|cvv2?|ssn|passwd)['"]\];[^\?]{1,600}mail\s*\(\s*\26(?<X2118521>)|(?:php)?\s+/\*\s*\*\s*MySQL\s+Web\s+Interface\s+By(?<X2056600>)|(?:php)?\s+@?error_reporting\((?:0|NULL)\);\s*(?:\$\w{1,9}\s*=\s*\(isset\((\$_SERVER\[[^\]]+\])\)\s*\?\s*\29:\$\w{1,20}\);\s*){7}[^\.]{99,300}\$\w{1,9}\s*=\s*['"]/\?['"](?:\.base64_encode\(\$\w{1,9}\)\.['"][^_]{1,3}['"]){7}[^\?]{99,500}@?eval\([^\)]+\);\s*\}\s*;\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X1121301>)|(?:php)?\s+\$GLOBALS\[[^\]]+]=Array\((?:base64_decode\(['"][^\)]{9,99}\),?){2,9}\);(?:\s*\?>\s*<\?(?:php)?)?\s*function\s+(\w{1,40})\((\$\w{1,32})\)\s*\{(\$\w{1,40})[^;]{99,600};return\s+base64_decode\(\33\[\32\]\);\}(?:\s*\?>\s*<\?(?:php)?)?[^\?]+echo\s+\31\(\d+\);else\s+echo\s+\31\(\d+\);\s*\?>(?<X1064290>)|(?:php)?\s+error_reporting\((?:0|NULL)\);\s*(\$\w{1,20})\s*=\s*['"][^'"]+['"];\s*(?:\$\w{1,20}\s*=\s*\(isset\((\$_[GPRSC]\w{2,6}\[['"]([^\]]+)['"]\])\)\h*\?\h*\36\h*:\h*\$\37\);\s*){5}[^>]{99,500}['"]\.\35['"];\s*if\h*\(+include\((base64_decode)\([^>]{20,150}\.\38\([^\}]{1,50}\}\s*(?:\?>|\Z)(?<X1137701>)|(?:php)?\s+function\s+long2str\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\{[^\?]{50000,};\s*@?eval\s*\(\s*\w{1,9}_decrypt\(\s*base64_decode\(\s*\$\w{1,40}\s*\),\s*['"]\w{1,40}['"]\s*\)\s*\)\s*;\s*(?:\?>)?\s*\Z(?<X2055242>)|(?:php)?\s+if\(!(define)d\(['"](REMOTING_INJECTED)['"]\)+\{\41\(['"]\42['"],(?:true|false|\d)\);\41\(['"]RK_DEBUG.?['"],strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],(?<X2183721>)|(?:php\b)?[^\(\{\}\?@=\$]{0,199}(\$\w{1,40})\s*=\s*\$_[GPCSR]\w{2,6}\[[^;]{1,199};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\44\s*\);[^\?\}\{]{0,99}\becho\s*['"]<\w[^;]{9,299}\w>['"];\s*if\s*\([^\?=;\{]{0,99}\{\s*[cm]o(?:py|ve_uploaded_file)\s*\(\s*\$_FILES\[[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1188940>)|(?:php|=)(?:\s*\$\w{1,40}\h*=\h*['"][\w=\-\+/]{1,99}['"];){3,}\s*(\$\w{1,40})\h*=\h*str_replace\h*\([^\)]+\)\h*;(?:\s*\$\w{1,40}\h*=\h*\46\h*\(\h*['"]\w{1,40}['"]\h*,\h*['"]{2}\h*,\h*['"]\w{1,99}['"]\h*\)\h*;){2}\s*(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\([""]{2},[^;]+\46\([^\)]+\)+;\s*@?\47\(\);\s*(?:\?>|\Z)(?<X1161930>)|(?:php|=)?[^\$]{1,99}(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\s*\49\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*[^\}\{\?]+(\$\w{1,40})\s*=\s*['"]?\49['"]?\s*;\s*(\$\w{1,40})\s*=\s*@?fopen\s*\(\s*\50\s*,[^\);]+\)\s*;[^\}\{\?]+fpassthru\(\s*\51\s*\)\s*;\s*exit[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1124460>)|(?:php|=)?\s*(\$\w{1,40}\+)=\h*base64_decode\h*\(\h*['"][^'"]{999,4999}['"]\h*\);\h*@?(eval)\h*\(\h*['"]return\h*@?\54\h*\(\h*(\\['"])\53\55\h*\);\h*['"]\h*\)\s*\?>(?<X1141670>)|(?:php|=)?\s*//XMPP/Jabber\h*:\h*PhishingFarm@(?<X2149430>)|(?:php|=)?\s*/\*[^/\w]{1,99}\bPHISH(?:ER)?(?:\h+by)?\h+\S{1,40}\s[^/\w]{3,40}\*(?<X2149421>)|(?:php|=)?\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"][^'"]{0,499}\b(?:wget|curl|lynx)\h+https?://(?:www\.)?pastebin\.com/(?:raw|download)/[^'";]{1,99}\.p[hly][p\d]?\h*['"]\h*\);\s*(?:\?>|\Z)(?<X1140072>)|(?:php|=)?\s*@?error_reporting\((?:0|false|NULL)\);\s*if\s*\(\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{[^\}]{1,500}echo\s*\(?['"]\s*<form\s+method\s*=\s*['"]?post\b[^\}@]{1,500}if\s*\(\s*@copy\(\$_FILES\[[^\?]{1,500}\?>(?<X1124390>)|(?:php|=)?\s*\$\w{1,9}\h*=\h*rawurldecode\(['"][^'"]{99,500}(title)(?:>|%3E)Monkey[^<]{0,5}Albino(?:</|%3C%2F)\61[^'"]{99,999}php_uname%(?<X2153042>)|(?:php|=)?\s*echo\h*['"]<link\b[^\.\(;]{1,99}href=[^>;]{0,99}base64_decode\h*\(\h*['"]Ly9zaGVsb[^'"]{4,99}['"]\h*\)(?:\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])+[^;]*;\s*function\h*\w{1,40}\h*\((?<X2155980>)|(?:php|=)?\s*if\h*\(\h*(?:(\$_FILES\h*\[['"]\w{1,9}['"]\])[\s\)]+\{?\s*@?[mc]o(?:ve_uploaded_file|py)\s*\(\s*\64\h*\[['"][^'"]+['"]\]\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*;(?:\s*echo\h*['"][^'"]{1,99}['"](?:\h*;)?)?\s*\}?(?:\s*else\s*\{?\s*echo\h*['"][^'"]{1,99}['"](?:\h*;)?\s*\}?)?\s*(?:\?>|\Z)(?<X1142540>)|(file_)exists\h*\(\h*(dirname)\h*\(__\66_\)\h*\.\h*(['"]/wp[\-_][cv]?cd\.php['"])\h*\)\s*\)\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(\h*\67\h*\(\h*['"]?__\66_['"]?\h*\)\s*\.\s*\68\s*\)\s*;\s*(?:\?>|\Z)(?<X1062166>))|(?:php|=)?\s+@?[spe](?:ystem|assthru|hell_exec|open|xec)\h*\(\h*base64_decode\h*\(\h*['"]cGVyb[^'"]{99,499}['"]\h*\)\h*\);\h*(?:\?>|\Z)(?<X1140370>)|(?:php|=)?\s+\$(?:user|username|login|email)\h*=\h*(\$_POST\[)['"](?:user|username|login|email)['"]\];\s*\$(?:password|pass|secret|pwd|passwd)\h*=\h*\71['"](?:password|pass|secret|pwd|passwd)['"]\];[^#]{99,999}<title>\h*Free\h+Auto\h+Like\h+Facebook(?<X2160540>)|(?:php|=)\s*(function)\s+(\w{1,40})\h*\([^\{]{1,99}\{\s*\$\w{1,40}\h*=\h*hex2bin\h*\(\h*['"]687474703a2f2f636f6e6e6563742e61706965732e6f7267[^\?]{1,499}\b\73\s+(\w{1,40})\h*\(\h*\)\s*\{[^\}]{1,199}\b\74\h*\([^\?]{1,499}\}\s*\75\h*\(\h*\);\s*(?:\?>|\Z)(?<X1171461>)|(?:php|=)\s*\$[\{'"]{0,2}(GLOBALS)[\}'"]{0,2}\[[^\]]+\]\h*=\h*['"].{49,199}['"];\s*(?:\$[\{'"]{0,2}\77[\}'"]{0,2}\[[^\]]+\]\[\d+\]\.){2}[^\?\v]{9999,}\beval\(\$\w{1,40}\[\$\77\[[^\]]+\]\[\d+\]+\);\h*\}\h*(?:exit|die)\b[^;]{0,9};(?:\h*\})+(?:\s*\?>)?\s*\Z(?<X2160313>))
\A\s*<\?(?:[ph\s]*(\$\w{1,15})\h*=\h*(\$_SERVER\[)[^\]]+\];\s*(\$\w{1,15})\h*=\h*['"]<script[^;]+;\s*if\h*\(\h*strpos\h*\(\h*\1,\h*['"]google['"][^\}]{9,499}\}\s*if\h*\(\h*stristr\h*\(\h*\2[^\{]{1,49}\{\s*echo\h*\3;\s*\}\s*(?:\?>|\Z)(?<X1192211>)|[ph\s]*(\$\w{1,25})[\h=]+['"](?:[^'"]+['"];\h*\$inter_domain[\h=]+['"]https?://[\d\.]+/['"][\h\.]+\5[\h\.]+['"/]+;[^\n]{999,4000}\bstr_i?replace\(['"]\.xml["'],['"]{2},(\$\w{1,25})\);\h*\}\h*(\$\w{1,25})\[[^\]]+\][\h=]+\6[^\n]{999,2000}\bgetServerCont\(\$\w{1,25},\h*\7\);\h*echo[^\}]+\}\s*\?>(?<X1226160>)|[^;]+;\s*\$\w{1,25}[\h=]+(?:['"]f|\5[\h\(]+\d+[\h\)]+)[^\?]{0,999}\b_COOKIE;\s*(\$\w{1,25})[\h=]+array_merge[\h\(]+\9[\h,]+\$_[GPRSC]\w{2,6}[\h\)]+;[^\?\}]{0,699}\bphpversion[\h\(\)]+,[^#]{0,499}\5[\h\(]+\d+[^\}]+\}\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230484>))|[ph\s]*(\$\w{1,25})[\h=]array\((base64_decode)\([^\)]+\),\12\([^\)]+\),\12\(strrev\(str_rot13\(explode\(\12\([^\)]+\),file_get_contents\(__FILE__[\)\[\]\d]+;[^\?]{0,199}\beval\(\11\[\d+\]\)\),\11\[\d+\]\);\s*exit\(\);\s*\?>=[0-9A-z/\+\-=:]{6000,20000}\Z(?<X1227530>)|[ph\s]*(\$\w{1,40})[=\s]+explode[\(\s]+(base64_decode)[\(\s'"]+Pz4=?['"\),\s]+file_get_contents[\(\s]+__FILE[_;\s\)]+(\$\w{1,40})[=\s]+array[\(\s]+(?:\15[^,\$;]+,)+\15[\s\(]+(?:str\w+[\(\s]+)+\14\[\d[^\(]{9,99}preg_r\w+[\(\s]+\16\[\d+\][,\s]+(?:(?:serialize|eval)[\(\s]+)+\16\[\d[^;]+;\s*exit[\(\);\s]*\?>\s*=[\w\d\+/]+\s*\Z(?<X2229402>)|[ph\s]*(\$\w{1,40})[=\s]+fopen[\(\s]+['"][^'"]{1,19}\.txt['"][,\s]+['"]a['"][\)\s;]+session_start\s*\(\);\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{0,99}\$\w{1,40}[=\s]+gethostbyaddr[\(\s]+\19[\)\s;]+fputs[\(\s]+\18\s*,[^;]+;\s*fclose[\(\s]+\18[\)\s;]+header[\(\s]+['"][^'"]*['"][\)\s;\?>]+\Z(?<X2226760>)|[ph\s]*(\$\w{1,40})[=\s]+rtrIM[\(\s]+['"][^'"\$]+['"][\)\s]+;\s*@?fiLe_PuT_cOnTeNtS[\(\s]+\21[,\s]+Base64_DecOdE[\(\s]+imPlOde[\(\s]+arRAy_SLIcE[\(\s]+filE[\(\s]+__FIle__[\)\s,\d;]+require(?:_once)?\s*\$\w{1,40}\s*;\s*/\*\s*PD9[^\*]{99,}\*/\s*\Z(?<X2224600>)|[ph\s]*(\$\w{1,40})[\s=]+(?:\w{1,40}\s*)?['"\(]{1,2}[^'"\$]{1,40}['"\)\s;]+(FILe)_pUt_COnteNTS[\(\s]+\23[,\s]+BAsE64_DeCodE[\(\s]+(?:JoIn|implode)[\(\s]+aRRAY_(?:sLicE|map)[\(\s]+\24[\(\s]+__\24__[\)\s]+[,\s]+\d+[,\s]+\d+[\)\s;]+(?:include|require)(?:_once)?\s*\23[\s;]+/\*\s*PD9[^\*]{99,}\*/[\?>\s]*\Z(?<X2211702>)|[ph\s]*(\$\w{1,40})\s*=(?:[\s'"]*create_function['"\s;]+\$\w{1,40}\s*=[\s'"]*;\s*\$\w{1,40}[\s=]+\26[\s\(]+\$\w{1,40}[,'"@]+eval[\s\(]+(array_)pop[^=]{9,199}=\s*\27merge[\s\(]+(?:\$_[GPRSC]\w{2,6}[,\)\s]+){2,};\s*(\$\w{1,40})[\s=]+isset[\s\(]+\$\w{1,40}\[[^\]]+\][^;]+;\s*@?eval\b[^;\)]+\28[\s\)]+;(?:[\s'"\)]+;)?[\s\?>]*\Z(?<X2265910>)|\s*['"]['"\h\.base64_dco]{17,40}['"];\s*(\$\w{1,40})\s*=\s*['"]['"\h\.gzinflate]{12,40}['"]\;\s*@?(error_)reporting[\s\(]+(?:NULL|0)[\)\s;@]+(?:ini_set[\(\s]+['"]\31log['"][,\s]+(?:NULL|0)[\)\s;@]+)?eval[\s\(]+(?:(?:\26|\30)[\s\(]+){2}['"][a-z\d\+/]{99,}={0,2}['"][\s\);\?>]+\Z(?<X1226740>)|\s*['"]range["']\s*;\s*(\$\w{1,40})\s*=\s*\26[\s\(]+['"]\176['"]\s*,\s*['"]\s*['"][\s\)]+;\s*include(?:_once)?\s*\33\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*(?:\.\s*\33\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*)+;[\s\?>]*\Z(?<X2217781>)|\s*\w+[\s\(]+['"][^'"\$]+['"][\s\);@]+(fILE_)PUT_COnTENts[\s\(@]+\26[,\s]+bAse64_DeCODe[\s\(]+join[\s\(]+ArRAy_sLicE[\s\(]+file[\s\(]+\w+[\s\(]+__\35_[\s\),]+\d+[\s,]+\d+[\s\)]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]{0,9}?\26[\$\}\)'"\h]*;\s*/\*\s*PD9[^\*]+\*/\s*\Z(?<X2223490>))|[ph\s]*(function)\s*(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+strtr[\(\s]+\39[,\s]+array[\(\s]+['"][\w'"=>,\s]{99}[^;]+;\s*\40[\s=]+base64_decode[\s\(]+\40[\s\);]+return\s*\40[\s;]+\}\s*\37\s*\w+[\s\(]+(\$\w{1,40})[^\}]{0,99}\bfile_get_contents[\(\s]+\41[^\}]+\b\38\s*\([^\}]+\}\s*\Z(?<X1223820>)|[ph\s]*[^\!]{0,100}(\$\w{1,40})\s*=\s*(?:\$\w{1,40}\[[\(\h]+(?:\d+[/\-\*\+\)\(]+)+\d+([\)\h]+)\]\s*\.?)+;[^\?@]{4000,9999}(\@\$\w{1,40})[=\h]+\43[\(\h]+['"]{2}\44[\s,]+[^;]{0,16};\s*\45[\h\(\)]+;\s*\?>(?<X1204202>)|[ph\s]*[^\{]{9,99}if[\h\(!]+defined[^\{]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"][^'"]+\.php['"];\s*\}\s*if[\h\(]+class_exists[\h\(]+['"](SC_FileManager)['"][\s\)\{]+\47::handle_request\(__FILE__\);\s*\}\s*(?:\?>)?\Z(?<X220366470>)|[ph\s]*\$\w+[=\h]+[^\{\n]{99,1500}\{\h*if[\h\(]+strlen\b[^\}]{99,450}\}\h*\$\w+[\h=]+implode[\h\(]+['"\h]+,\h*(array_)map[\h\(]+['"][^'"]+['"],\h*\49values[\h\(]+(\$\w+)[\h\)]+,\h*\49keys\b[^\n\?]{99,899}@\$\w+[\h\(]+\$\w+,\h*\50[\h\)];\h*echo[^;]+;\h*(?:exit|die)[^;]{0,9};[\}\h]+\Z(?<X1239651>)|[ph\s]*\$\w+[\h=]+(?:['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\w+/['"];\s*(function)\h*(\w+)[\h\(\)]+\s*\{\s*exit;\s*\}\s*\52\h*curl_[^\n]{999,5000}\b(main_shell)['"]\][\h=]+\$\54;\s*\}\s*\$referer=[^\n]{199,999}\?><\?[ph\s]*\53[\h\(\)]+;\s*\}\s*\?>(?<X1249890>)|[^;]+;\h*\$\w+[\h=]+[^;]+;[^\{\n]{0,199}\{\h*class\h*(\w+)[\h\{]+public\h*function[^\n]{0,500}\b_COOKIE;\h*\$\w+[\h=]+\$_POST;\h*\$\w+[\h=]+@?\$\w+\[substr\(\56::\$\w+[^\n]{99,1500}\bnew\h*\56[\h\(\)]+;[^\?\n]{0,99}\?>(?<X1254563>)|[^;]+;\s*\$\w+[\h=]+['"]class_exists['"];[^\{]{0,199}\bif[\h(]+!\$\w+[\s\)\{]+class\h*(\w+)\h*\{[^\{]{0,199}\{\s*\$\w+[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;[^\?]{0,799}\bif[\h\(]+is_array[\h\(]+\58::\$\w+[^\}]{9,499}[\s\}]+(\$\w+)[\h=]+new\h*\58[\h\(\)]+;\h*\59[\h=]+NULL;[\s\}]+\?>(?<X1247480>)|[^\{\n]{9,599}\b(foreach)[\h\(]+array[\h\(]+(\$\w+),\h*\$_cookie,\h*\$\w+,\h*\$_post,\h*\62[\h\)]+as\h*\$\w+[\h\)]+\{\h*\61[\h\(]+\$\w+[^\n\?]{9,599}\beval[\h\(]+(?:\$\w+|\$\w+\[\d+\][\h\(]\$\w+\[\d+\])[\h\)]+;\h*die[\h\(\)]+;[\h\}]+\Z(?<X2239662>))|[ph\s]*\$\w+\h*=[^\{]{0,350}\{\s*class\h*(\w+)\s*\{[^\{]{0,199}\{\s*(\$\w+)[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;\s*\$\w+[\h=]+@?\65\[[^\n]{0,1500}\}\h*(\$\w+)[\h=]+new\h*\64[\(\)\h]+;\s*\66[\h=]+['"\d]+;\s*\}\s*\?>(?<X1249691>)|[ph\s]*\$\w+\s*=[^\?/]{0,199}\bfile_put_contents[\s\(]+[^,;]+,[^;]{0,99}\barray_slice[\s\(]+file[\s\(]+__file__\s*\)[^;]{0,99};\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99};\s*/\*\s*PD9[\w/\+\s=]+(?:\*/\s*)?(?:\?>\s*)?\Z(?<X2229902>)|[ph\s]*\$\w{1,25}[\h=]+(?:(?:['"]\w+['"]|chr\h*\()[^\?]{99,400}\bforeach[\h\(]+array[\h\(]+\$\w{1,25},\$_POST,\$\w{1,25},\$_COOKIE,\$\w{1,25}[\h\)]+as\h*\$\w{1,25}[\s\)]+\{[^\?]{99,500}\beval[\h\(]+\$\w{1,25}[^\)]+[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230991>)|(?:['"]D|chr\(\d+)[^\{]{0,500}\$\w{1,25}[\h=]+['"]phpversion['"];[^\?]{0,999}\bglob[\h\(]+\$\w{1,25}[\h\.'"/\*]+,\h*GLOB_ONLYDIR[\h\)]+;\s*if[\h\(]+count[^\?]{0,500}\bstrlen[\h\(]+\$\w{1,25}[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230490>)|(?:['"]s|chr\(115)[^\{]{0,350}\bforeach[\h\(]+array[\h\(]+\$\w{1,25},\h*\$_[GPRSC]\w{2,6},\h*\$\w{1,25},\h*\$_[GPRSC]\w{2,6},\h*\$\w{1,25}[\h\)]+as[^\?]{0,350}\beval[\h\(]+\$\w{1,25}\[[^\)]+[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230501>))|[ph\s]*\$\w{1,40}[=\s]+['"][^'"@\s]+@[^'"]{2,}\.[a-z]{2,9}['"]\s*;\s*\?>\s*<\?[ph\s]*include(?:_once)?[\(\s]*['"][^'"]+\.(?:jpe?g|png|ico|gif)['"][\)\s;\?>]+\Z(?<X2209030>)|[ph\s]*\$\w{1,40}\h*=[^\(\);]{0,9}chr[^;]+;\h*(?:\$\w+\h*=[^;]+;\h*){9,}foreach[\h\(]+\$_POST\h*as\h*\$\w+[\h=>]+\$\w+[\h\)]+\{[^\}]+\}\s*\$\w+[\h=]+implode\(['"]{2}\h*,\h*array_map[^\?\n]{0,499}GLOB_ONLYDIR[\h\);]+if[\h\(]+count[^\n\?]{0,499}strlen[\h\(]+\$\w+[\h\);]+(?:exit|die)\b[^;]*;[\h\}]+\Z(?<X2241003>)|[ph\s]*\$\w{1,40}\s*=[^;]{0,99}\bchr\s*\((?:[^;]{0,99};[^\{]{0,400}\barray[\h(]+\$\w+,\h*\$_(?:COOKIE|POST),\h*\$\w+,\h*\$_(?:COOKIE|POST),\h*\$\w+[\h\)]+;\s*foreach[\h\(]+\$\w+\h*as\h*\$\w+[\s\)]+\{[^\}]{99,600}\beval[\h\(]+\$\w+[\h\)]+;\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\?>|\Z)(?<X1248972>)|[^\{]{0,999}\bforeach[\h\(]+\$_POST\h*as\h*\$\w+\h*=>\h*(\$\w+)[\s\)]+\{[^\}]{0,499}\}\s*\75[\h=]+implode[\h\(]+['"]{2},\h*(array_)map\b[^,]+,\h*\76values[\h\(]+\75[^\?]{0,1500}\}\s*\$\w+[\h=]+\$_SERVER\[\$\w[^\}]{0,599}\becho\h*\$\w+;\s*die[\(\);\s\}]+\Z(?<X2248981>))|[ph\s]*\$GLOBALS\[['"]HASHTYPE['"]\][=\s]+['"][^'"]*['"]\s*;\s*\$GLOBALS\[['"]PASSHASH['"]\][=\s]+['"]584c19ee1bfab[^'"]+d76['"]\s*;[^`]+\bpassthru[\s\(]+\$\w{1,40}(?<X2218170>))
\A\s*<\?(?:[ph\s]+(\$\w{1,9})\s*=\s*['"]https?://[^;]+;\s*(\$\w{1,9})\s*=\s*['"]base64_decode['"];\s*(\$\w{1,9})[^@]{1,20}(\@?file_)put_(contents)\s*\(\s*\3,[^\.]+\.\s*\2\s*\(\s*(\4get_\5\s*\(\1\))[^@]+@?unlink\s*\(\3\);\s*@?eval\s*\(\s*\2\s*\(\6\)\s*\)\s*;?\s*(?:\Z|\?>)(?<X1059742>)|[ph\s]+(\$_[GPRSC]\w{2,6}\[['"]shellurl['"]\])[\h=]+['"]https?://[^'"]+['"];[^\?]{9,399}\bfunction\h+(\w+)[\h\(]+\$\w{1,25}[\h\)]+\s*\{[^\}]{9,350}\bcurl_close\(\$\w+\);\s*\}[^\?]{99,699}\becho\h*\9[\h\(]+\8[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1212960>)|[ph\s]+(\$group_num)[=\s]+[^;]{0,50};\$inter_domain[=\s]+['"]https?[^'"]+['"]\.\11[^;]{1,50};[^\@]{1,300}\bfunction\s*(\w+)[^\%]{1,3800}(\$\w{1,40})[=\s]+(?:\$\w{1,40}[\.;])+\$\w{1,40}[\[\s]+['"]main_shell['"][\]\s]+[=\s]+\13[^\%]{1,500}(\$\w{1,40})[=\s]+\12[^;]+;[^\%]{1,200}echo\s*\14;(?:exit|die);[\}\s]+else[^\}]+\}\s*\?>\Z(?<X1221655>)|[ph\s]+(\$group_num)[\h=]+['"]\w+['"];\h*\$inter_domain[\h=]+['"]https?://[\d\.]+/[^;]{0,49}\16\b[^\n]{499,}\b(?:header[\h\(]+['"]HTTP/[\d\.]+\s+(?:500|40[43])\b[^\?\n]{1,199}){3,}(?:\?>|\Z)(?<X1225630>)|[ph\s]+(\$wp_hash_calc)[\h=]+pack\h*\(['"]H\*['"],['"][a-f0-9]{9999,}['"]\);\s*@?eval\h*\(\18\);\s*\$_\w{24,60}[\h=]+\d+;\s*(?:\?>)?\Z(?<X2202460>)|[ph\s]+(function)\h*(\w{1,20})\([^\)]+\)[\s\{]+[^\}]{9,99}\}\s*\20\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}[\h=]+\21\([^'"]{99,400}\}\s*(\$\w{1,20})[\h=]+['"][^'"]{9999,}['"];\s*(\$\w{1,20})[\h=]+['"]\w+['"];\s*(\$\w{1,20})[\h=]+\22[\(\h]+\23,\24\);\s*@?eval[\h\(]+\25\);\s*(?:\?>\s*)?\Z(?<X2210972>)|[ph\s]+(global)\s+\$(zym_decrypt);(?:\h*\$\28\[[^\]]+\][\h=]+base64_decode\h*\([^;]{1,199};){3,}\s*\?>\s*<\?[ph\s]+(?:(\$\27s\[['"]\28['"]\]\[)[^\]]+\]\([^\n]{4999,}\}\h*function\h+\w+[\h\(]+(\$\w+)[\h\)]+\{\h*return\h+\29[^\]]+\][\h\(]+\30[\h\)]+;[\h\}]+(?:\?>|\Z)(?<X1198931>)|\$\w+[\h=]+(\$\27s\[['"]\28['"]\]\[)[^\]]+\]\([^\n]{4999,}\32[^\]]+\]\([^;]{1,199}\b(?:return\h+(?:true|false);[\h\}]+){1,5}\h*(?:\?>|\Z)(?<X1198940>))|[ph\s]+(if\(isset\()(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+)\{file_put_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\.['"]\.\w+['"],(base64_decode)\(\35;\}\34(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+)\{unlink\(\36\(\37;\}\?>\Z(?<X2223193>)|[ph\s]+//\h*Silence\h*is\h*golden\.?[^;\$=]{1,99}@?error_reporting[\(\h]+(?:0|NULL|FALSE)\);[^\{]{1,40}\bfunction\h+(?:login|web).shell\(\)\s*\{(?<X2212340>)|[ph\s]+//\s*\w{0,19}AdsenseInject[^%#\*]{1,999}\$(\w+)[\s=]+['"]https?://[^'"]+\.zip['"];[^\?]{0,199}\b(\w+)\s*\([^\)]*\$\40\b[^#]{9999,}\bfunction\s+\41\w{0,9}[\s\(]+(\$\w+)[,\s]+(\$\w+)[\)\s]+\{[^\}\{]*\bfile_put_contents[\s\(]+\42\s*,[^;]*\43\b[^\}\{]+\}\s*(?:\?>|\Z)(?<X1211240>)|[ph\s]+/[\s\*]+@link\s+https?://[^/]*\bz0n51\.[\w\.]+\b[^;\$\(\)\{=]{0,199}\bfacebook\.com/z0n51\b(?<X2200610>)|[ph\s]+/[\s\*]+Plugin\s+Name[\s:]+(\w+)[\s\*]+/\s*function\s+(\w+)[\s\(\)]+\{\s*if[\s\(]+isset[\s\(]+(\$_[GPCSR]\w{2,6}[\s\[]+['"]\46['"]\s*\])[\s\)]+\{\s*@?echo\s+\48;\s*(@?(?:die|exit)\b[^;]{0,19};)[\s\}]+(add_action[\s\(]+['"]\w+['"][\s,]+['"])\47['"][^\?]{499,}\becho\s+\$\w+;\s*\49[\s\}]+\50[^;]+;\s*(?:\?>\s*)?\Z(?<X2211100>)|[ph\s]+/\*\*(?:[\s\*]+Plugin\h*Name:\h*(\w{1,20})\s*\*/\s*(function)\h+\w{1,20}\(\)[\{\s]+if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[['"]\52['']\]\)\)[\{\s]+[^\?>\*]{400,1200}\b\53\h+\w{1,20}\(\)[\{\s]+\$\w{1,20}[\h=]+['"]\52['"];[^@\?\*]{200,900}\bfile_put_contents\([^\?>]{600,1500}\}\s*add_action\([^\;]+;\s*(?:\?>|\Z)(?<X2205540>)|\s*\*[^\$\{\(]{0,150}Responsive\h*Webshell[^\$]{1,40}\$\w{1,20}[\h=]+\[(?<X2203531>)|\s+\*\s+PANEL\s+PRIV8\s+LIVE\b(?<X2208781>))|[ph\s]+@?(?:set_time_limit|error_reporting)\([^\n]{999,3500}\b(goto)\h*\w+;\h*\}\h*header\([^\)]+\);\h*echo\h*\$\w+\[\d+\];\h*exit[^\n]{999,3000}\b\57\h*\w+;\h*\w+:\h*\}\s*\?>(?<X1215910>)|[ph\s]+@?(file_)pu(t_contents)[\s\(]+['"][^'"]+\.php\d*['"][,\s]+@?\59ge\60[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;?\s*(?:\?>|\Z)(?<X1220430>)|[ph\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:[\(\s]+['"](?:curl|wget)\s*https?://(?:\w{1,40}\.){4,}oast\.me/[^\?]{1,40}\.txt[^\)]{0,40}['"]\);\s*(?:\?>|\Z)(?<X1233941>)|[\s\(]+['"](?:/bin/)?bash\h*\-i\h*>&\h*/dev/tcp/[\d\.]{5,20}/\d{3,5}\h*0>&1[\h'"]+\);\s*(?:\?>)?\Z(?<X2205793>))|[ph\s]+@?error_reporting[\s\(]+(?:0|NULL|False)[\s\)]+;\s*(?:@?session_start[\s\(\)]+;\s*)?class\s+(\w+)[\s\{]+(?:[pf]\w+\s*)?\$\w+[\s=]+['"]https?://[^/'"]*\bgovniku\.site\b[^@<%]{999,}\}\s*(\$\w+)[\s=]+new\s+\64[\s\(\)]+;\s*\65\s*\->\s*doAction[\s\(\)]+;\s*(?:\?>|\Z)(?<X1210160>)|[ph\s]+@?eval[\h\(]+gzuncompress[\h\(]+['"]x\\xda\\xe5\\xbd\\xedv[^\n]{15000,}\\xd9.A\\x7f["']\)\);(?:\s*\?>)?\Z(?<X2218900>)|[ph\s]+@?file_put_contents[\(\h]+['"][^\.]{1,40}\.php\d*['"][,\h]+['"]<\?[ph\s=]+echo\h*phpinfo\(\);['"\h\)]{2,5};\s*(?:\?>)?\Z(?<X1232571>)|[ph\s]+[^\$]{0,99}\$[KLP_O0]+[\h=]+['"]\d+['"];\s*(\$[KLP_O0]+)[\h=]+['"][^'"]{32,64}['"];\$\w{1,25}[\h=]+(?:\69\[\d+\]\.){15}[^\n]{999,14000}\bCURLOPT_CONNECTTIMEOUT,\h*\$[KLP_O0]+\);[^\n]{999,25000}\bexit[\(\)\}\h;]+\$\{['"][GOBALS\\x471532cf]{9,30}['"]\}\[[^\]]+\]\(\);\?>\z(?<X2223311>)|[ph\s]+[^\(]{0,20}\bfunction\h*(\w{1,15})\([^#]{9,350}\}\s*(\$\w{1,15})[\h=]+['"][^;]{999,4000}['"];\s*(\$\w{1,15})[\h=]+Array\([^\)]{99,650}\);\s*(\$\w{1,15})[\h=]+\71\(\72,\h*\73\);\s*(\$\w{1,15})[\h=]+['"creat_funio\.\\x\dh\(\)]{16,99};\h*\75\([^\$]{1,20}\74[^;]{1,20};\s*(?:\Z|\?>)(?<X2129814>)|[ph\s]+[ir](?:nclud|equir)e(?:_once)\s*(?:\(\s*)?['"][^"']+/images?/[^'"]{0,199}\.[^/'"]+['"]\);\s*\?>(?<X1212210>)|[ph\s]+\$(?:bot){2,4}[\h=]+[^;]+;\s*error_reporting\((?:0|NULL)\);[^\{\?]{999,5500}\bfopen\((\$\w+)\.(base64_decode)\([^\)]+\),\h*\79[^\?]{99,1200}\bfile\(\79\(\79[^\?]{99,999}\bchmod\(\78\.\$\w+[^\?]{999,2000}\bexec\(\79[^>]+>\h*/dev/null[^\)]+\);\s*@?unlink\([^\)]+\);\s*\?>(?<X1208370>)|[ph\s]+\$\w+=['"][^;]{1,19};(\$\w+)=['"]https?://[^;]+;\$\w+=\81\.['"]/jump\w+\.php['"];(?:\$\w+=\81\b[^;]+;){2}[^#@]{999,}\bfile_put_contents\([^;]+\brobots\.txt['"][^#@]{1,499}\?header\(['"]HTTP/[\d\.]+\s+40[34]\b[^\?#]{1,499}\becho\s*\$\w+;exit\b[^;\}]{0,19};[\};]+\?>(?<X1223940>)|[ph\s]+\$\w+[\h=]+['"](file_)put(_contents)['"];[^\}]{99,599}[\s\}]+return\h*\$\w+;[\s\}]+(\$\w+)[\h=]+\$_COOKIE;\s*\85[\h=]+array_merge[\h\(]+\85,\h*\$_POST[\h\)]+;[^\{]{0,99}\bforeach[\h\(]+\85\h*as\h*\$\w+\h*=>\h*(\$\w+)[^\?]{0,499}\b\83put\84[\h\(]+\$\w+,[^\$]+\86\[[^\}]+\}\s*exit[\s\(\)\};]+\Z(?<X2238850>)|[ph\s]+\$\w+[\s=]+(function)\s*\([\s\)]+\{[^\}]{1,499}\};\s*\$(\w+)[\s=]+\88[\s\(]+(\$\w+)[\s\)]+\{[^\}]{0,499}\beval\s*\([^\)]*\90\b[^\?]{999,}\$\89[\s\(]+\$\w+[\s\)]+;\s*(?:\?>|\Z)(?<X1209771>)|[ph\s]+\$\w{1,25}\h*=[^\?:]{0,99}\b(http)s?://[^'"]+\.top['"];\s*\$\w{1,25}[\h=]+['"]['"\.base64_ncod]+;[^\n\^#%]{999,2999}\bheader\(['"]\92/\d\.\d\h*404\h*not\h*found['"][^\n\^%#]{99,999}\b\92_build_query\(\$\w{1,25}\);(\$\w{1,25})[\h=]+@?file_get_contents\(\$\w[^\?]{0,399}\breturn\h*\93;\}\s*\?>(?<X1212571>)|[ph\s]+\$botbotbot[\h=]+['"]\d+['"];\s*error_reporting\h*\([^@]{2000,9000}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+[^;]{9,99}\);\s*@?unlink[\h\(]+[^\)]+\);(?:\s*\?>)?(?<X1208310>)|[ph\s]+class\s*(\w+)(?:\s*\{(?:[^\}]{1,499}(?:\}\s*)+\$(\w+)[\s=]+new\s+\96\s*\(\s*\);\s*(\$\w+)[\s=]+\$\97\s*\->[^;]+;\s*@?eval[\s\(]+\98[\s\)]+;\s*(?:\?>|\Z)(?<X1209850>)|\s*(?:const\s*platform_\w{5,10}\s*=\s*\d{1,2};\s*){2,9}(private)\s*\$(\w+)\s*=\s*["'][^'"]{60000,}["'];\s*\100[^<\\]{999,2500}gzinflate\(base64_decode\(\$\w+->\101\)\);[^;]{10,100};\s*\}\s*(\$\w+)\s*=\s*new\s*\96[^;]{1,9};\s*echo\s*\102\->execute\(\);\s*(?:\?>|\Z)(?<X1118745>))|\{private\s*static\s*(\$\w+);\s*static\s*function\s*(\w+\()[^;\{]+\{if\(!self::\104\)[\s:]+self::\w+\(\)[^@]{999,29999}\bfile_get_contents\(\$_FILES\[\96::\105[^\176]{999,}\breturn\s*\$\w+[\s\.]+\96::\105[^\)]+\);[\s\};]+(?:\?>|\Z)(?<X1228090>))|[ph\s]+define\(['"]PBOX['"][^;]+;[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\bdelayedlinks\.php['"](?:\)\s*)?;\s*\?>\s*(?:<\?[ph\s]+checkpost[\s\(]+\d+[\s\)]+;\s*\?>\s*)?<!DOCTYPE\s*html>(?<X2202451>))
\A\s*<\?php\s*(?:((\$\{['"]GLOBALS['"]\}\[)['"]\w{1,20}['"]\])\h*=\h*(['"][^'"]{1,40}['"]);\s*(\2['"]\w{1,20}['"]\])\h*=\h*\3;\s*\$\{\s*\1\s*\}\s*=\s*@?file_get_contents\h*\(\h*['"]https?://[^/]{0,19}\bpastebin\.com/(?:raw|download)\b[^;]{1,99};\s*@?eval\s*\(\s*\$\{\s*\4\s*\}\s*\);\s*(?:\?>|\Z)(?<X1167381>)|(/\*\h*generated\hby\hjetpack\hprotect\b)[^\/]{1,20}/\s*(function)\h*\w{1,10}\((\$\w{1,10})\)\s*\{\s*if\h*\(\h*!?is_writable\h*\(\h*['"]?\8['"]?\h*\)\h*\)\s*\{\s*return\b[^;]{1,99};[^\?@<>\|%\+:,]{99,999}\b\7\h*get_text_fr_serv\([^\)]+\)\s*\{[^\}\?]{1,500}\}\s*\6\b[^\/]{1,20}/\s*(?:\?>|\Z)(?<X1168261>)|(?:(?:error_reporting|set_time_limit)\((?:0|NULL)\);\s*){2}if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*echo\s*['"]<font color=#000000>\[uname\]['"]\.php_uname\(\)[^\{]{9,250}\{if\(@?copy\(\$_FILES\[(?<X2035971>)|(?:(?:session_start\(|error_reporting\((?:0|NULL|False))\);\s*){1,2}class\s*BrowserDetection\s*\{[^%]{999,9999}\$(subj?(?:ect)?)\h*=\h*['"]New\s+Log(?:\s*in)?(?:\s*details?)?\s+From\s+Visitor\b[^;]{0,99};[^\?]{99,1999}\bmail\([^\)]+\$\11\b[^\?]{1,499}\bheader\h*\(\h*['"]Location:(?<X2164502>)|(?:(\$\w{1,9})\s*=\s*pack\(['"]\w\d{1,2}['"],(?:\d{1,3},){4}[^\)]+\);\s*){3}if\(@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,3}['"][^'"]+['"]\)\{\s*\13\(['"](?:\\x[\w\d]+){4}[^\)]+\);\s*\}\s*else\s*\{\s*header\(['"]HTTP/1\.[01]\s*(?:404|403)[^'"]{9,50}['"]\);\s*(?:exit|die)\s*\([^;]{0,9};\}\s*\?>(?<X1134441>)|(?://header\s*\(\s*['"][^"']*['"]\s*\);)?\s*\$\w{1,40}\s*=['"][^"']*['"]\s*;\s*\$\w{1,40}=['"][^"']*['"]\s*;\s*\$\w{1,40}\s*=['"][^"']*['"]\s*;\s*\$\w{1,40}\s*=\s*urldecode\s*\([^#]{9999,30000};\$\{['"](?:\\x[0-9a-f]{2,3})+['"]\}\s*\[['"](?:\\x[0-9a-fA-F]{2,3})+['"]\]\(\);\s*(?:\?>|\Z)(?<X1037511>)|(?:/\*[^\$=\?%\{'"]{1,350}\*/\s*)?\$[^=]{1,25}\h*=\h*['"](?:dupmetbo_s5irfc64aly|5aecm6fdousrlb4t_ipy)['"];\$[^\n]{99,1599}\beval\((?<X2166484>)|(?:@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]cd\s*\w{1,9};\s*mv\s+\w{1,9}\.ico\s+\w{1,9}\.php;\s*['"]\s*\);\s*){1,9}(\$\w{1,40})\s*=[^;]{1,50};\s*(\$\w{1,40})\s*=\s*['"]\w{1,20}@\w{1,7}\.\w{2,6}['"]\s*;[^?]{1,50}mail\s*\(\18,\$\w{1,20},\17\s*\);?\s*(?:\?>|\Z)(?<X1059171>)|(?:@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*file_get_contents\s*\(\s*['"]https?://['"]\s*\.\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;\s*){2,}(?:\Z|\?>)(?<X1127510>)|(?:@?(?:session_start|error_reporting|set_time_limit)\s*\([^\)]{0,5}\);\s*){2,3}[^\?:]{9,150}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*(?:\?>|\Z)(?<X1121752>)|(?:@?unlink\h*\([^\)]{1,199}\);\s*){9}[^\$\{\}\?=>]{9999,29999}(?:\?>|\Z)(?<X1150570>)|(?:\$(?:title|title_dop|logo_alt|keywords|descr|bkeyword|keyword_bez)\h*=\h*["'][^'"]{1,499}['"];\s*){7}\$bkeyword_bez\h*=\h*['"](?<X2146236>)|(?:\$(\w{1,40})=visitor_\24\(\);){3}[^@]{99,999}\$(me?sg|message)=[^;]{9,999}\$p(?:ass(?:wo?r?d)?|wd)[^@]{1,499}\bmail\([^\)]{1,49}\$\25\b[^\)]{1,49}\);(\$\w{1,40})=fopen\(['"][^'"]+\.(?:html?|txt)['"][^\)]{1,49}\);fwrite\(\26,\$\25\);(?<X2155841>)|(?:\$[_0o]{1,40}\s*=\s*['"]\w+['"]\s*;\s*){3,}[^;]{1,9};\s*\$\{['"][GOBALS\\x47cf2153]{7,28}['"]\}\[['"][0o_\\x4f530]{1,160}['"]\]\(\);\s*\?>(?<X1139370>)|(?:\$\w{1,15}\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*){2}(\$\w{1,15})\h*=\h*['"]New\s*Logger[^;]+;\s*(\$\w{1,15})\h*\.?\h*=\h*[""]Powered\h*by[^;]+;[^\?]{0,99}\bmail\(\$\w{1,15},\h*\29,\h*\30\);\s*\?>(?<X1186540>)|(?:\$\w{1,19}\s*=\s*[^'";]{1,40}(?:[\^\|]['"][^\v\$]{1,19}['"])?;\s*)?\$\w{1,40}\s*=\s*['"][^\v]{1,40}['"][\^\|&](?:['"]|\w)[^\v]{1,40}['"]?;[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}[\.\)=,\|]+\$\w{1,19}\s*[\)\.](?:[^\t]{60,199})\);(?:\s*\?>)?\s*\Z(?<X2142241>)|(?:\$\w{1,20}\s*=\s*['"])?@?riny\s*\(tmvasyngr\s*\(onfr64_qrpbqr\s*\([^\?]{9999,30000}(?:\)\s*)+;\s*['"]\);[^\?]{0,15}\?>(?<X1134620>)|(?:\$\w{1,20}\s*=\s*\d+;)?[^\{]{1,50}\{(\$\w{1,20})\s*=[^\}]{25,200}\}\s*(\$\w{1,20})\s*=\s*['"]['"\s\.base64_dco]{13,40}['"]\s*;\s*return\s+\35\s*\(\s*\34\s*\)\s*;\s*\}\s*\$\w{1,20}\s*=(?:\s*['"][\w\-\+/=]{10,500}["']\s*(?:\.)){9}[^;]{65000,};\s*(?:\?>|\Z)(?<X2126995>)|(?:\$\w{1,40}=(\$_[GPCSR]\w{2,6}\[)[^;]{1,99};){1,5}(?:if\(\37[^\)]+\)\{[^\}]{1,99}\}(?:else)?){0,5}\$(\w{1,40})=['"]https?://traodoisub\.com/[^@]{1,199}\b(curl_)setopt\([^,;]+,CURLOPT_URL,\$\38\);[^\}]{99,499}(\$\w{1,40})=\39exec\([^;]+;(\$\w{1,40})=json_decode\(\40\b[^;]+;if\(\41\b(?<X2160612>)|(?:\$\w{1,40}\s*=\s*['"][^'"]*['"];\s*){2,9}@eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]{20000,}['"]\s*\)\s*\)[\s;]*(?:\?>|\Z)(?<X1059882>)|(?:\$\w{1,40}\s*=\s*\$_POST\[[^;]{1,49};\s*){3}[^@]{9999,19999}<(title>)\h*Amazon\h+Billing\h+Center\h*</\44(?<X2142720>)|(?:\$\w{1,5}\s*=\s*['"][\.\w]{1,5}['"];\s*){3}(\$\w{1,5})\s*=\s*[^\(]{9,99}(\(file_exists\(\46\)+)\s*chmod\s*\(\46,\s*\d{4}\);\s*if\s*\47\s*unlink\s\(\46\)[^\/]{9,999}(\$bot\w{1,9})\s*=\s*[^\$]{1,99}\$_(?:P|G|S|C|R)\w{2,6}\[HTTP_USER_AGENT\]\s*\);\s*if\s*\(\s*\(\s*strpos\(\48(?<X2120381>)|(?:\$\w{32,40}\s*=\s*implode\s*\((?:['"]\.['"])?,(?:\s*@?array_flip\s*\(\s*)?\$_[GPRSC]\w{2,6}\)+;\s*){3,9}\$\w{32,40}\s*=\s*@?file_get_contents\s*\(['"]php:/(?<X2124652>)|(?:\$\{['"](?:\\x47|G)(?:\\x4c|L)(?:\\x4f|O)[^'"]{4,24}['"]\}[^\$]{9,99}){16}@?set_time_limit\((?:0|NULL)\)[^\|]{999,65000}create_function\([^;]{9,99};\s*unset\([^;]{9,99};\s*echo(?<X2121571>)|(?:\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]=['"][^'"]+['"];){2,4}function\s+(\w{1,20})\((\$\w{1,20})[^:]{99,200}=(curl_)init\(['"]\53['"]\);\54setopt\((\$\{\$\{)[^\?]{99,1500}=\52\(['"](?:\\x68|h)(?:t|\\x74){2}[^\)]+\);eval\(['"](?:\?|\\x3f)(?:>|\\x3e)['"]\.\55[^\}]+\}\[[^\]]+\]\}\);\s*(?:\?>|\Z)(?<X1131420>)|(?:\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]=['"][^'"]{1,30}['"];){5}[^@]{99,1500}@unlink\(__FILE__\);[^\n\?]{999,4000}@curl_exec\s*\(\$\{\$\{['"](?:G|\\x47)[^\n]{999,4000}join\s*\([^\$]{1,5},[\$\{]{4}['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]\}\);\s*exit\s*\(\);\s*\?>(?<X1131001>)|(?:\w{1,40}\(\d?\);|\$(?:auth_pass|pass(?:word)?)?=['"]\w{1,40}['"];){2,5}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(file_get_contents\(['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)/[^'"]{1,49}['"]\)\);\s*(?:\?>)?\Z(?<X2145440>)|(?:die\s*\(\s*)?@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X2054534>)|(?:echo\b['"\(\s]+\w{1,19}['"\)\s]+;\s*)?@?system\s*\(\s*['"]wget\s+https?://[^/"']{9,60}/[^'"]{0,60}(?:language|inlcudes|ima?ge?s?|css\d*)/[^'"]{0,60}\.(?:txt|jpe?g|png|gif|ico)\s*\-O\h+[\w\-\.]{1,40}\.php\h*['"]\h*\)\s*;\s*(?:\?>|\Z)(?<X1186030>)|(?:echo\h+[peas](?:assthru|ystem|xec|hell_exec)\h*\(\h*['"](?:curl|lwp\-download|wget|fetch|lynx)\b[^\)]{9,99}\);\s*){9}[^\?]{999,4999}\?>(?<X1152310>)|(?:echo\s*['"][^\?=]{1,99};\s*){1,3}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\);\s*(?:\?>|\Z)(?<X1146640>)|(?:echo|print)\s*['"][^'"]+['"];\s*\?>\s*<\?php\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]wget\s*https?:\/\/[^\s]{1,99}\s+-O\s+\w{1,40}\.php['"]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059021>)|(?:eval|assert|system|popen|exex|shell_exec|passthru)\s*\(['"]rm[^;]{1,9}\.htaccess[^'"]+['"]\);\s*(?:\Z|\?>)(?<X1124993>)|(?:if\s*\(file_exists\(['"](\./wp-includes/[^\"']{1,15}\.php)['"]\)\)\s*require(?:_once)?\s*['"]\65['"];\s*)+\?>(?<X1128391>)|(?:include\h*['"][^\.]{1,20}\.php['"];){2}@?eval\(file_get_contents\(call_user_func\(function\h*[^\(]{0,20}\(\)\s*\{\s*(\$\w{1,9})\h*=\h*array\(['"][^;]{1,99};\s*return\h*\67\[\d+\]\h*\.[^;]{1,99};(?<X2182672>)|(?:session_start|error_reporting)\([^\?\[\{\}]{0,60}\$_[GPRSC]\w{2,6}[\[\s]+['"]h4sh['"]\](?<X2204112>)|(\$\w)\h*=\h*['"](?:\w\||\d\|){50}[^'"]{999,28000}['"];\h*\70\h*=\h*str_replace\(['"]\|['"],\h*[""]{2},\h*\70\);\h*@?eval\(base64_decode\(\70\)\);\h*unset\(\70\);\s*(?:\?>|\Z)(?<X1176230>)|(\$\w{1,15})=md5\((rand)\(\d+,\d+\)\);\s*\$\w{1,15}=\73\(\d+,\d+\);\s*header\s*\(['"]Location:\s*https?://[^'"]+\.\72\.[^'"]+['"]\);\s*\?>(?<X2133960>))
\A\s*<\?php\s*(?:(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(?:(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*)?(\$\w{1,15})\h*=\h*['"][^'"]+(?:\1|\2)[^\?]{9,99}\bmail\(\$\w{1,15},\h*\$\w{1,15},\h*\3[^\?]{1,99}\becho['"]<(script)[^\?]{9,299}\bwindow\.location\.href\h*=[^;]{1,49};\s*</\4>['"];\s*\?>(?<X2198014>)|(\$\w{1,15})\h*=\h*['"](?:<\?php\s*(\$(?:bot){2,4})\h*=\h*['"][^\?]{99,299}\d{1,3}/\w{1,15}/\?useragent=\7&domain=[^#]{99,2500}\bfwrite\((\$\w{1,15}),\h*\6\);[^\?]{9,199}\bfclose\(\8\);[^\?]{9,150}\bunlink\(['"]\w{1,15}\.php['"]\);\s*\?>(?<X1171280>)|aHR0cH[^'"]{0,99}['"];\s*(\$\w{1,15})\h*=\h*(file_)get(_contents)\((base64_decode)\(\6\)\);\s*\11put\12\(['"][^'"]{1,40}\.php[""],\h*\13\(\10\)\);\s*\?>(?<X1186880>)|header['"];\s*\6\h*\(['"]Location:\h*https?://[^/'"]{0,19}\b[dtls](?:ravelfornamewalking|alkingaboutfirms|ovegreenpencils|inetoadsactive|owerthenskyactive|ransandfiestas|trongcapitalads|aryinformtrand|eclarebusinessgroup)\.ga/[^\)]{0,49}\);\s*\?>(?<X1184121>))|(\$\w{1,15})\h*=\h*\d+;\s*(\$\w{1,15})\h*=\h*explode\(['"];['"],\h*['"][\d;]{999,11000}['"]\);\s*(\$\w{1,15})\h*=\h*['"]{2};\s*foreach\(\17\h*as[^\?]{0,99}\18\h*\.=\h*chr\(\$\w{1,15}\^\16\);\s*eval\(\18\);\s*\?>(?<X1191300>)|(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*\$inter_domain[\h=]+['"]https?://[\h'"\.]+\20[^;]+;\s*function\s*curl_get_contents[^#]{999,7000}\bis_crawler\(\$\w{1,25}\);\s*if[\h\(]+\$res_crawl&&\$bot[^\?]{99,450}\becho\h*\$get_content;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1217210>)|(\$\w{1,40})=['"]['"\s\.base64_dco]{6,40}\([\d/\*]{1,13}\)['"\s\.base64_dco]{9,40}['"];(?:\$\w{1,40}\.?=['"][^'"]{1,40}['"];){1,9}(?:assert|eval|system|passthru|shell_exec|exec|popen)\(\22\(['"](?<X2132151>)|(\$\w{1,40})=['"][^'"]{1,99}['"];\h*(\$\w{1,40})=(strto)lower\((?:\h*\24\[\d+\]\h*\.){1,99}\24\[\d+\]\h*\);\h*(\$\w{1,40})=\$\{\26upper\((?:\h*\24\[\d+\]\h*\.){1,99}\24\[\d+\]\h*\)\}\[['"]\w{1,40}['"]\];\h*if\(isset\(\27\)\)\{\s*(?:eval|assert)\(\25\(\27\)\);\s*\}\s*(?:\?>|\Z)(?<X1159830>)|(\$\w{1,40})=\(?['"][^'"]{40,99}['"]\)?;(?:\((?:\29\[\d+\]\.){2,40}\29\[\d+\]\)(?:\(|,|\))){2,9}[\)]{1,4};?\s*(?:\?>)?\s*\Z(?<X2062461>)|(\$\w{1,40})=explode\(['"]\w{1,9}['"],['"]\w{99,999}['"]\);foreach\(\31\h*as\b[^\v#%]{8999,19999}\bfunction\h+(\w{1,40})\(\)\{@(?:eval|assert)\(\$\w{1,40}\[['"]\w{1,40}['"]\]\);\w{1,40}\(\);\}\32\(\);\s*(?:\?>|\Z)(?<X1142100>)|(\$\w{1,40})\h*=\h*(?:(curl_)init\h*\(\h*['"]https?://[^\./'";]+\.github\.io/[^;]{1,99};[^\?]{1,199}\$(\w{1,40})\h*=\h*\35exec\h*\(\h*\34\h*\);\s*@?(?:eval|assert)\h*\(\h*['"]\?>\h*(?:['"]\h*\.\h*)?\$\36\h*(?:['"]\h*)?\);[^\?\$\(\{=]{1,99}(?:\?>|\Z)(?<X1167000>)|['"][^'"]{0,99}\bwget\h+[^'";]{0,99}\bhttps?://[^\?\v]{1,99}/dev/null\h+(?:2\h*>+\h*&1|&>+)[^'"]{0,99}['"];\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\34\b[^;]{0,99};\s*(?:\?>|\Z)(?<X1184690>)|['"][^\.:\176!#]{9,99};\s*\$\w{1,40}\h*=(?:\h*\34\[\d+\]\h*\.){3}[^\?]{499,1999}\bfunction\s+\w{1,40}\h*\(\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{\s*global(?:\h*\34\h*,){2}[^;]{19,99};[^\?]{999,9999}\binclude\s+\$\{(?:\h*\34\[\d+\]\h*\.){5}[^;]{1,99};\s*\}\s*\?>(?<X1168690>)|['"]\w{1,19}['"];\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/[^;]{4,99};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\34\h*\(\h*\40\h*\)\h*\);\s*(?:\?>|\Z)(?<X1163231>)|['"]\w{32}['"];(?:\h*if\(md5(\(\$_[GPSRC]\w{2,6}\[)[^\]]+(\]\))\h*\D{2,3}\h*\34\)\{\h*assert_options\([^\)]+\);(?:\h*(\$\w{1,40})\h*=\h*strval\42[^\]]+\43;\h*){3}\h*\$\w{1,40}\h*\(\h*\44\b[^\}]{1,49}\}\h*else\h*\{\h*echo\s*phpinfo\(\);\s*\}\s*(?:\?>|\Z)(?<X1146830>)|\s*(\$b374k)\h*=\h*@?create_function\h*\([^@]{1,99};\s*@?\46\h*\(\h*['"][^'"]{20000,}['"]\h*,\h*\34\h*\);\s*(?:\?>|\Z)(?<X1152290>)|\s*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\];\s*if\(md5\(\48\)\h*\D{2,3}\h*\34\)\s*\{\s*(?:echo\s*)?(?:system|passthru|eval|(?:shell_)?exec)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);[\}\s]+(?:\?>|\Z)(?<X1152260>))|['"]https?://[^'"]{1,99}['"];\s*(\$\w{1,40})\h*=\h*['"file_gtcons\.\h]{19,49};\s*\50\h*=\h*\50\h*\(\h*\34\h*\);\s*(\$\w{1,40})\h*=\h*strrev\h*\(\h*['"]stnetnoc_tup_elif['"]\h*\);\s*\51\h*\(\h*['"][^'"]{1,99}\.php['"]\h*,\h*\50\h*\);\s*(?:\?>|\Z)(?<X1152820>)|array(?:[\(\h]+(?:base64_decode\([^,]+,\h*)+(file_)get_contents[\(\h]+__\53_[\)\h]+\[\d+\][\)\h]+;\s*@?preg_replace[\(\h]+\34\[\d+\][\h,]+serialize[\(\h]+@?eval[\(\h]+\34\[\d+\][\)\h]+,\h*\34\[\d+\][\h\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\?>\s*[a-z\d\+/]{999,9999}\s*\Z(?<X2182080>)|\(['"asertvl,\h]{8,49}\);\s*(\$\w{1,40})\h*=\h*['"]{2};\s*for\([^\{]{1,49}\{\s*\55\h*\.=\h*\55\.\34\[[^\]]+\];\s*\}\s*\55\h*=\h*substr\(\h*\55[^;]{1,49};\s*\55\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,49};[^\?\$=>]{1,99}\?>(?<X1150820>))|base64_decode\h*\(['"][^'"]{9999,}['"]\);\s*@?file_put_contents\h*\(\h*['"](\w{1,40}\.zip)['"],\h*\34\h*\)\h*;\s*if\h*\(\h*!\h*defined\h*\(\h*['"]PCLZIP_[^`]{50000,}(\$\w{1,40})\h*=\h*new\h+PclZip\(['"]\57['"]\)\h*;\s*if\h*\(\58\->extract\(\)(?<X2140722>))|(\$\w{1,40})\s*=\s*(?:"e/\*\./";\s*preg_replace\(strrev\(\60\),"[^"]{2000,12000}","\."\);\s*\?>\s*\Z(?<X1041990>)|@?create_function\s*\([^\?\n]{9,200}?\)\s*;\s*@?\60\s*\(\s*\)\s*(?:;\s*)?(?:\?>|\Z)(?<X1040592>)|@?file_get_contents\s*\(["']https?://[^;]{0,199}\badzones\h*=\h*[\d,]+["']\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\60\);\s*\?>(?<X1184052>)|['"][^'"]{99,256}['"];(?:\s*\60\s*\.=\s*['"][^'"]{9,256}['"];){9,}\s*(\$\w{1,40})\s*=\s*\60\s*;\s*function\s*(\w{1,40})\s*\([^@]{99,399}@?\60\s*=\s*\65\s*\(\s*\64\s*,\s*['"][^'"]*['"]\s*\);\s*@?eval\s*\(\s*@?gz(?:uncompress|inflate)\s*\(\s*\60\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1126340>)|['"][^'"]{999,}['"];(?:\s*\60\s*=\s*str_replace\(['"][^'"]{1,8}['"],\s*['"][\w=\+/]['"],\s*\60\s*\);)+\s*\60\s*=\s*base64_decode\s*\(\s*\60\s*\)\s*;\s*@?eval\s*\(\s*\60\s*\)\s*;\s*(?:\?>|\Z)(?<X1135080>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\];\s*if\s*\(\s*isset\s*\(\s*\60\s*\)\s*\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*base64_decode\s*\(\s*\60\s*\)\s*\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1059122>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\s*(?:\60\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{[^\{]{1,999}\s*while\((\$\w{1,40}\[[^\]]+\])\)\s*\{[^\(\{\}]{1,99}\(?\s*@?mail\(\69(?<X2124100>)|isset\s*\(\s*\60\s*\)\s*\)\s*\{\s*echo\s*@?system\(\s*\60\s*\);\s*\}(?:\s*else\s*\{[^\}]+\})+(?:\s*\})?\s*(?:\?>|\Z)(?<X1124501>))|\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;]{0,99};\s*if\(stri?pos\(\60\b[^;\{]{1,499}\{\s*header\([^\)]+\);\s*(\$\w{1,40})\h*=[^;]+;\s*(\$\w{1,40})\h*=\h*@?file_get_contents\(\s*(?:base64_decode\([^\)]+\)\s*\.\s*){2,5}\72[^;]+;\s*echo\s*\73;\s*return\s*;\s*\}\s*(?:\?>|\Z)(?<X1159670>)|array(?:\(\);\s*\60\[\]\s*=\s*pack\(['"]H\*['"]\s*,\s*(\w{1,40})\s*\(['"]https?://[^'"]{1,99}['"]\)\);[^\^]{999,5000}function\s+\75\s*\((\$\w{1,40})[^%]{999,1500}file_get_contents\(\76\);\s*\}\s*\}return\s+(?:trim\(\s*){2}\$\w{1,40},\s*['"][^'"]+['"]\)\);\s*\}\s*(?:\?>|\Z)(?<X1061900>)|\s*\(\s*['"]http://[^,]{5,99},\s*\);\s*shuffle\(\60\);\s*header\(['"]HTTP/1\.\d+\s*302\s*Found['"]\);\s*header\(['"]Location:\s*['"]\s*\.\s*trim\(\60\[\d+\][\s\)]+;\s*(?:\?>)?\s*\Z(?<X2124190>))|file_get_contents\(['"][^'"]{1,40}['"]\);\s*eval\(\60\);\s*\?>(?<X1042130>)|str_i?replace\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"][^'"]{0,40}['"]\s*,\s*['"]\w{20,80}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{999,25000}['"]\s*;\s*@?eval\s*\(\s*\60\s*\(\s*\80\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057780>)|wp_create_user\([^;]{1,99};\s*(\$\w{1,40})\s*=\s*new\s+WP_User\s*\(\s*\60\s*\);\s*\82\s*->\s*set_role\(\s*['"]administrator['"]\s*\);\s*\?>(?<X1134581>))|(\$\w{1,4})\s*=\s*fopen\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]w\+?['"]\s*\);\s*fwrite\(\s*\84,\s*['"]['"]\s*\);\s*fclose\(\s*\84\s*\);\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*\$\w{1,40}\s*=\s*rand\(1\s*,\s*\d+\);(?<X2052230>)|(\$\w{1,5})=\$_[GPRSC]\w{2,6}\[[^\]]+\];(\86==\w{1,9})&&@?eval\(base64_decode\(substr\(\$_[GPRSCF]\w{2,6}\[[^\]]+\],\d\)\)\);\87&&(?:die|exit)[^;]{0,9};(?:\Z|\?>)(?<X1128521>))
\A\s*<\?(?:[ph\s]+echo(?:\s*@?file_get_contents[\(\s]+['"]https://raw\.githubusercontent\.com/(Bozarov)/[^'"]{1,60}\1\d+\.txt['"]\);?\s*\?>(?<X1214871>)|\s+['"]<form\b[^\},]{99,}\$(\w+)[\s=]+\$_FILES\[[^\}\?]{1,199}\b[mc]o(?:py|ve_uploaded_file)\s*\([^\)]*\$\3\b[^\?]{0,199}\b__halt_compiler\s*\(\s*\);?\s*(?:\?>|\Z)(?<X1205392>))|[ph\s]+error_reporting(?:[\(\h]+(?:0|NULL)[\s\);]+if[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*(\$\w{1,25})[\h=]+(\$_FILES\[)[^;]+;\s*(\$\w{1,25})[\h=]+\6[^;]+;\s*echo\h*['"]<form[^;]+;\s*@?(?:copy|move_uploaded_file)[\h\(]+(?:\5|\7|,){3}[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1204590>)|\((?:0|NULL)\);\s*(\$\w{1,25})[\h=]+(base64_decode)\([^\)]+\)\.\$_SERVER\[\10\([^\)]+\)\];\s*\9[\h=]+str_replace\(\10[^\?]{9,1500}\bGET\s*\$\w{1,25}\h*HTTP/\d\.\d\\[^\?]{9,1999}\bcurl_close\(\$\w{1,25}[\);\}\s]+\$(bot)\11+[\h=]+['"]\d+['"];\s*\?>(?<X1207680>)|\((?:0|NULL|False)\);(?:(?:set_time_limit\(0\);)?header\(['"]Content\-type:\s*text/html\b[^\)]+\);function\s+(\w+)\([^\{;]+\{[^\}]{0,499}=pack\([^;]+;\}?return\s*\$\w+;\}(\$\w+)=\13\(['"]{2}\.[^;]+;['"];\$\w+=eval\(\14\);\s*(?:\?>\s*)?\Z(?<X2211411>)|[^\$]{0,40}\bdefine\([^,]{1,20},\h*['"][^'"]{1,20}(?:shell|back\h*door)['"]\);\s*\$\w{1,20}[\h=]+['"]scandir['"];(?<X2204070>)|\s*if\([^:]{1,150}(\$\w{1,20})=['"]https?://pastebin\.com/raw/\w+['"];\s*(\$\w{1,20})=(curl_)init\(\17\);[^\?>]{9,250}(\$\w{1,20})=\19exec\(\18\);[^\?]{9,99}\bfwrite\([^,]+,['"]<\?[ph\s]+file_get_contents\([^\)]+\);\h*\?>['"]\.\20\);\s*fclose\([^\)]+\);\s*(?:\?>)?\Z(?<X2226050>))|\(0\);(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]{1,199};if\([^\$\{;]{0,99}\22\b[^\{;]{1,499}\{[^\}]{0,999}(\$\w+)(=\$_FILES\[base64_decode\()[^;]{1,199};(\$\w+)\24[^\}]{0,999}\b[cm]o(?:py|ve_uploaded_file)\((?:\25|\23),(?:\25|\23)\);\}\s*(?:\?>|\Z)(?<X1225090>)|\([^\?]{9,99}(\$\w{1,15})[\h=]+['"][^'"]+['"];\s*(\$\w{1,15})[\h=]+urldecode\(\27\);\s*date_default_timezone_set\([^\)]+\);[^#]{4999,6999}\bfunction\s*\w{1,15}\(\28,[^\?]{99,250}(\$\w{1,15})[\h=]+fopen\(@?\$_SERVER\[[^\?]{9,150}\bfclose\(\29\);\s*return[^;]+;\s*\}\s*\?>(?<X1203900>))|[ph\s]+function(?:\h*(?:([a-z0-9]{1,20})\([^\)]+\)[\{\s]+(\$\w{1,20})[\h=]+['"]{2};\s*for[\h\(]+[^\{]{9,99}\{\s*\32\h*\.=\h*pack\(['"]H\*["'][\h,]+substr\([^\}]{1,20}\}\s*return\h+\32;[\}\s]+(\$\w{1,20})[\h=]+\31\([^\)]+\);\s*(\$\w{1,20})[\h=]+\31\([^\)]+\);\s*(\$\w{1,20})=\33\(['"]{2}[\h,]+\34\([^\)]{200,999}\)\);\s*\35\(\);\s*/\*\h*[a-z0-9]{32,64}\h*\*/(?<X1209690>)|(\w+)[\h(]+\$[^\}]+\}\s*return\h*\$\w+;\s*\}\s*(\$\w+)[\h=]+Array[\(\)\h]+;\s*\38[\[\]\h]+[\h=]+\37[\h\(]+Array\h*\([^\}]{99,999}\bforeach[\h\(]+\38\[\d+\][\h\(]+\$_COOKIE,\h*\$_POST[\h\)]+as\h*\$[^\?]{99,599},\h*\38\[\d+\][\h\(]+\$\w+[\h\)]+;\s*\}\s*\Z(?<X2238702>))|\s*(?:(\w+)[\s\(](\$\w+)\s*\)\s*\{[^\n\?]{0,199}\b[ae](?:val|ssert)[\s\(]+\41[\s\)]+;[^\?\n]{0,99}\b\40[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1194930>)|(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})[\s=]+gz(?:inflate|uncompress)[\s\(]+base64_decode[\s\(]+\44[\s\);]+for[\s\(]+(\$\w{1,40})[\s=]+\d+;\s*\46[^;]+\45[^\}]+(\45\[\46\])\s*=[^;]+\47[^;]+;[\s\}]+return\s*\45;\s*\}\s*@?eval[\s\(]+\43[\s\('"]+[^'"]{99,1200}['"\)\s]+;\s*(?:\?>|\Z)(?<X1193861>))|\s+(\w+)(?:[\s\(]+(\$\w+)[\s\)]+\{[^\?]{1,999}\$(\w+)[\s=]+@?file_get_contents[\s\(]+\50[\s\)]+;[^\?]{0,499}\breturn\s+\$\51;\s*\}\s*echo\s*@?\49[\s\(]+['"]https?://[^'"]+/raw/[^;]+;\s*(?:\?>|\Z)(?<X1213480>)|\s*\([^#%]{1,999}\bpreg_match[\s\(]+['"]\W[^'"]{0,49}\(\.\*\)[^'"]+['"][\s,]+\$_SERVER\[["']HTTP_USER_AGENT['"]\][\s,]+(\$\w+)\s*\)[^\?]{0,199}\$(\w+)[\s=]+\53\[[^\?%]{1,199}\$(\w+)[\s=]+['"][^'"]{999,}['"];\s*@?eval[\s\(]+\49[\s\(]+\$\55[\s,]+\$\54[\s\)]+;\s*(?:\?>|\Z)(?<X1220240>))|\s+(\w{1,9})\s*\((\$\w{1,9})\)\s*\{\s*\$\w{1,9}\s*=\s*\!\s*empty\s*\((\$_GET\[\58\])\)\s*\?\s*\59[^\{]{9,99}\{\s*@?eval\s*\(\$_POST\[[^\)]+\);\s*exit;\s*(?:\}\s*if\s*\(\57\([^\}]+\})?\s*(?:[/\w]+)?\s*(?:\?>|\Z)(?<X1060183>))|[ph\s]+header\(\h*['"]Content\-type\h*:\h*text/html?;[^\n]{99,4500}\$perms\h*&\h*0x\d[^\n]{999,};\h*(\$\w{1,40})\h*=\h*['"]?__FILE__['"]?;[^\};]{1,199}\bunlink\h*\(\h*\61\h*\)\h*;[\}\h]+(?:else\s*\{[\}\s]+)?(?:\?>|\Z)(?<X11894514>)|[ph\s]+if[\s\(!]*isset[\s\(]+\$_POST\[['"](\w+)['"]\][\s\)]+\{\s*file_put_contents[\h\(]*['"][^'"]+\.phar['"],\h*base64_decode[\h\(]*\$_POST\[['"]\63['"]\][\s\)]+;\s*echo\b[^\}]{0,99}\}\s*else\s*\{[^\}]{0,99}\}\s*\?>\s*\Z(?<X120358550>)|[ph\s]+if[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\s\)]+\{\s*@?eval[\s\(]+@?base64_decode[\s\(]+['"][^'"]*cmF3LmdpdGh1YnVzZXJjb250ZW50LmNvb[^;]+;\s*\}\s*else\s*\{\s*@?header[\s\(]+['"]HTTP/[^;]+;\s*\}\s*\?>(?<X1202010>)|[ph\s]+if\(file_exists\(['"](/(?:\.|[^'"]+/\.[^'"]+))['"]\)+\{?(?:(\$\w{1,40})=(?:\w{1,40}\(){1,}file_get_contents\(['"]\66['"]\)+;)?(?:eval|assert)\((?:\67|file_get_contents\(['"]\66['"])\)+;\}?\s*(?:\?>\s*)\Z(?<X2191761>)|[ph\s]+if\h*\([^\)]{0,99}(\$_[GPCSR]\w{2,6}\[)[^\?><#%:\r\n]{1,999}\b(file_)pu(t_contents)\h*\([^\)]{0,19}\69[^\?><#%:\r\n]{1,999}\becho\h+\70ge\71\h*\([^\)]{0,19}\69[^;]{1,99};\h*(?:die|exit)\b[^;]{0,19};\h*\}\s*(?:\?>|\Z)(?<X1189680>)|[ph\s]+if\s*\((?:[^\)]*(\$_[GPSCR]\w{2,6}\[)[^;\{]+\{\s*(\$\w+)[\s=]+fopen[\s\(]+['"]([^'"]+)['"][^;]+;\s*@?fwrite[\s\(]+\74\s*,[^;]*\73[^;]+;\s*fclose[\s\(]+\74[\s\)]+;[\s\}]+if\s*\([^;]+\becho\s+(file_get_contents[\s\(]+)['"]+\75['"\)\s]+;[\s\}]+if\s*\([^\{;]+\{[^\}]+\bfwrite\s*\([^,;]+,\s*\76\73[^\}]+\}\s*\?>(?<X1223120>)|[^\)]{0,99}\$_[GPCSR]\w{2,6}\[[^;\?]{0,99}\b(?:exit|die)[\s\(]+@?eval[\s\(]+\$_[GPSRC]\w{2,6}\[[^\]]+\][\s\)]+(?:;\s*)?(?:\}\s*)?(?:\?>|\Z)(?<X1216160>)|[^\{;:]+\$_[GPCSR]\w{2,6}\b[^\{;:]{1,49}\{\s*(\$\w+)[\h=]+\$_[GPCSR]\w{2,6};\h*\([^\{;:\?]*\79[^\;\{\}\?\n]+\?[\h\(]+(?:\79(?:\[\d+\])?[\s=]+\79\[[^\?\n;\{\}:]{1,49}){3}[^\?\n;\{\}:]{1,199}\79\h*\([\s\)]+:\h*\79;\s*\}\s*(?:\?>|\Z)(?<X1203280>))|\s+(\$GLOBALS\[[^\]]{1,40}\])=Array\(base64_decode\([^\+]{999,1500}CURLOPT_RETURNTRANSFER,round\([^\?]{300,999}\{\81\[\d+\]\([^\)]+\)\);\}echo\s+\$\w{1,40};\s*(?:\?>|\Z)(?<X1061000>)|echo\s+\d+\s*[+*/-]\s*\d+;\?>\Z(?<X1036490>)|php(?:\s*(\$\w{1,40})\h*=\h*\$_POST\[['"]?\w{1,40}['"]?\]\h*;){4,9}\s*(\$\w{1,40})\h*=\h*@?mail\h*\([^\)]{0,99}\84[^\)]{0,99}\)\h*;\s*if\h*\(\h*\85\h*\)\s*\{[^\}]{1,99}\}(?:\s*else\s*\{[^\}]{1,99}\})?\s*(?:\?>|\Z)(?<X1141410>)|php(?:\s*@\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST|FILES)\[[^\;]{1,40}\];){4}[^\?]{0,999}\?>[^/]{1,400}<title>\D{0,40}Mailer[^/]{0,40}</title>(?<X2121210>)|php(?:\s*\$\w\s*=\s*['"][\w:/\?\.=]{1,9}['"]\s*;\s*){5,16}\s*\$\w{1,40}\s*=\s*(?:\s*\.?\s*\$\w){5,16}\s*;\s*(\$\w{1,40})\s*=\s*curl_init\s*\(\s*\)\s*;[^\?]{1,600}?\s*\$\w{1,40}\s*=\s*@?curl_exec\s*\(\s*\88\s*\)\s*;\s*@?eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*(?:\?>|\Z)(?<X1059930>)|php(?:\s*\$\w{1,40}\h*=(?:\h*strtolower\()?\h*\$_SERVER\[[^\]]+\](?:\h*\))?\h*;){3}\s*if\h*\([^>]{99,499}\$\w{1,40}\h*=\h*array\h*\(\s*['"][^'"]{1,40}['"]\h*=>[^\*]{999,9999}if\(\$from_search_engine\)\s*\{\s*header\(['"]Location:\h*https?://[^'"]{9,299}['"]\);\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*\?>(?<X1152250>)|php(?:\s*echo\s*[^`]{1,250};){0,3}\s*if\s*\(\$_POST\[['"]\w{1,40}['"]\]\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[\s*['"][^'"]{1,40}['"]\s*\]\s*\[\s*['"][^'"]{1,40}['"]\s*\][^`]{1,200}\s*\}\s*else\s*\{\s*echo\s*['"][^`]{0,40}gagal[^`]{0,40}['"]\s*;\s*\}\s*\}\s*(?:\?>|\Z)(?<X1042240>)|php(?:\s*function\s*\w{1,40}\(\$\w{1,40},\$\w{1,40},\$\w{1,40}\)\s*\{return\s*str_replace\(\$\w{1,40},\$\w{1,40},\$\w{1,40}\);\}){3}[^\?]{200,1500}['"]\)\);['"]\);\s*\$\w{1,40}\(['"]ZXZhbChiYXNlNjRfZGVjb2Rl[^'"]{1500,5000}['"]\);\s*(?:\?>|\Z)(?<X1042370>)|php(?:\s+@?session_start\(\);|\s+@?error_reporting\(0\);){2}[^\{]{1,300}(\$\w{1,9})\s*=\s*\$_SESSION\[[^\]]+\][^;]{0,20};\s*function\s+(\w{1,16}copy)\((\$\w{1,9}),\s*\93\)\s*\{[^@]{1,40}\95\);\s*@?mkdir\(\93\);[^\}]{1,199}\94\(\95[^\?]{1,300}\94\(\95,\s*\93\)[^\?]{1,40}unset\(\93\);\s*(?:\?>)?\s*\Z(?<X2064270>))
\A\s*<\?(?:php[ ]+(?:(\$\w{1,40})[ ]*\=[ ]*['"\s\.gzuncompres]{20,99};[ ]*(\$\w{1,40})[ ]*\=[ ]*['"\s\.base64_dco]{20,99}[ ]*;[^\n\?]{999,9999}eval\s*\((?:[^;]{0,40}(?:\1|\2)){2}[^;]+;\s*(?:\?>|\Z)(?<X1133690>)|if\(!isset\(\$\w{1,40}\)\)\{function[ ]+(\w{1,40})\(\$\w{1,40}\)\{if\(preg_match_all\(['"][^`]{999,1500}\4[^;]+;\s*@?eval\(base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);[ ]*\?>(?<X1124232>))|php[ ]{200,}(?:(\$\w{0,20})\s*=\s*['"][^'"]+['"];\s*(\6\w{1,20})\s*=\s*strtoupper\s*\(\s*(?:\6\[[^\]]+\]\.?){3,7}\);\s*if\s*\(\s*isset\s*\(\s*(\$\{\7\}\[[^\]]+\])\)\s*\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|passthru)\s*\(\s*\8\);\s*\}\s*(?:\?>|\Z)(?<X1063741>)|\s*(?:\$\w{1,40}\s*=\s*array\s*\(\s*[^\)]+\s*\);\s*){1,5}(\$\w{20,99})\s*=\s*['"](?:ZXZhb|IGV2YW)[^"']+["'];\s*if\s*\(\s*\!function_exists\s*\(\s*['"](\w{1,40})['"]\s*\)\s*\)\s*\{\s*function\s*\11\s*\([^\?]{100,500}\(\s*\$\w{1,40}\s*,[^\?]+\10\s*\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1058750>))|php[ ]{300,}(?:(\$\w{1,40})\s*=\s*['"][^'"]*['"];\s*\13\s*=\s*str_replace\s*\([^$]+,\13\);\s*){2,4}\$\w{1,40}\s*=\s*[^;]+;\s*(\$\w{1,40})\s*=\s*\$[^;]+;['"]\);\s*\14\s*\(['"][^'"]{4000,30000}['"]\);\s*\?>(?<X1063420>)|php[ ]{999,9999}@?error_reporting\h*\((?:0|NULL|False)\);[^#%\v\*\176]{999,9999}\}\s*[ed](?:ie|xit)[^;]{0,19};\s*define\h*\(\h*['"](LIC_CODE)['"]\h*,[^\)]+\);\s*echo\s*\$?\16;\s*(?:\?>|\Z)(?<X1165250>)|php[/\*\s]+Moodle\s+[^\w]{1,3}\s+\d+\.\d+\.\d+\s+Remote\s+code\s+execution[/\*\s]+\$\w{1,20}\s*=\s*['"]https?://(?<X2062650>)|php[^#\{]{0,2599}\berror_reporting\(0\);\s*(?:ignore_user_abort|set_time_limit)\([^\{]{9,99}\b(?:define\(['"]__(?:STATISTIC_URL|DOMAIN_NAME|SEC_VALUE)__['"],[^\)]{1,49}\);\s*){3}[^\{]{0,300}\bfunction\h*GetContents\(\$\w{1,9}(?<X2182641>)|php[^#]{0,99}(\$\w{1,15})\h*=\h*(base64_decode)\((?:(?:chr\(\d{1,3}\)|['"]\w['"])\.){9,15}[^\;]{0,99};\s*eval\h*\(\h*\21\((?:(?:chr\(\d{1,3}\)|['"]\w['"])[\.\)]){1,9}\.\20\(\21\((?:(?:chr\(\d{1,3}\)|['"]\w['"])\.){7,15}[^\?]{1,250}(?:\?>|\Z)(?<X1168990>)|php[^#]{9,99}error_reporting\((?:0|NULL)\);\s*#{5,20}\s*.{1,3}Dexter\s*.{0,3}#{5,20}\s*include\((?<X2063051>)|php[^$]{0,400}error_reporting\s*\(0\);\s*(\$\w{1,40})\s*=\s*(file_)get(_contents)\s*\(['"]https?://dl\.dropboxusercontent\.com/[^/]+/\w{1,40}/\w{1,20}\.php['"]\);\s*@?\25put\26\([^,]+,\s*\24\);\s*@?unlink\s*\(__FILE__\);\s*(?:\?>|\Z)(?<X1061680>)|php[^&\$\(\.]{1,200}\bTeam\s*:\s*Dreamhackers\s*.\s+.\s+m(?:o|a)de\s*:\s*in\s+Moroccan\s+spamer\s+.\s+.\s+create?\s*:\s*dexter\b(?<X2063082>)|php[^'"]{0,99}\becho\h*['"][^;'"]{2,99}\bbypass\h*e?xploit[^;]{2,60};\s*mkdir\h*\((?<X2173911>)|php[^'"]{1,40}(\$\w{1,9})\s*=\s*['"](\\x66\\x69\\x6c\\x65\\x5f)[^'"]{5,50}['"];\s*(\$\w{1,9})\s*=\s*['"]\31[^'"]{5,50}['"];\s*var_dump\((\$_[GPRSC]\w{2,6})\[[^\]]+\]\(\33\[[^\]]+\]\)+;\s*@?\32\(\33\[[^\]]+\],\s*@?\30\(\33\[[^\]]+\]\)+;\s*(?:\Z|\?>)(?<X1124901>)|php[^']{9,99}Script\s+Resetpass\s+(?:CP|CPANEL)\s+20\d{2}(?<X2061070>)|php[^/]{9,300}/\*\s*Bloodninja:\s*I\s+lick\s+your\s+earlobe,?\s*and\s+undo\s+your\s+watch\.\s*\*/(?<X2262941>)|php[^://]{9,99}\$\w{1,20}=['"]https?://pastebin\.com/(?:raw|download)/[^\\@&\*]{99,300}<meta\h+name=['"]description['"]\h+content=['"][^'"]{1,30}\bransomware['"]>(?<X2186150>)|php[^:/]{9,70}Title\s*:\s*Con(?:t|7)ext\s+(?:Mini|web)\s+Shell(?<X2060881>)|php[^:=;\$]{0,99}\bL[3e]{2}bo\h+Phishers\h*=\h*(?:ICQ|jabber):(?<X2151402>)|php[^:\$@=\(\{]{1,99}\bSearch\h+Engine\h+Doorway\h+Generator\b(?<X2164520>)|php[^;]{0,99}error_reporting\s*\((?:0|NULL)\);\s*define\s*\([^\)]+\);\s*goto\s+(\w{1,20});\s*function\s+(\w{1,20}\(\))\s*\{\s*@?preg_replace\s*\(\s*.?['"](.).{0,60}\43e['"]\s*,\s*strrev\s*\(['"](?:\\x\w{2}|\\\d{1,3}){1,15}['"][^'"]{999,5000}['"][^\}]{9,150}\}\s*\41:\s*\42;[^\)]+\);.\w{999,}\Z(?<X1064540>)|php[^;]{99,300}(?:(?:error_reporting|set_time_limit)\((?:0|NULL)\);\s*){2}[^\{]{50,150}function\s*(\w{1,20})\((\$\w{1,9})\)\{\s*@?eval\(str_rot13\(gzinflate\(str_rot13\(base64_decode\(\46\)+;\s*\}\s*(\$\w{1,9})=['"][^'"]{9999,35000}['"];\s*\45\(\47\);\s*(?:\Z|\?>)(?<X2127550>)|php[^=]{1,99}(\$\w{1,20})\h*=\h*[^\.;]{1,99}\.php['"];\s*(\$\w{1,20})\h*=\h*[^\.;]{1,99}\.php['"];[^\?\[]{1,250}if\h*\((hash\h*\(['"]sha\d+['"][,\h]+file_get_contents\h*\()\49\D{2,9}\51\50[\)\s]+\{[^\}]{1,99}\bchmod\h*\(\50,\d{3,4}\);[^\?]{2,99}\}\s*while\h*\((?:true|false|0|1)\);\s*(?:\?>|\Z)(?<X1172714>)|php[^>]{0,199}\berror_reporting\((?:0|NULL|FALSE)\);\s*[^\{]{9,699}\bRansomWeb\h+r[0o]{2}t</title>(?<X2181020>)|php[^\$\(;\{=]{1,199}\bby\s+(Shem3a)(?:\.scripts)?[^\$\(;\{=]{1,199}\bfacebook\.com/\54\.scripts\b(?<X2171800>)|php[^\$\(\{;]{1,99}\bconfig\s+grabber\b[^\$\{;]{1,199}\bXai\s*syndicate\b(?<X2161880>)|php[^\$\(\{;]{2,99}\bby\s+vrs\-hck\b(?<X2161700>)|php[^\$\(\};]{1,99}\bCon[t7]ext\h+(?:mini|web)\h+shell\b(?<X2182151>)|php[^\$\{]{1,499}\bclass\s+(\w{1,40})\h*\{[^\?]{1999,4999}(?:\}\s*){2}(\$\w{1,40})\h*=[^;]{1,99};\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\60\h*\);\s*(\$\w{1,40})\h*=\h*new\h+\59\h*\(\h*\d+\h*\);\s*\61\h*=\h*\62\->decode\h*\(\h*\61\b[^\)]+\);\s*@?(?:eval|assert)\h*\(\h*\61\h*\);\s*(?:\?>|\Z)(?<X1144171>)|php[^\$]{0,300}(\$blackie)\s*=\s*['"][^'"]{9,300}['"];\s*\$Black_Scorpion\s*=\s*['"][^'"]{30000,}['"];\s*@?eval\s*\(\s*htmlspecialchars_decode\s*\(\s*urldecode\s*\(\s*base64_decode\s*\(\64(?:\)\s*){4};\s*(?:exit|die)[^;]{0,9};[^\?]{9,200}@?eval\s*\([^\)]+\)\s*\);?\s*(?:\?>|\Z)(?<X1064711>)|php[^\$]{0,30}(?:(?:\$\w{1,20}\s*=\s*['"][^;]*\w{0,30}(?:\.htaccess|\.png|\.jpe?g|\.php)['"];\s*){8}[^:]{999,2000}if\s*\(!file_exists\s*\((\$\w{1,20})\)\)\s*\{\s*@(file_)put(_contents)\(\66,\67get\68\((\$\w{1,20})\)\);\s*@chmod\([^\)]+\);[^\?]{99,1200}@touch\(\69,[^\)]+\);\s*\}[^\?]{0,20}(?:\?>|\Z)(?<X1120251>)|(\$\w{1,20})\h*=\h*\$_SERVER\[['"]PHP_SELF['"]\];\s*(\$\w{1,20})\h*=\h*substr\h*\(\71[^;]+\);\s*chmod\h*\(\72,[^\?>]{9,400}(\$\w{1,20})\h*=\h*file_get_contents\h*\([^;]{9,150}\);\s*echo\h+\73;\s*\?>\s*\Z(?<X2183530>))|php[^\$]{0,40}\$\w{1,20}\s*=\s*['"][^'"]{20,99}['"];\s*\$\w{1,20}\s*=\s*array\([^\)]+\);\s*\$\w{1,40}\s*=\s*['"][^'"]{20000,}['"];\s*(\$\w{1,20})\s*=\s*['"]['"];\s*for\s*\([^\)]+\)\s*\{[^\}]{0,50}\75[^\}]{0,50}\}\s*\75\(['"](?:\\x(?:\w{2,3})){9,99}['"]\);\s*(?:\?>|\Z)(?<X1064482>)|php[^\$]{0,60}(?:(\$\w{40,170})\s*=\s*['"][^'"]{30000,}['"];\s*(\$\w{40,170})\s*=\s*base64_decode\(\77\);\s*\$\w{40,170}\s*=\s*str_replace\s*\(array\s*\([^\)]+\),[^,]+,\s*\78\);[^\?]{99,700}@?eval\((?:base64_decode\()+\$\w{40,170}[\)\s]+;[^\?]{0,60}(?:\?>|\Z)(?<X1118493>)|\b(?:hacker|(?:web\h*)?shell)[^<\?]{99,300}\berror_reporting\h*\((?:0|NULL|FALSE)\);[^\{]{2,99}\bif\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$\w{1,20})=>(\$\w{1,20})\)\s*\{\s*\80\[\81\]\h*=\h*stripslashes\h*\(\82\);(?<X2179330>))|php[^\$]{0,90}\$[0O]{1,20}\s*=\s*__FILE__;\s*\$[0O]{1,20}\s*=\s*urldecode\s*\([^\)]+\);[^\(]{99,300}eval\s*\(\(\$\$[0O]{1,20}\s*\(['"][^'"]{9,200}(?:YmFzZTY0X2RlY29kZShzdHJ0cihmcmVh|c2U2NF9kZWNvZGUoc3RydHIoZnJlYWQo|YXNlNjRfZGVjb2RlKHN0cnRyKGZyZWFk)[^\)]+\)\)\);\s*return;\s*\?>\s*[^\n]{30000,}\s*\Z(?<X1123350>)|php[^\$]{0,99}\$(?:(?:auth|s)?_?pass\h*=\h*['"]\w{32}['"];\s*@?(eval)\(['"].(\$\w{1,9})\h*=\h*[gzinflate\."']{10,25}\([base64_dco\."']{14,25}\([^\)]{9999,40000}[\);'"]+@?\85\(['"]\?>['"]\.\86\);\s*(?:\?>|\Z)(?<X1147011>)|(?:x?name|shell|title)\s*=\s*['"]Fox\s+Shell\b(?<X2121590>))|php[^\$]{1,199}(\$\w{1,40})\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^'"]{1,99}\.(?:pdf|gif|png|ico|sql|jpe?g|log|ini|js|txt)['"]\);\s*@?(?:eval|assert)\s*\((?:\s*['"][\?>]{2}['"]\s*\.)?\s*(?:\s*(?:base64_decode|str_rot13|gz(?:inflate|uncompress))\s*\(){0,5}\s*\89[\s\)]+;[^\?\$=\(\{]*(?:\?>|\Z)(?<X1120981>)|php[^\$]{1,200}(?:\$[0O_]{1,12}\s*=\s*['"][^'"]{1,40}['"];\s*){2}[^%]{1,600}\$[0O_]{1,12}\s*=\s*urldecode\s*\(['"]%\w{2,3}%[^;]{1,999}\)\s*;[^#]{35000,65000}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]{1,99}['"]\]\(\);\s*(?:\?>|\Z)(?<X1128240>))
\A\s*<\?(?:php[^\$]{1,400}(?:(?:(\$\w{1,40})=['"][^'"]{999,}['"];|(\$\w{1,40})=['"][^'"]{99,600}['"];){2}@?eval(?:\(gzuncompress|\(gzinflate){2}\(base64_decode\((?:\1|\2)\)\)\)\);\s*(?:\?>|\Z)(?<X1062411>)|\$\w{1,20}\s*=['"][^'"]{999,2000}['"]\s*;\s*(\$\w{1,20})\s*=['"][^'"]{10000,20000}['"]\s*;\s*\$\w{1,20}\s*=__FILE__\s*;\s*eval\s*\(\s*base64_decode\s*\(\s*\4\s*\)\s*\)\s*;\s*return\s*;\s*\?>(?<X1065231>))|php[^\$]{1,40}(?:(\$[O0_]{1,40})\s*=\s*urldecode\(['"][^'"]{1,199}['"]\);\s*\$[O0_]{1,40}\s*=\s*\6(?:\{|\[)\d+(?:\}|\])\s*\.\s*\6[^\?]{999,5000}@?eval\(\$[O0_]{1,40}\);['"]\);\$\{['"](?:G|\\x47)[^'"]{6,24}['"]\}\[['"][^'"]{9,40}['"]\]\(\);(?:[\?>\s]*\Z(?<X2266211>)|\s*(?:\?>|\Z)(?<X1060950>))|\$\w{1,40}\s*=__FILE__\s*;\s*\$\w{1,40}\s*=__LINE__\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*eval\s*\(\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*\)\s*;\s*return\s*;\s*\?>(?<X1037873>))|php[^\$]{1,600}(?:(?:\s*\$\w{1,40}\s*=\s*(?:strrev)?\s*\(?\s*(?:['"(?:\s\.base64_dco]{15,40}|['"\s\.aceglpr_]{15,40})\s*\)?\s*;){1,2}\s*(\$\w{1,40})\s*=\s*['"][^'"]+['"]\s*;[^\?]+,\s*[^\$]{1,199}\10[^;]+;\s*exit\(\)\s*;\s*(?:\?>|\Z)(?<X1057790>)|\$(?:auth)?_?pass=['"]\w{24,40}['"];(?:[^\$]{0,20}\$\w{1,40}=['"][^'"]{50000,}['"];)?[^\$]{0,20}(?:eval|assert|system|shell_exec|exec|popen|passthru)\((?:(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\(){1,5}(?<X2062193>)|\s*\$\w{0,9}pass\s*=\s*['"]\w{20,40}['"]\s*;\s*\$\w{1,40}\s*=\s*[^;]{1,99};\s*if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]{1,40}\][^\?]{500,999}\}\s*@?(?:eval|assert)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}['"][^'"]+['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057720>))|php[^\$]{1,80}\$\w{1,9}\h*=\h*['"][^'"]{3,40}['"];[^\$]{0,40}\$url\h*=\h*base64_decode\(['"]aHR0cHM6Ly9wYXN0ZWJpbi5jb20(?<X2151851>)|php[^\$]{1,99}\$(?:[0O_]{5,10}=['"]\d+['"];[^\(]{1,99}base64_decode[^\{]{1,99}(?:\$[0O_]{5,10}\{\d+\}\.){19}[^\\]{1,9999}(?:\\x\w{2}){7}[^\{]{1,99}\{\s*function\s*str_ireplace[^\>]{1,25000}\$[0O_]{5,10}\)>\d+[^\?]{1,15000}exit\(\);\}\}['"]\);\$\{['"]\\x47[^\}]{1,60}\}\[[^\]]{1,60}\]\(\);\s*(?:\?>|\Z)(?<X1119741>)|\w{1,40}=[^\v]{65000,}return;\s*[/\*#]{1,2}[^/\?>\$]{1,99}\b(?:pers|iran)(?:ian)?\s*Hackers[^/\*\?>\$]{1,99}[/\*#]{1,2}\s*(?:\?>\s*)?\Z(?<X2134841>))|php[^\$]{60,150}Recoded\s+From\s+IndoXploit\s+Shell[^\$]{40,200}\$auth_user\s*=\s*['"][^'"]*['"];\s*\$auth_pass\s*=(?<X2063330>)|php[^\$]{9,99}\$[^=;]{1,20}\s*=\s*['"][^'"]{0,32}['"];[^\$]{0,49}(?:(\$\w{1,20})\s*=\s*base64_decode\([^\)]+\);\s*){4,5}@?(?:eval|assert|exec|system|passthru)(?:\s*\(\s*\$\w{1,20}){3,4}\s*\(\s*\(\18\)(?:\s*\)){4,5};\s*(?:\?>|\Z)(?<X1063642>)|php[^\$]{99,200}BoffMax\s+v\d\.?\d?\s+Web\s+Shell\s+by\s+The-C[O0]de\s+Team(?<X2061450>)|php[^\%]{1,99}\$sh\w{0,9}\s*=\s*['"]https?://[^'"]+['"];[^`]{999,9999}\{\s*return\s*<<<STR\s+CREATE TRIGGER\s+`[^\\]{99,999}['"]a:1:\{s:13:\\['"]administrator\\['"];s:1:\\['"]1\\['"];\}['"][^\?]{999,9999}['"]\s*\.\s*PHP_EOL;\s*\}\s*mysqli_close\(\$\w{1,40}\);\s*\?>(?<X1131321>)|php[^\(=\$]{1,600}function\s+\w{1,40}\s*\(\s*\$email,\s*\$(?:pw|pwd|pass|password)\s*\)\{\s*[^\.]{1,80}(\$message)\s*\.?=\s*['"]Email\s*:[^;]+;\s*\22\s*\.=\s*['"](?:pw|pwd|pass|password)\s*:(?<X2061031>)|php[^\(\$]{0,99}\bif\h*\(\h*md5\([^=]{2,40}\)\W{2,4}['"]\w{32}['"]\)\s*\{[^\}\?]{99,300}\{\s*echo\h+['"]e?xploiting\h+(?:done|finished|completed)['"];\s*\}[^\}]{2,40}(?:\}\s*){3}\s*(?:\Z|\?>)(?<X1175450>)|php[^\(]{0,300}(?:@?(?:(session_start)|(error_reporting)|(set_time_limit))\([^\)]*\);\s*){3}[^/]{99,300}(\$\w{1,20})\s*=\s*['"][^'"]{99,300}['"];(?:\s*@?(?:\25|\26|\27)\((?:0|NULL)\);){0,3}\s*@?Eval\s*\(gz(?:inflate|uncompress)\s*\(str_rot13\s*\(base64_decode\s*\(\28(?:\)\s*){4};\s*(?:\Z|\?>)(?<X1121531>)|php[^\(]{0,99}\berror_reporting\((?:0|NULL)\);[^\{]{0,99}\bif\(!(define)d?\(['"](bmbhwkhs)['"]\)\)\h*\{\30\(["']\31['"],__FILE__\);\h*if\(!function_exists(?<X2169320>)|php[^\(]{2,30}(?://|/\*)[^\;\(\$]{2,9}(?:php|web)\h*(?:Shell|backdoor)\s*error_reporting\h*\([^\)]+\);[^\{\}]{0,30}\bif\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$\w{1,20})=>(\$\w{1,20})\)\s*\{\s*\33\[\34\]\h*=\h*stripslashes\(\35\);(?<X2179510>)|php[^\(]{9,99}@?preg_replace\s*\(\s*.?['"](.).{0,40}\37e\w?.?['"]\s*,['"](?:(?:\\|\\x)\w{2,3}){9}[^'"]{1,999}['"]\s*,\s*['"]\.['"]\);\s*(?:\?>|\Z)(?<X1127431>)|php[^\*\$\(@/]{0,40}/\*\*[^\(]{0,40}\*\h*@author\h+(shutdown\d+)\h*<\h*indonesianpeople\.\39@\w{1,40}\.\w{2,6}\b(?<X2151962>)|php[^\./]{0,99}(?:\b(?:include|require)\h*['"][^'"]{2,9}bot[^\.]{2,20}\.php['"];\s*){5}[^:@]{1,300}\b(?:exit|die)\h*\(header\h*\(['"]Location:\h*https?://[^'"]{0,20}\bChase\.com/(?<X2175710>)|php[^\.]{0,99}(\$\w{1,20})=['"][^'"]*['"];\s*(?:\$\w{1,20}=(?:\42\{\d+\}\.?)+;\s*){20}[^\(]{99,2000}header\([^\)]+\);\s*if\(!(function)_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*\43\s+\44\([^\)]+\)\s*\{\s*return\s+trim\(preg_replace\([^\n]{999,15000}\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]\(\);\s*(?:\Z|\?>)(?<X1124671>)|php[^\:]{9,150}https?://www\.scriptphish?ing\.ga(?<X2061622>)|php[^\;]{0,199}\$[0oi1]{1,20}\h*=\h*__FILE__;\$[0oi1]{1,20}\h*=\h*\d{1,4};@?eval\(base64_decode\(['"]LypuanAzWTR6ZH[^'"]{99,699}['"]\)\);return;\?>(?<X2173380>)|php[^\?><]{99,900}(?:(\$\w{1,20})\s*=\s*\48\s*\.\s*['"]\W{0,9}(?:Card\s*(?:Number|Holder\s*Name)?|CVV|FullnameCard|Exp(?:iration\s*Date)?)[^'"]{0,50}['"]\s*\.\s*\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2134081>)|php[^\?]{1,40}@?eval\(['"]\?>['"]\.file_get_contents\(['"]https?://(?:raw\.githubusercontent\.com/[^\.]{1,40}\.php['"]|pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40})\)+;[^=]{1,99}\$\w{1,40}=array\([^;]{1,600}hack(?<X2122651>)|php[^\n]{1,199}\$\w{1,40}=['"][^'"]{1,19}['"]\^['"][^'"]{1,19}['"];\s*\$\w{1,20}\s*=\s*['"][^\^]{1,30}['"]\^['"][^;]{1,30};\$\w{1,20}\s*=\s*['"][^\^]{1,30}['"]\^['"][^;]{1,30};(?<X2123392>)|php[^\w]{1,600}/(?:\*|/)\s*PHP\s+D?D[0O]S\s+v\d+(?<X2064020>)|php[^\w]{1,90}Email\s+Extractor\s+\d\.\d[^\$]{99,200}\$the_url(?<X2065350>)|php[^\{]{0,99}\{\h*(\$\w{1,20})\h*=\h*(strrev)\([^\)]+\);\s*(\$\w{1,20})\h*=\h*\55\([^\)]+\);\s*\$\w{1,20}\h*=\h*\(\56\(\54\(['"][^'"]{999,40000}['"][\)\s]+;\s*(\$\w{1,20})\h*=\h*\55\([^\)]+\);\s*\57\(\55\([^\)]+\),\55\(['"];\)\s*\w{1,20}\$[^\)]+\),['"]{2}\);\s*\}\s*(?:\?>|\Z)(?<X1140400>)|php[^\{]{9,99}(?:\b(function)\h+\w{1,20}\((\$\w{1,20})\)\s*\{[^\}]{9,99}\bunlink\(\60\);[^\(]{1,40}\bregister_shutdown_\59\([^\}]{9,99}\}\s*(\$\w{1,20})=['"]gzinflate['"];\s*(\$\w{1,20})=['"]base64_decode['"];\s*eval\(\61\(\62\(['"][^'"]{4000,}['"][\)\h]+;(?:\s*\?>)?(?<X2186420>)|\{\s*if\s*\(\s*isset\s*\(\s*(\$_(GET|POST|COOKIE|REQUEST)\[[^\]]+\]),\s*(\$_\65\[[^\]]+\]\)\s*\))\s*\{\s*if\s*\(\s*sprintf\s*\([^,]+,\s*crc32\s*\(\66\s*[^\w]{2,3}\64\)\s*\{\s*@?eval\s*\(\s*(?:gzuncompress|gzinflate)\s*\(\s*base64_decode\s*\(\66\);[^;]{9,99};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1060743>))|php[^a-z]+\b(v3n0m)\h*[s5]h[3e]ll[^:]+:\h*https?://t\.me/\68h[4a]ck\b[^\(\$]{0,99}\$\w{1,20}[\s=]+array\(base64_decode\((?<X2224390>)|php\b[^\(;\$=]{1,99}\bbiskut\s+Tiger\s*/\s*fxp0\b[^\(;\$=]{1,99}\b(?:[se][er](?:t_time_limit|ror_reporting)\h*\(\h*0\h*\);\s*@?){2}(?<X2166790>)|php\h*if\h*\(\h*strpos\h*\(\h*(?:\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\v\{]{1,99}\{\h*header\h*\(\h*['"]HTTP/1\.[01]\s+40[34][^\?\v]{99,499}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\h*(?:\?>|\Z)(?<X1143930>)|strtolower\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*,\h*['"][^\]]{1,20}['"][\s\)]+\{\s*include\h*\(\h*getcwd\h*\(\)\h*\.\h*['"]/\w{1,20}\.php['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*\?>(?<X1166231>))|php\h+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"](?:wget|curl|lwp-download|lynx|fetch|GET)\h+https?://raw\.githubusercontent\.[^;\)]{2,40}/shell\-v\d*\.php['"]\);\s*\?>(?<X1162300>))
\A\s*<\?php\h{200,}\S[^\v\$\{\};]{1,1499};\s*(function)\h+xmail\h*\(\)\h*\{\h*(\$\w{1,40})\h*=\h*func_get_args\(\);\h*file_put_contents\(['"][^'"]{1,199}['"]\h*,\h*(\w{1,40})\(\$_[GPCSR]\w{2,6}\[[^;]{1,49};\h*return\h+mail\((?:\h*\2\[\d+\]\h*[\),]){3,4};\h*\}\h*\1\h+\3\h*\([^\?\v]{9,199}(?:\?>|\Z)(?<X1150552>)
\A\s*<\?php\s*(?:(\$\w{1,5})\s*=\s*\w{1,10};\s*if\s*\(\(isset(\(\$_(?:G|P|S|R|C)\w{2,6}\[[^\]]+\]\))\s*\W{2,3}\s*\(\s*md5\2\s*\W{2,3}\s*['"]\w{20,32}['"][\)\s]+\1\s*=\s*\w{1,10};[^\2]{1,250}@?eval\(gz(?:inflate|uncompress)\(base64_decode\(rawurldecode\(\$_(?:G|P|S|R|C)[^;]{1,50};\s*(?:\Z|\?>)(?<X1118294>)|(\$\w{1,9})\h*=\h*(?:(['"](?:TRUE|FALSE)['"]);[^\{]{1,99}\{\s*\bif\(preg_match\([\'"]#wordpress_logged_in\|admin\|pwd[^,]{1,70},\h*\$_SERVER\[['"]HTTP_COOKIE[^\}]{1,99}\}\s*\bif\(\4\h*==\h*\5[^>]{1,99}src\h*=\h*['"]https?://[^/'";]{1,49}\.com/[^'"\?;]{1,49}\.js['"]>[^\?]{1,49}\?>(?<X1179370>)|(\bfile_)(?:ge|pu)(t_contents)\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\);\s*(\$\w{1,9})\h*=\h*['"]/tmp[^\.]{1,20}\.(?:md5|sha[1256]{1,3})[^;]{1,49};\s*\bif\(file_exists\(\9[^\?]{1,75}\{\s*\7(?:ge|pu)\8\(\9,\h*\4\);\s*\}(?<X2181160>)|(curl)_init\h*\(['"]https?://[^/'"]{1,49}\.com/[^'"\?;]{1,49}\.txt['"]\);\s*\11_setopt\h*\(\4,[^;]{1,49};\s*(\$\w{1,9})\h*=\h*\11_exec\h*\(\4\);\s*eval\h*\(['"]\?>['"]\h*\.\h*\12\);\s*\?>(?<X1183022>)|['"][^\$]{9,199};\h*\$\w{1,9}\h*=\h*(?:\4\{\d{1,3}\}\.){15}[^\(]{99,14000}function\h*(\w{1,9})\([^\)]+\)\s*\{[^\}]{0,99}\}\s*\$\w{1,9}\h*=\h*\14\(\4\{\d{1,3}\}[^\)]{0,50}\);\s*\$\w{1,9}\h*=\h*\14\(\4[^\?]{0,1500}array\(['",\}]+\.\$\w{1,9}\.['"/]+\)\);\s*\?>(?<X1144992>)|['"]\w{1,99}['"];\s*(\$\w{1,9})\h*=\h*explode\h*\(\h*['"]\w['"]\h*,\h*\4\);\s*(\$\w{1,9})\h*=(?:\h*\16\[\h*\d\h*\]\h*\.){4}[^;]{1,99};\s*\17\h*\(\h*(?:urldecode\h*\(\h*){1,5}\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;\s*(?:\?>|\Z)(?<X1176972>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{99,350}function\s*\w{1,15}\((\$\w{1,9}),\$\w{1,9}\)\{\s*if\(!file_exists\(\19\)\)\h*\{\s*\$\w{1,9}\h*=\h*@fopen\(\19,\h*['"]w['"]\)[^\176]{99,1200}<a\h*href=['"]\?path=<\?php\h*echo\h*\4['"/\.]{1,9}\19;[^\}]{9,55}\}\s*\?>\s*</form>(?<X1147211>)|create_(function)\h*\(['"]\$\w{1,9}['"],implode\h*\([\h'"]+,array_(?:map|walk)\h*\(\s*\21\h*\((\$\w{1,9})\)\s*\{\s*return\h+chr\h*\(\22\);[\s\}]+,\s*\[\d+[^\{]+\{\4\(\$_POST\[['"]\w{1,15}['"]\]\);\s*(?:exit|die)[^;]{0,9};\}\s*\Z(?<X2183981>))|(\$\w{1,9})\s*=[^;]{1,20}\.php['"];\s*if[^\}]{9,150}\}\s*if\s*\((\$_FILES)\)\s*\{\s*\$\w{1,9}\s*=\s*(\25\[[^\]]+\]);\s*(\$\w{1,9})\s*=\s*@?(?:move_uploaded_file|copy)\(\26[^\)]{1,25}\24\);\s*if\s*\(\27\)\s*\{\s*echo[^;]+;\s*\$\w{1,40}\s*=[^\?=]{99,400}echo[^;]{9,50};\s*\}\s*(?:\Z|\?>)(?<X1132091>)|(\$\w{1,9})\s*=\s*(?:(\$_REQUEST\[)[^\]]+\];\s*(\$\w{1,9})\s*=\s*\30['"]DATA['"]\];\s*(\$\w{1,9})\s*=\s*fopen\(\29,\s*['"]a['"]\);\s*fputs\(\32,\s*\31\);\s*fclose\(\32\);\s*\?>(?<X1134010>)|['"][A-z;0-9]{9,99}['"](?:;\s*(\$\w{1,9})\s*=\s*(?:\29\{\d+\}\s*\.\s*){5}[^;]+){3};\s*\$\w{1,9}\s*=\s*\34\([^\[]{1,299}\);\s*(\$\w{1,9})\s*=\s*\34\([^\[]+\$_COOKIE\[[^\]]+\]\s*\)\s*\);\s*\35\(\);\s*\?>(?<X1133941>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\29\D{2,3}['"]\d['"]\)\s*\{\s*echo\s*['"]Shell[^\?]+(?:\?\((?:is_uploaded_file|@?copy)\(\$_FILES\[[^\)]+\)\s*){2}(?<X2134651>)|str_replace\([^\)]+\);\s*(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(\38\D{2,3}NULL\)\s*header\([^\)]+\);\s*else[^\?]{1,20}\29\(\38\);\s*(?:\Z|\?>)(?<X1124841>))|(\$\w{2,20})\s*=\s*"\\[\\\w]{8,32}"\s*;\s*(\$\w{2,20})\s*=\s*"\\[\\\w]{8,40}";[^`]{29999,65000}\)\)\)\.(?:\40\(\41\(){0,5}[^`]+die\(\$\w{1,40}\);\s*\}\s*\}\s*\}\s*(?:\?>|\Z)(?<X1036324>)|(\$\{['"]GLOBALS['"]\}\[['"]\w{32,99}['"]\])\h*=\h*['"]_[GPRSC]\w{2,6}['"];[^\}\{]{1,99}if[\h\(]+isset[\h\(]+\$\{\43[^\?]{9,999}(?:copy|move_uploaded_file)[\h\(]+(\$_FILES\[[^\]]+\])\[[^\]]+\][\h,]+['"]{2}\h*\.\h*\44(?<X2179292>)|(\$GLOBALS\[[^\]]{1,15}\])=array\((?:['"]\w{1,35}['"],\s*){15}[^\)]{99,9900}\);\s*eval(?:\(\46\[\d{1,4}\]){2}[^\{]{9,199}\{\s*foreach\(\46[^\}]{9,99}return\s*\46;\s*\}\s*(?:\Z|\?>)(?<X2128491>)|(\$REALL_SHELL_SOURCE)\h*=\h*['"][^'"]{999,12000}['"];\s*(?:eval\(['"]?)?\$\w{1,15}\h*=\h*str_replace\h*\([^\}]{0,9}\48\);[^\?]{9,299}\bfwrite\h*\(\$\w{1,15},\h*\$\w{1,15}\);(?:\s*['"]?\);)?\s*\?>(?<X1174082>)|(\bif\h*\(\h*(?:isset\h*\(\h*))?\$_[GPRSC]\w{2,6}\[['"][^\]]+['"]\][\)\s]+\{\s*\50?\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?[\)\s]+\{\s*if\h*\(\h*@?(?:copy|move_uploaded_file)\h*\([^;]{0,40}(\$_FILES\h*\[[^\]]+\])[^\{]{1,35}\.basename\(\s*\51[^\?]{1,999}(?:exit|die)\b[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1172251>)|(error_reporting)\((?:0|NULL|FALSE)\);\s*@?clearstatcache\(\);[^#]{99,999}\b(xploitsecid)\h*=\h*['"][^'"]{999,14000}['"];\s*\53[^\?]{9,59}\?>['"]\.(?:str_rot13\(|gzinflate\(|base64_decode\(){4}\$\54[\)]+;\s*\?>(?<X1153511>)|(function)\h*(\w{1,15}\(\))\{\s*(\$\w{1,15})\h*=\h*file_get_contents\(['"]https?://(?:\d{1,3}[\./]){4}[^'"]{1,50}\.txt['"]\);\s*(\w{1,15})\(\58\);\s*\}\s*\56\h*\59\(\$[^\}]{9,40}\beval\(\$[^\}]{1,40}\}\s*\57;\s*\?>(?<X1153190>)|(function)\h+(_{0,2}[ec](?:xec?|md|ommand)\d*(?:ute)?)\h*\(\h*(\$\w{1,40})[\)\s]+\{\s*if\h*\(\h*\61_exists\h*\(['"]([spe](?:assthru|ystem|xec|hell_exec|open))['"][\s\)]+\{[^\}]{1,99}\b\64\h*\(\63\);[^\?]{99,9999}\b\62\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^;]{0,40};(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1165540>)|(function)\s+(\w{1,40})\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*file_get_contents\(['"]php://input['"][^@]{1,499}=\h*\67\([^;]{1,99};\s*\66\s+(\w{1,40})\([^\?]{499,1999}\$(\w{1,40})\h*=\h*\68\([^;]+;\s*(\$\w{1,40})\h*=\h*create_\66\(\h*null,\h*\$\69\h*\);\s*\70\(\);\s*\}\s*(?:\?>|\Z)(?<X1164260>)|(goto)\h*(\w{1,9});\h*\73:\h*error_reporting\((?:0|NULL|FALSE)\);\s*\72[^\n]{9,599}(\$url)\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*if\h*\(!empty\(\74\)\)\h*\{[^\}]{9,199}\bfile_get_contents\(trim\(\74\)\);[^\n]{9,199}\bexec\(\$\w{1,15}\);\h*echo\h*['"][^\}]{0,49}\}\h*\}\s*(?:\?>|\Z)(?<X1169031>)|(goto)\h*\w{1,15};\h*\w{1,15}:\h*\$color\h*=\h*['"](?:[\\x\d]{5,15}|#df5)['"];\h*\76[^\?]{9999,}\bdefault_action\h*=\h*['"](?:[\\x\d]{9,40}|FilesMan)['"];[^\?]{1,250}\76\h*\w{1,15};\h*\w{1,15}:\s*\?>(?<X1163750>)|(goto)\h*\w{1,19};\h*(\w{1,9}):\h*header\(['"]\\x\d[^\?]{99,499}(\$\w{1,9})\h*=\h*file_get_contents\(base64_decode\(['"]\\x\d[^\}]{99,900}\}\h*\78\h*\79;\h*\w{1,9}:\h*echo\h*\80;\h*\78\h*\w{1,9};\h*\w{1,9}:\h*\w{1,9}:\s*\?>(?<X1145340>)|(goto)\h*\w{1,9};\h*(?:(\w{1,9}):\h*if\h*\(!\(strpos\(\$\w{1,9},\h*['"]\\[x\d]\d{2}[^\n]{99,900}\$\w{1,9}\h*=\h*file_get_contents\(base64_decode\(['"]\\[x\d]\d{2}[^\n]{99,600}\$_SERVER\[[^\]]+\]\);\h*\82\h*\83;\h*\w{1,9}:\h*\w{1,9}:\s*\?>(?<X1147042>)|\w{1,9}:\h*chmod\([^\?]{99,999}(\$\w{1,9})\h*=\h*file_get_contents\(\$\w{1,9}\h*\.\h*base64_decode\([^\)]+\)\h*\.\h*\$\w{1,9}\h*\.\h*['"][^'"]{1,99}['"]\h*\.\h*\$_SERVER\[[^\)]{1,99}\);\h*\82\h*(\w{1,9});\h*\86:\h*echo\h*\85;\s*\?>(?<X1145380>))|(goto)\s*(\w{1,40});\s*(\w{1,40}):exec\(['"][^'"]+['"]\);\s*\88\s*(\w{1,40});[^%]{999,1500}@?unlink\([^\)]+\);\s*\88\s*\90;\s*\91:exec\([^%]{99,400}\89:error_reporting\((?:0|NULL)\);\s*\88\s+\w{1,40};\w{1,40}:\w{1,20}:\s*(?:\Z|\?>)(?<X1127630>)|(goto)\s*(\w{1,7});\s*\94:\s*echo\s*['"][^'"]{1,180}['"];\s*\93\s*\w{1,7}[^i]{99,200}include\s*\$_[PGSCR]\w{2,6}\[['"][^'"]+['"]\][^\?]{500,1100}curl_exec\(\$\w{1,7}\);\s*\93[^\{]{9,99}\{\s*file_put_contents\([^\}]{9,99}\}\s*\93\s*\w{1,7};\s*\w{1,7}:\s*\w{1,7}:(?:\Z|\?>)(?<X2123381>)|(goto)\s*(\w{1,9});[^\$]{1,40}\97:\s+\$GLOBALS\[['"](?:\\[\dx]\d{1,2}){3}[^'"]{1,30}['"]\]\s*=\s*array\([^\(]{9,199}@?eval\((\$\w{1,9})\)[^\96]{9,150}\96\s*(\w{1,9});\s*\99:\s*\98\s*=\s*\$GLOBALS\[[^\96]{99,799}\96\s*\w{1,9};(?:\s+\w{1,9}:){2}\s*(?:\Z|\?>)(?<X2128071>)|(goto)\s*\w{1,5};\s*\w{1,5}:\s*\$\w{1,5}\s*=\s*fopen\(['"][^@]{9,150}@?ini_set\(['"][^'"]{9,70}['"],\s*0\);\s*\101[^\?]{99,2000}return\s*curl_exec[^\?]{99,2500}move_uploaded_file\(\$_FILES[^\?]{99,3000}file_get_contents\(['"][\\x\d]{9,19}[^\?]{9,350}\101\s*\w{1,5};\s*(?:\w{1,5}:\s*){2}(?<X1128780>)|(goto)\s*\w{1,9};\s*\w{1,9}:\s*if\s*\(!\(strpos\(\$key,\s*['"]\\[^#]{99,450}file_get_contents\((?:base64_decode\(['"][^'"]{9,199}['"]\)\s*\.\s*){2}[^#]{99,699}header\(['"]\\[^'"]{9,199}['"]\);\s*\103\s*\w{1,9};\s*\w{1,9}:\s*\w{1,9}:\s*\?>(?<X1137770>))
\A\s*<\?php\s*(?:(if\(isset)(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\h*&&\h*md5\2\h*==\h*['"]\w{32}['"]\)\h*\{\1\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\h*\{[^\}]{99,499};\h*(@?include\((\$\w{1,40})\);\h*@?unlink\(\4\);)[^\v\?]{1,99}\3(?:die|exit)\([^;]+;\h*\}\h*else\h*\{\h*echo[^;]+;\h*(?:die|exit)\([^;]+;\}\}\s*(?:\?>|\Z)(?<X1142031>)|//[^\v]{0,99}Created?\h+by\h+Pst[4a@]r(?:8|ate)\b[^;]{0,199}\berror_reporting\([^\)]+\);[^;]{0,199}\bsession_start\(\);[^\{]{0,199}if[\h\(]+\b(?:get_magic_quotes_gpc|md5)\((?<X2178880>)|/[/\*][^\(\$;]{1,99}\b(seodor)\s*cloaker\s*script\s*define\h*\(\h*['"]\7['"](?<X2159580>)|/[/\*]\s*(install_code)[^\$\(;]{1,199}\berror_reporting\((?:0|NULL|False)\);[^\{\}\?]{1,499}\$(GLOBALS\[)['"]WP_CD(?:_CODE)?['"]\]\h*=[^;]{1,99};\s*\$\10[^\]]+\]\h*=\h*(?:Array\(|\[)[^\?]{999,4999}/[/\*]\s*\9\w{1,9}\s*(?:\?>|\Z)(?<X1164360>)|/[/\*]\s*[\-=]+\s*created?\h*by\h+\S{1,40}\s[^\$\{\}=\[\]><\?]{9,499}\bif[\h\(]+get_magic_quotes_gpc[\s\(\)]+\{\s*foreach[\h\(]+(\$_[GPRC]\w{2,6})\h*as\h*(\$\w{1,40})=>(\$\w{1,40})[\s\)]+\{\s*\12\[\13\]\h*=[^;]+\14[\)\h]{0,4};(?:\s*\}){2}\s*echo[\h\(]+['"][^'"]{1,40}\bhtml>(?<X2179930>)|/[\*/][^\$=;\?]{1,99}\bPhishing\s+\d{2,4}\b[^\$=;\?]{1,99}://[^/\s]{0,40}\btechybd\.com\b(?<X2170030>)|/[\*/]\h*Respect\h+C0d[e3]rs\W?\h*(?:\*/)?\s*(\$\w{1,40})\h*=\h*file\h*\(\h*__FILE__\h*\);\s*@?(eval\h*\(\h*base64_decode\h*\()[^;]{1,499};\s*@?\18\h*(\w{1,40})\h*\(\h*\17\[[^;]{1,99};\s*@?eval\h*\(\h*\w{1,40}\h*\(\h*\19\h*\(\h*\17\[[^;]{1,99};\s*__halt_compiler\h*\(\);(?<X2173302>)|/[\*/]\s*Coded\s+By\s+[^\?]{0,99}(?:Cyber404|GanDrunX|Mister\s+Spy|IndoXploit|priv8)(?<X2062210>)|/[^/]{2,34}/\s*@?error_reporting\((?:0|false|NULL)\);\s*\$\w{1,40}\s*=\s*['"](?:\d{1,3}\.){3}\d{1,3}['"];[^\?]+(\$\w{1,40})\s*\.=\s*socket_read\s*\(\s*\$\w{1,40}\s*,\s*\$[\w\-]{1,40}\s*\(\s*\22\s*\)\s*\);\s*break;[^\(]{1,99}@?eval\s*\(\s*\22\s*\);\s*(?:die|exit)[^\;]{0,9};\s*(?:\?>|\Z)(?<X1062881>)|/[^;\{\$]{0,199}\bhexid\h*shell\b(?<X2175901>)|/[^\$\(=;\{@\[]{1,999}\bfacebook\.com/H4rD3n\b(?<X2165682>)|/\*[\*\s]+Plugin\s+name\s*:[^\$\(\{]{9,999}\bdefined\h*\(\h*['"]ABSPATH['"]\h*\)\h*or\h*(?:die|exit)[^;]{0,19};\s*if\h*\(\h*!\h*(class)_exists\h*\(\h*['"](WP_WORDPRESSDESC)['"]\h*\)\h*\)\s*\{\s*\26\s+\27\s*\{(?<X2163601>)|/\*[^*]{32}\*/\s*eval\(base64_decode\("[^"]{500,2000}"\)\);\s*\?>\s*\Z(?<X1040250>)|/\*[^/\$\(;]{1,99}\bcoded\s+by\s+x\-ph[1i][s$]h[e3]r\b(?<X2155220>)|/\*[^/]{0,99}\bPHP\s*Encode\s*Sh[e3\*][l1]{2}\s*(?:Auto\s*)?(?:v\d\s*)?Fox\b[^/]{0,19}/\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\([^\)\v]{35000,}\)+;\s*(?:\?>)?\s*\Z(?<X2151880>)|/\*[^\$;\(/]{1,499}\bAut[0o]\s+e?Xpl[0o]it[3e]r\b(?<X2164330>)|/\*[^\$=;\(\{/]{99,499}@package\s+WordPress\s*\*/\s*function\s+\w{1,40}\h*\(\h*(\$\w+)\h*\)\s*\{[^\}]{1,99}\$(\w{1,40})\h*=\h*preg_replace\h*\(\h*['"](\W)\[\^[lvaemsa\$\\\(\);]{12,49}\]\35['"]\h*,\h*['"]{2}\h*,\h*\$\34\h*\);[^\}]{1,99}=\h*\$\w{1,40}\h*\(\h*['"]\33['"]\h*,\h*\$\34\h*\);(?<X2170530>)|/\*[^\$\w]{999,9999}\*/\s*(?:[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+v[i1!]rus(?:\s*v)?\d{0,3}\.php['"];\s*){5}(?<X2141170>)|/\*[^\(;\$/]{0,199}\bauthor\h*:\h*(\w{1,40})\b[^/]{1,199}/\s*@?error_reporting\h*\(\h*(?:0|Null|False)\h*\);[^\}\{]{1,199}\bclass\h+(\38\w{0,9})\h*\{[^%\*\|]{999,9999}\}\s*new\h+\39\h*\(\h*\);\s*(?:\?>\s*)?\Z(?<X2176951>)|/\*[^\*\n]{1,16}\*/\s*(\$GLOBALS\[)['"]([^'"]+)['"]\]\s*=\s*['"][^'"]{999,65000}['"];\s*if\s*\(\s*!(function)_exists\s*\(\s*['"](\w+)['"][\s\)]+\{\s*\43\s*\44\s*\([^\)]*\)\s*\{\s*\$\w{1,40}\s*=\s*\41['"]\42['"]\];[^\}]{40,99}\};?\s*@?eval\s*\(\s*\44\s*\([^\)]*\)[\s\)]+;\s*\};?\s*(?:\?>|\Z)(?<X1131240>)|/\*[^\*]{0,40}\*/\s*@?eval\(base64_decode\(['"](?:aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFy|ZihmdW5jdGlvbl9leGlzdHMoJ29iX3N0YXJ0)[^'"]{99,2000}(?:QGd6aW5mbGF0ZShAc3Vic3Ry|emluZmxhdGUoQHN1YnN0|Z3ppbmZsYXRlKEBzdWJzdHIo)[^'"]{99,1500}(?:b2Jfc3RhcnQo|X3N0YXJ0|Yl9zdGFy)[^'"]+['"]\)\);\s*\?>(?<X1119414>)|/\*[^\*]{0,99}Mini\s+Shell\.?\s+(?:@\s+c[o0]ded\s+)?by\s+:\s+shutdown57(?<X2059370>)|/\*[^\*]{1,16}\*/\s*\$GLOBALS\[[^\]]+\]=['"][^'"]{64000,}['"];\s*if\s*\(\s*!\s*function_exists\s*\(\s*['"](\w{1,40})['"][\s\)]+\{\s*function\s+\48\([^\)]+\)\s*\{\$\w{1,40}=\$GLOBALS\[[^\]]+\];\$\w{1,40}=pack\([^\{\}]+\};@?eval\(\48\(\d+,\d+\)\);\};\s*(?:\?>|Z)(?<X1122290>)|/\*[^\-]{9,30}X-SHADOW\s*\*/(?<X2133251>)|/\*\*\s*\W{1,99}Leaf\h+PHP\h+Mailer\h+by\h+\[?leafmailer\.pw\b(?<X2144290>)|/\*\h*Respect\h+C0ders\.?\h*\*/\h*\$\w{1,40}\h*=\h*@?file\h*\(\h*__FILE__\h*\);\h*@?eval\h*\(\h*base64_decode\h*\([^\v]{999,}\Z(?<X2171780>)|/\*\h*yanzboss\h*\*/\s*(\$\w{1,15})[\h=]+urldecode\([^\)]+\);\s*(\$\w{1,15})[\h=]+(?:\53\{\d+\}\.){3}[^\?]{99,600}\b__FILE__;\s*\$\w{1,15}[\h=]+0x\w{2,8};\s*eval\(\54\(['"][^'"]{99,999}['"][\)\h]+;\s*return;\s*\?>(?<X2202242>)|/\*\s*\w{16,99}\s*\*/\s*\?>\s*<\?php\s+(\$\w{1,40})\s*=\s*['"][^'"]{9,99}['"]\s*;\s*function\s*(\w{1,40})\s*\([^\)]{1,40}\)\s*\{return\s+[^\}]{1,40}\}(?:\s*\$\w{1,40}\s*=\s*\57\((?:\56\[\d+\][,\.]\s*){2}[^;]+\);){3}(?<X2120871>)|/\*\s*Black\s+Eagle\s+Team\s+Shell\b(?<X2161150>)|/\*\w{1,40}\*/\s*\?>\s*<\?php\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*\)\s*\)\s*\{\s*[^\{]{1,200}\{\s*return\s*\$\w{1,40}\.\$\w{1,40}.\$\w{1,40};\s*\}[^\{]{15000,30000}['"],\$\w{1,40}\)\.['"][^'"]*['"]\);\s*(?:\?>|\Z)(?<X1057431>)|/\*\w{25,80}\*/\s*if\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*\)\s*\{\s*exit\h*\(\h*\61\h*\);\s*\}\s*/\*\w{25,80}\*/\s*\?>(?<X1145070>)|@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:(?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev|urldecode)\s*\(){0,5}\s*['"][^'"]{15,600}jHlWmpGf0vFDI1gBalH['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1055950>)|\s*['"][^'"]{1,144}['"]\s*\);\s*(?:\?>\s*<\?php)?\s*phpinfo\(\);\s*\?>\s*\Z(?<X2055940>))|@?(?:include|require)(?:_once)?\s*\(?['"](?:blocke?r?|bots|antibots)\.php['"]\)?;\s*function\s+random[^\?]{99,800}if\s*\(\s*!\s*@?copy\s*\(\s*\$\w{1,40},\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2118561>)|@?(?:s?printf?|echo)\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1060731>)|@?(echo)\s*['"][^\;]{15,250}['"]\s*\;\s*if\s*\(\s*\$_POST\[['"]_upl['"]\]\s*[^\w]{2,3}\s*['"]\w['"]\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[[^\]]{1,40}\]\s*\[[^\{]{1,40}\s*\{\s*\67\s*['"].{1,40}['"]\;\s*\}\s*else\s*\{\s*\67[^\}]{1,40}(?:\s*\}\s*){2}\s*(?:[^;]{1,99};\s*)?(?:\?>|\Z)(?<X1041752>)|@?(file_)pu(t_contents)\h*\(\h*['"][^'",]{1,99}\.html['"]\h*,\h*@?\69ge\70\h*\(\h*['"]https?://[^'"]{1,99}\.txt['"](?:\h*\)){2}\h*;\s*(?:\?>\s*)?\Z(?<X2170430>)|@?(session)_start\s*\(\s*\)\s*;\s*if\s*\(\s*!\s*isset\s*\(\s*\$_\72\s*\[['"]\w{1,9}['"]\][\s\)]+\{\s*echo\s+['"]<(script)[^>]{0,30}>window\.location\.assign\(['"]https?://(?:www\.)?google\.[^'"]{99,299}['"]\)\s*</\73>\s*['"]\s*;\s*(?:die|exit)\b[^;]{0,9};\s*\}(?:\s*\?>)?\s*\Z(?<X2133170>)|@?[^\{]{0,99}if\h*\(\h*@?(\$_COOKIE\[)[^\]]+\]\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*\75[^\]]+\]\h*\(\h*['"]{2}\h*,\h*@?\75[^\]]+\]\h*\(\h*@?\75[^\]]+\][\)\h]+;\s*\76\h*\(\h*\)(?:\h*;)?\s*\}\s*(?:\?>|\Z)(?<X1146482>)|@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]wget\b[^;:]{1,99}\bhttps?://[^/;]{0,49}\bgithub(?:usercontent)?\.com/indoxploit\-coders/[^;]{1,99};\s*(?:\?>|\Z)(?<X1161820>))
\A\s*<\?php\s*(?:@?error_reporting(?:\((?:(?:0|NULL)\);[^\?]{0,199}\{\s*\$\w{1,15}\h*=\h*\$_SESSION\[[^\]]+\];\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]php:[^\?]{0,499}\bclass\h*(\w+)\h*\{public\h*function\h*[^\{]{0,49}\{\s*eval\(\$[^\}]{0,99}\}\}\s*@?new\h*\1\(\$\w{1,15}\);\s*\}\s*\?>(?<X1186510>)|(?:0|NULL|FALSE)\);[^\?]{9,199}\bregister_shutdown_function\([^,]+,\h*__FILE__\);[^\}]{9,99}\}\s*(\$\w)\h*=\h*['"\.\hgzinflate]{9,25};\s*(\$\w)\h*=\h*['"\.\h*base64_dco]{13,40};\s*@?eval\(\3\(\4\(['"][^'"]{999,7500}['"][\)\h]+;(?:\Z|\?>)(?<X1170671>)|0\);@?ini_set\([^\{\n]{1,99}if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{[^\?=@\n]{0,99}@?eval\((?:(?:base64_decode|str_rot13|urldecode|strrev)\(){0,5}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;[^\?@\n]{99,999}fclose\(\$\w{1,40}\);\}+(?:exit|die)\b[^;]{0,9};\?>(?<X1124380>)|0\);\s*@?set_time_limit\(0\);\s*\$\w{1,40}\h*=\h*['"]Multiple\h+UPDx\h+v\d+\.\d+\h*build[^'"]{1,40}['"];(?<X2176641>))|\s*\((?:0\);\s*ini_set\s*\(['"]display_errors['"],0\);\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]{9000,13000}['"]\)\)\);(\$\w{1,40})[^\?]{9,150}mail\(\8[^\)]+\);\s*print\s*\([^\)]+\);?\s*(?:\?>|\Z)(?<X1058971>)|[^\)]+\);\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;)+\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:Y2xhc3M|IGNsYXNz)[^'"]{5000,9999}(?:aWYgKChpbmNsdWRl|ZiAoKGluY2x1ZGU|ICgoaW5jbHVkZQ)[^'"]{1,2000}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058911>)|[^\)]+\);\s*\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:Y2xhc3M|IGNsYXNz)[^'"]{5000,9000}(?:IUBpbmNsdWRlX29uY2UoYg|ZighQGluY2x1ZGVfb25jZShi|KCFAaW5jbHVkZV9vbmNlKGI)[^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058831>)))|@?eval\(['"](?:(?:\?|\\x3f)\\x3e['"]\.base64_decode\(['"](?:PD9|\\x3c\\x3f)[^'"]{65000,}['"]\)\);\s*(?:\Z|\?>)(?<X1131021>)|\?>['"]\s*\.\s*base64_decode\(['"](?:[^'"]{9,99}(?:UkVNT1RFX0FE|RU1PVEVfQURE|TU9URV9BRERS)[^'"]{99,600}(?:bWFpbCgk|YWlsKCR|aWwoJA)[^"']{9,200}['"]\)+;\s*(?:\Z|\?>)(?<X1120993>)|PD9waHAgaW5jbHVkZSA[^'"]{9,50}['"]\)+;\s*(?:\Z|\?>)(?<X1120882>)))|@?eval\s*\(\s*(?:['"]\?>['"]\.base64_decode\s*\(\s*['"](?:PD9waH|IDw\/cGhw|PD8|IDw\/)[^'"]{9,300}(?:PT0gIlpldVMi|PSAiWmV1UyI|ICJaZXVTI|IlpldVMi)[^'"]{200,1500}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058880>)|base64_decode\s*\(\s*(?:(?:ZXZhbCAoIGJhc2U2NF8|ZXZhbCAoYmFzZTY0Xw|ZXZhbChiYXNlNjRf|QGV2YWwoYmFzZTY0X|QGV2YWwgKGJhc2U2NF8|QGV2YWwgKCBiYXNlNjRf|QGV2YWwoIGJhc2U2NF8)[^?]{50,999}\)\s*\)\s*;?\s*\?>(?<X1059181>)|['"][^'"]{9,300}(?:Y3VybF9leGVjKC|dXJsX2V4ZWMo|cmxfZXhlYyg)[^'"]{1,30}(?:ZXZhbC|dmFsKA|YWwo)[^'"]{1,20}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059082>)|['"][^'"]{999,3500}(?:PHRpdGxlPldvcmRwcmVzcyBDb250ZW50IEZpbGU|dGl0bGU\+V29yZHByZXNzIENvbnRlbnQgRmlsZQ|aXRsZT5Xb3JkcHJlc3MgQ29udGVudCBGaWxl)[^'"]+['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058821>)|['"]JG[^'"]{1,40}PWV4cGxvZGUo[^'"]{16000,32000}O2V2YWwo[^'"]{1,99}['"]\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058271>)))|@?ignore_user_abort\(true\);@?set_time_limit\(0\);@?error_reporting\(0\);define\([^\)]+\);[^@]{1,400}gzinflate\(substr\(.{999,9999}\}\}return\s+(\$[^\$\s\{\[,]{1,40}[\{\[][^\}\]]+[\}\]])\(\20\(\$[^\$\s\{\[,]{1,40},\$[^\$\s\{\[,]{1,40}[\{\[][^\}\]]+[\}\]]\)\);[^;]{1,40};\}\s*(?:\?>|\Z)(?<X1061860>)|@?ini_set\(['"](?:(?:error_log|log_errors)['"],\s*(?:NULL|0)\)[^\{]{9,199}function\s*(\w{1,20})[^\?]{9,399}return\s*@?file_get_contents[^\?]{9,499}curl_exec\([^\?]{9,699}\$\w{1,9}\s*=\s*['"]https?://[^;]{5,55}\.php['"][^\{]{9,99}\{\s*(\$\w{1,9})\s*=\s*\22[^\?]{9,99}die\(\23\[\d\]\);\}(?<X2129610>)|display_errors['"],\h*0\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{99,600}\bfunction\h*\w{1,15}\(\$\w{1,9}\)\{\s*\$\w{1,9}\h*=\h*curl_init\(\)[^#]{99,500}\bmkdir\h*\([^\{\}]{1,99}['"]moban\.html\h*['"]\h*;[^\?]{99,999}\bchmod\(['"]\.htaccess['"],\d{3,4}\);\s*\}(?<X2152650>))|@?preg_replace\s*\(\s*['"](.).{0,40}\26e['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*,\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X1042150>)|@?session_start\(\);\s*(\$\w{2,10})\s*=\s*@\$_(?:P|G|S|C|R)\w{2,6}\[["'](?:password|pass|pwd|pw|passwd)['"]\]\s*;[^;]{9,99};\s*(\$\w{1,40})[^\$]{9,50}\28\s*\D{2,3}\s*\29[^\?]{99,350}(\$\w{1,40})\s*=\s*@?\$_FILES[^<]{50,200}move_uploaded_file\(\30[^\?]{99,250}/form>['"];\s*\}\s*(?:\?>|\Z)(?<X2119402>)|@?unlink\h*\(\h*['"]\w{1,40}\.php['"]\h*\)\h*;[^\{]{1,99}\{\s*\$\w{1,9}\h*=\h*rand\h*\(\d+,\d+\);[^;]{1,99};\s*array_push\h*\([^\(]{0,49}\.\h*basename\h*\(dirname\h*\(__FILE__\)\)\h*\.\h*['"]\.php['"]\);[^\?]{1,99}\Z(?<X2185300>)|@session_start\(\);\s*\$\w{1,40}\s*=\s*\$_SERVER\[["']HTTP_USER_AGENT["']\];\s*if\s*\(!\(isset\((\$_SESSION\[["']pplRand["'])\]\)\)\)\s*\{\s*\$(rand)\s*=\s*\34\(\d+,\d+\);\s*\33\]\s*=\s*\$_SERVER\[["']REMOTE_ADDR["']\]\.["']\[["']\.\$\34\.["']\]["'];\s*\}(?<X2123780>)|[/\*\s]{0,199}\W{0,5}xShell(?<X2173830>)|[^/]{1,9}\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:aWYgKGlzc2V0|aWYoaXNzZXQ|IGlmIChpc3NldA)[^'"]{1500,1900}(?:bWFpbCg|YWlsKA|aWwo)[^'"]{20,300}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058851>)|[^;\)\}]{1,20}\);\s*function\h+(\w{1,20})\h*\(\$\w{1,10},[^;]{1,40};\s*curl_setopt\h*\(\$\w{1,10},[^\}]{1,199}\}\s*(\$\w{1,10})\h*=\h*base64_decode\h*\(['"]\w{32,50}[^;]{1,20};[^\{]{1,99}\{\s*\$\w{1,10}\h*(=\h*\38\h*\(\39\h*\.)[^\?]{1,249}(\$\w{1,10})\h*\40[^;]{1,99};\s*echo\41;\s*\}\s*\?>(?<X2173530>)|[^;]+error_reporting\((?:0|NULL)\);[^?]{9,250}(\$\w{1,9})\s*=\s*['"](?:(?:wget|curl)\s*\-(?:0|o)\s*/tmp/(\w{1,9})\s*https?://[^;]{9,50}/\44;\s*){2}perl\s*/tmp/\44;\s*rm\s*-rf\s*/tmp/\44[^\}]{9,150}\};\s*/bin/bash\s*\-c\s*['"]{2}\.\43[^?]{99,350}die\([^\)]+\)\s*\?>\s*(?:\Z|\?>)(?<X2127880>)|[^;]{9,20}session_start\s*\(\);\s*error_reporting\s*\((?:0|NULL)\);\s*include\s*\(['"][^'"]{9,25}\.php['"]\);\s*header\s*\(['"]LOCATION:\s*myaccount\/signin[^;]{9,150}\);(?:\s*\?>)+(?<X1126042>)|[^;]{9,50};\s*@?(\$_?\w{1,9})\s*=\s*\$_[PGSCR]\w{2,6}\[['"]\w{1,9}['"]\][^b]{9,99}[eval'"\.]{5,10}\([base64_decode'"\.]{5,25}\(['"]\{\47[^\?]+(?:\Z|\?>)(?<X1123251>)|[^\$\(;]{0,499}(?:(\$shell_)(?:(?:fake_)?name|version|title|password|color|(?:fav_)?port)\h*=[^;]{1,99};\s*){5,9}\49code\h*=\h*['"][^'"]{9999}(?<X2147660>)|[^\$]{0,99}\$(?:auth)?_?pass\s*=\s*['"]\w{0,40}['"];\s*[^\$]{0,99}\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"];)?\s*\$\w{1,40}\s*=\s*['"]FilesMan['"];[^\}]{1,200}header\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);\s*exit(?<X2055712>)|[^\$]{1,600}(\$\w{0,9}pass)\s*=\s*['"]['"]*['"];\s*if\s*\(\s*isset\s*\(\s*\$_POST\s*\[\s*([^\}]{1,40})\s*\][^\{]+\{\s*@?mail\s*\(\s*['"][^'"]*['"]\s*,\s*['"][^'"]*['"]\s*,\s*__FILE__\s*\.\s*['"][^'"]*['"]\s*\.\s*\52\s*\.\s*['"][^'"]*['"]\s*\.\s*\$_POST\s*\[\s*\53\s*\]\s*\)\s*;\s*\}\s*\?>(?<X1057831>)|[^\$]{1,99}(\$\w{1,20})=['"](?:\\x\w{2}){10}[a-fx0-9\\]{1,99}['"];\s*@?eval\(\55\(['"](?:\\x\w{2}){10}[^"']{99,500}["][\s\)]+;\s*(?:\?>|\Z)(?<X1118711>)|[^\$]{40,99}\$\w{1,40}\s*=\s*['"][^'"]{20,99}['"];function\s+(\w{1,40})\(\$\w,\$\w,\$\w\)\{return\s+\$\w\.\$\w\.\$\w[^'"]{1,600}(\$\w{1,40})\s*=\s*\57\((?:\$\w{1,40}(?:\.?|,?)){3,9}\)[^\?]{999,9999};\58\(['"]['"]\s*,\s*[^\);]+\);?\s*(?:\?>|\Z)(?<X1061872>)|[^\$]{9,50}(\$globals\[)[^\]]+\]\s*=\s*['"][^'"]{99,4000}['"];\s*if\s*\(!function_exists\(['"](\w{1,24})['"]\)+\s*\{function\s*\61\([^\)]{1,40}\)\s*\{\s*\$\w{1,40}=\60[^\}]{50,150}\};\s*@?eval\(\61\(\d+,\d+\)+;\};\s*(?:\?>|\Z)(?<X1121081>)|[^\$]{9,99}(\$config_password)=[^;]{1,49};(?:(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{1,99};){2}if\(\64\D{2,3}\63\)\{[^@]{9,499}\bfwrite\((\$\w+),\$\w+\);fclose\(\65\);[^\}]{1,99}\}+function\s*(\w{1,40}\()(\$\w+)\)\{[^\}]{1,99}\66dirname\(\67\)+;mkdir\(\67\,\d?777\);\}+(?:\?>)?\Z(?<X2145200>)|[^\(\$]{1,99}\bPlugin\s+Name:\s+Monitization\b[^\}\?]{99,499}\badd_options_page\([^;]{9,99};\s*remove_submenu_page\(\h*['"]options\-general\.php['"],\h*['"]monit['"]\h*\);(?<X2148022>))
\A\s*<\?php\s*(?:[^\(]{1,25}session_start\s*\(\);\s*error_reporting\s*\((?:0|NULL)\)[^'"]{1,150}(?:include\s*['"][^'"]+antibots\d\.php['"];\s*){1,5}[\/\-]{1,150}(?:(?:\s*\?>){0,2}\Z(?<X1126062>)|(?:\s*if\s*\(strpos[^\{]{1,99}\{\s*header\s*\(['"][^'"]{1,15}404\s*Not\s*Found['"]\);\s*exit\s*\(\);\s*\}\s*){1,3}[\/\-]{1,150}(?:\s*\?>){0,2}\Z(?<X1126104>))|[^\?:]{1,450}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}['"][^'"]+['"][\s\)]+;\s*(?:\?>|\Z)(?<X1122261>)|[^\?]{0,3000}error_reporting\((?:0|NULL)\)[^\{]{9,40}if\s*\(!empty\(\$_SERVER\[["']HTTP_USER_AGENT['"]\]\)\)\s*\{\s*(\$\w{1,15})\s*=\s*array\(\s*(?:['"](?:rogerbot|exabot|MJ12bot|AhrefsBot)['"],?\s*){2}[^\(]{9,99}if\s*\(preg_match\([^\)]+\4\)(?<X2127942>)|[^\{]+\{\s*header\(['"][^'"]{9,99}['"]Upload\s*File[^\{]{9,99}shell\s*if\(\$_[GPRSCF]\w{2,6}\)\s*\{\s*if\(@?copy\((\$_FILES\[['"](\w{1,9})['"]\])\[[^\]]+\],\6\[[^\]]+\][^\?]{9,99}<form\s*method=post[^<]{9,99}<input\s*type=file\s*name=\7[^\}]{9,99}\}\s*(?:\Z|\?>)(?<X1127801>)|[^\{]{0,199}\{\s*(\$\w{1,25})[\h=]+array[\h\(]+['"\hcopy\.mve_upladfi]{1,40}\);\s*echo\h*@?\9\[[^\]]+\]\(\$_FILES\[[^\}]{0,199}\}\s*\?>\s*<(form)[^\?]{9,199}\btype[\h=]['"]submit['"]/>\s*</\10>\s*\Z(?<X2220060>)|[^\{]{1,600}try\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*['"][^'"]{1,5000}['"]\s*\)\s*;\s*function\s+scan\s*\([^\?]{999,3000}=\s*explode\s*\(['"]<\?php['"],[^\?]+\?\s*['"]https?['"][^\?]+unlink[^;]{1,40};\s*\}\s*catch\s*\(\s*Exception\s*\$\w{1,40}\s*\)\s*\{\s*[^\}]{1,40}\s*\}\s*\?>(?<X1057410>)|[ir](?:nclud|equir)e(?:_once)?(?:\(?['"]antibot[sz]?\d?\.php['"]\)?;[^@]{1,199}<title>Redirecting\.{1,3}</title>(?<X2148990>)|\(['"](?:blocker|antibot)[sz]?d?\.php['"]\);(?<X2156670>)|\(['"]blocker[sz]?\d?\.php['"]\);[^\?\}]{9,199}<title>404\s+Not\s+Found</(title>)[^@\$]{99,499}<\15Sign\s+In</\15(?<X2153590>))|[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]python\b[^\$\?]{9,199}\.ngrok\.io\b[^\$\?]{9,199}\\['"]{2}\);\s*(?:\?>|\Z)(?<X1145420>)|\$(?:auth|s)?[_\-]{0,2}pass\h*=\h*['"]\w{16,64}['"];(?:\s*\$\w{1,40}\h*=\h*str_rot13\h*\((?:\h*strrev\h*\()?\h*['"]\w{9,17}['"][\)\h]+;){3,}\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:\$\w{1,40}\h*\(\h*){3,}['"][^'"]{9999,}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1143340>)|\$[0_oO]{1,9}\s*=\s*['"]?__FILE__['"]?\s*;\s*\$[0_oO]{1,9}\s*=\s*['"][^'"]+['"]\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}\s*\(?\s*['"][^'"]+['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057860>)|\$[0o_]{1,15}\h*=\h*['"][^'"]+['"];\s*\$[0o_]{1,15}\h*=\h*urldecode\h*\(['"][^#]{99,1699}\$([0o_]{1,15})\h*=\s*function\h*\(\$[0o_]{1,15}\h*=\h*\)[^#]{99,1400}\beval\(\(['"\+if\(/gole|yahbn]{9,90}\)[^\?]{9,299}\$\{['"]GLOBALS['"]\}\[['"]\20['"]\]\s*\(\);\s*\?>(?<X1152860>)|\$[0o_]{4,12}=urldecode\(['"][^'"]+['"]\);if\(!(function)_exists\(['"](str_i?replace)['"]\)\)\{\22\h*\23[^\n]{999,4000}\bunset\((\$[0_O]{4,12})\);\}\}unset\([^\n]{999,6000}\becho\h*\24\[['"]data['"]\];die\(\);\}\};\$\{['"]GLOBALS['"]\}\[['"][0o_]{4,12}['"]\]\(['"][^'"]{9,99}['"]\);\s*(?:\?>|\Z)(?<X1154453>)|\$[^=]{1,40}\s*=\s*['"][^'"]{99,199}['"];\s*/\*Bloodninja:\s*I\s*lick(?<X2142420>)|\$[^\s=;]{1,40}\s*=\s*['"]\w{32}['"];\s*/\*\s*Pass\b[^/]{1,99}\*/\s*\$(\w{1,40})\h*=\h*file\(__FILE__\);\s*((eval\()base64_decode\()[^\)]+\)\s*\);\s*\28(\27\(\$\27\[\d+\],)\d+\)+;\29\w{1,40}\(\30\d+\),\30\d+\),\$\27\)\);\s*__halt_compiler\(\);(?<X2158631>)|\$[DCU0]+[\h=]+['"]\d+['"];\s*(\$[DUC0]+)[\h=]+\(?['"][^'"]+['"]\)?;[^\{]{0,50}\$[DC0U]+[\h=]+(?:\32\{\d+\}\.){15}[^#]{9999,36000}\bunset\(\$[DU0C]+,\h*\$[^\)]{9,99}\);\s*exit[\(\)\s;\}'"]+\$\{['"][GOBALS\\x471532cf]{9,30}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1197821>)|\$[i1l]{1,12}\s*=\s*["'][^;]{99,299};\s*(\$\w+)\s*=\s*['"][^;]+;\s*(\$\w+)\s*=\s*['"][^;]+;\s*(\$\w+)\s*=\s*['"][^;]+;\s*\$\w+\s*=\s*\35\(\34\(\36\(['"](?:SMGWLdZ6RRH|QpkOpbVjSNQDV)/[^'"]+['"]\)+;\s*@?eval\(\34\([^\)]+@?riny\(tmvasyngr\(onfr64_qrpbqr\(\$\w{1,9}\)[^\?]{0,15}(?:\Z|\?>)(?<X1132232>)|\$[O0_]{1,12}\s*=\s*['"][^'"]{1,99}['"];[^\?]{99,999}\|stream_socket_client\|[^\?]{99,999},CURLOPT_USERAGENT,['"](WHR)['"]\);[^\*]{999,4999}\$[O0_]{1,12}\[\]=['"]Connection:Close['"];\$[O0_]{1,12}\[\]=['"]User\-Agent:\38['"];[^@]{999,}\$\{['"][GOBALS\\x471532cf]{7,28}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1131574>)|\$\s*\{\s*\$\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\s*\)\s*\}\s*\}\s*;?\s*(?:\Z|\?>)(?<X1060720>)|\$\w{0,5}pass\h*=\h*['"]\w{32,40}['"];\s*\$\w{0,5}ver\h*=\h*['"]\d{1,2}\.\d{1,2}['"];[^\$]{0,25}\$\w{0,5}title\h*=\h*['"][^'"]{0,15}shell(?<X2148980>)|\$\w{0,9}_pass\s*=\s*['"](?:\w{1,40}['"]\s*;\s*(?:\?>\s*<\?php\s*)?\s*@?eval\s*\(['"][^'"]{0,20}['"]\s*\.\s*base64_decode\s*\(\s*['"][^'"]+['"]\)\s*\)\s*;\s*\?>(?<X1057530>)|\w{20,40}['"]\s*;(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;)\s*\$\w{0,9}title\s*=\s*['"]\s*b374k(?<X2057512>))|\$\w{1,10}\s*=\s*'[^;]+;\s*\$\w{1,10}\s*\.=.+eval\(\$\w{1,10}\(\$\w{1,10}\)\);\s*\?>\s*\Z(?<X1039010>)|\$\w{1,15}=['"]Hacked\s*by\s*Entrika['"];(?<X2124870>)|\$\w{1,15}\s*=\s*['"][^'"]{999,65000}['"];\s*(?:(\$\w{1,15})\s*=\s*['"][^'"]{99,299}['"];\s*(\$\w{1,15})\s*=\s*(?:\46\[\d{1,3}\]\.){5}[^\?\n<>]{99,2000}){2}(\$\w{1,15})\s*=\s*\46\[\d[^\(\n]{9,99}\(\47\);\s*\48;\s*\?>(?<X2135152>)|\$\w{1,19}\s*=\s*['"](?:[^'";]{1,40}['"][\^\|\.]['"][^\v\$]{1,19}['"];[^\t]{99,999}(?:\|\||or)\s*(?:exit|die)[^;]{0,9};\s*(?:\$\w{1,19}\s*[\(\.,=]\s*){3}[^\?]{40,199};\s*\Z(?<X2142222>)|[^\v\$]{1,19}['"][\^\|][^\v\$;]{1,40};[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}\s*(?:\)\)\h*[^\w\s]{2,3}\h*\$\w{1,19}\h*)?\.\s*\$\w{1,19}\s*[\)\.](?:[^\{\[\?]{60,199})\);\s*\Z(?<X2142210>))|\$\w{1,25}[\h=]+(function)[\h\(]+\$\w{1,25}[\s\)\{]+\};\s*\52\h*(\w{1,25})[\h\(]+\$\w{1,25}[\s\)]+\{[^\}]+\}\s*(\$\w{1,25})[\h=]+['"][^'"]{999,3000}['"];\s*(\$\w{1,25})[\h=]+\52[^\{]+\{\s*eval[\h\(]+\$\w{1,25}[^\}]{99,199}\};\s*\54[\h=]+\$\w{1,25}\(\54\);\s*\54[\h=]+\53\(\54\);\s*\55\(\54\);\s*\?>(?<X1222650>)|\$\w{1,40}="[^"]+";\s*\$\w{1,40}='[^']+';\s*(?:\$\w{1,40}=(?:\$\w{1,40}\[\d+\]\.?)+;\s*){4,10}\s*\$\w{1,40}=\$\w{1,40}\(['"]{2},\$\w{1,40}\("[^"]+",\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)+;\s*\$\w{1,40}\(\$\w{1,40},\$\w{1,40}\(\$\w{1,40}\),\$\w{1,40}(?:,\d)?\);\s*(?:\?>|\Z)(?<X1041631>)|\$\w{1,40}=(visitor_country)\(\);\$\w{1,40}=\58[^@\?\}\{]{9,499}\$(\w{1,40})=(?:['"]https?://[^;]{1,199};(\$\w{1,40})=[^;]{1,999}\$pass(?:wo?r?d)?\b[^@]{1,499}\bmail\([^\)]+\60\b[^;]{1,99};\s*header\(['"]Location:\s*(?:https?://|\$\59)(?<X2161550>)|[^;]{1,999}\$pass(?:wo?r?d)?\b[^@]{1,499}\bmail\([^\)]+\$\59\b[^;]{1,99};\s*header\(['"]Location:\s*https?://(?<X2161540>))|\$\w{1,40}=\s*'';if\(!empty\(\$_COOKIE\)\){foreach.{100,1000}Cookie'\s*\)\s*!==\s*false\s*\)\s*header\(\$\w{1,40}\);\s*return\s*strlen\(\$\w{1,40}\);\s*\}\s*\?>\s*\Z(?<X1040700>)|\$\w{1,40}\h*=\h*['"](?:(?:localhost|127\.0\.0\.1)['"];[^!\{:]{1,99}(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];+\s*){1,4}(\$\w{1,40})\h*=\h*(mysqli_)connect\s*\([^\);\[]{0,99}\64\h*\);[^\?\-]{99,999}\s*\$\w{1,40}\h*=\h*\66query\h*\(\65,\$\w{1,40}\);[\s\}]+\66close\h*\(\h*\65\h*\);\s*\?>(?<X2142900>)|[^'"]{1,99}['"];[^\s/\*]{1,299};(?:/\*|#)[^\v]{9,499}\n\$\w{1,40}\h*=\h*['"][^'"]{1,99}['"];.{1,299}?['"]\h*\^\h*['"][^\t]{1999,3299}/\*[^\v]{9,299}:[^'"]{1,40}['"];\s*(?:\?>|\Z)(?<X1142750>)))
\A\s*<\?php\s*(?:\$\w{1,40}\h*=\h*(?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*require_once\h*\(\h*['"]geoplugin[^\?]{9,499}(?:\$\w{1,40}\h*\.?=[^;]{0,99}\$_POST\h*\[[^\]]+\][^;]{0,99};\s*){2}[^\?]{9,999}\bmail\h*\([^\)]+\)\h*;(?:\s*header\h*\(['"]Location:[^;\)]+\)\h*;)?(?:\s*(?:exit|die)\b[^;]{0,9};)?\s*\?>(?<X2157240>)|base64_decode\h*\(\h*['"]PD9waHAg[^'"]{1,999}['"]\h*\);\s*(\$\w{1,40})\h*=\h*@?fopen\h*\(\h*['"][^'"]+\.php['"][^;]{1,199};\s*(?:echo\s*)?fwrite\h*\(\h*\2\h*,[^;]{1,99};\s*fclose\h*\(\h*\2\h*\);\s*(?:\?>|\Z)(?<X1173132>)|getenv\(['"]REMOTE_ADDR['"]\);(?:\s*\$\w{1,40}\h*=\h*\$_POST\[[^\]]+\];){2}(?:\s*\$\w{1,40}\h*=\h*['"][^'"]{1,60}['"]\h*\.\h*\$\w{1,40}[^;]{0,40};){4}[^\|\?\(\[]{1,199}\|['"]\h*\.\h*\$\w{1,40};\s*@?mail\h*\([^\);]+\);\s*header\h*\(['"]Location:[^'"]+['"]\);(?<X2157750>))|\$\w{1,40}\s*=(?:(?:\s*'[^\n\v]{77}'\.\v{1,2}){3}(?<X2048363>)|\s*<<<EOT.{20000,60000}EOT;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST)\["\w{1,10}"\];\s*//[^\v]{0,199}\v\s*\$\w{1,40}\s*=\s*create_function\b(?<X2048572>)|\s*["']livingstonecole@aol\.com['"];\s*\$\w{1,40}\s*=\s*visitor_country\(\);\s*\$\w{1,40}\s*=\s*\$_POST\[(?<X2065520>)|\s*['"](?:[\w\-\.]{2,22}\.[a-z]{2,7}\s*,?\s*)+['"];\s*function\s*(\w{1,40})\s*\((\$\w{1,40})\)\s*\{[^\(\}\{]+return\s*\$\w\(\$\w\(\9\)\);\s*\}\s*eval\(\8\(['"][^'"]{999,9999}['"]\)+;(?:\s*\?>)?\s*\Z(?<X2125993>)|\s*['"][^'"]{1,100}['"]['"];\s*\$\w{1,40}\s*=\s*['"][^'"]{2000,4000}['"]\)\)['"];\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,100}['"];\s*(\$\w{1,40})\s*=\s*['"](.).{0,40}\13e\w?['"];\s*\11\s*\(\s*\12\s*,\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*,\s*['"][^'"]{0,40}['"]\);\s*(?:\Z|\?>)(?<X1042431>)|\s*['"][^;]{99,499}\bhttps?://[^/]{0,49}\bxlegion\.com/(?<X2155801>)|\s*['"]\s*find\s*/\s*-type\s*f\s*-name\s*['"]\*['"]\s*\|\sxargs\sgrep\s-rl\s['"]<head['"]['"]\s*;\s*\$\w{1,40}\s*=(?<X2051840>)|\s*['"]find\s[^;]{1,99}<head['"]{1,3};\s*\$\w{1,40}\s*=\s*['"]\s*<script\s[^>]{1,99}>\s*</script>\s*['"]\s*;\s*\$\w{1,40}\s*=\s*shell_exec\s*\((?<X2057901>)|\s*[^;]{0,20};\s*\$\w{1,40}\s*=\s*[^;]{20,80};\s*\$\w{1,40}\s*=\s*\w{1,40}\(\)\s*;\s*[^\?]{60000,}function\s*\w{1,40}\s*\(\s*\)\s*\{(?:\s*\$\w{1,40}\s*=['"][^'"]{20,80}['"]\s*;\s*){2}return\s*['"](?:\s*\{\s*\$\w{1,40}\s*\}\s*){2}['"]\s*;\s*\}\s*(?:\?>|\Z)(?<X1057540>)|\s*[^;]{1,40};\s*\$\w{1,40}\s*=\s*['"]?\$?_SERVER['"]?;[^\}]{1,200}\}\s*\}\s*(\$\w{1,40})\s*=\s*['"]curl_init['"]\s*;\s*[^\{]{99,999}if\s*\(\s*is_callable\(\19\)\s*\)(?<X2056313>)|\s*\$_SERVER\[[^>#<]{999,2999}\s*if\s*\(\s*strpos\s*\(\s*\$\w{1,40},\s*['"]google['"]\s*\)[^\}]{99,499}(\$\w{1,40})\s*=\s*(\w+)\(['"]http[^;]+;\s*echo\s*\21;\s*exit;\s*\}[^#]{999,2999}function\s+\22\([^\?]+return\s*@?file_get_contents\([^;]{1,99};[\s\}]+\?>(?<X1135681>)|\s*\d+;\s*(\$[li1o0]{1,15})\s*=\s*urldecode\(['"][^'"]{9,150}['"]\);\s*(\$\w{1,15})=(?:\24\{\d{1,2}\}\.){3}[^\(]{99,350}eval\(\25\(['"][^'"]{999,30000}['"]\)\);\s*(?:\Z|\?>)(?<X1128500>)|\s*\w{1,40};\s*[^:]{1,600}://[^/]{1,40}/[^`]{9000,15000}];for\((\$[O_0]{1,40})\s*=\s*0;\27<\$[O_0]{1,40};\$[O_0]{1,40}\+\+\)\{(\$[O_0]{1,40})\s*\.=\s*\$[O_0]{1,40}\[\$[O_0]{1,40}\[[^\]]{1,9}\]\(0,\$[O_0]{1,40}\)];}return\s*\28;}\s*(?:\?>|\Z)(?<X1057560>)|\s*array(?:\(['"\d\.,\s]{4999,19999}\);\s*\$\w{1,40}\s*=\s*file_get_contents\([^\!]+if\s*\(\s*!\$isbot\)\s*\{\s*\$\w{1,40}\s*=\s*\$_SERVER\[['"]HTTP_REFERER['"]\];\s*\$\w{1,40}\s*=\s*stristr\(\$\w{1,40},\s*['"](?:google|yahoo)['"]\);(?<X2124110>)|\s*\((?:(?:\s*['"][^'"]{24,96}['"]\s*,?){50,70}\s*\)\s*;.{0,284}eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*['"]['"]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;\s*\?>(?<X1041820>)|\s*['"]#google#i['"]\s*\)\s*;[^@]{99,999}if\s*\(\s*@?\$isbot\s*\)\s*\{[^\}]{9,999}(\$\w{1,40})\s*=\s*curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*curl_close\s*\(\s*\$\w{1,40}\)\s*;\s*echo\s*\(?\s*\32\s*\)?\s*;\s*\}\s*(?:\?>|\Z)(?<X1126300>))))|\$\w{1,9}\h*=\h*['"]base64_decode['"];[^\(]{0,49}(\$\w{1,9})\h*=\h*\$\w{1,9}\(\$\w{1,9}\(['"]https?:\s*//\w{1,9}\.trackstatisticsss\.com/\w{1,9}\.txt['"]\)\);\s*file_put_contents\(['"]([^'"]{1,15})['"],\h*['"]<\?php\s*['"]\h*\.\h*\34\)[^\?]{0,49}\bunlink\(['"]\35['"]\);\s*\?>(?<X1176740>)|\$\w{1,9}\s*=\s*(?:['"][^'"]{20,150}['"];\s*(\$\w{1,9})\s*=[^\.]{9,99}@?touch\(['"]\w{1,20}\.html?['"]\);[^\}]{99,300}\}\s*\}\s*@?system\(['"]kill[^\.]+\.\37\);[^%]{30000,}\}\s*sleep\(\d+\);\s*\}\s*@?system\(['"][^'"]{0,15}(\w{1,9}\.sh)['"]\);\s*@?unlink\(["']\38['"]\);\s*\?>(?<X1133150>)|\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]{9,99}/(bot\.txt)['"];(?:\s*(?:if|elseif)\(function_exists\(['"]((?:eval|system|assert|popen|exec|shell_exec|passthru))['"]\)\)\{\s*@?\41\(["'](?:wget|curl|lwp-download|lynx|fetch|GET)[^;]+\40;[^\}]+\}){2,9}\s*(?:\Z|\?>)(?<X1134920>)|__file__;\s*(\$\w{1,9})\s*=\s*['"][^'"]{500,2000}['"];\s*\43\s*=\s*base64_decode\s*\(\43\);\s*\43\s*=\s*strtr\s*\(\43[^;]{5,50};\s*(\$\w{1,9})\s*=\s*@?[ep]reg_replace\s*\(['"]__FILE__[^;]{5,50};\s*eval\s*\(\44\);(?<X2121061>)|array\(['"][^@]+@(?:[\w\-\.]+)\.(?:[a-z]{2,5})['"]\);\s*(?:\$\w{1,9}=['"][^']*['"];|\$\w{1,9}=array\([^\)]+\);){1,5}for\s*\((\$\w)=0;\46<\d;\46\+\+\)\s*\{\s*(\$\w{1,9})=\$\w{1,9}\[\46\]\s*;\s*(\$\w{1,9})\s*\.=\s*\$\w{1,9}\[\47\]\s*;\s*\}\s*\48\([^\)]{1,400}['"]\);\s*\?>\s*\Z(?<X2058450>))|\$\{['"](?:G|\\x47)(?:[^&]{999,6000}/\\x74(?:i|\\x69)(?:t|\\x74)(?:l|\\x6c)(?:e|\\x65)\\x3e[^`]+\)\);return\$\{\$\{['"](?:G|\\x47)[^'"]{9,18}['"]\}\[['"][^'"]+['"]\]\};\}echo\s*\(?\s*['"][^;]*['"]\s*\)?\s*;\s*(?:\?>|\Z)(?<X1058480>)|[^'"]{1,40}['"]\}[^:]{99,999}(?:h|\\x68)(?:t|\\x74){2}(?:p|\\x70)(?:s|\\x73)?://[^!]{99,600}if\s*\(\s*strcasecmp\s*\(\s*\$_SERVER[^?]{99,5000}curl_exec\s*\(\$\{\$\{['"](?:G|\\x47)[^'"]{1,40}['"]\}\[[^\]]{1,40}\]\}\);[^;]{0,99};?\}?exit\(\d*\);?\s*(?:\Z|\?>)(?<X1059281>))|\$\{['"][^%]{30000,50000},sprintf\(['"]%[^\^]+preg_match\(\s*['"].\^[^\$]{1,9}\$\{\$\{['"](?:\\(?:x47|107)|G)[^%]+['"]\s*;\s*\}\s*exit\s*;\s*(?:\?>|\Z)(?<X1057670>)|\$\{['"][^'"]{1,40}['"]\}\[["][^`]{40000,64000}\}=create_function\(['"]['"],@?gzuncompress\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\)\);\$\{\$\w{1,40}\}\(\);\s*\?>\Z(?<X1042400>)|\$\{['"][^\*]{99,999}@?preg_replace\s*\(\s*.?['"](.).{0,40}\54(?:e|\\(?:x65|101))\w?.?['"]\s*,[^\)]+\);\s*(?:\?>|\Z)(?<X1057680>)|\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=[^\.]{4000,9999}return\h*['"][^'"]{0,99}['"]\h*\.\h*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}[^/]{4000,9999}['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*\},['"]{2,}\),\$\{\$\w{1,40}\}\)\)\.['"]{2,}(?<X2138650>)|\$arrId\s*=\s*array\(['"]\d+\-\d+['"]\s*,(?<X2045555>)|\$auth_pass\h*=\h*['"]\w{32}['"];\s*(?://[^\$]{1,49}\s*)?(\$\w{1,40})\h*=\h*['"][^'"]{999,4999}['"];\s*@?(?:eval|assert)\h*\(\h*(?:(?:base64_decode|gz[id][ne]flate|str_rot13)\h*\(\h*){3,5}['"]?\58['"][\)\h]+;\s*(?:\?>|\Z)(?<X1147780>)|\$blocks\[['"](\w{1,49})\-\w[^\]]{0,99}\]\h*=\h*array\s*\(\s*['"](?:\60|\w+@)[^\n]{9,9999}\b(?:redito\.net|go\-links\.org)/\w{1,15}[^'"]{0,50}['"]\);\s*\?>(?<X1182696>)|\$GLOBALS\[[^\%]{60000,}%[^\?]{999,3000}\?\s*[^\&]{1000,1500}\.\./wp-config\.php(?<X2056980>)|\$pathToDor\h*=[^;]{1,99};[^\(]{1,199}\beval\h*\(\h*gz(?:uncompress|deflate)\h*\(\h*base64_decode\h*\(\h*['"][^\)'"]{999,}['"]\s*(?:\)\s*){3};\s*(?:\?>|\Z)(?<X1173080>)|\$s{1,9}ecret\h*=\h*['"]\w{1,199}['"];[^\}@]{1,199}\bif\h*\(\h*(?:\(\h*strpos\h*\(\h*\$_SERVER\[['"]HTTP_REFERER['"]\]\h*,\h*['"](?:google|yahoo|bing)['"]\h*\)\h*\)\h*\D{2,3}\h*){3,5}\{[^\}]{99,199}\bheader\(['"]Location:\h+https?://(?<X2151530>)|\$s{3,9}ecret=['"]\w{99,199}['"];[^@\{\?]{1,499}\bif\(+strpos\(\$_SERVER\[['"]HTTP_REFERER['"]\],["'][gby](?:oogle|ing|ahoo!?|andex)['"]\)+[^;\{]{1,99}\{[^\}]{9,999}\bheader\(['"]location:\s*https?://(?<X2159540>)|\@?set_time_limit[^\{]{9,99}if\((md5)\(\66\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\D{2,3}['"]\w{32}['"]\h*\D{2,3}\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\}]{9,199}eval\(\67\);\s*(?:die|exit)\(\)[^\{]{9,99}\{\s*echo\h*['"][^\}]{9,299}404\h*not\s*found[^\}]{9,199}\}\s*(?:\Z|\?>)(?<X1146860>))
\A\s*<\?php\s*(?:\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(((?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev))\(file_get_contents\(\1\(['"]aHR0cHM6Ly9zZW9oYWNrLm5ldC9[^\?]{1,99}\?>(?<X1188790>)|class\h*(?:(\w{1,15})\h*\{\s*function[^\?]{1,1999}\b(?:var\h*\$\w{1,9}\h*=\h*array\(['",gzinflatecruobs64_dp\h]+\);\s*){3}(var)\h*\$\w{1,15}\h*=\h*['"][^'"]{999,}['"];\s*\4\h*\$\w{1,15}\h*=\h*['"][^'"]{99,}['"];\s*\}\s*new\h*\3\(\);\s*\?>(?<X1186693>)|_[^\{]{5,45}\{private[^\n]{9,299}/\*Bloodninja\b(?<X2146902>))|class(?:\s*(\w{1,40})\{[^\{\(]{1,499}\b(function)\s*getPlatform\(\)\{[^@%&\|/\*]{499,1999}\b\8\s*(\w{1,40}\(\))\{[^@%\*]{999,1999}\$(content)Type=['"]application/msword['"];[^@]{1,499}\$(\10data)=['"][^'"]{49999,}['"];return\b[^;]{1,99}\$\11\)+;\}+echo\(new\s*\7\)\->\9;\s*(?:\?>)?\Z(?<X2162241>)|\s+(authkey)\s*\{\s*var\s*\$hsstr;\s*function\s+__construct\h*\(\h*\)\s*\{\s*\$this\h*\->\h*setister\h*\(\h*\d+\h*\);\s*\}[^\?]{999,9999}\$(\w{1,40})\h*=\h*new\s+\13\h*\(\h*\d+\h*\);\s*(\$\w{1,40})\h*=\h*\$\14\h*\->\h*uncode\h*\([^\)]+\);\s*@?eval\h*\(\h*\15\h*\);\s*(?:\?>|\Z)(?<X1165940>))|echo(?:[^;]{1,199};\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^\{]{0,199}\{\s*(\$\w{1,15})\h*=\h*\$\w{1,15};\s*@?(?:copy|move_uploaded_file)\([^\)]+\17\h*\)\h*;[^\}]{1,199}\}\s*\};?\s*echo[^;]{4,199}['"]\h*;\s*\?>(?<X1172541>)|\b[^;]{1,99};\s*if\h*\(\h*file_exists\h*\(\h*['"]([^'"]{1,199}\.php)['"]\h*\)\h*\)\h*\{\h*@?touch\h*\(\h*['"]\19['"]\h*,[^;]{2,99};\h*\}\h*unlink\h*\(\h*__FILE__\h*\);\s*(?:/\*\s*\w{1,40}\s*\*/\s*)?(?:\?>|\Z)(?<X1169340>)|\h*['"]<form[^\{]{9,99}\bif\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\{[^\?]{99,600}\becho\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*echo\h*['"][^;]{1,40};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1160270>)|\s*(?:base64_decode\()?["'][^;/]{1,99}['"][\)]?;\s*(?:@?include\(['"][^'"]{9,99}['"]\);\s*)?(?:@?(?:system|exec|passthru|shell_exec|popen|proc_open)\(['"][^@\?]{9,150}['"]\);=?\s*){3}[^\?]{9,9999}\?>(?<X1121834>)|\s*['"]<form\s*action[^;]{1,99};\s*if\s*\(isset\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{1,150}\$\w{1,9}\s*=\s*fopen\s*\(['"]([^'"]{1,15}php)['"][^=]{1,99}(\$\w{1,9})\s*=[^#]{1,599};\s*file_put_contents\s*\(['"]\23['"],\s*\24\);\s*\}\s*\}\s*(?:\Z|\?>)(?<X2125004>)|\s*['"][^/;@#&\*=\$!%\|:\{\[\(]{1,99}<(title)\b[^>]{0,99}>\s*404\s*Not\s*Found\s*</\26>[^\?\}@#&\*:%\|\+]{1,499}\b[mc]o(?:py|ve_uploaded_file)\h*\((?<X2170660>)|\s*['"][^\{\(=]{1,199}\b(?:echo\s*['"][^;]{1,99}\.\h*(\w{1,40})\h*\(\h*['"]https?://[^;]{1,199};\s*){1,9}function\s+\28\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\29\h*\);[^\?]{1,199}\breturn\h+\30;\s*\}\s*(?:exit|die)[^;]{0,19};\s*(?:\?>|\Z)(?<X1172790>)|\s*['"]Privet\s+bot\s+by\b(?<X2162800>)|\s*eval\(base64_decode\((?:str_replace\(\s*'.'\s*,\s*'.'\s*,\s*){3}(?<X2049671>)|\s+base64_decode\s*\(['"]PGh0bWw\+PGJvZHk[^'"]{9,999}(?:L3dwLWNvbnRlbnQvcGx1Z2lucy9jb250YWN0LWZvcm0tNy|d3AtY29udGVudC9wbHVnaW5zL2NvbnRhY3QtZm9ybS03|cC1jb250ZW50L3BsdWdpbnMvY29udGFjdC1mb3JtLTcv)[^'"]{1,999}['"]\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1124490>)))
\A\s*<\?php\s*(?:error_reporting(?:[\h\(]+(?:0|NULL)[\h\)]+;[^#]{99,2500}\b(echo)\h*['"]\h*window\.location\.href[\h=]+['"]https?://[^/]+\bsaleforyou\.org/[^;]+;\s*\1\h*['"]</script>['"][^#]{9,399}(\$\w{1,15})[\h=]+str_replace[\h\(]+['"]\.html['"],\h*['"]{2},\h*\2[^\?]{0,150}\?>(?<X1198200>)|\((?:0|NULL)\);(?:\h*(?:\$[0O]+[\h=]+\d+;\h*)?(\$[0O]+)[\h=]+['"][A-z0-9\+]{99,200}['"];\h*\4[\h=]+str_replace\([^\)]+\);\h*\$[o]+[\h=]+base64_decode\(\4\);[^\n]{999,12000}\b(?:exit|die)[^;]{0,9};\h*fwrite\(\$[0O]+,\h*\$[0O]+\);\h*fclose\(\$[0O]+\);\}\s*\?>(?<X1199091>)|\s*echo[^;]{1,40};\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\?]{9,70}\belse\s*\{\s*(\$\w{1,9})\h*=\h*file_get_contents\(\6\);[^#]{9,200}\beval\(\7\);\s*\}\s*function\h*\w{1,9}\(\$\w{1,9}\)\s*\{\s*(\$\w{1,9})\h*=\h*curl_init[^\?]{9,499}\8\);\s*\}\s*\?>(?<X1154271>)|\s*function\h*(\w{1,40})\([^\)]+\)\s*\{\s*http_response_code\([^\}]{0,99}\}\s*if\h*\(is_null\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{0,250}\bif\h*\(\h*@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{0,99}\b\10\(\);\s*(?:\?>|\Z)(?<X1186980>))|\((?:(?:0|NULL)\)[^\?]{1,99}IndoXploit(?<X2125020>)|(?:0|NULL|FALSE)\);[^\?\{]{1,99}\$\w{1,40}\h*=\h*['"][^'"]{1,2999}[ja](?:G5hbWU9Im1vYmFuIj|kbmFtZT0ibW9iYW4iO)[^@]{999,9999}\bunlink\h*\(\h*['"]\./[^'"]{1,40}\.php['"]\h*\);\s*(?:\?>|\Z)(?<X1149900>)|(?:0|NULL|False)\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^'"]{0,49}['"](?:\h*\)){3};\s*(?:\?>|\Z)(?<X1155920>)|(?:0|NULL|FALSE)\)[^,]{9,150}if\s*\(@?move_uploaded_file\s*\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^/]{99,300}(\$\w{1,20})\s*=\s*fopen\([^\)]+,['"]w\+['"]\);\s*fwrite\(\15,[^\)]+\);\s*fclose\(\15\);\s*(?:\}\s*)+(?:\?>|\Z)(?<X1135240>)|(?:NULL|0)\);(\s*\$GLOBALS\[['"])pass['"]\]=['"]\w{36,40}['"];\s*\17[^\)]{9,50}\beval['"]\);\s*\17ver[^;]{5,20};\s*\17title['"]\]=['"]\w{1,15}['"];\s*@?ob_start\b(?<X2131622>)|0\);[^\?]{99,450}eval\(base64_decode\(['"]JGNvbj1bIkEi[^'"]{99,1450}['"]\)\);\s*(\$\w{1,2})=str_split\(["][^"]{999,30000}["]\);\s*(\$\w{1,9})=['"]{2};\s*foreach\(\19[^\}]{9,200}\}\s*\}\s*\}\s*eval\(['"]\?>['"]\.gzinflate\(base64_decode\(\20\)+;\s*(?:\Z|\?>)(?<X2128433>)|0\);\s*if\s*\(\s*!\s*defined\s*\(\s*['"]WP_OPTION_KEY['"]\s*\)\s*\)\s*\{\s*function\s*\w{1,40}[^`]{29000,33000}\$this-\s*>\s*\w{1,40}\s*=\s*(\$\w{1,40})\s*;\s*\22\s*%\s*=\s*\$\w{1,40}\s*;\s*return\s*\22\s*;\s*\}\s*\}\s*(?:\?>|\Z)(?<X1057801>)|0\);\s*ini_set\(['"]display_errors\b[^\{]{9,250}(\$\w{1,15})\h*=\h*['"]https?://aztemplates\.com[^\{]{9,150}\{(\$\w{1,15})\h*=\h*(file_)(get)(_contents)\(\24\);\s*\$\w{1,15}\h*=\h*\26put\28\((\$\w{1,15}),\h*\25\);\s*\}\s*echo\h*\26\27\28\(\29\);\s*\?>(?<X1149040>)|0\);\s*session_start\(\);\s*\$myHost\s*=\s*['"]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}['"];\s*\$pathOnMyHost\s*=\s*['"]{2};\s*\$pathToDor\s*=\s*['"][^'"]{1,99}['"];\s*\$template\s*=\s*["'][^'"]{1,99}['"][^\}]{1,500}header\(['"][^'"]{1,20}404\s*Not\s*Found['"]\)(?<X2129270>)|[^\)]+\);define\([^\)]+\);(\$GLOBALS)\[(\w{1,9})\]\h*=\h*explode\([^#]{999,4600}(function)\h*tcget\(\$[0o]+[^#]{999,1500}\34\h*rdFile\([^\{]{5,15}\{(\$[0o]+)=&\32\{\32\{\33\}\{[^#]{9,199}(\$[0o]+)\h*=\h*\35\{[^#]{9,99}return\h*\36;\s*\}\s*\}\s*(?:\Z|\?>)(?<X1144360>)|\d\);[^\?]{300,600}</form>['"];\s*if\(\$_POST\[['"]?[^'"]{1,40}['"]?]\s*[^\w]{1,2}=\s*"home"\s*\)\s*\{\s*if\s*\(\s*@?copy\(\$_FILES\[['"]?[^'"]{1,40}['"]?\][^\?]{40,200}\s*else\s*\{\s*[^\}]{1,40}\s*\}\s*\}\s*exit;\s*\}\s*\?>\s*\Z(?<X2053722>))|\h*\((?:0|null|false)\);(?:[^/'"\?]{0,99}\$\w{1,9}[\h=]+['"]http://[^/'";]{1,49}\.xyz/[^'"\?;]{1,49}\.(?:txt|html|php|pl)['"];[^\?]{9,999}\$\w{1,9}[\h=]+['"]\w{1,9}:['"]\.strtolower\(\$_SERVER\[['"](?:HTTP_USER_AGENT|HTTP_REFERER)['"]\]\);[^\?]{99,1999}return\h*\$\w{1,40}[;\}\s]+\?>(?<X1189641>)|[^\$]{0,20}(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\];\s*(\$\w{1,20})\h*=\h*\41\[[^\(\)]{9,250}</form>['"];\s*(\$\w{1,20})\h*=\h*move_uploaded_file\h*\(\40,\42\);\s*if\h*\(\43\)\s*\{[^\?]{1,99}\}\s*(?:\?>\s*)?\Z(?<X2184503>)|[^\(\?]{1,75}\$\w{1,9}\h*=\h*curl_init\h*\(\);[^#]{9,499}\bfunction\h*(\w{1,15})\h*\((\$\w{1,15})\)\s*\{\s*\$\w{1,15}\h*=\h*file_get_contents\h*\(\46\);[^#]{99,799}\$\w{1,9}\h*=\h*\45\h*\(['"]https?://\w{1,5}\.topsale4you\.rocks/[^\}]{9,350}\}\s*\?>(?<X1183130>))|\h*\(\h*(?:0|NULL|False)\h*\);(?:[^\?=\$]{1,199}\$\w{1,40}\h*=\h*['"]DragonE?Xploit(?:er)?['"];(?<X2170420>)|[^\?@#!%&\*]{0,199}\$(\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\];\s*[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\$\49\h*\);[^\?@#!%&\*,\|\\\+]{0,499}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\?@#!%&\*\|\\\+]{1,199}(?:\?>|\Z)(?<X1170310>)|\s*if\h*\([^\}\?]{1,299}\bfunction\s+(getHtml)\h*\([^\?]{99,}\$(\w{1,40})\h*=\h*\51\h*\(\h*['"]https?://[^;]{1,99};\s*(?:\$\52\h*=\h*str_i?replace\h*\([^;]{1,99};\s*){0,3}echo\s*\$\52;\s*(?:exit|die)[^;]{0,19};\s*(?:\}\s*){0,4}(?:\?>|\Z)(?<X1170300>)))|eval\s*\(\s*base64_decode\s*\(\s*(?:"aWYoaXNzZXQoJF9SRVFVRVNUWy[^"]{400,1000}"\s*\)\s*\)\s*;\s*\?>(?<X1041250>)|['"](?:ZXJyb3JfcmVwb3J0aW5nKDAp|cnJvcl9yZXBvcnRpbmcoMCk|cm9yX3JlcG9ydGluZygwKQ)[^'"]{50,1000}(?:X2V4aXN0cygnc2hlbGxfZXhlYw|ZXhpc3RzKCdzaGVsbF9leGVj|eGlzdHMoJ3NoZWxsX2V4ZWM)[^'"]{400,1500}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058960>)|['"][^;]{1,15}(?:Z290bw|b3Rv|IGdvdG8)[^;]{9999,24000}(?:ZXZhbA|dmFs|IGV2YWw)[^;]{9,99}(?:aHRtbHNwZWNpYWxjaGFyc19kZWNvZGUodXJsZGVjb2RlKGJhc2U2NF9|dG1sc3BlY2lhbGNoYXJzX2RlY29kZSh1cmxkZWNvZGUoYmFzZTY0Xw|bWxzcGVjaWFsY2hhcnNfZGVjb2RlKHVybGRlY29kZShiYXNlNjRf)[^;]{9,600}['"]\)\s*\);\s*(?:\?>|\Z)(?<X1059400>))|file_pu(?:(t_contents\()['"][^'"\),]+\.php['"],file_ge\57['"]https?://[\d\.]+/[^'"\);\.]+\.txt['"]\)\);\s*(?:\?>)?\Z(?<X2171860>)|t_contents\s*\(\s*['"]\w+\.php['"]\s*,\s*base64_decode\s*\(\s*['"][^\;]{1,200}['"]\s*\)\s*\)\s*;\s*\?>\s*\Z(?<X2054360>))|for\s*\((\$\w{1,40})=\d+;[^\)]+\)\s*\{[^\$]{0,40}(\$\w{1,40})\s*=\s*(?:posix_get(?:pw|e)?[gu]id|getmy[gu]id|get_current_user)\s*\(\60\);\s*if\s*\(!empty\s*\(\61[\)\s]+\{\s*while\s*\(list\s*\(\$\w{1,40},(\$\w{1,40})\)\s*=\s*each\s*\(\61[\)\s]+\{\s*(?:echo|print)[^;]+\62\b[^;]+;\s*\}[^\?]{1,19}(?:\?>)?\Z(?<X2137122>)|foreach(?:\h*\(\h*\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,15}\h*=>\h*(\$\w{1,15})\h*\)[^\?]{99,1500}\}\s*(\$\w{1,15})\h*=\h*\$_SERVER\[[^\[\?\}]{1,199}(\$\w{1,15})\h*=\h*\$[^\;]{1,99}\.php['"];\s*@?file_put_contents\(\66,\h*\64\);\s*echo\h*['"]http://[^;]{1,99}\65[\)\h]+;\s*exit\(\);[\s\}]+(?:\?>|\Z)(?<X1192320>)|\s*\(\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,9}\D{2,4}(\$\w{1,9})\)\{\s*\$\w{1,9}\s*=\s*(base64_decode\()\68\);\s*\}\s*(\$\w{1,9})\s*=\s*explode[^\{]{1,50}(\$\w{1,9})\s*=\s*mail\((?:\69\70\[\d+\]\),){2,3}[^\{]{0,99}if\(\71\)\{\s*echo[^\}]{0,99}\}\s*else\s*\{echo[^\}]{0,99}\71;\}\s*(?:\Z|\?>)(?<X1133791>)))
\A\s*<\?php\s*(?:function(?:[^\{]{9,70}\{\s*global\s*(\$modx)[^\?]{99,3200}if\s*\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]\)\s*\{[^\}]{9,250}case\s*['"]\w{1,5}['"]:\s*wp_content_show\(\1\)[^\}]{9,100}@?wp_functions_content\(\1\)(?<X2128840>)|[^`]{999,1500}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\3e\w?.?['"]\s*,\s*['"](?:\\x\w{2}){40,78}['"]\s*,\s*['"]\.['"]\s*\);\s*(?:\?>|\Z)(?<X1042312>)|\h*(\w{1,15}\(\))\{\s*\$\w{1,9}\h*=\h*curl_init\(\);[^\}]{0,150}\bindoxploit\-coders/[^'"]{0,49}\.php['"]\);[^\?]{0,300}\bfwrite\(\$\w{1,15},\h*\5\);[^\?]{0,99}\binclude\(['"][^'"]{1,25}\.php[""]\);\s*\?>(?<X1172980>)|\h*wpb_admin_account\h*\(\h*\)\s*\{\s*(\$user)\h*=\h*['"][^'"]+['"];\s*\$pass\h*=[^\}]{1,250}\7\h*=\h*new\h*WP_User[^#]{99,999}\btranslate_user_role\h*\(['"]Administrator['"]\)[^\?]{1,250}\breturn\h*\$\w{1,15};\s*\}\s*\?>(?<X1173502>)|\h+(\w{1,40})\h*\([^\{]{1,99}\{\s*\$\w+\h*=\h*explode\h*\(\h*['"]([^'"]{1,40})['"][^\}]{1,499}\}\s*(\$\w+)\h*=\h*\$_[GPSRC]\w{2,6}\[[^;]{1,99};\s*\$\w+\h*=\h*\9\h*\(\h*['"](?:[asertvl]|\10){4,49}['"]\h*,\h*\11\h*\);[^\}\(\{\?]{1,99}\barray_map\h*\([^;]{1,99};\s*(?:\?>|\Z)(?<X1173790>)|\h+ob_gzhandlers3\((\$\w{1,40})\)\s*\{\s*@error_reporting\(0\);\s*(preg_)match\(['"](/\\<ul\.\*\?\\>/i)['"], \13,\h*(\$\w{1,40})\h*\);\s*return\h+\14replace\h*\(['"]\15['"],\s*\16\[\d+\]\.['"]\s*<li>\h*<a\h+href\h*=\h*['"][^'"]{1,99}(?:viagra|online|casino|pharma|cheap|sale)(?<X2140961>)|\s*(?:Ex)?tor\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*['"][^'"]*['"];\s*if\s*\(\s*function_exists\s*\(\s*['"]exec['"]\s*\)\s*\)\s*\{\s*@exec\s*\(\s*\$\w{1,40},\$\w{1,40}\s*\);(?<X2126320>)|\s*(\w{1,9})\((\$\w{1,9})[^\}]{9,150}return\s*\20;\}\s*function\s*(\w{1,9})[^\?]{99,500}isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^<]{9,99}fwrite\((\$\w{1,9})[^\.]{9,99}\.str_replace\([^\(]{9,40}\19\(\21\(['"]\w+['"]\),\22\)+;\s*fclose\(\23\);\s*include\s*(\$\w{1,9});\s*unlink\(\24\);\s*\}(?<X2125881>)|\s*(\w{1,9})\([^\}]{9,250}return\s*curl_exec[^\}]{1,50}\}\s*(\$\w{1,9})\s*=\s*\$_[PGSCR]\w{2,6}[^;]{9,99}\.php['"]\s*;\s*(\$\w{1,9})\s*=\s*\26\(['"]https?[^'"]{9,99}\.txt['"]\);\s*(\$\w{1,9})\s*=\s*fopen\(\27[^;]{1,20};\s*fwrite\(\29,\s*\28\);\s*fclose\(\29\)(?<X2280140>)|\s+(\w{1,40})\b[^\?]{99,499}\bfile_put_contents\([^;]{1,49};\s*\}\s*(\$\w{1,40})\h*=[^;]{1,99};\s*if\h*\(\h*\32\b[^\{]{1,49}\{\s*(\31\(['"]https?://[\d\.]{7,15}/)[^\?]{99,499}\}\s*else\s*\{\s*\33[^\}]{9,199}\}\s*(?:@?unlink\h*\([^;]{1,99};\s*){2,3}(?:\?>|\Z)(?<X1155960>)|\s+(CoreLibrariesHandler)\(\)\s*\{\s*(\$\w{1,20})=['"]\s*['"];\s*foreach\((str_)split\(\36,\d+\)[^\{]{1,20}\{\s*\$\w{1,20}\s*=\s*\37replace\(['"]\s*['"],[^,]+,\37replace\([^\?]{9,150}\}\s*register_shutdown_function\(['"]\35['"]\);\s*\?>(?<X1138671>)|\s+pre_term_name\h*\([^\}<\?>]{1,499}\breturn\s*@?\$\w{1,19}\h*\(\h*\$\w{1,19}\h*\);\s*\}\s*\$\w{1,19}\h*=\h*['"]<img\s*src=['"]data:(?<X2171120>))|GIF8(?:7|9)?\w?[^\s]{0,2}\s*[^\;]{0,80};(?<X2055424>)|global(?:\h*\$(\w{1,15});\$\41\[[^\]]+\][\h=]+(base64_decode\()[^\n]{999,2000}=\42[^\)]+\);\s*\?>\s*<\?php\s*(\$GLOBALS)\[['"]\41['"]\][^\n]{999,5000}\43\[['"]\41['"]\]\[[^\]]+\]\(\$httpAcceptLanguage[^\?]{1,99}\?>(?<X1198550>)|\s*(\$\w{1,10});\s*if\(\!\45\)\s*\{[^;]{5,15};\s*(\$\w{1,10})\s*=\s*['"][^'"]{1,99}['"];\s*if\(\!@?\$_(?:P|G|S|C|R)\w{2,6}\[\46[^\?]{9,250}@?setcookie\(\46[^y]{50,500}foreach\(array\((?:\d{1,3},){20}[^\{]{9,1500}\{(\$\w{1,10})[^\}]{9,99}\}\s*eval\(\47\);\s*exit;\s*\}\s*(?:\Z|\?>)(?<X1121800>)|\s*(\$\w{1,20});\s*if\s*\(!?\49\)\s*\{\s*\49\s*=\s*['"][^'"]+['"];\s*(\$\w{1,20})\s*=\s*(?:(?:base64_encode|str(?:rev|_replace))\s*\(){4}[^:]{99,200}(\$\w{1,20})\s*=\s*['"]https?://[^;]+;\s*\50\s*=\s*@?file_get_contents\s*\(['"]\51\?[^\?]{99,1500}(?:exit|die)[^;]{0,9};\s*(?:\}\s*){3}\?>(?<X1127173>))|goto(?:\s*\w+;\s*\w+:\s*header[^#]{99,1499}(?:goto\s+|\w{1,6}:\s+)\s*[^;]{1,199};[^\n]{999,20000}\bpreg_match\([^,]+,\h*\$_SERVER\[[^\?]{9,199}\bgoto\s*\w+;\s*\}\s*goto\s*\w+;\s*\w+:\s*echo[^;]{1,499};\s*goto\s*\w+;\s*\w+:\s*\w+:\s*\?>(?<X1307221>)|\s+\w{1,9};\s\w{1,9}:\s*fclose\([^\n]{99,300}fopen\([^\n\(]{99,200}\$\w{1,20}\s*=\s*(getcwd\(\))\s*\.\s*DIRECTORY_SEPARATOR;[^@\n]{300,999}@ini_set\([^\)]+,\s*(?:0|NULL)\);[^\n]{999,5000}['"](?:\\x?\w{1,3})+['"]\s*\.\s*php_uname\(\)\s*\.[^;]{30,150}\(\$\w{1,20}\s*=\s*\54\);(?<X1130280>))|header(?:\(['"]Location:\s*\w{1,19}\.php['"]\);(?:\$(u(?:ser)?(?:name)?|pass(?:wo?r?d)?)=\$_POST\[[^;]{1,99};){2}[^@]{99,199}\$(\w{1,40})=[^;]{0,49}\$\56\b[^@]{1,199}\bmail\([^\)]+\57\b[^\?\{\}!&]{1,299}\bfwrite\([^\);]+\$\56\b(?<X2163000>)|\h*\(['"]Location:[^;]+;\s*\$\w{1,20}\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;[^@]{9,99}(?:\$\w{1,40}\s*\.?=\.?[^\$]{1,40}\$_POST\[[^\]]+\][^;]{1,80}\s*;\s*){2,}[^/]{99,299}@\bmail\([^;]{9,99}\);\s*(?:exit|die)\b[^;]{0,9};\s*\?>(?<X1144331>)|\s*\(['"]Location:\s*http://[^'"]{0,40}(?:med|pharm|cialis|viagra|canadian)[^'"]{0,40}\.\w{2,9}/?['"]\);\Z(?<X2125571>))|if[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}[^>]{1,299}(\$\w{1,9})\h*=\h*(file)_get_contents\(\$\w{1,9}\);\s*eval\([^\.]{1,49}\.\h*\61\);[^\?]{1,49}\bif[\h\(]+@(?:copy|move_uploaded_\62)[\h\(]+(\$_\62s\[['"]\w{1,9}['"]\])\[[^\]]+\][\h,]+\63[^\?]{1,99}\becho\b[^\.]{1,99}\.\h*php_uname\h*\(\)\h*\.(?<X2181321>)|if[\h\(]+isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+(\$\w{1,15})\h*=\h*(curl_)init[\h\(]+base64_decode[\h\(]+\65[\h\)]+;\s*[^\}]{1,99}(\$\w{1,15})\h*=\h*\67exec[\h\(]+\66[\h\)]+;\s*eval[\h\(]+['"]\?>['"]\h*\.\h*\68[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1193380>)|if\(!(?:@?(\$\w{1,15})\)\{if\(preg_match\([^\)]+\)\)\{echo\s*["']<a\s*href=['"][^'"]+\.php['"][^\}]+\}@?\70=true;\}\?>(?<X1132681>)|\s*(class)_exists\(['"](WPPlugingsOptions)['"]\)\)\{\72\s*\73\{[^\}]{9,999}\bfunction\s*__construct\([^\)]+\)\{\s*\$this\->baseUrl=hex2bin\([^@]{9999,29999}\b(?:\73::\w{1,40}\(\);){3}\}+catch\(Exception\s*\$\w{1,40}\)\{\}\s*\Z(?<X2160022>)|isset\((?:(\$\w{1,15})\)\)\{\$\w{1,15}[^\n]{99,2800}\bif\((\$[0o]{4,9})\D{2,3}['"]have(?:door|donor)[^\n]{99,2500}\bif\(stristr\(\76,['"]nodonor['"]\)\)\{\}\}\75=\d{1,3};\}\?>(?<X1155880>)|\$_[GPRSC]\w{2,6}\[([^\]\$\)\.]+)\]\)\)\s*\{\s*setcookie\(\78[^;]{9,50}\);\s*header\(['"]Location:\s*https?://[^\)]{9,50}\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:\Z|\?>)(?<X1130321>)))|if\(\$_[GPRSCF]\w{2,6}\[[^\]]+\][^\{]{1,20}\{if\((\$_[GPRSCF]\w{2,6}\[[^\]]+\])==['"]['"]\)\s*\{\s*echo[^;]{1,40};(?:exit|die)[^;]{0,9};\}\s*eval\(\80\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:\Z|\?>)(?<X1128451>)|if\(\h*isset\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*if\(\h*function_exists\(\h*['"](unlink)['"][\)\s]+\{\s*(?:@?\83\(\82\);\s*){1,9}\}\s*(\$\w{1,40})\h*=\h*@?fopen\(\h*\82,[^\);]+\);\s*@?fwrite\(\h*\84,[^;]{1,99};\s*@?fclose\(\h*\84\h*\);\s*\}\s*(?:\?>|\Z)(?<X1163900>)|if\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{\s*error_reporting\(0\);\s*unlink\(['"][\./]{0,20}cpanel/contactinfo['"]\);\s*unlink\((['"][\./]{0,20}contactemail['"])\);\s*(\$\w{1,9})\s*=\s*fopen\(\87[^;]{1,9};\s*fwrite\(\88,\86\)[^\}]{9,199}fclose\(\88[^\?]{5,25}(?:\Z|\?>)(?<X2132190>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\)\)\{\$\w{1,40}=strrev\([^\}\s]{1,150}\}\s*\?>(?<X1121030>)|\$_REQUEST\[['"](\w{1,40})['"]\]\)\)\{\s*echo\s*['"][^"]{1,40}['"];\s*\$\91\s*=\s*\(?\$_REQUEST\[['"]\91['"]\]\s*\)\s*;\s*(?:system|shell_exec|passthru|exec|popen)\(\$\91\);\s*echo\s*['"][^"]{1,40}['"];\s*die;\s*\}\s*\?>(?<X1042191>)))
\A\s*<\?php\s+(?:(goto)\s+(\w{1,20});[^//]{1,900}\2:\s*error_reporting\((?:0|NULL)\);\s*\1\s+\w{1,20};[^\('"\$]{9,99}\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\((?<X2121133>)|(goto)\s+(\w{2,20});[^/]{1,1999}\5:\s*\$GLOBALS\[[^\]]+\][^\)]{1,399}\);[^\?]{1,999}\4\s+\w{2,20};\s*\w{2,20}:[^;]{0,99};?(?:\s*\?>)?\s*\Z(?<X2120683>)|(goto)\s+\w+;\s*\w+:[^=]{99,199}\$\w+\s*=\s*create_function\s*\([^;]+;\s*\7\s+\w+;[^=]{49,99}\$\w+\s*=\s*str_rot13\s*\(\s*@?pack\s*\([^,]+,\s*strrev\s*\([^;]+;\s*goto\s+\w+;\s*\w+:[^\n]{499,999}goto\s+\w+;\s*\w+:\s*echo\s*[^;]{1,99};\s*(?:\Z|\?>)(?<X1132241>)|(gzinflate)=['"]\9['"];\s*(base64_decode)=['"]\10['"];\s*eval\(\9\(\10\(['"][^'"]{99,400}['"]\)\)\);\s*(?:\?>|\Z)(?<X1174950>)|(header)\s*\(['"]HTTP/1\.1\s+302\s+Found['"]\);\s*\12\s*\(['"]Location:\s*https?://[^\?]{9,20}/\?\w=1nxr&[^'"]{1,15}['"]\);\s*\?>(?<X1130831>)|//\h+\w{2,20}[^\.]{0,20}\bCracker[^@]{0,9}\bcode\-security\.com\b(?<X2163281>)|/[/\*]\s*(?:<!--\s*)?SCAM\s+PAGE\s+(?:PPL|PayPal)\b(?<X2134730>)|/[\*\s]+\h*Plugin\h*name:\h*(\w{1,20})\s*\*/\s*(function)\h+(\w{1,20})\(\)[\s\{]+if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[["']\16['"]\]\)\)[\{\s]+[^,]{9,99}\b(add_action)\([^\)]+['"]\18['"]\);\s*\17\h+\w{1,20}\([^:@&]{99,600}\}\s*\17\h+(\w{1,20})\(\)[\{\s]+[^<\?]{700,2000}\bexit\(\);[\}\s]+\19\([^\)]+['"]\20['"]\);\s*(?:\Z|\?>)?\Z(?<X1209720>)|/\*[\*\s]+Scam(?:page)?\h+by\h+\S{3,40}\s(?<X2151651>)|/\*[\*]*\*/\s*@?eval\(base64_decode\(['"][^'"]{1,9}ZnVuY3Rpb25fZXhpc3Rz[^'"]{1,500}KCRHTE9CQUxTWy[^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058730>)|/\*[^/]{1,20}404\s+error\s+Web\s+Shell\s+(?:Recoded\s+)?by\s+XG[3e]n[o0][5s][^/]{1,4}\*/\s+\$auth_pass\b(?<X2124790>)|/\*[^\(\$;\{]{2,}\b(?:Facebook:\h*facebook\.com/(Ex\.Robotos)\s*|ICQ:\h*@\25)(?<X2165650>)|/\*[^\(]{9,99}\(\s*ORVX\h+Shell\b[^\(]{99,200}\beval\(base64_decode\((?<X2153600>)|/\*[^\*]{1,99}\*/\s+\?>\s*<\?php\s*\$\w{1,40}\s*=[^\?]{1,99}function\s+(\w{1,40})\s*\([^\?]{200,999}(\$\w{1,40})\s*=\s*\28\(\s*['"]\s*['"][\.\,][^\?]{21000,26000},\29\)[^\)]{0,9}\)\s*;\s*(?:\?>|\Z)(?<X1056801>)|/\*[^\*]{1,99}\bMr\s*Trovaz\b[^\?]{1,499}\?id=100010413816341\b(?<X1132830>)|/\*[^a-z0-9\$\*@]{99,500}(?:\\\h*)+By\h*Xbalti\h*/[^a-z0-9\$]{99,300}\bsession_start\(\);(?<X2138951>)|/\*\*?\s*(?:0|zero)\h*b\h*y\h*[t7]\h*[3e]\h*(?:m\h*[i1]\h*n\h*[i1]|s\h*h\h*[3e]\h*l)\b(?<X2155930>)|/\*\*[^<@/]{9,99}@author\h+(shutdown57)\h*<\h*indonesianpeople\.\34@\w{1,20}\.com\b(?<X2162410>)|/\*\*[^\$_\[]{2,40}@\h+author\h*:\h*shutdown57\b(?<X2170460>)|/\*\*[^\{\$;]{0,99}\bclass\h+RemoteAdmin\s*\{\s*[^/:]{1,40}\bconst\h+PCLZIP_URL\h*=\h*['"]https?://(?:www\.)?pastebin\.com/(?<X2155471>)|/\*\*\s*\*(?:\h*Front\h+to\h+the\h+wordpress\h+application\.[^\{\}]{99,500}\bclass\h+wordpress_migrations?\s*\{[^\};\[\]]{9,200}\bif\((?:sha|md)\d\([^=]{2,20}\W{2,4}['"]\w{32,60}['"]\)(?<X2183280>)|\s*Plugin\s+Name:\s+CMSmap\s+\-\s+WordPress\s+Shell(?<X2059960>))|/\*\s*WHM(?:CS?)?\s+(?:KILL|BRUT|CRACK)(?<X2059870>)|<script\s*src\s*=\s*https?:\s*//r00t\.info/(?<X2125320>)|@(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\([^\)]{9,999}\)\s*;?\s*(?:\?>)?\s*\Z(?<X2061551>)|@?(?:(?:set_time_limit|error_reporting)\s*\((?:0|NULL)\);\s*){1,2}(\$\w{1,20})\s*=\s*['"][^'"]{99,999}['"];\s*@?eval\s*\(\s*(?:(?:gz(?:inflate|uncompress)|str_rot13|base64_decode)\s*\(){3}\43(?:\)){4}\s*;\s*(?:\?>|\Z)(?<X1126860>)|@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:['"]cd\s+/tmp;[^;]{1,20};\s*(?:curl|wget)\s+https?://[^;]{9,20}/(\w{1,20});\s*perl\s+\45;\s*rm\s+-r?f\s+\45\*;\s*mkdir[^'"]{1,20}['"]\);?\s*(?:\Z|\?>)(?<X1062181>)|\s*base64_decode\s*\(\s*['"](?:QGV2YWwoJF9QT1NUW|ZXZhbCgkX1BPU1R)[^'"]{1,99}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057950>))|@?(?:session_start\(\);\s*|error_reporting\s*\((?:0|NULL)\);\s*){2}if\(strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{]{1,30}\)\s*\{\s*header\s*\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);[^\$]{9,150}(\$\w{1,9})\s*=\s*['"][^;]+;\s*header\s*\(['"]Location:\s*\48['"]\);\s*(?:\?>|\Z)(?<X1064232>)|@?(?:system|eval|assert|popen|shell_exec|exec)\(['"]cmd\.exe\s+/c\s+(?:START\s+)?\S{0,90}\\?powershell\.exe[^'"]{300,1500}['"]\);\s*(?:\?>|\Z)(?<X1122391>)|@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\((?:['"]whoami['"]\);\s*(?:\?>)?(?:\s*[^\?]{0,40}\s*<\?php\s+phpinfo\s*\(\);\s*\?>)?\s*\Z(?<X1058012>)|\s*base64_decode\s*\(['"](?:aWYgKCRfR0VUWy|aWYgKCRfUE9TVF)[^'"]{99,3000}['"]\)\s*\)\s*(?:\?>|\Z)(?<X1058051>))|@?(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name["']\];\s*@?(\$\w{1,20})\h*=\h*basename\(\54\[[^\]]+\]\);\s*if\h*\(\h*!?empty\h*\(\55[\)\{\s]+echo\h+['"]<form[^\?\*]{99,400}\b(?:copy|move_uploaded_file)\(\53,\55\)[^\?\*%]{9,99}[\}\s]+(?:\Z|\?>)(?<X1149870>)|@?create_function\s*\(\s*['"]['"]\s*,\s*base64_decode\s*\([^\)]+\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059602>)|@?error_reporting(?:\((?:(?:0|FALSE|NULL)\);[^\$\{;]{9,200}\bCon7ext\-Security\.com\b(?<X2156040>)|(?:0|NULL)\);[^\?]{1,600}echo\s+['"]DarkCrew[^\}]{9,30}\}\s*\?>(?<X1064451>)|(?:0|NULL)\);\s*(\$\w{1,9})\h*=\h*['"][^'"]{99,999}['"];\s*(\$\w{1,9})\h*=\h*(strrev)\(['"]esab['"][^;]{1,30}\);\s*(\$\w{1,9})\h*=\h*\61\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\62\([^;]+\);\s*(\$\w{1,9})\h*=\h*\64\(['"]\60['"],\63\);\s*\65\(\60\);[^\(]{0,90}\$\w{1,9}\(\);\s*(?:\?>|\Z)(?<X1146060>)|(?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\];\s*(\$\w{1,20})\h*=\h*\68\[[^\]]+\];\s*echo\s*(['"])[^\?]{20,150}\70;\s*@?(?:copy|move_uploaded_files)\(\67,\69\);\s*(?:\Z|\?>)(?<X1153801>)|(?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*['"]safe_mode\h*=\h*Off[^'"]{9,99}shell_exec\h*=\h*On[^'"]{0,99}['"];\s*fwrite\(fopen\(['"]php\.ini['"]\h*,\h*['"]w\+?['"]\),\72\);\s*(?:\Z|\?>)(?<X1153661>)|0\);[^/]{1,600}(?:header\(['"]\S{1,19}\s*404\s+Not\s+Found['"]\);\s*)+(?:exit|die)[^;]{0,9};\s*\}else\s+setcookie\(['"]\w{1,40}['"],\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\);\s*\?>(?:\s*<\?php\s+[^\?]{1,40}\?>)?\s*<\?php\b[^\?]{1,99}function\s+\w{1,32}\((?<X2064851>)|0\);\s*(\$\w{1,40})\h*=\h*['"][\w\.\-]{2,40}@\w{2,40}\.\w{2,9}['"];\s*\$\w{1,40}\h*=\h*getenv\(['"]REMOTE_ADDR['"]\)[^\?]{1,999}(\$\w{1,40})\h*=\h*fopen\([^;/]+/\w{2,40}\.txt['"]\h*,\h*['"]a\+?['"]\);\s*fwrite\(\76,[^;]+;[^\?>]{1,199}\bmail\(\75\h*,[^;]+;\s*\?>\s*<scr(?<X2142182>)|0\);\s*function\s+(\w{1,40})\(\)\s*\{[^\}]{1,600}chdir\(\s*\$\w{1,40}\s*\);\s*if\s*\(\s*is_readable\s*\(\s*['"]?(shadow|passwd)['"]?\s*\)\s*\)\s*\{\s*link\(\s*['"]?\79['"]?\s*,\s*['"][^\]]{1,400}\];\s*unlink\(\s*['"]?\79['"]?[^\}]+(?:\}\s*){2,6}\78\(\s*\);\s*(?:\?>|\Z)(?<X1062370>))|\h*\((?:(?:0|false|null)\);[^:/]{9,99}(\$_SERVER\[['"]REQUEST_URI['"]\])\h*=\h*str_replace\h*\(['"]\?reboot=yes['"],\h*['"]{2}\h*,\h*\81\);\s*(?:system|assert|eval|shell_exec)\h*\(['"]echo\h+['"][\*\h]{0,15}\bwget\h+https?://['"][^;]{2,25}\81(?<X2180531>)|(?:0|NULL|FALSE)\);[^/\*]{0,99}/\*\*\s*\*\h+Plugin\h*Name:\h*Cmsmap\W{0,4}\bWordpress\h*shell\b(?<X2174430>)|(?:0|NULL|FALSE)\);[^\)\{]{9,99}\bfile_exists\h*\([^\)]{0,20}\bwp\-(?:admin|content|includes)[^\{]{12,200}\{\s*\$\w{1,20}[\h=]+['"]<\?php\s+/\*\*\s*\*\s*Front\h+to\h+the\h+Wordpress\h+application\b(?<X2191960>))|\s*\((?:0|NULL)\);\s*(?:(?:\$\w{1,20}\s*=\s*['"]wp-(?:admin|content|includes)/['"];\s*){1,3}[^\t\?]{20000,};\s*file_put_contents\s*\([^\)]+\);\s*chmod\s*\(([^,]+),0777\);\s*unlink\s*\(\85\);\s*\}\s*(?:unlink\([^\)]+\);\s*){1,3}(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1127540>)|\$\w{1,20}\s*=\s*['"][^'"]{1,99}/\w{1,20}\.php['"];\s*(\$\w{1,20})\s*=\s*\(['"]<\?(?:php)?\s+@?eval\s*\(\s*base64_decode\s*\(['"][^'"]+['"]\)\s*\);\s*\?>['"]\);[^\?]{0,99}fwrite\s*\(\$\w{1,9},\87\);\s*\$\w{1,20}\s*=\s*fclose\([^\)]+\);\s*\?>(?<X1063771>)))|@?eval\((?:\s*['"]\?>['"]\s*\.\s*(?:gzuncompress|gzinflate)?\s*\.?\s*\(?\s*base64_decode\s*\(\s*['"][^'"]{1,40000}['"](?:\s*\)\s*){1,6};\s*\?>\s*<\?php\s*\/\*[^\*]*\*/\s*\?>(?<X1057971>)|gz(?:inflate\(base64_decode\(base64_decode\(['"][^'"]{999,2500}['"]\)\)\)\);?\s*\?>\s*\Z(?<X1058981>)|uncompress\(base64_decode\(['"]\\[\\xabcdef0-9]{65000,}['"]\)\)\);(?:\s*\?>)?\s*\Z(?<X1064170>))))
\A\s*<\?php\s*(?:if\h*\(\h*!\h*(?:(class)_exists\h*\(\h*['"](?:([a-f0-9]{33})['"](?:\s*\)){2}\s*\{\s*\1\s*\2\s*\{[^\(]{999,4999}\bfunction\s*__construct\h*\(\h*\)\s*\{\s*(\$this\h*\->\h*)[a-f0-9]{33}\h*=\h*new\s*std\1\(\);(?:\s*\3[a-f0-9]{33}\h*\(\);){9}[^\?#%\*\+]{999,5499}\breturn\s*php_uname\(\);(?<X2168982>)|(\w{33})['"](?:\h*\)){2}\s*\{\s*\1\h+\5\s*\{\s*(?:p(?:rivate|ublic)\h+(?:static\h+)?\$\w{33}[^;]{0,9};\s*){5}[^#@!%&\?\*]{999,4999}\breturn\h+array\h*\(\s*(?:(\$this\h*\->)\h*\w{33}\h*\(\h*@?\6\h*\w{33}\h*\[\h*\6\h*\w{33}\h*\]\h*\)\h*,\s*){4}(?<X2179282>))|(function)_exists\h*\(\h*['"]((tmp_)\w{1,40})['"][^\?!]{1,199}\bif\h*\(\h*!\h*defined\h*\(\h*['"](\10\w{1,40})['"]\h*(?:\)\h*){2}define\h*\(\h*['"]\11['"]\h*,[^;]{999,4999};\s*\8\s+\9\s*\([^%]{99,999}\$GLOBALS\[['"]\11['"]\]=\$\w{1,40};\s*\10\w{1,40}\h*\(\h*\);\s*(?:\?>|\Z)(?<X1166450>))|if\h*\(\h*!(?:class(_exists)\h*\(\h*['"](WPTemplatesOptions)['"][\s\)]+\{\s*class\h+\14\s*\{[^\-]{99,999}(private\h+(function))\h+(\w{1,19})\(\)\s*\{\s*(\$this->)\17\h*=\h*\18(\w{1,40})\([^<\*]{2999,4999}\15\h*\19\(\)\s*\{[^\}]+\16\13\(\h*['"]\w{1,40}['"][\s\)]+\{\s*return\h+wp_upload_dir\(\);\s*\}(?<X2155343>)|file_exists\h*\(\h*['"]([^'"]{1,199}/\.[^'"/]+)['"]\h*\)\h*\D{2,3}\h*(?:hash|(?:md|sha)\d)_file\h*\(\h*['"]\21['"]\h*\)[^\{\v\?]{1,99}\{\s*@?chmod\h*\(\h*['"]\21['"][^;]{1,99};\s*@?(?:copy|move_uploaded_file)\h*\([^,\);]+,\h*['"]\21['"]\);\s*@?chmod\h*\(\h*['"]\21['"][^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1173370>)|isset\h*\(\$_[GPRSC]\w{2,6}\[[^\}]{1,150}\bcase\h*['"]inj['"]:\s*(\w{1,15}\(\));[^&]{0,1999}\bfunction\h*\23\{\s*\w{1,15}\(\);\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\[['"]path_inj['"]\]\)\s*\{[^\?]{0,1199}\$isInjected\h*=\h*file_put_contents\([^#]{0,799}\breturn;\s*\}\s*(?:\?>|\Z)(?<X1186020>))|if\h*\(\h*(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\s*\{\s*eval\h*\(\h*(?:(?:gzinflate|gzuncompress|base64_decode|str_rot13)\h*\(){2,5}\h*file_get_contents\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\)+;\s*\}\s*(?:\?>|\Z)(?<X1160801>)|isset\h*\(\h*(?:(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{[^\}\?]{1,199}\b(file_put_contents\h*\([^,\);]+),\h*['"]<\?php\b[^'"]{1,19}['"]\h*\);\s*@?\27\h*,\h*\26\h*,\h*(FILE_APPEND)\h*\);\s*@?\27\h*,\h*['"][^'"]{1,9}\?>['"]\h*,\h*\28\h*\);[^\}\?>\{]{1,199}\}\s*\?>(?<X1163961>)|(\$_[GPSRC]\w{2,6}\[[^\]]+\])(?:\h*\)){2}\s*\{\s*@?(?:eval|assert)\h*\(\h*file_get_contents\h*\(\h*['"]https?://['"]\h*\.\h*\30(?:\h*\)){2};\s*\}\s*(?:\?>\s*)?\Z(?<X2170550>)|\$_[GPCSR]\w{2,6}\[(?:[^\]]+\]\h*\)\s*\)\s*\{\s*(?:(\$\w{1,40})\h*\.?=[^;]{0,49}\$_POST\[['"][UPL](?:ser(?:name|id)?|ass(?:wo?r?d)?|ogin)['"]\][^;]{0,40};\s*){2}[^\}]{0,199}\bfwrite\h*\([^,\)]+,\h*\32\h*\);[^\}]{0,99}\}\s*\?>\s*<(?:!DOCTYPE\s*)?html\b(?<X2171110>)|\h*['"]0.?day['"]\h*\][^\}\?]{1,499}\b[cm]o(?:ve_uploaded_file|py)\h*\(\h*(\$_FILES\[)[^,\)]+,\h*\34[^\?]{1,999}\b[ed](?:xit|ie)[^;]{0,19};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1180542>))|\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*(?:die|exit)\b[^\}]{0,99}\}\s*(\$\w{1,15})\h*=\h*__(FILE_)_\h*\.\h*['"]\.css['"];[^\?]{1,99}(\$\w{1,15})\h*=\h*['"][^'"]{999,7000}['"];[^\?]{9,150}\b\37put_contents\([^\)]+\38[\)\s]+;\s*include\h*\36;\s*unlink\(\36\);\s*(?:\?>|\Z)(?<X1166692>)|\h*\)\h*\D{2,3}\h*substr[^\{]{9,90}\{\(@?copy\(\$_FILES\[[^\]]+\][^;]{9,50};\h*(\$\w{1,15})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*if\(isset\(\40[^\{]{9,25}\{eval\(urldecode\(\40\)\);\h*(?:exit|die)[^;]{0,9};\}\}\s*\?>(?<X1144280>))))|if\s*\(!(?:(function)_exists\s*\(['"](\w{1,20})['"]\)\)\s*\{\s*\42\s+\43\s*\(\$\w{1,20}\)\s*\{\s*if\s*\(\s*preg_match_all\s*\(['"]#<(?:script|iframe)[^%]{300,2000}\$\w{1,20}\s*=\s*@?set_error_handler\s*\([^\;]+;\s*@?eval\s*\(\s*base64_decode\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\?>(?<X1124891>)|defined\(['"]frmDs['"]\)[^\}]{9,40}function\s*(\w{1,9})\s*\([^\}]{9,250}curl_close[^\?]{9,350}\45\(['"]https?://\d{1,3}[^'"]{9,50}\.js['"]\)[^#]{9,600}if\(!isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{9,250}fputs\((\$\w{1,5})[^\}]{1,40}fclose\(\46\);\s*(?:\}\s*){4}(?:\Z|\?>)(?<X1129340>)|isset\((\$\w{1,9})\)\)\s*\{\s*global\s*\48;\s*\48\s*=\s*\d{1,2}(?:;\s*error_reporting\(0\)[^\?]{99,800}print\(['"]<script>['"]\.base64_decode\(['"][^'"]{99,5000}['"]\)[^\{]{1,99}\{\s*fputs\((\$\w{1,5})[^\}]{1,30}fclose\(\49\);(?:\s*\})+\s*(?:\?>|\Z)(?<X1128362>)|[^\?]{99,800}error_reporting\(0\);\s*print\(gzinflate\(base64_decode\(['"][^'"]{99,5000}['"]\)[^\{]{1,99}\{\s*fputs\((\$\w{1,5})[^\}]{1,30}fclose\(\51\);(?:\s*\})+\s*(?:\?>|\Z)(?<X1130410>))))
\A\s*<\?php\s*(?:if\s*\((?:(isset)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\?]{99,350}\s*(\$\w{1,9})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\1\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,5})=\3;\s*(\$\w{1,9})=['"]From[^\?]{9,600}mail\(\$\w{1,5},\s*\2,\s*\4,\s*\5[^\?]{1,50}(?:die|exit)\(0\);\s*\}\s*(?:\Z|\?>)(?<X2129231>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\D{2,3}\s*['"]\w{32}['"]\)\s*\{\s*error_reporting\([^#]{999,6000}(\$shell)Path\s*=\s*pathinfo\(\$_SERVER\[[^\}]{9,150}\}\s*\7Dir\s*=\s*dirname(\(__FILE__\))[^\?]{999,1999}if\s*\(!\$\w{1,9}\)\s*\{\s*unlink\8;\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1135120>)|\s*!@?(\$\w{1,40})\s*!=\s*false\s*\|\|\s*!@?\10\s*!=\s*null\s*\)\s*[^j]{5000,6000}\s*file_put_contents\([^,]{9,99},\$[li]{1,40}\)\s*;\s*endif\s*;\s*endif\s*;\s*endif\s*;\s*\$\w{1,40}\s*=\s*true\s*;\s*\$\w{1,40}\s*=\s*true\s*;\s*\}\s*\?>(?<X1053892>)|\s*!defined\s*\(['"](?:\w{1,9}['"]\)\)\s*\{\s*define[^;]+;\s*@?error_reporting\s*\(0\);[^#]{2999,9999}function\s*(\w{1,9})\s*\((\$\w{1,9})\)\s*\{\s*if\s*\(\s*!\w{1,9}\s*\([^\}]{1,600}die\s*\(['"][^\.]{1,99}document\.location=\s*\(\\['"]https?://[^#]+if\s*\(\s*\13\s*\)\s*\12\s*\(\13\);\s*\}\s*\?>(?<X1125141>)|frm\w{1,9}['"]\)\)\s*\{\s*define[^;]+;[^#]{3000,5500}(?:exit|die)\b[^;]{0,9};\s*\}\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{(?:\s*@?error_reporting\s*\(0\);)?\s*print\s*\(\s*frm_getcache\s*\(\s*\$\w{1,40}\s*,\s*['"]https?://[^;]+;\W{0,20}\}\W{0,20}\}\W{0,20}\}\s*\?>(?<X1125201>))|\s*!function_exists\s*\(\s*['"](\w{1,40})['"].{300,450}\$\w{1,40}\s*=\s*['"]\16['"]\s*;\s*(\$\w{1,40})\s*=\s*(\$\w{1,40})\s*\(\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\17\s*\(\s*['"]['"]\s*,\s*\18\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\19\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1041880>)|\s*@?preg_match\s*\(\s*['"]/?(?:checkout|admin|\|){1,3}/?['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,20}['"]\s*\]\s*\)\s*\)\s*\{\s*@?file_put_contents\s*\(\s*.{1,200}\s*\?>(?<X1041860>)|\s*\!\s*class_exists\s*\([^@]{250,600}const\s*\w{1,40}\s*=\s*['"][ ]{200,}\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\]\s*\)\s*;\s*['"]\s*;(?<X2057620>)|\s*\$_[GPCSR]\w{2,6}\[[^\)]+\)\s*(?:\{\s*)?\b(?:die|exit)\h*\(\h*['"]baja?tax['"]\h*\);\s*header\h*\(\h*['"]Location:[^;]{1,99};\s*(?:\?>|\Z)(?<X1165330>)|\s*is_file\(\s*['"]/[^'"]+\.php['"]\s*\)\s*\)\s*\{\s*include(?:_once)?\s*\(\s*['"]/[^'"]+/wp\-[\w\-]{1,20}\.php['"]\s*\);\s*\}\s*\?>(?<X1058440>)|\s*isset\s*\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*\)\s*\)\s*die\s*\(\s*.{400,500}\s*\(\s*(\$\w{1,40})\s*\)\s*\)\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\25\s*\)\s*\)\s*\{\s*@?eval\s*\(\s*\25\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\}\s*\Z(?<X2051970>)|[GPCSR]\w{2,6}\[[^\]]+\]\s*(?:\)\s*){2}\{\s*(?:@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]+/(?:anti)?b(?:ot|locker)[sz]\d*\.php['"];\s*){2}(?<X2171250>)|[GPRSC]\w{2,6}\s*\[[^\]]+\][^\?]{1,200}\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:\s*\)\s*){1,6};?[^\?]{0,199}(?:\?>|\Z)(?<X1124581>)|POST\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\$_SERVER\s*\[['"]?DOCUMENT_ROOT['"]?\]\s*\.\s*base64[^;]+;\s*\$\w{1,40}\s*=\s*curl_init\(\);[^&]+\{@?unlink\(\29\);\}@?file_put_contents\(\29,\$\w{1,40}\);@?touch\(\29,strtotime[^\}]{1,99}\}\s*(?:\?>|\Z)(?<X1059942>))|\s*md5\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w{1,40}['"]\]\s*\)\s*==\s*['"][^'"]{1,40}['"]\)\s*\(\$\w{1,40}\s*=\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w['"]\]\s*\)\s*\.@?\$_\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w['"]\]\s*\);\s*\?>(?<X1042140>)|\s*sha1\s*\(\s*md5\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w['"]\s*\]\s*\)\s*\)\s*===\s*['"][^'"]{24,40}['"]\s*\)\s*\{\s*eval\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w['"]\s*\]\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]{1,40}['"]\s*;\s*\}\s*\?>(?<X1042170>)|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*if\s*\(stristr\([^\{]{5,50}\{echo\s*\(['"]<a\s*href=['"][^'"]{1,40}\.php['"]\s*style=[^\?]+hidden;\s*(?:(?:width|height):\s*\dpx;\s*){2}[^\}]{0,55}\}\s*(?:\Z|\?>)(?<X1129510>)|strpos\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]{1,30}\{\s*header\(['"]HTTP/\d\.\d\s*301[^\}]{9,99}\}\s*if\s*\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*@?eval\(base64_decode\(\34\)\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1132911>))|include(?:\(['"][^'"]{9,50}['"]\);\s*(\$\w{1,9})\h*=\h*wp_remote_get\(['"]https?://[^'"]{9,50}['"]\);\s*if\h*\(\h*file_put_contents\(\h*['"][^'"]{9,50}\.php['"],\s*(base64_decode)\([^\)]+\)\.\37\(\36\[[^\]]+\]\)\)\)\s*echo\h*[^;]{9,50};\s*unlink\(__FILE__\);\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X1144940>)|\h*['"][^'"]{0,49}\.php['"]\h*;\s*\$\w{1,15}\h*=\h*['"][^'"]{0,25}\bvictim\h*on\h*sms[^'"]{0,25}['"];(?<X2183430>))|ini_set\(['"]allow_url_include['"]?\s*,\s*['"]?1['"]\);[^;\$"':\*\{\}\?]{1,199}include\(['"]php://input['"]\);[^;\$"':\*\{\}\?]{1,199}(?:\?>|\Z)(?<X1124981>)|require\s*['"]call\.php['"];\s*\$user\s*=\s*\$_POST\[['"]user['"]\];\s*\$pass(?:word)?\s*=\s*\$_POST\[['"]pass(?:word)?['"]\];(?<X2046992>)|session_start\(\);(?:[^\?]{1,99}\bgetenv\([^\)]+\);[^\}\{]{0,99}(\$\w{1,15})\h*=\h*['"][^;]{1,99}\b(?:card|sms|cvv|cvc):\h*['"]\.\h*\$_SESSION\[[^\]]+\]\h*\.['"][^\?]{9,499}\b\w{1,15}\(\42,\h*\$\w{1,15}\);\s*header\(['"]Location:[^\)]{1,50}\);\s*(?:\?>|\Z)(?<X2192540>)|\s*class\s*BrowserDetection\s*\{[^%]{999,9999}\$(subj?(?:ect)?)\h*=\h*['"][^'"]{0,99}([^\s\w])\s*Normal\s*\dd\s*\45[^;]{1,49};[^!\}]{499,2999}\bmail\([^\)]+\$\44\b[^;]{1,99};\s*header\(['"]Location:(?<X2160130>)|\s*error_reporting\(0\);[^\.]{1,80}(?:include(?:_once)?\s*['"][^'"]{1,40}\.php['"];\s*){1,9}(\$\w{1,40})\s*=\s*fopen\s*\(\s*['"][^'"]+\.txt['"]\s*,\s*['"]a\+?['"]\s*\)\s*;\s*fwrite\s*\(\s*\47\s*,[^;]+\);\s*header\(\s*['"]LOCATION:[^\)]+\);?(?:\s*\?>)?\s*\Z(?<X2060511>))|set_time_limit\(0\);(?:[^\{]{9,400}(\$\w{1,15})=['"\.eval]{9,15};(\$\w{1,15})=['"\.gzinflate]{9,25};[^\n]{99,2200}(\$\w{1,15})\h*=\h*\$\w{1,15}\([^,]{1,9},\49\.['"\(]{1,9}\.\50[^\?]{9,60}\);\51\(['"][^'"]{9999,}['"]\);\?>(?<X2152801>)|\s*if\((isset\()(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\53(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{\s*if\((\w{1,15})\(\54,\h*\55[^\?]{9,150}\bfunction\s*\56\((\$url,\h*\$file)=[^#]{9,299}\bcurl_init\(\);[^\?]{9,600}\bif\(@?copy\(\57[^\?]{9,120}\bfalse;[\s\}]+\?>(?<X1153171>))|system(?:\(['"](?:echo\s+\w{1,40}\s*>\s*index\.html['"]\);\s*(?:system\(['"]c[pd][^'"]{1,99}['"]\);\s*){2,}echo\s*['"][^'"]*['"]\s*;(?:\s*\?>)?\s*\Z(?<X2125580>)|id['"]\);\s*[^\{\}]{1,400}function\s+selfpatch\(\)\s*\{\s* \$maps\s*=\s*read_proc_maps\(\);(?<X2126210>)|rm\h*(?:\.htaccess|php\.ini)['"]\);\s*\?>\Z(?<X1146341>))|\s*\(\s*['"]wget\s+https?://\S{1,40}/\w{1,9}\.txt\s+-O\s+\w{1,40}\.php;?\s*['"]\s*\);\s*(?:\?>|\Z)(?<X1132161>))|use\s+PHPMailer\\[^\$]{99,499}\bfunction\s*generateRandomString\([^@]{999,9999}<title>XasTr[oO]\s*Mailer</title>(?<X2156011>))
\A\s*<\?php\s+(?:(?:(?:(?:else)?(?:if)?)\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*){1,2}if\s*\(isset\s*\(\1\)\s*\)\s*\{\s*@?eval\s*(?:\(\s*str_rot13|\(\s*base64_decode|\(\s*gzinflate){1,3}\s*\(\s*\1\s*\)\s*\)\s*\);\s*die\(\s*\);\s*\}\s*(?:\Z|\?>)(?<X1042381>)|(?:(?:error_reporting|ini_set|set_time_limit)\([^\)]+\);\s*){4,9}if\(isset\(((\$_SERVER\[)[^\]]+\])[\)\h]+\4['"]REMOTE_ADDR['"]\]\h*=\h*\3;\s*if\(isset\([^\{]+\{@?eval\(base64_decode\([^/]{9,150}\bfile_get_contents\(['"]php://input['"]\);[^\?]{99,400}\}(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1142660>)|(?:(?:print|echo)\s*[^;]{1,99}?\s*;)?\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057940>)|(?:/\*[^<]+\*/\s*)?echo\s+['"]<html><title>\s*Importer\s+T[0O]{2}lz\s+v\.\d(?<X2060171>)|(?:/\*[^\*]{0,39}\*/)?\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"]IGlmKGZ1bmN0aW9uX2V4aXN0cygnb2Jfc3RhcnQ[^'"]{2500,2700}['"]\s*\)\s*\)\s*;\s*\?>(?<X1056810>)|(?:@?(?:eval|assert|system|(?:shell_|pcntl_)?exec|passthru|popen)\s*\(['"](?:w|\\x77)(?:g|\\x67)(?:e|\\x65)(?:t|\\x74)(?:\s|\\x20)[^\)]+\);){8,14}(?:exit|die)[^;]{0,9};\s*\?>\s*\Z(?<X1062341>)|(?:@?(?:set_time_limit|error_reporting)\((?:0|NULL|FALSE)\);\s*){1,2}if\h*\(\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[^\)]+\)\s*\{\s*@?eval\h*\(base64_decode\h*\(\10[\h\)]+;\s*\}[^\}]{1,150};\s*\}\s*(?:\?>|\Z)(?<X1137840>)|(?:@\$\w{1,20}\s*=\s*\$_POST\[[^\]]+\];\s*|@\$\w{1,20}\s*=\s*\$_FILES\[[^\]]+\]\[[^\]]+\];\s*){5,15}\?>[^\$]{9,150}<title>\s*PHP\s+Mailer\b(?<X2126620>)|(?:@\w{1,40}\([^\)]{1,40}\);\s*){2,9}if\s*\(?\s*isset\s*\(\s*\$_(?:G|P|C|S|R)[^\{]{1,600}\{\s*@?eval\s*\(\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*;\s*\}\s*exit\(?\)?;\s*(?:\?>|\Z)(?<X1058471>)|(?:[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"](?:blocker|bots|antibots|banned)\.php['"];\s*){3,5}function\h+getloginIDfromlogin\([^\)]+\)\s*\{\s*[^\?]{99,999}(\$\w{1,20})\h*=\h*ucfirst\(\14\);\s*\?>(?<X1141950>)|(?:\$(?:user|username|uname|login|email|password|pass|psw|pwd|passwd)\s*=\s*\$_[GPRSC]\w{2,6}\[['"](?:user|username|uname|login|email|password|pass|psw|pwd|passwd)['"]\];\s*){2}[^,]{99,800}<form\s+method\s*=\s*['"]post['"]\s+action\s*=\s*['"]\w{1,20}\.php['"](?<X2123612>)|(?:\$\w{1,20}\s*=\s*'(?!print)[^']{1,99}'\s*;\s*){6}[^%]{200,6000}(?:\$\w{1,20}\[\s*['"]?\d+['"]?\s*\]\s*\.?\s*){5,}\);(?<X1036545>)|(?:\$\w{1,20}\s*=\s*['"][^'"]+['"];\s*){1,4}\$\w{1,20}\s*=\s*isset\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{]{9,99}preg_match\(['"]/(?:googlebot|bingbot|slurp|Baiduspider)\|[^\?]{99,300}base64_decode\(['"]aHR0cD[^\)]{9,150}\)[^\?]{9,99}header\s*\(['"]Location:[^\)]+\);\s*(?:\?>|\Z)(?<X1136940>)|(?:\$\w{1,20}\s*=\s*\$_(?:P|G|S|R|C)\w{2,6}\[[^\]]+\];\s*){1,5}if\s*\(\s*isset\s*\(\$_[^\.]{99,500}(\$\w{1,20})\s*=\s*generateRandomString\(mt_rand\([^\)]+\)\)\s*\.\s*['"]\.php['"];[^>]{99,350}file_put_contents\(\19\s*,\s*\$\w{1,20}\);[^\]]{9,99}\s*unlink\(\19\);\s*(?:\Z|\?>)(?<X1118441>)|(?:\$\w{1,3}\h*=\h*['"][^\*]{10,200}['"];\s*){4,9}(\$\w{1,4})\h*=\h*(str_replace)\(['"][^'"]+['"]\h*,\h*['"]['"],['"][^'"]{15,30}['"]\);\s*(\$\w{1,4})\h*=\h*\22\(['"][^'"]+['"]\h*,\h*['"]['"]\h*,\h*(?:\$\w{1,4}\.)+\$\w{1,4}\);\s*(\$\w{1,3})\h*=\h*\21\(['"]['"],\23\);\24\(\);\s*(?:\?>|\Z)(?<X1161730>)|(?:\$\w{1,40}\s*=\s*(?:__FILE__|dirname\(\$\w{1,40}\))\s*;\s*){1,3}\s*do\s*\{\s*if\s*\(\s*file_exists\s*\(\s*[^'"]{1,40}[wp\-config\.h'/\s]{15,40}\)\s*\)\s*\{(?<X2059580>)|(?:\$\w{1,40}\s*=\s*['"]?\w{1,40}['"]?\s*;\s*){1,9}@?error_reporting\((?:0|false)\);[^\{]{1,99}function\s+\w{1,40}\(\s*\$\w{1,40}\s*\)\s*\{[^\?]{55000,65000}\)\)\);['"];\s*(\$\w{1,40})\s*=\s*Create_Function\s*\(\s*['"]['"]\s*,\s*\$\w{1,40}\s*\)\s*;\s*\27\s*\(\s*\)\s*;\s*(?:\?>|\Z)(?<X1060351>)|(?:\$\w{1,40}\s*=\s*['"][^'"]{1,150}['"];)?\s*if\s*\(\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[base64_decode\(['"][^'"]{1,40}['"]\)\]\s*[^\w]{1,2}=[^`]{200,600}\s*\{\s*@?eval\s*\(\s*\$_POST\[['"][^'"]{1,40}['"]\]\s*\);\s*\}\s*(?:\?>|\Z)(?<X1055890>)|(?:\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*;\s*){2}\?>[^!\{\}%\+]{1,600}<title>\s*(?:American\s+Express|Wells\s+Fargo|Bank\s+of\s+America)(?<X2122320>)|(?:\$\{['"](?:\\x47|G)[^'"]{6,24}['"]\}\[[^\]]+\]=['"][^'"]{1,99}['"];){3}[^\?]{1,999}\bfSockOpen\(\$\{\$\{['"](?:\\x47|G)[^'"]{6,24}['"]\}\[[^\]]+\]\},(?:80|443),[^\?]{1,999}require_once\s*['"][^"']+['"];\}else\{echo\s*['"][^\?]{1,999}[^\\]['"];\s*(?:die|exit)[^;]{0,9};\s*\}?\s*(?:\?>|\Z)(?<X1122530>)|(?:\$\{['"](?:G|\\x47)[^'"]{4,24}['"]\}\[[^\]]+\]=[^;]{1,40};){2}[^\)]{99,999}\);function\s+\w{1,40}\([^\)]+\)\{[^\?]{9,999}return\s*isset\s*\(\s*@?\$_(?:P|G|S|C|R)\w{2,6}\s*\[[^\]]+\]\s*\)\s*\?[^\?]{9,999}@eval\(\$\{\$\{['"](?:G|\\x47)[^;]{1,99};(?:die|exit)[^;]{0,9};\}+\s*(?:\?>|\Z)(?<X1122401>)|(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=\s*['"][^'"]+['"];\s*){2,9}[^@]{99,1500}if\h*\(@?file_put_contents\h*\(\$\{[^\?]{9,99}\{\s*@?include\$\{\$\{[^\{]{9,99}\}\s*@?unlink\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*\}\s*\);\s*\?>(?<X1137661>)|(?:echo\h+['"]<pre>[""];)?\s*(\$xmlrpc)\h*=\h*['"]pZJa[^'"]{99,999}['"];\s*@?(?:echo|eval)\h*\(?(?:(?:str_rot13|gzinflate|base64_decode)\h*\(){3,6}\(\34(?:\)\h*)+;\s*(?:\Z|\?>)(?<X1157450>)|(?:echo|print)\s*\(?\s*['"][\!\s\-\w'"\^]{1,40}['"]\s*\)?\s*;\s*\?>(?:\s*<\?php\s+(?:system|chmod)\s*\(\s*(?:['"]?(?:chmod|\w{1,40}\.php|\d{3,4})\s*['"]?\s*,?){2,3}\s*\)\s*;\s*\?>){2}(?<X1059490>)|(?:echo|print)\s+['"]Priv(?:8|ate)\s+Up[l1][0O][a4]d[3e]r.?['"];(?<X2065380>)|(?:Error_Reporting\(0\);)?\s*\$\w{1,40}=['"][^'"]{7000,8000}['"];\s*preg_replace\(['"]/\.\*/e['"],['"][^"']{1,120}['"][^'"]{1100,1600}['"][^'"]{1,40}['"],['"]\.['"]\);\s*return;\s*\?>\s*\Z(?<X1042000>)|(?:function\s+\w{1,20}\((\$\w{1,20})\)\s*\{\s*return\s+@?(?:base64_decode|gzinflate|eval)\s*\(\39(?:,\d)?\);\s*\}\s*){1,3}\$\w{1,20}\s*=\s*['"][^'"]{99,500}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\40e\w?.?['"]\s*,\s*['"][^\)]+\);\s*(?:\Z|\?>)(?<X1119640>)|(?:function\s+\w{1,20}\(\$[^\)]+\)\s*\{[^\}]+\}\s*){0,2}function\s+(\w{1,20})\s*\(\$\w{1,9}\s*=\s*[^\)]+\)\s*\{\s*\$\w{1,20}\s*=\s*(?:isset\()?\$_GET\[[^\]]+\][^}]{9,}\$\w{1,20}\s*=\s*@?(?:curl_exec|file_get_contents)\([^\)]+\);[^}]{1,99};\s*echo\s+[^;]{1,20};\s*\}\s*\42\(\);\s*\?>(?<X1062751>)|(\$[li1]{1,15})\s*=\s*urldecode\(['"][^'"]{9,150}['"]\);\s*(\$\w{1,15})=(?:\44\{\d{1,2}\}\.){3}[^\(]{99,350}eval\(\45\(['"][^'"]{999,30000}['"]\)\);\s*(?:\Z|\?>)(?<X1128168>)|(\$\w{1,16})\s*=\s*['"][^'"]{20,99}['"];\s*(\$\w{1,16})\s*=(?:\s*\47\s*\[\d+\]\s*\.\h*){3}[^'"]{999,9999}(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\([^;\+]{0,99}\48[^;\)]{999,9999}['"][\)\h]+;\h*@?\49\(\);\s*(?:\?>|\Z)(?<X1064471>)|(\$\w{1,20})=[eval\.'"]{5,15}\(([^\)]+)\);\s*['"];\s*(\$\w{1,20})=create_function\(['"]\52['"]\h*,\h*\51\);\s*(\$\w{1,20})=[base64_dco'"\.]{14,35};\s*(\$\w{1,20})\h*=\h*['"\.gzinflate]{10,25};\s*\53\(\55\(\54\(\54\(['"][^'"]{999,9000}["'](?:\)\s*)+;[^\(;]{0,40}\b(?:unlink\(__FILE__\);\s*){1,2}(?<X1168360>))
\A\s*<\?php\s+(?:(\$\w{1,20})\h*=\h*(?:(?:['"]{2}\.|chr\(\d+\)\.|['"]\w[""]\.){20}[^;]{99,999};\$\w{1,20}\h*=\h*\1\([^\?\\%&\*]{999,6000}\)\h*,\h*\$\w{1,20}\h*,\h*(\$\w{1,20})\(\2\(\$\w{1,20}\)\)\)\h*,\h*['"]\\\d['"]\)\);\s*\$\w{1,20}\(\);\s*(?:exit|die)[^;]{0,9};\s*(?:\?|\Z)(?<X1165101>)|(image)createfrompng\h*\(['"]\w{1,20}\.png['"]\);\s*header\h*\([^\)]+\);\s*\4png\h*\(\1\);\s*\4destroy\(\1\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\.]{9,99}\.txt['"]\);(?<X2141370>)|@\$_COOKIE\[[^\]]+\];\s*if\h*\(\1\W{2,4}['"][^'"]+['"]\)\s*\{\s*@?header\h*\(['"]HTTP/1\.\d\h+404\h*Not\h*Found['"]\);\s*die\h*\(['"]<(html>)<meta\h+http\-equiv\h*=\h*['"]refresh['"]\h+content\h*=['"]0;\s*url\h*=\h*https?://[^>]+>\s*</\6['"]\);\s*\}\s*\?>\Z(?<X2169770>)|["'][^\.]{2,20}\.txt['"];\s*for\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(\$\w{1,20})\h*=\h*\8\h*\.\h*['"]\.php['"];\s*if\h*\(!?copy\h*\(\1\h*,\h*\9\)\)\s*\{[^\}]{9,99}(?:\}\s*)+\s*(?:\?>|\Z)(?<X1184930>)|['"]([^'"]+)['"];\s*if\h*\(is_writable\h*\(\1\)\)\s*\{[^\\]+\}\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\((?:['"]\11['"]|\1)\);\s*\12\h*=\h*str_replace\h*\(['"]<\?php['"]\h*,\h*['"]['"],\12\);[^\(]{0,20}\bunlink\h*\([^\)]+\);\s*(?:\Z|\?>)(?<X1180511>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\h*\(strlen\(\1\)!=32\)\s*\1\h*=\h*md5\(\1\);\s*if\h*\(\1\W{2,4}['"][a-z0-9]{32}['"]\)\s*\{\s*\$\w{1,20}\h*=\h*['"]eng['"];\s*(\$\w{1,20})\h*=\h*base64_decode\h*\(['"]ZXJy[^'"]{15000,}['"]\);\s*@?eval\h*\(['"]?\14['"]?\);\s*\}\s*(?:\?>|\Z)(?<X1167510>)|base64_decode;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]{3,20}\);\s*\16\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(?:\?>)?\Z(?<X1185641>)|strrev\s*\(['"][stro13_\.'"]{12,25}['"]\);\s*(\$\w{1,20})\h*=\h*\$\{\1\h*\([^\)]+\)\h*\};\s*\(count\h*\(\18[^a-z]{1,9}\bin_array\h*\(gettype\h*\(\18\)\.[^<\v]{9,150}\)\h*\&+\18\(\)\):\18;\s*(?:\Z|\?>)(?<X1145331>)|substr\h*\(md5\h*\([^,]+,\h*rand\h*\([^;]+\);\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\(['"]\w{1,20}\.txt['"]\h*,\h*true\);\s*header\h*\(['"]Location\h*:\h*['"]\.['"]https?://['"]\.['"]\20['"]\.['"]\1['"]\);\s*(?:exit|die)\h*\(\);\s*(?:\?>|\Z)(?<X1184940>))|(\$\w{1,20})\s*=\s*['"](?:[^'"]{99,200}['"];\s*\$\w{1,20}\s*=\s*array\([^\)]+\);\s*\$payload\s*=\s*['"][^'"]{9000,40000}['"];\s*(\$\w{1,20})\s*=\s*["'][^'"]*['"];[^\}]{9,50}\23\.=\s*\22\[[^\]]+\]\s*;\s*\}\s*\23\(['"](?:\\x[a-fA-F0-9]{1,2}){9}[^\)'"]{9,999}['"]\);\s*(?:\Z|\?>)(?<X1123361>)|chr['"];\s*\$\w{1,20}\s*\.=\s*\22\(36\)\.\22\(95\)\.(?:\22\(82\)\.|\22\(71\)\.|\22\(80\)\.|\22\(83\)\.|\22\(67\)\.)[\d\(\)\.\$a-z]{15,45};(?<X2124830>))|(\$\w{1,20})\s*=\s*(?:file(?:\s*\([^\)]+\);[^\$]{0,99}(\$\w{1,20})\s*=\s*count\s*\(\26\);[^\$]{0,99}(\$\w{1,20})\s*=\s*rand\s*\(\d+,\27[^\)]{0,9}\);[^\$]{0,99}(\$\w{1,20})\s*=\s*trim\s*\(\26\[\28\]\);[^\$]{0,99}\?>\s*<html>[^=]+<meta[^\d]+=['"]refresh['"][^>]+<\?php\s+echo\s+\29;\s+\?>\s*['"]>(?<X1061751>)|_get_contents\s*\(['"]https?://[^'"]+\.(?:css|jpg|png|jpeg|ico)['"]\);\s*@?eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\26\)\s*\)\s*\);\s*(?:\?>|\Z)(?<X1061281>))|gz(?:inflate|uncompress)\s*\(base64_decode\s*\(['"][^'"]{60000,}['"]\)\s*\);\s*(\$\w{1,20})\s*=\s*create_function\(['"][^'"]*['"]\s*,\s*\26\);\s*\32\(\);\s*(?:\Z|\?>)(?<X1121070>)|str_replace\s*\(['"][^'"]*['"],\s*[^,]+,\s*['"][^'"]+['"]\);\s*\26\s*\(\s*.?['"](.)(.{0,40})\34e\w?.?['"]\s*,\s*\$_(?:GET|POST|REQUEST|SERVER|COOKIE)\[[^\]]+\],\s*['"]\35['"]\);\s*\?>(?<X1062860>)|substr\s*\([^\)]+\);\s*foreach\s*\(\s*array\s*\([^\)]+\)[^\?]{99,700}@?eval\s*\(urldecode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(\$\w{1,20})\[[^\)]+\)\s*\);\s*\}\s*\}\s*(?:(?:exit|die)[^;]{0,9};\s*)?\}\s*unset\s*\(\26\);\s*unset\s*\(\37\);\s*(?:\Z|\?>)(?<X1063190>))|(\$\w{1,40})\s*=\s*(?:@\$_FILES\[[^\]]{1,40}\];\s*if\s*\(\s*\39\[[^\]]{1,40}\]\s*[^\w]{2,3}\s*['"]['"]\s*\)\s*\{[^\}\(]{1,99}if\s*\(\s*move_uploaded_file\s*\(\s*\39\[[^\}]+\}\s*\}?[^\(\?]{1,200}exit[^;]{0,9};\s*(?:\?>|\Z)(?<X1061250>)|['"].{100,200};\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\s*=\s*\39.{6000,8000}\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\(\39,\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\(\39,\s*\$\w{1,40}\[\$\w{1,40}\]\)\);\s*\?>(?<X2053511>)|['"][\w\.\-]{1,40}\.(?:jpg|gif|ico)['"]\s*;\s*(\$\w{1,40})\s*=\s*curl_init\(['"]https?://[^'"]{1,99}\.php['"]\s*\)\s*;[^>]{1,600}>['"]@?\39['"][^=]{1,99}\$\w{1,40}\s*=\s*curl_exec\(\42\);[^\?]{1,99}(?:\?>|\Z)(?<X1059270>)|['"][^`]{25000,35000}(\$\w{1,40})\s*=\s*["'\.strev\s]{10,40};\s*@?eval[^\(]{0,9}\(\s*\44\s*\(\s*@?preg_replace\s*\(\s*[^,]{1,40}\s*,\s*['"]['"]\s*,\s*\39\s*\)\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057120>)|['"]\\[xa-f\d\\]{9,99}[^'"]{1,60}['"];\s*@?error_reporting\(0\);\s*\39\(['"][^'"]*['"],\s*['"]\\[xa-f\d\\]{9,99}[^'"\)]{6000,16000}\\[xa-f\d\\]{9,99}['"]\);\s*\?>(?<X1063593>)|base64_encode\(['"][^\%]{99,600}(\$\w{1,40})\s*=\s*urldecode\(['"]%[^\)]{1,99}\);(\$[^=;\s]{1,40})\s*=\s*(?:(?:\39|\47)\[\d+\]\.){2}[^;]{0,999};[^_]{99,600}\$\w{1,40}\s*=\s*__FILE__;\s*@?eval\(\s*\48\s*\(['"][^'"]{99,3000}['"]\)\s*\)\s*;\s*return[^;]{0,9};\s*\?>(?<X1063711>)|str_replace\s*\(\s*['"](\w{1,9})['"]\s*,\s*['"][^'"]*['"]\s*,\s*['"](?:\50|[asertvl])+['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*@?\39\s*\(\s*\51\[[^\]]{1,40}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059510>))|(\$\w{1,9})\h*=\h*strrev\(['"\.stro13_]{10,20}\);\s*(\$\w{1,9})\h*=\h*\53\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\53\([^:\?<%]{99,200}(\$\w{1,9})\h*=\h*\55\(['"]{2},\54\([^\)]+\)\)\)\?\56\(\):['"]{2};\s*(?:\?>|\Z)(?<X1153550>)|(\$\w{1,9})\s*=\s*(?:['"]\w{32}['"];[^\$]{0,20}(\$\w{1,9})\s*=\s*['"]\w{32}['"];[^\$]{0,20}if\s*\(\s*md5\s*\(\s*\$_GET\[[^\]]+\]\s*\)\s*[^\w]{2,3}\s*(?:\58|\59)\s*&&\s*md5\s*\(\s*\$_GET\[[^\]]+\]\s*\)\s*[^\w]{2,3}\s*(?:\58|\59)\s*\)\s*\{\s*@?eval\s*\(\s*\$_[^\)]+\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1059301>)|substr\([^\)]+\);\s*foreach\(array\([^\)]+\)\sas\s([^\)]+)\)\s*\{\s*\58\.\s*=\s*chr\(\61\);\s*\}[^/]{99,800}(?:@(?:unlink|rename)\([^\)]{9,200}\);\s*){1,4}(\$\w{1,9})\s*=\s*['"]https?://[^@]{9,99}@header\(['"]Location:\s*\62['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1121270>))|(\$\w{10,80})\s*=\s*[^;]{1,20};[^\t]{999,3000}\)\^\64\);\s*@?eval\s*\(['"]\?>['"]\s*\.\s*\$\w{10,80}\s*\.\s*['"]<\?\s*['"]\);\s*(?:\?>|\Z)(?<X2124932>)|(\$\w{20,60})=(\w{20,60})\([^\)]+\);\s*(\$\w{20,60})=\67\([^\)]+\);\s*(\$\w{20,60})=\67\([^\)]+\);\s*(\$\w{20,60})=new\s+\66\(\67\([^\)]+\)+;\s*error_reporting\(0\);\s*@?eval\(\68\(\70->\69\([^\)]{30000,}\)+;\s*Class\s+\w{1,20}[^#@\\]{4000,15000}return\s+\$\w{1,60};\s*\}\s*(?:\?>|\Z)(?<X1120121>)|(\$\{['"]GLOBALS['"]\}\[[^\]]+\])=[^\(]{9,99}\bArray\((?:['"](?:str_rot13|pack|strrev)['"],?){2,3}\);\s*function[^%&\?]{99,300}return\h+isset\(\$_[GPRSC]\w{2,6}\[[\$\{]+['"][^%&@\*]{99,999}\bif\(isset\(\$\{\72\}\)\)\s*\{\s*eval\(\$\{\72\}\);\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\?>|\Z)(?<X1151340>)|(\$GLOBALS\[)['"](?:pass|password|psw|pwd)['"]\]\s*=\s*['"][^'"]*['"];\s*\74[^\]]+\]\s*=\s*array\s*\((?:['"](?:explorer|terminal|eval)['"]\s*,?\s*){3}\);[^;]+;\s*\74['"]title['"]\]\s*=\s*['"]nu[l1]{2}[5s]['"];\s*@?ob_start\(\);\s*@?set_time_limit\((?:0|NULL)\);(?<X2065430>)|(\$GLOBALS\[['"][^'"]{1,40}['"]\])=Array\(base64_decode\([^`]{20000,25000}false;\}if\(!empty\((\$\w{1,40})\)\)\{if\(\76\[\d+\]\(\$\w{1,40},\77\)\)\{(\$\w{1,40})=false;\}\}return\s+\78;\}\s*(?:\?>|\Z)(?<X1056610>)|(file_)put(_contents)\h*\(['"][\./]+wp\-[^'"]{2,30}['"]\h*,\h*\80get\81\h*\(['"]https?://[^/]{2,30}/\w{1,20}\.php['"]\)\);\s*(?:exit|die)[^;]{0,15};\s*\?>(?<X1172840>)|(goto)\h+\w{1,20};\s*\w{1,20}:\s*if\h*\(\h*!?isset\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\)\)\s*\{\s*[^\}]{0,20}\}[^\('"]{0,50}\b(?:create_function|eval\h*\(base64_decode)\((?:null\h*,\h*)?\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s;]+[^\?>]{0,30}\83\h+(\w{1,9});\s*\84:\h+\w{1,9}:\s*(?:\Z|\?>)(?<X1169460>)|(goto)\h+\w{1,9};\h*\w{1,9}:\s*(\$\w{1,20})\h*=[^/\?%]{99,400}\b\86\h+(\w{1,9});\h*\88:\h*register_shutdown_function\h*\(\87\h*\(['"]{2}\h*,\h*\$\w{1,20}\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\](?:\)\s*){3};\s*(?:\?>|\Z)(?<X1157810>))
\A\s*<\?php\s+(?:@?eval\s*\((?:['"]\?>['"]\s*\.\s*base64_decode\s*\(['"][^'"]{99,500}(?:VXBsb2FkZXIgYnkgeFMxbGVuYzNk|cGxvYWRlciBieSB4UzFsZW5jM2Q|IFVwbG9hZGVyIGJ5IHhTMWxlbmMzZA)[^'"]{99,1600}['"]\)\s*\);?\s*(?:\?>|\Z)(?<X1062380>)|\s*(?:(?:['"][\?>]{0,2}['"]\s*\.\s*)?base64_decode\s*\(\s*['"][^'"]{1,40}(?:KCdibG9jay5wa|J2Jsb2NrLnBo|YmxvY2sucGhw|ImJsb2NrLnBocA)(?<X2059751>)|['"]\?>['"]\s*\.\s*base64_decode\s*\(\s*['"]PD9waHANCmhlYWRlcignTG9jYXRpb246IHRva2Vu[^'"]{999,1999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058210>)|base64_decode\s*\((?:['"](?:ZXJyb3JfcmVwb3J0aW5n|IGVycm9yX3JlcG9ydGluZw)[^'"]{1,20}(?:JHsiRw|OyAkeyJ(?:H|ceDQ3)|ICR7I(?:kc|lx4ND))[^'"]{99,500}(?:QGV2YWwo|ZXZhbC|QGV2YW)[^'"]{99,1500}(?:ZXhpdD|IGV4aXQ7)[^'"]+['"]\)\s*\);?\s*(?:\?>|\Z)(?<X1061700>)|\s*['"][^\)]{1,9}(?:aHR0c|dHRw)[^\)]{1,50}(?:YXJyYXko|cnJheSg)[^\)]{99,200}(?:O3Blcmw|cGVybA)[^\)]{99,500}(?:LnR4d|IC50eHQ)[^\)]{40,150}(?:c2hlbGxfZXhlYy|aGVsbF9leGVjK)[^'"]{20,99}['"]\)\s*\);?\s*(?:\Z|\?>)(?<X1060711>))))|@?preg_replace\s*\(\s*.?['"](.).{0,40}\6(?:['"]\s*\.\s*['"])?e\w?.?['"]\s*,[^\),]+\)\s*\)\s*\)\s*;[^\;]{0,40};\s*(?:\?>|\Z)(?<X1058621>)|@?unlink\h*\(['"][^\.]{2,30}\.php['"]\);\s*(?:require|include)\h*\(['"]wp\-blog\-header\.php["'"]\);\s*(\$\w{1,20})\h*=[^\{]{9,150}\{\s*wp_set_current_user\h*\([^,]{0,40},\h*\8\);[^\}/]{2,40}\bdo_action\h*\([^\)]+\);\s*\}\s*header\h*\(['"]Location:\h*/wp\-admin['"]\);\s*(?:\?>|\Z)(?<X1174730>)|@['"]\$\s*\w{1,9}\s*=\s*[^;]+['"];\s*(\$\w{1,20})\s*=\s*explode\([^\)]+\);\s*foreach\s*\(\10\s+as(\$\w{1,20})\s*=>\s*(\$\w{1,20})\)\s*\{\s*\12[^\)]+\);\s*\10\[\11\]\s*=\s*implode\(['"][^'"]*['"],array_reverse\(\12[^%]{5000,}function\s+(\w{1,9}\(\))\s*\{[^%]+\}\13;(?<X1064951>)|@error_reporting\(0\);\s*@set_time_limit\(0\);\s*(\$\w{1,20})\s*=\s*\$_[^;]+;\s*(\$\w{1,20})\s*=\s*\$_[^;]+;\s*if\s*\(isset\s*\(\15\)\)\s*\{\s*@?eval\s*\((?:gzinflate|gzuncompress)\s*\(base64_decode\s*\([^\}]+\}\s*elseif\s*\(isset\s*\(\16\)\)\s*\{[^\?]{300,1500}\)\)\);\s*\}\s*(?:\Z|\?>)(?<X1062330>)|[/\*\s]+@\s*PHP\s*Web\s*shell(?<X2060060>)|[/\*\s]{2,9}Plugin\h+name:\h*(\w{1,40})[/\*\s]{2,9}[^//\.\{]{1,50}\{\s*echo\h+['"]\19['"];\s*\$\w{1,20}\h*=\h*getcwd\(\)\.(?<X2152840>)|[/\*]{1,4}\s*PAKISTAN\s+CYBER\s+ATTACKER(?<X2060472>)|[^,]{1,600}\$\w{1,40}\s*=\s*tempnam\(sys_get_temp_dir\(\),\s*['"][^'"]*['"]\);\s*switch\(\$\w{1,40}\)\s*\{\s*case\s+['"]\w{1,40}['"]:[^,]{1,40},\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\)\)\)(?<X2064041>)|[^\$\(;]{0,69}error_reporting\(0\);[^\(]{1,40}\s*if\s*\(\s*isset\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\][\s\)]+\{[^\}]{1,600}if\s*\(\s*@?move_uploaded_file\(\$_FILES\[[^\-]{250,500}<form\s+[^\>]+method\s*=\s*\\?['"]POST\\?['"][^/]+/form>['"];\s*\}\s*(?:\?>|\Z)(?<X1118870>)|[^\$]{1,200}\s*(\$\w{1,9}(?:code|payload|evi?l))\s*=\s*['"][^'"]{30000,60000}['"]\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}(?:\s*\()?\s*\24(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057761>)|[^\$]{1,400}(\$\w{1,40})\s*=\s*['"]https?://[^'"]{1,99}['"];[^\?]{1,999}(\$\w{1,40})\s*=\s*http_build_query\s*\(\s*array\s*\([^\?]{1,400}file_get_contents\s*\(\s*\26\s*\.\s*["']\?["']\s*\.\s*\27\s*,\s*false\);\s*\}\s*(?:\?>)?\s*\Z(?<X1062561>)|[^\$]{1,400}\$\w{1,40}\s*=\s*['"]b374k['"];\s*/[/\*]\s*shell(?<X2062131>)|[^\$]{1,600}\$\w{0,9}(?:pw|pwd|pass|password)\s*=\s*['"]\w{20,40}['"]\s*;\s*@?eval\(\s*['"]\?>['"]\s*\.\s*gzinflate\s*\(\s*base64_decode\s*\(['"][^'"]{9999,}['"]\s*\)\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1060541>)|[^\$]{9,200}Act-Shell\s+V\.(?<X2060392>)|[^\?]{1,400}@system\(['"][^'"]{0,40}wget\s+https?://\d+\.\d+\.\d+\.\d+/\w{1,40}\s+-O\s*(\w{1,40});[^\.]{1,40}\./\32\s*>\s*/dev/null[^;]{0,40}\Z(?<X2056500>)|\$(?:password|pass|passwd|pwd|pasMarion\d{0,3})\s*=\s*['"][^'"]*['"]\s*\?>\s*<\?php[^\$]{1,40}(\$\w{1,20})\s*=\s*['"][^'"]{99,400}['"];\s*@?eval\s*\(gz(?:inflate|uncompress)\s*\(base64_decode\s*\(\34\)\s*\)\s*\);\s*\?>(?<X1121410>)|\$(?:pass|password|pwd|ps|pw)\s*=\s*['"][^'"]{1,40}['"];\s*@?session_start\(\);\s*\?>\s*<!DOCTYPE[^\+]{900,999}<\?php\s*if\s*\(\s*!empty\s*\(\s*\$_FILES\s*\[[^,]{99,300}@?move_uploaded_file\(\$_FILES\[[^\?]{850,900}echo\s*\(?['"]</table>['"]\)?;\s*(?:\?>|\Z)(?<X1118210>)|\$(?:username|user)\s*=\s*\$_POST\[['"](?:username|user)['"]\];\s*(?:\$(?:password|pass)\s*=\s*\$_POST\[['"](?:password|pass)['"]\];\s*)?\?>\s*<!DOCTYPE\s+html>[^?]{99,700}<title>\s*(?:(?:Scotia|RBS|HSBC|Tangrine|CitiUnion)\s*(?:Online|Net|Internet|Mobile)?\s*Bank)(?<X2063020>)|\$(?:username|user|login)\s*=\s*\$_POST\[['"](?:username|user)['"]\];\s*(?:\$(?:password|pass|pwd|pw)\s*=\s*\$_POST\[['"](?:password|pass)['"]\];\s*)?\?>\s*<!DOCTYPE\s+html>[^?]{99,700}<title>\s*(?:(?:Answer\s+)?Your\s+(?:Security|Secret)\s+Questions|(?:Online|Net|Internet)\s+Banking)(?<X2063012>)|\$\S{1,40}\s*=\s*['"][^'"]{1,40}['"];[^\$]{1,40}function\s+(\w{1,40})\s*\(\s*(\$\w{1,40})\s*\)\s*\{\s*\40\s*=\s*gzinflate\s*\(\s*base64_decode\s*\(\s*\40\s*\)\s*\);\s*for\([^\}]+\}\s*return\s+\40;\s*\}\s*@?eval\s*\(\s*\39\s*\(\s*['"][^'"]{999,65000}['"](?:\s*\)\s*)+;\s*(?:\?>|\Z)(?<X1065100>)|\$\w{1,20}\h*=\h*['"](?:[^@'";]{2,20}@(?:gmail|protonmail|yandex)\.\w{2,6}['"];\s*\$\w{1,20}\h*=\h*(\$_POST\[)['"](?:email|u(?:ser)?(?:name)?|login)['"]\];\s*\$\w{1,20}\h*=\h*\42['"](?:password|pass|pwd|passwd)['"]\];(?<X2155891>)|\w{32}['"];\s*(\$(?:b374k|c99|r57|wso))\h*=\h*@?create_function\h*\([^,]+,['"]['"eval\.]{5,15}\([gzinflate\.'"]{10,25}\(['"\.base64_dco]{14,25}\([^\)]+\)\)\);\s*['"]\);\s*@?\44\h*\(['"][^'"]{9999,}['"]\);\s*(?:\?>)?\Z(?<X2185080>))|\$\w{1,20}\h*=\h*(?:\$_SERVER\[['"]HTTP_USER_AGENT['"]\];[^\{]{9,150}\{\s*(\$\w{1,20})\h*=\h*['"]\w{32}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\(['"]http://adrotate\.[^\)]+\)\.\46;\s*echo\(['"]<iframe\h+src=['"]\.\47\.[^\)]+\);\s*\}\s*(?:\?>|\Z)(?<X1151380>)|array\(\s*(?:['"]/[^'"]+['"]\h*=>\h*['"][\h\w\-\+]{0,30}(?:cialis|viagra|levitra|kamagra|priligy|propecia|lasix|amoxil|clomid)[\h\w\-\+]{0,30}['"],\s*){9}[^\)\};]{999,9999}\);(?<X2146321>))|\$\w{1,20}\s*=\s*(?:["'][^'"]+['"];\s*if\s*\(isset\s*\((\$_[GPRSC]\w{2,6}\[\$\w{1,20}\]\))\s*\)\s*\{\s*\$\w{1,20}\s*=\s*str_rot13\s*\(\50;\s*(\$\w{1,20})\s*=\s*['"]['"];[^:]{9,99}str_split\(@?file_get_contents\(["']php://input['"]\)[^\}]{9,99}\}\s*@?eval\(\51\);\s*\}(?<X1130250>)|['"][^'"]*['"];[^%]{99,200}\$[0o_]{1,20}\s*=\s*urldecode\s*\([^\)]+\);\s*\$[0o_]{1,20}[^\:]{3000,13000}\{\s*return\s+trim\(preg_replace\(['"][^'"]*['"]\.addcslashes\s*\([^#]{20000,};\s*unset\([^\)]+\);\s*(?:exit|die)[^;]{0,9};\s*\}['"]\);\s*\$\{[^\}]+\}\[[^\]]+\]\(\);\s*\?>(?<X1123300>)|['"][^'"]{0,40}['"];\s*(\$\w{1,20})\s*=\s*array\([^=]{1,99}\);\s*(\$\w{1,20})\s*=\s*create_function\s*\([^\[]{0,9}(?:\54\[[^\]]+\]\.){20}[^\)]{1,65000}\);\s*\55\(['"][^'"]{999,13000}['"]\);\s*(?:\Z|\?>)(?<X1121431>)|['"]http://\w{1,20}\.touchpadz\.com/[^'"]{9,70}['"];[^\{]{9,150}\{\s*if\s*\(\s*function_exists\s*\(['"]fsockopen['"]\)\)[^%]{99,999}flush\(\);\s*@?eval\s*\(\s*urldecode\s*\(\$\w{1,20}\)\s*\);\s*\}\s*(?:exit|die)[^;]{0,9};\s*(?:\Z|\?>)(?<X1124000>)|\$_(?:G|P|R|S|C)\w{2,6}\[[^\]]+\];[^\{]{9,40}\{\s*(\$\w{1,20})\s*=\s*['"][^'"]*['"];\s*(\$\w{1,20})\s*=\s*\58\s*\.\s*basename\((\$_FILES\[[^\]]+\]\[[^\]]+\])\);\s*if\s*\(isset\(\60\)\)\s*\{\s*if\s*\(\s*@?move_uploaded_file\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\]\s*,\s*\59(?<X2118690>)|array\((?:['"][^'"]{9,30}['"]\s*,\s*){40}[^\)]{999,19000}['"]\);\s*@?(?:eval|system|assert|popen|exex|shell_exec)\(['"](?:e|\\x65)(?:v|\\x76)(?:a|\\x61)(?:l|\\x6C)(?:\(|\\x28)(?:g|\\x67)(?:z|\\x7A)[^"']{99,200}['"]\);\s*\?>(?<X1122001>)|getcwd\(\);[^\(]{1,50}(\$\w{1,20})\s*=\s*@?file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*(\$\w{1,20})\s*=\s*@?fopen\s*\([^\)]+\);\s*@?fwrite\s*\(\64\s*,\s*['"]?\63['"]?\);\s*(?:\Z|\?>)(?<X1118330>)))
\A\s*<\?php\s+(?:\$\w{1,40}\h*=\h*getenv\h*\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,40}\h*=\h*date\h*\([^\)']+\);(?:\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];){2}(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{9,199}['"];\s*){3}@?mail\h*\((?:\$\w{1,40},?){3,}\);\s*@?header\h*\(['"]Location:[^'"]+['"]\);\s*\?>\s*\Z(?<X2157341>)|\$\w{1,40}\s*=\s*['"](?:[^'"]{1,40}['"];\s*(\$\w{1,40})\s*=\s*dirname\(__FILE__\)[^;]{1,40};\s*\$\w{1,40}\s*=\s*time\(\);\s*\$\w{1,40}\s*=\s*file_exists\(\2\);[^@]{1,600}@fopen\(\2,[^\?]{999,5000}header\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\.\s*\$\w{1,40}\s*\)\s*;\s*(?:\?>|\Z)(?<X1063850>)|\w{32}['"];\s*\$\w{1,40}\s*=\s*array\([^\[]{40,99}\);\s*(\$\w{1,40})\s*=\s*create_function\([^\)]+\);\s*\4\(['"][^'"]{999,}['"]\);\s*\?>(?:\s*<\?php\s*/\*[^\*]{0,40}\*/\s*@?eval\(gz(?:inflate|uncompress)\(base64_decode\(['"][^'"]{999,5000}['"]\)\)\);)?\s*(?:\?>|\Z)(?<X1118683>))|\$\w{1,40}\s*=\s*(?:\d+;\s*function\s*(\w{1,40})\s*\(\$\w{1,40},\s*\$\w{1,40}\)\s*\{\s*\$\w{1,40}\s*=\s*['"]['"];[^\n]{999,4000};echo/\*[^\*]{1,99}\*/\(\6\(\$\w{1,40}\s*,\s*\$\w{1,40}\)\)\s*;\s*\?>(?<X2051051>)|array(?:\(['"]eN[^\);=]{999,9999}=?=?['"]\);(?:\s*\$\w{1,40}\s*=\s*array\s*\((?:['"\s,base64_dco]{20,60}|['"\s,gzuncompres]{20,60})\)\s*;){2}\s*(\$\w{1,40})\s*=[^\?]{99,499}eval\s*\([^;]{0,40}\8\b[^;]{0,40};\s*(?:\?>|\Z)(?<X1133661>)|\s*\((?:(?:["'][^'"]+['"],){39,}['"][^'"]+['"]\);\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\10e\w?.?['"]\s*,\s*['"](?:\\x\w{2,3}){2,39}[^'"]{2,400}['"]\s*,\s*['"]\.['"]\);?\s*(?:\?>|\Z)(?<X1062013>)|[^\)]+\)\s*;[^/]{99,300}if\s*\(\$isbot\)\s*\{\s*(\$\w{1,9})\s*=\s*curl_init\(\);[^\}]{99,999}(\$\w{1,20})\s*=\s*curl_exec\s*\(\12\);\s*(?:echo|print)\s+['"]?\13['"]?;\s*\}\s*@?eval\s*\(['"][^\)]{999,6000}['"]\)\s*;\s*(?:\Z|\?>)(?<X1065211>)|\s*(?:['"][^'"]{20,80}['"],){39}[^\)]{9,9999}\);\s*@?eval\s*\(\s*['"]\\x65\\x76(?:\\x61|\\x69)\\x6C[^'"]{99,999}(?:\\x29){4}\\x3B['"]\s*\)\s*;\s*(?:\?>|\Z)(?<X1058072>)))|dirname\(__FILE__\);[^<]{1,299}(fclose)\s*\(\$\w{1,40}\);\s*(\$\w{1,40})\s*=\s*<<<\s*['"]EOS['"]\s*<\?[^\?]+\?>\s*EOS;[^\$]{1,299}\s*(\$\w{1,40})\s*=\s*fopen\([^\.]{1,40}\.\s*['"]/?index\.php['"]\s*,[^,]+fwrite\(\18,\17\s*\.\s*\$\w{1,40}\s*\);\s*\}\s*\16\s*\(\18\);\s*\?>(?<X1060930>))|\$\{['"](?:\\x47|G)[^\}]{7,18}['"]\}\[[^\]]+\][^//]{99,1500}(?:h|\\x68)(?:t|\\x74){2}(?:p|\\x70)(?:s|\\x73)?://[^\*]{999,3500}['"]\.urlencode\((@php_uname\(\))\)\.[^\(]{9,90}\.substr\(\20[^#]{2000,20000};return\s*\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\s*\}\s*;\s*\}\s*(?:\?>|\Z)(?<X1121820>)|\$\{['"](?:G|\\x47)(?:[^\?]{2500,3500}\$twigboi[^%]{12000,15000}://['"]\.\$\{\$\w{1,40}\}\[\d+\]\.\$\{\$\{['"](?:G|\\x47)[^'"]{1,28}['"]\}\[['"][^'"]{1,40}['"]\]\};echo\$\{\$\w{1,40}\}\.['"][^'"]{1,40}['"];\}\}\s*(?:\?>|\Z)(?<X1060970>)|[^\?]{2500,5500}\?\)[^\?]{500,1999};\}\}\}\}(GetDomains)\(scandir\(\$[^!]{200,999}\23\(\$\{\$\{['"](?:G|\\x47)[^'"]{6,28}['"]\}\[[^\]]+\]\},\$\{\$\{['"](?:G|\\x47)[^'"]{6,28}['"]\}\[[^\]]+\]\}\[\d+\],\$\{\$\w{1,40}\}\[\d+\],\$\{\$\w{1,40}\}\);\}\s*(?:\?>|\Z)(?<X1060980>))|\$admin\[['"](?:password|pass|pwd|passwd)['"]\]\s*=\s*['"][^'"]*['"];\s*\$notice\s*=\s*['"]<FONT\s+color[^\(]{1,99}@?eval\(gzinflate\(base64_decode\(['"][^'"]{9000,40000}['"]\)\)\);\s*(?:\?>|\Z)(?<X1119710>)|\$auth_pass=['"]\w{32}['"];\s*if\(!(function)_exists\(['"](\w{1,20})['"]\)\)\{\26\h+\27\(\$(?<X2152960>)|\$GLOBALS\[(?:[^\]]+\]\s*=\s*(?:(Array)\s*\(\s*(?:base64_decode\s*\([^\)]+\)\s*,?\s*){4,9}\);\s*(?:\?>\s*<\?(?:php)?\s+)?function\s*(\w{1,32})\(\s*\$\w{1,32}\s*\)\s*\{\s*\$\w{1,32}\s*=\s*\29\([^%]{99,1300}\{\s*(\$\w{1,9})\s*=\s*\$_[^;]+;echo\s+\30\(\d+\)\s*\.\s*\31\s*\.\s*\30\(\d+\);\s*\}\s*\?>(?<X1064911>)|Array\((?:(base64_decode)\s*\([^\)]+\)\s*,\s*){9,50}\33\([^\)]+\)\);\s*function\s+_\w{1,20}\((\$\w)\)\s*\{\s*(\$\w)\s*=\s*Array\([^\)]+\);\s*return\s+\33\(\35\[\34\]\);[^:]{99,1500}eval\s*\(\s*\33[^\?]{99,1500}\$GLOBALS\[[^\)]{1,40}\);\s*(?:echo|print)[^;]+;\s*\?>(?<X1062691>))|[^`]{2200,2700}\}\}(\$\w{1,40})\s*=\s*['"\s\.creat_funio]{21,60}\s*;\s*(\$\w{1,40})\s*=\s*\37\([^;]{40,100};['"]\);\38\(['"][^\?]{60000,}['"]\);\?>(?<X1056510>))|\$ip\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];\s*(\$\w{1,40})\s*=\s*json_decode\(file_get_contents\([^\)]+\)+;\s*\$(negara|country)\s*=\s*\40(->country)_code;\s*\$nam[ae]_\41\s*=\s*\40\42;\s*\$[ck]ode_\41\s*=\s*strtolower\(\$\41\);(?:\s*\?>)?\s*\Z(?<X2120490>)|\$shellname[\h=]+["'][^'";]{1,15}\bshell['"];[^\\%!\*]{99,2500}\$\w{1,20}[\h=]+@?(?:\w{1,20}|\$[^\(]{1,20})\(['"]/etc/named\.conf['"](?<X2193681>)|\/\*[^\$//]{0,20}\b(?:shell|backdoor)[^\-\/]{2,20}\bprivate\-node\.\w{2,6}\b(?<X2179940>)|\{@?(?:eval|assert|shell_exec|exec|popen|system|passthru)\(\$\{\$\w{1,9}\}\[['"]\w{1,15}['"]\]\);\}\s*\?>(?<X1133711>)|call_user_func\s*\(\s*create_function\s*\(\s*['"]['"],\s*['"][^'"]{30000,40000}["'](?:\s*\)\s*){1,3};\s*['"](?:\s*\)\s*){1,3};\s*(?:\?>|\Z)(?<X2055861>)|class(?:\h+WPBrute\s*\{[^\}]{9,150}\}\s*function\h+brute\((?<X2152930>)|\s+(\w{1,9})\s*\{\s*var\s*\$\w{1,9};\s*function[^#]{9999,15000}\49::(\w{1,9})\(\$\w{1,9},\49::\50\(\)\);@mkdir\(\$\w{1,9}\);\s*\}\};\s*\};[^\=]+(\$\w{1,9}).=mysql_query\(\51.\);\s*if\(quotemeta\([^;]{1,60};\s*define\(['"]DEBUG_MODE['"],false\);\s*session_write_close\(\);\}\s*\}\s*(?:\?>|\Z)(?<X1061714>)|\s+SAPE_base\s*\{[^`]{23000,25000}\bwp_\w{1,9}\(\)\s*\{\s*@?error_reporting\(0\);\s*function\s+(\w{1,40})\([^\)]{1,40}\)\s*\{[^\}]{1,99}\}[^%]{999,5000}\53\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],\s*['"](?:google|yandex)['"]\);[^&]+sape\s*=\s*new\s*SAPE_client\([^\}]+(?:\}\s*){2,5}\?>(?<X1064672>))|define\(['"][^'"]+['"],\s+isset\(\$_REQUEST\[(['"]DEBUG['"])\]\)\s*\?\s*\$_REQUEST\[\55\]\s*:[^%]{9999,12000}%\[\[:\w{1,40}:\]\]\{\d+\}[^`]+,\s*500\);\s+\}\s*ob_end_flush\(\);\s*session_write_close\(\);\s*exit\(\);\s*(?:\?>|\Z)(?<X1061021>)|echo(?:[^;]{1,99}(?:php_uname|getcwd)\(\)[^/]{1,99}\s*<form\s+method\s*=\s*['"]post['"][^;]{99,999}['"];\s*if\s*\(\s*!\s*empty\s*\(\s*\$_FILES\s*\[[^\]]+\][\s\)]+\{\s*@?move_uploaded_file\s*\(\s*\$_FILES\s*\[[^\]]+\](?<X2122040>)|\b[^i]{1,40}IndoXploit\b(?<X2121050>)|\h+['"][^'"]+['"];\s*(\$\w{1,20})\h*=\h*['"]\w{1,20}\.txt['"];[^\(]{9,99}\bif\h*\(!?file_exists\(\59\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(fopen)\(\59,[^\?]{99,999}\b\61\h*\(\59,[^\)]+\);\s*fwrite\(\60,[^\)]+\);\s*fclose\(\60\);\s*@?(?:eval|system|passthru)\(\$_[^\?]{9,150};\s*\}\s*(?:\Z|\?>)(?<X1144530>)|\s*['"]\s*Priv8\s+Home\s+Root\s+Uploader.{500,1000}echo\s*['"]gagal\s+upload['"];\s*}\s*\}\s*\}\s*\?>(?<X1041650>)|\s*base64_decode\([^\)]+\);\s*(?:(\$\w{1,9})\h*=\h*(?:chr\(\d+\)\.?){5}[^;]{2,400};){1,6}\$\w{1,9}\h*=\h*\64\.\$\w{1,9}\(\$_REQUEST\[[^\]]+\]\);\s*@?(array)_diff_ukey\((@?\65\(\([^\)]+\)\()(\$\w{1,9})\)[^\)]+\),\s*\66[^;]+;\s*@?include(?:_once)?\(\67\);\s*@?unlink\(\67\);\s*(?:\?>|\Z)(?<X1061313>)|\s+(base64_decode)\s*\([^\)]{1,40}\);\s*(\$\w{1,40})\s*=\s*\69\s*\(['"][^'"]+['"]\);\s*(\$\w{1,40})\s*=\s*@?fopen\s*\(['"][^\.]+\.php?[2-6]?(?:t|tml)?['"],\s*['"]w\+['"]\);\s*@?fputs\s*\(\71,\s*\70\);\s*@?fclose\s*\(\71\);\s*@?unlink\s*\(__FILE__\);?\s*(?:\?>|\Z)(?<X1061572>)|\s+base64_decode(?:\(['"](?:[^'"]{1,99}['"]\)\s*;(?:\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(\s*str_rot13\s*\(\s*base64_decode\s*\(\s*['"][^'"]{9,999}['"]\s*\)\s*\)\s*\)\s*\)\s*;\s*echo\s+base64_decode\(['"][^'"]{9,999}['"]\)\s*;){3,9}\s*(?:\?>|\Z)(?<X1062870>)|PD9waHAgJ[^'"]{499,700}(?:PSI7IGV2YWwoYmFzZTY0X2RlY29kZSg|IjsgZXZhbChiYXNlNjRfZGVjb2RlKC|OyBldmFsKGJhc2U2NF9kZWNvZGUoJ)[^'"]{1,60}['"]\);\s*exit\b[^;]{0,9};\s*(?:\?>\s+)?\Z(?<X2127031>))|\s*\(['"][^'"]{1,40}['"]\);\s*@include(?:_once)?\s*\(\s*['"]https?:\/\/[^\)]+['"]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059011>))))
\A\s*<\?php\s+(?:Error_Reporting(?:\((?:(?:0|false)\);\s*\$\w{1,40}\s*=\s*['"][^'"]{9999,15000}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\1(?:e|\\x65|\\145)\w?.?['"]\s*,\s*['"][^,]+,[^\)]+\);\s*return[^\;]*\;\s*(?:\?>|\Z)(?<X1057360>)|0\);[^{]{9,150}\{\s*(\$\w{1,40})\s*=\s*curl_init\(\);\s*(?:(?:curl_setopt)\s*\(\3[^;]+;\s*){3}curl_exec\s*\(\3\);[^%]{600,3000}unlink\s*\(\s*basename\s*\(\s*\$_SERVER\[[^\]]+\]\)\s*\);\s*(?:\Z|\?>)(?<X1061091>)|0\);\h*\$\w{1,40}\h*=\h*(?:chr\h*\(\d+\)\h*\.\h*)+chr\h*\(\d+\);\s*\h*\$\w{1,40}\h*=\h*\$\w{1,40}\h*\(['"](?:edoced_46esab|etalfnizg|ecalper_rts)['"]\)[^!\[]{9999,30000}(\$\w{1,40})\h*=\h*ob_get_clean\(\);\h*@?eval\(\w{1,40}\(\5\)\);\s*\?>(?<X1138380>)|0\);\s*set_time_limit\(0\);\s*@?ini_set\('memory_limit',\s*'\d+M'\);\s*if\s*\([^\)]{1,20}\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\s*,\s*'\w+'\)\)\s*\{\s*header\(['"]HTTP/1\.1 301 Moved Permanently['"]\);\s*exit\(?\)?;\s*\}[^%]+\}\s*/\*\s+@hash:\s+\w{16,40}\s+-\s+\w{1,9}\s+\*/\s*\Z(?<X2058400>)|[^\)]+\);[^\$]+(\$\w{1,40})\s*=[^\}]+;function\s+(\w{1,40})\((\$\w{1,20}),\s*(\$\w{1,20}),\s*(\$\w{1,20})\)\s*\{return\s+\10\.\11\.\12;\s*\}\s*(?:\$\w{1,40}\s*=\s*\9\((?:\8\[\d+\],?\s*){1,}\);){3,7}[^%]+@?file_put_contents\((\$\w{1,40}),\10[^?]+\}\s*unlink\(\13\);\s*exit;\s*\}\s*\?>(?<X1061580>))|\h*\((?:0|null|false)\);\s*(\$\w{1,20})\h*=\h*['"]['"\.asert]{7,20}['"];\s*\$(\w{1,20})\h*=\h*\15\h*\(strrev\h*\(['"];\)\)\)['"][^'"]{9999,}['"]\(edoced_46esab\h*\(etalfnizg\h*\(lave["']\)\);\s*\$\{['"]\16['"]\};\s*(?:\?>)?\Z(?<X2180600>)|\s*\((?:0|NULL)\);\s*(\$\w{1,20})\s*=\s*(curl_)init\(\);[^:]{9,99}(?:https?://|aHR0c)[^\?]{9,99}(\$\w{1,20})\s*=\s*\19exec\(\18\);\s*@?eval\s*\(\20\);\s*(?:\?>|\Z)(?<X1130900>))|for\s*\((\$\w{1,9})\s*=\d+,(\$\w{1,9})\s*=\s*['"][^a-z0-9]{999,6000}['"],\s*(\$\w{1,9})\s*=\s*['"][^'"]*['"];\s*@?ord\s*\(\23\[\22\]\);\s*\22\+\+\)\s*\{[^\?]{99,700}\}\s*\24\s*=\s*@?decrypt\(\24\s*,\s*\$\w{1,9}\);\s*echo\(\24\);\s*(?:\?>|\Z)(?<X1124141>)|foreach\s*\(explode\(['"]\\x\w{2}['"],['"]\\x[\\xa-f0-9\|]{99,999}['"]\)\s*as\s*\$\w{1,40}\s*=>\s*(\$\w{1,40})\s*\)\s*\{\s*if\s*\(strpos\s*\(strtolower\(\s*\$_SERVER\[[^\]]{17,70}\]\s*\)\s*,\s*\26\s*\)\s*\D{2,3}\s*false\s*\)\s*\$GLOBALS\[['"]\\x[\\xa-f0-9]+['"]\]=1;\s*\}\s*(?:\?>|\Z)(?<X1132590>)|function(?:\h+(\w{1,20})(?:\((\$\w{1,20})\)\s*\{\s*\29\h*=\h*substr\(\29,\(int\)\(hex2bin\([^\[\]]{99,300}\breturn\h+strrev\(gzinflate\((?:\$\w{1,20}|base64_decode)\(\28\([^\;]+\);\s*\}\s*(?:eval\(){15,30}\w{1,20}\(['"][^'"]{999,7000}['"](?:\s*\)){15,30};\s*(?:\?>|\Z)(?<X1174921>)|\h*\((\$\w{1,20})\)\s*\{[^\}]{9,99}\breturn\h+\31;\s*\}\s*(\$\w{1,20})[\h=]+['"][^'"]{99,3000}['"];\s*(\$\w{1,20})[\h=]+['"]\28['"];\s*(\$\w{1,20})[\h=]+\33\h*\([^\)]+\);\s*(\$\w{1,20})[\h=]+\34\h*\(['"]{2},\33\h*\(\32\)\);\s*\35\(\);(?:\s*\?>)?\Z(?<X2191982>))|(?:\s*(\w{1,40})\(\$\w{1,40}\)\{\$\w{1,40}=Array\(['"]Ly4vZQ[=]{0,2}['"],[^\}]{80,150}\}\s*preg_replace\(\37\(\d+\),[^\?]{5000,}\37\(\d+\)\);\s*\?>(?<X1056640>)|\s+(?:generate_?)?random_?number\s*\(\s*\)\s*\{\s*\$\w{1,20}\s*=\s*array\([^\)]+\);[^\}]{9,99}\}[^\?\}\{%\*]{1,2999}header\s*\(['"]Location:\s+(?:sign|log)in\.php\?action=\w{0,9}Login[^;]{1,199}['"]+\s*\)\s*;\s*(?:\?>|\Z)(?<X1132081>)|\s+(\w{1,20})\s*\((\$\w{1,20})\)\s*\{\s*if\s*\(\s*function_exists\s*\(['"](curl_init)['"]\)\)\s*\{\s*\$\w{1,9}\s*=\s*\42\s*\(\41\);[^\[]{99,300}(\$\w{1,9})\s*=\s*\$_(?:G|P|S|R|C)\w{2,6}\[[^\]]+\];\s*if\s*\(\43\)\s*\{\s*print\s*\(\s*\40\s*\(['"]https?://[^\)]+\)\);\s*\}\s*(?:\?>|\Z)(?<X1121222>)|\s+(\w{1,22})\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][^'"]{22,99}['"];\s*(\$\w{1,40})\s*=\s*['"]['"];\s*for\s*\([^\)]{1,40}\$i\++\)\s*\{\s*\47\s*=\s*\47\s*\.\s*\46\[rand\(\d+,\d+\)\];\s*\}\s*return\s*\47;\s*\}\s*header\(['"]location:[^;]{1,99}\45\(\)\s*\);\s*@?session_start\(\);(?<X2123750>)|\s+(\w{1,40})\([^\?]{999,2000}\s*(\$\w{1,40})\s*=\s*\49\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*fopen\(\s*\$\w{1,40}\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*;\s*fwrite\(\s*\51\s*,\s*\50\s*\);[^\?]{1,400}\s*(?:\?>|\Z)(?<X1057070>)|\s+(\w{1,40})\(\s*\$\w{1,40}\s*\)\s*\{\s*(\$\w{1,40})\s*=[^\}]{1,99}\}\s*return\s*\54\s*;\s*\}\s*(\$\w{1,40})\s*=\s*\53\(['"][^'"]{1,99}['"]\);\s*(\$\w{1,40})\s*=\s*\53\(['"][^'"]{1,99}['"]\);\s*@?eval\(\s*(?:\56|\55)\s*\.\s*['"][^'"]{60000,}['"]\s*\.\s(?:\56|\55)\s*\);\s*(?:\?>|\Z)(?<X1056730>)|\s+is_bitch\s*\(([^\)]+)\)\s*\{\s*(\$bitche?s)\s*=\s*array\([^\)]+\);\s*foreach\s*\(\59\s+as\s+(\$\w{1,20})\)\s*\{\s*if\s*\(\s*stripos\s*\(\s*\58,\s*\60\s*\)[^;]+;\s*\}[^\}]{1,20}\}\s*(?:\?>)?\s*\Z(?<X1063071>)))|goto\s+(?:\w{1,40};\s*(\w{1,40}):\s+function\s+(\w{1,40})\([^\?]{9999,65000};\s*\w{1,40}:\s*\$\w{1,40}\s*=\s*isset\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\)\?[^;]+;\s*[^\(=\$]{1,99}goto\s*\62;\s*\w{1,40}:\s*\63\(\);(?<X2131560>)|\w{1,9};\s*\w{1,9}:\s*function\s+\w{1,9}\((\$\w{1,9})\)\s*\{\s*(\$\w{1,9})\s*=\s*array\([^\)]+\);\s*return\s+\66\[\65\];\s*\}[^\?]+@?eval\s*\((\$\w{1,9})\);[^\}]{9,300}@\$_(?:G|P|RC|S)\w{2,4}\[[^\]]+\];\s*\}[^\(]+if\s*\(\s*!isset\(\67\)\)\s*\{[^\}]+\}[^:]+:\s*\w{1,9}:\s*(?:\?>|\Z)(?<X1065141>))|header\([^\)]+\);(?:\s*\$[O0_]{1,40}\s*=\s*[^;]{1,40};\s*){2,7}\$[O0_]{1,40}\s*=\s*urldecode\(['"][^`]{65000,};unset\([^\)]+\);exit\(\);\}['"]\);\$\{['"][^'"]+['"]\}\[['"][^'"]+['"]\]\(\);?\s*\?>(?<X1061201>)|if\(!function_exists\("(\w{1,40})"\)\){function\s\w+\(\$\w+\)\{\$\w+=base64_decode\(\$\w+\);\$\w+=0;\$\w+=0;\$\w+=0;\$\w+=\(ord\(\$\w+\[1\]\)<<8\)\+ord\([^\?]{1500,3000}\?"\.">"\.\$\w+;return\s\$\w+;\}\}\}\}eval\(\70\("QAIAPD9waHAgABEkY29sb3Ig(?<X2057930>)|if\(isset\([^\}]{9,99}\}\s*if\(isset\((\$_[GPRSC]\w{2,6}\[?[^\]]*\]?)\)\)\s*\{\s*(\$\w{1,29})\h*=\h*\72;\s*\([^\{]{9,150}\73\(\)\):\73;\s*\}\s*if\(!isset\(\$_[^\}]{9,60}\}\s*\$\w{1,20}\[\d+\]\h*=\h*['"][^\n]{30000,};[^\?]{99,600}\beval\(trim\((?:base64_decode\()+\$\w{1,9}[\)\s]+;\s*(?:\Z|\?>)(?<X1155810>)|if\h*\((?:!@?([ir](?:nclud|equir)e(?:_once)?)\h*\(?['"][\./]{0,9}(cloak\.php)['"]\)?\h*\)\s*\{?\s*@?\75\h*\(?['"][\./]{0,9}\76['"]\)?;\s*if\h*\(function_exists\h*\(['"](getredir)['"]\)\)\s*\{\s*@?\77\h*\((?<X2168181>)|[^\{]+\)\s*\{\s*(\$\w{1,20})\h*=\h*['"][htps:/\.'"]{8,15}[^;]{9,99}[\.'"]{1,3}(?:jpe?g|bmp|gif|png|ico)['"];\s*\$\w{1,20}\h*=\h*file_get_contents\h*\(\79\);[^\}%\*]{99,400}\b(?:include|require)[^\$]{1,6}(\$\w{1,20})[^;]{1,4};[^@]{0,30}@?unlink\(\80\);(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1170510>)|\h*isset\h*\(\h*(?:(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\]\h*\)\h*\D{2,3}\h*\82\h*\[[^\]]+\]\h*\D{2,3}\h*['"][^'"]*['"]\h*\)\s*\{\h*(\$\w{1,40})\h*\=\h*['"\s\.creat_funio]{16,40};\s*(\$\w{1,40})\h*=\h*\83\s*\([^=]+\84\([^\)]+\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1059922>)|\$_[GPRSC]\w{2,6}\[['"]test_url['"]\]\h*\)\h*\)\s*\{(?<X2138503>))|isset\h*\((?:(\$_[GPRSC]\w{1,20}\[[^\]]+\])\)\)\s*\{\s*\$\w{1,20}\h*=\h*\87;\s*if\h*\((\$\w{1,20})\h*=\h*curl_init\(\)\)\s*\{\s*(curl_)[^&%\{]{20,200}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\89exec\(\88\)\);\s*\89close\(\88\);\s*(?:exit|die)[^;]{0,9};\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1155171>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"][^;"]{9,150}['"];\s*@copy\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\91\[[^\]]+\]\);\s*\}\s*(?:\?>)?\Z(?<X2180100>))))
\A\s*<(?:\?php\s+(?:if\s*\(!(?:function_exists\s*\((?:['"](tmp_\w{1,20})['"]\)\s*\)\s*\{\s*if\s*\(\s*isset\s*(\(\s*\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[['"]\1\d['"]\]\s*\))\s*\)\s*eval\s*\2[^%]{999,2500}@?set_error_handler\s*\(['"]\1\d['"]\)\s*\)[^\w]{2,3}['"]\1\d['"]\)\s*[^;]{9,40};\s*\1\d\(\);\s*(?:\?>|\Z)(?<X1062680>)|[^\)]+\)\)\s*\{\s*function\s+\w{1,20}\s*\([^\)]+\)\s*\{\s*global\s*(\$god_?mode);[^%]{999,2000}if\s*\(\$\w{1,20}\s*\W{1,4}(?:false|true)\)\s*\{\s*(\$\w{1,20})\s*=\s*['"]<script[^>]*>[^>]{99,999}>['"];\s*\4\s*=\s*\5;\s*\}\s*\}\s*\?>(?<X1122190>))|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*echo[^;]{0,33};\s*\}\s*\$\w{1,19}\s*=\s*@?eval\(["'](?:/[^/]{1,40}/)?(\$\w{1,19})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?eval\(base64_decode\(\7\)\);['"]\);(?:(\$\w{1,19})\s*=\s*['"]\w{1,40}['"];\8\([^\;]{1,99};)?\s*(?:\?>)?\s*\Z(?<X2124210>))|if\s*\(\s*(?:!defined\s*\(\s*['"](?:([^'"]{1,40})['"]\s*\)\s*\)\s*\{\s*define\(\s*['"]\10[^@]{99,999}\}function\s*([^\(]{1,40})\(&\$[^=]{1,40}=['"][^'"]*['"]\)\{global[^\?]{999,9999}\.=\11\((\$\11)(?:\)){3,6}['"],['"]\w{16,48}['"]\.\(\12=['"][^'"]{1,999}['"]\)\);\s*return\s+true;\s*\?>\w{16,40}(?<X1059150>)|(ALREADY_RUN_\w{9,33})['"]\s*\)\s*\)\s*\{\s*define\s*\(\s*['"]\14[']\s*,\s*1\s*\);(?<X2061851>))|(?:md5\()?\s*\$_POST\[['"]?\w{1,40}['"]?\]\s*\)?\s*[^\w]{1,2}=\s*['"]\w{1,40}['"]\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_POST\[['"]?\w{1,40}['"]?\];\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\(\s*stripslashes\s*\(\s*\16\s*\)\s*\);\s*\}\s*(?:\?>|\Z)(?<X1054351>)|\!empty\s*\(\$_FILES\)\s*\)\s*\{\s*(\$\w{1,20})\s*=\s*\$_FILES\[[^\]]+\]\[['"]\w{1,9}['"]\];[^:]{9,300}(\$\w{1,40})\s*=\s*str_replace\([^\{]+if\s*\(\s*move_uploaded_file\s*\(\s*\18,\19\)\s*\)\s*\{\s*[echotrulsfa\s;\}\{]{9,40}\}\s*\}\s*(?:\?>|\Z)(?<X1060132>)|\$_(?:P|G|S|C|R)\w{2,6}(?:\s*\[[^\]]+\])?\s*\)\s*\{\s*if\s*\(\s*@?copy\(\s*\$_FILES\s*\[[^\]]+\][^\?%&:\*]{9,300}<form\s*method\s*=\s*['"]?post['"]?[^\?%&:\*]{9,200}echo\b[^;]{1,200};\s*(?:\Z|\?>)(?<X2122271>)|is_(?:file\s*\(\s*(['"]/home/[^/]{1,40}/public_html/[\w\/\-\.\{\$\}\\[\]\(\)]{9,99}['"])\s*\)+\s*\{\s*include_once\s*\(\s*\22\s*\);\s*\}\s*(?:\Z|\?>)(?<X1121092>)|uploaded_file\s*\(\s*(\$_FILES)\s*\[[^\]]{1,40}\]\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\24\s*\[[^\]]{1,40}\]\s*\[[^\]]{1,40}\]\s*,\s*\24\s*\[[^\}]{1,600}\s*\}\s*(?:\?>|\Z)(?<X1059970>))|isset\s*\((?:(\$_(?:GET|POST|REQUEST|COOKIE)\[[^\]]+\]\))\s*&&\s*\(md5\s*\(\26\s*[^\w]{2,3}\s*['"][^\)]+\)[^\{]{9,99}\{\s*(\$\w{1,40})\s*=\s*['".preg_lac]{13,20};\s*(\$\w{1,40})\s*=\s*['"](.)[^,]{0,40}\29e['"];\s*\27\(\28,['".eval]{5,9}\([base64_dco'".]+\([^\}]{1,99}\}\s*(?:\?>|\Z)(?<X1061381>)|\$_POST\[[^\]]+\]\)\s*\)\s*\{[^\{\}<>!]{9,200}if\s*\(\s*isset\s*\(\s*\$_FILES\[['"]\w{1,20}['"]\]\[[^\]]+\]\)\s*\)\s*\{\s*(\$\w{1,20})\s*=\s*\$[^@]{9,50}@?move_uploaded_file\s*\(\$\w{1,20},\s*\31\);[^&]+>\s*<\/form>['"];\s*\}\s*(?:\Z|\?>)(?<X1060073>)|\s*(\$_FILES\[[^\]]{1,40}\])\[[^\]]{1,40}\]\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*getcwd\s*\(\s*\)\s*\.\s*['"][^'"]*['"];\s*(\$\w{1,40})\s*=\s*\34\s*\.\s*basename\s*\(\s*\33\[[^\]]{1,40}\]\);[^\)]{1,99}move_uploaded_file\s*\(\s*\33[^\$]+\35[^\?]{400,600}</form>['"];\s*\?>(?<X1059550>)|\s*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[[^\)]+\)\s*\)\s*\{[^;]{0,40};\s*if\s*\(isset\s*\((\$_(?:GET|POST|REQUEST|COOKIE|SERVER))\[[^\]]+\]\)\s*\)\s*\{\s*file_put_contents\s*\(\37\[[^\]]+\],base64_decode\s*\(\37\[[^\]]+\]\)\s*\);\s*\}(?:die|exit)[^\;]{0,9};\s*\}\s*\?>(?<X1063430>)|\s*\$_(?:GET|POST|SERVER|REQUEST)\[['"]?[^'"]{1,40}['"]?\]\s*\)\s*\)\s*\{\s*[^;]{20,60};\s*(\$\w{1,40})\s*=\s*(\$_SERVER)\[['"]HTTP_HOST['"]\];\s*(\$inj)\s*=\s*\40\[['"]REQUEST_URI['"]\];\s*\$\w{1,40}\s*=\s*rawurldecode\(\39\.\41\);\s*\$\w{1,40}\s*=\s*@?mail\s*\((?<X2056300>))|strtolower\s*\(\s*\$_SERVER\[['"]REQUEST_METHOD['"]\]\)\s*\!=\s*['"]post['"]\s*\)\s*\{[^\}]+\}\s*if\s*\(\s*array_key_exists\s*\((['"]\w{1,40}['"]),(\$_FILES)\)\s*\)\s*\{[^\}]{9,200}move_uploaded_file\s*\(\44\[\43\]\[[^\]]+\],\s*\$\w{1,40}\);\s*\}\s*exit;\s*(?:\Z|\?>)(?<X1060111>))|if\s*\((?:function_exists\(['"](exec|shell_exec|system|passthru)['"]\)\)\s*\{\s*(?:@\46\(['"][^\)]+\);\s*){15}(?<X2120031>)|isset\((\$_(?:G|P|C|S|R)\w{2,6})\[[^\]]+\]\)\)\s*\{\s*if\s*\(\s*\48\[[^\]]+\][^\w]{2,3}[^\}]{1,99}if\s*\(move_uploaded_file\(\$_FILES\[[^\]]+\][^\(]{1,99}if\s*\(\48\[[^\]]+\][^\(]+=\s*fopen\(\48\[[^\]]+\]\s*,\s*['"](?:a|w)\+?['"]\);[^\}]+(?:\s*\}\s*){1,3}else\s*\{[^\}]+\}\s*\?>(?<X1064010>))|include\(['"]\w{1,40}\.php['"]\s*\)\s*\?>\s*<\?php\s+if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*(\$_FILES\[)[^\),]{1,40},\s*\50[^\),]{1,40}\)\s*;\s*\}\s*(?:\?>|\Z)(?<X1059980>)|session_start(?:\(\);(?:[^&]{0,40}if\s*\((isset\s*\(\$_POST\[)['"](?:cc|card)(?:num|card)?['"]\]\)\s*(?:&&\s*\52['"](?:expiry|exp|valid)(?:MM|YY)?['"]\]\)\s*){1,2}&&\s*\52['"](?:cvv|pin)['"]\](?<X2125970>)|[^\$]{0,600}\$\w{1,20}\s*=\s*(pack\(\s*['"][nvchslvq]\*['"]\s*,[^\)]{1,40}\))\s*;\s*(\$GLOBALS)\s*=\s*array\(\s*(['"]\w['"])\s*=>\s*\54\s*,[^\{]{300,600}\s*(\$_SESSION)[^%]{60,200}\%\w['"]\s*,\s*\55\[\56\]\(['"]\w\*['"],\57\[['"]\w['"]\](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1059204>)|\s*/\*\W{9,99}\b(?:priv(?:ate?|8)\h+)?(?:paypal|pp|gaypal)\h+scama?\b(?<X2142871>))|\s*\(['"]login['"]\);\s*(\$\w{1,20})\s*=\s*(\$_POST\[)[^\]]+\];\s*\$(?:login|email|user|username)\s*=\s*\61['"](?:login|email|user|username)['"]\];\s*\$(?:password|passwd|pass|pwd)\s*=\s*\61['"](?:password|passwd|pass|pwd)['"]\][^\{]{9,99}if\s*\(isset\s*\(\60\)\)\s*\{(?<X2123810>))|system\((?:['"]pwd['"]\)[^\(]{1,40}system\(['"]cat\s+/etc/passwd[^\?]{1,600}define\(['"][^'"]{1,40}['"]\s*,\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;(?<X2057061>)|[^\)]{1,99}\)\s*;\s*system\(["']mkdir\s+[^\)]{1,40}/sok['"]\)\s*;\s*system\(["']mkdir\s+[^\)]{1,40}com_jooomlas['"]\)\s*;(?:\s*system\([^\)]{1,99}\)\s*;\s*){1,9}echo\s*\(?\s*['"][^'"]*['"]\s*\)?\s*;\s*(?:\?>|\Z)(?<X1058180>))|system\s*\(\s*['"][^'"]{1,40}['"]\s*\);\s*unlink\s*\(\s*__FILE__\s*\);(?:\s*\?>)?\s*\Z(?<X2120200>))|div(?:\b(?:[^>]{0,499}\b(?:style=['"](?:(?:height|width):\h*0\w{0,2};?\h*){2}['"]|data\-key=['"]\w{32}['"]|class=['"]?coinhive\-miner['"])){3}[^>]{0,499}>\s*(?:<[^>]{1,19}>[^>]{0,99}\bdisable\h+Adblock\W?\s*</[^>]{1,19}>\s*)?</div>(?<X1181070>)|\h+style\h*=\h*['"][^>]+['"]>[^://]{3,99}<a\h+href=['"]https?://(?:nulled\d+\w|iwpnulled)\.com/['"]>[^\-\$\*\(\)\[\]]{99,200}</div>\s*\Z(?<X1180500>)|\s+style=[""](?:[^'"\n]{0,199}\b(?:height|width)[\s:]+[0-3]p[tx];){2}[^>]{0,199}>\h*(?:<a\b[^>]{0,199}\bhref=['"]https?://[^>]+>[^</]{0,99}</a>[\h,\.]{0,19}){2,}</div>(?<X1215450>))|F(?:ilesMatch\s+['"]\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>]{0,199}>\s*Order\s+Allow[,\s]+deny\s*Deny\s+From\s+all\s*</(FilesMatch)>\s*<\69\s*['"]\((?:\^[^\)\|]{1,29}\|){25,}\^[^\)\|]{1,29}\)\$['"]>+\s*Order\s+allow[,\s]+deny\s*Allow\s+from\s+all\s*(?:Deny\s*from\s*66\.249\.79[\d\.\s]*)?</\69>(?<X1233761>)|orm\b(?:[^;\?]{99,499}<\?php\h*(\$\w{1,40})\h*=\h*basename\h*\(\h*(\$_FILES\h*\[)[^;]+;\s*if\h*\(\h*@?[cm]o(?:py|ve_uploaded_file)\h*\(\h*\72[^,]+,\h*\71[\)\s]+\{\s*echo\b[^;]+;\h*\}\s*else\s*\{[^\}]{0,199}\}\s*(?:\?>|\Z)(?<X1178270>)|[^\v\?]{99,199}<\?(?:php)?\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\)]+\)\h*;\h*(?:\?>|\Z)(?<X1147420>)))|head(?:>\s*(<meta)\h+name=['"]description['"][^>]{2,40}>\s*\75\h+http\-equiv=['"]refresh['"]\h+content=['"]0;\h*url=http://\w{2,4}\.[^\.]{3,20}\.su\b[^\$&\*]{9,99}</body>\s*\Z(?<X2183491>)|\b[^>]*>\s*<meta\b(?:[^>]*(?:\bhttp\-equiv=['"]?refresh|content=['"][0-2];\s*url=https?://[^/'"]*dates[^/'"]*\.ru)\b){2}[^>;/]{0,99}/?>\s*</head>\s*\Z(?<X2202090>)))
\A(?:\s*(?:<(?:html>(?:[^:]{0,70}<(script)[^>]*>\s*window\.location\.replace[\h\(]+['"]https?://hello\.turnedpro\.xyz/xxxd\?[^\)]{9,400}['"]\);\s*</\1>[^:]{0,70}</html>\s*\Z(?<X2252150>)|[^\{]{1,99}<script>\s*alert\(['"]Hacked\s+by\b(?<X2137741>)|\s*<!--\s*Mirrored\s+from\s+file\.hackersb\.cn/webshell(?<X2126422>)|\s*<(title)>\s*(?:Webshell|backdoor|hacked|fucked)\h*by\b[^/<]{6,20}</\5>(?<X2152950>)|\s*<(title>)([^<]{0,3}deadcode\d+[^<]{0,3})</\7<center>\s*<h\d*>\8<[^>]+>\s*<\?[ph\s]+[^\{]{99,400}\bif[\(\h]+\$_FILES[\)\h]+[\{\s]+if[\(\h]+!?empty[\(\h]+(\$_FILES\[[^\]]+\])[\h\)]+\{\s*@?[cm](?:ove_uploaded_file|opy)[\(\h]+\9[^\?@]{5,200}(?:\?>)?\s*\Z(?<X2232751>)|\s*<body>\s*<div\s*id\s*=\s*['"]\w{1,40}['"]\s*style\s*=\s*['"]display\s*:\s*none['"]>\s*if\s*\(\s*!\s*window\.done\s*\)\s*\{\s*window\.AddonManager\.getInstallForURL\(\s*['"]https?://[^,]{1,99}\.xpi['"],\s*function\(\s*install\s*\)(?<X2123551>))|php\s*@?(?:include|require)(?:_once)?\s*\(?['"](?:blocke?r?|bots|antibots)\.php['"]\)?;[^:/]{1,99}\s*json_decode\s*\(\s*file_get_contents\s*\(\s*['"]https?://[^;]{1,99};[^\?]{1,99}\?>\s*\<(?:\?php|html)(?<X2118553>)|script(?:[^>]*>\s*parent\.window\.opener\.location\s*=\s*['"]https?://[^>]{20,200}>\s*(?:<meta\h+http-equiv\s*=\s*['"]refresh['"]\h+content\s*=\s*['"]\d+;\s*URL\s*=\s*['"]?https?://[^'"]{9,150}['"]\s*/?>\s*){1,4}(?<X1138061>)|\b[^>]{0,199}>\s*\(\s*(function\s+)\([^<]{1,499}\b\14(globalClick)[\s\(]+\w+[\s\)]+\{\s*((?:const|var)\s+)?\w+[\s\=]+location\.host\s*\16(\w+)[\s=]+['"](?:https?://|[\./]{0,9}ois\.is/images/)[^<]{1,999}\bwindow\.open[\s\(]+\17\b[^\)]{0,199}\);?[\s\}]+document\.addEventListener[\s\(]+['"]\w+['"][,\s]+\15[\s\)]+;[\}\)\s]+\(\);\s*</script>(?<X1215241>)|\h+[^:]{1,40}src\h*=\h*['"]https?://(?:\w{1,5}\.)?sitekodlari\.com/\w{1,40}\.js['"]\h*>\h*</script>(?<X1145872>)|\h+src\h*=\h*['"]http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/js\.js\b[^'"]{0,9}['"]\h*>(?<X1169710>))|title>(?:\h*Wordpress\h*Mass\h*Defacer?\b(?<X2181700>)|\W{2,9}[Dhf](?:efac|ack|uck)ed\h+by\b(?<X2168171>)))|[^\w]?PNG.{3000,6000}?<\?php(?<X2055704>)|\(new\s*Function\(\(function\(s\)\{var\s*d=\{\},a=\(s\+""\)\.split\(""\),cc=a\[0\],o=cc,r=\[cc\],c=256,p;for\(var\s+i=1;i<a\.length;i\+\+\)\{var\s+cd=a\[i\]\.charCodeAt[^%]{200,300}%r\.length\)\)\}\)\.join\(['"]{2}\)\}\)\(atob\("[^"]{20000,}"\),.+"\)\)\)\)\)\)\(\);(?<X2052900>)|\<\?php\s*(?:/[\*/]\s*Moonafic\s*\-\s*(?:Mini|Web)?Shell\b[^\$\?\{=]{1,99}\$\w{1,40}\s*=\s*\[\s*['"]\w{1,40}['"],[^\]]{499,999}\];(?<X2156150>)|if\s*\(\s*isset\s*\(\s*\$\{\s*(\$\w{1,9})\s*\}\s*\[\s*['"](\w{1,9})['"]\s*\]\s*\)\s*\)\s*\{\s*(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*\$\{\s*\26\s*\}\s*\[\s*['"]\27['"]\s*\]\s*\)\s*;\s*\}\s*(?:\Z|\?>)(?<X1127720>)|system\([^\{]{1,}if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{[^\{]{1,}\{\s*(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w{1,9}\s*=\s*(?:eval|system|assert|popen|exec|shell_exec|passthru)\(['"]\29['"]\)[^\{]{9,50}\{\s*echo\s*['"]<form[^\}]{9,150}\}\s*(?:\Z|\?>)(?<X1128472>))|\?>\s*<\?[ph\s]*@?eval[\(\s]+rawurldecode[\(\s]+['"]%20%2[04](?![^/;]{0,19}(?:unlink|foreach))[^'"]{99,}['"][\s\)]+;\s*\?>\s*\Z(?<X2259383>)|\w{0,40}\s*<\?php\s*\$\w{1,40}\s*=\s*getcwd\b[^;]{0,9};\s*if\h*\(\h*isset\h*\(\h*(\$_FILES\[)['"]?(\w{1,40})['"]?\][\s\)]+\{\s*\$\w{1,40}\s*=\s*basename\h*\(\s*\32['"]\w{1,40}['"]\]\[['"]\w{1,40}['"]\][\h\)]+;\s*if\s*\(\h*@?move_uploaded_file[\h\(]+\32['"]?\33['"]?\][^j]{1,300}</form>['"];\s*(?:\?>|\Z)(?<X1053822>)|a:2:{s:4:"data";s:\d+:"a:2:{s:18:"users_can_register";s:1:"1";s:12:"default_role";s:13:"administrator";}";s:8:"checksum";s:32:"[a-z,0-9]{32}";}\s*\Z(?<X2061390>)|eval\(\s*String\.fromCharCode\((?:\d+\s*,\s*){3}[^\)]+\)\s*\)\s*;(?<X1043463>)|function(?:\s*\w+\(\)\{if\((isset)\((\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)+(?:\{\$\w{1,40}=\38[^;]+;\}else(?:if\37)?[^\)]+\)+)+;return\$\w+\[\d+\];\}function\w+\(\$\w+,\$\w+=\d+[^%]{1,2500}(\$\w+)=['"]//server\w+\.\w+\.com[^%]{1,100}[^%]{1,100}(\$\w+)=\w+\(\39[^%]{1,50}die\(\40\);[^;]+;(?<X1224992>)|\s+\w*bank\w*\s*\([^\)]{1,99}\)\s*\{\s*(?:(?:var\s+\w+\s*=[^;]+;\s*){2}\s*if\s*\([^\{]{9,199}\{\s*(?:document\.getElementById\s*\(\s*['"]bank(?:name|login|log|pass)['"]\s*\)\s*\.\s*\w[^;]{9,399};\s*){4,9}[\s\}]{2,9}(?<X2131671>)|if\s*\([^\{]{99,}\{\s*(?:document\.getElementById\s*\(\s*['"]bank(?:name|login|log|pass)['"]\s*\)\s*\.\s*\w[^;]{9,399};\s*){4,9}[\s\}]{2,9}(?<X2131653>)))|GIF(?:8(?:[9786]\w?[^\s]{0,2}\s*[^<]{0,200}\s*<\?(?:php|=)?\s*@?(?:\$\w{1,40}\s*=|\w{1,40}\s*[\('"\[]|\h+\?>)[\x00-\x7F]{3,199}[;\(](?<X20524214>)|\d[^`]{2000,6000}?<\?php(?<X2045903>)|\d\w?[^\s]{0,2}\s*[^\?]{0,80}\s*<\?\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\((?<X2054342>))|[\d\s]+<\?[ph\s]+(\$\w{1,20})[\h=]+(curl_)init[\h\(]+['"]https?://[^'"]{9,99}\.(?:php|txt)['"]\);\s*(\$\w{1,20})[\h=]+fopen[\h\(]+[^\?>]{99,300}\}\s*\48close[\h\(]+\47\);\s*fclose[\h\(]+\49\);\s*(?:\?>)?\s*\Z(?<X2211660>))|IDBTE[4A]M\s*<(?<X2204621>)|Options\s+Indexes\s+FollowSymLinks\s+DirectoryIndex\s+(con7ext\.)html?\s+HeaderName\s+\52txt\s+Satisfy\s+Any\s+IndexOptions\s+IgnoreCase[^=\*\n]{9,199}(?:(?:NameWidth|DescriptionWidth)=\*\s+)+SuppressHTMLPreamble\s+IndexIgnore\s+\*\s*\Z(?<X2223240>)|RewriteEngine(?:\s*On\s*RewriteRule\s*\^\([^\)]+\)\.html\$\s*\w{1,10}\.php\?xxx=\d{1,5}[^\[]+\[L\]\Z(?<X1122940>)|\s+On\s*RewriteBase\s+/\w+\s*RewriteCond %{REQUEST_FILENAME}\s+!-..+?\s*RewriteRule\s*\^\(\.\*\)\s+index\.php\?id=\$1\s*\Z(?<X1042752>))|var(?:\h+(\w{1,20})[\h=]+getUrlVars\(\)\[['"](frommobi)['"]\];\s*if\(\56\)[\s\{]+s(etCookie)\(['"](frommobile)['"],\56\);[\s\}]+var\h+\57[\h=]+g\58\(['"]\59['"]\);\s*if\(\57!=\d+\)[\s\{]+\(function\([^\)]+\)[\s\{]+if\(/android\.[^\{]{400,2500},['"]https?://[^\)]+\);(?<X2150851>)|\s*(\w{1,9})\s*=\s*String\s*;\s*var\s*(\w{1,9})\s*=\s*\61\.fromCharCode\s*\([^\)]{9,99},46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,[^\)]{99,999},41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,[^;]+;\s*eval[\s\(]+/\*\d+\*/\s*\62[\s\)]+;(?<X1230470>)|\s*(_0x\d+)=\[(?:[^,]{0,400}",?){5,30}\];document\[\64[0-9\[\]\(\)_x]+;\s*\Z(?<X1043412>))|X5O.{25}EICAR-STANDARD-ANTIVIRUS-TEST-FILE[^\s]{1,9}\s*\Z(?<X2050572>))|\w+<\?(?:php)?\s*\$\w+=['"]\{['"]\w+['":]+\d+['",]+login['":]+\w+['",]+password['":]+\w+['",]+cookie_name['":]+fm_user\b(?<X2323700>)|\WPNG\b.{3000,6000}<\?php(?<X2290932>)|\W{1}PNG\s+[^?%]+\?php[^\}]+file_put_contents\((?<X2283030>)|a:\d:\{s:\d+:['"]enabled[^/]+//(wpglobalstats\.\w{3,3}\b)/['"][^'"]+['"]postback_url[^/]+.//\70[^\}]{1,299}force_redirect_offer['"];\w:\d:[^\}]{1,99}\}(?<X1255323>)|CgppZighZGVmaW5lZCgnRE9MTFlfV0FZJykpeyBkZWZpbmUoJ0RPTExZX1dBWScsICdXb3JsZCBEb21pbmF0aW9uJyk7fQoKCiRyZWFsX2ZpbGUgPSB0[^=]{9999,}=\Z(?<X2308331>)|dmFyIHNjcmlwdCA9I[^@]{32,499}c2NyaXB0KTs\Z(?<X120364571>)|error_reporting\(0\);define\([^\}]+\}[^\{]+\{return\s*file_get_contents[^:]+:\s*unlink\(\$\w+[^\{]+else\{\}\}[^=]+=curl_init\(\$\w+[^\}]+\}else\{\$\w+=fwrite\(\$\w+,\w+\(\$\w+[^>]+case\$\w+=array\(['"]root['"][^\}]+\}[^\}]+=phpversion\(\);[^<]+echo\s*['"]<script[^>]+\.js['"]>[^;]+;\Z(?<X1312701>)|function\h*(_0x\w+)\(\)[\{\s]+const\h*(_0x\w+)=\[[^\?\\]{0,650}["']devtools(?:change)?['"][^\?\\]{0,2400}['"]sendbeacon['"][^\?\\]{0,2400}\];\75=function\(\)[\{\s]+return\h*\76;\s*\}[^@]{999,}(?:['"](?:c[ard]*num[ber]*|exp[iry]*|cvv|ccv?)['"]:["']?(?:_0x|#)[^\}]+['"]?,?){2,6}[^\?\\]{999,}\(\)[\};\s]+setInterval\([^\)]+\);\s*\}[\(\)]{4};\Z(?<X2231750>)|gif89;\w<\?(?:php)?\s*(?:(?:error_reporting|set_time_limit|session_start)\([^\)]{0,9}\);){3,4}[^@]{99,999}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\78\[\79\]=stripslashes\(\80\);\}(?<X2130880>)|H(?:[a4@]?ck[3e]d!?\s+by\s*\S{1,40}[^\v]*\Z(?<X2228023>)|ttps?://(?:hidupseni\.pages\.dev/?\Z(?<X120359730>)|u\-?short\.\w+/\w+\Z(?<X120360690>)))|JHJlcV91cmkgPS[a-z\d/\+=\s]{4000,}\Z(?<X2277732>))
\A(?:P(?:D9waHAKZXJyb3JfcmVwb3J0aW5nKDApOwpAc2V0X3RpbWVfbGltaXQoMCk7CkBpbmlfc2V0KCdtYXhfZXhlY3V0aW9uX3RpbWUnLCcwJyk7CkBpbmlfc2V0KCdtZW1vcnlfbGltaXQnLCctMScpOwpAaWdub3JlX3VzZXJfYWJvcnQodHJ1ZSk7Ci(?<X220361520>)|HNjcmlwdD52YXIgXzB4[a-z\d/\+=\s]{40000,}\Z(?<X2297970>))|var(?:\h*(_0x\w{1,9})\h*=\h*\[['"]fromCharCode['"],\h*['"]GET['"],\h*['"]open['"][^#]{99,1100}\s*var\s*(\w{1,15})\h*=\h*document\[\3\[[^#]{9,99}\bif\(\4\[\w\]\[\3\[\d{1,3}\]\]\h*\D{2,3}\h*\3\[\d{1,3}\]\)\s*\{(\w)\h*=\h*false\}\};\s*if\(\5\h*\D{2,3}\h*true\)\{\s*\w\(\)\s*\}\s*\}(?<X1166321>)|\s*\w[^!\n\[\}/\\\*\|\?]{1,40}\bwhile\(!!\[[^|\n:\?]{1,999}var\s*\w{1,9}=['"]ht+['"]\+(\w{1,6}\[\w{1,9}\(\w{1,5}\)\])[^\[]+\7[^!\n\*]{1,999}\!\[\]\)\{var\s*\w{1,9}=document[^;]{1,99}\([\'"sc\+ript]{9}[^|\n/\*/\}]+\}(?<X1237451>)))
\b(?:(?:(?:assert_options|error_reporting)\h*\([^\)]+\);\s*){3}[^\$]{0,99}(?:(\$\w{1,40})\h*\.?=\h*['"asert]{3,18};\s*){2,9}\1\h*\(\h*str_rot13\h*\(\h*['"]riny\h*\(\h*(?:\w{1,40}\h*\(\h*)?['"][^'"]{999,}['"]\h*\)\h*\)\h*;\h*['"]\h*\)\h*\)\h*;(?<X1142131>)|(?:(include)(?:_once)?\s*['"]bots/anti\d+\.php['"];\s*){2,}\3\s*['"]config\.php['"]\s*;\s*(\$\w{1,40})[=\s]+getenv[\(\s'"]+REMOTE_ADDR['"][\)\s]+;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+['"][^'"]+['"][,\s]+['"][^'"]+['"][\)\s]+;\s*fwrite[\(\s]+\5[,\s]+\4[^\?]{9,9999}\bheader[\("'\s]+Location\s*:(?<X2213741>)|(?:[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,19}\b(?:prevents|anti)/(?:anti|bot|blocker|princeduscam){1,2}[sz]*\d*\.php['"];\s*){3}(?<X2171793>)|(?:anonymousfox|smtpfox)\-\w+:[^:]{1,128}:\d+:{5}(?<X1250512>)|(?:CreateTools\s*\(\s*['"][^'"]+['"]\s*,\s*["']https?://[^;]{1,199};\s*){5}(?<X2187062>)|(?:define[\(\s'"]+(IFRAME_URL\w*)[',"\s]+https?://[^:;]+;\s*)+if[\s\(]+isset[\s\(]+\$_SERVER\s*\[['"]HTTP_USER_AGENT['"]\][^\{;]+\{\s*if[\s\(]+!\h*isset[\s\(]+\$_COOKIE\s*\[[^\{;=]+\{\s*setcookie\s*\([^\}]+\b\10[\s\);]+\}[^\}]*\b(?:exit|die)\b[^;]*;[^\}]*\}\s*\}(?<X1258350>)|(?:eval[\s\(]+){16,}\w+[\s\(]+\$GLOBALS\s*\[[^\]]+\]\s*\[[^\]]+\][\s\)]+;(?<X2262091>)|(?:function\h*\w{1,40}\h*\(\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*\)\s*\{\h*return\h*str_replace\(\h*(?:(?:\13|\14|\15)\h*,?){3}\);\h*\}\h*){2,}(\$\w{1,40})\h*=\h*['"][^\{\}\*/\+\?><@\.]{99,999}(\$\w{1,40})\h*=\h*[^;]+\16[^;]+;[^=]{0,9}\17[\(\h]+['"][^'"]{999,}['"][\s\)]+;(?<X1188753>)|(?:function\h+([a-z]{1,40})\d*[\h\(]+\)[\s\{]+(\$\w+)\h*=[^;]{499,1999};\s*(\$\w+)[\h=]+fopen[\h\(]+['"][^'"]{1,99}\.php['"][^;]{1,99};\s*\$\w+[\h=]+fwrite[\h\(]+\21[\h\,]+base64_decode[\h\(]+\20[\h\)]+;\s*fclose[\h\(]+\21\h*\);[\s\}]+){2,5}(?:\19\d*[\h\(]+\);\s*){1,5}(?<X1176943>)|(?:function\h+\w+\(\)\{try\{return\s*new\s*URL\(location\.href\)\.searchParams\.GET\(['"]\w+['"]\);\}catch\(\w+\)\{console\.\w+\(e\);\}return\s*null;\}){2}self\.options=\{['"]domain['"]:\h+['"][^'"]{1,299}['"],[^;]{1,499};importScripts\(['"]https?://bujerdaz\.com/[^=]{1,199}=\w+['"]\);(?<X1322020>)|(?:goto\s+\w{1,9};(?:\s*\w{1,9}\s*:){1,2}\s*){2}\$\w{1,40}\h*=\h*['"][^'"]{0,99}\b(?:botnet|covid)\d{0,9}[^@'"]{1,49}@(?:gmail|hotmail|live)\.com['"];[^@]{1,999}\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*['"]https?://[^/]{0,99}\bpaste(?:bin)?\.(?:se|com)/(?:raw|download)\b(?<X2151910>)|(?:if[\(\s]+\$\w{1,40}\s*\S{2,3}\s*\d+[\)\s]+(\$\w{1,40})[\s=]+['"][\./]{2,}['"];\s*){2,}(\$\w{1,40})[\s=]+rand\s*\(\s*1\s*,\s*2\s*\)\s*;(?:\s*if[\(\s]+\26\s*\S{2,3}\s*\d+[\s\)]+\$\w{1,40}[\s=]+base64_decode[\s\(]+['"]PD9[^'"]+['"][\s\)]+;)+\s*\$\w{1,40}[\s=]+fopen[\s\(]+\25\s*\.[^;]+\.php[^;]+;(?<X2210901>)|(?:if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*){2,}if[\s\(]+@(?:copy|move_uploaded_file)[\s\(]+\$_FILES\h*\[[^;\{]+\{\s*(?:echo|print)\b[^;]+;(?:\s*\})+\s*(?:echo|print)[\s\('"]+<form\h*method\h*=\h*['"]post\b[^;]+</form>['"]\s*;\s*\}(?<X1197080>)|(?:if\(!(function)_exists\(['"](\w+)['"]\)+\{\29\s+\30\([^\)]{0,99}\)\{){2,}[^\?@\+\-]{1,999}[;\}\{](\$\w+)=fsockopen\([^\}]{1,499};fputs\(\31,[^;]+;while\(!feof\(\31\)[^@]{999,}[;\{\}](\$\w+)=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]+;eval\(\32\);[^\?]{99,}\b\29\s+(\w+)\([^\?]{99,}\breturn\b[^;]+</html>['"];\}+(\$\w+)=['"]\33['"];ob_start\(\34\);\}+(?<X1218800>)|(?:if\((AntiBomb_)\w{1,40}(\(\$\w{1,40}\))[^\{\};]{1,99}\b(?:\36\w{1,40}\37;)?header\(['"]HTTP/\d\.\d\h+40[34]\b[^;]{1,99};(?:die|exit)[^;]{0,49};(?:\}?else)?){3}(?<X2173261>)|(?:if\(file_exists(\(\$[^\)]+\.['"]css['"]\.[^\)]+\))\)\{(?:[ir](?:nclud|equir)e(?:_once)|unlink)\39;[^\}]{0,99}\}){2}(?<X2201081>)|(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{?(?:echo\h*)?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\}?){3}(?<X2180831>)|(?:if\(strpos\([^,]+,['"]google['"]\)\s*!?==?\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}\s*(\$\w{1,9})\s*=\s*md5[^;]+;\s*echo\s*['"][^>]+\42['"]>['"];(?:exit|die)[^;]{0,9};(?<X1132850>)|(?:include\s*\(?['"][^'"]{1,12}anti\d{1,2}\.php['"]\)?;\s*){2,}[^\{]{0,99}(?:if\(strpos\([^,]{1,99},['"]google['"]\)\s*\D{2,3}\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}(?<X1132841>)|(?:include|require)(?:(?:_once)?(?:\(['"]zip://wp\-content/(\d+)\.zip#\45['"]\);(?<X120362072>)|\s*(?:['"]wp\-includes/class\-wp\-redi\-rect\.php['"];(?<X120344920>)|\(['"]zip://404\.zip#\w['"]\);(?<X120333790>))|\s+['"]te?mp/\w+\.txt['"];\s*exit;(?<X120367070>))|(?:once)?\(['"]indexbaru\.php['"]\);(?<X120359100>)|\(['"](?:(zip)://wp\-[\w\-]+\.\51#\.\w['"]\);(?<X120349960>)|wp\-setiings\.php['"]\);(?<X120351420>))|\h*['"]compress\.zlib://wp\-[^'"]+\.gz['"];(?<X120343251>)|\s*['"](?:compress\.zlib://cw\d{4}\.gz['"];(?<X120348771>)|zip://[\w\-]+\.txt#\w['"];(?<X120349970>)))|(?:md5\(){2,}\$_[GPSRC]\w{2,6}\[['"][^"']*bajatax(?<X2205951>)|(?:PRIVMSG\b[^;]{1,99};\s*print\s+\$sock\s+['"]){3}PRIVMSG\b(?<X2163970>)|(?:public|private)\s*static\s*function\s*\w+\(\s*\w+\s*(\$\w+)\s*\):[\s*\w+]+\{\s*(\$\w+)[^\$]{1,99}\59[^:]{1,199}AWG\_Shadow\w+::bypass\([\s*\w+]+\);\s*require\_once\s*ABSPATH[\s*\.]+['"]wp\-admin/includes/\w+\.php['"];\s*wp\_\w+\(\s*\59[^\$]{1,99}\60[^\$]+\60[\s*:]+\w+\s*\);\s*AWG\w+::\w+\([\s*\w+]+\);\s*\}(?<X220369893>)|(?:push\(@vars\s*,[^;]{1,20}\);\s*){3,6}Handle\(['"]whmcs_crack_Clients(?:Root|info)\b(?<X2143782>)|(?:require|include)(?:(?:_once)?\s+['"]zip://wp\-settingss\.php#\w{1}['"];(?<X1325670>)|\(['"]compress\.zlib://\w+\.gz['"]\);(?<X120369240>)|_once\s*\(['"]compress\.zlib://cw\d+\.gz['"]\);(?<X120354901>))|(?:unlink\([^\);]{1,99}/\.c(?:panel/contactinfo|ontactemail)['"]\h*\);\s*){2}(\$\w{1,40})\h*=\h*fopen\h*\([^\);,]{1,99}/\.c(?:panel/contactinfo|ontactemail)['"]\h*,[^;]{1,199};\s*fwrite\h*\(\h*\66\h*,\h*['"][^;]{1,99};\s*fclose\h*\(\h*\66\h*\);(?<X2175921>)|(\w)=(document)\.createElement[\('"\h]+script['"\)\h]+;\s*\68\.src=atob[\('"\h]+aHR0cHM6Ly9jb2Rl[^'"\)]{1,99}['"\)]+;\s*\69\.head\.appendChild[\h\(]+\68[\h\)]+;(?<X1209970>)|(add_)action\(['"]init['"],\s*(fn)\(\)\s*=>\s*(session_)id\(\)[^;]{1,49}\73start\(\),\s*\d+\);\s*\71action\(['"]wp_footer['"],\s*\72\(\)[^\$]{1,49}\$_SESSION[^@]{1,99}@?file_get_contents\(base64_decode\(['"]aHR0[^'"]+['"]\)\)\s*\?:\s*['"]<p>\s*</p>['"]\)\)\.['"]</div>['"]\)\);(?<X120356400>)|(add_action)(?:\(['"](?:init['"],\s*function[^\$]{1,49}(\$\w+)[^@]{1,99}(\$\w+)[^@]{1,49}@gmail\.com['"];[^&]{1,99}username(_exists)\(\76[^!]{1,49}!email\78\(\77[^\(]{1,49}wp_create_user\(\76[^\}]{1,99}set_role\(['"]administrator['"][^\{]{1,99}\75[^;]{1,49}global\s+(\$\w+)[^\{]{1,99}is_admin[^!]{1,99}\79[^\)]{1,99}['"]\{\$hidden_user\}['"]+;\s*\}\s*\}\);(?<X120354591>)|wp_login['"],['"](\w+)['"][^;]+;\w+\s*\81[^%]{50,500}function\s*(\w+)[\(\)\s\{='"]+\$\w+=['"]seobeta\d+[^!]+;if\(!username_exists\s*[^>]+>set_role\(['"]administrator[^_]+\75\([^,]+,['"]\82[^_]+(auto_login_admin)[^%]{10,200}wp_redirect\(admin_url[\(\);]+(?:exit|die)[;\}\s]+\75[^,]+,["']\83['"]\);(?<X1308272>))|\h*\(\h*['"]pre_current_active_plugins['"]\h*,\h*['"]validate[^'"]{1,99}['"]\h*\)\h*;\s*\75\h*\(\h*['"]init['"]\h*,\h*['"]upload\d*Fsociety\d+['"]\h*\)\h*;(?<X2143381>))|(AntiBomb)Res\w{0,3}\([^\(]+\);[^\}]{0,99}.?\86.block\([^;]{0,99};\s*die\(redirec?t\(['"]\./[a-z0-9]{5,15}\.php(?<X2185872>)|(array)_flip\(\$_links_override\);[\s\}]+\bif\(\$\w{1,20}\h*&&\h*!?isset\((\$_config\[['"]passover_urls?['"]\])[\)\s\{]+\89\h*=\h*\88\(['"][^-]{1,9},\h*['"]/wp-(?:admin|content|includes)\b(?<X2146360>)|(base64_encode)\(\$\w+\)\);unlink\(\$\w+\[\(int\)round[^\n]{99,512}\.\91\(\w+\(\w+::\w{2,3}\(['"][^;]{1,64};return\s+mail\([^\}]+\}function\s*[^\{]+\{\$\w+\s*=\s*explode[^\)]+\)\s*,\s*\$\w{1,2}\);\s*return\s*trim\(\$\w+\[array_rand\((?<X2266121>)|(class)\h*(\w+)\s*\{\s*(private)[^\?]{99,399}\b\95\s*static\h*(function)\h*\w+[\s\(\)\{]+self::\$\w+[\h=]+array\([^\)]{10000,25000}\);[\s\}]+\93\h*(\w+)\s*\{[^#]{99,2200}\b\96\h*(\w+)[\s\(\)\{]+if[\h\(]+isset[\h\(]+\$_REQUEST\[\94::[^#]{50000,}\bnew\h*\97\(\);\s*\$\w+[\h\->]+\98\(\);(?<X120365500>))
\b(?:(const)\s*(\w{1,14})[=\s]+['"][^;]+L2NzcHJlcG9ydGVkLmNvbT[^;]+;\1\s*\w+\s*=\s*atob\(\2\);\1\s*(\w+)\s*[^;]+;\3\.[^<]+appendChild\(\3\);(?<X1293241>)|(define)(?:[\(\s]['"](?:API|SHOP)_\w+['"][\s,]+str_i?replace\(['"](\.keyworddomain\.com)['"][\s,]+(MAINDOMAIN)[\s,\$'"]+(?:API|SHOP)_\w+[\s'"\)]+;\s*\5[\(\s]['"](?:API|SHOP)_\w+['"][\s,]+str_i?replace\(['"]\6['"][\s,]+\7[\s,\$'"]+(?:API|SHOP)_\w+[\s'"\)]+;(?<X1211060>)|[\h\('"]+SHELL_NAME['"],\h*['"]ANALIST\s+SHELL['"]\);[^\?]{9,150}\b\5[\h\('"]+SPAM_BYPASS_METHODS\b(?<X220358611>)|\((?:(['"]__NET['"])\h*,\h*True\);\s*if\h*\(!\5d\h*\(\10\)\)\s*\{\s*error_reporting\h*\([^/:]{9,99}\bfunction_exists\h*\([^\-\?\*]{9,200}\$\w{1,20}_\d\h*=\h*['"]https?://tds\-(?:err|narod)\.(?:com|ru)/[^`%]{999,7000}\bif\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\h*\)\s*\{[^\}>]+;(?:\s*\}){2}(?<X1168231>)|['"]SELF['"],\s*basename\(__FILE__\)\);\s*\5\(['"]ROOT['"],\s*str_replace\(['"]\\\\['"],\s*['"]\/['"],\s*getcwd[^%]{1,6999}<title>NAXC\s*Shell</title>(?<X220351260>))|\h*\(['"](PLUGIN_NAME)['"]\h*,\h*['"]monit\.php['"]\);[^\(]{0,40}\b\5\h*\(['"]HEADER_\13['"]\h*,\h*['"]Plugin\h+Name:\h*Monitization['"]\);(?<X2148092>))|(document\.)addEventListener\(['"]DOMContentLoaded['"],function\(\)\{const\s*_[01]x[a-f\d]{1,39}=atob\(['"]aHR0[^\.\n]{1,999}\15createElement\(['"]script[^\}]+\}[^\.]{1,999}\bnew\s+ethers\.JsonRpcProvider\(atob\(['"]aHR0(?:[^\?\n]+\b(?:Promise|load)\?)+[^\\]+\.error\(['"]BSC\s+Response[^\}]+\}[^\}]+\}\);(?<X1280470>)|(document\.writeln)\h*\(['"]\h*<(script)\b[^>]+>['"]\);\s*\17\h*\(['"]var\h+(\w{1,9})\h*=\h*document\.referrer["']\);\s*\17\h*\(['"]if\(\19\.indexof\(\\['"](?:baidu|yahoo|bing|google)\b[^;]{20,250}\);\s*\17\h*\(["']location\.href=\\['"]https?://[^/]{2,20}/\d/\w{1,20}\.html\b[^\(]+;\s*\17\(['"]</\18>['"]\);(?<X1190592>)|(echo)\h*['"]<[^\{]{9,199}<input[^>]{0,99}\bname\h*=\h*['"](\w{1,40})['"][^>]{0,99}>[^\{]{0,99}\bif\((\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)\s*\{\s*\21\h*['"]<([^>]{0,15}>)['"]\h*\.?\h*exec\(\23['"]\22['"]\]\)\h*\.?\h*['"]</\24[""];\s*\}(?<X1180330>)|(Element)\.prototype\.appendAfter(?:[\s=]+(function)[\s\(]+\26[\)\s]+\{\s*\26\.parentNode\.insertBefore\(this[,\s]+\26\.nextSibling[\);\}\s,]+false[;\(\s]+\27[\(\)\s\{]+var\s*\w{1,40}[=\s]+(String\.fromCharCode\()104,[1256,]{1,40},58,47,47,[^;]+;\s*var\s*(\w{1,40})[\s=]+document\.create\26\(\28[^\*\n]+\[0\]\.appendChild\(\29\);\}\)\(\);(?<X1211720>)|\s*=\s*function\(\26\)\s*\{\s*\26\.parentNode\.insertBefore\(this,\s*\26\.nextSibling\);\s*\}\s*,\h*false\h*;[^;=]+var\h*(?:(\w{1,40})(?:\.(?:type|src))?\h*=[^;\)]*String\.fromCharCode\([^;]+;\s*){2,}\31(\.append)[^\}]{9,499}\32child\(\31\);\s*\}\s*\)\s*\(\);(?<X1194704>))|(error_reporting\()0\);(?:\34[^;]+;)+if\(!(function)_exists\(['"](hex2bin)['"]\)+\{\35\s*\36\([^@]{999,4999}=['"]<\?[ph\s]*define\(['"]WP_USE_THEMES['"],true\);\s*require\s*__DIR__\s*\.\s*['"]/wp\-blog\-header\.php['"];['"];[^@]{499,1999}\b(unlink\(__FILE__\);)(?:\?>)+\37+(?<X1233000>)|(exec)\s+master\.dbo\.(xp_cmdshell)\s+[^&>\$]+([&>\$])\s*(?:\40\s*\39|request\.form\s*\(\s*(['"])[^'"]+\42\s*\)\s*\41|(?:quot;\s*\.\s*\$)?_[GPCSR]\w+\[[^\]]{3,50}\]|\w+\.\w+\s*\41)(?<X2128382>)|(file_)(?:get(_contents)\((\$\w{1,20})\);\s*\$\w{1,20}\h*=\h*filemtime\(\46\);\s*if\(preg_match_all\(\h*[\'"]\|(?:\(\.\*\))?<\\!--\h*(?:\\/)?js-tools\b[^;]{9,99}\);\s*\44put\45\h*\(\46,(?<X2158230>)|put(_contents)\(['"]\w+\.php['"],\h*\44get\48\(['"]https?://[^'"]+\bYudas1337/(?:ninja_shell|ExorLock_Ransomware)/[^'"]+\.(?:php|txt)['"]\)\);(?<X1203591>))|(file_put_(content)s)\h*\(\h*(\$_SERVER\[['"]DOCUMENT_ROOT['"]\])[\h\.]+['"](/wp\-\51/)db\-cache\.php['"][\h,]+(\$\w{1,40})[\h\)]+;\s*(?:\$\w{1,40}\h*=\h*array\h*\(\)\h*;|\50\h*\(\h*\52[\h\.]+['"]\53plugins/[\w\-]{1,40}\.php['"][\h,]+\54[\h\)]+;)(?<X2168311>)|(file_put_contents\()(dirname\(__FILE__\)\.['"]/)\.htaccess['"],[^;]{1,99};(?:\bif\(!is_dir(\((\57wp\-)(?:admin|content|includes)/['"])\)\)\{?mkdir\58,[^;]{1,99};\}?){3}[^\{\}\?@#%\*!&:<>\+]{1,999}(\$\w{1,40})(?:\d=\59[^'"]{1,99}\.php['"];\60){3}[^\{]{1,199}\b(?:if\([^\{]{1,199}\{\56\60\d,['"]{2}\);\}){3}(?<X2172770>)|(find_admin)\((\$\w{1,20}),(\$\w{1,20})\);\s*\}\s*function\h+s_xhell\(\64\)\s*\{\s*\63\h*=\h*array\((?:["']/[a-z0-9-_]{0,15}\.?(?:txt|php|phtml|pl)?["'],){10}[^\)]{99,999}\);\s*\62\(\63,\64\);(?<X2139130>)|(for[\h\(]+)(\$\w{1,9})\h*=\h*0;\h*\67\h*(<strlen)[\h\(]+(\$\w{1,9})[\s\);\{]+\66(\$\w{1,9})[\h=]+0;[\h\(]*\70\h*\68[\h\(]+(\$\w{1,9})\D{2,9}\$\w{1,9}\68[\h\(]+\$\w{1,9}[\h\)]+;\s*\$\w{1,9}\+{2},[^\.\^%]{9,199}\.=\h*(?:\69|\71)\{(?:\67|\70)\}\h*\^\h*(?:\69|\71)\{(?:\67|\70)\}[^:%/]{9,199}\bpreg_replace\h*\((?<X2177145>)|(foreach)[\s\(]+\$\w{1,40}\s+as\s+(\$\w{1,40})[\s\)]+\{(?:\s*\74\s*=\s*strrev[\s\(]+\74[\s\)]+;)?\s*if[\s\(]+strpos[\s\(]+\$\w{1,40}[,\s]+\74[\s\)]+!=+\s*false[\s\)\{]+setcookie[^;]+;\s*\$\w{1,40}\s*=\s*false;(?:\s*break;)?[\s\};]+\73[^;\{]+\74[\s\)]+\{[^\}]+\$\w{1,40}\s*=\s*true;(?:\s*break;)?\s*\}\s*\};(?<X1234721>)|(foreach\()\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{\76\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=ftp_connect\([^;]{1,99};if\(ftp_login\(\79,(?:\w{1,40}\()?\77\)?,(?:\w{1,40}\()?\78\)?\)\)\{[^\}]{0,99}\bftp_put\(\79,(?<X2167210>))
\b(function)(?:(\w+)\(+\w+,\w+\)\{var\w+=\w+\(\);return\2=\1\(\w+,\w+\)[^%]{1,1100}(R_PATH)[^%]{1,2150}['"]\w+['"]:(\w+)\((?:\-\w+[,\)])+[^%]{1,12200}\3['"]\]\)+;\1\4[^%]{1,50}\2[^%]{1,1810}\4[\(\s]+(?:\-\w+[,\)])+[^\;]+;[^\;]+;\}\(\)+;(?<X1235002>)|\h*(?:((_0x[a-z0-9]+)\([^\)]+\))[\{\s]+var\h*_0x[a-z0-9]+=(_0x[a-z0-9]+)\(\);[^\}]{9,150}\},\6;\s*\}[^\[]{9,150}\1\h*\8\(\)[\{\s]+var\h*(\w+)=\[[^\]]+\];\s*\8=\1\(\)[\{\s]+(return)\h*\9;[^\n\$\t]{999,6000}\}(scriptz\w+)\[[^\]]+\]=[^'"]{9,99}\10\h*\7\([^\[]+\bdocument\[[^;\t\.]{9,60}\[\w+\([^\)]+\)\]\(\11\);(?<X1215080>)|(\w+)(?:[\h\(\)\{]+var\h*\w=\[[^\]]+\];\h*\13=\1\(\)\{return\h*\w;\};\h*return\h*\13\(\);[^\n]{99,1200}\bscreen,\w=window,\w[^\n]{99,999}\bnew\h*httpClient\(\),\w=\w\[\w\([^\n]{9,299}\breturn\h*\w\[\w[^;]{0,99}0x1[^;]+;\}\}\(\)\);\}(?<X1273350>)|[\s\(\)\{]+(\$\w+)[\h=]+['"][^'"]{999,10000}['"];\s*echo\h*['"]<script>\h*\(\h*\1[\h\(\)\{]+const\h*\w+[\h=]+atob\h*\([\h\\'"\.]+\15[^\{\?]{9,299}\badd_action[\h\(]+['"]\w+['"],\h*['"]\13['"],[^;]+;(?<X120362940>)|[\s\(\)]+\{\s*(\$\w{1,25})[\h=]+['"]aHR0cHM6Ly95b2FzdC1zY2hlbWEtZ3JhcGguY29t[^'"]+['"];\s*\$\w{1,25}[\h=]+base64_decode[\h\(]+\17[\h\)]+;\s*if[\h\(]+\1_exists[\h\(]+['"]curl_init['"][\s\)]+\{[^\?]{99,500}\badd_action[\h\(]+[^,]+,\s*['"]\13['"][\h\)]+;(?<X1230051>)|\([^\{]+\{\s*(\$\w+)[\h=]+['"]{2};\s*for[^\{]+\{(?:\s*\$\w+[\h=]+ord\(\$\w+\[[^;]+;){2}[^\}]{0,99}\}\s*return\h*\19;\s*\}[^\{]{0,99}\b\1\h*(\w+)\(\)\s*\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*__DIR__[\h\.]+\13\([^;]+;[^\{]{0,99}\{\s*add_action\(['"][^'"]+['"],\h*['"]\20['"]\);[^\}]{0,99}\}(?<X120346511>))|(\w{1,25})\(\)\s*\{\s*unlink\([^\)]+\);\s*\}\s*add_action\([^\{]{0,199}\{\s*\1\h*\w{1,25}\(\)\s*\{\s*echo\h*['"]<img\h*style=['"]display:\h*none;['"]\h*src=['"]https?://[^'"]{1,59}\.jpg\?\w{1,9}=['"][\h\.]+\$_SERVER\[[^\}]{0,199}\}\s*\}\s*register_shutdown_function\(['"]\22['"]\);(?<X1200980>)|(\w{1,30})\(\)\s*\{\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*\1\h*(\w{1,30})\(\)\s*\{\s*return\h+['"][^'"]{1,40}['"];\s*\}\s*echo\h+\25\(\);\s*(?:exit|die)\b[^;]{0,19};[\}\s]+(add_action\(['"]init['"]\h*,)\h*['"]\24['"]\h*\);\s*\26\h*['"]glo[^'"]{9,40}['"]\h*\)\h*;\s*\Z(?<X1174582>)|(\w{1,40})\h*\(\)\s*\{\s*var\s*(\w{1,40})\h*=\h*\[\h*['"]createElement['"]\h*,(?:[^\]\+:/]{0,499}?,\h*['"](?:charCodeAt|charAt)['"]\h*,){2}[^\]\+:/]{0,499}?['"]onload['"][^\]\+:/]{0,499},\h*['"]https://['"]\h*,[^;\]]+\];\h*\28=\1\(\)[;\{\}\h]+return\h*\29[;\}\h]+return\h*\28\(\)[;\s]+\}(?<X1196341>)|(\w{1,40}\(\))\s*\{\s*(\w{1,40}\(\));\s*\}[^%&\|!]{0,9999}\1\h*\32\s*\{[^=\}]+\b(\w{1,40}\(\));[^%&!]{0,9999}\1\h*\33(?:[^=\}]*\$_[GPRSC]\w{2,6}[=\s]+&\$HTTP_[GPRSC]\w{2,6}_VARS;)+\s*\}[^%\|]+\b\31;[^!]+!\1[^\}]+\}\s*call_user_func[\s\(]+create_\1[^;]{0,19}\\x65\b(?<X2196610>)|(_0x)\w+\(+\35\w+,\35\w+\)\{var\h*\35\w+=\35\w+\(\);return\h*\35\w+=\1\(\35\w+[^\n]{999,3000}\bencodeURIComponent\(window\[\35\w+\([^\)]+\)\]\[['"]R_PATH['"]\]\),void[^\n]{99,999}\binsertBefore['"]\]\(\35\w+,\35\w+\);\}[\h\(\)]+;(?<X1235540>)|(_0x\w+)\([^\)]+\)\{const[^;]+;return\h*\37=\1\([^\n]{999,9999}\bconst\h*_0x\w+=\[['"](?:https?://|\\x68\\x74\\x74\\x70\\x3a)[^\n]{999,1999}\bwindow\[['"]mobileCheck['"]\]\(\)[^\n]{99,999}\bdocument\[[^\]]+\][^;]+;\}[\(\)]+;(?<X1277962>)|(create_hidden\w+)[\s\(\)\{]+(\$\w+)[\h=]+['"]([\w\-]+)['"];[^\?]{9,199}\bwp_create_user[\h\(]+\40,[^\?]{0,99}\bset_role[\h\('"]+administrator['"\h\)]+;[^\?]{99,500}\b\39\(\);\s*\1\h*(hide_[\w\-]+)\([^\?]{9,199}\blogin['"\h,]+\41['"\h\)]+;[^\?]{9,199}add_action[\h\(]+[^,]+,\h*['"]\42[\h\)'"]+;(?<X120360550>)|(isBot\(\))\s*\{\s*\$botAgents\h*=\h*['"][^\}]{9,399}\}\s*\1\h*(\w{1,40})\(\)\s*\{[^\?]{99,250}\bif\h*\(\h*\44\h*\)\s*\{\s*(echo\h*\$link);\s*\}\s*\}\s*else\s*\{\s*\46;[\s\}]+add_action\(["'][^'"]+['"],\s*['"]\45['"]\);(?<X1195560>)|(JSCget_content)[^#]{99,999}\bCURLOPT_SSL_VERIFYPEER[\s,]+false\);[^#]{99,1500}\1\h*JSCis_visitor\((?:[^#]{99,4500}\1\h*(\w+)[\(\)\{\s]+\bdefine\(["']JSURL['"],\h*['"]aHR0cHM6Ly9yZWFkZmx1eGEuY29t['"]\);[^#]{999,4000}\b\48\(\$\w+[^;]+;\s*echo[^;]+;\s*exit[^;]{0,9};\s*\}\s*\}\s*\}\s*\49\(\);(?<X120361620>)|[^#]{99,999}\bdefine\(["']JSURL['"],\h*['"]aHR0cHM6Ly9yZWFkZmx1eGEuY29t['"]\);[^#]{999,2000}\b\48\(\$\w+[^;]+;\s*echo[^;]+;\s*(?:exit|die|safe_exit)[^;]{0,9};\s*\}\s*\}\s*\}(?<X120361610>))|\w{1,40}\h*\(\h*\$\w{1,20}[^\)]{1,99}\)\s*\{\s*(\$\w{1,40})\h*=\h*preg_split\([^;]+;\s*array_walk\(\s*\52\h*,[^\?]{1,200}(\$\w{1,20})\h*=\h*chr[\h\(]+ord[\h\(]+\53\)\h*\^\h*ord[\h\(]+[^;]{1,99};[^\?]{9,999}(\$\w{1,40})\h*=\h*\w{1,40}\([^;]+;\s*(\$\w{1,20})\h*=\h*create_\1\(\h*null\h*,\h*\54\h*\);\s*@?\55\(\);(?<X1167112>)|seo_redirect_plugin_main\(\)\s*\{[^#]{99,700}\bhkjhall\.com/?['"];\s*\$\w+[\h=]+array_map\(\1\(\$\w+[\s\)\{]+return\h*is_array\b(?<X220361730>))|\h+(?:(\w+)[\s\(]+(\$\w+)[\s\)]+\{\s*if[\h\(]+\1_exists[\h\(]+['"](curl_)exec['"\)\s\{]+\$\w+[\h=]+\60init\(\59\);[^\?]{99,999}\breturn\s*\$\w+;\s*\}\s*(\$\w+)[\h=]+\58\((?:['"]https?://[^'"]+\.txt['"]\);\s*eval\h*\(['"]\?>['"]\.\61\);(?<X1201150>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(\$\w+)[\h=]+eval\h*\(['"]\?>['"]\.\61\);\s*header[\h\(]+['"][^:]+:\s*\63\h*['"]\);(?<X1201160>))|(\w+\(\))[\s\{]+\w+[\s=]+\[[\d\,\s]+\];[^>]{1,499}\b(\w+)[\s=]+new\s+XMLHttpRequest\(\);[^>/]{0,199}\b(\w+)[\s=]+\66\.responseText;[^>/]{0,199}(?:\b(\w+)\s*=[^;\}=]{0,49}(?:\67|\68)[^>\*!]{0,199}){2,}\b(\w+)[\s=]+new\s*\1[\s\(]+\68[\s\)]+;\s*\69\(\);[^>]{0,199}\66\.open\([^>/]{0,199}\bwindow\.onload[\s=]+\65;(?<X1211392>)|(\w{1,20})\((?:(\$\w{1,20})\)[\s\{]+(\$\w{1,20})=array\([^\)]+\);\s*return\h*\73\[\72\];[\s\}]+\1\h*\w{1,20}\([^\}]{99,200}\{\s*session_get_cookie_params\(\$_[GPRSC]\w{2,6},[^%@#&]{99,200}\bif\([^\{]+\)[\s\{]+(\$\w{1,20})=create_\1\(\71\(\d+\),[^\)]+\);\s*\74\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1200800>)|\$\w{1,20}\)[\s\{]+(\$\w{1,20})=['"]{2};\s*for\([^\}]{9,99}\breturn\h*\76;[\}\s]+\$\w{1,20}=['"]\1_exists['"];\s*(\$\w{1,20})=(?:str_replace\([^\)]+\)|create_\1);\s*(\$\w{1,20})=['"]base64_decode['"];\s*(\$\w{1,20})=\71\(\78\([^\)]+\)\);\s*call_user_func\(\77\(['"]{2},\79\)\);(?<X1202570>))|(\w{1,20}\(\))\s*\{[^\}]{9,40}(\$\w{1,20})\h*=\h*(\w{1,20}\(\));\s*@?eval\(['"][^\$]+\82[^\)]+\);\s*\}\s*\1\h+\83\s*\{\s*(\$\w{1,20})\h*=\h*str_replace\(['",\s]{5,9}\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*return\h+['"][^\$]+\84[^;]+;\s*\}\s*\81;(?<X1147871>)|(\w{1,30})\h*\(\h*(\$\w{1,40})\h*,[^\{]{1,99}\{\s*for\h*\([^\{]{1,99}\{\s*(\87\[[^\]]+\])\h*=\h*chr\h*\(\h*ord\h*\(\h*\88\h*\)\h*\^\h*ord\h*\([^;]{1,99};\s*\}\s*return\s+\87;[^\?]{1,999}\$(\w{1,40})\h*=\h*\86\([^;]{1,99};\s*(\$\w{1,40})\h*=\h*create_\1\h*\(\h*null\h*,\h*\$\89\h*\);\s*@?\90\(\);(?<X1166902>)|(\w{1,40})\h*\(\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*;\s*return\h*@?(?:\(\h*)?\93\h*\[[^\]]+\][\h\)]{0,9};\s*\}\s*@?(extract)\h*\(\h*(array)\h*\(\h*(\w{1,40})\s*=>\s*create_\1\h*\(\h*(?:NULL|['"]{2})\h*,\h*\92[\s\(\)]+;\s*@?\94\h*\(\h*\95\h*\(\h*\w{1,40}\s*=>\h*(?:\$\96|\93)[\s\(\)]+;(?<X1169230>)|(get_str)\((\$\w{1,12})\)\s*\{\s*\99\h*=\h*str_rot13\(\99\);\s*return\h*\99;\s*\}\s*\1\h*(\w{1,40})\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][a-z\d]{999,}['"];\s*\101\h*=\h*\98\(\101\);[^@]{0,999}@eval\h*\([^;]+\101\b[^;]{0,40};\s*\}\s*\100\(\);(?<X1182240>)|[a-f0-9]{8,32}\([a-f0-9]{8,32}\)\h*\{\h*var\h+[a-f0-9]{8,32}\h*=\h*\d+;\h*return\(parseInt\([a-f0-9]{8,32},[a-f0-9]{8,32}\)\);\}\h*\1\h*([a-f0-9]{8,32})\([a-f0-9]{8,32}\)\{[^/>\+]{9,299}\+=\w{1,40}\(\)+\{[^'"]{99,299}\103\(['"][a-f0-9]{99,999}['"]\);(?<X1158521>)|aHR\h*\([^\)]+\)\s*\{[^\}\{]{99,400}\breturn\h+\$\w{1,20}\h*\(\$\w{1,20}\h*,\h*array\(\),[^\);]{9,99}\);\s*\}\s*if\h*\(\1_exists\h*\([^\)]+\)\s*\)\s*\{\s*\1\h+get_data_yo\h*\((?<X2168460>)|shell\((\$\w{1,20})\)\s*\{[^\}]{1,40}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\106[^\?:#]{9,600}\b\1\h*perms\([^\)]+\)\s*\{\s*[^&]{0,50}(?:(?:else)?if\(\(\$perms&(0x[A-Z0-9]{3,5})\)\W{1,4}\107\)\s*\{\s*\$\w{1,20}=['"].['"];\s*\}\s*){5}(?<X2186600>)))
\b(function)\s*(?:(\w)\s*\([^\{;]+\{\s*var\s*\w+[\s=]+(\w+)[\(\)\s]+;\s*return\s*\w+[\s=]+\1\s*\([^\{;]+\{[^\}]+\}[,\s]+\2[^;]+;\s*\}\s*\1\s*\3[^=;]{0,40}(\w+)[\s=]+\[[^\]]{99,}\]\s*;\s*\w+[\s=]+\1[\s\(\)]+\{\s*return\s*\4[;\s]*\}[;\s]*return\s*\3[\(\);\s]*\}\W+\Z(?<X12144816>)|(\w+)\(\)[\{\s]+(\$\w{1,40})[=\s]+['"]aHR0c[^'";]{9,60}['"];\s*\7[=\s]+base64\w+[\(\s]+\7[\)\s]+;\s*if[\s\(]+\1_exists[\(\s]+['"]curl_init['"][^%]{1,150}(\$\w{1,40})[=\s]+[^%]{1,130}\7[^%]{1,100}echo\s*\8;[\}\s]+add_action[\(\s]+['"]\w+['"],\s*['"]\6['"][\)\s]+;(?<X1232611>)|(\w{1,20})[\(\s]+\$\w{1,9}[,\s]+\$\w{1,9}[\s=]+array[\(\)]+[^\}]+(\$\w{1,20})[\s=]+curl_exec[^\}]+return\s*\11[^%\|]+\1\s*(\w{1,20})[^\}]+google\|yahoo\|bing\|aol\|apple[^%+]{99,2999}\bif[\s\(]+\12[^\}]+echo\s*\10[^\?><]{9,99}\}(?<X1260981>)|(\w{1,40})[\(\)\s\{]+(\w{1,40})[\(\)\s;\}]+(\$\w{1,40})[=\s]+(__DIR__)[\.\s]+['"]/[^'"]+\.php['"][\s;]+if[\(\s]+file(_exists)[\(\s]+\16[\)\s\{]+include[\(\s]+\17[\.\s]+['"]/\w{1,4}['"](?:[\.\s]+['"][\w\.]{1,5}['"][\.\s]+['"])+[\.\w]{0,5}p['"][\)\s;\}]+if[\(\s]+\1\18[\(\s'"]+\15['"\)\s\{]+(\$\w{1,40})[=\s]+new\s*\w+[\(\)\s;]+if[\(\s]+\19\->\w+[\(\)\s\{]+add_action[\(\s'"]+init['",\s]+\14['"\)\s;]+\}\s*\}(?<X1259261>)|(_0x\w+)\(\)\s*\{\s*var\s*\w+\s*=\s*\[['"][^;]{1,999}['"]\];\s*\21\s*=\s*\1\s*[^\.]{1,2999}\s*return\s*!?\w+\s*[^\.]{1,299}\w+\s*\(getCookie\(_0x\w+\(\w+\)\)[^\}]{1,199}['"]ar\-my\-acco['"]\s*[^:]{1,999}['"]zoneID['"]:\s*_0x\w+\(\w+\)[^\.]{1,480}\(\w+\)\);\s*\},\s*0x\d+\);\s*\}(?<X120341852>)|(_[01]x[a-f\d]+)\(\)\{var\s*_[01]x[a-f\d]+=\[['"]{2}\];\23=\1\(\)\{return\b[^\n]{14999,}=window\[[^;]+;\s*function\s*_[01]x[a-f\d]+\s*\([^;]+;\s*\}(?<X1251620>)|(_[10]x[\da-f]+)\s*\([^;\}=]{0,40}const\s*_[10]x[\da-f]+[=\s]+(_[10]x[\da-f]+)[\(\)\s;]+return\s*\25[=\s]+\1\s*\((?:[^\}i]+\})+\s*\1\s*\26[^\[]{1,999}\[['"]userAgent['",\s]+(?:\\x\d|http)[^!\n]+\bwhile[\(\s]+!!\[\][^`%\|\n]{1,1999}\bvar\s*(_[10]x[\da-f]+)[=\s]+\[[^\n<]{99,5999}\bdocument\[\27\[[^\)]+\)[\}\(\);]*;(?<X1249836>)|(loc\w+)\(\)\h*\{\h*var\h*\w+\h*=\h*(document)\h*,\h*\w+\h*=\h*\[['"][^\]]+\]\s*;\s*\w+\h*=\h*setInterval[\(\s]+\1[\(\)\s]+\{[^\?]{9,999}\}\h*['"]loading['"]\h*==+\h*\30\.readyState\?\30\.addEventListener\(['"]DOMContentLoaded['"],\29\):\29\(\);(?<X1258301>)|\w+\((\$\w+)\)\{(return)\s*preg_quote\(\32[\);\}]+(eval)\(['"]\s*\1\s*\w+\((\$\w+),(\$\w+),(\$\w+)[\)\{]+\b\33\s*preg_replace\(\35\,\36\,\37[\);\}';]+\34[\('"]+\1\s*(\w+)\(\32\)\{\b\33\s*base64_decode\(\32[\);\}']+\34\(\w+\(\38\(['"][^'"]{999,}['\)]+,\d{2}[);]+(?:\?>|\Z)(?<X1306051>)|\w{1,40}(?:[\(\)\s\{]+if[\s\(]+strpos[\(\s]+\$_SERVER\[[^\]]+\][\s,]+['"]wp\-[^\}]+\}\s*if[\(\s]+(curre\w+[\('"\s]+admin\w+)[^=]{0,99}\$\w{1,40}[\s=]+['"]aHR0[^!]+\1\s*(\w+)[\(\)\s\{]+if[\s\(!]+\40[^:]{99,}::\w+[^\{]{99,}\{(?:[^\}]{0,199}\}){1,5}\s*register_ac\w+[\s\(]+__FILE__[,\s'"]+\41['"\s\)]+;(?<X1259270>)|[\(\s]+\w{1,40}[,\s]+\w{1,40}[\)\s\{]+var\s*\w+=\w+\(\);return \w+=\1\(\w+,\w+\)\{\w+=\w+\-\w+;var\s*\w+=\w+\[\w+\];if[\(\s]+\w{1,20}\[[^\]]+\]\s*==+\s*undefined\b(?:[^\[\]\n]{1,499}\[['"](?:charAt|fromCharCode)['"]\]){2}[^\n@]{1999,}\bgetElementsByTagName[^\}]+\}\(window,docum[^;]+;(?<X1253590>))|\w{1,9}\(\)\{header\(['"]HTTP/1\.[01]\s+40[34]\b[^;]{1,49};echo[^;]{1,199};(?:exit|die)[^;]{0,19};\}\1\s*\w{1,9}\((\$\w{1,9})\)\{@?unlink\(\44\);if\((\$\w{1,9})=@?fopen\(\44,[^\{;]+\{(\$\w{1,9})=['"]<IfModule\s+mod_rewrite\.c>[^;]{99,199};@?fwrite\(\45,\46\);(?<X2144300>)|_0x(?:\w+\([^=]{1,99}[\s=]{1,8}(_0x\w+)[^\}]+[\}\s,\w]+\(\w+[^:\n]{1,999}atob\(_0x\w+\(0x\w+\)\+_0x\w+\([^\}]+[\}\s\(]+document[\s\);]+\1\s*\48[\(\{\)\s]+var\s*[^\]]+36078SWzeyE['"]\];\48[^\}]+\};return\s*\48[\(\)\s;]+\}(?<X1279960>)|\w{1,9}\(_0x\w{1,9},_0x\w{1,9}[\s\)]+\{\s*var\s*_0x\w{1,9}=_0x\w{1,9}\(\);\s*return\s*_0x\w{1,9}=\1\([^;]+;\s*var\s*_0x\w{1,9}=_0x\w{1,9}\[[^\]]+\];[^\[\n]{9,999}\[[^\]=]+,['"]aHR0c[^'"]+['"],[^\]]+\];[^!\n]{9,}\bwhile\(!!\[[^\n:]{9,}:[^/\n]{9,}=btoa\([^;]+appendChild['"\]\(]+\w+[;\}\(\)]+;(?<X1210230>))|_(?:[01]x\w{1,9}[\(\s]+_[01]x\w{1,9}[,\s]+_[01]x\w{1,9}[\)\s]+\{\s*var\s*_[01]x\w{1,9}[\s=]+_[01]x\w{1,9}\([^\(]{0,40}\1\s*\([^:\n]{99,999}://[\w\-]*cdn[\w\-]*\.[a-z]{2,9}/\w[^\*\n@]{9,999}\*[\s\(]+parseInt[^\n]{99,9999}\[['"]insertBefore['"]\]\(_[01]x\w{1,9}[,\s]+_[01]x\w{1,9}\);\}\(\)\)\);(?<X1230000>)|\w{6}\s*\([^\{]{1,32}\{\s*var\s*\w+\s*=\s*\w+[\(\)\s]+;[^%\n]{1,9999}var\s*(_\w+)[^\{]+\{['"]\w+['"]:\1[^!\n]{1,9999}\!document\[\52[^\}\n]+atob[^\)\n]+\52\(\w+\)\]\);\w+=\w+\[\52\(\w{4}\)[^\]]+\52[^\}]+\}\(document\){2};\1\s*_\w+\(\)\{\}(?<X1257362>))|activate_(\w+)\s*\(\s*\)\s*\{\s*\}\s*\1\s*(deactivate)_\54[\(\s]+[\)\s]+\{\s*require(?:_once)?[\s\(]*plugin_dir_path[\(\s]+__FILE__[\)\.\s]+['"][^'"]+\.php['"]\s*;\s*\54_\w+::\55[\(\)\s;]+\}(?<X2234311>)|hide_plugin\(\$plugins\)\s*\{[^@]{99,9999}\->hidden_user;\s*\}\s*\w+\s*\1\s*generate_credentials\b(?<X220354180>)|suicide\(\)\{if\(\1_exists\([^\}]{1,199}\}else\{(unlink\()__FILE__\);\}(?:\58[^\)]{1,49}\);){5}(?<X2149480>))
\b(?:(function)(?:\s+(?:(\w+)(?:[\(\)\s\{]+(?:(\$\w+)[=\s'"]+https?://[^'"\.]+\.com['";\s]+)+if[\(\s]+\1_exists[\('"\s]+(file_get_contents)['"\)\s]+\{[^\{\}&]+(\$\w{1,40})[=\s'"]+@\4[\s\(]+\3[^,]{9,499}\becho['"\s]+<script\s*src[="'\s.]+esc_url[\(\s]+\5[^;]+;(?:\s*\})+\s*add_action[\('"\s]+wp_head['",\s]+\2['"\)\s]+;(?<X1253363>)|[^!]{1,49}!\1_exists\(['"]wp_create_user['"]\)\)\s*\w+;\s*\$\w+[\s=]+['"]maddin_admin['"][^\{]{1,149}!username_Exists\((\$\w+)[^\(]{1,49}wp_create_user\(\7[^\(]{1,49}\7[\s=]+new\s+wp_user\(\7\w+[^\(]{1,49}set_role\(['"]administrator['"]\)[^\(]{1,49}update_user_meta\(\7\w+[^\}]{1,99}\}\s*\}\s*add_Action\(['"]init['"],\s*['"]\2['"]\);(?<X120361201>)|[^'"]{1,49}['"]ABCDE[^'"]+['"][^\}]{1,99}foreach\((\w+)[^!]{1,99}\9[^\?]{1,199}(\$_SERVER\[['"]REQUEST)\w+['"]\][^#]{1,299}\10\w+['"]\]\);exit;\}echo\s+\2\(['"]PCFkb2N[^'"]+['"]\);\}\1[^\?]{1,999}['"]AElfSxQ2[^'"]+['"];if\(isset\((\$_COOKIE)[^\}]{1,29}(\$\w+)[^;]{1,99}\11[^\?]{1,99}create_\1[^;]{1,29}\12\);\$\w+\(\);\}\}\?>(?<X120351200>)|[^\[]{1,29}\$_SERVER[^\{]{1,99}\1\s+\w+(_bot)[^;]{1,49}\2[^'"]{1,49}foreach[^\{]{1,499}\1\s+\w+\14[^;]{1,49}\2[^>]{1,499}\1_exists[^;]{1,29}(curl)\w+[^=]{1,39}\15\w+[^&]{1,299}\15\w+[^@]{1,299}@?file_get_contents[^\-]{1,99}\w+\14[^\?]{1,299}https?:[^'"]+\.txt['"][^\.]{1,199}echo[^;]{1,29};\s+exit;\s*\}(?<X120351970>)|\((\$\w+)\)\s*\{[^\{]{1,49}\1_exists[^;]{1,49}(curl)\w+\(\17\);\s*\18\w+[^\{]{1,499}\1_exists[^;]{1,49}file_get_contents\(\17\);[^\$]{1,99}(\$\w+)[\h=]+\2\(['"]https?://[^'"]+\.php['"]\);[^\{]{1,49}\19[^\}]{1,149}(\$\w+),\s*\19\);\s*include\(\20[^\?]{1,149}exit\(\);\s*\}\s*\}(?<X120352331>)|\((\$\w+)\)\{if\(\1_exists\(['"](shell_exec)['"]\)\)\{return\s+\23\(\22\);\}return\s+['"]\w+[^;]{1,29}['"];\}[^\n]{1,1399}if\(isset\(\$_POST\[['"](\w+)[^=]{1,29}=\2\(\$_POST\[['"]\24['"]\]\)(?<X220366190>)|\(\$\w+[^!]{1,49}if\(!\s*\1_exists\(['"](curl_)\w+[^\(]{1,99}\1_exists\(['"]\26\w+[^\(]{1,99}(\$\w+)=\26\w+\([^\{]{1,99}\27[^!]{1,199}(\$\w+)=\26\w+\(\27[^\?]{1,99}\28=array[^\?]{1,49}eval\(['"]\?>['"]\.\28\)\)[^:]{1,199}(\$\w+)=\2\(['"]https?://[^'"]+\.txt['"]\);print_r\(\29\);(?<X120363501>)|\(\)[^\?]{1,99}get_site_url\(\);(\$\w+)[^:]{1,199}wp_remote_post\(['"]https?://[^'"]+\.php['"][^\$]{1,99}['"]POST['"][^\(]{1,99}\31[^\{]{1,99}add_action\(['"]wp_footer['"],['"]\2['"]\);\1\s+(\w+)\(\)\{(\$\w+)[^:]{1,99}https?://[^'"]+\.txt['"][^@]{1,399}foreach\(\33[^#]{1,129}file_put_contents\([^\?]{1,49}['"]\32['"]\);(?<X120363170>)|\(\)\s*\{(?:[\s=]+\w+[\s=]+\(!\w+\(\$_SERVER\[['"]\w+['"]\]\)\)[^\(]{1,99}(\$\w+)[\s=]+\w+\([^;]+\);[^\{]{1,99}foreach[\s=]+\(\35\s+\w+\s+\$\w+\)[^\*]{1,199}\1\s+(\w+)[^!]{1,299}function\s*(\w+)\(\)[^\(]+\(\2[^:]{1,99}\36\(['"]https?://[^'"]+\.txt['"]\);[^\-]{1,99}[^\?]{1,399}echo\s*\37\(\);(?<X120348322>)|[^\[]{1,99}\$_SERVER[^\(]{1,99}(\$\w+)[\s=]+array\([^\)]{1,299}\);[^\{]{1,99}foreach\s*\(\39[^/]{1,129}\1\s+(fetch_url_content)\(\$\w+\)\s*\{[^\}]{1,399}(curl)\w+\(\$\w+\);\s*\41\w+[^'"]+rtrim\(\$_SERVER\[['"]REQUEST_URI['"]\][^\{]{1,99}\2[^\$]{1,99}(\$\w+)[^\$]{1,99}\$\w+[\s=]+\40\(\42[^:]{1,199}['"]FAILED[^\}]{1,49}exit;\s*\}\s*\}(?<X120348313>)|\s*if[\h\(]+empty\(\$_SERVER\[['"][^\[]{1,99}(\$\w+)[^\(]{1,599}foreach[\h\(]+\44[^\.]{1,299}\1\s+(\w+)\(\)[^%]{1,499}sprintf\([^\{]{1,99}foreach[^;]{1,99}explode\([^#]{1,399}\1\s+(\w+)\(\)[^@]{1,99}@?gethostbyaddr\(\$_SERVER[^@]{1,399}\2[^\{]{1,49}\46[^\{]{1,49}\45[^=]{1,99}(?:\.php|html)[^!]{1,199}echo\s*['"][^\}]{1,49}\}\s*exit;\s*\}(?<X120360651>)))|(\w{1,40})(?:(\(\)\{)\s*\1\s+\w{1,40}\(\$\w+\)\s*\{\s*\$\w{1,40}\h*=\h*curl_[^#]{9,9999}\1\s+(\w{1,40})\49\s*if\s*\(\s*isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+\{\s*\1\h+(\w{1,40})\(\)\s*\{\s*echo\h+[^;]{1,60};\s*\}\s*\51[^'"]{1,299}(?:add_action\(['"]init['"],\s*['"](?:\48|\50)['"]\);\s*){2}(?<X1145160>)|\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*if\h*\(\h*\1_exists\h*\(\h*['"](curl_)\w+['"](?:\h*\)){2}\s*\{\s*\$\w+\h*=\h*\54init\h*\(\h*\53\h*\);[^\?\.]{1,999}\breturn\b[^;]{1,49};\s*\}\s*(\$\w{1,40})\h*=\h*\48\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*\55\h*\);(?<X1171480>))|(is_bot)\(\)\s*\{(?:\s*(\$\w+)[\s=]+\$_SERVER(?:[['"][^\$]{1,49}(\$\w+)[^\{]{1,129}foreach\s*\(\59[^!]{1,99}\58[^\[]{1,99}\1\s+(\w+)[^\.]{1,199}\57\(\)[^\.]{1,99}\60\(\)[^;]{1,49}(?:include|require)\(['"]\w+\.txt['"]\);\s*\}\s*(?:exit|die);\s*\}(?<X120353710>)|\[['"](?:[^\(]{1,49}(\$\w+)[^\{]{1,199}foreach[\h\(]+\62[^!]{1,49}\58[^\.]{1,99}\1\s+(\w+)\(\)\s*\{[^\{]{1,149}\57\([^\(]{1,49}\(\63\([^\(]{1,49}include\(['"][^\(]{1,99}header\(['"]Location:\s*https?://[^'"]+['"],\s*true,\s*\d+\);\s*\}\s*exit;\s*\}(?<X120356740>)|[^\[]{1,99}(\$\w+)[^\{]{1,199}foreach[\h\(]+\65[^!]{1,49}\58[^\?]{1,99}\1\s+(\w+)[^;]{1,99};[^!]{1,499}\57\(\)[^\?]{1,99}\$_SERVER\[['"]REQUEST_URI['"]\][^!]{1,99}\(strpos[^:]{1,199}https://[^'"]+['"];[^=]{1,49}(\$\w+)[\s=]+\66[^\?]{1,149}echo\s+\67;\s*exit;\s*\}\s*\}\s*\}\s*(?:\}\);)?(?<X120356691>))|\[(?:[^\$]{1,49}(\$\w+)[^\{]{1,199}foreach[\h\(]+\69[^!]{1,99}\58[^'"]{1,99}\1\s+(\w+)[^\?]{1,199}\57\([^\(]{1,99}\(\70[^;]{1,99}(?:include|require)\(['"][^'"]+\.txt['"]\);[^\(]{1,99}\(['"]Location:\h*https?://[^'"]+['"][^\}]{1,99}\}\s*(?:exit|die);\s*\}(?<X120355460>)|[^\(]{1,99}(\$\w+)[^\{]{1,199}foreach[\h\(]+\72[^!]{1,99}\58[^/]{1,99}\1\s+(\w+)[^\?]{1,199}\57\([^\(]{1,99}\(\73\([^;]{1,99}(?:include|require)\(['"][^'"]+['"]\);[^;]{1,99}['"]Location:\s*https?://[^'"]+['"]\);\s*\}\s*exit;\s*\}(?<X120355740>)))|if\(!isset\((\$_SERVER\[['"]\w+['"]\])\)[^\$]{1,99}(\$\w+)=\75;(\$\w+)[^\{]{1,399}foreach\(\77[^!]{1,99}\76[^\?]{1,99}\1\s+\w+[^;]{1,49}curl\w+[^\{]{1,499}\57\([^'"]{1,49}['"]https?://[^'"]+['"];(\$\w+)[^\?]{1,119}echo\78;exit;\}\}(?<X120356772>))|(wp_)\w+\(\)[^,]{1,49}get_bloginfo\([^\?]{1,99}\$_SERVER\[[^\(]{1,49}(\$\w+)[\s=]+\80\w+[^\[]{1,49}\80\w+\(\81[^\.]{1,199}file_put_contents[^!]{1,99}\.txt['"][^!]{1,299}base64_decode\([^\{]{1,299}\1\s+\80\w+[^;]{1,99}(\$\w+)[^;]{1,99}\.php['"][^<]{1,99}file_get_contents\(\82[^@]{1,299}add_action[^\{]{1,49}\1[^;]{1,99}</div>['"];\s*\}\);(?<X120357730>)|\w+\((\$\w+)(?:[^\(]{1,49}if\s*\(ini_get\(['"]allow_url_fopen['"]\)\)[^\(]{1,49}stream_context_create[^\{]{1,299}file_get_contents\(\84[^\{]{1,49}\1_exists\(['"]curl_init['"][^#]{1,899}\$_SERVER\[[^\}]{1,99}rtrim[^\.]{1,399}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];[^;]{1,49}(\$\w+)[\s=]+fetchC\(\85[^\?]{1,149}echo\s+\86;\s*\}\s*exit;\s*\}\s*\}(?<X120357250>)|\)[^'"]{1,49}ini_get[^\$]{1,49}(\$\w+)[^\?]{1,399}file_get_contents\(\84,\s*(?:false|true),\s*\88[^\{]{1,49}\1_exists\(['"](curl)\w+[^;]{1,49}\89\w+[^\-]{1,499}\89\w+[^\[]{1,299}(\$\w+)[\s=]+isset\(\$_SERVER[^>]{1,199}(\$\w+)[^:]{1,99}https?://[^'"]+\.txt[^!]{1,599}\91\[\90\]\);\s*(\$\w+)[^\}]{1,199}echo\s+\92;\s*exit;\s*\}\s*\}(?<X120353070>))|get\((\$\w+)\)\{(\$\w+)=shell_exec\(['"]wget[^;]{1,99}\94\)\);return\95;\}\1\s+\w+\(\94\)[^=]{1,99}=fopen\(\94[^\(]{1,99}stream_get_contents\([^\?]{1,99}return\$\w+;\}\$\w+=['"]\?>['"];\?>['"]\)\.getfilealt\(urldecode\(['"]https?://[^'"]+['"](?<X120358760>))|_exists\h*\(['"](ZM5j2q0shf_pirogok)['"]\)\h*\)\s*\{\s*\1\h+\97\(\)\s*\{(?<X2151761>))|(function\h+)(\w{1,40})[\h\(\)]+\{\s*(\$\w{1,40})\h*=\h*(\w{1,40})\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\?<>]{1,499}\bget_user_by\([^\)]+\101\b[^\?\}/<]{1,299}\bdo_action\h*\(\h*['"]wp_login['"][^\?]{1,299}\b\99\102\h*\([^\}]{1,499}\}\s*if\h*\([^\{=;]{1,99}\{\s*\100\h*\([^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1179221>)|(getcwd\(\))\s*\.[^!\{\}]{199,999}\bif\(isset(\((\$_[GPCSR]\w{2,6}\[['"]\w+['"]\])\))\)\{(?:if\(!(?:file_exists|is_dir)\105\)\s*die\(\106[^;]+;){2}chdir\105(\s*or\s*die\()[^;]+;(\$\w{1,40})=scandir\105\107[^;]+;foreach\(\108\s*as[^\;]+\104[^;]+;if\(file_put_contents\(\$\w+,\$_[GPCSR]\w{2,6}\[['"]\w+['"]\]\)\)(?<X2131311>)|(global\h+)(\$[o01li_]+);\h*\111[\h=]+(@?create_(function)\h*\()[^;]+;\h*if[\h\(]+!\h*\113_exists[\h\(]+['"]([o01li_]+)['"][\s\)]+\{\h*\113\s*\114[\h\(\)]+\{\s*\110\111\h*;\s*return\s*(call_user_func[\h\(]+)\111[\h,]+['"][^'"]+['"][\h,]+\d+[\h\);]+\}\h*\115\112[\h'"]+,\h*['"][^'"]+['"][\h\)]+;\h*\}(?<X1196870>))
\b(?:(goto)(?:[\s\w;:]+(?:\$\w+[\s=]+array\(['"]\\x[^;]{99,999};\s*\1[^\}]{1,99}CURLOPT_CONNECTTIMEOUT[,\s]+round\([\d\.]+\s*\+\s*[\d\.]+[^\(]{1,299}header\([^\?]{1,2500};\s*(\w+):\s*if\s*\(!\(PReG_mAtCH[^%]{1,1799}\2;\s*\w+:\s*\w+:(?<X1298110>)|\1\s*\w+;[^@]+@ignore_user_abort\(1\);[^@]{1,99}(@header)\(['"]\\x\w{2}\\[^%]{999,7100}file_put_contents\([^@]{1,99};\s*(\w+):\s*\w+:\s*\1[^:]{1,99}:\s*echo[^>]{999,}\4\(['"]\\x\w+\\x\w+\\[^\?]{1,299}\1\s*\5;\s*\w+:\s*\w+:(?<X1298101>))|\h*(?:(\w{1,9});\s*\7:\s*class\h*(\w{1,9})\h*\{\s*(public)\s*(function)\h*\w{1,9}\h*\(\)\s*\{\s*return\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*\}\s*\9\s*\10\h*\w{1,9}\h*\(\$\w{1,9}\)\s*\{\s*\1[^\?]{9,15999}\bnew\s*\8\h*\(\);\s*\1\h*(\w{1,9});\s*\11:\s*\$\w{1,9}\->\w{1,9}\h*\(\);(?<X1178490>)|\w+;\h*\w+:\h*(?:(\$\w+)[\h=]+(curl_)init\([^\?\n]{9,199}\beval\(['"][^\n\?]{9,199}\b\14exec[\h\(]+\13[\h\)]+;\h*\1\h*\w+;\h*\w+:(?<X120341980>)|function\h*(yqH_e)[\h\(\)\{]+\1\h*\w+[^\n]{0,99}\barray\([^\)]+\);[^\n]{0,499}\bfile_get_contents\([^\n]{0,299}\b\16[\h\(\)\{]+\1\h*\w+;\h*\}\h*\1\h*\w+;\h*\w+:\h*\w+:(?<X120370190>)))|\h+(?:\w{1,9};\w{1,9}:\h*chmod\((\$\w{1,40}),\d+\);[^\?]{99,299}\1\s+\w{1,9};\w{1,9}:\s*\$\w{1,9}=base64_decode\(['"]aHR0c[^;]{9,49}(?:Ojgw|ODA|MDA)[^'"]{1,40}['"]\);\1\s+\w{1,9};\w{1,9}:\s*\18\h*=\$_SERVER\[['"]SCRIPT_FILENAME['"]\];(?<X2144700>)|\w{3,9};\h*\w{3,9}:\h+(?:(?:exit|die)\b[^;]{0,9};\h*\1\h+\w{3,9}\h*;\h*\w{3,9}\h*:\h*\$\w{3,9}\h*=\h*str_replace\h*\(['"][^\|\v]{999,19999}\bif\h*\(\h*!\(empty\(\h*\$\w{1,40}\h*\)\h*\|\|\h*\$\w{1,40}\h*\D{2,3}\h*200[\s\)]+\{\h*\1\h+\w{3,9};\h*\}\h*\1\h+\w{3,9};\h+\w{3,9}:\h*define\h*\([^\)]+\)\h*;(?<X1167400>)|\$\w{3,9}\h*=\h*\$\w{3,9}\h*\.\h*\$\w{3,9};\h*\1\h+\w{3,9};\h*\w{3,9}:\h+\$\w{3,9}\h*=\h*@?curl_exec\(\$\w{3,9}\);\h*\1\h+\w{3,9};\h*\w{3,9}:\h*@?error_reporting\(0\);[^\v>@/]{9999,15000}\b\1\h+\w{3,9};\h*\w{3,9}:\h+define\(['"\\,xa-f\d\h]{19,99}\)\h*;(?<X1162900>)))|\s*(?:(\w{5});(?:\s*(?:\1\s*)?\w{5}:)+\s*(\$\w+)[=\s]+md5\(\$_[GPRSC]\w{2,6}\[['"]\\[\\xa-f\d]+['"]\]\);\s*\1[^=]{16,64}=\s*\$_[GPRSC]\w{2,6}\[['"][\\xa-f\d]+[^\(]+\(!\(\23\s*=+\s*['"][^\)]+\)[\s\)\{]+\1[^\n]{9,199}\22:[^\n]{9,9999}!move_uploaded_file[^:]+:\s*echo\s*['"][^;]+;\s*\1\s*\w{5};(?:\s*\w{5}:)+(?<X1261311>)|\w+;\s*(?:(\w+):\s*@?mkdir\((\$\w+)[^\(]{1,49}\1\s*(\w+);\s*\27:\s*file_put_contents\(\$\w+\s*\.\s*['"]\\x2f\\155\\x61\\x69\\156\\56\\x70\\150\\x70['"],\s*file_get_contents[^:]{1,99}\w+:\s*\26[^:]{1,99}\25;\s*\w+:\s*echo\s*['"]\\x44\\x6f\\156\\x65\\56['"];(?<X120344930>)|\w+:\s*exit;[^!]{1,49}!password_verify[^\]]{1,149}\$_SERVER\[['"]\\120\\110\\120\\x5f\\x53[^'"]+['"]\]\);[^@]{1,399}(function_exists)\([^@]{1,149}@?file_get_contents[^'"]{1,49}\29\([^\{]{1,99}\{\s*\1[^#]{1,999}\$_COOKIE[^@]{1,999}echo\s*['"]\\x3c\\41\\x44\\117\\x43\\124[^'"]+['"];(?<X120350070>)))|\s+(?:(\w+);(?:\s*(\w+):[^'"]{1,99}['"]\\x2f\\x28\\x62\\157\\x74[^'"]+['"]\s*;\s*\1\s+\w+;\s*\31:\s*ob_start[^\[]{1,99}strtolower\(\$_SERVER[^\?]{1,249}lph_requests\(['"]\\150\\164\\164\\x70\\163[^'"]+['"]\);[^\}]{1,49}die;[^\?]{1,99}function_exists[^;]{1,99}(curl)\w+[^\}]{1,199}\33\w+[^/]{1,159}\1\s+\32;\s*\w+:(?<X120353060>)|\s+(\w+):\s*(\$\w+)[\s=]+['"]\\57\\x28\\142[^'"]+['"];[^\(]{1,49}\31:\s*(ob_)\w+[^\{]{1,99}(function)[^\?]{1,49}\38\w+\(['"]\\143\\x75\\x72[^'"]+['"]\)[^;]{1,49}curl_init[^\[]{1,399}\36[^\[]{1,99}\$_SERVER\[[^\[]{1,299}\37\w+\(\);\s*die;\s*\}\s*\1[^/]{1,199}header\(['"]\\x56\\x61\\162[^'"]+['"]\);\s*\1\s+\35;\s*\w+:(?<X120354360>)|\s+\31:\s+(\$\w+)[\h\=]+dirname\((__DIR__),[^\[]{1,29}\$_GET[^:]{1,99}\1[^\(]{1,99}file_put_contents\(*\40[^\(]{1,49}file_get_contents\(\41[^'"]{1,29}['"]\\x2f\\155\\x61[^'"]+['"][^@]{1,99}@?mkdir\(\40[^:]{1,99}\1[^'"]{1,49}echo\s*['"]\\x44\\x6f\\x6e[^'"]+['"];(?<X120351770>)|\w+:(\$\w+)=['"]\\163\\164\\162\\137\\162\\157\\164\\061\\063['"];\1[^\{]{1,299}\31:(\$\w+)=['"][^'"]+['"];\1[^\(]{1,99}\43[^\{]{1,199}strlen[^%]{1,49}\44=hexdec[^/]{1,199}exit\([^/]{1,99}\44[^;]{1,49};eval\(\44\);(?<X120352660>))|\w+;(?:[^\.]{1,99}strpos[^\.]{1,149}file_put_contents[^'"]{1,29}['"]\\x2f\\x72\\x6f\\x62[^'"]+['"],\s*(\$\w+)[^\?]{1,169}str_replace[^@]{1,299}\46\s*=\s*@?file_get_contents[^\?]{1,499}\$_SERVER\[[^#]{99,3399}curl_close[^=]{1,299}curl_setopt[^\*]{99,4999}echo[^\*]{1,499}\1\s*\w+;\s*\w+:\s*\w+:(?<X120349500>)|\s+(\w+):\s*(\$\w+)[\s=]+array\(\$_REQUEST\[['"]\\170['"]\][^\$]{1,49}\1[^\$]{1,49}(\$\w+)[\s=]+array_keys\(\49\)\[\d+\];\s*\1[^\.]{1,49}echo[^:]{1,49}\1\s+\48;\s*\w+:\s*eval\(\50\);(?<X120365140>))|\w+[^\$]{1,99}if\s*\(isset\((\$_GET)\[['"]\\x61['"]\]\)\)[^=]{1,139}foreach[^@]{1,399}\1\s*\w+;\s*\w+:\s*echo\s*['"]\\15\\xa\\x3c\\x74\\x72\\76\\15\\xa[^'"]+['"][^@]{1,2999}\52[^\{]{1,199}(file_exists)\((\$\w+)[^\.]{1,199}file_get_contents[^!]{999,}\54[^@]{999,}\52[^#]{1,1999}\53[^'"]{1,99}['"]\\40\\xd\\xa\\x3c\\57\\x64\\151[^'"]+['"];(?<X120350022>)))|(header)\([^%]{1,99}301[^%]{1,99}\56\(['"]Location:\s*https?://[^'"]+\.gob\.pe/[^'"]{1,99}['"]\);exit\(\);(?<X120364410>)|(header\()['"]HTTP/[12\.]+\h+40[34]\b[^@#%&\\\|]{1,999}(\$\w{1,40})=['"]https?://['"]\.\w{1,40}\([^\^\)]{1,99}\^\(?ord\([^@#%&/\\\|]{1,299}\bfile_get_(content)s\(\59\);[^@#%&\\\|]{1,299}\b\58['"]\60\-Disposition:\h*attachment\b[^\?#%\+/&\\\|]{1,299}\becho\h*\$\w{1,40};(?:exit|die)[^;]{0,19};(?<X2186390>)|(https?://ghostbin\.axel\.org)[^\?]{1,12}/raw\s*<\?(?:php)?[^\$]{1,49}\$\w+[\s=]+['"]\62[^'"]+['"];[^;]{1,49}(\$\w+)[\s=]+(curl)\w+\(\);[^;]{1,99}\64\w+\(\63[^\{]{1,559}(\$\w+)[\s=]+\64\w+\(\63\);[^;]{1,199}echo\s*['"]Error\s+\64:[^\{]{1,99}\{[^;]{1,99}echo\s+\65;\s*\}[^;]{1,49}\64\w+\(\63\);(?<X120355091>)|(if[\(\s]+is_null[\(\s]+\$_[GPRSC]\w{2,6})\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[\s=]+['"]['"]\s*;\s*\67\[[^\]]+\][^\n:]{9,9999}\b\w{1,40}\(['"]https?://\w+\.[\w\-]{3,40}\.[a-z]{2,6}/[^;'"\?]+\.\w{2,4}\?[^\?]{99,}\$\w{1,40}[\s=]+\$\w{1,40}[\.\s'"]+\?[^'"]+['"][\.\s]+urlencode\s*\([^;]+\$_[GPRSC]\w{2,6}\[[^\]]+\];(?<X1217411>)|(if[\(\s]+isset[\(\s]+(\$_[GPRSC]\w{2,6}\[))[^\]]+\][\)\s]+[\{\s]+\69(['"]\w+['"])[\]\s]+[\)\s]+include\s*\70\71[\]\s]+;\s*\69(['"]\w+['"]\])[\)\s]+[\{\s]+\$\w{1,40}[=\s]+file_get_contents[\(\s]+\70\72[\)\s]+;\s*file_put[^\}]{1,200}\}\s*\69['"](\w+)['"][\]\s]+[\)\s]+echo\s*['"]\73['"];[\s\}]+(?<X1235020>)|(if\(isset\()\$_[GPRSCH]\w{2,6}\[[^\]]+\]\)\)[\{\s]+(\$\w+)=fopen\((['"][^'"]+['"]),[^\)]+\);\s*fwrite\(\76,[^\}]{9,99}\}\s*if\(is_file\(\77\)\)[\{\s]+echo\h*(file_get_contents)\(\77\);[\}\s]+\75\$_[GPRSCH]\w{2,6}\[[^\}]{1,60}\b\78\([^;]{1,40};\s*fclose\(\76\);\s*\}(?<X1224550>)|(if\(strcmp\(__CMS_NAME__,)['"](wordpress)['"]\)[^\)]+\)\s*\{\s*(\$\w{1,20})=str(_replace)\(['"][ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"]class\.wp\-includes\.php['"]\);[^\$]+\82\);\s*\82=preg\83\(['"]/\(package\\s\+\81\b[^\?>]{9,99}\80['"]joomla\b[^\?#&]{99,900}\bfwrite\(\$\w{1,20},\82\);(?<X2186401>)|(if\(stristr\((\$links),)\h*['"](JSLINKS)['"]\)\)\s*\{\s*\86\h*=\h*str_replace\(\h*['"]\87['"]\h*,\h*['"]{2}\h*,\h*\86\h*\);\s*\85\h*['"]JSCYCUPDATE['"][\s\)]+\{\s*dscs_upgrade\h*\(\86\);\s*return\s*['"]{2};\s*\}\s*\$\w{1,40}\h*=\h*@?fopen\([^;]+cache\.txt['"](?<X2162461>)|(if\(strpos\()\$_SERVER\[['"]REQUEST_URI['"]\],['"][^\{]{9,99}\)\{[^\{]{9,99}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*(\$\w{1,20})=>\$\w{1,20}\)\{\89\90,['"]wordpress_logged_in['"][^\?\\]{99,400}(\$\w{1,20})=ob_g[^\}\{]{9,150}\bfile_put_contents\(\$\w{1,20},\91\)[^\n]{0,20}\becho\h*\91;\}[^;]{9,99}\bheader\.php['"]\);(?<X1178541>)|(include)\s*['"]\\x2fvar\\x2fchr\\x6fot\/\\x68[^'"]+\\x65l\.p\\x68p['"];\s*\93[^\?]{1,399}\93_once\(\$\w+\.['"]\/\w{16,}\.zip['"]\);\s*\?><\?php[^\$]{1,399}\93\s*['"]\\x2fvar\\x2fchr[^'"]+\\x62jec\\x74\.ph\\x70['"];(?<X120346341>)|(let)\s*(\w)\s*=\s*\w+;\95\s*ss\d+\s*=\s*\96\[['"]\w+['"]\[['"]\w+['"]\]\(['"]\w['"],\s*['"]\w['"]\)\];\95\s*(\w+)\s*=\s*\96\['function['"]\];\95\s*(ss\d+)\s*=\s*ss\d+\(['"]Y29uc3Q[^'"]+['"]\);\97\(\98\)\.call\(\w+\);(?<X120340800>))
\b(?:(local)\s+\w+(\s*=\s*)['"]\$\w+['"]\s*\1\s+(\w+)\2['"]/tmp/\w+['"][^%]{1,19}\1\s+(\w+)\2['"]https?://[^'"]{1,256}xmrig[^%]{1,799}\bcurl\s+\-fL(\s+\-o\s+['"]\$\3['"]\s+['"]\$\4['"]\s*\|\|\s*return\s+1)[^%]{1,99}wget\5(?<X220337081>)|(moban\.html?)\h*['"]\h*;[^\{\}\?]{0,199}\bfile_put_contents\h*\([^;]+/\7\b(?<X2172380>)|(null),['"]\w+['"]:\s*\w+,['"]\w+['"]:\s*['"](?:auto\.c3pool\.org:\d+['"],['"]\w+['"]:\s*['"][^,]{1,99}['"][^\.]{1,70}true,['"]enabled['"]:[^\.]{1,49}\s*:\s*\9,['"]daemon['"]:(?<X220347280>)|pool\.supportxmr\.com:\d+['"],['"]\w+['"]:\s*['"][^,]{1,99}['"][^\.]{1,70}false,['"]enabled['"]:[^\.]{1,49}\s*\9,['"]daemon['"]:(?<X220342300>))|(Plugin)\s+Name:\s*(?:(WooCommeerce)\s*\*\s+\12\s+URI:[^\?]{1,299}\13[^\{]{1,99}function\s+\w+\((\$\w+)[^\}]{1,499}foreach\(\14[^#]{999,}if[\h\(]+(\$\w+)[^!]{1,99}<\?php[^\?]{1,99}eval\(['"]\?>['"]\s*\.\s*\15(?<X220358130>)|(WooCommerse)\s*\12\s+URI:[^\?]{1,99}injects\s+\17\s+metadata[^\$]{1,299}(\$\w+)_hex[\s=]+['"][^'"]+['"];\s*\18_key[^\?]{1,199}hex2bin\(\18_hex[^\?]{1,299}eval\(gzinflate\(base64_decode\(\18\w+[^\{]{1,199}['"]all_plugins['"](?<X220353450>))|(private)\s*\$\w+[\s=]+['"]\d+['"];\s*\w+\s*\$\w+[=\s]+['"]https?://[^;]+;\s*\20\s*\$\w+[\s=]+['"]\d+['"];[^\}]{1,999}add_filter\(['"]\w+['"],\s*array\(\$\w+,\s*['"]hide_plugin['"](?<X220364241>)|(pwn)\h*\(\h*['"][^'"]{1,40}['"]\h*\)\h*;\s*function\h+\22\(\h*\$\w{1,40}\h*\)\s*\{\s*global\h*\$\w{1,40}\h*,\h*\$\w{1,40}(?:\h*,\h*\$\w{1,40})?\h*;\s*(?:class|function)\h+(?:Vuln|str2ptr)\s*[\{\(](?<X2138103>)|(Rewrite)(?:Cond\s*%\{HTTP_USER_AGENT\}\s*(?:Googlebot|Googlebot\-)[^\[]+\[NC\]\s*\24Rule\s*\^\(\.\*\)\$\s+cloak\.php\s*\[L\](?<X120363601>)|Engine(?:\h+On\s*\24Base\h+/\s*(\24Cond\h+%\{[^\}]{1,25}\})\h+android[^\n]{99,320}\s*\26\s*\^\(\d{1,4}\|\d{1,4}[^\n]{199,1699}\s*\24Rule\h+\^\$\h*https?://[^\[]{1,49}/\w{1,20}\.php[^\[,]{0,20}\[R,\h*L\](?<X1168191>)|\s+On\s*\24Cond(?:\s*%\{HTTP_USER_AGENT\}\s*['"](?:Android|iPhone|iPad|iPod|BlackBerry|Windows\s+Phone)?[^'"]{1,199}['"]\s*\[nc\]\s*\24Rule\s*\^\.\*\$\s*https?://lakns\.com/[^\{]{1,49}=\{CLICK_ID\}\s*\[R=\d+,L\](?<X120356961>)|\s+%\{HTTP_USER_AGENT\}\s+android\s+\[[^\*]+?windows\-media\-player\)\s+\[NC\]\s*\24Rule\s+\^\(\.\*\)\$\s+https?://[\S]+\s+\[L,R=302\](?<X1042712>))|\s+On\s+(\24Cond)\s+%\{HTTP:X\-Wap\-[^\}]+\}\s+\^\.\+\$\s+\[OR\]\s+\30\s+%\{HTTP_ACCEPT\}\s+\([^\|\.]+vnd\.wap\.[^\)]+\)\s+\[NC,OR\][^!]+\30\s+%\{REQUEST_URI\}\s+!\\\\\.\((?:(?:jpe?g|gif|png|bmp|ico)\|?){3,}\)\$\s+\[NC\]\s+\24Rule\s+\^\(\.\*\)\$\s+https?://tinyurl\.com/\w{3,16}\s+\[L,R=3\d{2}\](?<X1218760>)))|(RewriteCond)(?:\s*%\{HTTP_USER_AGENT\}\s*\((?:(?:google|yahoo|msn|aol|bing)\|?){3,}\)\s*\[OR\]\s*\32\s*%\{HTTP_REFERER\}\s*\((?:(?:google|yahoo|msn|aol|bing)\|?){3,}\)\s*RewriteRule\s*\.\s*\S{1,40}\.php\s*\[L,S=\d+\](?<X1269400>)|\s+(%\{HTTP_USER_AGENT\})\s+\(android\|[^\n\[\],]{40,399}\b\s+\[NC,OR\]\s+\32\s+\34\s+\^\(\d+\|[\w\|\-\[\]\\\h\(\)/\.]{999,1999}\)\s+\[NC\]\n\s*RewriteRule\s+\^\$\s+https://tinyurl\.com/[a-z\d]{3,12}\s+\[R,L\](?<X1218270>))|(rewritecond\h*%)\{HTTP_USER_AGENT\}[\s=]\((?:Googlebot|AdsBot|Mediapartners-Google|APIs-Google)[^\)]{1,49}\)\s*\[\w+\]\s*\36\{REQUEST_URI\}\s*\^/\$\s*+\w+\s*+\^\$[^\[]+wp\-admin/maint/wp\-[^\.]+\.php\s*+\[\w+\](?<X120348084>)|(rndtext)\h*=\h*(md5\(microtime\(\)\));(?:\s*\$\w{1,15}\h*=\h*rand\(\d+,\d+\);){2}\s*\$\38\h*=\h*\39\.\39;\s*(?:header\(['"]Location:\h*\w{1,15}\.(?:html?|php)|function\h*validate_cc_number)(?<X2192531>)|(round)\([\d\+\-]+\)[\h\|]+(\$GLOBALS\[[^\]]+\])\[\d+\]\(\$_COOKIE,[^\)]+[\h\)\)]+;\h*else\h*\{\42[^\n\?]{599,1999}\42\[\d+\]\(\$\w+\);\h*if[\h\(]+\41\([\d\+\-]+\)[\h\+]+\41\([\d\+\-]+\)\)(?<X120341770>)|(scriptTitle)\h*=\h*['"]PHPShell['"];\s*\$\w{1,15}\h*=\h*['"]\$\44\h*by(?<X2146160>)|(search_file_js)\h*\(\h*(\$\w{1,40})\h*,\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?scandir\h*\(\h*\47\h*\)\h*;[^@\}]{9,199}@?\46\h*\(\h*\47\h*,\h*['"]\.js\b(?<X2151660>)|(socket)\.\49\(\49\.AF_INET\h*,[^\?]{9,9999}(?:Attack|flood)(?<X2150783>)|(string)\[\]\h+(\w{1,40})\h*=\h*new\h*\51\[\d+\];\s*foreach\h*\(\h*Management(Object)\h+(\w{1,40})\h+in\h+\w{1,40}\h*\(\h*['"]SELECT\h+\S{1,40}\h+from\h+Win32_Process\b[^\{]{1,99}\{\s*\54\.InvokeMethod\h*\(\h*['"]GetOwner['"]\h*,\h*\(\h*\53\h*\[\]\h*\)\h*\52\h*\);\s*\}\s*return\h+\52\[\d+\];\s*\}(?<X2172360>)|(TELEGRAM_TOKEN)=['"]7808612445[^'"]{1,99}['"][^\-]{1,99}CHAT_ID=['"]\-1002822967423['"][^&]{1,699}FILE=\$\(find\s*['"]\$FOLDER_PATH['"][^\?]{1,399}curl\s*\-X\s*POST\s*https?://api\.telegram\.org/bot\$\56[^\&]{1,99}\$\w+&text=[^'"]{1,199}\$DOMAIN['"]\s*\w+\s*\[\s*\$\?\s*\-\w+\s*\d+\s*\];(?<X220344090>)|(title)></\58>[^\?]{0,99}<\?php\s*if[\h\(]+\$_[GPRSC]\w{2,6}[^\?]{9,99}\bmove_uploaded_file\(\$_FILES[^<]{0,99}<form\b(?<X2198051>)|(to)\h*=\h*['"][^\.]{0,49}@app88\.vn['"];[^\?]{9,150}\bmail\(\$\60(?<X2170130>)|(unlink\()[^\);]{0,99}(\.htaccess)['"]\);[^\?@#%:/]{1,499}\bfile_put_contents\([^,]{1,99}\63['"],[^\?@#%:]{1,499}\b\62[^\);@#%:]{0,99}\.user\.ini['"][^\?@#%]{1,499}(?:\$(\w{1,40})\.?=str_replace\(['"](?:<\?|\?>)[^;]{1,199};){1,}eval\(\$\64\)(?<X2186221>)|(unlink\h*\()[^\)]{1,199}\);[\s\}]{1,99}if\h*\(\$_[GPRSC]\w{2,6}\[['"](bajatax)['"]\]\W{1,4}['"]\67['"]\)\s*\{\s*(?:@?\66[^\)]{1,99}\);\s*){1,5}(?<X2176182>)|(update_option)(?:[\h\('"]+(sbi_license_)key['"],[^;]+;\s*\69[\h\('"]+\70status['"],[^;]+;\s*\69[\h\('"]+\70[^;]+;\s*\69[\h\('"]+\70data['"],\h*\[\h*['"]success['"][\h=>]+true,\h*['"]license[^;]+;(?<X120365780>)|[\h\(]+['"](flatsome_wup_)\w+['"],\s*['"]\w+\-\w+\-\w+\-\w+\-\w+['"][\h\(]+\);\s*\69[\h\(]+['"]\72supported_until['"],\s*['"]\d+\.\d+\.\d+['"][\h\(]+\);[^;]{1,99}\72buyer['"],\s*['"]Licensed['"][^\.]{1,99}require\s+get_template_directory\(\)\s*\.\s*['"][^\.]+\.php['"];(?<X120362140>)|\(\s*['"]elementor_pro_license_key['"][^\(]{1,99}\69[^;]{1,199}json_encode[^\{]{1,199}add_action[^!]{1,99}(\$\w+)[^'"]{1,99}\74[^\}]{1,199}json_encode[^\$]{1,149}\74[^:]{1,99}(\$\w+)[\s=]+wp_remote_get\(\s*['"]https?://wordpressnull\.org[^\?]{1,199}\75;[^!]{1,49}return\s+\$\w+;\s*\}\s*\},\s*\d+,\s*\d+\s*\);\s*\}\s*\);(?<X120350871>)))
\b(?:(var)(?:[^://]{1,99}\1\s*(\w+)\s*=\s*\w+\[[^:]{1,99}://go\.syndcloud\.com[^\}]{1,999}\]\(\2\);(?<X120346760>)|\h+\w{1,20}\h*=\h*\d;\s*\1\h+(\w{1,9})\h*=\h*(document);\s*\1\h+(\w{1,9})\h*=\h*\4\.createElement\(['"](script)['"]\);\s*\6\.type[^\(]{9,60}\s*\1\h+\w{1,9}\h*=\h*String\.fromCharCode\([\d,]{99,299}\);\s*\6\.[^\.]{9,24}\5\.current\7[^\[]{9,199}\[0\]\.appendChild\(\6\);[^\}]{0,99}\}(?<X1143046>)|\s*(?:((a0)\w)=(\10\w);\(\w+\((\w),\w\)\{\1\s*\10\w=\{\12:0x[^\\]{1,999}\10\w=\{['"]webdriverCheck['"]:\w+\(\)\{\1\s*\w=\9;\s*\w+[^\\]{1,1999}\11;\w+[^\\]{1,2999}XMLHttpRequest\(\);\s*\w\[\w\(\10\w\.\w\)\]\(['"]GET['"][^\\]{1,999}\10\w\.[^;]{1,99}appendChild['"][^;]{1,99};\},0x\w+\);\},!\[\]\);(?<X120345940>)|(\w{1,16})\s*=\s*\w+;\(function\(\w{1,16},\w{1,16}\)\{\1[^\}]{1,499}\}catch[^;]+;}{3}\((\w{1,16})[^\)]+\){2};;[^=]+=\15[^\}]{1,199}undefined\)[^}]{1,199}/=['"];\1[^\}]{1,399}\}for[^\}]+\}return\s*decodeURIComponent[^\+]+\+{2}[^\.]{1,2700}\(window,document,\14[^\]]{1,99}\{\1\s*(\w{1,16})\s*=\[['"]Aw5Zzxj0qMvMB3jL[^\]]+\];\15\s*=\w+[^;]+\16;\};return\s*\15\(\);\}(?<X1249913>)|\w\s*=\d+;\s*\1\s*(\w)[\s=]+\w+;\s*\1\s*(\w)[\s=]+\18\['create['"\=\s\+]+element['"]\]\(['"scr\s\+ipt]+\);\s*\19\[['"]src['"]\][\s='"]+[^'"]+syndcloud\.com[^'"]{1,99}['"];\s*\19\[['"]type['"]\][=\s'"text\\/javs\+crip;]+\18\[['']head['"]\]\[['"]append['"\s\+]+child['"]\]\(\19\);(?<X120333370>)|_[01]x[a-f\d]+\s*=\s*(_[01]x[a-f\d]+);\((\w+)[^!\n]{1,256}while\(!!\[\][^\}]+\}catch[^\}]+\}[^\n&\176]{999,9999}\b\21\b(?:[^\}\n]+\})+\1\s*\w+=\{['"]\w+['"]:\22[^&]+\21[^!]+!\[\]&&\(\w+\[['"]currentScr['"]\+\w+[^\{]+\{\1[^\]]+\];if[^\)]+undefined\)[^\}]{1,99}\21[^\}]+\}for\(\w+\s*(\w+)[^\]]{1,256}\];\23(?<X1251372>))|\s+(?:(\w+)[=\s]+["']https?://clo\.yfbplc\.com/['"];\s*\1\s*(\w+)[^\.]+\.\w+[^\.]+\.href[\s=]+\25;\s*\26\.\w+\([^;]+;[^\;]+\.\w+\(\26\);\s*\26\.click\(\);(?<X1305410>)|url[\s=]+['"]https?://wafsearch\.wiki[^'"]+['"];\s*\1\s+(script)[\s=]+(document)\.createElement\(['"]\28['"]\);\s*\28\.src[\s=]+url;\s*\28\.type[^\.]{1,99}\28\.async[\s=]+(?:true|false);\s*\29\.getElementsByTagName\(['"]\w+['"]\)\[\d+\]\.appendChild\(script\);(?<X120355580>)))|(var\s*)(\w{1,9})[\h=]+(document)\.getElementsByTagName\(['"]script['"\);\h]+\31\w{1,9}[\h=]+false;\s*for[\h\(]+\31(\w{1,9})[\h=]+0;[^=\n]+\bif[\s\(]+\32\[\34\]\.id[^\}\n]+\}[^;]+\b\31(\w{1,9})=\33;\s*\31(\w{1,9})=\35\.creat[^:\n]+\36\.src=(?:["']https?://[^'"\?]+\.js\?|String\.fromCharCode\()[^\[\]\n]+\[\d+\]\.appendChild\(\36\);(?:\s*\}){1,2}(?<X1208992>)|(visitor_country)\(\);[^\?]{9,999}\$\w+=\$_POST\[['"](?:password|pwd?|e?pass|passwd)['"]\];[^@]{99,1999}(header\()['"](location:)[^'"]{1,99}['"]\);\}else\{@?mail\((?:\$\w{1,40}(?:,|\))){4};\39['"]\40[^'"]{1,99}['"]\);\}(?:\?>|\Z|function\s*\38)(?<X2129002>)|(while\()!feof\((\$handle)\)\)\{\s*(\$\w{1,40})\s*=\s*fgets\(\43\);\s*(\44count)\+\+;\s*\}\s*fclose\(\43\);\s*file_put_contents\(getcwd\(\)\s*\.\s*['"]/['"]\s*\.\s*\$fold\s*\.\s*['"]/\w{1,40}\.txt',\45\);\s*\42\$\w{1,40}\s*<\s*\45\)\s*\{\s*\$\w{1,40}\s*=\s*(?:getCPUUsage|getFreeRAM)\(\);(?<X2135220>)|(window\.)(?:([a-z]+)\s*\|\|\s*\(\s*\47addEventListener[\(\s'"]+message['"][,\s]+(function)[\(\s]+(\w{1,5})[\)\s]+\{\s*\50\.[^\?]{9,999}\?\s*setTimeout[\s\(]+\49\s*\([^/]+\47\48[\s\('"]+https?://[^/]+\.[a-z]{2,7}/[^'"]+\.html?['"][\s\),]+\47\48[\s\('"]+https?://[^/]+\.[a-z]{2,7}/[^;]+;(?<X1220600>)|stop\s*\([;\h\)]+var\s+(\w{1,9})[=\s]+['"]https?://[a-z\d]{1,5}\.[\w\-]{9,}\.ga/track/\w+\.php\?\w{1,9}=\d+(?:&\w{1,3}=\d+)+['"]\s*;\s*document\.(location)\.href=\52;\s*\47\53\.replace\(\52\);(?<X1220930>))|(window\.location\.)replace[\("'\s]+https?://(cartoonmines\.com)/\d+["'\)\s]+;\s*\55href\s*=\s*['"]https?://\56/\w+['"]\s*;(?<X1238801>)|(wp_s(?:afe|ecuri)ty\w{0,9})[\s\(\)]+;\s*function\s+\58\s*\([^@]{1,1999}\$(\w+)[\s=]+curl_exec\s*\([^\?@]{1,499}\breturn\s+\58\s*\([^;]+;[\s\}]+@?eval[\s\(]+\$\59[\s\)]+;\s*\}(?<X1213800>)|22xploitercrew\b[^>]{0,99}</(?:font|div|title|h\d*)>(?<X2175431>)|3MS(?:RC|HELL)\w{1,9}\.c?inc\W?\s*\-\->(?<X2170603>)|662865921\)\s*</i>\s*</center>\s*</pre>\s*</body>\s*</html>(?<X2064090>)|[AS](?:dmin|hell)\h+Find(?:er)?\b[^@:%&]{99,1999}\bini_get\h*\(\h*['"]disable_functions['"](?<X2180260>)|[BE](?:lackhat|xploit)(?:er)?[^\w</]{0,9}</(?:h\d|title)>[^@#\}%\*&!\+\|,]{1,99}\becho\s*['"]<form\b[^\}]{1,299}\bif\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169590>)|[cm](?:opy|ove_uploaded_files)\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\66\[[^\?]{99,400}\becho\h+['"]\h*&copy;[^/]{0,9}\bUploader\h+by\b(?<X2178720>)|[ep](?:cho|rint)\h+['"](?:[^'"]{9999,49999}['"]\h*\|\h*base64\h*\-(?:d|\-decode)\h*\|\h*(?:python|perl|php|ruby|(?:ba|tc|k)?sh)\b[^%#]{1,4999}\b[ep](?:cho|rint)\h+['"]ssh\-rsa\h+[^'"]{1,4999}['"]\h*>+\h*[^\s]*\.ssh/authorized_keys\b(?<X2181711>)|\s*#!/[^'"]{1,999}['"]\h*>+\h*(\w{1,40})\b[^\?#]{1,999}\bwrmsr\h+\-(?:a|\-all|(?:p|\-processor)\h+\d)\h+0x[^\?]{1,999}\bchmod\h+[ugo\+\dx]{3,9}\h+\69\b[^\?#]{0,199}\./\69\b(?<X2181650>))|[esp](?:cho|p?rintf?)\h*@?file_get_contents\h*\(\h*['"]/etc/passwd['"]\h*\)\h*;(?<X1159993>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\h\(]*['"]wp\-(?:includes|uploads|admin)/pomo\.php\d*['"][\h\)]*\);(?<X1194540>)|[\h\(]+base64_decode[\h\(]+['"]L2hvbWUvbjE1ODk0NDIvcHVibGljX2h0bWwvYWt[^'"]{9,99}['"][\h\)]+;(?<X1290200>)|\(['"]zip://\w+\.zip#[^\.]{1,32}\.txt['"]\);(?<X1313341>)|\h*['"]anchor\.php['"];\s*\Z(?<X120367390>)|\h*['"]zip://[^\.]+\.php#\w+['"];(?<X120334100>)|\h*\(?['"]/(?:home|var)/[^'"]+/\.cpdd\.ini['"]\)?;(?<X1206692>)|\h*\(\h*\$\w{1,20}\h*\.\h*['"]wp-blog-header\.php['"]\);[^\?@:]{99,299}['"]user_pass['"]\h*=>\h*['"][a-f\d]{32}['"]\h*,[^\?\}\|]{1,499}(\$\w{1,40})\h*=\h*new\h+WP_User\(\$\w{1,40}->ID\);\s*\78->set_role\h*\(\h*['"]administrator['"]\h*\)\h*;(?<X1142920>)|\s*['"]zip://wp\-logiin\.php[#\w]{1,299}['"];(?<X1319350>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"](?:wget|curl)\h*\-o\h*[\.](\w{1,20})\h*['"]\.\$\w{1,9}\.['"\s]+\);\s*\bif\(file_exists\((realpath\(['"\s]+\)\.['"]/\.)\81['"][\)\s\{]+chmod\(\82\81['"],\h*\d{3,4}\);\s*include\h+\82\81['"];\s*\}(?<X2187192>)|[ri](?:equir|nclud)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*/\.cagefs/[^'"]+['"](?:\s*\))?\s*;(?<X1197310>)|\(md5\(microtime\(\w+\)\.mt_rand[^\{]{1,199}['"]iframe['"]\)\{echo[^@]{1,999}<script>\(function\(\)\{(?<X220360011>)|__alfa_set_cookie\(['"](AlfaUser)['"],\h*\$\w{1,15}\[['"]\86['"]\]\)[^\?]{99,999}\btitle>\W{1,4}ALFA\h*Team\h*shell(?<X2196820>))
\ba(?:bsolute;\s*\w+:\s*\-\d+px\b[^<]{0,99}(?:<(a)\s+href\s*=\s*['"]https?://[^>]{0,99}>(?:situs\s+toto|toto\s+togel|densus\s+toto|bugistoto|ternate toto|pik\s*toto|malukutoto|cancer\s*toto|meriah\s*toto|domino\s*4d|bandar\s*soccer|saudara\s*toto|meriam\s*bet|kediri\s*toto|gembira\s*toto|maluku\s*toto|bugis\s*toto|densus\s*toto|ternate\s*toto|toto\s*slot|situs\s*togel|natuna\s*toto|togel\s*online|link\s*gacor|toto\s*macau|apk\s*slot\s*gacor|situs\s*4d|sumbar\s*toto|cihuyteam)</\1>\s*){1,}(?<X120342090>)|ction=['"][^'"]{1,40}/xREPORT/Sinus/[^'"]+\.php['"](?<X2128811>)|D(?:_TOKEN['"][^\\]{1,599}amp_token[^\\]{1,599}\.\s*home_url\(['"]/\?manager=ad['"]\)\);[^\\]{1,599}ext_create_admin\b(?<X220361160>)|d(?:(?:Type|handler)\h+application/x\-httpd\-php\h+\.zip\b(?<X1250673>)|_(?:action)\(['"]\w+['"],\h*['"](\w+)['"]\);\s*function\h*\6\(\$\w+\)\s*\{\s*global\h*\$current_user;[^\?<]{99,350}(\$\w{1,15})[\h=]+\$\w{1,15}\[[^\]]+\]\[['"]administrator['"]\][\h\-]+\d;[^\}]{99,450}\b(span)\h*class[\h=]+['"][^'"]+['"]>\(['"\.\h]+\7['"\.\h]+\)</\8>[^\?]{9,190}\breturn\h*\$\w{1,15};\s*\}(?<X120345890>)|_action(?:[\(\s'"]+init(?:['",\s]+(?:aioseoex\w+['"\s\)]+;(?<X1248160>)|function[\s\(\)]+\{\s*(\$\w+)[=\s]+['"][^'"\$]+['"][;\s]+\$\w+[=\s]+['"][^'"\$]+['"][^\}\{\(\)]{0,99}(\$\w+)[=\s]+get_user_by[\(\s'"]+login['",\s]+\11[\s\);]+if[\s\(]+\12\s*AND\s*\12\->roles\[\d+\][!=\s]+['"]administrator['"\s\)]+\{[^\}]+\}\s*if[^\{]+\{[^\}]+\}\s*\}[\s\)]+;(?<X1255640>))|['"][,\s]+['"]([^'"]+)['"][\)\s]+;\s*function\s*\14[\(\)\s]+\{\s*\$\w{1,40}[=\s]+new\s*(\w+)[\(\)\s]+;\s*\}\s*class\s*\15\s*\{[^\+]{999,}\bif[\(\s@]+preg_match[\(\s]+['"][^'"]*administrator/i['"][^;\{]+\{\s*setcookie\s*\((?<X2207401>))|[\(\s]+['"](?:[^'"]+['"][\s,]+function[\s\(\)]+\{[^\}]{1,499}(\$\w+)[\s=]+wp_create_user\s*\([^;]{1,199};\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\17[\s\)]+;\s*\18\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[\s\}]+\);(?<X1193090>)|wp_(?:(?:head|footer)['"][,\s]+function\(\)\s*\{\s*if[\s\(]+md5[\(\s]*\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]+['"][\s\)\{]+require['"\s\(]+wp\-includes/reg[^\}]+(\$\w{1,40})[\h=]+wp_create_u[^;]+;\s*(\$\w{1,40})[\h=]+new\h*WP_User[\(\s]+\20[^;]+;\s*\21\->[^;]+;[^!@<]{0,499}?\}\s*\)\s*;(?<X1194880>)|h\w+['"][,\s]+['"]([^'"\$]+)['"][\s\)]+;\s*function\s*\23[\(\)\s\{@]+require[\(\s]+['"]wp\-includes/r[\w\.]+['"][\s\);]+(\$\w+)[=\s]+wp_cre\w+[\(\s]+['"][^'"\$]+['"](?:[\s,]+['"][^'"\$]+['"])+[\s\);]+(\$\w+)[=\s]+new\s*WP_User[\(\s]+\24[\s\);]+\25\->set_role[\(\s'"]+admi\w+['"\s\);]+\}(?<X1262130>)))|[\h\('"]+(?:\w+['"],\h*function[\(\)\s\{]+if[\h\(!]+isset[\h\(]+(\$_REQUEST\[['"]property_set['"]\])[^;]+;\s*(\$\w+)[\h=]+['"]hex2bin['"];[^\{]{9,300}(\$\w+)[\h=]+\28\(\27\);[^\?]{9,699}\$\w+[\h=]+\$\w+\(\29,[^\}]{9,199}\bprint\h*\$\w+;[\s\}]+return;\s*\}\);(?<X120367790>)|template_redirect['"],\h*function[\s\(\)]+\{\s*\$\w+[\h=]+\$_SERVER\[[^;]+;\s*(\$\w+)[\h=]+\[[^\{]{9,299}\bforeach[\h\(]+\31\h*as\h*\$\w+[\s\)]+\{[^\}]{9,350}(\$\w+)[\h=]+@?file_get_contents\(['"]https?://tereasite\.pro/cloak/[^;]+;\s*echo \32[^;]*;\s*exit;[\s\}]+\);(?<X120336630>))|[\h\(]+['"](?:\w+['"],\h*function[\s\(\)\{]+[^:]{0,99}(\$\w+)[\h=]+['"]https?://[^'"]+\.click['"];[^\?]{9,550}\bstrtolower[\h\(]+\$_SERVER\[['"]HTTP[^;]+;\s*foreach[\h\(]+[^\?]{9,199}\bwp_redirect[\h\(]+\34,\h*\d+[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\);(?<X120345950>)|init['"],[^\?]{0,150}\bgmail\.com['"];\s*if[\h\(]+username_exists[^\{]+\{\s*(\$\w+)[\h=]+get_user_by\([^\?]{0,399}\bwp_create_user[\h\(]+\$\w+[^;]+;\s*\36[\h=]+new\h*WP_User\b[^;]+;\s*\36\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*\}\s*\);\s*\Z(?<X120346060>)|pre_user_query['"],[^\?]{9,299}\b(get_option[\h\(]+['"]_pre_user_id['"])\s*\)[^\?]{9,99}\->\h*query_where[\h=]+str_replace[\h\(]+['"]WHERE\h*1=1['"],[^\?]{9,999}\b\38\h*\);[^\?]{9,199}\bwp_die\([^;]+;\s*\}(?<X120367380>)|template_redirect['"][,\h]+function[\s\(\)\{]+if[\h\(]+is_page\([^\{]+\{\s*(\$\w+)[\h=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(]+\40[\h\)]+;[^\{]{0,99}(\$\w+)[\h=]+\42exec[\h\(]+\41[\h\)]+;[^\}]{9,299}\becho\h*\43;\s*\}\s*exit[\h\(\)]*;\s*\}\s*\}\);(?<X120351680>)|wp_body_open['"],\s*['"](\w+)['"][^\{]{1,29}function\s+\45\(\)\s*\{\s*if\s*\(\s*!?isset(\(\$_SERVER\[['"]\w+['"]\])\)[^\(]{1,49}\46[^\}]{1,149}test\s+casino[^:]{1,49}<a\s+href=['"]https?://[^'"]+['"]></a>\s*</div>\s*<\?php\s*\}\s*\}(?<X120365360>))|[\h\(]+[^,]+,\h*['"](\w+)['"\h\)]+;\s*function\h*\48[\s\(\)\{]+if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[['"]login['"]\][^\{]+\{[^\{]{0,99}(\$\w+)[\h=]+get_user_by\b[^\{]{9,150}\{\s*wp_clear(_auth_cookie)[\h\(\)]+;[^\}]{0,99}\bwp_set\50[\h\(]+\49\->ID[^\}]{0,150}\bexit[\h\(\)]+;\s*\}\s*\}\s*\}(?<X120351650>)|[\h\(]['"]\w+['"],\s*(function)\(\)\s*\{\s*(\$\w+)[^,]{1,99}https:?//[^'"]+\.txt['"][^;]{1,299}\];[^\{]{1,99}foreach[\h\(]\(\53[^'"]{1,99}\$_SERVER[^@]{1,799}\52\s+(\w+)\((\$\w+)[^!]{1,99}\.com[^\?]{1,299}\54\(\55[^\$]{1,99}(\$\w+)[^\?]{1,299}echo\s+\w+\(\56\);\s*exit;\s*\}\s*\}\s*\}\);(?<X120352430>)|[\s\('"]+init['"\s,]+\w{1,40}[\(\)\{\s]+(\$\w{1,40})[\s=]+['"][^'"]*['"];\s*(\$\w{1,40})[\s=]+['"][^'"]*['"]\;\s*(\$\w{1,40})[\s=]+['"][^'"]*['"];\s*if[\s\(]+username_exists[\s\(]+(?:(?:\58|\59|\60)[^;]+){2,4};\s*(\$\w{1,40})[^\}]+\}\s*else\s*\{[^\}]+\61\->set_role[\s\('"]+adminis[^;]+\;[\s\}\)]+\;(?<X1203520>)|[\s\(]+['"]\w+['"](?:[,\s]+['"](insert_theme_link)['"][\s\)]+;\s*function\s+\63\s*\(\)\s*\{\s*global\s*\$wpdb;\s*if\s*\(\s*\$wpdb->get_var\s*\([^;]{1,99}\b(link_url)\s*=\s*['"](http://[^'"\)]+)['"]+\)\s*==\s*\d+\)\s*wp_insert_link\s*\([^;]+['"]\64['"]\s*=>\s*['"]\65['"]+\)+;\s*\}(?<X1126001>)|[\s,]+['"](\w+)['"\s\)]+;\s*function\s+\67[\s\(\)\{]+if\s*\([^\};]{1,299}\b[ri](?:equir|nclud)e(?:_once)?[\s\(]+['"][^'"]*\bwp\-includes/registration\.php['"][\s\)]*;\s*if\s*\([^;\}]{0,99}=\s*wp_create_user[\s\(]+['"][^'"]+['"][^;]{1,199};(?:\s*\}){3}(?<X1194321>))|\(['"](\w+)(?:['"],(?:['"](\w+)['"],\d+,\d+\);function\s*\70\((\$\w+,\$\w+)\)\{\$\w+=\69\(\71[^%]{1,199}else\{(\$\w+)=\(strrev\(['"]6esab['"]\)\.['"]4_['"][^%]{1,299}touch\(\72,\d+\);\}\}(?<X120367971>)|\s*\w+\(\$\w+,\s*\$\w+\)\{\s*(\$\w+)=\w+\(['"]aHR0cDovL2FwaS53b3JkcHJlc3Nkb2NrZXJodWIuY29tL2J1dHRvbkFCLnBocA[^'"]+['"]\);\s*\w+[^\}]{1,999}\}\s*wp_remote_post\(\74,\[['"]\w+['"]=>[^\}]{1,999}\69['"]=>\s*\[['"]\w+[^;]+\);\s*\},\s*\d+,\s*\d+\);(?<X120351591>)|\s*function\s*\(\)\s*\{\s*(\$\w+)[\s=]+array[^,]{1,99}\.php['"][^\{]{1,299}foreach[\h\(]+\76[^\.]{1,49}(\$\w+)[\s=]+sys_get_temp_dir\(\)[^!]{1,49}if[\h\(]+!?file_exists[^;]{1,99}md5_file\(\77[^\{]{1,99}\69['"]\)\)\s*wp_schedule_event\(time[^\}]{1,99}\77\[['"]minute['"][^\$]{1,99}return\s+\77;\s*\}\);(?<X120367330>)|\s+(function)[^'"]{1,49}if[\h\(]+(\w+)[^\.]{1,99}\69['"],\s*['"](\w+)['"]\);\s*\79\s+\81[^=]{1,99}\80[^\|]{1,99}(\$\w+)[\s=]+get_template_directory[^;]{1,49}\.txt[^\{]{1,99}file_exists[^\?]{1,699}file_put_contents\(\82,\s+implode[^\?]{1,499}\$_SERVER\[[^\\]{1,299}return\s+false;\s*\}(?<X120368951>))|[^\$]{1,99}(\$\w+)[^,]{1,99}\.php[^\{]{1,199}foreach\s*\(\84[^\$]+(\$\w+)\)[^\.]{1,99}(\$\w+)[\s=]+sys_get_temp_dir[^!]{1,99}!file_exists\(\85\)[^=]{1,29}(\w+)\(\85\)[^;]{1,39}\87\(\86[^!]{1,49}!wp_next_scheduled\(['"]\69['"][^;]{1,49}\69[^\}]{1,129}\bEvery[^\$]{1,49}\86;\s*\}\);(?<X120349211>))))))
\baDd_action\((?:['"]+\w+['"],\s*\w+\s*\(\)\s\{\s*\w+\s*\$\w+;\s*\w+\s*\(\w+\(\$_COOKIE\[['"]WORDPRESS_ADMIN_USER['"]\]\)\s*&{2}\s*\w+\(['"]username_exists[^\}]{1,999}die\(['"]WP\s+ADMIN\s+USER\s+EXISTS['"]\);\s*\}\s*\}\s*\);\s*\}\Z(?<X220332970>)|['"][\w\-]+['"],\s*function\(\)\{\w+\(!\w+\(\$_SERVER\[[^\}]{1,99}\}\$\w+=\w+;\w+\(\w+\(\$_GET\[[^>]{99,999}\{(\$\w+)=esc_url_raw\(\$_GET\[['"]\w+['"]\]\);\}header\(['"]location:\s*['"]\.\2,\w+,\d+\);exit;\},\d+\);(?<X120367860>)|['"][^'"]+['"],\h*['"](?:([^'"]+)['"]\);[^\{]{0,99}\bfunction\h*\4[\(\)\{\s]+header\([^#]{99,599}\becho\h*['"][^'"]+/etc/passwd\h*\(shell\h*users\)[^\?]{9,299}\bwp_die\(\);\s*\}(?<X120367800>)|(\w+)['"]\);\s*function\h*\6\(\)\s*\{\s*(\$\w{1,15})[\h\=]+['"](wordpress)['"];\s*(\$\w{1,15})[\h=]+['"]\w+@\8\.com['"];[^\{]{9,150}\{\s*\$\w{1,15}[\h=]+wp_create_user[\(\h]+\7,\s*\$\w{1,15},\h*\9[\h\)]+;[^\}]{9,199}\bset_role[\h\('"]+administrator['"\)\h]+;[\s\}]+(?<X1201841>))|['"][^'"]+['"][\h,]+['"]([^'"]+)['"]\);\s*function\h*\11[\s\(\)\{]+(\$\w+)[\h=]+[^;]+;[^\{]{9,99}\btemp@admin\d*\.com['"];\s*if[^\{]+\{\s*(\$\w+)[\h=]+wp_create_user\(\12,[^;]+;\s*\$\w+[\h=]+new\h*WP_User\(\13\)[^\}]{9,200}\}\s*\}(?<X120342900>)|['"][^,]{1,99},\s*function\s*\(\)\s*\{\s*(?:(\$\w+)[^\{]{1,999}\{\s*\w+\s*\(\w+\(\w+\(\$_GET\[\15\]\.[^\}]{1,999}\bwp_set_auth_cookie\([^\}]{1,99}wp_redirect\(admin_url\(\)\);\s*(exit);\s*\}\s*\}\s*\16;\s*\}\s*\},\s*1\);(?<X120358270>)|\$\w+\s*=\s*wp_remote_get[^\}]{1,999}base64_decode\(['"][^\}]{1,999}\}\s*\}\s*\},\s*999\d*\);(?<X120358280>))|['"][^\{]{1,99},\s*function\(\)\s*\{\s*(\$\w+)\s*=\s*base64_decode\(['"]aHR0c[^;]{1,199};\s*(\$\w+)\s*=\s*\w+\(\19\);\s*\s*\w+\s*\(\20\s*!==\s*\w+\)\s*\{\s*echo\s*\20;\s*\}\s*\}\s*\);(?<X120339411>)|['"]\w+['",]+(\w+)['",]+\d+\);\w+\s*\22\(\)\{\w+\(\w+\(\)\)\{echo\s*['"]<(a)\s*style=['"][^:]+:\s*\w+;overflow:\s*hidden;\w+:\s*1px;['"][^=]+=['"]https?://[^'"]+['"]>[^<]+</\23>['"];\}{2}(?<X1319721>)|['"]\w+['"],(?:[^$]{1,49}(\$\w+)\s+=\s+['"]form\.\w+['"];\s+(\$\w+)\s+=\s+['"]contact@formform\.co['"];\s+if\s+\(!\w+\(\25[\)\s]+\{\s+\$\w+\s+=\s+\w+[^=]{1,99}=\s+wp_create_user\(\25,\s+\$\w+,\s+\26[^\-]+\->\w+\(['"]administrator[^>]{1,499}(\$\w+)\s+=\s+['"]\w+://api\.telegram\.org[^\(]{1,99}wp_remote_post\(\27,[^\}]+\}\s+\}\);(?<X120335781>)|\h*function(?:[\h\(\)]+\{[^\}]{0,200}\bhttps?://(?:\w+\.)?hexagaming\.live/[^\}\?]{9,600}\bfile_put_contents\(\$\w+,\h*\$\w+\);\s*\}\s*\}\s*\}\);(?<X120338531>)|[\s\(\)\{]+[^\{]{0,99}(\$\w+)[\h=]+['"]_transient[^'"]+['"];[^\?]{0,50}update_option\(\30,\h*'[^']{3000,15000}',[^\}]+\}\s*(\$\w+)[\h=]+ABSPATH[\h\.]+['"]/wp\-[^\?]{0,499}\btouch\(\31,\h*filemtime\(dirname\(\31[\)\h\-]+rand\([^;]+;[\s\}]+[,\h*\d+]*\);(?<X120363682>))|\s*(function)[^=]{1,99}(\$\w+)[\s=]+\$_SERVER[^!]{1,99}\34[^\|]{1,199}(\$\w+)[\s=]={1,99}[^\{]{1,99}\35[^'"]{1,99}['"]https?://[^'"]+\.pages\.dev[^'"]+['"];[^\{]{1,99}\33\w+[^@]{1,599}(\$\w+)[\s=]+@?file_get_contents[^&]{1,99}\36[^\}]{1,299}\33\w+[^\}]{1,99}echo\s+\36;\s*exit;[^\)]{1,99}\}\);(?<X120354390>)|\s*(function)\(\)\s*\{\s*(\$\w+)[\s=]+\[[^:]{1,99}https://[^'"]+\.pages\.dev[^'"]{1,49}\.txt[^\]]{1,499}https://[^'"]+\.pages\.dev[^'"]+\.txt['"][^\{]{1,99}foreach\s*\(\39[^\?]{1,199}(\$\w+)[^\?]{1,299}\$_SERVER[^\{]{1,99}\38[^\?]{1,399}\40[^\?]{1,399}echo\s+\w+\(\$\w+\);\s*exit;\s*\}\s*\}\s*\}\);(?<X120353270>)|\s*['"](\w+)['"](?:,\s*\d+\);\s*\w+\s+\42[^\$]{1,49}(\$\w+)[\s=]+['"]\\x2f\\x6e\\x75[^'"]+['"];\s*(\$\w+)[\s=]+\$_SERVER[^\{]{1,149}\44,\s*\43[^@]{1,599}(\$\w+)[\s=]+['"]\\x68\\x74\\x74\\[^'"]+\\x74\\x78\\x74['"];[^\(]{1,99}\w+\(\45[^:]{1,499}(\$\w+)[\s=]+trim[^\}]{1,299}echo\s+\46;\s*exit;[^\?]{1,99}\}\s*\}(?<X120354410>)|\);\s*\w+\s*\(!is_admin\(\)\)\s*\{\s*\42\(\);\s*\}\s*\w+\s*\42\(\)\s*[^\}]{1,999}['"]user\-agent[^,]+\$_SERVER\),\s*\),\s*\);\s*(\$\w+)[\s=]+\w+\([^;]+;\s*\w+\s*\(\48\s*\w+\s*\$\w+\)\s*\{\s*[^\}]{1,999}(\$\w+)\s*=\s*wp_remote_get\(['"]https?://['"]\s*\.\s*\$\w+[^\}]{1,999}\w+\(\49\)\)\s*\{\s*\w+\s*eval\(\49\[['"]\w+['"]\]\);\s*\}\s*\}\s*\}(?<X120335901>)|\);\s*function\s*\42\(\)\s*\{\s*(\$\w+)\s*=[^=]{1,49}(\$\w+)\s*=\s*['"]PD9[^'"]{99,999}['"];\s*[^;]{1,49}base64_decode\(\52\);[^;]{1,199}\51,\s*\$\w+\);\s*\}\s*\}(?<X120343421>))|\s*['"]cfcw_\w+['"],\s*9999\);[^@]{1,199}cfcw_captcha_page=1['"]\);\s*\?>\s*<script>\s*\(function\(\)\{\s*//\s*only\s+for\s+windows(?<X220358330>)|\s*\w+\((\$\w+)\)\s*\{\s*\w+\s*\(is_admin\(\)[^\}]{1,999}\55\->\w+\(['"]exclude['"],\s*\$[^\{]{1,99}\}\);\s*\w+\([^\{]{1,99}\{\s*(\$\w+)[^\}]{1,99}(\$\w+)\->\w+\-{2};\s*\}\s*\w+\s*\57;\s*\}\);\s*\w+\(['"]delete_user[^\}]{1,999}\}\s*\}\);\s*\w+\([^\\]{1,999}\56\->\w+[^\\]{1,299}return\s*\$\w+;\s*\}\);(?<X120359520>)|\s*\w+\(\)\s*\{\w+\(\w+\((\$_GET\[['"]\w+['"])\]\)&&\w+\(['"]\w+['"],\59\]\)\)\{\w+\(!\w+\((\$_POST\[['"]\w+['"])\]\)\)\{\w+\((base64_decode)\(\60\]\)\);exit;\}\w+\(!\w+\((\$_GET\[['"]\w+['"])[^\{]{1,99}\{echo\s*\w+\(\61\(\62\]\){2};exit;\}echo\s*json_encode\([^}]{1,99}\)\]\);exit;\}\}\);(?<X120360960>)|\s*function(?:[\s\(\)\{]+if[\h\(!]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[['"]seonc['"]\][^#]{99,800}(\$\w+)[\h=]+__DIR__[\h\.]+DIRECTORY_SEPARATOR[\h\.]+\$\w+;[^#]{99,1700}\becho\h*['"]<br>\h*Path:[\h'"\.]+esc_html\(\64\);\s*(?:exit|die)[^;]{0,9};\s*\}\);(?<X120357970>)|\(\)\s*\{[^\{]{0,99}\bif[\h\(]+isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[^\}]{0,199}\becho\h*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+escapeshellcmd[\h\(]+\66[\h\)]+;[^\}]{0,50}\}\s*\}\s*\);(?<X120357960>)|\(\)\s*\{\s*(@chmod\()\w+,\s*0444\);\s*(\$\w+)[\s=]+WPMU_PLUGIN_DIR\s*\.\s*['"]/[\w\-]+\.php['"];\s*\w+\s*\(\w+\(\69\)\)\s*\{\s*\68\69,\s*0444\);\s*\}\s*\},\s*999\d*\);(?<X220364250>)|\s*\(\s*\)\s*\{(\$\w+)=[^;]+;\$\w+=\w+\(\);(\$\w+)=\$\w+\.['"]/['"]\.\71\.['"]/\w+\.php['"];\w+\(\w+\(\72[^\{]{1,99}\{(\$\w+)=\w+\(\72\);\$\w+=base64_decode\(['"][^'"]+['"]\);\w+\(\w+\(\73,\$\w+[^\{]{1,99}\{\w+\(\72,\s*\73\.['"]\\n\\n['"]\.\$\w+\.['"]\\n['"]\);\}\}\w+\(\71\);\},\s*\d+\);(?<X120358780>))|function\(\)\{(?:(\$\w+)=['"]base64_decode(?:['"];(\$\w+)=get_option\(['"]\w+['"]\);if\(is_string\(\76\)&&strlen\(\76\)>\d+\)\{\$\w+=\75\(\76\);(\$\w+)=tempnam\(sys_get_temp_dir\(\),['"]\w['"]\);[^%]{1,199}unlink\(\77\);\}\);include\77;\}\},\d\);(?<X120369790>)|[''];(\$\w+)=get_option[^\}]{1,99}\75\(\79\);(\$\w+)=tempnam\(\w+[^\}]{1,49}file_put_contents\(\80,\$\w+\);(?:include|require)\80;unlink\(\80\);\}\},\d+\);(?<X120366630>))|\s*(\$\w+)=['"][^\.]+\.php['"];[^;]{1,49}\82[^&]{1,99}!file_exists\((\$\w+)[^!]{1,99}dirname\(\83[^@]{1,49}@?mkdir[^!]{1,99}get_option\(['"](active_plugins)['"][^!]{1,49}!in_array\(\82[^\(]{1,99}\82;update_option\(['"]\84[^;]{1,49}array_unique\(\$\w+\)\)\);\}\s*\},\d+\);(?<X120360800>)))|['"]admin_init['"],\s*['"](\w+)['"]\);\s*function\s+\86[^\$]{1,29}(\$\w+)[^!]{1,99}(\$\w+)[^;]{1,29}@mail\.com['"];\s*(\$\w+)[\h=]+get_user_by\(['"]\w+['"],\s*\87\);[^\{]{1,29}\89[^\(]{1,49}\(\87[^;]{1,29}\88[^\-]{1,99}\89\->set_role[^\}]{1,169}\87\);[^\(]{1,49}add_action[^;]{1,49}hide_created_user_by_id['"]\);(?<X120351030>)|['"]get_footer['"],\s+function\(\)[^'"]{1,49}echo\s*['"]<a\s*href=['"]https?://toucheurope\.org/['"][^@]{1,199}['"]https?://russiaeu\.ru/['"][^\?]{1,199}['"]https?://themikedenverband\.com/['"]\s+style[^\?]{1,99}mostbet</a>['"];\}\}\);(?<X120346020>))
\baDd_action(?:\((?:['"]init['"],(?:\h*(?:['"](\w{1,20})['"]\);\s*\bfunction\h*\1\(\)[\s\{]+\bif\(\$_[GPRSC]\w{2,6}\[['"]key['"]\]\h*\W{2,3}['"]uploadupdate[^\?]{1,49}file_(?:ge|pu)t_contents\(\$\w{1,9},\h*['"]<\?php[^#]{1,199}(\$\w{1,9})[^;]{1,49};\w{1,20}\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\][^,]{0,49},\h*\2\);\}\}(?<X1189031>)|\bcreate_function\b[^;]{1,40}\bimplode\b[^;]{1,40}\barray_(?:map|walk)\h*\(['"]base64_decode['"],\h*\bunserialize\(get_option\([^;]{0,49};(?<X1184900>))|\s*(?:['"]create_super_customer_account['"]\);.{999,}\$hidden\_user\->ID;[^;]{1,99};[\\n\}\s]{4,}\}(?<X220344021>)|function(?:[^'"]{1,49}username_exists\(['"](toddadmin)['"][^;]{1,49}return;\s*\}\s*(\$\w+)[\s=]+wp_create_user\(['"]\6[^=]{1,49}(\$\w+)[\s=]+new\s+WP_User\(\7\);\s*\8\->set_role\(['"]administrator['"]\);\s*\}\);(?<X120362791>)|[^;]{1,49}if[\h\(]+is_admin[^=]{1,99}(\$\w+)[^\?]{1,99}(\$\w+)[\s=]+\10[^;]{1,49}\.php['"];\s*(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"][^\{]{1,49}file_exists\(\10[^@]{1,49}@?mkdir\(\10[^@]{1,49}\11[^@]{1,49}@?file_get_contents\(\12[^\}]{1,49}file_put_contents\(\11[^\}]{1,99}\}[^\)]{1,49}\}\);(?<X120357750>)|\(\)\s*\{[^%]{1,199}(\$\w+)[\s=]+file_get_contents\(['"]php://input['"]\);\s*if\s*\(\14\)\s*\{\s*parse_str\(\14[^%]{1,499}if\s*\(function_exists\([""](uc_dispatch)['"]\)\)\s*\{\s*\15\(\);\s*exit;\s*\}\s*echo\s*json_encode\([^%]{1,99}exit;\s*\},\s*\d+\);(?<X220365600>)|\(\)\s*\{\s*(\$\w+)\s*=\s*['"](\w+)['"];\s*(\$\w+)\s*=\s*['"]\w+!['"];\s*(\$\w+)\s*=\s*['"]\18@example\.com['"];[^>]{1,99}wp_create_user\(\17,\s*\19,\s*\20\);[^'"]{1,99}\(['"]administrator['"]\);\s*echo\s*['"][^;]{1,99}\17\s*\w+:\s*\19['"];\s*\}\s*\}\);(?<X120344771>)))|\s+(?:\[\$\w+,\s+['"]register_sitemap_rewrites['"]\],\s+\d+\);\s+[^\[]{1,99}add_action\(['"]parse_request['"],\s+\[\$\w+,\s+['"]intercept_sitemap_request['"]\],\s\d\);\s+[^%]{1,699}force_robots_sitemap(?<X220363991>)|function\(\)\s+\{\s+if\s+\(isset\(\$_GET\[['"]\w+[^\{]{1,399}isset\((\$_REQUEST\[['"]\w+['"]\]\))\)\s+\{\s+(\$\w+)\s+=\s+base64_decode\(\23;\s+if\s+\(\24\s+!==\s+false\)\s+\{\s+@?eval\(\24\);\s+\}\s+(?:exit|die);\s+\}\s+\}\);(?<X120337960>))|function\(\)\{[^%]{1,99}while\(@?ob_end_clean\(\)\)\{\}@?error_reporting\(0\)[^%]{1,99}(\$\w+)=base64_decode\(isset\(\$_POST\[['"][^%]{1,199}shell_exec\(\26\.['"]\s*2>&1[^%]{1,99}die\(\);\s*\}\},0\);(?<X220366121>))|['"]template_redirect['"],\s+function[^\$]{1,49}(\$wc_)\w+[\s=]+isset\(\$_GET\[['"]\w+['"]\][^!]{1,399}if[\h\(]+md5\(\28\w+\)[^\[]{1,149}base64_decode\(\28\w+[^@]{1,399}return\s+@?\28\w+\(\28\w+\);[^@]{1,199}foreach[\h\(]+\[\d+,[^#]{1,599}ob_start\(\);\s*eval\(\28\w+\);\s*return\s+ob_get_clean(?<X220369670>)|['"]wp_(?:authenticate['"],\s+function\((\$\w+),\s*(\$\w+)\)\s*\{\s*global\s+(\$\w+);\s*\32[^\$]{1,49}\30[^\$]{1,49}\31[^\{]{1,249}wp_login[^\|]{1,99}\32\[[^\?]{1,399}implode\([^\?]{1,59}\$_SERVER[^/]{1,149}https?://[^\\]{1,1299}function_exists\(['"](\w+)['"][^@]{1,49}@?\33\(base64_decode\(['"]aHR0[^'"]+['"]\)(?<X220369690>)|enqueue_scripts['"],\s*(function)[^\{]+\{\s*echo\s*['"]<(script)>\(\35\([^\)]+\)\{\w+[^\.]+\.(join)\([^\.]+\.\37\([^,]+,\(\35[^;]+;\w+\.async[^\.]+\.\37[^:]+\.body\.appendChild\([^\,]+,window,['"]etnacodLrip[^'"]+['"]\);</\36>['"];\s*\}\);(?<X1315020>)|footer['"],\s*function\(\)\s*\{[^%]{1,199}is_front_page\(\)\)\s*\{[^%]{1,199}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://createvpn\.org[^'"]{1,199}['"]\);[^%]{1,199}echo\s*\39;\s*\}\s*\}\s*\);(?<X120358090>)|head(?:['",\s]+function\(\)\s*\{\s*echo\s*['"]<(script)\s*type\s*=[^=]+\s*=\s*['"]https?://[^>]{1,99}>\s*</\41>['"];\s*\},\s*\d{4,}\);(?<X120343090>)|['"],\s*['"](\w+)['"]\);\s*function\s+\43\(\)\s*\{if\(isset\(\$_GET\[(base64_decode)\(['"]Zm9udF9pY2[^'"]+['"]\)\]\)==\44\(['"]aHNkaGto[^'"]+['"]\)\)\s*\{(?:require|include)\(\44[^\}]{1,99}username_exists\(\44[^\-]{1,99}wp_create_user\(\44[^\-]{1,99}\->set_role\(\44\(['"]YWRtaW5pc3RyYXRvcg==['"]\)\);\}\}\}(?<X120362270>)|['"][\s,]+\w+\(\)[\s{]+(\$\w+)[\s='"]+\w{999,}['"\s]+;\s*(\$\w+)[\s=]+base64_decode\(\46\);\s*\w+\s*\(\47\)\s*\{\s*echo\s*['"]<(script)\s*id=['"]\w+['"]>[^\.]+\.\s*\47\s*\.\s*[^<]+</\48>[^;]+;\s*\}\s*\}\);(?<X1312811>))|loaded['"],\s*['"][\w\-]+['"],\s*9999\);[^\}]{1,999}\$_GET\[['"]compat\b(?<X220356030>)|login['"][^\}]{1,999}\}\s*\w+\s*\w+[^#]{1,999}(\$\w+)\s*=\s*sprintf\([^\)]+\$\w+\[['"]password['"]\],[^\)]+\);\s*(\$\w+)\s*=\s*['"][^'"]+telegram\.org/[^\]]+['"]text['"][\s=>]+\51[^\}]+\52,[^\)]+\);\s*\}(?<X120337920>))|[^,]+,\s*['"](xyz1234_my_custom_add_user)[^@]+\bfunction\h*\54[\)\(\s\{]+(\$username)[=\s]+['"]divineadmin[^@]+(\$\w+)[=\s]+['"]divine@admin123[^\.]+\$\w+[=\s]+['"]vishalk\.divine@\w+\.com['"];[^;]+wp_create_user\(\55,\h*\56,\h*\$\w+\);[^\}]+\$\w+\->add_role\(['"]administrator['"]\);\s*\}\s*\}(?<X1312070>)|[^;]{1,64}\)[;\s]{99,512}function\h*\w*\(\)\s*{[^\)]{1,199}aHR0cHM6Ly9hcGkuc3[^\)]{16,64}\);(?<X2264240>)|\h*['"]init['"]\h*,\h*function\h*\(\)\s*\{(?:\s*(\$\w{1,40})\h*=[^;]+;|\s*if\s*\([^!]+\})+\s*if[\h\(]+!\h*\59\b[^,]{0,99}\([^;]*\$\w{1,40}\h*=\h*wp_create_(user)[\h\(]+(?:\$\w{1,40}(?:\h*,)?\h*)+\)\h*;\s*(\$\w{1,40})\h*=\h*new\h+WP_\60\h*\([^;]+;\s*\61\->set_role\(\h*['"]administrator['"\);\s\}]+\)\s*(?:;|\Z)(?<X1191410>)|\s*['"]\w+['"],\s*['"](?:(\w+)['"]\s*\);\s*\w+\s*\63\(\)\s*\{\s*\w+\s*\(\s*!\s*empty\(\s*\$_GET\[['"]hello['"]\][^\}]{1,199}wp_create_user\([^\}]{1,99}\$\w+\->set_role\(\s*['"]administrator['"][^\\]{1,99}wp_set_password\([^;]+;\s*\}\s*\}\s*\}\s*\}(?<X120339271>)|my_backdoor['"]\s*\);[^\\]{1,1999}[\w\-]+@gmail\.com['"](?<X220345972>))|\s*['"]\w+['"],\s*function[^\$]{1,49}(\$\w+)[\s=]+['"][^'"]{1,32}['"];[^;]{1,29}['"](\w+)['"][^\{]{1,99}\66[^@]{1,49}@?eval\(\$_POST[^>]{1,99}\67[^\?]{1,799}add_filter[^\[]{1,99}(\$\w+)[^\{]{1,99}foreach\s*\(\s*\68[^:]{1,299}add_action[^/]{1,99}https?://[^'"]+['"];[^\?]{1,99}\$_SERVER[^!]{1,999}curl_\w+[^\?]{1,899}exit;[^\?]{1,99},\s*\d+\);(?<X120352531>)|\s*['"]wp_head['"]\s*,\s*['"](\w{1,40})['"]\);\s*function\s+\70\(\s*\)\s*\{\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\D{2,3}\s*['"]\w{1,40}['"]\s*\)\s*\{(?:[^\?]{499,999}(\$\w{1,40})\s*=\s*['"]<\?[^\?]{499,999}file_put_contents\([^\)]+\71\);[^\}]{9,199}exit;(?:\s*\}){2}(?<X1134550>)|[^\}]{99,999}echo[^;]{1,99}\.str_replace\(\s*(\$_SERVER\[)[^\]]+\]\s*,\s*\73[^\]]+\]\s*,[^;]{9,199};\s*exit;\s*\}\s*\}(?<X1134570>)))|\h*\(\h*['"](?:\w{1,15}['"],\h*['"](\w{1,15})['"]\h*\);\s*function\h*\75\(\)\h*\{\h*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\s*\{[^\}]{9,199}\bset_role\h*\(\h*['"]administrator['"][\);\}\s]+\}(?<X1191691>)|admin_head\h*['"]\h*,\h*['"]dolly_\w{1,9}['"]\h*\);\W{0,5}@eval\h*\(\$lyrics\h*\((?<X2174610>))|\s*\((?:['"]init['"],\s*['"](wp[_\-]\w{1,20}\d)['"]\);\s*(function)\s+\78\(\)\s*\{\s*if\s*\(\s*(?:isset\s*\()?\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\}]{1,99}\s*\79\s+wp[_\-]\w{1,20}\d\((\$\w{1,20})[^\?]{1,99}file_put_contents\(\80,\s*['"]<\?php\s[^;]+;\s*\}\s*\$\w{1,20}\s*=\s*curl_init\(\);(?<X2135762>)|[^,;]+,\s*function\s*\(\s*\)\s*\{[^\}]{1,499}\$(\w+)[\s=]+new\s+WP_User\s*\([^;]+;\s*\$\82\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[^,\?#@%:/&]{0,149}?\}\s*\);(?<X1203730>)))
\ba(?:D(?:d(?:_filter(?:[\(\s]+['"]login(_redirect)['",\s_]+NAMESPACE[_\.\s]+['"][^;]+;\s*function\s*wp\1\w+[\s\(\)\{]+if[\s!\(]+file_exists[\s\(]+['"]([^'"]+\.js)['"\)\s]+\{\s*copy\s*\([^;:,]+\2["']\s*,\s*['"]\2['"\s\)]+;[^<]{0,9999}\becho\h*['"]<script>[^\n:/<>]{0,499}\.createElement[\(\s'"]+script(?<X2238391>)|[\h\('"]+\w+['"\h,]+function[^\{]+\{\s*if[\h\(!]+is_wp_error\([^\{]+\{\s*@?file_put_contents[\h\(]+ABSPATH[\h\.]+base64_decode\([^;]+;\s}\s*return\h*\$\w+;[^\)]+\);(?<X120369100>)|[\h\(]+[^\)]+\);\s*function\s*\w+\((\$\w+),\h*(\$\w+),[^\{]+\{\s*if[\h\(]+wp_get_current_user[\h\(\)]+\->\h*user_login\h*\W{2,3}\h*base64_decode[\h\(]+[^\)]+[\s\)]+\{\s*\$\w+[\h=]+array[\h\(]+[^\)]+\);\s*if[\h\(]+!empty[\h\(]+\6[^\{]+\{\s*\5\[\6[^\}]+[\s\}]+return\h*\5;\s*\}(?<X1263890>)|\((?:(base64_decode)\(['"]YXV0aGv\w+['"]\),function\(\$\w+,\$\w+[^&]{1,499}&&\$\w+={1,4}\8\(['"][^'"]{1,499}['"]\)\)\{\$\w+=get_user_by\(\8\(['"]BG9\w+[^\{]{1,99}\{(\$\w+)=wp_create_user\(\$\w+,\$\w+\);\w+\(\w+\(\9\)[^>]+>has_cap\(\8[^>]{1,499}>set_role\(\8\(['"]YWRtaW5[^\}]+\}\w+\s*\$\w+;\},\d+,\d+\);(?<X120335461>)|['"]\w+['"],\s*(?:['"](\w+)[^;]{1,32};\s*\w+\s*\11\((\$\w+),\s*\$\w+,\s*\$\w+\)\s*\{[^\}]{1,999}base64_decode\(['"]aHR0cA[^\}]{1,99}aGVhZGVy['"]\)[^\}]{1,299}\w+\(\w+\(['"]aHR0c[^'"]{1,199}['"]\),\s*\w+,\s*\$\w+\);\s*\}\s*\w+[^\)]{1,32}\)\s*\{\s*\}\s*\}\s*return\s*\12;\s*\}(?<X120339483>)|\w+\((\$\w+)\)\s*\{\s*\w+\s*\(isset\(\14(\[['"][\w+\-]+/[\w\-]+\.php['"]\])\)\)\s*\{\s*unset\(\14\15\);\s*\}\s*return\s*\14.{99,9999}\$\w+\s*=\s*hex2bin\(['"][^'"]{32,}['"]\);\s*\?>\s*<script(?<X220345471>)|\w+\s*\((\$plugins)\)\s*\{\s*\w+\s*\(isset\(\$_GET\[['"]\w+['"]\]\)\)\s*\{\s*\w+\s*\17;\s*\}\s*\$\w+[\s=]+plugin_basename\(\w+\);\s*unset\(\17\[\$\w+\]\);\s*\w+\s*\17;\s*\}\);(?<X220360020>)|function\((\$\w+)\)\s*\{\s*(\$\w+)[\s=]+get_user_by\(['"]login['"],\s*['"]wordfence\-\w+['"]\);\s*if\s*\(\20\)\s*\{\s*(\19\[['"]\w+['"]\])[\s=]+array_merge\(\(array\)\(\21\s*\?\?\s*\[\]\),\s*\[\20\->ID\]\);\s*\}\s*return\s*\19;\s*\}\);(?<X120366201>))|['"]all_plugins['"],(?:['"](hide_my_plugin_from_list)['"]\);\w+\s*\23\((\$plugins)\)\s*\{\$\w+=\w+\(\w+\);(\$\w+)=\(array\)get_option\(['"]\w+['"],\w+\(\)\);\w+\(\w+\(\$\w+,\25,\w+\)\)\{unset\(\24\[\$\w+\]\);\}\w+\24;\}\s*\Z(?<X220356442>)|\w+\((\$\w+)\)\s*\{unset\(\27\[plugin_basename[^\}]{1,99}\27;\},9999(?<X220363000>)|\w+\((\$\w+)\)\{(\$\w+)=['"][^;]+;\w+\(\w+\(\29\[\30\]\)\)\s*\{unset\(\29\[\30\]\);\}[^;]+;\}\);\w+[^\}]{1,999}WP_Error\([^,]+,['"]plugin\s+hidden['"],[^;]+404(?<X220354670>))|['"]cron_schedules['"],\s*(function)[\h\(]+(\$\w+)[^\[]{1,49}\33[^&]{1,299}add_action\(['"]\w+['"],\s*\32[^\.]{1,99}trailingslashit\(ABSPATH\)\s*\.\s*['"]\\x77\\x70\\x2d[^'"]+['"];\s*(\$\w+)[^\|]{1,299}file_exists\((\$\w+)[^\{]{1,49}\35[^@]{1,499}@?file_put_contents\(\35[^!]{1,149}error_log[^;]{1,49}\34\);\s*\}\s*\}\s*\}\);(?<X120359200>)|['"]pre_http_request['"],\s*function(?:[^!]{1,99}strpos\(\$\w+,\s*['"]duplicator\.com['"][^>]{1,149}(\$\w+)[\h=]+['"]activate_license['"][^\{]{1,49}\37[\h=]+['"]check_license[^@]{1,199}json_encode\(\[[^\\]{1,699}\37[\h=]+['"]deactivate_license['"][^\?]{1,499}\$\w+\->setKey\(['"][^'"]{1,32}['"]\);\s*\}\s*\}\s*\}\);(?<X120369370>)|\((\$\w+)[^\{]{1,49}(\$\w+)[^\$]{1,49}strpos\(\40[^\{]{1,49}\.com/[^\}]{1,149}json_encode\(array\(['"]success['"][^\{]{1,249}return\s+\39;[^\(]{1,49}update_option\(['"](\w+)[^>]{1,49}\41[^@]{1,299}is_limit_reached['"]\s*=>\s+false\)\)\)\);(?<X120370410>))|['"]the_content['"]\h*,\h*['"](_[^'"]{1,9})['"]\h*,\h*\d{5,9}\);\s*function\h+\43\((\$\w{1,40})\)\s*\{\s*global\h*\$post;\s*if\h*\(\h*is_single\(\)\h*&&\h*\((\$\w{1,9})\h*=\h*@eval\(get_option\(['"][^'"]{1,99}['"][\h\)]+[!==]{2,3}\h*false\)\s*\{\s*(return)\h+\45;\s*\}\s*else\s+\46\h+\44;\s*\}(?<X1038391>)))|Type(?:\h*application/x-httpd-(?:php|cgi)\h*\.nakanosec\b(?<X1222661>)|\h+application/x\-httpd\-php\h+\.min\b(?<X1325440>)|\s+application/x\-httpd\-cgi\s+(\.(?:con7ext|Index_Unknown1337))(?:\s*AddHandler\s+cgi\-script\s+\50\b)+(?<X1221531>)))|min_url\h*\(\h*['"]\h*options\-general\.php\?page=monit\h*['"\=]\h*\)[^#%`]{999,15000}\bfunction\h+hide_plugin_trickspanda\(\)\s*\{(?<X2169870>)|spect_x_forwarded_for\s*\(\s*\)\s*;(?<X2225351>))|ffiche\h+de\h*(Hack[^>]{0,150})['"]>\s*<(center)>\54</\55>\s*</a>(?<X2153063>)|l(?:ert\(['"](Anon[^\s\)'";]{1,40})\s+was\s+here['"]\);?</script\b[^@]{99,999}<title>\s*[thpf](?:ouch|[au]ck|wn)[e3]d\s+by\s+\57\b(?<X2159811>)|l(?:mediacloud\.com/\w{1,40}\.php\?['"];\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\{[^\}\{]{99,499}\$\w{1,40}\s*=\s*wp_insert_post\s*\(\s*\$\w{1,40}\s*,\s*true\s*\);(?<X2127060>)|ow\s+from\s+all\s+RewriteEngine\s+off\s+<Files\s+\*\.php\s*>\s*allow\s+from\s+all\s*</Files>\s*\Z(?<X1233081>)))|nonymous\h*Cyber[^;]{0,99};\s*(\$\w{1,15})\h*=\h*["']Office365[^\?]{9,250}\bmail\(\$\w{1,15},\h*\61,\h*\$\w{1,15}\);(?<X2170120>)|p(?:iKey:\h*['"]AIzaSyBwo8TUSo0k9ApBL6FfD-pBKY80F_leY-s["'][^\}]{1,99}\.firebase(?:app|io)\.com\b(?<X2145921>)|PLE\h+VBV:\h*['"]\h*\.\h*\$_SESSION\[['"]cc_name['"]\](?<X2138390>))|rr(?:2html\(\$_REQUEST\['\w+'\]\);(?<X1035211>)|_php_file\s*=\s*findshells\s*\(\s*\$_SERVER(?<X2048500>)|ay\((?:["']wp\-[^'"]+['"],){4}[^\*]{1,194}\barray\((?:["']wp\-[^'"]+['"],)+[^\?]{1,50}\bget([\(\s]+)['"]\w+://[^\/]+/\d\.txt['"]([\)\s]+)[^\*]{1,477}\bfile_get\w+[\(\s]+['"]\w+://hello\.(?:\w+\.)+xyz/\w+\.txt['"][\)\s]+[^\-]{1,5}str_replace\67(?:['"]\w*['"],)+\$\w{1,40}\68;(?<X2211041>)|ay\(['"]find\s+all\s+suid\s+files\b(?<X2050951>)|ay\(_xr\(['"][^\?]{0,250}['"]4afddc30e72a['"]\),[^#]{0,1500}\bX-Agent-Key[^#]{0,7500}===\h*['"]copyself['"][^\?]{0,800}===\h*['"]spread['"][^\176]{9,13000}===\h*['"]scan_shells['"](?<X220364191>)|ay\s*\(\s*\(\s*string\s*\)\s*stripslashes\s*\(base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*=>2\s*\),\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\);(?<X1036212>)|ay_map\s*\(\s*['"]\w+['"]\s*,\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*['"]\w+['"]\s*\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*\)\s*;(?<X1036231>)|ay_walk[\s\(]+\$\w{1,40}[,\s]+['"][^'"]+['"][\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:echo\s*)?file_put_contents\s*\([^;\[]*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}=]{0,40}\}[^%]{0,999}(?:<form|\bfilemtime)\b(?<X2227910>))|ssert\(['"]\\x65\\x76\\x61\\x6C\\x28[^'"\);\s]{9,199}['"][^'"\);\s]{999,9999}['"](?:\\x[a-f0-9]{2})+['"]\);(?<X1124510>)|tOptions[=\s]+\{\s*['"]\w+['"][\s:]+['"][a-f\d]{32}['"][,\s]+['"]\w+['"][:\s]+['"]iframe\b[^;\.]+;\s*document\.write[\(\s'"]+<[scr'"\+\sipt]{9,}type[=\s]+['"][^\+:;>\?]+src[=\s]+['"]https?[^:><]{9,99}https?:['"]\s*\?[^/><]+//[^/]{1,40}\.com/\w{32}/invoke\.js['"][^>]{0,99}></[scr'"\+\sipt]{9,}>['"\s\);]+\Z(?<X1230270>)|uthor(?::\s*wp\s+core\s*Contributors\s*\*/[^#]{1,9999}die\(['"]wp\s+user\s+exists['"]\);\s*}\s*\}\);\s*\?>\Z(?<X220350810>)|\s*uri:[^:]{1,32}://greggpalmer\.[^@]{1,999}unset\((\$plugins)\[[^;]+;\s*\}\s*\w+\s*\78;\s*\}\);(?<X220356430>)|\s+uri:\s*https?://wordpress\.org\s*license:[^\}]{1,999}define\(['"]\w+['"],\s*['"]wpbooster['"]\);(?<X220343760>)))
\b(?:B(?:a(?:ck(?:door\s+Destroyer[^'"]{1,30}['"]\s*//(?:\w+\.)?exploit\-db\.com\/search\?q=Linux\h*Kernel(?<X2278281>)|upsystemswordpress\.org[^\}]{1,999}set_role\(['"]administrator['"][^\\]{1,999}['"]hide_admin_user['"](?<X220349551>))|nk:[^\;]{1,99};\s*\$\w+\s*=\s*fopen\(['"](?:../){3}\w+\.txt['"](?<X2266320>)|se(?:64_(?:decode\((?:'ZXJyb3JfcmVwb3J0aW5n'\),base64_decode\('Y3Vyb(?<X2055000>)|['"][^\?]{1,999}['"]bad_mode['"]\]\);\}exit;\}\s*\Z(?<X220357160>))|encode\(\w+\(['"]https?://[^\)]{1,999}\)+\s*\?\s*['"]<script>alert\(['"]Toolkit\s+spawned!['"]\);(?<X220338270>))|['"]\.\(32\*2\)\s*\.\s*['"][_deco'"\.]{6,}['"]\s*;(?<X2043843>)|name\(\$file\)\s*==\s*"configuration\.php"\s*\|\|\s*basename\(\$file\)\s*==\s*"wp-config\.php"\s*\)\s*\)(?<X2049860>)))|londe\s+girl\s+dressed\s+undressed\s*<a\s+href\s*=\s*['"]https?://merky\.de[^<]{1,64}</a>\s*biggest\s+mature\s+swingers\s+party\s+dreams\s+gentlemen\s+club\s+melbourne\b(?<X1261880>)|o(?:dy>[^\{\}]{9,199}\becho\h*[base64_dco'"\h]{9,25}\(\$_COOKIE\[[^\]]+\]\)[^\{\}]{99,599}w</html>(?<X2188930>)|ndishee\d*\.php['"]\h*(?:\)\h*)?;(?:\s*[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,99}\bbondishee\d*\.php['"]\h*(?:\)\h*)?;){2}(?<X2157881>)|t(?:admin\.php['"]\h*\);\s*echo\s*['"]<script\b[^\$,\|\+#%&]{9,999}<title\b[^>]{0,99}>\s*Boteye\s*(?:\w{1,40}\s*)?v\s*[\d\.]+\b(?<X2166670>)|net\h*Panel[^\{]{9,199}\bprint\h*['"][^<]+Bots\?\h*<y/n>(?<X2196760>)))|rute\h*force\h*Attack\h*tool\h*for\h*wordpress[^:]{1,80}(.)n00py\14\s*['"]+\s*print\b(?<X2152760>)|u(?:g7sec::w[0o][0o]t\((?<X2193593>)|sybox\s*wget\s*http://\d+\.\d+\.\d+\.\d+/(bot\.x86_64);\s*chmod\s*777\s*\17;\s*\./\17\s*android\s*rm\s*\$0(?<X2323182>)|y\s*zydena\s*online\s*<a\s*href=['"]https?://[^<]+<.a>\s*no\s*prescription\b(?<X1251380>))|y(?:\h+Haxor\S*</title>(?<X2265940>)|pass\s*phpsuhosin\b[^@\{\?]{99,499}\$\w{1,40}\h*=\h*\$_[GPCSR]\w{2,6}\[(?<X2155940>)))|c(?:a(?:ll_user_func(?:[\(\h]+(function)[\h\(\)\{]+(?:(\$\w+)(?:\->\w+){0,2}[\h=]+new\h+\\stdClass[\s\(\)]+;){4}[^\?\n]{1,999};\h*(\$\w+)[\h=]+(\22[\h\(\)]+use[\h\(]+\23)[\h\)]\{[^\n]{9999,}\(\h*['"][^'"]*['"][\h,]+\25[\h,]+\24\h*\)[^\n\?]{999,}\24[\h\(]+(?:false|true)[,\h]+['"][^'"]+['"][\h\);\}]+;(?<X1201731>)|\(\$\w+,[^'"]+['"]\\\w+\\\w+\\\w+[^'"]{32,}\\\w+\\\w+['"]\)+\s*\.\s*\$\w+\);\s*\Z(?<X220354051>)|\s*\(\s*create_function\s*\(\s*\w{1,40}\s*\,\s*str_rot13\s*\(\s*strrev\s*\(\s*['"][^']{1,400}'\)\)\)\);(?<X1041690>))|se\h+['"](?:mass.?deface['"]:[^\{]{1,199}\{\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\}]+\bwhile\h*\([^\)]+\breaddir\h*\([^\}]{1,199}\b[cm]o(?:ve_uploaded_file|py)\h*\(\29,\h*\$\w{1,9}(?<X2179680>)|shell['"]:\s*(\$cmd(?:exec)?\d*)\h*=\h*\$_[GPRC]\w{2,6}\h*\[[^\]]+\];[^\[]{0,499}=\h*\w{1,40}\(\h*\31\h*,(?<X2182900>))|se\s*(?:'exesys':\s*\$content\s*\.=\s*\$shell->exesysform\(\);(?<X2050760>)|["']update["']\s*:\s*if\s*\(\s*file_put_contents\s*\(\s*__FILE__\s*,\s* base64_decode\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*\)\s*echo\s*['"]OK['"];(?<X2045920>)|['"]exec['"]:\s*(\$\w+)[\s=]+_param\(['"]\w+['"]\);\s*if\s*\(\35\s*&&\s*function_exists\(['"]shell_exec['"]\)\)\s*\{\s*\w+\(\$\w+,\s*\$\w+,\s*['"]exec_command[^%]{1,699}base64_decode\(['"]iVBORw(?<X220363460>)|['"]hijack['"]\s*:\s*\$title\s*=\s*['"]cPanel(?<X2223600>))|se(?:\s+['"]((?:shell_)?exec|passthru|popen)['"]:[^;]{1,99}\b\38\h*\([^\?]{1,999}\bfunction\s+lock\w{1,19}\h*\([^\}]{1,199}\bfile_put_contents\h*\(\h*(\$\w{1,40})\h*,[^;]{1,99};\s*@?touch\h*\(\h*\39\h*,(?<X2171180>)|\s[^:]{1,9}:(\$\w{1,40})(=isset\()(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)&&!is_array\(\43\)\?\43\s*:\s*['"]{2};(\$\w{1,40})=fopen\([^;]+;[^\?\{\}]{1,99}\41\42\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\?(base64_decode\(\41\))\s*:\s*myconv\(\45[^;]+;if\(!?fputs\(\44,\41\)[^#%\^\?]{999,1999}<title>[^/<]{1,49}\bshell\b(?<X2134050>))|tch\(Exception(\$\w{1,40})\)\{[^=]{1,40}array\(['"]success['"]=>false,['"]msg['"]=>\47->getMessage\(\),?\)+;\}+public\s*static\s*function\s*\w{1,40}\(\)\{\$\w{1,40}=(?:str_replace\([^\(]{1,40}){3},dirname\(__FILE__\)+;\$\w{1,40}=htmlspecialchars\(sprintf\(['"]//%s%s['"](?<X2130840>))|cc=str_rot13\(gzinflate\(base64_decode\(\$code_(?<X2051170>)|d\s*\./\h*;\s*(?:curl|wget)\b[^:\n;]{1,199}http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^\&\n]{1,999}chmod\s+\+x\s+(\w+)\h*;\s*\./\50[^\n\|]+\brm\s*\-r?f\s*\./\50\h*;(?<X2242312>)|h(?:a(?:nge_files\((\$\w{1,20})\.['"][^\.]{1,20}\.html['"]\h*,[^/'"]{2,40}\52\.['"]/bajatax['"]\);(?<X2165280>)|rCode\(\$\w+\);\s*function charCode\(\$\w+\)\{\s*\$\w+\s*=\s*array\(.+?\$\w+\[\d+\];return\s+EvAl\(\$\w+\);\s*\}(?<X2044402>)|rset\s*=\s*UTF-8['"]>\s*<title>\s*Google\s+Drive\s*-\s*Google\s+Drive\s*</title(?<X2052020>))|mod\((?:(\$\w{1,20}),\d+\);\s*file_put_contents\(\56,[^\)]+\);\s*\$\w{1,20}=fopen\(\56,[^\)]+\)[^;]{0,40};\s*\$\w{1,20}=['"][^'"]{999,}['"];[^/<]{50,200}\becho\h+["']<[^>]+>[^/<]{0,20}\bshell\b(?<X2198760>)|\$\w+,\s*0444\);\s*\}\s*\},\s*99\d+\);[^@]{1,999}unset\((\$plugins)\[[^@]{1,999}\58;\s*\},\s*\d+\);(?<X220361140>)|\s*dirname\(__FILE__\).+?{\$a=Array\("/\.\*/e.+?_\d+\(\d+\)\);(?<X2044161>))|mod\h*\(\h*['"][^'"]{1,99}/(wp\-[^'"/]{1,99}\.php)['"]\h*,\h*\d{3,4}\h*\);\s*@?file_put_contents\h*\(\h*['"][^;]{1,99}\b\61['"]\h*,\h*base64_decode\h*\([^;]{1,99};\s*@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^;]{1,99}\b\61['"](?:\)\h*)?;\s*@?unlink\h*\([^\)]{1,99}\b\61['"]\h*\);(?<X1158671>)|r[\(\s]+hexdec[\(\s]+(?:\$\w{1,40}\[[^\]]+\][\s\.\)]+)+;[^=]{0,199}\bfunction\s*perms[\s\(]+(\$\w{1,40})[\s\)\{]+\$\w{1,40}[=\s]+fileperms[\s\(]+\63(?<X2225581>))))
\bclass(?: PluginJoomla.+\$\w+\s*=\s*@?\$_COOKIE\[\'\w+\'\]\;\s*.*\$\w+\s*=\$\w+\(@?\$_COOKIE\[\'\w+\']\)\;.+\$\w+\s*=\s*new\s*PluginJoomla;(?<X2044911>)|-cloaking\.php[^\?]{0,99}class-seo-injector\.php[^#]{0,7999}\bcloaking\->is_bot\(\);[^\?]{0,199}seo_injector->inject\([^\?]{0,99}backlink_manager->inject\([^#]{0,299}traffic_handler->handle\((?<X220362002>)|=['"]title['"]>\bhacked\s+by\s+yiix103</p>(?<X220346790>)|\h*(\S{1,40})\h*\{\s*function\h*__destruct\h*\(\)\h*\{\s*@?(\$\w{1,40})\h*=\h*['"][^;]{12,};\s*@?\5\h*=\h*\5\h*\(\h*['"]{2}\h*,\h*\$this\->(\w{1,40})\h*\)\h*;\s*return\h*@/?\5\h*\(\h*\)\h*;(?:\s*\}){2}\s*@?(\$\w{1,40})\h*=\h*new\h+\4\(\);\s*@?\7\->\6\h*=\h*&\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;(?<X1161590>)|\h*(\w+)[\s\{]+(?:const\b[^%]{999,10000}\b(self::)\$\w+[\h=]+\[\[(\w+)::\w+\([^\?]{0,300}\bdata[\h=]+\$_COOKIE;\s*\$this\h*\->\h*target[\h=]+\$_SERVER\[[^#]{5000,13000}\bclass\h*\11[\s\{]+private\s*static\s*(\$\w+);[^\?]{9,599}\10\12[\h=]+array\([^\)]{599,1999}\);[\s\}]+\9::\w+\(\);(?<X120350920>)|private(?:\b[^#]{99,1800}\bfunction\h*(init\d+)[^\}]{9,599}\$hex_data[\h=]+['"][^'"]{4000,}['"];[^#]{99,1999}\b\9::\14(?<X220359980>)|\h*\$inter_domain[\h=]+['"]https?:[^;]+;[^#]{999,6500}\b(main_shell)['"]\][\h=]+\$\16;[^\^]{99,1300}(\$\w+)[\h=]+new\h*\9\(\);\s*\17\h*\->\h*\w+\(\);(?<X120348531>)))|\h*(\w+)\s*\{(?:[^\?]{99,600}\becho\h*['"]Debug:\h*Hybrid\b[^\?]{99,1200}\bif[\h\(!]+defined[\h\(]+['"]DISABLE_EVAL['"][^\{]+\{\s*eval[\h\(]+substr[\h\(]+\$\w+[\h,]+\d+[\s\)\};]+\19::run\b(?<X220344270>)|[^\?]{99,800}\bsetcookie\(_\w+::(_\w+)\([^@%\\]{999,8500}\bself::\$\w+[\h=]+\[\w+::\21\([^;]+;\s*\$this\h*\->\h*data[\h=]+\$_COOKIE;[^\176]{5000,15500}(\$\w+)[\h=]+\bnew\h*\19\(\);\s*\22\h*\->\h*\w+\(\)\h*\->\h*\w+\(\);(?<X120344631>)|[^\?]{99,999}\becho\h*['"]Debug:\h*Heredoc\b[^\?]{999,40000}\bif[\h\(!]+defined[\h\(]+['"]DISABLE_EVAL['"][^\{]+\{\s*eval[\h\(]+substr[\h\(]+\$\w+[\h,]+\d+[\s\)\};]+[^:]{0,99}\19::run\b(?<X220344284>)|\s*const\h*\w+\h*=[^\{]{0,500}\{\s*\$this\->\w+\(\);\s*add_action\(['"]template_redirect['"][^\^]{2000,5000}\breturn\h*urldecode\(\$\w+\(implode\(\$\w+[\h\)]+;\s*\}[^#]{9000,18000}\bprivate\h*static\h*function\h*\w+\(\)\h*\{\s*self::\$\w+[\s=]+array\([^\}]+\}\s*\}\s*\19::\w+\(\);(?<X120346480>)|\s*private[^#]{99,1500}\bpublic\h*static\h*function\h*(run\(\))\s*\{\s*\$\w+[\h=]+(?:implode[\h\('"\[,]+)?['"\.,in_set]+(?:[\]\)\h]+)?;[^#]{999,}\bDISABLE_EVAL['"][^\{]+\{\s*eval[\h\(]+\$\w+[\s\)\};]+[^:]{0,99}\19::\26;(?<X220344331>))|\h*(\w+)(?:\s*{\s*private[^\?]{9,700}\bpublic\h*static\h*function\h*(init_\w+)[\(\)\{\s]+(\$\w+)[\h=]+['"][^'"]{3999,25000}['"];\s*\$\w+[\h=]+hex2bin[\h\(]+strrev[\h\(]+base64_decode[\h\(]+\30[\h\)]+;[^\?]{99,999}\b\28::\29[\h\(\)]+;(?<X220367640>)|\{[^\?]{9,399}\bpassword[\h=]+\w+[\h\(]+addslashes[\h\(]+['"]password['"]\.\$_POST\[['"]ftp['"][^\?]{9,199}\bif[\h\(]+md5\(@?eval[\h\(]+\$\w+\h*\->\h*call[\s\(]+new\h*\28[\h\(\)]+\->\h*getUsername[\s\(\)\{]+sprintf[\h\('"]+hello['"\)]+;\s*\}\s*\}\s*\}(?<X1273360>))|\h*(\w{1,15})(?:\b[^\?]{99,499}(\$\w{1,15})[\h=]+\$_COOKIE;[^\(]{0,20}\(count\(\34\)[\h=]+\33::\w\(\d\)[^\n]{0,250}\beval\(\$\w{1,15}\)\)[\h:]+\34;(?<X2210400>)|\s*\{\s*private[^;]+;\s*public\s*static\h*function\h*(\w{1,15})\([^\?]{9,4999}\b(header\(\33::\36\()[^\;]+;\s*@?\37[^#]{9,3000}\bfputs\(\$_\w{1,15},\s*\$_\w{1,15}\);(?<X2198182>))|\h*(\w{1,9})\h*\{\s*(public)\h*(function)\h*root\(\)\s*\{\s*return\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*\}\s*\40\h*\41\h*executebin\(\$\w\)\s*\{[^\?]{99,7999}(\$\w{1,9})\h*=\h*new\h*\39;\s*\42\->run\(\);(?<X1178520>)|\h*(_[^\x00-\x7F]{1,20})\h*\{[^\*\}]{9,999}return\h+BasE64_DecODE\(self::\$[^;]+;\h*(/\*Bloodninja:)[^#!]{99,9999}if\h*\(\h*!\h*(?:isset|empty)\h*\45[^\}\{><!#]{99,999}\44::[^;\v]+;(?<X1160400>)|\h*(shellmanager)[\s\{]+private\s*\$shells\b[^\?]{0,250}function\s*loadshells[\s\(\)\{]+global\h*\$\47;(?<X2146101>)|\h*(so_\w+)\{\s*private\h*\$(\w+);\s*public\h*function[^\{]+\{\s*(\$\w+)\->\50=base64_decode\([^\?]{99,4000}\$_SESSION\[['"]shell['"]\]=\51\->get_api\([^\?]{99,3500}\bnew\h*\49\(\);(?<X1252520>)|\h*=\h*['"](shell)['"]>\s*<\?php\h*echo\h*htmlspecialchars\h*\(\h*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\$_[GPRSC]\w{2,6}\[['"]\53['"]\]\h*\)\h*\);(?<X2167950>)|\h*\w+[\s\{]+[^\{]{0,299}\bprivate\h*\$\w+,\h*\$\w+,\h*(\$\w+),\h*\$\w+,[^\{]{0,199}\{\s*(\$this)\h*\->\h*\w+\(\);\s*add_action\(['"]template_redirect['"],\h*\[\56,[^\176]{15000,21500}\bforeach\(\[__FILE__,\h*__DIR__\]\h*as\h*\55[\s\)\{]+@?\$\w+\([^;]+;\s*@\$\w+\(\55,[^;]+;\s*\}\s*return[^;]+;\s*\}\s*\}(?<X120349170>)|\h*\w{1,25}\{\h*public\h*static\h*function[^\n]{999,4500}\bempty\(\$_SESSION\[(base64_decode\()[^\)]+\)\]\[\58[^\)]+[\)\]]+\{\$\w{1,15}[\h=]+explode\([^\n]{99,399}\b(?:exit|die)[^;]{0,9};\}\}(?<X1198560>)|\h*APSW_RemoteRenderEngine[^\?]{0,99}['"]apsw_gateway_main['"];[\s\S]{0,99}['"]apsw_gateway_backup['"][^\176]{999,7000}\bWP-RemoteRender/\d+\.\d+['"],[\s\S]{0,99}['"]X-APSW-Context['"](?<X220364970>)|\h*indoxploit\h*\{\s*public\h*\$dork\h*;(?<X2169371>)|\h+(\w+)(?:\h*\{\s*private[^#]{20000,45000}\bforeach[\s\(\[,]+(?:['"][\./]+['"],\s*){4}[^\]]+\]\h*as\h*(\$\w+)[\s\)\{]+if[\h\(]+file_exists[\h\(]+\63[\h\.]+[^'"]+['"]wp\-load\.php['"][^\?]{99,199}\berror_reporting[\h\(]+(?:0|NULL)[\h\)]+;[^\?]{99,650}\belse[\s\{]+\62::init[\h\(\)]+;(?<X2210242>)|\{[^\?]{1,999}\bfunction\h+(\w+)\(\)\{(\$\w+)=\$_[GPCSR]\w{2,6};\(\66\b(?:[^;]{0,99}\66\[\62::\w+\(\d+\)\]){2}[^;:]+:\66;\s*return\s*\62::\w+\(\d+\);\}\s*\65\(\);\s*(?:\?>|\Z)(?<X2211992>))|\h+(\w{1,40})(?:\h*\{\h*public\h*function\h+__invoke\h*\(\h*(\$\w{1,40})\h*\)\h*\{\h*@?eval\h*\(\h*\69\b[^\)]+\);(?:\h*\}){2}\s*@?call_user_func\h*\(\h*new\h+\68\h*\(\h*\)\h*,\h*\$\w{1,40}\h*\);(?<X1171450>)|\s*\{\s*public\h*\$(\w{1,40})\h*=[^;]+;\s*\bfunction\h*__destruct\h*\(\h*\)\s*\{\s*@?(?:eval|assert)\h*\(\h*\\?['"]?\$this\->\w{1,40}\\?['"]?\h*\)\h*;(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*new\h*\68\h*\(\);\s*(\$\w{1,40})\h*=\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];\s*\72\->\71\h*=\h*\73\h*;(?<X1169292>))|\h+(conectBase)\s*\{[^\{]{9,99}\bfunction\h+get_content_code\([^%`]{999,6000}\}\s*\$\75\h*=\h*new\h+\75\(['"][^'"]{1,20}(?:cGl6ZGVjLW5lYXIu|emRlYy1uZWFyLndz|aXpkZWMtbmVhci53)[^'"]{2,30}['"]\);(?<X1161760>)|\h+(WP_\w+)\h*\{[^\?]{99,999}\$\w+[\h=]+[\h'"\.base64_dco]{10,40};\s*\$\w+[\h=]+['"\h\.gzinflate]{10,40};[^\?]{9,999}\binclude\((\$\w+)\);\s*@?unlink\(\78\);[^#]{9,199}\barray_(?:walk|map)\(\$cookie_[^#]{9,199}\b\s*\77::boot\(\);(?<X120361450>)|\h+[a-f\d]{33}\s*\{(?:\s*p(?:ublic|rivate)\h*\$[a-f\d]{33}\h*;){9,}\s*public\h+function\h*__construct\h*\(\)\s*\{(?:\s*\$this\->[a-f\d]{33}\h*\(\)\h*;){9}(?<X2169491>)|\h+deRanSomeware\s*\{[^\{\)]{0,20}\bfunction\h+shcpackInstall\(\)\s*\{(?<X2181270>)|\h+KuzuluyArt[\s\{]+(?:public\h*)?\$\w{1,20}=['"]https?://[^'"]{9,40}\.id["'];(?<X2198650>)|\h+Macros\h*\{[^#]{4999,9999}\}\s*echo\h+serialize\h*\(\h*array\h*\((?:\h*["'](?:total|sent|success|error)['"]\h*=>\h*[^,;]{0,49},){4}\h*["']rcpt['"]\h*=>\h*\$\w{1,40}\h*\)\h*\);\s*(?:\?>\s*)?\Z(?<X2178772>)|\h+Spammer\((thread)ing\.\84\):\s*def\h+__init__\(\h*self\h*,\h*url,\h*number\h*,\h*proxy\h*\):(?<X2150800>))
\bclass(?:\s*(\w+)(?:[\{\s]+(?:private|public)\s*static\s*\$\w+;[^\(]{0,15}function\h*(\w+)\([^_]{9,400}\}\}\s*function\s*(\w+)\([^\)]+\)[\{\s]+(\$\w+)=\$_[GPRSC]\w{2,6};\s*\(\4[^\[]+\4\[\1::\2\([^\}]{99,400}\beval\([^\}]+\}\s*\3\(\);(?<X1256480>)|\s*\{\s*\w+\s*\$\w+;\s*\w+\s*\$\w+\s*=\s*\[[^=]+=>\s*['"](aHR0c)[^'"]+['"],\s*[^=]+=>\s*['"]\6[^'"]+['"],\s*['"]\w+['"]\s*=>\s*['"]\6[^;]+;\s*\w+[^\\]+\1\(\);\Z(?<X120335910>)|\{[^\{]+\{\$\w+\->\w+=\$\w+;\}public\s*function\s*(\w+)\(\$\w+\)\{\$\w+=base64_decode\(\$\w+\);\$\w+=substr[^;]+;\$\w+=openssl_cipher_iv_length[^%]{1,999}new\s*\1\(['"]\w+['"]\);\$\w+=['"][^"']{999,}['"];\$\w+=\$\w+\->\8\(\$\w+\);eval\(\$\w+\);(?<X120333110>)|\{[^_]{1,199}function\s+__destruct\(\)\{@?eval\(['"]{2}\.\$\w+[^\-]{1,99}\->(\w+)['"]\);\}\}(\$\w+)\s+=\s+new\s+\1;(\$\w+)\s+=\s+@?\$_POST\[['"]\w+['"]\];\$\w+\s+=\s+base64_decode\({2}substr\(@?\$_POST\[['"][^'"]{1,99}['"]\],\$\w+,\-\12\){3};\11\->\10\s+=\s+['"]{2}\.\$\w+;(?<X1325660>)|\{p(?:ublic|rivate)\$\w+;p(?:ublic|rivate)\s*function__construct\(\)\{\$this\->\w+=hex2bin\(addslashes\(\$_POST\[['"]\w+['"][\]\)]+;\}{2}\$\w+=function\(\)\{return\$this\->\w+;\};eval\(\$\w+\->call\(new\s*\1\)\);(?<X1321992>)|\{private\$\w+=['"]http://colambiapictures\.top/get\.php['"];[^@]{999,7000}\bnew\s*\1\(\);(?<X1311580>))|\s*(\w+_(\d+)\w+)\s*\{\s*const\s*version[^@]{99,19999}\\[\w\-]+/[^\\]{999,9999}@\$\w+\(['"](\$\w+)[^;]+;\s*@\18[^\\]{1,999}self::\$\w+[=\s]+array\(['"][^\)]{299,}\);\s*\}\s*\}\s*\$\16\s*=\s*\w+\s*\16\(\);\s*\$\16\->\w+_\17\w+\(\)\->\w+_\17\w+\(\);\s*//\s*\w+(?<X120343791>)|\s*(\w+_(\w{5})\w+)\s*\{\s*const[^\{]{1,999}\s*\{\s*\$this\->\w+\21\w+\(\);\s*add_action\(['"]\w+['"],\s*[^;]{1,99}\w+_\21\w+['"]\]\);\s*\}[^\}]{1,99}if\s*\(isset\(\$_GET\[\w+::\w+\([^\}]{1,999}wp_redirect\(\$\w+\);\s*exit;\s*\}\s*\}\s*\w+\s*\w+\s*\w+\21\w+\(\).{999,}\->\w+\21\w+\(\);\s*//\s*\20(?<X120341390>)|\s*(\w{1,40})\s*\{\s*(?:\[\w+\(\w+\)\]\s*=\s*null;[^\}\{:]{0,499}=\s*['"]https?://cdnreport\.net[^'"]*['"]\s*;[^\n\?]{99,9999}\]\(['"]href['"],this\[['"][^'"]+['"]\]\+['"]\?[^\n<]{9,999}\bwindow\[[^\]]+\]\h*=\h*new\s*\23\h*\([^\}\{\n]{1,499}\}\},\w+\);(?<X1259451>)|function\s*\w{1,40}\s*\(\s*(\$\w{1,40})(?:[\s,]+&?\$\w{1,40}){3}[\s\)]+\{\s*(\$\w{1,40})[\s=]+parse_url[\s\(]+\25[\s\);]+(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\(]+['"]['"][\s,]+\26\[[^\]]+\][\s\);]+\27\s*\(\)[^\}]+\}[\s\}]+stream_wrapper_register[\s\(]+['"][^'"]+['"][\s,]+['"]\23['"][\s\)]+;(?<X1194810>))|\s*(colorize)\{(private\s+static)\s*\$\w{1,40}=array\(\);(\30\s+function)\s*swap\(&(\$\w{1,9}),&(\$\w{1,9})\)\{(?:(?:\32|\33)=\32\^\33;){3}\}\31\s*KSA\([^&\?]{99,999}\$\w{1,40}=new\s*\29;(?<X2134940>)|\s*\=\s*['"]tit['"]>\s*Mailer\s*Inbox(?<X2051730>)|\s*\w+\s*\{\s*(private)\s*\$\w+[=\s]+['"]\\x68\\x74\\x74\\x70:[^'"]{1,999}['"];\s*\36\s*\$\w+[=\s]+\[\];(?<X2325240>)|\s*\w{1,40}\s*\{\s*(?:static\s*(function)\s*\w{1,40}[\(\)\s\{]+eval[\(\s]+(self::)(\$\w{1,40})[\)\s;]+\}\s*\38\s*__construct[\(\s]+\$\w{1,40}[\)\s\{]+\39\40[=\s]+\$\w{1,40}[^\?]{99,9999},['"]\w+['"][\);\s]+(\$\w+)[=\s]+new\s*\w+[\(\s]+\$\w+[\);\s]+call_user_func[\(\s]+array[\(\s]+\41[,\s]+['"]\w*['"][\)\s]+;(?<X1248830>)|var\s*\$\w{1,40}[\s;]+function\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)\{]+(\$\w{1,40})[\s=]+\$_SERVER\[['"]HTTP_USER_A[^\]]+\][\s;]+if[\s\(]+preg_match[\s\('"/]+Apple[^'"]*['"][\s,]+\43[\s,]+(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})[\s=]+str_replace[^;\[\]]+\44\[[^\]]+\][\s\);]+\45[\s=]+explode\b(?<X2198741>))|\s*\w{1,40}\{private\s*static\s*(\$\w+);\s*public\s*static\s*function\s*\w+[\(\s]+\$\w+[,\s]+\$\w+[\)\{\s]+if[\(\s]+!\s*self::\47\s*\)[^\n]{999,}@touch\(\$_SERVER\[\w+::\w+\([^;\n]+\),\$\w+\);(?<X1252640>)|\s*_keys\s*\{[^\{\},]{0,99}\bfunction\s*_dekr[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{[^\}\+]{9,999}\+\+(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})\[\49\][=\s]+chr[\s\(]+ord[\s\(]+\50\[\49\][\s\)]*\^\s*ord[\s\(]+\$\w{1,40}\[\49%\$\w{1,40}\][\s\)]+;[^\^]+\bpreg_replace\b(?<X2223221>)|\s*Advanced_LinkFlow_Control\s*\{\s*\w+\s*\$\w+[=\s]+['"]\\[^'"]+\\[^'"]+['"];(?<X220366340>)|\s*Foo\s*\{\s*function\s*__construct[\(\)\s]+\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\->\w+[\(\s]+\$\w{1,40}\->\w+[\)\s]+;[^\^]{0,999}\$\w{1,40}\[\$\w{1,40}\]\s*\^\s*\$\w{1,40}\[\$\w{1,40}%[^_]+\barray[\(\s]+['"]['"\h\,creat_funio]{15,40}['"][\s\)]+;[^\}]{99,}['"][;\s]+\}[^\(]{0,40}\bnew\s*Foo\(\);(?<X1211270>)|\s*Get_?(link)s\s*\{\s*var\s*\$host\s*=[^`]{499,3999}?(?:return\s*['"]<!\-\-\54\s*error\-\->['"];|\$data\s*=\s*file_get_contents\(\$file\);\s*return\s*\$data;|\$this\->\54s\s*=\s*file_get_contents\(\$this\->\w{1,40}\);)(?:\s*\}){2,3}(?<X1037794>)|\s*Ma\w+\s*extends\s*Mage_\w+\s*\{\s*public\s*function\s*indexAction\s*\(\s*\)\s*\{\s*@?eval\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*\w+\s*\]\s*\)\s*;\s*\}\s*\}(?<X1037400>)|\s*pony_db\s*\{\s*public\s*\$db_link;\s*protected\s+\$database;(?<X2123142>)|\s*WP(?:_Core_Performance_Monitor[^\}]{1,999}https?://[^'"]+/generate\-for\-bots['"](?<X220332961>)|pl(?:loadcontent|aginload)\s*\{(?:(?<X2157201>)|[^\}]{99,499}\bconst\s*\w{1,40}\s*=\s*(?:['"]\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPCSR]\w{2,6}\[(?<X2157190>)))|\s+(\w+)(?:[\s\{]+[^;\(\{=\}]*function\s+__(?:con|de)struct[\s\(\)]+\{\s*((\$\w+)[\s=]+(\$this\s*\->\s*))\w+[\s\(]+\64(\w+)[\s\)]+;\s*\62\w+[\s\(]+\64\w+[\s\(]+\63[\s\)]+;\s*\62\w+[\s\(]+\63[\s\)]+;[^\?#:/]{499,4999}\$\w+[\s=]+['"][^'"]{9999,}['"];[^;=\$]{0,19}\$\65\s*=[^;]{99,};\s*\}\s*new\s+\61[\s\(\)]+;(?<X1196991>)|\{\s*function\s+(\w+)\((\$\w+)\)\{\s*(\$\w+)=curl_init\(\68\);\s*curl_setopt\(\69[^\?]{1,199}\61['"]\);[^;]{1,99}\67['"]\);\s*(\$\w+)=[^=]{1,99}(\$\w+)=['"]https?://pastebin\.com[^'"]+['"];\s*eval\(['"]\?>['"]\.\$\w+\->\w+\(\70,\71\)\);(?<X120350440>))|\s+(\w{1,20})\s*\{\s*public\s*(function)\s*__cons\w+[\(\)\s]+\{[^=]{9,999}(\$\w{1,9})[=\s]+sys_get_t\w+[^\}]+file_put_contents[\(\s]\75[^=]*\w{1,30}[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\$_[GPRSC]\w{2,6}\[[^!]{9,999}\74\s*\w{1,50}[\s\(\)\{]+(\$\w{1,9})[\s=]+['"]\w*['"];\s*return\s*\76[^!<]*\73[\s\(\)]+;(?<X1257071>)|\s+(\w{1,40})\s*\{(?:(?:\s*var\s*\$\w{1,40};){4}[^%]{3000,15000}(\$\w{1,40})\s*=\s*\$\w{1,40}\s*\.\s*(base64_decode)\s*\([^;]{99,599};[^!@]{1,99}!@?include_once\s*\(\80\s*\(['"]aHR0cDovLw=?=?['"]\)\s*\.\s*\79\)[^!@]{1,99}\78[^\}]+\79[\)\s]+\{(?:\s*\}){2}(?<X1126883>)|[^\{\}]+\b(function\s+)__construct[\s\(]+(\$\w+)[^\{;]+\{\s*(self::\$\w+)[\s=]+\83;\s*@?eval\b[^\(;]{0,99}\(\s*(?:null\.)*\84\s*\);\s*\}\s*\}\s*\82(\w+)\s*\([^\}]{99,499}\}\s*(\$\w+)[\s=]+(?:null\.)*\85[\s\(]+@?\$_[GPCSR]\w{2,6}\b[^;]+;[^;\(]{0,99}\bnew\s+\78[\s\(]+\86[\s\)]+;(?<X1196330>))|\s+(\w{1,40})\{[^\(\{]{9,499}\bfunction\s*__construct\(\)\{\$this\->\w{1,40}=hex2bin\(['"]68747470(?:73)?3a2f2f636f6e6e6563742e61706965732e6f72672f['"]\);[^@]{999,4999}\bnew\s*\88\(\);\s*(?:\?>\s*)?\Z(?<X2152551>)|\s+(CM_base)\s*\{[^\}\{]{99,999}function\s+\90\(\$options\s*=\s*null\)\s*\{(?<X2135010>))
\bc(?:lass(?:\s+\w+(?:[^;]{1,49}private\s+static\s+(\$\w+)[^\}]{1,99}(\$\w+)\)\s*\{[^\)]{1,49}\1[^\[]{1,49}strlen\(\2\)[^:]{1,49}(\$\w+)[\s=]+base64_decode\(self[^\?]{1,199}\3[^\{]{1,49}function[^\?]{1,49}\1[\s=]+array\(['"]_0['"]=>[^\)]{99,1999}\);\s*\}\s*\}(?<X120363261>)|\s*\{[^\}]{32,600}\badd_action\s*\(\s*(_hqv::_ideg)[^\^]{999,9000}\bself::\$\w+[\h=]+\[\5\(['"][^;]+;\s*\$this[\h\->]+data[\h=]+\$_COOKIE;[^#]{999,13000}\bfilemtime\((__DIR__)[\h\.]+\5[^;]+;\s*foreach\(\[__FILE__,\h*\6\][^\}]{0,199}@\$\w+\(\$\w+,\h*\$\w+,\h*\$\w+\);\s*\}\s*return[^;]+;\s*\}\s*\}(?<X120365181>)|\s*\{\s*[^\{]{1,99}\{\s*(\$\w+)[^\{]{1,149}\{\s*\8\s*[\h=]+\8\h*\*\h*\d+;[^\?@]{1,110}else\s*\{\s*(\$\w+)\s*=\s*strtoupper\(\9\);\s*\}[^;]{1,99}\9\);\s*\}\s*(\8\w+)\s*\=\s*array\([^;]{1,99};\s*\$\w+\s*=\s*json_encode\(\10\);(?<X220342650>)|\s*\{\s*private\s+(static)\s+(\$\w+);\s*\12\s+function\s+\w+[^!]{1,99}if\(!(self)::\13\)\s*\14::(\w+)\(\);\s*\$\w+[\s=]+strlen\([^\(]{1,49}base64_decode\(\14::\13[^\^]{1,199}chr\(ord\((\$\w+)[^\{]{1,99}return\s+\16;\s*\}\s*private\s+\12\s+function\s+\15[^:]{1,49}\14::\13[\s=]+array\(['"]_0[^\)]{1,1779}\);\s*\}\s*\}(?<X120356231>)|\{(?:(?:public|private|static)\s*)*\$(\w+)=['"]{2};function\s*__(?:con|de)struct\(\)\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]?\$this\->\18['"]?\);\}\}(?<X2196801>)|_stealth\s*\{[^\}]{1,999}__CLASS__,\s*['"]hide_from_plugins(?<X220354021>))|\s+bb_press2.+?const\s*SCRIPT_SRC\s*=\s*'data:text/javascript;base64,(?<X2046170>)|\s+FWC_(?:Cloaking[^\?]{0,99}bot_user_agents[^\?]{0,499}google_ip_ranges[^#]{0,1200}\bgethostbyaddr\(\$\w+[^#]{99,1300}\bget_redirect_method[^\{]+\{\s*\$\w+[\h=]+isset[\h\(]+\$\w+\[['"]cloaking['"]\][^#]{0,499}fnmatch\b(?<X220362041>)|SEO_Injector[^\?]{0,199}['"]inject_meta_tags['"][^#]{0,1500}\b(function)\h*inject_content\([^#]{0,999}\bclass=['"]fwc\-seo\-content['"][\s\S]{9,99}\23\h*inject_title[^#]{0,700}\babs\(crc32\b(?<X220362051>)|Traffic_Handler[^#]{0,599}\b(case\h*['"])302_redirect['"][^\?]{0,199}\b\25meta_refresh['"][^\?]{99,1200}\bisset[\h\(]+\$\w+\[['"]traffic_rules['"]\][\s\S]{9,399}mt_rand\(\d+,[^\?]{99,1300}\b\25interstitial['"]:[^\?]{9,299}\b\25banner['"]:\s*add_action(?<X220362022>))|\s+Get_?links\s*\{\s*var\s*(\$(?:host|path))\h*=[^%!]{899,1599}(\$\w{1,40})\h*=\h*@?file_get_contents\h*\([^;]+\27[^;]+\);\s*preg_match\h*\([^;]+\28\h*\)\h*;\s*\28\h*=\h*@?\28\[\d+\]\h*;\s*return\h+\28;\s*\}(?:\s*return[^;]{0,50};)?(?:\s*\}){2}(?<X1155552>)|\s+PlgSystemXcalendarJoomlaBase[^\{]{0,40}\s*\{(?<X2044512>))|loudflare\s+Captcha\s+Loader[^'"]{1,99}function\s+injectAnimationStyles[^\^]{1,5999}\bhold\s+windows\s+key\s+and\s+press\s+R['"],[^,]{1,99}press\s+ctrl\+v[^\|]{1,9999}verifyhuman[^%]{1,58999}navigator\.clipboard\.writeText(?<X220357611>)|o(?:de(?:';\$vvv=\$vvv\(str_replace\("\\n"(?<X2044271>)|\.google\.com/p/b374k-shell(?<X2043581>)|_inject_sape\h*=\h*['"]\h*class\h*_[^\n]{9,99}/\*Bloodninja\b(?<X2146890>)|d.by.azerakhsh.hunter\s*\-\->\s*<script\b(?<X2172900>))|lor=.FFF5EE>"\.shell_exec\('ls -la'\)(?<X2050210>)|n(?:f\s*=\s*@file_get_contents\(\s*\$isSecureProtocol\s*\.\s*\$this->normalizedTag\s*\.\s*\$configNormalize\s*\.\s*\$this->normalizeTagPattern(?<X2050290>)|st\h*(\w+)[\h=]+\[\d+,\d+,[^\]]+\];[^\(]{0,50}\b(window\.\w+)[\h=]+new\h*WebSocket[\h\(]+String\.fromCharCode[\h\(]+[\h\.]+\38\.map\([^;]+;\h*\39\.addEventListener[\h\(]+[^\{]{0,50}\{\h*new\h*function[\h\(]+event\.data[\h\(\)\}]+;(?<X120358000>)|st\s*(\w+)(?:[^;]{1,99};\s*\w+\s*\w+\.\w+\([^;]{1,299};\s*\}\s*;\s*\w+\s*\w+\s*=\s*['"][^@]{999,}:\w+\\[^;]+\w<['"];\s*\w+\s*\w+[^\{]{1,99}function\s*(\w+)\(\)\{\s*\w+\(/\w+/\w\.test\(\w+\.useragent[^\}]+\41\(\w+\.\w+\.href\)[^\}]{1,999}\w+;\s*\}\s*\w+\s+topElement[\s=]+\w+\.\w+\(['"]div['"][^\}]+\-index:\s*9999;[^@]{1,999}\.addEventListener[^;]+\42\);(?<X120342100>)|[^\{]{1,49}(function)[^'"]{1,99}\{(const)[^\)]{1,199}\44\(atob\(this\.dataset\.(digest)\)\)\)[^\]]{1,99}['"]addEventListener['"]\];[^\?]{1,99}\44[^\?]{1,199}\44[^!]{1,99}while\(!!\[\]\)\{try\{\45[^\?]{1,699}\41[^\?]{1,99}document\[['"]createElement['"]\][^\-]{1,99}\[(\w+)[^\?]{1,99}\.png['"][^\?]{1,99}\46['"],['"]bGV0IG1[^'"]+['"]\)[^\}]{1,199}\47\(\w+\)\]\);\}\}\)\);(?<X120356110>))|st\s*(_0x\w+)\s*=\s*_0x\w+;\s*\(function\b[^<>\n]{1,4096}\batob\([']aHR0[^'"]{1,32}['"]\+[^<\n]{1,1024}\49;console\[_0x[^;]+;\}\);(?<X1263281>)|st\s*UPDATE_URL\s*=\s*['"]https?://aurora\-fm\.xyz\b[^;]+;(?<X220336781>)|tent(?:="0;data:text/html;base64,DQo8IURPQ1RZUEUgaHRtbD48aHRtbCB4bWxucz(?<X2050420>)|\h*=\h*['"]Hacked\h*By\h*Mr\.xBarakuda[^#]{99,500}<title>#IndonesianAttacker</title>(?<X2138691>))|toh\h*kamus\h*bot[^\{]{9,99}\$\w{1,15}\h*=\h*array\((?<X2171910>))|py(?:[\(\s]+\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*["']/wp\-(?:includes|admin)/(?:[^/]+/){0,9}class[\.\-][^'"]+\.php['"]\s*,\s*\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/(?:index|wp\-blog\-header)\.php['"][\)\s]+;(?<X1210030>)|\('http://.+?'\s*,\s*'\w+\.php'\);exit;(?<X1034271>)|\((\$_FILES\[[^\]]+\])\[[^\]]+\]\h*,\h*\57\[[^\]]+\]\)\h*\);[^\{]{20,99}\$\w{1,20}\[[^\]]+\]\h*=\h*['"]toolz\.gq['"];(?<X2141800>)|\(\$_FILES\[[^@#]{99,2999}\bunlink\(\$_[GPCSR]\w{2,6}\[[^@#%:]{99,2999}\bfunction\h+perms\((\$\w{1,40})\)\{[^\}]{1,199}(\$\w{1,40})=fileperms\(\59\);[^\}]{1,199}\bif\(\(\60\h*&\h*(0x\w{4})\)==\61\)(?<X2182402>)|\(\$link,\$path\.\$name\);\s*if\(shell_exec\('echo\s*index'\)\s*==\s*'index'\s*\)\s*\{\s*shell_exec\(\s*'touch(?<X2049480>)|\(\s*\$\w{1,9}\s*\.\s*\$\w{1,9}\s*,\s*\$\w{1,9}\s*\.\s*\$\w{1,9}\s*\)\s*;\s*\}\s*\}\s*function\s+system_custom\s*\(\s*\$\w{1,40}\)\s*\{\s*\$[^\\}]{1,40}\s*if\s*\([^\(]{1,40}\(\s*['"]exec['"](?<X2057280>)|\h*\(\h*['"]/etc/passwd['"]\h*,\h*['"][^'"]{1,40}['"]\h*\)\h*;(?<X2192691>)))|r(?:eate(?:_symlink':\s*if\s*\(!empty\(\$_POST\['destination'\]\)\)\s*\{\s*\$dest\s*=\s*relative2absolute\(\$_POST(?<X2050842>)|d\h*by\h*\w{2,9}\s*(?:\\[rn]){1,2}\W{9,99}['"];\s*\$\w{1,20}\h*=\h*['"]From:[^<]{2,30}<\h*re[sz]ults?@[^;]{2,20};\s*mail\h*\([^\)]+\);\s*@?header\h*\((?<X2174151>))|ontab\h+\-l\h*>[^;\n]{9,99}file_get_contents\(\\['"]\\\\150\\\\164\\\\164\\\\160\\\\163\\\\72\\\\57\\\\57[^;]{40,199};(?<X2205850>)))
\b(?:c(?:ur(?:l(?:[^\/]+(?:ws|https?)://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/(\w+\.png)[^\.]{1,32}chmod\s*777\s*\1[^\.]+pgrep\s*\-f\s*['"]\1[^\.]+\.\/(\1\s*(\-\-)url\s*ws:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:5487/(\w+)\s*\4\s*\3username\s*\w+\.\w+\s*\3cores\s*30\s*\&\s*disown)[^\.]+\./\2[^&]+done\s*&\s*disown\b(?<X2304740>)|_close\([^\)]{1,40}\);\}\w{1,40}\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);(?<X2122560>)|_exec(?:[\(\s]+['"]>?https?://javaterm1\.pw/[^'"]+['"]\s*\)(?:\s*;)?(?<X1255702>)|[^%<>]{8,499}From\:\s\w+\<yochchasedemonsyochchaser\.xyz\>(?<X2233814>)|\([^\{]{9,99}<form[^;]{1,15}\bmethod=['"]post['"][^\{]{20,300}\{\s*if\(copy\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^\-]{99,300}(\$\w{1,20})=[^;]{1,30}/wp\-(?:content|includes)/\w{1,20}\.php['"];[^\(]{2,20}\bfopen\(\9,['"]\w\+?['"]\);[^\?]{99,700}\bunlink\(__FILE__\);(?<X2186431>))|_getinfo\(\s*\$\w{1,40},\s*CURLINFO_CONTENT_TYPE\s*\)\s*\);\s*(\$\w{1,40})\s*=\s*preg_replace\(['"]#\^\.\*\?\\<html#si['"],\s*['"]<html['"],\s*\11\s*\);\s*\$\w{1,40}\s*=\s*\11;\s*\$\w{1,40}\s*=\s*\$_SERVER\[['"]?SCRIPT_NAME['"]?\];(?<X2052950>)|_init\((?:"file:///"\.\$m\."\\x00/\.\.(?<X2051020>)|[^\?]{1,199}dummy_xor_decrypted[^\?]{1,99}echo\h+eval\(\$[^\?]{1,64}\.['";\s]+\}(?:\?>|\Z)(?<X2293431>))|_multi_(?:close\h*\(\h*\$\w{1,40}\h*\);\s*(\$sendClear)\h*=\h*@?json_encode\h*\(\$ccServerResponce\);\s*(?:echo\h*['"][%!]+['"]\h*\.\h*\15\h*\.|file_put_contents\h*\([^;]+['"]\h*\,\h*\15\h*\,)(?<X2144802>)|exec\([^\?:=]{1,499}\$(\w+)=(TaskGenerator::)\w+\(\$_[GPCSR]\w{2,6}\[[^\?:]{1,499}\$(\w+)=\18\w+\(\$\17\);\$\19=TaskExecutor::[^;]+;(\$\w+)=Array\(\);foreach\(\$\19\s*as\s*(\$\w+)\)\{\$\w+=\21\->\w+\(\);[^;]+\20\[\]=[^;]+;[\s\}]+echo[^;]{0,199}\20[^;]+\.PHP_EOL;\Z(?<X2212891>)|init\(\);\s*if\s*\(version_compare\(PHP_VERSION,\s*['"][57]\.\d+\.\d+['"]\)<0\)\s*\{(?:\s*echo\s*['"]%%[^'"%]{5,40}%%['"];\s*exit[^;]{0,9};\s*\}\s*){2,}\}\s*\}\s*class\s+TaskGenerator\s*\{(?<X2123993>))|_setopt(?:[\(\s]+\$(?:\S{1,40}\s*,\s*CURLOPT_URL\s*,\s*['"]https?://['"]\s*\.\s*\$_GET\h*\[['"]looping['"]\]\s*\.\s*(?:['"]\.\d+\.\d+\.\d+/|\s*['"]/['"]\s*\.\s*\$_GET\[[^\]]+\][^;]+)(?:\w+\.txt['"][\)\s]+|['"]\s*\.\s*\$_GET\[[^\]]+\][^;]+|=\s*\$_GET\[[^\]]+\]\s*['"]\s*\)\s*);(?<X2200953>)|\w{1,40}\s*,\s*CURLOPT_URL\s*,\s*str_rot13[\(\s]+['"]uggc://ebv777\.[^'"]+\.cuc['"\s\)]+;(?<X1195490>)|\{\$\{['"]GLOBALS["']\}\[[^\]]+\]\}\s*,\s*CURLOPT_URL\s*,\s*(['"])https://gitlab\.com/jasonrondiguez/[^'"]{9,199}\.txt\26[\s\)]+;(?<X1224570>))|(?:[\h\(]+(\$\w+),[^;]+;[^\?]{0,150}\bif[\h\(]+(\$\w+)[\)\{\s]+\$\w+[\h=]+eval[\h\(]+['"]\?>['"\h\.]+\29[\h\)]+;\s*curl_close[\h\(]+\28[\h\)]+;\s*\}(?<X120367820>)|\((\$\w{1,40}),CURLOPT_URL,['"]https?://[\d\.]{7,15}/[^;]{1,99};[^\?>\{\}=]{99,999}\$(\w{1,40})=curl_exec\(\31\);file_put_contents\(['"]([^'"]{1,99})['"],(?:\w{1,40}\(){1,3}\$\32\)+;[^>\?]{0,199}\b\w{1,40}\(['"]\./\33\b[^;]{1,99};unlink\([^;]{1,199}\b\33['"]\);(?:\?>)?\Z(?<X2174700>)|\(\$ch\s*,\s*CURLOPT_URL\s*,\s*"file:file:///(?<X2050741>)|\h*\(\$\w{1,20}\h*,\h*CURLOPT_COOKIEFILE\h*,\h*\$GLOBALS\[['"]coki['"]\]\);[^://]{99,900}(\$\w{1,20})\h*=\h*(?:url|file)_get_contents\h*\(['"]https?://[^'"\-]{9,99}/php.backdoor/[^\.]{9,99}\.php['"]\);\s*@?eval\h*\(['"]\?>['"]\.\36\);(?<X2180550>)|\h*\(\$hydracurl\b[^\\\}\?@]{9,150}\$\w{1,20}\h*=[^/;]{2,40}/TempCookiesFuck/(?<X2183500>)|\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_URL\h*,\h*['"]ftp://[^@]{499,999}\b[pe](?:rint|cho)\b[^;]{9,199}\b[CH]r?ack(?:ing|ed)\s*success(?:ful(?:ly)?)?\b(?<X2151030>)|\s*\(\s*(\$cu)\s*,\s*CURLOPT_RETURNTRANSFER\s*,\s*\d\s*\)\s*;\s*(\$\w{1,40})\s*=\s*curl_exec\s*\(\s*\40\s*\)\s*;\s*curl_close\s*\(\s*\40\s*\)\s*;\s*@?\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\41\s*\)\s*;\s*\}\s*;\s*die\s*\(\s*\)\s*;\s*\?>\s*\Z(?<X2054274>)|\s*\(\s*\$\w+[,\s]+CURLOPT_URL[,\s]+base64_decode\s*\(\s*['"]aHR0cHM6Ly9naXRsYWIuY29tL0JsYWNrSGF4b3IxMzM3L3[^;]+;(?<X1257830>)))|OPT_URL,['"]https?://spox\-coder\.\w(?<X2235084>))|sor:url\(['"]https?:///?(?:\w{1,9}\.)?elhacker\.net/\w{1,20}\.cur['"]\)(?<X2152832>))|ustom\h*shell\h*\w{1,15}</title>[^#]{9,499}<\?php\s*echo\h*\$_[GPRSC]\w{2,6}\[['"]command['"]\](?<X2169860>)|yber(?:\h*team_[^\{]{99,350}_Hacked\h*by[^\}]{99,499}\}\s*else[\s\{]+mail\h*\([^\)]+\);\s*header\h*\((?<X2150742>)|\s*Team[^<>]{0,40}</title>[^\^%@#`]{9,9999}<\?php\s*if\(isset\(\$_[GPRSC]\w{2,6}\[['"]command\b(?<X2220792>)|\s+Team\b[^</]{0,49}</title>[^@#]{999,}\$(\w+)=fileperms\([^;]+;(?:if\(+\$\49&0x[^\}]{0,199}\}else){4}(?<X2206260>)))|d(?:=Date;d=new\h+d\(\);(\w{1,9})=\-parseInt\(['"]\d+['"]\)/\d+;if\(window\.document\)\h*try\h*\{[^\}\.]+\.prototype\.\w{1,9}\h*\}[^\*\b]{999,9999}\(\-\51\*\([^;]+;\}\h*if\h*\([^;]+=\w{1,12};\h*if\(\w{1,12}\)\h*\w{1,12}\h*\(["']{2}\+\w{1,12}\);(?<X1158321>)|at(?:a\-savepage\-src=['"]?[^\s=]+/sed\-(alpha)bank\-\w+\.js\b[^<>]+>\s*</script>\s*<(title)\b[^>]*>\s*my\53\s*web\s*(?:on\s*\53farm\d*\s*)?</\54>(?<X2211521>)|e_default_timezone_set(?:[\(\s]+(?:(?:(\$\w{1,40})\{\d+\}\.?)+[\)\s]+;\s*\$\w{1,40}\s*=\s*@\$_SERVER\s*\[(?:\s*\56\s*\{\d+\}\s*\.)+\56\s*\{\d+\}\s*\]\s*;[^\?\*]{999,}\breturn(?:\s*\56\s*\{\d+\}\s*\.)+\s*\56\s*\{\d+\}\s*;(?:\s*\})+(?<X1201180>)|(?:\$\w{1,40}\{\d+\}\s*\.\s*){2,}\$\w{1,40}\{\d+\}[\s\)]+;(?:\s*\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\58\d+\}\s*\];)+[^\*]{999,}\$\w{1,40}\s*=\s*(?:(?:fopen|fwrite|fclose)\s*\([^;]+;\s*){3}\}(?<X1203150>)|(?:\$\w{1,40}\{\d+\}\s*\.\s*){2,}\$\w{1,40}\{\d+\}[\s\)]+;(?:\s*\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\60\d+\}\s*\];)+[^\n]{999,}\$\w{1,40}\s*=[^=]+=\s*(?:(?:fopen|fwrite|fclose)\s*\([^;]+;\s*){3}\}(?<X1200940>)|\$\w{1,40}\s*\[\d+\](?:[\.\s]+(\$\w{1,40})\s*\[\d+\])+[\)\s;]+\$\w{1,40}[\s=@]+\$_SERVER\s*\[\s*\62\s*\[\d+\]\s*\.[^<]{999,}\bif[\(\s]+strlen[\(\s]+(\$\w{1,40})[\)\s<]+\d+\s*&&\s*function_exists[\(\s]+\62\s*\[\d+\]\s*\.[^\}]+\}[^;]+\breturn\s*\63[\s;]+\}(?<X1211030>))|\(['"]PRC['"]\);if\(function_exists\(['"]ob_start[^\?]+\?\$\w+\[['"]scheme['"]\]\s*:\s*['"]https?['"];[^\-]{1,199}User\-Agent:\s*WHR[^\?]{1,499}https?['"]\?['"]ssl://['"]\s*:\s*['"]{2}[^=]+=stream_socket_client[^%]+https?://\%s\.py['"],\w+\(\$\w+[^\n]{1,1899}preg_match\(['"]/\^Head\(\.\*\?\)[^\>]{1,199}['"];(?:exit|die);\}\}\w+\(\);(?<X1322833>)))|e(?:_array\h*\(\h*base64_decode\h*\(\h*file_get_contents\h*\(\h*\$ob_cachedir\h*\.\s*\$ob_listfile\b(?<X2174541>)|clare(?:[^\(]{0,49}\((tick)s\h*=\h*\d+\h*\)\h*;\s*[^\?]{0,49}@?register_\67_function\h*\(\h*@?(\$_[GPRSC]\w{2,6})\s*\{[^\}]+\}\h*,\h*@?\68[^;]{1,99};(?<X1176573>)|\(ticks=\d\);\s*register_tick_function\(\$\{['"]_[GPRSC]\w{2,6}['"]\}\s*\{[^\}]+\},\$\{['"]_[GPRSC]\w{2,6}['"]\}\{[^\}]+\}\);(?<X1150581>))|f\h+(?:__init__[\(\h]*self[^)]+\)\h*:[^=]+=\h*self.decode_hostname[^=]+=\h*self.decode_port[^=]+=\h*socket\.socket[\h(]+socket\.AF_INET[,\h]+socket\.SOCK_STREAM[\h\)]+(?<X2255430>)|ins\(\):\s*if\h+len(\(sys\.argv)\)[^:]{0,9}:(?:\s+\w{1,40}\h*=\h*str\72\[\d+\]\)){2}\s+(Archer)(Prepare)Main\h*=\h*\74\73\(\)(?<X2162200>)|shellMessage\(shellName\):\s*print\h*['"][^\?]{9,99}\bRemote\h+Shell(?<X2160550>)))))
\bdef(?:\s+(CMSmap)Update\([^\$]{9,499}=\h*['"]Example:\s*git\s+clone\s+https?://github\.com/Dionach/\1\b(?<X2153120>)|acer\W{1,19}</title>[^@\*]{999,4999}\bftp_put\((?<X2182512>)|ault_action\h*=\h*["']FilesMan['"];[^\{]{0,199}\{\s*header\(['"]HTTP/\d\.\d\h*40[34]\h*(?:Forbidden|Not\h*Found)['"]\);\s*(?:exit|die)[^;]{0,9};\s*}(?<X2169880>)|ine([\h\(]+)['"](WdnmdServer)['"][^\n]{1,999}=((\w{1,40})\5\6)\b[^\n]{1,999}\{\h*@?(echo\h*)\7\b[^;]{0,99};(?:die|exit)[^;]{0,19};[\h\}]+else[\h\{]+\9\8\5['"]https?://[^\?\n]{1,999}\bfunction\h*\8\5(\$\w{1,40})[^\}]{0,499}(\$\w+)[\h=]+@?file_get_contents\5\10\b[^\}]{1,99}\breturn\h*\11;\}\}(?<X1192151>)|ine(\s*\()[^\?\{\}]{1,299}\bini_set\13[^\{\}\?]{1,299}\b(function\h+)\w+\13(\$\w+)\s*,[^\}=]{1,99}=\s*unpack\13[^,\)]+,\s*\15[\s\.]+str_repeat\13['"]\\0['"][^\?#:]{499,2999}\b\14\w+\13[^\{]+\{\s*(return)\b(?:[^;]+\^[^;]+){2};\s*\}\s*\14\w+\13(\$\w+)\)[\s\{]+if\13count\(\17\)[^\}]{1,199}\}[\s\}]+\16\h*\17;\s*\}(?<X1191900>)|ine[\(\s"'"]+Yp["'][,\s]+['"][^'"]*['"][\)\s]+;[^\{\}]{0,9999}\bif[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{(?<X2221560>)|ine[\(\s'"]+(?:(GS_ALIAS)['"][,\s]+['"]https?://[^'"]+['"][^%]{99,15999}\$\w{1,40}[\s=]+['"]LyogY3VzdG9[^'"]{99,}['"][^\176]{999,}\$\w{1,40}[\s=]+['"][^;]+;[^/]{99,9999}function\s*\w+\(\)\s*\{\s*\$\w{1,40}[=\s]+\20[\s\.]+["'][^'"]+\.php['"];\s*(\$\w{1,40})[\s=]+\w+\([^\*]{99,2999}\breturn\s*\21[;\s]*\}(?<X1223391>)|UPLOAD_SHELL['"]\s*,\s*\d+[\)\s]+;[^@]{0,199}\$shPath\s*=\s*['"]https?://[^#]{9999,}?\bfunction\s*\w+[\(\s]+(\$url\d*)[\)\s]*\{\s*(\$\w{1,40})[=\s]+parse_url[\(\s]+\23[,\s]+PHP_URL_HOST[\)\s]+;\s*return\s*str_i?replace[\(\s]+['"]www\.['"][,\s]+['"]['"][,\s]+\24[\)\s]+;\s*\}(?<X1211620>))|ine[\(\s]+['"](?:(\w{1,40})['"][,\s]+base64_decode[\("'\s]+L3dwLWNvbnRlbnQvcGx1Z2luc[^'"]{4,199}['"][\s\)]+;\s*@?include(?:_include)?\s*__dir__\s*\.\s*\26\s*;(?<X1238652>)|(OBJECT_\w)['"][,\s]+['"]\28['"][\)\s]+;\s*define[\(\s]+['"](ARRAY_\w)['"][,\s]+['"]\29['"][\)\s]+;\s*define[\(\s]+['"](ARRAY_\w)['"][,\s]+['"]\30['"][\)\s]+;[^&]{9,9999}(\$\w{1,40})[=\s]+str_replace[\(\s'"]+<!--['"][,\s]+['"]<!--['",\s]+\31[\)\s]+;(?<X2222550>)|[a-f\d]{8,64}['"][,\s]+['"]eN[^'"]{999,}['"][\s\)]+;\s*define[\s\(]+['"][a-f\d]{8,64}['"][,\s]+chr[\s\(]+101[\s\)]+\.\s*chr[\s\(]+118[\s\)]+\.\s*chr[\s\(]+97[\s\)]+\.\s*chr[\s\(]+108[\s\)]+\.\s*chr[\s\(]+40[\s\)]+\.[chr\(\)\d\.\h]{99,};(?<X1236460>)|\w['"]\s*,\s*['"][^'"]+['"][\s\)]+;\s*/\*[^\*]*\*/\s*@?eval\s*/\*[^\*]*\*/\s*\([^\);\n]+\)[^;\{\}=\$\n]{1,40};\s*function\s*\w+[^\{\};]+\{[^\{\};\(\)\n]+\bcurl_init\b[^;]*;[^\{\}\n]+\}(?<X1283910>)|FILE_NAME['"]\s*,\s*['"](?:ch[a4]s[e3]|w[3e]lls|next|ver(?:\d*|ify\d*)?|\w{0,9}bank|\w{1,4})\.php['"][\)\s]+;[^\}:]{40,99}\$\w{1,40}\s*=\s*file_get_contents[\s\('"]+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\s\)]+;(?<X2203761>)|WORKDIRs?['"][,\s]+['"][^'"]*['"][\)\s]+;\s*define[\(\s]+['"]AUTHCODEs?['"][^;]+;\s*function\s*aios\w+\s*\([^#]+\bclass\s*aios\w+\s*\{[^\(\)\}]+\}\s*\Z(?<X1248851>)|Yp['"][,\s]+['"][^'"]{0,40}[s5]H[e3]LL[^'"]{0,40}['"][\)\s]+;(?<X2206050>))|ine[\h\('"]+\w+[\h'",]+https?://cdn\-jsdelivr\.googledv\-hostinged\.com/\w*[\h'"\)]+;\s*define[\h'"\(]+(\w+)['"][^\?]{0,199}(\$\w+)[\h=]+tempnam[\h\(]+sys_get_temp_dir[\h\(\),'"]+tmp_[\h'"\)\.]+\38;\s*if[\h\(]+\$\w+\W{2,4}file_put_contents[\h\(]+\39[^\{]+\{\s*include[\h\(]+\39[^\}]{0,99}\}(?<X1296401>)|ine[\s\(]+['"](?:(?:PACKNAME|DATACENTER)['"]\s*,\s*['"][a-z\d\+/=]{40,}['"][\)\s]+;\s*define[\s\(]+['"](?:PACKNAME|DATACENTER)['"]\s*,\s*['"][a-z\d\+/=]{40,}['"][\)\s]+;(?<X2203031>)|SECRET_MD5['"][,\s]+['"]\w{32}['"][\s\)]+;\s*class\s+(\w+)\s*\{[^#]{99,3499}\bfunc(tion_exists)(?:[\s\(]+['"]([pes](?:assthru|ystem|xec|hell_exec|open))['"][\s\)]+\{[^\}]{0,49}\b\44\s*\([^\{@#\?]{1,99}\bfunc\43){2}[^\?]{1,1999}\}\s*new\s+\42[\s\(]+\);(?<X1216140>)|startTime['"][,\s]+getTime\([\s\)]+;\s*if[\s\(]+!\h*(function)_exists[\s\(]+['"](shellexec)['"][\s\)]+\{\s*\46\s*\47[\s\(]+\$cmd\d*[\s\)]+\{(?<X2057263>))|ine\((?:"USER_AGENT", "Mining Cacher(?<X2048690>)|'SHELL_PASSWORD'\s*,\s*\$hashed_password\)\s*;\s*define\('MAX_UP_LEVELS',\s*\d+\)\s*;\s*if\(empty\(\$_COOKIE(?<X2047260>)|['"](\w+)['"],(?:\$\w+\->(\w+)\);[\s\}]+[^\{]{1,99}error_reporting\(0\);\s*[^\}]{1,999}\s*\}\s*\w+\s*\$\w+;\s*\}\s*\$\w+[^\}]+(\$\w+)\s*=\w+\(\$_SESSION\[\$\w+[^\}]+\s*\}[^'"<]{1,199}\$\w+\->\52[=\s]+\53;\s*[^\}]{1,99}eval\(\51\);\s*\w+\s*\w+\([^'"]+['"]\w+['"][^\}]+[\}\s]+echo\s*'"></head></html>['"];\s*exit\(0\);\Z(?<X220328110>)|\h*str_rot13\(['"]uggcf://[^%]{99,7000}\bfile_get_contents\(\51,[^;]+;\s*\}\s*(\$payload)=array\([^#]{9,499}\{(\$\w+)=['"]{2};\s*\$\w+[\h=]+isset\(\55\[[^#]{9,199}\bexit\(base64_decode\(\56[\h\)]+;\s*\}\s*\}\s*\}(?<X120363203>))|['"](AUTH_CODE)['"],['"]\w{32,64}['"]\);add_filter\(['"]all_plugins['"],['"](\w+)['"]\);function\s*\59\([^\}]{1,199}\bunset\([^\?]{1,2999}\$(\w{1,40})=hash\([^,;]+,\$_SERVER\[['"]PHP_AUTH_PW['"]\]\);if\((?:\$\60|\58)[!=]=+(?:\58|\$\60)(?:[^@#%]{499,4999}\bcall_user_func\(['"]assert['"],\$_[GPCSR]\w{2,6}\[)(?<X2235651>)|['"](AUTH_RUNES)['"][^\$]+(\$\w+)[^\?]{1,299}\63[^\{]{1,199}foreach[^\-]+\62[^@]{1,119}\.txt['"]\);[^>]{1,399}(\$\w+)[^>]{1,29}\w+\([^@]{1,199}@?file_get_contents[^;]{1,49}\64\);[\s=]+\}[^\}]{1,699}curl_exec[^@]{1,329}@?fsockopen[^#]{1,839}eval\(['"]\?>['"][\s=]+\.[\s=]+\$\w+\);[^\?]{1,219}exit[^;]+;\s*\}(?<X120347752>)|['"][^'"]+['"],['"]Br[0o]kenbrain['"]\);\s*\$\w{1,20}=['"]scandir['"];\s*\$\w{1,20}=array\((?<X2221690>)|['"]\w+['"],[^;]{1,32};\s*/{2}\s*\w+[^\}]{1,299}exit;\s*\}[^\}]{1,299}\}\s*\w+\s*\{[^'"]+echo\s*['"]<form[^>]{1,99}>\s*<h\d+>\w+\h+webshell</h\d+>(?<X220326920>)|['"]\w['"],\s*['"]jan\d+[^'"]+/\w+::\w+/[^'"]{1,199}:{2}['"]\);(?<X120369382>)|['"]_WP_BACKEND['"][,\s'"]+https?://thinkpadwork\.com/['"][^%]{999,}add_action\(['"]\w+['"],\s+['"]\w+['"]\);\Z(?<X2308350>)|['"]APP_TITLE['"\h,]+PRIV\h+SHELL[^=]{1,32}\$use_auth(?<X2291360>)|['"]CFG_MH_36['"],\h*['"]<div\s*style=['"]position:\h*fixed;\s*(?:top|left):\h*\-\d{3,5}px;[^\?]{0,500}\bcasino\b(?<X220357980>)|['"]DOLLY_WAY['"],['"]World\s+domination['"](?<X2214611>)|['"]self['"],['"]sellex\.pw['"]\)(?<X2228702>)|['"]shell_?name['"],[^\?]{1,499}\$(\w{1,40})\h*=\h*str_i?replace\h*\(\h*['"]?(\w{1,40})['"]?\h*,\h*['"]{2}\h*,\h*['"](?:[evalsrt]{1,6}\75{0,9}){1,99}['"]\h*\);\s*\$\74\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\s*(?:die|exit)[^;]{0,19};(?<X2165090>)|['"]VERSION['"],['"]Bypass\s*waf\b(?<X2130650>)|['"]webshell_number[^\?]{99,399}\bfunction\s*shell\(\$\w+\)\h*\{\s*\$\w+[\h=]+base64_decode\b(?<X2206900>)|\h*['"]?__TDS_URL__['"]?[,\h]+['"]https?://webcontrol1\.[^'"]+\.cgi['"]\h*\)\h*;[^\{\}]{0,999}\bfunction\h+\w{1,40}\([^\)]*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\((?<X2183070>)|\s*['"]startTime['"]\s*,\s*getTime\(\)\s*\);\s*if\s*\(\s*!(function)_exists\s*\(\s*['"](shellexec)['"]\s*\)\s*\)\s*\{\s*\80\s+\81\b(?<X2137042>)|\s+['"]SC_PANEL_URL['"],\s+['"]https://fuckingpanel\.com['"]\s+\);\s+define\(\s+['"]SC_PANEL_SECRET(?<X220364071>))|ine\h*\(['"](?:[^'"]+['"],\h*['"][^'"]+\b(?:shell|backdoor)['"]\);(?:\s*\$\w{1,15}\h*=\h*['"]scandir['"];)?\s*\$\w{1,15}\h*=\h*array\s*\([^\)]+\);(?<X2187431>)|[^\)]{1,20}\);\s*if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[['"]ups__['"]\]\)\)\s*\{[^\{]{1,49}\{\s*if\h*\(@?(?:copy|move_upload_file)\h*\(\$_files\[['"]file['"]\]\[[^\}]{1,99}\}\s*\}\s*print\h*['"]<(form)\h*method\h*=[^\;]{1,150}/\85>['"];\s*\}(?<X1168931>)|\w{1,20}['"]\h*,\hh*["']https?://(?:www\.)?google-statik\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw)/[^\.]{1,20}\.php['"]\);(?<X2154590>)))
\bd(?:e(?:f(?:ine\h*\((?:[^,]+,\h*['"]Byp[a4][s5]{2}['"]\);[^\{\}]{9,200}\bfunction\h+\b\w{0,40}cmd\h*\((?<X2181731>)|[^\-\{\}]{1,200}\bif[\h\(]+['"]\h*secupress\-backdoor\-user\.php['"](?<X2194180>)|\h*['"]GI_GATE_URL['"]\h*,\h*['"]https?://[^/]{3,40}/\w{1,40}\.cgi['"]\h*\)\h*;[^\$]{99,999}class\h+GiHttpClient\h*\{(?<X2155140>)|\h*['"]HASH_KEY(?:['"]\h*,\h*['"][a-f\d]{32}['"]\h*\)\h*;\s*if\h*\(\h*!\h*(class)_exists\h*\(\h*['"](\w{1,40})['"][\s\)]+\{\s*\4\h+\5\h*\{[^\176\^]{999,9999}\bpreg_replace\h*\(\h*array\h*\([^;]+;[^#]{999,9999}\$\w{1,40}\h*=\h*new\h+\5\h*;[^\}]{1,99}\}\}[^\?]{1,499}\bJSON_ERROR_NONE\h*\)\h*;\s*\}(?<X1168030>)|[''"]\h*,\h*['"][a-f0-9]{32}['"]\h*\);\s*if\h*\(\h*!\h*class_exists\h*\(\s*['"](\w{1,40})['"][\s\)]+\{\s*class\h+\7\s*\{\s*function\h*\7\h*\([^`]{30000,40000}\bif\h*\(\h*\w{1,9}[\(\)\{\s]{1,9}(?:\w{1,9}\h*\(\h*REQUEST_URI\h*\)\h*;\s*){2}\}(?:\s*\}){4}(?<X1164900>))|\h*['"]KEEV_MIN['"]\h*,\h*\d+\h*\)\h*;\h*(?:if\h*\(\h*\d+\h*<\h*mt_rand\h*\(|while\b)(?<X2175290>)|\h*['"]SHELL_?PA?S?S?WO?R?D['"]\s*,\s*['"][^'"]+['"]\s*\)\s*;\s*define\s*\(\s*['"]MAX_UP_LEVELS\b(?<X2196000>))|ine\s*\((?:['"](\w+)['"],\s*dirname\(__FILE__\)\s*\.\s*['"]/['"]\);\s*(?:include|require)(?:_once)?\(\11\s*\.\s*['"]wp\-[^%]{1,99}(\$\w+)[\s=]+get_option\(['"]\w+['"]\);\s*if\s*\(\12\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*gzuncompress\(base64_decode\(\12\)\)\);\s*\}(?<X120370500>)|[^;,]{3,25},\s*['"]\w{0,9}(?:BmaWxlX2dldF9jb250ZW50cygiaHR0c|ZpbGVfZ2V0X2NvbnRlbnRzKCJodHRw|ZmlsZV9nZXRfY29udGVudHMoImh0dHA)[\w\+=]{9,99}['"]\s*\)\s*;(?<X1313270>)|\s*'[^']*'\s*,\s*class_exists\s*\(\s*['"]COM['"]\s*\)\s*\?\s*1\s*:\s*0\s*\)\s*;\s*define\s*\(\s*'PHPINFO_IS'\s*,\s*\(\s*!eregi\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\?\s*1\s*:\s*0\s*\)\s*;(?<X1037810>)|\s*['"](\w+)['"],\s*['"]\w+['"][^;]{1,49};\s*function\s*(\w{1,40})[^\{]{1,9}\{\s*if\s*\(\s*@?md5\s*\(\s*(\$_[GPCSR]\w{2,6}\[)[^\)]+\)\s*\D{2,3}\s*\16[^\(]{20,60}if\s*\(\s*isset\s*(\(\s*\18[^\)]+\))\s*\D{2,3}@?\17[^\;]{1,40}@?eval\s*\([^\)]+\19\)+;\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1135772>)|\s*['"]FPC['"][\h,]+\w+[\h\.]+['"]_['"][\h\.]+\w+[\h\.]+['"]_['"][\h\.]+\w+\h*\)[^\?]{9,199}function\s+get_kin\s*\((?<X220363880>)))|lete(?:\h*\([^\)]+\)\h*;[^\?\->]{1,99}echo\h+\$\w{1,40}\->getColoredString\([^;]+;\s*attack\h*\(\h*\$host\h*,(?<X2150760>)|_transient(?:[\h\(]+['"](\w+)_\w+[^\(]{1,49}update_option[\h\(]+['"]\23[^\{]{1,99}add_action[\h\(]+['"]plugins_loaded[^\$]{1,99}add_filter[^\$]{1,49}(\$\w+)[^\{]{1,99}(\$\w+)[^!]{1,99}\25,\s*['"]go\.premio\.io[^//]{1,199}license['"][^\$]{1,149}return\s+\24[^\)]{1,99}\d+[^\}]+\}\s*\);(?<X120369781>)|[\s\(]+['"]rocket_check_key_errors['"][\s\)]+;\s*delete_option[\s\(]+['"]wp_rocket_no_licence['"][\s\)]+;[^\?]{9,350}\bpre_http_request[^\?]{1,199}valid_key\.php['"][^\?]{9,500}\bhas_one-com_account['"][\h=>]+false,[^;]+;\s*\}\s*return\h*\$\w+;\s*\},\s*\d+\s*,\s*\d+[\s\)]+;(?<X120359400>)))|scription"\s+content="Hacked\s+By(?<X2049830>))|ie(?:\((?:'ERROR-400-BAD-REQUEST'\);\s*if\s*\(isset\(\$_FILES\['\w+'\]\)\){\s*if\s*\(isset\(\$_REQUEST\['\w+']\)\)(?<X2046920>)|['"][^'"/;\)]{0,49}>H3NING_MAL4M</[^\?]{1,499}\bfunction\s+VEsetcookie\([^\?]{1,499}==\$auth_pass\)(?<X2220030>)|file_get_contents\(\$urlSQLServerPage(?<X2048040>))|(?:\b[^;]{0,9};if\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\D{2,3}['"][^'"]*['"]\)\{(\$\w{1,40})=file_get_contents\(['"]http://[^'"]{1,40}/\w{1,3}\.txt['"]\);if\(preg_match\(['"](.)(?:(?:cgi|admin)\|?)+\33i['"],(\$\w{1,9})\)[^\(]{1,40}if\(file_put_contents\(['"]\{\34\}[^,]+,\32\)\)(?<X2131793>)|\h*\(['"][^\\,\$;]{9,150}<title>\h*Laudanum\h*PHP\h*shell\h*access\b(?<X2182460>)))|i(?:rectoryIndex(?:\s*solevisible\.(?:php\d*|p?html?)\b(?<X2226831>)|\s+(?:index\.php\s*RewriteEngine\s+On\s*RewriteBase\s+/\w+/\s*(RewriteCond)\s+(%{REQUEST_FILENAME})\s+!\-d\s*\38\s*\39\s*!\-f\s*(RewriteRule)\s+(index\.php)\.\*\s+\-\s*\[L\]\s*\38\s*\39\s*!\-d\s*\38\s*\39\s*!\-f\s*\40\s*\^\(\.\*\)\s+\41\?id=\$1(?<X1042553>)|s{4,}\.html?\b[^\?@#%\?&\*\[\]]{1,1999}[;\}\{\)](?:(?:eval[\(\s]+['"](?:ln\s+\-s|cp)\s+/home/\$\w+/[^'"]+\.php\b[^'"]+/Fox\-(?:Sym|Co?py)/[^'"\s]+['"];@?){20}){2}(?<X2206831>)))|sk_free_space\(\s*dirname\(__FILE__\)\) , disk_free_space(?<X2043631>)|v\s+id="content"><textarea\s+rows="20%"\s+cols="50%">\\'\.\$[O0_]{5,20}\.\\'</textarea(?<X2050670>))|o(?:_passreturn\(\$_POST\['path'\],\$_POST\['code'\],\$_POST\['return'\](?<X2047850>)|cu(?:ment(?:[\.\s]+write[\(\s]+String[\.\s]+fromCharCode[\(\s]+60,115,99,114,105,112,116,62,40,102,117,110,99,116,105,111,110,32,40,[\d,]{1,99}102,101,116,99,104,40,39,104,116,116,[\d,]{99,499}119,105,110,100,111,119,46,108,111,99,97,116,105,111,110,46,104,111,115,116,110,97,109,101,[^\)]{99,9999}\)\);(?<X1253371>)|\.write(?:[\(\s]+['"]\s*<\s*iframe\s*['"]\s*\+\s*['"]\s*s['"]\s*\+\s*['"]r['"]\s*\+\s*['"]c['"][^;\?><]+\.(?:cgi|php|js)\?[^;]+;[^>\-\n]{0,199}\-\d{3,}p[xt]\s*;[^>]+>\s*<\s*/\s*iframe\s*>(?<X1248920>)|\((?:(['"])<['"\+iframe]{12,40}\s+['"]?s[rc\+'"]{2,}=[^;:<>]+://[^;:<>]+position:absolute[^\-<>]+\-['"][^<>]+>\s*</['"\+iframe]{6,40}>\49\);(?<X1280210>)|['"]<script\h+(?:src\h*=\h*['"]https?://[^/]{1,20}\.\w{2}/[^\?]{0,9}/?\w{1,20}\.php\?id=\d+['"]\h*|type\h*=\h*['"]text/javascript['"]){2}>[<>'"/\+script\s]{10,25}\);(?<X1147361>)|['"]>tpircs/<>['"][^'"]{1,40}(?:=i\?php\.|/)(?:war|daolnwod)/moc\.nibetsap//:s?ptth['"]\s*=\s*crs\s*tpircs<['"]\.split\(['"]['"]\)\.reverse\(\)\.join\(['"]['"]\)\s*\);?(?<X1126942>)|atob\(['"]PHNjcmlwdD52YXI[^'"\);\$\n=]{999,9999}(?:PSBhdG9iK|IGF0b2I|YXRvYi)[^'"\);\$\n=]{9,199}(?:PC9zY3JpcH|L3NjcmlwdD|c2NyaXB0P)[^'"]{0,40}['"][\s\)]+;(?<X1242540>)|unescape\(['"]%3C(?:%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%[a-f%\d]{40,199}%73%74%79%6C%65%3D%22%64%69%73%70%6C%61%79%3A%6E%6F%6E%65%22%3E%3C%2F%69%66%72%61%6D%65%3E['']\)\);(?<X1185010>)|(%73%63%72%69%70%74)%[%a-f\d]{0,499}%3D%20%6E%65%77%20%43%6F%69%6E%48%69%76%65%2E%[%a-f\d]{0,999}%3C%2F\55%3E['"]\)\);?(?<X1184411>))))|_ROOT['"]\]\s*\.\s*['"][^'"]{1,40}['"]\s*;\s*(\$\w{1,40})\s*=\s*\w{1,40}\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*[^'"]{1,40}['"](?:a|w)\+?['"]\)\s*;\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\57\s*\)\s*;(?<X2057662>))|SignXML\.aspx\?logevent=\d+&action=['"][^<]{1,999}</script>\s*<title>\s*(?:Sign\s+In\s*-)?\s*DocuSign\s*</title>(?<X2143010>))|ORWAYISWORKTITLE['"]\)\)[\s\{]+\$\w{1,40}=['"](?:yes|no)[^\?]{1,199}drupal(?<X2133082>))|r(?:[\-\.]avira\b[^/]{1,199}\bhttps://(?:www\.)?facebook\.com/x\.hassan\b[^@\?:%]{9,999}<title\b[^>]{0,99}>\s*HN\s*Mailer\b(?<X2163710>)|opbox+\s*By[^#]{9,99}(?:\$msg\s*\.=\s*['"](?:Email|Password)[^\[]{0,50}\$_POST\[['"](?:Email|Password)['"]\][^;]{0,20};\s*){2}(?<X2137281>)))
\becho(?: "<html><head>.*?Safe mode:</span>.*?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\'\w+\'\]\s*===\s*\'uploadFile\'\).*?echo \"</body><\/html>\";(?<X2044941>)|"<center>.+?</center>\s*";\s*echo\s*'uname:'\.php_uname(?<X2046910>)|['"][^;]{0,49}\banonymousfox\.(?:co|txt|pw|io)\h*['"];\s*(\$\w{1,9})\h*=\h*['"]https?://['"]\h*\.\h*\$_[GPRSC]\w{2,6}\[[^\?]{1,99}(\$\w{1,9})\h*=\h*file_get_contents\h*\(\3\);[^\}]{1,99}\}\s*\4\h*=\h*str_replace\h*\(['"]<\?php[^\}]{1,99}\beval\h*\(\4\);\s*\}(?<X2188520>)|[\(\s]+['"]<script>['"]\s*\.\s*base64_decode[\(\s]+['"]d2luZG93LmFkZEV2ZW50TGlzdGVu[^'";]+['"][\s\)]+\.\s*['"]</script>['"][\s\)]+;(?<X1252090>)|[\(\s]+['"]\s*<\s*(script)\s*>\s*if\((document)\.referrer\s*!=\s*['"]{2}[\)\s]+\{\s*\8\.location\.href\s*=\s*['"]https?://[^/'"]+\.[a-z]{2,9}/[^'"\s]+['"]\s*\}\s*<\s*/\s*\7\s*>\s*['"][\)\s]+;(?<X1250630>)|[\(\s]+base64_decode[\("'\s]+Ijxmb[^;]+;\s*@(?:copy|move_uploaded_file)[\s\(]+\$_FILES\s*\[[^\]]+\]\[[^\]]+\][,\s]+\$_FILES\s*\[[^\]]+\]\[[^\]]+\][\s\);]+echo\s*\([^;]+;\s*@?(?:exit|die)\b[^;]*;(?<X1259650>)|[\h\(]+(exploit_db)[\(\h]+[^\}]{99,200}[\}\s]+function\h+\11\([^\)]+\)[\{\s]+\$\w{1,20}[\h=]+@file_get_contents[\h\(]+[\h'"]+https?://(?:www\.)?exploit\-db\.com/(?<X2204160>)|[\s'"\(]+<h1>\s*<a\h+href\h*=\h*['"](?:\\)?\$fullpath['"]>OK\-Click\h+here!\s*</a>(?<X2049692>)|[\s'"]+<[^'"]{0,49}\bshell\h*upload[er]*</[^>]+>\s*<form\b(?<X2184961>)|[\s\('"]+<title>[^\w\n\b]{0,15}\b(?:Upl[0o][a4]d[e3]r|h[a4]ck[e3]d|pwned)\h*By[\h\./]*\w{1,40}\b[^</>]{0,99}[</>]{2}(?<X2210942>)|[^;]{9,499}\b403\s+Forbidden\b[^;]{9,499};\s*if\s*\(isset\s*\(\$_[GPSCR]\w{2,6}\[[^\]]+\]\)\)\{[^\}]{1,199}\b(?:copy|move_uploaded_file)\((?<X2136560>)|\('<form\s+method="post"\s*enctype="multipart/form-data"><b>UPLOAD FILE:</b>\s*<input type="file" size="25" name="upload"><br><b>FILE NAME:</b> <input type="text" name="filename" size="25"> <input type="submit" value="UPLOAD"></form>'\);\s*if\(isset\(\$_FILES\['upload'\]\)\s*and\s*isset\(\$_POST\['filename'\]\)\)\s*{\s*if\(copy\(\$_FILES\['upload'\]\['tmp_name'\]\s*,\s*\$_POST\['filename'\]\)\)\s*{\s*echo\('[^']+'\.\$_POST\['filename'\]\);\s*}\s*else\s*{\s*echo\('[^']+'\);\s*}\s*}(?<X1036120>)|\(['"]<(script)>\s*if\((document)\.[^\)]{1,32}['"]+\)\s*\{\s*\19\.location\.href\s*=\s*['"]https?://whatnow\d?\.\w+/\w+['"]\s*\}\s*</\18>['"]\);(?<X1250520>)|\b[\s\(]+['"]\?>['"][\.;]?['"]?https?://bit\.ly/(?<X2200812>)|\b[^;]{1,99}<[ht](?:\d|itle)[^>]{0,99}>\s*IDBT[3e][a4]m\b[^;]{1,99}\bphp_uname\(\)(?<X2159361>)|\h*(\$[a-z_]{1,40})\d*=([peas](?:assthru|ystem|xec|hell_exec|open)\()['"][^\);]{1,99}/(wp\-[\w\-]{1,40}\.php)['"]\);(?:echo\h*\23\d*=\24['"][^\);]{1,99}/\25['"]\);){4}(?<X2177092>)|\h*(\$GLOBALS)\h*\[[^\]]+\]\h*\.\h*php_uname\h*\(\)[^\}]{0,499}\bif[\s\(]+(?:copy|move_uploaded_file)[\s\(]+\$_FILES\[\27\[(?<X2196521>)|\h*<[<\h]+(ES?O[DT])\b[<\h]+script[^;]+\29;[^\v\*%]{0,999}(\$con\w{0,9})\h*=\h*get\w{0,9}\h*\(['"]https?://[^;]+;\h*\30\h*=\h*str_replace\b[^;]+\30\);[^\v\+]{99,499}\}\s*echo\h*\30;\s*(?:die|exit)\b[^;]{0,19};(?:\s*\}){2}(?<X1184160>)|\h*@?eval[\s\(]+["']\?>['"][\s\.]+@?file_get_contents[\s\(]+['"]https?://bit\.ly/[a-z0-9]{4,9}['"][\s\)]+;(?<X1212353>)|\h*['"](?:<a\h*style[\h=]+['"]display:none;?['"]\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]+</a>\s*){3,10}['"];(?<X1237070>)|\h*['"](?:<a\h*style[\h=]+['"]display:none;['"]\h*href[^>]{0,99}>[^<]{0,40}\bslot\b[^<]{0,40}</a>\s*){3,9}['"];(?<X1223140>)|\h*['"](?:<a\h*style[\h=]+['"]display[\h:]+none;?['"]\h*href[\h=]+['"](https?://[^'"]+)['"]>[^<]{0,40}(?:slot|togel|\35)[^<]{0,40}</a>\s*){5,15}['"];(?<X1223550>)|\h*['"](?:<a\h*style[\h=]+['"]display[\h:]+none;?['"]\h*href[\h=]+['"]https?://[^'"]+['"]>(?:slot\h*gacor|rodaslot)</a>\s*){1,9}['"];(?<X1227310>)|\h*['"]<(?:(div)\h*style\h*=\h*['"](?:display|visibility):(?:none|hidden)['"]>\w{0,25}<(iframe)[^\?]{9,60}\.(?:php|cgi)?\?[^>]{0,50}></\39>\h*</\38>\h*['"];(?<X1142561>)|(script)\h*src[\h=]+['"]https:?//(?:[^\.]+\.)?jquery\-uii\.com/[^\.]+\.js['"]></\41>['"];(?<X1209960>)|(title)>\h*newnight\h*-\h*shell</\43>[^\(]{9,50}\.php_uname\(\)\.['"]</?br>(?<X2141491>)|(title)>b[a@]?ckd[0o]{2}r\b[^<]{1,40}</\45>['"];(?<X2176033>)|(title)>x?Mailer\h+[\w\-]{4,24}(?:\.[a-z]{2,6})+\b[^\<]{0,15}</\47>['"];(?<X2167201>)|[^>]+>\h*back\W{1,2}connect[^/]{0,20}(?:tool|shell)(?<X2216101>)|center(?:>[^/]{0,40}\bSecDevil13\h*Mini\h*Upl[o0]ader(?<X2153450>)|[^;]{0,99};\s*exec\([^\)]+\);\s*system\([^\)]+\);\s*\$\w{1,15}\h*=\h*php_uname\(\);[^#]{0,399}\bfile_get_contents\(['"]https?://api\.telegram[^'"]{0,49}['"]\h*\.\h*http_build_query\(\$\w{1,15}\)\h*\);(?<X2185460>))|html>\h*</html>['"];\h*error_reporting\((?:0|NULL)\);[^\$]{0,99}\beval(?:[\h\(]+\$\w+){3,5}[\h\(]+['"][^'"]{99,399}['"][\h\)]+;(?<X1236670>)|title>(?:\s*Mass\h*(?:Cleaner[\h\w]+\bby\s*\W{1,4}RECODED\b[^#]{99,750}\b_POST\[['"]defpage\w{0,9}['"]\];(?<X2202221>)|Delete[\h\-]+By\b[^\{]{99,299}\bfunction\h*\w{1,15}\([^\)]+\)\s*\{\s*if\([^\{]+\{\s*\$\w{1,15}[\h=]+scandir\s*\((?<X2202211>))|\W{0,9}WordPress\h*MassDeface(?<X2175670>)))|\h*['"][^'"]{1,25}\bLokomedia\h+(?:Auto\h*Tanem\h*Shell|\(SQL\h*Injection)\b(?<X2151091>)|\h*['"][^/;]{1,40}<title>\h*M[@a4]ss\h*d[e3]f[a@4]c[e3]r?\b(?<X2168131>)|\h*['"][^;]{0,50}\bphpshell\.xyz\h*/\h*shell\d+\.com(?<X2156560>)|\h*['"]\h*Craigs\h*Backdoor\h*Wordpress\h*Admin[^;]+['"];(?<X2198021>)|\h*['"]\s*(?:(?:<a\h*style[\h=]+['"]display:none;\s*['"]\s*href[\h=]+['"]https?://[^'"]{1,90}['"]>[^<]{1,99}(?:slot|gacor|escort)[^<]{0,99}</a>\s*){3,}['"];\s*\Z(?<X1227560>)|(?:<script[^>;]{1,150}>\s*</script>\s*<a\h*href[^>]{1,150}>[^<;]{1,50}</a>\s*){2,4}['"];\Z(?<X1193270>)|GIF8\d[a-z];\s*<html\b[^;\?]{1,99}<\?\s*\$[^\}\?]{99,499}\b[cm]o(?:py|ve_uploaded_File)\s*\(\s*\$_FILES\h*\[[^\?]{9,499}\?>[^;]{1,1999}['"];(?<X1173730>))|\h*['"]\W{0,2}PhyRo\W{0,2}['"];[^\(]{0,15}\bif\(\$_[GPRSC]\w{2,6}\[[^\)]{1,20}['"]upload['"]\)\s*\{[^\./]{9,150}\bif\((\$\w{1,20})[^\)]+\)[\{\s]+if\(@?[cm](?:opy|ove_uploaded_files)\(\$_FILES\[[^\)]{1,40}\.\63\)\)[^\?]{99,250}\becho\h*["']?[^;]{1,40};\s*\}(?<X1214840>)|\h*['"]Priv8[^'"]{0,25}\buploader\h*by\b(?<X2173450>)|\h*`/bin/(?:ba)?sh\h*\-\w[^/]+/dev/tcp/\d+\.\d+\.\d+\.\d+/\w+\h*0>&\d['"]?`;(?<X1207981>)|\h*file_get_contents[\h\(]+['"]https?://(?:codeigniter\.icu/[^'"]+\.php['"]\);(?<X1268310>)|pastebin\.com/raw/i6u63g6q['"][\h\)]+;(?<X120348570>)|slot\-gacor\b[^'"]+\.txt['"][\h\)];(?<X1236681>))|\h*PD9w[^\|]{500,1500}\|\h*base64\h*\-\w+>\$\w+;[^\?]{9,99}\bhttps?://cdnflare\.xyz/(?<X220367481>)|\h*php_uname\(\);[^\(]{0,20}\bif\(\$_POST\)[\{\s]+if\([cm](?:opy|ove_uploaded_files)\((\$_FILES\[[^\]]+\]\[)[^\]]+\],(\71[^\]]+\])\)\)[\{\s]+echo\h*['"][^\.]{0,40}\.\72[^\?]{1,99}\becho\h*['"]<form\h*method=post[^\};]{9,99}>['"];\s*\}(?<X1222690>)|\h+"Uploader\h+By\h+Psyco\b(?<X2051381>)|\h+(\w{1,40})\h*\(\h*['"]https?://[^;]{1,99};\s*function\h+\75\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\76\h*\);\s*if\h*\(\h*!\77\h*\)\s*\{[^\}]{1,499}\}\s*return\h+\77;\s*\}\s*(?:die|exit)[^;]{0,19};(?<X1171750>)|\h+(chr\h*\(\h*60\h*\)\h*\.\h*)((?:chr\h*\(\h*(?:115|99|114|105|112|116)\h*\)\h*\.\h*){6})[chr\(\)\h\.;\d]{99,999}\.\79chr\h*\(\h*47\h*\)\h*\.\80chr\h*\(\h*62\h*\);(?<X1183841>)|\h+@?[peas](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]cd\h+/tmp;[^:\)\v]{4,40}\bhttps?://[^\?\v\)]{9,99};\h*perl\h+\S{1,40};\brm\h*\-r?f[^\.;\v]{1,40}\.(?:txt|php|perl|pl)[^;\v]{1,20};(?<X1174262>))
\becho(?:\h+['"]<(?:!\-\-\h*\d\h*\-\->['"];\h*\$to\h*=\h*['"]https?://([\w\-\.]{1,40}\.\w{2,3})/\?\w{1,3}=['"];(?:\s*if\h*\(\h*preg_match\h*\(\h*['"][^\}]{9,199}\})+\s*echo\h+['"]<!\-\-\h*\d\h*\-\->['"];[^\{\}]{99,399}\{\s*header\h*\(\h*['"]Location:\h*https?://\1/?['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1156070>)|(script)[^:]{1,60}src\h*=\h*['"](?:https?:)?/?/?zerobyte\-id\.github\.io/PHP\-Backdoor/[^'"]{1,40}['"]\h*>\s*</\3>['"]\h*;\s*echo\h*['"]</(?:body|html)>(?<X2152411>)|(script)\h+src\h*=\h*["']+\h*\.\h*(?:(?:gz(?:uncompress|inflate)|base64_decode|strrev|str_rot13)\h*\(\h*){2,}['"][^'"]{9,99}['"][\h\)]+\.\h*["'][^>;\.\v\$]{1,99}>\s*</\5>['"]\h*\.\h*PHP_EOL\h*;(?<X1152660>)|[^;/\$]{99,200}>\s*(?:<(?:td|font)[^';]{4,35}>\h*(?:N4m3|S1z3|P3rm15ion|4ct1on)\h*<[^;'"]{4,35}>\s*){3}(?<X2168481>)|[^>]*html>[^\$\(\)]{99,500}<title>\h*pst[a4]r(?:8|ate)\h*(?:web)?\h*shell\b(?<X2174320>))|\h+['"][^\[\]\{]{9,200}<font[^>]+>\h*Error\h*People\h*Squad\b(?<X2172820>)|\h+['"]\W{0,4}<(html>)\s*<div\h+style=\\['"](?:(?:left|right):\h*-\d{3,5}px;\h*|position:\h*absolute;\h*|(?:top|bottom):\h*-\d{3,5}px){3}\\['"]>\s*(?:<a\h+href=[^>]{3,99}>[^<]{2,99}</a>\s*){5,30}</div>\s*</\10\s*['"];(?<X1145861>)|\h+['"]GIF\d{2}[a-z]?;\s*<(?:title|h(?:tml|\d|ead)|!DOCTYPE)\b[^;]{1,99};\s*echo\b[^;]{1,99}\.php_uname\(\)\.(?<X2176920>)|\s*"<form\s*action\s*=\s*'"\s*\.\s*\$current\s*\.\s*"&mode=copy&src="\s*\.\s*\$src\s*\.\s*"'\s*method\s*=\s*'POST'>(?<X2047920>)|\s*"This\s*shit\s*works!";\s*if\s*\(isset\(\$_FILES(?<X2051710>)|\s*'<title>Upload\s*Files\s*xSecurity(?<X2049560>)|\s*(@null\s*;)\s*goto\s*\w+\s*;[^\n\?]{99,}\16(?<X1259660>)|\s*@?(?:eval|assert)\s*\(\s*['"]\\77\\76['"]\s*\.\s*@?file_get_contents[\s\(]+['"]\\(?:x68|104)(?:\\(?:x74|116)){2}[^'"\.]{31}\\(?:x2e|46)\\(?:154|108)\\(?:x79|121)[a-f\dx\\]{30,40}['"][\s\)]+;(?<X1212370>)|\s*['"]%\w+\\r\\n['"];\w+\s*(\w+)\((\$\w+)\)[^\?]+\20\);\$\w+=\w+\([^\?]+(\$\w+)=['"]\?>['"];eval\(['"]\{\21\}['"]\.\19\(['"]https?://[^/]+/\w+\.(?:jpeg|jpg|png|gif)['"]\)\);(?<X1313850>)|\s*['"](?:<a\s+style\s*=\s*['"]display\s*:\s*none;\s*['"]\s+href\s*=\s*['"]https?://[^'"]+/['"]\s*>\w{3,16}(?:\s+\w{1,16})*\s*</a>\s*){3,}['"]\s*;[\s\?>]*\Z(?<X1222511>)|\s*['"]<(?:[^\?/]{0,99}//(?:www\.)?(?:facebook\.com|fb\.me)/anonsecteam['"\s](?<X2224351>)|\w+>\w+\s*\w+\(\w+,\w+\)\{\w+\s*(\w+)=\w+\.\w+\.\w+;\w+\s*(\w+)=\25\.\w+\(\25\.\w+[^\}]{1,999}XMLHttpRequest[^\.]{1,99}\b(\w+)\.open\(['"]\w+['"],\26[^\\]{1,999}\27\.[^\{]+\{\w+\(\27\.\w+={2}\d+[^\\]{1,999}//\w+\.top4top\.io/[^\}]{1,199}(\$\w+)=['"][^'"]{99,999}['"];\w+\s*(\w+)\([^\}]{1,999}\}\w+\s*\w+[^\{]+\{\$\w+=\29\([^;]{1,32};eval[^\?]{1,99}\28,\w+\);(?<X120330520>)|a\s*href=['"]\?(\w{1,40})=(\w{1,40})['"][^@]{999,19999}\bif\(\$_[GPCSR]\w{2,6}\[['"]\31['"]\]==["']\32['"]\)\{unlink(\(__FILE__)\);(\$\w{1,40})=fopen\33,[^;]{1,99};fwrite\(\34,['"]\31['"]\);fclose\(\34\);\}\s*(?:\?>)?\Z(?<X2169820>)|div\s*style=[^>]+>['"];\s*@?error_reporting[\(\s]+\d[\)\s]+;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][=\s]+['"](Mr\.\s*0T4KU)['"][^>]+>[^\?]{1,300}\bNameless\s*Security\s*Hackers\b[^@%\*]{499,2900}\36[^\};'"]{1,499}['"];\s*\}\s*echo\s*['"]</div>['"];(?<X1225401>)|form(?:\s*action[^;]{9,99};\s*error_reporting\(0\);\s*(\$\w{1,9})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\38=stripslashes\(\38\);\s*eval\(\38\);(?<X1128465>)|\s+action\s*=[^;]{99,}</form>['"];\s*\{\s*@?(?:move_uploaded_file|copy)[\s\(]+\$_FILES\[[^\]]+\]\[[^\]]+\][,\s'"\.]+\$_FILES\[[^\]]+\]\[[^\]]+\][\s\)]+;[^=\{\}]{0,199}\}(?<X1223870>))|pre>['"];\s*system\(\$_REQUEST\['c'\]\);\s*die;(?<X2053920>)|script>\s*['"]\s*\.\s*base64_decode[\(\s]+['"]ZnVuY3Rpb24[^'"]{99,9999}P(?:T09dW5kZWZpbmVk|T11bmRlZmluZWQ|XVuZGVmaW5lZA)[^'"\n]{99,}['"][\)\.\s]+['"]\s*</script>['"]\s*;(?<X1258650>))|\s*['"][^_]{9,99}<title>\s*x3_V\s*(?:mini|web)\s*shell\b(?<X2134101>)|\s*['"]\\(?:n<!\-\-\s*Invisible\s+sitemap\s+link\s+injected\s+by\s+mu\s+plugin\s*\-\->\\n['"];(?<X220344000>)|x3c\\x2f\\x62\\x6f\\x64\\x79\\76\\x3c\\x2f\\150\\164\\155\\154\\x3e['"];\s*(?:\?>|\Z)(?<X220335441>))|\s*['"]\s*<meta[^>]{0,99}>\s*<(title)>SHELLIZM[^<]+</\46>[^;]{99,400};\s*(\$\w{1,25})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*pwn\(\47\);(?<X2201230>)|\s*['"]\|OK\d+\|['"]\s*;\s*\$\w{1,40}\s*=\s*['"]<script\b[^!\n\+]+(?:while\h*\(!!\[\]\)\h*\{\h*try\h*\{\h*var\s*\w{1,40}\s*=\s*parseInt\s*\(|window\.atob\(\\?['"][^;]+;[^\n!\+]{0,99}\.appendChild\(\w+\)\h*;)(?<X2203811>)|\s*['"]FoxAuto\s*V\d[^;]+anonymous[^;]*;(?<X2222820>)|\s*['"]G(?:IF89\w*\s*OK['"];\?>(?<X220366050>)|oogle\-site\-verification:\s*google['"]\.\$_GET(?<X2117161>))|\s*['"]RxR\s+H[a4]Ck[E3]r!?['"]\s*;(?<X2250280>)|\s*['"]This\s*server\s*has\s*been\s*infected\s*by\s*\$\w{1,40}['"];(?<X2172210>)|\s*['"]window\.location\.href[\s=]+['"]https?://[^\.'";\s]{1,5}\.saleforyou\.org/[^'"]+['"]\s*['"]\s*;(?<X1199040>)|\s*\$USER\s*->\s*Update\s*\(\s*\d+,\s*array\(\s*"PASSWORD"\s*=>\s*'[^']+'\s*\)\s*\)\s*;(?<X2049580>)|\s*\("<<OK>>"\s*\.\s*join\s*\("\\n"\s*,\s*\$injected\s*\)\s*\.\s*"<</OK>>"\s*\);(?<X2049350>)|\s*\(\s*(?:gzinflate\s*\(\s*base64_decode\s*\(\s*['"]tVVNb5tAEP0t5WKoh[^'"]{500,900}['"](?:\s*\)\s*){3};(?<X1065202>)|php_logo_guid\s*\(\s*\)\s*\)\s*;\s*@?copy\s*\(\s*\$\w{1,40}\s*\[\s*fl\s*\]\s*\[\s*[^]]+\]\s*,\s*'[^']+'\s*\)\s*;\s*\$\w{1,40}\s*='[^;]+;\s*@\$\s*\{\s*a\s*\}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;(?<X1039590>))|\s*\(\w+\((\$\w+)[\s=]+['"]https?://[^'"]+\.pages\.dev/[^;]+\beval\(['"]\?>['"]\s*.\s*\w+\(\60\)\)\s*:\s*['"][\w\-]+['"];(?<X120363280>)|\s*`\$_[GPCSR]\w{2,6}\[[^\]]+\]`;(?<X1234082>)|\s*`\{\$_GET\h*\[[^\]]+\]\}`\s*;(?<X1204970>)|\s*basename[\(\s]+__FILE__[,\s]+['"]\.php['"][\)\s]+\.\s*['"]\.php['"]\s*;(?:\s*@?file_put_contents[\(\s]+['"]\w\.php['"][,\s@]+file_get_contents[\(\s]+['"]https?://[^'"]{9,}\.php['"][\)\s]+;)+(?:\s*echo\s*['"][^'"]*['"]\s*;)?(?<X1258821>)|\s*eval\('\?>'\s*\.\s*join\(\s*""\s*,\s*file\(\s*"\$c/\$p\.html(?<X2049820>)|\s*file_get_contents(?:[\('"\s]+https?://api\.blinku12\.us/\w+\.txt["'\)\s]+;(?<X1214860>)|[\(\s"]+https://[a-z]{1,9}(\d)\67\.[a-z]{2,3}/[a-z]{1,9}(\d)\68\.txt["'\)\s;]+\Z(?<X1219050>)|\(['"](?:\\x68\\x74\\164\\160\\x73\\72\\57[^'"]+\\x35\\x68\\70\\x78\\122\\155['"]\);(?<X120348650>)|https?://(?:raw|user\-images)\.githubusercontent\.com/[^'"]{0,199}backlink[^'"]{0,199}\.txt['"]\);?(?<X1236650>)))|\s*implode\(['"]+,(\$\w+)\);\$\w+=implode\(['"]+,\72\);(\$\w+)=implode\(['"]+,\w+\(\$\w+\)\);eval\(['"]\?>['"]\.\73\);(?<X120365700>)|\s*php_uname\b[^;]+;\s*(\$\w{1,40})[=\s]+(\$_FILES\[)[^\]]+\]\[[^;]+;\s*(\$\w{1,40})[=\s]+\76[^\]]+\]\[[^;]+;\s*echo\s*['"]<form\s+method[=\s'"]+P[^;]+;(?:\s*(\$\w{1,40})[=\s]+['"][move_uplad_fi]{2,12}['"][\s;]+){2}(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+\78;\s*\79[\s\(]+\75[,\s]+\77[\s\)]+;(?<X1232330>)|\s*shell_exec[\(\s]+\$_GET\h*\[['"]?(?:root|cm?d?)[^\]]*\][\)\s]+;(?<X1248300>)|\s*strpos[\(\s]+strtolower[\(\s]+\$_SERVER\[(base64_decode)[\(\s]+['"]SFRUUF9VU0VSX0FHRU5U["'][\)\s]+\][\)\s]*,\s*\82[\(\s]+['"]Z29vZ2xlYm90['"][\s\)]+!=+\s*(?:true|false)\?\82[\(\s]+['"]P[^"']{99,}['"][\s\)]+:\s*['"]{2}\s*;(?<X1217690>)|\s+@?eval[\(\s]+['"]\\77\\76['"]\s*\.\s*@?file_get_contents[\(\s]+['"]\\[a-fx\d\\]{30,199}['"][\s\)]+;(?<X1220130>)|\s+@?file_get_contents\s*\(\s*['"]index\.html(?:\.bak)+['"]\s*\)\s*;?(?<X1036511>)|\s+["']<title>[^;]+;\s*function\s+(http_get)\(\$\w{1,40}\)\{[^\}]{99,999}\}(\$\w{1,40})=[^;]{1,99}/wp\-(?:content|admin)/[^'"]{1,99}\.php['"];(?:chmod\(\87,0777\);)?(\$\w{1,40})=\86\(['"]https?://[^;]{1,99};(\$\w{1,40})=fopen\(\87[^;]{1,99};fwrite\(\89,\88\);(?<X2148631>)|\s+['"]<b(?:>\s*stats\s*</b>\s*-\s*Displays?\s+statistics\s+about\s+your\s+spam(?<X2060580>)|r><[^>]+>\s*NGH\s*sh[3e]ll\s+(?:[\w\.]{2,5})?\s+by\s+Cr[a4]sh\s*<(?<X2119390>))|\s+['"]<(?:font\s+color\s*=\s*[^>]+>\s*TheM[o0]n[e3]yT[3e][4a]m(?<X2121120>)|title>403webshell</title>(?<X2314430>))|\s+['"]No\DQRQR\s*\|[^\|]{0,30}\|\s*(?:Thanks\s+to|Vreated\s+By)\s*:\s*Sn[1i]p[e3]r\s*H[a4]ck\s*\D\s*Dr\.Kr[0o]{1,5}z\s*\D\s*H[a4]ck[3e]r_s[a4]['"];(?<X2119090>))
\berror_reporting\(0\);(?:(?:[^\?\{]{1,200}(\$\w{1,25})\h*=\h*base64_decode\(['"][^'"]{999,35000}['"]\);\s*(\$\w{1,25})\h*=\h*(file_)get(_contents)\([^\)]+\);\s*if\(md5\(\2\)\h*\D{2,3}\h*md5\(\1\)\)\s*\{[^\}]{1,99}\b\3put\4\((\$\w{1,25}\.['"][^'"]+['"]),\s*\1\);\s*@?chmod\(\5,\h*\d+\);\s*\}){1,2}(?<X1194632>)|(\$\w+)=['"][^'"]+(?:['"];\$\w+=['"]/[^\.]+\.txt['"];\$\w+=stream_socket_client\(['"]tcp://\{\7\}:80['"][^\{]+\{fwrite\(\$\w+,['"]\w+\{\$\w+\}http/\d\.[^\}]+\7\}[^\{]+\{(\$\w+)=\w+\(sys_get_temp_dir\(\),['"]php['"]\);file_put_contents\(\8,\$\w+\);\w+\8;unlink\(\8\);\}\}(?<X1315690>)|\.txt['"];\$\w+=\w+\(\7,FILE_IGNORE_NEW_LINES[^;]+;\w+\(\$\w+[^\{]+\{(\$\w+)=\w+\(sys_get_temp_dir\(\),['"]php['"]\);\w+\(\10[^\);]+\){2};\w+\10;unlink\(\10\);\}(?<X1315720>))|(\$\w+)=['"]http(?:s://[^'"]+\.php['"];(\$\w+)=['"]['"];if\(function_exists\(['"](curl_)\w+['"][^/]{1,299}\14\w+\((\$\w+)[^\{]{1,99}\13=\14\w+\(\15\);\14\w+\(\15\);\}else\{\13=file_get_contents\(\12[^/]{1,49}echo\13;\}(?<X120366760>)|s?://[^'"]+\.info[^%]{1,499}(\$\w+)[\s=]+curl_exec\((\$\w+)\);curl_close\(\18\);\}else\{\17=file_get_contents\(\12\);\}if\(\17\)\{echo\17;\};(?<X120363861>)|s?:[^;]+\.txt['"][^\)]{1,99}function[^=]{1,49}(\$\w+),(\$\w+)\)=explode[^\-]{1,99}\20[^\?]{1,49}\21[^:]{1,149}file_get_contents[^\?]{1,199}foreach[^:]{1,199}https?://[^'"]+['"][^\?]{1,99}\$_SERVER[^\.]{1,599}['"]\d+\.\d+\.\d+\.\d+['"][^\}]{1,299}\12\)\);die\(\);\}\}(?<X120350770>))|(\$\w+)=['"]range['"];(\$\w+)=\23[^;]+;(\$\w+)=\$\{(?:\24[^\.\;]+(?:\.|;))+if\(+in_array\(gettype\(\25[^\(]+\25\)\&+(?:md5\()+\25[^=]+=+['"][^'"]*['"]\)+[^@]{1,900}eval\(\25[^@]{1,3000}(\$\w+)=array\(['"]status['"]=>\d+,(['"]content['"])[^;]+;if\(+is_array[^@]{1,9000}echo\26\[\27\];exit\(0\);\}(?<X1306553>)|(\$\w+)=[^;]+;(\$\w+)=(?:[^;]+;(?:if\(+preg_match[^\{]+\{)+[^\}]+\}[^\$]+\.\29\.[^\$]+\.\30;exit;\}\$\w+=['"]https?://[^@]{1,700}(\$\w+)=(?:\$\w+[\.;])+(\$\w+)=(?:curl\w+[\(\);]+)+\32[^\)]+\31[^@]{1,500}\$\w+=file_get_contents\(\31\);[^@]{1,100}(\$\w+)=explode[^;]+;\$\w+=count\(\33\);if[^@]{1,100}exit;(?<X1311771>)|\29[^;]+;(\$\w+)=\$\{(?:\30[^\.\}]+[\.\}])+;if\(+in_array\(gettype\(\35\)[^'"]+(?:md5\()+\35[^\)]+\)+=+['"][^'"$]+['"]\)+\{\([^;]+eval\(\35[^\;]+;\}[^@]{1,200}class\s*\w+\{(static\s*function)[^@]{1,2000}\36\s*(\w+)\(\)\{\$\w+=array\((?:['"](?:\d+[t'"])+[,'"\)])+;[^@]{1,1500}\37\(\);header\([^\)]+\);(?<X1322261>))|(\$\w+)=fopen\(['"]php://filter/[^,]{1,99},[^'"]{99,}['"][^;]+;(\$\w+)=\w+\(\39\);fclose\(\39\);eval\(1={2}1\?\40\s*:\s*['"]\w+['"]\);(?<X120358252>)|(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];[^\?]{1,199}(\$\w+)\)[^;]{1,49}\43[^@]{1,199}file_get_contents[^\?]{1,399}fetch_ip_ranges\([^\?]{1,99}\$_SERVER[^\-]{1,399}foreach[^\-]{1,99}\43[^\.]{1,499}(\$\w+)=\[['"]\d+\.\d+\.\d+\.\d+['"][^\?]{1,219}\44[^\}]{1,29}implode[^\}]{1,29}\42[^\}]{1,29}die\(\);\}\}(?<X120352580>)|@?ini_set\(["']display_errors["']\s*,\s*0\);\$var=\s*\$_SERVER\[["']PHP_SELF["']\]\."\?";\$form\s*=["']<form\s*enctype="multipart/form-data"\s*action=["']["']\.\$var\.["']["']\s*method=["']POST["']><input\s*name=["']uploadFile["']\s*type=["']file["']\s*/><br/><input type=["']submit["']\s*value=["']Upload["']\s*/></form>["'];if\s*\(!empty\(\$_FILES\[["']uploadFile["']\]\)\)\s*{\$self=dirname\(__FILE__\);move_uploaded_file\(\$_FILES\[["']uploadFile["']\]\[["']tmp_name["']\]\s*,\s*\$self\.DIRECTORY_SEPARATOR\.\$_FILES\[["']uploadFile["']\]\[["']name["']\]\);\$time\s*=\s*filemtime\(\$self\);print\s*["']OK["'];\s*}\s*else\s*{\s*print\s*\$form;\s*}(?<X1035860>)|@?set_time_limit\(3600\)[^=]{1,99}(function)\s+\w+_[^'"]{1,99}\47_exists\(['"](curl)\w+[^@]{1,199}\48\w+,isset\(\$_SERVER[^@]{1,299}\48\w+[^#]{1,499}@?file_get_contents[^!]{1,99}\47[^#]{1,799}define\(['"]\w+['"],['"]aHR0[^'"]+['"][^#]{1,599}base64_Decode[^\*]{1,799}intval[^\*]{1,99}(\$\w+\[['"]\w+['"]\])\)\?\49:'';exit\(0\);\}\}\}(?:\s*isWAF\(\))?(?<X120358431>)|[^!]+if\(!isset\(\$_SERVER\[['"]HTTP_CLIENT_IP['"]\]\)\)\{[^\{]+\{\$\w+=urlencode\(\$_SERVER\[['"]HTTP_HOST['"]\]\);\$\w+=urlencode\(\$\w+[^\n]{99,999}strpos\((\$\w+),\s*['"]robots\.txt['"][^%]{1,399}strpos\(\51,['"]pingsitemap['"]\)[^;]+\{define\(['"]\w+['"],true\);(?<X120334161>)|[^#]{200,1000}(\$\w{1,40})\s*=\s*['"]range['"]\s*;\s*\$\w{1,40}\s*=\s*\53[\(\s]+['"]\176['"],['"][^%]{99,999}\bfunction\h*(\w+)[\s\(\)\{]+\$\w+[\h=]+array[\h\(]+[^\?]{99,1400}\b\54\(\);header\([^#]{99,600}\{(\$\w+)=array\([^#]{999,3700}\becho\h*\55\[['"]content['"]\];\h*(?:exit|die)[^;]{0,9};\s*\}(?<X1307732>)|[^%]{1,1999}chmod\(\$\w+,\s*0444\);['"],\s*['"]\}['"][^%]{1,999}add_action\(['"]\w+['"],\s*function\(\)[^\}]{1,999}array\(['"]\w+/[\w\-]+\.php['"],\s*['"]\.[\w\-]+\.dat['"](?<X220361150>)|[^%]{1,399}stripos\(\$\w+\s*,\s*['"]google['"]\)[^%]{1,199}stripos\(\$\w+\s*,\s*['"]bot['"]\)[^%]{1,199}echo\s+@?file_get_contents\(['"]https?:/[^\.]{1,99}\.pages\.dev[^'"]{1,199}['"]\);\s*exit;\s*\}(?<X120362430>)|[^&]{1,499}&&count\(\$\w+\)={1,4}\d+&&(md5\()\59\59\59\$\w+\[\d[\]\)]+={1,4}['"]\w{32}['"][\)\{\(]+(\$\w+\[\d+\])[^;]{1,299}eval\(\60[^:]{1,999}curl_init\([^\n]{200,3999}(\$\w+)=str_replace\(['"]okhtmlgetcontent[^\n]{499,4999}curl_close\(\$\w+\);return\61;\}(?<X1320602>)|[^:]{1,499}https?://[^'"]{1,499}\.txt['"];function\s*(\w+)\((\$\w+)\)\{\$\w+=curl_init\(\64[^!]+\w+\(!\$\w+\)\{(?:exit|die)\([^\{]+\{\}(\$\w+)=tempnam[^;]+;file_put_contents\(\65,\$\w+\);(?:include|require)(?:_once)?\65;unlink\(\65\);\}\63\(\64\);(?<X120339090>)|[^;]+;\h*(\$_)(\d)[\h=]+(base64_decode)\(['"][^'"]{0,99}['"]\);\h*if\((isset\(\$_GET\[)\67\68\][\h\)\{]+\67\d=__DIR__;\h*(\67\d)=\70\69\([^#]{999,3000}=\71\.DIRECTORY_SEPARATOR\.\$_POST\[\69[^\?]{99,399}\becho\s*\69\(['"][^'"]{0,99}['"]\);\s*\}\s*\}\s*\}(?<X120336393>)|[^;]+;\h*ini_set\((base64_decode)\(['"][^\?\n]{99,399}<(title)>MSV\h*FM</\74><[^\n\^]{99,4000}\bfileperms\(\$\w+\);\h*if\(\(\$\w+[^\{]+\{(\$\w+)=\73\(['"][^#\n]{99,999}\breturn\h*\75;\h*\}(?<X120336401>)|[^\n\$\*!@&='"]{1,99}if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{\h*\$\w{1,40}\h*=\h*(\$_FILES)\h*\[[^\n\?@:&\*]{99,999}\{\h*if\h*\(\h*@(?:copy|move_uploaded_file)\h*\(\h*\77\h*\[[^\n\?@&\*!]{99,999}echo[^;]{1,99};[\h\}]{1,9}(?<X1137992>)|[^\n]{1,9999}\{\w+\(['"]\w+\s*gagal\s*dibuat['"],\d+\);\}{3}echo\s*['"]</div>['"];echo\s*['"]</div><script(?<X220337323>)|[^\{]{1,999}\{\s*header\(['"]http/1\.0\s*403[^;]+\);\s*exit;\s*\}\s*\$\w+[\s=]+urlencode\(\$_SERVER[^\.]{1,999};if\(strpos\(\$\w+,['"]favicon\.ico['"][^\{]{1,999}\{(?<X1325272>)|[^\{]{1,99}class\s+(\w+)[^\$]{1,299}(public\s+function)\s+\w+\((\$\w+),\s*(\$\w+)\)[^;]{1,179}\83[^;]{1,99}\84[^\(]{1,199}\82[^;]{1,199}base64_decode[^;]{1,99}file_get_contents[^@]{1,399}@?rename[^\{]{1,399}\81[^\$]{1,29}(\$\w+\->html)[^\[]{1,399}\$_GET[^\}]{1,299}\85\(\);\s*\};(?<X120351192>)|[^\}]{1,999}\$\w+[\s=]+['"]123['"][^\}]+\$_GET\[['"]\w['"][^\}]+http_response_code\(404\)(?<X220362990>)|\$\w+=['"]https?://[^'"]+['"];[^\(]{1,99}function\s+(ip_in_range)\(\$\w+,(\$\w+)\)[^/]{1,99}explode\(['"]/['"],\89\);[^\?]{1,199}file_get_contents\([^\?]{1,299}foreach[^:]{1,199}https?://[^'"]+['"][^@]{1,199}\$_SERVER[^@]{1,499}\88\(\$\w+,\89\)\)[^\[]{1,499}\[['"]\d+\.\d+\.\d+\.\d+['"][^\?]{1,249}\)\);die\(\);\}\}(?<X120356590>)|\$\w+=isset\(\$_SERVER[^:]+://['"\s:]+https?://['"];(\$\w+)=['"]https?://[^'"]+\.txt['"];\$\w+=\w+\(\91\);[^\)]+\);\$\w+=\w+[^\n]{1,99}(\$\w+)=\w+\(sys_get_temp_dir[\(\),'"]+php['"]\);file_put_contents\(\92,\$\w+\);\w+\92;unlink\(\92\);(?<X1315700>)|\$\w+[\h=]+(?:['"])?range[^\?]{99,799}\bcurl_exec\(\$\w+\);return\h*empty[^@]{999,7000}\bico['"][\h\)\{]+\$\w+=true[;\}\h]+if\(!\(\$\w+[\h\)\{]+(\$\w+)=\w+\(['"]https?://(?:\d+\.){3}\d+/['"],\$\w+\)[^\?]{9,299}\bheader\([^\)]+\94\[[^;]+;\h*echo\h*\94\[[^\]]+\];\h*exit\(0\);\}(?<X1306542>)|\$\w{1,14}[^:]{1,200}(md5)\(\96\(\96[^\;]{1,200};[^\(]{1,40}class\s*(\w{1,14})\s*\{\s*static\s*function\s*(\w{1,14})[^\+]{1,1000}self::\98[^\?]{1,400}\97::[^\@]{1,600}function\s*(\w{1,20})\(\$\w{1,14},[^\@]{2000,3500}\99\(base64_decode\(['"]aHR0cDovL3pzMTk4djEzYXUuZHJpdmVsLmxvbC8[^>]{1,500}exit\(\d\);\}\}(?<X1290043>)|\$c_='[^']+';\$c0='[^']+';\$c1='[^']+';\$c2='(?<X2051150>))
\becho(?:\s+['"]start['"];error_reporting[^\$]{1,49}ini_set[^;]{1,29};(\$\w+)[\h=]+\$_SERVER\[['"]\w+['"]\][^;]{1,29};(\$\w+)=['"]base['"]\.['"]64['"]\.['"]_decode['"];(\$\w+)\(\1[^;]{1,49}\.php['"],\2[^;]{1,29};\3\(\1[^\?]{1,49}\3\(\1[^@]{1,49}echo\s+['"]finish['"];@?unlink\(__FILE__\);(?<X120352050>)|\s+file_get_contents\((?:'/home/'\.\$user\.'/\.my\.cnf(?<X2051680>)|['"]https?://niir\.org[^'"]{1,99}['"]\);(?<X120344650>))|\s+mail\(\$to,\$them,\$mss,\$head\)\?_\d+\(\d+\):_\d+\(\d+\)(?<X2046210>)|\s+null;[^=]{0,40}\beval\b[^=:\?]{0,40}\([^=:\?]{0,40}['"]\?>['"]\s*\.\s*\w+[\s\('"]+https?://\w{1,5}\.\w{3,20}\.[a-z]{2,8}/[^'"]{1,199}\.(?:png|jpe?g|gif)['"][\s\)]+;(?<X1220120>)|\swelcome\sto\sr57\sshell(?<X2044191>))
\bE(?:l(?:ement\.prototype\.(append)After\h*=\h*(function\()(\w{1,40})\)\h*\{\h*\3\.parentNode\.insert[^\{]{9,99};\h*\(\2\)\h*\{[^\}]{0,499}\b\3\.src\h*=\h*(String\.fromCharCode\()104,116,116,112[^\)]+\);[^\}]{99,999}\(\4[^\)]+\)+\[0\]\.\1Child\(\3\);?\h*\}\h*\)\h*\(\);(?<X1185111>)|se\s*(?:\{\s*(?:(\$\w{1,40})\h*=\h*create_function\h*\(\h*(?:['"]{2}|null)\h*,\h*base64_decode\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\h]+;\h*@?\6\h*\(\h*\)\h*;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}(?<X1185590>)|\$[^\}\{]{0,99}(?:(?:\s*(\$to)\s*=\s*EMAIL;)|(?:\s*\$ip\s*=\s*getenv\(['"]REMOTE_ADDR['"]\);)){2}[^\}\{]{0,999}if\s*\(\s*mail\s*\(\s*\8\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2052091>)|echo\s*['"]indata_error['"]\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\b(?<X2046932>))|if\("shell"\s*==\s*substr\(\$action\s*,\s*0\s*,\s*5\)\)\{\s*\?>(?<X2050350>))|se(?:\{print "preg_fail";\}\}else\{print "preg_empty"(?<X2055020>)|if[\(\s]+@\$_[GPRC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*['"][^'"\$]+['"][\)\s]+\{\s*if[\(\s]+wp_delete_post[\(\s@]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][,\s]+(?:true|1)[\)\s]+\{\s*(?:echo|die|exit|print)[\s'"\(]+[^'"\(\)]*['"\)\s]*;\s*\}\s*\}(?<X1205940>)|if\((?:(function)_exists\(['"](shell_exec)['"]\)\)\{\$\w{1,40}=\15\(\$\w{1,40}\);(return)\s*\$\w{1,40};\}\16\b[^;]{1,40};\}\14\s*command\(\)\{(?<X2055922>)|strtolower\(\$cmd\)\s*==\s*"etcpasswdfile"\)\s*\{\s*\$pw\s*=\s*file\('/etc/passwd/'\);(?<X2050750>))|if\s*\(\s*(?:\$current_blog\s*===\s*'active'\s*\)\s*\{\s*file_put_contents\s*\(\s*\$destination\s*,\s*\$blog_id\s*\)\s*;\s*\}(?<X2047900>)|has_passthru\s*\)\{\s*x_passthru(?<X2050260>)|isset\(\s*\$_COOKIE\[\s*'\w+'\s*\]\s*\)\s*&&\s*!empty\(\s*\$_COOKIE\[\s*'\w+'\s*\]\s*\)\s*\)\s*{\s*echo\s*htmlentities\(\s*\(\s*string\s*\)(?<X2046680>))))|Nq(?:1fflvU2f677/iieaqQDPhb(?<X2053170>)|VWvtTFFfa/lc6VGoDSrC7p(?<X2053130>))|rror(?:\{+if\h*this\.getTemplateFilter\(\)\.(add\W{1,2}[\w\d]{1,4}AfterFilterCallback)\(base64_decode\)\.\24\(system\)\.filter\([^\)]+\)\}+\w*\{+/if\}\}(?<X120346281>)|_reporting(?:[\(0\);\s]+set_time_limit[\(0\);\s]+header\(['"]HTTP\/\d+\.\d+\s*404\s*Not\s*Found['"\);\s]+echo\s*['"]<!DOCTYPE\s*HTML><html><head><title>[^\|]+\|\|\s*\$dir(?<X2284420>)|[\(\h]+(?:0|NULL)[\)\h]+;\s*(function)\h*(\w{1,25})[\(\h]+\$\w{1,25}[\)\s]+\{\s*if[\(\h]+\27_exists[\(\h]+['"]curl_exec[^\?]{99,999}\}\s*(\$\w{1,25})[\h=]+\28[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h]+;\s*(\$\w{1,25})[\h=]+eval[\(\h]+['"]\?>['"][\h\.]+\29[\)\h]+;\s*header\(['"][^:]+:\h*\30['"]\);(?<X1197260>)|[\(\h]+(?:0|NULL)[\)\h];[^\?]{9,99}\$\w+[\h=]+['"]<\?xml[^\176]{999,3500}\bfile_get_contents\(['"]php://input['"]\);[^\176]{999,4200}\bord\(\$\w+\[\$\w+\]\);\s*(?:\$\w+\+\+;\s*)?\}\s*return\s*\$\w+;\s*\}(?<X1207011>)|[\(\s]+(?:0|null)[\)\s]+;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*(base64_decode)[\(\s]+['"][^'"]*['"][\)\s]+\{(?:\s*(\$\w{1,40})\s*=\s*\$_FILES\s*\[[^\]]+\]\s*\[\s*\33\b[^;]+;){2}[^\}]{0,499}(?:move_uploaded_file|copy)\s*\([^;]+\34[\s\)]+;[^\}]{0,99}\}(?<X1205750>)|[\(\s]+(\w+::\w+)\(\d+\)\s*[-\+\*/]\s*\36\(\d+\)[\)\s]+;(?<X1227620>)|[\(\s]+0[\)\s;@]+mkdir[\(\s]+['"]([^'"\$]+)['"][,\s]+0?7\d+[^;]+;\s*(\$\w{1,40})[=\s@]+(file_)ge(t_contents)[\(\s'"]+https?://[^'"]+\.(?:txt|php)['"\);\s]+(\$\w{1,40})[=\s@]+['"]\38/[^'"]+\.php['";\s]+if[\s\(]+\40pu\41[\s\(]+\42[,\s]+\39[^\?\n]{9,199}(\$\w{1,40})\s*=[^\n\}]{9,499}\43[\);\s]+\}(?<X1208520>)|[\(\s]+0[\)\s;]+http_response_code[\(\s]+4\d+[^\{\}\[]{1,499}(\$\w{1,40})[=\s]+\[['"][a-f\d]{4,64}['"](?:[,\s]+['"][a-f\d]{4,64}['"])+\][^<\+]{0,999}if[\(\s]+(\$\w{1,40})\s*<\s*count[\(\s]+\45[\)\s]+\{\s*\45\[\46\]\s*\.?=[^!]{0,999}\bif[\(\s]+!\45\[\d+\][\(\s]+\$_FILES\[[^\]]+\]\[[^\]]+\]\[\46\](?<X2228051>)|[\(\s]+0[\)\s]+;\s*@?set_time_limit[\(\s]+0[\)\s;]+(\$\{\$\{['"]GLOBALS['"]\}\[)([^\]]+\]\})[=\s]+curl_init[\(\s\);]+curl_setopt[\(\s]+\48\49[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0c[^;]+;[^\?\n]{0,499}\beval[\(\s]+base64_decode\s*\([^;]*\48[^\]]+\][\}\)\s]+;(?<X1257281>)|[\(\s]+\d+[\)\s;]+http_response_code[\(\s]+\d+[\)\s;]+define[\(\s]+['"]\w{2,5}['"][,\s]+['"][^'"]*['"][\)\s;]+\$\w{1,40}[\s=]+['"]scandir['"]\s*;\s*\$\w{1,40}[=\s]+array[\(\s]+['"][\s,'"a-f\d]{99,1999}\)\s*;[^><]{0,999}\bwhile[\s\(]+\$\w{1,40}\s*<\s*count[\s\(]+\$\w{1,40}(?<X2228390>)|[\h\(]+(?:0|NULL)[\h\)]+;(?:[^#]{9,150}\bCyberPunk\h*Ultimate\h*(?:v\h*\d+\.\d+)</title>(?<X220369070>)|\s*(\$\w{1,15})[\h=]+@?file_get_contents[\h\(]+str_rot13[\h\(]+[^;]+;\s*eval[\h\(]+['"]\?>['"][\.\h]+\53[\h\)]+;(?<X1212170>)|\s*(\$\w{1,15})[\h=]+['"]https?://(?:www\.)?bestmarijuanaguide\.com[^'']+['"];[^\^]{999,3999}\bstr_replace\(\$\w+\.\55,\h*\$[^@]{99,1200}\bsetcookie\(['"]haircki['"],\h*['"]haircooki['"],[^;]+;(?:define\(['"]\w+['"],true\);){2,4}(?<X1203860>)|\s*function[^\}]{0,59}\bfunc_get_args[^\{]{0,99}\{\s*return\h*['"][^'"]{9999,20000}['"];[\s\}]+eval[\h\(]+base64_decode[\h\(]+[^\)]+[\h\)]+;(?<X1293270>)|\s*header[\h\(]+[^\)]+\);\s*if[\h\(]+\$_SERVER\[[^\]]+\][^\{]+\{\s*(\$\w{1,25})[\h=]+array_shift[\h\(]+\$_[GPRSC]\w{2,6}[\h\)]+;\s*eval[\h\(]+gzinflate[\h\(]+base64_decode[\h\(]+\58[\h\)]+;\s*\}(?<X1207976>))|[\h\(]+0[\h\)]+;\s*function\h*([^\h]+)[\s\(\)\{]+\$[^\h]+[\h=]+0x\w+;\s*(\$[^\h]+)[\h=]+func_get_args[\h\(\)]+;[^\}]+\}\s*if[\h\(]+\61[^\{]+\{\s*return\h*base64_decode[\h\(]+str_rot13[\h\(]+['"][^'"]{10000,}['"][\h\)]+;[\s\}]+eval[\h\(]+\60[\h\(]+0x\w+[\h\(\)]+\60[\h\(]+[^\)]+[\h\)]+;(?<X1290392>)|[\h\(]+[^\{]{9,699}\bclass\s+(KillBot)\s*\{[^#]{99,1999}(\$\w+)[\s=]+new\s+\63;\s*\64\s*\->\s*apikey[\s\(]+(\$\w+\h*\[)[^;]+;\s*if[\s\(]+\64\s*\->\s*\w+\s*\([^\{;]{1,99}\{\s*(@?die[\s\(]+header[\s\(]+['"]Location:[^;]{0,9}\65)[^;]+;[\s\}]+(?:else[\s\{]+\66[^;]+;[\s\}]+)?(?<X1222603>)|[\s\(]+0[\s\)]+;[^\$\?]{0,99}\bif[\s\(]+isset\s*\([^\{;\?]{1,99}\{\s*\?>[^\?]{0,1499}<\?[ph\s]+if[\s\(]+(\$_FILES)[\s\)]+\{\s*(?:if[\s\(]function_exists[\s\(]+['"](move_uploaded_file|copy)['"][\s\)]+\{[^\}]*\b\69[\s\(]+\68\[[^,\);]+,\s*\68\[[^\n]{0,499}){2}\}\s*(?:\}\s*)*(?:\?>\s*)?\Z(?<X1210351>)|\((?:0|FALSE)\);(?:[^\{\}]{1,50}\$xmlname=['"]mapss?\.xml['"];[^_]{0,20}\$(sitemap)[^=]{0,15}=["']\71[^@#]{999,6000}\b(?:get|file_get_contents)\(['"]https?://[^\);]{4,60}\.txt['"]\);[^\?>@]{30,400}\bfile_put_contents\([^,]+\.php['"],\$shell.load\)[^@#]{5000,9000}\{(\$\w{1,20})\[\]=[^\[\?]{1,30}\}return\72;\}(?<X1188000>)|\s*if\s*\(\s*eregi\s*\(\s*['"]mainlink\|\w{1,40}['"],\s*@?\$_SERVER\[['"]HTTP_REFERER['"]\]\s*\)\s*&&\s*!\$_COOKIE\[['"](\w{1,40})['"]\]\s*\)\s*\{\s*@?setcookie\(\s*['"]\74['"],\s*['"]\w{1,40}['"]\s*\);\s*\}(?<X1055981>))|\((?:0|FALSE|NULL)\);(?:[^\./]{9,30}<(title>)(\./\w{1,20})</\76[^\@\\]{300,2000}>\77</font>[^\@\*%]{400,2000}(\$\w{1,20})=scandir\([^\)]+\);\s*foreach\(\78\h*as\b(?<X2189440>)|\s*(\$\w{1,20})=\$\{['"]_[GPRSC]\w{2,6}['"]\};\s*\([^_]{1,20}\bin_array\(gettype\(\80\)\.count\(\80\)[^=]{1,20}\80\[\d+\]=[^\?#@]{200,999}\bcurl_exec\([^\)]+\);\s*if\(empty\((\$\w{1,20})\)\)\s*\81=file_get_contents\h*\([^\)]+\);\s*return\h*\81;\s*\}(?<X1187890>)|\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*['"]/?(?:wordpress|wp|ptth)/?['"]\s*\)\s*;[^\?]{999,9999}(file_)pu(t_contents)\s*\(\s*ABSPATH\s*\.\s*WPINC\s*\.\s*['"]/ID3/\w{1,40}\.dat['"],\s*\83ge\84\s*\(\s*\$style.css\s*\.\s*['"]\w{1,40}['"]\s*\)\s*\)\s*;(?:\s*\}){5}(?<X1130470>)))))
\bError_reporting(?:\((?:0|NULL)\);(?:[^\n]{0,99}\bfilesMatch\b[^;]+;\h*\$\w{1,15}=+@?fopen\(['"]\.htaccess['"],[^\n]{99,2500}\bif\(\!isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)]+\{login_shell\(\);\}\}(\$\w{1,15})=['"]<img\h*src[^\n\)]{99,1999}\)['"]>#['"],\1,(\$\w{1,15})\);\$\w{1,15}=\2\[\d+\];(?<X1202100>)|[^\{\n]+\{\h*\$\w{1,25}[\h=]+@?file_get_contents\(\$\w{1,25}\);[^\n]{99,1500}\bLove=['"],\h*(\$\w{1,25})\);\h*\4[\h=]+str_replace\(['"]\.Lovehtml['"],\h*['"]\.html['"],\h*\4\);\h*echo\h*\4;\h*(?:exit|die)[^;]{0,9};(?<X1201805>)|[^\{]{9,99}\bif\((isset)\(\$_GET\[['"]cobaind[^\{]+\{\s*(\$\w+)[\h=]+\$_FILES\[[^\?]{99,399}\bmove_uploaded_file\(\$\w+,\h*\7[^\}]{9,99}\}\s*if\(\6\(\$_POST\[['"]\w+['"][^\}]{99,450}\becho\h*['"]Error[^;]+;\s*\}\s*\}(?<X120336041>)|\$_\w{1,20}\s*=\s*__FILE__;\$_\w{1,9}\s*=\s*['"][^'"]{999,}['"];\s*@?eval\(base64_decode\(['"][^'"]{1,30}(?:YmFzZTY0X2RlY29k|c2U2NF9kZWNvZGUo|YXNlNjRfZGVjb2Rl)[^'"]{1,90}(?:ZXJlZ19yZXBsYWNlKCdfX0ZJTEVf|ZWdfcmVwbGFjZSgnX19GSUxF|cmVnX3JlcGxhY2UoJ19fRklMRV9f)[^'"]+['"]\)\s*\);(?<X2065012>)|\h*function\h*(\w{1,15})\(\$\w{1,15}\)\h*\{[^\{]{1,99}\{\h*(\$\w{1,15})\h*\.=\h*pack\(['"]\w['"],\h*hexdec\(substr\(\$\w{1,15}[^\}]+\}\h*return\h*\11;\h*\}\h*eval\(\10\(['"][^'"]{1,99}['"]\)\h*\.\h*['"][^'"]{999,60000}['"][\);'"]+;(?<X1195761>)|\s*(\$\w{1,15})[\h=]+['"][^'"]+['"];\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]+\{\s*if\(\14[^\{]+\{setcookie\(\13,\h*\14,[^\^]{99,999}\bX0MB13</title><[^\^]{999,14000}\{\h*header\(['"]Location:\h*['"]\.basename\(__FILE__[\);}\s]+print\h*\$end;(?<X2202201>)|\s*(\$\w{1,25})[\h=]+(base64_)decode\([^\)]{0,99}\);\s*if[^\{]+\{\s*(\$\w{1,25})[\h=]+\16[\h\.]+\17encode\(\$_SERVER[^\?]{0,350}\{@?(\$\w{1,25})[\h=]+file_get_contents\(\18\);\s*\}\s*echo\h\19;[\s\}]+if[^\{]+\{\s*echo\h*['"]<div[^\}]{0,99}\}(?<X1214740>)|\s*[^\?]{0,199}\becho\h*['"]<!DoCTYPE\h*HTML>[^\|]{999,6500}\bmass_deface['"]><font[^>]{0,99}>AUTO\h*MASS</[^%\^]{99,7000}\bperms\h*&\h*0x\d+\)[^\)]+\)\);\s*return\h*\$\w{1,15};\s*\}(?<X1196031>)|\s*\$\w{1,20}=['"]https?://[^\.]{2,20}key[sz][^'"]{0,15}/(?:windows|antivirus|os|game)[^'"]{1,20}key[sz]?/?['"];[^#%\*]{20,150}(\$\w{1,20})=(curl_)init\(\);[^\(]{0,30}\23setopt\(\22,[^:]+https?://[^'"]{9,99}\.txt['"]\);[^\{]{99,250}\{\s*\$\w{1,20}=['"]https?://[^\}]{9,99}\}(?<X1196100>)|\s*\$\w{1,20}\s*=\s*strrev\s*\(\s*['"]/wordpress/['"]\s*\);[^\{]{30,300}if\s*\(\s*is_dir\s*\(\s*(ABSPATH\s*\.\s*WPINC)\s*\)\s*\)\s*\{\s*(\$\w{1,20})[^\?]{99,7000}\{\s*(file_)put(_contents)\s*\(\s*\25\s*\.\s*[^\(]{9,40},\s*\27get\28\s*\(\s*\26\s*\.\s*["']json["']\s*\)\s*\);(?:\s*\})+(?<X1133271>)|\s*define\(['"]__SEC_VALUE__['"],[^\{]{199,240}function\s*CheckSecureValue\s*\(\s*\)\s*\{\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\](?<X2064681>)|\s*function\h*\w+\((\$\w+)\)\s*\{\s*\$\w+[\h=]+@?(curl_)init\(\31\);[^\}]{9,400}\bGLOBALS\[['"]coki['"]\]\);\s*(\$\w+)[\h=]+@?\32exec\([^\?]{0,99}\breturn\h*\33;\s*\}(?<X1213240>))|\((?:0|NULL)\)[^\?\{]{0,199}\{(\$\w{1,15})[\h=]+['"]/tmp/[^\.]+\.txt['"];[^\?]{99,399}\bfunction\h*(\w+)\([^\{]+\{\s*\$\w{1,15}[\h=]+['"]https?://(?:\w+\.)?classicpartnerships\.com/[^\?]{99,499}\bfile_put_contents\(\35,[^\?]{9,299}\badd_filter\(['"][^'"]+['"],['"]\36['"][;\)\}]+(?<X1204230>)|\((?:0|NULL|FALSE)\);(?:(\$\w{1,20})=['"]strrev['"];(?:\$\w{1,20}=\38\([^\)]+\);){5}[^\\]{99,1500};\$\w{1,20}\(\$\{['"]_FILES['"]\}\[[^\]]+\]\[['"]tmp_name['"]\],[^\?]{99,700}['"]</textarea>['"]\);\}(?:exit|die)[^;]{0,19};\h*\}(?<X1135251>)|[^'"]{0,30}\bdefine\([^,]{1,20},['"]G[3e][l1][14]y\h*(?:Mini|web)\h*shell['"]\);[^\d]{9,40}\$\w{1,20}=array\((?<X2200890>)|[^\$]{0,60}(\$\w{1,20})[=\s]+["']chr['"];\s*(\$\w{1,20})[\s=]+\41\h*\(\h*\d+\h*[\-\+/\*][^'"]{99,1500};\s*(\$\w{1,20})=\42\([^'"]*['"][^\)]{5000,}['"]\s*\)[\)\s]+;\s*(\$\w{1,20})[=\h]+(?:create_function|\$\w{1,20})[\(\s]+['"]{2}[,\s]+\43[\)\s]+;\s*@?\44[\(\)\s]+;(?<X2235373>)|[^\(\)]{2,50}\$\w{1,20}=['"]\w{20,40}['"];\s*foreach\([^@\?]{99,700}\$\w{1,20}=file_get_contents\(['"]https?://[^\)]+/(\w{1,20}\.txt)['"]\);\s*\$\w{1,20}=fopen\(['"]\46['"],[^@]{999,3000}(\$\w{1,20})=fopen\(\$\w{1,20}\.['"]\.tpl['"][^;]+;\s*fwrite\(\47[^\)]+\);\s*fclose\(\47(?<X2185041>)|[^\(]{0,30}(\$pathdor)=dirname\(__FILE__\);\s*\$pathsrv=\49\.['"]/files["'];[^\(]{9,150}\(str_replace\(['"]\.pdf['"](?<X2172692>)|[^\?=\$]{1,199}\bif\(\$_[GPCSR]\w{2,6}\[[^\)]+\)\{echo\b[^;]{1,99}\.php_uname\(\)\.[^\?\}@]{1,499}\b[cm]o(?:ve_uploaded_file|py)\((\$_FILES\[)[^\),]{1,99},\51(?<X2174890>)|[^\?]{1,199}\bfunction\s*\w{1,40}\((\$\w{1,40})\)\{if\(stri?pos\(\53,['"](\.\w{1,40})['"]\)[^\?]{1,99}\bfile_pu(t_contents\()\53\.['"]\54['"],\w{1,40}\(file_ge\55\53\)[^;]{1,99};unlink\(\53\);(?<X2165871>)|[^\?]{9,400}\$(?:pass|passwd|psw|pwd|password|auth|auth_pass)\s*=\s*['"][^'"]*['"];[^\?]{9,200}header\(['"]HTTP/1\.\d\s+(?:401|404)\s+(?:Unauthori[zs]ed|Not\s+Found)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X2125014>)|[^\{\}\?]{0,99}\$ex_links\h*=[^@]{99,1499}\bif\h*\(file_exists\h*(\([^\)]+\))\s*\)\s*\{[^@]{99,599}\bunlink\58;[^\`]{999,4999}\bfopen\(([^\,]+),[^\?]{1,99}\b[ir](?:nclud|equir)e(?:_once)?\(\59\);\}(?<X2144685>)|[^\{]{0,40}\bif\(get_magic_quotes_gpc\(\)\)\{foreach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,29}=>\$\w{1,20}\)\{[^'"]{0,40}\$s?name=['"]\w{1,9}Shell['"];(?<X2178940>)|[^\{]{9,99}\{\s*function\h+(\w{1,20})\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\(['"](tmp)['"]\h*,[^\)]+\);[^\?>]{99,1500}\b\62\([^\)]+\);\s*include\(['"]\63['"]\);\s*\}(?<X2174280>)|\s*(?:\$\w+[\h=]+(?:gzdecode\()?(base64_decode)\(['"][^'"]{999,5000}['"]\)+;[^\[]{0,60}\$\w+[\h=]+(\$_SERVER\[)[^\]]+\];\s*){2}[^\\<#]{999,1500}(\$\w+)[\h=]+strrev[\h\(]+['"][^'"]{9,40}//:sptth['"]\)[^<]{9,150}\b\65[\h\(]+[^\)]+\)[\.\h]+\67[\W\h]+\66[^\}]{1,60}\b(?:exit|die)[^;]{0,9};\s*\}(?<X1227280>)|\s*(\$\w{1,20})=sys_get_temp_dir\(\)\.[^;]{9,99}\.dummy['"];\s*if\(isset\([^\{]+\{\s*unlink\(\69\);[^\}]{1,70}\}[cm]o(?:py|ve_uploaded_file)\(\$_[GPRSC][^,]+,\69\);\s*(\$\w{1,20})=file_get_contents\(\69[^\)]*\);\s*eval\(["']\?>['"]\.\70\.['"]<\?['"]\);(?<X1235380>)|\s*\$\w{1,20}\h*=\h*\$_SERVER\[['"]SCRIPT_NAME['"]\];\s*(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\{]{9,99}\{\s*if\((file_exists)\(\72\)\)\s*\{\s*\$\w{1,20}\h*=\h*htmlentities\(file_get_contents\(\72\)\);[^\?]{99,300}if\(\73\(\72\)\)\s*\{\s*if\(unlink\(\72\)\)(?<X2143060>)|\s*\bif\(\$_[GPRSC]\w{2,6}\[[^\?]{1,79}\{(\$\w{1,20})[^;]{1,199};\s*(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*\bif\(!empty\(\76\)\)[\s\{]+\bunlink\(\75\);\bexec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\);[^\?]{1,99}file_put_contents\(\75,\$\w{1,20}\);\s*chmod\(\75,\d+\);(?<X2186011>)|function\b[^\{]{1,99}\{if\((\$_[GPCSR]\w{2,6})\)\{if\(isset\((\78\[chr\()[^\}@\?#!/:]{1,499}\beval\(\w{1,40}\(\)\s*\?[^;:]{1,99}\79[^;:]{1,99}:\79(?<X2183630>)|header\(['"]Content\-type[:\h]+text/html;[^@]{999,}\bSubmitting\s*Google\s*Sitemap\b[^@]{999,};\$\w+=function\((\$htName),(\$htContents)\)\{(\$\w+)=fopen\(\81,[^;]+;fwrite\(\83,\82\);fclose\(\83\);\};\$\w+\(\);(?<X1211200>))|\((?:\d|FALSE|NULL)\);\s*(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*declare\h*\(ticks=\d\);\s*register_tick_function\h*\(\85\h*,\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1178240>)|\((?:\d|NULL|FALSE)\);[^/:]{9,99}<title>Bypass\h*Shell\b(?<X2177591>)|\((round)\(0\+0\+0\+0\)\);[^\[]{1,99}\$_SERVER\[(['"]\w{16,}['"])\]\)[^:]{1,299}\89\]\)==\88\([^<]{1,699}base64_encode\(trim[^>]{1,229}curl_setopt[^\?]{1,599}!empty\((\$\w+)\)\)[\s=]+\{[\s=]+echo\s+\90;[^\?]{1,299}foreach[^\?]{1,199}echo[\s=]+['"]\w+['"];\s*exit;\s*\}\s*\}(?<X120348381>)|\(0\).{100,1000}?sprintf\("%c"\s*,\s*\$\w{1,40}\s*\^\s*ord\(\$\w{1,40}\[\$\w{1,40}\]\)\);\s*\$\w{1,40}\s*=\s*\$\w{1,40}\("\s*"\s*,\s*\$\w{1,40}\([^)]{1,300}\)\);\s*\$\w{1,40}\(\s*\);(?<X1039691>))
\beval(?:[\(\h]+str_replace[\(\h]+array[\(\h]+['"]<\?php[^\(]{0,50}\bbase64_decode[\(\h]+file_get_contents[\h\(]+[''][^'"]+\.txt['"][\h\)]+[^;]{0,20};(?<X1298370>)|[\(\s]+Str(?:ing\.fromCharCode[\(\s]+118,97,114,[^\)]{0,99}61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,[^\)\*/]{9,9999}/\*[^\*]+\*/[\)\s]+;(?<X1228070>)|rev[\(\s]+htmlspecialchars_decode[\(\s]+gzinflate[\(\s]+base64_decode[\(\s]+\$\w{1,40}\b(?<X2198411>))|[\h\('"]+\?>['"\h\.]+[\h\(]+(\$\w+)[\h=]+@file_get_contents\([^;\?]{1,99}\?\h*\4[\h:]+[\h\(]+\$\w+[\h=]+curl_init[^;\?]{9,99}\?\h*\$\w+[\h:]+['"\)\h]+;(?<X120341970>)|[\h\(]+(urldecode)\([^\)]+\)[\h\.]+file_get_contents[\h\(]+\6[\h\(]+['"]https?://worldofseafood\.com/\w+\.txt['"][\h\)]+;\h*\?>(?<X120335760>)|\("\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E[^\)]{9999,}(?<X2047662>)|\((?:(?:base64_decode|gzinflate|str_rot13|convert_uudecode|gzuncompress)\s*\(\s*){6,18}\(?\$\w{1,40}(?:\s*\))+(?:\s*;)(?<X1131590>)|\((\w+\()(?:['"]https?://[^/'"]+\.(?:xyz|top)/[^;]+;\s*\}[^\{\?\}]{1,99}\{\s*eval\(\10){5}(?<X2201221>)|\((function)\((?:[\w,\)]{12,}\{\w[\s=]+\12\((\w)[^%]{1,999}regexp\([^\{]+\{\w+\([\w\.\s'"=\)]+\{\13[^%]{1,999}(web_security)\|[^\)]+(addEventListener)['"]\.split[^\.]+\.\15\(['"]DOMContentLoaded[^\.]+\.\14[\s=]+['"]undefined[^\.]+\.\14[\s='"]+\w+['";\s]+\}{2},\s*false\);(?<X1305010>)|p,a,c,k(?:,e,d\)\{\w=\12\(\w\)\{[^\n\?]{9,299}//\d+\-\d+\.\d+/\d+\?\d+=\d+[^\n\|]{9,199},\h*['"]\w+\|document\|[^;\.]{9,199}\|head\|appendChild\|addEventListener['"]\.split\([^\)]+\),\d+,\{\}\)\)(?<X1197701>)|[^\)]+\)\s*\{\s*(\w{1,9})\h*=\h*\12\([^\)]+\)\s*\{\s*return\([^\(]{1,9}\18\(parseInt\([^\n@#]{400,800};\d+\.\w{1,9}\([^\)]+\);\s*['"],\d+,\d+,['"][^\)]{1,200}\byadro\|[^\)]{1,200}\|ru\|[^\.]{2,200}\.split\(['"]\|['"]\),\d+,\{\}\)\)(?<X1155131>)))|\((urldecode)\(['"]\?>['"]\)(?:[\h\.]+file_get_contents\(\20\(['"]https?://(?:[^\.]+\.)?barbarslot\.cv/[^'"]+\.txt['"][\h\)]+;(?<X120342530>)|\.file_get_contents\(\20\(['"]https?://worldofseafood\.com/love\.txt['"]\)\)\);(?<X120340242>))|\(['"]\?>['"](?:[\h\.]+getdata\(['"]https?://(?:[\w\-]+\.)?tritoncenter\.ru/[^'"]+\.txt['"]\)\);(?<X120343222>)|\.implode\(['"]+,file\(['"]https?://[^;]+\.txt['"]\)\)\);(?<X120365711>)|\s*\.\s*geturl\(['"]https?://pastebin\.com/raw/(?:38eijnpp['"]\)\);(?<X120344320>)|iaSJxBFf['"]\)\);(?<X120344340>)))|\([^;\)]*\$(?:love(?:you)?fanny|ramdan|rmdn(?:maulana)?|danbella|(?:lonte|memek|jembut)_cyber)\b(?<X2201902>)|\([^\(]{1,39}(urldecode)\(['"][^\.]{1,29}['"]\)\s*\.\s*file_get_contents\([^\(]{1,39}\28\([^'"]{1,39}['"]https?://luxury\-souffle\-f41289\.netlify\.app/wordpress\.php['"]\s*\)\s*\)(?<X120342851>)|\(\$\w{1,15}\[\\['"]payload\\['"]\]\)[^\?]{9,199}/\*Bloodninja\b(?<X2146982>)|\(\(['"\+if\(/gole|yahbn]{9,90}\)/i[^=]{9,150}=['"\+htp:/musicy\.xz]{9,50}[^\)]{9,150}\d{1,3}\)['"\+\}\)]{1,9}\.replace\([^\)]{1,15}\)\)(?<X1152523>)|\(\s*"return\s+eval\(\\\"\$code\\\"\);"\)\s+\?>(?<X2044032>)|\(\s*'error_reporting\(E_ERROR\);\$out(?<X2048610>)|\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:.pass.\]\);\s*exit\(\);(?<X2043591>)|pass(?<X2043561>))|\(\s*\$(?:_g\(\s*\$_b\(\$_r(?<X2044061>)|gzc\(\s*\$b64\(\s*\$r13(?<X2043531>))|\(\s*base64_decode\(['"]aWYobWQ1KCRfUE9TVFsicGYiXSkgPT09ICI5M2FkMDAzZDdmYzU3YWFlOTM4YmE0ODNhNjVkZGY2ZCIp[^'"]+["']>(?<X1306734>)|\(\s*x\(\$x(?<X2043751>)|\(base64_decode\((?:"aWYgKCFkZWZpbmVkKCdBTFJFQURZX1JVTl[^"]+"\)\);(?<X1040750>)|'(?:JGY9|JGYgP)[^'"]+?'\)\);(?<X1034662>)|@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['[a-zA-Z0-9]+'\]\)\);(?<X1034231>)|['"][^'"]+['"]\)\);\s*(\$\w+)[\s=]+isset\(\$_SERVER\[[^\|]{1,99}(\$\w+)[\s=]+\(\43[^;]{1,49}\43[^'"]{1,49}['"]/\w+\.php['"]\);\s*if[\h\(]+\44\s*&&\s*is_bot\(\)\)\s*\{\s*eval\(['"]\?>['"]\.file_Get_contents\([^;]{1,49}\);\s*exit;\s*\}(?<X120361011>)|['"][^'"]{9,99}(?:IWRlZmluZWQo|ZGVmaW5l|ZWZpbmVk)[^'"]{99,700}(?:c3RyZWFt|dHJlYW1f|cmVhbV9j)[^'"]{1,99}(?:ZmlsZV9nZXRfY29udGVudHMo|aWxlX2dldF9jb250ZW50|bGVfZ2V0X2NvbnRlbnRz)[^'"]{1,99}['"]\)\);(?<X1120142>)|['"]\\103\\x69\\x42\\154\\x64\\155[^'"]+\\x70\\113\\124\\163\\147['"]\)\);\s*\?>(?<X120350720>)|['"]JHVybCA[^'"]+['"]\)\);(?<X120351570>)|['"]ZnVuY3Rpb24gX3dPSUoo[^'"]+['"]\)\);(?<X120348591>)|['"]ZXh0cmFjdCgkX1BPU1QpOy[^'"]+fWVjaG8gJG91dDt9['"]\)\);(?<X120341550>)|['"]ZXJyb3Jf(?:[^'"]+GVhZCk7['"]\)\);(?<X120359430>)|cmVwb3J0aW5nKDApOw[^'"]+['"]\)\);(?<X120359530>))|['"]ZXZhbCh(?:AZmlsZV9nZXRfY29udGVudHMoImh0dHA6[^'"]{1,99}(?:eHQiKSk7|dCIpKTs|dHh0IikpOw)=+['"]\)\);(?<X1128651>)|ne[^'"]+E9PSIpKSk7['"]\)\);(?<X120350371>)|nem[^'"]+['"]\)\);(?<X120351460>))|[^;]{9,250}\);error_reporting\((?:0|NULL|FALSE)\);\s*(?:\$\w{1,20}=\(isset\(\$_SERVER\[[^;]{9,99}:\$\w{1,20}\);\s*){3,6}(\$\w{1,20})=base64_encode\([^;]{0,150}\);\s*if\(\((include_once\(base64_decode\([^\$]{9,99}\56)\)\)\)\s*\{[^\{]+\belse\s*\{\57\);\s*\}(?<X1183901>)|\$_REQUEST\['\w{1,40}'\]\)\);\s*else\s*eval\(\$_REQUEST\['\w{1,40}'\]\);\s*break;(?<X2050340>)|file_get_contents\(['"]https://debugilaton\.com[^'"]+\.txt['"]\)\)\);(?<X120353090>))|\(decodeURI\(['"]function%20[^\+\n\{\}\176]{9,499}['"]%5D\h*===\h*undefined\s*\)[^\n@#]{999,}%7D['"]\)\)(?:\s*;)?(?<X1258830>)|\(function\((?:(\w)(?:,\w)+\)\s*\{(?:\h*var\s*\w+[\s=]+0;)+(?:\s*var\s*\w+[\s=]+\[\];)+\s*while[^;]+if\([^;\.]+\.push\(\62\.charAt\(\w+[\)\s;]+else\s*if\(\w+<\62\.length\)\w+\.push\([^\{\}]+\}[^\n%]{0,499}if[\(\s]+\w+\.(charCode)At\(\w+\)%[^\)]+\)[^\-\+\{\}\n]+\.from\63\([^'"]+.join[\('"\);}]+\(['"][\w,'"]{9999,}\)+;(?<X1263112>)|p,a,c,k,e,(?:d\)\s*\{(?:(\w)=function\(\w\)\s*\{return\h*\(\h*\w<a\?['"]{2}:\65\(parseint\(\w[^\n]{99,3500}\bbase64\|\|document[^\}\n]{99,999}\bxyz\|msxml\d\|[^\}\n]{9,299}\.split\(['"]\|['"]\),\d,\{\}\)\)(?<X1195141>)|\w=function\(\w\)\s*\{[^:]{9,250}\breturn\h+\w\}\(["'][^\{]{1,5}\{\\[^:]+:\\["']//[\d\.'",\\:]{10,40}\};(?:[^a-zA-Z;]{1,150};){10,40}['"][\d,]+['"]\|\|[^'"]{99,500}\|php\|[^'"]{9,60}\|eval\|stringify\|[^'"]{1,150}['"],\d+,\{\}\)\)(?<X1193753>))|(?:d\)\{e=function\(\w\)\{return\([^\n]{599,999}['"],\d+,\d+,['"][^'"\d]{1,999}\bsAdsUrl\d+\|[^'"]+['"]\.split\(['"]\|['"]\),\d+,\{\}\)\);?(?<X1131463>)|r\)\{[^\&]{99,999}tongjii[^\{]{1,99}?\.split\(['"]\|['"]\),0,\{\}\)\)(?<X1043193>)|r\)\{e=function\(c\)\{[^\v\*&]{99,499}&&[^\;\v]+;['"],\d+,\d+,['"]\|+indexOf\|if\|rc\|length\|msn\|yahoo\|referrer\|altavista\|ogo\|bi\|hp\|var\|aol\|query[^\.;\}\)]{9,99}go\|window\|location['"]\.split\(['"]\|['"]\),\d+,\{\}\)\)(?<X1161831>))))|\(gz(?:inflate\((?:\$\{\$\{['"](?:\\x\w{2,8}){4,}['"]\}\[['"](?:\\x\w{2,8}){4,}['"]\]\}\)\);\s*(?:\?>|\Z)(?<X2266360>)|base64_decode\(['"](?:1VkJc9rWFv4r[^'"]{1,3999}['"]\)\)\);(?<X120329650>)|FJ3FtqOKFkX[^'"]+['"]\)\)\);(?<X120348950>))|str_rot13\(base64_decode\(\$backdoor(?<X2049800>))|uncompress\(base64_decode\('eNqs/fuPK9tWH47(?<X2047290>))|\(Stri(?:ng\.fromCharCode\((?:118(?:,\s*97,(\s*114,)(\s*32,)[^\)]{99,500}83,\s*116,\76\s*105,\s*110,\s*103,\s*46,\s*102,\76\s*111,\s*109,\s*67,\s*104,\s*97,\76\s*67,\s*111,\s*100,\s*101,\s*40,\s*[^\)]{99,199}52,\s*55,(\s*44,)\77\s*57,\s*57,\78\77(\s*49,)(\s*48,)\80\78\77\79\79\80\78\77\s*52,\s*54,\78[^\)]+41,\s*59,\s*10,\s*125\)\);(?<X1064250>)|[,\s]+97[,\s]+114,[^\)]{1,99},\s*111[,\s]+99[,\s]+117[,\s]+109[,\s]+101[,\s]+110[,\s]+116[,\s]+46[,\s]+99[,\s]+114[,\s]+101[,\s]+97[,\s]+116[,\s]+101[,\s]+69[,\s]+108[,\s]+101[,\s]+109[,\s]+101[,\s]+110[,\s]+116[,\s]+40[,\s]+39[,\s]+(115[,\s]+99[,\s]+114[,\s]+105[,\s]+112[,\s]+116)[^\)]{99,}\82[^;]+;(?<X1258850>))|(?:[^\)]{100,2000}\)\);\s*\Z(?<X1043392>)|[^\)]{199,399}46,115,101,116,65,116,116,114,105,98,117,116,101,40,34,115,114,99,34,44,34,104,116,116,112,(?:\d+,)?58,47,47,[^\)]{1,99}58,51,49,50,57,47,106,115[^\)]{99,999}\)\);(?<X1124223>)))|pslashes\(array_pop\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\)\)\)(?<X2045251>))|\(strrev\(file_get_contents\('[\-\w.]+'\)\)\);(?<X1035230>)|\(substr\((\$\w+),\d+\)\);(goto)[^\\]{1,999}\$\w+=['"]\w{999,}['"];\89[^\}]+\}\89\s*\w+[^\\]{1,299}\88={3}\w+[^\\]{99,999}\$_GET\[['"][^\}]{1,999}['"]immunify[^\\]+\89\s*\w+;\w+:\s*\w+:\Z(?<X220340281>))
\bError_reporting(?:\(0\);(?:\s*(@?ini_set)\(['"]\w+['"],\s*['"]\d+['"]\);\s*\1\(['"]imunify360\.cleanup_on_restore['"],\s*false\);\s*(\$\w+)[\s=]+['"]https?://[^'"]+\-cdn\.net[^'"]+\.php['"];[^\(]{1,49}(curl)\w+\(\2\);\s*\3\w+[^\{]{1,149}(\$\w+)[\s=]+\3\w+[^\{]{1,49}\4\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\4\);\s*\}(?<X120354980>)|\s*(\$\w+)[\s=]+array\(['"]\d+\.\d+\.\d+['"][^\)]{1,3999}\);[^;]{1,49}(\$\w+)[\s=]+preg_replace[^;]{1,49}\$_SERVER[^\|]{1,99}\7,\s*\6[^:]{1,299}https?://['"][^'"]{1,99}(file_get_contents\(base64_decode\(['"]aHR0[^'"]+['"])[^<]{1,199}\8\)\.['"]/\w+\.php[^\}]{1,99}echo\s+\$\w+;\s*exit;\};\};(?<X120359600>)|\s*(\$\w+)[^\(]{1,49}\$\w+[\s=]+explode\(['"]\\\w+['"],\s+file_get_contents\(['"]\w+\.txt[^/]{1,99}fopen[^\[]{1,99}(\$\w+)[\s=]+explode[^\{]{1,49}mysqli_connect\(\11\[\d+[^\.]{1,99}mysqli_query[^\.]{1,99}SELECT\s+\10\s+FROM\s*['"]\.\11[^\(]{1,99}option_name=['"](?:active_plugins|siteurl)(?<X220370210>)|\s*(\$\w{1,25})[\h=]+['"]stristr['"];[^\{]{9,99}\bfunction\h*(httpGet)\([^\{]+\{\s*header\([^\)]+\);\s*\$\w{1,25}[\h=]+curl_init\([^\{]{9,750}\bdefine\(['"](\w+)['"],\h*\13\(\w+,[^\{]{0,500}\{\s*if\h*\(\15\)\s*\{\s*echo\h*\14\([^\?]{9,350}\bif\h*\(\15[^\}]{0,99}\bexit;\s*\}(?<X1208980>)|\s*(\$\w{1,40})\h*=\h*new\h+\w{1,40};\s*if[\(\h]+(isset)[\(\h]+(\$_[GP]\w{2,6}\[)[^\]]+\][\)\s]+(?:\{\s*)?\17\->proxy\(\);\s*(elseif)[\(\h]+\18[\(\h]+\19[^\]]+\][\)\s]+(?:\{\s*)?\17\->check_a\w+\(\);\s*\20[\(\h]+\18[\(\h]+\$_[GP]\w{2,6}\[[^\]]+\][\)\s]+(?:\{\s*)?\17\->update_c\w+\(\);(?<X2188300>)|\s*(function\s*)\w{1,14}\((\$\w{1,14}),\s*[^@]{1,700}return\s*file_get_contents\(\23\);[\s\}]+\22\w{1,14}\(\)[^@]{1,100}REQUEST_SCHEME['"]\][\s='"]+https[^@]{1,400}\22\w{1,14}\((\$\w{1,14})\)[^@]{1,30}\24,\s*['"](?:google|bing|coccoc)[^@]{1,1800}aHR0cHM6Ly9zZW8uNjY3NzU5LmNvbS[^@]{1,100}exit;\}\s*\}(?<X1322111>)|\s*@?set_time_limit\(0\);[^%]{1,999}generate_username\(\)\s*\{\s*\w+[\s'"]+\w+['"]\s*\.\s*generate_random_string\(\d+\);[^%]{1,999}generate_email\(\$\w+\)\s*\{\s*\$\w+[\s=]+\[['"]gmail\.com['"].(?<X220360990>)|\s*@ini_set\(['"]display_errors['"],\h*0\);\s*if[\h\(]+!class_exists[\h\(]+['"]([\w\-]+)['"]\)[^\?]{9,899}\bWHERE\s*option_name[\h=]+['"]\$\w+['"]\h*LIMIT\h*1['"][^\?]{99,800}\beval\(['"]\?>['"\h\.]+\$\w+\);[^\?]{9,99}\bnew\h*\27[^;]+;\s*\$\w+[\h\->]+load\([^;]+;\s*\?>(?<X220365750>)|\s*\$\w+[\s=]+(?:(?:\$_SERVER\[[^\]]+\]\h*\?+\s*){5}[^;]+;[^#]{500,1500}\$cloaking_targets[\s=]+\[[^;]{0,199}\bbot['"]([\h=>]+['"]https?://[^/]+)/[^'"]+\.txt['"],\s*['"](mobile)['"]\29[^#]{999,2000}\bheader\(['"]Location:[\h'"\.]+\$\w+\[['"]\30['"]\][^;]+;\s*exit;\s*\}\s*\}\s*\}(?<X120351980>)|['"]\\x69\\156['"]\s*\.\s*['"]\\151\\x5f\\x73['"]\s*\.\s*['"]\\x65\\164['"];(?<X220332210>))|\s*\$name\s*=\s*'[^']+'\s*;\s*\$text=.+fopen \(\s*"\$name"\s*,\s*"w"\);\s*fwrite\(\s*\$fp\s*,\s*\$text\s*\);\s*fclose\(\s*\$fp\s*\);\s*}(?<X1039170>)|\s*\$strings = "as";.+?\)\);'\)\);(?<X1034261>)|\s*\$wp_\w{1,40}\s*=\s*strrev\s*\([^\)]{1,40}ptth['"]\s*\);(?:\s*if\s*\(\s*(?:is_file|stripos)\s*\([^\{]{1,99}\s*\{[^\}]{1,999}\}\s*\}?){4,9}(?<X1063841>)|\s*\w+\s*(\w+)\([^\{]{1,32}\{\s*\$\w+[\s=]+(\$_SERVER;)\s*\w+\(!\w+\(['"]curl_exec[^\}]{1,32}stream_context_create\([^\\]{1,799}function\s*(\w+\(\))\s*\{\s*\$\w+[\s=]+\37\s*\w+\(.{1,2999}\36[^\.]{1,99}\.\s*['"][\w-]+\.php\?[^\\]{1,299}\}\s*\}\s*\38;(?<X120351860>)|\s*date_default_timezone_set\((\$_[GPRSC]\w{2,6}\[)[^\]]+\][^\?]{99,600}if\h*\(\h*mail\(\40[^\]]+\]\h*,\h*\40[^\]]+\]\h*,\h*base64_decode\(\40[^\]]+\]\)\h*,\h*implode\([^\}]{99,200}\}\s*else\s*\{\s*\$\w{1,15}\h*=\h*json_encode\([^\}]{9,99}['"]Gagal(?<X2144601>)|\s*defined?\(['"]__DIR['"],\s*['"][^'"]{1,40}/wp-(?:admin|include)/(?:\w{1,40}/)?\.\w{1,40}/['"]\s*\);(?<X2134990>)|\s*echo\s*['"]AnonymousFox(?<X2050181>)|\s*eval\("if\s*\(\s*isset\(\s*\\\$_REQUEST\[['"]\w+['"]\]\)\s*&&\s*\(md5\(\\\$_REQUEST\[['"]ch['"]\]\)\s*==\s*['"]\w+['"]\s*\)\s*&&\s*isset\(\\\$_REQUEST\[['"]\w+['"]\]\)\)\s*{\s*eval\(stripslashes\(\\\$_REQUEST\[['"]\w+['"]\]\)\);\s*exit\(\);\s*}"\s*\);(?<X1035880>)|\s*goto\h*\w{3,9};\s*\w{3,9}:\h+file_put_contents\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*,\h*FILE_APPEND\h*\)\h*;[^\[\]\{\}\(\)]{0,99}\bset_time_limit\b[^\[\]\{\}]{0,99}\bgoto\h*\w{3,9};\s*\w{3,9}:\h+mkdir\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X2161990>)|\s*if\(!class_exists\(['"](\w+)['"]\)\)\s*\{\s*class\s*\46\s*\{\s*(?:public\s*\$\w+[\s=]+['"]\w+['"];\s*){10}[^\*]{1,4999}if\((\$\w+)\)\s*\{\s*eval\(['"]\?>['"]\s*\.\s*\47\);\s*\}(?<X220356041>)|\s*if\s*\((?:\s*!(function)_exists\s*\(['"](\w+)['"]\)\)\s*\{\s*\49\s+\50\s*\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"]http[^;]+['"];[^\?]{99,2999}(\$\w{1,40})\s*=\s*file_get_contents\s*\(\s*\51\s*,[^\?]{99,499}eval\s*\(\52\);[\s\}]+\50\s*\(\);(?<X1133312>)|isset\(\$_GET\[['"]\w+['"]\][^\$]{1,49}\$_GET\[['"]\d+['"]\][^\$]{1,49}(\$\w+)[^\(]{1,49}(\$\w+)[\s=]+(proc)\w+\(\54,\s*array\([^\$]{1,149}(\$\w+)\);[^\{]{1,99}\{\s*echo\s+stream_get_contents\(\57\[[\d+]\]\);\s*fclose\(\57\[[\d+]\]\);\s*\56\w+\(\55\);\s*\}\s*exit;\s*\}\s*\}(?<X120350470>))|\s*ini_set\((?:[^\.]{1,49}(\$\w+)[\s=]+__DIR__[^;]{1,49}\.php['"];\s*function\s+(\w+)[^\[]{1,49}\$_SERVER[^=]{1,99}(\$\w+)[^\{]{1,499}foreach[\h\(]+\61[^&]{1,199}\60[^\{]{1,49}file_exists\(\59[^;]{1,49}file_get_contents\(\59[^\(]{1,49}base64_decode\(trim\([^!]{1,299}(\$\w+)[^:]{1,299}https?://[^\?]{1,249}echo\s+\62[^/]{1,49}exit;\s*\}\s*\}(?<X120357720>)|\s*(?:chr\(\d+\)\s*\.?)+,\s*\d+\);\s*echo\s+@?file_get_contents\(\s*(?:chr\(\d+\)\s*\.?)+\);(?<X1041601>))|\w+\(['"]content\-type[^\{]{1,99}\{\$\w+=array\(['"][^\?]{32,999}\?['"]\.\w+\(\$\w+\);\}\w+\{[^\?]{99,9999}\?\.\*/['"][^\}]{1,999}\}\}\w+\([^\}]{1,999}\(base64_decode\(['"]aHR0c[^'"]+['"]\)[^\}]{1,999}\.trim\(\$\w+\[[^\?](\w+)[^\?]{1,999}\65['"]\];exit\(0\);\}(?<X120366846>)|\w+\(\);\w+[^\?]{99,9999};if\(move_uploaded_file\(\$\w+,\$\w+\)==['"]\d+['"]\)\{echo\s*['"]\s*[^\?\\]{1,999}<(title)>xxx</\67>(?<X2325462>)|function\s*\w+\((\$\w+)\)\{(\$\w+)=(array\(['"]status['"]=>0,['"]content['"]=>['"]+,['"]type['"]=>['"]+\);)if\(\!?\(is_array\(\69\)+\{return\70;\}foreach\(\69as\$\w+\)+\{if\(preg_match[^@]{1,200}return\70;\}function\s*\w+\(\$\w+,(\$\w+)=array\(\)+\{(\$\w+)=\71if\(+is_array\(\72\)[^@]{1,5000}echo\73[^;]+;exit\(0\);\}(?<X1322520>)|header\(['"]Content\-type[\h:]+text/html;[^#]{499,}\bif\(preg_match\(['"][^;\{]+\{(\w+)\(\$\w+,['"]google\-site\-verification\s*:[^;]+;\s*(?:exit|die)\b[^;]{0,99};[^#]{499,}\bfunction\s+\75\s*\([^;\{]+\{[^\}]{0,499}\bfwrite\([^;]+;fclose\([^;]+;[\s\}]+\w+\(\);(?<X1218590>)|ini_set\((?:"display_errors", 0\);\$localpath=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$root_path=substr\(\$absolutepath,0,strpos\(\$absolutepath,\$localpath\)\);include_once\(\$root_path\."/SESS_\w{32}\.php"\);(?<X1035800>)|['"]display_errors[^;]{1,32};session_start\(\)[^<]{1,9999}\{echo\s*['"]<!\w+[^\^]{1,299}403\s*forbidden</title>[^\?]{1,9999}curl['"];break;\}\$\w+=\$\w+\.\$\w+;list\(\$\w+,\s*\$\w+\)=\w+\(\$\w+\);if\(\$\w+={3}\w+\)\{(?:die|exit);\}eval\(['"]\?>['"]\.\s*\$\w+\);(?<X1308820>))|set_time_limit\(0\);\s*(\$\w+)=@?\$_REQUEST\[['"]\w+['"]\];\s*if\(\79\)\{\s*\79=str_replace\(array[^;]{1,49}\79\);\s*(\$\w+)="";for\([^\)]{1,49}strlen\(\79[^\(]{1,49}\80\.=urldecode\(['"][^;]{1,49}\79[^@]{1,49}@?eval/\*\*/\(\80\);exit;\s*\}(?<X120359210>))|\(0\)[\s;]+function\s*(\w{1,40})\s*\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][^'"]+['"];\s*(\$\w{1,40})\s*=\s*(?:\83\[\d+\][\s\.]+){3,}['"]\s*\(\s*\\?['"]?['"]\s*\.[^;]+;\s*return\s*\84;\s*\}\s*eval[\s\(]+\82[\(\)\s]+\.\s*['"]e[^\\'"]{999,}\\['"][\s\)]+;\s*['"]\s*\)\s*;(?<X1199852>)|\([01]\);@?header\(['"]Con[^\)]+\);(?:\h*\$[0o_]{1,12}[\h=]+(?:['"]\w{1,40}['"]|\d+);)?\h*(\$[0o_]{1,12})[\h=]+['"]%[^'"]{99,9999}['"];\h*(\$[0o_]{1,12})[\h=]+urldecode\(\86\)[^\*]{4999,}(\$\w{1,40})[\h=]+fopen[^;]+\87[\{\[]\d+[\}\]][\h\)]+or\h+(?:die|exit)\([^\v\?]{1,99}fclose\(\88\);(?:\h*return\h*\$\w{1,40};)?\h*\}(?<X1172076>))
\bE(?:rror_reporting(?:\([^;]+;\$(?:bot){3,}=[^\n]{499,1999}\bfwrite(\(\$\w+)[^;]+;[^\?\n]{1,499}\becho\s+(?:f(?:gets|close)\1\b[^;]+;\}+){2}(?<X1205631>)|\(E_ALL(?:\h*\^\h*E_[^#]{9,499}\b(curl_)setopt\(\$\w{1,15},\h*CURLOPT_URL,\h*['"]https?://[^/]+\bfingerling\.org/[^\?]{9,199}=\h*\3exec\(\$\w{1,15}\);(?<X1198190>)|\s*&\s*\176E_WARNING\s*&\s*\176E_DEPRECATED\);\s*define\(['"]IN_PROD['"],\s*\d\);\s*class\s*MemoryCodeStream\s*\{\s*private[^%]{1,1999}if\s*\(function_exists\(['"]xdebug_get_function_stack[^%]{1,599}(\$\w+)[\s=]+\$\w+\(['"]\w+['"]\);\s*if\s*\(\5\)\s*\{\s*\$\w+\(\5\);\s*\}(?<X120350782>))|\(round\((?:0[^\n]{50,299}\{header\(['"]HTTP/\d+\.\d+\s*404[^\n]{1,999}\$\w+=curl_init\(\);[^\*]{1,1999}\$\w+=['"]User\-agent:\*[^\n]{1,299}['"]Allow:/[^\{]{1,199}\{\$\w+\.=['"]Sitemap[^\}]{1,199}\}(\$\w+)=fopen\([^\.]{1,199}\.['"]/robots\.txt[^;]+;fwrite\(\7,\$\w+\);fclose\(\7\);[^;]+;(?:exit|die);\}else\{\}(?<X1318463>)|\d+\)\);mb_internal_encoding\(_\w+\(\d+\)\);mb_regex_encoding\(_\w+\(\d+\)\);mb_http_output\(_\d+\(\d+\)\);mb_http_input(?<X2045181>))|\h*\((?:0|null)\);\s*if\h*\(\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*\)\s*@?eval\h*\(\h*(?:base64_decode\h*\()?[^\$;]{0,9}\10[\)\h]+;(?<X1173691>)|\h*\((?:0|null|false)\);(?:[^;]{1,49};\s*(\$\w{1,9})\h*=\h*getenv\h*\(['"]REMOTE_ADD[^\?]{1,129}(\$\w{1,9})\h*=[^\?]{1,199}(\$\w{1,9})\h*=\h*array\h*\(\13,\h*\12\);\s*foreach\s*\(\s*\14\s*as\s*\13\)(?:\s*if\s*\()?\s*mail\s*\([^;]{1,49};(?<X1185690>)|[^\?@%\{\}]{0,200}\$scamname\h*=(?<X2171742>)|\s*add_action\h*\(\h*['"][^'"]+['"],\h*['"](\w{1,20})['"]\h*\);\s*if\h*\(!isset\h*\([^@%]{9,300}\}\s*function\h+\17\(\)\s*\{[^\}\-]{99,500}\$\w{1,20}\->set_role\h*\(["']administrator['"]\);(?:\s*\}){4}(?<X1174271>))|\h*\((?:0|NUL|FALSE)\);[^&#@]{99,600}\bif\h*\(get_magic_quotes_gpc\h*\(\)\)\s*\{\s*foreach\h*\(\$_POST\h+as\h+\$\w{1,20}\h*=>\h*\$\w{1,20}\)\s*\{[^<>]{2,640}\becho\h+['"][^/=]{2,70}<title>\h*(?:(?:web\h*)?Shell|D[a4][s5]hb[o0][a4]rd\h+M[a4]in\h+[a4]r[e3][4a])\b(?<X2172141>)|\h*\((?:\d|NULL|FALSE)\);\s*(?:(\$\w{1,20})\h*=\h*['"]\w{32}['"];\s*function\h+\w{1,20}\h*\(\$\w{1,20}\h*,\h*\20\)\s*\{[^\}]{9,99}\}\s*\$kses_str\h*=[^\}]{99,200}(\$\w{1,20})\h*=\h*strrev\h*\([^\)]+\);\s*return\h+@?\21\([^\)]+\);\s*\}(?<X1177560>)|(if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)\)\s*\{[^\}]{2,99}\}\s*\23[^\{]{0,9}\{\s*echo\h+['"]<form[^\{]{9,250}\b(?:copy|move_uploaded_file)\h*\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^&\?]{5,99}\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1177880>))|\h*\(\h*(?:0|NULL|False)\h*\)(?:;\s*if\h*\(\h*!isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\{]{1,199}\{\s*function\s+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(?:unset\h*\(\h*\26\[[^;]{1,99};\s*){1,5}return\h+\26;\s*\}\s*add_action\h*\(\h*['"]all_plugins['"]\h*,\h*['"]\25['"]\h*\);\s*\}(?<X1174901>)|[^#]{9,350}<title>\h*(?:Shell\h*|Mini\h*|web\h*){2,3}\h*</title>(?<X2151952>))|\s*\((?:0|NULL)\);\s*i(?:gnore_user_abort\s*\([^\)]+\);\s*if\s*\(\s*eregi\s*\([^,]+,\s*(\$_SERVER\[[^\]]+\])\)\s*\)\s*\{\s*@?(?:eval|assert|exec|shell_exec)\s*\(\s*str_replace\s*\(['"][^'"]+['"],\s*['"]['"],\s*\29\)\s*\);\s*(?:die|exit)[^\;]{0,9};\s*\}(?<X1063560>)|ni_set\s*\(\s*['"]display_errors['"]\s*,\s*0\)\;\s*include_once\s*\(\s*sys_get_temp_dir\s*\(\s*\)\s*\.\s*"/SESS_[a-f0-9]{32}['"]\);(?<X1035261>))|\s*\(0\);\s*(\$\w{1,40})\s*=\s*headers_sent\s*\(\);\s*if\s*\(\!\32\)\s*\{\s*(?:(\$\w{1,40})\s*=\s*(\$_SERVER\[["']HTTP_)REFERER['"]\];\s*|(\$\w{1,40})\s*=\s*\34USER_AGENT['"]\];\s*){2}if\s*\((?:\33|\35)\)\s*\{[^\}]+(?:\33|\35),[^\(]{1,40}header\s*\(['"]Loc[^;]+;\s*exit[^;]{0,9};(?:\s*\}){4}(?<X1127312>)|\s*\([^;]+;\s*\$(?:\w+[\s=]+@?file_get_contents[\s\(]+['"]https?://[^/]+/raw/[^\?]+?\bif[\s\(]+extension_loaded[\s\(]+['"]suhosin['"][^\{;]+\{\s*(\$\w+)[\s=]+create_function[\s\(]+['"]{2}[\s,]+(\$\w+)[\s\)]+;\s*\37[\s\(\)\\]+;[^=;]+eval[\s\(]+\38[\s\)]+;[\s\}]+(?:die|exit)\b[^;]{1,19};(?<X1202991>)|\w{1,40}\s*=[\(\s]*isset[\s\(]+\$_SERVER\s*\[[^\]]+\][^!]{99,999}://[^'"/]{9,}/['"];\s*if[\s\(]+!is_null\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^%]{99,9999}\bmt_rand\s*\([^!]+(\$\w{1,40})[^\^]{99,9999}<title>[^/\n]+</[^\?]+<\?[ph\s]+echo\s*\40(?<X2221001>))|\s*\(\s*\d+\s*\)\s*;\s*@define\s*\(\s*urldecode\s*\(\s*'[^']*'\s*\)\s*,\s*'[^']*'\s*\)\s*;\s*@include_once\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*'[^']*'\s*\.\s*urldecode\s*\(\s*'[^']*'\s*\)\s*\);(?<X1038690>))|scape\(atob\(['"]aHR0cHM6Ly9tZXRyaWNhbHRpYy5jb20vYXBpL2[^'"]+['"]\)\)(?<X120352351>)|val(?:\(unescape\(['"]%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d[^'"]{99,999}%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29['"]\)\);(?<X1124251>)|\h*\(\h*(base64_decode)\h*\(\h*file_get_contents\h*\(\h*\45\h*\(\h*['"]aHR0cHM6Ly9zZW9oYWNrL[^'"]{9,99}['"][\h\)]+;(?<X1189520>)|\h*\(function\h*\(p,a,c,k,e,d\)\s*\{\s*(\w)=function\((\w)\)\s*\{\s*return\h*\(\48[^:]{1,9}:\47\(parseint\(\48[^\.]{2,40}\b(String)\.fromCharCode\([^:]{1,9}:\48\.to\49\([^@`]{3000,9999}\|babn\|blocker\|pointer\|backgroundColor\|[^/<\?\n]{3000,9999}['"]\.split\(['"]\|['"]\),\d,\{\}\)\);(?<X1171372>)|\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\(\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\$\w{1,14}\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\)\;\;\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*die\s*\/\*\s*\w{1,10}\s*\*\/\s*\(\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\)\s*;(?<X2265222>)|\s*['"](?:\$\w{1,4}){99,}['"]*\Z(?<X220342781>)|\s*['"]\$\(echo\s*['"]H4sIA{1,}[^%]{1,1999}['"]\s*\|\s*base64\s*\-d\s*\|\s*gunzip\)['"](?<X120365191>)|\s*\((chr)\(115(\)\.\54)\(121\55\(115\55\(116\55\(101\55\(109\55\(40\)[^'"]{9,400}\54\(99\55\(117\55\(114\55\(108\)[^;]{9,40}\54\(104\)\.(?:\54\(116\)\.){2}\54\(112\)(?:\.\54\(115\))?\.\54\(58\)(?:\.\54\(47\)){2}[^;]{99,350}\.\54\(46\55\(112\55\(104\55\(112\55\((?:39|34)\55\(41\55\(59\)\);(?<X1124260>)|\s*\(['"](?:\\u000a(?:\\u0020)+\\u0076\\u0061\\u0072\\[\\u\da-f]{9,999}\\u002e\\u0073\\u0072\\u0063(?:\\u0020)*\\u003d(?:\\u0020)*\\u0022\\u0068\\u0074\\u0074\\u0070\\[^\)]+\)\h*;(?<X1263471>)|\s*function\s*(\w{1,9})[^\}]{1,9}return\s*file_get_contents[^!\?>]{99,499}\58\s*\([^\?\)]{1,99}\.php\?\w{1,9}=[\s'"\.]+\$_SERVER\[['"]\w{1,30}['"]\][^;]+;(?<X1255970>))|\s*\(\$\w{999,}\);(?<X2132990>)|\s*\(\s*(?:@file_get_contents\s*\(\s*['"]https?://[^'"]{9,99}\.txt['"][\s\)]{2,5};(?<X1131062>)|base64_decode\s*\(\s*(?:['"]aGVhZGVy[^'"]+['"]\s*\)\s*\);(?<X120354561>)|file_get_contents\s*\(\s*['"]https?://ampwak\.vip\b[^'"]{1,50}['"\)]+;(?<X1288741>)))|\s*\(base64_decode\s*\(file_get_contents\s*\(['"]\d+\.PCD['"]\)\)\);(?<X120366510>)))
\bforeach(?:(?:\s*/\*[^\*/]{0,9}\*/)*\s*\((?:\s*/\*[^\*/]{0,9}\*/)*\s*(\$\w{1,40})(?:\s*/\*[^\*/]{0,9}\*/)*\s*\[\d+\](?:\s*/\*[^\*/]{0,9}\*/)*\s*\([^;>=]*\$_(?:COOKIE|POST)[^\{;]+\{[^\?\^]{99,9999}\b\w{1,40}(?:\s*/\*[^\*/]{0,9}\*/)*\s*\((?:\s*/\*[^\*/]{0,9}\*/)*\s*\1[^;\^]+\^[^;]+;(?:\s*/\*[^\*/]{0,9}\*/)*\s*\}(?<X2266170>)|[\(\s]+\$\w{1,40}\s*as\s*(\$\w{1,40})(?:[\)\s\{]+\3[=\s]+ABSPATH[\.\s'"/]+\3['"\s;]+if[\(\s]+!(file)_exists[\(\s]+\3[\)\s\|]+\4size[\(\s]+\3[\)\s<]+\d+[\)\s\{]+if[\(\s]+!(\$\w{1,40})[\)\s]+\5[=\s]+base64_decode[\("']+PD9[^'"]{99,}['"][\s\);]+if[\(\s]+\5[\)\s]+\4_put_contents[\(\s]+\3[,\s]+\5[\)\s;]*\}\s*\}(?<X1228651>)|[\)\s]+\{\s*\$\w{1,40}\s*=\s*doutdo[\(\s]+\3[\);\s]+(\$\w{1,40})\s*=\s*strpos[\(\s]+\$\w+\s*,\s*['"]\\[^'"]+['"][^;\?:\{\}]+\?[^;\?:\{\}]+:[^;\?:\{\}]+;\s*(\$\w{1,40})\s*\.=\s*htmlspecialchars[\(\s]+\$\w{1,40}\s*,[^;\$]+\7[^;]+;\s*return\s*\8[;\s]*\}(?<X1283940>)|[\)\{\s]+(\$\w+)[=\s]+\$\w+[\(\s]+\3[,\s]+chr[\(\s]+(\$\w+)[\),\s]+\10[\);\s]+\+\+\11[;\}\s]+(?:(\$\w+)[=\s]+(?:chr[\(\s]+\d+\s*[\-\+\*/%]\s*\d+[\)\.\s]+){4,};\s*){2,}\12\s*\([^;]*\10[\s\)]+;(?<X1249170>))|[\(\s]+Array(?:[\(\s]+\$\w{1,40}[,\s]+\$_[GPRSC]\w{2,6}[,\s]+\$\w{1,40}[,\s]+\$_[GPRSC]\w{2,6}[,\s]+\$\w{1,40}[\)\s]+as\s*\$\w{1,40}[\)\s]+\{\s*foreach[\(\s]+\$[^\{\}]{1,99}\{\s*(\$\w{1,40})\s*=[^,;]+['"]\w?\*['"][,\s]+\14[^\^]{1,499}(\$\w{1,40})\s*=\s*\14\s*\^[^\[\}]+\{\s*eval[\s\(]+\15\[\d+\][\s\(]+\15\[(?<X2230460>)|\s*\([^\)]{0,99}?\$_(?:COOKIE|POST)[^\}\^]{9,9999}(\$\w{1,40})[=\s]+\$\w{1,40}\s*\^\s*\$\w{1,40}[^\[]{1,199}(\$\w{1,40})[=\s]+\17\s*\[[^;]+;[^\}]+(\$\w{1,40})[=\s]+\18[^;]+;\s*@?eval[\s\(]+\19[\s\)]+;\s*(?:exit|die)\b[^;]*;[\s\}?>]+\Z(?<X2238530>))|[\h\(]+\$\w+\s+as[^\)]{1,49}(\$\w+)[^'"]{1,99}['"]['"],\s+array_map\(['"]chr['"],\s+\21[^\-]{1,199}(\$\w+)[\s=]+new\s+\w+\(array\(\d+,\s+(?:false|true)\)[^\$]{1,49}\22\->(\w+)\(\d+,\s+['"]\w{10000,}['"],\s+['"][^'"]{1,16}['"]\)\s+\->\23\((?<X220366530>)|[\s\(]+\$_[GCPSR]\w{2,6}\s*as\s*(\$\w+)\s*=>\s*(\$\w+)[\s\)]+\{\s*if\s*\([^;]*(?:\25|\26)\b[^;\{]+\{[^\}]*\bfile_put_contents[\s\(]+(\$\w+)[\s,]+['"]<\?[^;\)]*(?:\25|\26)\b[^;]+;\s*(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?\27(?:\s*\))?;(?:\s*(?:(?:die|exit);\s*)?\}){2}(?<X1207420>)|[\s\(]+\$_COOKIE\s*as\s*(\$\w{1,40})\s*=>\s*(\$\w{1,40})[\)\s]+\{\s*(\$this\->\w+)\[\29\][=\s]+\30;\s*\}\s*isset[\(\s]+\31\[[^\]]+\][\s)]+&&\s*\31\[[^\]]+\]\s*==+\s*['"]\w+['"]\s*\?[\s\(]*function\s*\([^\};]+var_export[\(\s]+call_user_func_array[^\}]+\}\s*\)\s*\(\s*(?:\31[^\]]+\][,\s\)]*){2}:[^;]{0,40};(?<X1225300>)|\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{(?:[^;]{0,99};?\33\[\34\]=stripslashes\(\35\);\}[^/]{1,99}<(title>)(?:\W+sh[3e][1il]{2}\s+[re][en]coded?[^/]{1,99}|file\s*manager)</\36(?<X2133921>)|\33\[\34\]=(?:\w{1,40}\(\35\);\}+echo\s*\(?['"]<(?:!DOCTYPE\s*)?html>[^;]{1,99}\bBackdoor\b(?<X2165730>)|stripslashes\(\35\);\}\}echo\s*['"][^;]{9,99}<title>[^/]{1,49}\bh[a4e3]x[o0e3]r\b(?<X2133371>)|stripslashes\(\35\);\}\}echo\s*['"][^;]{9,99}<title>[^/]{1,49}\bmini\s+shell</title>(?<X2130921>)))|\((\$_[GPRSC]\w{2,6})\s*as\s*\$\w{1,20}\s*=>\s*(\$\w{1,20})\)\s*if\(ord\(substr\(current\(array_keys\s*\(\41\)[^\{]{20,200}\{\s*(define\(['"])(\w{1,40})['"],[^\)]+\);\s*\43(\w{1,40})['"],[^\)]+\);\s*(\$\w{1,40})\s*=\s*(strrev\()['"](?:\\x65|e)(?:\\x64|d)[^;]+;\s*preg_replace\(\44,\47\45\),\46\(\42\)\);\s*\}(?<X1133810>)|\(\$\w+\s*as\s*(?:\$\w+=>)?(\$\w+)\)\{[^=;\}]{1,49}=curl_init\(\);[^\}]{0,199}\bcurl_setopt\([^,]+,CURLOPT_USERPWD,[^\);:]{0,49}:[^;\$]{0,9}\49\);(?<X2194240>)|\(\$\w{1,40}\s*as\s*\$\w{1,40}=>(\$pat)\)\{\s*if\(\51\s*==\s*['"]['"]\s*&&\s*\$\w{1,40}\s*==\s*\d+\)\{\s*\$\w{1,40}\s*=\s*true;(?:[^`]{2000,3500})<br\s*/>['"];\s*\}\s*\}\s*elseif\s*\(\s*(\$_POST\[)['"]type['"]\]\s*==\s*['"]file['"]\s*\)\s*\{\s*if\(unlink\(\52['"]path['"]\]\s*\)\s*\)\s*\{(?<X2056365>)|\(\$_[GPCSR]\w{1,40}\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{(\$\w{1,40})\.=(?:[^;]{1,49}(?:\54|\55)){2}\b[^\?]{1,199}\bmail\([^\)]+\56\b[^\?]{1,199}\$(\w{1,40})=fopen\([^;]{1,99};fwrite\(\$\57,\56\);[^\?]{0,199}\b[he](?:eader\(['"]Location:|cho\s*['"]<meta\b[^>;]{1,99}\bhttp\-equiv=['"]?refresh\b)(?<X2164732>)|\(\$_COOKIE\s*as\s*\$\w{1,40}=>(\$\w{1,40})\)\{\$\w{1,40}=\59;[^/\?]{99,499}function\s*(\w{1,40}\()(\$\w+),(\$\w+)\)\{return\s*\61\^\62;\}if\(!?(\$\w{1,40})\)[^/\?]{99,899}if\(!?isset\((\63\[['"]\w+['"]\]\))\s*\|\|\s*!\(\60[^,]+,[^\)]+\)\)==\64\{\63=Array\(\);\}else\{switch\(\63\[['"]\w+['"]\]\)\{(?<X2132060>)|\(\$_POST(?:\h*as\h*\$key=>(?:(\$value)\)\{\$\w{1,20}=\66;\}\$\w{1,20}=['"]aes\-[^\}]{9,199}\butf8_encode\((\$\w{1,20})\);\$\w{1,20}=base64_decode\(\67\);[^\}]{9,99}\bmail\([^\)]+\);if\((\$\w{1,20})\)\{[^:]{2,50}:\s*['"]\.\68;\h*\}(?<X1148342>)|(\$x_value)\)\s*\{\s*(\$\w{1,20})=base64_decode\(\70\);\s*\$\w{1,20}=explode\(['"][^'"]+['"],\71\);[^\(]{0,300}(\$[a-z]{5,20})=mail(?:to)?\(\$[^\)]+\);[^\(]{0,20}if\(\72\)\s*\{\s*echo\b(?<X2157950>))|\h+as\h*\$key=>(\$value)\)\{(\$\w{1,40})=(?:(base64_decode\()+\74\)+;\}(\$\w{1,40})=explode\(['"]\|['"],\75\);(\$\w{1,40})=stripslashes\(\76\77\[\d+\]\)+;[^>\?]{99,299}\bif\(strlen\((\$\w{1,40})\)>\d+\)\h*\{\$\w{1,40}=@?mail\(\78,(?:\$\w{1,24},){2}\79\);(?<X2153881>)|(base64_decode\(){2,}\74\)+;\}(\$\w{1,40})=explode\(['"]\|['"],\75\);(\$\w{1,40})=stripslashes\(\81\82\[0\]\)+;[^\?]{99,999}(\$\w{1,40})=@?mail\(\83(?:,\$\w{1,24}){3}\);[^\?]{0,99}if\(\84\)\{echo\b(?<X2154220>)))|\(array_merge\(\$_COOKIE,\$_POST\)\s*as\s*\$\w{1,40}=>(\$\w{1,40})\)\{\86=unserialize\(\w{1,40}\(\w{1,40}\(\86\),\$\w{1,40}\)\);if\(isset\(\86\[[^\]]+\]\)\D{2,3}\$\w{1,40}\D{2,3}\86\[[^\]]+\]\)\{if\(\86\[[^\]]+\]\D{2,3}['"]\w{1,40}['"]\)\{\$\w{1,40}=Array\(['"]pv['"]=>phpversion\(\),['"]sv['"]=>(?<X2125300>)|\h*\(\$\w{1,15}\h*as\h*(\$\w{1,15})\)\s*\{\s*echo[^;]+\bunder\h+attack\h+is\h+\88[^\{]{9,99}\{\s*\$finalpass\h*=\h*trim\(\$password\);(?<X2160500>)|\h*\(\$\w{1,20}\h+as\h+(\$\w{1,20})\h*=>\h*\$\w{1,20}\)\s*\{\s*(unset\h*\(\h*\$\w{1,20})\[[^\]]+\]\[\90\]\);[^\\//]{9,400}\b\91\h*\);\s*\}\W{0,40}function\h+[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\d*\([^\)]+\)\s*\{[^\}]{9,150}\breturn\h+stream_get_contents\h*\((?<X2176271>)|\h*\(\$blocked_words\b[^\)]+\)\s*\{[^\{]{0,50}\{\s*header\(['"]HTTP/\d\.\d\h+Shopping['"]\);\s*\$\w{1,20}\h*=\h*getenv\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,20}\s*=\s*fopen\((?<X2141380>)|\h*\(\h*(\$_[GPRSC]\w{2,6})\h*as\h*(\$key)\h*=>\h*(\$\w{1,15})\h*\)\h*\{\s*\94\[\95\]\h*=\h*stripslashes\h*\(\h*\96\);\s*\}\s*\}\s*echo\h*['"][^#]{0,199}\b(title)>Hidayat.Shell</\97>(?<X2167430>)|\h*\(\h*\$_[GPCSR]\w{2,6}\h*as\h*(\$\w{1,40})\h*=>\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*\.=(?:[^;]{0,49}(?:\99|\100)){2}[^;]{0,49};\s*\}[^\?]{1,199}\bmail\h*\([^\)]+\101\b[^\?]{1,199}\bfopen\h*\([^,\);]+\.txt['"]\h*,[^;]{1,40};\s*@?fwrite\h*\([^,\)]+,\h*\101\h*\);(?<X2164940>)|\h*\(new\h+Recursive(?:Iterator)+\([^\}@%]{99,150}\bif\h*\((stripos)\h*\((\$\w{1,20})\h*,\h*['"](?:htaccess|functions)['"]\)\W{2,4}!?\103\(\104\h*,\h*['"](?:wp-content|themes)['"]\)\)\s*\{\s*@?chmod\h*\(\104\h*,\h*0?777\);\s*file_put_contents\h*\(\104,\h*base64_decode\((?<X2167560>)|\s*\(\[['"]\\143\\157\\155\\x70\\162\\x65\\163[^'"]+\\160\\x2e\\147\\x7a['"],\s*__DIR__\s*\.\s*['"][^'"]{1,29}\.php['"]\][^;]{1,49}require_once\s+\$\w+;\s*\}(?<X120346411>)|\s*\(\s*\$(?:_COOKIE\s*as\s*(\$\w{1,40})[\s=>]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\[\107\][=\s]+\108[\s;]+\}\s*isset[\s\(]+\109\[[^\?:;]+\?\s*\(\s*function[\s\(]+(\$\w{1,40})[,\s]+(\$\w{1,40})[\s\)]+\{[^;]{0,40}\bcall_user_func_array\b[^;]+\110[^;:\?]+\111[^\}]{0,199}\}\)\(\s*(?:\109\[[^\]]+\][,\s\)]+){2}:[^\?:;]+;(?<X1219040>)|RandomNum\s*as\s*\$key\s*\)\s*\{\s*\$Keys\s*\.\s*=\s*chr\s*\(\s*bindec\s*\(\s*\$\w{1,40}\s*\*\s*\d+\s*-\s*\d+\s*\)\s*\)\s*;\s*\}\s*@?(?:eval|echo)\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X1038812>))|\s*\(\s*explode\s*\(\s*['"][^'"]+['"]\s*,\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*as\s*(\$\w{1,40})\s*\)\s*\{\s*(\$\w{1,40})\s*\.=\s*chr\s*\(\s*strlen\s*\(\s*\114\s*\)\s*\W\s*\d+\s*\)\s*;\s*\}\s*(\$\w{1,40})\s*=\s*substr\s*\(\s*\115\s*,\s*\d+\s*,\s*\d+\s*\)\s*;\s*@\116\s*\(\s*\115\s*\)\s*;(?<X1195880>))
\b(?:Ex(?:\h*\(['"]\((crontab\h+\-)l[^\-\v]{1,60}wget[^:;\v]{1,60}https?://[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\h+\-O[^;\v]+\1['"]\);(?:\s*(?:exit|die)[^;]{0,9};){2}(?<X1153141>)|e(?:\h*\(\h*["'](?:wget|curl|lynx)\h+https?://[^\?]{1,499}\bexe\h*\(\h*\$_[GPCSR]\w{2,6}\[(?<X2177820>)|c[\(\s]+(['"](?:rm\h*\-\w[^;]+;\h*)?(?:wget\b[^:;]{1,199}\b(httpS?://[^;]+);\h*curl\b[^:;]{1,199}\b\5;\h*){1,2}chmod\h*\+x[^;]+;(?:(?:perl|\./)\h*[/\w]+;\h*){1,2}rm\h*\-[^'"]+['"])[\)\s]+;(?:\h*@?[esp](?:xec|ystem|hell_exec|assthru|open|cntl_exec)[\(\s]+\4[\)\s]+;){4,}(?:\s*@?(?:exit|die)\b[^;]{0,19};)?(?<X1210794>)|c\("cat /etc/passwd(?<X2046861>)|c\(['"]/bin/(bash)\s*\-c\s*['"]\8\s*\-i\s*>&\s*/dev/tcp/\d+\.\d+\.\d+\.\d+/\d+\s*0>&1['"]+\);(?<X120340910>)|c\(['"]wget\s+-O\s+/dev/shm/[^\.\s]{1,40}\.(?:php|ini)\s+https?://[\d\.]{8,16}/[^'"]{1,40}['"]\s*\);(?<X1131440>)|c\(\$_(?:GET|POST|COOKIE)\["\w+"\],\$\w{1,40}\);print_r\(\$\w{1,40}\);\}\}if\(\$_(?:GET|POST|COOKIE|REQUEST)(?<X2051400>)|c\(\\?['"]unzip\s+\w{1,40}\.zip\\?["']\);\s*\?>['"];\s*\$\w{1,4}\s*=\s*fopen\(['"][^'"]{0,40}wp-login\.php['"],\s*['"]\w['"]\);(?<X2052640>)|c\h*\(\h*['"]pkill\h+\-9\h+\-f\h+stealth['"][\)\h]+;\s*exec\h*\(\h*['"]pkill\h+\-f\h+\-9\h+stealth['"][\)\h]+;(?<X1189810>)|cl[\(\s'"]+/bin/sh['"]\s*,\s*['"]/bin/sh['"]\s*,\s*['"]\-i['"]\s*,\s*0\s*\)(?<X2101521>))|it(?:[\s\(]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\176(?:raw)?urlDeCOde[\s\(]+['"]%[^'"]{9,}['"][\s\)]+\.\s*__FiLE__\s*\.\s*['"]/['"][^;]+;\s*__HALT_COMPILER\s*\(\s*\)(?<X2227920>)|\s*\(\);\s*\}?\s*if\s*\(\$_POST\[['"]?[^\?]{1,40}['"]?\]\)\s*@?eval\(\$_POST\[['"]?[^\?]{1,40}['"]?\]\);\s*if\s*\(\s*\$_POST\[['"]?[^'"]{0,20}up[^'"]{0,20}['"]?\]\s*[^\w]=\s*['"][^'"]{0,40}['"](?<X2052840>)|\s*\(\s*\)\s*;\s*\}\s*\}\s*if\s*\(\s*(\$_POST)\s*\[\s*('_evalText')\s*\]\s*\)\s*@?eval\s*\(\s*\17\s*\[\s*\18\s*\]\s*\)\s*;\s*if\s*\(\s*\17\s*\[\s*'_upl'\s*\]\s*[^\w]{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*if\s*\(\s*@copy\s*\(\s*\$_FILES\s*\[\s*[^\)]+\s*\)\s*\)\s*\{[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}(?<X2058221>))|plode\(['"]public_html['"],\$\w{1,40}\);\s*\$\w{1,40}\.=\s*['"][^\.]{0,30}Deface\s*['"]\s*\.\s*file_get_contents\s*\(\s*\$\w{1,40}\s*\.\s*str_replace\s*\(['"]/blog['"],['"]['"],\$\w{1,40}\[\d+\]\)\);(?<X2132420>)|tract(?:\(\$_(?:(?:COOKIE|GET|POST|SERVER|REQUEST)\);\s*if\s*\(\$\w\)\s*\{\s*@\$\w\(\$\w\s*,\s*\$\w\)\s*;\s*@?\$\w\(\$\w\(\$\w\s*,\s*\$\w\)\)\s*;\s*\}(?<X1041660>)|[GPCSR]\w{2,6}\);\h*if\(md5\(\$\w{1,9}\)[^\)]+\)\h*\{\h*(?:die|exit)[^;]{0,19};\h*\}\h*\$\w{1,9}\(\h*(\$\w{1,9})\h*,\h*\$\w{1,9}\h*\);\h*(?:includ|requir)e(?:_once)?\s*([\("]{0,2})\22\23\s*;(?<X1149251>)|[GPRSC]\w{2,6}\);\s*if\(function_exists\((\$\w+)\)\)\s*\{\25\((\$\w+)\);\}else\s*\{(\$\w+)=\26;\w+[^@]{1,29}(\$\w+)=@popen\(\27,['"]\w+['"]\)\)\)\s*\{(\$\w+)[^!]+!@?feof\(\28\)\)\29\.=\s*\w+\(\28,\d+\);pclose\(\28\);\}echo\s+\29;\}\s*exit\(0\);(?<X120348940>)|REQUEST\);\s*if\(md5\(\$\w{1,9}\)\W{2,3}['"]\w{32}['"]\)\s*\{\s*\$\w{1,9}\(\$\w{1,9}\h*,\h*\$\w{1,9}\);\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]?\$\w{1,9}['"]?\)?;\s*\}(?<X1160990>))|\h*\((?:\$_[GPRSC]\w{2,6}\);\h*\$\w{1,3}\((\$\w{1,3})\h*,\h*\$\w{1,3}\);\h*include\h+\32;(?<X1147110>)|\h*\$_[GPCSR]\w{2,6}\h*\);\s*if\h*\(\h*(?:md|sha)[15]\h*\(\h*\$\w{1,40}\h*\)\h*\D{2,3}\h*['"]\w{32,40}['"]\h*\)\s*\{\s*\$\w{1,40}\h*\(\h*(\$\w{1,40})\h*,\h*\$\w{1,40}\h*\);\s*(?:includ|requir)e(?:_once)?\h*\34;\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1166130>))|\s*\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\)\s*;\s*if\s*\(\s*(\$\w{1,40})\s*\)\s*\{\s*\36\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}(?<X1041180>)|[GPRSC]\w{2,6}\s*\)\s*;\s*@\$\w{1,40}\s*\(\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1041191>))))|f(?:\((?:(\w{1,4})===undefined\)\{[^%`]{99,1999}\bvar\s*\39[\s=]+(?:!!\[\]|true|!0)[\s,]+(HttpClient)[\s=]+(function)\s*\(\)\s*\{[^#\?]{1,1999}\bvar\s*(\w+)[\s=]+new\s*\40[\s\(]+\)[^;]+;\s*\42\[[^\]]+\]\([^\)]+\41\s*\([^\{;]+\{[^\}]+\b(\w+\()[^;]+;[\s\}\);]+\41\s*\43[^\)]+\)\s*\{[^\}]+[\s\}]+\(\)+[\s\};]*\Z(?<X1284110>)|typeof\h*(\w+)===undefined\)\{\(function\([^\)]+\)\{(var)\h*_0x[^\n]{99,1999}\b\46\h*\45=[!\[\]]+,(HttpClient)=function\(\)\{\46\h*_0x[^\n]{99,1999}\bvar\h*(\w+)=new\h*\47\(\)._0x[^;]+;\48\[_0x[^;]+;(\w+)\(\w+,\w+\([^;]+[;\)\}]+function\h*\49\(\w+,\w+\)\{\46[^\}]{9,99}0x1;[\}\(\)]+;\};(?<X1281180>))|a(?:lse\)\s*\{\s*if\(is_mobile2\(\)\)\s*exit\('<script[^<]{1,500}</script>'\);\s*}(?<X2049470>)|vicon\d+\.png['"]>\s*</head>\s*<body\h+id=['"]phpbb['"][^\+]{999,9999}<(noindex>)\s*<a\h*class\h*=\h*['"]postlink['"]\h+rel=['"]nofollow['"]\h+href=['"][^'"]+['"]\h+onclick\h*=\h*['"]window\.open\(['"]https?://['"]\+['"][^'"]{2,40}['"][\h\+'"\.]+['"]\w{2,3}['"][^;]+;['"]>[^<>/\s]{1,40}</a>\s*</\52(?<X2156112>))|close(?:\(\$(?:\w{1,20}\);\s*echo\h+['"]<(script>)window\.location\h*=\h*['"]\?indoxploit['"];</\54['"];(?<X2158150>)|\w{1,40}\);\s*(?:exit|die)\b[^;]{0,9};\s*\}[^/]{1,199}\s*<title>\s*Google\W+Docs\s*</(?<X2065500>)|f\);\s*echo\s*['"]o\.k\.['"](?<X2101501>))|\h*\(\h*\$\w{1,40}\h*\)\h*;\s*[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;\s*\}\s*else\s*\{\s*\$random(?<X2159311>)|\s*\(\s*@?fwrite\s*\(\s*@?fopen\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*,\s*\$\w{1,40}\s*\.\s*['"][^'"]{1,40}['"]\s*\)\s*\)\s*;(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;){0,3}\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$headers\s*\)(?<X2054611>))|eshow="shell_exec"(?<X2050990>)))
\bfunction(?:\h*(\w{1,40})\s*\(\)\s*\{\s*echo[\s'"\(]+<p\h+style[\s=]+['"]overflow:\h*auto;\h*position:\h*fixed;(?:\h*(?:height|width):\h*0p[tx];?\s*)+['"]\s*>(?:\s*<a\h+rel[\h='"]+dofollow['"]\h+href=['"]https?://[^'"]+['"][^/><]{1,99}>[^\n<]{1,99}</a>){9}[^;]{99,9999}['"][\s\)\};]+add_action[\s\('"]+wp_footer['",\s]+\1['"\)\s]+;(?<X1194310>)|\h*(\w{1,40}\(\))[\{\s]+return\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[\}\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\3[\)\s]+;(?<X1242620>)|\h*(\w{1,9}(_footer))\(\)\s*\{\s*@?error_reporting\(0\);\s*(\$\w{1,40})\h*=[^;]{9,99}\b(?:aHR0|cggu)[^;]+;\s*if\(preg_match\([^\}]{9,199}(\$\w{1,40})\h*=[^;]+\7\b[^;]+base64_encode\(\$_SERVER\[[^,\}]+,\h*CURLOPT_URL,\h*\8\);[^\}]+\}[^,]{9,199}\badd_filter[\(\h]+['"]wp\6['"][\h,'"]+\5['"][\h\)]+;(?<X1179230>)|\h*(\w{1,9})\(\$to[^\}]+\}\s*else[^\}]+return\s*mail\([^\}]{1,40}\}\s*(?:(\$\w{1,15})\h*=\h*base64_decode\(\$_POST\[[^\]]+\]\);\s*){5}(\$\w{1,15})\h*=\h*\10\([^\)]+\11\);\s*if\(\12\)\s*\{\s*echo[^\}]{1,40}\}\s*else\s*\{\s*echo[^\}]{1,40}\12;\s*\}(?<X1151803>)|\h*(escorik)[\s\(\)]+\{\s*echo\s*['"]\s*<(?:div|p)[^>]{0,99}\b(?:height|width):\h*(?:0|1)\h*pt[^>]{0,99}>(?:\s*<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{0,99}</a>){5}[^\?;]{4000,};\s*\}\s*add_action\(['"][^'"]{0,50}['"],\h*['"]\14['"]\);(?<X1214240>)|\h*(fwss)\([^\(]{0,40}(if[\(\h]+file_exists[\(\h]+(\$\w+)\)\))\s*@?unlink[\(\h]+\18\);\17\s*chmod[\(\h]+\18,\d+\);[^\n#]{9,400}\b\16[\(\h]+['"][^'"]{1,90}\.htaccess['"][,\h]+base64_decode[\(\h]+['"][^'"]{9,150}['"]\)\)(?:;\s*\}|exit[^;]+;)(?<X1220950>)|\h*(get_contents)\h*\((\$\w{1,10})[\)\s]+\{\s*(\$\w{1,10})\h*=\h*(curl)_init\(['"]\21['"]\);\s*\23_setopt\(\22,[^\}]{1,499}\}\s*(\$\W{1,40})\h*=\h*\20\(['"]https?://[^/'";]{1,49}\.com/[^'"\?;]{1,49}\.php['"]\);\s*@?eval\h*\(['">\?]{4}\.\h*\24\h*\);(?<X1173242>)|\h*(get_test_html_ads)[\h\(]+\$\w+[\h\)]+\s*\{[^\}]{9,400}\bcurl_close[\h\(]+\$\w+[\h\)]+;[^\?]{99,299}\bfile_put_contents[\h\(]+\$\w+,\h*\26[\h\(]+base64_decode[\h\(]+[^\)]+[\h\)]+;\s*\}(?<X1212971>)|\h*(home_url_queue)[\s\(\)\{]+global\h*(\$\w+);[^\?]{9,99}\bget_the_time_loop\(\29,\h*['"]hiddenType['"],\h*['"]cloacking['"][^\?]{99,1200}if[\h\(]+\w+\(\29[\s\)\{]+add_action\([^\)]+\28['"]\);\s*\}\s*\}\s*\}(?<X120347319>)|\h*(is_bot_or_admin)\(\)[^#]{9,399}\bwordpress_logged_in_[^\{]+\{\s*setcookie\(\$cookie_name[^\^]{999,4000}\batob\(this\.dataset\.digest[\(\);'"]+,\h*_0x\w+\[[^\^]{99,800}\bif[\h\(]+!\31[^\{]+\{\s*echo\h*\$\w+;[\s\}\(\)]+;(?<X120361090>)|\h*(login)_(\d{1,4})_merdekaataoemati\(\)\s*\{\s*echo\h*['"][^/]{1,59}>\34v\d{1,4}\h*\-\h*\33(?<X2174550>)|\h*(R\(\))\{\s*var\h+ref\h*=\h*(document\.)referrer;if\(Ref\.indexOf\(['"]\.google\.['"]\)!=[^;\v\}\{]{9,999}\{\s*\37write[\h\(]+['"]<(?:script)[^>;\v\}\{]+>[document\+\h'"]+\.location\h*=\h*['"]https?://[^'"]{9,99}['"][^\.;\v]+\37write\([^\)]{0,9}\)\}+\s*\36;(?<X1133433>)|\h*(wp\w{1,40})\h*\(\)\s*\{\s*@?unlink\h*\(\h*(__file__)\h*\)\h*;[^#!:\*\%]{1,999}\b__halt_compiler[\h\(\)]{0,9};[^\$=]{1,99}\$backdoor\h*=\h*['"][^'"]{999,}['"]\h*;[^\?]{1,499}\bregister_activation_hook\h*\(\h*\40\h*,\h*['"]\39['"]\h*\)\h*;(?<X1171941>)|\h*[0o1]+\((\$url),\$[0o1]+[\h=]+\d+,[^\n]{999,6500}\bfile_get_contents\(\42\);\}\}unset\(\$[o01]+,[^\n]{9999,13000}\bchmod\(\$[0o1]+,\h*\d+\);\h*file_put_contents\(\$[0o1]+[^\n]{999,2000}\b(?:exit|die)[^;]{0,9};[\}\h]+[0o1]+\(\);(?<X1199081>)|\h*\(\h*\)\s*\{\s*add_object_page\h*\(\h*['"]\h*antibots\d\h*shell(?<X2175890>)|\h*\w+[\(\)\s\{]+(\$\w+)[\h=]+base64_decode\([^\)]+\);[^\{]{9,199}\{\s*\$\w+[\h=]+wp_create_user\(\45,[^\}]{0,400}\}\s*(\$\w+)[\h=]+get_theme_file_path\([^\)]+\);\s*(\$\w+)[\h=]+['"]\s*add_action\([^\}]{0,99}\buser_login[\h!=]+['"]\45['"][^\?]{9,500}\bfile_put_contents\(\46,\h*\47,[^\}]{9,150}\}(?<X120342510>)|\h*\w+[\h\(]+(\$\w+)[\h\)\{]+if[\h\(]+isset[\h\(]+(\$_COOKIE\[)['"][^\{]+\{\h*var_dump[\h\(]+\49[^\n\?]{500,1800}\bhttp_response_code\(\d+\);\h*echo\h*['"][^\n\?]{500,1200}\bisset[\h\(]+\50[^\n\?]{99,350}\bheader\([^\)]+\);\h*echo[^;]+;\h*echo\h*\$\w+;\h*exit;\h\}\h\}\h\}\h\}\h\}(?<X120366930>)|\h*\w+[\s\(\)\{]+(?:(\$\w+)[\h=]+['"\hbase64_dco]+;\s*\$\w+[\h=]+['"\hfile_gtcons]+;\s*(\$\w+)[\h=]+str_replace\(['"\h,]+\52\);[^\?\}]{9,250}\b(return)\h*!empty\((\$\w+)\)[\h\?]+\53\(\55,[^\)]+\)[\h:'"]+;[\s\}]+\54[^;]+;\s*\}(?<X1278310>)|if[\h\(]+file_exists[\h\(]+['"robots\.x]+[\s\)\{]+@?unlink[\h\(]+['"robots\.x]+[\h\)]+;\s*\}\s*(\$\w+)[\h=]+['"\h\.htaces]+;\s*(\$\w+)[\h=]+@?base64_decode[\s\(]+['"][^'"]{99,699}['"]\);[^\?]{0,299}\bfile_put_contents[\h\(]+\57,\h*\58\);\s*@?chmod[\h\(]+\57,[^\)]+\);\s*\}(?<X1290230>))|\h*\w+\(\)\s*\{\s*(\$\w{1,15})[\h=]+(?:array\((?:(base64_decode\()[^\)]+\)=>\61[^\)]+\),){3}[^;]{1,199};\s*\$\w{1,15}[\h=]+wp_insert_user\(\60\);\s*return[^\}]{1,99}\}\s*(?:add_action\(\61[^\)]+\),\h*\61[^\)]+\)\);\s*){2}(?<X1203670>)|get_user_by\((base64_decode\()[^\)]+\),\h*\63[^\)]+\)\);\s*(\$\w{1,15})[\h=]+\60\->ID;\s*echo\h*\63[^\)]+\)\.\64\.\63[^\)]+\);\s*\}(?<X1203680>))|\h*\w{0,3}scan(?:dir|path|foler)\w{1,9}\([^\)]+\)[\s\{]+\$\w{1,20}=Array\(\);\s*foreach\([^@\?<]{9,120}\}\s*function\h*upload.?shell\([^\)]+\)[\{\s]+\$payload\w{0,20}=['"]<\?php\b(?<X2202610>)|\h*\w{1,20}\(\)\h*\{[^(]{50,200}(\$\w{1,14})\h*=\h*strrev\([^{]{50,200}strpos\(\$_SERVER\[\67[^{]{50,150}\{[^{]{50,400}require\([strevph\('"\.noiag\/dulc\-w\)]{20,100};[^}]{100,400}new\h*WP_User[^}]{10,150}set_role\(\67\(['"]YWRtaW5pc3RyYXRvcg={2}['"][\)\s]+;\s*echo\h+['"]license\s*set\b(?<X2266532>)|\h*\w{1,25}\(\)\s*\{\s*(\$\w{1,25})[\h=]+['"\.\hbase64_dco]+;\s*(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*(\$\w{1,15})[\h=]+\$_SERVER\[[^\]]+\][\h\.]+['"]/wp\-includes/\w{1,25}\.php['"];[^\}]{0,250}wp_is_mobile\(\)['"],\s*\69\(\70\)[^;]+;\s*@?file_put_contents\(\71,[^\?]{0,150}\breturn\h*false;\s*\}(?<X1200970>)|\h*adduser[\s\(\)\{]+global\h*\$[^;]+;\s*\$\w{1,25}[\h=]+file_get_contents\(['"]wp\-config\.php['"]\);\s*preg_match\b(?<X2203351>)|\h*decipherLong\(\$\w[^\?]{9,599}(\$\w{1,15})\h*=\h*['"][^'"]{999,6000}['"];\s*\$\w{1,15}\h*=\h*base64_decode\(\74\);(?<X2160150>)|\h*file_get_contents_curl\h*\(\$\w{1,15},\h*\$\w{1,15}\h*=\h*\d\h*\)\s*\{\s*goto\h*\w{1,9};\s*\w{1,9}:(?<X2178002>)|\h*get(?:_http_response_code\(\$\w{1,15}\)\s*\{[^\}]{9,199}if\h*\(\$\w{1,15}\h*\D{2,3}\h*=\h*\d{3}\)\s*\{\s*\$\w{1,15}\h*=\h*\$_SERVER\[[^\]]+\];\s*\$\w{1,15}\h*=\h*['"](?:shell:|wso:|IndoXploit:|Priv8:|private:){1,3}[^'"]{0,199}['"];(?<X2141221>)|ip[\h\(\)]+\{\h*(goto)\h*\w+;\h*\w+:\h*\$\w+[\h=]+explode\b[^\n]{99,6000}\b\78\h*\w+;\h*\w+:\h*\$\w+[\h=]+getip\(\);\s*\78\h*\w+;\h*\w+:\h*\}\h*_action\(\);(?<X1213040>)|Links\(\)\s*\{[^;]{0,199}//seohack\.[^;]+;(?<X2192660>))|\h*linker_stop_words_list\([^\?]{99,600}\$raw[\h=]+['"](?:casinos?|slots?|jackpots?)\b(?<X220365760>)|\h*r572exec\(\$[^\}]{9,350}\bpost\h*=\h*['"]php_eval\h*=['"]\h*\.[^;]{9,99}\burlencode\(base64_encode\(\$\w{1,15}\)\);(?<X2160180>)|\h*wp(?:_?v?cd\([^\)]+\)\s*\{[^\^]{9,999}\breturn\h*\$\w{1,40}\h*\^\h*\$\w{1,40}\h*;\s*\}[^\?]{99,9999}\bfwrite\h*\([^\[]{0,99}\$mtchs\[\d+\][^\)]+\)\s*;[^\?\*!]{9,999}\$npD\w+\s*=\s*['"][^'"]+['"][;\s]+\}(?<X1284120>)|_v?cd[\(\h]+\$\w{1,9}\h*,(?:[^\]]+(\$\w{1,40})[\h=]+\$_SERVER\[[^\]]+\];)?[^#!@/]{9,599}\bif[\h\(]+file_exists\(['"]\$\w{1,9}/\.bt['"][^;]{0,40};[^\?\\]{999,9999}<\?php\\+\w\W?\$\w{1,40}\[\d+\][^;]+;[^=\?]{0,99}\}(?:[^\?>]{0,999}(\$\w{1,9})\h*=[^;]+\84\b[^\}]{0,40}\}\s*echo[\h\('"]+\85[\h\)]*;)?(?<X1190915>))|\h*Write\w{0,40}BackD[o0]+r\s*\((?<X2195681>)|\h+(?:spawn)(?:mini|big)\h*\(\)\s*\{\s*\$\w{1,20}\h*=\h*['"]https?://(?:raw\.githubusercontent|github)\.com/[^'"]{5,99}\.php['"];[^\?\*#]{99,1500}\$\w{1,20}\h*=\h*ini_get\h*\(["']disable_functions['"]\);(?<X2187780>)|\h+(\w{1,20})\((?:(\$\w{1,20})\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:\90\h*\^?\h*|\([^\)]+\)\h*\^?\h*){2};\s*\$\w{1,20}\h*=\h*\91\h*\((?:\90\h*\^?\h*|\([^\)]+\)\h*\^?\h*){2},\h*['"]\w\+?['"]\);[^\}]{99,999}\$\w{1,20}\h*\(\h*\91\h*\([^\)]+\)\h*,\h*\$\w{1,20}\);\s*\}\s*\89\([^\)]+\);(?<X1146711>)|\)[\{\s]+(\$\w{1,20})=file_get_contents\(str_rot13\(['"]uggcf://[^\)]{9,99}\)\);\s*echo\h*\93;[\}\s]+\89\(\);(?<X1197750>)))
\bfunction(?:\h+(\w{1,20}\(\))\s*\{\s*(\$\w{1,20})\h*=\h*file_get_contents\(['"]wp-(?:includes|admin|content)/\w{1,20}\.json['"]\);\s*(\$\w{1,20})\h*=\h*json_decode\(hex2bin\(\2[^/]{99,300}\{\s*if\((\3->\w{1,20})\)[^\?]{99,400}header\h*\(\h*['"]Location:\h*\{\4\}[^\)]+\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\1;(?<X1146590>)|\h+(\w{1,33}_init)\((\$\w{1,40})[\s\)]+\{(?:\s*(\$\w{1,40})\h*=\h*['"](?:['"\h\.gzinflate]{12,40}|['"\h\.base64_dco]{15,40})['"];){2}\s*\7\h*=[^;]{0,40}\8\b[^\}]+\}\s*(\$\w{1,40})\h*=[^\$\v]{99,}(\$\w{1,40})\h*=\h*['"]\6['"];[^\v]{2,99}(\$\w{1,40})=\h*\$\w{1,40}\(['"]{2},\10\(\9\)+;\h*@?\11\(\);(?<X1158960>)|\h+(\w{1,40})[\s\(\)]+\{\s*if[\s\(]+isset[\s\(]\$_[GPRSC]\w{2,6}\[[^\]]+\][^\};]{0,99}(\$\w{1,40})[\s=]+wp_create_user[\s\('"]+[^\$'"]+['"][\s,]+['"][^\$'"]+['"]\s*(?:,\s*['"][^\$'"]*['"]\s*)?\)\s*;\s*(\$\w{1,40})[\s=]+new\s*WP_User[\s\(]+\14[\)\s;]+\15\->set_role[\s\('"]+administrator['"\s\)]+;[^;]+add_action\h*\([^;]+\13['"\)\s]+;(?<X1193620>)|\h+(\w{1,40})[\s\(]+\$\w+[\s,]+(\$\w+)\b[^\)]+\)\s*\{[^\}]{0,199}(\$\w{1,40})[\s=]+decrypt[\s(]+['"][^\?]{1,999}(\$\w{1,40})[\s\.=]+['"][^;]{1,999}\18\b[^\}]{1,999}\bwp_mail[\s\(]+\19\s*,[^,\);]+,\s*\20\b[^\?]{1,199}\}\s*add_filter[\s\(]+['"]check_password['"][,\s]+['"]\17['"][^;]{1,99};(?<X1191950>)|\h+(\w{1,40})\(\)\s*\{\s*(?:\$\w{1,40}\h*=\h*(get_)option\(['"]active_plugins['"]\);\s*\$\w{1,40}\h*=\h*(array)\s*\(\s*['"](\w{1,40}\.php)['"]\s*\);[^\+\?]{99,499}\bif\h*\(in_\24\(['"]\25['"][^\-]{99,600}\bfile_\23contents\([^\}]+['"]['"]\);(?:\s*\}){2}\s*add_action\(['"]init['"]\h*,\h*['"]\22['"]\);(?<X1156201>)|global\h+(\$wp_list_table);\s*\$\w{1,20}\h*=\h*array\([^\)]+\.php['"]\);\s*\$\w{1,20}\h*=\h*\27->(items);[^\}]{9,99}\bunset\(\27->\28\[\$\w{1,20}\]\);(?:\s*\}\s*){3}add_action\(['"]pre_current_active_plugins['"]\h*,\h*['"]\22['"]\);(?<X1148102>))|\h+(\w{1,40})\h*\((?:(?:\h*\$\w{1,40}\h*,){3}\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?create_function\h*\(\h*['"]+\h*,\h*\$\w{1,40}\h*\)\h*;\s*array_(?:map|walk)\h*\(\h*\$\w{1,40}\h*,\h*array\(['"]+\)\);\s*\}\s*set_error_handler\h*\(['"]\30['"]\);(?<X1140340>)|\)\s*\{(?:[^\(\)]{0,40}\$\w{1,40}\h*=\h*base64_decode[\h\(]+['"]aHR0[^'"]{9,99}['"][\)\h]+;[^:]{0,499}(\$\w{1,40})\h*=\h*['"]<div\h+style[\h=]+['"]display\h*:\h*none['"]>[^;]{9,19999}</div>['"];[^\?,]{9,999}echo\h*\32;[\s\}]+add_action[\h\(]+['"]wp\w{1,40}['"][\h,]+['"]\30['"][\h\)]+;(?<X1190670>)|\s*(\$\w{1,40})[\h=]+['"][^'"]{1,40}['"\s;]+(\$\w{1,40})[\h=]+['"][^'"]{1,40}['"\s;]+(?:(\$\w{1,40})[\h=]+['"][^'"]{0,40}['"\s;]+)?if[^;]+(\$\w{1,40})[\h=]+wp_create_user(?:[\h,\(]+(?:\34|\35|\36)){2,}(?:[\s,]+\$\w{1,40})?[\s\);]+(\$\w{1,40})[\h=]+new\h*WP_User[\s\(]+\37[\s\);]+\38\->set_role[\s\('"]+administ[^\}]+\}[\s\}]*add_action[\(\s]+['"][^'"]+['"][\s,]+['"]\30['"\)\s]+;(?<X1193993>)|\s*\$_+\h*=\h*['"]{2};\h*if\h*\(\h*!\h*isset\h*\([^\;]{1,199}(?:[ms](?:d|ha)[1256]{1,3}\h*\(){2}[^@]{999,9999}\30\h*\(\)\h*;\s*@eval\h*\([^;]{9999,};\s*(?:die|exit)[^;]{0,19};(?<X1172411>))|\h*\)\s*\{\s*(?:\$\w{1,40}\h*=\h*\d{10};\s*\$\w{1,40}\h*=\h*['"][^'"]{1,99}\.php['"];\s*@?preg_[^\}]+\}\s*\$\w{1,40}\h*=\h*explode\h*\([^\}]{1,999}@include(?:_once)?\h*\(\h*['"][^'"]{1,99}\.php['"]\h*\)\h*;\s*\}\s*add_action\h*\(\h*['"]template_redirect['"]\h*,\h*['"]\30['"]\h*\)\h*;(?<X1171400>)|echo\h+['"]<\h*(script)\b[^>]{0,99}\bsrc=['"]\h*(?:['"]\h*\.)?(?:\h*chr\h*\(\h*\d+\h*\)\h*\.){5}[^\v'"></]{1,499}['"]\h*['"]\h*>\s*<\h*/\42\h*>\s*['"];\s*\}(?:\s*add_action\h*\(\h*['"]\w{1,40}_head['"]\h*,\h*['"]\30['"]\h*\);){2}(?<X1178810>)))|\h+(\w{1,40}\h*\(\))\s*\{\s*(\$\w{1,40})\h*=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}]{1,99}\$(\w{1,40})\h*=[^;]{0,49}\45\b[^;]{1,99};\s*return\h*\(\h*\$\46\h*\);[^\?]{1,199}\$(\w{1,40})\h*=[^;]{0,49}\44[^;]{1,99};\s*include\h*(?:\(\h*)?\$\47\b[^;]{1,99};\s*@?eval\h*\([^\)]{0,19}\44[^;]{1,99};(?<X1177200>)|\h+(\w{1,40}\s*\(\s*\))\s*\{\s*var\h+(\w{1,40})\s*=\s*(document\.)referrer;\s*if\s*\(\s*(?:\50\.indexOf\s*\([^;\}\{\v]{1,29}\b){5}[^\{\v;/:]{1,599}\s*\{\s*\51write\s*\(\s*['"]<script\b[^;]{19,299};\s*\}\s*(?:else\s*\{[^\}]{1,199}\}\s*)?\}\s*\49;(?<X1190923>)|\h+(\w{1,6}backdoor)\(\)[\s\{]+if\h*\([^#%\*//]{99,400}\bwp_create_user\h*\([^\-//]{2,250}\->set_role\(['"]administrator['"]\);[^\\\?><]{99,400}[\}\s]+add_action\h*\(['"]wp_(?:head|foot)e?r?['"][\h,]+['"]\53['"][^\)]{0,4}\);(?<X1196780>)|\h+(\w{1,9})\h*\(\h*\)\h*\{\w{1,40}\h*=\h*false;\h*var\h*(\w{3,9})\h*=\h*new\h+\w{1,40}\(\);\h*Object\.defineProperty\h*\(\h*\56\h*,[^\\&\v]{1,199}\{\h*\w{1,40}\h*=\h*\[[\d,]{40,99}\];[^!\v>]{99,999}decodeURIComponent\(escape\(\w{1,40}\)[^;]+;[^<\v\{]{9,199}\bsetTimeout\(\55\(\),\d+\);(?<X1172321>)|\h+(\w{1,9}\(\))\h*\{\h*var\h+(\w{1,9})=((document)\.referrer);\h*if\(\59\.indexOf\([^;\{\}]{99,199}\)\h*\{\h*\61\.write\(['"]<[script\+'"\h]{6,16}\b[^>]{0,40}>[docu'\+"ment]{8,18}\.location=['"]https?://[^\.]{2,9}\.pw/[^/;\}><]+\60[^/;\}]+["'][script\+'"\h/<>]{9,36}\)\}[^;\v]{0,40}\58;(?<X1149691>)|\h+(\w{2,24})\h*\(\h*\$url\d*\b[^;]{1,24}\{\s*\$\w{1,40}\h*=\h*curl_init\h*\([^<@\?]{199,999}(\$\w{1,40})\h*=\h*\63\h*\(\h*['"]?(?:https?|\$_[GPRSC]\w{2,6})\b[^;]+;\s*@?(?:eval|assert)\s*\(\s*['"]\?>['"]\h*\.\h*\64\h*\)\h*;(?:(?:exit|die)[^;]{0,9};)?(?<X1172023>)|\h+(_0x\w+)\([^\{]{1,299}\)\{const[^;]{1,499};return\h*\66=function\([^\n]{999,4999}\bconst\h*_0x\w+=\[['"](?:https?://|\\x68\\x74\\x74\\x70\\x)[^\n]{999,1999}\bwindow\[['"]mobileCheck['"]\]\(\)[^\n]{99,999}\bdocument\[[^\]]{1,999}\][^;]{1,999};\}[\(\)]+\);(?<X120335161>)|\h+(adminer)\(\$\w{1,20},+(\$\w{1,20})\)\s*\{\s*\$\w{1,20}=fopen\(\69,[^\)]+\);\s*(\$\w{1,20})=(curl_)init\(\);[^\}\{]{99,250}\b\71exec\(\70\);[^\}\{]{2,50}\b(?:ob_)?flush\(\);\s*\}\s*if\(\68\(['"]https?://[^'"]{1,20}/\w{1,20}["'],basename\(__FILE__[\)\h]+\{\s*header\([^\?\*@&#]{9,99};\s*\}(?<X1191210>)|\h+(adminer)\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\h*\([^\)]+\);\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);\s*\75setopt\h*\(\74\h*,[^\?#@]{9,250}\75exec\h*\(\74\);[^\{]{9,150}\b\73\(['"]https?://[^\)]+\)[^\?@#%&]{9,45}\becho\h+['"][^'"]+['"];\s*\}(?<X1191713>)|\h+(dalilaescort_system_update)\h*\(\)\s*\{\s*\$\w{1,20}\h*=\h*\d+;[^\?@#]{200,4500}\becho\h+\$\w{1,20};\s*[\s\}]+add_action[\h\(]+['"]wp_(?:footer|header)['"][\h,]+['"]\77['"]\h*\);(?<X1189770>)|\h+(decrypt_SO)\h*\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*mcrypt_[^\}]{9,999}\ssubstr\h*\([^;]+;\s*\}\s*foreach\h*\(\h*\$_[GPRSC]\w{2,6}\h+as\h+\$\w{1,40}\h*=>\s*(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\h*=\h*\80\h*;\s*\}\s*(\$\w{1,40})\h*=\h*\79\h*\(\h*\81\h*,[^\?]{1,99}\b(?:echo|\w?print\w?)\h*\(\h*\82\h*\)\h*;(?<X1168751>)|\h+(file_put_contentz)\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{[^\-\?@]+\84\h*\(\h*BASE_FOLDER\h*\.\h*['"]/\{\$\w{1,40}\}\.txt['"]\h*,\h*\$linkdata\h*\)\h*;(?<X2162680>)|\h+(get)\h*\(\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\(\);[^:]{99,999}\86\h*\(['"]https?://(?:\d{1,3}\.?){4}/\w{1,40}['"]\h*,\h*["']([^;]{1,40})['"]\);\s*\$\w{1,40}\h*=\h*exec\(['"]chmod\h+\+x\h*\87(?:[^\+]{99,999}\+x\h+\w{1,40}){2}[^\}]{1,49}\}(?<X1144721>)|\h+(get\w{0,12})\b\h*\(\h*\$url[\)\s]+\{[^@\^]{999,9999}(\$con\d*)\h*=\h*\89\(['"]http://(?:\w{1,9}\.)?\w{3,24}\.\w{2,9}/[^\}]{9,499}\becho\h*\90;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*(define\(['"]DISALLOW_FILE_)EDIT(['"][\h,]+true\);)\s*\91MODS\92(?<X1176530>)|\h+(get\w{0,20})\((\$\w{1,9}),(\$\w{1,9})\)[^\}]{0,99}\}\s*(\$\w{1,9})\h*=\h*(curl)_init\(\);\s*\98_setopt\(\97,\98opt_url,\95\);[^#]{99,999}\96\h*=\h*\94\(\95,[^\}]{0,99}\}\s*\96\h*=\h*explode\(['"]\W+['"],\96\);[^\}]{0,99}\}(?<X2186081>)|\h+(get_?http\w{0,9})\h*\(\h*\$\w{1,40}[^\)]{0,40}\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\((?:[^:\?<]{99,999}(\$\w{1,40})\h*=\h*\100\h*\(\h*['"]https?:[^'"]{1,99}(?:viagra|cialis|online|casino|game|sale|pharm|herb|jersey|jordan|yeezy)[^;]+;)+\s*echo\h+\101\h*;\s*\}(?<X1168601>)|\h+(R\(\))\h*\{\h*var\h+(\w{1,9})\h*=\h*((document\.)(referrer));\h*if\(\104\.indexOf\(['"]\.(?:google|bing|yahoo|rambler|yandex)\.['"]\)!=[^;\}\v/:\?<>\{]+\{\h*(\106write)\h*\(\h*['"]<script\b[^:]{1,99}\bsrc=['"]http://[^\v\?'"]+\?se_\107=[^\.>\}]+\105[^\.>\}]+\.title\)[^\.]{1,99}\108[^;]{1,9}\103;(?<X1164491>))
\bfunction(?:\h+(R\(\))\s*\{\s*var\h+(\w{1,12})\h*=\h*(document\.)referrer;\s*if\h*\(\h*\2\.indexOf\(['"]\.google\.[^;\{\}]+\{\h*\3write\(['"]<(script)\b[^;:]+\bsrc\h*=\h*['"]https?://[^/'"]+/\w{1,40}/?['"]>\s*</\4>['"]\h*\)\s*\};\s*\}\s*\1;(?<X1183400>)|\h+(random\w{1,40}\h*\(\))\s*\{\s*\$\w{1,40}\h*=\h*array\h*\(\h*\d+\h*,[^\}]{1,999}\}\s*\$\w{1,40}\h*=(?:\h*\6\h*\.){3}[^/]{1,9999}<title>\h*Sign\h*in[^/]{0,99}</(?<X2140621>)|\h+(Search\()(\w)\)\{\s*js\h*=\h*['"](https?://)[^/]{4,40}/\w{1,9}\.js['"]\h*;\s*if\(\9==['"]['"]\)\{\s*var\h+\w{1,9}\h*=\h*document\.referrer;[^/\v]{99,499}\)\):['"]\10(search_on_form/\?)[^:\v]{99,499}\10\11[^\}]{40,99}\}\}\h*\8['"]?['"]?\);(?<X1151500>)|\h+(wampserver)\(([^\)]+)\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:chr\([^\)]+\)\.?){5,20};(\$\w{1,20})\h*=\h*(?:chr\([^\)]+\)\.?){5,20};\s*\14=\15\(\16\(\14\)[^\(]{999,3000}\15=['"]\13['"];\s*\16=\15\((?:chr\([^\)]+\)\.?){5,25}\);\s*(\$_\13)\h*=\h*@?\16\(["']{2},\15\(\14\)\);\s*\17\(\);(?<X1142710>)|\h+(wordpre\w{0,33})[\s\(\)]+\{[^\(\)]{0,40}(\$\w{1,40})\h*=\h*base64_decode\h*\(['"]aHR[^'"]{9,99}['"][\h\)]+;[^\},]{1,99}(\$\w{1,40})[\h,]+CURLO[^;]+\20[\h\)]+;[^\}]+(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\21[^\}]+echo\h+\22;[^=\(\)]{1,99}add_action\(["']wp_(?:footer|header)['"][\h,]+['"]\19['"][\h\)]+;(?<X1174220>)|\h+(WP_URL_CD)\h*\(\h*(\$\w{1,40})[\)\s]+\{\s*if\h*\(\h*\(\h*(\$\w{1,40})\h*=\h*@?(file_get_contents)\h*\(\h*\25\h*\.[^#:\*]{999,9999}if\h*\(preg_match\(['"][^\$]{9,99}\26\h*,[^\}]+\24\h*\([^\;]{9,99};(?:\s*\})+\s*if\h*\(\h*\26\h*=\h*@?\27\h*\(__FILE__\)+\s*\{[^\}]+\}\s*\}(?<X1162451>)|\h+\w{0,9}plugin_install\(\)[\s\{]+\$\w{1,20}=str_replace\(['"]/wp\-content/themes[',"]+\bget_theme_root\(\)\);[^\?%&\*]{99,500}\bwp_remote_get\(hex2bin\([^\}#%]{99,200}\b(?:exit|die)[^;]{0,9};[\}\s]+\$\w{1,20}=['"][a-z0-9]{99}(?<X2192330>)|\h+\w{1,16}\(\w{1,40}\)\s*\{\s*var\h+\w{1,40}=\d\h*,\h*\w{1,40}\h*=\h*\d;\s*var\h+\w{1,40}\h*=\h*['"]\d+\-\d+,(?:[^/]{99,1999}=\h*parseInt\([^\)]+\)/\w{1,40};[^/]{99,999}(\.replace\(/)[^;]+;){4}\s*\}[^/]{99,999}\30[^\.]{9,499}(\.getElementById\()['"][^\.]{9,499}document\31[^\)]{1,40}\);\s*\}(?<X1141441>)|\h+\w{1,20}[\h\(]+(\$\w{1,9})[\h,]+\$\w{1,50}[\s\)]+\{[^\(\{\}]{9,99}(\$\w{1,50})[\s=]+['"]urldecode['"][\s;]+(\$\w{1,50})[\s=]+\34[\h\(]+\33[^\(\{\}]{1,99}(\$\w{1,50})[\s=]+substr\s*\([^\)\(\n]+strlen[\h\(]+\35[^\(\{]{9,99}\35\^\36\h*;(?<X2254831>)|\h+\w{1,20}\((?:([^\)]+)\)\{if\(strpos\(\38,['"]\.xploiter\b(?<X2179160>)|[^\)]+\)\s*\{\s*\$\w{1,20}=base64_decode\([^\)]+\);\s*if\(!(file_)exists\([^\)]+/(wp\-[^\.]{2,20}\.php)['"]\)\)\{\s*(\40)pu(t_contents\()[^\)]+/\41['"],[^@#]{999,6000}\{\s*\$\w{1,20}=['"]<script\h+type=['"]text/javascript['"]\h*src=['"][^\?]{2,15}\?n=nb5['"][^;]+;\s*\$\w{1,20}=\42ge\43(?<X2187160>)|\)[\s\{]+(\$\w{1,20})=(array)\((?:['"]https?://bit\.ly/[^,]+,?){2,4}\);\s*shuffle\(\45\);\s*(\$\w{1,20})=\46_pop\(\45\);[^@%\*]{200,1500}\47=get_url\(\);[\s\}]+if\([^\{]{2,40},\47\)\)[\s\{]+\45=\46\((?:['"]https?://[^'"]{1,15}(?:herbal|rx|pill|drug)(?:caring|store|shop)\.\w{2,4}['"],){2,6}(?<X2193082>)|\)\s*\{\s*if\([^\{]+\)[\s\{]+(?:\$\w{1,20}=[^;]{1,60};\s*){5,20}[^:#&%]{99,400}(\$\w{1,20})=(?:\$\w{1,20}\.)+\$\w{1,20};\s*(\$\w{1,20})=[^;]{1,30};\s*(\$\w{1,20})=[^;]{1,30};\s*if\b[^\}]{9,99}\bwp_create_user\(\50,\51,\49\);[^\}]{1,40}\50\->set_role\(['"]administrator['"]\);[\}\s]{3}(?<X1192991>))|\h+\w{1,40}\((\$\w{1,40})\)\{(\$\w{1,40})=(file_)ge(t_contents\()\53\);[^\?@#%:/&\*]{1,199}(\$\w{1,40})=base64_decode\(['"]dmFyIF8weD[^'"]{999,}['"]\);\55pu\56\53,\57\.\54\);(?<X2184190>)|\h+\w{1,40}\h*\(\h*\$\w{1,40}\h*\)\h*\{\h*\$\w{1,40}\h*=\h*['"][^'"]{36,99}['"];\h*(?:\$\w{1,40}\h*=\h*){2,}['"]{2};[^\v@#%]{99,999}\beval\h*\(\h*\$\w{1,40}[^\s\w]{1,9}\s*\$\w{1,40}\h*=[^;]{99,999};@?preg_replace\h*\(\h*['"](\W)[^,;\)]+\59e['"]\h*,\h*['"]\\x\w{2}[^;]{1,299};\h*$(?<X1188270>)|\h+_sm_shutdown_function\(\$html_content\)\s*\{(?<X2165001>)|\h+alfaMassDefacer\h*\(\h*\)\s*\{\s*alfahead\h*\(\h*\);(?<X2192110>)|\h+AnonymousFox\h*\((?<X2182142>)|\h+curPageURL\(\)\s*\{\s*(\$\w{1,40})\h*=\h*['"](http)['"];\s*if\h*\(\s*\$_SERVER\[['"]\65S['"]\][^'"]{2,9}['"]on['"]\)\s*\{\s*\64\h*\.=\h*['"]s['"][^\$]+\64\h*\.=\h*['"]://['"];[^@]{9,499}@getenv\(['"]REMOTE_ADDR['"]\)[^/\|]{1,999}(\$\w{1,40})\h*\.=\h*['"]Victim[^\?]{9,499}mail\([^\)]+\66[^\)]+\);(?<X1150870>)|\h+detectBot\h*\([^\)]+\)\s*\{\s*\$stop_ips_masks\h*=\h*array\s*\([^\}]{99,9999}\$is_human\h*=\h*(?:false|true);(?<X2162622>)|\h+enc(?:File\(([^\)]+)\)\s*\{\s*if\h*\(strpos\h*\(\69\h*,\h*['"]\.(\w{0,9}crypt\w{0,20})['"]\)[^\}\.]{9,99}\}\s*file_put_contents\h*\(\69\h*\.\W{0,9}\70['"](?<X2166661>)|odeSource\([^@#%]{999,9999}\$urlToRedirect==["']shell["'](?<X2178921>))|\h+ge(?:nerate.doorway\((?<X2183260>)|t(Cookie)\((\w{1,40})\)\s*\{\s*var\h+\w{1,40}\h*=\h*(document\.)\74\.match\(new\h+RegExp\([^\)]+\)['"\s\+]+\75\.replace\(\W{9,}g[^;]+;[^\+]{9,499}\76write\(['"][<iframe'\+"]{9,}\h[^:]{1,40}['"]https?://[^/]{4,60}/[^'"]+\.html?\b[^\)]+[/><iframe'\+"]{9,}\);(?:\s*\}){2}(?<X1162392>)|t_text_fr_serv_wrm\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*curl_init\(\);[^\}\{]{99,300}\bfile_put_contents\h*\([^\)]+\);\s*\}\s*if\h*\(\$_[GPRSC]\w{2,6}\[['"]activatewrm['"]\][^\)]+\)\s*\{[^\}\{\?>]{99,200};\s*\}(?<X1157000>)|tHtml\d*\(\$\w{1,40}\)\s*\{[^@%]{999,9999}\bsetcookie\h*\(['"]haircki['"],[^;]+\);(?<X1154376>)|thttpcnt\(\$url\s*,\s*\$timeout[^\)]+\)\s*\{[^\\\*@]{999,9999}(echo\h+['"])<(script)\b[^>]{0,40}>[^;]{0,9}['"]\h*;\s*\80location\.href\h*=\h*['"]https?://[^;]{1,99}['"];\s*\80</\81>['"]\h*;(?:\s*\}){2}(?<X1161281>)|tMagentoByConfig\h*\(\h*\$\w{1,40}\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*\83\h*==\h*\d+\h*\?\h*URL_BACK_HOST(?<X2176330>))|\h+gorila\h*\([^\)]+\)\s*\{[^\}]{99,400}\}\s*if\h*\(!?isset\h*\([^\}\?\*]{20,200}\bif\h*\(preg_match\h*\(['"]/(?:Wordpress|Joomla|Magento)/i['"]\h*,\h*\$(?<X2159220>)|\h+HTTP_404_Not_Found\((\$\w{1,20})\)\s*\{\s*(\$\w{1,20})=['"][gzinflate\.'"]{10,25}['"];\s*(\$\w{1,20})=['"][base64_dco\.'"]{13,30}['"];\s*\86=\87\(\88\(\86\)\);[^=]{1,20}(\$\w{1,20})\h*=\h*['"][^'"]{999,4000}['"];[^\?]{9,99}(\$\w{1,20})\h*=\h*@?\$\w{1,20}\(['"]{2},\$\w{1,20}\(\89\)\);\s*\90\(\);(?<X1142670>)|\h+j4nc0x\((\$\w{1,20})\)\s*\{\s*\$\w{1,20}\h*=\h*file_get_contents\h*\(\92\);[^\}]{9,200}\bbackscan\h*\(\92\)(?<X2166561>)|\h+login_(shell)\(\)\s*\{\s*if\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\W{1,3}['"]\94['"]\)\s*\{(?<X2154570>)|\h+mainbottom\h*\(\h*\)\s*\{\s*echo\h*['"]<[^\}\(\$@]{1,499}\bFileBox\h+Version\b[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X2184110>)|\h+pwn\((\$cmd)\)\s*\{[^#@^]{999,4000}\(\$\w{1,20}\->\w{1,20}\)\(\97\);\s*(?:exit|die)[^;]{0,9};\s*\}[^:\\]{9,99}(\$\w{1,20})=\(['"]https://github\.com/[^\)]+\);\s*(\$\w{1,20})=file_get_contents\(\98\);\s*eval\([^\(]{0,5}\(?\$\w{1,20}\(\99\)(?<X2187380>)|\h+rdFile\([^\?]{99,2000}\breturn\h+\$[^;]{2,20};(?:\s*\}\s*){1,2}function\h+tcget\h*\(\$[^\$,]{2,20},\$[^\$,]{2,20}=['"]{2}\)\s*\{(?<X2162830>)|\h+re(?:adZips\(\)\s*\{[^\}]{99,300}\barray_push\h*\([^:\\]{99,500}<title>\h*unz[i!]p[3e]r\h*by\b(?<X2183190>)|thta\h*\(\)\s*\{(?<X2153711>))|\h+themefunc\(\)\s*\{[^\!&\*]{9,99}\bif\(!class_exists\(['"](WP_GHOST)['"]\)\)[\s\{]+class\h+\104\s*\{[^\}%\*]{99,400}\badd_action\(["']plugins_loaded['"],array\(&\$this,['"]shellaccess['"]\)\);(?<X2195961>)|\h+tulis_file\((\$(?:nam[ea]|file)),[^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\(['"]\106(?<X2151980>)|\h+wp(?:(_set_charset_)vars\h*\((\$\w{1,20})\)\s*\{[^\}]{99,250}\breturn\h+\109;\s*\}\s*(\$mysql\108prefix)\h*=[^\?]{999,15000}(\$\w{1,20})\h*=\h*\109\h*\(['"]{2}\h*,\h*\$\w{1,20}\(\110\)\);\s*\111\(\);(?<X2170101>)|\w{1,16}\((\$\w{1,16})\)\s*\{\s*(\$\w{1,40})[\h=]+['"]['"\h\.gzinflate]{9,40}['"]\;\s*(\$\w{1,40})[\h=]+['"]['"\h\.base64_dco]{13,60};\s*(\$\w+)[\h=]+(?:(?:\115|\114)[\h\(]+)+\113[\)\h]+;[^=]{0,40}\116[^\$]{999,}(\$\w+)[^\(]{0,99}(\$\w+)[^,]{9,999}(\$\w+)[\h=]+\118\(['"]{2}[\h,]+\117[^;]+;\s*@?\119\(\);(?<X1177970>)|_scan_dir\h*\([^\)]+\)\s*\{[^\?>\\]{99,900}\$fake_dirs\h*=\h*array\h*\((?<X2179440>))|\h+xu\(\)\s*\{\s*\$api_url\h*=\h*['"]https?://[^'"]{1,99}/api\.php['"];\s*\$api_key\h*=\h*['"][a-f0-9]{32}['"];(?<X2150991>))
\bf(?:ile(?:[\(\s]+['"]/etc/named\.conf["'][^\?]{9,9999}\?\s*substr[\(\s@]+php_uname\s*\(\s*\)[^;]+;(?<X2226610>)|\s*Manager\s*by<a\s*href=['"]https://t\.me/X7ROOT['"]\s*\w+=['"]_blank['"]>X7ROOT</a></footer></body></html>\Z(?<X220337955>)|\s+manager\s+by<a\s+href[\s=]+['"]https?://t\.me/(professor[\w\-]+)['"][^>]{0,99}>\3</a></footer>(?<X220351640>)|\s+writer[^%]{1,99}['"](shell)\.php['"][^%]{1,99}\5\s+code[^@]{1,999}paste\s+your\s+shell\s*here(?<X220354720>)|_get_contents(?:\((?:['"]https?://['"]\.\$_[GPRSC]\w{2,6}\[['"]looping['"]\]\.['"]\.\d{1,3}\.\d{1,3}\.\d{1,3}/story\d{0,4}\.php\?pass=\$apass&\w=\$_[GPRSC]\w{2,6}\[[^\]]+\]['"]\)(?<X2172861>)|\h*['"]https://api\.telegram\.org/[^@]{99,499}<(title>)Netflix</\8(?<X2155181>))|(?:\h*\((?:['"]https?://api\.bincodes\.com/[^\)]+\);[^%]{99,600}(?:\$(?:message|msg|f[uc]{2}k)\h*\.?\h*=\h*['"][^\[]+\.\$_POST\[[^\]]+\]\.[^;]+;\s*){3}(?<X2141140>)|\h*['"]/etc/passwd['"]\h*\)\h*;[^\-]{1,9999}\bwp\-(?<X2140540>)|\h*['"]https?://[^\?]{9,399}\b(header)\h*\.?=\h*['"]From:\h*sh[e3]ll[^\}\?]{9,99}\bmail\h*\(\h*[^\)]+\$\12\);(?<X2188010>)|dirname\(__FILE__\)\.['"][^'"]{2,20}/\.\w{1,20}['"]\)\.['"]/(?:pharma?|pills)\.php\?[^\?&\*#]{9,150}\$(?:pills?|pharma?)\h*=\h*explode\h*\([^,]+,\h*\$(?:pills?|pharma?)\b(?<X2183250>))|\s*\((?:\$cachelink\);if\s*\(!\$\w{1,40}\)\s*\{header\(['"]HTTP/1\.1\s+404\s+Not\s+Found['"]\);\s*header\s*\((?<X2137300>)|\s*@?sys_get_temp_dir\s*\([^\{\}]{1,599}foreach\h+\(\h*\$\w{1,40}\h+as\h+(\$\w{1,40})\h*=>\h*(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})\s*=\s*explode\s*\([^\)]{0,20}\17[\s\)]+;\s*\$\w{1,40}\[\16\]\[[^\]]+\]\s*=\s*['"]https?://[^;]{1,40}\18\[\d+\]['"\s\)\./]+wp-login\.php['"](?<X2136770>)|\s*\$\w{1,14}\(\s*['"]Lmh0YQ==['"],\s*\d\s*\)(?<X2276601>))))|_put_(?:(content)s\h*\(\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp\-\21/db\-cache\.php['"]\h*,(?<X2167641>)|cONTEnts(?:[\(\s]+(?:(?:Utf8_deCODE|trim|chop|hebrev)[\(\s]+)?(\$\w{1,40})[\),\s]+BAse64_decoDe[\(\s]+ImpLoDE[\(\s]+ArRaY_sLICe[\(\s]+fILE[\(\s]+(?:\w+[\(\s]+)?__FiLE__[\),\s]+\d+[,\s]+\d+[\)\s]+;\s*(?:require|INcludE)(?:_once)?[\s\(]*(?:\w+[\(\s]+)?\23[\s\)]*;\s*/\*\s+PD9[^\*]{999,}\*/\s*\Z(?<X1225742>)|[\h\('"]+(\$_COOKIE\[)[^\]]+\],\h*urldecode[\h\(]+strtr[\h\(]+\25[^\]]+\],\h*['"]\w+['"],\h*['"]\w+['"][\s\)]+;//['"]\);(?<X120367170>)|[\h\('"]+\w+\.php['"],\h*['"](?:<pre>)?<\?php\h*if[\h\(]+isset[\h\(]+[^#]{9,150}\b(?:eval|trim)[\h\(]+\$_POST\[[^\]]+\][\h\)]+;(?:[\h\)\}\?>'";]+)?/\*['"][\h\)]+;(?<X120367180>)|[\s\('"]+/home\d*/[^'"]+\.php['"][,\s]+['"][>@]?file_get_contents[\s\(\\'"]+https?://filestack\.live/[a-f\d]+\.html?[\\'"\s\)<]+\)(?:\s*;)?(?<X1238640>)|\('\w+','<\?php '\.\$m\);include\('\w+'\);\s*$(?<X2044891>)|\(((\$this->)workpath)\s*\.\s*['"]\w{1,20}\.txt['"],[^,]+,\s*FILE_APPEND\);\s*fclose\(\$\w{1,20}\);\s*unlink\(\$\w{1,20}\);[^%]{99,500}=\s*\30;\s*(?:(\$\w{1,20})\[[^\]]+\]\s*=\s*(?:function_exists|ini_get)\([^\)]+\)[^;]{1,20};\s*){3,9}\31\w{1,20}\(serialize\(\32\)\);\s*(?:exit|die)[^;]{0,9};(?<X2135511>)|\((\$\w+)=\w+\(sys_get_temp_dir\(\),[^,]{1,99},\w+\(\$encrypted[^;]+;include\34;unlink\(\34\);\s*\Z(?<X220359650>)|\((strrev\(hex2bin\()[^\}\{%]{9,99}\$_[GPRSC]\w{2,6}\[["'](priv_)\w{1,20}['"]\][\h=]+\36['"][^'"]{9,99}['"]\)\);\s*\$_[GPRSC]\w{2,6}\[['"]\37msg['"]\][\h=]+\36(?<X2192300>)|\(['"](?:[^'"]+\.php['"],file_get_contents\(base64_decode\(['"]aHR0c[^\)]+\)[^\)]{0,499}\$_[GPCSR]\w{2,6}\[[^;]+;(?:echo\s*['"][^;]{1,199};)?(?:die|exit)\b[^;]{0,19};(?<X1235430>)|[^'"]{5,15}\.txt['"][^\)]{9,60}\);\s*(\$\w{1,9})\s*=\s*['"][^'"]{9,50}["'][^\$]+(\$\w{1,9})\s*=\s*['"](?:[^\]]{1,99}(?:Card|Pass|CCV2)){2}[^\]]{9,159}file_get_contents\(['"][^\$]{1,40}bot\40[^'"]{1,40}['"]\.urlencode\(\41\)\);(?<X2123342>)|\w+\.txt['"]\,\s*\$\w+\,\s*FILE_APPEND\);\s*header\(['"]location:\shttps?://[^;]{1,99};(?<X2242520>))|\([^,\)]{0,99}\$_[GPCSR]\w{2,6}\[[^,]{1,99},\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}\?]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open)\(['"]rm\s[^;]{1,99};\}?\s*(?:\?>\s*)?\Z(?<X2182970>)|\([^\),]+,\$(?:shells?|wso)\)[^\?]{1,499}\bunlink\(__FILE__\)(?<X2209511>)|\(\$(?:\w{1,20},\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$htaccess\w{0,20}=['"]<FilesMatch\h+['"]\.\([^\\\{]{9,150}\block360\.php\b[^\)]{0,40}\)\$(?<X2198370>)|\w{1,40},\h*['"]<\?php\h*/\*['"]\.rand\([^\)]{0,99}\)\.['"]\*/\h*\?>['"]\.\$\w{1,40}\);[^%&#]{99,500}\bcurl_exec\((?<X2149710>)|\{\${"GLOBALS"}\["\w+"\]},\$\w+\,LOCK_EX\);(?<X1247431>)|_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/[^'"]{1,20}\.php['"],<\?php[^\^]{1,9}["']\^['"][^;]{1,40};\s*eval\(["']{2}\.[^;]{1,60}\);\s*\?>\)(?<X1205900>)|path\s*,\s*\$this->get_backdoor_code(?<X2051190>)|rfn,file_get_contents\('pid\.php(?<X2048440>))|\(\s*(?:'err_class/sape\.php(?<X2047720>)|['"]((?:/var)?/tmp/[^'"]+)['"]\s*,\s*['"][^;]+\);\s*(?:echo\s*)?@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\(\s*['"]\s*crontab\s+\53\s*['"]\s*\);(?<X1131450>)|\$\w{1,10}\s*\.\s*["']/\w+\.(?:png|gif|jpg)["']\s*,\s*["']<\?php\s*["']\s*\.\s*get\(\s*\$\w{1,10}\(\$\w{1,10}\)\)\);(?<X2047561>))|\(__FILE__,['"]<\?[^'"]{0,19}['"]\);unlink\(__FILE__\);(?<X2227091>)|\(str_rot13\("[^"]+"\), file_get_contents\(str_rot13\("uggc://[^"]+"\)\)\);.+@\$strings\(str_rot13\(file_get_contents(?<X2044681>)|\h*\(['"](?:(?:\.\./){0,9}wp[\-_][^'"]{3,16}\.(?:php|js)['"]\h*,\h*base64_decode\h*\(\h*['"]PD9[^;\v'"]{499,}['"](?:\h*\))+;?(?<X1139812>)|[\w\-]{1,15}\.php['"]\h*,\h*base64_decode\h*\(['"](?:PD9waHANCkBlcnJvcl9yZXBvcnRpbmcoMCk7|PD8gZnVuY3Rpb24gXzE4OTY1NTAzMzQ)[^'"\);\v]{599,9999}['"]\)\);(?<X1139851>)|\.default/timing/['"]\h*\.\h*microtime\h*\((?<X2161240>))|\h*\((?:[^,\)]+/wp\-(?:admin|contents|includes)/[^'",\)]+\.(?:php|js)['"]\h*,[\h\w\(]{0,49}['"][^\s'"]{39999,}['"][\h\)]+;(?<X1143890>)|[^,\)]{1,49}/wp\-(?:admin|contents|includes)/[^'",\)]{1,49}\.(?:php|js)['"][\h,]+['"]\{\$username\}:\{\$password\}[^,]+,\h*FILE_APPEND\);(?<X1216890>)|[^;,\)]{1,99}/accesson\.php['"]\h*,\h*base64_decode\h*\([^\);]{99,4999}(?:\)\h*){2};?(?<X1168643>)|\h*['"][^'"]{0,19}\.htaccess['"][^;]{1,99};\s*(\$\w{1,40})\h*=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]{1,49};\s*foreach\h*\(\h*\64\h+as\h+\$\w{1,40}\h*\)\s*\{[^;]{0,99};(?:\s*@?[cs](?:ymlink|opy)\h*\([^;]{1,99};){9}(?<X2151050>)|\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/(?:['"]\h*\.\h*\$_[GPRC]\w{2,6}\h*\[[^\]]+\](?:\h*\.\h*['"]\.php['"])?\h*,\s*\$\w{1,40}(?:\h*\[[^\]]+\])?\h*\)\h*;(?<X1157590>)|wp[\-_]?te?mp(?:\.php)?['"]\h*,\h*@?urldecode\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\)\h*;(?<X1157580>)))|\s*\((?:(?:\$\w{1,20}|\$_SERVER\[['"]DOCUMENT_ROOT['"]\])\s*\.\s*['"]/wso(?:.domain.hack|.?webshell|.shell)\.php['"]\s*,\s*\$\w{1,20}\);(?<X2125500>)|[^\)]+\);\s*header\s*\(['"]Location:[^'"]+['"]\);[^\?]{0,150}\?>\s*<!DOCtYPE\s+html>[^/]{9,99}<title>\s*(?:Accedi\s*o\s*registrati|Login\s*or\s*register)(?<X2125980>)|\\['"]wp-[^\.]{1,30}\.php\\['"],\s*base64_decode\(\\['"](?:PD9waHA|IDw.cGhw)[^"']{99,400}(?:bW92ZV91cGxvYWRlZF9maWxl|IG1vdmVfdXBsb2FkZWRfZmlsZ)[^\\]+\\['"]\)\s*\);(?:\s*/[/\*]['"]\);)?(?<X1061791>)|\s*['"]([^'"]{1,40})['"]\s*,\s*base64_decode\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*\)\s*\)\s*;\s*include\s*\(\s*['"]\71['"]\s*\)\s*;(?<X1054500>)|\s*['"][^,]{1,120},\s*base64_decode\s*\(\s*['"]PD9waHANCmVjaG8gIlRoaXMgc2hpdCB3b3JrcyEiOw0KaWYgKGlzc2V0KCRfRklMRVNbImZpbGVuYW1lIl0pK[^,]{500,510};(?:\s/\*['"]\);)?(?<X1041641>)))))|l(?:ock[^\n\?]{0,50}\bfwrite\([^\n\?]{0,999}\.trash['"];[^\n\^]{99,1500}\bpassword['"][^\n#]{0,499}\bmove_uploaded_file\([^\n#]{0,1500}\bscandir\(\$\w+\);(?<X220363494>)|ush\s*\(\);\s*@mail[\(\s]+\$_GET\[['"]\w+['"]\]\s*,\s*\$subject\s*,\s*\$message\s*,\s*@?\$header[\)\s]+;\s*@?sleep[\(\s]+\$_GET\[['"]\w+['"]\][\)\s]+;(?<X2050311>))|m_theme\s*=\s*['"]\d+['"][^\$]{0,99}\$\w{1,40}\s*=\s*['"]http://pingserver\.org[^;]+;[^\$]{0,99}\$\w{1,40}\s*=\s*['"]wp_old_cache['"];[^\$]{0,99}\$\w{1,40}\s*=\s*['"]wp_old_lcache['"];(?<X2128620>))
\bf(?:o(?:ld in folder\.SubFolders '-->FOLDERz(?<X2050790>)|pen\((?:['"](?:/['"]\.\$\w{1,40}\.['"]/['"]\.\$\w{1,40}\.['"]/\.contactinfo['"],['"]w\+?['"]\);[^:\n]{0,199}['"]:208[23]/resetpass\b(?<X2136871>)|[\w\.-]{1,20}\.txt['"]\h*,\h*['"][aw]\+?['"]\);\s*fwrite\([^\?]{99,200}\bheader\(['"]Location:\h*https?://(?:netflix|paypal|bank|gmail)\b(?<X2147270>)|[^'"]+\.txt['"],['"]a+?['"]\);\s*fwrite\([^\)]+\);\s*fclose\([^\)]+\);\s*@?mail\([^\)]+\);\s*header\(['"]Location:\h*https?://my\.ebay\.(?<X2142290>)|[^'"]{1,20}\.txt['"]\h*,\h*['"][aw]\+?['"]\);[^\d]{9,99}\bfclose\([^\)]+\);\s*header\(['"]HTTP/\d\.\d\h+403\h+forbidden['"]\);\s*(?:die|exit)\(['"]<[^\)]{9,99}<title>\h*404\h+Not\h+Found\b(?<X2151992>)|\.htaccess['"],['"]w['"]\)[^%]{4999,9999}str\(\$\w{1,40},['"]class-wp-mobile\.php['"]\);(?<X2127460>))|\$s1\.'accesson\.php(?<X2050681>))|pen(?:\b\h*\(['"][^\.]{2,30}\.txt['"]\h*,\h*['"]a\+?["']\);[^\*@]{9,200}\bmail\h*\(\$\w{1,20}\h*,\h*['"]Wells\h*(?:fargo)?\h+(?:login|complete|fullz)\b(?<X2176150>)|\h*\(['"][^'"]{2,20}\.txt['"],\h*['"]a\+?['"]\);[^\{\}]{9,400}\bexit\h*\(\h*header\h*\(['"]Location:\h*https?://[^'"]{9,99}=\{(\$praga)\}\{\9\}['"]\)\);[^\?>]{99,500}\9\h*=\h*(?:md5|rand)\h*\((?<X2177230>)|\s*\(['"](?:(r[0o]{2}t\.pl)['"],\s*['"](?:a|w)\+?['"]\);\s*if\s*\(\s*(\$\w{1,40})\s*!=\s*FALSE\)\s*\{\s*fwrite\s*\(\12,\s*base64_decode\s*\(\$\w{1,40}\)\s*\);\s*\$\w{1,40}\s*=\s*exec_all\s*\(['"]perl\s+\11;['"](?<X2121950>)|\w{1,9}\.txt['"],\s*['"]a\+?['"]\);[^=]{1,99}\$\w{1,40}\s*=\s*md5\s*\(\s*rand\s*\(\d+,\d+\)\s*\)[^\(]{1,99}\brecurse_copy\s*\((\$\w{1,40}),\s*(\$\w{1,40})\)\s*\{\s*\$\w{1,40}\s*=\s*opendir\s*\((?:\14|\15)\)\s*;\s*@?mkdir\s*\((?:\14|\15)\)(?<X2130400>))|\s*\(\s*(?:["'][^'"]*["']\s*,\s*['"][^"']*['"]\s*\)\s*;\s*\}\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*rawurldecode\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*@?include\s*\(\s*"[^"]*"\s*\)\s*;(?<X2046540>)|['"]/etc/passwd['"]\s*,\s*['"]\w\+?['"]\s*\)[^\{]{1,999}while\s*\(\s*\$\w{1,40}\s*=\s*fgets\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2132283>)))|r[\h\(]+(?:(\$\w{1,40})[\h=]+0;\h*\19(<strlen)[\h\(]+(\$\w{1,40})[\h\)]+;[\s\)]+\{(?:\s*\$\w{1,40}[\h=]+['"][^'"]{1,99}['"];)?\s*for[\s\(]+(\$\w{1,40})[\h=]+0;[\h\(]+\22\20[\h\(]+(\$\w{1,40})\D{2,9}\19\20[\h\(]+\21[\h\)]+;\s*(?:\19|\22)\+{2},[^\.\^]{0,199}\.=(?:\h*(?:\21|\23)\{(?:\19|\22)\}\h*\^?){2};[^@]{9,199}@exec\((?<X2178010>)|(\$\w{1,9})[\h=]+0;\h*\25\h*<\h*\d+;\h*\25\++[\s\)]+\{\s*(\$\w{1,40})[\h=]+str_repeat\([^\)]+\25[\h\)]+;\s*if[\h\(]+(file_)exists[\h\(]+\26[\h\.]+['"]wp\-load(\.php)["'][\s\)]+\{break;[\}\s]+if[\h\(]+\27put_contents[\h\(]+\26[\h\.]+['"]wp\-\w{1,9}\28['"][\h,]+base64_decode\(['"][^'"]{9999,}['"][\)\h]+;?(?<X1177960>))|r(?:[\s\(]+[^<]+<(\w{1,9})\.length[^=]+(\w{1,9})\+=String\.fromCharCode[\s\(]+\30\.charCodeAt[\(\w\)]+-\d{1,9}[\)\s]+;\s*document\.write[\(\s]\31[\)\s];(?<X1262341>)|\((\$\w+)[^\{]{0,49}\{\h*\$\w+\.?=chr\(hexdec\(\$\w+\[\33\]\.[^\{]{9,150}\{\h*(return)\h*hex2bin\(\$\w+\)[\h;\}]+(function)\h*\w+\([^\}]{9,399}\}\h*\34\h*\$\w+;\}\h*\35\h*(\w+)\([^\}]{9,199}\}\h*(\$\w+)[\h=]+['"][^'"]{25000,}['"];\h*(\$\w+)[\h=]+\36\(\37[^\{]{9,199}\{\h*eval\(['"]\?>['"][\h\.]+\38\);\}else[^\|\]\}]{9,99}\}(?<X120332980>)|\([^\{\?]{2,40}\)\{(\$\w{1,20})\.?=(\$\w{1,20})\[mt_rand\(\d,strlen\(\41\)[^\];]+\];\}(\$\w{1,20})=['"]<\?php\h*/\*['"]\.\40\.['"]\h*\*/\?>['"]\.\42;(\$\w{1,20})=\$_SERVER\[[^\]]+\]\.['"]/[^\.]{2,20}\.php['"];file_put_contents\(\43,\42\);\}function\h+\w{1,60}\(\42\)\{\$\w{1,20}=array\((?<X2178331>)|\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(?:(\$logins)\h*=\h*str_replace\h*\(['"\h][^'"]+['"]\h*,\h*['"]{2}\h*,\h*\46\);\s*){2,4}(?:echo\h+nl2br\h*\(Execute\h*\(['"]\h*ln\h+\-s[^'"]{2,60}\46\[\45\]\-[^\.]{2,20}\.txt['"]\)\);\s*){10}(?<X2180730>)|\h*\(\h*(\$\w{1,40})\h*=\h*\d;\h*\48\h*\D{1,3}\h*strlen\h*\(\h*['"](\w{199,499})['"]\h*\);\h*\48\h*[\+\-]=\h*(\d+)\h*\)\h*(\$\w{1,40})\h*\.=\h*chr\h*\(\h*hexdec\h*\(\h*substr\h*\(\h*['"]\49['"]\h*,\h*\48\h*,\h*\50(?:\h*\)){3};\h*eval\h*\(\h*\51\h*\);(?<X1170750>)|\s*\(\$i\s*=\s*2\s*;\s*\(\s*\$i\s*<=\s*20\s*\)\s*;\s*\$i\+\+\)\s*{\s*\$newfile\s*=\s*"\$i\.php";(?<X2048460>)|\s*\(\s*(\$\w)\s*=\s*0;\s*\54\s*<\s*strlen\s*\(\s*\$wp_file_descriptions\[['"]md5_check\.php['"]]\s*\);\s*\54\s*=\s*\54\s*\+\s*\d+\s*\)\s*\$search\s*\.?=\s*['"]%['"]\s*\.\s*substr\s*\(\s*\$wp_file_descriptions\[['"]md5_check\.php['"]]\s*,\s*\54,\s*\d+\s*\);\s*\$wp_template\s*=\s*@?preg_replace\s*\((?<X2058430>)|\s*\(\s*(\$\w{1,40})\s*=\s*\d+;\s*\56\s*<\s*\$\w{1,40}\s*;\s*\56\+\+\s*\)\s*\{\s*[^\}]{1,400}flush\s*\(\s*\);\s*\$\w{1,40}\s*=\s*new\s+PHPMailer\s*\(\s*\);(?<X2055221>)))|p(?:\s*=\s*@fsockopen\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\d+\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*@fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*connect3\s*\(\s*\$\w{1,40}\s*\.\s*["'][^"']*["']\s*\.\s*urlencode\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;\s*\}\s*(?:exit|die)[^;]{0,9};(?<X2046351>)|assthru\([^@]{1,199}<title\b[^>]{0,99}>\h*X14ob\h*(?:\-\h*)?[S$]h[e3][l1]{2}\b(?<X2163420>)|uts\s*\(\s*\$fp\s*,\s*['"][^'"]{60,99}SimAttacker\s*\d+\.\d+\s*ready(?<X2123561>))|rom:\h*(?:(?:jokamerrez|losyavlaton)\d*@(?:gmail|yahoo|prontonmail|yandex)\.com['"][^;]{0,9};\s*mail\((?<X2171831>)|\w{1,20}\h*sp[@4a]m<[^>]+>['"];\s*\$\w{1,20}\h*\.?\h*=\h*\$(?<X2153021>))|sockopen\(['"](?:\d+\.\d+\.\d+\.\d+['"],\d+\);exec\(['"]/bin/sh\s+\-i\s+<&3\s+>&3\s+2>&3['"]\);(?<X120362111>)|udp://\$\w{1,20}['"],[^\)]+\);[^/]{99,300}\becho\h+['"]DD?OS\h+attack\h+against\h+udp://(?<X2149761>))|unction (?:__\w{1,40}\(\$\w{1,40}\)\{\$\w{1,40}=[base64_decode.']+;return\s*\$\w\(\$\w{1,40}\);\}\}\$\w+=[create_function.']+;\$_(?<X2050320>)|arr2html\(\$array,\s*&\$arr\s*=\s*'\s*',\$ztabhtml='',\$zheaderarray=''\)\s*{\s*\$array\s*=\s*"as"\s*\.\s*\$_REQUEST\['array'\];\s*\$sort\s*=\s*array\(\$_REQUEST\['sort'\]\);(?<X2045980>)|check_commands\s*\(\)\s*\{\s*if\s*\(\s*array_key_exists\s*\(\s*'delete'\s*,\s*\$_REQUEST\s*\)\s*\)\s*\{\s*unlink\(\s*__FILE__\s*\);(?<X2050610>)))
\bfunction(?:(\w+)\((\$\w+)\)\{if\(extension_loaded\(['"](curl)['"][^\?]{1,99}\3\w+[^@]{1,299}@?file_get_contents\(\2[^:]{1,299}\1\(['"]https?://[^'"]+\.txt['"]\)[^\n]{1,399}http_response_code\(\d+\);[^\n]{1,199}(\$\w+)=\1\(['"]https?://[^'"]+\.txt['"]\);[^\}]{1,99}eval\(\4\);\}(?:die|exit);\}(?:\})?,\d+\);(?<X120358531>)|[^\$]{1,29}(\$real_file)\w+,\s*\6\w+\)[^\$]{1,99}(\$\w+)[\s=]+fopen\(\6\w+[^\(]{1,99}\(\6\w+\);\s*(curl)\w+[^\}]{1,99}\7\);\8\w+[^\-]{1,199}['"][^'"]+\.php['"][^\{]{1,49}(file_exists)[^\{]{1,49}\{include[^'"]{1,99}['"]UfitVzpC[^'"]+['"]\)[^\\]{1,399}\9\((\$\w+)[^\(]{1,49}include\(\10\);ob_end_clean\(\);\}\}\s*\}\s*\}(?<X120352380>)|\([^\)]+\)\s*\{\s*show(BankLogoSpinner\(\);)[^\}\{]{2,499}\bhide\12(?<X2172912>)|\h*(?:wsoExGently|pwn)\([^\)]+\)[\{\s]+define\(['"]Logging['"],[^\[]{9,300}\$\w{1,20}\[\][\h=]+Pwn::alloc\((?<X2206661>)|\h*([\w\-]+)[\s\(\)\{]+header\([^#]{99,1400}\bfile_get_contents\(['"]/etc/passwd['"]\);[^#]{9,1200}\bwp_die\(\);\s*\}\s*(add_action)\([^;]+;\s*\16[\('"]+[^'"]+['"],\h*['"]\15['"]\);(?<X120367811>)|\h*(\w+)[\(\)\s\{]+(\$\w+)[\h=]+['"]https?://mangsud\.haxor-research\.com/[^'"]+\.php['"];\s*(\$\w+)[\h=]+@?file_get_contents\(\19\);[^\}]{0,299}\}\s*echo\h*\20;\s*\}\s*add_action[\h\(]+['"][\w\-]+['"][\h,]+['"]\18['"][^\)]*\);(?<X120348900>)|\h*(\w+)[\(\)\{\s]+if[\h\(]+isset[\h\(]+\$_SERVER\[[^\]]+\][\h\)]+\W{2}\h*preg_match[\h\(]+['"]/Googlebot[^\{]{9,99}\{\s*(\$\w{1,15})[\h=]+['"\.\h\*\dbase_dco]+;\s*(\$\w{1,15})[\h=]+['"][^'"]{399,999}['"];\s*echo\h*\23[\h\(]\24[\h\)];[\}\s]+add_action\(['"][^'"]+['"],\h*['"]\22['"]\);(?<X1203660>)|\h*(\w+)[\h\(]+(?:(\$\w+)[\s\)\{]+[^\{]{0,99}\{\s*\$\w+[\h=]+file_get_contents[\h\(]+\27[\h\)]+;[^\?]{0,299}(\$\w+)[\h=]+\26[\h\(]+['"]https?://[^'"]+\.txt['"][\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\28[\h\)]+;(?<X120345060>)|[^\{]+\{\s*(\$\w+)[\h=]+tempnam[\h\(]+sys_get_temp_dir[^;]+;\s*file_put_contents[\h\(]+\30,\h*['"]<\?php[^\?]{99,250}(\$\w+)[\h=]+\$\w+\h*\(['"][^'"]{5000,13000}['"]\);\s*\26[\h\(]+\31[\h\)]+;(?<X1318400>)|\$\w+[\s\)\{]+(\$\w+)[\h=]+(?:['"]/(?:var|homed*)/[^'"]{0,99}/etc/ssess_\w{32,64}['"];\s*if[\h\(]+file_exists[\h\(]+\33[\s\)]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\33[\h\)]+;[^\}]{0,199}\}\s*ob_start[\h\(]+['"]\26['"][\h\)]+;(?<X1258370>)|curl_init\(\);[^\}]{9,250}\bcurl_close[\h\(]+\33[\h\)]+;\s*return\h*\$\w+;[\s\}]+(\$\w+)[\h=]+['"]\?>['"];\s*eval[\h\(]+\35[\h\.]+\26[\h\(]+base64_decode[\h\(]+['"]aHR0cHM[^\)]+[\)]+;(?<X1293250>))|\$\w+[^\{]+\{\s*GLOBAL\h*\$\w+;\s*if[\h\(]+hash[\h\(]+[^\?]{9,1500}(\$\w+)[\h=]+openssl_decrypt[\h\(]+hex2bin[\s\('"]+[^'"]{999,5000}['"][^;]+;\s*\$_COOKIE\[[^\]]+\][\h=]+\37;\s*\}[^#]{999,7000}\b\26[\h\('"]+[^'"]+['"\)]+;(?<X220363770>))|\h*(\w+)[\s\(\)\{]+(?:\?>\s*<(script)[^>]{0,99}src=['"]https://[^'"]+[?!use\.fontawesome]\.js['"]></\40>\s*<\?php\s*\}\s*add_action\(['"]wp_head['"],\h*['"]\39['"]\);\s*\Z(?<X1307241>)|if[\h\(]+!isset[\h\(]+\$_SERVER\[[^\?]{99,399}\bif[\h\(]+\39[\s\(\)\{]+(\$\w+)[\h=]+@?file_get_contents[\h\(]+['"]https?://tereasite\.pro/cloak/[^'"]+['"\)\h]+;\s*if[\h\(]+\42[\s\)\{]+[^\}]{0,150}\becho\h*\42;\s*exit;\s*\}\s*(?:else\s*\{[^\}]{0,199}\}\s*)?\}(?:\s*\}\);)?(?<X120336622>))|\h*(\w+)[\s\(\)]+\{\s*echo\s*base64_decode[\h\(]+['"]PHNjcm[^'"]{99,400}['"][\h\)]+;\s*\}\s*add_action[\h\(]+['"][^'"]+['"][\h,]+['"]\44['"][^\)]*\);(?<X1230510>)|\h*(\w+)[^\{]+\{\s*if[\h\(]+[^\{]+\{\s*touch[\h\(]+__FILE__,\h*filemtime\(['"]index\.php['"]\)[^\?]{9,650}(\$\w+)[\h=]+['"]<[^>]{300,700}>['"];\s*preg_match[\h\(]+[^,]+,\h*\47,\h*(\$\w+)[\h\)];\s*(\$\w+)[\h=]+\48\[\d+\];\s*(\$\w+)[\h=]+\46[\h\(]+\49,[^;]+;[^\?]{0,90}\beval[\h\(]+\50[\h\)]+;\s*\}(?<X120361670>)|\h*(\w+)\((?:(\$\w+)\)\{\s*\53[\h=]+base64_decode\(\53\);\s*eval\(\53\);\s*\}[^\?]{9,199}if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*==[^\{]+\{\s*\53[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\52\(\53\);\s*return;\s*\};(?<X1266440>)|(\$\w{1,15})[^\{]+\{\s*return[^\{\}]{9,199}\{\s*\$\w{1,15}[\h=]+@?fopen\(\55[^\?]{9,199}\bchmod\(\55,[^\?]{99,299}\b\52\((\$\w+)[\h\.]+['"]/\w+\.txt['"],[^#]{99,799}\bfile_put_contents\(\56[\h\.]+['"]/wp\-(?:includes|admin|content)/[^\.]+\.php['"],\h*['"]<\?[ph\s]+\?>['"]\);\s*\}(?<X1204520>)|(\$\w{1,20})\)[\{\s]+(\$\w{1,20})=["']base64_decode['"];\s*\58=\59\(\58\);[^\}]{1,40}\}\s*if\((?:md5\()+\$_[^\}\\]{99,500}\becho\h*\52\([^\}]+\);[\}\s]+if\([^\$]{0,20}\$_FILES\[\52[^\{]+\)[\{\s]+[cm]o(?:py|ve_uploaded_file)\([^\}]{9,99}\}\s*echo\h*\52\([^\}]+\);[^\?]{9,99}\bheader\(\52\([^;]+\);(?:exit|die)[^;\}]*;\}(?<X1220661>)|[^\{]+\{\s*(\$\w+)[\h=]+['"]{2};\s*for[^\{]+\{(?:\s*\$\w+[\h=]+ord\(\$\w+\[[^;]+;){2}[^\}]{0,99}\}\s*return\h*\61;\s*\}\s*if[\h\(]+!?defined[\h\(]+['"]ABSPATH['"][\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\52\([^\)]+\);\s*\}(?<X120346520>)|\$[^\{]+\{[^\}]{9,250}curl_setopt\(\$\w+,\h*CURLOPT_[^#]{999,1599}\bhref['"]\][\h\.=]+(\$\w+);\s*(\$\w+)\[['"]main_shell['"]\][\h\.=]+\63;[^%\^]{999,2500}\b\52\(\$\w+,\h*\64\);\s*echo\h*\$\w+;\s*exit\(\);\s*\}(?<X120333950>)|\)[\s\{]+echo\h*['"]\s*<p[^>]+>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{1,99}>[^<]{0,50}\bescort[^<]{0,50}</a>\s*){5}[^\};]{999,};[\}\s]+add_action\(['"]\w+['"][,\h]+['"]\52['"]\);(?<X1209681>)|\)\s*\{\s*(\$\w+)(?:=['"][^\{]{0,199}\{\s*if[\h\(]+update_option[\h\(]+['"]primary_domain['"][\h,]+['"]https?://[^\.]+\.(?:abcd1|2024a)\.ru['"][\s\)]+\{[^\?]{99,1500}\?>\s*<div[^\?]{9,99}<\?[ph\s]*_e[\h\(]+\67[^\}]{9,199}\}\s*add_action[\h\(]+['"]\w+['"][\h,]+['"]\52['"][\h\)]+;(?<X1252530>)|[\h=]+['"][^'"]{6000,13000}['"];\s*echo\s*['"]<(script)[^\}]{9,99}\batob[\h\(]+[\\'"\.\h]+\67\h*\.[^\}]{99,200}\}[\s\)\(;]+</\69>['"];\s*\}\s*add_action[\h\(]+[^,]+,\h*['"]\52['"][\h\)]+;(?<X1305590>))|\)\{if\(class_exists\([^\{]{1,99}\{\?><meta[^\n]{9999,45000}\bdocument\[_0x[\d\w]+\(0x[^\n]{9,700}\bwc_add_notice\(['"]<[^>]+>(?:CVV|CVC)/[^\n\?]{99,299}\badd_action\(['"][^'"]+['"],\h*['"]\52['"]\);(?<X1203160>))|\h*(\w{1,15})\(\$\w{1,15}\)\{(\$\w{1,15})\h*=\h*array\([^\)]+\);\h*for\([^\}]{9,199}\}\h*return\h*\73\[\d\];\h*\}\h*(\$\w{1,15})\h*=\h*['"][^'"]{999,5000}['"];\h*(\$\w{1,15})\h*=\h*['"]\72['"];\h*(\$\w{1,15})\h*=\h*\75\([^\)]+\);\h*(\$\w{1,15})\h*=\h*\76\(['"]{2},\75\(\74\)\);\h*\77\(\);(?<X1196370>)|\h*(\w{1,15}\(\))\s*\{\s*(\$\w{1,15})\h*=\h*file_get_contents\(str_rot13\(['"]uggcf://[^\)]+\)\h*(?:\.\h*\$_SERVER\[[^\]]+\])?\);\s*echo\h*\80;\s*\}\s*\79;\s*\?>(?<X1195272>)|\h*(\w{1,25})[\(\)\{\s]+echo\h*['"]<[^>]{0,99}\bdisplay:\h*none[^\}\{]{0,150}<a[^>]{0,99}>[^<]+\b(?:escort|sex|seks)\h*</a>[^\}\{]{0,999}\}\s*add_action\(['"][^'"]+['"],\h*['"]\82['"]\);(?<X1211310>)|\h*(\w{1,25})\(\)\h*\{\s*\$(\w{1,25})\h*=\h*get_option\(['"]\85['"]\);\s*\$\w{1,25}\h*=\h*array\(\s*['"]monit\.php['"]\s*\)[^\?]{99,1100}\bfile_put_contents\(\$\w{1,15},\h*\$\w{1,15}\);\s*\}[^\(]{0,50}\badd_action\(['"]init['"],\h*['"]\84['"]\);(?<X1155870>)|\h*(\w{1,25})\s*\(\s*\)\s*\{\s*(\$(?:alt)?sayfa)\h*=[^\}\{]{1,499}(\$\w{1,40})\s*=\s*(?:['"]<div\b[^>]{0,99}\bstyle=['"]display:none\b[^;]{999,}|curl_exec\s*\([^\}]{1,99});\s*if\s*\([^\)]{0,99}\88\b[^\{]{1,99}\{(?:[^\}]{1,199}\becho\s*\89;[\s\}]+){2,}add_action\s*\([^,]+,\s*['"]\87['"]\s*\);(?<X1190721>)|\h*(\w{1,40})[\(\h]+(\$\w{1,40})[\s\)]+\{\s*@?eval[\(\h]+\92[\s\)]+;\s*\}\s*@?\s*\91[\(\h]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;(?<X1194790>)|\h*(\w{1,40})\(\)\s*\{[^\}\{]{0,99}(\$\w{1,40})\h*=\h*\[(?:\h*['"]https?://xn\-\-\w{2,32}\.xn\-\-p1ai['"]\h*,?){2,}\]\h*;[^\{]{0,99}\{\s*header\(['"]Location:\h*['"]\.\95\[array_rand\(\95\)[^\?]{0,199}\badd_action\(\h*['"][^'"]+['"],\h*['"]\94['"]\h*\);(?<X2187710>)|\h*(\w{1,40})\h*\(\h*\$\w{1,40}\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*list\h*\(\h*(\$\w{1,40})\h*,\h*\$\w+\h*\)\h*=\h*explode\h*\([^;]{1,99}\98\b[^;]{1,99};\s*return\s*openssl_decrypt\h*\(\h*\99\b[^;]{1,99};\s*\}\s*@?eval\h*\(\h*\97\h*\(\h*\$_[GPCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^;\s_'"]{9999,}['"]\h*\)\h*\)\h*;(?<X1167963>))
\bfunction(?:\s(\w{1,30}\(\))[\s\{]+(\$\w{1,14})[\s=]+curl_init[^;]+;\s*curl_setopt\(\2[^'"]{1,50}['"]https://(?:\w+\.)?classic\-editor\.com[^\}]{1,200}\}\s*function\s(\w{1,30})\(\)[\s\{]+(\$\w{1,14})[\s=]+\1;\s*echo\s*\4;\s*\}\s*add_action\(['"]\w{1,14}['"][\s,'"]+\3['"]\);(?<X1318381>)|\s*((_0x)\w+)\(\7\w+,[^\}]{1,999}\},\s*\6\([^\}]{1,32}\}[^\]]+(\bo\-p\.shop\b)[^!]+\6,\7[^\}]+\}\s*\w+\(\7[^\^]{1,999}\8[^\^]{1,99}(\7\w+)=\7\w+=>\{\w+[^\^]+\9\(\7\w+\),\s*\w+\[\w+[^\}]+\6;[^\}]+\}\s*\}\s*\};\s*\}\(\);\s*\}(?<X120331900>)|\s*(\w)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"]base64_decode['"]\s*;\s*\12[=\s]+\13[\(\s]+\12[\)\s]+;\s*\13[=\s]+['"]gzinflate['"]\s*;\s*return\s*\13[\(\s]+\12[\)\s;]+\}\s*@?session_start\s*\(\)[;\s]+header[\s\(]+\11[\s\(]+['"][^'"\$]{9,199}['"][\s\)]+;[^\}]{99,499}\b(?:exit|die)\b[^;]*;\s*\}(?<X2223500>)|\s*(\w)\(\w,\w\)\{\w+\s*\w=(\w)\(\);\w+\s*\15=\w+\([^}]{1,99}\15\[['"](\w+)['"]\]={3}undefined\)\{\w+[^\\]{1,999}\17['"][^\}]+\}\w+\s*\w[^\}]+\},\15\([^\\]{1,999}\w+\.XMLHTTP[^\\]{1,9999}['"]\\x22[^\}]{1,99}\}{2}[^\\]{1,999}\16\(\)\{var\s*\w+=\s*\[['"][^\\]{999,4999}\16=\w+\(\)\{return\s*\w+;\};\w+\s*\16\(\);\}(?<X120332120>)|\s*(\w+)[\(\)\s]+\{\h*return\s*['"]https?://(?:[fz]\w+\.[^'"]+['"][;\s]+\}\s*\$\w{1,40}[=\s]+\19[\(\)\s]+;[^\n\*#]{99,}(\$\w+)\[['"]http_user_agent['"]\]\s*=[^;]*;\s*echo\s*\w+\s*\([^;]+\20[\s\)]*;[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1254770>)|\d+(?:\.\d+){3}/[fz]\w[^'"]+['"][;\s]+\}\s*\$\w{1,40}[=\s]+\19[\(\)\s]+;[^\n\*#]{99,}(\$\w+)\[['"]http_user_agent['"]\]\s*=[^;]*;\s*echo\s*\w+\s*\([^;]+\22[\s\)]*;[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1254940>))|\s*(\w+)[\(\)\{\s]+\$\w+[\s=]+wp_get_current_user[\(\)\->\s]+has_cap[\(\s'"]+\w+['"\s\)]+\?\s*1\s*:\s*0[\s;]+if[\s\(]+\$\w+[\s=]+0[\)\s\{]+echo['">\s<]+(script)[^;]+;base64[,\s]+[^'"]{999,}["><\s/]+\25[>\s\}'";]+add_action[\('"]+wp_head['",\s]+\24['"\s\)]+;(?<X1308800>)|\s*(\w+)[\(\)\{]+if\(\w+[\(\)\{]+\w+;\}(\$\w+)=['"]_auth['"];\$\w+=['"]\w+['"];if\(isset\(\$_COOKIE\[\28[^\{]+\{\$\w+=array\(['"][^>]{5,64}>['"]Administrator[^;]{6,64};\$\w+=get_users[^\-]{8,64}\->\w+,[^;]{8,299};wp_set_auth_cookie[^;]{8,200};do_action\(['"]\w+[^\}]{1,64}\}{1,4}add_action\(['"]init['"],['"]\27['"]\);(?<X1317510>)|\s*(\w+)[\(\s]+(?:(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s'"]+base64_decode[^\}]{9,99}\breturn\s*\32[\s\(]+\31[^!]{0,999}if[\(\s]+!defined[\(\s]+\30[\(\s]+['"][^'"]{1,40}['"][\s\)]+\{[^\.]+\$\w{1,40}[=\s]+\$\w{1,40}[\.\s]+md5[\(\s]+str_ireplace[\(\s]+\30[^\}]+\}(?:[^\}]+\}){2}\s*@?eval[\s\(]+\30[^;]+;\s*\Z(?<X2221031>)|\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{[^\^\}]{0,99}(\$\w{1,40})[=\s]+urldecode[\(\s]+\$\w{1,40}[^\^\}]{0,99}(\$\w{1,40})[=\s]+substr[\(\s]+\$\w{1,40}[,\s]+0[,\s]+strlen[\(\s]+\34[^\^\}\^]{0,99}return\s*\34\s*\^\s*\35;(?:[^\%\^]{0,499}(\$\w+)\s*=\s*\$\w*[\{\[]\30[\(\s]+['"][^:;]+;){1,2}[^\%\^]{0,499}include(?:_once)?[^;]+\36(?<X2232434>))|\s*(\w+)[\s\(\)]+[\{\s]+echo\s*['"]<div\s*style[=\s]+['"]display:none['"]>\s*<h2[^>]+display:none['"]>\s*<a[^:]+href[=\s]+['"]https?://[^'"]+['"][^<]+</a>\s*</div>['"];[\s\}]+add_action[\(\s]+['"][^'"]*['"],['"]\38['"][\)\s]+;(?<X1217642>)|\s*(\w+)[^;]{1,49}static(\$\w+)=(?:false|true)?;\w+\(\41[^=]{1,99}\41[^\.]{1,49}(\$\w+)=['"]\w+['"]\.md5[^\-]{1,49}\42[^%]{1,399}json_encode[^@]{1,499}(base64_decode)\(['"]aHR0cHM6Ly8['"]\)\.['"]\d+\.\d+\.\d+\.\d+['"]\.\43[^@]{1,399}unlink\(\$\w+\);[^!]{1,99}add_action\(['"]\w+['"],['"]\40['"],\d+\);(?<X120349802>)|\s*(\w+)[^\.]{99,999}(\$\w)['"\s=]+\?>['"];\s*eval\(\46\s*\.\s*\45\(\w+\(['"]aHR0[^'"]+['"]\){3};(?<X1314000>)|\s*(\w+)\((\$\w+)\)(?:\s*\{\s*(?:\$\w+[=\s]+['"]\\\w+\\\w+[^'"]+['"]\s*\.\s*md5\(\49\);\s*\w+\(['"]\\[^'"]+['"]\);.{99,9999}\48\(['"]\\\w+\\\w+[^\{]{1,999}\{\s*wp_enqueue_script\(['"][^@]{1,1999}array_merge\(\$\w+,\s*\w+\(\$\w+\)\);\s*\}\s*\}\s*r?(?<X120353330>)|\w+\s*\(\w+\((?:['"]allow_url_fopen['"]\)\)\s*\{\s*\w+\s*@?file_get_contents\(\49[^\\]{1,999}\}\s*(\$\w+)\s*=\s*strtolower\(\$_SERVER\[['"]\w+[^;]{1,99};\s*(\$\w+)[^;]+/[\w\-]+\.txt['"];\s*\$\w+\s*=\s*\48\(\52\);\s*(\$\w+)[\s=]+['"]/[^;]+googlebot[^;]+;\s*\w+\s*\(\w+\(\53,\s*\51\){2}\s*\{\s*echo\s*\$\w+;\s*exit;\s*\}(?<X120338520>)|\49,[^\{]{1,99}\{\s*\$\w+[\s=]+['"]<(script)\s*\w+=['"]/wp\-wordfence\.js['"]></\55>['"];\s*\49[^;]+;\s*\}\s*\w+\s*\49;\s*\}\s*\w+\(['"]\48['"]\);(?<X120341580>))|\w+\s*\w+\(['"](hex2bin)['"]\)\s*\?\s*@\57\(\49\)\s*:\s*@pack\(['"]H\*['"],\s*\49\);\s*\}[^\\]{99,1999}wp_die\(\48\(['"]\w{32,}['"]\)\);\s*\}\s*\}\);\s*\Z(?<X120358180>)|global\s*(\$\w+);\s*\w+\s*\(\59[\s='"]+users\.php['"]\s*&&\s*is_admin\(\)\)\s*\{\s*\$\w+[=\s'"]+[\w\-]+['"];\s*(\$\w+)\s*=\s*[^\}]+\w+\s*\(\60\)\s*\{\s*\49\->\w+\[['"]exclude['"]\]\s*=\s*\w+\(\60\->ID\);\s*\}\s*\}\s*\}\s*add_action\(['"]\w+['"],\s*['"]\48['"]\);(?<X120340460>))|\{(\$\w+)=curl_\w+\(\);\w+\(\62,\[\w+=>\49,\w+=>\w+[^\}]{1,999};\(\w+\s*\w+\(\62\)\);\w+\(\62\);\}\w+\(\48\(base64_decode\(['"]aHR0[^'"]+['"]\)\)\s*\w+(\$\w+)\)\{eval\(['"]\?>['"]\.\63\)\;\}(?<X120329660>))|\s*(\w+)\(\$\w+(?:[^=]{1,199}\$\w+\s+=\s+curl_init\(\$\w+\);[^\}]+\}\s+(\$\w+)\s+=\s+(base64_decode\(['"]aHR0)[^;]{1,399};\s*(\$\w+)\s*=\s*\67[^;]{1,499};\s+(\$\w+)\s+=\s*\65\(\66\);\s*if\s*\(\69[^\{]+\{\s+eval\(\69[^\{]+\{\s*\$\w+\s*=\s*\65\(\68\);[^\?]{1,499}\?>(?<X120337850>)|\)\s*\{\s*(?:[^\}]{1,999}\}\s*\$\w+[^@]{1,999}\65\(\$\w+\)[^@]{1,999}readfile\(&?base64_decode\(['"]d3AtY29uZmlnLnBocA[^'"]{1,32}['"]\)\);\s*\}\s*\}(?<X120336923>)|\w+\s*hex2bin\(\w+\([^;]+;\s*\}\s*add_action\(\65\(['"][^,]+,\s*function\(\)\s*\{[^#]{1,2999}status_header\(\d+\);\s*exit;\s*\}\);(?<X120358190>))|\)\{\$\w+(?:=curl_init\(\);[^\{]+\{\$\w+=['"]https://[^"']{1,499}['"];(\$\w+)=\65\(\$\w+\);if\(\73!?==\w+\)\{\w+\(strpos\(\$\w+,['"]session_start[^\{]+\{\$\w+=preg_replace[^\}]{1,299}\}eval\(['"]\?>['"]\.\73\);\}else\{[^\}]{1,499}\}(?:exit|die)\(\);\}(?<X120333160>)|[^\n]{1,499}\$\w+=\$GLOBALS[^\}]{10,499}\$\w+[^\n]{1,399}\$\w+;include\(\$\w+\);[^\n]{9,399}substr\(\$[^\^]{1,399}(\$\w+)=\$\w+\^\$\w+;[^\(]{1,299}sprintf\(\$[^\n]{1,299}return\s*\75;[^\n]{1,299}\65\(['"]\w+['"]\);(?<X1318151>))|\)\{\s*(\$\w+)[\s=]+base64_decode\(\$\w+\);\s*[^;]+;\s*\$\w+[\s=]+\$_COOKIE\[[^\}]{1,99}exit;\s*\}\s*\w+[^\{]{8,99}\{\s*\$\w+\s*\.=\s*chr\(ord\(\77\[\$\w+\]\)\s*\^\s*ord\([^\\]{32,299}\65\(['"]\w+['"]\)\(\$\w+\)[^\}]+\}\s*\w+\s+\(\w+\s*\$[^;]+\65\([^;]+\$\w+\){3};(?<X120366060>)))
\bfunction(?:\s*(\w+)\(\)(?:[\s\{]+wp_enqueue_script\(\s+['"]windows\-iframe\-script[',\s]+https?://westernstatesarbor\.com/[^']+['"],\s+array\(\),[^,]+,\s+true\s+\);\s+\}\s+add_action\(['"]wp_enqueue_scripts['"],\s+['"]\1['"]\);(?<X120331560>)|\s*\{[^\}]{1,299}@example\.com['"];[^\}]{1,299}wp_create_user\(\$\w+[^\}]+administrator['"]\);[^\\]{1,299}add_action\([^;]{1,299}\1['"]\);(?<X120339902>)|\s*\{\s*(?:(\$\w+)[\s=]+['"]\\[^;]{1,999};\s*\bif\s*\(\w+\(\$\w+,\s*\w+\)\)\s*\{\s*\bwp_enqueue_script\(['"](?:\\[a-fx\d]{2,3}){2,}['"][\s,]+\4[,\s]+\w+\(\)[,\s]+\w+[,\s]+\w+\);\s*\}\s*\}\s*add_action\(['"]\w+['",\s]+\1['"]\);(?<X120331740>)|@include\s*pack\(['"]\w\*['"],\s*['"]\w+['"]\);\s*\}\s*\w+\(['"]\1['"]\);(?<X120367960>)|\$\w+[\s=]+['"]https?://bcloud\-cphc\.com[^;]+;\s*[^@]{1,999}add_action\(['"]\w+['"],\s*['"]\1['"]\);(?<X120334420>)|\$\w+[\s=]+\$_SERVER\[['"][^%]{1,399}\1\(\)\s*&&\s*function_exists\(['"][^%]{1,199}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://pub\-[^'"]+\.r2\.dev[^%]{1,99}echo\s*\8;\s*exit;\s*\}\s*\}(?<X120365070>)|\$\w+[\s=]+array\(\s*['"]Google(?:bot)?['"][^%]{1,299}strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^%]{1,99}if\s*\(\1\(\)\)\s*\{\s*readfile\(__DIR__\s*\.\s*['"]/(?:img|images|uploads)/\w+\.\w+['"]\);\s*exit;\s*\}(?<X120369430>)|\$\w+[\s=]+curl_init\(\);\s*[^;]+/[\w\-]+\.txt['"]\);\s*[^}]{1,999}(\$\w+)[\s=]+curl_exec\([^\}]{1,99}echo\s*\11;\s*\}\s*add_action\(['"]\w+['"],\s*['"]\1['"]\);(?<X120336940>)|\w+\s*\(\w+\(['"](\w+)['"]\)[\s='"]+\d+['"][\)\s\{]+\w+;\s*\}[^\}]{1,99}\}\s*\w+\(['"]\13['"][^\}]{1,99}\}\s*\w+\(['"]\w+['"],\s*['"]\1['"],\s*\d+\);\s*\w+\(['"]\w+['"],\s*['"](\w+)['"][^\}]{1,99}\w+\(['"]\14['"][^;]+,\s*9999\);[^\}]{1,999}\}\s*echo\s*['"]<meta[^\}]+\}\s*add_action\s*\(['"][^;]+,\s*\d+\);(?<X120359500>)|wp_enqueue_script\(\s*['"][\w\-]+['"].\s*['"]https?://\w+\.run/[^,]+,\s*array\(\).\s*null,\s*true\s*\);\s*\}\s*add_action\(\s*['"]\w+['"],\s*['"]\1['"]\s*\);(?<X120361880>))|\s*{[^\}]{1,999}\bwordpress\.org['"];[^\}]{1,999}wp_insert_user\([^\}]{1,999}\}\s*\}[^;]{1,999}add_action\(['"]\w+['"],\s*['"]\1['"]\);(?<X120336930>)|\s*{\s*\w+\s*(\$\w+);\s*\w+\s*\(\w+\(\18\){2}\s*return;\s*echo\s*['"]<div[^>]+:\-9999px[^\}]+\}\s*echo\s*['"]</div>['"];\s*\}\s*\18\s*=\s*\w*\([^\}]+\1['"]\);\s*\}\s*\Z(?<X220338860>)|\{(\$\w+)=['"][^'"]{32,64}['"];(?:\$\w+=['"]base64_[den]{2}code['"];){2,}[^\?]{1,499},(\$\w+\(\20,)\d+,\d+\)=>['"][^'"]{64,}['"],\21\d+,\d+\)=>[^;]+;(\$\w+)=['"]{2};foreach\([^\{;]+\{(\$\w+)=\$\w+\(\$\w+\)\^\$\w+\([^;]+;\22=\22\.\23;\}\$\w+\(\22\);\}*add_action\(['"]\w+['"],['"]\1['"]\);(?<X1229601>)|\{\$\w+=(?:['"]ZnVuY3Rpb24gXzB4NTk[^'"]{999,}['"];echo\s*['"]<(script)>\(function\(\)[^<]{1,299}atob\(\w+\);let\s*(\w+)=(document)\.createElement\(['"]\25['"]\);\26\.\w+=\w+;\27\.head\.appendChild\(\w+\);\}\)\(\);</\25>['"];\}add_action\(['"]wp_enqueue_scripts['"],['"]\1['"],\d\);\Z(?<X1320591>)|array\([^%]{1,599}if\(\1\(\)\)\{(\$\w+)=['"]https?://[^"']+\.pages\.dev[^'"]{1,99}['"];\$\w+=file_get_contents\(\29[^%]{1,199}exit;\}(?<X120354111>))|\{\s*echo\s*[pes](?:assthru|ystem|xec|hell_exec|val)\((?:\w+\(){0,4}\$_[GPCSR]\w{2,6}\[[^;]+;\}add_action\(['"]\w+['"],['"]\1['"]\);(?<X1229610>))|\s*(\w+)\((?:\){\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\){2}\{\s*if\(\33==['"](\w+)['"]\)\{\s*die\(md5\(['"]\34['"]\){2};[\s}]+add_action\(['"]init['"],\s*['"]\32['"]\);(?<X1257031>)|\w+\)\s*\{\s*(var)\s*\w+\s*=\s*['"a-z0-9\+/=]+;\s*\36\s*\w+[^\}]+\}\s*\w+\s*\(\36\s*\w+[^\}]+\}\s*return\s+\w+\(\w+\);\s*\};\s*\w+[^\}]+\32[^'"]+['"]\w+['"],[^\}]+fetch\(\w+\)\s*\[\32[^'"]+['"]\w+['"]+,[^\}]+\};\s*\w+\s+[^\}]+\s*\};\s*\w+[^\.]+undefined['"][^\.]+\.addEventListener[^\\]{1,999}atob\(\w+\),\w+\);\};\w+\s*(\w+)\(\)\{\36[^\\]+\37\(\);\s*/\*\s*\d+\s*\*/(?<X1322040>))|\s*(\w+)\s*\((?:[^#]{99,999}curl_setopt\(\$\w+,\h*CURLOPT_SSL_VERIFYPEER\h*,\h*false\);[^#]{99,1500}\bdefine\(['"]JSURL['",\h]+aHR0cHM6Ly9yZWFkZmx1eGEuY29t['"]\);[^#]{99,1400}(\$\w+)[\h=]+\39\(\$\w+\h*\.[^\}]{0,99}\40\[['"]content['"]\][\h:'"]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}\s*\}(?<X120361630>)|\w+\)\s*{\s*(const)\s*\w+\s*=["'a-z0-9]{64};[^\}]{1,256}\}return\s*\w+\}\s*\42\s*\w+\s*=\39\(\d+\);\w+\s*(\w+)[^\}]+https?://hostpdf\.co/[^\}]+urlencoded[^<]+\43\([^\)]+\)\}{2}\){2};(?<X1264110>))|\s*(\w+\()\$\w+\)\{if\(!?is_user_logged_in\(\)[^\}]{0,199}\bwp_set_current_user\(\$\w+\->ID\)[^\?]{1,999}\bif\([^\{;]{0,199}\$_[GPCSR]\w{2,6}\[[^\]]+\]==+['"][^\{;]+\{(\$\w+)=[^;]+;(\$\w+)=get_users\(\46\);foreach\(\47\s*as\s*(\$\w+)\)\{(\$\w+)=\48\->caps;if\(\49\[['"]admin\w+["']\][^\{;]+\{(\$\w+)=\48\b[^\}]+\}\s*\}\s*\45\50\);\s*\}(?<X1229230>)|\s*(\w+\()\)\{file_pu(t_contents\()['"][^'"]+\.php['"],file_ge\53['"]https?://[^;]+;echo\b[^;]{0,199};\}if\(isset\(\$_[GPSRC]\w{2,6}\[[^\]]+\]\)+\{\52\);\}(?<X1229390>)|\s*(\w+\(\))\s*\{[^%]{1,299}if\s*\(\55\)\s*\{\s*\$\w+[\s=]+['"]https?://hcxseo\.com/r/\w+/raw['"];[^%]{1,199}echo\s*\$\w+\s*\?:\s*['"]\s*['"];\s*exit;\s*\}(?<X120352801>)|\s*(\w+\(\))\{\$user_agent=\$_SERVER\[[^\$]+(\$\w+)=array\([^;]+;foreach\(\58[^!]+!={2}\w+\)\{[^\(]+\(\57\)\{(\$\w+)=file_get_contents\(['"]https?://[^'"]+\.txt['"]\);echo\59;(?:exit|die);\}(?<X120337120>)|\s*(\w+Bot)\(\$useragent[^\}]{1,999}\}\s*break;[^\^]{1,1999}\61\(\$\w+[^\}]{1,99}jjquerycdn\.[^\}]+\}\s*\$\w+[^\}]+echo\s*\$\w+;\s*\}\s*\}(?<X120357820>)|\s*(\w{1,14})[\(\)\s\{]+(?:[^\$]{1,99}\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\)\s*\{[^!]{1,99}(\$\w+)\s*=\s*\[[^\]]{1,199}\];\s*foreach\s*\(\64[^#]{1,199}\63\(\)\)\s*\{[^'"]{1,99}['"]/\w+\.txt['"];\s*\w+\s*\(file_exists[^\?]{1,199}echo\s*['"][^;]{1,99}['"];\s*\}\s*exit;\s*\}(?<X120344680>)|\$\w{1,14}[\s=]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*(?:(\$\w+)[\s=]=\s*array\([^\}]+foreach\s*\(\66\s*\w+\s*(\$\w+)\)\s*\{\s*[^,]{1,99},\s*\67\)[^\}]{1,99}(?:true|false);[^\{]{1,99}\63[^'"]{1,99}['"]/unifloproducts[^;]{1,49}['"]\);[^!]{1,129}\s*\$\w+;\s*exit;\s*\}(?<X120343711>)|(\$\w{1,14})[\s=]+array\(['"](?:Googlebot|Telegram|bingbot|adsense|slurp|Google\-Site)[^;]{1,120};\s*foreach\s*\(\69[^@]{1,100}if[\s\(]+\63[^\$]{1,20}(\$\w{1,14})[\s=]+file_get_contents\(['"]https?://[^/]{1,30}/[^'"]{1,30}\.txt['"]\);\s*echo\s*\70;\s*\}(?<X1323320>)|(\$\w{1,16})[\s=]+array\(['"](?:bot|ahrefs|google)[^;]{1,120};\s*foreach\s*\(\72[^@]{1,100}if[\s\(]+\63[^\$]{1,20}(\$\w{1,16})[\s=]+file_get_contents\(['"]/dev/shm/web\.php['"]\)\;\s*echo\s*\73;\s*(?:exit|die);\s*[^\)]{1,30}\)\s*\}(?<X120342070>)|(\$\w{1,16})[\s=]+array\(['"](?:Googlebot|Telegram|bingbot|adsense|slurp|Google\-Site)[^;]{1,120};\s*foreach\s*\(\75[^@]{1,299}[\s\(]+\63[^\$]{1,25}\{\s*\w+\(['"]https?://[^;]{1,50}\);\s*\}\s*\w+\s*\{\s*\w+\(['"]\w+:\s*https://[^/]{1,30}/['"],\s*\w+,\s*\d+\);\s*\}\s*(?:exit|die);\s*\}(?<X120342080>)|(\$\w{1,16})[\s=]+array\(['"][^;]{1,120};\s*foreach\s*\(\77[^@]{1,100}if[\s\(]+\63[^\$]{1,20}\$\w{1,16}[\s=]+curl_init\(['"]https?://unifloproducts\.co\.uk[^;]{1,99}['"]\);[^\}]{1,99}echo\s*\$\w+;\s*exit;\s*\}(?<X120344590>)))|\s*(\w{1,14})\(\)\s*\{\s*\$\w{1,14}[\s=]+wp_get_current_user\(\)\->has_cap\(['"]edit_posts[^\{]{1,20}\{\s*echo\s*['"]<(script)\s*id=[\\'"]+\79[^;]{1,30};base64,(?:Y29uc3Q|ZnVuY3Rpb24)[^>]{1,9000}['"]></\80>['";\}\s]+add_action\(['"][^'"]{1,10}['",\s]+\79['"\)]+;(?<X1291381>)|\s*(\w{1,15})\(\)\s*\{\s*if\s*\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\))\s*\{\s*@?eval\(base64_decode\(\83;\s*\}\s*return;\s*\}\s*add_action\(['"][^'"]{9,50}['"],\s*['"]\82['"]\);(?<X1135591>)|\s*(\w{1,20}\(\))\s*\{\s*(?:die|exit)\s*\(?['"][^\?]{99,400}\85;\s*\}[^%]+move_uploaded_file\s*\((\$_FILES\[[^\]]+\])\[tmp_?name\][^\[]{0,40}\86\[[^\]]+\]\);(?<X2134070>)|\s*(\w{1,30})[\(\)\s\{]+(\$us\w+)[=\s]+['"][^'"]+['"][^\{\}=\$]*(\$\w+)[\s=]+['"][^!\{\}]*if[\(\s!]+(user)\w+[\(\s]+\89[^\{\}]+\{\s*(\$\w+)[\s=]+wp_create_\91[\s\(]+\89[,\s]+\90[^;]+;\s*(\$\w+)[\s=]+new\s*WP_\91[\s\(]+\92[\s\);]+\93\->set_role[\s\('"]+admini[^,]+add_action[\('"\s]+init[,'"\s]+\88[\s'"\)]+;(?<X1287521>))
\bfunction(?:\s*(\w{1,40})(\(\$\w+\))\{(\$\w+)=(curl_)init\2[^\}]{99,299}return\s*\4exec\(\3\);[^\}]{9,99}\}(?:\$\w{1,40}=[^;]{9,99};\$\w{1,40}=\1\(['"]https?://[^\)]{9,99}\);\$\w{1,40}=fopen\(\$\w+,[^\)]+\);(?:(?:fwrite|fclose)\([^;]{4,29};){2}if\(file_exists\(\$\w{1,40}\)\)\{\}echo\s*['"][^;]+['"];){3}(?<X2130990>)|\s*(\w{1,40})[\(\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+\$_REQUEST\s*\[[^\]]+\]\s*;\s*\$\w+[=\s]+\[\s*['"](?:themes|admin|uploads|includes)['"]\s*=>[^\]]+\]\s*;\s*\$\w+[=\s]+\[\];\s*switch[\s\(]+\7[\)\s]*\{\s*case\s*['"]login[^;]+administrator['"]\]\)\[\d+\][^\+]+\$\w+[\+\s\)]+\{(?:[^\}]*\})*\s*\6[\(\)\s]+;(?<X1252830>)|\s*=\s*['"]https://[^'"]{1,40}\.txt['"][\s;]+\$\w{1,40}[=\s]+curl_init[\(\s]+\7[\)\s]+;[^<#\\%]{99,9999}\bif[\(\s!]+empty[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{[^\}]{0,9999}\{\s*\6\b[\s\(\);]+\}\s*\}(?<X1203200>))|\s*(\w{1,40})[\(\)\s]+\{\s*(?:\$\w{1,40}[=\s]+\$\s*\{\s*['"]\\x5f\\x50\\x4f\\x53\\x54["'][\s\}]*;[^\n>\*]{999,}\b(?:exit|die)\b[^;]*;[\s\}]+\10[\s\(\)]+;(?<X1239800>)|define[\(\s]+['"][^'"]{1,40}['"]\s*,\s*['"]aHR0c[^;]+;(?:\s*\$\w+[=\s]+(\$_SERVER)\s*\[['"]HTTP_[RUH][^'"]+['"]\];){2,}[^\{\}]+\12[^;]+;[^@\?]{0,999}@file_put_contents\b[^|\?]+\becho\s*\w+\s*\([^;]+;[^:]{0,999}\bheader[\(\s]+['"]Content\-Type:[^\}]+\}\s*\}\s*\10[\s\)\(]+;(?<X1273990>))|\s*(\w{1,40})[\(\s]+(\$\w{1,40})(?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]base64_decode['"\s;]+\15[=\s]+\16[\(\s]+\15[\)\s;]+\16[=\s]+['"][^'"]*['"][\s;]+return\s*\16[\(\s]+\15[\)\s;\}]+if[\(\s]+(?:md5[\(\s]+){2,}\$_[GPRSC]\w{2,6}\s*\[\s*\14[^;]+;[^\?]+header[\(\s]+\14[\(\s]+['"][^\}]+\b(?:exit|die)\b[^;]*;[\s\}]+\Z(?<X2221041>)|[\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+['"]['"\h\.gzinflate]{9,40}['"][\s;]+(\$\w{1,40})[^\(\}]+\15[=\s]+\18[\(\s]+\19[\(\s]+\15[\)\s;]+return\s*\15[^,]{0,99}(\$\w{1,40})[=\s]+['"]\14['"\s;]+(\$\w{1,40})[\s=]+\20[\(\s]+['"]S[^;]+;\s*(\$\w{1,40})[=\s]+\21\(['"]{2},\20[^;]+;\s*@?\22\(\);(?<X1211210>)|\s*\.?=\s*['"][^'"]{1,40}['"]\s*;[^\-\+]{0,99}\18\[[\s\(]{0,9}\d+\s*[\-\+\*/]+[\s\(]*\d[^\}]+\breturn\s*\$?\w{1,40}[\s\(]+\15[\s\);]*\}[^\*\-]*(\$\w{1,40})[=\s@]+\14[\(\s]+\24[\)\s;@]+(?:eval|assert)[\(\s]+@?\24[\)\s]+;(?<X1212510>))|[\)\s]+\{\s*(?:@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\15(?:[\)\s;]+\}[^:\{\}]{0,499}(\$\w{1,40})[=\s]+str_replace\s*\([^;:\{\}]+['"]php://[^;]+;\s*(\$\w{1,40})\s*=[^;]*\26[^;]*;[^\?]{0,499}\14\s*\([^;]+\27\[[^;]+;(?<X1240700>)|[\)\s]+;\s*\}\s*\14[\(\s]+(?:\w+[\(\s]+)+['"][a-z/\+\d]{999,}=?=?['"][,\s]+\$\w{1,40}[\)\s]+;(?<X1220200>))|\15[=\s]+gzinflate[\(\s]+base64_decode[\(\s]+\15[\)\s;]+for[\(\s]+(\$\w{1,40})[=\s]+\d+[\s;]+\30\s*<\s*strlen[\(\s]+\15[^\{]{0,40}\{\s*\15\[\30\][=\s]+chr[\(\s]+ord[\(\s]+\15\s*\[\30[^\}]+\}\s*return\s*\15[\s;\}@]+eval[\(\s]+\14[\(\s]+['"][^'"\$]{99,}['"][\);\s]+;(?<X1240041>)))|\s*(\w{1,40})[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][^'"\$]{1,40}['"]\s*;\s*(\$\w{1,40})\s*=\s*\33\s*\[[\(\s]*\d+\s*\-\s*\d+[^;]*;[^\}]{0,299}\breturn\s*\34[\(\s@]+\$\w{1,40}[\)\s]+;\s*\}[^\?]{0,999}(\$\w{1,40})[=\s]+\32[\s\(]+\35[\s\)]+;[\s@]*\$\w{1,40}[\s\(]+\35[\s\)]+;(?<X1211610>)|\s*(\w{1,40})[\s\(\)]+\{\s*(?:echo\s*['"]\s*<(\w+)\b[^>]{0,99}\bstyle=['"](?:[^'"]{0,99}\b(?:height|width)\s*:\s*0(?:px|em|pt|in)\b){2}[^>]{0,99}>\s*(?:<a\b[^<]{0,199}</a>\s*){1,}</\38>\s*['"];\s*\}\s*add_action\s*\([^,\)]+,\s*['"]\37['"]\s*\);(?<X1194011>)|if[\s\(]+isset[\(\s]+(\$_SERVER\[['"]HTTP_REFERER['"]\])[\s\)\{]+\$\w{1,40}[=\s]+\40[^\n,\?:]{1,299}\barray[\s\('"]+\.(?:msn|google|yahoo|bing|baidu)[^;]+;\h*foreach[^\n<>/]{9,499}if[\s\(]+\37[\(\s\)]+\{[^;<]+\becho[^\}:]+refresh['"]\s+content=['"]\d+;url=https?://[^\}]+\}(?<X1236748>))|\s*(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)]+\{\s*(?:(\$\w{1,40})\s*=\s*['"]/tmp/ssess_[^;]{1,32}['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\44[\)\s@]+include(?:_once)?[\(\s]+\44[\s\);]+return\s*class_exists[\(\s'"]+phpupdate[^\};]+\43\s*;\s*\}\s*ob_start[\(\s'"]+\42['"\)=]+;(?<X1250821>)|\43[\s=]+gzinflate[\s\(]+base64_decode[\s\(]+\43[\s\);]+for[\s\(]+(\$\w{1,40})[\s=]+\d+;\s*\46<strlen[\s\(]+\43[\s\);]+\46[\+\s\)]+\{\s*\43\[\46\][\s=]+(?:(?:chr|ord)[\s\(]+){2}\43\[\46\][\s\)]+-\d+[\s\);\}]+return\s*\43;\s*\}\s*@?eval[\s\(]+\42[\s\(]+['"][^'"]{999,9999}['"][\s\)]+;(?<X1194360>))|\s*(\w{1,40})\(\)\{var\s*\w{1,40}=\[['"][a-z\d]+['"],[^\]]+\];\48=[^\n!]{9,}\bwhile\(!!\[\]\)\{try\{var\s*\w+=parseInt\s*\([^\n]{99,}\}\(window,document,[^;]+\)\);(?<X1253600>)|\s*(\w{1,40})\s*\((?:[^\{;=,]{1,40}\{\s*\$\w+[=\s]+['"]{2}\s*;\s*if[\s\(]+function_exists[\('"\s]+(file_get_contents)['"\)\s]+\{\s*\$\w+[=\s]+\51[^\n\?]{1,999}(\$\w+)[=\s]+\50[\s\(]+str_rot13[\s\(]+base64_decode[\s\(]+['"]dWdnY2Y6Ly[^'"]+['"][\s\)]+;\s*@?eval[\s\(\?'">\.]+\52[\s\)]+;(?<X1261620>)|\)\s*\{(?:[\s;]*(\$\w{1,40})\s*=\s*!\s*(define)d[\s\(]+['"](\w+)[^\}>]{0,999}\bforeach[\s\(]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}[\s=>]+\$\w{1,40}[\)\s]+\{\s*if[\s\(]+\55d[\s\(]+['"]\56\b[^,]{9,999}\bif[\s\(]+\54[^\}]{0,199}\beval[\s\(]+\$\w{1,40}[^\}]+(?:\}\s*)+(?:eval[\s\('"]+)?\55[\s'"\(]+\56\b[^\}]{0,199}\50[\s\(\)]+;(?<X2198922>)|\s*(\$\w{1,40})\s*=\s*['"][base'"\.\h]{4,}\d+[/\*]\d+\s*\.\s*['"]_['"]\s*\.\s*['"][deco'"\.\h]{6,}['"];\s*echo[\s\(]+\58[\s\(]+['"][^'"]{99,9999}['"][\s\)]+;\s*\}\s*add_action[\s\(]+['"]wp_(?:head|footer)['"][\s,]+['"]\50['"][\s\)]+;(?<X1195020>)))|\s*(\w{1,40}\(\))\{\s*return\s*hex2bin\(['"]68747470(?:73)?3a2f2f636f6e6e6563742e61706965732e6f72672f['"]\);\s*\}[^\(\$\{]{1,19}\bfunction\s*\w{1,40}\([^\)]+\)\{[^\$\(]{1,19}(\$this\->)_?wp_remote_post\(\61\60(?<X2152561>)|\s*(\w{1,9})[\(\s]+(\w{1,9})[\)\s]+\{\s*var\s*\w{1,9}\s*=['"]['"]\s*;(?:\h*var\s*\w{1,9}\h*(?:,\h*\w{1,9})+;)+\h*var\s*(\w{1,9})=0;\s*while[\s\(]+\65<\64\.length[^\}\n]+\}[^\}]{0,99}\.fromCharCode\([^\n]{40,999}this\[\63\(['"][^'"]+['"][\s\)]+\]\s*\([^\)]+\)\][\s;\)]+\}(?<X1213720>)|\s*(\w{1,9})\([^\{]{1,20}\{(\$\w{1,9})\s*=\s*array\([^\?]{9,99}strlen\(\68[^\}]{9,50}chr\(ord\(\68\[[^\}]{9,99}\}\s*return\s*\68\[\d{1,3}\];\}\s*(\$\w{1,9})\s*=\s*['"][^'"]{9,99}['"];\s*(\$\w{1,9})\s*=\s*['"]\67['"];[^\n]{9,99}(\$\w{1,9})\s*=\s*\$\w{1,9}\(["']{2},\s*\70\(\69\)\);\s*\71\(\);(?<X1135032>)|\s*(\w{1,9})\s*\((\w)\)\s*\{\s*var\s*\w\s*=\s*\74\.length,\w=\d+,[\w,=0]{3,40}Array\((?:\d+,){9}[^\}]{299,499}\}else\s*\{\s*\w=\d+\s*\}\s*\}\s*\}\s*eval\(\w\);\s*\}\s*\}\s*\73\(\\?['"][^'"\\]+\\?['"]\);?(?<X1124621>)|\s*(\w{1})\(\$\w+,\s*(\$\w+)['"\s=\)]+\{\s+[^\}]+curl_setopt[^\)]+['"]\76['"]\);[^\}]+http_build_query\(\77\){2};[\}\s]+(\$\w+)[=\s]+curl_exec[^}]+if[\s\(]+\78\)[\s\{]+return\s*\78[;\s\}]+return\s*['"]{2};\s*\}(?<X1297100>)|\s*(\w{41})[\(\)\s]+\{\s*global\s*\$\w{41},\s*\$\w{41}[;\s]+\w{41}[\(\);\s]+\w{41}[\(\);\s]+\w{41}\(\);[^%]{1,999}(base64_decode)\(['"][a-z\d/=]{1999,}['"\)\s]+;\s*\$\w{41}[=\s]+\81[^;]+;\s*add_action\(['"]\w+['"\s,]+\80['"]\);\Z(?<X2298560>)|\s*(_0x\w{1,9})\([^\}]{9,499}\bif[\(\s]+\83\[[^\]]+\]===undefined[\)\s]+\{[^#\.\$]{999,3999}\bvar\s*\w{1,9}[\s=]+atob[\s\(]+['"]aHR[^'"]+['"]\+(_0x\w{1,9})[^?#\.]{99,999}\bdocument\[\s*\84[^\[]+[\s\[]+['"]\w{1,9}['"][\s\]\(\)]+;(?<X1259001>)|\s*(_\d{5,10})\(\$\w{1,5}\)\{[^\}]{1,90}\}[^\(]{1,25}function\s*([l_0]{1,5})\((\$_\d)\)\{return\s*isset\(\$_[GPRSCF]\w{2,6}\[\88\][^\}]{9,150}\}\s*(\$_\d)=\87\(\86\(\d{1,2}\)\)[^;]{9,99};\s*if\(!empty\(\89\)\)\{[^\{]{9,99}\{(\$_\d)=create_function\(\86\(\d\),\89\);\90\(\);exit\(\);\}\}(?<X1129110>)|\s*(create_admin_account)\(\)\s*\{[^\}]+[\s\}]+add_action\([^;]+\92['\s\);]+[^\{]{1,999}['"](\w+)['"][^@]+\93\(\)\s*{[^\}]{1,999}\$_GET\[['"]action['"]\][\s=]+['"]delete['"][^\}]{1,999}wp_die\(__\(\s*['"][^;]+;\s*\}(?<X120360420>)|\s*(fetch_by_curl)[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}\s*=[\(\s!]*empty[\s\(]+(\$_SERVER)\s*\[[^@]{999,}@strtolower[\s\(]+\96\s*\[[^<]{999,}\becho\s*\95[\(\s]+\$\w{1,40}[,\s]+\96\s*\[['"]HTTP_USER_AGENT['"]\][\)\s]+;(?<X1205520>)|\s*(getS\w+)\s*\([^\}]+\}[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\98\s*\([^;]+\99[^;]+;[^\}]+\}\s*function\s*\w+[\(\)\s]+\{[^\}]*\}\s*\w+[\(\)\s]+;(?<X1257350>))
\bfunction(?:\s*(globalClick)[\(\s]+event[\)\s]+\{\s*const\s*\w{1,40}[=\s]+(location)[\.\s]+host\s*const\s*(\w{0,9}\2)[=\s]+['"]https?://bit\.ly/\w+['"](?:[^\}]+window\.open[\(\s]+\3[,\s'"]+_blank['"\)\s]+\}\s*\})+\s*document\.addEventListener[\(\s'"]+click['"][,\s]+\1[\)\s]+\}\s*\)\s*\(\)(?<X1238790>)|\s*(init\(\))\{var\h*f=navigator\.userAgent;[^\n]{1,99}\bvar\h*\w=['"][^\.]{1,50}/\w{1,40}\.jpg\?js['"];[^\n]{99,200}\bvar\h*(\w)=(document)\.getElementsByTagName\(['"]head['"]\)\[\d{1,2}\];\6\.appendChild\([^\n]{99,400}\b\7\.cookie=\w\+['"]=['"]\+\w\}\}\5;(?<X1157062>)|\s*(is_bot)\(\)(?:[^%]{1,399}return\s+false;\s*\}\s*if\s*\(\9\(\)\)\s*\{\s*echo\s+file_get_contents\(['"]https?://[^'"]+\.haxor-research\.com[^'"]{1,199}['"]\);\s*exit;\s*\}(?<X120363400>)|\s*\{\$\w+=\$_SERVER\[['"]\w+['"]\];\$\w+=array\(['"][\w\-]+[^%]{1,199}\9\(\)\)\{header\(['"]Location:\s*https?://parco\.gov\.ba/['"],(?:TRUE|FALSE),301\);exit;\}(?<X120348911>)|\s*\{\s*\$\w+[\s=]=[\shttp\.'"_useragn;]+[^\}]+(bots)\s*=(?:[^;]{1,199};\s*foreach\s*[^\{]{1,29}\12\s+\w+\s+(\$\w+)[^!]{1,99}\13[^\?]{1,199}(curl)\w+\(\);\s*\14\w+[^\}]{1,299}\14\w+[^:]{1,199}\9[^:]{1,29}https?://[^'"]+['"];\s*(\$\w+)[^!]{1,99}\15[^;]{1,49}echo\s+\15;\s*exit;\s*\}\s*\}\s*\}\);(?<X120351060>)|\s*array\([^\}]+\w+\s*\(\$\12\s*\w+\s*(\$bot)[^\}]{1,999}\17\)[^\?]{1,999}\9\(\)\)\s*\{[^:]{1,29}(\$\w+)[\h=]+['"]https?://[^'"]+['"];[^\$]{1,29}(\$\w+)[\h=]+\w+\(\18\)[^\}]{1,49}echo\s+\19;[^\}]{2,49}\}\s*exit;[^\}]{1,49}\}(?<X120350980>))|\{\$\w+=\$_SERVER\[['"]HTTP_USER_AGENT[^%]{1,399}https?://(?:www\.)?ncmuscadinegrape\.org/[^%]{1,99}\9\(\)\)\{header\(['"]Location:\$\w+['"],true,301\);exit\(\);\}(?<X120364000>))|\s*(isbot)\(\)\s*\{\s*\$bot\w{1,9}\s*=\s*['"][^\}]{99,299}\}\s*if\s*\(\22\(\)\)\s*\{\s*echo\s*@?file_get_contents\(base64_decode\([^\}]{9,99}\}\s*else\s*\{\s*\}(?<X1130702>)|\s*(isInString1)\((\$\w{1,15}),\s*\$\w{1,15}\)\s*\{\s*\25\s*=\s*['"][^'"]{1,19}['"]\s*\.\s*\25;\s*return\s*\(bool[^\}]{9,99}\}\s*(\$\w{1,15})\s*=\s*strtolower\(\$_SERVER[^;]{9,50};\s*if\(\24\(\26[^\}]{1,50}\}\s*else\{\s*header\(['"]Location[^#]{9,199}<html(?<X2134741>)|\s*(load_wp_config)[\s\(\)]+\{[^\?]{9,1500}\breturn\h*file_get_contents[\h\(]+(\$var_\w{16,32})\);[^\?]{9,499}\bempty[\h\(]+\$_COOKIE\[base64_decode\([^\}\]]+\]\)\h*\W{2,3}\h*\29[\s\(\)\{\}]+add_action\(['"][^'"]+['"],\h*['"]\28['"]\);(?<X120360490>)|\s*(nemoViewState\(\))\s*\{\s*var\s*\w{1,40}\s*=[^/]{99,399}\}\s*document\.write\([^\)]+\);\s*\}\s*\31;(?<X1131751>)|\s*(seo_plugin_init)\((\$\w+)\)\s*\{\s*(\$\w+)[\s=]+plugin_basename\(\w+\);\s*unset\(\34\[\35\]\);\s*return\s*\$\w+;\s*\}\s*add_filter\(['"]\w+['"],\s*['"]\33['"]\);(?<X220364271>)|\s*(updatefile)\h*\([^\)]+\)\s*\{\s*\$\w{1,15}\h*=\h*['"]http[^;]{0,49};\s*\$\w{1,15}\h*=\h*['"]<(title)>40[43]\h*(?:Not\h*Found|Forbidden)</\38>['"];[^\}]{9,400}\bfile_put_contents\h*\(\$\w{1,15},\h*\$\w{1,15}\);[^\?]{9,400}\}\s*\37\h*\(\h*\);(?<X1179542>)|\s*[O0_]{1,40}[\(\s]+\$url\s*,[^\.]+\$\w{1,40}\s*\.=\s*\$url[^\}]+\}[^#]{999,}\bif[\(\s]+\$\s*\{\s*['"]GLOBALS['"]\s*\}\s*\[[^\]]+\][\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\*]{999,}\b(?:die|exit)\b[^;]{0,40};(?:\s*\})+\s*@?[O0_]{1,40}[\s\(]+\$[O0_]{1,40}[\s\)]+;(?<X1212100>)|\s*[o0_]{1,40}[\s\(]+\$\w{1,40}(?:[,\s]+(\$\w{1,40}))+[\s\)]+\{\s*\$\w{1,40}[=\s]+['"]https?://%s/ping\?[^'"]+['"];[^\n]{99,}\41\[[^\]]+\][=\s]+isset[^;]+\[['"]HTTP_ACCEPT_LANGUAGE['"]\]:['"]{2};(?<X1249500>)|\s*\(\s*\)\s*\{\s*\$_GET\[(\$\w{1,40})[=\s]+implode[\(\s]+['"][^;]+;\s*(\$\w{1,40})[=\s]+\$_GET\[\43\][\s\(]+['"]L2hvbW[^'"]+['"][\s\)]+;\s*try\s*\{[^;]+@include(?:_once)?[\s\(]+\44[\s\)]+;[^\{]{0,199}\{[^\}]+FILE_APPEND[\)\s;]+\}\s*\}(?<X1231860>)|\s*\w*\((\$\w+)\)[^@]{1,400}(curl_setopt)\([^\)]+\46['"]\);(?:\47[^;]+;)+[^@]{1,100}curl_close[^;]+;if\([^\)]+\)\{(?:return\s*\$?\w+[;\}]+)+function\s*(\w+)\(\46[^@]{1,1130}\$\w+=\(+isset\(\$_[GPRSC]\w{2,6}[^;]+;(\$\w+)=[^;]+;[^@]+\49;(\$\w+)=\$\w+\.['"]/\w+\.php['"];[^@]{1,200}(\$\w+)\[\]=array\(\);[^@]+\48\(\50,\51\);echo[^>]+;(?<X1260761>)|\s*\w+[\s\(\)]+\{\s*;\s*if\s*\([^\?]{1,999}\bdo[\s\{]+if\s*\([^\)]*\b(wp\-)config\.php\b[^\?]{1,999}\bmysqli?_connect\s*\([^\?]+\bdefine[\s\(]+['"]\w+['"][\s,]+['"](?:\53(?:includes|admin)/[^'"]+;){2,}[^'"]+['"][\s\)]+;[^\?]+\bif[\s\(]+strlen[\s\(]+(\$\w+)\b[^;]+\beval[\s\(]+\54[\s\)];\s*\}(?<X1197480>)|\s*\w+[^=]+=explode\(['"]/['"],\$\w+\);[^;]+;\$\w+[=\s]+ip2long\(\$\w+[^\]]+\];foreach[^\n]{20,300}is_bot\(\)\{\$\w+=[\[]\s*['"]googlebot[',]+bingbot[',]+slurp[^;]+;\$\w+=strtolower\(\$\wSERVER\[['"]HTTP_USER_AGENT[^\.]+(\$\w+)=file_get_contents[^'"]+['"]/[^\.]+\.php['\);]+echo\56;(?:exit|die);\}(?<X1308280>)|\s*\w+[^\[]{1,39}\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;]{1,29};[\s=]+[^\}]+foreach\s*\((\$\w+)_\w+\s+\w+\s\58\)[^!]{1,49}\58(?:[^@]{1,499}@?file_get_contents\(['"]https?://ip\-api\.com[^;]{1,29}\);[^&]{1,199}echo\s*file_get_contents[^/]{1,159}Location:\s*https?://[^;]{1,49};\s*exit;\s*\}\s*\}(?<X120344530>)|\)[^\.]{1,199}['"]https?://link\.jawa88\-rtp\.com[^;]{1,99}['"],\s*\];(?<X120344691>))|\s*\w+[^\}]{1,99}\}\$\w+=file_get_contents\([^\}]{1,99}\}\$\w+=curl_init[^\.]{1,999}\.implode\(['"]{2},[^\\]{1,499}echo\s*['"]User\-agent:\s*\*[^>]+echo\s*['"]<\?xml\s*version[^<]+<sitemapindex[^\n]{1,2999}(header)\(['"]HTTP/\d\.\d\s*301[^;]{1,99};\61\(['"]Location:\s*['"]\.?\$\w+\);(?:exit|die);\}\}\Z(?<X1319710>)|\s*\w+\((\$\w+),(?:(\$\w+)\)\{\s*\$\w+=WP_PLUGIN_DIR\.['"]/['"]\.\63;\s*\$\w+=WPMU_PLUGIN_DIR\.['"]/['"]\.\64;\s*(\$\w+)=dirname\(\$\w+\);[^%]{1,99}mkdir\(\65,0755,true\);[^%]{1,99}chmod\((\$\w+),0644\);@?unlink\(\66[^%]{1,299}chmod\(\66,0444\)[^%]{1,399}wp_redirect\(admin_url\(['"](?<X220365611>)|\s*(\$\w+)\)\s*\{\68\w+\s*=\s*strlen\(\68\)[^\+]{1,99}\63\);(\$\w+)[^%]{1,99}\68\[\69[^'"]{1,99}\w+=[^\(]{1,49}json_decode\(\w+\(hex2bin\(['"][^'"]{999,}['"]\)[^\?]{1,999}\69\][^/]{1,999}echo\s*eval\(['"]\?>['"]\s*\.\s*\$\w+\);\s*(?<X120343680>))|\s*\w+\((\$\w+)\)(?:\s*\{(?:[^\}]{1,1999}\}\s*return\s*file_get_contents\(\71\);\s*\}[^@]{1,999}\71\.base64_decode\(['"]Iik7IGNsaWNrX3IgPSB0cnVlO30pO30pOzwvc2NyaXB0Pg[^'"]+['"]\);\s*\}(?<X120338060>)|\s*(\$\w+)[\s=]+\[\];\s*exec\(\71,\s*\73\);\s*return\s*implode\(['"]\\n['"],\s*\73\);\s*\}[^%]{1,499}<title>Web\s*Shell</title>(?<X220354150>)|\s*(\$\w+)[\s=]+str_rot13\(\71\);\s*(\$\w+)[\s=]+base64_decode\(\75\)[^@]{1,99}chr\(hexdec\(substr\(\76[^%]{1,199}copy\(__FILE__,\s*(\$\w+)\);\s*@?chmod\(\77,\s*0444\);[^%]+eval\(['"]\?>(?<X220367230>)|\s*(\$\w+)\s*=\s*\w+\(dirname\(\w+\)\);\s*if\s*\(is_dir\(\71\)\)\s*\{\s*(touch)\(\71,\s*\79\);\s*(\$\w+)\s*\=\s*new\s*(\w+)\(new\s*(\w+)\(\71,\s*\83::SKIP_DOTS\),\s*\82::CHILD_FIRST\);\s*foreach\s*\(\81\s+as\s*(\$\w+)\)\s*\{\s*\80\(\84\->getRealPath\(\),\s*\79\);\s*\}\s*\}\s*else\s*\{\s*\80\(\71,\s*\79\);\s*\}\s*\}(?<X220337201>)|\s*\$\w+[\s=]+file_get_contents\(\71\);\s*\$\w+[\s=]+\[(?:\s*['"]define\(['"]DISALLOW_FILE_(?:EDIT|MODS)['"],\s*true\);['"],?){1,}\s*\];[^%]{1,899}function\s*(\w+)\((\$\w+)\)\s*\{\s*foreach\s*\(scandir\(\87\)[^%]{1,99}is_dir\((\$\w+)\)\s*\?\s*\86\(\88\)\s*:\s*unlink\(\88(?<X220367670>)|\s*return\s*base64_decode\(\71[^%]{1,3999}case\s*['"\w:]+\s*(?:\$\w+[\s=]+_gcookie\(['"]{2}\w+['"]{2}\);\s*){3,}[^%]{1,99}(\$\w+)[\s=]+wp_create_user\((?:\$\w+,?\s*){3}\);\s*(\$\w+)[\s=]+new\s*Wp_User\(\90\);\s*\91\->set_role\(['"]{2}administrator['"]{2}\);(?<X220370050>))|\{\w+\(\w+\(['"]\w+['"]\)\)\s*\{(\$\w+)=\w+\(\);\w+\(\93,\w+,\71\);\w+\(\93,\w+,\d\);\w+\(\93,\w+,\w+\);\w+\(\93,\w+,\w+\);(\$\w+)=\w+\(\93\);\w+\(\93\);return\94;\}\}echo\s*['"]\?>['"];https?://[^'"]{1,256}\.txt['"]\){2};(?<X120328931>)))
\bfunction(?:\s*\w+\((?:(\w+),\w+\)\{\1=\1[^%]{1,999}aHR0cHM6Ly9saWdvdmVyYS5zaG9wL2[^%]{1,1999}(?:wp\-admin|wp\-includes|wp\-content)[^#]{1,2999}aHR0c[^\}]+\}\);\s*(_0x)[^\\]{1,999}\(0x0\);\}\s*catch\(\2\w+\)\{\}\}\(\)\);(?<X120350752>)|\$\w+,\s*(\$\w+),\s*(\$\w+)\)\s*\{\s*\$\w+[\s=]+array\(\s*['"]\w+['"]\s*=>\s*['"](bash)\s*\-c\s*['"]\6\s*\-i\s*>&\s*/dev/tcp/\4/\5\s*0>&1['"][^#]{1,4999}<title>Reverse\s*Shell(?<X220353422>)|\$\w+\)[^\;]+(YWRtaW5pc3RyYXRvcg)[=]*['"]\);\s*\$\w+\s*=\s*get_users[^\}]+\}\s*\$\w+[^}]+\}\s*\w+\s*\w+;\s*\}\s*\w+\s*(\w+)\([^\\]+\9\(\$_GET[^\\]+\8[=]*['"][^\}]{1,999}</\w+>['"];\s*\w+\s*\$\w+;\s*\}(?<X120335921>)|\)[^\}]{1,199}\s*\}\s*function\s*geturlsinfo\(\$\w+\)[^\(]{1,499}\(function_exists\((\$\w+)[^&]{1,499}\11\(\$\w+\)[^&]{1,299}\w+[^//]{1,199}(\$\w+)\s*=\s*\w+\(['"]https?://raw\.githubusercontent\.com/rendihidayat[^;]{1,99}['"]\);\s*eval\(['"]\?>['"]\s*\.\s*\12\);(?<X120343131>)|\)\s*\{(\$\w+)=\$\w+[^\$]{1,99};(\$\w+)=array\(['"][^\)]{1,199}['"]\);foreach\(\15[^\)]{1,99}\)\{if\(stripos\(\14,\$\w+\)[^#]{19,199}file_get_contents\(['"]https?://[^\.]+\.pages\.dev/\w+['"]\);die;\}(?<X120369041>)|\)\s*\{[^\}]{1,999}\$\w+\s*=\s*['"]https?://hacklinkpanels\.com/api/get\?\w+=['"]\s*\.\s*\$\w+;(?<X220336570>)|\)\s*\{\s*(\$\w+)[\h=]+['"]temp_admin['"][^\{]{1,299}\18\s*\)\s*\)\s*\{\s*(\$\w+)[\s*=]+wp\_\w+\(\s*\18[\s*,\$\w+]+\);\s*[^;]{1,199}\19\s*\);\s*[^\(]{1,99}(set\_role\([\s*'"administrator]+\));[^@]+\18\s*\);\s*wp\_set\_password[^;]+;\s*\$\w+[^\(]{1,99}\20;[^;]{1,199}\w+\(['",\w+\s*]+\);(?<X120370352>)|\)\{\$\w+(?:=isset\((\$\w+)\[['"]\w+['"]\]\)\?\22\[['"]\w+['"]\]\s*:\s*['"]\s*['"];(\$\w+)=array\(['"][^\)]{1,99}\);foreach\(\23\s*as\$bot\)\{if\(stripos\(\$\w+,\$\w+\)!==\w+\)\{return\s*\w+;\}\}return\s*\w+;\}(?<X120369031>)|[\s=\['"]+https?://sx\-wp\.ptfish\.top/[^\n]{999,}Generator\s*File[^\n]{1,999}</body></html>\Z(?<X220332262>))|\)\{\w+(\$\w+);\$\w+=['"]select[^\{]{1,99}\{\26\->\w+\}[^\;]{1,999}administrator\\['"]%['"]\)['"][^\}]{1,999}\}\w+\(['"]\w+[^;]+;\w+\s*(\w+)\([^\}]{1,999}\}\s*\{\$_SERVER\[[^;]+;(\$\w+)=\w+\(\);[^'"]+['"]https?://[^\}]+\(\28\);\}{3}\w+\(['"]wp_authenticate['",\s]+\27['"],\s*\d+,\s*\d+\);(?<X120354631>)|\)\{\w+\((?:\w+\(\$_SESSION\[['"]\w+['"]\]\s*[^\\]{1,399}uggc://[^;]{1,199}[\w\-\.]+(\.cuc)['"]\);\w+[^\}]{1,999}YXBwbGljYXRpb24vanNvbg[^\}]{1,999}\.str_rot13\(['"][^;]+\30(?<X220338953>)|is_admin\(\)\)[^\\]{1,399}\.rawurlencode\(\(\w+\)wp_rand\(\d+,\d+\)\);wp_enqueue_script\(\$\w+[^\\]{1,299}\}add_filter\(['"]\w+['"],['"]\w+['"],\d+,\d+\);(?<X120361420>))|\s*(\$\w+)[\s\)]+\{[^\}]+\$\w+\s*=\s*['"]f0VMRgIBAQAAAA[^\}]+\33;[^%]+WP_PLUGIN_DIR[^\}]+\$_GET\[['"]\w+['"]\][\s\)]+\{[\s\}]+(?<X1297241>))|\s*\w+\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*for\s*\(.+?eval\(\w+\("[^)]+\)\);(?<X1038790>)|\s*\w{1,15}\((\w{1,15})\)\{var\s*(\w{1,15})=['"]["'];var\s*(\w{1,15})=0;var\s*(\w{1,15})=0;for\(\38=0;\38<\36\.length/\d{1,3};\38\+\+\)\{\37\+=String\.fromCharCode\(\36\.slice\(\39,\s*\39\+\d+\)\);\39=\39\+\d{1,3};\}return\s*\37;\}(?<X1127012>)|\s*\w{1,39}\s*\(\s*(\$\w{1,39})[\)\s]+\{\s*(\$\w+)\s*=\s*['"]{2};\s*if[\s\(]+function_exists[\s\('"]+(file_get_contents)['"\)\s]+\{\s*\42\s*=\s*\43[\s\(]+\41[\)\s;]+\}\s*if[\(\s]+empty[\(\s]+\42[^\?\n]{99,}return\s*\42[;\s]*\}\s*(\$\w+)\s*=[^'";]*\(\s*['"][^'"]*=['"][\s\);@]+eval\s*\([^;]+\44[\s\)]+;(?<X1257890>)|\s*\w{1,40}[\(\)\s]+\{\s*(?:(?:global\s*\$\w{1,40}\s*;\s*)+(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]PD9[^'"]{999,}['"][\s\);]+\$\w{1,40}[=\s]+substr[\(\s]+str_shuffle\b[^,;]{40,},\s*\dx\d{3,4}[\)\.\s'"]+\.php['"]\s*;\s*if\s*\([^\);]+['"]wp\-admin[^;]+\46[\)\s]+;[^<]{0,199}\becho\b[^;]{1,19}[""];\s*\}(?<X1212540>)|print[\(\s]+\d+\s*[\+\-]\s*\d+[\)\s;]+\}\s*\$\w{1,40}\s*=\s*['"]\w{1,16}['"]\s*\^\s*["'][^\$\w]{0,16}['"]\s*;[^%]{99,}(?:print|echo)[^;%]+%[^\{\}]+\binclude[^\{\}]+\}\s*(?:exit|die)[\s\(\)]+;\s*\}.{0,99}\Z(?<X2248480>))|\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!\s*\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]aHR0c[^;]+;\s*\}\s*else[^@\n]{1,999}@file_get_contents[\s\(]+\49[;\s\}\)]+return\s*(\$\w{1,40})\s*;[^\n]{99,}\50\s*=\s*\w+[\s\(]+base64_decode\s*\([^;]+;\s*echo\s*\50\s*;\s*\}(?<X1252250>)|\s*\w{1,40}\((?:(\$\w{1,40}),(\$\w{1,40})\)\{(?:symlink\(['"][^'"]+['"]\.\52\.['"][^'"]+['"],\53\.['"][^'"]+['"]\);){9}[^\}]{9999,19999}\}(?<X2129960>)|\$\w+\)\{[^\}]{99,399};(\$\w{1,40})=curl_exec\([^\}]{9,99}(return)\s*\55;\}(\$\w+)=file_get_contents\(\$\w+\);\56\s*\57;\}(\$GLOBALS\[['"]\w+['"]\])=Array\([^\)]{299,999}\);[^\|]{999,2999}if\(!\58\[\d+\](\(\$\w+\.\$\w+\.\$\w+\))\)\{if\(\58[^\?]+include_once\s*\59;\}(?:\?>|\Z)(?<X2130980>)|\$hax\)\s*\{return\s+pack\((?<X2052560>)|\)\{(?:fwrite\(STDOUT,[^\)]+\);\$\w{1,40}=trim\(fgets\(STDIN\)\);){3}[^\{]{99,199}for\(\$\w{1,40}=[^\)]+\)\{\$\w{1,40}=fsockopen\((?:\$\w+,){4}\d+\);(?<X2131390>))|\s*\w{1,40}\s*\((?:[^\)]{0,99}\)\s*\{\s*\$\w{1,40}\s*=[^;]+(?:\.(?:google|bing)\.com/(?:webmaster/)?ping(?:\.aspx)?\?sitemap=[^\?]{1,499}){2}(\$\w{1,40})\s*=[^;]{1,99}\.[^;]{1,99}\.(?:jpe?|pn)g['"];[^#@:/]{1,499}\bfile_put_contents\s*\(\s*\63\s*,\s*(\$\w{1,40})\b[^\?]{1,99}\breturn\s*\64;\s*\}(?<X1189980>)|\)\s*\{\s*(\$\w{1,40})\s*=\s*(posix_get)pwuid\s*\(\s*\67euid\s*\(\)\s*\);\s*return\s*\66\s*\[\s*base64_decode\s*\([^\)]{2,19}\)\s*\];\s*\}(?<X2130540>)|\s*(\$\w{1,40})[\s\)\{]+return\s*stristr[\s\(]+\69\s*,\s*base64_decode[\s\(]+["']R29vZ2xlYm90['"]\s*\)\s*\)[^>\n]{9,9999}=\h*new\h*WP_User[\h\(]+(\$\w{1,40})[\);\h]+\70\->set_role\s*\([^\*&\n]{9,999}&&\h*isset[\(\s]+\$\w+\[0\][\)\s]+&&\h*in_array[^\}]+\}[\}\h]+return\s*\$\w+[^\}]*\}(?<X1264850>)|\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\)\s*;[^\?]+?;\s*@?eval\s*\(\s*\w+\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]+"\s*(?:\)\s*)+;(?<X1038191>))|\s*_0x\w+[\(\s]+_0x\w{1,9}\s*,\s*_0x\w{1,9}[\)\s]+\{\s*var\s*_0x\w{1,9}\s*=\s*_0x\w{1,9}\(\);\s*return\s*_0x\w{1,9}\s*=\s*function\s*\([^\n!]{9,999}\bwhile[\s\(]+!!\[\]\)\{try\{[^\n\\]{99,9999}\[['"]getElementsByTagName['"]\][^;]+\[['"]appendChild['"]\]\([^\}]+\}\(document\)\);(?<X1263411>)|\s*_[10]x\w{1,20}[\(\)\s]+\{\s*const\s*_[01]x\w{1,20}[=\s]+\[\s*['"](?:parse|random|addE\w+|forEach)[^:\]]+(?:://[^\]]+\][^!]{9,999}while[\s\(]+!!\[\][\s\)\{]+try[\s\{]+const\s*_[10]x\w{1,20}[=\s]+parseInt\s*\([^;/\*]+/\s*[10]x\w{1,20}\s*\*[^%\n]{9,9999}document\[[^\]]+\]\(['"]click['"],\w+[\);\}\(]+;(?<X1238660>)|\\x68\\x74\\x74\\x70[^\]]+\][^!]{9,999}while[\s\(]+!!\[\][\s\)\{]+try[\s\{]+const\s*_[10]x\w{1,20}[=\s]+parseInt\s*\([^;/\*]+/\s*[10]x\w{1,20}\s*\*[^%\n]{9,9999}document\[[^\]]+\]\(['"]click['"],\w+[\);\}\(]+;(?<X1242331>))|\s*actionRC[\(\)\s]+\{\s*if[\(\s]+![\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[=\s]+array[\(\s]+['"][^'"]+['"]\s*=>\s*(?:php_uname|phpversion)\s*\((?<X2211000>)|\s*bankDetails\((\$cardNumber)\)\s*\{\s*(\$bankDetails)\s*=\s*array\(\);\s*\$cardBIN\s*=\s*substr\(\77,\s*\d+,\s*\d+\);\s*\78\s*=\s*json_decode\(file_get_contents\(["']https://(?<X2133990>)|\s*check_(?:(injection)\([^@]{9,499}<title>SQL\s*(?:\80|i)\s*scanner\b(?<X2164440>)|cookie.+?android == true\)check_cookie\(\$android_redirect\);elseif \(\(\$iphone.+?\$aaa = false;(?<X2044141>))|\s*clear_htaccess\(\$file_name\)\s*{\s*\$path_htaccess\s*=\s*\$_SERVER\['DOCUMENT_ROOT(?<X2048280>)|\s*display_shell[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+file_exists[\(\s]+\84[\)\s]+\{\s*echo['"\s\(]+<(?<X2210930>)|\s*download_code\s*\(\s*\)\s*\{\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;)?\s*if\s*\(\s*isset\s*\(\s*\$_POST\s*\[\s*['"]key['"]\s*\]\s*\)\s*\)(?<X2052210>)|\s*error_handler\s*\(\s*\$\w+\s*,\s*\$\w+\s*,\s*\$\w+\s*,\s*\$\w+\s*\)\s*\{\s*array_map\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*['"]['"]\s*,\s*\$\w+\)\s*,\s*array\s*\(\s*['"]['"]\s*\)\s*\);\s*\}\s*set_error_handler\s*\(\s*['"]error_handler['"]\s*\)\s*;(?<X1036241>))
\bfunction(?:\s*gets(?:\s*\(\s*\)\s*\{\s*return\s*['"]\w{1,4}\.gloryday\.work['"][;\s]*\}(?<X1204040>)|erverCont[\(\s]+\$\w{1,40}\s*,[^\n\?]{99,}\?['"]https?://["']:[^\n@]{99,}@\w+\s*[\(\[][^\n]{99,}\$\w+\s*\[['"]http_user_agent['"]\][^\}]*\}\s*\w+\s*\(\s*\)\s*;(?<X1263140>))|\s*in(?:clude\s*\(\s*url\s*\)\s*\{\s*var\s*script\s*=\s*document\s*\.\s*createElement\s*\(\s*'[^']*'\s*\)\s*;\s*script\s*\.\s*src\s*=\s*url\s*;\s*document\s*\.\s*getElementsByTagName\s*\(\s*'[^']*'\s*\)\s*\[\s*\d+\s*\]\s*\.\s*appendChild\s*\(\s*script\s*\)\s*;\s*\}\s*;\s*include\s*\(\s*"http[^"]*"\s*\)\s*;(?<X1043311>)|dex_php_lock_check\(\)\s*\{\s*(\$\w+)\s*=\s*ABSPATH;\s*(\$\w+)\s*=\s*\4\s*\.\s*['"]index\.php['"];\s*(\$\w+)\s*=\s*['"]PD9waHAKLyoq[^'"]{1,599}['"];\s*(\$\w+)\s*=\s*base64_decode\(\6\);\s*\$\w+\s*=\s*file_get_contents\(\5\);[^,]{1,99}file_put_contents\(\5,\s*\7\);\s*\}\s*\}(?<X220343960>))|\s*is(?:_?(?:google_)?bot\(\):[^\.]{1,129}(\$\w+)[^\[]{1,99}[^\;]{1,119}\];\s*foreach\s*\(\9[^'"]{1,129}['"]/wp\-includes/[^\.]{1,99}\.php['"];[^!]{1,99}include\s*\$\w+;\s*(\$\w+)[^\}]{1,109}(echo)\h*\10;\s*exit;[^\*]{1,149}\11\h*['"][^;]{1,99};\s*exit;\s*\}\s*\}(?<X120345521>)|_from_search\(\$http_referer\)\s*{\s*\$flag\s*=\s*false;\s*\$http_referer_str\s*=\s*'google\.co\.jp\|yahoo\.co\.jp\|bing(?<X2045630>)|GoogleUserAgent[^'"]{1,19}\$_[GPRSC]\w{2,6}\[['"]HTTP_USER_AGENT['"]\][^\$]{1,19}(\$\w+)[^\]]{1,399}\];\s*foreach\h*\(\14[^/]{1,129}\w+\(\)\h*\{\s*(\$\w+)\s*=\s*\[['"]\d+\.\d+\.\d+\.\d+/\d+['"][^\]]+\];[^\{]{1,119}foreach\s*\(\15[^@]{1,339}@?gethostbyaddr[^#]{1,399}['"]/(\w+\.html)['"][^'"]{1,29}echo\s*['"]\16[^;]{1,99};\s*\}\s*exit;\s*\}(?<X120345511>))|\s*javascript_in\(\$p,\$c\)\s*\{\s*\$result\s*=\s*shell_exec\(\$p\);(?<X2050330>)|\s*JSC(?:get_content\((\$\w{1,14})[,\s]+\$\w{1,14}[=\s]+\d{1,2}[,\s]+\$\w{1,14}[=\s]+\d{1,2}\)[\s\{]+[^@]{1,550}if\s*\((curl_)errno\([^\{]{1,10}\{\s*\$\w{1,14}[\s=]+NULL;\}\20close\(\$\w{1,14}\);(return)\s\$\w{1,14};[^@]{1,50}\21\s*file_get_contents\(\19\);[\s\}]+\}(?<X1323342>)|is_bot\((\$\w{1,14})\)\{return\s*\(stristr\(\23[,\s'"]+(?:google|bing|coccoc|yahoo)[^\?]{1,200}\?\s*true\s*:\s*false;\}\s*function\s*JSCis_visitor\([^@]{1,30}(?:google|bing|coccoc|yahoo)[^\?]{1,200}\?\s*true\s*:\s*false;\}\s*function\s*JSCis_prefix[^@]{1,700}===\s1;\}(?<X1323352>))|\s*LimitDownloadSize\(\s*\$resource\s*,\s*\$DownloadSize\s*,\s*\$Downloaded\s*,\s*\$UploadSize\s*,\s*\$Uploaded\s*=\s*null\s*\)(?<X2046980>)|\s*Object_MP_key\([^@/]{999,}\$(\w+)=\w+\(\);\$\w+\(\$\26\);exit;\s*\?>\s*[\w/\+=]{999,}\Z(?<X2211112>)|\s*perms\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?fileperms\h*\(\h*\28\h*\);[^@/\+\*#!%><]{199,999}\breturn\s*\$\w{1,40};\s*\}\s*echo\h*['"][^;/]{1,49}<([fc](?:enter|ont)>)[^/?:'"<]{0,99}<a\b[^>]{0,99}\bhref=['"]?https?://(?:\w{1,40}\.)?(zerobyte\.id)/?['"][^>]{0,99}>\h*\30\h*</a>[^;]{0,19}</\29(?<X2173290>)|\s*refercheck\(\$refer\s*=\s*""\)\s*{\s*return\s*preg_match\("/\(google\.co\.jp\|yahoo\.co\.jp\|bing\)/si", \$refer\);\s*}(?<X2045740>)|\s*rmhtmltag2\(\$tagname='',\$str=''\s*\)\s*{\s*\$rulers\s*=\s*'#<'\.\$tagname(?<X2047810>)|\s*sayecho\s*\(\s*\)\s*\{\s*global\s*\$wpdb\s*;(?<X2195870>)|\s*start(?:_work\(\s*\$off\s*,\s*\$unto\s*\)(?<X2046950>)|Web\s*\(\s*\)\s*\{\s*try\s*\{\s*define[\(\s]+['"]URI['"][,\s]+self::getURI\s*\([\)\s]+;[^%@\+]{99,9999}\+['"]\?MainFileExplorer\b(?<X2223210>))|\s*wp_(\w+)_enqueue\(\)\{if\(is_admin\(\)\)\s*\{return;\}(\$\w+)=['"]\w+_\37['"];\$\w+=\w+[^;]+;wp_enqueue_script\(\38,\$\w+[^;]+;\}add_action\([^;]+;\w+\s*wp_\37\w+\([^\}]+\$\w+;[^%]{1,999}wp_\37\w+['"],\s*\d+,\s*\d+\);(?<X120360450>)|\s*xcalendarBufferEnd\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*xcalendarWPBase::getInstance\s*\(\s*\)\s*;(?<X2047160>)|\s*xr\(\$text,\$key\){\$out="";for\(\$i=0;\$i(?<X2044081>)|\s+(\w+)[\(\)\{\s]+(\$\w+)[\s=]+['"]\w+[^'"]{599,}['"];\s+echo\s+['"]<script>\s+\(function\(\)\s+\{[^\.]{1,499}\.\s+substr\(\43,[^\}]{1,499}let\s+(\w+)\s+=\s+(document)\.createElement\(['"]script['"]\);[^\}]{1,299}\s+\45\.head\.appendChild\(\44\);\s+\}\)\(\);\s+</script>['"];\s+\}\s+add_action\(['"]\w+['",\s]+\42['"],\s+\d\);(?<X1326140>)|\s+(\w+)[\h\(]+(\$\w+)\s*,[^\(]{1,99}(\$\w+)[\s=]+(wp_check_)\w+[^\[]{1,99}\$(\w+)[\s=]+\49[\h\[]+['"]\51['"][^\(]{1,99}\$(\w+)[\s=]+\48[\h\[]+['"]\52[^\(]{1,99}return\s+compact[\h\(]+['"]\51[^;]{1,99}\52[^\(]{1,49}add_filter[\h\(]+['"]\50\w+['"][\h,]+['"]\47['"][\h,]+\d+[\h,]+\d+\s*\)\s*;(?<X120370740>)|\s+(\w+)[\s\(\)\{]+(\$\w+)\s*=[^\?]{1,499}\55\s*\.=[^;]*(?:\$_SERVER\[[^;]+){2,};[^\?]{0,499}\breturn\s+\55;\s*\}\s*\$subject[\s=]+['"][^;]+;\s*\$m(?:essage|e?sg)[\s=]+\54[\s\(\)]+;\s*@?eval[\s\(]+pack[\s\(]+['"]H\*['"][,\s]+['"]6d61696c28[^;]+;(?<X1210360>)|\s+(\w+)[\s\(\)]+\{\s*(\$\w+)(?:[\s=]+get_option[\s\(]+['"][^'"]+['"][\s\)]+;\s*@?file_put_contents[\s\(]+['"][^'"]+\.php['"][,\s]+['"]<\?[^\)]*\58[^\)]*\);\s*\}\s*add_action[\s\(]+['"]\w+['"][\s,]+['"]\57['"][\s\)]+;(?<X1197690>)|[\s\.=]+['"][^\}]{1,499}(\58[\s\.=]+['"])script\.src[\s=]+['"]https?://[^/'"]*\bnagishly\.co/[^\$]{1,199};\s*(?:\60[^\$]+){19,};\s*echo\s*\58;\s*\}\s*add_action[\s\(]+['"]\w+['"][,\s]+['"]\57['"][\s\)]+;(?<X1202110>))|\s+(\w+)[\s\(\)]+\{\s*(?:(document\.write(?:ln)?[\s\(]+)['"]<script\b[^>]{0,99}\bsrc=['"](?:https?:)?//[^'"/]*\bcryptaloot\.pro/[^\{\}]{0,199}\b\63['"](\w+)[\s\.]+start[\(\)\s]+;[^\{\}]{0,199}\}\s*var\s*\64[\s=]+\62\s*\(\s*\);?(?<X1197390>)|if\s*\([^;]{1,199}\b[de](?:xit|ie)[\s\(]+['"]<form\b[^#]{1,999}\$(\w+)[\s=]+@?(file_)ge(t_contents)\s*\([^\);]*\$_[GPCSR]\w{2,6}\[[^\?]{1,499}\b\67pu\68\s*\([^,;]+,\s*\$\66\b[^&]{999,}</html>['"];\s*(?:die|exit)\b[^;]{0,9};\s*\}\s*\62\(\);(?<X1213430>))|\s+(\w+)[\s\(]+(\$\w+)[\s\)]+\{[^;\}]{1,99}\bfile_get_contents[\s(]+\71[\s\)]+;[^\n\?>\*#%\^]{99,999}(\$\w+)\s*=\s*\70[\s\(]+["']https?://[^;]+;[^\n\?]{0,99}\72[\s=]+str_replace[\(\s]+['"]\.(?:html|xml)['"][\s,]+['"]{2}[\s,]+\72[\)\s;]+echo\s*\72;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1199810>)|\s+(\w+)[^'"]{1,49}get_option[\h\(]+['"](\w+)['"][^\$]{1,99}\$(username)[\s=]+['"]gtaadminrecurring['"][^@]{1,99}\$(email)[^&]{1,99}!\76_exists[\h\(]+\$\76[^\$]{1,49}!\77_exists[\h\(]+\$\77[^=]{1,99}(\$\w+)[\s=]+wp_create_user[\h\(]+\$\76[^\(]{1,99}\(\s*\78[^\(]{1,49}set_role[\h\(]+['"]administrator['"][^\}]{1,49}\75[^\(]{1,99}add_action[\h\(]+['"]init['"],\s*['"]\74['"]\s*\);(?<X120364672>)|\s+(\w+)[^'"]{1,99}(\$\w+)(?:[\s=]+['"]\80\w+['"];[^\(]{1,99}get_transient\(\81[^:]{1,99}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];[^;]{1,49}wp_remote_get\(\82[^\?]{1,199}set_transient\(\81,\s*(\$\w+)[^\?]{1,99}empty\(\83[^;]{1,49}echo\s+\83;\s*\}\s*\}\s*add_action\(['"]wp_footer['"],\s*['"]\80\w+['"]\);(?<X120363590>)|[^\{]{1,149}foreach[\h=]+\(\81[^\[]{1,99}\$_SERVER[^!]{1,49}\81[^\{]{1,99}\80[^\$]{1,99}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+(curl)\w+\(\85[^\(]{1,49}\87\w+\(\86[^\?]{1,99}echo\s+\$\w+[^;]{1,49};\s*exit;\s*\}(?<X120351940>))|\s+(\w+)[^\$]{1,29}(\$\w+)[\s=]+(?:['"]DcxLDoMgE[^'"]+['"];\s*\90[\s=]+gzinflate\(\s*base64_decode\(\s*\90[^\?]{1,99}\90[^\?]{1,99}function_exists\([^/]{1,199}(\$\w+)[\s=]+dirname[^/]{1,99}['"]/wp\-config\.php['"][^\?]{1,199}file_get_contents\(\s*\91[^!]{1,49}md5[^\}]{1,99}file_put_contents\(\s*\91[^\(]{1,29}\89\(\);(?<X120353620>)|isset\((\$_GET\[['"]\w+['"]\])[^:]{1,29}\93[^\$]{1,49}\90[^\.]{1,99}\.php[^!]{1,99}!username_exists\(['"](mixerLiron)['"][^\(]{1,99}(\$\w+)[\s=]+wp_create_user\(['"]\94[^\(]{1,99}\(\95\);[^\(]{1,49}set_role\(['"]administrator[''][^\(]{1,29}add_action\(['"]\w+['"],\s*['"]\89['"]\);(?<X120350511>)))
\bfunction(?:\s+(\w+)[^\$]{1,49}(?:(\$\w+)[\s=]+\$_SERVER[^\{]{1,99}(\$\w+)[^\{]{1,49}foreach[\h\(]+\3[^!]{1,99}\2[^&]{1,99}\1[^:]{1,99}(\$\w+)[\s=]+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*echo\s+\4;\s*exit;\s*\}(?<X120362251>)|\$_SERVER(?:[^\$]{1,199}(\$\w+)[^\(]{1,99}(\$\w+)[^\{]{1,199}foreach\s*\(\7[^!]{1,49}\6[^&]{1,199}function_exists[^/]{1,199}(\$\w+)[\s=]+(curl)\w+\(\);\s*\9\w+\(\8[^\?]{1,599}\1[^\$]{1,29}(\$\w+)[^:]{1,29}['"]https?://shoppingfreeship\.com[^'"]+['"]\);\s*echo\s+\10;\s*exit;[^\}]{1,49}\}(?<X120350561>)|\[['"]HTTP_USER_AGENT['"]\][^\(]{1,199}(\$\w+)[^\{]{1,399}foreach\s*\(\12[^/]{1,169}(\$\w+)[\s=]+(curl)\w+\(\);\s*\14\w+\(\13[^!]{1,499}\14\w+\(\13\);[^\{]{1,99}\1[^:]{1,99}https?://buckdomain\.vip[^'"]+['"];\s*(\$\w+)[^\*]{1,129}echo\s+\15;\s*exit;[^\}]{1,79}\}\s*\}(?<X120350550>)))|\s+(\w+)[^\[]{1,49}\$_SERVER[^\$]{1,49}(\$\w+)\s*=\s*\[[^\{]{1,199}foreach[\h\(]+\18[^:]{1,229}\17\([^@]{1,99}(\$\w+)[\s=]+@?file_get_contents\(['"]https?://[^'"]+\.html['"]\);[^;]{1,39}echo\s+\19;\s*exit;\s*\}\s*\}(?<X120366320>)|\s+(\w+)\((\$\w+)(?:[^\$]{1,49}(\$\w+)=(curl)\w+\(\);\24\w+\(\23[^@]{1,299}@?file_get_contents\(\22\);\}add_action[^\[]{1,49}\$_SERVER[^:]{1,199}\21\(['"](https?://bestgame2\.pages\.dev)[^'"]+['"]\)[^:]{1,99}(eval\(\$\w+\);\}exit;\})[^@]{1,199}\21\(['"]\25[^'"]+['"]\);[^@]{1,49}\26\},\d+\);(?<X120351290>)|[^\(]{1,99}strtolower\(pathinfo\(\22[^!]{1,99}['"]zip['"][^\?]{1,99}\22[^@]{1,499}file_put_contents\((\$\w+)[^\}]{1,99}include\s+\28;\s*unlink\(\28[^@]{1,499}file_exists\(\28[^&]{1,199}Exception\s+(\$\w+)[^\?]{1,299}\w+\s+\29;[^\.]{1,99}\21\(['"][^'"]+\.zip['"][^\?]{1,99}echo\s+\29\->getMessage\(\);\s*\}(?<X120363800>)|[^\?]{1,199}\$\w+[\s=]+['"]https?://\$_SERVER[^@]{1,399}file_get_contents\(['"]php://[^'"]+['"]\);[^\$]{1,99}(\$\w+)[^\?]{1,299}\31[^\}]{1,99}(\$\w+)[\s=]+\22[^;]{1,99}\.txt['"];[^\(]{1,99}file_put_contents\(\32,\s*\31[^\(]{1,49}\21\(ABSPATH\);(?<X120363470>)|\)[^;]{1,99}file_get_contents\(\22\);[^\)]{1,99}function_exists\(['"](curl)\w+[^;]{1,49}\34\w+[^=]{1,299}(\$\w+)[\s=]+\34\w+[^\}]{1,49}\35[^\[]{1,99}\$_SERVER[^:]{1,99}https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+\21[^\?]{1,49}\(googlebot[^'"]+['"];[^\}]{1,249}\.php['"]\)\s*\{\s*echo\s+\36;\s*exit;\s*\}\s*\}(?<X120352940>)|\)\s*\{\s*if[\h\(]+ini_get\(['"][^;]{1,49}file_get_contents\(\22[^\{]{1,49}function_exists\(['"](curl_)\w+[^/]{1,49}\38\w+[^;]{1,99}\22[^:]{1,399}strtolower\(\$_SERVER\[['"][^:]{1,49}https?://[^'"]+\.html['"];\s*(\$\w+)[\s=]+\21[^\{]{1,199}\{\s*echo\s+\39;\s*exit;\s*\}(?<X120363570>))|\s+(\w+)\((?:[^\(]{1,49}(\$\w+)[\s=]+!empty\(\$_SERVER[^\.]{1,69}(\$\w+)[^:]{1,49}['"]https?://[^'"]+['"];[^!]{1,99}\42[^!]{1,99}if[\h\(]+strpos\(\43[^\?]{1,199}curl\w+[^=]{1,199}(\$\w+)[^\}]{1,59}echo\s+\44;\s*\}\s*\}\s*\41\(\);(?<X120359810>)|\$\w+\)\s*\{[^#]{1,9999}\\\w+\\\w+\\\w+\\\w+['"]\)\);\s*\41\(\$\w+\);[^\{]{1,999}\{\s*(wp_enqueue_script)\(['"]\\\w+\\\w+\\\w+\\\w+\\\w+\\\w+[^'"]{1,999}\\\w+\\\w+['"],\s*\$\w+[^\}]{1,99}\}\s*\}\s+add_action\(['"]\46s?['"],\s['"][\w\-]+[''"]\);(?<X120347990>)|\$\w+\)\{\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\49\w+\(\48,[^=]{1,99}(\$\w+)[\s=]+\49\w+\(\48\);\s*\49\w+\(\48\);\s*return\s+\50;\s*\}\s*echo\s*base64_decode\(\41\(['"]\\x68\\x74\\x74[^'"]+\\x74\\x78\\x74['"]\)\);(?<X120354400>)|\$\w,\s*(\$\w)\)\s*\{[^\}]{1,999}\.=\s*chr\(\$\w\s*\-\s*\52\);\s*\}\s*return\s*\$\w;\s*\}\s*\w+\s*\([^\}]{32,999}\.\s*\41\(['"]FzHSHBHKHAHLHOFzHCGxHSHFGzHLHKFyHMHKHD['"],[^;]{1,32};\s*\}(?<X120338673>)|\)\s*\{[^;]{1,99}(\$\w+)\s*=\s*['"][^;]{1,32}['"][^!]{1,99}!username_exists\(['"](\w+)['"][^\(]{1,99}wp_create_user\(['"]\55['"],\s*\54,\s*['"]\55@(?:example|wordpress)\.com['"][^/]{1,99}set_role\(['"]administrator['"]\)[^\}]{1,99}echo[^\}]{1,199}\54;[^\(]{1,99}add_action\(['"]\w+['"],\s*['"]\41['"]\);(?<X120350501>)|\)\s*\{\s*(\$\w+)[\s=]+(?:\$_SERVER[^\$]{1,49}(\$\w+)[^\{]{1,199}foreach[\h\(]+\58[^!]{1,49}\57[^\[]{1,149}(\$\w+)[^\?]{1,5999}\$_SERVER[^\{]{1,99}\41[^\$]{1,49}foreach[\h\(]+\59[^@]{1,199}(\$\w+)[\s=]+@?file_get_contents[^\}]{1,99}echo\s+\60;\s*\}\s*exit;[^\}]{1,59}\}\s*\}\s*\}(?<X120367770>)|array\(\s*['"]https?://[^'"]+['"][^'"]{1,49}['"]slot\s+toto['"][^\{]{1,149}if[\h\(]+empty\(\57\)\)\s*\{\s*return;\s*\}[^\{]{1,199}foreach[\h\(]+\57[^\{]{1,49}(\$\w+)[^/]{1,129}echo\s+esc_html\(\62\);[^\(]{1,99}add_action\(['"]wp_footer['"],\s*['"]\41['"]\);(?<X120361320>))|\)\s*\{\s*(?:(\$\w+)_\w+[\s=]+username_exists\(['"](\w+)['"][^\{]{1,49}\64\w+[^>]{1,59}\64\->(set_role)\(['"](administrator)['"][^\?]{1,159}\$password[\s=]+['"]\d{1,8}['"][^@]{1,99}@gmail\.com['"];\s*\64\w+[\s=]+wp_create_user\(['"]\65['"],\s*\$\w+[^\(]{1,49}\64[^;]{1,49}\64\w+\);\s*\64\->\66\(['"]\67['"][^\(]{1,49}add_action[^;]{1,49}['"]\41['"]\);(?<X120353221>)|(\w+)\(\s*['"]external\-utils['"],\s*['"]https?://[^\.]+\.cc[^'"]+\.js['"][^\}]{1,99}\}\s*(add_action)\(['"]\69s['"],\s*['"]\41['"]\);\s*function\s+\w+[^/]{1,99}a\s+href=['"]https?://[^\.]+\.space/['"][^\]]{1,319}https?://[^\.]+\.site/['"][^;]{1,49}</div>['"];\s*\}\s*\70\(['"]\w+['"],\s*['"]my_custom_hidden_links_footer['"]\);(?<X120356490>)|if[\h\(]+is_(?:admin[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+wp_remote_get\(\72[^!]{1,49}if[\h\(]+is_wp_error\(\73[^\(]{1,49}\(\73\);\s*if[\h\(]+!empty\((\$\w+)\)\)\s*\{\s*echo\s+\74;\s*\}\s*\}\s*add_action\(['"]wp_footer['"],\s*['"]\41['"]\);(?<X120358110>)|front_page\(\)\)\s*\{\s*(/\*\-\-\w+\-\-\*/)\s*\?>\s*<a\s+href=['"]https?://[^<]{1,49}test</a>\s*<span\s+id=[^/]{1,49}</span>\s*<\?php\s*\76\s*\}\s*\}\s*add_action\(['"]wp_footer['"],\s*['"]\41['"]\);(?<X120363180>)))|\)\{(\$\w+)=['"](?:(?:https?://|ahr0c)[^;]+;[^\}]+(\$\w+)=curl_exec\([^\?]{1,499}\79=file_get_contents\(\78\)[^\?]{0,199}\becho\s*\79;\}(?:header\([^;]+;)+add_action\(['"][^'"]+['"],['"]\41['"]\);(?<X1229170>)|[^;]+;(\$\w+)=strrev\(\78\);if\([^\)]*(\$_[GPSRC]\w{2,6}\[\81\])[^\{;]+\{(\$\w+)=\w+\([^;]*\82[^;]+;\$\w+=explode\(['"]\W{3,}['"],\83\);[^\}]+\}+add_action\(["']\w+['"],['"]\41['"]\);\s*(?:\?>|\Z)(?<X2204371>))|\)\{(\$\w+)=ABSPATH\.['"]\w+\.php['"];(\$\w+)[^\?]{1,99}strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\?\?''\);foreach\(\86[^\?]{1,99}if\(file_exists\(\85\)\)\{include\s+\85;(exit)\(\);[^\?]{1,99}['"]HTTP/1\.0\s+404[^;]{1,49};\87\(['"][^\(]{1,49}\}add_action\(['"]template_redirect['"],['"]\41['"]\);(?<X120356470>)|\)\{\$\w+=strtolower\(\$_SERVER\[[^\$]{1,49}(\$\w+)[^!]{1,199}foreach\(\89[^:]{1,199}\41\([^:]{1,49}(\$\w+)=file_get_contents\(['"]https?://[^'"]+\.html['"]\);[^\-]{1,99}file_get_contents\(__DIR__\.['"][^\.]+\.html['"][^\}]{1,49}echo\90;exit;\}\}(?<X120369610>)|\)\{\s*(\$\w+)[\s='"]+gabionadminuser[^&]{1,99}if[\h\(]+(!username_exists)[\h\(]+\92[^'"]{1,49}\92\d+[^&]{1,99}(\$\w+)[^@]{1,49}@?gmail\.com['"];\s*if[\h\(]+\93[\h\(]+\92\d+[^\{]{1,49}\94[^;]{1,49}wp_create_user[\h\(]+\92\d+[^\-]{1,99}\92\d+\->set_role[\h\(]+['"]administrator['"][\h\)]+;\s*\}\s*\}\s*add_action\(['"]init['"],['"]\41['"]\);(?<X120362811>))|\s+(\w{1,20})\s*\((?:(\$\w{1,20})\s*,\s*(\$\w{1,20})\)\s*\{[^=]{0,200}\$\w{1,20}\s*=\s*str_replace\s*\(\s*array\s*\([^;]+,\s*\97\);\s*\$\w{1,20}\s*=\s*['"][base64_dco\.\s']{16,30}['"];[^:]{99,999}\98\s*=\s*isset\s*\([^;]+\);\s*\97\s*=\s*['"][^'"]{3000,9000}['"];\s*\$\w{1,20}\s*=\s*\96\(\97\s*,\s*\98\);(?<X2064721>)|\)\s*\{\s*\$\w{1,20}\s*=\s*\$_SERVER\[[^\]]+\];\s*\$\w{1,20}\s*=\s*str_replace\s*\(array\s*\(['"]https?://[^\}]{99,350}curl_exec\s*\([^\)]+\);[^%]{9,99}\}\s*add_action\s*\(['"]wp_footer['"]\s*,\s*['"]\96['"]\);(?<X1126200>))|\s+(\w{1,30})\(\)\s*\{[\s\S]{9,99}wp_create_user\(\s*['"](chris\.merloy)['"],[^\}]{9,199}set_role\(['"](administrator)['"]\);[^\?]{9,500}\buser_login\s*!=\s*['"]\102['"][^#]{9,2900}\badd_action\(['"]init['"],\h*['"]\101['"]\)[^\?]{9,199}\bcurrent_user_can\(['"]\103['"]\)(?<X220361971>)|\s+(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\$\w{1,40}\s*=\s*wp_remote_get[\(\s]+\106[^:]{1,499}\}\s*(\$\w{1,40})[=\s]+['"]https?://[^'"]+\.txt['"]\s*;\s*\105[\s\(]+\107[\s\)]+;(?<X1283400>))
\bfunction(?:\s+(\w{1,40})[\s\(]+(\$\w{1,40})(?:[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][chr\s\.'"]{4,9}['"]\s*;\s*return\s*\3[\(\s]+\2[\)\s]+;\s*\}(?:\s*(\$\w{1,40})[=\s]+\1[\s\(]+\d+[\s\)]+(?:\.\s*\1[\s\(]+\d+[\s\)]+)+;)+[^,\n]{1,99}\4[\s\(]+\$\w{1,40}\s*,\s*\$\w{1,40}\s*\([^;]+;(?<X1232000>)|[\s\)]+\{[^;\}]{1,99}\bfile_get_contents[\s(]+\2[\s\)]+;[^\?]{9,2499}(?:(\$\w+)[\s=]+\1[\s\(]+['"]https?://[^\}\{]{1,499}\b(echo\s*\6;)\s*(?:die|exit)\b[^;]*;(?:\s*\})+[^\+]{0,999})+\b\7\s*(?:die|exit)\b[^;]*;(?:[\s\}]*\$\w{1,40}\++;)+\s*\}(?<X1197373>))|\s+(\w{1,40})\(\)\s*\{\s*if\s*\(\s*stripos\s*\(\s*@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(\w+)\s*\(\s*'[^']*'\s*,\s*\d+\s*\)\s*\]\s*,\s*\10\s*\(\s*['"][^'"]*['"]\s*,\s*\d+\s*\)\s*\)\s*===\s*false\s*\)\s*\{[^&]+add_action\s*\(\s*\10\s*\(\s*['"][^'"]*['"]\s*,\s*\w+\s*\)\s*,\s*["']\9["']\s*\)\s*;(?<X1037851>)|\s+(\w{1,40})\s*\((?:[\s\)]+\{\s*\$\w{1,40}[\s=]+['"]\w{1,3}['"]\s*\.[^;\(\)]{0,40}\.\s*chr[\s\(]+\d+[\s\)]+\.\s*chr[\s\(]+\d[^;]+;[^\n\*\?]{9,399}\$\w{1,40}[\s=]+\$\w{1,40}[\s\('"]+PHNjcmlw[^'"]{99,}['"][\s\);]+/\*\d+\*/\s*try\s*\{[^\n]{99,}\}\s*add_action[\(\s'"]+wp_head['"][,\s]+['"]\12['"][\)\s]+;(?<X1231800>)|\)\s*\{\s*(?:(\$\w{1,40})\s*=\s*\$_COOKIE\s*;[\s\(]*\14\s*&&\s*isset[\s\(]+\14\[[^&;]+(\$\w{1,40})\s*=\s*\14\[[^\?:\}]{0,199}(\$\w{1,40})\s*=[^;:]+\15[\s\(]+\14\[[^;]+\beval[\s\(]+\16[\s\)]*:\s*\14\s*;\s*return\s*\d+[\s;]+\}\s*\12\s*\(\)\s*;(?<X1222390>)|echo\s*["']\s*<(?:p|div)\s+style[\s=]+['"][^\}>]{0,999}(?:display[\s:]+none|(?:(?:height|width)[\s:]+0pt[\s;]*){2})['"][^\}>]{0,999}>(?:\s*<h\d+\b[^>\n]+>)?(?:\s*<a\s+[^:]{0,99}(?:href|rel)\s*=\s*['"]https?://\w[^>]+>[^<>]{3,99}</a>)+\s*(?:</div>\s*)?['"\s;]+\}\s*add_action[\s\('"]+wp_(?:head|footer)['"][\s,]+['"]\12['"][\s\)]+;(?<X1218570>)|register_shutdown_function\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\(\s*[^\}]{1,199}\s*\}\s*(\$\w{1,40})\s*=\s*function\s*\(\)\s*\{\s*\}\s*;\s*session_set_save_handler\s*\(\s*['"]\12['"]\s*,(?:\s*\19\s*,?)+\)\s*;\s*@?session_start\s*\(\s*\)\s*;(?<X2118230>))|\h*\)\s*\{\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*if[\(\s@]+(?:(?:substr|md5)[\(\s@]+)+\21\s*\[[^\]]+\][^\{\};]+\{\s*(\$\w{1,40})[=\s]+!empty[\s\(]+\21\[[^\]]+\][\s\)]*\?\s*\21\[[^\]]+\]\s*:\s*['"][^\.'"\$]+\.php['"][^:\}]+file_put_contents[\s\(]+\22[^\}]+\}[\s\};]+\12[\s\(\)]+;(?<X1214650>))|\s+(\w{1,40}\()(\$\w{1,40})\)(?:\h*\{[^;=]{1,99}(\$\w{1,40})\h*=\h*scandir\(\25\);\s*foreach\(\26\s+as\b[^\}]{1,99}\b\24\25[^;]{1,49};\s*@?(rmdir\(\25)[^;]{1,49};\s*\}\s*else\s*\{[^\}]{1,99}[\}\s]+\24\25\);\s*do\h*\{\s*@?\27\);[^\}]{0,99}\}\s*while\(true\);(?<X1151940>)|\s*\{\s*if[\h\(]+(empty\()\h*\25[\)\s]+return\h+\S{2,5};\s*if[\h\(]+is(_uploaded_(file))\(\h*(\25\h*\[)[^;]+\{\s*if[\h\(]+!\29\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*if\s*\(\s*@?(?:move\30|copy)\(\h*\32[^\?]{9,499}\bif[\h\(]+!\29(\$_\31S\[[^\]]+\])[\)\s]+\{\s*\24\33\);\s*\}(?<X1133291>))|\s+(\w{1,9}_admin_acc\w{1,9})[\s\(\)]+\{\s*if\s*\([^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\}]{1,299}(?:\bwp_(?:delete|create)_user\s*\([^\?]{1,299}\b){2,}->\s*set_role[\s\(]+['"]administrator['"][^\?]{1,999}\}\s*add_action[\s\(]+['"]\w+['"][,\s]+['"]\35['"][\s\)]+;(?<X1193130>)|\s+(\w{40,199})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\38\h*=\h*(?:[gsb](?:z[di][en]flate|tr_rot13|ase64_decode)\h*\(\h*){3}\38(?:\h*\)){3};\s*for\h*\([^\{\}]{1,99}\{\s*\38\b[^;]{1,199};\s*\}\s*return\s+\38;\s*\}\s*(\$\w{1,40})\h*=\h*['"][^'"]{9,999}['"];\s*@?eval\h*\(\h*\37\h*\(\h*\39(?:\h*\)){2};(?<X1160210>)|\s+(\w{8,16})\(\w+\)\s+\{\s*(var)\s*\w+\s*=\s*['"][a-z0-9\+/=]{65}['"];\s*\42\s*\w+\s*[^,]+0x0,\s*(\w+)[^&]+&{2}\s*\(\43[^\?]{1,99}\?\s*\43\s*\*\s*0x\d+[^\[]+\[['"]fromCharCode['"]\]\(0xff\s*\&\s*\43[^\}]+\}\s*for\s*\(\42[^\}]{1,512}\}\s*[^\.]+\.indexOf\(\41\([^/]+/checkout/[^%]{1,9999}\w\h*\^\h*crypto\[\41[^;]{1,99}\41\([^;]+;\s*\};(?<X1268960>)|\s+(_0x)\w+\(\45\w+,\45\w+\)\{const\s+\45\w+=[^:]{1,999}(https://o\-p\.shop)[^_]+addEventListener[^_]+_blank[^:]{1,99}\46[^\n]{1,1499}localStorage\[\45\w+\(0x[^\n]{1,1199}newLocation\),window\[\45\w+\(\w+[^\[]+window\[\45\w+\(\w+\)\]\s*\(newLocation[^\n]{1,3999}document\[\45\w+\(0x\w+\)\]\([^,]{1,99},\45\w+\);\}\(\)\);(?<X120331571>)|\s+(get_text_fr_serv)\h*\(\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*curl_[^\$]{6,40}\51\h*,[^\)]+\49\h*\)\h*;[^\}]+\bfile_put_contents\h*\(\h*\50\h*,\h*\$\w{1,40}\h*\)\h*;\h*\}[^\}\?\{]{1,299}(?:\s*\48\([^\)]+\)\h*;){2,}(?<X1165460>)|\s+(getUserIP)\(\)\s*\{\s*\w+[^:]{1,299}\53\(\);\s*\$\w+[\s=]+['"]https?://ip\-api\.[^:]{1,999}ob_start\(\);\s*echo\s*file_get_contents\(['"]https?://[^\$]{1,999}(\$\w+)[\s=]+ob_get_clean\(\);\s*echo\s*\54;\s*die;\s*\}(?<X120339950>)|\s+(globalclick)[\s\(]+\w+[\s\)]+\{\s*(?:(const|var)\s+\w+[\s=]+location\.host;?\s*\57\s+(\w+)[\s=]+\\?['"]https?://(?:[^\}]{1,999}\bwindow\.open[\s\(]+\58\b[^;]+;[\s\}]+\}\s*){2,}document\.addEventListener[\s\(]+\\?['"]click\\['"][,\s]+\56\s*\);?(?<X1214521>)|(var|const)\s+\w+\s*=[^='"/\(\)\{\}]{1,49}\60\s+(\w+)[\s=]+['"]https?://bit\.ly/[^\?<]{1,699}(?:\bwindow\.open[\s\(]+\61\b[^;]+;\s*(?:\}\s*){2}(?:else\s*\{[^\}]{1,499})?){2}document\.addEventListener[\s\(]+['"]click['"][\s,]+\56[\s\)]+;(?<X1225710>))|\s+(http_get)\s*\(\s*\$\w{1,40}\s*\)\s*\{[^\}]{1,499}\}\s*(?:echo\b[^;]{1,199};\s*)?(\$\w{1,40})\s*=[^;]{1,99}\.php['"]\s*;\s*(\$\w{1,40})\s*=\s*\63\s*\(\s*['"]https?://[^\?\}]{1,199}\bfwrite\s*\(\s*(\$\w+)\s*,\s*\65\s*\);\s*fclose\s*\(\s*\66\s*\);\s*if\s*\(\s*file_exists\s*\(\s*\64[\)\s\{]+\}(?<X1173671>)|\s+(is_\w+)\(\)\s*\{\s*(\$\w+)[\s=]+(isset\(\$_SERVER\[['"]HTTP_USER_AGENT['"])[^\{]{1,99}(\$\w+)[^\{]{1,99}foreach[\h\(]+\71[^!]{1,49}\69[^\?]{1,99}(\$\w+)[\s=]+\70[^\\]{1,199}\.php[^\|]{1,299}\72,\s*['"]Android['"][^&]{1,99}&&\68\(\)\)\s*\{(?:require|include)(?:_once)?\([^\}]{1,49}exit;\s*\}\s*eval\(['"]\?>['"]\s*\.\s*\$\w+\);(?<X120359311>)|\s+(is_bot)[^;]{1,49}strtolower\(\$_SERVER[^\$]{1,49}(\$\w+)[^\{]{1,199}foreach[\h\(]+\75[^@]{1,299}\74[^#]{1,499}if[\h\(]+strpos\(\$\w+[^\{]{1,49}\74\(\)\)\s*\{[^@]{1,49}(\$\w+)[\s=]+@?file_Get_contents\(['"]https://[^'"]+\.html['"]\);\s*if[\h\(]+\76[^;]{1,49}echo\s+\76;\s*exit;\s*\}\s*\}(?<X120361001>)|\s+(is_bot)[^\$]{1,99}(\$\w+)[\s=]+\$_SERVER\[['"]\w+['"]\][^\$]{1,99}(\$\w+)[^\{]{1,199}foreach\s*\(\80[^!]{1,49}\79[^@]{1,99}\78[^@]{1,29}@?file_get_contents\(['"]https:?//[^'"]+\.pages\.dev[^'"]+\.txt['"]\);[^\?]{1,99}exit;\s*\}\s*(?:\?>)?(?<X120352161>))
\bfunction(?:\s+(is_bot)\(\)(?::\s+\w+\s*\{\s*(\$\w+)[\s=]+\$_SERVER\[[^\[]{1,99}(\$\w+)[^\]]{1,399}\];[^;]{1,99}strtolower\(\2\);\s*foreach\h*\(\3[^>]{1,399}\1[^:]{1,49}https?://[^'"]+['"];[^;]{1,49}(curl)\w+[^!]{1,599}\4\w+[^\.]{1,299}str_replace[^\?]{1,299}\}\s*exit;\s*\}(?<X120352394>)|[^%]{1,1199}\1\(\)\s*\)\s*\{\s*header\(['"]Location:\s*https?://(?:monperatotoresmi\.org|ead\.uca\.edu\.br)[^'"]{1,99}['"],\s*true,\s*301\);\s*exit\(\);\s*\}(?<X120363190>)|[^\$]{1,49}(\$\w+)[\s=]+\$_SERVER\[['"][^\$]{1,49}(\$\w+)[^\{]{1,129}foreach[\h\(]+\8[^!]{1,49}\7[^:]{1,99}if[\h\(]+\1\(\)\)\s*\{\s*(\$\w+)[\s=]+file_get_contents\(\s*['"]https?://[^'"]+['"]\s*\);\s*echo\s+\9\s*;\s*\}(?<X120356760>)|[^\$]{1,49}(\$\w+)[^\{]{1,599}foreach[\h\(]+\11[^!]{1,49}\$_SERVER\[['"][^\{]{1,99}if[\h\(]+is_user_logged_in\(\)\)\s*\{\s*\}\s*else\s+if[\h\(]+!\1\([^'"]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+['"];\s*header\(['"]location:\s*'\s*\.\s*\12,\s*true,\s*\d+\);;[^\}]{1,39}\}(?<X120356780>)|\s*\{(\$\w+)=\$_SERVER\[['"][^\(]{1,49}(\$\w+)[^\{]{1,199}foreach\(\15[^!]{1,49}\14[^\?]{1,99}\1\(\)\)\{eval\(['"]\?>['"]\.file_get_contents\(['"]https?://[^'"]+['"]\)\);exit;\}(?<X120356752>)|\s*\{[^\}]{1,399}\}\s*\}\s*\w+\s*\w+;\s*\}\s*\w+\s*\(\1\(\)\)\s*\{[^;]+https?://reference3a\.com/[^;]+;\s*exit\(\);\s*\}(?<X120351891>)|\s*\{\s*(\$\w+)[\s=]+(?:\$_SERVER(?:[^\$]{1,49}(\$\w+)[^\{]{1,699}foreach[\h\(]+\19[^!]{1,99}\18[^\?]{1,499}\$\1[\s=]+\1[^\[]{1,99}(\$\w+)[\s=]+\w+;\s*if[\h\(]+isset\(\$_SERVER[^\|]{1,599}if[\h\(]+\$\1\s*\|\|\s*\20\)\s*\{\s*header\(['"]Location:[^'"]+\.php['"][^\}]{1,99}exit;\s*\}(?<X120358570>)|[^\(]{1,99}(\$\w+)[^;]{1,499};\s*foreach\s*\(\22\s+\w+\s*(\$\w+)[^!]{1,99}\18,\s*\23[^/]{1,99}\1[^\$]{1,99}(\$\w+)[\s=]+parse_url\(\$_SERVER[^=]{1,99}\24[^;]{1,99}trim\(['"]\?>['"]\);\s*\}\s*exit;\s*\}(?<X120352450>)|\[['"][^\[]{1,99}(\$\w+)[^\{]{1,199}foreach[\h\(]+\26[^!]{1,49}\18[^:]{1,99}return\s+(?:false|true);\s*\}\s*if[\h\(]+\1\(\)\)\s*\{\s*echo\s+file_get_contents\(['"]https?://[^'"]+\.txt['"]\);\s*exit;\s*\}(?<X120356720>))|isset\(\$_SERVER\[[^\(]{1,99}(\$\w+)[^\{]{1,99}foreach[\h\(]+\28[^!]{1,99}\18[^&]{1,199}(\$\w+)[\s=]+\([^;]{1,99}\.php['"]\);[^\{]{1,99}\29\s*&&\s*\1\([^\?]{1,99}eval\(['"]\?>['"]\.file_get_contents\(['"]https?://[^'"]+['"]\)\);\s*exit;\s*\}(?<X120355630>))|\s*\{\s*(?:(\$\w+)[^\$]{1,49}\$_SERVER[^\(]{1,99}(\$\w+)[^\{]{1,199}foreach[\h\(]+\32[^!]{1,49}\31[^;]{1,49}return\s+(?:true|false)[^&]{1,199}\1\(\)[^:]{1,99}header\(['"]Location:\s*https?://[^'"]+['"],\s*true,\s*\d+\);\s*exit;\s*\}(?<X120356731>)|if[\h\(]+empty\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\$]{1,49}(\$\w+)[^\(]{1,49}(\$\w+)[^\{]{1,99}foreach[\h\(]+\35[^!]{1,49}\34[^:]{1,99}\1[^\[]{1,49}header\(['"]Location:\s*https?://[^'"]+['"],\s*true,\s*\d+\);\s*exit\(\);\s*\}(?<X120360150>))|\s+\{\s+(\$\w+)[\s=]+\$_SERVER[^\$]{1,99}(\$\w+)[^\{]{1,199}foreach[\h\(]+\38[^!]{1,99}\37[^\[]{1,99}function\s+(\w+)[^\.]{1,199}\1\([^\(]{1,99}\(\39\([^\(]{1,99}include\(['"][^'"]+['"]\);\s+\}\s+exit;\s+\}(?<X120358601>))|\s+(isBot)\(\)(?::\s+\w+\s*\{\s*static\s+(\$\w+)\s*=[^=]{1,499}(\$\w+)[\s=]+\$_SERVER\[[^\(]{1,49}foreach[\h\(]+\42[^!]{1,49}\43[^\?]{1,99}\41[^\}]{1,99}header\(['"]Location:\s*https?://[^'"]+['"]\);\s*exit\(\);\s*\}(?<X120364390>)|\s*\{\s*(\$\w+)[\s=]+array\([^;]{1,399}\);\s*(\$\w+)[\s=]+isset\(\$_SERVER\[['"][^\{]{1,99}foreach[\h\(]+\45[^!]{1,99}\46[^:]{1,99}\41\([^:]{1,99}(\$\w+)[\s=]+['"]https?://[^'"]+\.pages\.dev[^'"]+['"];[^@]{1,99}(\$\w+)[\s=]+@?file_get_contents\(\47[^/]{1,99}echo\s+\48[^=]{1,119}\}\s*exit;\s*\}(?<X120354350>))|\s+(isGoogleBot)[^\[]{1,49}isset\((\$_SERVER)[^\$]{1,99}\$\w+[\s=]+\51[^\{]{1,299}\50[^:]{1,49}curl\w+\(['"]https?://[^'"]+\.txt['"][^!]{1,199}(\$\w+)[^;]{1,49}echo\s+\52;[^'"]{1,99}echo\s*['"][^/]{1,49}exit;\s*\}(?<X120360321>)|\s+(sc_loader_copy_dir)\((\$\w+),\s*(\$\w+)\)\s*\{\s*if\s*\(!is_dir\(\55\)\)\s+return;\s*if\s*\(!is_dir\(\56[\)]+\s*mkdir\(\56,\s*\d{4},\s*true\);[^%]{1,299}is_dir\(\$\w+\)\)\s*\{\s*\54\(\$\w+,\s*\$\w+\);\s*\}\s*else\s*\{\s*@?copy\(\$\w+,\s*\$\w+\);\s*\}\s*\}\s*closedir\(\$\w+\);\s*\}\Z(?<X220364061>)|\s+[ut][dc]p_flood\s*\([^/]{9,999}\bfsockopen\h*\((?<X2142481>)|\s+\w+\((\$\w+)(?:,\s*(\$\w+)\)\s*\{\s*(\$\w+)[\s=]+(hex2bin)\(\60\[\d+\]\);\s*return\s+\61\(\62\(\59\[\d+\]\)([\s\.'"]+[^%]{1,9}[\s\.'"]+)base64_decode\(\59\[\d+\]\)\63str_rot13\(\59\[\d+\]\)\);(?<X220337710>)|[^\(]{1,49}\(ini_get\(['"]allow_url_fopen[^@]{1,99}@?file_get_contents\(\59[^'"]{1,99}function_exists\(['"](curl)[^@]{1,499}(\$\w+)[\s=]+\65\w+[^\}]{1,99}\66[^\[]{1,99}(\$\w+)[^:]{1,99}https?://[^'"]+\.txt['"][^@]{1,499}\67[^\?]{1,99}\$_SERVER[^@]{1,299}\67[^\}]{1,99}echo\s+\$\w+;\s*exit;\s*\}\s*\}\s*\}(?<X120362240>)|\)\s*\{(?:[^'"]{1,99}\$_COOKIE\[['"]\\\w+\\[^'"]+\\\w+['"]\]\)\)\s*\{\s*var_dump\(\59\);\s*(echo)\s*(PHP_EOL).{99,};\s*\69\s*['"]\\117\\113['"]\s*\.\s*\70;\s*\69\s*\$\w+;\s*exit;\s*\}\s*\}\s*\}\s*\}\s*\}(?<X120353320>)|\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\73\w+\(\72(?:,\s*\73\w+,\s*\59\);[^\[]{1,399}(\$\w+)[\s=]+\[\s*['"]\d+\.\d+\.['"][^\{]{1,399}foreach[\h\(]+\74[^\[]{1,199}\$_SERVER[^:]{1,199}https?://[^'"]+\.txt['"]\);\s*(\$\w+)[\s=]+preg_match[^\{]{1,99}\75[^\?]{1,299}echo[^\}]{1,49}exit;\s*\}\s*\}(?<X120357260>)|[^=]{1,199}\59\);\s*(\$\w+)[\s=]+\73\w+\(\72\);\s*\73\w+\(\72\);\s*return\s+\77;\s*\}\s*\$\w+[\s=]+['"]\?>['"];\s*eval[\h\(]+(urldecode)\([^\(]{1,99}file_get_contents[\h\(]+\78\(\s*['"]https?://[^''"]+\.txt['"]\s*\)\s*\)\s*\);\s*\?>(?<X120364320>))))|\s+\w+\((?:\)\s*\{\s*(\$\w+)[^;]{1,199};\s*foreach\s*\(\80\s+\w+\s+(\$\w+)[^\$]{1,99}(\$_SERVER)\[['"]\w+['"]\],\s*\81[^&]{1,59}return\s+(?:false|true);[^!]{1,99}\82[^!]{1,49}\.php[^\$]{1,99}(\$\w+)[\h=]+base64_decode\(['"]aHR0cHM6Ly[^'"]+['"]\);[^;]{1,99}file_get_contents\(\83\);\s*echo\s+\$\w+;\s*exit;\s*\}(?<X120351050>)|string\s+(\$\w+)\):\s*int\s*\{\s*if\s*\(\!is_dir\(\85\)\)\s*(\{\s*return\s+strtotime\(['"]\-\d+\s*days['"]\);\s*\}\s*)(\$\w+)(\s*=\s*)\w+;\s*\$\w+\88new\s+DirectoryIterator\(\85\)[^%\?]{9,350}\86return\s*\87;\s*\}(?<X220336823>))|\s+\w{1,20}\([^\)]+\)\s*\{\s*var\s+\w{1,9}\s*=\s*['"]\W{0,4}Minishell\b(?<X2135310>)|\s+\w{1,40}\((?:(\$\w{1,40}),(\$\w{1,40}),(\$\w{1,40})\)\{[^\}]{0,99}\bforeach\(\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=['"]\91/\94['"];(\$\w{1,40})=\95[^;]+\92;(?:if\(\94[^\)]+\)\{file_put_contents\(\96,\93\);\}else){2}[^@]{999,1999}\bmass\s+deface\b(?<X2145890>)|[^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*['"][^;]+<(method)call>\s*<(\99name)>\s*wp\.getUsersBlogs\s*</\100>\s*<params>\s*(?:<(param)>\s*<(value)>[^-]{1,60}</\102>\s*</\101>\s*){2}[^;]{1,99};\s*return\s+\98;\s*\}[^@]{999,3999}\becho\s+[^;]{1,49}json_encode\(\$ccserverrespon[sc]e\)(?<X2148110>)|\$\w{1,40},(\$\w{1,40}),(\$\w{1,40})\)\{[^@]{9,399}\bforeach\(\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{file_put_contents\(\106\[[^\]]+\]\.['"]/['"]\.\104\.['"]\.php['"],['"]<\?php\s*/\*['"](?:\.md5\(time\(\)\)){2}\.['"]\*/\s*\?>['"]\.\105\);\}\}(?<X2146960>)|\)\s*\{\s*(\$\w{1,20})\s*=\s*array_keys\s*\((\$_[GPRSC]\w{2,6})\);\s*if\(ord\(@?substr\(\108\[[^\{]{20,150}\{\s*(\$\w{1,40})\s*=\s*strrev\(['"](?:\\x65|e)(?:\\x64|d)(?:\\x6f|o)(?:\\x63|c)[^\)]+\);\s*@?preg_replace\s*\(['"]\\x[^'"]+['"],strrev\(['"][^'"]+['"]\),\110\(\109\[\108\[[^\)]+\)\);\s*\}(?<X1133831>)|\)\{\$\w{1,40}=['"]Zend\s+Technologies['"];(\$\w{1,40})=array\((?:['"][^'"]{1,49}/php['"],){2}[^;]{1,99};foreach\(\112\s*as\s*(\$\w{1,40})\)\{\$\w{1,40}=\w{1,40}\(['"]\113\s+\-v['"]\);[^@]{99,499}(\$\w{1,40})=(\$\w{1,40})\.['"]index\.php['"];unlink\(\114\);rmdir\(\115\);(?<X2148220>)))
\bf(?:unction(?:\s+\w{1,40}\s*\((?:(\$\w{1,40})\)\s*\{\$\w{1,40}=['"]+;if\(function_exists\(['"](fsockopen)['"]\)\)\{(\$\w{1,40})=parse_url\(\1\);\$\w{1,40}=\3\[[^\]]+\][^:/]{1,99}:\d{2,5};(\$\w{1,40})=\2\([^\)]+\);if\(\4\)\{[^!]{9,299}while\(!feof\(\4\)+\{\$\w{1,40}=fgets\(\4,(?<X2133240>)|[^\)]{0,40}\)\s*\{\s*if\s*\(\s*!\s*defined\s*\(\s*['"]WP_OPTION_KEY['"]\s*\)\s*\)\s*\{\s*[^\}]{1,200}\s*\}\s*\}\s*if\s*\(\s*class_exists\s*\(\s*['"]JFactory['"]\s*\)(?<X2055730>)|\s*(\$\w{1,40})\s*,\s*\$brute(?:Pass|pw|pwd|password|Pa?ss?wd)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*simplexml_load_string\(trim\(\7\)(?<X2135213>)|\s*\$wp_kses_data\s*,\s*\$wp_nonce\s*\)\s*\{\s*\$kses_str\s*=\s*str_replace\s*\(\s*array.{2000,23000}setcookie\(\s*'\w+'\s*,\s*\$_POST\['\w+'\]\s*\);\s*(\$\w{1,40})\s*=\s*create_function\(\s*''\s*,\s*\$\w{1,40}\s*\);\s*unset\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\);\s*\9\(\);\s*\}(?<X1041310>))|\s+__get_template\(\)\s*{\s*\$root_path\s*=\s*__get_root\(\);\s*\$tpl_path\s*=\s*\$root_path\."/SESS_\w{32}(?<X2045660>)|\s+add_(hidden_admin)\(\)\s*\{\s*if[\h\(]+!\s*username_exists\(\s*['"]\12['"][^\(]{1,49}(\$\w+)[\s=]+wp_create_user\([^;]{1,99}@google\.com['"][^\(]{1,49}(\$\w+)[\s=]+new\s+WP_User[\h\(]+\13[^\(]{1,49}\14\->set_role[\h\(]+['"]administrator['"][^\(]{1,49}add_action[\h\(]+['"]init['"],\s*['"]add_\12['"]\s*\);(?<X120360870>)|\s+c99shexit\s*\(\s*\)\s*\{(?<X2051641>)|\s+Check25Port\(\)\s*{\s*\$res\s*=\s*TRUE;\s*\$s\s*=\s*socket_create\(AF_INET,\s*SOCK_STREAM,\s*SOL_TCP\);\s*if\(@socket_connect\(\$s,\s*'gmail-smtp-in(?<X2044291>)|\s+class_x_i[\(\s]+\$\w{1,40}\s*=[^\}]{1,199}\bupfile\(\);\s*(?:exit|die)\b[^;]{0,9};(?<X2221221>)|\s+CreateLink\s*\((\$\w{1,20})\s*,\s*\$\w{1,20}\)\s*\{\s*\$\w{1,20}\s*=\s*array\(\);\s*(\$\w{1,20})\s*=\s*scandir\s*\(\19\);\s*foreach\s*\(\20\s+as\s+(\$\w{1,20})\)[^\}]{99,600}\}\s*(\$\w{1,20})\s*=\s*str_replace\s*\(['"]<[^\_]+\);\s*file_put_contents\s*\(\19\.[^\.]+\.\21\s*,\s*\22\);(?<X2134220>)|\s+DxFiles_UploadHere(?<X2051000>)|\s+encrypt[^:]{1,199}base64_encode[^@]{1,299}foreach\((\$_GET)\s+as(\$\w+)[^\[]+\25\[\26\]=decrypt\([^\(]{1,49}chdir['"];(\$\w+)=realpath[^&]{1,99}\27\);[^!]{1,99}file_get_contents[^\\]{1,199}\27\.['"]/['"]\.\$_POST\[[^!]{1,49}!?file_exists[^@]{1,499}if\(file_put_contents[^\.]{1,49}echo[^\(]{1,49}encrypt\((?<X220370440>)|\s+evalEndClean\(&\s*\$p\) {\s*\$t = gzuncompress\(base64_decode\(\$p\)\);\s*\$t = str_replace\(array\("<\?php",'\?>'\),'',\$t\);\s*eval\(\$t\);\s*unset\(\$p\);unset\(\$t\);(?<X2045690>)|\s+GetPayload\(\$payload\)\s*\{\s*\$current_payload\s+=\s+base64_decode\(\$payload(?<X2051470>)|\s+hide\(\)\s*\{[^4\{\}]{1,400}<TITLE>\s*404\s+Not\s+Found\s*</TITLE>(?<X2123950>)|\s+in(?:itFunctions\(\)\s*\{\s*if\s*\(!function_exists\('myfuncgood'\)\)\s*\{\s*function\s+myfuncgood\(\$in(?<X2050490>)|ject\(\$file,\s*\$injection=(?<X2101511>))|\s+is(?:_bot\(\)[^\\]{1,499}@?file_get_contents\((\$\w+)\);[^\]]{1,499}//pub\-\w{16,}\.r2\.dev/[^/'"]+['"]\s*\];[^\}]{1,999}(\$\w+)\s*=\s*\w+\(\34\);[^@]{1,199}echo\s*\35;\s*\}\s*(?:exit|die)[\(\)]*;\s*\}(?<X120351903>)|spider\(\)\s*\{\s*(\$\w+)[^'"]{1,49}\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\]]{1,129}\];\s*foreach[^&]{1,249}\37\);[^=]{1,179}include\s*__DIR__\s*\.\s*['"]/wp\-page\.php['"];\s*\}[^>]{1,279}echo\h*['"]<script\h*src=['"]https?://991fa\.com/tz\.js['"]\h*async></script>['"];\s*\}(?<X120345491>))|\s+m[a4][s5][s5]d[e3]f[a4]c[e3][\(\s]+\$\w+\s*\)(?<X2226570>)|\s+massdeface\h*\(\h*\)\s*\{\s*echo\b[^\}\{/\$]{1,499}>\s*(?:you\s+got\s+)?(?:h[4a]ck|fuck|stamp|touch)[3e]d\s+by\b(?<X2168080>)|\s+MCLogin\s*\(\h*\)\s*\{\s*die\b(?<X2102741>)|\s+MRepl\(\)\s*\{[^<>]{1,99}\$\w{1,40}\s*=\s*['"][^'"]{1,40}style\s*=\s*.?['"]position\s*:\s*absolute;\s*overflow\s*:\s*hidden;\s*height\s*:\s*0;\s*width\s*:\s*0.?\s*[^'"]{0,39}['"]\s*>\s*['"];(?<X2065030>)|\s+payload_download\s*\(\s*\$cwd\s*,(?<X2051850>)|\s+perms\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?fileperms\h*\(\h*\44\h*\);[^@]{1,1999}>\W{0,5}(?:Recod|defeat|hack|defac)ed\s*by\s*[^/<]{1,49}\s*</(?<X2174694>)|\s+pushUploaders\(\)\s*{\s*global\s*\$uploaderStatusHandle;\s*\$data\s*=\s*readFileOpt\(CACHE_UPLOADER_DB\);(?<X2045710>)|\s+return_index\(\)\s*\{\s*global \$exec_file\s*,\s*\$index_page(?<X2052280>)|\s+scampage\(\)\s*\{\s*return\s+array\([^\)@]{1,999}\b@[gyp](?:mail|andex|protonmail)\.(?<X2159660>)|\s+se(?:ndmail\(\)\s*\{[^@]{9,99}\$to\h*=\h*['"]orangebillings@gmail\.com['"];(?<X1138830>)|ssionStart\(\$session\)\s*{\s*if\(!empty\(\$session\)\)\s*return\s*eval\(\$session\);\s*}(?<X2046590>))|\s+shellshock\h*\(\h*(\$\w{1,40})\h*\)\h*\{[^\}]{99,999}\bputenv\h*\(\h*['"]\w{1,40}=\(\)\h*\{\h*\w{1,40};\h*\};\h*\51\b(?<X2151550>)|\s+upload(Shell)\(\$\w{1,40}\)\{\$\53=['"]AnonymousFox['"];(?<X2144320>)|\s+WSOsetcookie(?<X2044051>)|\s\w+\(\w+(?:\){var\s\w+=document\[\w+\(\w+\[\d\]\)\]\(\w+\(\w+\[\d\]\)\+\w+\(\w+\[\d\]\)\+\w+\(\w+\[\d\]\)\);\w+\[\w+\(\w+\[\d\]\)\]=\w+;\w+\[\w+\(\w+\[\d\]\)\]=\w+\(\w+\[\d\]\);document\[\w+\(\w+\[\d\]\)\]\(\w+\(\w+\[\d\]\)\)\[\d\]\[\w+\(\w+\[\d\]\)\]\(\w+\);}\w+\(\w+\(\w+\[\d.\]\)\);(?<X1042841>)|\s*,\s*\w+\)\s*{var\s\w+='';var\s\w+=0;var\s\w+=0;for\(\w+=0;\w+<\w+\.length;\w+\+\+\){var\s\w+=\w+\.charAt\(\w+\);var\s\w+=\w+\.charCodeAt\(0\)\^\w+\.charCodeAt\(\w+\);\w+=String\.fromCharCode\(\w+\);\w+\+=\w+;if\(\w+==\w+\.length-1\)\w+=0;else\s\w+\+\+;}return\(\w+\);}(?<X1042830>))|_0x[\da-f]+[^@]{1,800}while[\(\)\[\]\!\{]+try\{var_0x[\da-f]+=parseInt[^@]{1,3500},(\w{1,14})=Math\[_0x[^@]{1,37000}\[['"]id['"]\]=\58[^@]{1,43000}function_0x[\da-f]+\(\)\{var_0x[\da-f]+=\[[^@]{1,36000}\(\58\)\[[^@]{1,34000}catch\(_0x[\da-f]+[\)\{]+\}\};?(?<X1292341>)|_exists(?:\(['"]actionFilesMan['"]\)\h*\?\h*['"]g\(['"]?(?:null|FilesMan)\b(?<X2160330>)|\h*\(\h*['"]wp_authenticate['"](?:\h*\)){2}\s*\{\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*(\$\w{1,40})\h*(,[^\)]+\);)[^@\?%#\*\+]{199,1999}=\h*\w{1,40}\h*\(\h*\61\h*,\h*['"](?:wp\w{1,40}\h+LONGBLOB\h*,\h*){5}[^\);'"]+['"]\h*,\h*['"]\w{1,40}['"]\62(?<X2168402>)))|write(?:[\(\s]+(?:\$\w{1,9}\s*,\s*['"][<br>\s]{3,}<center>\s*<h\d+>[^!<\n]{2,40}\bh[a@]ck[e@]d\s*by\b[^;]+['"][\s\)]+(?<X1206611>)|fopen[\(\s]+['"][^'"]+\.php['"][,\s]+w[\)\s]+[,\s]+base64_decode[\(\s]+['"]PD9waHAKLy9zY3A[^'"]{9,999}['"][\)\s]+;(?<X1210780>))|\((\$\w+),(?:(?:\w+\()+['"][^'"]{199,}['"]\)+;(?:includ|requir)e(?:_once)?[\s\(]+stream_get_meta_data\(\66\)\[[^\]]+\][\s\)]*;(?<X1229371>)|\s*['"]<\?php\s*['"]\s*\.[^\}]{1,99}fseek\(\66,[^;]+;\s*include\s*\$\w+;\s*fclose\(\66\);\s*\}[^=]{1,99}\$\w+[\s=]+array_reverse\(\w+\(['"]\.['"],\s*['"]a\.b\.c\.d['"]\)\);\s*return\s*['"][^;]+;\s*\}[^#]+\w+::\w+\(\);\s*(?:\Z|//\s*EOF)(?<X220350880>))|\((?:[^\),]{1,49},\h*['"]<\?php\h*error_reporting\((?:0|NULL|False)\);[^\}]{1,199}<input\b[^>]{1,99}type=\\?['"]file\\?['"][^@\}]{1,199}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\\\$_FILES\[[^#]{99,1999}\btouch\(dirname(\(__FILE__\)),\h*\$\w{1,40}\);\s*(?:\}\s*)?@?unlink\69;(?<X2154440>)|\$\w+,\s*['"]new\s*victim[^>]{1,999}>[^;]{1,999}window\.location\.href\s*=\s*['"]https?://(?:\w+\.)?facebook\.com\b(?<X220345540>)|\$\w{1,9},base64_decode\(\$\w{1,9}\)\);\s*(\$\w{1,9})\s*=\s*['"][^'"]{99,300}['"];\s*fwrite\(fopen\(['"]\.htaccess['"],['"]w['"]\),base64_decode\(\72\)\);\s*chmod\((?<X2123921>)|\$fp,"\\xEF\\xBB\\xBF"\.(?:\$body(?<X2043541>)|iconv\('gbk','utf-8//IGNORE(?<X2044131>))|\s*(\$\w{1,4}),\s*['"]\s*(?:login|userid|username|email)\s*:?['"]\s*\.\s*\$\w{1,40}\s*\);\s*fwrite\s*\(\s*\76[^\$]{1,40}fwrite\(\s*\76,\s*['"]\s*(?:pass|passwd|password)\s*:?['"]\s*\.\s*\$\w{1,40}\s*\);(?<X2054701>)|fopen\([^\);:]+\),(\$\w{1,40})\);goto\s*\w{1,9};\w{1,9}:[^@]{1,999}\78=\w{1,40}\([^\)]{0,99}['"]https?://[^/]{0,40}\b[ap](?:nonymous|ornhub)fox\.(?:com|to)/[^;]{1,99};goto\s*\w{1,9};\w{1,9}:(?<X2164431>))|\h*\((?:\$\w{1,15},\h*['"]<IfModule\h*mod_security\.c>FucKFilterEngine\b[^\?]{9,299}\bpowered\h*by\h*alnjm33\b(?<X2173460>)|\h*\$htaccess\h*,[^\.]{1,40}DirectoryIndex\h+Sux\.html(?<X2140550>))))
\bg(?:a(?:gal[^;]{1,199}webshell(?:\_auto)?\.log\b(?<X220358240>)|lehdotid\h*\(uploader\)\h*</title>(?<X2174491>))|cc\s+-o\s+(exploits)\s+\w{1,40}\.c;\s*chmod\s+\+x\s+\3;\s*\./\3;(?<X2055541>)|et(?:\(['"]https?://(?:(?:[^\.]{0,25}\.)firstguide\.xyz/\w{1,25}\.txt['"]\);\s*if\([^\}]+\)[\s\{]+(\$\w{1,15})[\h=]+\$\w{1,15}[\h\.]+['"]/(?:wp\-login|themes|admin|settings)\.php['"];[^\}]{0,99}\bfwrite\(fopen\(\5,\h*['"]\w['"]\)(?<X2197111>)|[^/'";]{1,49}\.top/(gutenblock\-(?:64|86))['"],['"]\7['"]\);\s*\$\w{1,9}\h*=\h*co?md\(['"]chmod\h*\+x\h*\7\h*\W{2,3}\h*\./\7(?<X2183820>))|_option\(['"]gplrock_options['"],\s+\[\]\);\s+\$\w+\->\w+\s+=\s+\$\w+\[['"](\w+)['"]\]\s+\?\?\s+['"]https?://[^'"]{1,399}\w+\.php['"];\s+if\s+\(str\w+\(\$\w+\->\9,\s+['"]hacklinkpanel\.\w+['"]\)\s+\!==\s+\w+\)\s+\{\s+\$\w+\->\9\s+=\s+['"]https(?<X220363890>)|_stealth_name\(\)\{[^\\]{1,999}drop_and_run\(\)\{\w+\s*payload_func=(?<X220358414>)|content301page['"],[^;]{1,32};header\(['"\s]+\.\$\w+\);exit;\}\}\}\}\}\Z(?<X220341520>)|env\([^\)]+\);\s*\$(?:user|pass|username|password)[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\?]{0,199}\b(msg)[\h=]+['"][^'"]{0,199}\bby\h*uNkown\b[^;]+;\s*(\$\w+)[\h=]+fopen\(['"][^'"]+\.txt['"][^\?]{0,99}\bfclose\(\14\);\s*mail\([^\)]+\13\)(?<X2208132>)|env\s*\(['"](?:(REMOTE_ADDR)['"]\)\)\s*,\s*['"][^'"]+['"]\)[^\{]{1,20}\{\s*header\s*\(['"]HTTP/[\d\.]+\s+(?:404|401|403)\s+(?:Not\s*Found|unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^%]{99,700}https?://(?:www\.)?geoiptool\.com/\?IP\s*=\s*["']\.\$_SERVER\[['"]\16['"]\](?<X2134390>)|REMOTE_ADDR['"]\);[^@]{99,1500}(?:\$\w{1,20}\s*\.[\s=]+['"]\W{0,9}\b(?:CC|(?:Card|CC|C\-|D\-)\s*(?:number)?|(?:Expir(?:ation|y))?\s*(?:date|month|year)|CVV|Card\s*Security\s*(?:Number|Code)|CVN)[^'"]{0,99}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){3}[^\?]{50,900}\bmail\((?<X2133802>))|hostbyaddr(?:\(getenv\(['"]REMOTE_ADDR['"]\)(?:[^\?]{99,600}(?:\$\w{1,20}\s*\.?|\$_SESSION\[[^\]]+\])\s*=\s*\$_POST\[['"](?:VBV|CVV|CCV|PIN)['"]\];\s*\$\w{1,20}\s*=\s*fopen\((?<X2134950>)|\);\s*\$(?:msg|message|bilsmsg|f[uc]{2}k)\h*\.?\h*=\h*["'][^\w\'";]{0,40}Bismillah\b(?<X2143763>))|\s*\(\s*getenv\s*\(['"]REMOTE_ADDR['"]\)\)\s*,\s*['"][^\{]{1,30}\{\s*header\s*\(['"]HTTP/\d\.\d\s*(?:404|403|401)\s+(?:Not\s*Found|forbidden|unauthori[sz]ed)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^/]{9,300}['"]https?://www\.geoplugin\.net/(?<X2135540>))|linkofdoor\h*=\h*['"][^\?]{9,90}\$[lji]{5,15}\h*=\h*array\h*\((?:\h*['"][\./]{0,18}wp-config\.php['"]\h*,){2}(?<X2153560>))|host\h*(?:Exploiter\h*Team[^\?]{0,20}<\?php\s+@?error_reporting\h*\((?:0|NULL|FALSE)\);(?<X2167820>)|shell\b</(?:center|title|b|font)>[^\{\}]{9,299}\$\{['"]GLOBALS['"]\}\[(?<X2183660>))|IF8(?:9(?:\w?;<\?(?:php|=)?\s*(\$\w{1,20})\h*=\h*explode\(['"][^'"]+['"],['"][^'"]{99,800}['"]\);\s*foreach\(\25\h*as\h*\$\w{1,20}\h*=>\h*(\$\w{1,20})\)\s*\{\s*\26\h*=\h*preg_split\((?<X2159420>)|a;<\?[ph\s]*if\(\$_[GPRSC]\w{2,6}\s*\[\s*['"\]=\)\{]+echo\s*['"][<>\w]{1,16}priv8\s+uploader\s+by\s+\w+[^?]{99,512}Uploaded['"];\}{3}\s*\?>(?<X1265980>)|a\s*<[^?]{1,999}<title>php\s+polyglot\b(?<X220354700>))|(?:[9786]\w?[^\s]{0,2}<\?[ph\s]*session_start\s*\(\)\s*;\s*function\s*generate\w+\s*\((?<X2224950>)|\d[a-z];\s*<\?php\s*echo\s*['"][^'";]{1,99}\bUploader\s+by\b(?<X2163950>)|\d\w?[^\?]{0,99}<\?php\s*[^\{]{0,99}if\((?:isset\()?\$_[GPRSC]\w{2,6}\[[^\]]+\](?<X220364950>)|\d\w?[^\s]{0,2}\s*[^\?]{0,80}\s*<\?[^\?]{1,999}\?indoxploit(?<X2134501>)))|l(?:acier\s+bank</p>\s*</form>\s*</body>\s*</html>\Z(?<X220340690>)|ob(?:[\h\(]+\$\w{1,25}[\h\.]+['"][\s/\*]+['"][\h,]+GLOB_ONLYDIR[\h\)]+;\s*if[\h\(]+count[\h\(]+(\$\w{1,25})[\h\)]+>\h*\d+[\s\)\{]+foreach[\h\(]+\35\h*as\h*(\$\w{1,25})[\s\)\{]+if[\h\(]+@?is_writable[\h\(]+\36[\s\)]+\{(?<X2279720>)|al \$\w+; \$\w+=array\('\$\w+\[0\]=array_pop\(\$\w+\);\$\w+=\w+\(\d+,\d+\);.+create_';if\(function_exists.+?\)\);};unset\(\$\w+\);(?<X2044451>)|al(\$\w+);\39[^\n]{1,99}\39=\39[^=]{1,99}(\$\w+)=['"][^'"]+\.com['"][^\[]{1,129}wp_set_password[^\}]{1,49}\39,(\$\w+)[^\}]{1,29}\40,\41[^\=]{1,49}\$\w+=['"][^'"]+['"][^\(]{1,29}\w+[^;]{1,49};(\$\w+)\s*=['"]cw_tester['"][^@]{1,799}!username_exists\(\42[^(]{1,99}wp_create_user\(\42[^\}]{1,99}set_role\(['"]administrator['"][^}]{1,99},\s*\$\w+\);\}\}\);(?<X120350521>)|al(\$VERSIONDESTRUCTATARISBACK);if\(\44\)\s*return;(\$\w+)=['"][\d\.]{1,10}['"];\44=\45;(?<X2128900>)|al\h*(?:(\$\w{1,15});\s*(\$\w{1,15})\h*=\h*['"]UPDATE[^;]{9,99}\btransandfiestas\.ga/\w{1,9}\.php\?\w[^;]{1,99};[\h'"]+;\s*\$\w{1,15}\h*=\h*\47\->query\(\48\);(?<X1184700>)|(\$\w{1,20});\s*\$wp_auth_(?:url_)?key=['"]\w{32}['"];\s*(\$\w{1,20})=['"]https?://[^/]{2,15}\.spekt\.pw/[^\(\)]{9,150}\bif\(\(\50=file_get_contents\(\51\)(?<X2181291>)|(\$\w{1,20});\s*if[\h\(]+!(\$\w{1,25})[^\)]+\)\)\s*\{\s*\$\w{1,20}[\h=]+['"]_shaesx_['"];[^\}]{99,400}\bif[\(\s]+!function_exists[\(\s]+['"]get_data_ya['"][\s\)]+\{[^%`]{1,2100}\54[\h=]+[^;]+;\s*\53[\h=]+['"][^'"]*['"];\s*\}(?<X1211250>)|(\$\w{1,40})[\s,]+(\$\w+);\s*if\s*\([^\)]{0,99}\56\b[^\{]{1,99}\{[^=\$\{]{0,99}\bclass\h+(\w{1,40})\s*\{[^\};]{0,99}\$\w{1,40}[\s=]+(?:\[|Array\s*\()(?:[^\]\)]{0,199}['"](?:\w{1,9}:)?/[^'"]+\.(?:bin|sav)['"]\s*,){2}[^`]{999,19999}\57[\s=]+new\h*\58;\s*\56[\s=]+\(\w{1,9}\)\s*\57;(?<X1191912>))|al\h+(\$\w{1,40})\h*;(?:\h*define\h*\(['"]\w{1,40}['"]\h*,\h*['"]wp-content/uploads/[^'"]{0,99}['"]\)\h*;)?\h*\60\h*=\h*array\h*\(\h*['"]\60\[\d+\]\h*=\h*array_pop\(\60\);[^\v]{999,9999}\)[\)\};]{3,6}\h*unset\h*\(\60\)(?:\h*;)?(?<X1139161>)|al\s*(?:(\$wp)\s*;\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}['"][^'"]{0,99}\bwp\-includes/registration\.php['"][^\{\}]{1,199}\{[^=\}]*(\$\w+)([\s=]+)wp_create_user([\s\(]+)[^;]{1,99};\s*(\$\w+)\64new\h+WP_User\65\s*\63\s*\);\s*\66\s*\->\s*set_role\65\s*['"]administrator['"][\s\)]+;\s*\}\s*wp_redirect[^;]+\62\->request[\s\)]+;(?<X1199830>)|\$\w{1,40}\s*;\s*if\s*\(\s*!isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\$\w{1,40}\s*=\s*new\s*dolly_plugin\s*\(\s*\)\s*;(?<X2046220>))|al\s+(\$\w+);\s*if[\s\(]+!(\$\w+)\b[^;]+\b(function\s+)get_data_ya(\s*\()[^<]{99,1499}\b\71wp_cd\72[^%\\]{99,1499}\bfwrite\72[^,]+,\s*['"]<\?[^=]{1,199}(?:(?:\69|\70)[\s=]+['"][^'"]+['"];\s*){2}\}(?<X1197270>))))
\b(?:g(?:o(?:\h*=\h*(mass)['"]>\1\h*deface(?<X2175880>)|to(?:[\h\;]+\w+;[^\(]+(create_robots)[^\{]+function[\s=]+\3\((\$\w+)\)[\s=]+\{\s+(\$\w+)[\s=]+func\(\);\s+(\$\w+)[^!]+!file_exists\(\6\)\)[\s=]+\{\s+\5[^\n]{1,59}\5[^\n]{2000,}\bwp_remote_get\(\4,\s+array\(['"]\w+['"][^!]+!is_wp_error[^\?]{1,999}\$_SERVER\[[^\n]{999,2239}(\$\w+)\[\d+\][\s=]+\.[\s=]+\7\[\d+\][^;]+;\s+\}(?<X120348011>)|\h*(\w{1,40})\h*;\s*\9:\s*@?error_reporting[\(\d\)]+;\s*goto\h*(\w{1,40})\h*;\s*\10:\s*if\s*\([^;]+\[['"]tmp_name['"]\];[^\?\n]{99,999}\b(?:move_uploaded_file|copy)\s*\([^;]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1201420>)|\h*\w{9,40};(?:\h*\w{9,40}:\h*){2,}define[\(\s]+['"]\\[^'"\$]{1,40}['"][,\s]+preg_replace[\(\s]+['"]\\[^'"]+['"]\s*,\s*['"]{2}\s*,[^@\n]{99,}@set_time_limit\b[^\n\*]{99,}\bgoto\s*\w{9,40};(?:\h*\w{9,40}:){2,}(?<X1259740>)|\h+\w{1,6};\h*\w{1,6}:\h*(?:\$\w{1,40}\s*=\s*curl_(?:exec[\(\s]+(\$\w+)[\)\s]+;\s*goto\h+\w{1,6};\h*\w{1,6}:\h*\13[=\s]+curl_init[\s\(]+(\$\w{1,40})[^\n\\]+\14[=\s]+['"]\\[^/\*\n]{1,999}\b(?:tempnam|unlink)\b[^/\*\n]{1,99}\bgoto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275151>)|init[\(\s]+(\$\w+)[\)\s]+;\s*goto\h+\w{1,6};\h*\w{1,6}:\h*if[\s\(]+file_exists[\s\(]+(\$\w+)[\s\)]+\{\s*unlink[\s\(]+\17[^\\\n]{1,999}\16[=\s]+['"]\\[^\n\*]{1,999}\bgoto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275160>))|curl_setopt[\(\s]+\$\w{1,40}\s*,[^\n&]{1,999}&&\s*file_put_contents\s*\(\s*(\$\w+)\s*,[^;]+include(?:_once)?\s*\19[^\n\\'"]+=\s*['"]\\[^\n,]+=\s*tempnam[\(\s]+sys_get_temp_dir[\(\)\s]+,[^;]+;\h*goto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275170>))|\h+\w{3,9};\s*\w{3,9}:\h*(?:if\h*\(\h*!\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\s*\{\s*goto\h+\w{3,9};\s*\}[^\%&\^\|\*@]{999,9999}if\h*\(\h*@?[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$(?:HTTP_POST)?_FILES\[[^\]]+\][^\)]+\)[\s\)]+\{\s*goto\h+\w{3,9};\s*\}(?<X2162120>)|return\h*(\$\w{3,9});\s*(?:(goto)\h+\w{3,9};\s*\w{3,9}:\h*\22\h*=\h*substr\(\22\h*,\h*(\(int\))\h*(hex2bin)\(['"]\d+['"]\)\h*,\h*\24\h*\25\(['"][^'"]{1,40}['"])?[\s\)]+;\23\h+\w{3,9};\s*\w{3,9}:(?<X2163511>))|\h+\w{4,9};\h*\w{4,9}:\h*<form\b[^;]+;[^\{\}]{1,499}if\(@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{1,499}\bgoto\h+\w{4,9};\h*\w{4,9}:\h*error_reporting\(0\);(?<X2149050>)|\s*(\w{1,9})\s*;\s*\28\s*:\s*\$\w{1,40}(?:[=\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;[^\n\{\}]{0,499}\bfunction\s*(\w{1,40})[\s\(]+\$\w{1,40}(?:[^>\n]{1,999}\29[\s\(]+array[\s\(]+['"][^"']+['"]\s*=>\s*200)+[\s\);]+\}\s*\}(?<X1251470>)|\s*=\s*strpos[\(\s]+\$\w+[,\s]+base64_decode[\(\s]+["']\\[^\)]+\)[\s\)]*!=+\s*false\s*\?\s*base64_decode[\(\s]+['"]\\[^'"]+['"][\)\s]*:\s*base64_decode[\(\s]+['"]\\[^'"]+['"][\s\)]+;(?<X1253480>))|\s*(\w{3,12})\s*;\s*(?:(\w{3,12}):\s*(\$\w{1,40})[\s=]+['"]\\[\d\\xa-f]{14,99}['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\32:\s*echo\s*(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;\s*goto\s*\33\s*;\s*\35:\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][^'"]{2,8}['"][\.\s]+(?:\34[\(\s]+)+\36[\s\)]+;(?<X1226270>)|\32:\s*echo\s*(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\39:\s*(\$\w{1,40})[\s=]+['"][^'"\$]+['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\41:\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][^'"]{2,8}['"][\.\s]+(?:\40[\(\s]+)+\38[\s\)]+;(?<X1226260>))|\s*(\w{3,9});\s*\43:\s*@eval[\(\s]+['"]\\x3f\\x3e['"][\s@\.]+file_get_contents[\s\(]+['"](?:(?:(?:\\x[a-f\d]{2})+(?:\\\d{2,3})+)|(?:(?:\\\d{2,3})+|(?:\\x[a-f\d]{2})+)){4,}['"][\s\)]+;(?<X1212630>)|\s*\w+;\w+:(?:[^\.]{1,99}\w+\.txt['"];[^=]{1,299}(\$\w+)=stream_socket_client\(['"]tcp://\{\$\w+\}:80[^\{]{10,499}\{fwrite\(\45,['"]GET\{\$\w+\}[^;]{1,99};\$\w+=stream_get_contents\(\45\);[^>]{1,499}(\$\w+)=tempnam\(sys_get_temp_dir[^;]+;file_put_contents\(\46,\$\w+\);include\46;unlink\(\46\);\}{2}(?<X1319300>)|\s*\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]\bcurl\s*\-(?:k\s*\-O\s*https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/(\w+\.png);chmod\s*\d{3}\s*\48;nohup\./\48\s*\-u\s*\w+\s*\-o\s*\w+\.\w+\.stream:80\s*\-p\s*xgas["']\);(?<X1303571>)|O\s*https?://(?:\w+\.)+(?:[\w\-\/]+)/(\w+\.png);chmod\s*\d{3}\s*\50;nohup\./\50\s*\-{2}url\s*ws://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d+[^)]+\-{2}cores\s*\d+\s*['"]\);(?<X1300460>)))|\s*\w{1,9};(?:\s*\w{1,9}:\s*(?:(function)\s*\w{1,9}[\(\s]+\$\w+[\)\s\{]*\$\w+\s*=\s*['"]{2}\s*;\s*if[\s\(]+\52_exists[\(\s]+(base64_decode)[\("']+\\x[^\)]+\)[\s\)]+\{\s*\$\w{1,40}[\s=]+curl_init[\(\)\s]+;[^\n]{99,}\.\s*\53[\(\s]+['"][^'"]+["'][\)\s;\}]+return\s*\$\w{1,40}[\s;\}]+goto\s*\w{1,9};(?:\s*\w{1,9}:)+(?<X1254340>)|\$\w{1,40}=['"]moban['"];[^@\{]{99,499}\bgoto\s+\w{1,9};\s*\w{1,9}:\s*if\((?:move_uploaded_file|copy)\(\$_FILES\[(?<X2145040>))|\w{1,9}:\s*header\(['"]Location:\s*https?://(?:www\.)?banc[ao][^'"]{9,49}['"]\);\s*(?:goto\s*\w{1,9};\s*(?:\w{1,9}:\s*){1,2}){2}echo\s*['"]<(?:title|h\d)>40[34]\s*(?:Not\s*Found|Forbidden)\b(?<X2156330>))|\s+(\w+);\s*\57:\s*(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+['"]\\(?:160|x70)\\(?:150|x68)\\(?:160|x70)\\(?:x3a|0?72)[^,\n]{9,199}\beval[\s\(]+UrLDecoDe[\s\(]+str_replace[\s\('"]+\\75\\61['"][,\s]+['"]{2}[,\s]+\58[^=\n]{0,99}=\s*GZinFlaTE[\(\s]+SuBStr[\s\(]+\58[^\n]{9,999}goto\s+(\w+);\s*\59:(?:\s*\w+:)+(?<X1231840>)|\s+(\w+)[^\(]{1,99}\s+(function)\s+(\w+)[^'"]{1,49}(str_)\w+[^\{]{1,299}\62\s+\((\$\w+)\)[^'"]{1,49}pack\(['"]\\110\\x2a['"],\s*\65[^@]{99,999}\64\w+[^>]{1,399}substr[^@]{1,3999}hash_hmac[^@]{1,199}@?gzuncompress[^#]{1,1299}\64\w+[^>]{1,499}\61:\s+\62[^>]{1,299}curl_init[^@]{1,1899}\63\(\65[^@]{1,1899}add_action\(['"]\\167\\x70\\x5f[^\)]+['"]\);(?<X120351170>)|\s+\w+;[^\(]{1,49}(?:\w+[^\n]{1,299}\w+\(['"]\\56\\170\\x6d\\154['"][^\?]{1,999}\$_SERVER[^\?]{1,499}\w+[^@]{1,4200}\{\s*goto\s*(\w+)[^@]{1,99}['"]\\x68\\x74\\164\\160\\72\\57[^'"]+\\66\\137\\x31\\x36\\57['"][^@]{999,1999}(@?file_get_contents)\((\w+)[^@]{1,1199}\68\(\69[^\*]{1,999}goto\s+\w+;\s*\w+:\s*\67:(?<X120346611>)|function[^\{]{1,49}(array)\(\)\)[^\?]{1,1119}\$_SERVER\[['"]\\x53\\x45\\x52\\x56\\105\\122\\137\\116\\x41\\115\\105['"]\];[^\?]{1,999}\71[^\?]{1,799}\$_SERVER\[['"]\\x48\\124\\x54[^'"]+\\105\\122['"]\]\)[^@]{1,999}(@?file_get_contents)\((\w+)[^@]{999,}\72\(\73[^\*]{1,799}exit;[^\*]{1,199}goto\s*\w+;\s+\w+:\s*\w+:(?<X120346540>))|\s+\w{1,9};(?:\s*\w{1,9}:[^;]{0,49}\bfile_get_contents\h*\(\h*['"]/home/['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]/etc/(?:['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]/)?(?:shadow|passwd)['"]\h*\)\h*\);\s*goto\b(?<X2143831>)|\w{1,9}:\s*\$\w{1,40}=\w{1,40}\(['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^@]{1,99}\bgoto\s+\w{1,9};\w{1,9}:\s*unlink\(['"][^'"]{1,49}\.zip['"]\);(?<X2144090>))))|r(?:[e3][e3]tz\b[^\?\n\r]{0,99}</?font\b[^@]{99,999}\bindoxploit\b(?<X2155742>)|eetz(?:[^\?]{1,99}<\s*marquee[^>]{1,99}>[^<]{1,999}indoxploit(?<X2137901>)|\s*:[^\?]{0,199}anon666txploit(?<X2181342>)))|S_\w+=php\d[^%]{1,9}bash\s*\-c\s*['"]\$\(curl\s*\-fsSL\s*https?://gsocket\.io/\w+\)[""](?<X120369850>))|hack(?:\h*</[^:]{0,99}<a\h+href\h*=\h*['"]https://(?:www\.)?facebook\.com/aziz\.elalj\b(?<X2179040>)|ed\h+by\h+H4nZY\b(?<X2266562>)|ed\s+by(?:[^'"]{0,99}['"]https?://t\.me/tsecnetworkv2['"](?<X220355850>)|\b[^'";]{1,40}['"];\$\w{1,40}=(?:base64_decode|gz(?:inflate|uncompress)|str_rot13|convert_uudecode|eval)\s*\((?<X2132980>))))
\bheader(?:[\s\("']+Location[\s:htps/]+tdgram\.com/\w{2,10}["')\s;]+die[\s\(\)]+;(?<X1254011>)|[\s\(]+['"]Content\-type(?:[:\h]+text/html?\b[^\)]+\);\s*(\$[^\s=\w]{1,499})[\s=]+["'][^\?\{\}]{1,999}\bmail[\s\(]+\2,[^;]*\$_SERVER\[[^\?]{1,1999}\b[pes](?:assthru|xec|hell_exec)[\s\(]+\$_[GPCSR]\w{2,6}\[[^\?]{1,999}\?>\s*<(html>)[^@]{1,1999}</\3\s*(?:<\?[ph\s]+\W+(?:\?>\s*)?)?\Z(?<X1212220>)|[:\s]+text/html;[^\?]{1,4999}\$(\w+)[\s=]+function\s*\([^\{]+\{\s*\$\w+[\s=]+\$[\{"]*_[GPCSR]\w{2,6}\b[^;]+;[^\}]+=\s*['"]<FilesMatch\s+['"](?:[^'"]{1,19}\.php\W){5}[^#]{1,1999}\$(\w+)[\s=]+['"]https?://[^\?]{1,999}=\s*curl_init[\s\(]+\$\6\b[^\?]{1,999}\$\5[\h\(\)]+;(?<X1210170>))|\((?:"\s*location:\s*ufl\.php\?id="\s*\.\s*\$first\[0\]\);(?<X2048020>)|['"][^'"]{1,40}['"]Sniper_SA\s*shell['"]{2}\);\s*header\(['"][^'"]{1,15}401\s*Unauthorized['"]\)(?<X2129970>)|['"]\w+\-type:\w+/json['"]\);\s*\w+\(\$_SERVER\['\w+['"]\]!==['"]POST['"]\)die\(['"]\{\}['"]\);\s*\$\w+\s*=\s*json_decode\(file_get_contents\(['"]php://input[^%]{1,299}file['"],['"]_get[^%]{1,99}implode\(['"]['"],\w+\(['"]base64_decode[^%]{99,2999}die\(\w+\(\[['"]\w+['"]=>@?touch\(\$\w+,\$\w+\)\]\)\);\}\s*die\(['"]\{\}['"]\);(?<X120365172>)|['"]Cache\-Control:\s*no\-cache,[^\{]+\{if\(!empty\(\$_SERVER\[[^/]+https?://[^;]+;\$\w+=curl_init[^\{]+\{return\s*null;\}\$\w+=json_decode[^\-]+Google\-InspectionTool[^\[]+\[\s*['"]google[^\{]+\{[^\.]+header\(['"][^'"]+301\s*Moved[^;]+;HEADER\(['"]lOCATION:\s*https?://\w+\.com[^;]+;(?:exit|die);\}\Z(?<X1314730>)|['"]Content(?:-type[^%]{1,99}ASTROID_SSRF_RCE_[^%]{1,199}if\(isset\((\$_REQUEST\[['"]\w+['"]\])[^%]{1,19}shell_exec\(\12[^%]{1,99}@?unlink\(__FILE__\);echo[^;]{1,19};\}(?<X120359941>)|\-Type:(?:[^\)]+\);(?:\s*\$\w{1,40}\s*=\s*['"]\d+['"];)+(?:\s*\$\w{1,40}\s*=\s*['"]\\x[\d\\xa-f]{9,999}['"]\s*;)+\s*\$\{["'][GOBALS\\x471532cf]{9,28}['"]\}[^>]{999,}\.c>[^\*]{999,}\*\.xml[^\?]{99,9999}\$\{["'][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1201810>)|\h*text/html;[^\)]{1,99}\);\$[0o_]{1,40}=[^@></]{1,999}\$([0o_]{1,40})=(\$\{["']GLOBALS['"]\}\[)['"][0o_]{1,40}['"]\]\(\$[0o_]{1,40}\.\$[0o_]{1,40}\);(?:eval|assert)\(\$\15\);(?:\s*['"]\);)?\16['"][0o_]{1,40}['"]\]\(\);\s*(?:\?>)?\Z(?<X2164110>)))|['"]HTTP/(?:1\.(?:[01]\s+40[34][^@]+\$(email|login|id)=(\$_POST\[)[^\]]+\];(\$pass(?:word)?)=\19[^\]]+\];[^\(]{1,199}\b(?:curl_init|file_get_contents)\(['"]https?://[^'"]+\b(?:[\?&]\w{1,40}=(?:\$\18|\20)){2}(?<X2141760>)|\d+\h+40[34]\h+(?:Not\h+Found|Unauthori[sz]ed)['"]\);[^\?@\*]{99,1500}\b(?:symlink\(['"]/[^\)]+\.txt['"]\);\s*){10}(?<X2186270>)|\d\h+(?:404|403|401)\h+(?:Not\h+Found|forbidden|unauthori[sz]ed)['"]\);\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\bfunction\h+(?:bin_rand[om]{0,2}|rand[om]{0,2}_bin)\(|[^%]{1,350}<title>\h*Apple\b)(?<X2140041>)|\d\s+(404\s+Not\s+Found)['"]\);[^\.]{9,40}\s*\$file\s*=\s*fopen\(['"](?:\d{1,3}_bot\.txt['"][^\)]+\);[^/]{9,200}(?:echo|print)\s*\(?['"]<[^>]+>\s*\24(?<X2120080>)|\w{1,3}[-_]{1,3}\.txt['"][^\)]+\);[^/]{9,400}(?:echo|print)\s*\(?['"]<[^>]+>\s*\24(?<X2239201>)))|[123]\.\d+\s*404\s+Not\s+Found['"]\);\s*echo\s*['"]404\s+Not\s+Found.?['"];\s*(?:die|exit)[^;]{0,9};\s*\}\s*\$\w{1,40}\s*=\s*@?file_get_contents\(\$\w{1,40}\);\s*if\s*\(\s*strpos\s*\(\s*\$\w{1,40},\s*['"]PDF\-\d+\.\d+['"]\)(?<X2127981>)|[\d\.]+\s+40[14]\s+(?:Unauthori[zs]ed|Not\s+Found)['"]\);(?:exit|die)[^;]{0,19};[^@\|]{9999,19999}(?:\{(?:unlink|[mc]o(?:py|ve_uploaded_file))\((?:\$_[GPCSR]\w{2,6}\[[^\]]+\][,\)])+;\}[^@#]{99,2999}){2}(?<X2194750>)|[^'"]+\b404\s+Not\s+Found['"]\);[^@]{999,2999}\bfunction\s+\w{1,40}\s*\(\s*\)\s*\{\s*error_reporting\((?:0|NULL|False)\);[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\((?<X2162320>)|\d+\.\d+\h*(?:403|404)\s+\w+['"]\);(?:exit|die)[^\?\n]{99,1999}\bstrpos\(\$\w+,\h*['"]favicon\.ico['"]\)[^\n#]{99,299}\bi['"],\h*\$_SERVER\[[^\]]+\][\)\{\h]+\$[^\*]+User\-AGENT:\s*\*\s*Allow:\s*/['"];[^;]+sitemap\.xml['"];[^\n]{1,1499}robots\.txt['"],\$\w+\);\}(?:exit|die)\(\);return;\}\}else\{\}(?<X120330152>)|\d\.\d\h+404\h+Not\h+Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\D{0,99}\$\w{1,20}\h*=\h*['"][\w\s]{1,20}(?:Shell|backdoor)["'];(?<X2145910>))|['"]Location:(?:[^;]{1,49};\s*(?:die|exit)[^;]{0,19};[^\?\$]{1,19}/[\*\s]+Scampage\s+by\s+MrProfessor\b(?<X2153200>)|[^\?]{1,40}/?\w{1,20}\.php\?login-microsoftonline-com_onedrive0\d+['"]\);\s*(?:exit|die)[^;]{0,19};(?<X2153031>)|\h*https?://icloud\.com["']\);\s*(?:exit|die)[^;]{0,9};[^\*%]{999,9000}\bmail\((?:\$\w{1,20}\h*,?\h*){4}\);\s*file_get_contents\s*\(['"]https?://api\.telegram\.(?:org|com)/bot\b[^\?]{1,30}/sendMessage\?(?<X2155430>)|\s*http(?:s:\/\/www\.google\.com\.au\/url\?sa[^'"]{1,99}https?(?:%3A|:)(?:%2F|\/){2}www\.paypal\.com(?:%2F|\/)signin&usg=AFQjCNFZ290e5[^'"]{1,50}['"]\);\s*die\(\);(?<X1126080>)|s?://[^;]{1,99};\$\w{1,40}=[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^>]{1,499}\bfile_put_contents\(['"][^'"]+\.txt['"][^;]{1,99};(?:exit|die)[^;]{0,19};(?<X2173070>)))|['"]Vary:\s*User\-Agent['"]\);[^%]{1,799}\$current_url[\s=]+\$\w+\s*\.\s*\$_SERVER\[['"]HTTP_HOST[^%]{1,2999}\$current_url\s*===\s*['"]https?://[^'"]{1,99}['"][^%]{1,399}make_request\(['"]https?://[^'"]+\.pages\.dev/[^'"]{1,99}['"]\);\s*exit;\s*\}(?<X120364540>)|[^\)]+\b40[345]\b[^\?@]{1,999}/\$id?xkill?er\.php\b[^\?]{1,999}\b(?:file_get_contents\s*\(\h*['"]https?://api\.telegram\.org/[^;]{1,199};\s*@?){2}\h*header\h*\(\h*['"]Location:(?<X2164220>))|\h*\(['"](?:HTTP/(?:1\.\d\h*404\h*Not\h*Found['"]\);[^\{]{9,40}\b(function)\h+aHr\([^\\%\*]{99,600}\b\39\h+get_data_yo\h*\(\$(?<X2169940>)|\d\.\d\h+404\h+Not\h*Found['"]\);\s*(?:exit|die)[^;]{0,9};[^\[]{9,150}\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\{]{9,40}\{\s*\$\w{1,20}\h*=\h*fopen\(['"][^'"]{1,20}/blacklist\.dat['"](?<X2141250>))|location:(?:[^\?]{1,20}/\w{1,20}\.php\?websrc\h*=\h*['"]\.md5\(['"]X-moustache['"]\)\.(?<X2144430>)|\h*\w{1,20}\.php\?websrc\h*=\h*['"]\.md5\h*\(['"]n[0o]{2}b\h*[a4][5s]{2}[a4][s5][!1i]n\b(?<X2138541>))|WWW\-Authenticate:\h*Basic\h+realm=[^\)]{2,20}\bwas\h*Here\b[^\)]+\);\s*header\h*\(['"]HTTP/1\.0\h+40[14]\h*(?:not\h+found|unauthorized)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^\$]{0,90}\$\w{1,20}\h*=\h*['"][^'"]{99,1500}['"];\s*\$\w{1,20}\h*=\h*base64_decode\h*\((?<X2187790>))|\h*\(\h*['"](?:\h*Location:\h*[^\?]{2,99}\.php(?:\?|[^_]{1,30})cmd=\w{1,20}&[^\$]{1,30}=\$praga(?<X2149752>)|Content\-type:\h*text/html[^\)]+\);\s*(\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\]\s*\(0\);[^\(]{0,99}\(['"]\$url\h*,[^@]+\46\w+['"]\]\s*\(\\?['"]\W\(?sitemap\)?\.(?:\*\.)?xml\b[^\?@#%\*&!\+\|]{499,1499}\46\w+['"]\]\h*\(\h*\);(?<X1180431>)|HTTP/1\.\d+\h+404\h+Not\h+Found['"]\h*\)\h*;[^=]{1,999}\$(?:auth|s)_pass\h*=\h*['"][^'"]{1,40}['"]\h*;(?<X2168700>)|Location:\h*(?:https?://www\.)?pubgmobile\.com[^;]+;\s*function\h*\w{1,25}\h*\(\)\s*\{\s*\$\w{1,15}\h*=\h*@?\$_SERVER\[[^#]{0,3500}\bfile_get_contents\h*\(\$\w{1,15}\);\s*\$\w{1,15}\h*=\h*['"]https?://api\.telegram\.org\b(?<X2186551>))|\s*\(['"]HTTP(?:/(?:1\.\d\s+(?:(?:404|401)\s+(?:Not\s+Found|Unauthori[sz]ed)['"]\);(?:\s*(?:echo|print_?r?)[^;]{1,299};)?\s*(?:exit|die)[^;]{0,9};(?:\s*\}){1,2}\s*(?:function\s+login_shell\s*\(\)|[^@\.]{1,2999}\.\s*php_uname\s*\(\)\s*\.[^\@]+@?copy\s*\(\$_FILES\[)(?<X2125451>)|(?:404|403)\s+(?:Not\s*Found|Unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^@]{9,400}<title>(?:Chase|well's\s+Fargo|Bank\s+of\s+America|Halifax)\b(?<X2125951>)|404\s+Not\s+Found['"]\);[^%]{99,200}<title>\s*AndroXshell\b(?<X2125620>))|\d\.\d\s+(?:401|404|403)\s+(?:Unauthori[sz]ed|forbidden|Not\s+Found)['"]\);\s*(?:exit|die)\s*\(['"][^=]{1,20}href\s*=\s*https?://php\.spb\.ru/remview/(?<X2135690>))|s?://(?:(?:www\.facebook\.com/(?:ensikology\.id|IdhamDotID))|(?:bkenv4@gmail\.com))['"]\);\s*(?:die|exit)[^;]{0,9};(?<X2062034>))|\s*\(\s*['"]location:(?:[^\)]{1,199}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2129093>)|\s*https?://(?:organiconlinesale|goodwelnesswebmart|canadiansafestoreonline)[^'"]+['"]\);(?<X1124851>)))
\bh(?:eaders\h*(?:=\h*['"]From:\h*(?:MrTrojan\h*<[^\(]{9,99}phpversion\(\);\s*mail\((?<X2144032>)|Phising['"];\s*mail\((?<X2142740>))|\.?=\h*['"]From:\h*By_o0om['"]\h*\.\h*['"]\\r\\n['"];\s*mail\([^\)]{1,49}\);\s*header\(['"]Location\b(?<X2173171>))|e(?:llopage['"]=>['"]\s*<center>\s*<h\d>alexusMailer\s*service</h\d>\s*</center>(?<X2124700>)|x2bin(?:\([^;]+;\s*\?>\s*<script\b[^\\]{1,999}\w+\.replace\(/<\\/\?\.\*\?script\.\*\?>[^\}]{1,99}eval\([^\?]{1,399}</script>\s*<\?php\s*\}\s*add_action\(['"]\w+['"],\s*['"]\w+['"]\);\s*\}(?<X220361800>)|\h*\(\h*['"]\\[^'"]{1,99}['"]\h*\)\h*\)\h*;\h*goto\h*\w{3,12};[^\v\{]{1,499};\h*\w{3,12}:(?:\h*eval\h*\(){9,}(?<X2172401>)|\s*\(\s*\w+\s*\([^;]+;\s*\}\s*add_action\([^\{]+function\(\)\{[^=]+=\s*['"]/google\w+\.html(?<X220358202>))|ylink\.me['"][^\^]{1,999}<title>[^<]{0,99}resmi\s+slot\b(?<X220358260>))|ide\s+-s\s+"/usr/sbin/httpd"\s+-d\s+-p\s+ax\.pid(?<X2047330>)|ostname\h*=\h*gethostbyaddr\(\$\w{1,9}\)[^\(]{0,99}(?:(\$\w{1,40})\s*\.=\s*['"]\w{1,9}\d?\s*:\s*['"]\s*\.\s*\$_POST\[["'](?:user|pass)[^;]+;\s*){2}\10\s*\.=\s*['"]\W{9,40}[^\(]{9,200}sendMessage\(\10\);(?<X2143731>)|ref(?:[=\s]+['"](?:(?:replicapanerai|chloereplica|tswissreplicawatch|jerseysclub)\.\w{32,}\.html['"]\s*/?>\s*<title>[^\\]{1,299}<style>img\s*\{max\-width:\s*99%(?<X220345031>)|\w+\.\w{32,}\.html['"]\s*/?>\s*<title>[^<]{1,999}(?:A2325m</title>\s*<meta[^>]{1,999}\breplica\b(?<X220345011>)|backless[^<]{1,99}formal</title>\s*<meta[^>]{1,99}backless\s+push\s+up\s+bra\b(?<X220345022>)))|\h*=\h*(?:(?:['"]\h*)?https?://cdn\.jsdelivr\.net/gh/iDevMore/(?<X2157511>)|['"](?:https?:)?//0x[a-z0-9]{1,20}\.github\.io/MARIJUANA/(?<X2141321>)|['"][^\$]{1,10}\$site_url\.['"]/wp\-(?:content|includes|admin)/plugins/([^/]{1,40})/[^\.]{1,20}\.php['"][^>]{1,49}>\17\h*shell\b(?<X2174341>)|['"]https?://www\.facebook\.com/IdhamDotID['"](?<X2158850>)))|t(?:ml(?:_footer\s*\(\)\s*\{\s*[^>]{1,99}<h\d*>\s*Coded\s*by\s*MizoZ(?<X2058280>)|specialchars\((\$_[GPRSC]\w{2,6}\[['"])\w{1,40}['"]\]\);\s*if\(\21hajar['"]\]\)\s*\{(?<X2163931>))|tp_(?:response_code(?:[\(\s]+4(?:04[\)\s;]+define[\s\('"]+self['"]\s*,\s*['"][^'"]*[s5]h[e3]ll(?<X2209011>)|\d+[\)\s]+;\s*(\$\w{1,40})[=\s]+['"][^'"]{9,}['"]\s*;\s*(\$\w{1,40})[=\s'"@]+eval[\(\s]+(?:\$\w{1,40}[\(\s]+)+\24\[\d+\](?:\s*\.\s*\24\[\d+\])+[\s\)'"]+;[^\?]{0,999}\beval[\s\(]+\25[\s\)]+;(?<X1228000>))|\(404[\);\s]+(?:exit|die)\b[^;]{0,19};[^\.]{1,699}\bif[\(\s]+isset[\(\s]+(\$\w{1,40})\D{2,9}\27[\s='"]+(?:recover|check)['"]\D{2,9}isset[\(\s]+(\$\w{1,20})\b[^\\#]{9,300}\bwp_dir_file[\(\s]+\28[\);\s]+chmod[\(\s]+\$\w{1,40}\,\d+\);\s*if\([^\(]{1,20}\bfile_put_contents\((?<X2203612>))|USER_AGENT['"]\]\)\s*,\s*['"]googlebot['"]\)\s*\)\s*\{\s*header\s*\(['"]http/\d\.\d\s*301\s*moved\s*permanently['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*function\s+generateRandom(?:String|number)\((?<X2133332>))|tp(?:d\.conf['"]\s*,\s*['"]vhosts\.conf['"]\s*,\s*['"]cfg\.php['"]\s*,\s*['"]config\.php(?<X2100811>)|s?://(?:(?:www\.)?facebook\.com/xarfaoui\s*\*/\s*@?(?:include|require)(?:_once)?[^'"]{0,5}['"][^\.]{0,15}\banti\d*\.php['"][^;]{0,5};(?<X2173630>)|[^;]{9,40}\.txt['"];\s*\$\w{1,20}\s*=\s*['"][^;]{0,20};\s*net\suser\sAdmin\s*/add\s*/expires:never\s*/passwordreq:no;(?<X2126161>)|\d+\.\d+\.\d+\.\d+/[^%]{1,99}(\$\w+)[^%]{1,299}\w+\(\$_COOKIE,\s*\$_POST\)[^%]{1,99}@?unserialize(\([\$\w]+)\35\(base64_decode[^:]+\w+::\w+\(['"]https?://httpbin\.org[^%]{99,999}\34\->\w+\(\);\Z(?<X2298320>)|idmsa\.apple\.com/[^%]{999,5999}(\$subject)\h*=[^;]{1,99}\bAPPLE?\s+(?:LOGIN|INFO|ID)[^\(]{9,299}\bmail\([^\)]+\37(?<X2142171>)|t\.me/v[3e]n[0o]mh[4a]ck\b(?<X2224401>))|s?\://tradequark\.com[^\$]{1,64}(\$\w+)(\s*=\s*)file_get_contents\s*\(\$\w+[);\s]{1,16}[^_]{1,64}(\$\w+)\41tempnam\s*\(sys_get_temp_dir[^;]{1,64}[\s;]+file_put_contents\s*\(\42\,\40[);\s]+include\42[\s;]+unlink\s*\(\42\);(?<X2299061>)))|uman[\h=]+substr_count[\h\(]+\$\w+[\h,]+['"]#\w+['"][\h\)]+;[^%\^&]{9,99}<title>\h*ZeroBot\b[^%\^&]{99,2000}\becho\h*\$\w+[\h\.]+['"]\h*\?del['"\?>\h]+delete\h*Antibot\h*File\b(?<X2319292>))
\bi(?:d(?:\h*=\h*['"]?[back]{0,2}\d{0,3}shell['"]\s*>[^@]{1,1999}\b[sape](?:val|ystem|ssert|open|xec|hell_exec)[\h\(]+['"]?\$\w{1,16}\b[^;]{1,99}\)\h*;(?<X2175820>)|\s*=\s*system\s*\(\s*base64_decode\(\s*"cGlkb2YgY25yaWc=(?<X2050160>))|f \((?:\$(?:_FILES\['F1l3'\]\) {move_uploaded_file\(\$_FILES\['F1l3'\]\['tmp_name'\], \$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['Name'\]\); Exit;}(?<X1034521>)|whattime\s*==\s*"goodtime" \|\|\s*empty\(\$settings\)\) {(?<X2044851>))|(?:md5\(\$_COOKIE\['i'\]\) == '.{32}'\)\s*{\s*function file_download\(\$filename, \$mimetype='application/octet-stream'\) {(?<X2044831>)|strpos\(\$check_result,'BLOCK'\) !== false \|\| strpos\(\$check_result,'FOUND'\) !== false \|\| strpos(?<X2044631>)))|f(?:![\(\s]+pidof\s+(xmrig)[^\.]{1,50}researchvetku\.com/c3pool/\7\$\*[^'"]+(echo)[^\\]+\8[\s=]+['"]Run[^\.]+\7[^\.]+\7\\"(?<X220347901>)|(?:/\*[^*]+\*/)?\((?:/\*[^*]+\*/)?isset\((?:/\*[^*]+\*/)?\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/\*[^*]+\*/)?\)(?:/\*[^*]+\*/)?\)(?:/\*[^*]+\*/)?\{(?:/\*[^*]+\*/)?\$_[GPRCS]\w{2,6}(?:/[^/]+/)?\[[^\]]+\]\((?:/[^/]+/)?\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/[^/]+/)?\)(?:/\*[^*]+\*/)?;(?:/[^/]+/)?(?:/[^/]+/)?(?:exit|die)(?:/[^/]+/)?[^;]{0,9};(?:/[^/]+/)?\}(?:/[^/]+/)?(?<X1036612>)|(?:\s*\(sha\d+|\s*\(md5\s*){2}\(\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\)\)\s*[^\w]{2,3}\s*['"][^'"]+['"]\)\s*\{\s*if\s*\([^\{\}]{1,99}\{[^\{\}]{1,99}\}\s*@?(?:eval|assert|system|shell_exec|passthru)\s*\(\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\);[^\}\{]+\}\s*else\s*die[^;]{0,40};(?<X1062321>)|([\h\(]+)defined\12['"](\w+)['"][^\v\};]{1,499}(\$\w{1,40})[\h=]+(\$_[GPSRC]\w{2,6}\[)[^\}]{1,99}\beval\12\14\b[^\v,]{1,199}\b(file_)pu(t_contents\12)\13[\h\.]+(?:\15[^\]]+\][,\)\h]{1,3}){2};[^\v]{1,499}\b\16ge\17['"]https?://magentostore\-telemetry\.com/[^;]{1,199};\h*if\12[^;\}]{1,99}\bbreak;(?:\h*\})+(?<X1192600>)|([\s\(]+)defined\19['"](ABSPATH)['"][\s\)]+return \20;\s*else[\s\{]+(?:\$\w{1,40}[\s=]+str_replace\19[^;]{1,99};\s*){2}(?:[^\?]{1,999}=mysqli?_connect\19(?:DB_(?:HOST|USER|PASSWORD)\s*,?){3}\);){2}[^\?]{499,4999}\bif\19strlen(\19\$\w+\s*\))[\s<>=!]+\d+\s*\)\s*@?eval\21;(?<X1192223>)|[ ]*\([ ]*@?\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*\{[ ]*echo[ ]*\([ ]*(\$\w{1,40})[ ]*=[ ]*\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*\.[ ]*\23[ ]*\([ ]*\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*;[ ]*(?:exit|die)\b[^;]{0,9};[ ]*\}(?<X1038641>)|[\(\h]+(?:!empty(?:[\(\h]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]+\{\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\}]{9,199}\bfile_put_contents[\(\h]+\26,\h*['"]<\?php[\\n]*['"][\h\.]+base64_decode[\h\(]+\25[^;]+;\s*echo\h*\26;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1204630>)|[\h\(]+(\$_SERVER)\h*\[['"]HTTP_USER_AGENT['"]\][^:;\?]+\$\w{1,40}\h*=\h*['"]https?://\w{1,99}\.\w{2,3}/in\.php\?\w{1,9}=['"][^;]+;\s*if[\h\(]+\$\w{1,40}\h*=\h*file_get_contents[\h\(]+\$\w{1,40}[\s\)]+\{[^;]+\bcurl_init\h*\([^\}]{9,999}array_flip\h*\(\28,[^;]+\28\);(?:\s*\}){3}(?<X1182610>))|(?:(?:!\h*)?(?:isset|empty)[\(\h]+)?(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\)\h]+\{\s*(\$\w{1,40})\h*=\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\s\(]+\30[^;\)]+\)\s*;\s*while[\s\(]+!feof[\s\(]+\31[\s\)]+\{\s*(\$\w{1,40})\h*=\h*fgets[\s\(]+\31\s*,[^;]+;\s*echo\b[^;]+\32\s*;\s*\}[^\}]{0,40}\}(?<X1188450>)|(\$\w{1,40})\h*!=+\h*(\d+)[\s\)]+\{\s*function\h+(?:(\w{1,40})\h*\([^\)]{0,40}\)\s*\{\s*for\b[^:]{9,99}\}(?:\s*eval[\h\(]+\36\(['"];\)+['"][^'"]{9,9999}['"]\(edoced_46esab\(lave['"]\)\);){3,}\s*\34\h*=\h*\35;\s*\}(?<X1184021>)|\w{1,40}\h*\([^\)]{0,40}\)\s*\{\s*for\b[^:\?]{99,999}\{\s*setcookie[\h\(]+\$\w{1,40},[^;]+;\s*(\$\w{1,40})[\h=]+\w{1,40}[\h\(]+\$\w{1,40}[\h\.]+['"]://['"][^;]+\burlencode[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]+echo\h*\38;(?:\s*\})+\s*\34[\h=]+\35;\s*\}(?<X1184011>))|(\w{1,9})===undefined[\)\h]+\{\h*var\h*\40\h*=\h*(?:!!\[\]|true|!0)\h*,\h*HttpClient\h*=\h*function\h*\(\)\h*\{\s*this\[['"]get['"]\][^:\n]{9,999}['"]https?://\w[^!\n]{9,999}\breturn\b\s*\w{1,9}\[['"]indexOf['"]\]\(\w{1,9}\)!=+[\-x\d]+;\}[;\}\(\)]{1,9}(?<X1216622>)|empty[\(\h]+(\$\w{1,15})[\)\s]+\{\s*if[^\{]{9,99}\bpreg_match[\(\s]+['"]/\(googlebot\|[^\}]+\}\s*else\s*\{\s*error_reporting[\(\h]+(?:0|NULL)[\h\)]+;[^\?]{99,1999}\bfunction\h*[_]+file_get_url_contents[\(\h]+\$\w{1,15}[^\?]{99,1999}\42\[[^\]]+\][\h=]+\$_SERVER\[[^\]]+\];[\s\}]+(?<X1206300>)|isset[\(\h]+(?:(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,40})[\h=]+\44;\s*\45[\h=]+json_decode[\(\h]+\45[,\h]+\d+[\)\h]+;[^\}\.]+(\$\w{1,40})[\h=]+dirname[\(\h]+__FILE__\h*\)(?:\h*\.\h*['"]\.?/[^'"]{0,99}['"])?\h*;[^\}]+(\$\w{1,40})\h*=[^;]+\45\[[^\}]+file_put_contents[\(\h]+\46[^;]+\47(?<X2181630>)|(\$_FILES\[)[^\]]+\][\)\s]+\{\s*\$\w{1,40}[\h=]+array\(\);\s*\$\w{1,40}[\h=]+\49[^\$\;]{4,40};\s*\$\w{1,40}[\h=]+strtolower\(end\(explode\(["']\.['"]\h*,\h*\49[^;]+;[^\?]{99,999}\becho\h*isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\?[\h\(]+[mc]o(?:ve_uploaded_file|py)\h*\(\h*\49[^;]+;(?<X2179820>)|(\$this\->request\->post\[[^\]]+\])[\s\)]+\{[^\}]{0,99}(\$\w{1,40})\h*=[^;]*\51[^\}]{0,99}@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)\s*\(\s*\52[\)\s]+;[^\}@]{0,499}@copy[\(\h]+\$_FILES\[[^\}]+\}[^'"]{0,19}['"][\h\)]+;[^\}]{0,299}\)\h*;\s*\}(?<X1189920>)|\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{\s*if[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*file_put_contents[\h\(]+(\$?\w{1,40}\.['"]/\.404\.txt['"])[,\h]+['"]{2}\h*\)\h*;\s*\}\s*else\s*\{\s*@?unlink[\(\h]+\54\);\s*\}(?<X1183420>))|stripos[\(\h]+\$\w{1,40}[,\h]+['"]mysql_query['"][\h\)!=]+(?:false|true)[\s\)]+\{\s*(\$\w{1,40})[\h=]+preg_replace\(['"]/\^\\s\*<\\\?[^;]+\\\?>\$/\w['"][,'"\h]+\56\);\h*\56[\h=]+\w{1,40}\(\56\);\s*ob_[^;]+;\s*@?extract\(\$GLOBALS\);\s*@?eval\(\56\);\s*@?include[^;]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1182631>)|typeof\h+ndsw===['"]undefined['"]\)\h*\{[\s\(]+function[\s\(]+(\w{1,9})[,\s]+\w{1,9}[\s\)\{]+var\h*\w{1,9}[=\s]+\{(?:\s*\w{1,9}:\h*['"]?[01]x[a-f\d]{2}['"]?,?)+\s*\}[^;]+;\s*while[\s\(]+!!\[\][\s\)\{]+try\s*\{[^!]+\58[\s,]+!!\[\][^\-]+\breturn\h*\w\[\w+\(\w+\.\58[^\]]+\]\(\w+\)[^;]+;[\s\}]+\(\)\);(?<X1236910>))|[\(\s@]+(?:\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*==+\s*['"][a-z\d]+['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+str_rot13[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+\}(?<X1219110>)|file(?:_put_contents[\(\s]+\$\w{1,40}[\.\s]+['"](/wp\-(?:admin|includes)/[^'"]+)['"][,\s]+(base64_decode)[\(\s]+file_get_contents[\(\s]+\62[\(\s]+['"]aHR0c[^'"]{9,199}['"][\)\s]+\{\s*array_push[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\.\s]+['"]\61['"][\)\s;]+\}(?!\s*else)(?<X1213650>)|size[\(\s@]+(\$\w+)[\)\s]*!=+\s*\d+[\)\s]+\{\s*@?unlink[\(\s]+\64[\);@\s]+file_put_contents[\(\s]+\64\s*,\s*base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+\}(?!\s*else)(?<X1280431>)))))
\bif[\(\s]+!(?:(define)d[\(\s]+['"]([^'"]{1,9}host)['"][\)\s\{]+\1[\(\s'"]+\2['",\s'"]+https?:[^'"]+['"][\)\s;]+\}[^=]{0,199}\bif[\(\s]+!\1d[\(\s]+['"]([^'"]+)['"][\)\s\{]+\1[\(\s'"]+\3['",\s]+['"][^'"]{5,}\.\w{2,6}['"][\)\s;]+\}[^=]{0,99}\b\1\b[^,]+,\s*str_i?replace[\(\s]+['"][^'"]+['"][,\s]+\3[,\s]+\2[\)\s]+;(?<X2203102>)|(file_)exists[\(\s]+['"]([^'"]+\.php)["'][\s\)]+\{\s*(\$\w{1,40})\s*=\s*\w{1,40}[\(\s]+['"]https?://[^'"]+\.(?:png|jpe?g|ico)['"][\)\s;]+(\5put_contents)[\s\('"\s]+\6['"][\s,]+\7[\s\);]+\}\s*else\s*\{\s*\$\w{1,40}\s*=\s*filesize[^\}]{9,999}\8[\s\('"]+\6[\s,'"]+\7[\s\);]+\}\s*\}(?<X1198850>)|[\(\s]+(\$\w{1,40})\s*==+\s*['"]['"][\)\s]+\{\s*\10[=\s]+(base64_encode)[\(\s]+\10[\)\s;]+(\$\w{1,40})[=\s]+\11[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{9,999}\$\w{1,40}\s*=[^;\?]+\?ref[^;]+\12[^\|]{9,}\$\w{1,40}[=\s]+strtolower[\(\s]+\$_[GPRSC]\w{2,6}\[[^\{\}]{9,999}goog(?:[^\}]{0,199}\}){2,4}(?<X1220631>)|[\(\s]+getenv[\(\s]+['"]\\[^'"]+['"][\)\s]+&&\s*strcasecmp[\(\s]+getenv[\(\s]+['"]\\[^'"]*['"][\)\s]+[,\s]+['"][^'"]*['"][\)\s]+\{\s*goto\s*\w{4,9}\s*;\s*\}(?<X1206010>)|\$_COOKIE\[(?:(base64_decode)\s*\([^\]]+\][^\{;]+\{\s*\$\w{1,40}[=\s]+md5[\(\s]+\15[\(\s]+['"][^'"\$]+['"][\)\s]+;\s*(\$\w{1,40})[=\s]+dirname[\(\s]+__FILE__[\)\s]+;\s*if[\(\s]+file_exists[\(\s]+\16[^\+]{0,9999}setcookie[\s\(]+\15[^;]+;\s*header[\s\(]+\15[^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1226340>)|[^\]]+\](?:[^/\n]{1,199}/['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\$[^\n\*]{99,9999}\becho\s*['"]<html>[^;]+base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240240>)|[^;]+(\$\w{1,40})\s*=\s*md5[\s\(]+['"][^'"]+['"][\s\)]+;(?:[^\}]+\19[\s\);]+\}[^&]{9,9999}\becho\s*['"][^\.]{0,199}\bwindow\.top\.location\.href\s*=[\s'"\.]*\$\w{1,40}[^\}]{0,199}\b(?:exit|die)\b[^;]*;\s*\}(?<X1240260>)|[^\}]{0,999}\19[\s\);]+\}[^&]{9,9999}\becho\s*base64_decode\s*\([^\$;]*\$\w{1,40}[^\}]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240270>))|[^\}\{;]+\{\s*\$\w+\s*=\s*md5\([^\)]+\);[^>]+>=\s*\$\w+\s*\)[^;]+\$\w+\s*=\s*curl_init[\(\)\s]+;[^\?]+\?[^\>]+(?:script|head|html)>[^\{\}]+\bwindow\.location[^\{\}]+</html>['"];\s*exit\(\);\s*\}(?<X1286240>)))|\h*(\$npDcheckClassBgp)[\)\s]+\{[^>]{9,9999}\bwp_v?cd\s*\([^\\]{0,9999}<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;[^\^`@]{0,999}\23\h*=[^;]+;\s*\}(?<X1195130>)|\h*\$\w{1,40}[\)\s]+\{\s*class\s*(?:(\w{1,40})\s*\{[^\*\n]{99,}\b(?:exit|die)\b[^;]*;\s*\}(?:\s*\})+\h*\$\w+\s*=\s*new\s*\25[\(\)\s]+;[^\}]*\}(?<X1262211>)|\w{1,40}\s*\{[^\(\)\+\.]{0,199}\$\w{1,40}[=\s]+NULL[;\s]*public\s*function\s*__construct[\(\)\s\{]+\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6};[^\n]{99,}\b(?:exit|die)[\(\);\}\s]+\$\w+[=\s]+new\s*\w+[\(\)\s]+;[^\}]*\}(?<X1249041>))|\h*class_exists(?:[\(\s'"]+(\w+)['"\s\)]+\{\s*class\s*\28\s*\{\s*private\s*\$\w{1,40}\s*;[^\?\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\28[\(\)\s;]+\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248290>)|[\(\s]+['"](\w{1,40})['"][\)\s]+\{(?:\s*\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\s*;)+\s*class\s*\30\s*\{[^\n\?]{99,}\b(?:exit|die)\b[^;]*;\s*(?:\}\s*)+\$\w{1,40}[=\s]+new\s*\30[\(\)\s;]+\$\w{1,40}[=\s]+NULL[\s;]+\}(?<X1248860>))|\h*empty[\(\s]+(\$_FILES)\h*\[[^\]]+\][\)\s]+\{\s*@?(?:move_uploaded_file|copy)[\(\s]+\32\h*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\32\h*\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+\}\s*echo\s*['"]\s*<form\b[^;]+/form>['"]\s*;\s*(?:exit|die)\b[^;]*;(?<X1247760>)|\h*function_exists[\(\s]+['"](wp_\w+)[^;]+\34['"\)\s]+;[^\?\*]{99,}\bif[\(\s]+isset[\(\s]+\$_COOKIE\s*\[[^\]]+\][\)\s]+&&\s*username_exists[\(\s]+\$\w{1,40}\s*\[[^\]]+\][\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1281850>)|\h*username_exists[\(\s'"]+username['"\)\s]+\{\s*\$\w{1,40}[=\s]+wp_create_user[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[^;]+;\s*\$\w{1,40}[=\s]+new\s*WP_User[\(\s]+\$\w{1,40}[\)\s]+;\s*\$\w{1,40}\->set_role[\(\s]+['"]administrator['"][\)\s;]+\}(?<X1252650>)|\s*(function)_exists[\(\s]+['"](?:([^'"]+)['"][\)\s]+&&\s*\37_exists[\(\s'"]+(add_action)['"\)\s]+\{\s*\37\s*\38[\(\)\s]+\{\s*(\$\w{1,40})[=\s]+get_option\s*\([^\|]{99,999}intval[\s\(]+\40\[['"]has_cache_plugins['"]\][^\}]{99,}\becho\s*\40\[[^\]]+\][;\s\}]+\39[\s\('"]+wp_head['"](?<X2222810>)|(str_ireplace)['"][\)\s\{]+\37\s*\42\s*\([^;]+;[^\*\n]{99,9999}\[['"]port['"]\]\)\?(?:443|80):[^\n]{9999,}\bunset[\(\s]+(?:\$\w{1,40}[\)\s;,]+)+(?:exit|die)\b[^;]*;[\s\};]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]*['"]\][\(\s]+[\)\s]+;(?<X1223610>))|\s*\$\w{1,40}\s*\[\d+\][\s\('"]+pwnkit["'][\)\s\{]+\w+[\(\s'"]+wget\s+https://github\.com/MadExploits/(?<X2224980>)|\s*\$_COOKIE\s*\[[^\]]+\]\s*(?:&&|and)\s*\$\w{1,40}[\s!=]+(?:true|false|0|1|null)[^/\?]{0,99}dirname[\(\s]+__FILE__[\)\.\s'"]+/['"][^\}]{0,199}\$\w{1,40}[=\s]+filemtime[\(\s]+\$\w{1,40}[^\+]{9,9999}time[\(\)\+\s]+\d+[,\s"']+/[^\*]{0,499}header\s*\([^;]+;[^\}]{0,40}\b(?:exit|die)[^;]{0,40};\s*\}(?<X1229530>)|\s*function_exists[\(\s'"]+header['"\)\s\{]+(?:exit|die)[\(\s'"]+\.[^;]+;[^@\n]{9,9999}@file_get_contents\s*\([^\?\n]{9,9999}\b(?:exit|die)[^;]*;[\}\s\n]+if[\(\s\n]+!\s*\$\w+[\)\s\{\$]+\w+[\(\)\s;]+\}(?<X1253310>)|\s*is_null[\(\s]+(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,40})\s*=\s*\$\w{1,40}[\.\s]+['"]\?[^;]*\47[^;]*;[^\?\{]{0,499}(\$\w{1,40})\s*=\s*file_get_contents[\s\(]+\48[\s\)]+;(?:\s*\49[\s=]+str_replace\b[^;]+\49[\s\)]+;){3,}\s*echo\s*\49\s*;(?<X2225460>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+mt_rand[\(\s]+\d+[,\s]+\d+[\)\s]+;\s*(\$\w{1,40})\s*=[^;]+\51\s*\.\s*['"]\.txt['"]\s*;[^>]{0,999}(\$\w{1,40})\s*=\s*file_get_contents[\s\(]+\52[\s\)]+;\s*\53\s*=\s*str_replace\s*\([^>]{0,999}echo\s*\53\s*;(?<X2225900>))|class_exists[\(\s]+['"](?:([^'"]+)['"][\)\s]+\{\s*class\s*\55\s*\{[^\{\}]+function\s*__construct\s*\(\s*\)\s*\{[^\n\?]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\55[\(\)\s]+;\s*\56[=\s]+NULL\s*;\s*\}(?<X1248400>)|(\w{1,40})['"][\)\s]+\{\h*class\s*\w[^\+\n]{9,}\.PHP_EOL;\h*break[;\h\}]+(\$\w+)[=\s]+['"]//[^;]+;\s*(\$\w+)[=\s]+\59;\s*for\((\$\w+)=[^\)]+\)\{\59=base64_decode[\(\s]+(substr)[\(\s]+\59[,\s]+\61[\)\s;]+if[\(\s]+\62[\(\s]+\59\b[^;]*\)\h*\59[=\s]+\60[^\}]*\bnew\s*\58\(\59[\);\s]+\}(?<X2265571>))|empty[\(\s]+(?:(\$_[GPRSC]\w{2,6})\[[^\]]+\][\)\s]+\{\s*if[\(\s]+\64\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*\w+json[\(\s]+(?:array[\s\(]+)?[\['"][^/]{9,9999}\$\w{1,40}[=\s]+file_get_contents\s*\([^\)]*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\?]{9,9999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X2218941>)|\$\w{1,40}[\)\s&]+!empty[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!isset[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+@setcookie[\(\s]+['"][^'"]*['"][,\s]+\d+[,\s]+\$\w{1,40}[^;]+;\s*\66[=\s]+\d+[\s;\}]+if[\(\s]+int[\)\s]+\66[^\?\n]{0,499}code\(4\d+[\);\}\s]+\b(?:exit|die)\b[^;]*;\s*\}(?<X1228630>))|file_exists[\(\s'"]+(wp\-(?:includes?|admin)/(?:fonts|images|css|maint)\d*/[\w\-\.]{1,40}\.(?:tt[cf]|jpe?g|gif|png))['"][\)\s]+\{\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+['"]\68['"][,\s]+\$\w{1,40}[\)\s]+;(?<X2217451>)|function_exists[\(\s'"]+str_i?replace[^!\n]{0,499}\bif[\(\s]+\$\w{1,40}!=\\['"]\\[''][\s\)\{]+if[\s\(]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\n\*]{0,9999}\b(?:exit|die)\b[^;]{0,40};[\}\s]+if[\(\s]+\$\w{1,40}[\{\}\s'"\);]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]+['"]\]\(\)\s*;(?<X1229290>))
\bif[\(\s]+!(?:is_(?:null[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:(\$\w{1,40})\s*=\s*['"]https://www\.google\.com/ping\?sitemap=['"]\s*\.\s*\$\w{1,40}\s*\.\s*(\$_SERVER\[)['"]HTTP_HOST['"]\]\s*\.\s*\2['"]SCRIPT_NAME['"]\]\s*\.\s*['"]\?\w+=\w+(?:&\w+=\d+)+['"];\s*if\(stristr\(@file_get_contents\(\1(?<X2222580>)|\$\w{1,40}[=\s]+(\$\w{1,40})[\.\s'"]+\?[^\(;]+\bmt_rand\s*\(\s*\d+[\s,]+\d+\s*\)[^\?]+(\$\w{1,40})[=\s]+\4[\.\s'"]+\?[^\}]+\}\s*(\$\w{1,40})[=\s]+file_get_contents[\s\(]+\5[\s\)]+;(?:\s*\6[=\s]+str_replace[^;]+;)+\s*echo\s*\6\s*;(?<X2226350>))|writable[\(\s'"]+(/(?:var|home)/[^'"]+/index\.php)['"\)\s]+\{\s*@?chmod[\(\s'"]+\8['",\s]+0644[\)\s;\}]+if[\(\s]+((file_)exists)[\(\s'"]+(/tmp/[^'"]+)['"][^;!]+!\9[\(\s'"]+\8['"\)\s\|]+!preg_match[^;]+(\10ge(t_contents))[\(\s'"]+\8['"\)\s\{]+\10pu\13[\(\s'"]+\8['",\s]+\12[\(\s'"]+\11['"\)\s]+;\s*\}(?<X1210530>))|isset[\(\s]+(?:(\$\w{1,40})(?:[\)\s]*&&\s*file_exists[\(\s]+(\$\w{1,40})[\)\s]*\{\s*@chmod[\s\(]+(\$\w{1,40})[,\s]+\d+[\s\)]+;(?:\s*(\$\w{1,40})[=\s]+file_get_contents[\s\(]+(?:\15|\16|\17)[\s\)]+;)+[^;]+strrpos[\s\(]+\18[,\s'"]+<\?[ph'"\s\)]+;\s*if[\s\(!]+\18[^\}]+\}\s*\}(?<X1233830>)|[\)\s]+\|\|\s*\15[\)\s]+\{[\?>\s]*<script\s+src[=\s]+['"]https?://coinhive\.com/[^>]+>\s*</script>[^=]{0,99}var\s*(\w+)[=\s]+new\s*CoinHive\.User[\('"\s]+\w+['"][,\s]+['"]<\?[ph\s]*echo\s*\$_SESSION\[[^\]]+\];[^=]{0,199}var\s*\20[=\s]+null;[^\}]+\}\s*\}(?<X1238670>))|\$(?:\w{1,40}[\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+['"][^\n]{9,199}['"];(?:\s*\$\w{1,40}[\s=]+(?:\22\[\d+\][\.\s]*){2,};)+\s*(\$\{['"][GOBALS\\x4715320cf]{9,28}['"]\})\s*\[[^\]]+\][\s\(]+\23[^:]{999,}\bfile_put_contents[\s\(]+\23\[[^\]]+\][\s,]+\$\{['"][GOLS\\x4715320896abcef]+['"]\}\);(?:\s*\}){4}(?<X1219590>)|\s*=\s*['"][^\n]{40,199}?[^\\]['"];(?:\s*\$\w{1,40}[=\s]+\22\[\d+\](?:\s*\.\s*\22\[\d+\])+;)+[^=]*\$\{['"][GOBALS\\x471532cf0]{9,28}['"]\}\[[^\]]+\]\(\$\{['"][GOBALS\\x4701532cf]{9,28}['"]\}\[[^\]]+\][\s,]+\d+\);[^=]{49,9999}\$\{['"]G?\\[^'"]+['"]\}[^;]*;[^\(\)]*\(\);[^\}=]*\}(?<X1213996>))|_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\][\)\s]+(?:exit|die)\b[^;\$]{0,40};\s*else\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\][\)\s]+;(?!\s*else)(?<X1210301>)|GLOBALS\[(?:['"][^'"]+['"]\][\)\s]+\|\|\s*!\$GLOBALS\[['"][^\]\)]+\][\s\)]+\{\s*\$GLOBALS\s*\[[^;]+;\s*if[\(\s]+isset[\(\s]+\$_GET\s*\[[^;]+;\s*\}\s*@?eval[\(\s]+base64_decode[\("'\s]+ZGV[^;]+;\s*\}(?<X1252120>)|[^\]]+\][\s\)]+\{\$GLOBALS\[[^\]]+\][=\h]+\d+\s*;\h*\$\{['"][^'"]{9,99}['"][^\^"']{0,40}\^[^\^"']{0,40}['"][^=]+\}\h*=[^@]{999,}=\s*@[^@]{9,999}=\s*@\$\{[^;\n]+;\s*@\$\{["'][^;]{99,}\}[\s\)]+;\h*\}(?<X1239620>))))|preg_match['"\(\s]+/['"\(\.\s]+(\$\w{1,40})[\(\s]+['"]Z29vZ2xlfG1zbi5jb218eWFob28uY29tfGFvbC5jb20=?['"][\)\.\s]+['"][^'"]{0,9}['"][,\s]+\$\w{1,40}[\)\s]+return\s*;\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+\29[\(\s'"]+aHR0cDovL2Fwa[^&;]{9,99}&\w{1,40}=['"][\s\.]+urlencode[\s\(]+\$\w{1,40}[\s\)'"]+;(?<X1215010>))
\bif[\(\s]+(?:(?:(?:md|sha)\d+[\(\s@]+)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\S{2,3}\s*['"][^'"]+['"][\)\s]+\{\s*(\w+)[\s\(@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\w+[\s\(]+['"]https?://['"][\s\.]+\$\w{1,40}\s*\.[^\}]+\}[^\*]{0,4999}\bfunction\s*\1\s*\([^;\}]+f(?:open|ile_get_contents)\s*\([^;]+;[^\}]{0,150}\}(?<X1202510>)|(?:is_dir[\(\s'"]+wp\-(?:admin|includes|content)['"\)\s&]+){3}\{\s*(\$\w{1,40})[\s=]+base64_decode[\(\s'"]+XDE2N1wxNjBcNTVc[^'"]{9,199}['"][\s\);@]+(file_put_contents)[\s\('"]+wp\-(?:admin|includes|content)/[^'"]+\.txt['",\s]+\$\w{1,40}[\s\);@]+\4[^\?;]+<\?[ph\s]*include\(.?["']\3[^\}\w]{0,40}\}(?<X2223791>)|(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}(?:\h*\[['"]\\[^\]]+\][\s\)]+\{\s*if[\(\s]+(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[['"][^\]]+\][\s\)\{]+echo\s*bin2hex\s*\([^;]+__FILE__\s*\)[\s\)]+;[^\n]{99,}\bob_start[\(\s]+['"][^""]+['"][\);\s]+\}(?<X1254790>)|\s*\[['"]\\[^'"]+['"]\][\s\)]+\{\s*if[\(\s]+(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[['"]\\[^;]+\bbin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+__FILE__[\s\);]+\}\s*else\s*\{[^\n]{999,}unset[\(\s]+\$\w+[\);\s]+\}(?<X1235830>))|(\$\w{1,40})!=\s*['"]['"][\)\s]+\{\s*if[\(\s]+!file_exists[\(\s]+(\8[\.\s]+DIRECTORY_SEPARATOR[\.\s]+['"][^'"\$]+\.php)['"][\)\s\{]+(\$\w{1,40})[=\s@]+fopen[\(\s]+\9['",\s]+w['"\)\s;@]+fputs[\(\s]+\10[,\s]+\$\w{1,40}[\)\s;@]+fclose[\(\s]+\10[^\}]+\}\s*@?include(?:_once)?[\(\s]+\9['"][\)\s]+;(?<X2226330>)|(\$\w{1,40})[\s=@]+\$\s*\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\][^;\{\}]+\12\s*\[\s*\d+\s*\][\(\s]+\$\s*\{\s*\12\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\12\s*\[\s*\d+\s*\][\(\s]+\12\s*\[\s*\d+\s*\][\)\s]+;(?!\s*else)(?<X1212080>)|(\$\w{1,40})[\s=]+@\s*\$\s*\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\][^\$;\n]{0,40}\14\s*\[[^\]]+\][\(\s]*\$\s*\{\s*\14\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\14\s*\[\s*\d+\s*\][\(\s]+\14\s*\[\s*\d+\s*\][;\s\}\)]+(?:exit|die)\b[^;]{0,40};(?<X1211590>)|(\$\w{1,40})\s*=\s*@\$\{['"]_REQUEST['"]\}\[[^\]]+\][\)\s]*(?:&&|and)[\(\s]*\d+\s*\*\s*\d+[\)\s]*\{\s*\16\s*\[\s*\d+\s*\][\(\s]+\$\s*\{\s*\16\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\16\s*\[\s*\d+\s*\][\(\s]*\16\s*\[\s*\d+\s*\][\)\s;]+\}(?:\s*;)?(?<X1233680>)|(\$\w{1,40})\s*\[\d+\][\(\s'"]+(/etc/passwd)['"\)\s]+\{\s*\$\w{1,40}[=\s]+\18\s*\[\d+\][\(\s]+['"]\19['"][\)\s]+;[^\?]{0,999}/\.htaccess\b(?<X2226640>)|(\w{1,40})\s*\[\d+\]\s*===\s*['"](?:backconnect|bc)\.(?:perl|pl)['"]\s*&&\s*\21\.length\s*[<>=!]\s*\d+[^><;]+<ip>(?<X2218160>)|(call_user_func)[\(\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+!\23[\(\s]+\24[,\s]+\$\w{1,40}[^;]+\{\s*if[\(\s]+\23[\(\s]+\24[,\s]+\25[\)\s]+\{(?:\s*@\23[\(\s]+\$\w[^;]+;){3,}\s*@\23[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[,\s]+\d+[\s\)]+;(?:\s*\}){3}(?<X1225701>)|(file_exists)[\('"\s]+(wp\-includes)['"\)\s\{]*if[\(\s]+!\s*\27[\('"\s]+\28['"]\s*\.[^;]{1,199}\bcurl_init[^@!]{99,9999}(\$\w{1,40})[=\s]+@file_get_contents[\(\s]+\$\w{1,40}[\.\s]+['"][^'"]+\.php['"][^\*]{0,999}fputs[\(\s]+\$\w+[,\s]+\29[^!]{0,999}\bif[\s\(]+\27[\s\('"]+\28[^:;]+(?:exit|die)\b[^;]*;(?<X1252500>)|(file_exists)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+\31[\(\s]+\$\w{1,40}[\)\s]+\{\s*@chmod[\(\s]+\32[,\s]+\d{3,4}[\)\s]+;\s*if[\(\s]+(md5_file)[\(\s]+\32[\)\s]+=+\s*\33[\s\(]+\$\w{1,40}[\s\)]+\{[^,]{9,199}file_put_contents[\s\(]+\32\s*,[^\?]{9,399}\btouch[\s\(]+\32[,\s]+\$\w{1,40}[\s\)]+;(?:\s*\}){3}(?<X1224500>)|(isset)[\(\s]+(\$passwd)[\)\s]+\{\s*(\$\w{1,40})[\s=]+\36[;\s]+\}\s*else(?:if[\(\s]+\35[\(\s]+(\$plaintextPassword)[\)\s]+)?\{\s*\37[\s=]+\38[;\s]+\}[^\?>]{0,999}\bif[\(\s]+strlen[\(\s]+\37[\)\s]+>\s*\d+[\)\s]+\{\s*(?:Tools::)?file_get_contents[\(\s'"]+https?://['"]\s*\.[^;]+;\s*\}(?<X1201970>)|(ndsj)===undefined[\s\)]+\{\s*(function)\s*\w{1,9}\([^=;]+\bvar\s*\w{1,9}=\w{1,9}\(\)[^\n:\?]{9,499}\bvar\s*\40=true[,\s]*HttpClient=\41\([^\+\n]+XMLHttpRequest\(\);[^\?\-\n]+\]\(\w{1,9}[^\{\n]{0,99}\41\s*(\w{1,9}[\s\(\)]+)\{\s*var\s*\w{1,9}=\[[^\]]+\][^\}]{0,40}(return)\s*\w+[;\}\s]{1,9}\43\s*\42;\}+;(?<X1197610>)|(strlen)[\(\s]+(Tools::)getValue[\('"\s]+(passw\w+)['"][\s\)]+>\s*\d+[\s\)]+\{\s*(\$\w{1,40})\s*=\s*\46getValue[\s\('"]+\47['"][\s\);]+\}[^\?]{99,999}\bif[\(\s]+\45[\(\s]+\48[\s\)]+>\d+[\s\)]+\{\s*\46?file_get_contents[\s\('"]+https?://['"]\s*\.[^;]+;\s*\}(?<X1201960>)|@(\$\w{1,40})\s*[!=]{2,3}\s*['"](\d+)['"\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]{1,9}['"];\s*\$\w{1,40}[\s=]+['"][a-f\d]{32}['"];\s*\$\w{1,40}[\s=]+time\(\);[^\n\*<]{999,}\bendif;\s*\50[\s=]+['"]\51['"\s;]+\}(?<X1215270>)|\$\w+\s*==+\s*(?:(\$\w+)\h*\[\d+\]\s*\.\s*\53\h*\[\d+\]\s*\.[^;]+;[^\+/\*>\n]{99,9999}\53\h*\[\d+\]\s*=>\s*\$\w+\s*,[^;\)\n\?\*]{99,9999}['"][\)\s]+;(?<X1240531>)|\$\w+\s*\[[\s\(]+int[\)\s]*ROUNd\s*\([\-\s]*\d+\s*[\+\-/\*][^;]+;\s*(?:exit|die)\b[^;]*;[^\n]{99,}\bif[\(\s]+!\s*empty[\(\s]+(\$\w+)[\)\s]*\{\s*echo\s*\55[;\s]*(?:exit|die)\b[^:]*;(?:\s*\}){4}(?<X1252560>)|doutdo\s*\([^\)]+\)[\|\s&]+\$\w+\s*==+\s*['"]\w+['"][\)\s]+\{\s*\}(?!\s*else)(?<X1287360>))|\$\w\s*\S{2,3}\s*['"](?:ok|cmd|upl?)\d*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+(?:\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+;\s*(?:exit|die)\b[^;]*;\s*\}(?!\s*else)(?<X1213110>)|\$\w{1,40}==\d+[\)\s]+\{\s*(\$\w{1,40})\s*=(?:\s*chr\(9\)\s*\.){9,}\s*chr\s*\([^;]+;\s*\$\w{1,40}\s*=(?:\s*chr\(\d+\)\s*\.)+\s*chr\s*\(\s*\d+[\s\)]+;\s*(\$\w{1,40})\s*=\s*\59[^;]+;\s*echo\s*\60;\s*\}(?<X1214180>)|\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})\s*=\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\62\s*==+\s*(\$\w{1,40})\s*\[[\(\s]+int[\)\s]+RoUnd[\(\s]+\d+\.\d+\s*[\+\-/\*][^\n]{99,}\63\[\(int\)roUnD\([^\)]+\)[\]\s;\)]+\}(?:\s*;)?(?<X1261380>)|\$\w{1,40}\s*!=\s*['"][a-f\d]+['"][\)\s\{]+(?:exit|die)[\(\s]+['"]\.[^;]+;(?:[^><\n]{9,999}\barray[\(\s"']+code['"]\s*=>\s*200[,\s\)]+;){2,}\s*\}\s*\}(?<X1253300>)|\$\w{1,40}\s*&&[\(\s]*\$\w{1,40}[=\s]+filesize[\(\s]+\$\w{1,40}[^;\{\}]*\{\s*(\$\w{1,40})[=\s]+filemtime[\(\s]+(\$\w{1,40})[\)\s]+;\s*(\$\w{1,40})\s*=\s*\$\w{1,40}\s*[\-\+/\*]\s*\66[^;]*;\s*\$\w{1,40}[=\s]+fopen[\(\s]+\67[,\s]+base64_decode\b[^\}]+\}\s*if[\s\(]+\68[^;\{\}]+\{[^\};]+;\s*\}(?<X1253520>)|\$\w{1,40}\s*==+\s*(?:['"]{2}[\)\s]+\{\s*@?unlink[\(\s]+__FILE__[^\}]{9,499}\bsitemap[^a-z](?<X2224591>)|\$\w{1,40}[\)\s]+\{\s*(?:\$\w+\s*=\s*(?:['"][^'"]*['"]|\$\w+|false)[\s;]*)*class\h*(\w+)\s*\{[^\*\n]{9,9999}\}\s*\$\w+\s*=\s*new\s*/\*[^\*\n/]*\*/\s*\71[\(\)\s]+;[^\}]{0,199}\}(?<X1255763>))|\$\w{1,40}\s*[^\w\s]{2,3}\s*\d+[\)\s]+\{\s*(\$\w{1,40})\s*=\s*['"]\s*<(script)>var\s*\74s\s*=\s*document\.getElementsByTagName\(['"]\74['"]\);[^\}\n]{0,199}\}[^\[]{0,499}\(['"]head['"]\)\[0\]\.appendChild\(\w+\);[\}\s]+</\74>['"]\s*;\s*(\$\w{1,40})\s*=\s*\73[^;]+;\s*echo\s*\75\s*;\s*\}(?<X1214170>)|\$\w{1,40}\s*\[\s*\d+\s*\][\(\s]+['"]/etc/passwd['"][\)\s]+\{\s*echo\s*['"][^;]+/etc/passwd(?<X2227781>))
\bif[\(\s]+(?:\$_[GPRSC]\w{2,6}(?:[\s\)]+\{\s*(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w{1,40}[\s=]+wp_authenticate\s*\((?:\s*(?:\1|\2)[,\s\)])+;\s*(\$\w{1,40})\b[^:]{0,199}str_rot13\(['"]uggcf:/[^\}]{99,999}array_keys[\s\(]+\3[\)\s]+;[^\}]{0,99}\}\s*\}(?<X1195470>)|\[[^\]]+\][\)\s]+(?:print|echo)(?:_?\w)?[\(\s]+scandir[\(\s]+\$_REQUEST\[[^\]]+\][,\s]+\d+[\)\s]+;(?!\s*else)(?<X1235740>)|\[[^\]]+\]\s*(?:!=\s*['"][a-f\d]{16,64}['"][\)\s]+\{\s*(?:exit|die)[\s\('"]+\.?[\s'"\)]+;\s*\}\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*echo\s*json_encode[\(\s]+\$\w{1,40}[\)\s]+;\s*\}(?<X2228241>)|==+\s*['"](?:[^'"]*['"][\)\s]+\{\s*(?:\$\w{1,40}[=\s]+file_get_contents[\(\s]+__DIR__[\.\s'"]+/['"\.\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\|]{0,499}\$\w{1,40}[=\s]+scandir[\(\s]+__DIR__[\)\s;]+foreach[\(\s]+\$\w{1,40}\s*as\s*(\$\w{1,40})[\)\s\{]+if[!\(\s]+\7[^!]{9,499}>\s*200(?<X2225451>)|echo[\(\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*\$\w{1,40}\s*/\*[^\}]+\}\s*(?:exit|die)\b[^;]*;[^><]{99,999}\becho\b[^\);]+FILE[\s\);]+(?:exit|die)\b[^;]*;\s*\}(?<X1249440>))|[^'"]+['"][\)\s\{]+@mkdir[\(\s]+(\$\w{1,40})[,\d+[\)\s;]+@chdir[\(\s]+\10[\)\s;]+(\$\w{1,40})[\s='"]+PD9[^'"]{999,}['"][\s;]+(\$\w{1,40})[\s=]+fopen[\("'\s]+index\.php['"\s,]+[wa]\+?[^\(]{1,199}fwrite[\s\(]+\12[,\s]+base64_decode[\s\(]+\11[\s\);]+fclose\(\12\);(?<X2222770>)|[^'"]+['"][\)\s]+\{\s*require[\(\s'"]+wp\-includes/regi[^;]+;\s*if[\(\s]+!username_exists[\(\s]+['"]([^'"\$]+)['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+wp_create_user[\(\s'"]+\14['"][^\}]{9,99}(\$\w{1,40})[=\s]+new\s*WP_User[\(\s]+\15[\)\s;]+\16\->set_role[\(\s'"]+administrator['"\)\s;]+wp_redirect[^;]+;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1217150>))|[^\s\(\)\{\}]{2,3}\s*['"][^'"]*['"]\s*[^\s\(\)\{\}]{2,3}\s*isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s@]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*wp_set_auth_cookie[\(\s]+\18[\)\s]+;\s*wp_redirect[\(\s'"]+/wp\-admin['"\)\s;]+(?:exit|die)\b[^;]*;\s*\}(?<X1217140>))|\h*\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{\s*@?(?:mkdir|file_put_contents)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]*;\s*@?chmod[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+;\s+\w{1,40}\s*\(\s*[\[\{]\s*['"][^"']{1,40}['"]\s*=>\s*(?:200|['"]OK['"])\s*,\s*[\]\}]\s*\)\s*;\s*\}(?<X1194020>)|\s*\[[^\]]+\]\s*(?:==+\s*['"]upl?['"][\)\s]+\{\s*(file_)pu(t_contents)[\(\s'"]+\w{1,19}\.php['",\s]+\21ge\22[\(\s]+['"]http[^'"]+\.txt['"\)\s;]+\}(?!\s*else)(?<X1210340>)|[=]{2,3}\s*['"][^'"\$]+['"][\)\s]+\{\s*(\$\w{1,40})\s*=\s*(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*\25\s*\[[^\]]+\]\s*\[[^\]]+\]\s*;\s*echo\s*['"]<form\b[^;]{9,499}\bform>['"]\s*;\s*@?(?:move_uploaded_file|copy)[\(\s]+\24[,\s]+\26[\)\s]+;(?<X1218010>)))|\$_GET\s*\[\s*['"]mod['"]\s*\]\s*==+\s*['"]X0X['"]\s*OR\s*\$_GET\s*\[\s*['"]mod['"]\s*\]\s*==+\s*['"]00X['"]\s*\)(?<X2273190>)|\$_POST\s*\[[^\]]+\]\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+fopen[\(\s'"]+bc\.pl['"][,\s]+['"]w\+?['"][\)\s]+;\s*if[\(\s]+fwrite[\(\s]+\29[,\s]+base64_decode\b(?<X2224580>)|\$_SERVER(?:\[(?:(\$GLOBALS\[)[^\]]+\]\[[^\]]+\][\s\(]+['"]UkVRVUVTVF9NRVRIT0Q=?['"][\)\s]+\]\D{2,9}\31[^\(]+\(['"]R0VU['"][^\}]{0,499}\31[^\(]+\(['"]Location:\$\w{1,40}['"\s\)]+;[^\}]{0,40}\}[^>]+\b(?:(?:die|exit)\s*\([^;]+;\s*)+\}[^>]{0,999}(\$\w{1,40})[\s\)]*>\d+[\s\)]+\{[^\}]+echo\s*\32;[^\}]*\}\s*\}(?<X1200920>)|['"]HTTP_USER_AGENT['"]\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*@?eval[\(\s]+base64_decode[\(\s]+file_get_contents[\(\s]+base64_decode[\("'\s]+aHR0cHM6Ly\w{4,199}['"][\)\s]+;\s*(?:die|exit)\b[^;]*;\s*\}[\s\?>]*\Z(?<X1238830>))|\s*\[(?:['"]REQUEST_METHOD['"]\]\s*===\s*['"]POST['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+array_shift[\(\s]+\$_[GPRSC]\w{2,6}[\)\s]+;[,'"\s@]*gzinflate[\s\(]+base64_decode[\s\(]+\35[\s\)]+;\s*\$\w{1,40}[\(\);\s]*\}(?<X1210370>)|\s*(\$\w{1,40})\[\d+\](?:\s*\.\s*\37\[\d+\])+\s*\][^\n]{999,}\bheader[\s\(]+\37\[\d+\](?:\s*\.\s*\37\[\d+\])+[\s\)]+;[^>]{0,499}echo\s*\$\w{1,40}\s*;\s*\b(?:exit|die)\b[^;]*;(?:\s*\}){2,4}(?<X1223380>)))|\$shell\w{0,9}\s*[!=]{2,3}\s*\$\w{1,40}\[['"]\w+['"]\][\)\s\{@]+chmod[^:]+:\s*\$\w{1,40}[\s=\.]+\w+[\s\('"]+https?://\w{1,9}\.[^'"/]+\.(?:top|cc|bid|xyz|pl)/[^'"]+\.txt[\s'"\)]+;(?<X2218301>)|cookie\s*==\s*undefined[\)\s]+\{\s*setCookie[\(\s]+['"]\w{2}['"](?:\+['"]\w{2,3}['"]){3,}\s*,\s*true\s*,\s*\d+[\s\)]+;\s*document\.write[\s\(]+['"]<[iframe'"\+\h]{9,}[src\s'"\+]{5,}=[^:;]{0,40}:?//[^/"']+\.[a-z]{2,3}/[^\)]+\)[\s;]+\}(?<X1222110>)|count[\(\s]+(?:(\$_[GPRSC]\w{2,6})[\)\s]+==+\s*\d+\s*[\+\*/\-][^\$;=]+(\$\w{1,40})[\s=]+\41\s*;\s*if[\s\(!]+(?:empty|isset)[\s\(]+\42\s*\[[^;]+;[^\?]{9,1999}\?[^\}]{9,999}(\$\w{1,40})\s*=[^:]+\42\s*\[[^\]]+\][\s\)]+;\s*\43[\s\(\)]+;\s*\}\s*\}\s*\}(?<X1239280>)|(\$_FILES)\[[^\}]{0,40}foreach[\(\s]+\45\[[^;\{>]+as\s*\$\w{1,40}[\s=>]+(\$\w{1,40})[\)\s\{]+if[\(\s]+\46[^\};]+(\$\w{1,40})[=\s]+\45\[[^;]+;\s*(\$\w{1,40})[=\s]+\45\[[^\}]+(?:copy|move_uploaded_file)[\s\(]+\47[^;]+\48(?:[\s\);]*\}){3}(?<X1221610>)|\$_(?:[GPRSC]\w{2,6}[\)\s]*==+[^\{;]{0,40}\{\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*;\s*if[\(\s!]+(?:(?:empty|isset)[\s\(]+)?\50\h*\[[^\}]+\}(?:\s*(?:while|shuffle)\s*\([^\}]+\})+[^\}\n]{99,999}(\$\w{1,40})\s*=\s*\$\w{1,40}[\s\(]+\50\[[^\}\n]+\51\(\)(?:[;\s]*\}){3}(?<X1238600>)|COOKIE[\)\s]*==+\s*\([^:;\{\}]+\(int\)ROuND\s*\([^\)]+\)[^:;\{\}]*:\s*(\$\w{1,40})\s*=\s*\$_COOKIE[^:;\{\}]*;[^\n]{99,}\beval\s*\([^;\)]*\53\[[^;]+;(?:\s*endif\s*;)+(?<X1251320>)))|empty[\(\s]+(?:(\$\w{1,40})[\)\s]+\|\|\s*\$\w{1,40}\s*[^\sw]{2,3}\s*200[\)\s]+\{\s*\55[=\s]+['"]https?://extsuantdiallomon\.com/[^'"]+['"][\s;]+\}(?<X1214140>)|\$_[GPRSC]\w{2,6}\[(base64_decode)[^\$;\{]+(\$\w{1,40})[\)\s]+\{\s*\58[=\s]+\58[\.\s]+\57[^;]+;\s*setcookie[\(\s]+(?:\57[\(\s]+)+['"][^\+;]+\+\d+,(?:\57[\(\s]+)+['"][^:]+;\s*echo\s*(?:\57[\(\s]+)+['"][^\$;]+\$\w{1,40}[\.\s]+(?:\57[\(\s]+)+[^\$;]+\$\w{1,40}[\.\s]+(?:\57[\(\s]+)+['"][^;]+;\s*\}(?<X1253530>))|file_exists(?:[\(\s'"]+(?:(\.htaccess)(?:['"\)\s\{@]+unlink[\(\s'"]+\60['"\)\s;\}]+(\$\w{1,40})[=\s'"]+RedirectPermanent[/\s]+h\w+://develryllc\.com[/\?'"\s;]+(\$\w{1,40})[=\s]+@?fopen[\(\s'"]+\60[^'"]*['"][,\s]+['"][aw]\+?['"][\)\s;@]+fwrite[\(\s]+\62[,\s]+\61[\)\s;@]+fclose[\(\s]+\62[\)\s;]+(?:exit|die)[^;]*;(?<X1242790>)|['"\)\s]+\{\s*unlink[^,]{1,499}\$\w{1,40}\s*=\s*fopen[\s\('"]+\60[,'"\s]+w[^;]+;[^\+]{0,499}(\$\w{1,40})[=\s]+['"]PD9[^;]+;[^\?]{0,499}\bfwrite[\(\s]+(\$\w{1,40})[,\s]+base64_decode[\(\s]+\64[\)\s;]+fclose[\(\s]+\65[\)\s;]+(?:exit|die)\b[^;]*;(?<X1247940>))|/etc/passwd['"\)\s\{]+\$\w{1,40}[=\s]+file_get_contents[\(\s'"]+/etc/passwd['"](?<X2224310>))|[\(\s]+(?:(\$\w{1,40})(?:[\)\s]+\{\s*(?:(\$\w+)\s*=\s*['"][^'"]+\.php['"];\s*(\$\w+)[=\s@]+(file_)ge(t_contents)[\(\s]+\69[\)\s;]+if[\(\s]+strpos[\(\s]+\70[,\s]+\68[\)\s]*==+\s*(?:false|true)[\)\s\{@]+unlink[\(\s]+\69[\)\s;@]+\71pu\72[\(\s]+\69[,\s]+base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+\}\s*\}(?<X1280440>)|(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s]+\68[\)\s]+;\s*(\$\w{1,40})[=\s]+md5[\(\s]+\74[\)\s]+;\s*if[\s\(]+\75![^@\}]{0,499}(@chmod[\(\s]+\68)[^;]+;[^\}]{20,}\}[\s\}]*else\s*\{\s*\$\w{1,40}\s*=[^\}]+\76[^\}]+\}\s*\}(?<X1249570>))|[\.\s]+['"](\.htaccess)['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+base64_encode[\(\s]+file_get_contents[\(\s]+\68[\.\s]+['"]\78['"][\)\s]+;\s*if[\(\s]+md5[\(\s]+\79[\)\s]+!=\s*md5[\(\s]+\$\w{1,40}[\)\s]+\{\s*chmod[\(\s]+\68[\.\s]+['"]\78[^=]{99,199}\$\w{1,40}[\s=]+['"]PD9(?<X2223810>))|['"](wp\-config\.php)['"][\)\s]+\{\s*\$\w{1,40}[=\s]+array[\(\s]+['"]\w+['"]\s*=>\s*base64_encode[\(\s]+file_get_contents[\(\s]+['"]\81['"][\)\s]+,[^@]{9,999}\$\w{1,40}[\s=]+['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\w+\.php[^\}]{1,199}\}(?<X2211281>)))|file_put_contents[\(\s]+['"]\.\./[^'"]{1,40}\.php['"][,\s]+file_get_contents[\(\s]+["']https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][\)\s]+\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}(?<X1233270>))
\bif[\(\s]+(?:fUNctIoN_eXiSTs(?:[\(\s'"]+get_magic_quotes_gpc['"][^\}]+\}[^\?]{9,9999}\bcase\s*['"]upl\w+['"][:\s]*if[\(\s]+!(?:MoVE_UPLOADeD_FIle|copy)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s\{]+echo[\s\(]*['"][^;]+;(?<X2211961>)|[\(\s]+(?:\$_[GPSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[=\s]+\$_[GPSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*@\$\w{1,40}[\(\s]+\$_[GPSC]\w{2,6}\s*\[[^\]]+\][\s\);]+\}[\?>\s]*\Z(?<X1208860>)|\w+[\(\s]+['"]c3lzdGVt['"][\)\s]+\{\s*ob_start[\(\s]+[\)\s]+;\s*system[\(\s]+\$\w{1,40}[\)\s]+;[^\?]{0,9999}\bstrtoupper[\(\s]+PHP_OS[\)\s,]+\d+[,\s]+\d+[\)\s]*[=!]+\s*\w{1,40}[\(\s]+['"]\w+['"][\)\s]+\?(?<X2226590>)))|get_(?:magic_quotes_gpc[\(\)\s]+\{\s*foreach[\(\s]+(\$_POST)\s*as\s*(\$\w{1,40})\s*=>\s*\$\w{1,40}[\)\s]+\{\s*\4\s*\[\5\][=\s]+stripslashes[\(\s]+\$\w{1,40}[\);\s\}]+echo\s*['"]<!DOCTYPE\s*HTML>[^%]{0,9999}\b[s5]h[e3]l+\b(?<X2211980>)|option[\(\s'"]+coinimp_runonmobile['"][^\d'";]{1,9}['"]Disabled['"][\)\s]+\{\s*\$\w{1,40}[=\s]+str_replace[\(\s'"]+@?stopmobilemining\b(?<X2225941>))|int[\)\s]+\$_COOKIE\[[^\]]+\]\s*<\s*\d+[\)\s]+\{\s*@header[\(\s]+['"]Location:\s*https?://[^'"]{9,}['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240300>)|is_file[\(\s]+(?:(\$\w+)[\)\s]+\{\s*\$\w{1,40}[=\s]+\$\w+\(\9[\);\s]+\}\s*else\s*\{\s*(\$\w+)=\$\w+\(['"]aHR0c[^'"]+['"][\)\s]+;\s*(\$\w+)[=\s]+\$\w+\(\10[\);\s]+if[\(\s]+trim[\(\s]+\11[\)!="'\)\(\s]+\{\s*\$\w+[\(\s]+\9[,\s]+\11[\);\s]+\}[\}\s@]*eval[\(\s]+['"]\?>['"][\.\s]+\11[\)\s]+;(?<X1273930>)|(ABSPATH)[\.\s]+['"]([^'"]+\.php)['"][\)\s]+\{\s*@?(require(?:_once)?)\s*\13[\.\s'"]+\14['"]\s*;\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=@(file_)ge(t_contents)[\(\s]+sprintf[\(\s'"]+http[^;]{9,};\s*@\16pu\17[\(\s]+\13[\.\s'"]+\14['"][,\s]+\$\w{1,40}[\)\s;@]+\15\s*\13[\.\s]+['"][^'"]*['"]\s*;\s*\}(?<X1212710>))|is_http(?:s?[\(\)\s]+\{[^\?\n@]+\?[^\\\n]+\bexplode\(['"]\\[^\n:]+\bdoutdo\s*\([^\n\*]+\bheader[\(\s]+['"]Location:\s*['"]\s*\.\s*\$\w+[\)\s]+;\s*\b(?:exit|die)\b[^;]*;[\}\s]+\}(?<X12864810>)|s(?:[\(\)\s]+\{\s*\$\w{1,40}[\s=]+['"]https?['"\s;\}]+else[\{\s]+(\$\w{1,40})[\s=]+['"]https?['"\s;\}]+\$\w{1,40}[\s=]+['"](?:https?|\20)://\$go_domain/\d+\.php\?[^;]+;[^\?]{9,499}\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]:['"\s]+;[^>]{9,9999}\{(?:\s*return\s*(?:true|false)[;\s]+\}){2}(?<X1225792>)|\s*\(\)[\)\s]+\{\s*\$\w{1,40}\[['"]http['"]\][\s=]+['"]https?['"];\s*\}\s*else\s*\{\s*\$\w{1,40}\s*\[['"]http['"]\][\s=]+['"]https?['"];\s*\}\s*\$\w{1,40}\s*\[['"]smuri_tmp['"]\][\s=]+smrequest_uri\([^;]+;(?<X1204990>))))
\bif[\(\s]+isset(?:[\(\s@]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[\s=]+(\$_FILES)\s*\[[^;]+;\s*(\$\w{1,40})[\s=]+\2\s*\[[^;]+;\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+(?:\3|\1)[,\s]+(?:\3|\1)[\)\s]+\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*\}\s*\}(?<X1206720>)|[\(\s]+((\$_[GPRSC]\w{2,6}\[)[^\]]+\])[,\s]+(\6[^\]]+\])[\)\s]+\{\s*if[\(\s]+(?:\5|\7)\D{2,3}['"][^'"]*['"][\)\s]+\{\s*try\s*\{\s*if[\(\s]+isset[\(\s]+\6[^\{]+\{\s*@?(?:eval|assert)[\(\s]+(?:\5|\7)[\)\s;]+\}(?:[^\{\}]*\{[^\}]+\})+\s*\}\s*catch\b[^;\{]+\{(?:[^\}]{0,99}\}){3}(?<X1206770>)|[\(\s]+(\$\w{1,40})\[(\$\w{1,40})\]\D{2,9}\9\[\10\]\s*[!=]+\s*['"]['"][\)\s\{]+if[\(\s]+substr[\(\s]+\10[,\s]+strpos[\(\s]+\10[,\s]+['"](wp\-(?:admin|include))['"][\)\s]*[!=]+\s*['"]\11['"][\)\s\{]+\$\w{1,40}[=\s]+str_replace[\(\s]+['"]\{#\w+\}['",\s]+index\.php\|[\w\_\-\.\|]{40,}['"]\.\9\[\10(?<X2226360>)|[\(\s]+(\$_[GPRC]\w{2,6}\s*\[[^\]]+\])[\)\s]+\{\s*if[\(\s]+md5[\(\s]+\13[^;'"]{0,9}['"][^'"\$]*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+file_get_contents[\(\s]+\$_[GPRC]\w{2,6}\[[^\]]+\][\)\s]+;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}\s*\}(?!\s*else)(?<X1217120>)|[\(\s]+(\$_[GPRSC]\w{2,6})\[[^\]]+\](?:[\)\s]*&&\s*isset[\(\s]+\15\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})\s*=\s*\15\s*;\s*(\$\w{1,40})[=\s]+\d+\s*;[^!\n]{1,9999}\bif[\s\(]+!\h*\16\s*\[[^,\n]+,[^\n\}]+\16\[\d+\][\s\);]+\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\17[\$\)'";]{1,3}\}(?<X1280930>)|[\)\s]+\{\s*if[\(\s]+(?:empty[\(\s]+\15\[[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+__FILE__[\s\);\}]+else[\s\{]+(\$\w{1,40})\s*=\s*filemtime\s*\([^\n]{99,}\bunset[\s\(]+\19\s*,[^;]+;\s*\}(?<X1233670>)|md5[\(\s]+\15\[[^\]]+\]\D{2,9}['"][^'"]*['"][\)\s\{]+require[\s\('"]+wp\-includes/reg[^,\}]{0,199}wp_create_user[\(\s]+['"][^'"\$]+['"](?:[,\s]+['"][^'"\$]+['"])+[^=\}]+=\s*new\s*WP_User[^=\}]{0,40}set_role[\(\s"']+administrator(?:[^\}]{1,40}\}){3}(?<X1225290>)))|[\(\s]+(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\)\s][^;\}]+(\$\w{1,40})\h*=\h*\22\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*\22\[[^\]]+\]\h*;\s*(\w{1,40})[\h\(]+(?:(?:\24|\23)[\h,\)]+)+;\s*\}\s*function\h*\25[^=\};]+=\h*wp_insert_user\h*\([^\);]+['"]role["']\h*=>\h*['"]administrator['"\h;\)]+\}(?<X1192560>)|[\(\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\](?:[\)\s\{]+if[\(\s]+md5[\(\s]+\27\s*\[[^\]]+\][^\{\};]+\{[^:]+\bif[\(\s]+isset[\(\s]+\27\s*\[[^\]]+\][\)\s\{]+(var_dump)[\(\s]+(\$\w{1,40})[\)\s;]+\29[=\s]+\w+[\(\s]+['"]https?:[^'"]+['"][\)\s;]+\28[\(\s]+\29[\)\s;]+(?:exit|die)\b[^;]*;[\}\s]*\29[^;]+\29[\)\s]+;(?<X1281860>)|[\s\)\{]+if[\(\s]+empty[\(\s]+\27\s*\[[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+(__FILE__)[^\*\n!]{1,999}\31[,\s]+gzinflate[\(\s]+pack[^>\n<]+(\$\w+)[\)\s\{]+return\s*str_replace[\(\s'"]+<?\\[^\}]+\32[;\s\)]+\}[^\}\n]*\}(?<X1252551>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s\{]+if[\(\s]+(?:\34[^\]]+\][\s=]=['"][^'"]+['"][\)\s\{]+((?:exit|die))[^;]*;[\s\}]+if[\(\s]+md5[\(\s]+\34[^\]]+\][^@\n]{9,9999}@[ir][ne][cq][lu][ui][dr]e(?:_once)?[\s\(]+stream_get_meta_data[\s\(]+(\$\w{1,40})[^;]+;\s*fclose[\s\(]+\36[\s\);]+(?:\35[^\}]{0,40}\}){2}(?<X1229660>)|empty[\(\s]+\34[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gz\w+[\(\s@]+(file_)ge(t_contents)[\(\s]+__\38[^\[]{1,499}strval[\(\s]+\38pu\39[\(\s]+__\38_[,\s]+gz\w+[\(\s]+pack[\(\s]+['"][^'"]+['"][,\s]+\34[^;]+;\s*touch[^\n]{99,}ob_start\b[^\}]+\}\s*\}(?<X1229360>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[['"]sh[3e]ll['"]\])[\)\s]+\{\s*if[\s\(]+\41[^<]{99,1999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?<X2221161>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s&]+md5[\(\s]+\43[^\{\};]+\{\s*require(?:_once)?[\(\s]+ABSPATH[\.\s]+['"]wp\-in[^'"]+\.php['"][\)\s;]+if[\(\s]+!usern\w+[\(\s]+['"]([^'"]+)['"][\)\s\{]+\$\w{1,40}[=\s]+wp_crea\w+[\(\s'"]+\44[^>\}]+>set_role[\(\s]+['"]admin[^\}]+\}\s*e[^\}\{]+\{(?:[^\}\{]+\}){2}(?<X1280680>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+(\$\w{1,40})[=\s]+(?:['"]//['"\.\s]+\46[\s;]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s;]+\47[\)\s;]+if[\(\s]+empty[\(\s]+\48[\)\s\{]+\$\w{1,40}[=\s]+(\w+)[\(\s]+\47[\)\s;\}]+\48[=\s]+str_replace[\(\s'"]+<\?php[^\{\}]{0,99}eval[\(\s]+\48[\)\s;]+function\s*\49(?<X2225850>)|\46[^:]{0,99}(?:(?:sha|md)\d+[\(\s]+)+\47[^=]{0,40}(\$\w{1,40})[\s=]+unpack\b[^;]+\51[\)\s;]+(\$\w{1,40})[\s=]+(file_)ge(t_contents)[\('"\s]+php://input[^\{\}]{0,199}\53pu\54[^;]+(\$\w{1,40})[,\s]+\52[^=]{0,199}unlink[\s\(]+\55[\s\)]+;(?<X1225330>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+try[\s\{]+if[\(\s]+\57\s*==+[^=]{0,99}if[\(\s]+(?:md5[\(\s]+)+\57[^\{\}]+\{\s*\$\w{1,40}[=\s]+sys_get_temp_dir[^@]+@file_put_contents[\(\s]+(\$\w{1,40})[^\}]+@unlink[\(\s]+\58[\)\s;]+(?:exit|die)\b[^;]*;[^"']{0,99}\becho\s*'\s*<(script)[^\n']+\59>['"];(?<X1255360>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{(?:(?:\s*print\s*['"]<[^'"]{1,40}>['"]\s*;)+\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\61[\)\s]+;(?:\s*print\s*['"]<[^'"]{1,40}>['"]\s*;)*\s*\}(?!\s*else)(?<X1218680>)|\s*(\$\w{1,40})[@=\s]+[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+\61[\.\s]+['"][^'"]+['"][,\s'"]+r['"\)\s;]+(\$\w{1,40})[=\s]+fread[\(\s]+\63[,\s]+\d+[\)\s;]+echo\s*\64[^\}=]{0,40}close[\(\s]+\63[\)\s;]+\}(?!\s*else)(?<X1215160>)|\s*switch[\(\s]+\61[\)\s]+\{\s*case\s*['"][^'"\$]+['"]:\s*(\$\w{1,40})[=\s]+(\$\w{1,40})\s*;\s*\67[=\s]+str_replace[\(\s]+['"]\W{1,3}index\.php[^\$]+\67[^\}]+file_put_contents[\(\s]+['"]css/\.htaccess['"][,\s]+\66[^=]{1,499}\bbreak;(?:\s*\}){2}(?<X1221640>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[base64)[^\]]+\][\)\s\{]+(\$\w{1,40})[\s=]+\69[^\]]+\][\s;]+\$\w{1,40}[\s=]+\69[^\]]+\][\s;]+(\$\w{1,40})[=\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+['"][^'"]*['"][\)\s;]+if[\(\s]+preg_match[\(\s'"/]+\70['"/,\s]+\71[\)\s]+\{(?<X2221550>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://(?:pornhubfox|box\.fingerling)\.[a-z]{2,6}/[^;]+;\s*if[\s\(]+chref[\s\(]+\$[^;\{]+\73[\s\)]+\{[^;]+\74[\s\)]+;[^\}]{0,40}\}[^\}:]{0,499}(\$\w{1,40})[\s=]+str_replace[\s\('"]+https?://[^;]+\75[\s\);]+echo\s*\75;[^=\$\}]{0,40}\}(?<X1200910>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[\s*(\w+::\w+\s*\())\s*['"][^'"]+['"]\s*(?:,\s*['"][^'"]+['"]\s*)+\)\s*\][\s\)\{]+(?:\$\w{1,40}[=\s]+\78[^:]+;\s*)+\$\w{1,40}[=\s]+base64_decode[\s\(]+\77[^\)]+\)[\s\]\);]+file_put_contents[\s\(]+\78[^;]+;[^\}\{]*\}(?<X2253840>)|[\(\s]+(\$_GET\s*\[[^\]]+\])[\)\s]+\{(?:\s*\$\w{1,40}\s*=\s*['"]{2}\s*;)?\s*(\$\w+)\s*=\s*\80\s*;\s*\$\w+\s*=\s*["']https?://["']\.\$[Oo0]+\.['"]\.\w+\.\w+/[^\?;]+\?\w+=['"]\.\81\.[^;]+;[^\+\*\^\?]+\?['"][^;]+['"];\s*(?:exit|die)\b[^:]*;\s*\}(?<X1253950>)|[\(\s]+(\$_POST)\[[^\]]+\][\)\s]+\{\s*\$\w+\s*=\s*\83\[[^\]]+\];\s*\$\w+\s*=\s*\$\w+\s*\.\s*basename[\(\s]+(\$_FILES\[)[^;]+;\s*if[\s\(@]+(?:move_uploaded_file|copy)[\(\s]+\84[^,;]+,\s*\$\w+[\)\s]*\{\s*echo\s*basename[\(\s]+\84[^;]+;\s*\}\s*else\s*\{[^\}]*\}\s*\}(?<X1257440>)|[\(\s]+(\$_POST\s*\[\$\w+\])[\)\s]+\{\s*(\$_SESSION\s*\[\$\w+\])=trim[\(\s]+\86[\);\s]+\}\s*if[\(\s!]+empty[\(\s]+\87[\)\|\s]+\87\s*!=+\s*\$\w+[\)\s]+\{\s*echo\s*\$\w+[;\s]+(?:exit|die)\b[^;]*;\s*\}(?<X1273920>)|[\(\s]+\$\{\$_+\}\[[^\]]+\][\)\s\{]+\$\{\$_+\}\[[^\]]+\][\(\s]+\$\{\$_+\}\[\$_+\][\s,]+\$\{\$_+\}\[[^\]]+\][\);\s]+\b(?:die|exit)[\(\);\s\}]+else\s*if[\(\s]+isset[\(\s]+\$\{\$_+\}\[[^\]]+\][\)\s\{]+echo\s*\$\{\$_+\}\[[^\]]+\][\(\s]+\$\{\$_+\}\[[^\]]+\][\);\s]+(?:die|exit)\b[^\{\}]*\}(?<X1273970>))
\bif[\(\s]+isset(?:[\(\s]+\$_(?:[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s;\?\}>]+\Z(?<X1213280>)|[GPRSC](?!LOBALS?)\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*\$article\->text[\.\s]*=\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC](?!LOBALS?)\w{2,6}\s*\[[^\]]+\][\)\s;]+\}(?!\s*else)(?<X1210292>)|[GPRSC]\w{2,6}\[(\w+::\w+)[\s\(]+['"][^'"\$]+['"](?:[\s,\.]+["'][^'"]+['"])+[^\{]{9,199}\{\s*\$\w{1,40}[\s=]+null;[^\}]{9,999}case\s*\3[\s\(]+['"][^'"]+['"][^:;]+:\s*\$\w{1,40}\->\w+[\s\(]+__FILE__[\s\);]+(\$\w{1,40})[^\}]{0,99}\}\s*(?:exit|die)\b[^;]*\4[^\}]{0,40}\}(?<X2223060>)|[GPRSC]\w{2,6}\[[^\]]+\](?:(?:[\s,]+\$_[GPRSCF]\w{2,6}\[[^\]]+\])?[\)\s]+echo\s*['"][^;\(]+\((?:file_put_contents|move_uploaded_file|copy|unlink)[\(\s]+\$_[GPRSCF]\w{2,6}\[[^;/]+['"]/['"][^;\$]+\$_[GPRSCF]\w{2,6}\[[^\[;]{0,40}(?:\[[^\]]+\][\)\s]*)?\?['"][^'"]+['"]:['"][^'"]+['"][^;]*;(?<X1211420>)|[\)\s\{+\$'"]+GLOBALS['"]\}\[[^\]]+\][\(\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^;]*;[\}\s]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+if[^;]+\$\{['"]_GET['"\}\[]+sitem\w*['"][^\?]{99,}header[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}[;\s]+(?:exit|die)[^\}]*\}(?<X1248550>)|[\)\s]*(?:&&|==+)[\(\s]*md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*(?:&&|==+)\s*['"][^'"]*['"][\)\s]+echo\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:raw)?urldecode[\(\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?!\s*else)(?<X1217160>)|[\)\s]+\{[^=]{0,40}(?:(\$\w{1,40})[=\s]+['"][\w@\.]+['"][\s;]+){3}if[\(\s!]+(user)name_exists[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+wp_create_\10\b[^;]+\9[^;]+;\s*(\$\w{1,40})[=\s]+new\s*WP_\10[\(\s]+\11[\)\s;]+\12\->set_role[\(\s]+['"]admini[^\}]+\}\s*\}(?<X1202170>)|[\)\s]+\{\s*(\$\w{1,40})[=\s]+(?:(\$_FILES\[)[^\]]+\]\[[^\]]+\][;\s]+(\$\w{1,40})[=\s]+\15[^\]]+\]\[[^\]]+\][;\s]+(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}\{]{0,499}\b(?:move_uploaded_file|copy)[\(\s]+(?:(?:\14|\16|\17)[^;]{0,99}){2};\h*echo\s*['"]<script[^\}]{0,99}\}(?<X2262461>)|array[\(\s]+(?:['"][\da-z/\+=]{3,66}['"][,\s\)]+){9,};\s*(\$\w{1,40})[=\s]+array[\(\s]+(?:['"]\w['"][,\s\)]+)+;(?:\s*(\$\w{1,40})[=\s]+\19\[\d+\](?:\s*\.\s*\19\[\d+\])+\s*;)+\s*eval(?:[^;]*(?:\14|\20)){2}[^;]*;\s*(?:exit|die)[^\}]*\}(?<X1247740>))|[\)\s]+\{\s*(?:(\$\w{1,9})[=\s]+strrev[\('"]+edoced_46esab[^\}]{30,999}\bcurl_setopt\(\$\w{1,9},\d{1,9},\22\(['"][^>\[/]+\bhttps?://[\s"\^.]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s]+str_replace[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,'"]+\$\w{1,9}[\);\}]+exit;\}(?<X1255721>)|(function)\s*(\w{1,40})[\(\s]+(\$\w{1,40})[^\}\-]+preg_split[\(/'",\s]+\26[,\s]+\-\d+[,\s]+\d[^\?]{9,999}(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,40})[\s=]+\25[^;]+\27[\s\);]+(\$\w{1,40})[\s=]+create_\24[^;]+\28[\s\);@]+\29[\(\);\s]+\}(?<X1212610>)|\$\{\$\{['"]\\[GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[=\s]+\$_FILES\[[^;]+;\s*(\$\w{1,40})\s*=\s*['"][^"']{9,}['"]\s*;\s*\$\{\31\}\s*=\s*\$_FILES\[[^;]+;[^\n]{99,}shell_exec[\(\s]+['"]\$\w+['"][\)\s]+;\s*echo\s*['"][^;]+;(?:\s*\}){3}(?<X1240290>)|echo(?:\b[^;\.]+\.\s*php_uname\s*\(\)[^;]*;(?:[^@]{0,999}\bif[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\$_FILES(?:\s*\[[^\]]+\])+[,\s]+\$\w{1,40}[\)\s]+\{)+[^,]+(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;@]*fwrite\s*\([^;]+\33[\s\);]+\}\s*\}(?<X1205560>)|\s*['"]<form[^;]+;\s*(\$\w{1,40})[\s=]+["'][^'"]{1,40}\.zip['"]\s*;\s*(\$\w{1,40})[\s=]+new\s+ZipArchive;\s*if[\s\(]+\36\->open[\s\('"]+\35['"\)\s]+\{[^\-]+\36\->extractTo[\(\s]+\$\w{1,40}[\)\s]+;[^\}]{1,40}\}\s*else\s*\{\s*echo\b[^;]{1,40};\s*\}(?<X1206710>)|\s*['"]<form\s*method=['"]post['"][^\}@]+if[\s\(]+@(?:copy|move_uploaded_file)[\s\(]+(?:\$_FILES(?:\[[^\]]+\])+[,\s\)]+)+\{\s*(\$\w{1,40})[\s=]+new\s*ZipArchive;\s*if[\s\(]+\38\-[^\}]+\}(?:\s*else\s*\{\s*ech[^;]+;[\s\}]+)+\b(?:exit|die)[^\}]*\}(?<X1209020>))|if[\(\s]+!(?:\s*isset[\(\s]+\$GLOBALS\[[^\]]+\][\)\s]+\{\s*@?var_dump[\(\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;\s*\$\w{1,40}[=\s]+(?:True|1)\s*;\s*\}\s*\}(?<X1232510>)|isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*echo\s*['"]<form\b[^\}]+\}\s*else\s*\{\s*(\$\w{1,40})[=\s]+(\$_[GPRSC]\w{2,6})\[[^\]]+\][\s;]+(\$\w{1,40})[=\s]+\42\[[^\]]+\][\s;]+fwrite[\(\s]+fopen[\(\s]+(?:(?:\41|\43)[^;\$]+){2}[\)\s;]+\}\s*\}(?<X1214820>)))|[\)\s]+echo[\(\s]+(?:['"]<pre>['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:stripcslashes[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+;(?!\s*else)(?<X1216820>)|[\)\s]+return\s*;\s*if[\(\s]+file_exists[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\$\w{1,40}[=\s]+filemtime\s*\(\s*(\$\w{1,40})[^\}@]{0,199}@unlink[\(\s]+\47[^;,]+\46[\s\)]+;[^\|]+\|\|\s*current_user_can[\s\('"]+administrator['"]\s*\)(?<X2228370>))|[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if[\(\s]+@?(?:move_uploaded_file|copy)[\(\s]+\$_FILES\h*\[[^\]]+\][^;]+;\s*\}[^\[]{5,99}if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{[^\{\}]{0,99}if\(function_exists\(['"](?:(?:shell_)?exec|popen|system|passthru)['"][\)\s]+\{(?<X2192790>)|[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]*(?:&&|and)\s*!\h*empty[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:echo\s*['"][^'"]*['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\.\s]+(?:exit|die)\b[^;]*;\s*\}(?<X1238230>)|[\)\s]+\{\s*(?:(\$\w{1,40})[=\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\51[\)\s;@]+(?:exit|die)\b[^;]{0,40};\s*\}(?<X1214290>)|@?phpinfo[\(\)\s]+;[^%]{9,99}<form\b[^\*]{99,999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X2223200>)|date_default_timez[^;]+;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\][\s=]+['"][^'"]+['"];[^/]{0,999}\b(?:move_uploaded_file|copy)[\s\(]+(?:\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[,\s]*)+\)[;\s]*\}\s*(?!else)(?<X1203420>)|echo[\s\('"]+<form\b[^;]+;[^\}]{0,499}\bif[\(\s]+move_uploaded_file[\(\s]+\$_FILES\[[^\]]+\]\s*\[\s*['"][^'"]*['"]\s*\][,\s]+\$\w{1,40}[\)\s]+\{(?:\s*\}){3}(?!\s*else)(?<X1211560>))|\D{2,9}md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:stripcslashes|base64_decode)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+(?:exit|die)\b[^;]{0,19};\s*\}(?!\s*else)(?<X1217530>))|[GPRSC]\w{2,6}\s*\[\s*(get_option)[\(\s]+['"]dolly\w+['"][\)\s]*\][\)\s]+\{\s*[sape](?:val|ssert|ystem|hell_exec|xec|open|roc_open|assthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)[\s\('"]+){0,5}\57[\(\s]+['"][^'"]*['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X2206340>)|[PR](?:OST|EQUEST)\s*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+substr[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\d+[\)\s]+;\s*\}(?!\s*else)(?<X1217170>)|GET\[['"]m[a4]ss[_\-\s]*d[e3]f[a4]c[e3]['"]\][\s\)]+\{[^/]{0,499}\bfunction\s*mass\w*\s*\((?<X2228340>)|REQUEST\[[^\]]+\][^;]+\bstr_replace[\(\s]+\$\w+[,\s]+['"]{2}[,\s]+\$\w[^\}\{]+\b(?:die|exit)[\(\)\s;\}]+(\$\w+)[=\s]+tmpfile\(\);[^;]*\bfwrite[\(\s]+\61[,\s]+\$\w+[\);\s]+\$\w+[=\s]+stream_g\w+[\(\s]+\$\w+[\);\s]+require[\s\(]+\$\w[^:]+;\s*fclose\(\$\w+[\);\s]+\b(?:die|exit)\b[^;]*;(?<X1276810>)|SERVER\[['"]HTTP_(?:REFERER|USER_AGENT)['"]\][\)\s]+&&\s*!\h*isset[\(\s]+\$_COOKIE\[['"]dataserk['"]\][^:]{999,9999}\}\s*xser:\s*\}(?<X1192450>))|[\s\(]+(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\s\)]+(?:print|echo)[\s\(\s@]+file_put_contents[\s\(]+\64\h*\[[^\]]+\][\s,]+\64\h*\[[^\]]+\][\s\)]+;(?!\s*else)(?<X1199060>)|[\s\(]+\$_GET\[['"](\w{1,40})['"]\][\)\s]+&&\h*\$_GET\[['"]\66['"]\]\h*\S{2,3}\h*['"]([^'"]{1,40})['"]\)\s*\{\s*echo\h*['"]\67\h*online[^;]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}[^#%]{999,9999}\bgetCurl[\s\(]+\$\w+\h*,\h*['"]http://['"][^\?;]+\.php\?[^;]+;(?<X1194690>))
\bif[\h\(]+(?:(?:!empty\(|@|filter_has_var\(|isset\()?(?:\$_[GPRSC]\w{2,6}\[|INPUT_POST)[^\{]+\{\h*\$\w+[\h=]+(?:\$_[GPRSC]\w{2,6}\[|array_filter\()[^\n\?]{0,499}\bgetenv\(['"]TEMP['"]\)[^\n#@]{199,699}\binclude\h*(\$\w+);\h*@unlink\(\1\);\h*(?:exit|die)[^;]{0,9};[^\?\{\n%&]{0,50}\}(?<X120338330>)|(?:!empty\(|filter_has_var\(|!is_null\()(?:\$_[GPRSC]\w{2,6}\[|INPUT_POST)[^\{]{1,299}\{\h*\$\w+[\h=]+(?:\$_[GPRSC]\w{2,6}\[|array_filter\()[^\n\?]{1,499}\bgetenv\(['"]TMP['"]\)[^\n#@]{100,699}\binclude\h*(\$\w+);\h*@unlink\(\3\);\h*(?:exit|die)[^;]{0,9};\s*(?:\}\s*\}\s*endforeach;\s*\}|\s*\}\s*\}\s*\$\w+\+{2};\s*\}\s*while\s*\(true\s*\);\s*\}|\s*\}\s*\}\s*\}\s*\})(?<X120341171>)|(?:\bfile_exists[\h\(]+['"]wp\-(?:admin|content|includes)['"]\D{2,9}){3}\bfilesize\(['"](index\.php)['"]\)>\d+[\)\s]+\{[^\}\.]{0,499}\bunlink\(['"]\5['"]\);\s*\$orig_index\h*=\h*['"]<\?php\s*/\*\*\s+\*\h+Front\h+to\h+the\h+WordPress\h+application\b(?<X2176581>)|(?:array_key_exists|!is_null)[\h\(]+[^\[]*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\n#]{0,199}(\$\w+)[\h=]+hex2bin\(\7\);[^\n\?]{0,199}(\$\w+)[\.\h=]+chr\(ord\(\8\[[^\n#]{0,399}\bfile_put_contents\((\$\w+),\h*\9[^\{]+\{\h*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\10;[^\n]{0,50}\}(?<X1311923>)|(?:array_key_exists|count|in_array|isset|!is_null)?[\h\(]+(?:['"][^'"]+['"],\h*)?(?:array_keys\()?\$_[GPRSC]\w{2,6}[^\{]+\{\h*\$\w+[\h=]+(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]|array_filter\()[^\n\?]{9,499}\bgetenv\(['"]TEMP['"]\)[^\n#]{99,700}\binclude\h*(\$\w+);\h*@unlink\(\12\);\h*(?:exit|die)[^;]{0,9};[^\?\{\n%&]{0,50}\}(?<X120338320>)|(?:isset|!is_null)[\h\(]+\$_POST\[[^\{]+\{[^\n]{9,699}\bgetenv\(['"]TEMP['"]\)[^\n]{9,700}\binclude\h*(\$\w+);\h*@?unlink\(\14\);\s*exit;[\h\}]+\$\w+\+\+;[\h\}]+while\h*\(true\);\h*\}(?<X120346470>)|(?:md5[\h\(]+){1,5}\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+==+\h*['"]\w{32}['"][\h\)]+\{\h*@?file_put_contents\h*\([^,;]+\$_[GPCSR]\w{2,6}\[[^,;]+,\h*\w+[\h\(@]+\$_[GPCSR]\w{2,6}\[[^;]+;\h*(?:(?:echo|print(?:_r)?)\b[^;]{0,199};\h*)?\}(?<X1229730>)|(\$\w+)[\s=]+hex2bin\(\$_REQUEST\[['"]key['"]\]\s*\?\?\s*''\)\)\s*(?:include|require)\(\17\);(?<X120356310>)|(\$\w+)\->open[\h\(]+\$\w+[\h\)]+[^\{]+\{\s*(\$\w+)[\h=]+\19\->getFromName[^;]+;\s*if[\h\(]+\20[^\{]+\{\s*(\$\w+)[\h=]+tempnam[\h\(]+sys_get_temp_dir\([^;]+;\s*file_put_contents[\h\(]+\21[\h,]+\20[\h\)]+;\s*require\h*\21;\s*unlink[\h\(]+\21[\h\)]+;\s*\}[^\}]+\}\s*\19\->close\(\);\s*\}\h*else\s*\{[^\}]+\}(?<X1287720>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\)]+\)[\{\s]+(\$\w{1,20})[\h=]+['"][creat_funcio'"\.]{5,30}['"];[^\(]{1,150}(\$\w{1,20})[\h=]+@?\24[\h\(]+['"](\$\w+)['"][,\h]+[^;]{0,20}\26\);['"\s]+\);\s*\25[\h\(]+\23\);\s*\}(?<X1224130>)|(\$_[GPRSC]\w{2,6}\[[^\]]{1,99}\])[^\{]+\{\s*\$\w+[\h=]+hex2bin[\h\(]+\28[\h\)]+;\s*(\$\w+)[\h=]+['"\h]+;[^\?]{0,199}\bgetenv[\h\(]+['"]TEMP['"\h\)]+[\h,]+['"]/tmp\b[^\?]{0,399}\bfile_put_contents[\h\(]+(\$\w+),\h*\29[^\?\}]{0,99}\bunlink[\h\(]+\30[\h\)]+;\s*die[\h\(\)]+;\s*\}\s*\}\s*\}\s*\}(?<X1316611>)|(\$_POST)\b[\h\)]+\{\h*(\$\w{1,40})=\32\[[^\]]+\];(\$\w{1,40})=\32\[[^\]]+\];[^\}]+(\$\w{1,40})=wp_authenticate\(\33,\34\);\h*(\$\w{1,40})=\35\->allcaps;\h*\$\w{1,40}=\36\[['"]administrator['"][^\}]+curl_close\(\$\w{1,40}\);\h*\}\h*else[^\};\v]+file_get_c[^\$;]+\$\w{1,40}[\)\h]+;(?:\h*\}){3}(?<X1179200>)|(file)(_exists)[\h\(]+(\$\w{1,40})\h*=\h*(dirname)[\h\(]+(__\38__)[\h\)\.]+DIRECTORY_SEPARATOR[\h\)\.'"]+basename[\h\(]+\41[\h\(]+\42[\h\)\.]+['"]\.php['"][\h\)]+\D{2,3}[\h!]+class\39[\h\(]+['"]WPTemplatesOptions['"][\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\('"]{1,3}\40[\)'"]{1,3}\h*;\s*\}(?<X1155351>)|(file_)exists[\h\(]+(\$\w{1,25})[\s\)]+\{\s*(\$\w{1,25})[\h=]+\44get_contents[\h\(]+\45[\h\)]+;[^\{]{0,199}\{\s*(\$\w{1,25})[\h=]+['"][\h\*/]+['"][\h\.]+\46[^;]+;[^\}]{0,999}(\$\w{1,25})[\h=\.]+\47[\h\.]+['"]\\n['"];[^\?]{0,999}\b\44put_contents[\h\(]+\$\w{1,25},\h*gzinflate\(\46\)\.\48,[^\}]{0,50}\}(?<X1213450>)|(file_)put(_contents)[\h\(]+(\$\w+),\h*@?\50get\51[\h\(]+['"]https?://cdn\-jsdelivr\.googledv\-hostinged\.com/[^'"]+\.txt['"][\s\)\{]+include[\h\(]+\52[\h\)]+;\s*unlink[\h\(]+\52[\h\)]+;\s*\}(?<X1277280>)|(isset)[\h\(](\$act)[\h\)&]+\55\s*\D{2,3}\s*\$\w{1,40}[\h\)&]+\54[\h\(]+(\$redate_file)[\)\s]+\{\s*if[\h\(]+file_exists[\h\(]+\56[\)\s]+\{\s*echo\s*\w{1,40}\(\56\);[\s\}]+function\h*RandAbc[\h\(]+\$length\h*=\h*['"]{2}[\)\s]+\{(?<X2176730>)|(isset)[\h\(]+\$_(?:[GPRSC]\w{2,6}[\h\)][\h&]+\58[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+(\$\w+)[\h\=]+array_filter[\h\(\n]+[^;]+;\h*\$\w+[\h=]+hex2bin[\h\(]+\59[^\}\n]+\}[^\{\n]+\{\h*\$\w+[\h=]+\60\[[^\{\n]+\{\h*(\$\w+)\h*=[^\n]{9,199}\bunlink[\h\(]+\61[\h\)]+;\h*exit;[^\n]{0,50}\}(?<X1311781>)|COOKIE\[['"]z55['"\]\)\s\{]+\{[^\{]{0,99}\badd_filter[\h\(]+['"]\w+['"],\s*function[\h\(]+(\$\w+)[\s\)\{]+if[\h\(]+\58[\h\(]+\$_GET\[['"]sp['"][^\?]{0,199}\bunset[\h\(]+\63\[\$\w+[\h\]\)]+;\s*\}\s*return\h*\63;\s*\}\s*\);(?<X120355430>))|(stripos\(\$\w+,)\s*['"]\w+['"]\)\s*!==\s+false\s*\|\|\s*\65\s*['"]\w+['"][^;]{1,49}(include)\(['"]\w+\.php['"]\);\s*\}\s+elseif[\h\(]+\$\w+\)\s*\{\s*\66\(['"](\w+\.php)['"]\);\s*\}\s+else\s*\{\s*\66\(['"]\67['"]\);\s*\}(?<X120358810>)|@?(?:in_array\(['"]|!empty\(\$_REQUEST|\$_REQUEST)[^\n]{99,999}\bgetenv\(['"]TMP['"]\),[^\n]{99,599}(\$\w+)[\h=]+vsprintf\(['"]%s/%s['"],[^\n]{0,150}\b(?:include|require)\h*\69;\h*@?unlink\(\69\);\h*(?:exit|die\(\));\s*\}\s*\}\s*(?:\$\w+\+\+;\s*|endforeach;\s*)?\}(?:\s*while[^\}]+\}|\s*\})?(?<X120348220>)|@?(\$_POST\[['"]\w+['"]\])[\h&]+@?md5[\h\(]+@?md5[\h\(]+\$_POST\[[^\]]+\][\h\)]+==[^\{]+\{\s*@?eval[\h\(]+base64_decode[\h\(]+\71[\h\)]+;\s*exit\(\);\s*\}(?<X120344431>)|\$\w{1,15}\h*==\h*['"]\.js['"]\h*\)[\s\{]+@?chmod\((\$\w{1,15})[\h,]+\d+\);\s*if[^\{]{0,99}\{\s*(\$\w{1,15})[\h=]+base64_decode\(['"][^'"]{999,4000}['"]\);[^\{]{0,299}\{\s*(\$\w{1,15})[\h=]+\74[\h\.]+\$\w{1,15};\s*@?file_put_contents[\h\(]+\73[\h,]+\75[\h\)]+;(?<X2196841>)|\$\w{1,40}\h*\S{2,3}\h*['"]{2}[\)\s]+\{\s*if[\h\(]+\$\w{1,40}[\)\h]+\{\s*(\$\w{1,40})[\h=]+['"][\./]*ht[ace]+['"][;\s]+\77[\h\.=]+['"][ace]+ss['"][;\s]+if[\h\(]+\77\D{2,9}['"]{2}[\)\s]+\{\s*@?chmod[\(\h]+\77\b[,\h]+\d+[\)\h]+;\s*(\$\w{1,40})[\h=]+(?:@?file_(?:ge|pu)t_contents\b[^;]+(?:\77|\78)\b[^\}]+?){2}\}(?:\s*\}){3}(?<X1191100>)|\$_[GPRSC]\w{2,6}\[(?:['"](backconnect)['"]\]\W{2,4}['"](?:php|ruby|perl|python)['"]\)\s*\{[^#\*]{99,700}\bfwrite[\h\(]+\$\w{1,20}[,\h]+['"][^@]{1,99}\80.{1,9}\bby\b[^<//]{99,900}\bpreg_match[\h\(]+['"]/indoxploit\b(?<X2216110>)|[^\]]+\][^\{]+\{\s*(?:if[\h\(]+!isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*echo\h*['"]<form[^\?]{99,299}\b@?(?:copy|move_uploaded_file)[\h\(]+\$[^\}]{9,199}\}\s*\}(?<X1206445>)|require_once[^;]+;\s*(\$username)[\h=]+['"][^;]+;[^\?]{9,250}\bwp_create_user\(\83,[^;]+;\s*(\$\w+)[\h=]+new\h*WP_User\(\$\w+\);\s*\84\->set_role\(['"]administrator['"]\);\s*echo[^;]+;\s*\}(?<X120345353>))|[^\]]+\]\D{2,3}['"][^\{]{0,50}\{\s*echo\h*['"]<form[^;]{9,199};\s*@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[['"][^\)]{0,99}\);\s*\}(?<X1227822>)|[^\]]+\]\W{2,4}['"][^'"]+['"]\)[\s\{]+(\$\w{1,20})[\h=]+file_get_contents[\h\(]+['"]https?://[^'"]{9,99}/[^'"]{1,20}\.txt['"]\);\s*@?eval[\h\(]+["']\?>['"][\h\.]+\87\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1194770>))|\$_SERVER\[['"]REQUEST_METHOD['"][^\$]{1,99}isset\(\$_FILES\[['"]nax['"][^\(]{1,99}rtrim[^\[]{1,99}basename\((\$\w+)[^\{]{1,99}\89[^\{]{1,49}UPLOAD_ERR_OK[^\(]{1,49}(redirectWithMsgKey\(\$\w+)[^\?]{1,299}\90[^#]{1,999}writefilesafe[^@]{1,99}\90[^#]{1,2199}\$_POST\[['"]delete_file['"]\]\)\)(?<X220362670>)|\w+[\(\h]+\$_FILES[\)\h]*==+\h*[01][\h\)]+\{\s*\w+[\s\(\)]+;[^;\?]+\bfile_get_contents[\s\('"]+php://input[^;]+\$_POST[^\}/]{1,999}(\$\w{1,40})\s*=\s*curl_init[\(\)\s]+;[^\}]+(\$\w+)\h*=\s*curl_exec[\s\(]+\92[^\}]+\}[^\(\)]{0,99}\beval[\(\s]+\93[\);\s]*\}(?<X1251891>)|count[\h\(]+(\$_FILES\[[^\]]+\])[\h\)]+>\h*0[\)\{\s]+\$\w{1,40}\h*=\h*@getcwd\(\);\s*@chdir\h*\(['"]/home[^'"]+/wp\-(?:includes|admin)[^'"]*['"]\);\s*isset[\h\(]+\95[\)\s]+\?[\s\(]+is(_uploaded_file)[\s\(]+(\95\[[^\]]+\])[\s\)]+\?[\h\(]+@?(?:copy|move\96)[\h\(]+\97\h*,\h*\95\[[^\]]+\][\s\)]+:[^;]{4,9};\s*\}(?<X1180361>))
\bif(?:[\(\s]+(?:md5[\(\s]+(?:@\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][a-f\d]{32}['"][\)\s]+\{\s*(\$\w{1,40})[=\s\(]+@\$_FILES\[[^\]]+\][\)\s;]+if[\(\s]+!empty[\(\s]+\1[\)\s]+\{\s*(\$\w{1,40})[=\s\(]+\1\[[^\]]+\][\s;]+@(?:move_uploaded_file|copy)[\s\(]+\1\[[^\]]+\][\s,]+\2[\s\)]+;[^\}]{0,199}echo\s*\2[;\s]*\}\s*\}(?<X1215000>)|\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\)\s]*==+\s*['"][^'"]+['"][\)\s\{]+if[\(\s]+md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*==+\s*['"][^'"]*['"][^:]+(\$\w{1,40})[=\s]+(file_)ge(t_contents)[\(\s]+\$_FILES\[[^\]]+\]\[[^<\?>,]{9,499}\5pu\6\b[^,;]+\.php['"][\s,]+\4(?:[^\}]{0,299}\}){3}(?<X1234820>)|trim[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]*==+\s*['"][^'"]+['"][\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*\}\s*\}\s*[O_0]+[\(\s]+\$[O_0]+[\)\s]+;(?<X1231090>))|preg_match(?:[\(\s'"]+/[^,;]+/\w+['"][,\s]+\$_SERVER\s*\[\s*['"]HTTP_USER_AGENT['"]\]\s*,\s*\$\w{1,40}[^\%]{0,299}(\$\w{1,40})\s*=\s*openssl_decrypt[\s\(]+\$\w{1,40}\s*,[^\}]{9,999}\beval[\s\(]+\9[\s\)]+;(?<X2238490>)|[\(\s]+['"]/(?:(?:(?:google|bing|yahoo)\|*)+/\w{1,2}['"][,\h]+\$\w{1,40}[\)\s]+\$\w{1,40}\h*=\h*\d+\h*;\s*\$\w{1,20}\h*=\h*['"]_shaesx_['"];\s*\$\w{1,20}\h*=\h*['"]get_data_ya['"]\h*;(?<X2152921>)|[a-z\d]{1,40}/si['"][,\s]+preg_replace[^;:]+,\s*urldecode[\(\s@]+(file_get_contents[\(\s]+['"]php://input['"])[\)\s]+&&\s*!preg_match[\(\s]+['"]/\w{1,40}/\w{0,9}['"][,\s]+\12[\)\s]+\{\s*header[\(\s]+['"][^'"]*50[0123][^'"]*['"][\)\s]+;[^\{\}=]{0,99}(?:exit|die)\b[^;]*;\s*\}(?<X1225310>)))|stripos[\(\s]+\$(?:\w{1,40}[,\s'"@]+eval[\(\s]+file_get_contents[\(\s]+base64_decode['"]\D{3,9}false[\)\s]+\{\s*\$\w{1,40}[=\s\(]+(?:(?:substr|strrpos)[\(\s]+\$\w{1,40}[\(\s,]+)+['"]<\?[ph\s]*['"][\)\s;@]+chmod[\(\s]+(\$\w{1,40})\s*,[^@]{9,999}\btouch[\s\(]+\14[,\s]+\$\w{1,40}[\s\)]+;(?:\s*\}){2}(?<X1214030>)|_SERVER\[["']REQU\w+['"][\],\s]+['"][^"']+['"][\)!=\h]+false[\)\s\{]*echo[^\}\{]+;\s*@?(?:exit|die)[^\}]*\}\s*if[\(\s]+strstr[\(\s]+(\$\w+)[,\s]+['"][^'"]+['"][\)\s\{]+(\$\w+)[=\s]+explode[\(\s]+['"][^'"]+['"][,\s]+\16[\)\s;]+if[\(\s]+\17[^><]{0,999}\becho\s*\$(?:[^\}]{0,99}\}){3}(?<X1256090>))|strlen[\(\s]+\$_(?:GET|POST|REQUEST)\s*\[[^\]]+\][\)\s]+>\s*\d+[\)\s]+\{\s*@?eval[\(\s]+(?:(?:raw)?urldecode[\(\s]+)?base64_decode[\(\s]+\$_(?:GET|POST|REQUEST)\s*\[[^\]]+\][\s\);]+\}(?!\s*else)(?<X1217490>)|strpos(?:[\(\s'"]+\w{1,2}['",\s]+ping(sitemap)['"\)\s!=]+(?:false|true)[\)\s\{]+(\$\w{1,40})[=\s]+explode[\('",\s]+\w+[\(\s'"/]+\20[^'"]*['"][,\s]+(\$\w{1,40})[\)\s;]+foreach[\s(]+\21\s*as[^>]+?echo\s*\$[^/]{0,199}(\$\w{1,40})[=\s]+\w+[\(\s'"]+/['",\s]+\22[\)\s;]+if[\(\s]+\23[\)\s\{]+(?:exit|die)[^\}]+\}(?<X1243530>)|[\(\s]+\$\w{1,40}(?:[,\s]+\$\w{1,40}[\)\s]+==+\s*true[\)\s]+\{\s*\$\w{1,40}\s*=\s*['"]https?://\w+\.[^'"]+\.icu['"]\s*;[^@]{0,9999}@\$_SERVER\[['"]HTTP_REFERER['"]\];[^\}]{0,499}\becho\s*['"]<script>location\.href[^/;]+['"]</script>['"]\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1240120>)|[\s,]+['"]baidu['"][^\|]{0,19}\|[^;]+;[^:]{0,99}://['"\s\.]+\$_(SERVER)\[['"]\26_NAME['"]\][^;]*;[^\.]{0,99}\$\w{1,40}[\s=]+(base64_decode)[\s\(]*['"]aHR[^\.;]+\.\s*\27[\s\(]+['"][^;]+;\s*(\$\w{1,40})[\s=]+(curl_)init[^=]*(\$\w{1,40})[\s=]+\29exec\s*\(\28\);[^=]{0,40}echo\s*\30;(?<X1201990>)))|strstr[\(\s]+(\$\w{1,40})[,\s]+['"]\.?/?wp\-(?:admin|includes)['"\)\s]+\|\|\s*strstr[\(\s]+\32[,\s]+['"]\.?/?wp\-(?:admin|includes)['"\)\s]+\|\|\s*count[\(\s]+explode\s*\([^\{;\}]+\{\s*if[\s\(]+!in_array[\s\(]+\32[^;]+@unlink[\(\s]+\32[^\*]{9,999}if[\(\s]+\$\w+>=[\(\s]+\$\w+[\-\+]\d+\*[^\}]+\}\s*\}(?<X1255600>)|substr[\(\s]+(\$\w{1,40})[,\s]+\-\d+[\)\s]*==+\s*['"]\.xml['"\)\s]+\{\s*sitemap[\w\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[,\s]+\34[,\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^;]*;[^\*]{0,9999}\bif[\(\s]+preg_match[\(\s]+['"]/[^;=]{9,9999}\$\w{1,40}[=\s]+\$\w{1,40}[^;\?]+\.php\?[^\}]+(?:exit|die)[^\}]*\}\s*\}(?<X1248410>)|trim[\(\s]+\$\w{1,40}\s*\[\d+\][\)\s]*!=\s*['"][^'"]*['"]&&!is_dir[\(\s]+trim\s*\(\s*(\$\w{1,40})\s*\[\d+\][\s\)]+\{\s*mkdir[\s\(]+trim\s*\(\s*\36\s*\[\d+\][\s\)]+;\s*\}\s*\$\w{1,40}\s*=\s*sprintf[\s\(]+(?:\$\w{1,40}\s*,\s*)+urlencode\s*\([^\.]+file_put_contents\(trim\(\36\[[^\]]+\]\)\.[^\}]{0,99}\}(?<X1217700>)|typeof(?:\h*(\w+)\s*==+\s*undefined\s*\)\s*\{[\(\s]*function\s*\([^\)]+\)\s*\{\s*var\s*_0x[^\*!]{99,1999}\bwhile[\(\s]+!!\[\][\)\s]+\{\s*try\s*\{[^!]+\bvar\s*\38\s*=\s*!!\[\][,\s]+HttpClient\s*=[^/<>\-]+\breturn\b\s*\w+\s*\[[^;\-]+\-\w+[^;]*;\s*\}\s*\}\s*\([\)\s]+;\s*\}(?<X1266260>)|\s*(?:nd|zq)\w{2}(?:==+(?:['"]|&quot;)undefined(?:['"]|&quot;)[\h\)\{\(]+function\h+\w\(\)\{var\h+(\w)=\[[^\]]+\];\w=function\(\)\{return\h+\40\}[^!\n]{0,999}\bwhile\(!!\[\]\)\{[^&\n]{9,999}&&[^><\|\?%\*\n]{9,9999}!==\-[01]x\d+\}\}\(\)\)\};(?<X1274980>)|\s*==+\s*(?:['"]|&quot;)undefined(?:['"]|&quot;)[\s\)\{\(]+function[\h\(]+\w+[\h\(\)]+\{\s*var\s*\w+\s*=\s*\[['"][^\]]{40,}\];[^\\<>]{99,11999}\}\s*\}\s*\(\)\);\s*\}(?<X1266161>))|\s*(ndsj)===['"]undefined["'][\s\)]+\{\s*(function)\s*(\w{1,9})[\(\)\{\s]+var\s*\w{1,9}\s*=\s*\[[^]]+\];[^:]{9,99}return\s*\45[\(\)\s]+;[^\n\?]{9,1999}\bvar\s*\43=!!\[\][,\s]*HttpClient=\44\([^\+\n]+XMLHttpRequest[^>\n]{9,8999}(?:\}\}|\)\));\};(?<X1254450>)|\s*ndsw\s*==+\s*['"]undefined['"\)\s]*\{[\s\(]*(function)[\(\s]+\w+[,\s]+\w+[\)\s\{]+var\s*\w+[\s=]+\{[^\}]+\}[^;]+;\s*while[\s\(]+!!\[\][\)\s\{]+try[\s\{]+var\s*\w+[\s=]+parseI[^;]+;\s*if[^,\{]+\{[^\?\n]{99,}\?[^\]\n]+\];\s*(\w+)[=\s]+\47[\(\)\s\{]+(return)\s*\w+[\}\s;]+\49\s*\48[^\}]*\}\s*\}(?<X1253550>))|version_compare[\(\s]+PHP_VERSION[,\s]+['"][\d\.]+['"][,\s]+['"][<>=]+['"][\)\s\{]+error_reporting[\(\s]+(?:E_\w+[\^\(\s\|\)]+){9,};[\s\}]+(\$\w{1,40})[=\s]+str_ireplace[\(\s]+['"]\w+['",\s]+\$\w{1,40}[\)\s;]+(\$\w{1,40})[=\s]+['"]Lyp[^'"]{9999,}['"][\s;]+(?:eval|assert)[\(\s]+\51[\(\s]+\52[\)\s]+;(?<X1229341>)|window\.location\.href\.includes[\(\s]+atob[\(\s]+['"]Y2hlY2tvd[^'"]*['"][\)\s]+\{\s*let\s*\w{1,40}[\s=]+(document\.)createElement\(['"]script['"]\);[^\{\}\(\)]+\b(\w+)\.async[=\s]+!\d+[,\s]+\55\.src[=\s]+atob\(['"]aHR0c[^;,]+,\s*\54[^!]+\.getElementById\(['"]\w+!['"]\)\.remove\(\),[^\}]*\}(?:\s*;)?(?<X1271970>))|[\h=]+\((?:!\$\w+[^\[]{1,149}(function)\s+(get)\w+[^\$]{1,49}\$_SERVER[^\{]{1,129}\57\s+\58\w+\((\$\w+)[^@]{1,99}@?file_get_contents\(\59[^\{]{1,99}\57_exists[^;]{1,49}curl\w+[^:]{1,499}(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+['"]https?://[^'"]+['"];[^;]{1,129}echo\s+\58\w+\(\60[^&]{1,299}\61\);\s*exit;\s*\}\s*\}(?<X120352190>)|isset\(\$_GET\[['"]\w+['"][^=]{1,29}try[\h=]+\{\s*(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[^;]{1,99}\.php['"];\s*(\$\w+)[\s=]+@?file_get_contents\(\63\);[^\{]{1,99}\64,\s*\65[^\?]{1,149}@?unlink\(\64[^\$]{1,49}(?:include|require)\s+\64[^\(]{1,49}catch\s*\(Throwable\s+\$\w+\)\s*\{\s*\}\s*\}(?<X120352180>)))
\bif(?:[\h\(!]+(?:(class)_exists[\h\('"]+(\w+)['"\s\)\{]+\1\h*\2[\s\{]+(private)\h*\$\w+[\h=]+['"]https?://0x44\.info/\w+['"];\s*\3\$(\w+)[\h=]+['"]http2_session_id\b[^#]{99,3000}\bsetcookie[\h\(]+\$\w+\->\4,[^%\^]{999,3000}\bregister_activation_hook[\h\(]+__FILE__,[^;]+;\s*new\h*\2[\h\(\)]+;\s*\}(?<X120355411>)|(function)_exists(?:[\('"]+([^'"]+)['"\)]+\s*\{\s*\6\h+\7\h*\([^\}://]{99,400}(\$\w{1,20})[\h=]+[^;]{0,9}\bwp_authenticate\([^\)]+\);\s*if\h*\(isset\h*\(\8\[[^\]]+\]\[['"]administrator['"]\]\)\)\s*\{[^\?:/]{0,999}\$\w{1,20}[\h=]+['"]https?://[^\}]{99,300}(?:\s*\})+;?\s*add_action[\h\(]+[^,]+[,'"\h]+\7[^\)]+\);\s*\}(?<X1189823>)|[\h\('"]+(verstige_wp_search)['"\s\)\{]+\6\h*\10[\s\(\)\{]+[^\?]{99,599}\bwp_parse_url[\h\(]+home_url[\h\(\)]+,[^;]+\bNULL[\h\)]+;\s*(\$\w+)[\h=]+wp_upload_bits\h*\([^;]+;\s*load_template[\h\(]+\11[^\?\{\(]{0,99}\badd_action[\h\(]+['"]\w+['"][\h,]+['"]\10['"\)\h]+;(?<X120345990>)|[\h\(]+['"](\w+)['"\s\)\{]+\6\h*\13[\s\(\)\{]+add_action[\(\h'"]+wp_footer\b[^\}]{9,150}\bwp_remote_get[\(\h'"]+https?://wpapi\.live/panel/api/footer\?[^\}]{9,899}\bbase64_decode\(\$\w+\[['"]googleOnly['"]\]\);[^#]{999,3000}\b\13\(\);\s*\};(?<X120350670>)|[\h\(]+['"](wc_store_api_sync_init_handler)['"\h\)\s\{]+\6\h*\15[^\n#]+\bfile_put_contents\(\$\w+,\h*\$\w+[\h\)]+;\s*(\$\w+)[\h=]+(\$\w+)[\h\.]+['"]wp\-settings\.php['"];\s*if[^\{]+\{\h*\16[\h=]+\17[\h\.]+['"]wp\-config\.php['"];[^\?\n]{9,199}\b\15['"\h\)]+;\s*\}(?<X120362530>))|file_exists[\h\(]+([^\)]{9,49}\.xcf/wp\-[^'"]+\.php)[\s'"\)\{]+@(?:copy|move_uploaded_file)[\h\(]+[^,]+,\h*\19['"][\h\)]+;\s*activate_plugin[\h\('"]+[^/]+\.xcf/wp\-[^'"]+['"][\h\)]+;\s*\}(?<X120369060>))|[\h\(]+!(?:(define)d[\h\(]+['"](__PLUGIN_DEPLOYER_RAN__)['"][\s\)\{]+\21[\h\(]+['"]\22['"][^#]{9,499}(\$\w+)[\h=]+\$\w+[\h\.]+['"]\.tmp['"];\s*if[\h\(]+@?file_put_contents[\h\(]+\23[^\}]{9,199}[\s\}]+;\s*(\$\w+)[\h=]+WP_CONTENT_DIR[^#]{999,9500}\bunlink[\h\(]+\24[\h\)];\s*\},\s*\d+[\h\)]+;\s*\}(?<X120365470>)|(function)(_exists)[\h\(]+['"]([\w\-]{1,40})['"][\)\s]+\{\s*\26\h*\28\h*\(\)[\s\{]+\$\w{1,40}[\h=]+['"][a-f\d]{32}['"];\s*if[\h\(!]+array_key\27[\h\(]+md5[\h\(]+(\$_SERVER)[^,;\h]+,(\$_POST)[^\?]{9,99}(\$\w{1,40})\h*=[^;]+\30\[md5[\h\(]+\29[^\?/\*&:]{499,999}\bserialize[\h\(]+\31[\h\)]+;(?:\s*\}){2}(?<X1177421>)|(function)(_exists)\(['"](\w+)['"]\)\)[^\(]{1,99}\33\s+\35[^;]{1,99}['"](\w+)['"];[^@]{1,99}@gmail\.com['"];[^\{]{1,99}\w+\34[^\?]{1,199}set_role\(['"]administrator['"]\);[^\{]{1,99}\33[^;]{1,99}(\$\w+)[\s=]+\[['"]\36['"]\][^\(]{1,99}foreach[\h\(]+\37[^\?]{1,399}str_replace\([^;]{1,199}query_where[^\(]{1,99}\35\(\);\s*\}(?<X120355491>)|(function)_exists(?:[\h\('"]+(\w+)['"\s\)\{]+\39\h*\40[\s\(\)\{]+(\$\w+)[\h=]+base64_decode[\h\('"]+[^;]+;\s*\$\w+[\h=]+get_users[\h\(\['"]+role['"\h=>]+\41\][^\?]{9,199}\39\h*(\w+)[\(\)\s\{]+\$\w+[\h=]+\40[\h\(\)]+;\s*\$\w+[\h=]+get_user_by\([^\?]{99,299}\b\39\h*\w+[\s\(\)\{]+if[\h\(]+isset\(\$_GET\[[^\]]+\][\s\)\{]+\42\(\);\s*\}\s*\}\s*\}(?<X120338130>)|[\h\(]+['"](\w+)['"](?:[\h\)]+&&[^\{]+\{\s*add_action[\h\(]+['"]\w+['"]\h*,\h*['"]\44['"][\h\)]+;[^\{]+\39\h*\44\([^\}]{9,299}\bWHERE\h*1=1['"]\s*,\s*['"]WHERE[^,]+,\s*\$user_search\->[^\?]{99,1500}\bif[\h\(]+isset[\h\(]+\$_COOKIE\[[^\{]+\{\s*die[^;]*;\s*\}\s*\}(?<X1278931>)|[\s\)\{]+\39\h*(\44\(\))\s*\{[^\?]{99,999}\berror_reporting\((?:0|NULL)\);[^\?]{999,7000}\bvar_dump\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\h*\[[^#]{99,1999}\bexit;\s*\}\s*\$\w+[\h=]+\46;\s*\}(?<X1209340>)|[\s\)]+\{\s*\39\h*\44[^#]{99,1500}\bescort</a></li>[^#]{99,1999}//wpnulled\.pro/[^#]{99,2500}\vadd_action[\h\(]+['"]wp_footer['",\h]+\44['"][\h\)]+;(?<X1305820>))|[\h\(]['"]is_https['"][\s\)\{]+(?:\39\h*(\w+)[\h\(]+[^\)]+\)\s*\{[^\}]{9,399}\}\s*return\h*\$\w+(?:[\h\(]+[^\)]+\))?;\s*\}\s*){3}\49[\h\(]+['"][^'"]{6000,10000}['"][\h\)]+;\s*\}(?<X1235040>)|\(['"](\w+)[^\(]{1,49}\51[^\(]{1,49}\39\s+\51[^@]{1,199}is_user_logged_in[^\$]{1,199}(\$\w+)[\s=]+array\(\s*['"]aHR0[^'"]+['"][^@]{1,199}\51[^@]{1,199}echo\s+json_encode\(\52\);\s*\?>;\39[^\?]{1,399}document\.head\.appendChild[^\*]{1,499}add_action\(['"]wp_footer['"],\s*['"]\51['"],\s*\d+\);\s*\}(?<X120362131>)))|[\h\(]+!?(?:empty\h*\(\h*\$redirect[^'"]{2,25}['"]wp\-admin/['"][^\{]{9,99}\{\s*\$\w{1,20}=['"]https?://[^/\\&]{99,700}(\$\w{1,20})=base64_decode\(['"]aHr0[^\)]{9,99}\)\.[^@\{]{9,150}\$\w{1,20}\h*=\h*@?file_get_contents\(\54\);[^,]{0,40}\bfunction\h+(\w{1,20})\([^\};]+\bcurl_init\([^\}]+\}\s*\55\(\54\);\s*\}(?<X1174291>)|isset[\h\(]+[^\{]{1,40}\{\s*(\$\w{1,20})[\h=]+\$_FILES\[[^\]]+\];\s*if[\h\(]+move_uploaded_file[\h\(]+\57\[["']tmp_name['"]\][^\{]{1,40}\)[\{\s]+echo\h*['"][^\}]{0,40}(?:(?:exit|die)[^;]{0,9};[\}\s]+){1,3}(?<X1242630>)))
\bif(?:[\h\(]+!(?:\h*(function)_exists(?:[\h\('"]+(\w+)['"\s\)]+\{\s*\1\h*\2[^\{]+\{\s*\$\w{1,25}[\h=]+['"][^'"]+['"];\s*(\$\w{1,25})[\h=]+strtr[\h\(]+\3[^\?]{99,300}(\$\w{1,25})[\h=]+\$_POST;\s*if[\h\(]+isset[\h\(]+\4\[[^\}]{0,400}\binclude[\h\(]+\$\w{1,25}[\h\)]+;\s*\}\s*\}(?<X1220281>)|[\h\(]+['"](\w+)['"][\h\)]+:\s*\1\h*(\w+)\([^\{]+\{\s*\$\w+[\h=]+curl_init\([^\}]{9,300}\}\s*\1\h*\6[\s\(\)\{]+\$\w+[\h=]+array[\s\(]+getcwd\(\)\.[^\\]{99,900}\\\$temp_path\b[^\{]{9,500}\{[^\\]{9,550}\bfile_put_contents\(\$\w+,\h*\7\([^\?]{0,99}\badd_action\(['"]\w+['"],\h*['"]\6['"]\);(?<X120344180>))|class_exists[\h\(]+['"](\w+)['"][\s\)\{]+if[\h\(]+@function_exists[\h\(]+['"]is_user_logged_in['"][^&]{999,7000}\bif[\h\(]+substr[\h\(]+(\$\w+\[[^\]]+\])[,\h\d]+\)\W{2,4}['"]<script['"][\s\)\{]+print\h*\10;[\s\}]+setcookie\(['"]WPSESSID['"][^\?]{99,999}(\$\w+)[\h=]+new\h*\9;\s*\11\->init\(\);\s*\}(?<X1273340>)|defined(?:[\h\('"]+[_A]+[\s'"\)]+define[\h\('"]+[_A]+['"\h,]+[_A]+['"\h\)]+;\s*(\$GLOBALS\[[_A]+\])=explode\([^\n]{20000,}\bcall_user_func_array\(['"]pack['"],\h*array\(\13\[\d[^\n]{999,1500}\bgoto\h*\w+;\h*goto\h*\w+;\h*\w+:\w+:(?<X1296420>)|[\h\(]+['"]_WP_CACHE_GC_RUN[^#]{0,499}md5_file[\h\(]+(?:(\$ip)\s*\)[^#]{0,399}\bfile_put_contents\(\15,\h*base64_decode[\h\(]+['"][^'"]{5000,32000}['"][\h\)]+;\s*\}\s*\}\s*\);\s*\}\s*\Z(?<X120366270>)|\$ip\s*\)[^#]{0,399}\bfile_put_contents[\h\(]+\$\w{1,20}[\h,]+base64_decode[\h\(]+\$\w+\[[^\]]+\][\s\)]+;[\s\}]+@?\$\w+\->close\(\);[\s\)\}]+;\s*\}(?<X120363941>))|[^\}]{0,99}\}\s*if[\h\(]+is_admin[^\}]{0,99}\}\s*if[\h\(]+!function_exists[\h\(]+['"]([\w\-]+)['"][\s\)\{]+\$GLOBALS\[['"]\18_loaded['"]\][^\?]{99,500}\?>\s*<script>\s*if[\h\(]+!window\.[_]*\18[^#]{9,299}\batob\(\w+\[\w+\]\)\+Math\.random\([^#]{9,799}\badd_action\([^,]+,\h*['"]\18['"][^;]+;\s*\}(?<X120365490>)|\(['"](\w+)['"]\)\)\s*\{\s*define\(['"]\20[^\{]{1,99}function\((\$\w+)[^\[]{1,99}\$_SERVER[^\}]{1,149}\21;[^\[]{1,99}\[\s*['"]https://[^'"]+\.txt['"][^\{]{1,199}foreach[^@]{1,99}@?file_get_contents[^@]{1,499}\21[^@]{1,99}(\$\w+)[\s=]+['"]<div\s+style[^@]{1,359}\21\s*\.=\s*\22;\s*\}\s*\w+\s+\21;\s*\}\);\s*\}(?<X120358010>)|\(['"]determinator['"][\)\s]+\{\s*function\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+\{\s*(\$\w{1,40})[\s=]+['"]curl['"]\s*;\s*\$\w{1,40}[\s=]+\24\s*\.\s*['"]_init['"][^\n]{99,9999}\binclude_once[\s\(]+(\$\w{1,40})[\s\);]+\}[^\?\n:]{9,199}\25[,\s]+['"][htps\.:/'"]+[^;\?]+\.php\?[^;]+\)\s*;(?:\s*\}){3}(?<X1216792>)|\([^\{]+\{\s*ob_start[\h\(]+function[\h\(]+(\$\w+)[\s\)\{]+[^\}]{0,99}(\$\w+)[\h=]+['"]https?://raw\.githubusercontent\.com/avatarrevangers04/[^'"]+\.txt['"];[^\}]{0,99}\$\w+[\h=]+curl_init\(\28\);[^\?]{9,600}\breturn\h*\27;\s*[\s\}\)]+;\s*\}(?<X120353810>))|empty(?:[\h\(]+(\$_POST\[['"]cmd['"]\])[^#]{99,299}\bWeb\h*Shell</title>[^\?]{99,1500}<\?(?:php|=)\s*htmlspecialchars\(\30[^#]{99,599}</body>\s*</html>(?<X120336020>)|\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\{\s*(\$\w{1,25})[\h=]+(base64_decode)\(['"][^'"]{999,5000}['"]\);\s*(\$\w{1,25})[\h=]+['"][^'"]+\.php['"];\s*function\h*(\w+)\(\34,\h*\32\)\s*\{[^\}]+\bfile_put_contents\(\34,\s*\32\);[^\?]{9,199}\b\35\(['"][^'"]+\.htaccess['"],\h*\33\([^\)]+[\h\)]+;\s*\}(?<X1216991>))|file_exists[\h\(]+['"](?:(/home/[^'"]{9,99}\.ph(?:tml|p))['"]\)\)\s*\{\s*(@?copy[\h\(]+['"]/home/[^'"]{9,99}['"][\h,]+['"]\37['"]\);)\s*\}\s*else\s*\{[^\{]{9,150}\{\s*@?unlink[\(\h]+['"]\37['"]\);\s*\38(?:\s*\}){1,3}(?<X1189781>)|(/tmp/\.\w+)['"][^\{]+\{\s*@?(file_)put(_contents)[\h\(]+['"]\40['"][\h,]+@?\41get\42[\h\(]+base64_decode[\h\(]+['"][^'"]{0,99}['"][\h\)]+;\s*\}\s*@?include_once[\h\(]+['"]\40['"][\h\)]+;(?<X1214370>))|function_exists[\h\(]+(?:['"]\w+['"][\)\s\{]+[^%#]{99,2000}\beval[\h\(]+['"\?>\h\.]+\$\w+\[\d+[\s\)\]\};]+exit;[\s\}]+else[\s\{]+\$\w+[\h=]+['"]https?://[^%]{999,3000}\btrue\]\]\);\h*(\$\w+)=file_get_contents\(\$\w+,[^\n]{9,299}\breturn\h*\44;\}(?<X1320741>)|__NAMESPACE__[\h\.\\'"]+(\w+)['"][\h\)\{]+function\h*\46[\h\(]+\$\w+[\h\)\{]+static\h*(\$\w+)\h*=[^\?]{99,1200}\breturn\h*base64_decode[\h\(]+\47\[[^\?]{99,1900}\barray[\h\(]+\$GLOBALS\[\46[\(\)\d,\h\]]+\46[\(\)\d\h]+;[\h\}]+(?<X1260660>))|is_wp_error[\h\(]+\$\w+[\h\)]+&&\h*!empty[\h\(]+(\$_POST\[[^\]]+\]|\$\w+)[^\{]{0,50}\{\s*@?file_put_contents[\h\(]+ABSPATH\.base64_decode[\h\(]+['"][^'"]{9,99}['"][\h\)]+,\h*\49\h*\.['"]:['"][^\)]{0,50}\bFILE_APPEND[\h\)]+;\s*\}(?<X120357910>)|isset\(\$_GET\[['"]\w+['"]\]\)\)\s*\{\s*http_response_code\(\d+\);\s*header\(['"]HTTP/\d+\.\d+[^\(]{1,49}exit\(\);\s*\}\s*(\$\w+)[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\53\w+\(\52,\s*\53\w+,\s*\51\);[^=]{1,99}(\$\w+)[\s=]+\53\w+[^\?]{1,49}eval[\h\(]+['"]\?>['"]\.\54\);(?<X120360160>)|strpos[\h\(]+\$_SERVER\[[^\]]+\],\h*['"]sgert['"][^\{]{0,199}\{\s*echo\h*['"]<(script)>\h*var\h*(\w+)[\h=]+new\h*XMLHttpRequest\(\);\h*var\h*\w+[\h=]+location\.href\.split\([^<]{9,200}\bwindow\[[^;]+;[\s\}]+;\s*\57\.send\(\);\s*</\56>['"];\s*\}(?<X120343800>))|[\h\(]+(?:defined(?:[\h\('"]+ABSPATH['"\s\)\{]+(\$\w+)[\h=]+base64_decode\(['"][^'"]+['"]\);\s*if[\h\(]+file_exists[\h\(]+\59[\s\)]+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\59[\h\)]+;\s*\}(?<X120369050>)|[\h\(]+['"]PHP[^\{]+\{\s*(\$\w+)[\h=]+(base64_decode\(urldecode\()['"][^'"]{999,5000}['"][\s\)]+;\s*\}\s*else\s*\{\s*\61[\h=]+\62['"][^'"]{999,5000}['"][^\?]{99,5500}(\$\w+)[\h=]+['"]\w+\.php['"];\s*file_put_contents\(\$_SERVER\[[^\]]+\][\h\.]+DIRECTORY_SEPARATOR[\h\.]+\63,\h*\61[\h\)]+;(?<X120347150>))|empty[\h\(]+(\$\w{1,40})[\s\)]+\{\s*if[\h\(]+substr[\h\(]+trim[\h\(]+(\$_SERVER\[)['"]REMOTE_A[^;]{99,199}\belse\s*\{\s*@?error_reporting[\h\(]+0[\h\)]+;\s*@ini_set\([^@]{99,999}@stream_context_create\([^\?]{999,2999}(?:\65\[[^\]]+\][=\h]+\66[^;]+;\s*)+\65\h*=\h*trim[\h\(]+\65[\h\)]+;(?:\s*\}){2}(?<X1178130>)|file_exists(?:[\h\(]+(?:(\$\w{1,20})[\h=]+base64_decode[\h\(]+['"][^'"]{9,150}['"]\)\)\)\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\(?['"]?\68['"]?\)?;\s*else\s*echo\h*__FILE__;(?<X1215620>)|(ABSPATH)[\h\.]+['"](wp\-includes/teknocore\-[^'"]+\.php)['"][\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\70[\h\.]+['"]\71['"];\s*\}(?<X120355540>)|['"](\w+\.zip)['"\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:['"\h]+zip://\73#\w+\.txt['"];\}(?<X1316131>)|[\h\(]+['"zip\.\h]+://\73#\w+['"\h\)]+;(?<X1307810>))|['"](\w+\.zip)['"\s\)\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]zip://\76#\w+(?:['"];\s*\}(?<X1305970>)|\.php['"];\s*\}(?<X1295010>))|\$png\w{1,12}[\h\)]+require_once\(['"][\./]{0,2}screen[\w\-]{0,40}\.(?:png|jpe?g|ico)['"]\);(?<X1179700>))|\(__DIR__\s*\.\s*['"]/wp\-loader\.php['"]\)\)\s*(?:require|include)(?:_once)?\(__DIR__\s*\.\s*['"]/wp\-loader\.php['"]\);(?<X120361270>))|function_exists[\h\(]+(\$\w{1,40})[\h\)]+\{\s*\$\w{1,40}[\h=]+@\81[\h\(]+['"][^'"]*['"][\h,]+(?:\$\w{1,40}[\h\(\)]+)+;\s*if[\h\(]+\$\w{1,40}[\h\)]+@?\$\w{1,40}[\h\(=][^\}]{2,99}\}\h*else\h*\{\s*(\$\w{1,40})\h*\.?=\h*['"]\\[^\}@\v]{99,999};\h*@\$\w{1,40}[\h\(]+\82[\h\)]+;\};(?<X1187682>)|get_option(?:[\h\('"]+(_elementor_pro_license_data)['"][\s\)\{]+delete_option[\h\('"]+\84['"\h\)]+;\s*\}(?<X120365770>)|\(['"]_(elementor_pro_license)_data['"]\)[^\(]{1,49}delete_option\(\s*['"]_\86_data['"]\);\s*\}\s*(update_option)[\h\(]+['']\86_key['"],\s*['"]\*{3,}[^'"]{1,9}['"][\h\)]+;\s*\87[\h\(]+['"]_\86\w+[^\)]{1,49}\+12\s+hours['"][^\?]{1,99}json_encode\([^\]]{1,99}expires[^/]{1,99}add_filter[^\)]{1,99}__return_empty_array['"],\s*\d+\s*\);(?<X120361191>))))
\bif[\h\(]+(?:isset(?:[\(\h]+\$_(?:[GPRSC]\w{2,6}\[['"]sitemap['"]\][\h\)]+\S{2,3}\h*isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\s*\$\w{1,40}[\h=]+['"]file['"];\h*@?header\([^\)]+\);\h*(\$\w{1,40})[\h=]+find_file_in_folders\([^\}]+\}\s*else\s*\{[^\}]+\}\s*\}\s*fclose\(\1\);\s*\}\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1181931>)|POST\[[^\]]+\][\s\)]+\{\s*if[\h\(]+is_writable[\h\(]+\$(?:w[e3]b)?r[o0]{2}t[\s\)]+\{\s*(if[\(\h]+@copy\h*\(\h*\$_FILES\[[^\]]+\]\[[^\]]+\]\h*,)[^\}]{9,499}\}\s*else\s*\{\s*echo[^;]+;(?:\s*\}){2}\s*else\s*\{\s*\3[^\}]{9,499}\}\s*else\s*\{\s*echo[^;]+;(?:\s*\}){3}(?<X2176680>))|[\h\(@]+\$_GET\s*\[[^\]]+\][\s\)\{]+(\$\w+)\s*=[@\sfile_putcons\.'"]{15,};\s*(\$\w+)\s*=[@\s'"\.file_gtcons]{15,};\s*\5[\h\(]+['"][^,]+,\h*\6[\h\(]+['"]['"\.htps:/]+[^\);]+\)[\h\)]+;\s*\}(?<X1259501>)|[\h\(]+(\$_[GPR]\w{2,6}\[[^\]]+\])[\s\)\{]+(echo)\h*['"]<(\w+)>['"];\s*\9\h*system[\h\(]+\8[\h\)]+;\s*\9\h*['"]</\10>['"];\s*\}(?<X1259780>)|[\h\(]+(\$_[GPRC]\w{2,6}\[[^\]]+\])[\h\)&]+\12[\h=]+[^\{]+\{\s*eval[\h\(]+(?:hex2bin[\h\(]+){1,2}\$_[GPRC]\w{2,6}\[[^\]]+\][\h\)]+;\s*\}(?<X1259990>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\)]+\])\)(?:[^\$]{1,15}\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\)[^,]{1,99}(\$\w{1,20})[\h=]+array\w{0,6}[\h\(]+[\h\)]+;\s*parse_str[\h\(]+base64_decode[\h\(]+\14\)[,\h]+\15\);\s*echo\h*(\15\[)\d+\][\h\(]+\16\d\][\h,]+\16\d+\]\);\s*(?:die|exit)[^;]{1,9};\s*\}(?<X1227940>)|[^_]{1,15}\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\)[^,]{1,99}\b(?:parse_str|ccontrollerclient::RunCommand)[\(\h]+hex2bin[\(\h]+str_rot13[\h\(]+\14\)[^\?]{0,20}\b(?:die|exit)[^;]{1,99};\s*\}?(?<X1227930>))|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h=]+trim[\h\(]\19\);[\}\s]+if[\h\(]+isset[\h\(]+\20\)\)\s*\{\s*@?eval[\h\(]+base64_decode[\h\(]+\20\)\);\s*\}(?<X1190790>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+(\$\w+)[\h=]+\22;\s*if[\h\(]+\23===['"]ping['"][\s\)\{]+echo[^;]+;\s*(?:exit|die)[^;]{0,9};[\s\}]+@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\23[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X120367470>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\n#]{0,199}(\$\w+)[\h=]+hex2bin\(\25\);[^\n\?]{0,199}(\$\w+)[\.\h=]+chr\(ord\(\26\[[^\n#]{0,399}\bfile_put_contents\((\$\w+),\h*\27[^\n\?]+\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\28;[^\n]{0,50}\}(?<X1311911>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]{9,40}\)[\s\{]+(\$\w{1,20})=\30;\s*\31[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[\}\s]+else[\{\s]*echo\h+[^;]{9,99};(?<X1198520>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[^\{]{1,40}\{\s*if[\h\(]+!?isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\)]+)[\h\)]+\s*\34[\h=]+array\(\);\s*(\$\w{1,20})[\h=]+\33;\s*\35\h*\(\34\);\s*\}(?<X1195630>)|[\h\(]+(\$_[GPRSC]\w{2,6}\h*\[['"]\w{32}['"]\])[\h\)]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:\s*\(\s*(?:stripslashes|base64_decode|gzuncompress))+[\s\(]+\37[\)\s]+;(?<X1181901>)|[\h\(]+(\$_COOKIE)\[\d+\][^\{]+\{(\$\w+)=\39;(\$\w+)=0;[^\n\?]{0,300}\]\(\40\[\d+\][\h\)]+;\}\h*include[\h\(]+\41[\h\)]+;\h*\}(?<X1254550>)|[\h\(]+(\$_COOKIE\[)['"][^'"]+['"][\s\)\]\{]+\b(?:system|exec|passthru|shell_exec|popen)[\h\(]base64_decode[\h\(]\43['"]callback['"]\][\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X120357930>)|[\h\(]+(\$_COOKIE\[[^\]]+\])[\s\)\{]+(?:[ir][ne][cq][lu][ui][dr]e(?:_once)?|copy)[\h\(]+\45[^\)]*\);[^\}]{0,59}\}(?<X1290190>)|[\h\(]+(\$_REQUEST\[)[^\{]+\{\h*\$\w+[\h=]+hex2bin\(\47[^\?\n]{99,250}/var/tmp\b[^\?\n]{99,199}\bfile_put_contents\([^\{]+\{\h*include\h*(\$\w+);\h*unlink\(\48\);\h*exit;\h*\}\h*\}\h*\}\h*\}(?<X120334480>)|[\h\(]+[^\{=]{2,40}[!=]{1,3}\h*['"](anons\d+)['"]\)\s*die\h*\(["']\50shellworks['"]\);[^\}\?]{9,99}@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+\$_[GPRSC]\w{2,6}\[(?<X2189530>)|[\h\(]+\$_[GPRSC]\w{2,6}\[(?:['"]auto_login['"]\][\s\)\{]+[^\{]{0,99}(\$\w+)[\h=]+get_user_by\b[^\{]{9,150}\{\s*wp_clear(_auth_cookie)[\h\(\)]+;[^\}]{0,99}\bwp_set\53[\h\(]+\52\->ID[^\}]{0,150}\bexit[\h\(\)]+;\s*\}\s*\}(?<X120351660>)|[^\]]+\](?:[\h\)]+[^\{]+\{\s*add_action[\h\(]+['"]init['"][\h,]+function[\s\(\)]+\{\s*(\$\w+)[\h=]+get_users[\h\(\['"]+role['"]=>['"]administrator[^\}]{0,99}\bwp_set_auth_cookie[\h\(]+\55[^;]+;\s*\w+[\h\(]+home_url[\h\(\)]+;\s*(?:exit|die)[^;]{0,9};[^;]+;\s*\}(?<X120345170>)|[\s\)\{]+(\$\w+)[\h=]+base64_decode[\h\(]+[^;]+;\s*(\$\w+)[\h=]+(curl_)init[\h\(]+\57[\h\)]+;[^\{]{0,99}(\$\w+)[\h=]+\59exec[\h\(]+\58[\h\)]+;\s*if[\h\(]+\60[^\{]+\{\s*eval[\h\(]+['"]\?>['"\.\h]+\60[^\?]{0,99}\b\59close[\h\(]+\58[\h\)]+;\s*\}(?<X1306500>)|[\s\)\{]+(echo)\h*['"]<body[^;]+;\s*\62\h*['"]<form[^;]{9,150};\s*if[\h\(]isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)\{]+\$\w+[\h=]+(\$_FILES\[)[^\{]{0,150}\bif[\h\(]+move_uploaded_file\(\63[^\{]+\{\s*\62\h*['"]<font[^\}]{0,199}\}\s*else\s*\{\s*\62[^;]+;\s*\}\s*\}\s*\}(?<X120348700>)|[\s\)\{]+if[\h\(]+(\$\w+)[\h=]+@?file_get_contents[\h\(]+['"]https?://[^/]+/[^'"]+\.txt['"][^\{]+\{\s*eval[\('"\?>\h\.]+\65[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*else\s*\{[^\}]+\}\s*\}(?<X1266430>)))|[\h\(]+\$_(?:COOKIE\[[^\]]+\][\s\)]+\{\s*(\$\w+)[\h=]+['"][^'"]+\.(?:png|jpe?g|bmp)['"];\s*include[\h\(]+\67[\h\)]+;\s*exit;\s*\}(?<X120352640>)|FILES\[['"]dosya['"]\][\s\)]+\{[^#]{999,2000}\bif[\h\(]+strpos[\h\(]+\$\w+,\h*['"]Bot\b[^\{]+\{\s*if[\h\(]+file_put_contents\b(?<X220365330>)|GET\[[^\{]+(?:\bimgos['"][\s\)\{]+[^\{]{9,400}\{\s*include\h*['"]compress\.zlib://['"][\h\.]+\$\w+;\s*exit;[^\}]{0,400}\}\s*else\s*\{\s*echo[^\}]{0,300}\}\s*\}(?<X120347200>)|\{\s*error_reporting\([^\}]{0,599}\bif\(move_uploaded_file\(\$\w+[^\{]{0,199}\{\s*(\$\w+)[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w+[\h=]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\71\h*\.[^\}]{0,99}\}\s*exit;\s*\}(?<X120335770>))|SERVER\[['"]HTTP_[^\{]+\{\s*if[\h\(]+\$_SERVER\[['"]REQUEST_[^\{]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"][^'"]+\.php['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X120345870>))|[\h\(]\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*(\$\w+)[\h=]+array[\h\(]+(?:['"][^'"]{25,40}['"],){99}[^\)]{1000,25000}\);\s*(\$\w+)[\h=]+array[\h\(]+(?:['"][^'"]{1}['"],){50}[^\)]{9,299}\);\s*\$\w+[\h=]+\75\[\d+\]\.\75\[[^\}]{99,550}\beval[\h\(]+\$[^\)]{0,99}\74[\h\)]+;[^\}]{0,99}\}(?<X1305580>)|\(\$_GET\[['"]\w+['"]\][^\[]{1,99}\$_SERVER[^!]{1,99}(\$\w+)[\s=]+basename[^\?]{1,99}\77[^@]{1,299}if[\h\(]+is_uploaded_file\((\$_FILES)[^\.]{1,99}unlink\(\78[^@]{1,199}htmlspecialchars[^\|]{1,299}echo\s+['"]<form\s+method=[^\|]{1,199}echo\s*['"]</form>['"];\s*exit;\s*\}(?<X120359040>))|md5[\(\h]+@\$_COOKIE\[[^\]]+\][\)\h]+\S{2,3}\h*['"]\w{32}['"][\h\)]+\{\s*@?error_reporting[\(\h]+(?:0|null|false|round)\b[^;]{0,19};\s*@\barray_(?:map|walk)\h*\([^;]+\)\h*;\s*\}(?<X1034211>)|md5[\h\(]+(?:(\$_REQUEST\[)[^\]]+\][\h\)]+[^\{]+\{\s*if[\h\(]+file_put_contents[\h\(]+(hex2bin)[\h\(]+\81[^\]]+\][\h\),]+\82[\h\(]+\81[^\]]+\][\h\)]+,[^\)]+[\s\)]+print_r[\h\(]+[^\)]+\);\s*\}(?<X120354170>)|\$_GET\[(?:['"]kntl['"]\]\s*\?\?\s*""\s*\)[^\{]+\{\s*(\$\w+)[\h=]+\s*['"]/(?:var|home)/[^'"]+['"];[^\?]{9,299}\bUpload</button>\s*</form>[^\{]{9,199}(\$\w+)[\h=]+\84[\.\h]+\$\w+;\s*(\$\w+)[\h=]+@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^,]+,\h*\85[\h\)]+;\s*exit\(\86[^;]+;\s*\}(?<X120361710>)|[^\]]+\][^\{]+\{\s*(\$\w+)[\h=]+['"]bash[^;]{0,50}\bhttps?://syndicateseo\.xyz/[^;]+;[^\}]{0,99}\b[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\88,[^;]+;\s*(?:echo\h*['"][^;]+;\s*){1,2}\}(?<X120361680>)))|php_sapi_name\([^\|]{1,49}!?defined\(['"](\w+)[^\{]{1,49}\90\)\)\s*\{\s*(\$\w+)[\s=]+(curl_)\w+\(['"]https?://[^'"]+\.php['"]\);\s*\92\w+\(\91[^\(]{1,49}(\$\w+)[\s=]+\92\w+\(\91\);\s*\92\w+\(\91\);\s*if[\h\(]+\93[\h\)]+eval\(['"]\?>['"][\h\.]+\93\);\s*\}(?<X120370750>))
\bif(?:[\h\(]+preg_match(?:[\(\h]+['"]/[bajtx\h'"\.]{7,40}/i['"][\h,]+\$email[\s\)\{]+\$\w{1,40}[\h=]+Db::getInstance\(\)\-[^;]+;\s*(\$passwd)[\h=]+['"][bajtx\h'"\.]{7,40}['"];[^\}]+\}[^\(/&\{]{1,199}\bfile_get_contents\(['"][^;]+\burlencode\((\$\w+)\b[^;]{0,99};(?:\s*\1[\h=]+null;|\s*mail\([^;]+\2\b[^;]+;)?(?<X1181502>)|[\h\(]+['"][^\$;\{\}=,]{1,40},\h*\$_SERVER\h*\[\h*['"]REQUEST_URI[^\}]{0,499}\bfunction\h+(\w{1,40})[\h\(]+(\$\w{1,40})[^\{]{1,40}\{\s*\$\w{1,40}[\h=]+@?file_get_contents[\h\(]+\5[^\?]{999,9999}\{\s*(\$\w{1,40})[\h=]+\4[\h\(]+['"]https?:[^;]+;[^\}]+echo\h+\6;(?:[^\}]{0,99}\}){2,3}(?<X1174180>))|[\h\(]isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)[\{\s]+(echo)\h*['"]<[^\.]{1,9}\.(\$\w{1,20})[\h=]+\(\8\);\s*\9\h*`\10`\.['"]<[^>]+>['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1212990>)|[\s\(!]+isset[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]*&&[^\{]{9,99}\{\s*\$\w{1,20}\s*=\s*['"]wp[_-]vcd['"];\s*switch\s*\(\s*\12[\)\s]*\{[^%]{400,4000}(?:\}\s*){3}break;\s*default\s*:\s*print\s*['"]ERROR_WP_ACTION\s+WP_V_CD\s+WP_CD['"];\s*\}\s*(?:die|exit)\b[^;]{0,40};\s*\}(?<X1131262>)|[\s\(]*(\$_POST)[\s\)]*\{(?:\s*(\$\w{1,40})\s*=\s*\14\[[^\]]+\]\s*;)+\s*\$\w{1,40}[\s=]+wp_aut[^;]+\15[^;]*;\s*(\$\w{1,40})\b[^;]*;\s*if[\s\(!]+empty[\s\(]+\16[\s\)]+\{\s*\$\w{1,40}[\s=]+curl_ini[^;]*;(?:\s*(\$\w{1,40})[\s=]+str_rot13\b[^;]+;)+\s*\$\w{1,40}\s*=[^;]*\17[^;]*;[^\}]*curl_close[^;]*;\s*\}\s*\}(?<X1201400>)|[\s\(]+!(?:(file_)exists[\s\(]+['"](/tmp/[^'"/]{1,40})['"][\s\)]+\{\s*@?\19pu(t_contents)[\s\(]+['"]\20['"][\s,]+\19ge\21[\s\(]+base64_decode[\s\(]+['"]aHR0[^'"]{1,199}['"][\s\)]+;\s*\}\s*@?include(?:_once)?[\s\(]+['"]\20['"][\s\)]+;(?<X1198710>)|(function)_exists(?:[\(\s]+['"](\w+)['"][\)\s\{]+\23\s*\24(?:[\(\)\s\{]+\$\w+[=\s]+\$_SERVER\[['"]SER[^\]]+\];\s*\$\w+[=\s]+['"]127[\.01]+['"][^\n>\?:]{9,}curl_setopt[^;\{\}]+['"]https?://['"](?:[\s\.]+\$cl\d+ip[\.\s]+['"]/?['"])+\s*\.[^\n>]{9,}header[\('"\w:\s]+404\s*Not\s*Found['"\)\s;\}]+else[\s\{]+\}(?<X1262400>)|[^\$]+\$_SERVER\[[^\]]+\][^\n>\?:]{9,}curl_setopt[^;\{\}]+['"]https?://['"](?:[\s\.]+\$cl\d+ip[\.\s]+['"]/?['"])+\s*\.[^\n>]{9,}\bheader[^;]+404\s*Not\s*Found[^\}]{1,99}\}\s*else[^\}]+\}(?<X1262410>))|[\s\('"]+(\w+)[\)'"\s\{]+\23\s+\27[\s\(\)\{]+(?:[^;=\(]+=\s*(call_user_func(?:_array)?\s*\()[^;]{1,99};){2}[^\?]{1,499}(?:=\s*\28[^;]{1,199};[^=;\(\}]{0,19}){5}[^\?]{1,299}\b(?:die|exit)[\s\(]+\28[^;]{99,};[\s\}]+\27[\s\(\)]+;\s*\}(?<X1193600>))))
\bif[\s\(]+(?:!?username_exists[\s\(]+['"]([^'"]+)['"][^;\{]+\{\s*(\$\w+)[\s=]+get(_user)_by\s*\([^,\)]+,\s*['"]\1['"][^\}]+\2(\s*\->\s*set_role[\s\(]+['"]administrator['"][^;]+;)[\s\}]+else[\s\{]+(\$\w+)[\s=]+wp_create\3[\s\(]+['"]\1['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP\3[\s\(]+\5[\s\)]+;\s*\6\4\s*\}(?<X1207630>)|!\h*class_exists[\(\s]+['"](\w{1,40})['"\)\s]+\{\s*if[\s\(]+@function_exists[\('"\s]+(is_user_logged_in)['"\)\s]+\{\s*if[\s\(]+\9[\(\)\s]+\{[^<]{99,}<\s*script['"][^>]{1,9999}\->cookie[^=]+(\$\w+)\s*=\s*new\s*\8;\s*\10\->\w+[\(\);\s]+\}(?<X1281270>)|!\h*file_exists[\s\(]+(['"][^'"]+\.txt['"])[\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+['"]://['"][\.\s]+\$_SERVER\s*\[['"]HTTP_HOST['"\]\.\s]+/\w+['"][\s;]+(\$\w{1,40})[=\s]+(file_get_contents)[\s\(]+\13[\s\);]+if[\s\(]+empty[\s\(]+\14[\s\)]+\{\s*\$\w{1,40}[=\s]+curl_i[^!]+\15[\s\(]+\12[\s\);]+\}(?<X1283411>)|!\w+\([\)\s\{]+var\s*(\w{1,40})[=\s]+\w+[\s\(]+['"]\w['"](?:[\h\+]+['"]\w['"])+[\)\s;]+if[\s\(]+\17[\s=]+undefined[\)\s\{]+setCookie[\s\(]+['"]\w['"](?:[\h\+]+['"]\w['"])+[,\s]+\w[^;]+;\s*document\.write[\(\s'"]+<[iframe'"\+]{6,}\s+[src'"\+]{3,}=[^;:>]*http://[^<\-]+\-\d{4,}p[xt];[^/<]+<[^\}]+\}\s*\}(?<X1263611>)|!class_exists[\(\s]+['"](?:([^'"]{1,40})['"][\)\s]+\{\s*if[\s\(]+function_exists[\(\s]+['"]is_user_logged_in['"][\)\s]+\{[^\176]{9,9999}if[\(\s]+@preg_match[\(\s]+['"]\176[^\\]{9,4999}(\$\w{1,40})\s*=\s*new\s*\19;\s*\20\->init[\s\(]+\$\w+[,\s]+\$\w+[\s\);]+\}(?<X1271940>)|(\w+)['"][\)\s\{]+if[\s\(]+@(function_exists)[\(\s]+['"](is_user_logged_in)['"\)\s]*\{\s*if[\s\(]+\24[^#]{1,999}\$\w+[=\s'"]+#\(\w+\|[^>]+\bif[\(\s]+!@\23[\(\s'"]+getallheaders['"\)\s]+\{[^\\]+\bclass\s*\22[^;]+\$\w+[=\s]+['"]\\[^\*]+=\.\*\?[^!]+\22;\s*\$\w+\->\w+[\(\);\s]+\}(?<X1279000>))|!empty(?:[\(\s]+\$_REQUEST\s*\[['"][^'"]+['"]\][\)\s]*\|\|\s*!empty\(\$_REQUEST\s*\[['"][^'"]+['"]\][\)\s]*\|\|[^;]+\btrim[\(\s]+ini_get[\(\s]+['"]disable_functions['"]\)+;\s*\}[^\n]{99,}\bfile_put_contents[\(\s]+\$_REQUEST\s*\[[^;\n]+;[^\}]+\b(?:exit|die)\b[^;]*;\s*\}(?<X1264610>)|[\s\(]+(\$_POST\s*\[[^\]]+\])[\)\s]+\{\s*\$\w{1,40}\s*=\s*array[\s\(]+(?:['"](?:(shell_exec)|exec|system|popen|passthru|proc_open)['"][\s,\)]+){4,};\s*\$\w{1,40}[=\s]+ini_get[\(\s'"]+disable_functions[^\[]{1,999}\28[\s\(]+\27[^<>]+while[\(\s]+!feof[\(\s]+\$[^;]+;\s*\}[^\}\{]{0,99}\}\s*\}(?<X1255150>))|!isset[\s\(]+((\$roles\[)['"]\w+['"]\])[\s\)\|]+!NUMBER\D{0,9}\30[\s\)]+\{\s*function[^=@]{0,99}\}\s*else[\s\{]+switch[\s\(]\31['"]\w+['"]\][\s\)]+\{\s*case\h*['"]\w+['"]:\s*echo[\h\(@]+serialize[^;]+phpversion\([^\}]+@eval[\h\(]+\31['"]\w+['"]\][\s\)]+;[^\}]{0,40}\}\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1191250>)|(?:(?:sha|md)[12456]{1,3}[\s\(]+){2,}\$\w{1,40}\D{2,9}['"][^'"]{32,64}['"][\s\)]+\{\s*(\$\w{1,40})\s*=(?:\s*isset)?[\s\(]*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]*;\s*(?:if[\s!@\(]+(?:isset|empty)[\s\(]+\33[^;]+;[\s\}]+)?@?[sae](?:ystem|xec|open|val|ssert)[\s\(]+\33[\s\);]+(?:die|exit)\b[^;]{0,19};\s*\}(?<X1201391>)|(?:md5[\s\(]+)+\$_[GPCSR]\w{2,6}\[[^;\{]{1,199}\{\s*@?\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^\)]*\$_[GPSRC]\w{2,6}\[[^;]+;\s*@?(?:die|exit)\b[^;]*;\s*\}(?<X1207430>)|(?:md5[\s\(]+){2,}\$\w{1,40}[\s\)]+\S{2,3}\s*['"]\w{32,}['"][\s\)]+\{\s*(\$\w{1,40})\s*=\s*(?:isset[\s\(]+)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]*;[^@>]{0,499}(\$\w{1,40})\s*=\s*base64_decode[\s\(]+\36[\s\)]+;\s*@?eval[\s\(]+\37[\s\)]+;[^\}=]{0,40}\}(?<X1200850>)|(?:md5[\s\(]+){2,}getenv[\s\(]+['"]HTTP_USER_AGENT['"][\s\)]+\S{2,3}\s*['"][^'"]{32,}['"][\s\)]+\{\s*@?chmod[\(\s]+['"](\.htaccess)['"][\s,]+\d+[\s\);@]+unlink[\s\(]+['"]\39['"\s\);@]+file_put_contents[\s\(]+['"][^'"]+\.php['"][\s,]+base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+(?:die|exit)\b[^;]{0,19};\s*\}(?<X1200840>)|\!function_exists[\(\\\s]+['"]\w{1,40}\\?['"][^\{\};]*\{\s*try[^\n@/:]{9,999}if[\s\(]+(?:\$[a-z\d]+[\s\(]+){2,}\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s=\\]+['"][a-f\d]{32}[^:<@]{1,999}@\$\w[^:<]{1,999}<(script>)[^:<]{0,9999}</\41[\\'";\}\s]+add_action\(\\?['"]wp_[hf][^\}]+\}[\}\s]+catch\s*\([^\}]+\}\s*\}(?<X1264903>)|\$\w{1,40}\s*==+\s*(?:(\$\w{1,40})\[\(\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^;]+;\s*(?:exit|die)\b[^;]*;[\s\{\}]*if[\(\s]+\$\w{1,40}\s*==\s*\$\w{1,40}\s*\[[\(\s]+int[\)\s]+rounD[\(\s]+\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^\n]{99,}\43\[[\(\s]+int[\)\s]+rounD[\(\s]+\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^;]+;(?<X1260630>)|\$\w{1,40}\)\{\s*function\s*(\w+)[\s\(\)]+\{\s*\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\w+\s*\([^\*\n]+\bbase64_decode\(md5\(\$\w+\[\w[^\}]+\}\s*\}[^\}]+\}\s*\45[\s\(\);]+\}(?<X1280920>))|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\]\s*\S{2,3}\s*\$GLOBALS\[[^\]]+\]\[[^\]]+\][\)\s]+\{\s*function\h*hide_plugins\h*\((?<X2196501>)|\s*\[['"]vf[^\]]{2,9}\]\s*\S{2,3}\s*['"]online\d+['"\)\s]+\{\s*echo\b[^;:]+https?://[^;:/]+\.(?:top|xyz|ga)/[^;:\?]+\?domain[^;:\?]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1196700>)|\s*\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{\s*\$\w{1,40}\[[^\]]+\][\s=]+['"]post['"\s;]+\$\w{1,40}\[[^\]]+\][\s=]+['"]page\w*['"];[^\{\},]{0,199}(?:\$\w{1,40}[\s=]+@?\w{1,40}[\s\(]+['"][^'"]{1,99}['"][\s\)]+;\s*)+\$\w{1,40}[\s=]+curl_init\s*\(\);[^!]+if[\(\s]+!empty(?:[^\}]{0,499}\}){3}(?<X1198310>))|\d+\s*[\*\-\+]\s*\d+[\)\s]+ANd[\(\s]+(\$\w{1,40})\s*=\s*@\s*\$\s*\{\s*['"]\\(?:x5fR|137)\\(?:x45Q|122)[^'"]{1,15}(?:T|\\x54)['"]\}\s*\[['"][^'"]+['"]\][\s\)]+\{\s*\50\s*\[\d+\][\s\(]+\$\s*\{\s*\50\s*\[\s*\d+\s*\]\s*\}\s*\[\d+\][,\s]+\50\s*\[\d+\][\s\(]+\50\s*\[\s*\d+\s*\][\s\)]+;\s*\}\s*;(?<X1250731>)|current_us(?:\w+[\s\(]+(base64_decode)[\s\(]+['"][^'"]+['"][\s\)&]+!array_k\w+[\s\(]+\52[^;\)]+\)[,\s]+\$_[GPRSC]\w{2,6}[\s\)\{]+(add_action)[\s\(]+\52[^@]{99,}(\$\w{1,40})[=\s]+@dns_get_r\w+[\(\s]+\$\w{1,40}\b[^\}]+\}\s*else[^\}]+wp_red\w+[\s\(]+\54[\s\);@]+(?:exit|die)[^;]*;[\s\}]*\53[\s\(]+\52[^\}]+\}(?<X1260511>)|er_can(?:[\s\('"]+(administrator)[^=]+if[\s\(]+!(function)_exists[\s\('"]+(_?\w{1,9})[^\|@]+(\$\w{1,40})[=\s]+new\s*WP_User[^;]+;\s*\59\->set_role\(['"]\56['"]\);[^<?:]+\57\s*\58[\s\(]+[^#%]+(\$\w{1,9})[\s=]+['"]dns_[^;]+;[^;]+\60[^;]+DNS_TXT[^>?:]+add_action[^;]+\58['"][\)\s]+;\s*\}(?<X1260871>)|[\s\(]+(base64_decode)[\s\('"]+YWRtaW5pc3RyYXRvcg=*['"][^\+%#\.]{99,1399}\b\62[\s\('"]+LyhhbmRyb2lkfHdlYm9zfG[^\+%#]{99,2299}(\$\w{1,9})[\s=]+dns_get_record[\s\(]+\$\w{1,9}[\s,]+DNS_TXT[^\+%#]{9,999}\bwp_redirect[\s\(]+\63[\s\);]+(?:exit|die)[;\}\s]+add_action[\s\(]+\62[^;]+;\s*\}(?<X1257921>)))|get_magic_quotes_gpc\s*\(\)[\s\)]+\{\s*foreach[\s\(]+\$_[GPRC]\w{2,6}\s*as\s*(\$\w{1,40})\s*=>\s*\$\w{1,40}[\s\)]+\{\s*\$_POST\[\65[^;]+;\s*\}\s*\}[^\{\}]{0,999}function\s*perms[\s\(]+\$\w{1,40}[\s\)]+\{[^\?\.]{0,999}(\$\w{1,40})\s*\.=[\s\(]+\$\w{1,40}[^;\?]+\?\s*['"][rw][^\}]+\breturn\s*\66;\s*\}(?<X1198950>)|is_file[\s\(]+['"]\{\$\w+\}/\.w3\-cache/[^:]{9,999}\b\w{1,40}[\s\(]+['"]https?://\w(?<X2223630>)|isset[\(\s]+(?:(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,40})\s*=\s*file_get_contents[\(\s]+\69[\);\s@]+eval[\('\?>"\.\s]+\70[\.'"<\?ph\s;]*\)\s*;\s*@?(?:die|exit)\b[^;]*;\s*\}(?<X1287530>)|(\$_REQUEST\s*\[[^\]]+\])[\s\)@]+system[\s(]+\72[\s\)]+;(?!\s*else)(?<X1279250>)|\$_(?:GET\[[^\]]+\][\)\s]*\{\s*(\$\w{1,40})[=\s]+__DIR__;\s*\$\w{1,40}[=\s]+\$_POST\[[^\]]+\][^\{\}]{0,499}\bif[\(\s]+(\$\w{1,40})[=\s]+opendir[\(\s]+\74[\s\)\{]+while\s*\([^\}]+\bfopen[\(\s]+\74[^\}]*\}(?:[^\{\}\$]*\})+\s*closedir[\s\(]+\75(?:[^\{\}\$]{0,40}\}){2}(?<X1259980>)|POST\s*\[['"](pw_\w+)['"]\][\)\s]*\{\s*if[\s\(]+\$_POST\s*\[['"]\77['"]\][\)\s]+==+\s*\$\w+[\)\s]+\{\s*setcookie[\(\s]+["']\77[^;]+;\s*(\$\w+)\s*=[^;]+;[\s\}]+if[\s\(]+!\78[\s\)\{]+(?:die|exit)\b[\s\('"]+<form\s+action=['"]\?(?<X2269931>))))
\bif(?:[\s\(]+(?:isset[\s\(]+(?:((\$\w{1,40})\[['"]ak['"]\])[\s\)&]+\$\w{1,40}[\s=]+\1[\s\)]+\{\s*if[\s\(]+\2\[[^\]]+\][\s=]+['"]\w+['"\s\)\{]+(\$\w{1,40})[\s=]+Array[\s\('"]+pv['"]\s*=>\s*phpversion[\s\(]+\)[,\s]+['"]sv['"]\s*=>[^\}]+serialize[\s\(]+\3[\s\);]+\}\s*elseif[\s\(]+\2[^\}]{0,99}eval[\s\(]+\2\[[^\]]+\][\s\);]+\}\s*exit\b[^;]*;\s*\}(?<X1195588>)|(\$+\w+\[[^\]]+\])[\s\)]+\{\s*(\$\w+)[\s=]+\5;\s*(\$\w+)[\s=]+fopen\s*\([^;]+;\s*(fwrite[\s\(]+\7)[,\s]+['"]<\?[^;]+;\s*\8[,\s]+stri?_replace[\s\(]+['"](\W{1,5})\s*\w{1,64}\s*\9['"][^;]*\6\b[^;]+;\s*fclose[\s\(]+\7[\s\)]+;\s*\}(?<X1212430>)|(\$_COOKIE\[[^\]]+\])[\s\)]+[\s&]+isset[\s\(]+(\$_POST\[\11\])[\s\)\{]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\12[\h\)]+;\s*\};(?<X120361380>)|\$_(?:[GPCSR]\w{2,6}[\s\[]+['"][^'"]+["']\s*\][\s\)]+\{\s*echo.{1,1999}?\}\s*else\s*\{\s*@?move_uploaded_file[\s\(]+\$\w{1,40}[\s\[]+["'][^'"]+["'][\s\]]+\[\s*["'][^'"]+["'][\s\]]+,\s*["'][^"']*["']\s*\.\s*\$\w{1,40}[\s\[]+["'][^"']+["'][\s\]]+\[\s*["'][^'"]+["'][\s\]]+\)\s*;\s*echo[^\$]+\$_FILES[\s\[]+["'][^"']+["'][\s\]]+\[\s*["'][^"']+["'][\s\]]+;\s*echo\s*["'][^'"]+["']\s*;\s*\}\s*\}(?<X1037391>)|[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*@?(\$\w{1,40})\h*=\h*str_replace[\s\(]+['"]\(\)['"]\h*,\h*['"]['"]\h*,(?:\s*['"][\w\+/]{1,40}\(\);['"]\.)+\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\}]{9999,}@?(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*['"]{2}\h*,[^;,\)]*\15[\)\s]+;\s*@?\16\(\);\s*\}(?<X1194820>)|[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)@]+array_map[\(\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\]\s*,\s*\18\s*\[[^\]]+\][\s\)]+;(?!\s*else)(?<X1201765>)|COOKIE\[[^\]]+\][\)\{@]+eval[\s\(]+substr[\s\(]+file_get_contents[\s\(]+['"]https?://bit\.ly/[^:'"]+['"][\s\)\d,]+;\s*@?(?:exit|die)[\(\)\s]+;\s*\}(?<X1250801>)))|md5[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]*\S{2,3}\h*['"][^'"]+['"][\s\)]+\{\s*require[\(\s]+['"]wp\-includes/reg[^;]+;\s*if[\s(]+!(user)name_exists[\s\(]+['"]([^'"]+)['"][\s\)]+\{\s*(\$\w{1,40})[\s=]+wp_create_\21[\s\(]+['"]\22['"][\s,]+['"][^'"\$]+['"][\s\)]+;\s*(\$\w{1,40})[\s=]+new\h*WP_\21[\s\(]+\23[\s\);]+(\24\->set_role[\s\('"]+admini[^;]+;)\s*\}[^\}]+\25\s*\}\s*\}(?<X1197100>)|preg_match[\('"\s/]+[^,](?:(?:Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|AmazonBot|YandexBot|paloaltonetworks)\|){2,}[^,]+[\s,]+\$_server\[[^\]]+\][\s\)\{]+header[\s\('"]+[HTP/1\.02\s]+403\s*Forbidden['"\);exit\(\s]+\}(?<X1261073>)|strpos[\(\s]+\$(?:[o0]+[,\s]+(\$[o0]+)\s*\[[^\]]+\](?:[\s\.]+\28\s*\[[^\]]+\])+[\)\s]+\{\s*\$[o0]+\s*=[^:]+;\s*if[\s\(]+empty[\(\s]+\$[o0]+[\)\s\{@]+header[\(\s]+\28\s*\[[^\]]+\]\s*\.[^\*@\n]{9,9999}\bif[\(\s]+!\s*empty[\(\s]+(\$[o0]+)[\)\s\{]+echo\s*\29[;\s]+@?(?:exit|die)\b[^;]*;\s*\}\s*\}\s*\}\s*\}(?<X1261750>)|user_agent\s*,\s*['"]Googlebot['"][\)\s]*!==+\s*false[^\};@]+include(?:_once)?\s*['"]wp\-\w+\.html?['"];\s*(?:exit|die)\b[^:]*;\s*\}\s*\}(?<X1264021>))|strstr(?:[\(\s]+(\$\w{1,40})[,\s]+['"]\w{1,9}map\w*['"][\)\s]+\{\s*\$\w{1,40}[\s=]+dirname[\(\s]+\32[\)\s]+;[^=]{1,999}\bif[\s\(]+strstr[\(\s]+\32[,\s]+['"]\.[xh]t?ml['"][^#]{9,6999}\bif[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;\{\}]+\{\s*echo\b[^;]+\32[^;]+;[^\}]{0,499}\}\s*@?\w{1,40}[\h\(]+[^;]+\32[^;]+;(?<X1186482>)|[\s\(]+(\$\w{1,40}),['"]\.php['"\)\s]*\{\s*if[\s\(]+(?:(?:sha|md)\d+[\s\(]+)+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*==[^;:\{\}]+[\$\w]+[\s\.]+['"]:?//['"]\s*\.[^\{\};]+\{\s*(\$\w+)[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\s\(]+file_put_contents[\s\(]+\$\w+[\s/\.'"]+\34,\35[\)\s]*\{[^\}]+\}\s*\}\s*\}(?<X1255740>))|substr[\(\s]+\$\w+,\s*\-\d+[\)\s]*==+\s*['"]robots['"][\)\s]+\{\s*define[\(\s]+['"]BASE_PATH['"][,\s]+\$_SERVER\s*\[['"]DOCUMENT_ROOT['"]\][\);\s]*\$\w+\s*=\s*@?file_get_contents\s*\([^\n]{99,}\$\w+\s*\[["']http_user_agent['"]\][^;]*;[^\}]*\}\s*\w+[\s\(\)]+;(?<X1262320>))|\(!(?:(class)_exists\(['"](\w{1,40})['"]\)+\{[^\}\v]{1,999}\}+if\(@preg_match\([^,]{99,999},\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\v]{99,999}\b\38\h+\39\{[^;]{0,99}\$\w{1,40}\h*=\h*['"](?:\\x\d+|https?://)[^\v]{999,9999}\bunset\(\$links\[[^\v]{1,199}(\$\w{1,40})=new\h+\39;\40\->\w{1,40}\([^;]{1,99};\}(?<X1181910>)|(function)_exists\(['"](CoreLibrariesHandler)['"]\)\)\s*\{[^\{\(]{0,19}\b\42\h*\43\(\)\s*\{[^\{\(]{0,19}(\$\w{1,25})\h*=\h*['"][^\?]{99,999}\becho\h*\44;\s*\}[^\}]{0,19}\bregister_shutdown_\42\(['"]\43['"]\);[^\}=\$\(;\{]{0,99}\}(?<X1174372>))|\(!?(?:((function)_exists)\(['"](\w{1,20})['"]\)\)[\s\{]+\47\h+\48\(\)[\s\{]+\$\w{1,20}=array\(\);\s*foreach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,20}=>[^@#\*]{99,300}\46\(['"](is_user_logged_in)["']\)\)\s*\{\s*if\(\49[^@&]{999,6000}\bcurl_exec\([^\}]+[\}\s]+(\$\w{1,20})=new\h+curlopt_request;\50\->init\(\);\s*\}(?<X1194070>)|(function)_exists\(['"](\w+)[^\(]{1,49}\52\53\((\$\w+)\)\{eval\(\54[^=]{1,49}\54=get_option[^,]{1,99}add_action\(['"]after_setup_theme['"],['"]\w+['"],\d+\);\}(?<X120366130>)|empty\(\s*\$_COOKIE\[['"]client_check['"]\][\s\)]+die\(\s*\$_COOKIE\[['"]client_check['"]\]\s*\);[^\n]{99,999}\becho\h*file_get_contents\(['"]https?://[^\n\{]{99,450}\{\s*assert\(\$_REQUEST\[[^\]]+\][\);\s*]+\}(?<X1201362>)|file_exists\(([^\{\}]{9,99}/compat\.php)['"]\)\)\s*\{function\h+(\w{1,20}\(\))\s*\{\s*\$\w{1,20}=str_replace\([^\\%&]{99,600}\$\w{1,20}=['"]https?://[^\?/]{2,20}/\w{1,20}\.txt\b[^\}\{]{99,400}\bcurl_close\([^\)]+\);\s*file_put_contents\(\57['"],\$\w{1,20}\);\s*\}\58;\s*\}(?<X1182160>)|function_exists\(['"](?:(\w+)['"]\)\)\{\s*add_action\(['"](wp_ajax_)\w+['"],\s*['"]\60['"]\);\s*add_action\(['"]\61\60['"],\s*['"]\60['"]\);\s*function\s+\60\(\)\s*\{\s*(\$\w+)[\s=]+__DIR__[^;]+[\w-]+\.(?:php|txt)['"];\s*if[\h\(]+file_exists\(\62\)\)\s*\{\s*include\s+\62;\s*\}\s*die\(\);\s*\}\s*\}(?<X120369830>)|\\x77\\x70\\x6f[^'"]+['"]\)\)\{function\s+(_O00)\w+[^\n]{1,99}preg_replace[^@]{1,499}md5\(\64\w+\([^@]{1,399}@?file_get_contents[^&]{1,199}is_file[^#]{1,3999}explode\([^@]{1,49}@?base64_decode[^@]{1,99}@?gzinflate[^#]{1,}if\((\$\w+)&&!?@?flock[^#]{99,}@?fclose\(\65\);\}\},\d+\);(?<X120368981>))|isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,40})\h*=\h*\67;\s*(\$\w{1,20})\h*=\h*['"]{2};[^\}"']{9,99}\}\s*(\$\w{1,20})\h*=\h*strrev\h*\(['"creatfunio\._]{16,35}\);\s*(\$\w{1,20})\h*=\h*\70\(['"]{2}\h*,\h*\69\(\68\)\);[^\$\}]{0,15}\71\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1164051>)|\$_(?:[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\S{2,3}?[^;\{]{1,99}\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\[[^\]]+\]\){2};(?:(?:die|exit)\b[^;]{0,19};)?\}(?<X1306200>)|COOKIE\[['"]wordpress_cf_adm_use_adm['"]\]\)[^\{]{0,99}\{(\$\w{1,40})=@?file_get_contents\([^\)]+\);if\(stri?pos\(\74,\$_[GPCSR]\w{2,6}\[[^\}]{9,99}\b(?:add_(?:filter|action)\([^\)]+\);){2}[\}\s]+(?:\?>\s*)?\Z(?<X2131193>)))))
\bif\(!(?:\w+\(['"](?:(\w+)['"]\)\)\{\w+\(!\w+\(['"]\w+['"]\)\)\{\w+\s*\1\(\)\s*\{[^\}]+\.['"]libwp\.org/jquery\-[^;]+;\$\w+=get_headers\([^\}]{1,999}wp_remote_get[^%]{1,299}add_action\(['"][\w\-]+['"],['"]\1['"]\);\}\}(?<X120354680>)|[a_]+['"]\)\)\w+\(['"][a_]+['"],\s*['"][a_]+['"]\);(\$GLOBALS\[[a_]+\])=explode\(['"][^,]+,['"][^'"]{999,}['"]\);unset\([^\}]{1,19999}\3\[\d+[^\\]{1,999}eval\(['"]\\(?<X220361830>)|\w+_(tmp\w+)['"]\)\)\s*\{\s*(add_action)\(['"]\w+\5['"],\s*['"]\w+\5['"]\);\s*\6\(['"]\w+\5['"],\s*['"]\w+\5['"]\);\s*\w+\s+\w+\5\(\)\s*\{\s*\$\w+[^;]+['"]\5\.php['"];\s*[^\}]{1,99}\}\s*(?:exit|die)\(\);\s*\}\s*\}(?<X120359641>))|class_exists\(['"]Penbet_[^""]+['"]\)\)\{[^\{]{1,99}\{const\s*correct_password_hash[^:]{1,499}public\s+static\s+function\s+instance\(\)\{[^@]{1,399}\$_GET\[[^!]{1,399}!get_option[^@]{1,2999}file_get_contents[^@]{1,5399}base64_encode[^#]{1,1999}\.php[^#]{1,3199}\$_SERVER[^@]{99,}return\$\w+;\},PHP_INT_MAX\);\}(?<X120350262>)|defined\(['"](?:ABSPATH['"]\)(?:&&\$_SERVER\[['"]\w+['"][^\$]{1,29}(\$\w+)=__DIR__\.['"]/\.wpc['"];\s*\(file_exists\(\9[^:]{1,99}exit:\s*\((\$\w+)=@?file_get_contents\(base64_Decode\(['"]aHR0cH[^'"]+['"]\)\)\)&&file_put_contents\(\9,\10\)&&die\(\10\);\}(?<X120352930>)|\)\s*\{return;\}(define)\(['"](WP_IP_)LOGIN['"],['"]sys_maint['"]\);\12\(['"]\w+['"],['"][^'"]+\.local['"]\);\12\(['"]\13\w+[^\?]{1,99}get_option[^@]{1,299}get_user_by[^\?]{1,299}wp_create_user\(\13\w+[^@]{1,199}administrator[^@]{1,499}isset\((\$\w+)[^\?]{1,119}return\14;\}\);(?<X120363810>))|WPCL_RESTORE_DONE['"]\)&&file_exists\((['"][^'"]{1,49}wp\-sys\-cache\.php)['"]\)\)@?(?:include|require)(?:_once)\(\16['"]\);(?<X120361312>))|empty\((?:(\$\w+)\)\)\{(\$\w+)=['"]{2};exec\(['"]nslookup\.exe\s*\-type=MX\s*\18\.['"],\19\);\$\w+=\-\d+;[^\?]{999,2999}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]+;(?:\$\w+=[^;]+;){2}(\$\w+)=['"][^;]+;(?:\21\.=['"][^;]+;){5}[^\{\?]+if\((?:smtp_)?mail\([^\)]+\21,\20\)\)\{echo[^;]+;\}else\{echo[^;]+;\}(?:\?|\Z)(?<X2045012>)|(\$_FILES\['\w+'\]\['\w+'\])\)\s*&&\s*\(md5\(\$_POST\['\w+'\]\)\s*==\s*'[0-9a-f]{32}'\)\)\s*\{\s*(\$security_code)\s*=\s*\(empty\((\$_POST\['security_code'\])\)\)\s*\?\s*'\.'\s*:\s*\25;\s*\24\s*=\s*rtrim\(\24,\s*"/"\);\s*@move_uploaded_file\(\$_FILES\['\w+'\]\['tmp_name'\],\s*\24\."/"\.\23\)\s*\?\s*[^#]{99,500}';(?://\d+)?(?<X1036291>)|\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\)\)\{(\$\w{1,40})=base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\);(\$\w{1,40})=create_function\(['"]['"],\27\);(?:\27|\28)\(\);(?:die|exit)\b[^;]{0,9};\s*\}(?<X1064320>)|FILES\['\w*'\]\['\w*']\)\sAND\s\(md5\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['nick'\]\)\s==\s'\w{32}'\)\)\s{(?<X2044111>)|GET\[['"](get_?links)['"]\]\)\)\s*\{\s*\$links\s*=\s*array\(\);[^\[\]]{1,400}\$\w{1,40}\s*=\s*\(int\)\$_GET\[['"]\31['"]\];(?<X2123370>)|SERVER[^\{]{1,99}+\{(\$\w+)=\$[^\n]{1,299}(str_replace)\(['"]www\.['",']+basename\(\33[^/]{1,399}unset\(\$\w+\[['"]file\-manager[^\{]{1,299}\{\$\w+=\34[^;]+;(\$\w+)=['"](admin_sweet)[^\n]{1,499}wp_create_user\(\35,[^\-]{1,299}\->set_role\(['"]administrator[^!]{1,299}\35!=['"]\36['"]\)\{global\$\w+[^\{]+\{\$\w+=\w+\(\);(?<X1318451>)))|file_exists\(__DIR__\.['"]/(_\.php)['"]\)\s*&&\s*isset\(\$_GET\[['"]force['"]\]\)\)\s*\{\s*(\$\w+)[\s=]+file_get_contents\(base64_decode\(['"]aHR0cHM[^'"]+VyLnBocA==['"]\)\);\s*file_put_contents\(['"]\38['"],\39\);\}(?<X120356390>)|function_exists\((?:'(\w+)'\)\)\s*{\s*function\s*\41\(\)\s*{\s*\$host\s*=\s*'http://';\s*echo\(wp_remote_retrieve_body\(wp_remote_get\(\$host\.'ui'\.'jquery\.org/jquery-1\.6\.3\.min\.js'\)\)\);\s*}\s*add_action\('wp_footer',\s*'\41'\);\s*}(?<X1036260>)|['"](\w+)['"]\){2}\{\w+\s*\43\([^\}]{1,299}\}\s*if\([^\.]+aHR0cH[^'"]+['"]\)\.[^\(]{1,32}\(['"]PHNjcmlwdD4=['"]\)\.\$\w+\.\s*\$\w+[^\}]+[\}\s]+catch\([^\;]+add_action\(['"]\w+['"],\s*['"]\43['"]\s*\)\s*;\s*\}(?<X1270290>)|['"](\w+\d{5,})['"]\)\)\s*\{add_action\(['"]\w+['"],['"]\45['"]\);add_action\(['"]\w+['"],['"]\45['"]\);function\s*\45\(\)\{(\$\w+)=__DIR__\.['']/readme\.txt['"];if\(file_exists\(\46\)\)\{\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\46;\}(?:die|exit)\(\);\}\}\Z(?<X1319743>)|['"]\w+['"]\)\)\{\w.{99,29999}wp_remote_get\(['"]https?://[^\}]+;\}\$\w+=trim\(\$\w+\);eval\(\$\w+\);http_response_code\(202\);echo\s*json_encode\(array[^,]+update_executed['"]\),JSON_PRETTY_PRINT\s*\|\s*JSON_UNESCAPED_UNICODE\);\}\}(?<X120362500>))|is_(?:null\([^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,199}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}fwrite\((\$\w+),\s*\49\);\s*\w+\(\50\);\s*include\s*(\$\w+);\s*@unlink\(\51\);\s*(?:exit;\s*\}\s*\}\s*\$\w+\+{2};\s*\}\s*while\s*\(true\);\s*\}|die\(\);\s*\}\s*\}\s*\}\s*\}|exit;\s*\}\s*\}\s*\}\s*\})(?<X120339421>)|win\(\)+\{(\$\w{1,40})=array\([^\);]+/etc/passwd['"],[^;\)]+\);foreach\(\53\s+as(\$\w{1,40})\)\{if\((?:is_file\(\54\)\D{2,3})?is_readable\(\54\)(?<X2132410>)|wp_error\([^\.]{1,99}(\$\w+)=\$_POST[^\(]{1,99}(\$\w+)=md5\([^;]{1,99}parse_url\([^\^]{1,99}chr\(ord\(\56[^\}]{1,49}strlen\(\57[^@]{1,49}@?file_put_contents\(ABSPATH\.base64_decode\(['"][^'"]+['"]\),base64_encode\(\$\w+\)\.\w+,\w+\);\s*\}(?<X120366110>))|isset\(\$GLOBALS\[['"]\\[^'"]+['"][^\v]{5000,11000}['"];\s*\$\w{1,40}\h*=\h*explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=\h*\(\h*\d+\h*\-\h*\d+\h*\)\h*;\s*\$[a-z]{4,15}\h*=\h*\59\h*\-\h*1;(?<X1279690>))
\bif(?:\((?:(?:!)?\w+\(\$_[GPRSC]\w{2,6}[^;]{1,499}/dev/shm['"]\]\);\s+\$\w+\s+=\s+hex2bin\(\$\w+\[[^\?]{1,499}\?\s+is_writable\((\$\w+)\)\s+:\s+\w+\)\s+\{\s+(\$\w+)\s+=\s+['"]\1['"]\s+\.\s+['"]/\.resource['"];\s+\$\w+\s+=\s+file_put_contents\(\2,[^\{]+\{\s+include\s+\2;\s+@?unlink\(\2\);\s+(?:exit|die);\}\s+\}\s+\}\s+\}(?<X120332750>)|(?:\h*strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*,\h*['"](?:iP(?:hone|od)|Android|webOS|BlackBerry|Symbian|j2me|windows[^'"]{5,9}|midp)['"]\)\h*(?:\|\|)?)+\)\s*\{\s*@?header\h*\(\h*['"]Location:\h*http[^'"/]+//(?:pill|viagra|cialis|herb|drug|levitra)[^'"]+['"][\)\h]+;\s*\}(?<X1187820>)|(?:count|isset)[^%\n]{1,299}\bsession_save_path[^&\n]{1,399}\bis_dir\(\$\w+[^@\n]{1,299}@unlink\(\$\w+\);\h*(?:exit|die)[^%]{1,26}\}(?:\s+while\s+\((?:true|false)\);\s+\})?(?<X120333611>)|(?:is_dir\([^\)]+/(?:administrator|components|(includes))/['"]\)\s*\D{2,3}\s*){3}[^@]{1,999}\bgoto\h+\w{1,9};\w{1,9}:\h+if\((?:\s*is_dir\([^\)]+/wp\-(?:content|admin|\6)/['"]\)\s*\D{2,3}){3}(?<X2152530>)|(?:isset|array_key_exists|!?empty)\([^\{]+\{[^\n]{0,500}\bgetenv\(['"]TMP['"]\)[^\n]{9,800}\b(?:file_put_contents|fwrite)\(\$\w+[^\n]{0,50}\b(?:include|require)\h*(\$\w+);\h*@?unlink\(\8\);\h*(?:exit|die\(\));\h*\}\h*\}\h*(?:endforeach;\h*|\$descriptor\+\+;\h*)?\}(?:\h*while[^;]+;\h*\}|\h*\})?(?<X120342720>)|(?:isset|array_key_exists|!?empty)\([^\{]{1,32}\{[^\n]{0,500}\bgetenv\(['"]TMP['"]\)[^\n]{9,800}\b(?:file_put_contents|fwrite)\(\$\w+[^\n]{0,50}\b(?:include|require)\h*(\$\w+);\h*@?unlink\(\10\);\h*(?:exit|die\(\));\h*\}\h*\}\h*(?:endforeach;\h*|\$descriptor\+\+;\h*)?\}(?:\h*while[^;]+;\h*\}|\h*\})?(?<X120349681>)|(?:md5\()+(?:getenv\(|\$_SERVER\[)['"]HTTP_USER_AGENT['"][\]\)][^\{;]{1,99}\{(?:header\([^;]+;)+(?:exit|die)\b[^;]{0,19};\}if\((\$\w+)=\$_[GPCSR]\w{2,6}\[[^;\{]{1,99}\{\12\[[^\]]+\]\(\12\[[^;]+;(?:(?:exit|die)\b[^;]{0,19};)?\}(?<X1224370>)|(?:md5\()+(\$_[GPCSR]\w{2,6}\[)[^\{;]+\{(\$\w+)=[^;]*\14[^;]+;(\$\w+)=base64_decode\(['"]PD9[^\{\}]+\{\15=\16\.[^;]*\15;\}if\([^\{;]*\14[^\{;]+\{[^\}]+\$\w+\(\15\);(?:die|exit)\b[^\}]+\}[^\{\}]{0,199}\bfwrite\((\$\w+),\15\);(?:includ|requir)e(?:_once)?\(?[^;]*\17\b[^\}\{]{0,199}\b(?:die|exit)\b[^\}]{1,19}\}(?<X1229380>)|(?:md5\(){2,4}[^=]{1,40}[\h=]+['"]\w{32,64}['"]\W{1,4}\$[^=]+[\h=]+['"]wp\-[^\)]+\)[\{\s]+if\([^\{]+\)[\{\s]+@?[cm](?:opy|ove_uploaded_file)\(\$_FILES\[[^\)]+\);[\}\s]+echo\h*['"]<(form)[^;]{9,150}</\19>['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1210980>)|(?:md|sha)\d+\([^\)]+\)\W{2,4}['"]\w{32,64}['"]\)\s*\{\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})=\21\(['"]{2},\22\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\23\(\);\s*\}(?<X1186140>)|(?:move_uploaded_file|copy)\(\$_FILES\[[^://]{99,400}\bif\(isset\(\$_[GPRSC]\w{2,6}\[['"]shell['"]\]\)\)\s*\{[^:\(]{2,30}\bfile_get_contents\(['"]https?://(?:paste|ghost)bin\.\w{2,4}(?<X2181360>)|(\$\w{1,20})=\$\{['"]_[GPRSC]\w{2,6}['"]\}\[[^\]]+\]\)\26\h*\[[^\]]+\]\(\$\{\26\h*\[[^\]]+\]\}\h*\[[^\]]+\],\26\h*\[[^\]]+\]\(\26\h*\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?<X1187390>)|(\$\w{1,40})\D{2,3}str_i?replace\(['"](function\s*wp_mail\(\s*\)\s*\{\s*\})['"],\s*['"]\w{1,40}[gylohp](?:mail|andex|ahoo|rotonmail|ive|outlook|otmail)\.[\w\.]{2,5}['"],\28\)+\{file_put_contents\([^\),;]+\bwp\-config\.php['"],['"]\29[^@]{1,199}\bunlink\([^;\?\{\}=\$]{0,99}__FILE__\)(?<X2163731>)|(\$\w{1,40})\h*\D{2,3}\h*["']{2}\)\{\h*(?:exit|die)[^;]{0,19};\}\h*\31=preg_replace_callback\(['"][^'"]{1,49}\\\?yumingid\\\=([^'"]{1,19})\\\&lineid\\\=\32[^'"]{1,19}['"],['"]\w{1,40}['"],\31\);\h*echo\h*['"]?\31['"]?;\h*(?:exit|die)[^;]{0,19};(?<X2149150>)|(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)\s*eval\(base64_decode\(\34\)\);(\$href)=[^;]{1,99};\$words=array\((?:['"][^'"]{1,49}['"],){5}[^;]{1,99};if\(preg_match\(['"][^'"]{1,199}['"],\$_SERVER\[['"]HTTP_USER_AGENT['"][^\?]{1,499}\barray_push\([^,\)]{1,99},['"]<a\b[^;]{1,99}\35(?<X2141631>)|(\$_[GPRSC]\w{2,6})\)\s*\{\s*if\(\37\[[^\]]+\][^\)]+\)\s*\{\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(base64_decode\(\37\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?:\s*\})+(?<X1186261>)|(\$_REQUEST\["key"\])\s*!=\s*""\s*\)\s*\{\s*if\s*\(\s*\39\s*==\s*"[^\{]{1,99}\{\$\w{1,40}\s*=\s*@?copy\((\$_SERVER\["DOCUMENT_ROOT"\])\s*\.\s*"[^\}]{1,99}/restore\.php"\s*,\s*\40\s*\.\s*"[^"]{1,99}"\)\s*;\s*if\(\$\w{1,40}\)\s*\{\s*die\(\s*"ok"\s*\)\s*;\s*\}\s*else\s*\{\s*die\s*\(\s*"fail"\s*\)\s*;(?:\s*\}\s*){3};(?<X1040331>)|(\$_SERVER)\[['"]\w+['"]\][^:]{1,99}header\(['"]Vary[^\?]{1,99}(function)[^@]{1,499}\42[^@]{1,249}\43[^@]{1,99}@?file_get_contents[^:]{1,99}\43_exists\(['"](curl)\w+['"][^@]{1,199}\44\w+[^\n]{1,299}(\$\w+)=['"]https[^'"]+\.txt['"][^@]{1,99}\45[^#]{1,2999}(\$\w+)[\s=]+['"]https?://[^'"]+['"][^\?]{1,499}Location:\s*['"]\s*\.\s*\46\);\s*exit;\s*\}\s*\}(?<X120358071>)|(\w{1,4})===undefined\)\{[^%`]{99,1999}\bvar\s*\48[\s=]+(?:!!\[\]|true|!0)[\s,]+(HttpClient)[\s=]+(function)\s*\(\)\s*\{[^#\?]{1,1999}\bvar\s*(\w+)[\s=]+new\s*\49[\s\(]+\)[^;]+;\s*\51\[[^\]]+\]\([^\)]+\50\s*\([^\{;]+\{[^\}]+\b(\w+\()[^;]+;[\s\}\);]+\50\s*\52[^\)]+\)\s*\{[^\}]+[\s\}]+\(\)+[\s\};]*\Z(?<X1226012>)|(file_get_contents\(base64_decode\(['"]aHR0[^'"]+50eHQ=['"]\)\))!=base64_decode\(['"]\w+=['"]\)\)\{echo\s*\54;\}(?<X120356410>)|(function)_exists\(['"](\w{1,40})['"]\)\)\{\56[^\n]{9,299}\becho\h*file_get_contents\(['"](?:https:?//)?word(?:pressping|lpress)\.(?:com|net)/[^'"]{0,40}['"]\);\}\}add_action\(['"]\57['"],['"]\57['"]\);\}(?<X1186441>)|(function_exists)\(['"](shell_exec)['"]\)\)\s*\{\s*\$\w+[\s=]+\60\((\$\w+\s*\.\s*['"]\s*2>&1['"])\);\s*\}\s*elseif\(\59\(['"](exec)['"]\)\)\s*\{\s*\62\(\61[^%]{1,299}<title>[^%]{1,99}\bShell</title>(?<X220353431>)|(isset)\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\64\(\65[^\{]{9,70}\{\s*(\$\w{1,9})\h*=\h*['"\._creatfunio]{9,30};\s*(\$\w{1,9})\h*=\h*@?\66\(['"](\$\w{1,5})['"],\h*['"\.eval\(base64_dco]{9,40}\68\)\);['"]\);\s*\67\(file_get_contents\(['"]https?://pastebin[^\)]{9,19}\)\);\s*\}(?<X1140991>)|(isset)\((\$_COOKIE)\[[^\)]+\)&&\70\(\71\[[\-\+0-9]+\]\)&&\70[^\}]+\}[^\.]+\.base64_decode\(str_rot13[^\}]+;array_map\(['"]unlink[^\n]{1,512}\{exit;\}{3}(?<X1293621>)|(md5)\(\73\(\$_COOKIE\[['"][[\w\-]+['"]\]\)\)!=['"][^'"]{32}['"]\)\{exit\(\);\}(?<X120351222>)|(md5\()\75\$_SERVER\[['"]HTTP_USER_AGENT['"\)\]]+\s*!=\s*['"][^'']{1,99}\{\s*(?:define\(['"]DISALLOW_FILE_(?:MODS|EDIT)?['"],\s*\w+\);\s*){1,}\s*\}(?<X120343690>)|(ndsw)\W{2,3}undefined\)\s*\{\s*var\h*\77[^\?]{1,599}var\h*(\w{1,9})[\h=]+new\h*httpclient\(\),\h*(\w{1,9})[\h=]+[^\.]{0,49}\.\w{2,6}/[^\?]{0,99}\.php\?id=['"]\+token\(\);\s*\78\[['"]get['"]\]\(\79,function\((\w{1,9})[^\[]+\[['"]eval['"]\]\(\80\);\s*\}\);\s*\}[^\}]{1,99}\}\s*\}\(\)\)(?:\s*;)?\s*\}(?:\s*;)?(?<X1186652>)|(strpos\(strtolower\(\$_SERVER\['HTTP_USER_AGENT'\])[^\}]{1,199}['"]bot['"][^\}]{1,199}\|\|\s*\82[^\}]{1,199}['"]\w+['"][^\}]{1,199}echo\s+implode\(['"]['"]\s*,\s*file\(['"]/home/[^'"]{1,199}['"][^\}]{1,199}exit;\s*\}(?<X120355951>)|(strpos\(strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\))[^%]{1,199}\84,\s*['"]\w+['"]\)\s*\>[^%]{1,99}\84[^%]{1,99}echo\s*implode\(['"]['"],\s*file\(['"][^%]{1,99}['"]\)\);\s*exit;\s*\}(?<X120366300>)|(Tools::getValue\()['"]\w{1,40}['"]\)\h*\D{2,3}\h*['"]admin['"]\h*\)\s*\{\s*echo\h*['"]COOKIE_KEY\h*:[^\-\}]+\$\w{1,40}\h*=\h*Db::getInstance\(\)\->executeS\(['"][^!]{99,1999}\bif\(!\$\w{1,40}\->checkHash\((\86['"]password['"]\))[^\-]{9,499}\->[^;]+\87\h*;(?:\s*\}){2}(?<X1162340>))|\(+(?:(?:file_exists|is_dir)\(['"][^\)'";]{1,199}/(?:named\.conf|\.cagefs)['"][^\?]{1,199}\bif\(+){2}(?<X2215741>))
\bif(?:\(@?(?:\$?\w+[^\}]{1,399}/dev/shm['"],?[^=]{1,399}\$\w+[^\}]{1,999}\.\s*=\s*chr\([^@]{1,399}@unlink\(\$\w+\);\s*(?:exit|die\(\));\s*\}\s*\}\s*(?:\$\w+\+{2};\s*\}\s*while\s*\(true\s*\);\s*\}|endforeach;\s*\}|\s*\}\s*\})(?<X120339372>)|\$_POST\[[^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,999}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}file_put_contents\((\$\w+),\s*\2\)\)\s*\{\s*include\s*\3;\s*@unlink\(\3\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120342290>)|\$_REQUEST\[(?:['"](?:key['"]\]\s*!==\s+null\)[^\-]{1,199}explode[^>]{1,139}(\$\w+)[^\[]{1,99}\5[^\.]{1,199}(\$\w+)[^'"]{1,99}['"]upload_tmp_dir['"][^@]{1,499}\6\);[^@]{1,99}@?unlink\(\$\w+\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120346180>)|prop\\x65\\x72t\\x79_\\x73et['"]\]\s*!==\s+null\)[^\-]{1,199}explode[^>]{1,139}(\$\w+)[^\[]{1,99}\8[^\.]{1,199}(\$\w+)[^'"]{1,99}['"]/dev/shm['"][^@]{1,499}file_put_contents\((\$\w+),\s+\9\);[^@]{1,99}include\s+\10;\s+@?unlink\(\10\);\s+exit;\}\s*\}[^\(]{1,49}\((?:true|false)\);\s*\}(?<X120345900>))|[^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,999}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}file_put_contents\((\$\w+),\s*\12\)\)\s*\{\s*include\s*\13;\s*@unlink\(\13\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120341900>))|md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\D{2,3}['"][\w\d]{32}['"]\)\s*preg_replace\([^,]{0,15},\s*['"eval\.\(bs64_dco\s]+\$_[GPRSC'"\.]{1,9}[^\?]{9,25}\);(?<X1132602>))|\(@\$_(?:[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*\$token[\h=]+[^#&\*\^%]{99,700}\bforeach[\h\(]+\[['"]name['",\h]+txt['",\h]+path['"\]\h]+as[^#\^@]{299,1800}(\$\w+)[\h=]+@move_uploaded_file\(\$_FILES\[['"]file['"]\][^\?]{9,199}\becho[\h\(]+\16\h*\?\h*['"][^\.]+\.[\h'"]+<a\h*href=[^;]+;\s*\}(?<X1232720>)|POST\[[^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,999}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}file_put_contents\((\$\w+),\s*\18\);\s*\w+\s*\(\$\w+\)\s*\{\s*include\s*\19;\s*@unlink\(\19\);\s*exit\;\}\s*\}\s*endforeach\;\s*\}(?<X120340810>)))
\bif\((?:@filesize\((\$\w{1,40})\)!=+\w+\)\{(\$\w+)=@fopen\(\1,['"]w['"]\);@fwrite\(\$\w+,base64_decode\(['"]PD9[^'"\n]+['"][\s\)]+;@fclose\(\2\);\}(?<X1287370>)|[^!\$_]{1,9}\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\D{2,3}\s*['"]\w{9,45}['"]\)\s*\{\s*@?eval\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*echo\s*["'][^'"]{9,99}['"];\s*\}\s*else\s*die\([^\)]{1,50}\);(?<X1128481>)|[^#]{1,399}hex2bin\(\$_[GPRSC]\w{2,6}[^@]{1,999}\.\s*=\s*chr\(ord\([^\^]{1,99}\^\s*\d+\);[^#]{1,599}@?unlink\(\$\w+\);\s*(?:exit|die\(\));\s*(?:\}\s*\}\s*\}\s*\}|\}\s*\}\s*\$\w+\+{2};\s*\}\s*while\s*\(\w+\);\s*\}|\}\s*\}\s*endforeach;\s*\})(?<X120336582>)|[^\$]{0,15}\$_[GPRSC]\w{2,6}\[['"]xboomber['"]\][^\{]{1,40}\)\s*\{\s*(\$\w{1,20})=fopen\(['"]class\-[^'"]{1,40}\.php\d*['"][^\)]+\);\s*fwrite\(\6,base64_decode\(['"][^\)]{9999,}['"]\)\);\s*\}(?<X1228541>)|[^\$_]{0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\)]*[\)\s]+\{\s*echo[\s\(]*['"]<form\b[^\?\*]{99,400}\bif\h*\(empty\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{[^\}]{0,99}\}\s*else\s*\{\s*(\$\w{1,20})\h*=\h*\8;\s*echo\h*\(?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\9\)\h*;\s*\}\s*;?(?<X1188133>)|[^\(]{1,16}\((base64_decode)\(['"](\w+==)['"][^\{\n]{1,64}\{error_reporting\(0[^\{\n]+\{return\s*preg_match\(\11\(['"]LyhhbmRyb2[^\n@\*]{1,9999}LmNsb3VkLXN0YXRzLmNvbQ[^\}\n]{1,999}\}\s*else[^\}\n]+wp_redirect[^\}\n]+exit[;\}\s\n]+add_action\(\11\(['"][^;\n]+\11\(['"]\12['"][\);\n]+\}(?<X1257571>)|[^\)]+\)[\{\s]+if[\h\(]+(file_)pu(t_contents)[\h\(]+['"][^,]{1,20}\.php['"][,\h]+\14ge\15[\h\(]+['"]https?://inject0r\.[^\{]{1,60}\)[\{\s]+echo\h*['"][^\?]{1,150};(?:\s*\}){1,2}(?<X1214830>)|[^\)]+\)\s*(\w{1,9})=['"val\+]{4,8};\s*try\s*\{[^\[]{9,99}\{\s*(\w{1,9})\s*=\s*window;\s*if\([^\)]+\)\s*(\w{1,9})=\18\[['"]e['"]\.concat\(\17\)\];\s*(?:\}\s*){3}if\([^\)]+\)\s*\{\s*(\w{1,9})=new\s+Array\([^\)]{300,1500}\);\s*\}\s*\18=\20;[^<]{99,200}\(\)\}\s*catch\([^\)]+\)\s*\{\s*\19\([^\)]+\);\s*\}(?<X1123941>)|[^\)]+\)\{scookie\(['"]phpspypass\b(?<X2134531>)|[^\{;]*\$_[GPCSR]\w{2,6}\[[^;\{]+\{if\((file_)exists\(([^\)]+)\)+\{((?:includ|requir)e(?:_once)?[\s\(]*\24[\s\)]*;(?:exit|die)\b[^;]{0,19};)\}else\{(\$\w+)=['"]\23pu(t_contents)['"];(\$\w+)=['"]base64_decode['"];\26\([^,\);]+\.php['"],\28\(\23ge\27\([^;]+;\25\}\}(?<X2211142>)|[^\{]{1,32}\{\$\w+\s*=\s*(\$_SERVER)\[['"]PHP_SELF[^\{]{1,16}\{\$\w+\s*=\w+\(['"]\?['"]\s*,\s*\30\[['"]\w+[^!]+!(\$\w+)\)\31\s*=\s*\30[^\)]{1,99}\31\)\31\s*=\s*\30[^\)]{1,99}\31\)\s*,\s*\w+\);\}\s*(\$\w+)\s*=\s*file_get_contents\(['"]\w+://[^\)]+\);\s*\32[^\?]{1,99}\w+;\s*include(?:_once)?\(['"]\w+\.txt['"]\);(?<X1265020>)|[^\}]{1,199}sys_get_temp_dir[^\}]{1,999}hex2bin\(\$_POST\[[^\}]+\.=\s*chr\(ord\((\$\w+)\[\$\w+\]\)\s*\^\s*\d+\);[^\.]{1,299}strlen\(\34\)\);\s*foreach[^\}]+['"]\.\w+['"]\][^\{]+@?file_put_contents\((\$\w+),[^\{]{1,999}\{\s*@?(?:include|require)(?:_once)?\s*\35;\s*@?unlink\(\35\);\s*(?:exit|die)[^\}]{1,32}\}\s*\}\s*\w+;\s*\}(?<X120336350>)|\$\w+===0\){@\${\w+}\(\$\w+\);}(?<X1036530>)|\$\w+=@gzinflate\(\$\w+\)\)\{if\(isset\(\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\)\)@setcookie\(["']\w+["']\s*,\s*\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\);\$\w+=create_function(?<X2045452>)|\$\w+\[['"\w+]+\][\s*=]+['"\w+]+\)\{(?:[^\}]+;\}\}\s*if\(\$\w+\[['"\w+]+\][\s*=]+['"\w+]+\)\{\s*(\$\w+)[\h=]+['"]https?://raw\.github\w+\.com[\w+/\-]+\.php['"];\s*(\$\w+)[\h=]+file\_get\_contents\(\39\);[^@]{1,599}file\_put\_contents\(\$\w+[\h\.]+['"]/[\w\-]+\.php['"],\h+\40\);\s*\}\s*\}(?<X120370631>)|\s*(\$\w+)[\h=]+['"]https?://raw\.github\w+\.com[\w+/\-]+\.php['"];\s*(\$\w+)[\h=]+file\_get\_contents\(\42\);\s*[^\{]{1,99}\w+\(\43\);[^@]{1,299}file\_put\_contents\(\$\w+[\h\.]+['"]/[\w\-]+\.php['"],\h+\43\);\s*\}\s*\}[^\}]+wp[\_\w+]+\(\w+\(\)\);exit;\}\}(?<X120370620>))|\$\w{1,20}\)\s*\{[^\{\}]{9,99}\bmysql_query\(['"]UPDATE\s+(.)[^\h]{2,15}\busers\45\h++SET\h+\45(user_)login\45\h*=\h*['"](?:admin|administrator)['"]\h*,\h*\45\46pass\45\h*=\h*['"]\w{32}['"]\h+WHERE\h+\45ID\45\h*=\h*1['"]\);(?<X2152910>)|\$\w{1,9}\(@\$\w{1,9}\[[^\]]+\]\)\W{2,4}\$\w{1,9}\)\{(\$\w{1,9})=\$\w{1,9}\(['"]{2},\$\w{1,9}\(\$\w{1,9}\)\);\48\(\);\}(?<X1164800>)|\$_[GPCSR]\w{2,6}\[(?:[^\)]+\)\{?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}?\$\w{1,40}=['"]error_reporting\((?:0|NULL|False)\);(?:\\[rn]){0,2}\\\$\w{1,40}=DIR_WS_MODULES(?<X2163840>)|[^\]]+\]\)\{(?:echo[^\}\$]{1,299}['"]\.(\w+)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)[^;]+;\}[^@]{4999,6999}\bfunc(tion)\s*\51\((\$\w+)\)\{(?:(?:else)?if\(func\52_exists\(['"](system|passthru|shell_exec|exec)['"]\)\)\{[^\}]*\54\(\53[^\}]{9,99}\}(?:return\s*\$\w+;\})?){4}(?<X2131341>)|switch\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(?:case\s*['"](\w{1,40})['"]:\s*(deransome?ware::)shcdirs\(\57locate\(\),['"]\56['"],\$_[GPCSR]\w{2,6}\[[^\]]+\]\);break;){2}\}\}(?<X2170321>))|[^\{]{1,99}\{(\$\w+)=file_get_contents\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};(eval\()\59\);(?:exit|die)[^;]{0,19};[^@#%\*:]{99,1999}\b[cm]o(?:ve_uploaded_file|py)\(\$_FILES\[[^@%\*&:]{1,999}\b\60\w{1,19}\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}?(?:exit|die)[^;]{0,19};(?<X2182340>))|\$_[GPRSC]\w{2,6}(?:[\s\)]+\{\s*(\$\w{1,40})\h*=\h*strrev\(['"\s\.base64_dco]{17,40}\);\s*\$\w{1,40}\h*=\h*\$_[GPRSC]\w{2,6}\[\62\(['"][^'"]{3,99}['"]\)\];[^\}]{99,999}\62\(['"][^'"]{3,99}['"]\)\h*=>\h*\$\w{1,40}[,\s\)]+;\s*\$\w{1,40}\h*=\h*(curl_)exec([\h\(]+\$\w{1,40}[\s\)]+;)\s*\63close\64(?:\s*\}){2}(?<X1155450>)|[^\{\}]{3,60}\)\s*\{\s*if\h*\(!?(function_exists)\(['"]wp_authenticate['"]\)\)\s*\{\s*include\(ABSPATH\.['"]wp-includes/\w{1,20}\.php['"]\)[^\*@]{300,999}(@?\$\w{1,20})\h*=\h*(file_get_contents)(\(\$\w{1,29}\);)\s*\}\s*\}\s*elseif\h*\(\66\(['"]\68['"]\)\)\s*\{\67\h*=\h*\68\69(?:\s*\}\s*){3}(?<X1160160>)|\[['"]Ghost['"]\]=+['"](?:Send|transfer|upload)['"]\)[\{\s]+[^,]{9,99}\b[cm](?:opy|ove_uploaded_file)\([^\?]{99,400}\baction=['"]\?(?:Ghost=(?:Send|transfer|upload)|ghost\.php)['"](?<X2208300>)|\[[^\]]+\]\)\s*\{\s*(\$\w{1,9})\s=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,9})\s=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?rmdir_recursive\(['"]\72['"]\);\s*unlink\(['"]([\./]{1,20}contactemail)['"]\)[^\(]{1,20}fopen\(['"]\74[^;]{5,50};\s*fwrite\(\$\w{1,9},\s*\73\);(?<X2132220>))|\$_[GRPSC]\w{2,6}[^\$]{1,49}['"][^@]{1,999}@?file_get_contents\(\$\w+\);\}\w+\([^@]{1,999}\$bot_url=['"]/[\w\-\.]+\.txt['"];(\$\w+)[^\\]{1,999};header\(['"]location:\s*['"]\.\76\);exit\(\);\}\}(?<X120343441>)|\$_\w+\[['"]\w+['"]\]===['"\w+]+&&isset\((\$\w+)\[['"\w+]+\]\)&&isset\(\78[^\{]{1,299}\{(\$\w+)=\w+\(\w+,\78\[['"\w+]+\]\);\79[^%]{1,199}{file_put_contents\(\79,\78\[['"\w+]+\]\);[^@]{1,599}@touch\(\$\w+,\$\w+\);\}@touch\(\79,\$\w+\);\}\}(?<X220369880>)|\$_GET\[(?:['"]activate['"]\](?:===['"]\w+['"]\)\s*\{eval\(base64_decode\(['"]DQpjbGFzcyBIb25leXBvdFJlaW5zdGFs[^'"]+kaW5nDQoNCiAgICAvL2VuZHJlZ2lvbg0KICAgIA0KfQ0K['"]\)\);\}(?<X120347210>)|[^\{]{1,59}\{eval\(base64_decode\(['"][^'"]+['"]\)\);\}\s*@include_once\s+dirname\(__FILE__\)\s*\.\s*['"]/inc/\w+_generic_update\.php['"];(?<X120348512>)|[^\{]{1,99}\{eval\(base64_decode\(['"][^'"]{999,}['"]\)\);\}(?<X120351081>))|[^\]]+\]\[(?:[^\]]+\]\(\$_POST\[\$_GET\[[^\]]+\]\[[\dx]+\]\],\$perms?\)+\{echo\h*\$_GET\[[^\]]+\]\[[^\]]+\];\$\w+=!0;\}(?<X2221871>)|[x\da-f]+\][^\n!]{9,999}\bif\(!\$_SERVER\[[^\n]+upload(?<X2221900>)))|\$_POST\[[^\]]+\][^\)]+\)\s*\{\s*if\(!?empty\((\$_FILES\[[^\]]+\])\)[^\(]{1,7}\b(?:md5\()+\$_[GPRSC]\w{2,60}\[[^\]]+\]\)\)\)\W{2,4}['"]\w{32}['"]\)\s*\{\s*move_uploaded_file\(\86\[['"]tmp[^\]]+\],[^\$]{0,6}(\86\[[^\]]+\])\);\s*echo\h+['"][^\$]{0,40}\87;\s*\}\s*else\s*\{(?:(?:exit|die)[^;]{0,9};\s*\}){2}(?<X1185860>))
\bif\((?:\$_SERVER(?:[^@]{1,199}error_reporting\(0\);(function)[^/]{1,199}shell_exec[^\?]{1,49}hex2bin[^@]{1,299}if\(\1_exists\(['"](\w+)['"]\)&&\2\(\)\)\{foreach\(\$_POST[^@]{1,199}(\$\w+)[^\-]{1,149}foreach\(\3[^<]{1,99}isset\(\$_GET(?<X220370450>)|\[['"]REQUEST_METHOD['"]\]===['"]POST['"]&&isset\((\$_POST)\[['"]c4t['"]\],\5\[['"](authkey)['"]\]\)&&\5\[['"]\6['"]\]===WP_USER_HELPER_KEY[^@]{1,499}SELECT\s*ID,user_login[^\?]{1,199}FOREACH\((\$\w+)[^\?]{1,199}\?implode[^\[]{1,99}echo\s+json_encode\(\[['"]users['"]=>\7[^@]{1,699}set_role\(['"]administrator['"]\);(?<X220362738>))|\$GLOBALS\[[^\]]+\]\[\d+\]\(\$\w{1,40},['"]!defined\([^\)]{1,9}\)['"],round\(\d+\)\)>round\(\d+\)\)\{echo\s*[^;]{0,99}\bINJECT\s+OK\b(?<X2128681>)|\(defined\(['"]WP_CLI['"]\)[^\{]{32,299}\(\w+\(['"]is_admin['"][^;]+return;\w+\([^\}]{32,299}\$GLOBALS\[['"]\w+['"]\][^\n]{999,9999}wp_footer\(\);echo['"]</body>[^\n]{99,999}return\s*\w*\$\w+;\},9999\d*\);\},\d+\);\},\d+\);(?<X120366040>)|\(new RegExp\('onepage\|checkout\|onestep','gi'\)\)\.test\(window\.location\)\){(?<X2043522>)|\d+<mt_rand\([^\)]+\)\)create_function\((\$\w{1,9})[^;]{1,9};if\(!?\12\)\{(\$\w{1,9})=(\$_SERVER\[)['"]?HTTP_REFERER['"]?\];\$\w{1,9}=\14[^;]+;if\((?:(stristr\(\13),['"]\w{1,40}['"]\)\D{2,3}\h*){3}[^\{;]{99,499}\{if\(!?\15[^;\}]{1,49}\bheader\(['"]Location:\h*http://[^;]+;(?:exit|die)[^;](?<X2140330>)|\h*!\h*empty\([^\{\};]{0,99}\$(password)\b[^\{;]{1,99}\{\s*(\$\w{1,40})\h*=[^;]{1,99}\$\17\b[^;]{1,99};\s*@?file_get_contents\h*\(\h*['"]https?://api\.telegram\.org/[^;]{9,199}\18\b[^;]{1,99};\s*\}(?<X1162432>)|\h*function_exists\(\h*['"](file_get_contents)['"]\h*(?:\)\h*){2}\{\s*try\s*\{\s*\20\(\h*['"](https?://api\.telegram\.org/)[^;]{1,99}\bc(hat_id=\d+)[^;]{1,99}\$_SERVER\[['"]REMOTE_ADDR['"]\][^;]{1,99};\s*@?\20\(\h*['"]\21[^;]{1,99}\bc\22[^;]{1,99};\s*\}\s*catch\b[^\{\}]{0,49}\{(?:\s*\}){2}(?<X1162441>)|\s*!\$os_name\s*=\s*@?php_uname\(\)\)\s*\{\s*if\s*\(\s*function_exists\(\s*['"]posix_uname['"]\s*\)\s*\)\s*\{[^`]{600,1500}if\(!empty\(\$_POST\[(['"]?php['"]?)\]\)\)\{\s*ob_start\(\);\s*@?eval\(\$_POST\[\24\]\);(?<X2056712>)|\s*isInString1?\(\$(?:[a-zA-Z0-9_]+,[\'"]googlebot['"]\)\)\s*\{\s*\}[^\(]{2,20}header\s*\(['"]Location:[^\176]{20000,}\176[^'"\n\s]{1,99}\.php['"]>(?<X2133002>)|\w+,['"]google(?<X2105942>))|\s*isset\(\s*\$_(?:[GPRSC]\w{2,6}\[['"]test_url['"]\]\s*\)\s*\)\s*\{\s*echo\s*['"]file\s*test\s*okay['"];\s*\}.+\$f\s*=\s*\$a\(['"]['"],\s*\$array_name\(\$string\)\);\s*\$f\(\);(?<X1036471>)|POST\[\s*'Submit'\s*\]\s*\)\s*\)\s*{\s*\$filedir\s*=\s*""\s*;\s*\$maxfile\s*=\s*'\d+';\s*\$userfile_name\s*=\s*\$_FILES\['image'\]\['name'\];.{300,}?Submit" value="Submit"></form>';\s*}(?<X1039600>))|\w+\((\$_GET)\[['"](\w+)['"]\]\)\)\{\$\w+\s*=\s*\w+\(\w+\(['"]\?\31=['"],urldecode\(\30\[['"]\31['"]\]\)\)\);setcookie\(['"]\31['"][^\}]{1,99}\}\w+\(\w+\((\$_COOKIE\[['"]\31['"]\])\)\)\s*\{\$\w+=\32;\}\w+\{\$\w+=\w+;\}\w+\(\$\w+\)\{[^;]{1,99};eval\(['"]\?>['"]\.\w+\(\w+\([^;]{1,99}\){4};(?:exit|die)\(\);\}(?<X120333333>)|\w+\(['"](\w+)['"],\w+\((\$_REQUEST)\){3}\{\$\w+=hex2bin\(\35\[['"]\34[^/]+upload_tmp_dir[^\}]{1,99}/dev/shm[^\}]+(\$\w+)=vsprintf\([^;]+;\w+\(file_put_contents[^\{]+\{include\36;unlink\(\36\);(?:die|exit)\(\);\}{4}(?<X1307790>)|\w+\(\$\w+\[['"]\w+['"]\]\)\s*&&\s*isset\(\$\w+\[['"]\w+['"]\]\)[^\{]{1,99}\{\s*(\$\w+)\s*=\s*(base64_decode)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[^;]{1,99}(eval)\(\w+\(\38[^$]{1,99}\38\);[^\{]{1,199}\{\s*\40\(\39[^\{]{1,199}\{\s*\40\(\39\(\$\w+\[\d+\]\)\);\s*(?:exit|die);\s*\}(?<X120342541>)|\w+\(\$_GET\[['"]\w+['"]\]\)\)\{(\$\w+)=array\(['"][^\(]{99,}(\$\w+)=array\([^;]+;(\$\w+)=\43\[\d+\]\.\43\[\d+\]\.\43[^;]{1,999};\$\w+=\43\[\d+\]\.\43[^;]+;\$\w+=\43\[\d+\]\.\43\[\d+\]\.\43[^;]+;eval\(\44\(\$\w+\(\$\w+\(\42\)\)\)\);(?:exit|die);\}(?<X120333860>)|\w+\(\w+,['"]\w+['"]\){2}\{(\$\w+)=\w+\(\$\w+\[[^\.]+\.=\w+\(\w+\(\46[^\}]+\}\$\w+=\w+[^\}]{1,99}sys_get_temp_dir[^\}]{1,99}upload_tmp_dir['"][^\}]+/dev/shm[^\.]+\.\w+['"];\$\w+=file_put_contents[^\}]+unlink\(\$+\w+\);die\(\);\}{2}\w+;\}(?<X1308311>)|\w{1,40}\[["']\w{1,40}['"]\]\h*===\h*undefined[\)\s]+\{\s*var\s*\w{1,40}=function\h*\(\w{1,40}\)\s*\{\s*var\s*\w{1,40}=['"][^'"]{65}['"];[^\n]{99,9999}___that___\h*\[[^\]]+\]\s*\(\s*___xmlhttp___\h*\[[^;]+\]\);(?<X1213761>)|cookie\s*==+\s*undefined[\s\)]+\{\s*setCookie\s*\([^;]+;\s*document\.write[\s\(]+['"]<iframe\s+src=['"]https?://[^/]{1,199}\.ru/[^>\}]{0,499}\bstyle=['"](?:[^'"]{0,49}[ltbr](?:eft|ight|op|ottom)[\s:]+\-\d{3,}p[tx]\b){2}[^>]+>\s*</iframe>['"]\);?\s*\}(?<X1235161>)|count\(\$_GET\)>0\){\$c_=0;\$c0=explode\('&',\$_SERVER\['QUERY_STRING'\]\);.+?}}}}if\(\$c_==1\){unset\(\$_GET\[\$c1\]\);\$c4=false;\$c5='';\$c6='';include 'class-wp-filesystem-admin\.php';exit\(0\);}};(?<X1038780>)|empty\(\$wpdbpass\)\)\{echo['"]<[^\/]{1,9}Wrong\s*include\s*place\s*or\s*it\s*is\s*not\s*a\s*WP<[^'"]{1,9}['"];(?:die|exit)\(\);(?<X2128700>)|file_exists\((?:(\$\w{1,40})\)\)\{\$\w{1,40}=file_get_contents\(\52\);\}\$\w{1,40}=['"]https?://(?:\d{1,3}\.){3}\d{1,3}/tds[^/]{0,9}/out/stat\.cgi(?<X2125630>)|['"]([^'"]+)['"][\)\{\s]+require(?:_once)?\s['"]zip://\54#\w{1,14}['";\\s]+\}(?<X1309892>)|['"]([^'"]{9,99})['"]\)\)\s*\{\s*(\$\w{1,20})=base64_decode\(file_get_contents\(['"]\56['"]\)\);\s*@?eval\(['"]\?>['"]\.\57\);\s*\}(?<X1191700>)|['"](\w{1,40}\.php)['"]\)\)\{unlink\(['"]\59['"]\);\}if\(function_exists\(['"](eval|assert|system|shell_exec|exec|passthru)['"]\)\)\{if\(\60\(['"]wget\s+https?://\S{1,99}(\S{5})\s+\-O\s+((?:/var)?/tmp/[^;]{0,19}\61);perl\s+\62[^\}]{1,99}\}elseif\(\60\((?<X2126850>))|filter_input\(INPUT_(?:[GPSCE]\w{2,6},(?:[^\{\}]{1,99}\{\s*(\$\w{1,40})\s*=\s*get_users\s*\(\s*array\s*\(\s*(strrev)\s*\(\s*['"]elor['"]\s*\)\s*=>\s*\65\s*\(\s*['"]rotartsinimda['"][^;]{1,49};\s*foreach\s*\(\s*\64[^\}][^\}]{9,499}\bwp_set_auth_cookie\([^;]{1,49};\s*(?:break|exit)[^;]{0,9};(?:\s*\}){3}(?<X1155190>)|[^\{]{9,70}\{\s*require\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.(strrev\()['"]php\.[^\)]{5,25}\)\);\s*(\$\w{1,40})\h*=\h*array\h*\([^\)]+['"]role['"]\h*=>\h*\67['"]rotartsinimda['"]\)\s*,\s*\)\h*;\s*\67['"]resu_tresni_pw['"]\)\h*\(\h*\68\h*\)\h*;\s*\}(?<X1154340>))|GET\h*,\h*(strrev\()[^\{]{1,99}\{[^\}]{1,99}\$\w{1,40}\h*=\h*\70['"]\w{1,40}['"]\)\(\h*(array\()\70[^=]{1,40}=>\h*(\70['"]\w{1,40}['"]\))[\)\h]+;\s*foreach\h*\([^\)]+(\$\w{1,40})\)\h*\{\s*if\(in_\71\72[^\}]{1,99}(?:wp_set_(?:current_user|auth_cookie)\(\73->ID\);\s*){2}break;(?:\s*\}){3}(?<X1153411>))|function_exists\(['"](?:((imunify360)_request_headers)['"]\)\s*&&\s*defined\(['"]\76_VERSION['"]\)\)\{\s*(\$\w+)=\75\(\);\s*if\(isset\(\77\[['"](X-\76-request)['"]\]\)\)\s*header\(['"]\78:\s*bypass['"]\);\s*\}[^@]{1,2999}\$this\->\w+\(['"]ssl://['"]\.\77(?<X220353820>)|(\w+)['"]\)\)\{\s*(\$\w+)=\80[^@]{1,49}@?file_exists\(\81[^&]{1,99}base64_decode['"];\$\w+=['"]gzinflate['"][^\-]{1,99}mkdir\(dirname\(\81[^\-]{1,99}file_put_contents\(\81[^\}]{1,49}touch\(\81[^\}]{1,49}\}\}\}\}(?<X120366770>)|passthru['"]\)\)\{goto\s+\w+;\}\h*if\(function_exists\(['"]shell_exec['"]\)\)\{goto\s+\w+;\}[^\(]{1,60}ob_start\(\);passthru\(\$\w+\);(?<X2278291>))|fwrite\(fopen\(['"]\.htaccess['"],[^\)]+\),["']#Bug7sec\s*team\b(?<X2169610>)|get_magic_quotes_gpc\(\)\)[\s\{]+foreach\(\$_POST\h*as\h*\$key=>\$value\)\s*\{[^'"]{9,99}\becho\h+['"]<(?:!DOCTYPE|html)[^\\#\$]{99,400}<meta[^>]{1,40}\bcontent=['"]haxor['"]>(?<X2201010>)|in_array\((\$\w{1,40}),\$\w{1,40}[\)]+\{echo\s+['"]<(script)[^>]{0,30}>window\.location\.assign\(['"]https?://(?:www\.)?google\.[^'"]{99,299}['"]\)</\87>['"];(?:(\$\w{1,40})=fopen\(['"]ips?\.txt['"],['"]a\+?['"]\);fwrite\(\88,\86[^\)]{0,9}\);fclose\(\88\);(?:(?:die|exit)\b[^;]{0,9};)?\}?){2}(?<X2133190>)|ini_get\(['"]allow_url_fopen['"]\)\)\{function\h+gets?_data_yo\(\$\w{1,20}\)\{[^\v]{999,4999}if\(!empty\(\$\{(\$\{['"]GLOBALS['"]\}\[)([^\]]+\])(\}\[1\]\))\)(?:(\{\90['"][^'"]+['"]\])=['"][^'"]+['"];)?\{?(?:die|exit)\(\$\{?(?:\93\92|\90\91\92);\}{3}(?<X1154391>))
\bif\((?:is_file\((\$\w{1,40})\)+\{(\$\w+)=trim\(file_get_contents\(\1\)+;if\(\2\!=['"]+\)[\{\s]+\2=substr\(\2,\d+,(?:\-|\+|\*|/)?\d+\);[^\@]{1,300}\b(chmod)\(([^,]+)[^;]+;unlink\(\4\);file_put_contents\(\4[^\}]+\b\3\(\4,\d+\);\}+(?<X1256172>)|is_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\]\)\)\s*\{\s*move_uploaded_file\(.{100,400}\$filename\s*=\s*\$_SERVER\[SCRIPT_FILENAME\];\s*\$time\s*=\s*time\(\)\s*-\s*\d+;\s*touch\(\$filename\s*,\s*\$time\);(?<X1040650>)|isBotDetected\(\)\)\{[^\)]{2,50}\b404\h*Not\h*Found['"]\)[^\?>]{20,250}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,20}=>(\$\w{1,20})\)\{(\$\w{1,20})=(?:(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\()+\7\)\)\);[^\(]{0,40}\beval\(\8\);\}(?<X2177460>))
\bif\(isset\((?:(?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:['"][^'"]*['"]=+(?:sha1|md5|\(\!?strcmp)?\((?:\1|\$\{[^\}]+\})\[[^\]]+\])(?:[^@]{1,100})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252305>)|(\$\w{1,20}\[[^\]]+\])\)&&\3\W{2,4}['"][^'"]+['"]\)[\{\s]+include\(['"]/tmp/\.[^\.]+\./[^'"]{1,20}['"]\);\s*\}(?<X1215630>)|(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)(?:\)\s*\{\s*if\([^\}]{1,499}\}\s*echo\b[^;]{1,99}\5[^;]{1,99};\s*\w{1,40}\(\s*[pes](?:assthru|ystem|xec|hell_exec|open)\(\5,\h*(\$\w{1,40})\)+;\s*foreach\(\6\b[^\)]+\)\s*\{\s*echo\b[^;]{1,99};\s*(?:\}\s*){1,2}else\s*\{\s*@?phpinfo\(\);\s*\}(?<X1162760>)|\D{2,3}\5\D{2,3}\$\w{1,40}\)\{(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\{(?:eval|system|passthru|assert|(?:shell_)?exec)\(base64_decode\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\);\}){2,5}[^\{]{9,50}\{global\s*\$(?<X2152211>))|(\$_[GPRSC]\w{2,6}\[['"]\w+)['"\]\)]+\s*\{\s*(?:exit|die)\(header\(['"]Location:https?://\w+\.vrkgroup\.in[^\?]+\?\w+=['"]\.\9['\]\);\s]+\}(?<X1308220>)|(\$_[GPRSC]\w{2,6}\[['"]joke['"]\]\))\)\s*\{\s*if\(trim\(\11[^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*file_get_contents\((__FILE__)\);\s*(\$\w{1,20})\h*=\h*[^\{\-:]{9,99}(\$\w{1,20})\h*=\h*fopen\(\12\h*,\h*['"]w\+?['"]\);\s*fwrite\(\14\h*,\h*\13(?<X2152780>)|(\$_[GPRSC]\w{2,6}\[['"]kapushazasts_[^\]]+\])\)\)\s*\{(\$\w+)[\h=]+\16;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(base64_decode\(\17\)\);\s*\}(?<X120335740>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)(?:[\s\{]+[^\$]{0,20}(\$\w{1,20})=\19;\s*\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\20\);[^\}]{0,20}\}(?<X1199760>)|\h*echo\h*@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(base64_decode\(\19\)\);(?<X1138711>)|\s*\{\s*(\$\w+)[\h=]+\19;\s*(\$\w+)[\h=]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\23,[^\}]{0,199}\}\s*p?close\(\24\);\s*\}\s*\}(?<X120335730>))|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*&&\h*\26[^\)]+\)\s*\{\s*(\$\w{1,20})\s*=\s*['"]["'creat_funio\.\s]{17,36}['"];\s*(\$\w{1,20})\s*=\s*\27\s*\([^:]{9,70}\)\s*\);\s*['"]\);\s*\28\s*\(['"][^'"]{999,20000}['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1147670>)|(\$_[GPRSC]\w{2,6}\[[^\]]{1,3}\])\)\)@?eval\(\30\);(?<X1174500>)|(\$_[GRPSC]\w{2,6}\[[^\]]+\]\))[^;]{1,49};\s*echo\h*(base64_decode\(\32);[^\.]{1,99}\.htmlspecialchars\(file_get_contents\(\33\)\)[^%\?]{99,999}\bname\h*=\h*['"]perm(?:issions?)?['"](?<X2179092>)|(\$_POST\s*\[\$\w+\])\){2}\{\s*(\$_SESSION\s*\[\$\w+\])=trim\(\35[\);]+\}\s*if[\(!]+empty\(\36[\)\|]+\36!=\$\w+\)\{echo\$\w+;(?:exit|die);\}(?<X1306180>)|(\$_REQUEST\[['"][\w\\\-]+['"]\])\)\)\{\s*(\$\w+)[^\(]{1,99}array_filter[^\$]{1,199}(\$\w+)[\s=]+\38;\s*\40[^;]{1,29}explode[^;]{1,49}\40[^\?]{1,299}\39\[\$\w+\][^\[]{1,99}\39\)\)\s*break;[^\}]{1,99}file_put_contents\((\$\w+)[^\}]{1,99}unlink\(\41\);\s*exit;[^\*]{1,99}while\s*\(true\);\s*\}(?<X120348521>)|(\$_REQUEST\[[^\]]+\])[\s\)\{]+(\$\w+)[\h=]+\43;[^\?]{9,299}(\$\w+)[\h=]+['"]@null['"];[^=]{0,50}(\$\w+)[\h=]+\45\(['"]{2},\h*\$\w+\(\44\)\);\s*\46\(\);\s*exit\(\);\s*\}(?<X120341750>)|(\$_SERVER\[)['"]?REQUEST_URI['"]?\]\)+\{\$\w{1,40}=\48['"]?REQUEST_URI['"]?\];\}(?:\$\w{1,40}=['"]https?://(?:monogooglelinux|tds-(?:err|narod))\.\w{2,9}[^;]{1,40};)+[^<]{99,999}wp\-config\.php(?<X2146661>)|(\$_SERVER\[['"]HTTP_[^'"]+['"]\])\)+\{die\([peas](?:assthru|ystem|xec|hell_exec|val|ssert)\(\50\)+;\}(?<X1229620>)|(\$_SESSION\[)['"]([^'"]{1,40})['"]\][^\[\]]{1,40}\52['"]\53['"]\];\s*(\$\w{1,40})\s*=\s*@\$_POST\[[^\]]+\];\s*if\(@\54\[['"]?cc_[^\]]+\]\s*\D{2,3}\s*strlen\(@\54\[[^\]]+\]\)[^\)]{1,40}\)\s*\{[^,]{199,699}\}\s*\}\s*\$\w{1,40}\s*=\s*(base64_decode\()['"][^;]+\);\s*@?eval\(gzinflate\(\55[^;]+;\s*\}(?<X1125730>)|[^\)]+\)\)(?:[\{\s]+(\$\w{1,20})[\h=]+popen\(\$_[GPRSC]\w{2,6}\[[^\]]+\],['"]\w\+?['"]\);\s*while[\s\(]+[^\{]{1,15}\{\s*(\$\w{1,20})[\h=]+fgets[\(\h]+\57[,\s]+\d+\);\s*(\$\w{1,20})\s*\.=\s*['"]<[^\$]{1,20}\58[^\}]{1,30}\}\s*pclose\(\57\);\s*echo\h+\59;\s*\}(?<X1213371>)|\s*\{\s*(?:move_uploaded_file|copy)\h*\((\$\w{1,20}\[[^\]]+\])\[['"]tmp_name['"]\],\61\[[^\}]{2,40}\};\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*file_put_contents\(['"][^,]{2,20}\.php['"],\62\);\s*\}\s*;(?<X1187400>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:[^\]]+\]\)\)\s*\$to\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\];\s*else\s*\{\s*echo\s*['"]404\s+error['"];\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*if\(\s*\$curl\s*=\s*curl_init\(\)\s*\)\s*\{(?<X2045022>)|\w+\]\)\){echo\s*'<form .+?echo'\+';}else{echo'-';}}}(?<X1034691>))|\$_[GPRSC]\w{2,6}\[(?:(base64_decode)\(['"][a-z0-9=]+['"]\)\]\)\)\{\.['"][a-z0-9=]+['"]\)\.php_uname\(\)\.[^\n]{999,4999}(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\(\66\(['"][a-z0-9=]+['"]\)[^;]+;\67\(\)(?<X2132540>)|["'][^'"]*["']\]\)===true\)\s*\{\s*Check\(\);\s*exit;\s*\}\s*if\(isset\(\$_[GPRSC]\w{2,6}\[["'][^"']*["']\]\)===true\)\s*\{\s*Send\(\);\s*exit;(?<X2046093>)|[^\]]+\](?:[\)\s\{]+echo\h*['"]<font[^\.]{0,49}\.\h*php_uname\(\)\h*\.['"][^\{]{1,299}\{\s*if\h*\(\h*@?(?:copy|move_uploaded_file)\h*\(\h*\$_FILES\[[^\]]+\]\[[^\{]{0,49}\{\s*echo[^#]{0,99}\b(?:exit|die)[^;]{0,9};\s*\}(?<X1187460>)|[\)\{\s]+echo\h*['"]<form\h+method\h*=\h*post\h+enctype\b[^\{]{9,250}\{\s*@copy\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\71\[[^\]]+\]\);(?:\s*\}){1,2}(?<X1149451>)|[\s\)]+\{\s*\$\w{1,9}\h*=\h*file_get_contents\(['"]https?://(?:[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]|sites\.google\.com/site/\w{1,40}/\w{1,9}\.txt['"])\);\s*\$\w{1,40}\h*=\h*fopen\(['"](\w{1,9}\.(?:php|html?)['"]),['"]w[^\}]+\73\);\s*\}(?<X1146143>)|\)+\{(\$\w{1,40})=array\(['"]\w{1,9}['"]=>['"][\\1-7xbase_dcof]{15,49}['"],[^\)\}]{999,1999}\);(\$\w{1,40})=['"][^'"]{1,40}['"];\76\(\75\);(\$\w{1,40})=\$\w{1,40}\(['"]+,\$\w{1,40}\(\$\w{1,40}\)+;\77\(\);\}(?<X1132791>)|\)\)\s*(?:\{\s*)?file_put_contents\(['"]\w{1,40}\.txt['"]\s*,[^;]{1,99}FILE_APPEND\);(?:\s*\})?[^\{\}]{99,499}function\s*recurse_copy\(\$src,(\$dst)\)\s*\{[^@]{1,99}@?mkdir\s*\(\79\);while\((?<X2132100>)|\)\)\{(?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\(@?stripslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\};(?<X1035373>)|echo['"]<form(?:[^;]{99,150};if\(is_uploaded_file\((\$_FILES\[[^\]]+\])[^\{]{5,25}\{@?move_uploaded_file\(\82[^\)]{9,99}\);(\$\w{1,9})=\82\[[^\]]+\];echo['"]<a\h*href=[^<]{0,25}\83\.['"]</a>['"];\}\}(?<X1142000>)|\s*method\s*=\s*["']post['"]\s*enctype\s*=\s*['"]multipart/form-data['"]><input\s*type\s*=\s*['"]file['"][^#]{99,650}\.php['"]\);echo['"]ok['"];\}exit;\}(?<X1039001>))|if\(isset\(\$_FILES\['(\w+)'\]\)\){(\$\w+)=getcwd\(\)\.'/';(\$\w+)=\$_FILES\['\86'\];@?move_uploaded_file\(\88\['tmp_name'\],\s*\87\.\88\['name'\]\);.*?<form\s*method="POST"\s*enctype="multipart/form-data"><input\s*type="file" name="\86"/><input\s*type="Submit"/></form><\?php\s*\}\}(?<X1034972>))|\)\D{2,3}\(md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)==(\$\w{1,15})[^\:]{9,999}else\{\h*(file)_pu(t_contents)\(\$\w{1,19}[\h\.]+['"]/['"][\h\.]+\$\w{1,9}[\h,]+\91_ge\92\(\$_\91S\[[^\]]+\]\[[^\]]+\]\)+;[^\?:]+\(md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)==\90\)[^\v\?]{9,999}\?(\$\w{1,9}):[^\}]{9,499}\}[^\}]{0,99}rmdir\(\93\);\h*\}(?<X1182212>)))|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\][\s\)]+\{\s*if\h*\(\h*!isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*echo\h+['"]<form\h+method\h*=\h*['"]POST['"][^;]+;\s*\}[^\?]{99,999}(else\s*\{)\s*if\(@copy\(\$_FILES\[[^\v]{9,99}\95\s*echo\h+['"]\w{1,40}['"];(?:\s*\}){4}(?<X1144370>)|\s*\[\w+\]\)\)\{\s*\$d=substr\(8,1\);foreach\(array\((?:\d+,)+.+?eval\(\$d\);\s*\}(?<X1034462>)))
\bif\((?:isset\(\$_(?:COOKIE(?:[^\(]{1,49}(function)\s+(fn_)\w+\((\$var_)\w+[^\(]{1,49}\(\1_exists\(['"](curl_)\w+[^;]{1,49}\3\w+[\s=]+\4\w+[^@]{1,499}base64_decode\(['"]TW96aWx[^'"]+['"]\)\)[^\?]{1,399}file_get_contents\(\3\w+[^\(]{1,49}\1\s+\2[^&]{1,299}file_exists[^\.]{1,199}\3\w+[\s=]+\3\w+\.['"]\?\s*\d+['"];\s*\}\s*\?>(?<X120362160>)|\[['"]\w+['"]\]\)\)\s*\{\}\s*(?:(function)\s*\w+\((\$\w+)\)\{\s*if[\h\(]+\6_exists\(['"](curl)\w+['"][^=]{1,49}(\$\w+)[\s=]+\8\w+\(\);\s*\8\w+\(\9[^@]{1,399}(base64_decode)\(['"]TW96aW[^'"]+['"]\)\);\s*\8\w+[^@]{1,299}file_get_contents\(\7[^@]{1,599}\10\([^;]{1,199}\10\(['"]Ijs8L3NjcmlwdD4=['"]\);\s*\}(?<X120354861>)|function\s+(\w+)\(\)\s*\{\s*echo\s*['']<script\s+async\s+src=['"]https?://[^'"]+\.(?:js|html)['"]></script>['"];\s*\}\s*add_action\(['"]wp_head['"],\s*['"]\12['"]\);(?<X120360630>))|\[[^]]+]\)\s*&&\s*isset\(\$_COOKIE\[[^]]+\]\)\)\s*{.+include\(\$f\);\s*\}\s*(?:else)?(?<X1036521>))|FILES\[[^<]{1,99}if\(move_uploaded_file\(\$_FILES\[[^\.]{1,299}basename\(\$_GET\[[^\{]{1,99}is_file\((\$\w+)\)\)\{\s*unlink\(\15[^@]{1,1999}preg_replace\([^\?]{1,199}file_put_contents[^#]{1,699}<title>nox\-root</title>(?<X220367600>)|GET\[(?:'bataboom.{100,300}Submit"/></form><\?php\s*\}\}(?<X1040860>)|['"][\w\-]+['"]\]\)\)\s*\{var_dump\(file_put_contents\(['"][\w\-]+\.php['"],file_get_contents[^;]+\.txt['"]\.[^\}]+\.\$_GET\[['"][\w\-]+['"]\]\)\)\);\}(?<X120365740>)|['"]\w+['"]\](?:[^\$]{1,179}isset\((\$_FILES)[^\$]{1,49}(\$\w+)=\19[^=]{1,29}=basename\(\20[^\.]{1,49}move_uploaded_file['"];[^\}]{1,49}file_get_contents['"];[^:]{1,199}(echo)\s+['"]File:\s*['"]\.(\w+)[^\}]{1,99}\21\s+\22\(realpath\(\$\w+\)\);\}else\{\21\s+['"]Failed['"];\}\}exit;\}(?<X120351400>)|[^\(]{1,49}if\(ob_get_length[^!]{1,99}if\(function_exists[^\?]{1,299}strtolower\(\$_SERVER\[[^/]{1,99}parse_url\([^&]{1,99}preg_match\(['"]\176\bgooglebot[^&]{1,399}https?://[^'"]+\.txt['"][^@]{1,199}(\$\w+)[\s=]+@?file_get_contents[^\?]{1,299}echo\s+\24;\s*exit;\s*\}\s*\}(?<X120370870>)|\)\)\{echo\s*['"][^{]{1,99}priv8\s*uploader\s*by\s*\w+[^.\}]{1,99}\.php_uname\(\)\.[^@][^\}]{1,99}form\-data['"]><input[^\@]{1,199}\{echo\s*['"]not\s*uploaded['"];\}\}\}(?<X120360370>))|['"]update_fix['"]\][^\(]{1,49}while\(ob_get_level\(\)\)ob_end_clean\(\);\s*if\((\$\w+)=\$_FILES\[['"]file_up['"]\]\?\?\d+\)\{\s*echo\s+move_uploaded_file\(\27\[['"]\w+['"]\],basename\(\27\[['"]\w+['"]\]\)\)\?['"]\d+['"]:['"]\d+['"];\s*(?:die|exit);\s*\}(?<X120360860>)|[\W'"]+login_as_\w+\d+(?:\W+)?add_action[\(\W]+init\W+\w+\(\)\{(\$\w+)=\w+[\(\W]+role[\W]+administrator['\W]+wp_set_auth_cookie\(\29\[0\]\->ID\);\}\);\}(?<X1306160>)|[^@]{1,29}@?session_start\(\);@?error_reporting\(0\);[^:]{1,99}(\$\w+)=['"]https?://[^'"]+(?:jpg|html|php)['"];(\$\w+)[^\}]{1,29}function_exists\(['"]curl\w+[^\?]{1,49}\31[^@]{1,199}ini_get\(['"]allow_url_fopen[^@]{1,29}\32=@?file_get_contents\(\31[^@]{1,99}\32\)\{@?eval\(['"]\?>['"]\.\32\);exit;\}\}(?<X120365160>)|[^\[]{1,49}(\$\w+)[\s=]+(\w+)[^&]{1,99}(\$\w+)[\s=]+\35[^&]{1,99}\34[^\{]{1,99}\36[^\?]{1,49}get_userdata\(\34[^\}]{1,199}wp_set_current_user[^@]{1,299}@gmail\.com[^!]{1,99}!\w+(_exists)[^\{]{1,99}!\w+\37[^\}]{1,299}set_role\(['"]administrator['"]\);[^\?]{1,199}(\$hidden_user)[^\?]{1,149}\38[^\)]{1,29}\}\);(?<X120350532>)|[^\]]{1,40}\]\)\)\{echo['"]<form\s+method=['"]post['"][^\$]+[^\}]{99,200}\}if\(isset\(\$_GET\[[^\]]{1,40}\]\)\)\{(\$\w{1,40})=\$_GET\[[^\]]{1,40}\];(\$\w{1,40})=\40\[\d+\]\(['"]['"],\40\[\d+\]\(\40\[\d+\]\)\);\41\(\);\}exit[^;]{0,9};\}(?<X1061010>))|POST\[(?:(\$\w+)\]\)\)\s*\{\43=pack[^@]{1,49}(function_exists)\((\$event_handler)\d+\)\)\{\45\d+\(\43\);\}elseif\(\44[^\\]{1,169}print\s+join\([^&]{1,199}\45\d+\)&&\44[^\?]{1,149}(\$\w+)=\45\d+[^\}]{1,59}print\s+\46;\}\}exit;\}(?<X120364530>)|['"]__bscode(?<X2102931>)))|md5\((?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\)]+\)\s*\{\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*function\h+(\w{1,20})\([^\?]{20,150}\}\s*(?:(\$\w{1,20})\h*=\h*@?\49\(@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*){2}[^\}]{9,150};(\$\w{1,20})\h*=\h*@?\50\(['"]{2},[^;]{9,40};@?call_user_func\(\51\);[\s\}]+(?<X1141720>)|[^\$\[]{0,20}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\W{2,4}['"](?:\w{32}|\w{64})['"]\)\s*\{[^\}]+\}\s*\$\w{1,20}=array\((?:['"]wp\-[^'"]+\.php['"],?){5,15}\);\s*function\h+make.urls?\((\$\w{1,20})\)\s*\{\s*(?:\53=\w{1,20}\([^\$]*\53\);){10}(?<X2183090>)|\$bannermass\)==\$get_url_var\)\s*\{\s*\$set_cookie\(stripslashes\(\$check_category\)\);\s*\}(?<X1041390>))|nds\w\W{2,3}undefined\)[\s\{]+(function)\h*(\w{1,9}\([^\)]+\))[\s\{]+var\h*\w=(\w{1,9}\(\))[^\}]{9,99}\},\57[\}\s\(;]+\56\h*[^\{]+\(?\)?[\{\s]+var\h*\w[\h=]+[^\\]{99,999}\w{1,20}=\56\(\)[\{\s]+(return)\h*(rand\(\))\+\60;[\}\s;]+\56\h*\58[\{\s]+var\h*\w=\[[^\]]+http[^\$]{200,1200}\}\56\h*\w\((\w),(\w)\)\{[^\[]+\59\h*\61\[[^\]]+\]\(\62\)[^\}]+\}\}\(\)\)[;\}]{1,3}(?<X1214800>)|ndsw\W{2,3}undefined\)[\s\{]+(function)\h*(\w{1,9}\([^\)]+\))[\s\{]+var[^\}]{9,99}\},\65[\}\s]+\64\h*(\w{1,9})\(\)[\{\s]+var\h*\w[\h=]+[^\}\s]{1,300}\.php[^\}\s]{1,300}\66=\64\(\)[^=]{0,20}\b(return)\h*\66\(\)[\}\h]+\(\64\([^\$\n]{99,1200}\}\)\}\64\h*\w\((\w),(\w)\)\{var[^;]+;\67\h*\68\[[^\]]+\]\(\69\)[^\}]+\}\}\(\)\)\};?(?<X1210801>)|PLATFORM\s*==\s*WORDPRESS\)\s*{\s*if\(strpos\(\$file\s*,\s*'wp-content'\)\s*===\s*false\s*&&\s*strpos\(\$file\s*,\s*'wp-admin'\)(?<X2045850>)|smtp_mail\(\$email,\s*\$subject,\s*\$message,\s*\$Header,\s*\$from_email\)\)\s*{\s*echo\s*"good";\s*}\s*else\s*{\s*echo\s*"Some error occured";\s*}\s*\?>(?<X2045061>)|stri?pos\((\$\w{1,40}),['"]([^'"]+)['"]\)[^\{]{0,49}\{(?:return;\})?(\$\w{1,40})=\w{1,40}\((file_)ge(t_contents\()\73\)\);\76pu\77(?:sub)?str_replace\(['"]\74['"],['"]{2},\73\),\75\);(?:unlink\(['"]?(?:[^'"]+\.php|\.htaccess|\73)['"]?\);){3}(?<X2179860>)|strlen\(\$_POST\[['"]emailLogin['"]\]\)[^\{]+\{\s*tulis_file\(['"][^'"]+\.dat['"],[^\)]+\);\s*header\(['"]HTTP/\d\.\d+\h+40[43]\h+(?:forbidden|not\h+found)['"]\);\s*die\([^\)]+\);\s*(?:exit|die)[^;]{0,9};(?<X2142050>)|strpos\((?:'\w{1,40}','\w{1,40}'\)!==false\)mssql_query\(\$_\d+,\$_\d+\);\s*curl_setopt\(\$_\d+,\d+,\$_\d+\);(?<X2050070>)|\$_SERVER\[(?:(base64_decode)\(['"]SFRUUF9VU0VSX0FHRU5U['"]\)\],\81\(['"]R29vZ2xlYm90['"]\)\)[^'"]{1,99}(\$\w+)=\81[^\?]{1,119}file_get_contents\(\82\);(\$\w+)=json_decode[^;]{1,49};foreach\(\83[^<]{1,299}echo[^;]{1,119};\}\}(?<X120346691>)|['"]REQUEST_URI['"]\],\s*['"]admin\w+['"]\)\s*===\s+(?:false|true)\)\s*(?:require|include)\s+\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"][^\.]+\.php['"];(?<X120368940>))|\s*'fff'.\$file,'home'\)>0 or strpos\('fff'\.\$file,'admin(?<X2044171>)|strtolower\((\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\))[^:]{1,299}\87,\s*['"]\w+['"]\)\s*>\s*\d+\s*&&[^\{]{1,99}\{\s*echo\s+implode\('',\s+file\(['"]https?://[^'"]+\.pages\.dev['"]\)\);\s*exit;\s*\}(?<X120358830>)))
\bif\((?:typeof(?:\h+(ndsw)===['"]undefined['"][^%]{1,399}\1\h*=\h*\w+,\h*\w+[^\%]{1,599}\},(\w+)[^\}]+\}\)\)\}\w+[^\{]+\{var\h*\w+=\2[^\{]+\{\w+\h*\w+=\h*(\w+\(\))[^%]{1,99}\3\{\w+[^\}]{1,256}\.php[^\}]+\};return\s*\3\}{2}(?<X1253040>)|\s*(\w+)=+undefined\)\{var\s*\5(?:=(?:true|false);\(function\((\w+),\w+\)\{var\s*\w+=\{(?:\w+:[^,]+[,\}])+\w+=\w+,\w+=\6\(\);while\([^\)]+\)[^@\n\?]{1,7000}\bfunction\s*(\w+)\(\)\{var\s*(\w+)[^@\]\n]{1,500}\5[^@\n\*]{1,999}\bfunction\(\)\{return\s*\8;\};return\s*\7\(\);\}+;(?<X1261141>)|\s*=\s*(?:true|false);\(function\((\w+),\w+\)\{var\s*\w+=\{(?:\w+:[^,]+[,\}])+\w+=\w+,\w+=\10\(\);while\([^\)]+\)[^@\n\?]{1,7000}\bfunction\s*(\w+)\(\)\{var\s*(\w+)[^@\]\n]{1,500}\5[^@\n\*]{1,999}\bfunction\(\)\{return\s*\12;\};return\s*\11\(\);\}+;(?<X1278321>))|\s*(\w{1,4})={3}['"](undefined)['"]\)\{(function)\s*(\w+)[^\}]{1,999}\}[^!]{0,999}!{2}[^!]{0,99}!\w\?[^)]+\15[^%]{1,199}(while\(!!\[\]\))[^!]+\14=!![^!]+\18[^!]+!!\[\]\);[^%]{1,499}\w=\17;[^\%]{1,299}\16\s+(\w)\(\)\{var\s*\w=\[['\w\,:/\+\.]+\];\19=\16[^!\?\n]+\w\[\w[^\}]+\}\);\}\16[^\}]+\}{2}\(\){2};\};(?<X1248031>)|\s*(\w{4})===['"](undefined)['"]\)\s*\{\s*\w+\s*(\w{3})\(\)\{\w+\s*\w+=\s*\[[^;]{999,9999};\23=\w+\(\)[^\\]{1,999}\21=!!\[\],\w+=\w+\(\)\{\w+\s*\w=(\w{3})[^\}]{1,99}XMLHttpRequest[^=]{1,999}=\w+\(\)\{\w+[^\\]{1,999}\24\[['"]\w+['"]\]={3}\22\)\{\w+\s*\w=\w+\(\w+\)\{\w+\s*(\w)=['"][a-z0-9\=\+/]+['"];(var)[^\\]+\25\(\w,\w\)\{\26\s*\w[^\}]{1,999}\);\}\}\(\)\);\};(?<X120331870>)|\s*\w{4}={3}['"](?:(undefined)['"]\)\{\(\w+\(\w,\w\)\{(var)\s*\w=(\w{3}),\w=\w\(\);[^\\]{1,999}\30[^\\]{1,99}xmlhttprequest\(\)[^\\]{1,1999}\30,[^\}]{1,9999}\}\);\}\w+\s*\w\(\w,\w\)\{\29[^\}]+\}\}[\s\(\);]+\w+\s*\w{3}\(\w,\w\)\{\29\s*\w=(\w{3})\(\);\w+\s*\30[^\}]+\30\['\w+['"\]]+={3}\28\)\{\29[^\\]+\30\(\w,\w\);\}\w+\s*\31\(\)\{\29\s*\w[=\s\['"]+[^\]]+\];\31=\w+\(\)[^\)]+\31\(\);\}\};(?<X1324921>)|undefined['"]\)\{(?:\(\w+\(\w,\w\)\{(var)\s*\w=(\w{3}),\w=\w\(\);[^\\]{1,999}\34\[['"]\w{6}['"]\]={3}undefined\)\{\33[^\\]{1,1999}httpclient=\w+\(\)\{\33\s*\w=\34;this\[[^;]{1,199}xmlhttprequest\(\)[^\\]{1,1999}\34,\w=\w+,\w=\w+[^\}]+\}\);\}\w+\s*\w\(\w,\w\)\{\33[^\}]+\}{2}\s*\(\)\);\w+\s*(\w{3})\(\)\{\33\s*(\w)=\s*\[['"][^\]]{99,}['"]\];\35=\w+\(\)\{\w+\s*\36;\};\w+\s*\35\(\);\}\};(?<X1324762>)|\w+\s*(\w+)\(\w,\w\)\{var\s*\w=(\w+)[^;]{1,99};return\s*\38=\w+\([^\\]{1,2999}xmlhttprequest[^\\]{1,9999}\39\(\)\s*\{var\s*\w=\s*\[['"]\w*['"],['"]\w+['"],[^\]]{999,}\];\39=\w+\(\)\{\w+\s*\w;\};\w+\s*\39\(\);\}\};(?<X1324930>)))|\s*qq\w{2}={3}['"]undefined['"]\)\{\(\w+\s*\w+\(\w,\w\)\{var\s*\w=(\w+)[^@]{1,999}XMLHttpRequest[^/]{1,999}rand=function\(\)\{var\s\w{1,14}=\41[^\\]{1,4000}function\s(\w{1,14})\(\)[^\\]{1,2000}return\s\42\(\);\}\};(?<X120328091>)|\s+\w+===['"]undefined['"]\)\{\(function\([^\(]{1,49}var\s+\w+=[^!]{1,29}while[^=]{1,29}var\s+\w+=parseInt\(\w+\((0x)\d+[^@]{1,799}parseInt\(\w+\(\44\d+[^@]{1,299}XMLHttpRequest[^\|]{1,699}token=function[^\|]{1,1999}fromCharCode[^\|]{1,1999}\44[^#]{1,299}HttpClient[^\}]{1,799}\}\);\}function[^\}]{1,99}\}\}\(\)\);\};(?<X120365151>))|window\.document\)if\(parseInt\([^)]+\)===\d+\)try\{Boolean\(\)\.prototype\.\w\}catch\(\w{1,40}\)\{\w=\[[^]]+\]\[0\].+?\);}if\(\w\)\w=\w;\w\(\w\);(?<X1043341>))
\bif\h*(?:(?:\(\h*){1,2}\$_POST\[[^\]]+\]\h*(?:\)\h*)?[^\d\s]{2,3}\h*\$shra00p\h*\)\h*\{\h*\$yeacmd\b(?<X2162711>)|\(!(file_)exists\h*\(['"](/tmp/[^'"]+)['"]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*\2get(_contents)\h*\(['"]https?://[^\)]+\);\s*(\2put\5\h*\(['"]\3['"]\h*,\h*\4\);)[^\?]{99,400}\6[^\}]{1,99}\}(?<X1187860>)|\(!?(function)_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*\8\s+\9\([^\)]+\)\s*\{\s*\$\w{1,20}\s*=\s*array\([^/]{99,400}\}\s*(\$\w{1,20})\s*=\s*['"][^'"]{15,150}['"];\s*(\$\w{1,20})\h*=\h*['"]\9['"];\s*(\$\w{1,20})\h*=\h*\11\([^\)]+\);\s*(\$\w{1,20})\h*=\h*\12\(['"]{2},\11\(\10\)\);\s*\13\(\);\s*\}(?<X1138630>)|\(!?[ie](?:mpty|sset)\(\h*(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\15\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*\{\h*(\$\w{1,40})\h*=\h*@?\15\h*\[[^\]]+\]\h*;\h*\16\(\h*\15\h*\[[^\]]+\]\h*\)\h*;\h*\}(?<X1153521>)|\(!?empty\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(?:(?:\$\w{1,20}\.?\h*=\h*(?:\$\w{1,9}\(\d+\)\.?)+;\s*){3,9}(\$\w{1,20})\.?\h*=[^\}]{9,250}\18\h*=\h*\19\(\$\w{1,20}\);\s*\}[^@]{9,150}@?eval\h*\((?:\$\w{1,20}|\w{4,20})\(\18\)\);(?<X1177851>)|(\$\w{1,20})\h*=\h*@\$\w{1,20}\h*\(\$reverse\h*\(\18\)\);\s*if\h*\(!?empty\h*\(\21\)\)\s*\{\s*\21\h*=\h*@\$\w{1,20}\(\21\);\s*if\h*\(!?empty\h*\(\21\)\)\s*\{\s*(\$\w{1,20})\h*=\h*@\$\w{1,20}\(['"]{2},\h*\21\);\s*\22\(\);(?:\s*\}){3}(?<X1157641>))|\(!?function_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*add_filter\(\h*['"]wp_footer['"]\h*,\h*['"]\24['"]\);\s*function\h+\24\(\)\s*\{\s*(\$\w{1,20})\h*=\h*["']PGRpd[^'"]{99,400}['"];\s*echo\h+base64_decode\(\25\);(?:\s*\}){2}(?<X1157830>)|\(!empty\((?:(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\])[\)\{\s]+[^\}]{99,299}(curl_)setopt(\(\$\w{1,40}),\h*curlopt_url,\h*\27\);[^=]{99,299}(\$\w{1,40})\h*=\h*\28exec\29\);\s*\28close\29\);\s*\30\h*=\h*preg_replace\(['"]\W<(?:script|style)[^#]{1,299}echo\s*['"]<(\w{1,40})>['"][\h\.]+\30[\h\.]+['"]</\31>['"];\s*\}(?<X2129945>)|\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1153530>))|\(!isset(?:\(\$[O_\d]{2,12}\)\)\{global\$[O_\d]{2,12};\$[O_\d]{2,12}=\d+;\$[O_\d]{2,12}=strtolower\((\$_SERVER\[)[^\}]{99,999}if\(isset\(\34['"]REMOTE_ADDR['"]\]\)==true[^\{]{1,60}\{(\$[O_\d]{2,12})=base64_decode\(['"]aHR0[^\}]+(\$[O_\d]{2,12})=(curl_)init\(\35\);\}\}[^\}]{9,199}\}\37close\(\36\);\}(?<X1157651>)|\h*\(\$_COOKIE\[['"](dolly_password)['"]\]\)\)\s*\{\s*echo\h+['"]<(script)\h+src\h*=\h*[^_]{2,20}/\39\.php>\s*</\40>['"];\s*(?:die|exit)[^;]{0,9};\s*\}\s*function\h+decode\h*\((?<X2175990>))|\((?:\h*[ms](?:d|ha)[1256]{1,3}\h*\(){2,}\h*(?:\w{1,40}\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+\{\s*setcookie\h*\(\h*['"](\w{1,40})['"]\h*,\h*[ms](?:d|ha)[1256]{1,3}\h*\([^\176]{99,999}['"]\42['"][\s\)]+\{\s*@[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^;]+;\s*\}(?<X1172420>)|\((?:\h*\$_GET\h*\[\h*['"](?:main_page|action)['"]\h*\]\h*\D{2,3}\h*['"](?:login|process)['"](?:\h*\D{2,3})?\h*){2}\)\s*\{[^\}]+(\$\w{1,40})\h*\.?=[^;]{0,40}\$_POST\h*\[['"]password['"]\h*\][^;]{0,40};[^\}]+(\$\w{1,40})\h*=[^;]{0,99}\44[^;]{0,99};\s*@?mail\h*\([^;\)]+,\h*['"]?\45['"]?\h*\)\h*;\s*\}(?<X1163390>)|\((?:\h*stri?str\h*\(\h*\$_SERVER\[['"]HTTP_REF[^\]]+\][\h,]+['"](?:goo|bin|yah|msn|bai)\w{0,6}['"][\h\)]+\|{0,2})+\)\s*\{\s*(echo)\h+['"]<(script)(?:\h+language\h*=\h*\S{1,40})?\h*>[^;]{0,9};\s*\47\h+['"]location\.href\h*=\h*['"]http[^;"']{1,99}/\w{1,40}\d+\.js\b[^;]+;\s*\47\h*['"]\h*</\48>[\h'"]+;\s*\}(?<X1168630>)|\((?:isset\()?\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)?\s*\{\s*echo\h*['"][^'"]{1,50}['"]\h*\.php_uname\(\)\h*\.['"][^\{]{9,299}\bif\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\D{2,3}\h*['"]?upload['"]?\h*\)\s*\{\s*if\(@?(?:copy|array)\(\$_FILES\[[^\}]{9,99}\}\s*else\s*\{\s*echo\h*['"][^'"]{0,50}['"];\s*\}\s*\}\s*\}(?<X1157632>)|\((\$_[GPRSC]\w{2,6})\)\s*\{\s*(\$\w{1,20})\h*=\h*\51\[[^\]]+\];\s*(\$\w{1,20})\h*=[^\(]{20,150}(\$\w{1,20})\h*=\h*wp_authenticate\(\52\h*,\h*\53\);\s*\$\w{1,20}\h*=\h*\54->allcaps;[^%#\^&\*]{99,600}\bfunction_exists\(['"](file_get_contents)['"][\)\{\s@]+\$\w{1,20}\h*=\h*\55\([^\)]+\);(?:\s*\}){3}(?<X1152891>)|\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\s*\{\s*(\$\w{1,15})\h*=\h*\57;\s*(\$\w{1,15})\h*=\h*md5\(sha1\(\58\)\);\s*if\h*\(\h*\59\h*\D{2,3}\h*['"]\w{32}['"]\)\{\s*\$_SESSION\[[^\]]+\]\h*=\h*\d;\s*\}\s*\}(?<X1157680>)|\((array)_key_exists\h*\(['"]article['"],\h*\$_[GPRSC]\w{2,6}\)\)\s*\{\s*\$(\w{1,9})\h*=\h*get_load_path\h*\(\);\s*require_once\h*\(\$\62\);[^\{]{1,99}(\$\w{1,9})\h*=\h*wp_insert_post\h*\(\61[^\{\}]{0,499}\{\$\w{1,9}\h*=\h*get_permalink\(\63\);[^\?]{0,499}echo\h*['"][^;\$]+\$\w{1,40}#\\n['"];\s*\}\}(?<X1189022>)|\((file\h*\(['"]/etc/(?:passwd|shadow)['"]\))\)\s*\{\s*\$\w{1,20}\h*=\h*\65;[^\?>#\*]{99,600}\bif\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(r_scandir)\h*\(\$\w{1,20},\66\);[\s\}]+\bfunction\h+\67\((?<X2189410>)|\((isset)\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\W{2}\h*\69\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\}]{9,150}(\$_\w{1,15})\h*=\h*tempnam\h*\(['"]/tmp['"],[^\?]{99,1500}\bfopen\h*\(\71,\h*['"]\w['"]\h*\);\s*fwrite\h*\(\$_\w{1,15},\h*['"]<\?php\h*['"][\h\.]+gzuncompress\h*\(base64_decode\h*\(\70(?<X2196751>)|\((isset\h*\()(\$_SERVER\[)[^\]]+\]\)\W{2,4}!?\73\$_COOKIE\[['"]dataserk?["']\]\)[^\{]{9,40}\{\s*\$\w{1,20}\h*=\h*\74[^\(\)]{9,99}\$\w{1,20}\h*=\h*(base64_decode)\h*\([^<\*\\]{999,5000}\bheader\h*\(\75\h*\([^;]{9,50}\);(?:\s*\}){3}(?<X1170081>)|\(@(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\)@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(@\77\);(?<X1157441>)|\([^;\{]*\bmd5[\h\(]+\$_[GPCSR]\w{2,6}\[[^\{;]+\{[^\}\{]+\busername_exists[\h\(]+['"]([^'"]+)['"][\s\)]+\{\s*(\$\w+)[\s=]+wp_create_user[\h\(]+['"]\79['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\80[\s\)]+;\s*\81\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;(?:\s*\};?){2}(?<X1208700>)|\([^\);=\{\}]{0,99}\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\(\h*@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\)\h*;(?<X1189280>)|\([^\)]+\)\s*\{\s*\$\w{0,5}bot\h*=\h*['"]Is\h*Cloak\W{2,5}\bto\h*scam\b[^\}]{9,99}\}\s*if\h*\(isset\h*\((\$_[GPRSC]\w{1,20}\[['"]keyword['"]\])\)\)\s*\{\s*\$\w{1,20}\h*=\h*\84(?<X2183370>)|\([^\)]{0,99}\$(_[GPCSR]\w{2,6}\[[^\]]+\])\h*\)\s*[^\s\d]{2,3}\s*function_exists\h*\(([^\)]{0,99}\$\86)\h*\)\s*\)\s*call_user_func\h*\(\87\h*\);\s*(?:die|exit)[^;]{0,19};(?<X1165552>)|\([^\)]{0,99}\$_[GPCSR]\w{2,6}\[[^\};]{1,99}\bunlink\h*\(\h*__FILE__\h*\);[^\?]{1,999}\bif\h*\([^\)]{0,99}(\$_FILES\[)[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\89(?<X2184210>)|\([^\{;]{0,99}\$_[GPCSR]\w{2,6}\b[^\{;]{1,99}\)\h*(?:\{\h*)?@?call_user_func(?:_array)?\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*,\h*(?:\[|array\h*\()?(?:\$_[GCPSR]\w{2,6}\[[^\]]+\][\h,]*){1,}[\]\)\h]+;(?<X1192342>)|\([^\{\}]{1,99}\{\s*header\(['"]HTTP/1\.[01]\h+40[34]\b[^;]{1,99};\s*(?:die|exit)[^;]{0,19};[^@]{9,199}\$[^=]{1,40}=\h*['"]FilesMan\b(?<X2153461>)|\(\$(anonym)ouse?\)\s*\{\s*@?(?:include|require)[^;\.]{2,9}\93\.php[^;]{0,9};\s*\$\w{1,20}\h*=\h*rand\93\((?<X2170440>)|\(\$_[GPRSC]\w{2,6}\[[^\]]+\](?:\)\{\s*if\h*\(@?(?:copy|move_uploaded_file)\(\$_FILES\[[^#]{99,400}\bPavPal</title>(?<X2156570>)|\W{2,4}['"]?([^'"\)]+)['"]?\)\s*\{\s*\$_SESSIOn\[['"]rootkit['"]\]\h*=\h*\96;(?<X2164820>)|\W{2,4}['"]wp_ajax_try_\d+_v\d+['"]\)\s*\{\s*if\h*\(!?empty\h*\((\$_[GPRSCF]\w{2,6}\[[^\]]+\])\)[^@\};]{9,200}@?[mcf](?:ove_uploaded_file|opy|ile_get_contents)\(\98[^\)]*\);[^\?>]{9,300}\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1165570>))|\(\$xCheck_login\)\s*\{[^\{]{0,99}\$xPassword\)\s*\{\s*die\(['"]\D{9,99}<title>\h*404\h*Not\h*Found\b(?<X2145900>)|\(\h*!((\$this\h*\->)\h*\w{33}\h*\->\h*)bot\h*(\D{2,3})\h*!\101unbot\h*\103\h*!\102\h*\w{33}\h*\(\h*\)\h*\)\s*\{\s*echo\h+\101\h*data\h*\->\h*script\h*\->\h*data\h*;[^#%\*]{999,9999}\bnew\h+\w{33}\h*\(\h*\);\s*\}\s*//\h*\w{32,33}\s*\Z(?<X2179311>))
\bif\h*(?:\(\h*!(function)_exists\h*\((?:['"](logthishit)['"]\)\)\s*\{[^\{]{0,150}\b\1\h+\2\h*\([^\)]+\)\s*\{[^#%`]{999,20000}\$\w{1,20}\h*=\h*['"]\w{1,20}@yandex\.(?:com|ru)['"];(?<X1165830>)|\h*['"](\w{1,40})['"][\h\)]+\{\1\h+\4\([^;\}]+;\s*for\h*\([^\}]+\}[^\}]{0,99}\}\s*(\$\w{1,40})[\h=]+['"][^'"]{999,}['"];\s*(\$\w{1,40})[\h=]+['"]\4['"];\s*(\$\w{1,40})[\h=]+\6\(['"][^'"]{3,99}[=\+]['"]\);\s*(\$\w{1,40})[\h=]+\7\(["']{2}\h*,\h*\6\(\5[^;]+;\s*@?\8\(\);\s*\}(?<X1187851>))|\(\h*!?\h*(?:(function)_exists\h*\(['"](sorry_\10)['"]\)\)\s*\{\s*\10\h+\11\h*\(\h*\$\w{1,20}\h*\)\h*\{\s*if\h*\(\h*is_user_logged_in\h*\([\)\s]+\{[^\-\?\[\]]{9,150}\}\s*add_filter\h*\(\h*['"][^'"]{1,20}['"]\h*,\h*['"]\11['"]\h*\);\s*\}(?<X1164041>)|isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\S{2,3}?[^;\{]{1,99}\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;(?:\s*(?:die|exit)\b[^;]{0,19};)?\s*\}(?<X1173491>))|\(\h*!?file_exists\h*\(['"](/(?:home|var|www)[^\)'"]+\.html?)['"]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(file_)ge(t_contents)\h*\(['"]https?://(?:paste|ghost)bin\.com/raw/[^'"]{1,40}['"]\);\s*\16pu\17\h*\(\h*['"]\14['"]\h*,\h*\15\);\s*\}\s*else\s*\{[^\}]{0,60}\}(?<X1188481>)|\(\h*!?isset\h*\((\$_[GPRSC]\w{2,6}\[['"](?:pass|password|passwd|psw|pwd)['"]\])\)\)\h*([^;&=!]{3,40})\h*=\h*md5\(\19\);\s*if\h*\(!\(\20\)\)\s*die\(\);\s*@?eval\(cipher\(base64_decode\((?<X2152090>)|\(\h*!\$(?:_(COOKIE)\s*\[\s*(base64_decode)\s*\(\s*['"][^'"]*['"]\s*\)\s*\]\s*\)\s*\{\s*set\22\s*\(\s*\23\s*\([^;]+;\s*echo\s*\23\s*\(\s*['"]PHNjcmlwdD53aW5kb3cubG9jYXRpb24ucmVwbG[^'"]+['"]\s*\)\s*\.\s*['"]http[^'"]+['"]\s*\.[^;]+;\s*\}(?<X1188630>)|IS_CONFIGURED\h*\)\h*\{\s*\?>\s*<!DOCTYPE\h*html>[^\?]{1,150}<(title)>\h*Web\h*Console\h*\</\25>(?<X2170691>))|\(\h*!\h*(?:(file_)exists(?:[\(\h]+['"]([\./]*[^'"/]{1,40}\.php)['"\s\)]+\{\s*(\$\w{1,40})[\h=]+(\27ge(t_contents))[\h\(]+['"](http[^'"]{9,40}\.(?:txt|html))['"\)\s]+;\s*\27pu\31[\h\('"]+\28['",\h]+\29[\)\h]+;[\s\}]+else\s*\{[^\}]+\29[=\h]+\30[\h\('"]+\32['"\)\h]+;\s*\27pu\31[\('"\h]+\28['",\h]+\29[\)\h]+;(?:\s*\}){2}(?<X1189160>)|\h*\(\h*(['"]/home\d*/[^'"]{4,99}\.php['"])(?:\s*\)){2}\s*\{\h*\27put(_contents)\h*\(\h*\34\h*,\h*\27get\35\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\s\)]+;\s*\}(?<X1164532>))|(function)_exists(?:[\s\(]+['"](sorry_\37)['"][\s\)]+\{\s*\37\s*\38[\s\(]+\$\w{1,40}[\s\)]+\{\s*if[\s\(]+is_user_logged_in\(\)[\h\)]+\{[\s\}]+else[\s\{]+if[\h\(]+is_[ps][^;]+\becho\h*['"]\\[\d\\xa-f]{99,999}['"]\h*;(?:\s*\}){3}\s*add_action[\h\(]+['"]wp_footer['"]\h*,\h*['"]\38['"][^;]{0,9};\s*\}(?<X1178910>)|\h*\(\h*['"](?:(\w{1,40})['"][\s\)\{]+\37\h*\40\h*\([^;\{\}]{0,49}\{[^\}]{9,999}\}\s*return[^\}]+\}\s*(\$\w{1,40})[\h=]+['"][^'"]{99,}['"];\s*(\$\w{1,40})[\h=]+['"]\40[^\}]+(\$\w{1,40})[\h=]+\42[\h\(]+['"][^\}]+(\$\w{1,40})[\h=]+\43[\h\(]+['"]{2}[^;'"]+\41[^;]+;\s*@?\44[\(\)\h]+;\s*\}(?<X1189190>)|(DSAGdfg_)['"][\s\)\{]+\37\h*\46\h*\(\)\s*\{[^\?:>]{599,3500}\beval\h*\(\h*\46\w{1,15}\h*\(\h*\$\w{1,15}\h*\[\d\][\)\h]+;\s*break;(?:\s*\}){4,}(?<X1189122>)|(sorry_\37)['"]\)\)\s*\{\s*\37\h*\48\((\$\w{1,15})\)\s*\{\s*if\h*\(\h*is_user_logged_in\([^\?]{99,1500}\belse\s*\{\s*(\$\w{1,15})\h*=\h*\49;\s*\}\s*return\h*\50;[\s\}]+\}(?<X1173851>)))|\(\h*preg_match\h*\(\h*['"]/resetpass/['"]\h*,[^;]{1,99}\)[^@]{1,99}\$\w{1,40}\h*=\h*@?getcwd\(\);[^\?\*\>]{1,999}(?:\s*\$\w{1,40}\h*=\h*@?(?:get_current_user|getmyuid|getmygid|posix_get\w{4})\b[^;]+;){2}(?<X2163070>)|class(?:(_exists)\h*\(\h*['"](?:[^'"]{1,40}['"][\s\)]+\{\s*if\h*\(\h*@file\53\h*\(['"](/home\d*/[^'";]{9,99}\.(?:jpe?g|gif|png|ico))['"][\s\)]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\54[\$\}\)'"]{1,3};(?:\s*\}){2}(?<X1155580>)|WPPlugingsOptions['"]\h*\)\s*&&\h*file\53\h*\(\h*([^\}\{;]{9,99})\)\h*\)\s*\{\s*@?include_once\h*\(\h*\56\h*\);\s*\}(?<X1157970>))|_exists\h*\(\h*['"](RMSActivationRemoteHandler)['"]\h*\)\h*\)\s*\{\s*class\h+\58\s*\{(?<X2157800>))|empty\h*\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*)(?:\)\s*){2}\{\s*(\$\w{1,40})\h*=\h*@?popen\h*\(\h*\60\h*,[^;]{1,49};\s*echo\h*fread\h*\(\h*\61\h*,\h*\d+\h*\);\s*pclose\h*\(\h*\61\h*\)\h*;\s*\}(?<X1165140>)|function_exists\h*\(\h*['"]do_rms_activation_task['"]\)\)\s*\{\s*[^\[]{0,99}\$GLOBALS\[['"]rms_report_to['"]\]\h*=\h*['"]https?://managerly\.org/[^'"]{1,50}['"];(?<X2157790>)|isset\h*\(\h*(\$_session\h*\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,10})\h*=\h*(curl)_init\h*\(\h*\)\h*;\s*\66_setopt\h*\(\h*\65\h*,\h*\66opt_url\h*,[^\}]{1,150}\s*\64\h*=\h*\66_exec\h*\(\h*\65\h*\)\h*;[^\}]{0,20}\}\s*@?eval\h*\(\h*(?:base64_decode\h*\(\h*)?\64\h*\)\h*;(?<X1173092>))|\(\h*!class(_exists)[\h\(]+['"]WPTemplatesOptions['"][\h\)]+[^\d\s_]{2,3}\h*function\68[\h\(]+['"](wp_get_theme)s['"][\s\)]+\{[^\;\{]+\{\s*(\$\w{1,40})\h*=[^;]+\{\$\69\-\>\w+\}\.php['"];\s*if[\h\(]+file\68[\h\(]+\70[\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\('"\h]{0,3}\70[\)'"\h]{1,3};(?:\s*\}){3}(?<X1155400>)|\(\h*!defined(?:(\(['"]WP_LOAD_CHECK_MODULES)['"][\)\s]+\{[^\}]{1,499}\bdefine\72['"][\h,]+1[\h\)]+;[^\?]{999,1499}@file_put_contents\([^;]+\.\h*\$wp_write[,\h]+FILE_APPEND[\)\h]+;\s*\}(?<X1176620>)|\(['"]WP\w{0,40}['"][\h\)]+\{\s*@?include_once\h+['"]\w{1,40}\.(?:png|jpe?g|ico)['"];\s*\}(?<X1183080>)|\h*\(\h*['"]REMOTING_INJECTED['"][\s\)]+\{[^%]{999,14500}\bexit\h*\(\h*str_replace\h*\(\h*['"]<[RESPON_]+>['"],\h*['"]{2},\h*\$\w{1,15}[\s\)]+;\s*\}[^\\]{999,8500}\bget_s_contents\h*\([^\);]+\burlencode\h*\(\h*\$client[\)\s;\}]+\}(?<X1194925>))|\(\h*!function_exists\h*\(['"](?:(themes_\w{1,40})['"]\)\)\h*:[^\$]{1,499}\$\w{1,40}\h*=\h*array_merge\h*\((?:\h*\$_[RSC]\w{2,6}\h*,?){3}\)\h*;[^@]{99,999}(\$\w{1,40})\h*=\h*\77\(\h*['"]{2}\h*,\h*@?\$\w{1,40}\([^\)]+\)+;[^\-]{99,499}\badd_action\h*\(\h*\$\w{1,40}\h*,\s*['"]\76['"]\h*,[^;]{1,40}\);\s*endif;(?<X1160381>)|(wp[\-_]v?cd)['"][\)\s]+\{[^\^]{999,9999}\bfunction\h+\79\h*\([^@]{999,1599}@isset\h*\(\h*\$mtchs\h*\[\d+\]\)+\s*\{\s*@?fwrite\h*\([^@]{1,99}if\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*@include\h*\(\h*\$\w{1,40}\h*\)\h*;(?:\s*\}){2}(?<X1140440>))|\(\h*!isset\h*\(\h*(?:(\$GLOBALS\h*\[['"]VfQ9EN['"]\])[\s\)]+\{\s*\81\h*=\h*\d;\s*\$\{[^\n]{9999,20000};@\$\{[^\}]{9,150}\}\(\$\{[^\}]{9,99}\}\);\}(?<X1189600>)|(\$GLOBALS\h*\[[^\]]+\])[\s\)]+\{\s*\83\h*=\h*\d[\s;]+function\h*(\w{1,15})\h*\([^\?]{999,2999}(\$_\d{1,3})\h*=\h*\84[^\}\?]{1,999}\bfile_put_contents\h*\(\85,\h*['"]WP\+\+[^\?]{99,3000}\bunset\(['"]wp_setting_init_global['"][^\)\}]{99,899}\bmt_rand['"][\)\s;]+;\s*\}(?<X1189551>))|\(\h*(!?isset\h*\(\h*\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\)\h]+\W{2,4}\h*\87\[[^\]]+\][\)\s]+\{\s*@?setcookie[^;]{1,99};\s*@?header\h*\(\h*['"]location:\h*https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^'"\?;]{0,49}/\?\w{1,9}\h*=[^;]{1,16};\s*\}(?<X1173712>)|\(\h*((\$_[GPCSR]\w{2,6})\[[^\]]{1,40}\])[\h=!]{2,9}\89\h*\)\h*\{\h*extract\h*\(\h*\90\h*\)\h*;\h*u[ak]?sort\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\h*;\h*\}(?<X1134180>)|\(\h*(?:!?\h*[ie](?:sset|mpty)\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\h*@?preg_replace\h*\(\h*.?['"](.).{0,40}\92(?:\\x65|e|\\145)\w?.?['"]\h*,\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*,\h*['"][^'"]{0,9}['"]\h*\)\h*;(?:\h*(?:exit|die)\b[^;]{0,9};)?\h*\}(?<X1164310>)|\(\h*(?:(?:md|sha)[1256]\h*\(\h*){3,}@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\D{2,3}\h*['"][^'"]*['"][\s\)]+\{[^\}]+(?:\s*echo)?\s*@?(?:eval|assert)\s*\(\s*\w{4,24}\s*\(\s*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;[^\.]{1,999}\.\h*php_uname\h*\((?<X2166410>)|\(\h*(?:(?:md|sha)[2561]{1,3}\s*\(\s*)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\S{2,3}\h*['"][^'"]{1,40}['"][\)\s]+(?:die|exit)\s*\(\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:\s*\(\s*(?:stripslashes|base64_decode|gzuncompress)){1,}\s*\(\s*\$_[GPCSR]\w{2,6}\s*\[[^\]]+\][\s\)]+;(?<X1186310>))
\bif\h*(?:\(\h*(?:isset\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]{0,99}\{[^,]{0,99}(file_)pu(t_contents)[\h\(]+['"](?:/home\d*/[^/]+/[^'"]+/)?[\w\-]{1,12}\.php['"\h,]+\1ge\2[\h\('"]+https?://raw\.githubusercontent\.com/[^'"]{1,99}(?:shell|xploit|cmd|root|shell|crack|anon|fake)[^'"]{1,99}\.php['"][\)\h]+;\s*\}(?<X1185552>)|\(\h*(?:md5\h*\(\h*)?\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*\W{2,4}\h*['"]\w{20,50}["']\h*\)@?eval\h*\(\h*base64_decode\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*\)\h*;(?<X1164673>)|\(\h*(?:md|sha)[1256]{1,3}\h*\(\h*(?:trim\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\W{3,9}['"]\w{1,40}['"][\s\)]+\{\s*(?:echo\h+)?@?(?:eval|assert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1165610>)|\(\h*(\$\w{1,40})\h*==\h*['"]root['"][\)\s]+\{\s*(\$\w{1,40})\h*=\h*['"]/['"][\h\.]+\6[\h\.]+['"]/\.accesshash['"]\h*;\s*(\$\w{1,40})\h*=\h*getcwd[\h\(\)]+;\s*(\$\w{1,40})\h*=\h*\6[\h\.]+['"][^'"]{1,40}['"]\h*;\s*if\h*\(\h*is_readable\h*\(\7[\s\)]+\{\s*copy\h*\(\h*\7\h*,[^;]{0,40}\8[^;]{1,40}\9[^;]+;(?<X2158691>)|\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*Array\(\s*['"]\w{1,9}['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\12\h*\);\s*\}\s*elseif\s*\(\h*\11[^\)]+\)\s*\{\s*@?eval\h*\(\h*\11[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>\s*)?\Z(?<X2160641>)|\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*@?(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*\(\h*\14[^;\$\(\v]{1,16};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1140891>)|\(\h*(\$_[GPRSC]\w{2,6})\s*\)\s*\{\s*(\$\w{1,40})\h*=\h*\16\[[^\]]+\];\s*(\$\w{1,40})\h*=\h*\16\[[^\]]+\];[^\}\->\{]+(\$\w{1,40})\h*=\h*wp_authenticate\((?:\h*(?:\17|\18)\h*,?){2}\);\s*(\$\w{1,40})\h*=\h*\19\->allcaps;\s*\$\w{1,40}\h*=\h*\20\[[^\}]+\}\s*\}(?:\s*else[^\}\{]{1,99}\{[^\}]+\}(?:\s*\})+)?(?<X1161690>)|\(\h*(\$_[GPRSC]\w{2,6}\[['"])\wshell['"]\]\h*\D{2,3}\h*['"]\d{1,3}['"]\h*\)\s*\{\s*if\h*\(\h*\22[^\]]+\]\h*\D{2,3}\h*['"]\d{1,3}['"]\h*\)\s*\{\s*\$\w{1,15}\h*=\h*file_get_contents\([^\)]+\.php['"]\);(?<X2174560>)|\(\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*(?:!=\h*(?:['"]{2}|null)\h*\)\s*\{\s*@?eval\h*\(\h*\24\h*\)\h*;(?:\s*(?:die|exit)\b[^;]{0,9};)?\s*\}(?<X1164910>)|\W{2,4}\h*md5\(\24\)\h*\D{2,3}\h*['"]\w{32}['"]\h*\)\h*\{\h*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\)\h*;\h*\}(?<X1164612>))|\(\h*(\$_FILES\[['"]\w{1,9}['"]\])\s*\)\s*\{\s*@?[cm]o(?:ve_uploaded_file|py)\h*\(\s*\27\s*\[\s*['"][^'"]+['"]\s*\]\s*,\s*\$_[GPRC]\w{2,6}\[[^\]]+\]\h*\)\s*;[^;]{1,49};\s*(?:exit|die)\b[^;]{0,19};\s*\}(?:\s*;)?(?<X1184381>)|\(\h*(isset)\h*\(\h*(\$_([GPRSC]\w{2,6})\[)([^\]]+)\]\h*\)\h*or\h[^\{]{1,40}\{\s*if\h*\(\h*!\29\h*\(\h*\30[^\]]+\][\)\s]+set\31\(\32,[^;]+;\s*@?eval\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*){1,5}file_get_contents\h*\(\h*['"]https?://\w[^;]+;\s*(?:die|exit)\b[^;]{0,9};\s*\}(?<X1162751>)|\(\h*@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{9,299}\bif\h*\(\h*isset\(\$_[GPRSC]\w{2,6}\[['"]cmd['"]\][\)\s]+\{\s*echo\h*['"](?<X2173610>)|\(\h*@?(?:md|sha)[1256]{1,3}\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\D{2,3}\h*['"][a-f0-9]{32,128}['"][^/\}]{1,199}\b[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?:\s*echo[^;]+;)?(?:\s*(?:die|exit)\b[^;]{0,9};)?\s*\}(?<X1167103>)|\(\h*@?[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\?]{1,199}\becho\s*['"]<script\b[^>]{0,99}>\s*alert\h*\([^\?]{1,199}\becho\s*['"][^;]{1,99}['"]\h*\.\h*php_uname\(\h*\)(?<X2168610>)|\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\S{2,3}\h*['"]\w{0,40}['"][\s\)]+\{\s*@?[ps](?:assthru|ystem|hell_exec)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\h]+;\s*\}(?<X1185101>)|\(\h*@?\bcopy\(\$_FILES\[['"][^&]{99,4000}\b(?:paste|ghost)(?:bin)?\.(?:com|se)[^#]{9,60}\bDownload\h*Mini\s*Shell(?<X2153441>)|\(\h*@?mail\h*\((?:\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*,){2}[^;]{1,99}\bimplode\h*\([^>_@]{1,99}\{\s*\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\]\s*\}\s*=\h*json_encode\s*\(\s*array\s*\(\s*['"]subject['"]\s*=>\s*\39(?<X2142962>)|\(\h*@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*==+\h*['"]login['"]\h*\)\s*(?:\{\s*@?mail\h*\(\h*['"][^'"@,\);]+@(?:(?:g|proton|hot)mail|ya(?:hoo|ndex)|live|aol)\.[^;]{1,99};\s*header\h*\(\h*['"]Location:\s*\w{1,19}\.html?['"]\h*\);\s*\}\s*(?:else\s*)?){2}(?:\?>\s*)?\Z(?<X2167420>)|\(\h*@is_file\h*\(\h*(?:(['"]\./tmp/['"]\h*\.\h*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\.\h*\$\w{1,15})[\)\s]+\{\s*(include)\h*['"]\w{1,15}\.txt["'];\s*\43\(\42\);[^\?]{0,199}\?>\s*<!doctype\h*html>(?<X2177471>)|['"]([^'"]{5,49}\.(?:gif|jpe?g|png|ico|bmp|txt))['"][\)\h]+\{\h*@(?:require|include)_once\h*\(\h*['"]\45['"]\h*\);\h*\}(?<X1176541>))|\(\h*\$_[GPRSC]\w{2,6}\[(?:[^\]]+\]\W{2,4}['"]shell\d['"]\h*\)\s*\{\s*echo\h*["'][^\*%@]{99,400}\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\);\s*foreach\h*\([^\)]+\)\s*\{[^\(\)]{9,99}['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1164771>)|[^\{]+\{\s*\w{1,40}[\h\(]+['"](/tmp/bc\d*\.pl)['"][^;]+;\s*\$\w{1,20}\h*=\h*\S{1,99}[\h\(]+['"]perl\h*\48\b(?<X2183761>))|\(\h*\$_(?:[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\h\)]+\{\h*@?extract\h*\(\h*\$_[GPRSC]\w{2,6}\h*\)\h*;\h*(?:die|exit)\h*\(\h*\$\w{1,40}\h*\(\h*\$\w{1,40}[\)\h]+;\h*\}(?<X1174650>)|\h*<>\h*['"]{2}\h*\)\s*(?:die|exit)\h*\(\h*['"](\w{1,9})['"]\h*\)\h*;[^;]{1,199}\bfile_put_contents\h*\(\h*['"][^'"]{1,40}\.php['"]\h*,\h*['"](?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])+['"]\h*\)\h*;[^\?]+echo\h*['"]\51\w{0,9}['"];[^\}]{0,40}\}\s*else\s*\{\s*echo[^\}]{1,99}\}(?<X1174020>)|\W{2,5}['"][^'"]{1,40}['"][\s\)]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"]wget\h+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"\s]{1,40}\b\h+\-O\h+([^\s'"]{1,40})['"][\h\)]+;\s*\$\w{1,40}\h*=\h*fopen\h*\(\h*['"]\53['"](?<X2167981>))|SERVER\[['"]REQUEST_METHOD['"]\]\h*[^\s\d]{1,3}\h*['"]GET['"]\h*\)\s*\{\s*(?:echo|print)\s*(?:\(\s*)?['"][^;]{1,199}<title\b[^>]{0,99}>\s*40[345]\b[^;]{1,199};\s*(?:die|exit)[^;]{0,19};\s*\}[^\?><]{1,1500}=\h*new\h+geoPlugin\h*\(\h*\)\h*;(?<X2165532>))|\(\h*\$bannermass\h*==+\h*\$get_url_var[\h\)]+\{\s*\$set_cookie\h*\(\h*(?:stripslashes\h*\(\h*)?\$check_category\h*(?:\)\h*){2};[^\}\$\(;@]{1,19}\}(?<X1164301>)|\(\h*\$cloacked_page\h*\)\s*\{\s*if\h*\(\h*\$is_bot\h*\)\s*\{\s*(?:@?send_nocache_headers\h*\(\h*\)\h*;\s*)?showDoorPage\h*\(\h*\$page_file\h*\)\h*;(?<X2144021>)|\(\h*\$ip(?:hone|od)(?:\h*\|\|\h*\$\w{1,40}\h*)+===\h*true\h*\)\s*\{\s*@?header\h*\(\h*['"]Location:\h*https?://[\w\-\.]{2,40}\.ws/?['"]\h*\)(?:\h*;)?\s*\}(?<X1156090>)|\(\h*do_backdoor\h*\(\h*\$\w{0,9}path[\)\s]+\$\w{1,40}\h*=\h*(?:true|false|null)\h*;(?<X2179760>))
\bif\h*(?:\(\h*fil(?:e_exists(?:\(\h*['"](wp\-login\.php)['"][\s\)]+\{\s*(\$\w{1,40})\s*=\s*file_get_contents\(\h*['"]\1['"]\h*\);\s*(\$\w{1,40})\h*=[^;]{999,4999};\s*\2\s*=\s*str_replace\h*\(\h*['"]wp_safe_(redirect)\(\$\4_to\);['"]\h*,\h*base64_decode\(\h*\3\h*\)\h*,\h*\2\h*\)\h*;(?<X2143440>)|\h*\(\h*(?:(((?:plugin_dir_path)\h*\(\h*__file__\h*\)|get_template_directory\h*\(\h*\))\h*\.\h*['"]/\.['"]\h*\.\h*basename\h*\(\h*\7\h*\)\h*\.\h*['"]\.php['"])\h*\)\h*\)\s*\{\s*(?:includ|requir)e(?:_once)?\h*(?:\(\h*)?\6\h*(?:\)\h*)?;\s*\}(?<X1169352>)|(get_template_directory\h*\(\))\h*\.\h*(DIRECTORY_SEPARATOR)[\.\h'"\.]+(basename)\h*\(\9\)[\.\h'"\.]+php['"][\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\('"]{0,3}\9\h*\.\h*\10[\.\h'"]+\11\h*\(\9\)[\.\h'"\.]+php[\)'"]{1,3};\s*\}(?<X1155390>)|['"](/(?:var/)?tmp/\w{1,12}\.pl)['"][\s\)]+\{\s*unlink\h*\(['"]\13['"]\);\s*\}\s*\$\w{1,40}\h*=\h*fopen\h*\(['"]\13['"]\h*,\h*['"][aw]\+?['"]\h*\)\h*;[^\.&]{1,99}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(['"]perl\h+\13\h*\$\w{1,9}\h*\$\w{1,9}\h*&(?<X2156891>)))|ter_(input)\h*\(\h*\15_[GPSCE]\w{2,6},[^\{]{9,70}\{\s*require\h*\(\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*(strrev)\h*\(\h*['"]php\.[^\)]{5,25}\)[\h\)]+;\s*\16\h*\(\h*['"]eikooc_htua_tes_pw['"]\h*\)\h*\(\h*\d+\h*[^\s\w]\h*\d+\h*\)\h*;\s*\}(?<X1168800>))|\(\h*function_exists\h*\((?:['"]((curl_)init)['"][\)\s]+\{\s*(\$\w{1,20})\h*=\h*\18\h*\((['"]https?://www\.\w{1,20}\.\w{2,6}/\w{1,10}\.php[^;]{99,499};)\s*\19setopt\h*\(\20,\w+,[^;]+;[^\{]{1,299}\{\s*echo\h*file_get_contents\h*\(\21[^\{]{1,99}\{\s*assert\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?:\s*\}){2}(?<X1172921>)|\h*['"](is_user_logged_in)['"][\s\)]+\{\s*if\h*\(\h*!\h*\23\h*\([\s\)]+(@?add_action\h*\()\h*(?:(\w{1,40})\h*\([^\)]+\)\h*,\h*){2}mt_rand\h*\(\h*(?:round\h*\(\h*0(?:\h*\+\h*(?:\d+\.)?\d+\h*)+\)(?:\h*,)?\h*)+\)[\h\)]+;\s*\}(?:\s*else\s*\24(?:\25\h*\([^\)]+\)\h*,\h*){2}[^;]+;)?(?<X1161870>))|\(\h*ini_get\h*\(\h*(?:['"]allow_url_fopen['"][\)\s]+\{\s*function\h+(gets?_data_yo)\h*\([^\+\-]+\27\h*\(\h*wp[_\-][vc]?cd\h*\([^;]+(\$\w{1,40})[\)\h]+;\h*(\$\w{1,40})\h*=\h*@?explode\h*\([^\)]+\28\h*\)\h*;[^\}]{1,40}\29\h*\[\d+\][\)\h]+;(?:\s*\}){4,5}(?<X1149182>)|\\?['"]allow_url_fopen\\?['"]\h*\)\h*\)\s*\{\s*function\h+get_data_ya\h*\([^@]{99,1500}fwrite\h*\(\h*(\$\w{1,40})\h*,\h*\\?['"]\h*<\?php\s*\\?\\\w\W?\$mtchs\h*\[\d+\][^;]+;\s*fclose\h*\(\h*\31\h*\)\h*;\s*@?include\h*(\([^\)]{1,60}\))\h*;\s*@?unlink\h*\32\h*;(?<X1139603>))|\(\h*is(?:_https\s*\(\)\s*\)[^\(]{0,99}\}\s*\$\w{1,40}[=\h]+smrequest_uri\h*\(\);[^\?]{9,499}(\$\w{1,40})['"=\h\.base64_dnco]{20,40};\s*\$\w{1,40}[\h=]+\34\(\$\w{1,40}\);[^#]{99,50000}\bfunction\h*smoutdo\h*\(\h*\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[^\}]+\}\s*return\h*\35;\s*\}(?<X1193840>)|set\((?:((\$_[GPRSC]\w{2,6})\h*\[[^\]]+\])(?:\h*\)){2}\s*\{\s*@?(array)_diff_ukey\h*\(@?\39\h*\(\h*(\(string\))\h*@?\38\[[^\]]+\]=>\d\)\h*,\h*@\39\h*\(\h*\40(?:stripslashes)\(@?\38[^\]]+\]\h*\)=>\d\)\h*,\h*@?\37\);\s*\}(?<X1163861>)|\h*(\$_[GPCSR]\w{2,6}\[['"]\w{32}['"]\])\){2}\h*preg_replace\(\h*['"][^'"\v]+['"]\h*,\h*str_rot13\h*\(['"riny\.\h]{6,49}\)\h*\.\h*['"]?\h*\(\h*\42\h*\)\h*['"]?\h*,\h*["'][^'"\v]+['"]\h*\)\h*;(?<X1134131>)|\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1153490>))|set\h*\((?:((\$_[GPRSC]\w{2,6}\[)[^\]]+\])\)\W{2,9}(?:\(\s*)?md5\h*\(\45\)\W{2,9}['"]\w{32}['"](?:\h*\))?\W{2,4}isset\h*\((\46[^\]]+\])(?:\s*\)){2}\s*\{?\s*@?eval\h*\(\h*base64_decode\h*\(\h*\47(?:\h*\)){2};\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1164591>)|(\$_[GPRSC]\w{1,20}\[[^\]]+\])\)\W{2,4}isset\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*@?array_(?:map|walk)\h*\(\h*(?:\49|\50)\h*,\h*(?:\50|\49)\h*\);\s*\}(?<X1165062>)|(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)\{]+eval\h*\(\h*\w{1,9}\h*\(\h*\52[^\]]+\][\s\)]+;[^\?]{0,99}\binclude\h*['"]\$\w{1,9}/\$_[GPRSC]\w{2,6}\[['"]?SHOWWSO['"]?\]\.php['"];(?<X2196850>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{?\s*@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(stripslashes\h*\(urldecode\h*\(\h*\54\)\)\);(?<X1164570>)|\$\w{1,40}\h*\[['"]i?s?door\w{0,30}['"]\][\)s]+\{[^\}]{1,299}\becho\h*\$i?s?door\w{0,30}\h*;(?<X2159001>)|\$_[GPRSC]\w{2,6}\[(?:['"][^'"]{0,9}shell[^'"]{0,9}['"]\]\)\)\s*\{[^\{]{9,99}\b\bif\h*\(\h*isset\h*\(\$_[GPRSC]\w{2,6}\[['"]htaccess['"]\]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*["'][^;'"]{9,99}\bDirectoryIndex\h+Sux\.html\s*['"];\s*file_put_contents\h*\(['"]\.htaccess['"],\h*\57\);(?<X2190500>)|[^\]]+\]\)\)\s*\{\s*echo\h*['"][^'"]{1,49}\bXploiter['"];\s*echo[^\.]{0,15}\.\h*php_uname\(\)\h*\.[^\{]{9,199}\{\s*if\h*\(\h*@?\h*(?:array|copy|move_uploaded_file)\h*\(\h*\$_FILES[^\}]{1,99}\}\s*else\s*\{\s*echo\h*['"]gagal['"];\s*\}\s*\}\s*\}(?<X1160440>))|\h*(\$_[GPCSR]\w{2,6}\[)[^\]]+\]\h*\)\h*[^\v\d;\$]{2,3}\h*\60[^\]]+\]\h*==+\h*['"][^'"]+['"][^\)]{0,99}[\)\h]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:base64_decode\h*\(\h*)?\60[^\]]+\][\h\)]+;(?<X1185032>)|\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+(?:[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*(?:\(\h*(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*){2,5}\(\h*\62[\h\)]+;\h*$(?<X1139841>)|\{\s*if\h*\([^;\{\}%#@!/]{1,99}\{\s*(\$\w{1,40})\h*=\h*\62;\s*@?preg_replace\h*\(\h*['"](\W)[^'"]+\65e['"],[^\),;]+\bstr_rot13\(\h*['"]riny['"]\h*\)[^\);,]+\64\b[^;]{1,99};\s*(?:die|exit)[^;]{0,19};(?:\s*\}){2}(?<X1161740>))|\h*(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)]+\{\s*@error_r[^\}]{0,99}if[\s\(]+isset[\s\(]+\67[^\}]{0,99}\}\s*else\s*\{[^:\{\}]{0,99}(\$\w{1,40})[\h=]+file_get_contents\(['"]php:[^;]+;[^@]{0,999}(\$\w{1,40})\h*=[^;]+\68[^\{\}]{0,99}(\$\w{1,40})[\h=]+\69[^@]{9,99}@new\h+\w{1,40}\(\70\);(?:\s*\}){2}(?<X1185320>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*ini_set\(['"]display_errors['"][\h,]+['"](?:Off|0)['"]\);[^\}]{0,499}\$\w{1,40}[\h=]+json_encode\(\$_COOKIE[\h,]+256\b[^\\\}]{0,999}(curl)_setopt\((\$\w{1,40})[\h,]+\73OPT_URL[,\h]+['"]\\[^;]+\72[\}'"\)\h]{3,9};[^\}]+\73_close\(\74\);[^\}]{0,40}\}(?<X1188320>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\h*\76[^\{]{1,50}\{\s*die\h*\(\h*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*file_get_contents\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\){3};\s*\}(?<X1162051>)|\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\s\)\(\{]+(\$\w{1,40})\s*=\s*\78[\)\s]+\S{2,3}\s*@preg_replace[\(\s]+['"](.)[^'"]{0,9}\80e['"][,\s]+['"]@['"][\s\.]+str_rot13[\s\(]+['"]riny['"][\)\.\s]+['"]\(\79\)['"][\s,]+['"]\w{1,40}['"][\s;\)]+(?:exit|die)\b[^;]{0,19};\s*\}(?<X1034123>)|\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\s\)]+\{\h*(\$\w{1,40})\h*=\h*['"]\h*\};\s*['"][\h\.]+(urldecode\()gz(?:inflate|uncompress)\(\84\$\w{1,40}[\h\.]+\82[\h\.]+\$\w{1,40}(?:\h*\)){3}[\h\.]+['"]\h*\{\h*['"]\h*;\s*create_function\h*\(\h*(?:["']{2}|null|false)\h*,\h*\83[\h\)]+;\s*\}(?<X2118573>)|\h*(\$_[GPRSC]\w{2,6}\s*/\*[^\*]+\*/\s*\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\s*=\s*\86\s*;(?:[^\}]+\$\w{1,40}\h*\.=\h*\$\w{1,40}\[\$\w{1,40}\];\s*\})+[^,\}]+(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*(?:['"]['"]|null)[\h,]+\$\w{1,40}\(\87[\)\h]+;\s*@?\88\(\);\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1186710>)|\h*(\$_COOKIE\[[^\]]+\]\))\)\s*@\$_COOKIE\[[^\]]+\]\(\90;(?<X1191660>)|\h*(\$_REQUEST\[['"]\{\$\w{1,15}\}['"]\])[\)\s\{]+(\$\w{1,15})\h*=\h*\92;\s*(\$\w{1,15})\h*=\h*['"]{2};[^\?]{99,700}(\$\w{1,15})\h*=\h*\$\w{1,15}\(['"\.\_\hcreatfunio]+\);\s*(\$\w{1,15})\h*=\h*\95\(['"]{2},\h*\94\(\93[\h\)]+;\s*\96\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1194960>)|\h*(\$config\[['"]request['"]\])[\)\s]+\{\s*error_reporting\(0\);\s*eval\(\h*\98\h*\)\h*;\s*\}(?<X1171430>)|\h*\$\h*_\h*[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{[^/]{9,50}<title>[^\w]{0,9}Hidden\h+Uploader[^<]{0,9}</title>(?<X2140781>))))
\bif\h*(?:\(\h*isset\h*\(\h*\$_(?:[GPCSR]\w{2,6}\[[^\]]+\](?:(?:\h*\)){2}\h*\{\s*echo\s*['"]<form\b[^\}\{:#%\*\+!&\?,@]{1,499}\b(?:(?:if\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^;\{\}]{1,99}|else\s*)\{\s*echo\b[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}){1,2}\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1169520>)|(?:\s*\)){2}\s*\{\s*if\h*\([^\}]{1,99}\b[cm]o(?:py|ve_uploaded_File)\h*\(\h*\$_FILES\[[^;]{1,99};[\s\}]+\?>[^/]{1,199}<(title)\b[^>]{0,99}>\s*ImageSurfer\s*</\2>(?<X2171321>)|[\)\s]{1,9}\{\s*error_reporting\((?:0|NULL)\);\s*(\$\w{1,40})\h*=[^\}]{9,99}(\$\w{1,40})\h*=\h*file_ge(t_contents\()\$_[GPSCR]\w{2,6}\[[^;]{1,49};\s*(?:\}\s*)?@?file_pu\6\h*\4\h*,\h*\5\h*\);(?:\s*echo\b[^;]{1,49};)?\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1152020>)|[\h\)]+\{\s*@?ini_set\(['"]error_reporting['"]\h*,\h*(?:0|Null|false)\h*\);[^\$\{=\}]{1,99}\b(function)\s+(\w{1,40})\b[^\?]{999,9999}\bregister_shutdown_\8\([^\)]+(\$\w{1,40})\);[^\*]{99,499}\bfile_put_contents\(\h*\10\b[^\?/\*]{1,499}\9\(\);\s*\}(?<X1158350>))|[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{(?:(?:\s*(\$\w{1,40})[\h=]+\$_[GPRSC]\w{2,6}\[[^;]+;)+\s*(function)\h*(\w{1,40})[^\}]{4,99}\breturn[^;\^]{3,99}\^[^\v]{3,99};[\s\}]+(\$\w{1,40})[\h=]+\14[^;]+\12[^;]+;\s*(\$\w{1,40})[\h=]+create_\13\((?:['"]{2}|null)[\h,]+\15[\h\)]+;\s*@?\16[\(\)\h]+;\s*\}(?<X1186190>)|\s*(\$\w{1,40})(?:[\s=]+@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\s\(]+(?:base64_decode[\s\(]+)?['"@]?\$_[GPRSC]\w{2,6}\[[^\}]{0,40}while[\s\(]+\$\w{1,40}[\s=]+fgets[\s\(]+\18[\s\)]+\{[^\}=]{6,99}\}(?:\s*@?\w{3,19}[\s\(]+\18[\s\)]+;)?\s*\}(?<X1186230>)|\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*;\s*if\h*\(\h*\18\h*\D{2,3}\h*['"]port[^'"]{0,9}['"][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?fsockopen\(['"][^'"]{9,40}['"]\h*,\h*(?:110|143)\h*,[^\*\?&%]{99,9999}fclose\(\20\);(?:[^\}]{1,99}\}){2}(?<X1163130>))|\s*(?:@?extract[\s\(]+\$_[GPRC]\w{2,6}\b[\s\)]+;\s*(?:die|exit)[\s\(]+\$\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+;\s*\}(?<X1186241>)|if[\h\(!]+file(_exists)\h*\(['"][^'"]+['"][\s\)]+\{\s*if\h*\(\h*function\23\h*\(['"]((?:shell_)?exec|system)['"][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?\24\(['"]w?GET\b[^:]{1,60}https?://[a-z]{2,5}bin\.com?/[^\?\*\|\[]{399,999}eval\(\25\);[^\}]{0,24}\}(?<X1161220>)))|[GPRSC]\w{2,6}\[[^\]]+\][^\{]{5,99}\{\s*if\h*\(\h*md5\h*\((\$_REQUEST\[)[^\]]+\]\)\h*\D{2,3}\h*['"]\w{32}['"]\)\s*\{\s*@?eval\(\27[^\]]+\]\);\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1160590>)|[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\)\s]+\{\s*(?:@?preg_replace\s*\(\s*.?['"](.).{0,40}\29e\w?.?['"]\s*,\s*['"]['"eval\.\h]{7,}\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*['"]\s*,\s*['"][^'"]{0,40}['"]\s*\)\s*;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}(?<X1174030>)|echo\h*\(?['"]<form\b[^;]+;\s*if\h*\(\h*(?:isset\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*if\h*\(\h*@?[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\)]+\)[\)\s]+\{[^\*\(\)\[\]\?]{1,499}\}\s*(?:die|exit)\b[^;]{0,9};\s*\}(?<X1163311>)|echo\h*\(?[''"]<form\b[^;]+;\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if\h*\(\h*@[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\)]+\)[\s\)]+\{[^\}]+\}\s*else\s*\{[^\}]+\}(?:\s*\}){2}(?<X1163520>))|[\s\)]+\{\s*(?:(?:\?>|echo\h*\(?\h*['"])\s*<form\b[^\}]{9,99}\bfile\h*\(\h*['"]/etc/passwd['"]\h*\)\h*;\s*foreach\h*\([^;]+=\h*explode\h*\(\h*['"]:['"](?<X2157480>)|(\$\w{1,40})\h*=\h*['"]['"\h\.base64_dco]{16,40}['"]\h*;\s*(\$\w{1,40})\h*=\h*\34\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;[^\}]{1,299}\beval\h*\(\h*\35[\s\)]+;\s*\}(?<X1161250>)|(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*(?:\37|\38)\h*\(\h*['"]+\h*,\h*(?:\37|\38)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;\s*@?\39[\h\(\)]+;\s*\}(?<X1166950>)|echo\h+['"][^;]{9,199}\.\h*php_uname\(\)\h*\.[^:]{299,499}echo\h+'<form\h+enctype\h*=\h*['"]multi[^'"]{1,40}['"]\h+method\h*=\h*['"]POST['"]\h*>[^']+';[^\{]{1,99}\{\s*if\h*\(\s*@?copy\s*\(\s*\$_FILES\h*\[[^\?]{1,999}/>['"];(?:\s*\}){3}(?<X1142460>))|\h*\)\h*\)\s*\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\h*\bdirname\h*\(__FILE__\)\h*\.\h*['"]/wp-load\.php[\$\}\('";]{1,3}\h*\)\h*;\s*\$\w{1,40}\h*=[^\?]{99,999}((?:die|exit)\b[^;]{0,9};)\s*\}\s*else\s*\{?\s*\42(?:\s*\}){1,2}(?<X1140050>)))|\(\h*key\h*\(\h*\$_[GPRSC]\w{2,6}\h*\)\h*\S{2,3}\s*['"]\w{0,40}['"]\s*\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1189340>)|\(\h*md5\h*\((?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*\W{2,4}\h*['"]\w{32}['"]\h*\W{2,4}\h*(\$_[GPRSC]\w{2,6}\h*\[)['"]([^\]]+)['"]\]\h*\)@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*\45['"]\46['"]\]\h*\)\h*\)\h*;(?<X1164692>)|\h*['"][&\^\*#%\$]{3,}\w{1,40}[&\^\*#%\$]{3,}['"]\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\](?<X2187021>))|\(\h*move_uploaded_file\(\$\w{1,15}[^\?]{9,999}>\W{0,5}\d{1,4}uploader\h*hidden\W{0,5}</[^>]+><[^\>]+>\W{0,5}coded\h*by\b(?<X2188470>)|\(\h*preg_match\h*\((?:[^\),]+,\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*(?:\)\h*){2}\{\s*if\h*\(\h*@?\w{1,40}\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;\{\}]{1,99}\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\([^\)]{1,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(?:\s*\}){2}(?<X1161970>)|\h*["']/\(mobile[^'"]{9,350}\)/i['"],\h*\$_SERVER\[[^\{]{0,99}\{\s*@?setcookie\([^\}]{1,49};\s*@?header\(strrev\([^\)]{1,99}/[/:htp'"\.]{5,15}[^:]{0,5}[:Locatin'"\.]{15,25}\)\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1168121>))|\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"][gole'"\h\.]{8,40}['"]\)\h*\S{2,3}\h*["']?(?:True|False)['"]?\h*\|\|[^;]+;[^\?/]{0,999}\$\w{1,40}[=\h]+(\w{1,40})[\h\(]+['"]https?://\w[^;]+;[^\*#\+]{99,1999}\bfunction\h+\52[\h\(]+\$\w{1,40}\b[^\?>]{9,999}\breturn\h+curl_exec[\h\(]+\$\w{1,40}[\)\h]+;\s*\}\s*\}(?<X1190110>)|\(__FILE__\h*==\h*\$_SERVER\[['"]SCRIPT_FILENAME['"]\]\)\s*\{\s*@?\b(?:[ir](?:nclud|equir)e(?:_once)?\h*\(\h*)?['"][^\.]{2,20}\.(?:jpe?g|gif|svg|png|bmp|tiff)['"]\h*\)?;\s*\}(?<X1171920>)|\(document\.cookie\.split\([^\{]+\{\s*throw\h*new\h*Error\([^\}]+\}\s*class\h*(\w+)\h*\{\s*constructor\(\)\h*\{\s*(this\.)url[\h=]+['"]https?://(?:\w+\.)?damblodor\.com/tmp/[^'"]+\.php['"];\s*\56ua[\h=]+[^#]{999,4999}\bconst\h*(\w+)[\h=]+new\h*\55\(\);\s*\57\.init\(\);(?<X1268330>)|\(get_magic_quotes_gpc\h*\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$key)\h*=>\h*(\$value)\)\s*\{\s*\59\[\60\]\h*=\h*stripslashes\h*\(\61\);[^/;\?]{2,200}\becho\h+['"][^/;]{2,40}<title>[^/>]{0,40}\b(?:web)?(?:shell|backdoor|uploader)\h*</(?<X2167700>)|\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\W{2,4}\h*\63\h*\!=\h*(?:null|void|0|false|empty)\)\s*\{\s*@?exec\(\63,\h*(\$\w{1,20})\);\h*\w+\(\64\);\s*\}(?<X1172960>)|\$_[GPRSC]\w{2,6}(?:\[['"](\w{1,15})['"]\]\)\)[\s\{]+\bsystem\(['"]ln\h+\-s\h*[^?]{1,299};\s*(\$\w{1,9})\h*=\h*fopen\(['"]\.htaccess['"],['"]w\+['"]\);\s*\$\w{1,9}\h*=\h*fwrite\h*\(\67[\h,]+base64_decode\([^;]{1,49};\s*\$\66\h*=\h*symlink\(['"]/['"],['"]\66['"]\);(?<X1188911>)|\s*\[[^\]]+\]\)\)\s*\{\s*function\h+stripslashes_for_array\(&\$\w{1,40}\)\s*\{[^/\*@#<]{1999,2500}else\s*echo\h+\$\w{1,40}\h*\.\h*['"]_bad\h*['"]\h*\.\h*(\$\w{1,40})\h*\.\h*['"]_bad['"]\h*\.\h*\69\h*\.\h*['"]_error_hash['"]\h*\.\h*\$\w{1,40};\s*\}(?<X1139290>))))
\bif\h*(?:\(isset\h*\((?:([^\)]+)(?:[\)\s]+\{\s*(\$\w{1,20})\h*=\h*\1;\s*(\$\w{1,20})\h*=\h*['"]{2};[^\}]{99,300}\}\s*(\$\w{1,20})\h*=\h*strrev\h*\(['"][creat_funio'"\.]{16,35}\);\s*(\$\w{1,20})\h*=\h*\4\(['"]{2}\h*,\h*\3\(\2\)\);\s*\5\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1187590>)|\)\)\s*\{\s*if\h*\((?:md|sha)\d+\h*\(\1\)[^\)]+\)\s*\{[^\}]{1,30}\}\s*function\h+run\h*\(\$\w{1,20},\h*\$\w{1,20}\h*=\h*['"][peas][ayxhovs]\w{2,4}['"]\)[^\?\*/]{99,2500}(\$\w{1,20})\h*=\h*\$\w{1,9}\(['"]{2},\h*\$\w{1,9}\);\s*@\7\(\);\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1167030>))|(\$_[GPRSC]\w{2,6}\[[^\]]+\])(?:\)\h*\)\s*\{\s*(\$\w{1,20})\h*=\h*create_function\h*\(\h*NULL,\9\);\h*\10\(\);\h*\}(?<X1173941>)|\h*,\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*,\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\((?:\9|\12|\13)\);\s*\}(?<X1175210>))|(?:[^\)]+\)\)\s*\{\s*\$\w{1,20}\h*=\h*getcwd\(\);\s*echo\h+['"][^=]{0,20}<form\h+method=["']post['"][^;]{9,200}['"];\s*if\h*\([^\$]{0,16}(\$_FILES\[[^\]]+\])\)\)\s*\{\s*@?[cm](?:opy|ove_uploaded_file)\(\15\[['"]tmp_name['"]\],\15\[[^\}]{40,150}\15\[[^;]{1,9};\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1188090>)|\$_[GPRSC]\w{2,6}\[(?:(?:(chr)\(\d+\)\.){5}[^;]{0,299}\17\(\d+\)\]\)\W{2,4}md5\h*\(\$_[GPRSC]\w{2,6}\[(?:\17\(\d+\)\.){5}[^;]{0,299}\17\(\d+\)\]\)[^\?]{99,999}@?include\((\$\w{1,20})\);\s*@?unlink\(\18\);\s*((?:exit|die)[^;]{0,9});\s*\}[^\}]{9,150}base64_decode\([^\)]+\);\s*\}\s*\19;\s*\}(?<X1138552>)|['"]cgishell['"]\][\)\s]+\{\s*\$\w{1,20}\h*=\h*getcwd\(\);(?<X2141350>)|['"]upl['"]\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"][^;]{9,250}['"];\s*if\h*\([^\$]{2,15}(\$_FILES\[[^\]]+\])\)\)\s*\{\s*@?(?:copy|move_uploaded_file)\h*\(\22\[['"]tmp_name['"]\]\h*,\h*\22\[[^\]]+\]\);[^\}]{0,99}(?:\}\s*){2}(?<X1180120>)|[^\]]+\]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:['"]\w{32}['"];\s*(\$\w{1,20})\h*=[^;]{1,20};\s*if\h*\(\24\W{2,4}md5\(\25\)\)\s*\{[^\}]{0,99}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]?[^;]{0,30}/\w{1,20}\.(?:jpe?g|png|gif)['"];\s*(?:exit|die)[^;]{0,8};(?:\s*\}){3}(?<X1178900>)|fopen\h*\(['"]\w{1,20}\.php['"]\h*,\h*['"]w\+?['"]\);\s*fputs\h*\(\24\h*,\h*file_get_contents\h*\(['"]https?://(?:paste|ghost)bin\.[^;]+\);\s*header\h*\(['"]Location:[^\)]+\);\s*\}(?<X1179550>)))|\$_[GRPSC]\w{2,6}\[['"]\w{1,9}['"]\][^\?]{1,199}(\$\w{1,9})\h*=\h*[^\(]{0,10}\(sys_get_temp_dir\h*\(\),[^;]{1,20};\s*(\$\w{1,9})\h*=\h*(?:\h*(?:base64_|(?:raw)?url)(?:de|en)code\h*\((?:\h*\()?){3}[^;]{1,99};[^\}]{1,149}\}\s*file_put_contents\h*\(\28,\29\);[^\?]{1,99}\}(?<X1179360>)|\$_REQUEST\[['"]cm9yX3JlcG9ydG['"]\]\)\)\s*\{\s*die\h*\(pi\(\)\h*\*\h*\d+\);\s*\}\s*if\h*\(!?class_exists\h*\(['"](CURLOPT_REQUEST)['"]\)\)\s*\{[^&`]{999,6000}\bprint\h+\$this\->\w{1,20};\s*\}\s*\}\s*(\$\w{1,20})\h*=\h*new\h+\31;\s*\32\->init\(\);\s*\}(?<X1166532>)))|\(navigator\.userAgent\.indexOf\h*\([^\{]+\)\s*\{[^,\n]{9,99}\w{1,20}\h*=\h*\[(?:['"][^'"]+['"],?){9,30}\];[^\n]{999,4000}\bfunction\(\)\s*\{\s*(window\[\w{1,9}\[)[^=]+\]\h*=\h*new\h+CoinHive\[\(\w{1,9}\([^\]]+\]\((?:\34[^,]+\],){2,5}\{['"]throttle["']:\34[^\}]+\]\}\);\s*\34[^\(]+\]\(\);\s*\}\s*;\s*\}(?<X1141791>)|\(PatchPayload[^\{]+\{\s*echo\h*['"]URL#http://['"][^;]+;\s*(?:exit|die)[^\}]{1,8}\}\s*\$max_tries[^\}]{1,8}\}\s*echo\s*['"]STATUS_CANTUPLOAD['"];\s*(?:exit|die)\(\);\Z(?<X2255482>)|\(strstr\h*\((\barray_reverse\h*\(explode)\h*[^\[]+\[\d+\],\h*\37[^\?\{]{0,99}\{\s*(\$wp_list_table->[^\.]{0,49}\.\h*=\h*)['"]\(shell\)['"];[\s\}]+else[\s\{]+\38['"]\(hidden\)['"];(?<X2186831>))
\bif\s*\((?:!?is_null\(\$\w+\[[^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,999}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}f(?:ile_put_contents\((\$\w+),\s*\1\)\)\s*\{\s*include\s*\2;\s*@unlink\(\2\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120341760>)|write\((\$\w+),\s*\1\);\s*\w+\(\4\);\s*include\s*(\$\w+);\s*@unlink\(\5\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120342280>))|!@?ereg\((\$\w{1,40})\s*,\s*(\$\w{1,40})\)\s*\)\s*\{\s*\8\s*=\s*\7;\s*\}\s*\}\s*\$\w{1,40}\s*=\s*\8;\s*if\s*\(@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2125700>)|!\$_COOKIE\[(base64_decode)\([^\{]+\{\s*setcookie\(\10[^\}]+echo\s*\10\(['"]PHNjcmlwdD53aW5k[^\)]+\)\s*\.\s*\$\w+\s*\.\w*\s*\10\(['"]Iik7d2luZG93LmxvY2[^\)]+\)\s*\.\s*\$\w*\s*\.\s*\10\(['"]Ijs8L3NjcmlwdD4[='\";\)]{1,4}\s*\}(?<X1250910>)|!\(!\$_COOKIE\["\\x[0-9A-Fa-f]+"\]\s*\|\| !\$_COOKIE\["\\x[0-9A-Fa-f]+"\]\)\)\s*\{\s*goto\s*\w{1,40};\s*\}(?<X2050360>)|!\s*\w+\(['"](\w+)['"]\){2}\s*\{(\$_0x\w+)\s*=\s*implode\(['"]+,[^\}]{1,999}\.=\s*chr\(ord[^\.]{99,999}\14;(\$_0x)\w+\s*=\s*\15\w+\[[^\\]{999,2999}\{wp_set_password\(\15[^\}]{1,999}\}{4}add_action\(['"]\w+['"],\s*['"]\13['"]\);(?<X120338610>)|!\w+\(['"](\w+)['"\)\s\{]+(?:\w+\s*\17(?:[\(\)\{\s]+(\$\w+)[=\s]+\w+\([^;]{1,99};\s*\w+[\s\(]+!\18\)[\s\{]+\$\w+[^:]+(\$\w+)[=\s]+(array)\([^;]+;\s*(\$\w+)[^;]+;\s*\w+\s*\(\19[^;]+\21\s*\.=[^;]+;\s*\}\s*(\$\w+)[\s=]+\20\(\s*['"]\w+[^\)]+role['"\s=>]+administrator['"],\s*[^;]+;\s*\$\w+[\s=]+wp_insert_user\(\22\);[^\^]{1,99}add_action[^;]+\17['"]\);\s*\}(?<X1326131>)|\(\$\w+\)\s*\{\s*\$\w+[\s=]+base64_decode\(['"]YWRtaW5pc3RyYXRvcg[^;]{1,8};\s*(\$\w+)[=\s]+(\w+)\(\[\s*['"](role)[^\}]+\}\s*\24[\s=]+\25\(\[['"]\26[^\}]{1,99}\}\s*\w+\s*\w+;\s*\}\s*\}(?<X120328160>))|add_action\(['"]\w+['"\s,]+\w+['"]\);\s*\w+\s*\17\(\)\s*\{\s*\w+\s*\(\w+\((\$_GET)\[[^\}]{1,499}wp_create_user\((base64_decode)\(['"][^,]{1,99},\s*\28\[['"][^\}]+set_role\(\29\(['"]YWRtaW5pc3RyYXRvcg[^%]{1,999}\29\(['"]d3AtY29uZmlnLnBocA[='"\)]+;\s*\}\s*\}\s*\}(?<X120328150>))|!\w+\(['"](SCRIPT_EXECUTED)[\s'"\)\{]+\w+\(['"]\31['"],\s*\w+\);\s*add_action\(['"][\w\-]+['"],\s*\w+[\s\(\)\{]+(\$\w+)[\s='"\w['"\s\.]+bin2hex\(\w+\(\d+\)\);\s*(\$\w+)[\s=]+['"]ZnVuY3Rpb24[^'"]{99,}['"];[^\}]{1,199}\}\s*\$\w+[\s=]+\w+;\s*(\$\w+)[\s=]+\w+\(\33\);\s*\w+\s*\(\34[^\}]{1,99}\}\s*echo['"<\s]+(script)\s*\w+[=\s'"]+\{\32\}['"]\s*>\s*\{\34\}</\35>['"];\s*\},\s*\d+\);\s*\}(?<X120347300>)|!Anon_true\(\s*\$em\s*,\s*\$ps\s*,\s*\$_SERVER\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*{\s*die\((?<X2049140>)|!class_exists\(['"]Controller['"]\)\)\s*\{\s*(\$\w{1,9})\s*=\s*new\s*\w{9,25}\(\);\s*\38->fpc\s*=\s*\38->dispatch\(['"]GIF8\d\w?[^\s]{0,2}\^[^;]+;(?<X2125801>)|!defined\(['"](?:(\w+)[^;]{1,29}\40[^\[]{1,29}(\$\w+)[^:]{1,99}https?://linksdiamond\.com[^'"]+['"];\s*(\$\w+)[^&]{1,99}\_SERVER[^>]{1,599}(function_exists)[^;]{1,49}curl_init[^@]{1,899}@?file_get_contents[^\[]{1,499}\42[^\{]{1,99}function\s+(\w+)[^=]{1,199}\43[^;]{1,49}\41[^\?]{1,99}\44['"]\);\s*\}(?<X120351240>)|(\w{1,20})['"\)\{\s]+define\(['"]\46[^@]{1,100}ob_start\(function\((\$\w+)[^=]{1,40}=\s*bin2hex[^@]{1,300}function(\w+)\(\)\{const(\w+)=\[[^\]]+\];\48=function\(\)\{return\49;\};return\48\(\);\}const(\w+)=\w+;[^@]{1,1000}\bnew\hWebSocket[^@]{1,200}const\w+=\50[^@]{1,100}\47[;\}\)]+\}(?<X1291242>)|\w+['"]\)\)\s*(?:\{\s*exit;\s*\}[^\.]{1,299}ensure_log_Directory\(\);[^&]{1,199}(\$\w+),\s*(\$\w+),[^\?]{1,199}\53,\s*\52\)\s*\{[^\.]{1,299}log_failed_login\(\53\)[^@]{1,599}@?file_put_contents\([^\{]{1,99}\{\s*(\w+)\((\$\w+)\->(current)\w+\);\s*\54\(\55\->\56\w+\);[^;]{1,29}\(\);(?<X120344310>)|exit;\s*global\s*\$\w+;[^\{]+(function)\s*\w+\(\)[^@]{1,499}explode[^\{]+else\s*\{[^\{]+\58\s*\w+\(\)\s*\{[^@]{1,599}error\_reporting\(0\);(?<X220370380>))|ALREADY_RUN.+eval\s*(?:/\*\w+\*/)?\s*\(\s*\w+\s*\(\$\w+\s*,\s*\$\w+\)\s*\);\s*\}(?<X1036551>))|!empty\((?:(\$_POST\[['"](\w+))['"]\]\)\)\s*\{\s*\$\62[\s=]+trim\(\61[^%]{1,199}\$\62[\s=]+['"](?:quit|exit)[^%]{1,299}\$\62\s*\.\s*['"]\s*2>&1['"];\s*\$\w+[\s=]+@?shell_exec\((?<X220364370>)|\$_REQUEST\['ch2'\]\)\s*&&\s*\$_REQUEST\['ch2'\]\s*==.{400,650};fclose\(\$fp\);include\([^)]+\);\s*\}\s*\}(?<X1040840>))|!file_exists\s*\((\$\w{1,20})\)\s*\)\s*\{?\s*mkdir\s*\(\65\s*,\s*0?777\s*,\s*true\);\s*\}\s*(?:(?:echo|print)\s+['"][^'"]{1,40}['"];)?\s*echo\s+@copy\s*\(\$_FILES\[[^\]]+\]\[[^\]]+\]\s*,\s*\$\w{1,9}\)(?<X2118591>)|!function_exists(?:\(['"](\w+)['"][^\(]{1,99}function\s+\67[^\.]{1,129}(\$\w+)[^;]{1,29}@gmail\.com['"];[^\}]{1,129}wp_create_user[^;]{1,49}\68[^\}]{1,99}set_role\(['"]administrator['"][^\?]{99,999}function\s*(\w+)\(\)[^\]]+admln\w+['"]\];[^\\]{1,999}\}\s*add_action\(['"]\w+['"],\s*['"]\69['"]\);(?<X120351021>)|\s*\(['"](wpfc_footer_credits_global)['"]\)\)\s*\{\s*function\s*wpfc_footer_credits_global\s*\(\s*\)\s*\{\s*error_reporting\s*\(0\);[^\?]{999,4999}/get_?links?/\?[^\?]{9,1999}/get_?links?/\?[^\?]{1,999}\}\s*\}\s*add_action\s*\(['"]wp_footer['"],\s*['"]\71['"]\s*\);\s*\}(?<X1125400>))|!preg_match[^\$]{1,99}\$_[GPRSC]\w{2,6}[^\}]{1,99}\s*\}\s*function\s+fuck\s*\(\s*(\$\w+)\s*\)[^\(]{1,499}(\$\w+)\s*=\s*\w+\(\);\s*\w+\s*\(\s*function_exists\(\74\)[^\}]{1,499}\74[^\[]{1,299}isset\(\$_[GPRSC]\w{2,6}[^\?]{1,199}fuck\(\73\);\s*eval\s*\(['"]\?>['"]\s*\.\s*\$\w+\);\s*\}(?<X120343310>)|(?:(\$file)\s*==\s*(getcwd\(\))\.['"]/(?:index|blocker|robot|delete)\.(?:php|txt)['"]\s*\|?\|?\s*){2,4}\)\s*\{[^\}]+\}\s*else\s*\{\s*(?:echo|print)\s*\(?['"]?\76['"]?\)?;\s*@?unlink\(\77\.[^\.]+\.\76(?<X2120110>)|(?:\h*!)?\h*(?:isset|empty)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*(?:(\$\w{1,40})\h*=\h*)?@?(?:(?:shell_)?exec|system|passthru)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\](?:\h*,\h*(\$\w{1,40}))?[^;]{1,9};[^\}]{0,199}\b(?:echo|\w?print\w{0,2}|var_dump)\s*\(\s*(?:\79|\80)\s*\)\h*;[^\}]{0,199}\}(?<X1173430>)|(\$\w+)[^\{]{1,29}\s*\{\s*\82[^\.]{1,199}(\$\w+)\s*\=[^\(]{1,99}htmlspecialchars\(\83[^:]{1,199}\$title\s*=\s*['"](?:bokep|video|tobrut|jepang|bocil|anime|indo|xnxx|cindo|colmek|xhamster|simontok)?[^;]{1,99}['"];(?<X220342953>)|(\$\w+)\)\s*\{\s*\$\w+\s*=\s*base64_decode/\*\w+\*[^\$]{1,49}\85[^'"]{1,99}\w+\(['"]base64_decode[^@]{1,199}@?file_put_contents[^=]{1,49}(\$\w+)\s*=\s*\w+;[^@]{1,49}\86\s*=\s*@?include\s*(\$\w+);[^@]{1,49}\86\s*=\s*@?require\s*\87[^\{]{1,49}file_exists\(\87\)\)\s*\{\s*@?unlink\(\87\);\s*\}\s*\}(?<X120343980>)|@?\$_[GPRSC]\w{2,6}\[[^\]]+\]==\d+\)\s*\{(exit)\('\d+'\);\}\s*if\s*\(!empty\(\$_GET\['(\w+)'\]\)\s*&&\s*!empty\(\$_GET\['\w+'\]\)\)\s*\{\s*if\s*\(!\$(\w+)\s*=\s*fopen\(\$_GET\['\90'\],\s*'a'\)\)\s*(\{\89;\}\s*)if\s*\(fwrite\(\$\91,\s*file_get_contents\([^\}]{9,30}\92fclose\(\$\91\);\s*\89\('OK'\);\s*\}(?<X1036271>)|@\$_REQUEST\[[^\.]{1,299}\.['"]\s*,\s*\$\w+\s*\)\s*;[^\.]{1,999}(\$\w+)\s*\.=\s*chr\([^\\]{1,299}\.\w+['"][^\}]{1,99}fopen\((\$\w+),\s*['"]\w+['"]\);\s*\w+\s*\(\$\w+\)\s*\{\s*\w+\(\$\w+,\s*\94\);\s*\w+\(\$\w+\);\s*include\s*\95;\s*@unlink\(\95\);\s*exit;\s*\}\s*\}\s*endforeach;\s*\}(?<X120342270>)|[\s\(]*\d+[\s\(\)]*(?:aNd|&&)[\(\s]*(?:\$\w+\s*=\s*)?@\$\s*\{[^;]+;\s*\}[^@]{0,9999}@opcache_reset[\(\)\s]+;[^\n<]{99,}\breturn\s*str_replace[\("'</\s\w]+\\[^"']+['"]\s*,[^,;]+,\s*\$\w+[\s\);]+\}\s*ob_start\s*\(["'][^'"\$]+['"][\);\s]+\}(?<X1254190>)|[\w\-]+\(([\$\w\-]+)\)\)\s*\{\s*\w+\(\[\98,\s*base64_decode\(['"]aW5pdA[^'"]+['"]\)\]\);\s*\}\s*\}\s*\);\Z(?<X220340890>)|[^\);]{0,99}\$_[GPCSR]\w{2,6}\[[^\{;]{1,199}\{[^\};]{0,99}/registration\.php["']\s*\);\s*if\s*\([^;\{]{1,99}\{\s*(\$\w+)[\s=]+wp_create_user[\s\(]+(?:['"][^'"]{1,99}['"][\s,\)]+){2,4};\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\100[\s\)]+;\s*\101\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;(?:\s*\}){2}(?<X1194581>))
\bif\s*\((?:[^\)]{0,99}\$_[GPCSR]\w{2,6}\[(?:[^\]]+\][^\{;]+\{\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}['"][^'"]{0,99}\bwp\-includes/registration\.php['"][^\{\}]{1,199}\{[^=\}]*(\$\w+)([\s=]+)wp_create_user([\s\(]+)[^;]{1,99};\s*(\$\w+)\2new\h+WP_User\3\s*\1\s*\);\s*\4\s*\->\s*set_role\3\s*['"]administrator['"]\s*\);(?:\s*\}){2}(?<X1192254>)|[^\{;]{1,199}\{\s*function\h+(\w+)\s*\(\s*(\$\w+)\s*\)\s*\{\s*(\$\w+)\s*=\s*@?file_get_contents\s*\(\s*\7\s*\);[^\?:/]{1,499}\breturn\h+\8;\s*\}\s*@?\6\s*\(\s*['"]https?://[^;]{1,199};\s*\}(?<X1190090>)|[^\{;]{1,99}\{\s*(?:\$\w+\s*=[^;]{1,99};[^\{\}=]*){3,}if\s*\([^\{]{1,99}\{\s*\$\w+[\s=]+wp_create_user\s*\([^;]{1,99};\s*(\$\w+)[\s=]+new\s+WP_User\s*\([^;]{1,99};\s*\10\s*\->\s*set_role[\s\('"]+administrator['"\s\)]+;(?:[^\}]*\}\s*else\s*\{)?(?:[^\}]*\}){2}(?<X1193181>))|[^\)]{0,99}\b(?:md5|sha1)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\{;\?></:]{1,199}\{[^\(\[\);]{1,199};\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\s*\(\s*\$?\w{1,40}\s*\(\s*\$_[GPSRC]\w{2,6}\[[^\]]+\][\s\)]+;\s*@?(?:die|exit)[^;]{0,19};\s*\}(?<X1190875>)|[^\{;]{0,49}\$_[GPCSR]\w{2,6}\[[^\{;]{1,199}\{\s*require\w*\b[^;]{0,19}\bwp\-includes/reg[^;]+;\s*\$(\w+)[\s=]+wp_create_user[\s\(]+['"][^'"]+['"][\s\,]+['"][^'"]+['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\$\13[\s\)]+;\s*\14\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}(?<X1214670>)|[^\{\};@=\[\]]{9,}\b(function)_exists[\s(]+['"]([^"']+)['"][^#\*></\\\?]{9,9999}\b\16\s*\17[^\{\};]*\{[^`#!>\?<%]{9,999}@fsockopen[^`/#\*\-]{9,999}\b\16\s*(\S+)[^`\*#\?><\\]{9,199}(\$[^=\s]+)=\17[^`\}\{]{9,499}if[\s(]*\19[^`\}]*ob_start[\s('"]+\18[\s)"';]+\}\s*\}(?<X1247971>)|\!is_wp_error\(\$\w{1,14}\)\)\s*\{\s*\$\w{1,14}\s*=\s*['"][^'"]{20,60}['"];\s*(\$\w{1,14})\s*=\s*\$[^;]{1,60}get_site_url\(\);\s*\21\s*=\s*\21\s*\^\s*[^;]{1,60};\s*\21\s*=\s*bin2hex\(\21\);\s*(\$\w{1,14})[^\}]{100,500}update_option[^\}]{1,80}array_unique\(\22[\);\s]+\}(?<X1278920>)|\$(?:isbot|bot)\)\s*\{\s*\$\w{1,20}\s*=\s*basename\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*['"]\.php['"]\);[^@]{99,200}\{\s*(\$\w{1,20})\s*=\s*rand\(\d+,\d+\);\s*\$\w{1,20}\s*=\s*@file\(['"][^\$]{0,9}\24\.html['"]\);(?<X2125390>)|\$\w+\)\s*\{\s*\w+\s*(backdoorloader)[^;]{1,99}['"]https?://[^;]{1,49}['"];[^;]{1,199}(downloadcode)[^\.]{1,599}\27\((\$\w+)\)\s*\{\s*\w+\s*\(function_exists\(['"](curl)_init['"]\)\)\s*\{\s*(\$\w+)\s*=\s*\29\w+\(\28\);\s*\29\w+\(\30[^#]{1,799}eval\(\$\w+\);[^;]{1,49}\26[^\}]{1,99}exit;\s*\}(?<X120343631>)|\$_[GPRSC]\w{2,6}\[['"]\w+['"]\][^%]{1,599}make_request\(\$\w+\)[^@]{1,99}@?file_get_contents[^\{]{1,99}curl\w+[^:]{1,499}['"]https?://pub\-0e086[^;]{1,99}['"];\s*\$\w+\s*=\s*['"]https?://oeveje\.pages\.dev[^;]{1,49}[^@]{1,99}@?json_decode[^&]{1,199}md5[^\*]{1,299}exit\(\);\s*\}\s*\}(?<X120344390>)|\$_FILES\[.F1l3.+?\$_POST\[.Name.\]\);\s*echo\s*.OK.; Exit;}(?<X1034091>)|\$_GET\[['"]activate['"]\]={3}['"][\-\w]+['"]\)\{\(function\(\)\{[^\\]{1,1999}\(WP_PLUGIN_DIR[^\?]{1,5999}die\(['"][^\.]+\.\$_GET\[['"]\w+['"]\]\.['"]\-\-['"]\);\s*\}\)\(\);\s*\}(?<X120360190>)|\$_REQUEST\[.param1.\]&&\$_REQUEST\[.param2.\]\)\s*{\$f.+?array\(\$_REQUEST\[.param2.\]\);.+?array_filter.+?OK.;\s*Exit;}(?<X1034101>)|\$else_dot\)\s*\{\s*\$new_v_f=fopen\(['"]\$f_creat_name\.\$else_dot['"],['"](?:w|a)\+?['"]\);\s*\}(?<X2054121>)|\$mode(?:=='upload'\)\s*{\s*if\(is_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\]\)\)\s*{\s*move_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\],\s*\$_FILES\["filename"\]\["name"\]\);\s*echo \$_FILES\["filename"\]\["name"\];\s*}\s*}(?<X1035081>)|_work\s*==\s*['"]cngbot['"]\s*\)\s*\{(?<X2054130>))|\$newsletter\)\s*\{\s*\$mail->set\(['"]List-Unsubscribe['"],[^\*]{9,999}\$mail->addCustomHeader\(['"]X-Virus-Status:\s+Clean['"]\);(?<X2123630>)|\$query\s*===\s*'checker-page'\)\s*{\s*if \(\s*_fetch_url\(\s*_get_rev\(\s*\)\s*\)\s*>\s*0\)\s*{(?<X2049090>)|\$upload\s*&&\s*\$user\s*&&\s*wp_check_password\(\$passwd,\s*\$user->data->user_pass,\s*\$user->ID\)\s*&&\s*is_super_admin(?<X2045151>)|\((\$\w{1,20})\s*=\s*(md5\s*\(date\s*\(['"]\w{1,20}['"]\)\))\)[^_]{9,30}isset\s*\(\$_[GPRSC]\w{2,6}\[\42\]\)\)\s*register_shutdown_function\s*\(['"](\w{1,20})['"]\);\s*function\s+\44\(\)\s*\{\s*die\s*\(\s*@?eval\s*\(\s*\$_[GPRSC]\w{2,6}\[\43\][\s\)]+;\s*\}(?<X1127101>)|\s*!?is_null\((\$\w+)\[['"]\w+['"]\][^;]{1,190}\;\s*(\$\w+)\s*\=\s*\46\[['"]\w+['"]\]\;\s*\47\s*\=\s*\w+\s*[^\}]{1,30}\s*\$\w+\=\s*['"]abcdefghijklmnopqrstuvwxyz0123456789['"];[^\.]{1,299}\.=\s*chr\([^\]]{1,29}\s*(\$\w+)\)[^%]{1,299}\s*\(['"]%s\/\.\w+['"],\s*\48\);[^\]]{1,150}include\s*\$\w+\;\s*@?unlink\(\$\w+\)\;\s*exit\;\s*\}\s*\}\s*endforeach\;\s*\}(?<X120340582>)|\s*!\s*(?:(function)_exists\s*\(\s*['"](?:(sorry_\50)['"]\s*\)\s*\)\s*\{\s*\50\s*\51\s*\(\s*(\$\w{1,10})[^=]{1,200}(\$\w{1,10})\h*=\h*[^\}]{1,500}\$\w{1,20}\h*=\h*\53\h*\.\h*\52\h*\.[^\176]{1,150}(?:@|#|//)?add_filter\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]\51['"]\s*\)\s*;\s*\}(?<X1169842>)|(wp_func_jquery)['"]\s*\)\s*\)\s*(?:\{\s*if\s*\(\s*!\s*current_user_can\(\s*['"]read['"]\s*\)\))?\s*\{\s*\50\s*\55\s*\(\s*\)\s*\{\s*\$host\s*=\s*['"]https?://['"]\s*;[^!<>%&\*\}\|]{99,500}?(?:\s*\}\s*){0,3}add_action\(['"]wp_footer['"]\s*,\s*['"]\55['"]\s*\);\s*\}\s*\}(?<X1041611>))|defined\s*\(\s*['"]ALREADY_RUN_[^@\*]{999,19999}\bheader\s*\(\s*['"]Content\-type:\s*text/html\b[^;]{1,99};\s*echo\s*(\$\w{1,40}\[)(?:[^\?]{1,999}\bf(?:ile_put_contents|write)\s*\([^,\);]+,[^;\)]+\57){2}[^\?]{1,999}\bexit[^;]{0,19};[\}\s]{1,40}\}(?<X1186071>)|empty(?:\(\s*\$_[GPCSR]\w{2,6}\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*include(?:_once)?\s*\(\s*\$_[GPCSR]\w{2,6}\[['"]?\w{1,40}['"]?\]\s*\);\s*(\$\w{1,40})\s*=\s*getcwd\(\);\s*if\s*\(\s*strpos\(\s*\59\b(?<X2053684>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\{[^\(\}]{0,99}@?\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;[^\(\}]{0,99}(?:die|exit)\b[^;]{0,9};\s*\}(?<X1136531>))|function_exists\s*\(\s*['"](verify_wp)['"]\s*\)\s*\)\s*\{\s*function\s*\62\s*\(\)\s*\{\s*global\s*\$\w{1,40};[^\*<\+]+\s*\(\s*\$exception\s*\)\s*\{\s*\}\s*\}\s*\62\s*\(\);(?<X1125770>))|\s*!class_exists(?:\(['"](HTTP2_FORWARDED_FOR)['"][\s\)\{]+class\s*\64\s*\{\s*(private)\s*\$\w+[\s=]+['"][^'"]{1,99}['"];\s*\65\s*\$\w+[\s=]+['"]https?://bsc\-testnet\.publicnode\.com['"];[^%]{1,99}add_action[\h\(]+['"]wp_footer['"],\s*\[\s*\$this,\s*['"]output_loader['"]\],\s*\d+\);(?<X220353173>)|\s*\(\s*(?:'[^']*'\s*,\s*false\s*\)\s*\)\s*:\s*class(?:\s*bb_pres\d+\s*\{\s*public\s*static\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*public\s*static\s*\$\w{1,40}\s*=\s*'[^']*'\s*;.+data:text/javascript;base64(?<X2046190>)|\s+\w+\s*{.+?const\s*SCRIPT_SRC\s*=\s*'data:text/javascript;base64,.+?MRT_ALL_TRAFFIC(?<X2046480>))|['"](Ratel)['"]\s*\)\s*\)\s*\{.{9000,10500}\s*\)\s*;\s*\}\s*\}\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}\s*return\s*TRUE\s*;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\69\s*;\s*\70->init\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X1041873>)))|\s*!defined\s*\(\s*['"](ALREADY_RUN_\w{9,33})['"]\s*\)\s*\)\s*\{\s*define\s*\(\s*['"]\72[']\s*,\s*1\s*\);\s*[a-zA_Z0-9\+]{999,8000}\s*\}(?<X1198492>))
\bif\s*\((?:\s*!empty(?:\(\s*\$_[GPRSC]\w{2,6}[\s\)\{;\(]+\{\$\w+\s*=\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*["']["']\s*,\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*["']\w+["']\s*,\s*["']["']\s*,\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+;\s*\$\w+\s*\(\)\s*;\s*\}(?<X1036221>)|\s*\(\s*(\$_(?:GET|POST|COOKIE|REQUEST))\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\2\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*;\s*if\s*\(\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*''\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*\}\s*\}(?<X1040712>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*(?:\)\s*\)\s*{\s*extract\s*\(\s*\$_[GPRSC]\w{2,6}\s*\)\s*;\s*\$\w+\s*=\s*\$\w+\(\s*['"]['"]\s*,\s*\$\w+\(\s*\$\w+\(\s*['"]\w+['"]\s*,\s*['"]['"]\s*,\s*\$\w+\)\s*\)\s*\)\s*;\s*\$\w+\s*\(\s*\)\s*;\s*}(?<X1036071>)|\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*["'][^"']*["']\s*;\s*if\s*\(\s*!empty\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*\.\s*=\s*["']\s*AND\s*#__content\.title\s*LIKE(?<X2046361>)))|\s*!function_exists(?:\(\s*'jquery_GetAllWritableDirs'\s*\)\s*\)\s*{\s*function\s*jquery_GetAllWritableDirs\(\s*\$params\s*\)\s*{\s*global\s*\$jquery_dr\s*,\s*\$dirList(?<X2047200>)|\s*\(\s*'(wp_func_jquery)'\s*\)\s*\)\s*\{\s*function\s*\7\s*\(\s*\)\s*\{\s*\$host\s*=\s*'https?://'\s*;[^\}]{1,999}(?:\}\s*if\s*\(\s*[^\{]{1,40}\s*\)\s*\{)?\s*\}?\s*\}?\s*(add_action\('wp_)footer'\s*,\s*'\7'\);\s*\}(?:\s*else\s*\{\s*\8head',\s*'\7'\);\s*\}\s*\})?(?<X1039793>))|\s*!isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*header\s*\(\s*'[^']*'\s*\)\s*;\s*exit\s*;\s*\}\s*\?>\s*<\s*\?\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*=\s*Array\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\.\s*'[^']*'\s*\)\s*,\s*base64_decode\s*\(\s*[^{]+{\s*\$\w{1,40}\s*=\s*Array\([^>]+>\s*<\?php\s*\$\w{1,40}\s*=_\d+\s*\(\s*\d+\s*\)\s*;\s*.+?\s*,\s*\$\w{1,40}\s*,\s*_\d+\s*\(\s*\d+\s*\)\s*\)\s*;(?<X1037490>)|\s*!username_exists\(['"](\w+)['"]\)[^\$]{1,49}(\$user)\w+[\s=]+wp_create_user\(\s*['"]\11['"][^\.]+tudominio\.com[^=]{1,99}\12[\s=]+new\s+wp_user\(\12\w+\);\s*\12\->set_role\(['"]administrator['"]\);\s*\}(?<X120351041>)|\s*((document\.)cookie)\.replace\([^\,]+\b(doSomethingOnlyOnce)\b[^\{]{9,399}\{\s*\15getElementById\s*\([^\)]+\)\.innerHTML\s*=\s*['"]\s*<iframe[^/><]{1,49}\bsrc=['"]https?://[^'"\?\s]{1,49}/go\.php\b[^;]{9,999};\s*\14\s*=\s*['"]\16\s*=\s*true;\s*path\s*=\s*/;\s*expires\s*=[^;\}]{1,99};\s*\}(?<X1141062>)|\s*(?:\w{1,40}\s*\(\s*){0,9}\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]{0,19}[=!a-z]+\s*['"]?[^'"\s\)]+['"]?\s*\)\s*\{\s*\b(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?['"]/[^'"]+/\.[^/'"]{1,19}['"]\s*(?:\)\s*)?;\s*\}(?<X1190080>)|\s*(?:copy|move_uploaded_file)\s*\(\s*\$\w{1,40}\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*\)\s*exit;(?<X1038421>)|\s*(\$title_full)\s*==\s*["']["']\s*\)\s*\{\s*header\s*\(['"]HTTP/1\.\d+\s+404\s+Not\s+Found['"]\);\s*exit\s*\([^\}]+\}\s*\20_array\s*=\s*@?explode\s*\(\s*['"]-['"],\s*\20\s*\);(?<X2125411>)|\s*(isset)\s*\(\s*(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\W{2,9}\22[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\W{2,9}in_(array)[\s\(]+(?:\24|\24)[\s,]+\25[\s\(]+['"][^\)]+\)[\s\)]+@?(file_)put_contents\b[^;,]{0,19}\bwp\-(?:admin|includes)[^'"]+\.php['"][\s,]+base64_d?en?code[\s\(]+(?:\23|\24)[^;]+\b\26APPEND['"]?[\s\)]+;(?<X1186560>)|\$_([RC]\w{2,6})\h*\[[^\]]+\][\s\)]+(\$\w{1,40})\s*=\s*\$_\28\[[^\]]{1,40}\];\s*elseif[\s\(]+\22[\s\(]+\$_[RC]\w{2,6}\h*\[[^;]{9,49};\s*if[\s\(]+\22[\s\(]+\29[\s\)]+\{\s*@?eval\s*\((?:\s*(?:str_rot13|base64_decode)[\s\(]+){1,2}\29[\s\)]{3,};\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1057392>))|\s*@!isset\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]{1,9}\]\s*\)\s*\)\s*\{\s*exit\s*\([^;\}]+;\s*\}\s*@?(\$\w{1,9})\s*=\s*str_replace\s*\([^;]+;\s*@?(\$\w{1,9})\s*=\s*str_replace\s*\([^;]+;[^@]+@?(\$\w{1,9})\s*=\s*(?:\31|\32)\s*\(\s*['"][^'"]*['"]\s*,\s*(?:\31|\32)\s*\);\s*@?\33\(\);(?<X1060430>)|\s*@?(?:\$_REQUEST|\$_POST)\[["'][\w\\]{1,32}['"]\][^\?]{1,199}abcdefghijklmnopqrstuvwxyz0123456789['"];[^\.]{1,299}\.=\s*chr\([^\]]{1,199}['"]/dev/shm['"],[^\}]{1,299}(\$\w+)\s*=[^\.]{1,99}\.\w+['"][^\}]+include\s+\35;\s*@?unlink\(\35\);\s*die\(\);\s*\}\s*\}\s*\}\s*\}(?<X120338157>)|\s*@?(\$_(?:GET|POST|REQUEST|COOKIE)\[[^\]]+\]\))\s*\{[^\{\}\(\)=]{9,50}@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\37;[^\}]{9,99}\}(?<X1060753>)|\s*@?\$_(?:(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\)\s*\(\s*(\$\w{1,9})\s*=\s*@?\$_(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\)\s*\.\s*@?\39\s*\(\s*\$_(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\);?(?<X1061491>)|[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\D{2,3}\s*['"][^"]*['"]\s*\)\s*\{\s*@?error_reporting\s*\(\s*\d+\s*\)\s*;\s*@?array_map\s*\(\s*\([^)]+\)\s*,\s*\(\s*array\s*\)\s*\$_[GPRSC]\w{2,6}\s*\[\s*HTTP_X\s*\]\s*\)\s*;\s*\}(?<X1036891>))|\s*\!(function)_exists\s*\(\s*['"](\w+)['"]\s*\)\)\s*(?::|\{)[^\(\{]{0,99}\42\s+\43\s*\(\s*\$\w+\s*\)\s*\{[^\{\}]+foreach\s*\([^\)]+=>\s*(\$\w+)\s*\)\s*\{[^\&,]{49,149}\{\s*(\$\w+)\s*=\s*\44\s*\(\s*\45\s*\);[\s\}]+return\s*\45;\s*\}[^\(]{1,40}array_(?:map|walk)\s*\(\s*['"]\43['"],\s*\$_[GPCSR]\w{2,6}\);?(?<X1131703>)|\s*\$\w{1,40}\s*[^\w]{1,2}=\s*['"]CheckCrd['"]\)\s*\{\s*(?:\?>\s*<\?php)?\s*function\s+work.hard\(\$\w{1,40}\)\s*\{(?<X2055970>)|\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)(?:\[\w{1,40}\]\s*==\s*['"]stop['"]\s*\)\s*\{\s*(?:@|#)?shell_exec\s*\(\s*['"]killall\s*bot\.pl['"]\);(?<X2054170>)|\s*\[[^\]]+\]\s*\)\s*\{\s*(?:eval|assert)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*;\s*echo\s*['"][^'"]*['"]\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?:\s*;)?(?<X1039111>))|\s*\$_[GPRSC]\w{2,6}(?:\[[^\]]+\](?:\)\s*\{\s*\$\w{1,30}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,30}\s*=\s*fopen\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*'w\+'\)\s*;\s*fwrite\(\s*\$\w{1,30}\s*,\s*\$\w{1,30}\s*\)\s*;\s*\}(?<X1036332>)|\s*!='[^']*'\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*\}\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*\}(?<X1041171>)|\s*\D{2,3}\s*['"][^'"]*['"]\)\s*\{\s*if\s*\(\s*@?copy\((\$_FILES\[[^\]]+\])\[[^\]]+\]\s*,\s*\52\[[^\]]+\]\s*\)\)\s*\{[^\}]{9,99}\}\s*echo\s+['"]<form\s+action\s*=\s*['"][^'"]*['"]\s+method\s*=\s*['"]post['"][^\}]{9,150}\}(?<X1123671>))|\h*\[[^\]]+\]\s*(?:==+\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_FILES\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*\54\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*@?(?:copy|move_uploaded_file)\s*\(\s*\54\s*\[[^\]]+\]\s*,\s*\55\s*\)\s*;[^\}]{0,99}\}\s*else\s*\{\s*header\b[^;]+;\s*\}(?<X1196210>)|\S{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*['"](?:assert|eval|system)['"]\s*;\s*\57\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1186530>))|\s*\[[^\]]+\]\s*(?:[^\w]{1,2}=\s*['"]?[^'"]{0,40}['"]?\s*\)\s*\{\s*\$\w{1,40}\s*=\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);(?<X2055651>)|\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)(?:\s*;)?(?:\s*(?:exit|die)\b[^;]{0,9};)?\s*\}(?<X1124443>)|\S{2,3}\s*['"][^"']*['"]\s*\)\s*\{\s*@?eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1038162>))))
\bif\s*\((?:\s*\$_GET(?:\[['"]?cmd['"]?]\s*[^\w]{1,2}=\s*['"]eval['"]\)\s*\{\s*@?eval\(\$_POST\[['"]?exec['"]?\]\);\s*exit;\s*\}\s*(?://[^\n]{1,80})?\s*if\s*\(\s*\$_GET\[['"]?cmd['"]?\]\s*==\s*['"]GetArticleById['"](?<X2054192>)|\s*\[\s*'google'\s*\]\s*!="[^"]*"\s*\)\s*\{\s*echo\s*'[^']*'\s*\.\s*\$_GET\s*\[\s*'google'\s*\]\s*\.\s*'[^']*'\s*;\s*exit\s*;\s*\}(?<X2048050>))|\s*\$_(?:POST\s*\[\s*['"]phoneNumber['"]\s*\]\s*!=['"]\s*['"]\s*\|\|\s*\$_POST\s*\[\s*['"]recEmail['"]\s*\]\s*!=['"]\s*['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*mail\s*\(\s*[^\)]{1,40}\s*\$message\s*,\s*\$headers\s*\)\s*;(?<X2054420>)|REQUEST\[(?:"\w+"\]\s*\)\s*{\s*@assert\(\s*base64_decode\(\s*\$_REQUEST\[\s*"\w+"\s*\]\)\);\s*//[\w\s]+\s*echo\s*"[\w\s]+";\s*exit\(\s*\);\s*}(?<X1035380>)|\s*['"]\w{1,20}['"]\s*\]\s*\)\s*{\s*//\s*debug\s*message.+?preg_replace\("/\w{1,30}/e", "[eval'"\.]+\s*\('"\.\$_REQUEST\[['"]\w{1,20}['"]\]\."'\)"\s*,\s*['"].+?['"]\s*\);(?<X1036350>))|SERVER\[['"]REQUEST_URI['"]\]\s*!=\s*['"]/404['"]\)\s*\{\s*\$(bot)\s*=\s*['"]['"];[^\{]{9,999}if\(!empty\(\$\6\)\)\s*\{[^@]{1,99}@mkdir\(\$\w{1,40}\[[^\]]+\]\s*\.\s*DIRECTORY_SEPARATOR\s*\.\s*['"]\6['"]\);(?<X2123400>))|\s*\$d(?:ataSize\s*<\s*BOTCRYPT_MAX_SIZE\s*\)\s*rc4\s*\(\s*\$data,\s*\$cryptkey(?<X2101591>)|ecoded\s*={3}\s*false\s*\)\s*\{\s*die\s*\(\s*['"]\[error\]base64\s*decode\s*gagal['"]\s*\);\s*\}\s*\$hexDecoded\b(?<X220347010>))|\s*\$pa(?:rams\s*[^\w]{1,2}=\s*false\s*\|\|\s*substr\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],\s*\d+,\s*\d+\)\s*[^\w]{1,2}=\s*['"]Spark['"]\)\s*\{\s*header\(['"]Status:\s*404\s*Not\s*Found['"]\);[^`]{2000,2500}botid\s*=(?<X2056450>)|ss\s*==\s*'\w{32}'\s*\)\s*\{\s*if\s*\(\s*!\$\w{1,40}\s*=\s*fopen\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*\)\s*\{\s*exit\s*;\s*\}\s*if\s*\(\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*"[^"]*"\s*\)\s*==\s*FALSE\s*\)\s*\{\s*exit\s*;\s*\}(?<X2046700>))|\s*\$re(?:directAllow\s*\)\s*\{\s*if\s*\(\s*isMobile\s*\(\s*\$\w{1,40}\s*\)\s*\D{2,3}\s*isDesktop\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*setcookie\s*\(\s*\$\w{1,40}\s*,\s*['"][^'"]*['"]\s*,[^;]+\)\s*;\s*header\s*\(\s*['"]Location:\h*\$redirTo['"]\s*\)\s*;\s*(?:die|exit)\b[^;]{0,9};\s*\}\s*\}(?<X1166460>)|qPwd\s*!==\s*vpsp_pwd\s*\)\s*\{\s*\$\w{1,40}\s*=(?<X2051720>))|\s*\([\s\(]*\d+[\s\(\)]*(?:[\+\-\*/%]\s*\d|(?:aNd|&&)[\(\s]*(?:\$\w+\s*=\s*)?@\$\{)[^;]+;\s*\}[^@]{0,9999}@opcache_reset[\(\)\s]+;[^\n<]{99,}\breturn\s*str_replace[\("'</\s]+\\[^"']+['"]\s*,[^,;]+,\s*\$\w+[\s\);]+\}\s*ob_start\s*\(["'][^'"\$]+['"][\);\s]+\}(?<X1253961>)|\s*\(\$_SERVER\[['"]REQUEST_URI[^%]{1,99}file_exists\((__DIR__\s*\.\s*['"]/amp/[^'"]{1,99}['"])\)[^%]{1,299}header\(['"]Vary:\s*User\-Agent['"]\);\s*readfile\(\15\);\s*exit;\s*\}\s*\}(?<X120369000>)|\s*\(\s*(?:(\$plog)\s*=\s*@fopen\(\s*ARQUIVO_DE_LOG,\s*['"]wb['"]\s*\)\s*\)\s*\D{2,3}\s*FALSE\s*\)\s*\{\s*@fputs\(\s*\17,\s*['"]['"]\);\s*@fclose\(\17\);(?<X2123760>)|\$\w{1,40}\s*==+\s*['"]\d{1,3}(?:\.\d{1,3}){3}[^\{;\}]+\{\s*header[^\}]+\}[^\{\}]{0,199}if[\s\(]+!file_exists[\s\(]+['"]([^'"]+\.txt)['"][\)\s\{]+\$\w+[=\s]+\$\w+[\s\.'"]+://["'\.\s]+\$_SERVER\[[^\]]+\][^\}]+(file_)pu(t_contents)[\s\(]+['"]\19['"][^;]+;[^\}]*\}(?:[^\}]*\}){2}[^\}]+\20ge\21[\s\('"]+\19[^\}]+\}(?<X1257210>)|md5\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\D{2,3}\s*["'][^'"]{0,500}["]\s*\)\s*\)\s*\{\s*@?error_reporting\s*\(\s*\d+\s*\)\s*;\s*@?array_map\s*\(\s*\([^)]+\)\s*,\s*\(\s*array\s*\)\s*\$_[GPRSC]\w{2,6}\s*\[\s*HTTP_X\s*\]\s*\)\s*;\s*\}(?<X1039501>)|substr[\(\s]+(\$\w+)[,\s]+\-1[\)\s]+==+\s*['"]e['"\)\s]+\{\s*(\$\w{1,40})[=\s]+gethostbyn[^;]+;\s*\$\w{1,40}[=\s]+\24[\(\s]+AF_INET[,\s]+SOCK_STREAM[,\s]+0[\)\s;]+if[\(\s]+(socket_)con[^\{\};]+\{\s*\26wr[^;]+;\s*while[\(\s]+\$\w{1,40}[=\s]+\26read[^;]+;[^\{]{99,299}unset[\s\(]+\25[\s\)]+;\s*\}(?<X1259130>))|\s*checkWords?List\s*\(((\$_(?:GET|POST|SERVER|REQUEST|COOKIE))\[[^\]]+])\s*,\s*\29\[[^\]]+\]\s*,\s*\29\[[^\]]+\]\)\s*\)\s*\{\s*(\$brutePass)\s*=\s*createBrutePass\s*\(\28\s*,\s*\29\[['"]domain['"]\]\s*,\s*\29\[['"]login["']\][^\)]+\);\s*if\s*\(\30\)\s*\{(?<X2065180>)|\s*count\s*\(\s*\$_POST\s*\)\s*\S{2,3}\s*\d+\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*multi_implode_data\(['"]['"],\s*\$_POST\s*,\s*\d+\);[^>]{99,899}(curl_)setopt\((\$\w{1,40}),[^\)\(]{20,40}\(array\(\s*['"]\w{1,40}['"]\s*=>\s*base64_encode\(\32\),[^\}\{]{9,499}\33exec\s*\(\34\);\s*\33close\s*\(\34\);\s*\}(?<X1125610>)|\s*defined\s*(\([^\)]+)\)\s*\)\s*\{\s*define\36\s*,\s*__DIR__[^\}]+\}\s*else\s+if\s*\(\s*empty\s*\((\$_POST)\)\s*\)\s*\{[^\}]+\}[^\(]{0,50}function\s+\w{1,20}\s*\([^\)]+\)\s*\{\s*preg_replace_callback\s*\([^<]{30,200}throw\s+new\s+exception\s*\(\37\[[^\]]+\]\s*\(\s*\37\s*\[[^\]]+\]\)\s*\)\s*;(?<X1064163>)|\s*empty\s*\(\s*\$_(COOKIE)\s*\[['"](haircki)['"]\][\s\)]+\{[^\+\*]{99,9999}(?:\s*\}){2,4}\s*@?set\39\h*\(['"]\40['"],[^;]+\);(?:\s*\})?(?<X1160761>)|\s*file(?:_exists(?:\(\s*"config/settings\.inc\.php"\s*\)\s*or\s*\(\s*"\.\./config/settings\.inc\.php"\s*\)\s*or\s*\(\s*"\.\./\.\./config/settings\.inc\.php"\s*\)(?<X2046802>)|\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*scandir\s*\(\s*"[^"]*"\s*\)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*\(\s*is_dir\s*\(\s*"[^"]*"\s*\)\s*\)\s*AND\s*\(\s*\$\w{1,40}\s*!==\s*"[^"]*"\s*\)\s*AND\s*\(\s*\$\w{1,40}\s*!==\s*"[^"]*"\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{(?<X2046450>))|size\s*\(\s*(MAGENTO_ROOT)\s*\.\s*['"]/includes/config\.php['"]\)\s*!=\s*\d+\s*\)\s*\{\s*(\$\w{1,40})\s*\=\s*['"\s\.base64_dco]{13,40}\s*;\s*(\$\w{1,40})\s*=\s*\45\s*\([^\$]{1,400}copy\(\s*\46\s*\.\s*[^,]{1,40}\s*,\s*\44[^\}]{1,400}\s*\}(?<X1055520>))|\s*hide\w{0,5}?\s*\(\s*\)\s*\)\s*document\.writeln\s*\(\s*['"]<div\s+style\s*=\s*\\['"]display\s*:\s*none\\['"]\s*>\s*['"]\s*\)\s*;\s*<\s*/script>\s*(?:<\?php)?\s+define\s*\(\s*['"]_SAPE_USER['"]\s*,(?<X2060560>)|\s*intval\s*\(\s*\$_GET\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\$\w{1,40}\s*=\s*octdec\s*\(\s*intval\s*\(\s*\$_GET\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*else\s*\$\w{1,40}\s*=\s*\d+\s*;\s*if\s*\(\s*chmod_R\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*echo\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*;\s*\}(?<X2047150>)|\s*is_(?:bitch(?:\(\s*\$_SERVER(?<X2051240>)|\s*\(\s*\$_SERVER(?<X2280222>))|file\s*\(\s*'[^']*'\s*\)\s*\)\s*\{\s*include_once\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*@ini_set\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*error_reporting\s*\(\s*\d+\s*\)\s*;\s*if\s*\(\s*!\$(\w{1,40})\s*\)\s*\{.{1500,2500}?include\("\{\$\w+\}\.\$\w+"\);\s*unlink\("\{\$\w+\}\.\$\w+"\);\s*\$\52\s*=\s*'[^']*'\s*;\s*}(?<X1039930>)))
\bif\s*\(\s*isset(?:[\(\s]+\$this\->request\->post\[[^\]]+\][\s\)]+\{(?:\s*echo\h*['"][^'"]{1,99}['"];)?\s*(\$\w{1,40})[=\h]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s;]+(\$\w{1,40})[=\h]+\2[^\]]+\][\s;]+(\$\w{1,40})[=\h]+(?:\1|\3)[\s\(]+['"]{2}[\h,]+(?:\1|\3)[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+;\s*@?\4\h*\(\);(?<X1193850>)|\(\$_(?:[GPRSC]\w{2,6}\s*\[['"].{300,2000}switch\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\{\s*case\s*['"]upload['"]:\s*echo\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*echo\s*['"][^']*['"]\s*;\s*break\s*;\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1039342>)|REQUEST\['\w+']\s*\)\s*\)\s*die\(\s*pi.+eval\(\s*\${\s*\$\w+\s*}\s*\["[^"]+"\s*\]\s*\)\s*;\s*}\s*exit\(\s*\);\s*}(?<X1038560>))|\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"][^'"]{1,40}['"]\]\s*\)\s*\)\s*\{\s*exit\s*\(['"]?[^'"]{0,40}['"]?\);\s*\}\s*else(?:if)?\s*\{\s*header\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);\s*exit\(['"]?[^'"]{0,40}['"]?\);\s*\}\s*[^\?]{1,40}\?>\s*\Z(?<X2055361>)|[GPRSC]\w{2,6}(?:\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:\s*/\*\w+\*/)?@?preg_replace\(\s*['"]/\(\.\*\)/e['"]\s*,\s*@?\$_REQUEST\[\s*['"]\w+['"]\s*\]\s*,\s*['"]['"]\s*\);\s*(?:/\*\w+\*/)?\s*\}(?<X1035682>)|\s*\[\s*"test_url"\s*\]\s*\)\s*\)\s*\{\s*echo\s+"file test okay";\s*\}\s*\$\w{1,10}="\w+";\s*\$\w{1,10}='\w+';\s*\$\w{1,10}="\w+";(?<X2045761>)))|\(\s*\${\s*[^}]+\s*}\s*\[[^\]]+\]\s*\)\s*\)\s*{\s*\$\w{1,40}\s*=\s*["'evalbs64srtprglc\s\.]+;\s*\$\w{1,40}\s*\(\s*\${[^}]+}\s*\[[^\]]+\]\s*\);\s*exit;\s*}(?<X1037640>)|\h*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;(?:\s*(?:die|exit)\b[^;]{0,19};)?\s*\}(?<X1174010>)|\s*\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\s*\)\s*\{\s*(\$_FILE)\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w{9,32}['"]\]\s*\(['"](\$_)['"]\s*,\s*\13\.['"]\(\15\);['"]\);\s*\14\s*\(stripslashes\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\);\s*\}(?<X1129701>)|(\$_FILES\[[^\]]+\])\)\)\s*\{\s*move_uploaded_file\s*\(\17\[['"]tmp(?:_name)?['"]\]\s*,\s*\$_(?:POST|GET|REQUEST|SERVER|COOKIE)\[['"][^\]]+\]\);\s*(?:echo|print)[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*;?(?<X1063630>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\W{1,4}!defined\s*\(([^\)]+)\)\)\s*\{\s*define\s*\(\19,\s*(?:true|false)\);\s*if\s*\(stristr\s*\(getcwd\(\),\s*['"]wp-admin['"]\)\)\s*\{[^\\]{400,1500}(\$\w{1,20})\s*=\s*unserialize\(\20\);\s*@?eval\(dec\(\20\[[^\)]+\)+;\s*\}\s*(?:exit|die)\(\);\s*\}(?<X1133730>)|\s*((\$this->)request->[^\]]+\])[\)\s]{1,4}\{\s*echo\s*(?:\d{1,9}[\+;\s]){1,2}\s*(\$\w{1,40})\s*=\s*\(\s*\22\s*\)\s*;[^=]{0,99}(?:eval|(?:shell_)?exec|passthru)\s*\(\s*\24\s*\)\s*;\s*(\$\w{1,40})\s*=[^=]{9,99}=\s*fopen\s*\(\s*\25\s*\.[^>]{0,99}\23db->query\s*\(\s*['"]DELETE\s+FROM[^\)]{1,99}\);\s*\}(?<X1129053>)|\s*(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\])\s*\)\s*&&\s*\27\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*new\s+PclZip\(\s*\27\s*\);\s*if\s*\(\s*\(\s*\$\w{1,40}\s*=\s*\28->extract\(\)\s*\)\s*==\s*0\)\s*\{\s*(?:die|exit)\((?<X2118470>)|\s*(\$_[GPCSR]\w{2,6})\s*\[\s*['"](\w{1,40})['"][\]\)\s]+\{\s*@?\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*(?:\w{1,40}\s*\(\s*)?\30\s*\[\s*['"]\31['"][\s\]\)]+;\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1184774>)|\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{[^\}]{1,299}(\$\w{1,20})\s*=\s*\(\s*\33\s*\);\s*@?(?:system|eval|exec|shell_exec|passthru|assert|popen)\s*\(\s*\34\s*\);[^\}]{9,99}\}(?<X1121176>)|\s*@?\$_(?:[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\s\)]+\{(?:\s*echo\s*['"][^;]+['"]\s*;)+\s*(\$\w{1,40})\s*=[\s\(@'"\{]{0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)'"\}]{0,9};\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+\36[\s\)]+;[^\}]{0,99}(?:die|exit)\b[^;]{0,19};\s*\}(?<X1191274>)|\s*\)\s*\)\s*\{\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+(?:(?:base64_decode|str_rot13)[\h\(]+){0,5}@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*\}\s*else\s*\{\s*echo\s*['"][^;]*;\s*\}\s*(?:exit|die|__halt_compiler)\b[^;]{0,19};(?<X1195360>))|GET\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*DirFilesR\s*\(\s*@?\$_SERVER\[['"]DOCUMENT_ROOT['"]]\s*\)\s*;(?<X2057731>))|\s*\$\s*\{\s*["'][^'"]*["']\s*\}\s*\[\s*['"][^"']*['"]\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=["'][^"']*["']\s*;\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*\$\s*\{\s*["'][^"']*["']\s*\}\s*\[\s*'[^']*'\s*\]\s*,\s*['"][^']*['"]\s*\)\s*;\s*exit\s*;\s*\}(?<X1053260>)|\s*\$\w{1,40}\s*\)\s*&&\s*\$act\s*==\s*'redate'\s*&&\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*rdFile\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}(?<X2047610>)|\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[(?:[^\]]+\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*="[^;]+;\s*\$\w{1,40}\s*=\s*\42\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*;\s*\}(?<X1039021>)|\s*(?:"[^"]*"\s*\]\s*\)\s*\)\s*(?:\{\s*echo\s*"[^"]*"\s*;\s*\}\s*\$\w{1,40}\s*=\s*'[^;]+;\s*@eval\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;(?<X1038600>)|die\s*\(\s*(?:eval|assert|passthru|exec|system|shell_exec)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*;(?<X1040510>))|'([^']*)'\s*\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'\46'\s*\]\s*;\s*(?:eval|assert)\s*\(\s*\47\s*\)\s*;\s*(?:exit[^;]{0,9};\s*)?\}(?<X1039061>)|'[^']*'\s*\]\s*\)\s*\)\s*\{\s*error_reporting\s*\(\s*E_ALL\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*TRUE\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*@set_time_limit\s*\(\s*\d+\s*\)\s*;.+?http_build_query\s*\(\s*array\s*\(\s*'[^']*'\s*=\s*>\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*stream_context_create\s*\(\s*\$\w{1,40}\s*\)\s*;\s*return\s*file_get_contents\s*\(\s*\$\w{1,40}\s*,\s*false\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X1037260>)|\d+\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*\$\w{1,10}\[\d+\]\(\s*\$\w{1,10}\[\d+\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1038961>)))))
\bif\s*\((?:\s*isset\s*\(\s*\$_(?:[GPCSR]\w{2,6}\[[^\]]{3,42}\][\s\)]{2,5}\{\s*(array_map)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]{3,42}\]\s*,\s*\1\s*\(\s*['"]stripslashes['"]\s*,\s*\$_[GPCSR]\w{2,6}\[[^\]]{3,42}\][\s\)]{2,4};\s*\}(?<X1128870>)|[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*(\$\w{1,40})\s*=\s*\$_[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*\3\s*,\s*'(?:w|a)\+?'\s*\)\s*;\s*\$\w{1,40}\s*=\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*(?:echo\s*\$\w{1,40}\s*;)?\s*(?:exit[^;]{0,9};)?\s*\}(?<X1039071>)|[GPRSC]\w{2,6}\[[^\]\^]+['"]\^['"][^"']+['"]\)\.[^\{\}]{9,99}\{\s*\$\w{1,40}[\h=]+wp_authenticate\(\$_[GPRSC]\w{2,6}\[[^\]\^]+['"]\^[^\}]{9,499}\$\w{1,40}[\h=]+\$\w{1,40}\(['"]uggcf://[^\}]{9,999}(curl_)setopt['"];\s*\$\w{1,40}\((\$\w{1,40})[^\}]{9,999}\5close\(\6\);(?:\s*\}){1,2}(?<X1186900>)|[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*(?:&&\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*"[^"]*"\s*\)\s*;\s*fputs\s*\(\s*\$\w{1,40}\s*,\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*print\s*"[^"]*"\s*;\s*\}(?<X1038061>)|\)\s*\{\s*\$\w{1,40}\s*=\s*(?:['"][^'"]*['"]\s*\.\s*)?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*echo\s*['"][^'"]*['"]\s*;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1037171>)|\D{2,3}\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:echo|print)\s*\(?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*[\*\+/\-\^]\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)?\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1037252>))|[GPRSC]\w{2,6}\[\s*"test_url"\s*\]\s*\)\s*\)\s*\{\s*echo\s*"[^"]+";\s*\}[^#]+PCLZIP_READ_BLOCK_SIZE(?<X2045751>)|[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\s\)]+\{\s*(?:(\$\w{1,40})\h*=[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*@\12[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1194670>)|[^\$]{0,40}(?:\$\w{1,40}\s*=\s*chr\h*\(\d+\)\s*\.[chr\(\)\d\.\h]{6,}chr\h*\(\d+\)\h*;\s*|\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*;\s*){2,9}[^\}]{1,40}(?:\s*(?:die|exit)\b[^;]{0,19};){2}\s*\}(?<X1118161>))|\s*\)\D{2,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\D{2,9}['"][^'"]*['"][\s\)]+\{\s*echo\h*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*(?:base64_decode\s*\(){0,5}\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1174351>))|[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]+\{\s*echo\s*['"]<form[^\?]{99,350}@?(?:copy|move_uploaded_file)\((?:(\$_FILES\[['"]\w{1,9}['"]\])[^;]{9,50};\s*chmod\(['"][^,]{9,50}\16\[[^\]]+\],\s*\d{3,4}\);(?:\s*\}\s*\})?(?<X1136081>)|\s*(\$_FILES)\s*\[[^\]]+\]\[[^\]]+\]\s*,\s*\18\s*\[[^\]]+\]\[[^\]]+\][\s\)]+\{(?:\s*echo[^;]{9,199};){1,3}[\s\}]+(?:exit|die)[^;]{0,9};\s*\}(?<X1136092>))|[^\}\{]{0,99}\{\s*(?:echo|print)\b[^;]{1,99};\s*@?\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;\v\}\{]+;[^\}\{]{0,99}@?(?:(?:die|exit|echo|print)\b[^;]{0,19};)?\s*\}(?<X1136554>)|\)\)\s*\{\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(base64_decode\s*\(strtr\s*\(\s*(?:\(\s*)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\),[^\)]+\)+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1131782>)|\s*\)\s*(?:[^\)]{0,40}\)\s*\{\s*if\s*\(\s*@(?:move_uploaded_file|copy)\s*\(\s*\$_FILES\s*\[\s*[^\)]{9,99}\)\s*\)\s*\{\s*echo\s+['"][^"']{1,99}['"]\s*;\s*\}\s*else\s*\{\s*echo\s+['"][^"']{1,99}['"]\s*;\s*\}\s*\}(?<X1136880>)|\)\s*array_map\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*/\*[^*]+\*/\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;(?<X1039371>)|\)\s*echo\s*file_get_contents\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;(?<X1039091>)))|COOKIE\[['"](\w{1,20})['"]\]\)\s*\)[^\(]{1,60}if\s*\(\s*\(\s*preg_match\s*\(['"]/(?:(?:admin|wp-login\.php|wp-admin|administrator)\|?){4}/\w{1,3}['"],\s*\$_SERVER\[[^\{]{9,99}\{\s*setcookie\s*\(['"]\25['"](?<X2063612>)|REQUEST\s*\[\s*"\w+"\s*\]\s*\)\s*\)\s*{.+?@arsort\s*\(\s*\$\w{1,40}\s*\)\s*;\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*exit\s*\(\s*\)\s*;\s*\}(?<X1038750>))|\s*kadence_is_bot\s*\(\s*\)\s*&&\s*!is_admin\s*\(\s*\)\s*\)\s*\{\s*\$cache\s*=\s*get_transient\s*\(\s*['"]kadence_cloak_header['"]\s*\);(?<X220360461>)|\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{(?:\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;){2,4}\s*header\(\s*['"]Location:(?<X2054042>)|\s*md5(?:\(\s*reset\(\s*\$_COOKIE\s*\)\s*\)\s*==\s*'\w+'\s*&&\s*count\(\s*\$_COOKIE\s*\)\s*>\s*\d+\s*\)\s*{\s*\$_sessions_debug_data.+?unlink\(\s*\$_session_debug_stream\s*\);\s*}(?<X1038430>)|\s*\(\s*(?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*==\s*['"][^'"]*['"]\s*\)\s*\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\.\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;(?<X1037243>)|@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*==\s*"[^"]*"\s*\)\s*\{\s*print\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*basename\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*if\s*\(\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*\}(?<X1038120>)))|\s*me_file_put_contents\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@chmod\s*\(\s*\$\w{1,40}\s*,\s*0444\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\}\s*;\s*\}\s*\}\s*else\s*if\s*\(\s*\$\w{1,40}\s*==\s*'[^']*'\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*me_file_get_contents\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*"[^"]*"\s*;\s*\}(?<X2046380>)|\s*preg_match(?:\(['"]/['"]\s*\.\s*implode\(['"]\|['"],\s*\$googleBots\)\s*\.\s*['"]/[^\.]{1,99}strpos\(\$\w+,\s*['"]google\.['"]\)\s*!==\s*(?:true|false)\s*\)\s*\{\s*\w+\s*\(\$_SERVER\[['"]REQUEST_URI['"]\][^\{]{1,99}\{\s*(?:include|require)\s+['"][\w\-]{1,30}\.php['"];\s*(?:exit|die)\(\);\s*\}\s*\}(?<X120336181>)|\s*\(\s*'[^']*'\s*,\s*\$_SERVER\s*\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*curl_init\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_URL\s*,\s*'[^']*'\s*\)\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_RETURNTRANSFER\s*,\s*1\s*\)\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_CONNECTTIMEOUT\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*curl_close\s*\(\s*\$\w{1,40}\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}(?<X1038030>))|\s*screen\.(?:width|height)\s*[<=]{1,2}\s*\d+\s*\)\s*\{\s*window\.location\s*=\s*['"]https?://[^/]{4,40}\.pw/[a-z]{4,8}['"];\s*\}(?<X1133421>)|\s*socket_listen\s*\(\s*\$sock\s*,\s*\d+\s*\)\s*===\s*false\s*\)\s*\{\s*echo\s*['"]HaHa(?<X2051820>)|\s*str(?:pos(?:\(\s*strtolower\(\s*\$_SERVER\[\s*'REQUEST_URI'\s*\]\s*\)\s*,\s*'\w+'\s*\)\s*\)\s*{\s*include\s*\(\s*getcwd\s*\(\s*\)\s*\.\s*'/\w+\.php'\s*\);\s*exit;\s*}(?<X1035670>)|\s*\(\s*\$_SERVER\[['"]REQUEST_URI['"]\]\s*,\s*['"]checkout['"]\s*\)\s*!==\s*false\s*\)\s*\{\s*if[\s\(]+!isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*if[\s\(]+\d[\s\)]+if[\s\(]+\d[\s\)]+echo\s*file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0[a-z\d]{9,199}=+['"][\s\)]+;\s*\}\s*\}(?<X1186790>)|\s*\(\s*gethostbyaddr\s*\([^,]+,\s*['"]google['"]\s*\)[^\{]{1,49}\{\s*header\s*\(\s*['"]HTTP/1\.[01]\s+40[134][^#@\?]{9,499}(\$\w{1,40})\s*=\s*\$_POST\[['"]pass(?:word)?['"]\];[^\{\}\?]{9,999}\$(msg|message)\s*\.=\s*['"][^;]+\40[^\(\{\}\?]{9,999}\bmail\s*\([^\)]+\41(?<X2134611>))|str\s*\(\s*\$_SERVER\s*\[\s*'[^']*'\s*\]\s*,\s*"[^"]*"\s*\)\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*foreach\s*\(\s*\$_COOKIE\s*as\s*\$\w{1,40}\s*=\s*>\s*\$\w{1,40}\s*\)\s*\{(?<X2047970>)))
\bif\s*\((?:\s*substr\s*\(\s*(?:key|md5)\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\),\s*\d+,\s*\d+\)\s*\D{2,3}\s*['"][^'"]{1,40}['"]\)\s*\{\s*@?eval\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*\}(?<X1137710>)|\s*typeof\s*_popwnd\s*==\s*'[^']*'\s*\)\s*\{\s*var\s*_popwnd\s*=\s*-1\s*;\s*function\s*_popwnd_open\s*\(\s*\)\s*\{\s*if\s*\(\s*_popwnd!=-1\s*\)\s*return\s*;\s*_popwnd\s*=\s*window\s*\.\s*open\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*_popwnd\s*\.\s*blur\s*\(\s*\)\s*;\s*window\s*\.\s*focus\s*\(\s*\)\s*;\s*\}\s*\}\s*;\s*window\s*\.\s*addEventListener\s*\(\s*'[^']*'\s*,\s*_popwnd_open\s*\)\s*;(?<X1043131>)|\w+\(\)\)\s*\{\s*\$\w+[\s=]+\w+\(['"]https?://pub\-[^/]+\.r2\.dev/[^\}]{1,999}(\$\w+)[\s=]+curl_exec\(\$\w+\);\s*\w+\(\$\w+\);\s*echo\s*\3;\s*exit;\s*\}(?<X120343240>)|basename\(\$_SERVER\[['"][^%]{1,199}\(function\(\)\{[^%]{1,99}wp_get_current_user\(\);[^%]{1,99}in_array\(['"]administrator['"],\s*\(array\)\$\w+\->roles[^%]{1,499}time\(\)\)\);\s*@?wp_remote_post\(['"]https?://[^%]{1,199}json['"]\)\)\);\s*\}\);(?<X120364640>)|crawlerDetect\(\$_SERVER\[['"]?HTTP_USER_AGENT['"]?\]\)\)\s*\{\s*header\(['"]HTTP/1\.\d\s+404\s+Not\s+Found['"]\);\s*die\(['"][^'"]{1,100}['"]\);\s*\}\s*\$IP_Connected\s*=\s*\$_SERVER\[['"]?REMOTE_ADDR['"]?\];(?<X2052850>)|eregi\s*\(['"](?:Linux|windows)['"]\s*,\s*\$\w{1,20}\)\)\s*\{[^//]{9,99}\$\w{1,20}\s*=\s*['"]https?://milw0rm.com/(?<X2125090>)|file_exists\((?:\$htaccessPath\)\)\s*{\s*chmod\(\s*\$htaccessPath\s*,\s*0777\);\s*if\s*\(is_writable\(\$htaccessPath\)\)\s*{\s*\$htaccessData\s*=\s*file_get_contents\(\$htaccessPath\);\s*\$htaccessTime\s*=\s*filemtime\(\$htaccessPath\);(?<X2048180>)|\s*['"](?:\.\./)+\w+\.php\.suspected['"]\s*\)\s*\)\s*rename\(\s*['"](?:\.\./)+\w+\.php\.suspected['"]\s*,\s*['"](?:\.\./)+\w+\.php['"]\s*\);(?<X2045641>))|function_exists\(['"](shell_exec)['"]\)\s*&&\s*!in_array\(['"]\10['"],\s*explode\([^%]{1,99}\10\((\$\w+\s*\.\s*['"]\s*2>&1)['"]\);[^%]{1,999}exec\(\11[^%]{1,999}system\(\11(?<X220369540>)|in_array\(\$\w+\[['"]countryCode['"]\][^\$]{1,99}(\$\w+)\s*=\s*['"]https?://html\.avatar\-amp\.info[^;]{1,99}['"];\s*(\$\w+)\s*=\s*@?file_get_contents\(\13\);\s*\w+\s*\(!\14\)\s*\{\s*\14\s*=\s*['"]\w+\s*\w+['"];\s*\}\s*echo\s*\14;\s*exit\(\);\s*\}(?<X120344401>)|is_(?:bot\(\)\)\s*\{\s*(?:(\$\w+)\s*=\s*['"][^'"]{1,29}\.html['"];[^\{]{1,49}(fetch_url_content)\(\16\)\s*\{\s*(\$\w+)\s*=\s*(curl)\w+\(\);\s*\19\w+\(\18[^\}]{1,199}\19\w+\(\18\);[^\{]{1,99}\17\(\16\);[^'"]{1,99}echo[^'"]{1,49}['"]\bgagal[^;]+\16\);\s*\}\s*exit;\s*\}(?<X120346700>)|echo\s+file_get_contents\((?:['"]https?://[^\.]{1,99}\.pages\.dev[^'"]+\.txt['"]\);\s*exit;\s*\}(?<X120353851>)|['']https://[^\.]+\.pages\.dev[^'"]+\.txt['"]\);\s*exit;\s*\}(?<X120353901>)))|object\(\$_SESSION\["__default"\]\["user"\]\)\s*&&\s*!\(\$_SESSION\["__default"\]\["user"\]->id\)\)\s*{echo\s*"\s*<script\s*language=JavaScript\s*id=onDate\s*>\s*</script>\s*<script\s*language=JavaScript\s*src=[^>]+>\s*</script>\s*"\s*;?\s*\}\s*;?(?<X1047172>))|isInString\d?\(\$\w{1,20}\s*,\s*['"]googlebot['"]\)\)\s*\{\s*\}[^\(]{2,20}header\s*\(['"]Location:[^\\]{9999,35000}(?:<li[ ][^>]{9,150}>\s*<a\s*href=['"]https?://[^>]+>[^<]{9,99}</a>\s*</li>\s*){2,7}(?<X2133771>)|isset\((?:(\$\{\$_+\})\[['"](\w+)['"]]\)\)\s*\{\s*(\$\w+)([\s=]+)explode\(['",]{1,}\s*\25\[['"]\26['"]\]\);\s*(\$\w+)\28(\$\w+)\(\25\[['"]\26\w+['"]\]\);\s*\$\w+\28\$\w+\s*\.\s*basename\(\29\);\s*\$\w+\28\30\(\27\[\d+\]\);(?<X220337252>)|(\$_POST)\[(\$\w+)\][\s{)]+\33\s*=\s*pack\(['"]H\*[^,]{1,16}\,\s*\32\[\33[^(]{1,32}\(function_exists\((\$\w+)\d[)\s{]+\34\d\(\33\)[^=]{1,500}\=\s*\34\d\(\33,\h+(['"])\w\35[);\s]{1,64}if\s*\((\$\w+)\)[\s\{]+(\$\w+)\s*=\s*\34\d\(\36[);\s]+\34\d\(\36[);\s]+print\s*\37;[}\s]+(?:exit|die);\s*\}(?<X1298761>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:'check'\]\)\) {\s*echo "ok";\s*}\s*else\s*{\s*if\(\s*\$curl\s*=\s*curl_init\(\)\s*\)\s*{(?<X2044701>)|str_rot13\(pack\("H\*",\s*"\w+"\)\)]\)\)\s*{\$_(?<X2044371>))|\$_(?:[GPRSC]\w{2,6}\[['"]diag_nonce['"]\]\)\s*&&\s*\$_[GPRSC]\w{2,6}\[['"]diag_nonce['"]\]\s*===\s*['"]\w+['"]\)\s*\{\s*eval\(base64_decode\(['"][^'"]{999,}['"]\)\);\s*exit;\s*\}(?<X120343600>)|FILES\['\w+'\]\['name'\]\)\)\s*{\s*\$abod\s*=\s*\$filedir\.\$userfile_name;\s*@move_uploaded_file\(\$userfile_tmp,\s*\$abod\);\s*echo"<center><b>Done\s*==>\s*\$userfile_name</b></center>";\s*}\s*}\s*else{(?<X2045421>)|GET\[(?:'\w+'\]\)\)\s*{\s*header\(\s*'Content-Type: image/jpeg'\s*\);\s*readfile\('[^']+'\);\s*exit\(\);\s*}\s*header\('Location: [^']+'\);\s*exit\(\);(?<X1036280>)|['"][\w\-]+['"]\]\)\)\s*\{[^\{]{1,999}//otwarte\.info[^;]+\.txt['"];[^\?]{1,999}\}\s*\w+\s*\{\s*echo\s*['"]+;\s*\}(?<X120340490>)|['"]\w+['"]\]\)\)\s*\{\s*\$\w+[\s=]+['"]https?://[^\.]+\.pages\.dev[^'"]+['"];\s*(\$\w+)[\s=]+(curl)\w+\(\);\s*\46\w+\(\45[^=]{1,349}(\$\w+)[\s=]+\46\w+\(\45\);[^!]{1,99}\47[^\)]{1,39}trim\(\47[^\?]{1,39}eval\(['"]\?>['"]\s*\.\s*\47\);[^\{]{1,39}\{\s*\}\}\s*\}(?<X120350101>))|REQUEST\['action'\]\).{5000,}?@file_get_contents_tcurl\s*\(\s*"[^"]*"\s*\)\s*\)\s*AND\s*stripos\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*!==\s*false\s*\)\s*\{\s*extract\s*\(\s*theme_temp_setup\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*\}\s*\}(?<X1039530>)|SERVER\[(?:(\w+)\]\)\)[^\$]{1,99}(\$\w+)=json_decode\(base64_decode\(\$_SERVER\[\50\]\)\);[^;]+\$\w+=wp_remote_get\(\s*\51\[0\]\);[^;]+\$\w+=wp_remote_retrieve_body\(\$\w+[^\}]{1,999}file_put_contents\(ABSPATH\.\51\[1\],\s*base64_decode\([^\}]{1,999}delete_option\(\51\[5\]\);[^\}]{0,32}\}(?<X120361430>)|['"]HTTP_REFERER['"]\][^%]{1,199}header\(['"]Location:\s*https?://898maksibet\.com[^'"]{1,99}['"]\);\s*exit;\s*\}\s*\}(?<X120361341>)))|\s*\$_GET\['\w{1,10}'\]\)\)\s*{\s*header\('Content-Type:\s*text/html;\s*charset=windows-1251'\);\s*\$\w{1,10}=\$_GET\['\w{1,10}'\];\s*echo\s*eval/\*\*/\('\?>'\.join\("",file\("[^"]+"\)\)\.'<\?'\);\s*die;\s*}(?<X1038980>))|isset\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(?:\{\s*(?:\$str\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w+[\/\*/\-]*\([/\*\/\-]*\$_[GPRSC]\w{2,6}\[[^\]]+\][/\*\/\-]*\);\s*\}(?<X1034782>)|eval\s*\(file_get_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\};(?<X1038101>))|echo\s+shell_exec\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);if\s*\(isset\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*echo\s+@?eval\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1034942>))|JSCis_bot\(\$_SERVER\[["']HTTP_USER_AGENT["']\][^@]{1,350}(JSCget_content\(base64_decode\(["']aHR0cHM6Ly9zZW8uNjY3NzU5LmNvbS)[^@]{1,200}\58[^\}]{1,100}[\s\}]+\}(?<X1323332>)|location\.pathname\.includes\((atob)\(['"]Y2hlY2tvdXQ['"][\)\{]+fetch\(\60\(['"]aHR0c[^'"]+['"]\),\{method:\s*['"]POST[^\{]+\{const\s*(\w+)=document\.createElement\(['"]script['"]\);[^\}]+document\.head\.appendChild\(\61\);\}[\);]+\}(?<X1308242>)|php_sapi_name\(\s*\)\s*!==\s*['"]cli['"]\s*&&\s*\([^\}]{1,199}\)\)\s*\{[^\}]{1,999}(\$\w+)\s*=\s*@file_get_contents\(['"]https?://[^\.]+\.b\-cdn\.net[^'"]{1,299}['"]\)[^%]{1,99}@file_put_contents\(\$\w+,\s*\63[^\}]{1,99}\}\s*\}(?<X120355641>)|preg_match\(\$\w+,\s*\$\w+\)\s*&&\s*\$_SERVER\[['"]REQUEST_URI['"]\]\s*==\s*['"]/\w+/['"][^%]{1,199}usleep\(rand\(\d+,\s*\d+\)\);[^%]{1,199}echo\s*lph_requests\(['"]https?://[^%]{1,99}\.pages\.dev[^'"]{1,199}['"]\);\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120363010>)|sha1\(md5\(\$_POST\["\w{1,40}"\]\)\)==="\w{40}"\)\s*move_uploaded_file\(\$(?<X2051600>))
\bi(?:f(?:\s*\((?:str(?:istr\(\$_SERVER\['HTTP_USER_AGENT'\],\s*'(?:google|yandex)'\)\)\s*\{echo\s*\("<a href='[\w/]+' ?(?:style='[^']+')>\w+</a>\s*<br>"\);}\s*@?include\(\$_REQUEST\['\w+'\]\);(?<X1036251>)|len\(strval\(key\(\$_GET\)\)\)\)\s*\$m\s*=\s*'sub_id_1='\s*\.\s*strval\s*\(\s*key\(\s*\$_GET\s*\)\s*\);(?<X2047640>)|len\h*\(\h*\$link\h*\)\s*>\s*\d+\)\s*\{\s*\$fp\s*=\s*@?fopen\h*\(\s*\$cache\s*,\s*['"]w\+?['"]\h*\)\h*;(?<X2116962>)|pos\((?:\$_SERVER\['REQUEST_URI'\]\s*,\s*'[^']+'\)\s*!==\s*false\)\s*{\s*error_reporting\(0\);\s*ini_set\('display_errors',\s*0\);\s*set_time_limit\(0\);.+add_filter\( 'wp_title',\s*'\w+'\s*\);\s*}\s*}(?<X1035830>)|gethostbyaddr\(getenv\(['"]REMOTE_ADDR['"]\)\)[^\{]{1,30}\)\s*\{\s*header\s*\(['"]HTTP/1\.\d\s+404\s+Not\s+Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^\(]{0,150}(?:include\s*\(?['"][^'"]{1,50}\.php['"]\)?;\s*){3}(?<X2123521>)))|void\s*\d\s*\D{1,3}\s*(\w{1,20})\)\s*\{\s*var\s+\6\s*=\s*\{\s*(config):\s*\{[^-]{20,150}\{\s*\6\.load\(\)\s*\}\s*,\s*this\.\7\.[^\n]{99,400}=\s*new\s+c[rol](?:inHive|ient|LT)\.Anonymous\s*\(['"]\w{32,64}['"],[^\?]{20,150}\};\s*\6\.init\(\)\s*\}(?<X1127961>)|wp_check_password\(\$_REQUEST\[['"]wpnonce['"]\]\s*,\s*['"][a-f\d]+['"]\)!==\s*true\s*\)\s*\{\s*\$\w{1,14}\s*=\s*[^\{]{1,500}\{\s*\$_SESSION\[['"]loggedin['"]\]\s*=\s*1;(?<X2278741>))|\s+(?:!\s+pgrep\s+-f\s+"minmon(?<X2050460>)|\(!\w+\(['"](SCRIPT_EXECUTED)['"]\)\)\s*\{[^\;]+define\(['"]\11['"],\s*\w+\);[^\{]{1,99}ob_start\(function\((\$\w+)\)\s*\w+\s*\(\$\w+\)\s*\{[^;]{1,99}(\$\w+)\s*=\s*bin2hex\(random_bytes\(8\)\);[^\}]{1,199}\12,\s*\13\)[^<]{1,99}return\s*preg_replace\(['"]/\\s\*?<\\(/body>)/['"],\s*['"]<\14['"],\s*\12\);[/\s\}]+return\s*\12;[//\s\}\)]+;\s*[/]*\}(?<X120339560>)|\(isset\((?:(\$_POST\[['"]ninja_cmd)['"]\]\)\s+\&&\s+\$_SESSION\[['"]ninja_auth['"]\]\)\s+\{\s+(\$\w+)\s+=\s+\16['"]\];\s+(\$\w+)\s+=\s+shell_exec\(\17\.['"]\s+2>&1['"]\);\s+\$_SESSION\[['"]last_cmd_output['"]\]\s+=\s+\18;(?<X220339710>)|\$_[GPRSC]\w{2,6}\[['"]off['"][^\^\[]{1,199}[^\(]+\(move_uploaded_file\((\$_FILES)\[['"]\w+['"]\]\[['"]\w+['"]\],\s+\20[^/]+/\w+><\w+>['"];\s+echo\s+['"]<a\s+href=['"]\{\20\[['"]\w+[^=]{1,199}target=['"]_blank['"]>Open</\w+[^/]+<form\s+method=['"]POST[^\}]{1,199}(?:exit|die)\(\);\s+\}(?<X120353511>))|\(md5\(@?\$_GET\[['"]\w+['"]\]\)\s+==\s+['"]\w{32}['"]\)[^\.]{9,199}\.\s+getcwd\(\)[^\{]+\{\s+if\s+\(@?move_uploaded_file\(\$_FILES\[['"]\w+['"]\]\[['"]\w+['"]\],\s+\$_FILES\[['"][^\.]+\.\s+\$_FILES\[['"]file['"]\]\[['"]\w+['"][^\}]+\}\s+else\s+if\s+\(@?copy\(\$_files[^\}]+\}[^;]+;[\s+\}]+exit\(\);\s+\}(?<X120333900>)|\(strpos\((\$\w+),\s+['/\)\s]+={1,4}\s+\d+\s*\|{2}\s+preg_match\(['"][^'"]{1,149}['"],\s+\23\){2}\s+\{\s+header\(['"]Location:\s+https?://trusik\.co\.uk/cig\-bin/\w+['"]\);\s+(?:exit|die);\s+\}(?<X1324210>))|rame_window\.scrollto\([^\)]+\);[\s\}]+write_to_iframe[\h\(]+get_boxed_text[\h\(]+['"]\h*WSO\h*shell\h*backdoor\b(?<X2204060>))|gnore_user_abort(?:\(true\);\s*set_time_limit\(0\);\s*@ini_set\('error_log',NULL\);\s*@ini_set\('log_errors',0\);\s*class\s*MCurl(?<X2048520>)|\s*\(\s*true\s*\)\s*;\s*set_time_limit\s*\(\s*\d+\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*NULL\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*0\s*\)\s*;\s*function\s*getURL.+?getURL\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*exit\s*;(?:\s*\}){1,4}(?<X1038151>))|mp(?:lode(?:[\s\(]+['"]_['"]\s*,\s*array[\(\s]+["']move['"][\s,]+['"]uploaded['"][,\s]+['"]file['"][\)\s]+;(?<X2196391>)|\(".r.n",array\("%1html%3","%1head%3",head\(\),"%2head%3","%1body%3(?<X2043971>)|\(\$\{\$\{['"](GLOBALS)['"]\}\[[^\]]+\]\}\)\.['"]\.module['"];file_put_contents\(\$\{\$\w{1,40}\},['"]<\?(?:php|=)?\h*(unlink\()__FILE__\);(?:\\r)?\\n['"]\.\$\{\$\w{1,40}\}\);include(?:_once)?\(\$\{\$\{['"]\30['"]\}\[[^\]]+\]\}\);\31\$\{\$\{['"]\30['"]\}\[[^\]]+\]\}\);(?:exit|die)\b[^;]{0,9};(?<X2152161>))|ortScripts(?:[\s\(]+['"](?:https?:)?//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"]+\.js['"][\s\)]+;?(?<X1223580>)|\(\\?['"]https:\/\/(?:\w{1,30})\.wordfence\.me/\w{1,20}\.js\\?['"]\);(?<X1314651>))))
\bin(?:clude(?:(?:_once)?(?:[\s\('"]+(zip)://wp\-includes/(\w+)\.\1#\2['"\)\s]+;(?<X1308780>)|[\s\(]+['"][^'"]*\bwp\-load\.php['"][\s\)]*;\s*(?:(\$\w+)[\s=]+['"][^;]+;\s*){2,3}if\s*\([^\{;]+\{\s*(\$\w+)[\s=]+@?wp_create_user\s*\([^;]+\4\b[^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\5[\s\)]+;\s*\6\->set_role[\s\(]+['"]admin\w+['"][\s\)]+;\s*\}\s*(?:exit|die)\b[^;]{0,9};(?<X1213350>)|\(?['"][^'"]{0,4}antibots\.php['"]\)?;[^<]{0,200}\b(?:if\(strpos\((?:\$_SERVER\[|gethostbyaddr\(getenv\()['"](?:HTTP_USER_AGENT|REMOTE_ADDR)['"][\)\]\h,]{1,4}['"]GoogleBot['"]\)[^\)]+\)\s*\{\s*header\(['"]HTTP/\d\.\d\h+404\h+Not\h+Found["']\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*){2}(?<X2142831>)|\(\s*\$\w{1,40}\s*\.\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\s*\[\s*['"]\w+['"]\s*\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};(?<X1038661>)|\h*(?:\(\h*)?['"][^'"\$]{0,99}/\.(?:[^'"/]{1,49}\.txt|\.{2,})['"]\h*(?:\)\h*)?;(?<X1174885>)|\h*['"]\./View_files/validate_form\.js['"]\h*;[^{\}]{1,199}@?\$reg_username\h*=\h*addslashes\h*\(\h*\$_POST\h*\[(?<X2171680>)|\h*[\$\{\('"]{1,3}zip://[^;{}\$]+['"]\s*;(?<X1273911>)|\s*['"\(][^'"\(]{0,20}cssisma[^/]{0,20}/\w{1,40}\.php['"\(];(?<X2055111>))|(?:[\h\(]+['"]cc_validator\.php['"][\h\)]*;[^\$]{1,99}\$\w{1,40}\h*=\h*getenv\h*\(['"]REMOTE_ADDR['"]\h*\)\h*;[^\.]{1,99}include[\h\(]+['"]Email\.php['"][\h\)]*;(?<X2143000>)|\(['"]wp\-includes/error_log['"]\);(?<X120357771>)|\(['"]zip://(?:core/v\.zip#v['"]\);(?<X120348100>)|wp\-\w+/(\w)\17\17#\17['"]\);(?<X120340521>)|wp\-style\.zip#(?:wp|xx)['"]\);(?<X120350821>)|wp\-webdb\.zip#load['"]\);(?<X120345340>))|\(['"zip\.]+://[\w\-]+\.zip#\d+['"]\);(?<X120344190>)|\h*(?:dirname[\h\(]){4,8}__file__[\h\)]+\.\h*['"]/wp\-load\.php['"];[^\?]{0,499}\bif[\h\(]+wp_hash[\h\(]+\$_COOKIE\[['"]message['"]\][\h\)]+==(?<X220362770>)|\h*['"][^'"]{1,199}/wp\-content/fonts/shell\.php['"];(?<X120345331>)|\h*['"]compress\.zlib://['"][\h\.]+WP_CONTENT_DIR[\h\.]+['"][^'"]+['"];(?<X120366700>)|\h*\(?['"][^'"]{1,40}/xREPORT/Sinus/[^'"]+\.php['"](?<X2128822>)|\h+['"]404\.php['"];\s*\}[^\.]{99,200}(\$\w{1,20})\h*=\h*new\h+\w{1,20};\s*\26->load_stop\([^\.]+\.\h*['"]/[^'"]+stops?\.txt['"](?<X2146390>)|\s*'antibots\.php';\s*\$mail\s*=\s*\$_SESSION\['mail'\]\s*=\s*\$_POST\['mail'\];(?<X2049280>)|\s*['"]compress\.zlib://index\.gz['"];(?<X120346461>)|\s*\(?['"][^'"]+bots?[^'"]+['"]\)?;[^\{]{0,199}(?:if\(strpos\([^,]+,['"]google['"]\)\s*!?==?\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}(?<X2131646>)|\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*'/includes/_bb_press_plugin.class.php'\s*\)\s*;\s*register_activation_hook\s*\(\s*__FILE__\s*,\s*array\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*;\s*//\s*M\s*register_deactivation_hook\s*\(\s*__FILE__\s*,\s*array\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*;\s*add_filter\s*\(\s*'[^']*'\s*,\s*array\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\)\s*,\s*10\s*,\s*3\s*\)\s*;\s*add_action\s*\(\s*'[^']*'\s*,\s*array\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\)\s*\)\s*;(?<X1037050>)|\s*pack\(['"]H\*['"],\s*['"][^'"]{1,999}['"]\);(?<X120369531>)|\s+socket_get_status\((\$\w+)\)\[['"]uri['"]\];\s*fclose\(\33\);[^=]{1,99}(\$\w+)[\s=]+new\s+Compiler\(\d+,\s*['"]GENERATE_RANDOM_BYTE['"]\);\s*\$\w+\s*=\s*['"][^'"]{1,32}['"];[^\-]{1,49}\34\->\w+\(__FILE__,\s*__COMPILER_HALT_OFFSET__\);[^\?]{1,199}__halt_compiler(?<X220350480>)|_once\((?:[ ]+dirname\([ ]+__FILE__[ ]+\)[ ]+\.[ ]+['"]/config/class\.php['"][ ]+\)\h*;(?<X1155410>)|['"]zip://_\(:\W{1,}#\W{1,}_['"]\);(?<X120353612>))|_once(?:\h*['"]compress\.zlib://ss\.gz['"];(?<X120349430>)|\s*['"]wp\-(?:admin|includes)/\.[\w\-]+['"];(?<X120370131>)|\s*\(\s*\$_SERVER\s*\[\s*'[^']*'\s*\]\s*\.\s*'/bitrix/[^']*\.(?:gif|jpg|jpeg|png|ico)'\s*\)\s*;(?<X1039441>))))|doxploit\b[^@]{99,999}<(h\d>)\h*Victim\s+Result\s+will\s+be\s+there\h*</\41(?<X2148261>)|fo[^'"\v;=\$]{1,99}\s*Card\h+Number\h*:\h*['"]\h*\.\h*(\$_SESSION\h*\[)['"]dftCN2['"]\]\h*\.\h*['"]\s*Expiration\h+Date\h*:\h*['"]\h*\.\h*\43['"]datex2['"]\]\h*\.\h*['"]\s*(?:Card\h+Verifi(?:cation)?\h+Number|CVV)\h*:\h*['"]\h*\.\h*\43['"]dftVC2['"]\](?<X1139061>))
\b(?:i(?:n(?:i_set(?:['"\(]+imunify360\.\w+['",\s]+false\);\s*http_response_code[\s\(]+404\s*\)(?<X2291900>)|[\(\s]+['"]display_errors['"](?:,\s*['"]Off['"][^\$]+(\$\w+)[^\$]+(\$\w+)[^%]{1,30}filemtime[\(\s]+\2[^\w]+if\(md5\((\$_[GPRSC]\w{2,6})[^\$]+\$\w+=array[^%]{1,120}if\(isset\(\4[^\$]+(\$\w+)=[^;]+;\$\w+=file_get\w+\(\5[^%]{1,110}chmod\(\5[^%]{1,919}(\w+)\(\3,\$\w+[^%]{1,8150}(\$\w+)=ltrim[^@]{1,7040}\6\(\3,\7\);die;\}+(?<X1218452>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227660>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227672>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227681>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227701>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227691>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227711>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227770>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227891>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227733>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227740>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^\+/]{0,199}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227722>))|\('display_errors','Off'\);\s*error_reporting\('E_ALL'\);\s*if\(isset\(\$_FILES\['u'\]\)\s*&&\s*isset\(\$_POST\['n'\]\)\)\s*move_uploaded_file\(\$_FILES\['u'\]\['tmp_name'\],\$_POST\['n'\]\);\s*setcookie\('server',1,time\(\)\+1e6\);\s*\$s=\$_SERVER;\s*if\(\$server!=1\s*&&\s*\$s\['HTTP_REFERER'\]\s*&&\s*strpos\(\$s\['HTTP_REFERER'\],\$s\['HTTP_HOST'\]\)===false\s*&&\s*\$_COOKIE\['server'\]!=1\)\s*{\s*\$server=1;\s*eval\(file_get_contents\(base64_decode\('\w+'\)\.\$s\['HTTP_HOST'\]\)\);\s*}(?<X1036450>)|\(['"](?:display_errors|error_reporting)['"],['"](?:off|0|NULL|FALSE)['"]\);[^\$]{0,99}\$\w+=(base64_decode)\([^@\*<]{2000,9999}\bif\([^\)]+\)[\{\s]+(\$\w{1,20})=file_get_contents\(['"][^'"]{0,60}\bsistermoon\.\w{1,20}/[^\\@]{99,600}\bwindow\.location\.href=[^\$]{0,20}\22\.\21\([^\;]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1227100>)|\(['"]cgi\.fix_pathinfo['"],[^\)]{1,19}\);\$\w{1,40}=new\s+(\w{1,40})\(\$_[GPCSR]\w{2,6}\);unlink\(__FILE__\);(?:exit|die)[^;]{0,19};class\s+\24\{(?<X2151810>)|\(['"]display_(?:(error)s['"],['"]0['"]\);\26_reporting\(0\);[^\[]{0,999}(\$\w{1,40})[\h=]+(\$_SERVER\[)['"]HTTP_HOST['"]\][\h\.]+\28['"]REQUEST_URI['"]\];[^%\\]{0,999}\bif[\h\(]+\$\w{1,40}[!=\h]+\27[^;]+;[^\?\\]{99,1999}\becho\h*\$\w{1,40};[\h\}]+register_(shutdown)_function\(['"]\29['"]\);[^\}]{0,99}\}(?<X1184180>)|errors['"],(?:(?:0|Null|False)\);[^\{\$]{1,499}\bfunction\s+(\w{1,40}\()[^\}]{99,499}\breturn\s+curl_exec\([^\}]{1,99}\}(\$\w{1,40})=[^;]{1,99}/wp\-[^;]{1,99}\.php['"];(\$\w{1,40})=\31['"]https?://[^/]{3,99}bin\.com?/[^;]{1,199};(\$\w{1,40})=fopen\(\32[^;]{1,9};@?fwrite\(\34,\33\);(?<X2158710>)|0\);ini_set\(['"]display_startup_errors['"],0\);[^\{]{1,999}\{\w+\(base64_decode\s*\(['"]PHN[^'"]+['"]\)\);\}(?<X120369022>)|\h*0\);\s*error_reporting[^;]+;[^\?]{99,1800}\bco['"][\h=>]+\$_COOKIE\[(['"]_event['"])\],\s*['"]user_id['"][\h=>]+\$\w+,[^#]{99,3400}\bsetcookie\(\s*\37,\s*\$\w+\[[^,]+,\s*time\(\)[^;]+;\s*\}\s*\}\s*\}(?<X120348092>)|\h*0\)[^#]{9999,21000}\bPH_VAR_FILTER_DATA['"]\)[\h=]+false[^#]{9999,21000}\bPH_PLACEHOLDER_ROOT_ARRAY['"],\h*json_encode\([^\?]{999,5000}\bminiapiing_multiappible[\h\.]+['"]/api/click['"];(?<X220365291>)))|\([^\)]+\);\s*error_reporting\([^\)]+\);\s*setcookie\([^\{]{0,150}\bif\((isset)\((\$_FILES\[)[^\]]+\]\)\h*\D{2,3}\h*\40\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]{9,99}\{\s*(?:move_uploaded_file|copy)\(\41[^\}]{0,99}\}\s*elseif\([^\{]{0,99}\{\s*eval\(file_get_contents\([^\}]{0,99}\}(?<X1179500>))|jUrl[=\h]+['"]https?://toremanc\.com/[^'"]+\.txt['"]\s*(injFile)[\h=]+['"]\w+\.php['"][^&]{599,1500}\becho\h*['"]\$\w{1,25}/wp\-(?:includes|admin|content)/\$\43\h*\|\h*\$\w{1,25}['"](?<X2207800>))|octl\s*\(\s*\$listen_socket\s*,\s*0x8004667e(?<X2049880>)|p\h*=\h*getenv\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,9}\h*=\h*[""]Mini\s*shell['"];(?<X2146150>)|s(?:_readable\s*\(\s*['"]/etc/passwd['"]\s*\)\s*\?[^\?]{100,600}php_uname\(\)(?<X2056371>)|set\((?:(?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:['"][^'"]*['"]=+(?:sha1|md5|\(\!?strcmp)?\((?:\48|\$\{[^\}]+\})\[[^\]]+\])(?:[^@]{1,100})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252771>)|(\$_REQUEST)[^\]]{1,32}[\]\)]+\{(\$\w+)=['"]\\x[^;]+;\$\{\51\}=\50\[['"]\w+['"]\];echo\h*executecommand\(\$\{\$\{['"]\\x(?<X2265351>)|\$_GET\[['"]Antonkill['"]\]\)\)(?<X220348981>))|set\s*\((?:\$_[GPRSC]\w{2,6}\[['"]get(?:(?:web)?shell\d?|backdoor)['"]\]\)\)\s*\{\s*@?(?:exec|shell_exec|system|assert|popen|pcntl_exec|eval|file_get_contents)\(['"][^:]{0,20}https?://\w{1,20}\.paste\.se/(?<X2135280>)|\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*&&\s*\(\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*&&\s*@preg_replace\(['"][^'"]*e['"],\s*[^,]+,\s*['][^"']*[']\);(?<X1037581>))))|J(?:FIF\b[\W\w]{1,99}<\?php\s+function\s+executeCommand\((?<X220353360>)|son_decode\((?:\s*file_get_contents\(\s*['"]php://input[^%]{1,299}mkdir\(\s*\$\w+,\s*0755[^%]{1,2199}<title>File(?<X220369361>)|file_get_contents\(['"]https?://www\.geoplugin\.net/[^\[]{99,999}\bfunction\h+country_sort\(\)\s*\{[^\(]{9,40}\$\w{1,20}\h*=\h*array\((?:\d+,?)+\);[^\?]{99,200}\bheader\(['"]Location:(?<X2147521>)))|kirim_mail\h*\([^;]+;[^\?:]{1,499}\bheader\h*\(\h*['"]Location:(?<X2163812>))
\bL(?:337xyz\h*WAF\h*BYPASS\b[^\<]{0,15}</(?:h\d+|title)>(?<X220360530>)|[O0]GZ(?:xx)?\h*\$country[^#]{9,250}\$msg\h*=\h*['"][^'"]{9,59}_ONE\h*WITH\h*GOD_[^\}]{99,599}\}\s*else\h*\{\s*mail\([^\)]+\);\s*header\((?<X2167831>)|e(?:afMailCheck\h*\(\h*\$\w{1,40}[\s\)]{1,9}\{(?<X2157470>)|t(?:\h*(\w+),(?:\h*\w+,){6}[^;]+;\s*const\h*(\w+)[\h=]+(\w+);\s*(function)\h*\6\([^#&]{99,2000}\bMain\h*malicious\h*functions[\s\-]+\w+[\h=]+\7[^#]{99,1100}\btypeof\h*require[\h!=]+\5\([^:]{0,30}:\h*process\[\5\([^#]{999,3500}\b\4\(\w+\.slice\([^;]+;[\s\}]+\);\s*\w+\(\);(?<X120348330>)|\s*\w{1,14}\s*=\s*localStorage[^\{]{1,200}let\s*(\w{1,14})[=\s'"htps:/]+jatesmetrics\.xyz[^\{]{1,250}\{[^\{]{1,150}\{[^\{\}]+CVC[^\{]{1,999}\{[^\}]{1,999}\bgetElementById\(['"]cvv["']\)[^\}]+\};\s*fetch\(\9[^\!]{1,999}\![^\!]{1,300}\![^\!]{1,300}\![^\!]{1,400}\![^\}]{1,300}\}\s*\}\s*,\s*\d+\);(?<X1273591>)))|i(?:cense:\s+GPL\-2\.0\-or\-later[^\}]{1,199}private\s+static\s+(\$\w+)[^:]{1,299}public\s+static\s+function\s+\w+\(\)\s*\{\s*if[\h\(]+null\s*[\h=]+self::\11\)\s+self::\11[\s=]+new\s+self\((?<X220369872>)|st\((?:\$tobuf,\$from,\$frompwd,\$fromname,\$subject,\$message\)= split \(':::',\s*\$conar\);\s*\$toar = split\('\\\|\\\|',\$tobuf\);\s*foreach \(\$toar\s*as\s*\$to\)\s*{\s*list\(\$fromlogin,\$fromhost\)=split\('@',\$from\);(?<X2046620>)|\s*\$tobuf\s*,\s*\$from\s*,\s*\$subject\s*,\s*\$messagefile\s*\)=\s*explode\s*\(\s*':::'\s*,\s*\$conar\s*\);(?<X2046670>))|st\s*\(\s*\$tobuf\s*,\s*\$from\s*,\s*\$subject\s*,\s*\$messagefile\s*\)\s*=\s*split\s*\(\s*':::'\s*,\s*\$conar\s*\)\s*;(?<X2047950>)|te\W{0,5}\bSimple\s*(?:shell\h*|backdoor\h*){1,2}\h*\](?<X2175691>))|o(?:ad_(?:(template)[\s\(]+strrev[\s\(]+['"]//:piz['"][\s\)]+\.\s*locate_\17[\s\(]+['"][^'"]+\.\17['"][\s\)]+\.\s*['"]#\17['"][,\s]+true[\s\)]+;(?<X1221270>)|template\(\s*(?:(["'])zip://\19\s*\.\s*locate_template\(\s*\19\w+\.theme\19\s*\)\s*\.\s*\19#[\w\-]+\19[^\)]{0,16}\);(?<X120353880>)|['"]zip://['"]\s*\.\s*locate_template\(\s*['"][\w\-]+\.theme['"]\s*\)\s*\.\s*['"]#archive['"],[^;]{0,16};(?<X120355332>)))|cation\.replace\(url\+['"][^'"]{1,99}\.php\?p=['"]\h*\+\h*imei_c\h*\+['"]\|?Injection(?<X2151541>)|gin\h+in\h+tiktok!?['"\s]+>[^%]{1,99}<title>verifycode</title>(?<X2295780>)))
\bM(?:[a4@][s5][s5]\h*D[e3]f[a4]c[e3](?:\h*1Dir)?\h*Tools</(?:h\d|title)(?<X2156511>)|a(?:de(?:\h*by\h*cyborg[^\?]{0,399}\berror_reporting\b(?<X2183210>)|_by="Bl0od3r";(?<X2050970>))|g(?:e::getModel\(['"]admin/rules['"]\)\h*((\->set)Role)Id(\(\$\w{1,40}\->getId\(\)\))\h*\5Resources(\(array)\(['"]all['"]\)\)\h*(\->saveRel)\(\);[^\?]{99,499}\$(\w{1,40})\h*\4Ids\7\6\)\h*\4UserId\(\$\9\->getUserId\(\)\)\h*\8ations\(\);\h*\}\h*catch\b[^\}]{9,99}\}\h*echo\b[^;]+;\h*(?:unlink\(__FILE__\);)?(?:\?>)?\Z(?<X2158584>)|icboom\(\$_GET\["y"\]\);\$f\s*=\s*\$_GET(?<X2048310>))|il(?:[\h\(]+\$\w{1,16}\h*\,\h*['"]Ll[o0]yds\b[^;]+\.\h*\$_SERVER\[[^\]]+\][^;]+(\$\w{1,40})\h*\)\h*;\s*(\$\w{1,40})\h*=\h*fopen\h*\([^;]+/[\w\-]{1,40}\.txt['"][\h,]+['"][aw]\+?['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\13\h*,\h*\12\h*\)\h*;(?<X2179561>)|\(['"]{2},\h*\$headers\h*,\h*(\$\w{1,40})\b[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\([^\),;]{1,99}\.txt['"]\h*,[^;]{1,99};\s*@?fwrite\h*\(\h*\16\h*,\h*\15\h*\);[^#]{99,299}\bfaceb[^\so</t]{1,9}ok</title>(?<X2166891>)|\([^,;]+,['"][^'"]+\bRezult[sz]?\b(?<X2215331>)|\([^;]{1,99};\s*\?>\s*<!\-\-\s*Powered\s+by\s+sadflix\b(?<X2162940>)|\([^\);'"@]{9,40}\);\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\)\$\(]{0,24}\)\s*\{\s*echo\s+['"]<form\s+action\s*=\s*['"][^'"]*['"]\s+method\s*=\s*['"]post['"][^@]{99,300}@copy\(\s*(\$_FILES\[[^\]]+\])\[[^\]]+\],\s*\20(?<X2124241>)|\([^\)]+\$(?:(m(?:e?sg|essage)?)\b[^\?]{1,199}\bfwrite\([^\)]+\$\22\h*\);\s*header\h*\(\h*["']Location:\h*https?://[^/]{0,99}\bcorreos\.es/(?<X2160200>)|(me?s(?:g|sage))\b[^;]{1,99};(\$\w{1,40})=fopen\([^;]{1,99};fwrite\(\25,\$\24\);[^@=]{1,199}<script\b[^>]{0,99}>[^;\(='"]{1,99}\blocation\.href\h*=\h*['"][^\?'";&=]{1,99}\?sslchannel=true&(?:amp;)?sessionid=(?<X2166360>))|\([^\)]+\);(?:[^\(]{1,20}\bfopen\(['"][^'"]+\.txt['"]\h*,\h*['"]a['"]\);\s*fwrite\([^\)]+\);\s*header\(["]Location:[^/]+/verification-card\.php\?cmd=(?<X2142070>)|\s*\$\w{1,20}\h*=\h*fopen\(['"][^/]+/Paype/hell\.php\b(?<X2142060>)|\s*echo\h+\$[^>]{3,35}>\h*H[4a]ck[5S]n[i!]p\b(?<X2143080>)|\s*header\(['"]Location:[^\?]{1,99}\?websrc=['"][^\)\(]{1,29}['"]\.md5\([^;&]{2,30}&dispatch\h*=\h*(?<X2151010>))|\([^\)]{1,60}\);\s*\?>\s*<\?php(?:\s*\$\w{1,40}\s*=\s*@?(?:system\(id\)|php_uname\(\)|PHP_OS);){3}(?<X2120570>)|\(\$\w+,\s*\$\w+,\s*\$\w+,\s*\$\w+\);\s*print\(['"]\s*<script>window\.\w+\.\w+\(['"]https?://login\.microsoftonline\.com/[^;]+;\s*</script>['"]\);\s*\}\s*\?>\Z(?<X220340920>)|\(\$\w{1,9},\h*['"]New[^#]{99,300}<title>Bullbank\h*Online(?<X2143720>)|\(\$_POST\['email'\]\s*,\s*\$_POST\['subject'\]\s*,\s*\$_POST\['content'\]\s*,\s*\$headers\);\s*}\s*\?>\s*<title>BOOM</title>(?<X2045890>)|\(\$emailusr,\s*(\$subj),\s*(\$data)\);\s*mail\(\$cc,\s*\35,\s*\36\s*\);\s*header\(['"]Location:[^'"]{1,40}\.scotiabank\.com/[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054880>)|\(\s*\$\w{1,40},\s*\$\w{1,40},\s*(\$message)\s*\);\s*(\$\w{1,4})\s*=\s*fopen\(\s*['"]\w{1,40}\.?\w{1,10}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\);\s*fputs\(\s*\39,\s*\38\);(?:\s*fclose\(\s*\39\s*\);)?\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054430>)|\h*\(['"](?:[^@]{2,20}@\w{3,15}\.com['"]\h*,\h*['"]Byna\h*Alert['"]\h*,\h*\$\w{1,20}\);\s*header\h*\((?<X2171570>)|[^@]{4,30}@(?:protonmail|yandex|gmail)\.\w{2,6}["'],[^\)]+\);\s*(?:file_put_contents|fopen)\h*\(['"][^'",]{0,9}\b\w{1,20}\.txt['"],[^\)]+['"]?(?:a|file_append)['"]?\);[^\{_]{99,200}\bfunction\h+Redirect\(\)\s*\{\s*(window\.)parent\.\42location\.href\h*=\h*['"]https?://(?<X2164371>)|suspiciousmail@googlemail\.com['"],(?<X2168520>)|th3\.pr0@(?:yandex|protonmail)\.(?:com|ru)(?<X2156760>))|\h*\([^;]{5,150}\);\s*echo\h+['"][^'"]{2,20}\bAuto\h+E?Xploiter['"];(?<X2182360>)|\h*\([^;]{9,40}\$XBALTI_(?:email|message|SUBJECT|HEADERS)\b(?<X2180110>)|\h*\([^\)]+\);\s*header\h*\(['"]Location:[^\.]{1,15}carding\.php\b(?<X2144040>)|\h*\([^\)]{9,90}\);\s*(\$\w{1,9})\h*=\h*['"]Array\s*gans['"];\s*\$__\w{1,9}\h*=\h*['"]getcwd['"][^#]{99,500}<(title)>['"]\h*\.\h*\49\h*\.\h*['"]</\50>(?<X2153340>)|\h*\([^\)]{9,99}\)\h*;[^=\v]{0,99}\bsetcookie\h*\([^;]+;\h*\$\w{1,40}\h*=\h*(__FILE__)\h*;\h*(\$\w{1,40})\h*=\h*['"][^'"]{9999,}['"];\h*(\$\w{1,40})\h*=\h*base64_decode\(\53\)\h*;\h*\54\h*=\h*strtr\h*\(\h*\54\h*,[^;]+;\h*(\$\w{1,40})\h*=\h*[pe]reg_replace\(\h*['"]\52['"]\h*,[^;]+;\s*eval\(\55\)\h*;(?<X2164481>)|\h*\(\$\w{1,20}(?:,\$subject,\$fuck,[^\)]+\);\s*header\h*\(['"]Location:(?<X2140681>)|\h*,\h*['"](?:Amazon|Netflix|Disney|Spotify)\h+Fullz\b(?<X2176010>))|\h*\(\h*(?:(?:\$\w{1,40}\h*,?\h*){4}\);\s*(\$\w{1,40})\h*=\h*fopen\h*\(['"][^'"]{1,40}\.txt['"]\h*,\h*['"]a\+?['"]\h*\);\s*@?fwrite\h*\(\h*\59\h*,\h*\$\w{1,40}\h*\);[^\$]{1,99}(\$\w{1,40})\h*=\h*['"]https://connect\.secure\.wellsfargo\.com/auth/[^;]+['"];\s*header\h*\(\s*"Location:\h*\60"\h*\);(?<X2142122>)|['"][^@'"\);]+@(?:gmail|ya(?:ndex|hoo)|(?:proton|hot)mail|live|outlook)\.[\w\.]{1,9}['"]\h*,[^\?]{1,499}\$experience_login\h*=\h*@?file_get_contents\h*\([^;]{1,99}\bInternetBanking[^'"]{0,99}\.(?:html?|txt)['"]\h*\);(?<X2164870>))|\s*\((?:\$\w{1,20},?\s*|\$\{\$\{['"]G[^\}]+\}\[[^\]]+\]\},?){4}\);\s*header\s*\([""]Location:\h*https?://(?:www\.)?(?!qbank)[^/]{0,20}(?:bank|paypal|gmail|yahoo|microsoft|amazon|ebay)\.\w{2,6}/(?<X2146532>)|\s*\((?:\s*['"]?\$\w{1,40}['"]?\s*,?){3,4}\);\s*(\$\w{1,40})\s*=\s*@?mail\s*\((?:\s*['"]?\$\w{1,40}['"]?\s*,?){3,4}\);\s*if\s*\(\s*\64\s*\D{2,3}\s*\S+?\s*\)\s*\{\s*header\s*\(['"]Location:[^;\)'"]{1,99}(?:loan|bank|wealth|amazon|gmail|aol|pay|microsoft|bing|azure|google|yahoo)(?<X2130020>)|\s*\([^\)]+\);\s*\}[^\(]{9,99}\s*\}\s*setcookie\s*\([^\)]+\);\s*\$backdoor\s*=(?<X2124010>)|\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*(?:['"][^'"]{0,40}['"]\s*,\s*\$\w{1,40}\s*\)\s*;\s*print\s*['"]OK(?:\s*By\s*King)?<br>['"]\s*;\s*flush\s*\(\s*\)\s*;(?<X2054001>)|\$\w{1,40},\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*header\s*\(\s*['"]Location\s*:[^\?!]{1,500}\?>\s*<!DOCTYPE\b[^\?!]{1,500}<title>\s*(?:404\s+)?Error\b(?<X2126120>)))|ke(?:botlist\s*\(\s*(\$BotList)\s*\)\s*\{\s*if\s*\(\s*!\s*file_exists\s*\(\s*\69\b(?<X2057252>)|hide\('action', 'backconnect'\);\s*p\('<p>'\);\s*p\('Your IP:'\);\s*makeinput\(array\((?<X2046730>))|ss\s*(?:exploiter\s*</title>[^\?]{99,499}<\?php\s*(?:(?:error_reporting|set_time_limit)\h*\(\h*(?:0|NULL|False)\h*\);\s*){2}\s*function\s*\w{1,40}\b[^\{]{1,199}\{\s*\$\w{1,40}\h*=\h*curl_init\h*\(\h*\);(?<X2170990>)|Revslider\h*exp?l[0o][i1]t[1i]?n?g?</title>(?<X2176440>))|te\-layer\s+Obfuscated\s+Webshell\b(?<X220363980>))|d5(?:\((?:(['"](\w+)['"])\)\.['"]\w+['"];if[^\{]+\{\$\w+=base64_decode\(str_rot13\(\$_COOKIE[^\)]+\)+;[^%]{1,2000}if\(\!class_exists\(\75\)+[^;]+;\s*new\s*\76[^;]+;(?<X220332280>)|(['"](\w+)['"])\)\.['"]\w+['"];if[^\{]+\{\$\w+=base64_decode\(str_rot13\(\$_COOKIE[^\)]{1,999}\)+;[^%]{1,2000}if\(\!class_exists\(\78\)+[^;]{1,999};\s*new\s*\79[^;]{1,1999};(?<X220337110>)|\$\w{1,15}\[['"]AlfaPass['"]\]\)\);\s*header\([^\?]{99,299}\btitle>\W{0,5}\bAlFA\h*team\h*shell\h*\-\h*v\h*['"]\h*\.\h*__ALFA_VERSION__(?<X2189150>))|\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\)\s*===\s*__PASSWORD__\s*\)\s*\{\s*\$\w{1,40}\s*=\s*array\s*\(\s*filemtime\s*\(\s*__FILE__\s*\)\s*,\s*filemtime\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*basename\s*\(\s*\$\w{1,40}\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\)\s*;\s*if\s*\(\s*move_uploaded_file(?<X2046370>))|eta\h*http\-equiv\h*=\h*['"]Refresh['"][^#]{99,199}<\?php\s*\$\w{1,15}\h*=\h*(\$_[GPRSC]\w{2,6}\[['"])username['"]\];\s*\$\w{1,15}\h*=\h*\83password['"]\];\s*(\$to)\h*=[^\?]{9,250}\bmail\h*\(\h*\84(?<X2167871>)|INI\h+SHELL\h*</title>(?<X2149111>))
\b(?:M(?:kdir(?:[\(\s]+['"](\w+)['"\)\s;@]+eval\(['"fileput_cons\.\s]{19,}\(['"]\1[^'"]{1,40}\.php['"][\s,]+['"fopen\.\s]{6,}\(['"]http[^'"]{9,99}['"][\s,]+['"]\w\+?['"\s\);]+(\$\w{1,40})[\s=]+(curl_)init\b[^\+]{0,999}(\$\w{1,40})[\s=@]+fopen\b[^;]+;(?:(?:[^\?=\n]{0,99}(?:\3close|fclose))[\s\(]+(?:\2|\4)[\s\)]+;){2}(?<X1201300>)|[\s\(]+['"]([^'"]+)['"][\s\)]+;\s*@?(file_)pu(t_contents)[\s\(]+['"]\6/[^'"]+\.php['"][\s,]+\7ge\8[\s\(]+['"]https?://[^/;'"]*\bgithub(?:usercontent)?\.[^;]+;(?<X1207390>)|\((\$\w+),\d{4},\w+\);[^&]+@?exec\(['"]cd\s+/tmp\s+\&\&\s+tar\s+\w+\s+['"]\.(escapeshellarg)[^%]{1,999}@?exec\(['"]rm\s+\-rf\s+['"]\.\11\(\10\)\);\s+\w+\(\$\w+\s+as\s+\$\w+\)@?unlink\(\$\w+\);\s+@?unlink\(__FILE__\);(?:exit|die);\s+\}\s+http_\w+\(\d{3}\);\Z(?<X220362170>)|\(['"](?:([^'"]{1,49})['"],0?777\);symlink\(['"]/['"],['"]\13/[^'"]{0,49}['"]\);(\$\w{1,40})=['"][^'"]{1,99}\b(?:Add(?:Type|Handler)\s*text/plain\s*\.php\s*){2}[^'"]{1,99}['"];file_put_contents\(['"]\13/\.htaccess['"],\14\);(?<X2147980>)|(\w{1,20})['"],\h*\d{3,4}\);\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*\bsystem\(['"]ln\h+\-s\h*['"]\.\17\.['"]\h*\16/['"]\.\18\);\s*symlink\(\17,['"]\16/['"]\.\18\);\s*\$\w{1,9}\h*=\h*fopen\(['"]\16/\.htaccess['"],\h*['"]w['"]\);(?<X2188840>)|(\w{1,40})['"][^;]{1,99};chdir\(['"]\20['"]\);(symlink\()['"]/['"],[^\}\?]{1,499};file_put_contents\(['"]\.htaccess['"],[^\}\?]{1,199}\b\21(?:['"]/home\d*/['"]\.(\$\w{1,40})\.['"]/public_html/[^'";\)]+['"],\22\.['"][^'";\)]+\.txt['"]\);\21){9}(?<X2170400>)|page/['"]\.mb_substr\(md5\((?:(\$key)\)\h*,[^\}]{9,199}\bfile_put_contents\(['"]sitemap[^\.]{0,12}\.(?:txt|xml)['"]\h*,\h*\24\b[^;]+;\s*\}(?<X2178890>)|\$key\)(?<X2110651>))|XDz-config['"],0777\);\s*\$\w{1,20}\h*=\h*['"]Options\h+all\h+\\n(?<X2162870>))|\h*\((?:(\$\w{1,29}\.\$doorpath\.[^\$]{1,6}\.\$\w{1,20})\);\s*if\h*\(\h*is_writable\h*\(\28\)\)\s*\{[^\}\?]{9,99}\bif\h*\(!?\$\w{1,20}\h*=\h*fopen\(\28\.['"]/writedoor\d+\.php['"],['"]w['"]\)(?<X2182600>)|[^\{\}]{1,99}['"]moban\.html\h*['"]\h*;(?<X2146751>))|\s*\(\s*['"]\w{1,40}['"]\s*\);\s*\$\w{1,40}\s*=\s*@?file_get_contents\s*\(['"]https?://phpshell\.[^'"]{1,99}['"]\s*\);\s*[^\(]{1,40}@?touch\s*\(\s*['"][^\.]{1,40}\.php['"]\s*\)\s*;(?<X2122311>)|\s+[./]{1,9}/(\w{1,20})\s*(?:echo\s+['"]?(?:Options|DirectoryIndex|AddType|AddHandler|ReadmeName)[^>]{1,40}>{1,2}\s*[./]{1,9}/\32/\.htaccess\s*){5}[^;]{99,400}for\s+\w\s+in\s*.cd\s+/etc\s*;\s*cat\s+passwd[^;]{9,50};\s*do\s*(?:eval\s+['"]ln\s+-s\s+/[^'"]{9,99}['"];\s*){20}(?<X2118822>))|o(?:iyan8@gmail\.com['"];[^\(]{1,40}(?:getenv|mail)\((?<X2121783>)|ve_uploaded_file\s*/\*;\*/(?<X2043731>))|sg\(['"]compiling\s*shell\s*in\s*/tmp['"]\)\s*ret\s*=\s*os.system\(['"]gcc(?<X2128181>)|t_rand\(\s*0\s*,\s*count\(\s*\$not_android_urls\)-1\)(?<X2043821>)|U(?:\s*plugin\s*\-\s*(\d+)[^\}]{1,999}define\(['"]\w+['"],\s*['"]\38['"]\);[^;]{1,99}base64_decode\(.{1,9999}crontrol\-\38(?<X220359440>)|\s+Plugin[^#]{1,199}define\(['"]\w+['"],\s*base64_decode[^\|]{1,499}ob_start\(function\(\$\w+\)[^\^]{1,2699}@?file_get_contents\(__FILE__\);(?<X220359360>)|ltiple\h*config\h*fucker[^>]{0,99}</?(?:title|font|br?)>(?<X2181551>)|nmap\s*\(args\.thp_map\s*,\s*MAP_SIZE\);\s*if\s*\((\w{1,20})\)\s*\{\s*fprintf\s*\(stderr\s*,\s*['"]\D{0,4}Exploit\s+Failed\D{0,4}['"]\);\s*\}\s*return\s+\42;(?<X2122370>)|stafa\s+Kemal[^$]{1,99}\$(__FILE__)\s*\=\s*\44\;\s*\$(__DIR__)\s*\=\s*\45\;\s*(eval\(base64_decode\(['"])[^'"]{1,999}['"]\)\);\s*\46(?<X220331430>))|y(?:\h*(\$\w{1,15})\h*=\h*['"][^'"]{0,99}\bcasper\h*rfi\h*crack\h*bot\b[^'"]{0,150}['"];\s*print\(\48\);(?<X2184750>)|\h+\$\w{1,20}\h*=\h*join\h*\(['"]{2},@victims\);\s*print\h+['"]OOM.Killer\h*Victims\b(?<X2179530>)|\s*(?:%\w{1,9}\s*=\s*\(\);\s*my\s*(\$\w{1,40})\s*=\s*['"]/etc/passwd['"];\s*open\s*\(\s*PASSWD,\s*['"]\s*<\s*\51(?<X2057600>)|\$\w{1,40}\s*;\s*\$\w{1,40}\s*\.\s*=\$\w{1,40}\s*while\s*\(\s*<\s*DATA\s*>\s*\)\s*;\s*eval\s*\(\s*unpack\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X2048200>)|\$fakeproc\s*=\s*"/usr/local/apache/bin/httpd\s*-KKD"(?<X2046970>))|\s+(\$\w{1,40})='';\55\.=\$_\s+while\(<DATA>\);\55=unpack\(['"][\w\s]{1,5}\*['"],\55\);\55=[^;]{32,75};@?eval\(\55\);\s+__DATA__\s*\w\(.{7500,8000}\s*\Z(?<X2062895>)|dir->close\(\);\s*@chmod\("\$deldir",0777\);\s*echo\s+@rmdir\(\$deldir\)(?<X2050860>)|sql(?:_error\(\);\s*\}\s*\}\s*(?:else)?if\s*\(\s*isset\s*\(\s*\$_REQUEST\[['"]?([^'"]{1,40})['"]?\]\s*\)\s*\)\s*\{\s*\$_REQUEST\[['"]?\58['"]?\]\s*\.?=\s*\$\w{1,40}\s*\.\s*\$_REQUEST\[['"]?[^'"]{1,40}['"]?\];\s*if\s*\(\s*@?unlink\(\s*\$_REQUEST\[['"]?\58['"]?\](?:\s*\)\s*){1,5}\{(?<X2055681>)|i_query[\h\(]+\$con[,\h]+\$sql\d[\)\h]+;\s*file_put_contents\h*\(['"]\.//application//extra//\w{1,40}\.php['"][,\h]+(?:gz(?:uncompress|inflate)\()?base64_decode[\(\h]+['"][^'"]{999,}['"][\)\h]+;\s*(?:touch|exit|die)\h*\((?<X2177782>))|Upload\->uploadFile\h*\(\h*\)(?<X2044012>)))|n(?:ame\s*===\s*"webconsole"\)\s*\$get\s*=\s*array\(['"]https?\:\/\/pastebin\.com\/raw(?<X2051740>)|ew(?:\h+Hello[_\-]?Dolly\h*\(\h*\)\h*;(?<X2171011>)|\s*\w+\(atob\(['"]c2V0VGltZW91[^'"]{1,256}(?:Y29tL3V0aWxz|b20vdXRpbHMv|LmNvbS91dGlscy8)[^'"]+(?:fSwyMDAwKQ|LDIwMDAp|MjAwMCk)[=\+/]{0,2}['"]\){2}\(\)(?:\s*;)?(?<X1254421>)|\s*function\s*\(\s*atob\s*\(\s*['"]c2V0VGltZW91dChmdW5jdGlvbigpe2pRdWVyeS5nZXRTY3JpcH[^\)]{0,199}(?:LGZ1bmN0aW9uKCl7alF1ZXJ5K|ZnVuY3Rpb24oKXtqUXVlcnk|dW5jdGlvbigpe2pRdWVyeS)[^\)]{0,199}(?:KS5yZW1vdmVBdHRyKCJvbmxvYWQiKX0pf|LnJlbW92ZUF0dHIoIm9ubG9hZCIpfSl|cmVtb3ZlQXR0cigib25sb2FkIil9KX)[^\)]+\){2}\(\)(?<X1249181>))|o(?:hup(?:\./\w+\.png[^\{]+\{echo\s*['"]shell_exec\s*executed\s*successfully\s*['"](?<X2309450>)|\s*/tmp/\.[\w\-]+unix/javae\b[^@]+\bxmrig\b(?<X220355960>))|tify_me\h*\(\h*\)\h*;[^\v\*\^]{99,1999}\bfile_put_contents\h*\(\h*(?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]|strrev)\h*\(\h*hex2bin\h*\([^\v\*]{99,1999}\bsetcookie\h*\(\h*['"]priv[^;\v]{9,99}['"]\h*\)\h*;(?:\h*\}){2}(?<X2139790>))))
\bo(?:b(?:_(?:end_clean\(\);\s*(\$\w{1,15})[\h=]+str_replace\(array\(\s*(?:WPSecurityValidateKey\([^\)]+\),?\s*){4}\),\h*['"]{2},\h*\1\);\s*echo\h*\1;\s*exit\(\);[\s\}]+function\h*\w+\(\)\s*\{\s*if[\h\(]+is_404\(\)[\s\)\{]+WPSecurityAnalyseRequest\(\);(?<X2203540>)|start(?:[\(\)\s]+;\s*phpinfo[\(\s]+\d+[\)\s]+;\s*\$\w{1,40}[=\s]+ob_get_contents[\(\)\s]+;[^\?]+\bphp_sapi_name[\(\)\s]+\?[^\?<\|]{99,9999}\$\w{1,40}[=\s]+['"](?:index\.php|\.htaccess)['"]\s*;\s*\$\w{1,40}[=\s]+['"](?:index\.php|\.htaccess)['"]\s*;(?<X1227862>)|\(\);(?:[^%]{1,199}preg_match\(\$\w+,\s*\$\w+\)[^%]{1,199}\$_SERVER\[['"]REQUEST_URI['"]\]\s*==\s*['"]\/['"][^%]{1,199}usleep\(rand\(\d+,\s*\d+\)\)[^%]{1,199}include\s*\(['"]https?://[^%]{1,99}\.pages\.dev[^'"]{1,99}['"]\)[^%]{1,99}ob_end_flush\(\);\s*exit;\s*\}(?<X120362080>)|[^%]{1,99}header\(['"]Vary:\s*User-Agent['"]\)[^%]{1,699}preg_match\(\$\w+,\s*\$\w+\)\s*&&\s*\$_SERVER\[['"]\w+['"]\]\s*==\s*['"]\/['"][^%]{1,199}usleep\(rand\(\d+,\s*\d+\)\)[^%]{1,199}echo\s+\w+\(['"]https?://[^'"]+\.pages\.dev[^'"]{1,199}['"]\)[^%]{1,199}ob_end_flush\(\);\s*exit;(?<X120363831>)|\s*(\$\w+)=['"]https?://[^'"]+\.txt['"];\s*function\s+(\w+)[^\$]{1,49}\$_SERVER[^\$]{1,49}(\$\w+)[^\}]{1,199}return\s+gethostbyname[^;]{1,49}\8[^\{]{1,99}\7[^\?]{1,99}function_exists\(['"]curl\w+[^\]]{1,99}\6[^@]{1,599}(\$\w+)[\s=]+@?file_get_contents\(\6[^\?]{1,199}echo\9;exit;\}\}(?<X120362231>)|\s*\?>\s*<\?php\s*\$\w+[\s=]+['"]st[^%]{1,99}ot13['"];\s*\$\w+[\s=]+['"]b[^%]{1,99}ase64[^%]{1,99}error_reporting\(\d+\);(?<X120357310>)|\s*\w+\(['"]Vary:[^:]{1,99}['"]https://[^'"]+\.html['"];[^\?]{1,199}(?:\w+\(['"](curl)\w+['"]\)\)\s*\{\s*(\$\w+)[\s=]+\12\w+\(\);\s*\12\w+\(\13[^\}]{1,199}\12\w+\(\13\);[^/]{1,129}(file_get_contents)[^@]{1,179}@?json_decode\(\14\(['"]https?://[^'"]+['"]\)[^&]{1,249}echo[^\?]{1,219}ob_end_flush\(\);\s*exit;\s*\}(?<X120348551>)|function_exists\(['"](curl)\w+['"][^=]+(\$\w+)[\s=]+\16\w+\(\);\s*\16\w+\(\17[^\?]{1,369}file_get_contents[^\{]{1,49}function\s+(\w+)[^>]{1,349}\18[^\}]{1,99}echo\s+\w+\(\$\w+\);\s*\w+\(\);\s*exit;\s*\}(?<X120348781>))|\s*header(?:[^/]{1,49}\$\w+[\s=]+['"]https?://[^'"]+['"];[^\[]{1,49}\$_SERVER\[['"]\w+['"]\][^\$]{1,49}(\$\w+)[^\{]{1,199}(\$\w+)[\s=]+(?:false|true);\s*foreach[\h\(]+\20[^\}]{1,99}\21[^@]{1,299}@?file_get_contents[^\{]{1,99}\21[^\}]{1,149}echo\s+\$\w+;\s*\}\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120352550>)|[^\$]{1,49}\$\w+[^\$]{1,99}\$\w+[\s=]+strtolower\(\$_SERVER[^\{]{1,49}(function)\s+(\w+)\(\$\w+\)[^\)]{1,49}\23_exists[^;]{1,49}(curl)\w+[^\}]{1,299}\25\w+[^\{]{1,99}\$_SERVER[^:]{1,99}echo\s+\24[\h\(]['"]https?://[^'"]+\.txt['"]\);\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120352440>)|\(['"](?:\w+:\s*User\-Agent['"]\);\s*(\$\w+)[\s=]*['"]https?://colok\.iceamericano\.life/[^%]{1,699}echo\s*\w+\(\27\);\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120349160>)|Vary:(?:[^%]{1,99}\s*(\$\w+)[\s=]+['"]/\((?:bot|google|hrefs)[^'"]+/i['"];\s*(\$\w+)[\s=]+strtolower\((\$_SERVER\[['"])[^%]{1,99}if\s*\(preg_match\(\29,\s*\30\)\s*&&\s*\31[^@]{1,99}usleep\(rand\(\d+,\s*\d+\)\);\s*include\s*\(['"]home['"]\);\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120369930>)|[^:]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+["];[^\[]{1,149}strtolower\(\$_SERVER[^\{]{1,49}(function)\s+(\w+)[^'"]{1,49}\34\w+\(['"]curl\w+['"][^&]{1,399}preg_match[^\}]{1,99}echo\s+\35\(\33\);\s*ob_end_flush\(\);\s*exit;\s*\}(?<X120360340>)|[^\$]{1,49}(\$\w+)[\s=]+['"]https?://[^'"]+['"];[^\?]{1,199}strtolower\(\$_SERVER[^/]{1,49}parse_url[^@]{1,299}file_get_contents\(\37\);if\((\$\w+)[^\}]{1,99}echo\38;\}else\{http_response_code\(\d+\);echo[^\(]{1,49}ob_end_flush\(\);exit;\}(?<X120359781>)|\s*User-Agent['"]\);[^%]{1,199}\$\w+[\s=]+['"]/[^%]{1,299}\$bot_url[\s=]+['"](?:/wp-\w+|https?://)[^%]{1,299}usleep\(random_int\(\d+,\s*\d+\)\);[^%]{1,499}ob_end_flush\(\);\s*exit;\s*\}\s*\}(?<X120364520>)|\s+user\-agent['"]\);\s*(\$\w+)\s*=\s*__DIR__\s*\.\s*['"]\\x2f\\x77\\x70\\x2d\\x63\\x6f[^'"]+\\x68\\x74\\x6d\\x6c['"];[^\*]{1,419}/lp\-profile/[^&]{1,99}file_exists\(\41[^\}]{1,99}include\s+\41;[^'"]{1,99}echo\s*['"]\\x42\\x6f\\x74\\x20[^'"]+\\x6e\\x64\\x2e['"];[^'"]{1,29}exit;\s*\}(?<X120345500>))|Vary[^\$]{1,49}(\$\w+)=['"]https?://[^'"]+\.txt['"][^\?]{1,199}\$_SERVER[^/]{1,49}function\s+(\w+)[^\[]{1,49}curl_init[^!]{1,499}if\(preg_match\([^@]{1,99}echo\s+\44\(\43\);ob_end_flush\(\);exit;\}(?<X120361402>))|\([^\;]+;\s*(\$\w+)[\h='"/\(]+(?:bot|google)[^;]+;[^\?]{99,400}\bif[\(\h]+preg_match[\h\(]+\46,[^\{]+\{\s*usleep\([^;]+;\s*echo\h*\w+[\h\(]+['"]https?://[^/]+\.pages\.dev/[^'"]+\.txt['"\h\)]+;\s*ob_end_flush[\h\(\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X120361050>))|header\((?:['"]Vary:[^/]{1,99}(\$\w+)[^\[]{1,99}(\$\w+)=strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);function\s+(\w+)[^\?]{1,99}curl\w+['"]\)\)[^\?]{1,299}preg_match\(\48,\49\)&&\$_SERVER\[[^:]{1,99}echo\s*\50\(['"]https?://[^\.]+\.pages\.dev/[^'"]+\.txt['"]\);ob_end_flush\(\);\s*die;\}(?<X120356150>)|[^{]{64,512}strtolower\(\$_SERVER\[['"]HTTP_USER_AGENT[^\;]{1,32};[^;]{32,128}\$\w+=curl_init\(\);curl_setopt[^\{]{32,512}\{\w+\s*file_get_contents\(\$\w+\);\}return[^\{]{32,128}\{usleep\(rand\(\d+,\d+\)\);echo\s*\w+\(\$\w+\);ob_end_flush\(\);(?:exit|die);\}(?<X1318162>)))|\(\w+\s*\(\$\w+\)\s*\{\s*\$\w+[=\s]+crc32\(\$_SERVER\[['"]\w+['"]\]\);\s*\$\w+[\s=]+array\(\s*['"][^'"]{1,99}casino\b(?<X220328100>)|\(function\((\$\w+)\)\s*\{\s*\54[\s=]+str_ireplace\(['"](<\w+>)['"],\s*['"]\55<script\s*src=['"]https?://[^%]{1,99}></script>['"],\s*\54\);\s*return\s*\54;\s*\}\);\s*(?<X120368002>)))|fuscated\s*by\s*Yak\s*Pro\b[^;\$]{9,499}\bgoto\s*\w{1,9};\s*\w{1,9}:[^@]{99,499}\$(\w{1,40})\h*=\h*['"][^'"]{1,49}[pg](?:mail|rotonmail)\.com['"];[^@]{9,99}\bmail\h*\(\h*\$\57\b(?<X2157990>))|n(?:error\s*=\s*['"]eval[\s\(]+/\*[^;\*\n/]{0,40}\*/\s*String\.fromCharCode\s*\([\d,\s]{99,999}[\s\)]+['"](?<X1197350>)|mouseover=['"](this\.)stop\(\)['"]\h*onmouseout=['"]\60start\(\)['"]>[^_]{0,20}\bcyb[3e]r_[i1]d[3ei1][0o][t7]\b(?<X2142152>))|p(?:en(?:\((?:my\s*)?(\w+),[^\)]*\$ARGV\[[^\?]{1,499}\bwhile\(<\62>\)\{(?:(\$\w+)=\$_;)?[^\?]{1,499}\bsystem\(['"]p(?:erl|ython|hp)\b[^'"]{1,199}(?:\63|\$_)\b(?<X2211631>)|\h*FILE,[^\?:,@%&\*]{1,199}\bmy\h*(\$\w{1,40})=new\h*Parallel::Forkmanager\([^\?]{1,999}\bsendmail\([^\)]{1,199}\);\65\->finish;(?<X2181810>)|\s*\((d[o0]mains),\s*['"]/etc/named\.conf['"]\s*\)[^;]+;\s*@?\w{1,9}\s*=\s*<\67>;\s*close\s*\67\s*;\s*if\s*\(\s*\$err\s*\)\s*\{(?<X2132641>)|ssl_(?:(decrypt)\([^@%&:\\\+]{1,999}\$(\w{1,40})=new\h+\69\b[^\?@#%&\\\+]{1,999}\$\70\->removeDeface\((?<X2184990>)|RAW_DATA,\s*hex2bin\(\s*['"]\w+['"]\s*\)\s*\);\s*\}\s*\}\s*(\$\w+)\s*=\s*tmpfile\s*\(\);\$\w+\s*=\s*stream_get_meta_data\s*\(\s*\72\s*\);\s*fwrite\s*\(\s*\$\w+,\s*['"]\s*<\?php\s*['"]\.\s*\w+\s*\(\s*\$_COOKIE\s*\[\s*\d+\s*\-\s*\d+\s*\](?<X220343870>)))|tion\s*value=['"]cat\s*/etc/passwd['"]>(?<X2050881>))|s\.system\(['"]ln\h+-s\W{0,9}\w{1,20}\.txt['"]\)\s*(\w{1,9})\h*=\h*['"]Options\h+indexes\h+FollowSymLinks\\n[^'"]{9,99}['"]\s*(\w{1,9})\h*=\h*open\(['"]\.htaccess['"],['"]w\+['"]\)\s*\76\.write\(\75\)\s*\76\.close\(\)(?<X2158700>)|tp_err\.php['"]\.['"]\\['"]>\*\*\s+OTP[^\*]{1,99}\*\*\s+PIN[^\*]{1,99}\*\*\s+PIN_error[^\*]{1,99}\*\*\s+password[^\*]{1,99}\*\*\s+Password_Error[^:]{1,299}https://api\.telegram\.org\/bot['"]\s+\.\s+\$\w+\s+\.\s+['"]/sendMessage(?<X220328900>)|va\-tools\s*https?://t\.me/ovacloud\s*\*\*/\s*\$\w+[=\s]+\[(?<X220327750>))
\bp(?:(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\][^@]{9,99}\b(mail_to)\h*=\h*['"][^\}]{0,399}\bmail\(\$\1,\h*['"]Logs\d\h*Attemt\b(?<X2169021>)|a(?:ckage\h*Skyrdp\h*Shell\b(?<X220364360>)|th_throwgh_files.+burlywood(?<X2046140>))|cntl_exec\(['"][^\s'"]{0,49}\bperl\b[^=]{1,199}=(\w{1,9}(\(\$\w{1,40}\);))\W{0,9}(unlink)\6[^@#%&\|]{99,999}=new\h*COM\(['"]WScript\.Shell['"]\);\$\w{1,40}\->Run\(['"]c:[^\s'"]+\.exe\b[^=]{1,199}=\5\W{0,9}\7\6(?<X2180710>)|DF[\-\s]+<\?\s*[ph\s]+/[\*\s]+plugin\s*name:(?<X2306400>)|h(?:ishers\h+is\h+against\h+abusive\h+form[^\$]{9,99}['"];\s*\$bad_words\h*=\h*array\((?<X2150560>)|p(?:_uname(?:\(\)(?:,\s*['"][^'"]{1,40}['"]=>phpversion\(\),['"][^'"]{1,40}['"]=>['"]\d+\.\d+['"],[^\?/\]]{1,599}/json['"]\);echo\s*json_encode\((?<X2130820>)|[^\?]{1,300}<title>[^<]{0,25}\bSh[e3]ll\b[^<]{0,25}</title>(?<X2133121>))|\h*\(\)\h*(?:;\s*\$\w{1,40}\h*=\h*@?ini_get\h*\(\h*['"]disable_functions['"]\)\h*;(?<X2167091>)|\.\h*base64_decode\h*\((?<X2259600>))|\s*\(\s*\)\s*\.[^\(]{1,99}getcwd\s*\(\s*\)\s*;?[^\(;]{1,499};\s*if\s*\(\s*!\s*empty\s*\(\s*\$_FILES\[[^\]]+\][\s\)]+\{\s*@?(?:move_uploaded_file|copy)\s*\(\s*\$_FILES\s*\[(?<X2127210>))|ddos\.com[^'"]{0,40}['"];\s*echo\s*['"]\s*SYN\s*Flood(?<X2052770>)|info\s*\(\);\s*break;[^\?]{9,9999}<form\s+action=['"]\?[^`]{999,19999}\bshell_exec[\(\s]+\$\w{1,40}[\)\s]+;(?<X2222102>)|shell[^\?]{0,49}\buse\h*\w{1,15};\s*my\h*\(\h*\$\w{1,15},\h*%FORM\h*\);(?<X2172650>)|version\s*\(\s*\)\s*;\s*@?mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*@?mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054481>)))|l(?:\(\$s_cwd\)\.['"]&x=upload['"](?:\.['"]+)?>upl\b(?<X2049361>)|ugin(?:\h*name:\s*(\w+)[^\?]{0,99}\bclass\h*\21\s*\{\s*var\h*\$\w+[\h=]+['"][^'"]{2999,}['"];\s*var\h*\$\w+[\h=]+array\(\d+,[^\?]{999,59999}\bisset\((\$_SERVER\[\$\w+\])\)[\h\?]+\22[^#]{999,4999}\beval\(\$\w+\->\w+\);\s*\}\s*\}(?<X2209700>)|\s*name:(?:[^#]{99,9999}endpoint['"]=>['"]aHR0cHM6Ly9nb29nbGFuYWxpdG(?<X220354230>)|[^\*]{1,99}\bAuthor:\s*WordPress\s*\*/\s*\w+\s*\w+;[^\}]+\}\s*\w+\s*\(\s*!\s*\w+\([^\}]{1,1299}hide_plugin_from_list[^\}]{1,199}\s*\}\s*[^\{]{1,32}GetIP\((?<X220335000>)|\s*SecurePlugin\w+[^%]{1,99}class\s*Loader\w+\s*\{\s*private\s*function\s*\w+\(\)\s*\{[^%]{1,99}\$\w+[\s=]+(?:defined\(['"](__DIR__)['"]\)\s*\?\s*\26\s*:\s*dirname\(__FILE__\);\s*return\s*str_rot13\(['"]\w+['"]\);\s*\}(?<X220353000>)|unpack\(['"]\w+['"],\s*hash\(['"]\w+['"],\s*microtime\(\),\s*(?:true|false)\)\);\s*return\s*base64_decode\(['"][^'"]{1,199}['"]\);\s*\}(?<X220354770>)))|\s+(?:name:(?:[^\*]{8,32}\*/\s*\$GLOBALS\[['"]\w+['"]\]=array\(['"]\\(?<X220363922>)|[^\\]{32,999}\bwordpress_logged_in_/\.test\(\w+\.cookie\){3}\{\w+\s*\w*=\s*\[['"]aHR0c[^\\]{1,999}\$GLOBALS\[['"](?<X220360970>)|[^\{]{1,99}plugin\s+uri:\s*https?://example\.com\b[^\\]{1,9999}dns_get_record\([^;]+DNS_TXT(?<X220356673>)|\s*(\w+)[^\{]{1,999}author:\s*wp\s+license:[^\{]{1,999}text\s+domain:\s*\32(?<X220364260>)|\s*(Sid\s+Gifari\s+SEO\s+Code\s+Uplaoder)[^\*]{1,399}Author:\s+\34[\h\-]+Team=\s+Gifari\s+Industries[\h\-]+BD\s+Cyber\s+Security\s+Team(?<X220369201>)|\s*(WP\s+Cache\s+Helper)[^\-]{1,99}Description:\s+\36\s+for\s+WordPress[^\-]{1,199}https://github\.com/coreflux[^#]{1,3999}\->set_role\(['"]administrator['"]\)(?<X220359080>)|\s*admin\s+guardian[^!]{1,299}Author:\s*AWG(?<X220367271>)|\s*Classic\s+Editor\s+Tools[^@]{1,999}\bregister_activation_hook\(__FILE__,\s+array\(\$\w+,\s*['"]activate['"][^\.]{1,399}\bCREATE\s+TABLE[^@]{500,6999}\bget_token['"]\)(?<X220367002>)|\s*Hostinger\s+Backup[^:]{1,49}Version:[^:]{1,799}\$\w+[\s=]+\[['"]casino['"],['"]bonus['"],['"]spins['"],['"]free['"]\];(?<X120357740>)|\s*plugins\s*\./Mr403Forbidden\b(?<X220361840>)|\s*shell\s*plugin\s*plugin\s*URI:\s*https?://example\.com\b(?<X220335140>)|\s*Site\s+Toolkit\s+Services[^\|]{1,1999}wp_create_user\((\$__stk_)username,\s+\43password,\s*\43email\);[^'"]{1,99}set_role\(['"]administrator['"]\);(?<X220360360>)|\s*wordfence[^\{]{1,199}author:\s*wordfence[^#]{1,999}\$\w+[\s=]+['"]http://\d+\.\d+\.\d+\.\d+(?<X220354210>)|\s*wp\s+(?:Analytics\s+core[^\{]{1,999}author:\s*wp\s+core\s*team\b(?<X220364230>)|Performance\s+Analytics[^@]{1,599}wp_get_current_user\(\);[^\(]{1,99}\(['"]administrator[^\?]{1,199}isset\(\$_SERVER\[['"]HTTP_USER_AGENT[^#]{1,5999}new\s+Uint8Array(?<X220361210>))|\s+(nybaro)[^\.]{1,49}plugin\s+uri:\s*https?://[^/]+/\48[^/]{1,99}author:\s+erasmo\s+hal(?<X220367560>)|\s+(Primary\s+Loader\s+Plugin)[^:]{1,49}Description:\s+\50[^@]{1,499}add_action\(['"]rest_api_init['"],\s+function[^/]{1,49}register_rest_route\(['"]plugin\-updater[^\|]{1,999}(\$\w+)[\s=]+['"]https?://[^'"]+\{(\$\w+)\}[^'"]+\.zip['"];\s*error_log[^\$]{1,99}\52[^;]{1,49}\51['"]\);(?<X220364770>)|\s+(WooCommerce)\s+Unauthorized\s+Administrative[^\-]{1,199}Author:\s+\54[^#]{1,1299}wp_create_user[^\?]{1,199}set_role\((base64_decode)[^\|]{1,2999}(\$\w+)[\s=]+['"]aHR0[^'"]+['"];\s*(\$\w+)[\s=]+\55\(\56[^>]{1,99}wp_remote_get\(\57(?<X220364750>)|\s+\{\{MU_PLUGIN_NAME\}\}[^@]{1,999}Anti\-detection:(?<X220360211>)|\s+Am\s+I\s+Human\s*Description:\s+No\s+Bots\s+Allowed[^/]{1,99}author:\s+Security\s+researcher\s+TOPAZ(?<X220366623>)|\s+ultravueal\s+reactsion[^\?]{1,199}author:\s*microcloudible\s+maxreacting(?<X220370180>)|\s+wordpress\s+site\s+editor[^&]{1,199}is_admin\(\)[^\(]{1,49}\(function_exists\((?<X220370430>)|\s+WP\s+(?:Api\s+Auth[^#]{1,1999}if[\h\(]+!username_exists\((\$\w+)\)\)\s*\{\s*(\$\w+)[\s=]+wp_create_user\(\63[^\{]{1,99}is_wp_error\(\64[^#]{1,7999}strpos\(\$\w+\[['"]administrator[^@]{999,}@file_put_contents\((?<X220363210>)|UpdraftPlus[^/]{1,199}author:\s+otter\s+loginizer(?<X220369220>)))|uri:\s+https?://github\.com\s*\*\s*Description:\s*GAnalyticsWpPlugin\b(?<X220358770>))))|o(?:ison\h*Shell\s*</title>\s*['"]\s*;\s*(\$\w{1,40})\s*=\s*php_uname\s*\([^;]{1,49};\s*\$\w{1,40}\s*=\s*['"]https?://(?:www\.)?exploit\-db\.com/search/[^;]{0,499}\68(?<X2140590>)|rt_c="I2luY2x1ZGUgPHN0ZGlvLm(?<X2051070>)|wered\s+by\s+Mr\.Alsa3ek\s+@\s+TeaM\s+HacKer\s+Egypt\b(?<X2265380>)))
\bpr(?:e(?:>';\s*if\s*\(\$_POST\[['"](cmd)['"]\]\)\{\s*\$\1\s*=\s*\$_POST\[['"]\1['"]\];\s*passthru\(\$\1\);(?<X2052710>)|g_match(?:(?:_all)?\([^,]+,file_Get_contents\((?:['"]php://input|\$_[GPCSR]\w{2,6}\[)[^,]+,(\$\w+)\b[^@]{1,499}\beval\([^;]{0,199}\3\[(?<X2214591>)|\((?:['"]/\d+xbeast[^\};#]{9,99}\$\w{1,20}=['"]anonymousfox\-['"]\.substr\(str_shuffle\((?<X2192010>)|['"]?/sape/i['"]?\s*,\s*\$_SERVER\[['"]?HTTP_REFERER(?<X2111512>)|['"]\Wdefine[^'"]{0,99}\bDB_PASSWORD\b[^@#%:!<>\|&]{1,1999}\bmysqli?_query\([^\)]*['"]update\b[^;]{1,99}\busers\s+set\b[^;]{0,99}\buser_pass=(?<X2206241>)|[^\$]{1,99}\.php\$/['"].\$_SERVER\[['"]PHP_SELF['"]\].(\$\w+)\)\)\{\s*(\$\w+)[\s=]+\8[^\}]+\}\s*\$\w+[\s=]+str_pad\(\w+\(\9[^\}]{1,999}\w+\(unpack\(['"]\w\*['"],\s*\9(?<X220331730>)))|g_replace\((?:['"](?:\\x2f(?:\\x..)+['"]\s*,\s*['"](?:\\x..)+['"],['"]['"]\);(?<X1034172>)|\W+['"],['"]['"],(\$\w+)\);eval\(['"]\?>['"]\.\12\);\}\?>\s*\Z(?<X220367850>))|(?:\"\\043\\056\\052\\043\\145(?<X2044201>)|\$\w+.\$\w+,"(?:\\x[a-z0-9]+){3}.{3000,}\?>(?<X2044712>)))|g_replace(?:\h*\(\h*['"](\W)[^'",]{1,99}\16e['"]\h*,\h*@?str_rot13\h*\(\h*['"]\h*@?(?:nffreg|riny)\h*\(\h*\$_[TCPFE]\w{2,6}\[[^\]]+\]\h*\)\h*;\h*['"]\h*\)\h*,[^;\)]{1,99}\)\h*;(?<X1175191>)|\s*\(\s*(?:.?['"](.).{0,40}\18e\w?.?['"]\s*,\s*(?:['"]\\x(?:65\\x76\\x61\\x6C\\x28\\x62\\x61\\x73\\x65\\x36\\x34\\x5F\\x64\\x65\\x63\\x6F\\x64\\x65\\x28[^'"]{99,300}['"]\s*,\s*['"]\.["']\);(?<X1125040>)|[^'"]{9,199}['"][^'"]+['"][^'"]{9,199}['"]\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1125280>))|str_replace\s*\(['"]\s+['"],['"]\s*['"],\s*["'](?:\\x[\d\w]{2,4}){9}[^'"]{9,999}['"][^'"\n]{9999,30000}['"](?:\\x[\d\w]{2,4}){1,9}['"]\)\s*,\s*['"]\.['"]\);(?<X1134662>))|\$exif\[\s*\\['"]Make\\['"]\s*\]\s*,\s*\$exif\[\s*\\['"]Model\\['"]\s*\](?<X2101491>)))|g_split(?:[\h\(]+['"]\/\/u['"][^\?]{99,1700}\bsys_get_temp_dir\(\)[\h\.]+DIRECTORY_SEPARATOR[\h\.]+['"]config_[^\?]{9,299}\bregister_shutdown_function\s*\(function\(\)\h*use\h*\((\$\w+)[^\?]{0,99}\bunlink\(\23\);(?<X220363910>)|\("//",\$\w+,-1,PREG_SPLIT_NO_EMPTY\);\$\w+=implode\("",array_reverse\(\$\w+\)\);};\$\w+=__FILE__;(?<X2046040>)))|int(?:\([_]*\);[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(base64_decode\(\$_SERVER\[HTTP_CMD[\]\)]+;(?:exit|die)[^;]{0,9};(?<X1206800>)|\h*['"](?:[^;]{9,99}\bcgi\h*command\h*run[^;]{0,15}\bninjacr\d{0,1}</h\d>(?<X2172550>)|\$_SERVER\[[^\]]+\]\h*not\h*found<[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\$\w{1,15}[\h=]+['"]https?://\$\w{1,15}:\$\w{1,15}/\$\w{1,5}['"];\s*print_dbg\b(?<X2198420>)|\h*\W{0,25}SQL\h*Scanner[^;]+;\s*print\h*['"]\h*\W{0,25}Coded\h*by[^\-]{0,25}\-\h*IndoXploit(?<X1143910>))|\h+['"](?:(?:https?://)?twitter\.com/Reckz0r\b(?<X2153400>)|[^'"]{5,60}\bCode\h*Execution\h*(?:exploit|vulnerability)\h*by\b(?<X2179320>)|document\.write\(['"]<script\h+src=\\['"]http?://[^\);]{9,150}\);\s*['"];\s*\$\w{1,20}\h*=\h*fopen\((__FILE__),[^#%]{300,999}\btouch\(dirname\(\32\),\h*\$\w{1,20}\);\s*\}\s*@?unlink\(\32\);(?<X2159520>)|Slowloris[^;]+\\n['"];(?<X2150711>))|\s*"(?:<form enctype=multipart/form-data[^"]*"\s*;\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*gogogo\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*tmp_name\s*\]\s*\)\s*\)\s*\{\s*@copy\s*\(\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*tmp_name\s*\]\s*,\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*name\s*\]\s*\)\s*;\s*\}\s*\}\s*;(?<X1039150>)|Sending\s*Mail\s*To\s*\$to\.\.\.\.";\s*flush\(\);\s*\$header\s*=\s*"From:\s*\$realnamenew(?<X2047350>))|\s*'<form\s*enctype=multipart/form-data\s*method=post><input\s*name=\w+\s*type=file><input\s*type=submit\s*name=g>\s*</form>';\s*if\(\s*isset\(\s*\$_POST\['\w+'\]\s*\)\s*\)\s*{\s*if\s*\(\s*is_uploaded_file\(\s*\$_FILES\['\w+'\]\['tmp_name'\]\s*\)\s*\)\s*{\s*@?copy\(\$_FILES\['\w+'\]\['tmp_name'\]\s*,\s*\$_FILES\['\w+'\]\['name'\]\);\s*}\s*}\s*exit;(?<X1036010>)|\s*['"](?:\W{0,9}\s*ConnectBack\s+Backdoor\s+Shell\b[^;]{1,99};(?<X2118641>)|At+a[quck]{2}e?:\s*\$ip\s+on\s+port\s+\$rand[^'"]*['"];[^\(\{]{1,99}\s*for\((\$\w)=0;\39<65535;\39\+\+\)\s*\{\s*\$out\s*\.=\s*['"][^'"]{1,40}['"];\s*\}\s*while\(1\)\s*\{[^:/]{1,99}\s*\$\w{1,40}\s*=\s*fsockopen\(['"](?:udp|tcp)://(?<X2124082>))|\s*\$\w{1,9}\s*['"]PRIVMSG\s*['"]\.\$\w{1,9}\.['"]\s*:\s*Bot\s*genol(?<X2128190>)|\s*\(\s*shell_exec\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)\[['"]ex[3e]c['"]\]\s*\)[^\)]{0,9}\);[^\(]{9,50}(\$\w{1,40})\s*=\s*['"][^'"]*['"];\s*if\s*\(\s*isset\s*\(\s*(\$_FILES\[[^\]]+\])\)\)[^\}]{99,250}if\s*\(\s*move_uploaded_file\s*\(\s*\43\[[^\]]+\],[^\)]+\)\)\s*\{\s*\42\s*=\s*['"](?<X2065311>)|\s+['"](?:(?:IHS\s+BACK\D{0,3}CONNECT\s+BACKDOOR|Av[3e]l[0o]x[1i][5s]\s+backconnect\s+tool)\b(?<X2123281>)|\W{0,5}Dr\.S[a4]M[!i]M_\d{1,4}\s+Pr[!i]v(?:ate|8)\s+L[o0]c[a4][l1](?<X2122350>))|\W{0,9}(?:hack|own|fuck|defac|pwn|cod|mass)ed\h*by\h*th[3e]\h*k[i!]ll[3e]r\h*dz(?<X2183603>)|_r(?:[\h\(]+glob[\h\(]['"][^'"]+['"][\h\)]+;\s*die[\h\(]+file_get_contents[\h\(]+['"][^'"]+\bindex\.php['"][\)\h]+;(?<X1257810>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;(?<X1041111>)|\s*\(\s*call_user_func_array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\)\s*;(?<X1041101>))|f\("Usage: findsock ip port(?<X2050730>)|f\h*['"][^'"]{1,999}\bflood[^\?]{0,799}\bif\h*\(\$ARGV\[\d+\]\h*\D{2,3}[^\{]{1,49}\{\s*system\((?<X2187880>))|iv(?:(?:8|ate)\b[^'"]{1,99}['"]\s+(\w{1,40})\h*=\h*open\(\h*['"]/etc/passwd['"][^\)]{1,49}\)\s+\53\h*=\h*\53\.read\(\)\s+\53\h*=\h*re\.find\w{1,9}\(\h*['"]/home/[^\,]{1,49},\h*\53\h*\)\s+for\h+\w{1,40}\h+in\h+\53:(?<X2147890>)|8</title>[^\?]{9,200}<\?php\s*\$\w{1,15}\h*=\h*file\h*\(\h*['"]\h*/etc/passwd\h*['"]\h*\);(?<X2160070>)|8\s+MAILER\s*<\s*/title\s*>(?<X2049032>)|ate(?:\$\w+=['"]\w{9999,}['"];public\s*\w+\s*\w+\([^\.]{1,999}\.=chr\(\$\w+\);\}\w+\$\w+\(\);\}\}\$\w+=new\s*\w+\(\);\$\w+\->\w+\(\);\$\w+\->\w+\(\);\$\w+\->\w+\(\);\Z(?<X220354190>)|\s*\$\w{1,40}\s*=\s*(?:'[^']{10,200}'\s*;\s*private\s*\$\w{1,40}\s*=\s*'application/msword'\s*;\s*public\s*function\s*execute\s*\(\s*\)(?<X2048950>)|['"]https?://(?:govniku|norauto)\.site/?['"]\s*;(?<X1210202>))|\s+function\s+backdoorFiles\s*\(\s*\$\w{1,40}\s*\)(?<X2051750>)))|o(?:ftpd[^`\176]{1,9999}?eval\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)(?<X2045493>)|tected\s+function\s+getipstack\((\$\w+)\)\s*\{\s*if\s+\((!empty)\((\$\w+)\->(IP_STACK_TOKEN)\)\s*&&\s*\63\(\62\)\)\s*\{\s*try\s*\{\s*\$\w+\s*=\s*sprintf\(base64_decode\(['"]aHR0cDovL2[^'"]+fa2V5PSVz['"]\),\s*\62,\s*\64\->\65\);(?<X220345660>)))
\bpu(?:blic(?:\h+(?:(function)\h+\w{1,40}\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*['"]\1['"]\h*;\s*(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\.\h*['"]return\h+true;\h*['"]\h*;\s*(\$\w{1,40})\h*=\h*\$this\->\w{1,40}\h*\.\h*['"]_['"]\h*\.\h*\2\h*;\s*\$\w{1,40}\h*=\h*\4\h*\(\h*(?:['"]{2}|null)\h*,\h*\3\h*\)\h*;(?<X2159822>)|function[^\{]{1,40}\{\s*(\$\w{1,25})\h*->\h*baseUrl\h*=\h*hex2bin\(\h*['"]68747[^'"]{5,40}672f['"]\h*\);\s*\6\h*->\h*script\h*=\h*['"]Wordpress['"];(?<X2157780>)|static\h+function\h+wp_login\(\)\s*\{\s*(\$\w{1,20})\h*=\h*hex2bin\([^\)]{9,99}\);\s*if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\{\s*(\$\w{1,20})\h*=\h*['"]https?://[^\(]{9,200}\bwp_authenticate\([^\)]+\);[^\{]{9,99}\{\s*\$\w{1,20}\h*=\h*wp_remote_post\(\8\.[^\];]{99,200}=>\h*\9,[\s\]\}\);]{10,40}(?<X1146431>))|\s*function(?:\s*root_vuln\s*\(\s*\)\s*\{\s*\$\w{1,40}\s*=\s*php_uname(?<X2051981>)|__destruct\(\)\{(\w+)::(\$\w+)=unserialize\(\12::\13[);\s]{1,16}\$\w+[^}]{1,256}[}\s]+public\s*function\s*\w+\((\$\w+)\,(\$\w+)[)\s]+{return\14\s*[[\]\d]+\^str_repeat\(\15\,(?:intval)?\(strlen\(\14\s*[\d[\]]+\)\s*/\s*strlen\(\15\){2}\s*\+\s*\d\);\}[^\}]+array_map\([^%]{1,999}base64_decode\(md5\((?<X2299533>))|\s+(?:function(?:\s+(?:\w+[^;]{1,49}require_once[^;]{1,99}\.php[^\(]{1,49}(\$\w+)[^\{]{1,99}foreach[\h\(]+\17[^;]{1,99}['"](\w+\-\w+)['"][^\?]{1,199}is_plugin_active[^:]{1,299}curl_\w+[\h\(]+['"]https?://[^'"]+['"][^@]{1,499}(\$\w+)[\s=]+['"]https?://[^'"]+\18\.zip['"];[^\?]{1,199}\19[^@]{1,599}@?unlink[^\?]{1,299}\17[^\*]{1,799}update_option[\h\(]+['"]\w+['"][^\*]{1,49}\}\s*\}\s*\}(?<X120363450>)|load_dependencies\(\)\s+\{\s+(\$\w+\s+)=\s+\[\s+(?:['"]class\-gplrock\-(?:database|api|content|seo|ghost|cron|admin)\.php['"],\s+){7}['"]class\-gplrock\-public\-frontend\.php['"]\s+\];\s+foreach\s+\(\21as\s+\$\w+\)\s+\{\s+\$\w+\s+=\s+GPLROCK_PLUGIN_DIR(?<X220363901>)|setLinksToDbJm\(\)(?<X2048930>))|__destruct\(\)\{(\$\w+)=['"]base64_decode['"];(\$\w+)=(\$\w+)\->(\w+)[^\-]{1,49}\26\->\27[^\)]{1,49}\24[^&]{1,99}if\(\25!=""&&\$\w+==['"][^'"]{1,10}['"]\)\s*\{(\$\w+)=\$\w+\(\25\);eval\(\28\);\}return;\}(?<X120352892>))|string\s+sessionName\s*=\s*['"]ASPXSpy['"];(?<X2123870>)))|sh\s*\(@\w{1,20}\s*,\s*['"]https?://www\.milw0rm\.com/exploits/(?<X2129380>)|tenv(?:\(['"]\w{1,40}=\(\)\{\w{1,40};\};[^\)]{1,99}\);mail\([^\)]+\);(\$\w{1,40})=file_get_contents\((\$\w{1,40})\);unlink\(\33\);return\s*\32;\}function\s*\w{1,40}\(\$\w{1,40}\)\{\$\w{1,40}=['"][^'"]{65000,}['"];(?<X2137720>)|\h*\(\h*['"]PHP_LOL=\(\)\h*\{\h*\w{1,40};\h*\};\h*\$\w{1,40}\h*>\h*\$\w{1,40}\h*2>&1['"](?<X2155831>))|tincache\(\$urlhash\."::::"\.codedata(?<X2050640>))
\bR(?:(ewriteRule\s*\^\w{1,3})/\w*\-\.\*\-\(\\d\+\)\.(\w?html?\$)\s*(\w*\/index\\\.php\?)\w{1,3}=\$\d+\&\%(\{QUERY_STRING\}\s*\[L\])\s*R\1\/\(\.\*\)[\-\w]+\\d\+\.\2\s*\3\w{1,3}=\$\d+\&\%\4(?<X1203621>)|and(?:\h*\([^\)]+\);\s*\$victim.creds\h*=(?<X2168860>)|o?m?keywords?\.php\?\w{1,20}=['"]\.md5\([^/\{]{9,99}\bif\([^\{]{1,60}\bsitemap\.xml['"]\)[^\\#\*]{200,1300}\bif\(isBot\(\)\)[\{\s]+[^=]{9,99}\}\s*include\h*cache\w{1,20}\(\);\s*(?:die|exit)[^;]{0,9};\s*function\h+\w{1,20}\(\$x5had\b(?<X2210611>))|e(?:alpath\([^\)]+\);[^\(]{0,50}if\s*\(\s*isset\s*\(\s*(\$_POST\[['"](eval)['"]\]\)\s*\))\s*\{\s*\9\s*\(\s*base64_decode\s*\(\s*\8;\s*\}[^\d\?\}]{9,99}file_get_contents\((\$\w{1,9})\);[^\}]{9,300}chmod\s*\(\10,\s*0?777\);\s*if\s*\(function_exists\s*\(['"]mb_ereg_replace(?<X2060821>)|c(?:oded\h*by\h*BabyMoon[^#]{1,149}\bif\(@?@?(?:copy|move_uploaded_file)\(\$_FILES(?<X2173390>)|urse_copy(?:\((?:\$\w{1,40},(\$\w{1,40})\);if\(!?isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\s*(?:\{\s*)?header\(['"]Location:['"]\.\13\b[^\}\?]{1,499}\b[cm]o(?:py|ve_uploaded_File)\([^\?]{1,499}\bmail\([^;]{1,99};(?:echo\b[^;]{1,99};)?(?:die|exit)[^;]{0,19};(?:unset\(\13\);)?(?:\?>)?\Z(?<X2183711>)|\s*\$src\s*,\s*\$dst\s*\);\s*header\(\s*['"]location:\s*\$dst['"]\s*\);(?<X2115451>))|(?:\h*\(\h*\$[^,]{1,40},\h*\$[^\)]{1,40}\)\h*;\s*header\h*\(\h*['"]location:(?:(?<X2171991>)|[^;]+;\s*(\$\w{1,40})\h*=\h*@?fopen\h*\(\h*['"]\w{1,6}\.txt['"]\h*,\h*['"]a\+?['"]\h*\)\h*;\s*fwrite\h*\(\h*\17\h*,(?<X2172010>))|\s*\(\s*\$src\s*,\s*\$dst\s*\);[^:]{0,99}header\s*\(\s*['"]location:\s*\$dst\??(?:['"]\s*\);[^\.]{1,99}\$\w{1,40}\s*=\s*fopen\(['"][^'"]{1,19}\.txt['"]\s*,\s*['"][aw]\+?['"]\);[^\?]{0,99}fwrite\(|[^\?]{1,40}(?:\?>|\Z)|[^;]{1,40};\s*\}\s*else)(?<X2120317>))))|direct(?:\h*\d+\h*/slot/\w+\.php\h*https?://[^/]+/slot\b[^/]+/\w+\.php(?<X1236340>)|\s+301\s+/slot\-gacor/\s+https://[\w\.\-/]+$(?<X1229260>)|Match\s+301\s+\^/\(\[[^:]{1,399}https?://(trusik\.co\.uk/\$)\d+\s+RewriteEngine\s*on\s*RewriteCond\s*\%\{SERVER_PORT\}\s+80\s+rewriteCond\s+%\{REQUEST_URI\}\s+!\^/\\\.well\-known/[^\*]{1,999}\*\)\$\s+https://www\.\22\d+\s*\[R,L\](?<X1324731>)|Permanent\s+/\s+https?://develryllc\.com/\?(?<X1242800>))|fresh['"]\s*content=['"]\d+;\s*url=(http://(?:bestselect2019|fastsmartassist|globalmedsreward|goodfastquality|herbal(?:drugsvalue|genericinc)|luckybestmart|newhealthprogram|online(?:firsttrade|hotprice|smartmall)|organicfirstdeal|pure(?:first|organice)shop|the(?:aidoutlet|pillsupply))\.[senbrut]{1,3})/?['"]\s*>\s*<script\s*type=['"]text/javascript['"]>\s*window\.location\.href\s*=\s*['"]\25[^\?]{80,300}\s*</body>\s*</html>\s*\Z(?<X2058373>)|giSTer_sHUtdoWN_fUNCtiOn(?:[\s\('"\\]+unlink[,'"\)\s]+(\$\w{1,40})[,'"\)]+;[^\}\?,]{0,99}\27[\h=]+implode[\s\(]+['"][^"']+['"][^;]+;\s*unset[\s\('"\\]+\27[,'"\);\s]+endif;\s*(\$\w{1,40})[\h=]+fopen[\s\(]+\27[^;]+;\s*fwrite[\s\(]+\28[^;\$]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\);]+fclose[\s\(]+\28[\s\);]+include\h*\27;(?<X2197010>)|\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*\}\s*\}\s*\}\s*\$\w{1,40}\s*=\s*new\s*Ratel\s*;\s*\$\w{1,40}-\s*>\s*init\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X2048220>)|\s*\(\s*\$\w{1,40}\s*\(\s*['"]{2}\s*,\s*\$\w{1,40}\s*\(\s*\$_[GPCSR]\w{2,6}\[(?<X2144791>))|name(?:\h*\(\h*['"]/[^'"]{3,199}['"]\h*,\h*['"]/[^'"]{3,199}\d+['"]\h*\)\h*;\s*(\$\w{1,40})\h*=\h*['"]%[^'"]{9999,}['"];(?:\s*(\$\w{1,40})\h*=\h*@?(?:urldecode|strrev|str_rot13)\h*\(\h*\32\h*\)\h*;)+\s*@?eval\h*\(\h*\33\h*\)\h*;(?<X1187150>)|\s*\(\s*(\$\w{1,20})\s*\.\s*"\.php\.suspected"\s*,\s*\35\."\.php"\s*\);(?<X2047670>))|porting\(0\);\s*\$\w+[\s=]+['"]\\150\\164\\164\\160\\163\\[^'"]+\\170\\x2e\\x74\\170\\164['"];(?<X120354340>)|quire(?:(?:_once)?(?:[ ]+dirname\([ ]+__FILE__[ ]+\)[ ]+\.[ ]+['"]/config/class\.php['"]\h*;(?<X1158020>)|\h*__DIR__\h*\.\h*['"]\.{0,2}/wp\-includes/(IXR)/class\-\39\-cookie\.php['"]\h*;(?<X1238750>))|(?:[\s\('"\./]+wp\-includes/reg[^;]+;\s*\$\w{1,40}\h*=[^\{]{9,99}\{\s*(\$\w{1,40})[\s=]+wp_create_user[\s\('"]+[^'"\$]+['"](?:\s*,\s*['"][^'"\$]*['"])+[\s\)]+;\s*(\$\w{1,40})[\s=]+new\s*WP_user[\s\(]+\41[\s\);]+(\42\->set_role[\s\(]+)['"](administrator)['"][\s\);]+\}[^\}]{0,999}\43\s*['"]\44['"\)\s;]+\}(?<X1191580>)|[\s\(]*['"][^'"]*\bwp-includes/reg\w+\.php['"][\s\)]*;\s*if\s*\([^;\{]+\{\s*\$\w+[\s=]+wp_create_user[\s\(]+['"]([^'"]+)['"][\s,]+['"]([^'"]+)['"][^\}]{1,499}\->\s*set_role[\s\(]+['"]admin\w+['"][^\}]+\}\s*else[\s\{]+\$\w+[\s=]+get_user_by\s*\([^,;]+,\s*['"]\46['"][^\}]+\bwp_set_password[\s\(]+['"]\47['"][^;]+;\s*\}(?<X1212583>)|\s*['"]images/1699678273\.jpg['"];(?<X120344520>)|\s*__DIR__\s*\.\s*'[^']*'\s*;\s*\$\w{1,40}\s*=\s*new\s*Clue\\Psocksd\\App\s*\(\s*\)\s*;\s*\$\w{1,40}-\s*>\s*run\s*\(\s*\)\s*;(?<X2046420>)|_once(?:[\h\(]+[^\)]+[\h\)]+;(?:\s*(\$\w+)[\h=]+base64_decode[\h\(]+[^\)]+[\h\)]+;){3}\s*if[\h\(]+!username_exists[^\{]+\{\s*(\$\w+)[\h=]+wp_create_user\([^\)]+\51\);\s*if[\h\(]+is_int[\h\(]+\52[\s\)]+\{[^\}]*\}\s*\}(?<X1263880>)|\h*\(\h*(?:["']rms\-[\w\-]{1,40}\.php['"]\);\s*rms_\w{4,40}\h*\(\h*['"]?__FILE__['"]?\h*,\h*['"]rms\-[\w\-]{1,40}\.php['"],[^\);]+\);(?<X1158830>)|['"]\.\./\.cagefs/[^'"]{1,99}\.(?:ico|jpe?g|gif|png)['"]\h*\)\h*;(?<X1185570>)))))|turn(?:[\h\(]+object\)\s*\[['"]activations_left['"]\s*=>\s*['"]unlimited['"],\s*['"](license)['"]\s*=>\s*['"]valid['"],\s*['"]site_count['"]\s*=>\s*['"]9['"],\s*['"]\56_limit['"]\s*=>\s*['"]999['"],\s*['"]expires['"]\s*=>\s*['"]lifetime['"]\];(?<X120361490>)|[^\(]{1,99}\(['"]\\x62\\x61\\163\\145\\66\\x34\\x\s*5f\\x65\\x6e\\x63\\x6f\\x64\\145['"],\d+,\$\w+\);\}\$\w+[\s=]+wordwrap(?<X220338070>)|\(eval\([^#]{1,99}\)\);\?>#![^\-]{1,32}/php\s*\-q(?<X220359630>)|\h*@shell_exec[\h\(]+\$\w+\[\d+\][\h\.]+['"]\h*2>&1[^;]+;\s*\}\s*\$\w+[\h=]+\[\s*['"]+\w+['"][\h=>]+['"](?:exec|scandir|file_(?:get|put)_contents|chmod|rename|unlink)['"],[^#]{599,1500}\bnb_set_cookie[\h\(]+\$\w+,\h*\$_SESSION\[(?<X220358581>)|\h+(?:['"]Mr\.Tenar.shell:<(?<X2175530>)|mail\((?:\$\w{1,40},?)+\);\}(\$\w{1,40})=base64_decode\(\$_POST\[[^\]]+\]\);[^\|\?<?]{99,499}\$\w{1,40}=\w{1,40}\([^\|]{4,40}\|\h*mail\h+\-s[^\);]+\62\);(?<X2153890>)|new\h*\w{1,9}\((\$this\->)\w{1,9}\(['"]tds['"]\),\64\w{1,9}\(\),new\h*\w{1,9}\(\),[^\),>\-]+\->\w{1,9}\(['"]tds\.params\b[^\)]+\)+;(?<X2180941>))|\s*(?:@?file_get_contents\(\w{1,40}\s*::\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\[array_rand\(\$\w{1,40}\)\]\);\s*\}\s*static\b(?<X2265890>)|['"]seo\d*\.gloryplan\.(?:life|ws|jp|pl|ga)['"];(?<X1207790>)|\$c0\[\$c_\];}\$GLOBALS\['_\d+_'\]\[0\]\(a_\(0\),a_\(1\),a_\(2\)\);\s*}(?<X2044571>)|\w+\(\$path\);\}\}set_error_mode\(0\);set_max_execution\(0\);init_session\(\);\w+\(isset\(\$_POST\[['"]access_code['"]\]\)&&\$_POST\[['"]access_code['"]\]==['"]\d+['"]\)\s*\{\$_SESSION\[['"]is_admin(?<X220365690>)|file_put_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{1,15}\}\s*echo\s*['"]<[^/]{9,25}Shell\s*Password(?<X2135330>)|proc_open[\s\(]+(?:\$\w{1,40}[,\s\)]*)+;[\s\}]*(?:(?:public|static|private)\s*)+function\s*\w+[\(\s]+\$\w{1,40}[^;:]+(\$\w{1,40})[\s=]+self::\w+\s*\(\)\s*;\s*\$\w{1,40}[\s=]+\71\[\d+\]\[\d+\][^\?/]{9,999}\$\w{1,40}\s*\.=\s*chr[\(\s]+octdec[\(\s]+\$\w{1,40}[\)\s;\}]+foreach\b(?<X2225840>)|true;\s*\?><\?php\s*function\s*\w{1,40}\(\$\w{1,40}\){\$\w{1,40}="";if\(isset\(\$_GET\["v1"\](?<X2048530>))|\s+RC4::Encrypt\([^\)]+\);\s*\}\s*\Z(?<X2043623>))))
\bR(?:ewrite(?:Cond(?:\h*%\{HTTP_USER_AGENT[^\[]{1,50}(?:Android|Iphone)[^/]{1,299}RewriteRule\s+\^\.\*\$\h+https?://(?:eventbet\.best/PPbsTL[^\=]{1,49}\[R=302,L\](?<X120369510>)|lakns\.com/link\?[^\[]{9,99}\[R=302,L\](?<X120361040>))|\h+%\{HTTP_USER_AGENT\}\h+\S{0,99}\bgooglebot\b\S{0,99}(?:\h+\[[^\]]+\])?\s*RewriteRule\h+\S{1,19}\h+https?://casinoslotu\.club/\S{1,9}\b(?:\h+\[[^\]]+\])?(?<X1187361>)|\s*%\{\s*HTTP_HOST\s*\}\s*\^\.\*\$\s*RewriteRule\s*\^/\?\$\s*['"]https[\\/:]+online[\\\-]+login[\\\.]+cfd[\\/'"]+\s*\[R=301,L\](?<X120366541>)|\s+%\{HTTP_(?:HOST\}\s+\^\.\*\$\s+RewriteRule\s+\^/\?\$\s+['"]https?\\:\\/\\/accounts\\\.binance\\\.\w+\\/\w+\\/register\\\?ref\\=\w+['"]\s+\[R=30\d+,L\](?<X1232450>)|USER_AGENT\}\s+Google(?:\s+\[NC\]\s+RewriteRule\s+\^\$\s+/wp\-includes/\w+\-gacor\d+bet\-\d+/\s+\[L\](?<X1324751>)|bot\s+\[NC\]\s+RewriteRule\s+\(\.\*\)\s+https?://[^'"\n]{0,99}escorts[^'"\n]{0,99}\.(?:html|php)\??\s+\[R=30\d+[,\s]+L\](?<X1232440>))))|Engine(?:\h*on\s*(?:RewriteRule\h*\(\[[^\]]+\]\*\.(?:exe|png|dll|jpe?g|doc|vbs|zip|rar|dat|dat2)\)\h*\w{1,15}\.php\h*\[\w+\]\s*){5,10}(?<X1198430>)|\h+On\s*RewriteRule\s+\^\(\.\*\),\(\.\*\)\$\h+\$2\.php\?rewrite_params=\$1&page_url=\$2(?<X1042701>)|\s*on\s*RewriteCond\s*%\{HTTP_USER_AGENT\}\s*googlebot\s*\[NC\]\s*RewriteRule\s*\^\.\*\$\s*https?://www\.sentantuan\.com/dua/ozel\-dualar/\s*\[R=301,L\](?<X1318520>)|\s+On\s*(?:(?:RewriteCond\s*%\{HTTP_REFERER\}\s*\.\*[^\.]+\.\*\$\s*\[NC(?:,OR)?\]\s*)+RewriteRule\s*\.\*\s*http://[^\[]+\[R,L\](?<X1042676>)|RewriteRule\s+\^\(\[A-Za-z0-9-\]\+\)\.html\$\s+\w+\.php\?br=\$1\s+\[L\](?<X1042661>))|\s+on\s+Rewrite(?:Cond\s+%\{HTTP_USER_AGENT\}\s+acs[^\*]+RewriteRule\s+\^\(\.\*\)\$[^\[]+\[L,R=302\](?<X1042622>)|Rule\s+lilly/\(\.\+\)\$\s+https?://[^\n\$]{4,99}\$\d+&slog=lilly\s+\[R=30[12],L\](?<X1232700>)))|Rule\h*\^(?:/\?\$\h*['"]https?\\?:[\\/]+foodclique\\?\.org\\?/[^'"]+['"]\h*\[R=301,L\](?<X1233580>)|\(\.\*\)\$\h*https?://[^\$]{1,40}/slot\-gacor/\$\d+\h*\[[^\]]+\](?<X1237510>))|Rule\h+\^(?:[\.\w\*\(\[]+(?:\\d\+\)|\-/\]\w)[^\$]{3,25}[\.\*]*\$\h*manager/index\\\.php\?id=\$\d+[&%\-\$\d]*{QUERY_STRING\}\h*\[L\](?<X1263920>)|[a-z\d]{9,}/\(\.\*\)\$\h+/wp\-includes/assets/\w+\.php\?\w+=\$1\h+\[L\](?<X1221621>)|\(\.\*\)\$\h+https?://iofan\.com/\h+\[L\h*,\h*R=301\](?<X1217890>))|Rule\s*\^(?:/\?\$\s*["']https?[\\:/]+satudata\\\.polmankab\\\.go\\\.id\\/["']\s*\[R=30\d+[,\s]+L\](?<X1226140>)|\$\s*https?://pub\-\w+\.r2\.dev/\w*\.html\s*\[L,R=(?:301|302)\](?<X1265560>)|\(\.\*\)\$\s*(?:/wp\-includes/[\w\-\.]+\.php\s+\[L,QSA\](?<X1229880>)|https://[^\[]{1,99}slot[^\[]{1,99}\.html\s*\[\w+,\w+=\d+\](?<X120346991>))|\.\*\\\.\[p+\]\[h+\]\.\*\s*\-\s*\[L\]\s*RewriteRule\s*\^\.\*\\.\[s+\]\[u+\]\[s+\]\[p+\]\[e+\]\[c+\]\[t+\]\[e+\]\[d+\]\s*\-\s*\[L\]\s*<FilesMatch\s*['"]\\\.\((?:ph\w+\|)+suspected\)\$['"]>\s*Deny\s*from\s*all\s*</FilesMatch>(?<X1259560>))|Rule\s+\^(?:(?:\.\*[\-\(]+(?:itm|site|sitemap)|catalog[\-\(]+)[^\?\n]{1,99}\\\.(?:php|xml)[\?\)\$]{1,3}[^\n\$]{1,40}[=/]\$1(?:&%\{QUERY_STRING\})?\s+\[L\](?<X1221860>)|/\?\$\s+['"]https\\:\\/\\/(?:dilettantiarezzo\\\.it|indogal\\\.co\\\.id)\\/[rcus]+\\/ibxkey[\\/]*['"]\s+\[R=301,L\](?<X1222151>)))|iny\(tmhapbzcerff\(onfr64_qrpbqr\('(?<X2044650>)|m\h+\-f\h+([^\s\.]{1,40}\.txt);\h*wget(?:\h+\-[qo])+\h+\28\h+https?://[a-z\.]{0,9}turnedpro\.(?:com?|xyz)/\S{1,60}\h[^\n;]{1,99};(?<X1193360>)|o(?:ottn\$?['"]\)?;[^@]{9,399}(\$\w{1,40})\s*=\s*@?str_replace\s*\(\s*['"]www\.['"]\s*,\s*['"][^'"]*['"]\s*,\30\s*\)\s*;(?<X2126310>)|ws=\d+>\s*<!\-\-#exec\s*cmd=\$\w+\s*\-\->\s*\Z(?<X220365370>))|un[\(\h'"]+curl\h+\-s\h+https?://golang666\.(?<X2205840>))
\bS(?:\.H\.E\.L\.L[^</]{0,99}</title>(?<X2225211>)|afe_mode\h*=\h*OFF[^\[\]%&]{99,200}\$\w{1,20}\h*=\h*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"]cat\h+/etc/passwd\h*>\h*\w{1,20}\.txt\b(?<X2158111>)|c(?:andir\((\$\w{1,20})\);\s*foreach\([^\)]+\)[\s\{]+[^:\\]{99,200}(\$\w{1,20})(=array\()(?:['"]\d+['"]=>['"]https?://[^'"]{9,99}/\w{1,20}\.txt['"],){1,4}\);\s*\$\w{1,20}\5[^\?@#%\*]{200,1500}\bif\(is_writable\(dirname\(\3\)[^\}]{2,40}\bfwrite\(\$\w{1,20},file_get_contents\(\4\[(?<X2191812>)|otiabank\s+(?:colpatria|global\s*site|Canada)[^<>/]{0,40}</title>(?<X2221733>)|ript\.src\s*=\s*['"]https?://accessibeapp\.com\b[^'"]+['"]\s*;(?<X1205370>))|e(?:lf(?:::(\w+)\(\);\s*\}\s*private\s+static\s+function\s+\9[^&]{1,199}\$_SERVER\[['"][^\[]{1,49}isset\(\$_POST[^!]{1,129}(\$\w+)[\s=]+sanitize_user\(\$_POST[^\$]{1,49}(\$\w+)[\s=]+get_user_by\(['"]login['"],\s+\10[^\-]{1,199}wp_set_current_user\(\11\->ID\);[^\}]{1,199}wp_redirect[^\[]{1,199}(\$\w+)[\s=]+array_map[^\}]{1,199}implode[^;]+\12(?<X220369680>)|\.header\h*=\h*\{\s*['"]User\-Agent['"]\h*:\h*['"][a@]rch[e3]rGh[o0]st\d*['"]\h*,(?<X2162190>)|Test\s*\(\s*\)\s*\)\s*;\s*elseif[^\}]{1,60}\{\s*\$\w{1,40}\s*=\s*json_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*true\s*\)\s*;\s*(print)\s*(json_encode)\s*\(\s*alexusMailer\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*\15\s*\16\s*\(\s*array\s*\((?<X2046331>))|nd(?:\((flood)\h*,\h*(pack)\(['"][^'"]+['"]\h*,\h*['"]\18['"]\)\h*,\h*\d+\h*,\h*\19_sockaddr_in\((?<X2152040>)|packet\((\$\w{1,40}),0,0,0\);\21=['"]POST\s*['"]\.\$\w{1,40}\.['"]/index\.php\?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20\s+HTTP/\d+\.\d+(?:\\r)?\\n['"];(?<X2132170>)|Post[\h\(]+['"]activated['"],[^\?]{0,50}loopline\.net/[^#]{999,5500}\bif[\h\(]+\$username[\h=]+['"]ll01idjks97sp['"][^\?]{0,2500}\bquery_where[\.=\h'"]+AND\h*user_login\h*Not\h*Like\h*['"]ll01%(?<X220362750>)|raw\(\$IRC_cur_socket\s*,\s*"PRIVMSG(?<X2050140>))|rver\s+d3ifff(?<X2049180>)|ssion_start(?:\(\);(?:(\$\w+)=['"][\w\-]+['"];(\$\w+)=[''][\w\-]+['"];\$\w+=\w+\(\$_SESSION\[['"][^#]{1,999}\26\]={3}\27\)[^#]{1,999}upload</button>[^\?]{1,99}\?php\s*(?:exit|die)[\(\)]*;\}\}\w+\{http_response_code\(404\);(?:exit|die)[\(\)]*;\}(?<X120364100>)|[^\?]{0,199}\s*(\$\w{1,25})\h*=\h*['"]http://['"]\.\$_SERVER\[[^\?]{9,299}\bfunction\h*(random_number\(\))\s*\{\s*[^\}]{9,300}\}\s*\29\h*=\h*(?:\30\.){3,6}(date\([^\)]+\))\.md5\(\31\)[^;]{0,49}\30;(?<X2178991>)|\s*include\(['"]\.+/[\w\-]{1,5}bots\.php['"]\);(?:\s*if\h*\(strpos\((?:gethostbyaddr\(getenv\(|\$_SERVER\[)['"](?:HTTP_USER_AGENT|REMOTE_ADDR)['"][\]\)]{1,2},\h*['"]GoogleBot['"]\)\h*\D{2,3}\h*false\)\s*\{\s*@?header\(['"]HTTP/\d+\.\d+\h+404\h+Not\h+Found['"]\);\s*@?(?:exit|die)\b[^;]{0,9};\s*\}){2}(?<X2139960>)|function\s*fetchUrl\((\$\w+)\)\s*\{(\$\w+)=curl_init\(\34\);curl_setopt\(\35[^%]{1,99}curl_exec\(\35\);\}\34=['"]https?://[^%]{1,199}fetchUrl\(\34\);if\(is_string\((\$\w+)\)\)\{eval\(['"]\?>['"]\.\36[^%]{1,99}['"];\}(?<X120364920>))|\h*\(\);\s*set_time_limit\h*\(0\);\s*\$\w{1,15}\h*=\h*md5\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(\$\w{1,15})\h*=\h*['"]\w{32}['"];[^#]{999,9999}\bmd5\h*cracker['"],[^\?]{9,999}\broot\h*sh[e3]ll</a>\]\h*\[<a\h*href\h*=\h*['"]{1,2}\.\38\.[^\n]{999,12999}\bprint\h*\$\w{1,15};\s*(?:exit|die)[^;]{0,9};(?<X1188210>))|t(?:_time_limit(?:(\(0\));error_reporting\40;\w+\(['"](\w+)[^}]{1,99}(base64_decode)\(['"](aHR0)[^;]+;\w+\(['"]\w+['"],\42\(['"]\43[^\}]+\.php['"]\){2};\$\w+=\$_SERVER[^\n]{1,2999}return\$\w+;\}{5}\w+\s*(\w+)[^\>]{99,9999}\.\41\.['"]&\w+=['"]\.\w+\);\}{3}\44\(\);(?<X1318360>)|\(0\);(?:\s*ignore_user_abort\(\);\s*if\s*\(\s*filesize\(\s*"\.htaccess"\s*\)\s*>\s*\d+\s*\)\s*{\s*\$\w+\s*=\s*fopen.+?\(\s*sys_get_temp_dir\(\)\s*\.\s*"/\$\w+"\s*\);\s*}(?<X1035770>)|function\s+Root_GP\(&(\$\w{1,40})\)\{while\(list\(\$key,\$var\)=each\(\47\)\)\{if\(\(strtoupper\((?<X2132552>))|\(\d+\);(?:\s*error_reporting\(\d+\);\s*preg_replace\(['"]\\x[^'"]+['"],['"].{50000,}['"],['"].{2,5}\);(?<X1041590>)|ignore_user_abort\(\d+\);(?:(\$\w+)=['"]\w+\.\w+\.\w+['"][^!]+str_rot13\(urldecode\(\50\)\);[^\?]{1,999}false\?['"]pingok['"]\s*:\s*['"]error['"];[^:]{1,2999}\$\w+=\$\w+[^;]{1,99}indexnew\.php['"];\$\w+=trim\(\w+\(\$\w+,\$\w+\)\);\}\}\Z(?<X1323000>)|[^!]+str_rot13\(urldecode\([^:]+stristr\(\$\w+,['"]User\-agent['"][\)\{]+unlink\(\$\w+\);if\(file_put_contents[^\n]{1,4999}(\$\w+)=str_replace\(['"]getcontent301page['"],['"]{2},\$\w+\);header\(['"]\s+['"]\.\52\);(?:exit|die);\}{7}\Z(?<X1322291>)|[^!]{99,999}str_rot13\(urldecode\(\$\w+\)\);[^/]{99,999}preg_match\(['"]/\^google[^\{]{5,500}\{file_put_contents\(\$\w+,[^%]{499,4999}strstr\(\$\w+,['"]getcontent301page['"]\)\)\{[^\}]+(?:exit|die);\}{6}\Z(?<X1318083>)|\$\w+=['"]\w+\.\w+\.\w+['"][^&]+&&strtolower\(\$_SERVER\[['"]HTTPS['"]\]\)!==['"]off['"][^%]{1,19999}\{header\(['"]HTTP/1\.1\s*301[^'"]+['"]\);(\$\w+)=str_replace\(['"]getcontent301page['"],['"]['"],\55\);header\(['"]Location:\s*['"]\.\55\);die;\}{7}\Z(?<X1322992>)))|\h*\(3600\);\s*@?ignore_user_abort\s*\(1\);[^#]{1,6500}##\w+[^!]{1,2000}str_replace[\(\s'"]+getcontent301page['",\s]+(\$\w{1,14})\);\s*header[\(\s"']+Location:['"\s\.]+\57\);\s*exit;[\s\}]+\}(?<X1324651>))|cookie(?:[\h\(]+\$cookieName,[^#]{99,2300}\bif[\h\(]+[^\{]+strpos[\h\(]+\$\w+,\h*['"]akkkkkkkkkkkkkkkkkkkk['"](?<X220369981>)|\('f_wp'\s*,\s*\$_POST(?<X2050510>)|\(['"]b374k['"],\$\w{1,40},time\(\)\s*\+\s*\$\w{1,40}\);\s*\$\w{1,40}\s*=\s*(?:true|false);(?<X2132801>)|\h*\(['"](whatsup)["']\h*,\h*['"]\62man["']\h*,\h*time\(\)\+\d+\*\d+\*\d+\h*(?:,\h*['"][^'"]+['"])?\);(?<X1174305>)|\s*\((?:['"](cvv2?|ssn\d?)['"]\s*,\s*\$_POST\['\64'\](?<X2052250>)|\s*['"]haircki['"]\s*,\s*['"]haircooki['"]\s*,\s*time\s*\(\)\s*\+\s*3600\s*\*\s*24\s*\*\s*\d{2,3}\s*\)\s*;(?<X1206001>)))|Interval\(['"]\w{1,20}\(\)['"],\d+\);\s*\w{1,20}\h*=\h*['"]\W{0,9}Hacked\h+by\b(?<X2141831>)|Timeout(?:[\h\(\)]+=>\h*location\.href[\h=]+['"\`]https://(?:[\w\-\.]+)?empatiya\.net/\?\w+['"\`],\h*\d+\);(?<X120354261>)|[\h\(]+function[\(\)\h\{]+window\.location\.href[\h=]+['"]https?://(?:\w+\.)?gabrielpidello\.com/\w+/[^'"]+['"]\h*\}[\h,]+\d*[\h\)]+;(?<X1259711>)|\(function\((\w{1,14})\)\{\s*return\s*\70\.split[^;]{1,50}const\s*(\w{1,14})\s*=\s*char\.charCodeAt\(\d+\);return\s*String.fromCharCode\(\71[^,]{1,30}atob\(['"][^'"]{1,550}['"]\)\).\d\);(?<X1281311>)|\s*\(\s*\w+[\(\)\s\{]{1,99}\w+\.location\.\w+['"\s=]+https?://hanovertdo\.org[^;]+;\s*\}[,\s]+\d+\s*\);(?<X1283920>))))|h(?:[e3]ll+\s+byp[a4@][s5][5s][^<>/]{0,40}</title>(?<X2221820>)|\s+-c\s+\./cnrig\s+-a\s+cryptonight\s+-o(?<X2051100>)|ell\s*(?::\s*<\?php[^\\]{1,999}['"]\?BDKR28=['"](?<X220344880>)|</title>[^%]{1,150}<meta\h+(?:name\h*=\h*['"][^'"]+['"]\h+|content\h*=\h*['"]IndoXploit['"]){2}>(?<X2142260>))|ell(?:_exec(?:[^\}]{1,999};(?:exit|die);\}[^;]{1,99};\w+\(\);[^<]{1,999}\$_POST\[['"]\w+['"]\]={3}['"][^\}]+<(title)>login[\-\h]+Adminer</\78(?<X220331851>)|\(['"][ba]*sh\s*\-\w[\s\\'"]+\$\((?:curl|wget)[^'"]{1,99}https?://jstags\.com[^'"]{1,32}['"]\s*>\s*/dev/[^"']{1,32}['"]\);(?:\s*echo\s*['"\\]+shell\s+active[\\'"]+;)?(?<X120344500>)|\s*\(\$\w+[^\\@]{1,3999}<title>love</title>(?<X220348160>))|domain:\]['"],\h*ucfirst\h*\(\$_\d{1,3}\[round\h*\(\d{1,3}\)\]\),\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[^\{]{9,199}\bif\h*\(!is_file\h*\(\$_FILES(?<X2156680>)|name\h*=\h*['"][^'"]{0,49}['"];[^\{]{0,99}\bfunction\h*Class_UC_key\b(?<X2175681>)))|l(?:eep\s*\(\d+\)\s*;\s*\$\w{1,40}[\s=]+(\w+)[\s\(]+\$\w{1,40}[^;]+;\s*function\s+\84[\s\(]+(\$\w{1,40})[\s\)]+\{[^\}]+\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\85[^;]+;[^!]{0,1999}\bwhile[\s\(]+!@?feof\s*\((?<X2223030>)|ider_option\w{0,40}\(\$\w{1,40}\)\s*\{\s*if\s*\(is_single\(\)\s*\)\s*\{\s*[^\}<>\{]{1,40}\$\w{1,40}\s*=\s*['"]\s*(?:<script[^\.>]{1,90}go\.(?:oclasrv|mobisla)\.com/[^>]+></script>\s*){2}(?<X2123490>)))
\bS(?:ocket(?:(\(flood,)\h*PF_INET,\h*SOCK_DGRAM,\s*\d{1,3}\);[^@]{99,999}\bsend\1[^\)\(\$;]{0,99}\bpack\(['"][^'"]{1,40}['"],\h*['"][^'"]{999}(?<X2159730>)|(\(socket,)[^;]+;connect\3[^#@]{1,499}\bsystem\(['"](?:unset\s*(?:HISTFILE|SAVEHIST)\b[^'"]{0,19}\b){2}(?<X2226822>)|\((?:flood|crazy),[^\{\\]{9,99}\bprintf\h*['"]udp\h*(?:flood|crazy)\h*\-\h*\w{1,25}\\n['"];(?<X2184423>)|_setopt\([^\)]+\);\s*\}\s*\}\s*define\(['"]PAYLOAD_UUID['"]\s*,\s*['"](?:\\x[a-fA-F0-9]{1,3}){9,30}['"]\);\s*define\(['"]SESSION_GUID['"]\s*,\s*['"]\\x00(?<X2123010>))|p(?:ider.record\(\);\s*echo\h*\$\w{1,20};\s*(?:exit|die)\(\);[^<\*#]{99,800}\bforeach\(\$xml\w{0,15}\b[^\*#\\]{99,300}\bsitemap\-[^;]{0,20}\.xml['"];(?<X2183890>)|rintf\s*\(\s*"%c"\s*,\s*\$\w{1,40}\s*\^\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*for\b(?<X2048301>))|r(?:and\(seed\(\)\);\s*\$additional=array\("%1meta name=\\"description\\"\s*content=\\"\$description\\"%3","%1meta(?<X2051500>)|c=(?:(['"])//ber2g8e3keley\.com\b[^'"]+/\w+\.js\10(?<X1203080>)|['"]https?://b\-i\-t\-l\-y\.[^'"]+['"](?<X1235251>))|c(?:[=\h]+['"]https?://webcstore\.pw/[^'"]+\.js['"](?<X1238250>)|\h*=\h*['"](?:data\s*:\s*text/javascript;\s*base64\s*,\s*CiAgICAoZnVuY3Rpb24oKSB7CiA[a-z\d\+/]{99,9999}(?:IT09ICd1bmRlZmluZWQ|ICd1bmRlZmluZWQ|bmRlZmluZWQ)[a-z\d\+/]{99,9999}={0,2}["'](?<X1195172>)|https?://(?:www\.)?web\-not404foundcyberteam\.\w{2,6}/(?<X2161561>))))|t(?:at(?:\s*\(\$\w{1,40}\);\s*(\$\w{1,40})\s*=\s*(dirname\((__FILE__)\))[^;]+;\s*(@touch)\s*\(\16[^;]+;\s*\19\(\17[^;]+;\s*\19\(\18[^%]{200,600}(\$\w{1,40})\s*=\s*file_get_contents[^\{]+\{\s*(\$\w{1,40})\s*=\s*check_spider\((\$\w{1,40})[^\[]+\21\s*=\s*de_get\(\20,\22\);[^\}]+\21\s*=\s*(?:true|false);\s*\}\s*\}(?<X2060803>)|ic\s*public\s*function\s*\w+\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\w+\s*\(\s*["'][^"']*=["']\s*\)\s*;\s*return\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X2046580>))|r_(?:i?replace[\s\(]+['"]AnonymousFox['"](?<X2197511>)|replace\('define\("PRENAME","\d+"\);'\s*,\s*'define\("PRENAME"(?<X2045571>)|rot13\(pack\((["'])H\*\27\,\bstrrev\((\$\w+)\)[;)]{1,16}if\(isset\(\28[);][^\.]{1,64}(\$\w+)=\27\./\27\.implode[^;]{1,64};file_put_contents\(\29\,\27<\?[ph\s]{1,64}unlink\((__)FILE\30\);[\\\w]+\27\.\28\);include\(\29\);unlink\(\29\);(?:die|exit)\(\);\}\}\?>\Z(?<X2298774>))|r(?:atum\+tcp://pool\.minexmr\.com:(?<X2048340>)|eam_select\((\$\w{1,40}),[^;]{9,99};(?:if\(in_array\(\$[^,]{1,40},\33\)\)\{(if\(\$\w{1,40}\)\s*\w{1,40}\()['"](?:SOCK|STDOUT|STDERR)\s*read['"]\);(\$\w{1,40})=fread\(\$[^;]{5,99};\34['"](?:SOCK|STDOUT|STDERR):\s*\35['"]\);fwrite\(\$[^,]{1,40},\35\);\}){3}(?<X2130660>)|i?pos\([^\),]+,['"]?\$(?:bot){3}[^\?]{1,4999}\bchmod\(([^\),]+['"][^'"]+?['"]),[^;]+;unlink\(\37\);[^\?:]{1,9999}\bheader\(['"]Location[:\s]+https?://[^/'"]+\.(?:top|xyz)['"/](?<X2210321>)|ipos\(\$path\s*,\s*'/httpdocs/'\s*\)\s*\+\s*strlen\(\s*'/httpdocs/(?<X2047230>)|pos\((\$\w{1,40}),['"]<\?[^@#%&/\*]{1,499}\bfile_put_contents\((\$\w{1,40}),\40\);register_shutdown_(function)\((?:array\(|\[)\$\w{1,40},\h*['"](\w{1,40})['"][\)\]],\41,\$\w{1,40}\);[^@#%\{]{1,199}\b\42\h+\43\((\$\w{1,40}),(\$\w{1,40})\)\{[^\}]{1,499}\bunlink\(\44\);\}?touch\(dirname\(\44\),\45\);(?<X2184130>)|rev\(['"][^'"]{1,80}moc\.tnetnocresubuhtig\.war//:sptth['"]\)\)[^\{]{1,50}\{\s*(\$\w{1,14})\s*=\s*curl_init[^\}]{1,300}(\$\w{1,14})\s*=\s*curl_exec\(\47\);\s*curl_close\(\47\);\s*return\s*\48(?<X2280531>)|str[\(\s]+\$\w{1,40}[,\s]+['"]xiaoxiannv['"][^\}]{0,999}\$\w{1,40}[\s\=]+['"]xiaoxiannv['"](?<X2225360>))|ylesheet[^/]{1,40}href[^/]{1,40}\.?/cssisma[^\?]{1,200}Anonisma(?<X2055101>))|u(?:b(?:\s+[tu][dc]p_?flood(?:er)?\s*\{[^@]{99,499}\bsub\s+[tu][dc]p_?flood(?:er)?\s*\{(?<X2142981>)|ject\h*=\h*['"]BANk\(SANT\-ANDER\)\h*\W[^#]{99,250}@?mail\(\$(?<X2143640>)|str\(\$__lp,\s*0x\w+-0x\w+\)\)\);break;\}\}\}eval\(\$__ln\);return 0;\}\s*else\s*\{die\((?<X2048830>)|str_count\([^,]+,['"]Linux['"]\)[^\{]{1,9}[\{\s]+\$\w{1,20}=base64_decode\([^\\@\?]{4000,8000}\bsystem\(['"]gcc[^\)]{1,15}\bdirty(?:c|cow)?\.c\b(?<X2202140>))|ccessfully\s*opened\s*reverse\s*shell\s*to\$\w{1,40}:\$\w{1,40}['"]\);while\(\d+\)(?<X2126781>))|witch(?:[\(\s]+@\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*case\s*['"\w\s]+:\s*(\$\w{1,40})[\s=@]+\$_FILES\s*\[[^\]]+\][^\},]+if[\s\(]+(?:(move_uploaded_file)|copy)[\s\(]+\57\[[^\?\*\n]{9,999}case\s*['"\w\s]+:\s*@?(?:copy|\58)\s*\(['"]http[^'"]+\.(?:png|jpe?g|gif)['",\s]+['"][^'"]+\.php['"][\)\s;]+break[\s;]+\}(?<X1208010>)|\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(?:case\h*['"][^'"]{1,49}\bshell['"]:\s*echo\s*\w{1,40}\(['"]https?://[^;]{1,99};break;){5}(?<X2141550>)|\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\)\s*\{\s*case\b[^\}]{1,99}\bglobal\s*\$vbulletin;[^\}]{0,499}<(?:h\d|title)[^>]{0,99}>\s*L[o0]g[1il]n\s*Sh[3e][1il]{2}\b(?<X2160620>))|y(?:mlink(?:\(['"]/home\d*/['"]\s*\.\s*\$[^\s\.;]{1,40}\s*\.\s*['"]/public_html[^;]+\.txt['"]\);(?:\s*symlink\(['"]/home\d*/['"]\s*\.\s*\$[^\s\.;]{1,40}\s*\.\s*['"]/public_html[^;]+\.txt['"]\);){2,3}(?<X1199880>)|\s*\(\s*['"]/home[^\)]{20,99}['"]\);\s*\}\s*(\$d[0o]mains)\s*=\s*@file\s*\(['"]/etc/\w{1,20}\.conf['"]\);\s*if\s*\(\63\)\s*\{\s*@?mkdir\((?<X2118771>))|s(?:_get_temp_dir\(\)[^;]{1,9};((file_)put(_contents)(\((\$\w{1,40})\.['"]tmp['"]),\$\w{1,40}\);if\(md5\(\66get\67\68[\)=]{4}\$\w{1,40}\)\{unlink\68\);)\$\w{1,40}=\69;\}else\{\69=['"](?:/var/)?tmp/['"];\65(?<X2130152>)|tem\(['"]ln\h+-s[^\)]+\);(\$htaccess)=['"]\s*Options\h+Indexes\h+FollowSymLinks[^'";]{9,90}['"];@?file_put_contents\(['"]\.htaccess['"],\71\);(?<X2156251>)|tem\h*\(\h*['"]cd\h*/tmp;\h*wget\h*['"]?http://\d{1,3}\.[\d\.]{3,11}/([^;\)]+\.gz)['"]?;\h*tar\h+\-[^;\)]+\73;\h*\./\w{1,40}\b\h+\-[^;:\)]+tcp://[^:;]{1,40}\.mine[^;'"\)]{9,199}['"]\h*\)\h*;(?<X2175740>)|temctl\h*stop\h*c3pool_miner\.service[^\?]{999,10000}\bgrep\h*['"]monero['"][\h\|]+awk(?<X2222021>)|temInfo\(\$_SERVER\[['"]REMOTE_ADDR['"]\]\)[^\?]{99,499}MrProfessor\s*\-{9}[^\;]{99,499};\s*mail\(\$receiverEmail(?<X2134000>))))
\bt(?:e(?:legram\W{1,4}@Coder_Seller\b[^\$\(\{\*]{1,199}\*/(?<X2176021>)|mpnam\h*\(\h*base64_decode\h*\(\h*['"]L3RtcA[^'"]{0,2}['"](?:(?<X2168291>)|\)\h*,[^;]+;\s*\$\w{1,40}\h*=\h*fopen\h*\(\h*(\$\w{1,40})\h*,[^;]+;[^\}]{1,99}\binclude(?:_once)?\h*\3\h*;\s*unlink\h*\(\h*\3\h*\)\h*;\s*return\h+get_defined_vars\h*\(\);(?<X2168280>)))|heAlmightyZeus</\w+>['"];\w+\(!\w+\(\$_GET\[['"]\d(?<X2323130>)|itle(?:=['"](?:A|Ira)nonymous\h*(?:checker|bypasser|backdoor|webshell)['"][^/]{0,60}/>[^\?]{1,20}<\?[ph\s]+(?:(?:set_time_limit|error_reporting)\((?:0|NULL|FALSE)\);\s*){1,3}[^\?]{200,1500}\bforeach\((\$_POST)\h*as\h*(\$\w+)=>(\$\w{1,20})\)[\{\s]+\6\[\7\]=stripslashes\(\8\);(?<X2217040>)|>['"];\s*(\$\w{1,15})\h*=\h*new\h*backdoor\(\);(?:\s*\10\h*\->\h*(\w{1,15})\h*=\h*\$\11;){4,}\s*\becho\b(?<X2189750>))|o(?:ol(?:s::file_get_contents[\s\('"]+https?://ferreteriasimancas\.com/[^;\)]+=['"]\s*\.\s*Tools::getServerName\(\)[^\)]{0,99}\);(?<X1229720>)|s?\s*by\s*hitman\b[^\?]{9,499}\bmail\([^\)]+\$([mb](?:essage|e?sg|ilsmg))\b[^\?]{9,499}\bfwrite\([^\)]+\$\14\h*\);(?<X2159070>))|p4top\.(?:io|net)/(?:p|m)_[^>]{1,99}>[^\?]{0,999}\b(?:touched|Hacked|heked|Owned|Ghost|pwned)\b(?<X2161035>)|uch\((?:['"]?\$path['"]?,\s*\$time_path\);\s*\}\s*if\s*\(\s*\$\w{1,40}\s*\W{2,3}\s*true\)\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*unlink\(\$_SERVER\[['"]SCRIPT_FILENAME['"]\]\);\s*\}\s*\}\s*else\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*\}\s*function\s+scan\((?<X2064840>)|\s*__FILE__\s*,\s*filemtime\(\s*['"]index\.php['"]\s*\)\s*\);\s*\}\s*\$\w{1,40}\s*=\s*(?:['"\s\.base64_dco]{13,40}|['gz\s"\.inflate]{10,40}|['"\s\.gzuncompres]{12,40})\s*;(?<X2064761>)|__FILE__,(mktime\([^;]{1,99};)[^\?/:]{1,499}\$(\w{1,40})=(file_)ge(t_contents\()['"]php://input['"]\);[^@#%]{499,1999}\b\21pu\22\$\w{1,40},\$\20[^;]{1,99};touch\(\$\w{1,40},\19(?<X2179101>))|uch(?:\h*\((?:\h*(\$\w{1,40})\h*,\h*strtotime\h*\(\h*['"]\-\d+\h+days['"]\h*,\h*time\h*\(\)[\h\)]+;\s*file_put_contents\h*\(\h*\24\h*,(?<X2176802>)|__FILE__,[^\)]+\);\s*mk(?:dir|folder)\([^\)]+\);[^\{\}]{9,200}\$\w{1,20}\h*=\h*['"]rss\.xml['"];\s*\$\w{1,20}\h*=\h*['"]sitemap\w{0,15}\.xml['"];\s*if\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*['"]https?://(?<X2181521>))|\s*\(\s*\$curfile\s*,\s*\$time\s*,\s*\$time\b(?<X2113332>)))|r(?:im\(\(@file_get_contents\(base64_decode\(['"]aHR0c[^'"]+nR4dA==['"]\)\)\)\);(?<X120356420>)|y(?:[\s\{]+if[\s\(]+(isset)[\s\(]+\$_GET\[['"]\w+['"\]\)&]+!\29\(\s*(\$_POST)[^\{]+\{die\(md5\([^!&]{1,999}@unlink\(\$\w+\);die\([^_%]{1,99}\30\[[^\}]+\}\s*array\(['"]wp_(?:head|footer)[^\}]+[\}\s]+catch\(\w+\s*\$\w+[\)\{\}\s]+\}(?<X1286231>)|\h*\{\s*(\$\w{1,15})\h*=\h*array\h*\([^\)]+\);\s*(?:\$\w{1,15}\h*=\h*\32\[\d+\]\h*\.\h*['"]\w[^;]{3,250};\s*){9}[^\(]{9,999}(\$\w{1,15})\h*=\h*isset\(\$_SERVER\[\$\w{1,15}\]\)[^#]{9,1700}\bcurlopt_httpheader,\h*array\([^\)]{0,150}\33[^\}]{9,399}\becho\h*\([^\{]{0,199}\bcatch\h*\([^\)]+\)\s*\{\s*\}(?<X1185451>)|\h*\{\s*\$(bajatax)\w{1,40}\h*=[^\}]{1,299}\$(message\d+)\h*=\h*['"]\35\|:[^;]{1,199};\s*@?(file_get_contents\h*\(\h*['"]https?://)[^;]{1,199}\$\36[^;]{1,99};[\}\s]+(catch\h*\()[^\{]{1,99}\{\s*if\h*\([^\{\}]{1,199}\{\s*try\s*\{(?:\s*\37[^;]{1,199};){1,2}\s*\}\s*\38[^\)]+\)\s*\{(?:\s*\}){3}(?<X1175500>)|\h*\{\s*if\h*\(\h*md5\h*\([^\}]{1,199}\$(\w{1,40})\h*=\h*['"][^;]{1,19}\bbajatax\b(?:[^\}]{1,199}\bfwrite\h*\([^\);]+\$\40\);){1,2}\s*@?fclose\([^;]+;[\s\}]+catch\s*\(Exception\h*\$\w{1,40}\h*\)\s*\{\s*\}(?<X1163400>)|\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*(?:(String)\h*;(?:\s*(?:var|let))?\s*\w+\s*=[^;\[]{0,499}\42\s*\[\s*['"][from\+\h'"]+\43\.fromCharCode\s*\((?:\s*/\*[^\*]*\*/)*\s*\d[^:\n]{999,4999}\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\h]+if[^\}\n]+\]\.remove[\(\);\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}(?<X1250221>)|String\h*;(?:(?:\s*(?:var|let))?\s*\w+\s*=\s*\42\s*\[\s*['"][fromCharCode'"\+]{15,40}\][^;\[]+\+\s*\42\s*\[[^\n!#]{999,9999}\bremove\(\);\}\}\}\s*catch\s*\(\w+\)\s*\{\}\s*/\*[a-f\d]*\*/(?<X1250570>)|(?:\s*(?:var|let))?\s*\w+\s*=\s*\42\s*\[\s*['"][fromCharde'"\+]{15,40}\][^;\[]+\+\s*\42\s*\[[^\n!#]{999,9999}\[['"][cu'\+"rentSip]{16,40}['"]\]\.remove\(\);[\}\s]+catch\s*\(\w+\)\s*\{\s*\}(?<X1250581>)))|\s*\{\s*(\$\w+)(?:[\h=]+\[\h*['"]https?://[^\]]+\];\s*(\$\w+)[\h=]+implode[\h\(]+["']{2},\h*\47\);\s*(\$\w+)[\h=]+(curl_)init[\h\(]+\48\);[^\{]{9,150}(\$\w+)[\h=]+\50exec[\h\(]+\49[\h\)]+;[^\{]{0,99}\{\s*eval[\h\(]+['"]\?>['"][\h\.]+\51[\h\)]+;[^\{]{0,99}\bcatch[^\{]+\{\s*error_log[^\}]{0,99}\}(?<X120341511>)|[^\$]{1,99}(\$\w+)[\s=]+['"]MDAwMDAwMDAwMB6wIxk[^'"]+['"];\s*(\$\w+)[\s=]+\47\->decrypt\(\53\);\s*eval\(\54\);[^\$]{1,49}(\$\w+)\)\s*\{\s*\$\w+[\s=]+\55\->getMessage\(\);\s*\$\w+[\s=]+['"]['"];\s*\}(?<X120350000>))|\s*\{\s*(\$\w{1,40})[=\s]+(?:['"][^'"\$]{4,15}['"][\s;]+if[\(\s]+!is_array[\(\s]+(\$\w{1,40})[\)\s]+\58[=\s]+explode[\(\s'"]+,['"][,\s]+\58[\)\s;]+(\$\w{1,40})[=\s]+\[\s*0(?:[,\s]+\d)+\s*\][^\+]{0,199}if[\s\(]+\58\[\59\[\d+\][^;]+\]\((\$\w{1,40})\)[\s\)]+\{[^\|\?]{0,499}@\57\(\60[,\s]+\60[^>]+\$\w{1,40}\->\w+\((?<X2226730>)|wp_remote_get[\(\s]+get_option[\(\s]+['"][^'"\$]+['"][\),\s]+\$\w{1,40}[\)\s]+;\s*return\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\57\s*\[['"]body['"]\][\)\s]+;\s*\}\s*catch[\(\s]+Throwable\s*\$\w{1,40}[\)\s]+\{\s*\}(?<X1239170>))|\s*\{\s*(\$\w{1,40})(?:\h*=\h*@file_get_contents[\h\(]+['"]http://\w{1,9}\.mapsplugin\.com/bro/[^'"]{0,40}['"][^;]+;\s*\}\s*catch[\s\(]+Exception\s+\$\w{1,40}[\s\)]+\{\s*\}\s*echo\s+\63\s*;\s*define[\(\h]+['"][a-z]+['"][\h,]+['"][a-z]+['"][\)\h]+;(?<X1185061>)|\s*=\s*shell_exec[\(\s]+['"][^\}\{]+(\$\w{1,40})[=\s]+trim[\(\s]+\63[\)\s;]+if[\s\(]+\65[^\$;]+(\$\w{1,40})[=\s]+fsockopen[\s\(]+base64_decode\s*\([^;]+;(?:\s*\$\w{1,40}[=\s]+)?proc_open[\("'\s]+(?:sh|bash)\b[^;\$]+\66[^;]+;\s*\}\s*\}\s*catch[\s\(]+exception\s*\$\w+\s*\)\s*\{\s*\}(?<X1287710>))|\s*\{\s*@(\$\w{1,40})[\s=]+getcwd\(\);\s*@(\$\w{1,40})[\s=]+\68\.base64_decode[\(\s]+['"][^;]+;[^<]{0,999}if[\s\(]+\$\w{1,40}<[^\{\}]{0,99}\{\}[^=]+@touch[\s\(]+\69[^=]{0,99}@\$\w{1,40}[\s=]+['"]PD9[^'"]{999,}['"];(?:[^:]{0,9999}://wordpresstheme\.live/){1,9}[^;]+\$_SERVER\[['"]SERVER_NAME[^=]{0,99}\)\{\}(?<X1218780>)|\s*\{\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]*;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+uniqid[\(\s]+rand[\(\)\s]+,[^;]+\.js['"][\s;]+@?(file_put_contents)[\(\s]+\71[^\}]+\72[\s\(]+\71[^;]+;[^\}]*\}[\s\}]*catch[\s\(]+Exception\s*\$\w+[\s\)]+\{[^\}]*\}(?<X1258660>)|\s*\{\s*ob_start\(\);\s*eval\(['"]\?>['"]\.\$\w+\->\w+\);\s*\w+\s*\w+\(\);[^=]{1,299}return\s*['"]\W+\w+\s*\w+\W+['"];\s*\}[^'"]{1,32}(\$\w+)[=\s]+['"]aHR0[^'"]+['"];\s*\$\w+[=\s]+\w+\s*\w+\(\74\);\s*echo\s*\$\w+\->\w+\(\);\s*\?>\Z(?<X220326983>)|\s*\{\s*var(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\76\s*\[\s*['"][fromChade'"\s\+]{12,}['"]\]\s*\(\s*\d[^;]+;[^:\n]{999,4999}\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\h]+if[^\}\n]+\]\.remove[\(\);\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}(?<X1250240>)|\{\s*\$bajatax_\w+[\h=]+apply_filters\([^\}]{99,600}[\s\}]+(catch[\h\(]+Exception)\h*\$e\)\s*\{[^\}]{9,400}\bfile_get_contents\(['"]https:?//api\.telegram\b[^\}]{9,199}\}\s*\78\h*\$e\d\)[\s\{]+\}\s*\}\s*\}(?<X1213250>)))|ulis_file\(['"][^\'"]{0,20}\b(?:total|block|log)_?(?:bot|visitor|email|photocc)\.(?:txt|dat)['"],['"]?[^'"]{0,9}\$ip\b(?<X2151971>)|V12hsJy_\s*\(\s*'[^']*'\s*,\s*\d+\s*\)\s*\)\s*array_shift\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*;\s*\}\s*\}\s*else\s*\{\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*=\s*microtime\s*\(\s*true\s*\)\s*;\s*\}\s*\}(?<X2046392>))
\bvar(?:\s*(_[10]x[a-f\d]{1,40})\s*=\s*(_[10]x[a-f\d]{1,40})[;\s\(]*function\s*\([^;\}\{]+\{[^;]+;\s*while[\s\(]+!!\[\][\s\)]*\{\s*try\s*\{[^&]{9,999}\[['"](getElementsByTagName)['"]\][^;]+;\s*\}[\s\(]+(window[,\s]+document['",\s]+script['",\s]+\1)[^;]+;\s*function\s*\2\s*\([^@]+\3[^;]+;\s*\}\s*\(\4[^;]+;(?<X1249332>)|\s*(_\wx\w{1,9})=\[(?:(?:['"][^'"]{1,99}['"],?){1,9}['"]\s*(?:c|\\x63)(?:o|\\x6f)(?:n|\\x6E)(?:s|\\x73)(?:t|\\x74)[^\]]{1,40}((?:h|\\x68)(?:t|\\x74)(?:t|\\x74)(?:p|\\x70))[^\]]+\7[^\]]+\7[^\]]+\7[^\]]+\];var\s*(_\wx\w{1,9})=\[\6\[[^\?]+\8\[\d+\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\)\(\);?(?<X1057910>)|['"]{2},['"](?:\\x41|A)(?:\\x42|B)(?:\\x43|C)(?:\\x44|D)[^\]]{99,999}['"]\];\s*function\s*(_\wx\w{1,9})\([^\./]+if\s*\(navigator\[\6\[\d+\]\]\)\s*\{\s*if\s*\(\s*\w{1,9}\(\6\[\d+\]\)\s*\W{2,3}\s*\d+\)\{\}\s*else\s*\{\s*\w{1,9}\s*\([^\(]{99,199}\(\6\[\d+\]\)\s*\+\s*\10\(\)[\s\}]+;(?<X1118460>))|\s*(_\wx\w{1,9})\s*=\s*\[(?:"","[^\]]{1,999}(?:\?|\\x3F)(?:k|\\x6B)(?:e|\\x65)(?:y|\\x79)(?:=|\\x3D)"\];function\s*(makeid\(\))\{var\s*_\wx\w{1,9}\s*=\s*\12\[[^\?]{1,600}\?\12\[[^\?]{400,750}\12\[\d+\]\s*\+\s*\13\}\};?(?<X1057990>)|['"](?:s|\\x73)[^\?]{350,3800}\];var\s*(?:_\wx\w{1,9})=\[\12\[[^@]{500,4000}?\[0x0\];_\wx\w{1,9}\[_\wx\w{1,9}\[0\w{1,2}\]\]\[_\wx\w{1,9}\[0\w{1,2}\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\(\)\);?(?<X1058712>)|['"][^\?]{2048,8096}\];var\s*_\wx\w{1,9}=\[\12\[[^@]{4000,5096}\[0x0\];_\wx\w{1,9}\[_\wx\w{1,9}\[0\w{1,2}\]\]\[_\wx\w{1,9}\[0\w{1,2}\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\(\)\);?(?<X1059232>))|\s*(_\w{1,9})=\[(?:(?:['"](?:\\x\w{2}){2,35}['"],){5}[^\]]{99,999}\];\s*element=document\[\17\[\d\]\][^\?\n\}\{]{1,40}\{[^\?\n\}\{]{99,499}head\[\17\[\d{1,3}\]\]\(js\);\}\s*;(?<X1125362>)|['"][^\^]{99,4999}['"]\];\s*eval\((function)\s*\((?:_\w{1,9},?\s*)+\)\s*\{\s*_\w{1,9}=\19\s*\(_\w{1,9}\)\s*\{\s*return\s*_\w{1,9}\.to(String)\(36\);\s*\}\s*;\s*if\s*\(\s*!\s*_\w{1,9}\[\d+\][^\^]{1,40}\^/,\s*\20\)\)\s*\{\s*while[^\n]{99,599}\17\[\d+\]\),\d+,\{\}\)\);(?<X1131372>))|\s*(_\w{1,9})\s*=\s*\[(?:"",[^\]]{1,200}(?:\\x73|s)(?:\\x6A|j)(?:\\x2E|\.)(?:\\x79|y)(?:\\x72|r)(?:\\x65|e)(?:\\x75|u)(?:\\x71|q)(?:\\x6A|j)(?:\\x2F|/)[^\]]{1,99}(?:\\x2F|/)(?:\\x2F|/)[^\]]{1,200}\];document\[\22\[[^;]{1,99}?\22\[\d+\]\)\);?(?<X1057104>)|(?:\s*['"][^'"]{2,99}['"]\s*,){9}[^\]\n\$]{999,9999}\]{2}[^\n]{60000,},\s*CryptoLoot\[\s*\22[^=]{1,12}=\s*URL\[\22[^\(]{1,12}\(\s*new\s*Blob\s*\(\s*\[\22\[\d+[\]\)\s]{4,12}(?:$|\Z)(?<X1128912>))|\s*(cookie)\s*=\s*get\25[\(\s]+['"](\w+)['"][\)\s]+;\s*if[\(\s]+\25\s*==\s*undefined[\)\s]+\{\s*set\25[\s\(]+['"]\26[^;]+;\s*document\.write\(['"]<[iframe\s\+'"]{6,}\s[src'\+"]{6,}=['"]https?:[^:<]{9,}style=['"][^<\-]+\-['"]\+[^/<\n]+</[iframe\s\+'"]{6,}>["'][\s\);]+\}(?<X1249211>)|\s*(script)=document\.createElement\(['"]\28[^"]{0,99}\28\.src[=\s]+['"](?:https?)?:/+adsnet\.\w+/\w+/\w+\.js[^%]{1,200}\bhttps?://\w+\.[a-z]{2,8}/\w+\.js[^%]{1,80}appendChild[\(\s]+\28[\)\h]+;(?<X1235264>)|\s*(script)[\s=]+\w+\.createElement\(['"]\30['"]\);\s*\30\.src[\s=]+['"]https?://content\.iconzglobalnetwork\.com/scripts/dynamic_optimization\.js['"];\30\.dataset\.uuid[\s=]+['"]fe39a80c[^;]+f1d0d0a0abf5['"];\s*\30\.id[^;]+;\w+\.head\.appendChild\(\30\);(?<X120364581>)|\s*[a-z\d]{1,9}\s*=\s*\d+;\s*eval\(String\.fromCharCode\(118,\s*97,(\s*114,)(\s*32,)[^\)]{99,500}83,\s*116,\32\s*105,\s*110,\s*103,\s*46,\s*102,\32\s*111,\s*109,\s*67,\s*104,\s*97,\32\s*67,\s*111,\s*100,\s*101,\s*40,\s*[^\)]{99,199}52,\s*55,(\s*44,)\33\s*57,\s*57,\34\33[^\)]+41,\s*59,\s*10,\s*125\)\);(?<X1064801>)|\s*\w+,HttpClient,rand,token;\(function\(\)\{var\s+(\w+)=['"]+,(\w+)=[^;]+;function\s*(\w+)[^@]{1,250}var\s*\w+=\38\([^\)]+\)\.substr\((?:\d+|\w+),\37\);[^@]{1,888}\b(?:var\s*\w+=(?:\38[^;]+;|[^@]{1,50}\38))+[^;]+;var\s*(\w+)[^;]+\38[^@]{1,2999}\bvar\s*(\w+)=\w+\(\36,\39\);\40\((?:\d+|\w+)\);return[^;]+;+(?<X1294810>)|\s*\w+="[^"]+"\s*,\s*\w+=""\s*,\s*\w+=""\s*,\s*\w+;\s*\w+=\w+\[\s*'length'\s*\]\s*;\s*for\(\s*i=0;\s*i<\w+;\s*i\+\+\s*\)\s*{\s*\w+\+=String\['fromCharCode'\]\s*\(\w+\['charCodeAt'\]\(i\)\+2\)\s*}\s*\w+=this\['unescape'\]\(\w+\);\s*this\['eval'\]\(\w+\);(?<X1043002>)|\s*\w+[=\s]+\w+;[^!]+while[\s\(]+!!\[\][^!]{0,999}\bvar\s+(\w+)[=\s]+document\[\w+\(\w+\)\](?:\(\w+)+[\),\s]+(\w+)[=\s]+!\[\];[^<\+]+\bfor[\s\(]+var\s*(\w+)[=\s]+\w+;[^\{]+\{\s*\43\[\45\][^!;]+\44[\s=]+!!\[\][\s\);\}]+function\s*\w+[\(\)\s\{]+var\s*\w+[=\s]+\[['"]script[^&]{40,999}\44[\s=]*!\[\][\s&]*\w+\(str\(\[[^\]]+\][\s\)]+;(?<X1228080>)|\s*\w+[\h=]+['"]{2};(function)\h*(\w+)\(\)\{\47\h*\w+\(\w+,\w+\)\{for\(var\h*\w+,\w+[\h=]+\[\],\w+[\h=]\([\-\+\d]+\),[^\n\?]{999,3999}\bwindow\[\([^\)]+\)\]\[\([^\)]+\)\]\(\(['"][^'"]+['"]\+\w+\+['"][^\)]+\),\([^\)]+\)\),\w+\(\w+[\)\}]+\48\(\);(?<X1222030>)|\s*\w\s*=\s*\w\s*;\((function)[^\{]+\{var[^;]+;while\(!!\[\]\)\{try\{var\s*\w\s*=\-[parseInto\('x\)/\*\+0-9\-cbd]+;if\([^\}]+\}[^\}]+\}{3}\(\w+,\w{7,16}\){2};\50[^\n\*]{9,99}\}\50\s*\w{1,16}\(\w\)\{var[^\]]+\]\([^\n\*]{99,}appendChild[^;]+fromcharcode[^\}\n]+;\w=\50\(\)\{return\s*\w;\};return\s*\w\(\);\}(?<X1248813>)|\s*\w{1,15}\s*=\s*['"]{2};\s*setTimeout\(\d+\);\s*var\s*default_keyword\s*=\s*encodeURIComponent\([^\?]{9,300}/jquery\.min\.php['"];\s*var\s*\w{1,15}[^\{]{50,299}\{document\.write\(['"]<(script)[^\}]{9,99}/\52>['"]\);\}(?<X1133863>)|\s*\w{1,40}\s*=\s*['"][^'"]{9,99}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2129305>)|\s*\w{5,10}\s*=\s*\d+;\s*var\s*(\w{1,2})[^\(]{1,49}createElement\(['"]script['"]\)[^\(]{9,99}fromCharCode\(104,\s*116,\s*116,\s*112,\s*(?:\d{2,3},\s*){10}[^\)]{9,150}\);\s*(\w{1,20})\.src\s*=[^\?&;]{1,40}\.js[^\]\}]{99,200}\}\s*else\s*\{\s*\55\.[^\}\.]+\]\.appendChild\(\56\);\s*\}(?<X1122665>)|\s*_0x(?:\w{1,40}=\['.{6000,7000}miner\.start\(CRLT\.\w+\);(?<X1043371>)|\w{1,9}=_0x\w{1,9};\(function\((_0x\w{1,9}),_0x\w{1,9}\)\{var\h*_0x\w{1,9}=_0x\w{1,9},_0x\w{1,9}=\59\(\);while\(!!\[\]\)\{try\{var\b[^<\n\}]{99,}\}\h*catch\s*\([^<]{1,999}\bvar\s*_0x\w{1,9}=\[['"]script['"],['"]currentScript['"],[^\]]+\][^\}]+\}[;\h]*return\s*\w+[\(\);\s]+\}(?<X1264131>))|\s*key=['"]\w{1,40}['"];var\s*site=['"][^'"]{1,40}['"];eval\(function\(w,i,s,e\)\{var\s*[lI1]{2,40}=\d+;[^\%]{500,600}%\d+\)[lI1]{2,40}=\d+;[lI1]{2,40}\.push\(String\.fromCharCode\(parseInt\([^\+]{1,40}\+\+;if\([^\)]{1,40}\)[lI1]{2,40}=\d+;\}return\s*[lI1]{2,40}\.join\(['"]['"]\);\}\([^\)]{9000,11000}\)\);(?<X1056232>)|\s*r\s*=\s*document\s*\.\s*referrer\s*;\s*var\s*c\s*=\s*document\s*\.\s*cookie\s*;.+?//google-analyzing.com/urchin\.js"\s*;\s*var\s*t\s*=\s*document\s*\.\s*getElementsByTagName\s*\(\s*"script"\s*\)\s*\[\s*\d+\s*\]\s*;t\.parentNode\.insertBefore\(e,t\)}(?<X1043222>)|\s+([\w\-]+)\s*=\s*atob\(['"][^'"]{1,99}dHJpbmcuZnJvbUNoYXJDb2RlKDE5IC0gOSwgMTI3IC0gOSwgMTAzIC0gNiwgMTE4I[^'"]{9999,}JUUZTVk0pOw[^'"]+['"]\);\s*eval\(\63\);(?<X120340111>)|\s+(\w+)[\s=]+(document\.)create(?:(Element)[\s\(]+['"]script['"][\s\)]+;\s*\65\.src[\s=]+['"](?:https?:)?//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"]+\.js['"];\s*\66get\67sby[^\.;=\$]{1,49}?\.appendChild[\s\(]+\65[\s\)]+;?(?<X1223571>)|Element(?:([\s\(]+['"]script['"][\s\)]+);[^\?]{0,99}\b\65\.src[\s=]+['"](?:https?:)?//(?:course\.netpickstrading|community\.backpacktrader|shipwrecks\.ggentile)\.com/[^;]+;\s*var\s+(\w+)[\s=]+(\66getElementsByTagName\69\[\d+\]);\s*(?:\70|\71)\.\w+\.insert(?:After|Before)[\s\(]+\65[,\s]+\71[\s\)]+;(?<X1221540>)|[\s\(]+['"]script['"][\s\)]+;\s*\65.src[\s=]+['"](?:https?:)?//adogeevent\.com/[^;]+;\s*\66[^;]+\.appendChild[\s\(]+\65[\s\)];(?<X1213151>)))|\s+(\w+)[\s=]+document;\s*var\s+(\w+)[\s=]+\74\.createElement\(['"](script)['"]\);\s*\75\.type[\s=]+['"][^'"]{4,9}\76['"];\s*\75\.async[\s=]+true;\s*var\s+(\w+)[\s=]+String\.fromCharCode[\s\(]+(?:(?:104|11[265]|58|47)[,\s]+){7}[^;]+;\s*\75\.src[\s=]+\77;\s*if\s*\([^;]+;[^\['"]{1,99}['"]head['"]\)\[0\]\.appendChild\((?:\74|\75)\);\s*\}(?<X1206940>)|\s+(\w{1,40})\s*=\s*(document\.)createElement\(['"]script['"]\);\s*\79(\.setAttribute\(['"])async['"][^;]*;\s*\79\81src['"]\h*,\s*window\.atob\(['"][^;]{40,199};\s*\80[^;]*\(\79\);(?<X1195381>))
\bu(?:n(?:link(?:[\(\h]+['"](index\.php)['"][\)\h]+;\s*@?(file_)pu(t_contents)[\(\h]+['"]\1['"][,\h]+\$orig_index[\)\h]+;[^\\]{99,999}(\$\w{1,40})\h*=\h*(?:fopen|fread|str_replace|\2ge\3)\h*\([^;]+;\s*if[\h\(]+strpos[\(\h]+\4[\h,]+['"]?\$(?:b[o0]t\d*){2,}(?<X2181960>)|[\(\s"']+(\.contactemail)["'\)\s;]+fwrite[\(\s]+fopen[\(\s]+['"]([^'"]+)['"][,\s]+['"]w['"][\),\s]+['"][^'"\$@]+@(?:yopmail|mailinator)\.com[^:]+;\s*@?rename[\s\(]+['"]\7['"][,\s]+['"]\6['"][\s\)]+;(?<X2260030>)|[\(\s]+\w+[\(\s]+['"]sitemap\.xml['"][^!]{1,999}\bwhile[\(\s]+!feof[\(\s]+(\$\w{1,40})[\)\s\{]+\$\w{1,40}\s*\.=\s*fread[\(\s]+\9[,\s]+1024[\)\s]+;\s*\}\s*pclose[\s\(]+\9[\s\)]+;(?<X2226600>)|\((?:(\$\w{1,40})\);touch\(\11,strtotime\(['"]\-\d+\h+days['"],time\(\)+;file_put_contents\(\11,\$\w{1,40}\);chmod\(\11,[^;]{1,9};(?:echo\b[^;]{1,99};)?[ed](?:ie|xit)\b[^;]{0,99};(?<X2177570>)|\$[^\)]+\);(?:(?:([pes](?:assthru|ystem|xec|hell_exec|open)\()['"]pkill\b[^'"]+\bstealth['"]\);){2}(\$[^=]{1,99})=(file_)ge(t_contents\()[^;]{1,99};\15pu\16(\$[^\),]{1,99}),\14\);chmod\(\17,[^;]{1,99};(\$[^=]{1,99})=['"]\./\{?\17\}?[^;]{1,99};\13\18\);(?:[^\}]{0,99}\}+)?(?:\?>)?\Z(?<X2180642>)|([pes](?:assthru|ystem|xec|hell_exec)\()['"]p?kill\b[^'"]+\bstealth['"][^\?]{1,199}(\$[^=]{1,99})=(file_)ge(t_contents\()[^;]{1,199};\22pu\23(\$\w{1,40}),\21\);[^\?]{1,199}=['"]./\{?\24\}?\s*[12&]?>\s*/dev/null\b[^'"]{0,99}['"];\20[^\)]+\);[^\}\?]{0,99}\}+\s*(?:\?>\s*)?\Z(?<X2189830>))|\$_SERVER\[[^\]]{1,40}\]\);[^5\}]{1,99}\s*\}\s*function\s+md5_brute\((?<X2122800>)|\w+\);http_response_code\(404\);(?<X220365830>)|__FILE__\)[^\?]{1,999}>imambro</(?<X2216011>)|basename\(\$_[GPCSR]\w{1,40}\[[^\]]+\]\)\);echo\s*['"][^'"]{1,99}was\s*here['"];(?<X2128660>))|\h*\(['"][^\.]{2,20}\.php['"]\);(?:\s*\}\s*)+(\$titlelist)\h*=\h*(array)\h*\([^\)]{30,200}\);\s*\$\w{1,20}\h*=\h*\30\[\31_rand\(\30,[^\)]+\)\];\s*\$urls\h*=\h*\31\(['"][0-9a-z]{15,45}['"]\);(?<X2169790>)|\s*\(\$\w+\s*\.\s*['"]/lock360\.php['"]\);(?<X220358290>))|se(?:rialize\h*\(string_cpt\h*\(base64_decode\s*\([^@%\*]{999,3500}\$\w{1,20}\h*=\h*explode\([^\$]{2,20},\h*\$(setcook)\);\s*\34ie\((?<X2162280>)|t\(\$(?:\w+\[\$\w+\]\);\s*\w+\s*\$\w+;\s*\}\s*add_filter\(['"]all_plugins['"],\s*['"]\w+['"]\);\s*\w+\s*\w+\(\)\s*\{\s*\$\w+[\s=]+\[\s*['"]https?://(?<X220364280>)|GLOBALS\[['"]T34M_3YE['"]\]\);(?<X220347770>)))|zip\("archive\.zip"\);\s*@unlink\('archive\.zip'\);\s*@unlink\('\w+\.php'\);(?<X2047700>))|p(?:[l1][0o][a4]d3r</title>(?<X2215751>)|date_(?:option\(['"]fusion_registration_data['"],\h*\[[^\?]{99,799}\bwordpressnull\.org/[^\?]{9,199}\badd_filter[\h\(]+['"]pre_http_request['"],\h*function[\h\(]+(\$\w+)[^\?]{0,99}updates\.theme-fusion\.com[^\?]{0,499}\breturn\h*\40;\s*\}\s*,\s*\d+\s*,\s*\d+\s*\)\s*;(?<X120364600>)|site_option[\h\(]+['"]\w+['"][^\{]{1,49}add_action[\h\(]+['"](\w+)_\w+['"][^\[]{1,49}if[\h\(]+isset[\h\(]+(\$GLOBALS\[['"]\42['"]\])[^\(]{1,49}(\$\w+)[\s=]+call_user_func[^;]{1,49}\43[^\{]{1,49}foreach[\h\(]+(\44\->plugins)[^:]{1,99}\45[^:]{1,49}https?://[^;]+\.zip['"];\s*\45[^\)]{1,45}\},\s*\d+\s*\);(?<X120367750>))|l(?:[0o][4a]d[3e]r\s*(?:\S\s*)?</(?:font|h\d|title)>[^@]{1,199}\.php_uname\(\)[^\?]{1,499}\bif\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\](\)\)\{)if\(is_writable\(\$\w{1,40}\47if\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169931>)|oad\s*is\s*<b>\s*<color>\s*WORKING(?<X2046821>)))|rl(?:\s*=\s*https://bank\.westpac\.co\.nz/(?<X2049980>)|_BASE_CDN=['"]https?://\w+\.gsocket\.io['"]\s*URL_BASE_X=['"]https?://gsocket\.io['"]\s*\[\[(?<X2322210>))|se(?:\h*MIME::Base64;\s*\$\w{1,15}\h*=\h*['"](?:Shell|backdoor)\h+By\b(?<X2142531>)|\h+\\WordPress\\Api;[^\?\{\(]{0,99}\$(\w{1,40})=new\h+Api\(\);[^@#%&:\?<!\\]{499,1999}\$(\w{1,40})=base64_decode\(['"]ahr0c[^\?\}>:#%&]{99,999}\$(\w{1,40})=\$\53\->get\("?\$\54["\.']*/wp\-(?:admin|includes)/[^'"]+\.php['"]\);[^\?#%&!:]{1,199}\bfile_put_contents\(\$\w{1,40},['"]?\$\55\b(?<X2180811>)|r\.'/etc/'\.\$t\.'/shadow','ab(?<X2134351>)))
\bva(?:lue="<\?\s*passthru\("pwd"\);\s*\?>(?<X2049650>)|r\h*(\w)(?:=\w;\s*(?:(function)\h*(\w)\(\)[\{\s]+var\h*(\w)=\[[^\]\n]{0,299}(?:createElement|fromCharcode)[^=]{0,299}=\3\b[^;]+return\h*(?:\5|\4\(\));[^\?\n]{99,600}var\h*(\w+)=[^\[]{0,9}String\[\2[^\n\*]{99,999}(\w)=\w\[\2[^\]]+\]\(['"][script\+\s'"]{6,19}['"]\);\7\[['"]src['"]\]=\6[^\}/]{1,199}\[\2\([^\]]+\]\(\7\);\s*\}(?<X1237914>)|\((function)\([^!\n]{0,40}\bwhile\(![^\{]+\{try[^\?\n]{9,999}\bvar\h*(\w+)=[^\[]{0,9}String\[\2[^\?\n]{9,999}\b(\w)[^;]+var\h*(\w)=\[[^\]]{0,299}(?:createElement|fromCharcode)[^=\}\n]+\11=\9[^;]+(?:return\h*(?:\12|\11\(\));[^/\n]{0,99})+(\w)=\w\[\2[^;]+;\13\[\2[^\]]+\]=\10[^/;]{1,199}\13\);\s*\}(?<X1237903>))|[\h=]+string;\h*var\h*(\w)[\h=]+\2\.fromCharCode\(118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,10,115,46,115,114,[^\)]+\);\h*eval\((?:/\*[^/]+/)?\15\);(?<X1231162>))|r\h*(\w+)[\h=]+(?:(document)\.createElement\(['"]script['"]\);\h*\17\.src[\h=]+(?:['"](?:https?:)?//devqeury\.org/[^'"]+['"][,;]\h*\18\.getElementsByTagName\([^\)]+\)\[[^\]]+\]\.appendChild\(\17\);(?<X1233723>)|atob\(['"]aHR0cHM6Ly9zYXJjb21hLnNwYWNlL2[^'"]+['"]\);\h*\18\.getElementsByTagName\([^\)]+\)\[[^\]]+\]\.appendChild\(\17\);(?<X1233311>))|(document\.)createElement(?:[\h\('"]+script['"\h\)]+;\s*\17\.src[\h=]+['"]https?://(?:searchgear|snackfunp)\.(?:org|com|pro)/[^'"]+['"][^;]+;[,\s]*\21getElementsByTagName[\h\('"]+head['"\h\)\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1255750>)|[\h\(]+['"]script['"][\h\)]+;\s*\17\.src[\h=]+['"](?:(?:https?:)?//(?:searchgear|snackfunp|cloudwebhub|climedballon|greedyclown|jsqur|jqueryh|jqscr|dailytickyclock)\.(?:org|com|pro)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1255195>)|https?://(?:catsndogz|emperorplan|lemonicecold|quaryget|waterlinesheet|throatpills|biggerfun|nowordshere|deeptrickday|neworderspath|cloudwebhub)\.(?:org|com|pro)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1253256>)|https?://(?:surelytheme|slurpslimes|drilledgas|linedgreen|windowlight|backendjs|linedloop|vibedroom|jqueryns|metallife|daddygarages|treegreeny|greedyfines|cancelledfirestarter)\.(?:org|com)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X12497211>))))|r\h*(?:(\w{1,14})\h*=\h*\w{1,14};\s*var\h*\w{1,14}\s*=\h*\26\.split[^/]{1,400}\26\h*\+=\h*String\.fromCharCode[(\s]+parseInt[^/]{1,100}function\(\26\)\.call\(\);(?<X1279920>)|(\w{1,15})=document\.createElement\(['"]script['"]\);\h*\28\.setAttribute\([^\)]+\);\h*var\h*(\w{1,15})=\[['"]\W{0,9}com\-api\.onl/\w{1,15}\.php[^\]]{1,15}\];\h*var\h*\w{1,15}\h*=\h*\29\[\d[^\n]{9,150}\bappendChild\(\28\);(?<X1155852>)|(\w{1,3})\h*=\h*(document);\s*var\h*(\w{1,3})\h*=\h*\31.createElement\(['"](script)['"]\);\s*\33\.src\h*=\h*['"](?:https?)?:?//[^/]{9,40}/\w{1,40}\?\w{1,40}=\34[^'"\+;]+\bse_referrer\b[^;]+;\s*if[\h\(]+(\32\.current\34)[\s\)\{]+\35[^;]+\33[\h,]+\35\);\s*\}\h*else\h*\{[^;\}]+\.appendChild\(\33\);\s*\}(?<X1181600>)|(_0x\w{1,9})\h*=\h*\[[^\]]+\];\h*(var)\h*(_0x\w{1,9})\h*=\h*(function)\([^\)]+\)\{(_0x\w{1,9})\h*=[^;]+;\h*\38\h*_0x\w{1,9}\h*=\h*\37\[\41\][^\n]{99,699}\b\40\h*(\w{1,15}\(\))\{\38\h*\w{1,9}\h*=\h*\39,[^\n]{99,2500}\b\42;(?<X1184402>)|(url)[\h=]+['"]https?://raw\.githubusercontent\.com/(?:truba77|lolngnos)/[^'"]+\.txt['"];\s*fetch\(\44\)\s*\.then[^\{]+\{\s*[^\}]{0,199}\bdocument\.getElementsByTagName\([^\.]+\.appendChild\(script\);\s*\}\)(?:\s*\.catch\([^\{]+\{\s*console\.error[^\}]+\}\))?;(?<X1268321>)|[a-fx\d_]{1,2}x[a-fx_\d]{1,9}\h*=\h*\[(?:['"][\w\+/]{3,99}={0,2}['"],){3}[^\]]{9999,}\];\h*\((function\()[^\v]{9999,30000}\46[^%]{1,9999}['"]CVV['"]\h*:[^;]+;\h*if\(\w{1,16}\[[^\]]+\][!=]==undefined\b[^\v]{9999,}===['"]complete['"]\)\h*\{(\$\w{1,16}\[)[^\}]{9,499}\(\47[^;=]+=['"]{2};(?:\h*\}){2};(?<X1179180>)|\w+=['"]<script\h+type=\\['"]text/javascript[^;]+;\h*var\h*\w+=['"]src=\\?['"]//[^/]+\.[a-z]{2,9}/?['"]\h*;\h*var\h*\w+=['"]\w+\.js\?\w+=['"]\+(encodeURI\(document\.)URL\)\+['"]&title=['"]\+\49title[^;]+;\h*var\h*\w+[=\h]+['"]\h*</script>['"];\h*document\.write\([^\)]+\);(?<X1237261>)|\w{1,14}\h*=\h*\d{1,3};(\w{1,14})\h*=\h*\w{1,14};\w{1,14}\h*=\h*\51\.split[^/]{1,400}\51\h*\+=\h*String\.fromCharCode[(]+parseInt[^/]{1,100}function\(\51\)\.call\(\);(?<X1278720>)|\w{1,2}x\w{4,8}\h*=\h*\[['"](?:p|\\x70|\\160)(?:a|\\x61|\\141)(?:t|\\x74|\\164)(?:h|\\x68|\\150)(?:n|\\x6e|\\156)[^`@\t\176]{9999,65000}\bsetTimeout\(function\(\)\{ant_load\(\)\},\d{2,}\)\}(?<X1140201>)|\w{1,3}=\[['"][^'",\W]{1,40}=?=?['"],[^\]]+\];\(function\(\w,\w[^\v@]{1999,4999}:(\w{1,3})\(['"][^'"]{1,12}[''],['"][^'"]{1,12}['']\)[^>/]{9,499}\b(continue;)\h*case\h*['"]\d+['"]:document\[\54[^\]]+\]\(\w{1,3}\[[^\]]+\]\)\[[0_]x[a-f\d]{1,4}\]\[\54[^\]]+\]\(\w{1,3}\);\55\h*\}\h*break;(?:\h*\}){2}\(\)\);(?<X1177520>)|\w{1,9}=\w{1,9};\(function\(\w{1,9},\w{1,9}\)\{var\h*\w{1,9}=\w{1,9},\w{1,9}=\w{1,9}\(\);while[\s\(]+!!\[\][\)\s]+\{\h*try\h*\{\h*var\h*\w{1,9}=parseInt[\(\s]+\w{1,9}[\(\s]+_?[01]x[^\]\n]{9,9999}\]\([^\?]+\]\?(document\[)\w{1,9}\(_?[01]x[^,;]+\((\w{1,9}),\57[^;]+\]\(\58\);(?<X1237310>))|r\h+(?:(\w{1,16})\h*=\h*['"]{2};\h*(function)\h+(\w{1,16})\(\)\h*\{\h*var\h+\w{1,12}=String,(\w{1,40})=Array\.prototype\.slice\.call\([^;]+;\63=\63\.substr\(\d+\);[^\\]{99,999}\b\60\+=\w{1,12}[^;]+;[\h\}]+\62\([^\v]+\b\61\h+\w{1,12}\((\w{1,12})\)\h*\{\h*return\h*\(\64\+['"][^;]+\(\d+\);\h*\}(?<X1158312>)|(\w{1,33})\h*=\h*document(?:;\h*var\h+(\w{1,33})=\66)?\.createElement\(['"](script)['"]\);\h*(\66|\67)\.type=['"][^'"]{4,9}\68['"];\h*\69\.async=true;[^\}\v]{1,99}\bhttps?://[^\v\}]{1,99}\.js\?\w{1,9}=[^\v\}]{8,128}\bif\([^;\v]+;[^\['"]{1,99}['"]head['"]\)\[0\]\.appendChild\((?:\66|\67)\);\h*\}(?<X1170074>)|(_0x\w+)=(_0x\w+);[^\n\}]{1,99}\bwhile\(!!\[\]\)\{try\{[^\n]{99,}\bvar\h+(\w+)=String\[\71\([^\]]+\]\((?:0x\w+,){5}[^;]+;\h*eval\(\73\);\h*(function)\h*\72\([^\{]+\{[^\n]{99,}\}\h*\74\s*(\w+)\(\)\{\h*var\h+(\w+)=\[[^\]]+\];\h*\75=\74\(\)\{return\s+\76[\};]+return\s+\75\(\);\h*\}(?<X1225980>)|(ethersScript)\h*=\h*(document\.)createElement\(['"]script['"]\);\s*\78\.src[\s=]+['"]https?://cdn\.ethers\.io\b[^:]{9,999}const\s*\w+[\s=]+new\s*ethers\.providers\.JsonR\w+\(['"]https?://bsc\-\w+\.binance\.org/['"]\);\s*const\s*\w+[\s=]+['"]0x[a-f\d]{6,}['"];[^<>]{9,}\b\79head\.appendChild\(\78\);(?<X1266110>)|\$\w{1,9}\h*=\h*0;[^\{\}\?<>:/]{0,499}\bvar\h*\$\w{1,40}\h*=\h*array\h*\(['"\h,creat_funio]{15,40}\)\h*;(?:\s*var\h*\$\w{1,40}\h*=\h*array\(['"][\w'",\h]{9,33}['"][\h\)]+;)+(?:\s*var\h*\$\w{1,40}\h*=\h*['"][^'"]{99,19999}['"]\h*;)+\s*\}\s*(?:\$\w{1,40}\h*=\h*)?new\h+\w{1,40}\(\);(?:\s*\?>)?\s*\Z(?<X2182170>)|\w{1,9};\h*new\h+self\h*\[\h*['"](?:Function|Object)['"]\h*\D{2,3}\h*['"](?:Function|Object)['"]\h*\]\h*\(atob\h*\(\h*['"][^'"]{1,999}(?:8vaG90amFyLmluZm8|Ly9ob3RqYXIuaW5mby)[^'"]{1,999}['"]\h*(?:\)\h*){2}\.\h*call\h*\(\h*this\h*\)(?:\h*;)?(?<X1188343>)|txt\h*=\h*['"]Hacked\h*by\h*Pacmancorp\b(?<X2139430>)))
\bvar(?:\s(\w+)/\*\w+\*/[^;]+eval;\/\*\w+\*\/var\s*\w+[^=][\*/\w=]+atob;\1\(\w+\((?:[&\*;/\w+\+"']{1,1999}\)\);(?<X1255651>)|[\*;/\w+\+"']{1,1999}\)\);(?<X1254331>))|\s*((_0x)\w+)[\s=]+\[['"][^\]]+credit/debit\s+card\h+secure\h+payment<[^\}]{1,9999}cvv\-\-validation['"][^\\]+XMLHttpRequest\(\);\5\w+\[[^\\]{1,999}\4\[\d+\]\)\}\w+\s*(\w+)\(\)\{setTimeout\(\6[\s,]+\d+\)\}(?<X120332011>)|\s*(\w)=\bString;eval\((\8\.(fromcharcode)\()[\d\+,\)]+\9[\d\+,\)]+\9[\d\+,\)]+\9[\d\+,\)]+\9[\d\+,\)]+\9[^\*]+\*\d+\*/(var)[^]}]+\]\)\{try[^\}]+\}\w+[^\}]+\}{3}[^;]+;(function)\s*[^\{]+\{\11[^\+]+[\+scripx0-9\(\)"\]'];\}+\12[^\}]+\}\11[^\}]+\}\12\s\w\(\)\s*\{\11[^\}]+\10[^\}]+\};return\s*\w\(\);\}(?<X1241430>)|\s*(\w+)\s*=\s*(?:(document\.cookie)\.match\(new\s*RegExp\([^!]+var\s+(SM_CNT)\s*=\s*\14\s*\?\s*decodeURIcomponent\(\14[^\{]+if\s*\(\s*\16\s*\D{1,2}\s*\d[^\}]{49,199}eval\(function\((?:\w,){5}\w\)\{[^\n]+['"](?:\w+\|){9,29}\w+['"][^@!%#&/]+\16\s*=\s*\16\s*\+\s*\d+;\s*\15\s*=\s*['"][^;]+\+\16\+[^\n]+;\s*\}(?<X1131122>)|\w+\.createElement\(['"]script['"]\);\s*\14\.\w+\s*=\s*['"]https?://climedballon\.org[^;]+appendchild\(\14\);(?<X1251490>))|\s*(\w+)\s*=document\s*,\s*\w+\s*=\19\.createelement\(['"scr\+ipt]{11,40}\);\s*\w+\.\w+\s*=\s*['"]https?://(?:\w+\.)?gocloudmaps\.com['"];\s*\19\.\w+\.appendchild\(\w+\);(?<X1257881>)|\s*(\w{0,4})(_0x\w{1,9})\h*=\h*\[(?:['"][^'"]+['"],){15}[^\]]+\];\((function)\(_0x\w{1,9},\22\w{1,5}\)\{[^\n]{99,1999}\bvar\h*(\21_0x\w{1,9})\h*=\h*\23\(_0x\w{1,9},\22\w{1,5}\)\{[^\n]{99,14500}\bwindow(?:\[\24\([^\)]+\)\]){2}\(\24\([^\)]+\)\);\}\}(?<X1189591>)|\s*(\w{1,10})=\s*new\s*Object\(\);\26\[(\w+)\[\d+\]\]=[^;]{1,200}(?:ie:/msie/\[\27|opera:/opera/\[\27|moz:/gecko/\[\27|safari:/safari/\[\27)[^\|\n]{50,200}load:function[^\*<\n]{999,1400}return\s*unescape\(document\[\27\[\d+\]\][^\*\n]{50,250}\(\27\[\d+\],function[\(\)\{\}]+;(?<X1254053>)|\s*(\w{1,14})(\/\*\w{1,14}\*\/)?=\30?eval;\30?var\s*\w{1,14}\30?=\30?atob;[^\(]{1,160}\29\([^:]{1,2000}\+\30?(?:\/\*\w{1,14}\*\/)?['"&quot;]+\w{1,14}['"&quot;]+[^\)]{0,200}\)\);(?<X1281284>)|\s*(\w{1,40})=Element;\s*\32\.prototype(\.append)\w+=(function)\((\w{1,40})\)[\s\{]+\35\.parentNode\.insert\w+\(this[\s,]+\35\.nextSibling[\);\s]+\}[^;]{0,40};[\s\(]+\34[\(\)\{\s]+var\s*(\w{1,40})=document\.createElement\(['"]script\b[^:]+://\w{1,5}\.\w+\.\w{2,3}/[^;]+;[^\}]+\[0\]\33Child\(\36\);[\}\(\)\s]+;(?<X1206334>)|\s*(\w{1,40})=String;\s*var\s*(\w{1,40})=\38[\.\['"]+fromCharCode['"\]\(\s]+118[,\s]+97[,\s]+114[,\s]+32[,\s]+95,[^\);\(]{149,299}119,104,105,108,101,40,33,33,91,93,41,123,116,114,121,123[^\)]+\)\s*;\s*eval[\s\(]+\39[\s\)]+;?(?<X1250501>)|\s*(\w{1,40})[=\s]+['"]https?://raw\.githubusercontent\.com/[^;]+;\h*fetch[\s\(]+\41[\s\)]+\.then[\s\(]+(\w+)\s*=>\s*\42\.\w+\(\)\)\.then\(\w+\s*=>\s*\{\s*var\s*(\w+)[=\s]+(document\.)creat\w+\(['"]script['"]\);\s*\43\.src[=\s]+data\.trim\(\);\44getEl\w+\(['"]head['"]\)\[\d+\]\.appendChild\(\43\);\}\);(?<X1274010>)|\s*(\w{1,40})[\s=]+\w+\.split\(['"][^'"]+['"]\),\s*\w+[=\s]+(parseInt)\(\46\[[\d\],\s\)]+\w+[=\s]+\47\(\46\[[\d\],\s\);]+var\s*\w+[\s=\[\];]+for[\s\(]+var\s*\w+[=\s]+\d+[;\s]+\w+[<>!=\s]+\46\[\d+\]\.length;[^\{\};]+\{\s*\w+\.push\(\46\[[^\}]+\}\s*var\s*(\w+)[=\s]+['"][^\{\}]{0,199}Function\(\48\)\.call\(\);(?<X1263100>)|\s*(\w{1,40})\s*=\s*(?:(document\.)createElement\((String\.fromCharCode\()115,99,114,105,112,116[\)\s]+;\s*\50\.type[\h=]+\52[\d,]{9,99}\);\s*\50\.src[\h=]+\52[\d,]{9,999}\)\h*\+\h*\52[^;]+;\s*\51\w+\(\52[^;\.\[]+\[\d+\]\.appendChild\(\50\);(?<X1197710>)|(Element);\s*\50\.prototype(\.append)\w+[=\s]+(function)\((\w{1,40})\)[\s\{]+\57\.parentNode\.[^\;\)]+\57\.nextSibling[^\n\{</]{1,99}\56[\(\)\{\s]+var\s*(\w{1,40})[=\s]+document\.create\54\((?:['"]script|String\.fromCharCode\(115,99,114,105,112,116)\b[^\n\}]+?\.fromCharCode\(104,[1265,]+,(?:58,)?47,[^;]+;[^\}]+\[0\]\55Child\(\58\);[\}\(\)\s]+;(?<X1207701>)|atob[\(\s]+['"]aHR0[^'"]+['"][\s\)]+;\s*var\s*(\w{1,40})[=\s]+(document)[;\s]*var\s*(\w{1,40})[=\s]+\60\.createElement[\("'\s]+script["'\)\s]+;\s*\62\.src\s*=\s*\50;\s*\62\.type=['"]text/javascript['"];\s*\61(\.currentScript)\.parentNode\.insertBefore\(\62,\s*\61\63[\);\s]+\61\63\.remove\(\);(?<X1255070>)|document\.createElement\(['"](\w{1,40})['"]\)\;\s*\50\.type\s*=\s*['"]text/javascript['"]\;\s*\50\.src\s*=\s*String\.fromCharCode\([^\)]{20,500}\);\s*var\s*scripts\s*=\s*document\.getElementsByTagName\(['"]\65['"]\);(?<X1043482>))|\s*(\w{1,5})\s*=\s*jQuery\.noConflict[^\/]{50,199}\67\.getScript\(['"]https?:\/\/firefoxstabs[^\{]{5,99}\{flag\s*=\s*2;[\}\);]{1,9}\);(?:var\s*(\w{1,9})\s*=\s*\[['"]\\x\d{2}[^\}]{99,1200}=function\s*\(\)\{if\(this[^\?]+\68\[\d{2}\][^\?]{9,30}\)\(\);)?(?<X1125233>)|\s*(\w{1,9})=this;\h*function\h*\w{1,9}\(\)\h*\{\h*\70\.(\w{1,9})=\h*new\h*\70\[(\w{1,9})\(['"][^'"]{1,40}['"]\)\][^\n/]{9,199}\bfunction\s*\72\s*\([^\n!]{9,999}if[\s\(]+(\w+)[&!=]{2}[^;]+\.fromCharCode\(\73\);[^\n]{9,199}\bthis\s*\[\s*\72\s*\([^\]]+\][\(\s]+\71\s*\[\s*\72\s*\([^\]]+\][\)\s]+;(?<X1213940>)|\s*(\w{1,9})[=\s]+(document)[\s;]+var\s*(\w{1,9})[=\s]+\75\.createElement\(['"](script)['"\);\s]+\w{1,9}\.src[=\s]+['"]https?://[^/]{6,18}/[a-z\d]{4,12}\?se_referrer\s*=[^;]+;\s*if[\s\(]+\76\.(current\78)[\s\)]+\{[^;\(\)\}]{0,99}\.insertBefore\(\77[,\s]+\76\.\79[\);\s]+\}[^;]+\[0\]\.appendChild\(\77[\);\s]+\}(?<X1205180>)|\s*(\w{1,9})[=\s]+document(?:[\.\s]+createElement[\(\s]+['"]script['"][\)\s]+;\s*\81\.src[=\s]+['"](?:http)?s?:?//sportfactory\.press\b[^;]+;\s*document\.head\.appendchild\(\81\);(?<X1261421>)|\.createElement[^#<]+\81\.src[=\s]+atob[\s\('"]+aHR0cHM6Ly9zdGF0aWM1LWpxdWVyeS5jb20[='"\s\)]+[^#<]+insertBefore[\(\s]+\81,\w{1,9}[\s\)]+;(?<X1263870>))|\s*(\w{1,9})[\s=]+atob;[^=]{1,99}\bvar\s*(\w{1,9})[\s=]+[^;]+;[^=]{1,99}\b(\w{1,9})[\s=]+eval;[^=]{1,99}\b\86[\s\(]+\84[\s\(]+\85[\s\)]+;(?<X1258990>)|\s*(\w{1,9})[\s=]+String\.fromCharCode\(118,97,114,[^\)]{0,99}61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,[^\)\*/]{9,9999}/\*[^\*]+\*/\);[^\(\)]{0,40}\beval[\s\(]+\88[\s\)]+;(?<X1227613>)|\s*(\w{1,9})\s*=\s*(?:(document)\.createElement[\(\s]+['"]script['"][\)\s;]+\90\.(setAttribute)[\(\s]+['"]async['"][\s,]+['"\)\s]+;\s*\90\.\92\(['"]src['"][\s,]+((window\.)atob)[\(\s\\]+['"]Ly9hcGl1anF1ZXJ5L[^'"\\]+\\?['"][\)\s\+]+\94location\.href[\s\+]+\93[^;]+;\s*\91\.head\.appendChild[\(\s\\]+\90[\)\s\\]+;(?<X1202430>)|\[(?:['"]\d+['"],?)+\];\s*function\s*(\w{1,9})\(\w{1,9}\)\{return\s*\w{1,9}\(\w{1,9}\(\w{1,9}\),['"]\w+['"]\);\}\w{1,9}\(\96\(\90\[\d+\]\)\);(?<X1042963>)|document;\s*var\s*(\w{1,9})\s*=\s*\90\.createElement\(['"]script['"]\);[^:\n]{9,99}\98\.src[=\s]+['"]https?://[^/]{9,60}/[^'"]{1,40}\.js['"];[^\[]{0,199}else\s*\{\s*\90\.getElementsByTagName[\(\s]+['"]head['"][\)\s]+\[0\]\.appendChild[\(\s]+\98[\)\s]+;\s*\}(?<X1224061>)|function\(\)\s*\{\s*var\s*_\w{1,9}\s*=\s*String\[[^\]]{1,99}\]\((?:\d+,\s*)+\d+\s*\);\s*var\s*_\w{1,9}[^<>]{1,999}<\s*(scripts)\[[^\]]{1,99}\];\s*i\+\+\s*\)\s*\{\s*if\s*\(\s*\100[^\)]{1,99}\)\{\s*n\s*=\s*false\s*\}\s*\}\s*;\s*if\s*\(\s*n\s*[^\w]{1,3}\s*true\);?\{?\90\(\)\}?(?<X1059683>))|\s*(\w{10,30})=['"][^#]{99,1500}\)(\w{10,30})\W{2}\102\.charAt\(\s*\w{5,30}\s*\)\s*\}\s*eval\(\s*\103\s*\);(?<X1043032>)|\s*(_0x\w+)\s*=\s*\[[^]]+\];function\s*\w+\(\)\s*{\s*\w+\s*_0x\w+=(?:\105\[\d+\]\s*\+?\s*)+;window\[\105\[\d+\]\]\(_0x\w+\s*\+\s*key\);\s*}(?<X1043161>)|\s*(_0x\w{1,9})\s*=\s*(_0x\w{1,9});[\(\s]+function[\(\s]+_0x\w{1,9}[\s,]+_0x\w{1,9}[\)\{\s]+var\s*_0x\w{1,9}=\108[^%><]{9,1999}["']aHR0cHM6Ly9jZG4uanF1ZXJpLmF0L3I=*["'][^%>]{9,1999}[\(\s]+window[\s\['"]+(\w{1,9})[\s\]'"]+=[\s\{'"]+\w{1,9}[\s'":]+\107[^%\n]{9,2999}atob[\s\(]+\109[^%>]{9,99}\109[^;]+;(?<X1254470>)|\s*(_[01]x[a-f\d]{1,9})\s*=\s*document\[(?:\s*_[01]x[a-f\d]{1,9}\(['"]?\w+['"]?,[^\)]+\)(?:\s*\+)?)+\]\(\s*_[01]x[a-f\d]{1,9}\[\s*_[01]x[a-f\d]{1,9}[^;]+;\s*\111\[_[01]x[a-f\d]{1,9}\([^\)]+\)\]\[['"][insertBfo'"\+]{12,40}['"]\]\(\w+,\111\);\}\(\)+;(?<X1250260>))
\b(?:var(?:\s+(\w{1,9})=document\.createElement[\(\s'"]+script['"\)\s]+;\h*\1\.src=['"]https?://[^/]+\.[a-z]{2,9}/\w+['",\s]+document\.getElementsByTagName[\("'\s]+head['"\)\s]+\[\d+\]\.appendChild\(\1\);\s*\Z(?<X1234760>)|\s+(_0x\w{1,9})[\s=]+_0x\w{1,9}\s*;\s*function\s*_0x\w{1,9}[\(\)\s]+\{\s*var\s*_0x\w{1,9}[\s=]+\[['"]srcdoc[^\]]+\][^>#\n]{99,4999},(\w{1,9})\[['"]\w{1,9}['"]\][\s=]+document[^#\$\n]{9999,}\4\[\3[^;\n]*;(?<X1256561>)|\s+(_[01]x[a-f\d]{1,39})\h*=\h*\[['"]\\[^\]]{9,}\];\h*var\h+(\w+)\h*=\h*(document)\[\6\[\d+\]\]\([^;]+;\7\[\6\[\d+\]\]\h*=\h*\6\[\d+\];\s*\8\[\6\[\d+\]\]\(\6\[\d+\]\)\[\d+\]\[\6\[\d+\]\]\(\7\)(?:\s*;)?(?<X1274680>)|\s+\w+=\[["']0\d{2,}["'],[^]]+\];function.+?String\.fromCharCode\(\w+\.slice\(\w+,[^\}]+\}return\s*(?:\(\w+\)|\w+);\s*\}(?:function \w+\(\w+\)\s*\{\s*return \w+\(\w+\(\w+\),["']\w+["']\);})?(?<X1043112>)|\s+\w{1,40}=\d+;\s*(\w{1,40})=\w{1,40};\s*(\w{1,40})=\w{1,40}\.split\(['"]o13['"]\)\s*,\s*\w{1,40}\h*=\h*(parseInt\()\12\[[^;]+;\s*var\s+(\w{1,40})\h*=\h*\[\];\s*for\h*\([^\}\{]{0,99}\{\s*\14\.push\(\12\[\d+\]\.substring\([^\^]{0,199}\13\14\[[^;\^]+\^[^;]+;\s*function\(\11\)\.call\(\);(?<X1195322>)|\s+\w{1,9}\s*=\s*\[(?:['"][^'"]{5,1500}['"]\s*,?){5,7}\];\s*\(\s*function\s*\((\w{1,20}),\w{1,20}\)\s*\{[^\}]{9,99}\{\s*\16\[['"]push['"]\]\(\16\[['"]shift['"]\]\(\)\);[^\.]{99,300}\{\}\.constructor\([^\.]{999,4000};\s*var\s+(\w{1,9})\s*=\s*document\[[^\}]{20,80}\(\w{1,9},\17\);\s*\}\s*\(\)\);(?<X1063621>)|_dump\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST),\s*\$_GET,\s*\$_COOKIE,\s*\$_FILES\);\s*\$output = ob_get_clean\(\); \$fp = fopen(?<X2044181>))|V(?:BV\s+INFORMATION[^\$;=]{1,299}\$_SESSION\[[^\]]+\]\s*=\s*\$_POST\[[^\]]+\];(?<X2132400>)|ersion(?:[^<]{1,99}author:\s*<(a)\h+href[=\h'"]+https?://www\.litespeedtech\.com[^<]{1,99}</\21>\s*\*/[^=\\]{1,999}['"]\w+\.php\?custom_slug=(?<X220331890>)|_compare\(PHP_VERSION,\s*['"]\d+\.\d+\.\d+['"][^@]{1,3999}implode\(['"]['"],\s+array_map\(['"]chr['"],\s+\$\w+\)\);\s*\}[^=]{1,49}\$\w+[\s=]+['"]\w{999,}['"];(?<X220366143>))|isitor_country\(\);\s*(\$(?:msg|message))\s*\.?=\s*['"][^'"]{1,40}['"]?(\\n['"]);\s*\24\s*\.?=\s*['"][^'"]{1,40}['"]\s*\.\s*\$_POST\[['"]email['"]\]\s*\.\s*['"]?\25;\s*\24\s*\.?=\s*['"][^'"]{1,40}['"]\s*\.\s*\$_POST\[['"]password['"]\]\.['"]?\25;(?<X2054721>)))
\b(?:w(?:ebadmin\.php</h1>(?<X2047190>)|get(?:\h+http://\d+\.\d+\.\d+\.\d+/hiddenbin/(\w+\.x86_64);\h+curl\h+\-O\h+http://\d+\.\d+\.\d+\.\d+/\w+/\2;cat\h+\2\h+>(\w+);chmod\h+\+x\h+\*;\./\3(?<X2323222>)|\s+https?://[^/]+/xmrig_lin64\s+-o\s+/tmp/(?<X2051390>))|hile(?:\!?\(?isset\((?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(?['"][^'"]*['"]|\((?:\6|\$\{[^\}]+\})\[[^\]]+\]\)=+['"][^'"]*['"])?[^@]{1,57}hex2bin(?:\(\$_[GPRSC]\w{2,6}|\(\$\{['"][^'"]*['"]\}|\(str\w+)(?:[^@]{1,180}|[^@]{1,600})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252295>)|\((?:1|True)\)\{(\$\w{1,40})=fsockopen\(['"][a-z]{1,3}://[^\}]{1,199}\bfwrite\(\8,(?<X2184880>)|\((?:true|1)\)\s*\{\s*if\(!(file_)exists\((\$\w{1,40})[\s\)]+\{\s*\10put_contents\h*\(\11,\$\w{1,40}\);\s*touch\(\11,strtotime\(['"]\-\d+\h+days['"],time[\h\(\)]+;\s*chmod\(\11,0444\b(?<X2171811>)|\((\$\w{1,40})(?:\b[^\}]{1,499}\bfile_put_contents\([^,]{0,199}\13\b[^,]{0,499}\.htaccess['"],[^=]{1,499}=base64_decode\(['"]PEZpbGVzTWF0Y2g(?<X2187051>)|\h*<\h*sizeof\((\$\w{1,40})(\[round\()[^\]]+\]\)\)\{(file_)put(_contents\()(\$\w{1,40}),\17get\18\15\16\d+[^\)]+\)\]\[\13\]\)\);\$\w{1,40}=fopen\(\19,(?<X2152170>))|\((\$\w{1,9})\h*=\h*\$\w{1,9}->accept\(\)\)\s*\{[^\}]{99,200}print\h*\21\h*['"]<[^\\]{1,150}INDOXPLOIT(?<X2138970>)|\((md5)\(\23\(\$_COOKIE\[['"]\w+['"]\]\)\)!=['"][^'"]{1,32}['"]\)\{exit\(\);\}(?<X120360770>)|\(?isset\((\$_[GPRSC]\w{2,6})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(['"][^'"]*['"]|\(\25\[[^\]]+\]\)=+['"][^'"]*['"])?(?:[^@]{1,57}|[^@]{1,200})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252790>)|\(\d+\)\{if\([^f]{1,99}rand\(1,65535\);\$\w{1,40}=fsockopen\(['"](?:udp|tcp)://['"][^'"]{1,499}['"][^'"]{4,40}\bFlood\b(?<X2131430>)|\(\w{1,9}<\d+[\)\s]+\{\s*(\w{1,9})\h*\+=\h*String\[['"]fromChar['"][\+\s]+\w+\]\(['"][^\}\n]{9,999}\}\s*\(\s*function\([^\+\)]+\+\s*\28\)\)\(\);(?<X1235620>)|\h*\(\h*(?:!feof\h*\(\h*(\$\w{1,40})[\s\)]+fwrite\h*\(\h*(\$\w{1,40})\h*,\h*fgetc\h*\(\h*\30[\h\)]+;\s*fclose\h*\(\h*\30\h*\)\h*;\s*fclose\h*\(\h*\31\h*\)\h*;\s*(?:return\h+(?:TRUE|FALSE)\h*;\s*\}\s*){2}function\h+random_str\h*\(\h*\$\w{1,40}\h*=\h*\d+\h*\)\s*\{(?<X2158730>)|(\$\w{1,15})[\h=]+[^\{]+\{\s*select\h*\33;[^\}]{1,99}\bprint\h*\$\w{1,15}\h*['"](?:hacked|Touched)\h*by\b(?<X1198121>)|\$\w{1,40}\h*=\h*mysql_fetch_array\h*\(\h*\$\w{1,40}[\)\s]+\{[^\}\->]+\$\w{1,40}\h*=\h*\$\w{1,40}\->decrypt\((\$\w{1,40})\[['"]cc_number_enc['"]\]\);\s*\$\w{1,40}\h*=\h*\35\[['"]exp['"]\](?<X2161430>)))|i(?:ndow(?:[\.\s]+location[=\s]+['"](?:https?:?)?//whyaboveweather\.top\b[^'"]+['"]\s*;(?<X1221200>)|\.(?:[^\\]{1,399}://secureportal777\.com['"]\)\.[^\\]{1,299};\}(?<X120361821>)|\w{1,40}\s*=\s*\{\s*['"][^'"]{1,40}['"]\s*:\s*\w{1,40}\s*,\s*['"]key['"]:[^`]{710,790}=\s*new\s+CoinHive(?:\.User)?\([^\)]{60,100}\);window(?:\[\w{1,40}\[\d+\]\]){3}\(\)\}(?<X1056222>)|a\d+\s*=\s*1\s*;\s*!function\(\s*\)\s*\{\s*var\s*(\w{1,3})\h*=\h*JSON\.parse[^\v]{2000,}['"]a\d+['"]\);\w=\w\?\w:\40\[0\],\w\(\w\)\};\w\(\)\}\(\);(?<X1043332>)|eval\(String\.fromCharCode\([^\)]+61,\d+,43,\d+,46,102,114,111,109,67,104,97,114,67,111,100,101[^\)]+\)\s*\)\s*;(?<X1058251>)|location(?:(?:\.href)?\h*=\h*['"]https?://[^/]{1,99}\bvoluumtrk\.com/[^'"]{0,99}['"];?(?<X1141821>)|\.href(?:=['"]https://u(?:\-)?short\.(?:today|info|net|dev|observer)/[^'"]+['"];(?<X120367104>)|\s*=\s*(?:(['"])https?://t\.me/(?:BlumCryptoBot|hamster_kombat_Bot)/[^'"]+\45(?<X1265600>)|['"]https?://(?:yourvibe1|iplogger|pepe\-meme|winmeme)\.com/[^'"]*['"](?:\s*;)?(?<X1202933>))))|miner\.stop\s*==\s*['"]function['"]\)\s*window\.miner\.stop\(\);(?<X2052890>)|onload[=\h]+function\s*\(\s*\)\s*\{(?:[^=\{\}]{0,499}\bvar\h*(\w{1,40})[=\h]+(document\.)createElement[\('"\s]+script['"\)\s;]+\49\.src[=\s]+['"]https?://cdn\.ethers\.io\b[^\}\[]{1,499}\bconst\s*\w{1,40}[=\h]+['"]0xdf20921[^'"]+20353f72d6['"];[^<]{99,}\b\50head\.appendChild[\(\h]+\49[\);\s]*\}(?<X1264051>)|\s*\w+\s*\w+\s=\s*(atob)\(['"]aHR0cHM6Ly9jZG4uZXRoZXJzLmlvL[^\)]{1,99}\);\s*\w+\s*(\w+)\s*=\s*\w+\.createelement[^\}]{1,256}\52\(['"]YXN5bm[^\)]{1,9999}\);[^\}]+\};\s*\53\.[^\}]{1,256}\};\s*[^;]+\53\);\s*\};(?<X1265541>))|open\(dwn\)['"]>[^<]{5,9}</a>['"]\);\s*</script>[^\{]{99,500}<div\h*id=['"]post_thanks_box_\d{1,7}['"]>[^\{]{99,400}\bclass=['"]alt1['"]>(?:<a\h*href=[^\(]{9,150}\(\d{1,2}\.\d{1,2}\.\d{4}\),\h*){3}(?<X2148573>)|park\s*=\s*['"]eyJ1dWlkI[^'"]{99,499}(?:Ly93dzI1|L3d3MjU|d3cyNQ)[^'"]{99,}['"]\s*;(?<X1286250>)|stop\(\);var\s*(\w{1,9})=['"]https?://\w+\.piterreceiver\.ga/fast\.php\?\w+=[^;]+;document\.location\.href=\57;window\.location\.href=\57\s*;(?<X1231040>))|\[['"](?:\w{8,99}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\59[^\]]{1,599}cdndomain['"]:['"]\w+\.\w+['"]\};!\w+\(\)\{\w+\s+(\w+)=\s*\{\d+:\w+\(\60,(\w+)[^\n]{1,9999}\w=\w+\(\60,\61\)\{[^\n]{9999,49999}=\61,\60[^\n]+window\.\w+=new\s*\w+[\)\}\(]+;(?<X1317241>)|\w{8,}['"\]=\{]+adserverDomain['"]:['"]\w+\.\w+[^\.]+(\w\d\.php)[^\}]+\63[^\]]{1,599}cdndomain['"]:['"]\w+\.\w+['"]\};!\w+\(\)\{\w+\s+(\w+)=\s*\{\d+:\w+\(\64,(\w+)[^\n]{1,9999}\w=\w+\(\64,\65\)\{[^\n]{9999,49999}=\65,\64[^\n]+window\.(\w+)=new\s*\w+[\)\}\(;\s</]+[^\}]+\66\.\w+\(\{\w+:['"]\w+['"][^\{]+\{\w+\.log[^;]+;\}{2}\)\(\);(?<X1315390>)))|thout\h+http[\s\*/]+\bdefine[\(\s]+['"]PATH_TO_BACK_SHELL['"][,\s]+['"](?:[^'"\$]+['"][\)\s]+;(?<X2247711>)|[^'"\$]{1,499}['"][\)\s]+;(?<X220326563>)))|ordPress\s+is\s+readed\b(?<X2193291>)|p_(?:add_inline_script[\s\(]+['"][\w\-]+['"][\s,]+base64_decode[\s\(]+['"]ICAgIChmdW5jdGlvbigpIHsKI[^"']{9,499}(?:ICBSX1BBVEg|Ul9QQVRI|X1BBVEg)[^'"]+aW5zZXJ0QmVmb3JlK[^'"]+['"][\s\)]+;(?<X1220470>)|remote_(?:post[\h\(]+['"]https?://panel\d+\.com/[^\[]{0,20}\[[^\]]{0,300}['"]action['"][\h=>]+['"]add_shell['"],[^\]]{0,200}['"]shell_type['"]\h*=>\h*['"](?<X220363330>)|request\(['"]https?://[^'"]+\.dev/[^%]{1,999}file_get_contents\(['"]php://input['"]\)[^%]{1,999}(?:(\$\w+)\[\]=['"](?:passthru|system|shell_exec|exec)['"];){2}\}foreach\(\73[^%]{1,999}(\$\w+)=\[\];exec\(\$cmd,\74,\$\w+\);\74=implode\(PHP_EOL,\74\);return\74(?<X220370611>)))|rite_log\s*\(['"]confspy\.log['"],[^\)]+\);\s*open\(\w{1,20}\s*,\s*['"]/etc/passwd['"]\)(?<X2123440>))|x(?:@xmr\.crypto-pool\.fr:80/xmr(?<X2048330>)|OR\s+fallback\s*\$\w+[\s=]+substr\(md5\(['"][\w\-]+['"]\s*.\s*DB_NAME\),\s*\d+,\sd*\d+\);[^\}]{1,999}\w+\((\$\w+),\s*['"]<\?php['"]\)\s*===\s*0\)\s*return\s*\78;(?<X220365940>)|ploitSec\s*Tools</title>(?<X2170782>))|YeMeNi\s*HaCkeR(?:>|&gt;){2}(?<X2050281>))
\{(?:(?:\s*\$\w{1,40}\s*=\s*['"](?:\.\./){1,7}['"];){7}\s*\$\w{1,40}\s*=\s*file_get_contents\s*\(\$\w{1,40}\s*\.\s*['"]wp-config\.php['"]\);(?<X2053561>)|(?:case\b[^:;]{1,49}:\s*(?:echo\s*)?(\w{1,40})\(['"]https?://[^/;'"]{0,99}\bpaste[^/\s;]{1,49}/(?:raw|download)\b[^,;\)]{1,99},['"][^'";\s]{1,99}\.php\d?['"]\);break;){3}[^@#%&\*!><]{99,1999}\bfunction\h+\2\((\$\w{1,40}),[^\}\?]{1,499}\bf(?:write|ile_put_contents)\([^;\),]{1,99},[^\);]{0,99}\3\b(?<X2182620>)|(\$\w+)=(?:\w+\(\$_[GPCSR]\w{2,6}\[[^,]+,\$\w+\);(\$\w+)=explode\(['"]\W+['"],\5\);(?:(\$\w+)=\6\[\d+\];)+(\$\w+)=curl_init\(\7\);[^\}=]{1,499}\$(\w+)=curl_exec\(\8\);[^\}\?]{1,499}\bfile_put_contents\([^,]+,\$\9\);(?<X2205422>)|Array\([^;]*(?:['"]\w+['"]|\.chr\([^\)]+\))+=>phpversion\(\),[^;]+;echo\s*serialize\(\5\);[^#%]{1,299};[ir](?:nclud|equir)e(?:_once)?\s*\(?(\$\w+)\)?;\$\w+\(\11\);\}+(?:exit|die)\b[^;]{0,19};\}+(?:\?>\s*)?(?<X2202711>))|(\$\w{1,40})=(?:&new\h*COM\(['"]Shell\.Application['"]\);\$\w{1,40}=\13\->ShellExecute\(\$_[GPCSR]\w{2,6}\[[^\]]+\],\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?<X2180520>)|base64_decode\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};eval\(\13\);(?:exit|die)[^;]{0,19};\}[^\?]{1,499}\bif\(preg_match\(['"][^'"]+\bgoogle\b[^,\)]+,\$_SERVER\[[^\]]+\]\)+\{[^\}]{0,499}\b(?:add_filter\(['"]wp_\w+['"],['"](\w+)['"]\);){3}\}function\h+\15\((?<X2180861>))|(file_put_contents\([^,]{1,99},\$\w{1,40})[,\)][^;]{0,99};\}+(?:else\{\17[,\)][^;]{0,99};\}+){2}(?:(?:if\(\$\w{1,40}\)\{?)?header\(['"]\w{1,40}:\h*(?:ok|[\d\.]+)['"]\);\}?){3}[^\}]{1,99}\}+\s*(?:\?>\s*)?\Z(?<X2182990>)|(if\(function_exists\()['"][pes](?:assthru|ystem|xec|hell_exec|open)['"]\)[^\{;]{0,99}\{[^\}]{0,199}(\$\w+(?:\[[^\]]+\])?\[)\d+(\]\(\$\w+)\b(?:[^\}]*\}else\s*\19['"][pes](?:assthru|ystem|xec|hell_exec|open)['"]\)[^\{;]{0,99}\{[^\}]{0,199}\20\d+\21\b){3}(?<X2205771>)|(php)\}\s*(\$ino)\h*=\h*['"]PGRpdiBjbGFzcz0iaW5mby1hYSI[^'"]{9,99}['"];\s*echo\h*base64_decode\(\24\);\s*\{/\23\}(?<X1156500>)|\$(?:(\w+)=(?:\$?\w+\()*\$_[GPCSR]\w{2,6}\[[^;]+;(?:\$\w+=)?[peas](?:assthru|ystem|xec|hell_exec)\(\$\26\b[^\?]{1,499}\$(\w+)=['"]https?://[^;]+/raw/[^\}\?]{1,199}\$(\w+)[=,](?:curl_init\(\$\27|CURLOPT_URL,\$\27)\)[^\}\?]{1,199}\$(\w+)=curl_exec\(\$\28\)[^\?:/#%]{0,199}\bf(?:ile_put_contents|puts|write)\([^,\)]+,\$\29\);(?<X2202880>)|\w+=\w+\(['"]position:\w+;left:\-\d+px;top:\-\d+px;[^\.]{1,999}\$\w+=['"]wp\-['"]\.substr\((?<X220332950>)|\w{1,14}=array\(['"][^,]{1,30},['"]ppa\.bew\.at["',]+ad\-oyhp[^@]{1,512}rev\(['"]atad_atem_teg_maerts(?<X2291852>)|_SESSION\[\$\w+\]=\d;mail\(base64_decode\(['"]c3ltY29uZm1haWxAZ21haWwuY29t['"]\),base64_decode\(['"]U1NFQ0NB['"]\),(?<X220334370>)|htaccess=['"]Options[^'";]{9,99}['"];\s*\$lsdshell=gzinflate\(\$GLOBALS\[(?<X2173951>)|msg=['"]File\s*Manager\s*Kominfo<br>Error:\s*Cannot\s*load\s*configuration(?<X220333010>))|\h*(?:(\$\w{1,40})\h*=\h*file_get_contents\([^;]{1,49};\h*if\h*\([^\{]{1,99}\{\h*\36\h*=\h*(\w{1,40})\h*\([^\}]{1,99}\}\h*(?:\36\h*=\h*str_replace\h*\(\h*["'](?:<\?php|\?>)['"]\h*,\h*['"]{2}\h*,\h*\36\h*\);\h*){2,3}(?:eval|assert)\h*\(\h*\36\h*\);\h*\}\h*function\h+\37\h*\([^\v\?]{99,999}(?:\?>)?\s*\Z(?<X2151831>)|echo\h*L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDAzIGlua[^\|]+RmcycgMj4vZGV2L251bGwpCg==\s*\|\s*bash;\s*\}\s*2\h*>\h*/dev/null(?<X120361760>))|\s*(?:(?:(\$\w{1,20})\h*=\h*['"][\d\.]+_Stub_Linux_(?:x|amd)(?:86|64)['"];\s*){2}\}[^\{]{99,999}\{\s*chmod\((([^\)]+\.)\$\w{1,20}),\h*0777\);\s*(?:\$\w{1,20}\h*=\h*)?exec\(\41[^/]{0,99}\bunlink\(\42\40\);(?<X2148661>)|(?:echo|print)\s*\(?['"]?eval\(magicboom\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\}\s*else\s*(?:echo|print)\s*\(?['"]?(?:echo|print)\s*\(?['"]?file_get_contents\(['"]/etc/passwd['"]\)(?<X2123322>)|(?:setcookie\s*\(['"](?:EBI|Easy)_(?:FileMan|Bot_Installer)['"]\s*,[^;]{1,99}\);\s*){1,2}\$\w{1,20}\s*=\s*['"]\w{1,20}\.php['"];(?<X2126611>)|(\$\w{1,20})\h*=\h*\w{1,20}\h*\([^\)]+\);\s*(?:if\h*\(preg_match\h*\(['"]/(?:TEMPBAN|S(?:HOW|AVE)DOOR)/i['"]\h*,\h*\46\)\)\s*\{[^\}]+\}\s*){2}(?<X2183201>)|(\$\w{1,40})\s*=\s*['"]base64_decode['"];\s*(\$\w{1,40})\s*=\s*\48\s*\(\s*@?\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\);\s*\$\w{1,40}\s*=\s*unserialize\s*\(\s*\48\s*\(\s*['"][^;]{1,1999};(?:\s*\$\w{1,40}\s*=\s*(?:md5|sha1|hash)\s*\([^\)]+\49\s*\);){2}(?<X2186183>)|(\$xsec)shell\s*=\s*(\$_FILES\[[^\]]+\])\[[^\]]+\];\s*\51team\s*=\s*\52\[['"]tmp_name['"]\];(?<X2130110>)|\$(?:\w{1,4}\s*=\s*\$\w{1,4}\[\d+\]\s*;\s*\$\w{1,4}\s*=\s*['"]moban['"]\s*;\s*\}\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\)\s*\{\s*(\$\w+)\s*=\s*\$_SERVER[^\?]{9,199}\bget\s*\(\s*\$\w+\s*,\s*\54\s*\);(?<X2058001>)|_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*=\s*md5\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*\)\s*;\s*\}\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*setcookie\s*\(\s*\$\w{1,40}\s*,\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*,\s*time\s*\(\s*\)\s*\+\s*3600\s*\)\s*;(?<X2046431>))|\w{100,300}\|base64\h*\-\w\|bash;\s*\}\h*\d\h*>\h*/dev/null\h*#\w+\h*>\h*/dev/random\b(?<X120356070>)|AtVTEwOTIgaWRfcnNhIDI[^'"]+\|base64\s*\-d\|bash;\}\s*2>/dev/null(?<X120363530>)|die\s*\(\w{1,20}\s*\(['"]\?\w{1,15}\s*=\s*sqlshell['"],(?<X2129680>)|echo(?:\s*L3Vzci9iaW4vcGtpbGwgLTAgLVUxMDAzIGRlZnVuY3QgMj4v[^\|]+cvaHRvcC9kZWZ1bmN0JyAyPi9kZXYvbnVsbCkK\h*\|\h*base64\h*\-\w+\|bash;\s*\}\s*2>/dev/null(?<X120361770>)|\s+@?eval\s*\(base64_decode\s*\(['"](?:ZGllKGluY2x1ZGVfb25j|ZXhpdChpbmNsdWRlX29uYw)[^;]{1,40};\s*\}\s*(\$\w{1,20})\s*=\s*\$_[^\{]{9,50}\{\s*echo\s+@?eval\s*\(urldecode\s*\(\61(?<X2127141>)))|\sgLTAgLVUxMzcwIG[^\n\s\|\{\}]+\|base64\s*\-d\|bash[;\s]+\}\s*2>/dev/null\b(?<X1269260>)|\s{1,4}echo\s+L(?:3Vzci9iaW4vc|2Jpbi9wa2ls)[^\n\s\|\{\}]+\|base64\s*\-d\|bash[;\s]+\}\s*2>/dev/null\b(?<X1268971>)|\{(var\h*this\.getTemplateFilter\(\)\.)filter\(\w+\)\}+\{+\65addAfterFilterCallback\(shell_exec\)[^/]{0,50}//(?:\w+\.)?citytoohot\.fr/css/[^'"]{0,50}\.php['"]\)\}\}(?<X120346270>)|eval\(base64_decode\(\$_[GPCSR]\w{2,6}\[[^\?=]{1,99}\$(\w{1,40})=[^;]{1,99}/wp\-config\.php['"];\$\w{1,40}=(file_)ge(t_contents(\(\$\67))\);[^\}]{1,499}\b\68pu\69,[^\}]{1,499}\btouch\70,[^@]{1,4999}=array\((?:['"][\d\.]+['"],){19}(?<X2186870>)|if\(\$o\)\$o\.=';\s*';\$o\.=\$n\.'='\.addslashes\(\$v\);}\$h\.='Cookie:(?<X2048190>)|private static\$_[^;]{1,30};static function _[^(]{1,30}\(\$[^)]{1,30}\)\{if\(!self::\$_(?<X2050110>)|return\(base64_decode\(['"]dGVtcG5hbQ['"](?<X220337350>)|unlink\(\$\w+[^\.]{32,299}<title>asplat\s+shell</title>(?<X220340450>))
\|\s*md5\s*\(\s*\$_GET\[['"]?[^'"]{1,10}['"]?\]\s*\)\s*[^\w]{1,2}=\s*['"]\w{24,40}['"]\s*\)\s*die\s*;\s*function\s+execute\(\s*\$\w{1,40}\s*\)\s*\{[^\?]{100,300}\s*(\$\w{1,40})\s*=\s*@?shell_exec\(\$\w\);\s*return\s*\1;\s*\}\s*elseif(?<X2054182>)
\}(?:(\$\w{1,40})=['"]PD9[^'"]{999,}['"];(\$\w{1,40})=\w{1,40}::\w{1,40}\(\1\);[^\}=;@#%:\?]{1,99}\b(?:includ|requir)e(?:_once)?\h*\(?\2\->[^;\}]{1,99};[^\?\}]{0,199}\}{0,3}(?:\?>\s*)?\Z(?<X2184151>)|(function)\h+\w{1,40}(\(\$\w{1,40})\)\{(?:\$\w{1,40}=[^;]{0,99};)?(?:if\(\4_exists\(['"]([pes](?:assthru|ystem|xec|hell_exec|open))['"]\)\)\{[^\}]{0,99}\b\6\5\b[^\}]{2,99}\}(?:else)?){4}[^@]{99,4999}\bunlink\(\$_[GPCSR]\w{2,6}\[(?<X2182390>)|(function\h+)\w{1,40}\([^\{]{1,99}\{(\$\w{1,40})=[^;]{0,40}<\?[^;]{1,40};(?:\$\w{1,40}=)?eval\(\9\);[^\?]{0,99}\}\8\w{1,40}\((\$\w{1,40})\)\{[^%#@\*\+:/\\\|\?]{1,399}(?:[pes](?:assthru|(?:cntl|hell)_exec|xec)\(\10\b[^\)]{0,19}\);[^%#@\*\+:/\\\|!@&\+><\?]{1,99}){2}(?<X2182250>)|;@?eval\(\$[O0]{4,24}\(['"]QHNldF90aW1lX2xpbWl0KDM2MDApOw0KQGlnbm9yZV91c2VyX2Fib3(?<X2056090>)|@error_reporting\(00?\);@ini_set\([^;]{1,99};@set_time_limit\(00?\);@ignore_user_abort\(true\);\$\w+\s*=\s*['"]/[^;]+\.php['"];\$\w+\s*=\s*['"]PD9[^'"]+['"];[^#]{1,99}tmp/\.\w(?<X220340700>)|[ir](?:equir|nclud)e(?:_once)?[\s\(]+['"][^'"]+\.php\d*['"];(\$\w+)=urldecode\(\$\w+\);(\$\w+)=new\h+\w{1,40}\([^;]{1,99};(\$\w+)=\15\->\w+\(\14\);(?:eval|assert)\(\16\);(?:\?>)?\Z(?<X2193401>)|\);\s*function\s+refreshBotsOnline\(\)\{\s*\$\(\\['"]#nav\\['"]\)\.load\(\\['"]inc/\w{1,40}\.php\\['"]\);\s*setTimeout\(refreshBotsOnline,\s*\d+\);\s*\}\s*</script>(?<X2056441>)|\s*(?:(?:(\$\w{1,20})\h*=\h*fopen\h*\(['"]https?://[^'"]{9,99}\.txt['"],[^\)]+\);[^\{]{9,99}\bif\h*\([^\)]+\)\s*\{\s*\19\h*=\h*(?:file|url)_get(_contents)\h*\(['"]https?://[^\)]+\.txt['"]\);\s*\}\s*){2,4}(\$\w{1,30})\h*=[^/]{9,150}\bfile_put\20\h*\(\21\.['"]/wp\-(?:admin|includes)/(?<X2185310>)|(?:\$\w{1,20}\h*=\h*count_c\(['"][^'"]{1,20}\btotal_(?:click|login|[cv]{2,3}|vbv|bank|bot|upload|email|log)\.txt['"]\);\s*){5}(?<X2152010>)|\$\w{1,9}\s*=\s*(\$_(?:G|P|S|R|C)\w{2,4})\[['"]cc['"]\];\s*\$\w{1,9}\s*=\s*\24\[[^\?]{99,300}\$FromName\s*=\s*\24\[['"]otkogo_name['"]\];[^\?]{99,350}(\$mail)\s*=\s*new\s+PHPMailer\(\);[^\?]{999,3000}\$message\.\s*=[^\(]{9,60}\s*if\s*\(\s*!\25->Send\(\)\)\s*die\s*\([^\)]+\);\s*echo\s*['"][^'"]+['"];(?<X2064811>)|\)\s*;\s*\}\s*\}\s*function\s+visitor_country\(\)\{\$\{['"][GOBALS\\x471532cf]{9,28}['"](?<X2052511>)|\}\s*\}\s*(?:\$\w{1,40}\s*=\s*new\s*(?:WebShell|backdoor)\(\);\s*(?:\?>)?\s*\Z(?<X2057181>)|if\(\$_POST\[['"](\w)['"]\]\)\{\s*\$\w\s*=\s*\$_POST\[['"]\29['"]\];\s*\$\w{1,4}\s*=\s*md5\(sha1\(\$\29\)\);\s*if\s*\(\$\w{1,4}\s*==\s*['"]\w{30,34}['"]\s*\)\{ \$_SESSION\[['"]\w{1,4}['"]\]\s*=\s*1;\s*\}\}\s*\?>\s*<form(?<X2052650>))|Class\h+Joomla_brute_force\s*\{\s*public\h+Function\b(?<X2153750>)|else(?:\s*(?:\{\s*(?:\$v\s*=\s*new\s+verifier\(\);\s*print_r\(\$v->checkemails(?<X2050560>)|if\s*\(\$_POST\[['"]?[^'"]{1,40}['"]?\]\)\s*\{\s*@?eval\(\$_POST\[['"][^'"]{1,40}['"]\]\);\s*\}\s*\}\s*\}\s*\}\s*add_filter\(\s*['"]init['"],\s*['"]wp_is_plugin_load['"]\);\s*\}\s*add_action\(\s*['"]init['"],\s*array\(\s*['"]Akismet['"],(?<X2053521>))|if\s*\(\s*\$\w{1,40}\s*==\s*"php"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*\}\s*else\s*if\s*\(\s*\$\w{1,40}\s*==\s*"aspx"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;(?<X2046510>))|if\s*\(\s*function_exists\(['"]shell_exec['"]\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@?shell_exec\(\$cmd\);\s*return\s*\$\w{1,40};\s*\}\s*\}\s*function\s+perms\(\$\w{1,40}\)\s*\{(?<X2055871>))|function(?:\h+(lock)\h*\([^\)]+\)\s*\{[^\.]{0,40}\$(\36\d+)\h*=\h*[^;]{1,20}\37\.php['"];\s*(\$\w{1,20})\h*=\h*base64_decode\h*\(['"][^'"]{999,5000}['"]\);\s*\38\h*=\h*['"]<\?php\h+unlink\(['"]\$\37['"][^@]{99,300}@?file_put_contents\h*\(\$\37\h*,\h*\38\);(?<X2184470>)|\s*comshelL\(\s*(\$\w{1,40})\s*,\s*(\$\w{1,40})\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\41->exec\s*\(\s*"cmd\.exe\s+/?\w?\s*\40"\);\s*(\$\w{1,40})\s*=\s*\42->StdOut\(\);\s*return\s*\43->ReadAll\(\);\s*\}\s*function(?<X2056281>))|if\s*\(\s*function_exists\(\s*['"]add_filter['"]\s*\)\s*\)\s*add_filter\(\s*['"]all_plugins['"]\s*,\s*['"]fourofour_pp['"]\);\s*return\s*1;\s*\?>\s*\Z(?<X2055590>)|list\(\$\w{1,40},\$\w{1,40}\)=\w{1,40}::\w{1,40}\("\\r\\n\\r\\n",\$\w{1,40},\((?<X2049410>))|\}(?:@error_reporting\(00?\);@ini_set\((\w+)::(\w+)\(['"][^\)]{1,99}\),\47::\48\(['"]\w+[^;]{1,99};@set_time_limit\(00?\);@\w+\(\w+\);\$\w+=['"]phar://[^'"]+\.php/\w{16,}\.\w{4,}['"](?<X220335041>)|else\{\$\w+=@\$_SERVER\[(?:(?:""|chr\(\d+\)|"\w")\.?){9}[^\]]+\];(?<X2045413>))|break;(?:\bcase\h+['"](?:Oracle|Postgresql|M[sy]sql)['"]:[^\?#@%&:/\\\|\+!,\.]{1,299}){4}[^@#%\\\|]{4999,9999}=(?:[peas](?:assthru|ystem|xec|hell_exec|open)\([^\?#@%&\*\+:/,\\\|\.]{1,99}\b){4}(?<X2180681>)|CurlProxy::run\(\);?\s*(?:\?>\s*)?\Z(?<X2184141>)|define\(['"]CURRENTDIR['"],getcwd\(\)\);define\(['"]GS_ALIAS['"],['"]https?://tableinhouse\.com['"]\);[^\]]{1,999}=>['"]CASINO\b(?<X2326090>)|elseif\(\$_[GPCSR]\w{2,6}\[[^\]]+\]===?['"]\w{1,40}['"]\)\{unlink\(__FILE__\);\}else\{(\$\w{1,40})=scandir\([^\}]{1,999}\bforeach\(\54\h*as\h*(\$\w{1,40})\)\{[^\}]{1,999}\(is_writable\([^\)]+\55\b(?<X2181061>)|function\s+cek(?:root|file|dir)\(\)\{[^\?\\]{99,4999}\becho\s*['"]\W{0,5}Web\s*Server\s*:(?:[^\?\}\{]{1,199}>\s*['"]\.(?:php_uname|phpversion|get_current_user|getmyuid)\(\)\.['"]\s*<){3}(?<X2221090>)|goto\s*\w+;\w+:\s*echo\s*['"]<!DOCTYPE[^}]{1,999}vivid\s+workspace\s+manager</title>(?<X220332190>)|return\s*\$\w{1,40};\}(\$\w{1,40})=['"](?:\\x?\w{2,3})+['"];(\$\w{1,40})=['"](?:\\x?\w{2,3})+['"];\$\w{1,40}=\w{1,40}\(\w{1,40}\(\60\(__FILE__,false,null,__COMPILER_HALT_OFFSET__\),['"]\w{1,40}['"]\)\);\59(?<X2052490>))
](?:\}\)==\d+\s*\)\s*echo\s*@serialize\(\$\{\$(?<X2048580>)|}(?:=(?:Array\("\w+"=>@phpversion\(\),"\\x\d+\\x\d+"=>"\\x\d+\.\\x\d+-1",\);echo\s*@serialize\(\${\$\w+\}\);}elseif\(\${\${(?<X2045670>)|trim\(\s*array_pop\(\${\${"(?<X2043791>))|\)\);}echo\${\$\w+};exit\(\);function get_ip\(\){\${\${".+uniqid\(\)\.uniqid\(\);\${\${(?<X2047450>)))
^(?:@?eval\(\$_POST\[['"]\$config['"]\]\);$(?<X1163462>)|@eval\(\$_[GPRC]\w{2,6}\[['"]?\w['"]?\]\);(?<X1174390>)|[\*\h/\d]{5,12}/home\d?/[^\h>&]{2,99}/wp-content/(?:jmagick|oembed|ruleset)_64\h*(?:\(deleted\)\h*)?>\h*/dev/null\h*2>&1(?<X1153255>)|[\*\h/\d]{5,15}wget\h+(https?://[^\-]{9,60}/\w{1,20}\.txt)\h+\-O\h+(/(?:home|plaan)/[^\s>]{9,99}/[\w\-_\.]{1,40}\.php)\h*>\h*(/dev/null);\s*fetch\h+\-o\h+\5\h+\4\h*>\h*\6[^<:,'"%\$\*]{99,600}\5\h*>\h*\6(?<X1153234>)|[\*\h/\d]{5,20}(?:(?:/(?:usr/)?bin/)?\bwget\b[^:]{0,40}\bhttps?://(?:hello|dolly)[\w\d]*\.[^/]{1,20}\.(?:com?|xyz)/(xxxd)\b[^\n]{1,199}/bin/sh\h+\8\b[^\n]{1,99}\brm\h+\-f\h+\8$(?<X1193351>)|(?:/usr/bin/)?\bwget\b[^:]{0,40}\h+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\h+\-O\h+[^>$]{1,60}/[\.\w\-]{1,20}\h*(?:>\h*/dev/null\h+2>&1\h*)?$(?<X1153275>)|(\w{1,9})[=\h]+['"]/home\d*/[^/]+/[\w\.]+/[^'"]+\.php['"]\s*;\s*if\s+\[\s+!\s+\-s\s+(['"]\$\11)['"]\s+\]\s*;\s*then\s+echo\s+['"][a-z\d/\+]+=?=?['"]\s*\|\s*base64\s+\-\-decode\s*>+\s*\12['"]\s*;\s*fi\s*;\s*chmod\s+\d{3,}\s+\12['"]*(?<X1230423>)|/(?:home(?:\d*/[^/]+/[^\-\n]+\-content/(?:themes|plugins)[^>]{1,99}config_ads\h*>\s*/dev/null\h*2>\&1(?<X1242321>)|\d?/[^\h>&]{9,99}/wp-content/plugins/apikey/\w{1,9}\h*>\h*/dev/null\h*2>&1(?<X1153312>))|usr/(?:(?:local/)?bin/php\s*\-r\s*['"]eval\(gzinflate\(base64_decode\(['"][^'"]{200,800}['"][\)\s]+;['"]$(?<X1210590>)|local/lsws/lsphp[78]\d/bin/php\s+/home/[^/]+/[^\v$]{9,199}/wp\-includes/(?:css\d*|ima?ge?s?|blocks?|maint?)/[\w\-\.]+\.php$(?<X1224970>))|var/tmp/[a-z]{2,12}\h*>\h*/dev/null\h+2>&1(?<X1154711>))|cd\h+((?:/var)?/tmp/?)(\h*&&\h*)\19?(chmod)\h+[57]{3}\h+(\w{1,9}\.php)\20(?:/usr/bin/)?php\h+\19?\22\20\21\h+[0]{3,4}\h+\19?\22[^\v]+/dev/null\h+2>&1\Z(?<X1154741>)|echo(?:\h+['"]PD9[^'"\$=\|]{1,999}(?:KSkgJiYgQGV2YWwoJF9|KSAmJiBAZXZhbCgk|ICYmIEBldmFsKCR)[^'"|\$]+['"]\h*\|\h+base64\h*\W\Wdecode\h*>\h*/home\d*/[^/]+/[\w\.\-]+/\S{1,16}\.php(?<X1240021>)|\s*['"]PD[^'"]{0,19}(?:NsYXN|Y2xhc|bGFzc)[^'"]{9,299}(?:YXJyYXk|cnJhe|cmF5)[^'"]{9,299}(?:JF9DT09LSUU|X0NPT0tJRQ|Q09PS0lF)[^'"]{1,99}(?:Y291bnQ|b3VudA|dW50)[^'"]{9,399}['"]\s*\|\s*base64\s+\-\-decode\s*>+\s*/home\d*/[^/]+/public_html/[^\v]{1,199}?\.php\b(?<X1210770>))|perl\h+/var/tmp/[a-z]{2,12}\h*>\h*/dev/null\h+2>&1(?<X1153283>))|\$(\w+)[\h=]+['"][^\$=\n]+;\$\w+[\h=]+&\$+\27;[^\n]{1,999}\$\w+[\h=]+\$\w+[\h\(]+\$\w+[\h\)]+;\h*(\$\w+)[\h=]+\$\w+[\h\(]+['"]{2}[,\h]+\$\w+[\h\)]+;\h*if\h*\([^;\)]+\)\h*\28\(\);$(?<X1215570>)|\(function\h*\(\h*\w{1,9}\h*,\h*(\w{1,9})\h*\)\s*\{\s*if\h*\(\h*\W(?:[^\{\};\v]{0,49}\b(?:android|meego)){2}[^\v]{999,2499}\.location\h*=\h*\30\h*;\h*\}\h*\)\h*\([^,\)\v;='"]{1,199},\h*['"]https?://super\W?tds\.[^'"/]{1,49}/go\.php\?[^'"]{1,99}['"]\h*\)\h*;\h*$(?<X1179883>)|\*/\d{1,2}[\*\h]{5,20}\bcurl\h+\-so\h+(\S{1,40})\h+https?://[^/]{9,40}\.(?:xyz|top)/\S{4,40}\h+&&\h+/bin/sh\h+\32[^\n&]{1,99}&&\h+rm\h+\-f\h+\32(?<X1205830>)|\w{1,40}\s*<\?php\s*echo\s*php_uname\(\);\s*if\s*\(isset\(\$_POST\['\w+'\]\)\)\s*{(?<X2048870>)|A[dp][dp]Type\h+application/x\-httpd\-php[5678]?\d?\s+\.(?:root|jpe?g|png|ico)\b(?<X1226424>)|if\h*\(count\h*\(\h*(\$_[GPCSR]\w{2,6})\h*\)[^\?\v]{1,999}\$(\w{1,40})\h*=\h*\d;[^\v\?\(\{]{1,199}\bif\h*\(\h*\$\37\b[^\{]{1,99}\{\h*unset\h*\(\h*\36\[[^\}\v]{1,499}\binclude\h*\(?\h*['"][^'"]+\.php['"]\h*\)?;\h*(?:exit|die)\b[^;]{0,9};[\}\h]+;\h*(?:\?>|\Z)(?<X1180950>))
_(?:_(?:create_initial_settings[^#]+#google.+?__obfuscate_write(?<X2045620>)|DIR__\.['"]/\.wp_['"]\.substr\(md5\(uniqid\(\)\),0,8\)\.['"]\.tmp['"];\$\w+=@file_put_contents\(\$\w+,['"]<\?php\s*['"]\.\$_POST(?<X220365304>))|BLANK\s*>\{\$_FILES\["userfile"\]\["name"\]\}</a><br><br>"\s*;\s*echo\s*getcwd\(\)(?<X2049890>)|d(?:oEvil\h*\([^\)]+\)\s*\{[^\}]{1,999}\$r(?:oot|eal)ShellUrl\h*=(?<X2168551>)|uis_is_wp\s*</WORDPRESS>\s*[^'"]{1,40}['"]\s*;\s*echo\s*\(?\s*['"]\s*<EVAL_ENABLED>\s*\$_duis_eval_enabled(?<X2126870>))|POST\[\(chr\(\d+\).chr\(\d+\)\)(?<X2043711>))
A(?:CCOUNT\s+PAYPAL\s+FULLZ</font(?<X2048970>)|dd(?:Handler\s*cgi-script\s*\.shell[^?]{99,399}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);(?<X2122461>)|Type\s+application/x-httpd-cgi\s+\.alfa(?<X2058330>)))
By[ ]+th[3e][ ]+Err[0o]r[^\$]{9,99}\$auth_pass(?<X2130750>)
C(?:GI\-Telnet\s*\-\s*S[e3]c[7t][o0]r\W{1,9}\s*(?:</\w{1,40}>\s*){1,2}['"];(?<X2122571>)|o(?:ded(?:\s*by\s*:\s*</font><font\s*color="red">\s*TrenggalekTeam(?<X2048980>)|\s+By\s+<font color="red">Little\s+Wei(?<X2048780>))|ffeeCup Web Form Builder\s*-->\s*<title>Yahoo\s+Update</title>(?<X2052060>)|m(?:ic\s*Sans\s*MS['"]>[^\$]{1,99}if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\)\s*\{\s*if\s*\(\s*@(?:copy|move_uploaded_file)\s*\(\s*\$_FILES\s*\[(?<X2127250>)|munity\s*priv8\s*WebShell(?<X2049920>))|nfigs\s+Grabber\s+By\s+AnonCoders\s+Team(?<X2046600>)))
D(?:ir(?:Contents\(\$rest\);\}else\{getDirContents(?<X2051591>)|ECTORY_SEPARATOR\s*\.\s*\$[A-Za-z0-9]+;\s*if\s*\(@\$GLOBALS\['[a-z0-9]+'\]\(\$[A-Za-z0-9]+(?<X2043681>))|onSkippo[^<]{0,20}</[^\(\{\);]{9,99};\s*if\h*\(\h*!?empty\h*\(\$(?:email|username|uname|user|login)\)\W{2,4}!?empty\h*\(\$(?:password|pass|pwd|psw)\)(?<X2165410>)|r(?:\.\s*Nova\s+Login\s+To\s+Shell</title>(?<X2048990>)|mNurHxXATBjbLkSGpOQnIzco(?<X2053160>)))
e(?:cho\s*file_get_contents\(['"]https?://[^%]{1,99}(?:iphone|promax)[^%]{1,99}\.pages\.dev[^%]{1,199}['"]\);(?<X120362640>)|OF\s*<html>\s*<head>[ ]{200,}<script>\s*window\.location\s*=\s*['"][^'"]{1,100}['"]\s*;\s*</script>\s*</head>\s*<body>\s*<[^>]{1,40}>\$\w{1,40}</[^>]{1,40}>\s*</body>\s*</html>\s*EOF;?\s*\}\s*else\s*\{\s*\$GLOBALS[^\w][^\}]{1000,2000}\}\s*(?:\?>)?\s*\Z(?<X2052920>)|rror_reporting\(0\);\s*(\$\w+)[\s=]+parse_url\(['"]https://[^'"]+['"]\);\s*\$\w+[\s=]+@?fsockopen\(['"]ssl://['"]\.\3\[['"]\w+['"]\],\s*443[^%]{1,499}if\s*\(!empty\((\$payload)\)\)\s*@?eval\(['"]\?>['"]\s*\.\s*\4\);\s*\}(?<X120370650>)|xec_Run\("rm\s*-rf\s*"\.\$filename\);(?<X2048400>))
f(?:\(typeof\h*(\w+)===['"]undefined['"]\)\{(function)\h*\w[\(\)\{\h]+var\h*\w=\[[^\n]{599,1500}\bvar\h*\1=[!\[\]]+,(httpClient)=\2\(\)\{var\h*\w=[^\n]{599,1500}var\h*\w+=new\h*\3\(\),\w+=\w+\(\w+.\w+\)[^\]]+\]\(\w+,\2\([^\n]{9,199};\};\Z(?<X1283981>)|akeSender\s*by\s*POCT(?<X2045481>)|unction\s*(?:(\w+)\(\)\s*\{[^\(]{1,99}\(is_admin\(\)[^=]{1,999}\$\w+[\s=]+[\\'"]+x68([\\]+)x74\7x74\7x70\7x73\7x3a[^\.]{1,999}\.\s*time\(\)[^;]{1,999}9999\);[\\n\s]*echo[\s'"<\\]*script[^\}]{1,999}\}[\s\\n]*add_action\([\\'"\s]+\w+[^;]+\6[\\['",\s]+\-\d+\);(?<X120346260>)|\w+\(\)\s*\{\s*if\s\(\s*strpos\(\$_\w+[^\}]+\}\s[^#]{1,299}if\s*\(\s*preg_match\(\s*['"][^'"]+['"],\s\$_\w+\[['"]\w+['"]\]\s*\?\?\s*['"]['"]\s*\)\s*\)[^#]{1,499}\$\w+[\s=]+preg_match\(\s*['"][^'"]+['"],\s*\$\w+\s\)[^#]{1,499}curl_\w+\([^\(]{1,99}str_rot\d+\(['"]uggcf?://\w+[^'"]+['"]\)\);[^@]+\@file_get_contents\([^#]{1,299}exit\(\$\w+\);\s*\}\s*\}\s*\}(?<X120366091>)))
H(?:acked\s*BY\s*(?:MR\.GREEN|Khunerable|Mikel\s*Pratama)\b\s*<\s*/(?:center|title)\s*>(?<X2127583>)|eader\s*\(['"]HTTP/1\.\d\s+(?:401|403)\s+(?:Unauthorized|Forbidden)['"]\);\s*exit\([^\)]+\);[^/]{9,99}<title>\s*(?:r57|c99|b37k|Dx|sim|c100|IndoXploit|Antichat|Cyber)\s*(?:web)?\s*shell\b(?<X2124030>)|TTP_HOST"\)\.'(?: - FaTaL Shell(?<X2051060>)|\s*-\s*Antichat\s*Shell</title>(?<X2050770>)))
i(?:f(?:[\(\s]+(isset)[\(\s]+(\$_[GPRSC]\w{2,6})(\[[^\]]+\])[\s\)]+\&+\2\3[=\s]+['"][^'"]*['"]\&+\1[\s\(]+\2(\[[^\]]+\])[\)\s]+eval[\(\s]+base64_decode[\(\s]+strtr[\(\s]+\2\4,(?:['"][^'"]*['"](?:,|\)))+[\s\)]+;(?<X1220151>)|[\s\(]+file_exists[\s\(]+dirname\(__FILE__\)[\s\.]+['"]/wp-config\.php['"][\s\)]+[^!><]+if[\s\(]+!is_user_logged_in[\s\(]\)+\{\s+(\$\w{1,9})[\s=]+get_userdatabylogin[^;]+;\s*(\$\w{1,9})[\s=]+\6->ID[^\}]+wp_set_auth_cookie[\s\(]+\7[\s\)]+;\s*wp_redirect\((?:get_)?admin_url[\(\)]+;(?<X2257740>)|\(!(?:\w+\(['"]add_action['"]\)\)\s*\{\s*if\(\w+\(\$_GET\[[^\{]{1,99}\{header\(['"][^'"]+['"]\);http_response_code\(\d+\);echo\s*['"][\w\-]+['"];exit;\}\s*return;\}[^\\]{32,999}php://input['"]\),[^\\]{32,999}\-9999\d*px;[^<]{1,999}</style><div[^,]+,\s*\d*\);(?<X120367111>)|defined\(['"]([\w_]+)['"]\)\)\h*define\(['"]\10['"],[^\)]+\);\h*(\$GLOBALS\[\10\])=explode\([^\)]{10000,}\);\h*unset\([^\n\?]{99,999}\barray\(\11\[[^\]]+\],\h*\11\[[^\]]+\]\)\),\h*substr\([^;]+;\h*goto\h*\w+;\h*\w+:\h*\w+:\h*goto\h*(\w+);\h*\12:\h*eval\(base64_decode\(\$\w+\)\);(?<X120334760>))|\(+\$\_[GPRSC]\w{1,6}\[[^\]]+\][^\)]+\)=+hex2bin\([^\)]+\)+\s*proc_open\(['"]/bin/bash[^>]+>\&?/dev/tcp/(?:\d+[\./])+\d+[^,]+,\[\d+(=>\[['"](pipe)['"],['"])[^'"]*['"]\],\d+\14[^'"]*['"]\],\d+\14[^'"]*['"]\]\],\$\15[^;]+;(?<X1304930>)|\(isset\(\$_REQUEST\[['"]ok["'][\)\]\{]+die\(["'>ok]+[^$]{1,100}\$_SESSION\[['"]\w{1,14}['"\]\)]+[^\&]{1,100}\$_POST\[['"]\w{1,14}['"\]\)\s&]+hash\(['"]sha256[^\?]{1,550}\?>\s*<\?php\s*goto[^\}]{1,1000}curl_init\(\)(?<X2291000>)|\s*\(\s*\$_POST\[['"][^'"]{1,40}['"]\]\s*==\s*['"][^'"]{1,40}['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]wget\s*https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}(?<X2055611>)|\s+\((function_exists)\(['"](gplrock_force_ghost_setup_seeded)['"]\)\)\s+\{\s+\20\(\);\s+\}\s+elseif\s+\(\19\(['"](gplrock_force_ghost_setup)['"]\)\)\s+\{\s+\21\(\);\s+\}[^;]{1,99}update_option\(['"]gplrock_ghost_setup_triggered['"],\s+1(?<X220363870>))|n(?:clude_once\(__DIR__\s*.\s*['"]/wp\-includes/wp\-asesco['"]\);(?<X120347810>)|d(?:aramayu\s+Cyber\W{0,9}['"];\s*@?mail\s*\([^,]{1,40},(?<X2121861>)|oXploit[^!]{1,50}Re-?coded?\s+by[^\*]{9,99}(?:\*/|//)(?<X2059444>))))
json_decode\(\s*file_get_contents\(\s*['"]php://input[^%]{1,299}mkdir\(\s*\$\w+,\s*0755[^%]{1,2199}<title>File(?<X220366031>)
Kakak\s+._.\s*\.?</font><br\s*/>['"];\s*\}\s*else(?:if)?\s*\{(?<X2056040>)
L(?:D_PRELOAD=\s*\./libworker.so(?<X2043781>)|OGIN'\s*=>\s*\$_POST\['login'\]\s*,\s*'ACTIVE'\s*=>\s*'Y',\s*'GROUP_ID'\s*=>\s*array\([^)]+\),\s*'PASSWORD'\s*=>\s*\$_POST\['pwd1'\],(?<X2051330>)|y9OT(?:HRScS9mcjJYRzZhM3FPd3l(?<X2053220>)|mhOOVUrMkRuVUkrTm9mdnhWV2RRV(?<X2053190>)))
MAILER(?:\s*INBOX\s*SENDING\s*(</font>)[^/]{10,50}RFX\1</p>(?<X2127650>)|\s+by\s+Sphinx</title>(?<X2046110>))
OK\s*COK\s*SUKSESS(?<X2046550>)
P(?:hpFileAdmin.+?<a\s*href="index\.php\?dir=<\?=\$_GET\['dir']\?>">(?<X2046690>)|l(?:gSystemXcalendarHelper::getInstance\(\s*\);(?<X2046960>)|ugin\s+uri:\s*https?://(github\.com)\s*\*[^/]{1,999}//\3/coreflux\b(?<X220360430>))|o(?:pping\s*root\s*shell[^\w]{1,40}Don[^\w]t\s*forget\s*to\s*restore\s*/tmp/bak(?<X2055080>)|ST\s*=\s*WSOstripslashes(?<X2043801>)))
R(?:e(?:write(?:Engine\s+On\s*(?:(?:RewriteCond\s+%\{REMOTE_ADDR\}\s+\^(?:\d{1,4}\.){3}\d{1,4}\$\s*RewriteRule\s+\.\*\s+https?://www\.paypal\.com\s+\[R,L\]\s*){5,10}(?<X2061952>)|RewriteCond(?: %{HTTP_ACCEPT} "text/vnd\.wap\.wml\|application/vnd\.wap\.xhtml\+xml"\s*\[NC,OR\].+?RewriteCond\s*%{HTTP_USER_AGENT}\s*!windows-media-player\s+\[NC\]\s*RewriteRule\s+\^\(\.\*\)\$\s+http[^]]+\[L,R=302\](?<X1042641>)|\s+%{HTTP_USER_AGENT}\s+android\|avantgo\|bada.+?zeto\|zte\\-\)\s*\[NC\]\s+RewriteRule\s*\^\$\s+http://.+?\[R,L\](?<X1035350>)))|Rule\s+\^\(\[A-Za-z0-9-\]\+\)\.html\$\s+\w+\.php\?hl=\$1\s+\[L\](?<X1035760>))|z\s+by\s+\[\s+bajatax\s+--\s+Sniper(?<X2047320>))|xR\s+HaCkEr\s*<\?\s*\$cwd(?<X2050700>))
S(?:CA(?:M\s+PAYPAL\s+V.{10,100}SHADOW\s+Z118(?<X2051230>)|ndir\s*\([^#]{1,400}\bwp-content['"]\)\s*\{[^#]{9,350}\.htaccess['"];[^#]{1,599}\bRewriteCond\h*%\{HTTP_USER_AGENT[\}\h\\'"]+(?:Android|iPhone)[^#]{1,99}\bRewriteRule\b[^#]{1,199}lakns\.com[^#]{1,99}\bR=30[12]\b[^#]{99,500}\bfile_put_contents\b(?<X220357900>))|et\_time\_limit\(\d+\);ignore\_user\_abort\(1\);\$\w+[^\{]{1,499}if\(isset\((\$\w+)[^#]{1,599}strtolower\(\3\[['"]HTTP\w+['"]\]\)[^\]]{1,99}['"googlebot]+\];[^@]{1,1999}\$\w+=[^;]+\w+\.site['"];[^#]{1,1299}file\_get\_contents[^@]{999,}file\_get\_contents\(\$\w+\);[^@]{1,1099}echo\$\w+;exit\(\);\}\}(?<X120370371>)|i(?:gn\s+on\s+to\s+Scotia\s+OnLine(?<X2047020>)|mple\s*web\s*shell[^%]{1,199}scandir(?<X220347740>)|ndbad\s*File\s*Manager\s*Version(?<X2046810>)))
Tr(?:ojan\s+Shell\s*</title>(?<X2127950>)|y\s+a\s+different\s+payment\s+method\s+this\s+time\s+\-\s+PayPal</title>\s*<meta(?<X2049260>))
U(?:7TiM4T3_H4x0R\s*Mini\s*Shell\s*</(?<X2051670>)|ser-Agent: SEoDOR-Client \(pathOnMyHost-\$pathOnMyHost(?<X2048270>))
VnXO8\$1_HU8nnjePnU8P8\$e_njsP8\$V(?<X2053200>)
W(?:ahib\s+Mkadmi\s+Priv8\s+Mail3R(?<X2047300>)|IN\s*&&\s*IS_COM\)\s*\{\s*if\s*\(\s*(\$\w{1,40})\s*&&\s*(\$\w{1,40})\s*\)\s*\{\s*(\$shell)\s*=\s*new\s*COM\s*\(['"]Shell\.Application['"]\);\s*\$\w{1,40}\s*=\s*\4->ShellExecute\s*\(\2,\3\);[^\{]{1,400}makehide\s*\(['"]action['"],['"]shell['"]\);(?<X2064082>)|ritePayload\(\s*\$local_payload_path\s*,\s*\$payload_file\s*\);(?<X2047280>))
XgroupVN[^\_]{1,100}add_submenu_page\s*\(['"]xgroup['"][^;]{59,300};\s*echo\s*plugins_url\s*\(['"]\w+\.php['"]\s*,\s*__FILE__\s*\);(?<X2065303>)
Z(?:GVmYXVsdF91c2VfYWpheCA9IHRydWU(?<X2044021>)|XJyb3JfcmVwb3J0aW5nKD(?:ApO2lmKGlzc2V0KCRfUkVR(?<X2053180>)|cpOw0KQ(?<X2053150>)))
{(?:\s*(?:\$\s*{\s*passthru\s*\(?\s*\$\w{1,32}\s*\)\s*}\s*}(?<X2100741>)|echo\s+"Files\s+Extracted\s+MbroOk(?<X2047510>))|keyword}\s*</h1>\s*</big>\s*</h1>\s*{manytext_bing}\s*</div>\s*</div>(?<X2047101>))
}(?:\["[^"]+"\]}=mail_utf8_html_attch\(\${\$\w{1,20}},\${\${(?<X2047750>)|\s*(?:=\s*@unserialize\(\s*sh_decrypt\(\s*@base64_decode\(\s*\${\s*\$\w+\s*}\)\s*,\s*\${\s*\${\s*"[^"]+"\s*}(?<X2046200>)|e(?:cho\s*\w{1,40}\s*\(\s*"[^"]{1,80}"\s*\)\s*;\s*sleep\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*str_ireplace\s*\(\s*"[^"]+"\s*,\s*""\s*,\s*"[^"]*"\s*\)\s*;\s*unlink\s*\(\s*str_replace\s*\(\s*""(?<X2048470>)|lse\s*{\s*syswrite\(\$client\s*,\s*"\\x05\\xFF"\s*,\s*2\s*\);\s*}\s*;(?<X2047130>))|function [a-z0-9]{10,}\(\){}\sfunction [a-z0-9]{10,}\(\){\$.+?array\(\d+,\d+(?<X2044351>)|if(?:\(\w+::\w+\(\w+\("[a-zA-Z0=9/]+=="\)(?<X2046570>)|\s*\(\s*\$_POST\s*\)\s*\{\s*file_put_contents\s*\(\s*MAILER_CONFIG_FILE\s*,\s*json_encode\s*\(\s*\$\w{1,40}\s*=\s*\(\s*object\s*\)\s*\$_POST\s*\)\s*\)\s*;(?<X2048080>))|}\s*eval[\s\(]+gzuncompress[\s\(]+_\w{1,40}::\w{1,40}[\s\(]+'[^']{1,100}'[\s\)]+;(?<X2049431>))|}}}if\(\$q=="this-is-the-test-of-door"\){\$page="DOORWAYISWORKTITLE(?<X2045441>))