!(?:(define)d\(['"]DOCS_VERSION['"]\)[^\}\$=\[]{1,199}\b\1\(['"]DOCS_API_URL['"]\h*,\h*['"]aHR0(?<X2174590>)|(function)\s*\(\s*\w+\s*,\s*\w+\)\s*{\s*!\3\s*\(\w+\s*\)\s*\{\s*\bvar\s*[^\.]{1,32}\.\w*\(['"]+\)\.map[\(\w,\s\)\{]+return\s*\w+\.fromCharCode\([^;]{32,128};\w+\s*\w+[\(\s\)\}\w]+['"]\\x\w{2}\\x\w{2}\\x\w{2}\\x\w{2}[^'"]{1024,4096}['"\s]*,\s*['"]\w*['"\s]*\);(?<X1265922>)|\$(?:_REQUEST\s*\[\s*['"]c99sh_surl['"]\s*\]\s*\)(?<X2100781>)|bots?\h*\[\d+\][^\}\{]{1,99}\{\s*(\$\w{1,40})\h*=\h*gets?_data_yo\h*\([^\)]{1,99}\b\w{1,40}\.dat['"]\h*\)\h*;\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"]\{\$\w{1,9}\}\h*\.\h*\w{1,9}\h*['"]\h*,\h*['"][wa]\+?['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\7\h*,\h*\6\h*\)\h*;(?<X2150342>))|\((?:function\(\)\{var\s*_0x\w{1,9}[\s=]+\[['"]createElement[^%>#=]{99,599}aHR0cHM6Ly9[^%>#]{99,2999}iPhone\|iPad\|iPod\|Android/i\[(_0x\w{1,9})[^%>#\^]{99,2999}document\[\9[^\{\^]+\{_0x\w{1,9}[\(\);\}\^]{5,15}(?<X1256862>)|isset\((?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(['"][^'"]*['"]|\((?:\11|\$\{[^\}]+\})\[[^\]]+\]\)=+['"][^'"]*['"])?[^@]{1,57}hex2bin(?:\(\$_[GPRSC]\w{2,6}|\(\$\{['"][^'"]*['"]\}|\(str\w+)(?:[^@]{1,180}|[^@]{1,600})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252782>))|\s*isset\s*\(\s*\$_SESSION\s*\[\s*(['"]nst['"])\s*\]\s*\)\s*\w{2,3}\s*\$_SESSION\s*\[\s*\13\s*\]\s*[^\w]{2,3}\s*\$\w{1,40}\s*\)\s*\{\s*die\s*\(\s*['"]\s*<title>(?<X2058320>)|bot\w{0,9}\s*\([\s\)]+\{\s*echo\s*\w{1,40}\s*\(\s*(\$DOOR_FILE_NAME)\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*(?:\}\s*)+\$\w{1,40}\s*=\s*file_get_contents\s*\([^)]{0,99}\15[^)]*\)\s*;(?<X2131410>)|function(?:[\(\w,\s]{1,16}(\w)\h*\)\h*\{\s*var\s*\w{1,16}\h*=\h*Math\.floor[\(\h]+Date\.now[^'"]{1,128}atob[\s\(''"]+anMub3B0dHJh['"\s\+]+Y2tlci5vbmxpbmU[='"\);]+\(\17[^;]{1,256}\.appendChild\(\17[\)\}\(\s]+document\);(?<X1278511>)|\((\w+),(\w+)\)\{\h*let\s*\w+=\-1!==\19\.cookie\.indexOf\([^\)]+\);\19\.location\.toString\(\)\.includes\(\20\)&&fetch\(\[[^\]]+\]\.map\(function\(\19\)\{\h*return\s*String\.fromCharCode\(\19[\)\}\.]+join[\("'\),\{\h]+method\s*:\s*['"]POST[^;]+;[^;]+\(document[,\s]+['"]checkout['"][\)\s]+;(?<X1263090>)|\(\w(?:,\w)+\)\{const\h*\w+=["']\w{1,40}['"][,\w\h]+=(document)\.cookie;[^\}\?\{\n]{0,99}(\b\w{1,20})=\22\.referrer[^<\+\|]{9,999}if\(!\23[^<&^\}\{]+\23\.indexOf[\('"\h]+(?:google|bing|facebook|yahoo|instagram|naver|pinterest)[\.'"\)]+[^<\|\n]{9,}\bhead['"]\)\[0\]\.appendChild\(\w+[\)\}\(\h]+\22[\)\h]+;(?<X1248891>)|\s*\((_0x\w{1,9})[^\}\n\?&:]{1,499}(_0x\w{1,9})[=\s]+atob\s*\([^\}\?]{1,999}\25[\s\['"]+createElement['"][^\n\}:\?]{1,999}\[['"]src['"]\]\s*=\s*['"]https?:[/'"\s\+]+\26[^\}\n]{1,999}\}[\s\(]+document[\s\)]+;(?<X1264941>)|\s*\((_\w+)\s*\)\s*\{\s*var\s*_\w*\s*=\s*date[^!\}]{1,499}var\s*(_\w+)\s*=\s*\28\.referrer;\s*if\s*\(!\29\)\s*return;\s*var\s*_\w+\s*=\s*\[[\d,\s]+\];[^/]{1,499}fromcharcode[^:]+://[^\}\{]+\28\.createelement\(['"]script[^\}\{]+\28\.getElementsByTagName[^\}]{1,999}\}\(document\);(?<X1257373>)|\s*\([,\w\s\)\{]{4,32}=\s*\w+\.createelement\([^\}]+\}\s*\([^:]{1,99}://chimpstatic\.com/\w+\-\w+/js/users/\w+/dd13878c057168f24ab77a98e\.js['"]\s*\);(?<X1279283>))|window\[\w+\(\w[^\]]+\]\s*&&\s*\(\s*window\[[^\]]+\]\s*=\s*\{[^\}/\+\)]{0,499}['"]R_PATH['"]\s*:\s*['"]https?://\w[^;\}]+\}\);(?<X1252100>))
"(?:;(?:@file_put_contents\("\$GLOBALS\[web_root\]temp/(?<X2049300>)|\s*eval\s*/\*[^*]+\*/\s*\(\w{1,30}\s*\(\s*\$\w{1,30}\s*,\s*\$\w{1,30}\s*\)\s*\);\s*\?>(?<X2045940>))|[#\-=\[]{10,12}Priv(?:8|ate)\s*PayPal\s*Scam(?<X2054713>)|User-Agent:\s*\$template"\s*\."\|\$pathToDor"\s*\."\|\$pathOnMyHost"(?<X2044781>))
#(?:!/(?:bin/bash\s*while\s*true\s*;\s*do\s*\{\s*if\s*\[\s*"\$\(pidof \w{1,100}\)"\s*\]\s*then\s*sleep\s*60\s*else\s*\.\s*/kswd\s*&\s*fi\s*\}\s*done(?<X2048540>)|usr/bin/(?:(?:ba|z|t)?sh\s*(?:DIR=\$1\s*IFS=\$[^\&]{199,399}\s*permnum=['"]0777['"]\s*permhuman=['"]drwxrwxrw['"][^\?]{500,}\$permcolor\\['"]\},\s*done\s*echo\s*['"]\{\}\]['"](?<X2058360>)|USEFUL\s*=\s*\([^\)]{1,99}\)[^\?]{999,2000}Cant\s*Read\s*\[\s*/etc/named\.conf\s*]\\c['"]\s*fi\s*echo\s*-e\s*['"]['"]\]\}\\c['"](?<X2058350>))|env\s+python[^>]{9,700}(?:auto)?commands?\s*=\s*['"]unset\s+HISTFILE;uname\s+-a;id['"](?<X2124950>)|perl(?:[^:]{1,30}use\s+IO::Socket;[^/]{99,600}(?:\$\w{1,20}\s*=\s*|print\s+)['"]['"Jm7\.3uz]{6,12}['"];(?<X2064121>)|\s*[^\?]{450,600};\s*system\(\s*decode_base64\s*\(\s*\$\w{1,40}\s*\{\s*['"]cmd['"]\s*\}\s*\)\s*\)\s*;\s*print\s*['"]</pre>['"]\s*\}\s*\}(?<X2058340>))|p(?:hp\h+\-q\s+eNrtW(?:mtPW0kS.StMFI2JJtr0|WtPW1cW.SsERTVoUH)(?<X2152511>)|ython(?:[^'"]{1,99}program_name\s*=\s*['"]fpm-worker-main['"][^\\]{0,50}(?:\w{1,20}\s*=\s*['"]https?://[^'"]{9,40}/\w{1,20}\.(?:json|php)['"]\s*){1,3}\w{1,20}\s*=\s*['"]\w{1,9}\.sh['"](?<X2063550>)|[^_]{1,99}_?exploit[^\)]+\b\w+\s*=\s*\w*\(\)\s*token\s*=\s*['"][^'"]{1,128}+['"]\s*chatid(?<X2245490>)))))|#(?:(?:START|END)_DATA##['"][^\?]{1,49}=(?:explode|array)\([^\)]{99}[^\?]{1,999}=['"]adhupemail\.com\b(?<X2202971>)|\s+\w{1,40}\s+(?:Priv8|Private)\s+Webshell(?<X2056721>))|([a-f\d]{6,9}#)\s*if[\s\(]+empty[\s\(]+(\$\w{1,40})[\s\)]+\{\s*\13[=\s]+['"]<script\b[^:]+\bsrc[\h=]+\\?['"]http://[^/]+\.[a-z]{2,9}/[^'"]+['"]\s*>\s*</script>['"];\s*echo\s*\13;\s*\}(?:\s*#/\12)?(?<X1238171>)|([a-z0-9]{4,9}#)\s*(?:/\*\*[^$]{1,}\*/\s*)?if\s*\(\s*empty\s*\(\s*\$\w{1,40}[\)\s]+\{\s*error_reporting\s*\(\s*0\s*\)\s*;[^#\?]{999,2999}@?fsockopen\s*\([^#]{999,1999}echo\s+[\$'"][^;]{1,199};\s*\}(?:\s*else\s*\{[^\}]+)?(?:\s*\}){1,2}\s*#/\15(?<X1133351>)|(\w{1,15}#)[^\{]{9,1500}\bif\h*\(\h*empty\h*\(\h*(\$\w{1,9})[\s\)]+\{\s*if[\(\h]+substr[\(\h]+trim[\(\h]+(\$_SERVER)\[[^\]]+\][^\(]{0,49}\bpreg_match\(\s*['"]/\(googlebot\|\w[^\?]{99,1999}\bfunction\h*__file_get_url_contents\(\s*\$remote_url[^\?]{9,2500}\18(\[[^\]]+\])\h*=\h*\19\20;[^#]{2,499}#/\17(?<X1178971>)|(\w{4,7}#)\s*if\s*\(\s*empty\s*\(\s*(\$\w{1,5})\s*\)\s*\)\s*\{\s*\23\s*=\s*['"]<(script)\s+type\s*=\s*[\\'"tcpservi/jxa]+[^;]+;\w{1,5}\s*=\s*['"\\+document]+;\s*(\w{1,5})\s*=\s*['"\\+split]+;[^:]{9,200}eval[^/]{9,99}['"][\w]{999,7000}\\['"]\[\25\][^<]+\);\s*\}\s*<\/\24>['"];\s*echo\s+\23;\s*\}\s*#/\22(?<X1059342>)|[a-z0-9]{4,9}#\s*(?:/\*\*[^$]{1,}\*/\s*)?if\s*\(\s*empty\s*\(\s*\$\w{1,40}[\)\s]+\{\s*if[\s\(]+substr[\s\(]+trim[\s\(]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\s\)]+,[^\)]+\)\s*==\s*['"]\d+\.\d+['"]\s*\)[^#\?]{999,4999}@fsockopen\s*\([^#]{999,1999}echo\s+[\$'"][^;]{1,299};(?:\s*\}){2,5}\s*#/[a-z0-9]{4,9}#(?<X1133324>)|\$\s*https://telegram\.me/neo_net\b(?<X2208800>)|\-+do\-+not\-change\-+the\-+following\-+content\-+\s*<(FilesMatch)\s+['"]\.\([^\)]{0,99}\b(?:py\|?|exe\|?|php\d*\|?)[^>]{0,199}>\s*Order\s+(Allow[,\s]+deny)\s*Deny\s+(From\s+all)\s*</\29>\s*<\29\h*['"]\^\((?:[^\|]{0,40}\.php\d*\|?)+\)\$['"]>\s*Order\s+\30\s*Allow\s+\31\s*</\29>(?<X1220973>)|\h*(?:Facebook|ICQ):\h*(?:facebook\.com/|@)Ex\.Robotos\s*RewriteEngine\h+On\b(?<X2165623>)|\s*(?:!/usr/bin/python[^>]{1,600}>\s*<methodCall>\s*<methodName>\s*wp\.getUsersBlogs\s*<[^\]]{1,600}passlist\s*=\s*\[\s*['"](?<X2059821>)|BEGIN\s*W0RDPRESS\s*#<IfModule\s*mod_rewrite\s*\.\s*c>\s*#RewriteEngine\s*On\s*#RewriteBase\s*/\s*#RewriteCond\s*%\s*\{\s*REQUEST_FILENAME\s*\}\s*!-f\s*#RewriteCond\s*%\s*\{\s*REQUEST_FILENAME\s*\}\s*!-d\s*#RewriteRule\s*\.\s*/index\s*\.\s*php\s*\[\s*L\s*\]\s*#</IfModule>\s*#\s*END\s*WordPress(?<X1042681>)|Jakarta-Blackhat\s*Hacker(?:`|'|")s(?<X2056940>))|builds\h+random\h+ascii\h+string\s+def\h+buildblock\((?:self\h*,\h*)?size\):[^#]{9,499}print\h+['"][^'"]{0,99}(?:flood|port|attack|worker|udp|dos|hulk|crack|brut)(?<X2150790>)|wordpress\s*rewrite\s*rules\s+<(FilesMatch)\s+['"]\.\(ph[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\38>[^<>\)\(]{0,40}<\38\s*['"]\^\((?:[\w\-\.]+\.php\|?)*\)\$['"]\s*>\s*\39\s*Allow\s+\40\s*</\38>(?<X1218131>))
%24(?:\w{1,14}\s*/%2A(?:%20)*\w{1,14}(?:%20)*%2A/(?:%20)*%3D(?:%20)*/%2A(?:%20)*\w{1,14}(?:%20)*%2A/(?:%20)*(?:%27|%22)?\d{1,5}(?:%27|%22)?%3B(?<X2273130>)|\w{1,40}(?:%20)*%3D(?:%20)*class_exists%28%24\w+%29%3B[^\n\*]{0,499}%24\w+(?:%20)*%3D(?:%20)*new(?:%20)*/%2A[^\*\n'"]+2A/(?:%20)*\w+(?:%20)*%28[^\?\n'"]{9,19999}%28%29%3B%7D(?<X2273141>))
&(?:(?:amp;)?\.?rand=13vqcr8bp0gud\b(?<X2153013>)|\.?rand=13InboxLight\.aspx(?<X2148911>)|copy;\s*202[32]\s*&bull;\s*SLOT\d{2}\s*</span>[^:\.\?]{0,99}</body>(?<X2230080>))
';\$\w+=str_rot13\('fge_ebg13'\);\$\w+=\$\w+\('onfr64_qrpbqr'\);\$\w+=\$\w+\('[^']+'\);eval\(\$\w+\(\$\w+\(\$\w+\(\$\w+\)\)\)\)(?<X2045391>)
(&lt;)script[^:\.>]{1,99}src\s*=(&[^;]{1,5};)https?://magento(?:\.name|core\.net)/[^>\.]{1,40}\.js\2\s*(&gt;)\s*\1/script\3(?<X1127232>)
((\$\{['"]GLOBALS['"]\}\[)['"]\w{1,40}['"]\])=['"]key['"];\$_POST\[\$\{\1\}\]=stripslashes\(\$\{\2[^\]]+\]\}\);[^@\?]{9,99}<title>[^/<]{1,49}\bShell\b(?<X2145110>)
((\$\{['"]GLOBALS['"]\}\[)[^\]]+\])=['"][^\?\n:/@#%&\*\+\\\|<>!]{1,499}=file_get_contents\(['"]php://input['"]\);[^\?\n:/#%&\*\+\\\|<>!]{1,499}\1\}?=(?:\$\{)?\2[^;]+;try\{eval\((?:\$\{)?\1\}?\);\}catch\([^\)]+\)\{[^\}]{0,199}\}{1,2}(?<X1218611>)
(//###==###)(?:[^#]{1000,6000}\}\}\}\}if\(@\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\s*==\s*\w{1,40}\(\w{1,40}\)\)\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\(\$GLOBALS\[['"][^'"]{1,40}['"]\]\[\w{1,40}\]\(\$_REQUEST\[[^'"]{1,40}\(\w{1,40}\)\]\s*\)\s*\)\s*;\s*\}\s*echo\s*\$\w{1,40};\s*\}\s*\1(?<X1053603>)|\s*\$GLOBALS\s*\[[^\]]+\][=\s]+Array[\(\s]+base64_decode[\(\s]+['"][^\n\?><]+\?>\h*<\?[ph\h]*function[^\n#]+\}\s*\1(?<X1276800>)|\s+(?:(\$\w{1,40})\s*\.?=\s*['"][asertvl]+['"];\s*){1,3}@\4\s*\(\s*str_rot13\s*\(\s*['"]riny\s*\([^\)]{999,1999}[\s\)]+;['"][\s\)]+;\s*\1(?<X1137863>))
(//###={1,3}###)\s*@?error_reporting\s*\([^#]+\}\s*if\s*\(\s*!\s*empty\s*\(\s*\$_COOKIE\s*\[\w{1,40}\(\d+\)\][\s\)]+die[^#]{1500,5000}?\{\s*@?eval\s*\(\s*\$GLOBALS\s*\[['"]_\w{1,40}_['"]\]\s*\[\d+\]\s*\(\s*\$_REQUEST\s*\[['"]\w{1,40}['"]\][\s\)]+;\s*\}\s*\}\s*\1(?<X1127690>)
(//\h*install_code)\b[^#]{999,19999}\bWP_URL_CD\h*\([^;]{1,99};[\}\s]+if\s*\(\s*\$\w{1,40}\s*=\s*@?file_ge(t_contents\s*\(\s*__FILE__)[\s\)]+\{\s*(\$\w{1,40})\s*=\s*preg_replace\s*\(\s*['"]\W\1\b[^\}]{1,999}\bfile_pu\2\s*,\s*\3\s*\);[\}\s]+\1_end\b(?<X1187130>)
(//\w{1,9})bg[^\*\(\[\{#]{1,49}\./\.htaccess['"];[^\}]{1,599}\}\s*(@?chmod\(\$\w{1,15},\h*\d{3,4}\);)\s*@?file_pu(t_contents)\s*\(\s*\$\w{1,40}\s*,\s*@?file_ge\3\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\2\s*[^\?]{99,1999}\1end(?<X1178782>)
(//i)start\s*(function)\s+\w{1,40}\((\$\w{1,40})\)[^\}]{1,99}glob\(\s*\3[^\)]+/wp\-\*\.php[^@]{99,1999}(\$\w{1,40})\s*=\s*\$_[GCPSR]\w{2,6};\s*(\$\w{1,40})\s*=[^;]{1,40};\s*if[^;]{1,99}@?\4\[\5\]\(@?\4\[[^%]{999,4999}\2\s*decrypt_url\([^\}]{99,499}\}\s*return\s*\$\w{1,40};\s*\}\s*\1end(?<X1137971>)
(//wp\w+)\h*(?:bg|beginning|start)\s*(?:\$\w{1,20}[\h=]+["'][^'"]{1,60}['"];\s*){5,15}\bif[\h\(]+(\$\w{1,20})[&\h]+(file_)exists[\h\(]+(\$\w{1,20})\)\)[\s\{]+[^&\\@]{99,250}\b(\3pu(t_contents)\()\2[,\h]+(\3ge\6\()\4\)\);[^\\\?@]{600,1200}\5[^\)]+\7[^\}]{1,40}\bchmod\([^;]+;[\s\}]+\1\h*(?:end|ed|exit)(?<X1203950>)
(/[\*/\h]+\w+)_start\s*\$\w{1,20}[\h=]+['"]['"filesz\.\h]{8,30}['"];\s*\$\w{1,20}[\h=]+['"][file_xist'"\.\h]{11,30}['"];\s*(\$\w{1,20})[\h=]+['"][file_putcons'\.\h]{17,50}['"];[^\*\?]{300,999}\2[\h\(]+[^;]+\);\s*[@\$]*\w+[\h\(]+[^,]+,\h*\d+\);[\}\s]+\1_end\b(?<X1233490>)
(/\*[^\*]{1,30}\*/)\s*@?error_reporting\h*\([,\h'"]*(?:NULL|0|false|off)[\h\)'"]*\);(?:\s*@ini_set\h*\(\s*['"](?:error_log|log_errors|display_errors)['"][,\h'"]+(?:NULL|0|false|off)[\h\)'"]+;)+\s*@eval\(\s*base64_decode\([^\?\*]{99,20000}\1(?<X1040621>)
(/\*[a-f\d]{3,9}\*/)\s*(\$\w{1,40})\s*=\s*['"]/h[^'"]+/\.[^'"/\.]+\.[a-z]{2,5}['"]\s*;\s*if[\(\s]+!\h*isset[\(\s]+\2[\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*else\s*\{\s*@include(?:_once)?(?:\s*/\*+[^\*]*\*+/)?[\(\s]*\2[\)\s;]+\}\s*\1(?<X1280910>)
(/\*[a-f\d]{32}\*/)\s*(\$\w{1,20})\h*=\h*['"][base64_dco\.'"]{16,40}['"]\h*;\s*@?eval\h*\(\h*\2\h*\(\h*['"][^'"]{999,19999}['"]\h*\)\h*\)\h*;\s*\1(?<X1166071>)
(/\*[a-f\d]{4,64}\*/)\s*(function)\h*\w{1,40}\([^\)]+\)\s*\{\s*var\s*(\w{1,9})\h*=\h*document\.create(Element)\(['"]script['"]\);\h*\3\.src=\w{1,40}[^\}]{9,499}\.get\4sByTagName\([^\)]+\)\[\d+\]\.appendChild\(\3\)\h*\}\s*\2\h*(\w{1,40})\([^\)]*\)\s*\{[^\*\v]{999,9999}\b\5\b[^\;]{2,19};(?:\s*\1)?(?<X1188431>)
(/\*\s*[a-f0-9]{1,32}\s*\*/)\s*var\s*(\w{1,2}x\w{1,9})=\[['"][^_\n]{99,1999}(?:\\x2f|/)(?:i|\\x69)(?:f|\\x66)(?:r|\\x72)(?:a|\\x61)(?:m|\\x6d)(?:e|\\x65)(?:>|\\x3e)[^\n\*]{99,999}(\w{1,2}x\w{1,9})\[\2\[\d+\]+=\w{1,2}x\w{1,9}\[\d+\][^;]{0,99};document(?:\[\2\[\d+\]+)+\(\3\)[;\} ]{1,9}\s*\1?(?<X1133611>)
(/\*\w{32,64}\*/)(?:\s*;)?\s*(window)\[[^\]]{1,40}\]\[[^\]]{1,40}\]=\[[^\]]{999,9999}\];\s*var\s*[\w=]+=\2\[[^\]]{1,99}\]\[[^\]]{1,99}\],(\w{1,40})=\2;[^\n\)]+\3\[[^\]]{1,40}\]\[[^\]]{1,40}\]\]?\.join\([^\)]{1,9}\);['"]\)+;\s*\1?(?<X1128721>)
(/\?do=kak-)udalit-[^'">]{1,99}['"]>[^</>\v]{4,99}</a>(?:[^\?]{0,499}<a\h+href=['"]https?://[^/]{4,40}/\w{32}\1[^'">]{1,99}['"]>[^</>\v]{4,99}</a>){2}(?<X2148550>)
(<!--[^\w]+-->)\s*<Script>\s*document\.write\s*\(\s*unescape\s*\(\s*['"]%3c%69%66%72%61%6d%65[^'"]{99,300}%22%76%69%73%69%62%69%6c%69%74%79%3a%20%68%69%64%64%65%6e%22[^'"]{1,50}['"]\)\s*\)\s*</script>\1(?<X1062281>)
(<!--service_)start-->\s*<html>(?:</?head>){2}<body>\s*<\?php\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[['"]([^\]]+)['"]\]\D{2,9}['"][^'"]{1,40}['"]\h*\)\s*\{[^#]{999,1999}\}\s*else\s*\{\s*print\h*['"]<(script)\h+type\h*=[^;\?]+\+\h*['"]\h*\?\h*\2\h*=\h*\w{1,40}['"]</\3>['"];\s*\}\s*\?>\s*</body></html>\s*\1end-->(?<X1143710>)
(<!\-\-[a-f\d]{32}\-\->)<\?php\h*@ob_start\(\);\h*@ini_set\(['"]display_(error)s['"][,\h]+0\h*\)\h*;\h*@\2_reporting\(0\);\h*echo\h*base64_decode\(['"]PHNjcmlw[^;=]{4999,9999}(?:=+|\+)['"]\)\h*;\h*\?>\1(?<X1177151>)
(<!\-\-service)_start\h*\-\->[^\?]{1,30}<\?php[^\?]{1,599}(\$\w{1,40}\h*=\h*fopen)\(\$\w{1,20}\.['"]/(?:wp\-(config)|\3uration)\.php['"],[^#]{99,2299}\2(\(dirname\(_(_file)__\))\.['"]/\w{1,12}\.php['",\h]+w\+?['"]\);[^%]{1,350}(?:move_uploaded\5|copy)\(\\\$\5s\[[^#]{1,540}@?touch\4,[^!]{1,299}\1_end\h*\-\->(?<X1172943>)
(<\?)php\s*file_(?:ge|pu)t_contents\h*\(\$_[GPRSC]\w{2,6}\[['"]DOCUMENT_ROOT['"]\][\h\.]+['"][^\'"]{0,49}\.php['",\h]+\1\s*(\$_\w{1,20})\h*=\h*['"]chr['"];\s*\&?(\$_\w{1,20})\h*=\h*(?:\2\(\d+\)\.){1,20}[^;]+;\s*(\$_\w{1,20})\h*=\h*\2\(\h*\d+\h*\)\.[^;]{1,199};\s*\$_\h*=\h*\4\(['"\h]+,\3\);[^#]{1,49};\s*\?>(?<X1187271>)
(<\?[ph\s]+)define\(['"]PBOX['"][^;]+;\s*@?[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\bdelayedlinks\.php['"](?:[\)\s]+)?;\s*\?>\s*\1@?[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\.php['"](?:[\)\s]+)?;\s*\?>(?<X1217880>)
(<\?php)(?:\h+\$\w{1,40}\h*=(?:\h*[hsm](?:exdec|ubstr|d5)\h*\(\h*){3}\$_SERVER\[['"]HTTP_HOST['"]\][\h,\d\)]{7,18};[^\->]{0,499}(\$jemenu)\h*=\h*\$app(->get)Menu(\(\));\s*if\h*\(\h*\2\3Active\4\s*=[^\;\{]+\)\s*\{\s*(\$\w{1,40})\s*=\s*rand\4;[^;]+\5;\?>['"][^\*&%:\-]+['"]none['"];\s*\}\s*</script>\s*\1\s*\}\s*\?>(?<X1048382>)|\s*(?:error_reporting\((?:0|NULL|FALSE)\);\s*function\h*\w{1,15}\((\$\w{1,15})\)\s*\{\s*\$\w{1,15}\h*=\h*curl_init\(\7\);[^\?]{0,299}\bfile_put_contents\(['"][^'"]+\.png['"],\h*['"]\1[^\}]{0,99}\}\s*(?:require|include)(?:_once)?\h*__DIR__\s*\.\h*['"][^'"]+\.png['"];\s*(?:\?>|\Z)(?<X1175041>)|if(?:[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*\$\w{1,40}\h*=\h*['"]\1\s*@?eval[\h\(]+(?:(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\(){3,}['"][^'"]{999,9999}['"][\s\)]+;\s*\?>['"];\s*@?file_put_contents\(['"][^'"]{9,99}\.php['"][,\h]+\$\w{1,40}[\s\)]+;\s*\}\s*\?>(?<X1177670>)|\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\))\h*\W{2,3}\h*(?:md5|sha[1256]{1,3})[\h\(]+\10\h*\S{2,3}\h*(base64_decode)[^\{]{1,99}\{\s*(\$\w{1,9})\h*=\h*\11[\h\(]+\$_[GPRSC]\w{2,6}[^;]+;\s*file_put_contents[\h\(]+(['"]lte?_['"])\h*,\h*['"]\1[\h'"\.]+\12\);\s*\12[\h=]+\13;[^\?]{1,199}\?>(?<X1185781>))))
(<\?php\s*)if\h*\(in_array\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{1,40}\?>\s*<(span)\b[^>]{9,60}>\s*(?:<a\h*href\h*=\h*['"]https?://[^<]{9,99}</a>\s*){3,9}</\2>\s*\1\s*\}\s*\?>\s*\Z(?<X1193041>)
(<Hacked>)\s*(?:<br>\s*){2,6}\1(?<X2174380>)
(?:(?:\$\w{1,20}='.';)+\$\w{1,20}=(?:\$\w{1,20}\.?)+;)+@?eval\(\$\w{1,20}\(\$\w{1,20}\(\$\w{1,20}\(\$\w{1,20}\(["'][^"']+["'](?:\)\s*){5};(?<X1034952>)
(?:(\$\w+\[)\]=['"]Mozilla/[^'"]+['"];){5}[^\}]{1,1499}(\$\w+)=(?:array\(|\[)[^;]*['"]User\-agent[\s:'"\.]+\1[^\{]{0,199}\bfunction\s+(\w+\()\$\w+,(\$\w+)\)\{[^\}]*,CURLOPT_HTTPHEADER,\4\)[^@]{1,999}(\$\w+)=['"]https?://(?:www\.)?google\.com/webmasters/[^;]+;\$\w+=\3\5,\2\)[^@]{1,499}\bunlink\(['"][^'"]+\.php['"]\)[;\?>\}]+\Z(?<X2225960>)
(?:(\$\w{1,25})[\h=]+(\$_SERVER\[[^\]]+\])[\h\.]+['"]/(?:\.htaccess|index\.php)['"];\s*){2}(?:(\$\w{1,25})[\h=]+\2[\h\.]+['"][^'"]+\.(?:html|gif|png|jpe?g)['"];\s*){2}[^\?]{0,400}\b(file_)put(_contents)[\h\(]+\1,\h*\4get\5[\h\(]+\3[\h\)]+;\s*@?chmod[\h\(]+\1,\h*\d{3,4}[\h\)]+;\s*\}\s*\}(?<X1234351>)
(?:(\$\w{1,40})=@?((mysqli?_)query\(\$\w{1,40},)['"]SHOW\h+(?:DATABASES|TABLES|COLUMNS)\b[^\?]{1,199}){3}\bwhile\((\$\w{1,40})=\3fetch_array\(\1\)\)\{if\([pe]reg_match\([^,\)]+,\4\b[^\?]{1,199}=\2['"]SELECT\h*['"]\.\4\[[^\}]{1,199}\becho\h*\$\w{1,40}\[\4\[(?<X2173220>)
(?:(\$\w{1,40})[=\s]+(\$\w{1,40})\[[\s\(]*\d+[\s\)]*(?:[/\+\*%\-]\s*\d+\s*)+\](?:[\.\s]+\2\[[\s\(]*\d+\s*(?:[/\+\*%\-][\s\(/\+\*%\-]*\d+[\s\)/\+\*%\-]*)+\])+;\s*)+\$\w{1,40}[=\s]+['"][^;]{99,}['"]\s*;[^'"\*]{0,99}(\$\w{1,40})[\.=\s]+\1[^'"\*]{0,40}(\$\w{1,40})[=\s]+\$\w{1,40}\(['"]{2}[,\s]+\3[\s\);@]+\4\(\);(?<X1216610>)
(?:(\$\w{1,40})[=\s]+http_get[\(\s]+['"]https?://raw\.githubuser\w+\.com/botersx/[^\;]+;\s*(\$\w{1,40})[\s=]+fopen[\(\s]+(\$\w{1,40}),[^\;]+;\s*fwrite[\(\s]+\2,\s*\1[\)\s]+;\s*fclose[\(\s]+\2[\)\s]+;\s*if\(file\w+[\(\s]+\3[\)\s]+[\{\s]+echo\s*(?:[^\.]{1,100}\.(?:\.|\3\.|;)+)+[^\$]{1,100}(?:\3(?:\d+)?[\s=]+)?[^\;]{1,200};\s*)+(?<X2221961>)
(?:(\$\w{1,40})[=\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]['"\s;:]+){2}\$\w{1,40}[=\s]+\$\w{1,40}[=\s'";\s]+switch[\s\(]+\$\w{1,40}[\s\)\{]+case[^\?]{99,9999}isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^,]+file_put_contents[\s\(]+\1(?<X2265880>)
(?:(\$\w{1,40})\[['"]\w{1,40}['"]\]=['"][^'"]{1,40}['"]\^['"][^'"]{1,40}['"];){3,9}[^\n]{99,1999}\$\w{1,40}\(\1\);(?:if\([^\n;]{1,99})?(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);\2\(\);\}?(?<X1132500>)
(?:(\$\w{1,40})\h*=\h*['"](?:get|file|contents|put)['"]\s*;\s*){3,}(\$\w{1,40})\h*=[^;]*\1[^;]*;\s*(\$\w{1,40})\h*=[^;]*\2[^;]*;[^\}\{]*\breturn\s*(?:\3|\2)[^\}\{;]*;(?<X1265521>)
(?:(\$\w{1,40})\h*=\h*['"][^\n]{1,40}['"]\^['"][^\n]{1,40}['"]\h*;\h*){3,}(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*['"]{2}\h*,[^;]{0,99}\1\h*\((?:\h*'[^']{99,}'\h*\^)+\h*'[^']{99,}'\h*\)(?:\h*\))+;\s*@?\2\h*\(\);(?<X1166221>)
(?:(\$\w{1,40})\h*=\h*\$\w{1,40}\[[\h\(]*\d+\h*[/\+\*\-]\h*\d+\b[^;]{9,9999};\s*)+\$\w{1,40}\h*=\h*['"]{2}[^'"]{999,}['"]{2};\s*(\$\w{1,40})\h*=\h*\$\w{1,40};[^\(\)\{\}]{0,99}\2\h*\.=\h*\1;\s*@?(\$\w{1,40})\h*=\h*\$\w{1,40}[\h\(]+['"]{2}(?:\h*\))?\h*,\h*\(\h*\2[\h\)]+;\s*@?\3\h*\(\)\h*;(?<X1185770>)
(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*){2}function\h*(\w{1,40})\s*\([^;]+;[^\?]{0,499}(\$\w{1,40})[\h=]+\2\b[^;]*\1[^;]*;\s*(\$\w{1,40})[\h=]+tmpfile[\(\);\s@]+fwrite[\(\s]+\4\h*,[^;]*\3[\s\);]+(\$\w{1,40})[\h=]+stream_get_meta_data[\s\(]+\4[^;]*;\s*@?include(?:_once)?[\s\(]*\5\b[^;]*;(?<X1196570>)
(?:(\$\w{1,40})\s*=\s*['"]\{#\w{5,40}\}['"]\s*;\s*)+\$\w{1,40}\s*=\s*@?(file_)ge(t_contents)[\s\(]+(\$\w{1,40})[\s\.'"]+/index\.php[^\{\}]{9,999}(\2pu\3)[\s\(]+\4[\s\.'"]+/\.htaccess['"][^\|]+(\$\w{1,40})[\s=]+explode[^;]+\1[\s\);]+foreach[\s\(]+\6\s*as\s*(\$\w{1,40})[^\?]{9,999}\5[\(\s]+\7\s*,[^;]+;\s*\}(?<X1218310>)
(?:(\$\w{1,40})\s*=\s*\$_SERVER\s*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/[i\.][^;]+[ps]['"][\s;]+)+(\$\w{1,40})[=\s]+['"]['"\h\.base64_dco]{17,40}['"][^\{\}\*]{0,199}(\$\w{1,40})[=\s]+\2[\s\(]+['"]PD9[^'";]{99,}['"][^!]+if[^;\{\}]+\3[^\}]+(@file_put_contents\s*\()[^;]+\3[^\}]+\}\s*\}[^\}]+\4\1[^\}]+\}\s*\}(?:[^\}]*\bunlink[\s\(]+\1[\s\);]+\})?(?<X1279481>)
(?:(\$\w{1,9})\h*=\h*['"]\\x\d[^'"]{9,99}['"];\s*){4}(\$\w{1,9})\h*=\h*['"][^'"]{999,4000}['"];\s*@?eval\((?:\$\w{1,9}\(){3}\1\(\(\2\)+;(?<X1139241>)
(?:(\$\w{3,9})\h*\.?=\h*['"]\h*[qa](?:uestion|nswer)\h*\d*\h*:\h*['"]\.\$_POST\[[^\]]+\]\.['"](?:\\r)?\\n['"];\s*){4}[^\?]{99,499}mail\([^\)]+\1\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][\./]{2,12}\w{1,40}\.txt['"],\h*['"][aw]\+?['"]\);\s*fwrite\(\2,\h*\1[^/]{1,99}cation\.href\h*=\h*['"][^"']{9,199}['"];\s*</script>(?<X2145522>)
(?:(\$m[es][gs](?:sage)?)\.=['"](?:(?:User|login|e\-?mail|id|card)\s*(?:id|address|pass(?:word)?)?|pass(?:word)?|pin|cvv|ssn)\s*:\s*(?:['"]\s*\.\s*)?\$\w{1,40}[^;]{1,20};){2}[^\{]{99,999}(\$\w{1,40})="?\1[^;]{1,9};[^@#`\?\*]{99,999}\b(?:mail|file_put_contents|fwrite|fputs)\([^;\?]{1,199}\2(?<X2139800>)
(?:(\$m[es][gs](?:sage)?)\s*\.=[^;]{1,99};\s*){2}[^\(\{@]{1,99}(\$\w{1,40})\s*=\s*['"][^'"]+['"];[^\}\?]{1,99}\bmail\(\s*\2[^\)]+\1\s*\);\s*\}\s*\?>\s*<script[^>]{0,49}>\s*(?:<!--[^/<=;]{1,99})?\bwindow\.location\s*=\s*['"]https?://[^/]{0,19}(?:bank|gmail|apple?|dropbox|ama?z(?:on)?)(?:\.\w{1,3}){1,3}['"/](?<X2139531>)
(?:,\$\w+\)\{if\(is_writable\((\$\w+)\)+\{(\$\w+)=scandir\(\1\);foreach\(\2\s*as\s*(\$\w+)\)\{(\$\w+)=['"]\1/\3['"];(\$[^=;\w]{0,99})=\4\b[^\?]{0,99}\b(file_put_contents\(\5,\$\w+\);)[^\?]{0,199}\b\6[^\?\[#%:/!@\*<>\{]{0,199}){2}(?<X2220270>)
(?:/\*[^\*]{1,18}\*/\$\w{1,9}='[^']{40,}';){30}(?<X2045312>)
(?:;(\$\w{1,40})=['"]<meta\h+(?:(?:http\-equiv=['"]?refresh['"]?|content=['"][0-2];)[^>]{1,99}){2}>['"];(?:print|echo)\h*['"]?\1['"]?;(?:die|exit)[^;]{0,19};[^@<\?]{1,199}){3}\}\$\w{1,40}=new\h+\w{1,40}\([^;]{1,99};\s*(?:\?>\s*)?\Z(?<X2183150>)
(?:<!--\s*(?:begin|end)\h+mod:\h+Thanks\h+for\h+posts\h*-->){2}\s*</ul>\s*(?:<(h\d)><a\h*href\h*=\h*['"]#\w{1,5}['"]></a></\1>\s*)?<p[^>]{0,20}><img[^\?]{9,250}<div\h*class\h*=\h*['"]content['"]><blockquote>[^\?]{9,199}onclick\h*=\h*['"]this\.target\h*=\h*['"]_blank['"];['"]>[^<]{0,15}</a></noindex><br>(?<X2141273>)
(?:<(div)\h*style[\h=]+['"]display:\h*none;?['"]>\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,50}\b(?:slot|bocoran)[^<]{0,50}</a>\s*</\1>\s*){3,}(?<X1213401>)
(?:<(Files)\s+\*\.(?:ph|s)\*>\s+Order\s+Deny,Allow\s+Deny\s+from\s+all\s+</\1>\s*)+<(\1Match)\s+['"]\^\(\w\.php\.?(?:\|\w{1,5}\.php\.?)+\)\$['"]>\s+Order\s+allow,deny\s+Allow\s+from\s+all\s+</\2>(?<X1218260>)
(?:<(script)[^\?]{0,49}\bsrc\h*=\h*['"][^/]{0,49}//(?:paxmedia|mwtraf)[^>]{0,99}></\1>)(?<X1185330>)
(?:<(script)\b[^>]{0,99}>\s*var\s+(\w{1,40})\s*=\s*(document\.)createElement\s*\(\s*['"]\1['"]\s*\);\s*\2\.setAttribute\s*\(\s*['"]src['"]\s*,\s*window\.atob\s*\([^;/><]{9,299};\s*\3(?:\w{1,9}\.)?appendChild\s*\(\s*\2\s*\);\s*</\1>\s*){2,}(?<X1190571>)
(?:<(script)\h+data\-cfasync\h*=\h*['"]false['"]\h+(?:type\h*=\h*['"]text/java\1['"]\h+)?src\h*=\h*['"](?:https?:)?//go\.mob(?:trks|isla)\.com/notice\.php\?p=\d{3,}&[^>]{1,99}>\h*</\1>){2}(?<X1185521>)
(?:<(span|div)\h*style\h*=\h*['"]display\h*:\h*none['"]\h*>\h*<a\s*href\h*=\h*['"]https?://[^/'";]{0,49}(?:sport|fashion|jordan|jersey)[^/'";]{0,49}\.com/?['"]>[^</\v]{1,99}</a>\h*</\1>\s*){3,}(?<X1171762>)
(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}><img[^>]{0,99}\btitle[\h=]+['"][^'"]{0,40}\b(?:escort|seks|sex)['"][^>]{0,99}></a>\s*){2,20}(?<X1233140>)
(?:<a\h*href\h*=\h*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^>]{1,99}><img[^>]{0,99}\bsrc\h*=\h*['"]https?://[^'"]{1,199}\.gif[^>]{0,99}></a>\s*){5,10}\Z(?<X1195551>)
(?:<a\h*style[\h=]+['"]color[\h:]+#\d{4};['"]\h*href[\h=]+['"][^>]{9,99}><(strong)>[^<]{0,40}\bslot\b[^<]{0,40}</\1></a>[^\?\n]{199,4000}\b\1>[^<]{0,40}\bslot\b[^<]{0,40}</\1></a>\s*){2,}(?<X1226241>)
(?:<a\s*href[\h=]+['"]https?://[^'"]+['"]>slot\d*\b[^<]*</a>(?:<br\h*/>)?\s*){2,9}(?<X1233114>)
(?:<a\s*style=['"]display[\h:]+none['"\s;]+href=['"]?https?://(?:[^\s'">]{0,199}(?:slot|togel|panen)[^>]{0,199}>|[^>]{0,199}>[^<]{0,49}(?:slot|togel|panen)[^<]{0,199}|(?:\d{1,3}\.){3}\d{1,3}\b[^>]{0,199}>[^</]{0,99})</a>\s*){3,}(?<X1230210>)
(?:<a\s*style[=\h]+['"]display:none;?['"]\h*href[\h=]+['"](https?://[^'"]+)['"][^>]+>\1</a>\s*){3,10}(?<X1212261>)
(?:<a\s+href=['"]https?://[^'"]+['"][^>]{0,49}\btitle=['"]([^'"]{0,49}\b(?:escort|shell|hacklink|paykasa(?:\s*al)?|indoxploit)\b[^'"]{0,49})['"][^>]{0,99}>\s*\1\s*</a>\s*){2,}(?<X1232540>)
(?:<a\s+href=['"]https?://[^>]+>[^</]{0,49}\b(?:slot|poker|bocoran)\b[^</]{0,49}</a>\s*(?:<br\s*/>\s*)?){3,}\Z(?<X1214531>)
(?:<a\s+href\s*=\s*['"]https?://[^/]{3,40}\.[a-z]{2,7}/wp\-(?:en|it|fr|pl|jp|pt|sp|de)\.html['"]\s+title[=\s]+['"](?:fake|replica)[^'"]{1,40}['"]\s+style\s*=\s*['"]position:absolute;(?:left|right):\-\d{4,12}px;['"]>[^><]{0,40}(?:fake|replica)[^><]{0,40}</a>\s*)+(?<X1220610>)
(?:<a\s+style=['"]display[\h:]+none;?['"]\s+href=['"]?https?://[^/'"]+\.(?:sch|ac|go)\.id/[^>]{0,199}>[^<]{0,49}</a>\s*){5,}(?<X1229100>)
(?:<a\s+style=['"]display[\h:]+none;?['"]\s+href=['"]?https?://[^>]+>[^<]{0,49}\b(?:slot|togel|gacor)\b[^<]{0,49}</a>\s*){9,}(?<X1229091>)
(?:<div\b[^>]*\bstyle=['"][^'"]*\b(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^>]*>\s*echo\s*base64_decode[\s\(]+['"]PGE[^'"]+['"][\s\)]+;\s*</div>\s*){2,}(?<X1201500>)
(?:<div\b[^>]{1,99}\bstyle=['"]display:none['"][^>]{0,99}>\h*<a\h+href=['"]https?://[^'"\s]+['"]\h*title=['"]([^'">]{1,49})['"]\h*>\1</a>\h*</div>\s*){2,9}(?<X1172882>)
(?:<div\h+style\h*=\h*['"]display\h*:\h*none\h*;\h*['"]\h*>\h*<a\h+href\h*=[^<]{9,70}\bshell\h*</a>\h*</div>\s*){9,}(?<X1138862>)
(?:<div\s+style=['"][^'">]*?\b(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}px)\b[^>]{0,49}>\s*(?:<a\s+(?:(?:href=['"]?https?://|title=['"]([^'"]+)['"])[^>]{0,49}){2}>\s*\1\s*</a>\s*)+</div>\s{0,4}){3,}(?<X1199894>)
(?:<div\s+style=['"]display[\h:]+none;?['"]>(?:<[ou]l>)?(?:<(?:li|p)>(?:<[^aploud\W]\w+>)?<a\b[^>/:]{0,99}\bhref=['"]?https?://[^>]+>[^<]{0,199}</a>(?:</[^aploud\W]\w+>)?</(?:p|li)>){3,}(?:</[uo]l>)?</div>){3,}(?<X1229162>)
(?:<Files\s*\*\.\w{1,2}\*\s*>\s*Order\s+Deny[,\s]+Allow\s+Deny\s+from\s+all\s*</Files>\s*)+<FilesMatch\s+['"]\^\([^\(\)\|]+\.[ps]h(?:p|tml)(?:\|[^\(\)\|]+\.[ps]h(?:p|tml))+\)\$['"]>\s*Order\s+allow[,\s]+deny\s*Allow\s+from\s+all\s*</FilesMatch>(?<X1280450>)
(?:<h1>[^/]{0,9}(?:H[4a]ck[e3]d|pwn[e3]d)\h*by\b[^/]{1,99}<\h*/h1>\s*){2}(?<X2141302>)
(?:<link\h+href\h*=\h*['"]http://(?:www\.)?cheapjerseys[^/]{1,99}\.com/[^'"]{1,99}\.(?:ico|css)['"]\h+rel\h*=\h*['"]stylesheet['"]\h+type\h*=\h*['"]text/css['"]\h*/>\s*){5}[^&]{99,9999}var\h+http_host\h*=\h*['"]cheapjerseys(?<X2144982>)
(?:<link\h+rel\h*=\h*['"]stylesheet['"]\h+type\h*=\h*["']text/css['"] href=['"]https?://(?:www\.)?cheapjerseys[^/]{1,99}\.\w{2,9}/[^\.'"]{9,99}\.css['"]\h*>\s*){5}[^&]{99,9999}var\h+http_host\h*=\h*['"](?:https?)?:?/?/?(?:www\.)?cheapjersey[^'"]{1,99}['"];(?<X2145033>)
(?:<meta[^>\v'"]{1,99}\bcontent\s*=\s*['"]\s*defaced\s*by\s*[^>\v]{1,99}/>\s*){3}(?<X2139180>)
(?:<meta\s*name=['"](?:author|copyright|publisher)['"]\s*content=['"]slot\s*(?:mania|online|bonus|gacor)['"]\s*(?:/\s*)?>\s*){2}(?<X2225383>)
(?:<meta\s+(?:content\h*=\h*['"](?:Defac|hack|stamp|fuck)ed\h*by\b[^>]{1,40}['"]\h*|name\h*=\h*['"][^'"]{1,20}['"]\h*){2}/?>\s*){2}(?<X2139195>)
(?:<spam\b[^>]{0,499}>\s*\w\s*</spam>\s*){5}(?<X2172970>)
(?:@(?:error_reporting|ini_set)\h*\((?:['"][^'"]+['"],)?(?:0|NULL|FALSE)\);\s*){2,5}@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1172700>)
(?:@file_put_contents\h*\(['"]?(?:\h*\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/(?:wp\-\w{4,9}/(?:uploads|css|ima?ge?s?)/)?|[\./]{12,60})wp\-[^\.]{1,40}\.php['"]\h*,\h*\$\w{1,40}\h*\)\h*;\s{0,9}){3,}(?<X1150960>)
(?:@include_once\h*\(\h*['"]/[hvt](?:ome|ar|mp)\b[^'"]{0,99}/\w{1,40}\.so['"]\h*\)\h*;)+(?<X1143300>)
(?:@ini_set\(['"](?:display_errors|log_errors)['"],['"]?(?:off|0|NULL)['"]?\);\h*){2,3}[^\?]{0,350}\bmove_uploaded_file\(\$[^\n]{9,799}(\$\w{1,25})\h*=\h*str_i?replace\([^\)]+\);\s*echo\h*['"][^=]{5,40}\b(script)\s*src\h*=\h*['"]{1,2}(?:\.\$\w{1,25}){3}\.\1\.['"]{1,2}></\2>[^;]{5,40};\s*\}(?<X1155541>)
(?:\$(?:message|spam|bilsmg)\s*\.?=\s*['"]\s*(?:\|\s*)?(?:Password|Pass|PWD?|P\b|PIN)[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);)[^\?]{1,700}\$headers\s*\.=\s*\$_POST\[['"]eMailAdd['"]\](?<X2044078>)
(?:\$(\w+)[\s=]+['"][^;]+;\s*){2,3}if\s*\([^;\{]+\{\s*(\$\w+)[\s=]+@?wp_create_user\s*\([^;]+\$\1\b[^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\2[\s\)]+;\s*\3\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[\s\}]+else[\s\{]+\3[\s=]+get_user_by\s*\([^\}]{1,499}\bwp_update_user\s*\([^;]+;\s*\}(?<X1213360>)
(?:\$(\w{0,40}(?:email|pass))\h*=\h*isset\((\$_[GPCSR]\w{2,6}\[['"]\1['"]\])\)\h*\?\h*\2\h*:\h*['"]{2};\s*){2}[^\(\{]{9,299}(\$\w{1,40})\s*=[^;]{0,49}\1[^\(]{1,499}\bmail\([^\);]{0,49}\3\b(?<X2140321>)
(?:\$(index|sitemap)_url\s*=\s*['"]https?://\$\w{1,40}/\1\.php\?[^;]{9,199};\s*){2}[^#%>]{99,2499}\}(?:\s*if\s*\([^\}]{1,99}\)\s*\{\s*@?header\s*\(\s*['"](?:Content-type:\s*text/html\b|HTTP/[123\.]+\h+(?:40[34]|30[12]))[^\}]{1,499}\b[de](?:ie|xit)[^;]{0,19};\s*\}\s*(?:else)?){3}\}?(?<X1188900>)
(?:\$(m[eas][gis](?:l|sage)?)\.=['"](?:Em?|e\-?ma[1i]l\s*(?:add\.?(?:ress)?|pass(?:word)?|id)?|pass(?:wo?r?d|code)?|pasw|pw|cvv\d?|id|(?:online|user|apple?|yahoo!?|login)\s*id|username|pin)\s*(?:\d\s*)?:[^;]{0,49}\$_POST\[[^;]{1,99};){2}[^\@]{9,1499}\b(?:mail|file_put_contents|fwrite|fputs)\([^;\?]{1,199}\$\1(?<X21359822>)
(?:\$(m[es][gs](?:sage)?)\.=['"](?:(?:User|login|e\-?mail|id|card)\s*(?:id|address|pass(?:word)?)?|pass(?:word)?|pin|cvv|ssn)\s*:\s*(?:['"]\s*\.\s*)?\$\w{1,40}[^;]{4,12};){2}[^\{@#`\?\*]{99,1499}\$(subject)=['"](?:Chase|Office(?:365)?)[^\?]{1,99}\bmail\([^\)]+(?:\$(?:\1|\2),){2}(?<X2138586>)
(?:\$(msg|message)\s*\.=\s*['"][^'"]{0,9}(?:(?:Email|login)\s*(?:add[res]{0,4}|id)?|pass(?:wo?r?d)?)\b[^;]{1,49}\$_POST\[[^;]{1,49};\s*){2}[^\?]{499,999}\$(sub|subject)\s*=\s*['"][^'"]{0,19}(?:Paypal|Apple?|AMA?ZO?N|ebay)\s*login[^\?]+\bmail\s*\([^\)]{1,49}(?:\$(?:\1|\2)\s*[,\)]\s*){2}(?<X2141180>)
(?:\$[0O_c6]{6,12}\s*=\s*\(?['"][^'"]{0,99}["']\)?;\s*)+\$[0O_c6]{6,12}\s*=\s*\$[0O_c6]{6,12}[\{\[]\d+[\]\}]\.[^\v]{1999,50000}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1125855>)
(?:\$[mbf](?:essage|sg|ilsmg|[cu]{2}k)\h*\.=\h*['"]\$victimInfo\d*\\n['"];\s*){2}(?<X2167592>)
(?:\$\w+=\$_[GPCSR]\w{2,6};){2}(\$\w+)=implode\(['"]{2},explode\([^;]+;(?:\$\w+=\1\(['"]\w+['"],['"]{2},['"]\w+['"]\);)+(\$\w+)=[^;]*\1\([^;]+;(?:if\([^;\{]{1,499}\{){2}[^\}\{]{1,499}\binclude[\s\(]*\1\([^;]+;\}else\{(\$\w+)=\1\([^;]+;(\$\w+)=\3\(['"]{2},\2\);\4\(\);\}\}(?<X1224050>)
(?:\$\w+[\s=]+(?:file|http)_ge(t_contents)[\s\(]+['"]https?://[^/'"]*\banonymousfox\.to\b[^;]+;\s*)+(?:(?:save|file_pu\1)[\s\(]+['"][^'"]*\.php\d*['"][\s,]+\$\w+[\s\)]+;\s*)+(?<X1197300>)
(?:\$\w+[\s=]+is_(?:spider|referer_search)[\s\(\)]+;\s*){2}\$\w+[\s=]+['"]https?://[^/'"]+\.xyz[/'"][^;]{1,99};\s*(\$\w+)[\s=]+['"]<script\b[^#%&]{999,4999}\bheader[\s\(]+['"]Content\-type:\s*text/html;[^;]{1,99};\s*echo\s*\$\w+;\s*((?:die|exit)\b[^;]{0,19};)[\s\}]+else\s*\{[^\}]{0,199}\becho\s*\1;\s*\2[\}\s]+(?<X1192940>)
(?:\$\w+\s*=\s*['"][\w\\]+?['"]\s*\^\s*['"][\w\\]+?['"];\s*)+\$\w+\(\$\w+\s*,\s*['"][\w\\]+?['"]\^['"][\w\\]+?['"]\s*,\s*['"]\w+['"]\);(?://\w{16,64})?(?<X1035402>)
(?:\$\w{1,10}=['"][str_o13gzinflaebdc64]{9,13}['"];){4}(\$\w{1,10})=['"][^'"]{65000,}['"];\s*eval(?:\(\$\w{1,10}){4}\({2}\1\){6};(?<X1128692>)
(?:\$\w{1,10}\s*=\s*"[^;]+;\s*)+\$\w{1,10}\s*=\s*\$\w{1,10}\((?:\$\w{1,10}\(){5,}.+\)\)\)\)\s*,\s*\$\w{1,10}\);\s*\$\w{1,10}\(\$\w{1,10}\);\s*include_once\(\s*\$\w{1,10}\s*\);(?<X1038991>)
(?:\$\w{1,12}\.?=['"]\\[^'"\s]{2,16}['"];){9,}\$\w{1,12}=(\$\w{1,12})\(\$\w{1,12}\)[^\v\*:\-]{999,9999}(\$\w{1,12})=\1\(\2\);\h*@\$\w{1,12}\(\2\);\h*\}(?:\h*;)?(?<X1171230>)
(?:\$\w{1,15}[\h\=\.]+['"][^'"]+['"];\h*){15,}(?:(\$\w{1,15})[\h=]+\$\w{1,15}\(\1\);\h*){3}\$\w{1,15}[\h=]+['"][^'"=/\+]{999,}Aid29yZHByZXNzX2xvZ2dlZF9p[^'"]+['"];\h*\$\w{1,15}[\h=]+['"]=[^'"]+['"];(?<X1202530>)
(?:\$\w{1,20}[\h=]+\$_SERVER\[(strrev)\(strtoupper\([^\)]+\)\)\];\s*){3,6}if\(!preg_match\([^@#%\}]{9,450}\)\s*\{\s*@?setcookie\h*\([^;]+\);\s*@?header\h*\(\1\h*\([^\.]{0,30}\d\?igc\.[^:]{9,99}[/:'"pth\.]{7,15}\s*:[locatin\.'"]{9,15}\)[^;]{1,150}\$\w{1,20}[\h\)]{1,4};\s*(?:exit|die);(?:\s*\}){3}(?<X1192001>)
(?:\$\w{1,20}\h*=\h*['"][^'"]{19999,}['"];\s*){2}[^\(]{99,300}\b(?:file_put_contents\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.(base64_decode)\(\$\w{1,20}\)\h*,\h*\1\(\$\w{1,20}\)+;\s*){2,3}[^@]{9999,}\}\s*;\s*(\$\w{1,20})\h*=\h*\1\(\2\);\s*@?(\$\w{1,20})\h*=\h*\w{1,9}\(\2,[^\)]+\);\s*@?eval\h*\(@?gzuncompress\(\3[\s\)]{2,5};(?<X1141784>)
(?:\$\w{1,20}\h*=\h*['"]\.ht(?:access|passwd)['"];\s*){2}[^=]{99,400}\bdie\(getimage\(\$_[GPRSC]\w{2,6}\[[^\]]+\][;\)\s\}]{5,9}\$\w{1,20}\h*=\h*DIRECTORY_SEPARATOR;\s*if\h*\(function_exists\(['"]php_uname['"][\)\{\s]{4,9}\$\w{1,20}\h*=\h*\(strtoupper\(substr\(PHP_OS\b(?<X2142280>)
(?:\$\w{1,20}\h*=\h*['"]https?://[^'";]{2,30}/\.\w{1,20}\.php['"];\s*){3}[^\(]{0,99}(\$\w{1,20})\h*=\h*array\([^\)]+\);\s*(\$\w{1,20})\h*=\h*array_rand\(\1\);\s*\$\w{1,20}\h*=\h*\1\[\2\];\s*(\$\w{1,20})\h*=\h*file\h*\(['"][^\.]{0,20}\.txt['"]\);\s*foreach\h*\(\h*\3\b(?<X2169421>)
(?:\$\w{1,20}\h*=\h*\$_SERVER\[strrev[^'"]{0,12}\(['"](?:tnega_resu|tsoh|rerefer)_ptth['"]\)[^;]{0,4};\s*){2}[^/\{]{0,90}\bif\h*\(!preg_match\h*\(['"]/(?:crawl|mobile)[^\?>]{99,900}\bsetcookie\h*\([^\;]+\);\s*header\h*\(strrev\h*\(['"]php[^;\)]+\)\);\s*(?:exit|die)[^;]{0,9};(?:\s*\}){3}(?<X1175381>)
(?:\$\w{1,20}\s*=\s*(?:chr\(\s*(?:\d+|ord\(["']\w+["']\))\s*[\^\+\-/\*]\s*(?:\d+|ord\(["']\w+["']\))\s*\)\.?)+;\s*){2,}.+?exit\(\$\{\w{1,20}\((?<X2035114>)
(?:\$\w{1,40}\[chr\(\d+\)\]\(\w+\("[\w/=]+"\)\);\s?){3,}\s*if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\|\|\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*OR\s*strpos\(\$\w+\s*,\s*\$\w+\)\)\s*\{(?<X1036052>)
(?:\$\w{1,40}\h*=\h*[wg](?:et_site_url|p_login_url)\(\);\s*){2}(\$\w{1,40})\h*=\h*['"][^@]{1,40}@[^/\}\[]{1,299}mail\(\1,[^\)]+\);\s*(\$\w{1,40})\h*=\h*\$_SERVER\[['"]DOC[^;]+/wp-\w{1,12}\.php['"];\s*(\$\w{1,40})\h*=\h*plugin_dir_path\(__FI[^;]+/\w{1,40}\.(?:html?|md|txt)['"];\s*@?copy\(\3,\h*\2\);(?<X1148560>)
(?:\$\w{1,40}\s*="[^"]*"\s*;(?:\s*\$\w{1,40}\s*=\s*str_replace\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;){2,}\s*){3}\$__\w{1,40}\('',"\};"(?<X2048681>)
(?:\$\w{1,40}\s*=\s*'[^']{1,200}';\s*){10,}\$\w{1,40}=str_replace\('[^']{1,50}','',(?:\$\w{1,40}[\s\.\)]+){10,};(?<X2045954>)
(?:\$\w{1,40}\s*=\s*(\$\w{1,40})\s*\[[\(\s]*\d+(?:\s*[/\-\*\+%\(])+\s*\d[^\]]*\](?:[\.\s]+\1\s*\[[\(\s]*\d+(?:\s*[/\-\*\+%\(])+\d[^\]]*\])+\s*;\s*)+(\$\w{1,40})\s*=\s*['"]{2}[^'"]+['"]{2}\s*;[^\.]{0,499}\$\w{1,40}\s*\.=\s*\2\s*;[^\(\)]{0,99}\$\w+\s*\(\s*\)\s*;(?<X1248080>)
(?:\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\s*\1\d+\}\s*\]\s*;\s*)+\$\w{1,40}\s*=[^>\n]{999,9999}foreach[\(\s]+\$\w{1,40}\s*as\s*\$\w{1,40}\s*=>[^>\n@]{999,}try\s*\{\s*\$\w{1,40}[\s=]+@?file_get_contents[\(\s]+\$\w{1,40}[^=]{0,499}(\$\w{1,40})[\s=]+fopen[^\n]{0,199}fclose\(\2\);\s*\}(?<X1200860>)
(?:\$\w{1,40}\s*=\s*['"][^'"]{0,49}(?:wtuds|sotpie)['"];\s*){2}[^#]{0,499}\$\w{1,40}\s*=\s*(?:array\s*\(|\[)(?:\s*['"]([#@/!%\176;])[^'"]{5,30}\1i?['"]\s*,){9}[^\)\]]{99,1999}[\)\]]\s;(?<X2129422>)
(?:\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*[^)]+?\s*\)\s*;\s*){4}\$\w+\s*=\s*\$\w+\(\s*\$\w+\(\s*\$\w+\s*\)\s*,\s*\d+\s*\);\s*\$\w+\s*=\$\w+\(\s*\$\w+\s*\);\s*\$(?<X2047111>)
(?:\$\w{1,40}\s*=\s*\$_POST\s*\[\s*['"](?:log|pwd)['"]\s*\]\s*;\s*){2}(\$\w{1,40})\s*=[^\{\}/]{9,499}(\$\w{1,40})\s*=\s*['"]https://api\.telegram\.org/bot['"]\s*\.\s*\1[^;]+;\s*@?file_get_contents[\s\(]+\2[\s\)]+;(?<X1239520>)
(?:\$\w{1,40}\s*=\s*\\'[^']{1,100}'\^\\'[^']+';\s*){3}\$\w{1,40}\s*=\s*\$\w{1,40}\(\\'\\'\s*,\s*\$\w{1,40}\(\$\w{1,40}\((?<X2050441>)
(?:\$\w{1,9}=['"][GETPOSCKIQUR_]{1,9}['"];){3,6}(\$\w{1,9})=[^;]{1,49};if\([^\$\n;\{]{0,9}\1[^\$\n;\[\{]{0,9}\[[^\]]+\]\)\)\{[^\}]{1,99}(\$\w{1,9})=\$\w{1,9}\(['"]{2},\$\w{1,9}\(\1\[[^;]+;\2\(\);\h*(?:die|exit)[^;]{0,19};\h*\}(?<X1140921>)
(?:\$\w{1,9}\h*=\h*(?:(chr\()\d{2,3}\)\.){2,}\1\d{2,3}\)+;\h*)+if\(\$\w{1,9}\((\$\w{1,9})\)\)\h*\{\2\((?:\1\d{2,3}\)\.){2,}\1\d{2,3}\)+;\h*\}\h*else\h*\{\h*(?:echo|print)[\h\(]+(?:\1\d{2,3}\)\.){2,}\1\d{2,3}\)+;\s*\}(?<X1182200>)
(?:\$\w{5,16} = (?:\d+|"\w+"|""|true|false);){5}\$\w+\s*=\s*"base64_decode";(?:\$\w+\s*=\s*(?:\d+|"\w+"|""|true|false);){5}(?<X2044742>)
(?:\$\{['"](?:\\x47|G)[^'"]{4,20}(?:\\x53|S)['"]\}\[[^\]]+\]=['"][^'"]*['"];){2}function\s*(\w{1,40})\(\$\w{1,40}\)\{[^\?\s@]{99,999}return\s*(?:\$)?\{\$\{['"](?:\\x47|G)[^'"]{4,20}(?:\\x53|S)['"]\}\[[^\]]+\]\}?;\}\s*@?eval\(\1\(['"][^'"]{999,}['"]\)+;(?<X1122240>)
(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{1,40}['"]\h*;\h*)+@?error_reporting\(0\);[^\v:>\*#&%\^]{99,9999}[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\([\$\{]{1,4}['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][^;]{0,9};(?:[^\v\}]{0,9}\})+(?<X1138310>)
(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{1,99}['"];\h*){2,}if[\(\h]+(?:isset[\(\h+])?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^@\v]{0,999}\bif[\h\(]+@[cm]o(?:py|ve_uploaded_File)[\(\h]+\$_FILES\[[^;]+;[^,\v!\*@]{0,499}else\s*\{\s*echo\b[^;]+;(?:\s*\}){2,}(?<X1183910>)
(?:\$_SESSION\[['"]x(?:username|password)['"]\]=\$\w{1,20};){2}[^://]{9,99}\$\w{1,20}=['"]https://idmsa\.apple\.com(?<X2159941>)
(?:\$arr_word\[\d+\]\[\]\s*=\s*['"]\d+["'];){10,}(?<X1037132>)
(?:\$func\d\s*=\s*strrev\(str_replace\('[^']+','','[^']+'\)\);\s*){3,}(?<X2051311>)
(?:\$port.bind\w{0,9}\h*=\h*['"][^'"]{99,1500}['"];\s*){2}\$back_connect\h*=(?<X2189051>)
(?:\((crontab)\s*\-l\s*\d+\s*>\s*(/dev/null)\s*;\s*echo\s*['"]\s*(?:\*\s+){5}(?:wget|curl)\h+\-[qs]\b[\s\-]+(?:\-O[\s\-]*)?http://(?:\d{1,3}\.){3}\d{1,3}/[^\s]{1,99}\.sh\W{1,9}sh\s*>\s*\2[^;\)]{0,19}\)[\s\|]+\1[\s\-]+){1,2};(?<X1197190>)
(?:\(\d{3,}\-\d{3,}\)\.[^\n]+\n(\$\w{1,40})[^\(]+\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\n]+\n).{99,499}?(?:\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\(]+\(\d{3,}\-\d{3,}\)\.[^\n]+\n\1[^\n]+\n).{0,499}\beval\b.{0,199}\(['"]e(?<X2213302>)
(?:\bdefine\h*\(\h*['"]\w{1,9}_bot(?:_id|net|_version)['"]\h*,\h*\d{1,9}\h*\);\h*\v){3}(?<X2139212>)
(?:\becho\b[^;]{1,99};(?:(\$\w{1,40})=(mysqli?_)query\(['"]SELECT\h+value\h+FROM\b[^\);]{0,99}\bcore_config_data\W?\h+where\h+path\h*=[^;]{0,99};[^\}@;#%\*:/<>\.\[\]\+\-]{1,199}\becho\h+Mage::Helper\(['"]core['"]\)\->decrypt\([^;]{1,99};\}\2free_result\(\1\);\}){2,}){3}(?<X2179710>)
(?:\bfunction\s*\w{1,19}Pass\((\$\w{1,40})\)\{if\((\$\w{1,40})=file\(\1\)\)\{foreach\(\2\s*as\s*(\$\w{1,40})\)\{if\([pe]reg\(['"](DB_PASSWORD)['"],\3\)\)\{\3=trim\(\3\);(\$\w{1,40})=(?:[^;]{1,99}\bstrpos\(\3,['"]\4['"]\)\h*\+\h*\d+){2}\)+;[\}\s]+if\(\5\)\{return\s*\5;[^@#!\*&\|:<>\?/]{1,49}){2}(?<X2163470>)
(?:\bRedirect\h*301\h*/(?:gtr\d+|0101a\d+)/\h*https?://[^\n]{9,99}\s*){5,20}(?<X1260570>)
(?:\{(file_put_contents\()[^,]+,base64_decode\(['"]PD9[^'"]{1,4999}['"]\)+;[^\}]{0,99}\b\1[^,]+\.htaccess['"],[^;]{1,99};\}\s*else\s*if\([^\{]{1,99}){3}\{[^:]{99,4999}['"]uggcf?://[^@]{99,4999}\bunlink\(['"][^'"]+\.php['"]\);(?<X2182540>)
(?:Dim\s*shell_\w{1,40}\s*as\s*string\s*=\s*['"][^\v]{1,99}['"]\s*){5,7}(?<X2130014>)
(?:fputs\(\$\w{1,9},['"]\s*(?:join|privmsg|notice|away|nick|part)[^\)]{5,50}\);){5}(?<X2129800>)
(?:function\s*\w{1,20}\([^\)]{9,99}\)\{return\s*str_replace\([^\)]{9,99}\);\}\s*){3}(?:(\$\w{1,20})\s*=\s*['"]\w{9,99}['"];\s*\1\s*=\s*\w{1,20}\(['"]\w{1,15}['"],['"]{2},\1\);\s*){3}[^\?]{99,200}\$\w{1,20}\(["']\w{999,30000}['"]\);\?><\?php(?<X1127890>)
(?:if\(\$\w{1,40}==['"](?:mysql|postgre|oracle)_(?:error|union)['"]\)\{\$\w{1,40}=str_replace\(['"]\$payload_(?:union|error|oracle)['"],[^;]{99,499};\$\w{1,40}=\d+;\$\w{1,40}=\(GetBetween\(file_get_contents\([^\)]+\)\)-\d+\);\}else){3}(?<X2137240>)
(?:if\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=='[^']*'\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\(\s*htmlspecialchars\s*\(\s*file_get_contents\s*\(\s*'[^']*'\s*\)\s*\)\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}\s*){2}(?:\s*//file\s*end)?(?<X1036941>)
(?:include\h+['"][^;]{0,20}\banti(?:\d+|bots?)\.php['"];\s*){5}[^\$\{]{99,999}\bif\h*\(!isset\h*\([^\)]+\)\)\S*\{\s*exit\(header\s*\(['"]Location:\h*https?://(?:www\.)?(?:outlook|gmail|paypal|yahoo)\b(?<X2146031>)
(?:loc_data\([^\)]+\);\s*\$\w{1,40}\h*=\h*){2}[^;]{1,40};\s*(?:\$(to_drop|msg|message|bilsmsg|fuck)\h*\.=\h*['"]\h*\d\h*:\W{1,9}\$_POST\[['"][up]['"]\][^;]{1,49};\s*){2}[^\?]{99,499}\bmail\([^\)]+\$\1(?<X2141611>)
(?:mail\((?:\$\w+,\s*\$\w+,\s*\$\w+(?:,\s*\$header)?\))|(?:stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\)\));(?:\s*\})?)\s*if\(\$\w+\)\s*\{\s*echo\s*'\w+';\s*\}\s*else\s*\{\s*(?:echo)?\s*'\w+\s*:\s*'(?<X2045052>)
(?:subject|sub)\h*=\h*['"]\W{0,4}YAHOO\h*LOGINZ\W{0,4}['"];\s*\$\w{1,25}\h*=\h*['"][^'"]{0,49}\bgmail\.com['"];\s*\$\w{0,25}\h*=\h*['"]Visitor\b(?<X2183450>)
(@include_once\()['"](/[^'"]{19,99}/user/\d+/)[^;]{1,99}\.php['"]\);(?:\s*\1['"]\2[^;]{1,99}\.(?:png|gif|jpe?g|ico)['"]\);){1,}(?<X1181920>)
(@system)\h*\(\h*['"]killall\h+\-9\h+['"]\h*\.\h*basename\h*\(\h*['"]\.?/?(\w{1,40}\.so)['"]\h*\)\h*\);\s*@?file_put_contents\h*\(\h*['"]\.?/?\2['"]\h*,\h*['"]\\x[a-f\d]{2}[\\xa-f\d]{9999,}['"]\h*\);\s*@?chmod\h*\(\h*['"]\.?/?\2['"]\h*,\h*0\d{3}\h*\)\h*;[^\?]{9,999}\1\h*\(\h*['"]\./\w{1,9}\.sh['"]\h*\);(?<X1168000>)
(\$(?:log.user|username|uname|user))\h*=\h*(\$_POST\[)[^\]]+\];\s*(\$(?:log.)?pa?s?s?wo?r?d)\h*=\h*\2[^\]]+\];[^\\\{]{99,300}(\$\w{1,20})\h*=\h*['"][^\$]{2,20}\.\1\.[^;]{1,60}\.\3\.[^;]{0,99};[^@/]{9,99}(?:@fwrite\(fopen\([^\)]+\),\4\);\s*){3,6}\s*\}(?<X1174510>)
(\$(?:mail)?subj?(?:ect)?)\h*=\h*['"]We\s*tran?sfer\s+log[sz]?['"];[^\?]{9,299}\bmail\([^\)]+\1[^;]{1,99};\s*(?:\}\s*)?\s*function\s+visitor_country\(\)\s*\{(?<X2148161>)
(\$(?:str|fiti?\w|html|joomla\w{1,20}|wfk))\h*=\h*["']PGRpdiB[^'"]{99,800}['"];\s*echo\h+base64_decode\(\1\);(?<X1157824>)
(\$(\w{1,40}))\h*=\h*\$\h*\{\h*['"]_[GPRSC]\w{2,6}['"]\h*\}\h*;[@\h\(!]+\$\h*\{\h*@*['"]\2['"][\h\}\{]+\[?['"][^'"]+['"]\]?[\h\}@]+\S{2,3}@*(?:\1|\$?\{\h*@*['"]\2['"][\h\}\{]+)[^;\?:]*(?:['"][^'"]+['"][\h\}\)]+)?\?[@\h]*\$[\h\{@]+['"]\2['"]\h*\}\h*:[^;\$]*\$[\h\{@]+['"]\2['"]\h*\}[\h\{@]*\[?['"][^'"]+['"]\]?[\h\}\(]+\1[\{\h\[@]+['"][^'"]+['"]\]?[\h\}\)]+;(?<X1195690>)
(\$(\w{1,40}))\h*=\h*\$\h*\{\h*['"]_[GPRSC]\w{2,6}['"]\h*\}\h*;[@\h\(]+\$\h*\{\h*@*['"]\2['"][\h\}\{]+['"][^'"]+['"][\h\}@]+\S{2,3}@*\1[\{\h@]*['"][^'"]+['"][\h\}\)]+\?[@\h]*\$[\h\{@]+['"]\2['"]\h*\}\h*:[^;\$]*\$[\h\{@]+['"]\2['"]\h*\}[\h\{@]+['"][^'"]+['"][\h\}\(]+\1[\{\h@]+['"][^'"]+['"][\h\}\)]+;(?<X1195660>)
(\$(shell)_source\d*)[\h=]+\$\w{1,20}[\.\s]+['"]/\2_index/\2\d+\.html[""];\s*if[\(\s]+check_remote_file_exists\(\1(?<X2161101>)
(\$[0o]{1,12})\h*=\h*['"][a-f\d]{32,64}['"];\s*if\b[^\{]{0,499}\(\h*!?\h*\(\h*isset\h*\(\h*(\$\w{1,40})\h*\)\h*\S{2,3}\h*(?:md5|sha[1256]{1,3})\h*\(\h*\2\h*\)\h*\S{2,3}\h*\1[\)\s]+\{\s*[^;]{1,20}404\h*not\h*found['"]\h*\)\h*;(?<X2173653>)
(\$[0O]{1,9})\s*=\s*urldecode\([^\)]{9,150}\);\s*\$[0O]{1,9}\s*=\s*(?:\1\{\d{1,2}\}\.){3}[^\?\(]{9,1599};\h*function\h+(alfa)\h*\((\$\w{1,40})\)\s*\{[^a]+,\3\);\s*\}\s*\$[^\(\{\?\}\$]{9999,}(\$\w{1,40})\h*=\h*["'][^'"]{999,}['"];\s*\4\h*=\h*\2\(\4\);\s*@?eval\(\$[0O]{1,9}\(\4\)+;(?:\s*return;)?(?<X1140530>)
(\$[0o_]{1,4})\h*=\h*urldecode\(['"][^'"]{60,}['"]\)\h*;[^/\\\*\v]{99,9999}\bcurl_setopt\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_USERAGENT\h*,\h*\1\{\d+\}\h*\.[^\v`\*]{99,9999}\bfunction\h*(\w{1,40})\h*\([^;]+\bglobal\h*\1;[^\v\*>]{999,}\}\h*\2\(\)\h*;(?<X1188980>)
(\$[^\s=]{1,60})\h*=\h*@?create_function\h*\(\h*(?:['"]{2}|null)\h*,\h*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s)]+;(?:\s*(\$[^\s=]{1,60})\h*=\h*['"]\w{1,40}['"]\s*;)?\s*\W{0,3}(?:\1|\2)(?:\s*\})?\s*\(\)\s*;(?<X1187181>)
(\$[htmlinks]{4,5})\h*=\h*(getContent)\((\$url),[^<]{9,99}(?:\1\h*=\h*str_replace\(['"]<a[^@]{9,200},\1\)\h*;\s*){3}[^\{]{99,1500}echo\s+\1;\s*function\s+\2\(\3,(?<X2138944>)
(\$[o0_]+)\h*=\h*['"][^#]{9,999}\bglobal\h*(\$\w{1,9});\s*\2[\h=]+urldecode\(\1\);[^#]{1,399}(\$\w{1,15})[\h=]+(curl)_init\(\);\s*\4_setopt\(\3,[^#\n]{99,9999}\bdefine\(['"](BASE_PATH)['"][^;]{1,49};\h*file_put_contents\(\5\.['"]/robots\.txt['"],[^#]{1,9999}\bheader\(['"]http\S{2,4}\h*404\b[^;]+;\s*\}(?<X1190862>)
(\$[O_0]+)\s*=\s*urldecode[\(\s]+['"]%[a-f\d%]{40,199}['"][\s\)]+;(?:\s*\$[O_0]+\s*=(?:\s*\1\[\d+\]\s*\.)+\s*\1\[\d+\]\s*;)+\s*\$[O_0]+\s*=\s*\$\{['"]GLOBALS['"]\}\s*\[['"][O_0]+['"]\]\s*\(['"]\$[O_0]+[\s=]+\\?['"]+\\?['"]+\s*,[^\-]{999,9999}\$[O_0]+['"\)\s\};]+\$\{['"]GLOBALS['"]\}\[['"][O_0]+['"]\]\(1\);(?<X1206350>)
(\$\w+)(?:=(?:"(?:assert";\1\(['|"]eval\(gzuncompress\(base64_decode\(['|"][^'|^"]+'\)\)\);['|"]\);exit;(?<X2054980>)|base64_decode";assert\(\1\('[\w=]+'\)\);(?<X1035101>))|'(?:base64_decode';(\$\w+)='create_function';if\(!empty\(\$_REQUEST\['(\w+)'\]\)\){(\$\w+)=strrev\(\$_REQUEST\['\5'\]\);(\$\w+)=\4\('',\1\(\6\)\);\7\(\);}(?<X2054970>)|preg_replace';(\$\w+)='eval\(base64_decode\("[^"]+"\)\);.*?;(\$\w+)="/(\w+)/e";\1\(\10,\9,'\11'\);(?<X2054960>))|(?:['"]\w+['"])?(?:\.chr\(\w+\s*(?:\-|\+|\*|/)?\s*\w+\)\.)+[^;]+;(\$\w+)=(?:['"]\w+['"])?(?:\.?chr\(\w+\s*(?:\-|\+|\*|/)?\s*\w+\)\.)+[^;]+;(\$\w+)=\13\(\1\);(?:\$\w+=\14;)?(?:\$\w+=['"]\d+['"];[^!]+if\(\!\$\w+\)\{class\s*(\w+)\{private[^@]{1,5000}\$\w+=new\s*\15\(\);\$\w+=['"]\w+['"];\})?(?<X1252141>)|(?:sm|d)outdo\(\$\w+\);if\(!stri?str\(\1,['"]nobotuseragent['"]\)+\{(?:if\(stri?str\(\1,['"](?:(?:ok|ping)[^'"]+getcontent['"][^\{;]+\{[^\}]{0,999}\becho\b[^;]{0,49}\1\)*;|getcontent(\d{3})page['"][^\{;]+\{[^\}]{0,999}\bheader\(['"]HTTP/[\d\.]{1,3}\s*\17\b[^\}]{0,999}\b)(?:die|exit)\b[^;]{0,19};\}(?:else\s*)?){3,}\}(?<X1234280>)|(curl_)init\(\);(?:(\$\w+)=['"]https?://[^'"/;\?]{0,49}\b(?:githubusercontent|paste(?:bin|\.ee)|ghostbin)\b[^\}\?=]{1,199}\b\19setopt\(\1,CURLOPT_URL,\20\);[^\}\?=]{0,499}(\$\w+)=\19exec\(\1\);echo\s*\21;(?<X1229760>)|\19setopt\(\1,CURLOPT_URL,['"]https?://(?:[^;]{0,49}?\.\$\w+\.){2}[^\?\}]{1,999}(\$\w+)=\19exec\(\1\);\19close\(\1\);if\([^;\{]*\23\b[^\{;]{1,99}\{[^\}]*\bhttp_response_code\(40[34]\);[^\}]*(?:die|exit)\b[^;]{0,19};\}[^\?]{0,199}\?><meta\s+http\-equiv=['"]?refresh['"]?\s+content=['"]0;\s*url=[^>]{1,99}>(?<X1225970>))|['"](?:[^'"]{32,99}['"];error_reporting\(0\);(\$\w+)=['"]\w+['"];\25=\1\[[^;]{1,512};\25=\25\.\1\[[^;]+\;\25=\25\.\1[^;]+;\25=\25\.\1\[[^;]+;\25=\$_SERVER\[\1\[[^;]+;\25=\$_SERVER\[\1\[[^;]{1,99}\.\1\[\d+\]\];(?<X1277750>)|\w{32,64}['"];[^\}\?]{0,199}\binclude(?:once)?\((?:\$\w+\.)?['"]wp\-config\.php['"]\);[^\?#]{99,999}\bif\(\1!=\$_[GPCSR]\w{2,6}\[[^;]{0,99}\b(?:die|exit)\b[^;]{0,19};(?<X2197062>)|\w{32}['"];[^\?\{]{0,499}\bfunction\s*(\w+)\(\$\w+\)\{[^\}]+(\$\w+)\.?=pack\([^\?]{1,99}\breturn\s*\29;[^\?\{]{1,99}\bif\((?:md5\()+(?:getenv\(|\$_SERVER\[)['"]HTTP_USER_AGENT['"][\]\)]+!=+\1\)\{header\([^\);]+\b40[34]\s*(?:Not|forbidden)\b[^\}]+exit\b[^;]{0,19};\}(\$\w+)=['"]\28['"];(?:\$\w+=\30\([^;]+;){9}(?<X2224071>)|chr['"];(?:(\$\w+)=(?:\1\([\d\-\.\+\*/%]{0,49}\)\.)+\1\([\d\-\.\+\*/%]{0,49}\);)+eval\([^\)'"]{0,49}\32\([^\)'"]{0,49}['"][\w/\+=]{999}(?<X2224151>)|file_exists['"];(\$\w+)=['"]chmod['"];\$\w+=['"]touch['"];\$\w+=['"]unlink['"];(\$\w+)[^;]{1,99};(\$\w+)[^@]{1,100}(\$\w+)=\$_[GPRSC]\w{2,6}\[[^\]]+\]\.['"]/\w+\.php['"];(\$\w+)=['"](?:\w+(?:\-|/|\.))+\w+['"];if\(\1\(\38\)+\{\34\(\37,\d+\);\$\w+=\36\(\38\);\$\w+=\35\(\37[^;]+;\34\(\37,\d+\);\}\}(?<X1259281>)|https?://[^;]+;(\$\w+)=curl_init\([^\}\{]{0,199},CURLOPT_URL,\1\)[^\}\{]{0,199}(\$\w+)=curl_exec\(\40\);curl_close\(\40\);(\$\w+)=['"]([^'"]+)['"];file_put_contents\(\42,\41\)[^\{\}]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec)\(['"]\43['"]\);(?<X1228980>)|range['"];(\$\w+)=\1\(['"][^'"\w]+['"],['"][^'"\w]+['"]\);(?:includ|requir)e(?:_once)?[\s\(]*(?:\45\[[^\]]+\]\.)+\45\[[^\]]+\][\s\)]*;(?<X1226390>))|['|"]\w+\.zip['|"];\s*(\$\w+)\s*=\s*file_get_contents\(['|"][^'|^"]+['|"]\);\s*file_put_contents\(\1,\s*\47\);.*?pclzip\.lib\.php.*(\$\w+)\s*=\s*new\s*PclZip\(\1\);\s*if\s*\(\48->extract\(\)\s*==\s*0\)\s*{\s*die\("Error\s*:\s*"\.\48->errorInfo\(true\)\);\s*}(?<X1035062>)|[^;]{0,199}\.(?:htaccess|php)['"];(\$\w+)=[^;]{0,199}\.(?:htaccess|php)['"];(\$\w+)=[^;]{0,199}\.(?:css|ttf|js|txt|woff\d*)['"];(\$\w+)=[^;]{0,199}\.(?:css|ttf|js|txt|woff\d*)['"];(?:(?:if\([^;\{]{1,199}\{){2}chmod\((\1|\50),[^;]+;file_pu(t_contents\()\53,file_ge\54(?:\51|\52)\)+;chmod\(\53,[^;]+;\}{2}){2}(?<X1233750>)|[preg_replace'.\s]+;\s*(\$\w+)\s*=.*?\1\(["']\56["']\s*,.*?,\s*["']\w+["']\);(?<X1035870>)|\$(?:\w+\(['"]HTTP_COOKIE['"]\);(\$\w+)=\$\w+\([^\}\{]{1,199}\bforeach\(\58\s*as\$\w+\)\{[^\}]{0,199}\1\[[^\]]+\]+=[^\}]{1,199}\}\((\$\w+\(\1\))==\d+&&in_array\(\$\w+\(\1\)\.\59,\1\)+\?\(+\1\[\d+\]=\1\[[^;:\}\{]{1,199}&&\1\(\)+:\1;(?<X1227150>)|_[GPCSR]\w{2,6}\[[^;]{1,99};[^;]{0,199}\1=file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\?]{19,499}\beval\(\1\);(?:die|exit)\b[^;]{0,19};(?<X2196061>))|array\([^;\)\$]{0,199}(?:['"](?:role['"]=>['"]administrator|user_pass['"]=>['"][^'"]+)['"][^;\)\$]{0,199}){2}\);if\([^\{;]+\{(\$\w+)=(wp_insert_user\(\1\);)update(_option\(['"]\w+['"]),\62\)[^\}]{0,99}\}(?:else\{[^\{\}]{1,499}\{(\$\w+)=get\64\);\1\[['"]id['"]\]=\65;\63\}\})?(?<X1225040>)|f(?:ile_get_contents\(['"][^'"]+\.(?:ttf|otf|woff2?)['"]\);eval\([^;]{0,199}\1\)+;(?<X1229440>)|unc_get_args\(\);if\(!function_exists\((\$\w+)\)+\68=\w+\(\68\);unset\(\1\[[^;]+;(?:return\s*)?call_user_func_array\(\68,\1\)(?<X2224211>))|range\(['"]\W+['"],['"]\W+['"]\);(\$\w+)=\$\{(?:\1\[[^\]]+\]\.){3}[^;]+;if\(+in_array\(gettype\(\70\)[^\{;]{1,199}\{[^;]{0,199}\beval\(\70\[[^\]]+\]\(\$\{\70\[[^;]+;\}(?<X1234340>)|s(?:candir\(\$_SERVER\['DOCUMENT_ROOT'\]\);for\((\$\w+)=0;\72<count\(\1\);\72\+\+\){if\(stristr\(\1\[\72\],'php'\)\){(\$\w+)=filemtime\(\$_SERVER\['DOCUMENT_ROOT'\]\."/"\.\1\[\72\]\);break;}}touch\(dirname\(__FILE__\),\73\);touch\(\$_SERVER\['SCRIPT_FILENAME'\],\73\);.*?(\$\w+)=new ZipArchive\(\).*?\74->extractTo\(\$\w+\);.*?<form enctype="multipart/form-data" method="post" action=""><label><input class="\w+" type="file" name="\w+" /></label><br /><input type="submit" name="submit" class="\w+" value="\w+" /></form></body></html>(?<X2054990>)|trrev\([^;]+;eval\((?:\$\w+\(){0,9}\1\((?:\$\w+\(){0,9}['"][^'"]{9999,}['"]\)(?<X2224081>))|wp_remote_post\((?:base64_decode\(['"]aHR0c|['"]https?://)[^;]+;if\(\1\[[^;\{]{1,199}\{eval\(\1\[[^\]]+\]\);\}(?<X1232200>))|[=\s]+@?fopen([\(\s]+)['"](?:[^'"]{1,99}/)?wp-includes/[^'"]+\.php['"][\s,]+['"][\w\+]{1,4}['"]([\)\s]+);\s*(\$\w+)[=\s]+['"]\s*<\?[ph\s]+@eval\78base64_decode\78['"][^'"]*['"]\79+;\s*['"];\s*@?fwrite\78\1[\s,]+\80\79;\s*@?fclose\78\1\79;(?<X1218421>)|[\h=]+(?:['"](?:/(?:home\d?|var)/[^'"]+\.\w+\.css['"];\s*if[\h\(]+!isset[\h\(]+\1[\s\)\{]+\w+[\h\(]+\1[\h\)]+;[\s\}]+else[\s\{]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\1[\h\)]+;\s*\}(?<X1283781>)|[^;]+;\h*(\$\w+)[\h=]+(?:\w+[\h\(]+)?(?:\1\[\d+\][\h\.]+){5,}\1\[\d+\][\h\)]*;\h*(\$\w+)[\h=]+\$\{[^\}]+\1\[\d+\][\h\)]+\}\[[^\]]+\];\h*if\h*\([^;\{]{1,99}\{\h*@?eval[\h\(]+\83[\h\(]+\84[\h\)]+;\h*\}(?!else)(?<X1215510>)|\?>['"]\s*;\s*eval[\h\(]+\1[\h\.]+(?:file_)?get(?:_contents)?[\h\(]+base64_decode[\h\(]+['"]aHR0cHM6Ly9wYXN0ZS5lZS9[^'"]+['"][\h\)]+;(?<X1268251>)|https?://\w+\.sicp\.me/\w+['"];\s*(\$\w+)[\h=]+@(file_)get(_contents)[\h\(]+\1[\h\)]+;\s*if[\h\(]+\87[^\{]+\{\s*(\$\w+)[\h=]+[^;]+;\s*\$\w+[\h=]+@\88put\89[\h\(]+\90[,\h]+\87[\h\)];\s*if[^\{]+\{[^\}]+(?:\}\s*else\s*\{[^\}]+\}\s*){2}(?<X1254530>)|index['"];\s*(\$\w+)[\h=]+wp_upload_dir[\h\(\)]+;\s*(\$\w+)[\h=]+\92\[[^\]]+\][\h\.]+['"]/[^\$]+/\1\.zip/\1\.php['"];\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]phar://['"\h\.]+\93;(?<X1235900>))|array[\h\(]+[\d,\h]+\);\s*(\$\w+)[\h=]+['"]{2};\s*foreach[\h\(]+\1\h*as\h*(\$\w+)[\s\)\{]+if[\h\(]+\96[^\{]+\{\s*\95[\h=\.]+(?:['"]|chr\(|\96)?[^\?]{0,299}(\$\w+)[\h=]+\95[\s\(]+(?:file_get_contents|\$\w+)[\s\(]+\95[^;]+;[^\?]{0,99}\beval[\h\(]+\97[\h\)]+;(?<X1269461>)|f(?:ile_get_contents[\h\(]+['"]https?://r(?:aw\.githubusercontent\.com/css\-wordpress/[^'"]+/js['"][\h\)]+;\s*echo\h*\1;(?<X1237680>)|ealestat\.lol/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;(?<X1237670>))|unction[\h\(]+(\$\w+)[\h\)]+\{\h*return\h+strtr[\h\(]+\101\h*,[^;]{1,99};\h*\};\h*\$\w+[\h=]+\1\h*\([^\n\?\+/]{1,499}(\$\w{1,40})[\s=]+\$\w+[\h\(]+['"]{2}[\h,]+(?:\$\w+[\h\(]+){1,}['"][^'"\s]{999,}['"][\s\)]+;\s*\102[\h\(\)]+;(?<X1194091>))))
(\$\w+)(?:[\s=]+(?:(?:\[|array\()[^\]\)]*\$_[GPCSR]\w{2,6}\b[^;]{0,499};\s*if\s*\([^\)]*\1\[\d+(\]\[\1\[)[^;\{]+\{\s*(\$\w+)[\s=]+\1\[(?:\d+\2[^\]]+\]+\(\1\[){2}[^\}]{0,499}\3\[[^\]]+(\]\(\3\[)[^;]+;\s*(?:requir|includ)e(?:_once)?\s*(?:\(\s*)?\3\[[^;]+;\s*\3\[[^\]]+\4[^;]+;\s*\}(?<X1197790>)|(curl_)init[\s\(]+(base64_decode)[\s\(]+(?:['"]aHR0c[^'"]+|strrev[\s(]+['"][^'"]+c0RHa)['"][\s\)]+;[^\}]{0,499}\$(\w+)[\s=]+\6exec[\s\(]+\1[\s\)]+;\s*(\$\w+)[\s=]+(?:\7\s*\([^;]*)['"](?:<\?|4zp|pz4)['"][^;]*;@?eval[\s\(]+\9[\s\.]+\$\8[\s\)]+;\s*(?:die|exit)\b[^;]{0,19};(?<X1197730>)|@?f(?:ile_get_contents[\s\(]+['"]https?://pastebin\.com/raw/[^'"]+['"][\s\)]+;\s*@?echo[\s\(]{0,5}\1[\s\)]{0,5};(?<X1225730>)|open[\s\(]+['"][^'"]*\bwp\-links?\.php['"][^;]+;\s*(\$\w+)[\s=]+@?file_get_contents[\s\(]+['"]https?://[^;]+;\s*(?:\$\w+[\s=]+)?@?fwrite[\s\(]+\1[\s,]+\12[\s\)]+;\s*fclose[\s\(]+\1[\s\)]+;(?<X1198580>))|['"](?:<\\x3f[^=]{1,499}\\x\w+['";\s]+(\$\w+)\s*=[^;]+;\s*@?file_put_contents[\s\(]+\14[\s,]+\1[\s\)]+;\s*(?:@?(?:includ|requir)e(?:_once)?[\s\(]*\14[\s\)]*;\s*)?@?unlink[\s\(]+\14[\s\)]+;(?<X1227031>)|sulele333@onmail\.com['"];[^\?]{1,499}\$(\w+)[\s=]+\$_[GPSRC]\w{2,6}\[[^\?]{1,199}\$(\w+)\s*\.?=\s*['"][^;]{0,199}\$\16[^\?]{1,999}\bheader[\s\(]+['"][^\?]{1,199}\bmail[\s\(]+['"]?\1\b[^\);]+,\s*\$\17\s*\)\s*;(?<X2228101>)))|\.=(?:\(+(\$\w+\s*&\s*0x)\d{4}\)\?(?:(\(+\19\d{4}\)\?)['"]\w['"][\s:]+['"]\w['"]\)[\s:]+\20)?['"]\w['"][\s:]+['"]\-['"]\)+;\1\.=){8}[^\}]{1,499};return\s*\1;\}\s*echo\b[^;]{1,299}\bBlackhat</(?<X2221100>)|\=array_merge\(\s*\$_[GPRSC]\w{2,6}\s*,\s*\$_[GPRSC]\w{2,6}\);\s*foreach\s*\(\1\s*\w+\s*\$\w+\s*=>\s+(\$\w+)\)\s*\{\s*\22[^\(]+\(\w+\(\w*\(base64_decode\(\22\)[^\}]{1,999}\}\s*elseif\s*\(\22[^\{]{1,999}\{\s*eval\(\22[^\;]+;\s*\}\s*(?:exit|die)[^\}]+\}\s*\}(?<X1248610>)|\[\d+\]\s*=\s*\w+\s*\(\s*array\([\d,\s\)]{4,128};\s*\$\w+\s*=\s*\d+;\s*(\$\w+)\s*=\s*\$_COOKIE;\s*\$\w*\s*=\s*['"]\d+['"];\s*\24\s*=\s*\1\[\d+\]\(\24,\s*\$_POST\)(?<X2277991>)|\s*=\s*(?:['"]/\w+/[^;]{8,128}\.\w+\.(?:\\x63|c)ss['"];\s*if\s*\(empty[^;]{1,128};\s*\}(?:\s*\w+)?\s*\{\s*@?include(?:_once)?[^\}]{1,99}\(\1\);\s*\}(?<X1269252>)|file_get_contents\(['"]https?://\w+\.(?:rpka\.org|pejuangbola88\.com)/\w+\.php[^\$]+echo\s*\1(?<X1252211>)|scandir\(\$_SERVER\['DOCUMENT_ROOT'\]\);\s*for\s*\((\$\w+)=0;\28<count\(\1\);\28\+\+\)\s*{\s*if\(stristr\(\1\[\28\],\s*'php'\)\)\s*{\s*(\$\w+)\s*=\s*filemtime\(\$_SERVER\['DOCUMENT_ROOT'\]\."/"\.\1\[\28\]\);\s*break;\s*}\s*}\s*touch\(dirname\(__FILE__\),\s*\29\);\s*touch\(\$_SERVER\['SCRIPT_FILENAME'\],\s*\29\);\s*chmod\(\$_SERVER\['SCRIPT_FILENAME'\],\s*0444\);(?<X1035051>)|urlencode\(\$_SERVER[^\{]+\{\s*\$\w+\s*\=\s*array\([^\)]+(?:Googlebot|TelegramBot)[^;)]+\);[^\^]+://[^\\}]+\.txt[^\{]+\{\1[^\;]{1,512};\s*[^;]{1,64};\s*echo\s*\$\w+;\s*(?:die|exit);\s*\}(?<X1279222>)))
(\$\w{1,10})\h*=\h*file_get_contents\(['"]https?://usaklubgacor\.com[^'"]+['"]\);[^;]+json_decode\(\1\);[^\}]{1,100}\}(?<X1265851>)
(\$\w{1,12})(?:=\$\w{1,12}\((?:['"]{2}|null),(?:\$\w{1,12}[\(\.]){9,}\$\w{1,12}\){3,};@?\1\(\);(?<X1182430>)|\h*=\h*base64_decode\h*\(\h*['"][a-z=]{3,9}['"]\h*\)\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*(?:\.\h*(?:['"][^'"]*['"]|base64_decode\h*\(\h*['"][a-z=]{3,9}['"]\h*\))\h*)?;\h*@?\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1157870>))
(\$\w{1,14})(?:=(?:\$_SERVER\[['"](?:HTTP_X_FORWARDED_FOR|HTTP_CF_CONNECTING_IP)['"]\];(\$\w{1,14})=explode\(['"\s,]+\1\);(\$\w{1,14})=\2\[\d\];(\$\w{1,14})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\.gethostbyaddr\(\3\);\$\w{1,14}=preg_match\([^\)]{1,70}yandex[^\)]{1,70}\)/i['",]+\4(?<X2280491>)|urldecode\(['"]https?://volovmart\.ru[^\$]{1,30}\$_GET[^\)]{1,60}file_get_contents\(\1\)\)!=false\)(?<X2280520>))|[\s=]+get_headers[^\!]{1,60}strpos\(\1\[['"]Content-Type['"\],\s]+pdf[^$]{1,20}\$\w{1,14}[\s=]+file_get_contents[^%]{1,20}[\s='"]+%PDF-[^<]{1,140}<\?=[^\?]{1,25}eval[^\>]{1,25}[>"\.]+file_get_contents[^\)]{1,70}[\);\s]+(?<X2284170>)|\s*=\s*\$_SERVER\[['"]HTTP_(?:USER_AGENT|REFERER)['"]\];\s*if\((?:strpos\(strtolower\(\1\)\s*,\s*strtolower\(['"][w\.]*?(?:google|bing)[^'"]{1,10}['"]\)\)\s*!==\s*false[\|\s\)]+){1,5}\s*\{\s*[^\}]{1,200}(?:\$\w{1,14})\s*=\s*['"]https?://[\w\d./]+['"];[^\}]{1,300}echo\s*['"]?[^;]+['"]?;\s*\}(?<X2274020>))
(\$\w{1,15})(?:=\(gzinflate\(str_rot13\(base64_decode\(['"][^'"]{99,999}['"]\)+;\s*(\$\w{1,15})=fopen\([^\}]{9,90}\}else\{\s*fwrite\(\2,\1\);\s*fclose\(\2\);\s*\}(?<X1147730>)|[\h=]+(?:'[^']{999,5000}';\s*(\$\w{1,15})[\h=]+base64_decode\([^\)]+\);\s*eval\(\4\(\1\)\);(?<X1198540>)|(curl_)init\(\);\s*\6setopt\(\1,\h*CURLOPT_URL,\h*['"]https:?//archive\-h\.org/[^'"]{1,50}\.php['"]\);\s*\6exec\(\1\);(?<X1198260>)|['"\.indexph]{9,20};\s*(\$\w{1,25})[\h=]+['"\-\./wpincludes]{9,20}[^;]+;\s*if[\h\(]+(file_)exists[\h\(]+\8[\h\)]+[^\{]+\{\s*(\$\w{1,25})[\h=]+\9get(_contents)[\h\(]+\8[\h\)]+;\s*\$\w{1,25}[\h=]+\9get\11[\h\(]+\1[\h\)]+;[^#]{99,999}\b\9put\11[\h\(]\1,\h*gzinflate[\h\(]+\10[^;]+;\s*\}(?<X1218030>)|\(\$_SERVER\[[^\]]+\][\h=]+['"]wp_is_mobile['"]\);\s*(\$\w{1,15})[\h=]+\$_COOKIE;\s*\(count\(\13\)[\h=]+\d+\W{1,4}\1\)\h*\?[^;]{1,150}\)\)\h*:\h*\13;(?<X1200990>)|str_replace[\h\(]+(base64_decode)[\h\(]+[^\)]+\)\h*,[^,]+,\h*urldecode[\h\(]+\15[\h\(]+['"][^'"]{999,7000}['"][\h\)]+;\s*(\$\w{1,15})[\h=]+dirname[\h\(]+__FILE__[\h\)]+;\s*(?:file_put_contents[\h\(]+\16[\h\.]+\15[\h\(]+[^\)]+\)\h*,\h*\1[\\h\.]+[^\)]+\);\s*){1,2}(?<X1215110>))|\h*=(?:\h*(?:(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\(['"]{2},\h*\18[^\]]+\]\(\18[^\]]+\]\([^\)]+[\)]+;\s*\1\(\);(?<X1193940>)|(base64_)decode\(['"][^'"]{0,99}['"]\)\.\20encode\((\$\w{1,15})\)\.['"]&[^;]{0,150};\s*(\$\w{1,15})\h*=\h*@?file_get_contents\(\1\);\s*if\(empty\(\22\)\)\{\s*function\h+(\w{1,15})\([^\{]{0,25}\{\s*\$\w{1,15}\h*=\h*curl_[^\}]{0,299}\}\s*\23\(\1\);\}[^#]{0,650}\breturn\h*\21\[\$type\];\}(?<X1184280>)|(base64_decode)\(['"][^;]+;\s*(\$\w{1,15})\h*=\h*\25[^\?]{9,399}@?(chmod)\(\1,\d{3,4}\);[^;]{1,99};\s*@?\27\(\1,\d{3,4}\);[\}\s]+[^\?]{1,599}@?\27\(\26,\d{3,4}\);[\s\}]+(?<X1186681>)|['"][\.'"str_o13]{5,20}['"];[^\(]{0,49}(\$\w{1,15})\h*=\h*\$\{\1\h*\(['"\._PBXVR]+\)\h*\};\s*\(\h*count\h*\(\h*\29\h*\)[^:]{1,150}:\29;\s*(\$\w{1,15})\h*=\h*\1\h*\(['"\.cevag_]{7,19}\)\h*;\s*@?\30\h*\([^\)]+\)\h*;(?<X1166601>)|['"][^']{1,50}'(\^')[^\$]{1,50};\s*(\$\w{1,15})\h*=\h*\1\(['"]{2},['"][^']{9,299}'\32[^\)]{9,299}['"]\);\s*\33\(\);(?<X1176221>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\(\h]+\1\D{2,3}['"][^'"]+['"][\)\s]+\{(\$\w{1,15})\h*=\h*(\$_FILES\[)['"][^;]{1,50};\s*(\$\w{1,15})\h*=\h*\36[^;]{1,50};\s*echo\h*['"]<form[^;]{0,150};\s*@?(?:copy|move_uploaded_file)\(\35,\h*\37\);(?<X1194080>)|\barray\(\$\{['"]_[GPRSC]\w{2,6}[^\]]+\],\h*['"]create_function['"],['"](?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)[^\$]+\$\{['"]_COOKIE['"]\},['"]https?://['"]\.\$\{['"]_SERVER['"]\}\[[^;]+;\s*\$\w{1,9}\h*=\h*\1\[\d+\]\(['"]aHR0cDovLz(?<X2188831>)|array\((?:['"][^'"]{1,9}['"]\h*,\h*){3}[^\)]{99,999}\);[^\.]{1,99}\$\w{1,40}\h*=\h*\1\[\d+\]\h*\.[^\?!]{99,1999}\beval\([^;\}]{2,30}\);\s*(?:\}\s*){0,2}if\(!\$\w{1,15}\)\{(?:\s*(\$\w{1,15})\h*=\h*\1\[\d{1,3}\]\h*\.[^;]+;){3,}\s*\$\w{1,40}\h*\(\$\w{1,40}\);\s*echo\(\40\);\s*\}(?<X1162353>)|file_get_contents\h*\(\h*str_rot13\h*\([^;]{9,49}/blog/\w{1,15}['"]\h*\);\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*['"]\?>['"]\h*\.\h*\1\h*\);(?<X1191941>)|fopen\([^\)]+\);\h*(\$\w{1,15})\h*=\h*@?file_get_contents\(['"]https?://pastebin\.com/[^'"]{9,50}['"]\);\h*fwrite\(\1,\h*\43\);\h*fclose\(\1\);(?<X1138681>)|range\(\d+,\h*\d+\);\s*(\$\w{1,15})\h*=\h*\$\{(?:(chr)\(\1\[\d+\]\)\.){6}[^;]{0,99};\s*(\$\w{1,15})\h*=\h*\45\[\46\(\1\[\d+[\]\)]+;\s*if\(md5\(\47\.\47\)[^\{]{1,99}\{\s*\$\w{1,15}\([^\)]{1,50}\)\h*\.\h*['"]\(\45\[\47\]\)['"][^\}]{1,99}\};(?<X1193970>)|str_replace\([^\)]+\);[^\{\?]{0,250}(\$\w{1,15})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\49\(\1\([^\)]+\)\);\s*(\$\w{1,15})\h*=\h*@?\50\(['"]{2},\h*\51\);\h*@?\52\(\);(?<X1195202>))|\s*function\h*(get_page)\h*\(\$\w{1,15}\)\s*\{[^\}]{9,850}\}\s*\}\s*if\h*\(\$\w{1,15}\h*=\h*\54\h*\(['"]https?://myopencart\.net/[^\}]{9,500}\1\h*=\h*str_replace\h*\(\$\w{1,9},\h*\$\w{1,9},\h*\1\);\s*(?:ini_set|error_reporting)\h*\([^\}]{9,150}\}\s*else\s*\{\s*echo\h*\1;\s*\}(?<X1155790>)))
(\$\w{1,16})(?:\h*=\h*@?preg_replace\h*\(\h*['"]/\[[a-z]{1,9}\]/['"]\h*,\h*['"]['"]\h*,\h*['"]\w{13,}['"]\h*\)\h*;[^\)\(\}\{]{1,499}\$\w{1,9}\h*=\h*(\w{1,40})\h*\(\h*\1\h*\(\h*['"][a-z\+/\d]{4,40}=?=?['"][\h\)]+;[^\+\{\}/,\*]{99,999}\$\w{1,9}\h*=\h*\2\(\1\(['"][^'"]{9999,}['"]\)\);(?<X2176241>)|\s*=\s*(\$\w{1,16})\s*\[[\s\(]*\d+\s*[\-\+\*/]\s*[\d\(][^;]+\4\s*\[[\s\(]*\d+\s*[\-\+\*/]\s*[\d\(][^;]+;[^\{\}]{0,199}\bif[\s\(]+\$\w{1,16}\s*[=!<>]+\s*md5[\s\(]+\1[\s\)]+\{\s*\1\s*=[^\}]+\}\s*return\s*\1[\s\(]+\$\w{1,16}[\s\)]+;(?<X1248823>))
(\$\w{1,16}\[['"](\w{1,33})['"]\])\h*=\h*['"][a-f\d]{32}['"];\s*if\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\h*\[['"]\2['"]\])\h*\)\h*\S{2,3}\h*md5\h*\(\h*\3\h*\)\h*\S{2,3}\h*\1[\s\)]+\{[^;]+\b[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\*\-\?]{1,499}=\h*new\h+Mailer\h*\((?<X2169060>)
(\$\w{1,19})[\s=]+['"][^'"]{9999,}['"];\s*(\$\w{1,15})[\h=]+\$_SERVER\[[^\]]+\]\h*\.\h*['"][^;]{9,99}\.php['"];\s*if\(file_exists\(\2\)\)\s*@?unlink\(\2\);\s*(\$\w{1,15})[\h=]+base64_decode\(\1\);\s*(\$\w{1,15})[\h=]+fopen\(\2[^\)]+\);\s*fwrite\(\4,\h*\3\);\s*fclose\(\4\);(?<X1198110>)
(\$\w{1,20})(?:(=array\()['"]\\['"][pf][^,]+,['"]zilla['"]\);[^\{]{0,250}\bforeach\(\1\h*as\h*\$\w{1,20}\)\s*\{\s*if\([^\{]{1,40}\)[\s\{]+\$\w{1,20}\2[^;]{1,60};(\$\w{1,20})=["'](?:aHR0cH|http)[^;]+;[^\}]{1,60}(\$\w{1,20})=(curl_)init\((?:\3|\$\w{1,20})\);[^\}\?]{99,400}\b\5exec\(\4\);[^\}]{1,30}[\}\s]+(?<X1193770>)|=(?:(base64_decode)\(\$\w{1,20}\);\s*(\$\w{1,20})=\7\([^\)]+\);\s*(\$\w{1,20})=\1\.\8;\s*(\$\w{1,20})=str_rot13\(base64_encode\(\9\)\);[^@\{\}]{0,99}\bmkdir\(([^\)]+images/)['"]\);\s*chmod\(\11[^\.]{1,20}\.(?:jpe?g|png|ico)\b[^\}\{]{9,99}\bfwrite\(\$\w{1,20},md5\(\10(?<X2190512>)|(curl_)init\(\);[^\(]{0,40}\13setopt\(\1,curlopt_url,base64_decode\(['"]aHR0[^;]{9,99}\);\s*\13setopt\(\1[^@\}\{#]{9,99}(\$\w{1,20})=\13exec\(\1\);\s*\13close\(\1\);\s*eval\(\14\);(?<X1205890>)|@?(base64_decode)\([^\)]+\);\s*if[\h\(]+@?function_exists\h*\(\1\)\)\s*\{\s*(\$\w{1,20})[\h=]+@?\1\h*\(["']{2}[\h,]+@?\16\h*\(["'][^'"]{9,1500}['"]\)\);\s*@?\17\(\);\s*\}(?<X1191720>)|["'](?:base64_decode['"];\s*(\$\w{1,20})=["']strrev['"];\s*(\$\w{1,20})=["']file_put_contents['"];[^\(]{0,30}\bif\(!?file_exists\(([^\)]+)\)[^>#@\*]{99,500}\$\w{1,20}=\19\(\1\([^\)]+\)[^\{\}]{99,400}\{\s*\$\w{1,20}=\20\([^\)]+\);\s*\}\s*\$\w{1,20}=\20\(\21,\$\w{1,20}\);\s*\}(?<X1187280>)|https?://[^/'"]{0,19}\brootinjector\.\w{2,6}/[^'";]{1,60}\.(?:txt|php)['"];\s*if\(isset\([^\)]+\)\)\s*\{[^\}]{1,40}\}\s*if\([^\{]{9,99}\)\s*\{\s*(\$\w{1,20})=file_get_contents\(\1\);\s*echo\h*\23;\s*\}(?<X1192481>))|['"](?:[^'"]{1,40}\.php['"];\s*(\$\w{1,20})=['"]wp\-[^'"]{9,99}\.ttc['"];\s*if\([^\{]{1,40}\{chmod\(\1,\d+\);\s*(\$\w{1,20})=(file_get_contents)\(\25\);\s*(\$\w{1,20})=\27\(\1\);\s*(\$\w{1,20})=substr\(\28,strr?pos\(\28,['"]<\?php\s*['"]\)\);\s*file_put_contents\(\1,gzinflate\(\26\)\.\29,LOCK_EX\);\s*\}(?<X1221710>)|[^'"]{9,50}['"];(\$\w{1,20})=['"]{2};(foreach)\([^\)]+\)\s*\{\s*\31\.?=(\1\[[^\]]+\])[^\}]+\}\s*if\(isset\([^\}\n]{30,250}\}\s*\32\([^\)]+\)\s*\{\s*(\$\w{1,20})\.?=\33;\s*\}\s*(\$\w{1,20})=\34\([^\)]+\);(\$\w{1,20})=\35\(['"]{2},\$\w{1,20}\(\$\w{1,20}\)\);\36\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1142630>)|[^;]{9,50}/[^;]{1,30}\.pii['"];\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]*['"]?\1['"]?[\h\)]*;(?<X1195970>)|base64_decode['"];\s*eval\(\1\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?<X1194120>)|file_put_contents['"];(\$\w{1,20})\h*=[^;]{2,99};\1\(['"][^'"]+['"],['"]<\?php\h*['"]\.\40\);[^\{]{9,99}\bif\(file_exists\(\40\)\)\{include\(\40\);unlink\(\40\);(?:exit|die)[^;]{0,9};[^<:/]{20,150}\bfunction\h*\w{1,20}\(\)\{echo\h*['"]<script[^:]{1,60}\bsrc=['"]https?://(?<X2177261>)|https?://[^'"]{9,99}/\w{1,20}\.php['"];\s*\1=\1\.[^;]{2,40};\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6};\s*(\$\w{1,20})=\42;\s*\43=str_replace\(['"]base64_decode\([^;]{9,40}\43\);[^\?#&]{99,250}(\$\w{1,20})=stream_context_create\([^;]+;\s*(\$\w{1,20})=file_get_contents\(\1[^\)]+,\44\);\s*echo\h*\45;(?<X1190330>))|[^;]{0,30}\b(file_)ge(t_contents)\((?:\$\w{1,20}|https?://|/)[^;]{0,20};\s*\47pu\48\((?:\w{1,20}\.txt|\$\w{1,20}),\1,LOCK_EX\);\s*header\(['"]Location:https?://[^\?]{9,99}\?\w{1,20}=caixa['"]\);(?<X1200660>)|[^;]{1,30}\.php['"];\s*(\$\w{1,20})=[^;]{1,30}\.htaccess['"];\s*\$\w{1,20}=explode\([^,]+,file_get_contents\([^\)]+\)\);[^,\\/]{9,99}\$\w{1,20}=array\((?:['"]/wp\-(?:includes|admin|content)/[^'"]{1,60}\.php['"],){10}[^@%\*]{400,1500}\btouch\(\50[^;]+\);(?:\s*chmod\((?:\1|\50),\d+\);)+[^\}]{0,9}\}(?<X1192951>)|[^;]{1,40}\bsys_get_temp_dir\(\);\s*\$\w{1,20}=\1\.['"]/sess_\w{32}['"];[^\}]{99,650}[\}\s]+\bfunction\h+do.backdoor[^\(]{0,9}\((?<X2187250>)|\$\{?['"]?_[GPRSC]\w{2,6}['"]?\}?;(?:if)?\(+count\(\1\)[^\)]{0,99}\b(?:md5|in_array|sha\d+)\(gettype\(\1\)[^\{\};\?:]{1,199}[\?\{]\(+\1\[[^\]]+\]=[^;:\?]{1,199}\1=\1\[[^\]]+\]\(\1\[[^;:]{1,199}\1\(\)+:\h*\1;(?<X1191751>)|array\(['"]<[^\?\[\]]{99,1500}\);(if\(strpos\()[^\{]+\)\{[^\{]{9,99}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*(\$\w{1,20})=>\$\w{1,20}\)\{\54\55,['"]wordpress_logged_in['"][^\?\\]{99,400}\bfile_pu(t_contents)\([^\?%#]{9,150}(\$\w{1,20})=ob_ge\56\(\);\57=str_replace\(array_keys\(\1\),\1,\57\)[^\n]{0,20}echo\h*\57;\}(?<X1178530>)|explode\(['"][^,]+,file_get_contents\([^;]{1,40}\);\$\w{1,20}=['"]<\?php\h+copy\(['"]https?://[^'",]{9,99}\.txt['"],['"][^'"]{2,40}\.php['"]\);\?>['"];[^\{\}]{0,99}\bforeach\(\1\h*as\h*\$(?:web.)?shell\)(?<X2181951>)|fopen\((?:["'][^'"]{1,40}\.(?:php|txt)['"],['"]w\+['"]\);\s*(\$\w{1,20})=file_get_contents\(['"]https?://[^\)]{9,99}\.(?:txt|php)['"]\);\s*\$\w{1,20}=fwrite\(\1,\60\);\s*fclose\(\1\);(?<X1191861>)|['"][^'"]{1,20}\.txt['"][^\)]+\);\s*(\$\w{1,20})=fopen\(['"]https?://pastebin\.com/raw/[^\)]+\);[^\{]{1,30}\{\s*(\$\w{1,20})\.?=fgets\(\62\);[\}\s]+fwrite\(\1,\63\);\s*fclose\(\1\);(?<X1200670>))|getcwd\(\);\s*\}\s*\1=str_replace\(['"][^'"]+['"],['"]MrKrT[5s]8x['"],\1\);\s*(\1s?)=explode\([^\)]+\);\s*foreach\(\65\h*as\h*\$key=>\$value\)(?<X2169470>)|ob_get_contents\(\);\s*ob_end_clean\(\);\s*preg_match\(['"]/\-\-(?:prefix|bindir)=\([^,]+,\1,(\$fKi[1l]{2})\);\s*if\(\(isset\(\67\[\d+\][^\{]+\{\s*return\h*\67\[\d+\]\h*\.\h*['"](?:bin)?/php\b(?<X2183141>)|str_replace\(['"][^'"]+\.php['"],['"]{2},__FILE__\);\s*if\(file_exists\((\1[^\)]+)\)\)\s*\{\s*\$\w{1,20}=file_get_contents\(\69\);[^:\\]{99,200}\$\w{1,20}=['"]https?://[^/'"]{1,20}\.ddns\.net/[^'"]{0,20}\.php['"](?<X2183222>))|[=\h]+str_replace\(['"]([^'"]+)["'],["']{2},[^;]{9,99};(?:\s*(\$\w{1,20})[\h=]+\1\(['"]\71['"],[^;]{9,99}\);){1,4}(\$\w{1,20})[\h=]+\1\(['"]\71['",]+(?:\w\71){9,99}[^;]{1,40}\);\s*(\$\w{1,20})=[^;]{1,40};\s*\$\w{1,20}=\72\((\$\w{1,20})\(\74\)[\s,]+\75\(\73\)\);\s*if\([^\?>]{99,999}\bchmod\([^\)]+\);(?<X1194190>))
(\$\w{1,20})(?:[\h=]+(?:(@base64_decode)[\h\(]+[^\)]+\);\s*if[\h\(]+@?function_exists[\h\(]+\1\)\)\s*\{\s*(\$\w{1,20})[\h=]+@\1[\h\(]+['"]{2}\h*,\h*\2\h*\(['"][^'"]{99,300}(?:ZXZhbChiYXNlNjRfZGVjb2Rl|YWwoYmFzZTY0X2RlY29k|dmFsKGJhc2U2NF9kZWNvZGUo)[^'"]{999,3000}["']\)\);\s*@\3\(\);\s*\}\s*\Z(?<X1189690>)|['"][base64_dco\.'"\h]{20,90}['"];\s*(\$\w{1,20})[\h=]+['"][_\.'"POSTGE\h]{6,30}['"];\s*(\$\w{1,20})[\h=]+\$\{\5\};[^\{]{1,60}\bif[\h\(]+isset[\h\(]+\6\[[^\]]+\]\)\)[\s\{]+(\$\w{1,20})[\h=]+\1\(\6\[[^\]]+\]\);\s*@?eval\(\7\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1191820>)|[^;]{9,70}\.php['"];\s*(\$\w{1,20})[\h=]+[^;/]{9,60}/\.htaccess['"];\s*(\$\w{1,20})[\h=]+[^;/]{9,60}/wp\-[^;]{9,90}\.(?:css|txt)['"];\s*(\$\w{1,20})[^\(]{9,150}\bif\(\1[^\)]+\10[\)\{\s]+[^/\\'"]{99,400}\b(file_)pu(t_contents)\(\9[\h,]+\12ge\13\(\11\)\);\s*@?chmod\(\9,[^\)]+\);(?:\s*\}){2}(?<X1192830>)|\$(?:\w{1,20}\[\d+\]\(['"]https?://[^'"]{9,40}\.txt['"]\);\s*(?:\1[\h=]+str_replace\([^\)]+\1\);\s*){5,15}\bclass\h*(\w)[\{\s]+(?:public\h*)?function\h+(\w{1,20})\((\$\w{1,20})\)[\{\s]+@?eval\(\17[^;]+\);[\}\s]+(\$\w{1,9})[\h=]+new\h*\15[\(\)\h]{2,5};\s*\18\->\16[\h\(]+\1[\h\)]+;(?<X1210421>)|_[GPRSC]\w{2,6}(?:[\s;]+(\$\w{1,20})[\h=]+\$_[GPRSC]\w{2,6}[\s;]+(\$\w{1,20})[\h=]+array_merge[\h\(]+\20[\h,]+\1[\h\)];[^\{]{0,999}\bforeach[\h\(]+\21\h*as\h*(\$\w{1,20})[\h=>]+(\$\w{1,20})[\)\s\{]+\$?\w{1,49}[\h\(]+\23[\h,]+\$\w{1,9}[\h,]\22(?<X2254852>)|\[[^\]]+\];\s*(?:(\$\w{1,20})[\h=]+array\(['"][^,]+['"][,\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*uasort[\h\(]+\25[,\s]+base64_decode\(\1\)\);(?<X1215640>)|if\(function_exists\([^\{]{1,20}\{\s*(\$\w{1,20})[\h=]+@?(curl_)init\(\);\s*@?\28setopt\(\27,curlopt_url,\1\);[^\?\{]{20,150}(\$\w{1,20})[\h=]+\28exec\(\27\);\s*@?eval\(\29\)[^\?><]{1,35}(?:exit|die)[^;]{0,9};[\}\s]{1,2}(?<X1212811>))))|array\h*\((?:['"][a-zA-Z0-9\+/]+["'],){200}['"][^\);]{999,}\);\s*(\$\w{1,20})[\h=]+(strrev)[\h\(]+['"]edoced_46esab['"]\);\s*(\$\w{1,20})[\h=]+\32[\h\(]+["']etalfnizg['"]\);\s*@?eval[\h\(]+\33[\h\(]+\31[\h\(]+implode[\h\(]+['"]{2},\1[\h\)]{4};(?<X1190541>)|curl_init[\h\(]+['"]https?://[^/]{0,9}github[^/]{1,20}\.com/[^'"]{0,40}\b(?:shell|backdoor)[^'"]{0,40}\.(?:php|txt)['"]\);\s*(\$\w{1,20})[\h=]+fopen[\h\(]+['"][^;\)]+\);\s*(curl_)setopt\(\1[\h,]+CURLOPT_FILE[\h,]+\35\);[^\{]{1,50}\b\36exec\(\1\);[^\}]{1,99}\}\s*\36close\(\1\);\s*fclose\(\35\);(?<X1215611>)|f(?:ile_get_contents[\h\(]+['"](?:[^'"]{1,40}\.txt['"]\);\s*@?eval[\h\(]+base64_decode[\h\(]+\1[\)\h]+;(?<X1217980>)|https?://[^/]{1,20}(?:github|pastebin)[^\.]{1,20}\.\w{2,6}/[^'"]{0,40}(?:web|reverse)?(?:shell|backdoor)[^'"]{0,40}\.(?:php|txt)['"]\);\s*echo\h*\1;(?<X1216090>))|open\((?:(?:urldecode|base64_decode)[\h\(]+){2,}['"][^'"]{9,99}['"]\)\),['"]\w\+?['"]\);\s*@?constant[\h\(]+eval[\h\(]+fgets[\h\(]+\1[\h\)]{3};(?<X1213000>)))|[\s=]+['"](?:/\w[^'"\\]{0,99}\\x[a-f\d]{2}[^'"]{0,99}/\.[^'"]{1,99}['"];(?:\h*@include(?:_once)?[^;\$]*\1[^;]*;(?<X1253981>)|\s*(?:(\$\w{1,20})[\s=]+\1[\s;]+strpos[\s\(]+\42[,\s]+["']\w{1,10}['"\s\)]+;\s*@include(?:_once)?[^;\$]*\42[^;]*;(?<X1255420>)|strpos[\s\(]+\1[,\s]+["']\w{1,10}['"\s\)]+;\s*@include(?:_once)?[^;\$]*\1[^;]*;(?<X1254400>)))|wp\-\w{1,16}\.php['"];\s+while[\s\(]+!file_exists[\s\(]+\1[\s\)\{]+[^/'"]+\1[\s=]+['"][\./]+['"]\.\1[^\(=]+if[\(\s]+file_exists[\(\s]+\1[\s\)]+require(?:_once)?[\(\s]+\1[\s\)];(?<X2257712>))|\.=\(\((\$\w+)&0x\d+\)\?\(\(\46&0x\d+\)\?[^:]+:\h*['"]x['"]\)\h*:\(\(\46[^;]{1,20}\);\s*return\h*\1;[\}\s]+\?><(?:!doctype\h*)?html>[^\?]{9,99}<title>[^/]{0,20}(?:shell|backdoor)[^/]{0,20}</[^\?]{99,400}<\?[ph\s]+echo\(\(uname\(['"]php_uname['"]\)\)(?<X2217030>))
(\$\w{1,20})\h*(?:=\h*(?:(?:\$\w{1,20}\.?){5,9};\s*if\h*\(\h*\$\w{1,20}\h*\W{2,3}\h*(?:md|sha)[1256]{1,3}\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*\1\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*;\s*\}\s*else\s*\{\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1159931>)|(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/wp\-)[^;]{1,20};\s*(\$\w{1,20})\h*=\h*['"][^'"]{2,20}\.php["'];\s*if\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*\3[^:]{9,99}\bif\h*\(file_put_contents\h*\(\1\.\4[^\(]+\(['"]https?://[^\*>]{99,600}\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)\(\1\.\4\);(?<X1187490>)|(file_)ge(t_contents)\h*\(['"]https?://pastebin\.com/raw\.php\?i=\w{1,20}['"]\);\s*\6pu\7\(['"][^'"]{0,49}\.php['"],\1,FILE_APPEND\);(?<X1188373>)|(str_replace)\h*\(['"]google\-analytics\.com['"]\h*,\h*[""]{2},\h*\1\);\s*\1\h*=\h*\9\h*\(['"]<div[^:/]{9,99}<a\h+href\h*=\h*https?://[^@%#]{300,7500}\bfunction\h+Createlink\h*\((?<X2172800>)|@?\$_[GPRSC]\w{1,20}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*@?\$_[GPRSC]\w{1,20}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*\1\.\11;\s*(\$\w{1,20})\h*=\h*str_replace\h*\(\1\h*,\h*['"]{2}\h*,\h*\12\);\s*\$\w{1,20}\h*=\h*create_function\h*\(['"]{2}\h*,\h*\13\);(?<X1188620>)|['"]['"\.ero_pting]{16,45}['"];\s*\1\h*\((?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*['"][gzuncompres\.'"]{13,30}['"];\s*(\$\w{1,20})\h*=\h*['"]['"base64_dco\._]{14,30}['"];\s*@?eval\h*\(\15\h*\(\16\h*\(['"][^'"]{999,15000}['"][\)\h]+;(?<X1184860>)|['"][^'";]{0,60}/etc/(?:\$\w{1,20}/)?shadow['"];[^\(]{0,60}(\$\w{1,20})\h*=\h*fopen\h*\(\1\h*,\h*['"]w\+?['"]\);\s*fwrite\h*\(\18\h*,\h*\$\w{1,20}\);(?<X2188661>)|['"][^'"]{1,20}\b(sitemap\.xml)['"];[^@]{2,80}@unlink\h*\(\1\);\s*@?(file_put_contents)\h*\(\1,\$\w{1,20}\);\s*\21\h*\(['"][^'"]{0,9}map\.log['"]\h*,\h*['"]#\20[^\?:\\]{99,500}\bfunction\hcurl_get\w{0,6}_from_webpage\h*\((?<X2185131>)|['"][creat_funio'"\s\.]{16,35}['"];\s*(\$b374k)\h*=\h*\1[^;]{0,150};['"]\);\s*\23\h*\((?<X2171650>)|['"]\W{5,20}\W{5,20}\h*Created\h*by\h*\w{1,20}\b[^:]{9,40}:\h*\$(?:email|u(?:ser)?(?:name)?|login)[^:]{9,40}:\h*\$(?:password|pass|pwd|passwd)\b[^\}>]{9,499}\bmail\([^\)]+\1(?<X2153651>)|['"]aHr(?:0c[^'"]{5,50}['"];\s*if\h*\([^\{]{9,99}\{\s*(?:exit|die)[^;]{0,9};\s*\}\s*echo\h+@?file_get_contents\(base64_decode\(\1\)\.\W{1,9}(http_build_query)\([^=]{9,40}\bstream_context_create\(array\([^&]{20,150}=>\h*\26\([^\[]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\s\)]+;(?<X1141751>)|[^'"]{1,40}(?:dGVtcGxhdGV1cGRhdGVyLmRsaW5rZGRucy5j|bXBsYXRldXBkYXRlci5kbGlua2RkbnMuY29t|ZW1wbGF0ZXVwZGF0ZXIuZGxpbmtkZG5zLmNv)[^'"]+['"];\s*\$\w{1,20}\h*=\h*base64_decode\(\1\);(?<X2149470>))|['"]EggShell['"];\s*\$\w{1,20}\h*=\h*['"]\1\h*by\b(?<X2138570>)|['"]https?://(?:[^'"]{2,99}['"];\s*(\$\w{1,20})\h*=\h*['"]\.?/wp-(?:admin|includes|uploads)/[^;\(\)]{2,40}\.php['"];\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);[^\{]{9,150}(\$\w{1,20})\h*=\h*\32exec\(\31\);\s*if\(!?\33\)\s*\{\s*\33\h*=\h*@?(file_)ge(t_contents)\(\1\);\s*\}\s*\34pu\35\(\30,\h*\33\);(?<X2165150>)|[^'"]{9,99}/\w{1,20}\.(?:jpe?g|gif|svg|png|bmp|tiff)['"];\s*(\$\w{1,20})\h*=\h*['"][file_gtcons\.'"]{18,30};\37\h*=\h*\37\(\1\);\s*(\$\w{1,40})\h*=\h*strrev\(['"]stnetnoc_tup_elif['"]\);\s*\38\([^,]+,\h*\37\);(?<X1150540>)|[^/]{2,40}/shell_index/['"]\.\$domain_name\d*\.str_replace\(['"]\.php\d*['"],['"]\.html['"],[^\);]+\);\s*\$\w{1,20}\h*=\h*get_headers\(\1\);\s*if\(file_exists\([^\}@]{9,99}@file_get_contents\(\1\);(?<X2161580>))|\$\w{1,20}\(\(string\)null\h*,\h*\1\);\s*@?unset\(\$\w{1,20}\);\s*\1\(\);\s*\}\s*\}\s*\?>[^/\$]{9,99}<title>\h*404\h+Not\h+Found\h*<(?<X2159450>)|\$\w{1,20}\->getBot\(\);\s*if\h*\((\1\[['"]isbot['"]\])[^\)]+\)\s*\{\s*\$sNbot\h*=\h*['"][^\.]{2,20}\.\42\.(?<X2183390>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*(array)\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*=>\h*['"]\|\.\*\|e['"],\);\s*\45_walk\h*\(\44\h*,\h*\1\h*,\h*['"]{2}\);(?<X1187900>)|\1\h*\+\h*\d+;\s*(\$keyword\d+)\h*=\h*file\(['"][^\.]{1,20}\.php\.txt['"]\);\s*\$\w{1,20}\h*=\h*\47\[\1\];[^<]{99,999}(\$\w{1,20})\h*=\h*['"]<(script)>\s*var\h+keyword=\\['"][^\.]{1,20}\.txt\\['"];\s*</\49>[^\$]{9,99}\bsrc=\\['"]http://[^\$]{9,99}\becho\h+\48;(?<X2155300>)|file_get_contents(?:\([^\)]+\);\s*if\(preg_match\(['"]/IndoXploit\h*-\h*Auto\h+E?Xploiter/[^'"]+['"]\h*,\h*\1(?<X2152750>)|\h*\(['"][\./]{3,9}[^'"]{9,30}/[\w\.]{1,20}\.po['"]\);\s*\$(code_auth)\h*=\h*new\h+\52\(\d+\);\s*(\$\w{1,20})\h*=\h*\$\52->uncode\(\1\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\53\);(?<X1159350>))|fopen\(['"](?:\.htaccess['"]\h*,\h*['"][wa]\+?['"]\);\s*\$\w{1,20}\h*=\h*fwrite\h*\(\1\h*,\h*base64_decode\(\$f[uvck]{3}em\)\);\s*\$\w{1,20}\h*=\h*symlink\((?<X2156740>)|\w{1,20}\.txt['"],['"]?[aw]\+?['"]?\);\s*\$\w{1,20}\h*=\h*fwrite\(\1,[^\?]{99,999}\b(?:meta\h+http-equiv\h*=\h*['"]refresh['"]\h*content\h*=\h*['"]\d;\h*URL\h*=\h*|header\h*\(Location\h*:\h*)(?:https?://)?(?:\w{1,9}\.)?(?:facebook|paypal|gmail|yahoo|instagram|twitter)\.(?<X2148051>))|getenv\(['"]REMOTE_ADDR['"]\);[^\(]{99,500}\$(?:message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"](?:Social\h*security\h*number|SSN)\b[^\(]{99,500}\bmail\([^\)]+\);\s*(\$\w{1,20})\h*=\h*fopen\(['"]\.?/logs/\1\.txt['"]\h*,\h*['"]a['"]\);\s*fwrite\(\57(?<X2146461>)|str_replace\(\w{1,20},['"]{2},['"][^'"]+['"]\);\1\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1187200>)|strtolower\h*\((\$_[GPRSC]\w{2,6}\[strrev\h*\(strtoupper\h*\()['"]tnega_resu_ptth['"]\)\)\]\);\s*\$\w{1,20}\h*=\h*\60['"]tsoh_ptth['"]\)\)\];\s*if\h*\(!?preg_match\h*\([^\)]+,\h*\1\)\)\s*\{[^\}]{9,250}\{\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1176410>)|substr\(str_shuffle\([^;]+\);\s*\}\s*mkdir\h*\(['"](\$\w{1,20})/\1['"]\h*,\h*0?777\);\s*(\$\w{1,20})\h*=\h*base64_decode\(['"][^'"]{999,12000}['"]\);\s*file_put_contents\h*\(['"]\62/\1/\w{1,20}\.(?:zip|php)['"],\63\);(?<X2157960>))|\.=\h*\$\w{1,20}\[mt_rand\([^\]]+\];\s*\}\s*(\$data)\h*=\h*['"]<\?(?:php)?\h*/\*['"]\h*\.\1\.\h*['"]\h*\*/\h*\?>['"][^\{\}]{9,90}\bfile_put_contents\h*\(\$\w{1,20}\h*,\h*\65\);\s*\}\s*function\h+\w{1,20}\h*\(\65\)\s*\{\s*\$\w{1,20}\h*=\h*(array)\h*\([^\}:]{99,300}\66\(['"]url["']=>['"]http:(?<X2172661>))
(\$\w{1,20})\s*=\s*(?:['"](?:[preg_lac.'"]{14,35}['"];\s*\1\s*\(\s*.?['"](.).{0,40}\2e\w?.?['"]\s*,\s*['"](?:\\x[a-z0-9]{2,3}){6}(?<X2125960>)|\.?/[^\/]{1,40}/(?:css|images|js)/[^'"]+['"]\s*\.\s*['"][^'"]{1,30}['"]\s*\.\s*['"].txt['"];\s*(\$\w{1,20})\s*=\s*fopen\(\1\s*,\s*['"]a['"]\)\s*or\s*die\([^\)]+\);\s*(\$\w{1,20})\s*=\s*['"][^'"]{9,999}['"];\s*fwrite\(\4\s*,\s*\5\);\s*fclose\(\4\);(?<X2123741>)|\w{1,20}\.php['"];\s*(\$\w{1,20})\s*=\s*(?:generate_?)?random_?(?:string|number)\(\);\s*(\$\w{1,20})\s*=\s*\7\.['"]\.php['"];[^\$]{0,15}@?copy\(\1\s*,\s*\8\)(?<X2123641>)|\w{32}['"];[^<]{9,300}!=\s*\1\)\s*\)\s*\{\s*die\s*\(['"](?:404|401|403)\s+(?:Not\s*Found|Unauthori[zs]ed|forbidden)\b[^#]{99,3000}(\$\w{1,20}[^=]+)\s*=\s*shell_exec\((\$\w{1,20})\);[^\{]+\{\s*\10=\s*(?:passthru|exec|popen|system|assert|pcntl_exec)\(\11\);(?<X2134291>)|https?://dropsforums\.ru/panel/[^'"]{9,40}['"];\s*\$\w{1,20}\s*=\s*curl_init\(\1\);(?<X2124270>)|PGRpdiB(?:pZD0i|zdHlsZ|jbGFzcz)[^'"]{89,999}['"]\s*;\s*echo\h+base64_decode\s*\(\s*\1\s*\)\s*;(?<X1166996>))|(?:['"creat_funio\.]{20,30};\s*(\$\w{1,20})\s*=\s*@\1\(['"](\$\w{1,20})['"],['"eval\.]{9,15}\(['"][\?>]{2}['"]\.['"gzinflate\.]{14,20}\(\s*['"\.base64_dco]{15,25}\(\16\)\)\);['"]\);\s*@\15\(['"][^'"]{999,5000}['"]\);(?<X1063540>)|\\['"][asert\\.'"\s]{9,15}['"];\s*(\$\w{1,20})\s*=\s*\$\{\\['"][_POST\.'"\\\s]{9,12}['"]\};\s*\1\s*\(\s*\18\[[^\]]+\]\);(?:\s*/[\*/]['"]\);)?(?<X1061801>)|file(?:\(['"]/etc/named\.conf['"]\);\s*(\$\w{1,20})\s*=\s*scandir\(['"]/var/named['"]\);\s*if\s*\((?:\20|\1)[^\}]+posix_getpwuid\s*\(fileowner\s*\(['"]/etc/valiases\b(?<X2132771>)|_get_contents\([^\.]+\.['"]\.info['"]\);[^<]{9,300}(?:[^\$]{0,15}\$\w{1,20}\s*=\s*(explode\(['"]<)([^>]+)>['"],\s*\1\);\s*\$\w{1,20}\s*=\s*\22/\23>['"],[^\)]+\);\s*){5}(?<X2123790>))|implode\s*\(file\s*\(['"]data:[^\.]+\.str_replace\s*\([^\$]+\1\)\)\);[^@]{99,200}\1\s*=\s*@gzinflate\(\1\)\)\s*\D{2,3}\s*\(CRC32\(substr\(\1[^\}]{9,99}\{\s*(\$\w{1,20})\s*=\s*array\([^@]{99,400}@create_function\(['"]['"],['"]\};\s*unset\(.\1,[^\)]+\25\)(?<X2127931>)|trim\s*\(\$_POST\[[^\]]+\]\)\.['"]\.php['"];\s*\$\w{1,20}\s*=\s*file_get_contents\((__FILE__)\);[^\}]{9,150}unlink\s*\(\27\);\s*echo\s+['"](xXsUIssAZ):\s*['"]\s*\.\s*\1\.\s*['"]\s*:\28['"];(?<X2063651>)))
(\$\w{1,24})=rand\(\);\s*\1=md5\(\1\);\s*header\s*\(['"]location:[^&]{15,30}&\w+=\1\1&session=\1\1['"]\);(?<X2119452>)
(\$\w{1,25})(?:=['"][^'"]{32,64}['"];(\$\w{1,25})=(?:\1\[\d+\]\.){5}[^\{]{99,499}\bif\(@?\2\([^\{]+\{(\$\w{1,25})[\h=]+@?\$\w{1,25}\(['"]{2},\s*@?\$\w{1,25}\([^\)]{99,499}[\h\)]+;@?\3[\h\(\)]+;\}(?<X1208710>)|[\h=]+(?:['"](?:['"\h\.creat_funio]{15,40}['"];\s*(\$\w{1,25})[\h=]+['"]['"\h\.gzuncompres]{12,40}['"];\s*(\$\w{1,25})[\h=]+\1[\h\(]+(?:['"]{2}|null)\s*,\s*\5[\h\(]+['"]x.{49,499}?\)[\s\)]+;\s*(?:echo\s*)?@?\6[\h\(\)]*;(?<X1207934>)|[\-\+\|\h]+\[[\h'"\.B4JATX]+\][\h\|\+\-]+[^;]+;\s*\1[\h\.=]+[^;]{9,150};\s*if\(strlen\(\$\w{1,25}\)[^\{]+\{\s*Tools::file_get_contents\(['"\.:/htpsaielgrmo]+[^\(]+\(\1\)[\h\.'"]+\);\s*\}(?<X1201941>)|wpdefault['"];\s*(\$\w{1,25})[\h=]+[^;]+;\s*(\$\w{1,25})[\h=]+['"]wordpress@[^\}]{9,99}\bwp_create_user[\h\(]+\1[,\h]+\9[,\h]+\10[\h\)]+;\s*[^\}]{0,99}\b\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*\}\s*\}\s*\Z(?<X1213310>))|file_get_contents[\h\(]+['"](?:https?://(?:(?:vivapasarantogel\.com|buku303\.gg)/[^'"]+\.(?:txt|js)['"][\h\)]+;\s*echo\h*\1;(?<X1227792>)|[^/]+/paste/[^/]+/raw['"][\h\)]+;\s*echo\h*\1;(?<X1214260>)|info\.ibii\.ac\.id/[^'"]+\.txt['"][\h\)]+;\s*echo\h*\1;(?<X1237200>)|raw\.githubusercontent[^/]+/(?:benny12311|trioneone311)/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1227301>)|raw\.githubusercontent\.com/(?:subdomain88|subdomain88)/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1237320>)|raw\.githubusercontent\.com/andina8/[^'"]+['"][\h\)]+;\s*echo\h*\1;(?<X1228300>)|twins\-[^/]+\.app/[^'"]+\.(?:txt|js)['"][\h\)];\s*echo\h*\1;(?<X1233890>))|license\.js['"][\h\)];\s*eval[\h\(]+\1[\h\)]+;(?<X1233690>))|getallheaders[\h\(\)]+;\s*if[\h\(]+array_key_exists[\h\(]+[^\)]+\1[\h\)]+\W{2,3}\1\[[^\)]+\)\s*@?include\h*['"][^'"]+\.(?:ico|png|jpe?g|txt)['"];(?<X1219090>)))
(\$\w{1,2})=\$\w{1,40}\[\d+\]\(['"]\\[xa-f\d\\]{3,199}['"][\s\)]+;\s*class\s*(\w{1,2})\s*\{\s*public\s*function\s*(\w+)[\s\(]+(\$\w{1,40})[\s\)]+\{\s*eval[\s\(]+\4[^;]+;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\2[\s\(\)]+;\s*\5\->\3[\s\(]+\1[\s\)]+;(?<X1247410>)
(\$\w{1,30})\s*=\s*(?:['"]\.['"]\s*\.\s*str_replace[\(\s]+['"]\s+['"][,\s]+['"]['"][,\s]+['"][a-z\d\s]{3,}['"][\)\s]+;\s*if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*(\$\w+)\s*=\s*\$\w+[\(\s]+\1[\)\s]+;\s*return\s*!empty[\(\s]+\2[\)\s]*\?\s*\$?\w+[\(\s]+\2[,\s]+true[\)\s]+:['";\s]*\}(?<X1278260>)|array\(\s*[^\)]+\)\s*;\s*if\s*\(\s*\$is_bot[^\w]{2,9}\(\s*FALSE\s*[^\w]{2,3}\s*strpos\(\s*@?preg_replace\(\s*\1[^\.]{20,99}\{\s*(\$\w{1,20})[^\(]{1,40}\4\s*\.\s*basename\(\s*(\$_FILES\[[^\]]+\])[^\(]+if\(\s*move_uploaded_file\(\5[^\]]+\],\s*\4\)\s*\)\s*\{[^\(]{9,50}exit\(\);\s*\}(?<X1062042>))
(\$\w{1,40})(?:(?:\s*/\*[^\*]{0,19}\*/)?\s*=(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*\^(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*;\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*=(?:\s*/\*[^\*]{0,19}\*/)?\s*\$\w{1,40}(?:\s*/\*[^\*]{0,19}\*/)?\s*\((?:\s*/\*[^\*]{0,19}\*/)?\s*chr\b[^;]+\1[^\{\}]{0,99}\{[^\}]+die[^\}]{0,40}\}(?<X1247510>)|([\s=]+)(?:base64_decode([\s\(]+)['"]aHR0c|['"]https?://)[^;]{1,199}(?:\$_POST\[['"](?:log|pwd)['"]\][^;]{1,199}){2};\s*(\$\w+)\3@?file_get_contents\4\1([\s\)]+);\s*if\4[^\{;=]{0,49}\5[^\{=;]{0,49}\{\s*function\s*(\w+)\4\$\w+\6\{[^\}]{0,299}\bcurl_exec\4[^\}]{1,199}\}\s*\7\4\1\6;\s*\}(?<X1192930>))
(\$\w{1,40})(?:=(?:(?:(\$\w{1,40})\[['"]\w\s*['"][\s\+]+\d+\s+[^\]]+\][\.;])+(\$\w{1,40})=(?:\2\[['"]\w\s*['"][\s\+]+\d+\s+[^\]]+\][\.;])+(?:(\$\w{1,40})=[^;]+;)+\$\w{1,40}=\1\(\4,\3\(['"\s]+\),['"][^'"]*['"]\);[^!]{9,3999}(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;\5\(\6\(['"][^'"]*['"]\)+;\$\w{1,40}=\d+;(?<X1224964>)|(?:get|scan)dir\([^;]{1,99};for\([^\{]{1,199}\{[^\}]{1,499}\$(\w{1,40})=file_get_contents\(\1\[[^\}]{1,199};(\$\w{1,40})=openssl_(?:en|de)crypt\(\$\8,[^\}]{1,499};fwrite\([^\),;]{1,99},\9\);[^\}]{0,499}\brename\(\1\[(?<X2192401>)|(\$_[GPCSR]\w{2,6}\[)[^;]{1,99};if\(\1\b[^;\}]{1,99}\b(?:exit|die)[^;]{0,19};\}switch\(\$\w+\)\{case\b[^;:]{1,99}:(\$\w+)=\11[^;]{1,99};[^:\}]{1,199}\$(\w{1,40})=(file_)ge(t_contents\(\12)\);\$\w+=(\w+)\(\$\13\b[^@]{9,499}\bcase\b[^\}\?]{1,499}\b\14pu\15\b[^\}]{1,499}\}break;\}function\h+\16\((?<X2173813>)|(file_)ge(t_contents\(\$\w{1,40})\);\1=base64_decode\(['"]PD9[^'"]{999,}['"]\)\.\1;\18pu\19,\1\);(?<X2184200>)|(socket_)create\(AF_INET,[^\{]{1,499}\bdo\h*(\$\w{1,40})\.=chr\(rand\([^;]{1,99};while\([^\)]+\);[^\{]{1,499}\bdo\{[^\}]{1,499}\b\21sendto\(\1,\22,[^\}]{1,499}\}while\((?:1|True)\);(?<X2181820>)|<<<(?:(\w{1,40})\s*<\?(?:cuc)?\s*@?vav_frg\([^\?]{1,999}\?>\s*\24;(\$\w{1,40})=\w{1,40}\(\1\b[^;]{1,99};(\$\w{1,40})=fopen\((\$\w{1,40}),[^;]{1,99};fwrite\(\26,\25\);fclose\(\26\);header\(['"]Location:(?:['"]\.)?\27['"]?\);(?:\?>)?\Z(?<X2172201>)|['"]\w{1,40}['"]\s*<\?[^@]{999,1999}fwrite\(\$\w{1,40},\1\);[^\?]{99,499}\becho\s*['"]<(apicall\w{1,40}>)[^;]{1,40}</\29['"];\}unlink\(__FILE__\);(?:rmdir\(__DIR__\);)?(?:\?>)?\Z(?<X2140600>))|["'](?:Office365|Live|MSN)['"];(\$\w{1,40})=['"][^;]{1,99};[^\(\?]{1,99}\bmail\([^\)]+\31[^\)]+\1\);file_put_contents\([^;]{1,99};header\(['"]Location:[^;]{1,199};\s*(?:\?>|\Z)(?<X2146550>)|['"](?:<\?[^=]{1,499};(\$\w{1,40})=(fopen\()['"]([^'"]{1,40}\.php)['"],[^;]{1,99};(fwrite\()\33,\1\);fclose\(\33\);(\$\w{1,40})=['"](?:(?:DirectoryIndex|ErrorDocument\h*\d{3})\h*/?\35\s*(?:\\n\s*)?){3}[^;]{1,499};(\$\w{1,40})=\34['"][^'"]{0,99}\.htaccess['"][^;]{1,99};\36\38,\37\);(?<X2179850>)|[^'"]{1,40}['"]\^['"][^'"]{1,40}['"];\1\(\$\w{1,40}\);\$\w{1,40}=@?\$\w{1,40}\(@?\$\w{1,40}\[\$\w{1,40}\]\);(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);(?:if\([^\n;]{1,99})?\40\(\);\}?(?<X1132510>)|[^'"]{999,49999}['"];(\$\w{1,40})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,;]+/\(\.\*\)[^,;\)]+,\42,[^\?]{1,999}\$(\w{1,40})\.=chr\(+ord\(substr\(\1,[^\?]{1,499}\b[ea](?:val|ssert)\(\$\43\);(?:\?>)?\Z(?<X2181750>)|[^;]+\b(?:APPLE?|VBV)\b[^;]+['"];(\$\w{1,40})\.?=[^\(]{99,199}mail\(\$\w+(,\1,(\$\w{1,40}),\45\);)(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;\48\(\49\([^\),;]{9,49}\)\46fclose\(fwrite\(fopen\(['"][^'"]+\.html?['"],[^\)]+\),\47\)\);echo\s*['"]<meta\s+http-equiv=['"]refresh['"](?<X2134260>)|[a-z\d]{1,3}['"];@?include(?:_once)?\h+\1\h*;(?<X1206630>)|\w{1,9}['"];function\s*\w+\s*\(\s*(\$\w+)[\)\s]+\{\$\w+=file_get_contents\(\52[^:\n]+['"]https?://['"]\s*\.\s*\1\s*\.\s*['"]\.[\w\-\.]+(?:\.[a-z]{2,9})+[^'"]*['"];[^\?\n]+\bstrpos[\(\s]+\$\w+[,\s]+['"]pingsitemap\.xml['"][^\n]{99,}echo\s*\$\w+[^;]*;(?:\h*(?:exit|return|die)\b[^;]*;)+(?<X1265130>)|https?://(?:(?:\w+(?:\.|/))+php\?[\s\w]+=['"](?:\.urlencode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\))+;(\$\w{1,40})=fopen\(\1,[^;]+;if\(\54\)[^;]+;\};if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{eval[^;]+;\}(?<X1217751>)|[^'";]{1,99}\.txt['"];(\$\w{1,40})=['"][^'"]{0,99}/wp\-(?:content|admin|includes)/[^'"]+['"]\.\$\w{1,40}\.['"]\.php['"];[^\?]{1,199}\$(\w{1,40})=(file_)ge(t_contents\()\1\);[^\?]{1,99}\b\58pu\59\56,\$\57\);[^\%#]{1,499}\bunlink\([^\)]+\.php['"]\);(?:\?>)?\Z(?<X2171841>)|[^/'";]+\.xyz\b[^;]{1,299};(?:(?:if\([^\{;]{0,99}\1\b[^\{;]{0,99}|else)\{header\(['"]Content\-type:\s*(?:application|text)/(?:x|ht)ml\b[^\)]{0,99}\);\}){2}echo\b[^;]{0,99}\1\b(?<X2192272>))|key['"];(\$\w{1,40})=['"]value['"];\$_POST\[\$\{\1\}\]=\w{1,40}\(\$\{\62\}\);\}[^@]{9,99}<title>\W{0,15}Kaito_Shell\b(?<X2144861>))|\$_(?:[GPCSR]\w{2,6}\[(?:['"]\w{1,40}['"]\];if\(\1\)\{(\$\w{1,40})=\1\(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\]\);(\$\w{1,40})=\1\(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\]\);\64\(['"][^'"]+['"],\65,\d{1,4}\);(die|exit)\([^\)]*\);\}else\s*phpinfo\(\);\66;(?<X2129430>)|[^;]{1,99};\?>[^/]{0,99}<title\b[^>]{0,99}>[^/<>]{0,99}\b(?:(?:de?|en)cod(?:e|ing)\h*\W\h*){2}[^@!]{999,2999}\b(?:break;case\h*['"]\w{1,19}['"]\h*:\h*\$\w{1,40}=(?:\w{1,40}\(){2}[^;\)]{0,1999}\1\)+;){6}(?<X2179641>))|(?:[GPRSC]\w{2,6}\[[^\]]+\];(\$\w+)=\w+\(\1\);\$\w+=array\(['"]/https:\\/\\/pastes\\\.io\\\/raw\\/\+[^;:]+:\\/\\/raw\\\.githubusercontent\\\.com\\/[^;]+;(\$\w{1,40})=[^\}]{9,499}(\$\w+)=fopen\(\70,[^;]+;fwrite\(\71,\69[\);\}]+(?:fclose\(\71[\);\}]+)?include\s*\70;(?<X1228270>)|SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,;]+/\(\.\*\)[^,;\)]+,\1,[^\?]{1,999}\$(\w{1,40})\.=chr\(+ord\(substr\([^\?]{1,499}\b[ea](?:val|ssert)\(\$\73\);(?<X2181761>)))|array\((?:(?:['"][^'"]{0,40}\bwp\-config\.php['"],){3}[^;]{99,4999};[^\}\?]{1,199}\bforeach\(\1\h*as\h*(\$\w{1,40})\)\{(\$\w{1,40})=[^;]{0,99}\75\b[^\?\}]{0,199};(?:copy|symlink)\((?:\76|\75),(?<X2182521>)|[^\)]{9,499}['"](?:(?:Apple|user)\s*ID|email|user(?:name)?)['"]\s*=>[^,]{1,99},\s*['"]Pass(?:word)?['"]\s*=>[^\)]{9,499}\);foreach\(\1[^\)]+\)\{(\$\w{1,40})\.=[^;]{1,99};\}[^\?]{99,999}\bf(?:ile_get_contents|open)\(['"]https://api\.telegram\.org/bot[^'"\);]{1,99}\78(?<X2138130>))|base64_decode\(\1\);(header\(['"]Location:\s*[^'"\?]{1,99}\.php\?\w{1,40}=['"]\.md5\([^\)]+\)\.(?:['"]&\w{1,40}=['"]\.rand\(\d+,\d+\)\.){2}['"])&\w{1,40}=['"]\.\1\);\}else\{\80['"]\);\}\s*(?:\?>)?\Z(?<X2171901>)|g(?:et_(?:current_user\(\);(?:(\$\w{1,40})=\$_SERVER\[['"]\w+['"]\];[^\}\?]+(\$\w{1,40})=fopen\(['"]/home/['"]\.\1\.['"]/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w+['"]\);fwrite\(\83,\$\w+\);fclose\(\83\);[^\?!&\{\}]{9,99}\$\w{1,40}=["]?\82[^;]+:2083/resetpass(?<X2131210>)|[^:]{0,199}(\$\w{1,40})=['"]email:[^;]{1,49};(?:(\$\w{1,40})=fopen\(['"]/home/['"]\.\1\.['"]/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w+['"]\);fwrite\(\86,\85\);fclose\(\86\);){2}(?<X2130160>))|users\((?:array\(|\[)['"]role['"]=>['"]administrator['"][\]\)]\);foreach\(\1\h*as\h*(\$\w{1,40})\)\{[^\}]{0,199}\88\->(user_pass)\b[^@]{1,499}\bwp_update_user\([^;]{0,999}['"]\89['"]=>\$_[GPCSR]\w{2,6}\[(?<X2184170>))|zinflate\(base64_decode\(\1\)\);(\$\w+)=0;while\(\(\(\91<strlen\(\1\)+\{\1\[\91\]=chr\(ord\(\1\[\91\]\)\s*\-\s*\d\);\91\+\+;\}return\1;\}(?<X1265620>))|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\?[^;]{9,99};[^\^\}]{1,99}((\$\w{1,40})\[[^\]]+\])=chr\(ord\(\93\)\^\(\(\1[^;]{1,40};\}\$\w{1,40}=gz[^;]{1,40}\94\)[^\{]{1,40}\{setcookie\(['"][^'"]+['"],\1\);(?<X2132960>)|new(?:\h+Api\(\);(?:if\(!file_exists\((\$\w{1,40})\.['"](/wp\-(?:admin|includes)/[^'"]+\.php)['"][^\}\?>]{1,499}\$(\w{1,40})=\96\.['"]\97['"];[^\}\?>]{0,499}\$(\w{1,40})=\1\->get\(base64_decode\(['"]ahr0c[^\)]+\)\.['"]\97['"]\);file_put_contents\(\$\98,['"]?\$\99\b[^;]{1,99};\}){2}(?<X2180791>)|\s+\w{1,40}\(\);(\$\w{1,40})=new\s+Loader\(\1\);\1->set\(['"]\w{1,40}['"],\101\);\$\w{1,40}=new\s+DB\([^\}]{1,600}?\}\}if\(file_exists\(['"](\w{1,40}['"\.ph]{5,9})['"]\)\)\{include(?:_once)?\s*\(?['"]\102['"]\)?;\}(?<X1058660>))|preg_split\(['"]/\{\\\|\}/si['"],\$\w+,\-\d+,PREG_SPLIT_NO_EMPTY\);if[\s\(]+![\s\(]+is_array[\s\(]+\1[\s\)]+\{return\s*(?:false|true);\}if[\s\(]+count[\s\(]+\1[^\n<]{99,}\bheader[\(\s]+(\$\w{1,40})\[0\]\);echo\s*\104\[\d+\];(?:die|exit)\b[^;]*;[\}\s]+\}\h*\w+\(\$\w+,\$\w+\);(?<X1266140>))|[=@\s]+fopen[\(\s'"]+wp\-cli?\.php['"][,\s]+['"][wa]\+?['"][\)\s;]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s'"]+https?://raw\.[^'"/]+\.[a-z]{2,6}/[^'"]+['"][\)\s;]+\$\w{1,40}[=\s@]+fwrite[\(\s]+\1[\)\(,\s]+\106[\)\s;@]+fclose[\(\s]+\1[\)\s]+;(?<X1204190>)|[=\h]+['"][^'"]{1,9}['"]\h*\^\h*['"][^'"]{1,9}['"]\h*;\h*@?(\$\w{1,40})[=\h]+base64_decode\([\$\{\h]*\1[\h\}]*\[[^\]]+\][\h\)]+;\h*@?eval[\h\(]+['"]{2}[\.\h]+\108[\h\)]+;(?<X1238871>))
(\$\w{1,40})(?:[=\s'"]+https?://(\$_SERVER\[)HTTP_HOST\]\2REQUEST_URI\]['"\s;]+(\$\w{1,40})\s*=[^;]+;\s*if[\(\s]+strpos[\(\s]+\1[,\s'"/\.]+wp\-(?:admin|includes)[^><\n]{9,999}if[\s\(]+\3[^\{]{2,9}\{\s*echo[\s\('"]+<(script)\s*src[=\s'"]+https?://[a-z\d]{1,3}\.\w{5,}\.[a-z]{2,8}/[^;\?]+\.js\?[^;]+</\4>['"\s;]+\}(?<X1211020>)|[=\s@\.]+preg_replace[\s\(]+['"](.)[^;]+\6['"]\s*,\s*['"]{2}\s*,\s*\1[\s\);]+(\$\w{1,40})[=\s@\.]+\1[\(\s]+['"][^'"]+['"][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*/\*[^\*]*\*/[\s\(]+\$?(?:\w+[\s\(]+)+(?:['"][\?>]{2}['"]\s*\.\s*)?\7[^;]*;(?<X1254241>)|[=\s@]+(?:(file_get_contents)[\(\s'"]+http://[^;\?]{1,40}\.aspx?\?[^;]+;[^\?]{0,999}\$\w{1,40}\s*=\s*\9[\s\(]+\1\s*\.\s*['"]/[^;\?]{0,999}\.aspx?\?[^;]+;[^\|]{9,9999}\becho\s*\9[\s\(]+\1[^;\?]+\.aspx?[^;]+;[^\?]{0,999}?echo\s*\9[\s\(]+\1[^;\?]+\.aspx?[^;]+;(?<X1221980>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+file_put_contents[\(\s]+\1[,\s]+\11[\)\s]+;(?:\s*echo\s*\11\s*;)?(?<X1223440>)|file_get_contents[\(\s@]+\$_(?:GET|POST)\s*\[[^\]]+\][\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\s]+\1[\)\s]+;(?<X1225130>)|unserialize[\(\s]+base64_decode[\(\s]+(?:trim[\(\s@]+)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\{\}]{0,199}if[\(\s]+@\h*\1\s*\[[^\]]+\][\)\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+(?:trim[\(\s@]+)?\1\s*\[[^\]]+\][\)\s]+;(?<X1239021>))|[=\s]+(?:!\$\w{1,40}\s*;\s*\$\w{1,40}[=\s]+(?:['"][^'"]*['"]|\$\w+)\s*;\s*if[\(\s]+\1[\)\s]+\{\s*class\s*(\w+)\s*\{\s*private\s*\$\w{1,40}\s*;[^\^\n]+\^[^\n\*]+\}\s*\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\15[\(\)\s]+;[^\}]*\}(?<X1254290>)|(\$\w{1,40})(?:[\(\s'"]+svyr_trg_pbagragf['"\)\s]+;\h*\$\w{1,40}[=\s]+\1[\(\s]+\17[\(\s'"]+cuc:\s*//vachg['"\)\s]+;(?<X1214110>)|[\(\s]+\$\w{1,40}[\(\s]+\$\w{1,40}\s*\)\s*\)\s*\(\s*\)\s*;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[\s*\17\s*\([^\}\{;]+\{[^\}@]{0,499}@include(?:_once)?[\s\(]+\1[^;]+;[^\?]{0,999}\becho\s*\17\s*\([^;]+;\s*\}\s*\}(?<X1237780>)|\s*;(?:\s*/\*[^\*]{0,19}\*/)?\s*@include(?:\s*/\*[^\*/]{0,19}\*/)?\s*\((?:\s*/\*[^\*]{0,19}\*/)?\s*\1(?:\s*/\*[^\*]{0,19}\*/)?\s*\)(?:\s*/\*[^\*]{0,19}\*/)?\s*;(?:\s*/\*[^\*]{0,19}\*/)?\s*@\$\w{1,40}(?:\s*/\*[^\*/]{0,19}\*/)?\s*\[\d[^;]+\17[^\}]{0,99}\b(?:die|exit)\b[^;]+;(?<X1247450>))|(\$_SESSION)\[\w+\([^\]]+\][\s;]+if[\(\s]+empty[\(\s]+\21\[[^\]]+\][\)\.\s]+\1\][\)\s]+\{\s*if[\(\s]+isset[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\D{2,9}(?:(?:sha|md)[15][\(\s]+){2}\22\1\][\)\s=!]+\$\w{1,40}[\)\s\{]+\21\[[^\]]+\][\)\.\s]+\1\][^\}]*\}\s*else\s*\{\s*\w+\s*\(\)\s*;[^\}]*\}\s*\}(?<X1222990>)|(\$GLOBALS\[['"]\w+['"]\]\[)\d+(\]\(\$_POST\[\w+\()\d+\)\]\);\s*(\$\w{1,40})[=\s]+\24\d+\25\d+\)\]\);\s*(\$\w{1,40})[=\s]+\24\d+\25\d+\)\]\);\s*\$\w{1,40}[=\s]+\24\d+\25\d+\)\]\);\s*(\$\w{1,40})[=\s]+\24\d+\]\((?:(?:\1|\26|\27)[,\s\)]+){2}[^;]+;\s*if[\(\s]+\28[\)\s\{]+echo[^=\?]{1,99}\28;\s*\}(?<X1227460>)|(base64_decode)(?:[\(\s'"]+L[23][^'"]{1,99}(?:(?:Ly5jYWdlZnMvL|LmNhZ2Vmcy8u|Y2FnZWZzLy4u|Ly5jcGFkZG9ucy8|LmNvbXBvc2VyLy4)[^'"]+|uLi4|Li4u)['"][\s\)]+;\s*if[\s\(]+(?:!(?:is_file|file_exists)[\s\(]+\1[\s\)]+\|+)?filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]\1[\s,]+\31ge\32[\s\(]+\30[\s\(]+['"]aHR0[^;]+['"][\s\)]+;\s*\}(?!\s*else)(?<X1217527>)|[\(\s]+['"](?:aHR0cHM6Ly9waW5rZmVscy5zaG9wLz90PWpzb24maT0[=\+]{0,2}['"][\)\.\s]+\$\w{1,40}[\.\s]+\30[\(\s]+['"][^'"]*['"][\)\.\s]+\$\w{1,40}[\s;]+(\$\w{1,40})[=\s]+json_decode[\(\s]+\1[^;]+;\s*if[\(\s]+empty[\(\s]+\34\[\30[\(\s]+['"][^'"]*['"][\)\s]+\][\)\s\{]+\$\w{1,40}[=\s]+\34\[\30[\(\s]+['"][^'"]*['"][\)\s]+\][\s;]+\}(?<X1257900>)|PD9[^'"]{999,}['"][\)\s]+;\s*(\$\w{1,40})[=\s]+dirname[\s\(]+__FILE__[\s\)]+;\s*(?:@?file_put_contents[\(\s]+\36\s*\.\s*\30[\(\s]+['"]Ly4uLy4u[^'"]{1,999}['"][\)\s]+,\s*\1\s*\.\s*PHP_EOL[\)\s]+;\s*){2}(?<X1222893>)))|(curl_)init[\(\s]+base64_decode[\(\s]+(strrev)[\(\s]+['"][^'"\$]+['"][\)\s]+;(?:\s*\38setopt[^;]+;)*\s*(\$\w{1,40})[=\s]+\38exec[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+base64_decode[\(\s]+\39[\(\s]+['"][\w=]{3,5}['"][\)\s@;]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\41[\.\s]+\40[\)\s]+;(?<X1228030>)|(file_get_contents)[\(\s'"]+\.htaccess['"][\)\s]+;\s*(\$\w{1,40})[=\s]+\43[\(\s'"]+index\.php['"][\)\s]+;[^\{\}]{9,499}if[\(\s]+is_dir[\(\s]+['"]wp\-(?:includes|admin)/[^'"]+['"][\s\)]+\{\s*file_put_contents[\s\('"]+wp\-(?:admin|includes)/[^'"]+\.(?:png|jpg|ico)['"][,\s]+(?:\1|\44)[^\}\{]+\}(?<X1228410>)|(function)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*eval[\(\s]+\47[\)\s]+;\s*\}\s*;\s*\$\w{1,40}[=\s]+\46[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][base64_dco]{9,13}['"]\s*;\s*\$\w{1,40}[\s=]+\48\s*\[[\(\s]*\d+\s*[\-\*\+/][^\?]+\1[\s\(]+\$\w{1,40}[\s\)]+;(?<X1212530>)|@?(file_get_contents)[\(\s"']+https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][\)\s]+;\s*(\$\w{1,40})[=\s]+@?\50[\(\s"']+https?://github\.com/\w+/[^'"]{1,40}\.txt['"][\s\)]+;(?:\s*\$\w{1,40}[=\s]+fwrite[\(\s]+\$\w{1,40}[,\s]+(?:\1|\51)[\)\s]+;)+(?<X1224560>)|@(?:\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+if[\(\s]+isset[\(\s]+\1[\)\s&]+strlen[\(\s]+\1[^;\{\}@]+@hex2bin[\(\s]+\1[^;\{\}]+\{\s*(\$\w{1,40})[=\s@]+fopen[\(\s]+__FILE__[,\s'"]+r['"\)\s;@]+fseek[\(\s]+\53[^;]+;\s*eval[\(\s]+base64_decode[\(\s@]+stream_ge\w+[\(\s]+\53[^\}]+\}\s*@?unset[\(\s]+\1[\)\s]+;(?<X1255540>)|fopen[\(\s'"]+\.htaccess['"][\s,]+['"]w['"][\)\s;]+if[\s\(]+\1[\s\)]+\{[^\|!\?]{9,}(\$\w{1,40})[\s='"]+/tmp/sess_['"\s\.]+md5[\s\(]+\$_SERVER\[['"]REQUEST_URI['"\]\)\s]+;[^\|\?]{9,}\|\|\s*filesize[\s\(]+\55[^\(]+base64_decode[\('"\s]+PD9[a-z\d\+/=]{999,}['"][\s\)]+;[^\?]{199,599};\s*\}\s*\}(?<X1213290>))))
(\$\w{1,40})[=\s]+(?:['"](?:(/home\d*/[^/]+/[^/]+/)[^'"]+/['"][\s;]+\$\w{1,40}[=\s]+['"]\2[^'"]*i\w+\.php['"\s;]+(\$\w{1,40})[=\s]+['"]{2}[;\s]+(?:(\$\w{1,40})[=\s]+\1[\s\.]+['"][^'"\$]+\.png['"\s;]+)+if[\s\(]+\3[\s\)\{]+if[\s\(]+(file_)exists[\s\(]+\3[^,]{0,199}\5get_contents[\s\(]+\4[^\?]{9,999}touch[\s\(]+\3[^;]+;(?:\s*\}){4}(?<X1226181>)|/h[^;'"]+/\.[a-z\d]+\.(?:css|gif|ico)['"]\s*;\s*if[\(\s]+!isset[\(\s]+\1[\)\s]+\{\s*strrev[\(\s]+\1[\)\s;]+\}\s*else\s*\{\s*@include_once(?:\s*/\*[^'"]*\*/)?[\(\s]*\1[\)\s;]+\}(?<X1278880>)|<\?[ph\s]*['"][\s;]+(\$\w{1,40})[=\s]+(\$_SERVER)\[['"]HTTP_HOST['"\]\s\.]+\9\[['"]REQ[^\$]{0,99}\$\w{1,40}[=\s]+['"]https?:[^:\?]+\?['"\s\.]+\8[^\{\}@]+(\$\w{1,40})[=\s'"]+(?:@(?:session\w+|set_time\w+|error_r\w+)[^;]+;\s*){3}[^/]+(\$\w{1,40})[=\s]+\1[\s\.]+\10[^:]+file_put_contents[^:]+\11['"\)\s]+;(?<X1249220>)|['"][\s;]+(?:if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\1[=\s]+(?:md5[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^;]+;[\s\}]+)+if[\(\s]+\1[^'";:]+['"]http://\w{2,9}\.[^'"]+\.txt[^;]+(?:exit|die)\b[^;]+form>['"]\);[\s\}]+else\s*\{\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][=\s]+\1[\s;]+\}(?<X1218290>)|[^'"]{1,20}['"]\s*\^\s*['"][^'"]{1,20}['"]\s*;\s*(\$\w{1,40})[=\s]+&\$\1\s*;\s*(\$\w{1,40})[=\s]+array\s*\([^\n]{99,399}\$\w{1,40}\(\15\)[;\s]+(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s@]+\14\[[^,\n]{0,40},\s*\$\w{1,40}[\s\)]+;\s*if[\s\(]+\16\s*[!=]+\s*\$\w{1,40}[\s\)@]+\$\w{1,40}\(\);(?<X1216730>)|[ba'\."se64_dco]{17,}['"];\s*(\$\w+)\s*=\s*\1[\(\s]+['"]PD9[^'"]+['"][\)\s;]+(\$\w+)\s*=\s*\1[\(\s]+['"]PElm[^'"]+['"][\)\s]+;(?:\s*if[\(\s]+\$\w+\s*&&\s*(?:\18|\19)[\s\)]+\{\s*if[^;]+;[^\}]+\}\s*\})+(?<X1278470>)|[file_xst'"\s\.]{19,40}['"]\s*;[^\n\}@!]{0,499}\bif[\s\(]+!\h*\1[\s\(]+\$\w{1,40}\s*\)[^;]+\$\w{1,40}[=\s]+@\$\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;\s*@[^\}]{0,999}@\$\w+[\(\s]+\$\w+[,\s]+\d+[\)\s]+;\s*\}\s*\}(?!\s*\})(?<X1239160>)|[fz][^'"]+\.[a-z]{2,9}\b[^'"]*['"][\s;]+\1[\s=]+['"]https?://[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1259400>)|[index'"\.]{8,}\.php['"][\s;]+(\$\w{1,40})[=\s]+['"][^;]+\.(?:ttc|gif|jpg|png|ico)['"\s;]+if[\s\(]+!isset[\s\(]+\$\w{1,40}[\s\)&]+(file_)exists[\s\(]+\23[\s\)\{@]+chmod[\s\(]+\1[^\}]{9,199}@\24put_contents[\(\s]+\1[,\s]+gzinflate[\(\s]+\$\w{1,40}[\)\.\s]+\$\w{1,40}[,\s]+LOCK_EX[\)\s;]+\}(?<X1221580>)|[index\.ph'"]{12,40}['"][\s;]+(\$\w{1,40})[=\s]+['"]wp\-[^;]+;\s*if[\(\s]+file_exists[\(\s]+\26[^;\{]+\{\s*(\$\w{1,40})[=\s]+(file_get_contents)[\(\s]+\26[\)\s;]+(\$\w{1,40})[=\s]+\28[\(\s]+\1[\)\s;]+(\$\w{1,40})(?:[=\s,]*[strpoub]{6,7}[\(\s]*\29){2}[^\}]{0,99}\27[\)\s\.]+\30[^\}]{0,40}\}(?<X1204250>)|\.htaccess['"]\s*;\s*\$\w{1,40}[=\s]+@base64_decode[\(\s]+['"]PEZpbGVzTWF0[^;]+;\s*if[\(\s]+(file_)exists[\(\s]+\1[\)\s\{]+\$\w{1,40}[=\s]+\32ge(t_contents)[\(\s]+\1[^,]+@chmod[\(\s]+\1[^;]+;\s*@\32pu\33[\s\(]+\1[^;]+;\s*@chmod[\s\(]+\1[^;]+;(?<X1243550>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"][\s;]+\1[\s=]+['"]https?://[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1259410>)|base64_decode['"]\s*;[^=]{0,199}(?:ini_set[\s\(]+['"](?:error_log|display_errors|log_errors)['"]|error_reporting)[,\s\(]+(?:null|0|off)[\s\)]+;[^=]{0,199}\beval\b[^'"\)]{0,99}\1[\s\(]+(?:\$\w{1,40}[\s\(]+)*['"][a-z\d/\+]{99,}['"][\s)]+;(?<X1238561>)|c(?:lass_exists['"]\s*;\s*(\$\w{1,40})[=\s]+\1[\(\s]+\$\w{1,40}[\)\s]+;\s*\$\w{1,40}[=\s]+\37\s*;\s*if[\(\s]+!\$\w{1,40}[\)\s]+\{\s*class\s*(\w+)\s*\{\s*private\s*\$\w{1,40}\s*;[^\?\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\38[\(\)\s;]+\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248270>)|ount['"];\s*(\$\w{1,40})[=\s]+(\$_[GPRSC]\w{2,6});\s*(\$\w{1,40})[=\s]+['"]\w+['"];\s*if[\(\s]+reset[\(\s]+\40[\)\s]+==['"]\w+['"]\.\42&&\1[\(\s]+\40[\)\s]+[>=<!]+\d+[\)\s]+\{\s*@?eval[\(\s]+base64_decode[\(\s]+(?:\41|\40)\[[^\]]+\][\)\s;]+\}(?<X1224484>)|reate_function['"]\s*;\s*@?error_reporting[\(\s]+(?:0|null|false)[\)\s]+;\s*\1[\(\s]+(?:['"]['"]|null)[,\s]+['"][\s\};@]+eval[\s\(@]+base64_decode[\s\(\\]+['"][^'"\$]{99,}['"][\s\)]+;[\s/]*['"][\s\)]+;(?<X1230370>))|eval[\(\s]+(?:\$\w{1,40}[\(\s]+){2,}(\$\w{1,40})\s*\[\s*\d+\s*\](?:[\.\s]+\45\s*\[\s*\d+\s*\][\s\);]*){9,}['']\s*;[^\?]{0,499}\beval[\s\(]+\1[\s\)]+;(?<X1228820>)|h(?:ex2bin['"];\s*(\$\w{1,40})[=\s]+array[\s\(]+\1[^;]{99,};\s*(\$\w{1,40})[=\s]+\47\[\d+\]\s*;\s*(\$\w{1,40})[=\s]+\48[\s\(]+\47\[\d+\][\s\)]*;[^,]{9,499}(\$\w{1,40})[=\s]+\49[\s\(]+__FILE__\s*,[^\[]+\[['"][^'"]+['"]\][\s\;]+(?:\$\w{1,40}[\(\s,]+)+\50[^_]{0,99}__Halt_CompiLer\b[\(\)\s]+;(?<X2227630>)|ttp://['"][\.\s]+\$goweb[\.\s]+['"]/\w+\.php\?[^;\$]+\$\w{1,40}\s*;\s*\$\w{1,40}[=\s]+trim[\(\s]+\w+[\(\s]+\1[\)\s]+;(?<X1227400>)|ttps://(?:%s/ping\?s[^'"]+['"]\s*;\s*(\$\w{1,40})[=\s]+sprintf[\(\s]+\1\s*,[^;]+;\s*\$\w{1,40}[=\s]+\w+[\(\s]+\53[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*var_dump[\(\s]+\53[^\}]+(?:exit|die)\b[^;]*;\s*\}(?<X1259142>)|raw\.githubusercontent\.com/[^'"]*\bshell/[^'"]*['"]\s*;\s*(\$\w{1,40})[=\s]+wp_upload_dir[\(\s]+[\)\s]+\[\s*['"]basedir['"]\s*\][\.\s]+['"][^'"]+\.php['"]\s*;(?:\s*\$\w{1,40}[=\s]+)?@?\w+[\(\s]+\1[,\s]+\55[\)\s]+;(?<X1242300>))|ttps?://(?:['"][\.\s]+\$goweb[\.\s]+['"]/[^\?;]+\?[^;]+;\s*\$\w{1,40}[\s=]+(\w{1,40})[\s\(]+\1[\s\)]+;[^@]{0,9999}\bfunction\s*\57[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+@file_get_contents[\(\s]+\58[\)\s]+;[^\}]+\}\s*return\s*\59[;\s]*\}(?<X1212230>)|[kc]od\d*\.[\w\-]{2,}(?:\.[a-z]+)+/(?:read|[kc]od)[^;]+;\s*(\$\w{1,40})[=\s]+curl_init[\(\s]+\1[\)\s]+;[^\?\{\}]{0,500}\bcurl_close[\(\s]+\61[\)\s]+;(?<X1259861>)|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/?['"]\s*\.\s*\$\w{1,40}[^\\><\n]{99,9999}(\$\w{1,40})[=\s]+\1[^\n!]{99,9999}(\$\w{1,40})[=\s]+(\w+)[\s\(]+\63\s*,[^\n\*]{99,9999}if[\(\s]+strpos[\(\s]+\64\s*,[^\n\*]{99,9999}(\$\w{1,40})[=\s]+\65\s*\([^\?]+echo\s*\66;[^\}]{0,40}\}\s*\}(?:\s*else\s*\{[^\}]{0,99}\})?(?<X1219981>)|cdn\-jsdelivr\.[^'"]+['"]\s*;\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;\s*curl_setopt[\(\s]+(\$\w{1,40})[,\s]+CURLOPT_URL[,\s]+\1[^=]{0,99}(\$\w{1,40})[=\s]+curl_exec[\(\s]+\68[\)\s]+;\s*curl_close[\(\s]+\68[\)\s]+;\s*eval[\(\s]+['"][^'"]*['"][\.\s]+\69[\)\s]+;(?<X1272431>))))|[rfpc]\w{3,15}[\(\s]+['"]https?://yoast\-schema\-graph\.com/[^'"]*['"][\)\s]+;\s*echo\s*\1\s*;(?<X1234470>)|\!\$\w+;\h*\$\w+[=\s]+(?:['"]\d+['"]|\$\w+);\h*if[\(\s]+\1[\)\{\s]+class\s*(\w+)\s*\{\s*private\s*\$\w+;[^\^\n]{1,9999}\^\s*str_repeat[^<\n]{1,9999}\}\s*\$\w+[=\s]+new\s*\72[\(\)\s]+;[^\}]*\}(?<X1254251>))
(\$\w{1,40})[=\s]+(?:\$(?:\s*\{\s*['"]\\x?\d{2,3}['"\.\s\d\\]{9,999}\}[^\}\n]{1,999}(\$\w{1,40})[=\h]+__DIR__\h*\.[^;]+?\1[^;]+;[^\}\n]{0,499}\binclude(?:_once)?[\s\(]+\2[\s\)]+;\s*@?\$?\w+[\s\(]+\2[\s\)]+;\s*\}(?<X1237441>)|\w{1,40}(?:\(\$\w{1,40}\(["']\\{2}['"]\s*,\s*['"]/['"]\s*,\s*__FILE__[\)\s]+;[^@\-\n]{0,999}\$\w{1,40}\s*=\s*(?:\$\w{1,40}\s*=\s*)+(?:['"]{2}|null);\s*\$\w{1,40}[=\s@]+\$\w{1,40}\((?:['"]{2}|null)[,\s]+(?:['"]{2}|null)\);\s*\1\s*=\s*(?:\$\w{1,40}\s*=\s*)+(?:['"]{2}|null);(?<X1217952>)|\s*;(?:\s*\$\w{1,40}[=\s]+(?:['"][^'"]+['"]|\$\w{1,40})\s*;){0,9}\s*if[\(\s]+!\h*\1[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^\n]{99,}\}\s*\$\w{1,40}\s*=\s*new\s*/\*[^\*]*\*/\s*\5[\(\)\s]{2,};[^\}\n]*\}(?<X2253512>)|\s*;\s*if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\n]{99,}\b(?:exit|die)[\(\);\s]+\}[^\?\n]{0,199}\bnew\s*\7[\s\(\)]+;[^\}]*\}(?<X1252270>))|_[GPRC]\w{2,6}(?:\[[^\]]+\][\s;]+if[\s\(]+!empty[\s\(]+\1[\s\)\{]+\$_[GPRCS]\w{2,6}\[[^>]{9,999}=>\s*\$\w+[\)\s;\}]+(\$\w{1,40})[=\s]+\w+[\s\(]+str_rot13[\s\(]+['"]uggcf?://[^'"]+['"][\.\s\)]+\1[\.\s'"]+\.txt['"\s\);@]+eval[\s\(]+['"]\?>['"][\.\s]+\9[\s\)]+;(?:\s*@?(?:exit|die)\b[^;]*;)?(?<X1261080>)|\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\w+[\(\s]+\1[\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\b[^;]+\11[\)\s;]+\bif[\s\(]+\11[^;]+(\$\w{1,40})[=\s]+['"]/tmp/sess[^;\$]+\1[^\}]+@include(?:_once)?[\(\s]+\12[\);\s]+\}(?!\s*else)(?<X1238110>))|_[GPRSC]\w{2,6}(?:\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+\1[\)\s]+;\s*\$\w{1,40}[=\s]+array[\(\s'"]+/https:\\/\\/pastes\\\.io\\\/raw\\/\+[^;:]+:\\/\\/raw\\\.githubusercontent\\\.com\\/[^;]+;\s*(\$\w{1,40})\s*=[^\}]{9,499}\bfile_put_contents[\(\s]+\15[,\s]+\14[\)\s;\}]+include\s*\15;(?<X1224510>)|\s*,[\(\s]*\$\w{1,40}[^\{\}\[\]]{0,99}function\b[^;]+return[^:\?\]]{9,199}array_merge[\(\s]+\$_[GPRSC]\w{2,6}[,\s]+\1[^>]{9,}(\$\w{1,40})[=\s]+empty[\s\(]+\1\[[^\]]+\][^!\n]{9,}stripos[\s\(]+\17\s*,[^;:]+file_put_contents[\s\(]+(\$\w{1,40})[,\s]+\17[^;\?]+\18\s*\?\s*exit[^'";:]*:(?<X1220461>))|_SERVER\[['"]HTTP_USER_AGENT['"\];\s]+if[\(\s]+preg_match[\(\s]+['"]/x64.\)\s*\(\.\*\)\s*.\(/is['",\s]+\1[,\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+\20\[\d+\][\s;]+\21[=\s]+str_replace[\(\s'"]+WebKit[^'"]+['"][,\s]+['"][^'"]*['"][,\s]+\21[\)\s;\}]+else\s*\{\s*@?(?:exit|die)\b[^;]*;\s*\}(?<X1214320>)|http\w+[\.\s]+['"]://['"][\.\s]+\$goweb\d*[\.\s]+['"]/[\w\-]+\.php\?[^;]+\$lang\h*;\s*\$\w{1,40}[=\s]+trim[\(\s]+\w+[\(\s]+\1[\)\s]+;(?<X1214150>))|\[\]\s*;(?:(?:\s*\$\w{1,40}[=\s]+\d+\s*;)*\s*\1\s*\[\s*\d+\s*\][=\s]+\w+[\(\s]+Array[\(\s]+\d+\s*,[^\)]*\)[\s\)]+;){9,}(?:\s*\$\w{1,40}[=\s]+\d+\s*;)*\s*\$\w{1,40}[=\s]+\$_COOKIE\s*;[^\^]{99,}\b\w+[\s\(]+\1,\1\[[^;]+;\s*\}(?<X2253700>)|\d+\s*;\s*foreach[\(\s]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}[=\s]+>\s*\$\w{1,40}[\)\s]+\{\s*if[\(\s]+strstr[\(\s]+strval[\(\s]+\$\w{1,40}[\)\s,'"]+wordpress_logged_in['"\s\)]+\{\s*\1[^\}]+\}\s*\}\s*if[\s\(]+\1[^;]+\bconst\s*\w{1,40}\s*=[\d\*\s]+;[^<]{9,9999}\}\)\(\)[;\s]*</script>['";\s]*\}(?<X1214972>)|\w{1,40}(?:[\(\s]+(?:(\$\w{1,40})[\)\s]*=>\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+FgEtS[\(\s]+FoPeN[\(\s]+StRrEv[\(\s]+StRtR[\(\s]+\26[,\s]+['"]\\x[\da-f]{2}\\[\\x\da-f]{99,}['"]\s*,\s*['"][\\x\da-f]{99,}['"][\s\),]+\d+[\s\)]+;\s*\1[\s\(]+['"][\\x\da-f]{9,}['"][\s\)]+;(?<X1224940>)|\$\w{1,40}[\)\s;]+if[\(\s]+strstr[\(\s]+\1[,\s]+['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+explode[\(\s]+['"][^'"]*['"][,\s]+\1[\)\s]+;(?:\s*if[\(\s]+\28\s*\[\d+\][^\}]{0,199}\becho\s*\28\s*\[\d+\][^;]*;[^\}]{0,199}\}){2,5}\s*\}(?<X1202900>))|\s*(?:\(\)[;\s]*if[\(\s]+!empty[\(\s]+\1[\)\s]+\{\s*\$\w{1,40}[=\s@]+\w{1,40}\s*\([^\}]{40,499}(\$\w{1,40})[=\s]+curl_exec[\(\s]+\$\w{1,40}[\)\s;]+\}\s*else\s*\{\s*\30[=\s]+file_get_contents[\(\s]+base64_decode[\(\s'"]+aHR0cDovL[a-z\d/\+]{9,99}=?=?['"\)\s;]+\}\s*echo\s*\30\s*;\s*\}\s*\}(?<X1204730>)|\^\s*(['"])[^;]+\32\s*;\s*(\$\w{1,40})[=\s]+['"]([^'"]+)['"]\s*;\s*\1[\s\(]+.?['"](.)\33\35e\w?.?['"]\s*,\s*['"][^\^]+\^[^,]+,\s*['"]\34['"][\s\)]+;(?<X1057382>)))|__DIR__[\.\s]+['"]/[^'"]{3,40}\.(?:png|jpe?g|ico|gif)['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+\1[\)\s]+;\s*if[\(\s]+\37[\)\s]+\{\s*@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\37[\)\s]+;[\s\}\?>]*\Z(?<X1222520>)|array[\(\s'"]+index['"][^;\)]+['"]wp\-config['"\)\s;]+foreach[\(\s]+\1\s*as\s*(\$\w{1,40})[\)\s]+\{\s*\bif[\(\s]+\39\s*==+\s*['"]\.htaccess['"\s\)]+(\$\w{1,40})[^\{\}]+\39\s*\.\s*['"]\.php['"];[^;]+clearstatcache[^;]+\40[\s\);]+(\$\w{1,40})[^\}]+@fclose[\(\s]+\41[\)\s]+;(?:\s*\}){4}(?<X1212700>)|base(?:64_decode(?:[\(\s'"]+L(?:2[^'"]{1,99}(?:(?:Ly5jYWdlZnMvL|LmNhZ2Vmcy8u|Y2FnZWZzLy4u|Ly5jcGFkZG9ucy8)[^'"]+|uLi4|Li4u)['"][\s\)]+;\s*if[\s\(]+!is_file[\s\(]+\1[\s\)]+\|+\s*filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*(\$\w{1,40})[\s=]+@?fopen[\s\(]+\1[,\s]+['"][wa][^;]+;\s*@?fwrite[\s\(]+\43[,\s]+file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0[^;]+['"][\s\)]+;[^\}]{0,99}\}(?!\s*else)(?<X1217990>)|[23][^'"]{1,99}uLg['"][\s\)]+;\s*if[\s\(]+!is_file[\s\(]+\1[\s\)]+\|+filesize[\s\(]+\1[\s\)]+[=!<>]{1,3}\d+[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]\1[\s,]+\45ge\46[\s\(]+base64_decode[\s\(]+['"]aHR0[^;]+['"][\s\)]+;\s*\}(?!\s*else)(?<X1218050>)|i4u['"][^\{\}]{1,499}\{[^,\}\[]{0,999}(\$\w{1,40})\s*=[^;*]+\1\b[^;]*;\s*(\$\w{1,40})\s*=[^;*]+\48\b[^;]*;[^!]{0,999}(\$\w{1,40})\s*=\s*fsockopen[\(\s]+\49[^;]+;[^\[]{0,499}(\$\w{1,40})\s*=[^;]+\50[^\?]{0,499}\becho\s*\51\s*;\s*\}\s*\}(?<X1240142>))|[\(\s]+['"](?:[^'"]{1,99}['"][\)\s;]+\$\w{1,40}[=\s]+file_ge\w+[\(\s'"]+https?:[/'"\.\s]+\1[\.\s]+['"][^'"]+\.php['"][\)\s;]+\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+if[\(\s]+defined[\(\s'"]+PHP[^;\{]+\{\s*\$\w+[\s=]+base64_decode[\('"\s]+PD9[^\}]+\}[^\*:\|]+file_pu[^;]+;(?<X1256110>)|PC9oZWFk\w{0,9}=?=?['"][\)\s;]+(\$\w{1,40})[=\s]+\1[\s;]+(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]PHNjcmlwdD4gZG9jdW1lbnQud3JpdGUoIjxzY3Jpc[^;\)'"]+['"][\)\s;]+(\$\w{1,40})[=\s]+\55\s*\.\s*['"](?:\\r)?\\n[^'"]*['"]\s*\.\s*\54\s*;[^\}]+\bstr_replace[\(\s]+\$\w{1,40}[,\s]+\56\s*,[^:;]+;\s*\}\s*\}(?<X1250900>)|PD9[^'"]{9,40}YmFzZTY0X2RlY29kZSgnUEQ5[a-z\d/\+]{999,}=?=?['"][\s\)]+;(?:\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s'"]+/[^'"]+\.php['"][,\s]+['"][aw]\+?['"][\)\s;]+fwrite[\(\s]+\58[,\s]+\1[\.\s]+PHP_EOL[\)\s;]+fclose[\(\s]+\58[\)\s]+;)+(?<X1229670>)))|name[\(\s]+(?:__FILE__[,\s]+(base64_decode)[\(\s]+['"](LnBocA[=\+]*)['"][\)\.\s]+\60[\(\s]+['"]\61['"][\)\s]+;\s*\$\w{1,40}[=\s]+file_get_contents[\(\s]+\1[\)\s]+;[^/]{0,999}\$\w{1,40}[=\s]+(?:\60[\s\(]+){2,}['"][^'"]+['"][\s\)]+;[^<>]{999,}<\s*rand\s*\([^<>]+\.php\s*>\s*/dev/null(?<X2228190>)|trim[\(\s]+preg_replace[\(\s]+\$\w{1,40}[\(\s]+['"]/\\[\(,\s]+\.\*\$/['",\s\)]+__FILE__[\)\s]+;\s*\1[=\s]+substr[\(\s]+str_repeat[\(\s]+\1[,\(\s]+strlen[\(\s]+(\$\w{1,40})[\)\s/]+strlen\b[^;]+;\s*(?:eval|assert)[\(\s]+(?:\1|\63)\^(?:\1|\63)[\)\s]+;(?<X2230280>))))
(\$\w{1,40})[=\s]+(?:c(?:hr[\(\s]+\d+[\)\.\s]+substr[\s\(]+['"][^'"]+['"][^;]+;\s*(\$\w{1,40})[=\s]+\1[\s\(]+substr[\s\(]+\$\w{1,40}[^;]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\2[\)\s]+;(?<X1222840>)|lass_exists[\(\s]+\$\w{1,40}[\)\s]+;\s*(\$\w{1,40})[=\s]+\1\s*;\s*if[\(\s]+!\4[\)\s\{]+class\s*(\w{1,40})\s*\{[^\n]{99,9999}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\5[\(;\)\s]+\$\w{1,40}[=\s]+NULL[;\s]+\}(?<X1248102>)|url_init(?:[\(\)\s;]+(curl_setopt)[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+['"]https?://[^'"\$]{9,}/\w{1,4}\.txt['"][\)\s]+;\s*\7[\(\s]+\1[,\s]+CURLOPT_RETURNTRANSFER[,\s]+\d+[\)\s;]+(\$\w{1,40})[=\s]+curl_exec[\(\s]+\1[\)\s;]+curl_close[\(\s]+\1[\)\s;]+echo\s*\8[\s;\?>]*\Z(?<X1229801>)|[\(\)\s]+;\h*curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0c[^'"]+['"][\s\)]+;[^\n=]{0,99}curl_setopt[\(\s]+\1[,\s]+CURLOPT_USERAGENT[,\s]+['"]Mozilla/[^\)]+\)['"\)\s]*;[^=\n]{0,999}(\$\w{1,40})[=\s]+curl_exec[\s\(]+\1[\s\)]+;\h*@?eval[\s\(]+\10[\s\)]+;(?<X1235270>)|[\(\s]+base64_decode[\(\s]+['"]aHR0c[^'"]{9,199}["'][\s\)]+;\s*curl_setopt[\s\(]+\1[,\s+]CURLOPT_RETURNTRANSFER[^;]+;\s*(\$\w{1,40})[=\s]+curl_exec[\s\(]+\1[\s\)]+;\s*@?eval[\s\(]+base64_decode[\s\('"]+Pz4[=\+]{0,2}['"][\s\.\)]+\12[\s\)]+;(?<X1223830>)))|explode[\(\s]+['"][^'"]*['"][,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+!\$_COOKIE\[[^\?\n]{9,999}curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s'"]+aHR0c[\w\+/=]+['"][\)\s]+\.['"\s]*\?[^\+\n]{9,299}(\$\w{1,40})[=\s]+file_get_contents[\(\s'"]+https?:[^&\n]+\14[^\}]+(?:exit|die)[^;]*;\s*\}(?<X1238570>)|f(?:ile_get_contents[\(\s]+['"](?:[^'"\$]+\.js['"][\)\s]+;\s*@?(?:passthru|system|exec|shell_exec|popen|eval|assert)[\(\s]+base64_decode[\(\s]+\1[\)\s]+;(?<X1234180>)|https://(?:\w+\.githubusercontent\.com/\w+/wso-webshell[^;]+;\s*file_put_contents[\(\s]+\$\w{1,40},\s*\1[\)\s]+;(?<X1233421>)|raw\.githubusercontent\.com/SilenceIsGold[^'"]{9,199}['"][\)\s]+;\s*echo\s*\1\s*;(?<X1220822>)))|unction[\(\s]+\$\w{1,40}(?:[,\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]*['"][\s;]+\$\w{1,40}[\s=]+['"][^'"]+['"][\s;]+\$\w{1,40}[\.\s=]+\$\w{1,40}\[[\(\s]\d+\s*[\*\-\+/]\s*\d+[^\]]*\]\s*\.[^\?]{999,}\$\w{1,40}[=\s]+['"][a-z\d/\+]{999,}['"][;\s]*(\$\w{1,40})[=\s]+\1[\s\(]+\19[^\?]{0,40}\$\w{1,40}[\s\(]+\19[\s\)]+;(?<X1211070>)|[\)\s]+\{\s*\$\w{1,40}[=\s]+['"](?:['"]\s*;\s*\$\w{1,40}[=\s]+['"]Mozilla/[^\?]{99,9999}\{\s*(\$\w{1,40})[\s=]+['"]aHR0c[^\}]+\}[^\*]{0,999}\becho\s*\1[\s\(]+\21[\s\)]+;\s*\}\s*\}(?<X1237790>)|[^'"]+['"]\s*;\s*\$\w{1,40}[\s=\.]+\$\w{1,40}\s*\[[\(\s]*\d+\s*[\-\*/\+][\s\(]*\d+[^;]+;[^\?]{99,999}\$\w{1,40}[=\s]+\1[\(\s]+(\$\w{1,40})\);\s*\23[=\s]+\$\w{1,40}[\(\s]+\23[\);\s]+\$\w{1,40}[\s\(]+\23[\s\)]+;(?<X1211290>))))|get_(?:contents[\(\s]+str_rot13[\(\s'"]+uggc[^'"]{6,}['"][\)\.\s]+['"][^'"]*['"][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\s]+\1[\)\s]+;(?<X1210550>)|users[\(\s\[]+['"]role['"=>\s]+(administrator)\b[^;]+;\s*foreach[\s\(]+\1\s*as\s*(\$\w{1,40})[\s\)]+\{\s*if[\(\s]+user_can[\(\s]+\27[,\s'"]+\26['"\)\s]+\{\s*if[\(\s]+function_ex\w+[\(\s'"]+(wp_set_cur\w+)['"\)\s]+\{\s*\28[\s\(]+(\27\->id)[^;]+;\s*wp_set_au\w+[\s\(]+\29[^\}]+\}(?:\s*\}){2}(?<X1258340>))|isset[\(\s]+(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\?\s*\31\s*:\s*(?:false|0|null)\s*;\s*if[\(\s]+\1\s*\S{2,3}\s*['"][^'"]+['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]|\1)[,\s]+\$\w{1,40}[^=]{0,99}\}(?!\s*else)(?<X1212900>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\?\s*trim[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+;\s*(\$\w{1,40})[=\s]+(\w{1,40})[\(\s]+['"][^'"]*['"][\.\s]+\1[\)\s]+;\s*@eval[\(\s]+\33[\)\s;]+function\s*\34[\(\s]+\$url\d*[\)\s]+\{\s*(?:(?:else|if)[^\}]+return\s*\$\w{1,40}[\s;]+\}\s*)+\}(?<X1205280>))|md5[\(\s]+\1[\)\s;]+\$\w{1,40}[=\s]+strlen[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+urldecode[\(\s]+base64_decode[\(\s]+\36[\s\);]+\$\w{1,40}[=\s]+strlen[\s\(]+\36[^'"]{1,99}(\$\w{1,40})[=\s]+['"]['"][^#]{99,9999}if\(substr\(\37[^;]+\1[^;]+eval\b[^;]+\37[^\}]{0,40}\}(?<X1219100>)|new\s*\w{1,40}\s*\(\);\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[(\w+::\w+)[\(\s]+['"]\w+['"]\s*[\.,][^\]]+\][\)\s]+&&\s*isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+null\s*;[^%]+\bcase\s*\39[^;]+\40[\s=]+\1\->[^\}]+\}\s*(?:die|exit)[\s\(]+\40[\s;\)]+\}(?<X2221471>)|ob_get_clean[\(\)\s;]+ob_start\(\);\s*(\$\w{1,40})[=\s]+['"].<body[^;]+;\s*if[\(\s]+preg_match[\(\s]+\42[,\s]+\1[,\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+\43\[\d+[\]\s;]+\$\w{1,40}[=\s]+base64_decode[\(\s]+['"]aHR0c[^'"]+['"][^\.]{0,999}\44\s*\.=\s*['"]<script(?:[^\}]+\}){2}\s*echo\s*\1;(?<X1255550>)|preg_replace[\(\s]+(\$\w{1,40})[\(\s]+['"].\\?\(\.\*\$.['"][\),\s]+['"]['"][,\s]+__FILE__[\)\s;]+\1[=\s]+trim[\(\s]+\1[\)\s]+;\s*\46[=\s]+substr[\(\s]+\46[,\s]+\d+[\)\s]+;\s*\1[=\s]+basename[\(\s]+\1[\)\s]+;\s*return\s*\1\s*;(?<X2255310>)|range[\(\s]+chr[\(\s]+\d+(?:(?:[\),\s]+chr[\(\s]+\d+[\)\s]+)+;(?:(?:\s*(\$\w{1,40})\s*=\s*(?:array)?[\$\(@\{]*?\1\[\d+\]\s*(?:[\.\}\[,]+\s*\1\[\d+\]+){5}[^;]+;)+[^\}]+@\48\[\d+\]\(['"]{2}[,\s]+\1\[[^;]+;\s*\b(?:exit|die)\b[^;]{0,19};\s*\}(?<X1210220>)|(?:\s*(\$\w{1,40})\s*=\s*(?:array)?[\$\(@\{]*?\1\[\d+\]\s*(?:[\.\}\[,]+\s*\1\[\d+\]+){5}[^;]+;)+\s*(\$\w{1,40})\s*=\s*@?\50[\s\(]+\1\[\d+\](?:[\.,\s]+\1\[\d+\]){9,}\)\s*;\s*@\51[\s\(]+['"][^'"]{999,}['"][\s\)]+;(?<X1210210>))|(?:[\),\s]+chr[\(\s]+\d+[\)\s]+;\s*(\$\w{1,40})[=\s]+\$[\{\s]+\1\s*\[\d+\](?:\s*\.\s*\1\s*\[\d+\])+[\s\}]+;\s*if[\(\s]+in_array[\(\s]+gettype[\(\s]+\53[\)\.\s]+count[\(\s]+\53[\)\s]+[,\s]+\53[\)\s]+\S{2,3}\s*count[\(\s]+\53[^;]+&&\s*\53\s*\([\s\);]+\}(?<X1214911>)|\s*\)(?:[,\s]+chr[\(\s]+\d+[\)\s]+)+;(?:\s*(\$\w{1,40})[=\s]+\$\{\s*\1\[\d+\](?:\s*\.\s*\1\[\d+\])+\s*\}\s*;)+\s*@\(count\(\55\)\S{2,3}\d+\S{2,3}\bin_array\(gettype\(\55[^;@]+@\55[\s=]+\55\[\d+\][\(\s]+\55\[\d+\][\s,]+\55\[\d+\]\([^:;]+\55[\s\(\)]*:\s*\55[\s\(\)]*;(?<X1211691>)))|s(?:tr(?:rev[\(\s]+base64_decode[\(\s]+strrev[\(\s]+\1[\)\s]+;\s*(\$\w{1,40})[=\s]+tmpfile[\(\)\s]+;\s*(\$\w{1,40})[=\s]+stream_get_meta_data[\(\s]+\57[^:]+;\s*fwrite[\(\s]+\57[,\s]+\1[^\}]{0,99}include(?:_once)?[\(\s]+\58[\)\s]+;\s*\}\s*fclose[\(\s]+\57[\)\s]+;(?<X1221440>)|val[\(\s]+(\$_SERVER\[)['"]HTTP_REFERER['"]\][\)\s;]+\$\w{1,40}[=\s]+\w{1,40}[\(\)\.\s]+\60[^\]]+\][\s;]+if[\(\s]+strpos[\(\s]+\1[^;]+;\s*(\$\w{1,40})[=\s]+array\b[^:\{\}]{9,499}(\$\w{1,40})[=\s]+\w+['"\(\s]+https?://\w+\.\w+(?:\.\w+)+/?['"][^;]+\61[^\?]{99,999}echo\s*\62[^;]+;[^\}]{0,40}\}(?<X1223711>))|ubstr[\(\s]+(?:@\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE['"]\][,\s]+0[,\s]+\d+[\)\s]+;[^\{\}]{0,199}(\$\w{1,40})[=\s]+['"][^'"\$]+['"]\s*;\s*(\$\w{1,40})[=\s]+curl_init\s*\([^:]{0,99}://[^;]+\64[^;]+;[^'"]{0,999},[^:]+\1[^;]+;[^!]+curl_close[\s\(]+\65[\s\)]+;(?<X1239790>)|file_get_contents[\(\s]+__FILE__[\),\s]+\-\d{3,}[\)\s]+;(?:\s*\1[=\s]+str_replace[\(\s]+['"][^'"]*['"][,\s]+['"][^'"]*['"][,\s]+\1[\)\s]+;){2,}\s*(\$\w{1,40})\s*=\s*['"\h\.gzuncompres]{15,40};\s*@?eval[\s\(]+\67[\s\(]+\1[\s\)]+;\s*(?:exit|die)\b[^;]*;(?<X1279751>)))|tmpfile[\(\);\s]+(\$\w+)[=\s]+rawurldecode[\(\s]+base64_decode[\(\s]+\$\w+[\)\s;]+fwrite[\(\s]+\1[\s,]+['"]<\?[ph\s]*["'][\s\.]+\69[\s\);@]+include(?:_once)?\s*stream_get_meta_data[\(\s]+\1[\)\s]+\[[^\]]+\][\s;@]+fclose[\(\s]+\1[\)\s]+;(?<X1249110>)|u(?:niqid[\(\)\s]+;\s*if[\s\(]+@copy[\s\(]+['"]https?://paste\.ee[^\$]+\1[\s\.]+[^\{]+[\{\s]+echo\s*\1[\s\.]+[^\?]+echo\s['"]Fail\.['"];[\s\}]+(?<X1218440>)|pload_shell[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+(?:!empty|isset)[\(\s]+\1[\)\s\{]+(\$\w{1,40})[\[\]=\s]+['"]http://['"][\.\s]+\1[\s;\}]+echo\s*serialize[\(\s]+\72[\)\s]+;(?<X2222130>)))
(\$\w{1,40})\h*=\h*(?:(?:\$\w{1,40}\.){1,9}\$\w{1,40};\s*if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\h*\[\1\([^\]]+\][^\}\n]{9,999}(\$\w{1,40})\h*=\h*\1\(['"][^"']+['"]\);[^\}\n]{0,999}\bmail[\s\(]+\2\h*,[^;]+;\s*\}(?<X1194740>)|(?:bin2hex|hex2bin)\h*\(\h*\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\)\h*;\h*(\$\w{1,40})=['"][^;]{1,99};\h*(\$\w{1,40})\h*=\h*(?:bin2hex|hex2bin)\h*\(\h*\4\h*\)\h*;\h*\5\h*\(\h*(?:bin2hex|hex2bin)\h*\(\h*\1(?:\h*\)){2}\h*;(?<X1189500>)|(?:null|['"]{2}|false);\s*switch\h*\(\h*\$\w{1,40}\)\s*\{[^\$]{0,99}\1\h*=\h*new\h+Flooding\h*\(['"](?:udp|tcp)://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}['"]\h*,\h*(?:80|443|8?53),\h*\d+\h*\)\h*;\s*\1->(?:Udp|Tcp)Flood\h*\(\);(?<X2142021>)|([peas](?:assthru|ystem|xec?(?:ute)?|hell_exec|open))\(['"]gcc\h+\-o\h+(/tmp/\S+)\h+(/tmp/[^\s'"]{1,49})['"]\);\s*@?unlink\(['"]\10['"]\);\s*\1\h*=\h*\8\(['"]\9(?<X2142270>)|(\$\w{1,40})\[\d+\]\h*(?:\.\h*\12\[\d+\]\h*)+;(?:\s*(\$\w{1,40})[\h=]+['"][^'"]{0,40}['"][\h\.]+chr\(\d+\)\h*(?:\.['"][^'"]{0,40}['"][\.\s]+chr\(\d+\)\h*)+(?:\.['"][^'"]{0,40}['"]\h*)?;)+\s*(\$\w{1,40})[\h=]+\$\w{1,40}[\s\.]+\13;\s*\1\(\12\[\d+\]\h*(?:\.\h*\12\[\d+\]\h*)+,\h*\14\h*,[^;]{0,19};(?<X1187950>)|(\$\w{1,40})\h*=\h*substr\h*\(\h*\$_SERVER\h*\[['"]PHP_SELF['"]\]\h*,[^;]{1,99};\s*function\h+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*if\h*\(\h*@?chmod\h*\(\h*\18\h*,\h*\d{3,4}[^;]+;\s*\}[^\}]{1,99}(?:\}\s*)+\17\h*\(\h*(?:\1|\16)\h*\)\h*;(?<X1167070>)|(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*;\s*echo\h*\1\h*;\s*if[\(\s]+!?(?:empty|isset)?[\(\s]+\$(?:auth|s)_pass[\)\s]+\{\s*if[\s\(]+isset[\(\s]+\20[^;]+setcookie[\(\s]+md5[\(\s]+\$[^;]+;[^\}]{0,999}\bws[[o0](?:L[o0]gin)?[\(\s\)]+;\s*\}(?<X1189720>)|(base64_decode)\(['"]Y29weQ=?=?['"]\);[^\?]{99,999}\bif\(\$_[GPRSC]\w{2,6}\h*\[\22\(['"]\w{2,8}[=\+]{0,2}['"]\)\]\h*\D{2,3}\h*\w{2,40}\h*\)\s*\{\s*if\h*\(\h*@?\1\h*\(\h*\$_FILES\[\22\(['"]\w{2,8}[=\+]{0,2}['"]\)\][^;]+;\s*\}\s*else\s*\{[^\}]+\}(?:\s*\}){2}(?<X1163532>)|(curl_)init\h*\(\h*['"]https?://[^/\.]{1,40}\.github(?:usercontent)?\.(?:io|com)/[^;]{1,99};[^\?\}]{1,199}\$(\w{1,40})\h*=\h*\24exec\h*\(\h*\1\h*\);\s*@?(?:eval|assert)\h*\(\h*['"]\?>(?:['"]\h*\.)?\h*\$\25\h*(?:['"]\h*)?\);(?<X1173182>)|(JRequest::getString\()[^;]+(['"]cookie['"])[\)\h]+;\s*if[\s\(]+\1[\s\)\{]+(\$\w{1,40})[\h=]+\1[\h\(]\27[^;]+\28[\)\h]+;\s*(\$\w{1,40})[\h=]+\1[\h\(]\27[^;]+\28[\)\h]+;[^\}]{0,40}(?:\29|\30)[\s\(]+['"].(.{0,40}).e['"][\s,]+(?:\29|\30)[\h,]+['"]?\31['"]?[\h\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190840>)|(str_i?replace)\h*\(\h*['"][^'"]{1,9}['"]\h*,\h*['"]['"][^;]+\)\h*;\s*(\$\w{1,40})\h*=\h*\33\h*\(\h*['"][^'"]{1,9}['"]\h*,[^;]+\)\h*;\s*(\$\w{1,40})\h*=\h*(?:\1|\34)\h*\(\h*\33\h*\([^;]+;[^\{\}\?\[\]]{1,199}\$\w{1,40}\h*\(\h*\1\h*,\h*\35\h*\)\h*;(?:\s*(?:include|unlink)?\h*\(?\1\)?;){2}(?<X1165520>)|@(\$_SERVER\[)['"]HTTP_ACCEPT_LANGUAGE['"\]\s;]+\$\w{1,40}[\s=]+(urlencode)[\(\s]+\1[\)\s;]+(\$\w{1,40})[\s=]+['"]{2}[;\s]+if[\(\s]+isset[\(\s]+(\37[^\]]+\])[\)\s\{]+\39[=\s]+\40[\s;]+\39[=\s]+\38[\(\s]+\39[\)\s;\}]+\$\w+[=\s]+(?:(?:sha|md)[1526]+[\(\s]+)+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X1237350>)|@?((file_)ge(t_contents))\h*\(\h*(\$\w+)\h*\);\s*(\$\w+)\h*=\h*filemtime\h*\(\h*\45\h*\);[^\{@!]{1,99}\b(?:(?:if\([^\)]+\)|else)\s*\{\s*@?\43pu\44\h*\(\h*\45\h*,\h*\1\h*\.\h*['"](?:\?>)?['"]\h*\.\h*\42\h*\([^;]{1,99};\s*@?touch\h*\(\h*\45\h*,\h*\46\h*\);\s*add_option\([^;]{1,99};\s*\}\s*){2}(?<X1170710>)|@?(file_)ge(t_contents\()[^;]{1,99};\s*@?\48pu\49(\$\w{1,40}),\h*\1\);\s*(?:@?chmod\(\h*\50,[^;]{1,99};\s*)?(\$\w{1,40})\h*=\h*['"][^'";]{0,99}\50\h*&?>[^;]{1,99};\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\(\h*\51\b[^;]{1,99};(?<X1183011>)|@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*@?\1[\s\(]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(\$\w{1,40})\h*=\h*@?\1[\s\(]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(?:\53|\54)[\s\(]+.?['"](.).{0,40}\55e\w?.?['"]\s*,\s*\$\w{1,40}\h*,\h*['"]?\w{1,40}['"]?[\s\)]+;(?<X1191620>)|@?trim[\(\h]+@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;\s*if[\(\h]+\1[\h\)]+\{\s*(\$\w{1,40})[\h=]+strrev[\(\h]+['"]31t[^\}]+\$\w{1,40}[\h=]+\57[\(\h]+['"][^\}]+\1[\)\s\'";]+(\$\w{1,40})=\$\w{1,40}\(\57\([^;]+;\s*(\$\w{1,40})[\h=]+\58\(['"]{2}[^\}]+\59\(\);\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1184040>)|@get_current_user\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*['"]\1['"]\h*;[^\}><\?]{1,499}(\$\w{1,40})\h*=\h*['"]From:\h*<\61>[^;]{0,9};[^;]{0,99}\bmail\h*\([^;]+\62\h*\)(?:[\s\)]+(?:else\s*)?\{\s*echo[^=\}]{1,99}\}){1,2}(?<X1171510>)|@gz(?:inflate|uncompress)[\(\h]+strrev[\(\h]+\$\w{1,40}[\)\h]+;[^\?]{0,499}\bif\s*\(\s*crc32[\s\(]+\1[\)\s]+\S{2,3}\s*\$\w+[\)\s]+\{\s*(\$\w{1,40})\s*=\s*create_function[\s\(]+['']\$\w+['"][,\h]+\$\w{1,40}[\)\s]+;\s*@?\64[\s\(]+['"][^"']+['"][\)\s]+;\s*\}(?<X1038773>)|['"\.preg_lac\h]{14,69};\s*@?\1(?:\h*\(\h*['"](\W)[^,]{1,49}\66e['"]\h*,\h*\$_[GPSCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?<X1147942>)|\s*\(\s*['"](\W)[^,]{1,49}\68e['"]\h*,\h*\$_[GPSCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?:\s*(?:exit|die)[^;]{0,9};)?(?<X1148333>))|['"\s\.creat_funio]{20,40}\h*;\s*(\$\w{1,40})\h*=\h*\1\h*\(\h*['"](\\?\$\w{1,40})['"]\h*,\h*['"][eval'"\.\h]{9,40}['"]\h*\(\h*['"][\?>]{2}['"]\h*\.\h*['"\h\.base64_dco]{20,40}\(\71[\h\)]+;\h*['"]\h*\)\h*;\s*\70\h*\(\h*['"][^'"]{999,}['"][\h\)]+;(?:\s*(?:exit|die)\b[^;]{0,9};)?(?<X1156870>)|['"]['"\h\.base64_ncod]{15,40}['"]\h*;\s*(\$\w{1,40})\h*=\h*\1[\(\h]+\$\w{1,40}[\)\h]+;[^#`]{9999,19999}\.\h*\73;[^!\{]{0,99}if[\h\(]+!\h*strstr\h*\(\h*(\$\w{1,40})[^\*\|]{99,999}\bheader[\h\(]+['"]Location:\h*['"][^;]+\74[\h\)]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\}){3}(?<X1190770>)|['"][^'"]{0,49}\.htaccess['"];\s*(\$\w{1,40})\h*=\h*['"]\1['"];\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*\76[^;]{1,49};\s*(\$\w{1,40})\h*=\h*['"][^'"]{1,199}\b(?:AddHandler\h+cgi\-script\h+\.cin\s*){2}['"];\s*fwrite\h*\(\h*\77\h*,\h*\78\h*\)\h*;(?<X2146420>)|['"][^'"]{1,40}['"]\^['"][^'"]{1,40}['"]\h*;\h*(\$\w{1,40})\h*=\h*\1\h*\(\h*['"]{2}\h*,\h*['"]{2}\h*\^\h*['"]{2}\h*\)\h*;\h*@?\80\h*\(\)\h*;(?<X1166240>)|['"][^'"]{40,499}['"];\s*(\$\w{1,40})\h*=\h*(\$this\h*\->\h*\w{1,40}\h*\()\h*['"]\w{9,99}['"]\s*\);\s*(\$\w{1,40})\h*=\h*\82\h*\(\h*['"]{2}\h*,\h*\83\h*\1[\h\)]+;\s*\84\h*\([\h\)]+;(?<X1187330>)|['"][^'"]{49,99}['"];\s*if\h*\(\h*(version)_compare\(\h*PHP_\86\h*,[^\)]{1,49}[\)\s]+\{\s*@?error_reporting\([^;]{1,199};\h*\}\h*(\$\w{1,40})\h*=\h*str_i?replace\([^\)]+\1\);\s*(\$\w{1,40})\h*=\h*['"][^'"]{9999,}['"];\h*(\$\w{1,40})\h*=\h*\87\(\88\);\s*@?\w{1,40}\(\89[^;]{0,19};(?<X1143881>)|['"][^'"]{9,99}['"];\s*(\$\w{1,40})\h*=\h*(['"]['"]);\s*foreach\(\[[\d,]{9,13}\]\h*as\h*(\$\w{1,9})[\)\s]+\{\s*\91\h*\.=\h*\1\[\93\];\s*\}\s*if\(isset\(\$_[GPRSC]\w{2,6}\h*/\*[^\*\v]{99,}\*/\h*\[[^@:\->]{99,9999}\$\w{1,19}\h*=\h*\$\w{1,19}\(\92,\h*\$\w{1,19}\(\$\w{1,19}[\h\)]+;\s*\}(?<X1140080>)|['"][^'"]{9,99}['"]\h*;\s*\bif\h*\(\h*(version)_compare\h*\(\h*PHP_\95\h*,[^\)]{1,49}[\)\s]+\{?\s*error_reporting\([^;]{1,199};\s*(?:\}\s*)?\$\w{1,40}\s*=\s*str_i?replace\h*\([^\)]+\1\h*\)\h*;(?<X2143871>)|['"][preg_lac'"\.\h]{14,40}['"]\h*;\s*@?\1\h*\(\s*.?['"](.).{0,40}\97e\w?.?['"]\s*,\h*['"][eval\h\.'"]{4,40}\([^;]{1,99}\)\h*;(?<X1191010>)|['"]\\x63\\x72\\x65\\x61\\x74\\x65\\x5f\\x66\\x75\\x6e\\x63\\x74\\x69\\x6f\\x6e['"]\h*;\s*(\$\w{1,40})\h*=\h*@?\1\h*\(\h*['"][^'"]{0,9}['"]\h*,\h*['"][^'"]+['"]\h*\)\h*;\s*@?\99\h*\(\h*['"][^'"]{999,}['"]\h*\)\h*;(?<X1188410>)|['"]\w{1,9}['"];\s*\1\h*=\h*['"]\w{1,9}['"]\h*\.\h*\1\h*\.\h*['"]\w{1,9}['"];\s*if\h*\(\h*\$\w{1,40}\W{2,9}\$\w{1,40}[\s\)]+\{\s*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,[^;\}]+\1\h*\(\h*array\h*\([^\}]+(\$\w{1,40}\);)\s*\}\s*else\s*\{\s*\1\h*\(\h*array\h*\([^;]+\101(?:\s*\}){2}(?<X1165482>)|['"]aHR0cHM6Ly9zZW9oYWNr[^'"]{9,99}['"]\h*;(?:\s*\1[\s=]+(?:base64_decode|file_get_contents)[\s\(]+\1[\s\)]+;)+\s*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\h\(]+(?:(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\1[\s\)]+;(?<X1192670>)|['"]aWYobWQ1K[^;]{9,999}['"]\h*;\h*@?\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)(?:[\h\(]+(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\s*\1[\s\)]+;(?<X1192510>))
(\$\w{1,40})(?:[=\s]+wp_(?:create_user[\(\s]+['"][^'"\$]+['"][,\s]+['"][^'"]+['"][,\s]+['"][^'"]+['"][\)\s]+;\s*\$\w{1,40}[=\s]+new\s*WP_User[\(\s]+\1[\)\s]+;\s*\$\w{1,40}\->set_role[\(\s]+['"]administrator['"][\)\s]+;[\?>\s]*\Z(?<X1210150>)|upload_dir[\(\);\s]+(\$\w{1,40})[=\s]+\1\[['"]basedir['"]\][\s\.]+['"]/\w+['"\s;]+if[\s\(!]+is_dir[\s\(]+\3[\s\)\{]+wp_mkdir_p[\s\(]+\3[\s\);\}]+(\$\w{1,40})[=\s]+tempnam[\s\(]+\3[,\s]+['"][^'"]+['"][\s\);]+if[\s\(]+\4[\s\)\{@]+file_put_contents[\s\(]+\4[^;]+;\s*include[\s\(]+\4[^\}]+\}(?<X1222200>))|[@=\s]+fopen[\(\s]+__FILE__[,\s]+['"]r['"][\)\s;@]+fseek[\(\s]+\1[^;]+;\s*(\$\w{1,40})[=\s]+stream_\w+[\(\s]+\1[\)\s;]+fclose[\(\s]+\1[\)\s;]+\$\w{1,40}[=\s]+create_function[\(\s]+['"][^'"]*['"][,\s]+(?:(?:gz(?:uncompress|inflate)|strrev|substr)[\(\s]+){2,}\6(?<X2205861>)|[\h=]+(?:@?create_(function)[\h\(]+['"]{2}[,\h]+(['"])[^;]{1,99}\b\8\h*(\w{1,40})\b[^\?\n]{1,299}(\$\w{1,40})[\h=]+@?unserialize\(\10\(base64_decode\(\11\),[^\{\}\n]{1,299}\{\s*@?eval\(\11\[[^;]{1,99};\h*@?(?:die|exit)\b[^;]{0,19};\h*\}\h*\9\h*\);\s*@?\1\s*\(\s*\);(?<X1194411>)|['"](?:(?:\w{2,6}[GPCSR]_|_[GPCSR]\w{2,6})['"];\h*(\$\w{1,40})\h*=[^;]{0,99}\1\b[^;]{1,99};\h*if\h*\([^\)]{0,99}\13\b[^;\{\n]{1,99}(?:\{\h*)?@?preg_replace[\h\(]["'](\W)[^,'"]+\14e['"]\h*,[^;]{0,99}\13\b[^;]{0,99};(?:\h*\})?(?<X1193190>)|[^'"]+['"]\h*\^\h*["'][^'"]+['"];\h*(\$\w{1,40})[=\s]+&\$\1;\h*(\$\w+)[=\s]+array[\(\s]+['"]\w+['"]\s*=>\s*@\16\s*\[['"][^'"]+['"](?:\s*\^\s*['"][^'"]+['"])+\s*\]\s*,[^;]+\)\s*;\s*(\$\w{1,40})[=\s]+['"][^'"]+['"](?:\s*\^\s*['"][^'"]+['"])+\s*;\s*\18[\s\(]+\17[\s\)]+;(?<X1231851>)|wp\-includes/[^\;]+\.js['"];[^\)]{1,999}@filesize\((\$\w+)[^\(]+file_get_contents\(\1\)[\)\s\{]+@unlink\(\20\);file_put_contents\(\20[,\s]+base64_decode\(\$\w+[\);\}]+if\(\w+\(\20[\)\s]+require_once\(\20\);(?<X1281821>))|\$_COOKIE;\s*\1[\h=]+(\$\w{1,40})\s*\[\s*\d+\s*\][\s\(]+\1[\s,]+\$_[GPRSC]\w{2,6}[^;]*;[^\*]{0,9999}\w+[\(\s]+\22[,\s]+\22\s*\[\s*\d+\s*\][\(\s]+\22\s*\[\s*\d+\s*\][,\s]+\$\w{1,40}\s*\^[^;]+;\s*\}(?<X1249191>)|array[\h\(]+[^)]{20,80}\);\s*foreach[\h\(]+\1\h*as\h*(\$\w{1,40})[\s\)\{]+\$\w{1,40}\s*\.=\s*\$\w{1,40}\[\24\];\s*\}\s*\$\w{1,40}[\h=]+strrev[\h\(]+['"\s\.creat_funio]{15,40}[\h\)]+;(?<X2049753>))|[\s="'htps:/]+\b(?:raw|gist)\.githubusercontent\.com/hacker\-d[^;]+;[^\?]{0,19999}(\$\w{1,40})[\s=]+\w+[\s\(]+\1[^;]+;[^\?]{0,999}\becho\s+eval['"\(\?>\.\h]+\26[\s\);]+\}\s*else\s*\{[^\}\{]*\}(?<X1274661>)|[\s='"]+/tmp/\.[a-z_]+\d*['";\s]+if[\(\s]+file_exists[\(\s]+\1[\)\s]+\{\s*\$\w{1,40}[=\s]+fopen[\(\s]+\1[,\s'"]+w['"](?:[^:]{0,199}@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s'"]+cd\b[^\):]{0,99}https?://[^;\-]+\.(?:png|gif|jpe?g)\s*\-o\s+([\w\.]+)[^/\}]{0,40}\./\28[^\)]+\)[\s;]+\})+(?<X1214891>)|[\s=]+(?:(\$\w{1,40})\[\d+(?:\](?:(?:[\.\s]+\30\[\d+\])+\s*;\s*(\$\w{1,40})[\s=]+\30\[\d+\](?:[\.\s]+\30\[\d+\])+\s*;\s*@?eval[\s\(]+\1[\s\(]+\31[\s\(]+(\$\w{1,40})\[\d+\](?:[\.\s]+\32\[\d+\])+[\s\);\?>]+\Z(?<X1226370>)|(?:[\s\.]+\30\[\d+\])+\s*;\s*(\$\w{1,40})[\s=]+\30\[\d+\](?:[\s\.]+\30\[\d+\])+\s*;[^\(\)]{0,499}\beval[\s\(]+(?:(?:\1|\34)[\s\(]+){2,}(\$\w{1,40})\[\d+\](?:[\s\.]+\35\[\d+\]){9}[^\)]{999,}\)[\s\)]+;(?<X1227430>)|(?:\.\30\[\d+\])+[\s;]+(\$\w{1,40})[\s=]+\30\[\d+\](?:\.\30\[\d+\])+[\s;]+(\$\w{1,40})[\s=]+\30\[\d+\](?:\.\30\[\d+\])+[\s;]+if(?:[\s\(]+@?(?:\1|\37|\38))+[\s\)]+\{\s*(\$\w{1,40})[\s=]+@?(?:\1|\37|\38)[\s\(]+['"]{2}[\s,]+@?(?:\1|\37|\38)[\(\s]+['"][^'"]{99,}['"][\s\);]+@\39\(\);\s*\}(?<X1217570>))|\s*[/\*\+\-]\s*\d+[^\]]*\]\s*\.[^;]+;\s*(?:(\$\w{1,40})[\s=]+\30\[\d+\s*[/\*\+\-]\s*\d+[^\]]*\]\s*\.[^;]+;\s*)+\$\w{1,40}[\s=]+['"]\\[a-f\d\\x]{999,}['"];[^\(]{0,999}(\$\w{1,40})[\.=\s]+(?:\1|\41)[\s@\(;]*(\$\w{1,40})[\s=]+(?:\1|\41)[\s\(]+['"]{2}[,\s]+\42[\s\);@]+\43[\s\(\)]+;(?<X1211050>))|(\$_SERVER\[)['"](DOCUMENT_ROOT)['"]\][\s\.]+['"]/ind['"]\s*\.\s*['"]ex\.php['"]\s*;\s*(\$\w{1,40})[\s=]+\45['"]\46['"]\][\s\.]+['"]/\.htac['"]\s*\.\s*['"]cess["'][^\{\}]{0,499}\bif[\s\(]+\1[^\}]+\}[\s\}]*\bif[\s\(]+\47[^\}]+@file_put_contents[\s\(]+\47[,\s]+file_get_contents[^;]+;[^\}]+\}\s*\}(?<X1225030>)|['"](?:(?:%[a-f\d]{2}){9}[%a-f\d]+['"]\s*;\s*\$\w{1,40}[\s=]+['"]http['"]\s*;[^!:]{0,9999}\$(?:goweb|urlshang|web|(?:html_?)?content)[\s=]+str_rot13[\s\(]+urldecode[\s\(]+\1[\s\)]+;(?<X1222213>)|(?:\.+/)*\.htaccess['"]\s*;\s*(\$\w{1,40})[=\s]+strtolower[\(\s]+(file_)ge(t_contents)[\(\s]+\1[\)\s]+;\s*if[\(\s]+preg_match[\("'/\s]+(?:(?:allow|deny)\s+from\s+all|order\s+(?:allow|deny))['",\s/]+\50[^%]{9,9999}(\$\w{1,40})[=\s]+['"]<IfMo[^;]+;\s*@?\51pu\52[\s\(]+\1[,\s]+\53[\s\);]+\}(?<X1218380>)|/(?:var|home\d*)?/[^'"\$]+/\.\w+\.\w*['"][;\s]+(\$\w+)[\s=]+substr[\s\(]+\1[\s,]+\d+[\s@\);]+include_once[\s\(]+\55[\s\)]+;(?<X1258252>)|[^'"]{999,}['"];\s*(\$\w+)[\s=]+str_replace\s*\([^;]{1,199};\s*(\$\w+)[\s=]+['"base64dco_\.]{18,};\s*@?eval[\s\(]+(?:(?:\57|\58)[\s\(]+){2}[^\)]+,\s*\1[\s\)]+;(?<X1194170>)|aWYo[^'"]+['"][\s;]+(\$\w{1,40})[\s=]+['"]['"\h\.streplac_]{11,40}['"][\s;]+(\$\w{1,40})[\s=]+\60[\s\('"]+\w+['"]['"\s,]+['"]\w{5,40}['"][\s\);]+(\$\w{1,40})[\s=]+\60[\s\('"]+\w+['"]['"\s,]+['"]\w{5,40}['"][\s\);]+(\$\w{1,40})[\s=@]+(?:\61|\62)[\s\(]+['"]{2}\s*,[^;]*\1[\s\);@]+\63\(\);(?<X1210540>)|c['"\s\.]+h[\s\.'"]+r['"]\s*;(?:\s*(\$\w{1,40})[\s=]+\1[\s\(]+\d+[\-\+\*/]\d+[\s\)]+(?:\.\s*\1[\s\(]+\d+[\-\+\*/]\d+[\s\)]+)+;)+\s*(?:\$\w{1,40}[\s=\(]+){3}['"][a-z\d\+/]{9999,}={0,2}['"][\)\s;]+(\$\w{1,40})[\s=]+\65[\(\s]+['"]{2}[,\s]+\$\w{1,40}[\)\s;@]+\66\s*\(\s*\)\s*;(?<X1212300>)|https?://raw\.github[^;]+;[^\{\}\?]{0,99}\b(curl_setopt[\s\(]+(\$\w+)[\s,]+CURLOPT_)URL[\s,]+\1[\s\)]+;[^\}\{\?]{0,199}\b\68FILE[\s,]+(\$\w+)[\s\)]+;[^\?\{\}]{0,199}\bcurl_exec[\s\(]+\69[\s\)]+;[^\?\{\}]{0,199}\bfclose[\s\(]+\70[\s\)]+;(?<X1196140>))|['"]{2};\s*\1[=\s]+isset\(\1\)[\s&]+\1[\s'"=]+\?\s*(\$_SERVER)\[['"]SCRI[^;]+:\s*\1;(?:\s*\$\w+[=\s]+\72\[[^;]+;){3,}[^\{\}]{0,199}\{[^\{\}]{0,199}(\$\w+)[=\s]+false[^\*]+\bif[\s\(]+\73\h*!=[^;]+(\$\w+)[=\s]+['"]http[^;]+;\s*(\$\w+)[=\s]+\w+[\s\(]+\74[,\s]+\$\w+[\s\);]+echo\s*\75[^\}]*\}\s*\}(?<X1271930>)|\$_(?:[GPRSC]\w{2,6}\s*;(?:[^\)]{0,40}\bcount[\(\s]+\1[^;]{0,40}&&in_array[\(\s]+gettype[\(\s]+\1[\)\.\s]+count[\(\s]+\1[^:]+\1[\(\)\s]+:\s*\$\{\$\{['"]GLOBALS['"]\}(?:\[[^\]]+\]\}\s*;)?(?<X1227651>)|\s*if[\(\s]+\$\w{1,40}\s*\[[^\]]+\]\s*\S{2,3}\s*[^\s;'"\(\)\$]{1,40}['"\)\s]+\{\s*\1\s*\[[^\]]+\]\s*\S{2,3}\s*[^\s;'"\(\)\$]{1,40}\1\s*\[[^\]]+\][\s\(]+\1\s*\[[^\]]+\][\s\);]+\}\s*@?(?:eval|assert)[\s\('"\?>\.]+file_get_contents[\s\(]+\1\s*\[[^\]]+\][\s\)]+;(?<X1207000>))|COOKIE\b[^\n]{0,40}\bcount[\(\s]+\1[^;]{0,40}\bin_array[\(\s]+gettype[\(\s]+\1[\)\.\s]+count[\(\s]+\1[\)&,\s]+\1[\)\s]+\?[\(\s]+\1\s*\[\d+\][\s=]+\1\s*\[\d+\][^,;]+\1[\s=]+\1\s*\[\d+\][\(\s]+\1\s*\[\d+\][,\s]+\1\s*\[\d+\][\(\s]+\1\s*\[\d+\][\)\s&]+\1[\(\)\s]+:\1\s*;(?<X1212600>))|new\s*KClickClient[\('"\s]+https?://mrricch5\.beget\.tech/api\.php\?['"][,\s]+['"]\w+['"][\)\s]+;[^=\?<]{0,999}\1\->executeAndBreak\s*\(\s*\)\s*;(?<X1212620>)|wp_create_user\s*\([^;]{1,199};\s*(\$\w{1,40})[\s=]+new\s+WP_User\s*\(\s*\1\s*\);\s*\81\s*\->\s*set_role\s*\(\s*['"]administrator['"]\s*\);\s*(?:echo|print|(?:wp_)?mail)\b[^;]{1,199};\s*(?:die|exit)\b[^;]{0,19};(?<X1192020>))|\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];(\$\w{1,40})\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];(\$\w{1,40})\.=['"](?:\\x?[a-f0-9]{2,3}){2,3}['"];@\$\w{1,40}\((?:(?:\1|\83|\84)\(){2,3}(?:\$\w{1,40}\(?)+\){3,};(?<X1140151>)|\[(?:['"](\w{1,40})['"]\]\h*=\h*['"](?:assert|eval)['"]\h*;\s*(\$\w{1,40})\[\h*\]\h*=\h*\1\h*;\s*@?\87\[0\]\[['"]\86['"]\]\h*\(\h*(?:(?:gz(?:uncompress|inflate)|base64_decode)\h*\(\h*){0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;(?<X1166750>)|\]\h*=\h*chr\h*\(\h*ord\h*\(\h*(\$\w{1,40})\h*\[(\$\w{1,40})\]\h*\)\h*\^\h*ord\((\$\w{1,40})\h*\[\h*\90\h*%\h*count\h*\(\h*\91[\h\]\)]+;\s*\}\s*\89\h*=\h*implode\h*\(\h*['"]{2}\h*,\h*\1\h*\)\h*;[^'"]{1,499}\(\h*['"]{2}\h*,\h*\89\h*\)\h*;(?<X2161510>)))
(\$\w{1,40})\h*=(?:(?:\h*(\$\w{1,40}\[)[\h\(]+\d+[\-\+\*/\(]+\d+[\-\+\*/\)][^\]]*\]\h*\.?){3,};(?:\s*\$\w{1,40}\h*=(?:\h*\2[\h\(]+\d+[\-\+\*/\(]+\d+[\-\+\*/\)][^\]]*\]\h*\.?){3,};){1,9}[^\{\}@\?>]{0,999}@?(\$\w{1,40})\h*=\h*@?\1[\(\h]+(?:['"]{2}|null)[\)\h]+,[^;]{2,40};\h*@?\3\(\);(?<X1187001>)|(?:\h*chr\h*\(\d+\)\h*\.){3,}[^;]+;\s*(\$\w{1,40})\h*=\h*\1\h*\((?:\h*chr\h*\(\d+\)\h*\.){3,}[^;]+;\s*(\$\w{1,40})\h*=\h*\5\h*\(\h*(?:['"]{2}|null)\h*,\h*\1\h*\([^\)]+\)[\h\)]+;\s*@?\6\h*\(\h*\)\h*;(?<X1171640>)|(\h*str_i?replace\h*\(\h*['"][^'"]{1,19}['"]\h*,\h*['"]{2}\h*,)\h*\$\w{1,40}\h*\);\s*(\$\w{1,40})\h*=\h*\8[^;]{1,99};\s*(\$\w{1,40})\h*=\h*\9\h*\(\h*\1\h*\);\s*\10\h*=\h*['"]\h*\?>\h*\10\h*['"];\s*@?eval\h*\(\h*\10\h*\);(?<X1169531>))
(\$\w{1,40})\h*=\h*(?:['"]base['"]\h*\.(?:[\h\(]+\d+[\h\*\+\-/]+\d+[\)\h]+\.\h*['"][_decod\.'"\h]{7,}['"]\h*;\s*@?eval\h*\([^;]*\1\h*\(\h*\$[^;\)]+\)\h*\)\h*\)\h*;(?<X1186990>)|\h*3\.2\h*\*\h*20\h*\.\h*['"]_decode['"]\h*;\h*goto\h+\w{3,12};\h*\w{3,12}:\h*return\h*@?eval\h*\([^;]{0,99}\1\h*\((?<X2172450>))|['"]header['"]\h*;\s*\1\h*\(\h*base64_decode\h*\(\h*['"]TG9jYXRpb246[^\;\.]+\.\h*['"]https?://[^'"]+['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,19};(?<X1188570>)|['"]https?://(?:['"]\h*\.\h*(\$_(SERVER)\[)['"](?:\6_NAME['"]\])+[\h\.:'"]{1,12}\5['"]\6_PORT['"]\]\h*\.\h*\5['"]REQ[^;]+;[^\{\(\[]{1,40}(\$\w{1,40})\h*=\h*explode\(\$\w{1,40},\1\);\s*if\(count\(\7\)>\d+\)\s*\{[^\}]{1,99}@\$\w{1,40}\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\);\s*return;\s*\}(?<X1150840>)|\w{1,40}\.com/?['"]\h*;[^\v]{999,9999}(\$\w{1,40})\h*=\h*get\w{1,9}\h*\(\1\b[^\v\*]{99,999}(\$\w{1,40})\h*=\h*str_replace\h*\(\h*['"][^'"]{0,9}['"]\h*,\h*\9\b[^\v\}\?]{9,499}\w?(?:echo|print)\w{0,2}\h+\10\h*;\h*(?:exit|die)\b[^;]{0,9};(?:\h*\}){4}(?<X1169721>)|apigooglee\.com/[^;]+;\s*\$\w{1,40}\h*=\h*wp_remote_get[\h\(]+\1[\)\h]+;(?<X1193880>))|['"]index\.php['"];\s*(\$\w{1,40})[\h=]+@?(file_get_contents)[\(\s]+\1[\)\s;]+(\$\w{1,40})[\h=]+@?\14[\(\s]+['"][^'"]+/\d+['"][\)\s]+;\s*(\$\w{1,40})\h*=[^;]*\15[\s\);]+if[\s\(]md5[\s\(]\13[\s\)]+!=\s*md5[\s\(]+\16[\s\)]+\{\s*(@chmod\()\1[^;]+;\s*@file_put_contents[^;]+\1[,\s]+\16[\);\s]+\17\1[^;]+;\s*\}(?<X1194220>)|['"]PD9(?:[^'"]{999,9999}['"];[^\?]{1,499}\bfile_put_contents\h*\(\h*(\$\w{1,40})\h*,\h*\1\h*\);\s*include(?:_once)?\h*(?:\(\h*)?\19\h*(?:\)\h*)?;\s*unlink\h*\(\h*\19\h*\);\s*(?:\?>\s*)?\Z(?<X2183861>)|[^'"]{9999,30000}['"]\s*;\s*(\$\w{1,40})\h*=\h*fopen[\s\(]+['"]\./[^'"/]+\.php['"]\h*,\h*['"]w['"][\s\)]+;\s*fwrite[\s\(]+\21[,\s]+base64_decode[\s\(]+\1[\s\)]+;\s*fclose[\(\s]+\21[\)\s]+;(?<X1194040>))|['"]ZXZhb[^'"]{99,300}['"];\s*\$\w{1,40}\h*=\h*['"]=[^'"]{9999,20000}['"];\s*@?eval\(htmlspecialchars_decode\(urldecode\(base64_decode\(\1[\)\h]+;\s*(?:die|exit)\b[^;]{0,9};(?<X2138991>)|['"]{2}\h*;\s*for[\(\s]+(\$\w{1,40})=0;\s*\24<strlen[\(\s]+(\$\w{1,40})\)[\-\+\h]+\d+\h*;\s*\24\+=\d+[\)\s]+\{\s*\1\h*\.=\h*chr[\(\h]+hexdec[\(\s]+\25\[\24\][\.\h]+\25\[\24[\+\-\h]+\d+\][\)\h]+;\s*\}\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\26e\w?.?['"]\s*,\h*\1\h*,\h*['"]{2}\h*\)\h*;(?<X1190950>)|\$(?:\{\h*(?:\$\w{1,40}|str_rot13)\h*\(\h*['"]_[PCTE][BR]['"\w\.\h]{1,19}\)\h*\}|\$\w{1,40})\h*;\h*@?\((?:[^;\v#%\{\}/@\-<>]{0,199}\1\h*\[\h*\d+\h*\]\h*\(\h*\1\h*\[){2,}[^;\v\?#%\{\}/@\-!=<>]{1,99}:\1;(?<X1188161>)|\$\w{1,40};(?:\s*\1\h*\.=\h*\$\w{1,40};)+\s*(\$\w{1,40})\h*=\h*\$\w{1,40}[\h\(]+['"]{2}(?:\h*\))?\h*,\h*\(\h*\1[\h\)]+;\s*\29\h*\(\)\h*;(?<X1185762>)|\$\{['"]\\[^'"]+['"]\};\s*@?\(\h*in_array[\s\(]+gettype[\s\(]+?\1[^;]+\1[^\v;@&,\\]{5,}&&[\(\h]+@?\1\h*=\h*\1\[\d+\]\h*\(\h*\1\[\d+\]\h*,\h*\1\[\d+\][^;\v]+\1\[\d+\][^;\v]*;(?<X1188400>)|\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(?:(\$\w{1,40})\h*=\h*str_replace\h*\(\h*array\h*\([^;]+\1[^;]+;\s*(\$\w{1,40})\h*=[^;]+\32[^\?>]{99,499}(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\33\h*\)\h*;(?:\s*\})?\s*\w?(?:echo|print)\w{0,2}['"\h\)]{0,9}\34['"\h\)]{0,9};(?<X1127332>)|if\h*\(\h*empty\h*\(\h*\1\b[^\?>:/]{1,999}(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\1\h*\)\h*;[^\?]{1,499}\36\h*=\h*str_replace\h*\([^\?]{1,40}\?[^;]{1,40}\36\h*\)\h*;[^\}]{1,99}\beval\h*\(\h*\36\h*\)\h*;\s*\}(?<X1172740>))|\$_SERVER\[(?:[^;]{9,40};\s*\$\w{1,40}\s*=\s*['"]PD9[^'"]{999,}['"];\s*(\$\w{1,40})\h*=\h*['"][^;]+['"]\h*;[^\v\?<]{999,9999}\bsubstr_count[\h\(]+\$\w{1,40}[\h,]+\38[\h\(]+['"][^\}\v;]+;\s*\$\w{1,40}\h*=\h*@?fopen\h*\(\h*\1\h*\.[^;]+;\s*@?fwrite[\h\(]+\$\w{1,40}[\h,]+\38\h*\([^\}]{99,199};\s*\}(?<X1188260>)|[^\]]+\];\s*(\$\w{1,20})\h*=\h*['"]https?://[^;]{1,99};\s*\$\w{1,40}\h*=[^;]{1,99}\.xml['"](?:[^@]{99,1999}\$(\w{1,40})\h*=\h*file_get_contents\h*\(\h*\40\b[^\)]+\1\b[^;]{0,49};\s*echo\s*\$\41;\s*(?:exit|die)[^;]{0,19};){2}[\s\}]+else\s*\{(?:\s*\}){2}(?<X1168920>))|\[['"]https?://[^'"]{1,199}\.txt['"][,\s]+['"]/tmp/sess_['"][\s\.]+md5\h*\([^;]+['"]\.php['"\];\s]+if\s*\([^;]+include(?:_once)?[\s\('"]+(\1\[\d+\])[\s\)'";\}]+else[\s\{]+(\$\w{1,40})[\s=]+fopen[\s\('"]+\43[^;]+;[^=\}]{0,199}\bfwrite[\s\(]+\44[,\s]+\w+[\s\(]+\1\[\d+\][^\}]{0,99}\}(?<X1195291>)|\w{1,40}\h*\(\h*\$GLOBALS\s*\[[^\]]+\]\s*\)\s*;\s*@?eval[\s\(]+['"][\?>]{2}['"]\s*\.\s*\1[\s\)]+;(?<X2188331>)|array(?:[\(\s]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\[[^\]]+\]\h*,\h*(?:['"](?:create_function|str_rot13|json_decode|pack|base64_decode|file_get_contents|fopen|curl_\w{1,40})['"](?:\h*,)?\h*){3,}\);[^\}]{9,499}\1\[\d+\][\h(]+['"]{2}\h*,[^;,]{4,40}\)\h*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190580>)|[\h\(]+(base64_decode[\h\(]+str_i?replace[\h\(]+['"]\.['"]\h*,\h*['"]{2}\h*,\h*['"])[a-z\.\d=\+/]{9,99}['"][\h\)]+;\s*foreach[\h\(]+\1\b[^;]{0,99}\1\[\$\w{1,40}\]\h*=\h*s?(?:print|echo)f?\h*\([^\\]{499,999}<script>\h*['"]\h*\.\h*\48[a-z\.\d=\+/]{9,99}['"][\h\)]+\.(?<X2177030>))|base64_decode\h*\([YXNZJd'"\d\.]{9,24}\)\h*;\s*\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)(?:\h*;)?(?<X1140930>)|count\h*\(\h*\$\w{1,40}\h*\)\h*[\+\-/%]\h*\d+\h*;\s*if\h*\(\h*!?\1[\s\)]+\{\s*(\$\w{1,40})\h*=\h*['"]?create_function['"]?\h*;\s*(\$\w{1,40})\h*=\h*\51\h*\(\h*(?:['"]{2}|null)\h*,\h*\$[^;]+;\s*@?\52\(\);\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1188802>)|create_function\h*\(\h*chr\h*\(\h*\d+[/\*\+\-]\h*\d+\h*\)\h*\.[^;]{99,999};\s*@?\1\h*\(\h*base64_decode\h*\([^;]{99,999};(?<X1178171>)|curl_init\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}\?=]{1,999}\b(?:curl_setopt\h*\(\h*\1\h*,\h*CURLOPT_COOKIE(?:JAR|FILE)\h*,\h*\$GLOBALS\[['"]coki['"]\]\h*\);\s*){2}(?:(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\$\w{1,40}\h*\)\h*;\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*\55\);\s*){0,2}(?<X1183571>)|date_default_timezone_get\h*\(\);\s*if[\h\(]+getenv[\h\(]+['"]REM[^\^]{99,9999}if[\h\(]+preg_match[\s\(]+['"]\W{1,9}sitemap[^;]+\1[\)\h]+;\s*(\$\w{1,40})\h*=[^\^\?]{99,9999}\57[\h=]+str_replace\h*\([^;]+\57[\h\)]+;\s*@?header[\h\(]+['"]Location:\h*['"][^;]+\57[\)\h]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\}){2}(?<X1189221>)|explode\h*\(\h*['"]:['"]\h*,\h*\1\h*\)\h*\[0\]\h*;\s*if\h*\(\h*(function)_exists\h*\(\h*['"](curl_init)['"][\)\s]+\{\s*(\$\w{1,40})\h*=\h*(\w{1,40})\h*\(\h*['"]\h*https?://[^;]+\1\b[^>]{99,999}echo\h+\61\h*;\s*\b\59\h+\62\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*\60\h*\([^\}]{9,499}\}(?<X1167310>)|file(?:_get_contents[\(\h]+['"]https?://\w{0,49}[^;]{1,49}\w{1,20}\.(?:txt|php|log|ico|png)['"][\)\s]+;\s*@?eval[\s\(]+['"]\?>\h*\1['"][\)\s]+;(?<X1189143>)|mtime\h*\(\h*(['"][^'"]{0,99}/wp\-config\.php['"])\h*\)\h*;\s*@?chmod\h*\(\h*\65\h*,\h*07\d+\h*\)\h*;\s*@?file_put_contents\h*\(\h*\65\h*,\h*\$\w{1,40}\h*\)\h*;\s*@?touch\h*\(\h*\65\h*,\h*\1\h*,\h*\1\h*\)\h*;(?<X2172370>))|fopen[\s\('"]+wp[^;'"]+\.php['"\s,]+['"][aw]\+?['"\s\;)]+(\$\w{1,40})[\s=@]+file_get_contents[\h\('"]+https?://[a-z]{2,5}bin\.com?/(?:\w{1,40}/)?(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}['"][\s\)'";]+(?:\$\w{1,40}[\s=@]+)?fwrite[\s\(]+\1[\s,'"\(\)]+\67[\s\.'"\(\);]+fclose[\s\(]+\1[\s\)]+;(?<X1196730>)|get\w{0,40}\h*\(\h*['"]https?://[^\}]{1,499}\bfile_put_contents\h*\(\h*['"]([^'"]{0,49}\bwp\-\w{1,40}/[^'"]{0,99}/\.[^'"/]{1,99}\.(?:jpe?g|bmp|png|gif))['"]\h*,\h*\1\h*\);\s*(\$\w{1,40})\h*=\h*explode\h*\([^;\)]{0,99}\b\69\b[^;]{0,99};\s*echo\h*\70\h*\[[^;]{1,99};(?<X1184922>)|get_option\(['"]_transient_feed_[a-z0-9]{1,40}['"]\);\s*\1\h*=\h*base64_decode\(str_rot13\(\1\)\);\h*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"][^'"]+['"]\)\h*\D{2,3}\h*false\h*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?create_function\h*\(\s*['"]{2}\h*,\h*\1\h*\);\h*@\72\(\);\h*\}(?<X1139590>)|getallheaders\h*\(\);\s*if\h*\(\h*!?\h*[ie](?:sset|mpty)\h*\(\h*\1\h*\[[^;\{]+\{\s*(\$\w{1,40})\h*=\h*['"][^;]+;[^\}\{\?]{0,150}(\$\w{1,40})\h*=[^;]{1,99};\s*@?file_put_contents\h*\(\h*\75\h*,\h*\74\h*\)\h*;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\75[\$\}\)'";]{1,3}\h*;[^\{=\}]{0,99}\}(?<X1168951>))
(\$\w{1,40})(?:\h*=\h*(?:http_get\(['"]https?://\w{1,9}\.[\w\-]{1,12}\.xyz/?['"][\h,]+\$\w{1,40}[\h\)]+;\s*if[\h\(]+!in_array[\(\s]+\1\[[^\]]+\][^;]+\b(header\h*\()\h*['"]HTTP/[^\-]{9,499}if[\h\(]+strlen[\(\h]+(\1\[[^\]]+\])[\s\)]+\{\s*@?\2[^;]+\1\[[^\]]+\][\]\)\h]+;\s*echo[^;]+\3;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1190600>)|new\h*JInputCookie[;\s]*(\$\w{1,40})[\h=]+(\1\->get)[\(\s]+['"]\w{1,40}['"][\s\;)]+if[\s\(]+\5[\s\)]+\{\s*(\$\w{1,40})[\h=]+\5[\(\s]+\6[\(\s]+['"]\w{1,40}['"][\s\);]+(\$\w{1,40})[\h=]+\5[\(\s]+\6[\(\s]+['"]\w{1,40}['"][\s\);@]+(?:\8|\7)\s*\(\s*.?['"](.).{0,40}\9e\w?.?['"][\s,]+(?:\8|\7)[^;]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1196590>)|new\h+(?:\w{1,40}\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*\1\h*\->\h*\w{1,40}\h*\(\h*\$\w{1,40}\h*=\h*['"]\$_[GPRSC]\w{2,6}\[[^\]]+\]['"]\h*\)\h*;\s*@?eval\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*)+\11[\h\)]+;(?<X1169251>)|WP_User[\(\s]+wp_create_user[\(\s]+['"]([^'"\$]{1,40})['"]\h*,\h*['"][^'"\$]{1,40}['"][\)\s]+;\s*\1\->\s*set_role[\(\s]+['"]administrator['"][\)\s]+;[^\}]{0,199}\bif[\(\s]+\$\w{1,40}\s*!=\s*['"]\13['"][\)\s]+\{\s*global\s*\$wpdb;\s*\}\s*\}(?<X1195011>))|rand\(\);\s*(\$praga)\h*=\h*md5\(\1\);[^#:]{9,799}\bheader\h*\(\h*['"]Location:[^\?;]{1,99}\.php\?[^'";]{1,399}=\15(?<X2151221>)|str\w{3,9}\h*\(\h*['"][YASRTMEVL]{4,9}["']\h*\)\h*;\s*(\$\w{1,40})\h*=(?:\h*\1\h*\[\d+\]\h*\.){3}[^;]{3,99};\s*\17\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1171660>)|str_r(?:eplace(?:\(\h*['"][!@#\$%]{1,5}['"],\h*(['"])[^,]+\19,\h*urldecode\(['"]%[a-f0-9%]{999,9999}['"]\)+;\s*(\$\w{1,40})\h*=\h*dirname\([^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(\20['\."/]{1,24}/[^,]{1,40}\.php['"],\h*['"][wa\+]+['"]\);\s*fwrite\(\21,\h*\1[^\{\[\?&\*:@!\\]{2,64000}fclose\(\21\);(?<X1150510>)|\h*\(\h*['"](.)['"]\h*,\h*['"]['"]\h*,\h*['"](?:[str_eplac]+\23)+[str_eplac]+['"]\h*\)\h*;\s*(?:(?:\$\w{1,40}\h*=\h*['"][\w/\+=]{9,199}['"]\h*;|\$\w{1,40}\h*=\h*\1\h*\([^;]+;)\s*)+(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*(?:['"]{2}|null)\h*,[^;]+\1\h*\([^;]+;\s*@?\24[\h\(\)]+;(?<X1166960>))|ot13(?:[\(\h]+['"][nfreg'"\.]{6,40}['"][\h\)]+;\s*@?\1[\(\h]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;(?<X1183561>)|\h*\(\h*['"]flfgrz['"]\h*\)\h*;\s*@?\1\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1164000>)))|strrev(?:[\(\h]+['"]31tor_rts['"][\)\h]+;(?:\s*\$\w{1,40}\h*=[^;]{0,99}\1[\(\h'"\[]+\w{1,40}['"\)\]\h]+;)+\s*if\b[^;]+\1[\(\h'"]+\w{1,40}['"\)\]\h]+;[^\}]{0,99}\}\s*(\$\w{1,40})[=\h]+@[\$\{]*implode\b[^\{]{9,199}\{\s*(\$\w{1,40})[=\h]+\$\w{1,40}\(["']{2}[,\h]+\28\);\s*@?\29\(\);[^\}]{0,40}\}(?<X1189890>)|[\h\(]+['"]ecalper_gerp['"][\)\h]+;\s*@?\1\s*\(\s*.?['"](.).{0,40}\31e\w?.?['"]\s*,\h*['"]?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]['"]?\h*,\h*['"][^'"]*['"][\s\)]+;(?<X1191520>)|\([\.'"\h31orts_]{11,40}\);[^\[\{\}]{0,99}(\$\w{1,40})\h*=\h*\1\(['"\h\.zq5]{5,40}\);[^;]{1,199}\33\(\h*\$\w{1,40}\h*\)\D{2,9}['"][a-f\d\.'"\s]{35,99}['"]\D{2,9}(\$\w{1,40})\h*=\h*\$\w{1,40}\(\h*(?:['"]{2}|null)\h*,\h*\$\w{1,40}\([^\)]+\)[\h\)]+\?\h*@?\34\(\)\h*:\h*['"]{2};\s*\}(?<X1171610>)|\h*\((?:['"]edoced_46esab['"]\)\h*;[^\{\}!@]{1,499}if\h*\(\h*is_callable\h*\h*\(\h*['"](curl_init)['"][\s\)]+\{\s*\$\w{1,40}\h*=\h*\36\h*\([^@=!\?\+]{9,999}echo\b[^;]+\1\b[^;'"]+['"][^\s'"]{9,99}['"][^;]+;\s*\}(?<X1161090>)|\h*['"]['"\h\.base64_dco]{15,40}['"]\h*\)\h*;\s*\$\w{1,40}\h*=(?:\h*(?:gz(?:uncompress|inflate)|\1)\h*\(){2}\h*['"][^'"]{999,}['"][\s\)]+;\s*@?Create_Function\h*\(\h*(?:['"]{2}|null)\h*,\h*['"][^'"]{1,40}['"]\h*\)\h*;(?<X1172440>)))|tmpfile[\s\(\)]+;\s*@?fwrite[\s\(]+\1[\h,]+['"]<\?[ph\s]+['"]\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(\$\w{1,40})\h*=\h*stream_get_meta_data[\s\(]+\1[\s\)]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\{\('"]{1,3}\39\h*\[[^\]]+\]\h*;\s*\}(?<X1196380>))|\s*(?:(?:/\*[^/]*\*/\s*)?=\s*(?:/\*[^/]*\*/\s*)?\$\w{1,40}\s*(?:/\*[^/]*\*/\s*)?;(?:\s*\w+\(\$\w+,\h*['"]\w+['"]\);)?\s*@include_once\s*/\*[^/]*\*/\s*\(\s*(?:/\*[^/]*\*/\s*)?\1\s*(?:/\*[^/]*\*/\s*)?\)\s*(?:/\*[^/]*\*/\s*)?;(?<X1255052>)|/\*[^\*]{0,9}\*/\s*=(?:\s*/\*[^\*]{0,9}\*/)?\s*(\$\w{1,40})\s*;\s*@?include(?:\s*/\*[^\*]{0,9}\*/)?[\(\s]+\1(?:\s*/\*[^\*]{0,9}\*/)?\s*\)(?:\s*/\*[^\*]{0,9}\*/)?\s*;(?:\s*/\*[^\*]{0,9}\*/)?\s*@?\$\w{1,40}(?:\s*/\*[^\*]{0,9}\*/)?\s*\[[^;]*\42[^;]+;(?:\s*/\*[^\*]{0,9}\*/)?\s*(?:exit|die)\b[^;]*;(?<X1247690>)|=(?:(?:\s*\$\w{1,40}\s*\.)?\s*['"]https?://[fz][\d_]+\.[^'"]+\.\w{2,9}/?['"][^;]*;\s*\1\s*=\s*trim[\(\s]+\1[\)\s]+;[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\44[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1252930>)|[\s'"]*(?:\d+['"\s;]+if[\(\s]+isset[\(\s]+\$_[GC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{[^\?]{0,9999}(\$\w{1,40})\s*=\s*['"]https?://[^;]*\1[^;]*;[^\?]{0,9999}?(\$\w{1,40})\s*=\s*\w{1,40}\s*\([^\)]*\46[^\)]*\)\s*;[^\?]{0,999}\becho\s*\47;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1210810>)|create_function['"\s;]+\$\w{1,40}\s*=[\s'"]*;\s*\$\w{1,40}[\s=]+\1[\s\(]+\$\w{1,40}[,'"@]+eval[\s\(]+(array_)pop[^=]{9,199}=\s*\49merge[\s\(]+(?:\$_[GPRSC]\w{2,6}[,\)\s]+){2,};\s*(\$\w{1,40})[\s=]+isset[\s\(]+\$\w{1,40}\[[^\]]+\][^;]+;\s*@?eval\b[^;\)]+\50[\s\)]+;(?:[\s'"\)]+;)?(?<X1214920>))|\$_[GPCSR]\w{2,6}\[['"](?:pass|passwd|pwd|password|cvv)['"]\];[^\?]{9,499}(\$\w{1,40})=[^;]{1,99}\1[^;]{1,99};(\$\w{1,40})=\52;[^\?]{0,99}mail\([^\)]{1,49}\53\);file_put_contents\([^,]{1,29},\52,(?<X2130950>))))
(\$\w{1,40})\s*=\s*(?:__DIR__\s*\.\s*['"]\.?/[^'"]{1,199}\.(?:png|gif|ico|jpe?g)['"]\s*;\s*if\s*\(\s*!file_exists\s*\(\s*\1[\s\)]+\{\s*(?:die|exit)\b[^;]{0,19};\s*\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\$\{\('"\s]{1,3}\1[\s\$\}\)'"]{0,3};(?<X1196150>)|array\s*\(\s*(\$\w{1,40})\s*,\s*\$ip\s*\)\s*;\s*foreach\s*\(\s*\1\s*as\s*\3\s*\)\s*mail\s*\(\s*\3\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*;(?<X2054410>)|base(?:64_decode(?:[\('"\s]+aHR0[a-z\d/=\+]{9,199}['"][\\s\)\.'"]+\?[^'";]+['"]\s*;\s*(\$\w{1,40})[=\s]+\[\s*['"]User\-agent['"][^\[\{\}\?]{4,99}(\$\w{1,40})[=\s]+wp_remote_post[\(\s]+\1\s*,[^,;]+>\s*\5\s*,[^;]+;\s*@eval[\s\(]+\6\[['"]body['"]\][\s\)]+;(?<X1218430>)|[\('"]+aHR0[^;]+;[^<>\n]{9,9999}\bwhile[\(\s]+\$\w{1,40}\s*[<>]\s*\d+[\)\s]+\{\s*(\$\w+)\s*=\s*\$?\w+[\(\s]+\1[,\s]+\$\w+[\)\s]+;\s*\$\w+\s*=\s*@gz[^;\$\)]+\8[^\}\+]{1,499}@header\s*\([^;]+;\s*\}\s*echo\s*\$\w+[;\s]+(?:die|exit)\b[^;]*;[\}\s]+\$\w+\+\+[;\s]+\}(?<X1255870>)|[\(\s]+['"]JHJlcV9[^'"]{99,}['"]\s*,\s*true[\);\s@]+eval\s*/\*[^;\$]+\1\b[^;]*;(?<X1278500>)|\s*\(['"][QY][a-z0-9]{19}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\1\s*\(\s*['"]{2},\s*@?preg_replace\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]{2}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*@?\11\s*\(\s*\)\s*;(?<X1133260>))|name[\(\s]+trim[\(\s]+preg_replace[\(\s\$]+\w+[\('"\s]+/[^,;]+,\s*['"]{2}\s*,\s*__FILE__[\s\)]+;\s*\1\s*=\s*substr[\(\s]+str_repeat[\(\s]+\1\s*,[\s\(]*strlen[\(\s]+\$\w{1,40}[^\^;]{1,199}(\$\w{1,40})[\s\)]+;\s*\13[=\s]+\13\s*\^[^;]+;\s*@?eval[\s\(]+\13[\s\)]+;\Z(?<X2238511>))|bcsqrt[\(\s]+\d+[\)\s]+;[^\?]+\bcurl_setopt[\(\s]+(\$\w{1,40})\s*,\s*CURLOPT_URL\s*,\s*['"]https?://\1\.\d+\.\d+\.\d+/[^;\?\n]+\?[^;]+;\s*(\$\w{1,40})\s*=\s*@?curl_exec[\(\s]+\15[\)\s]+;[^\}=]+\becho\s*\16;[^\}=]*\}(?<X1200960>)|chr\(\d+\)\h*\.[chr\(\d\)\.\h]{9,199};\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\1[\$\}\)'";]{1,3};(?<X1195391>)|create_(function)\s*\('([\$\w]{1,40})',\s*\w+\s*\(base64_decode\s*\([^)]+\),\s*\$_[GPRSC]\w{2,6}\s*\[[^\;]+\]\)\s*\.\s*'[^']*'\);\s*\1\(\20\);\s*\19\s*\w+\s*\((\$\w{1,40})\s*,\s*(\$\w{1,40})\)\s*\{\s*return\s*\21\s*\^\s*str_repeat\s*\(\22,\s*ceil\s*\((strlen\s*\()\21\)\s*/\s*\23\22\)+;\s*\}(?<X1037502>)|curl_init[\('"\s]+https?://\w\d+\.xsph\.ru/[^\?'"]+\?[^"'\?]+['"]\s*\.[^;\[]+\$_SERVER\[['"]REMOTE_ADDR['"]\][\)\s]+;\s*@?curl_exec[\(\s]+\1[\)\s]+;\s*curl_close[\(\s]+\1[\)\s]+;(?<X1261810>)|dirname\s*\(\s*__FILE__\s*\)\s*\.\s*['"]/['"]\s*\.\s*basename\s*\(\s*__FILE__\s*\)\s*;\s*\$GLOBALS\[[^\]]+\]\s*=\s*['"][^'"]{9999,}['"];\s*function\s+(\w{1,40})\s*\(\$\w{1,40}\)\s*\{\s*global\s+\1[^>#]{599,1999}\b\26\s*\(\s*str_rot13\s*\(\s*['"][^;'"]+;\s*['"]\s*\)\s*\)\s*;(?<X1136800>)|EMAIL;\s*(?:\$\w{1,40}\s*=\s*)?@?mail\s*\(\s*\1\s*,\s*[^\)]{1,120}\s*\)\s*;\s*(?:\?>)?\s*<script\s*type\s*=\s*['"]text/javascript['"]>\s*[^\&]{1,200}&rand\s*=\s*\d+InboxLightaspxn(?<X2054830>)|exif_read_data[\(\s]+['"]https?://\w{1,3}\.googleusercontent\.com/[^'"]+\.(?:jpe?g|png|ico)['"][\)\s;@]+eval[\(\s]+base64_decode[\(\s]+\1(?:\[[^\]]+\])+[\)\s]+;(?<X1199820>)|explode[\(\s]+['"](\w+)['"]\s*,\s*['"][base]+\30[asdcode]+['"][\)\s]+;\s*(\$\w{1,40})[=\s]+\1\s*\[\s*\d+\s*\][\.\s]+['"][^'"]*['"][\.\s]+\1\s*\[\s*\d+\s*\]\s*;\s*(\$\w{1,40})[=\s]+\31[\s\(]+['"][^"']+['"]\s*,[^;]+;\s*\$\w+\s*=\s*(?:(?:\31|\32)[\s\(]+)+['"][^'"]+['"][^;]+;(?<X1265550>)|file_get_contents(?:[\(\s]+(?:['"]https?://(?:backlink\.[^'"]+\.txt['"][\)\s]+;\s*echo\s*\1\s*;(?<X1280400>)|pub\-[^\./"']+\.r2\.dev/[^'"]+['"][\)\s]+;\s*echo[^;]*\1\b[^;]*;(?<X1264880>))|__FILE__[\)\s]+;\s*global\s*(\$\w{1,40})[\s;]+if[\s\(]+!empty[\s\(]+\36[\s\)\{]+\1\s*\.=\s*\36[^\*]+preg_match[\('"\s]+/[^%]{9,9999}if[\s\(]+\$\w{1,40}\s*%[^;]+;[^\+]{9,9999}\b(file_put_contents)[\(\s]+(\$\w{1,40})[^\{\}]{0,199}\$\w+\+\+[^\+]{199,9999}\37[\s\(]+\38[^\}]+\}(?<X1222460>))|\s*\(\s*(?:['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*[^\$]{1,40}\s*\1\s*(?:\s*\)\s*){1,6};(?<X2054672>)|str_rot13\s*\(\s*['"]uggc://[^'"]{3,199}['"][^;]*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^;]*\1\b[^;]+;(?<X1195040>)))|fopen(?:[\(\s]+\$get_sent_type\s*,\s*['"]w['"][\)\s]+;\s*@?fputs[\(\s]+\1[,\s]+\$seopress_social_twitter_card_option[\);\s@]+fclose[\(\s]+\1[\)\s]+;(?<X1219470>)|\s*\((?:\s*['"]/(?:home|etc)/?['"]\s*\.\s*\$\w{1,40}\.){1,2}['"]/?(?:shadow|passwd)['"]\s*,[^\)]+\)\s*;[ ]*fwrite\s*\(\s*\1\s*,[^\)]+\)\s*;[ ]*fclose\s*\(\1\)\s*;(?<X2129852>))|get_(?:option\s*\(\s*['"](?:_site)?_transie\w{30,50}['"]\s*\);\s*\1\s*=\s*base64_decode\s*\(\s*str_rot13\s*\(\s*\1(?:\[[^\]]{1,40}\])?\s*\)\s*\);\s*if\s*\(\s*[^\{]{29,99}\s*\{\s*(\$\w{1,40})\s*=\s*create_function\(\s*['"]['"]\s*,\s*\1\s*\);\s*@?\44\(\);\s*\}(?<X1057033>)|users\s*\(\s*array\s*\(\s*['"]role['"]\s*=>\s*['"]administrator['"][\s\)]+;\s*if\s*\(\s*!\s*count\s*\(\1\)\)\s*\s*(?:die|exit)\b[^\?]{1,299}(\$\w{1,40})\s*=\s*\1\[\d+\];\s*(\$\w{1,40})\s*=\s*\46->user_login;[^\{\}]{1,299}do_action\s*\(\s*['"]wp_login['"]\s*,\s*\47\s*\);(?<X1135962>))|isset(?:[\(\s]+\$_COOKIE\s*\[\s*(\$\w{1,40})\s*\[\d+\]\s*\][\)\s]*\?\s*\$_COOKIE\s*\[\s*\49\s*\[\d+\]\s*\]\s*:\s*\49\s*\[\d+\];\s*\$\w+\s*=\s*\49\s*\[\d+\][\(\s]+\1[\);\s]*\}\s*@?\w+[\(\s]+\49[,\s]+\$\w+[,\s]+\$\w+[\)\s]+;(?<X2266280>)|[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\?\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*:[^;]+;\s*(\$\w{1,40})\s*=\s*['"]['"\h\.base64_dco]{15,40}['"]\h*;\s*(\$\w{1,40})\s*=[^;]*(?:\1|\51)\h*\(\h*(?:\1|\51)\h*\)[^;]*;\s*@?eval[\s\(]+\52[\s\)]+;(?<X1194000>))|Mage(?:::getModel\(['"]sales/quote_payment['"]\)->getCollection\(\);\s*\1->addFieldToFilter\(['"]cc_number_enc['"],[^;]{1,200};\s*var_dump\(\1->getSize\(\)\);(?<X2052600>)|NTO_ROOT\s*\.\s*['"]/includes/config\.php['"];\s*if\s*\(\s*file_exists\s*\(\s*\1\)\s*&&\s*\(\s*filesize\(\1\)\s*==\s*\d+\)\s*\)\s*\{\s*include\s*\1;\s*\}\s*else\s*\{\s*(\$\w{1,40})\s*=\s*['"\s\.base64_dco]{13,40}\s*;\s*\$\w{1,40}\s*=\s*\55\s*[^\?]{1,600}\s*\1;\s*\}(?<X1055481>))|new\s*create_function[\(\s]+\d+[,\s]+['"][^'"\$]+['"][\)\s]+;\s*\$\w{1,40}\s*=\s*\1\->\w+\(\);\s*\1\->\w+[\s\(]+(?:\1\->\w+[\s\(]+){3,}\d+[\s\)]+;(?<X2268980>)|range\(\s*\d+,\s*\d+\s*\);\s*(\$\w{1,40})\s*=\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\.\s*chr\([^;]{1,99};\s*\58\s*\(\s*\$\{\s*\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\.?\s*chr\(\1[^\}]{1,99}\}\[\s*chr\s*\(\s*\1\[\d+\]\d*\)\s*\]\s*\);\s*\?>\s*\Z(?<X1041941>)|str_r(?:eplace(?:[\s\(]+['"][^'"]{1,9}['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]+['"][\s\)]+;(?:\s*\$\w{1,40}[\s=]+['"][a-z\d\+/]{1,99}={0,2}['"]\h*;)+(?:\s*(\$\w{1,40})[\s=]+\1[\s\(]+['"][^'"]{1,9}['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]+['"][\s\)]+;)+[^\{\}\?]{0,99}(\$\w{1,40})[\s=]+\60[\s\(]+['"]{2}\s*,[^,;]+;\s*@?\61\(\);(?<X1195090>)|\s*\([^\$]{1,12}\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^@]{0,40}(\$\w{1,40})\s*=\s*@json_de(code)\s*\(\s*file_get_contents\s*\(\s*['"]https?://api\.bin\64s\.com/\w{3,12}-checker\.php\?api_key=\w{32}&(?:cc|bin)=['"]\.\1\.['"][^'"]{1,40}['"][\)\s]+;\s*\$[^=]{1,40}\s*=\s*\63->\w{1,9};(?<X2134722>))|ot13\s*\(\s*['"]uggc://[^'"]{9,199}['"][\s\)]+;[^\n<>]{0,199}<\h*filemtime\s*\([^\n<>]{99,499}\bcurl_setopt\b[^;]+\1\b[^\n\{<>]{9,499}\{\s*(\$\w{1,40})\s*=\h*file_get_contents[\s\(]+\1\h*\.[^\n<>]{9,499}\becho[\s\(]+\66[\s\)]*;\s*\}(?<X1196320>))|time\s*\(\)\s*;\s*(\$\w{1,40})\s*=\s*@?filemtime\s*\(\s*['"]([^'"]+)['"]\s*\)\s*;\s*\$\w{1,40}\s*=\s*\1\s*\-\s*\68\s*;[^\}]{0,499}(\$\w{1,40})\s*=\s*@file_get_contents[\(\s]str_rot13[\(\s'"]+uggc://[^'"]+\.cuc['"][\s\)]+;[^\?]{0,200}filesize[\s\(]+['"]\69['"][\)\s]+;\s*\}\s*echo[^;]*\70;(?<X1195500>)|trim[\(\s]+urlx[\(\s'"]+https?://['"]\s*\.\s*gets\s*\(\)\s*\.\s*['"]/sitemap\b[^;]+;\s*if[\s\(]+\1=+\s*['"]{2}[\s\)]+\{\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1204260>)|up\w{0,9}(?:shell|backdoor|exploit)[\(\s]+\$\w{1,40}\s*,\s*['"][^'"]*['"][\)\s]+;\s*\$\w{1,40}[\[\]\s=]+['"]https?://["']\s*\.\s*\1\s*;(?<X2206320>))
(\$\w{1,40})\s*=\s*(?:!\h*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*(?:['"][^'"]+['"]|\$\w+)\s*;\s*if[\s\(]+\1[\s\)]+\{\s*class\s*\w{1,40}\s*\{[^\n\*]{99,}\}\s*\$\w+\s*=\s*new\s*/\*[^\*]+\*/\s*\w+[\(\)\s]+;[^\}]*\}(?<X1255000>)|"as";\s*\1\s*.=\s*".{2000,10000}"\)\)\)'\);\s*\?>\Z(?<X2051410>)|(?:@?implode\(\s*)?@?file\s*\(['"]/etc/named\.conf['"]\)?\s*\)\s*;\s*if\s*\(\s*!\s*\1\s*\)\s*\{\s*die\b(?<X2052782>)|(?:chr\(\d+\)\.?){1,5};\s*(\$\w{1,40})\s*=\s*file_get_contents\(['"]php://input['"]\);\s*\5\s*=\s*CB_XORm\(\5,\s*\1,\s*\d+\*\d+\);\s*if\s*\(\s*strncmp\(\s*['"][^'"]{1,40}["'],\s*\5\s*,\s*\d+\s*\)\s*==\d+\s*\)\s*\{(?<X2055401>)|(?:strtolower[\(\s]+)?@?\$_SERVER\[['"]HTTP_(?:USER_AGENT|REFERER)['"]\][\)\s]*;\s*if[\(\s]+stri?pos[\(\s]+\1\s*,[^;\{]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]+;[^\}]{0,499}\b\w+[\s\(]+\7[\s\)]+;[^\}]*\b(?:exit|die)[\(\)\s]+;\s*\}(?<X1240220>)|(['"])[^\?]{60,99}\9;[^@]{999,3000}@\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40},\$\w{1,40}\(\$\w{1,40}\((?:\1\[\d+\]\.){99,300}\1\[\d+\]\)\)\),(?:\1\[\d+\],){1,40}\1\[\d+\]\);(?<X1061040>)|(\$\w+)\s*\[\d+\][\(\s]+\$_COOKIE[,\s]+\$_(?:POST|GET)[\)\s]+;\s*\$\w{1,40}\s*=\s*\11\h*\[\d+\]\h*;\s*foreach[\s\(]+\1\s*as[^\}]{9,999}\}\s*elseif[^\}\.]{1,499}(\$\w{1,40})\s*=\s*\11\h*\[[^;]+;[^\}]+@unlink[\s\(]+\12[\s\)]+;[\s\}]+exit\b[^;]*;(?:\s*\}){2}(?<X1235950>)|(base64_decode\s*\()\s*gzinflate\s*\(\s*\14\s*['"][\w\+=/]{999,35000}['"][\);\s]{4,40}(?:(\$\w{1,40})\s*=\s*fopen\([^\)]{9,99}\)\s*;\s*fwrite\s*\(\s*\15\s*,\s*\1[^\)]{0,9}\);\s*fclose\s*\(\s*\15\s*\)\s*;\s*){2}(?<X1129572>)|(file_)ge(t_contents)[\(\s]+['"][^'"\$]{1,40}\.txt['"][\)\s]+;\s*(\$\w+)[=\s]+tempnam[\(\s]+sys_get_temp_dir[\(\s]+\)[,\s]+['"][^'"\$]+['"]\);\s*\1[=\s]+str_rot13[\(\s]+\1[\);\s]+\17pu\18\(\19,\s*['"]<\?[ph"'\.\s]+\1[^\?]+\bunlink[\s\(]+\19[\s\)]+;(?<X1271960>)|(implode)\s*\(\s*['"]+\s*,\s*(array_map)\s*\(\s*chr\s*,\s*\1[\)\s]+;\s*(\$\w{1,40})\s*=\s*\21\s*\(\s*['"]+\s*,\s*\22\s*\(\s*chr\s*,\s*\23[\)\s]+;\s*(?:\1|\23)\s*=\s*(?:\1|\23)\s*\(\s*['"]+\s*,\s*(?:\1|\23)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;\s*(?:\1|\23)\s*\(\s*\)\s*;(?<X1132620>)|(str_replace)[\s\(]+['"](\w)['"]\s*,\s*['"]{2}\s*,\s*['"](?:[creat_funio]{1,5}\26){1,9}(?:\26[creat_funio]{1,9}){1,9}['"][\s\)]+;\s*(\$\w{1,40})\s*=\s*['"]=*strlen\s*\([^\.]{9,499}(\$\w{1,40})\s*=\s*\25\s*\([^;]+\27[^;]*;\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]{2}\s*,\s*\28[\s\)]+;\s*@?\29\s*\(\)\s*;(?<X1196180>)|(strrev)[\(\]'"]+edoced_46esab['"\)\s]+;(?:\s*\$\w{1,40}[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*;)+\s*\$\w{1,40}[\s=]+file_get_contents[\s\(]+\1[\s\(]+\31\s*\([^;]{9,99};\s*\$\w{1,40}[\s=]+\1[\s\(]+\31\s*\([^;]{9,99};[^\}\{\[\]!]{0,499}\$\w{1,40}[\s=]+\1[\s\(]+\31[\s\(]+['"][^'"]{999,}['"\s\)]+;(?<X1196170>)|@?\$_[GPRSC]\w{2,6}\s*(?:;\s*\(\s*@?count[\s\(]+\1[\s\)]+\S{2,3}\s*\d+[\s\)]+\?[\(\s]+(\$\w{1,40})\h*=(?:\h*\1\[\d+\][\h\.\)]+)+\S{2,3}(?:[\(\s]+(\$\w{1,40})[\h=@]+\33\h*\((?:\h*\1\[\d+\][\h\.\)]+)+\S{2,3})+[\s\(]+\34[\h=@]+\$\w{1,40}[\s\(]+\1\[\d+\][\h,]+\34[^;:]+\34\(\)[\s\)]+:\s*\1\s*;(?<X1192710>)|\[[^\]]+\][\s\(]+(?:['"]{2}|null)[,\s]+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;\s*@?\1\s*\([\(\)\s]+;(?<X1219440>))|@?create_function\s*\(\s*['"]\s*['"]\s*,\s*@?str_rot13\s*\(\s*['"]\s*@?riny\s*\(\s*\$\w{1,40}\[\s*[^\w]{0,2}\w{1,40}[^\w]{0,2}\s*\]\s*\)\s*;\s*[^\w]{0,2}\s*\)\s*\)\s*;\s*@?\1\(\s*\)\s*;(?<X1056760>)|@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;\s*[^\}]{1,100}\bfwrite\(\s*\$\w{1,4}\s*,\s*\1\s*\);(?<X2054513>)|@?urldecode[\(\s]+['"]%[^'"]+['"][\)\s]+;\s*@?header[\s\(]+(?:\1\{\d+\}\.){2}[^\n\*]{999,}(\$\w{1,40})\s*=\s*fopen[\(\s]+@\$_[GPRSC]\w{2,6}\h*\[(?:\1\{\d+\}\.){2}[^;]+;[\h\}]+(\$\w{1,40})\s*=\s*fwrite[\s\(]+\39[^;]+;[^\}]{0,99}\40;\s*\}(?<X1201110>)|@\$\w{1,40}\(['"](\$\w{1,40})["'],/\*[^\*\n]+\*/['"][^'"]+['"]/\*[^\*\n]+\*/\^/\*[^\*\n]+\*/['"][^'"]+['"]\)/\*[^\*\n]+\*/;@\1\(\42\);(?<X1273200>)|@\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\s*(?:isset\s*\(\s*)?\1\s*\)(?:\s*\))?\s*\{\s*(\$\w{1,40})\s*=\s*\1\s*\(\s*@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;[^\}]{0,499}\44\s*\(\s*.?['"](.).{0,40}\45e\w?.?['"]\s*,[^\}]{9,99}\}(?:\s*else(?:\s*\{[^\}]{0,299}\}|[^;]{1,99};))?(?<X1135942>)|@\$_FILES\[[^\]]+\];\s*if\s*\(\s*\1\s*\[[^\]]+\]\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\.\s*\1\s*\[[^\]]+\]\s*;\s*if\s*\(\s*@?move_uploaded_file\s*\(\s*\1\s*\[[^\]]+\]\s*,\s*\47[\s\)]+\{\s*echo\s*['"][^;]+;(?:\s*\})+(?<X1134750>)|@file_get_contents[\(\s]+str_rot13[\(\s'"]+uggc://jjj\.nftif\.pbz/['"][\)\.\s]+['"][^'"]+['"][\)\s]+;\s*echo\b[^;\$]+\1[\)\s]+;(?<X1237640>)|@stream_socket_client\(\s*['"]tcp://\$\w{1,40}:25['"],\s*\$\w{1,40},\s*\$\w{1,40},\s*\d+\);\s*else\s*(return)\s*-?\d;\s*if\s*\(\s*!\s*\$\w{1,40}\)\s\s*{\s*\50\s*\d;\s*}\s*else\s*{\s*\$\w{1,40}\s*=\s*\w{1,40}\(\1\);\s*@fputs\(\s*\1,\s*['"]EHLO\s*\$\w{1,40}\s*\\r\\n['"]\s*\);(?<X2054330>)|['"\.\sasert]{11,28}\s*;\s*@?\1\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)(?:\s*;)?(?<X1060943>)|['"\s\.asert]{9,36};\s*@?\1\s*\(\s*@?\$\{\s*['"\s\._POST]{8,40}\s*\}\s*\[[^\]]+\]\s*\)\s*;?(?<X1043722>)|['"](?:\.\./){3,}['"]\s*;\s*(\$\w{1,40})\s*=\s*@?file_get_contents[\s\(]+['"]http://[^'"]{40,}\.php['"][\s\)]+;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\1[\.\s]+\$\w{1,40}[,\s]+['"][^'"]*['"][\)\s]+;\s*\$\w{1,40}[=\s]+fwrite[\(\s]+\55[,\s]+\54[\)\s]+;\s*return\s*\1[\.\s]+\$\w{1,40}\s*;(?<X1222360>)|['"](?:\\x\w{2}){40,78}['"];\s*\$payload\s*=\s*\$\w{1,12}\.\$\w{1,12}\.\$\w{1,12}.\$\w{1,12};\s*preg_replace\('/\.\*/e',\1,'\.'\);\s*\?>(?<X2052660>)|['"]/h[^'"]+/\.[^'"\$]+['"]\s*;\s*if[\s\(]+!\h*isset[\s\(]+\1[\s\)]+\{\s*echo[^\}\{]+\}\s*else\s*\{\s*@include(?:_once)?\s*/\*[^\*]*\*/[\s\(]+\1[;\s\)]+\}(?<X1285660>)|['"]/h[^;]+;\s*if[\s\(]+!\h*isset[\(\s]+\1[\)\s]+\{\s*\wtrim[\s\(]+\1[\);\s]+\}\s*else\s*\{\s*@include_once\s*/\*[^\*]+\*/[\s\(]+\1[\);\s]+\}(?<X1283380>)|['"]/home\d*/[^/]+/(?:[^'"]+/public_html/?['"];\s*\$\w{1,40}[=\s]+\1[\.\s]+['"]index\.php['"\s;]+(\$\w{1,40})[=\s]+\1[\.\s]+['"]wp\-[^'";]+\.css['"\s;]+if[\(\s]+(file_)exists[\(\s]+\60[^/\.]{0,499}(\$\w{1,40})[=\s]+\1[\.\s]+['"]\.htaccess[^\}]{0,999}@\61put_contents[\s\(]+\62[^=\}]{0,99}\}\s*\}(?<X1219580>)|\.[^'"]+['"]\s*;\s*if[\(\s]+!is_file[\(\s]+\1[\)\s]+\|\|\s*filesize[\(\s]+\1[\)\s]+\S{2,3}\s*\d+[\)\s]+\{\s*@?file_put_contents[\(\s]+\$\w{1,40}[,\s@]+\w+[\(\s]+base64_decode[\(\s]+['"]aHR0[^'"]+dHh0['"][\)\s;]+\}(?<X1212390>))|['"]=\w{1,40}\?[^/]+/[^;:]+//:f?cggu['";\s]+if[\s\(]+preg_match[\s\(]+(?:(?:strrev|str_rot13)[\s\(]+)+['"][^"']+['"][\s\),]+strtolower[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})\s*=[^;]+\1[^;]+;\s*(\$\w{1,40})[\s=]+wp_remote_get[\s\(]+\65[\s\);]+\$\w{1,40}\s*=[^;]+\66[\s\);]+echo\s*\$\w{1,40};\s*\}(?<X1198340>)|['"]['"\h\.base64_dco]{13,40}['"][;\s]+(\$\w{1,40})[=\s]+(?:['"]aHR0c[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+(?:(?:\1|\68)[\(\s\)]+){2,};\s*(\$\w{1,40})[=\s]+(wp_remote_)get[\(\s]+\69[\)\s;]+(\$\w{1,40})[=\s]+\71retrieve_body[\(\s]+\70[\)\s]+;[^\}]+?(?:\{\s*echo\s*\72\s*;\s*\}|echo\s*\72\s*;)(?<X1208770>)|\1[^;]+;\s*(\$\w{1,40})[=\s]+\1[^;]+;\s*require(?:_once)?[^\-;/]+wp\-includes/reg[^'"]+['"][\)\s;]+if[\(\s]+!(user)name_exists[^\}=]+(\$\w{1,40})[=\s]+wp_create_\75(?:[^;]+(?:\68|\74)){2,}[^;]+;\s*(\$\w{1,40})[=\s]+new\s*WP_\75[\(\s]+\76[\)\s]+;\s*\77\->set_role[\(\s]+['"]admin[^\}]+\}(?<X1208760>))|['"]['"\h\.base64_dco]{16,40}['"];\s*\$\w{1,40}\s*=\s*\1[\s\(]+['"]PD9[^'"]{99,}['"][\s\)]+;\s*\$\w{1,40}\s*=\s*\1[\s\(]+['"]PHNjcmlwdD[^"']{99,}['"][\s\)]+;(?<X1229060>)|['"]['"\h\.base64_dco]{20,60};\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]Z[^;]+;\s*eval[\s\(]+\80[\s\)]+;\s*(\$\w{1,40})\s*=\s*\w+[\s\(]+['"]%[^;]{99,};\s*eval[\s\(]+\81[\s\)]+;(?<X1276860>)|['"]['"\h\.base64_dco]{21,40}['"][;\s@]+error_reporting[\(\s]+0[\)\s;@]+eval[\(\s]+\1[\(\s]+['"]IGVyc[^'"]{99,}['"][\s\);\?>]+\Z(?<X1261120>))
(\$\w{1,40})\s*=\s*(?:['"]['"]\s*;\s*if[\(\s]+time[\(\)\s]+[\-\*\+]\s*\d+\s*[=><][=\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+function_exists[\(\s]+['"]curl_version['"][\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init\b[^:]{0,999}CURLOPT_URL\s*,\s*['"]https?://[^/'"\$]+/[^\*@]{9,9999}\becho\b[^;]+\1[^;]*;\s*(?:exit|die)\b[^;]*;(?<X1240250>)|['"][^'"\$]{1,20}['"]\s*\^\s*['"][^'"\$]{1,99}['"]\s*;\s*@?preg_replace[\s\(]+\1\s*,[^,;]{9,999}['"]\s*,\s*['"][^'"\$]{1,20}['"][\s\)]+;(?<X1215660>)|['"][^'"]{0,9}(?:\\x?\d{2,3}\w){3,20}\([^;]{999,}['"]\h*;\s*@?(?:assert|eval)[\s\(]+\1[\s\)]+;(?<X1194350>)|['"][^'"]{1,40}\.html?['"]\s*;\s*(\$\w{1,4})\s*=\s*fopen\(\s*\1\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*[^;]{0,39}\s*;\s*fwrite\(\s*\5\s*,\s*(\$MESSAGE)\s*\);\s*fclose\(\5\);\s*@?mail\(\$TO,\$SUBJECT,\6,\$HEADER\);(?<X2054251>)|['"][^'"]{1,9}['"]\s*\^\s*['"][^'"]{1,9}['"];\s*(\$\w{1,40})\s*=\s*&\$\1;\s*\$\w{1,40}[=\s]+array[\(\s]+(?:['"][^'"]+['"]=>\s*['"][^'"]{1,49}['"]\s*\^\s*['"][^'"]{1,49}['"](?:\s*,)?\s*)+\s*['"][^'"]+['"]=>@\8\[[^\n]{99,199}(\$\w{1,40})[^;]+['"]['"][^=\n]{0,40}==\$\w{1,40}[\)\s]+\9\(\);(?<X1215540>)|['"][^'"]{3,9}['"]\s*\^\s*['"][^'"]{3,9}["']\s*;\s*(\$\w{1,40})\s*=\s*&\$?\1;\s*(\$\w{1,40})\s*=\s*array\s*\([^\|\n]{99,499}\$\w{1,40}[\s\(]+\12[^\n\[\}]{1,40}\11\[[^\]]+\][^"'\n]{1,40}(\$\w{1,40})\s*=\s*\$\w{1,40}[\s\(]+['"]{2}[\s,]+\$\w{1,40}[\s)]+;[^\n;]+\13\s*\(\s*\)\s*;(?<X1214930>)|['"][asert]{1,5}['"]\s*;\s*\1\s*=\s*['"][asert]{1,5}['"]\s*\.\s*\1\s*;\s*(\$\w{1,40})\s*=\s*['"][_POST]{5}['"]\s*;\s*\$\w{1,40}\s*=\s*strtoupper\s*\(\s*(?:\15\[\d\]\.?){5}\s*\)(?<X2052291>)|['"]\?>['"];\s*@?eval[\(\s]+\1\s*\.\s*\w+[\(\s]+base64_decode[\(\s]+['"](?:aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbn|aHR0cHM6Ly9naXN0LmdpdGh1YnVzZXJjb24)[^'"]+['"][\)\s]+;(?<X1278001>)|['"]\\143(?:\\x65|\\14\d|\\16\d|\\137|\\x74|\\x6e|\\15\d|\.|['"]|\s){20,};\s*(\$\w{1,40})\s*=\s*\1[\s\(]+['"]\\[^\)]+\)[\s;]+\18[\s\(]+['"][=a-z\d/\+]{99,}['"][\s\)]+;(?<X1202161>)|['"]\\x[a-f\dx\\]{9,40}['"]\s*\^\s*['"][^'"]{9,}['"];\s*(\$\w{1,40})\s*=\s*['"][^'"]+[""](?:\s*\^\s*['"][^'"]+[""])+\s*;\s*\1[\s\(]+\20\s*,[^;\(]{999,},\s*['"][^'"]+['"]\s*\)\s*;(?<X1215280>)|['"]as+['"]\s*\.\s*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*array\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*@?array_filter[\(\s]+\22[\s,]+\1[\s\)]+;(?<X1195440>)|['"]base(?:64_(?:decode['"][\s;]+if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+(\$\w{1,40})[\s=]+['"]file_put_contents['"\s;]+(\$\w{1,40})[\s=]+\1[\s\(]+\$_[GPRSC]\w{2,6}\[[^=]+\24[\s\(]+['"]([^'"]+)['"]\h*,[^;]+\25[\s\);]+(\$\w{1,40})[\s=]+['"]\26['"][^\}]+include[\s\(]+\27[^=]+;(?:\s*\}){2}(?<X2195860>)|encode['"];\s*(\$smuri)\s*=\s*\1[\(\s]+\$smuri_tmp[\)\s;]+function\s*smrequest_uri[\s\(\)]+\{\s*if[\(\s]+isset[\(\s]+(\$_SERVER\[['"]REQUEST_URI['"]\])[\s\)]+\{\s*\29\s*=\s*\30;[^:]{4,999}\$\w{1,40}\s*=\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\s*\?\s*\31\s*:\s*['"]{2}\s*;(?<X1201310>))|['"];\s*(\$\w{1,40})\s*=\s*['"]?64['"]?\s*;\s*(\$\w{1,40})\s*=\s*['"]decode['"]\s*;\s*(\$\w{1,40})\s*=\s*(?:\1|\33|\34)\s*\.\s*(?:\1|\33|\34)\s*\.\s*['"]_['"]\s*\.\s*(?:\1|\33|\34)\s*;\s*@?(?:eval|assert|system)[\(\s]+\35[\(\s]+file_get_contents[\(\s]+['"][^'"\$]+\.txt['"][\)\s]+;(?<X1250270>)|['"]\s*\.[\s\(]+128[\s/%\*\+\-]+\d[\)\s]*\.\s*['"]_de['"]\s*\.\s*['"][code'"\s]{5,};\s*@?(?:eval|assert)[\(\s]+\1[\(\s]+\$\w{1,40}\s*\.\s*\$\w{1,40}[\s\)]+;(?<X1221680>))|['"]curl_init\+curl_setopt\+curl_exec\|fsockopen\|pfsockopen\|stream_socket_client\|socket_create['"];\s*\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+\$\w{1,40}[=\s]+['"]['"]\s*;[^\?]{0,499}unset[\(\s]+\1[,\s]+\$\w+[\)\s]+;(?<X1247700>)|['"]https?://(?:(?:past[a-z]{1,5}|[a-z]{2,5}bin)\.(?:com?|ee|xyz|top)/(?:raw|download|r)?(?:\.php\?i=|/)[^'"]{1,40}['"][^,]{1,999},\s*CURLOPT_URL\s*,\s*\1[^\}]+\}\s*else\s*\{\s*(\$\w+)\s*=\s*@\bfile_get_contents[\(\s]+\1[^\}]*\}\s*@?eval\b[^;\)]+\39[\)\s]+;(?<X1248131>)|["'];\s*\1\s*=\s*\1\s*\.\s*['"](?:[fz][^'"]+['"];[^\n\*]{99,}(\$data\w*)\s*\[['"]http_user_agent['"]\][^\}]*,\s*\41[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261240>)|\d{1,3}(?:\.\d{1,3}){3}/[zf][^'"]+['"];[^\n\*]{99,}(\$data\w*)\s*\[['"]http_user_agent['"]\][^\}]*,\s*\43[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261230>))|[^/]+\.[a-z]{2,7}/wp\-(?:includes|admin)/[^'"]+/[\w\.\-]+\.txt['"]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+file_get_contents[\s\(]+\1[\s\)]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\45[\)\s]+;(?<X1223400>)|[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*;\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\1\h*\)\h*;\s*@?(?:eval|assert)\h*\([^;]{0,99}\47[\h\)]+;(?<X1166190>)|cdn(?:[^'"/]+/[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+tempnam[\(\s]+sys_get_temp_dir[\s\(\)]+,[^;]+\.['"\s]+\.php['"][\s;]+try\s*\{\s*\$\w+[=\s]+curl_init[\(\s]+\1[^\}]+\binclude(?:_once)?[\(\s]+\49[\)\s;]+\}\s*\}\s*finally\s*\{[^\}]*unlink[\(\s]+\49[\);\s]+\}\s*\}(?<X1280690>)|[^'"]+\.txt['"][\s;]+(\$\w{1,40})[=\s]+(?:(curl_)init[\s\(]+(?:\1)?[;\)\s]+\52setopt[^=]+(\$\w{1,40})[=\s]+\52exec[\s\(]+\51[^\{\}]{0,499}file_pu\w+[\s\(]+(\$\w+)[,\s]+\53[^\*]{0,499}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]{0,3}\54[^\*]{0,499}unlink[\s\(]+\54[\s\);\}]{1,9}(?<X1273891>)|tempnam[^;]+;\s*try[\s\{]+(\$\w{1,40})[=\s]+(curl_)init[\s\(]+\1[^\{\}=]+(\$\w{1,40})[=\s]+\57exec[\s\(]+\56[^=\{\}]+\58\s*(?:&&|and)\s*file_pu\w+[\s\(]+\51[,\s]+\58[\s\)\{]+include[\w\(]*\51[^=]{0,499}unlink[\s\(]+\51(?:[\s\);]*\})+(?<X1273900>)))|pastebin\.com/raw/\w+['"];\s*(\$\w{1,40})\s*=\s*['"]\.+/[\w\-]{1,3}\.php['"]\s*;\s*@?file_put_contents[\s\(]+\60\s*,\s*file_get_contents[\s\(]+\1[\s\)]+;(?<X1250850>))|['"]index\.php\.bak(?:['"\s;]+\$\w{1,40}[=\s@]+(file_)ge(t_contents)[\s\(]+\1[\s\);]+(\$\w{1,40})[=\s@]+['"]/[^'"]{40,}/wp\-(?:admin|includes)\b[^"']*/\d+['"\s;]+if[\s\(]+\62exists[\s\(]+\64[\s\)]+\{\s*(\$\w{1,40})[=\s@]+\62ge\63[\s\(]+\64[^\}]+,\s*\65[\s\);@]+chmod[\s\(]+\1[,\s]+04+[\s\);]+\}\s*\}(?<X1208571>)|['"]\s*;\s*\$\w{1,40}\s*=\s*@?file_get_contents[\(\s]+\1[\)\s]+;[^\{\}]{9,399}if[\s\(]+file_exists[\(\s]+\$\w+[\s\)]+\{[^\{\}]{9,399}if[\(\s]+md5[\(\s]+\$\w+\s*\)[^\{\}]{9,399}\{[^\}]{0,99}\bfile_put_contents[\s\(]+\1[,\s]+\$\w{1,40}(?:[^\}]{0,99}\}){2}(?<X1232650>))|['"]m['"]\s*\.\s*chr[\(\s]+100[\)\s]+\.\s*chr[\(\s]+53[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\}]+\}\s*if[\s\(]+(?:\1[\s\(]+)+\$_[GPRSC]\w{2,6}[^\n\{\}]{99,999}\{\s*(\$\w{1,40})\s*=\s*sys_get_temp_dir[^\n]{99,999}@include[\s\(]+\68[\s\);]+@unlink[\s\(]+\68[\s\)]+;\s*\}\s*\}(?<X1249010>)|['"]p['"\h\.aceglpr_]{15,40}\s*\;\s*\1\s*\(\s*.?['"](.).{0,40}\70(?:["']\h*\.\h*['"])?e['"]\h*,\h*[eval'"\.\h]{5,40}\h*\(\h*['"\h\.base64_dco]{15,40}\(\h*['"][^\)]{999,}['"][\h\)]+['"]\h*,\h*['"][^'"]{1,9}['"]\h*\)\h*;(?<X1185831>)|['"]PD9[^'"]{9,999}(?:ZXhlY|bW92ZV91cGxvYWRlZF9maWx)[^""]+['"]\s*;\s*@?file_put_contents[\s\('"]+\.[\w\-]{1,12}\.php['"]\s*,\s*base64_decode[\s\(]+\1[\s\)]+;(?<X1218541>)|['"]phar://\./[^;]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{0,3}\1[\s\)]*;(?<X1273880>)|['"]range["']\s*;\s*(\$\w{1,40})\s*=\s*\1\s*\([^;]+;\s*include(?:_once)?\s*\74\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*\.\s*\74\s*\[\s*\d+\s*\+\s*\d+\s*\](?<X2217791>)|['"]wp[^'"]+\.css['"];\s*global\s*(\$\w+);\s*if[\s\(]+is_file[\(\s]+\1[\)\s!&]+\76[\)\s\{]+(\$\w+)[=\s]+trim[\(\s]+file_g\w+[\(\s]+\$\w+[\)\s;]+if[\s\(]+\77!=+['"]{2}[\)\s]+\{[^\{\}]+(\$\w{1,40})[\s=]+jso\w+[\s\(]+\77[^=]+foreach[\(\s]+\78\s*as\s*(\$\w+)[\)\s]+\{[^\}]+@chmod\(\79(?:[^\}]*\}){4}(?<X1272320>)|['"]wp\-login\.php['"]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+['"]PD9[^'"]{99,}['"][\s\)]+;\s*file_put_contents\s*\([^,;]*\1\s*,\s*\81[\s\)]+;(?<X2206640>)|['"]{2}\s*;\s*(\$\w{1,40})\s*=\s*urldecode\s*\(\s*['"]%[a-f\d%]{40,}['"]\s*\)\s*;\s*\$\w{1,40}=\s*\83\s*\{\d+\}\s*\.[^\n]{999,}\1\s*!?=+\s*\\?['"]\\?['"][^\n]{999,}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*\(\)\s*;(?<X1206030>))
(\$\w{1,40})\s*=\s*(?:[^;]{1,40}\.php['"]?\s*;\s*(\$\w{1,20})\s*=\s*\w{1,40}\s*\(\s*['"]https?://(?:ghostbin|pastebin)\.com/(?:raw|download|paste)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*\)\s*;\s*(\$\w{1,20})\s*=\s*fopen\s*\(\s*\1,\s*['"]\w\+?['"]\)\s*;\s*fwrite\s*\(\s*\3,\s*\2\)\s*;\s*fclose\s*\(\s*\3\s*\)\s*;?(?<X2062302>)|[assert'"\. ]{7,};\s*(\$\w{1,40})=[eval'"\. ]{5,};\s*@\1\("\5\(\\\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)"\s*\)\s*;(?<X1040961>)|\$\w+[\(\s]+\$\w+[\)\s]+;\s*(\$\w{1,40})\s*=\s*\1\s*;\s*if[\(\s]+!\7[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^\{\}]+\bfunction\s*__construct[\(\)\s]+\{\s*\$\w{1,40}[=\s]+\$_COOKIE;[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\8[\(\)\s]+;\s*\9[=\s]+NULL[\s;]+\}(?<X1248690>)|\$\w{1,40};\s*(?:(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\n]{99,}\}\s*\$\w+\s*=\s*new\s*\11[\(\)\s]+;[^\}]*\}(?<X1252720>)|\1\s*=\s*.?\s*\w/[^/]+/['"][^\w]['"]\.unpack\s*\([^\)]+\)[^;]{0,4};[^>]{0,20}<html>\s*<head>\s*<title>\s*PPS\s+\d\.\d(?<X2062452>)|if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w+)\s*\{[^\?:@]{0,999}\bfunction\s*__construct\s*\(\s*\)\s*\{\s*\$\w+\s*=\s*\$_COOKIE;[^\n]{99,9999}\bexit[\s\(\);\}\s]+\$\w+\s*=\s*new\s*\14[\(\)]+;[^\}]*\}(?<X1250840>))|\$\w{1,40}\s*;\s*if[\(\s]+!\s*\1[\)\s]+\{\s*class\s*(\w{1,40})\s*\{[^_]{0,999}\bfunction\s*__construct[\(\)\s]+\{\s*\$\w{1,40}\s*=\s*\$_COOKIE\s*;\s*\$\w{1,40}\s*=\s*\$_POST\b[^\?]{99,9999}\b(?:exit|die)\s*\(\s*\)\s*;[\}\s]+\$\w+\s*=\s*new\s*\16[\(\);\s]+\$\w+\s*=\s*['"][^;\{\}]+;\s*\}(?<X1250490>)|\$\{['"]\\x5f\\x43\\x4f\\x4f\\x4b\\x49\\x45['"]\};\s*if[\s\(]+in_array[\s\(]+gettype[\s\(]+\1[\s\)]+\.\s*count[\s\(]+\1[^\{\};]+\{[^;]+\1\s*\([\s\)]+;\s*\}(?<X1202290>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:['"]?\w{1,40}['"]?\];\s*(\$\w{1,40})\s*=\s*['"]\w{1,40}\.txt['"];\s*if\s*\(\s*\$\w{1,40}\s*==\s*['"]?\w{0,40}['"]?\s*\)\s*\{\s*die;\s*\}\s*else\s*\{\s*@?unlink\s*\(\s*\19\s*\);\s*\$sym(?:link)?\s*=\s*\1;(?<X2052930>)|[^\]]+\]\s*;[^\(]{1,40}(\$\w{1,40})\s*=\s*base64_decode\s*\(\s*\1\s*\)\s*;\s*[^@]{99,999}(\$\w{1,40})\s*=\s*file_get_contents\s*\(['"]\21[^\)]+\);\s*(\$\w{1,40})\s*=\s*['"]\21[^'"]{0,20}\22\.\$?php['"];\s*if\s*\(\s*!@fopen\s*\(\23(?<X2062251>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*;\s*if\s*\(\s*!is_user_logged_in\s*\(\s*\)\s*\)\s*\{\s*(wp_set)_current_user\s*\(\s*\1\s*\)\s*;\s*\25_auth_cookie\s*\(\s*\1\s*\)\s*;\s*\}(?<X1058490>)|\$_[GPCRS]\w{2,6}\[[^;]{1,99};\s*(\$\w{1,40})\s*=\s*['"]file_put_contents['"];[^\}@#%&\*:\\\|!]{0,999}(\$\w{1,40})\s*=\s*['"]unlink['"];\s*\27\h*\(\h*(\$\w{1,40})\h*,[^\);]{0,99}\1\b[^;]{0,99};\s*include\h*\(\h*\29\h*\);\s*\28\s*\(\s*\29\s*\);(?<X1185380>)|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\]\s*;\s*(?:@eval\s*\(\s*['"]\\\$\w{1,40}\s*=\s*\1\s*;\s*['"]\s*\)\s*;(?<X1195890>)|\$\w{1,40}\s*=\s*array\h*\([^;]+;\s*foreach\s*\(\s*\1\s*as\s*(\$\w{1,40})\s*\)\s*\{[^\}]{0,499}\}(?:\s*\$\w{1,40}\s*=\s*)?@?mail\h*\((?:\h*\32\[[^\]]+\]\h*,){3}[^;]+;\s*(\$\w{1,40})[^\}]{0,99}\}\s*echo[^;]{0,40}\33[^;]{0,40};(?<X2194800>))|\s*;(?:\s*\$\w{1,40}\s*\.=\s*['"][^'"]{1,40}['"]\s*;)+\s*\bif[\(\s]+isset[\(\s]+\1\s*\[\s*(\$\w{1,40})\s*\([^\{;=]+\{\s*(\$\w{1,40})\s*=\s*\1\s*\[\s*\35[^;]+;\s*if[\(\s]+\$\w{1,40}[\(\s]+\36[\)\s]+\{\s*\}\s*\}(?<X1215820>)|\s*;\s*foreach[\s\(]+\1[^\)]+\)\s*\{[^\}]+\}\s*(\$\w{1,40})\s*=\s*\1\[[^\]]+\][^;]*;\s*(\$\w{1,40})\s*=\s*\1\[[^\]]+\][^;]*;[^\{\}\?]{0,99}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\39[;\s\)]+\1\[[^\]]+\][\s\(]+\38[\)\s;]+\1\[[^\]]+\][\s\(]+\39[\s\)]+;(?<X1223010>)|\s*\[[^\]]+\]\s*;\s*(?:@?mail\s*\(\s*['"][^@]{1,40}@?[^'"]{1,40}\.\w{2,9}['"]\s*,\s*['"]\1['"]\s*,\s*['"]\1['"]\s*\)\s*;(?<X1127674>)|if\s*\(\s*\1\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(?:echo|print)?\s*\(?\s*@(?:eval|assert|system|exec|shell_exec|passthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1125261>)))|\$_COOKIE(?:\h*;\h*foreach\s*\(\s*\1\s*as\s*(\$\w{1,40})\s*=>\s*(\$\w+)[\)\s]+\{[^;\^\{\}]+\^\s*str_pad[\(\s]+\43\s*,\s*strlen[\(\s]+\44[\),\s]*\43[\);\s]+\}\h*eval[\(\s]+\1\[[^\]]+\][\)\s]+;(?<X1261100>)|\s*;[\(\s]*COuNT[\(\s]+\1[\)\s]*==+\s*\d+\s*(?:&&|and)\s*IN_arRAY[\s\(]+GeTtypE[\s\(]+\1[\)\(\.\s]+count\s*\([^\?;]+\?[^,;]+\1\s*=\s*\1\s*\[\d+\]\s*\(\s*\1\[\d+\][,\s]+\1\[\d+\][\s\(]+\1\[[^;:]+:\1(?:\s*;)?(?<X1254980>)|\s*;[^\{\}]{0,499}\bwhile[\s\(]+(\$\w+)[\)\s]+\{\s*(\$\w+)\[(\$\w+)\]\s*\.=\s*\1\[[^\]]+\]\[\47\];[^\}]+\}[^!]{0,499}\bif[\s\(]+!\s*\48\s*\[[^\]]+\][^;]+\47[=\s]+\48\s*\[[^\]]+\][\s\(]+\49[^;]+;\s*\48\s*\[[^\]]+\][\s\(]+\47\s*,[^;\)]+\1\s*\[[^;]+;[\s\}]*include(?:_once)?[\s\(]+\49[\s\)]+;(?<X1262070>)|\s*;\h*if[\s\(]+round[\(\s]+\d+[\(\s]*[\+\-\*/][^\n@\*]{99,}\$GLOBALS\[[^\]]+\]\[[^\]]+\][\(\s]+\$\w+[,\s]+\1[\)\s]+;(?<X1261260>))|\$_POST\s*\[\s*[''][^'"]+['']\s*\]\s*;\s*(\$\w{1,40})\s*=\s*\$_POST\s*\[\s*[''][^'"]+['']\s*\]\s*;\s*(\$\w{1,40})\s*=\s*base64_decode[\s\(]+(?:\1|\52)[\s\)]+;\s*@?file_put_contents[\s\(]+(?:\1|\52)\s*,\s*(?:\53)\s*\)\s*;\s*@?chmod[\s\(]+(?:\1|\52)\s*,\s*\d+[\)\s]+;(?<X1250430>)|\$_SERVER\s*\[(?:['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/wp\-includes/js/[^'"]+\.js['"]\s*;\s*if[\s\(]+\$\w{1,40}\s*&&\s*file_exists[\s\(]+\$\w{1,40}\s*\)[^\n]{99,}\bfile_put_contents[\(\s]+(\$\w+)\s*,\s*file_get_contents[\(\s]+\1[\s\);@]+chmod[\(\s]+\55[,\s]+['"]\d+['"][\);\s]+\}\s*\}(?<X1251950>)|\s*['"]HTTP[^\]]+\]\s*;\s*if[\(\s]+preg_match[\(\s]+['"][^'"]+['"][,\s]+\1[,\s]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\s*\.?=[^;]*\57[^;]*;\s*\58[\s=]+str_replace\b[^;]+\58[\s\)]+;(?<X2223473>))|\(['"][^'"]{1,99}['"]\);[^\.]{0,199}(?:\$\w{1,40}\s*=(?:\s*\1\{\d+\}\.){3,}\1\{\d+\};\s*)+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^#@]{999,}@socket_read\((?:[^#@]{9,}@)+header\([^\?@]{0,999}\becho[\s'"\(]+(\$\w{1,40})[\s'"\);]+unset[\s'"\(]+\60[^\{]{1,99}\{[^;]+\]\(\);(?<X1197984>)|\([^\)]{9,49}\)\^\$\w{1,40};\s*(\$\w{1,40})\s*=.{1,999}(?:\1|\62)\s*[\(\);\.][^;]{0,99}\)(?:(?:die|exit)[^;]{0,9})?;(?<X2140414>)|\1\s*\.\s*['"][fz](?:[^'"]+['"];\s*function\s*\w+[\(\s]+\$\w+[\)\s]+\{[^\?\n]{99,}\?\s*['"]https?://['"][^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}\s*\w+[\s\)\(]+;(?<X1262830>)|\w+\.[^'"]+['"];\s*function\s*(getSe\w+)\s*\([^\n\*\\]{99,}(\$\w+)\[['"]http_user_agent['"]\][^;]*;[^\}]+\65\s*\([^;]+\66[\\)]+;[^\}]*\}\s*@?\w+\s*\(\s*\)\s*;(?<X1261800>))|\1\s*\.\s*['"](?:\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]+['"];\s*function\s*\w+[\(\s]+\$\w+[\)\s]+\{[^\?\n]{99,}\?\s*['"]https?://['"][^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}\s*\w+[\s\)\(]+;(?<X1262821>)|https?://[fz][^"']{4,}['"];\s*function\s*(\w{1,40})\s*\([^\n]{99,}(\$\w+)\s*\[['"]http_user_agent['"]\][^;]*;\s*\$\w+\s*=\s*\69[^;]+\70[^\}]*\}\s*\w+[\s\(\)]+;(?<X1261500>))|\[(?:['"]aHR0cHM6Ly[^'"]{9,199}['"](?:\s*,)?\s*){2,}\][\s;]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*foreach[\(\s]+\1\s*as\s*(\$\w{1,40})[\)\s]+\{[^\}]{0,299}(\$\w{1,40})[=\s]+curl_init[\(\s]+base64_decode[\(\s]+\72[^\}]+\bcurl_exec[\s\(]+\73[^\}]{0,99}\}\s*\}(?<X1218561>)|\[\(\d{1,40}[\+\-]\d{1,40}[^\]]+\]\];\s*(\$\w{1,40})[=\s]+cuRl_IniT[\(\s]+\$\w{1,40}[\)\s]+;\s*CURl_SEtOPt_arrAY[\(\s]+\75[,\s]+\1[\)\s;]+\$\w{1,40}[=\s]+cuRL_exec[\(\s]+\75[\)\s]+;[^\?\n><]{0,999}\bcurl_cLOse[\s\(]+\75[\s\)]+;(?<X1285010>)|\d{1,3}\s*\+\s*\d{1,3}\s*\+\s*\d{1,3}\s*;\s*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*){3}(\$\w{1,40})\s*=\s*\w+[\s\(]+['"][^'"]+['"][,\s]+\1[,\s]+['"][^'"]{40,999}['"][\s\)]+;\s*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*){3,}\$\w{1,40}\s*=\s*\77[\s\(]+["'][^'"\$]{9,}['"][\s\)]+;(?<X2223840>)|\w{1,40}\h*\(\s*\$[DO0i_]+\h*,\s*['"]https?://['"]\h*\.\h*\$[DO0i_]+\b\h*\.\h*['"][^'"/]+\.[a-z]{2,6}/[^\?;'"/]+\.php\?domain=['"]\h*\.[^\?;:/]+;\s*if[\s\(]+(?:!\h*empty[\s\(]+\1[\s\)]+\{[^;]+\bjson_decode[\s\(]+\1\h*,[^,]{0,999}\becho[\s\('"]*\1[\s\)'"]*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1196720>)|\1[\s\)]+\{\s*echo[\s'"\(]*\1[\s'"\);]+(?:exit|die)\b[^;]{0,19};\s*\}(?<X1196710>)))
(\$\w{1,40})\s*(?:=(?:\s*(?:urldecode(?:[\(\s]+['"][a-z]{2,9}\.[\w\.\-]+\.\w{4,5}['"][\s\);]+(\$\w{1,40})[=\s]+is_https[^\[&]{1,499}(\$\w{1,40})[=\s]+str_rot13[\s\(]+\1[^!]+(\$\w+)[=\s]+\2[^;]+\3[^;]+;\s*(\$\w+)\s*=[^;=]*\4[^!]+(\$\w{1,40})[=\s]+\w+[\s\(]+\5[\s;\)]+if[\s\(]+!strstr[\s\(]+\6[^;]+\b\w+[\(\s]+\6[;\s\)]+\}(?<X1278440>)|[\s\(]+\$\w{1,40}[\s\)]+;define[\s\('"]+BASE_PATH['"\h,]*str_ireplace\s*\([^\|]{0,199}\$\w{1,40}[\s=@]+file_get_contents(?:[\s\(]*\$\w{1,40}\s*\{\d+\}\s*\.){9,}\1\s*\{\d+\}[\s\)]+;[^\?\*>]{9,9999}\b(?:(?:touch|chmod|usleep)[^;]+;\s*){3}\}\s*\}\s*\}(?:\s*;)?(?<X1195461>)|\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*[^\}\{\]\{]{1,399}(\$\w{1,40})\s*=\s*file_get_contents\(\1\);\s*@?eval\(\9\);(?<X1123620>))|wp_create_user[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}(?:,\s*\$\w{1,40})?[\s\)]+;\s*(\$\w{1,40})\s*=\s*new\s*WP_User[\(\s]+\1[\s\)]+;\s*\11\->set_role[\(\s]+['"]administrator['"][\s\)]+;\s*grant_super_admin[\s\(]+\1[\s\)]+;(?<X1198981>)|wp_remote_post[\(\s]+base64_decode[\("'\s]+aHR0c[^'"]{1,199}['"][^;]+;\s*if[\(\s]+!empty[\(\s]+\1\[[^\]]+\][\s\)]+\{(?:\s*(?:exit|die)\b[^;]{0,40};)?\s*@?eval[\(\s]+\1\[[^\]]+\][\)\s;]+(?:\s*(?:exit|die)\b[^;]{0,40};\s*)?\}(?<X1219062>))|__FILE__\s*;\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s]+(\$\w{1,40})[\(\s]+['"][^'"]{9,}['"][\)\s]+[,\s]+\15[\(\s]+['"][a-z\d\+/]{99,}['"][\s\)]+;\s*\14[\s\(]+\15\s*,\s*\$\w{1,40}(?:\s*\.\s*\$\w{1,40})+\s*,\s*\1[\s\)]+;(?<X1226750>))|\(\s*(?:.?['"](.).{0,40}\17e\w?.?['"]\s*,\h*\$\w{1,40}\h*,\h*['"]\w{0,9}['"]\h*\)\h*;\s*\1\s*\(\s*.?['"](.).{0,40}\18e\w?.?['"]\s*,\h*\$\w{1,40}\h*,\h*['"]\w{0,9}['"]\h*\)\h*;(?<X1191610>)|\d+(?:\s*(?:[-\+/\*\(\)]+\s*)+\d+)+[\)\s]*\.\s*(?:\1|['"]\d+['"])[^;]+;[^\n]{0,499}\binclude(?:_once)?[\(\s]+(\$\w{1,40})[\)\s]+;\s*\$?\w{1,40}[\(\s]+\20[\)\s;\}]+(?:exit|die)\b[^;]*;[\s\}]*\Z(?<X2238520>))|\.=\s*(?:['"](?:(Rewrite)Rule\s*\^['"]\h*\.\h*(\$\22_index)\h*\.\h*['"]\.php\$\s*\-\s*\[L\][^'";]*['"];(?:\s*\1\s*\.=\s*['"]\22Cond\s*%\{REQUEST_FILENAME\}\s*!\-[fd][^'";]*['"];)+\s*\1\s*\.=\s*['"]\22rule\s*\.\s*/['"]\s*\.\h*\23\h*\.\h*['"]\.php\$?\s*\[L\][^'";]*['"];(?<X1195300>)|Shell[^/]+\bhttps?://['"]\s*\.\s*\$_SERVER\s*\[['"]SERVER_NAME['"]\]\s*\.\s*\$_SERVER\s*\[['"]PHP_SELF['"]\][^;]*;[^\{\}\?,]{0,499}\bmail\s*\([^;]+\1[^;]+;(?<X1255711>))|\$\w{1,40}\s*\[[\s\(]*\d+\s*(?:[\+/\*\-\(\)]+\s*)+\d+\]\s*\.\s*['"]{2}\s*;\s*return\s*\1[\(\s]+\$\w{1,40}[\)\s]+;(?<X1225570>))|\.?=\s*@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\(@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^><]{0,999}\btrigger_error[\s\(]+\1[,\s]+\w+[\s\)]+;(?<X1202500>)|\=\s*['"\s\.base64_dco]{18,40}\s*;(?:\s*(\$\w{1,40})\s*\=\s*['"\s\.creat_funio]{18,45}\s*;|\s*(\$\w{1,40})\s*\=\s*['"\s\.gzuncompres]{18,40}\s*\;\s*){2}(\$\w{1,40})\s*=\s*@?(?:\1|\28|\29)\s*\(['"]{2},(?:\s*(?:\1|\28|\29)\s*\(){2}['"][^'"]+['"][\)\s]+;\s*\30\s*\(\)\s*;(?<X1132921>))
(\$\w{1,40}\h*\->\h*query_where)\h*=\h*str_i?replace\h*\(\h*['"](WHERE\h+(\d+)\h*=\h*\3)['"]\s*,\s*['"]\2\h*AND\h*\{\h*\$wpdb\h*\->\h*users\h*\}\h*\.\h*user_login\h*!==?\h*['"](?!silver_surfer)[^'"\$]{1,40}['"]\h*['"]\h*,\h*\1\h*\)\h*;(?<X1184582>)
(\$\w{1,40}Moban\w{0,40})\s*=\s*['"]\./wp\-(?:admin|includes)/[^"']+\.(?:png|jpe?g|gif)['"]\s*;\s*if[\(\s]+\$\w{1,40}\s*&&\s*(file_exists)[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!\2[\(\s]+\$\w{1,40}[\)\s]+or[\(\s]+filesize[\(\s]+\$\w{1,40}[^\?]{99,9999}\bchmod[\s\(]+\1[,\s]+\d+[\s\)]+;(?:\s*\}){2,9}(?<X1222350>)
(\$\w{1,4})\s*=\s*fopen\(\s*(?:(?:\$\w{1,4}|['"][\w\.]+['"])\s*,\s*['"](?:a|w)\+?['"]\);\s*fwrite\(\s*\1\s*,\s*[^\)]{1,20}(\$bilsmg)[^\)]{1,20}\s*\)\s*;\s*fclose\(\1\);\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,40}['"];\s*@?mail\s*\(\s*\3[^,]{0,50}\s*,\s*\$\w{1,40}\s*,\s*\2\s*,\s*\$\w{1,40}\s*\)\s*;(?<X2054742>)|['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\);\s*(?:fwrite|fputs)\(\s*\1,\s*(\$(?:message|\w\d))\s*\);\s*mail\(\s*\$\w{1,40},\s*\$\w{1,40},\s*\5\s*(?:,\$\w{1,40}\s*)?\);\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054450>))
(\$\w{1,50})\s*=\s*(?:'[^']*'\s*;\s*\$\w{1,50}\s*=\s*str_replace\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*,\s*\$\w{1,50}\s*\)\s*;\s*@\$\w{1,50}\s*\(\s*\$\w{1,50}\s*\(\s*\1\s*\)\s*\)\s*;(?<X2047960>)|[^;]{1,9};\s*if\s*\([^\)]+\)\s*@?(file_)put(_contents)\s*\(['"]\w{1,20}\.txt['"],(?:[^\;]{0,99})?\s*@?\3get\4\s*\(['"](php://input)['"]\)\s*\.[^;]{9,99};\s*if\s*\([^\)]+\)\s*\{\s*\1\s*=\s*@?\3get\4\s*\(['"]\5['"]\);(?<X2126551>))
(\$\w{1,5})=(?:['"][^'"a-z0-9]{1,9}["'];\s*\1=\([^;a-z0-9]{5,30}\);\s*if\(isset\(((\$\{[^\}]+\})\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,5})=['"][base64dco\.\*'"\d\h_]{15,35}['"];\s*\3\[[^\]]+\]\(\3\[[^\]]+\],\4\(\2\)\);\s*\}(?<X1175100>)|\$\w{1,5}\(['"]['"],\$\w{1,5}\(\$\w{1,9}\(\$\w{1,5}\[(\$\w{1,5})\((\$\w{1,5}),\d+,\6\(\7,\d+,\d+\)+\],['"\-_\+,/=]{4,18}['"]\)+;\1\(\);(?<X1135060>))
(\$\w{1,60})[\s=]+\$_[GPRSC]\w{2,6}\s*;\s*\$\w{1,60}[=\s]+\d+\s*;[\(\s]*count[\(\s]+\1[\)\s]+[^\w\s]{2,3}\s*\d+\s*[^\w\s]{2,3}\s*in_array[\(\s]+gettype[\s\(]+\1[^:;]+\1\(\)+\s*:\s*\1;(?<X1214011>)
(\$\w{1,9})(?:=(?:(@?strrev\()[preg_replace]{12}\);\s*(\$\w{1,9})=\2[base64_decode]{13}\);\s*@?\1\(\3\(\w{1,9}\),\$_[GPRSC]\w{2,6}\[[^\]]+\],\w{1,9}\);(?<X1133720>)|base64_decode\(file_get_contents\(['"][^\)]{1,99}\)\);(\$\w{1,9})=hex2bin\(['"][^\)]{1,99}\);(\$\w{1,9})=[^(]{1,99}\(\1,\5\);eval\(\6\);(?<X1256380>))|[=\s]+\$_SERVER\[['"]HTTP_USER_AGENT[^\{]{3,99}if[\s\(]+strpos[\(\s]+\1[\s,'"]+bot['"\)\s]+[^<#]+(\$\w{1,20})[\s=]+substr[\s\(]\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE[^\{\}]{3,99}if[\s\(]+\8[^\};]{0,99}\bheader[\(\s'"]+Location[:\shtps/]+[^\)]+\);[\s\}]*\b(?:exit|die)\b[^;]*;(?<X1276790>)|\h*=\h*(?:(\$\w{1,9})\(\h*['"]\w{1,9}['"]\h*,\h*['"]['"]\h*,\h*['"]\w{4,99}['"]\h*\);\s*(\$\w{1,9})\h*=\h*\10\(\h*['"]\w{1,9}['"]\h*,\h*['"]['"]\h*,\h*['"]\w{4,99}['"]\h*\);\s*(\$\w{1,9})\h*=\h*\11\(\h*['"]['"],\h*\1\(\h*\10\((?:\h*['"\$]\w{0,9}['"]?\h*[,\.]?){4,9}\)[\)\h]+;\h*@?\12\h*\(\)\h*;(?<X1054951>)|(base64_decode)\h*\(['"]bWQ1['"]\)\h*;\h*(?:\$\w{1,9}\h*=\h*['"][^'"]{1,99}['"];\h{0,9}){9,}[^=]{0,99}\$\w{1,40}\h*=\h*unserialize\(\14\(['"][^\v%\*@]{4999,14999}\bforeach\h*\(\h*\1\h*as\b[^\)]+\)\h*(\$\w{1,9})\h*=[^;]+;(?:\h*\})+\h*echo\h+\15\h*;(?<X1167390>)|@?\$_[GPRSC]\w{2,6}\h*\[['"]otp\d*['"]\];[^\*]{1,40}(\$\w{1,9})\h*=\h*\$_server\[['"]remote_[^\?]{99,3099}(\$\w{1,9})\h*=[^\:;]{1,20}\:\h*\1[^\}]{1,149}\18\h*\.\h*=[^\:;]{1,20}\:\h*\17[^\(]{1,399}if[\(\h]+@?mail[\(\h]+['"][^\$]{1,59}\$\w+,\h*\18(?<X2178351>)|['"]/home\d*/[^/]{1,40}/public_html[^'";]{1,99}\.php['"];\s*(\$\w{1,9})\h*=\h*['"]/tmp[^;]{1,99}['"];\s*if[\h\(]+(file_)exists[\h\(]+\20\D{2,9}hash[\h\(]+['"](?:sha|md)[1256]{1,3}['"][\h,]+(\21ge(t_contents))[\h\(]+\1[^\}]{1,199}\21pu\23[\h\(]+\1[\h,]+\22[\h\(]+\20[\h\)]+;\s*\}(?<X1173862>)|['"]<\?php\s+@?include(?:_once)?\(\\?['"]+[\h\.]+\$\w{1,40}[\h\.]+['"]\\['"]\);\s*\?>[^'"]{0,9}['"][\h\.]+\$\w{1,40}\h*;\s*file_put_contents\h*\(['"](index\.php)['"][\h,]+\1\);\s*@?chmod\h*\(['"]\25['"][\h,]+\d{3,4}\h*\);(?:\s*\}){2}\s*@unlink\h*\(['"][\w\-]{1,12}\.php['"]\);(?:\s*\?>)?\s*\Z(?<X2176610>)|['"][^/]+/wp-config\.php['"];\s*(\$\w{1,9})\h*=\h*file_get_contents\h*\(\1\);[^\?]{1,199}\bchmod\h*\(\1,\h*\d{3,4}\);\s*\27\h*=\h*trim\h*\(\27\)[\h\.]+['"]\\n[^\(]{0,49}[ir][ne][cq][lu][ui][dr]e(?:_once)\(ABSPATH\h*\.['"]wp-head\.php['"]\);(?<X2187292>)|['"][evalsrt'"\.\h]{7,40}['"];\h*(\$\w{1,9})\h*=\h*\$\{['"][_POST\."']{7,16}\}\h*;\h*\1\h*\(\h*\29\h*\[[^\]]+\]\h*\)\h*;(?<X1139821>)|['"][sape]\w{1,9}['"]\h*;\s*(\$\w{1,40})\h*=\h*trim\h*\(\h*\1\h*,\h*["']\w{1,9}['"]\h*\)\h*\.\h*str_repeat\h*\(\h*['"]\w['"]\h*,\h*\d+\h*\)(?:\h*\.\h*trim\h*\(\h*\1\h*,\h*["']\w{1,9}['"]\h*\))+\h*;\s*\31\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1146070>)|['"]\s*hacked\h*by[^;]{0,49};\s*(\$\w{1,9})\h*=\h*fopen\(['"][^'"]{2,40}\b\w{1,20}\.html['"]\h*,[^\)]+\);\s*fwrite\(\33,\h*\1\);\s*fclose\(\33\);(?<X1188391>)|['"]{2};\s*if\h*\(\h*isset\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h\)]+\{\s*\1\h*=\h*\35;\s*\}\s*else\s*\{\s*\1\h*=\h*\w{1,40}\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{1,99}@?eval\h*\(['"]\?>['"]\h*\.\h*\1\);\s*@?eval\h*\(['"](?:exit|die)\b[^;]{0,9};['"]\);\s*@?\w{1,40}\h*\(\1\)(?:\h*;)?(?<X1140850>)|['"asert\.\h]{1,25};\s*(\$\w{1,9})\h*=\h*(array)\h*\(\1\h*=>\h*['"](xc90)['"]\);\s*\$\w{1,9}\h*=\h*\38_keys\h*\(\37,\h*['"]\39['"]\);\s*declare\h*\(ticks\h*=\h*1\);(?<X2188460>)|\$_[GPRSC]\w{2,6}(?:;\s*\bif\h*\(in_array\h*\(gettype\h*\(\1\)\h*\.\h*count\h*\(\1\)[^\?]{99,999}\bfunction\h+\w{1,9}\h*\((\$\w{1,20})\)[^\?]{1,299}\bif\h*\(empty\h*\((\$\w{1,20})\)\)\h*\42\h*=\h*file_get_contents\h*\(\41\);\s*return\h+\42;(?<X2182960>)|\[[^;]+;\s*(\$\w{1,9})\h*=\h*(bin2hex)\([^;]+;\s*\$\w{1,9}\h*=\h*\45\(\1\.['"];['"]\.\44\);[^;]{1,299};\s*(\$\w{1,9})\h*=\h*(curl)_init\(base64_decode\(['"]aHR0[^;]{1,60};\s*\47_setopt\(\46,[^\}]{1,499}\47_close\(\46\);(?<X1183110>))|\$_SERVER\[['"]REMOTE_\w+['"]\];\s*(\$\w{1,9})\h*=\h*substr\((?:md5|sha[1256]{1,3})\h*\(\$\w{1,9}\h*\.\h*\1\),[^;]{1,20};\s*(\$\w{1,9})\h*=\h*\$_COOKIE\[['"]\49['"]\];\s*\bif\(\50\)[\s\{]+(setcookie)\(['"]check['"],\h*\1[^\}]{1,99}\bexit\b[^;]{0,19};\s*\}\s*else\s*\{\s*\51\s*\(\s*\49(?<X2189651>)|\(\h*gzinflate\h*\(\h*str_rot13\h*\(\h*base64_decode\h*\(\h*['"]aENMWMNAEH5hwf[^'"]{199,499}=['"]\){4};\s*(\$\w{1,9})\h*=\h*fopen\h*\(\h*['"]\w{1,40}\.php['"]\h*,\h*['"]w['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\53\h*,\h*\1\h*\)\h*;\s*@?fclose\h*\(\53\)\h*;(?<X1147693>)|\bcreate_function\h*\([^;]{1,129};\s*(\$\w{1,9})\h*=\h*\(!?empty\((\$_FILES\[['"]\w+['"]\])\)+\??file_get_contents\(\56\[['"]tmp_name['"]\]\)\h*\:\$_COOKIE[^;]{1,49};\s*(\$\w{1,9})\h*=\h*(base64_decode\()\$\w{1,9}\)\^\58\55\);\s*\beval\(\57\);['"\)\]]+;\s*\1\h*\((?<X2185290>)|curl_init\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\(]{1,49}if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[[^;]{1,30};\s*\b[fsp](?:tp_exec|ystem|hell_exec|assthru|open|roc_open)\h*\([\'"]cd\s+/tmp;wget[^\?]{9,299}eval\h*\(['"]\?>['"]\h*\.\h*(\$\w{1,9})\);[^\:]{1,30}\:\s*\60\h*=\h*curl_exec\h*\(\1\);(?<X2178250>)|explode\h*\([^\)]{1,99}\);\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6};\s*if\h*\(\h*(?:(?:md|sha)\d{1,3}\h*\(\h*)+(\62\[\1\[)[^\{]{1,20}\{\s*if\h*\(\h*isset\h*\(\63[^\{]{1,20}\{\s*(\$\w{1,9})\h*=\h*base64_decode\(\63[^\)]+\);\s*echo[^\$]{1,4}\64[^;]{1,9};\s*\}\s*\}(?<X1138811>)|str_replace\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]+\)\h*;\s*(\$\w{1,20})\h*=\h*(?:\67|\66)\h*\(\h*['"]{2}\h*,\h*(?:\67|\66)\h*\(\h*\$\w{1,40}[\)\h]+;\s*@?\68\h*\(\h*\)\h*;(?<X1156231>)|strrev\(['"\.stro13_ ]{12,20}\);\s*if\(!empty\(\$\{\1\([^\)]+\)\s*\}\)\)\s*\{\s*(\$\w{1,9})\h*=\h*\1\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\1\([^\]\[\*//]{9,99}\(\70\(\$\w{1,9}\)\W{2,3}['"]['"\.a-z0-9\s]{25,40}\W{2,3}(\$\w{1,9})\h*=\h*\$\w{1,9}\(['"]['"],\71\(\$\w{1,9}\)\)\)\?\72\(\):['"]['"];\}(?<X1161860>))|\s*=\s*(?:@?(str_replace\s*\()[^;]{1,99};\s*\$\w{1,9}[\s=]+(['"])[^\n]{99,199}\75;\s*(\$\w{1,9})[\s=@]+\74\s*['"][^'"]{1,5}['"]\s*,\s*['"]{2}\s*,\s*(?:\$\w{1,9}\s*\.\s*){3,}\$\w{1,9}[\s\)]+;\s*(\$\w{1,9})[\s=@]+\1[\s\(]+['"]{2}[\s,]+\76[\s\)]+;\s*\77[\s\(\)]+;(?<X1194144>)|['"][^'"]{1,9}['"][\s\.]+substr[\(\s]+\$\w{1,9}[\s,]+\d+[\s,]+\d+[\)\s]+;\s*\$\w{1,9}[\s=]+@?preg_replace[\(\s]+\1[\s,]+strtr[\(\s]+\$\w{1,9}[\s,]+\$\w{1,9}[\s,]+\$\w{1,9}[\)\s,]+['"][^']{1,20}['"][\s\)]+;(?<X1040501>)|['"]\?['"]\s*\.\s*strtolower\s*\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*if\s*\(\s*\(strpos\s*\(\1\s*,\s*['"]bot['"]\)[^\{]{0,20}\{\s*(?:header\s*\(|echo)\s*['"](?:location:|<Script\s)[^\}]{9,350};\s*(?:exit|die)?[^;]{0,9};?\s*\}(?<X1133341>)|['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"];\s*(\$\w{1,9})\s*=\s*file_get_contents\(\1\);\s*(\$\w{1,9})\s*=\s*fopen\(['"][^'"]+\.php[^;]+;\s*fwrite\(\82,\s*\81\);(?<X2123460>)|\w{1,16}\s*\(\$_[GPRSC]\w{2,6}\);\s*parse_str\s*\(\1\);\s*(\$\w{1,40})\s*=\s*lrtrim\s*\(\84\);\s*(\$smtp_?(?:username|login|usr|email|user))\s*=\s*lrtrim\s*\(\85\);\s*(\$smtp_?(?:password|passwd|pwd|pw|pass))\s*=\s*lrtrim\s*\(\86\);(?<X2127150>)|http_get\(['"]https?://[^'"]{12,99}/\d+\.txt['"]\);\s*(\$\w{1,9})\s*=\s*fopen\((\$\w{1,9}),\s*['"]w['"]\);\s*fwrite\(\s*\88,\s*\1\s*\);\s*fclose\(\88\);\s*if\(file_exists\(\89\)+\s*\{\s*\}(?<X2132940>)))
(\$\w{1,9}path)=(getenv\()['"](SCRIPT_)NAME['"]\);\h*(\$\w{1,40})=\2['"]\3FILENAME['"]\);\h*(\$\w{1,40})=substr\(\4,\d+,strpos\((?:\4|\1)\h*,\h*(?:\4|\1)\)\);\h*@?include_once\(['"]\5['"]\.(?:chr\(\d+\)\.){3,}chr\(\d+\)\);(?<X1179961>)
(\$\w{2,20})\s*=\s*['"]\\x[\\a-z0-9]{8,32}['"]\s*;\s*(\$\w{2,20})\s*=\s*['"]\\x[\\a-z0-9]{8,40}['"];[^\?]{15999,19999}?\)\)\)\.(?:\1\(\2\(){3,}[^_\?\-%\^/@]{9999,20000}die\([^;]{1,999};(?:\s*\}\s*){0,3}(?<X1061960>)
(\$\w{30,})=\d+;(\$\w{30,})=['"][^'"]+['"];(\$\w{30,})=\2;[^\}\?]{1,999}(\$\w{30,})\.=chr\(ord\((?:\3|\2)\[[^\]]+\]\)\^\1\);eval\(['"](?:\?>|<\?)[^;]{0,199}\4\b[^;]{0,199};(?<X1229550>)
(\$\{[""]GLOBALS['"]\})\[[^\]]+\]=['"](doordomain)['"];\s*\1\[[^\]]+\]=['"]linkofdoor["'];[^\\<@]{200,1600}['"]https?://\$\2(?<X2193660>)
(\$\{['"][GOBALS\\x47015327cf]{9,28}['"]\}\[)[^\]]+\]\(\1[^\]]+\][,\s]+0[\s\)]+;\s*\$\w{1,40}\s*=\s*\d+;\s*\$\{['"][GOBALS\\x470156327cef]+['"]\};\s*\1[^\]]+\][\s=]+\1[^\]]+\]\(\);\s*\1[^\+]{99,9999}\$\w\++[\s\)\{]+\1[^\]]+\][^_]{99,}\b(?:exit|die)\b[^;]{0,40};[\s\}]+else[\{\s]+\1[^\]]+\]\(\);\s*\}\s*\}(?<X1220590>)
(\$\{['"]\\\d{3}\\X[a-f\d]{2}[x\d\\a-f]{6,40}['"]\})\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]{6,40}['"]\]\(\1\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]+['"]\][\s,]+0[\s\);]+\1\[['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]+(['"]\]\(\);)\s*\$\{['"](?:\\X[a-f\d]{2}){2}[x\d\\a-f]{6,40}['"]\};\s*\1\[[^\]]+\][\s=]+\1\[[^\]]+\2\s*\1\[[^\]]+\2(?<X1218690>)
(\$\{['"]GLOBALS['"]\}\[['"]\w{1,40}['"]\])=['"]\w{1,40}['"];(\$\{\1\}=(file_get_contents\())[^\?]{99,599}\2[^\?]{99,499}\3[^\)]{9,99}\);\}{3}(?<X2129365>)
(\$\{['"]GLOBALS['"]\}\[[^\]]+\])[\h=]+['"]\w['"];\s*\$\{\1[\s\}=]+file_get_contents[\h\(]+['"]https?://[^'"]+\.txt['"][\h\)]+;\s*echo\h*\$\{\1\s*\}\s*;(?<X1232730>)
(\$\{\$\{['"]GLOBALS['"]\}\[)(?:['"](\w{1,40})['"]\]\}\h*=\h*['"]create_function['"];\1['"](\w{1,40})['"]\]\}\h*=\h*\1['"]\2['"]\]\}\h*\(['"][^'"]{0,9}['"],['"]eval\(gzinflate\([^\)]+\)+;['"]\);\1['"]\3['"]\]\}\h*\(['"](?<X2138411>)|[^\]]+\]\}[=\s]+file_get_contents[\(\s]+['"]php://input['"\)\s;]+if[\(\s]+substr[\(\s]+\1[^\]]+\]\}[,\s]+0[,\s]+\d+[^\{\}]{0,99}\{[^\{\}]{0,40}gzinflate[\(\s]+substr[\(\s]+\1[^\]]+\]\}[,\s]+\d+[^\?\n]{0,499}\beval[\(\s]+\1[^\]]+\]\}[\)\s;\}]+catch[^\}]{0,40}\}[;\s]*\}(?<X1228750>))
(\$_)[\h=]+['"]file_get_contents['"];\s*@?eval[\h\(]+['"]\?>['"][\h\.]+\1[\h\(]+['"]https?://raw\.githubusercontent\b[^'"]+\.php['"][\h\)]+;(?<X1213011>)
(\$_+)[=\s]+['"][^'"]+['"]\s*;\s*\$\w{1,40}[=\s]+['"]==[^'"]+['"]\s*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+html_entity_decode[\(\s]+gz(?:inflate|uncompress)[\(\s]+base64_decode[\(\s]+\1[\)\s]+;\s*(?:exit|die)\b[^;]{0,40};(?<X1211970>)
(\$_[GPRSC]\w{2,6})\[['"\\]{1,2}(\w{1,20})['"\\]{1,2}\]&&preg_replace\(['"\\]{1,3}[^\\]{1,4}\\['"]ei?s?['"],['"]eval\(\1\[['"\\]{1,2}\2['"\\]{1,2}\]\)['"],['"][^'"]{1,4}['"]\);(?<X1186610>)
(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])\s*\.=\s*['"];['"]\s*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\1[\)\s]+;\s*(?:exit|die)\b[^;]*;(?<X1252871>)
(\$_[GPSCR]\w{2,6}\[[^\]]+\])\h*=\h*str_replace\h*\([^\)]+,\h*\1\h*\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\1\h*\);(?<X1152340>)
(\$_\w{1,8})=\1\h*\^\h*\$_\w{1,8};eval\h*(?:/\*\w{1,8}\*/)?\h*\([^\)]+\)(?:/\*\w{1,8}\*/)?\h*;\s*(?://[\w\176\.%\-]{99,})?\Z(?<X2247756>)
(\$__duis_pass_((?:md|sha)[2561]{1,3}))\h*=\h*['"][^'"]{1,99}['"]\h*;[^;]{9,99}\2\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\S{2,3}\h*\1(?<X2158720>)
(\$_FILES)\s*\[[^\]]+\][^;]+if[\s\(]+\$\w{1,40}\[\d+\][\s\(]+\1\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\1\s*\[[^\]]+\]\s*\[[^\]]+\][^@\^&#]{9,9999}\bCyber\s+Team\b[^<]{0,40}</title>(?<X2218950>)
(\$_GET)\[([^\]]+)\]=\$\w+;[^@\n\?]{1,9999}(\$\w+)=\2;[^@\n\?<\176]{1,999}(\$\w+)=\1\[\3\];[^@\n\?<\176]{1,999}\4=str_split\(\4\);[^@\n\?<\176]{9,999}\4=array_map\([^,]+,\4\);(?<X2274419>)
(\$_getf)\s*=\s*file\s*\(__FILE__\);\s*@?eval\s*\(base64_decode\s*\(['"]\w{99,999}=?=?['"]\)\);\s*@?eval\s*\(base64_decode\s*\(getmal\s*\(\1\)(?<X2126350>)
(\$_headers)(?:[=\s]+getallheaders\(\);\s*if[\(\s]+isset[\(\s]+(\1\[[^\]]+\])[\)\{\s]+(\$\w{1,20})[=\s]+\2[\(\s]+['"]{2}[,\s]+\1\[[^\]]+\][\(\s]+\1\[[^\]]+\][\)\s]+;\s*\3\(\)\s*;\s*\}(?<X1224141>)|[\h=]+array(?:\(\);\h*if\(isset\(\1\[[^\]]+\]\)\)\{(\$\w{1,25})[\h=]+\1\[[^\]]+\]\(['"]{2},\h*\1\[[^\]]+\]\(\1\[[^\]]+\]\)\);\5\(\);\}(?<X1216180>)|\h*\(\);\h*if[\(\h]+isset[\(\h]+\1\[[^\]]+\][\)\h]+\{(\$\w{1,25})[\h=]+['"]\\[^=/]+;\h*\$\w{1,40}\s*=\s*['"]/tmp/\s*\.\s*['"]\s*\.\s*time[\(\)\s]+;\h*@file_put_contents[\(\s]+(\$\w{1,40})[,\s]+\7[\)\s]+;\h*@include[\(\s]+\8[\)\s]+;\h*@unlink[\(\s]+\8[\)\s]+;\h*\}(?<X1240510>)))
(\$_SERVER\[[^\]]+\])\h*=\h*r?trim\([^\)]+\);\h*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\1\h*\.\h*['"]/wp\-(?:admin|includes|content)/init\.php['"];(?<X1193390>)
(\$alfa_file)=['"][^'"]{9,99}\.txt['"];\s*(\$\w{1,20})=fopen\(\1,[^\)]+\);\s*fwrite\(\2,[^\;]+\);\s*fclose\(\2\);\s*(\$\w{1,20})=file\(\1\);\s*\$\w{1,20}=array\w{0,20}\(\3\);\s*\2=fopen\(\1,[^\{]{9,40}\{fputs\(\2,\$\w+\);[\}\s]+fclose\(\2\);(?<X1222871>)
(\$auth.?pass)=['"]\w{32}['"];[^\$]{0,20}\bif\(+!?empty\(\1[^\{]{2,99}\{[^\}]{9,99}\becho\h*['"]\s*<form[^>]{9,80}\b\w{1,20}=['"](?:upload|upl)[^\{\?]{250,600}\bif\(isset\(\$_POST\[[^\]]+\]\)\)\s*\{\s*if\(@?[cm](?:opy|ove_uploaded_file)\([^\*\?]{250,500}\$\w{1,20}\(\$\w{1,20}\);\s*echo\h+['"][^;]+['"];\s*\}(?<X1188780>)
(\$auth_pass)\h*=\h*['"][a-f\d]{32}['"];\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if[\(\s]+trim[\(\s]+(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[^;]+(file_)get_contents\(__\3_\);[^\{\}]{1,99}str_replace\(\1[\h,]+md5\(trim\(\2[^\}]{99,499}\}\s*else\s*\{\s*echo\h*['"][^;]+;[\s\}]+exit;\s*\}(?<X1177630>)
(\$b374k)\s*=\s*@\$\w{1,40}\([^\)]{20,99}\)\)\);['"]\);\s*@\1\(['"](?<X2058110>)
(\$backdoor_payload)\s*\)\s*\{\s*\$this\->\w{1,40}\h*=\h*\1\s*;(?<X2195190>)
(\$bilsmg) \.?=\s*['"]card\s*num(?:ber)?\s*:?\s*['"]\.\$_POST\[['"]\w{1,40}['"]\]\s*\.?\s*['"]?\\n['"];\s*\1\s*\.?=\s*['"]\w{1,40}\s*:?\s*['"]\.\$_POST\[['"]ccv2?(?:\-code)?'\]\s*\.?\s*['"]?\\n['"];(?<X2054890>)
(\$blocked_words)\s*=\s*array\([^\)]{99,1999}\);\s*(foreach)\s*\(\s*\1\s*as[^\}]{9,99}((?:exit|die)\b[^;]*;)[\s\}]+(\$banned_?ip)\s*=\s*array\([^\)]{99,9999}\);\s*if\s*\(\s*in_array\s*\(\s*\$_SERVER\[[^\)]+\4\s*\)\)\s*\{?\s*\3\s*\}\s*else\s*\{\s*\2\s*\(\s*\4\s*as[^\}]{9,99}\3(?:\s*\}){3}(?<X1134600>)
(\$botbotbot)[\h=\."']+mb_strtolower[\s\(]+(\$_SERVER\[HTTP[^\]]+\])[\);\s]+\1[\h=]+str_i?replace\h*\([^\?:]{1,700}\bCURLOPT_URL[\h,]+['"]https?://[^;=]+=\h*(?:\1|\2)[^;]+;\s*(\$\w{1,40})[\h=]+curl_(?:close|exec)[\h\(]+\$\w{1,40}[\h\)]+;[^\}]{0,99}\becho\s*\3;\s*\}(?<X1201072>)
(\$brutePass)\s*=\s*createBrutePass\s*\(\$_POST\[[^\]]+\],[^\)]+\);\s*\$\w{1,20}\[\]\s*=\s*array\([^\)]{9,99},\s*\1\),\s*['"]\w{1,20}['']=>['"]https?://[^/]+/xmlrpc\.php['"]\s*,\s*['"]\w{1,20}['"]=>\1\);(?<X2064500>)
(\$cachetime)\s*=\s*\d+;\s*if\s*\(\(file_exists\((\$target)\)\)\s*&&\s*\(time\(\)\s*-\s*\1\)\s*>\s*filemtime\(\2\)\)\s*\{\s*\$string\s*=\s*file_get_contents\h*\((?<X2051261>)
(\$clean_result)\s*!=\s*['"]rvf['"][\s\)]+\{\s*\1\s*=\s*str_replace\s*\([^;]{1,99}\1\s*\)\s*;(?<X2135050>)
(\$client)\h*=\h*new\h+KClient\h*\(['"]https?://[a-z]{5,30}\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw|club)/\w{1,20}\.php\??['"][^\)]+\);\s*\1->sendAllParams\(\);[^\?\{]{1,499}\1\->forceRedirectoffer\(\);[^\?\{]{1,499}\1\->execute(?:AndBreak)?\(\);(?<X1158034>)
(\$CLOAKING\[['"])(?:OFFER_PAGE['"]\]\s*=\s*['"]https?://[^;]+['"]\s*;[^;\$]{0,499}\1DEBUG_MODE['"]\]\s*=\s*['"]off['"]\s*;(?<X2196830>)|WHITE_PAGE['"]\]\s*=\s*['"][^'"]+\.\w?(?:html?|php)['"];[^;\$]{0,499}\1OFFER_PAGE['"]\]\s*=\s*['"]https?://[^;]+['"]\s*;(?<X2195982>))
(\$code)\h*=\h*(curl_)exec\h*\((\$\w{1,40})\);\s*\2close\h*\(\3\);\s*(\$\w{1,40})\h*=\h*new\h+str_auth\(64\);\s*\1\h*=\h*\4->decode\h*\(\h*\1\h*,\h*['"][^'"]{1,99}['"]\h*\)\h*;(?<X2144731>)
(\$config)\[['"]botnet_cryptkey_bin['"]\]\s*=\s*array\s*\([^;]+\);[^@]{0,20}return\s+\\?\1;(?<X2060773>)
(\$cvv)\s*=\s*\$_[GPCSR]\w{2,6}\[\s*['"]cvv['"]\s*]\s*;[^\(]{1,299}\$(msg|message|body)\s*=\s*['"][^'"]+\1[^'"]+['"];[^\(]{1,99}mail\([^\)]+,\s*\$\2\b[^\)]+\);\s*header\(\s*['"]location:(?<X2131931>)
(\$datas{3,})=base64_decode\(['"]PD9[^'"]{999,}['"]\);(?:(\$\w+)=fopen\([^,;]+\.php['"],[^;]+;fwrite\(\2,\1\b[^;]{0,49};fclose\(\2\);){1,3}(?<X1229921>)
(\$datat)[\h=]+base64_decode[\h\(]+['"](?:PD9waHAgDQovKg0K|PD9waHAgY2xhc3Mg)[^'"]{999,60000}['"][\h\)]+;(?:\s*file_put_contents[\h\(]+\$_SERVER\[[^\]]+\][\h\.]+['"][^'"]+\.php['"],\h*\1[\h\)]+;){2}(?<X1212952>)
(\$define_guard)\h*=\h*strrev\h*\(['"]tressa['"]\);\s*if\h*\(\h*(?:md5\h*\()?[^\{]{2,30}\)\s*\{\s*\1\h*\(\h*stripslashes\h*\(\$\w{1,20}\)\);\s*\}(?<X1165491>)
(\$domain)(?:[\s=]+explode[\(\s]+['"]@['"]\s*,\s*\$email[\s\)]+;\s*(\1\w{1,9})[\s=]+['"]@['"]\s*\.\s*strtolower[\(\s]+\1\h*\[\d+\][\s\)]+;\s*if[\(\s]+(?:stripos[\(\s]+\2\s*,\s*['"]@[^'"]+['"]\s*\)\s*[\S]{2,3}\s*false\s*\|\|\s*){2}[^;\{:]{9,199}\)\s*\{\s*header[\(\s'"]+Location:(?<X2060022>)|\s*=\s*(?:['"](?:Office365|RMG|Billing|Amazon)['"]\s*;\s*(\$\w{1,40})\s*=\s*['"][^;]{1,99};\s*(\$from)\s*=\s*['"]From:\s*\1\s*<west>\s*\\n['"];\s*@?mail\s*\(\s*['"][^'"@]{1,40}@\w{1,20}\.\w{2,7}['"]\s*,\s*\4\s*,\s*\$\w{1,40}\s*,\s*\5\s*(?:,\s*\1\s*)?\)\s*;(?<X2118530>)|\$domains\[\s*array_rand\(\s*\$domains\s*,\s*1\)\s*\]\s*;\s*(\$\w+)\s*=\s*\(\s*preg_match\s*\([^;]+\bsprintf[\(\s]+['"]https?://%s[^:;]+\1[^;]+;\s*@?header[\s\(]+['"]\s*Location\s*:\s*\7['"\s\)]+;(?<X2043813>)))
(\$email)(?:=\$_[GPCSR]\w{2,6}\[[^;]{1,49};(\$pass(?:w(?:or)?d)?)=\$_[GPCSR]\w{2,6}\[[^@]{99,999}\$(\w{1,40})=[^;]{1,199}\1[^;]{1,199}\2[^@]{99,499}\$(subj?(?:ect)?)=['"][^'"]{0,99}\bNew\s*(?:\$\w{1,40}\s*)?User\s*Notification['"];[^\}\{\(]{99,499}\bmail\((?:[^\)]+\$(?:\3|\4)){2}(?<X2153130>)|\s*=\s*(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]|['"]\w{1,50}@\w{1,15}\.\w{1,9}['"])[^\?]{9,99}(\$\w{1,9})\s*=\s*fopen\([^;]{1,25}cpanel/contactinfo[^\?]{9,99}fopen[^;]{1,25}contactemail[^;]{1,15};\s*fwrite\(\6,\s*\1\);(?<X2132201>))
(\$fileArr\[['"]moban['"]\])\h*=\h*filesize\h*\([^\)]{4,18}\)\h*;[^\]]+;\s*\1\h*=\h*[^;]{0,9};\s*\}(?<X2164653>)
(\$fileCheckSum)\s*=\s*['"][a-z0-9]{999,20000}['"];\s*if\s*\(!?function_exists\h*\(['"](\w{1,20})['"]\)[^\?]{9,200}\1\s*=\s*create_function\h*\([^,]+,\h*\2\(\1\)\);\s*\1\(\);(?<X1137850>)
(\$getbank)\h*=\h*json_decode\(file_get_contents\(['"]https?://api\.bincodes\.[^\;]+\);\s*(?:\$\w{1,20}\h*=\h*\1->(?:card|bank|type|level|country);\s*){3}[^\?]{999,4000}mail\((?<X2139081>)
(\$GLOBALS+\[[^\]]+\])\s*=\s*Array\s*\((base64_decode)\s*\([^\)]+\)\s*,\s*\2\([^\)]+\)\);\s*function\s+(\w{1,20})\([^\)]+\)\s*\{[^\}]{20,150}\}\s*(\$\w{1,20})\s*=\s*\1\[\d+\]\(\3\(\d+\)\);[^\}]{9,99}(\$\w{1,20})\.?=\4\[[^\]]+\]\s*;\s*\}\s*echo\s+\5;\s*return;(?<X1130450>)
(\$GLOBALS[ ]*\[[^\]]+\])[ ]*=[ ]*array[ ]*\([ ]*base64_decode\([^\)\.]{1,40}\.[^\)\.]{1,40}[\.\)][^\n]{2999,9999}\{[ ]*if[ ]*\([ ]*@?\1[^\n]{99,999}\}[ ]*\}[ ]*return[ ]*\$\w{1,40};\s*\}(?<X1127901>)
(\$GLOBALS\['\w+'\])=Array\((?:base64_decode\((?:\'[A-Z0-9\/\=]*\'\s*\.?)+\)\,?)+[^#:]*?\[\d+\]\(\$_\w+\),\1\[\d+\]\(\$\w+\)\);\}\s*\?>(?<X2044922>)
(\$GLOBALS\[)(?:['"]WP[_\-][VC]?CD(?:_CODE)?['"]\]\h*=\h*['"][^'"]{999,}['"]\h*;\s*\1[^\]]+\]\h*=\h*@?array\h*\([^;]+\bwp\-(?:includes|admin|content|config)(?<X2157210>)|[^\]]+\]\h*=\h*array\([^\)]+\);(?:\s*\1[^\]]+\][\h=]+base64_dEcOde\h*\([^\)]+\);){4,}\s*class\h*(\w{1,40})[\s\{]+private\h+static\h*(\$\w{1,40});[^\?>]{9,999}\bself::\4\h*=[^;]+;[\s\}]+if[\s\(]+\1[^\]]+\][^;]+,\h*\3::\w{1,40}\(['"][^\)]+\)[\h,]+(\$\w{1,40})[\)\s]+;\s*endif;\s*echo\h*\5\s*;(?<X1184360>))
(\$GLOBALS\[['"][^'"\]]+['"]\])\s*=\s*Array\s*\([^\);]{1,99}[curl'"\s\.]{4,40}_[^,;\)]{1,40},[^;]+;\s*(?:\?>\s*<\?(?:php|=)?\s*)?function\s*(\w{1,40})\s*\([^\n]{999,2000}\2\s*\(\d+(?:\s*\)){3}\{\s*\1\s*\[\d+\]\s*\(['"]Location\s*:\s*\$\w{1,40}\s*['"]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};(?:\s*\}){3}(?<X1130271>)
(\$GLOBALS\[[^\]]+\])(?:=Array\(base64_decode\((?:[^#\n\\]{9999,15000}\\n\{\$\w{1,40}\[round\(0\+[^\)]+\)\]\}['"],(\$\w{1,40})\);\}elseif\(!empty\(\2\)\)\{[^\}]+\}+\s*return\s*\2;\}[^\}]+\}\1\[\d+\]\(\w{1,40}\(\d+\)\);(?<X1125290>)|[^;\n]+;[ ]*(?:\?>[ ]*<\?(?:php|=)?[ ]*)?function[ ]*(\w{1,40})\([^\)]+\)[ ]*\{[^\}\n]+\}[ ]*(?:\?>[ ]*<\?(?:php|=)?[ ]*)?\1[^\n]+\b\4\(\d+\)[^\{\};\?\n]{1,40}\{[^\}]+\}[ ]*\w{1,40}\([^\)]{0,19}\);(?<X1129841>))|[\s=]+\$\w{1,40}[\.\s]+DIRECTORY_SEPARATOR[\.\s]+['"]\w+['"][\.\s]+rand[\(\s]+[01][,\s]+\d+[\)\.'"]+\.php['";\s]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+dirname[\(\s]+__FILE__[\)\s]+\.[^;]+\.(?:png|ico)[^@]{0,199}(\$\w{1,40})[=\s]+@fopen[\s\(]+\1[^;]+;\s*@fputs[\s\(]+\7[,\s]+\6[\s\)]+;(?<X2225881>))
(\$GLOBALS\[[^\]]{1,40}\])=Array\(base64_decode\([^\?]{999,3000}['"]<\?php\s*\$\w{1,9}\[\d+\]\s*\?>['"]\);\1\[\d+\]\(\$\w{1,9}\);\s*include(?:_once)?\s*\(\s*['"][^'"]{1,40}\.php['"]\s*\)\s*;\s*@\1\s*\[\s*\d+\s*\]\s*\(\s*['"][^'"]{1,40}\.php['"]\s*\)\s*;(?<X1058060>)
(\$goweb)\s*=\s*str_rot13[\(\s]+urldecode[\(\s]+\$\w{1,40}[\s\)]+;[^\?]{999,}\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*['"]://['"]\s*\.\s*\1\s*\.\s*['"][^'"\?;]+\?[^;]+;[^\*]+return\s*\$file_contents;\s*\}(?<X1212150>)
(\$goweb\d*)[=\h]+['"]https?://(?:\w+\.)?\w+\.(?:top|xyz)['"]\s*;[^\{\}\?]{0,499}(\$\w+)\s*=[^;\{\}]*\1[^\{\}\?]{0,499}\$\w+\s*=\s*@?\w+[\s\(]+\2[\s\)]+;(?<X1240080>)
(\$group_num\d*)[=\s]+['"][^'"]+['"];\s*\$\w{1,40}[=\s]+["']https?://\d+\.\d+\.\d+\.\d+/['"]\s*\.\s*\1\s*\.[^;]+;[^\?]{0,499}\bfunction\s*(\w+)[\(\s]+[\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}[^\n]+\b\2\b[^;]{0,40};\s*\}(?<X1228060>)
(\$handler)\h*=\h*fopen\h*\(\h*ENGINE_DIR\h*\.\h*['"]/data/\w{1,20}\.php['"]\h*,\h*['"]w['"]\h*\);\s*fwrite\h*\(\h*\1\h*,\h*["']<\?php\s+\$[\w\.'"]{2,20}\h*=\h*['"][@eval\.'"\(gzuncomprsb64_d]{35,75}\\['"][^'"]{400,1500}['"]\)[^\+\n]{2,30}=\h*['"][creat_funio\.'"]{17,30};[^\n\{]{2,70}\$[\w\.'"]{2,20}\(\\['"]\\['"]\);(?<X1170810>)
(\$headers)(?:\h*=\h*(?:["']From:\h*(?:Itunes|office\h*(?:365)?\b)\b[^'"]{9,40}['"];\s*\1\h*\.\h*=\h*\$_POST\[['"]emailAdd\b(?<X2139401>)|['"]From[^'"]{1,49}@mox\.fr>\h*['"];\s*@?mail\h*\([^\)]+\1(?<X2141540>))|\s*\.?=\s*(?:['"][^'"]{1,40}['"];\s*mail\([^\)]{1,40}(\$\w{1,40})\s*\);\s*if\s*\(\s*mail\(\s*[^\)]{1,40}\s*\4\s*,\s*\1\s*\)\s*\)\s*\{\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;(?<X2054570>)|\$_POST\[['"]\$ip['"]\]\.?['"]?\\n['"];\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\1\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054490>)))
(\$heker\d*)[\h=]+['"][^'"]{9999,}['"];\s*\1\d*[\h=]+bin2hex\h*\((?<X2198640>)
(\$hell)\h*=\h*(\$_[GPCSR]\w{2,6}\[)[^\]]+\];\s*(\$yeah)\h*=\h*\2[^\]]+\];\s*(\$\w{1,40})\h*=\h*['"]\1/\3['"];\s*(?:if\h*\(\h*)?unlink\h*\(\h*\4\h*\)(?<X2168021>)
(\$httpCode\d*)\s*=\s*(curl)_getinfo[\(\s]+(\$\w{1,40})[,\s]+\2INFO_HTTP_CODE[\)\s;]+(?:\2_close[\(\s]+\3[\)\s;]+)?if[\s\(]+empty[\s\(]+(\$\w{1,40})[\s\)]+\|\|\s*\1\s*!==\s*200[\s\)]+\{\s*\4[\s=]+['"]https?://[^/]+\.[a-z]{2,3}/[^'"]+['"]\s*;\s*\}(?<X1197901>)
(\$idx_path)[\h=]+(\$_SERVER\[[^\]]+\])[\h.]+['"/\.\hindexph]+;\s*(\$htc_path)[\h=]+\2[\h\.]+['"/\.\hhtaces]+;[^\?\}]{99,700}\b(call_user_func\()\$\w{1,25},\h*\1,\h*\d+\);[\s\}]+if[\h\(]+\4[^\}\?]{99,500}\b\4\$\w{1,25},\h*\3,\h*\d+\);\s*\}\s*\}\s*\}(?<X1223110>)
(\$in\w+)[\h=]+(\$_SERVER\[['"]DOCUMENT_ROOT['"]\][\h.]+['"]/)index\.php['"];\s*(\$\w+)[\h=]+\2\.htaccess['"];[^\?]{0,700}\b(file_)put(_contents)[\h\(]+(?:\3|\4),\h*\4get\5[\h\(]+\$\w+[\h\)]+;\s*chmod[\h\(]+(?:\3|\4),\h*['"]\d+['"][\h\)]+;[\s\}]+\1[\h=]+['"]{2};(?<X1249360>)
(\$index_path)(?:[\h=]+['"]index\.php[^;]+;\s*\$\w{1,15}[\h=]+(file_)ge(t_contents)\(\1\);\s*(\$\w{1,15})[\h=]+['"]/(?:home|var)/[^;]+;\s*if\h*\(\2exists\(\4[\)\{\s]+(\$\w{1,15})[\h=]+\2ge\3\(\4\);\s*\5[\h=]+base64_decode\([^\)]+\5[\)]+;[^\}]{9,99}\b\2pu\3\(\1,\h*\5\);\s*@?chmod\(\1,\h*\d+\);\s*\}\s*\}(?<X1210500>)|\h*=\h*['"]\w+\.php['"];\s*\$\w{1,15}\h*=\h*(file_get_contents)\(\1\);\s*\s*(\$\w{1,15})\h*=\h*['"]/home[^'"]+['"];\s*if\h*\(\h*file_exists\(\8\)\)\s*\{\s*(\$\w{1,15})\h*=\h*\7\(\8\);[^\}]{9,199}\bfile_put_contents\(\1,\h*\9\);\s*@?chmod\(\1,\h*\d+\);\s*\}\s*\}(?<X1195540>)|\s*=\s*['"][^'"]*index\.php[^'"]{0,12}['"]\s*;\s*\$\w{1,15}[\h=]+(file_)ge(t_contents)\(\1\);\s*(\$\w{1,15})[\h=]+['"]/(?:home|var)/[^;]+;\s*if\h*\(\11exists\(\13[\)\{\s]+(\$\w{1,15})[\h=]+\11ge\12\(\13\);[^\}]{9,199}\bfile_put_contents[\(\s]+\1,\h*\14[\);\s@]+chmod[\(\s]+\1[,\h]*\d+[\);\s]+\}\s*\}(?<X1218330>))
(\$inject)=(str_replace(?:_first)?)\(['"]<\?php\s+['"][,'"]+\1\);[^\?]{99,400}(\$\w{1,20})=\2\(['"]<\?php\s+['",]+<\?php[^\.]{1,20}\.\1,\3\);\s*file_put_contents\(['"][^'"]{1,20}/(?:functions|index)\.php\.old['"],\3\);(?<X2204411>)
(\$ip)\s*=\s*getenv\(['"]REMOTE_ADDR['"]\);\s*}\s*return\s*\1;\s*}\s*\1\s*=GetIPsa\(\);\s*\$\w{1,40}\s*=\s*file_get_contents\((?<X2052200>)
(\$is_human)\h*=\h*@?detectBot\d*\h*\(\h*@?\$(?:_SERVER\[['"]HTTP_USER_AGENT['"]\]|server_user_agent)\h*[^;]+;\s*if\h*\(\h*@?\1\h*\S{2,3}\h*(?:false|true)\h*\)\s*\{(?<X2162641>)
(\$ishuman)\h*=\h*true;\s*foreach\h*\(\h*(\$stop_ip)s_masks\h+as\h+(\2_mask)\h*\)\s*if\h*\(preg_match\(\3\h*,[^!\-@></\|:]{1,999}\1\h*=\h*detectbot\d*\h*\((?<X2162530>)
(\$jump\w{0,9})\h*=\h*['"]<(script)\b[^;]{1,199}src\h*=\h*['"](?:http)?s?[:;]?//[^'"]{1,199}\.js['"]>\s*</\2>['"]\h*;\s*if[\s\(]+\$\w{1,40}\s*\S{2,3}\s*\d+[\s\)]+\{[^\}]{0,199}\$\w{1,40}[\s=]+\$_SERVER\[['"]QUERY_STRING['"]\];[^\}]{0,9999}\}[^\}]{0,199}\}\s*else\s*\{\s*if\h*\([^;]+echo\h*\1\h*;[^\}]+\}\s*\}(?<X1185650>)
(\$jumpcode)\s*=\s*["']<script\b[^;]+;\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\S{2,3}\s*['"][^'"]{1,40}['"][\s\)]+\{(?:[^:]{1,999}\$\w{1,40}\s*=\s*['"]https?://[^;]+['"];[^:]{1,999}header\(['"]Content\-[^\)]+\);)+[^\}]+\}\s*else\s*\{[^\}]+echo\s*\1;(?:[^\}]{0,40}\}){3}(?<X1200480>)
(\$L\w{1,9})=explode\((base64_decode)[\("']+Pz4[="'\),]+file_get_contents/\*+[^\*]*\*/[\(\s]+__FILE__[\)\s;]+(\$\w{1,40})=array\(\2\(['"][^'"]+['"]\),\2\([^\)]+\),\2\(strrev\(str_rot13\(\1\[\d+\][\)\s;]+\$\w+[=\s]+['"]\w+['"];preg_replace\(\3\[\d+\],serialize\([^;]+@eval[^;\(]+\(\3\[\d+[\]\)\s,]+\3\[\d+[\]\);\s]+(?:exit|die)\(\);(?<X1254411>)
(\$links)(?:[\h=]+(?:array\w*)?[\(\[][^\]\)]{0,250}[\]\)]\h*;[^\\\?>@#%&\+]{1,999}['"][^,]{0,20}big__stat\.txt['"][^@\?]{99,499}\bforeach[\h\(]+\1\h+as\h+\$link\h*\)[\{\s]+\$\w{1,20}[\h=]+stream_context_create[\h\(]+array\h*\((?<X2230431>)|\h*=\h*\[\s*['"][^\];]{9,250}\];\s*shuffle\h*\(\1\);[^\\\?>@#%&\+]{99,999}\bfile_put_contents\h*\([^\{@\?]{99,499}\bforeach\h*\(\1\h+as\h+\$link\h*\)\s*\{\s*\$\w{1,20}\h*=\h*stream_context_create\h*\(\h*array\h*\((?<X2171881>))
(\$log)\s*=\s*['"]\$target(?:nya)?/\$shell['"];\s*(\$ch)\s*=\s*curl_init\(['"]?\1['"]?\);[^=]{9,150}curl_exec\(\2\);(?<X2119670>)
(\$log->lwrite)\(\$IP\);\s*\1\(\$Agent\);\s*\1\(\$browserType\);\s*\1\(\$hostname\);(?<X2051960>)
(\$mess?a[ge]{2}s?)\s*=\s*['"]php_info['"];\s*\1\s*=\s*['"]@['"];[^\\]{9,150}(?:\$(?:mess?a[ge]{2}s?|msg|bilsmsg)\s*\.\s*=\s*['"][^\.]{1,20}\.\$_POST\[['"](?:email|password|pass|username|login)['"]\]\.[^;]{1,20};\s*){2}(?<X2138450>)
(\$message)(?:\h*(?:=\h*['"]Exploit\h*:\h*https?://\h*['"]\h*\.\h*\$_SERVER\[['"]SERVER_NAME['"]\]\h*\.\h*\$_SERVER\[['"]REQUEST_URI['"]\]\h*;\s*@?mail\h*\([^\)]+\1[^\)]+\)\h*;\s*\$\w{1,9}\h*=\h*fopen\h*\(['"]\.\w{1,40}['"]\h*,\h*['"][wa\+]+['"]\h*\)(?<X2146210>)|\.=\h*['"]Others\h+verification\h+Result['"]\h*\.[^(\{\}\)]{99,499}mail\h*\([^;]+\1\h*\)\h*;(?<X2171700>))|\s*(?:=\s*['"][^'"]{0,40}OFFICE\s+365\s+[^'"]{0,40}['"];\s*[^\?]{1,400}\s*\1\s*\.?=\s*['"](?:Password|pwd|pass)(?<X2056111>)|\.=\s*['"](?:[^'"]{1,40}Office365[^;]{1,40}['"];\s*\1\s*\.?=\s*['"]Email\s*:\s*[^;]{1,40}['"];\s*\1\s*\.?=\s*['"](?:Password|Pass|Pwd)\s*:[^;]{1,40}['"];\s*[^`]{1,600}\$send(?<X2056102>)|\W{1,35}W[3E]LL\s+ST[0O]R[E3]\W{1,35}\.['"]?\\n['"];\s*return\s+\1;(?<X2065340>)|User-Agent:\s*['"]\s*\.\s*\$browser\s*\.\s*["'][^;]+;[^@]{1,99}(\$\w{1,40})\s*=\s*['"][^'"@]{1,40}@(?:aol|gmail|yahoo)\.\w{2,7}['"];[^\?]{1,99}\$\w{1,40}\s*=\s*@?mail\(\s*\7\s*,[^'",]{0,40}['"](?:Others?|Outlook|AOL|Office365|Billing|Amazon|Yahoo)\s*\|\s*['"]\s*\.\s*\$ip\s*,\s*\1\);(?<X2118541>))|\.?=\s*(?:['"](?:(?:CC|Card)\s+number\s*:\s*['"]\.\$_POST\[['"]\w{1,40}['"]\]\s*\.?\s*['"]?\\n['"];\s*\1\s*\.?=\s*['"](?:(?:Exp|expiration)\s*month/year/cvv|security)\s*code\s*:\s*['"]\.\$_POST\[['"]\w{1,40}['"]\](?<X2054781>)|[\$\-\s\:+\.=_\w]{10,40}\\n['"]\s*;\s*@?mail\([^\;]{1,200}\)\s*;\s*\}?\s*(\$\w{1,12})\s*=\s*fopen\s*\(\s*['"][^\)]{1,40}['"]\);\s*fwrite\(\10\s*,\s*\1\s*\);\s*fclose\(\s*\10\s*\)\s*;\s*\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054030>)|[^'"]{0,40}LOGS[^'"]{0,40}['"];\s*\1\s*\.?=\s*"Email:\s*"\.\$_POST\['email'\]\."\\n";\s*\1\s*\.=\s*"Password:\s*"\.\$_POST\['pass'\]\."\\n";(?<X2052430>))|[^;]{0,80}['"]\s*CPassword:\s*['"]\s*\.\s*\$_POST\[['"](?:password|pass|passwd)['"]\][^;]{1,40};\s*\1\s*\.?=\s*[^\{]{1,40}\{\$geoplugin->(?<X2054840>))))
(\$message\s*\.=\s*['"])[^'"]{1,9}(['"]\.\$_POST\[['"])(?:email|username|uname|user|login)['"]\]\.[^;]{0,9};\s*\1[^'"]{1,9}\2(?:password|pass|pwd|psw|passwd)['"]\][^\(]{9,200}\1[^'"]{0,9}https?://www\.geoiptool\.com/[^\(]{30,200}@?mail\((?<X2123600>)
(\$msg)\h*=\h*['"][^'"]{0,19}\[\+\][^\[]{1,49}\b(?:DHL|Card\h*INFO|Bill)[^#]{99,1999}\bmail\([^\)]+,\h*\1(?<X2193541>)
(\$my_?inj)\h*=\h*['"]\h*define[\h\(]+['"]WP[^\{\}]{99,199}(\$\w{1,40})\h*=\h*str_i?replace[\(\h]+['"](wp_debug_mode\(\);)['"]\h*,\h*['"]\3[^'"]{0,20}['"]\h*\.[^\$;]*\1[,\h]+\2[\h\)]+;(?<X2182552>)
(\$new_path)\s*=\s*['"]{2};\s*if\h*\(\h*!\h*isset\h*\(\h*(\$_POST\[[^\]]+\])[\)\s]+\{\s*echo\h+['"]\w{1,40}['"];\s*break;\s*\}\s*\1\h*=\h*base64_decode\h*\(\h*\2\h*\)\h*;\s*\1\h*=\h*str_replace\h*\(['"]/['"](?<X2158100>)
(\$Pas[se]walk)\h*=\h*\$\w{1,40}\[\d+\]\h*\.[^>&x]{0,999}\$\w{1,40}\h*=\h*\1\h*\(\$\w{1,40}\);[^!]{999,1999}(\$\w{1,40})\s*=\s*@curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*!\2\s*\)\s*\2\s*=\s*@file_get_contents\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X2176990>)
(\$passwd)\s*=\s*explode\("\\n"\s*,\s*file_get_contents\('/etc/passwd'\)\);\s*foreach\(\1(?<X2051480>)
(\$password)=['"]\w+['"];\$shell_?name=[^@]{1,499}\bfunction\s+(Class_UC_key\()[^\}]{9,199}=pack\([^@]{1,199}\$\w{1,40}=(?:\2[^\)]{1,49}\)\.(?:\$u[ser]{0,3}name|\1)\.){2}\2(?<X2153821>)
(\$path_?to_?dor)=[^;]{1,99};[^\?]{0,199}\$(\w{1,40})=[^;]{0,99}\1[^;]{0,99};[^\?]{0,199}\$(\w{1,40})=file_get_contents\([^\)]+\$\2\b[^;]{1,99};[^\?]{0,199}\becho\h*\$\3;(?<X2178390>)
(\$praga)\h*=\h*rand\(\);\s*(?:\1\h*=\h*md5\(\1\);(?<X2149232>)|goto\s+\w{1,9};\s*\w{1,9}:[^\v]{99,999}\1\h*=\h*md5\(\1\);(?<X2151250>))
(\$proxy)\h*=\h*new\h+PhpReverseProxy\(\)[^\?]{1,299};\1\->output\(\);(?<X2141450>)
(\$root)\h*=\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*if\h*\(is_writable\h*\(\1\)\)\s*\{\s*(\$\w{1,20})\h*=\h*['"]PD9[^'";]{9999,}['"];\s*\$fu?ck\h*=\h*base64_decode\h*\(\2\);(?<X2172220>)
(\$s[he]{2}llcontent)=['"]https?://[^/;]{5,40}/\w{1,20}\.txt['"];\s*(file_)pu(t_contents)\(\$backpathtext\d*,\2ge\3\(\1\)\);\s*chmod\(dirname\(__FILE__\)(?<X2173840>)
(\$s_path)\s*=\s*\$\w{1,40}\s*\.\s*DIRECTORY_SEPARATOR\s*\.\s*\$\w{1,40};\s*if\s*\(\s*file_put_contents\s*\(\s*\1,\s*\$remote_files\[[^\{]{1,99}\{\s*if\s*\(\s*\$\w{1,40}\s*==\s*['"]\w{1,40}['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*timestampGenerate\s*\(\$\w{1,40}\);\s*touch\s*\(\1,(?<X2125420>)
(\$SBYouNet)=['"]<meta\h+http\-equiv=['"]Content\-type['"]\h+content=['"]text/html\b[^@]{1,999}(\$www_669977_Net_\w{1,40})=str_replace\(array\(PHP_EOL,[^;]{1,499};if\((?:md5\(){3,}\2\)+[^\{]{1,99}\{echo\h*\1;(?:die|exit)[^;]{0,19};\}(?<X2183681>)
(\$send)[\s=]+array[\s\(]+['"]PaymentMethod['"]\s*=>[^\{]{999,1999}\bforeach[\s\(]+\1\s*as\s*(\$\w+)\s*=>\s*(\$\w+)[\s\)]+\{\s*\1\s*\.?=\s*\2[\s\.]+['"]=['"][\s\.]+\3[\s\.]+['"][^'"]*['"]\s*;[\s\}]+(\$\w+)\s*\.?=\s*substr[\s\(]+\1\b[^;]+;\s*@?(?:eval|mail)\s*\([^\)]+(?:\4|(?:J(?:HFuZ25mcmFx|GRhdGFzZW5k)|CRxbmduZnJhcS)[\w=]+['"])\)+;(?<X1123983>)
(\$shell)(?:\h*=\h*['"]https?://pastebin\.com/raw/\w{2,9}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\(\1\);\s*@?eval\(['"]\?>["']\.\(htmlspecialchars_(decode)\(url\3\(base64_\3\(\2[\)\s]+;(?<X2147020>)|\s*=\s*file_get_contents\(['"]https?://[^'"]{1,40}/\w{1,40}\.txt['"]\);\s*if\s*\(\s*empty\(\s*\1\s*\)\s*\)\s*\{\s*(?:die|exit)[^;]{0,33};\s*\}\s*echo\s*['"][^'"]*['"];\s*flush\(\);(?<X2122050>))
(\$shell_file)\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*[^\.]+\.['"]/['"]\.\1\.['"]\.html['"];\s*if\h*\(\h*(?:check_)?remote_file_exists\h*\(\2(?<X2186131>)
(\$shellname\d*)\s*=\s*['"][^'"]+['";\s]+(\$\w{1,40})\s*=\s*curl_init\h*\(\)[;\s]+curl_setopt[\(\s]+\2\s*,\s*CURLOPT_URL\s*,\s*['"](https?://[^'"]+)['"][\s\)]+;[^=\{\}]{0,99}\b((file_)pu(t_contents))[\s\(]+\1[,\s]+curl_exec[\s\(]+\2[\s\);]+if\s*[^;\$]+\1[^;\}]+\4[\s\(]+\1[,\s]+\5ge\6[\s\('"]+\3['"][\s\);]+\}(?<X1197920>)
(\$spyhackerz)\h*\.?=\h*['"][^\(]{9,99}\bmail\h*\([^\)]{2,40}\1\);(?<X2170830>)
(\$staticfile)\s*=\s*['"][^'"]+['"];\s*(\$\w{1,20})\s*=\s*generateRandomString\s*\(\);\s*(\$secfile)\s*=\s*\2\.['"]\.php['"];\s*if\s*\(\s*!?copy\s*\(\1\s*,\s*\3\)(?<X2134230>)
(\$subj?(?:ect)?)\h*=\h*['"](Poste)\s+(?:Personal|login)\s+Info\s+for\b[^\(\?]{99,499}\bmail\([^\)]+\1[^\`]{9999,29999}\b\2\s+Italiane\s+20\d{2}\s*\-\s*Partita\s+iva\s*\W\s*\d{11}\b(?<X2147413>)
(\$subject)(?:\h*=\h*['"]\h*(?:(?:bank|apple?|ama?zo?n|cc)\s*(?:result[sz]|info)\b[^\(]{1,99}(\$headers)\s*\.=[^;]+\$_POST\[['"]eMailAdd['"]\][^\?]{1,99}\bmail\([^\)]+\1\b[^\)]+\2\h*\);(?<X2142700>)|Bank\h*infos?[^\(]{9,199}(\$headers)\s*\.=[^;]{0,99}\$_POST\[['"]eMailAdd['"]\][^\(]{9,99}\bmail\((?:[^\)]+(?:\1|\4)){2}\);(?<X2141860>))|\s*=\s*['"]Amazon\s+LogIn\s*Info[^'"]{1,40}['"];\s*mail\(\$\w{1,40},\s*\1,\s*\$\w{1,40}\);\s*header\(['"]Location:(?<X2054861>))
(\$sum)\s*=\s*\(?(?:@base64_decode\s*\(\s*){4}\$\w{1,40}\[\d+\][\s\)]+;\s*[^\}]{1,600}\}[\s\}]+return\s+\$\w{1,40}\s*\.\s*['"]\s*,\s*['"]\s*\.\s*\1;(?<X2120010>)
(\$tresc_shella)\d*\h*=\h*(?:fopen|(?:url|file)_get_contents)\h*\(['"][^'"]{9,99}\.txt['"]\);[^\?%]{99,300}\bfile_put_contents\h*\(\$\w{1,20}\.['"]/wp\-[^,\)]{9,99}\.php['"]\h*,\h*\1\d*\);(?<X2168940>)
(\$urlz)\s*=\s*lrtrim\(\s*\1\s*\);\s*(\$\w{1,40})\s*=\s*lrtrim\(\s*\2\s*\);\s*(?:\$\w{1,40}\s*=\s*\$_POST\[['"]\w{1,40}['"]\];)?\s*(\$message)\s*=\s*urlencode\(\s*\3\s*\);\s*\3\s*=\s*ereg_replace\(['"]%(?<X2055561>)
(\$user)[\h=]+['"]username['"];\s*(\$pass)[\h=]+['"]Password['"];[^\{]{9,150}\{\s*(\$\w{1,15})[\h=]+wp_create_user[\h\(]+\1[\h,]+\2[^\)]+\);\s*(\$\w{1,15})[\h=]+new\h*WP_User[\h\(]+\3[\h\)]+;\s*\4\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*}(?<X1199110>)
(\$v\d+)[\h=]+['"]\./wp-(?:admin|content|includes)/[^'"]+['"];\s*if[\h\(]+(file)size[\h\(]+[^\{;]+\{\s*if[\h\(]+\2_exists[\h\(]+\1[\s\)]+\{\s*(\$\w{1,25})[\h=]+gzinflate[\h\(]+\2_get(_contents)[\h\(]+\1[\h\)]+;\s*if[^#;]{0,99}\b\2_put\4[\h\(]+['"][^'"]+['"],\s*\3[\h\)]+;\s*\}\s*\}(?<X1213031>)
(\$VERSION)\s*=[^;]+;\s*\$REDIRECT_[^@#]{999,4999}\$(\w+)[\s=]+array[\s\(]+['"]https?://[\d\.]+/router\d+\.php\?[^;]+\1[\s\)]+;\s*shuffle[\s\(]+\$\2[\s\)]+;[^\?]{1,499}\bforeach[\s\(]+\$\2\s*as\s*(\$\w+)\b[^\}]{1,99}(\$\w+)[\s=]+@?file_get_contents[\s\(]+\3\b[^\?]{1,999}\becho\s*\4;(?:\s*(?:die|exit)\b[^;]{0,99};\s*\}?)+(?<X1195655>)
(\$web)[\h=]+\$\w+[\h\.]+['"]://['"][^;]+;\s*(\$\w+)[\h=]+trim\(\w+\(\1[\h\)]+;\s*if[\h\(]+!(strstr)\(\2,[^\{]+\{\s*if[\h\(]+\3\(\2,[^\{]+\{\s*@header\([^\)]+\);\s*\2[\h=]+str_replace\([^;]+;\s*echo\h*\2;\s*(exit\(\);)\s*\}\s*else\h*if\([^\{]+\{[^\}]{9,199}\becho\h*\2;\s*\4\s*\}\s*\}(?<X1262700>)
(\$wp\w{0,40})\h*=\h*['"][a-f\d]{0,64}['"]\h*;\s*function\h*(\w{1,40})\h*\([^\)]*\1[^\?]{99,1999}(\$\w{1,40})\h*=\h*\2\h*\([^\)]*\1[\h\)]+;\s*if[\h\(]+isset[\h\(]+\3[\s\)]+\{\s*@?(?:eval|asset)[\h\(]+\3[\h\)]+;\s*\}(?<X1179921>)
(\$wp_(file)system)\s*=\s*array\h*\(\h*\)\h*;\h*\$\w{1,40}\h*=\h*\d+;\s*\1\h*\[[^\]]+\]\h*=\h*\2size\h*\(\h*__\2__[\h\)]+;\s*if[\h\(]+\2_exists[\h\('"\.]+/template\.html?['"][\)\s\)]+\{\s*\1\h*\[(?<X2179130>)
(\$wp_4meta_arr)[=\s]+array[\(\s'"]+comment["']\s*=>[^;]+;\s*\$\w{1,40}[\s=]+(?:(\$\w+)\s*\->\s*query[\(\s'"]+SELECT[^;%]+\bLIKE\s*['"]recovery_pages_%['"\s\)]+;[^\176]{9,999}(\$\w{1,40})\s*=\s*str_replace[\s\(]+\1[^>]{9,9999}@touch[\s\(]+\3[^;]+;[\s\}]*\2\->close[\(\);\s]+unset[\s\(]+\2[s\)]+;(?<X1222440>)|(\$wpdb)[^'";]+['"]SELECT[^;%]+\bLIKE\s*['"]recovery_pages_%[^;]+;[^\176]{9,999}(\$\w{1,40})\s*=\s*str_replace[\s\(]+\1[^>]{9,9999}@touch[\s\(]+\6[^;]+;[\s\}]*\5\->close[\(\);\s]+unset[\s\(]+\5[s\)]+;(?<X1222490>))
(\$wp_\w+)[\h=]+explode[\h\(]+['"]function['"],[^;]+;\s*(\$wp_\w+)[\h=]+\1[^;]+;[^\?]{9,99}(\$wp_\w+)[\h=]+\2\([^\)]+\);\s*\$\w+[\h=]+\2[\h\(]+\3[\h\(]+\2[\h\(]+[^;]+;(?<X1266040>)
(\$wp_\w{1,9})\s*=\s*getcwd\(\);\s*if\s*\(\s*isset\s*\(\s*\$_FILES\[['"](wp_\w{1,9})['"]\]\)\)\s*\{\s*\$wp_\w{1,40}\s*=\s*basename\(\$_FILES\[['"]\2['"]\]\[['"][^\$]{1,40}\$_FILES\[['"]\2['"]\]\[['"][^'"]{1,40}['"]\],\s*\1(?:[^\?]{200,300})\?path\s*=\s*\1[^\;]{1,200};(?<X1056241>)
(\$wp_default_logo)(?:=['"]<img\h*src=["']data:image/\w{1,7};[^'"]{600,2200}['"]>['"];\s*preg_match\(["'][^,]{5,40},\1,(\$\w{1,20})\);\s*(\$\w{1,20})=\2\[\d+\];\s*(\$\w{1,20})=pre_term_name\(\3\);\s*if\(isset\(\4\)\)[\{\s]+eval\(\4\);\s*\}(?<X2203772>)|\s*=\s*['"](<img\s*src)[^>]{9999,30000}>['"];\s*preg_match\s*\(['"][^<]{0,9}\6[^,]+,\s*\1\b(?<X2134480>))
(\$wp_template_css)\h*=\h*get_option\([^\)]+\);\s*if\h*\(\h*isset\h*\(\h*(\1\[[^\]]+\])[\s\)]+@\2\h*\(\h*null,\h*\1\[[^\]]+\]\h*\(\h*\1\[[^\]]+\][\s\)]+;(?<X1194440>)
(\$wpautop)\h*=\h*\w{1,40}\h*\([^;]+;\s*(if\h*\(\h*isset\h*\()\h*\1\h*\)\h*\)\h*\{\s*\2\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+@setcookie\h*\(\h*['"]f_pp['"]\h*,\h*\3\h*\);\s*(\$\w{1,40})\h*=\h*create_function\h*\(\h*['"]{2}\h*,\h*\1\h*\);\s*unset\h*\([^\)]+\1\h*\);\s*\4\(\);\s*\}(?<X2144010>)
(\$wpautop\d*)\s*=\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+;\s*if[\s\(]+isset[\s\(]+\1[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]create_function['"];\s*\2[\s\(]+['"]{2}\s*,\s*['"]\}['"]\s*\.\s*\1\s*\.[^;]+;\s*\}(?<X1200470>)
(\$wpdb\->)query\h*\(['"]INSERT\h*into\h*\1users\h*\([^\\\?\*]{99,900}\$\w{1,20}\h*=\h*file_get_contents\h*\(['"]https?://(?:paste|ghost)bin\.\w{2,6}/(?<X2181282>)
(\$xmailer)=explode\([^\)]+\);\s*\$gmailer=\1\[array_rand\(\1\)\];[^%&\+]{99,900}\bmail\([^\)]+\);\s*\}\s*foreach\h*\(\$_POST\h*as\h*\$key=>\$[^\)]{0,3}value\)(?<X2174520>)
(\$Z118_)SUBJECT\s*\.?=\s*['"](?:CC|VBV|CVV|Pin|Login|PPL|Paypal|Gmail|Ymail)(?:'s)?\s*(?:Info)?\s+FROM\s+(?:.\s+['"]\.\$_SESSION\[[^\]]+\]\.['"]['"]?\s*){1,2};\s*\1HEADERS\s*\.?=\s*['"]From:\s*Dexter(?<X2063062>)
(\.(\w{1,40}\()['"]http)s?://[^;]{1,199};(?:echo\b[^;]{1,199}\1s?://[^;]{1,199};){1,}\}?function\h*\2(\$\w{1,40})\)\{(\$\w{1,40})=file_get_contents\(\3\);if\(!?\4\b[^\}]{1,499}\}return\h*\4;\}?(?:exit|die)[^;]{0,19};\}?(?:\?>)?\Z(?<X2178570>)
(\/\*\h*\w{32}\h*\*\/)\s*(\$\w{1,15})\h*=\h*(?:chr\(\d{1,3}\)\h*\.\h*){15}[^;]{0,699};\s*(\$\w{1,15})\h*=\h*(?:\2\[\d{1,3}\]\h*\.\h*){8}[^;]{0,199};\s*(\$\w{1,15})\h*=\h*(?:\2\[\d{1,3}\]\h*\.\h*){8}[^;]{0,199};\s*\3\h*\(\h*\4\h*\(\h*null,\h*(?:\2\[\d{1,3}\]\h*\.\h*){145}[^;]+;\s*\1(?<X1183670>)
(createFolder)\s*\(\s*\$\w+\s*\)\s*;function\s+\1\s*\(\s*(\$\w+)\s*\)\s*\{[^\{]{1,20}\{\1\s*\(\s*dirname\s*\(\s*\2(?:\s*\)){2}\s*;\s*mkdir\s*\(\s*\2\b[^`]{99,999};\s*header\s*\(\s*['"]\s*content\-type\s*:[^'"]{1,99}charset\s*=\s*gb2312[^'"]{0,99}['"]\s*\)\s*;(?<X2128001>)
(function)\s*\w+\((\)\{)[^\{]+\{\1\s*\w{1,40}\([^\;]{1,50};(?:(curl_)setopt\([^;]+;){3,4}(\$\w+)=\3exec\(\$\w+\);return\s*['"]<\?php\s*/\*['"]\.(?:md5\(time\(\){2}\.){2}['"]\*/\?>['"]\.\4;\}\1\s*(\w+)[^\}]{99,199}\}\1\s*(\w+)\([^\}]{9,99}\{(\$\w+)=[^;]+;if\(\7\2\5\([^\)]+,\7,\d\);\}{3}\6\(\$_[GPCSR]\w{2,6}\[(?<X2129260>)
(function\s+)upload\d+Fsociety\d*\(\)\{\s*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\{]{1,49}\{\s*\1\w+(\(\$\w+,\s*(\$\w+)\))\s*\{\s*\3\s*=[^;]+(md5\(rand\([^\)]+\)\))\s*\.\s*\4[^;]+;\s*file_put_contents\2;\s*\}\s*\1\w+\s*(\(\$\w+\))\s*\{\s*(\$\w{1,40})\s*=\s*rawurldecode\5;\s*return\s*\6;\s*\}(?<X2131912>)
(fwrite\(\s*fopen\(\s*['"]\s*\.\s*contactemail\s*['"]\s*,\s*['"](?:w|a)\+?['"]\s*\)\s*,\s*['"][\w\.\-]+@[\w\.\-]+\.[a-z]{2,6}['"]\);)[^;]{1,60};\s*\1(?<X2118703>)
(g\d{2}b_crypt\()(\$_[GPCSR]\w{2,6}\[['"])\w{1,40}['"]\](,['"]\w{2,5}['"]\s*\)\s*:\s*false\s*;)(\2\w{1,40}['"]\])=\(isset\(\4\)\)\?\1\4\3(?<X2130090>)
(header\()['"](?:(Content\-)Length:\s*['"]\.(\$\w{1,40}\[)\d{1,3}\]\((uhex\([\$_[GPSCR]\w{1,6}\[[^\]]{1,42}\]\))\){2};\1['"]\2disposition:\s*attachment;filename=[^;]{1,99}\4[^;]{1,99};\3\d{1,3}\]\(\4\);\}(?:\?>|\Z)(?<X2128800>)|WWW-Authenticate:\s*Basic\s+realm\s*=\s*(?:['"](?:php|c99|wso|r57)\s*shell[^\)]{0,20}\);\s*\1['"]HTTP/\d\.\d\s+(?:401|403)\s+(?:Unauthorized|forbidden)(?<X2129140>)|[^\)]{1,15}\);\s*\1['"]HTTP/1\.\d\s+(?:401|403)\s+(?:Unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};[^\\]{99,500}\$\w{1,20}\s*=\s*['"]/etc/passwd['"];(?<X2123850>)))
(if\(isset)\((\$\w{1,10})[\)\s]+\{\s*\$\w{1,10}\h*=\h*[eas](?:xec|hell_exec|val|ssert)\(\2\);[^\}]{1,99}\}\s*\1\((\$eval)[\)\s]+\{\s*eval\(['"]\3['"]\);\s*\}(?<X2173233>)
(ob_)start\(\);\s*(\$\w{1,9})\s*=\s*\\['"]['"]\.\$(?:data|payload)\.['"]\\['"];\s*@?eval\s*\(gz(?:uncompress|inflate)\s*\(base64_decode\s*\(\2\)\s*\)\s*\);\s*\$\w{1,9}\s*=\s*\1get_contents\(\);\s*\1end_clean\(\);\s*\?>['"];(?<X2121671>)
(touch)\s*\(\s*(dirname)\s*\(\s*(__FILE__)\s*\)\s*,\s*\$\w{1,40}\s*\);\s*\1\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*\$\w{1,40}\s*\);\s*if\s*\(\s*(substr)\s*\(\s*(PHP_OS)\s*,\s*0\s*,\s*3\s*\)\s*\D{2,3}\s*'[^']*'\s*\|\|\s*\4\s*\(\s*\5\s*,\s*0\s*,\s*3\s*\)\s*\D{2,3}\s*'[^']*'\s*\)\s*\{\s*(chmod)\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*0444\s*\);\s*\6\s*\(\s*\2\s*\(\s*\3\s*\)\s*,\s*0555\s*\);\s*\}(?<X2046941>)
(unlink)\s*\(['"]([^\.]{0,9}\.pl)['"]\);\s*\1\s*\(['"](php\.ini)['"]\);\s*\$\w{1,20}\s*=\s*fopen\(['"]\3['"],[^\.]{9,99}\$\w{1,20}\s*=\s*['"]perl\s+\2\s+\$\w{1,20}['"];(?<X2124340>)
,(?:(\$\w{1,40})[=\s]+function[\(\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})\s*=\s*['"]['"][\)\s]+\{\s*return\s*empty[\s\(]+\2\[\3[^&\n]{1,199}\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}[\)\s]*&&[^:\?\n]+include\s*\$\w{1,40};[^\?:\n]{0,199}\1[\s\(]+\$\w{1,40}\s*,\s*\4\[\d+\][^:\n]{1,999}:\s*['"]{2}(?<X1222530>)|\s*(?:['"](?:\^[^'"]+['"]\s*,\s*["']\^[^'"]+["']\s*,\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*in_array\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]+['"]\s*\]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{[^\}]+header\s*\(\s*'HTTP/1\.0 404 Not Found'\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*else\s*\{[^\}]+foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{(?<X2046322>)|index\.html\.bak\.bak[^\?]{1,600}\$is_(?:wp|wordpress)\s*=\s*(?:false|0);\s*\$is_(?:jm|joomla)\s*=\s*(?:false|0);(?<X2056770>))|basename\(\$_FILES[^\$]{1,40}\$_POST\[['"]?(\w{1,40})['"]?];[^`]{1,400}<input\s+name\s*=\s*['"]\8['"][^>]{1,40}value\s*=\s*['"]\.php['"]\s*/>(?<X2052880>)|function\s*\(\s*\)\s*{\s*add_object_page\s*\(\s*"UBH"\s*,(?<X2049960>)|sprintf\((\w{1,40})\('[^']{1,40}'\),\s*constant\(\11\('[^']{1,40}'\)\)\s*,\s*Config::get\(\w{1,40}\((?<X2050540>))|CURLOPT_(?:POSTFIELDS,['"]<(method)call>\s*<(\13(name))>\s*wp\.getUsersBlogs\s*</\14>\s*<(param)s>\s*(?:<\16>\s*<(value)>[^\-]{1,60}</\17>\s*</\16>\s*){2}[^\?#%@&\*:]{1,199}\bpreg_\w{1,19}\(['"](\W)<\15>isAdmin</\15>\18(?<X2179601>)|URL,['"]https?://(?:[^\./'"]{1,19}\.)?admailer\.[\w\.]+/[^'"]{3}[^\}\?=]{1,499}\$(\w{1,40})=curl_exec\([^\}\?]{1,499}\bfile_put_contents\(['"]([^,\)'"]+\.php)['"],\$\20\);(?:requir|includ)e\w{0,5}\h*\(?['"]\21['"]\)?;[^@#%&\\]{499,1999}\}new\h+\w{1,40}\(\);(?:\?>)?\Z(?<X2180480>)))
-\s*Process\s*Faker\s*,[^\n]{1,200}\s+Options:\s+-s\s+string\s+Fake\s+name\s+process(?<X2055960>)
/(?:#s"\s*,\s*\$\w{1,40}\(\s*""\s*,\s*\$\w{1,40}\(__FILE__\s*\)\s*\)\s*,\s*\$match\s*\)\s*\?\s*\(\s*\$match\[\s*\d+\s*\]\s*\)\s*:\s*""\s*\)\s*\.\s*"//"\s*\)\s*;(?<X2049100>)|(\*\w{32}\*)/;\(function\(\)\{var\s*(\w{1,15})=['"]{2};var\s*\w{1,15}=['"]\w{99,2200}['"];for\s*\(var[^\}]{9,199}\}\s*\3=\3\.substring\(\d,\3\.length\-\d\);\s*(eval\()\4['"]String\.fromCharcode\(['"]\+\3\+['"]\)['"\);\}]{1,9}\(\);/\2/(?<X1155463>)|/(?:###=(?:=###\s*assert\s*\(.{1000,5000}\)\)"\);\s*//###==###(?<X1039820>)|CACHE(?: START=###.*?//###=CACHE END=###(?<X1035141>)|S START=###\s*error_reporting\(0\);\s*assert_options\(ASSERT_ACTIVE\s*,\s*1\);\s*.+//###=CACHES END=###(?<X1036380>)))|(\w+_)start\s*\$\w+[\h=]+['"]file_exists['"];[^\{]{9,199}\{\s*\$\w+[\h=]+['"]base64_decode['"];\s*(\$\w+)[\h=]+\$_SERVER\[[^\{]{9,199}\{\s*@?\$\w+[\h\(]+\10[,\h]+\d+[\h\)]+;[^\}]{9,99}@\$\w+[\h\(]+\10[,\h]+\d+[\h\)]+;[\s\}]+//\9end(?<X1259510>)|(Viv\h*,\h*bebegim)[\.\s]{1,9}define\h*\(['"]\12\.*['"]\h*,\h*['"]Denzel-(?<X2152701>)|\h*(?:(\w+)_start\s*\$\w+[\h=]+['"\.\hfilesz]+;[^\n\?]{0,350}(\$\w+)[\h=]+\$_SERVER\[['"\h\.document_r]+\][^\n\?\{]{0,199}\{\h*if[\h\(]+\$\w+[\h\(]+\$\w+[\h\)]+\{[^\}]{0,99}@\$\w+[\h\(]+\15,\s*\$\w+[\h\(]+[^\}]+[\h\}]+\s*//\h*\14_end(?<X1232880>)|(ck[i1l]+)bg\b[^\?#]{1,4999}\bstri?(?:str|pos)\s*\([^,\)]+,\s*['"]#bbbtitsbbb#['"][^\?/]{1,4999}//\h*\17end\b(?<X1209843>))|\s*installbg\s*\$\w{1,40}='[^']+';\s*require\("\$\w{1,40}"\);\s*//\s*installend(?<X1038540>)|\w{1,15}\s*(\w{1,9})\h*=\h*\d;\s*(\w{1,9})\h*=\h*['"]{2};\s*(\w{1,9})\h*=\h*['"][^'"]+['"];\s*while\(\20\h*\D{1,3}\h*\d{1,3}\)\s*\{\s*\21\D{2,3}String\[['"]fromChar[\'"]\s*\+\s*\22\s*\]\([^\n]{9,350}\bfunction\([^\)]{0,49}\+\21[\(\)\h]+;\s*//\w{1,15}(?<X1179060>)|\w{4,32}\v\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=[^\v]{65000,}@header\s*\(['"][^'"]{1,99}['"]\);\}\s*(?:exit|die)\s*\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\}\);]+\s*//\w{4,32}(?<X1135950>)|i(?:nsta\w+\s*(?:require|include|require_once|include_once)\(["'][^'"]+['"]\);\s*//insta\w+(?<X1037121>)|start\s[^#\*%]{999,6000}?error_reporting\s*\(0\)[^\?]{999,6000}?//iend(?<X1034252>))|PING.*?sav.php\?p=\w+&url=.*?\@ob_start\(\'obCacheStart\'\);(?<X2044931>))|[/\*]\s*Venmo\s+Scam\s+by\b(?<X2169800>)|[\*\s]{1,99}Plugin\h+Name:\h+CMSmap\h*(?:\W\h*)?WordPress\h+Shell\s*\*\h*Plugin\h+URI:[^\*\?><;\$\(\{\}\)]{1,199}\*\h*Description:(?<X2175630>)|\*(?:([a-f0-9]{6}\*/)\s*(\w{1,9})\h*=\h*function\(\)\{[^\{]{1,99};(\w{1,9})=String\.fromCharCode;try\{[^x]{99,499}\{\w=['"](?:[a-f0-9]x[a-f0-9]{1,2},){9}[a-f0-9,x]{999,9999}['"]\.split\h*\([^\.]{9,99}\w=\w.concat\(\32\(eval\(\31\([^;]+;\h*\}\h*\w{1,9}=(\w{1,9});\h*eval\h*\([^\)]+\33\);(?:\h*\})+(?:\s*/\*/\30)?(?<X1143671>)|([a-f\d]{2,6})\*/\s*@include[\(\s]+['"]/home\d*/[^/]+/[^/]+/wp\-[^/]+/[^'"]+/\.[a-f\d]{3,9}\.\w*['"][\)\s]+;(?:\s*/\*\35\*/)?(?<X1242570>)|(\w{32})\*/\s*var\h*(_0x\w+)[\h=]+\[[^\n]{9,150}\bcreateElement['"],\h*['"]https?://(?:\w+\.)?trymyfinger\.website/\?id[^\n]{99,1100}\bdocument\[\38\[\d+[\]\[]+\38\[\d+[\]]+\([^\)]+\)[;\}\s]+/\*\37\*/(?<X1203870>)|(visitorTracker\*/)@\w{1,40}\([^\)]{0,20}\);\S{0,99}echo\s+base64_decode\(['"][^'"]{999,}['"]\);(?:\s*/\*/?\40)?(?<X1135970>)|\h*\w{32}\h*\*/\s*(func)tion\h+x(mail)\h*\(\)\s*\{\s*(\$\w{1,40})\h*=\h*\42_get_args\(\);\s*file_put_contents\h*\(\h*['"][^\?\^\{\}]+\b\43\(\h*(?:\44\[[0-3]\]\h*,?\h*){4}\);\s*\}\s*\42tion\h+\w{1,9}[^\?\^]+\^\s*['"]0['"];\s*\}\s*return\s*\$\w{1,40};\s*\}(?<X1034562>)|\s*(?:Created\s+by\s+l33bo_phishers(?<X2052671>)|edition:\s*\d+\.\d+\s*\*/\s*(\$\w{1,40})\s*=\s*['"]eN[^'"]+['"];eval\(gzuncompress\(base64_decode\(\47\)\)\);(?<X1269430>)|T(?:EST-TRACK-LINE\s*\*/\s*\$\w+.+?/\*\s*/TEST-TRACK-LINE\s*\*/\s*(?<X1034601>)|urbo\s+Force\s+By\s+TrYaG\.CC\s+\-\s+TrYaG\s+AcaDemY\s*\*/(?<X2047460>)))|_\*/\s*touch\(\s*\$var1\s*\);\s*\?>\s*</body>\s*</html>\s*\Z(?<X2049840>)|edition:\d+\.\d+\*/\s*(\$\w{1,40})\s*=\s*['"]eNpN[^;]{3000,5000}['"]\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*\52(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1054231>))|\s*\*\w+\s*\*/\s*@include\s*"[^"]*"\s*;\s*/\s*\*\w+\s*\*/(?<X1036861>)|app/code/core/Mage['"];\s*(\$\w{1,40})\s*=\s*\$\w{1,40}\s*\(\s*['"]aHR0cDovL3Bhc3RlYmluLmNvbS9yYXcv['"]\s*\)\s*;\s*[^\(\)\{\}]{1,199}\s*\$\w{1,40}\s*=\s*['"](?:Cc|Abstract)\.php['"]\s*;[^\(\)\{\}]{1,199}\$\w{1,40}\s*=\s*\55\s*\.\s*['"][^'"]{1,20}['"];(?<X2129250>)|sec\.html?['"];\$\w{1,20}=file_get_contents\(['"]https?://(?:paste|ghost)bin\.co(?<X2177660>)|t(?:emplate-loader\.php\s+\);\s*(/\*[a-f0-9]{32}\*/)\s*(\$\w{1,40})=['"\s\.base64_dco]{16,40};\s*@?eval\(\59\(['"][^'"]{9999,29999}['"]\)\);\s*\58\s*\}(?<X2132250>)|mp/sess_[a-z0-9]{20,40}['"];\s*\}\s*\}\s*function\s+\w{1,40}\([^\)]*\)\s*\{\s*return\s+['"]/?\w{1,40}\.php\?\w{1,9}\s*=\s*['"]\s*\.\s*_SAPE(?<X2060550>))|wp\-admin/[\w\-]{1,15}\.php\?action=revslider[^'"]{1,49}\bwp\-config\.php['"];[^\}]{0,99}\bfile_get_contents\(\$\w{1,15}\);(?<X2184431>))
:(?:(\$\w{1,40})=\$\w{1,40}\(['"]noitcnuf_etaerc['"]\);goto\h+\w{1,9};\w{1,9}:[^\?]{1,499}:(\$\w{1,40})=['"][^'"]{9999,}['"];[^\?]{1,499}:(\$\w{1,40})=\1\(['"](?:/\*[^'"]+\*/)?['"],[^\),;]{1,199}\2\)+,[^\?]{1,499}:\3\(\);\s*(?:\?>\s*)?\Z(?<X2180911>)|//(?:bit\.ly/[^/'"]+['"][\)\h]+;\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\b[\h\(]+(?:['"][\?>]{2}['"][\h\.]+)?\$\w{1,40}[\)\h]+;(?<X2183922>)|t\.me/z0n51\s+\*(?<X2238290>))|: 3FEShell(?<X2050940>)|\${\$\w+}=php_uname\(preg_replace\("/\^-/","",\${\${(?<X2047340>)|\s*(?:['"]Up[l1][o0][a4]d[3e]r\s+By\s+[A4]tt[a4]ck[3e]r\s+G[a4]z[a4]['"];\s*\?>(?<X2064791>)|mkdir\([^;]{1,99}/\.?well\-known\b[^;]{0,99};\s*goto\s*\w{1,9};[^\?><#%!@]{99,999}=base64_decode\(['"]PD9[^'"]{999,14999}['"]\);[^\?]{1,999}\becho\h+['"]<shell>(?<X2181231>)))
;(?:(\$\w+)=fopen\((\$[^,]+),[^;]+;f(?:write|puts)\(\1,[^;]+;fclose\(\1\);(?:if\(file_exists\(\2\)+\{(?:(?:includ|requir)e(?:_once)?|unlink)\(?\2\)?;[^\}]*\}){2,}\}+(?:\?>|;)*\Z(?<X2200511>)|(\$\w{1,40})=(?:['"](?:<\?(?:php)?\s*(unlink\()['"](\$\w{1,40})['"][^\?]{1,199}[;\}]file_put_contents\(\6,\4\);(\$\w{1,40})=['"]nohup\b[^;]{0,99}\6\b[^;]{0,199};\w{1,40}\(\7\);sleep\(\d+\);\5\6\);(?<X2188700>)|[^'"]+(?:Password|cvv)[^'"]+['"];[^\(]{1,199}\bmail\([^\)]+\4[^\)]+\);(\$\w{1,40})=['"][^'"]+['"];if\(is_writable\(\9\)\)\{if\((\$\w+)=fopen\(\9,[^\)]+\)\)\{?\s*fwrite\(\10,[^\)]+\4[^\)]+\);\}{1,2}header\(['"]Location:[^\)]+\);(?:\?>|\Z)(?<X2131721>)|google\-site\-verification\s*:[^;]{1,99};file_put_contents\([^,;]+,\4\);(?:[^@#%]{1,799}\.authcode\(){2}(?<X2190101>))|file\((\$\w{1,40})\);(\$\w{1,40})=file_get_contents\(\13\);(?:if\(mb_stri?pos\([^,\)]{0,49}(?:\4\[\d+\]|\14),['"]/\*[^\{]{1,19}\{){2}[^\}]{1,99}\}(\$\w{1,40})=fopen\(\13,[^;]{1,19};fwrite\(\15,['"]<\?[^\}]{1,199}\btouch\(\13,[^\);]{4}(?<X2191851>))|(\$\{[^\}]+\}\[)([^\]]+\])=['"]_COOKIE['"];(?:\$\{)?(\17[^\]]+\])\}?=(?:\$\{)?\17\18\}?;(?:if)?\([^;]{0,199}\bin_array\(gettype\((?:\$\{)?\19[^;:]{1,1499}\19\}?\(\)(?<X2209402>)|(goto)\h+\w{1,9};\w{1,9}:\h*echo\h+['"]<(cpanel)>https?://[^:]{1,20}:2083\|[^/]{1,20}</\22><br>['"];\21(?<X2154671>)|@\$(?:\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\s*\?>\s*\Z(?<X2049991>)|__\(\$__\d+\(@\$_\[\d+\]\.@\$_\[\d+\]\.(?<X2049080>)|fun\(\s*str_rot13\((?<X2043611>))|[ei](?:rror_reporting\(|ni_set\(['"]display_errors['"])[^;]{1,9};(\$\w{1,40})=['"]https?://[^\}\?]{1,499}\becho\h+['"]google\-site\-verification:[^@#%]{999,4999}\)\{global\b[^;]{0,99}\27\b[^\?#%&]{1,999}\}(\$\w{1,40})=\w+\(\27[^\}]{1,499}\bfile_put_contents\([^,]+,\28\);echo\h*\28;\}?(?:\s*\?>)*\Z(?<X2180851>)|[rep](?:eturn|cho|rint)\h+json_encode\h*\([^;]{1,499}\bis_writable\(__FILE__\)[^;\}#%&\\\|<\+\*]{1,999}\barray\(['"]\w{1,9}['"]=>\h*@?(?:php(?:version|_sapi_name|version)|get_current_user|getmy[ug]id)\(\)[^@#%\};:/&\+]{1,99};\}(?<X2181253>)|\$(?:(\w{1,40})=['"]([^'"]{0,99}\.php)['"];(?:\$\w{1,40}=['"]\32\?(?:content|createdoor|update|getback|spider)['"];){5,9}(\$\w{1,40})=client_version\(['"]\d{1,20}['"]\);\$\w{1,40}=['"]https?://['"]\.\33\.\$\31;(?<X2158800>)|\w{1,40}(?:='[^']{1,40}'\^'[^']+';\w{1,40}(?<X2050631>)|\^\$\w{1,40};\$\w{1,40}=\$\w{1,40}\^'(?<X2050471>))|\{\$(?:\w{1,40}\}(?:\.=pack\("[^"]{1,20}?",0x00000000,0x00000000,0x00000000,strlen\(\$\{\$\{"(?<X2048230>)|\s*=\s*get_option\(EWPT_PLUGIN_SLUG\);echo"[^"]+"\s*\.\s*esc_attr\(\$\{\$\{"[^"]+"\}\s*\["(?<X2047270>))|\{"[^"]{1,100}"\}\[[^\]]{1,100}\]\}=system_custom\(\$\{\$\w{1,40}\}\);echo\$\{\$\{"[^"]{1,100}"\}\["[^"]{1,100}"\]\};print(?<X2050300>))|_(?:\s*=\s*create_function\(\s*""\s*,\s*@gzuncompress\(\$_+\)\);\$_+\(\);\s*\?>(?<X2049720>)|\w{1,10}=array\([^)]+\);\$payload="[^"]{4000,14000}";(?<X2049730>)|\w{1,40}=.\$_\w{1,40}\("[^"]+",'\w{1,40}'\);@\$_\w{1,40}\("[^"]+",.\$_\w{1,40}\((?<X2049700>))|b374k\s*=\s*\$\w{1,40}\(\s*['"]\$\w{1,40}['"]\s*,\s*['"\.,\seval]{7,40}\((?<X2051990>)|this->tm_class_name_div=\$\{\$\{"\\x\w{2}(?<X2047890>))|\s*(?:(?:(?:else\h*)?if\h*\(function_exists\h*\(\h*['"](exec|shell_exec|system|passthru|popen|eval)["']\h*\)\h*\)\h*\{[^\}]{1,40}(?:\$\w{1,20}\h*=\h*)?@\45\h*\(\$[^\)]+\);\s*\$\w{1,40}\h*=\h*@ob_get_contents\h*\(\h*\)[^\}]{0,90}\}\s*){2}(?<X2121642>)|(?:\$\w{1,20}\h*=\h*preg_replace\(['"](\W)<(?:script|style|!--)\.\*\?(?:</script|</style|-->)>?\47is['"]\h*,\h*['"]{2}\h*,\h*\$\w{1,20}\);\s*){2,3}[^,]{9,99}\$\w{1,20}\h*=\h*array\((?<X2152062>)|(?:echo|print)\s*\(?['"]?<title>\s*Droid-X-Fahri\s*<(?<X2123451>)|(?:goto\s*\w{1,40};\s*\w{1,40}:\s*@?ini_set\([^\)]{1,99}\);\s*){2}[^/]{9,99}<title>\s*\w{1,40}\s+backdoor\s*</title>(?<X2130892>)|(?:passthru|exec|shell_exec|popen|system|eval)\(\s*['"]\./findsock[^\$]{1,40}\$_SERVER\[['"]REMOTE_ADDR['"]\][^\$]{1,40}\$_SERVER\[['"]REMOTE_PORT['"]\]\s*\)\s*\?>(?<X2054071>)|(\$\w{1,20})\s*=\s*file_get_contents\s*\(['"]https?://[^'"]{1,20}/\w{1,20}\.txt['"]\);\s*(\$\w{1,20})\s*=\s*fopen\s*\(\$\w{1,20}\.['"][^'"]{1,20}/\w{1,20}\.(?:jpe?g|bmp|gif|png|ico)['"]\s*,\s*['"]w['"]\);\s*fwrite\s*\(\53,\52\);(?<X2122380>)|[#]{5,200}\s*\$SUBJECT\s*=\s*['"]\s*\((?:AMAZON|ADOBE|AZURE)\)\s*\((?:BILLING|LOGIN)\)\s*\(\s*\$IP\s*\)\s*\(\s*\$COUNTRYNAME\s*\)\s*['"]\s*;(?<X2054681>)|[fpeas](?:p?assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\$\w{1,20}\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>\s*<html>\s*<head>[^\$\{\}\*]{99,400}<title>\h*[^/]{0,20}Shell\h*</(?<X2163121>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"](?:css|images|fonts|js)/\w{1,20}\.gif['"]\)?;[^:/]{0,30}\bmail\h*\([^\)]+\);[^\?>]{0,99}\bheader\h*\(['"]Location:(?<X2166201>)|\$(?:[O0_]+="[^"]*"\s*;\s*\$\w{1,40}="[^"]*"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*echo\s*\$\w{1,40}\s*\.\s*"[^"]*"\s*;\s*(?<X2046640>)|\w{1,20}\s*=\s*(?:http_get|file_get_contents)\s*\(['"]https?://laggerghost\.github.io/[^\)]+\);(?<X2134470>)|\{['"](?:G|\\x47)(?:L|\\x4c)(?:O|\\x4f)(?:B|\\x42)(?:A|\\x41)(?:L|\\x4c)(?:S|\\x53)['"]\}\[['"](?:z|r|_|\\x7a|\\x5f|\\x72){1,40}['"]\]\(\$[zr_]{1,40},CURLOPT_USERAGENT,\\['"]WHR\\['"]\);(?<X2053771>)|default_use_ajax\s*=\s*false;\s*\$default_charset\s*=.+print\s*eval\((?<X2045720>))|\b\w{1,20}\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);\s*hebrevc\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);\s*\w{1,10}\(\$\w{1,10}\s*=\s*\$\w{1,10}\.\$\w{1,10}\[\d+\]\);(?<X2047590>)|\}\s*\}\s*(?:\$\w{1,20}\s*=\s*['"][3E]x[0o]rc[i1][s5][7t]['"];(?<X2130861>)|\}\s*echo\s*['"][^'"]{0,40}['"]?\s*\.?\s*php_uname\(\)\s*\.?\s*['"]?\\?r?\\?n?['"];\s*echo\s*getcwd\(\)\s*\.?\s*['"]?\\?r?\\?n?['"];\s*\?>\s*\Z(?<X2052570>))|e(?:val\(\$GLOBALS\['\w+'\]\[\d+\]\(\$GLOBALS\['\w+'\]\[\d+\]\(\$\w+\)\)\);\?>(?<X2045171>)|xit[\s\(\)]+;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*\w{1,40}\s*\(\s*(\$\w{1,40})\s*,\s*\66\h*\)\s*;\s*\w{1,40}\s*\(\s*\67\s*,\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\(\s*\67\s*\[\s*\d+\s*\]\s*,\s*\66\s*\^\s*\w{1,40}\s*\(\s*\67\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\(\s*\66(?:\s*\)){4};\s*\}\s*\Z(?<X2048926>))|function\s*\w{1,40}\(\$\w{1,40}\)\s*\{\s*return\s*\(substr\(\$\w{1,40}\s*,\s*\d+\s*,\s*\d+\s*\)\s*==\s*\w{1,40}\(array\([^)]{1,100}\)\s*\)\s*\)\s*;\s*\}(?<X2049290>)|if\s*\(\s*isset\s*\(\s*(\$_FILES)\[['"]?([^'"]{1,40})['"]?\]\s*\)\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\70\[['"]?\71['"]?\][^\(]{200,300}php_uname\(\s*[^\)]{0,40}\s*\)(?<X2055050>)|print\s+"Flooded:\s*\$ip\s*on\s*port\s*\$rand(?<X2058030>)|symlink\('/'\.\$home\.'/'\.\$user\.'/public_html/client\-area/configuration\.php',\$user\.'WHMCS\.txt'\);(?<X2047490>))|\w{1,40}:\h*(_?doEvil\()[^\?]{1,9999}\bgoto\h+\w{1,40};(?:\w{1,40}:\h*){1,}function\h*\75(?<X2182420>)|\w{1,9}:\s*(file_put_contents\((\$\w{1,40}),(\$\w{1,40})\);goto)\b[^?=]{1,199}:\s*\79=base64_decode\(['"][^"']{9999,19999}["']\);[^\?]{1,199}:\s*\77\b[^\?]{1,199}\b(unlink\()\78\);[^\?]{1,199}:\s*\80(?:\$_SERVER\[["']SCRIPT_FILENAME['"]\]|__FILE__)\);(?<X2181050>)|\}\s*echo\s+'[^']{1,100}';\s*preg_replace\("\\x2F\\x2E\\x2A\\x2F\\x65","\\x65\\x76\\x61\\x6C\\x28(?<X2050530>)|class\s*Smarty3\s*{\s*private\s*static\s*\$file_with_ip(?<X2046870>)|define\(['"](?:\w+['"],['"]D3S4H\s+SH[e3]ll['"]\)(?<X2220900>)|IS_WIN['"],[^\?]{1,499}=['"][^<>'";]{0,9}<(FilesMatch)\s+\\['"]\^\([^\)]+\)\$\\['"]\s*>(?:\\n|\s){0,9}Order\s+allow,\s*deny(?:\\n|\s){0,9}Allow\s+from\s+all(?:\\n|\s){0,9}</\85>(?<X2215311>)|Yp['"],[^;]+;\$\w+=['"]scandir['"];\$\w+=(?:Array\(|\[)\s*(?:(?:['"][a-f0-9]+['"],){9}[^@]{1,4999}>Mr\.Combet\s*(?:web)?shell\b(?<X2220860>)|(?:['"][a-f0-9]+['"][,\s]+){9}(?<X2215321>))))
;(?:e(?:rror_\w{1,9}\(0\);(\$\w{1,40})=['"][^'"]{1,19}['"];(?:\$\w{1,40}=['"](?:getcwd|file_get_contents|scandir|unlink|rmdir)['"];){5}[^\}\?;]{0,49}\bforeach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\2\[\3\]=stripslashes\(\4\);\}+echo\s*['"][^;]{1,199}<title\b[^>]{0,99}>[\h'"\.]{1,9}\1\b(?<X2168140>)|urt\s*=\s*xaja_esu_tluafed\$(?<X2045521>)|val\(htmlspecialchars(_decode)\(gz[id][ne]flate\((base64\7\()\$\{\$\{\8[^\)]+\)\}\[\8[^\)]+\)\]\}\){4};(?:exit|die)[^;]{0,19};\s*(?:\?>)?\s*\Z(?<X2131630>))|f(?:ile_put_contents\(\$_7\['.'\]\['\w+'\],\$_\d+,FILE_APPEND\|LOCK_EX\);}if(?<X2044221>)|unction\s+\w+\((\$\w+)\)\{list(\(\$\w+),[^=]+=unserialize\([^;]{0,49}\11\)+;\$\w+=(file_)ge(t_contents)\12\);[^\?]{1,499}\bunlink\12\);\13pu\14\12,[^;]+;touch\12,(?<X2220101>))|goto\s*\w{1,19};\w{1,19}:\$\w{1,19}=(\w{1,19}\()\16[^\.]{99,999}\.['"]{2}[^'"]{9999,35000}['"]{2}\.\16((\$\w{1,19})\[\d+\]),\17\.\17,\18\[\d+\]\);goto(?<X2129310>)|if\((?:\$_POST\['\w{1,40}'\]=="Upload"\){if\(@copy\(\$_FILES\['file'\]\['tmp_name'\],\$_FILES\['file'\]\['name'\]\)\)\{echo(?<X2049900>)|typeof\h*(\w+)===undefined\)\{\(function\([^\)]+\)\{(var)\h*_0x[^\n]{99,1999}\b\22\h*\21=[!\[\]]+,(HttpClient)=function\(\)\{\22\h*_0x[^\n]{99,1999}\bvar\h*(\w+)=new\h*\23\(\)._0x[^;]+;\24\[_0x[^;]+;(\w+)\(\w+,\w+\([^;]+[;\)\}]+function\h*\25\(\w+,\w+\)\{\22[^\}]{9,99}0x1;[\}\(\)]+;\};(?<X1262692>))|return\${\$\w{1,20}};}public function getRules\(\){if\(\$this->detectionType==self::DETECTION_TYPE_EXTENDED\){return self::getMobileDetectionRulesExtended\(\);}(?<X2047760>)|set_time_limit\(0\);array_walk\(\$_COOKIE,"enumerator"\);array_walk\(\$_POST,"enumerator"\);function enumerator\(\$value,\$key\)\{\$\{(?<X2050660>)|var\s*(\w+)=\[.*?"];function\s*(\w+)\(\)\{var\s*\w+=navigator\[\29\[\d\]\]\|\|navigator\[\29.*?\30\(\)===\!0&&\(window\[\29\[\d\]\]=\29\[\d\]\);(?<X1042951>))
<(?:!(?:--(?:#include\s*file="/etc/passwd"\s*-->(?<X2046901>)|([^>]+)>\s*<iframe\s+src\s*=\s*['"]?https?://[^\s\?>]+\.php\?\w{1,9}=\d+['"]?\s+frameborder\s*=\s*(?:0|1)\s+(margin)height\s*=\s*(?:0|1)\s+\3width\s*=\s*(?:0|1)\s+scrolling\s*=\s*(?:0|1)\s+width\s*=\s*(?:0|1)\s+height\s*=\s*(?:0|1)\s+border\s*=\s*(?:0|1)>\s*</iframe><!--/\2>(?<X1063752>)|([a-z0-9]{3,9}-->)\s*<(script>)\s*(\w{1,9})\s*=\s*\w[\-;][^\.]{1,40}if\(window\.document\)try\{new\s*\7\.prototype\}catch\(\w{1,40}\)\s*\{[^\}]+fromCharCode\(\d+[\+\-\*]\w[^;]+;\}\w{1,9}\(\w{1,9}\);\}\s*</\6\s*<!--/?\5(?<X1127411>)|(\w{3,8})-->\s*<script>\s*var\s*url\s*=\s*['"]https?://[^/]{4,40}/[^\.]{1,40}\.php['"]\s*;if\(\(navigator\.userAgent[^{]{1,500}\{\s*var\s*(\w)=document\.createElement\(['"]iframe['"]\);[^/]{1,500}document\.getElementsByTagName\(['"]body['"]\)\[\d+\]\.appendChild\(\10\)\}</script>\s*<!--/\9-->(?<X1058130>)|(\w{3,9}-->)\s*<Script[^>]*>\s*document\.write\s*\(['"]<iframe\s+src\s*=\s*['"]https?://[^'"]{0,40}\.php['"][^/]{9,80}(?:height|width)\s*=\s*['"]?[0-2]['"]>\s*</iframe>['"]\)\s*;\s*</script>(?:\s*<!--/\12)?(?<X1126822>)|\s*(visitorTracker\s*-->)\s*<\?(?:php|=)?\s+@?\w{1,40}\([^6\n\?\{\[]{9,99};\s*echo\s+base64_decode\s*\(['"][^'"\);]+['"]\);\s*\?>(?:\s*<!--/?\s*\14)?(?<X1133541>)|\s*\(function\s*\(\s*(\w{1,40})\s*\)\s*\{\s*var\s*(\w{1,40})\s*=\s*\(?\s*['"][^'"]{49,999}['"]\s*(?:\)|;)(?:\.replace\s*\(\s*\16\s*,[^\)]{2,20}\);?|eval\s*\(\s*unescape\s*\(\s*\17){2}[^>]{2,20}-->(?<X1127491>)|\s*Mirrored\s*from\s*(?:www\.)?bankofamerica\.com/online-banking/sign-in/(?<X2051941>)|\s+Mirrored\s+from\s+www\.temredecardpassahipercard\.com\.br(?<X2123730>)|\s+saved\s+from\s+url\s*=\(\d+\)\w{1,40}:[^:]{1,200}<title>\s*(?:OTHER|WINDOWS|GMAIL|YAHOO|GOOGLE|MICROSOFT|AOL)\s+SIGN\s+IN\s*</title>\s+<meta\s+name="GENERATOR"\s+content="Created\s+by\s+BlueVoda(?<X2065530>)|codes_iframe-->\s*<script\s+type="text/javascript">.{1,1100}</script>\s*\w{0,40}<!--/codes_iframe-->(?<X1043444>))|[\-\d\w]{5,15}><(script)[^>]{9,50}>\s*document\.write\(['"]<(iframe)\s*src=['"]https?://[^'"]{9,99}\.php['"][^>]{0,50}(?:width|height)=['"](?:0|1)['"][^>]{0,50}style=['"]display:none['"]></\24>['"]\);</\23><![/\-\d\w]{5,15}>(?<X1127621>)|[^>]{0,40}\bFierzaXploit/Mr\.MF33\b[^\?]{9,99}<\?=\s*@?(null);\s*echo\h*@?\26;(?<X2210494>)|[^>]{1,15}><script>\w{1,5}=\(\[\]\.slice[^\{]{9,170}\{(\w{1,5})=window[^\{]{1,50}\{\w{1,5}=\28\.eval[^\[]+(\w{1,5})=\[[\d\.k'"\+]{99,4500}\];\29=\29\[\d\]\.split\([^>]{9,80}\w{1,5}\(\w{1,5}\);</script><![^>]{1,15}>(?<X1129621>)|\-\-(?:(\w{4,9}\-\->)\s*<script>\s*var\s*(\w{1,9})\s*=\s*document\.createElement\(\s*["']iframe['"]\s*\)[^:]{9,60}src['"],\s*['"]https?://[^/]{2,40}/[\w]+\.php['"]\s*\);[^/]{9,160}?\32\.style\.\w{4,5}\s*=\s*['"]-\d+px[^!]{9,99}?getElementById\([^\)]{1,40}\)\.appendChild\(\32\);\s*</script>\s*<!\-\-/\31(?<X1059102>)|\h*#(?:exec|include)\h+(?:cmd|virtual)=\$\w{1,40}\h+(\-\->)[^\?@\}\{]{1,999}<!\-\-\h*#(?:exec|include)\h+(?:cmd|virtual)=\$\w{1,40}\h+\34(?<X2174130>)|\h*mass\h*deface\h*\-\->(?<X2177213>)|\s*[CDFHS](?:reat|efac|[au]ck|tamp)e?d?\s*by\s*[^\s\->]{1,99}\bxploitsecid\.[a-z\.]{2,9}\b(?<X2170761>)|\s*author[\s:]+Unknown45\s*\-\->(?<X2280390>)|\s*Scam\s+made\s+by\b(?<X2166372>)))|%(?:@page\s[^\!]{1,999}!\s*(?:\s*/\*\*.{1,200}\*/\s*)?(private\s+static\s+final\s+String\s+PW)\s*=\s*['"][^'"]{1,40}['"];\s*[^\s]{0,40}\s*\40_SESSION_ATTRIBUTE\s*=\s*['"](?:JspSpy|supersuper)\w{1,9}['"];(?<X2057056>)|\s*(?:eval(?:\s*request\([^)]{1,30}\)\s*%>(?<X2049951>)|\s+Request[\h\(]+['"][^'"]+['"][\h\)]+%>\s*\Z(?<X1206570>))|Function\s+(MorfiCoder)\([^\)]{1,40}\)\s+\44\s*=\s*Replace\(\s*Replace\(\s*StrReverse\([^\)]{1,40}\)\s*,[^%]{1,200}\s*%>(?<X1055340>)))|((?:title|center)>)hidden\h*uploader</\46(?<X2178150>)|(?:(title|br|div|font)>)[^<]{0,6}(?:hack|own|fuck|defac|pwn)ed\h*by\h*[^<]{0,6}fr[4a]ns_n[3e]t</\48>(?<X2181531>)|(?:b|font|title)>(?:edit|hack|fuck|pwn|touch)ed\h*by\h*the\W{0,5}big\W{0,5}cave</[^\?]{0,199}\bif\h*\(\h*!?\$mail\h*\->\h*send\(\)(?<X2176492>)|(?:center|title)>\s*Upload(?:er)?\s+(?:by|[^\d]{0,3})\s+Hashor\s+W(?:4|A)s\s+H(?:3|e)r(?:3|e)(?<X2063460>)|(?:font|div)[^>]+>\s*\./Key[sz]Net\W{0,6}407\h+Authentic\h+Exploit\b(?<X2159201>)|(?:h1|title|div)>ghost\h*exploiter\h*team(?<X2174680>)|(?:h\d|title)>\s*Moshkela\s+Hacker(?<X2054150>)|(?:meta\b[^>/]{1,199}\bcontent\h*=\h*['"]|(?:font|center|h\d|title)\b[^>/]{0,99}>\s*)(?:hack|defac)e?d?!?\s+by(?:\b|_)[^/<]{0,40}/?[<>](?<X2264980>)|(?:meta|title|font)[^>]{1,49}\b[heftod](?:(?:acked|ckd|ncrypted|vckd|ested|wned|ouched)\h*by|efacer?)[^<]{0,150}<[^\\]{99,9999}\bIndoXploit\b(?<X2138842>)|(?:p|div)\s*style\h*=\h*['"][^>]{0,50}\b(?:height|width):\h*0[^>]{0,49}>\s*(?:<a\h*title[^>]{0,170}>[^<]{1,40}</a>(?:</div>)?\s*){8,}</(?:div|p)>(?<X1193242>)|(?:p|marquee|div)\h*(?:class[\h=]+['"]escort|style[\h=]+['"][^'"]{0,49}\b0\h*px)[^>]+>\s*(?:(?:<a[^>]{0,49}\bhref[\h=]+['"]https?://[^>]+>[^<]{0,49}\b(?:escort|seks|sex)\b[^/]{0,49}/a>\s*){1,5}[^#]{0,1300}\b(?:escort|seks|sex)</(?:p|marquee|div|a)>(?<X1201781>)|(?:<a[^>]{0,49}\bhref[\h=]+['"]https?://[^>]+>[^<]{0,49}\b(?:escort|seks|sex)\b[^<]{0,49}</a>\s*){1,5}[^#]{0,99}</(?:p|marquee|div)>(?<X1200561>))|(?:title|b|h\d*)>[^</]{0,9}\b(?:crew|team|e?xploiter)\b[^\}\\]{99,600}\{[^\[]{0,20}\b(?:copy|move_uploaded_files)\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\],\60(?<X2180450>)|([^>]+)>[^>/]{2,20}\bShell\W{0,9}</\62>\s*<a\h+href=['"](?:https?://)?zerolearn\.blogspot\.(?<X2165041>)|([uo]l)\b[^>]*\bstyle=['"](?:[^'"]*\b[tlbr](?:eft|ight|ottom|op)[\h:]+\-\d{4,}(?:px|em)\b){2}[^>]+>\s*(?:<li\b[^>]*>\s*<a\b[^>]*\bhref=['"]?https?://[^>]*>[^<>/]{0,199}</a>\s*</li>\s*){25,}</\64>(?<X1200630>)|(\w{1,5})\h*style[\h=]+['"]position:[^;]+;\h*\w+:\-\d{4,}+px['"]>(?:[^<]{0,199}<a\h*href[^>]{0,99}>[^<]{0,99}</a>){2}[^\n]{0,199}\b(?:rolex|fake)\b[^\n]{99,1500}</\66>(?<X1223173>)|(\w{1,9})(?:\b(?:[^>](?!class=)[^>]{0,99}\bstyle=['"](?:[^'"]{0,49}\b(?:height|width)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>\s*(?:<a\h*href\h*=\h*['"]([^'"]+)['"][^>]{0,199}>\s*\69\s*</a>\s*)+</\68>(?<X1196661>)|[^>]{0,99}\bstyle(?:=['"](?:[^'"]{0,49}\b(?:height|width)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>[^</]{0,99}(?:<a\b[^>]{0,99}\brel=['"]dofollow['"][^>]{0,99}>[^</]{0,99}</a>[^</]{0,99})+</\68>(?<X1196551>)|\h*=['"][^'"]{1,20}\b(?:left|right|top|bottom)\h*:\h*\-\d{4,8}(?:px|em)\b[^>]{0,99}>[^>\v]{0,99}(?:<a\b[^>]{0,99}\bhref\h*=\h*['"]https?://[^'"]{1,49}/(?:buy\w+online|jersey|viagra|cialis|pharm|levitra|cheap)/['"][^>]{0,99}>[^<]{0,49}</a>[^<\v]{0,199}){4,}</\68>(?<X1190154>)))|\h*style[\\\s='"]+[^"]*position[\s:]+absolute[;\s*]+left[\s:]+\-\d{3,6}p?x?[^>]+[^<]+<a[^>]+https?://[^<]+</a>[^<]+</\68>(?:[\\rn]+<a\h*href=[\\'"]+https?://[^\/]{1,20}\/[^'"]{30,100}[^>]>[^>]{1,20}</a>)?(?<X1262236>))|(article)\h*style[\h=]+['"]display[:\h]+none;['"]>\s*(?:<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,49}\bescort[^<]{0,49}</a>\s*<(span)>,</\75>\s*){5}[^\?#%&]{999,9000}\bescort\b[^<]{0,40}</a>[^\?#%&]{0,500}</\74>(?<X1220250>)|(center>)[^\.\v;]{0,9}\./\w{1,20}exploit\h*</\77[^;]{1,99};\s*\bfunction\s*perms\h*\((?<X2180311>))
<(?:(div)(?:[^>]{0,99}><(script)>\s*var\h*\w{1,15};\s*new\h*self\[[^\]]+\]atob\(['"]aWYobmV3IFJlZ0V4cCgiY2hlY2tvdXQiKS[^'"]{99,250}['"]\)\)\.call\(this\);\s*</\2></\1>(?<X1202560>)|\h*(?:id=(['"]\w+["'])><div\h*style=['"]display:None;['"]>(?:<(strong>)<a\h*href=['"][^'"]+['"]>[^<]+</a></\5){10,40}</\1></\1><(script)[^>]*>\s*if\([^'"]{9,99}\bdocument\.getelementbyid\(\4\)\.style\.display=['"]none['"];</\6>(?<X1216921>)|style(?:=['"]display:none;?['"]><(script)[^>]{0,35}>\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'"]{9,99}\.(?:png|jpe?g|ico|gif|bmp)['"]\)?;</\8></\1>(?<X1147920>)|[\h=]+['"]display(?::(?:\h*none(?:;?['"]>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{9,150}>[^<]{0,40}(?:masaj|escort|eskort|mutlu)[^<]{0,40}</a>\s*){15}[^\?]{0,}\b(?:masaj|escort|eskort|mutlu)[^<]{0,40}</a>\s*</\1>(?<X1215101>)|;['"]>\s*(?:(?:(?:<li>)?<a\h*href[\h=]+['"](https?://[^'"]+)['"][^>]{0,99}>\11</a>(?:</li>)?\s*){4,45}</?\1>(?<X1211781>)|(?:<a\h*href[\h=]+['"]https:?//[^'"]+['"]>[^<]{0,49}\b(?:togel|slot\d*)\b[^<]{0,49}</a>\s*){4,10}</\1>(?<X1211941>)))|none(?:;['"]>\s*<a\h*href[^>]{0,99}>slot\h*Gacor</a>\s*</\1>(?<X1258020>)|['"]>(?:(?:\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>haberler</a>){15,}\s*</\1>(?<X1223151>)|[^#]{0,299}\bescort[^<]{0,40}</a>[^#]{0,399}\bhack\h*forum[^<]{0,40}</a>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}\btitle[\h=]+['"]([^'"]+)['"]>\16</a>\s*){3,}</\1>(?<X1223161>))))|(?:[\h*:]+none;['"]>\s*(?:(?:<a\h*href[\h=]+['"]https:?//[^>]+>slot[^<]+</a>\s*){2,5}</\1>(?<X1218860>)|(?:<p>\s*)?<a\h*href[\h=]+['"]https:?//[^>]+>slot[^<]+</a>\s*(?:</p>\s*)?(?:\s*(?:<p>\s*)?<a\h*href[\h=]+['"][^>]+>[^<]+</a>\s*(?:</p>\s*)?)+\s*(?:<p>\s*)?<a\h*href[\h=]+['"](?:https:?//)?[^>]+>slot[^<]+</a>\s*(?:</p>\s*)?</\1>(?<X1219600>))|[\h:]+none;?['"]>\s*(?:(?:<a[^>]{0,99}>slot\b[^<]{0,99}</a>\s*){2,9}(?:</\1>)?(?<X1223680>)|(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{0,40}\bcrack[ed]*\b[^<]{0,40}</a>\s*){2,9}</\1>(?<X1223561>)|<(\w+)>\s*<(\w+)><a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]+</a></\23>[^\?%&\(\)\{\}]{99,3500}\b(?:slot|gacor)[^<]+</a></\23>\s*<\23><a\h*href[^\?%&\(\)\{\}]{99,1500}\b\23>\s*</\22>\s*</\1>(?<X1232741>)|<a\h*href[\h=]+['"]https?://[^>]{9,99}>[^<]{0,40}\b(crack)\b[^<]{0,40}</a>[^\?]{150,500}\b\25\b[^<]{0,40}</a>\s*</\1>(?<X1226231>))))|[\h=]+['"]overflow:hidden;[^\?]{9,99}(?:<\1><(\w+)><(a)\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{1,99}</\28></\27></\1>\s*){3,10}</\1>(?<X1198160>)|[\h=]+['"]position:[^;"']+;\w+[\h:]+\-\d{5,}px;\w+[\h:]+0px;?['"]>\s*<\w+>\s*<(\w+)[^/]{0,99}href[\h=]+['"]https?://[^'"]+['"]>[^<]+</\30></\w+>[^\?%&\(\)\{\}]{99,2500}\b(?:slot|gacor)[^<]+</\30></\w+>\s*<\w+><\30[^/]+href[^\?%&\(\)\{\}]{99,1500}\b\30>\s*</\w+>\s*</\1>(?<X1261060>)))|\h+id\h*=[^>]{1,40}><a\h*href\h*=\h*['"][^<>]{1,99}["']visibility\h*:\h*hidden["'][^/]{1,99}/a><(script)>string\.prototype\.(\w{1,15})\h*=\h*(function)\(\)[^#]{9,199}\b\34\h*(\w{1,40})\(\)\{window\.top\.location\.href\h*=\h*\w\.\33\(\);\}\h*setTimeout\(\35,\d{1,4}\);</\32></\1>(?<X1161952>)|\s*style(?:=['"]display:none['"]>GIF89a?</\1><\?php\s*(array)_map\(['"][^'"]{0,15}['"],\h*\(\37\)\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\?>(?<X1147280>)|\h*=\h*['"][^'"]{0,99}\bheight\h*:\h*0pt;[^'"]{0,99}['"]>[^>]{0,99}\btitle\h*=\h*['"]([\w\-\.]{1,40})[^>]{0,49}>\39</a>[^<]{0,50}</\1>(?<X1198100>)))|(div\h*id\h*=['"])rightcol['"]>\s*<\41head['"]>\s*<(script)[^>]{0,99}>\s*(\w{1,25})\h*=\h*Math\.floor\([^\?]{0,199}\bdocument\.getElementById\(['"]\w+['"]\h*\+\h*\43\)\.style\.display\h*=\h*['"]none['"];\s*</\42>\s*<h\d>(?<X2184622>)|(div|p)(?:[^>]{0,99}\bstyle[\h=]+['"]display:\h*none;?['"][^>]{0,99}>\s*(?:<a\h*href=[^>]+>[^<]*\b(?:bocoran|reverse|deface)\b[^<]*</a>\s*){1,5}</\45>\Z(?<X1212560>)|\b(?:[^>]*\bstyle=['"]?display[:\h]+none\b[^>]*>(?:\s*<a\b[^>]*\bhref=['"]https?://[^>]+>[^</]{0,19}\b[sepf](?:ex|eks|orn|s[kc]ort|roti[ck]+|uc?k(?:ing)?)\b[^</]{0,19}</a>){20}[^\?#!\$]{499,}</\45>(?<X1202331>)|[^>]{0,99}\bstyle=['"](?:[^'"]{0,49}\b[hw](?:eight|idth)[:\h]+0\h*p[tx]\b){2}[^>]{1,99}>\s*(?:<a\b[^>]{0,199}\btitle=['"]([^'"]{0,49})['"][^>]{0,199}>\s*\48\s*</a>\s*)+</?\45>(?<X1196673>)))|(div|span|p)\s+style=['"]display[\s:]+none\b[^>]+>(?:\s*<a\b[^>]*\bhref=['"]?https?://[^>]+>[^></]{0,19}\b(?:bokep|escort|slot)\b[^</]{0,19}</a>){50}.{49999,}</\50>(?<X1210310>)|(div|span|p|section|aside)\b[^>]{0,99}\bstyle=['"][^'"]{0,99}\b(?:display:\s*none|font:\h*0px)\b[^>]{0,99}>\s*(?:<p[^>]+>\s*)?(?:<a\b[^>]{0,150}\bhref=['"]?https?://[^>]{1,99}\btitle=['"]([^'"]{0,99}\b(?:se(?:ks|xy?)|porno?|escort[sz]?)\b[^'"]{0,99})['"][^>]{0,99}>\s*\53\s*</a>\s*){5,}(?:</p>\s*)?</\52>(?<X1190983>))
<(?:(FilesMatch)(?:\h*(?:"(?:\.\([^\)]{0,99}\b(?:php\d*\|){2}[^\)]{1,99}\)\$">[^<]{0,99}\bdeny\h*from\h*all\s*</\1>\s*<\1\h*"\^\((?:[^\)]{0,999}\b[rj]index\.php\|){2}[^\)]{99,999}\)\$">[^<]{0,99}\ballow\h*from\h*all\s*</\1>(?<X1215991>)|\^\((?:[\w\-]{1,15}\.php\|){4,8}\bmoni\-skxa\.php[^\$]+\$">\s*Order\h*Allow.Deny\s*Allow\h*from\h*all\s*</\1>(?<X1201740>)|\^\([^\)]{9,299}\b(?:moon|my\d+)(\.php\|)(?:[^\|]+\4){3}[^\)]+\)\$">\s*(Order\s+allow[,\s]+deny)\s*(allow(\s+from\s+all))\s*</\1>\s*<\1\s+"\.\([^\)]{0,99}\b(?:php\d*\|){2}[^>]+>\s*\5\s*Deny\7\s*</\1>\s*<\1\s+"[^'"]+\b(?:moon|my\d+)\4(?:[^\|]+\4){3}[^\)]+\)\$">\s*\5\s*\6\s*</\1>(?<X1215972>))|['"](?:[^\(]+\(\?\w:[^\)]*\bsuspected\|[^\)]+\)\S['"]>\s*[^<]{1,99}\bAllow\h*from\h*all\s*</\1>(?<X1202230>)|\^\((?:xmrig|1\.mcm\.x86_64|conf|admin|confcom)[\.ph]*\)\$["]>\s*Order\h*Allow\h*,\h*Deny\s*Allow\h*from\h*all\s*</\1>(?<X1252060>)|\^\(\w+\.php\|[^\)]{0,99}\bstyle_c4\.php[^\)]{0,99}\)\$['"]>\s*Order\h*allow,\h*deny\s*Allow\h*from\h*all\s*</\1>(?<X1257241>)))|\s*['"](?:\.\((?:(?:[parhstml\d\.]{3,}\|+){19,}[parhstml\d\.]{3,}\)\$['"]>\s*(Order\s*allow\s*,\s*deny)\s*Deny\s*from\s*all\s*</\1>\s*<\1\s*['"]\^\((?:[^\)\|\$]{1,19}\.(?:php|[ps]html)\|){2,}[^\)\|\$]{1,19}\.(?:php|[ps]html)\)\$['"]>\s*\12\s*Allow\s*from\s*all\s*</\1>(?<X1268342>)|[^\)\.\-]{9,}\)\$['"]>\s*(Order\s*Allow,Deny)\s*Deny\s*(from\s*all)\s*</\1>\s*<\1\s*['"]\^\([^\)\$\*]{4,}\.(?:php|[ps]?html)\)\$['"]\s*>\s*\14\s*Allow\s+\15\s*</\1>(?<X1221992>)|p[hy][^\)]+\)\$['"]>\s*(Order\s*allow,deny)\s*Deny\s*from\s*all\s*</\1>\s*<\1\s*['"](?:\((?:\^?[\w\-\.]{1,49}\.ph(?:p|tml)\|){3,}[\w\-\.\^\|]+\)\$['"]>\s*\17\s*Allow\s*from\s*all\s*</\1>(?<X1226131>)|\^\((?:[\w\-\.]{1,49}\|){3,}[\w\-\.]{1,49}\)\.php\$['"]>\s*\17\s*Allow\s*from\s*all\s*</\1>(?<X1222082>)))|(?:\.\*\\\.\(py\|exe\|phtml(?:\|php){4}[^\)]+suspected\)\$['"]>\s*Order\s*Allow,Deny\s*Deny\s*from\s*all\s*</\1>\s*<FilesMatch\s*['"]\^\(?index\.php\)?\$['"]\s*>\s*Order\s*Allow,Deny\s*Allow\s*from\s*all\s*</\1>(?<X1249650>)|\\?\.\(php\|(?:[^\(\)\|]{3,12}\|){9,}[^\)]+\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Deny\s*from\s*all\s*</\1>\s*<\1\s+['"]\^\((?:[^\|\)\$]{1,40}\.(?:xml|php|txt)\|)+\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Allow\s*from\s*all\s*</\1>(?<X1272440>)|\\?\.\*\\?\.\(py\|(?:[^\|\{\}\$]+\|){8,}[^\)]*\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Deny\s*from\s*all\s*</\1>\s*<\1\s*['"]\^\((?:[^\|\(\)\$]+\.(?:php|txt|ico)\|?)+\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Allow\s*from\s*all\s*</\1>(?<X1272460>)|\\\.\(php\|(?:[^\(\)\|]{3,12}\|){9,}[^\)]+\)\$['"]>\s*Deny\s+from\s+all\s*</\1>\s*<\1\s*['"]\^\(\.\w+\.php\)\$['"]>\s*Allow\s+from\s+all\s*</\1>(?<X1271950>)))|\s+(?:"(?:\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>]+>\s*(Order\s+Allow[,\s]+Deny)\s*\s*Deny(\s+from\s+all)\s*</\1>\s*<\1\s+"\^\((?:[^\|\)]{0,49}\.php\d*\|){9}[^\)]{99,}\)\$">\s*\24\s*allow\25\s*</\1>\s*\Z(?<X1216400>)|\^\([^\)]{0,1999}\bm(?:oon|y\d*)\.php\d*\|[^\)]{1,}\)\$">\s*(Order\s+Allow[,\s]+Deny)\s*Allow(\s+from\s+all)\s*</\1>\s*<\1\s+"\.\((?:[^\)]{0,99}\bphp\d*\|){1}[^>]+>\s*\27\s*Deny\28\s*</\1>\s*<\1\s+"\^\((?:[^\|\)]{0,49}\.php\d*\|){9}[^\)]{99,}\)\$">\s*\27\s*allow\28\s*</\1>\s*\Z(?<X1216391>))|['"](?:(?:[^'"]{0,199}\b(?:ph(?:p|tml)\d?|py|exe\W)){3}[^'"]{0,499}\$['"][^>]{0,199}>[^</]{0,199}\bDeny\s+from\s+all\s*</\1>\s*<\1\s+['"][^'"]{0,199}\b(?:lock(?:666|360)|dropdown|wp\-blog\-header|versions?)\\?\.php\d*\b[^>]{1,499}>[^</]{0,99}\bAllow\s+from\s+all\s*</\1>(?<X1196089>)|(?:[^'"]{0,199}\b(?:php\d?|py|exe\W)){3}[^'"]{0,499}\$['"][^>]{0,199}>[^</]{0,199}\bDeny\s+from\s+all\s*</\1>\s*<\1\s+['"][^'"]{0,199}\|kill(?:\.php\d*)?\|[^'"]{0,99}\|wjsindex(?:\.php\d*)?\|[^\)]{0,99}\)\.php\d*\b[^>]{1,499}>[^</]{0,99}\bAllow\s+from\s+all\s*</\1>(?<X1217200>)|\.\((?:[^\)]{0,99}\bph(?:p\d*|tml)\|){2}[^"'\)]+\)\$['"]\s*>\s*(Order\s+Allow[,\s]+deny)\s*Deny\s+(from\s+all)\s*</\1>\s*<\1\s+['"]\((?:\^[\w\.\-]{2,99}\.ph(?:p|[578]|tml)\|){20,}\^[\w\.\-]{2,99}\.ph(?:p|[578]|tml)\)\$["']>\s*\32\s*Allow\s+\33\s*</\1>(?<X1218201>)|\.\((?:p(?:y|html|hp\d*)\|[^\)]{0,19}\b){4}[^\)\.]{0,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>\s*<\1\s+['"]\^\((?:[\w\-\.]{1,19}\|){5}[^\)]{1,499}\)\.php\d*\$['"]\s*>\s*\35\s+allow\s+\36\s*</\1>(?<X1223080>)|\.\((?:p(?:y|html|hp\d*)\|[^\)]{0,19}\b){4}[^\)\.]{0,99}\)\$['"]\s*>\s*Order\s+allow[,\s]+deny\s+Deny(\s+from\s+all\s*)</\1>\s*<\1\s+["']\^\((?:[^\|\)]{1,49}\.php\|){3}[^\)/<]{30,199}\bAllow\38\s*</\1>(?<X1222380>)|\.\(p[hy](?:[^\)]+\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>[^<>\)\(]{0,40}<\1\s*['"]\^\((?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){3,}[\w\-\.]+\)\$['"]\s*>\s*\40\s*Allow\s+\41\s*</\1>(?<X1222094>)|[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>[^<>\)\(]{0,40}<\1\s*['"]\((?:\^[\w\-\.]+\.php\|?){9,}\)\$['"]\s*>\s*\43\s*Allow\s+\44\s*</\1>(?<X1218920>)|[^\)]{99,}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>[^<>\)\(]{0,40}<\1\s*['"]\^\((?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){2,}[\w\-\.]+\)\$['"]\s*>\s*\46\s*Allow\s+\47\s*</\1>(?<X1226430>))|\.\(ph(?:[^\)]{1,199}\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>[^<>\)\(]{0,40}<\1\s*['"]\^\(\w{1,3}index\.php(?:\|\w{1,3}index\.php)*\)\$['"]\s*>\s*\49\s*Allow\s+\50\s*</\1>(?<X1218120>)|p(?:\|Php\d*){9,}[^\)]+\)\$['"]>\s*(Order\s+allow\s*,\s*deny)\s+Deny\s+(from\s+all)\s+</\1>\s*<\1\s+['"]\^\([^\)]+\)\$['"]\s*>\s*\52\s+Allow\s+\53\s*</\1>(?<X1221190>))|\.\*.\.\(p[hy]\|[^\)]{30,199}\|suspected\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>\s*<\1\s+['"]\^\([\w\-\.]{1,12}\.php(?:\|[\w\-\.]{1,12}\.php){4,}\)\$['"]>\s+\55\s+allow\s+\56\s+</\1>(?<X1218340>)|\.\*\\\.\(p[hy][^\)]+\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s+Deny\s+(from\s+all)\s*</\1>[^<>\)\(]{0,40}<\1\s*['"]\^\((?:(?!index)(?:[\w\-\.]+\.ph(?:p\d{0,2}|tml)\|+){2,}[\w\-\.]+\)\$['"]\s*>\s*\58\s*Allow\s+\59\s*</\1>(?<X1226440>)|(?:[\w\-\.]+\.php\|){3,}[\w\-\.]+\)\$['"]\s*>\s*\58\s*Allow\s+\59\s*</\1>(?<X1223720>)))))|(font|title|center)[^>]{0,40}>\bcoded\h*by\s*Naufal\h*Ardhani[^<]{0,49}</\62>(?<X2179000>)|(h1)\h*onclick\h*=\h*['"](\w{1,9})\([^>]{9,150}>Sec666host</\64>\s*<script>\s*var\h*\w{1,9}\h*=\h*document\.getElementById\([^\)]+\);\s*function\h*\65\((?<X2147200>)|(html)>[^\?]{9,99}\bmeta[^>]{1,40}\bURL\h*=\h*['"]?(https?://[^/]{0,15}\bdot\.tk/)[^@]{9,199}\bfunction\h+(\w{1,15}\(\))\s*\{\s*var\h*\$\w{1,15}\h*=\h*['"]\68[^#]{99,299}\bwindow\.setTimeout\(['"]\69[^#]{9,80}</\67>(?<X1161782>)|(ifModule)[^>]+>\s*RewriteEngine\h*on\s*RewriteCond\h*%\{[^\}]+\}\h*(?:YandexBot|Googlebot|bingbot)\h*\[[^<]{9,199}\bRewriteRule[^/]{1,40}//apachehosting\.eu/\?aid=[^<]{1,99}</\71>(?<X1199150>)|(iframe)(?:(?=[^\?>]{0,99}\.ru)\h*(?:id=['"]a\d+['"]\h*|src=['"][^\.]{1,25}\.ru/[^\.]{1,5}\.html\?a=\d+['"]\h*|style=['"]display\h*:\h*none;?['"]\h*|(?:width|height)=['"]\d+['"]\h*){3,5}></\73>(?<X1154517>)|[^>]{0,49}\bsrc\h*=\h*['"]https?://[^/]{0,15}\btop4top\.(?:io|net)/m_[^>]{0,99}></\73>(?<X1161021>)|[^>]{0,99}\bsrc\h*=\h*['"](?:https?:)?//eiueuiuewi\.com/[^>]{0,99}></\73>(?<X1162980>)|\h*id=['"]a\d+['"]\h*(?:src=['"]https?://[^\.]{1,15}\.ru/[^\.]{1,5}\.html['"]\h*|style=['"]display:\h*none;?['"]\h*|(?:width|height)=['"]\d{1,5}['"]\h*){4}></\73>(?<X1154524>)|\h+(?:(?:\w{1,9}\h*=\h*['"]\w{1,40}['"]\h*)?src\h*=\h*['"]http:\h*//[^'"/;\?]{1,99}/\w{1,40}\.(?:php|cgi)\?[^'"\?]{1,40}['"]\h*(?:\w{1,9}\h*=\h*['"]\w{1,40}['"]\h*)?(?:\h*(?:style|width|height)\h*=\h*['"]\h*(?:display\h*:\h*none(?:\h*;)?\h*['"]|[012]\h*['"])){1,3}\h*>\h*</\73>(?<X1141505>)|(?:src\h*=\h*['"]https?://(?:www\.)?100cal\.co\.il/?['"]\h*|height\h*=\h*['"][^'"]+['"]\h*|width\h*=\h*['"][^'"]+['"]\h*|title\h*=\h*['"][^'"]+['"]){3,4}>\s*</\73>(?<X1159441>))|\s*src=['"]https?://[^'"]{1,99}\.php\?key=\w{32}&u=\w+['"]\s*(?:(?:width|height)\s*=\s*['"][012]['"]\s*)+[^>]{9,99}>\s*</\73>(?<X1197361>)))
<(?:(marquee)(?:[^>]{0,49}\b(?:width|height):\h*0\h*px[^>]{0,49}>(?:<script[^>]{0,59}>\s*document\.write\(unescape\(['"](?:%3C%61|%3C%64%69%76)%20[^'"]{99,4999}['"]\)\);\s*</script>\s*){1,3}</\1>(?<X1189852>)|\h*style[\h=]+['"](?:[^'"]{0,49}\bwidth:\h*0px[^>]{0,49}>\s*(?:<a[^>]+>[^<]+</a>\s*){15,}</\1>(?<X1201121>)|[^'"]{0,99}\b(?:width|height):\h*0px;[^'"]{0,99}['"]>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{5,55}</a>\s*){1,5}<a\h*href[^>]{1,99}>[^<]{1,55}\b(?:escort|sex|seks)</a>\s*</\1>(?<X1203010>))|\h+style\h*=\h*['"]position\h*:\h*absolute;(?:\h*(?:width|height)\h*:\h*0px;)+\h*['"]\h*>(?:\s*<!\-\-[^\->]*\-\->\s*)?[^\n\$\{\}\*]{999,1999}</a>[^<>]{0,499}</\1>(?<X1192571>))|(ol|div)[^>]{0,199}\bstyle=['"]display:\h*none\b[^>]+>(?:\s*<(?:li|p)[^>]*><a\h*href=['"]https?://[^'"]+['"]>[^<]{0,499}\b(?:game|slot|gacor|poker|rtp)\b[^<]{0,499}</a></(?:li|p)>){5}[^\?]{0,1500}</a>\s*</(?:li|p)>\s*</\6>(?<X1209653>)|(p)\h*style=['"][^'"]{0,59}\bwidth:\h*0p[tx][^'"]{0,59}['"]>[^@]{0,800}(?:<a\h*href=[^>]+>[^<]{0,49}\b(?:escort|porn|erotik|seks)[^<]{0,49}</a>\s*){3,15}</\8>(?<X1200880>)|(p|div)\b[^>]*\bstyle=['"](?:[^'">]*\b[tlrbhw](?:op|eft|e?ight|ottom|idth)[\h:]+(?:\-\d+|0)p[xt]\b){2}[^>]*>[^@#]{0,999}<a\b(?:[^>]*\bhref=['"]https?://[^>]+>[^</]{0,19}\b[sepf](?:ex|eks|orn|scort|roti[ck]+|uc?k(?:ing)?)[^</]{0,19}</a>\s*<a\b){10}[^@#]{1,}</\10>(?<X1201890>)|(script)(?:><(fscy)\[['"]length['"]\];(\w{1,9})(\+=)\d\)\w{1,9}\15\13\.charCodeAt\(\14\)[^\)]{9,70}\)(\w{1,9})\15String\.fromCharCode\(parseInt\([^;]{9,70};document\.write\(\16\);['"];eval\(\13\);</\12>(?<X1142582>)|>?\h*(?:type\h*=\h*['"]text/javascript["']\h*|async\h*)+src\h*=\h*['"]https?://\w{1,9}\.d(?:igestcolect|eveloperstatss)\.\w{2,9}/[\w\-\.]{1,5}\.js\?\w{1,5}=[\d\.\w]+['"][^>\n\r]{0,60}>?</\12>(?<X1151573>)|>(?:\(function(?:[^\{]{0,50}\{\s*const\h*(\w+)[\h=]+\[\s*[\\'"]+https?://ois\.is/[^<]{999,4000}\bvisitNeWLocation[\h\(]+\19,\h*\w+,\h*\w+[\h\)]+;[\s\}]+document\.addEventListener\(\\?["']click\\?['"],\h*globalClick\)\s*[\s\}\)\(]+</\12>(?<X1219085>)|\(_0x\w+,_0x\w+\)\{var\b[^\n]{999,5000}\bnew\h*Date\(\)/0x\w+\);\h*_0x\w+\[[^\n]{99,600}\bencodeURIComponent\(document\[['"]title['"][^\n]{1500,4000},['"]R_PATH['"]:['"]https?://[^\n]{999,2000}\bvar\h*(_0x\w+)=document\[[^;]+;\h*\21\[[^\]]+\]\[['"\+insertBfo]+\]\([^\)]+\);[\}\(\)]+;</\12>(?<X1223302>)|\s*\([^\{]{0,50}\{\s*const\s+(\w+)[\h=]+[^<@#%]{99,1999}\bconst\s+(visitNeWLocation)[\s=]+\(\s*\23\b[^\?<!%&]{1,399}\bwindow\.open\s*\([^<@#%:!]{99,1999}\b\24[\h\(]+\23,[^;]{1,99};[\s\}]+document\.addEventListener[\s\(]+\\?["']click\\?['"][\s,]+globalClick[\s\);\}]+\(\s*\)(?:;\s*)?</\12>(?<X1220571>))|\h*(?:(var)\h*a\d*=['"]{2};\h*setTimeout\(\d+\);\s*\26\h*(default_keyword)\h*=\h*encodeURIComponent\((document\.)title\);\s*\26\h+se_referrer[^/\?]{99,199}['"]\?\27=['"][^/\?]{9,99}\26\h+(\w{1,40})\h*=\h*base\h*\+\h*['"]\?[^/\?]{99,199}\{\h*\28write\(['"]<\12[^;]+\29[\+\h'"><script\)/;]{9,40}\}\h*</\12>(?<X1154581>)|document\.write[\h(]+String\.fromCharCode[\h\(]+60,115,99,114,105,112,116,62,118,97,114,32,95,36,95,97,55,57,56,61,91,34,92,120,50,69,34,44,34,92,120[^\)]{999,5500}41,60,47,115,99,114,105,112,116,62[\h\)]+;\h*</\12>(?<X1250621>))|\s*(?:(?:/\*[^\*]{0,9}\*/)\s*try\s*\{\s*window\.onload\s*=\s*function\(\)\s*\{\s*var\s+(\w{1,20})\s*=\s*(document\.)createElement\([^;]+\);\s*(\32\.setAttribute\(['"])type['"],\s*['"]text/javascript['"]\);\s*\34src['"],[^\?]+\);\s*\33body\.appendChild\(\32\);\s*\}\s*\}\s*catch\(\w\)\s*\{\}\s*</\12>(?<X1063892>)|(\$\w{1,15})\h*=\h*function\(\w\)\s*\{\s*if\h*\(typeof\h*\(\36\.(list)\[[^<]{1,99}\36\.\37\h*=\h*\[['"]\\['"]php\.\w{1,15}/[^\]]{0,99}\.[document\.lai]{17}['"]\];\s*var\h*\w{1,15}\h*=\h*Math\.floor\([^<]{0,99}\bsetTimeout\(\36\(\d+\),\h*delay\);\s*\}\s*</\12>(?<X1186781>)|(\$\w{1,25})\h*=\h*function\(\w\)\{\h*if[\(\h]+typeof[^\}]+\};\h*\39\.list\h*=\h*\[['"\\]+php\.noitalsnart/cni[^>]{9,199}\bsetTimeout\(\39\(\d\),\h*delay\);\}</\12>(?<X1184733>)|\(\s*function\(\w,\w,\w,\w\)\h*\{[^\}]{9,99}\}\s*\)\s*\(\s*document\.createElement\(\h*['"]\12['"]\h*\)\h*,\h*['"]https?://iclickcdn\.com/[^'"]{1,15}\.js['"][^<]{1,99}</\12>(?<X1160735>)|\(function(?:\(\w{1,40}[\s\)\{]+var\h*(\w{1,9})[\h=]+document,\s*(\w{1,9})[\h=]+\42\.createElement\(['"]\12['"]\)[^<>]{1,99}\43\.src[\h=]+['"][^'"]{0,19}\bapprefaculty\.pro\b[^'"]{0,199}['"];\s*(\w{1,9})\.parentNode\.insertBefore\(\43,\h*\44[\);\}\s\(\{]+</\12>(?<X1196581>)|\s*\([\w\d,\s]+\)\s*\{[^\{]{10,100}getElementByID[^\{]{1,20}\{[^\{]{10,100}\{\s*\w{1,20}\(['"][^'"]+['"],\s*['"]web['"],\s*\d+\);[^=]{10,100}src\s*=\s*['"](?:http)?s?:?//(?:\w+\.)?trustisimportant\.fun/[^'"]+['"];[^<]{10,100}<\/\12>(?<X1273490>))|\w\s*=\s*(document\.createTextnode)\([^\)]+\);[^-]{9,99};(\w{1,9})\s*=\s*\47\s*\([eval"'\+]{5,15}\);\s*(\w)\s*=\s*window\[\48\.nodeValue\];\s*\49\s*\(\s*String\.fromCharCode\s*\((?:\d{1,3}-\w,){19}[^\)]+\d{1,3}-\w\)\s*\);\s*</\12>(?<X1065273>)|const\s*(\w{1,14})[\s=]+\[\s*93,\s*89,\s*89[\d,\s]{64,}\];\s*const\s*(\w{1,14})[\s=]+\d+;\s*window\.(\w{1,14})[\s=]+new\s+WebSocket\(\s*String\.fromCharCode\(\.{3}\51\.map\(\s*(?:\()?(\w{1,8})(?:\))?[\s=>]+\54\s*\^\s*\52[^\{]{9,150}\w+\.\53\.addEventLi\w+\(['"]message['"],[^\}]{8,64}[\}\);\s*]+</\12>(?<X1266545>)|document\.write[\h\(]+atob[\h\(]+['"]PHNjcmlwdCB0eXBlPSd0ZXh0L2phdmFz[^'"]{0,199}ZmYuanMnPjwvc2NyaXB0Pg==['"][\h\)]+;\s*</\12>(?<X1258060>)|function\s*(_0x[\da-f]+)\([^\(]{9,99}\(\);\s*return\s*\57[=\s]+function[^\}]{9,200}\}[^\}]{9,99}\}[^\}]{99,999}\}[^=]{9,99}const\s*\w{1,14}[=\s]+\[[\dxa-f,]+\][,;]\s*\w{1,14}[=\s]+[x\da-f]+;\s*window[\.\['"]+\w{1,14}[\]'"\s]+=\s*new\s*WebSocket[^</]{9,200}addEventListener[^<]{9,500}</\12>(?<X1273221>)|var\s*(\w{1,14})\s*=\s*eval;\s*var\s*(\w{1,14})\s*=\s*String;\s*var\s*(\w{1,14})\s*=\s*['"]fromCharCode['"];\s*var\s*(\w{1,14})\s*=\s*\60\[\61\]\([\d,]+\);\59\(\62\);</\12>(?<X1278730>)|var\s+\w\s*,\s*(\w)\s*=\s*Math\.atan\s*\(Math\.tan\s*\([^\)]+\)\s*\);[^;]{1,30};\s*\64\s*=\s*Math\.ceil\s*\((\w)\);\s*(\w{1,9})\s*=\s*document\.createTextNode\s*\([eval"+]{6,15}\);\s*(\w)\s*=\s*window\[\66\.nodevalue\];\s*\67\(string\.fromCharCode\((?:\d{2,3}\+\65,){200}[^\)]+\)\s*\);\s*</\12>(?<X1065262>)|window\.location\.href\s*=\s*['"]https?://adfoc\.us\/[\w\d]+['"];\s*</\12>(?:\s*</head>\s*</html>)?(?<X1282770>)|ZnVuY3Rpb24gbG9jYWxfc[^<]{1,1256}X3IoKTs=\s*</\12>(?<X1258290>))|\W{0,20}var\s*\w{1,40}\s*=\s*(document)\s*,\s*\w{1,40}\s*=\s*\d{1,5};\s*[^/!]{49,149}return\(\s*parseint\(\s*\w{1,40},\w{1,40}\(?[\)\s]{2,6};\}\s*function\s*(\w{1,40})\b[^/]{99,399}\}\s*\71\.write\(\s*\72\(\s*['"]\w{199,499}['"]\)\);[^<]{1,9}<\s*/\12>(?<X1130292>))|[^.\?;]{0,60}\bsrc=['"]//\w{1,20}\.bilsyndication\.\w{2,4}/\w{1,4}/\?\w{1,4}=\w{32}['"][^>/]{2,40}>\s*</\12>(?<X1177410>)|[^/]{4,64}//(?:\w+\.)?cloudswiftcdn\.com/?['"]>\s*</\12>(?<X1262471>)|[^:>;]{1,60}\bsrc\h*=\h*['"]https?://(?:\w{1,9}\.)?(?:blackentertainments\.\w{2,6}/\w{1,9}\.(?:js|php)\?\w{1,9}=[\w\.&%=]{1,40}['"]\h*>\s*</\12>(?<X1176470>)|moby\-aa\.\w{2,6}/(?:\w{1,9}\.)?(?:js|php)\?\w{1,9}=[\w\.&%=]{1,40}['"]\h*>\s*</\12>(?<X1176550>))|[^:>]{1,60}src\h*=\h*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/hengfu\.js['"]\h*[^:>]{1,60}></\12>(?<X1141920>)|[^<>]{1,100}src\h*=\h*['"]https?://(?:\w+\.)?cdnstatics.net[^'"]{1,20}['"]\h*>\h*</\12>(?<X1281291>)|[^>\.:]{1,99}\bsrc\h*=\h*['"][^'"]{1,60}/(?:\w{2}/){3}\w{32}\.js['"]></\12>(?<X11640212>)))
<(script)(?:[^>]*>(?:\(function\([^\)]+\)[\{\s]+const\h*(\w+)=\[(?:[\\'"\s]+https?://ois\.is/images/[\w\-]{1,40}\.(?:png|jpe?g|ico|gif)[\\'"\s]+,?){1,6}\][^\?<\\]{999,2500}\b\w+\(\2,host(?:name)?,\w+\);[\}\s]+document\.addEventListener\(['"]click['"],globalCLick\)\}\)\(\)</\1>(?<X1217970>)|\s*!?(function)\([^\)]+\)\s*\{\s*!?\4\h+\w\([^\)]+\)\s*\{\s*(\w)=(\w)\.[^,]{2,30},\((\w)=\6\.createElement\(\w{1,4}\)\)\.async=[^,]{1,2},\7\.src\h*=\h*['"]https?://[^\}]{9,99}\}\h*,\h*\5\.parentNode\.insertBefore\(\7,\5\)\s*\}\(window,document,[^\[]+,\[[^\]]+\],\d\)\}\(\);\s*</\1>(?<X1177402>)|\s*\w=\-parseInt\([^;]{2,9};\s*if\(window\[[^@,%]{9,150}\b(f)=['"fromCh\+]{7,15};\s*\9\+=['"]arC['"];\s*\9\+=['"]qgode['"]\[['"](substr)['"]\]\(\d+\);(\w)=this;\s*\w=\11\[\9\.\10\(\d+\)[^\}@]{2,20}\}\s*\w=['"][\d\.@]{999,4000}['"]\[['"\+split]{7,15}\][^</]{30,150};if\((\w)\)\12\(['"]{2}\+\w\);\s*</\1>(?<X1160081>)|\s*document\.write\(unescape\(['"]%3c\1%20src%3d%22https?%3A(?:/|%2f){2}[^%]{9,30}(?:/|%2f)coinhive\.min\.js[^\.]{9,70}Coinhive\.(?:User|Anonymous)%28(%(?:27|22))\w{32}\14%2c[^\.]{9,60}\w{1,9}\.start%28%29[^;]{9,25};\s*</script>(?<X1125812>)|\s*eval\((function)\(p,a,c,k,e,d\)[\{\s]+\w=\16\((\w+)\)[\s\{]+return\h*\17[\s\}]+;if\([^\.]+\.replace\([^,]+,\w{1,20}\)\)[\s\{]+while\(\17[^#\$_]{999,2000}\);['"][\d,]+['"]\|\|[^'"]{9,500}\|(?:uads|xads_platf)\|[^'"]{1,500}\|(?:uads|xads_platf)[^'"]{0,500}['"]\.split\(['"]\|['"]\),\d+,\{\}\)+\s*</\1>(?<X1204240>)|\s*function\s+(\w{1,20})\(\w{1,20},\s*(\w{1,20}),\s*(\w{1,20})\)\s*\{\s*var\s+(\w{1,20})\s*=\s*\21\.split\(\20\);[^\{]{9,150}\{\s*(\w{1,20})\s*=\s*\22[^\.]{1,30}String\.fromCharCode\(\23\);[^_]{99,400}\w{1,20}\.innerHTML\s*\+=\s*\19\([^\)]+\)[^<]{99,400}(?:document\.getElementById|\w{1,9}\.split)\([^\)]+\);\s*\}\s*;\s*</\1>(?<X1124172>)|\s*if[\h\(]+screen\.(?:width|height)[\h<=>]+\d+\)[\{\s]+(window\.location)[\h=]+['"]https?://(?:x{2}|moli)[^/]{0,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top|bid|cf)/[^'"]{1,40}['"];[\}\s]+else[\{\s]+\25[\h=]+['"]https?://(?:x{2}|moli)[^/]{0,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top|bid|cf)/[^;]{1,20};[\}\s]+</\1>(?<X1208261>)|var\h*\w+=(\w+);\s*(function)\h*(\w{1,20})\(\)[\{\s]+var\h*\w{1,20}=\[[^;]{9,800},['"](?:bitcoin|etherium|litecoin|doge)['"][^;]{99,400}\];\s*\29=\28\(\)[\{\s]+[^\(]+;\s*return\h*\29\(\);[\}\s]+\28\27\([^\$]{400,1500},\$\(document\)\[[^\?\$]{999,3500}(?:case['"]\d*['"]:[^:]{9,400};){5}[^/]{9,900}\bcase['"]\d+['"]:[^\)]{9,40}continue;[\}\s]+break;[\}\)]+;</\1>(?<X1208160>))|[^>]+>\s*;\(function\(\w,\w,\w.[^\)]+\)\{\w=\w\.createElement\([^\n/<]{9,150}//[^/]+/\w+\?ref_id=\w+&scr_id=\w+&base_id=\w+&campin_id=\d+&[^\n<]{0,150}\bwindow\.location\.search\.replace\([^;]+;\s*</\1>(?<X1255491>)|[^>]{0,150}\bsrc\h*=\h*["']https?://\w{1,20}\.[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml|com)/\w{1,20}\.js\?\w=(?:[a-z]{2}\d|[a-z]{3})['"][^>]{0,150}>\s*</\1>(?<X1164238>)|[^>]{0,25}>(?:\s*(?:document\.write\(['"]\\u[\\u0-9a-f]{1,99}\\u003C\\u0074\\u0069\\u0074\\u006C\\u0065\\u003E\\u004D\\u0072\\u002E\\u0070\\u0033\\u006D\\u0075\\u0031\\u0034\\u0020[\\u0-9a-f]{999,}['"]\);\s*</\1>(?<X1130303>)|eval\((function)\(p,a,c,k,e,[dr]\)\{\w=\34\((\w)\)\{return\([^;%]{9,40}\(\35=\35%\w\)>\d+\b[^<_]{99,999}[\|xa-f0-9_]{40}[^\.<>/]{1,99}\.split\(['"][^"']*['"]\),\d+,\{\s*\}[\s\)]{2,9}</\1>(?<X1043101>))|eval\((function)\(p,a,c,k,e,[dr]\)\{\w=\37\(\w\)\{return\s+\w\.to(String)\(\d+\)\};if\(!['"]+\.replace\(/\^/,\38\)\)\{while\([^\n]{99,299}['"],\d{2},\d{2},['"]\|[^'"]{4,40}\|iframe\|[^'"]{9,99}frameborder[^\{\}\n/]+\{\}\)\)</\1>(?<X1133030>))|[^>]{0,30}src=['"]https?://\w{1,6}\.stivenfernando\.com/stm[^'"]{1,15}['"]></\1>(?<X1155072>)|[^>]{0,33}>(?:\s*<!--)?\s*function\s*(\w{1,9}\(\))\s*\{\s*var\s*(?:\w,?){3,9};\s*var\s*(\w)=['"]{2};\s*(?:(?:\42\+=['"]\d+['"];\s*)|(?:\42=\42\+['"]\d+['"];\s*)){2,9}[^\}]{1,99}\}\s*if\s*\(\s*\(\s*(\w)\s*-\s*unescape\([^\}]{1,99}\.fromCharCode\(\43\)\);\43[^;]+;\}\}\s*\41;(?:\s*//-->)?\s*</\1>(?<X1124941>)|[^>]{0,40}(?:>(?:\h*var\h*(_0x\d{0,4})\h*=\h*\[[^\]]{99,1999}\];\s*function\h*(\w{1,9})\([^\n]{99,900}\bif\(navigator\[\45[^\}]{0,99}\}\h*else\h*\{\46\(\45\[[^\n]{99,399}\bwindow(?:\[\45\[\d{1,2}\]\]){2}\h*=\h*\45\[\d{1,2}\]\h*\+\h*domain\h*\+\h*\45\[\d{1,2}\][\}\)\h]+</\1>(?<X1172581>)|\s*(var)\h*(\w{1,5})\h*=\h*(String\.fromCharCode\()[\d,]{99,299}\);\s*\48\h*\w{1,5}\h*=\h*document;[^>]{9,200}\48\h*(\w{1,5})\h*=\h*\49;\s*(\w{1,5})\.src\h*=\h*\51[^>]{9,250}\bgetElementsByTagName\(\50[\d,]{1,99}\)\);(list\.)insertBefore\(\52.\h*\53childNodes\[0\]\);\s*\}\s*</\1>(?<X1155163>)|\s*atOptions\h*=\h*\{[^;]{1,450}\};\s*document\.write\(\\?['"]<[^>]{1,150}/\w{32}/invoke\.js\\?['"][^\)]{0,25}\);\s*</\1>(?<X11627011>)|\s*function\h*(getCookie)\(\w\)\s*\{\s*var\h*\w\h*=\h*(document)\.[^>]{0,499},\h*(\w{1,9})\h*=\h*\56\(['"]redirect['"]\);\s*if\(\h*now\h*\D{2,3}\h*\(\h*time\h*=\h*\58[^\}]{9,199}\b\57\.write\(['"]<\1\h*src[^\}]{0,49}\}\s*</\1>(?<X1178960>))|\bsrc\h*=\h*['"](?:(?:https?:)?//[^/]{0,15}(?:qalitygigant\.com|static\-resource\.com|cdn\-javascript\.net|pushlat\.com|otrwaram\.com|stati\.in|privacylocationforloc\.com|rogerstrips\.com|transmapp\.com|mikkymax\.com|trafficbetter\.biz|promclickapp\.biz|rasenalong\.com)/[^>]{1,150}></\1>(?<X1161536>)|https?://(?:poponclick\.info|adsnet\.work|fbpopr\.com|webpinp\.com|o-oo\.ooo)/[^'"]{1,90}\.js['"]></\1>(?<X1161332>))|src=['"]https?://[^\.]{0,15}\.weatherforecastmap\.com/\w{1,15}\.php\?zona=[^'"]{5,25}['"]></\1>(?<X1155092>))|[^>]{0,60}>(?:[^_]{0,49}\bvar\h*(_0x\w{1,9})\h*=\h*\[['"][^'"]{1,49}['"],[^\]]{1,999}\][^\?:\}/]{99,499}\{if\h*\(/\(android\|[^\)]{9,50}\)\.[\+\h]{0,49}\bmobile[^:<]{999,2999}\b(?:new\h+Date\h*\(\h*){2}\)\[[^:</]{99,499}\bwindow\[\63\[\d{1,3}\]\],\h*\63\[\d{1,3}\]\)\}\s*[^<]{0,20}</\1>(?<X11523615>)|\s*(document\.write\()['"<divstyle\h\+]{8,40}=['"]position\h*:\h*absolute\h*;\h*[left'"\+\h]{4,9}:\h*\-\d{4,}px[^/]{9,99}</\1>(?:\s*<a\h+href\h*=\h*['"]http://[^<]{20,199}</a>){3,}\s*<\1[^>]{0,60}>\s*\65['"</div>\+\h]{5,19}\)\h*;\s*</\1>(?<X1144952>)|\s*<!--\s*function\s*(\w{1,40})\s*\(\w{1,40}\)\s*\{\s*var\s*\w{1,40}\s*=\s*arguments\.[^@]{400,999}new\s*Array\s*\(\s*\d+\s*,(?:\s*\d{6,10}\s*\+\s*\(\s*\d{6,10}\s*\)\s*,){9}[^;]{999,8000};[^@]{999,3000}\.charCodeAt\s*\([^\}]{5,10}\}\s*\67\s*\(['"]\w{600,900}['"]\);[^<]{1,19}</\1>(?<X1128113>)|\s*\((function)\(\)\h*\{\h*var\h*(?:\w=['"]?[^'"]{1,7}['"],){10,15}(\w)=\w\+[^\{\}\$]{9,99}\b\69\h+\w\((\w),(\w)\)\h*\{\h*return\h+\71\^\72\s*\}\s*\69[^\v\t\$]{99,250}\bvar\h+(?:\w{1,2}=\w\([^\)]{1,4}\),){20}[^//>\v\t]{999,6500};\h*\70(\(\)\})\w\73\)\73\)\(\);\s*(?:/\*[^\*/<]+\*/\s*)?</\1>(?<X1177373>)|\s*eval\h*\(\h*(unescape)\h*\(\h*['"](?:%\w{2}){99}[^\)]{99,999}['"]\)\);\s*(</\1>)\s*<\1[^>]{0,60}>\s*document\.write\h*\(\h*\75\h*\(\h*['"](?:%\w{2}){500}[^'"\)]{1500,6000}['"]\)\);\s*\76(?<X1158645>)|\s*var(?:\h*(\w{1,9})=\[(?:\d{1,3},){9}[^\]]{999,5000}\];\s*var\s*(\w{1,9})=["']{2};for\h*\(var\h*(\w{1,9})=[^\{]{9,99}\{\79\+=string\.fromCharCode\(\78\[\80\]\h*\-\h*\78\[\d+\]\);\h*\}\h*document\.write\(\79\);\h*</\1>(?<X1152503>)|\s*(\w{1,20})=[^,]{50,150},(\w{1,20})\s*=[^,]{50,150},[^\{\}]{9,99};(?:while\(\w{1,20}<=\s*(?:\82|\83)\.length[^\{]{1,40}\{[^\}]+String\.fromCharCode\(\s*(?:\82|\83)\.\w{1,20}At\(\w{1,20}\++\)[^\}]+\}(?:\w{1,20}=[^;]+;)?\s*){2}document\.write\s*\(\s*\w{1,20}\s*\)[^/]+</\1>(?<X1126830>)|\s*(\w{1,2}x\w{1,9})=\[[^\]]{99,999}\];\s*var\s*\w{1,40}=String\[\85\[\d+\]+\(104,\s*116,\s*116,\s*112,\s*(?:115,\s*)?58,[^\);]+\);\s*var\s*\w{1,9}=function\s*httpGet\([^/]+==\s*\85\[\d+\]\)\s*\{n\s*=\s*false\}\};\s*if\s*\(\s*\w\s*==\s*true\s*\)\s*\{\s*a1?\(\)\s*\}+\s*</\1>(?<X1134860>))|eval\(String\.fromCharCode\(118,97,114,32,[^\)]{9,150}49,48,52,44,49,49,54,44,49,49,54,44,49,49,50,44,49,49,53,44,53,56,44,52,55,44,52,55,44,49,49,(?:57,44,49,49,53,44,52,54,44|53,44,49,49,54,44,57,55,44,49,49,54,44,52,54)[^;]{999,2500}\);</\1>(?<X1148732>)))
<(script)(?:[^>]{0,99}(?:>(?:(Object)[^\(]{0,50}\((function)\(\)\{var\h*\w{20,}\h*=\h*['"][^'"]+['"];var\h*\w\h*=\h*\[['"][^\n]{599,1200}\batob['"]\]\h*=\h*\3\((\w)\)\{var\h*\w\h*=\h*string\([^\n]{999,1800}\};\4\(\);[\(\)\}]+;\2[^<]{0,50}</\1>[^<]{0,50}</\1>(?<X1195151>)|\((function)(\(\w,\h*\w\))\{var\h*(\w{1,15})=\w,\w=\w\(\);while\(!!\[\]\)\{try\{var\h*\w=\-(parseInt\(\8\(0x)\d+\)\)/0x\d\+\-\9\d+\)\)/[^\n]{3500,}=\6\((\w),\w\)\{\10=\10\-0x\d+;var\h*(\w)=\w\[\10\];return\h*\11;\},\w\7;\}</\1>(?<X1196600>)|\(function\((_0x)\w+,\h*\13\w+\)\{var\s*\13\w+=\13\w+\(\);[^\n]{99,9999}\bdiv[><'",]+cvv\b[^\n]{50000,}\bcontinue;case'17':document\[[^\n]{999,7999}\btry\{if\(\13\w+\)return\h*\13\w+;[^\}]{0,99}\}\h*catch\(\13\w+\)[\{\}]+</\1>(?<X1281602>)|\s*\((function)\((_0x)\w+,\16\w+\)[^>]{99,499}\b(parseInt)\(\16\w+\(\-0x[^\)]+\)\)[/\*\+\-\(]+\(\-0x[^\)]+\)[/\*\+\-\(]+\17\(\16\w+\([^>]{999,6000}\barguments\);return\h*\16\w+=null,\h*\16\w+;\}\}:\15[\(\)\{\}]+;return[^\}]+\}\h*else\h*\{\h*if\([^>]{999,16000}\b\15\(\)\{return[^\}]+\};return[^\}]+\}</\1>(?<X1228740>)|\s*\(\s*function\h*\(\)\s*\{[^\}]{0,99}\b(\w{1,15})\.src[\h=]+['"]https?://(?:\w{0,25}\.)\bstorerightdesicion\.com/[^'"]+\.js['"];\s*var\h*(\w{1,15})[\h=]+document\.[^\}]{0,99}\binsertBefore\(\19,\h*\20\);\s*\}\)\(\);\s*</\1>(?<X1200641>)|\s*document\.write\(['"]<\1\h*src[\h=]+['"]https?://parkingcrew\.net/\w+\.php\?regcn[\h=]+\d+&[^;]{0,200};</\1>(?<X1218630>)|\s*setTimeout[\s\(\)=>\{]+window\.location\.href[\h=]+['"]https:?//[^/]{0,50}/\?https:?//[^'"]{0,50}['"];\s*\}\s*,\s*\d+[\s\)]+;\s*</\1>(?<X1218100>)|\s*var\h*(\w{1,15})\h*=\h*['"](?:https?:)?(?://)?(?:www\.)?hotpricedeal\.su\b[^'"]{0,99}['"];\s*window\.location\.href\h*=\h*\24;\s*</\1>(?<X1196681>)|\s*window\.location\.href[\h=]+['"]https:?//[^/]+/\?utm_source=[^&]+&utm_medium=[^&]+&utm_campaign=\w+['"];\s*</\1>(?<X1218110>))|\bsrc(?:[\h=]+['"](?:(?:https?:)?//(?:(?:\w{1,15}\.)?classicpartnerships\.com/[^>]{0,99}></\1>(?<X1203921>)|eoredi\.\w{2,6}/notice\.php\?\w[\h=]+\d{7}&\w[^\>]{0,99}></\1>(?<X1205811>)|thubanoa\.com/\w\?\w=[^>]{0,99}>\s*</\1>(?<X1258040>))|https?://7za\.co\.za/\w+\.js['"][^>]{0,99}>\s*</\1>(?<X1256840>))|\h*=\h*['"](?:(?:https:)?(?://)?(?:www\.)?oackoubs\.com/\d+/\d+['"][^>]{0,99}></\1>(?<X1195111>)|(?:https?:)?//(?:[^/]{1,40}\.com/\w{32}/invoke\.js['"][^>]{0,99}></\1>(?<X1162697>)|js\.users\.51\.la/\d+\.js['"]></\1>(?<X1179212>))|http(?:s:?//(?:adrequest\.xyz|somelandingpage\.com)/[^>]{1,99}></\1>(?<X1161403>)|s?://(coinhive)\.com/[^>]{0,199}></\1>\s*<(div)\h*class\h*=\h*['"]\35\-[^>]{0,99}\bdata\-key\h*=\h*['"]\w{32}['"][^>]{0,199}></\36>(?<X1180010>)))|\h*=\h*\\?['"](?:http)?s?[:;]?//[^/'"]{0,19}\b[bdtls](?:ontkinhooot\.tw|(?:elonnanotservice|ravelfornamewalking|alkingaboutfirms|ovegreenpencils|inetoadsactive|owerthenskyactive|ransandfiestas|trongcapitalads|aryinformtrand|eclarebusinessgroup)\.ga)/\w+(?:\.(?:js|php))?\?\w+=\w+\b[^>]{0,99}['"]\h*(?:type\h*=\h*['"]text/java\1['"]\h*)?></\1>(?<X1184227>)))|[^>]{1,30}>\s*\(function[^;]{1,70}atob\(['"]L2NoZWNrb3V0Lw==[^=]{1,20}const\s*(\w{1,14})\s*=\s*atob\(['"]d3NzOi8v[^\}]{1,110}WebSocket\(\39[^\<]{1,220}</\1>(?<X1281300>)|[^>]{1,60}src=['"](?:[&#\d;]{99,199}|https?://(?:www\.)?(?:iviseo|love520w)\.com/[^'"]{1,15}\.js)['"][^>]{0,25}></\1>(?<X1152683>)|[^>]{1,99}>\s*\(function\([\w\s]+,(\w+)[\)\{\s]+var[^\}]+\42[\);\}\(]+break[^<]+\{var\s*\w+[\s=]+(\w+)[^/]{1,999}appendChild['",]+136qCYCNj['",/\.]+my\.counter[^\}]+[\};]+return\s*\43[\(\)\s;]+\}[\s*</]+\1\s*>(?<X1280661>)|\b(?:[^><:]{1,60}\bsrc\s*=\s*['"]https?://(?:\w+\.)?milawig\.com[^'"]{1,30}['"]\s*>\s*<\/\1>(?<X1274992>)|[^>]{0,199}>(?:\h*var\h+(?:(?:\w{1,9}\h*[,=]\h*){1,3}\[[^\]\v]{9999,19999}\];[^\v]{999,9999}try\{[^=;]{0,49}=['"](\w{1,9})['"]\}[^\v]{9999,39999}</\1>\s*<\1\b[^>]{0,99}\b(?:(?:src=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}|on(?:error|load)=['"]\46\(\);?['"])[^>]{0,199}){2}>\s*</\1>(?<X1179980>)|(\w{1,9})=(window);[^\v\|#%\*\\]{999,3999}\(\h*\48\[[^,]{0,19},\h*['"](\w{1,40})['"]\h*,\h*\[[^;]+;\h*</\1>\s*<\1\b[^>]{0,99}\b(?:(?:src=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}|on(?:error|load)=['"](?:\49|\48)\.\50\(\);?['"])[^>]{0,199}){2}>\s*</\1>(?<X1179972>))|\s*if[\s\(]+!navigator\.useragent\.match\s*\(/Google\s+Web\s+Preview[^;\}]{1,199}\bdocument\.getElementById\s*\([^\)]+\)[\s\.]+style[\s\.]+display\s*=\s*['"]['"noe\+\s]{5,}['"][;\s]+</\1>(?<X1221780>))|[^>]{0,40}>\h*(document\.write\(['"])<div\h+style=['"](?:(?:height|width):[120]px;\h*)+overflow:hidden['"]\h*>\h*['"][\h\)]+;</\1>(?:\s*<ul>\s*<li>\s*)?<a\b[^;]{99,999}>\h*\53</div>['"]\);\s*</\1>(?<X1188971>)|[^>]{0,99}>\s*(?:eval\(String\.fromCharCode\(118,\h*97,\h*114,\h*32,\h*100,\h*61,\h*(?:\d{1,3},\h){199}[^\)]{99,1500}115,\h*41,\h*59,\h*10,\h*125\)\);\s*</\1>(?<X1166262>)|function\s+(sabrinavi_)go\(\s*\)\s*\{\s*(if\h*\(\h*(document\.)cookie\.indexOf\h*\(\h*['"]\56(click)\h*=['"]\h*\))[^\)]+\)\s*\{\s*(\56cu_jump)\h*=\h*\d+;[^@]{1,1499}\57[^\)]+\)\s*\{\s*var\s+\60\h*=\h*\d+;\s*(\58on\59=\56go);\s*setTimeout\h*\(\h*['"]\61['"],\h*\d+\);\s*\}\s*</\1>(?<X1164171>))|[^>]{0,99}\bsrc(?:[\h=]+['"](?:https?:)?//\w{1,25}\.storerightdesicion\.com/[^'"]+\.js['"][^>]{0,99}></\1>(?<X1201580>)|\h*=\h*['"]?https?://propu\.sh/[^'"]{1,49}\.js\?\w=\d+['"]?[^>]{0,99}>\s*</\1>(?<X1160744>))|[^\.>:\?]{0,60}\bsrc\h*=\h*['"]?(?:https?:)?//go\d*\.mobisla\.com/\w{1,40}\.php\?[^\.>:\?]{0,60}>\s*</\1>(?<X1182113>))|\h*(?:(?:async|type)[^>:\.]{0,99}\bsrc\h*=\h*['"]https?://(?:www\.)?ye185hcamw\.\w{2,6}/[^\.'"]+/\w+\.js['"][^>]{0,99}></\1>(?<X1166301>)|(?:src=['"]https?://\w{1,6}\.[^/]{1,40}/clizkes['"]\h*|type=['"][^'"]{5,40}['"]\h*){2}></\1>(?<X1155112>)|(?:type=['"][^'"]{1,40}['"]\h*|src=['"]\W{0,9}\bcom\-api\.onl/\w{1,15}\.php\?\d[^'"]{0,25}['"]\h*){2}></\1>(?<X1155241>)|(async)\h*=['"]\69['"]\h*src\h*=\h*['"][^'"]{0,9}\bbrowsermine\.com/[^\.]{0,40}\.js[^'"]{0,40}['"]></\1>(?<X1155662>)|[^>]{0,60}src=['"](?:https?:)?//(?:\w{1,15}\.)?[^/\?]{2,20}/adServe/banners\?tid=[\d_]{2,20}[^>'"]{0,29}['"]>\s*</\1>(?<X1171343>)|data\-cfasync(?:=['"]false['"][^>]{0,40}>\((function\()\)\{var\h*\w{1,9},(\w{1,9}),\w{1,9}=\[[^\]]{999,9999}\];[^;<]{3,40}\72\73\)[^\v\\@#\t]{9999,54000}\bsrc=['"]//[^/'"\s]{1,49}/apu\.php\?zoneid=\d{7}[^>]{1,199}>\h*</\1>(?<X1179740>)|[^>]{5,99}\bsrc\h*=\h*['"]https?://[^/]{0,15}greatdexchange\.com/\w/[^\.]{0,25}\.php\?\w=\d+['"]></\1>(?<X1170643>))|src=(?:[""]https?://gnogle\.ru/js/\w{1,9}['"]></\1>(?<X1154502>)|['"](?:(?:https?:)?//go\.mob[a-z]{1,5}\.com/[\w\-\.]{1,40}\.php\?(?:p|zone(?:id)?)=\d{7}[^'"]{0,40}['"]>\s*</\1>(?<X1180490>)|http(?:s:?//essays-today\.com/\?sserpdrow[^\>/]{9,80}></\1>(?<X1154472>)|s?://(?:[^\.]{0,15}\.bro\.kim/[^'"]{1,50}\.js['"]></\1>(?<X1154532>)|themelibery\.com[^'"]{1,20}['"]>\h*</\1>(?<X1266511>)))))|src(?:[\h=]+['"]https?://(?:[^/]+/\w{4,6}['"][^>]+></\1>\Z(?<X1232560>)|yoast\-schema\-graph\.com/[^'"]+\.js['"]></\1>\Z(?<X1227510>))|\h*=\h*['"][^'"]+['"]></\1>\s*<\1>\s*var\h*(\w+)\h*=\h*\w+\.User\([^\{]{0,99}\{\s*threads:\h*\d[^\}]{9,199}\}\);\s*\83\.start\(\);\s*</\1>(?<X1197630>))|type\h*=\h*text/javascript>\s*[^\?]{1,99}(function\(\)[\s\{]+var\h*[^\?]{0,99}(elem)\.src\h*=\h*['"]https?://)[^/'";]{1,49}\.ga/\w+\.js[^\?]{9,499}\85[^/'";]{1,49}\.ga/\w+\.js[^\}]{1,299}\bappendChild\(\86\)[\}\(\);]+</\1>(?<X1186851>)))
<(?:(script)(?:\h+(?:(?:src\h*=\h*['"]https?://(?:eluxer\.net|glganltcs\.space|worldnaturenet\.xyz|[^/]{1,15}\.stringengines\.com)/[^'"]{1,99}['"]\h*|type\h*=\h*['"][^'"]{1,25}['"]\h*){2}></\1>(?<X1161004>)|language(?:=['"]php['"]>\s*if\(!?isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*echo[^;\}]{5,40};\}\s*(\$\w{1,20})=(eval\()['"][^\$]{0,20}(\$\w{1,20})\h*=\h*\3;\s*\5base64_decode\(\6\)\);['"]\);\s*(\$\w{1,20})=['"]preg_replace['"];\s*\7\([^\$]{2,20}\4[^\)]{2,20}\);\s*</\1>(?<X1160970>)|[\h=]+['"][^'"]{0,9}\bJ[av]*Script['"]\h*runat[\h=]+['"]server['"]\h*>\s*function\h+\w{1,20}\(\)[\{\s]+eval[\s\(]+request\[[^\]]+\][,\s'"]+[unsafe\+'"]{6,15}[\s'"]+\);[\}\s]+</\1>(?<X1207840>))|src\h*=\h*['"](?:(?:https?:)?//[^/]{1,40}\bverifyspot\.net/[^\?]{1,40}\.php\?id\h*=\h*\w{32}['"]></\1>(?<X1161452>)|http(?:s:?//[^/]{0,15}(?:dontstopthismusics|blackentertainments|lobbydesires|developfirstline)\.com/[^>]{1,40}></\1>(?<X1161484>)|s?://(?:www\.)?webshop\-tool\-manager\.info/[^'"]+['"][^>]{0,99}></\1>(?<X1183871>)))|type\h*=\h*['"](?:[^'"]{5,15}['"]\h+src\h*=\h*['"]https?://[^/]{4,49}/wp-content/\w\.php\?ver=[^'"]{1,9}['"]></\1>(?<X1160823>)|text/javascript['"]\h+src\h*=\h*['"]https?://(?:www\.)?cheapjerseys[^'"/]{1,40}\.\w{2,9}/[^'"]{1,99}\.js['"]\h*>\h*</\1>\s*<\1[^>]{0,99}>[^/]{99,999}function\h+popupWindowPrice\h*\(url\)\s*\{\s*window\.open\h*\(\h*url\h*,(?<X2145091>)))|\h[^>]{0,60}src=['"](?:https?:)?//[^\./]{2,20}\.com/[a-z\d]{9,20}/261\d{2}['"]>\s*</\1>(?<X1171332>)|\s*(?:[^=]{1,32}=\s*['"]https?://162\.33\.177\.118/[^'"]{1,32}['"]>\s*</\1>(?<X1258120>)|[^>]{0,60}>(?:(\w{1,9})\.\w{1,9}=(function)\h*\(\)\s*\{\s*return\h+typeof\h*(\17\.[^=]+)\W{1,4}\18['"]\?\19\.apply\(\17\.[^\-/%]{9,250}\b\w{1,20}=decodeURI\h*\([^\[\]<\}]{5000,10000}\);[^#`]{4000,}\bif\(!!\[\]\)\s*\{\s*\w{1,9}=JSON\.parse\(atob\([^#`@]{9999,}\bdocument\.cookie=g7t[^/<]{2,60};\s*</\1>(?<X1171361>)|\s*\w{1,40}\s*=\s*parseInt;[^;]{1,40}\s*String\.fromCharCode[^=]{1,20}=\s*\\['"]\w{2}\b([^\w])(?:\w{2}\21){1,20}\w\b([^\w]|)\21[^'"]{999,1999}['"]\.replace\s*\(\s*/\22/[^\)]+\)\.split\s*\(\s*(\\['"])\21\23\s*\);[^`]{99,399}\{\s*(\w+)\s*=\s*eval;[^/]{49,299}\24\s*\([\s\w\)\};]{5,20}</\1>(?<X1128234>))|[^>]{0,60}src=['"](?:https?:)?//(?:\w{1,15}\.)?(?:madratesforall|responserver|masontotally|cpmprofitablenetwork|bestcpmnetwork|modulepush|plqbxvnjxq92)\.com/\w{32}/invoke\.js['"](?:\h*class=[^>]{1,50})?></\1>(?<X1152478>)|[^>]{9,29}>var\s*(_Hasync)\s*=\s*\27\s*\|\|\s*\[\];\s*(\27\.push\(\[['"](Histats)\.)start['"]\s*,\s*['"]\d,42(?:14393|09412)\s*,[^\)]{9,29}\);\s*\28[^\}]+\}\)\(\);\s*</\1>\s*<no\1>[^\.]{19,49}\.\29\.com/[^/]{29,99}</a>\s*</no\1>(?<X1130041>)|src(?:\h*=\h*['"]https?://cdn\-server\.top/[^\?>\n]{1,40}\?[^'"]{1,40}['"]\s*>\s*</\1>(?<X1197620>)|\s*=\s*(?:['"]https?://(?:\w+\.)?(?:bmwebm\.org/[^'"]+\.js['"]>\s*</\1>\s*<\1>\w{1,40}\.config[\(\{\s]+login:\s*['"]\d+['"][,\s]+pass:\s*null[\s\}\)]+\.power\(\d+\)[;\s]+</\1>(?<X1202951>)|quickcontentnetwork\.com(?:[\w/\-\.]+)?['"]>\s*</\1>(?<X1273470>))|\\['"]https?://(?:\w+\.)?ethers\.io[^>]{1,256}>[^,]+,[^\};:]{1,49999}\b\1>(?<X1262492>))))|\s+type[\h=\\'"]+text/java\1['"\\\s]+\bdata\-cfasync[\h=]+\\?['"]false\\?['"]>\s*/\*<!(?:\[|(&#091;))CDATA(?:\[|\35)[/\*\s]+\((function\()\)[\h\{]+var\h*[a-f\d]{32}[\h=]+\\?['"][^"']{9,99}['"];[^!]{999,9999}!!(?:\[|\35)(?:\]|&#093;);\h*\}[^\{]{9,60}if\(\w{1,9}===undefined\)\{[^/\v]+\36\)\{\w{1,9}\++;(\w{1,9}\(\);)[^/]{0,99}\37[^;]{0,9};[^<]{0,99}</\1>(?<X11783017>)|\s[^:]{1,50}src\s*=\s*['"]https?://(?:\w+\.)?busz\.io[^'"]*['"]></\1>(?<X1277720>))|(script>)(?:(\w{1,9})=(?:\[['"]\w{1,9}=0;(\w{1,9})=['"]['"];for\(\w{1,9}=0;\w{1,9}<(\41\[0\])[^/]+\+=String\.fromCharCode\(parseInt\(0\+['"]\w['"][^,/\v]+document\.write\(\42\);['"],['"][0-9a-f]{99,999}['"]\];\h*eval\(\43\);\s*</\40(?<X1149332>)|function\(\)\{return\s+(\w{1,9})\[\w\];\};(\w{1,9})=window;(\w{1,9})=String\.fromCharCode;[^/\s]{99,299}\bif\(\46\.document\)\{\45=['"](?:0x\w{1,2},){9}[^'"\s]{999,4999}['"]\.split\(['"],['"]\);[^/\s]{9,99};(\w{1,9})=\48\.concat\(\47\(eval\(\41\(\)[^/\s]{1,49}\beval\([^\)]+\48\);\}+</\40(?<X1153732>))|\h*(?:\(function\(\w,\w,\w\)\s*\{\s*object\.defineproperty\([^\?]{99,999}var\h*(\w{1,9})\h*=\h*function\([^>]{99,1599}window\[\50\(['"]\w{1,9}['"]\)\]\s*\(['"]domcontentloaded[^>]{1,20}</\40(?<X1176191>)|window\.location\.href=['"](https?://i\-io\.io/\w{3,9})['"];\s*</\40\s*<meta\h*(?:http\-equiv=['"]refresh['"]\s*|content=['"]?\d+['"]?;?|url=['"]?\52['"]?){3}>(?<X1221480>))|\s*(?:\[['"](sojson\.v)\d+['"]\]\[['"][^'"]{3,99}['"]\][^/\.\+]+\[['"]\54\d+['"]\]\+\[\][^/,]{9,9999},[^;/<]+\((\W)\[a\-zA\-Z\][^/</;]{0,19}\55[^</]{0,40}</\40(?<X1190731>)|function\s+\w{1,40}\((pills)\)\s*\{[^\}]{9,199}\bvar\s+(keys)=['"]tds\-keyword=['"];\s*location\.replace\h*\(\h*\w{1,9}\+['"]:['"]\+(slesh\+)\59domen\+point\+zona\+\59page\+[^\)]{1,49}\58\+\57\);\s*\}\s*</\40(?<X1153742>))|eval\((function)\(p,a,c,k,e,r\)\{\w=\61\(\w\)\{return\s+\w\.to(String)\(\w\)\};if\(!['"]+\.replace\(/\^/,\62\)\)\{while\([^\n/]{99,299}(?:(?:split|reverse|join)\|){2,3}\d+=[^:]{9,99}//:s?ptth[^\{\}\n/]+\{\}\)\)</\40(?<X1132900>))|(style)[^>]+>\h*(\w+)[\h\{]+display:\h*none;[\h\}]+</\64>\s*<\65>\s*<a\h*href[\h=]+['"][^>]+>B374k\h*shell</a>\s*</\65>(?<X1209300>)|(textarea)[^>]{0,25}style\h*=\h*['"](?:display|visibility):(?:none|hidden);['"]>[\da-z]{150,300}</\67><(script)>[^\?]{9,150}(eval)\(['"](\w{1,9})\.['"/+charodet]{8,20}\(\w{1,9}\)[^\}]{9,350}\}catch\(\w\)\{try\{\69[^<]{9,99}\69\(\70\);\s*</\68>(?<X1142573>)|(title)>(?:(?:(?:Recod|defeat|hack|defac)ed|kiss)\s+by\b[^<]{1,40}</\72>[^#]{1,700}\bsrc\h*=\h*['"]https?://\w\.top4top\.io/[^\.]{1,40}\.(?:mp3|txt|mp4|jpg|gif|png)['"](?<X2168582>)|(?:Acceso|Bienvenido)\h+a\h+ita[^\h]{1,2}\h+empresas\</\72>(?<X2264262>)|(?:Mini|DoXing)\s*shell</\72>(?<X2129871>)|[\s\.\:\|\*]{1,9}oluxshop\s*maill?er[\s\.\:\|\*]{1,9}<\s*/\72(?<X2129830>)|[^<]{0,25}UNDERXPLOIT\h*SHELL\h*\d[^<]{0,15}</\72>(?<X2180350>)|[^<]{1,32}tryag\s+uploa?der\s+files[^<]{1,16}</\72>(?<X2265391>)|\h*(?:404(?:\h+page)?\h+not\h+found\h*</\72>[^&!]{200,1500}@copy\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\](?<X2151162>)|[\-_]{1,40}\h*</\72>\s*<\?php\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)(?<X2161421>))|\W{0,5}TINY\h*SHELL\W{0,5}</\72>(?<X2173480>)|\W{0,9}KeyzNet\h*Backdoor\W{0,9}</\72>(?<X2155531>)|chinafans\s*file\s*manager</\72(?<X2129933>))|(title>)(?:&#87;&#101;&#98;&#109;&#97(;&#105;&)#108;&#32;&#76;&#111;&#103\85#110;\s*</\84(?<X2207411>)|(?:Database|db)\s*e?mails?\s*extract(?:or)?</\84(?<X2130570>)|0wn[e3]d\W{0,9}</\84(?<X2176500>)|[^/;]{0,40}\bAntichat\h*Shell\h*</\84(?<X2151481>)|[^/<]{0,10}(?:hack|fu?ck|defac)\w+\h*shell\h*upload</\84(?<X2181332>)|[^/]{0,99}\b[B8]yp[a4][s$5]{2}\s*[s$5]h[e3][1l]{2}</\84(?<X2044842>)|[^/]{0,9}E?Xploit\h*</\84[^\.:]{9,99}href\h*=\h*['"]https?://\w{1,9}\.top4top\.io/(?<X2168511>)|[^/]{1,9}\bZerr?[o0]+Err[0o]r\s+v[\d\.]+</\84(?<X2133501>)|\h*(?:([^</]{5,60})\h*</\84[^\?\*&]{2,400}<meta\h+name\h*=\h*['"](?:keywords|description)['"]\h+content\h*=\h*['"]\94['"]\h*/?>[^\?\*&]{400,25000}>\s*(?:<a\h+href\h*=\h*https?://[^>\n]{9,150}>[a-z0-9]{5,20}</a>\h*,\h*){9}[^\v]{999,9999}</a>,\h*</div>(?<X2282490>)|['"]\.\$[shel]{1,5}name\.['"]</\84[^\\;\{\$]{9,99}<link\h+href\h*=\h*['"](?:https?:)?//zerobyte\-id\.github\.[^/]{1,20}/PHP.(?:Backdoor|webshell)\b(?<X2189370>)|shutdown57\h*ransomware[^\<]{0,20}</\84(?<X2179051>))|\S{1,40}\h+m[i1]n[i1]\h+sh[e3][1l][1l]\h*</\84(?<X2152190>)|Amazon\s+Billing\s+Center\s*</\84[^\^\\\|\176\`]{30000,40000}\$cvv2?c?=\$_[GPCSR]\w{2,6}\[['"]cvv2?c?['"]\];(?<X2133490>)|g[a4][l1i][e3]rz\s*[s\$x]h[e3]{1,2}[l1i]{1,2}\s*[b6][a4]ckd{1,2}[oO]r[szx\$]?</\84(?<X2130610>)|hun(?:te|73)r\h*uploader</\84['"];[^\{]{9,299}\{\s*if\h*\(\h*(?:copy|move)_uploaded_file\b(?<X2174401>)|iserver\h+kit\h*</\84(?<X2175011>))|(title|center|h\d|font)(?!\s*class\s*=\s*['"]woo)[^>]{0,99}>[^<]{0,14}m[i1]n[i1]\h*[5s]h[e3]ll[^a-z\d]?\b[^<\n/]{0,10}</\103>(?<X2176704>)|/?dortxt>(?<X2189582>))
<(?:/(?:a>\s*Deface\s+Mirror\s+Priv(?:\d+|ate)?\s+Shell\b(?<X2121581>)|dd>\s*(?:<dd><a(?:\s*(?:href|title)\s*=\s*['"]?https?://[^'"\s]{9,99}\d{1,5}\.php\?\d{1,5}\.html['"\s]){2}[^>]{9,99}>https?://[^'"\s]{9,99}\d{1,5}\.php\?\d{1,5}\.html\s*</a>\s*</dd>\s*){4}(?<X2129648>)|form>(?:";\s*move_uploaded_file[\s\(]+\$saw1[\s,]+\$saw2[\s\)]+;(?<X2049223>)|\s*<\?php\s*\$(\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\4['"]?\];\s*(\$\w{1,40})\s*=\s*(?:passthru|exec|shell_exec|popen|system|eval)\(['"]\$\4['"]\);\s*echo\s*['"][^\$]{0,40}\5[^\$]{0,40}['"];\s*\?>(?<X2052440>))|h(?:ead>\s*<body>.{1,9999}\bfunction\s+\w{1,40}\(\)\s*\{\s*\w{1,40}\s*=\s*\w{1,40}\(\);\s*\w{1,40}\s*=\s*\[(?:\d+,){20,100}\d+\];\s*return\s*\w{1,40}\(\w{1,40},\w{1,40}\);\s*\}(?<X2050431>)|tml>\s*<(?:\?php\s*(\$\w{1,40})\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\}\{]{1,999}\$\w{1,40}\s*=\s*@?fopen\s*\(\s*['"]\w{1,40}\.txt['"]\s*,\s*['"]a\+?['"][^\-]{1,999}\$(\w{1,40})\s*=[^;]{0,40}\8[^\(]{1,499}\bphpversion\s*\(\s*\)\s*;\s*@?mails*\([^\;]{1,40}\b\9\b[^;]+;\s*(?:\?>|\Z)(?<X2136220>)|SCRIPT[^=]{1,40}=\s*VBScript\s*\s*><[^\w]{0,40}\w{1,40}\s*=\s*['"]svchost\.exe['"](?<X2055130>)))|noembed>\s*<title>\s*-J\.B\.O\.Y-(?<X1059810>)|pathshell>(?<X2202541>)|s(?:cript>(?:";exit;}}}function\s+\w{1,40}\(\){\$\w{1,40}='http://';if\(\$_SERVER\["SERVER_PORT"\]!="80"\){\$\w{1,40}\.=\$_SERVER\["HTTP_HOST"\]\.":"\.\$_SERVER\["PHP_SELF"\];}else{\$\w{1,40}\.=\$_SERVER\["HTTP_HOST"\](?<X2048090>)|\s*<meta\b(?:[^>]{0,99}(?:http\-equiv=['"]?refresh['"]?|content=['"]\d+;\s*url=https?://[^"']{1,99}/\.\w{99})){2}(?<X2190252>))|tyle>\s*<title>\s*x-Mailer</(?<X2120910>))|title>\s*(?:(?:<meta\h[^/]{0,40}content\h*=\h*|<script[^/]{0,40}\()['"](?:hacked|s[7t][a4]mp3d)\h*by\h*xL[0o]n[e3][l1]y\b(?<X2138531>)|<meta\h*content=['"]Hacked\h+By\h+\S{1,40}\b[^/>]{1,199}name=['"]description['"](?<X2167133>)))|\?(?:(?:=|php)?\s*\(\s*\$(\w{1,20})\s*=\s*@?\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\[[^]]{1,10}\s*\]\s*\)\s*\.\s*@?\$\19\(\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\[[^]{1,10}]\s*\]\s*\)\s*(?:\?>|\Z)(?<X1040451>)|(?:=|php)\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\h*\?>(?<X1216550>)|(?:php)?(?:(?:\s*@?error_reporting\s*\(\s*0\s*\)\s*;)?\s*(\$\w{1,40})\h*=\h*str_replace[\s\(]+\b\w\s*,\s*['"]{2}\s*,\s*['"]?\w{5,19}['"]?[\s\)]+;\s*@?\22[\s\(]+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1186202>)|[ ]{99,}\$\w{1,40}[\s=]+class_exists[\s\(]+['"](\w+)['"][\s\)]+;\h*if[\s\(]+!\$\w+[\s\)]+\{\h*class\h*\24\h*\{(?:[^:\n]{9,999}\b(?:substr|str_repeat|strlen|is_array)[\s\(]+\24::)+[^\?\n<\*]{9,999}\binclude(?:_once)?\h*\$\w+;\h*@\24::[^\n\?>]{0,199}\bnew\s*\24[\s\(\)]+;[^\?>\n]{0,99}(?:\?>|\Z)(?<X1238160>)|[\t]{40,}if[\(\s]+!\h*class_exists[\(\s]+['"]([^'"]{1,40})['"][\s\)]+\{[^\}]{1,99}\bis_user_logged_in\h*\(\)[^\n]{999,9999}\}\h*(\$\w{1,40})\h*=\h*new\h+\26;\h*\27\->init\h*\([^;]+\$is_bot[\)\h]+;\h*\}\s*(?:\?>|\Z)(?<X1193500>)|[^\?]{0,500}\$\w{1,15}\h*=\h*@?(?:get_current_user|getcwd)\(\);[^\?]{0,500}(\$\w{1,15})\h*=\h*fopen\(['"]/(?:home|var)[^\)]{0,45}contact(?:email|info)['"],\h*['"]w['"]\);\s*fwrite\([^\)]{0,15}\29(?<X2147353>)|[^\{]{5,50}\bfunction\h*(\w{1,15})\(\$\w{1,15}\)\{(eval)\(['"](\W{0,5}\$\w{1,9})=['"\h\.\(gzinflatesr_o13b64dc]{9,300}[^;]{1,25};\32\(\33\);['"]\);\}\s*\31\(['"][^'"]{99,999}['"]\);[^\?]{0,50}\?>(?<X1147723>)|\h*(?:(\$\w{1,40})\h*=\h*(file_)ge(t_contents)\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\h\)]+;\s*if\h*\(\h*\36pu\37\h*\(\h*['"][^"']{1,40}\.php['"]\h*,\h*\35\h*\)[^;]+;[^\?>]{0,99}\?>(?<X1187140>)|system\h*\(['"]\\[\\\da-fx]{799,999}['"]\);\h*\?>(?<X1175720>))|\n{0,9}[ ]{200,}function\h*\w{1,40}\h*\((?:\h*\$\w{1,40}\h*,?)+\)\h*\{\h*return\h+str_replace\h*\([^\?\v\.\[]{499,9999}(\$\w{1,99})\h*=[^;\v]+;['"]\);\h*\40\h*\(['"][^'"\v]+['"]\h*\)\h*;\h*(?:\?>|\Z)(?<X1157692>))))
<\?(?:php)?\s*(?:(?:(?:(?:echo\s*)?(?:ini_get|ini_restore)\(.{1,2}(?:open_basedir|safe_mode).{1,2}\);\s*){0,4}include\(\s*\$_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\]\s*\);\s*){1,2}\s*(?:\?>|\Z)(?<X1042108>)|(?:(?:set_time_limit|display_errors|error_reporting)\h*\([^;]{0,19};\s*){1,}class\h+(pbot)\s*\{\s*var\s*\$config\h*=\h*array\([^@]{999,9999}(\$\w{1,40})\h*=\h*new\h*\2;\s*\3\h*\->\h*\w{1,40}\h*\(\h*\);\s*(?:\?>|\Z)(?<X1184272>)|(?:\$\w{1,40}\s*=\s*["']https?://[^;]{1,199};)?\s*(?:@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec|cntl_exec)\s*\([^\)]+\b(?:curl|GET|wget|lwp\-download|fetch|lynx)\s[^\)]+\);\s*){10}(?<X2186102>)|(?:echo\h+)?@?eval\h*\(\h*(?:@?\w{1,40}\h*\(\h*){2,}@?file_get_contents\h*\(\h*(?:@?\w{1,40}\h*\(\h*){1,}['"]ahr0c[^'"]{1,199}['"]\)\h*\.\h*['"]\w{1,199}['"][\h\)]{1,199};\s*(?:\?>|\Z)(?<X1188250>)|(?:session_start\(\);[^\{]{0,99})?function\s+(random_number\s*\(\))\s*\{[^\}]{9,300}\}\s*\$\w{1,15}\s*=\s*(?:\7\.){3,6}(date\([^\)]+\))\.(?:md5\(\8\)\.?){3,6};(?<X2134275>)|(\$[o0_]{1,12})\h*=\h*urldecode\h*\(\h*['"]%[^;]+;(?:\h*\$[o0_]{1,12}\h*=\h*\10\h*\[\d+\]\h*\.[^;]+;)+[^>\v]{9999,}\barray\h*\(\h*['"]domain['"]\h*=>[^;]+;[^\?]{9,999}\b(?:exit|die)\b[^;]{0,9};[\h\}]+@?\$?[o0_]{1,12}\h*\(\h*\$[o0_]{1,12}\h*\)\h*;\s*(?:\?>|\Z)(?<X1171600>)|(\$\w{1,10})\h*=\h*array_merge\h*\(\h*\$_[GPRSC]\w{2,6}\h*,[^;]{1,49};\s*(\$\w{1,10})\h*=\h*isset\h*\(\h*\12\h*\[[^;]{1,299};[^\?]{0,40}\beval\h*\(\h*(?:(?:strrev|base64_decode)\h*\(\h*){2,}\13[\)\s]+;\s*\}\s*(?:\?>|\Z)(?<X1173121>)|(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);\s*\17setopt\h*\(\16\h*,\h*curlopt_url\h*,\h*base64_decode\h*\(['"]aHR0cH[^\)]{6,99}\)\.\15\);\s*\17exec\h*\(\16\);\s*(?:\?>|\Z)(?<X1185942>)|(\$\w{1,40})\h*=[\h'"base64_dco\.\d/\+\-%\^\(\)]{18,49};\s*(\$\w{1,40})\h*=\h*(?:\(\h*)?['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\20\h*\);\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*(?:\(\h*)?\19\h*\(\h*\21(?:\h*\)){2,3};\s*(?:\?>|\Z)(?<X1170853>)|(\$\w{1,40})\h*=\h*['"][^'"]+\.php['"];\s*(\$\w{1,40})=\h*(http_get)\h*\(\h*['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*\23\b[^;]{1,99};\s*fwrite\h*\(\h*\26\h*,\h*\24\h*\);[^\{\}\?]{1,199}\bfunction\s+\25\h*\(\h*\$\w{1,40}\h*\)\s*\{[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1170890>)|(\$\w{1,40})\s*=[^;]{99,999};\s*@?file_put_contents\s*\([^,;]+,\s*\28\s*\);[^\?]{0,499}\$(\w{1,40})\s*=\s*(\w{1,40})\s*\(\s*\$\w{1,40}\s*\);\s*@?eval\s*\(\s*['"]\?>['"]\s*\.\s*\$\29\s*\);\s*function\h+\30\b[^\}]{1,499}\bcurl_exec\s*\([^;]{1,49};\s*return\s+\$\w{1,40};\s*\}\s*(?:\?>|\Z)(?<X1185990>)|(\$\w{1,40})\s*=\s*(?:(?:array\s*\(|\[)[^;]{1,99}\$_[GPCSR]\w{2,6}\b[^;]{1,99};\s*if\s*\([^=;\{]{1,99}\32\[[^=;\{]{1,99}\{\s*(\$\w{1,40})\s*=\s*\32\[[^;]{1,99}\(\32\[[^;]{1,99};\s*(?:(\33\[)[^\]]+\]\s*(?:=\s*\34[^\]]+\]\s*\(|\(\s*\34)[^\}]{1,99};\s*){3,}\}\s*(?:\?>|\Z)(?<X1189270>)|['"][^;]{1,99};\s*(\$\w{1,40})\s*=\s*explode\s*\([^;]{0,99}\32\b[^;]{1,99};[^\}\?]{0,499}\$(\w{1,40})\s*=(?:\s*\36\s*\[[^\]]+\]\s*\.){3}[^;]{0,199};\s*\$\37\s*\(\s*\$_[GPCSR]\w{2,6}\[[^;]{1,199};\s*(?:\?>|\Z)(?<X1186410>))|(\$\w{1,9})=['"]lave['"];\s*(\$\w{1,9})=['"]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)['"];\s*\39=strrev\(\39\);\s*@?(?:eval|assert|shell_exec|exec|popen|system|passthru)\(\39\.\40\);\s*\?>(?<X1133050>)|(\$user.?agents?.?to.?filter)=array\(['"]#[^\)]{300,1500}\);[^!]{0,20}\bif\(!empty\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\W{0,3}\([^\(]{0,9}\bstri?pos\(preg_replace\(\42,[^:/]{9,200}\bif\(\$isbot\)\{[^>#]{99,900}\b(curl_)exec\([^\)]+\);\43close\([^\)]+\);echo\h*\$\w{1,20};\}\s*\?>(?<X1178472>)|(\$user.?agents?.?to.?filter)[\h\=]+array[\h\(]+['"]#[^\)]{300,1500}[\h\)]+;[^!]{0,20}\bif[\h\(]+!empty[\h\(]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\h\)]+\W{0,3}\([^\(]{0,15}\bstri?pos[\h\(]+preg_replace[\h\(]+\45,[^:/]{9,200}\bif[\h\(]+\$isbot\b[^\?]{99,550}\bheader[\h\(]+[""]Location[^\}]+\}\s*\?>(?<X1240110>)|@?(?:include(?:_once)?|require)\(\s*['"][^;\?]{1,80}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip|jpeg|gz|log|key)['"]\s*\);\s*\?>(?<X1042296>)|@?eval\s*\(\s*file_get_contents\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1055151>)|@?preg_replace\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s* \$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*['"]['"]\s*\);\s*\?>(?<X1038091>)|@?unlink\([^;]{1,99};\s*(\$\w{1,40})\s*=[^;]{1,199};\s*(\$\w{1,40})\s*=\s*@?(file_)ge(t_contents\s*\()\s*\50\s*\);[^\{\?]{0,399}\bwhile\s*\(\s*True\s*\)\s*\{[^\}]{1,999}\b\52pu\53\s*\50\s*,\s*\51\s*\);\s*@?touch\s*\(\s*\50\s*,[^\)\-;]{0,49}\-\d+\h[^\?%:/#&\+\\\*/]{9,499}\}\s*(?:\?>|\Z)(?<X1185911>)|@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(str_rot13\s*\('\w*\s*\(\s*\$_\w*\["\w*"\]\s*\);'\s*\)\s*\);\s*\?>(?<X1035621>)|[ri](?:equir|nclud)e(?:_once)?\(?['"][^'"]{0,19}\b[ba](?:lock(?:er|_detector)|ntibot)[sz]?\.php['"]\)?;[^\?]{0,99}\$(\w{1,40})=glob\([^;]{1,99};foreach\(\$\56\s*as\s*(\$\w{1,40})\)\s*unlink\(\57\);copy\((?:['"][^'"]+\.php['"][,\)]){2};[^\?]{1,999}\bheader\(['"]Location:\s*\$secfile\b(?<X2170860>)|\$[o0_]{8,16}\h*=\h*urldecode\(['"]%[^;]{1,999};[^\*\v\?]{99,9999}\$[o0_]{8,16}\h*=\h*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)\?]+\$\{['"][GOBALS\\x471532cf]{9,28}['"][^\->\*\v]{99,999}\becho\h+\\?['"]wp\-[^;]+;[^;]{0,9};\h*@?\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);[^\?]{0,40}\?>(?<X1168680>)|\$\w+\s*=(?:(?:\s*chr\(\s*\d+\s*\)\s*\.?\s*)+\s*;\s*(?:\s*\$\w+\s*=(?:\$\w+\(\s*\d+\s*\)\s*\.?\s*){10,};\s*){2,}\$\w+=\$\w+\s*\(\s*["']+\s*,\s*\$\w+\s*\)\s*;\s*@\$\w+\(\s*\);\s*\?>(?<X1038261>)|\s*@?\$_SERVER\["HTTP_USER_AGENT"\].+?@?eval\(\s*\$\w+\[\w+\]\s*\);\s*echo\s*"[^"]+";\?>(?<X1035542>))|\$\w{1,40}\s*=\s*['"](?:[^'"]{30000,}['"];\s*[^\%]+%\d+\)\s*\)\s*;\s*\}\s*(\$\w{1,40})\s*=\s*@?gzinflate[^\{]{40,100}\s*\{\s*(\$\w{1,40})\s*=\s*create_function\(['"]\$\w{1,40}['"],\62\);\s*\63\(['"][^'"]{40,99}['"]\);\s*\}\s*(?:\?>|\Z)(?<X1056260>)|\w{32}['"];\s*\$\w{1,40}\s*=\s*['"]#df5['"];\s*\$\w{1,40}\s*=\s*['"]FilesMan\b(?<X2046016>))|\$cmd\s*=\s*\$_[GPCSR]\w{2,6}\h*(?:\\\s*)?\[\h*['"]-cmd['"]\h*\];\s*\?>[^/]{1,99}<title>[^/]{0,99}\bShell\b(?<X2142470>)|\$ip\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*.{1,400}\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$mensaje\s*,\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2052101>)|getenv\(['"]REMOTE_ADDR['"]\)\s*;\s*(\$\w{1,40})\s*=\s*fopen\(['"]\w{1,40}\.\w{1,8}['"],\s*['"]a['"]\);\s*fwrite\(\68,\$ip[^;]{1,60}\);\s*\$\w{1,40}\s*=\s*rand\(\d+,\s*\d+\);(?<X2052141>))|\$ipv?\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\s*\.?=\.?\s*[^;]{1,80}\s*;\s*){0,3}\s*\$(?:mensaje|message)\s*\.?=\s*['"](pass|passwd|password)[^\w]{1,40}\$_POST\[['"]?\w{0,20}\70['"]?\]\.?['"]?\\n['"];(?<X2054441>)|\$sh[e3]ll_color\h*=\h*['"][^'"]{0,40}['"]\h*;(?:\s*(?:error_reporting|set_time_limit)[\h\(]+(?:0|false|off)[\h\)]+;){2}[^\\]{0,499}\bphp_uname\h*\((?<X2181640>)|\$user_agent_to_filter\h*=[^\?]{999,4999}\bif\(\h*@\$is_?bot\h*\)\s*\{[^\}]{1,499}\becho\h*\$result;\s*\}\s*(?:\?>|\Z)(?<X1177800>)|define\h*\(\h*['"]WP_CACHE['"]\h*,\h*true\h*\)\h*;\s*if\s*\((?:\s*!)?\s*isset\h*\(\s*(\$\w{1,40})[\s\)]+\{\s*(?:\$\w{1,40}\h*=\h*['"][^'"]{1,99}['"]\h*;\s*){1,9}function\h+[a-fliox0-9_]{1,16}\h*\([^#`\176]{999,9999}\{\s*\}\s*\}\s*\74\h*\h*=\d+\h*;\s*\}\s*\?>(?<X1156881>))
<\?(?:(?:php)?(?:\s*(?:function(?:\h+(?:(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*['"]{2};[^\}]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\2\h*,[^\?:/#%&@]{1,199}\breturn\h+\3;\s*\}[^;]{1,199}\b\1\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1184061>)|(isInString\d*)\h*\(\h*(\$haystack)\h*,\h*\$needle\h*\)\s*\{\s*\6\h*=[^\}]{9,99}\}\s*(\$\w{1,20})\h*=\h*strpos\h*\(\h*\$_SERVER\[['"]HTTP_REFERER['"]\]\);\s*if[\h\(]+\5[\h\(]+\7\b[^\?\(]{9,99}\bheader\h*\(\h*['"]Location:\h*https?://[^'"]+['"]\);\s*\}\s*(?:\?>|\Z)(?<X1179171>))|\s*(\w{1,40})\h*\(\h*\$\w+\h*,\h*\$\w+\h*\)\s*\{[^\}]{99,499}\}\s*if\h*\(\h*\9\h*\(\h*['"]https?://[^/'"]{1,99}bin\.com/(?:raw|download)[/\?][^,\)]+,\h*['"][^'"]+\.php['"]\h*\)\h*\)\s*\{\s*echo\b[^;]{1,99};\s*\}\s*(?:else\s*\{\s*echo\b[^;]{1,99};\s*\}\s*)(?:\?>|\Z)(?<X1171270>))|if\(preg_match\(['"]\/Google\s*Web[^'"]{1,99}['"],\s*\$_Server\[['"]HTTP_USER_AGENT['"]\]\)\)\s*\{\s*echo['"]\s*(?:<a\s*href=['"]http://[^>]{9,99}>[\sa-z]{0,30}<\/a>\s*){3,}['"];\s*\}\s*(?:\Z|\?>)(?<X2125332>)|if\h*\(\h*(?:isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*echo\s*['"]\h*<form[^;]{9,199};\s*if\h*\(\h*isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*@?(?:copy|move_uploaded_file)\h*\([^;]{1,99};\s*(?:echo[^;]{1,99};\s*)?\}\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1140971>)|preg_match\h*\(\h*['"][^'"]{0,99}\bgoogle(?:bot)?\b[^;\{:]{1,999}[\{:]\s*(\$\w{1,40})\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^;]{1,199};\s*@?eval\s*\(\s*@?\w{1,40}\s*\(\s*\13(?:\s*\)){2};\s*(?:endif;|\})\s*(?:\?>|\Z)(?<X1188650>))|if\s*\((?:\(!(\$_POST\[[^\]]+\])\)\s*\D{1,5}\(\15[^\)]+\)\)\s*\{\s*\15\s*=\s*['"]uname\s+-ar\s*;\s*pwd\s*;\s*id\s*;[^\}]{0,15}\}[^\$]{9,99}echo\s+[^\.]{1,20}\.(?:eval|system|passthru|assert|exec|shell_exec)\(\15\)(?<X2121450>)|\s*[^\w]?\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)[^\}]{40,200}\s*\}\s*else(?:if)?\s*\{\s*(\$\w{1,40})\s*\=\s*[\\'"\s\.aceglpr_]{12,80}\s*;\s*@?\17\s*\(\s*.?['"](.).{0,40}\18e\w?.?['"]\s*,\s*[^\}]{1,40}\s*\}\s*(?:\?>|\Z)(?<X1056190>)|\s*isset\s*\(\s*(?:(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w{1,40}['"]\s*\])\s*\)\s*\)\s*@?(?:system|exec|passthru|shell_exec|popen)\s*\(\s*\20\s*\s*\)\s*;\s*\?>(?<X1041931>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?(\w{1,40})['"]?\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?create_function\s*\(\s*['"]['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\22['"]?\]\s*\);\s*\23\(\s*\);\s*\}\s*(?:\?>|\Z)(?<X1056161>)))|include\(\$_SERVER[^\}]{100,600}->Authorize\([^\)]{1,40}\);\s*header\(['"]location:[^'"]{1,40}['"]\);\s*die\(\);\s*\}\s*else\s*\{[^\}]{1,600}\s*\}\s*(?:\?>|\Z)(?<X1053751>))|\s+(?:(?:@?echo\s*)?@?eval\s*\(\s*['"]\?>['"]\s*\.\s*@?file_get_contents\s*\(\s*['"]https?://[^\)]{3,}\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1056182>)|/\*\*/@?eval\(base64_decode\(['"](?:aWYoZnVuY3Rpb25fZXhpc3RzKCJvYl9zdGFy|ZihmdW5jdGlvbl9leGlzdHMoIm9iX3N0YXJ0)[^'"]{99,2000}(?:Z3ppbmZsYXRlKHN1YnN0|aW5mbGF0ZShzdWJzdHIo|emluZmxhdGUoc3Vic3Ry)[^'"]{99,1500}(?:b2Jfc3RhcnQo|X3N0YXJ0|Yl9zdGFy)[^'"]+['"]\)\);\s*\?>(?<X1119432>)|@?eval[\h\(]+['"]\?>['"]\.hex2bin[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\?>(?<X1195780>)|include\s*\(['"]blocker\.php['"]\)\s*\;\s*\$DIR\s*\=\s*md5\s*\(\s*rand\s*\(\s*\d+\s*\,\s*\d+\)\s*\)\s*\;(?<X2051650>))|\s[\h]{99,}\bgoto\h+\w{3,9};[^\n]{999,}\bgoto\h+\w+\s*;\s*\w+\s*:\s*\w+[\(\)\s]*;[^\?]{0,99}(?:\?>|\Z)(?<X1240280>))|(?:php)\s*(\$\w{1,20})\h*=\h*['"][base_dco\.'"\d\h/\+\-]{16,40}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\(\31\h*\([^\)]+\)\);\s*(\$\w{1,20})\h*=\h*iconv\h*\([^\$]+,\s*\32\);\s*echo\h+\33;\s*(?:\?>|\Z)(?<X1185931>)|(?:php|)\s*[^\[]{0,200}(\$\w{1,9})\h*=\h*\[[^;]{9,99}/tmp/sess_[^;]{9,99};\s*if\(file_exists\(\35[^\?]{1,999}fopen\(\35[^\}]{9,99}echo\h*['"]<script>window\.[^\{]{9,99}function\h*\w{1,9}\(\$\w{1,40}\)\h*\{[^=]{9,50}=\h*curl_init[^\}\?]{9,299}\}\s*\?>(?<X1138933>)|(?:php|=)(?:\s*[sei](?:rror_reporting|et_time_limit|gnore_user_abort)\h*\(\h*[01]\h*\)\h*;){3}\s*\$\w{1,40}\h*=\h*['"]<\?[^;]{1,40}(?:\s*[sei](?:rror_reporting|et_time_limit|gnore_user_abort)\h*\(\h*[01]\h*\)\h*;){1,3}(?<X2158920>))
<\?(?:(?:php|=)?(?:[ ]{180,}\$\w{1,40}[ ]*=[ ]*(['"])[^;]+\1;[^\?\n]{199,4999}[ir][ne][cq][lu][ui][dr]e(?:_once)?[ ]*[\$\{\('"]{1,3}[^;]{1,99}[\$\}\('";]{1,3}\s*(?:\?>|\Z)(?<X1125311>)|[\s/\*]*null;[\s/\*]*@?eval[\s\*/]*\(\s*['"]\?>['"][\s\.]+@?file_get_contents[\s\*/]*\(\s*['"]https?://[^/'"]+\bgithub(?:usercontent)?\.com/[^;]+;[\s/\*]*(?:\?>|\Z)(?<X1206360>)|\h*(?:(\$_{1,40})\h*=[^;a-z0-9]{1,5};\h*\4\h*=(?:\h*\(\h*\4\h*\^\h*['"][^'"a-z0-9]{1,3}['"]\h*\)\h*[\.;]){1,5}\h*(?:\?>\h*\<\?(?:php|=\h*)?)?(?:\h*\$\{[^\};a-z0-9]+\4\}\[['"][^a-z0-9]{1,3}['"]\]\h*[\(\)]){2}\h*;\h*(?:\?>|\Z)(?<X1140361>)|/\*\h*CaZaNoVa\d*\h*\*/\h*\$\w{1,40}\h*=\h*\(\h*['"][\?>]{2}['"]\h*\.\h*gz(?:uncompress|inflate)\h*\(\h*base64_decode\h*\(\h*['"](?<X2152980>))|\h{200,}(\$\w{1,40})\h*=\h*['"][\\xa-f\d]{3,99}['"]\h*;[^\v\?><\^]{999,9999}\7\h*\([^;]{1,99};\s*(?:\?>|\Z)(?<X1160840>)|\s*(?:#[a-f0-9]{4,9}#\s*if\h*\(empty\(\$\w{1,40}[\)\s]+\{\s*error_reporting\h*\(0\);[^\$]{1,499}\bfunction\h+(\w{1,40})\h*\(\h*\$remote\w{1,9}\h*,[^\?]{999,9999}\9\h*\([^\)'"]+['"]\?\w{1,9}=[^;]+;[^\}]{99,499}\}(?:\s*\}){2}\s*\?>(?<X1163620>)|(\$\w{1,40})\h*=\h*(?:rawurldecode\(\h*['"][^'"]{9999,}['"]\h*\)\h*;\s*function\h+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*tempnam\([^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(\h*\14\h*,[^;]+;\s*fwrite\(\h*\15\h*,\h*\13\h*\)[^\}]+\}\s*extract\(\h*\12\h*\(\h*\11[\)\s]+;\s*(?:\?>|\Z)(?<X1158170>)|url(decode)\(base64_\17\(['"][^'"]{999,}['"][s\)]+;\s*@?file_put_contents\h*\(\h*(__FILE__)\h*\.\h*['"]\.php['"]\h*,\h*\11\h*\)\h*;\s*@?unlink\h*\(\h*\18\h*\)\h*;(?<X2163561>))|@?eval\h*\(\h*(base64_decode)\h*\(\h*['"]Pz4=?['"]\h*\)\h*\.\h*file_get_contents\h*\(\h*\20\h*\(\h*['"]aHR0[^'"]{9,199}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1176810>)|@?fwrite\h*\(\h*fopen\h*\(\h*['"]\w{1,25}\.php['"]\h*,\h*['"][wa]\+?['"]\h*\)\h*,\h*file_get_contents\h*\(\h*['"]https?://[a-z]{2,5}bin\.[a-z]{2,3}/(?:raw|download)/\w{1,15}['"]\h*\)\h*\)(?:\h*;)?\s*\?>(?<X1143751>)|@\$[_\[\]=@!\+;\$\{\}>\(\)\.\-\^</]{199,499}\?>(?<X1124470>)|\$ip\h*=\h*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);[^@]{0,600}(\$message)\h*\.?=\h*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{25,90}(\\n)['"]\s*;(?:\s*\24\h*\.?=\h*['"][^\n]{1,60}(?:['"]\25['"]|['"]\s*\-\s*['"]);){1,12}\s*\24\h*\.?=\h*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{25,90}\25['"]\h*;(?<X2052323>)|eval\h*\(\h*\$GLOBALS\h*\[[^\]]+\]\h*\(\h*['"]JElJSUlJSUkxMTFsST0nb2JfZW5(?<X2053052>)|if\h*\(\h*isset\h*\(\h*(\$_FILES\h*\[['"])[^\]]+\]\h*\)\h*\)\s*\{\s*if\h*\(\h*\28[^\)]+\)\s*\{\s*echo\h*['"][^;]+['"];\s*\}\s*else\s*\{\s*@?(?:copy|move_uploaded_file)\h*\(\h*(?:\28[^\)]+){2}\)\h*;(?:\s*echo\h*['"][^;]+;)*(?:\s*\}\s*(?:/[/\*][^\v]{1,99})*){2}\s*(?:\?>|\Z)(?<X1145851>)|null;\s*eval\h*\(['"]\?>['"][\h\.]+file_get_contents\h*\(['"]https?://[^'"]{0,25}\bklgrth\.io/[^'"]{0,99}['"][\h\)]+;\s*\?>(?<X1200870>)|session_start\(\);\s*\$(\w{1,40})\s*=\s*\$_POST\[['"]\31['"]\];\s*\$(login_password)\s*=\s*\$_POST\[['"]\32['"]\];\s*(\$ip)\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"][\)\]];\s*\$\w{1,40}\s*=\s*['"]\33['"]\s*;(?<X2052131>))|\s+(?:#([a-z0-9]{6,12}#)\s+/\*[^#]{99,9999}\bwhile\h*\(\h*!\h*@?feof\h*\([^#]{99,9999}#/\35\s*(?:\?>|\Z)(?<X1158471>)|(\$\w{1,20})\h*=\h*@?base64_decode\([^\)]+\);\s*echo\h*@\37\h*\(isset\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\?\38:NULL\);\s*\?>(?<X1148640>)|\$_F\h*=\h*__FILE__;\h*\$_X\h*=\h*@?file_get_contents\h*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*\)\h*;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*['"]JF9YP[^'"]{99,9999}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1143280>)|\$GLOBALS\[[^\]]+\]\s*=\s*Array\(base64_decode\([^\)]+\),[^;]+;\s*function\s*(\w{1,40})\(\$\w\)\{\$\w=Array\([^;]+;\s*return[^;]+;\s*\}\s*[^#]+\$_SERVER\[\41\(\d+\)\]\s*\.\s*\$\w{1,40}\s*\.\s*\41\(\d+\);\s*\}\s*else\s*\{\s*echo\s*\41\(\d+\);\s*\}\s*(?:\?>|\Z)(?<X1125690>)|if\h*\(\s*!?\h*(?:empty|isset)\h*\(\h*(\$_FILES\[)[^\]]+\][\)\s]+\{[^\?]{1,999}\b[cm]o(?:py|ve_uploaded_file)\h*\(\43[^;]+\);(?:\s*\}){2,3}[^\$\.]{1,99}\$\w{1,40}\h*=\h*opendir\h*\(['"]\.['"]\);[^\?]{99,999}\}\s*\}\s*echo\h+['"]</TABLE>['"];\s*\?>(?<X1142430>)))|(?:php|=)\s*[ea][vs](?:al|sert)\s*\(\s*@?file_get_contents\s*\(\s*['"]https?://[^'"]{4,99}\.(?:txt|gif|png|jpe?g)['"]\s*\)\s*\);\s*\?>(?<X1133471>)|(php)\s*(\$\w{1,40})=fopen\s*\(['"]\.{1,2}/\w{1,9}\.txt['"],['"]a\+?['"]\);fwrite\s*\(\47[^;\{\}]{1,99}\.\$_SESSION\[[^\]]+\][^;]{1,9};\s*\?>\s*<meta\s+http-equiv=['"]refresh['"]\s+content=['"]\d+;URL=[\w\-]{1,40}\.\46\?\w{1,9}=[\w\-]{1,40}[^/]{1,199}<\?\46\s*include\s*['"]\.{1,2}/\w{1,9}\.\46['"];(?<X2134680>)|=(?:\h*@?eval[\(\s]+["']\?>["']\.\w+[\(\s]+['"]https?://paste\.ee/r/[^/]+/\d+['"][\)\s]+;\s*__halt_compiler[\(\);\s]+(?:\?>|\Z)(?<X1264820>)|\s*(?:(?:eval|assert)\(\s*file_get_contents\(\s*['"]https?://[^)]+\)\s*\)\s*;?\s*\?>(?<X1038921>)|(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?\d{2,3}\\[\\xa-f\d]{9999,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"]\s*\.\s*(?:(?:\51|\52|\53)[\s\(\)]+){3,};\s*(?:\?>|\Z)(?<X1221810>)|@null\s*;\s*(\$\w+)[\h=]+['"][a-f\d]{999,}['"];\h*function\h*(\w+)[\(\h]\55[\h\)\{]+(\$\w+)[\h=]+sys_get_temp_dir[\(\)\h]+;\s*\$\w+[\h=]+\57[\.'"/\h]+\$_SERVER\[[^;]+\.tmp['"];[^\?\n]{99,399}\bextract[\h\(]+\56[\h\(]+\55[\s;\)\}]+(?:\?>|\Z)(?<X1277781>)|\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*\.\s*stripslashes\s*\(\s*@\$\w{1,40}\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*\)\s*;\s*exit\s*;\s*\?>(?<X1040602>)|eval[\(\s]+['"]\?>['"]\s*\.[\(\s]*base64_decode[\(\s]+file_get_contents[\(\s]+["']https?://\w+\.\w+\.[a-z]{2,9}/[^'"]+\.txt['"][\s\);]+__halt_compiler[\(\);\s]+(?:\?>|\Z)(?<X1227760>)))|[=\sph@]*(?:(?:copy|move_uploaded_file)[\(\s'"]+https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{1,4}/[\w\-\.]+\.txt['"][,\s]+['"][\w\-\.]+\.php['"][\)\s;>\?]+\Z(?<X1218530>)|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]{2}['"][\.\(\s]+base64_decode[\(\s]+(?:\w+[\(\s]+)+['"]https?://[^'"]+\.aspx['"][\)\.\s]+['"][^'"]+\.txt['"][\)\s;]+__halt_compiler[\(\)\s;]+(?:\?>|\Z)(?<X1228210>))|[=ph\s@]*(?:`[\s\('"\{]*\$_[GPRSC]\w{2,6}\s*\[[^\]]*\]['"\s;\)\}]*`[\s;\}]*(?:\?>|\Z)(?<X1209170>)|eval[\("'\s]+\?>['"][\.\s]+\(\s*base64_decode[\s\(]+(?:\w+[\s\(]+)+['"]https?://[^/]+/\d+\.aspx['"\)\s]+\.\s*['"][^'"\$]+\.txt['"][\s\)]+;[^\?]{0,40}(?:\?>|\Z)(?<X1236940>)|NULL;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][=\s]+['"][^'"]+['"]\s*;\s*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[\s=]+['"][^'"]{99,}['"][\s;@]+eval[\(\s]+htmlspecialchars_decode[\(\s]+gz(?:inflate|uncompress)[\(\s]+base64_decode[\(\s]+['"][^'"]{9,}['"][\s\);]+(?:\?>|\Z)(?<X1227900>))|[=ph\s]*@null\s*;\h*(\$\w+)[=\s]+['"][^'"]+['"]\s*;\s*function\s*(\w+)\s*\([^\n\?]+\beXtRaCt[\s\(]+\67[\s\(]+\66[\s\)]+;\s*(?:\?>|\Z)(?<X1281410>)|[\sph=@]+file_put_contents[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][,\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s;\)]+(?:\?>|\Z)(?<X1199050>)|[\sph@=]+(/\*[^\*\n]{0,40}\*/)\s*null\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{9,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{9,}['"]\s*;\s*@?eval[\(\s]+strrev[\(\s]+htmlspecialchars_decode[\(\s]+gzinflate[\(\s]+base64_decode[\(\s]+(?:\72|\71)[\s\);]+\70?[\s;\)]*(?:\?>|\Z)(?<X1198441>)|[\sph@]+(?:(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\s=]+['"][^'"]{9,}['"];\s*)+@(?:(?:ini_set|set_time_limit)\s*\([^;]+;[@\s]*)+header\s*\([^\)]+\)\s*;[^\?]+\[['"]REMOTE_ADDR['"]\][\.\s]+['"][^'"]+['"][\);\s]+(?:\?>|\Z)(?<X1208590>)|[ea](?:val|ssert)[\s\(]+base64_decode[\s\(]+file_get_contents[\s\(]+str_rot13[\(\s]+['"]uggc[^'"]{9,}['"][\s\);]+(?:\?>|\Z)(?<X1196790>)))
<\?(?:[\sph]*(?:(?:\$\w{1,40}[=\s]+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+)+switch[\s\(]+@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*case\s*['"]\d+['":\s]+(\$\w{1,40})[=\s]+@\$_FILES\[[^\]]+\][^\}]+if[\(\s]+(?:move_uploaded_file|copy)[\(\s]+\1\[[^\?\n]{99,499}else\s*\{[^\}]{0,99}\}[\s\}]+(?:exit|die)[^\?]{0,40}\?>(?<X1214990>)|(\$\w{1,40})\s*=\s*['"]aHR\d[^'"]+['"]\s*;[^\{\}!]{0,999}\bif[\(\s]+!\s*empty[\(\s]+\3[\)\s]+\{\s*(\$\w{1,40})[=\s]+\3\s*;\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\w{1,40}[\s\(]+\4\b[^;]+;\s*if\s*\([^;]+\badmin\b[^\{]{0,99}\{[^\}]{0,99}\5\->\w{1,40}\(\);(?<X2204000>)|@(header)[\(\s]+['"]Content[^\)]+\)\s*;[^@]+if[\(\s]+stristr[\(\s]+@file_get_contents[\(\s]+\$\w{1,40}[\s\),]+(\$\w{1,40})\{\d+\}(?:\s*\.\s*\8\{\d+\}[\s\)]*)+[\{;][^<\n]{999,}\b\7[\s\(]+\8\{\d+\}(?:\s*\.\s*\8\{\d+\}[\s\)]*)+;[\s\};]*(?:\?>|\Z)(?<X1204290>)|goto\s*(\w{3,9});\s*\10:\s*if[\s\(]+(file_)exists[\s\('"]+\\x2f\\(?:x74|164)\\x6d\\x70\\(?:57|x2f)\\x2e[^'"]+['"][\s\)\{]+goto[^\}]{0,40}\}[^\(\{\$=]{0,99}\11pu(t_contents)[\s\('"]+\\(?:57|x2f)\\(?:x74|164)(?:\\x6d|155)(?:\\x70|160)[^;'"]+['"][\s,]+\11ge\12[\s\(]+base64_decode[^;]+;[^\?]{0,40}\?>(?<X1203431>))|[\sph]+(?:(?:if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*)+@?(?:copy|move_uploaded_file)[\s\(]+\$_FILES\s*\[[^;]+;[^\}]{0,199}\}\s*else\s*\{\s*echo[\s'"\(]+<form\b[^;]+</form>['"];[\s\}]+(?:\?>|\Z)(?<X1198004>)|(\$\w{1,40})(?:\h*=\h*str_rot13[\(\s]+['"]ugg[^'"]+['"][\)\s]+;\s*(\$\w{1,40})\h*=\h*curl_init\(\);[^\?]{0,999}curl_setopt[\s\(]+\16[,\s]+CURLOPT_URL[,\s]+\15[\)\s]+;[^\?]{0,999}\b(?:echo|print)[\s'"\(]+curl_exec[\s\(]+\16[\)\s]+;\s*(?:\?>|\Z)(?<X1195530>)|\s*=\s*['"]<\?[\sph]+@?eval[\s\(]+gzinflate[\s\(]+base64_decode[\s\(]+['"][^'"]{99,}['"][\s\)]+;[\?>\s'";]+(\$\w{1,40})[\s=]+['"]H[a@]ck[e3]d\s*by\b[^;]+;(?:\s*\$\w{1,40}[\s=]+fopen[\s\(]+['"][^'"]+\.(?:php|txt)['"][\s,]+['"]w\+?['"][\s\)]+;)+(?:\s*fwrite(?:[\s\(]+\$\w{1,40}[\s,]+(?:\15|\18))[\s\)]+;)+(?:\s*fclose[\(\s]+\$\w{1,40}[\)\s]+;){2}\s*(?:\?>|\Z)(?<X1198330>)|\s*=\s*popen[\s\(]+base64_decode[\s\(]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s,]+['"]r\+?['"\)\s;]+while[\s\(]+!feof[\s\(]+\15[\s\)\{]+(\$\w{1,40})\s*\.=\s*fread[\s\(]+\15[\s,]+1024[\)\s;]+\}\s*echo\b[^;]*\20[^;]*;\s*pclose[\s\(]+\15[\s\)]+;\s*(?:\?>|\Z)(?<X1198750>))|(function)\h*(\w{1,40})\s*\(\)\s*\{\s*\22\s*\w{1,40}\s*\([^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*curl_init\h*\(\)\h*;\s*curl_setopt\s*\(\s*\24\s*,[^,]+,\s*str_rot13[\s\(]+['"]uggc[^;]+;[^\}=]+\$\w{1,40}\h*=\h*curl_exec[\s\(]+\24[\s\)]+;[^\?]{0,999}\b\23\s*\(\s*\)[\s;\}]+(?:\?>|\Z)(?<X1195810>)|\$\w{1,40}(?:\h*=\h*base64_decode[\s\(]+['"][^'"]*['"][\)\s]+;(?:\s*\$\w{1,40}\h*=(?:\h*\$\w{1,40}\{\d+\}\s*\.){3,}\s*\$\w{1,40}\{\d+\}\h*;)+\s*echo[\s\('"]+wp\-[^;]+;[^\?]{9,999}\$\w{1,40}\h*=\h*(\$\{['"][GOBALS\\x471532cf]{9,28}['"]\})[^;:]+:(?:\\?['"]){2};[^\?]{0,999}\26\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1195450>)|\s*=\s*\(\s*["'][^'"]{9,199}['"][\s\)]+;\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+(?:@?(?:gz(?:inflate|uncompress)|base64_decode|urldecode)[\(\s]+){0,5}['"]cmVhZGZpbGUoc3RyX3JvdDEzKCd1Z2d[^'"]+['"][\)\s]+;\s*(?:\?>|\Z)(?<X1196430>))|echo[\s'"]+<meta\s+http\-equiv\s*=\s*['"]refresh['"]\s+content\s*=\s*['"]0;\s*URL\s*=\s*https?://(?:bit|molingvarballheart|xxxconent|allowww)\.(?:ly|cf|biz|com)/(?:\w{1,39}/?\s*){1,2}['"]>['"]\s*;\s*\?>(?<X1202911>)|if[\s\(]+!isset[\s\(]+(\$\w{1,40})[\s\)]+\{(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,99}['"]\s*;){1,3}\s*@eval[\s\(]+gzuncompress[\s\(]+base64_decode[\s\(]+['"]eN[^;'"]{999,}['"][\s\)]+;\s*\30=\d+\s*;\s*\}\s*(?:\?>|\Z)(?<X1198320>))|[^;]{1,99};(?:\s*\$(?:mysite|filename|fromsite)[\s=]+['"](?:https?://[^;]+|\s*['"]);){3}[^@]+?\$(\w{1,40})[\s=]+@?file_get_contents[\s\(]+\$fromsite\b[^@]+?echo\s*\$\32;\s*((?:exit|die)[^;]{0,19};)[\s\}]+else[\s\{]+\$tiaourl\s*=[^\?]{1,999}\33[\s\}]+(?:\?>|\Z)(?<X1195800>)|[^=\$\(\{]{0,49}(?:(\$\w+)[\s=]+\(?@?\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*|if\s*\([^;\{]{0,99}(?:\35\b|\$_[GPSRC]\w{2,6}\[)[^\{;]{1,199}\{\s*){2}[^\}]{0,199}\b[peas](?:assthru|ystem|xec|hell_exec|val|ssert)([\s\("]+)(?:@?\w+\36){0,9}\35\b[^;]{1,99};[^\?=\(]{0,99}\b(?:(?:(?:exit|die)[^;]{0,19};|\})\s*){2}(?:\?>|\Z)(?<X1191035>)|[^\$/\*\{]{0,99}\bfwrite\(fopen\(['"][^'"]+\.php['"],[^\)]+\),file_get_contents\(['"]https?://(?<X2216511>)|[^\$=/\*]{0,199}\berror_reporting\(0\);[^\?]{1,499}\bif\(preg_match\(['"](\W)\-\-check\-alive\-\-\39[^\}]{1,99}\bexit\b[^;]{0,19};\}[^@]{999,}\b(stri?pos\()\w+\(\),['"]\-\-jumpshop\-\-['"]\)[^\?]{1,99}\$(\w+)=\$_SERVER\[['"]HTTP_REFERER['"]\];\s*return\s*\((?:\40\$\41,['"]\w+['"]\)\s*\|\|\s*){5}[^;]+;[\s\}]+\?>(?<X1216170>)|[^\$\?\}\+;]{0,299}\b[sape](?:val|ssert|ystem|hell_exec|xec|open|roc_open|assthru)\s*(?:/\*[^\*]{0,4999}\*/\s*)?\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)[\s\(@'"]+){0,5}\$\h*_\h*[GPRSC]\w{2,6}\h*\[[^\]]+\]['";]?\h*\)[^\?]{0,49}(?:\?>|\Z)(?<X10343118>)|[ph=\s]+(?:@?eval[\s\(]+(?:(?:str_rot13|base64_decode|gz(?:inflate|uncompress)[\s\(]+)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\);]+(?:\?>\s*)?\Z(?<X1041911>)|['"]\?>['"][\s\.]+\w+[\s\(]+['"]https?://[^;]+;\s*(?:\?>|\Z)(?<X1198610>))|eval[\s\(]+['"][\?>]{2}['"]\h*\.\h*file_get_contents[\s\('"]+https?://bit\.ly/[^'"]{1,40}['"\)]+;\s*(?:\?>|\Z)(?<X1193910>))|[ph\h]*/\*[^\*\n]{1,40}\*/\h*(\$\w{1,40})\h*=\h*['"](?:['"\h\.base64_dco]{15,40}|[str_o13'"\.\h]{10,40}|[strev'"\.\h]{9,})['"]\h*;[^\?\n]{0,199}?\beval\s*\([^'";]*\47[^;'"]*\(['"][=a-z\d\+/]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1223290>)|[ph\h]+(?:(?:@?echo\h*)?(\$\w{1,40})\h*=\h*['"]https?://xxx\.[^;]{1,199};\h*(\$\w{1,40})[\h=]+(?:['"][file_gtcons]+['"][\h\.]{0,9}){2,};\h*\$\w+[=\h]+\50[\h\(]+\49[\h\)]+;\h*(\$\w+)[\h=]+(?:['"][file_putcons]+['"][\h\.]{0,9}){2,};\h*\51[\(\h]+[^,;]+,\50\h*\);+\h*(?:\?>|\Z)(?<X1192190>)|(?:\$\w{1,40}\h*=\h*@\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*)+switch[\s\(]+\$_[GPRSC]\w{2,6}\[[^;]+case\h*['"][^;]+(\$\w{1,40})[\h=]+\$_FILES\[[^\]]+\];\s*if[\s\(]+\53\[[^\]]+\]\D{2,9}['"]{2}[\s\)]+\{[^\}]+if[\s\(]+@?(?:copy|move_uploaded_file)[\(\s]+\53\[[^\n\?]{99,499}\b(?:exit|die)\b[^;]{0,19};[\h\}]+\?>(?<X1194560>)|/\*Leafmail\d+\*/\h*goto\h[^@\n]+@\$\w+\h*\([^\?\n]+\bgoto\h+\w+\s*;(?:\s*\w+:)*\s*(?:\?>|\Z)(?<X1286220>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"\(]*[^/]+/(?:\d+|template)\.(?:jpe?g|bmp|ico|txt)['"\)]*;\h*\?>(?<X1204511>))|[ph\s*]+(?:(\$\w+)[\h=]+\[['"]https?://klik\.lol/[^'"]+\.txt['"]=>['"][^\]]+\];\s*foreach[\h\(]+\57\h*as\h*(\$\w+)=>(\$\w+)[\s\)\{]+(\$\w+)[\h=]+(file_)get(_contents)\(\58\);\s*if[\h\(]+\60\W{2,3}[^\{]+\{\61put\62[\h\(]+\59,\h*\60[\s\);\}]+\?>(?<X1265730>)|try\{[^(]+(\$\w+)=['"]file_put_contents[^\(]+sys_get_temp_dir[^\{]+\{\64[^\{]+\{\$\w+[^\$]+\$\w+=serialize\(\$_COOKIE[^\?]{1,999}http?://[^']+\.js['"];\64[^\}]+[^\?]+catch\(\w+\$\w+\)\{\}\?>(?<X1250990>))|[ph\s=]*(?:(?:\$\w+=['"]\w+['"];){1,19}(\$\w+)=['"]https?://[^;]{1,199};eval\((?:\$\w+\()+file_get_contents\(\66\)+;\s*(?:\?>|\Z)(?<X1229151>)|(\$\w{1,40})(?:[\s=]+['"]\\x[a-f\d]{2}[\\x\da-f]{999,}['"]\s*;\s*(\$\w{1,40})[\s=]+['"]\\x[a-f\d]{2}[\\x\da-f]{9,}['"];\s*@eval[\s\(]+['"][\?>]{2}['"][\.\s]+(?:\69[\s\(]+)+\68[\s\)]+;\s*(?:\?>|\Z)(?<X1224270>)|\s*=\s*['"]\\(?:x?[\da-f]{2,3}\\[\\xa-f\d]{9999,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?[\da-f]{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x?[\da-f]{2,3}\\[\\xa-f\d]{9,199}['"]\s*;\s*@?eval[\s\(]+(?:(?:\68|\71|\72)[\s\(\)]+){3};[\s\?>]*\Z(?<X1221830>)|x[a-f\d]{2}[\\x[a-f\d]{9,}['"]\s*;\s*(\$\w{1,40})\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]{9,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"]\s*\.\s*(?:(?:\68|\74)[\s\(\)]+){4,};\s*\?>(?<X1225200>)))|\(?(\$\w+)=\$_[GPCSR]\w{2,6}\[[^\]]+\]\)?\.\76\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:\?>|\Z)(?<X1224410>)))
<\?(?:[ph\s@]*(?:(?:(?:error_reporting|set_time_limit|ignore_user_abort)[\(\s]+(?:\d+|true|false)[\)\s;@]+){3}\$\w{1,40}\s*=\s*['"]/(?:var/www/|home\d*/)[^'"]+['"]\s*;\s*\$\w{1,40}\s*=\s*base64_decode[\(\s'"]+PD9[^'"]+['"][^\\]{999,}\$\w{1,40}\s*=[^\}]+\btouch\s*\([^;]+;\s*\}\s*(?:\?>|\Z)(?<X2221761>)|(?:(?:set_time_limit|error_reporting)[\(\s]+(?:0|null)[\)\s;@]+)+function\s*(\w+)[\(\s]+(\$\w{1,40})[\)\s\{]+(\$\w{1,40})[@=\s]+curl_init[\(\s]+\3[\)\s;]+curl_setopt[\(\s]+\4[,\s]+CURLO[^\}]+\}\s*(\$\w{1,40})[@=\s]+\2[\s\('"]+https://raw\.gith\w+\.c[^'"]{1,199}['"][\s\);]+echo\s*\5[;\s]+(?:\?>|\Z)(?<X1241410>)|(?:move_uploaded_file|copy)[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][,\s]+basename[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1228220>)|(?:session_start|error_reporting)\s*\([^\?\{'"]{0,199}\b(?:include|unlink\s*\()\s*['"][\.]{1,2}/[^'"]+\.(?:php|txt)[^=]{0,99}bots?\.(?:php|txt)['"]\)?;[^\n\\]{0,399}\bheader[\s\('"]+location\s*:\s*[\w\-]+\.php(?:\?\w+[=\s]+\{\s*\$_SESSION\[[^\]]+\]\s*\})?[^\}]{0,99}(?:exit|die)\b[^\?]{0,150}\?>(?<X2204093>)|(\$\w{1,40})(?:[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if[\(\s]+isset[\(\s]+\9[\)\s\{@]+preg_replace\s*\(\s*.?['"](.).{0,40}\10e\w?.?['"][,\s]+['"][^'"]*['"][,\s]+base64_decode[\(\s]+['"][^'"]*['"][\)\s;\}]+(?:\?>|\Z)(?<X1227390>)|[\s=]+['"][^;]{20,}['"]\s*;(?:\s*\$\w{1,40}[\s=]+\9\s*\[\d+\](?:\s*\.\s*\9\s*\[\d+\])+\s*;)+\s*if[\s\(]+isset[\s\(\$\{]+\9\s*\[\d+\](?:\s*\.\s*\9\s*\[\d+\])+[^\?>]+\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\9\[\d+\][^;]{1,99};[\s\};]*(?:\?>|\Z)(?<X1213540>)|[\s=]+['"][base'"\s\.]{4,9}['"]\s*\.\s*\d+\s*/\s*\d+\s*\.\s*['"][_deco\s'"\.]{4,20};\s*(\$\w{1,40})[\s=]+['"]/['"];\s*(\$\w{1,40})[\s=]+\$_SERVER\s*\[[^\]]+\][\s;]+if[\(\s]+(?:\13|\14)\s*\S{2,3}\s*(?:\13|\14)[\)\s]+\{\s*echo[\(\s]+\9[\(\s]+['"]P[a-z\+/\d]{999,}={0,2}['"][\s\);\}]+(?:\?>|\Z)(?<X1214781>))|(\$_(?:GET|POST|REQUEST|SESSION))\s*\[[^\]]+\][\(\s]+\16\s*\[[^\]]+\][\);\s]+(?:\?>|\Z)(?<X1263830>)|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+/\*\d+\*/\s*(?:chr[\(\s]+\d+\s*\)[\.\s\)]+)+;\s*(?:\?>|\Z)(?<X1229931>)|\beval[\(\s]+['"]\?>['"][\s\.]+file_get_contents[\(\s]+['"]/home\d*/[^/]+/\.cagefs/[^'"]+/\w+['"][\s\);\{\}]+(?:\?>|\Z)(?<X1273960>)|copy[\(\s]+['"]https?://[^'"]+\.txt['"],['"][^'"]+\.php['"][\);\s]*\?>(?<X1278301>)|e(?:rror_reporting(?:[\(\d\);\s]+(\$\w{1,40})\s*=\s*['"]https?://[^'"]+\.php['"];\s*\$\w+\s*=\s*file_get_contents[\(\s]+\21[\);\s@]+eval[\(\s]+['"]\?>['"]\s*\.\s*\$\w+[\);\s]+\?>\s*<div\s*style\h*=\h*['"]display\s*:\s*none["']\s*>(?:\s*<a\h+href[^>]{9,}>[^<>]{1,199}</a>)+\s*</div>(?<X1264280>)|[\(\s]+0[\)\s;]+\$\w{1,40}\s*/\*[^\*]{1,40}\*/\s*=[^\n]{999,2999}\d+(?:\W\d+){9}[^\n]{999,4999}/\*[^\*]{1,40}\*/\s*@\$\w{1,40}[\s\(]+['"][^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1216651>)|[\(\s]+\d+[\)\s;]+(?:\$\w{1,40}\s*=\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}[=\s]+str_replace[\(\s]+array[\(\s]+(base64_decode)[\(\s]+['"][^'"]*['"][^;]+;\s*(\$\w{1,40})[=\s]+\24[\('"\s]+aHR0[^\{\}]{0,999}\{[^\}]*(\$\w{1,40})[^;]+\25\b[^\?\n]{0,499}\becho\s*\26;\s*(?:\?>|\Z)(?<X1203091>)|if[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s\{]+(\$\w{1,40})[=\s]+\28[^\]]+\][\s;]+preg_match_all\s*\([^;]+,\s*\29[\s,]+(\$\w{1,40})(?:[^:]{0,499}(\$\w{1,40})[=\s]+parse_url[\s\('"]+http[^;]+\30\[[^;]+;\s*echo[\s'"]+http[^;]+\31[^;]+;)+(?:[^\}]{0,40}\}){2}\s*(?:\?>|\Z)(?<X1228570>))|[\s\(]+0[\)\s]*;\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*=\s*/\*[^\*]+\*/\s*['"][^'"]{1,40}['"]\s*\.[^\n]{4999,7999}/\*[^\*]+\*/\s*@\$\w{1,40}\s*\(\s*['"][^'"]{999,}["'][\s\)\};]+(?:\?>|\Z)(?<X1216800>)|\b[^;]{0,19};\s*\$\w{1,40}\s*=\s*(base64_decode)[\s\(]+['"]aHR0c[^;]+;\s*(\$\w{1,40})[^,]{9,199}preg\w+[\(\s]+\34[\(\s]+['"][^;,]+,\s*\$_[GPRSC]\w{2,6}\[\s*\34[^\?]{1,999}\bcurl_exec\b[^\?]+\$_[GPRSC]\w{2,6}\[\s*\34[\s\(]+['"][^'"]+['"][\)\s\]]+=+\s*\35\w+[\)\s;]+(?:\?>|\Z)(?<X1202392>)|\s*\(\s*\(\s*int[\s\)]+round[^;]+;[^@\n]{0,9999}@\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\n]+(?:\?>|\Z)(?<X1249240>))|val[\(\s]+openssl_decrypt[\(\s]+(base64_decode)[\(\s]+['"][^'"\$]{99,}['"][\s\)]+,\s*['"]AES\-256\-\w*['"]\s*,\s*\38[\s\(]+['"][^'"\$]{9,}['"][\s\)]+,\s*OPENSSL_RAW_DATA[,\s]+\38[\s\(]+['"][^'"]{1,99}['"][\s\\);]+(?:\?>|\Z)(?<X1240130>))|parse_str[\h(]+[^\)]{99,499}\);[\s@]*eval[\h\(]+(\$\w{1,25})[\[\d\]\h]+[\(\h]+\40[\h\[\d\]]+[\(\h]+\40[\[\d\]\h\(]+['"]WaomRuw/[^'"]{6000,20000}['"][\h\)\.]+['"\h]+//['"\h]+[\h\)]+;\s*(?:\Z|\?>)(?<X1209921>)|require(?:_once)?(?:[\(\s]+ABSPATH)?[\.\s'"/\(]+wp\-(?:includes|admin)[^'"]+\.(?:svg|png|jpe?g|gif)['"\)\s;]+(?:\?>|\Z)(?<X1214770>)|se(?:ssion_start[\(\)\s;@]+(require(?:_once)?)\s*['"]([^\!]{0,20})(\w*)\.php['"][;\s]*\43\s*['"]\44(\w*bots?)\.php['"][;\s]*(\$\w{1,40})[=\s]+new\s*\45[;\s]*(\$\w{1,40})[=\s]+new\s*\46[;\s]*if[\(\s\!]+\47\->checkToken[\(\)\{\s]+echo\s*\48\->throw404[\(\)\s]+;\s*(?:die|exit)\b[^;]{0,19};(?<X2204122>)|t_time_limit[\(\s]+\d+[\)\s;@]+ignore_user_abort[\(\s]+\d+[\)\s;]+\$\w{1,40}[\s=]+['"]%[a-f\d%]{9,}['"]\s*;\s*\$\w{1,40}[=\s]+['"]https?['"]\s*;[^\*]{99,}/\*[^\n\*]{1,40}\*/\s*(?:\?>|\Z)(?<X1231100>)))|[ph\s@]+(?:(?:error_reporting\(0\);\h*)?(\$\w{1,40})[=\h]+array\(@\$\{['"]\\x[^'"]+['"]\}\[[^\]]+\][^;]+;(?:\h*\$\w{1,40}[=\h@]+\51\[\d+\]\([^;]+;)+\h*\51\[\d+\]\D{2,9}\d\D{2,9}die\(\51\[\d+\]\(__FILE__[\s\)]+;[^=;]+\bmd5\(md5\(\$\w{1,40}\[\d+\][\)\s]+==+[^\}]{0,199}@\51\[\d+\]\(['"]{2}\s*,[^\}]{1,60}\}\s*(?:\?>|\Z)(?<X1209631>)|(\$\w{1,40})\s*=\s*(?:\$\s*\{['"]_[GPRC]\w{2,6}["']\}[;\(\s]+(count)\s*\(\s*\53\s*\)[^;]+\bmd5[\(\s]+gettype[\(\s]+\53[\)\.\s]+\54[\(\s]+\53[^:;]+:\s*\53\s*;\s*(\$\w{1,40})\s*=[^;'"]+['"]_[GPRC]\w{2,6}['"][^\?]+\55\s*\[\d+\]\s*\(\s*['"]{2}\s*,[^;]+;\s*(?:die|exit)\b[^;]*;[\s\};]+(?:\?>|\Z)(?<X1204940>)|array\s*\([\)\(\s'",\$base64_dcogzunmprifltv;]{40,99}(\$\w{1,40})\s*=\s*create_function[\s\(]+['"].?['"](?:\s*\.\s*['"][^'"]+['"])*\s*,(?:\s*\53\[\d+\]\s*\.){6,}\s*\53\[\d+\][\s\)]+;\s*\57[\s\(]+['"][a-z\d\+/]{999,}={0,2}['"][\s\);]+(?:\?>|\Z)(?<X1205040>))|(header)\s*\([^\)]+\)[;\s@]+error_reporting\s*\([^;]+;\s*(\$\w{1,40})\s*=\s*['"]%[a-f\d%]{99,}['"]\s*;[^\n]{0,99}(\$\w{1,40})\s*=\s*urldecode[\(\s]+\60[\)\s]+;[^\n\*]{999,}\b\59\s*\(\s*(?:\61\[\d+\]\s*\.\s*){2,}\61\[\d+\][\s\);\]\}]+(?:\?>|\Z)(?<X1202781>)|\$\w{1,40}\s*=\s*['"]\d+['"]\s*;(?:\s*\$\w{1,40}\s*=\s*['"][\\xa-f\d]{9,}['"]\s*;){3,}\s*\$\s*\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\]\s*\(\d+\)\s*;[^\n]{999,}\$\s*\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\]\s*\(\d*\)[\s;\}]+\?>(?<X1204950>)|error_reporting(?:[\(\d\);\s]+(\$\w{1,40})[=\s]+\$\{['"]\\[xa-f\d\\]{1,99}['"]\}[\s;]+if[\s\(]+in_array[\s\(]+gettype[\s\(]+\64[\s\)]+\.\s*count[\s\(]+(?:\$?\{?\64[\s\),\[\]\{\}\.\d\(=;@]+){9,}(?:\?>|\Z)(?<X1197890>)|\s*\((?:0\);\s*(\$\w{1,40})[=\s]+range[\s\(]+chr\(\d+\)(?:[\s,]+chr\s*\(\d+\))+[\s\);]+(\$\w{1,40})[=\s]+\$\{\s*\66\[\d+\](?:[\s\.]+\66\[\d+\])+[\}\s;]+if[\s\(]+in_array[\s\(]+gettype[\s\(]+\67[^;]+\67\[\d+\];\s*\67\[\d+\][=\s]+\67\[\d+\]\(\67\[\d+\][^\>\?]{0,199}\67\s*\(\)[\s;\}]+(?:\?>|\Z)(?<X1218930>)|\s*\([\s\(]*int[\)\s]+roUND[\s\(]+\-?\d+(?:\.\d+)?\s*[\+\-\*/][^\n]{99,}\bexit\b[^;]*;[\}\s;]*(?:\?>|\Z)(?<X1261530>)))|file_put_contents[\(\s]+\$_SERVER\s*\[\s*['"]DOCUMENT_ROOT['"]\s*\]\s*\.\s*['"][/\.]*wp[^'"]+\.php['"][,\s]+base64_decode[\(\s]+['"]PD8[^'"]{1,40}(?:KS5jaHI|LmNocg|Y2hyK)[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1258860>)|include(?:_once)?[\h\('"]+/tmp/sse['"\.]{0,4}ss_\w{32}['"][\h\)]+;\s*if\h*\(\h*class_exists[\h\(]+['"](\w{1,4})['"][\)\s]+\{\s*(\$\w{1,20})\h*=\h*new\h*\71[\(\)\s]{2,};\s*echo[\h\('"]*\72\->exec[\(\)\s]{2,};[\s\};]+(?:\?>|\Z)(?<X1181451>))|[ph\s\(]*(\$\w{1,40})[\s\)]*\[[^\]]+\]\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\?+\s*\d+\s*;\s*if[\(\s]+\74[\)\s]*\[[^\]]+\][\)\s\{]+@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\74[\)\s]*\[[^\]]+\][^:]+;[\s\}]*(?:\?>|\Z)(?<X1237270>))
<\?[ph\s]*(?:(//###==###)\s*(?:@?error_reporting[\(\s]+0[\)\s]+;[^\n>]{99,}\}\s*\1\s*(?:\?>|\Z)(?<X1260970>)|if[\(\s]+(?:!\h*)?(?:isset|empty)[^\n]{99,}\}\s*\1\s*(?:\?>|\Z)(?<X1261090>))|(?:(?:error_reporting|set_time_limit|ignore_user_abort)\([01]\);){2,}(\$\w+)=fopen\(['"][^'"]+['"],[^;]+;fwrite\(\4,file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+;(?:fclose\((?:\4)\);?)?\s*(?:\?>|\Z)(?<X1229080>)|(?:@?(?:error_reporting|ignore_user_abort|sleep)\s*\((?:\d+|true)\)[;\s]+){2,}\$\w+[\s=]+scandir[\s\(]+(base64_decode)[^!\n]+\$\w{1,40}!=+\6[^\?\n\+]{9,999}\$\w{1,40}[\s=]+(?:\6[\s\(]+){2}['"][^'"]{9,}['"][^\n\+]{9,}\$\w{1,40}\+[^\}\n]+\}\s*(\$\w+)[\s=]+basename[^\?\n]{99,}\bunlink\(['"]\7['"\);\s]+\?>(?<X1220981>)|(?:@?(?:error_reporting|set_time_limit|ignore_user_abort)[\s\(]+\d+[\s\)]+;\s*){3}(\w{1,40})[\s\(]+\$_[GPRSC]\w{2,6}[\s\)]+;[^=]{0,99}\$\w{1,40}\s*=\s*['"]https?://\d{1,3}(?:\.\d{1,3}){3}/[^\*\\]{999,19999}\bfunction\s+\9\s*\([^\{\}]{1,40}\{[^\*]{99,9999}\breturn\s*(?:false|true);\s*\}\s*(?:\?>|\Z)(?<X1218660>)|(?:@?(?:set_time_limit|ignore_user_abort)[\(\s]+\d+[\)\s;]+)+(\$\w{1,40})[=\s]+['"][^'"]*['"][\s;]+\$\w{1,40}[=\s]+base64_encode[\(\s@]+\$_SERVER\[['"]HTTP_[^\]]+\][^:]{9,9999}(\$\w{1,40})[=\s]+\11\s*\.[^;]+;[^\?:]+\$\w{1,40}[=\s]+['"]https?://['"][\s\.]+\12[^;]+;[^\?]{99,9999}/\*[^\*]*\*/\s*\?>(?<X1218061>)|(?:@include(?:_once)?\s*base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;\s*)+\$(?:group_num|inter_domain)\h*=\h*['"][^'"]+['"]\h*;[^\+\n]{0,999}\bfunction\s+(\w+)[\(\s]+\$[^\n]{999,}\becho\s+\14\w*[\s\(]+\$\w{1,40}\s*,\s*\$\w{1,40}[\s\)]+;\s*\w+[\(\)\s;]+\}[^\n]*(?:\?>|\Z)(?<X1237380>)|(?:\$\w+[\h=]+['"][gzinflate]['"];\s*){9}(\$\w+)\h*=[^\n]{0,599}\beval\(\16\(\$\w+\(['"][^'"]{99,}['"][\)]+;\s*\?>(?<X1255531>)|(?:\$\w{1,40}[\s=]+['"]\d+['"];\s*)+(?:/[/\*]|@)header\s*\([^\)]+\)\s*;(?:\s*\$\w{1,40}[\s=]+['"]\\x[x\\a-f\d]{9,}['"]\s*;)+\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^\n]{999,}\b(?:exit|die)\b[^;]*;[\}'"\)]+;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1209060>)|(?:\$\w{1,40}\s*=['"][^'"]+['"]\s*;\s*)?\$\w{1,40}[=\s]+["'](?:https?)?:?//[^;\n]{1,99}['"];\s*function\h*(\w+\(\))[\{\s]+\b(?:return\s*)?(?:exit|die)[^;]*;\s*\}[^\n]{999,}\becho\s*\$\w{1,40};\s*\19;\s*\};?\s*(?:\?>|\Z)(?<X1230953>)|(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?\$\w{1,40}[=\s]+["'](?:https?)?:?//[^;\n]{1,99}['"];\s*function\h*\w+[\s\(]+\$\w{1,40}[\s\)\{]+\$\w{1,40}\s*=\s*curl_init\s*\([^\}]+\}[^\n]{999,}\becho\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*else\s*\{\s*\}\s*(?:\?>|\Z)(?<X1231070>)|(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=\s*['"][^'"]+['"]\s*;\s*)+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}\s*=\s*urldecode[\s\(]+['"]%[^;]+;[^\n]{99,}\[\d+\];\h*(?:die|exit)[\(\);\}\s]+\w+[\(\$\{\s]+['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^;]+;\s*(?:\?>|\Z)(?<X2241440>)|(\$\w)[^;]+;\s*\$\w\s*=\s*\w+;\s*\$\w\s*=\s*['"]\w+['"];\s*(\$\w)\s*=\s*\23\.\$\w\.[^;]+;\s*eval\(\24\(file_get_contents\(\'\w\.txt['"]\){3};\s*\?>(?<X1247722>)|(\$\w+)=['"](?:[\w\-/\\]+\.\w+(?:\.\w+)?['"];(\$\w+)=['"]\w?['"];(\$\w+)=['"]https?://(?:\w+\.)?\w+(?:\.\w+)+(?:/\w+)+\.php\?url=['"]\.\26\.[^;]+\27[^;]+;(\$\w+)=curl_init\(\28\);[^\?]+curl_close\(\29\);\?>(?<X1259892>)|[^;]{1,199};\26=\w+\([^;]{0,199}\26\b[^;]{0,199};(\$\w+)=file_get_contents\(['"][^;]{1,199};eval\(\26\(\31\)+;?(?:\?>|\Z)(?<X1234850>)|base64_decode['"];(?:(?:ini_set\(['"](?:(?:log|display)_errors|error_log)['"],|error_reporting\()(?:0|NULL|False)\);|echo\s*['"]<html>\s*</html>['"];){2,6}(\$\w+)=['"]create_function['"];(\$\w+)=\33\(['"]{2},\26\(['"]IGVycm9yX3JlcG9ydGluZygwKTs[^'"]{9999,}['"]\)+;\34\(\);(?:\?>|\Z)(?<X1229891>))|(\$\w+)=\$_(?:[GPCSR]\w{2,6};[^\?\{]{1,99}\{(\$\w+)\[\$\w+\]\.=\36\[[^\?]{1,299}\{(\$\w+)=\37\[\d+\]\((\$\w+),\37\[[^;]+;\37\[\d+\]\(\38,[^;]{0,49}\37\[\d+\]\(\36\[[^;]+;\}(?:includ|requir)e(?:_once)?[\s\("]+\39[\s\)"]+;(?:\?>|\Z)(?<X1231900>)|SERVER\[['"]HTTP_USER_AGENT['"]\];if\(stri?pos\(\36,[^\{;]{1,199}\{(\$\w+)=['"]aHR0c[^'"]+['"];(\$\w+)=base64_decode\(\41\);echo\s*\$\w+\(\42\);\}(?:\?>)?\Z(?<X1232250>))|(\$\w+)(?:[=\s]+['"][^'"]+['"]\s*\^\s*['"][^'"]+['"];\h*(\$\w+)[=\s]+\$_COOKIE\h*;\h*foreach[\(\s]+\45\s*as\s*(\$\w+)\s*=>\s*\$\w+[\)\h]+\{\h*\45\h*\[\46\][=\h]+\44[\(\h]+[^;]+;\h*\}\h*eval[\h\(]+\45\h*\[[^\]]+\][\)\h]+;\s*(?:\?>|\Z)(?<X1234681>)|[\h=]+(file_)get(_contents)[\h\(]+['"][^'"]+\.txt['"][\h\)]+;\s*(\$\w+)[\h=]+tempnam[^\?]{0,99}\b\48put\49[\h\(]+\50[\h,]+['"<\?ph\.\h]+\44[\h\)]+;\s*include\h*\50;\s*unlink[\h\(]+\50[\h\)]+;\s*\?>(?<X1271210>)|[\h=]+['"]base['"];\s*(\$\w+)[\h=]+['"]decode['"];\s*(\$\w+)[\h=]+\44[\h\.]+['"]64_['"][\h\.]+\52;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+\53[\h\(]+file_get_contents[\h\(]+['"][^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233570>)|[\h=]+['"]https?://(?:(?:\w+\.)?acidpoll\.top/[^'"]+\.txt['"];\s*(\$\w+)[\h=]+(curl_)init\(\);\s*\56setopt\(\55[\h,]+\w+[\h,]+\44\);[^;]+;\s*(\$\w+)[\h=]+\56exec\(\55\);[^;]+;\s*eval\(['"]\?>['"][\h\.]+\57\);\s*\?>(?<X1268300>)|raw\.[^/]+/MadExploits/[^'"]+['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\60setopt[\h\(]+\59,[^,]+,\h*\44[^\?]{0,199}\b\60close[\h\(]+\59[\h\)]+;\s*eval[\h\(]+['"]\?>['"][\h\.]+\$\w+[\s\);]+\?>(?<X1235511>))|[\h=]+\$_SERVER\[[^\]]+\];\s*(\$\w+)[\h=]+\44[\h\.]+['"][^'"]+\.php['"];\s*(\$\w+)[\h=]+['"](https?://)[^'"]+\.jpg['"];\s*(\$\w+)[\h=]+\44[\h\.]+['"][^'"]+\.php['"];\s*(\$\w+)[\h\=]+['"]\64[^'"]+\.jpg['"];[^\{]{0,199}\{\s*copy[\h\(]+\63[,\h]+\62[^\{]{0,99}\{\s*copy[\h\(]+\66[,\h]+\65[\)\};\s]+\?>(?<X1237620>)|[\h=]+curl_init[\h\(\)]+;[^\{\?]{0,99}\bcurl_setopt[\h\(]+\44[\h,]+CURLOPT_URL[\h,]+['"]https?://(?:yoast\-schema\-graph|poixo)\.com/[^\{]{0,199}(\$\w+)[\h=]+curl_exec[\h\(]+\44[\h\)]+;[^\?]{0,99}\becho\h*\68;[^\?]{0,49}\?>(?<X1236701>)|[\h=]+file_get_contents[\(\h]+['"]https?://(?:\w+\.)*(?:rtpgalakx100\.xyz|mazimill\.com)/[^'"]+\.txt['"][\h\)]+;\s*\?>\s*<\?=\h*\44;\s*\?>(?<X1279940>))|(\$\w{1,25})[\h=]+(?:(curl_)init(?:[\(\)]+;\72setopt[\h\(]+\71,[^,]+,\h*['"]https?://pastebin\.com/raw/\w{1,9}['"]\);[^\?]{40,99}\b\72close[\h\(]+\71[\h\)]+;\s*echo\h*\$\w{1,25};\s*\?>(?<X1226670>)|[\h\(\)]+;\s*\72setopt[\h\(]+\71,[^,]+,\h*['"]https?://vivapasarantogel\.com/[^'"]+\.txt['"][\h\)]+;[^\?\}\{=]{0,199}(\$\w{1,25})\s*=\s*\72exec[\h\(]+\71[\h\)]+;\s*\72close[\h\(]+\71[\h\)]+;\s*echo\h*\74;\s*\?>(?<X1228291>)|[\h\(]+['"]https?://raw\.githubusercontent[^/]+/cantikalinda/[^'"]+['"][\h\)]+;[^\?]{9,199}(\$\w{1,25})[\h=]+\(?\72exec[\h\(]+\71[\h\)]+\)?;\s*\72close[\h\(]+\71[\h\)]+;\s*echo\h*\76;\s*\?>(?<X1227810>))|(file_)get(_contents)[\h\(]+['"]https://raw\.githubusercontent\.com/[^/]+/web\Wshell/[^'"]+\.php['"][\h\)]+;\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\{]{0,199}\bif[\h\(]+\78put\79[\h\(]+\80,\h*\71[\h\)]+\{[^\?]{0,199}\?>(?<X1250300>)|['"\.base64_dco]{9,40};\s*(\$\w{1,25})[\h=]+['"\.gzuncompres]{9,40};\s*error_reporting\((?:0|NILL)\);\s*ini_set\([^\)]+\);\s*eval\(\82\(\71\(['"][^'"]{300,3000}\bv77t\+IrxeM99onjv\+3fxLc=['"][\h\)]+;\s*\?>(?<X1226710>)))
<\?[ph\s]*(\$\w{1,40})(?:[=\h@]+urldecode[^;]+;(?:\$\w{1,40}[=\h]+(?:\1\[[\d]+\](?:\.|\;))+\h*){3,}[^\;]+;[^\(\)\n]{0,499}\bfunction\h*\w{1,40}[\(\h]+\$[^#`\n]{999,}\bheader[\(\h]+\$\w{1,40}[^;]*;\h*echo[\h\(]*\$\w{1,40}[^;]*;\h*die[^;]*;[\h\}]+\w{1,40}[\h\(]+\$\w{1,40}[,\h]+\$\w{1,40}[\)\h]+;\s*(?:\?>|\Z)(?<X1208514>)|[=\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s;@]+\1[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1216640>)|[=\s]+<<<EOD\b[^;]{499,}\vEOD;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+gz\w+[\(\s]+\4[\)\s]+;\s*(\$\w{1,40})[=\s]+tempnam\b[^;]+;\s*@?file_put_contents[\(\s]+\6[,\s]+\5[\)\s;@]+include(?:_once)?[\s\(]*\$\w{1,40}[;\s@]+unlink[\(\s]+\6[\)\s;]+(?:\?>|\Z)(?<X1250890>)|[=\s]+@(\$_FILES)\[[^\]]+\][\s;]+if[\(\s]+\1\[[^\]]+\][^'"\w]{1,9}['"][^'"]*['"][\)\s\{]+(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s]+(?:\1|\8)\[[^\]]+\][\s;]+if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+(?:\1|\8)\[[^\]]+\][,\s]+\9[^\}]+\}[\s\}@]*(?:exit|die)\b[^;]*;\s*(?:\?>|\Z)(?<X1237150>)|[=\s]+['"]([^'"\$]+)['"]\s*;\s*\$\w{1,40}[=\s]+class_exists[\(\s]+\1[\)\s]+;[^\{\}\n]{0,99}\bif[\(\s]+!\$\w{1,40}[\)\s]+\{\s*class\s*\11\s*\{\s*private\s*\$\w{1,40}[\s;]+public\s*static\s*\$\w{1,40}\s*=[^\n\?]{999,}\}\s*\$\w{1,40}[=\s]+new\s*\11[\s\(\)]+;[^\?\n]{0,40}(?:\?>|\Z)(?<X1239920>)|[=\s]+['"](\w{1,40})['"]\s*;\s*(\$\w{1,40})[=\s]+class_exists[\(\s]+\1[\)\s]+;\s*(\$\w{1,40})[=\s]+\14\s*;\s*if[\(\s]+!\h*\15[\)\s]+\{\s*class\s*\13\s*\{[^\?]{99,}(\$\w{1,40})[=\s]+new\s*\13[\(\)\s]+;\s*\16[=\s]+(?:NULL|['"]{2}|false)\s*;\s*\}\s*(?:\?>|\Z)(?<X1240690>)|[=\s]+['"]<img\s+src[=\s'"]+data:image/(?:pn|jpe?)g;[^;]{99,}['"]\s*>\s*['"][\s;@]+preg_match[\(\s]+['"]\W<img[^,]+,\s*\1[,\s]+(\$\w{1,40})[\)\s;]+(\$\w{1,40})[=\s]+\18\s*\[\s*\d+[\]\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\19[\)\s;]+(?:\?>|\Z)(?<X1233660>)|[=\s]+['"]['"\h\.base64_dco]{16,40}['"][;\s@]+(?:(?:error_reporting[\s\('"]+(?:null|0)[\s\);]+)+[^=\.\n]{0,199}(\$\w{1,40})[=\s]+['"]['"\h\.creat_funio]{15,40}['"][\s;]+(\$\w{1,40})[=\s]+\21[\s\(]+['"]{2}[,\s]+\1[\s\(]+['"][^'"]+['"][\s\);]+\22[\s\(\);]+(?:\?>|\Z)(?<X1229780>)|(?:ini_set[\s\('"]+(?:error_log|display_errors)['",\s]+(?:null|0)[\s\);]+)+[^=\.\n]{0,199}(\$\w{1,40})[=\s]+['"]['"\h\.creat_funio]{15,40}['"][\s;]+(\$\w{1,40})[=\s]+\24[\s\(]+['"]{2}[,\s]+\1[\s\(]+['"][^'"]+['"][\s\);]+\25[\s\(\);]+(?:\?>|\Z)(?<X1229770>))|[=\s]+['"]['"\h\.base64_dco]{16,40}['"]\s*;\s*(\$\w{1,40})[=\s]+['"]['"\h\.gzuncompresiflate]{13,40};[^\(]{0,99}\berror_reporting[\s\(]+0[\)\s]*;[^\+]{0,499}(\$\w{1,40})[=\s]+\$\w{1,40}[\s\(]+['"]{2}\s*,[^'";]{0,99}(?:(?:\1|\27)[\s\(]+)+['"][^'"]{99,}['"][\s\);@]+\28[\s\(\);]+(?:\?>|\Z)(?<X1229840>)|[=\s]+['"][^'"]{2,9}['"][\s;]+\$\w{1,40}[=\s]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}/?['"][\.\s]+\1[^:]+;\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s\{]+\$\w{1,40}[=\s]+curl_init[\s\(\)]+;[^@]{99,}\?.{0,9}sitemap=[^;]+;[^&]{99,}(?:&&\s*substr|\bstrtolower[\(\s]+isset)[\s\(]+\$_SERV[^>]+Not\s*Found['"\);\s\}]+(?:\?>|\Z)(?<X1217801>)|[=\s]+['"][file_put_cons\s'"\.]{17,99}["']\s*;\s*(\$\w{1,40})[=\s]+['"][file_gt_cons\s'"\.]{17,99}["']\s*;\s*\$\w{1,40}\s*=[^;]+;\s*if[\s\(]+isset[\s\(]+(\$_FILES)\s*\[[^\]]+\][\s\)]+\{\s*\1[\s\(]+\32(?:\s*\[[^\]]+\]){2}[,\s]+\31[\s\(]+\32(?:\s*\[[^\]]+\]){2}[^\?]{9,199}(?:\?>|\Z)(?<X1218960>)|[=\s]+['"]\w+['"](?:[\s\.]+/\*[^\*]*\*/\s*['"]\w+['"])+;\s*\1[\s\(]+\d+[^\(\n]{0,199}ini_set[\s\(]+\1[^!]{0,999}\bif[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+\1[\(\s]+['"][^'"]*['"][\)\s]*!==\s*false[\)\s]+\{[^\?]{0,199}\{\s*(\$\w{1,40})\s*=[chr\(\)\d\.]{999,};\s*echo\s*\34[;\s\}]*(?:\?>|\Z)(?<X1228660>)|[=\s]+['"]https?://(?:['"];\s*\$\w{1,40}[=\s]+\1\s*\.\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\!]{1,99}(\$\w{1,40})[=\s]+urldecode[\(\s]+(?:base64_\w*[\(\s]+)?\$\w{1,40}[\)\s]+;\s*(\$\w{1,40})[=\s]+['"]\?>['"];\s*(\$\w{1,40})[=\s]+(?:(?:\37|\36)[\.\s]*){2,};\s*@?eval[\(\s]+\38[\)\s]+;\s*\?>(?<X1203710>)|[^'"]{9,40}\.txt['"\s;]+(\$\w{1,40})[=\s]+['"](?:[_tfegoclnis'"\.\s]{17,}|[_tnrclui'"\.\s]{9,})['"\s;]+(\$\w{1,40})[=\s]+\40[\(\s]+\1[\)\s;]+(\$\w{1,40})[=\s]+strrev[\(\s]+['"][_tpfeoculnis\s'"]{17,}['"][\)\s;]+\42[\(\s]+['"][^'"]+\.php['",\s]+\41[\)\s;]+(?:\?>|\Z)(?<X1206580>))|[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*(\$\w{1,40})[=\s]+\1\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})[=\s]+\1\s*\[[^\]]+\]\s*;\s*if[\(\s]+isset[\(\s]+\44[\)\s@]+\44[\(\s]+\45[\)\s;]+(?:\?>|\Z)(?<X1238860>)|[=\s]+base64_decode(?:[\(\s]+['"][YZcUQR][^'"\$\(\)]+['"][\)\s]+;\s*@?\1[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1234700>)|[\s\(]+['"][^;]+;\s*@?error_reporting[\(\s]+0[\)\s]+;[^\n]{99,}\$\w{1,40}[=\s]+explode[\s\(]+\1\[\d+\][^,;]+,\s*trim[\s\(]+\w+[\s\(]+\$\w{1,40}\s*\.\s*\$\w{1,40}[\s\);]+(?:\?>|\Z)(?<X1259840>)|\s*;\s*(\$\w{1,40})[\s=]+\1[\(\s'"]+YXNzZXJ0['"\)\s;]+\49[\(\s]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s;]+(?:\?>|\Z)(?<X1214080>))|[=\s]+curl_init\s*\(\s*\)\s*;\s*curl_setopt[\(\s]+\1[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0cHM6L2xpbm[^'"\n]{9,99}['"][\)\s]+;[^=\?\n]{0,99}\becho\s*curl_exec[\(\s]+\1[\)\s;]+(?:\?>|\Z)(?<X1217680>)|[=\s]+fopen[\(\s]+(base64_decode)[\(\s]+['"][^'"]+['"][\)\s]+[,\s]+\52[\(\s]+['"][^'"]+['"][\)\s;]+(fwrite)[\(\s]+\1[,\s]+\52[\(\s]+['"]PD9[^'"]+['"][\)\s;]+\53[\(\s]+\1[,\s]+\52[\(\s]+['"][^'"]+['"][\)\s;@]+fclose[\(\s]+\1[\)\s]+;\s*(?:\?>|\Z)(?<X1208600>)|[=\s]+function[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]+['"]\s*;\s*\$\w{1,40}[\s=]+\$\w{1,40}\s*\[\s*\d+\s*[\-\*\+/]\s*\d+[^@\*\?]{999,}(\$\w{1,40})[=\s]+\1[\s\(]+\55[\s\);@]+eval[\s\(]+\55[\s\);]+(?:\?>|\Z)(?<X1212380>)|[=\s]+sys_get_temp_dir[\(\)\.\s]+['"][^'"]*['"][\.\s]+(?:(?:md|sha)[5261]+[\(\s]+)+rand[\(\s\d,\)\s;@]+file_put_contents[\(\s]+\1[,\s]+gz\w+[\(\s]+pack[\(\s'"]+H\*['"][,\s]+['"][^'"\n]{999,}['"][\)\s;@]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\{\('"]{1,3}?\1[^\?\n]{0,199}(?:\?>|\Z)(?<X1256070>)|[\s=]+['"](?:\\x?[\da-f]{2,3})+['"]\s*;\s*(?:(\$\w{1,40})[\s=]+['"](?:\\x?[\da-f]{2,3})+['"][\s;]+)+@eval[\s\(]+\1\s*\([^;\)]*file_get_contents[\s\(]+\58[\)\s;]+(?:\?>|\Z)(?<X1227380>)|[\s=]+['"][^'"\$]{1,9}['"]\s*;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+\1[,\s]+['"]r['"][\)\s]+;\s*if[\(\s]+\60[\)\s]+\{\s*(\$\w{1,40})[=\s]+fread[\(\s]+\60[,\s]+filesize[\(\s]+\1[\)\s]+;\s*@?eval[\(\s]+base64_decode[\(\s]+\61[\)\s]+;\s*fclose[\(\s]+\60[\)\s;\}]+(?:\?>|\Z)(?<X1230030>)|[\s=]+\$_SERVER\[[^\]]+\][\s;]+(?:\$\w{1,40}[\s=]+\1[\.\s]+['"][^'"]+php['"][;\s]+\$\w{1,40}[\s='"]+http:/[^'"]{4,}\.txt['"\s;]+)+(?:if[\(\s]+!file_exists[\(\s]+(\$\w{1,40})[\)\s\|]+filesize[\(\s]+\63[\)\s<]+\d+[\)\s\{]+unlink[\s\(]+\63[\s\);@]+copy[\s\(]+\$\w{1,40}[,\s]+\63[\s\);\}]+)+\?>(?<X1238090>)|\s*=['"\h\.strev]{11,40};\s*(\$\w{1,40})\s*=['"\h\.base64_dco]{15,40};\s*(\$\w{1,40})\s*=['"\h\.gzuiflatncompres]{15,40}\;\s*error_reporting[\(\s]+0[\)\s]+;\s*@?eval[\s\(]+(?:(?:\1|\65|\66)[\s\(]+){3}['"][^'"]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1228590>)|\s*=[\s\(]*\$_(?:GET|POST|COOKIE|REQUEST)\s*\[[^\]\$]+\][\s\)]*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*\1(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057441>)|\s*=[^;\-\+\(\)]{0,9}\bchr[\(\s]+\d+\s*\-\s*\d[^;]+;\h*(\$\w{1,40})[=\s]+class_exists[\(\s]+\1[\)\s]+;\h*(\$\w{1,40})[=\s]+\69[;\s]+if[\s\(]+!\h*\70[\)\{\s]+class\s*\w+\s*\{[^\n]{99,}\b(?:exit|die)\b[^;]*;(?:\s*\}){3}\s*\$\w{1,40}[=\s]+new\s*\w+[\(\s]+[\)\s]+;[^\}\n]*\}\s*(?:\?>|\Z)(?<X1242291>)|\s*=\s*['"\h\.base64_dco]{17,40};(?:[^\(]{0,199}\bini_set[\(\s]+['"](?:display_errors|error_log|log_errors)['"][,\s]+0[\s\)]+;[^=]{0,199}eval\s*\([^'";\)]{0,39}\1[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1230010>)|[^\(]{0,99}\berror_reporting[\(\s]+0[\)\s;@]+eval\s*\([^'";\)]{0,39}(?:\1)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1229950>)))
<\?[ph\s]*(?:(\$\w{1,40})(?:\s*=\s*['"\h\.str_o13]{17,40};\s*(\$\w{1,40})\s*=\s*['"\h\.base64_dco]{17,40};[^\(]{0,199}\bini_set[\(\s]+['"](?:display_errors|error_log|log_errors)['"][,\s]+0[\s\)]+;[^=]{0,199}eval\s*\([^'";\)]{0,39}(?:\1|\2)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1230020>)|\s*=\s*['"\h\.stro13_]{14,40};\s*(\$\w{1,40})\s*=\s*['"\h\.base64_dco]{17,40};[^\(]{0,99}\berror_reporting[\(\s]+0[\)\s;@]+eval\s*\([^'";\)]{0,39}(?:\1|\4)[^'";\)]{0,39}\(['"][a-z\+/\d]{99,}=?=?['"][\s\);]+(?:\?>|\Z)(?<X1229940>)|\s*=\s*['"](?:(?:[base64_dco\s'"\.]{16,}|[strev'"\.\s]{9,})['"]\s*;[^\+\n]{0,299}\beval\s*\([^'";]{0,199}\1[^'";]{0,199}['"][=a-z/\+\d]{999,}['"][\s\);]+(?:\?>|\Z)(?<X1239150>)|['"\h\.base64_dco]{13,40}['"];\s*(?:(\$\w{1,40})\s*=\s*['"]['"\h\.str_o13]{11,40}['"];\s*@?error_reporting[\(\s]+(?:null|0)[\)\s]+;\s*ini_set[\s\('"]+error_log['",\s]+(?:null|0)[\s\)]+;\s*@?eval[\s\(]+(?:(?:\1|\7)[\s\(]+)+['"][^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1229050>)|@?error_reporting[\(\s]+0[\)\s]+;\s*ini_set[\s\('"]+error_log['",\s]+(?:null|0)[\s\)]+;\s*@?eval[\s\(]+\1[\s\(]+['"]IGVycm9yX3JlcG9ydGluZ[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1229041>))|[^'"\$]+['"]\s*\^\s*(?:pack[\(\s]+['"]H\*['"]|hex2bin)[,\s\(]+['"][a-f\d]{9,}['"][\)\s]+;(?:\s*\$\w{1,40}[=\s]+['"]['"]\s*;)?(?:\s*\$\w{1,40}[\.\s=]+\1[\(\s]+['"][^;]+;){9,}[^,\{\}\.]{0,499}\bpreg_replace(?:\s*/\*[^\*]*\*/)?\s*\((?:\s*/\*[^\*]*\*/)?\s*\1(?:\s*/\*[^\*]*\*/)?\s*\((?:\s*/\*[^\*]*\*/)?\s*['"](?<X2240601>)|ba['"]\s*\.\s*['"]se['"]\s*\.\s*\d+\s*[/%\*\+]\s*\d+\s*\.\s*['"]_['"]\s*\.\s*['"]de['"]\s*\.\s*['"]co['"]\s*\.\s*['"]de['"]\s*;\s*echo\s*\1[\s\('"]+PHAgc3R5bGU9InBvc2l0aW9u[^'"]{99,}['"][\s\);]+(?:\?>|\Z)(?<X1215830>))|\s*=\s*\$\{['"][GOBALS\\x4791532cf]{9,28}['"]\};\s*if\(in_array\(gettype\(\1[^\{]{0,40}\{\s*@?\1\[\d+\]\s*=\s*(?:\1\[\d+\]\s*\.?)+;\s*@?\1\[\d+\]\s*=\s*\1\[\d+\][\s\(]+\1\[\d+\][^\?&>\n]{9,999}&&\s*die\((\$\w{1,40})\[[^;]*;[^\n]{9,499}\12\[\d+\]\([^;]+;\s*die\b[^;]*;[\s\}]*(?:\?>|\Z)(?<X1209580>)|\s*=\s*file_get_contents[\(\s]+['"]https?://[^'"]+/backlink\b[^;]+;\s*echo\s*\1;\s*(?:\?>|\Z)(?<X1235551>))|(\$\w{1,8})[=\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][;\s]*if[\(\s]+\15\s*!=\s*['"]\w{32,64}['"][\)\{\s]+(?:die|exit)[^\[]{5,99}(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^%:_\?]{20,199}\bif[\(\s]+\16\s*==+\s*["']\w+['"][^\}]+\bmkdir\s*\([^!%\^&:\?]{20,199}\bif[\(\s]+\16\s*==+\s*["']\w+["'](?<X2254001>)|(\$\w{1,9})\s*=\s*curl_init[\(\)\s]+;\s*curl_setopt[\(\s]+\18\s*,\s*CURLOPT_URL\s*,\s*['"]https?://[^/\$]+/\w+\.php/?['"][\)\s]+;\s*curl_setopt[\(\s]+\18\s*,\s*CURLOPT_RETURNTRA[^;]+;\s*(\$\w)\s*=\s*curl_exec[\(\s]+\18[\)\s]+;\s*curl_close[\(\s]+\18[\)\s;\?><ph]+\becho\s*\19[;\s]*(?:\?>|\Z)(?<X1255350>)|(\$\{['"]GLOBALS['"]\})(\[[^\]]+\])[\h=]+['"]\w+['"];[^\?]{9,399}\bCURLOPT_URL,\h*['"]https?://[^'"]+\.(?:jpe?g|png|txt)['"]\);\s*curl_setopt\(\$\{\21[^;]+;\s*(\$\{\21\[[^\]]+\]\})[\h=]+curl_exec\(\$\{\21\22\}[^\?]{9,99}\beval\(['"\?>\.\h]+\23\);\s*\?>(?<X1266450>)|(\$GLOBALS\[[^\]]+\])(?:=Array\([^;]+;[^@#]{1,199}(?:\25\[[^\]]+\]\([^;]+;\s*@?){2,}(\$\w+)[\s=]+@?\25\[[^\]]+\]\([^;]+;\s*@?eval[\s\(]+\26[\s\)]+;\s*(?:\?>|\Z)(?<X1216762>)|[\h=]+['"]https?://glot\.io/[^'"]+/\w+\.php['"];[^\?]{99,999}(\$\w{1,40})\s*=[^;]+\25[^;]+;\s*@?eval[\h\('"\?>\.]+\28[\h\)]+;\s*(?:\?>|\Z)(?<X1206971>)|[\h=]+array[\h\(]+base64_decode[^\n]{999,5500}\bif[\h\(]+(round)\([^\)]+\)\W{1,3}\30\([^\)]+[\)\W]+\25\[\d+\]\([^\)]+[\)]+\25\[\d+\]\([^\)]+\);[^\n]{999,5500}\)\25\[\d+\]\(\$\w+,\h*\$_COOKIE\);\s*\?>(?<X1260740>))|(\$group\w{1,40})\s*=\s*['"]\w{1,40}['"]\s*;\s*\$\w{1,40}\s*=\s*['"]http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/*['"][\.\s]+\32[\.\s]+['"][^'"]*['"]\s*;[^\n@]{99,9999}\bif[\(\s]+stristr[\(\s]+@file_get_contents\s*\([^\n]{99,9999}\}\s*else\s*\{\s*\}\s*\?>(?<X1225280>)|(\$pa?s?s?wo?r?ds?)[\s=]+['"][^'"]*['"][^=]{0,99}if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}\34[\)\s\{]+if[\(\s]+(\$_[GPRSC]\w{2,6})[\)\s\{]+(\$\w{1,40})[=\s]+fopen[\(\s]+\35\[[^\}]{0,40}if[\(\s]+fwrite[\(\s]+\36[,\s]+\35\[[^\}]{0,40}echo\s*['"][^'"]*['"][\s;]+(?:else[\s\{]*echo\s*['"][^'"]*['"][;\s\}]+)+(?:\?>|\Z)(?<X1226500>)|(\$var_)\w+=[^;]+;\h*\38\w+=[^;]+;\h*\38\w+=dirname\(__FILE__\)\.(base64_)decode\([^\n\?]{999,3500}\bfwrite\((\38\w+),\39encode\((\38\w+)[\h\)]+;fclose\(\40\);\h*return\h*\41;\h*\}\h*return\h*\w+;\h*\}\h*\?>(?<X1254100>)|(file_put_contents)[\(\s]+['"](\w+\.php\d*)['"][,\s]+['"]<\?[ph\s]*['"][\.\s]+['"][^'"]+['"][,\s]+(FILE_APPEND)[\)\s]+;[^\+]{0,499}['"]\$\w{1,40}\s*=\s*\\?["']e[^'"]{99,}['"][^\?]{9,9999}\?>[^;]+;\s*\43[\s\('"]+\44['"][,\s]+['"][^;]+\45[\s\)]+;[^\?]{0,199}(?:\?>|\Z)(?<X1228441>)|(function)\h*(?:\w+[\h\(]+(\$\w{1,25})[\s\)\{]+return\h*gzinflate[\h\(]+\48[\h\)]+;[\s\}]+\47\h*\w+[\h\(]+(\$\w{1,25})[\s\)\{]+(\$\w{1,25})[\h=]+['"][base64_dco]+['"];\s*(\$\w{1,25})[\h=]+(?:['"]b['"]|\50\[)[^;]+;\s*return\h*\51[\h\(]+\49[\h\)]+;[\s\}]+\?>(?<X1228790>)|curl_get_contents\((\$\w+)\)\{\$\w+=curl_init\(\);[^\{]+\47\h*(?:(getServerCont)\(\53,\$\w+=array[\(\)]+\{\53=str_replace\([^\n]{999,4500}\bmain_shell['"]\][^\n]{99,999}\becho\h*\54\d+\(\$\w+,\$\w+\);[^\{\n]{0,99}\{\h*[^>]{1,99}\b(?:exit|die);(?:\}\s*\w{2}\(\);\})?\s*\?>(?<X1253563>)|getServerCont\(\53,\$\w+=array[\(\)]+\{\53=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+;\h*\}\h*\w+[\(\)\h]+;(?:\h*\$\w+[\h=]+['"]{2};)?\h*\?>(?<X1261541>)|getServerCont\(\53,\$\w+=array[\(\)]+\{\53=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+\h*;\h*\$\w+\h*=['"\h]*\w+['"];\w+\(\)[\s;\}]+(?:\?>|\Z)(?<X1272520>)|getServerCont\(\53,\$\w+=array[\(\)]+\{\53=str_replace\([^\n]{999,5000}\bmain_shell['"]\][^\n]{99,999}\becho\h*\$\w+\h*;\s*\w+[\(\)\h]+;[^\}]+\}\s*\?>(?<X1279930>)))|(function)\s*(?:\w+[\(\s]+(\$\w{1,40})[\s=]+['"]['"][\)\s]+\{\s*(\$\w{1,40})[\s=]+['"]\w{1,5}['"][\s;]+\61\s*\.=\s*['"]\w{1,5}['"][^\?\n]{9,199}\60\?[^;]+;[^\+]{9,499}\b(?:\w{1,40}[\s\(]+)+['"][^'"]{999,}['"][^@]{0,999}@eVaL\(\$\w+[^\?]{9,499}\59\s*\w+[\(\s]+(\$\w{1,40})[\)\s\{]+return\s*\62[\};\s]+\?>(?<X1220050>)|\w{1,40}[\(\s]+(\$\w{1,40})(?:[=\s]+['"]['"][\)\s]+\{\s*return\s*explode[\(\s]+['"].['"][,\s]+(\w+)[\(\s]+\64[\.\s]+['"][^'"\$]*['"][\)\s;\}]+\59\s*\65[^/]{9,9999}\}\s*(\w+)\s*\([^;'"]+['"][a-z\d/\+]{999,}['"][^\?@]{0,999}\59\s*\66[\s\(]+(\$\w{1,40})[\s\)@\{]+eval[\s\(]+\67[^\?]{0,199}\?>(?<X1219520>)|\s*=\s*['"]['"][\)\s]+\{\s*(return)\s*explode[\(\s]+['"],['"][,\s]+\w{1,40}[\(\s]+\64[\.\s]+['"][^'"]+['"][\)\s;]+\}\s*\59\s*\w{1,40}[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s\{]+define[^<]{99,9999}<[^=\[]{0,50}(\$\w{1,40})\[[^\]]+\]\s*=[^\?>]{1,499}\b\69\s*\70[^\?]{0,99}\?>(?<X1220501>)))|/(?:/(###==\s*\d+\s*==###)\s*@?ini_set[\(\s]+['"]display_errors['"][,\s]+(?:false|0)[\)\s]+;\s*@?error_reporting[\(\s]+\d+[\)\s]+;[^\?=\}]{0,499}(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;[^#>]+\becho\s*\73\s*;[\s\}]*//\72\s*(?:\?>|\Z)(?<X1229110>)|\*[^\*]+\*/\s*@?error_reporting[\s\(]+0[\)\s]+;\s*/\*[^\*]+\*/\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*=\s*/\*[^\*]+\*/[^\n]{999,9999}@\$\w{1,40}[\s\(]+['"][\da-z\+/]{999,}['"][\s\);]+(?:\?>|\Z)(?<X1221741>)|\*\s*<=====street\s+magic=====>\s*\*/\s*/\*\s*<David\s+Blaine>:[^\$]+(\$GLOBALS\[[^\]]+\])=Array\(base64_decode\([^#]{99,9999}\76\[\d+\]\((?:\$\w{1,40},?)+[\s\)]+;[\s\}]*/\*[^\*]+\*/\s*(?:\?>|\Z)(?<X1222120>)|\*\s*Visit\s+our\s+shop\s+orvx\.pw\b[^/]+\*/\s*@?eval\s*\([^\n]+?\b__halt_compiler[\s\(\)]+;(?<X2200593>))|;;+error_reporting\(0\);\$\w+=str_replace[^;]+;+\$\w+=\(\$\_[GPRSC]\w{1,6}\[[^\n@]{999,}\belse\s*\{\s*(\$\w{1,40})\s*=\s*\$\w+[;\}\s]+return\s*\79[;\s]*\}[;\s]*\?>(?<X2257561>))
<\?[ph\s]*(?:@(?:['"]\$\s*\w{1,40}=\s*\w{1,40}=https?://[^'";]{40,}['"]\s*;\s*\$\w+\s*=\s*explode\s*\([^\n]{999,}\}\s*\w+[\(\);\s]*(?:\?>|\Z)(?<X1260650>)|\$_SERVER\[([^\]]+)\][=\s]+\$_SERVER\[\2\]\s*;\s*if[\(\s]+in_array[\(\s]+['"]curl['",\s]+get_loaded_extensions\([\)\s]+\{[^\n\?]{999,}\?['"][\s\.]+urldecode[^\}]+\}\s*else\s*\{\s*header[\("'\s]+Location\s*:\s*https?://[^;]+;\s*\}\s*(?:exit|die)\b[^;]*;\s*\}\s*(?:\?>|\Z)(?<X1232640>)|\s*['"]\s*\$\s*\w{1,40}\s*=\s*\w{1,40}\s*=\s*https?://[^'"]+['"]\s*;\s*\$\w+\s*=[^\n]{99,}\b(?:exit|die)\b[^;]*;(?:\s*\}\s*)+\w+[\(\)\s]+;\s*(?:\?>|\Z)(?<X1261470>)|header[\(\s'"]+Content\-[^\)]+\)\s*;\s*@?error_reporting\(0\)[\s;]+(\$\w{1,40})\s*=\s*['"]%[a-f%\d]{99,9999}[""]\s*;\s*global\s*(\$\w{1,40});\s*\6[\s=]+urldecode\s*\(\s*\5[^\n\*#]{999,}\bheader[\s\(]\6\{\d+\}(?:\s*\.\s*\6\{\d+\})+\s*\)[\s;\}]+(?:\?>|\Z)(?<X1215700>)|include(?:_once)?\s*base64_decode[\(\s]+['"](?:[^'"\$]{9,299}['"][\)\s;]+\$(?:group_num|inter_domain|i[tfn]_do(?:main)?)\d*\s*=\s*['"]{2}[\s;]+\?>(?<X1237930>)|L2hvb[^'"]{9,199}['"][\)\s;]+\?>(?<X1238680>))|ini_set[\(\s'"]+max_execution_time['",\s]+0[\)\s;]+while[\(\s]+True[\)\s\{]+if[\(\s]+!(file_)exists[\(\s'"]+(/home\d*/[^/]+/public_html)['"\)\s\{]+mkdir[\(\s'"]+\11[^=]{0,599}=\s*base64_encode[\s\(]+\10get_contents[\s\('"]+/tmp/\.sessions/\.L2[^'"]+['"][^%]{0,999}['"]%o['",\s]+fileperms[^\?]{0,40}(?:\?>|\Z)(?<X1228730>))|\$(?:(?:group_num|inter_?domain\d*|it_domain|i[ftn]_do)[=\h]+['"][^'"]+['"]\h*;[^,\n]{0,999}\bcurl_setopt[\s\(]+\$\w+\s*,[^\n]{999,}(?:\?>|\Z)(?<X1236418>)|(?:group_num|inter_domain|i[tfn]_do(?:main)?)\d*\s*=\s*['"][^'"]+['"]\s*;\s*if[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+['"]\.php['"\)\s]+\{\s*\$main_shel\w+\s*=\s*\$\w{1,40}\s*\.[^\n>]{99,9999}\bgetServerCont\d*[\(\s]+\$\w+[,\s]+\$\w+[\)\s;]+\}\s*else\s*\{\s*\}\s*\?>(?<X1237950>)|(GLOBAL)S\[['"](\w+)['"]\];\15(\$\16);\$\16=\$\15s;\17\[[^\]]+\]=['"]\\x[a-f\d\\x]{99,9999}['"];\17\[\17\[[^\]]+\]\[\d+\]\.\17\[[^\?\n]{99,}if[\s\(]+(\$\w{1,40})\[\17\[[^\]]+\]\[\d+\]\][^\s\w;]{2,3}\17\[[^\]]+\]\[\d+\][\s\(\)\{\};]+eval[\s\(]+\18\[\17\[[^\]]+\][^;]*;[\s\}]+(?:exit|die)\b[^;]{0,40};[\s\}]*\?>(?<X1217500>)|[o0]{1,9}[=\s]+['"]\w{1,9}['"];\s*\$goweb=['"]{2};\s*if[\(\s]+is_https\s*\(\)\s*\)\s*\{\s*\$\w+\[['"]http['"]\][=\s]+['"]https['"];\s*\}\s*else\s*\{\s*\$\w+\[['"]http['"]\][=\s]+['"]http['"];\s*\}\s*(?:\?>|\Z)(?<X1216930>)|[o0_]{1,40}[\s=]+@?urldecode[\(\s]+['"]%[a-f\d%]{99,}['"](?:[\s\);]+\$[o0_]{1,40}[\s=]+\$[o0_]{1,40}\{\d+\}\.\$[^\n<]{999,}@\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\$[o0_]{1,40}[,\s]+\$[o0_]{1,40}[\s\);]+\}['"\)\s;]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\([01][\);\s]+(?:\?>|\Z)(?<X1232710>)|[\s\)]+;[^\n<]{999,}@\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\$[o0_]{1,40}[,\s]+\$[o0_]{1,40}[\s\);]+\}['"\)\s]+;\h*@?\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\([01][\);\s]+(?:\?>|\Z)(?<X1232480>))|\w+=['"][^;]+;\$\w+=['"]http['"];if\(is_https\(\)[^@]{499,1999}(\$\w+)=(\w{1,4}outdo\(\$)[^\}]{1,199}=str_i?replace\(['"]ok(?:ht|x)mlget(content)['"],['"]{2},\23\);echo\s*\23;(?:exit|die)\b[^;]{0,19};[^@]{499,1999}\bfunction\s+\24(\w+)\)\{[^\?/]{0,499}(\$\w+)=file_get_\25s\(\$\26\)[^\?]{1,199}\breturn\s*\27[;\}\s]+(?:\?>|\Z)(?<X1232030>)|\w+[=\s]+['"]https?://\d+\.\d+\.\d+\.\d+/\w+/?['"]\s*;\s*function\s*(\w+)[\(\)\s]+\{\s*(?:exit|die)\b[^;]{0,40};\s*\}[^\n\*]{999,}\becho\s*\$\w+\s*;\s*\29[\s\(\)]+;[\s\};]*(?:\?>|\Z)(?<X1229651>)|\w+\s*=\s*(?:chr|['"]\\|['"]\w)[^\{\}]{99,399}\{\s*function\h*\w+[\(\)\h]+\{\s*return[^\{]{0,99}\bclass\h*(\w+)\s*\{\s*(?:public|private)[^\n]{9,699}\b_POST;\h*\$\w+[\h=]+\$_COOKIE;\h*\$\w+[^\n]{9,1599}\bnew\h*\31[\(\d\)\h]+;[^\}]+\}\s*\?>(?<X1256855>)|\w{1,19}\s*=\s*['"]f[^'"]{1,9}['"][\s;]+\$\w{1,40}\s*=\s*['"]https?://[^'"]{1,40}\.(?:top|xyz|ga)['"][\s;]+function\s*?\w{0,9}(get_content)s[\(\s]+\$\w{1,40}[\)\s]+\{[^\*\\]{999,}\becho\s*\$\w{0,9}\33s?[;\s@]+(?:exit|die)\b[^;]{0,19};[\s\}]+else\s*\{\s*@?header\b[^;]*Not\s*Found['"\)\s;\}]+\?>(?<X1208030>)|\w{1,25}[\h=]+['"](?:error_reporting|display_errors)['"];[^\?]{99,399}\bif[\h\(]+\$\w{1,25}\h*\D{2,3}[^\{]+\{\s*(\$\w{1,25})[\h=]+['"]\h*<(script)[^>]{0,99}\bsrc[\h=]+['"]https?:\s*//track\.violetlovelines\.com/[^>]{0,99}></\36>\h*['"];\s*echo\h*\35;\s*\}\s*\?>(?<X1227840>)|\w{1,2}[\h=]+['"]error_reporting['"];\$\w{1,2}[\h=]+['"][^'"\$]{9,}['"];\$\w{1,2}[\h=]+['"]base64_encode['"];\$\w{1,2}[\h=]+['"]base64_decode['"];\$\w{1,2}[\h=]+['"]convert_uuencode['"];\$\w{1,2}[\h=]+['"]convert_uudecode['"];[a-z\d=\$;'"\+/\h]{99,999}\?>(?<X1237851>)|\w{1,40}=\w{1,40}\([^;]{1,40};;+error_reporting\(0\);+\$\w+=\(((\$\_[GPRSC]\w{1,6}\[)[^\]]+\])\!=['"]+\&+\39\!=['"]off['"]\)\|+\40[^|]+\|+\40[^/]+https://['"]:['"]http://['"];[^@]{1,250};\$\w+=(str_replace)[^;]+;+(\$\w+)=\41[^@]{1,3200}(\$\w+)=\42[^\n]{99,9999}\btouch\(\43,strtotime[^>\?]+\?>(?<X2257554>)|\w{1,40}[=\h]+['"][zfd]\w{1,9}['"]\h*;\h*@set_time_limit[^/=\n:]{0,499}\bdefine[^;]+;\h*define\(['"](\w+)[^;]+;\h*function[\s\w\(]+(\$\w{1,40})[\)\s]+\{return\h*@\$_[GPRSC]\w{2,6}\[\46\][^%\n@]{1,3500}\bif[\(\s]+strpos[\(\s]+\45[^\n]{9,9999}\b(?:die|exit)[\(\s]+\$\w{1,40}[^>\?\n]+(?:\?>|\Z)(?<X1239211>)|\w{1,40}[=\s'"]+https?://(?:\d{1,3}(?:\.\d{1,3}){3}|z\d)[^'"]*['"][;\s]+(?:\$\w{1,40}[=\s]+['"]['"\s;]+)?function\s*\w+[\(\s]+\$\w{1,40}[\)\h\{]+\$\w{1,40}[=\s]+curl_init[^>\n]{9,}if[\(\s]+strpos[\s\(]+\$\w+[,\s'"]+\.ph[^\n]{99,}echo\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^\?]*\?>(?<X1242282>)|\w{1,40}[=\s]+explode[\(\s]+(base64_decode)[\(\s]+['"]Pz4=['"][@\),\s]+file_get_contents[\(\s]+__FILE__[\)\s;]+(\$\w{1,40})[=\s]+array[\(\s]+\49\s*\([^\?\n]{1,999}\bpreg_replace[\(\s]+\50\s*\[\d+\][,\s]+serialize[\(\s]+eval[\(\s]+\50\s*\[\d+\][\),\s]+\50\s*\[\d+\][\)\s@;]+(?:exit|die)\b[^;]*;\s*\?>(?<X1280670>)|\w{1,40}[=\s]+file_get_contents[\(\s'"]+http://\d{1,3}(?:\.\d{1,3}){3}/[^'"]+['"][\)\s;]+(\$\w{1,40})[=\s]+['"][^'"\$]+['"][^>]{9,999}(function)\s*\w+[\(\s]+(\$\w{1,40})[\)\s]+\{[^\(\)]{0,99}if[\(\s]+\53_exists[\(\s'"]+exec['"\)\s\{@]+exec[\s\(]+\54[^\?]+sleep[^=\?]{0,99}unlink[^;]+\52[^\?]{0,99}\?>(?<X1222780>)|\w{1,40}[\s=]+['"]\w{1,5}\d+['"][\s;]+\$\w{1,40}[\s=]+['"]http[^'"]+['"][\s;]+function\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init\(\);(?:[^\*]{0,9999}\bif[\(\s]+strpos[\(\s]+\$\w{1,40}[,\s]+['"](?:\.php|map|\.xml)['"][\s\)]+>)+[^>]{0,9999}\becho\s*\$\w{1,40};[^\?=]{0,40}\?>(?<X1203140>)|\w{1,40}\[['"][\\x\da-f]{9,}['"]\][\s=]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\\?['"]aHR0c[^;]+;\s*if[\(\s]+isset[\(\s]+\$\{[^;/]+/index\.php[^\n\?]{9,9999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\)[\s;]*(?:\?>|\Z)(?<X1236905>)|\w{1,40}\s*=\s*['"]http(?:://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/(?:[^'"]*['"]\s*;[^\{\}]{0,199}\bfunction\s*(\w{1,40})\s*\([\s\)\{]+(?:exit|die)\b[^\}]*\}[^\n]{999,}\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*\58[\(\s]+[\)\s;\}]+(?:\?>|\Z)(?<X1240610>)|[^'"]+['"]\s*;\s*(function)\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\}]+\}\s*\60\s+(\w+)\s*\([^\n\*]{99,}\becho\s+\61\s*\([^;]+;\s*@?(?:exit|die)\b[^;]*;\s*\}\s*\?>(?<X1231190>))|s?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^'"]+/['"]\s*;\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\n]{999,}echo\s*\$\w+;[^\}]{0,40}\}\s*define[\(\s]+['"]WP_USE_THEMES['"][,\s]+true[\)\s]+;\s*(?:\?>|\Z)(?<X1231060>))|\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\s=]+['"][\\xa-f\d]{6,199}['"][\s;]+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}[^\}]+\}[\s=]+['"][^'"]{499,}['"]\s*;\s*@?eval[\s\(]+htmlspecialchars_decode[\s\(]+gz(?:inflate|uncompress)[\s\(]+base64_decode[\s\(]+["'][^'"]{99,999}['"][\s\);]+(?:\?>|\Z)(?<X1222190>)|password=['"][^;]+;[^\?]{1,499},CURLOPT_URL,(?:base64_decode\(['"]aHR0c|https?:)[^\?@#:&]{1,499}?(\$[^=;\(\)]{1,199})=curl_exec\([^\?]{1,499}\beval\((?:base64_decode\(['"]Pz4=*['"]\)|['"]\?>['"])\.(?:\65|[\$\{'"]*GLOBALS['"\[])[^;]+;\s*(?:\?>|\Z)(?<X1227140>)))
<\?[ph\s]*(?:\b(?:(?:diE|exit)[\(\s]+REQUiRe\176RAWUrLDEcODe[\(\s]+['"]%[^;\)'"]{40,}['"][\)\s]+\.\s*__File__\s*\.\s*['"]/['"]\s*\.\s*\176\s*['"][^'"]+['"][\s\);]+__HALT_COMPILER[\(\);\s]*\?>(?<X2253240>)|define[\(\s]+['"]\w['"]\s*,\s*['"][^'"]+['"][\s\)]+;\s*goto\s+\w+;[^\n\\]{0,9999}\bpreg_match[\(\s]+['"]\\[^\n\?]+\?\s*\$_SERVER\s*\[[^\n\*]{9,}\bgoto\s*\w+\s*;\s*\w+:\s*\w+[\(\)\s;]+(?:\?>|\Z)(?<X1284150>)|error_reporting\s*\(\d+\);\s*(\$\w{1,40})[=\s]+['"]range['"];\s*\$\w{1,40}[=\s]+\3[\s\(]+['"]\176['"],['"]\s+['"]\);\s*\$\w{1,40}[=\s]+[^:]{99,700}:(?:[^>]{99,1000}>)?[^>]{99,1500}>0[^>]{99,9999}\);\s*(?:\?>|\Z)(?<X1271202>)|goto\s+\w+\s*;\s*\w+\s*:\s*(?:exit|die)\b[^;]*;[^\n@]{99,}@file_put_contents[\(\s]+['"][^\n\?]{99,}\bgoto\h+\w+;(?:\h*\w+:)+\s*(?:\?>|\Z)(?<X1273560>))|\s*(\$\w+)[\h=]+['"][^'"]+['"];\s*(\$\w+)[=\h]+['"]\d*['"];\s*(\$\w+)[\h=]+['"]https?://kod\.themelicense\.net/[^\?]+\.php\?url=['"\.]+\6[\.'"]+&type[='"\.]+\7[\.'"]+;\s*(\$\w+)[\h=]+curl_init[\h\(]+\8[\h\)]+;[^\?]{0,499}\bcurl_close[\h\(]+\9[\h\)]+;\s*\?>(?<X1258030>)|copy\(['"]https?://[^'"]+\.txt['"],['"][^'"]+\.php['"]\);?\?>(?<X1228970>)|echo(?:\b[^;]{0,40}<form\b[^;]+;\s*@(?:copy|move_uploaded_file)[\(\s]+(\$_FILES)\[[^\]]+\]\s*\[[^\]]+\][,\s]+\12\[[^\]]+\]\s*\[[^\]]+\][\)\s]+;(?:\s*echo\b[^;]+;)?\s*(?:\?>|\Z)(?<X1228200>)|\h*file_get_contents[\h\(]+['"]http(?:s://[^'"]+\blinks\.txt['"][\h\)]+;\s*\?>(?<X1230540>)|s?://[^/]+/wp\-(?:includes|content|admin)/[^\.'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233591>)|s?://[^/]+\.jepara\.go\.id/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1233860>)|s?://animenews\.biz/[^'"]{0,99}\.txt['"][\h\)]+;\s*\?>(?<X1237090>)|s?://bcklink\.xyz/[^'"]+\.php['"][\h\)]+;\s*\?>(?<X1227800>)|s?://ja\-panik\.[^/]+/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1223670>)|s?://vwm88\.com/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1234230>))|\s*(?:@?eval[\(\s'"]*\\(?:77\\x3e["']\s*\.\s*@?file_get_contents[\s\('"]+\\150\\x74\\x74\\160\\x73[^'"]{9,199}['"][\s\);]+(?:\?>|\Z)(?<X1223740>)|x3f\\76["']\s*\.\s*@?file_get_contents[\s\('"]+\\x68\\164\\164\\160\\x73[^'"]{9,199}['"][\s\);]+(?:\?>|\Z)(?<X1223730>))|['"]<form\b[^;]+['"]\s*;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*['"][^'"]*['"][\)\s]+\{\s*echo[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\?[^;:]+:[^;:\?]+;\s*\}\s*(?:\?>|\Z)(?<X1217480>)|['"][^'"]*['"]\s*\.\s*php_uname\s*\(\s*\)\s*\.\s*['"][^'"]*['"]\s*\?>\s*<form action\s*=\s*['"]\?[^\?]+<\?[ph\s]*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\?>[^=]{0,999}\beval[\(\s]+(?:\w+[\(\s]+)+['"][^'"]{99,}['"][\s\)]+;\s*\?>\s*<\?[ph\s]*\}\s*\?>(?<X2228120>)|['"][^'"]{0,12}['"]\s*;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+['"]class[^'"]*\.php['"][,\s]+['"]w['"][\)\s@;]+fwrite[\(\s]+\25[,\s]+base64_decode[\(\s]+['"]PD9[a-z\d\+/]{999,}={0,2}['"][\)\s]+;\s*fclose[\(\s]+\25[\)\s;\}]+(?:\?>|\Z)(?<X1213640>)|file_get_contents(?:[\(\s]+['"]https?://[^'"/]+/\.well-known/[^'"\$]+\.txt['"][\)\s;]+(?:\?>|\Z)(?<X1238210>)|[\h\(]+['"]https?://(?:\w+\.)?menyalaabangkuh\.xyz/\w+\.txt['"\h\)]+;\s*\?>(?<X1257700>)|[\s\(]+['"]https?://[^'"]+/links?\d*\.txt['"][\s\)]+;\s*(?:\?>\s*)?\Z(?<X1230200>)|\(['"]https?://(?:raw|user\-images)\.githubusercontent\.com/[^\)]+\);?(?:\?>|\Z)(?<X1233870>))))|error_reporting(?:[\(\s]+\d+[\)\s;]+foreach[\(\s]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}\s*=>\s*(\$\w{1,40})[\)\s]+\{\s*\$_[GPRSC]\w{2,6}\s*\[(base64_decode)[\(\s]+['"][^;]+=\s*\31;[^\n]{999,}\{\s*(\$\w{1,40})[=\s]+str_replace[\(\s]+\32[\(\s]+['"][^,;]+,\s*['"]<title>\$[^\}]{1,99}\}\s*echo\s*\33[;\s\?>]*\Z(?<X1231110>)|[\s\(]+0[\)\s]+;(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;){2}\s*\$\w{1,40}[\s=]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}['"]\;\s*\$\w{1,40}[\s=]+['"]/wp\-content/\w{1,40}['"\s;]+\$\w{1,40}\s*=\s*['"](?:\w*,){9,}\w*['"];[^\^\}\.]{0,499}\$\w{1,40}\s*\.=\s*\S{1,40}\s*\^\s*\S(?<X2203550>)|\(0\);define\(['"][^'"]+['"],['"][^'"]+['"]\);\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]=explode\(['"]\|[^'"\|]{0,8}\|[^'"\|]{0,8}\|[^'"\|]{0,8}['"],gzinflate\(substr\(['"][^\n]{999,11111}=\$_[GPCSR]\w{2,6}(?:\[[^\]]+\])+\((?:\$_[GPCSR]\w{2,6}\[){2}[^\]]+\]\[[\dxa-f]+\](?<X2221950>)|\([^\?]{9,399}\bconst\h*(targets)[\h=]+\[(?:['"]https:?//[^'"]+['"],?\s*){5,20}\][^\?]{999,3500}\bvisitNewLocation[\h\(]+\37[\h,]+\w{1,25}[\h,]+\w{1,25}[\s\);\}]+document\.addEventListener[\h\(]+[^,]+,\h*globalClick[\s\)\}\(]+</script>['"];[\s\}]+\?>(?<X1226691>))|f(?:ile_pu(t_contents\()['"][^'"]+\.php["'],file_ge\39['"]https?://[^'"]+\.txt['"]\)+;unlink\(__FILE__\);\s*\?>(?<X1228990>)|unction(?:\h*\w+[\h\(]+\$\w+[\h\)\{]+\$\w+[\h=]+curl_init[^\}]+\}\h*function\h*(\w+\(\))[\h\{]+return\h*exit;\h*\}[^\n]{99,5000}\b(main_shell)['"]\][\h=]+\$\42;[\h\}]+\$\w+[\h\=]+isset[\h\(]+\$_SERVER\[['"]HTTP_[^\n]{99,999}\b\41;\?>(?<X1260560>)|\s*(\w+)(?:[\(\)\s]+\{\s*file_put_contents[\(\s]+['"][^'"]+\.php['"][,\s]+file_get_contents[\(\s]+['"]https?://gitlab\.com/[^'"\-]+/\-/[^'"\-]+\.php['"][^\}]+\}\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\44[\(\)\s;]+\}\s*(?:\?>|\Z)(?<X1227880>)|[\(\s]+(\$\w{1,40})[\)\s\{]+(?:\$\w{1,40}[=\s]+strlen[\(\s]+trim[\(\s]+\46[\)\s]+;[^\}]+\+\s*hexdec[\(\s]+substr[\(\s]+\46[,\s]+\$\w[^\}]+\}[^'"]{0,99}eval[\s\(]+\44[\s\(]+['"][^'"]+['"][\s\)]+\.\s*['"][a-z\d/\+]+\\?['"]['"][\s\.]+\44[\s\(]+['"][\da-f]{9,}['"][\s\)]+\.[\s'"\);\?>]+\Z(?<X1227440>)|\46[=\s]+gzinflate[\(\s]+base64_decode[\(\s]+\46[\)\s;]+for[\(\s]+(\$\w{1,40})\s*=[^\{\}\+]+\48\+\+[\)\s\{]+(\$\w{1,40})\[\48\][=\s]+chr[\(\s]+ord[\(\s]+\49\[\48\][\d\-\)\s;\}]+return\s*\49[^\(\)]{9,499}\beval[\(\s]+\44[\(\s]+['"][^'"]+['"][\)\s;]+(?:\?>|\Z)(?<X1231050>)))|\s*(?:(\w+\()[^\?]{1,499}\}function\s*(\w+\()(\$\w+)\)\{[^\}]{1,499}(\$\w+)=file_get_contents\(\53\);[^\}]{0,499}(\$\w+)=\51\54\);return\s*\55;\}(\$\w+)=\52[^;]+\.(?:jpe?g|png|ico|gif|bmp)['"]\);if\([^;\}]{1,49}\beval\(\56\);(?:(?:echo|die|exit)\b[^;]{0,49};|\}){0,3}(?:\?>|\Z)(?<X1231910>)|(\w{1,40})\((?:\$\w{1,40}[,\)\s]+)+\{\s*\$\w{1,40}[=\s]+['"][^'"]{40,}['"];[^\{]{0,99}(\$\w{1,40})[=\s]+(base64_decode)\(\59[^\}]*\}[\s\}]+return\s*\60[^\}]*\}[;\s]*(?:(\$\w{1,40})[\s=]+['"][^'"]+['"];\s*)+(\$\w{1,40})[=\s]+\58\(\61[,\s]+\$\w{1,40}[\)\s;@]+eval[\(\s]+\62[\)\s;]+(?:\?>|\Z)(?<X1210190>)|(_is_ssl)[\(\)\s]+\{\s*(\$\w+)\s*=\s*\$\s*\{\s*['"]\\[^\?\n]{99,999}\65\[[^\]]+\][\s\)]*\?[^@\n]{9,9999}(\$\w{1,40})\s*=\s*\$\w{1,40}[\(\s]+\65\s*\[[^\]]+\][\)\s;]+if[\(\s]+@\$\w{1,40}[\(\s]+\$\w{1,40}[,\s]+\66[\)\s]+\{[^>]+\bexit\(['"][^'"]+['"]\);[\}\s]+\64\s*\(\)[\s;]+(?:\?>|\Z)(?<X1241450>)|\w+[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*\$_COOKIE\[\68\][=\s]+\$\w{1,40}\s*;\s*setcookie\b[^\-]{9,999}(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+\$_SERVER\[['"]HTTP_HOST['"]\].['"]/well\-known/[\w\-]+\.txt[^\*\?]{99,9999}\bdownloadFile[\(\s'"]+\69[^;]+;[\s\}]*(?:\?>|\Z)(?<X1217330>)|\w+\((\$\w+)\)\{(\$\w+)=[^;]+;(\$\w+)=[^;]+;(\$\w+)=[^;]+;\71=\74\(\72\(\73\(\71\)+;return\71;\}[^@!:]{1,1100}\bfunction\s*(\w+)\(\71\)[^@\*]{1,1100}\b\75\(\71\);\}die\(\);\}{3}(?<X2256732>)|\w+\s*\([^;\{\}]{1,40}\{\s*\$\w{1,40}\s*=\s*['"]https?://%s/['"]\s*\.[^\n]{99,}@header[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;[\}\s]*(?:\?>|\Z)(?<X1251690>))|\s+curl_get_contents[^\.\n\*]{1,9999}\breferbots[^:]{1,999}:[/\w]+\.qaybet[^\n\*]+\[['"]http_user_agent['"]\][^\?\n]*\?>(?<X1274721>))))
<\?[ph\s]*(?:goto(?:\h*[a-z\d]{3,9};\h*[a-z\d]{3,9}:\h*@ini_set[\(\s]+['"]display_errors['"][,\s]+0[\)\s]+;\h*goto[^\n!]{0,99}\bif[\s\(]+!\h*file_exists[\s\('"]+/[^'"]+\.js['"\)\s]+\|\|\s*trim\s*\([^\?\n]+\?[^;]+</script>['"];[\s\}]*(?:\?>|\Z)(?<X1237400>)|\s*(?:\w+;\s*\w+:\s*function\s*\w+[\(\s]+\$\w+[\)\s]*\{\s*goto\s*\w+;\s*\w+:\s*if[\s\(]+is_array[\(\s]+\$\w+[\)\s]+\{\s*goto\b[^@\n]{1,999}@preg_split[\(\s]+['"]\\[^\n]{99,}\bif[\(\s]+isset[\(\s]+\$_SERVER\h*\[[^\]]+\][^\?]{1,999}(?:\?>|\Z)(?<X1259090>)|\w{2,12};\s*\w{2,12}:\s*@header[\(\s]+['"]\\[^@\n]{9,999}@set_time_limit\b[^\n]{99,}\bif[\(\s]+is_dir[\(\s]+\$\w+\s*\.\s*['"]\\[^\?\n]+\b\w+:\s*(?:\?>|\Z)(?<X1259850>))|\s+\w{3,8};\s*\w{3,8}:\s*ob_implicit_flush\b[^\n]{3,299}\bgoto\s+\w{3,8};\s*\w{3,8}:\s*(\$botbot[bot]+)\s*=\s*str_replace\s*\([^;]+\4(?:[^\n\^\?>!]{1,9999}\b(?:while|if)[\s\(]+!){2}[^\n]+goto\s+\w{3,8};\s*\w{3,8}:\s*(?:\?>|\Z)(?<X1235301>))|header(?:[\h\(]+['"]Location[\h:]+https?://kundeservice\-postnord\.info/[^'"]+['"][\h\)]+;\s*\?>(?<X1226930>)|\(['"]Location[\s:]+(?:https?:)?//combustus\.net/[^'"]+['"]\);(?:(?:exit|die)\b[^;]{0,49};)?\s*(?:\?>|\Z)(?<X1227950>)))
<\?[ph\s]*if(?:[\(\h]+isset[\(\h]+\$_[GPC]\w{2,6}\[[^\{]+\{\s*(\$\w+)[\h=]+['"]https?://snippet\.host[^'"]+/raw['"];\s*(\$\w+)[\h=]+file_get_contents[\h\(]+\1[\h\)]+;\s*eval[\h\('"\?>]+\2[\h<\?ph'"\)]+;\s*\}\s*\?>(?<X1279970>)|[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]+\{\s*echo(?:(?:\s*['"][^'"]*['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1221410>)|\s*['"][^'"]*['"][\.\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\.\s]+['"][^'"]*['"])?\s*;\s*echo\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1221400>))|\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s@]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\6\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\{\s*echo\s*['"][^'"]*['"][\s;\}]+else\s*\{\s*echo\s*['"][^'"]*['"][;\s\}]+(?:\?>|\Z)(?<X1218970>))|[\(\s]+!function_exists[\(\s'"]+explode['"\)\s]+\{\s*function\s*explode[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{\s*return\s*split[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;[^\n@]{0,99}@ini_set\h*\([^\n]{99,9999}\}\s*goto\s*\w+;\s*(?:\w+:[\}\s]*)+(?:\?>|\Z)(?<X1237610>)|[\(\s]+(?:!\s*)?(?:empty|isset)[\(\s]+(\$_FILES\[)[^\]\$]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+basename[\(\s]+\9[^\]\$]+\]\s*\[[^\]\$]+\][\)\s]+;\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+\9[^\]]+\]\s*\[[^\]\$]+\][,\s]+\10[\)\s\{]+\becho\b[^;]+;[\s\}]+else[\s\{]+echo\b[^;]+;[\s\};]*(?:\?>|\Z)(?<X1229991>)|[\(\s]+(\$_[GPRSC]\w{2,6})[\)\s]+\{\s*(\$\w{1,40})[=@\s]+fopen[\(\s]+\12\s*\[[^\]]+\][,\s]+['"][wa]\+?['"][\)\s;]+if[\(\s@]+fwrite[\(\s]+\13[,\s]+\12\s*\[[^\]]+\][\)\s]+echo\b[^;]+;\s*else\s*echo\b[^;]+;\s*\}\s*(?:\?>|\Z)(?<X1203970>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\)\s]+\{\s*echo\s*['"][^'"]{0,40}['"][\.\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\15[\)\s;\}]+(?:\?>|\Z)(?<X1221250>)|[\(\s]+(\$_FILES)[\)\s\{]+if[\(\s]+(function_exists)[\(\s'"]+(move_uploaded_file|copy)['"\)\s\{]+if[\(\s]+\19[\(\s]+\17\[[^\]]+\]\[[^\]]+\][,\s]+\17\[[^\]]+\]\[[^\]]+\][\)\s]+\{[^\}]+\}[^=\[]{0,49}elseif[\(\s]+\18[\(\s'"]+(move_uploaded_file|copy)['"\s\)\{]+if[\(\s]+\20[\s\(]+\17[^\}]+\}[^\?]{0,40}\?>(?<X1228580>)|[\(\s]+\$_(?:[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*if[\(\s@]+(?:copy|move_uploaded_file)[\s\(]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\22\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s;\}]+(?:\?>|\Z)(?<X1222250>)|[GPRSCF]\w{2,6}\s*\[[^\]]+\][^\{;]{0,40}\{\s*(?:if|foreach)[\s\(]+\$_[GPRSCF]\w{2,6}\s*\[[^\]]+\][^,\}]{0,199}\b(?:move_uploaded_file|copy)[\(\s]+(\$_FILES\[)[^\]]+\]\s*\[[^\]]+\](?:\s*\[[^\]]+\])?[,\s]+\24[^\]]+\]\s*\[[^\]]+\](?:\s*\[[^\]]+\])?\s*\)[^\}]{0,199}\}[\s\};]*(?:\?>|\Z)(?<X1223230>)|SERVER\[[^\]]+\]\s*===\s*['"][^'"]{1,100}['"][\)\s]+\{\s*if[\(\s]+preg_match[\(\s]+['"]/google/i['"][,\s]+\$_SERVER\[['"\s]+HTTP_USER_AGENT['"\s]+\][\)\s]+\{[^\^\}]{9,999}\}[^\?]{0,99}\?>(?<X1239871>))|[\(\s]+isset(?:[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s\{@]+(?:copy|move_uploaded_file)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\s*\s*\[[^\]]+\]\s*\[[^\]]+\][\}\)\s;]*\?>(?<X1223260>)|[\)\s]+\{\s*@?(?:copy|move_uploaded_file)[\(\s]+\$_FILES\[[^\]]+\]\s*\[\s*['"][^'"]*['"]\s*\][,\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][\}\);\s\?>]*\Z(?<X1217900>))|[\(\s]+(?:(\$_FILES\[)[^\]]+\][\)\s]+\{[^\{\}\[]{0,99}(\$\w{1,40})[=\s]+\29[^\]]+\]\[[^\]]+\][\s;]+(\$\w{1,40})[=\s]+\29[^\]]+\]\[[^\]]+\][\s;]+@(?:move_uploaded_file|copy)[\(\s]+(?:\30|\31)[,\s]+(?:\30|\31)[\)\s;\}]+(?:\?>|\Z)(?<X1228600>)|(\$_FILES\[[^\]]+\])[\)\s]+\{\s*(?:(\$\w{1,40})[=\s]+count[\(\s]+\33\[[^\]]+\][\)\s;]+for[\(\s]+(\$\w{1,40})[=\s]+\d+;\s*\35\s*<\s*\34\s*;\s*\35\+\+[\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}\[\d+\][\(\s]+\33\[[^\]]+\]\[\35\][,\s]+\33\[[^\]]+\]\[\35\][\)\s;]+\}[^\?]{9,999}\36[^\?]{9,999}\?>(?<X1223850>)|date_default_timezone_set\b[^;]+;[^\}\-]{0,99}(\$\w{1,40})[=\s]+strtolower[\(\s]+substr[\(\s]+\33\[[^\]]+\][,\s]+\-\d[^\}\-]{0,99}(\$\w{1,40})[=\s]+date[\(\s]+['"][^'"]+['"][\)\.\s]+\38[^\[\}]{0,99}move_uploaded_file[\(\s]+\33\[[^;]+\39[^\}]+\}\s*\?>(?<X1222590>))|\$_[GPRSC]\w{2,6}(?:\[[^\]]+\][\)\s]+\{(?:(?:\s*echo\s*['"]<[^;]+;)+\s*if[\(\s]+(\$_FILES\[[^\]]+\]\[)[^\]]+\][^;\{]+\{\s*echo[^;]+;\s*\}\s*else\s*\{[^=\?]{0,499}\b(?:move_uploaded_file|copy)[\s\(]+\41[^\]]+\][^;]+\41[^\]]+\][\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1207251>)|\s*(\$\w{1,40})[=\s]+@fopen[\(\s]+['"][^'"]+\.php['"][,\s'"]+w['"][\)\s;]+if[\(\s]+!\43[\)\s]+(?:exit|die)\b[^;]*;\s*fwrite[\(\s]+\43[,\s]+base64_decode[\(\s'"]+PD9[^'"]+['"][\)\s;]+fclose[\(\s]+\43[^\}=]+(?:exit|die)\b[^;]*;[\s\};]*(?:\?>|\Z)(?<X1214450>))|\h*\[[^\]]+\](?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]https?://raw\.githubusercontent\.com/[^'"/]+exploit[^/]*/[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+(curl_)init[\(\)\s]+;\s*\47setopt[\s\(]+\46[^;]+\45[^\}=]+(\$\w{1,40})[=\s]+\47exec[\s\(]+\46[^\?\}]{0,99}eval[^;]+\48[^\}]+\}\s*\?>(?<X1237240>)|[\)\s]+\{\s*\$\w{1,40}[='"\s;]{6,}(\$\w{1,40})[=\s'"]+/tmp/sess_['"\.\s]+md5\s*\([^;]+;\s*if[\s\(]+(file_)exists[\s\(]+\50[^\};]+include(?:_once)?[\(\s]+\50[\)\s\};]+else[\s\{@]+\51put_contents[\s\(]+\50[^\}]+\}\s*(?:die|exit)[^\?=]{0,99}(?:\?>|\Z)(?<X1237590>))|\s*\[[^\]]+\](?:[\)\s\{@]+\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+stripslashes[\(\s@]+\$_(?:POST|get|REQUEST|COOKIE)\s*\[[^\]]+\][^;]+;[;\s\}]*(?:\?>|\Z)(?<X1223780>)|[\)\s\{]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][\?>]+['"][\.\s@]+file_get_contents[\(\s]+['"]https?://[^'"]*['"][\)\s]+;[;\}\s]+(?:\?>|\Z)(?<X1204020>)|[\s\)]+\$mailTo\s*=\s*base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;[^\?]+if[\(\s@]+mail[\(\s]+\$MailTo\s*,\s*\$MessageSubject\s*,\s*\$MessageBody\s*,\s*\$MessageHeader\s*\)\s*\)(?<X2046832>)|[\s\)]+\{[^\{\}]+\bif[\(\s]+@?(?:move_uploaded_file|copy)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$\w+[^\?>]+\?>\s*<form[^\n\?]{9,499}/>\s*<\?[ph\s]*\}(?:\s*;)?\s*(?:\?>|\Z)(?<X1261560>)|[\s\)]+\{\s*echo[\s'"\(]*<(form)\s*method[=\s]+['"]POST['"]\s*enctype[=\s]+['"]multipart/\57\-[^;]+</\57>['"]\s*;\s*@(?:copy|move_uploaded_file)[\(\s]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][\s,]+\58\s*\[[^\]]+\]\s*\[[^\]]+\][\);\s\}]*(?:\?>|\Z)(?<X1209540>)))))|[\(\s]+str(?:istr[\(\s]+\$_[GPRSC]\w{2,6}\[[^\);]+['"][^'"]+['"][\)\s]+\S{2,3}\s*false[\)\s]+\{\s*(\$\w{1,40})[\s=]+['"][filegtcons_'"\.\s]{17,40}['"][\s;]+(\$\w{1,40})[\s=]+\60[\s\('"]+http://[\w\-\.]{3,}\.(?:hu|xyz|ly)/[^'"]+['"][\s\);]+(\$\w{1,40})\s*=[<\?ph\s'"\.]{15}[^;]+\61[^\}]+\62[^\}]+\}[\s\};]+\?>(?<X1212690>)|pos[\(\s]+\$\w{1,40}[,\s]+['"]\.php['"][\)\s]+\{\s*(\$\w{0,9}shell)[=\s]+\$\w{1,40}[\.\s]+\$\w{1,40}[\.\s]+\$\w{1,40}\s*;\s*\$\w{1,40}\s*\[\s*['"][^'"]*['"]\s*\][=\s]+\64\s*;\s*\}[^>]{99,999}\}\s*else\s*\{\s*\}[;\?>\s]+\Z(?<X1226770>))|[\h\(]+isset[\h\(]+(?:(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)\{]+\$pass\d*[\h=]+['"]\w{32,64}['"];\s*\$\w+[\h=]+\66[^\]]+\];[^\{]{0,199}\{\s*\?>(?:<\w+>)?<form\h*action=[^\}]{0,399}\bif[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^,]+,\h*\$\w+[\h\)]+echo\h*['"][^\}\n\{]{0,99}[\}\s]+\?>(?<X1251300>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)\{]+\?>\s*<form[^\?]{9,199}<\?[ph\s]*\}\s*if[\h\(]+!empty[\h\(]+(\$_FILES\[[^\]]+\])[\s\)\{]+[^\{]{0,99}\bif[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\68\[[^\]]+\][^\?]{0,250}\?>(?<X1255412>))|[\h\(]+md5[\h\(]md5[^&]+&&\h*trim[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{;]+\{\s*(file_)put(_contents)[\h\(]+['"][^'"]+\.php['"],\h*\70get\71[\h\(]+['"]https?://[^\)]+\.txt['"][\h\)]+;\s*echo[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1233481>)|[\s\(]+!\s*empty[\s\(]+(\$_FILES)\s*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+['"][^'"\$]+['"][\s;]+\74[\s=]+\74[\s\.]+basename[\s\(]+\73\s*\[[^\]]+\]\s*\[[^\]]+\][\s\);]+if[\s\(@]+(?:copy|move_uploaded_file)[\s\(]+\73\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\74[\s\)]+\{\s*echo[^\}]+\}[^=\$\?<>]{0,499}(?:\?>|\Z)(?<X1217930>))
<\?[ph\s]*(?:if(?:[\s\(]+isset[\(\s]+\$_GET\s*\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}\s*=\s*['"][^'"]+\.txt['"];\s*\$\w+\s*=\s*file\s*\([^>]{99,4999}\belse\s*\{\s*\$\w{1,40}\s*=\s*['"]SLOT\s[^;]*;[^\?]{9,199}(?:\?>|\Z)(?<X1273802>)|\([^;\$\{]{0,199}\$_[GPCSR]\w{2,6}\[[^;\{]{1,199}\{file_pu(t_contents\(\$_[GPCSR]\w{2,6}\[)[^\]]+\],file_ge\2[^\]]+\]\)+;(?:die|exit)\b[^;]{0,19};\}\s*(?:\?>|\Z)(?<X1236220>)|\([^;\{]{0,199}\bmd5_file\(["']([^'"]+/\.htaccess)['"]\)!=['"]\w{32}['"][^\{;]{1,199}\{chmod\(['"]\4['"],\d+\);copy\(['"][^'"]+/\.\w{1,9}(?<!/\.htaccess|/\.htaccess\.txt)['"],['"]\4["']\);chmod\(['"]\4['"],\d+\);\}\s*(?:\?>|\Z)(?<X1229001>)|\([^\{;]*(\$_[GPCSR]\w{2,6}\[)[^\{;]+\{[^@]{1,999}(\$\w+)=[^;]*\6[^;]+;(\$\w+)=fopen\(['"]([^'"]+)['"],['"]w['"]\);fwrite\(\8,[^;]*\7\b[^\?]{0,199}\bif\(preg_match\([^,]+,\$_SERVER\[['"]HTTP_USER_AGENT['"][^\};]+\becho\s*(file_get_contents\()['"]\9\b[^\?]{0,199}\bfwrite\((\$\w+),\10\6[^;]+;fclose\(\11\);\}+(?:\?>|\Z)(?<X1228960>)|\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{echo[\s\(]*base64_decode\(["'][^;]+;(?:copy|move_uploaded_file)\((\$_FILES\[)[^,;]+,(\13[^\]]+\]\[[^\]]+\])\);echo\b[^;]{0,99}\14[^;]{0,99};\}(?:\?>|\Z)(?<X1229430>)|\(preg_match\(['"][^'"]+['"],\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)+\{echo\s*['"](?:<a\b[^>]{0,199}\btitle=['"]([^'"]+)['"][^>]{0,199}>\16</a>\s*){5}[^;\?\}\{]{999,}</a>['"];\}\s*\?>(?<X1232550>)|\s*\(\s*isset[\s\(]*\$_[GPCSR]\w{2,6}\s*\[[^\]]+\][\s\)]+\{\s*if[\s\(@]+(?:copy|move_uploaded_file)\s*\(\s*(\$_FILES\[[^\]]+\]\s*\[)\\?['"]tmp_name\\?['"]\]\s*,\s*\18\\?['"]name\\?['"]\][\s\)]+\{\s*echo[^;]{1,99};\s*\}\s*(?:else\s*\{\s*echo[^;]{1,99};\s*\}\s*)?\};?\s*(?:\?>|\Z)(?<X1137941>))|i(?:gnore_user_abort[\(\s]+true[\)\s]+;\s*(ini_set)[\(\s]+['"]memory_limit['"][,\s]+['"]\-1['"][\)\s;]+(?:(?:set_time_limit|error_reporting)[\(\s]+\d+[\)\s;]+)+(?:\20[\(\s]+['"](?:display_errors|max_execution_time)['"][,\s]+\d+[\)\s;]+)+\$\w{1,40}\s*=\s*['"][^;]+\bFileManager\b(?<X2226580>)|nclude(?:_once)?[\(\s]+['"]zip://\./[^"']+\.php['"][\)\s]+;\s*(?:\?>|\Z)(?<X1263220>))|pclose[\(\s]+popen[\(\s]+['"]/bin/\w{0,3}sh\b[^;>]{1,40}>&\s*/dev/tcp/(?!10\.|172\.[123]\d\.|192\.168\.)\d+\.\d+\.\d+\.\d+/\d{4,}\s+0>&1['"]+\s*,\s*['"]r['"][\s\);]+(?:\?>|\Z)(?<X1206871>)|set_time_limit[\(\s]+0[\)\s]+;(?:\s*@?error_(?:reporting|log)[\(\s]+0[\)\s]+;)+\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^;]+\.\s*php_uname\s*\(\s*\)[^\?]{1,999}(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s;@]+fwrite[\s\(]+fopen\b[^;]+\24[\s\)]+;[\s\};]+(?:\?>|\Z)(?<X1203910>)|while[\(\s]+True[\)\s]+\{\s*if[\(\s]+!file_exists[\('"\.\s]+(\$_SERVER)\[[^\]]+\][\.'"\)\s]+\{\s*CoPy[\('"\.\s]+\$\w{1,40}['"\.\s,]+\26\[[^\]]+\][\.'"\)\s;\}]+if[\(\s]+(?:FiLe)?PeRmS[\('"\.\s]+\26\[[^\]]+\][\.\)\s'"]+!=\s*['"]\d+['"\)\s]+\{\s*ChMoD[\('"\.\s]+\26\[[^\]]+\][\.'",\s]+\d+[\)\s;\}]+\?>(?<X1222540>))
<\?[ph\s]+(?:#+\s*(\w+)\s*#\s*if[\s\(]+empty[\s\(]+(\$\w+)\b[^;]{1,499}\berror_reporting[\s\(]+(?:0|NULL|False)[\)\s]+;[^\?]{1,999}\bcurl_exec\s*\([^#]{499,4999}\2[\s=]+['"]<(script)\b[^;]+</\3>['"];\s*echo\s*\2;[\s\}]*#+\s*/\1\s*#+\s*(?:\?>|\Z)(?<X1208490>)|(//[^\n]+|/\*[^\*]+\*/)\s*@?error_reporting[\h\(]+(?:0|NULL|FALSE)\);\s*@?ini_set\h*\([^\>?\\//]{999,2500}\beval\h*\(\$GLOBALS\[[^\(]{1,20}\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);(?:\s*\})+\s*\5(?:\s*\?>)?(?<X1194860>)|(//\s*[^\s\w]+)\s*error_reporting[\s\(]+(?:0|NULL|False)[\s\)]+;[^\n]{999,}\beval[\s\(]+\$GLOBALS(?:\[[^\]]+\])+[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;[\s\}]*\7\s*(?:\?>|\Z)(?<X1195030>)|(/\*Generated\s*by\s*Jetpack\s*\w+)[^\<]{1,50}echo\s*['"]\s*<script[^>]+>\s*if\s*[\(\s]+\!(window\.KTracking)[\)\s]+[\{\s]+\10[=\s][\{\s]+[^\?]{1,50}(https?://(?:\d+[\./])+keitaro)/[^\%]{1,100}\11/\?postback[^\%]{1,1300}function[^\{]+(\$\w{1,40})[^\%]{1,220}file_put\w+[\(\s]+\12[^\?]+\9\s*End\*/\s*\?>(?<X1227850>)|(?:(?:\$\w{1,40}\s*=\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\s*\(\s*\$GLOBALS\[[^\]]+\]\s*\);\s*){2,}(?:\?>|\Z)(?<X1190960>)|(?:(file_)pu(t_contents)\([""][^'"]{1,20}\.(?:php\d*|py|sh)\d*['"],\15ge\16\(["']https?://[^'"]{9,99}/[^'"]{0,20}\.txt['"]\)\);\s*unlink\(__FILE__\);\s*){2,6}\s*\?>(?<X1234880>)|(?:@?(?:error_rep\w+|ini_set)\s*\([^;]+;\s*){3,}header\s*\([^\{]{1,199}\bdefine[\s\(]+['"]Viv[,\s]+bebegim\b[^;]+;\s*(function\s+)(\w+)\s*\([^\?]{1,199}\b\18(\w+)[\s\(]+\)[\s\{]+(\$\w+)[\s=]+['"][^'"]{9999,}['"];\s*\$\w+[\s=]+\19[\s\(]+\21[\s\)]+;[^\?]{1,499}\beval\s*\([^;]+;[\s\}]+@?\20[\s\(]+\);\s*(?:\?>|\Z)(?<X1218880>)|(?:@?(?:error_reporting\s*\(|ini_set[\s\(]+['"][^'"]*error[^'"]*['"]\s*,)\s*(?:0|NULL|False)[\s\)]+;\s*)+if[\s\(]+!(?:move_uploaded_file|copy)[\s\(]+(\$_FILES\[)[^,]+,\s*\23[^\)]+[\s\)\{]+@?(?:move_uploaded_file|copy)[\s\(]+\23[^,]+,\s*\23[^\)]+[\s\)\}]+;\s*(?:\?>|\Z)(?<X1220290>)|(?:@?(?:set_time_limit|error_reporting|ignore_user_abort)[\h\(]+[^\)]+\);\s*)+(\$\w{1,15})[\h=]+['"][^'"]+['"];[^#]{899,1499}\$goweb[\h=]+\25\h*\.[^;]+\.top['"];[^%]+\bfile_put_contents\(\$\w{1,15},\h*\$\w{1,15}\);\s*\}\s*/\*\h*Rc\h*cx046\h*\*/\s*\?>(?<X1215790>)|(?:\$\w+=(?:(?:['"]\w+['"]\.)?chr\(\d+[^;]+;))+[^\{]+\{class\s+(\w+)\{private\$\w+;(public\s*static)\$\w+=['"](?:\w+[-"])+;\28[^>]+this\->\w+\(\)[^>]+(\$\w+)=new\s*\27\(\);\29=NULL;\}\?>(?<X1248470>)|(?:\$\w+=(function)\((?:\$\w+(?:,\$\w+){0,4})?\)\{[^\}]{0,199}\};)+(\$\w+)=\31\((\$\w+)\)\{eval\(\33\);\};\31\s*\w+\([^\{;]+\{[^\}]{1,999}\}(\$\w+)=['"][^'"]{999}[^\?]{999,4999}\32\(\34\);(?:\?>|\Z)(?<X1223880>)|(?:\$\w+=['"](?:str_rot13|base64_decode|gzuncompress)['"];\h*){2,4}[^\\]{0,150}\berror_reporting\((?:0|FALSE|NULL)\);[^\\]{0,99}(\$\w+)=["']create_function['"];\s*(\$\w+)=\36\(['"]{2},(?:\$\w+\(){2,4}['"][^\)]{2000,}['"][\)\s]+;\s*\37\(\);\s*(?:\?>)?\Z(?<X1229490>)|(?:\$\w+=[^\.]{1,99}\.chr\([^\)]+\)[^;]+;){2}(\$\w+)=[^;]+;class\s*(\w+)\{private\s*function[\w\s]+\(\39\)\{if\(is_array\(\40::(\$\w+)\)+[^@\n\*]{1,1999}\bpublic\s*static\41=[^;]+;\}(?:[^\?]+)?\?>(?<X1273512>)|(?:\$\w+[\h=]+['"][^'"]+['"];\h*)?\$\w+[\h=]+urldecode\h*\([^;]+;\h*(?:(\$\w+)[\h\.=]+\$\w+\[[^;]+;\h*)+@?eval[\h\(]+\43[\h\(]+['"][^'"]+['"][\h\)]+;\s*(?:\?>|\Z)(?<X1214390>)|(?:\$\w{1,40}\h*=\h*@?\$_[GPCSR]\w{2,6}\[[^;]{1,99};\h*){3}[^#%:/\*\v\?]{999,}\bcurl_setopt\h*\(\h*(\$\w{1,40})\h*,\h*CURLOPT_URL\h*,([^\)]+)\)[^\}\?]{1,199}(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\45\h*\);\h*\}\h*else\h*\{\h*\47\h*=file_get_contents\h*\(\46[\h\);\}]+echo\h+\47;[\h;\}]+(?:\?>|\Z)(?<X1189480>)|(?:\$\w{1,40}\s*=\s*['"]\d+['"];\s*)+(\$\w{1,40})\s*=\s*urldecode[\s*\('"]+%[^\)]+\);\s*\$\w{1,40}\s*=\s*\49\{\d+\}\s*\.[^:\-\n]{99,9999}\bheader\(['"]Content\-Type:[^;]+;(?:[^%\n#]{99,9999}%host%/)+[^;]+;[^\?\n]{9,999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1199121>)|(?:\$\w{1,40}\s*=\s*['"]\d+['"];\s*|(\$\w{1,40})\s*=\s*['"][\w\-:/]{20,99}['"];\s*)+\$\w{1,40}\s*=\s*\51\{\d+\}\s*\.(?:[^%\n]{99,30000}%(?:host|\{))+[^;]+;(?:[^\n\*]{99,30000}\*\.xml\b)?[^\?]{99,30000}[^\\]['"]\);\h*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1199130>)|(?:echo\s+)?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec|cntl_exec)\([^\)]{0,99}\bngrok\.io/\d+\h*0>&1[^\?]{0,99}\?>(?<X1210741>)|(?:if[\s\(]+[^\)]{0,19}\$_[GPCSR]\w{2,6}\[[^\{;]{1,99}\{\s*(?:@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^\}]{3,99}))[^\{]{1,99}\bif[\h\(]+(\$_[GPRSC]\w{2,6}\[['"](\w+))[^{]{1,49}\{\s*file_put_contents[\h\(]+['"]\w+\.php['"][,\h]+\54[^\?]{1,99}\?\h*\55\h*=\h*\d+['"][^;]{9,1199};\s*\?>(?<X1190822>)|(?:if\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]+\)\{@?(?:eval|copy)\(base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{0,99}\}|if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,3}\d+\)\{(?:print|echo)\([^\)]+\);\s*\}){2,6}\s*(?:\?>|\Z)(?<X1039383>)|(?:include\h*\([^\)]{1,49}\.php['"]\);\s*)[^\?;]{0,99};\s*\$p(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\];[^;]{0,199};\s*\$\w{1,9}\h*=\h*\$_SERVER\[['"]REMOTE_[^\{]{1,199}\bif\(1\h*\S{2,3}\h*1\)[\s\{]+(\$\w{1,9})\h*=\h*[^;]{1,40};\s*\$\w{1,9}\h*=\h*@?fopen\h*\(\58,[^\?]{9,199}\?>(?<X1190901>)|(\$\w+)=(?:(?:['"]\w+['"][\.\s]+|chr[^\)]+\)[\.\s]+['"]?|['"]\\x?\w+['"][\s\.]+|['"]\w+['"];)[^;]+;(?:\$\w+=[^;]+;)?\$\w+=class_exists\(\60\);\60=[^;]+;[^@]{1,150}\bclass\s*(\w+)\{(public)\s*function\s*\w+\(\)\{echo\s*['"]\d+['"];\}[^@]{1,100}\62\s*static(\$\w+)=\d+[^@]{1,820}\61::\63[^;]+;(?:eval\(|include)?\$\w+[^@]{1,200}(\$\w+)=new\s*\61\(\);\64=substr[^;]+;\}\?>(?<X1254961>)|(range\([^\;]+;)(\$\w+)=\$\{\60\[[^;]+;if\(+in_array\(gettype\(\67\)\.count\(\67\)[^;]+;\}class(\w+)\{(?:\w+\s*)?(?:static\s*)?function[^;\{]{1,99}\{\$\w+=\66[^@]{1,999}\bdie[^;]{0,19};(?:endif;)?\}+\68::\w+\(\);\?>\s*(?:SeoOk\s*)?\Z(?<X1218412>)|['"][^\$'"\n]{99,199}['"];\$\w+=['"][^\$'"\n]{99,9999}['"];eval\(htmlspecialchars_decode\(gzinflate\(base64_decode\(\60\)+;exit;\?>(?<X1255402>)|['"]\d+['"];(\$\w+)=[^;]+;(?:\$\w+=(?:\71\[\d+\][\.;])+)+if\(\!function_exists\(['"](str_i?replace)['"]\)+\{function\s*\72[^@]+(\$\w+)=isset\(\$\{['"]\w+['"]\}[^@]+(\$\w+)=(\$\{['"]GLOBALS['"]\})\[['"]\w+['"]\]\(\$\w+\);echo\74;(?:exit|die)\(\);[^@]+\60,\75[^@]+unset\(\74[^;]+\73\);(?:exit|die)\(\);\}+;\?>(?<X1250010>)|['"]base64_decode['"];(\$\w+)=['"]strrev['"];error_reporting\(0\);\$\w+=array\(['"]https?://elnn-me\.screenconnect\.com/Bin/ConnectWiseControl\.Client\.exe[^@]+\beval\(\77\(\60\(['"][^\$'"]*['"]\)+;\?>(?<X1274030>)|['"]PD9[^'"]+['"];file_put_contents\(['"][^'"]+\.php\d*['"],base64_decode\(\60\)+;\s*(?:\?>|\Z)(?<X2201021>)|[^;]+;(\$\w+)=[^;]+;\$\w+=\80\(\60\);\80=['"]\d+['"];[^@]{1,200}class\s*(\w+)\{private[^@]{1,4500}(\$\w+)=new\s*\81\(\);\82[^;]+;\}\?>(?<X1251980>)|[^;]+;if\(mail\(\$_[GPCSR]\w{2,6}\[[^\]]+\],['"][^'",]{0,199}\bShell\b[^;\{]{1,199}\{\60=[^;]+;\}\s*echo\s*\60;(?:\?>|\Z)(?<X1214100>)))
<\?[ph\s]+(?:(\$\w+)(?:[\h=]+file_get_contents[\h\(]+['"]https?://[^/]+/[^\.]+\.js['"][\h\)]+;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+base64_decode[\h\(]+\1[\h\)]+;\s*\?>(?<X1215900>)|[\s=]+(curl_)init(?:[\s\(\)]+;\s*\3setopt[\s\(]+\1[,\s]+CURLOPT_URL[,\s]+['"]https?://[^'"]+['"][\s\)]+;\s*\3exec[\s\(]+\1[\s\)]+;\s*\?>(?<X1202322>)|\b[^\?\{\}]{1,499}\b\3setopt[\s\(]+\1[\s,]+CURLOPT_URL[\s,]+['"]https?://[^/'"\s\?]*\bhacklink\.us/[^><\{\}]{1,499}\$(\w+)[\s=]+\3exec[\s\(]+\1[\s\)]+;[^\?\{\}]{0,499}\becho\s*\$\5;[^\w\?]*(?:\?>|\Z)(?<X1209450>))|[\s=]+@?create_function[\s\(]+['"]{2}[\s,]+(?:\w+\s*\(|\$_[GPCSR]\w{2,6}\[)[^;]+;\s*@?\1\s*\(\s*\)\s*;\s*(?:\?>|\Z)(?<X1215710>)|[\s=]+['"][^'"]*\b(?:fcggu|uggcf)\b[^;]+;[^\}\?;]+(\$\w+)\s*=[^;]*\1\b[^\}\?]{1,499}=\s*@?(file_get_contents[\s\(]+\8\b[^;]+;)[^\?;]+(\$\w+)[\s=]+@?\9[^;]*\becho\s*\10;[^;\?]{1,199}\becho\s*['"][^\}\?\$]{1,199};\W+(?:\?>|\Z)(?<X1200770>)|[\s=]+['"][^'"]+\.php['"];\s*\$\w+[\s=]+curl_init[\s\(]+(\$_[GPCSR]\w{2,6}\[[^\]]+\])[^\?\{\}]{1,499}\bif\s*\([^\{;=]+\{\s*(\$\w+)[=\s@]+(file_)ge(t_contents)[\s\(]+\12[\s\)]+;\s*@?\14pu\15[\s\(]+\1[,\s]+\13[\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1221330>)|[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*if\s*\([^;\{]+\{\s*(\$\w+)[\s=]+wp_create_user\s*\((?:[^\);]*(?:\1|\17|\18)){3}[^\)]*\);\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\19[\s\)]+;\s*\20\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1204180>)|[\s=]+['"][^;]{0,199}\$(\w+)[\s=]+(@?fopen[\s\(]+)['"]php://input['"][^;]+;\s*(\$\w+)[\s=]+\23\$_[GPCSR]\w{2,6}\[[^\}\?]{0,199}\$(\w+)[\s=]+@?f(?:gets|read)[\s\(]+\$\22\b[^\?]{0,199}\bf(?:write|puts)[\s\(]+\24[\s,]+\$\25[\s\)]+;[^;]{0,199};\s*@?eval[\s\(]+\1[\s\)]+;\s*(?:\?>|\Z)(?<X1205980>)|[\s=]+['"][^;]{1999,}['"];\s*(function\h+)(\w+)[^\{]{1,99}(\{\s*global\s+\1;)[^\}]{1,499}\}\s*\27(\w+)[\s\(\)]+\29[^%]{1,999}\btouch\s*\(\s*__FILE__\s*,[^;]{5}[^\?]{1,999}\bif\s*\(\s*\1\b[^\?;\{]{1,99}\{\s*@?ob_start[\s\(]+['"]\28['"]\s*\);[\}\s]+\30[\s\(\)]+;\s*(?:\?>|\Z)(?<X1191920>)|[\s=]+['"]aHR0cDovL3Jlc3NpbS5uZXQv[^;]+;\s*(\$\w+)[\s=]+base64_decode[\s\(]+\1[\s\)]+;\s*(\$\w+)[\s=]+@?file_get_contents[\s\(]+\32[\s\)]+;\s*echo\s*\33;\s*(?:\?>|\Z)(?<X1207350>)|[\s=]+['"]https?://[^'"]+\.txt['"];\s*(\$\w+)[\s=]+@?get_headers[\s\(]+\1[\s\)]+;\s*if[\s\(]+\35\[[^;]+(\$\w+)[\s=]+@?file_get_contents[\s\(]+\1[\s\)]+;\s*@?echo\s*\36;\s*(?:\}\s*)?(?:\?>|\Z)(?<X1212460>)|[\s=]+\$_[GPCSR]\w{2,6}\[[^;]+;\s*if\s*\([^\);]*\1[\s\)]+(?:\{\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\1\b[^;]+;\s*(?:\}\s*)?(?:\?>|\Z)(?<X1205600>)|[\s=]+range[\s\(]+chr[\s\(]+\d+[\s\)]+[\s,]+chr[\s\(]+\d+[\s\)]+;\s*@?include\s*(?:\1\[\d+\]\.){5,}\1\[\d+\];\s*(?:\?>|\Z)(?<X1216291>)|\s*=[^;]*\$_SERVER\[["']HTTP_USER_AGENT['"]\][^;]+;\s*if\s*\([^\{;]{0,499}\1\b[^;\{]{0,499}\{\s*@?echo\s*@?file_get_contents[\s\(]+['"]https?://[^;]+;[\s\}]+\?>(?<X1209230>))|(\$\w{1,12})\h*=\h*['"]\w{0,9}['"](?:[\h\.]+(?:chr\(\d+\)[\.\h]+['"]\w{0,6}['"][^;]{0,99})?)?;\s*\$\w{1,12}[\h=]+\41[\h\(]+['"]{2}[\h,]+array[\s\(]+['"][^;]+;\s*(\$\w{1,12})[\h=]+['"]\w{0,15}['"](?:[\.\h]+chr\(\d+\)[^;]+)?;\s*(\$\w{1,12})\h*=[^,]{0,999}(\$\w{1,12})\h*=[^;]*(?:\42|\43)[\s\(]+[^;]+;\s*@?\44\h*\(\);\s*(?:\42|\43)\h*\([^;]+;\s*(?:\?>|\Z)(?<X1182354>)|(\$\w{1,15})[\h=]+(?:(curl_)init\(\);\s*\47setopt\(\46,\h*CURLOPT_URL,\h*['"]https://thevenon\-blois\.com/['"]\);\s*\47exec\(\46\);\s*\?>(?<X1198080>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\h\(]+!empty[\h\(]+\46[\s\)\{]+file_put_contents[\h\(]+['"]wp_\w{1,25}\.php['"],\h*\46[\h\)]+;\s*echo[^;]+;[\s\}]+\?>(?<X1206460>))|(\$\w{1,20})(?:=['"]https?://\$_SERVER\[[^\(\)]{1,40};\s*(?:if\(strpos\(\50,['"]/?(?:wp|rest)[\-_][^;\}]{1,40};\}\s*){3,6}if\([^\)]+\)[\{\s]+echo\h+['"]<script\h*src=['"]https?://\w{1,9}\.[^\?]{5,60}\.js\?\w=[\d\.]+['"][^;]{0,50};[\}\s]+(?:\$\w{1,20}=\d+;)?\?>(?<X1212490>)|[\h=]+(curl_)init\(\);\s*\52setopt[\h\(]+\50[\h,]+curlopt_url[\h,]+['"]https?://[^'"]{9,20}/seo/[^'"]{1,40}\.php['"]\);[^\?><\{\}]{0,60}(\$\w{1,20})[\h=]+\52exec[\h\(]+\50\);\s*\52close[\h\(]+\50\);\s*echo\h+\53;\s*\?>(?<X1193450>)|[\h=]+["']copy['"];\s*\50[\h\(]+['"]https?://[\d\.]{5,12}/[^'"]{1,40}\.txt['"][,\h]+['"][^'"]{1,40}\.php\d*['"][\h\)]+;\s*(?:\?>|\Z)(?<X1233021>)|[\h=]+file_get_contents[\h\(]+['"]https?://paste\.ee/\w/\w{1,9}['"]\);\s*echo\h*\50;\s*\?>(?<X1233510>))|(\$\w{1,25})[\h=]+(?:['"\.creat_funio]+;\s*(\$\w{1,25})[\h=]+['"\.base64_dco]+;\s*(\$\w{1,25})[\h=]+\57[\h\(]+['"]{2},\h*\58[\h\(]+[^\)]{9,250}[\h\)]+;\s*\59[\h\(\)]+;\s*\?>(?<X1213320>)|['"][^'"]+\.php['"];\s*(\$\w{1,25})[\h=]+['"][^'"]+/images/[^;]+;\s*if[\h\(]+\57\D{2,7}(file_exists)[\h\(]+\61[\s\)\{]+if[\h\(]+!\62[\h\(]+\57[^\{]+\{\s*@?chmod[\h\(]+\57,\h*\d+[\h\)]+;\s*@?(file_)put(_contents)\(\57,\h*\63get\64\(\61[\h\)]+;[^\}]+\}\s*\}\s*\?>(?<X1223320>)|geturlsinfo[\h\(]+['"]https?://bitbucket\.[^'"]{0,40}\bbackdoor/[^'"]{0,99}/wso\d*\.php['"][\h\)]+;\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+['"]\?>['"\.]+\57[\h\)]+;(?:\?>|\Z)(?<X1222920>))|(\$\w{1,40})=['"](?:https?://api\.rexue\.org['"][^\@]{1,2200}\67(?<X2221970>)|range['"];(\$\w{1,40})=\67\([^;]+;include(?:\69\[\d+[\-\+/\*]\d+\]\.){4,}\69\[\d+[\-\+/\*]\d+\];\?>(?<X1224262>))|(\$\w{1,40})[=\s]+(?:['"][^'"]*['"]\^['"][^'"]*['"];\s*(\$\w{1,40})[=\s]+['"][^'"]*['"]\^['"][^'"]*['"];\s*\71[\(\s]+['"]\72['"][,\s]+['"][^'"]{99,999}['"]\^['"][a-z]{99,400}['"],\s*['"][a-z]+['"][\)\s]+;\s*\?>(?<X1214881>)|file_get_contents[\(\s]+['"]https?://luzlunatarotista\.com/[^'"]+\.txt['"][\)\s]+;\s*echo\s*\71;\s*\?>(?<X1233252>)))
<\?[ph\s]+(?:(\$\w{1,40})(?:[\h\=]+['"]https?\://youngmodel\.info/['"];[^\-]{0,700}\1\.urldecode([\(\s]+)\$\w{1,40}[\[\s]+\d[\]\s]+[\)\s]+;\h*((?:die|exit)\2[\)\s]+)[^\-]{0,145}Location\:\s*['"]\.\$\w{1,40}\);\s*\3;[\}\s]+\?>(?<X1206502>)|[\s='"\(]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s'"\);]*if[\s'"\(]+(?:!?(?:isset|empty)[\s'"\(]+)?\1[\s'"\)]*\{(?:\s*echo[\s='"\(@]+(?:eval|assert|system|shell_exec|exec|popen|passthru|proc_open)[\s\(]+(?:base64_decode\s*\(){0,5}\s*\1[\s'"\)]+;)+(?:\s*(?:exit|die)\b[^;]*;)?[\s\};]+(?:\?>|\Z)(?<X1198210>)|[\s=]+(array_)merge\s*\((?:\s*\$_[GPCSR]\w{2,6}\s*[,\)]){2,};\s*if\s*\(\s*\1\s*=[^\{;]{1,199}\{[^\}]{1,499}(\$\w{1,40})[\s=]+\6values\s*\(\s*\7\s*\);\s*\1[\s=]+\7\[[^\]]+\]\s*\(\s*['"]{2}\s*,\s*\7\[[^\]]+\]\s*\(\s*strrev\s*\(\s*\7\[[^;]{1,99};\s*\1\s*\(\s*\)\s*;\s*\}\s*(?:\?>|\Z)(?<X1190140>)|[\s=]+['"](register_shutdown_(function))['";\s]+\$\w{1,40}[\s=]+['"](\10_exists)['";\s]+\10\s*(\w{1,40})[\s\(\)\{]+\$\w{1,40}[\s='"]+\9['";\s]+\$\w{1,40}[\s='"]+\11['";\s]+(\$\w{1,40})[\s=]+['"]['"\h\.base64_dco]{13,40};\s*\$\w{1,40}[\s=]+\13[^;]+;[^\?]{9,999}\1\(['"]\12[\s'"\);]+(?:\?>|\Z)(?<X1207460>)|\h*=\h*@?\$_[GPRSC]\w{2,6}\h*;\h*@?\1\h*\[[^\]]+\]\h*\([^,;\n]+\1\h*\[[^\]]+\]\h*,[^,;\n]*\1\h*\[[^\]]+\][\s\)]+;\s*(?:die|exit)\b[^;]{0,19};\s*(?:\?>|\Z)(?<X1194780>)|\h*=\h*['"]base[^\v\\]{0,99}\(\h*str_replace\h*\([^\v\*]+\bsetcookie[\h\(]+['"]\w+['"]\h*,\h*\$_[GPRSC]\w{2,6}\b[^\v]+\bcreate_function[\h\(]+(?:['"]{2}|null)\h*,\h*\1[^\v]+</form>(?<X2044531>)|\s*=\s*@?urldecode\s*\(['"]%[a-f\d%]{99,999}['"][\s\)]+;\s*\$\w{1,40}\s*=\s*['"]\d+['"]\s*;\s*\$\w{1,40}\s*=(?:\s*\1\{\d+\}\s*\.){3}[^\n]{999,}\$htContents[\s\)]+;[^\?]{0,999}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1204700>)|\s*=\s*['"]c['"\h\.creat_funio]{13,60}n['"]\s*;\s*(\$\w{1,40})[=\s@]+\1[\s\(]+["'](\$\w{1,40})['"]\s*,\s*['"]e[val'"\s\.]{3,19}\(['"\h\.base64_dco]{13,60}\(\s*\19[\s\);'"@]+\18[\s\(]+['"][a-z\d\+=]{99,}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1206310>)|\s*=\s*basename[\s\(]+(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\][\s\)]+;\s*if[\s\(]+@?(?:move_uploaded_file|copy)[\s\(]+\21\s*\[[^\]]+\]\s*\[[^\]]+\][\s,]+\1[\s\)]+\{\s*echo\s*basename[\s\(]+\21\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\)[^;]{0,40};\s*\}\s*(?:\?>|\Z)(?<X1192650>)|\s*=\s*curl_init\([^;]{1,99};\s*curl_setopt\s*\(\s*\1[\s,]+CURLOPT_URL[\s,]+['"]https?://[^'"/]+/(?:hack|link){1,}/[^;]{1,99};\s*curl_exec\s*\(\s*\1\s*\);\s*(?:\?>|\Z)(?<X1191780>)|\s*=\s*exif_read_data[\(\s]+['"]https?://[^/]{3,99}/[^'"]+\.(?:jpe?g|png|ico)['"][\)\s;@]+eval[\(\s]+base64_decode[\(\s]+\1(?:\[[^\]]+\])+[\)\s]+;\s*(?:\?>|\Z)(?<X1200930>))|(\$\w{1,9})[\h=]+['"]\W{1,4}\^\W{1,4}['"];\s*(\$\w{1,9})[\h=]+['"]\W{1,4}\^\W{1,4}['"];\s*(\$\w{1,9})[\h=]+(?:\([^\w\.]+\)\h*\.?\h*){1,5};\s*\$\{\27\}\[\25\]\(\$\{\27\}\[\26\]\);\s*(?:\?>|\Z)(?<X1211550>)|(\$\{['"]GLOBALS['"]\})[^\(]{9,99}\berror_reporting\((?:0|NULL|FALSE)\);[^\{]{0,40}(\$\{\29\[[^\]]+\]\})=curl_init\(\);\s*curl_setopt\(\30,curlopt_url,(base64_decode\()['"]aHr0c[^\?>]{99,400}\beval\(\31[^\.]{1,9}\.\$\{\29\[[^\]]+\]\}\);\s*(?:\?>\s*)?\Z(?<X1232231>)|(\w)\s*\(\);\s*(\w)[\s\(]+array[\s\(]+(?:\d+\s*,\s*){9,}\d+[\s\)]+;\s*(function)\s*\34\s*\(\s*(\$\w)[\s\)]+\{\s*\$\w\s*=\s*(\w)[\s\(]+\36[^@]{99,9999}\35\s*\33\s*\([\s\)]+\{\s*if\s*\([^\?\-]+\35\s*\37\s*\((\$\w)[\s\)]+\{\s*\$\w[\s=]+array_shift[\s\(]+\38[^\}]+\}\s*return\s*\$\w[;\}\s]+(?:\?>|\Z)(?<X1201870>)|(error_reporting[\(\s]+)['"](?:\\\d+)+['"][\)\s]+;\s*define[\(\s]+['"][^'"]+['"][\s,]+['"][^'"]+['"]\s*\);\s*(\$GLOBALS\[[^\s\w]{1,40}\]?)[=\s]+array[\(\s]+[^@]{1,4999}\40\d+[\)\s]+;[^%]{1,510}\b(function)[^%]{9999,14999}\42[^\}]+\}\s*(\$\w{1,40})\s*=[^;]+;\s*(\w+)[^%]{1,6999}\41[\[\s]+\w+[\]\s]+,\s*\43[\)\s]+;\s*goto\s*\44;(?<X2222942>)|(file_)put(_contents)[\h\(]+['"][^'"]+['"][\h,]+\46get\47[\h\(]+['"]https?://raw\.githubusercontent\.com/ptacid/[^'"]+\.txt['"][\h\)]+;\s*\?>(?<X1253170>)|(function)(?:\h+(\w{1,40})\(\$\w{1,40}\)[\{\s]+\$\w{1,40}[\h=]+file_get_contents\(['"]php:/[^;]+;[^\}]{49,499}\breturn\h+urldecode\([^\?>\*]{1,499}(\$\w{1,40})[\h=]+\50[^\?>\*]{99,300}(\$\w{1,40})[\h=]+\w{1,40}\([^;]+\51\);\s*(\$\w{1,40})[\h=]+create_\49\((?:null|['"]+)[,\h]+\52\);\s*@?\53[\(\);\}\s]+\?>(?<X1189800>)|\s*\w+\(\)\{\$\w+=(?:['"][^'"]*['"];print_r[^;]+;\}(\$\w+)=[^;]+;\$\w+=\$_[GPRSC]\w{2,6};(?:\$\w+=[^;]+;)+\49\s*\w+\((\$\w+),\$\w+\)\{global\55;\$\w+=['"]+;for[^@]{1,300}\49\s*(\w+)\s*\(\)[^@]{1,99}\49\s*\w+\((\$\w+),\56\)\{global\55;[^@]{1,700}\49\s*(\w+)\s*\(\56,\58[^\)]*\)[^@]+\59\(\56,\58[^\)]*\);[^\?]+\57\(\);\?>(?<X2259521>)|[^;]+;print_r[^;]+;\}(?:[^@]{1,500}\49\s*\w+\((\$\w+)[^@]{1,500}\49\s*\w+\((\$\w+),\61\)[^@]{1,800}\49\s*(\w+\(\61,\62,\$\w+\))[^@]+\63;[^\?]+\?>(?<X2259540>)|\$\w+=[^;]+;\49\s*\w+\(\)\{\$\w+=\d+;[^@]{1,100}\49\s*\w+\((\$\w+)[^@]{1,500}\49\s*\w+\((\$\w+),\65\)[^@]{1,1000}\49\s*(\w+\(\65,\66,\$\w+\))[^@]+\67;\}\?>(?<X2259530>))))|(goto)\s*\w{5,6};\s*\w{5,6}:\s*\$\w{5,6}[^;]+;\s*\69[^\?\n]{0,9999}\?\s*\d+[^\(]+unset\(\$\w+\);\s*\69[^@\n]{0,999}(\$\w+)\s*=\s*@preg_replace_callback\([^\)]+\70\);\s*\69[^\n]+\69\s*\w{5,6};\s*\w{5,6}:\s*\w{5,6}\(\$\w{5,6},\s*\$\w{5,6}\);\s*\?>(?<X1257112>)|//(?:\s*hiden\h*shell\b[^!]{0,9999}\bif[\(\s]+@?(?:copy|move_uploaded_file)[\(\s]+\$_FILES\h*\[[^\?]{0,999}chmod[\(\s]+['"][^'"]{1,40}\.php['"]\s*,\s*\d{1,4}\s*\)\s*;\s*\}[^;]{0,99}(?:\?>|\Z)(?<X1195120>)|\w{1,40}\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\](?:\h*=\h*['"][^'"]{1,199}['"]\h*;[^\n]{9999,}\burlencode\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][\}\)\s]+;[\s\}]+//\w{1,40}\s*(?:\?>|\Z)(?<X1194680>)|\s*=\s*['"][^'"]+['"]\s*;[^\n]{999,}@header\s*\([^\)]+\)\s*;\s*echo\$\s*\{\s*\$\w{1,40}\s*\}\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*\}\s*\}\s*//\w{1,40}\s*(?:\?>|\Z)(?<X1206740>))))
<\?[ph\s]+(?:@?(?:(?:set_time_limit|error_reporting)\([^\{]{9,99}\{\s*echo\h*['"]<[^'"]+['"][\h\.]+php_uname\(\)[\h\.]+['"]<[^\?]{99,250}(\$\w{1,15})[\h=]+(\$_FILES\[['"]FUCK['"]\]\[)[^\?]{99,399}\bif\(@?(?:copy|move_uploaded_file)\(\2[^\]]+\],\h*\1[\s\)]+\{\s*(echo)[^\{]{9,99}\{\s*\3[^;]+;\s*[\}\s]+\?>(?<X1202521>)|(\w+)[\s\(]+['"][^'"]*(\.php)['"],[^;]+;\s*function\s*\5\s*\([^\{]+\{\s*(\$\w+)([\s=]+)['"]https?://[^;]+;\s*\$\w+[\s=]+@?(file_get_contents[\s\(]+)\7([\s\)]+;)\s*if\s*\([^\{;]+\{[^\}]+\}[^\}]*\$(\w+)\8[^;]+/lock\d+\6['"];[^\}]*echo\s*\9\$\11\10\s*\}\s*\?>(?<X1200820>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]\w+\.(?:avi|ogv|wav|m(?:4a|pg|kv|ov|3u8?)|jp[x2]|wbmp|tiff)['"]\)?;\s*\?>(?<X12068911>)|[pes](?:assthru|ystem|xec|hell_exec)[\s\(]+(?:@?\w+[\s\(]+){0,4}\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1214230>)|echo\s*(?:(?:\(\s*)?\w+[\s\(\)]+\?\s*['"]\s*<(\w+)\b[^>]{0,99}\bstyle=['"][^'"]*font\-size:\h*0(?:p[tx]|em)?\b[^>]{0,199}>[^</>]{0,199}(?:<a\b[^>]{0,99}\bhref=['"]https?://[^>]{0,199}>[^<>/]{0,199}</a>[^></]{0,199}){1,}</\15>['"][^;]{0,99};\s*(?:\?>|\Z)(?<X1195700>)|@?file_get_contents[\s\(]+['"]https?://[a-z\-\.]{1,25}\d{2,}\.com/Backlink\d{0,4}\.txt['"][\s\)]+;\s*(?:\?>|\Z)(?<X1221380>))|echo\s+file_get_contents[\s\(]+['"]https?://[^/'"]{0,19}\bblinku12\.us/[^;]+;\s*(?:\?>|\Z)(?<X1213820>)|error_reporting(?:[\h\(]+(?:(?:0|NULL|FALSE)[\h\)];\s*(\$\w{1,20})[\h=]+@?create_function[\h\(]+['"]{2}[,\h]+base64_decode[\h\(]+['"][^'"]+["'][\h\)]+;\s*@?\19\h*\(\);\s*\?>(?<X1209591>)|0[\h\)]+;\h*@?touch[\h\(]+__(FILE)__\h*,[^;]+;\h*function\h+(\w+)\h*\([^\n\?]{1,299}\$(\w+)[\h=]+@?\21_ge(t_contents)\h*\([^;"']+['"](?:cGhwOi8vaW5wdXQ=+|php://input)['"][^\n\?]{1,1499}\b\21_pu\24\h*\([^,]+,\h*\$\23\b[^\n\?]{1,4499}\b\22\h*\([^;]+;[^\?\w\n]{0,9}(?:\?>|\Z)(?<X1207300>))|\(0\);\s*session_start\s*\(\);\s*if[\(\h]+get_magic_quotes_gpc[\(\h]+\)[\)\h]+\{\s*foreach[\(\h]+(\$_POST)\h+as\s*(\$key)=>(\$value)[\s\)]+\{\s*\26\[\27\]\h*=\h*stripslashes\(\28\);\s*\}\s*\}\s*echo\s*'<!DOCTYPE\b[^']+<title></title>[^']+;[^\*]{999,}</HTML>\s*\Z(?<X1190420>)|\h*\(0\);@?header\(['"](Content)\-Type:text/html;[^;\)]+\);define\(['"][^@\n]{999,}\breturn\h+@file_get_\30s\h*\([^\n]{999,}\{\h*@unlink[\h\(]+\$\w{1,40}[\)\h]+;[\s\}]+else\s*\{[^\?]{1,199}(?:\?>|\Z)(?<X1190164>))|eval\s*\([^;]{0,199}\bfile_get_contents[\s\(]+['"]https?://[^'"]+\.(?:gif|png|ico|jpe?g|txt)['"][^;]+;\s*(?:\?>\s*)?\Z(?<X1222630>)|file_put_contents[\s\(]+['"][^'"]+\.php['"][,\s]+(['"])<form\b[^;]{1,499}\b[cm]o(?:py|ve_uploaded_file)[\s\(]+(\$_FILES\[)[^,]+,\s*\34[^;]{1,499};[^\)]{0,499}\33\);\s*(?:\?>|\Z)(?<X1210330>)|header\s*\(['"]Content\-[^\)]+\)[;\s@]+error_r[^=\$]{1,40}\$\w{1,40}[\s=]+['"]\d+['"];\s*(\$\w{1,40})[\s=]+urldecode\(['"][^'"]{99,}['"]\);\s*function\s*(\w{1,40})\([^\[]{9,9999}isset[\s\(]+\$_[GPRSC]\w{2,6}\[\36\{\d+\}\.[^;]+;[^>]{99,}\{\s*\$\w{1,40}[\s=]+\37\([^\}]+\}[\s\};]*\w{1,40}[(\);\s]+\?>(?<X1200460>)|mail\([""][^'"]+['"],['"][^'"]{0,19}\byakpro\b[^'"]+['"],\$_SERVER\[[^\)]+\);\s*(?:\?>|\Z)(?<X1219000>))|@require_once\h*\([^;'"]{0,9}['"]/wp\-(?:includes|admin)/[^'"]+\.(?:css|ico)['"][\)\s]+;\s*\?>(?<X1190381>)|['"](?:\$\s*(?:\w+=)+https?://(?:\w+\.\w+/?)+\s*\w+=\d+\s*\w+=\[\d:[^\]]+\][^;]+;\$\w+=(explode)\(['"][^'"]+['"],[^;]+;(foreach)[^\}]+\};\$\w+=__FILE__;\$\w+=\41[^;]+;\42[^\}]+\};(?:function[\w\s]+[^@]{1,900}\})+(?:\$\w+=(\$GLOBALS)[^;]+;)+\42[^;]+;\};extract\(\$\w+\);(\43\[[^\]]+\])[^@]{1,4300}(\$\w+)[^>]+if\(\44[^>]+echo['"]\45['"];die;\}+[^>]+>(?<X1260620>)|error_reporting['"]\(0\);if\((isset\()(\$_[GPRSC]\w{2,6})(\[[^\]]+\])\)\&+\47\48[^\$]+\47\48(\[[^\]]+\])\)+[^@]{1,100}\beval\((?:\w+\()+['"]https?://['"]\.\48\50\.['"](?:\w+\.\w+[/\?])+\w+=['"]\.\48\49\)+;die\(\);\}elseif[^\}]+\}(?:function[\w\s]+[^\}]+\})+return[^>]+>(?<X1260610>))|[^@]{1,200}(\$\w+)=[^;]+;class\s*(\w+)\{private\s*function[\w+\s]+\(\52\)\{if\(is_array\(\53::(\$\w+)\)+[^@]{1,1400}\bpublic\s*static\54=[^;]+;\}(?:[^\?]+)?\?>(?<X1273520>)|[^\?;\$]{0,99}\bSasKraXploit\h*shell\h*V(?<X2210252>)|[^\{=]{0,49}\bif\s*\(\s*\$_[GCPSR]\w{2,6}\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[\s*['"][^'"]{1,40}['"]\s*\]\s*\[\s*['"][^'"]{1,40}['"]\s*\][^`]{1,200}\s*\}\s*else\s*\{\s*echo\s*['"][^`]{0,40}gagal[^`]{0,40}['"]\s*;\s*\}\s\}\s*else\s*\{\s*[^`]{0,200}\s*\}\s*(?:\?>|\Z)(?<X1042221>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\h\(]+['"]wp\-[^/]+/images/[\w\h\\]+\.txt['"][\)\h]+;\s*\?>(?<X1206431>)|[\h\(]['"]/(?:home|var)[^'"]+\bpublic_html/\w+\.txt['"][\h\)]+;[^\?]{0,99}\?>(?<X1217220>)|\(?['"]img/\w+\.(?:jpe?g|gif|bmp|txt|ico)['"]\)?;\s*\?>(?<X1212240>)))
<\?[ph\s]+(?:\$(?:(?:bot){1,3}[\h=]+['"]?\d+['"]?;\s*error_reporting\((?:0|NULL)\);\h*ignore_user_abort\(true\)[^\n\?]{6000,20000}\b(?:include|unlink)[\h\(]+[^\)]+[\h\)]+;\s*\?>(?<X1213330>)|\w+=['"]\%\{\d+\}\%['"];(\$\w+)=['"][^'"]*['"];(?:\$\w+=(?:\2\[\d+\][\.;])+)+if\(\!function_exists\(['"](\w+)['"]\)+\{function\s*\3\((?:\$\w+[,\)])+\{return\s*trim\(preg_replace[^;]+;[^\n>]{99,9999}(\$\w+)=\$\{['"]_SERVER['"]\}[^\n&]{999,}\bunset\(\$\w+,\$\w+,\4,\$\w+,\$\w+[\)\h;]+exit[^>]+\?>(?<X2259011>)|\w+=['"]base64\w+['"];\$\w+=['"]file_put\w+['"];\$\w+=[^;]+;\$\w+=['"]\.\w+['"];[^@]{1,5400}(\$\w+)=explode\([^;]+;if\(\w+\s*\(\6\[\d+\],\6[^@]{1,1400}\b(global)(\$\w+);[^@]{1,20000}\6\);\}+\7\8;[^@]{1,1000}(\$\w+)=rand[^@]{1,1000}\8->\w+[^@]{1,1550}(\$\w+)\[[^\]]+\][^@]{1,1000}\9,\10\)+;\}\?>(?<X1265862>)|\w+=['"]http[^;]+;function\s*\w+\([^%]{1,100}(\$\w+)=curl_init\(\);[^@]{1,200}(\$\w+)=(?:curl_(?:exec|close)\(\12\);)+return\13[^@]{1,600}func\w+\s(\w+)[^@]{1,1000}(\$\w+)=\$_[GPRSC]\w{2,6}[^;]+;[^@]{1,100}(\$\w+)=\$\w+\.['"]/\w+.php[^@]{1,200}(\$\w+)[^@]{1,100}\17\[[^\]]+\]=\15;[^@]+echo\s*\14\(\16,\17\);(?:return|exit);\}\?>(?<X1247671>)|\w+=[^;]+;(?:(?:[^;]+;)?function\s*\w+\((\$\w+)\)\{global\$\w+;[^(]+\(\19\s*(?:as\$\w+)?\)\{(\$\w+)[^}]+\}return\20;}(\$\w+)=\[\];[^@]+(\$\w+)=\$_COOKIE;[^@]+foreach\(\22\s*as\$\w+=>(\$\w+)\)\{function\s*(\w+)\(\21[^@]+\23\^\24\(\21,\$\w+,\21\[\w+\]\(\23\)+;\}(?<X2251351>)|function\s*\w+\((\$\w+)\)\{(\$\w+)=[^;]+;(\$\w+)=[^;]+;(\$\w+)=[^;]+;\26=\29\(\27\(\28\(\26\)+;return\26;\}function\s*\w+\(\$\w+,(\$\w+)\)[^@\n]{99,}(\$\w+)=['"]serialize['"];echo\31\(\30\);\}[^\}]+\}(?<X2259551>)|seT_time_limiT\(+int\)round\((?:\d+[\+\)])+[^;]+;deFIne\(['"]\w+['"],['"]https?://[^;]+;define\(['"]\w+['"],(\w+)\(\)\);(function)\s*(\w+)[^@]+(\$\w+)=\35[^;]+;\34\33[^@]+\34\s*(\w+)\(\$\w+=null[^@]+(\$\w+)=array\([^@]+\37\(\)[^\(]{1,100}\35[^@]+\36[^@]+\38\[['"]\w+['"]\]=['"]\d+['"];\};\?>(?<X1250030>))|\w+=[^\.]{1,99}\.chr\([^\)]+\)[^;]+;\$\w+=['"]class_exists['"];(\$\w+)[^;]+;class\s*(\w+)\{private\s*function[\w\s]+\(\40\)\{if\(is_array\(\41::(\$\w+)\)+[^@\n\*]{1,1999}\bpublic\s*static\42=[^;]+;\}\?>(?<X1273503>)|\w+=array\([^;]{9999,};if\(!isset\(\$_COOKIE\[['"](\w+)['"]\]\)+\{?echo\s*['"]<(script)\b[^>]{0,49}\bsrc=(?:https?:)?//127\.0\.0\.1/\44\.php\b[^>]{0,99}>\s*</\45>['"];(?:exit|die)\b[^;]{0,19};[^\?/]{1,499}\beval\([^;]{999,};(?:\?>)?\Z(?<X2220420>)|\w+=explode\([^#@]{999,9999}=(\$GLOBALS\[)[^\]]+\]\(\47[^\)]+\)\?\47[^\]]+\]\([^:;\{]{1,99}:\47[^\]]+\]\(\47[^\?]{1,999}\}function\s*(\w+\(\))\{eval\(\$\w+\[[^;]+;\w+\(\);\}\48;?(?:\?>|\Z)(?<X2223541>)|\w+[\h=]+['"]https?://[^'"]+['"];(?:\h*\$\w+[\h=]+['"][^'"]*['"];)?\h*(function)\h*(\w+\(\))\{[^\}]+\}\h*\50\h*curl_get_contents\b[^\n]{99,4999}\b(main_shell)['"]\][\h=]+\$\52;\}\h*\$referer[^\n]{99,999}\bgetServerCont\d*\([^\)]+\);[^;]{0,9}\51;+\}\s*\?>(?<X1240631>)|\w+[\s=]+array_merge[\s\(]+(?:\$_[GPSRC]\w{2,6}[,\s\)]+){2,};\s*(\$\w+)[\s=]+['"][^'"]+['"];\s*\$\w+[\s=]+strtoupper[\s\(]+['"]HTTP_['"][\s\.]+\54[\s\)]+;[^\}]{1,499}\bfile_put_contents[\s\(]+(\$\w+)[^,;]*,\s*['"]<\?[^;]+;\s*@?include[\s\(]*\55[\s\)]*;[^;]*\bunlink[\s\(]+\55[\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1213670>)|\w{1,15}[\h=]+\$_COOKIE;\h*(\$\w{1,15})[\h=]+\d+;[^\n]{0,99}\bbreak;\h*\57\+\+;\h*(\$\w{1,15})\[\57\]=[^\n]{0,99}\58\[\d+\]\(\58\[\d+\]\(\$\w{1,15}\[\d+\][\h\)]+;\h*\}\h*[ir][ne][cq][lu][ui][dr]e(?:_once)?\(\57\);\s*\?>(?<X1215090>)|\w{1,25}[\h=]+file_put_contents\(['"](\w{1,25}\.php)['"],\h*['"]<\?php\h*['"]\h*\.\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\.\h*['"]\h*\?>['"]\);\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]\60['"];\s*\?>(?<X1201790>)|\w{1,40}=['"]\w+['"];\$\w{1,40}=\d+;\$\w{1,40}=['"](?:\w[/\-])+\w+\.\w+['"];\$\w{1,40}=\d+;(?:\$\w{1,40}=((\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\])\([^;]+\)+;)+[^@]{1,12689}\$(\w{1,40})=\63\w+['"]\][^@]+\62[^@]+\bexit\(\);\}['"]\);\63\64['"]\]\(\);function[\w\s]+\(\$\w{1,40},(\$\w{1,40})[^\?]+,\d+,\65\);\}\?>(?<X1233091>)|\w{1,40}[=\s]+['"][^"'\$]{1,9}['"]\s*;\s*\$\w{1,40}[=\s]+['"]https?://['"]\s*\.\s*\$\w{1,40}\s*\.\s*['"][^'"]+\.(?:xyz|top)['"]\s*;\s*function\s*\w{1,12}get_contents\s*\((?:[^>]{9,9999}>){6,8}\s*0[^>]+else\s*\{\s*@?header\(['"]HTTP/\d+\.\d+\s*404\s*Not\s*Found['"][\);\s]+\}\s*\?>(?<X1205200>)|\w{1,40}[\s=]+['"]\d+['"][\s;]+(\$\w{1,40})\s*=[\s\("']+[^'"\)\s]{18,}["'\)\s]+;(?:\s*\$\w{1,40}\s*=(?:\s*\68\[\d+\]\s*\.)+\s*\68\[\d+\];)+\s*@?header\([^\)]+\);\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\d+\);[^\*]{999,}\bunset\b[^;]+;\s*exit\b[\(\)\}'"\s;]+\$\{['"][^;]+\(\);\s*\?>(?<X1206100>)|\w{1,40}\h*=\h*base64_decode\h*\(\h*['"]ZnVuY3Rpb24gcGgo[a-z\d\+/]{999,1999}=*['"][\h\)]+;\s*@?eval[\(\h]+\$\w{1,40}\)\h*;\s*(?:\?>|\Z)(?<X1189070>)|\w{1,40}\s*=\s*(?:"[^"]*"\s*;\s*if\s*\(\s*\$_(?:GET|POST)\s*\[\s*pass\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}[=\s]+"[^"]*"\s*;\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\][=\s]+"[^"]*"\s*;[^\v]{999,5000}/>\s*</form>\s*<\?[ph\s]+\}\s*\?>(?<X1036761>)|\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*if[\(\s]+preg_match[\(\s]+['"]/[\(\s]+android\|[^:\n]{99,9999}\bheader[\s\(]+['"]Location:\s*https?://(?:bit|molingvarballheart|xxxconent)\.(?:ly|cf|biz)/(?:\w{1,39}/?\s*){1,2}['"][\s\)]+;\s*\?>(?<X1202920>))|\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=\h*['"][^'"]{3,40}['"]\h*;\h*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=[^\n]{9999,}\bappend_each\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\},[^;\.]+\.\h*urlencode\([^;]+;[\}\s]+(?:\?>|\Z)(?<X1194510>))|\@touch[\(\s]+(['"]\w*\.(?:txt|php|js)?['"])[\)\s]+;(\s*echo\s*\@eval[\(\s]+\@file_get_contents\()\@\$_[GPRSC]\w{2,6}[^;]+;\75\74[\)\s]+;\s*\?>\s*<\!\-+Null\_Route\-+>(?<X1216780>)|\beval\((str_rot13)\(gzinflate\(\77\(base64_decode\(['"]LUnFEu3IDf2a[^\)]+\){5};\s*\?>(?<X1262152>)|\h*echo\h*file_get_contents[\h\(]+['"]https?://raw\.githubusercontent\.com/[^/]{0,15}e?xploit/[^'"]{1,40}\.txt['"]\);\s*\?>(?<X1220940>)|class(?:\h*(\w+)[\{\s]+public\h*function\h*(\w+\(\))[\{\s]+(\$\w{1,20})[\h=]+['"\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]['"\s]+;\s*return\h*\82;[\}\s]+\82[\h=]+new\h*\80\(\);\s*(\$\w{1,20})[\h=]+\82[\h\->]+\81;\s*@?eval[\h\(]+\83[\h\)]+;[^\?]{0,30}(?:\?>|\Z)(?<X1233031>)|\h+(\w+)\s*\{[^\?]{1,999}\bfunction\h+(\w+)[\s\(\)]+\{\s*(\$\w+)[\s=]+\$_[GPCSR]\w{2,6};\s*\(\s*\87\b(?:[^;]{0,99}\87\[\85::\w+\(\d+\)\]){2}[^;:]+:\s*\87;\s*return\s*\85\s*::\s*\w+\(\d+\);\s*\}\s*\86\(\);\s*(?:\?>\s*)?\Z(?<X1213471>)|\s*(\w+)\{private\$(\w+);public\s*function__construct\(\)\{(\$this)\->\90=hex2bin\(addslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;\}+(\$\w+)=function\(\)\{return\91\->\90;\};eval\(\92\->call\(new\s*\89\)+;\?>(?<X1269440>)|\s*\w{1,20}[\{\s]+private\s*static[^;]{1,30};\s*(?:public\h*static\h*)?(function)\s*\w+\([^\{]+[^;]{0,60}\bself::(\w+\(\));[^\{]{0,60}\b\94\s*\95[\{\s]+[^\{]{9,199}\94\s*(\w+)\([^\}]{99,400}\beval\([^;]+;\s*return\s*\w+::\w[^\};]+;\s*\}\s*\96\(\);\s*(?:\?>)?\Z(?<X1253971>)))
<\?[ph\s]+(?:echo(?:[\h\('"]+<form\b[^;]{4,99}['"]post['"][^;]+;[^\}\?\{]{0,99}(\$\w{1,40})[\h\=]+(\$_FILES\h*\[[^\]]+\])\[[^\]]+\];[^\}\?\{]{0,99}if[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\?]{0,499}\bif[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\2[^,;]+,\h*\1\b[^\?=]{4,499}\}(?:\s*;)?\s*(?:\?>|\Z)(?<X1189960>)|[\h\(]+is_front_page\(\)\)[\h\?]+['"]<span\h+style=['"]display:block;\s*(?:(?:font\-size|height):0;\s*){2}['"]><[^/\?]{9,150}<a\h+href=['"]https?://anabol\-it\.com/[^:\?]{99,400}</span>['"][:'";\h]{3,7}\s*\?>(?<X1196880>)|[\s\('"]+<[^;\.]{0,99}\.\s*php_uname\s*\(\)[^\?]{99,9999}\bdeface[\W]{0,9}<[^;]*;\s*(?:\?>|\Z)(?<X1195350>)|\h*file_get_contents[\h\(]+['"]https:?//[^/]+/link\.txt['"][\h\)]+;\s*\?>(?<X1215850>)|\s*(?:@?file_get_contents[\(\s'"]+https?://\w+\.blinku12\.us/api\.php['"\);\s]+(?:\?>|\Z)(?<X1213121>)|[^\(;]+getcwd\([^\(;]+php_uname\([^\(;]+\.implode\([^\(;]+scandir[^@]{1,250}<input[^>]+value=['"]Up[^\?]+<\?[ph\}\s]+if[\(\s]+\!empty\((\$_FILES\[[^\]]+\])[\)\{\s]+(\$\w+)[^;]+;[;\s]+\9[=\s]+\9[\.\s]+basename[\(\s]+\8[^;]+;[;\s]+if[\(\s]+(?:move_uploaded_file|copy)[\(\s]+\8[^\);]+\9[^\?]+\?>(?<X1255333>)|file_get_contents[\(\s]+['"]https://[^/]{0,20}slotonline[^/]{0,20}\.\w{2,3}[^'"]+\.(?:php|txt)['"][\s\)]+;\s*\?>(?<X1232691>)))|e(?:rror_reporting(?:[\(\s]+(?:0[\)\s;@]+header[\(\s'"]+Content\-Type[^\$]{1,999}(?:\$\w{1,40}[=\s]+['"][^\|]{1,190};)+(?:\$\w{1,40}[=\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\]\s*;)+\$\w{1,40}[=\s]+[\(\s]+isset[\(\s]+\12[^:\n]{99,9999}://[^\n]{99,}(\$\w{1,40})[=\s@]+fopen[^>\n]+fclose[\(\s]+\13[^>\n]+(?:\?>|\Z)(?<X1239731>)|\d[\)\s]+;(\$\w{1,40})[=\s]+[^;]+;(\$\w{1,40})[=\s]+\15[\(\s]+(?:['"][^'"]*['"][,\)\s]+)+;\$\w{1,40}[=\s]+\$[\{\s]+(?:\16[\[\s]+\d+\+\d+[\]\s]+[\.\}\s]+)+;[^\%]{1,300}class\s*(\w+)[^\%]{1,600}static\s*func\w+\s*(\w+)[^\%]{1,1200}\b\17::\18[^;]+;eval[\(\s]+base64\w+[^\)]+[^;]+;\?>(?<X1226120>))|(?:[\h\(]+(?:0|NULL)[\h\)]+;\s*(\$\w{1,25})[\h=]+\$\{['"][_COOKIE\\xfb5439]{7,28}['"]\};\s*if[\h\(]+in_array[\h\(]+gettype[\h\(]+\20[^\}]{9,199}\(\$\{\20\[\d+\]\}\[\d+\][\h\)]+;\s*\20[\h\(\)]+;\s*\}\s*(\$\w{1,25})[\h\=]+array[\h\(]+\$\{['"][^\?]{99,599}\?\h*\21\[\d+\]\h*\([^\?]{0,99}\?>(?<X1207992>)|[\s\(]+(?:0|NULL|False)[\s\)]+;\s*@?header[\s\(]+['"]content\-type[:\h]+text/html;[^;]+;\s*\$\w+[\s=]+['"](\w+)['"];[^#]{1,1999}=\s*['"]https?://\23\.[^'"\?]+\.php\?[^\?]{1,999}\bstri?str[\s\(]+\$\w+[,\s]+['"]okhtmlgetcontent['"][^#]{1,9999}=\s*fwrite\s*\([^;]+;[^\}]{0,99}\}\s*(?:\?>|\Z)(?<X1213100>)|\((?:0|NULL)\);\s*(?:@?session_start\(\);\s*class\h*(crawler)\s*\{\s*private[^%`]{999,7500}\bcurl_close\(\$\w{1,15}\);\s*return\s*\$\w{1,15};[\s\}]+(\$\w{1,15})[\h=]+new\s*\25\(\);\s*\26->doAction\(\);\s*\?>(?<X1210751>)|\$\w{1,25}[\h=]+['"][^\?]{9,399}(\$\w{1,25})[\h=\.]+chr[\(\h]+\$\w{1,25}\h*\^\h*ord\([^\)]+[\h\)]+;\s*(\$\w{1,25})[\h=]+\28[\h\(]+['"]{2},\h*\$\w{1,25}[\h\(]+[^\)]+[\h\)]+;\s*\29[\h\(\)]+;(?<X2207963>)|if[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)[\h\(]+base64_decode[\h\(]+stripslashes[\h\(]+\31[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1211670>))|\((?:0|NULL)\)[^\{]{0,99}\bfunction\h*(\w{1,25})\(\$\w{1,25}\)\{[^\{]{1,199}\{\s*(\$\w{1,25})[\h\.=]+pack[\h\(]+['"]\w['"],\h*hexdec\b[^\}]+\}\s*return\h*\34;\s*\}\s*(\$\w{1,25})[\h\=]+\33\([^;]{1000,};['"];[^;]{0,250};\s*(\$\w{1,25})[\h=]+@?\$\w+\(['"]{2},\h*\35\);\s*\36[\h\(\)]+;\s*\?>(?<X1211321>)|\(0\);(?:(\$\w+)=(?:['"][^\$'"]*['"];(\$\w+)+=['"]hex2bin['"];(\$\w+)+=explode\([^\$]+\39\(['"][^$'"]*['"]\)+;eval\(\40\[\d+\]\(\40\[\d+\]\(\40\[\d+\]\(\38\)+;\?>(?<X1253643>)|isset(\(\$_[GPRSC]\w{1,6}\[[^\]]+\]\))\?urlencode\42[^;]+;function\s*\w+\(\)\{foreach\(\[(?:['"](?:HTTP_\w+|REMOTE\w+)?['"][,\]])+[^@]{1,400}\bstr_rot13[^@]{1,90}\38[^;]+;(?:curl_setopt[^;]+;)+(\$\w+)=json_decode[^@]{1,100}\bheader\(['"]Location:\s*['"]\.\43\->\w+,\w+,\d+\);exit;\}+(?<X1265440>))|header\([^\)]+\);(\$\w+)=[^;]+;(\$\w+)=(?:[^;]+;){2}(\$\w+)=urldecode\(\46\);[^@]{1,100}(\$\w+)=\$_[GPRSC]\w{2,6}\[[^\]]+\];[^@]{1,1000}\b\w+\(\47,\45[^;]+;\}if\(strstr\(\48,[^\)]+\)+[^@]{1,4000}\bfunction[\s\w]+\(\47,(?:\$\w+[,\)])+\{(\$\w+)=fopen\(\$\w+[^\)]+\)[^;]+;(\$\w+)=fwrite\(\49[^;]+;fclose\(\49\);return\50[^>]+>(?<X1260690>))))|val[\(\s]+['"]\s*function\s*(\w+)[\(\s\)]+\{(?:\s*(\$\w{1,40})[=\s]+['"]ba['"]\.['"]s['"][^'"\$]+['"]ode['"];){2,}[^%]{1,700}\53[\s\(]+['"][^'"]+['"][^\?]{1,150}\bcatch[\s\(]+Exception\s*\$\w+\)[\s\{\}]+add_action[\s\(]+['"]\w+['"][\s,]+['"]\52['"][\s\)'";]+\?>(?<X1229641>)|val\(file_get_contents\(['"]https?://recaptcha\-in\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml)/[^'"]{1,40}['"][\)\h]+;\s*\?>(?<X1203990>))|function(?:[\w\s]+\((\$\w+)\)\{(\$\w+)=curl_init\(\);(curl_setopt)\(\57[^@]{1,500}\58\(\57[^\$]+\$\w+=curl_exec\(\57\);curl_close\(\57\);return[^@]{1,700}\bfunction\s([\w\s]+)\(\56,\$\w+=array\(\)[^@]{1,1400}(\$\w+)\[\]=array\(\);(?:\60\[[^\]]+\]=\$\w+;)+if[^@]{1,9999}\$\w+=\59\(\$\w+,\60\);[^>]+>(?<X1286080>)|\h*(\w{1,40})\h*\(\)\s*\{\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*str_rot13\s*\(\s*['"]uggc[^;]+;\s*echo[\h'"\(]+\63[\h'"\)]*;\s*\}\s*\62[\(\s\)]+;\s*(?:\?>|\Z)(?<X1195741>)|\h+(?:(\w+)[\h\(]+(\$\w+)[\h\)]+\{\h*(\$\w+)[\h=]+@?file_get_contents[\h\(]+\66[\h\)]+;\h*return\b[^;]+\67\b[^\n]+\b(echo\h*@?\65[\h\(]+['"][^'"\?]+(?:\\x3f|\?))(?:\w|\\?\w+)=\d+['"][\h\)]+;[^\n]+?\b\68(?:\w|\\?\w+)=\d+['"][\h\)]+;[^\n\w\?]+(?:\?>|\Z)(?<X1206860>)|(\w{1,40})\([^\)]+\)[\{\s]+\$\w{1,20}=file_get_contents\([^;]+[^\}]{9,99}\}\s*(\$\w{1,20})=\$_SERVER\[["']HTTP_USER_AGENT['"]\];\s*\$\w{1,20}=array\(['"](?:bing|google)[^><]{99,299}\bforeach\(\$\w{1,20}\h*as\h*\$\w{1,20}\)[\s\{]+if\(strpos\(\71[^\/\\]{1,90}\becho\h+\70\(['"][^;]+;[\}\s]+(?:\?>)?\Z(?<X1205610>))|\s*(?:(\w+)\([^\)]+\)\s*\{\s*\$\w+[\h=]+curl_init\(\);[^\}]{9,500}\}\s*echo\h*\73[\h\(]+str_rot13[\h\(]+['"]uggc://frectbb\.[^'"]+['"][\h\)]+;\s*\?>(?<X1213260>)|(\w+\()\$\w+\)\{\$\w+=curl_init\([^\}]{1,999}\breturn\s*\$\w+;\}(\$\w+)=['"]https?://[^;]+;(\$\w+)=(?:\w+\()*\75\76\)+;eval\(\77\);(?:\?>|\Z)(?<X1224430>))|\s+(?:(\w+)\b[^\{]+\{\s*(\$\w+)\s*=([^;]*\$_[GPCSR]\w{2,6}\[)[^;]+;\s*(\$\w+)\s*=\81[^;]+;\s*(\$\w+)[\s=]+(curl_)init\s*\([^;]*\80\b[^\}]{0,499}\$(\w+)[\s=]+\84exec[\s\(]+\83[\s\)]+;[^\}]{0,199}\bfile_put_contents[\s\(]+\82[\s,]+\$\85[\s\)]+;[^\?]{0,199}\b\79\s*\([^;]+;[^\?;\(\)]{0,99}(?:\?>|\Z)(?<X1198960>)|(\w+\()(\$\w+)\)\{(\$\w+)=file_get_contents\(\88\);[^\?]{1,499}\breturn\s*\89;\}(\$\w+)=\87['"]https?://[^\?]{1,499}\bf(?:write|ile_put_contents)\([^,;]+,\90\);(?:fclose\([^;]+;)?\}*(?:\?>|\Z)(?<X1224040>)|(\w{1,40})[\h\(\)]+\{\s*(\$\w{1,40})[\s=]+@?file_get_contents\s*\([^\)]{0,99}['"](?:https?|uggcf?)://[^;]{1,199};\s*(?:echo|print|return)\s*\93;\s*\}\s*(?:(?:echo|print)\s*)?\92[\s\(\)]+;\s*(?:\?>\s*)?\Z(?<X1192140>)))|global(?:\h*(?:(\$\w{1,20});\s*if\(!?\95\)[\{\s]+function\h*(ob_start\w*)\((\$\w{1,20})\)[\{\s]+(?:\$\w{1,20}[\h=]+array\([\d,\h]{99,6000}\);\s*){2}[^\}]{1,80}\}\s*\$\w{1,20}[\h=]+str\w{1,20}\(\97\);[^@]{0,40}\b(?:if\([^\)]+\)[\{\h]+[^\}]{9,99}[\}\s]+){4,10}[^\}@]{9,60}\breturn\h*\97;[\}\s]+[^@]{0,30}@?ob_start\(['"]\96['"]\);[\}\s]+\?>(?<X1211480>)|\$searchsite\h*,[^;]+;[^\{\}]{0,499}\bbuymskey\b[^@\^]+\bsetcookie\h*\([^;]+;\s*\}\s*set_time_limit\([^\)]+\)\h*;\s*(?:\?>|\Z)(?<X1193031>))|\s+(\$ob_starting);\s*if[\s\(]+!\100[\s\)\{]+function\s+(\w+)[\s\(]+(\$\w+)[\s\)\{]+\$\w+[\s=]+Array[\s\(]+\d+\s*,[^<>/@\?]{1,9999}?\$(?:(\w+[\s=]+stri?pos[\s\(]+\$\w+[,\s]+['"])</\w+['"][\s\)]+;[^;]+\$\103>['"][^;]+;[^;]+\$){5}[^\?@]{1,499}\breturn\s+\102;[\s\}]+\100\s*=[^;]+;\s*@?ob_start[\s\(]+['"]\101['"][\s\)]+;[\s\}]+(?:\?>|\Z)(?<X1209992>)))
<\?[ph\s]+goto(?:\b[^\n]{1,999}=\h*['"][^'"]{0,199}\b64\h+group\h+of\h+zain\h+bani['"];[^\n]{999,};\s*(?:\?>|\Z)(?<X1216600>)|\h*(?:\w{3,8}[;:]\h*)+@?error_reporting\(0\);(?:[^\v]{0,1999}\$botbotbot\h*=[^;]*\b(?:str_replace|mb_strtolower)\h*\([^;]+;)+[^\v\?>]{0,99}\?>(?<X1189900>)|\s(\w+);\3:(\$(?:bot)+)=\.mb_strtolower[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;\s*goto\s*\w+;(\w+):\s*if\(strpos\(\4,[^\n]{99,350},\4\);\h*goto\h*\5;\h*\w+:\s*\?>(?<X2221512>)|\s+(\w+);\s*\7:\s*error_reporting[\s\(]+0[\s\)]+;[^\n]{0,999}\bwelcome\s+visitor\s+64\s+group\s+of\s+zain\s+bani['"];[^\n]{0,499}\beval\s*\([^;]{19999,}\\['"][\h\)]+;\h*['"][\h\)]+;\s*(?:\?>|\Z)(?<X1215050>))
<\?[ph\s]+if(?:([\(\s]+)isset\1\$_[GPRSC]\w{2,6}\[[^\]]+\][^>]+>\s*<(script>)\s*window\.add\w*\1[^,]+,function\1([\)\s]+)[\{\s]+(let\s*)(\w{1,40})[=\s]+(document\.createElement\1)[^;]+;\5\.\w*[^,]+,\5\.\w*[^\-]+[^'"]+['"];\s*\4\w{1,40}[=\s]+\6[^;]+;[^;]+;\s*\4\w{1,40}[=\s]\6[^;]+;[^;]+appendchild\1\5\3[^;]+;\s*</\2(?<X1216941>)|[\(\h]+isset[\h\(]+(\$_[GPRSC]\w{2,6})\[[^\]]+\][^\{]+\{\s*(\$\w{1,40})[=\h]+fopen[\h\(]+['"][^'"]+\.css['"],['"]\w['"][\)\s;]+(\$\w{1,40})[=\h]+['"]{2};\s*foreach[\h\(]+\8\h*as\h*(\$\w+)[^\{]+\{\s*\10[\h\.=]+\11[^\?]{99,499}\bfwrite\(\9,\10\.['"][^'"]+['"][\h\)]+;\s*\}\s*\?>(?<X1209441>)|[\(\s]+!\s*(file_)exists[\(\s'"]+(/home\d*/[^/]+/\.[^'"/]+\.txt)['"\)\s\{@]+\13pu(t_contents)[\(\s'"]+\14['",\s@]+\13ge\15[\(\s]+base64_decode[\(\s'"]+aHR0[^'"]{9,99}['"][\)\s;\}]+(?:\?>|\Z)(?<X1203220>)|[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*echo\b[^;]+\.\s*php_uname\s*\(\)[^;]*;[^\}]+\bif[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;\{\}\(]+\bif[\s\(]+@[cm]o(?:py|ve_uploaded_file)[\s\(]+\$_FILES\[[^\]]+\]\[[^\]]+\][\s,]+\$_FILES\[[^\]]+\]\[[^\]]+\]\s*\)[^;\{\}]+;\s*\}\s*(?:\?>|\Z)(?<X1189240>)|[\s\)]+\{\s*if[\(\s]+isset[\(\s]+(\$_FILES\[[^\]]+\])\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[=\s\(]+\18\[[^\]]+\][;\s\)]+(\$\w{1,40})[=\s\(]+\18\[[^\]]+\][;\s\)]+@(?:move_uploaded_file|copy)[\(@\s]+(?:\20|\19)[,\s\(@]+(?:\20|\19)[\s\)]+;[^\}]{0,99}\}[^\?\$]{0,499}(?:\?>|\Z)(?<X1198250>))|[\(\s]+md5[\(\s]+@\$_[GPRSC]\w{2,6}[\[\s]+['"]sid[^\w]+\w+[^\w]+(\$\w{1,40})[=\s]+[^\@]+@file_put_contents[\(\s]+\22,base64\w+[^\@]+@chmod[\(\s]\22,[^\?]+\?>(?<X1212270>)|[\h\(]+!is_writable[\h\(]+(['"]/[^'"]+/\w{1,25}\.php['"])[\s\)]+\{\s*chmod[\h\(]+\24,\h*\d+[\h\)]+;\s*\}\s*if[\h\(]+file_exists[\h\(]+(['"]/tmp/\w{1,25}\.txt['"])[^\{]+\{\s*(file_)put(_contents)[\h\(]+\24,\h*\26get\27[\h\(]+\25[\h\)]+;\s*\}\s*\?>(?<X1207941>)|[\h\(]+isset[\h\(]+\$_(?:[GPCSR]\w{2,6}\[[^\]]+\][\)\s\{]+(?:\$\w{1,40}[\h=]+@?(?:shell_exec|exec|passthru|system|popen)[\h\(]+['"]rm\h+[\-\w\s]{2,}(?:\.(?:php|html?)(?:\.bak)?\s+[\w\-]{2,}){3}[^'";&]{1,99}['"][\s\);]+echo\b[^;]{2,49};\s*){2,3}\}\s*(?:\?>|\Z)(?<X1152774>)|[GPRSC]\w{2,6}\[[^\]]+\](?:[\s\)]+\{\s*(?:\$\w{1,15}[\h=]+fsockopen\(\$_[GPRSC]\w{2,6}\[[^\]]+\][,\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h]+;\s*exec[\(\h]+['"]/bin/bash[^'"]+['"][\)\h]+;[\}\s]+\?>(?<X1204081>)|echo[\h\(]+base64_decode[\h\(]+[^\)]+[\h\)]+;\s*@?@?(?:copy|move_uploaded_file)[\h\(]+(\$_FILES\[[^\]]+\])[^;]+;\s*echo[\h\(]+['"]<a\h*href=['"]\.?\31[^;]+;\s*\}\s*\?>(?<X1254540>))|[^\{]+\{\s*(\$\w{1,25})[\h=]+['"]base64_decode['"];\s*(\$\w{1,25})[\h=]+['"]create_function['"];\s*(\$\w{1,25})[\h=]+\34[\h\(]+['"]{2},\s*\33[\h\(]+['"][^'"]{99,299}['"][\h\)]+;\s*\35[\h\(\)]+;\s*\}\s*\?>(?<X1207950>)))|[\s\(]+isset[\s\(]+(\$_FILES\[['"]uk45['"]\])[\s\)]+\{\s*@?(file_)pu(t_contents)[\s\(]+\37\[[^\]]+\][,\s]+@?\38ge\39[\s\(]+\37\[[^;]+;\s*(?:if[\s\(]+\38exists\s*\([^;\{]{1,199}\{\s*echo\b[^;]+;[\s\}]+(?:else[\s\{]+echo\b[^;]+;[\s\}]+)?)?(?:\?>|\Z)(?<X1221390>)|\([^\{;]+\)[\{\s]+\$\w{1,20}=\Wuname\h*\-a\W;[^\\@\*]{99,500}\bif\([^\)]+\)[\{\s]+(\$\w{1,20})=(file_)ge(t_contents)\(['"]https?://raw\.githubusercontent\.com/[^'"]{6,99}\.\w{2,6}['"]\);\s*(\$\w{1,20})=\42pu\43\(['"]([^'"]+)['"],\41\);\s*if\(\44\)[\{\s]+echo\h*['"]<a\h*href=['"]\45[^\\\?]{9,150};[\}\s]+(?:\?>)?(?<X1220851>)|\(\!?(function)_exists\(['"](\w+)['"]\)+\{\47\48\((\$\w+)\)\{(\$\w+)=sys_get_temp_dir\([^;]+md5\(\49[^\)]+\);\$\w+=file_exists\(\50[^@]{1,400}(\$\w+)=\48[^>]+eval\(\51[^>]+>(?<X1258210>)|\(\!?function_exists\(['"](\w+)['"]\)+\{function\s*\53\(\$\w+\)\{\$\w+=['"]https?://[^;]+;[^\}]+\}[^@]{1,99}(\$\w+)=\53\([^\)]+\);if\(\!?isset(\(\54\[['"]\w+['"]\]\))\)\{eval\55;\}+\?>(?<X1258521>)|\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[\h&]+\57[\h=]+['"][^'"]+['"][\s\)\{]+\$\w+[\h=]+(mysqli_)connect\(.{9,99}\);\s*\$\w+[\h=]+\58query\([^\)]+\);\s*(\$\w+)[\h=]+\58[^;]+;\s*(\$\w+)[\h=]+['"\.creat_funio]+;\s*(\$\w+)[\h=]+\60\([^,]+,\h*['"\.eval]+\([^\}]{1,99}\61\(\59\[[^\?]{0,99}\?>(?<X1223101>)|(\$_SERVER\[[^\]]+\])\)[\h\D]{2,5}strpos\(\63,['"]google\.['"]\)[\h!=]+false\)\s*\{\s*header\(['"]Location:\h*https:?//[^'"]+['"]\);\s*\}\s*\?>(?<X1211930>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+\{if\(strpos\(\$_[GPRSC]\w{2,6}\[[^\]]+\],['"]\w+['"]\)\!==?\w+\)\{class\s*(\w+)\{[\w\s]+(\$\w+);[\w\s]+(\w)\(\$\w+\)\{if\(\!(self::\66)\)\s*self::\w+\(\);[^=]+\68=array\((?:\d+[,\)])+;\}+function\s*(\w+)[^{]+\{(\$\w+)=\$_COOKIE;[^@]{1,300}\70;return\s*\65::\67\(\d+\);\}\69[^}]+\}+(?<X2250701>))|\(stri?str\(\$_[GPRSC]\w{1,6}\[['"]\w+['"]\],['"][^"']*['"]\)[^\}@]{1,199}(\$\w+)=\$\w+\(['"]https?://[\w\-\.]+\.[a-z]{2,9}\b[^'"]*['"]\);(\$\w+)=[^;]+\72;(\$\w+)=[^;]+;(\$\w+)=[^;]+;if\(\75\(\74,\73\)+\{echo\74;exit;\}+\?>(?<X1258231>)|\h*\([^;\{]{0,99}\$_SERVER[\h\[]+['"]HTTP_USER_AGENT['"][^\{;]{0,199}\{\s*@?echo\s*['"]\s*(?:<a\b[^>]{0,99}(?:\b(?:title=['"]([^'"]+)['"]|rel=['"]?dofollow['"]?)[^>]{0,99}){2}>\s*\77\s*</a>\s*){5,}['"]\s*;\s*\}\s*(?:\?>|\Z)(?<X1196240>)|\h*\(\$_[GPRSC]\w{2,6}\)\s*\{\s*\bif[\h\(]+@?[cm]o(?:ve_uploaded_file|py)[\h\(]+\$_FILES\[['"]\w+['"]\]\[['"]tmp_name['"]\]\h*,[^\?]{1,299}__halt_compiler\h*\(\)\h*;\s*(?:\?>|\Z)(?<X2183991>)|\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*echo\h+['"]<form[^;]+;[^\(\{\?@:]{1,299}if\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{[^\{@\}]{1,99}if\h*\(\h*@?(?:move_uploaded_file|copy)\h*\(\h*\$_FILES\[[^\?]{1,299}\{\s*echo\h+[^;]+;\s*(?:\}\s*){3}\?>(?<X1143631>)|\s*[\(\s]+\!class_exists[\(\s]+['"]([^'"]*)['"][\)\s]+[^:]+:+[^=]+\$\w{1,40}[=\s]+['"]base64['"][^\-]+@unserialize[^\?]+new\s*\81[\(\)\s]+;\$\w{1,40}[=\s]+NULL;[\}\s]+\?>(?<X1217381>)|\s*\([^;\{\$]*\$_[GPCSR]\w{2,6}\[[^\{;]+\{[^\}]{0,199}\$(\w+)\s*=[^;]*\$_[GPCSR]\w{2,6}\[[^;]+;\s*@?file_put_contents[\s\(]+(\$\w+)[\s,]+\$\83[\s\)]+;\s*@?(?:includ|requir)e(?:_once)?\h*(?:\(\h*)?\84\h*(?:\)\h*)?;\s*@?unlink[\s\(]+\84[\s\)]+;\s*(?:exit|die)\b[^;]*;\s*\}\s*(?:\?>|\Z)(?<X1198670>)|\s*\([^;\{\)]{0,49}\$_SERVER\[[^\{;\?]+\{\s*\?>\s*<(\w+)\b[^>]{0,99}\bstyle=['"][^'"]*\b[lrtbhw](?:(?:eft|ight|ottom|op)[\h:]+\-\d{4,}|(?:eight|idth)[\h:]+[012])px\b[^>]{0,99}>[^</]{0,49}(?:<a\b[^>]{0,99}\bhref=['"]https?://[^>]+>[^<\?]{0,49}</a>[^</]{0,199}){5,}</\86>\s*<\?[ph\s]+\}\s*\?>(?<X1220440>)|\s*\([^;\{]{0,99}\$_[GPCSR]\w{2,6}\[[^\{;]{1,99}\{\s*echo\s*['"]<[^;]{1,499};\s*(\$\w+)[\s=]+(?:@\s*)?\$_FILES\[[^\}]{0,299}\b[cm]o(?:ve_uploaded_file|py)[\s\(]+\88\[[^\{]{1,99}\{\s*echo\s*['"][^;]{1,99}<a href='(?:\\)?\$fullpath'>\s*OK\-Click\s*here\b[^;]{1,99};[\s\}]+\?>(?<X1192730>)|\s*\([^;\{]{1,499}['"](/[^'"]+/wp\-admin/images/\.[^'"/]+)['"][^\{;]{1,499}\{\s*(?:@?(?:chmod|copy)\s*\([^\)]{0,99}['"]\90['"][^;]{0,9};\s*){2,}\}\s*(?:\?>\s*)\Z(?<X1191841>)|\s*\([^\)]*(?:(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*(echo)\s+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\92[\s\)]+;\s*\93\b[^\}]+\}\s*(?:else\s*\{[^\}]{0,99}\}\s*)?\?>(?<X1201775>)|\$_[GPCSR]\w{2,6}\[[^\{;]+\{\s*(\$\w+)[\s=]+wp_create_user\h*\([^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\95[\s\)]+;\s*\96\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1206130>))|\s*\([^\{;]{1,199}\{\s*(\$\w+)[\s=]+(curl_)init[\s\(\)]+;[^\}]{0,499}\b\99setopt[\s\(]+\98[\s,]+CURLOPT_URL[\s,]+str_rot13[\s\(]+['"]uggcf?://[^\}=]{1,499}\$(\w+)[\s=]+\99exec[\s\(]+\98[\s\)]+;[^\}=]{0,499}\becho\s*\$\100;\s*\}\s*\?>(?<X1197000>)|\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*==["'][^'"]*["']\s*\)\s*\{\s*echo\s*\w+\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if\s*\(\s*\$\w{1,40}!=['"][^"]*['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@?eval\s*\(\s*["'][^"']*["']\s*\)\s*;\s*\}\s*\}\s*\?>(?<X1037093>))
<\?(?:[ph\s]+(?:set_time_limit\(\d+\);ignore_user_abort\(1\);(\$\w{1,40})[=\s]+['"](?:(?:\w+(?:\.|['"]))+(?:['"])?;(?:[^\;]+;){3}(\$\w{1,40})[^\@]{1,1800}\1[^\@]{1,1600}\2[^>]+goto\s*\w+;\w+:\}\?>(?<X1217770>)|(?:\w+(?:\.|['"]))+['"]*[^\@]{1,410}\$\w{1,40}[=\s]+str_rot13\(urldecode\(\1\)+;function[\s\w]+[^@]{1,610}\bif\(\!strstr\((\$\w{1,40})[^@]{1,1000}\4\);exit[^#]{99,650}(\$\w{1,40})[=\s]+file_get_contents\(\$\w{1,40}\);\}return\5;\}\?>(?<X1217581>))|try[\s\{]+(\$\w+)[\s=]+(?:array\s*\(|\[)[^;]{49,499};(?:\s*\$\w+[\s=]+\7\[[^;]{1,199};){12}[^%]{999,3999}\bstream_context_create\((\$\w+)\);\s*(\$\w+)[\s=]+@?file_get_contents\([^;]{0,99}\8\b[^;]{1,49};[^\}]{1,99}\becho\b[^;]{0,99}\9[\)\s]+;[\s\}]+catch\s*\([^\{;=]{1,99}\{[\}\s]+(?:\?>|\Z)(?<X1193700>))|\s*(?:\$(?:_="";\$_\[\+""\]='';\$_="\$_.*\$_}\['__'\]\);\?>(?<X1034411>)|adddate=date\("D M d, Y g:i a"\);\s*\$ip\s*=\s*getenv\("REMOTE_ADDR"\);\s*\$country\s*=\s*visitor_country\(\);(?<X2050920>)|GLOBALS\[(?:'_\d+_'\]=Array(?:.{400,1000}?\(\d+\)\)\s*eval\s*\(\s*base64_decode\s*\(\s*\$_POST\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*\?>(?<X1040080>)|\(base64_decode\((?:\s*'[\w=]+'\s*\.?)+\)\);\s*\?><\?\s*function\s*(_\d+)\((\$\w+)\)\{(\$\w+)=Array\((?:\s*'[\w=]+'\s*\.?,?)+\);return\s*base64_decode\(\16\[\15\]\);}\s*\?><\?php\s*\$password=\14\(\d+\);\$GLOBALS\['_\d+_'\]\[\d+\]\(\14\(\d\),\14\(\d\),\14\(\d\)\);\s*\?>(?<X1035841>))|['"]_\d{1,9}_['"]\]\s*=\s*Array\(base64_decode\(['"]\w{1,9}['"][^\{]{6000,7000}function\s*(_\d{1,15}\()[^/]{5000,15000}\$_SERVER\[\18[^/]{0,9}/title>[^\*]{500,25000}else\{\s*echo\s*\18[^;]{1,50};\s*(?:exit|die)[^;]{0,9};\}\s*(?:\Z|\?>)(?<X2132120>))|ip = getenv\("REMOTE_ADDR"\);.+?\$headers \.= \$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['eMailAdd'\]\."\\n";.+?header\("Location:.+?\?>(?<X1034881>)|lin=\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["link"\];\s*switch \(\$lin\) {(?<X2044611>)|random=rand\(0,100000000000\);\s*\$md5=md5\("\$random"\);\s*\$base=base64_encode\(\$md5\);\s*\$dst=md5\("\$base"\);(?<X2047060>))|eval(?:\((?:base64_decode\('.{76}'\.\s*'.{76}'\.(?<X1040040>)|gzuncompress\(base64_decode\('.{22000,25000}'\)\)\);(?<X2045211>))|\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>(?:\s*<\?\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>){2,}(?<X1037953>))|if\((?:!isBot\(\)\)\{\s*if\(isset\(\$_SERVER\['HTTP_REFERER'\]\)\s*AND\s*!isset\(\$_COOKIE\["\w+"\]\)\)\s*\{setcookie\(".{300,7000}\$botname\s*=\s*\$bot;\s*return\s*true;\s*\}\s*return false;\s*\}\s*\?>(?<X1040280>)|\$\w{1,40}\s*!=\s*""\)\s*print\s*Shell_Exec\(\$\w{1,40}\);\s*\?>(?<X1040400>))|include\s*\([^\)]+/bitrix/images/iblock/ib\.php['"]\s*\)\s*;\s*\?>(?<X1038501>)|php\s*(?:\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*function\s*\w+\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*global\s+\$\w.+@\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*\(\s*\$\w{1,40}\s*,\s*FALSE\s*,\s*\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*\)\s*;\s*return\s*\$\s*\{\s*\w+\s*\(\s*"[^"]*"\s*\)\s*\}\s*;\s*\}(?<X1037110>)|\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\.\s*@\$\w{1,40}\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\?>(?<X1036811>)|if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"login"\s*\]\s*=="[^"]*"\s*\)\s*\{\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;.+?<\s*form\s*enctype\s*="[^"]*"\s*method\s*="[^"]*"\s*>\s*<\s*input\s*name\s*="[^"]*"\s*type\s*="[^"]*"/\s*>\s*<\s*input\s*type\s*="[^"]*"\s*value\s*="[^"]*"/\s*>\s*<\s*/form\s*>(?<X1037210>))|set_time_limit\(\d+\);\s*error_reporting\(0\);\s*\$\w+\s+=\s*'[^']+';\s*eval\(gzinflate\(str_rot13\(base64_decode\(\$rhs\)\)\)\)\;\s*\?>(?<X1034481>))|\s+@?eval\(base64_decode\(\\['"][^'"]{400,500}(?:bWFpbC|YWlsKA|aWwo)[^'"]{9,49}(?:aGVsb|U2hlbGw|ZWxs)[^'"]{9,49}\\['"][\s\)]+;\s*(?:\?>|\Z)(?<X1118661>)|error_reporting\(0\);(?:\$\w+=(?:urldecode\()?\$_COOKIE\[["']\w+["']\]\)?;\s*){10,}(?<X2045373>)|php (?:\$a = str_replace\(x,"","\w+"\);\$a\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["\w+"\]\); \?>(?<X1034721>)|eval\("[^"]+"\.\$_REQUEST\['.'\]\."[^"]+"\);\?>(?<X1034141>)))
<\?php(?:(?:[^\(\$\?]{1,49})error_reporting\((?:0|NULL)[^;]{1,19};(?:\h*@?ini_set\([^;]+;){2,3}\h*@?eval\(\h*base64_decode\(['"](?:ZXJyb3JfcmVwb3J0aW5n|cnJvcl9yZXBvcnRpbmco)[^'"\s]{999,2999}['"][\h\)]+;(?:\h*@?ini_restore\([^;]+;){2}(?:[^\(\$\?]{1,49})\?>(?<X1134210>)|(?:\h*/\*[^\v\*]{3,16}\*/\h*(?:[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)|stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev|\(|['"][\w\+=/]{9,9999}['"]|\.)){5}\h*/\*[^\v\*]{3,16}\*/\h*[^\$]{99,1999}\h*/\*[^\v\*]{3,16}\*/\h*;\h*/\*[^\v\*]{3,16}\*/\h*\?>(?<X1140132>)|(?:\s*(?:error_reporting|set_time_limit)\h*\(0\);){2}[^\$]{0,40}\$e?xpl[o0][i1]t(?:sec)?\-?id\h*=\h*['"](?<X2173967>)|(?:\s*(?:error_reporting|set_time_limit|ignore_user_abort)\s*\(\s*\w{0,40}?\s*\)\s*;){3}(?:\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,210}?['"]\s*;){2}\s*do\s*\{.{100,300}@?copy\s*\(\s*\$\w{1,40}\s*,\s*\4\s*\)\s*\;\s*chmod\s*\(\s*\$\w{1,40}\s*,\s*\d+\s*\)\s*;\s*\}\s*sleep\s*\(\s*\d+\s*\)\s*;\s*\}\s*while\s*\(\s*true\s*\)\s*;\s*\?>(?<X1041771>)|(?:\s*(\$\w{1,40})\h*=\h*['"][asert]{1,5}['"];){2,}\s*(\$\w{1,40})\h*=\h*array\h*\([^;]{0,99}\6[^;]{0,99}\)[\s;]+(\$\w{1,40})[\s=]+array_\w{1,9}\h*\([^;]{0,99}\7[^;]{0,99}\)[\s;]+(\$\w{1,40})\h*=[^\$]{0,9}\8[^;]*;\s*@?\9[\s\(]+(?:base64_decode[\(\s]+)?@?\$_[GPRSC]\w{2,6}\s*\[[^;]{0,40};\s*(?:\?>|\Z)(?<X1185730>)|(?:\s*@?[si][eg](?:t_time_limit|nore_user_abort)\(\d+\);)+\s*\$\w{1,40}[\h=]+['"]map[^;]+;[^\{\}\?>]{0,999}\bif[\s\(]+is_https[\s\(\)]+\{\s*\$\w{1,40}[\h=]+['"]https?['"];[^\.\?>]{9,999}(\$\w{1,40})['"=\h\.base64_dnco]{20,40};\s*\$\w{1,40}[\h=]+\11\(\$\w{1,40}\);[^#]{99,50000}\breturn\h*\$\w{1,40};[\s\}]+\?>(?<X1187961>)|(?:\s*\$\w{1,40}\s*\=\s*\$_REQUEST\[['"][^'"]{1,40}['"]\]\;){15,30}\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);(?<X2052081>)|(?:\s*\$\w{1,9}\h*=\h*chr\(\d+\)\h*\.[^;]+;){2,}\s*\$\w{1,9}\h*=\h*(?:\$\w{1,9}\(){2}chr\(\d+\)\h*\.[^;]{99,999};\s*(\$\w{1,40})\h*=(?:\h*chr\(\d+\)(?:\h*\.)?)+;\s*@?file_put_contents\(\14[\h,]+chr\(\d+\)\h*\.[^;]+;\s*@?include(?:_once)?\(\$\w{1,40}\);\s*@?unlink\(\14\);\s*(?:\?>|\Z)(?<X1183650>)|(?:\s*\$\w{3,9}\h*=\h*['"][^\v\?"']{33,99}['"];)+[^\(]{0,99}function\h+(\w{1,40})\([^=]{5,99}(?:(\$\w{3,9})\h*=\h*(?:\16\()+(?:\$\w{3,9}(?:[\[\{]\d+[\]\}])?|['"]{2})[,\.][^;]+\);\s*){6,}(\$\w{3,9})\h*=\h*(?:\16[\h\(]+)+[^;]+\17\)+;[^\?]{999,9999}\18\(\$\w{3,9}\h*,\h*array\([^\)]+\)+;[^\v\?]{0,9}(?:\?>|\Z)(?<X1154361>)|(?:\s*goto\h+\w{3,9};\h*\w{3,9}:\h+(?:header\h*\(['"]\\[^\)]+\);|if\h*\(!\(strpos\(\$key,[^;]+;\h*\})){2}[^\?\v]{299,999}goto\h+\w{3,9};\h*\w{3,9}:\h+\$\w{1,40}\h*=\h*file_get_contents\h*\(base64_decode\h*\(['"]\\[^;]+\.\h*\$ua\h*\)\h*;\h*goto\h+\w{3,9};(?:\h*\w{3,9}:)+\s*\?>(?<X1153570>)|.{100,2000};include\s*\$\w{1,40}\(\$\{\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\}\)\[\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\.\$\w{1,40}\[\d+\]\];\}\s*\?>(?<X1040030>)|.{7100,9000}if\s*\(\$\w{1,10}\s*->\s*is_robots\(\)\)\s*\{\s*\$\w{1,10}\s*\[\s*'cache_code'\s*\]\s*=\s*\$\w{1,10}\s*->\s*code\s*;\s*\}\s*\}\s*\}\s*\}\s*\?>(?<X1039300>)|[ ]+/\*[ ]*vers[^:]{1,4}[ ]*:[ ]*\d+\.\d+\*/[ ]*(?:\$\w{1,40}[ ]*=[ ]*\w{1,40};[ ]*)?if[ ]*\(!(?:defined|function_exists)[ ]*\(['"][^'"]+['"]\)[^\{]{1,40}\{[^\n<]{999,9999}\);\}{1,4};?[ ]*\?>(?<X1132131>)|[ ]{200,}(?:\s*(?:\$\w{1,40})\s*\=\s*(?:['"\s\.base64_dco]{13,99}|['"\s\.gzuncompres]{12,99})\s*;){2}@?eval(/[^/]{0,40}/)\(\24\$\w{1,40}\24\(\24\$\w{1,40}\(['"][^'"]+['"](?:\s*\)\s*){1,6};?\s*(?:\?>|\Z)(?<X1058700>)|[ ]{99,}(?:/\*)[^\*\n]+\*/\s*(\$[1li]{1,40})\s*=\s*[^;]+;(\$GLOBALS\[[^\]]+\])\s*=\s*['"][^'"]+['"];\26\s*=\s*pack\([^,]+,\s*substr\(\27[^;]+;\s*if\s*\(!(function)_exists\(['"](\w+)['"]\)\)\s*\{\s*\28\s+\29\([^\}]{9,499}\}+;\s*eval\(\s*\26\s*\(\s*['"][^'"]{1999,4999}['"]\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1131951>)|[\h]{99,}if\h*\(\h*\(\h*!(?:\h*@file_exists\h*\(\h*['"][^'"]{4,499}['"]\h*\)\h*\S{2,3}\h*@md5_file\h*\(\h*['"][^'"]{4,499}['"]\h*\)\h*\S{2,3}\h*['"][^'"]{4,499}['"]\h*\)\h*(?:\S{2,3})?)+\{[^\?\v]{1,9999}@chmod\h*\(\h*['"][^'"]{1,499}['"]\h*,\h*0?444\h*\)\h*;\h*\}\s*(?:\?>|\Z)(?<X1169410>)|[\s\w\(\)\{\}\$\'\"\=\/\*\+\;]{1,200}\$(\w{1,14})\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*=\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*[\'\"]\32[\'\"]\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\^\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*[\'\"][^\'\"]*[\'\"];(?<X2273170>)|[^/]{9,300}/\*\s*Bloodninja:\s*I\s+lick\s+your\s+earlobe,?\s*and\s+undo\s+your\s+watch\.\s*\*/[^#]{99,1999}?Bloodninja:\s*Smack,\s*Smack,\s*yeeeaahhh\s*\.\s*\*/\s*(?:\?>|\Z)(?<X1127781>)|[^\$\(]{1,99}\bif\s*\(\s*isset\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\][\)\s]+\{[^\}]{9,199}\$(subj?(?:ect)?)\h*=\h*['"][^'"]{1,99}\bApple\s*ID\b[^'"]{0,99}\biCloud\b[^\}]{9,999}\bif\s*\(\s*mail\([^\)]+\$\35[^\)]+\)\s*\)\s*\{\s*echo\b[^;]{1,99};\s*\}\s*else\s*\{\s*echo\b[^;]{1,99};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1152790>)|[^\$]{1,199}(?:(\$\w{1,40}\[)[^\]]+\]\h*\.?=['"](?:\\[x1]6[382]|[chr])['"];){3}(?:\37[^\]]+\]\.?=\37[^;]+;){9}[^\v@]{99,999}@?eval\(\37[^\]]+\]\(\37[^\]]+\]\(['"][^'"]{9999,49999}['"]\)+;\s*(?:\?>|\Z)(?<X1137980>)|[^\$]{1,40}(\$\w{1,40})=wp_remote_get\(['"]https?://[^\?\{]{9,99}\{(?:file_put_contents\(['"]([^'"]+)['"],\39\[['"]body['"]\]\);if\(file_exists\(['"]\40['"]\)\)\{echo[^;]{1,49};unlink\(__FILE__\);(?:exit|die)[^;]{0,19};\}+){2,5}(?:else\{(?:echo[^;]{0,19};)?(?:exit|die)[^;]{0,19};\})?\s*(?:\?>|\Z)(?<X2144341>)|[^\$]{1,40}@?(?:(?:set_time_limit|error_reporting)\([^\)]+\);\s*){1,2}[^\$]{9,99}\$\w{1,20}\s*=\s*['"]\w{1,20}\.xml['"];[^\(]{9,20}(\$\w{1,20})\s*=\s*\w{1,20}\(\);[^\}]{9,50}\}\s*\$\w{1,20}\s*=\s*base64_encode\(\42\);[^%]{99,500}urldecode\([^\(]{99,600}eval\(\$[0o]{1,20}\(['"][^'"]{999,40000}['"]\)\);\s*\?>(?<X1128011>)|[^\$]{1,499}\$[a-z]{4,15}\s*=\s*['"][^\v]{5000,11000}['"];\s*\$\w{1,40}\h*=\h*explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=(?:\s*substr[\(\s]+\$\w{1,40})?[,\(\s]+\d+\h*\-\h*\d+[\)\d\(,\h\-]*;[^\?]{0,499}\$[a-z]{4,15}\h*=\h*\44\h*\-\h*1;[^\$\?\{\}]{0,499}\?>(?<X1056629>)|[^\$]{1,50}(\$_[GPSCR]\w{2,6}\s*\[)\s*['"]?([^'"]+)['"]?\s*\][^'"]{1,50}(wp_\w+_dl)\([^\)]+md5\s*\(\s*\46['"]?\47['"]?[^;]{30,99}\;[^\?]{99,300}function\s*\48\((\$\w+)\)\s*\{[^\?]{1,500}(\$\w{1,40})\s*=\s*file_get_contents\s*\(\s*\49\s*\);\s*\}\s*return\s*\50;\s*\}\s*(?:\?>|\Z)(?<X1127121>)|[^\$]{1,99}\$\w{1,40}\s*=\s*\$_[GPCSR]\w{2,6};\s*(\$\w{1,40})\s*=\s*str_replace\([^;]+;\s*(?:(\$\w{1,40})\s*=\s*\52\([^;]+;\s*){1,3}[^\$]{1,99}\$\w{1,40}\s*=\s*[^;]+;\s*(\$\w{1,40})\s*=\s*\53\(["']{2},[^;]+;\s*\54\(\);[^\$]{1,99}(\$\w{1,40})\s*=\s*\53\(["']{2},[^;]+;\s*@?\55\(\);\s*(?:\?>|\Z)(?<X1133763>)|[^\(\)]{0,99}\$xNamashell\h*=(?<X2167040>)|[^\(]{0,99}(\$\w{1,15})\h*=\h*['"]https?://[^/]+/wp\-config\.php['"];\s*@?(?:error_reporting|set_time_limit)\([^\{]{0,499}(\$request)\h*=\h*['"]POST\h*\{\58\[[^\]]+\]\}\h*\?\h*bot_ip\h*=[^\;]+;\s*\59\h*\.=\h*['"]Host:\h*\{\58\[[^;]+;(?<X2185470>)|[^\(]{1,60}@?eval\s*\(\s*base64_decode\s*\(['"][^'"]{99,500}(?:aXRsZT5OZXJkU3F1YWQgSGFDa2Vy|PHRpdGxlPk5lcmRTcXVhZCBIYUNrZXJz|dGl0bGU+TmVyZFNxdWFkIEhhQ2tlcnM8)[^'"]{4000,20000}['"]\)\)\s*\?>(?<X1118761>)|[^\?\$]{1,99}(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];\s*){2}if\s*\(\$\w{1,40}[^\}]{1,40}\}\s*else\s*\{\s*\$\w{1,40}\h*=\h*getcwd\(\);\s*\}[^\$]{1,999}if\h*\(\62\)\s*\{[^\}]{1,999}\}\s*else\s*\{\s*@?[sape](?:ystem|assthru|hell_exec|xec|val|ssert)\h*\(\h*\62\b[^;]+;(?:\s*\}){2}\s*\?>(?<X2140641>)|[^\{\}]{99,200}\$\w{1,20}=['"]\.Exorcised['"];\s*\$blacklist=(?<X2198511>)|[^\{]{0,30}if\s*\(\s*!?isset\s*\((\$eva1fYlbakBcVSir)\s*\)\s*\)\s*\{\s*\65\s*=\s*['"][^'"]{999,9000}['"];\s*(\$eva[l1]\w{2,9}S[i1j]r)\s*=[^\?]{200,1500}=\s*\66\.\66;\s*\$eva[l1]\w{2,9}S[i1j]r\s*=\s*\66;\s*\}\s*(?:\?>|\Z)(?<X1134250>)|[^\{]{1,70}if\([^\)]+\)\s*\{\s*(?:\$\w{1,20}\s*=\s*@?(?:(get)_current_user|\68cwd)\(\);\s*){2}preg_match_all\([^\{]{9,150}(\$\w{1,20})\s*=\s*fopen\(['"][^\.]+/\.contactemail['"],['"]w['"]\);\s*fwrite\(\69\s*,[^\)]+\);[^\}]{1,120}(?:unlink\([^\)]+\);\s*){2}\}\s*(?:\?>|\Z)(?<X1134890>))
<\?php(?:\s*(\$GLOBALS\[)[^\]]+\]=['"]\w{99,999}['"];[ ]*if[ ]*\([ ]*!function_exists[ ]*\(['"](\w{1,40})['"]\)[ ]*\)[ ]*\{[ ]*function[ ]*\w{1,40}[ ]*\([ ]*\$\w{1,40},[ ]*\$\w{1,40}[ ]*\)[ ]*\{[ ]*\$\w{1,40}=\1[^\]]+\];[ ]*\$\w{1,40}=pack[ ]*\([^\}]+\};\s*@?eval\s*\(\2\s*\([^;]+;\};\s*(?:\?>|\Z)(?<X1128320>)|\s*(\$wp[_\-][\w\-]{2,40})\h*=\h*['"](<img\h+src=['"]data:image/\w{3};)[^'"]{4,9999}['"]>['"];\s*preg_match\h*\(['"](.)\5\(\.\*\)['"]>\6['"],\h*\4,\h*(\$\w{1,40})\)[^\[]{1,40}\7\[\d+\];[^\}@]{99,399}(\$\w{1,40})\h*=\h*strrev\(['"]etalfnizg['"]\);\s*return\h+@\8\(\$\w{1,40}\);\s*\}\s*(?:\?>|\Z)(?<X1140220>)|\s*(echo)\h*['"]Raiz0WorM\h*(exploit)er[^\{]{9,199}if\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\{\s*if\s*\(\s*@?array\s*\(\s*\$_FILES\[[^\{]{9,99}\{\s*\10\h*['"]\11ing\h*done[^\?\(\$]{9,70}\?>(?<X1149701>)|\s*(function)\h*(\w{1,15}\(\))\{\s*if\(getenv\(['"]HTTP[^\?]{9,350}\}\s*(\$\w{1,15})\h*=\h*base64_decode\([^\)]+\)\h*\.\h*\14\h*\.\h*['"]\-['"][^\?]{9,399}\b\13_exists\(['"](file_get_contents)['"][\)\h]+\{\s*@?\$\w{1,15}\h*=\h*\16\(\15\);\s*\}\s*\?>(?<X1187930>)|\s*(function)\s+(\w{1,40})(?:[^\}]{1,99}(\$\w{1,40})=['"]https?://api\.telegram\.org/[^;]{1,99};(\$\w{1,40})=\20[^;]{1,99};file_get_contents\(\21\);[^@\?]{1,99}\bif\((\w{1,40})\((\$_[GPCSR]\w{2,6}\[[^\]]+\])\)+\{\19\(\23[^@\?]{99,499}\b\18\s+\22\((?<X2152240>)|\((\$\w{1,40})\)\{\s*\25\h*=\h*substr\(\25,[^\?]{9,499}\$(\w{1,40})\h*=\h*['"]base64_decode['"];\s*\18\s+(\w{1,40})\((\$\w{1,40})\)\{[^\}]{9,499}\breturn\s+strrev\(gzinflate\(\$\26\(\19\(\28\)+;\s*\}\s*@?(?:eval\(){9,49}\27\([^\)]{999,4999}\)+;\s*(?:\?>|\Z)(?<X1156940>))|\s*(function)\s+(?:(_check_isactive_widget)\(\)\{[^\@]{999,1999}\}\s*@?eval\(@?file_get_contents\(['"]https?://[^'"]{9,99}['"]\)\);[^/]{999,1999}(add_action\()[^,]{4,49},\s*['"]\31['"]\);\s*\30\s*(_getsprepare_widget)\(\)\{[^|]+\32[^,]{4,49},\s*['"]\33['"]\);\s*[^\?]{999,1499}\}\s*\?>\s*\Z(?<X1131030>)|(_verify(?:_is)?activate_(widget)s)\(\)\{[^\*#\|\^%]+\}\s*\30\s*_get_all\36s_?cont\(\$\w+,\$\w+=array\(\)+\{[^\?#:\*\\]+\}\s*(add_action\(['"])admin_head['"],\s*['"]\35['"]\);\s*\30\s*(_(?:get)?prepare_)\36s?\(\)\{[^\*\|]+\}\s*\37init['"],\s*['"]\38\36s?['"]\);\s*[^\?\|:]+?\?>(?<X1036304>))|\s*(goto)[^\{]{1,50}\b[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*base64_decode\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\h]+;[^!]{1,50}\bif\h*\(\h*!?isset\h*\(\h*\41[\)\s]+\{\s*\40[^\?]{1,99}\s*\?>(?<X1170211>)|\s*(goto)\h*\w{1,9};\h*\w{1,9}:[^\{\(\)]{0,70}\bfunction\h*\w{1,15}\([^\n]{99,600}:\h*\$\w{1,9}\h*=\h*['"]Base64_decode['"];\s*\43\h*\w{2,9};[^\n]{1,499}\b(?:eval\(){6}\w{1,9}\(['"][^'"]{1500,}['"][\)\h]+;(?<X1175411>)|\s*(goto)\h+(?:[a-z\d]{4,9};\h+[a-z\d]{4,9}:\h+@?eval[\h\(]+(?:['"][\\xa-f\d]{6,8}['"]\h*\.\h*)?(\$\w{1,40})[\h\)]+;[^=\$]{1,99}\46[\h=]+(curl_)exec[\h\(]+(\$\w{1,40})[\h\)]+;[^\{\}\?\>\<\[]{1,199}:\h+\48[\h=]+\47init[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;\h*\45\h+[a-z\d]{4,9};\h+[a-z\d]{4,9}:\s*(?:\?>|\Z)(?<X1175760>)|\w{3,9};\h+\w{3,9}:[^=\\]{1,99}(\$\w{1,40})\h*=\h*['"]\\(?:1(?:50|10)|x(?:68|48))\\[^'"]{19,40}['"](?:\h*\.\h*(\$_SERVER\[)[^\]]+\])+\h*;\h*\45\b[^\?>\v]{1,999}\50\h*\.\h*['"]\\[^'"]{1,99}['"]\h*\.\h*\51[^;]+\$\w{1,40}\h*\)\h*;[^\?>\v]{1,999};(?:\h*\})?\h*\45\h+\w{3,9};(?:\h+\w{3,9}:)+\s*\?>(?<X1168380>))|\s*(goto\h+)\w+;\h*\w+:\h*if\h*\(\h*[!\(\h]*strpos\h*\(\h*(\$\w{1,40})\b[^\?>]{99,499}\54\h*=\h*strtolower\h*\(\h*\$_SERVER\[[^\?>]{199,999}echo\s*(\$\w{1,40});[^\?>]{1,299}\55\h*=\h*file_get_contents\h*\(\h*base64_decode\h*\([^\?>]{199,999}\53\w+;(?:\h*\w+:){1,2}\s*\?>(?<X1134411>)|\s*(header)\h*\(['"]Content\-Type:text/html;\h*charset=utf\-8['"]\);\s*error_reporting\h*\(0\);\s*\$[o0_]+\h*=\h*['"][^\{]{1,499}\{\s*(\$\w{1,20})\h*=\h*curl_init\h*\(\);\s*curl_setopt\h*\(\58,[^#]{99,7099}\57\h*\([^\;]{0,49}404\h*not\h*found['"]\);[\}\s]+\?>(?<X1187800>)|\s*(if\h*\(\h*isset\h*\(\h*)\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+\{\s*echo\b[^\}]{1,199}\becho\h+get_current_user\h*\(\h*\);[^\}]{1,499}\b\60(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\h*=\h*\61;\s*@?(?:eval|assert)\h*\(\h*\62\h*\);\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1179110>)|\s*//(?:=+//\s*//=+\+\+\+Dhanush\+\+\+=+//\s*//=+//\s*//=+\+\+\+Coded\s*By\s*Arjun\+\+\+===//\s*//=+//\s*//=+\+\+\+An\s*Indian\s*Hacker\+\+\+=====//\s*//=+//\s*//====\s*Ashvin-2069/Oct-2012\s*====//\s*//\s*Set\s*Username\s*&\s*Password\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*//\s*Malware\s*Site\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*//\s*"[^"]*"\s*Base64\s*encoded\s*"[^"]*"\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*"[^"]*"\s*\.\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*\?>(?<X2046470>)|[^)]+\);\s*(?:\$[O0_]+=(?:'[^']+'|\d+);\s*){2,10}[^\v]+"]\(\);\?>(?<X1038311>)|\s*\w{1,40}\s*shell\b[^&\*\+\\]{99,2999}\$(\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\([^;]{1,99};\s*fwrite\h*\(\h*\67\h*,\h*\$\66\h*\);\s*fclose\h*\(\h*\67\h*\);\s*(?:header\h*\([^;]{1,199};\s*(?:\}\s*)?)?(?:\?>\s*)?\Z(?<X1175221>)|header\(.{30000,40000}@\$\{"[^"]*"\}\["[^"]*"\]\(\$\w{1,40},\$\w{1,40}\);\}\s*\}@\$\{"[^"]*"\}\["[^"]*"\]\(\$\w{1,40},0444\);\}\}'\);\$\{"[^"]*"\}\["[^"]*"\]\(\);\s*\?>(?<X1041210>))|\s*/\*(?:[ ]*\w+[ ]*\*/\s*if\s*\(\s*function_exists\s*\(['"]ob_start['"]\)\s*\D{2,3}\s*!isset\s*\((\$GLOBALS\[[^\]]+\])\)\)\s*\{\s*\70\s*=\s*['"][^'"]+/\w{1,40}\.php['"];\s*if\s*\(\s*file_exists\s*\(\s*\70\s*\)\s*\)\s*\{\s*include(?:_once)?\s*\(\70\);[^\}]+ob_start\s*\([^\)]+\);(?:\s*\}){2,3}\s*\?>(?<X1124600>)|[^*]+\*/\s*\$\w+\s*=['"][^'"]+['"];\s*\$\w+\s*=\s*str_rot13\s*\(\s*gzinflate\s*\(\s*str_rot13\s*\(\s*base64_decode\s*\(\s*\$\w+\s*\)\s*\)\s*\)\s*\)\s*;\s*eval\s*\(\s*\$\w+\s*\)\s*;\s*\?>(?<X1037880>)|[^*]{1,100}\*/\s*\$GLOBALS.{3000,5000}function\s+\w{1,40}\(\$a\s*,\s*\$b\){\s*\$c=\$GLOBALS\['\w{1,40}'\];\$d=pack\('H\*',[^)]+\);\s*return \$d\(substr\(\$c, \$a, \$b\)\);};eval\(\w{1,40}\(\d+,\d+\)\);};\?>(?<X1040160>)|[^\(]{0,40}if\(!(function)_exists\(['"](_\d{3,15})['"]\)\h*and\h*!defined[^\{]{1,40}\{\74\h*\75\(\$\w{1,15}\)\{\$\w{1,15}=Array\((?:['"][\w=]{0,40}['"],){5}[^\n]{99,4000}\$_SERVER\[\75\(\d[^\n]{9,999}\$\w{1,50}\h*\.\h*\75\(\d{1,3}[\);\}]+\h*\?>(?<X1151461>)|[^\*/]{299,999}(?:Fu|ha)Cked\s*by[^\*]{1,999}\s*https?://(?:www\.)?facebook\.com/[^/]{0,119}/L34K\.C0de/?\s*\*/(?<X2280150>)|\*[^/]+/\s*if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]/tmp/[^'"]+['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1201130>)|\s*\w+\s*\*/\s*header\s*\(\s*"Location:\s*http[^"]*"\s*\)\s*;\s*/\*\s*\w+\s*\*/\s*exit\s*;\s*\?>(?<X1037450>)|\s*\w{1,40}\s*\*/\s*\?>\s*<\?php\s*error_reporting\(E_ALL\);\$DOMAIN.{2500,4500}enc\(\$str\);fwrite\(\$file,\$str\);fclose\(\$file\);\}\?>\s*<\?php\s*/\*\s*\w{1,40}\s*\*/\s*\?>(?<X1040880>)|\s*AthenaHTTP\s*\*/(?<X2052500>)|\s*b374k\s*shell\b[^\$;\*]{1,99}\*/\$GLOBALS\[['"]pass['"]\]=(?<X2161750>)|\s*WSO\s*\[\s*2\s*\.\s*\d+\s*\](?<X2046060>))|\s*@?(?:eval|assert|system|popen|exec|shell_exec|passthru)\s*\(\s*["'](?:wget|curl|lwp-download|lynx|fetch|GET)\s*\-O\s*\S{1,40}\.php\s*https?://[^'"]{1,49}['"]\s*\)\s*;\s*(?:\Z|\?>)(?<X1125163>)|\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*(?:['"]wget\s*https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\s\-O\s*\w{1,40}\.php\s*['"]\s*\)\s*(?:\?>|\Z)(?<X1127261>)|base64_decode\s*\(\s*['"]d2dldCBodHRwczovL3Bhc3RlYmluLmNvbS9yYXcv[^'"]+['"][\s\)]+;\s*(?:\?>|\Z)(?<X1127271>))|\s*@?(?:include|include_once|require|require_once)\s*\(?\s*['"]https?://[^`]{1,200}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip)['"]\s*\)?\s*;\s*\?>(?<X1042210>)|\s*@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(['"](?:[^\?]{0,25}wget\h*https?://raw\.githubusercontent[^'"]{0,50}marijuana\.php['"]\);\s*\?>(?<X1146351>)|cat\h*/etc/passwd['"]\);\s*\?>(?<X1146331>))|\s*@?copy\(@?(\$_FILES\[[^\]]+\])\[[^\]]+\],\s*@?\90\[[^\]]+\]\);\s*\?>(?<X1129771>))
<\?php(?:\h*(\$[\w\-]{1,40})=base64_decode\(['"][^'"]{999,3999}["']\);\h*eval\(["']return\h*eval\(\\["']\1\\['"]\);['"]\);?\h*\?>(?<X1036091>)|\h*class\h*[^\{]{0,25}\{\h*private[^/]{99,299}/\*(Bloodninja)\b[^\n]{999,3000}curl_close\(\$_[^/]{9,50}/\*\3:[^/]{9,50}/\?>(?<X1146991>)|\h*function\h*\w{1,14}\((\$\w{1,14})\)\h*\{\h*while\h*\(\5\h*!==\h*['"]\/['"]\)[\w\W]{1,500}base64_decode\(substr[\w\W]{1,300}wp-load\.php[\w\W]{1,2000}file_get_contents\(['"]https?:\/\/\w{1,14}\.mystiqueapi\.com\/\?\w{1,14}\=['"]\.\$_SERVER\[['"]HTTP_HOST['"]\]\)\;\h*\?>(?<X1263901>)|\h*header\(['"]Content\-Type:text/html;\h*charset=utf\-8['"]\);\s*error_reporting\(0\);\s*\$[o0_]+\h*=\h*['"][^\*/#`>]{999,10999}\bif\h*\(\h*preg_match\h*\([^\.]{0,99}\$[o0][^\*\v]{999,}@(?:header|chmod|file_put_contents)\h*\([^;]+;(?:\s*\})+(?:\s*[o0]+\(\);)?\s*(?:\?>|\Z)(?<X1184521>)|\h*if(?:[\(\h]+isset[\(\h]+(\$_[GPRC]\w{2,6}\[[^\]]+\])[\h\)]+\{\s*function\h*(\w{1,40})\(\)\s*\{\s*global\h*\$wpdb;\s*(\$\w{1,40})[\h=]+array\(\);\s*(\$\w{1,40})\h*=\h*json_d[^;]*\8[^;]+;\s*foreach\(\11[^<]{199,999}<div\b[^>:]+style[\h=]+['"]display:none;['"][^;]+\10[^;]+;[^\}]{0,99}\}\s*\9\(\);\s*\}\s*\?>(?<X1179590>)|\h*\(\h*(?:md|sha)[5126]{1,3}\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;\{]{1,99}\{[^@\v\}]+if\h*\(\h*\s*@[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\]]+\]\[[^\]]+\],[^\}]+(?:\}\s*else\s*\{[^\}]+)?(?:\}\s*)+(?:\?>|\Z)(?<X1161410>)|\h*\(\h*@is_uploaded_file\h*\(\h*((\$_FILES\[[^\]]+\]\[)['"]tmp_name['"]\])\h*\)\h*\)\h*\{\h*(?:copy|move_uploaded_file)\h*\(\14,[^\)]+\15['"]name['"]\]\h*\)\h*;(?:\h*echo[^;\?\}]{1,99};)?\h*\}\h*\?>(?<X1137800>)|\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*function\h+get_web_page\h*\([^#]{999,1999}echo\h+implode\(\h*['"]\|['"]\h*,\h*\$\w{1,40}\h*\)\h*;\s*(?:die|exit)[^;]{0,9};\s*\}\s*\?>(?<X1157600>))|\h+(\$\w{1,20})\h*=\h*file_get_contents\h*\(['"]https?://shellerim\.[^'"]{2,20}\.txt['"]\);\s*(\$\w{1,20})\h*=\h*iconv\([^\$;]{2,20},\18\);\s*echo\h+\19;\s*(?:\?>|\Z)(?<X1158540>)|\h+(\$_+)\h*=(?:\h*\(\h*['"].{1,2}['"]\h*\^\h*['"].{1,2}['"]\h*\)\h*\.){3,}\h*\(\h*['"].{1,2}['"]\h*\^\h*['"].{1,2}['"]\h*\)\h*;\h*(\$_+)\h*=\h*\(\h*['"].{1,2}['"]\h*\^[^\?;]+;\h*@?(?:\21|\22)\((\$\{(?:\21|\22)\})\[[^\]]+\][\h\)]+;\h*@?(?:eval|assert|system)\h*\(\23\[[^\]]+\][\h\)]+;\s*(?:\?>|\Z)(?<X1141480>)|\h+@?eval\(html_entity_decode\(base64_decode\(['"][a-z0-9\+/]{999,9999}=?=?['"]\)+;\s*(?:\?>|\Z)(?<X1138460>)|\h+\$\w{1,20}\h*=\h*(?:(chr\()(?:98|97|115|101|54|52)\)\.|[base64]){6}[^&%\?]{99,600}\bfile_put_contents\(\26[^;]{9,99}\);@?include\([^\)]+\);@?unlink\([^;]{9,99}\);\s*\?>\s*<(script)\h+(?:type\h*=\h*['"]text/java\27['"]\h*|src\h*=\h*['"]https?://[^\?]{4,30}/\w{1,9}\.js\?v=[\d\.]+['"]\h*){2}></\27\>(?<X1148580>)|\h+echo\h+(?:file_put_contents\(['"]\w{1,40}\.php['"],\s*)?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*(?:,\h*true\h*)?\)\)?\h*;\h*\?>(?<X1139252>)|\h+error_reporting\h*\((?:0|NULL|FALSE)\);\s*\?>[^/]{9,99}<title>[^/<]{2,15}\b(?:private|web)\h*shell\b(?<X2174330>)|\h+function(?:\h+(\w{1,40})\h*\((\$\w{1,9})\)\h*\{\h*\$\w{1,9}\h*=(?:\h*chr\h*\(\d{2,3}\)\h*\.)+\h*chr\h*\(\d{2,3}\)\h*;[^\}\v\?]+\bunlink\h*\(\32\)\h*;\h*\}[^\?\{\}><\v]{1,99}\{[^\?\v\*]{99,499}\31\h*\(['"](?:/var)?/tmp[^;]+;[\h\}]+(?:exit|die)\b[^;]{0,9};\h*\}\s*(?:\?>|\Z)(?<X1157620>)|\s+\w{1,40}\h*\(\h*(\$fu)\h*,\h*(\$ck)\h*,\h*(\$you)\h*\)\s*\{\s*return(?:[^;\$]{0,49}(?:\34|\35|\36)){3}\h*;\h*\}(?<X2144141>))|\h+goto\h+\w{5};\h+\w{5}:\h*if\h*\(\h*mb_stripos\h*\(\h*\$botbotbot\d*\h*,\h*['"]\\[^\?\v]{9,999}=\h*curl_exec\h*\(\h*\$\w{1,40}\h*\)\h*;[^\?\v]{9,999}\bgoto\h++\w{5};\h*\w{5}:\s*\?>(?<X1182920>)|\h+if\h*\(\h*(?:!?\h*[ie][sm](?:set|pty)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[\h*chr\h*\(\d+\)\h*\.[^;\{\}\?\v]{99,999}\{\h*(\$\w{1,40})\h*=\h*chr\h*\(\d+\)\h*\.[^@\}\?\v]{99,999}@\$\w{1,40}\h*\(\h*\39\h*,\h*\$\w{1,40}\h*\)[^\v\}\?]{99,999}\39\h*\)\h*;\h*(?:exit|die)\b[^;\h]{0,9};\h*\}\s*(?:\?>|\Z)(?<X1139420>)|isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)+\h*\{\h*@?[ir](?:nclud|equir)e(?:_once)?\h*\(\h*['"][^"']{1,40}\.(?:png|ico|jpe?g|gif|bmp)['"]\h*\)\h*;\h*(?:die|exit)[^;]{0,9};\h*\}\h*\?>(?<X1147771>))|\h+if\h*\(SERVICEMODE\)\h*:\h*\?>\s*<script>window\.alexusMailerServiceMode=true;\s*</script>\s*<\?php\h+echo\h+\$googleCounter;\h*\?>(?<X2141930>)|\s*#([a-f0-9]{6,9}#)\s*if\h*\(\h*!?\h*(?:empty|isset)\h*\(\h*(\$\w{1,40})[\s)]+\{\s*\44\h*=\h*['"]<(script)\b[^;:>\v]+\bhttps?://[^'"\v]{8,99}['"]>\h*</\45>\h*['"]\h*;\s*echo\h*\44\h*;\s*\}\s*#/?\43\s*(?:\?>|\Z)(?<X1160430>)|\s*#\d{1,32}#\s*if\s*\(\s*empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*"<script.{10,200}?"\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}\s*#/\d{1,32}#\s*\?>\s*(?<X1039700>)|\s*#\s*IndoXploit[^\[]{1,150}\$\w{1,9}\s*=\s*\[['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*,(?<X2130054>)|\s*#\w{1,49}#[^\$]{499,1999}if\([^\{]{9,49}\{\s*if[\(\s]+substr\([^\{]+preg_match\([^,]+,\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\)\{\}\s]+else\s*\{\s*error_reporting\([^\{]{9,199}if\(\s*!(function)_exists\(\s*['"](__url_get_contents)['"][\)\s]+\{\s*\49\s+\50\([^\?]{999,4999}(?:\?>)?\s*\Z(?<X1134431>)|\s*(//ckII)\w+\s*\$\w{1,15}\h*=\h*['"]([^'"]+)['"];\s*\$\w{1,15}\h*=\h*['"]\./\53/\.htaccess['"];\s*\$\w{1,15}\h*=\h*['"]\./\53/moban\.html['"];[^\?]{999,2500}\bfile_get_contents\((\$\w{1,15}Moban\d+)[\)\h]+;\s*@?chmod\(\54,\h*\d+\);[\}\s]+\52end\s*\?>(?<X1197240>)|\s*(/\*[^\*]{0,9}\*/)\s*(?:@?error_reporting\((?:0|NULL|false)\);\s*)?@eval\(base64_decode\(['"][^'"]{99,4999}['"]\)\s*\)(?:\s*;)?\s*\56\s*(?:\?>|\Z)(?<X1124160>)|\s*(?:(?:(shell_exec)\(['"]chmod\h*\d{3,4}\h*[\.?\w\-]{1,15}['"]\);\s*)?\58\(['"]wget\h*https?://phpshel[^'"]{5,15}/([\-\.\w]{1,15}\.txt)['"]\);\s*\58\(['"]mv\h*\59\h*[\-\.\w]{1,15}['"]\);\s*){2,}\?>(?<X1143451>)|\s*(?:(?:session_start|error_reporting)\([^;]{1,9};\s*){2}[^=]{9,99}(?:@?ini_set\([^\)]{1,29}\);\s*){4,5}\$\w{1,40}\s*=\s*['"]\w{32}['"];[^;]{0,40}\beval\((?:@?(?:(?:base64_|convert_uu|rawurl)decode|gz(?:inflate|uncompress)|str_rot13)\(){9,13}['"][^'"]{65000,}['"][\)\s]{9,13}\s*;\s*(?:\?>|\Z)(?<X1131081>)|\s*(?:(?:set_time_limit|error_reporting)\(0\);\s*){2}if\([^:]{99,180}<title>\s*0byt3m[i1]n[i1]<\/title>(?<X2129330>)|\s*(?:(\$\w{1,20})=\63\.substr\([^\)]+\);\$\w{1,20}=[lr]?trim\([^\)]+\);){2,6}(?:(\$\w{1,20})=\64\.(?:\63|substr)\([^\)]+\);\$\w{1,20}=(?:[lr]?trim|str\w{2,9})\([^\)]+\);){5,20}[^\{]{99,400}\w\(\)\{\};[^\?]{99,300}(?:[lr]?trim|str\w{2,9})\([^\)]+\);\?>(?<X1135260>)|\s*(?://header\('Content-Type:text/html; charset=utf-8'\);\s*)?(?:\$[O0_]{2,16}=(?:'[^']*'|\d+);\s*){3,}\s*\$[O0_]{2,16}=array\([^\?>\{\}\*\[\(]{300,500}\?>(?<X1041072>)|\s*(?://header\('Content-Type:text/html; charset=utf-8'\);\s*)?\$\w{1,40}='\d+';\s*\$\w{1,40}=urldecode\("%.{20000,}\}\}'\);\$\{"[^"]{3,99}"\}\["[^"]{3,99}"\]\(\);\s*\?>(?<X1040221>)|\s*(?:/\*[^\(=\{\?'"/]{99,999}\*/\s*)?(?:\$\w{1,9}\h*=\h*substr\([^\)]+\);\s*){3}(\$\w{1,9})\h*=(?:\h*\$\w{1,9}[\.;]){3}\s*(?:\$\w{1,9}\h*=\h*\68\[\d+\][^;]{1,49};\s*){3}(\$\w{1,9})\h*=(?:\h*\$\w{1,9}[\.;]){3}\s*\69\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\s*\?>(?<X1155760>)|\s*(?:@?ini_set\h*\([^;]{1,49};\s*){3}[^\$]{9,199}(\$\w{1,40})\h*=['"\hcreat_funio\.]{17,49};\s*(\$\w{1,40})\h*=['"\hasert\.]{8,49};\s*(?:(\$\w{1,40})\h*=[^;]{1,99};\s*){2,3}(?:if\(isset\(\h*(\$\{\h*\73\h*\}\[)[^\]]+\][\h\)]+\{\h*(?:\71|\72)\h*\([^\)]{0,49}\74[^;]{1,99};\}\s*){1,2}[^\$\?]{1,99}\?>(?<X1151490>)|\s*(?:\$.\s*=\s*[\wchr\(\)\d+\./\*;\s"']+)+\$.\([chr\(\)\d\.,\s*\$abc]+;\s*$(?<X1034962>)|\s*(?:\$\w+\s*=\s*stripslashes\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\);\s*){3,}\$result\s+=\s+@?mail\(stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\),\s*stripslashes\(\$\w+\)\);\s*if\(\$result\)\{echo 'thank you';\}(?<X2045002>)|\s*(?:\$\w{1,30}\s*=[^;]+;\s*){2,}error_reporting\(0\);\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(.+echo\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*exit\s*;(?<X1039420>))
<\?php(?:\s*(?:\$\w{1,40}\s*=\s*['"][^\?]{1,200}['"];\s*){2}\$\w{1,40}\s*=[^\?]{1,999}\$\w{1,40}\h*=\h*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1039202>)|\s*(?:\$\w{1,40}\s*=\s*\$_SERVER\h*\[['"][^'"]{9,11}['"]\]\h*;\h*){3}(\$\w{1,40})\h*=\h*base64_decode\h*\(\h*['"][^'"]{1,99}['"]\h*\)\h*;\s*(\$\w{1,40})\h*=[^;]{1,99}\.\h*php_uname\(\)\h*\.[^;]+;\s*@?mail\h*\(['"]?\2['"]?\s*,[^;]{1,99},['"]?\3['"]?\h*\)\h*;\s*(?:\?>|\Z)(?<X1142450>)|\s*(?:\$\w{1,9}=['"][base64_dco_gzinfltrv]['"];){19}(?:\$\w{1,9}=(?:\$\w{1,9}\.?){1,15};){3}eval\(\$\w{1,9}\(\$\w{1,9}\(\$\w{1,9}\(['"][^'"]{999,6000}['"]\){4};\s*(?:\Z|\?>)(?<X1134640>)|\s*(?:\$\w{1,9}\s*=\s*["'][_COKIERQUSTGPV]{1,4}['"];\s*){2,9}(\$\w{1,9})\s*=\s*\$\{[^\}]{5,30}\};\s*(\$\w{1,9})\s*=\s*\6\[[^;]{4,40};\s*(\$\w{1,9})\s*=\s*\6\[[^;]{4,40};\s*(\$\w{1,9})\s*=\s*\7\s*\(['"]['"],\8\s*\(\6\[[^\]]+\]\)\);\s*\9\s*\(\);\s*(?:\Z|\?>)(?<X1132724>)|\s*(?:\$\w{1,9}\s*=\s*chr\([^;]{1,20}\);\s*){4,}(\$\w{1,9})\s*=[^;]{1,20};\s*forward_static_call_array\(\11,\s*array\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*(?:\Z|\?>)(?<X1129080>)|\s*(?:\$\{['"](?:\\x47|G)[^'"]{4,24}['"]\}\[[^\]]+\]=['"][^'"]{1,40}['"];){19}[^\)]{9,1499}if\(\(isset\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^%]{40000,}\]\}\);\}\}\}echo['"](?:<|\\x3c)(?:!|\\x21)--[^'"]{2,40}['"]\.[^\.]{41,99}\.['"]--(?:\\x3e|>)['"];\}\s*(?:\?>|\Z)(?<X1118242>)|\s*(?:\$\{['"][GOBALS\\x123457cf]{9,28}['"]\}\[[^\]]+\]\s*=[^;]{1,49};){3}[^\?\v]{4999,9999}if\(strpos\((?:\$_SERVER\[|gethostbyaddr\(getenv\()['"][REMOTE_AD\\x1245df]{11,44}['"]\)\),['"]google(?:bot)?['"][^\{]{1,99}\{header\(['"][HTP4850\\x]{4,16}[^'"\v]+[0134\\x]{3,12}[^\)]+\);exit\(\);\}\s*\?>(?<X1134590>)|\s*(?:\$arrUrlId\[['"][^'"]{0,99}['"]\]=['"][^']{0,40}['"];\s*){10}(?<X1036481>)|\s*(?:echo[^;]{1,49};\s*){1,3}@?(?:copy|move_uploaded_file)\h*\(\h*['"]https?://[^'"]{1,99}['"],\h*['"][^'"]+\.php['"]\h*\);\s*(?:@?unlink[^;]{1,99};\s*){1,3}(?:\?>|\Z)(?<X1140181>)|\s*(?:echo|print_r)\((\$_COOKIE)\);\s*if\h*\(\h*\17\[[^\]]+\]\h*\D{2,3}['"]?\w{1,32}['"]?\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*\17\[[^\]]+\]\.\h*\17[^;]{0,99};\s*\18\h*=\h*base64_decode\(\18\);\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\18\);\s*\}\s*(?:\?>|\Z)(?<X1189510>)|\s*(?:eval\((?:\$\w{1,40}\(){1,3}"[^"]+"\){1,3};\s*){4,}(?<X1039570>)|\s*(?:if\(isset\(\$_[GPRSC]\w{2,6}\["\w+"]\)\)\s*\$\w+ = base64_decode\(\$_[GPRSC]\w{2,6}\["\w+"\]\);\s*else\s*\{\s*echo "indata_error";\s*exit;\s*\}\s*)+if\(mail\(\$\w+,\$\w+,\$\w+,\$\w+\)\)\s*echo "sent_ok";\s*else\s*echo "sent_error";\s*\?>(?<X1034533>)|\s*(?:if\(isset\(\$_POST\["\w+"\]\)\)\{\$\w+=base64_decode\(\$_POST\["\w+"\]\);\}\s*else\{echo\s*"indata_error";\s*exit;\}\s*)+\s*if\(system\("echo\s*'"\.\$MessageBody\."'\s*\|\s*mail\s*-s\s*'"\.\$MessageSubject\."'\s*"\.\$MailTo\.""\)\)\{\s*echo\s*"sent_ok";\s*\}\s*else\{echo\s*"sent_error";\}(?<X1035961>)|\s*(?:include\s+\(?['"][^'";]+/anti(?:bots?)?\d*\.php['"]\)?;){4,9}(\$\w{1,40})=(?:array\(|\[)[^\]\)]{9,999}[\]\)];(\$\w{1,40})=mt_rand\([^;]+;(\$\w{1,40})=\23\[\24\];\?><meta[^>]{1,99}content=['"][^'">]{1,49}\25(?<X2134121>)|\s*(?:system|passthru|shell_exec)\(\s*"\$\w{1,40}"\s*\)\s*;\s*\?>(?<X1040140>)|\s*(\$[O_0]{2,12})\h*=\h*file\(__FILE__\)\h*\;\s*(eval\h*\(\h*base64_decode\h*\()\h*['"][a-z0-9]{99,999}={0,2}['"]\)\);\s*\29([Il]{2,12})\(\28\[0\],\d+\)+;\s*eval\([O_0]{2,12}\(\30\(\28\[\d+\],\d+\)\h*,\h*\30[^;]{1,99};\h*__halt_compiler\(\);\s*[^\s\$\?]{999,}\s*\Z(?<X1159872>)|\s*(\$\w{1,10})=['"][^;]{1,50};if\(isset\(\$_[GPRSC]\w{2,6}\[[^\}]{1,500}\b[cm]o(?:py|ve_uploaded_file)\(\$_files\[[^\?]{1,500}\bfile_get_contents\(['"]php://input['"]\);[^\?]{1,99}\b(curl)_setopt\([^\),]+,\33OPT_URL,['"]https?://[^;\)]+\32\b[^\?]{1,999}=['"]Origin:\s*chrome\-extension://(?<X2170221>)|\s*(\$\w{1,14})\s*=\s*base64_decode\(['"]aHR0cDovL21[^'"]{1,50}RvcC9saWJyYXJ5LnBoc[^'"]{1,100}['"]\);\s*eval\(['"\?>\.]+file_get_contents\(\35\)\s*\);\s*\?>(?<X1280500>)|\s*(\$\w{1,15})[\h=]+(curl_)init\(\);\s*\38setopt\(\37,\s*CURLOPT_URL,\h*['"]https?://yavapaiblock\.com/[^'"]+\.txt['"]\);[^\?]{0,99}(\$\w{1,15})[\h=]+\38exec\(\37\);[^\?]{0,99}\bfwrite\((\$\w{1,15}),\h*\39\);\s*fclose\(\40\);\s*\?>(?<X1201250>)|\s*(\$\w{1,15})\h*=\h*(?:(file_)get(_contents)\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*@?\43put\44\(['"][^'"]+['"],\h*\42\);\s*echo\h*['"]<script[^\?]{9,199}\bredirect\(\);['"]>['"];\s*\}\s*\?>(?<X1195590>)|['"][^'"]{9,99}['"];\s*function\h*(\w{1,15})\([^\}]{9,199}\}\s*\$\w{1,15}\h*=\h*\46\(\42\[\d{1,3}\][^\)]{9,99}\);[^\?]{99,2500}\46\([^\)]+\)\)\s*\.\s*['"]{2}[^'"]{999,30000}['"]{2}\s*\.\s*\46\(\42\[[^\}]{9,99}array\(['",\}\s]{1,9}\.\s*\$\w{1,15}\s*\.\s*['"/]{1,9}\)\);\s*(?:\Z|\?>)(?<X1145211>)|['"]jUjbZaJAEP0Vy7KKsG7JMNzL8sF5WcR1b6LGmJctICAKCghlMeW[^'"]{99,999}['"];\s*eval\((?:str_rot13\(|gzinflate\(|base64_decode\(){4}['"]\42['"]\)+;\s*(?:\Z|\?>)(?<X1147180>)|\$_SERVER\[[^\]]+\]\h*\.\h*['"]/?wp\-load\.php['"];\s*if\h*\(\h*file_exists\h*\(\h*\42\h*\)\h*\)\s*\{\s*(?:require|include)(?:_once)?\h*\(\h*\42\h*\);\s*wp_set_auth_cookie\h*\(\h*\d\h*,\h*\d\h*\);\s*\}\s*\?>(?<X1175020>)|array\((?:['"][^'"]{20,40}['"],\h*){15}[^\)]{999,9999}\);\s*(\$\w{1,15})\h*=\h*(strrev)\([^\)]+\);\s*(\$\w{1,15})\h*=\h*\51\([^\)]+\);\s*eval\(\52\(\50\(implode\(['"]{2},\h*\42[\h\)]+;\s*\?>(?<X1190200>)|str(?:_rot13\((?:['"]uggcf://[^\)]+\.gkg['"]\);\s*(\$\w{1,15})\h*=\h*(curl_)init\(\);[^\?]{0,99}\b\55setopt\(\54,\h*CURLOPT_URL,\h*\42\);[^\?]{99,500}\becho\h*\55exec\h*\(\h*\54\h*\);\s*\?>(?<X1195281>)|[^\)]+\);\h*if\(!(\$SESSION\[[^\]]+\])\)\{if\h*\(function_exists\(['"]curl_[^\n]{99,299}\belse\{\57\h*=\h*file_get_contents\(\42\h*\.\h*\$_SERVER\[[^\n]{1,199}\becho\h*['"][^'"]+['"];\h*\}\s*\?>(?<X1195260>))|tolower\(\$_SERVER\[[^\]]+\]\);\s*if\h*\(strpos\(\h*\42\h*,\h*['"][^'"]*['"]\h*\)[^\?\{\)]{1,40}\)\s*\{\s*\?>\s*<div\h+[^\}]{9,399}jerseys\b[^\}]{0,40}</a>[^\}]{99,15000}</div>\s*<\?php\h*\}\h*\?>(?<X1147054>)))|\s*(\$\w{1,15})\s*=\s*['"][^'"]{50,200}['"];\s*\$\w{1,15}\s*=\s*['"][^'"]{999,}['"];\s*@?eval\((?:htmlspecialchars_(decode)\(|url\61\(|base64_\61\(){3}\60\)+;\s*(?:exit|die)[^;]{0,9};\s*(?:\Z|\?>)(?<X1130122>)|\s*(\$\w{1,20})\s*=\s*php_uname\(\);\s*(\$\w{1,20})\s*=\s*\(\s*strtolower\s*\(\s*substr\s*\(\63[^'"]+['"]win['"]\)[^\(]{9,30}if\(\64\)[^\?]{99,500}move_uploaded_file\(\$_FILES\[[^\?]{99,400}(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?(?:passthru|system|eval|popen|shell_exec)\(\65\);[^\?]{0,30}\?>(?<X1133910>)|\s*(\$\w{1,25})[\h=]+(?:['"\.mb_ergplac]{15,40};\s*(\$\w{1,25})[\h=]+['"\.base64_dco]{13,30};\s*\67[\h\(]+(chr)[\h\(]+\d+[\h\)]+,\h*\68[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+,\h*\d+,\h*\69[\h\(]+\d+[\h\)]+;\s*(?:\?>|\Z)(?<X1216971>)|file_get_contents\(['"]https:?//fikrirasy\.id/[^'"]+\.txt['"]\);\s*\?>\s*<\?[ph=\s]+\67;\s*\?>(?<X1200550>))|\s*(\$\w{1,25})\h*=\h*['"][^'"]{1,99}['"];\h*(\$\w{1,25})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*(\$\w{1,25})\h*=\h*base64_decode\(\73\);\h*file_put_contents\(\72,\h*['"]<\?php\s*['"]\.\74\);\h*include\(\72\);\h*unlink\(\72\);\s*(?:\Z|\?>)(?<X1138700>)|\s*(\$\w{1,25})\s*=\s*['"]https?://pastebin[^'"]{9,50}['"];\s*(\$\w{1,25})\s*=\s*['"]/tmp[^'"]{0,50}["'];\s*@?(file_)put(_contents)\(\77,\s*['"]<\?php\s*['"]\.@?\78get\79\(\76\)\);\s*include\(\77\);\s*@?unlink\(\77\);\s*(?:\Z|\?>)(?<X1138560>))
<\?php(?:\s*(\$\w{1,40})=(?:"[^;\$\(\)\v`!@#%\^\+:\->]{1,99}";eval\(\1\("[\w\+/=]{9999,19999}"\)\);(?<X2044392>)|(?:str_rot13\((?:base64_decode|gzinflate|convert_uudecode|gzuncompress)\(){2}['"][^'"]{4999,}['"]\)+;\1=create_function\((?:null|['"]{2}),\1\);\1\(\);\?>(?<X2133011>)|['"](?:miss2021\.fun|ipsfacade\.ge)/[^'"]{0,9}['"];\$pdom=['"]https?://[^;]{1,199};echo\h*['"]<img\b[^/>]{0,99}\bsrc=['"]?https?://['"]\.\1\.['"]tracker\.(?:jp|pn)g\b[^/>]{0,99}\bdisplay:none\b[^\?@#%\*!\\\|]{99,999}=\1\.['"]/\w\.js\.php\?\w=['"](?<X2179902>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\1\D{2,3}['"][^'"]*['"]\)\{echo\s*[^;]{0,40}php_uname\s*\(\)[^;]{0,40};[^\}]+if\s*\(@?move_uploaded_file\s*\([^\?]{1,999}</form></body></html>['"];\s*\}\s*[\?>]{2,4}(?<X1125720>)|\$_POST\[[^\]]+\];(\$\w{1,40}=getenv\([^;]+;)[^\?]{1,99}\6([ri][en][qc][ul][iu][rd]e(?:_once)?\s*['"\(])[^;]+;\$\w{1,40}(=['"]UPDATE[\s\w]+SET)\s+[^;]+\1[^;]+;\$\w{1,40}=(mysqli?_query\()[^;]+;[^\?'"]{1,49}\$_?GRABAR_SQL\d?\8[^;]+\1[^;]+;\9[^;]+;\7[^;]+;(?:\?>|\Z)(?<X2134151>)|range\(1,\d+\);\s*(\$\w{1,40})=chr\(\1\[[^;]+;\s*\11\(\$\{chr\(\1\[[^;]+;\s*\?>(?<X1041380>))|\s*(\$\w{1,40})[\h=]+\$_COOKIE;\s*\$\w{1,40}[\h=]+\d+;\s*\(count\(\13\)==\d+&&in_array\(gettype\(\13\)\.count\(\13\),\h*\13[\h\)\?\(]+\13[^:;]{0,600}:\13;\s*\?>(?<X1212180>)|\s*(\$\w{1,40})\h*=\h*(?:(?:array\s*\(|\[)\s*['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^\?]{1,199}\bfwrite\h*\(\h*\$\w{1,40}\h*,\h*(\w{1,40})\h*\(\h*\15\[0\][^\?\{]{1,199}\bfunction\h+\16\h*\([^\{]{1,99}\{\s*\$\w{1,40}\h*=\h*curl_init\(\);[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1172760>)|(['"]false['"]);\s*if\(preg_match\(['"][^;]+\15\h*=\h*['"]true['"]\h*;\s*\}\s*if\h*\(\h*\15\h*\W{2,3}\h*\18\h*\)\s*\{[^\}]+\$\w{1,40}\h*=\h*\$matche?s?\[\d+\];(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*['"]<script[^:;>]+\bhttps?://[^:;>]+;[^\?\}]{99,199}\becho\h*\19;\s*\}\s*\?>(?<X1157911>)|@?file_get_contents\h*\(\h*['"]https?://(?:www\.)?[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\h*echo\s+['"]?\15['"]?;\s*\?>(?<X1151591>)|@?md5\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*if\h*\(\h*\15\h*\D{2,3}\h*['"]\w{32}['"]\h*\)\s*\{[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\([^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1164100>)|['"]base64_decode['"];\s*(\bif\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\))[^;\{\}]{0,99}\15\h*\(\h*['"]\w{32,50}[^\[]{1,45}(\$\w{1,10})\h*=\h*\15\h*\(\h*\$_[GPRSC]\w{2,6}[^\}]{1,499}\}\s*else[\{\s]+@?eval\h*\(\h*\15\h*\(\h*\24[^\{]{1,99}\{\s*\23[^\?]{1,99}(?:\?>|\Z)(?<X1173581>)|['"]https?://(?:[\d\.]+(?::\d+)?/[^;]{1,99};\s*(\$\w{1,40})\h*=['"\hfile_gtcons\.]{19,49};\s*\26\h*=\h*\26\(\15\);\s*(\$\w{1,40})\h*=\h*strrev\(['"]stnetnoc_tup_elif['"]\);\s*\27\([^,\)]+\.php['"],\h*\w{1,19}\(\26[\h\)]+;\s*(?:(?:echo|die|exit)\b[^;]{0,19};\s*)?(?:\?>|\Z)(?<X1164030>)|[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*;[^\$]{0,49}(\$\w{1,15})\h*=\h*['"][^'"]+\.php['"];[^\{]{0,49}\bfunction\h*(\w{1,15})\(\$\w{1,15},\h*\$\w{1,15}\)\{[^\+]{99,1500}\}\s*\30\(\29,\h*\15\);\s*\?>(?<X1176711>))|\$\{['"][GOBALS\\xa-f\d]{9,40}['"]\};\h*@[\(\h]+(count)\((?:\$?\w{1,40}\S{2,9}){2}(?:in_array\()?gettype[\h\(]+\15[\h\)\.]+\32\(\15[^\v\+\*/]{99,999}(\$\w{1,40})[\h=]+['"]\\x?\d+\\[^;]+;\s*(\$\w{1,40})[\h=]+@?\33\(['"][^'"]{0,40}['"],['"]\\[^'"]+['"]\);\s*@?\34\([^;]+;\s*(?:\?>|\Z)(?<X1188081>))|\s*(\$\w{1,40})\s*=(?:[^;]{1,40};\s*\$\w{1,40}\s*=['"base64_doc\.\s]{13,49};\s*\$\w{1,40}\s*=(?:\s*\36\[\d+\]\s*\.){4}[^;]{1,40};\s*if\b[^\{]{1,99}\{\s*(\$\w{1,40})\s*=\s*(array)\s*\([^;]{1,40};\s*\38_walk\s*\(\s*\37,\s*strval\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\][^;]{1,9};\s*\}\s*\?>(?<X1140461>)|\s*(\w{1,9});\s*(\$\w+)\s*=\s*\$_SERVER\[[^;]+;(?:\s*if\(strpos\(\41\b[^\{]{1,99}\{\s*\36\s*=\s*\w{1,9};\s*\}\s*else){3}[^\?@:></]{9,999}\bif\(\36\D{2,4}\40\)\{\s*(\$\w+)\s*=\s*['"]https?://[^;]+;\s*(\$\w+)\s*=\s*@?file_get_contents\(\42\);\s*echo\s*\43;[^\}]{9,499}[\s\}]+(?:\?>|\Z)(?<X1139501>)|\s*(chr\()104\)\h*\.\h*\45\b101\)\h*\.\h*\45\b97\)\h*\.\h*\45\b100\)\h*\.\h*\45\b101\)\h*\.\h*\45\b114[\)\h]+;\h*\36\h*\(\h*chr\(\d{2,3}\)\h*\.[chr\(\)\.\h\d]{99,999}\)\h*\)\h*;\s*\?>(?<X1184530>)|\s*(file_)ge(t_contents\()([^\)]+\bwp\-config\.php['"])\s*\);\s*(?:\36\s*=\s*str_replace\(\h*['"]define\(['"]DISALLOW_FILE_(?:EDIT|MODS)['"],\h*true\);['"]\h*,\h*['"]{2}\h*,\h*\36\);\s*){2}[^\?]{9,49}\47pu\48\49\h*,\h*\36\h*\);\s*touch\(\49[^;]{1,19};\s*echo[^;]{1,19};\s*(?:\?>|\Z)(?<X1144970>)|\s*['"](?:assert|eval)['"];\s*@?\36\s*\(\s*@?\$\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\]\s*\)(?:\s*;)?\s*(?:\?>|\Z)(?<X1131110>)|\s*['"][^'"]{32,99}['"];\h*\$\w{1,40}[\h=]+(?:\36\{\d+\}\s*\.\s*)+\36\{\d+\};\h*\$\w{1,40}[\h=]+\36\{\d+\}\s*\.[^\\\[]{999,1999}\$\w{1,40}[\h=]+\$\{\s*['"][GOBALS\\x471532cf]{9,28}['"]\s*\}[^>]{9,1999}\beval\([^;]+;['"]\);\h*\$\{['"][GOBALS\\x471532cf\s]{9,28}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1182220>)|\s*['"][^'"]{999,4999}['"]\s*;\s*(?:@?fwrite\(\s*@?fopen\(\s*\$_[GPCSR]\w{2,6}\[[^\)]+\)\s*,\s*@?base64_decode\(\36\)\s*\);\s*){3,9}echo[^;]{1,99};\s*(?:\?>|\Z)(?<X1137960>)|\s*[^;]{1,40}\s*;\s*if\s*\(isset\(\s*\$_REQUEST\[\36\]\)\)\s*\{\s*@?(?:system|exec|passthru|shell_exec|popen)\(\$_REQUEST\[\36\]\);\s*\}\s*(?:\?>)?\s*\Z(?<X2052790>)|\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]{0,40};\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]{0,40};+[^\?@]{99,499}@?mail\s*\(\s*(?:\36|\55)\s*,\s*(?:\36|\55)\s*,[^;]+\);\s*(?:\?>|\Z)(?<X1126270>)|\s*array\(\s*['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\s*=>\s*['"]([^'"]{1,40})['"]\s*\);\s*(\$\w{1,40})\s*=\s*array_keys\(\36,\s*['"]\57['"]\);\s*declare\(ticks=\d+\);\s*register_tick_function\(\58\[\d+\],\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\s*\?>(?<X1153640>)|\s*file_get_contents\s*\(\s*['"][^'"]*['"]\s*\)\s*;\s*\36\s*=\s*base64_decode\s*\(\s*\36\s*\)\s*;\s*file_put_contents\s*\(\s*['"]([^'"]+)['"]\s*,\s*\36\s*\)\s*;\s*include\s*\(\s*['"]\60['"]\s*\)\s*;\s*unlink\s*\(\s*['"]\60['"]\s*\)\s*;\s*(?:|\?>|\Z)(?<X1058520>)|\s*fopen\(__FILE__,\s*['"]\w['"]\);\s*fseek\(\s*\36,\d+\);\s*(\$c)\s*=\s*['"]['"];\s*while\s*\(\s*!feof\(\s*\36\s*\)\s*\)\s*\{\s*\62\s*\.?=\s*fread\(\s*\36,\d+\);\s*\}\s*@?(?:system|exec|passthru|shell_exec|popen|eval)\s*\(\s*bzdecompress\(\62\)\);\s*__halt_compiler\(\);\s*\?>(?<X2053802>)|\s*substr_replace\s*\(\s*['"][^'"]{5,9}['"]\s*,\s*['"][^'"]*['"]\s*,\s*\d\s*,\s*\d\s*\)\s*;\s*@?\36\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;\s*(?:\?>|\Z)(?<X1186760>))|\s*(\$\w{1,9})\h*=\h*(?:@\$_SERVER\[[^\]]+\];\s*(\$_REQUEST\[)['"](\w{1,9})['"]\]\h*=[^#]{99,599}\binclude(?:_once)?\h*\$PATH\h*\.\h*\65\h*\.\h*['"]\.php['"];\s*class\h*(\w{1,9})\h*\{\s*[^\{]{1,49}\$\67\h*=\h*false\)\s*\{[^\}]{0,99}(new)\h*\$\w{1,9}\(@\66[^\}]{0,99}[\}\s]+\69\h*\68\(\65\);\s*(?:\?>|\Z)(?<X1177702>)|['"]base64_decode['"];\s*(\$\w{1,9})\h*=\h*\65\(["']aHR[^'"]{1,99}['"]\);\s*(\$\w{1,9})\h*=\h*[""][^'"]{1,99}['"];\s*@?(file_)put(_contents)\(\72,\h*['"]<\?php\h*['"]\.\65[^\?]{0,99}\beval\(\65\(@?\73get\74\(\71[\h\)]+;\s*\?>(?<X1176421>)|['"]str_rot['"][\h\.]+\(\d+[^;]+;\s*\bif\h*\(!?empty\h*\(\$\{\65\h*\(['"]_CBFG['"][\)\}]+[^\?]{1,109}(\$\w{1,9})\h*=\h*\65\h*\(['"]perngr_shapgvba['"]\);[^\?]{1,165}(\$\w{1,9})\h*=\h*\76[^\?]{1,49}\?\h*\77\h*\(\)\h*:\h*['"\h]+;\s*\}(?<X2183181>)|file_get_contents\h*\(\h*['"]https?://pastebin\.com/raw(?:\.php\?i=|/)?[^'"]{5,10}['"]\h*\);\s*(?:eval\(base64_decode\(\65\)\);\s*)?(?:\Z|\?>)(?<X1142330>))|\s*(\$\w{99,})\h*=\h*['"][^'"]{9999,}['"];\s*(\$\w{99,})\h*=\h*(?:(?:str_rot13|base64_decode|gz(?:inflate|uncompress)|convert_uudecode|htmlspecialchars_decode|urldecode)\h*\(\h*)+\80[\h\)]+;\s*@?[sape](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(\h*\81\h*\)\h*;\s*(?:\?>|\Z)(?<X1140021>)|\s*(\$auth_pass)\h*=\h*['"][a-f\d]{32}['"];[^\{\}]{0,499}\bif[\(\h]+!empty[\(\h]+(\$_POST\[[^\]]+\])[\)\s]+\{\s*if[\(\h]+md5[\(\h]+\84[\h\)]+\S{2,3}\h*\83[\)\s]+\{[^\+\*,]{999,1999}<(title>)Db</\85(?<X2177580>))
<\?php(?:\s*@?e(?:rror_reporting(?:\((?:0\);\s*(?:(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\h*\(\h*\1\s*\D{2,3}\s*['"][^'"]{1,40}['"][\s\)]+\{\s*[^\}]{1,499}=\h*fopen\s*\([^\)]{1,99}/\.(?:cpanel/)?contact(?:info|email)['"],['"]\w{1,4}['"]\s*\);[^\?\}]{1,499}(?:unlink\(\$\w{1,40}\);\s*){2,}\}\s*(?:\?>|\Z)(?<X1142110>)|include_once\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp\-apps\.php['"];\s*\?>(?<X1180300>))|E_ERROR\);\s*(?:(\$remote_path)\h*=\h*['"]http://[^'"]+['"]\h*;\s*(\$\w{1,40})\h*=\h*['"][^'"]{0,99}['"]\h*;\s*(\$\w{1,40})\h*=\h*['"][^'"]{0,99}['"]\h*;[^\?\.>]{99,499}\{\s*echo\h+file_get_contents\h*\(\h*\4\h*\.\h*(?:\5|\6)\h*\)\h*;\s*(?:exit|die)[^;]{0,9};\s*\}(?:\s*\?>)?\s*\Z(?<X1162230>)|\$remote_path\h*=\h*['"]http://(?<X2103042>)))|\h*\(\h*[\$'"]?\w{1,40}[\$'"]?\h*\^\h*[\$'"]?\w{1,40}[\$'"]?\h*\)\h*;\s*define\h*\([^\)]+\)\h*;\s*\$\w{1,40}\h*\[[^\]]{0,40}\]\h*=\h*explode\h*\(\h*['"]\|[^;]{1,499}\bgzinflate\(substr\((?<X2172390>))|val\s*\(\s*base64_decode\s*\(\s*['"]IGlmICggaXNzZXQoICRfQ09PS0lFWy[^'"]{1,500}['"]\s*\)\s*\)\s*;\s*\?>(?:\s*<!--[a-z,0-9]{1,40}-->)?(?<X1054290>)|xtract(?:\h*\(\h*\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?\h*\)\h*;\s*@(?:die|exit)\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}[\)\h]+;\s*\?>(?<X1188890>)|\s*\(array\s*\(\w=>create_function\s*\(NULL,(\w{1,9}\s*\(\s*\))\s*\)\s*\)\s*\);[^\{]{1,50}function\s*\12\s*\{(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6};\s*return\s*@?\s*\(\13\s*\[[^\]]+\]\);\s*\}\s*(?:\Z|\?>)(?<X1129101>)))|\s*@?file_put_contents\s*\(\s*(['"][^'"]*['"])\s*,\s*['"][^'"]*['"]\s*\.\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*;\s*@?include\s*\(\s*\15\s*\)\s*;\s*@?unlink\s*\(\s*\15\s*\)\s*;\s*\?>(?<X1041670>)|\s*@?header[\h\(]+['"]Conte[^\)]+\)\h*;\h*(\$\w{1,40})[\h=]+['"]\w{1,40}@gmail\.com['"];\h*(\$\w{1,40})[\h=]+['"]http://['"][\h\.]+\$_(SERVER)\h*\[['"]\19[^\]]+\][\h\.]+\$_\19\h*\[[^;]+;\h*(\$\w{1,40})\h*=[^;]+\18[^;]+\$_\19\h*\[[^;]+;\s*@?mail[\h\(]+\17[^\$;]+\20[^;]+\bphp_uname\(\)[^;]+;\s*(?:\?>|\Z)(?<X1177940>)|\s*@?preg_replace(?:\('/[^/]{1,40}/e'\s*,\s*'[^,]+,\s*'[^']+'\s*\);\s*\?>(?<X1041120>)|\s*\(\s*.?['"](.).{0,40}\23e\w?.?['"]\s*,\s*['"][^'",]{9,}['"][^'"]{999,}['"][^\?>\n]{0,49}\)\s*;\s*\?>(?<X1135111>))|\s*@error_reporting\s*\((?:0\);\s*(?:@ini_set\s*\([^\)]+\);\s*){3}[^\?]+\{\s*\w{4,15}\s*\(?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\)?;\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1124350>)|\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^"']*['"]\s*\]\s*;\s*if\s*\(\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*base64_decode\s*\(\s*\w+\s*\)\s*;\s*\}\s*\?>(?<X1037730>))|\s*@in(?:clude_once\("index\.php"\);\s*\?>(?<X1036580>)|i_set\("(?:display_errors.{1600,1900}fwrite\((\$\w{1,40})\s*,\s*"<\?php\\n\$\w{1,40}\[1\]\\n\?>"\);\s*fclose\(\28\);\s*include\(([^)]{1,50})\);\s*unlink\(\29\);\s*\$\w{1,40}\s*=\s*"\w{1,40}";\s*\}\s*\?>\s*(?<X1040890>)|log_errors", false\);@ini_set\("display_errors.{500,1200}gzuncompress\(base64_decode\(\$_POST\["\w{1,40}"\]\)\)\);\s*@fclose\(\$\w{1,40}\);\s*include\s*\$\w{1,40};\s*\};\s*\?>(?<X1040870>)))|\s*@move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\?>(?<X1038380>)|\s*@set_time_limit\((?:0\);\s*\$xmlname\s*=\s*'\w{1,40}\.xml.{300,1000}\};eval\(\$[O0]{1,20}\("[^"]{5000,}"\)\);\s*\?>(?<X1040900>)|\d+\);\s*if\(isset\(\$_(GET|POST|COOKIE|REQUEST)\['\w{1,40}'\]\)\)\s*system\(base64_decode\(\$_\34\['.'\]\)\);\s*\?>(?<X1040420>))|\s*[^\$\(\s]{1,99}\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]{1,99};\s*\$\w{1,40}\s*=\s*explode\([^\)]+\36\);\s*if\([^\{;]{1,49}\{\s*(\$\w{1,40})\s*=\s*base64_decode\([^;]{1,99};\s*@\37\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);[^\?]{1,49}\?>(?<X1149260>)|\s*[^\}]{1,599}\}\s*function\h*(\w{1,20})\(\)\s*\{[^\?]{1,199}(\$\w{1,9})\h*=\h*\[(?:['"]https?://xn--[^'"]{9,99}['"][,\];\}]){1,99};[^\{]{1,99}\{\s*header\(['"]location\:\h*['"]\.\40\[array_rand\(\40\)\]\);\s*exit\(\);[^;]{1,49}add_action\(\h*['"]\w{1,20}['"],\h*['"]\39['"]\h*\);\s*(?:\?>|\Z)(?<X2182380>)|\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)(?:\(['"]pkill\h*\-\d[^\?]{9,80}(file_)put(_contents\(['"])[^'"]{1,40}['"],\h*\42get\43https?://(?:\d{1,3}\.){3}\d{1,3}:\d{4}/[^'"]{1,40}/\w{1,9}\.js['"]\h*\)\h*\)\h*;\s*\?>(?<X1148362>)|\s*\(\s*['"]\s*(?:wget|curl|lwp-download|lynx|fetch|GET)\s*[^:]{0,19}https://(?:laggerghost\.github[^\)]{0,40}\.txt|ghostbin\.[^'"]{1,20}/raw)[^\)]{0,9}\w{1,40}\.php['"]\);\s*(?:\Z|\?>)(?<X1137921>))|\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]\w+\.(?:tif|bmp)['"]\)?;\s*\?>(?<X1206700>)|\s*\$(?:auth|s)_?pass\s*=\s*['"][^'"]+['"]\s*;\s*\$\w{1,40}=@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*\?>(?<X1132972>)|\s*\$(?:username|user|userId|login)\s*=\s*\$_POST\[['"][^'"]*['"]\];\s*\$(?:password|pass|pwd|pw)\s*=\s*\$_POST\[[^\]]*\];\s*\?>\s*<\?php[^\}]{9,200}@?move_uploaded_file\((?<X2124811>)|\s*\$(\w{1,40})\s*=\s*['"](PGgyPjxkaXYgc3R5bGU9InBvc2l0aW9uOiBhYnNvbHV0ZT)[^'"]{100,600}['"];\s*echo\s+base64_decode\(\s*\$\49\s*\);\s*\?>\s*<\?php\s+\s*echo\s+base64_decode\(['"]\50[^'"]{100,600}['"]\);\s*\?>(?<X1053532>)|\s*\$.{1,100}\$\w\s*=\s*"[^"]{50000,}";\s*@\$\w\([^)]+\);"\);\s*\Z(?<X1040170>)|\s*\$[O0_]+='[^']+';\s*\$[O0_]+=\("[^"]+"\);\$[O0_]+=\$[O0_]+\{.{20000,30000};\$\{"[^"]+"\}\["[^"]+"\]\(\);\?>(?<X1041320>)|\s*\$[O0_]{1,40}='(?:.{30000,}Content-Type:text/html;charset=utf-8\\'\);echo\s+"\$[O0_]{1,40}";exit\(\);\}'\);\$\{"[^"]+"\}\["[^"]+"\]\(\);\$[O0_]{1,40}="[^"]+";\?>(?<X1041490>)|[^']+';\s*\$[O0_]{1,40}=\d+;\s*\$[O0_]{1,40}='index\.php.{30000,}range\(1,\$p\);\s*\}\s*\$numbers\s*=\s*range\(1,\$p\);\s*shuffle\(\$numbers\);\s*return\s*array_slice\(\$numbers,0,\$n\);\s*\}\s*\?>(?<X2051090>))|\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*="[^"]*"\s*;(?:.+?\s*;\s*eval\s*\(\s*\$\s*\{\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*\}\s*\?>(?<X1037840>)|\s*\$\s*\{\s*.+?\s*;\s*eval\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1036730>)|\s*\$\w{1,40}\s*="[^"]*"\s*;\${.+?;\s*@\$\s*\{\s*\$\w{1,40}\s*\}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\?>(?<X1037560>))|\s*\$\w+=(?:'[^']+';\s*\$\w+=(?:\$\w+\{\d+\}\.?){3,};(?:\s*\$\w+\s*=(?:\$\w+\{\d+\}\.?)+;)+\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1036921>)|(?:[.]?chr\(\d+\)[.;])+\s*eval\(\$\w+\(\$_REQUEST\[\w+\]\)\);\s*$(?<X2044772>)|strrev\("edoced_46esab"\);\$\w+="[^"]+";eval\(\$\w+\(\$\w+\)\);\s*$(?<X2045381>))|\s*\$\w+\s*=\s*(?:"(?:[base64_decode".\s]+";\s*assert\(\$\w+\('[^']+'\)\);\s*\?>(?<X1036040>)|\w+";\s*if\(isset\(\$_REQUEST\[\$\w+\]\)\)\s*{\s*eval\(\s*stripslashes\(\s*\$_REQUEST\[\$\w+\]\)\);\s*exit\(\);\s*};\s*\?>\s*(?<X1034591>))|\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\];\s*if\s*\(\$\w+\s*!=\s*['"]['"]\)\s*\{\s*\$\w+=base64_decode\(\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\);\s*@?eval\s*\(['"]\\\$\w+\s*=\s*\$\w+;['"]\);\s*\}\s*\?>(?<X1035302>)|Array\((?:'\w+'=>'\w+',?\s*){20,}\s*\);\s*function\s*\w+\(\$\w+,\s*\$\w+\)\{\$\w+.+?base64_decode.+eval\(\w+\(\$\w+,\s*\$\w+\)\);\?>(?<X1035122>)|base64_decode\('.+?;@?\$c\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w+['"]?\]\);\s*\?>(?<X1035521>)|file_get_contents\(\s*"http://.+?"\s*\);\s*if\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["\w+"\]=="\w+"\){\s*eval\(\$\w+\);\s*exit;\s*}\s*\?>\s*(?<X1034811>))|\s*\$\w{1,14}=['"]/home/[^'"]{1,50}public_html['"];\s*(\$\w{1,14})\s*=\s*<<<['"]PHP['"]\s*<\?php[^<]{1,450}(\$\w{1,14})\s*=\s*<<<['"]PHP['"]\s*<\?php[^\}]{1,350}\}[^\}]{1,150}md5_file[^\}]{1,100}file_put_contents[^\)]{1,10}\68\);[^\}]{1,50}\}[^\}]{1,100}\69(?<X2280511>))
<\?php(?:\s*\$\w{1,15}[\h=]+(\$_SERVER\[)[^#]{99,2500}\bget_url_con\(['"]https?://(?:\w+\.)?fingerling\.org/[^\.]+\blinks\.php\?gethost[^#]{599,2500}\bfile_put_contents\(\1[^\]]+\][\h\.]+['"]/sitemap\.xml['"],\h*\$\w{1,15}\);[\s\}]+\?>(?<X1197831>)|\s*\$\w{1,16}\s*=\s*(stripslashes\()\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w{1,16}\s*=\s*\3\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w+\s*=\s*\3\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$\w+\s*=\s*@?mail\(\3\$\w+\),\s*\3\$\w+\),\s*\3\$\w+\)\);\s*if\(\$\w+\)\s*\{\s*echo\s*(?:trim\()?'\w+'\)?;\}\s*else\s*\{\s*echo\s*'\w+\s*:\s*'\.\$\w+;\}\s*(?:\?>|\Z)(?<X1045042>)|\s*\$\w{1,20}(?:=\$_POST\[\w{1,20}\];echo\s*eval\(\$\w{1,20}\);echo "404 Not Found";\s*\?>(?<X1036620>)|[^;]{1,20};\s*function\s+(\w{1,20})\([^\)]+\)\s*\{\s*(\$\w{1,20})\s*=\s*["']{2};[^\{]+\)\s*\{\s*\7[^\}]{9,200}\}\s*\$\w{1,20}\s*=\s*['"rawuldeco\s\.]{13,25};[^\{]{999,4000}\$\w{1,20}\s*=\s*Array\([^\)]+\);\s*\$\w{1,20}\s*=\s*\6\([^\)]+\);\s*(\$\w{1,20})=[^\?]{99,200}\8\([^\?]{9,40}\);\s*(?:\?>|\Z)(?<X1129131>)|\s*=\s*Array\('\w'=>.+sprintf\(\w{1,20}\(\$\w{1,20}\s*,\s*\$\w{1,20}\)\);(?:\Z|\?>)(?<X1034452>))|\s*\$\w{1,40}=(?:"\w{32}";.{20000,30000};\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\s*\?>(?<X1040370>)|'###.+\'\)\);';\s*\$\w+=str_replace\('#', '', \$\w+\);\$\w+=create_function\('',\$\w+\);\$\w+\(\);\s*\?>(?<X1034391>)|['"]\w{1,40}['"];if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{(?:echo[^;]{9,199};){1,2}if\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\D{2,3}['"]\w{1,40}['"]\)\{if\([cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,]{1,49},\13[^\)]{1,49}\)+\{(?:(?:else\{)?echo[^;]{0,49};\}){2}\}\}(?:\?>|\Z)(?<X1149730>)|gzinflate\(base64_decode\('[^']{20000,}'\)\);\s*preg_replace\([^\?]{1,50}\?>(?<X1040180>))|\s*\$\w{1,40}\h*=(?:[^;]{1,49};\s*\$\w{1,40}\h*=[^;]{30000,};[^@>]{99,499}(\$\w{1,40})\h*=\h*['"]{2};\s*for\h*\([^\)]+\)\s*\16\h*\.=[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?fopen\((['"][^'"]{1,99}['"])[^;]{1,40};\s*@?fputs\(\17,['"]<\?php\h+\16\h+\?>['"]\);[^\?>=]{1,99}\bunlink\h*\(\h*\18\h*\);\s*(?:\?>|\Z)(?<X1151870>)|\h*(array)\h*\((?:\h*['"][^'"]{1,40}['"]\h*,){5}[^\);\v]{99,}\);\s*(?:\$\w{1,40}\s*=\s*\20\s*\(['",base64_dcgzumnopr\s]{16,49}\);\s*){2}(\$\w{1,40})\s*=[^;]+;\s*(?:\$\w{1,40}\s*=\s*\21\s*\([^;]+;\s*){2,3}\s*(?:eval|assert)\s*(?:\(\s*\$\w{1,40}\s*){2,3}\(\s*\21\s*\([^;]+;\s*\?>(?<X1142640>))|\s*\$\w{1,40}\s*="(?:.{100,1000}\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*"",[^;]+;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\?>(?<X1040340>)|[^"]*"\s*;\s*(?:\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*=\s*str_rot13\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*\.\s*='[^']*'\s*\.\s*\$\w{1,40}\s*;\s*@\$\w{1,40}\s*\(\s*\$\w+\s*\(.+?\)\);(?<X1037310>)|\s*(?:\$\w{1,40}\s*\[\s*\d+\s*\]\s*\.?\s*){3,};\s*\$\w+\((?:\$\w{1,40}\s*\[\s*\d+\s*\]\s*\.?\s*){3,}\s*,\s*\$\w+\s*,\s*['"]+\s*\);(?<X1037001>))|\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1037780>))|if\s*\(\s*\$(?:\w{1,40}\s*='[^']*'\|'[^']*'\s*\)\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*'[^']*'\|'[^']*'\s*\)\s*;(?<X2049510>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*@set_time_limit\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*="[^"]*"\s*\.\s*"[^"]*".+?<\s*form\s*method\s*="[^"]*"\s*enctype\s*="multipart/form-data"\s*>\s*<\s*input\s*name\s*="[^"]*"\s*type\s*="[^"]*"\s*>\s*<\s*input\s*type\s*="[^"]*"\s*value\s*="[^"]*"\s*>\s*<\s*/form\s*>\s*<\?php\s*\}\s*\?>(?<X1037030>)))|[^"]{200,}"\s*;\s*(?:\$\w{1,40}\s*=\s*str_replace\s*\(\s*['"][^;]+;\s*)+preg_replace\(\s*['"][^;]+;\s*\?>(?<X1036991>)|create_function"\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*\)\s*;(?<X1039320>))|\s*\$\w{1,40}\s*='(?:[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*@?eval.+'\)\);\s*/\*,\*/\s*\?>(?<X1041530>)|[^;]+\s*;\s*@?eval\(\$\w{1,40}\([^)]{5000,}\)\);(?<X1039760>)))
<\?php(?:\s*\$\w{1,40}\s*=(?:.{1,100}str_replace\('[^']+'\s*,\s*''\s*,\s*base64_decode\(\s*'[^']+'\s*\)\s*;\s*call_user_func\([^;]+;\s*\?>(?<X1041460>)|[^;]{1,100};\s*\$\w{1,40}\s*=\s*"[^"]{1,500}"\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\?>(?<X1040550>)|\$_GET\s*\[\s*"[^"]*"\s*\]\s*;\s*switch\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*case\s*"[^"]*":\s*\$\w{1,40}\s*="[^"]*"\s*;\s*break\s*;\s*\}\s*Header\s*\(\s*'[^']*'\s*\)\s*;\s*Header\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1039410>)|\s*"[^"]*"\s*(?:;\s*(?:\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*for\s*\(\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*<\s*strlen\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\+\+\s*\)\s*\{\s*\$\w{1,40}\s*\.\s*=\s*chr\s*\(\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\^\s*ord\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*\}\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*\?>(?<X1039400>)|eval\s*\(\s*gzuncompress\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038370>))|\^\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^"[^"]*"\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*[^)]+,\s*"[^"]*"\s*\)\s*;\s*\?>.+?<\?php\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*\^"[^"]*"\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*[^)]+,\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1039050>))|\s*"(?:[^;]+"\s*;\s*\$\w{1,40}=@?\$\w{1,40}\(.+?\)\s*;\s*@?\$\w{1,40}\(\s*"[^"]+"\);(?<X1039720>)|\\x.{50000,}\(\s*\$\w{1,40}\s*\(\s*"[^"]{1,20}"\s*\)\s*\)\s*\.\s*"[^"]*"\s*\)\s*;\s*die\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}\s*\}(?<X2048390>)|\w{1,40}";\s*\$\w{1,40}\s*=\s*"";\s*foreach\s*\(\s*\$_POST\s*as\s*\$\w{1,40}\s*=>\s*\$\w{1,40}\)\s*\{\s*if\s*\(\s*strlen[^\?]{999,2000}strlen\(\$\w{1,40}\s*\)\s*\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}\s*\}(?<X2050382>))|\s*'[^']*'\s*;\s*(?:\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*"[^"]*"\s*\)\s*\)\s*;(?<X1041220>)|include_once\s*\(\s*"config\.php"\s*\)\s*;\s*\?>\s*<!DOCTYPE\s*html(?<X2042600>))|\s*['"](?:[^'"]+['"];\s*function\s*(\w{1,40})\([^\{]+\{\s*return\s+['"\.\$\w]{2,99};\}[^\n]{999,1999}\$\w{1,40}\s*=(?:\s*\12\s*\(){3}[^;]{99,399}['"]{2}[^'"]{20000,30000}['"]{2}\.\$\w+\)\)\s*;\s*\$\w+\(\$\w+,array\([^;]+\)\);(?:\Z|\?>)(?<X1131691>)|https?://[fz][^;]+;[^\{\}]{0,99}\bfunction[^;]+curl_init[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent[^;]+;[^;]+\14[\s\)]+;[^\}]*(?:exit|die)(?:[^\}]{0,40}\})+\s*(?:\?>|\Z)(?<X1248171>))|\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(?:"[^"]*"\s*\]\s*;\s*if\s*\(\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*&&\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1041520>)|'[^']*'\s*\]\s*;\s*echo\s*file_get_contents\s*\(\s*"[^"]*"\s*\)\s*;\s*exit\s*;\s*\?>(?<X1037710>))|[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(\$\w{1,40}\s*==\s*'[^']*'\)\s*\{(?:\s*\$\w{1,40}\s*=\s*base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);){2}\s*\$\w{1,40}\s*=\s*curl_init\(\);.+?curl_close\(\$\w{1,40}\);\s*if\(\$\w{1,40}\)\s*\{\s*print\s*"[^"]*";\s*print\s*\$\w{1,40};\s*\}\s*else\s*\{\s*print\s*"[^"]*";\s*\}\s*\}\s*\?>(?<X1038001>)|[GPRSC]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*exit\s*;\s*\?>(?<X1041421>)|POST\s*\[\s*'[^']*'\s*\]\s*;\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*rtrim\s*\(\s*\$\w{1,40}\s*,\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*;\s*@move_uploaded_file\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\.\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\)\s*\?\s*print\s*"[^"]*"\s*:\s*print\s*["'][^"']*["']\s*;\s*\}\s*/\*[^\*]+\*/\s*print\s*['"][^']+['"]\s*;(?<X1038220>))|\s*\d+\s*;\s*\$GLOBALS\s*\['\w{1,40}'\]\s*=\s*Array\(\s*\);global\s*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*\$GLOBALS.{4000,}?\$\w{1,40}\s*\[\d+\]\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\}\s*\}\s*\?>(?<X1039650>)|\s*\w+;\$GLOBALS\['\w+'\]=Array\(\);global\s*\$\w{1,40};\$\w{1,40}=\$GLOBALS;\$\{"\\x[^"]{10,100}"}\['\w+'\]="\\x.{4000,7000}\);\}\}\s*\?>(?<X1040020>)|\s*\w{1,40};\s*function\s*\w{1,40}\s*\(\s*\$\w{1,40},\s*\$\w{1,40}\)\s*\{\s*(\$\w{1,40})\s*=\s*['"]['"];[^\}]+\}[^\}]+['"\s\.rawuldeco]{15,40}\s*;return\s+\$\w{1,40}\(\23\);\s*\}\s*\$\w{1,40}\s*=\s*(?:['"][\w%]+['"]\s*\.\s*){3}[^;]{1999,};\s*(?:\?>|\Z)(?<X1125760>)|\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*file_put_contents\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*include\s*\(\s*\$\w{1,40}\s*\)\s*;\s*unlink\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X1039770>)|\s*chr\(.{400,600};include\(\$\w{1,40}\);\$\w{1,40}\(\$\w{1,40}\);\s*\Z(?<X2051220>)|\s*getenv\("REMOTE_ADDR"\);\s*include\s*'antibots\.php';\s*\$message\s*\.=\s*"--(?<X2050930>)|\s*m(?:ail\s*\(\s*(?:stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*,\s*){2}stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*echo\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*echo\s*'[^']*'\s*\.\s*\$\w{1,40}\s*;\s*\}(?<X1038801>)|d5\s*\(\s*"[^"]*"\s*\)\s*;\s*\?><\?php\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*"[^"]*"\s*\)\s*\)\s*\)\s*;\s*\?>(?<X2047360>)))|\s*\$\w{1,9}(?:\h*=\h*['"]base[^;]{9,70}ode['"];\s*\?>(?<X1179430>)|\s*=\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val)\(['"]cd\s*(/tmp);\s*wget\s+[^;]{9,40}/(\w+)\s*;\s*perl\s+(\31/\32);\s*rm[^/]{1,9}\33\*\s*['"]\s*\)\s*;\s*\?>(?<X1135371>)|\s*=\s*array\([^\)]{5,20}\);\s*(\$\w{1,5})\s*=\s*curl_init\(['"]https?://[^'"]{9,80}\.php[^\{]{9,190}\$\w{1,9}\s*=\s*curl_exec\(\35\)[^\}]{9,80}foreach\(\$\w{1,9}\s*as\s*(\$\w{1,9})\)\s*\{echo\s*['"]<iframe\s*src=["']{2}\.\36\.['"]{2}\s*(?:width|height)\s*=\s*0[^\}]{1,30}\}\}\s*\?>(?<X1128141>)|\s*=\s*new\s*PDO\(['"]mysql:host=(?:\d{2,3}\.?){4};\s*dbname=evalueconsultores['"],\s*['"][^\)]{9,99}\);\s*(?:\?>\s*<html>\s*<head|if\(isset\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]|session_start\(\);\s*\$\w{1,9})(?<X2128890>))|\s*\$\{['"](?:(?:\\x47|G)[^!]{99,2000}curl_init\s*(\(\$\{\$\{)['"](?:\\x47|G)[^:]{9,99}curl_setopt\s*\39['"](?:\\x47|G)[^:]{9,400}curl_exec\s*\39['"](?:\\x47|G)[^!]{99,5000};\s*unlink\s*\([^\)]+\);\s*(?:echo|print)\s*\(?['"][^'"]+['"]\)?;?\s*(?:\?>|\Z)(?<X1059643>)|[^`]{1000,4000}\]\}=trim\(urldecode\(\$_REQUEST\["f"\]\)\);\$\{\$\{[^`]{1000,4000}"\]\}\)\{exit\(\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\}\);\}else\{@header\("[^"]{1,80}"\);\}\}\s*\?>(?<X1042060>)|[^`]{1000,6000}(\$\w{1,40})=base64_decode\(\$\{\$\w{1,40}\}\[\d+\]\);(\$\w{1,40})=create_function\(\s*['"]['"],\42\);\43\(\);\}\s*\?>(?<X1041970>)|[^`]{1000,8000}if\(preg_match\(["']/["']\.\$\{\$\{["'][^"']{1,40}["']\}\[["'][^"']{1,40}["']\]\}\.["']/["'],\$_SERVER\[["'][^"']{1,40}["']\]\)\)\{header\(["'][^"']{1,80}["']\);die\(["']<[^"']{1,300}["']\);\}\}\}\s*\?>(?<X1042020>)|[^`]{500,2000}\?>[""];file_put_contents\(['"][^'"]{1,20}\.php['"],\$\{\$\{[""][^'"]{1,40}[""]\}\[['"][^'"]{1,40}['"]\]\}\);\}\}\s*\?>(?<X1041980>))|\s*\$\{\h*[ep][cr](?:ho|int)\h*\([^;\}]+\)\h*\}\h*\.\h*\$\{\h*@?[sape](?:ystem|assthru|hell_exec|open|xec|val|ssert)\h*\(\h*\w{4,40}\b\h*\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\}\h*\?>(?<X1140210>)|\s*\$_\[['"]heading_title['"]\]\s*=\s*['"]Shell['"](?<X2128561>)|\s*\$a(?:lphabet\s*=\s*"[^"]+";\s*(\$string)\s*=.{50000,};\s*\$(\w{1,40})\s*=\s*\$\w{1,40}\(""\s*,\s*\$array_name\(\49\)\);\s*\$\50\(\);\s*\Z(?<X2050480>)|rchive_path\s*=\s*'(?:[^']*'\s*;\s*\$extract_path\s*=\s*'[^']*'\s*;\s*if\s*\(\s*!file_exists.+}\s*}\s*echo\s*"OK"\s*;\s*\?>(?<X1038820>)|\./id\.zip';\s*\$extract_path\s*=\s*'\./';(?<X2048620>)|\w+\.zip';\s*\$extract_path = '[^']+';\s*.+touch\(\s*\$extract_path\s*\.\s*\$value\s*,\s*filemtime\(\$archive_path\s*\)\s*\);\s*}\s*}\s*echo\s*"Ok!";\s*\?>(?<X1039270>))|uth_pass='.{32}';preg_replace\("/\.\*/(?<X2051180>)))
<\?php(?:\s*\$GLOBALS(?:(?:\[[^\]]{1,42}\]){2}=['"][bi](?:374k|ndoxploit)\s*shell\s*packer['"];(?<X2156170>)|\[[^\]]+\]=Array\h*\(\h*(?:base64_decode\h*\(\h*['"]\w{1,9}['"]\h*\.[a-z=\.'"\h]{1,99}\)\h*,?){2,9}\)\s*;\s*function\s*(\w{1,16})\s*\(\s*(\$\w{1,9})\s*\)\s*\{[^\}]{99,199}\[\3\]\);\s*\}[^\?\}]{1,99}(\$\w{1,9})\s*=\s*\2\s*\([^\?\}]+\}\s*echo\s*\4;\s*\?>(?<X1128601>))|\s*\$password=.+?if\s*\(!empty\s*\(\$_FILES\['\w+'\]\)\)\s*{\s*move_uploaded_file.+?<input type="submit" name="login" value="go!" /\s*></form>\s*<\?php\s*}\s*\?>(?<X1035430>)|\s*\$r6\s*=\s*pow\(2,6\);\s*\$stringus\s*=(?<X2044421>)|\s*\$str\s*=\s*'PGRpdi[^']+';\s*echo\s+base64_decode\(\$str\);\?>(?<X1037100>)|\s*\$target_urls\s*=\s*array.+?\$n\s*=\s*mt_rand\(0,count\(\$target_urls\)-1\);.+?\$rand_url;\?>\s*">\s*(?<X2044301>)|\s*\$user_agent_to_filter\s*=\s*array\s*\(\s*"#Ask\\s\*Jeeves.{2000,4000}\$_SERVER\[HTTP_HOST]"\s*\)\s*;\s*\$result\s*=\s*curl_exec\(\s*\$ch\s*\);\s*curl_close\s*\(\s*\$ch\s*\)\s*;\s*echo\s*\$result\s*;\s*}\s*\?>(?<X1039800>)|\s*\$zip\s*=\s*new\s*ZipArchive\s*\(\s*\)\s*;\s*\$zip_status\s*=\s*\$\w{1,40}-\s*>\s*open\s*\(\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*===\s*true\s*\)\s*\{.+\."\)"\);\s*}\s*;\s*\?>(?<X1038830>)|\s*\${"\\x[^"]+"}\["[^"]+"\]=.+?\);\s*exit\(\s*\);\s*}\s*\?>(?<X1037740>)|\s*\(\$\w{1,40}\s*=\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\)\s*&&\s*@preg_replace\(\s*'/ad/e'\s*,\s*'@'\s*\.\s*str_rot13\(\s*'riny'\s*\)\s*\.\s*'\(\$\w+\)'\s*,\s*'add'\);\s*\?>\s*(?<X1034131>)|POST\[[^]]+\]\)\s*&&\s*@?preg_replace\('/ad/e',[^;]{1,200};\s*\?>(?<X1041000>))|\s*\becho\h*['"][^'"]{0,49}\bUploader\h*\W{0,9}</title>[^;]{0,49};[^\?]{99,999}\balert\h*\(\h*['"]Exploit\h*by[^\}\?]{1,999}\}\s*\}\s*\?>(?<X1168061>)|\s*\bif\h*\((\$\w{1,9})\h*=\h*implode[\h\(]+['"]{2}[,\h]+\$_[GPRSC]\w{2,6}[\)\s\{]+(\$\w{1,9})\h*=\h*tmpfile[\h\(]+\)\h*;\s*@?fwrite[\h\(]+\17[\h,]+(?:raw)?url(decode)[\h\(]+(?:(?:strrev|str_rot13|base64_\18)[\h\(]+)+\16[\)\h]+;\s*\$\w{1,9}\h*=\h*stream_get_meta_data[\h\(]+\17[\)\h]+;[^\?]{1,99}(?:\?>|\Z)(?<X1183543>)|\s*class(?:\h+(\w{1,40})(?:\h*\{(function)\h+__construct\(\)\h*\{(\$\w+)\h*=[^;]{1,99};\22[\h=]+(\$this\->)(\w+)\(\23(access|core)\(\22\)\);[^\v\?]{99,999}\b(?:\21\h+(?:\24|\25)\((\$\w+)\)\h*\{\h*\$\w+[\h=]+\23[^;]{1,99};\h*\$\w+[\h=]+@\$\w+\(\26\);\h*return\h+\$\w+;\h*\}){2}[^\v]{999,}\bnew\h*\20\(\);\s*(?:\?>|\Z)(?<X1171584>)|\s*\{\s*public\h+\$(\w{1,40})\h*=\h*['"]{2};\s*function\h+__destruct\h*\(\h*\)\s*\{\s*@?(?:assert|eval)\h*\(\h*['"]\$this\->\28['"]\h*\);(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*new\h+\20;\s*(\29\h*\->\h*\28)\h*=\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*(?:echo\s*\30;\s*)?(?:\?>|\Z)(?<X1172630>))|\s*(\w{1,40})\s*\{\s*public\s*\$data\s*=\s*'[^']*'\s*;\s*public\s*function\s*__destruct\s*\(\s*\)\s*\{\s*echo\s*base64_decode\s*\(\s*\$\w{1,40}-\s*>\s*data\s*\)\s*;\s*\}\s*\}\s*\$\w{1,40}\s*=\s*new\s*\32\s*\(\s*\)\s*;\s*\?>(?<X1040940>))|\s*copy\s*\(\s*['"]https?://[^'"]+['"]\s*,\s*['"][^'"]+\.php['"]\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*\w{4,19}\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\(\34\)\);\s*(?:exit|die)\s*\([^;]{1,19};\s*\}\s*echo[^;]{1,19};\s*(?:\?>|\Z)(?<X1134540>)|\s*define\([^\{]{0,150}\bfunction\h*getCurl\([^\)]+\)\s*\{[^\}]{9,399}\}\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\]]+\];\s*if\(strpos\(\36[^\{]+\{\s*(\$\w{1,25})[\h=]+file_get_contents\([^\)]+\);\s*echo\h*\37[^\{]{9,199}\{\s*echo\h*['"]<script[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?:\s*\?>){1,4}(?<X1200543>)|\s*echo(?:[^;]+;\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*\)\s*;\s*array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\?>(?<X1038321>)|[^;]{9,50};\s*function\s*(\w{5,20})\([^\)]+\)\{\$\w{1,9}=curl_init[^\}]{99,300}\}(?:(\$\w{1,9})=\$_SERVER\[[^;]+\.php['"];\$\w{1,9}=\40\(['"]https?[^'"]{9,99}\.txt['"]\);(\$\w{1,9})=fopen\(\41[^\}]{9,99}fclose\(\42\);if\(file_exists\(\41\)\)\{echo\41[^\?]{9,99}done\s*\.\s*['"];){1,5}\s*(?:\Z|\?>)(?<X1126251>)|[^\.;\v]{1,25}\.\h*php_uname\h*\(\)\h*\.[^@]{1,20}\$\w{1,40}\h*=\h*@ini_get\h*\(\h*['"]disable_functions['"]\h*\)\h*;[^\?]{1,350}if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+[^\{]{1,20}\{\s*if\h*\(\h*@[cm]o(?:py|ve_uploaded_file)\h*\(\h*(\$_files\h*\[[^\]]+\])\[[^\]]+\]\h*,\h*\44(?<X2171692>)|\h*['"]<html>\h*<title>\h*Null\h*</title>(?<X2159840>)|\s*"(?:<pre>"\s*;\s*(?:system|exec|eval|assert|shell_exec|passthru)\(\$_(?:GET|POST|COOKIE|REQUEST)\[[^]]{1,20}\]\)\s*;\s*echo\s*"</pre>"\s*;\s*\?>(?<X1040530>)|[^"]+";\s*\$payload\s*=\s*base64_decode.{900,1500}fputs\(\s*\$f\s*,\s*\$payload\s*\);\s*fclose\(\$f\);\s*unlink\(__FILE__\);\s*\?>(?<X1040930>)|PHP\s+Uploader.{200,500}echo "Failed to Upload\.";\s*\}\s*\}\s*\?>(?<X1040780>))|\s*'(?:<b><br><br>'\.php_uname\(\s*\).+echo\s*'<b>Upload[^<]+</b><br><br>';\s*}\s*}\s*\?>(?<X1035471>)|RxR\s+HaCkEr(?<X2051210>))|\s*['"](?:[^"]*['"]\s*;\s*@?move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*['"][^']*['"]\s*\]\s*\[\s*['"][^']*['"]\s*\]\s*,\s*\$\w{1,40}\s*\[\s*['"][^']*['"]\s*\]\s*\[\s*['"][^']*['"]\s*\]\s*\)\s*;\s*@?(?:passthru|system|shell_exec|popen)\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*\?>(?<X1041561>)|[^'"]+['"];\s*preg_replace\s*\(['"][^'"]+['"]\s*,\s*["][^"]+["]\s*,\s*["][^"]+["]\s*\);\s*\?>(?<X1037690>)|\w+['"];\s*error_reporting\(0\);\s*if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*['"]\w+['"]\s*\D{2,3}\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(\$\w{1,40})\s*=\s*strtr\(\$_[GPRSC]\w{2,6}\[[^\]]+\],\s*['"]-_,['"],\s*['"]\+/=['"]\);@?eval\(base64_decode\(\54\)\);\s*echo\s*['"]\w+['"];\s*\?>(?<X1034892>))|\s*[^;]+;\s*\$\w{1,40}\s+=[^;]+;\s*@\s*\$\w{1,40}\s*\([^;]+;['"]\s*\)\s*;\s*\?>(?<X1038330>)|\s*\(?['"]\s*<form\s*[^>]{1,49}\s*method\s*=\s*['"]post['"][^\$]{100,200}\s*if\s*\(\s*@?\$_POST\[['"]?[^'"]{1,40}['"]?\]\s*[^\w]{1,3}\s*['"][^'"]{1,99}['"]\s*\)\s*\{\s*if\s*\(\s*@?copy\(\s*\$_FILES\[['"][^'"]{1,40}['"]\]\[['"][^'"]{1,40}['"]\],[^\?]{1,200}\s*\}\s*\}\s*\?>(?<X1056931>)|\s*eval\s*\(base64_decode\s*\(\s*(?:str_replace\s*\(\s*['"][^'"]+['"]\s*,\s*['"][^'"]+['"]\s*\s*,)+\s*['"][^'"]+['"]\s*(?:\)\s*)+;(?<X1037041>)|\s*hex2bin\s*\(\s*['"][^'"]*['"]\s*\)[^;]{0,99};\s*echo\s*['"]<form\b(?<X2184841>)))
<\?php(?:\s*error_reporting(?:\((?:(?:0|NULL)\);(?:[^\(]{0,40}\bfunction\h*(\w{1,15})\h*\(\h*\$\w{1,15}\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*curl_init\(\);[^\}]{9,399}\bcurl_close\(\2\);\s*return\h*\$\w{1,15};\s*\}\s*echo\h*\1\(str_rot13\(['"]uggc://[^\)]{1,50}\)\);\s*\?>(?<X1196020>)|[^\{]{0,49}\bif\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\{]{1,70}\{\s*(\$\w{1,15})\h*=\h*base64_decode[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*file_put_contents\([^\)]{1,19}\4\);[^\{]{0,40}\{(?:\s*(?:include|unlink)\(\4\);){2}(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1162221>)|\s*\$\w{1,15}\h*=\h*['"]https?://[^\?]{0,599}\bfwrite\(\$\w{1,40}\s*,\s*file_get_contents\(\$\w{1,40}\.['"]\w\-['"]\.\$_GET\[['"]\w{1,40}['"]\]\)\);\s*fclose\(\$\w{1,40}\);\s*\}[^\?]{0,99}\?>(?<X1049075>)|\s*function\h*(\w{1,25})\(\$\w{1,15}\)\s*\{\s*\$\w{1,15}[\h=]+@?curl_init[^\}]{99,500}\}\s*return\h*\$\w{1,15};\s*\}\s*(\$\w{1,15})[\h=]+\7\(str_rot13\(['"]uggc://[^;]+;\s*eval\(['"]\?>['"][\h\.]+\8\);\s*\?>(?<X1198043>)|\s*session_start\(\)[^#]{99,999}<h(?:1|2)>(?:Copy\s*of\s*)?XATHENA\s*V\d+(?<X2126013>))|(?:0|NULL|false)\);[^%@!\*,]{499,999}(\$\w{1,40})=explode\([^;]+;foreach\(\11\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=\12;\}[^\{\}\?]{9,99}(\$\w{1,40})=file\(\13\);for\([^\}]{99,199}\14\[\$\w+\]=['"][^;]+\$_[GPCSR]\w{2,6}\[[^\}]{9,199}\}(\$\w{1,40})=fopen\([^;]+;fputs\(\15,[^\)]+\14\)+;(?<X2134330>)|0\);(?:(\$\w{1,40})="[^"]+";\17=str_replace.{14000,19000}=chr\(hexdec\(\$\w{1,40}\[\$\w{1,40}\]\.\$\w{1,40}\[\$\w{1,40}\+1\]\)\);return\s*\$\w{1,40};\s*\}\s*\?>(?<X1041230>)|.{1,200}?\$root_path=substr\(\$absolutepath,0,strpos\(\$absolutepath,\$localpath\)\);include_once\("\$root_path"\."[^"]+"\);\s*\?>(?<X1040190>)|\s*(?:require\s*['"](?:(?:\.\./){0,2}(?:check|email)\.php)['"]\s*;\s*){2}\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;\s*)?if\s*\(\s*(?:trim|isset)\s*\(\s*\$_POST\s*\[\s*['"]submit['"]\s*\]\)\)\{\s*if\((?<X2052181>)|\s*echo\s*file_get_contents\(\$_GET\['filename'\]\);(?<X2049540>)|\s*if \(!isset\(\$_COOKIE\['\w+'\]\)\)\s*deny\(\);\s*\$cookieData(?<X2045281>)|\s*if\(isset\(\$_GET\['ms-load'\]\)\s*&&.{100,1000}\}\s*\}\s*endif;\?>(?<X1040350>)|\s*if\(isset\(\$_GET\[\w{1,40}\]\)\)\s*\{\s*echo.{100,1000}-->"\.\$_FILES\["\w+"\]\["\w+"\];\}else\{echo"<b>";\}\}\}\s*\?>(?<X1040730>)|\s*ignore_user_abort\(true\);\s*set_time_limit\(0\);\s*function str_1replace\(\$needle(?<X2044641>)|\s*ini_set\(['"]display_errors[^\[]{9,99}\$GLOBALS\[[^\]]{1,20}\]=Array\(base64_decode\(['"][^\}]{999,2400}\}\s*if\(!isset\((\$\w{1,9})\)\)\s*\{if\(!empty[^#]{999,2800}\}echo\s*\26;\s*\}\s*(?:\Z|\?>)(?<X1128410>)|\s*ini_set\(['"]max_execution_time['"],0\);[^\$'"]{0,499}\beval\((base64_decode\()['"][^'"]{999,}['"]\)\);\s*(\$\w{1,9})\h*=\h*str_split\(['"][^\)]{9999,29999}\);\s*(\$\w{1,9})=['"]{2};\s*foreach\(\29[^\}]{99,499}[\}\s]+@?eval\(['"][\?>]{2}['"]\.gz[^\)]+\28\30[\)\s]+;\s*(?:\?>|\Z)(?<X1152621>)|\s*set_time_limit\(\d+\);\s*function id2str\(\$id\)\s*\{.{1000,3000}curl_close\(\$curl\);\s*echo\s*\$content;\s*\?>(?<X1040640>)|ini_set\("display_errors", 0\);\$localpath=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$\w+=substr\(\$\w+,0,strpos\(\$absolutepath,\$localpath\)\);include_once\(\$root_path\."/\w+.zip"\);\s*\?>(?<X1035780>))|[^;]{1,19};\s*function\s*\w+\([^\}]{1,49}\}\s*(\$\w{1,40})\s*=\s*(str_rot13\()[^;]+;\s*\$\w{1,40}\s*=\s*['"]\w{32}['"]\s*;\s*(\$\w{1,40})\s*=\s*\35\s*strrev\([^;]+;\s*(eval\(\34\(\36\()[^\)]{99,199}\)+;\s*\37[^\)\v]{25000,50000}\)+;\s*(?:\?>|\Z)(?<X1133640>)|[^\)]{1,19}\);[^\{]{0,49}\s*function\s+(get_random_string\()[^:>%@]{199,1999}(\$\w{1,40})\s*=\s*\39[^\)]+\);\s*\40\s*=\s*md5\(\40\);[^\?]{0,49}\s*@?(?:copy|move_uploaded_file)\([^\)]+\40[^\)]+\);\s*header\([^\)]+\40\b[^;]+\);\s*(?:die|exit)\b[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1131730>)|\d+[\-\s]+\d+\);[^\}]{1,300}dataablog\.com[^\}]{1,200}(\$\w{1,14})\s*=\s*file_get_contents[^>]{1,400}strlen\(\42\)>[^>]{1,40}>[^\>]{1,100}exit\(\42\);\}\};\?>(?<X2280480>)|\d+\);\s*\$filename\s*=\s*"\w+";\s*\$task_id="\w+";\s*if\(\s*!file_exists\(\$filename\)\s*&&\s*function_exists\(\s*"parse_url"\s*\)\s*&&\s*function_exists\(\s*"socket_create"\s*\).+?\$f\s*=\s*@fopen\(\s*\$filename\s*,\s*"w"\s*\);\s*fclose\(\$f\);\s*}\s*socket_close\(\s*\$fp\s*\);\s*}\s*\?>(?<X1038410>)|\s*E_ALL\s*&\s*.E_NOTICE\s*\);.+?exit\s*\(\s*">\|1\|<"\s*\)\s*;\s*\}\s*\}\s*\}\s*else\s*\{\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1038350>))|\s*\((?:0\);\s*echo[^;]{1,99};\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\}\?]{1,99}['"][aw]\+?['"]\);\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*['"]<\?php\s*if\s*\([^\{\}]{20,99}\{\s*@?eval\s*\([^\};\?\)]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\);\}]+\?>['"][^=\?\}]+\}\s*\?>(?<X1128310>)|\s*\d+\s*\)\s*;\s*(?:\$\w{1,40}\s*=\s*['"]jquery['"]\s*;\s*\$\w{1,40}\s*=\s*['"]var(?<X2046490>)|if\s*\(\s*function_exists\s*\(\s*'[^']*'\s*\)\s*\)\s*\{\s*set_time_limit\s*\(\s*\d+\s*\).+?echo\s*\$\w{1,40}\s*;\s*@file_get_contents\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\?>(?<X1036780>))|\s*E_ALL\s*\)\s*;\s*ini_set\s*\(\s*'[^']*'\s*,\s*1\s*\)\s*;\s*function\s*str_between.+magento\s*not\s*found'[^']*'Content-type:\s*application/json'\s*\)\s*;\s*echo\s*json_encode\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\?>(?<X1037350>)))|\s*eval\((?:\s*strrev\(.{30000,}\(\s*rqbprqhh_geriabp\s*\(\s*ynir\s*\\'\s*\(\s*31tor_rts\s*\(\s*lave'\s*\)\s*\)\s*;\s*\Z(?<X2048800>)|base64_decode\('IGVycm9yX3JlcG9ydGluZygw(?<X2047520>)|gzinflate\((?:base64_decode\("DZZH(?<X2045161>)|str_rot13\(base64_decode\('[a-zA-Z0-9+/\s]+AQ=='\)\)\)\);\s*\?>(?<X1034181>)))|\s*eval\s*\(\s*(?:\$_[GPRSC]\w{2,6}\s*\[\s*\w+\s*\]\s*\)\s*(?:\?>|\Z)(?<X1036882>)|base64_decode\s*\(\s*(?:'[^']*'\s*\)\s*\)\s*;\s*\?><\?php\s*eval\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*==\s*"[^"]*"\s*\)\s*\{\s*@unlink\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*\?>(?<X2047530>)|\w+[^)]{1000,}\)\s*\);\s*\?>(?<X1037430>))|trim\s*\(\s*base64_decode\s*\(\s*["'][^'"]*['"]\s*\)\s*\)\s*\)\s*;\s*\?>(?<X1037770>))|\s*extract\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*,\s*\d+\s*\)\s*;\s*strripos\s*\(\s*@sha1\s*\(\s*\$\w{1,40}\s*\)\s*,\s*"[^"]*"\s*\)\s*==\s*\d+\s*&&\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1037010>)|\s*file_put_contents\s*\(\s*['"][^"]*['"]\s*,\s*file_get_contents\s*\(\s*['"][^"]*['"]\s*\)\s*\)\s*;\s*echo\s*["'][^"]*['"]\s*;\s*unlink\s*\(\s*__FILE__\s*\)\s*;\s*(?:\?>|\Z)(?<X1039222>))
<\?php(?:\s*function(?: botcheck\(\s*\)\s*{\s*\$spiders\s*=\s*array\((?<X2047001>)|\h*(\w{1,15})(?:\([^\}]{9,99}\}\s*(\$\w{1,15})\h*=\h*['"][^'"]{9,99}['"];\s*\$\w{1,15}\h*=\h*\2\((?:\3\[\d{1,3}\][^\)]{9,99}\);[^\?]{99,2500}\2\([^\)]+\)\)\s*\.['"]{2}[^\[]{999,30000}['"]{2}\s*\.\2\(\3\[[^\}]{9,99}array\(['",\}]{1,9}\.\$\w{1,15}\.['"/]{1,9}\)\);\s*(?:\Z|\?>)(?<X1145063>)|\h*\3\[\d{1,3}\][^\)]{9,99}\);[^\?]{999,30000}['"]{2}\s*\.\$\w{1,15};\s*\2\h*\([^\)]{9,99}\)\)\(['",\}\h]{1,9}\.\$\w{1,15}\.['"/]{1,9}\);\s*(?:\Z|\?>)(?<X1145101>))|\h*\((\$\w{1,9})\)\s*\{\s*\$\w{1,9}\h*=\h*curl_init\h*\(['"]\6['"]\);[^\}]{1,499}\}\s*(\$\w{1,9})\h*=\h*\2\h*\(['"]https?://bit\.ly/[^;]+;\s*eval\h*\(['"]\?>['"]\h*\.\h*\7\);\s*\?>(?<X2184001>))|\h*(\w{1,15}\()[^\)]+\)\{\s*(\$\w{1,15})\h*=\h*(\$\w{1,15})\h*\.\h*\$\w{1,15};\s*@?touch\(\10\);[^\?]{0,599}\bif\(@?(\$_REQUEST\[[^\]]+\])\)\{\s*(\$\w{1,15})\h*=\h*@?\12;[^\}]{0,99}\becho\s*\9\11,\h*\$\w{1,15},\h*\13\);[\}\s]+(\$dosya)[^\?]{0,99}\bprint\(\14[^\)]+\);\s*\?>(?<X1185270>)|\h*(\w{1,15}\(\))\s*\{[^\}]{1,399}\bcurl_exec\(\$\w{1,15}[\)\h]+;\s*return\h*\$\w{1,15};\s*\}[^\?]{1,1499}\bif\(@?(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\{\s*@?eval\([^\)]{0,15}\bfile_get_contents\(\17[\)\h]+;\s*\}\s*(\$\w{1,15})\h*=\h*\16;\s*\w{1,15}\(\18\);\s*\}\s*\?>(?<X1166611>)|\h+(\w{1,40})\(\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\([^#%\*]{999,9999}\becho\h+\20[^@]{999,9999}=\h*@file_get_contents\(\$\w{1,40}\);[^\^\*]{999,9999}?\bif\h*\(\h*\$\w{1,40}\h*==\h*['"]\w{1,40}['"]\h*\)\s*\{\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1153612>)|\h+(\w{1,40}\(\))\{\$\w{1,40}=['"]\w{1,40}['"];(\$\w{1,40})=['"]https://[^\}]{1,499}\b(file_)pu(t_contents\()([^\s,]+),['"]<\?[^\;]{0,99}\b\24ge\25\h*\23[\h\)]+;(?:\s*(?:include|unlink)\(\26\);){2}[^#]{1,999}\b\22;\24pu\25[^;]{1,99};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1181030>)|\s(\w{1,40})\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*[^;]+;\s*\$\w{1,40}\s*=\s*&\$\w{1,40}\s*;.{1,300};\28\s*\(\s*\$_(?:GET|POST|COOKIE)\s*\[\$d\]\s*\);\s*\?>(?<X1041331>)|\s*(\w+)(?:[^\{]+\{\s*(?:\$\w+\s*=\s*(?:(?:isset|trim)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\s*[\?:]\s*){2}['";\s]{4,8}){2}[^\{]{9,99}(\$\w+)\s*=\s*curl_exec\([^\{]{9,29}\{\s*file_put_contents\([^,]+,\s*\31\s*\);\s*\}[^\{]{9,49}\{\s*echo[^;]{1,19};[\}\s]{2,9}\30\(\);\s*\?>(?<X1129370>)|\s*\([^\{]{1,30}\{\s*(\$\w+)\s*=\s*(curl_)[^;]{1,10};(?:\s*\34setopt\s*\(\s*\33\s*,[^;]{1,50};){6,10}\s*(\$\w+)\s*=\s*\34exec\s*\(\s*\33\s*\)\s*;\s*\34close\s*\(\s*\33\s*\)\s*;\s*return\s*\35\s*;\s*\}[^@]{99,199}(\$\w+)\s*=\s*\30[^;]{1,99};\s*echo\s*\36\s*;(?:\s*\?>)+(?<X1127970>))|\s*(\w{1,15})\((\$\w{1,15})\)\s*\{\s*if\s*\(\s*\39\h*\D{2,3}\h*['"](indoxploit)['"]\)\s*\$\w{1,15}\h*=\h*array\(['"]https?://pastebin\.com/raw[^\}]{9,600}\}\s*\38\(\40\);\s*\?>(?<X1151080>)|\s*(\w{1,40}\()\$\w{1,40}\)\{\s*(\$\w{1,40})=(curl_)init\([^\}]{99,999}\$(\w{1,40})=\44exec\(\43\);\s*return\s*\$\45;\}\s*(\$\w{1,40})=\42['"]https?://[^'"]{1,99}\.txt['"]\);(?:eval|assert)\([^\)]+(?:\46|\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\]\h*\})[\)\h]+;?(?:\?>)?\Z(?<X2129954>)|\s*clear_folder\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*is_dir\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*if\s*\(\s*\$\w{1,40}\s*=\s*opendir\s*\(\s*\$\w{1,40}\s*\)\s*\).+\s*\(\s*is_dir\s*\(\s*'[^']*'\s*\)\s*\)\s*rmdir\s*\(\s*"[^"]*"\s*\)\s*;\s*if\s*\(\s*is_dir\s*\(\s*'[^']*'\s*\)\s*\)\s*echo\s*"[^"]*"\s*;\s*else\s*echo\s*"[^"]*"\s*;\s*exit\s*;\s*\}\s*\?>(?<X1036950>)|\s*encode\(\s*\$string\s*\)\s*\{.{500,800}=\s*function\(\s*\)\s*\{\s*'\.\$b\['code'\]\.'\}'\s*\)\s*;\s*\?>(?<X1040580>)|\s*strcode\(\$str\s*,\s*\$passw=""\)\s*{\s*\$salt.+?lmp_client\(strcode\(base64_decode\("[^"]{1,100}"\)\s*,\s*'\w{1,100}'\)\);\s*\?>(?<X1039550>)|\s+(\w{1,20})\(\$\w{1,14}\)\s*\{\s*\$\w{1,14}[\s=]+curl_init\(\)[^@]{1,2450}@file_get_contents[^#]{1,950}stristr\(@?\51\(\$\w{1,14}\)\s*,\s*['"]successfully['"][^#]{1,2200}#[^>]{1,100}(\$\w{1,14})[\s=]+getSeCont[^>]{1,40}\52;\w{1,14}[\(\);\}\s]+(?:\?>|\Z)(?<X1284131>)|\s+(\w{1,40}\(\))\s*\{\s*(\$\w{1,40})\h*=\h*['"]aHR0c[^;]{1,99};\s*(\$\w{1,40})\h*=\h*file_get_contents\([^\)]+\55[^;]{1,40};\s*return\s+\56;\s*\}\s*(\$\w{1,40})\h*=\h*(?:\w{1,40}\h*\(\h*){1,3}\54\h*\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\57\h*\);\s*(?:\?>|\Z)(?<X1144910>)|\s+file_to_include_unknown_cms(?<X2047540>)|\s+gethttpcnt\(\$url\s*,\s*\$timeout\s*=(?<X2048350>))|\s*goto\h*(?:\w{1,40};\s*\w{1,40}:\s*(\$botbotbot)\s*=[^;]+mb_strtolower[\(\h]+\$_SERVER\h*\[['"]?HTTP_USER_AGENT\b[^;]+;[^\[]{99,999}\61[^;]+;\s*(\$\w{1,40})[\h=]+curl_exec[\h\(]+\$\w{1,40}\h*\)[^\}]+echo\h*\62\h*;\s*\}[^\?]{0,99}(?:\?>|\Z)(?<X1178021>)|O\d+;\s*O\d+:[^\n>\-<]{499,}exec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\)[^\n>\-<]{999,1999}exec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\)(?<X2133301>))|\s*goto\h+(?:\w{1,40};\h*\w{1,40}:\h*\$\w{1,40}\h*=\h*file_get_contents\h*\(['"][^\?]{999,9999}mt_rand\h*\([^;]+;(?:\h*goto\h*\w{1,40};(?:\h*\w{1,40}:\h+)+)+\}(?:\h*goto\h*\w{1,40};(?:\h*\w{1,40}:\s+)+)+\?>(?<X1160511>)|\w{3,9};\h*\w{3,9}:\h+if\h*\(!\(strpos\(\$[^\?>]{99,}!(?:empty|isset)\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\?\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\?>]{99,}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*==[^>]{99,}\bhtmlspecialchars_decode\(\$\w{1,40}\);\h*goto\h*\w{1,40};\h*\w{1,40}:\s*\}\s*\?>(?<X1160491>)|\w{4,9};\h*\w{4,9}:\h+(\$botbotbot\d*)\h*=\h*str_replace\h*\([^\v\?<>]{99,999}\67\h*=[^;]{0,99}\bmb_strtolower[\(\h]+\$_SERVER\[['"]?HTTP_USER_AGENT['"]?\][^\?\v><]{1,499}\?>(?<X1181980>))|\s*goto\s*(?:(\w{1,40});\s*\w{1,40}:[^\?]{1499,}\69:\s*(\$\w{1,40})\s*=\s*['"](?:\\(?:[a-fx0-9]){2,3}){3}[^\?]{499,9999}\70[^;]{9,99};\s*\}?\s*goto\s*\w{1,9};\s*\w{1,40}:[^\?;]{1,99}(?:\?>|;)\s*\Z(?<X1124801>)|\w{1,40};\w{1,40}.{24000,28000}goto\s*\w{1,40};\w{1,40}:\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)\)\)\);\?>(?<X2055030>)|\w{1,9};\s*\w{1,9}:[^\?]{1,99}\bstrtolower\h*\(\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*\);[^\?]{9,4999}\bfile_get_contents\h*\(\h*['"]https?://[^/'";]{0,99}\bfingerling\.org/[^'";]+\.php['"][^\?]{1,999};\s*goto\s*\w{1,9};\s*(?:\w{1,9}:\s*){1,3}\s*(?:\?>|\Z)(?<X1160231>)|\w{4,8};\s*\w{4,8}:\s*(\$\w{1,40})\s*=\s*str_replace\(["']\\[\\xa-f\d]{2,40}['"]\h*,\h*['"]{2}\h*,\h*['"]\\[\\xa-f\d]{99,999}['"]\);[^\.\v]{999,9999}\$\w{1,40}\h*=\h*\$\w{1,40}\(\h*(?:['"]{2}|null)\h*,\h*\$\w{1,40}\h*\(\74\([^\)]+\)+;[^\?\.\v\+?%&]{9,2999}\b\w{2,8}:\h*\?>(?<X1179770>))|\s*header\s*\(\s*'[^']*'\s*\)\s*;\s*(?:@set_time_limit\s*\(\s*\d+\s*\)\s*;\s*define\s*\(\s*'[^']*'\s*,\s*\d+\s*\.\s*0\s*\)\s*;\s*define\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*if\s*\(\s*file_exists\s*\(\s*PASSWORD_FILE\s*\)\s*\)\s*\{\s*@unlink\s*\(\s*PASSWORD_FILE\s*\)\s*;\s*\}\s*(?<X2046500>)|\$\w{1,40}\s*=\s*'[^;]{5,100};\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*\?>(?<X1040120>)))
<\?php\s*if(?:[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^;]{1,49};\s*(\$\w{1,9})\h*=\h*['"]PD9waHA[^;'"]{9999,}["'];\s*(\$\w{1,9})[^;]{1,20};\s*fwrite\(\2,\h*base64_decode\(\1\)[^\176]{1,699}\.php_uname\(\)\.[^\?\}\{]{1,99}\$\w{1,40}\h*=\h*@?ini_get\(['"]disable_functions['"]\);[^\*&#]{1,799}\?>(?<X1181542>)|[\s\(]+(isset)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*echo[\s\(]*['"]<form\b[^;]+['"][\)\s]*;\s*if[\s\(]+\4[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{(?:\s*\$\w{1,40}\h*=\h*\$_FILES\[[^;]+;){2}\s*if\s*\(\s*@?(?:move_uploaded_file|copy)\s*\((?:\s*\$\w{1,40}[,\h\)]+)+\{[^\?]{0,499}\?>(?<X1187940>)|[\s\(]{2,4}isset(\(\$_[GPCSR]\w{2,6}\[\s*(base64_decode\()['"]\w+['"]\)\])\)[&\s]{2,4}\6\s*==\s*\7[^%]{300,900}array_filter\(glob\((\$\w{1,20}\.\7)[^%]{99,999}file_put_contents\s*\(\8[^%]{99,600}gzinflate\(\7\7['"][^\?]{30000,}\)\.base64_encode\(implode\(\7[^\.]{1,20}\.\7[^\)]+\);\s*\}\s*\?>(?<X1129483>)|\(!(define)d\(['"]PHP_EOL['"]\)\)\{\10\(['"]PHP_EOL['"],['"][^'"]+['"]\);\}if\(!\10d\(['"](DIRECTORY_SEPARATOR)['"]\)\)\{\10\(['"]\11['"],['"].['"]\);\}function\s*generateRandomString\(\$\w{1,40}=\d+\)\{[^\}]{99,999}\}return[^;\}]+;\}\$payload(?<X2130001>)|\(!?\(?isset\(\$_[GPCSR]\w{2,6}\[(chr\()\d+\)\]\)\h*\D{2,3}\h*md5\(\$_[GPCSR]\w{2,6}\[\13\d+\)\]\)\h*\D{2,3}\h*['"]\w{32}['"]\)+\h*(?:exit|die)[^;]{0,19};\h*(\$\w{1,40})\h*=\h*(?:\13\d+\)\h*\.){5}[^\?\v]{9,999};@?include\(\14\);\h*@?unlink\(\14\);\s*(?:\?>|\Z)(?<X1138640>)|\(!\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\){\s*header\('HTTP/1\.1 404 Not Found'\);\s*exit\(\);.+?}\s*\?>(?<X1035151>)|\(!empty\(\$_FILES\['\w+'\]\['\w+'\]\) && \(md5\(\$_POST\['\w+'\]\) == '\w{32}'\)\)\s*{\s*\$sc = \(empty\(\$_POST\['\w+']\)\).+<br/>Security Code: <br/><input name="\w+" value=""/>\s*<br/>Name:\s*<br/><input name="name" value=""/>\s*<br/>\s*<input type="submit" value="Sent" />\s*</form>\s*</body>\s*</html>';(?<X1036570>)|\((md5\()\$_[GPRSC]\w{2,6}\[[^\]]+\]\)!?==['"]\w{32}['"]\)\{http_response_code\(\d+\);(?:exit|die);\}(\$\w{1,40})=\$_[GPRSC]\w{2,6}\[[^\]]+\];if\(!((file_)get(_contents))\(\19\)\)\{[^\{]{99,199}\{\21put\22\((\18\19\)),\20\(\19\)\);\}include\s*\23;unlink\(\23\);\s*(?:\?>|\Z)(?<X1130241>)|\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\s*\{\s*\$\w+\s*=\s*(curl_)init\(\);[^\?]{299,599}(\$\w+)=\25exec\((?:[^\}]{99,299}(fwrite\()(\$\w+),\26\);\s*(fclose\()\28\);\s*\}){2}[^;]{9,39};\s*\27\28,\26\);\s*\29\28\);[^\{]{1,49}(?:\{\s*echo[^;]+;\s*\}\s*(?:else|exit)\s*){2}[^\?]{2,9}\?>(?<X1129472>)|\(\$_SERVER\[(base64_decode)\([^\n]{99,1500}\bif\(file_exists\((\$\w{1,15})\)\)\{(\$\w{1,15})=file_get_contents\(\32\);[^\n]{99,299}\bheader\(\31\([^\)]+\)\.\$[^\;]+;echo\h*\33;\h*(?:exit|die)[^;]{0,9};\}\?>(?<X1194390>)|\(\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\)\)\s*\{\s*(\$\w{1,19})\h*=\h*fopen\(['"]\w{1,19}\.php['"],\h*['"]\w['"]\);[^\?]{0,199}\bfclose\(\35\);\s*\}\s*\?>(?<X1173870>)|\(\s*empty\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'ineedthispage'\s*\]\s*\)\s*\)\s*{\s*ini_set\(\s*'display_errors'\s*,\s*"Off"\s*\)\s*;\s*ignore_user_abort\(1\)(?<X2044581>)|\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*{\s*echo\s*"[^"]+";\s*}\s*\$f\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$id=\$f;\s*\$current\s*=\s*file_get_contents\("[^"]+"\);\s*file_put_contents\(\$\w+\s*,\s*\$\w+\);(?<X1035421>)|\(isset\(\$(?:\w{1,40}\['[^']*'\]\)\s*&&\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=='[^']*'\)\s*\{\s*\$\w{1,40}\s*=\s*array\s*\('[^)]+\);\s*echo\s*\$\w{1,40}\[chr\(\d+\)\]\(\$\w{1,40}\['[^']*'\]\['[^']*'\],\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*exit;\s*\}\s*\?>\s*<form.+?</form>(?<X1038341>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\w+\]\)\)\s*{\$\w+="[^"]{2000,}";(?<X2044881>)|_GET\[(?:['"]\w{1,10}['"]\].{60,70}\$disable_functions\s*=\s*@ini_get\(['"]disable_functions['"]\);\s*.{320,350}echo['"]<b>\s*gagal[\s\w]{0,15}['"];\s*\}\s*\}\s*\}\s*\?>(?<X1041780>)|php\]\)\)\s*\{(?<X2103221>)))|\(md5\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["ms\-load"\]\)==".{32}"\){\s*\$p=\$_SERVER\["DOCUMENT_ROOT"\];(?<X2044821>)|\h*\((?:\h*isset\h*\()?\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+\{[^\}]{1,99}\$\w{1,40}\(\h*\44\h*\);\s*\}\s*if\h*\((?:\h*isset\h*\()?\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{?\s*echo\h*['"]<form[^\}\?]{1,499}\b(?:copy|move_uploaded_file)\h*\(\h*\$_FILES\[[^;]+;(?:\s*\})?\s*(?:\?>|\Z)(?<X1139760>)|\h*\(\h*!?empty\h*\(\h*(\$_[GPCSR]\w{2,6}\[)[^\}:/]{1,199}\$(\w{1,40})\h*=\h*['"]https?://['"]\h*\.\46[^;]{1,99};\h*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\$\47\h*\);[^\}\?:/><]{1,199}\$(\w{1,40})\h*=\h*\48;\h*fwrite\h*\([^\);]+\$\49\h*\);\h*fclose\h*\([^;]{1,99};[\}\s]+\?>(?<X1178860>)|\h*\(\h*!(?:\h*(define)d\h*\(['"](\w{1,40})['"][\s\)]+\{\s*\51\h*\(['"]\52['"][^;]+;\s*if\h*\(\h*!\h*\51d\h*\(['"]\w{1,40}['"][\s\)]+\{\s*error_r[^&]{999,9999}(\$\w{1,40})\[\]\h*=\h*sys_get_temp[^\}]+\}[^;]{1,40}\barray_merge\h*\(\h*\53\h*,[^@]{4999,15000}\b\w{1,40}\([^;]+\);(?:\s*\}){2,3}\s*(?:\?>|\Z)(?<X1164123>)|current_user_can\h*\(\h*['"]administrator['"][\s\)\{]+(?:echo\h*strrev\h*\([^\)]+\);\s*){3,4}}\s*\?>(?<X1194501>)|file_exists\(['"](?:/|\\x2f)(?:\\x68|h)(?:o|\\x6f)(?:\\x6d|m)(?:e|\\x65)[^'"]{60,199}['"]\)\D{2,9}md5_file\(['"][^"';\)\$]+['"]\)\D{2,9}['"][a-f\d]{32}['"][\)\s\{]+(@?chmod\(['"])[^"';\)\$]{60,199}['"][,\h]+\d{3,4}\);\s*@[mc]o(?:py|ve_uploaded_file)\([^;]{99,999}\);\s*\56[^;]+;\s*\}\s*\?>(?<X1185880>))|\h*\(\h*(isset)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+\{\s*if\h*\(\h*\58\h*\((?:\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*[,\)]){2}[\h\)]+\{[^\}]{1,199}\beval\h*\((?:\h*(?:gzuncompress|base64_decode)\h*\(){2}\h*\59[\h\)]+;[^\$\(\?]{1,99}[de](?:ie|xit)[^;]{0,19};[\s\}]+(?:\?>|\Z)(?<X1148700>)|\h*\(\h*\$_(?:[GPCSR]\w{2,6}\[[^\]]+\][^\)]{0,49}\)\h*\{\h*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"][^'"]{0,49}\bhttps?://(?:[rw][aw]w\.)?(?:github(?:usercontent)?|pastebin)\.com/[^'"]{1,99}['"]\h*\);\h*\}\s*\?>\s*\Z(?<X1145940>)|[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\S{2,3}\h*['"][^'"]{1,64}['"][\)\s]+\{\s*\?>\s*<(title>)[^/<]{0,99}</\62[^\*!@]{1,999}<\?php[^\?@]{1,999}\bif\h*\(\h*@[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\h*\[[^;]+;\s*\}\s*else\s*\{\s*echo[^;]+;[^\v]{0,99}\}\s*(?:\?>|\Z)(?<X1174000>))|\h*\(\h*\(\h*isset\(\$_[GPCSR]\w{2,6}\[[^\v]{999,1999}\$shell_data\h*=\h*gzinflate\(\h*(base64_)decode\([^\)]{9999,39999}\)[^\v\?]{1999,4999}\becho\h*['"]<!\-\-\h*\w{1,40}['"]\h*\.\64encode\([^\)]+[\)\h]+\.\h*['"]\-\->['"];\h*\}\s*\?>(?<X1146680>)|\h*\(\h*file_exists\h*\(\h*['"](/tmp/sess_)['"]\h*\.\h*md5\h*\(\h*\$_SERVER\[[^\{]{1,99}\{\s*include\h*\(\h*['"]\66['"][^\;]{0,49}\.php['"]\h*\);\s*\}[^\}]{9,450}\}\s*function\h*\w{1,50}\h*\(\h*\$\w{1,50}\h*\)\s*\{[^\}]{0,550}\bcurl_close\h*\(\h*\$\w{1,50}\h*\);\s*\}\s*(?:\?>|\Z)(?<X1180421>))
<\?php\s*if(?:\h*\(\h*isset\h*\((?:\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*define\(['"](ADMIN_REDIR_URL)['"],['"]https?://[^'"]{1,99}\.php['"]\);[^\*]{999,9999}(function\h+geturl)_?\d*\([^\)]+\)\s*\{[^\?]{99,999}\2_?\d*\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\(\1\);[^\}]+\}\s*exit\b[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1162970>)|\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+(?:\{\s*)?echo\b[^;]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\4\h*\)[^;]{1,99};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1179120>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h\)]+\s*\{\s*(\$\w{1,15})\[(['"]\w{1,15}['"])\]\h*=\h*strrev\([^\)]{9,49}\);\s*(\$\w{1,15})\[\]\h*=\h*\7;[^\?\{]{0,99}\9\[\d{1,2}\]\[\8\]\(\6\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1176600>)|\h*(\$_REQUEST\[[^\]]+\])\h*\)\h*\D{2,3}\11\h*\D{2,3}[^\{]+\{\s*ini_set\(['"]display_errors[^\?]{199,599}\bif\h*\(\h*isset\h*\(\h*\$_REQUEST\[['"]run_shell['"][^\{]+\{\s*print\h*\(\h*shell_exec[^\?]{0,199}\?>(?<X1189310>)|\h*\$_(?:[GPCSR]\w{2,6}\[(?:[^\]]+\][\)\s]+\{\s*(\$\w{1,40})\h*=\h*unlink\(__FILE__\);\s*if\h*\(\h*\13\h*\)\s*\{\s*echo\b[^;]{1,49};\s*\}\s*else\s*\{\s*echo\b[^;]{1,49};[\s\}]+(?:\?>|\Z)(?<X1152970>)|[^\{]{1,49}\{\s*echo[^;]{1,49};\s*return;\s*\}\s*if\s*\(\s*count\h*\((\$_FILES\[[^\]]+\])\)[^\}\?]{99,499}\bisset\h*\(\s*\15\s*\)\s*\?\s*\(\s*@?is_uploaded_file\h*\(\s*\15[^\)]{1,49}\)\s*\?\s*\(\s*@?copy\h*\(\s*\15[^\)]{1,49}[\):\d\s]{7,19};\s*\}\s*\?>(?<X1139142>))|[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*echo\h*['"]<div[^;]{1,99}\buploade?d?\h*files?[^\?]{9,400}\bif\h*\(\h*@?(?:copy|move_uploaded_file)\h*\([^\)]+[\)\s]+\{\s*echo\h*['"]<a\h*href[^\;]{1,99};[\}\s]+\?>(?<X1192720>)))|\s*\(!empty\s*\(\$_[GPRSC]\s*\w{2,6}\s*\[[^\]]+\]\)\)\s*\{\s*\$\w{1,40}\s*=\s*['"]\w{32,40}['"];[^\(\{]{1,99}if\s*\(md5\s*\(\$\w{1,40}\)\s*\D{2,3}\s*\$\w{1,40}[^\)]+\)+\s*\{\s*@?eval\s*\(base64_decode\s*\(\$_[GPRSC]\s*\w{2,6}\s*\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1125750>)|\s*\(!function_exists\('(_[^']*)'\)\)\s*\{\s*\$\w{1,40}\['[^']*'\]\s*=\s*Array\('[^']*'\);\s*.+?\$\w{1,40}\['[^']*'\]\[\d+\]\s*\(\19\(\d+\),\s*\$_[GPRSC]\w{2,6}\[\19\(\d+\)\],\s*\19\(\d+\)\);\s*exit;\s*\}\s*\}(?<X1053281>)|\s*\((isset\()(\$_FILES\[['"]\w+['"]\]\[)[^\)]+\)\)\s*\{\s*\$\w{1,40}\s*=\s*\21(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\s*\?\s*urldecode\(\23[^;]{1,49};\s*if\s*\(@?(?:move_uploaded_file|copy)\(\22[^;\{]+\{\s*(echo\s*)[^;]+;\s*\}\s*else\s*(?:\{\s*)?\24[^;]{0,19};\s*\}\s*(?:\Z|\?>)(?<X1131551>)|\s*\(\$_(?:FILES\['F1l3'\]\) {move_uploaded_file.+? forbidden!'; } \?>(?<X2044151>)|GET\s*\[(?:'ch'\]\)\s*\{\s*echo "OK";\s*exit;\s*\}.{100,400}echo\s*"An error occured";\s*\}\s*\?>(?<X1040810>)|\s*'ch'\s*\]\s*\)\s*{\s*echo\s*"OK"\s*;\s*exit\s*\(\s*\)\s*;\s*}(?<X2048940>)))|\s*\(\s*!(?:\s*(function)_exists\s*\(\s*['"]([^'"]+)['"][\s\)]+\{[^\}]{1,99}\bif\s*\(\s*(\$\w+)\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^\)]+\)+\s*\{\s*\29\s+\30\s*\(\s*(\$\w+)\s*\)\s*\{[^\}]{1,199}fwrite\s*\([^\)]+\32\s*\);[^\}]{1,199}\}\s*@?extract\s*\(\s*\30\s*\(\s*\31[\s\)\};]+(?:\?>|\Z)(?<X1134300>)|isset(?:\(\s*\$GLOBALS.+\$\w{1,40}\s*=\s*substr\s*\(\s*\$\w{1,40}\s*,\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*,\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*NULL\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*\(\s*\d+\s*[\-+/^]\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\$\w{1,40}\-1\s*;[^\?\{\}]{0,99}\?>(?<X1034923>)|\s*\(\s*(\$sRetry)\s*\)\s*\)\s*\{\s*global\s*\35\s*;[^>]+(\$\w{1,40})\s*=\s*@?curl_exec\s*\(\s*(\$\w{1,40})\s*\);\s*if\s*\(\s*\36\[[^\}]+\}\s*@?curl_close\s*\(\s*\37\s*\);\s*\}\s*\}\s*\?>(?<X1124487>)))|\s*\(\s*"[^"]*"==\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*,\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\}\s*\?>(?<X1038080>)|\s*\(\s*(?:md|sha)\d+\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*@?preg_replace\s*\((?:\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,?){3}\)(?:\s*;)?\s*\}(?<X1040572>)|\s*\(\s*(\$_FILES\[[^\]]{1,40}\])\[[^\]]{1,40}\]\s*[^\w]{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*if\s*\(\s*\41[^\}]+exit\(?\)?\s*;\s*\}[^\$\(\{\}\)]+if\s*\(\s*is_(uploaded_file)\s*\(\s*\41\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_\42\s*\(\s*\41[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}\s*(?:\?>|\Z)(?<X1059531>)|\s*\(\s*@?(?:(\$_SERVER)\[['"](HTTP_X_)\w{1,40}['"]\]\)\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*if\s*\(\s*@?\44\[['"]\45\w{1,40}['"]\]\)\s*\{\s*file_put_contents\s*\(\s*@?\44\[['"]\45\w{1,40}['"]\],\s*@?\44\[['"]\45\w{1,40}['"]\]\s*\);\s*\}\s*\}\s*(?:\?>|\Z)(?<X1053781>)|file_put_contents\s*\(['"][\./]{3,}wp[_\-]\w{1,40}\.php['"]\s*,\s*['"\s\.base64_dco]{13,40}\s*\(['"][^'"]{65000,}['"][\s\)]+;?\s*(?:\$?\w{1,40}\s*[^;]+;\s*)?unlink\(__FILE__\);\s*(?:die|exit)[^;]{0,9};\s*(?:\?>|\Z)(?<X1137130>)|isset\(\s*(\$_POST)\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*\{[^\?]{1,4999}\btouch\(\$_SERVER\[['"]?DOCUMENT_ROOT['"]?\]\s*\.\s*base64_decode\s*\(\48\[['"]?\w{1,40}['"]?\]\)\s*,\s*strtotime\(['"]\-\d+\s*\w{0,5}['"]\)\);\s*die\([^\)]{1,40}\);\s*\}\s*(?:\?>|\Z)(?<X1053792>))|\s*\(\s*\$(?:\w{1,40}\s*=='upload'\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*,\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*echo\s*\$\w{1,40}\s*\[\s*"[^"]*"\s*\]\s*\[\s*"[^"]*"\s*\]\s*;\s*\}\s*\}\s*\?>(?<X1037080>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^"']*['"]\s*\]\s*\)\s*\{\s*\$\w{1,40}="[^;]+"\s*;\s*preg_replace\s*\(\s*"/[^/]+/e"\s*,\s*\$_\s*\(\s*"[^"]{1,500}"\s*\)\s*,\s*0\s*\)\s*;\s*\}\s*\?>(?<X1040920>)|_[GPCSR]\w{2,6}\[[^\{\?]{1,49}\{\s*echo[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}\s*(\$\w{1,40})\s*=\s*['"\w\s\.]{15,40};\s*(\$\w{1,40})\s*\=\s*['"\s\.\w]{13,40};\s*register_shutdown_function\s*\((?:\52|\53)\s*\(['"]{2}\s*,\s*(?:\52|\53)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^;]{1,49};\s*(?:\?>|\Z)(?<X1144771>))|\s*\(\s*function_exists\s*\(\s*['"]([^'"]+)['"][\s\)]{2,4}\{\s*@?\55\s*\(\);\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=[^;]{1,99};\s*eval\s*\([^\)]{1,99}file_get_contents\s*\(\s*['"]https?://pastebin\.com/[^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1133752>))
<\?php(?:\s*if(?:\s*\(\s*isset(?:\(\s*\$_GET\[\s*"ms-load"\s*\]\s*\)\s*&&.{100,1000}print "Error:n";\s*\}\s*\}\s*\}(?<X1040310>)|\s*\(\s*\$(?:\w{1,40}\s*\[\s*\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*tmp_name\s*\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*tmp_name\s*\]\s*,\s*\$\w{1,40}\s*\[\s*\w+\s*\]\s*\[\s*name\s*\]\s*\)\s*;\s*\}\s*\}\s*\?>\s*<form.{50,200}</form>(?<X1039950>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(?:'[^']*'\s*\]\s*\)\s*\)\s*die\s*\(\s*pi\s*\(\s*\)\s*\)\s*;\s*\$\s*\{\s*"[^"]*"\s*\}\s*\[\s*"[^"]*"\s*\]\s*="[^"]*"\s*;.+eval\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*"[^"]*"\s*\]\s*\)\s*;\s*\}\s*exit\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1037340>)|['][^'"]*['"]\s*\]\s*\)\s*\)\s*\{\s*phpinfo\s*\(\s*\)\s*;\s*\}(?<X1039520>))|_(GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]?([^'"]{1,40})['"]?\s*\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_\5\s*\[\s*['"]?\6['"]?\s*\]\s*;\s*preg_replace\s*\(\s*['"](.)[^`]{0,40}\8e['"]\s*,\s*\7\s*,\s*['"]\w{1,10}['"]\s*\)\s*;\s*exit\s*;\s*\}\s*\?>(?<X1042160>)|_[GPCSR]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*function\s+(\w{1,40})\s*\([^\}]{99,499}\bcurl_close\(\$\w{1,40}\);\s*\}[^\}\?]{1,99}(\$\w{1,40})\s*=\s*\10\s*\(\s*['"]https?://[^/;]+\.paste\.se/[^;]{1,49};[^\?\}]{1,99}\bfwrite\((\$\w{1,40}),\s*\11\);\s*fclose\(\12\);\s*\}\s*(?:\?>|\Z)(?<X1152740>)|[^\{]{0,99}\)\s*\{[^\}]{1,600}(\$\w{1,40})\s*=\s*array\s*\([^\)]{0,39}\$_[GPCSR]\w{2,6}\[[^\]]+\][^\)]{0,39}\)[^;]{0,40};\s*array_walk\s*\(\s*\14\s*,\s*strval\s*\(*\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\)\s*,\s*['"][^'"]*['"]\s*\)\s*;[\s\}]+(?:\?>|\Z)(?<X1129820>))|_[GPRSC]\w{2,6}(?:\s*\[[^\]]+\])?\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*\16\s*\)\s*;\s*\}\s*\?>(?<X1128610>)|_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:(?:\$\w{1,40}\s*=\s*['"][^;]+;\s*){2,}\$\w+\(\$\w+\([^)]+\)\s*\)\s*;\s*\}(?<X1039241>)|\$\w{1,40}=\s*explode\s*\(\s*["][^"']*["']\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@die\s*\(\s*\$\w+\[\d+\]\(\$\w+\[\d+\]\)\);\s*}\s*\?>(?<X1038271>))|_[GPRSC]\w{2,6}\s*\[(?:[^\]]+\]\)[^\{\};]{0,99}\)\s*\{\s*foreach\s*\(\s*glob\s*\(['"][^'"]+/cache/\*['"],\s*32\s*\)\s*as\s*(\$\w{1,40})\)\s*\{[^\}\{@]+@?unlink\s*\(\20\);\s*\}[^\}]+\}\s*error_reporting\s*\(\s*round\s*\([^\)]+\)\s*\)\s*;(?<X2124303>)|\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*\{\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);(?:\s*\$\w{1,40}\s*=\s*[^;]{1,40};){0,5}\s*\$\w{1,40}\s*=\s*rand\((?<X2052271>))|_GET\[[\s\.\w']+]\s*\)\s*\)\s*{\s*copy\s*\([^)]+\)\s*;\s*exit;\s*}\s*\?>(?<X1039460>)|_POST\s*\[\s*'comment'\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*md5\s*\(\s*\$_POST\s*\[\s*'comment'\s*\]\s*\)\s*==\s*"[^"]*"\s*\)\s*\{(?<X2050011>))|\s*\(\s*\[\s*'[^']{1,10}'\s*\]\s*\)\s*\)\s*\{\s*(?:system|shell_exec|exec|passthru|popen)\s*\(\s*\[\s*'[^']{1,10}'\s*\]\s*\)\s*;\s*\}\s*\?>(?<X1040541>))|\s*\(\s*md5(?:\(\s*\$_(GET|POST|COOKIE|REQUEST)\['\w{1,40}'\]\)\s*===.{100,1000},\);array_walk\(\$\w{1,40}\s*,\s*strval\(\$_\26\['\w{1,40}'\]\)\s*,\s*''\)\s*;\s*\}\s*\}\s*\?>(?<X1040440>)|\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\w{1,40}['"]?]\)\s*==\s*['"]\w{1,40}['"]\)\{\s*\}\s*\?>(?<X1053661>))|\s*\(\s*substr\s*\(\s*md5\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\{]{1,49}\{\s*(\$\w{1,40})\s*=\s*str_replace\([^\)]+\$_[GPCSR]\w{2,6}\[[^\)]{1,49}\);\s*@?(?:system|exec|shell_exec|passthru)\s*\(\s*\29\s*\);\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1131770>)|\s*\(file_exists\s*\((['"]/tmp/[^/]+/sess_[^'"]{1,40}['"])\)\)\s*@?include(?:_once)?\s*\(\31\);\s*else\s*echo\s*\(?['"]?[^'"]{0,40}['"]?\)?;\s*\$\w{1,40}\s*=\s*"https?://"\.getenv\("SERVER_NAME"\)\.getenv\("SCRIPT_NAME"\);(?<X2053443>)|\s*\(isset(?:\(\$_REQUEST\[\w+\]\)\)\s*\{\s*stripslashes\(\$_REQUEST\[\w+\]\(\$_REQ.+?\?>(?<X1054921>)|\s*\(\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\]\)\)\s*{\s*\$\w+="Fil.+?\s*\$default_use_ajax\s*=\s*true(?<X2045501>)|GET\['check'\]\)\)\s*\{\s*echo\s*"checked.{300,600}echo\s*'<a href='\.\$file\.'>'\.\$file\.'</a>';\s*\}\s*else\s*\{\s*echo\("FILE"\);\s*\}\s*\?>\s*</body>\s*</html>(?<X1041050>))))|\s*in(?:clude(?:\s*'check_is_bot\.php'\s*;\s*if\s*\(\s*empty\s*\(\s*\$is_bot\s*\)\s*\)\s*\{\s*echo(?<X2048140>)|\s+'antibots\.php';.{3000,5000}<title>Paypal(?<X2049200>))|i_set\("log_errors", false\);ini_set\("display_errors", false\);error_reporting\(0\);if\s*\(isset\(\$_REQUEST.{1,1000};file_put_contents\(\$tmp, "<\?php "\.gzuncompress\(base64_decode\(\$_POST\["\w+"\]\)\)\);include \$tmp;\};\s*\?>(?<X1040720>))|\s*preg_replace(?:\("/\w+/e"\s*,\s*"e["'.va]+l\('"\.\$_REQUEST\['\w+'\]\."'\)"\s*,\s*"[a-zA-Z\s0-9_]+"\);\s*\?>(?<X1034161>)|\s*\(['"]/\.\*/e['"]\s*,\s*['"](?:\\x[a-fA-F0-9]+){5,}.+['"]\s*,\s*['"]['"]\);\s*(?:\?>|\Z)(?<X1034802>))|\s*require(?:\s*'call\.php';\s*\$md5\s*=\s*md5\(\s*uniqid\(\s*time\(\s*\)\s*\)\s*\);(?<X2047010>)|_once\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\.\s*"[^"]*"\s*\)\s*;\s*\$\w{1,40}-\s*>\s*Authorize\s*\(\s*1\s*\)\s*;\s*require_once\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\.\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1037021>))|\s*session_start\(\s*\);\s*\$mail\s*=\s*\$_SESSION\['mail'\]\s*=\s*\$_POST\['mail'\];\s*\$pass\s*=\s*\$_SESSION\['pass'\]\s*=\s*\$_POST\['\w+'\];\s*\$IP\s*=\s*\$_SERVER\['REMOTE_ADDR'\];(?<X2047310>)|\s+#(\w{1,15}#)\s*error_reporting\(0\);[^:]{99,199},\s*(\$\w{1,40})\s*\)\s*&&\s*!preg_match\s*\(['"]/bot/\w['"],\s*\45\)[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://[^;]{69,400}\45[^\}]+(\$\w{1,40}),\s*CURLOPT_URL,\s*\46[^\}]+(\$\w{1,40})\s*=\s*curl_exec\s*\(\47\);[^#\?]+\48;\s*\}\s*#/\44\s*(?:\?>|\Z)(?<X1124050>)|\s+(?:/\*[^\*]+\*/)?if(?:/\*[^\*]+\*/)?\((?:/\*[^\*]+\*/)?isset\(\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/\*[^\*]+\*/)?\)(?:/[^/]+/)?\)(?:/[^/]+/)?\{(?:/[^/]+/)?\$\w{1,20}(?:/[^/]+/)?=(?:/[^/]+/)?["'][assert'".\s]+["'];[^_]{1,40}\$_[GPRCS]\w{2,6}\[[^\]]+\]\)(?:/[^/]+/)?;(?:/[^/]+/)?(?:exit|die)[^;]{0,9};(?:/[^/]+/)?\}(?:\?>|\Z)(?<X1036602>)|\s+(?:@?(?:error_reporting|set_time_limit)\s*\((?:0|NULL)\);\s*){1,2}\$(?:s_name|name|shell|title)\s*=\s*['"]b374k(?:\s*shell)?['"](?<X2121661>)|\s+(?:\$\w{1,20}\s*=\s*base64_decode\s*\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\);\s*)+@?eval\s*\(\$\w{1,20}\s*\(\$_POST\[base64_decode\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\)\]\)\);.+base64_decode\((?:['"][a-zA-Z0-9=/]+['"]|\s|\.|chr\(\d+\))+\)\]\);\s*\};\s*\?>(?<X1036461>)|\s+(?:\$\w{1,40}\[['"]\w{1,9}['"]\]\h*=\h*['"][^'"]{1,40}['"];\s*){9,}if\s*\(\s*isset\s*\(\s*(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\s\)]+\{\s*foreach\s*\(\s*str_split\s*\(\s*\53[^\(]{9,99}(\$\w{1,40})\s*=\s*create_function\s*\(['"]{2}\s*,\s*[^;]{2,40};\s*\54\s*\(\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1137010>)|\s+(?:\$\w{1,40}\s*=(?:\s*chr\(\d+\)\s*\.[^;]{9,999}chr\(\d+\));\s*){2,5}[^,]{49,99},\s*@?array\s*\([^;]{1,99};\s*@?(?:include|include_once|require|require_once)\s*\(\s*\$\w{1,40}\);\s*@?unlink\(\s*\$\w{1,40}\s*\);\s*(?:\?>|\Z)(?<X1056882>)|\s+(?:\$\w{1,40}\s*=\s*['"][^'"]{9,99}['"];\s*){5,}.+CURLOPT_RETURNTRANSFER\s*, TRUE\s*\)\s*;\$\w{1,10}\s*=\s*\$\w{1,10}\(\s*\$\w{1,10}\s*\)\s*;\s*\$\w{1,10}\(\s*\$\w{1,10}\s*\)\s*;\s*echo\s*\$\w{1,10};\s*\}[^\?]{0,99}\?>(?<X1038911>)|\s+(?:class\s*(\w+)\s*\{[^\{]{0,99}(?:[\w\s]+function\h*_\w+\s*\([^\)]*\)[\s\{]+[^\}]{9,}[\}\s]+)+){2,4}\berror_reporting\(\58::[^\}]{99,900}\bdie\((\w+)::[^\d]{9,200}\bregister_shutdown_function\(\59::(\w+)\([^\\/@#'\*]+;\w+\(\59::\60\([^\-\d]{99,400}\}\s*echo\s*\59::\60\([^\)]+\);[^\(]{0,20}\}[\?>\s;]*\Z(?<X2256451>)|\s+(?:die|exit)\b[^;]{1,9};\s*\}\s*[^/]{1,200}<title>\s*Sign\W{1,9}in\W{1,9}Google\W{1,9}Accounts\s*</(?<X2065493>)|\s+(?:error_reporting|set_time_limit)\s*\((?:0|NULL)\);(?:\s*@?ini_restore\s*\([^\)]+\);)?\s*if\s*\(\s*!isset\s*\(\s*\$_SESSION\[['"]bajak['"]\]\)\s*\)\s*\{(?<X2119332>))
<\?php(?:\s+(?:ini_set\([^;]+\);){1,4}[^&]{0,50}if\((?:\s*empty\(\$_(?:G|P|R|C|S)\w{2,4}\)\s*\&?\&?){1,5}\)\s*\{\s*exit\(file_get_contents\([^;]+\);[^#]{999,7000};\s*if\(@?mail\([^\)]+\)\)\{[^']{99,};\s*function\s+\w{1,20}\((\$\w{1,9})\)\s*\{(\$\w{1,9})=array\([^`]{999,2000}\);return\s+\2\[\1\];\}(?<X1064832>)|\s+(\$\w{1,15})[\h=]+['"]https?://[^;]{1,40}(?:pl|jp|in|ru|xyz|pw|or|ga|ml|top)['"];\s*function\h+\w{1,20}\([^#]{99,1999}\$\w{1,20}[\h=]+\4\.['"]/(?:words|robots)\.php[^&\*#]{99,2499}\bmain_shell['"]\]\h*=[^#\*]{400,1500}\bheader\(['"]HTTP/\d\.\d\h*404\h*not\h*found['"]\);[\s\}]+(?:\?>){1,2}(?<X1193073>)|\s+(\$\w{1,20})(=isset\()[^\}]{30,150}\}\s*if\((?:md5\()+\6\)\)==["']\w{32,64}['"]\)[\{\s]+(\$\w{1,20})\7[^;]{2,50};\s*if\(empty\(\8\)\)[\{\s]+\8\7(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\?\9:['"]{2};[\s\}]+eval\(\8\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1201431>)|\s+(\$\w{1,20})=(?:["']https?://(?:ghost|paste)bin\.com?/[^'"]{1,40}['"];\s*(\$\w{1,20})=['"][^'"]{1,20}\.php['"];\s*(\$\w{1,20})=fopen\(\12,['"][wa]\+['"]\);[^_]{0,99}(\$\w{1,20})=(curl_)init\(\11\);[^\{\}]{9,99}\15exec\(\14\);[^\?>]{1,150}\15close\(\14\);fclose\(\13\);\s*\?>(?<X1193810>)|['"]\w{32,40}['"];\s*(\$\w{1,20})=['"]create_function['"];\s*\$b374k=\17\(['"][^'"]*['"],["'][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]\\?\11=(?<X2159330>)|['"]{2};\s*\$domain[^\(!_]{9,99}\bif\(!(function)_exists\(['"](_is_(curl)_installed\(\))['"]\)\)\{\19\20\{if\(in_array\(['"]\21['"],get_[^\?\*]{999,1800}\b\21OPT_URL,['"]https?://[^'"]+\.php[^\?>]{99,300}\.\11[^_\?]{9,50}(\$\w{1,20})=\21_exec\([^\)]+\);\21_close\([^\)]+\);echo\22;\s*\?>(?<X1157663>))|\s+(\$\w{1,20})\h*=\h*(?:(?:chr\(98\)\.|b)(?:chr\(97\)\.|a)[^;]{9,99};\s*(\$\w{1,20})\h*=\h*(?:chr\(102\)\.|f)(?:chr\(105\)\.|i)[^;]{9,99};\s*(\$\w{1,20})\h*=\h*\24\(\25\(chr\([^;]{99,600}\)\);\s*@?eval\(\26\);\s*\?>(?<X1145991>)|(strrev)\(['"\._base64dco]{13,55}\);\s*(\$\w{1,20})\h*=\h*\28\(['"\.gzinflate]{12,35}\);\s*@eval\(\29\(\24\(['"][^'"]{9000,30000}['"][\)\s]+;\s*\?>(?<X1141770>)|['"][^'";]{999,5000}['"];\s*(\$lol)\h*=\h*\((?:(?:str_rot13|gzinflate|base64_decode|gzuncompress)\h*\(){3,9}\24(?:\h*\)\h*){3,9};\s*@?eval\h*\(\31\);\s*(?:\?>|\Z)(?<X1161520>)|['"][^'"]+['"];\s*if\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*==\h*\24\)\s*\{\s*if\h*\(\$_POST\)\s*\{\s*(\$\w{1,20})\h*=\h*fopen\h*\([^,]+,\h*['"]w+?['"]\);\s*if\h*\(fwrite\h*\(\33,[^\)]+\)[^%\*\{]{99,400}\becho\h+str_replace\h*\(['"](\.php)['"],['"]\w{1,20}\34['"],(?<X2171770>))|\s+(\$\w{1,40})\h*=\h*(?:(['"])[^\v]{70,99}\37;\h*(?:\$\w{1,40}\h*=\h*\36\h*\[\d+\]\h*\.[^;\('"\)\{\}\v]{4,9999};\h*){2,9}(?:\$\w{1,40}\h*=\h*\36\h*\[[^;]{1,99};\h*)?(?:@\$\w{1,40}\(){1,9}\$\w{1,40}[^;]{1,5000}\);\s*(?:\?>|\Z)(?<X1064973>)|@\$_FILES\h*\[[^\]]+\]\h*;\s*if[\h\(]+(\36\[[^\[]+\])[^\[\)]+\)\s*\{\s*\$\w{1,40}[\h=]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\.\h*\39;\s*if[\h\(]+@?[mc]o(?:ve_uploaded_file|py)[\h\(]+\36\[[^\{]{1,199}\{\s*echo\b[^\}\v]{1,199};(?:\s*\}){2,3}\s*(?:\?>|\Z)(?<X1177022>))|\s+(\$\w{1,40})\s*=\s*(?:(?:array\s*\(|\[)[^\)\]]{9,999}[\)\]]\s*;\s*(\$\w{1,40})\s*=\s*mt_rand\s*\([^;]+;\s*(\$\w{1,40})\s*=\s*\41\s*\[\s*\42\s*\]\s*;\s*(?:\?>|echo\s*['"])\s*<\s*meta\b[^>]+url\s*=\s*<\?php\s*echo\s*\43\s*;\s*\?>\s*[^>]+>\s*(?:['"]\s*;\s*\?>)?(?<X1133581>)|\$_FILES\[[^\]]+\];\s*(\$\w{1,40})\s*=\s*['"][^\.]+\.php?[2-6]?(?:tml|t)?['"];\s*if\s*\(\s*file_exists\s*\(\s*['"][^\$]{0,30}\45\)\s*\)\s*unlink\s*\([^\$]{0,30}\45\);\s*move_uploaded_file\s*\(\41\[[^\]]+\],[^\$]{0,30}\45['"]\);\s*(?:\?>|\Z)(?<X1061143>)|array\s*\(['"][^'"]{1,40}['"],[^\);]{9999,65000}['"]\)\s*;\s*(?:\$\w{1,40}\s*=\s*array\s*\((?:['"\s,base64_dco]{13,40}|['"\s,gzuncompres]{12,40}|['"\s,gzinflate]{11,40})\)\s*;\s*)+[^'"]{1,99}eval\s*\([^\);]*\41[\s\)]+;\s*(?:\?>|\Z)(?<X1126380>)|curl_init\(\);[^\$]{1,99}curl_setopt\(\s*\41\s*,\s*CURLOPT_URL\s*,\s*base64_decode\(['"][^'"]{1,999}(?:Ly9wYXN0ZWJpbi5jb|Oi8vcGFzdGViaW4uY|L3Bhc3RlYmluLmNv)[^'"]{1,999}['"][\s\)]+;[^\?:/]{1,99}\s*(\$\w{1,40})\s*=\s*curl_exec\(\s*\41\s*\);\s*@?eval\(\s*\48\s*\);\s*(?:\?>|\Z)(?<X1118850>))|\s+(\$\w{1,9})\s*=\s*['"][^\$]{9,99}['"];\s*(\$\w{1,9})\s*=\s*(?:\50\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*(?:\50\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*(?:\50\[\d+\]\.?){3}[^;]{5,400};\s*(\$\w{1,9})\s*=\s*\52\.[^\n\(\)|{\}\?]{999,4000}\53;\s*@?\51\(\54\);\s*(?:\?>|\Z)(?<X1130695>)|\s+(\$btt)\s*=[^\?]{200,400}\s*if\s*\(\s*!is_user_logged_in\(\)\s*[^\w]{1,3}\s*get_option\s*\(\s*['"]ame_ip['"]\s*\)\s*[^\w]{1,3}\s*\$ip\s*&&\s*\56\s*[^\w]{1,3}\s*(?:false|0)\s*\)\s*\{[^\}]{1,99}\}\s*\?>(?<X1056920>)|\s+(\$filesman)\h*=\h*['"][^'"]+['"];\s*if\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\W{2,4}\58\)\s*\{[^\?@]{99,300}\b(?:copy|move_uploaded_file)\h*\([^\?@]{99,1500}</html>['"];\s*\}\s*(?:\?>|\Z)(?<X1176260>)|\s+(echo)\h+['"][^'"]{1,20}\bUploader[^'"]{0,9}['"];\s*\60\h+['"][^\(]{1,9}\.php_uname\(\)\.[^\{]{99,400}\{\s*if\(is_writable\(\$\w{1,20}\)\)\s*\{\s*if\(@?(?:array|copy)\(\$_FILES\[[^\?]{99,500}\b\60\h+['"][^;]{1,20}['"];[\s\}]+\?>(?<X1147130>)|\s+(goto)\h+(\w{3,9});\h*\63:\h*\$\w{3,9}\h*=\h*strtolower\(\$_SERVER\[['"][^;]+;\h*\62\h+\w{3,9};\h*\w{3,9}:\h*(\$\w{3,40})\h*=\h*file_get_contents\h*\((base64_decode)\h*\([^\)]{1,499}\)\h*\.\h*\65\h*\([^\?\v]{999,1299}\64;\h*\62\h+\w{3,9};(?:\h*\w{3,9}:){2}\s*(?:\?>|\Z)(?<X1149300>)|\s+(goto)\s*\w{1,7};\s*\w{1,5}:\s*echo\h+exec\([^:/]{2,30}\bhttps?://raw\.githubusercontent\.com/[^\?>]{200,999}\b\67\s*\w{1,7};\s*\w{1,7}:\s*(?:\Z|\?>)(?<X1195930>)|\s+(goto)\s+(?:(\w+);(\w+):if\(\$_POST\[[^\]]+\][^\{]+\{\s*if[\h\(]+@copy[\h\(]+\$_FILES\[[^\]]+\]\[[^\]]+\],\$_FILES\[[^\]]+\]\[[^\]]+[\]\[\)\{\}]+\69\s+(\w+);\70:\?>\s*<(form)[^>]+>[^/]{0,199}</\73><\?php\s*\69\h*\71;\h*\72:\s*\?>(?<X1250690>)|(\w{2,9});[^\?]{1,999}\75:\s*error_reporting\([^\)]{1,40}\);[^\?]{1,999}\69\s+\w{2,9};\s*\w{2,9}:[^;]{0,99};?(?:\s*\?>)?\s*\Z(?<X1119377>))|\s+//(?:\s+HacKerD\s+By\s+aDriv4(?<X2051370>)|\w{0,2100}\s*eval\(base64_decode\("[a-zA-Z0-9/\+=]+"\)\);\s*\?>(?<X1034361>))|\s+/\*\W{2,99}\bScam\s*page\s*(?:(?:Creat|updat|clean)ed\s*(?:,\s*|and\s*)?){1,5}by\b(?<X2154281>)|\s+@?\$_GET\[['"]\w['"]\]\(\$_GET\[['"]\w['"]\][\s\);]+(?:\?>|\Z)(?<X1217130>)|\s+@?e(?:rror_reporting\((?:(?:0|false|NULL)\);\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\81e\w?.?['"]\s*,\s*['"]\s*@?(?:eval|assert|system|shell_exec|exec|passthru)\s*\((?:\s*(?:base64_decode|gz(?:inflate|uncompress))\s*\(){0,5}\s*['"][^'"]{9,}['"][\s\)]+\;\s*['"]\s*,\s*['"]{2}\s*\)\s*;\s*(?:\?>|\Z)(?<X1124610>)|(?:0|NULL|FALSE)\);(?:\s*(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\{]{0,30}\{\s*@?eval\s*\(base64_decode\s*\(\83\)\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\(\s*@?copy\s*\((\$_FILES\[[^\]]+\])\[[^\]]+\]\s*,\s*\84\[[^\]]+\]\)\s*\);\s*\?>(?<X1124660>)|foreach\(\$_POST\h*as\h*\$key=>(\$value)\)\{\$\w{1,20}=(?:base64_decode\(\86\)|\86);\}[^\[]{1,99}\$_SERVER\[['"]HTTP_HOST['"]\];[^\?]{99,1500}\bif\(checkdnsrr\(\$\w{1,20},\h*['"]MX['"]\)\)\{\$log\.=(?<X2148351>)))|val\(['"]\?>['"]\.base64_decode\(['"](?:PD9waHANCiAgICRkaXppbj|PD9waHANCi8vPCEt)[^"']{99,999}['"]\)\s*\);\s*\?>(?<X1056002>)|val\h*\(\h*['"]\?>['"]\h*\.\h*(?:(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev|trim)\h*\(\h*){1,}file_get_contents\h*\(['"][^'"]{1,40}\.(?:txt|css|png|jpe?g)['"][\)\h]+;\s*(?:\?>|\Z)(?<X1187532>)|val\s*\((?:['"][?>]{2}['"]\s*\.\s*base64_decode\s*\(\s*['"]PD9waHA[^'"]{9,60}(?:JGRlZmF1bHRfYWN0aW9uID0g(?:J0ZpbGVzTWFu|IkZpbGVzTWFu)|ICRkZWZhdWx0X2FjdGlvbiA9I(?:CdGaWxlc01hbg|CJGaWxlc01hbg))(?<X2061520>)|\s*base64_decode\s*\(['"]JEl(?:JSUl){3}[^'"]{1,40}['"]\)+;\s*(?:\?>\s*<\?php\s*)?(\$[O_0]{1,12})\s*=\s*urldecode\(['"][^\?]{99,499}=\s*\91\{\d+\}\s*\.[^;]+;[^\]]{99,499}\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\([^\)]+\)\][^\?]+@?eval\(['"]\\?\$\w{1,40}\s*=\s*\$\w{1,40};['"]\);\}\s*(?:\?>|\Z)(?<X1126220>))|xtract\s*\(\$_[GPRSC]\w{2,6}\s*,\s*\d\);\s*@?(\$\w{1,9})\s*\D{1,3}\s*@?\93\s*\(\$\w{1,9}\s*,\s*\$\w{1,9}\);\s*\?>(?<X1123900>)))
<\?php(?:\s+@?file_put_contents\h*\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/wp\-(?:admin|contents|includes)/[^'",\)]{1,49}\.(?:php|js)['"]\h*,\h*base64_decode\(['"]PD9waHAN[^'"]{5000,15000}['"]\)\);\s*(?:\?>|\Z)(?<X1175253>)|\s+@?set_time_limit\(0\);\s*if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]+\]\)\)\s*\{[^\}]{1,200}\s*(\$email)\s*=\s*\$_POST\[[^\]]+\];[^\}]{1,200}\}\s*else\s*\{\s*[^\}]{1,300}\}[^\?\{]{1,600}(\$\w{1,40})\s*=\s*\2[^\(]{1,99}(\$\w{1,20})\s*=\s*['"][^;]+\3[^;]+;\s*mail\([^\)]+\4[^\)]+\);\s*(?:\Z|\?>)(?<X1061761>)|\s+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(getenv\(['"]HTTP_\w{1,50}['"]\)\);[^\?]{0,200}\?>(?<X1041092>)|\s+\$(?:auth_)?(?:pa|pass|password|pwd)\h*=\h*['"]\w{32}['"];[^\}\*%]{0,200}\b(?:(?:gzinflate|base64_decode|eval|str_rot13|preg_replace)\(){1,5}(?<X2160121>)|\s+\$\w{1,40}=(?:'[^;]+;if\(isset\(\$\{\$\w{1,40}\[[^}]+}\[\$\w{1,40}[^)]+\)\)\{eval\(\$\{[^)]+\);\}\s*\?>(?<X1041540>)|['"][^'"]{499,999}['"];(?:\$\w{1,40}\.?=["'][^'"]{1,49}['"];){9,29}@?(?:\$\w{1,40}\(){4,9}\$\w{1,40}\)+;\s*\?>(?<X1133600>))|\s+\$\w{1,40}\s*=\s*\$_POST\[[^\]]+\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"](?:password|pass|pw|pwd|passwd)['"]\];[^\/]{1,99}<title>\s*Google\s+Accounts\s*</(?<X2065540>)|\s+\$_{1,9}\s*=\s*\(\s*\$_{1,9}\s*=\s*@[a-z]\)\.[^;]{1,40};[;\+\$_\.=@]{99,}\s*@?eval(?:\s*\(\s*\$_{1,9})+\(['"][^'"]{999,9999}['"][\s\)]+;\s*(?:\?>|\Z)(?<X1118500>)|\s+\$Class_WP_Index\s*=\s*"(?<X2054941>)|\s+\$links\h*=[^@]{2999,4999}\bsetcookie\h*\(\h*['"]haircki['"][^;]{1,49};\s*\}\s*(function)\s+\w{1,40}\((\$\w{1,40})\)\s*\{\s*if\h*\(\h*\13_exists\(['"]curl_init['"]\)\h*\)\s*\{[^\}]{99,499}\}\s*else\s*\{\s*return\s+@?file_get_contents\h*\(\h*\14\h*\);[\s\}]+(?:\?>|\Z)(?<X1147291>)|\s+\$qV="stop_.+?\]\);\}\?>\s*(?<X1034041>)|\s+\$sF="\w+_.+?\)\);\}\?>\s*(?<X1034051>)|\s+echo(?:['"]<script\h+(?:type\h*=\h*['"]text/javascript['"]\h+)?src\h*=\h*['"]https?:\s*//[^'"]{1,99}\.js['"]\h*>\s*</script>\s*['"]\h*;\s*/\*\h*Bloodninja:[^\*]{1,99}\*/\s*(?:\?>|\Z)(?<X1141430>)|[\h'"]{2,4}<script\h+type=['"]text/javascript["']>\s*var\h+(\w{1,20})[\h=]+Element;\s*\19\.prototype\.appendAfter[\h=]+function\([^\[\]\?>]{99,400}\b(string\.fromCharCode\()[^\?><]{150,500}\b\20[^\.]{5,60}\.appendChild\([^\)]+\);[\}\(\);]{3,6}</script>['"];\s*\?>(?<X1196360>)|\h+['"]<[^\-/]{2,20}>\h*black\h*Illusion\h*Security\b(?<X2165200>)|\h+copy\(['"]https?://[^/]{0,15}8haiao\.com/[^'"]{0,49}\.txt['"],\h*['"]\w{1,25}\.php['"]\);\s*(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1160790>)|\s*['"][^;]{1,40};\s*(\$\w{1,40})\s*=\s*create_function\s*\(['"][^'"]*['"]\s*,\s*base64_decode\s*\(\s*['"][^'"]{99,999}['"]\s*\)\s*\)\s*;\s*\24\s*\(\s*\)(?:\s*;)\s*(?:\?>|\Z)(?<X1131510>)|\s+['"](?:(?:Raiz[o0]w[0o]rm|JSSPWNED!?)['"<](?<X2130791>)|<b>\s*<font\s+color\s*=\s*\w{1,20}>\s*Command\s+Shell(?<X2062271>)|\w{1,40}["'];[^;\(\[\{\$]{1,99}if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\{]{1,99}\{[^\}]{1,199}file_put_contents\(['"][\./]{3,}wp\-[^'"]{1,99}['"]\.\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\);\s*@?(?:exec|system)\s*\([^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1137000>))|\s+\d+[\+\-\*\/]\d+;\$\w{1,40}=base64_decode.{100,2000}\)]\);};\s*\?>(?<X1040970>))|\s+eval(?:\(\s*eval\("\\\$_(?<X2044041>)|\s*\(['"]\?>['"]\s*\.\s*base64_decode\s*\(['"]Z2lmODlhPD9w[^'"]{999,15000}['"]\)\s*\);\s*(?:\?>|\Z)(?<X1127361>))|\s+exit\(\);\s*endif;(?:\s*\?>\s*<\?php\s*)(\$\w{1,40})\s*=\s*['"][a-z0-9]{9999,65000}['"];\s*\$\w{1,40}\s*=(?:\s*\32\[\d+\]\s*\.){3,}\$[^@\*]{99,999}(\$\w{1,40})\s*=\s*\$\w{1,40}\(['"]\w\*['"],\s*\$\w{1,40}\([^\)]+\)+;\s*@?eval\(\33\)\s*;(?<X2132950>)|\s+function(?: (\w+)\(\$file_url,.+?file_get_contents\(\$file_url\);\35\('https://dl\.dropboxusercontent\.com.+?unlink\(\$_SERVER\['SCRIPT_FILENAME'\]\);\?>(?<X1034351>)|\s+(\w{1,20})\s*\([^\)]+\)\s*\{\s*(\$\w{1,9})\s*=\s*['"][^'"]*['"];[^@]{99,200}\38\s*=\s*\38\.chr\s*\(hexdec\s*\(substr[^@]{9,30}return\s*\(\38\);\s*\}\s*\((@?\$\w{1,20})\s*=\s*\37\([^\.]+\.\39\(\37\([^\)]+\)\s*\);\s*\?>(?<X1134170>)|\s+(wp_run_xcore)\s*\(\)\s*\{[^%]{99,400}eval\s*\(\$\w{1,20}\);\s*\}\s*\}\s*error_reporting\s*\([^\)]+\);\s*wp_update_xcore\s*\(\);\s*\41\s*\(\);[^\?]{0,90}\?>(?<X1125820>)|\s+\w+\(\$\w+\){\s*\$\w+\s*=\s*'[base64decode_\.']+';\s*\$\w+\s*=\s*gzinflate\(\$code\(\$\w+\)\);\s*for\(\$i=0;\$i<strlen\(\$\w+\);\$i\+\+\)\s*{\s*\$\w+\[\$i\]\s*=\s*chr\(ord\(\$\w+\[\$i\]\)-1\);\s*}\s*return\s+\$\w+;\s*}eval\(\w+\("[^"]+"\)\);\?>(?<X1035491>))|\s+global\s*(\$\w{1,20});\s*if\s*\(!?\44\)\s*\{\s*function\s+(\w{1,20})\s*\((\$\w{1,20})\)\s*\{\s*(?:\$\w{1,20}\s*=\s*array\([^\)]{99,5000}\);\s*){2}[^\?]{99,999}return\s+\46;\s*\}\s*\44\s*=\s*time\(\);\s*@?ob_start\(['"]\45['"]\);\s*\}\s*\?>(?<X1127180>)|\s+goto(?:\h*\w{3,9};[^\?\(]{1,99}\bgoto\h*\w{3,9};\s*\w{3,9}:\s*\$\w{3,9}\s*=\s*['"]?FilesMan['"]?\h*[;\)](?<X2162150>)|\s+(\w{1,9});\s+\49:\s+header\([^\(]{99,999}file_get_contents\(base64_decode\(['"][\\xa-f0-9]{99,}['"]\)\s*\.[^\n\?&%]{99,999}goto\s+\w{1,9};(?:\s+\w{1,9}:\s*)+(?:\?>|\Z)(?<X1133560>)|\s+\w{1,9};\s+(\w{1,9}):\s+\$\w{1,40}\s*=\s*@?file_get_contents\(base64_decode\(['"][\\xa-f0-9]{99,}['"]\)\s*\.[^\n\?&%]{999,2999}\51;.[^\n\?&%]{1,99}goto\s+\w{1,9};(?:\s+\w{1,9}:\s*)+(?:\?>|\Z)(?<X1133550>))|\s+header\([^\)]{9,99}\);\s*(\$\w{1,40})\s*=(?:\s*\$_SERVER\[['"]?(?:(HTTP_)USER_AGENT|\54REFERER)['"]?\]\.?){2};\s*if\s*\(\s*strpos\(\53,[^\}\?]{99,999}(\$\w{1,40})\s*=\s*@?file_get_contents\((base64_decode\()['"]aH[^'"]{9,99}['"]\)\s*\.\s*\56[^;]+;\s*echo\s+\55\s*;(?:\s*return\s*;)?\s*\}\s*\?>(?<X1133570>)|\s+if\((?:!isset\(\$_COOKIE\[['"][a-z0-9]{32,}['"]\]\)\)\s*\{header\(['"]HTTP/\d+\.\d+\s+404\s+Not\s+Found['"]\);(?:exit|die)[^;]{0,9};\}\s*\?>\s*<\?php[^\{]{99,999}\bdo\{\w{1,40}\(\);\}while\(\d+\D\d+\)(?<X2132560>)|isset\(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"](?:[^@\?\*]{9,499}\bif\h*\(\h*@[cm]o(?:py|ve_uploaded_files)\h*\(\h*\$_FIles\[[^\]]+\][^\}]+\}\s*else\s*\{[^\}]{1,99}\}\s*\})+(?:\s*\})+\s*(?:\?>|\Z)(?<X1154331>))|\s+if(?:\h*\(isset\h*\(((\$_FILES\[['"](?:azzatssins|assasins)['"]\]\[)[^\]]+\])\)\)\s*\{\s*(\$\w{1,20})\h*=\h*\60;\s*(\$\w{1,20})\h*=\h*\61['"]tmp_name['"]\];\s*@?(?:copy|move_uploaded_file)\h*\(\63\h*,\h*\62\);[^\?]{9,150}\}\s*\?>(?<X1172190>)|\s*\(\s*\$_SESSIONs*\[[^\]]+\]\s*\D{2,3}\s*['"][\w',\s\-]{1,40}['"]\)\s*\{\s*\?>\s*<span\s+title\s*=\s*['"]<\?php\s+echo\s+\$ca?rd_?se?c?re?t;\s*\?>(?<X2134761>)|\s*\(\s*\(\s*isset\s*\((\$_(?:G|P|R|S|C)\w{2,6}\[)[^\]]+\]\)\s*[^\w]{2,3}\s*\(\s*md5\s*\(\66[^\]]+\]\)\)\s*[^\w]{2,3}['"][^'"]+['"]\)\)\s*\{\s*if[^;]+@?eval\(gzinflate\(base64_decode\(rawurldecode\(\$_(?:G|P|R|S|C)[^\}]{9,150}\}\s*else\s*\{\s*header\(['"]HTTP/1.\d\s+404[^\}]+;\s*\}\s*\?>(?<X1064401>)|\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,9}\]\s*\)\s*\)\s*(?:echo|print)\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,9}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1060000>))|\s+move_uploaded_file\s*\(\s*\$_FILES\[[^\]]{1,40}\]\[[^\]]{1,40}\]\s*,\s*\$_FILES\[[^\]]{1,40}\]\[[^\]]{1,40}\]\s*\)\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru|pcntl_exec)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1061240>)|\s+readfile\s*\(\s*['"]/etc/(?:passwd|shadow)['"]\s*\)\s*;\s*(?:\?>|\Z)(?<X1131920>)|\s/\*\s*--\s*enphp.+(?:unset\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*echo\s*\$\w{1,40}\s*;\s*\?>(?<X1037150>)|}\{\d+\}\(E_ALL\^E_NOTICE\);\$_SERVER{(?<X2046230>))|\s\h{199,}/\*[^\*\n]{0,99}\*/\s*(function)\h*\w{1,40}\h*\(\h*\)\h*\{\h*\$\w{1,40}\h*=\h*func_get_args\h*\(\);\h*file_put_contents\h*\([^;]+;\h*(return)\h*@?mail\h*\((?:\h*\$\w{1,9}\[\d+\],?){3,}\);\h*\}\h*\73\h*\w{1,40}\h*\([^\}\n]{1,99}\}\h*\^\h*['"]\d+['"];\h*\}\h*\74\h*\$\w{1,9};\h*\}\s*(?:\?>|\Z)(?<X1135130>)|\s{1000,}\$\w{1,40}\s*=\s*\$_POST\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\[\w{1,40}\]\s*;(?<X2051570>))
<(?:\h*title\h*>\h*40[34]\h*(?:Not\h*Found|Forbidden)\h*(?:web\h*)?Shell\b(?<X2165370>)|\s*(?:(script)[^/]{1,40}/{2}[^\.]{1,40}\.balantfromsun\.com/\w{1,40}\.js[^>]{1,99}>\s*<\s*/\2\s*>(?<X1129041>)|\?\s*(?:\$\w{1,40}\s*="[^"]*"\s*;\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*pass\s*\]\s*==\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*getcwd\s*\(\s*\)\s*;\s*Echo.+?<input\s+type="submit" name="\w+"\s+value="go!"\s+/></form>\s*<\?php\s*}\s*\?>(?<X1037440>)|error_reporting\s*\(\s*\d+\s*\)\s*;\s*assert_options\s*\(\s*ASSERT_ACTIVE\s*,\s*1\s*\)\s*;.+?\$\w{1,40}\s*\(\s*str_rot13\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*\?>(?<X1038460>)|eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(\s*'[^']{1000,}'\s*\)\s*\)\s*\)\s*\?>(?<X1036770>)|if\s*\(\s*(?:!isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@import_request_variables\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*;\s*\}\s*if\s*\(\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*!='[^']*'\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*else\s*\{\s*if\s*\(\s*get_magic_quotes_gpc\s*\(\s*\)\s*\)\s*\$\w{1,40}\s*=\s*stripslashes\s*\(\s*\$\w{1,40}\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*;\s*return\s*;\s*\?>(?<X1037290>)|\$_FILES\['F1l3'\]\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*echo\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*echo\s*'[^']*'\s*;\s*\}\s*\?>(?<X1037750>))|require\s*\(\s*\$_SERVER\s*\[\s*"[^"]*"\s*\]\s*\.\s*"[^"]*"\s*\)\s*;\s*global\s*\$\w{1,40}\s*;\s*\$\w{1,40}-\s*>\s*Authorize\s*\(\s*[^)]+\)\s*;\s*LocalRedirect\s*\(\s*"[^"]*"\s*\)\s*;\s*\?>(?<X1037920>))|IfModule\s*mod_rewrite\s*\.\s*c\s*>\s*Options\s*\+FollowSymLinks\s*RewriteEngine\s*on\s*RewriteBase\s*/\w+\s*RewriteRule\s*\^c\s*\(\\d\+\)\[-/\].+?</IfModule>(?<X1042691>)|script\s*(?:>\s*var\s*s\s*=\s*document\s*\.\s*referrer\s*;\s*if\s*\(\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\|\|\s*s\s*\.\s*indexOf\s*\(\s*"[^"]*"\s*\)\s*>\s*0\s*\)\s*\{\s*self\s*\.\s*location\s*=\s*['"][^"']*['"]\s*;\s*\}\s*<\s*/script\s*>(?<X1043181>)|type\s*="[^"]*"\s*src\s*="http://unslider.com/unslider.min.js"\s*>\s*<\s*/script\s*>(?<X1043141>))|title\s*>\s*(?:404-server!+\s*<\s*/title\s*>(?<X2036851>)|<\s*\?\s*=\$Z118_title\s*\.\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*;\s*\?><\s*/title\s*>(?<X2046270>)))|a(?:[^>]+href[\s=]+['"][htps:/]+westalabamaicehouse\.com[^<]+</\s*a>(?<X1255930>)|\b(?:(?:[^>]{0,199}\b[sh](?:ref=['"]https?://|tyle=['"](?:[^'"]{0,199}\b(?:height|width|left|right)[\s:]+(?:[0-3]|\-\d{4})p[tx];){3})){2}[^>]+>[^</]{0,49}\breplica\b[^</]{0,49}</a>(?<X1215473>)|[^>:/]{0,49}\bhref=['"]?https?://(?:trabzon|gebze)escort\.com\b[^>]+>[^</]{0,49}</a>(?<X1219020>)|[^>]{0,99}\bhref=['"]https?://(?:(?:\w{1,40}\.)?hackingtool\.net/download/[^>]{1,199}>[^</]{0,99}</a>(?<X1181890>)|(?:www\.)noktashop\.org['"/][^>]{0,99}>[\w\h]{0,40}\bsex\h+shop\b[\w\h]{0,40}</a>(?<X1173152>)|[^/'"\s]{0,99}\b[sp](?:hellx\.org|(?:hp|ro)shell\.xyz)['"/\s][^>]{0,199}>[^</'";]{0,19}</a>(?<X1189432>)))|\h*href[\h=]+['"]https?://[^>]{0,99}\bleft[\h:]+\-\d{2,5}px;?['"]>\h*rolex[^<]+</a>(?<X1230560>)|\h+(?:href(?:=(?:['"]https?://(?:www\.)?cheapjersey[^'"]{1,20}['"]>[^<\v]{1,99}</a>\h*&nbsp;(?<X1145474>)|[\\'"]+https?://(?:\w{1,14}\.)?(?:(?:sportdrama\.co\.in|dafabet-pk\.com|1bettv\.com|casinononaams\.it|exycasinos\.com|nonaamscasino\.com)(?:[^'"]{1,50})?[\\'"][^>]{1,50}>\s*[^<]{1,20}\s*<\/a>(?<X1264224>)|(?:superr\.info|sevecenn\.info|resimm\.info|vipistanbul\.net|hisarr\.info|viagraif\.com|kaliteliblog\.com)(?:[^'"]{1,50})?[\\'"][^>]{0,50}>\s*[^<]{1,50}\s*<\/a>(?<X1281431>)))|['"\h=]+https?://[^/]+/(?:toto|produk)['"/>]+situs\h+toto[<\h]+/a\h*>(?<X1283450>)|\h*=\h*(?:['"]https?://(?:[w\.]{0,3}facebook\.com/spyus\.teamx\b(?<X2140570>)|mirror\-h\.org/search/[^\?@]{9,99}<a\h+href\h*=\h*['"]https?://defacer\.id/(?<X2164391>))|\\?['"]https?://[^/'"]{0,99}\wjerseys[^'"]{1,40}\\?['"]\h*>[\w\s]{1,40}\bjerseys?[\w\s]{0,15}</a>(?<X11527310>)))|name\h*=\h*['"]metka\d*['"]\h+href\h*=\h*['"]#download['"]\h+onClick\h*=\h*['"]red\(['"][^'"]{9,99}['"]\)\h*;\h*['"]>\h*<b>[^\x00-\x7F]{7}<.b>\s*</a>(?<X2157180>)|style\h*=\h*['"]display\h*:\h*none[;\h]*['"]\h+href[=\h]+['"]https?://unila\.ac\.id/[^'"]+['"]\h*rel[=\h'"]+dofollow['"\h]*>[^><]*</a>(?<X1264790>))|\s*href\s*=\s*['"](?:(https?://)yeezy\-(?:slidess|supply)\.\w+/['"]\s*style=['"]display:none;['"]><+\31[^>]+</a>+(?<X1256011>)|https?://(?:(?:antalyaescortsitesi|secretajans)\.com\b[^>]*>[^<>\n]{3,99}</a>(?<X1204010>)|(?:buyviagraonlinefree|buycialisonlinefree)\.[^'"]{1,16}['"]\s*[^>]+>\w+</a>(?<X1261870>)|refpasrasw\.world\b[^>]+>[^><]{1,90}</a>(?<X1204390>)))|\s+(?:href(?:=['"]https?://exposedgsmatmskimmers\.com['"]\s+style=['"]color:[^;]{1,9};\s*font\-size:\s*\d+px;\s*text\-decoration:\s*none['"]\s*>[^<>]{0,40}</a>(?<X1213140>)|[=\s]+['"](?:(?:https?:?)?//whyaboveweather\.top\b[^'"]{9,199}['"]\s*>(?:[^</]{0,49}</a>)?(?<X1221211>)|https?://(?:www\.)?replicheorologi\.it/['"]\s+title[=\s]+['"][^'"]+['"]\s+style[=\s]+['"]position\s*:\s*absolute;\s*(?:left|right):\s*\-\d+p[xt];['"]\s*>[^><\n]{0,40}</a>(?<X1235200>)))|style[=\h]+['"]display\s*:\s*none;['"]\s*href[=\h]+['"]https?://[^'"]{9,}['"]>https?://[^<>\n]+</a>(?<X1236061>)))|b(?:>(?:-{5,20}[^'"]{1,4}\s*(?:PPL|paypal)\s+SCAM\s+20\d{2}\s*[^'"]{1,4}-{5,10}(?<X2060344>)|\.::\[Shell functions\]::\.</b>(?<X2050850>)|Black\s*Space\s*Mailer\s*201(?<X2049240>)|Upload\s*Complate\s*!!!(?<X2049551>))|ase(?:\h+(?:(href\h*=\h*['"]https?://(?:www\.)?(\w{0,40}[^\-w_]jerseys\w{0,40}\.\w{2,9})/?)['"]\h*>(?:\s*<link\h+rel\h*=\h*['"](?:canonical|stylesheet)['"][^:>]*\44[^'"]{1,199}\.(?:html|ico|css)['"]>){5}[^&]{99,9999}var\h+http_host\h*=\h*['"]https?:?/?/?(?:www\.)?\45['"]\h*;(?<X2145261>)|href\h*=\h*['"](https?://(?:www\.)?[^'"]{0,40}[^\-w_]jerseys[^'"]{0,40}\.\w{2,9}/?)['"]\h*>\s*<link\b[^:>w]+\47[^:>]+\.(?:css|ico)['"]\h*>[^&]{99,9999}<a\h+href\h*=\h*['"]\47(?<X2145251>))|\s+href\s*=\s*['"](http://[^'"]{1,40}jerseys[^'"]{1,40}\.\w{2,3})/?['"]>\s*<link\s+rel\h*=\h*['"]canonical['"]\s+href\s*=\s*['"]\49[^\{\}\?]{1499,2499}\bfunction\h+popupWindow\s*\([^#]{999,1999}\?main_page\h*=\h*recheckout\b(?<X2157020>))|i(?:g>\s*Symlink\s+Bypass\s+Tool\b(?<X2126520>)|MO@2m\.ma>\\r\\n['"];\s*\$headers\h*\.?\h*=['"]MIME-Version:(?<X2152480>))|r(?:/>Mr Secretz</center>(?<X2052830>)|>(?:\[\+\]\s*Uname:'\.php_uname\(\)(?<X2051280>)|\s*(?:<a[ ]+href=\W{0,8}https?://[^\?\n]{9,99}\.(?:php|html)(?:\?\w{1,9}\s*=[^>\n]{9,150})?>[^\n<]{1,65}</a>[ ]*,[ ]*){10}[^\n]{0,9999}<a[ ]+href=\W{0,8}https?://[^\?\n]{9,199}\.(?:php|html)(?:\?\w{1,9}\s*=[^>\n]{9,150})?>[^\n<]{1,65}</a>[ ]*,[ ]*(?:&nbsp;[ ]*)?</(?:h\d|p|div|time|em|span|b|strong)>(?<X21227318>)|\s*(?:\[info\])?\s*Gaza\s+HaCKeR\s+Team\s*<(?<X2059321>)|\s*[S5]py\s+us\s+priv\s*(?:8|ate)\s+M[a4][i!l]{2}[3e]r\b(?<X2127070>))))|c(?:enter>(?:&copy;\h+\S{1,40}(?:\h+)?e?Xpl[o0]it\h+\d{4}\h*</(?<X2166702>)|<b>[^<]{1,9}Alien\s*Hack[^<]{1,9}<\/b><\/center>(?<X2128150>)|<h\d>(?:\h*priv(?:8|ate)\h+sh[e3][1l]{2}\h*[v\.\d]{0,9}</(?<X2157411>)|HacKeD\h*By\h*TeaM\h*Mosta(?<X2147310>))|\$\s+root@x48(?<X2051700>)|\.:Cyber Shell(?<X2050960>)|\s*Coded\s+By\s+Unkno0?wn\s+Kesdemar(?<X2061270>)|config\s*root\s*man</center>(?<X2047580>))|ode>\s*Trying\s*\$ServerName\.\.\.<br>\s*Connected\s*to\s*\$ServerName(?<X2050150>)))
<d(?:d\d+>\s*<div\b[^>]{1,199}\bstyle=['"](?:[^'">]{0,199}\b(?:width\h*:\h*\-?\dpx|(?:text\-)?overflow\h*:\h*hidden)\b){2}[^\v=]{1,499}(?:<a\s*href=['"]?https?://[^>]{1,199}>[^/<]{1,199}</a>\s*[\w\s]{0,99}\s*){5}[^\v]{9999,}</div>\s*<dd\d+>(?<X1164932>)|iv(?:[^>]{0,40}>\h*Zeux.H[a4]x[o0]r\h+Encode\h*&\h*decode\b(?<X2167350>)|[^>]{1,40}\bstyle\h*=\h*['"][^'"]{0,19}\bdisplay:\h*none\b[^>]{1,40}>\s*(?:<a\h+(?:\bhref\h*=\h*['"]https?://[^'"]{1,49}['"][^>]{0,99}|\btitle\h*=\h*['"]([^'">]{1,20})['"][^>]{0,99}|\brel=['"]dofollow['"][^>]{0,99}){3}>\h*\3\h*</a>\s*)+</div>(?<X1145505>)|[^\-]{0,20}\bstyle=['"](?:[^:]{1,20}:\h*(?:\-\d{3,5}|\dpx|hidden);){2,6}[^>]{1,90}>(?:<a\h*href=['"]https?://[^>]{9,99}>[^<]{0,60}(?:akun\h*[prws]{2}o|slot)[^<]{0,60}</a>\s*){10,}</div>(?<X1232170>)|\b[^>]*\bstyle=['"][^'"]*\b(?:(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^>]*>[^<>/=]{0,99}(?:<a\b[^>]*\bhref=['"]?https?://[^/'"]*(?<!a)(?:cheap|(?<!new[_\-]|new)jersey|bag)[^>]*>[^/\n<]*</a>\s*[^<>/=]{0,99}){5,}</div>(?<X1201213>)|display[\h:]+none\b[^>]+>\s*(?:<a\b[^>]+\bhref=['"]https?://[^>]+>[^</]{0,199}</a>\s*){9,12}<a\b[^>]+>[^></]*[ts](?:ogel|lot)\s+(?:online|terpercaya)\b[^</]*</a>\s*(?:<a\b[^>]+\bhref=['"]https?://[^>]+>[^</]{0,199}</a>\s*)+</div>(?<X1206250>))|\b[^>]{0,99}\b(style=)['"](?:[^'"]{0,99}\b[hw](?:eight|idth)\h*:\h*0[\w%]{0,2};){2}[^>]{0,99}>\s*(?:<a\b[^>]{0,99}\b\8['"][^'"]{0,99}\bfont\-size:\h*[\d\.]{2,9}[\w%]{0,2};[^>]{0,199}\bhref=['"]https?://[^>]{0,499}>[^><,]{0,49}</a>\s*(?:,\s*)?){2,}</div>(?<X1178441>)|\h*class\h*=\h*['"]hacke[rd]['"]>[^<]{0,20}hacked\h*by(?<X2140171>)|\h*id=(['"]\w+["'])>[^a]{0,30}<a\h*href=['"]https?://[^'"]{0,20}(?:fake|watches|replica|jersey)[^'"]{1,20}['"][^>]+>[^'"]{0,40}(?:fake|watches|replica|jersey)[^'"]{0,40}</a>[^\.]{1,40}<(script)[^>]*>[^'"]{0,99}\bdocument\.getelementbyid\(\11\)\.style\.display=['"]none['"];?</\12>(?<X1216913>)|\h*style(?:=\\\\['"]position:\h*absolute;\h*(?:left|right):\h*\-\d{4,}p[tx];\\\\['"]>(?:\\\\n)?<h2>[\w\-]{6,40}\.[a-z]{3}[^<]{1,50}<\\\\/h2>(?:\\\\n)?[^<]{1,500}(?:<a href=\\\\['"]https?:\\\\/\\\\/[\w\-]{6,40}\.[a-z]{3}\\\\/\\\\['"]>[\w\-]{6,40}<\\\\/a>)?[^<]{1,950}<\\\\/div>(?<X1264702>)|[\h=]+['"]display(?::\h*none;?['"]>\s*<a\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]{0,50}\bporno\b[^<]{0,50}</a>\s*[^\?]{999,}\bporno[^<]{0,50}</a>\s*</div>(?<X1213050>)|[\h:]+none;?['"]>sarah\b[^;]{99,999}\bporn</div>(?<X1237100>))|\h*=\h*['"](?:display\h*:\h*none;['"]>\s*(<a\h*href)[^>]{1,99}>(?:php|wso|indoxploit)\h*shell</a>\s*\17[^\?\{\(]{199,3500}/a>\s*<a\h*(?:title|href)[^>]{1,99}>[\w\h]{0,49}</a>\s*(?:</p>)?(?<X1183442>)|font\h*:\h*0\h*px[^>]{0,40}>\s*(?:<a\h*href\h*=\h*['"]https?://[^'"]{0,50}['"]\h*title\h*=\h*['"]([^'"]+)['"]>\19</a>\s*){5,30}</div>(?<X1191321>)))|\h+style=(?:["']display:none;['"]>\s*<\?php\s+echo\h*@?file_get_contents\(['"]https?://[^'"]{9,99}/backlink\.php["']\);\s*\?>\s*</div>(?<X1200680>)|['"](?:display:\h*none;['"]>(?:\s*<a\h+href=["']https?://[^>]{9,99}\btitle=['"]([\w\h]{0,20}(?:seks|sex|porn|gostosas|x{2,})[\w\h]{0,20})['"]>\h*\22\h*</a>\s*){5,}</div>(?<X1202250>)|overflow\b[^'"]{9,99}\b(?:(?:height|width)\h*:\h*0\h*pt;\h*){2}['"]>(?:\s*<a\h+href=["']https?://[^>]{1,60}\btitle[\h=]+['"][^'"]{1,40}['"]>[^<]{1,60}</a>){2,}\s*</div>(?<X1192242>)|position:\h*absolute;\s*(?:left|right|top|bottom):\h*\-\d+px['"]>(?:<a\h*href=['"]https?://[^'"]{9,99}['"]\h*title=['"][^'"]{0,9}(?:escort|se[kx]s?|nude|porn|adult)['"][^/]{9,99}</a>[^<]{0,4}){3,}[^@\$\*!&]{9999,}\btitle=['"][^'"]{0,9}(?:escort|se[kx]s?|nude|porn|adult)['"][^/]{9,99}</a></div>\Z(?<X1203180>)))|\h+style(?:[=\h]+["']display:\h*none;['"]\h*>[^<>/]{0,99}(?:cum|sex|porn|kardashian|girl)[^<>/]{0,99}<a\h+href[=\h]+['"]https?://([^/><]+)/[^<>]+>\26</a>(?:[^<>/]{0,199}<a\h+href[=\h]+['"]https?://[^/><]+/[^<>]+>[^<>]+</a>)+[^<>/]{0,199}</div>(?<X1237230>)|[\h='"]+position:absolute;left:\-\d{4,}px;['"]\h*>[^/]+href[^>\h]+>(?:situs|pam4d|gimbal)(?:\h+toto|\h+slot|\h+togel|\h+4d)?[^\^]+</div>(?<X1283441>)|\h*=\h*(?:['"]filter\h*:\h*alpha\((opacity)\h*=\h*0\h*\);\h*\29:\h*0\h*;\h*position\h*:\h*absolute\h*;\h*z\-index:\h*1\h*;\h*top:\h*\-\d{3,}px;\h*['"]\h*>(?:(?:\s*[^\v:/]{4,40}:)?(?:\s*<a\h+href\h*=\h*['"]https?://[^'"]+['"][^>]{0,40}>[^\v</]{1,99}</a>){5,})+\s*</div>(?<X1164970>)|\\?['"]left\h*:\h+-\d{3,9}px;\h*position\h*:\h*absolute;(?:\h*top:\h*-\d{3,9}px)?\\?['"]\h*>[^\^\|%\$\{\[\*\(@]{99,15999}?(?:cheapjerseys|viagra)[^\^\|%\$\{\[]{99,15999}?</div>(?<X1145292>)))|\s*class=(['"][\w\-'"]+)><(h\d+)\s*\bid=\32[^>]{1,99}\bright:\-\d+px[^>]+>[^=]+[^<]+<a\s*\bhref=['"]https?[^\h]{1,99}(?:lesbian|porn|wifexxx|bigtittybbw)[^>]+>\w+\.\w+</a>[^<]+<a\s*[^>]+>\w+\.\w+(</a>)[^<]+<a\s*[^>]+>\w+\.\w+\34\s*[^>]{1,99}</\33></div>(?<X1239271>)|\s*style=(?:['"]display(?::(?:\s*none;['"]><p>Search[^\=]+(?:<p><a\s*href=['"]https?://[^'"]{9,99}\.xml['"]>[^\<]{9,99}<\/a><\/p>){5,}<\/div><\/body>(?<X2126980>)|none['"]>(?:\s*<a\s*href\s*=\s*['"]https?://(?:rhinoobject\.com\s*[^<]+|connexist\.id\s*[^<]+|agenmicat\.com\s*[^<]+|leeseasyriders\.com\s*[^<]+|ayomasuk\.in\s*[^<]+|bacolchina\.com\s*[^<]+|brandiistan\.com\s*[^<]+|goals\.my\.id\s*[^<]+|wahlum\.org\s*[^<]+|cryptosblogs\.com\s*[^<]+|varynoke\.cz\s*[^<]+|pinkypye\.com\s*[^<]+|www\.varynoke\.cz\s*[^<]+|walz\.in\s*[^<]+)</a>[^<>]{0,9})+</div>(?<X1256592>))|[:\s]+none!important;?['"]>(?:<meta\b[^>]+>\s*)?(?:<a\b[^>]{0,199}\btitle=['"]([^'"]+)['"][^>]{0,199}>\s*\38\s*</a>\s*){19,}</div>(?<X1232400>)|[\s:]+none\b[^>]{0,99}>\s*(?:<a\b[^>]{0,499}\bhref=['"]https?://\w+\.ufc\.com/[^>]+>[^</]{0,199}</a>\s*){9,}</div>(?<X1227130>)|\s*:\s*none;['"]\s*>(?:\s*<a\s*href=['"]http://[^/]{0,19}escort[^/]{0,19}/[^'"]{1,199}['"][^>]*>[^</\n]{0,40}escort[^</\n]{0,40}</a>)+\s*</div>(?<X1226151>))|\s*['"]display:\s*none;['"]>(?:[^<]{1,99}\b(?:drugs?|sexo?|porn|shops)[^<]{1,99}<a[^>]{1,99}>\w+\.\w+</a>[^<]{1,99}</div>(?<X1239330>)|[^=]{1,99}=['"]https?:/[^"']{1,128}(?:porn|lesbian|sexo?|(w{1,16})?xnxx|\43?xnnx|anal)[^>]+>\w+\.\w+(</a>)[^\n]{1,499}\44\s*\w*[^<]{1,99}</div>(?<X1239321>)))|\s*style(?:[=\s]+['"]display:none['"]>\s*(?:<a\s*href[=\s]+['"]https?://[^>]+>[^<]{0,49}</a>\s*){9,}</div>\s*<(script)\h*src[\h=]['"]https?://hacklinkz\.\w+/[^'"]+\.js['"]></\46>(?<X1222862>)|[\h='"]+position[^'"]{0,99}\boverflow:\h*hidden;[^'"]{0,99}['"]>slot\d*\h*>[^\n]{99,800}</div>(?<X1235521>)|[\h=]+['"][^'"]{0,99}\bheight:\h*0p[^'"]{0,99}['"]>[^<]{5,50}<a\h*href[\h=]+['"]https?://[^>]{9,299}>[^<]{1,99}</a>[^<]{1,55}</div>(?<X1203000>)|\s*=\s*['"]overflow:\s*auto;\s*position:\s*absolute;(?:\s*(?:height|width):\s*0pt;)+\s*['"]>[^'"</]{0,99}escort[^'"</]{0,99}(?:\s*<a\b[^:<]+://[^/'"]+\.\w{2,6}/?['"][^<]*</a>)+[^'"</]{0,99}</div>(?<X1208090>))|\s+id=(?:"\w+">\s*(?:<a\s+href='[^']+'\s+title='[^']+'>[^<]+</a>\s*){20,}<script>\s*eval.+?</script>\s*</div>(?<X1036822>)|['"]\w+['"]>\s*(?:<ul>\s*)?(?:<li>\s*<a\s+href=[^>]{1,199}>[^</]{0,49}</a>\s*</li>\s*)+(?:</ul>\s*)?(?:</div>\s*)?<script\b[^>]{0,99}>\s*if[\s\(]+!?navigator\.useragent\.match[^;\}]{1,199}\bdocument\.getElementById\s*\([^\)]+\)[\s\.]+style[\s\.]+display\s*=['"noe\+\s]+(?:;?\s*)?</script>(?<X1216151>)|['"]Footerlinks['"]>\s*<ul>\s*(?:<li>\s*<a\b[^>]+\bhref=['"]?https?://[^>]+>[^</]{0,49}</a>\s*</li>\s*){3,}</ul>\s*</div>\s*<script\b[^>]{0,199}>\s*if[\s\(]+!?navigator\.useragent\.match[^;\}]{1,199}\bdocument\.getElementById\s*\([\s['"foterlinks\)\+]+\.style\.display\s*=['"noe\+\s]+(?:;?\s*)?</script>(?<X1215480>))))
<(?:div(?:\s+style=(?:[""](?:[^'"\n]{0,199}\b(?:height|width)[\s:]+[0-3]p[tx];){2}[^>]{0,199}>[^</\n]{0,199}\b(?:fake|replica)\s+watches\b[^\n]{0,499}<a\b[^>]{0,199}\bhref=['"]?https?://[^\n]{0,499}</div>(?<X1215460>)|['"]?display:none\b[^>]{0,199}>\s*(?:<a\b[^>]{0,99}\bhref=['"]?https?://kompas[^>]+>[\s\w]{0,199}</a>\s*){3,}</div>(?<X1212640>)|['"](?:display(?:[\h:]+none(?:;?['"](?:>\s*(?:<a\s+href=['"]https?://[^>]{1,499}\btitle=['"]([^'"]+)['"][^>]{0,199}>\s*\3\s*</a>\s*(?:<br\s*/?>\s*)?){25,}</div>(?<X1229210>)|\s*>\s*(?:<a\s+href=['"](https?://[^'"]+)['"][^>]{0,199}>(?:\s*\5\s*|[^</]{0,99}\b(?:gam(?:e|ing)|slot|joker|poker|togel)\d{0,3}\b[^</]{0,99})</a>\s*){9,}</div>(?<X1212801>))|(?:;?[\s'"]+>\s*(?:<a\b[^>]{0,199}\bhref=["']?https?://[^>]{1,199}(?:>|title=['"])[^</]{0,49}\bescort\b[^</]{0,49}(?:['"][^>]{0,199}>[^</]{0,49})?</a>\s*){4,}</div>(?<X1216320>)|[^>]+>\s*(?:<a\b[^>]{0,199}\bhref=['"]?https?://kawainime\.my\.id['"/\s][^>]{0,199}>[^</]{0,99}</a>\s*)+</div>(?<X1215400>)))|\s*:\s*none['"](?:><h\d[^;]+style[=\s]+['"]position\s*:\s*fixed;\s*(?:right|left)\s*:\s*\-\d{3,}px;\s*top\s*:\s*\-\d{3,}px;[^>]+display\s*:\s*none['"]>(?:\s*<a\s[^>]+>[^<>]{0,40}es[ck]ort[^<>]{0,40}</a>){9,}\s*</div>(?<X1217510>)|\s*>(?:\s*<p>\h*<a\s+href=['"]https?://[^'">]{9,99}['"]\s*>[^'"><]{0,99}(?:Obat|Jual|cytotec|Cara)[^'"><]{0,99}</a>(?:\s*</p>)?){9,}\s*</div>(?<X1231980>)))|position[:\s]+absolute[;\s]+(?:left|right)[:\s]+\-\d{3,}px['"]>(?:\s*<a\s+href=['"]https?://[^/]{0,18}porn[^/]*\.[a-z]{2,3}/[^'"]+['"]\s+title[\s=]+["'][^'"]+['"]>[^\n<]{3,40}</a>){2,}\s*</div>(?<X1214160>)))|\s+style(?:[=\s]+['"](?:(?:(?:width|height):[10]p[xt];\s*){2}overflow:hidden['"]\s*>(?:\s*<p>\s*<a\s+href[=\s]+['"](https?://[^/]{6,40}\.[a-z]{2,9}/)['"]\s*>\s*\12\s*</a>\s*</p>){9,}(?:\s*<p>\s*<a\s+href[=\s]+['"][^'"]+['"]\s*>[^\n<]+</a>\s*</p>)+\s*</div>(?<X1229280>)|display(?::none['"]\s*>(?:\s*<p>\s*<a\s+href[=\s]+['"]https?://[^/]+/[^"']*['"]\s*>[^<]{0,40}slot[^<]{0,40}</a>\s*</p>){2,}\s*</div>(?<X1226470>)|[:\s]+none['"]\s*>(?:\s*<a\s+title[=\s]+['"]((?:\S{1,40}\s+)+escorts?)['"]\s+href[\s=]+['"]https?://[^'"]{9,}['"]\s+rel[=\s]+['"]\w+['"]\s*>\15</a>)+\s*</div>(?<X1229851>)))|[\h=]+['"]display\s*:\s*none;\s*['"]>(?:\s*<ul>)?(?:(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://(?:agen|slot|casino)[^>]+>[^<]+</a>(?:</li>|</ul>|</div>)+)+[^;]{9,499}(?:agen|slot|casino)[^\n<]{0,99}</a>(?:\h*</li>)?\s*(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^<]+</a>(?:\s*</li>)?)(?:</li>|</ul>|</div>)+(?<X1261131>)|(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^>]+>[^<]+</a>(?:</li>|</ul>|</div>)+){4,}(?:(?:[^;]{9,499}slot[^\n<]{0,99}</a>)?(?:\h*</li>)?\s*(?:(?:\s*<li>)?\s*<a\s+href[\h=]+['"]https?://[^<]+</a>(?:\s*</li>)?)(?:</li>|</ul>|</div>)+)?(?<X1223363>))|[\s=]+["']overflow[:\s]+hidden\s*;\s*(?:height|width):[102]px;['"]\s*>(?:\s*<a\s+href[=\s]+['"]https?://[^'"]{9,}['"]\s*>[^><]{0,60}(?:slot|toto|spaceman|pay4d|gacor|freebet|qdal)[^><]{0,60}</a>){2,}\s*</div>(?<X1229861>)|\s*=\s*['"](?:\s*(?:(?:visibility|display)\s*:\s*(?:hidden|none)[\s;]*){2}['"]\s*>\s*(?:<a\s*href\s*=\s*['"][^'"]*es[kc]ort[^'"]*['"]\s*title\s*=['"][^'"]*es[kc]ort[^'"]*['"]\s*rel\s*=\s*['"]dofollow['"]\s*>[^\n<]{0,99}es[kc]ort[^\n<]{0,99}<\s*/a\s*>\s*)+<\s*/div\s*>(?<X1203361>)|display(?:\h*:\h*none['"]>(?:\s*<a\s+href\h*=\h*['"]https?://[^/\$\s'"]{3,40}\.[a-z]{2,9}/?(?:[^/]+/)?['"]\s+title\h*=\h*['"][^'"]+['"](?:\s*rel\h*=\h*['"]dofollow['"])?\s*>[^\n<>/\$;]{3,40}</a>){9,}\s*</div>(?<X1223070>)|\s*:\s*none\s*;['"]\s*>(?:\s*<a\s+href=['"]https?://[^/]+/[^'"><]{0,99}slot[^'"><]{0,99}['"]\s*>[^'"><]{0,99}slot[^'"><]{0,99}</a>)+\s*</div>\s*\Z(?<X1218550>)))))|F(?:ilesMatch(?:\h['"][\.\*\\]{1,5}\([pPhH\|578cdelmpustxy]{1,200}\)\$['"]>\s*Order\h*allow\,deny\s*Deny\h*from\h*all\s*<\/FilesMatch>\s*<FilesMatch\s*["']\^\((?:[a-z]{4,40}\d{2,}\.php)?\)\$['"]>\s*Order\s*allow\h*,\h*deny\s*Allow\hfrom\h*all\s*<\/FilesMatch>(?<X1264802>)|\s*(?:["']\^\((?:[a-z]{4,40}\d{2,}\.php)?\)\$['"]>\s*Order\s*allow\h*,\h*deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1265211>)|['"]\.(?:\*\\\.)?\(py\|[^\)\n]{40,}\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Deny\s*from\s*all\s*</FilesMatch>\s*<FilesMatch\s*['"].\(index\.php\|[^\$]{4,}\)\$['"]>\s*Order\s*Allow\s*,\s*Deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1257460>)|['"]\.\(php\|[^\)]{9,}\)\$['"]\s*>\s*Order\s+allow,deny\s+Deny\s+from\s+all\s*</FilesMatch>\s*<FilesMatch\s*["']\^\([\w\.\-]+\.php\|[^\)]{99,}\)\$\s*['"]\s*>\s*Order\s+allow,deny\s+Allow\s+from\s+all\s*</FilesMatch>(?<X1223650>)|['"]\.\*\\\.\((?:py|exe|phtml|php)\|[^\)]{9,}\)\$['"]\s*>\s*Order\s+allow,deny\s+Deny\s+from\s+all\s*</FilesMatch>\s*<FilesMatch\s*["']\^\([\w\.\-]+\.php\|[^\)]{99,}\)\$\s*['"]\s*>\s*Order\s+allow,deny\s+Allow\s+from\s+all\s*</FilesMatch>(?<X1225750>)|['"]\^\([\.\|][\w\-]+\.php\|[\w\.\-\|@]{9,}\|\s*\)\$['"]>\s*Order\s*allow\s*,\s*deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1259050>)|['"]\^\(index\.php\|lock[^><]+>\s*Order\s*Allow,Deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1256810>))|\s+['"]\.\((?:(?:[^\)]{0,99}\bphp\d*\|){2}[^>]{0,199}>\s*Order\s+Allow[,\s]+deny\s*Deny\s+From\s+all\s*</(FilesMatch)>\s*<\30\s*['"]\^[^\)'">]{1,49}[\(\|](?:godsend|geju|goutong)[\|\)][^"']{1,49}\\\.php\$['"]>\s*Order\s+allow[,\s]+deny\s*allow\s+from\s+all\s*</\30>(?<X1233921>)|(?:[^\)]{0,99}\bpy|exe|php\d*\|?)[^>]{0,199}>\s*Order\s+Allow[,\s]+deny[^\<]{1,99}</(FilesMatch)>\s*<\32\s*['"]\^[^\)'">]{0,999}[\(\|](?:indexx+\.py{0,9}hp|radio\.py{1,9}hp|(?:xbumb+leb33|asu|lock\d{0,3}(?:\-geek)?)\.p[htmlp]{2,4})\b[^"'\)]{0,999}\)\$['"]>\s*Order\s+allow[,\s]+deny\s*allow\s+from\s+all\s*</\32>(?<X1233934>))|\s+['"]\^\((?:[^\|\)]{1,49}\.php\|){5}[^\)]{19,1499}\)\|\([^\)]{0,49}\bsuspected\b[^\)]{0,49}\)\$['"]>\s*Order\s*allow,deny\s*Allow\s*from\s*all\s*</FilesMatch>(?<X1233610>))|o(?:nt(?: color="red">pwn pwnd owned hacked</font>(?<X2050710>)|[^>]*>\W{0,2}Ghazascanner\h*<(?<X2175000>)|[^>]{0,99}\bcolor\h*=\h*['"][^'"]+["'][^>]{0,99}>\h*\W{0,9}(?:Defacer\h*Team|Indoxploit|Xai\h*Team)\b(?<X2165211>)|[^>]{1,40}>webshe?ll</[^\]]{99,299}\becho\h*['"]<h\d>[^;]{9,199}system\.\h*:\h*['"]\.php_uname\(\)\.['"]</h\d>(?<X2151770>)|[^>]{9,99}>\s*(?:knocked|hacked)\s+by\s*(?:<[^>]{1,20}>\s*)?(?:z[e3]r[0o]h[1il]d[3e]n|AL\-VRI)\b(?<X2129752>))|oter[^>]{9,50}>[^<]{0,40}Mini\s*Shell\s*by[^<][^<]{1,99}</footer>\s*<a(?<X2128441>)|rm(?:[^;_]{9,99}\bvalue\h*=\h*['"][^0-9A-Z]{0,4}\bpunjabimob\.com[^'"]{0,4}['"](?<X2182070>)|\b[^>]{0,99}\b(?:(?:[ni](?:ame|d)=['"]?chalbhai['"]?\s*){2}(?<X2159322>)|style=['"][^'"]{0,99}\b(?:height|width)\h*:\h*[0-3]p[tx]\b[^>]{0,99}>\s*(?:</?(?:div|span|p|a)\b[^>]{0,99}>[^</]{0,49})+</form>(?<X1196231>))|\h+action\h*=\h*['"][vc](?:onfirm|erify)[^\.]{0,9}\.php\?[^;\?]{1,99}<\?php\h+echo\h+generateRandomString\h*\(\d{2,}\)\h*;\h*\?>[^\+\?\$\\\.\{\[]{1,499}<input\h+name\h*=\h*['"]p(?:wd?|ass|aswd|assword)\b(?<X2152880>)|\s+enctype=multipart/form-data\s+method=post>\s*<input\s+name=fileMass\s+type=file>.+?@copy\(\$_FILES\[fileMass\]\[tmp_name\],\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[path\]\.\$_FILES\[fileMass\]\[name\]\);\s*}};\s*\?>(?<X1034731>)))))
<h(?:(\d)\b[^>]{0,199}\bstyle=['"][^'"]{0,199}\bvisibility[:\h]+hidden\b[^>]{0,199}>(?:\s*<a\s+href=['"]https?://[^>]+\btitle=['"]([^'"]+)['"]\s*>\s*\2\s*</a>){25}[^\{\}!]{9999,}</a>\s*</h\1>(?<X1234250>)|1>(?:"\.ucfirst\(\$key\)\."</h1><br>\s*<br>"\.\$templateimage\."<br><br>\s*"\.\$mapinpages\."\s*"\.\$pageparse\."<br>\s*"\.\$links1\."(?<X2045700>)|[^/\w]{0,40}\b[hops](?:ack|wn|tamp)ed\s+by\b[^\(\?]{99,199}<script[^>]{1,40}>[^\.;\(]{0,9}\b(?:document\.write\(unescape\(['"][%\w]{99,4999}['"]\)\);\s*){2}(?<X2144421>)|\s*(?:By|PHP\s+Shell)\s+<\?php\s+echo\s+PHPSHELL_VERSION\s+\?>(?<X2063881>)|\s*<center>\s*mini\s*File\s*Manager(?<X2049940>)|Tryag\s*File\s*Manager\s*</(?<X2237650>))|2>(?:Confirm\s+Your\s+Paypal\s+Debit/Credit\s+Card\s*</h2>(?<X2049230>)|Developer\s+By\s+KymLjnk</h2>(?<X2048670>)|Verified\s+Your\s+Personal\s+Bank/Add Bank</h2>(?<X2049210>))|3\s+style[=\s]+['"]position\s*:\s*absolute;\s*top\s*:\s*[012]px;\s*(?:left|right):\s*\-\d{4,}px;['"]\s*>\s*<a\s+href[=\s]+["']https?://[^'"]+\.[a-z]{2,9}/['"]\s+title[=\s]+['"][^'"]+['"]\s*>[^<\n]{2,99}</a>\.</h3>(?<X1232990>)|[23]\h+id[=\s]+['"]friends\-links['"]\h+style[=\s]+['"]position:\s*fixed;\s*(?:right|left):\h*\-\d{3,}p[xt];\s*top:\h*\-\d{3,}p[xt];\h*overflow:\h*hidden;[^>]*>(?:[^<>]{0,99}\b(?:porn|sex)[^<>/]+<a\h+href[=\h]+['"]https?://([^'"]+)/?['"][^>]*>\13</a>)+[^/<>]*</h[23]>(?<X1237220>)|\d+>(?:\h*(?:Copyright\h*20\d+@Indonesian?\h*My\h*family\h*<(?<X2168351>)|Sid[\h\-_]{1,3}Gifari\h+(?:web)?(?:Shell)?\h+Upl[oa]{2}der\b\h*</(?<X2143022>))|PR[1i]V(?:8|ate)\h+M[a@4][1i]L[e3]R\h+by\b(?<X2170330>))|\d(?:>\s*(?:(?:This\s+Website\s+has\s+been\s+)?Hacked\s+by\s+Extreme\s+Crew\s*<(?<X2121320>)|Gentoo\W{0,4}MyHack\s*</h\d>(?<X2121490>)|IDBT[E3][4A]M\s+BOT\s+V\d+(?<X2062570>))|[^>]{0,30}>\d+E?XploiterCrew\h*</(?<X2166712>)|\b[^>]{0,99}>[^\w/]{1,19}(Rzzr)\s+Shop\b[^\?]{1,99}(?:<a\b[^>]{0,99}\bhref\h*=\h*['"]?https?://[^/]{0,19}\b\22\.to['"/\s][^=\?]{1,49}){2}(?<X2164070>))|EAD(?:>(?:<TITLE>IDBI\s*Bank\s*\-(?<X2047871>)|\s*<(?:script>\s*window\s*\.\s*top\s*\.\s*location\s*\.\s*href\s*="[^<]+</script>\s*</head>\s*<body>\s*<script>\s*document\s*\.\s*write\s*\(\s*'[^)]+\)\s*;\s*</script>\s*</body>(?<X1042613>)|title>\s*(?:(?:TurkCrew\s+Toplu\s+Tecavuz\s+Tools|Darkfeyz\s+Symlink)\b(?<X2127051>)|Mini\s*php\s*shell(?<X2125490>))|title>(?:azrail\s+1\.(?<X2050800>)|Xsender</title>\s*</head>(?<X2050520>))))|er>IndoXploit\h*Tools[^<]{0,70}</header>[^\?]{99,300}\bplaceholder\h*=\h*['"]Hacked\h*by(?<X2145390>))|tml>(?:.{1,9999}<title>utf</title>.{1,9999}echo\s*"<h1>Welcome</h1>\\n";.{1,9999}\btouch\(\$newfile,\s*\$time\);.{1,9999}</html>(?<X2044692>)|<title>Uploader\s*By\s*SiLnt\b(?<X2129352>)|\s*<(?:(title)>\W{0,5}\bUploade?r?\W{0,5}\|\h*([^<]+)</\33>[^\?]{0,999}<\?php[^\{]{0,199}\{\s*if[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[[^\{]+\{\s*echo\h*['"]<font[^%\^&@]{99,499}\b\34\h*CopyRight\b[^\?#%&]{0,99}</html>(?<X1233010>)|head>(?:\h*['"]\.\$\w{1,20}\.['"]\h*<title>\h*Eugen\h+Filemanager\b(?<X2140230>)|\s*<meta(?: http-equiv="(?:Content-Type" content="text/html; charset=windows-utf-8">\s*<title>\w+</title>\s*</head>\s*<body>\s*<\?php\s*print '<h1>.*?</h1>';\s*echo ".*?";.*?echo\s*\$_SERVER\['REMOTE_ADDR'\];\s*echo\s*"<form method=\\"post\\"\s*enctype=\\"multipart/form-data\\">.*?if\s*\(\s*@is_uploaded_file\(\s*\$_FILES\["\w+"\]\["\w+"\]\s*\)\)\s*{\s*.*?move_uploaded_file\(\$_FILES\["\w+"\]\["tmp_name"],.*?\$_FILES\["\w+"\]\["name"\]\);.*?echo\s*"<a\s*href=\\"\$\w+\\">\$\w+</a>";\s*.*?\$\w+\s*=\s*\$_SERVER\['SCRIPT_FILENAME'\];\s*touch\(\s*\$\w+\s*\);\s*\?>\s*</body>\s*</html>(?<X1035071>)|refresh" content="\d+;\s*url=http://.+?\s*r = Math\.floor\(Math\.random\(\) \* 10000\);\s* .+?document\.write\("<img src='" \+ l \+ "'>"\);\s*</script>\s*<body>\s*<h1>Loading...</h1>\s*</body>\s*</html>(?<X1042532>)|refresh" content="\d+;\s*url=http://[^"]+">\s*</head>\s*<body>\s*<h1>Loading...</h1>\s*</body>\s*(?<X1042522>))|\s*http-equiv=['"]Content-Type['"]\s*content=['"]text/html;\s*charset=UTF-8['"]>\s*<title>\s*Google\s+Drive\s*</title>\s*<script\s*language=['"]javascript['"]>(?<X2052010>))|\s*<script type="text/javascript" src="http://ajax\.googleminiapi\.com/angular\.min\.js">\s*</script>\s*<META HTTP-EQUIV="REFRESH" CONTENT="1;URL=[^"]+">\s*</head>\s*<body>\s*</body>\s*</html>(?<X1042571>)|\s*<title>(?:\s*(?:botn\s*<(?<X2055281>)|coded\s+by\s+ALFA\s+TEAM(?<X2063120>)|Webmail\s+\|?\s*Update\s*<(?<X2054691>))|Sucursal\s+Virtual\s+BANCOLOMBIA(?<X2052260>)))|title>\s*Symlink\s*Bypass\s*\d+\s*by\s+hAxOr(?<X2057000>))))
<(?:i(?:(frame)\h+\1border\h*=\h*['"][012]['"]\h+onload\h*=\h*['"]if\h*\(!(this\.)src\)\s*\{\s*(?:\2(?:height|width)\h*=\h*[''][012]['"];\s*){1,2}\2src\h*=\h*['"]https?://[^/:'"]{1,99}:\d{4}/[^'";]{1,99}['"];\s*(?:\2(?:height|width)\h*=\h*[''][012]['"];\s*){1,2}\}"\h*>[^/<]{1,99}</i\1>(?<X1141461>)|>(?:h[ea]ck|[o0p]wn|fuck|d[e3]f[a4@]c)ed\h*by\h*\S{2,40}\s*</(?:title|font|br?)>(?<X2182004>)|f(?:Module(?: mod_rewrite\.c>\s*RewriteEngine On\s*RewriteCond %{HTTP_REFERER}\s+\^\.\*\([^)]+\)\\.\(\.\*\)\s*RewriteCond\s*%{HTTP_USER_AGENT}\s*\^\.\*\(msie\|opera\)\s*\[NC\]\s*RewriteCond\s*%{REQUEST_FILENAME}\s*!/index\.php\s*RewriteRule\s*\(\.\*\)\s*/index\.php\?query=\$1\s*\[QSA,L\]\s*</IfModule>(?<X1042651>)|\s+mod_rewrite\.c>(?:[^\?]+?google\|yahoo\|msn\|aol\|bing[^\*]+?index\.php\s+\[L\]\s*</IfModule>(?<X1035631>)|\s*RewriteCond\s+%{HTTP_USER_AGENT}\s+\(google\|yahoo\|msn\|aol\|bing\) \[OR\]\s*RewriteCond\s+%{HTTP_REFERER}\s+\(google\|yahoo\|msn\|aol\|bing\)\s*RewriteRule \^\.\*\$\s+index\.php\s+\[L\]\s*<\/IfModule>(?<X1035360>)))|rame(?:[^>]{1,99}(?:\b(?:src\h*=\h*['"]?https?://(?!www\.googletagmanager\.com\b)|(?:width|height)\h*=\h*['"]?[012][pe]?[xm]?\b|style\h*=\h*['"]\h*(?:display:\h*none|visibility:\h*hidden)\b)[^>]{0,49}){4}[^>]{0,49}></iframe>\s*\Z(?<X1143505>)|\b(?:[^>]{0,25}src=['"]http://[^'"]{9,25}/in\.cgi\?(?:\d+|\w+=\w{32})\h*['"]\h*(?:\w{1,9}\h*=\h*['"]0['"]\h*)(?:\h*(?:style|width|height)\h*=\h*['"]\h*(?:display\h*:\h*none(?:\h*;)?\h*['"]|[012]\h*['"])){1,3}></iframe>(?<X1164011>)|[^>]{1,49}\bsrc\h*=\h*['"]https?://[^'"]{1,99}/\w{1,9}\.cgi\b[^>]{1,99}[wh](?:idth|eight)\h*=\h*['"][012](?:px)?["'][^>]{1,49}\bstyle\h*=\h*['"]display:none['"][^>]{0,49}>\s*</iframe>\s*\Z(?<X1146811>))|\h*src=['"]http://\w{1,9}\.com/\w{1,9}\.php['"]\h*(?:(?:width|height)=['"][01]['"]\h*){2}style=['"]visibility:hidden;position:absolute['"]></iframe>(?<X1142605>)|\s*(?:id="a\d+"\s*src="//[^/]+/f2\.html\?a=\d+"\s*style="display:\s*none;">\s*</iframe>(?<X1043241>)|src=['"]https?://[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*style\s*=\s*['"][^:]{5,20}:none['"]>\s*<\s*/iframe>(?<X1120352>)|src\s*=(?:['"]https?://autofaucet\.\w+/\w{1,9}/[^'"]+['"](?:\s+(?:width|height)\s*=\s*['"]0['"])+\s*style\s*=\s*['"]border\s*:\s*0['"]\s*>(?<X1202940>)|\s*['"]https?://(?:[^'"]+/in\.cgi\?default['"][^/]{9,50}(?:height|width)\s*=\s*['"]?\d['"][^/]{9,50}></iframe>(?<X1126841>)|[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*width\s*=\s*[01]\s*height\s*=\s*[01]\s*style\s*=\s*['"]?\D{5,20}:(?:none|0|1)p?x?['"]?>\s*<\s*/iframe>(?<X1120541>)))|style\s*=\s*['"]height\s*:\s*[01]px["']\s*src\s*=\s*['"]https?://[^/]{1,50}\.(?:pl|jp|pl|in|cn)/rc/["']\s*frameborder\s*=\s*[01]\s*width\s*=\s*[01]\s*>\s*<\s*/iframe>(?<X1118603>))|\s+src(?:=['"]http://\w{1,40}\.(?:pl|jp|pl|in|cn|ru|su</iframe>):8080/[^'"]{1,40}['"]\s+width=\d+p?x?\s+height=\d+p?x?\s+style=['"]visibility\s*:\s*(?:hidden|none|0)['"]>\s*</iframe>(?<X1121041>)|\s*=\s*['"]https?://[^/]{1,40}/in\.[^'"]{1,40}['"](?:(?:\s*(?:width|height)\s*=\s*[012]\s*)|(?:\s*style\s*=\s*['"]\s*visibility\s*:\s*hidden\s*['"]\s*)){3}>\s*</iframe>(?<X1126930>))))|mg[^>]{1,20}style=['"]display:none[^>]{1,20}new\s*function\(window\[[^\]]{1,20}split[^\]]{1,20}reverse[^>]{1,20}getAttribute\(['"]([\w-]+)['"][^>]{1,20}\20\s*=\s*['"][^'"]{1,250}['"]\s*>(?<X1281320>)|nput(?:[^>]{1,99}value\s*=\s*['"]\s*Mass\s*ch[ai]nge?\s*Admin\s*['"][^>]{1,99}/\s*>(?<X2127810>)|\h+type\h*=\h*submit\h+value\h*=\h*Deface>[^:\\%]{99,500}\bfile_get_contents\h*\((?<X2181691>)))|link(?:\h+rel\h*=\h*['"](?:[^'"]+['"]\h+href\h*=\h*['"]https?://www\.cheapjersey[^/]{3,30}/favicon\.ico['"]\h+type\h*=\h*['"]image/x-icon['"]>(?<X2151000>)|stylesheet['"]\h+href\h*=\h*['"]https?://raw\.githack\.com/con7ext/zerostore-shell\b(?<X2141910>))|\s*rel(?:=['"]sitemap[^\[!]{0,9999}if[\(\s]+!\s*is_null[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+\26[\s\.]+['"]\?[^>]{9,9999}(\$\w{1,40})\s*=\s*\w+[\s\(]+\26[^>]{9,9999}\27[\s=]+str_replace[\(\s]+["'](\w)\28{2,}["'][,\s]+\$\w[^;]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\27[\s\);]+echo\s*\27\s*;(?<X2224470>)|\s*=\s*['"]dns\-prefetch['"]\s*href\s*=\s*['"](?:https?:?)?/*apifetchmethod\.com/?['"]\s*/>(?<X1259192>))|\s+rel[\s='"]{1,32}amphtml[\s''"]+href\s*=\s*['"]https?://pub\-\w+\.r2\.dev/[^'"]{1,99}\-slot[^\.]+\.html['"][\s/>]+(?<X2280421>)))
<m(?:arquee\s*style\s*=\s*['"]position\s*:\s*absolute\s*;(?:\s*(?:width|hight)\s*:\s*0px;){1,2}\s*['"]\s*>(?:\s*<a\s+href=['"]https?://[^'"]{1,99}['"](?:\s*(?:rel|title)=['"][^'"]{1,99}['"]){1,2}\s*>[^<\n]{0,99}escort[^<\n]{0,99}</a>){2,}\s*</marquee>(?<X1198281>)|eta(?:[^"]{1,32}['"]refresh['"\s]+content[=\s'"]+[\d\.\s]+;url\s*=\s*https?://hanovertdo\.org[^'"]+['"]>(?<X1283930>)|[^>]+><h\d[^>]{0,99}\b(?:right|top):\-\d+px;[^>]{0,99}>(?:\s*<a\h*href[^>]{0,99}>[^<]{0,40}\b(?:shell|hacklink|deface)[^<]{0,40}</a>){4,}\s*<a[^>]{0,99}>[^/]{0,40}\bshell[^/]{0,40}(?:</[^>]+>)?</a>(?<X1206811>)|[^>]{0,50}content\h*=\h*['"][^'"]{0,25}\bShell['"]>\s*<title>PsMa\b\h*Shell</title>(?<X2146170>)|[^>]{1,50}content\s*=\s*['"][sec][yxu](?:ber\h*team\h*attack|plosion\h*Squad\s*Cyber|zuya\h*Cyber\h*Atttack)\b(?<X2137272>)|[^>]{9,59}content\h*=\h*['"][^'"]{0,50}\b(?:H[a@]ck[e3][dr]|pwn[e3]?r?d)\hby(?<X2140166>)|\b[^/>]+content\h*=\h*['"]sukabumi\h*hackers['"][^@]{999,1999}(\W)\h+Indoxploit\h+\7(?<X2142191>)|\b[^>]{0,49}\b(content)=['"][^'"]{1,49}\bURL=(https?://[^'"]{1,99}/wp\-(?:\9|includes|admin)/[^'"]{1,99})['"][^>]{0,49}>\s*<(script)\b[^>]{1,99}>\s*(?:var\h+)?(\w{1,40})\h*=\h*['"]\10['"];?\s*self(\.location)\.replace\h*\(\h*\12\h*\);?\s*window\13\h*=\h*\12;?\s*</\11>\s*</head>\s*</html>\s*\Z(?<X2161813>)|\b[^>]{0,99}\bcontent(?:=['"](?:\w{1,40}\s+Error\s+System['"][^\?@]{1,999}>\s*(?:Stamp|touch|(?:cra|ha|fu)ck|(?:re)?cod)ed\s+by\s+\w{1,40}\s*<(?<X2169011>)|uploader\s+shell\s+by\b[^@%\*&]{1,2499}\bif\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169640>))|\h*=\h*['"]trenggalek6etar\.\w{2,4}['"][^/>]{0,99}/>(?<X2143252>))|\h*(?:http-equiv[=\h]+['"]refresh['"]\h*|content[\h=]+['"]0[\h;]+url[\h=]+https?://ruhsuzman\.[^'"]{1,40}['"]\h*){2}>(?<X1222741>)|\h*http\-equiv(?:[\h=]+['"]refresh['"][^>]{0,99}0;url[\h=]+https?://cheapmedplace\.com/['"]\s*/>(?<X1218090>)|\b[^\?]{0,99}>\s*<(div)\h*style[\h=]+['"]display[:\h]+none;['"]>\s*<a\h*href\h*=\h*['"]https?://[^/'";]{1,49}\.(?:xyz|org|com|net|pl|jp|in|cn|ru|su|pw|or\.id|ga|ml)[^\176]{99,9999}</\20>\s*<(script)\h*src\h*=\h*https?://shell[^>]{1,49}/\w{1,20}\.js></\21>(?<X1179721>)|\h*=\h*['"]pragma['"][^#]{9,199}\b(?:Not\W{1,3}cias|Vagas)</title>[^\;]{9,99}\<script>\s*;\s*\((function)\(\)\s*\{\s*\23\h*id\((\w)\)\{\s*return\s*document\.getElementById\(\24\);\s*\}(?<X2166161>))|\h+(?:content\h*=\h*['"](?:Mr\.Overkill|.{0,3}EcchiExploit)['"]\h*|name\h*=\h*['"]author['"]\h*){2}(?<X2167172>)|\h+(?:name\h*=\h*['"](?:title|description|author|keywords)['"])\h+Content\h*=\h*['"](?:Mr\.\h*1334N|Hacked\h*Tanpa\h*Nama)\b(?<X2144353>)|\h+(?:name\h*=\h*['"](?:title|description|author|keywords)['"]\h+|content\h*=\h*['"](?:Tested\h*by\h*0x['"]?s404zx|Cowokerens\h*Team)){2}\b(?<X2144413>)|\h+(?:name\h*=\h*['"]description['"]\h*|content\h*=\h*['"]Hacked\h+by\h+mr\.donut'?s?['"]\h*){2}/?\s*>[^@\?]{1,199}<meta\h+(?:name\h*=\h*['"]title['"]\h*|content\h*=\h*['"][^'"]+\bblackhat['"]\h*){2}/?\s*>(?<X2145003>)|\h+content\h*=\h*['"](?:crtd\h*by\h*\./for\h*(?:you|me)['"](?<X2173280>)|Hacked\h*By\h*MR\.\S{1,40}(?<X2152944>))|\h+HTTP(?:-EQUIV\h*=\h*['"]refresh['"]\h+content\h*=\h*['"](?:[^'"]{0,49}\burl\h*=\h*https?://(?:[^/]{1,49}/wp\-content/upgrade/[^>\v<]{1,99}['"]>(?<X1149682>)|[^/]{4,60}/wp\-includes/[^>\v<]{1,99}['"]\h*>(?<X1149651>))|\d;\h*url\h*=\h*(https?://\w{1,40}\.(?:pl|jp|pl|in|cn|ru|su)(?:/[^'"]{0,40})?)['"]>\s*<(script)[^>]{1,40}>\s*window\.location\.href\h*=\h*['"]\34/?['"]\s*</\35>(?<X1146613>))|\-equiv(?:=['"]refresh['"]\s+content=['"]\d+;\h*URL\h*=\h*https?://[^'">/\s]{1,99}/wp\-(?:admin|content|includes)/[^'">\?]{1,199}/(?:\?[^'">]{0,99})?['"]\h*>(?<X2173102>)|\h*=\h*['"]refresh['"][^:]{2,30}\s*url\h*=\h*(https?://[^'">]{2,30}/wp\-content/(?:themes|plugins)/[^'">]{5,99})['"]>\s*<(script)[^>]{0,60}>[^\{\(]{0,9}\bfunction\h+redirect\(\)\s*\{\s*setTimeout\h*\(['"]window\.location\.replace\h*\(['"]\38['"]\)['"]\h*,\h*0\);\s*\}[^/]{0,9}</\39>(?<X1169141>)|\h*=\h*\\?['"]refresh\\?['"]\h+content\h*=\h*\\?['"]\d;\h*url\h*=\h*https?://[^/'"\\\$]{2,49}\.(?:bid|top|cc|me)/go/[a-z\d]{3,40}\\?['"]\s*>(?<X1223000>)))|\h+name(?:=['"]author['"]\h+content=["']AZZAT[SZ]{2}INS['"]>(?<X2157980>)|\h*=\h*['"](?:\w{1,40}['"]\h+content\h*=\h*['"]Xai\h+Syndicate["']>(?<X2162420>)|description['"]\h+content\h*=\h*['"][PO]wnd\h+by\b(?<X2180580>)))|\s*[^>]{1,99}[0;\s]+url[\s=]+https?://dgt\.multa\-pago\-n8494084\.eu[^'"]+['"]\s*>(?<X1282761>)|\s*charset\s*=\s*['"]utf\-8['"][/><\s]+link[^#]{1,299}#popupOverlay\s*\{[^<]+</style>\s*<script[^;]+const\s*OFF_WAIT[^\^]{1,35000}windows\s*power\s*shell\s*admin[^\^]+ADMIN_IPS,\s*\},\s*\w+:\s*['"]POST[^\!]+!copied\s*\)\s*\{\s*\w+\(\);\s*[\},\s]+\);[^<]{1,62}\}\s*\}\s*\};\s*</script>(?<X1269414>)|\s*http\-equiv\s*=(?:"[^"]*"\s*content\s*="[^"]*"\s*/\s*>\s*<\s*title\s*>\s*#[a-z]+#\s*<\s*/title\s*>\s*<\s*meta\s*name\s*="keywords"\s*content\s*="#[a-z]+#"\s*/\s*>\s*<\s*meta\s*name\s*="description"\s*content\s*="#[a-z]+#"\s*/\s*>(?<X2046262>)|\s*(['"])?(?:refresh)?\48?\s*content\s*=\s*['"]?\d{1,3};(?:\s*url=)?[^=]{1,99}=\d{1,3}InboxLightaspxn\.\d{4,9}(?<X2129071>)|\s*['"](?:\s*refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https?://redirect4\.xyz/?['"]>(?<X1250790>)|refresh['"]\s*content=['"]\d+[^=>]+=['"]?https?://(?:edocsignaturecontracts\.(?:buzz|cyou)|(?:iplogger|pepe\-meme|winmeme)\.com)[^>]+>(?<X1251365>)))|\s*name\s*=\s*['"]description['"]\s+content\s*=\s*['"](?:script)?\s*Paypal\s+(?:Account\s*)?Checker\s+Script\b(?<X2137171>)|\s+(?:content[\h=]+['"]\h*Cheap\h+Authentic\h+Jerseys?\b[^'"]{0,99}['"]\h*|name[\h=]+['"]description['"]\h*){2}/>[^@\?\!;]{1,399}<link\h+href[\h=]+['"]https?://(?:www\.)?cheapjersey(?<X2148253>)|\s+http(?:-equiv\h*=\h*['"]refresh['"]\s+content\h*=\h*['"]\d;\s*URL\h*=\h*https?://[^"'>]{2,30}/wp-content/themes/twenty[a-z]{5,15}/[^'">]{0,20}/(?:American.Express|Master.Card|Visa|\w{2,20}\h*bank)[^'"]{0,20}['"]>(?<X1165390>)|\-equiv\s*=\s*['"]refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https?://t\.me/(?:BlumCryptoBot|hamster_kombat_Bot)/[^'"]+['"]\s*>(?<X1265591>))|\s+name(?:=['"]generator['"]\s+content=['"]Microsoft\s*FrontPage\b[^%]{99,1200}(?:\$\w{1,40}\h*=\h*@?(?:php(?:_uname|version)\(\)|ini_get\(\h*['"]safe_mode['"]\h*\));\s*){3}(?<X2155971>)|\h*=\h*['"]description['"]\s+content\h*=\h*['"]Priv(?:8|ate)?\s+(?:home\s*)?(?:root\s*)uploader\b(?<X2137880>)|\s*=\s*['"](?:description['"]\s*content\s*=\s*['"]Wells\s+Fargo\s*:\s*Provider\s+of\s+banking\s*,(?<X2055201>)|generator['"]\s+content\s*=\s*['"]HTML\s+Tidy\s+For\s+Linux\s+\(vers\s+\d+\s+\w{3,9}\s+[12][90][7890]\d\)[^`\\\176]{99,9999}<div\s+(?:class|id|style)\s*=\s*['"][^>]+['"]>\s*[^\n%\\]{999,}['"]>\w{1,5}</a>\s*,[^/]{0,200}</div>(?<X2137798>)))))
<p(?:>(?:\h*<img\h*src\h*=\h*['"](?:https?:)?//jamdomegroup\.xyz/(acnt\?_=\d+&amp[^'"]{9,450})['"]\h*alt\h*=\h*['"]\1['"]\h*/></p>(?<X1184721>)|\s*Malaikat\s*Galau\s*defacer[^</]{1,40}</p>(?<X2127450>))|\h*style[\h=]+['"](?:height|width):[012]px[^>]+>(?:<a\h*href[\h=]+['"]h+ttps?://[^>]+>[^<]*\b(?:sex|seks|sexdoll|cheap|fuck)\b[^<]*</a>\s*){1,9}</p>(?<X1217230>)|\h+style(?:=['"]position:\h*absolute;\h*(?:left|right):\h*\-\d{4,8}px;(?:\h*(?:width|height):\h*\dpx;)+\h*overflow:\h*hidden;\h*['"]\h*>[^\v!;]{0,299}</p>(?<X1172931>)|\h*=[^>]{1,99}>\s*(?:<a\h+href\h*=['"][^>]{1,150}>[^<]{1,40}</a>\s*){9}[^\?]{99,3999}\bb374k\h*shell</a>[^\?#]{1,199}<a\h+href\h*=['"][^>]{1,150}>[^<]{1,40}</a>\s*</p>(?<X1163642>)|\h*=\h*["']overflow\h*:\h*auto;\h*position\h*:\h*fixed;(?:\h*(?:height|width):\h*0pt;?\s*)+['"]\h*>\n(?:\s*<a href=['"]https?://[^'"]+['"]>\h*<strong>[^\n<]{0,99}(?:windows|office|microsoft|visio|system|soft|instagram|facebook|twitter|youtube|pc)[^\n<]{0,99}</strong>\h*</a>){9}(?:\s+<a\b[^\n;]+</a>)+\s*</p>(?<X1195072>)|\h*=\h*['"]position\h*:\h*absolute;\h*top:\h*\-\d{5,}px;\h*['"]\h*>(?:\s*<a\h+href=['"]https?://[^'"]{1,40}['"]\h*>[^\n<]{1,60}</a>){3,}\s*</p>(?<X1193251>))|\s+(?:(style=['"]position[\s:]+absolute;\s*(?:(?:top|left|right|bottom)[:\s]+\-\d{4,}px;?\s*)+['"]\s*>)[^\n/<]{1,999}<a\s+href=['"]?https?://[^>]+>[^<]{0,99}</a>[^/\n<]{1,499}</p>(?:\s*<p\s+\9[^\n/<]{1,999}<a\s+href=['"]?https?://[^>]+>[^<]{0,99}</a>[^/\n<]{1,499}</p>){3,}(?<X1226100>)|style=['"](?:[^'"]{0,49}\b[hw](?:eight|idth)[:\h]+0p[tx]\b){2}[^>]{1,49}>\s*(?:<a\b[^>]{0,199}\btitle=['"]([^'"\s]+)[^'"]*['"][^>]{0,199}>\11[^<>]*</a>\s*){9}(?:<a\b[^>]{0,199}\btitle=['"][^>]{0,199}>[^<>]{0,199}</a>\s*)+</p>(?<X1234401>))|re(?:>(?:['"];\s*system\(['"][^'"]{1,40}['"]\s*\.\s*\$_FILES\[['"]([^'"]{0,40}up[^'"]{0,40})['"]\]\[['"][^'"]{1,40}['"]\]\s*\.\s*['"]\s*['"]\s*\.\s*\$\w{1,40}\s*\.\s*['"]/['"]\s*\.\$_FILES\[['"]\13['"]\](?<X2052870>)|\s*(?:Defac|hack|fuck)ed\h*by\b\h*L4663r666h05t\b(?<X2141362>))|\h*>\s*<\?(?:php)?\h*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*;\h*if\h*\(\h*\16\D{2,3}['"]{2}\h*\)(?:\h*\{)?\h*(?:echo|print)\h*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\16\h*\)\h*;\h*\?>\s*<\h*/pre\h*>(?<X2140940>)))
<script(?:>(?:(?:\s*\w=\w-\d;){2}\s*if\(window\.document\)if\(parseInt\(['"]\d['"][^\[]{40,60}\{(\w)=\[[^\]]{999,1800}\]\[\d+\]\.split\(['"]\w['"]\);\w=["'ev\+al]{8,18};\}[^\}]{1,99}\[[aCedfhmor"'\+]{15,40}\][^\}]{1,40}\}\s*if\(\1\)\w=\w;\w\(\w\);\s*</script>(?<X1065092>)|\h*\w{1,9}\h*=\h*['"][a-f\d]{99,999}['"];\h*(\w{1,9})\h*=\h*['"]\w{1,9}=0;\w{1,9}=['"]{2};for\((\w{1,9})=0;\4<\3\[['"]length['']\];\4\+=1\)\w{1,9}\+=\3\.charCodeAt\(\4\);[^/]{99,299}['"];\h*eval\h*\(\3\);\s*<\h*/\h*script\h*>(?<X1141420>)|\h*window\.location\h*=\h*['"]\?indoxploit\b(?<X2146501>)|\s*(?:\/\*[^\*]*\*\/)?\s*function\s*\w{1,9}\s*\(\s*(\w{1,9}),\s*(\w{1,9}),\s*(\w{1,9})\s*\)\s*\{\s*var\s*(\w{1,9});\s*\10\s*=\s*\7\.split\s*\(\s*\8\s*\);\s*var\s*\w{1,9}\s*=\s*\10\.join\s*\(\s*\9\s*\);[^:]+:\/\/[\w\-\.]{1,40}\.[\w\-\.]{2,6}\/[^\*]{1,800}\(\w{1,9}\)@?['"]\)\);\}<\/script>(?<X1058742>)|\s*(?:\w{1,9}\s*=\s*['"][^'"]{1,5}['"];\s*){10,30}(?:\w{1,9}\s*=\s*\w{1,9}\.concat\([^\)]+\);\s*){2,4}var\s+\w{1,9}\s*=\s*document\.createElement\s*\([^\)]+\);\s*(?:(\w{1,9})\.(?:setAttribute|frameBorder)\s*(?:=\s*0|\([^\)]+\));\s*){1,4}document\.body\.appendChild\(\12\);\s*</script>(?<X1062082>)|\s*(?:document|window)(?:\.top)?\.location(?:\.href)?\h*=\h*atob\(\h*['"]aHR0c[^'"]{9,99}['"]\h*\);\s*</[^\?]{1,99}\bSilence\h+is\h+golden\b(?<X2143391>)|\s*(function)\s+(\w{1,20}\(\))\s*\{\s*if\s*\(\s*navigator\.userAgent\.indexoF\([^\(]{99,200}if\(\16\s*>\s*\d+\)[^\}]{99,300}return\s+string\.fromCharCode\([^:]{99,500}\{\s*(window\.eval\(\);)\s*alert\([^<]{999,3000}\17[^\}]{9,30}\}\s*\15[^\{]+\{\s*\17\s*\}\s*\}\s*</script>(?<X1121351>)|\s*/\*\w{4,40}\*/\s*try\s*\{\s*window\.onload\s*=\s*function\(\)\s*\{\s*var\s*(\w{1,40})\s*=\s*document\.createElement\(['"]script['"]\);[^#]{9,999}\19\.setAttribute\(['"]src['"],[^\?`%]{99,999}document\.body\.appendChild\(\19\);\s*\}\s*\}\s*catch\(\w{1,40}\)\s*\{\}\s*</script>(?<X1126792>)|\s*\w{1,40}\s*=\s*['"]['"];[^%]{1,399};\s*(\w{1,40})\s*=\s*['"]%[a-f\d]{2}[a-f\d%]{99,999}['"];(?:\s*var\s*\w{1,40}\s*=['"]\w{0,40}['"];\s*){1,5}function\s*(\w{1,40})\([^%]{4500,5500}\22\(\21\);(?:\s*var\s*\w{1,40}\s*=['"]\w{0,40}['"];\s*){1,5}</script>(?<X1062102>)|\s*alert\(['"][h0ofptkl](?:iss|wn|o?uc[kh]|[ia4]ck)[e3]d\h+by\b[^\|\)]{2,99}\)(?<X2171085>)|\s*document\.(?:cookie(?:=['"]u=['"]\+window\.location\.href;\s*</script>\s*<title>\s*<\?[ph\s]*error_reporting[(\s]+E_ALL\s*\^[^:]+\$\w{1,40}\s*=[^;]+\.aspx['"];(?<X2221012>)|\s*=\s*['"]\w=['"]\+window\.location\.href\s*;\s*<\s*/script>\s*<title>\s*<\?[ph\s@]+error_reporting[\(\s]+E_ALL\s*\^[^\176]+<link\s+rel[='"\s]+sitemap(?<X2221150>)|\s*=\s*['"]u=['"]\s*\+\s*window\.location\.href;\s*</script>\s*<title>\s*<\?[ph\s]*error_reporting[(\s]+E_ALL\s*\^[^%]+\bmt_rand\s*\((?<X1221450>))|write\s*\(\s*['"][<iframe\+'"]{10,25}\s+src\s*=\s*['"]?https?:["'\+/]{2,9}(?:[a-z]{1,16}['"\+\s]{3}){3,9}\w{0,9}\.[a-z'"\+]{2,9}/[^/]{1,40}[</iframe>\+'"]{10,25}\);\s*</script>(?<X1062223>))|\s*function(?:\s*(\w+)[^;]+;\s*\}\s*var\s*\w+\s*=\s*['"]https?://wpemojii\.com[^;]+;[^\(]+\(\);\s*if\s*\(!\29[^\}]+\};\s*\w+\.\w+\s*=\s*\w+\(\)\s*\{\s*(console\.log)[^;]+;\s*\};\s*var\s*scripts[^\{]+\{\s*\30[^;]+[;\}\s]+</script>(?<X1252010>)|\s+(\w{1,20}\(\))\s*\{(?:[^\{]{9,30}\{\s*var\s+\w{1,9}\s*=\s*new\s+Array\((?:['"]#\w{4,9}['"]\s*,?\s*){6,30}\);\s*var\s+(\w{1,9})[^\}]{9,150}\33\s*\+\s*=\s*String\.fromCharCode\(parseInt\(c_clr\s*,\s*\d+\)\D\w\);[\s\}]+[^\/]{99,200}\}\s*setTimeout\(['"]\32['"],\d{1,3}\);\s*</script>(?<X1121313>)|\s*if\s*\(\s*navigator\.userAgent\.indexoF\([^\(]{99,200}if\(\32\s*>\s*\d+\)\s*\{[^:]{99,400}return\s+String\.fromCharCode\([^<]{999,4000}\{\s*alert\([^\)]+\);\s*\w{1,9}\.op\.replace\([^\)]+\);\s*var\s+\w{1,9}\s*=\s*document\.getEl[^;]{1,40};[\s\}]+</script>(?<X1121373>))|\s+\w{1,40}\((\w{0,40})\)\s*\{[^,]+return\s*\(parseInt\s*\(\36,\s*\w{1,40}\(?\)?\)\);\s*\}\s*function\s+(\w{1,40})[^%]{99,250}String\.fromCharCode\s*\([^\.]+\.substr\([^\.]+document\.write\s*\(\37\s*\(['"]3C5343[^'"]+['"]\)\s*\);\s*</script>(?<X10614010>))|\s*this\['eval'\]\(String\['fromCharCode'\]\s*\((?:\d+,?)+\)\);\s*</script>(?<X1042992>)|\s*try\s*\{\s*\w{1,9}\s*=\s*document\.createElement\([^:]{9,99};\s*\w{1,9}\s*=\s*['"fromChade\+]{13,25};[^,]{99,200};\s*\w{1,20}\s*=\s*\[[^\]]{999,3000}\];\s*for\([^\)]+\)\s*\{[^;]{0,4};\s*(\w{1,20})\s*=\s*\40\+String\[["'\+fromChade]{13,25}\]\([^;]+\);\s*\}\s*\w{1,9}\(\40\);\s*\}\s*</script>(?<X1122022>)|\s*var\s*(?:(\w+)\s*=\s*document\.createElement[\(\s"']+script["'\s\)]+;\s*\42\.src[\s=]+['"]https?://jquery\w+\.com/\w+['"]\s*;\s*document\.getElementsByTagName[\(\s'"]+head['"\)\s]+\[0\]\.appendChild[\(\s]+\42[\)\s]+;\s*</script>(?<X1230410>)|a\s*=\s*['"]['"];\s*setTimeout\(\d+\);\s*if\s*\(\s*document\s*\.\s*referrer\s*\.\s*indexOf\s*\(\s*location\s*\.\s*protocol[^`]{100,200}http://[^`]{1,100}\.[^`]{1,6}/js/jquery\.min\.php[^`]{1,650}?>\s*<(?:['"]\+['"])?/script>['"]\s*\);\s*\}\s*</script>(?<X1053912>)|ar2?\s*=\s*['"]\s*if\s*\(\s*document\.gElsByTaN['"]b\)\[\d+\][^\?%@\$]{30000,40000}(?:,\d+\+z){5}\)\);\s*<\/script>(?<X1126731>))|\s*var\s+\w{1,40}\s*=\s*['"][^'"]{1,99}['"];\s*function\s+(\w{1,40})\(\w{1,40},\w{1,40}\)\s*\{\s*if\s*\(\s*!(\w{1,9})\s*\)\s*\{\s*\47\s*=\s*['"][^'"]{20,99}['"];[^\?/]{1,999}eval\(\w{1,40}\);\s*\}\s*\46\(['"][^'"]{1,999}['"]\);\s*</script>(?<X1127481>)|\s*window\.top\.location\.href="http://[a-zA-Z0-9-._ +"]{1,100}?"\s*</script>(?<X1042561>)|\w+=new\s+Array\([^)]+\);var\s*i;\s*for\s*\(\s*i\s*=\s*0\s*;\s*i\s*<=\s*\w+\.length;\s*i\+\+\){\s*document\.write\(\s*String\.fromCharCode\(\s*Math\.round\(\s*\w+\[i\]\s*\)\s*\)\s*\);\s*};\s*</script>(?<X1043201>)|function(?:[\s_0x0-9a-f]+\([_0x0-9a-f,]+\)[^\[]{100,}\[[^\[]{100,}\[(?:['"][\w\d://=\-\.\|\?\&]{3,15}['"],)+['"][\w\d://=\-\.\|\?\&]{3,15}['"]\][^<]+case['"]\d+['"]:if\(\!_0x\w+\[_0x[a-fxh\d\(_\.,\)\+']{128,256}\]\)return;continue\;\}break;[\}\);]{11}</script>(?<X1268271>)|\s*(_0x\w{1,20})[\(\s]+_0x\w{1,20}[,\s]+_0x\w{1,20}[\)\s]+\{\s*var\s*(_0x\w{1,20})[=\s]+_0x\w{1,20}[\(\)\s;]+return\s*\52[=\s]+function[\(\s]+(_0x\w{1,20})[^;]+;\s*var\s*_0x\w{1,20}[=\s]+\53\[\54\];\s*return\b[^\}]+\}[,\s]+_0x\w{1,20}[\(\s]+_0x\w{1,20}[,\s]+_0x\w{1,20}[\)\s;]+\}\s*\}\s*</script>(?<X1248381>))|var\s*b="\w{1,30}";\s*c="\w{1,30}";\s*function setCookie\(\s*a,b,c\){\s*var\s*d\s*=\s*new\s*Date;d\.setTime\(\s*d\.getTime\(\s*\)\s*\+\s*\d+\s*\*\s*c\s*\*\s*\d+\s*\*\s*\w{1,30}\s*\);\s*var\s*e="expires="\+d\.toUTCString\(\);\s*document\.cookie.+?encodeURIComponent\(document\.referrer\)\s*\+\s*'">[<script/>'+\s]+\)\)\);\s*</script>(?<X1043061>))|[^:\.>]{1,99}src\s*=\s*['"]https?://magento(?:\.name|core\.net)/[^>\.]{1,40}\.js['"]\s*>\s*</script>(?<X1127220>)|[^><]{1,99}\bsrc[=\s]+['"][htps:/]+(?:cdn\-skins|cdnfrontend)\.com/[^<>]{1,99}>\s*<\s*/script\s*>(?<X1261763>))
<script(?:[^>]*>(?:[^\(]{1,20}if\s*\(\s*navigator\.userAgent\.match\s*\(/\((?:(?:android|midp|j2me|symbian|series\s*\d{0,3}|symbos|windows\s*\w{0,9}|ppc|smartphone|blackberry|bb|mtk|bada)\|?){8}[^/]{9,99}\)/i\)!\s*==\s*null\)\s*\{\s*window\.location\s*=\s*['"]https?://[^'"]+['"];\s*\}[^<]{1,20}</script>(?<X1135232>)|\s*(\w{1,20})\s*=\s*new\s+Array\(\);\s*(?:\2\[\d+\]\s*=\s*['"]\d+['"];\s*){29}[^\{]{20000,};\s*(\w{1,20})\s*=\s*['"]['"];[^\}]{20,150}\}\s*\}\s*document\.write\(unescape\(\3\)\);\s*</script>(?<X1125912>)|\s*\w{1,20}\s*=\s*[^;]+;\s*var\s+\w{1,9}\s*=\s*(?:true|false);[^'"]{9,60}(\w{1,9})\s*=\s*['"](?:%\w{2,3}){99}[^'"]{9,200}['"];[^\(]{9,40}function\s+(\w{1,9})\([^\)]+\)\s*\{\s*(?:var\s+\w{1,9}\s*=\s*['"][^'"]{0,5}['"];){3}[^\n]{999,5000};\s*\6\(\5\);[^<]{1,40}var\s+\w{1,20}\s*=\s*(?:tru|false);\s*</script>(?<X1124183>)|\s*var\s+(\w{1,20})\s*=\s*['"][^'"]{9,150}['"];\s*var\s+(\w{1,20})\s*=\s*['"][^'"]*['"];\s*for\([^\)]+\)\s*\9\+\s*=\s*String\.fromCharcode\(\8\.charCodeAt[^;]+\);\s*document\.write\(\9\);\s*</script>(?<X1122992>)|var\s*(\w{1,20})\s*=\s*['"][^"]{999,30000}['"];\s*(\w{1,20})\s*=\s*['"][^'"]*['"];\s*(\w{1,20})\s*=\s*['"][^'"]*['"];\s*var\s+(\w{1,20});\s*\14\s*=\s*\11\.length;\s*[^\{]+\{\s*\12\+=\s*String\.from(CharCode)\(\11\.\15At\([^\}]+\}\s*\13\s*=\s*unescape\(\12\);\s*document\.write\(\13\);\s*</script>(?<X1122881>))|[^>]+>(?:[/\*\s]+<\!\[CDATA\[\W{0,49}/\*\s*Privet\s+darkv\.\s*Each\s+domain\s+is\s+\dh\s+fox\s+dead\s*\*/\s*\(Function\(\)\s*\{\s*var\s+\w\s*=\s*window;[^\n\*]{99,9999}\)\h*\(\h*\);[/\*\]>\s]+</script>(?<X1216631>)|[^<]{0,30}<\!\[CDATA\[\W{0,9}/\*\s*Privet\s+darkv\.\s*Each\s+domain\s+is\s+\dh\s+fox\s+dead\s*\*/\s*\((Function\(\))\s*\{\s*var\s+(\w)\s*=\s*window;\s*\19\[[^\(]{300,1499}(\w)\s*=\s*\18\s*\{\s*if\([^:]{200,600}\18\{[^;]+;\s*(\20\(\))\}[^\}]+\};\s*\21\}\)\(\);[^<]{0,15}</script>(?<X1121504>)|\s*(?:status\s*=\s*location;\s*)?document\.write\s*\(['"]<iframe\s+src\s*=\s*['"]https?://[^'"]+['"]\s+width\s*=\s*0\s+height\s*=\s*0\s+[^:>]+display\s*:\s*none[^>]+>\s*</iframe>\s*['"]\s*\);\s*</script>(?:<!\-\-[^\-]+\-\->)?\s*\Z(?<X1061434>)|\s*(\$\w{0,9})\s*=\s*['"][^'"]{999,8000}['"];\s*function\s+(\w)\((\w)\)\s*\{\s*(\w)\s*=[^\{]{1,40}\{\s*if\s*\(\26\.charAt\([^\{]{1,9}\{\s*(\w{1,9})[^;]{1,30}\27\s*=\s*\27\+\28;\s*\}\s*return\s+unescape\(\27\);\s*\}\s*eval\(\25\(\24\)\s*\);\s*</script>(?<X1121652>)|\s*function\s+(?:(\w{1,9})\(([^\)]+)\)\s*\{\s*var\s+\w{1,9}\s*=\s*\31\.length,[^\(]{9,40}(\w{1,9})\s*=\s*Array\([^\)]{99,300}\);[^\[]{9,99}\(\32\[\31\.charCodeAt\([^\{]{9,20}\{(\w{1,9}).\s*=\s*String\.fromCharCode\([^'"]{9,40}document\.write\(\33\)\s*\}\s*\}\s*\30\([^\)]{9,150}\)\s*</script>(?<X1121281>)|(dnnViewState\(\))\s*\{\s*var[^\(]{9,99}\w\s*=\s*new\s+Array\([^\)]+\)[^\?]{99,250}\);\s*\}\s*\35;\s*</script>(?<X1119972>))|\s*setTimeout\(['"]location\.replace\(['"]https?://onetdsgo\.com/\w{1,15}\.php\?p[^\)]{1,9}\)['"],\h*\d{1,4}\);\s*</script>(?<X1152492>)|\s*var\s+\w{1,20}\s*=\s*\d+;\s*eval\s*\(\s*String.fromcHarCode\s*\(\s*[^\)]{1,70}104,\s*116,\s*116,\s*112,(?:\s*115,)?\s*58,\s*47,\s*47,\s*118,\s*101,\s*114,\s*121,\s*98[^\)]{9,99}46,\s*112,\s*104,\s*112[^\)]{99,500}\)\s*\);\s*</script>(?<X1061662>)|var a=.+?String\.fromCharCode\(a\.charCodeAt\(i\)\^2\)}c=unescape\(b\);document\.write\(c\);</script>(?<X1042811>))|[^>]{0,24}>\s*(?:document\.write\(unescape\(['"][^'"]{99,499}%3C%74%69%74%6C%65%3E%4C%6F%67%20%69%6E%20%74%6F%20%79%6F%75%72%20%50%61%79%50%61%6C%20%61%63%63%6F%75%6E%74%3C%2F(?<X2124040>)|function\s*(?:(\w{1,40})\s*\(\)\s*\{\s*\};\s*var\s*\w{1,40}\s*=\s*['"]['"];\s*\41\.prototype\s*=\s*\{[^/]{599,1499}['"]https?:[^;]{9,49}[count'"\+]{8,24}[^/]+var\s*(\w{1,20})\s*=\s*new\s*\41\(\);[^/\.]{0,40}\42\.\w{1,16}\(\);[^/]{0,40}</script>(?<X1126741>)|\w{1,40}\((\w{1,40})\)\s*\{\s*function\s*(\w{1,40})\s*\(\)\s*\{\s*var\s*(\w{1,40})\s*=\s*\d+;\s*return\s*\46;\s*\}\s*return\(parseInt\(\44,\45\(\)+;\s*\}\s*function\s*(\w{1,40})\s*\([^/]{99,999}document\.write\(\47\(['"]\w{99,3999}['"]\)\s*\);\s*</script>(?<X1123051>))|var\s*(?:(\w{1,40})\s*=\s*['"]\w{999,5000}['"];\s*var\s*(\w{1,40})\s*=\s*\49\.split\(['"]\w{1,40}['"]\);\s*[^\{]{1,499}\{\s*(\w{1,40})\s*.?=\s*String\.fromCharCode\(\50\[[^\]]+\]\s*\);\s*\}\s*document\.write\(\51\)\s*</script>(?<X1123001>)|\w{1,40}\s*=\s*(?:String|parseInt);[^'"]{1,99}var\s*\w{1,40}\s*=\s*['"](?:\w{1,40}(.)){9}[^\n'";\)\(\.\-]{999,5000}['"]\.split\(['"]\53['"]\);\s*var\s*(\w{1,40})\s*=\s*['"]\w{1,40}['"]\.replace\([^>]{99,999}\54\(\w{1,40}\);\s*</script>(?<X1126751>)))|[^>]{0,32}>\s*document\.write\(unescape\(['"](?:%[\da-f]{2}){20}[^"'\);_vrt]{9,999}['"]\)\s*\)\s*;\s*df\(['"][^"']{9,25000}['"]\)\s*</script>(?<X1121735>)|[^>]{0,33}>\s*(?:(t\d*)\s*=\s*['"][\d,]+['"]\s*\57\s*=\s*eval\(['"]String.fromCharCode\(['"]\+\57\+['"]\)['"]\);\s*document\.write\(\57\);\s*</script>(?<X1124631>)|var\s*(\w)\s*=\s*['"]{2};\s*var\s*(\w{1,9})\s*=\s*['"][a-f0-9]{99,999}['"];\s*for\(\s*(\w)=0;\s*\61<\60\.length;\s*\61\+=\d+\s*\)\s*\59\+=\s*String\.fromCharCode\(parseInt\(\60\[\61\]\s*\+\s*arr\[\61\+1\]\s*,\s*\d+\)\s*\);\s*eval\(\59\);\s*</script>(?<X1124591>))|[^>]{0,40}>\s*(?:document\.write\s*\(['"]\\u003c\\u0069\\u0066\\u0072\\u0061\\u006d\\u0065[^'"]{99,500}\\u0076\\u0069\\u0073\\u0069\\u0062\\u0069\\u006c\\u0069\\u0074\\u0079\\u003a\\u0068\\u0069\\u0064\\u0064\\u0065\\u006e[^'"]{99,300}['"]\);\s*</script>(?<X1129581>)|if\s*\(\s*typeof\s*\(\s*redef_colors\s*\)\s*==\s*['"]undefined['"]\s*\)\s*\{\s*var\s*\w{1,40}\s*=\s*new\s*Array\(['"](?:#\w{6}['"],[^;]{99,}\)|[^;]{1,99}\d+);[^\?%#]{499,1299}(try_pick_colors\(\))['"],\s*\d+\);\s*\}\s*\}\s*\64;\s*\}\s*</script>(?<X1127294>))|[^>]{0,49}>\h*var\h+_0x\w{4,9}\h*=\h*\[(?:['"](?:length|fromCharCode|createElement|type|async|src)['"],){3}[^/\v]{999,1499}\bvar\h+(\w{1,40})=document\[(_0x\w{4,9}\()[^/\v]{1,199}if\(\66\[\w{1,9}\]\[['"]id['"]\]\D{2,3}\67[^/\v]{9,49}\{\w\(\);?\}\h*</script>(?<X1143471>)|[^>]{0,60}>(?:[ ]{200,}var\s*(\w{1,16})\s*=\s*document\.createElement\(['"]iframe['"]\)[^!\n]{99,999}appendChild\(\69\);\s*</script>(?<X1121990>)|\s*\w{9,40}\s*=\s*['"]['"];\s*var[^%]{60,299};\s*(\w{1,40})\s*=\s*['"](?:%\w{2}){9}[^'"]{99,999}['"];[^\?`]{2999,9999};\s*\w{1,40}\(\71\);(?:\s*var\s*\w{1,9}\s*=\s*['"]?\w{1,40}['"]?;){2,5}\s*</script>(?<X1127861>)|\s*eval\(unescape\(['"]document\.write%28String\.fromCharCode%2860%2C105%2C102%2C114%2C97%2C109%2C101%2C32[^'";\)\(]{299,600}%2C105%2C102%2C114%2C97%2C109%2C101%2C62[^'";\)\(]{0,40}['"][\s\)]+;\s*</script>(?<X1127821>)|\s*function\s*(?:(\w{9,40})\((\w{9,40})\)\s*\{\s*return\(parseInt\(\75,\d+\)\);\s*\}\s*function\s*(\w{9,40})\((\w{9,40})\)\s*\{[^\}]{99,999}String\.fromCharCode\(\74\(\77\.substr\([^\(]{9,99}document\.write\(\76\(['"][^'"\)]{99,599}['"]\)\);\s*</script>(?<X1127831>)|getfromDOM\(containerid\)\s*\{[^/]{99,999}var\s*(\w{1,40})\s*=\s*document\.createElement\([^/:]{1,99}\79\.innerHTML\s*=\s*['"][^:]{0,9}https?://[^'";]{9,49}['"];\s*\79\.style\.visibility\s*=\s*['"]hidden['"][^/]{99,999}['"]\)\[\d+\]\.appendChild\(\w{1,40}\);\s*</script>(?<X1126801>)))|[^>]{0,80}>[ ]{200,}\b(?:if|[a-z]{1,2}=)[^\n<]{999,}<\s*/script>(?<X1123963>)|[^>]{0,99}>[^<]{0,99}\bwindow\.location\.href[\h=]+['"]https?://cartoonmines\.com/[^'";]{1,99}['"];[^<]{0,99}</script>(?<X1233451>)|[^>]{5,30}>(?:(?:<![^\(]{1,20})?\(function\(\)\{var\s*(\w{1,9})=['"]var\176[\176\d\w\(\)]{5,100}[^'"]{9,600}['"];\s*var\s*(\w{1,9})=\83\.replace\([^\)]{1,15}\);\s*var\s*(\w{1,9})=unescape\(\84\);\s*eval\(\85\)\}\)\(\);\s*(?:[^\>]{1,20})?></script>(?<X1128262>)|\s*var\s*(_0x\d{1,9})=\[['"]['"],['"](?:\\x\d{1,3}\w){1,20}[^\]]{99,999}\];function\s*(\w{1,9}\(\))\{var\s*_0x\w{1,6}=\87\[[^>]{99,1100}return\sunescape\(document\[\87\[[^>]{50,350}\88\}\};</script>(?<X1128961>)))
<script\b(?:[^:><]{1,99}src\s*=\s*\\?['"]https?://(?:j[pq]uery[^/]{1,16}\.(?:icu|jp|pl|xyz|top|ga)/jquery[a-z\-\.]{2,}\.js\\?['"]\s*>\s*<\s*/script>(?<X1222731>)|storepay\.pw/jquery[a-z\-\.]{2,}\.js\\?['"]\s*>\s*<\s*/script>(?<X1222750>))|[^<]{1,60}\bsrc\h*=\h*['"]https?://recaptcha\-in\.pw/\w+\.js['"]\s*>\s*</script>(?<X1043273>)|[^>:]{0,99}\bsrc=['"]?(?:https?:)?//(?:cdn\.scriptsplatform\.com/[^>]{1,199}>\s*</script>(?<X1237051>)|scripts\.asi\.services/[^>]{1,199}>\s*</script>(?<X1234860>))|[^>]*>\s*(\$\w+)[\s=]+function[\s\(]+(\w+)[\s\)]+\{[^\}]+\breturn\s+(\6\.list)\[\7\][\s;\}]+\8[\s=]+\[\s*['"]\\?(['"])[^\]'"]+\9=ferh\.noitacol\.(?:tnemucod|wodniw)['"]\s*\];[^/]{0,199}\6[\s\(]+\d+\s*\)[^/]{0,199}</script>(?<X1204450>)|[^>]*>\s*(document\.write)\(['"]<div\b[^@#%]{99,200}\bhref=['"]https?://(?:www\.)?(?:shelldownload|privshell)\.(?:org|com)\b[^#%&@]{300,800}<(script)\b[^>]*>\s*\11\([^\)]+\);\s*</\12>(?<X1197841>)|[^>]*>\s*if\s*\([^\);\n]{1,199}//(?:\w+\.)?pdflive\.store/[^</\n]{1,499}</(script)>\s*<\14\h+src=['"]data:text/java\14;base64,[^'"]+9wZGZsaXZlLnN0b3Jl[^'"]+['"][^>]{0,99}>\s*</\14>(?<X1206171>)|[^>]*>\s*var\s+(\w+)[\s=]+(?:(\w+)[\s\(]+\[\s*['"]https?://[^'"]+['"][^;]+\);\s*function\s+\17[\s\(]+(\w+)[\s\)]+\{\s*return\s+\18\[[^;]+;\s*\}\s*if\s*\([^;/\{]+\{\s*(\w+\.location\.href)[\s=]+\16[\s\+]+['"]/\?(arsae)=(['"][\s\+]+\w+[\s\(]+)\19\)[\s\+]+['"]&\20\w+=\21document\.refer+er[\s\)]+\}\s*</script>(?<X1203070>)|(document\.)createElement[\s\(]+['"](script)['"][\s\)]+;\s*\16\.setAttribute[\s\(]+['"]src['"][,\s]+window\.atob[\s\(]+['"]Ly9hcGl1anF1ZXJ5LmNvbS9[^;]+;\s*\23[^;\(]+\.appendChild[\s\(]+\16[\s\)]+;?\s*</\24>(?<X1202750>))|[^>]*\bsrc=(?:['"](?:https?:)?//free\.rnv\.life/[^>]+>\s*</script>(?<X1201920>)|['"]?(?:https?:)?//(?:(?:\w+\.)?googlestatisticalserver\.com/[^>]+>\s*</script>(?<X1208430>)|[^/'">]{0,49}\.belonnanotservice\.ga/[^>]{1,99}>\s*</script>(?<X1202700>)))|[^>]{0,199}>\(function\([^\)]+\)\{[^\}]{0,199}\b(\w+)=\w+\.createElement[\s\(]+\w+[^;]+;if\((\w+\.)location\[["']href['"]\][^\}]{0,199}\b\29\.src=[^;=]{0,49}\b\30atob\([^\}]+[\s\}\)]+\(window,document,['"]Ly81bGlmZS5wdy9[^\)]+\);?</script>(?<X1230260>)|[^>]{0,199}>\s*(Object\s*/\*)<!\[CDATA\[[\s/\*]+(\(function)[\s\(\)]+\{\s*(var\h+)\w+[\h=]+['"][^'"]+['"];\34\w+[\s=]+\[(?:\h*['"][^'"]+['"]\h*,){9,}['"][^'"]+['"]\h*\];\h*\33\([^\{]+\{[^\n]+\w+\[(\w+\()[^\)]+\)\]\[\35[^\)]+\)\]\([^\)]+\);\};\w+[\h\(\)\};]+;\h*\32[\]\s/\*>]+</script>(?<X1195311>)|[^>]{0,199}>\s*window\.location(?:(?:\.\w+){0,3}[\s=]+['"]https?://(?:[^/]{1,99}\.(?:bid|top|cc|me)/go/[^'"]+['"][\s;]{0,9}</script>(?<X1216983>)|cheapmedplace\.com/['"][\s;]+</script>(?<X1218081>)|ois\.is/[^'"]*['"][\s;]+</script>(?<X1220870>)|xxxmedia\.bid/[^'"]+['"][\s;]{0,9}</script>(?<X1216712>))|[\s=]+['"](?:https?:)?//technkia\.xyz/[^'"]+['"];?\s*</script>(?<X1217606>))|[^>]{0,199}\bsrc=(?:['"]?(?:https?:)?//(?:[^/'"\s]{0,99}\b(?:mackfbs\.me|directstore\.pw|legendarytable\.com|xvaaa\.com|by33589\.com)/[^>]{0,199}>\s*</script>(?<X1211574>)|[^/\s'"]*\belizaguarapo\.com/[^>]+>\s*</script>(?<X1198590>))|[^\s/]{0,9}//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"\s>:]+\.js[^>]{0,199}>\s*</script>(?<X1223772>))|[^>]{0,49}>\s*eval[\s\(]+String\.fromCharCode\s*\([^\?\(\)]{1,499};\s*var\s*(\w+)[\s=]+['"](?:https?:)?//deliverygoodstrategy\.com/[^\?'"]+\.js\b[^/><]{1,199}\b(\w+)\.src\s*=[^;\?/<>]{0,49}\b\45\b[^\?></]{1,199}\.insert(?:after|before)[\s\(]+\46\b[^\)]+\)[;\)\s]+</script>(?<X1212941>)|[^>]{0,99}>[\s\(]+function[\s\(]+(\w+)[\s,]+\w+[\s,]+(\w+)[\s\)]+\{\s*\49\.src\s*=[^;]{0,99}\b\48\b[^\}]+\.appendChild[\s\(]+\49[\s\)]+[^</]{0,99}\}\s*\)\s*\((?:[^,]+,){2}\s*document\.createElement[\s\(]+['"]script['"][\s\)]+</script>(?<X1196122>)|[^>]{0,99}>\h*var\h+(_0x\w{1,9})\h*=\h*\[\h*['"][^'"]+['"]\h*,[^\]]{99,499}\];\h*function\h+\w{1,40}\h*\((?:\h*_0x\w{1,9}\h*,){2}\h*_0x\w{1,9}\h*\)\h*\{[^\v]{999,4999}\{\h*window\h*\[\h*\51\[\d+\]\h*\]\h*=\h*\w{1,9}\h*(?:\}\h*else\h*\{\};\h*){1,3}</script>(?<X1177441>)|[^>]{0,99}>\s*(/\*[^*/]{1,99})\bstart\s*\*/\s*(?:var\s*(\w+)\s*=[^;]{1,99};\s*){2,}var\s*(\w+)[\s=]+new\s*XMLHTTPRequest[\s\(\)]+;\s*\55\.open[\s\(]+['"][^,\)]+,\s*['"]https?://[^/\?'"]{0,99}\bbuymskey\.com['"/][^;]{1,99};\s*\55.send[\s\(]+\54[\s\)]+;\s*\53end\s*\*/\s*</script>(?<X1192922>)|[^>]{0,99}>\s*(<!\-\-)\s*(Hax[0o]r\-nubi\s*\-\->)\s*document\.write\h*\(\h*unescape\h*\([^\)]{99,9999}\)\h*\);?\s*\57\s*/?\58\s*</script>(?<X1165232>)|[^>]{0,99}>\s*(?:(?:var\s+)?atOptions\h*=\h*\{[^/;]{1,299};\s*)?document\.write\h*\(\h*['"]<[^>;\v]{1,199}\b[sb](?:loi1|cloudhost)\.com/[^>]{1,99}\.js(?:\?[\w=\.&]{0,49})?['"][^;\)\v=]{0,99}\);?\s*</script>(?<X1166333>)|[^>]{0,99}>\s*(?:<!\-\-\s*)?document\.write\h*\(\h*unescape\h*\(\h*[^\);]{1,499}%3A%2F%2F%63%6F%69%6E%68%69%76%65%2E%63%6F%6D%2F%6C%69%62%2F%63%6F%69%6E%68%69%76%65%2E%6D%69%6E%2E%6A%73%[^\)]{1,999}\)\h*\);?\s*(?://\s*)?(?:\s*\-\->)?\s*</script>(?<X1181100>)|[^>]{0,99}>\s*function\h+(\w{1,40})\h*\(\h*(\w{1,40})\h*\)\s*\{\s*var\h+(\w{1,40})\h*=[^\}]{1,499}(?:\.location\.href\h*=\h*\63\h*\+\h*\64\b[^:\+<>]{1,399}){3}\bdocument\.writeln\h*\([^\)]+\bsrc=\\?['"](https?://[^'"]+)['"][^\)]+\)[\s\}]+\62\h*\(\h*['"]\65['"]\h*\);?\s*</script>(?<X1181310>)|[^>]{0,99}>\s*var(?:\h*(_0x\w{1,9})\h*=\h*\[[^\]]{199,1999}\];\h*if\(document\[\67\[\d\]\]\[\67\[\d\]\]\([^\v]{9,99}\bif\(\W\(android\|bb\\d\+\|meego[^\{;]{999,4999}\{var\h*_0x\w{1,9}\h*=(?:\h*new\h+Date\(){2}[^/]{9,399}\bwindow\[\67\[\d\]\],\h*\67\[\d\][\h\)\}]{2,3}\s*</script>(?<X1158013>)|\s*(\w\$\w+)[\s=]+['"]\69['"][^;]{0,99};\s*window\[\69\][\s=]+\{[^;]{1,999};[^\?#><]{199,1999};\s*decrypt[\s=]+this(?:\[[^\]]+\])+\([^/<\n]{1,999};(_0x\w+)\[(_0x\w+\()0x\w+,0x\w+\)\]=\71[^\)]+\),\h*document(?:\[\71[^\]]+\]){2,}\(\70\)[\h,]+\69[\h=]+undefined;\}[\s\(\)]+;\s*</script>(?<X1195851>)|\s+(\w+)[\s=]+['"](?:https?:)?//[^/'"]+\.my\.id[/'"][^;]{0,99};\s*if\s*\([^/\?]{0,499}\]\.some[\s\(]+\w+\s*=>\s*navigator\.userAgent\b[^</;\{]{0,99}\{\s*((?:window\.)?location\.(?:href|replace))[\s\(=]+\73\s*\+[^;\}<>]{0,99}\74\b[^\}]+\}\s*</script>(?<X1196970>))|[^>]{0,99}\bsrc=(?:['"](?:https?:)?//(?:native\.propellerclick|tharbadir|phortaub)\.com/[^'"\s\?]{1,99}\?z=\d{7}[^>]{1,99}>\s*</script>(?<X1179074>)|['"]?(?:https?:)//way\.specialblueitems\.com/[^\s\?='">]+\.js\b[^>]{0,99}>\s*</script>(?<X1225640>)|['"]?(?:https?:)?//(?:(?:hacklinkz\.org|r00tshell\.info)/[^>]+>\s*</script>(?<X1232392>)|r00t\.info/[^>]{0,99}>\s*</script>(?<X1191741>)|st(?:ore|eam)\.piterreceiver\.ga/[^'">\s\?]+\.(?:js|php\d*)\b[^>]{0,99}>\s*</script>(?<X1193692>))|['"]data:text/java(script);base64,\s*[^'"]+[Lo](?:y9wZGZsaXZlLnN0b3Jl|vL3BkZmxpdmUuc3RvcmU)[^'"]+['"][^>]{0,99}>\s*</\81>(?<X1206950>)|['"]https?://translate\.google\.com/[^'"\s]{1,99}=https?://[^/'"\s]{1,99}/(?:ntfc|apu)\.php\?\w{1,9}(?:%3d|=)\d{7}[^>]{1,99}>\s*</script>(?<X1180250>)|[^\s]{0,9}//(?:mingledunorder|pyxidiaimmerit|pppbr)\.com/[^>]{0,99}>\s*</script>(?<X1196292>)|\\?['"]?(?:https?:)?//[^/'"\s]{1,49}/(?:ntfc|apu)\.php\?(?:p|zoneid)=\d{7}\b[^>]{1,199}>\s*<\\?/script>(?<X1179457>))|[^>]{0,99}\bsrc[\h=]+(?:['"\s]*(?:https?:\s*)?//\w+\.violetlovelines\.com/[^'"\s\?]{1,49}\.js['"\?][^>]{0,99}>\s*</script>(?<X1228260>)|['"]https?://(?:obz\.bz|qqa\.qa|g\-l\.gl|d\-ev\.dev)/[^>]{0,99}></script>(?<X1236590>))|[^>]{0,99}\bsrc\h*=\h*['"]https?://(?:[^'"\./\s]{1,40}\.)?letsmakeparty\d+\.ga/\w\.js[^>]{0,99}>\s*</script>(?<X1176852>)|[^>]{0,99}src=['"]?(?:https?:)?//pagead\d*\.googlesyndication\.com/[^'"\s\?]{0,99}\?client=ca\-pub\-3921405283572600['"\s][^>]{0,99}>\s*</script>(?<X1234900>)|[^>]{1,60}\bsrc\h*=\h*['"]https?://[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][^>]{0,99}>\s*</script>(?<X1151582>)|[^>]{1,99}\bsrc(?:=['"]?(?:https?:)?//loloclicks\.biz/[^'"\s]{4,}['"\s][^>]{0,99}>\s*</script>(?<X1190711>)|\h*=\h*['"][^'"]{1,19}\.collectfasttracks\.com/[^>]{1,99}>\s*<\h*/script\h*>(?<X1141943>))|[^\.<>]{1,199}\bsrc\s*=\s*['"](?:http)?s?:?//saylor2xbtc\.com/[^'"]+['"]\s*>\s*</script>(?<X1220990>))
<title>\s*(?:(?:(?:Y|&#89;)(?:A|&#65;)(?:H|&#72;)(?:0|&#48;){2}|(?:0|&#48;)(?:T|&#84;)(?:H|&#72;)(?:E|&#69;)(?:R|&#82;)|(?:A|&#65;)(?:O|&#79;)(?:L|&#76;))?(?: |&#32;)?(?:S|&#83;)(?:1|&#49;)(?:G|&#71;)(?:N|&#78;)(?: |&#32;)(?:1|&#49;)(?:N|&#78;)(?<X2061214>)|(?:0byteV\d\W{1,4}PHP\s+Backdoor|Keisatsu\s+Shell\s+V\d+)\s*<(?<X2130331>)|(?:[s5]h[4a]n[9g][1]\s*&\s*(?:&nbsp;)?\s*n[3e]u[7t][2r][4a][1l][1i][5s][3e]|m[2r]\.c[2r][4a]ck[3e]d\S{0,6}\s*[4a]c{2}[3e][5s]{2})\s*<(?<X2126643>)|(?:ANZ|bank\s*of\s*new\s*zealand)\W{1,9}(?:Internet\s*banking\s*)?(?:Log|sign)\s*(?:in|on)\s*<[^\?]{99,1500}<form\s+(?:name\s*=\s*['"][^'"]+['"]\s*|method\s*=\s*['"]post['"]\s*){1,2}[^>]{9,99}action\s*=\s*['"][^'"]+\.php['"](?<X2129860>)|(?:cPanel\s+)?Turbo\s+Force[^<]{3,19}</title>(?<X2046122>)|(?:G|&#71;)(?:M|&#77;)(?:A|&#65;)(?:1|&#49;)(?:L|&#76;)(?:\.|,|&#76;|&#44;)?[^\[]{99,400}<img\s+src\s*=\s*['"]data:image/(?<X2061220>)|(?:Hacked\s+by\s+)?F[i1]r[3e]\s+H[a4@]wk\s+(?:plugin)?\b(?<X2123310>)|(?:Magic|MySQL|Peterson|indoxploit|CIH\.)\s*[^\?]{0,15}\s*(?:Web)?Shell(?<X2057211>)|(?:MyShell|CCCP\s+Modular\s+Shell)\s*<(?<X2061642>)|(?:OpenBank|Bankinter|ABANCA)\s*justificante\s*de\s*Ingreso\s*</title>(?<X2201830>)|(?:Phpspy|jshell)\s+Ver(?:sion)?\s+[\d\.]{3,4}\s*</(?<X2124921>)|(?:priv(?:ate|8))?\s*VHOST\s*(?:config)?\s*grabber\s*</(?<X2127390>)|(?:Priv8|Private)?\s*(?:Mister|Mr)\s+Spy\s*</(?<X2055901>)|(?:Priv8|Private)\s+Mailer(?<X2055911>)|(?:PUBG\s+(?:Mobile|PC)|Free\s+Fire\s+Indonesia)[^\?]+<\?php\s*eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(['"]jY9La8JAEMfvgXyHYRE2lvgol[^'"]{99,500}['"]\)\s*\)\s*\);?\s*(?:\?>|\Z)(?<X2061601>)|(?:Sign\s+On|Email|Access)[^\|]{1,40}\s*\|\s*Wells\s+Fargo\s*</title>(?<X2126110>)|(?:Small|PHP)\s*Web\s*Shell\s*by(?<X2057611>)|(?:Wordpress|Joomla|magento)\s*mass\s*defacer\s*(?:private|priv8|privat)?\s*by\b(?<X2133130>)|([^<]+)\s*</title>[^\\]{99,2000}<(h\d)\s+[^>]+>\s*\19\s*</\20>\s*</header>\s*<div[^>]+>[^\n]{999,40000}</div>\s*<footer\s+[^>]+>\s*(?:<a[ ]+href=['"]?https?://[^\?]{9,99}\.(?:php|html)(?:\?\w{1,3}\s*=[^>]{9,150})?>\w{0,3}</a>\s*,\s*){15}(?<X2125220>)|(\(c\))\s*private\s+mail(?:-|\s*)worker\s*\22(?<X2062360>)|(CaixaBank)[^\w]{1,5}banca\sdigital\s*\24Now<\/title>(?<X2128921>)|-\s*r\s*w\s*-\s*r\s*-\s*-\s*r-\s*-<(?<X2051810>)|0by[t7][3e]\s*m[1i]n[1i]\s*(?:web\s*shell\s*)?</(?<X2133200>)|0x1999\s*</title>\s*\$\w{1,40}\s*</head>\s*<body\s+onLoad(?<X2061981>)|403\s*-\s*Forbidden\s*</title>[^'"]{1,600}['"];\s*(?:exit|die)\b[^;]{0,40};\s*\}\s*function\s+random_number\(\)\s*\{[^\{]{1,600}=\s*visitor_country\(\);(?<X2122831>)|404\s+Not\s+Found\s*<(?:/(?:[^\-\*\|=\(]{99,500}system\(['"]rm\s+\-rf(?<X2119422>)|title>[^%]{99,600}\$\w{1,20}\s*=\s*stream_socket_client\s*\(['"]udp://[^'"]+['"]\);(?<X2125080>)|title>[^=]{9,400}(?:\{\s*echo\s+['"])?<form\s+(?:action\s*=\s*['"][^'"]*['"])?\s*method\s*=\s*['"]?post\b(?<X2061153>))|[^=]{99,300};\s*\$\w{1,20}\s*=\s*['"]safe_mode\s*=\s*off\b(?<X2126530>))|40[43]\s*(?:\W\s*)?[FN](?:orbidden|ot\s*Found)\b[^\?]{499,1499}\$m(e?sg|essage)\h*=\h*['"][^;]{1,199}\$username[^;]{1,99}\$passw?(?:o?r?d)?\b[^\?]{9,499}\bmail\([^\)]+\$m\34(?<X2154260>)|:.Spade\s*Mini\s*Shell(?<X2051760>)|::\s+AventGrup\s+::\.\.(?<X2051540>)|:\s*:\s*Inbox\s*:\s*:\s*Unlimited\s*</title>\s*<\?\s*@?eval\s*\(\s*base64_decode\s*\((?<X2056990>)|</title>(?:[^:"']{1,40}<\w+>\h*40[34]\h*(?:Not\h*Found|Forbidden)\h*</\w+>[^\?]{9,9999}\$perms&(?<X2227251>)|\s*<script>\s*var\s*\w{1,16}\s*=\s*['"][^'"]{0,33}\b[S5]h[e3]{1,9}[l1]{1,9}\b[^'"]*['"];(?<X2122330>))|<\?=?(?:php)?os\(['"]Postman[^\?]{9,50}by\s+r[3e]v[3e]ng4ns\b(?<X2129150>)|<\?[ph\s@]*error_reporting[\(\s]+E_ALL\s*\^[^#`]{99,9999}(\$\w{1,40})[=\s@]+mt_rand\s*\([^>\?]+(\$\w{1,40})\s*\.?=[^;]+\42[^>\?]+(\$\w{1,40})[\s\.=@]+file_get_contents[\s\(]+\43[^>\?]+echo\s*\44\s*;(?<X2221570>)|<\?php(?:\s*echo\s*(?:(\$\w{1,40});\s*\?>\s*</title>[^\{\}\?]{99,499}</html>\s*<\?php\s*\}\s*else\s*\{\s*\46\s*=\s*['"][^;]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2124530>)|\$_SERVER\[['"]HTTP_HOST['"]\]\s*\.\s*['"]\s*-\s*Inbox\s+Mass\s+Mailer";\s*\?>\s*</title>(?<X2124060>))|\s+echo(?:\s*getenv\s*\(['"]HTTP_HOST['"]\);\s*\?>\W{0,9}(?:c99\w{0,4}shell|31NH0)\W{0,9}<(?<X2121472>)|\s+str_replace\s*\(['"][^'"]+['"],['"]['"],['"][Validtor\.-_,]{10,25}['"]\);\s*\?>(?<X2129731>)))|['"\.\h]*getcwd\(\s*\)['"\.\h]*<(?<X2052531>)|['"]\s*\+\s*os\.environ\[['"]SERVER_NAME['"]\]\s*\+\s*['"]\s*-?\s*LSDSHELL\s*['"](?<X2060892>)|['"]\s*\.\s*(?:\$_SERVER(?:\[['"]HTTP_HOST['"]\]\s*\.\s*['"]\s*-\s*WebShellOrb_\s*['"](?<X2062780>)|\s*\[\s*['"]HTTP_HOST['"]\s*\]\s*\.\s*['"]\s*-\s*Bypass\s*\d+\s*</title>(?<X2203400>))|getenv\(['"]HTTP_HOST['"]\s*\)\s*\.\s*['"]\s*.\s*Shell\s+I\s*</title>(?<X2060600>))|[+\[]{0,2}\s*Powered\s*by\s*KcB\s*[\]+]{0,2}(?<X2051830>)|[-:\[]{1,3}\s*GreenwooD\s*[-:\]]{1,3}\s*WinX\s+Shell(?<X2053481>)|[:\.]{0,5}\s*Mailer\s+Inbox\s+(?:(?:-?\s*Dejector)|\d+)(?<X2054651>)|[:]{0,2}\s*eBuKa\s*mAx\s*INbOx\s*sEnDeR(?<X2052400>)|[\[]{0,1}\s*RileyWilder\s*(?:\'\s*s)?\s*Mailer(?<X2053950>)|[\w-]{0,9}\s*(?:cpanel|whm)\s+[^`]{0,9}\s*(?:crac|brut)(?<X2057111>)|[\w\^\.\|]{0,3}\s+Private\s+Shell\s(?<X2058670>)|[^/]{1,49}\s+Edited\s+By\s+KingDefacer\s*</title>(?<X2057041>)|[^><]{1,9}\s*\bAni\-Shell\b(?<X2122552>)|[^\<]{0,19}\s*r57c99\.com(?<X2057200>)|[^\w\s]{0,3}\s*T\.C\.T\s*[^\w\s]{0,3}\s*</(?<X2057820>)|[^\w]{0,3}\s*BYSCRA3ZY\s*[^\w]{0,3}\s*</title>(?<X2058690>)|[^\w]{1,3}\s*Trenggalek\s+Mafia(?<X2058171>)|[^\w]{1,3}Mr\.Cr[0o][7t][^\w]{1,3}\s*</title>(?<X2063510>)|[A4]LM[0O][S5][T7]H[3E]v[i!]L\W{0,4}H[!i]dd[3e]n\s+Gh[o0][s5][7t]\s+[7T][3e][a4]m\s*<(?<X2121510>)|[o0]wn[e3]d\s+By\s+[o0]*R[o0]+T[o0]*(?<X2122690>)|[S5]PYU[5S]\s+M[A4]IL[3E]R\s+2[K0][12]\d</title>(?<X2118480>)|[th][oa](?:uched|cked)\s*by\s*[0o]xyg[e3]n\W\s*</(?<X2141852>)|\$\w{1,15}\s*\-\s*Perl\s*Web\s*Shell(?<X2128061>)|\.:{2}.\s*BLACKUNIX\s*.:{2}\.\s*</title>(?<X2063310>)|\[?Mister\]?\s*\[?Spy\]?\s*Masse\s*-\s*S3ND3R(?<X2053432>)|\[\s*D912\s*Browser\s*\]\s*</title>(?<X2048640>)|\[S\]uper\[BAD\]\s*Mailer(?<X2051870>)|\W{0,3}\s*TurkisH\W{0,9}RuleZ\s+SheLL(?<X2121890>)|\W{0,9}(?:Bypass|Vhosts\s+Config\s+Grabber)(?:\D{0,15}|by)\s*TN\.DESTROYER(?<X2118735>)|\w{1,40}\.php\s+-\s+Edited\s+By\s+KingDefacer(?<X2062641>)|Al-Marhum\s+CGI\s+Shell\b(?<X2121681>)|Andro(?:\s*Ghost\s*69(?<X2055451>)|Gh[o0]st\s+PHP\s+Backdoor\s*</(?<X2124710>))|Ani\s*-\s*Shell(?<X2057550>)|Anon(?:Ghost\s+Cgi-Telnet(?<X2120180>)|ymousFox(?<X2055831>))|aramex\s*Postal\s*Services?\s*<\s*/title\s*>(?<X2226510>)|ASPX\s*spy\s*</(?<X2125520>)|Back\s*Connect\s*Shell\b[^@]{9,499}\bfsockopen\h*\((?<X2152330>)|Banco(?:\s*De\s*Oro\s*Update\s*Online\s*Banking[^\/]+<\/title>(?<X2122760>)|\s+De\s+Oro\s*</[^%]{999,15000}<form\s[^>]{0,90}method\s*=\s*['"]?post['"]\s*action\s*=\s*['"]\w{1,20}\.php['"]>(?<X2124820>))|Bing\s+Dorker\b(?<X2128330>)|bk\-code\s*shell\s*</title></head(?<X2130140>)|Black(?:hat\s*Code\s+Backdoor(?<X2056330>)|Tools\s*Folder\s*Mass\s*Defacer(?<X2051691>))|BraIn\s+Inc\D{1,3}\s*Sh[3][l1]{2}\s*-\s*By\D{1,3}cyberwarror(?<X2119380>)|BruteForcer\s+v\d+\.\d+(?<X2122600>)|Bypass(?:\s*Root\s*Path\s*by\s*Mauritania\s*Attacker(?<X2052700>)|\s+404\s+by\s+0x1999\s*<(?<X2122200>))|C99\s*(?:mad)?\s*shell(?<X2056390>)|cgi-shell\.py(?<X2057650>)|Ch?[a4][o0][s5]\s+Sh[3e][1l]{2}\s*</(?<X2125210>)|Cmd\s+by\s+ghz(?<X2055880>)|Config\s+Grabber\s+by\s+ResCooL[l1][3e]{2}[t7]\b(?<X2121620>)|Created\s+By\s+IndoXploit\s+(?:Just)?\s+FOr\s+(?:Wordpress|Joomla|Magento|Drupal)(?<X2061101>)|D-Evil\s+Mailer\b(?<X2121360>)|Dark Shell\s*</title>.+clearstatcache(?<X2045561>)|dis\s+Shell\s+Commander(?<X2055660>)|Documentation\s*</title>[^\&]{600,999}<h\d*>DOCUMENT\s+MANAGEMENT\s+SYSTEM\s*</h\d*>(?<X2060031>)|Dr\s*H[e3]x\s+(?:web)?shell\s*</(?<X2130080>)|Dr\s+HeX\s*</(?<X2056850>)|DropBox\s+Buisness\s*</title>(?<X2052750>)|EgY_SpIdEr\s+ShElL(?<X2057190>)|eMail[^\w]{2,9}RealUnix\.net[^\w]{2,9}Edited\s+By\s+WebCrac?ker(?<X2062630>)|Facebook\s*</title>\s*<\?php\s*include(?:_once)?\s*\(?['"][^\.]{1,99}\.php['"]\);(?<X2058260>)|Fastest\s+Zone-H\s*Mass\s+Deface\s+Poster(?<X2054140>))
<(?:script(?:\h*(?:(?:type\h*=\h*['"]?text/javascript['"]?\h+)?src=['"]https?://[^/]{0,20}(?:trackstatisticsss|destinyfernandi|adsformarket|gotosecond2)\.com/\w{1,15}\.js[^>]{0,40}></script>(?<X1151713>)|>\s*alert\s*\(\s*['"][^'"]{0,99}\bh[a4]ck[e3]d\s*by\b[^'"]{0,99}['"]\s*\)(?:\s*;)?\s*<\s*/script\s*>(?<X2140652>)|[^>]{1,30}src=['"]https?://(?:www\.)?cdn\.jsinit\.directfwd\.com[^"']{1,20}['"]></script>(?<X1266100>)|src=['"](?:(?:https?:)?/?/?[^/]{1,20}\bgithub\.io/[^\{\}]{9,400}>[^<]{1,20}Xploit\W+(?:mini|web)\h*(?:shell|backdoor)\b(?<X2221320>)|data:text/javascript,var%20\w+%2F%2A\w+%2A%[^'">]{99,}%29%29%3B['"][^>]{0,99}>\s*</script>(?<X1259100>)|http(?:://nt\d{3,8}\.(?:cn|jp|in|ru|pl)/\w/\w\.JS['"]></script>(?<X1142596>)|s?://[^/]{0,20}(?:trackstatisticsss|destinyfernandi|adsformarket|gotosecond2|greengoplatform)\.com/\w{1,15}\.js[^>]{0,40}></script>(?<X1209620>)))|type=['"]text/javascript['"]>\s*if\s*\([\w=]{4,16}\)\s*\{\s*function\h*(\w{1,30})\((\w{1,14}),\h*(\w{1,14})\)\s*\{\s*setTimeout\(\s*function\(\)\s*\{\9\(\);\s*\10\(\);\s*\}[^<]{50,400}notifa\.info[^<]{100,1000}\8[^<]{5,50}</script>(?<X1268291>))|\h+(?:type\h*=\h*['"](text/javascript)['"]\h*)?src\h*=\h*['"]https?://(?:www\.)?hostingcloud\.racing/\w{1,40}.js['"]\h*(?:type\h*=\h*['"]\12['"]\h*)?>\s*<\s*/script>(?<X1166042>)|\s*(?:[^:]+https?://websanalytic\.com[^\.]+\.php['"]></script>(?<X1257040>)|[^>]{0,40}>var\s*(\w{1,40})\s*=\s*\[["'][^\]]{400,550}['"]\];\s*var\s*url\s*=\s*String\[\15\[\d\][^`]{700,950}var\s*(\w)\s*=\s*true;\s*for\(var\s*i=scrpts\[\15\[15\]\];\w--;\)\{if\(scrpts\[\w\]\[\15\[\d+\]\]\s*==\s*\15\[\d+\]\)\{\16\s*=\s*false\}\};if\(\16\s*==\s*true\)\{a\(\)\}\}</script>(?<X1043511>)|language\s*="php"\s*>\s*\$\w{1,40}\s*=\s*.{1,1000}\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^]]+\]\s*\)\s*\)\s*;\s*<\s*/script\s*>(?<X1039510>)|src=['"](?:(?:http)?s?:?//(?:\w+\.)?trustisimportant\.fun/[^'"]+['"][\s></]+script>(?:<script[^>]{1,99}>\s*\w{1,20}[\s\(]+['"][^\)<>]+\)[;\s</]+script>)?(?<X1263562>)|https?://(?:(?:\w+\.)?startperfectsolutions\.com[^<]{1,64}</script>(?<X1257430>)|(?:one01|akamicdn)\.(?:click|net)/[^'"]+['"][^>]*>\s*</script>(?<X1253920>)))|src[=\s'"]+https?://fastjscdn\.org/\w+\.js\?\w+=\w+["']>\s*</script>(?<X1225990>)|src\s*=(?:['"](?:https?:?)?//pop\.dojo\.cc[^'"]*['"]\s*>\s*<\s*/script\s*>(?<X1255611>)|\s*['"]?https?[^'"]{1,19}(?:6tws\.us|expoilt\.com)[^'"]{1,9}\.js['"]?><\/script>(?<X1123694>)|\s*['"]http(?:[s:/]+(?:\w{0,20}\.)?descriptionscripts\.com[^'"]*['"][^>]{5,100}>\s*<\s*/script\s*>(?<X1240031>)|s?://(?:(?:\w+\.)?lainstree\.com[^'"]+['"]\s*type\s*=\s*['"]text/javascript['"]></script>(?<X1251520>)|cdn\.tutorialjinni\.com[^'"]+['"]\>\s*</script>(?<X1252820>)|storejscdn\.pw/[^"']+\.js['"]>\s*</script>(?<X1217650>))|s?:\/\/\w{1,14}\.gdcstatic\.com['"]\s*>\s*<\/script>(?<X1264162>)))|type(?:="text/javascript"\s*src="https?://[^/]{5,50}/\w{5,10}\?frm=script&se_referrer=<\?php\s*echo\s*\$_SERVER\['HTTP_HOST'\];\s*\?>&default_keyword=<\?php\s*echo\s*\$_SERVER\['REQUEST_URI'\];\s*\?>"></script>(?<X1043421>)|[=\s]+['"]text/(javascript)['"]\s*language[=\s]+['"]\31['"]\s*>[^;=]{0,199}\b(?:(\w{1,40})[=\s]+['"][^'"]*['"]\s*;\s*){2,}for[\s\(]+(\w+)[=\s]+\d+\s*;[^=\};]{0,199};\s*\33\+\+[^\}]{0,199}\{\s*\32\s*\+=\s*\w{1,40}\.[^;]+;\s*\}\s*document\.write[\(\s]+\32[^<]{0,99}</script>(?<X1240150>)|\s*=['"]text/javascript['"](?:>\s*function\s*\w+\(\)[^;]+;\s*var\s*\w+\s*=\s*window\.location\.href\.replace[^\}]{1,99}\}\);[^\}]{1,32}\s*\}[^:]{1,99}https?://\w*\.ipfs\.\w*\.\w*\/\?\w+\s*=[^'"]+(?:html?|js)['"];[^\}]{1,299}\},\s*\d+\);\s*</script>(?<X1251200>)|\s*src\s*=\s*['"]//facepage\.co\.za(?:/[\w\-]+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250780>)|\s*src\s*=\s*['"]//nidoasia\.org(?:/\w+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250770>)|\s*src\s*=\s*['"]//pontiarmada\.com(?:/\w+)?/\w+/\w+\.js['"]>\s*</script>(?<X1250760>))|\s*=\s*['"]text(?:/javascript['"]\s*>\s*document\.write\(\s*['"]\\u00[^'"]{999,5000}['"]\)\s*<\s*/script>\s*<\?php\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]{1,999}c2l4X2dldHB3dWlkKC[^'"][^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058310>)|\/javascript['"]\s*src\s*=\s*['"]https?://[^'"]{9,50}/dot\.php\?id=\d{1,9}['"]><\/script>(?<X1126722>))))|\s+(?:async=['"]async['"]\s+src=['"]//\w+\.sq88\.press[^'"]+['"]>\s*</script>(?<X1232490>)|language(?:=javascript>\s*eval\(\s*String\.fromCharCode\((?:\d+\s*,\s*){3}[^\)]+\)\s*\)\s*;</script>(?<X1043472>)|\s*=\s*['"]php['"]\s*>\s*\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}\s*\(?\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\](?:\s*\)\s*){1,6};?\s*</script>(?<X1058600>)|\s*=\s*VBScript\s*>[^`]{0,999}\bDropFileName\s*=\s*['"]svchost\.exe['"]\s*WriteData\s*=\s*['"][^\?]{64000,}</SCRIPT>\s*(?:<!--[^\r]{1,850}-->)?(?<X1055214>))|src[=\h]+['"]https?://asmr9999\.live/\w+\.js\?\w+[=\s]+\w+['"]\s*>\s*<\s*/script>(?<X1220651>)|src\s*=\s*['"](?:\.\./){1,5}www1\.bac-assets\.com/online-banking/spa-assets/(?<X2051950>)|type(?:[=\s]+['"]text/javascript['"]\s*>\s*document\.write\(atob\(['"]PHNjcml[^'"]{99,2999}MlNTMlNzQlNkYlNzIlNjElNjc[^'"]{999,}['"][\s\)]+</script>(?<X1225920>)|\s*=\s*['"]text/javascript['"]\s+src\s*=\s*['"]https?://\w{1,2}\.cnzz\.com/[^'"]+['"]>\s*</script>(?<X1232500>))))|s(?:ource\h+src\h*=\h*['"]https?://hyi?dra[^\.]{3,9}\.(?:com|onion)/hydra\.mp4\b(?<X2171530>)|pan(?:[^>]*>\h*[hfdo](?:ack|wn|uck|efac)ed\h+by\b[^\.:]{99,300}<audio[^://]{1,99}\bsrc\h*=\h*['"]https?://\w\.top4top\.io/(?<X2169391>)|\s*class(?:=['"]\w{5,9}['"]>\s*PHP\s*eMailer\s*<br>\s*made\s*by[^\/]+\/span>(?<X2120240>)|[^>]{1,15}>\D{2,5}PHP\s*Mailer\D{2,5}</span>(?<X2129241>)|\s*=\s*["']titulo['"]>\W{1,9}spamer\s*php\W{1,9}</span>(?<X2118631>))|\s*style\s*=\s*['"]overflow\s*:\s*auto;\s*position\s*:\s*absolute;\s*(?:(?:height|width)\s*:\s*[01]p[tx];\s*)+['"]\s*>\s*<ul>(?:\s*<li>\s*<a\s*href\s*=\s*['"]https?://[^/]+/['"]\s*title=['"][^'"]{0,99}escort[^'"]{0,99}['"]\s*>[^'">/]{0,99}escort[^'"/<]{0,99}</a>\s*</li>){9,}\s*</ul>\s*</span>(?<X1197974>)|\s+style[=\s]+['"]overflow[:\s]+auto\s*;\s*position[:\s]+absolute\s*;(?:\s*(?:height|width)\s*:\s*[10]p[tx]\s*;){2}\s*['"]\s*>(?:[^<>]{3,88}<a\s+href[\s=]+['"]https?://[^'"]+['"]\s+title[=\s]+['"][^"']+['"]\s*>[^<>]{3,88}</a>){3,}[^><]{0,88}</span>(?<X1226490>))|tyle(?:>\.nofollow\s*\{\s*display[^?]{1,75}(?:<(span>)\h*<(a)\h*href\h*=\h*['"]https?://\w{1,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml|tk|com)[^\?]{1,49}\.php\?\w{1,49}/\w{1,40}\.html['"]>[^\?]{0,99}</\57>\h*</\56<br>){4}[^#\v!@]{999,12999}</div>(?<X1190050>)|\b[^>]*>\s*(\w+)\s*\{\s*(?:display[\h:]+none|[lrtb](?:eft|ight|op|bottom)[\h:]+\-\d{3,}(?:px|em))\b[^\}]{0,19}\}\s*</style>\s*<\59>[^<>/=]{0,99}(?:<a\b[^>]*\bhref=['"]?https?://[^>]*>[^/\n<]*</a>\s*[^<>/=]{0,99}){5,}</\59>(?<X1200711>))|vg>\s*<use\s*href\h*=\h*['"]dAta\h*:\h*image/s\s*vg\+xml;\s*base64\s*,\s*PHN2Z[a-z\d\+/]{9,199}(?:bGVydC|YWxlcnQ|ImFsZXJ0K|J2FsZXJ0K)[a-z\d\+/]{9,40}=?=?#\w{1,9}['"]\s*>(?<X1251080>)))
<t(?:d>(?:\$\s*execute\s*a cmd</td>(?<X2043661>)|\D{0,9}(?:Anonymous\s+cyber\s+team|Hacked\s+by\s+SPAIROW\s+DA_?VINCCI)\D{0,9}</td>\s*</tr>\s*</body>(?<X2123651>)|\s*Exorcism404\W{0,2}@\W{0,2}hackermail\.com\b(?<X2137210>)|Hati\s+Mantan\s*[^'"]{1,10}['"];\s*[^\$]{1,40}\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?[^'"]{1,40}['"]?\](?<X2055641>))|itle(?:(?:\b|__)[^>]{0,99}>(?:a(?:cceso\s*clientes\s*banca\s*online\s*\|\s*bankinter|pple(?:\s*\-\s*my\s*apple\s*|\.itunes\-)id)|copyright\s*(?:center|help)?\h*\W{1,19}\h*(?:(?:buss?ines?s|help)\h*)?[1i]nstagram|banco\s*do\s*brasil\s*\-\s*autoatendimento\s*pessoa\s*fisica|web\.de\s*kundencenter)</title>(?<X2176863>)|>&#(?:66;&#97;&#110;&#107;&#32;&#111;&#102;&#32;&#65;&#109;&#101;&#114;&#105;&#99;&#97|86;&#101;&#114;&#105;&#102;&#121;)[^>]{20,300}>\s*<script>\s*settimeout[^=\}]{10,100}=\s*["']password['"](?<X2119442>)|>(?:[rc]\d{2}|(?:marco\s*)?priv(?:\s*\d|ate)?(?:\s*[mi1n]{4})?)\s*[5s]h[e3][li1]{2}(?:\s*(?:cgi|\d{4}))?<\/title>(?<X2126707>)|>(?:\s*[\|]{1,2})?\s*(?:Ombre|xGhost|InboX\s+Mass|Don\s+Cordoba)\s+Mailer(?<X2059782>)|>(?:a(?:mericanas\.com\s*\-\s*a\s*maior\s*loja\.\s*os\s*menores\s*pre[^/<o\s]{1,19}os\.|ctivation\s*\-\s*at&t\s*mail\s*services|dobe\s*document\s*cloud\s*\|\s*for|t&t\s*\-\s*home)|connectez\-vous\s*[^/<\s]{1,19}\s*votre\s*compte\s*paypa[1il])</title>(?<X2157274>)|>(?:TN\-SN!PER|DR!V3R\h+PRIV3T)\h+Mailer</title>(?<X2148191>)|>(?:WHM|cpanel)\h*resellers\h*finder\b[^\\\}\{]{99,1500}\bfile\h*\(\h*['"]/etc/trueuserowners['"]\);(?<X2198140>)|>(\w{1,40})\s*injector</title>[^\@]{99,499}echo\s*['"]\12[^;]{1,9};(\$\w{1,40})=@?PHP_OS;echo[^;]{0,19}\13(?<X2141191>)|>-\$\$Ar\s*ab_money\$\$-</title>(?<X2049790>)|>40(?:3\h*Forbidden</[^#]{99,800}<input[^\>]{0,99}shell['"]>[^#]{99,400}\$\w{1,15}\h*=\h*file\(['"]https?://pastebin\.com/(?:raw|download)\b[^\)]{5,50}\);(?<X2141231>)|4\h+Not\h+Found<[^\?%#]{99,1500}<title>[^<]{5,15}(?:Uploader|webshell|backdoor|cracker)\b(?<X2146932>)|4\s+Not\s+Found(?:</[^=]{1,600}</body>\s*</html>[^=]{1,600}(?:\s*<a\s+href=https?://[^>]{1,200}>[\w\s]{0,90}</a>,){24}[^\\]{99,9999}</body>\s*</html>(?<X2120294>)|\s*<[^\(\)\?]{99,999}['"]\);\}\}(\$\w{1,40})=\$_[GPRSC]\w{2,6}\[[^\]]+\];if\(\19\D{2,3}['"][^'"]*['"]\)\{\$\w{1,40}=pathinfo\(['"]\19(?<X2125510>))|[34]\s*(?:Forbidden|Not\s*Found)</(?![^\.]{0,99}Directory\s*access\s*is\s*forbidden)[^@]{99,999}\b(?:copy|move_uploaded_file)\(\$_FILES\[(?<X2143181>))|>7inc[^<]{0,20}</title>[^:]{9,99}https?://[^/]{1,20}/7inc-shell(?<X2132270>)|>::\s+Priv8\s+vHost\s+Config\s+Grabber(?<X2048250>)|>[<\?'";ph\s]*error_reporting[\s\(]+E_ALL\s*\^\s*E_NOTICE\s*\^\s*E_WARNING[\)\s]+;\s*echo\$\w{1,40}[^<]{0,40}<\s*/title\s*>\s*<meta\b[^&]{1,999}\btitle\s*=\s*['"]sitemap(?<X2223620>)|>[\sx]*[^\w]{0,3}GH[O0][5S]T[\sx]+S?H[E3]LL[^\w]{0,3}</title>(?<X2063932>)|>[\w\s]{1,99}\|\s*eBay\s*</[^\{]{99,999}['"]canonical['"]\s+href\s*=\s*['"]https?://signin\.ebay\.[^/]{2,6}(?<X2131740>)|>[^'"<\?\v/]{1,40}\bJersey[^'"<\?\v/]{1,99}</title>[^&]{999,9999}\bvar\h+http_host\h*=\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}jersey[^\.]{0,40}\.[^'"]{2,9}['"]\h*;(?<X2145082>)|>[^/<>]{0,9}\bcgi\h*(?:web\h*)?shell\b[^&\*`]{99,400}\$\w{1,20}\h*=\h*['"]\.htaccess['"];(?<X2185200>)|>[^/<>]{10,99}\bBulletproof\s+Botnet\s+Hosting\s+Service\s*</title>(?<X2146561>)|>[^/<]{0,20}\bc[o0]nfi?g?\h*[3e]xpl[o0]it[3e]r\b[^/<]{0,20}</[^\}\\\?]{99,800}\(['"]/etc/passwd['"](?<X2178581>)|>[^/<]{0,6}(?:hack|own|fuck|defac|pwn)ed\h*by\h*[l1][0o]c[4a][l1]h[3e][a4]dz\b(?<X2174752>)|>[^/]{0,15}\b(?:cyberwar\h*404|Mr\.K1m0ch1)\b(?<X1175360>)|>[^/]{0,30}(?:hacked|defaced)\s+by\s+KurdoXploit\s*</(?<X2130670>)|>[^/]{0,40}Mass\s*Mailer[^/]{0,15}by\b(?<X2047482>)|>[^<]{0,20}(?:(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|tadalafil|sildenafil|xenical|acomplia|phentermine)[^<]{9,150}</[^\$]{5000,}</div>\s*(?:<a[ ]+href[ ]*=[ ]*['"]https?://[^>\n]{9,200}title[ ]*=[ ]*['"]((?:[^'"]{0,20}[ ]*)(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|xenical)[ ]*(?:[^"']{0,20}))['"]>[ ]*\35[ ]*</a>\s*){5}(?<X2127025>)|(?:propecia|viagra|nexium|levitra|cialis|lipitor|pharmacy|tadalafil|xenical|acomplia|phentermine)[^<]{9,150}</[^\$]{5000,}</div>\s*(?:<a[ ]+href[ ]*=[ ]*['"]https?://[^>\n]{9,200}title[ ]*=[ ]*['"]((?:[^'"]{0,20}[ ]*)(?:viagra|cialis|pharmacy|tadalafil|sildenafil|acomplia|phentermine)[ ]*(?:[^"']{0,20}))['"]>[ ]*\37[ ]*</a>\s*){5}(?<X2127041>))|>[^<]{0,40}(?:\b[cs](?:h[e3]ll|r[e3]w)\h*(?:p[a@][s5]+w[o0]rd|b[a@]ckd[o0]+r|up[l1][oa0@]{2}d(?:er|s|5)|p[a@][s5]t[e3]b[i1]n|w[e3]b[5s]h[e3][l1]+)\b[^<]{0,40}<\h*/title>(?<X2138034>)|Seja\s+bem-vindos[^<]{0,40}</title>\s*<Script\s+language\s*=['"]javascript['"]\s+src\s*=\s*['"][^/]{0,9}/(?:dataverifica|validar_(?:tabela|campos))\.js['"]>(?<X2123770>))|>[^<]{0,4}\bIDBTE4M\b[^<]{0,4}<(?<X2141161>)|>[^<]{1,99}\bJersey(?:[^'"<\?\v/]{0,120}</title>[^&]{999,2499}src\h*=\h*\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}[^w]jerseys[^\.]{0,40}\.[^'"]{9,199}['"]></script>\s*</head>(?<X2145195>)|[^'"<\?\v/]{0,99}</title>[^@%]{999,9999}var\h+(http_host)\h*=\h*\h*['"](?:https?)?:?/?/?(?:www\.)?[^\.]{0,40}[^w]jerseys[^'"]{1,40}['"]\h*;[^;]{9,199}\+\h*\43\h*\+[^;]{1,40};\h*\}(?:\s*//-->)?\s*</script>\s*</head>(?<X2145233>))|>[^\-\$]{0,40}CGI[\- ]Telnet[^/<\$]{0,40}</title>\s*\$\w{1,40}\s*</head>(?<X2128300>)|>[^\<]{0,50}\bto\h*blackhole[^\?]{9,999}<\?php\s*goto\s*\w{1,9};(?<X2139682>)|>[^\w\s]{9,15}\bUpl[0o][a4]d[e3]r\h+By\h+\w{1,40}\b[^</]{1,99}</(?<X2167263>)|>[^\w]{0,15}\b[hd](?:[a4]ck[e3]d\hby|efacer)\h(?:Peyman\h*Siyahi|Kura\hLinux|\./Java\hDot)[^/]{0,55}</title>(?<X2140751>)|>[^\w]{1,5}Gu[e3][s5]{2}Who\?\s*M[4a]il[e3]r(?<X2064061>)|>[a@]n[o0]n[5s][e3]c\s[^<>]{1,40}</title>(?:[^\?]{1,199}<meta\b[^>]+content=['"]we\s*are\s*party\s*at\s*your\s*security\b){2}(?<X2221142>)|>[csk](?:iss|ecur|od|reat)ed\h+By\h+\./[^/<\v]{1,40}</(?<X2167851>)|>\(\.\*\)</title>[^_]{9,99}file_get_contents\(decodes\(['"][a-z0-9=]{9,99}['"]\)\.(?<X2133530>)|>\./[^</]{5,12}\bWas\h+here\b[^<]{0,4}</(?<X2175231>)|>\bHACKER\h*INDO\h*SHELL[^\(]{9,50}\b(?:system|eval|passthru|popen)\((?<X2143561>)|>\D{0,10}(?:cpanel|whm)\s+[^`]{0,9}\s*(?:crac|brut|Config\s+Grab|Finder\D{1,9}Cracker)(?<X2064074>)|>\D{0,4}(?:Bobyhikaru\s+Shell\s+Area\D{0,4}<(?<X2122770>)|Mini\s+Mass\sAuto\s+E?Xploiter\s+Only\s+Tools\b(?<X2123882>)|UM[A4][IL1]{2}[E3]R\b(?<X2122910>))|>\D{0,9}Ninja.Shell\D{0,9}</(?<X2126130>)|>\h*(?:(?:ki[s$]{1,2}[e3]d|h[a4]ck[e3]d|pwned)\h*by\h*[^/<]{1,49}</title>\s*<(iframe)[^>]{1,99}>\h*</\60>\s*<script[^>]{1,99}\bsrc\h*=\h*['"]https?://(?<X2140831>)|(?:Pwne?d|hacked|fucke?d)\h+by\h+D[es35]{2}[7t]r[0o]y[3e]r\b(?<X2141311>)|404\h+Not\h+Found(?:\h*</title>[^\}]{99,999}<\?(?:php|=)?\s*(?:exit|die)\b[^;]{0,9};(?:\s*\})*\s*define\h*\((?<X2152140>)|\W{0,4}uplo?a?de?r\h*<(?<X2172810>))|[3e]xp[l1]o?r[e3]?r?\h+[cs5]yb[e3]r\h*[a@]rmy\h*</(?<X2147470>)|[OPHJF](?:wn[e3]|[0o]{2}ne|acke|ucke)d\h+by\h+407\h+Authentic\h+Exploit<(?<X2159211>)|[pO]wn[3e]d\h*(?:by|\-)\h*[l1][e3]{2}[t7]</title>[^@]{1,99}<meta[^>]+(?:\b(?:content\h*=['"]r[0o]{2}[t7]|name\h*=\h*['"]author['"])\h*){2}(?<X2143331>)|Jingklong\h+sh[e3]ll\b(?<X2141000>)|MINI\s+\w{0,15}\h*SHELL\b\h*</title>\s*<style>(?<X2049251>)|PHP\h*mailer\h*Dev\h*by\b(?<X2143581>)|Sign\s+In\s*</title>[^>]{1,40}(?:signin_?files|images)/\w{1,40}\.ico['"](?<X2054752>)|SQL\b[^><]{1,40}\b(?:[e3]xpl[o0][i1]t|cr[a@]?ck|brut)[^/]{1,99}</(?<X2147751>)|SSI\h+[Tm]in[iy]\h+webshell\h*</(?<X2150860>)|Woody's\h+private\h+tool\b(?<X2140690>)|WP\h*Backdoor\h*User\h*v(?:<\?php|\.?\d)\b(?<X2194060>)|x?Mail(?:er)?\h+[xz]?B[o0]mb[e3]r\b(?<X2167060>))|>\s*#(?:bbbtitsbbb#\s*</title>(?<X2124571>)|htitleh#\s*</title>(?<X2176660>))))
<title(?:>\s*(?:File\s*</\s*[^\?]{1,200}<form\s+method\s*=\s*['"]post['"][^\?]{1,200}<\?php\s*if\s*\(\s*is_uploaded_file\(\s*(\$_FILES\[)(['"][^'"]{1,40}['"])(\]\[['"][^'"]{1,40}['"])\]\s*\)\s*\)\s*\{\s*move_uploaded_file\(\1\2\3\],\s*\1\2(\]\[['"][^'"]{1,40}['"]\])\s*\)\s*;\s*\$file\s*=\s*\1\2\4(?<X2056790>)|Folder\s*mass\s*defacer\s*by[^/]{1,49}</title>(?<X2130740>)|Gamma\s+Web\s+Shell\s*<(?<X2124310>)|GFX\s+\|\s*GForce\s*X-Sender\s*by\s*Mr-Anobs\s*2018(?<X2052460>)|Ghost\s*by\s*dandan(?<X2052580>)|H[a4@]ck[3e]d!?\s+by\s+(\./\S{1,40})\s*</title>[^#\-;]{1,99}<meta\h*(?:name=['"]description['"]\s*|content=['"][^'"]{0,40}\10[^'"]{0,40}['"]\s*){2}(?<X2121552>)|H[a@]ck[e3]d\s+by\s+(?:Dr\.SiLnT\s*HilL|your\s+HaxorsteinBD|Mo[E3]Gza|KIWIL0736|AssasinCyber|Totaled_Crixu|3xp1r3|x1x1pezo1x1x|takisik|\.\s*/[s5][i1l]N[i1l]CH[il1]|mr\W{0,5}gae\w{0,24}|Baku\s+Hantam\s+Crew|GR[0o]v|xMySQLz|Deni\W{0,2}Nax\W{0,2}Daz)\b(?<X20592113>)|H[ae]c?ked\s+(?:by\s+Ajob\s+Ekkhn\s+Pola|Bay\s+BlekHoll)\s*</(?<X2120021>)|Handanovix\s*X_Shell\s*GTA(?<X2056350>)|HMBr57\s+Shell\s*</(?<X2125870>)|HOTMAIL\s*\(W33\.INFO\)\s*</title>(?<X2047070>)|HTTP\s+404\s+Not\s+Found\s*</title>[^`]{1,600}\$\w{1,40}\s*=\s*file_get_contents\(\s*['"](?:\.\./){5,9}?wp-config\.php['"](?<X2057310>)|Impots\.gouv\.fr\s*-\s*Accueil\s*</title>(?<X2047040>)|INBOX\s+(?:by\s+LiGeiRo(?<X2060780>)|To\s+All\s+-\s+MAILER\s*</t(?<X2122300>))|Indo(?:e?Xploit\s*<\/title>(?<X2048121>)|xploit(?<X2056380>))|jahat\s*</title>[^\)]{1,499}php_uname\(\)(?<X2058680>)|jawa\s*\w{0,5}.\w{0,5}\s*Shell\s*</title>(?<X2121900>)|K[a4]iz[e3]n\s+Sh[3e][l1]+(?<X2119680>)|kacak\s+shell\s*<(?<X2126180>)|L[0O]ck[3e]d\s+By\s+L[a4][7T]y[a4]\s*</(?<X2118151>)|M[4a][5s]+\s+[5s]h[3e][il1]+\s*</title>(?<X2124360>)|M[a4]iler(?:\s*BY\s*Th[e3]\s*M4RoC[o4]in\s*Ghost</title>(?<X2128281>)|\s+SQLC[A4]RD(?<X2059366>))|M[e3]g[a4]\W{0,3}M[a4][il1]{2}\s+v[\d\.]{1,4}\s*</(?<X2130800>)|madnet\s+pri(?:vate|8)\s+mail\W{0,9}worker(?<X2122410>)|Mailer\s+By\s+ME(?<X2054020>)|MakMan\s*[-\s]{0,3}\s*Root\s*Exploiter(?<X2051780>)|ManToed\s*Shell(?<X2051880>)|Mini(?:\s*Shell\s*(?:Moded|Coded)?\s*\w{0,9}\s*[&nbsp\|':\.,]{0,80}\s*(?:TiGER|Sl0vv)(?<X2051902>)|\s+(?:Web)?\s*shell(?:\s*by)?\b[^<]{0,40}</title>(?<X2131161>))|Mr\s*Secretz\s+Shell(?<X2052820>)|MulCiShell\s+v\d+\.\d+(?<X2124520>)|NIX\s+REMOTE\s+WEB-SHELL(?<X2059500>)|Not\s+Found\b[^\*%]{999,2500}\$\w{1,40}\s*=\s*['"]a:1:\{s:13:['"]administrator['"];b:1;\}['"];(?<X2122541>)|nShell\s+\w?\d+\.\d+(?<X2057020>)|nsT\s*View(?<X2057740>)|One\s+Drive\s+Cloud\s+Document\s+Sharing\s*</title>[^\n#\*\$%&\^@\[\]]{9,1999}>\s*Login\s+with\s+Office\s+365\s*</button>(?<X2132070>)|PHP[^>]+ExpDoor\.com(?<X2124860>)|PHP\s*(?:Jackal(?<X2056270>)|Shell\s*<\?(?:php)?\s*echo\s*(?:offend|attack|hack)(?<X2121880>))|PHP\s+(?:(?:Web\s+)?Shell\s+(?:Ver|version)?\s*[\d.]{1,3}[^<]{0,20}<(?<X2125541>)|sender\s*</title>[^\$]{1,99}\$manda(?<X2124730>))|priv(?:(?:8|ate)\s+home\s+root\s+uploader\s+by\s+mr\.\s*error(?<X2060790>)|8\s+Tools(?<X2051920>))|RST\s+MySQL\s*</(?<X2060611>)|s72\s*Shell[^\w](?<X2053491>)|Safe\s+Mode\s+Shell(?<X2053620>)|Santander\s*-\s*Internet\s+Banking\s*</title>(?<X2123710>)|Scan\s+Shell\s+v?\d+\.\d+\s*</title>(?<X2122340>)|Script\s+Reset\s*pass\s+(?:CP|Cpanel)(?<X1060860>)|Security007\s+webshell(?<X2056410>)|SexCrime\s*-\s*Shell(?<X2055790>)|Sign(?:\s*in\s*(?:-\s*Google\s+Accounts\s*</title>[^\?]{1,99}lecollagiste\.com/collanews/extlib/favicon\.php(?<X2124691>)|to\s*your\s*Microsoft\s*account\s*</title>(?<X2055726>))|\s+in\s*(?:-\s*Google\s+Drive</title>\s*<style>(?<X2052030>)|</title>(?:.{350}\s*<\s*script type\s*=\s*['"]\s*text/javascript\s*['"]>\s*function unhideBody\(\)(?<X2052050>)|\s*<meta\s+name\s*=\s*['"]description['"]\s+content\s*=\s*['"]outlook\.com\s+is(?<X2060311>)))|\s+in\s+to\s+your\s+account<[^:]{99,500}<link\s+rel\s*=\s*['"][^'"]*['"]\s+href\s*=\s*['"]https?://secure\.aadcdn\.microsoftonline-p\.com/ests/[^'"]+/favicon(?:_\w)?\.ico['"]>(?<X2119961>))|Sim\s*Shell\s*-?\s*Simorgh(?<X2053502>)|smoker\s*backdoor\s*</(?<X2133140>)|spyus\s*mailer\b[^<]{1,49}\bby\s*\W?\s*toolz\b[^<]{1,49}</title>(?<X2131520>)|SST\s*Sheller(?<X2057011>)|STNC\s+Web\s*Shell\b(?<X2125050>)|Symlink(?:(?:_|\s)\s*Sa\s+\w?\d+\.\d+(?<X2056830>)|\s*[^\w]*\s*(?:Auto)?\s+C\-?panel\s+Cracker(?<X2061912>))|SyRi[a4]N\s+[3E][l1][e3]c[t7]r[0o]nic\s+[A4]rmy\s+Sh[3e][l1]{2}\W{1,4}S[3E][4A]\s+Sh[3e][l1]{2}(?<X2118360>)|SYSTTEM(?:-|\s+)32\s*-\s*20\d{2}(?<X2062390>)|Tiagow?\s+Own[zs]\b(?<X2126230>)|To0?olz\s+\d+\s*-\s*Cyb3r-dz(?<X2054220>)|UnKnown\s*-\s*Simple\s*Shell</title>(?<X2120260>)|unzip\s*file\s*by\s*ahwak2000(?<X2058381>)|Up[1l][o0][a4]d[3e]r\s+by\s+[T7][0o]P-H[A4]CK[3E]R(?<X2065250>)|Upl[o0]ad[e3]r\s+by\s+[dzx]{0,2}\-?gh[o0]st(?<X2125790>)|Uploader\s+By\s+[^<]{2,40}</title>\s*</head>(?<X2127280>)|UTS\s+M[a4][5s]{2}\s+M[a4]i[1l][3e]r\s*</title>(?<X2065280>)|View\s*Document\s*-\s*Sign\s+In</title>\s*</head>\s*<script\s*type="text/javascript">\s*(?:<!--)?\s*function popupwnd\((?<X2052800>)|w&#101;&#108;&#108;s\s*f&#97;&#114;&#103;o\s*</title>(?<X2152851>)|Webshell\s+Mass\s+Checker\b(?<X2124400>)|Wordpress\s+Mass\s+(?:(?:Changer?|Password)\s*){2}</title>(?<X2130370>)|Wp\s*Mass\s*by\s*Rooted\s*Syntax\s*<(?<X2127321>)|Xai\s+Syndicate[^<]{0,99}<(?<X2119691>)|YAHOO\W{1,9}SIGN\s+IN\s*</(?<X2065511>)|YassineHd\s+File\s+Manager\b(?<X2118251>)|Yrid06\s*Shell(?<X2061610>)|ZeroByte(?:.|\s+)ID\s+PHP\s+Backdoor(?<X2062770>)|ZETHA\s+WEB\s*SHELL(?<X2056670>))|>\W\w\W</[^@]{99,1999}<input\b[^>]{1,99}\bvalue=['"][^'"]{1,9}\bSpam\s*Now\b[^@]{1,199}\bfunction\s+genrand?(?:om)?str(?:ing)?\([^\)]+\)\{\$\w{1,40}=['"][\w\.]{63,100}['"];(?<X2159340>)|>\W{0,20}\bN[3E]TW[A4]R\h+[S5]P[A4]MM[3E]R\W{0,20}</(?<X2161080>)|>\W{0,5}(?:OuNeT|ghost\h*spy)\W{1,5}\bshell\W{0,15}</title>(?<X2146181>)|>\W{0,6}(?:Chmod\h*X\h*BlackDeath|Akses\h*by\h*Chmod)\b(?<X2165851>)|>\W{0,9}(?:\bx?GH[o0]st\h+x?(?:M[a@][i1]l|brut|cr[a@]ck)[e3]?r?\b(?<X2165051>)|DDOS\W{1,19}InCoders\b(?<X2120561>)|DESERTSUN\s+SERVER\s+CRASHER\W{0,9}</(?<X2124970>)|incr[30eo]{2}\.?([a4]tx)\W{1,6}Bl[a4]ck\.?\101\b(?<X2145950>)|M[il1]n[il1]\s*[5S]h[e3][il1]+\s+By\s[^\<]{1,99}</title>(?<X2128940>)|Php\h*Shell\h*v?\d+\.\d+\W{0,9}</title>(?<X2154550>)|Walkers404\sFile\s*Manager\W{0,9}</title>(?<X2135000>))|>\w{1,40}</title><form\s+enctype=multipart[^>]+method=post><input\s+name=\w+\s+type=file><input\s+type=submit\s+name=\w+>(?:\s*<br>\s*)+<input\s+name=path\s+type=text\s+value=<\?php\s+echo\s+@getcwd\h*\(\h*\)\h*;\s*\?>\s*/>(?<X2046721>)|>\|#\|\s*BW\s*Inbox\s*Mailer\s*\|#\|\s*</title>(?<X2047370>)|>b(?:374k\h*(?:[v\.\d]{1,9}\h*)?</(?<X2157770>)|ackdoor shell(?<X2051120>)|anca\s*Digital\s*</title>\s*<link\s*rel=['"]stylesheet['"]\s*type=['"]text/css['"]\s*href=['"]\./web/app\.css['"]>(?<X2208790>)|anco\h+de\h+Venezuela</title>(?<X2282151>)|lackTools(?:\.io)?\b\h+(?:[ex]?m[a4][i1]l|shell|brut|crack|upl)(?<X2167570>)|locked\h*\bBy\h*\bX\-5L0W(?<X2144590>)|OTEYE\b[^\.<>]{1,9}V\h*\d+\.\d+\b[^<]{0,40}</title>(?<X2179800>))|>C(?:[o0]nf[il1]g\s+F[u@]ck[e3]r\s+By[^/]{1,40}</title>(?<X2135090>)|ardiman\s+Asooooh(?<X2046781>)|r[a4]zy\s*H[a4]?ck\s*Team(?:\s*Shell)?</title>(?<X2156160>)|reated\h*\bBy\h*\bIndoxploit(?<X2144580>)|yber\h+Attack\h+System</title>(?<X2142500>))|>D(?:\.R\.S\s+Dz</title>(?<X2046630>)|asha\s*\dx\s*Vinca</title>(?<X2128642>)|D[o0][s5]!?\h+(?:UD|TC)P\h+Fl[o0]{2}d[^/]{0,40}</title>(?<X2193160>)|ive\s+Shell(?<X2050980>)|r\.\s*[^/]{1,40}\s*file\s*manager</title><style>body\{(?<X2128370>))|>E(?:kin0x Shell(?<X2051010>)|x[a4][s5]\s+Sh[e3][l1]{2,}(?<X2119700>))|>F(?:[i1]l[e3]\s*Upl[o0][a4@]?d[e3]r!?\s*by\s*[e3][a4@]?gl[e3][^<>\n]*</title>(?<X2233804>)|ier+za(?:\s*e?)?Xploit</title>(?<X2215561>)|oxAuto[^\w/]+\bV\d+\h*</title>\s*</head>(?<X2191280>)|reakzbrothers\h*\-\h*panel\s+login</(?<X2145880>)|ree\h*Spam\h*Tools?\b(?<X2166430>))|>GaLers\s+xh3LL\s+Backd00r</title>(?<X2046880>))
<title(?:>h(?:(?:[e3]x[1i]d|[o0]m[e3])\s+sh[e3]ll\s*</title>(?<X2226310>)|[A4]X+[O0]R\s+[^\s<>]{1,40}[^<>]{0,40}</title>(?<X2221920>)|acked by NG689Skw</title><center>(?<X2045101>)|entai\h*c[0o]de\h*</title>[^\?]{0,599}<\?php\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^\?]{9,99}\b@?[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES(?<X2166721>))|>K(?:A_uShell\h*\d{1,2}[^<]{0,9}</title>(?<X2141970>)|ID\s*-\s*Dr\.JEeNTeL\s*SheLL(?<X2050130>))|>Leaf\s+PHPMailer</title>(?<X2049780>)|>M(?:[a4@][s5][s5]\h*D[e3]f[a4]c[e3](?:r|\h*tools)(?<X2049392>)|ail\s+form\s+HTML\s+v\d+[^<]+</title>(?<X2048000>)|ister\s+Spy</title>(?<X2051340>)|r[^<\n]{1,40}\s*Webshell[^<\n]{0,40}</title>(?<X2226300>)|ySQL\s*Web\s*Interface</title>\\n(?<X2127790>))|>Netflix</title>(?:[^@]{99,9999}<meta[^>]{1,99}\bcontent=['"]nflx://(?<X2152420>)|[^@]{999,19999}<input[^>]{1,499}\btype\h*=\h*['"]password['"](?<X2152402>)|[^\?]{9,999}<meta[^>]{1,99}\bcontent=['"][^'"]{0,99}\bhttps?://(?:www\.)?netflix\.com/(?<X2152440>)|\s*<[lms!/][^\`\\]{499,9999}<input[^>]{0,99}\bname=['"]?(?:is_)?cvv['"\s](?<X2159684>))|>p(?:[o0]wny[@\s]shell[^<]{0,9}</title(?<X2130510>)|EREBA_r0x(?<X2049850>)|hoe?nix\h+Mini\h+Shell</title>(?<X2148081>)|HP-FILES\.ME</title>(?<X2045810>)|hp\s*shell(?:\s+|\.)xyz</title>(?<X2128031>)|hpshell\.xyz[^/]{0,9}\bspyhackerz\.com\b(?<X2172610>)|riv(?:8|ate)!?\h+Up[l1!][o0][a4@]d(?:er)?\b(?<X2171870>)|ro\s*Mailer\s*V2</title>(?<X2045122>)|ropaganda\s+Mail!\s+v\d+(?<X2048910>))|>S(?:ender Anonym Email :: FLoodeR :: SpameR</title>(?<X2044471>)|h3ll\b[^</\n]{0,40}</(?<X2225870>)|hare\s*Point\s*online</title><[/lms!][^@]{999,9999}<input\b[^>]{1,99}\btype=['"]password['"](?<X2153470>)|ign\s*in\s*to\s*your\s*account[^\176]{999,}<li>\s*<a>\s*&?copy;\s*\d{1,4}\s*Microsoft\s*</a>\s*</li>\s*</ul>\s*</footer>(?<X2132261>)|imple\h+PHP\h+Mysql\h+client\h*</title>(?<X2139231>)|SI\s+W[e3]b[s5]h[e3]ll\b(?<X2228400>))|>T(?:ampan\s*BlackHat\s*\-\s*Control\s*Panel</title>(?<X2263020>)|GD\s+Team\s+donkey</title(?<X2135141>)|ryag\s+File\s+Manager</title>(?<X2049761>)|urki(?:c|sh)\s*Hackers?\s*Rulez</(?<X2131361>))|>Upl(?:[o0][a@4]d[e3]r!?\h+by\h+[^</\v]{1,40}</(?<X2169200>)|oader\s+By\s+IndoXploit(?<X2051630>))|>V(?:aRVaRa\s*Searcher</title>(?<X2044121>)|uln!!\s+patch\s+it\s+Now(?<X2051421>))|>W(?:3LL\s+M!N!\s+SH3LL</title>(?<X2050590>)|eb\s*Login\s*Service\s*-\s*University\s*of\s*Florida</title>(?<X2048010>)|ebshell\h+by\h+\w+</title>(?<X2281961>)|P\h*Backdoor\h*User\h*v\h*<\?php\s*echo\b(?<X2193731>))|>Y(?:ahoo</title>\s*<\s*meta http-equiv\s*=\s*['"]refresh['"]\s*content\s*=\s*['"]\d+;\s*url\s*=\s*https://yahoo\.com['"]\s*>(?<X2052040>)|oCHI\s*Admin\s*Panel(?<X2233823>)|our\s*University\s*Grant\s*Information</title>(?<X2047881>))|[^>]*>\s*WeTransfer\s*</title>[^,]{99,200}<script[^\.]{1,30}async\s*=\s*["'][^'"]*['"]\s+src\s*=\s*['"]./\w{1,20}/analytics\.js\.download(?<X2119941>)|[^>]{0,99}>(?:federal\s*reserve\s*bank\s*of\s*new\s*york|log\s*in\s*(?:to\s*your\s*p[^\sy</]{1,19}yp[^\sl</]{1,19}l\s*[^\sc</]{1,19}ccoun|\|\s*smartshee)t|owa\s*outlook\s*\-\s*outlook\s*owa|n[^\st</]{1,19}tfiix\s*poland\-sign\s*in|copyright\s*\|\s*instagram|becu\s*online\s*banking)</title>(?<X2159404>)|[^\?>/]{0,99}>\s*QuixoticXploit\b[^>]{0,99}</(?<X2181093>)|\b[^>]*>(?:[^</]{0,29}\./Fake\s*Root\b(?<X2201331>)|\s*Navicat\s+HTTP\s+Tunnel\s+Tester\s*</title>(?<X2046842>)|\W+Yah[o0]{2}\W+</title>[^\?]{1,9999}>\s*Sign\s+in\s+to\s+Yahoo!?\s+mail\s*<(?<X2203703>)|Sign\s*In\s*\W\s*Luno</title>(?<X2202811>)|Undangan\s+Gro?up\s+WhatsApp</title>[^@]{99,}<input\b[^>]*type=['"]?password\b(?<X2208242>)|Zimbra\s*Web\s*Client\s*(?:\W\s*)?Sign\s*In</title>(?<X2203892>))|\b[^>]{0,199}>(?:Avinash\s*Kumar\s*Thapa</title>[^#%:]{1,499}\b[cm]o(?:py|ve_uploaded_file)\(\$_FILES\[[^%:\?]{1,499}>Acid</marquee>(?<X2220300>)|Netflix\s*\S\s*Your\s*account\s*(?:has\s*been\s*)?\w+</title>[^\?]{0,499}<meta\b[^>]{0,199}\b[hc](?:ttp\-equiv=['"]?refresh|ontent=['"][^'"]+url=https?://[^/'"]{0,199}\bnetflix\.(?:com|fr|co\.uk|in|de))\b(?<X2213572>)|Office\s*365\s*(?:[^\s\w]{0,5}(?:One|live|Microsoft)</title>[^\?@]{99,4999}<input\b[^>]{0,99}\btype=['"]?password\b(?<X2213271>)|for\s*business</title>[^\?@\+%\*\\]{1,9999}<input\b[^>]{0,199}\btype=['"]?password\b(?<X2211601>)))|\b[^>]{0,49}>\s*Microsoft\b[^\?:=]{0,99}<meta\b(?:[^>/:;]{0,9}\b(?:http\-equiv[\s=]+['"]?refresh\b|content[\s=]+['"][0123][;\s]+url[\s=]+https?://ksquarecreators\.in/)){2}(?<X2221351>))
<title\b[^>]{0,99}>(?:(?:(?:(?:hsbc\s*uk\s*\-\s*personal\s*&|log\s*on\s*to|santander|personal)\s*online\s*bank|acceso\s*clientes,\s*)ing|tienda\s*online\s*de\s*correos|bienvenue\s*sur\s*facebook)</title>(?<X2165342>)|(?:(?:(?:s(?:tandard\s*bank|untrust)|natwest)\s*online\s*|login\s*online\-)banking|telus\s*\|\s*online\s*update\s*\|\s*verify\s*sitekey)</title>(?<X2148483>)|(?:(?:[^\so]{1,9}oinbase\s*\.com\s*login\s*\W\s*sign\s*on|bank\s*of\s*america\s*\W\s*credit\s*union)|[^\sm]{1,19}minio\s*login\s*\W\s*sign\s*in|rogers\s*yahoo\s*\W\s*sign\s*in|login\s*\W\s*nubank)</title>(?<X2240733>)|(?:(?:[^\w\s]{0,9}secure\.online\s*citi[^\w\s]{0,9}\s*client\s*logi|rbfcu:\s*online\s*banking\s*logo)n|#1\s*social\s*media\s*auto\s*poster\s*and\s*scheduler\s*\-\s*dlvr\.it|[^\w\s]{0,9}bancolombia\s*sucursal\s*virtual\s*personas[^\w\s]{0,9}|absa\s*bank)</title>(?<X2178042>)|(?:(?:[^a\s/<]{1,9}ank\s*of\s*[^m\s/<]{1,9}merica\s*\|\s*create\s*sitekey\s*challenge\s*questions\s*and\s*answer|amazon\s*\-\s*confirm\s*your\s*billing\s*adres)s|<title>login\s*authorization\s*failed\s*\|unathorized\s*access\.<\/title>|\(pl\)\s*log\s*in\s*to\s*your\s*account)</title>(?<X2158762>)|(?:(?:b(?:ank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*your\s*billing\s*inform|npparibas\s*net\s*identific)|south\s*state\s*bank\s*\|\s*profile\s*verific)ation|1&1\s*ionos\s*(?:e\-mail\s*login|webmail)|at&t\s*mail)</title>(?<X2166572>)|(?:(?:banking\s*&\s*insurance\s*for\s*individuals\s*and\s*professionals\s*\|\s*ing\s*belgiu|entrar\s*[^\si</t]{1,19}\s*instagra)m|hsbc\s*india\s*\-\s*credit\s*cards,\s*nri\s*services,\s*saving\s*and\s*deposit|at&t\s*yahoo\s*mail|login\s*\-\s*ionos)</title>(?<X2169912>)|(?:(?:betaalpas\s*\W\s*abn\s*amro\s*\W\s*online\s*een\s*vervangende\s*betaalpas\s*aanvrag|abn\s*amro\s*\W\s*(?:online\s*pincode\s*bijwerk|gegevens\s*invull))en|se\s*connecter\s*[^\s</tv]{1,19}\s*votre\s*compte\s*microsoft)</title>(?<X2167292>)|(?:(?:coinbase\s*[^\s</tb]{1,29}\s*buy\s*&\s*sell\s*bitcoin,\s*ethereum,\s*and\s*more\s*with\s*trus|[1il]nstagram\s*\W\s*objection\s*to\s*copyrigh)t|b(?:anco\s*de\s*la\s*provincia\s*de\s*buenos\s*aires\s*login|us+ines+\s*\W\s*[1il]nstagram)|anz\s*\W\s*internet\s*banking\s*log\s*on)</title>(?<X2183932>)|(?:(?:connexion\s*\W\s*la\s*banque\s*postal|post\s*office\s*login\s*pag)e|wells\s*fargo\s*\W\s*please\s*confirm\s*your\s*identity|excel\s*online\s*\W\s*secure\s*documents\s*sharing|mobile\s*banking\s*\W\s*login)</title><[lsm!/](?<X2171304>)|(?:(?:credit\s*unions\s*in\s*florida\s*\W\s*suncoast\s*credit\s*unio|bitcoin\s*wallet\s*from\s*blockchai)n|echtzeit\s*\W\s*[^\sb</t]{1,19}berweisung\s*\W\s*sparkasse\s*musterstadt|sign\s*in\s*\W\s*chase\s*bank|yahoo!\s*mail)</title><[!lms/](?<X2166293>)|(?:(?:currently\.com\s*\W\s*at&t\s*yahoo\s*email,\s*news,\s*sports\s*&\s*mor|personal\s*banking\s*\W\s*online\s*banking\s*\W\s*bbva\-reserv)e|spectrum\s*billing\s*information\s*verifications\s*process|verified\s*badges\s*\W\s*instagram\s*help\s*center)</title>(?<X2181572>)|(?:(?:docusign\s*electronic\s*signature\s*applicatio|gmail\s*logi)n|centurylink\s*verification\s*required|excel\s*online\s*\|\s*user\s*account)</title>(?<X2157733>)|(?:(?:eigenheim\s*\-\s*immobilie\s*finanzieren\s*\||internet\-filiale\s*\-)\s*sparkasse\s*musterstadt|b(?:uy\s*and\s*sell\s*bitcoin\s*online\s*\|\s*paxful|nl\s*\-\s*gruppo\s*bnp\s*paribas)|cr[^\sd</t]{1,19}dit\s*agricole\s*\-\s*banque\s*et\s*assurances)</title>(?<X2165502>)|(?:(?:enter\s*your\s*card\s*details|pay\s*your\s*council\s*tax)\s*\W\s*gov\.uk|(?:confirm\s*your\s*apple\s*id|manage\s*your\s*account)\s*\W\s*apple|(?:billing\s*details|register)\s*\W\s*my3)</title>(?<X2167692>)|(?:(?:facebook\s*hack\s*news\s*\|\s*how\s*to\s*hack\s*facebook\s*account\s*quickly\s*and\s*for\s*fre|c(?:hase\s*online\s*\-\s*get\s*identification\s*cod|itibank\s*onlin))e|ho(?:(?:w\s*to\s*hack\s*an\s*facebook\s*account\s*online\s*in\s*\d{4}\s*\|\s*facebook\s*hack\s*new|me\s*page\s*\|\s*barclay)s|stpoint\.ch))</title>(?<X2159182>)|(?:(?:huntington\s*national\s*bank\s*\-\s*step\s*\d+\s*verify\s*account\s*informat|reset\s*password\s*\-\s*meridian\s*credit\s*un)ion|l(?:loyds\s*bank\s*\-\s*personal\s*banking,\s*personal\s*finances\s*&\s*bank\s*accounts|ogin\s*\-\s*meridian\s*credit\s*union))</title>(?<X2169102>)|(?:(?:icici\s*bank\s*(?:\-\s*email\s*authent|online\s*verif)icat|first\s*tech\s*federal\s*credit\s*un)ion|log\s*(?:in\s*to\s*my\s*account\s*\|\s*american\s*express\s*us|on\s*to\s*online\s*banking)|dhl\s*express\s*\|\s*track\s*shipment)</title>(?<X2165952>)|(?:(?:insurance,\s*banking,\s*investments\s*&\s*retireme|confirm\s*your\s*accou)nt|(?:usaa\s*verificatio|enter\s*your\s*pi)n)\s*\|\s*usaa</title>(?<X2151324>)|(?:(?:itau\s*card\s*\|\s*promo[^\s</to]{1,39}o\s*descont..o\s*com\s*suas\s*milha|keybank\s*profile\s*and\s*preference)s|login\s*in\s*to\s*your\s*paypal\s*account|wells\s*fargo[^</tv]{1,19}verify\s*your\s*identity|bradesco\s*\-\s*cota[^\s</to]{1,39}o\s*de\s*plano|update\s*accounts\s*\-\s*paypal)</title>(?<X2162032>)|(?:(?:keybank\s*\|\s*banking,\s*credit\s*cards,\s*mortgages,\s*and\s*loan|fidelity\s*investment)s|(?:log\s*in\s*\|\s*my\s*account\s*\|\s*telus\.co|copyright\s*\|\s*help\s*instagra)m|einloggen\s*oder\s*neu\s*anmelden\s*\|\s*ebay)</title>(?<X2150613>)|(?:(?:keycredit\s*online\s*\W\s*banking,\s*credit\s*cards,\s*mortgages,\s*and\s*loan|bnp\s*paribas\s*banque\s*\W\s*acceder[^\s</tm]{1,19}mes\s*compte|payment\s*\W\s*usp)s|centre\s*de\s*s[^\s</tc]{1,19}curit[^\s</tw]{1,19}\s*webmail)</title>(?<X2173052>)|(?:(?:linktree\s*\W\s*blocked\s*accou|online\s*banking\s*enrollme)nt|completa\s*il\s*tuo\s*profilo\s*\W\s*intesa\s*sanpaolo|postfinance\s*for\s*private\s*customers)</title>(?<X2167492>)|(?:(?:log(?:in\s*\-\s*my\s*account\s*\-\s*telstr|\s*in\s*\-\s*bank\s*of\s*americ))a|getting\s*started\s*\-\s*online\s*enrollment\s*\-\s*chase\.com)</title>(?<X2151434>)|(?:(?:mon\s*easy\s*banking,\s*ma\s*banque\s*en\s*ligne\s*\|\s*bnp\s*paribas\s*forti|wells\s*fargo\s*mortgage,\s*auto,\s*banking\s*service)s|online\s*payment,\s*merchant\s*account\s*\-\s*paypal|instagram\s*help\s*center|log\s*in\s*instagram)</title>(?<X2157743>)|(?:(?:ncb\s*personal\s*online\s*banking\s*\W\s*internet\s*banking\s*logi|tangerine\s*bank\s*\W\s*change\s*questio)n|sign\s*in\s*(?:with\s*yahoo\s*account|\W\s*google\s*accounts)|raiffeisen\s*online)</title>(?<X2182312>)|(?:(?:payment|check\s*your)\s*details|welcome|about\s*the\s*TV\s*licen[sc]e\s*holder)\s*\-\s*Update\s*\-\s*TV\s*Licensing\b[^</\w]{0,19}</title>(?<X2166741>)|(?:(?:Paypal\s*safety\s*&\s*security|Yahoo!?\s*\-\s*login)|[\W\S]ank\s*of\s*[\W\S]merica\s*\|\s*create\s*sitekey\s*challenge\s*questions\s*and\s*answers)</title>(?<X2150635>)|(?:(?:security\s*question|email\s*detail)s\s*\|\s*usaa|update\s*accounts\s*\-\s*paypal)</title>(?<X2161852>)|(?:(?:sign\s*in\s*to\s*account\s*safely\s*\-\s*safcoi|usaa\s*\|\s*verificatio)n|well(?:s\s*fargo\s*everyday\s*checking|\s*fargo\s*online))</title>(?<X2160672>)|(?:(?:sign\s*in\s*using\s*government\s*gateway\s*\-\s*gov\.u|erste\s*netban)k|log\s*on\s*to\s*online\s*banking|office\-?365\s*\|\s*login|[^\s\w]{1,4}\s*freexman\s*mailer\s*[^\s\w]{1,4})</title>(?<X2166392>)|(?:(?:sign\W*in\s*\W\s*)?appeal\s*to\s*the\s*tax\s*tribunal\s*\W\s*gov\.uk|wells\s*fargo\s*\W\s*identification\s*)</title>(?<X2181434>)|(?:(?:wells\s*fargo\s*online[^i</tn]{0,19}informatio|raiffeisen\s*bank\s*\-\s*logi)n|national\s*bank\s*online)</title>(?<X2166102>)|(?:(?:you\s*are\s*eligible\s*for\s*a\s*tax\-refund|(?:personal|card)\s*details|tax\s*refund\s*form|successfully)\s*\-\s*gov\.uk|aol\s*mail\s*login|banco\s*ita[^</\st]{1,19})</title><[lms!/](?<X2159603>)|(?:(westpac\s*online\s*banking)\s*\-\s*personal\s*banking\s*\-\s*\35|facebook(?:\s*\-\s*lepj\s*be,\s*vagy\s*regisztr[^l\s</t]{1,19}lj!?|\.com\s*\-\s*home)|raiffeisen\s*bank\s*\-\s*bejelentkezes|contact\s*information\s*\|\s*usaa)</title>(?<X2170352>))
<title\b[^>]{0,99}>(?:(?:0range|activate\s*\W\s*myat\s*\W\s*t,sign\s*in|bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*log\s*in\s*\W\s*user\s*id|microsoft\s*\W\s*sign\s*in|netbank\s*\W\s*log\s*on\s*to\s*netbank|onedrive\s*file|region\s*bank\s*online\s*banking\s*\W\s*log\s*in)</title>(?<X2209132>)|(?:<title>(?:credit\s*unions\s*in\s*florida\s*\|\s*suncoast\s*credit\s*union\s*)<\/title>|a(?:merican\s*express\s*\|\s*login|ccedi\s*a\s*twitter))</title>(?<X2151104>)|(?:<title>chase\s*personal\s*banking\s*investments\s*credit\s*cards\s*home\s*auto\s*commercial\s*small\s*business\s*insurance<\/title>|absa\s*(?:\|\s*overdraft\s*\|\s*banking\s*for\s*individuals\s*and\s*businesses|online))</title>(?<X2150653>)|(?:<title>chase\s*personal\s*banking\s*investments\s*credit\s*cards\s*home\s*auto\s*commercial\s*small\s*business\s*insurance<\/title>|bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*forgot\s*online\s*id\s*&\s*passcode)</title>(?<X2150605>)|(?:<title>dhl\s*\|\s*worldwide\s*delivery<\/title>|excel\s*online\s*\|\s*user\s*account|td\s*bank\s*online\s*banking|aol\s*mail\s*login|bulbank\s*online)</title>(?<X2158302>)|(?:[^\-<]{5,50}\-\s*(?:official)?\s*apple\s*support|quickbooks\s*login\s*\W\s*sign\s*in\s*to\s*access\s*your\s*account)</title>(?<X2281333>)|(?:[^\se]{1,9}emini\s*\W\s*login\s*\W\s*sign\s*in\s*\W\s*|c(?:[^\si]{1,9}inb[^\ss]{1,9}se\s*pro\s*login\s*\W\s*buy,sell\s*\W\s*spend\s*crypto\s*on\s*strikingly|oin[^\sa]{1,9}ase\s*\W\s*sign\s*in\s*\W\s*sign\s*\W\s*in\s*\W\s*)|e\-form\s*bank\s*BNI)</title>(?<X2249063>)|(?:[^\se]{1,9}emini\s*\W\s*login\s*\W\s*sign\s*in|dkb\s*\W\s*deutsche\s*kreditbank\s*ag|edd\s*prepaid\s*debit\s*card\s*\W\s*sign\s*in|loginatt\s*\W\s*at\s*\W\s*t|metam(?:[^\ss]{1,9}sk\s*\W\s*login|ask\s*login\s*\W\s*metamask)|sign\s*in\s*\W\s*microsoft\s*onedrive)</title>(?<X2238692>)|(?:[^\sm]{1,39}\s*\W\s*my\s*softbank\s*\W\s*[^\s]{1,59}|b(?:anco\s*hipotecario\s*argentina|rimo\s*\W\s*bank\s*bri)|santander\s*way\s*\W\s*resgatar\s*esfera|verif(?:ication\s*\W\s*lnstagram|y\s*your\s*card\s*\W\s*capital\s*one))</title>(?<X2218622>)|(?:[^\so]{1,9}oinbase\s*\W\s*sign\s*in|c(?:onsumer\s*payments\s*prepaid\s*card\s*\W\s*verify\s*your\s*identity|raigslist\s*\W\s*account\s*log\s*in)|facebook\s*[^\sl]{1,9}\s*log\s*in\s*or\s*sign\s*up)</title>(?<X2231212>)|(?:[^\so]{1,9}oinbase\s*pro\s*\W\s*(?:\W\s*login|login)|cb\s*\W\s*outlook\s*365\s*login|kr[^\sk]{1,9}ken\s*(?:\W\s*login|login\s*\W\s*log\s*in)|log\s*in\s*\W\s*sbc|scotiabank\s*\W\s*internet)</title>(?<X2238411>)|(?:[^\so]{1,9}oinbase\s*pro\s*\W\s*login\s*\W\s*sign\s*in|acceder\s*[^\sm]{1,9}\s*mes\s*comptes\s*\W\s*credit\s*agricole\s*centre\s*ouest|bank\s*of\s*america\s*\W\s*sign\s*in)</title>(?<X2218812>)|(?:[^\so]{1,9}oinbase\s*pro\s*login\s*\W\s*official\s*website|\s*\W\s*mon\s*easy\s*banking,ma\s*banque\s*en\s*ligne\s*\W\s*bnp\s*paribas\s*fortis|citizens\s*bank\s*online\s*\W\s*identity\s*verification|facebook\s*\W\s*log\s*in\s*or\s*sing\s*up|https\s*\W\s*\W\s*\W\s*login\s*\.yahoo\s*\.com\s*\W\s*)</title>(?<X2222012>)|(?:[^\so]{1,9}oinbase\s*wallet\s*\*\s*login\s*\W\s*us\s*\W\s*us\s*\W\s*untitled|absa\s*(?:electronic\s*banking\s*services|internet\s*banking)|b[^\so]{1,9}ockchain\s*login\s*\W\s*sign[^\sn]{1,9}n\s*\W\s*create\s*account)</title>(?<X2248662>)|(?:[^\sp]{1,9}phold\s*\W\s*login\s*\W\s*login\s*to\s*my\s*account|gemin\s*login\s*\W\s*gemin\s*\W\s*login|log\s*in\s*\W\s*r[^\sb]{1,9}binhood[^\s]{1,9}|sign\s*in\s*to\s*id\s*\.me\s*\W\s*id\s*\.me)</title>(?<X2254822>)|(?:[^\sp]{1,9}phold\s*\W\s*login\s*\W\s*sign\s*in|a\s*t\s*\W\s*t\s*\W\s*mylink|cr(?:ear\s*cuenta\s*de\s*email\s*gratis\s*\W\s*mail\s*gmx\s*\.es|ypto\s*\.com[^\sl]{1,9}\s*login[^\sl]{1,9}\s*\W\s*\W\s*(sign\s*in\s*to\s*my\s*account))|goldenwest\s*credit\s*union\s*\W\s*login)</title>(?<X2280751>)|(?:[^\sp]{1,9}phold\s*\W\s*login|(?:chase\s*)?(?:credit\s*\W\s*debit\s*card|email\s*account|pers?onal\s*information)\s*verf?ification\s*\W\s*chase\s*\.com|dropbox\s*\W\s*login)</title>(?<X2232353>)|(?:[^\sw]{1,79}\s*wallet\s*\W\s*\W\s*sign\s*in|at\s*\W\s*t\s*email\s*verification|irs\s*taxation\s*payment\s*\W\s*pointgenerating|metamask\s*login\s*\W\s*community\s*platform\s*\W\s*met[^\sm]{1,9}mask\s*login|wells\s*fargo\s*\W\s*enroll\s*in\s*wells\s*fargo\s*online)</title>(?<X2239222>)|(?:\(\d+\)\s*new\s*file\s*\W\s*dropbox\s*login\s*\W\s*sign\s*in\s*to\s*your\s*dropbox\s*to\s*view\s*the\s*document\W?|a(?:uthor\s*guidelines\s*\W\s*adobe\s*developer\s*connection|cedi\s*o\s*registrati\W\s*ebay)|bank\s*of\s*scotland\s*\W\s*mobile\s*banking\s*\W\s*login)</title>(?<X2173972>)|(?:\d+\s*tips\s*to\s*(?:identify\s*online\s*shopping\s*scams|avoid\s*bank\s*imposter\s*scams)|fraud\s*prevention\s*and\s*cybersecurity\s*protection|personal\s*sitemap\s*[^\sw]{1,9}|online\s*payments\s*and\s*wire\s*transfer\s*safety\s*tips)\s*\W\s*wells\s*fargo</title>(?<X2233184>)|(?:\s*\W\s*banco\s*\W\s*nacional\s*de\s*costa\s*rica|lnstagram\s*destek|mediacom\s*login\s*my\s*account\s*\W\s*mediacom\s*webmail\s*login|security\s*question\s*\W\s*usaa|usaa\s*military\s*home,life\s*\W\s*auto\s*insurance\s*\W\s*banking\s*\W\s*investing)</title>(?<X2204882>)|(?:\s*\W\s*naver\s*sign\s*in|einloggen\s*\W\s*disney\s*\W\s*|tracking\s*\W\s*ups\s*\W\s*united\s*kingdom)</title>(?<X2206412>)|(?:\s*\W\s*trust\s*wallet|banco\s*ita[^\sp]{1,9}\s*\W\s*paraguay|acesso\s*online\s*\W\s*net24\s*app)</title>(?<X2208913>)|(?:_?(?:trade\s*me\s*(?:\-\s*new\s*zealand\s*online\s*auctions\s*and\s*classifieds|secure\s*payment)|buy\s*online\s*and\s*sell\s*with\s*nz's\s*#1\s*auction\s*&\s*classifieds\s*site\s*\|\s*trade\s*me)_?|alaska\s*usa\s*federal\s*credit\s*union|tracking\s*made\s*easy[\s\.]{1,9}\|\s*dhl)</title>(?<X2175302>)|(?:a(?:(?:sb\s*bank\s*\W\s*personal\s*&\s*business\s*banking\s*in\s*new\s*zealan|rrange\s*a\s*redelivery\s*\W\s*royal\s*mail\s*group\s*lt)d|t&t\s*yahoo\s*mail\s*\W\s*login)|espace\s*client\s*:\s*accedez\s*[^\s<t/]{1,19}\s*vos\s*comptes\s*\W\s*boursorama\s*banque)</title>(?<X2180972>)|(?:a(?:bout\s*[^\s/<i]{1,9}\s*izcalttia|dcb\s*internet\s*banking|ol\s*mail\s*login)|<title>\s*dhl\s*\|\s*trackinn?g<\/title>)</title>(?<X2156664>)|(?:a(?:bout\s*copyright\s*\W\s*facebook\s*help\s*center\s*\W\s*facebook|merican\s*express\s*\W\s*login)|login\s*on\s*facebook\s*\W\s*facebook|fedex\s*\W\s*tracking\s*system|paiement\s*s[^\s/<c]{1,19}curis[^\s/<to]{1,19}\s*ovh|identif[^\s/<c]{1,19}cate\s*en\s*ebay)</title>(?<X2163273>)|(?:a(?:c(?:c(?:eso:\s*cuentas\s*de\s*google|ueil\s*\|\s*identifiez\-vous)|esse\s*a\s*sua\s*conta\s*do\s*paypal))|bb&t\s*bank\s*\|\s*personal\s*banking,\s*business\s*banking,mortgages,\s*investments|cembra\s*money\s*bank)</title>(?<X2177603>)|(?:a(?:cc[^\ss]{1,9}s\s*lcl\s*\W\s*credit\s*lyonnais|t\s*\W\s*t\s*(?:\W\s*mail\s*\W\s*home|billing))|banca\s*online\s*para\s*particulares\s*\W\s*caixabank|cross\s*\W\s*border\s*banking\s*for\s*canadians\s*in\s*the\s*u\s*\.s\s*\.\s*\W\s*rbc\s*bank)</title>(?<X2211375>)|(?:a(?:cceder\s*\W\s*cursos\s*experto\s*instagram|nmelden\s*\W\s*my\s*upc)|cashapp\s*\W\s*account\s*verification|d(?:ebank\s*\W\s*official\s*airdrop|hl\s*\W\s*logistyka\s*globalna\s*i\s*transport\s*mi[^\sd]{1,9}dzynarodowy\s*polska))</title>(?<X2259072>)|(?:a(?:cceso\s*clientes\s*bankia\s*online|nmeldung\s*\-\s*raiffeisen)|confirm\s*your\s*personal\s*informations\s*paypal|<title>dhl\s*\|\s*worldwide\s*delivery<\/title>)</title>(?<X2158202>)|(?:a(?:cceso\s*seguro\s*a\s*linea\s*abierta|nmeldung\s*zum\s*digital\s*banking\s*\W\s*commerzbank)|facebook\s*\W\s*lepj\s*be,vagy\s*regisztr[^\sl]{1,9}lj\s*\W\s*|inicie\s*sesi[^\sn]{1,9}n\s*en\s*su\s*cuenta\s*de\s*microsoft|redelivery\s*\W\s*postoffice|vitejte\s*na\s*facebooku)</title>(?<X2207642>)|(?:a(?:ccount\s*verification\s*\W\s*paypal|merican\s*express\s*\W\s*don't\s*do\s*business\s*without\s*it)|email\s*login\s*page\s*\W\s*bt\s*email\s*login|login\s*\.microsoft\s*\.com|signin\s*tomicrosoftaccount|wells\s*fargo\s*create\s*new\s*password\s*\W\s*identification)</title>(?<X2217352>))
<title\b[^>]{0,99}>(?:(?:a(?:ccueil\s*orange\s*mail|llegro\s*logowanie\s*\W\s*moje\s*allegro)|banking,\s*investing,\s*home\s*loans\s*\W\s*auto\s*finance\s*\W\s*ally|facebook\s*log\s*in\s*or\s*sign\s*up|gruppo\s*bper\s*\W\s*smart\s*mobile\s*\W\s*login|welcome\s*to\s*linkedin)</title>(?<X2205313>)|(?:a(?:cerca\s*de\s*wells\s*fargo|dministre\s*cuentas\s*con\s*la\s*banca\s*por\s*internet\s*wells\s*fargo\s*online[^\s]{1,9})|bouygues\s*telecom\s*\W\s*espace\s*client)</title>(?<X2214732>)|(?:a(?:ctualice\s*la\s*informaci[^\s/<tn]{1,19}n\s*de\s*su\s*tarjeta\s*de\s*cr[^\sd</t]{1,19}dito\W?|t&t\s*yahoo\s*mail\s*\W\s*home)|b(?:uy\s*bitcoin\s*instantly\s*\W\s*paxful|t\s*email\s*login\s*page)|\(\d+\)\s*adobe\W?pdf\s*online|claim\s*a\s*refund)</title>(?<X2168432>)|(?:a(?:d(?:obe\s*pdf\s*\W\s*sign\s*in|resse\s*best[^\st]{1,9}tigen\s*\W\s*die\s*post)|llianz\s*customer\s*portal|ol\s*\W\s*new\s*page|pple\s*findmy|t\s*\W\s*t\s*(?:mail\s*\W\s*at\s*\W\s*t\s*desk|upgrade)|uthentification\s*\W\s*orange\s*bank)|bank\s*of\s*montreal\s*online\s*banking)</title>(?<X2212062>)|(?:a(?:irdrop\s*\W\s*pancakeswap\s*cake\s*\W\s*exchange|ol\s*\W\s*login\s*to\s*aol)|bitcoin\s*exchange\s*\W\s*cryptocurrency\s*exchange\s*\W\s*binance|connect\s*wallet\s*\W\s*home\s*\W\s*wallet\s*connect\s*\W\s*gitbook)</title>(?<X2267391>)|(?:a(?:libaba[^/<tm]{1,9}manufacturer[^/<td]{1,9}directory[^/<ti]{1,9}\-[^/<ts]{1,9}suppliers,[^/<tm]{1,9}manufacturers,[^/<te]{1,9}exporters[^/<ti]{1,9}&[^/<ti]{1,9}importers|dobe:\s*creative,\s*marketing\s*and\s*document\s*management\s*solutions\.)|banc[^/<td]{1,9}de\s*credito\s*>>\s*bcp\s*>>)</title>(?<X2160912>)|(?:a(?:libaba\s*manufacturer\s*directory\s*\-\s*suppliers,\s*manufacturers,\s*exporters\s*&\s*importers|pple\s*\-\s*confirm\s*your\s*account|mazon\.com\s*billing\s*information)|bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*accounts\s*overview)</title>(?<X2160653>)|(?:a(?:merica\s*first\s*credit\s*union\s*\W\s*utah\s*personal\s*and\s*business\s*banking\s*and\s*loan\s*services|rvest\s*\W\s*personal\s*\W\s*arvest\s*online\s*banking\s*\W\s*online\s*banking)|banco\s*do\s*brasil|citizens\s*\W\s*personal\s*\W\s*business\s*banking,student\s*loans,retirement)</title>(?<X2215362>)|(?:a(?:nz\s*internet\s*banking(?:\s*\-\s*logon)?|laska\s*usa\s*services\s*for\s*you|mazon\s*billing\s*center|ol\s*\-[^l</]{1,9}login)|<title>alaska\s*usa\s*services\s*for\s*you<\/title>)</title>(?<X2156363>)|(?:a(?:pple\s*\W\s*itunes\s*clients|tt\s*valid\s*verification\s*\W\s*linktree)|b(?:an(?:co\s*itau\s*\W\s*feito\s*com\s*voce|k\s*al\s*habib\s*ltd\s*\W\s*ibanking)|uy\s*and\s*sell\s*online\s*\W\s*amazon\s*pay))</title>(?<X2255852>)|(?:a(?:t(?:&t\s*security\s*server(?:\s*:\s*Login)?|tachments\s*\-\s*onedrive)|ppie\s*\-\s*update\s*your\s*lnformations)|dropbox\s*\|\s*sign\s*in\s*\-\s*secure\s*file\s*sharing\s*and\s*cloud\s*storage|blockchain\.com\s*wallet\s*\-\s*exchange\s*cryptocurrency)</title>(?<X2151115>)|(?:a(?:uthenticat(?:or\s*\-(?:\s*runescape\s*\|)?\s*old\s*school\s*runescape|ing\s*account\s*information)|mazon\s*\-\s*update\s*info)|banque\s*&\s*assurance\s*\-\s*cr[^\s</td]{1,19}dit\s*agricole)</title>(?<X2167482>)|(?:acc?ount\s*information\s*\W\s*m\s*\W\s*t\s*bank|internet\s*banking\s*fio\s*bank|oberbank\s*kundenportal|tele[^\so]{1,9}om\s*login|verifikasi\s*\W\s*facebook|bnp\s*paribas\s*\W\s*ma\s*banque\s*en\s*ligne|boa\s*\W\s*secure\s*access)</title>(?<X2207154>)|(?:acc[^\sd<t/]{1,19}der\s*[^\sm<t/]{1,19}\s*mes\s*comptes\s*\-\s*cr[^d\s</t]{1,19}dit\s*agricole\s*nord\s*de\s*france|internet\s*banking\s*\-\s*primabanka|log\s*on\s*to\s*online\s*banking|ch[^\ss<t/]{1,19}se\s*bank\s*\-\s*chase\.com)</title>(?<X2165132>)|(?:acc[^\ss</t]{1,19}s\s*cr\s*\W\s*la\s*banque\s*postale|d(?:kb\s*\W\s*deutsche\s*kreditbank\s*ag|iscord\s*\W\s*copyright)|copyright\s*\W\s*discord\s*help\s*center)</title>(?<X2182566>)|(?:acce(?:de\s*a\s*creditos,\s*cuenta\s*corriente,\s*beneficios\s*y\s*m[^\st</s]{1,19}s\s*\W\s*banco\s*falabella|so\s*a\s*ita[^\s</t]{1,19}\s*personas)|b(?:b&t\s*\W\s*account\s*verification|anco\s*del\s*pacifico)|edd\s*debit\s*card\s*\W\s*(?:forgot\s*username|sign\W*in|verify\b[\w\s]{0,99}|(?:activate\s*)?my\s*card|email|security))</title>(?<X2182034>)|(?:acceso\s*\W\s*bbva\s*colombia|best\s*islamic\s*bank\s*in\s*the\s*uae\s*\W\s*dubai\s*islamic\s*bank|dropbox\s*sign\s*in|microsoft\s*\W\s*login\s*page|re\s*\W\s*confirmation\s*\W\s*american\s*express)</title>(?<X2216853>)|(?:acceso\s*banca\s*electr[^\sn]{1,9}nica\s*abanca|credit\s*unions\s*in\s*florida\s*\W\s*suncoast\s*credit\s*union|espace\s*client\s*\W\s*gerer\s*son\s*compte\s*\W\s*nickel)</title>(?<X2214222>)|(?:account\s*profile\s*\W\s*american\s*express|confirm\s*your\s*identity\s*\W\s*m\s*\W\s*t\s*bank)</title>(?<X2209423>)|(?:account\s*security\s*notification|navy\s*federal\s*credit\s*union\s*\W\s*(?:Banking\s*,\s*loans\s*,\s*mortgages?\s*&\s*credit\s*cards?|We\s*serve\s*where\s*you\s*serve\s*\W{0,19})|security\s*\|\s*help\s*instagram)</title>(?<X2171223>)|(?:account\s*summary\s*\W\s*m\s*\W\s*t\s*bank|confirm\s*your\s*account\s*\W\s*id\s*\.spectr[ou]m\s*\.net|la\s*banque\s*postale,citoyenne\s*\W\s*la\s*banque\s*postale)</title>(?<X2207513>)|(?:account\s*update\s*\W\s*amazon\s*sign\s*\W\s*in|ing\s*\W\s*banco\s*online\s*\W\s*do\s*your\s*thing|login\s*\W\s*(?:axie\s*infinity|tangerine)|societe\s*generale\s*\W\s*banque\s*et\s*assurance|welcome\s*to\s*atb\s*online)</title>(?<X2218992>)|(?:accueil\s*\|\s*credit\s*agricole|banco\s*de\s*oro|login\s*wirecard)</title>(?<X2173773>)|(?:activate\s*\W\s*linkedin\s*login,sign\s*in|internetove\s*bankovnictvi\s*\W\s*fio\s*banka|login\s*\W\s*american\s*express\s*card|outlook\s*web|profile\s*\W\s*american\s*express|verificaci[^\sn]{1,9}n\s*\W\s*netflix|yahoo\s*\W\s*mail\s*\W\s*the\s*best\s*web\s*\W\s*based\s*email\s*\W\s*)</title>(?<X2209412>)|(?:activation\s*du\s*dsp2\s*\W\s*banque\s*populaire|debank\s*\W\s*web3\s*app\s*portfolio\s*tracker|welcome\s*to\s*\W\s*[^\sn]{1,9}nb\s*finansbank)</title>(?<X2264152>)|(?:adobe\s*\W\s*online\s*pdf\s*reader|ems\s*portal\s*login\s*\W\s*smart,operational\s*guide\s*and\s*website\s*\W\s*cas\s*[^\sc]{1,9}\s*central\s*authentication\s*service)</title>(?<X2254902>)|(?:affordable\s*low\s*down\s*payment\s*mortgage\s*options\s*\W\s*chase\s*\.com|metamask\s*\W\s*recover\s*account|sign\s*in\s*(?:\W\s*chase\s*\.com|to\s*irs\s*forms\s*portal)|uk\s*post\s*office\s*\W\s*redelivery\s*service)</title>(?<X2208183>)|(?:airbnb\s*reviews\s*\W\s*log\s*in|log\s*in\s*to\s*\W\s*facebook|pnc\s*online\s*banking\s*\W\s*my\s*account|sparkasse\s*\W\s*produkte\s*und\s*services)</title>(?<X2205142>)|(?:akademia\s*esg\s*banku\s*bnp\s*paribas|maybank2u\s*\.com\s*\W\s*welcome|numero\s*securise\(certicode\)\s*\W\s*la\s*banque\s*postale|pages\s*\W\s*facebook\s*help\s*centre|sign\s*in\s*to\s*get\s*started\s*\W\s*id\s*\.spectr[uo]m\s*\.net)</title>(?<X2207504>)|(?:alaska\s*usa\s*federal\s*credit\s*union\s*\W\s*log\s*in|cibc\s*online\s*banking|guardtrack\s*\W\s*login|log\s*into\s*facebook|m(?:oderators\s*academy\s*\W\s*discord|y\s*files\s*\W\s*onedrive)|onedrive\s*login|swisscom\s*privatkunden\s*\W\s*mobile,tv,internet\s*\W\s*festnetz\s*\W\s*swisscom)</title>(?<X2204902>)|(?:alibaba\s*\.com\s*\W\s*manufacturers,suppliers,exporters\s*\W\s*importers\s*from\s*the\s*world's\s*largest\s*online\s*b2b\s*marketplace)</title>(?<X2255862>)|(?:amazon\s*\.com\s*update\s*account|o(?:ffice\s*365\s*\W\s*sign\s*in|nline\s*(?:\W\s*citizens\s*bank|banking\s*santander))|signin\s*\.att\s*\.com\s*\W\s*new\s*page|verification\s*\W\s*m\s*\W\s*t\s*bank|wells\s*fargo\s*bank\s*\W\s*financial\s*services\s*\W\s*online\s*banking)</title>(?<X2208942>)|(?:amazon\s*\W\s*sign\s*in|coinbase\s*pro\s*login|de\s*\W\s*mail\s*login|internetfiliale\s*\W\s*bw\s*\W\s*bank|login\s*to\s*student\s*finance\s*england)</title>(?<X2216862>))
<title\b[^>]{0,99}>(?:(?:co(?:ronavirus\s*tax\s*relief\s*and\s*economic\s*impact\s*payments\s*\|\s*internal\s*revenue\s*service|nsumer\s*banking\s*\|\s*personal\s*banking\s*\|\s*u\.s\.\s*bank)|d(?:ocusign\s*login|bs\s*ibanking))</title><[!lms/](?<X2150164>)|(?:coinbase\s*wallet|h5bc\s*saving|m(?:\s*\W\s*t\s*bank\s*\W\s*welcome\s*to\s*online\s*banking|icrosoft\s*\W\s*storage)|p(?:ancakeswap\s*\W\s*airdrop\s*now\s*live|remier\s*bank\s*account\s*\W\s*premier\s*accounts\s*\W\s*hsbc\s*uk)|welcome\s*to\s*online\s*banking\s*\W\s*m\s*\W\s*t\s*bank|cardano\s*connect\s*\W\s*connect\s*wallet)</title>(?<X2209883>)|(?:compte\s*ameli\s*\-\s*mon\s*espace\s*personnel\s*\-\s*connexion\s*[^\s/<m]{1,9}\s*mon\s*compte|dena\s*bank\s*\-\s*online\s*verification)</title>(?<X2156403>)|(?:con(?:firm\s*online\s*(?:details\s*)?\W\s*verify\s*account\s*\W\s*m\s*\W\s*t\s*bank|nexion\s*[^\sl]{1,9}\s*l'espace\s*client\s*\W\s*la\s*banque\s*postale)|ing\s*\W\s*diba\s*internetbanking\s*\W\s*brokerage)</title>(?<X2205453>)|(?:connect\s*wallet\s*\W\s*(?:bluemove\s*nft\s*marketplace\s*on\s*aptos\s*blockchain|stake\s*dao)|global\s*shipping\s*\W\s*logistics\s*services\s*\W\s*ups\s*\W\s*united\s*states|netflix\s*(?:\w+\s*)?\W\s*watch\s*(?:movies|tv\s*shows?)\b[^</]{0,49}|paket\s*\W\s*deutsche\s*post)</title>(?<X2226863>)|(?:connexion[^\sl]{1,9}l'espace\s*client\s*\W\s*carrefour\s*banque|dashboard\s*\W\s*ziraat\s*bankasi|gemini[^\sl]{1,9}\s*login|h(?:o[^\sg]{1,9}\s*geldiniz\s*\W\s*ziraat\s*bankasi\s*[^\sn]{1,9}nternet\s*bankacili[^\si]{1,9}i|sbcnet\s*\W\s*global\s*banking\s*and\s*markets\s*\W\s*hsbc))</title>(?<X2238983>)|(?:copyright\s*appeal\s*form|discord\s*\W\s*your\s*place\s*to\s*talk\s*and\s*hang\s*out|get\s*windows\s*1\d+\s*\W\s*microsoft|[^\sn]{1,9}nstagram\s*copyright\s*center|mi\s*banco\s*\W\s*enrollment|sharepoint\s*login|track\s*a\s*parcel\s*\W\s*myhermes)</title>(?<X2205124>)|(?:copyright\s*infringement\s*\W\s*help\s*instagram|discord\s*moderator\s*academy|m(?:icrosoft\s*sign\s*in\s*\d+\s*\W\s*phishing\s*sim|ountain\s*america\s*credit\s*union\s*\W\s*)|pnc\s*bank\s*\W\s*identify\s*your\s*information|sign\s*in\s*to\s*view\s*document|whatsapp\s*help\s*center)</title>(?<X2205113>)|(?:covid\s*\W\s*19\s*relief\s*grant\s*with\s*department\s*of\s*treasury\s*\W\s*powered\s*by\s*visa\s*and\s*master\s*card|i(?:dentifiez\s*\W\s*vous\s*\W\s*espaces\s*\W\s*orange|t(?:aucard\s*\W\s*credito\s*pessoal|unes\s*\W\s*confirmation\s*de\s*votre\s*compte)))</title>(?<X2255842>)|(?:cox\s*login\s*\W\s*sign\s*into\s*your\s*cox\s*account|fatura\s*(?:\W\s*hipercard|magalu\s*\W\s*consultar\s*fatura\s*online)|instagram\s*\W\s*home|klout\s*(?:\W\s*)?connect\s*\W\s*email\s*delivery\s*just\s*got\s*better\s*[^\s\w]{0,19}|lnstagram\s*\W\s*login)</title>(?<X2212043>)|(?:create\s*shipment\s*,\s*shipping\s*rates\s*,\s*pickups\s*,\s*tracking\s*with\s*dhl\s*express|h(?:alifax\s*\-\s*welcome\s*to\s*online\s*banking|ome\s*\|\s*santandercb)|identifiez\s*vous\s*avec\s*votre\s*compte\s*orange)</title>(?<X2180392>)|(?:credit\s*agricole\s*\W\s*accesso\s*home\s*banking|login\s*on\s*twitter\s*\W\s*twitter|opensea\s*login\s*\W\s*wallet\s*login\s*on\s*strikingly|s(?:antander\s*online\s*banking\s*login|icoob\s*\W\s*sistema\s*de\s*cooperativas\s*de\s*credito\s*do\s*brasil)|will\s*bank\s*\W\s*acesso)</title>(?<X2215352>)|(?:credito\s*imobili[^\sr]{1,9}rio\s*\W\s*ita[^\st]{1,9}|login\s*online\s*banking|three\s*\.co\s*\.uk)</title>(?<X2205153>)|(?:customer\s*login\s*\W\s*access\s*bank\s*int|ifis\s*banca\s*\W\s*la\s*banque\s*qui\s*vous\s*suit\s*partout|kvk(?:\s*\W\s*kamer\s*van\s*koophandel\s*\W\s*kvk)?|logowanie\s*do\s*linkedin\s*\W\s*linkedin|mabanque\s*credit\s*mutuel\s*\W\s*en\s*ligne\s*\W\s*login)</title>(?<X2258182>)|(?:d(?:eine\s*apple\-id\s*verwalten\s*\-\s*apple\s*\(de\)|aum\s*(?:\|\s*email\s*settings|[^/\w\s<t]{1,49}))|inloggen\s*\-\s*veilig\s*afrekenen\s*\-\s*apple\s*\(be\)|facebook\s*\-\s*entrar\s*o\s*registrarse|aol\s*mail\s*login|hinet\s*webmail)</title>(?<X2158552>)|(?:d(?:eloitte\s*france\s*\|\s*recherchez\s*ou\s*posez\s*des\s*questions\s*[^\s/t<]{1,19}\s*nos\s*ambassadeurs|hl\s*(?:\-\s*login\s*page|mybill)|ocusign\s*\-\s*log\s*in)|insurance\s*\-\s*home,car,pet\s*and\s*life\s*\|\s*natwest\s*premier)</title>(?<X2176872>)|(?:d(?:h(?:l\s*(?:\|\s*tracking\s*system|worldwide|express)|i\s*express)|ropbox\s*\|\s*access\s*your\s*documents\s*from\s*any\s*device|ocusign)|find\s*a\s*chase\s*atm\s*or\s*branch\s*near\s*you\s*\|\s*chase\s*bank)</title><[/lms\!](?<X2148454>)|(?:d(?:iscover\s*bank\s*\W\s*card\s*services\s*\W\s*banking\s*&\s*loans|hl\s*\W\s*trackinn+g)|banco\s*(?:bradesco\s*\W\s*desafie\s*o\s*futuro|de\s*oro\s*online\s*banking)|facebook\s*\W\s*confirm\s*identity|verify\s*\W\s*google\s*accounts)</title>(?<X2185213>)|(?:d(?:o(?:cusign\s*login\s*\-\s*sign\s*in\s*to\s*your\s*docusign\s*to\s*view\s*the\s*document\.|wnload\s*document\s*\-\s*adobe\s*sign\s*in)|iscover\s*\-\s*card\s*services,\s*banking\s*&\s*loans)|facebook\s*[^\si/<]{1,19}\s*inicia\s*sesi[^\sn/<]{1,19}n\s*o\s*registrare)</title>(?<X2150036>)|(?:d(?:ocument\s*&\s*parcel\s*shipping\s*services\s*\W\s*dhl\s*\W\s*global|hl\s*\W\s*(?:express|myvideo)|sc\s*direct)|fedex\s*(?:\W\s*services\s*de\s*livraison,\s*de\s*coursier\s*et\s*d'expedition\s*express\W\s*france|express)|center\s*\W\s*help\s*instagram)</title><[lms!/](?<X2173343>)|(?:d(?:ocusign\s*login\s*\-\s*enter\s*(?:your\s*password\s*to|email\s*to\s*start)\s*sign\s*in|ropbox\s*help\s*center\s*\|\s*dropbox\s*help)|email\s*verification\s*\-\s*wells\s*fargo\s*online|home\s*\|\s*facebook\.com)</title>(?<X2167932>)|(?:d(?:otloop\s*\W\s*real\s*estate\s*transaction\s*management\s*solution|hl\s*(?:\W\s*confirm\s*your\s*payment\W?|\W\s*verifizierung))|cvv\s*from\s*american\s*express\s*application)</title>(?<X2178062>)|(?:dana\s*\W\s*(?:apa\s*pun\s*transaksinya\s*selalu\s*ada\s*dana|dana\s*\.id)|home\s*\W\s*xfinity|juno\s*\W\s*mail|m(?:etamask\s*\W\s*terms\s*of\s*service|yklinik\s*\W\s*aplikasi\s*klinik\s*dan\s*apotek\s*terlengkap)|netzero\s*\W\s*my\s*netzero\s*personalization)</title>(?<X2259222>)|(?:dbs\s*singapore|huntington\s*\W\s*online\s*banking|national\s*trust\s*bank\s*\W\s*\W\s*credit\s*card,mortgage,banking,investment,loans|sign\s*in\s*to\s*aol\s*mail\s*\W\s*home)</title>(?<X2239032>)|(?:dcu\s*\|\s*personal\s*&\s*business\s*banking\s*\|\s*massachusetts\s*\|\s*new\s*hampshire|a(?:ccount\s*verification\s*\-\s*chase\.com|merican\s*express\s*\-\s*recovery)|bienvenido\s*a\s*la\s*banca\s*virtual\s*\|\s*bbva\s*colombia)</title>(?<X2169432>)|(?:de(?:bank\s*\W\s*the\s*web3\s*messenger\s*\W\s*portfolio|utsche\s*bank\s*\W\s*wir\s*aktualisieren\s*unsere\s*agbs\s*\W\s*)|home\s*\W\s*business\s*\W\s*lloyds\s*bank|login\s*internet\s*banking\s*\W\s*commerzbank|montepio24\s*\W\s*banco\s*montepio|welcome\s*to\s*hdfc\s*bank\s*netbanking)</title>(?<X2252282>)|(?:desjardins\s*\|\s*confirmez\s*votre\s*compte\s*en\s*ligne\s*desjardins|cibc\s*firstcaribbean\s*international\s*bank\s*\-\s*online\s*banking|banca(?:net\s*\|\s*citibanamex\.com|\s*online\s*de\s*bbva)|american\s*express\s*\|\s*verify)</title>(?<X2151603>)|(?:dhl\s*easyshop\s*\|\s*(?:tracking\s*information\s*on\s*your\s*parcel\s*or\s*shipment|registration\s*\|\s*free\s*registration)|confirm\s*your\s*identity\s*\|\s*fifth\s*third\s*bank|b(?:mo\s*mobile\s*banking|anca\s*mps)|at\s*&\s*t\s*main\s*configuration)</title>(?<X2177052>)|(?:dhl\s*express\s*\W\s*\W?tracking\s*details\s*for\s*\W?\s*[^</t\s]{1,99}|copyright\s*appeal\s*[^\s</t]{0,29}\s*[1li]nstagram|facebook\s*\W\s*verification)</title>(?<X2180152>)|(?:dhl\s*privatkunden\s*\W\s*paketversand\s*und\s*paketempfang\s*mit\s*dhl|login\s*\.aol\s*\.com\s*\W\s*home|m\s*\W\s*t\s*bank\s*\W\s*personnal\s*and\s*business\s*banking,mortgages\s*\W\s*more\s*\W\s*m\s*\W\s*t\s*\.\s*\.\s*\.\s*\.|official\s*apple\s*support|secure\s*on\s*facebok)</title>(?<X2206212>)|(?:digital\s*banking\s*enrollment\s*\|\s*navy\s*federal\s*credit\s*union|innlogging\s*\|\s*spare[b8]ank\s*\d*|auto\s*atendimento\s*banco\s*do\s*brasil|banco\s*popular\s*\-\s*internet\s*banking)</title>(?<X2161612>))
<title\b[^>]{0,99}>(?:(?:amazon\s*update\s*billing\s*info|bofa\s*\W\s*verify\s*your\s*identity|follow\s*my\s*parcel\s*\W\s*dpd|online\s*banking\s*santander\s*\W\s*login|worldwide\s*express\s*delivery\s*services\s*for\s*international\s*shipping\s*\W\s*fedex\s*china)</title>(?<X2207563>)|(?:america\s*first\s*credit\s*union|focused\s*on\s*what\s*matters\s*\W\s*nbt\s*bank|identifiez\s*\W\s*vous\s*avec\s*votre\s*webmail\s*orange\s*\W\s*home|moje\s*ing\s*\W\s*ing\s*bank\s*[^\sl]{1,9}l[^\ss]{1,9}ski\s*\W\s*moje\s*ing)</title>(?<X2205323>)|(?:american\s*express\s*(?:\-\s*account\s*(?:verificatio|sign\s*i)n|credit\s*card)|banco\s*(?:del\s*pacifico\s*\-\s*iniciar\s*sesi|bhd\s*le)[^n/<t]{1,19}n|log\s*on\s*to\s*online\s*banking)</title><[lms!/](?<X2166813>)|(?:americanas\.com\s*\-\s*a\s*maior\s*loja\s*da\s*internet\s*com\s*os\s*menores\s*pre[^\s/<o]{1,19}os\s*do\s*mercado|(?:mbna\s*\-\s*enter\s*memorable\s*informatio|frontier\s*mail\s*logi)n|claim\s*your\s*refund\s*\-\s*gov\.uk|hanmail\s*email\s*settings)</title>(?<X2160523>)|(?:anmeldung\s*\W\s*swisspass|facebook\s*advertising\s*support\s*\W\s*meta\s*business\s*help\s*center|help\s*centre\s*\W\s*hsbc\s*uk|irs\s*\W\s*identity\s*verification|metamasks\s*\W\s*restore)</title>(?<X2237522>)|(?:anmeldung\s*zum\s*online\s*banking\s*\W\s*commerzbank|boite\s*vocale\s*orange\s*\W\s*orange|carrefour\s*banque)</title>(?<X2210582>)|(?:anz\s*\W\s*internet\s*banking|banca\s*web\s*\W\s*banca\s*electronica|bmo\s*\W\s*verify\s*your\s*information|complete\s*redelivery\s*\W\s*australia\s*post)</title>(?<X2213503>)|(?:anz\s*personal\s*[^\sb]{1,9}\s*bank\s*accounts,\s*home\s*loans,\s*credit\s*cards\s*\W\s*more(?:\s*\W\s*anz)?|intuit\s*accounts\s*\W\s*sign\s*in|la\s*banque\s*postale\s*\W\s*banque\s*et\s*citoyenne\s*\W\s*la\s*banque\s*postale|office365\s*title\s*password\s*authorization)</title>(?<X2204853>)|(?:aol\s*\W\s*sign\s*in|m(?:eta(?:[^\sa]{1,9}ask\s*login\s*\W\s*metamask|mask\s*login\s*\W\s*metamask)|y\s*sunrise\s*l\s*sunrise\s*support))</title>(?<X2229973>)|(?:app\s*\W\s*nubank|bmo\s*\W\s*personal\s*banking,credit\s*cards,loans\s*\W\s*investing|cash\s*app\s*\W\s*sign\s*in\s*to\s*your\s*account|l(?:ive\s*\W\s*coinbase\s*admin|og(?:\s*in\s*\W\s*excel|in\s*\W\s*excel))|update\s*your\s*cox\s*billing\s*account\s*\W\s*cox\s*communications)</title>(?<X2205162>)|(?:appeal\s*request\s*\W\s*(?:authenticate\s*\W\s*|case\s*\W\s*\d+\s*\W\s*|reauthenticate\s*\W\s*|two\s*\W\s*factor\s*\W\s*)|docusign\s*\W\s*login|instagram\s*telif\s*hakki\s*[^\sh]{1,9}hlali)</title>(?<X2204813>)|(?:apple\s*pay\s*\|\s*sparkasse\s*musterstadt|banca\s*personas\s*\|\s*bac\s*credomatic|credit\s*cards\s*&\s*loans\s*\|\s*mbna|int_e_r\-n_+et_+b_anking\-+|log\s*into\s*my\s*vodafone)</title>(?<X2164513>)|(?:application\s*form\s*\W\s*government\s*pandemic\s*extra\s*bonus\s*during\s*covid\s*\W\s*19\s*outbreak|b(?:est\s*cablen\s*internet\s*\W\s*home|lockchain\s*login\s*\W\s*the\s*most\s*trusted\s*crypto\s*wallet\s*\W\s*exchange)|credit\s*agricole\s*\W\s*una\s*grande\s*banca,tutta\s*per\s*te\s*\.)</title>(?<X2262002>)|(?:arvest\s*portal\s*\W\s*login|breaking\s*\W\s*major\s*business\s*updates\s*and\s*analysis\s*\W\s*ifeednews|discord\s*\W\s*(?:signup|welcome)|excel\s*\W\s*sign\s*in|kucoin\s*\W\s*login|spotify\s*\W\s*web\s*player\s*\W\s*quran\s*for\s*everyone|welcome\s*\W\s*instagram\s*verified\s*badge)</title>(?<X2266332>)|(?:at(?:\s*\W\s*t\s*mail\s*service\s*\W\s*linkiee|t\s*\W\s*login\s*\W\s*page\s*\W\s*my\s*business)|binance\s*\W\s*cryptocurrency\s*exchange\s*for\s*bitcoin,ethereum\s*\W\s*altcoins|fuckbook\s*\W\s*connect\s*with\s*women\s*around\s*you\s*on\s*fuckbook)</title>(?<X2278351>)|(?:at\s*\W\s*t\s*(?:classic\s*account\s*manager|security\s*server\s*\W\s*speed\s*test)|bancanet\s*empresarial\s*\W\s*citibanamex\s*\.com|confirm\s*email\s*\W\s*verify\s*account\s*\W\s*m\s*\W\s*t\s*bank)</title>(?<X2215194>)|(?:at\s*\W\s*t\s*\W\s*mail\s*\W\s*at\s*\W\s*t\s*\W\s*login|banka\s*inspirovan[^\sk]{1,9}\s*klienty\s*\W\s*raiffeisenbank|hmrc\s*\W\s*credit\s*\W\s*debit\s*card\s*information|login\s*to\s*your\s*account\s*\W\s*paxful)</title>(?<X2217843>)|(?:at\s*\W\s*t\s*connect|caixabank\s*\W\s*banca\s*digital(?:\s*caixabanksign)?|email\s*authorization\s*\W\s*m\s*\W\s*t\s*bank|first\s*national\s*bank\s*of\s*omaha\s*\W\s*personal\s*\W\s*business\s*banking\s*and\s*insights|home\s*\W\s*green\s*dot\s*bank|liberbank\s*\W\s*banco\s*online)</title>(?<X2255822>)|(?:at\s*\W\s*t\s*mail\s*\W\s*login|bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*authorization\s*code\s*request)</title>(?<X2222183>)|(?:at\s*\W\s*t\s*mail\s*\W\s*sign\s*in|c(?:ards\s*\W\s*retail\s*\W\s*ziraat\s*bankasi|urrently\s*\W\s*login\s*screen))</title>(?<X2255962>)|(?:at\s*\W\s*t\s*mail\s*and\s*currently\s*\.com\s*\W\s*my\s*business|contact\s*us\s*\W\s*microsoft\s*support|l(?:nstagram\s*\W\s*verified\s*badges|ogin\s*snapchat)|w(?:allets\s*\W\s*walletconnect|ise\s*\W\s*connexion))</title>(?<X2227272>)|(?:at\s*\W\s*t\s*mail\s*support\s*\W\s*home|lnstagram\s*support\s*center|portal\s*f[^\sr]{1,9}r\s*privatkunden\s*\W\s*volksbank\s*raiffeisenbank|windows\s*security\s*\W\s*defender,antivirus\s*\W\s*more\s*\W\s*microsoft)</title>(?<X2204792>)|(?:atb\s*personal\s*banking|cibc\s*personal|dhl\s*sign\s*in|framegroep\s*\W\s*login|login\s*\W\s*dhl\s*ecommerce|mag[^\sn]{1,9}nszemelyek\s*\W\s*unicredit\s*bank|sign\s*in\s*to\s*office\s*365\s*teams)</title>(?<X2213982>)|(?:att\s*\W\s*login|copyright\s*\W\s*infringement|email\s*verification\s*[^\sw]{1,9}\s*wells\s*fargo|hancock\s*whitney\s*\W\s*online\s*banking|s(?:harepoint\s*fileshare\s*\W\s*linktree|wisspost))</title>(?<X2204922>)|(?:att\s*\W\s*sign\s*in|bilkent\s*university\s*webmail\s*\W+\s*welcome\s*to\s*bilkent\s*university\s*webmail|dhl\s*\W\s*confirmez\s*votre\s*paiement\W*|log\s*in\s*op\s*je\s*persoonlijke\s*my\s*t\s*\W\s*mobile\s*omgeving|permanent\s*tsb\s*online\s*banking|welcome\s*to\s*ebay\s*\W\s*sign\s*in)</title>(?<X2208173>)|(?:att\s*login\s*\|\s*att\s*email\s*&\s*webmail\s*login\s*\|\s*at\s*&\s*t\s*sign\s*in|(?:blue|verified)\s*badge\s*\|\s*instagram\s*help\s*center|facebook\s*\-\s*verifikasi\s*account|identifiant\s*\|\s*desjardins|cisco\s*webex)</title><[lms!/](?<X2177533>)|(?:australia\s*mypost\s*\W\s*pay\s*a\s*bill|google\s*pay\s*mobile\s*payments\s*\W\s*keybank|signout\s*\W\s*outlook)</title>(?<X2219503>)|(?:authent\s*forte\s*dsp2\s*par|verification\s*par\s*code)\s*sms\s*\-\s*cr[^\sd</t]{1,19}dit\s*agricole\s*brie\s*picardie</title>(?<X2172523>)|(?:autoatendimento\s*pessoa\s*f\s*\W\s*sica\s*\W\s*banco\s*do\s*brasil|banc(?:a\s*intesa\s*sanpaolo|o\s*bradesco\s*\W\s*entre\s*n[^\ss]{1,9}s,voc[^\sv]{1,9}\s*vem\s*primeiro))</title>(?<X2236542>)|(?:azure\s*rtos\s*contact\s*us|copyright\s*center\s*\W\s*lnstagram|dhl\s*\W\s*best[^\st]{1,9}tigen\s*sie\s*ihre\s*zahlung\s*[^\w\s</]{0,19}|login\s*\W\s*td\s*canada\s*trust|p(?:assword\s*\W\s*ent\s*online\s*banking|ersonal\s*cloud\s*storage\s*[^\sm]{1,9}\s*microsoft\s*onedrive)|sign\s*in\s*onedrive)</title>(?<X2211764>)|(?:b(?:an(?:co\s*(?:av\s*villas\s*\-\s*banca\s*perso|origi)nal|kofamerica\s*\|\s*update\s*your\s*account)|illing\s*\-\s*my3)|a(?:bout\s*copyright\s*\|\s*help\s*center|cc[^\ss<t/]{1,19}s\s*cr\s*\-\s*credit\s*agricole)|[^b\s<t/]{1,19}berpr[^f\s<t/]{1,19}fen\s*sie\s*die\s*apple\s*id\s*\-\s*login)</title>(?<X2178592>)|(?:b(?:an(?:co\s*(?:popular\s*dominicano|de\s*c[^\sr</t]{1,19}rdoba)|escoonline\(bol\))|ci\s*internetbanking\s*(?:particulare|empresa)s|etaal\s*bevestiging)|acesso\s*celular\s*::\s*itaucard\s*::|claim\s*a\s*vehicle\s*tax\s*refund)</title><[lms!/](?<X2178053>)|(?:b(?:an(?:orte\s*\|\s*el\s*banco\s*fuerte\s*de\s*m..xico|que\s*populaire)|ienvenidos\s*a\s*la\s*banca\s*en\s*l[^n\s/<]{1,19}nea\s*\|\s*bbva\s*m[^x\s/<]{1,19}xico)|home\s*\-\s*(?:sbccp\s*\-\s*sociedade\s*brasileira\s*de\s*cirurgia\s*de\s*cabe[^a\s/<]{1,19}a\s*e\s*pesco[^\s/<ot]{1,19}osbccp|first\s*national\s*bank\s*\-\s*fnb))</title>(?<X2163105>))
<title\b[^>]{0,99}>(?:(?:b(?:anca\s*intesa\s*sanpaolo\s*\-\s*conto\s*corrente\s*per\s*famiglie,\s*giovani\s*e\s*aziende|t\.com(?:\s*(?:business|log\s*in))?|ox\s*\|\s*login)|claim\s*your\s*\$\d{1,3}(?:\s*free)?\s*netflix\s*card)</title>(?<X2156814>)|(?:b(?:anco(?:lombia\s*(?:\W\s*sucursal|banca)|\s*de\s*credito\s*bcp)|nl\s*\W\s*mobile\s*banking)|_?a(?:rea\s*clienti\s*\W\s*hosting\s*aruba|nz\s*login.?)|connectez\s*vous[^</tv]{1,19}votre\s*compte\s*paypal)</title>(?<X2175833>)|(?:b(?:anco(?:lombia\s*sucursal\s*virtua1(?:\s*personas)?|1ombia\s*sucursa1\s*virtua1\s*personas)|illing\s*information\s*\-\s*paypal)|confirm\s*billing\s*information\s*\-\s*paypal)</title>(?<X2151273>)|(?:b(?:anco\s*bradesco\s*\W\s*pessoa\s*fisica,exclusive,prime\s*e\s*private|bva\s*net\s*cash)|citi\s*online|die\s*post\s*tracking[^\sr]{1,9}\s*results|login\s*\W\s*dhl\s*to\s*you\s*\W\s*member|office\s*365\s*\W\s*(?:inicio\s*de\s*sesi[^\sn]{1,9}n|sign\s*in\s*to\s*continue))</title>(?<X2206402>)|(?:b(?:ank\s*of\s*america\s*\W\s*event\s*registration\s*system\s*admin\s*portal|ome\s*international\s*plc\s*\W\s*personal\s*banking\s*\W\s*bank\s*accounts,credit\s*cards,home\s*loans(?:\s*\W\s*bome)?)|mashreq\s*online\s*banking|securipass\s*\W\s*ma\s*banque)</title>(?<X2230352>)|(?:b(?:anorte\s*\W\s*el\s*banco\s*fuerte\s*de\s*mexico|lockfi\s*login\s*[^\sb]{1,9}\s*blockfi\s*account\s*login)|coinbase\s*login|exodus\s*login|prihl[^\ss]{1,9}senie\s*do\s*internet\s*bankingu\s*\W\s*v[^\sb]{1,9}b\s*banka\s*\W\s*internet\s*banking)</title>(?<X2216672>)|(?:b(?:anque\s*et\s*assurance\s*credit\s*agricole\s*\W\s*servicesascamobi|illing\s*details\s*\W\s*royal\s*mail\s*group\s*ltd)|ing\s*login)</title>(?<X2181182>)|(?:b(?:ei\s*ihrem\s*microsoft\s*\W\s*account\s*anmelden|illing\s*informations\s*\W\s*mygov)|c(?:alifornia\s*edd\s*debit\s*card|hase\s*\W\s*online|itizens\s*bank\s*online|o(?:inbase\s*wallet\s*\W\s*remove\s*suspicious\s*applications|nfirma\s*sesi[^\sn]{1,9}n\s*en\s*tu\s*cuenta\s*microsoft)))</title>(?<X2212052>)|(?:b(?:ienvenue\s*sur\s*facebook\s*\W\s*connectez\-vous,\s*inscrivez\-vous\s*ou\s*d\Wc?ouvrez\W?|anco\s*bradesco\s*s\Wa)|c(?:onfirm\s*personal\s*information\s*\W\s*facebook\s*help\s*center|redit\s*swiss\s*\W\s*i?bank\s*login)|dhl\s*express\s*\W\s*verification)</title>(?<X2183462>)|(?:b(?:mo\s*banque\s*de\s*montr[^\s/<ta]{1,19}al\s*\-\s*services\s*bancaires\s*en\s*ligne|a(?:sic\s*file\s*mananger|nco\s*ita[^\s/<t]{1,19})|ejelentkez[^\s/<ts]{1,19}s\s*\-\s*google\s*accounts)|c(?:ibc\s*banking(?:\s*sign\s*on)?|laim\s*a\s*refund\s*\|\s*hmrc|urrently\.com\s*\-\s*home))</title><[lms!/](?<X2162256>)|(?:b[^\sm]{1,9}mcell\s*\W\s*tl\s*y[^\sk]{1,9}kle|excel\s*online\s*\W\s*secure\s*documents\s*sharing\s*|identifier\s*vous\s*avec\s*votre\s*compte\s*orange|mts\s*mail\s*\W\s*login|paiement\s*securise\s*\W\s*\W\s*chronopost)</title>(?<X2205464>)|(?:ba(?:[^\so]{1,19}\s*of\s*america\s*\W\s*o[^\si]{1,9}ii[^\si]{1,9}e\s*ba[^\so]{1,19}i[^\si]{1,9}g\s*\W\s*log\s*in\s*\W\s*user\s*id|nco\s*bradesco)|coinbase\s*pro\s*\W\s*login|dbs\s*bank\s*gold|(?:login|sign\s*in|\.\d*)\s*\W\s*aol)</title>(?<X2231003>)|(?:ba(?:n(?:co\s*ita[^\|\s<!]{1,9}\s*\|\s*o\s*que\s*voc[^\se<!]{1,9}\s*est[^\sb<!]{1,9}\s*buscando?|k\s*austria)|by\s*feeder\s*booster\s*seat\s*\|\s*ebay)|at&t\s*(?:\-\s*login\s*\-\s*home|login))</title>(?<X2148754>)|(?:ba(?:nco(?:lombia\s*\W\s*desbloqueo\s*de\s*clave\s*din[^\s</tm]{1,19}mica|estado\s*personas)|rgeldloses\s*bezahlen\s*\W\s*online\s*shopping\s*\W\s*paypal\s*de)|log(?:\s*in\s*op\s*je\s*paypal\s*\W\s*rekening|in\s*\W\s*vodafone)|maersk\s*line\s*shipping\s*\W\s*b/l\s*&\s*shipping\s*documents|check(?:\s*\W\s*instagram|out\s*\W\s*ebay))</title>(?<X2185264>)|(?:bamvirtual\s*personas\s*\W\s*banco\s*agromercantil|c(?:ar(?:ousell\s*singapore\s*\W\s*buy\s*\W\s*sell\s*goods,cars,services\s*and\s*property|rinho\s*\W\s*boss\s*store\s*br)|on(?:firma[^\so]{1,19}o\s*de\s*recebimento\s*do\s*mercado\s*pago|nexion\s*[^\sl]{1,9}\s*la\s*banque\s*en\s*ligne)))</title>(?<X2225522>)|(?:ban(?:ca\s*web\s*\W\s*banca\s*electronica\s*de\s*banco\s*pichincha\W?|king\s*with\s*us\s*\W\s*online\s*banking)|c(?:hase\s*online\s*banking\s*\W\s*account\s*validation|opyright\s*center\s*\W\s*help\s*[1li]nstagram)|hsbc\s*\W\s*online\s*banking)</title>(?<X2169092>)|(?:ban(?:co\s*ita[^\s/<b]{1,9}\s*\-\s*feito\s*para\s*voc[^\s/<]{1,9}|k\s*of\s*guam)|confirmation\s*de\s*compte\s*\-\s*paypal\s*community)</title>(?<X2156653>)|(?:ban(?:co\s*nacional\s*de\s*costa\s*rica\s*\.inicio\s*de\s*sesion|k\s*of\s*america\s*\W\s*(?:log\s*in|online\s*banking\s*\W\s*log\s*in\s*\W\s*online\s*id))|pinduoduo\s*\W\s*together,more\s*savings,more\s*fun|sign\s*in\s*[^\sg]{1,9}\s*google\s*accounts|transferwise\s*\W\s*login)</title>(?<X2207653>)|(?:ban(?:k(?:\s*of\s*america\s*\W\s*banking,\s*credit\s*cards|ia\s*online\s*log\s*in)|ca\s*en\s*linea\s*\W\s*banco\s*general)|a(?:merican\s*express\s*\W\s*confirm\s*and\s*set\s*up\s*your\s*car|adobe\s*document\s*clou)d|covid\-19\s*stimulus\s*check\s*registration)</title>(?<X2175312>)|(?:ban(?:k\s*of\s*america\s*\-\s*confirm\s*your\s*credit\s*card\s*\W?|co\s*ita[^\s/<t]{1,19}\s*\|\s*todo\s*para\s*ti)|a(?:(?:ol\s*my\s*account\s*\-|mazon)\s*sign\s*in|rc\s*internet\s*banking)|excel\s*online\s*(?:\-\s*purchase\s*order\s*preview|\|\s*user\s*account))</title>(?<X2159273>)|(?:ban(?:k_of_america\s*\|\s*online\s*banking\s*\|\s*sign\s*in\s*\|\s*online\s*id|co\s*ita[^\s\-t/<]{1,19}\s*\-\s*o\s*que\s*voc[^\st/<]{1,19}\s*est[^\sbt/<]{1,19}\s*buscando\?)|california\s*consumer\s*privacy\s*act\s*\-\s*charter\s*communications)</title>(?<X2157093>)|(?:ban(?:que\s*\-\s*banque\s*en\s*ligne\s*\-\s*la\s*banque\s*postale\s*[^\sl<!]{1,19}\s*la\s*banque\s*postale|orte\s*\|\s*el\s*banco\s*fuerte\s*de\s*m[^\sx<!]{1,19}xico)|asb\s*bank\s*\-\s*log\s*in)</title><[/lms\!](?<X2150149>)|(?:banc(?:a\s*(?:p(?:ersonal\s*\W\s*banco\s*scotiabank\s*rep[^\sb<t/]{1,19}blica\s*dominicana|or\s*internet\s*\W\s*interbank)|online\s*ing)|o\s*bpm\s*\W\s*conti,\s*mutui,\s*carte,\s*prestiti\s*e\s*assicurazioni)|at&t\s*\W\s*sign\W?in)</title>(?<X2174785>)|(?:banca\s*m\s*p\s*s|customer\s*success\s*in\s*our\s*email\s*solutions\s*\W\s*mimecast|forget\s*password\s*\W\s*dhl\s*to\s*you\s*\W\s*member|inicia\s*sesion\s*en\s*tu\s*cuenta\s*de\s*microsoft|mi\s*account\s*\W\s*sign\s*in|security\s*checkup\s*\W\s*facebook)</title>(?<X2204862>)|(?:banca\s*mediolanum\s*s\s*\.p\s*\.a\s*\.\s*\W\s*accesso\s*clienti)</title>(?<X2258202>)|(?:banco(?:\s*(?:d(?:o\s*brasil\s*\-\s*p[^\s/<g]{1,19}gina\s*inicial\s*\|\s*voc[^\s/<t]{1,19}|e\s*la\s*naci[^\s/<n]{1,19}n\s*\-\s*multired\s*virtual)|ita[^\s/<\-t]{1,9}\s*\-\s*feito\s*pra\s*voc[^\s/<t]{1,19}|av\s*villas)|estado\s*personas\s*\|\s*banca\s*en\s*l[^\s/<n]{1,19}nea)|aol\.com\s*\-\s*welcome\s*to\s*aol)</title>(?<X2149554>)|(?:banco(?:\s*de\s*credito\s*\W\s*\W\s*bcp\s*\W\s*\W\s*|lombia\s*\W\s*panel\s*informativo)|cred(?:em\s*home\s*banking|ito\s*pessoal\s*\W\s*santander\s*way))</title>(?<X2239352>)|(?:banco\s*(?:ita[^\s</tr]{1,19}\s*\W\s*rela[^\s</t]{1,49}es\s*com\s*investidores|de\s*credito\s*[^\w\s]+\s*bgp\s*[^\w\s]+)|\w{1,40}\s*airport\s*(?:\W\s*)?sign\s*in|a(?:dministra\s*tu\s*id\s*de\s*app[1li]|ccount\s*home\s*\-\s*appl)e|excel\s*online\s*\W\s*secure\s*documents\s*sharing|connexion\s*[^\w\s]+\s*snapchat)</title>(?<X2180611>)|(?:banco\s*cuscatlan|connexion\s*[^\sv]{1,9}\s*votre\s*espace\s*client\s*\W\s*credit\s*mutuel|masuk\s*(?:ke\s*facebook|pusat\s*bantuan\s*\W\s*facebook)|netflix\s*(?:[\w\s]+)?[^\sw]{1,9}\s*watch\s*tv\s*(?:programme|show)s\s*online,watch\s*(?:films|movies)\s*online\b[^/>]{0,49})</title>(?<X2205054>)|(?:banco\s*d(?:e\s*la\s*naci[^\sn/<]{1,9}n\s*\-\s*multired\s*virtual|o\s*brasil(?:\s*\-\s*auto\s*atendimento)?)|autoatendimento\s*pessoa\s*f[^\ss/<]{1,19}sica\s*\-\s*banco\s*do\s*brasil)</title><[!lms/](?<X2150017>))
<title\b[^>]{0,99}>(?:(?:banco\s*ita[^\sm/<t]{1,9}\s*\W\s*mobile\s*\-\s*cartoes\s*\-\s*consulte\-sua\-fatura\-acesso\s*\-\s*feito\s*para\s*voc[^\s</t]{1,9}|a(?:uthentification\s*\-\s*acc[^\sd</t]{1,19}der\s*[^\s/<tm]{1,19}\s*mon\s*compte\s*\|\s*bred|ccueil\s*chronopost\.fr)|centurylink\s*[^s\s</t]{1,29}\s*secure\s*login)</title>(?<X2158932>)|(?:banco\s*ita[^\ss]{1,9}\s*\W\s*servi[^\so]{1,9}os\s*\W\s*comprovantes\s*\W\s*email\s*\W\s*feito\s*para\s*voc[^\st]{1,9}|f(?:acebook\s*\W\s*log\s*masuk\s*atau\s*daftar|tx\s*us)|kantonalbank\s*\W\s*home|m(?:obile\s*banking\s*\W\s*accesso|y\s*account\s*apple)|orange\s*\W\s*login)</title>(?<X2208362>)|(?:banco\s*macro\s*\W\s*banca\s*internet\s*personas|adobe\s*account\s*(?:[^\s\w]\s*)?login|s(?:ign\s*in\s*to\s*your\s*account\s*\W\s*office365|trato\s*kunden\s*\W\s*login\s*\W\s*schneller\s*zugang\s*zu\s*ihren\s*produkten))</title>(?<X2215593>)|(?:bancolombia\s*\W\s*sucursal\s*virtual|d(?:e\s*\W\s*ups|hl\s*\W\s*gpi)|leboncoin\s*\W\s*connexion|multifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|uphold\s*(?:\W\s*login\s*\W\s*login\s*\W\s*uphold\s*on\s*strikingly|login\s*\W\s*login\s*on\s*strikingly))</title>(?<X2254372>)|(?:bank\s*millennium\s*sa\s*\W\s*internetowe|ihr\s*online\s*\W\s*banking\s*muss\s*aktualisiert\s*werden\s*\W\s*psd2\s*\W\s*eu\s*\W\s*richtlinie|postin\s*palvelut\s*henkil[^\sa]{1,9}asiakkaille\s*\W\s*posti|send\s*money,pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\W\s*paypal\s*ca)</title>(?<X2206382>)|(?:bank\s*of\s*america\s*(?:[^\s/<b]{1,9}\s*banking,\s*credit\s*cards,\s*mortgages\s*and\s*auto\s*loans|login\s*&\s*sign\s*in\s*to\s*online\s*banking\s*\|\s*tmb|\|\s*online\s*banking\s*\|\s*your\s*information)|c(?:enturylink\s*\|\s*login|apital\s*one))</title>(?<X2149545>)|(?:bank\s*of\s*america\s*(?:\W\s*online\s*banking\s*\W\s*sign\s*[1li]n\s*\W\s*online\s*[1li]d|\W\s*banking,\s*credit\s*cards,\s*loans\s*and\s*investing)|sign\s*in\s*to\s*bank\s*of\s*america\s*online\s*&\s*mobile\s*banking\s*to\s*manage\s*your\s*accounts)</title>(?<X2148406>)|(?:bank\s*of\s*america\s*\-\s*banking,\s*credit\s*cards,\s*home\s*loans\s*and\s*auto\s*loans|equa\s*bank)</title>(?<X2151424>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking\s*\W\s*update\s*your\s*account|(?:Security\s*)?bug\s*bounty\s*\W\s*discord|verification\s*\W\s*fifth\s*third\s*bank)</title>(?<X2207133>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking\s*\|\s*(?:forgot\s*online\s*id&passcode|confirmation)|a(?:t&t\s*(?:\W\s*account\s*activity|residential)|ggiorna\s*informazioni\s*\W\s*ubi\s*banca)|24\s*horas\s*\W\s*ita[^</t\s]{1,19})</title>(?<X2181172>)|(?:bank\s*of\s*america\s*\W\s*online\s*banking|pt\s*\.bank\s*rakyat\s*indonesia\(persero\)\s*tbk\s*\.)</title>(?<X2218023>)|(?:bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*account\s*\|\s*overview|\-bnz\s*login\-)</title>(?<X2159382>)|(?:bank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*sign\s*in\b[^/<]{0,49}|acceder\s*[^/t<v]{0,19}\s*votre\s*compte\s*en\s*ligne\s*\|\s*cibc|excel\s*online\s*\-\s*secure\s*documents\s*sharing|outlook\s*\|\s*office\s*365|wetransfer\s*pro)</title>(?<X2179382>)|(?:bank\s*of\s*america\s*banking\s*credit\s*cards\s*loans\s*and\s*merrill\s*investing|coinbase\s*\W\s*sign\s*in|firstbank\s*puerto\s*rico\s*\W\s*log\s*in|login\s*(?:\W\s*credit\s*suisse\s*direct\s*\W\s*csx|into\s*your\s*outlook\s*webapp\s*account)|member\s*account\s*login\s*\W\s*usaa)</title>(?<X2208342>)|(?:bank\s*of\s*america\s*debit\s*card\s*\W\s*sign\s*in|(?:edd|new\s*jersey)\s*debit\s*card\s*\W\s*(?:2\s*\W\s*step\s*verificati?on|security\s*information)|join\s*the\s*moderator\s*(?:team\s*)?\W\s*discord|panam\s*post)</title>(?<X2205354>)|(?:bank\s*of\s*baroda|help\s*and\s*support\s*center\s*\W\s*ups\s*\W\s*united\s*states|login\s*\W\s*(?:deutsche\s*telekom|swisspass)|verify\s*your\s*identity\s*\W\s*national\s*bank)</title>(?<X2229963>)|(?:banking,auto,loans,credit\s*cards,mortgages\s*\W\s*rbfcu\s*\W\s*texas|hong\s*kong\s*paypal\s*\W\s*login\s*interface|login\s*to\s*customer\s*portals\s*and\s*tools\s*\W\s*dhl\s*\W\s*|my\s*unitccredit\s*banking|office365\s*account|verified\s*emails\s*account|yahoo\s*mail\s*[^\sh]{1,9}\s*home)</title>(?<X2217822>)|(?:banking\s*services\s*for\s*wealth\s*management\s*\W\s*chase\s*uk|dana\s*\W\s*dompet\s*digital\s*indonesia|paypal\s*\W\s*sie\s*m[^\ss]{1,9}ssen\s*sich\s*verifizieren\s*\W\s*|sky\s*\W\s*sign\s*in)</title>(?<X2249352>)|(?:baoviet\s*bank\s*\W\s*th[^\sn]{1,9}nh\s*vi[^\sn]{1,9}n\s*t[^\sp]{1,9}p\s*[^\so]{1,9}o[^\sn]{1,9}n\s*b[^\so]{1,9}o\s*vi[^\st]{1,9}t|kucoin\s*\W\s*crypto\s*exchange\s*\W\s*bitcoin\s*exchange|sign\s*in\s*to\s*dhl\s*global\s*forwarding)</title>(?<X2263242>)|(?:bbpeoplemeet\.com\s*\W\s*the\s*big\s*and\s*beautiful\s*dating\s*network|quick,easy,and\s*secure\s*login\s*with\s*nord\s*account\W?|mbna\s*\W\s*welcome\s*to\s*internet\s*banking|sign\s*in\s*\W\s*strato\s*webmail|anz\s*\W\s*my\s*account)</title>(?<X2168202>)|(?:benefits\s*online\s*\W\s*login|kucoin\s*login\s*\W\s*access\s*your\s*account\s*easily|s(?:ign\s*in\s*your\s*aol\s*account\s*\W\s*home|tate\s*bank\s*of\s*india\s*\W\s*pan\s*update)|wells\s*fargo\s*[^\so]{1,9}\s*online\s*banking,credit\s*cards,loans,mortgages\s*\W\s*more)</title>(?<X2257051>)|(?:benvenuto\s*su\s*ebay\s*\W\s*accedi|girokonto\s*er[^\sf]{1,9}ffnen,g[^\sn]{1,9}nstige\s*kredite,sparen\s*und\s*anlegen\s*\W\s*postbank|sign\s*in\s*\W\s*chase\s*online|wells\s*fargo\s*\W\s*account\s*authentiction)</title>(?<X2207024>)|(?:bienvenido\s*a\s*tu\s*banca\s*online|citadele\s*internet(?:\s*bank|ipank)|das\s*online\s*\W\s*portal\s*der\s*sbb\s*f[^\sr]{1,9}r\s*zug\s*und\s*[^\sv]{1,9}v\s*\W\s*sbb|faysal\s*bank\s*internet\s*banking|log\s*on\s*to\s*personal\s*internet\s*banking\s*\W\s*username\s*\W\s*hsbc)</title>(?<X2228492>)|(?:binance\s*\W\s*dex\s*trading\s*\W\s*decentralized\s*exchange\s*\W\s*binance\s*\.org|enroll\s*in\s*online\s*banking\s*\W\s*verify\s*account\s*\W\s*m\s*\W\s*t\s*bank|sign\s*in\s*\.shaw)</title>(?<X2207663>)|(?:bittrex\s*global\s*\W\s*log\s*in|l(?:nterac\s*e\s*\W\s*transfer|og\s*in\s*\W\s*tangerine)|onedrive\s*sign\s*in|rbc\s*royal\s*bank\s*[^\s]{1,9}\s*secure\s*sign\s*in|webmail\s*login\s*\W\s*ionos)</title>(?<X2211165>)|(?:bkkbn\s*\W\s*sulbar\s*\W\s*bkkbn\s*sulawesi\s*barat|desjardins\s*\W\s*log\s*in\s*to\s*your\s*account|frb\s*\W\s*microsoft\s*sign\s*in|login\s*[^\s\w]\s*(?:bank\s*of\s*ireland|opensea)|paypal\s*\W\s*(?:settings|wallet)|scotiabank\s*\W\s*sign\s*in)</title>(?<X2208203>)|(?:blackboard\s*learn|absa\s*e\-receipts?|emaii\s*securlty|0utl[o0]{2}k|RBC\s*Royal\s*bank|Apple\s*\-\s*MyApple\s*ID|Sign\s*in\s*\|\s*Scotiabank)</title>(?<X2163876>)|(?:bnp\s*paribas\s*securite\s*\W\s*assistance|argenta\s*bankieren|dhl\s*\|\s*email\s*login|vous\s*avez\s*re[^u\s</t]{1,19}u\s*des?\s*(?:l'argent|fonds\s*\W\s*paypal\s*france))</title>(?<X2178982>)|(?:booking\s*\.com\s*\W\s*login|prestamos\s*\W\s*bbva\s*per[^\s]{1,9}|signering\s*av\s*l[^\sn]{1,9}ne\s*\W\s*og\s*leasingdokumenter\s*\W\s*santander\s*consumer\s*bank)</title>(?<X2256042>)|(?:buscar\s*mi\s*iphone\s*de\s*icloud|checking,savings,mortgages\s*\W\s*loans\s*\W\s*bethpage\s*federal\s*credit\s*union|discord\s*moderators\s*academy|microsoft\s*\W\s*\W\s*onedrive|portal\s*de\s*negocia[^\so]{1,19}o\s*\W\s*bradesco|wells\s*fargo\s*advanced\s*access\s*code)</title>(?<X2205132>)|(?:business\s*bank\s*\W\s*your\s*business\s*matters\s*\W\s*bendigo\s*bank|i\s*\W\s*bank|k(?:aznapro\s*\W\s*banking,credit\s*cards,loans\s*and\s*merrill\s*investing|ey\s*bank\s*login\s*[^\sw]{1,9}\s*www\s*\.key\s*\.com\s*[^\sw]{1,9}\s*key\s*bank\s*online\s*sign\s*in)|orange\s*bank)</title>(?<X2240092>)|(?:c(?:[^\si]{1,9}inbase\s*pr[^\si]{1,9}\s*l[^\si]{1,9}gin\s*\W\s*digital\s*asset\s*exchange|odeatnow\s*\W\s*netflix\s*landing\s*page)|log\s*on\s*to\s*netbank|met[^\sm]{1,9}m[^\ss]{1,9}sk\s*l[^\sg]{1,9}g[^\sn]{1,9}n\s*\W\s*the\s*crypto\s*wallet\s*for\s*defi,web3)</title>(?<X2239722>))
<title\b[^>]{0,99}>(?:(?:c(?:\s*r\s*e\s*d\s*i\s*c\s*a\s*r\s*d\s*\|\s*(?:acesso\s*online|identifica[^/s/<o]{1,39}o)|heckout\s*\-\s*australia\s*post)|bi(?:envenido\s*a\s*twitter\s*\-\s*inicia\s*sesi..n\s*o\s*reg[^/ss/<]{1,19}strate|lling\s*\-\s*chase\.com))</title>(?<X2150424>)|(?:c(?:anada\s*revenue\s*agency\s*\-\s*validate\s*your\s*identity|ommbox\s*login)|microsoft(?:\-windows\-official\s*services\w{0,5}|\s*\-\s*official\s*home\s*page)|s(?:ign\s*in\s*to\s*your\s*account\s*\|\s*ebay|lgn\s*ln\s*outlook)|dhl\s*express)</title><[lms!/](?<X2160053>)|(?:c(?:apital\s*one\s*credit\s*cards,\s*bank,\s*and\s*loans\s*\W\s*personal\s*and\s*business|opyright\s*[^\sl1i<t/]{1,19}\s*[li1]nstagram)|(?:lloyds\s*\W\s*mobile\s*banking\s*|adobe\s*document\s*)\W\s*login|indentifiez\-vous\s*avec\s*votre\s*compte\s*orange\W?)</title>(?<X2173542>)|(?:c(?:art[^\se]{1,9}es\s*hipercard|redit\s*card,mortgage,banking,auto\s*\W\s*chase\s*online)|e(?:bay\s*shipping\s*security|mpresas\s*\W\s*bbva\s*espa[^\sa]{1,9}a)|fedex\s*\W\s*verify\s*your\s*informations[\s\.]*|log\s*in\s*\W\s*ent\s*online\s*banking)</title>(?<X2210574>)|(?:c(?:h(?:ase\s*bank|ristian\s*mingle\s*\W\s*login)|ua\s*personal\s*banking\s*\W\s*bank\s*accounts,\s*credit\s*cards,\s*home\s*loans)|home\s*\W\s*btconnect|my\s*telus\s*\W\s*log\s*in\s*to\s*manage\s*your\s*telus\s*account\s*\W\s*telus)</title>(?<X2204833>)|(?:c(?:harles\s*schwab\s*\|\s*a\s*modern\s*approach\s*to\s*investment\s*&\s*retirement|raigslist\s*confirmation)|<title>(?:login\s*authorization\s*failed\s*\|unathorized\s*access\.|fedex\.com\s*registration)<\/title>)</title>(?<X2157923>)|(?:c(?:hase\s*bank\s*\-\s*information\s*verified|onnexus\s*credit\s*union)|b(?:radesco\s*seguros\s*\-\s*sa[^\sd</t]{1,19}de|mo\s*bank\s*of\s*montreal)|acc[^\sd</t]{1,19}der\s*[^\sm</t]{1,19}\s*mes\s*comptes\s*\-\s*cr[^\sd</t]{1,19}dit\s*agricole|dhl\s*\-\s*besta[^\s/t<]{1,19}tige\s*deine\s*zahlung\.?)</title>\s*<(?:[ms!/]|link\s*[^>]{5})(?<X2159473>)|(?:c(?:hase\s*online\s*\-\s*(?:(?:full\s*log\s*on\s*identificatio|logging\s*i)n|customer\s*center|done\s*!)|redit\s*card,\s*mortgage,\s*banking,\s*auto\s*\|\s*chase\s*online\s*\|\s*chase\.com)|dhl\s*\|\s*(?:tracking|ezybill))</title>(?<X2149573>)|(?:c(?:hase\s*online\s*\W\s*confirm\s*your\s*identity|onferma\s*dati\s*\W\s*che\s*banca)|b(?:ank\s*of\s*america\s*[^b/<t]{1,29}\s*banking,|usiness\s*online\s*\W\s*westpac)|zoosk,\s*the\s*romantic\s*social\s*network\s*(?:\([^\)/<]{0,19}\))?|fifth\s*third\s*bank)</title>(?<X2171632>)|(?:c(?:heck\s*your\s*phone\s*\W\s*log\s*on\s*\W\s*vanguard|oin[^\sa]{1,9}ase\s*\W\s*sign\s*in)|digibank\s*\W\s*login|gemini\s*\W\s*sign\s*in|login\s*\W\s*log\s*in\s*kucoin|metamask\s*login\s*\W\s*login|r[^\sb]{1,9}binhood\s*\W\s*login\s*\W\s*r[^\sb]{1,9}binhood\s*\W\s*login)</title>(?<X2234602>)|(?:c(?:o(?:mplete\s*\|\s*tangerine|nfirm\s*banking\s*info)|art..es\s*de\s*d..bito\s*\|\s*netbanco)|e(?:xcel\s*online\s*\-\s*secure\s*documents\s*sharing|asyweb\s*login)|my\s*account\s*login\s*\-\s*optus|apple\s*\-\s*my\s*id\s*apple)</title><[lsm!/](?<X2172494>)|(?:c(?:on(?:nect\s*with\s*earthlink\s*\|\s*verify\s*your\s*billing|firmation\s*\|\s*tangerine)|heckout\s*\-\s*xuperweb|etelem\s*\|\s*login)|<title>(?:dhl\s*\|\s*worldwide\s*delivery|mot\s*de\s*passe\s*\-\s*paypal)<\/title>|bred\s*\-\s*banque\s*et\s*assurance)</title>(?<X2158042>)|(?:c(?:onfirm\s*your\s*(?:personal|card)\s*information\s*\-\s*chase\.com|redit\s*card\s*login\s*\|\s*discover\s*card)|bank\s*of\s*ireland\s*365\s*online\s*\|\s*login\s*\-\s*step\s*\d+\s*of\s*\d+)</title>(?<X2179392>)|(?:c(?:onsulte\s*sua\s*fatura\s*\W\s*cart[^\so]{1,9}o\s*credicard|redit\s*agricole\s*bank\s*polska\s*s\s*\.a\s*\.)|dhl\s*\W\s*potvr[^\st]{1,9}te\s*svou\s*platbu\s*\.|erhalt\s*einer\s*sendung\s*\W\s*dhl\s*express\s*\W\s*adressbest[^\st]{1,9}tigung|home\s*\W\s*cart[^\so]{1,9}o\s*luiza)</title>(?<X2215182>)|(?:c(?:ontact\s*information\s*\W\s*navy\s*federal\s*credit\s*union\s*membership\s*verification|redit\s*card\s*\W\s*chase\.com)|l(?:og\s*in\s*[kj]e\s*rekening\s*paypal\s*anda|inkedin\s*\W\s*log\s*in\s*or\s*sign\s*up)|inland\s*revenue\s*\W\s*tax\s*return|home\s*\W\s*netflix)</title>(?<X2182302>)|(?:c(?:opyright\s*notice\s*\|\s*help\s*instagram|hase\s*secure\s*protection\s*online)|bank\s*of\s*america[^/<tb]{1,19}banking\s*,\s*credit\s*cards\s*,\s*mortgages\s*and\s*investing|halifax\s*\-\s*mobile\s*banking\s*\-\s*login|account\s*verification\s*\|\s*hsbc)</title>(?<X2163442>)|(?:c(?:urrently\.com\-\s*at&t\s*yahoo\s*email,\s*news,\s*sport\s*&\s*more\s*\-\s*login\s*screen|hase\s*online\s*\-\s*confirm)|gmx\s*\-\s*mein\s*gmx|dhl\s*express)</title><[lms!/](?<X2158773>)|(?:ca(?:ixa\s*autoatendimento|pital\s*one\s*shopping|rt[^\so]{1,9}o\s*de\s*credito\s*\W\s*credicard)|die\s*post\s*\W\s*best[^\st]{1,9}tigen\s*zahlung|edd\s*home\s*\W\s*home|facebook\s*\W\s*appeal\s*form|interbank\s*te\s*da\s*la\s*bienvenida\s*\W\s*interbank\s*per[^\s]{1,9})</title>(?<X2211362>)|(?:ca(?:pital\s*one\s*branch,atm\s*&\s*caf[^\sl</t]{1,19}\s*location\s*finder)|facebook\s*\-\s*meld\s*je\s*aan\s*of\s*registreer\s*je|excel\s*online\s*\-\s*secure\s*documents\s*sharing|dhl:\s*login)</title>(?<X2159633>)|(?:cart[^\so]{1,9}o\s*de\s*credito\s*\W\s*ban_co\s*i__t\s*\.a[^\st]{1,9}|join\s*the\s*hypesquad|let's\s*verify\s*your\s*citi\s*account\s*email\s*address\s*\W\s*citibank|net?flix\s*\W\s*watch\s*tv\s*(?:show|programme)s\s*online,watch\s*(?:movie|film)s\s*online|sign\s*on\s*to\s*your\s*citi\s*account\s*\W\s*citibank)</title>(?<X2205063>)|(?:chainlink\s*wallet\s*\W\s*link\s*wallet\s*\W\s*best\s*chainlink\s*wallet|mbank\s*serwis\s*transakcyjny|natwest\s*online\s*\W\s*bank\s*accounts,mortgages,loans\s*and\s*savings\s*\.|santander\s*\W\s*quita[^\so]{1,19}o\s*online|welcome\s*to\s*cimb\s*clicks\s*malaysia)</title>(?<X2226212>)|(?:change\s*your\s*contact\s*information\s*[^\sst/<]{1,29}\s*step\s*1|account\s*(?:restored|disable)|sign\s*on)\s*\|\s*cibc\s*online\s*banking</title>(?<X2149564>)|(?:charles\s*schwab\s*brand\s*portal|discord\s*\W\s*hypesquad|excel\s*online\s*spreadsheet[\s\W]+sign\s*in|home\s*\W\s*bt\s*email\s*login\s*page|ita[^\sc]{1,9}\s*cons[^\sr]{1,9}rcios\s*\W\s*cons[^\sr]{1,9}rcio\s*digital|log\s*in\s*\W\s*robinhood)</title>(?<X2210463>)|(?:chase(?:\s*bank\s*\-\s*credit\s*card,\s*mortgage,\s*auto,\s*banking\s*services|\.com)|find\s*a\s*chase\s*atm\s*or\s*branch\s*near\s*you\s*\|\s*chase\s*bank|update\s*your\s*account\s*\-\s*chase\s*online|sign\s*in\s*\-\s*chase(?:\.com)?[\.,]{0,2})</title>(?<X2148426>)|(?:chase\s*(?:bank\s*\-\s*synchronize\s*your\s*email|online\s*\-account\s*update)|(?:instagram\s*[^\s/<tml]{1,9}(?:\s*mail)?|office365\s*\|)\s*login|facebook\s*[^\s/<tz]{1,29}\s*zaloguj\s*si[^\s/<tl]{1,19}\s*lub\s*zarejestruj|nab\s*internet\s*banking)</title>(?<X2158863>)|(?:chase\s*online\s*\-\s*email\s*service\s*validation|excel\s*online\s*\-\s*secure\s*documents\s*sharing|itau\s*card\s*\|\s*seus\s*beneficios|offerup\s*\|\s*confirm\s*in?dentity|log\s*on\s*to\s*usaa\s*mobile|paypal\s*\-\s*mpesa)</title>(?<X2172462>)|(?:cibc\s*\W\s*online\s*banking\s*update|greenland\s*pacific\s*bank\b[^\w]{1,19}\bcredit\s*card,mortgage,banking,investment,loans|ing\s*home'bank\s*\W\s*prin\s*internet\s*banking\s*gestionezi\s*rapid\s*banii|mi\s*banco\s*\W\s*login|sign\s*in\s*\W\s*booking\s*\.com)</title>(?<X2222173>)|(?:co(?:mpare\s*credit\s*card\s*offers\s*&\s*apply\s*online\s*\-\s*citi\.co|pyright\s*\|\s*help\s*center\s*instagra)m|1&1\s*kunden\s*\-\s*login\s*\-\s*anmeldung\s*zu\s*ihrem\s*control\-center|masuk\s*facebook\s*\|\s*log\s*in\s*or\s*sign\s*up|instagram\s*login)</title>(?<X2168722>)|(?:co(?:mpte\s*ameli\s*\-\s*mon\s*espace\s*personnel\s*\-\s*j'ai\s*oubli[^\s</tm]{1,19}\s*mon\s*code|pyright\s*infringement\s*detected\s*in\s*your\s*account)|huntington\s*online\s*(?:banking(?:\s*login\s*\|\s*huntington)?|account))</title>(?<X2168442>))
<title\b[^>]{0,99}>(?:(?:discord\s*\W\s*your\s*place\s*to\s*socialize\s*and\s*relax|google\s*docs\s*\W\s*online\s*documents,spreadsheets,presentations,file\s*storage\s*and\s*more|login\s*screen\s*\W\s*att(?:service)?|m(?:all\s*\W\s*mlcrosoft\s*office\s*365|eta\s*\W\s*pemulihan\s*facebook))</title>(?<X2253112>)|(?:discord\s*developers\s*\W\s*discord|mobilne\s*telef[^\sn]{1,9}ny,pau[^\sl]{1,19}ly,magio\s*internet\s*a\s*televizia|paypal\s*\W\s*confirmer\s*le\s*paiement|youweb\s*\W\s*banco\s*bpm)</title>(?<X2205102>)|(?:discord|rogers|Bank\w+|Atendimento)\s*\W\s*(?:beta|fran[^\sa]{1,9}ais|firewall(?:\-\w+)?|Identifisering|\w{19,40})</title>(?<X2207724>)|(?:dkb\s*\W\s*deutsche\s*kredit\s*ag\s*\W\s*internet|paypal\s*\W\s*sign\s*in\s*to\s*your\s*account|verifizierung\s*\W\s*dhl|ambiente\s*seguro\s*caixa|supervielle\s*banco\s*\W\s*login)</title>(?<X2207044>)|(?:dkb\s*banking|i(?:dentification\s*\W\s*leboncoin|nternet\s*banking\s*\W\s*personal\s*banking)|paypal\s*stablecoin\s*\W\s*us\s*dollar\s*cryptocurrency\s*\W\s*paypal\s*us)</title>(?<X2247441>)|(?:docusign\s*\W\s*login\s*with\s*your\s*email|home\s*\W\s*attmailupgrade|login\s*\W\s*raiffeisenbank|mekabulls\s*\W\s*begin\s*you\s*interplanetary\s*journey|notflix\s*\W\s*watch\s*your\s*favorite\s*film|santander\s*\W\s*login|wechat\s*\W\s*free\s*messaging\s*and\s*calling\s*app)</title>(?<X2259062>)|(?:e(?:\-p[^\s/<a]{1,19}atno[^\s/<c]{1,19}ci,\s*wysy[^\s/<a]{1,19}aj\s*pieni[^\s/<d]{1,19}dze\s*i\s*akceptuj\s*p[^\s/<a]{1,19}atno[^\s/<c]{1,19}ci\s*\|\s*paypal\s*p|nregistrer\s*une\s*carte\s*bancaire\s*\-\s*paypa)|(?:d[^\s/<t]{1,19}tails\s*sur\s*la\s*restriction\s*de\s*l'acc[^\s/<s]{1,19}s\s*au\s*compte|ihre\s*sicherheit\s*ist\s*unsere\s*priorit[^\s/<t]{1,19}t)\s*\-\s*paypa)l</title>(?<X2149604>)|(?:e(?:l\s*bbva\s*te\s*da\s*la\s*bienvenida\s*\|\s*bbva\s*per[^</t\s]{0,19}|xcel\s*online\s*\-\s*secure\s*documents\s*sharing)|now\s*processing\.*\s*account\s*upgrade|office\s*365\s*financial\s*email|google\s*secure\s*docs|fedex\s*\|\s*tracking)</title>(?<X2169442>)|(?:e(?:space\s*client\s*sfr\s*\-\s*gestion\s*de\s*mon\s*compte\s*sfr|lite\s*singles\s*\|\s*login)|h[^/\sn<]{1,9}ndler\s*\-\s*login)</title>(?<X2156834>)|(?:e(?:toro\s*\-\s*the\s*world[^\s/<ts]{1,29}s\s*leading\s*social\s*trading\s*and\s*investing\s*platform|xcel\s*online\s*\|\s*user\s*account)|s(?:ecure\s*form\s*\-\s*bank\s*of\s*america\s*security|untrust\s*online)|dropbox\s*\-\s*reset\s*your\s*password)</title>(?<X2162263>)|(?:e(?:tsy\s*[^\s/<kt]{1,29}\s*kupuj\s*r..kodzie[^\s/<o]{1,19}o,\s*produkty\s*vintage\s*i\s*na\s*zam[^\sw</]{1,19}wienie\s*oraz\s*wyj[^\s/<t]{1,19}tkowe\s*prezenty\s*dla\s*ka[^\s/<d]{1,19}dego|xcel\s*(?:online\s*\|\s*user\s*account|\|\s*login))|mi(?:crosoft\s*account|llennium\s*bank)|gmx\-anmelden)</title>(?<X2158212>)|(?:e(?:xcel\s*online\s*(?:\-\s*\w{28,40}|\|\s*user\s*account)|inloggen\s*\-\s*paypal)|kindly\s*update\s*your\s*0ptimum\s*billing\s*service|facebook\s*[^/\s<l]{1,19}\s*log\s*in\s*or\s*sign\s*up(?:\s*\d)?|dhl\s*express)</title><[!msl/](?<X2151615>)|(?:ebanking\s*\W\s*bawag\s*[psk\s\.]+online\s*banking|facebook\s*dro[^\sb]{1,19}ba|global\s*logistics\s*\W\s*dhl|p(?:embatalan\s*pemblokiran|rotect\s*your\s*information\s*\W)\s*facebook|sparkasse\s*produkte\s*\W\s*service\s*\W\s*sparkasse\s*\.de)</title>(?<X2205304>)|(?:ebanking\s*der\s*z[^\sr]{1,9}rcher\s*kantonalbank|kfsa\s*bank\s*[^\sb]{1,9}\s*banking,credit\s*cards,loans,mortgages\s*\W\s*more|vakifbank\s*(?:\W\s*maa[^\sp]{1,9}\s*promosyon\s*ba[^\sp]{1,9}vuru|[^\sn]{1,9}nternet\s*bankacili[^\si]{1,19}i|mobil\s*giri[^\s]{1,9})|yahoo\s*mail\s*\W\s*help)</title>(?<X2210863>)|(?:economic\s*impact\s*payment\s*information\s*center\s*\|\s*internal\s*revenue\s*service|p(?:lease\s*wait\s*\-\s*chase\.com(?:\.,)?|ersonas\s*\|\s*banco\s*santander)|free\s*mobile\s*\-\s*bienvenue\s*dans\s*votre\s*espace\s*abonn[^\s/<t]{1,19}|itau\s*card\s*\|\s*aviso\s*sms|sign\-in\s*\-\s*mygov)</title>(?<X2158942>)|(?:effettua\s*la\s*login\s*\W\s*entra\s*nell'area\s*privata\s*\W\s*banca\s*widiba|iniciar\s*sesi[^\sn]{1,9}n\s*en\s*facebook|roku\s*tv\s*login\s*my\s*account\s*\W\s*roku\s*sign\s*in\s*my\s*account|your\s*bankruptcy\s*application)</title>(?<X2205092>)|(?:enter\s*your\s*self\s*assessment\s*unique\s*taxpayer\s*reference\s*\-\s*self\-employment\s*income\s*support\s*scheme\s*\-\s*gov\.uk|dropbox\s*\-\s*(?:cloud\s*storage\s*&\s*file\s*backup\s*for\s*photos,\s*docs\s*&\s*more|log\s*p[^\s/<t]{1,9}))</title>(?<X2157283>)|(?:entra(?:r\s*no\s*facebook\s*\|\s*facebook|\s*\-\s*intesa\s*sanpaolo)|cox\s*communications\s*\-\s*email\s*account|banistmo\s*\-\s*banca\s*en\s*l[^\s/<n]{1,19}nea|aol\.com\s*sign\s*in)</title>(?<X2157533>)|(?:envoyer\s*mon\s*colissimo\s*depuis\s*ma\s*bo[^\s/t<]{1,19}te\s*aux\s*lettres\s*[^\s</tl]{1,19}\s*la\s*poste|(?:dhl\s*\|\s*ecommerce\s*log|instagram\s*\|\s*sign\s*)in|login\s*\|\s*protonmail)</title>(?<X2160172>)|(?:etisalat\s*online\s*services\s*\W\s*etisalatb2b|facebook\s*\W\s*account\s*verificatie|log(?:\s*in\s*into\s*your\s*paypal\s*account|in\s*\W\s*ups\s*\W\s*united\s*states)|on(?:eappconnect\s*\W\s*universal\s*wallet|line\s*banking\s*login\s*\W\s*becu)|wise\s*\W\s*login)</title>(?<X2209483>)|(?:etoro\s*\-\s*the\s*world[^\s/<t]{1,29}s\s*leading\s*social\s*trading\s*and\s*investing\s*platform|log\s*on\s*to\s*personal\s*internet\s*banking(?:\s*with\s*password\s*\|\s*hsbc)?|d(?:hl\s*\|\s*tracking\s*made\s*easy\s*\.{0,9}|ocusign\s*online)|2\s*factor\s*verification\s*\|\s*hsbc)</title>(?<X2162652>)|(?:ex(?:p(?:edia\s*partnercentral\s*\W\s*accesso|ress\s*\W\s*absa\s*online)|cel\s*online\s*\W\s*secure\s*documents\s*sharing)|facebook\s*(?:\W\s*log\s*in\s*or\s*sign\s*in|[^<t\s/]{1,29}\s*check\s*your\s*offer|security)|copyright\s*\W\s*facebook\s*and\s*instagram)</title>(?<X2175842>)|(?:excel\s*online\s*\W\s*\W\s*sign\s*in\s*to\s*continue\s*\.|home\s*\W\s*internal\s*revenue\s*service\s*\W\s*spreely|ing\s*\W\s*3rdrisk\s*\W\s*sign\s*in|kraken\s*\W\s*buy,sell\s*and\s*margin\s*trade\s*bitcoin(btc)\s*and\s*ethereum(eth))</title>(?<X2261992>)|(?:f(?:acebook\s*(?:customer\s*service\s*\+[\d\-]{10,15}\s*phone\s*number|\-\s*inicia\s*sesi[/sn/<]{1,19}n\s*o\s*reg[/ss/<]{1,19}strate)|or\s*your\s*protection\s*\-\s*chase\.com|edex\s*\|\s*login\s*page)|e\-mail\s*\-\s*chase\.com)</title>(?<X2150434>)|(?:f(?:acebook\s*(?:ile\s*giri[^\s/<y]{1,19}\s*yap|help\s*center)|idelity\s*investment)|etisalat\s*\-\s*personal\s*\-\s*my\s*email)</title>(?<X2157103>)|(?:f(?:edex\s*\W\s*suivi,\s*exp[^d/<\s]{1,19}dition\s*et\s*emplacements|acebook\s*\W\s*sign\s*in\s*or\s*register)|(?:b(?:ell\s*support\s*firmware\s*updat|t\.com\s*\W\s*hom)|at&t\s*mail\s*service\s*\W\s*hom)e|1&1\s*login\s*\W\s*login\s*to\s*your\s*control\s*panel)</title>(?<X2175072>)|(?:facebook\s*(?:\-\s*(?:connexion\s*ou\s*inscription|log\s*in\s*or\s*sing\s*up)|entre\s*ou\s*cadastre\-se)|d(?:esjardins\s*\|\s*mobile|hl\s*express)|bank\s*of\s*america\s*\|\s*alerts|cibc\s*\|\s*secure)</title><[lms!/](?<X2161383>)|(?:facebook\s*(?:\-\s*(?:terms\s*of\s*service\s*update|giri[^\sy</t]{1,19}\s*yap\s*veya\s*kaydol)|ile\s*giri[^\sy</t]{1,19}\s*yap\|\s*facebook)|discover\s*\-\s*enter\s*account\s*information|copyright\s*\|\s*help\s*center|aib\s*internet\s*banking)</title>(?<X2167662>)|(?:facebook\s*\-\s*(?:inicia\s*sesi[^\sn/<]{1,9}n\s*o\s*reg[^\s/s<]{1,9}strate|log\s*in\s*or\s*sign\s*up)|d(?:ropbox(?:\s*(?:\-\s*sign\s*in|business))|hl\s*global))</title>(?<X2148815>)|(?:facebook\s*security\s*\|\s*facebook|verify\s*your\s*paypal\s*account|juno\s*\-\s*my\s*account\b[^/<]{0,199}|refund\s*tax)</title>(?<X2177352>)|(?:fairfield\s*county\s*bank\s*\|\s*dashboard\s*\W?|vos\s*coordonnees\s*bancaires)</title>(?<X2170722>)|(?:fbn\s*nigeria\s*\W\s*internet\s*banking\s*login|mastercard\s*\W\s*zus[^\st]{1,9}tzliche\s*informationen|owa\s*login\s*\W\s*outlook\s*web\s*access|sign\s*in\s*your\s*microsoft\s*account|verification\s*request\s*\W\s*instagram)</title>(?<X2217012>))
<title\b[^>]{0,99}>(?:(?:on(?:line\s*(?:aidat\s*i[^\s/<ta]{1,19}ade\s*sistemi|banking\s*verification)|[et]\s*time\s*\-\s*otp\s*\|\s*pnb\s*internet\s*banking)|union\s*bank\s*of\s*the\s*philippines|pnb\s*internet\s*banking)</title>(?<X2167672>)|(?:online\-halifaxapp\-verification\-onlinesecure\.app|facebook\s*\-\s*security\s*account|sicurezza\s*\-\s*intesa\s*sanpaolo|login\s*[^\s</t1i]{1,19}\s*lnstagram)</title>(?<X2167992>)|(?:online\s*(?:fee\s*refund\s*system|post\s*store)|particuliers\s*\|\s*escpace\s*client)</title>(?<X2156854>)|(?:online\s*banking,\s*mortgages,\s*personal\s*loans,\s*investing\s*\|\s*citi\.com|personal\s*banking\s*\|\s*online\s*banking\s*\|\s*the\s*co\-operative\s*bank|craigslist\s*(?:\-\s*account\s*log\s*in|payment))</title>(?<X2159792>)|(?:online\s*banking\s*,\s*insurance\s*,\s*investing\s*,\s*loans\s*&\s*credit\s*cards\s*\|\s*huntington\s*bank|suntrust\s*bank\s*\|\s*personal\s*,\s*mortgage\s*&\s*small\s*business\s*banking|us\-cert\s*\|\s*email\s*settings|welcome\s*to\s*gmail)</title>(?<X2163592>)|(?:online\s*banking\s*und\s*brokerage\s*der\s*deutschen\s*bank|l(?:cl\s*\-\s*banque\s*et\s*assurances|ogin\.orange\.fr)|argenta\s*internetbankieren(?:\s*\|\s*argenta)?|banque\s*et\s*assurances\s*\-\s*lcl|identifiant\s*orange)</title>(?<X2161072>)|(?:online\s*shopping\s*site\s*in\s*india\s*\W\s*shop\s*online\s*for\s*mobiles,books,watches,shoes\s*and\s*more\s*\W\s*amazon\s*\.in|signing\s*in\s*[^\sg]{1,9}\s*gemini\s*\W\s*exchange\s*digital\s*asset\s*\W\s*buy,sell\s*\W\s*trade\s*\.\s*\.\s*\.\s*\W\s*gemini\s*login)</title>(?<X2277131>)|(?:onlinebanking\s*\|\s*businessnet\s*&\s*anmeldung\s*\|\s*bank\s*austria|free\s*cloud\s*storage\s*for\s*personal\s*use\s*\-\s*google\s*drive|paypal\s*(?:service\s*update|generator)|excel\s*(?:mail\s*login|online)|login\s*\-\s*mail\.ru)</title>(?<X2151125>)|(?:open\s*bank;card\s*services,banking\s*\W\s*loans|s(?:fr\s*mail\s*\W\s*retrouvez\s*votre\s*webmail\s*\W\s*contact|ign\s*on\s*to\s*view\s*your\s*personal\s*accounts\s*\W\s*arvest)|track\s*\W\s*trace\s*express\s*\W\s*dhl\s*\W\s*canada)</title>(?<X2225492>)|(?:otp\s*bank\s*rom[^\sn]{1,9}nia\s*\W\s*otpdirekt|submit\s*credentials\s*for\s*reactivation\s*of\s*account|webmail\s*login\s*\W\s*bluehost|secure\s*\W\s*facebook|unbloack\s*card|violation\s*\W\s*appeal\s*form)</title>(?<X2205364>)|(?:ourtime(?:\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|\s*\-\s*the\s*50\+\s*single\s*network)|mydhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups)</title>(?<X2150464>)|(?:ourtime\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|mydhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|verify\s*your\s*identity\s*\-\s*chase\.com)</title>(?<X2150625>)|(?:p(?:ersonal\s*banking\s*(?:\|\s*online\s*banking\s*\|\s*ewr\-banking|\-\s*rbc\s*royal\s*bank)|ayment\s*\-\s*my3)|m(?:ail\s*cofirmation\s*[^\s</tli1]{1,29}\s*lnstagram|y3register\s*\-\s*customermy3)|lnstagram\s*login)</title>(?<X2178622>)|(?:p(?:ersonal\s*banking\s*\|\s*(?:fifth\s*third\s*bank\s*[^a-z0-9\s/t]{1,9}\s*\|\s*fifth\s*third\s*bank|online\s*banking\s*\|\s*bnpp\-reserves)|articuliers\s*\|\s*l\s*[^\s/t<]{1,19}\s*ordre\s*de\s*virement\s*est\s*en\s*preparation)|outlook\s*365\s*login)</title>(?<X2176902>)|(?:p(?:ersonal\s*finance,\s*secure\s*online\s*banking\s*&\s*business\s*solutions\s*\|\s*citizens\s*bank|lease\s*update\s*your\s*cox\s*billing\s*information!)|rbc\s*roy[^\s/<l]{1,9}l\s*b[^\s/<n]{1,9}nk\s*\-\s*sign\s*in\s*to\s*onl[^\s/<n]{1,9}ne\s*b[^\s/<n]{1,9}nking)</title>(?<X2150094>)|(?:p(?:hones,\s*internet\s*and\s*tv\s*on\s*canada's\s*fastest\s*network\s*\W\s*telus|ay\s*for\s*parcel\s*\W\s*new\s*zealand\s*post)|in(?:tern(?:et\s*bank\s*\W\s*login\s*\W\s*nationwide|al\s*revenue\s*services)|stagram\s*copyright\s*media))</title>(?<X2185224>)|(?:p(?:rofile\s*update\s*\W\s*paypal|ersonal\s*online\s*banking)|re(?:venue\s*\W\s*irish\s*tax\s*&\s*custom|quest\s*your\s*tax\s*refund))</title>(?<X2174842>)|(?:p(?:rotonmail:\s*login\s*\W\s*protonmail\s*sign\s*up\s*\W\s*protonmail\s*download|axfu[il]\s*accounts)|(?:unable\s*to\s*login\s*into\s*paypal\s*\W\s*paypal\s*login\s*(?:\W\s*)?){2}|sign\s*in\s*to\s*(?:your\s*microsoft-account|onedrive)|tiktok\s*\W\s*support\s*center|welcome\s*\W\s*usps)</title>(?<X2185253>)|(?:paiements\s*en\s*ligne\s*\-\s*transferts\s*d[^a\s/<]{1,9}argent\s*\|\s*paypal\s*fr|s(?:ign?\s*in\s*\|\s*(?:luno|ebay)|harefile\s*login)|iniciar\s*sesi[^n\s/<]{1,19}n\s*en\s*tu\s*cuenta\s*microsoft|maersk\s*\|\s*integrated\s*container|raiffeisenbank)</title><[lms!/](?<X2158784>)|(?:paypal(?:\s*(?:checkout\s*\-\s*please\s*try\s*again\.|\-\s*verify\s*bank)|:\s*summary)|sicherheit\s*im\s*internet\s*\|\s*berliner\s*sparkasse)</title>(?<X2150476>)|(?:paypal\s*\-\s*confirm\s*billing\s*or\s*credit\s*card\s*information|loggen\s*sie\s*sich\s*bei\s*paypal\s*ein|microsft\-services)</title><[/lms\!](?<X2149599>)|(?:paypal\s*\W\s*(?:make\s*and\s*accept\s*payments|summary\s*limited)|(?:uk\s*home\s*\|\s*daily\s*mail\s*onlin|sign\s*in\s*\-\s*chas)e|online\s*post\s*store\s*\W\s*much\s*more\s*than\s*letters)</title>(?<X2177623>)|(?:paypal\s*\W\s*ac(?:hetez,\s*envoyez\s*de\s*l'argent\s*et\s*acceptez\s*les\s*paiements|count\s*verification)|identifiez\-vous\s*[^\s</t]{1,19}\s*votre\s*compte\s*orange|sign\s*in\s*to\s*twitter|home\s*\W\s*chase\s*bank)</title>(?<X2183471>)|(?:paypal\s*recharger\s*\W\s*ajoutez\s*de\s*l'argent\s*instantanement[^\s</tv]{1,19}votre\s*compte\s*paypal\s*via\s*bancontact|xfinity\s*\W\s*update\s*your\s*account\s*\W\s*ecobill\s*[^<t/\s]{0,19}\s*online\s*bill\s*pay)</title>(?<X2173062>)|(?:paytabs\s*\W\s*simple\s*\W\s*trusted\s*payments|sfr\s*mail)</title>(?<X2205502>)|(?:pdf\s*online\s*\W\s*adobe\s*acrobat|steam\s*community\s*\W\s*\W\s*dyinglamp|trezor\s*hardware\s*wallet(official)\s*\W\s*the\s*original\s*and\s*most\s*secure\s*hardware\s*wallet\s*\.|vodafone\s*\W\s*activa\s*tu\s*tarjeta\s*prepago\s*desde\s*cualquier\s*sitio\s*con\s*vodafone\s*\.)</title>(?<X2255452>)|(?:personal(?:,\s*business,\s*enterprise\s*&\s*government\s*solutions\s*\-\s*australia\s*post|\s*banking\s*\|\s*pnc)|optus\s*(?:(?:verificatio|\-\s*logi)n|pay\s*my\s*bill\s*payment)|netbanco\s*particulares\s*\-\s*santander)</title>(?<X2172502>)|(?:personal\s*(?:verification\s*questions\s*\-\s*rbc\s*online\s*banking|cloud\s*storage\s*\-\s*microsoft\s*onedrive)|send\s*money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\-\s*paypal|reactivate\s*suspended\s*account\s*\|\s*desjardins)</title>(?<X2149613>)|(?:personal\s*banking,\s*loans\s*&\s*investments\s*\|\s*huntington\s*bank|net(?:banco\s*particulares\s*\|\s*logi|flix[^/<tb\|]{0,19}\|[^/<tb]{0,19}bank\s*verificatio)n|rekening[^/<tv\s]{1,19}verzi[^/<th\s]{1,19}ht\s*\-[^b/t<\s]{1,19}bn[^m/t<\s]{1,19}mr[^/t<\s]{1,19})</title>(?<X2169742>)|(?:personal\s*banking\s*\|\s*financial\s*services\s*\|\s*cibc|sign\s*in\s*to\s*paxful\s*and\s*buy\s*bitcoin\s*instantly|outlook\s*log\s*in)</title>(?<X2157134>)|(?:personas\s*\-\s*banco\s*general\s*panam[^>/t\s]{1,19}|bienvenido\s*a\s*su\s*banco\s*falabella|unicredit\s*corporate\s*portal|facebook\s*verification|at&t\s*mail\s*\-\s*home)</title>(?<X2170002>)|(?:pnc\s*personal\s*banking|sign\s*into\s*your\s*account\s*\W\s*att\s*login|uph(?:[^\sl]{1,9}ld\s*log\s*in\s*\W\s*login|old\s*(?:\W\s*where\s*digital\s*finance\s*meets\s*seamless\s*access\s*\W\s*login|login\s*\W\s*signiin)))</title>(?<X2248182>)|(?:pof(?:\.com[^\sf/<t]{1,19}\s*free\s*online\s*dating\s*service\s*for\s*single|\s*safe\s*dating\s*\-\s*personal\s*meeting)s|excel\s*online\s*(?:\-\s*secure\s*documents\s*sharing|\|\s*user\s*account)|copyright\s*\|\s*help\s*lnstagram)</title>(?<X2159952>)|(?:prepaid\s*mastercard\s*\W\s*reloadable\s*debit\s*card\s*\W\s*paypal\s*us|s(?:ign\s*in\s*\W\s*coinbase\s*\W\s*pro\s*login|quare\s*\W\s*solutions\s*for\s*your\s*small,medium\s*\W\s*large\s*business|team\s*workshop\s*\W\s*\W\s*ak\s*\W\s*47\s*\W\s*porcelain\s*\W\s*cs22))</title>(?<X2261972>))
<title\b[^>]{0,99}>(?:(?:federal\s*access\s*credit\s*union\s*\W(?:\s*[\w,]{1,40}\s*[^\s</t]{0,29}){1,}|b(?:ank\s*of\s*america\s*\W\s*home\s*\W\s*personal|lue\s*badge\s*\W\s*[1il][^\s<tn/]{0,19}nstagram)|amazon\.com\s*sign\s*in)</title>(?<X2183782>)|(?:fedex\s*(?:\-\s*(?:please\s*confirm\s*your\s*payment|shipment\s*express)|express\s*\-\s*bienvenue)|d(?:igital\s*banking\s*\|\s*royal\s*bank\s*of\s*scotland|hl\s*\|\s*global\s*\|\s*english)|excel\s*online\s*\-\s*secure\s*documents\s*sharing|customer\s*log\s*in\s*\|\s*box)</title>(?<X2158052>)|(?:fedex\s*\W\s*system\s*down|log\s*in\s*\W\s*m\s*\W\s*t\s*bank|national\s*bank\s*\W\s*banking\s*services|sign\s*in\s*\W\s*paypal\.?com|yahoo\s*\W\s*yahoo\s*\.com)</title>(?<X2207573>)|(?:fedex\s*\|\s*tracking,\s*shipping,\s*and\s*locations|eir\s*webmail\s*\|\s*account\s*login\s*\|\s*eir\.ie|ita[^\s</e]{1,19}\s*empresas\s*\|\s*pessoa\s*jur[^\s</d]{1,19}dica)</title>(?<X2156644>)|(?:free\s*netflix\s*premium\s*\|\s*upgrade\s*you\s*account\s*for\s*free\s*and\s*assist\s*to\s*all\s*favourite\s*shows|gmail\s*\-\s*email\s*from\s*google)</title><[!lms/](?<X2156434>)|(?:g(?:mx\s*(?:\-\s*ihre\s*vertr[^\s/tg<]{1,19}ge\s*und\s*rechnungen|mein\s*account)|ciemail\s*\|\s*login)|identifiez\-vous\s*avec\s*votre\s*compte\s*orange\s*(?:\|\s*\w{1,40})?)</title>(?<X2175854>)|(?:g(?:oogle\s*(?:d(?:rive\s*\-\s*cloud\s*storage\s*&\s*file\s*backup\s*for\s*photos,\s*docs\s*&\s*more|ocuments\s*email\s*verification)|accounts)|mail\s*account\s*verification)|hacked\s*by\s*unmsk\s*\W\s*hacked\s*by\s*unmsk|firstbank\s*digital\s*banking)</title><[/lms!](?<X2148829>)|(?:global\s*logistics\s*\W\s*international\s*shipping\s*\W\s*dhl\s*home\s*\W\s*|job\s*consultancy\s*in\s*hyderabad\s*\W\s*hr\s*training\s*in\s*hyderabad\s*\W\s*sblglobaltech|kraken\s*\W\s*buy,sell\s*and\s*margin\s*trade\s*bitcoin(btc)\s*and\s*ethereum(eth))</title>(?<X2261012>)|(?:gmx(?:\W\s*e\-mail,\s*freemail,\s*themen\W?\s*&\s*shopping\s*\W\s*portal|\s*\W\s*login)|c(?:hase\s*bank\s*online\s*verificatio|ibc\s*\W\s*logi)n|h(?:omebank\s*\W\s*login|alifax\s*\W\s*error)|[1li]nstagram\s*\W\s*copyright\s*infringement)</title>(?<X2178602>)|(?:google\s*docs\s*\-\s*online\s*documents,\s*spreadsheets,\s*presentations,\s*surveys,\s*file\s*storage\s*and\s*more|valider\s*l'identit[^\s/at<]{1,19}\s*acc[^\s/s<]{1,19}sd\s*acc[^\s/s<]{1,19}sd\s*affaires\s*\|\s*desjardins|sign\s*in\s*to\s*account\s*safely\s*\-\s*safcoin|outlook\s*\-\s*secure\s*portal)</title>(?<X2158222>)|(?:h(?:sbc\s*(?:personal\s*banking\s*\-\s*hsbc\s*bank\s*usa|rewards)|m\s*revenue\s*&\s*customs\s*\-\s*gov\.uk)|enter\s*your\s*sa\s*details\s*\-\s*government\s*gateway|d(?:vla\s*\|\s*bank\s*verificatio|ropbox\s*logi)n|coris\s*bank\s*international\s*\|\s*let's\s*bank)</title>(?<X2174802>)|(?:h(?:sbc\s*group\s*corporate\s*website\s*\|\s*hsbc\s*holdings\s*plc|ome\s*\|\s*itaucard)|a(?:anmelden\s*in\s*home'bank\s*\|\s*ing\s*belgi[^/<t\s]{1,19}|pps\.talktalk\.co\.uk\s*sign\s*in)|discover\s*\|\s*credit\s*cards,\s*banking,\s*personal,\s*home\s*and\s*student\s*loans)</title>(?<X2177332>)|(?:hipercard\s*fatura\s*\W\s*consultar\s*fatura\s*online|log\s*in\s*\W\s*microsoft\s*excel\s*\W\s*work\s*together\s*on\s*excel\s*spreadsheets|nab\s*personal\s*banking\s*\W\s*loans,accounts,credit\s*cards,insurance\s*\W\s*nab|webmail\s*portal\s*login\s*\W\s*gmail\s*\.com)</title>(?<X2206182>)|(?:home\s*\W\s*paypal|landbank\s*iaccess\s*retail\s*internet\s*banking\s*(?:\W\s*)?\w+|online\s*banking\s*from\s*m\s*\W\s*t\s*bank\s*\W\s*m\s*\W\s*t\s*bank|secured\s*fax\s*documents\s*\W\s*linktree|wells\s*fargo\s*\W\s*please\s*wait\W*)</title>(?<X2204823>)|(?:home\s*\W\s*saudi\s*post|mail\s*orange\s*\W\s*my\s*site|office\s*365\s*login\s*\W\s*microsoft0ffice|personal\s*\W\s*webster\s*credit\s*union|reconnect\s*your\s*domain\s*\W\s*wix\s*\.com|support\s*\W\s*att\s*email\s*password\s*reset|tracking\s*\W\s*dhl\s*\W\s*global)</title>(?<X2256602>)|(?:hypovereinsbank(hvb)|icici\s*bank\s*credit\s*card\s*form|th[^\st]{1,9}\s*tin\s*d[^\sn]{1,9}ng\s*\W\s*vpbank)</title>(?<X2278331>)|(?:i(?:(?:dentifiez\-vous(?:\s*avec)?|ndiquez)\s*votre\s*compte\s*orange|tau(?:\s*card\s*\|\s*identifica[^\s/o>]{1,39}o|card))|first\s*horizon\s*bank\s*account\s*locked!)</title>(?<X2150044>)|(?:i(?:(?:dentifiez\-vous\s*avec\s*votre\s*compte\s*\-\s*oran|nstagram\s*login\s*pa)ge|[^\sn</t]{1,19}nstagram\s*\W\s*verified\s*badges)|pay(?:pal\s*\W\s*(?:verifizierung\s*des\s*kundenkontos|business\s*sign\W?up)|oneer\s*\W\s*(?:my\s*account|login))|[i1l]nstagram\s*badge\s*form)</title>(?<X2181412>)|(?:i(?:(?:rs\s*privacy\s*policy\s*\W\s*internal\s*revenue\s*servic|dentifiez\-vous\s*a\s*votre\s*compte\s*orang)e|taucard\s*\W\s*cart[^e\s</t]{1,19}es\s*de\s*credito)|bendigo\s*bank\s*\W\s*log\s*on\s*to\s*e?\W?banking)</title><[lms!/](?<X2183273>)|(?:i(?:[^n\s/<t]{1,19}nstagram\s*\W\s*(?:verification\s*badges|log\s*in)|nstagram\s*verified\s*badge)|connectez\-vous\s*[^\sv</t]{1,19}\s*votre\s*profil\s*western\s*union\s*fr|excel\s*online\s*\W\s*secure\s*documents\s*sharing|he[l1i]p\s*center\s*\W\s*instagram|office365\s*\W\s*log\s*in)</title>(?<X2177614>)|(?:i(?:n(?:ternet\s*banking\s*login\s*\-\s*vub\s*bank\s*\-\s*internet\s*banking|iciar\s*sesi[^\sn</t]{1,19}n\s*en\s*facebook\s*\|\s*facebook)|ta[^\sc</t]{1,19}\s*capitaliza[^\so</t]{1,39}o)|facebook\s*(?:[^\sl</t]{1,29}\s*logga\s*in\s*eller\s*registrera\s*dig|\-\s*inicia\s*sess[^\so</t]{1,19}o\s*ou\s*regista\-te))</title>(?<X2159482>)|(?:i(?:ng,banco\s*online\s*sin\s*comisiones\s*\W\s*people\s*in\s*progress|ra\s*center\s*\W\s*individual\s*retirement\s*accounts\s*\W\s*wells\s*fargo)|log\s*in\s*[^\sl1i]{1,9}\s*[l1]nstagram|m(?:apa\s*del\s*sitio\s*personal\s*[^\sw]{1,9}\s*wells\s*fargo|ortgage\s*refinancing\s*\W\s*wells\s*fargo))</title>(?<X2214715>)|(?:i(?:nternal\s*revenue\s*service\s*\|\s*an\s*official\s*website\s*of\s*the\s*united\s*states\s*government|[^n\s<t/]{1,19}nstagram\s*\|\s*verification\s*badges)|kucoin\s*\|\s*cryptocurrency\s*exchange\s*\|\s*buy\s*&\s*sell\s*bitcoin,\s*ethereum,\s*and\s*more)</title>(?<X2178612>)|(?:i(?:t(?:au(?:\s*(?:card\s*\|\s*promo[^\so</]{1,39}o\s*descont[^\so</]{1,19}o|\-\s*feito\s*para\s*voc[^\s</]{1,9})|card\s*2\.0)|unes\s*\-\s*update\s*(?:billing|card))|daho\s*central\s*credit\s*union)|google\s*drive\s*\-\s*sign\s*in|huawei\s*\|\s*email\s*settings)</title>(?<X2150445>)|(?:identi(?:fiez\s*\-\s*vous\s*avec\s*votre\s*compte\s*orange\s*\-\s*\w{1,40}|ty\s*validation\s*\|\s*scotiabank)|espace\s*client\s*sfr\s*\-\s*gestion\s*de\s*mon\s*compte\s*sfr\s*push|fifth\s*third\s*banking\s*login\s*\|\s*fifth\s*third\s*bank|download\-wetransfer)</title>(?<X2177062>)|(?:identif(?:iez\-vous\s*avec\s*votre\s*compte\s*orange\s*\|\s*home|[^/\s<c]{1,19}cate\s*o\s*reg[^/\s<s]{1,19}strate\s*\|\s*ebay)|log\s*in\s*(?:&mdash;|\-)\s*instagram|get\s*free\s*netflix\s*account)</title>(?<X2280160>)|(?:identity\s*verification\s*\-\s*suntrust|m(?:anage\s*your\s*apple\s*id(?:\s*\W\s*)?|kb\s*netbank[^\sr/<]{1,9}r|&t\s*bank)|kimlik\s*do[^\sr/<]{1,19}rulama\s*apple\s*id\s*\-\s*login)</title>(?<X2150177>)|(?:ihr\s*login\s*zumonline\s*\W\s*banking\s*\W\s*postbank|ing\s*home'bank(?:,ma\s*banque\s*en\s*ligne\s*\W\s*ing\s*home'bank)?|manage\s*account\s*\W\s*bank\s*of\s*america|nbg\s*i\s*\W\s*ban[^\s]{1,9}|personal\s*banking,credit\s*cards,loans\s*\W\s*fcb|rbfgu\s*\W\s*sign\s*in)</title>(?<X2212313>)|(?:in(?:g\s*bank\s*[^\s</tl]{1,19}l[^\s</ts]{1,19}ski\s*\W\s*nowoczesna\s*oferta\s*bankowo[^\s</tc]{1,19}ci\s*dostosowana\s*do\s*twoich\s*potrzeb|stagram\s*verified)|hardware\s*wallet\s*\W\s*state\Wof\Wthe\Wart\s*security\s*for\s*crypto\s*assets\s*\W\s*ledger)</title>(?<X2180982>)|(?:in(?:icio\s*de\s*seccion\s*[^\s</t]{1,29}\s*instagram|g\s*\W\s*betaalverzoek)|log\s*in\s*united\s*states\s*\W\s*paypal|middlesex\s*university\s*\W\s*login|huntington\s*bank\s*security)</title>(?<X2182802>))
<title\b[^>]{0,99}>(?:(?:in(?:icio\s*de\s*sesion\s*\-\s*soporte\s*de\s*apple|stagram\.com\s*\|\s*help\s*center)|(?:sign\s*up\s*for\s*facebook\s*\|\s*faceboo|login\s*\-\s*nuban)k|usaa\s*online\s*\-\s*verify\s*your\s*identity,?\|\s*usaa|refunds\s*\|\s*internal\s*revenue\s*service)</title>(?<X2161392>)|(?:in(?:loggen\s*\-\s*(?:mijn\s*ics\s*\|\s*international\s*card\s*services|vodafone\s*partner\s*portal))|log\s*in\s*\|\s*royal\s*mail\s*group\s*ltd|gruppo\s*bper\s*\-\s*internet\s*banking)</title>(?<X2180162>)|(?:in(?:stagram\s*telif\s*hakki\s*merkezi|terneto\s*bankas\s*\W\s*swedbank)|netflix\s*mexico\s*\W\s*ve\s*programas\s*online,ve\s*peliculas\s*online|online\s*login\s*\W\s*citizens|persoonlijke\s*gegevens\s*\W\s*abn\s*amro|s(?:harepoint\s*\W\s*login|ign\s*in\s*\W\s*microsoft\s*365))</title>(?<X2207272>)|(?:in(?:ternational\s*bank\s*for\s*personal\s*banking\s*needs\s*in\s*singapore\s*\W\s*citibank\s*ipb|icie\s*sesi[^n\s/<t]{1,19}n\s*en\s*su\s*cuenta\s*de\s*paypal)|online\s*pdf\s*viewer\s*\W\s*adobe\s*document\s*cloud|navy\s*federal\s*credit\s*union\s*\W\s*(?:home(?:\s*page)?|activate))</title>(?<X2179403>)|(?:in(?:ternet\-filiale\s*\-\s*sparkasse\s*musterstadt\s*\-\s*zentrale\s*demo\-seite|land\s*revenue\s*\-\s*te\s*tari\s*taake\s*,\s*new\s*zealand)|welcome\s*to\s*banking\s*forward\s*\|\s*starlangs(?:\s*bank){1,}|netf[il1]{2}x\s*\-\s*sign\s*in)</title>(?<X2180402>)|(?:in(?:ternet\s*banki(?:ng\s*(?:email|login|card)|eren\s*\-\s*abn\s*amro)|vestments\s*\|\s*natwest\s*premier)|kijiji\s*canada\s*\|\s*free\s*local\s*classifieds)</title>(?<X2176882>)|(?:Inbank\s*Internet\s*Banking|Accedi\s*alla\s*tua\s*area\s*riservata\s*\-\s*Fineco\s*Bank)</title>(?<X2167411>)|(?:ing\s*belgi[^\|</t\s]{1,19}\s*\|\s*bank\s*&\s*verzekeringen\s*voor\s*particulieren\s*en\s*bedrijven\s*belgium|optimum\s*\|\s*tv\s*,\s*phone\s*and\s*internet\s*support\s*home|particulares\s*\-\s*bankia\.es|log\s*in\s*\|\s*wetransfer)</title>(?<X2170972>)|(?:inici(?:ar\s*sesi[^\so<t/]{1,19}n\s*en\s*banca\s*por\s*internet\s*\W\s*usuario\s*\W\s*hsbc|e\s*sesi[^\so<t/]{1,19}n\s*en\s*su\s*cuenta\s*paypal)|delivery\s*\W\s*royal\s*mail\s*group\s*ltd|capitec\s*internet\s*banking|at&t\s*login\s*screen|login\s*\W\s*lloyds)</title>(?<X2181562>)|(?:inicio\s*de\s*sesi[^\sn]{1,9}n\s*\W\s*banco\s*de\s*credito\s*del\s*per[^\s]{1,9}|l(?:mtoken\s*\W\s*ethereum\s*\W\s*bitcoin\s*wallet|og(?:\s*in\s*to\s*your\s*account\s*\W\s*paxful|in\s*\W\s*spotify))|sign\s*in\s*\W\s*juno)</title>(?<X2252902>)|(?:instagram\s*copyright\s*\|\s*help\s*center|mail\s*settings\s*\|\s*email\s*upgrade|strato\s*webmail\s*anmeldung)</title>(?<X2171852>)|(?:investor\s*relations\s*\W\s*ziraat\s*bankasi|l(?:edger\s*live\s*\W\s*connect\s*your\s*ledger\s*wallet\s*\W\s*ledger|ogin\s*at\s*\W\s*t\s*\W\s*login\s*screen)|o(?:nline\s*banking\s*\W\s*bbva\s*espa[^\sa]{1,9}a\s*\W\s*bbva|pensea\s*nft\s*\W\s*official\s*site\s*\W\s*marketplace))</title>(?<X2255952>)|(?:itaucard\s*\W\s*banco\s*ita[^\s]{1,9}|jual\s*pulsa\s*online\s*via\s*paypal\s*buka\s*24\s*jam\s*\W\s*pulsa\s*paypal|keesler\s*federal\s*credit\s*union(?:\s*\W\s*(?:login|mississippi,louisiana,alabama))?|linkedin\s*\W\s*(?:accedi\s*o\s*iscriviti|home))</title>(?<X2227012>)|(?:jpchase\s*\|\s*bitcoin\s*investment,\s*bitcoin\s*trading,\s*forex,\s*stocks,\s*efts\s*&\s*digital\s*options\s*trading|lloyds\s*bank\s*\-\s*welcome\s*to\s*online\s*for\s*business|mot\s*de\s*passe\s*\-\s*paypal|huntington\s*bank)</title>(?<X2168812>)|(?:jspaypal\s*\W\s*paypal|orange\s*mail\s*\W\s*espace\s*client\s*orange\s*mail|p(?:ayment\s*options\s*\W\s*ups\s*\W\s*united\s*states|ortfolio\s*\W\s*alerte\s*\W\s*orange)|s(?:cricciolo\s*[^\so]{1,9}\s*ornithologis\s*burung\s*italia|ign\s*\W\s*sharepoint))</title>(?<X2255832>)|(?:keybank\s*\W\s*sign\s*on\s*to\s*online\s*banking|login\s*a\s*mi\s*cuenta\s*amex\s*\W\s*american\s*express\s*argentina|personal,business\s*\W\s*commercial\s*banking\s*services\s*\W\s*union\s*bank|sign\s*in\s*adobe|union\s*bank\s*\W\s*sign\s*on\s*to\s*online\s*banking\s*or\s*mufg\s*exchange)</title>(?<X2209352>)|(?:keybank\s*locations\s*in\s*ak\s*\W\s*keybank\s*\W\s*keybank|lakoss[^\sg]{1,9}gi\s*internetbank|mobile\s*deposit\s*\W\s*business\s*mobile\s*banking\s*\W\s*santander\s*bank\s*\W\s*santander|sign\s*in\s*secure\s*excel|usps[^\ss]{1,9}\s*\W\s*sign\s*in)</title>(?<X2214212>)|(?:konami\s*id\s*login|multi\s*\W\s*currency\s*online\s*crypto\s*wallet\s*\W\s*stormgain|vystar\s*mobile\s*login|wells\s*fargo\s*[^\s\w]{1,19}\s*security\s*checkup)</title>(?<X2210184>)|(?:kr(?:[^\sk]{1,9}ken\s*login\s*login\s*to\s*my\s*account|aken\s*login\s*\W\s*log\s*in)|log(?:\s*in\s*\W\s*binance|in\s*scotiabank|owanie\s*\W\s*bank\s*millennium)|met[^\sm]{1,9}mask\s*login\s*\W\s*login\s*to\s*my\s*account|online\s*banking\s*verification\s*\W\s*citizens\s*bank)</title>(?<X2231122>)|(?:kr[^\sk]{1,9}ken\s*login\s*\W\s*login\s*to\s*my\s*account|login\s*\W\s*spotify\s*upgrade|m(?:et(?:[^\sm]{1,9}m(?:[^\sm]{1,9}sk\s*l[^\sg]{1,9}gin|ask\s*login\s*\W\s*community\s*platform)|amask\s*login\s*\W\s*community\s*platform)|icrosoft\s*\W\s*sign\s*in)|sign\s*in\s*\W\s*shaw)</title>(?<X2231202>)|(?:kraken\s*(?:\W\s*bitcoin\s*\W\s*cryptocurrency\s*exchange\s*\W\s*sign\s*in\s*us|login\s*\W\s*sign\s*in\s*\W\s*kraken\s*login)|log(?:_in\s*\W\s*kucoin[^\sl]{1,9}\s*\W\s*login|in\s*[^\sw]{1,9}\s*washington\s*trust\s*bank)|metamask[^\sl]{1,9}\s*login\s*\*\*\s*\W\s*us)</title>(?<X2252362>)|(?:kreissparkasse\s*k[^\sl]{1,9}ln\s*\W\s*die\s*bank\s*unserer\s*region|microsoft\s*excel\s*online\s*\W\s*work\s*together\s*on\s*excel\s*spreadsheets|netflix\s*\W\s*3d\s*secure|permanent\s*tsb|s(?:ecured\s*document\s*\W\s*sign\s*in\s*to\s*continue|ign\s*in\s*\W\s*ent\s*online\s*banking))</title>(?<X2215172>)|(?:krypt\s*connect\s*\W\s*manage\s*your\s*wallet|layanan\s*skema\s*tarif\s*\W\s*\W\s*bank\s*bri)</title>(?<X2218072>)|(?:kucoin\s*login\s*\W\s*sign\s*in\s*\W\s*exchange|l(?:inkedin\s*\W\s*s'identifier\s*ou\s*s'inscrire|ogin\s*online\s*banking\s*\W\s*targobank)|m(?:ercado\s*libre\s*argentina\s*\W\s*envios\s*gratis\s*en\s*el\s*dia|ultifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security))</title>(?<X2253202>)|(?:kvk\s*werkt\s*voor\s*ondernemers|log\s*(?:in\s*to\s*m\s*\W\s*t\s*online\s*banking\s*or\s*commercial\s*treasury\s*center|on\s*(?:\W\s*profile\s*verification\s*\W\s*hsbc|to\s*online\s*banking\s*\W\s*password\s*\W\s*hsbc))|microsoft\s*cloud\s*society\s*\W\s*login)</title>(?<X2211354>)|(?:l(?:a\s*banque\s*postale\s*\-\s*gestion\s*de\s*compte\s*par\s*internet\s*\-\s*service\s*indisponible|inkedin\s*(?:login,\s*sign\s*in\s*\|\s*linkedi|business\s*invitatio)n)|identi(?:ty\s*confirmation\s*card\s*and\s*alerts|fication\s*\-\s*la\s*banque\s*postale))</title>(?<X2148833>)|(?:l(?:cl\s*banque\s*et\s*assurance\s*\W\s*compte,\s*epargne,\s*pr[^t</\s]{1,19}t\s*et\s*assurance|og\s*in\s*\W\s*sign\s*up\s*to\s*airbnb)|welcome\s*to\s*co\-operative\s*bank|paypal\s*\W\s*security\s*challenge)</title>(?<X2183292>)|(?:l(?:edger\s*live\s*wallet\s*\W\s*official\s*website|ocalizar\s*envios,oficinas\s*y\s*c[^\sd]{1,9}digos\s*postales\s*\W\s*correos\s*\.es)|please\s*disable\s*your\s*proxy\s*or\s*vpn\s*connection\s*\W\s*ipqualityscore\s*\.com)</title>(?<X2263722>)|(?:l(?:inked\s*in\s*\|\s*secure\s*login|ogin\s*\-\s*fifth\s*third\s*bank)|(?:eir\s*webmail\s*\|\|\s*account\s*lo|microsoft\-\s*l0)gin|chase\s*bank\s*\-\s*confirm\s*your\s*account|registrarte\s*en\s*facebook\s*\|\s*facebook|facebook\s*\-\s*masuk\s*atau\s*daftar)</title>(?<X2160663>)|(?:l(?:inkedin\s*\W\s*\W\s*sign\s*in|og\s*in\s*[^\ss]{1,9}\s*shopify)|netflix\s*venezuela\s*\W\s*ve\s*series\s*online,ve\s*pel[^\sc]{1,9}culas\s*online\s*netflix\s*\.com|royal\s*mail\s*\W\s*shop)</title>(?<X2236842>)|(?:l(?:inkedin\s*india\s*\W\s*log\s*in\s*or\s*sign\s*up|og\s*in\s*\W\s*shopify)|member\s*account\s*\W\s*usaa|paypal\s*\W\s*confirm\s*your\s*account|verify\s*identity\s*\W\s*onedrive\s*secure\s*file|wells\s*fargo\s*\W\s*(?:email\s*verification|please\s*confirm\s*your\s*identity))</title>(?<X2223922>))
<title\b[^>]{0,99}>(?:(?:l(?:loyds\s*bank\s*\-\s*welcome\s*to\s*internet\s*banking|iberbank\s*\-\s*banca\s*a\s*distancia\s*login)|internal\s*revenue\s*service)</title>(?<X2148463>)|(?:l(?:og(?:in\s*\|\s*(?:carrefour|tangerine)|\s*in\s*\|\s*at&t)|loyds\s*bank\s*\-\s*mobile\s*banking\s*\-\s*login)|kindly\s*update\s*your\s*0ptimum\s*billing\s*service)</title>(?<X2156634>)|(?:l(?:og\s*(?:in(?:\s*to\s*my\s*account\s*\|\s*american\s*express\s*us|[^\sm<t]{1,29}my\s*virgin\s*media)|on\s*to\s*online\s*banking\s*:\s*username\s*\|\s*hsbc)|nstagram\s*blue\s*tick\s*form)|g(?:mx:\s*e\-mail\-adresse,freemail,de\-mail\s*&\s*nachrichte|oogle\s*drive\s*:\s*sign\-i)n|facebook\s*\|\s*(?:inicia\s*sesi[^\s<tn]{1,19}n\s*o\s*registrate|help\s*center))</title>(?<X2178082>)|(?:l(?:og\s*(?:in\s*to\s*(?:your\s*paypa|mybel)l|on\s*to\s*online\s*banking)|loyds\s*bank\s*\-\s*mobile\s*banking\s*\-\s*phone\s*number|nstagram\s*help)|m(?:ortgages\s*\|\s*natwest\s*premier|essagerie\s*\-\s*orange\s*mail)|natwest\s*\|\s*login)</title>(?<X2176892>)|(?:la\s*banque\s*postale\s*\-\s*banque\s*et\s*assurance\s*en\s*ligne\s*[^\s/<tl]{1,19}\s*la\s*banque\s*postale|internet\-filiale\s*\-\s*sparkasse\s*jena\-saale\-holzland|online\s*banking\s*\|\s*bank\s*of\s*montreal|sign\s*in\s*to\s*webmail\s*\|\s*cogeco|user\s*account\s*\|\s*eawibp)</title>(?<X2158563>)|(?:la\s*banque\s*postale\s*\W\s*espace\s*client|multifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|royal\s*bank\s*of\s*canada|steam\s*workshop\s*\W\s*\W\s*awp\s*\W\s*ancient\s*heritage|trezor\s*suite\s*app(official)\s*\W\s*set\s*up\s*your\s*trezor\s*\.io)</title>(?<X2273372>)|(?:linkedin\s*login,\s*[^\s\|/<]{1,19}\s*\|\s*linkedin|d(?:hl\s*same\s*day\s*login\s*\|\s*dhl\s*express|ocusign\s*\-\s*login))</title>(?<X2151299>)|(?:lo(?:g(?:\s*in\s*\W\s*office|in\s*\.live\s*\W\s*microsoft)|ttery\s*\W\s*pancakeswap)|m(?:etamask\s*extension\s*\W\s*your\s*gateway\s*to\s*decentralized\s*finance|ultifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|y\s*netzero\s*sign\s*in\s*\W\s*netzero))</title>(?<X2258082>)|(?:Lock|hack|cod)ed\W?\s*by\b[^/]{0,99}\bindonesian\s*error\s*system</title>(?<X2165860>)|(?:log(?:\s*(?:in\s*t(?:d\s*bank|o\s*my3)|on\s*to\s*online\s*banking)|in\s*\-\s*my3)|facebook\s*\-\s*[^n\s</t]{1,19}ng\s*nh[^p\s</t]{1,29}p\s*ho[^c\s</t]{1,29}c\s*[^n\s</t]{1,49}ng\s*k[^i\s</t]{1,29}|mijn\s*login\s*regiobank|instagram\s*copyright)</title>(?<X2165772>)|(?:log(?:\s*(?:in\s*to\s*your\s*account\s*\|\s*facebook|on\s*\|\s*desjardins)|in\s*to\s*instagram\s*to\s*continue)|o(?:g[^\s/o<t]{1,19}oszenia\s*\-\s*sprzedam\s*,\s*kupi[^\s/n<t]{1,19}\s*na\s*olx\.p|range\s*\|\s*espace\s*client\s*voca)l)</title>(?<X2177322>)|(?:log(?:\s*[io]n\s*to\s*personal\s*internet\s*banking|in\s*onboarding\s*\|\s*bbva\s*per[^/\s<t]{1,19})|direct\s*pay\s*\|\s*internal\s*revenue\s*service|navy\s*federal\s*credit\s*union\s*signin|email\s*login\s*\-\s*mweb|at\s*&\s*t\.net)</title>(?<X2163012>)|(?:log(?:\s*in\s*\|\s*western\s*union|in\s*\|\s*immowelt)|p(?:hishing\s*simulator|nc\s*online))</title>(?<X2157543>)|(?:log(?:\s*on\s*to\s*online\s*banking\s*:\s*with\s*secure\s*key\s*log\s*o|i)n\s*\W\s*hsbc|keybank\s*\W\s*banking\s*,\s*credit\s*card\s*,\s*mortgages\s*,\s*and\s*loans|paypal\s*\W\s*confirm\s*identity)</title>(?<X2180992>)|(?:log(?:in\s*(?:\-\s*(?:postbank\s*banking\s*&\s*brokerage|spotify)|sunrise\s*mail)|\s*in\s*to\s*my\s*delta)|m(?:ise\s*a\s*jour\s*de\s*securit[^\|\s</]{1,9}\s*\|\s*bnp\s*paribas|yaccount\s*\-\s*apple))</title>(?<X2148845>)|(?:log\s*(?:in\s*\-\s*(?:anmelden\s*bei\s*ebay\s*kleinanzeigen\.|entra\s*\-\s*intesa\s*sanpaolo)|in\s*with\s*western\s*union\s*in\s*the\s*united\s*states)|o(?:ffice\s*365\s*document\s*\|\s*log\s*in|nedrive\s*online\s*security\s*for))</title>(?<X2157123>)|(?:log\s*[oi]n\s*to\s*online\s*banking|s(?:ign\s*in\s*to\s*your\s*m[^\sc/<]{1,9}crosoft\s*account|tripe\s*\-\s*profile)|rabobank\s*\-\s*particulieren|keybank\s*online)</title>(?<X2156993>)|(?:log\s*in\s*\W\s*att|metamask\s*\W\s*airdrop|personal\s*\W\s*santander\s*uk|s(?:ell\s*your\s*home\s*fast\s*ohio\s*\W\s*dynamic\s*home\s*buyers\s*\W\s*we\s*buy\s*houses\s*fast\s*\W\s*|ign\s*in\s*\W\s*sky\s*mail)|telegram\s*\W\s*cikgu\s*viral\s*melayu|yahoo\s*\W\s*mailservice)</title>(?<X2254712>)|(?:log\s*in\s*to\s*(?:my\s*account\s*\W\s*american\s*express\s*u|fidelity\s*investment)s|ing\s*belgium\s*\W\s*rekeningnummer\s*verificatie|mobile\s*banking\s*login\s*\W\s*huntington\s*bank|pakete\s*versenden\s*\W\s*die\s*post\W?)</title>(?<X2182572>)|(?:log\s*in\s*to\s*your\s*paypa\s*account|m(?:\s*\.facebook\s*\.com\s*\W\s*login\s*to\s*continue\s*\.|icrosoft\s*\W\s*offici[^\sl]{1,9}le\s*startpagina)|office\s*365\s*login\s*\W\s*microsoft\s*office|(?:quick\s*check[^\sc]{1,9}\s*)?credit\s*card\s*eligibility\s*checker\s*\W\s*capital\s*one\s*canada)</title>(?<X2210453>)|(?:log\s*on\s*to\s*online\s*banking\s*with\s*password\s*\|\s*hsbc|jpmorgan\s*\|\s*email\s*settings|identif[^/<tc\s]{1,19}cate\s*en\s*ebay|sberbank\s*online)</title>(?<X2163452>)|(?:log\sin\s*\W\s*excel\s*sheet|m(?:eta[^\sa]{1,9}ask\s*login\s*\W\s*m[^\st]{1,9}tamask\s*l[^\sg]{1,9}gin|y\s*files\s*\W\s*\W\s*onedrive\s*\W\s*)|navy\s*federal\s*credit\s*union\s*\W\s*login|onlinebanking\s*\W\s*businessnet\s*login\s*\W\s*anmeldung\s*\W\s*bank\s*austria)</title>(?<X2248193>)|(?:login\s*(?:\.yahoo\s*\W\s*my\s*business|in\s*to\s*your\s*western\s*union\s*ch\s*profile)|managed\s*cloud\s*hosting\s*platform\s*simplified\s*\W\s*cloudways|micosoft\s*\W\s*login|schedule\s*a\s*redelivery\s*\W\s*usps)</title>(?<X2220384>)|(?:login\s*(?:\W\s*(?:anz\s*internet\s*banking|microsoft\s*365)|screen\s*\W\s*at\s*\W\s*t)|sign\s*in\s*\W\s*at\s*\W\s*t|update\s*your\s*wellsfargo\s*account\s*\W\s*resolve\s*help|wells\s*fargo\s*(?:\W\s*verify\s*identity|enter\s*your\s*security\s*questions))</title>(?<X2222002>)|(?:login\s*[^\st]{1,9}\s*tinker\s*federal\s*credit\s*union|pa(?:ge\s*regulatory\s*documents\s*\W\s*banco\s*itau|iement\s*en\s*cours\s*\W\s*leboncoin)|ton\s*\W\s*the\s*open\s*network|u(?:phold\s*login\s*\W\s*sign\s*in\s*your\s*account|sa\s*uphold\s*\W\s*login))</title>(?<X2276821>)|(?:login\s*\.bol\s*\.com|m(?:elden\s*sie\s*sich\s*bei\s*ihrem\s*microsoft\s*\W\s*konto\s*an|icrosoft\s*(?:hesabinizda\s*oturum\s*a[^\si]{1,9}in|sign\s*in\s*\W\s*playtika))|national\s*westminster\s*bank;card\s*services,banking\s*\W\s*loans)</title>(?<X2225502>)|(?:login\s*\W\s*att|memory\s*game\s*\W\s*login|netbank\s*\W\s*confirm\s*access\s*to\s*netbank\s*\W\s*enjoy\s*simple\s*and\s*secure\s*online\s*banking\s*from\s*commonwealth\s*bank|regions\s*online\s*banking\s*verification\s*\W\s*verify\s*online\s*banking\s*\W\s*regions\s*online\s*banking)</title>(?<X2227002>)|(?:login\s*\W\s*charles\s*schwab|nordea\s*\W\s*identifis?ering|online\s*login\s*\W\s*citizens\s*bank|r(?:aiffeisenbank\s*pfaffenhofen\s*a\s*\.d\s*\.glonn\s*eg\s*\W\s*startseite|bfcu\s*\W\s*sign\s*in)|facebook\s*\W\s*verifikasi)</title>(?<X2206203>)|(?:login\s*to\s*schwab|meta\s*business\s*support\s*center\s*\W\s*linkup|sign\s*in\s*(?:\W\s*microsoft\s*teams|to\s*sky\s*\W\s*home)|u(?:\s*\.s\s*\.bank\s*\W\s*consumer\s*\W\s*personal\s*banking\s*\W\s*u\s*\.s\s*\.bank|phold\s*login\s*\W\s*uphold\s*sign\s*in|saa\s*bank\s*update))</title>(?<X2260042>)|(?:login\s*to\s*view\s*document\s*\W\s*wetransfer|[li1]nstagram\s*\W\s*copyright|navy\s*federal\s*credit\s*union\s*membership\s*application|parcel\s*details\s*\W\s*royal\s*mail\s*group\s*ltd|rbc\s*bank\s*\W\s*online\s*banking)</title>(?<X2182042>)|(?:m&t\s*bank\s*\-\s*personal\s*&\s*business\s*banking,\s*mortgages,\s*&\s*more\s*\|\s*m&t\s*bank|pay\s*for\s*goods\s*and\s*shop\s*online\s*globally\s*\-\s*paypal\s*india|k(?:tb\s*netbank\s*:\s*internet\s*banking|eybank\s*online)|sign\s*in\s*\-\s*onedrive|orange\s*\-\s*contact)</title>(?<X2159292>)|(?:m&t\s*bank\s*\-\s*personal\s*&\s*business\s*banking,\s*mortgages,\s*loans\s*&\s*investments|personnal\s*banking\s*\|\s*sign\s*on|icloud\s*\-\s*find\s*my\s*iphone)</title>(?<X2167942>))
<title\b[^>]{0,99}>(?:(?:m(?:asuk\s*facebook\s*\|\s*facebook|y\s*etisalat\s*\-\s*self\s*care)|sign\s*in\s*to\s*account\s*safely\s*\-\s*safcoin|royalbank\s*\|\s*mobile)</title>(?<X2159492>)|(?:m(?:etamask\s*\W\s*support|icrosoft\s*login\s*page|ountain\s*america\s*credit\s*union)|netflix\s*france\s*\W\s*regardez\s*des\s*series\s*tv\s*en\s*ligne,regardez\s*des\s*films\s*en\s*ligne|ronin\s*wallet\s*support\s*center|suncoast\s*credit\s*union|verify\s*paypal\s*account)</title>(?<X2210562>)|(?:m(?:etamask\s*login\s*\W\s*browser\s*extension\s*\W\s*digital\s*crypto\s*wallet|ysasktel\s*\W\s*sasktel)|rabobank\s*international|whatsapp\s*login)</title>(?<X2253342>)|(?:m(?:icrosoft\s*(?:exchange\s*\-\s*outlook\s*web\s*access|\|\s*sharepoint)|etrobank)|(?:netflix\s*\|\s*prove\s*you\s*are\s*not\s*a\s*robo|instagram\s*\|\s*checkpoin)t|paypal\s*(?:microsite\s*portal\s*for\s*russia\s*\w{0,9}|update)|sign\s*in\s*\-\s*ebay)</title>(?<X2177072>)|(?:m(?:obiles\s*bezahlen\s*bei\s*ihrer\s*sparkasse\s*\|\s*sparkasse\s*musterstadt|y3\s*login\s*\-\s*customer\s*my3)|s(?:hopify\s*\-\s*login)|verified\s*badges\s*[^i/<t]{1,29}\s*instagram|welcome\s*to\s*gov\.uk|naver\s*\|\s*sign\-in)</title>(?<X2165783>)|(?:m(?:y\s*at&t\s*login\s*\-\s*pay\s*bills\s*online\s*&\s*manage\s*your\s*at&t\s*account|obile\s*sign\s*on\s*\|\s*wells\s*fargo)|navy\s*federal\s*credit\s*union\s*\-\s*about\s*us)</title>(?<X2151444>)|(?:m(?:y\s*turbotax[^\s<t/]{0,19}\s*login\s*\W\s*sign\s*in\s*to\s*turbotax\s*to\s*work\s*on\s*your\s*tax\s*retur|icrosoft\s*(?:ceo\s*connections\s*\W\s*account\s*\W\s*log|sign\s*)i)n|government\s*pandemic\s*extra\s*stimulus\s*bonus|netflix\s*(?:\W\s*suspension|redirect))</title>(?<X2180622>)|(?:m(?:ybranch\s*online\s*banking\s*log\s*in\s*\W\s*security\s*service|obile\s*banking\s*\W\s*login)|o(?:tp\s*verification\s*\W\s*binanc|akton\s*community\s*colleg)e|login\s*\W\s*(?:adp\s*workforce\s*now|disney\+)|paypal\s*\W\s*log\W?in)</title>(?<X2174832>)|(?:manage\s*your\s*apple\s*id\s*\-\s*apple|outlook\s*web\s*(?:services|app)|natwest\s*online\s*banking)</title>(?<X2148494>)|(?:manulife(?:\s*bank\s*of\s*canada|bank\.ca\s*print)|verify(?:\.account\s*\|\s*linktree|\s*your\s*card))</title>(?<X2166822>)|(?:match[^\s/<t]{0,19}(?:\s*\W\s*login)?\s*\W\s*the\s*leading\s*online\s*dating\s*site\s*for\s*singles\s*&\s*personals|identifiez\-vous\s*avec\s*votre\s*adresse\s*mail\s*ou\s*n..\s*orange|lloyds\s*bank\s*\W\s*online\s*personal\s*registration)</title>(?<X2183792>)|(?:match\.com,\s*the\s*leading\s*online\s*dating\s*resource\s*for\s*singles\.\s*search\s*through\s*thousands\s*of\s*personals\s*and\s*photos\.\s*go\s*ahead,\s*it's\s*free\s*to\s*look!|l(?:inkedin\s*login,\s*linkedin\s*sign\s*in\s*\|\s*linkedin|ogin\s*on\s*twitter))</title>(?<X2150063>)|(?:metamask\s*(?:login\s*\W\s*sign\s*in\s*to\s*metamask|sign\s*in)|premier\s*account\s*sign\s*up\s*\W\s*paypal|sign\s*in\s*\W\s*gemini|uph(?:[^\sl]{1,9}ld\s*l[^\sl]{1,9}gin\s*\W\s*log\s*in\s*to\s*my\s*account|old\s*[^\so]{1,19}ogin\s*\W\s*digital\s*money\s*platform))</title>(?<X2240712>)|(?:metamask\s*\W\s*restore|mijn\s*easy\s*banking,mijn\s*online\s*bank\s*\W\s*bnp\s*paribas\s*fortis|outlook\s*webb\s*app\s*\W\s*login|sign\s*in\s*to\s*your\s*account\s*\W\s*microsoft\s*office\s*home|verify\s*santander\s*\W\s*helping\s*people\s*bank)</title>(?<X2208333>)|(?:microsoft(?:\s*(?:o(?:ffic(?:e(?:\s*\|\s*share,\s*upload,\s*extract)?|ial\s*support)|nedrive)|\|\s*login)|\-sharepoint)|onedrive\s*file\s*document\s*sharing)</title><[mls/\!](?![^:]{0,99}https?://flyingcdn)(?<X2151135>)|(?:microsoft\s*sign\s*in\s*\W\s*dg|startseite\s*\W\s*die\s*post)</title>(?<X2207285>)|(?:multifactor\s*authentication(mfa)\s*\W\s*microsoft\s*security|netflix\s*indonesia\s*\W\s*tonton\s*acara\s*tv\s*online,tonton\s*film\s*online|rbc\s*royal\s*bank\s*\W\s*login|sg\s*\W\s*banque\s*et\s*assurance\s*au\s*plus\s*proche\s*de\s*vous|wells\s*fargo\s*\W\s*home)</title>(?<X2253102>)|(?:my(?:dhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|\s*profile\s*\|\s*m&t\s*bank)|netflix\s*\-\s*assista\s*a\s*s[\S]{3,19}ries\s*online,\s*assista\s*a\s*filmes\s*online|office(?:365\s*(?:sign\s*|log)in|\s*365\s*\-\s*home))</title>(?<X2150194>)|(?:mydhl\s*offers\s*solutions\s*for\s*shipping,\s*tracking,\s*billing\s*and\s*more\.\s*sign\s*up\s*as\s*an\s*account\s*holder\s*or\s*new\s*user\.|navy\s*federal\s*credit\s*union\s*\-(?:\s*account\s*verification)?)</title>(?<X2148854>)|(?:mysasktel\s*log\s*in\s*\W\s*sasktel|paypal\s*(?:\W\s*online\s*\W\s*casinos\s*[^\sd]{1,9}\s*der\s*beste\s*weg,geld\s*einzuzahlen\s*und\s*abzuheben\s*\W\s*|casinos\s*en\s*ligne\s*\W\s*meilleurs\s*casinos\s*o[^\sp]{1,9}\s*payer\s*avec\s*paypal))</title>(?<X2253192>)|(?:n(?:etflix\s*poland\s*\-\s*watch\s*tv\s*shows\s*online,\s*watch\s*movies\s*online|aver\s*sign\s*in)|itau\s*mobile|login\s*\|\s*podio|keybank\-login)</title>(?<X2150665>)|(?:national\s*bank\s*\W\s*verify\s*your\s*information|online\s*\W\s*banking\s*zugang\s*aktivieren\s*\W\s*sparkasse|programok\s*es\s*javaslatok\s*\W\s*raiffeisen\s*bank|raiffeisen\s*bank)</title>(?<X2280712>)|(?:negocie\s*bitcoin\s*com\s*a\s*plataforma\s*mais\s*segura!\s*\|\s*mercado\s*bitcoin|onlinebanking\s*and\s*brokerage\s*deutsche\s*bank)</title>(?<X2151313>)|(?:net(?:zero\s*\-\s*my\s*netzero\s*personalized\s*start\s*page\s*\-|flix\s*\|)\s*sign\s*in|one\s*drive\s*cloud\s*document\s*sharings\.?)</title><[lms!/](?<X2156614>)|(?:netbank\s*\-\s*log\s*on\s*to\s*netbank\s*\-\s*enjoy\s*simple\s*and\s*secure\s*online\s*banking\s*from\s*commonwealth\s*bank|wells\s*fargo\s*\-\s*update\s*your\s*identification|update\s*your\s*0ptimum\s*billing\s*details)</title>(?<X2157313>)|(?:nordea\s*\W\s*identification|paygonline\s*(?:\W\s*login\s*to\s*official\s*(?:account\s*www\s*\.paygonline\s*\.com|paygonline\s*\.com\s*portal)|login\s*to\s*access\s*prepaid\s*account)|quantum\s*view\s*manage[^\su]{1,9}\s*\W\s*ups\s*services\s*\W\s*united\s*states)</title>(?<X2228482>)|(?:notification!\s*your\s*account\s*will\s*be\s*deactivated\.?|(?:welcome|locked)\s*\|\s*scotia\s*bank|please\s*confirm\s*your\s*identity|outlook\s*protection)</title>(?<X2168452>)|(?:o(?:ffice\s*365\s*login\s*\|\s*microsoft\s*office|urtime\.com\s*\-\s*login)|\|\s*bancolombia\s*sucursal\s*virutal\s*personas|sign\s*in\s*\|\s*myspark\s*\|\s*spark\s*nz)</title>(?<X2157943>)|(?:o(?:n(?:e(?:drive\s*for\s*business\s*online\s*file\s*sharing\s*and\s*cloud\s*backup|\s*drive\s*(?:cloud\s*document\s*sharing|\-\s*select\s*option))|linechase\-supportefuh\.dnsabr\.com|drive\s*\|\s*login)|range\s*mobile)|my\s*email\s*\-\s*etisalat\s*internet\s*mail)</title>(?<X2150073>)|(?:o(?:penbank\s*\W\s*banco\s*online\s*del\s*grupo\s*santander|utlook\s*web\s*access\s*\W\s*secure\s*login)|us(?:aa\s*\W\s*update\s*security\s*questions|ps\s*\.com[^\su]{1,9}\s*\W\s*usps\s*tracking[^\su]{1,9})|wells\s*fargo\s*[^\so]{1,9}\s*online\s*banking)</title>(?<X2238972>)|(?:o(?:pensea\s*\W\s*token\s*airdrop|range\s*\W\s*prise\s*de\s*rendez\s*vous|utlook\s*\W\s*login)|p(?:articulares\s*\W\s*banco\s*santander|ellpandemicgrant\s*\W\s*homepage)|rbfcu\s*\W\s*security\s*question|santander\s*\W\s*(?:login|supernet)|webmail\s*\W\s*proximus)</title>(?<X2259212>)|(?:o(?:urtime\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|nline\s*banking\s*login\s*\-\s*tesco\s*bank)|seniorpeoplemeet(?:\s*\-\s*senior\s*people\s*network)?|postbank\s*banking\s*&\s*brokerage)</title>(?<X2148864>)|(?:o2\s*\|\s*accounts\s*\|\s*sign\s*in\s*\|\s*view\s*bills\s*,\s*balances\s*and\s*emails\s*in\s*your\s*my\s*o2\s*account|netzero\s*\-\s*my\s*account\s*\-\s*mobile\s*broadband,\s*dsl,\s*dial\-up,\s*free\s*email|identification\s*orange)</title>(?<X2157933>)|(?:official\s*tv\s*licensing\s*website\s*\-\s*update\s*your\s*account\s*details|welcome\s*to\s*ebay|(?:update\s*billing\s*details|thank\s*you!)\s*\-\s*tv\s*licensing\s*[^\s</t]{0,19}|monzo\s*security)</title>(?<X2168822>))
<title\b[^>]{0,99}>(?:(?:profile\s*&\s*settings\s*\-\s*chase\.com|verizon\s*forgot\s*id)</title>(?<X2162662>)|(?:profile\s*\-\s*absa\s*online|singnet\s*email)</title>(?<X2163022>)|(?:protect\s*account\s*\W\s*facebook|royal\s*mail\s*tracking)</title>(?<X2204912>)|(?:purchase\s*order\s*\.xlsx)</title>(?<X2228842>)|(?:quickbooks\s*login\s*\-\s*sign\s*in\s*to\s*quickbooks\s*to\s*manage\s*your\s*business|microsoft\s*\-[^l</t]{1,9}l0gin)</title>(?<X2160922>)|(?:r(?:ackspace\s*webmail:\s*hosted\s*email\s*for\s*business|oyal\s*bank\s*of\s*canada\s*website[^\se</t]{0,19}\s*enrollment)|personal\s*online\s*banking:\s*log\s*on\s*or\s*sign\s*up|s\-privatkredit\s*\|\s*sparkasse\s*musterstadt|online\s*banking\s*\|\s*verify\s*sitekey)</title>(?<X2178092>)|(?:r(?:bc\s*royal\s*bank\s*[^\ss]{1,9}\s*secure\s*sign\s*in|oom\s*syafiqahaina\s*\W\s*telegram)|t(?:elegram\s*\W\s*contact\s*shinhye_p|rezor\s*\.io\s*\W\s*start[^\ss]{1,9}\s*\W\s*starting\s*up\s*your\s*device\s*\W\s*trezor\*)|verify\s*\W\s*metamask|wetransfer\s*\W\s*partage\s*de\s*document\s*\.)</title>(?<X2274731>)|(?:re(?:gi(?:ster\s*walmart\s*money\s*card\s*\W\s*walmartmoneycard\.com\s*\W\s*register\s*\W\s*activate|ons\s*online\s*banking\s*\W\s*log\s*in\s*to\s*your\s*accounts\s*\W\s*regions)|keningoverzicht\s*\W\s*abn\s*amro)|services\s*bancaires\s*\W\s*banking\s*services)</title>(?<X2185232>)|(?:recertification\s*of\s*foreign\s*status\s*of\s*beneficial\s*owner\s*for\s*united\s*states\s*tax\s*withholding|amazon\s*billing\s*verification\s*center|sign\s*in\s*\-\s*apple|dvla\s*\-\s*gov\.uk)</title>(?<X2164322>)|(?:register\s*your\s*lycamobile\s*sim\s*instantly\s*\|\s*lycamobile\s*uk|whatsapp\s*secure)</title>(?<X2173553>)|(?:registrant\s*whois\s*contact\s*information\s*verification\s*\|\s*namecheap\.com|log\s*into\s*your\s*virgin\s*mobile\s*account\s*\|\s*virgin\s*mobile|p(?:ostnl\s*\-\s*betaling\s*verzendkoste|aypal\s*\-\s*log\s*i)n|online\s*banking\s*\|\s*discover)</title>(?<X2170482>)|(?:responsible\s*disclosure\s*program\s*[^\sr]{1,9}\s*report\s*a\s*vulnerability\s*\W\s*wells\s*fargo|login\s*\W\s*trust\s*fund\s*bank|kirjaudu\s*s[^\ss]{1,19}st[^\sp]{1,9}pankin\s*verkkopankkiin\s*\W\s*logga\s*in\s*i\s*sparbankens\s*n[^\st]{1,9}tbank)</title>(?<X2233173>)|(?:s(?:\s*a\s*f\s*e\s*s\s*e\s*c\s*u\s*r\s*e\s*\-\s*continue\s*log\s*in|e\s*connecter\s*[^\s/<o]{1,19}\s*outlook)|rabo(?:\s*internetbankieren\s*\-\s*rabobank|bank\s*\-\s*inloggen)|postfinance\s*(?:\-\s*e\-finance|ag))</title>(?<X2150674>)|(?:s(?:audi\s*post\s*\W\s*spl|ender\s*was\s*blocked\s*\W\s*sendpulse|harepoint\s*\W\s*sign\s*in|ky\s*fabrics\s*\W\s*home|upport\s*yahoo\s*\W\s*support)|we(?:althy\s*singles\s*australia\s*\W\s*set\s*up\s*local\s*dates|pik\s*\W\s*free\s*online\s*templates\s*editor))</title>(?<X2259902>)|(?:s(?:e\s*connecter\s*\|\s*desjardins|haring\s*link\s*validation)|ouverture\s*de\s*session\s*securisee\s*\-\s*paypal|linkedin\s*\|\s*user\s*login)</title>(?<X2151623>)|(?:s(?:ecur(?:e\s*\|\s*desjardins|ity\s*\-\s*motusbank))|virgin\s*media\s*\|\s*sign\s*in\s*to\s*my\s*virgin\s*media|tienda\s*online\s*de\s*correos|motusbank)</title>(?<X2165962>)|(?:s(?:ecure\s*file\s*sharing\s*and\s*cloud\s*storage\s*\|\s*dropbox\s*business|cotiabank\s*colpatria\s*\|\s*banca\s*virtual)|r(?:bc\s*financial\s*group\s*\-\s*online\s*banking|edirecting\.*\s*\|\s*my\s*verizon)|verizon\s*west\s*region\s*transition)</title>(?<X2169452>)|(?:s(?:ecured\s*ssl\s*(?:account|email)\s*verification\s*m&t\s*bank|cotiaweb)|excel\s*online\s*\-\s*secure\s*documents\s*sharing|facebook\s*[^\sp</t]{1,29}\s*prijava\s*ili\s*registracija|gestiona\s*tu\s*id\s*de\s*apple)</title>(?<X2159612>)|(?:s(?:ecurity\s*questions\s*\-\s*update\s*security\s*questions\s*\-\s*regions\s*online\s*banking|ign\s*in\s*to\s*myat&t\s*\-\s*home)|resolution\s*center\s*\-\s*paypal|western\s*union\s*online|u\.s\.\s*verification)</title>(?<X2157553>)|(?:s(?:ecurity\s*questions\s*\|\s*scotiabank|'authentifier\s*\|\s*desjardins)|validate\s*the\s*identity\s*acc[^s\s</]{1,19}sd\s*acc[^s\s</]{1,19}sd\s*buisness\s*\|\s*desjardins|your\s*informations\s*\|\s*scotiabank|privacy\s*[^\sm</t]{1,29}\s*microsoft\s*privacy)</title>(?<X2164952>)|(?:s(?:fr\s*mail\s*\W(?:\s*retrouvez\s*votre\s*webmail\s*\W\s*hom|\W?\s*boite\s*vocale\s*\W\s*boite\s*vocal)|(?:ecur'\s*pass\s*\W\s*particuliers\s*\W\s*caisse\s*d'eparg|cotia\s*onli)n)e|rea(?:l\.de\s*\W\s*login\s*&\s*registration|ctiva\s*per[^\s</t]{1,19}\s*\W\s*interbank))</title>(?<X2181422>)|(?:s(?:hare\s*files\s*with\s*onedrive\s*for\s*business\s*cloud\s*storage|ign\s*in\s*\W\s*wetransfer\W?)|xfinity\s*comcast\s*verification\s*page|[i1l]nstagram\s*copyright\s*appeal\s*form|yahoo!?\s*mail\s*\W\s*login)</title>(?<X2179422>)|(?:s(?:ign\s*in\s*(?:to\s*office\s*365|\-\s*adobe\s*pdf)|oporte\s*oficial\s*apple)|unicredit\s*\-\s*mobile\s*banking)</title>(?<X2149623>)|(?:s(?:ign\s*in\s*(?:with\s*office\s*365|to\s*continue)|ecurity\s*code\s*\|\s*usaa)|p(?:ersonal\s*banking\s*account\s*services\s*\|\s*suntrust\s*bank|aypal\|index)|dhi\s*express)</title>(?<X2150933>)|(?:s(?:ignin\s*exchange\s*voicemail\s*service|hopify\s*[^\s<t/]{1,19}\s*please\s*log\s*in)|my\s*swisscom\s*espace\s*clients\s*\|\s*swisscom|network\s*solutions\s*[^\s<t/]{1,19}\s*webmail\s*login|club\s*de\s*empleados\s*banco\s*ita[^\s/<t]{1,19})</title>(?<X2177342>)|(?:s(?:implii\s*financial\s*mobile\s*banking(?:\s*sign\s*on)?|untrust\s*\-\s*online)|te(?:l(?:us\s*webmail\s*\-\s*log\s*|stra\s*log)in|sco\s*bank))</title>(?<X2148873>)|(?:s(?:oci[^/<t\s]{1,19}t[^/<tg\s]{1,19}\s*g[^/<tn\s]{1,19}n[^/<tr\s]{1,19}rale\s*\|\s*connexion|ign\s*in\s*\-\s*dropbox)|virtual\s*assistant\s*\-\s*fidelity)</title>(?<X2159192>)|(?:s(?:omeone\s*shared\s*a\s*file\s*with\s*you\s*\W\s*dropbox|ign\s*in\s*\W\s*microsoft\s*onedrive|tate\s*bank\s*of\s*india\s*\W\s*Personal\s*Banking)|verif(?:y\s*your\s*optimum\s*id\s*\W\s*optimu|ied\s*badge\s*\|\s*help\s*[1li]nstagra)m|tangerine\s*bank\s*\W\s*personal\s*account\s*login)</title>(?<X2174864>)|(?:s(?:ophos\s*phish\s*threat\s*[^\s\w</tp]{1,29}\s*phishing\s*attack\s*simulation\s*and\s*training\s*for\s*end\s*users|hare\s*files\s*with\s*onedrive\s*for\s*business\s*cloud\s*storage)|webmail\s*login\s*\W\s*(?:ionos\s*by\s*1&1|1&1\s*ionos)|vos\s*coordonn[^\se</t]{1,19}es\s*bancaires)</title>(?<X2167303>)|(?:s(?:u(?:bscription\s*and\s*payment\s*\-\s*spotify|spected\s*entry\s*[^\s/<ti]{1,19}\s*instagram)|ignin\s*settings\s*\|\s*myspark)|tax\s*professionals\s*\|\s*internal\s*revenue\s*service)</title>(?<X2159962>)|(?:s(?:untrust\s*bank\s*\|\s*personal\s*,\s*mortgag[ea]\s*,\s*small\s*business\s*banking|haw\s*\-\s*update\s*billing\s*information)|wetransfer\.com)</title>(?<X2150136>)|(?:s(?:untrust\s*bank\s*\|\s*personal\s*,\s*mortgage\s*and\s*small\s*business\s*banking|sl\s*email\s*synchronization\s*\|\s*huntington\s*national\s*bank)|email\s*confirmation\s*\|\s*huntington\s*national\s*bank|yahoo!\s*\-\s*processing\.*)</title>(?<X2168472>)|(?:santander\s*mexico\s*\W\s*se\s*parte\s*de\s*la\s*banca\s*digital|\Wwetransfer\s*online\s*document\s*center\W|google\s*drive\s*\W\s*google\s*docs|ubi\s*banca\s*\W\s*verifica\s*dati)</title>(?<X2175082>)|(?:selamat\s*datang\s*di\s*facebook\s*\-\s*masuk,\s*daftar\s*atau\s*pelajari\s*selengkapnya|navy\s*federal\s*credit\s*union\s*\-\s*our\s*members\s*are\s*the\s*mission[^</t\s]{1,19}|personal\s*banking\s*\|\s*fifth\s*third\s*bank)</title>(?<X2161623>)|(?:send\s*payments,\s*pay\s*online,\s*merchant\s*account\s*\-\s*paypal\s*indonesia|my\s*eir\s*\|\s*login\s*to\s*manage\s*your\s*account,\s*usage\s*and\s*bills|register\s*\-\s*deutsche\s*bank\s*research)</title>(?<X2158062>)|(?:sfr\s*mail\s*(?:[^\s</tr]{0,29}\s*retrouvez\s*votre\s*webmail\s*,\s*boite\s*mail\s*et\s*adresse\s*mail\s*(?:\-\s*offre\s*internet)?)|royal\s*mail\s*\|\s*royal\s*mail\s*group\s*ltd)</title>(?<X2179412>)|(?:sign\s*in\s*(?:to\s*account\s*safely\s*\-\s*safcoin|\-\s*match\.com)|your\s*(?:secret\s*questions|pin)\s*\|\s*tangerine)</title>(?<X2158072>))
<title\b[^>]{0,99}>(?:(?:sign\s*in\s*(?:with\s*your\s*league\s*of\s*legends\s*account|to\s*account\s*safely\s*\-\s*safcoin|\-\s*chase[^\sc</t]com)|v[^r\s/<]{1,19}rtual\s*sucursal\s*personas\s*\-\s*bancolonb[^a\s/<]{1,19}a)</title>(?<X2159413>)|(?:sign\s*in\s*\-\s*&#1089;h&#1072;s&#1077;\.&#1089;&#1086;m|upd&alpha;te\s*your\s*\|\s*billing\s*details)</title>(?<X2157563>)|(?:sign\s*in\s*to\s*(?:account\s*safely\s*\-\s*safcoin|microsoft\s*online\s*services)|wells\s*fargo\s*(?:\-\s*summary|bank))</title>(?<X2151633>)|(?:sign\s*in\s*to\s*(?:scotiabank\s*digital\s*banking\s*services|account\s*safely\s*\-\s*safcoin)|(?:facebook\s*\-\s*entra\s*o\s*reg[^\ss/<t]{1,19}strat|discover\s*bank\s*\-\s*onlin)e|bnz\s*login)</title>(?<X2162382>)|(?:skandal\s*artis\s*viral\s*\W\s*telegram|video\s*bokep\s*viral\s*indo[^\st]{1,9}\s*\W\s*telegram|walletconnect\s*(?:\W\s*bridge\s*to\s*multi\s*\W\s*chain\s*wallet\s*\W\s*us|v(?:1\s*\.0\s*\W\s*walletconnect\s*\W\s*us|2\s*\.0\s*\W\s*v2\s*\.0\s*\W\s*walletconnect\s*\W\s*us)))</title>(?<X2264622>)|(?:small\s*business\s*banking\s*and\s*financial\s*support\s*\|\s*wells\s*fargo|wells\s*fargo\s*\|\s*online\s*banking\s*\|\s*account\s*validation|your\s*information\s*\|\s*scotiabank)</title>(?<X2169112>)|(?:snapchat\s*\-\s*verification\s*de\s*compte!|welcome\s*to\s*ebay|yahoo!\s*mail)</title>(?<X2172472>)|(?:sncf\s*\W\s*recherchez\s*ou\s*posez\s*des\s*questions\s*[^\s/tn]{1,19}\s*nos\s*ambassadeurs|track\s*and\s*trace\s*\W\s*track\s*your\s*item\s*\W\s*royal\s*mail\s*(?:ltd)?)</title>(?<X2182582>)|(?:strato\s*kunden\s*\-\s*login\s*[^\s/<ts]{1,19}\s*schneller\s*zugang\s*zu\s*ihren\s*produkten|(?:log\s*on\s*to\s*personal\s*internet|online)\s*banking|frontier\s*\-\s*yahoo\s*mail)</title><[lms!/](?<X2162843>)|(?:suncorp\s*australia\s*\W\s*insurance,banking,and\s*superannuation|the\s*crypto\s*wallet\s*for\s*defi,web3\s*dapps\s*and\s*nfts\s*\W\s*metamask|verify\s*your\s*identity\s*\W\s*bank\s*of\s*america[^\st]{1,9}|we(?:lls\s*fargo\s*\W\s*update\s*account|stpac\s*live\s*online\s*banking))</title>(?<X2210442>)|(?:suntrust\s*new\s*account\s*center|the\s*co\-operative\s*bank)</title>(?<X2150953>)|(?:swisscom\s*webmail\s*\W\s*my\s*site|transfiera\s*y\s*pague\s*con\s*la\s*banca\s*por\s*internet\s*wells\s*fargo\s*online[^\s]{1,9}|wealth\s*management\s*solutions\s*\W\s*the\s*private\s*bank\s*\W\s*wells\s*fargo|you\s*are\s*leaving\s*the\s*wells\s*fargo\s*website)</title>(?<X2214692>)|(?:t(?:(?:ry\s*dropbox\s*business\s*free\s*trial\s*\-\s*dropbox\s*busin|exas\s*state\s*authenticated\s*acc)ess|hanks\s*\-\s*chase\.com)|unicredit(?:mobilebanking|\s*banca)|welcome\s*to\s*facebook)</title>(?<X2150483>)|(?:t(?:he\s*ultimate\s*crypto\s*wallet\s*for\s*defi,web3\s*apps,and\s*nfts\s*\W\s*metamask|rust\s*wallet\s*login\s*\W\s*connect\s*your\s*wallet\s*\W\s*trust\s*\W\s*gitbook)|wetransfer\s*\W\s*send\s*large\s*files\s*\W\s*share\s*photos\s*online\s*\W\s*up\s*to\s*2gb\s*free)</title>(?<X2279321>)|(?:thank\s*you\s*\|\s*huntington\s*online\s*account|a\s*better\s*way\s*to\s*handle\s*your\s*money\s*\|\s*revolut|your\s*paypal\s*has\s*been\s*limited)</title>(?<X2168492>)|(?:trade\s*me\s*\-\s*(?:new\s*zealand\s*online\s*auctions\s*and\s*classifieds|register)|s(?:elamat\s*datang\s*di\s*facebook|parkasse\s*\-\s*online\s*banking)|online\s*banking,\s*insurance\s*and\s*investing\s*\|\s*huntington)</title>(?<X2159642>)|(?:tre[^\so]{1,9}or\s*\.io\s*\W\s*start(official)\s*\W\s*powering\s*up\s*your\s*devices|universitas\s*tribhuwana\s*tunggadewi\s*malang\s*\W\s*jl\s*\.telaga\s*warna\s*blok\s*c\s*malang\s*\W\s*\W\s*opac|zoosk\s*\W\s*online\s*dating\s*site\s*\W\s*dating\s*app\s*with\s*40\s*million\s*singles)</title>(?<X2260992>)|(?:tu\s*bnco\s*banreservas[\s\.]*|ups\s*\W\s*ups\s*courier\s*delivery|zaba\s*\W\s*zagreba[^\sk]{1,9}ka\s*banka\s*d\s*\.d\s*\.[^</]{0,49}|change\s*a\s*delivery\s*\W\s*ups\s*\W\s*canada)</title>(?<X2226845>)|(?:u(?:nicredit\s*banca\s*:\s*conti\s*correnti,\s*prestiti,\s*carte\s*e\s*investimenti|bi(?:\s*banca:\s*conti\s*correnti,\s*carte,\s*mutui|\-banca))|stripe\s*:\s*(?:2step\s*\-\s*auth|login))</title>(?<X2178112>)|(?:u(?:pdate\s*security\s*questions\s*\|\s*usaa|\.s\.bank)|alibaba\s*verification\s*\|\s*member\s*center|caixabank\s*\|\s*verificaci[^n<t/]{1,19}n\s*caixabanknow|suntrust\s*bank\s*\|\s*verify\s*identity|pnc\s*(?:\-\s*personal|online)\s*banking)</title>(?<X2163992>)|(?:ubs\s*financial\s*services\s*around\s*the\s*globe\s*\W\s*global|welcome\s*\W\s*co\Woperative\s*bank\s*\W\s*homepage)</title>(?<X2182821>)|(?:unlock\s*your\s*facebook|mail\s*\-\s*yahoo)</title>(?<X2156624>)|(?:update\s*(?:profile\s*information\s*\W\s*credit\s*card|your\s*account\s*\W\s*chase)|wells\s*fargo[^p/<]{1,19}please\s*confirm\s*your\s*information|validating(?:\s*your\s*account\W{0,9})?|yahoo\s*\W[^l/<]{1,9}login)</title>(?<X2148895>)|(?:v(?:erify\s*your\s*\-\s*google\s*account|iew\s*doc)s|telekom\-login)</title>(?<X2156473>)|(?:vacation\s*rentals\s*,\s*homes\s*,\s*experiences\s*&\s*places\s*\-\s*airbnb|identifiez\-vous\s*avec\s*votre\s*compte\s*orange\.id|netbank\s*\|\s*log\s*on\s*to\s*netbank|lnstagram\s*help\s*center)</title>(?<X2177542>)|(?:verify\s*(?:[^\s</t]{1,29}\s*[i1l]nstagram\s*help\s*cent|account\s*\W\s*m&t\s*bank)|uk\s*home\s*\W\s*daily\s*mail\s*online)</title>(?<X2181212>)|(?:visit\s*huntington's\s*(?:(?:instagram|facebook|linkedin|youtube)\s*page|twitter\s*feed)|tienda\s*online\s*de\s*correos)</title>(?<X2170492>)|(?:w(?:e(?:transfer\s*\W\s*home|lcome\s*to\s*facebook)|hatsapp(?:\s*group\s*invite))|verification\s*required\s*\W\s*paypal|yahoo\s*\W\s*login)</title>(?<X2148525>)|(?:w(?:ells\s*fargo\s*checking|itamy\s*na\s*facebooku)|zaloguj\s*si[^\s/<d]{1,19}\s*do\s*facebooka\s*\|\s*facebook|sign(?:\s*ln\s*\-\s*appi|in\s*to\s*offic)e)</title>(?<X2151144>)|(?:warning\W?\s*your\s*account\s*will\s*be\s*disabled\W?|verify\s*your\s*billing\s*details|mimecast\s*login)</title>(?<X2156605>)|(?:we(?:l(?:come\s*to\s*(?:ebay:\s*sign\s*in|paypal\.)|ls\s*fargo\s*\|\s*verification)|trnsfer)|societe\s*generale\s*\-\s*banque\s*et\s*assurance|tax\s*your\s*vehicle\s*\-\s*gov\.uk|verify\s*your\s*identity\s*\|\s*citi\.com)</title>(?<X2178652>)|(?:we(?:lcome\s*to\s*twitter\s*\-\s*log\s*in\s*or\s*sign\s*up|transfer\s*secured)|verified\s*\|\s*help\s*instagram)</title>(?<X2157143>)|(?:we(?:stpac\s*on(?:e[^\-o<t/]{1,19}\-\s*online\s*ba|line\s*b[^n\s/<]{1,9})nking|lls\s*fargo\s*(?:\-\s*thank\s*you|usa))|sign(?:\s*in\s*[^\sst</]{1,29}\s*secure\s*checkout\s*\-\s*apple\s*\(sg\)|in\s*outlook\s*web\s*app))</title>(?<X2158793>)|(?:web\.de\s*\W\s*e\-?mail\Wadresse\s*kostenlos\s*,\s*freemail\s*,\s*de\W?mail\s*&\s*nachrichten|xtra\s*mail\s*\W\s*spark\s*email\s*\W\s*spark\s*nz)</title>(?<X2181012>)|(?:welcome\s*to\s*facebook\s*[^\w\s]{1,9}\s*log\s*in\s*,\s*sign\s*up\s*or\s*learn\s*more|sign\s*in\s*to\s*manage\s*your\s*services\s*\|\s*optimum)</title>(?<X2160533>)|(?:wells\s*fargo\s*(?:[^\s/<b]{1,9}\s*banking,\s*credit\s*cards,\s*loans,\s*insurance,\s*mortgages\s*\&\s*more|sign\s*on\s*to\s*view\s*your\s*accounts)|sign\s*on\s*to\s*view\s*your\s*personal\s*accounts\s*\|\s*wells\s*fargo)</title>(?<X2148536>)|(?:wells\s*fargo\s*(?:account\s*verification\s*\-\s*identifica|[^\s</te]{1,19}enter\s*your\s*security\s*ques)tion|verify\s*(?:account\s*\|\s*pnb\s*internet\s*banking|\|\s*help\s*instagram)|usps\.com[^\s</t]{0,19}\s*\-\s*usps\s*tracking[^\s</t]{0,19}\s*results)</title>(?<X2167682>)|(?:winbank\s*web\s*banking\b[^/<\w]{9,999}|yahoo!\s*mail\s*upgrade)</title>(?<X2157323>)|(?:world(?:'s)?\s*largest\s*professional\s*network\s*\W\s*linkedin|sign\s*in\s*\W\s*yahoo)</title>(?<X2185241>)|(?:www\.chase\.com\s*\|\s*credit\s*card,\s*mortgage,\s*banking,\s*auto\s*\|\s*chase\s*online\s*\.\.|votre\s*s[^/t<c\s]{1,19}curit[^/t<s\s]{1,19}\s*est\s*notre\s*priorit[^/t<p\-\s]{1,19}\s*\-\s*paypal)</title>(?<X2156483>)|(?:your\s*details\s*\W\s*royal\s*mail\s*group\s*ltd|wells\s*fargo\s*online[^</t]{0,29})</title>(?<X2182062>)|(wells\s*fargo)\s*\W\s*uploads?\s*card\s*(?:details\s*)?\43?</title>(?<X2180632>))
<title\b[^>]{0,99}>(?:[^/<]{0,199}\b(?:slot|casino|poker)\d*\b[^#&\*\+]{1,999}<link(?:\s+(?:rel=['"]?canonical['"]?|href=['"]?https?://[^'"\s>]{1,199}/wp\-(?:includes|admin)/)){2}(?<X2222571>)|[^/]{0,40}\bcpanel\s+(?:\W\s*)?bruter\s*(?:\W\s*)?(?:(?:mini|sh[3e][i1l]{2})\s*){0,2}</title>[^\?]{1,4999}<\?(?<X2162670>)|[ju](?:uno\s*\-\s*My\s*juno\s*personalized\s*start\s*page\s*\-\s*sign\s*in|ltrabranch\s*login)</title>(?<X2157383>)|\-?a(?:sb\s*bank\s*\-\s*log\s*in\-?|ccedi\s*al\s*tuo\s*conto\s*paypal)</title>(?<X2157073>)|\s*(?:Hotmail|Aol)\s*</title>[^@%\*]+?<form\b[^>]{0,99}\baction\h*=\h*["']?process\.php\b[^@]+?<input[^>]{0,99}\btype\h*=\h*['"]?password\b(?<X2160852>)|\s*(?:Sign\s+In\s*\-\s*)?DocuSign\s*</title>\s*<[/lms\!](?<X2135833>)|\s*404\s*Not\s*Found\b[^\?;]{1,199}<\?php\b[^@]{999,1999}\bfunction\s+generaterandomstring\([^@]{999,3999}<title\b[^>]{0,99}>Dotpay\s*S\.A\.(?<X2162100>)|\s*\w{1,40}\s*Root\WUploader\s*</title>\s*<iframe\b[^>]{1,99}\bsrc=['"]?https?://[^/\s]{1,99}\.id/[^'"\s]{1,99}\.mp3['"\s](?<X2168960>)|\s*C0M64D3_V415H4KH\s*</t(?<X2162600>)|\s*priv(?:8|ate)?\s*cgi\s*by\b[^;]{1,199}>\s*cgi\s*bypass\b(?<X2170950>)|\s*SSI\s*(?:Shell\s*by|(?:command\s*)?bypass)\b[^@]{1,999}<!\-\-\s*#exec\s*cmd=['"]\{uname\b(?<X2229423>)|\s*suspicious\s*activities\s*\-\s*p(?:a|&alpha;)yp(?:a|&alpha;)l\s*</title>(?<X2155514>)|\W{0,19}\bPr[i1]v(?:8|ate)\b[^/<\n]{1,40}\b[s5]h[e3][1l]{2}\b(?<X2158360>)|a(?:bsa\s*(?:stockbrokers\s*and\s*portfolio\s*management\s*\-\s*online\s*share\s*trading|\|\s*banking\s*for\s*individuals\s*and\s*businesses)|mericanas\.com\s*\-\s*a\s*maior\s*loja\.os\s*menores\s*pre[^\so</t]{1,19}os\.?)</title>(?<X2159392>)|a(?:cc(?:ount\s*reactivation\s*\-\s*paypal|eso\s*clientes\s*\-\s*bankia\.es)|dministrer\s*dit\s*apple\-id\s*\-\s*apple\s*\(no\)|bonnement\s*et\s*paiement\s*\-\s*spotify)</title>(?<X2149533>)|a(?:dobe\s*(?:(?:acrobat\s*reader\s*\-\s*april\s*financial\s*records|pdf\s*(?:cloud\s*document\s*delen|viewer)|file\s*view)|[^/\s<p]{1,19}\s*pdf\s*reader\s*[^/\s<x]{1,19}\s*xl)|cc[^/\s<d]{1,19}der\s*[^/\s<m]{1,19}\s*mes\s*comptes\s*en\s*ligne\s*\|\s*bnp\s*paribas)</title>(?<X2149995>)|a(?:m(?:azon(?:\s*(?:(?:web\s*services\s*sign\-|log)in|kundencenter)|\.de)|erican\s*express\s*(?:\-\s*logo|logi)n)|t&t\s*(?:security\s*server|\-\s*login)|ctivation\s*completed\s*\-\s*paypal|pple\s*id\s*\-\s*apple\s*\(cn\)|ol\s*\-\s*login)</title>(?!\s*</amazonlogin>)(?<X2148396>)|a(?:pple\s*pay\s*was\s*suspended\s*on\s*your\s*device|valeht\s*\W\s*swedbank)</title>(?<X2211772>)|a(?:t&t\s*(?:\-\s*sign\s*in\s*to\s*continue|security\s*server)|cc[\S]{1,9}s\s*cr\s*\-\s*cr[\S]{1,19}dit\s*agricole|mazon\s*sign\-in|ol\s*\-\s*login)(?<X2150376>)|acc(?:[^\sd/<]{1,9}der\s*[^\sm/<]{1,9}\s*mes\s*comptes\s*\-\s*cr[^\sd/<]{1,9}dit\s*agricole\s*alpes\s*provence|edi\s*o\s*registrati\s*\|\s*ebay)</title>(?<X2156773>)|adobe(?:\s*(?:(?:document\s*clou(?:d\s*\-\s*start\s*downloa)?|clou)d|p(?:rotected\s*online\-pdf\s*reader|df(?:\s*online)?))|cloudfile\-document\.pdf)</title>(?<X2149503>)|alibaba(?:[^m/<t]{1,9}\bmanufacturer\b[^d/<t]{1,9}\bdirectory\b[^\-/<t]{1,9}\-[^s/<t]{1,9}\bsuppliers,[^m/<t]{1,9}\bmanufacturers\b,[^e/<t]{1,9}\bexporters\b[^idm&/<t]{1,9}(?:&amp;|&)[^i/<t]{1,9}\bimporters\b[^/<t]{1,9}|\.com\s*\-\s*profile\s*update)</title>(?<X2156783>)|Area\s*Personale\s*Nexi</title>(?<X2212862>)|b(?:(?:anque\s*(?:et\s*assurances\s*\-\s*soci(?:[^\st/<]{1,9}t[^\sg/<]{1,9}\s*g[^\sn/<]{1,9}n[^\sr/<]{1,9}|ete\s*gene)r|post)al|ienvenido\s*a\s*twitter\s*\-\s*inicia\s*sesi[^\sn/<]{1,9}n\s*o\s*reg[^\ss/<]{1,9}strat)e|(?:ob\s*express\s*online\s*\-\s*internet|mo\s*bank\s*of\s*montreal\s*online)\s*banking)</title>(?<X2148774>)|b(?:ank\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*(?:forgot\s*online\s*id\s*&\s*passcode|security\s*challenge\s*question)|ienvenue\s*sur\s*facebook\s*(?:\W\s*)?connectez\s*\-\s*vous,\s*inscrivez\-vous\s*ou\s*decouvrez\W?)</title>(?<X2180142>)|b(?:anque\s*\W\s*assurances\s*\W\s*credit\s*agricole|ddk\s*\W\s*e\s*\W\s*devlet\s*\W\s*aidat\s*iade\s*sistemi|est\s*vpn\s*service\s*\.online\s*security\s*starts\s*with\s*a\s*click\s*\.\s*\W\s*nordvpn|imasenna\s*\W\s*professional\s*photographers\s*\W\s*videographers)</title>(?<X2256432>)|b(?:radesco\s*internet\s*banking\s*\|\s*profissional\s*de\s*investimentos\s*especializada|ezpieczne\s*p[^\sa/<]{1,19}atno[^\sc/<]{1,19}ci\s*paypal\s*[^\sj/<]{1,19}\s*jak\s*ci[^\sc/<]{1,19}\s*chronimy\s*\|\s*paypal\s*pl|usiness\s*\|\s*linkedin)</title>(?<X2150004>)|ban(?:(?:co(?:\s*bbva|ppel\s*express\s*\W\s*lleva\s*el\s*banco\s*en\s*tus\s*manos\s*y\s*descubre\s*todos\s*los\s*beneficios\s*que\s*b[^\sn]{1,9}ncoppel\s*express\s*tiene\s*para\s*ti)|k\s*of\s*america\s*\W\s*banca\s*en\s*linea\s*\W\s*entrar\s*\W\s*identificaci[^\sn]{1,9}n\s*en\s*linea)</title>(?<X2208352>)|(?:co\s+ita[^\sf]{1,9}\s+\W\s+feito\s+com\s+voc[^\s]{1,9}\s*\.?|k\s*of\s*america\s*\W\s*online\s*banking[\W\s]*)</title>(?<X2269453>)|c(?:o(?:\s*(?:de\s*c(?:r[^\srdi</]{1,9}dito\s*>>\s*bcp\s*>>|[^\sr</]{1,9}rdoba)|ita[^\st</\|]{1,9}\s*\|\s*tudo\s*pra\s*voc[^\s</]{1,9})|lombia\s*sucursal\s*virtual\s*personas)|a\s*virtual)</title>(?<X2148415>)|co\s*(?:bradesco\s*\W\s*pessoa\s*f\s*\W\s*sica,exclusive,prime\s*e\s*private|pichincha\s*\W\s*agendamiento\s*en\s*linea)</title>(?<X2210872>)|k(?:\s*of\s*america\s*\|\s*online\s*banking\s*\|\s*sitekey\s*\|\s*(?:sitekey\s*challenge\s*ques|online\s*id\s*reactiva)tion|ing\s*with\s*citi\s*\|\s*citi\.com)</title>(?<X2156373>)|k\s*of\s*america\s*(?:(?:\-\s*banking,\s*credit\s*cards,\s*(?:loans\s*and\s*merrill\s*investing|mortgages\s*and\s*auto\s*loans)|[^\w\s]{1,9}\s*banking,\s*credit\s*cards,\s*mortgages\s*and\s*investing)</title>(?<X2150396>)|(?:\|\s*online\s*banking\s*\|\s*(?:sitekey\s*\|\s*change\s*sitekey\s*challenge\s*questions\s*and\s*answers|verify\s*information|account\s*update)|\-\s*banking,credit\s*cards,home\s*loans\s*&\s*auto\s*loans)</title>(?<X2159172>)|\W\s*online\s*banking\s*\W\s*log\s*in</title>(?<X2218523>)|\|\s*(?:online\s*banking\s*\|\s*(?:forgot\s*online\s*id\s*&\s*passcode|sign\s*on\s*your\s*accounts|update\s*your\s*information)|(?:enter\s*sitekey\s*challenge\s*questions\s*and\s*answer|confirmation\s*proces)s)</title>(?<X2150404>)))|c(?:a(?:rt[^\s/<o]{1,19}o\s*de\s*cr[^\s/<d]{1,19}dito\s*\|\s*banco\s*ita[^\s/<t]{1,19}|ixa\s*econ[^\s/<m]{1,19}mica(?:\s*\|\s*mobile)?)|hase\s*(?:checking\s*accounts\s*\|\s*chase|online\s*\-\s*l[^\s/<g]{1,19}gin)|laim\s*your\s*funds\s*\-\s*gov\.uk)</title>(?<X2151285>)|c(?:hange\s*your\s*personal\s*verification\s*questions\s*\-\s*step\s*2\s*\-\s*simplii\s*financial\s*\-\s*online\s*banking|erticode\s*plus\s*\-\s*la\s*banque\s*postale\s*\-\s*gestion\s*de\s*compte\s*par\s*internet|ompte\s*ameli\s*\-\s*mon\s*espace\s*personnel)</title>(?<X2148803>)|cha(?:(?:se\s*(?:bank\s*\-\s*credit\s*cards,\s*mortgage,\s*personal\s*&\s*commercial\s*banking,\s*auto\s*loans,\s*investing\s*,\s*retirement\s*planning,\s*checking,\s*and\s*business\s*banking|verification\s*step\s*2)|nge\s*password\s*[^i</\s]{1,9}\s*instagram)</title>(?<X2156393>)|se[\s\-\|]+(?:home|login|ucard|support|Linktree|Online|Fraud)(?:[\s\-\|:&]+(?:Personal|Center|Banking|Lending|Retirement|Investing|Business|Verification|Linktree))*</title>(?<X2228833>)|se\s*online(?:\s*\-\s*(?:(?:i(?:dentifica|nstruc)ti|log)on|processing)|sm\s*\-\s*customer\s*center)?</title>(?<X2148433>))|cibc\s*mobile(?:\s*(?:banking(?:\s*sign\s*on)?|sign\s*on))?</title>(?<X2148793>)|co(?:x\s*communications\s*\-\s*residential\s*home|pyright\s*\|\s*instagram\s*help\s*center|ntinue\s*\-\s*google\s*accounts)</title>(?<X2148783>)|Config\s*Grabber\b(?<X2170411>)|d(?:kb\s*\-\s*deutsche\s*kreditbank\s*ag\s*\-\s*internet\s*banking|hl\s*\|\s*(?:tracking\s*system|global))</title>(?<X2156413>)|d(?:ropbox\s*\|\s*access\s*your\s*documents\s*from\s*any\s*device|irektnet\s*internet\s*banking\s*\-\s*raiffeisen\s*bank|hl\s*\|\s*(?:tracking|ezybill)|ocuslgn)</title>(?<X2149583>))
<(?:t(?:itle(?:\b[^>]{0,99}>(?:dhl\s*(?:\W\s*(?:confirme\s*su\s*pago\s*\.|track\s*(?:ande\s*trace|your\s*order))|express(?:\s*\W\s*(?:e\s*\W\s*currency\s*system\s*\.open\s*e\s*\W\s*wallet\s*\W\s*merchant\s*account|justfemi's\s*clone))?|globale\s*\W\s*verfolgen\s*sie\s*ihr\s*paket|login|on\s*demand\s*delivery)</title>(?<X2235422>)|e(?:nvoyer\s*mon\s*carpostal\s*depuis\s*ma\s*bo[^\st</]{1,19}te\s*aux\s*lettres\s*\|\s*carpostal|qua\s*bank\s*\-\s*modernibanka\s*bez\s*poplatk[^\s/t<a]{1,19}a\s*pro\s*ka[^\sd</t]{1,19}deho|xecution\s*de\s*votre\s*paiement\s*internet\s*securise|rste\s*bank\s*und\s*sparkassen\s*login)</title>(?<X2178072>)|fidelity\s*investments\s*(?:\-\s*retirement\s*plans,\s*investing,\s*brokerage,\s*wealth\s*management,\s*financial\s*planning\s*and\s*advice,\s*online\s*trading\.*|\|\s*verify\s*your\s*identity)</title>(?<X2169732>)|i(?:n(?:ternet(?:\-filiale\s*\-\s*kreissparkasse\s*waiblingen|\s*banking\s*\|\s*capitec\s*bank)|formation\s*[^\s/<s]{1,29}\s*secure\s*checkout\s*\-\s*apple)|tau\s*card\s*\|\s*acesso\s*online)</title>(?<X2156443>)|in(?:i(?:ci(?:ar\s*sesi[^\s/<tn]{1,19}n\s*en\s*tu\s*cuenta\s*microsoft|e\s*sesion\s*en\s*su\s*cuenta\s*paypal)|terbank\.com\s*\W\s*[^i</\stbz]{0,29}initerbank\s*zasoby\s*i\s*informacje\W?)|loggen\s*online\s*banking\s*\W\s*deutsche\s*bank\s*belgium|g\s*betaalverzoek\s*\W\s*ing)</title>(?<X2174812>)|l(?:(?:a\s*banque\s*postale\s*\-\s*compte\s*bancaire\s*en\s*ligne\s*\-\s*banque\s*[^\sl/<]{1,19}\s*l)?a\s*banque\s*postale|iberbank\s*\-\s*banca\s*a\s*distancia(?:\s*login)?)</title><[/lms!](?<X2150055>)|log(?:(?:\s*in\s*(?:(?:using\s*your\s*paypal|to\s*your\s*paypai)\s*accoun|[^\s/]{1,29}\s*snapcha)t|in\s*\-\s*anmelden\s*bei\s*ebay\s*kleinanzeigen)</title>(?<X2150455>)|(?:\s*in\s*(?:to\s*(?:facebook\s*\|\s*facebook|your\s*paypal\s*account)|bij\s*mijn\s*ing\s*\-\s*ing\s*bankieren|\|\s*wetransfer)|in\s*(?:\|\s*(?:fifth\s*third\s*bank|salesforce|eharmony)|online\-banking|\-\s*dropbox))</title>(?<X2148473>)|\s*in\s*\-\s*p(?:a|&alpha;)yp(?:a|&alpha;)l</title>(?<X2155423>))|m(?:on\s*site\s*mobile\s*\|\s*cr[^\sd/<]{1,9}dit\s*mutuel\s*de\s*bretagne\s*\-\s*banque\s*assurance|ydhl\+\s*login\s*\|\s*create\s*shipments,\s*get\s*quotes\s*and\s*courier\s*pickups|ise\s*a\s*jours\s*des\s*informations\s*personnel\s*\-\s*paypal)</title>(?<X2151304>)|ne(?:t(?:bank\s*\-\s*confirm\s*your\s*identity|flix\s*account\s*\-\s*services)|dbank\s*money)</title>(?<X2156453>)|netflix(?:\s*\-)?\s*(?:Payment|Plans[,\s]+Pricing|Betalingsinformation|Verification|billing)\b[^</]{0,40}</title>(?<X2212854>)|o(?:urtime\.com\s*\-\s*the\s*50\+\s*single\s*network(?:\s*\-\s*meet\s*50\+\s*singles\s*singles)?|tp\s*bank\s*\-\s*otpdirekt(?:\s*bel[^/\sp<]{1,19}p[^/\ss<]{1,19}s)?)</title>(?<X2150084>)|OneDrive\s*\|\s*CloudStorage</title>(?<X2166152>)|rbc\s*caribbean\s*online\s*banking\s*\-\s*login</title>(?<X2168332>)|s(?:e(?:nd\s*money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*with\s*paypal|rvices\s*fedex\s*tracking\s*\-\s*suivez\s*votre\s*colis)|bcglobal\s*login\s*:\s*sbcglobal\s*email\s*login\s*\|\s*att\s*email\s*account|ign\s*in\s*\-\s*google\s*accounts)</title>(?<X2178642>)|s(?:ecure\s*file\s*sharing,\s*storage\s*and\s*collaboration\s*\|\s*box|ign\s*in\s*(?:\|\s*we\s*transfer\W?|\-\s*pdf\s*cloud)|wisscom\s*login)</title>(?<X2150684>)|s(?:ervicios\s*financieros\s*y\s*bancarios\s*para\s*\|\s*empresas\s*\|\s*bbva\s*argentina|cotiabank\s*\-\s*(?:verify\s*your\s*identity|banca\s*por\s*internet)|ign\s*in\s*\-\s*(?:google\s*accounts|8x8\s*support|airtable)|alisbury\s*bank\s*and\s*trust\s*company)</title>(?<X2178102>)|sen(?:d\s*(?:money,\s*pay\s*online\s*or\s*set\s*up\s*a\s*merchant\s*account\s*\-\s*paypai|payments\s*or\s*pay\s*online\s*\-\s*paypai\s*sg)|iorpeoplemeet\.com\s*\-\s*(?:senior\s*singles\s*member\s*login|the\s*senior\s*people\s*network))</title>(?<X2150123>)|sign(?:(?:\s*in\s*(?:to\s*manage\s*your\s*services\s*\|\s*optimum\s*page|\-\s*&#1089;h&#1072;s&#1077;\.&#1089;&#1086;m)|in\s*outlook\s*webapp\s*settings)</title>(?<X2156495>)|\s*(?:in\s*(?:to\s*(?:onl[^\sn/]{1,9}ne\s*b[^\sn/]{1,9}nking|your\s*account)|\|\s*(?:made\-in\-china\.com|online\s*id)|[^\ss/]{1,19}\s*secure\s*checkout\s*\-\s*apple|\-\s*drop\s*box\s*accounts)|on\s*\-\s*shaw)</title>[^\$]{99}(?<X2280120>)|\s*in(?:(?:\s*\W)?(?:\s*(?:to|with|your))*\s*(?:Coinbase|(?:(?:Account|Google)\s*){2}|Outlook)\s*</title>(?<X2210113>)|\s*(?:[^\s\w]|to|or|with)(?:\s*your)?\s*(?:My\s*Virgin(?:\s*media\s*details)?|microsoft\s*account|mygov\b[^>]{0,40})</title>(?<X2236831>)|\s*(?:to\s*(?:outlook|xfinity|yahoo!|skype)|\|\s*ziprecruiter|\-\s*chase\.com)</title>(?<X2148503>)|\s*\-\s*adobe\s*files?</title>(?<X2150223>)|\s*\W\s*(?:Members\s*)?(?:1st\s*)?Federal\s*Credit\s*Union</title>(?<X2253991>)))|Tienda\s*Online\s*de\s*Correos\s*\W\s*mucho\s*m[^\s<t/s]{1,19}s\s*que\s*cartas</title>(?<X2178852>)|verify\s*your\s*paypal\s*account\s*informations</title>(?<X2183482>)|w(?:ells\s*fargo(?:\s*[^\sb/<]{1,19}\s*banking,\s*credit\s*cards,\s*loans,\s*mortgages\s*&\s*more|\s*sign\s*on\s*to\s*view\s*your\s*accounts)|hatsapp\s*[^\sp/<]{1,19}\s*payment)</title>(?<X2150494>)|wells\s*fargo\s*(?:(?:\-\s*(?:update\s*your\s*contact\s*information|sign\s*on\s*your\s*accounts|change\s*your\s*username)|sign\s*on\s*to\s*account\s*login)</title>(?<X2160062>)|\-\s*personal\s*&\s*business\s*banking\s*\-\s*student,\s*auto\s*&\s*home\s*loans\s*\-\s*investing\s*&\s*insurance</title>(?<X2148545>)|\-\s*secure\s*account\s*update</title>(?<X2170502>)|verification\s*[^\w\s]+\s*step\s*\d+\s*</title>(?<X2208473>)))|\s*>\s*FileContral\s*\w?\d\s*\.\s*\d\s*[Bb]y\s*[Ll]eslee\s*<\s*\/\s*title\s*>(?<X2120961>))|mz@localhost\.com>['"];\s*mail\([^\)]+\);\s*\$\w{1,20}\h*=\h*fopen\(['"][\./]{2,9}\bresult\.txt['"]\h*,\h*['"]a['"]\);(?<X2162361>))|updates@ourtimewhorers\.com>['"];\s*mail\s*\((?<X2065320>))
=(?:'\);return\s*base64_decode\(\$a\[\$i\]\);\s*}\s*\?>Wordpress\s*<\?php\s*\$_0(?<X2049420>)|(?:owlTrim\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\$GLOBALS\[[^\]]+\]=){5}(?<X2204331>)|(file_get_contents)\(['"](https?://www\.[a-z]omndo\.(?:xyz|com|top)/o2\.php\?)[^;\}/\)]{1,99}\)+\{\$\w{1,40}=\3\w{0,9}\(['"]\4(?<X2177860>)|=(?:==\+\+\+Coded\s+By\s+Izladen\+\+\+===(?<X2048100>)|\[BY\s+P!RA17DZ\]==(?<X2049110>)|\s*FALSE\)\s*{\s*break;\s*}\s*if\s*\(\$\w+\s*==\s*\d+ \|\|\s*\$\w+\s*===\s*\d+\s*\|\|\s*\$\w+\s*===\s*\d+\s*\)\s*{\s*\$\w+\[\$\w+\]\[(?<X2044311>))|>(?:\h*Script\h+by\h+@HossainServer\h*<=(?<X2155440>)|\s*['"]tools['"],\s*\/\*\s*available:(?:\s*(?:ls|search|upload|cmd|eval|sql|mailer|encoders|tools|processes|sysinfo),?\s*){9,11}\s*\*/(?<X2055761>)|php(version\(\))[^;]{0,199}zend_\11[^@]{99,}\{(?:\b[pes](?:hell_exec|xec|ystem|passthru)\([^\?]{1,49}){3}(?<X2214561>))|@(?:\$_COOKIE;\s*\$(?<X2043891>)|gzuncompress\s*\(\s*@base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\{\s*setcookie\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*setcookie\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}=\s*create_function(?<X2047930>))|["']link[otf]{2}door["'];\s*\$\w{1,20}=["'](doordomain)['"];\s*\$\{['"]GLOBALS["']\}[^\\@#%]{300,1500}\$\{["']GLOBALS['"]\}\[[^\]]+\]\}=['"]https?://\$\15[^@#%]{9,300}\bshuffle\((?<X2191681>)|['"](?:<(FilesMatch)\s*\\?['"]\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>;]+>\s*(?:\\n|\\r){0,9}\s*Order\s*Allow[\s,]+Deny\s*(?:\\n|\\r){0,9}\s*Deny\s*from\s*all\s*(?:\\n|\\r){0,9}\s*</\17>\s*(?:\\n|\\r){0,9}\s*<\17\b(?<X2216381>)|[_post]{5}['"];[^\?]{1,199}\bcopy\(['"]https?://[^,]+\.txt['"],[^;]+\.ph(?:p|tml?)\d*['"]\);(?<X2201551>)|\W{9,}[LVCB](?:ard|c|illing|ogin|ictim)\s*Info(?:rmation)?\b[^\?]{199,999}\$(\w{1,40})=['"]Paypal\s+[LVCB](?:ard|c|illing|ogin|ictim)\s+Info(?:rmation)?\b[^\?]{1,199}\bmail\([^\);]+\$\20\b(?<X2164861>)|anonymousfox\b[^;]{1,19}\bsubstr\(str_shuffle\(['"]\w{1,40}['"]\),\d+\);[^@]{1,199}\bgoto\s*\w{1,9};\w{1,9}:\$\w{1,40}=\w{1,9}\([^;\)]{1,99}/resetpass['"](?<X2163610>))|[cf](?:url_init|ile_get_contents)\(['"]https://(?:\w{1,40}\.)?defacer\.id/[^'"]{0,99}\bnotify\b(?<X2178561>)|\h*(?:@?get_current_user\(\);[^\?]{1,199}\$(\w{1,40})\h*=\h*@?php_uname\(\);[^\?]{1,499}\$(\w{1,40})\h*\.?=[^;]{1,99}\$\24\b[^\?]{1,499}\$(\w{1,40})\h*\.?=\h*['"]X\-Mailer\h*:\h*PHP/[^@\?]{1,199}\bmail\((?:[^\)]+\$(?:\25|\26)\b){2}(?<X2159971>)|\$_COOKIE;\s*(\$\w{1,25})[\h=]+array_merge[\h\(]+\28[\h,]+\$_[GPRSC]\w{2,6}[\h\)]+;[^\?]{0,600}\barray[\h\(]+[^=]+=>\h*phpversion[\h\)\(]+,(?<X2230983>)|n(?:ew\h+BrowserDetection\h*\(\);[^\?]{1,999}\bmail\h*\([^\?]{1,199}\bheader\h*\(\h*['"]Location:\s*https?://[^;]{1,199};\s*(?:\}\s*)*(?:die|exit)[^;]{0,19};(?<X2171152>)|um_macros\(\s*\$\{\s*\$\{(?<X2043932>)))|\s*(?:['"]\s*\[\s*\W\s*\]\s*hacked\s+by\b(?<X2163172>)|\$\w+\("",\s*\$\w+\(\$\w+\("\w+",\s*"",\s*\$\w+\.\$\w+\.\$\w+\.\$\w+\)\)\);\s*\$\w+\(\);\s*\?>(?<X2044322>)|count[\(\s]+\$_FILES\s*\[['"]Sec666(?<X2259620>)|new\s*\w{1,40}\(\d+\);\s*(\w{1,40}\[)\d+(\]\h*=\h*['"]\s*[HDS](?:eface|acke?|tampe?)d?\s*by)\b[^;]{1,99};\s*\35\d+\36\b(?<X2167253>)|remove_tags\(\s*_dl\s*\(\s*\$_(?:GET|POST|COOKIE)\s*\[(?<X2051511>))|\w+\(['"]https?://hello\.[^'"]+/[^'"/]+\.txt['"][^@]{1,1999}=stri?_replace\(['"](?:okhtmlgetcontent|getcontent\d+page)['"],['"]{2},(\$\w+)\);echo\s*\39;(?:exit|die)\b[^;]{0,19};(?<X2204491>)|array\((?:(?:['"]\^?(?:(?:\d{1,3}|\*)\.){3}(?:\d{1,3}|\*)['"],){9}[^\)]{999,9999}\);[^:<%&\^#]{9,4999}(?:exit\(|\{)header\(['"](?:Location:\s*https?://|HTTP/[\d\.]{1,3}\s*404)(?<X2128834>)|['"]us\w+['"]=>['"]\w{1,9}['"],['"]pa\w+['"]=>['"]\w{32}['"],['"]sa\w+['"]=>['"][10]['"],['"]lo\w+['"]=>['"]40[34]['"],['"]sh\w+['"]=>['"][10]['"],['"]po\w+['"]=>(?:true|false),[^;]{0,99};(?:\$\w{1,40}=['"](?:function_exists|charcodeAt|eval|gzinflate)['"];){3}(?<X2171540>))|DB_(?:PASSWORD|USER);(\$\w+)=DB_(?:PASSWORD|USER);[^\?#/%<>]{99,499}\$(\w+)=(?:\w+\()+\$_[GPCSR]\w{2,6}\[[^\?#:/%&<]{99,999}\$(\w+)=\$\44\b[^\?#:/%\}&]{1,199}\w+\((?:[^\)]*(?:\43|\$\45)\b){2}(?<X2197051>)|f(?:ile\(['"]/etc/passwd['"]\);\$(\w{1,40})=\[(?:['"]/home\d*/['"],){3}[^;]{1,99};foreach\(\$\47\s*as\s*(\$\w{1,40})\)\{[^\}]{1,199}\$(\w{1,40})=explode\(['"]:['"][^\?]{1,199}\$(\w{1,40})=\48\.\$\49\.['"]/\.accesshash['"];[^\?]{1,199}\bfile_get_contents\(\$\50\);(?<X2165072>)|open\((?:([^,;]{2,99})_[GPCSR]\w{2,6}\[[^\?]{1,499}\bfwrite\(\52\w+,[^\?]{0,199}\beval\(stri?_replace\(['"]\52['"],['"]\$['"],(?<X2216041>)|[^;]{1,99};(\$\w{1,40})=[^;]{0,99}\.(\$\w{1,40})\.['"][^;]{1,99};fwrite(\(\$\w{1,40}),\54\);fclose\56\);if\(preg_match\(['"](\W)\(?(?:\?:)?[a-z]{2,3}\)?\57\w{0,5}['"],['"\.]*\55['"\.]*\)+\{header\(['"]Location:\h*https?:[^'"]{1,99}/your\-licen[sc]e/['"]\);\}else\{echo\b[^;\}]+;\}\s*(?:\?>\s*)?\Z(?<X2177680>)))|new\s*KScam;(?<X2217001>)|proc_open\((\$\w+)\.['"]\s*2>\s*&1\b[^@\?]{1,199}\$(\w+)=new\s+COM\(['"]WScript\.shell['"]\);\$\w+=\$\61\->exec\(['"]cmd\.exe\b[^;\)]{0,19}\60\b(?<X2220890>)|str_rot13\((\$\w{1,40})\);\63=strrev\(\63\);\63=[^@\?#%&<\\\|\*\+]{1,499}['"]door\h+page\h+(?:rendered|not\h+exists?)\b(?<X2180930>)|unserialize\(string_cpt\(base64_decode\(\$\w{1,40}\),\$\w{1,40}\)\);\$\w{1,40}=\$_REQUEST(?<X2048430>))
>(?:</form>['"];\s*(?:if\h*\(\h*!\h*is_dir\h*\(\h*['"]([^'"]{2,50}/[^'"]{1,60})['"]\h*\)\h*\)\s*mkdir\h*\(\h*['"]\1['"]\h*,\h*0777\h*\);\s*){1,3}[^%&#\+]{99,600}\becho\h+['"]<meta\h+http-equiv=['"]refresh['"]\h+content=["']\d;\h*url=['"]\.\$(?<X2149771>)|[^<]{0,20}\bshell\b[^:\\]{9,250}\bif\h*\(\h*isset\h*\(\$_[GPRSC]\w{2,6}\[['"]get(?:shell\d*|door)['"]\]\)\)\s*\{\s*\w{4,20}\h*\(['"](?:wget|curl)[^://]{0,40}\bhttps?://raw\.githubusercontent\.(?<X2185121>)|[^\w]{0,15}\b[hd](?:[a4]ck[e3]d\hby|efacer)\h(?:r[o0][o0]tkit|CIVILIAN|TurkSiberKonseyi|ToxicSecTeam|Chinafans|Ayoub|SAH4ND)[^<]{0,9}<(?:/font|/?title|/?p|/div|span|o:p)>(?<X2140776>)|\h*(?:(?:banco|bank|paypal)\b[^\\\{\}]{99,400}\$scama?path[\h=]+\[[^,]{1,60}\binit\.php['"][^\{\}]{9,99}\bfunction\h+curlget\h*\((?<X2198150>)|(?:Uploader|ransomware)\h+by\b[^>/#@]{1,99}[#@][\w\-\s]{1,19}\bteam\s*</font>(?<X2174722>)|['"]\h*\.\h*\$(?:use?r(?:name)?|login)\h*\.\h*['"]<[^\$]{9,99}\.\h*\$(?:passwd|psd|pass|password)\h*\.\h*['"]<[^\?]{99,700}\$subject\s*=\s*['"]Office365\b[^\(]{99,200}mail\((?<X2138490>)|\W{0,5}M\ha\hg\he\hn\ht\ho\W{0,5}(?:Steal(?:er|ing)\h*|Information\h*){2}<(?<X2148600>)|cod[3e]d\h+by\h*:\h*rowad\h*</(?<X2143100>)|symlink.Bypass\b[^\(]{9,150}(\w{1,20})\h*=\h*open\(['"]/etc/passwd['"]\h*,\h*['"]r['"]\)\s*\10\h*=\h*\10\.read\(\)(?<X2152280>))|\s*(?:(?:https?://)?facebook\.com/ico\.phtml\s*<(?<X2133220>)|<title>[^<]{0,40}\b(?:PHP|WSO|backdoor|R57|Indoxploit|upload(?:s|er)?|Team)\s*\b(?:web)?shell\b[^<]{0,40}</title>[^\?]{1,9999}(?:<\?|\?>)(?<X2138043>)|[HPF](?:ack|uck|wned)ed\h+by\h+Thex[a@]b\d*</(?<X2160981>)|Ashiyane\s+Digital\s+Security\s+Team\b[^<]{0,40}</(?<X2126571>)|c99shell\s+(?:v|version)\.?['"](?:\.\$\w{1,20}\.['"]|[\d\.]{1,3})\s*</a>(?<X2130060>)|Da(?:3|s)s\s*(?:HaCkEr)?\s*File\s+Manager\s*(?:Version)?\s*<(?<X2057320>)|G[o0]h[a4]ck\s+T[3e][4a]m\s*<(?<X2122750>)|P(?:HP\s+eMailer\s*<br>\s*maded?\s+by\s+S[3e]Rv[A43e]r(?<X2118350>)|owered\h*by\b[^\\\{\}]{1,30}\bsellex\.pw\s*<(?<X2210121>))|S(?:UEXE\s+Bypasser\s+Via\s+Symlink(?<X2062310>)|ym[l1]ink\s+Byp[a4][5s]{2}\s+\d{4}<br>\s*<[^>]{1,20}>\s*Made\s+By\s+Mindl[3e][5s]{2}\s+Inj[3e]c[t7][0o]r(?<X2118611>)))|\W{0,9}(?:Recod|hack|fuck|defac)ed\h+by\h+Acenk40[43]\h*\-\h*Indoxploit[^<]{0,29}</(?<X2165912>)|ashshell\h+v[^\$]{0,3}\$\w{1,20}\.['"]</(?<X2140390>)|C(?:oded\s+by\b[^\}&]{1,399}(?:\.=\h*\(\h*\$\w{1,40}\h*&\h*\d{3,5}\h*\)\h*\?\h*['"]\w['"]\h*:\h*['"]\W['"];\s*(\$\w{1,40})\h*){5}[^\}]{1,399}\breturn\s+\25;[^@\{%#!\+]{1,499}\b[pe](?:rint|cho)\b[^;]{1,99}\.php_uname\(\)(?<X2169700>)|SRF\s*Exploiter\b[^\?@#]{99,1999}\bif\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^@\?#%&\*\+\|]{499,999}>\s*Mass\s*Defacer?\s*<(?<X2168051>))|Gantengers Crew<(?<X2050240>)|L[3e]g[1li][0o]n\s*(?:\w+\s*)?Exploit\b[^\?]{1,199}\bphp_uname\(\)(?<X2204612>)|mustafa\.moshkela\.19\d+@gmail\.com</(?<X2147462>)|r57shell\s*[^v]{0,9}v\s*\.\s*['"]\.\$version\.['"]\s*<(?<X2061190>)|scama?\h*priv(?:8|ate)\h+[^</\v]{1,40}</(?:font|div|script)>(?<X2173661>)|U(?:nknownSec\d*<[^@\?\}!\\#:]{1,199}\$(\w+)=[^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\?\}!@#:\[\\]{1,199}\bproc_open\(\$\33(?<X2221080>)|pload\s+Form\s+Yunkers\s+Crew<(?<X2052610>)))
@(?:(?:eval|assert)\s*/\*\*\*\*+\*/(?:[\(\s\$]+\w{1,40}){3,}\)[\s\)]+;(?<X1208550>)|(?:require|include)_once\((?:['"][^'"]*['"]\s*\.?\s*|chr\(\d+\)\s*\.?\s*){10,}\);(?<X1035941>)|(?:yandex|protonmail)\.(?:com|ru)['"];\s*(\$\w{1,20})\h*=\h*['"](?:Wells\h*Fargo|\w{1,9}\h*bank)\b[^\(]{9,99}\bmail\([^\)]+\3\b(?<X2155901>)|(['"])\$\s*\w{1,40}\h*=\h*\d+\b[^'"\\]{499,1999}\5;\s*@\w{7,40}\([^\)]{0,9}\);[^=]{0,99}\$domain\d*\h*=[^`]{40000,}\becho\h*file_get_contents\(\$\w{1,40}\);(?:[^\}]{0,99}\}){2}[^;]{0,99}\bclass_\w{1,3}\(\);(?<X1180231>)|(\$\w{1,40})(?:[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*['"]['"]\s*;\s*if[\s\(]+\7\s*[!=][^<]{999,}\becho\s*['"]<html[^\+]{99,}(\$\w{1,40})[=\s]+['"]https?://[^;]+;[^#]{999,9999}(\$\w{1,40})[=\s]+\w+[\s\(]+\8\s*,[^\}]{0,99}\bexit[\s\(]+\9[\s\)]+;(?:\s*\}){2}(?<X1220010>)|\h*=\h*(?:@?json_decode\h*\(\h*(?:trim\h*\(\h*)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\h\)]+;\s*if\h*\(\h*preg_match\h*\([^\{]{1,40}\{[^\?\}]{1,199}(\$\w{1,40})\h*=\h*@?Email(?:Text|Html)\h*\([^;\v\?]{1,99}\7[^;]+;\s*\w{1,40}\h*(?:\(\h*)?\11\h*\?(?<X2139412>)|['"]<\?[ph\s@]+eval[\s\(]+base64_decode[\s\(]+['"][a-z\d\+/]{999,}=+['"][\s\)]+;[^'"]{0,40}['"]\h*;\s*@?(\$\w{1,40})\h*=\h*fopen[\s\(]+\$\w{1,40}[\s,]+['"]a\+?['"][\s\)]+;\s*@?fwrite[\s\(]+\13[\s,]+\7[\s\)]+;[^=\{\}]{0,199}\bfclose[\s\(]+\13[\s\)]+;(?<X1196461>)))|(\$_SERVER)\s*\[['"](HTTP_ACCEPT_LANGUAGE)['"]\]\s*=\s*\15\s*\[['"]\16['"][\];\s]+if[\s\(]+(?:!\h*function_exists[\(\s'"]+getRealip[^:\n\?]{99,}\bcurl_setopt[\(\s]+\$\w+[,\s]+CURLOPT_URL[,\s]+['"]https?://['"](?:\s*\.\s*\$cl\d+ip\s*\.\s*['"]/?['"])+\s*\.[^\?\n]{9,}\bhttp_response_code\(404(?:[^\}]{1,99}\}){2}(?<X1262360>)|in_array[\(\s'"]+curl[^:\n\?]{99,}\bcurl_setopt[\(\s]+\$\w+[,\s]+CURLOPT_URL[,\s]+['"]https?://['"](?:\s*\.\s*\$cl\d+ip\s*\.\s*['"]/?['"])+\s*\.[^\?\n]{9,}\bhttp_response_code\(404\);(?<X1262370>))|/\*[^\/\n]{0,9}\*/eval(?:\s*/\*[^\/\n]{0,9}\*/)?[\(\s]+(?:\s*/\*[^\/\n]{0,9}\*/)?['"]\?>['"](?:\s*/\*[^\/\n]{0,9}\*/)?[\.\s]+(?:/\*[^\/\n]{0,9}\*/\s*)?file_get_contents(?:\s*/\*[^\/\n]{0,9}\*/)?[\(\s'"]+(?:/\*[^\/\n]{0,9}\*/\s*)?https?://[^'"]+\.txt['"]\s*(?:/\*[^\/\n]{0,9}\*/\s*)?\)\s*(?:/\*[^\/\n]{0,9}\*/\s*)?\)(?:\s*/\*[^\/\n]{0,9}\*/)?(?:\s*;)?(?<X1245470>)|['"]\$\s*(?:\w+\s*=\s*\w+\s*=\s*\w+\s*=\s*https?://[^/\s]+/[^/\s]+\.[^\?]{99,}\?\$\w+\[['"][^'"]+['"]\]:80\s*,[^\n]{99,}(\$\w+)\s*=\s*\$\w+\[\d+\][;\s\}]+echo\s*['"]\20['"][;\s]+(?:die|exit)\b[;\}\s]+\w+[\(\)\s]+;(?<X1261110>)|\w{1,40}\s*=\s*\w{1,40}\s*=\s*https?://[^/\$'"]+/[^'"]+['"]\s*;\s*\$\w+\s*=\s*explode[\s\(]+['"][^'"]+['"]\s*,[^\n]{99,}\b(?:die|exit)\b[^;]*;\}\}+\h*\w{1,40}\(\);(?<X1266220>))|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\(\s]+PACK[\(\s'"]+H\*['"]\s*,\s*['"]2f686f6d6[^;'"]+2e6(?:8746d(?:6c)?|76966|37373)['"][\s\)]+;(?<X1213342>)|[\h(]+['"]/(?:var|home)/[^'"]{0,99}/\.\w+\.mo['"][\h\)]+;(?<X1237080>)|\(['"][^'"/]+/\d+['"]\);(?<X1036722>)|\(['"]wp\-(?:includes|uploads|admin)/(?:js|css|ima?ge?)/[^'"]{1,30}/\w{1,20}\.php['"]\);(?<X1189700>)|\h*[\$\{\('"]{1,3}\\[a-fx\d]{2,3}\\[a-fx\d\\]+['"]\h*\^\h*['"]\\[a-fx\d]{2,3}\\[a-fx\d\\]+['"]\h*\)\h*;(?<X1159020>)|\h*\(?['"]/var/tmp/\d['"]\)?;(?<X1164740>)|\s*\$bcd;(?<X1230520>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\h]+base64_decode[\(\h]+@\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\?\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*:\h*['"][^'"]*['"][\)\h]+;(?<X1210280>)|\$(?:\$\w{1,40}\s*=\s*chr\(\w{1,9}\^\w{1,9}[^;]{9,99};\s*echo\s*\(\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\31e\w?.?['"]\s*,\s*strrev\(['"](?<X2124770>)|\w+\('##e'\s*,\s*"\\x[^"]+"\s*,\s*''\);(?<X2044411>)|\w{1,40}\([eval\."]{5,21}\('(?:\\x[a-fA-F0-9]{2}){10}[^\'\)]{99,999}'\);"\);\s*\Z(?<X2045082>)|_(?:[GPRSC]\w{2,6}\[[^\]]+\](?:;\s*\$\w{1,20}\h*=\h*['"][\w\-_]{1,20}\.aspx?['"];[^#]{600,1900}\$\w{1,9}\h*=\h*['"][^\$]{20,99}:\h*\$(?:email|user|login|username)[^#]{99,600}\bmail\((?<X2153382>)|\(str_rot13\h*\(\h*['"]riny\h*\(\h*\$_\w+\h*\[[^\]]+\]\h*\)\h*;\h*['"](?:\h*\)\h*){2};(?<X1035042>))|\[\]=@!\+_\s*;.+?\$_\[\s*@-_\s*\]\s*\(\s*\$_\[\s*@!\+_\s*\]\s*\)\s*;(?<X1038950>))|set_cookie\(@array\(\(string\)\$\w+\s*=>\s*\d\s*\)[,\s]+@array\(\(string\)stripslashes[\('"\}\{\.\h]+\$\w+[\./\)\s'"]+=>\s*\d\s*\)\s*,\s*@\$\w+\);(?<X1277420>))|\([\h@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]*['"][^'"\.]{1,60}\.php\d*['"][\h\)]*\);(?<X1193822>)|c(?:hmod(?:\((?:(\$\w{1,40}),0755\);\s*@unlink\(\40\);\s*\}\s*@file_put_contents\(\40,\$\w{1,40}\);\s*echo 'ok';\s*\}\s*\?>(?<X2051620>)|__FILE__,\h*\d+\);\s*(?:set_time_limit|set_time_limit)\([^\{]{9,99}\bini_set\(['"]user_agent[^\{]{99,1500}\{\s*echo\h*(file_get_contents\()[^\)]+\);\s*exit;\s*\}\s*if\h*\(preg_match[^\?]{99,300}(\$\w{1,15})\h*=\h*\42\$\w{1,15}\);\s*if\h*\(!empty\(\43\)\)\s*\{\s*return\h*\43;\s*\}\s*\}(?<X1191330>))|\h*\(\h*dirname\h*\(__FILE__\)\h*,\h*0?777\h*\)\h*;[^\.]{1,999}\.\h*(DIRECTORY_SEPARATOR)\h*\.[^`]{99,9999}=\h*@?(?:file_get_contents|fopen)\h*\(\h*\$\w{1,40}\h*\.\h*\45\h*\.(?<X2139982>))|opy(?:\(@\$_FILES\[[^\]]+\]\[[^\]]+\],@?\$_FILES\[[^\]]+\]\[[^\]]+\]\);\s*(?:echo\b[^;]+;\s*)*\Z(?<X1253911>)|\s*\((\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\48\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+echo\s*\(['"]<a\s+href=['"]\.\s*\48\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\.\s*['"]>['"]\s*\.\s*\48\s*\[[^\]]+\]\s*\[[^\]]+\]\s*\.\s*['"]</a>['"][\)\s]+;(?<X1273550>)|\s*\(\s*(?:["']https?://[^"']+["']\s*,\s*["'].+?\.ph\w+["']\s*\)\s*;(?<X1039470>)|\$_FILES\[file\]\[tmp_name\]\s*,\s*\$_FILES\[file\]\[name\]\);\s*exit;(?<X1041060>)))))
@(?:e(?:rror_reporting(?:[\(\s]+0[\)\s]+;\s*function\s*(encode)[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*for\s*\([^\^]+(\2\[\$\w{1,40}\])[\s=]+\3\s*\^\s*\$\w{1,40};[\s\}]+return\s*\2;\s*\}[^!@]{0,999}\beval\(['"]{2}\s*\.\s*\$\w{1,40}[^@]+@run[\s\(]+(\$\w{1,40})[^\}]+\}\s*else\s*\{[^;]+\1[\s\(]+\4[^\}]+\}\s*\}\s*\}(?<X2218320>)|[\s\(]+(?:false|0|null)[\)\s]+;\s*if[\s\(]+!empty[\(\s]+(\$_COOKIE\[)[^\]]+\][\)\s]+&&\s*empty[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\7\s*=\s*\6[^\]]+\];\s*echo\s*\7[;\s]+\}\s*elseif[\s\(]+empty[\s\(]+\7[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}(?<X1221890>)|\(0\);\s*@?set_time_limit\(0\);\s*(\$\w{1,40})\h*=\h*['"]%[^'"]{9,}['"];\s*\9\h*=\h*@?(?:raw)?urldecode\h*\(\h*\9\h*\)\h*;\s*\9\h*=\h*@?strrev\h*\(\h*\9\h*\)\h*;\s*@?(?:eval|assert)\h*\(\h*\9\h*\)\h*;(?<X1166860>)|\h*\(0\);\s*(@ini_set\(['"])error_log['"],NULL\);\s*\11log_errors['"],0\);\s*if\s*\(count\(\$_POST\)\s*<\s*2\)\s*\{\s*(?:die|exit)\(PHP_OS.+\$\w+\s*<\s*strlen\(\$\w+\);\s*\$\w+\++\)\s*\$\w+\s*\.=\s*chr\(ord\(\$\w+\[\$\w+\]\)\s*\^\s*2\);\s*return\s*\$\w+;\s*\}(?<X1036181>)|\s*\(\s*0\s*\)\s*;\s*@set_time_limit\s*\(\s*0\s*\)\s*;\s*(\$\w{1,40})\s*=\s*'[^']+'\s*;\s*@eval\s*\(\s*gzinflate\s*\(\s*base64_decode\s*\(\s*\13\s*\)\s*\)\s*\)\s*;(?<X2050400>))|val(?:(?:\s*/\*[^/\n]{0,9}\*/)?[\(\s]+['"][\?>]{2}['"][\.\s@]+file_get_contents(?:\s*/\*[^/\n]{0,9}\*/)?[\(\s]+(?:(?:raw)?urld?en?code[\s\(]+){3,}['"]https://[^'"]{4,}\.txt['"][\s\)]+;(?<X1239290>)|/\*[^\*]{0,499}\*/[\s\(]+(\$\w{1,40})\s*\[[\d\+\-]+\][\s\(\$\{]+\16\s*\[[\d\+\-]+\][\s\}]+s*\[[\d\+\-]+\][\s\)]+;(?<X1248350>)|/\*\*+\*/[\(\s]+['"]\?>['"][\s\.@]+\w+(?:/\*+\*/)?[\(\s]+['"]https?://bit\.ly/[a-z\d]{3,16}["'][\)\s]+;(?<X1221660>)|[\(\s@]+base64_decode[\(\s]+['"](?:aWYoQCRf|QGV2YWwoJF9)[^'"]{9,299}['"][\s\)]+;(?<X1211711>)|[\s\(@]+file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0cHM6Ly9rYXQuYWxsdGhtLmNv[^'"=]+['"\s\)=]+;(?<X1198240>)|\((?:(?:base64_decode|gzinflate|str_rot13|convert_uudecode|gzuncompress)\s*\(\s*){6,18}\(?\$\w{1,40}(?:\s*\))+(?:\s*;)(?<X1131541>)|\(\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[cmd\]\)(?<X2043601>)|POST\[['"]wp_ajx_request['"]\]\);(?<X1160040>))|\(\$r9f35db4\((?<X2053210>)|\(\s*\$unzip\(\s*\$_SESSION\[\s*'PhpCode'\s*\]\s*\)\s*\)\s*;(?<X2050000>)|\(gzinflate\(base64_decode\(\$code\)\)\);[^\?]{0,12}(?:\?>)?\Z(?<X2050811>)|\h*/\*+\*/\h*\(\h*['"]\?>['"]\h*\.\h*file_get_contents\h*/\*+\*/\h*\(\h*rawurldecode\h*\(\h*urldecode\h*\(\h*['"]https?://[^"']{9,}\.txt['"][\)\s]+;(?<X1262260>)|\h*\(\h*file_get_contents\h*\(\h*['"]https?://[^/'";]{1,49}\.xyz/[^'"\?;]{1,49}\.txt['"](?:\h*\)){2};(?<X1168240>)|\s*/\*+/\s*\(\s*(?:/\*+/\s*)?['"]\?>['"]\s*(?:/\*+/\s*)?\.\s*(?:/\*+/\s*)?file_get_contents\s*/\*+/[\(\s]+['"](?:https?://|[\\a-f\d]{40,})[^'"]+['"][^;]+;(?<X1205211>)|\s*/\*(?:[^/\n\(\);=]*\*/\s*\(\s*['"]\?>['"]\s*\.\s*@?file_get_contents\b[^;\(\)]*\([^;\(\)'"]*['"]\\[^;\)]+\)[\s\)]+;(?<X1252940>)|[^\*]*\*/\s*\(\s*/\*[^\*]*\*/\s*\$\w+\s*/\*[^\*]*\*/\s*\[\s*(?:/\*[^\*]*\*/\s*)?\d+\s*[\+\*/\-]\s*(?:/\*[^\*]*\*/\s*)?\d+\s*(?:/\*[^\*]*\*/\s*)?\]\s*(?:/\*[^\*]*\*/\s*)?\(\s*(?:/\*[^\*]*\*/\s*)?\$\w+\s*(?:/\*[^\*]*\*/\s*)?\)(?:(?:\s*/\*[^\*]*\*/)?[\)\s]*)*;(?<X1234480>))|\s*\(\s*@file_get_contents\s*\(\s*['"]https?://[^'"]{9,99}\.txt['"][\s\)]{2,5};(?<X1131052>))|xtract(?:[\(\s]+\$_[GPRC](?!GLOBALS?)\w{2,6}[\)\s]+;\h*@(?:exit|die)\b[\s\(]+(?:\$\w{1,40}[\.\s\(\)]*)+;(?<X1210140>)|\h*\(\h*\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?\h*\)\h*;\s*@(?:die|exit)\h*\(\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)\h*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\h*\$\w{1,40}[\h\)]+;(?<X1188820>)|\s*\(\s*\$_REQUEST\s*\);[^\$\(;]{0,99}@?(?:die|exit)\s*\(\s*@?\s*\$\w+\(\s*\$\w+\s*\)\s*\);(?<X1034585>)))|f(?:il(?:e_put_contents(?:\((?:['"](?:\w{1,40}\.php['"]\s*,\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/raw[^\)]{1,40}\)\)\;(?<X1041800>)|wp\-(?:admin|content|includes)/[^'"]+\.php['"],\h*['"]<\?[ph\s]+[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\\?\$_[GPRSC]\w{2,6}\[[^\]]+\]\);['"]\);(?<X1233130>))|\$_REQUEST\[['"]\w{1,2}['"]\],base64_decode\(\$_REQUEST\[['"]\w{1,2}['"]\]\)\);(?<X1242560>))|\s*\([\s\(]*\$_COOKIE\s*\[[^\]]+\][,\s@]+file_get_contents\s*\([\s\(]*\$_COOKIE\s*\[[^\]]+\][\)\s]+;(?<X1249640>))|ter_var[\(\s]+\$_[GPRSC]\w{2,6}\s*\{\s*\w+\s*\}[,\s]+FILTER_CALLBACK[,\s]+array[\(\s]+['"]options['"]\s*=>\s*\$_[GPRSC]\w{2,6}\s*\{\s*/\*\w+\*/@\s*\w{1,9}\s*\}[\)\s]+;(?<X1226560>))|puts[\(\s]+fopen[\(\s]+(base64_decode)[\(\s]+['"][^'"]+['"][\)\s,]+[wa]\+?[\),\s]+\41[\(\s'"]+PD9waHAgQG(?:Fz|V2)[^'"]+['"][\s\)]+;(?<X1198840>)|sockopen\(\$\w{1,40}\[[^\]]{1,100}\],\s*80\s*,\s*\$\w{1,40},\s*\$\w{1,40}\s*,\s*5\)\)\s*\{\s*goto\s*\w{1,40};\s*\}\s*goto(?<X2050450>)|write[\(\s]+fopen[\(\s]['"]wp\-(?:admin|includes)/[^'"]+\.(?:png|gif|jpe?g)['"]\s*,\s*['"]a\+['"][\s\)]+,\s*\$\w{1,40}[\s\)]+;(?<X1223420>))|g(?:et_current_user\h*\(\h*\)\h*;\s*(\$\w{1,40})\h*=\h*@?php_uname\h*\(\h*\)\h*;[^\?:]{9,999}(\$\w{1,40})\h*=\h*['"][^;]{0,40}\45\b[^\?]{99,999}\bmail\h*\([^;\)]+\46\h*,(?<X2172030>)|zinflate\(\s*@base64_decode\(\s*@str_replac(?<X2043981>))|header[\("'\s]+Location\s*:\s*https?://[^/]+/wp\-(?:includes|admin)/[^'"]+['"][\)\s]+;(?<X1221020>))
@(?:i(?:gnore_user_abort[\(\s]+\d+[\);\s]+\$\w{1,40}\s*=\s*\\?['"]%[^;]+;\s*\$\w+[=\s]+\\?['"]https?\\?['"]\s*;[^:\*]{99,}\bUser\-agent:\s*\*[^\*]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+\$\w{1,40}[\)\s;]+\}\s*return\s*\1[;\s]*\}(?<X1281830>)|n(?:clude(?:(?:_once)?(?:['"\(\s]+/home\d*/[^/]+/index\.php['"][\s\)]*;(?<X1209110>)|['"\s\(]+\\[\\xa-f\d]{40,}\\x2e\\x74\\x74\\x66['"\s\)]+;(?<X1214900>)|['"](?:ima?ge?s?|css\d*)/[^/]+/\d+\.(?:jpg|png|gif)['"];(?<X1215260>)|['"]images?\d*/[\w\-]{1,9}\.(?:png|jpe?g|gif)['"];(?<X1217300>)|[\$\{\('"\h]{1,4}logo\d*\.(?:png|jpe?g|gif|ico)[\$\}\)'"]{1,4};(?<X1229811>)|[\("'\s]+/home\d*/[^/]+/(?:[^;]{0,199}/)?public_html/(?:[^'";=]*\./\w+\.php["'\)\s]+;(?<X1219540>)|wp(?:\-content/plugins/|includes|admin)[^'";=]*/\w+\.php["'\)\s;\?>]+\Z(?<X1219550>))|[\(\s'"]+/home\d*/[^/]{2,}/public_html\w*/(?:\.+/)+[\w\-]+\.php['"\)\s]+;(?<X1214190>)|[\(\s'"]+\./wp\-(?:includes|admin)/class[\.\-_][a-z\d]{1,9}[\.\-_][a-z\d]{1,9}\.(?:php|txt|png|jpe?g)['"\)\s]+;(?<X1206590>)|[\(\s'"]+\\057mnt/[^/]+/[^'"\$]+/[^'"\$]+\.ico['"][\s\)]+;(?:\s*/\*[^\*]+\*/)?(?<X1230380>)|[\(\s]+['"]\\\\057home\d*\\\\057[^;]+\.(?:ico|jpe?g|gif|png)['"][\)\s]+;(?<X1241400>)|[\(\s]+['"]\d{40,}['"][\)\s]+;(?<X1212910>)|[\(\s]+pack[\(\s'"]+H\*[\s'",]+77702d[^'"]{9,99}['"][\s\)]+;(?<X1208850>)|[\h\$\{\('"]{1,4}(?:ima?ge?s?|css)\d*/(?!spacer)[\w\.\-]+\.(?:png|jpe?g|gif|ico)[\$\}\)'";\h]{1,4};(?<X1229792>)|[\s\(]*['"](?:[^\\]{0,9}\\[ x]?[a-f\d]{2,3}){4,}\w{0,3}['"][\s\)]*;(?<X1209551>)|[\s\(]*['"][^'"]{1,199}(?:\\056|\.)(?:g|\\103)(?:\\151|i)(?:\\146|f)['"][\s\)]*;(?<X1201321>)|[\s\(]*base64_decode[\(\s'"]+L2hv[^'"]{9,}(?:aW1hZ2|bWFnZXMv)[^"']+['"][\s\)]+;(?<X1234331>)|[\s\(]+["']/home/[^/]+/public_html/[/\w\.\-]{0,99}?wp\-(?:includes|admin)[^'"]*/\.[^'"/]+\.\w*["'][\)\s]+;(?<X1238371>)|\(['"]wp\-admin/includes/\w{1,9}\.php['"]\);(?<X1168100>)|\h*(?:\(\h*)?['"][^'"]{0,99}/\.(?:[^'"/]{1,49}\.txt|\.{2,})['"]\h*(?:\)\h*)?;(?<X1174875>)|\h*['"]wp\-content/[^'"]{40,}/\.?\d+\.\w+['"]\h*;(?<X1258420>)|\h*\(\h*['"][^'"]{0,8}\\x?\d{2,3}[^'"]{0,8}\\[^'"/]{1,99}/[^'"/]{1,99}\\x?\d{2,3}g?['"]\h*\)\h*;(?<X1190412>)|\h*base64_decode[\(\s]+['"][^'"\$]{1,40}(?:anBn|LmpwZw|i5wbmc|cG5n)=?=?['"][\)\s]+;(?<X1250381>)|\s*(?:\(\s*)?pack[\s\(]+['"]H\*['"][,\s]+['"]2f746d702[a-f\d]{4,199}['"][\)\s]+;(?<X1209941>)|\s*/\*(?:[^\*\n]*\*/[\(\s]+['"]/\\[^'"]+['"][\s\)]+;(?<X1249450>)|[^\*]*\*/[\s\(]+['"]/home\d*/[^\)]+/\.[a-f\d][^/]+['"][\s\)]+;(?<X1249310>)|[^\n\*]{0,40}\*/[\(\s'"]+/[^;\.\)'"]+/\.[^\.]+\.\w{1,3}['"][\s\)]+;(?<X1251100>)|[^\n\*]{0,9}\*/\s*\(\s*['"]/[^'"\\]*\\x?\d{2}[^'"\n]{9,}/\.[^'"]+\.\w{1,9}['"][\s\)]+;(?<X1253770>))|\s*['"]wp\-[^'"]+/\d+\.log['"]\s*;(?:\s*@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+;)?(?<X1252880>)|\s*[\('"]\s*[^;/]{0,40}\s*\.\s*['"]?[^'"]{1,40}\.(?:xlsx|doc|docx|pdf|gif|jpg|png|ico|sql|zip|jpeg|gz|log|key|bmp|ini)(?:\s*[\)'"]\s*){1,2};(?<X1063823>)|\s*\([\("'\s]+\w{1,12}\.css["'\)\s]+;(?<X1214043>)|\s*ABSPATH\s*\.\s*WPINC\s*\.\s*['"][^'"\(\);]{1,199}\.(?:png|jpe?g|ico|gif|bmp|ttf\d*)['"\s\);\?>]+\Z(?<X1218390>)|\s*base64_decode(?:[\(\s]+['"]L2hvbW[^'"]{3,199}['"][\)\s;>\?]+\Z(?<X1238780>)|\(['"]L[^'"]{1,256}(?:LnR0Zg|LnBuZw)==['"]\);(?<X1248582>))|\s+base64_decode(?:[\(\s]+['"]L2hvbW[^'"]{9,99}dGY=['"][\s\)]+;(?<X1226480>)|\(['"]YXBwbGljYXRpb24vZm9vdGVyLnBuZw==['"]\);(?<X1269940>)))|(?:[\(\s]+PACK[\(\s]+['"]\w\*['"],['"]\w*2e6a7067['"][\)\s]+;(?<X1210054>)|\s*/\*[^\*]*\*/[\(\s]+["']/var/[^'"]{9,}['"][\s\)]+;(?<X1249480>)|\s+base64_decode[\(\s]+['"][^'"\$\(\),]+wbmc={0,2}['"][\)\s]+;(?<X1261370>)|_once(?:[\('"\s]+[\./]+['"\)\s]+;(?<X1198700>)|[\(\h'"]+ima?ge?s?/[^;'"]{1,40}\.(?:gif|jpe?g|png)['"\)\h]+;(?<X1189710>)|[\(\s'"]+/home\d*/[^/]+/public_html/[^;]*wp\-(?:includes|admin)/[^;]*(?:js|css|ima?ge?s?)\d*[^;]+\.php['\s"\)]+;(?<X1193490>)|[\(\s]+PACK[\(\s]+['"]H\*['"],['"]2f[^'"]{1,199}2e6a73['"][\s\)]+;(?<X1261630>)|\h*\(['"]/home/[^/]{1,40}/\.cache/(?:\w{1,40}/){0,9}[^\s\w/]{1,9}['"]\h*\)\h*;(?<X1174240>)|\h*\(\h*ABSPATH\h*\.\h*['"]wp\-[^'"]{0,59}\.(?:png|gif|jpe?g|ico|css)['"]\h*\);(?<X1187510>))))|i_set(?:([\(\s]+)[^,]+,\s*['"]0['"]([\)\s]+);\s*error_\w+\48[0]\49;\s*if\s*\48\!(function)_exists\48['"](\w+)['"]\49+[\s\{]+[^=]+\50\s*\51[^=]+(\$\w{1,40})[^\}]+return\s*\52[^\?]{1,400}return\s*\52;[^!]+\bif\s*\48!\50_exists\48['"](wp_cd)['"][^\$]+\50\s*\53\48(\$\w{1,40})[^\}]+\}\s*return\s*\54\^\$\w{1,40};[\s\}]+(?<X1218241>)|\(['"]\\[^\n\*><!]{99,999}\bif[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h\{]+if[\(\s]+file_exists[\(\s]+\$_FILES\[[^\]]+\]\s*\[[^\]]+\][\)\s]+\{\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\][^@\n]{9,999}@fopen\s*\([\s\$\{]+['"][^\?\n]{99,}&&\$_SERVER\[[^\}]+\}\s*echo\s*['"][^;]+;\s*\}(?<X1240310>)|\(['"]display_errors['"],\h*['"]0['"]\);\h*error_reporting\(0\);\h*(\$\w{1,14})[\s='"]+st[^;]{1,20};\h*(\$\w{1,14})[\s='"]+url[^;]{1,20};\h*\$\w{1,14}[\s='"]+\57\(\58[^\[]{1,200}stream_context_create[^<]{1,450}session_cache_[^<]{1,100}<\?php\h*['"\h\.]+\$\w{1,14}[^;]{1,10};\h*[^;]{1,20};[^;]{1,20};\h*unlink\(\$\w{1,14}\);(?<X1285500>)|\h*\(\h*["']display_errors['"]\h*,\h*['"]0['"]\h*\);\s*\$\w{1,40}\h*=\h*['"]\\[^\?]{99,999}@\((\$\w{1,9}\[)\d+\]\h*!=\h*\60\d+\]\)\h*\?\h*@\60\d+\][^\?]{99,999}fwrite\((\$\w{1,40})\h*,\h*\\?['"]\h*<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;\s*fclose\(\61\);\s*@?include(\([^\)]{1,60}\));\s*@?unlink\62;(?<X1139750>))))|m(?:ail\((?:[^\)]+\);\s*header\(['"]Location:\h*[^\?;]{1,20}/\w{1,20}\.php\?websrc=['"]\.md5\((?<X2150261>)|\s*\$_POST\['emailfinal'\]\s*,\s*\$_SERVER\['HTTP_HOST(?<X2049040>))|kdir(?:\("ByPassSym"\);\s*@chdir\("ByPassSym"\);\s*@exec(?<X2048660>)|\h*\(\h*['"]\./['"]\h*\.\h*\$\w{1,40}\h*\);\s*\$\w{1,40}\h*=\h*['"]https?://['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"](moban\.html)['"];[^\{\}]{1,199}file_put_contents\h*\([^;]{1,99}\67(?<X2146760>))|ove_uploaded_file(?:.+?echo"<center><b>Done ==> \$userfile_name</b></center>(?<X2045031>)|\(\$userfile_tmp\s*,\s*\$qx\);\s*@chmod\s*\(\$qx\s*,\s*octdec\(\s*\$mode\s*\)\s*\);(?<X2047820>)))|null;\s*@?eval[\(\s]+str_rot13[\(\s]+gzuncompress[\(\s]+base64_decode[\(\s]+['"][^'"]{99,}['"][\s\)]+;\h*eval[\s\\(]+(?:\$?\w+[\s\(]+)+['"][^'"]{99,}['"][\s\)]+;(?<X1258880>)|ob_end_clean\(\);\s*\}\s*elseif(?:\(@is_resource\(\$f\s*=\s*@popen\(\$cfe\s*,\s*"r"\s*\)\)\)\s*\{(?<X2050120>)|\s*\(\s*@?is_resource\s*\(\s*\$\w{1,40}\s*=\s*@?popen\(\s*\$\w{1,40},\s*['"]\w[^\w]?['"]\s*\)\s*\)\s*\)\s*\{\s*\$res(?<X2055231>))|p(?:cntl_exec\s*\(\s*"/bin/sh"\s*,\s*Array\("-c",\$arg\)\);\s*\}\s*else\s*\{@pcntl_waitpid\(\$p,(?<X2049810>)|reg_replace(?:\(\s*(?:['"](?:\\\w{2,3}){11,40}['"]\s*,\s*['"]\\(?:x65|145)\\(?:x76|166)\\(?:x61|141)\\(?:x6c|154)(?:\\\w{2,3}){80,99}['"]\s*,\s*['"](?:\\\w{2,3}){99,110}['"]\);(?<X1056741>)|\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*,\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*\.\s*\$exif\[[^\]]+\]\s*,\s*''\s*\);(?<X1040820>))|(?:\h*\(\h*.?['"](.).{0,40}?\77(['"]\h*\.\h*['"])e\78\w?.?['"]\h*,\h*['"]\\[\\a-fx\d]{8,99}['"][^'"\s]{999,9999}['"]\\[\\a-fx\d]{8,99}['"]\h*,\h*['"]\d+['"]\h*\)\h*;(?<X1177910>)|\s*\(\s*.?['"](.).{0,40}\80e\w?.?['"]\s*,\s*['"]\\x[^'"]{9,199}['"][^'"]+['"][^'"]{9,199}['"]\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1125270>))))|re(?:gister_shutdown_function[\(\h]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\{['"][^'"]+['"]\}[\h,]+\$\{['"]_[GPRSC]\w{2,6}['"]\}\{['"][^'"]+['"]\}[\)\h]+;(?<X1195670>)|quire(?:(?:once)?\s+__DIR__\s*\.\s*['"]/s\w{0,9}\.png['"];(?<X1234510>)|\('\./images/\d+'\);(?<X1038760>)|_once\(['"]/(?:var|home|srv)[^'"]{9,199}\.ico['"]\);(?<X1260720>))))
@(?:s(?:e(?:ssion_start\(\);\s*@?error_reporting\((?:0|NULL)\);\s*\$user_agent\s*=\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*function\s+getOS\(\)\s*\{[^\(]{0,99}(\$os_array)\s*=\s*array\([^\)]+\);\s*foreach\s*\(\1(?<X2120100>)|t_time_limit(?:[\(\s]+(?:0[\)\s;]+class\s*(\w+)[\s\{]+private\s*\$\w{1,40}[\s;]+public\s*function\s*__con[^\*\n]{9,9999}(\$\w{1,40})[=\s]+new\s*\3[\(\)\s;]+\4\->\w+[\(\)\s;]+if[\(\s]+!class_e\w+[\(\s]+['"]([^'"]+)['"][^\n\*]{9,}\b(?:exit|die)[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\5[\(\)\s;]+\6[=\s]+NULL[\s;]+\}(?<X1248110>)|\d+[\);\s]+define[\(\s]+['"]\w{1,9}['"][,\s]+['"]https?://\w{1,9}\.(?:allstage|lessopen)\.(?:ru|shop)['"\)\s]+;[^\n]{99,9999}(\$\w{1,40})[=\s]+\w{1,40}[\(\s]+['"]['"][,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+\8[\)\s]+\{\s*@?(?:exit|die)\b[^;]*;\s*\}(?<X1237661>)|\d+[\)\s;]+define[\(\s]+['"](?:[^'"]{1,3}['"][,\s]+['"]https?://[^'"]{3,}['"][\)\s]+;[^\?]{0,99}\breturn\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*['"]['"]\s*;[^\*]{999,9999}(\$\w{1,40})[=\s]+\w+[\(\s]+['"]['"][,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+\10[\)\s]+(?:exit|die)\b[^;]{0,19};(?<X1227600>)|\w{1,2}['",\s]+http://[^'"]{3,}['"][^\{\}]{9,199}function\s*\w+[\(\s]+(\$\w{1,40})[\)\s\{]+return\s*@(\$_SERVER\[\12\])\s*\?\s*\13[:'"\s;]+\}[^\n<]{99,}\becho\s*\$\w[^;]+;\s*\}[^\?]{9,499}if[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(?:exit|die)[\s\(]+\14[^;]*;\s*\}(?<X1245510>))|\d+[\)\s]+;\h*@ignore_user_abort[\(\s]\d+[\)\s]+;\s*\$\w{1,40}[=\s]+['"][^@\n]{9,9999}@\$_[GPRSC]\w{2,6}\s*\[\s*['"]\\[^:;]+;[^\n]{99,}\bgoto\h+\w{3,9};(?:\h+\w{3,9}:)+\h*\}(?<X1238240>)|\d+[\)\s]+;\s*define[\(\s]+['"]\w+['"][,\s]+['"]https?://[^'"]+['"][\)\s]+;[^\\\n@]{9,999}@\$_SERVER\[\$[^\n\*%]{999,}(\$\w{1,40})[=\s]+\w+[\(\s]+['"][/\?\*#]['"][,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\17[\)\s]+\{\s*(?:exit|die)[\s\(]+\17[\s\)]+;\s*\}(?<X1238590>))|\((?:0\);array_walk\(\$_COOKIE,"[^"]{1,100}"\);array_walk\(\$_POST,"[^"]{1,100}"\);function\s*enumerator(?<X2048550>)|\(int\)RoUnD\((?:[^;]+;[^\n\*]{99,}\bif[\(\s]+\$?\w+[\(\)\s]+\{\s*(?:\$\w{1,40}\s*\[[^\]]+\]\s*=\s*['"][^'"]*['"]\s*;|\b(?:exit|die)\b[^;]*\$\w{1,40}[^;]*;\s*)\s*\}\s*;(?<X1249470>)|[^\n]{999,}\$\w+\s*\[[^\]]+\]\s*=\s*['"]\\?[\dx]+['"][;\s]+\}(?<X1250940>))|\s*0\s*\)\s*;\s*if\(\s*\$lim\s*>\s*100\s*\)\s*break\s*;\s*\$d\s*=\s*\$startDir\s*\.\s*\$one_dir;(?<X2047770>))|\s*\(\s*\((?:[\s\(]*\d+\s*[^\)'"\w][^\n]{999,}\$\w+\s*\[[^\]]+\]\s*=\s*['"]\\?[\dx]+['"][;\s]+\}(?<X1250960>)|[^;\+\-]*\d+\s*[\-\+][^;]+;\s*define\s*\([^\n]{99,}\bif[\(\s]+\w+[\(\s]+['"]HTTP[^\}]+\}(?<X1249660>))|\s*\(\s*\d+[\);\s@]+ignore_user_abort\s*\([^\)]+\)[;\s]+\$\w+\s*=\s*base64_decode\s*\(['"][^'"]+['"]\);[^\n\*/]{99,}\bif[\(\s]+!\h*(\$\w+)[\)\s]+\{\s*\25[=\h]+@file_get_contents[\(\s]+\$\w+[\);\s]+\}\s*return\s*\25[;\s]+\}(?<X1262142>)))|y(?:mlink\('/home/' \. \$user \. '/public_html/wp-config\.php', \$user(?<X2051490>)|stem(?:\("killall\s+-9\s+"\.basename\("/usr/bin/host"\)\);(?<X2047210>)|\h*\((?:['"][^'"]{1,99}['"]\);\s*\$\w{1,40}\h*=\h*file_get_contents\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\h*\)\h*;\s*while\h*\(\h*(?:true|1)\h*\)\s*\{(?<X2181480>)|\h*['"]killall\h+\-9\h*['"]\h*\.\h*(?:\$\w{1,40}|basename\h*\(\h*['"][^'"]+['"]\h*\))\h*\)\h*;\s*\$so(?:32|64)\h*=\h*['"][^'"]{9999,}['"];\s*\$so(?:32|64)\h*=\h*['"](?<X2141011>)))))|unlink\((?:['"]tmp/['"][^\?]{99,699}<TITLE>\s*(?:The\s+page\s+cannot\s+be\s+found|404\s+(?:page\s+)?Not\s+Found)(?<X2124721>)|\$\{\$\{['"][GOBALS\\x\da-f]{9,28}['"]\}\[[^\]]+\]\}\);[^@\(]{0,499}(?:\b(?:[pes](?:assthru|ystem|xec|hell_exec|open))\(['"][\\x\da-f]{9,99}['"]\);\h*){2,}\$[^=]{1,40}=\h*file_get_contents\h*\((?<X2182850>)|_FILE_\);\s*@?(?:eval|assert)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*phpinfo\(\);(?<X1134932>)))
[#]{2}\s*ReCoded\s*By\s*Syechrul\s*Imam(?<X2054240>)
['"]color:#\w{1,9}['"]\s*>\W{0,9}pr[i1]v(?:[a4][7t][3e]|8)\s+m[i1]n[1i]\s*w[3e]b[s5]h[3e][l1]{2}\b(?<X2130960>)
[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(\s*\$_SERVER\[\s*'DOCUMENT_ROOT'\s*\]\s*\.\s*'[\w/_0%]{0,200}\.(?:jpg|gif|jpeg|bmp)'\s*\)\s*;(?<X1041011>)
\$(?:((?:email|login|user|username|uname|loginID)\w?)\s*=\s*\$_POST\[['"]\1['"]\];\s*\$((?:pass|password|passwd|psw|pwd)\w?)\s*=\s*\$_POST\[['"]\2['"]\];\s*[^\+]{1,400}\$message\s*=\s*['"]\s*[^\}]{1,200}(?:FACEBOOK|GOOGLE)(?<X2054793>)|((?:open_cache_ruzhu|huan_yuan)\w+)[\s=]+base64_decode[\s\(]+['"][^;]+;\s*\$\w+[\s=]+@?(file_)ge(t_contents)[\s\(]+(\S[^\)]+)\s*\);\s*if\s*\([^;\{]{1,199}\{\s*(@?chmod[\s\(]+\7)[^;]+;\s*@?\5pu\6[\s\(]+\7[\s,]+\$\4[\s\)]+;\s*\8[^;]+;\s*\}(?<X1202051>)|(?:\w+[\s=]+['"](?:[\w\-\.]{1,19}\|){10}[^'"]{999,}['"];\s*\$){2}[^\?]{1,999}(\$\w+)[\s=@]+(file_)ge(t_contents)[\s\(]+['"]https?://[^;]+;[\s\}@]+\11pu\12\s*\(([^;,]+),\s*\10[\s\);]+\}\s*else[\s\{]+\10[\s=@]+\11ge\12[\s\(]+\13[\s\)]+;[\s\}]+setcookie\s*\([^;]+;\s*header[\s\(]+['"]Location\s*:[^;]+\10\b[^;]+;\s*exit;\s*\}(?<X1222410>)|(?:auth)?_?pass=['"]\w{4,400}['"];\$\w{1,40}=\(['"]\?>['"]\.(?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\(){1,5}['"](?<X2125830>)|(?:auth_)?(?:password|psw|pass|pswd|pwd)\h*=\h*['"][a-z0-9]{32}['"];[^\{]{0,150}\bfunction\h+login_shell\(\)\s*\{(?<X2168501>)|(?:auth|s)?_?pass\h*=\h*['"](?:\w{24,40}['"];\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{50000,}['"];\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(|function\h+login\w?shell\b)(?<X2055622>)|\w{32}['"];[^\(]{99,200}(?:preg_replace(?:_callback)?|\$\w{1,20})\h*\(['"](.)[^'"]{0,2}\18e['"]\h*,\h*['"](?<X2149461>))|(?:auth|s)_pass\h*=\h*['"](?:[a-f\d]{32}['"];\s*function\h*wsoLogin\h*\(\)(?<X2170052>)|\w{4,40}['"];[^=\$\{\}\[\]@]{0,99}\$color\h*=\h*['"]#[a-f\d]{6}['"]\h*;(?:[^=\$]{0,99}\$\w{1,40}\h*=\h*['"]#[a-f\d]{6}['"]\h*;){2}(?<X2168072>))|(?:bot){3,}[=\s]+\d+\s*;\s*@?error_reporting[\s\(]+0[\)\s]+;[^!\n]{99,999}\bif[\s\(]+!(\$\w{1,40})[^!\n]{9,499}\bfwrite[\(\s]+\22[^\}\n]{9,499}(\$\w{1,40})\s*=[^;]+\22[^\]\n]{9,499}\23[\s=]+\23\[\d+\]\s*;\s*echo\s*\23\s*;\s*\}\s*\}(?<X1238880>)|(?:data|message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{0,20}World\h+of\h+hack\h+Scama\b(?<X2159890>)|(?:dos|file|shell|backdoor)\s*=\s*file_get_contents\s*\(['"]https?://r00t\.info/txt/[^"']+['"]\);(?<X2123060>)|(?:headers?|from)\h*=\h*['"]From:\h*(?:Just\h+Scampage|Invi[sz]ible\h+Dbox)\h*<[^@]{2,20}@\w{2,20}\.\w{2,6}>['"];(?<X2161651>)|(?:me?sg|message|bilsmg)\h*=\h*['"]\W{0,15}Office365[^;]{0,49};[^\}]{0,199}\bmail\h*\([^\)]{0,150}\);\s*header\h*\(['"]?Location\b(?<X2175030>)|(?:message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{1,20}(?:created|made|fucked)?\h*by\h+SweezThaCreator\b(?<X2155730>)|(?:message|data|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{5,20}(?:Hacked|F[uc]{2}ked|Pwned)\h+by\b(?<X2154230>)|(?:message|msg|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\D{0,20}\bBy\h+Slo!(?<X2152271>)|(?:message|msg|bilsmg|f[uc]{2}k)(?:\.=['"]\W{1,20}\bCreated\h+by\h+xFighter\b(?<X2145370>)|\h*\.\h*=\h*['"](?:[\w\s]{2,30}\bby\h+4gb4\h*\\n['"];(?<X2144080>)|\W{0,30}\bCreated\h+by\h+OVo.360\b\W{0,30}\\n['"];(?<X2165660>)))|(?:msg|bilsmg|fuck|message)\h*\.\h*=\h*['"]\W{0,30}WELLS\h*(?:fargo\h*)?card[s2z]\h*re[sz]ults?\h*by\b(?<X2141740>)|(?:msg|message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"][^\$;@]{9,70}:[^\$;@]{1,9}\$(?:id|login|username|user|uname|email|user)\b[^:\$;]{5,70}:[^\$;@]{1,9}\$(?:password|pass|pswd|pwd)\b[^@\\]{9,200}['"][^@;'"]{2,20}@(?:yandex|protonmail)\.(?:com|ru)\b(?<X2155990>)|(?:msg|message|bilsmsg)\h*\.?\h*=\h*['"]\W{0,60}Carders?\h+inc\b[^'"]{0,60}\\n['"];(?<X2141340>)|(?:out|name|title)\s*\.?=\s*['"](?:Otrasher\s*DDOS\s*Tool|Pacman\s+Corp\s+Backdoor)\b(?<X2123031>)|(?:Playme|message)\s*\.=\s*['"]\W{0,30}Scama\s+Amazon\s+By\s+Salah\W{0,30}\\n['"];(?<X2121480>)|(?:subj|subject)\s*=\s*['"](?:New)?\s*Office\s+365\s+Login[^'"]+['"];\s*\$(?:msg|message|body|content)\s*=\s*['"]Email:\s*\$(?:uname|username|user|e?mail)\D{1,3}Password:\s*\$(?:password|pwd|passwd|pass)[^;]+;[^\(]{1,40}mail\([^\)]+\);(?<X2119890>)|(?:Team|Squad)\s*=\s*['"]\D{0,4}System\s+Crashers\D{0,4}['"];(?<X2122920>)|(?:username|user|login|uname|card(?:\h*number)?)\h*\.?\h*=\h*\$_POST\h*\[['"](?:emailadd|username|user|login|uname|card(?:\h*number)?|[cv]{3})['"]\];[^@]{9,150}=\h*['"][^@]{2,20}@(?:yandex|protonmail)\.(?:com|ru)\b(?<X2155680>)|(?:user|username|login|email)\h*=\h*(\$_POST\[)['"](?:user|username|login|email)['"]\];\s*\$(?:password|pass|secret|pwd|passwd)\h*=\h*\43['"](?:password|pass|secret|pwd|passwd)['"]\];[^\?]{99,500}\b(?:mail\([^\)]+\);\s*){2}header\((?<X2147221>)|(?:web\h*.)?shell(?:.name)?\h*=\h*['"]\w{1,5}shell\h*Ordered\h*from\b(?<X2173820>)|([^;=\s]+)=[^;]+\.php\d*['"];(\$\w+)=file_ge(t_contents)\([^;]+\.(?:png|jpe?g|gif|bmp)['"]\);[^\}\?]{1,499}\$(\w+)=fopen\(\$\46,[^;]+;f(?:puts|write|ile_pu\48)\(\$\49,\47\);(?<X2205741>)|([ms][au](?:ilsubj?|bject))\h*=\h*['"](?:(?:Soapy|box)\s+\-\s+GMAIL|Welcome\s+(?:Log[sz]|Result[sz]?)|More\s+toh?\s+come)[^;]{0,49};[^\?]{1,99}\bmail\([^\)]+\$\51\b(?<X2147342>))
\$(?:(\w+)(?:=(?:['"](?:[^;'"]+\.exe['"];[^\?]{0,199}\b(?:(?<=\$)(\w+)=fopen\(\$\1,[^;]+;fwrite\(\$\2|file_put_contents\(\$\1),\$\w+\);(?<X2215771>)|a:1:\{s:13:['"]administrator['"][^\}]{0,99}\}[^'"]{0,99}['"];mysqli?_query\(\$\w+,['"]INSERT\s+INTO\s+['"\.\s\`]+\$\w+[\s\.'"\`]+usermeta['"\`\s]+\([^;]+\$\1\b(?<X2215422>)|f0VMRg[^'"]{999,}['"];[^\?]{0,999}\bfile_put_contents\(['"]([^'"]+)['"],base64_decode\(\$\1\)[^\?]{1,999}\bputenv\(['"]\w+=\5['"](?<X2209271>)|Z29vZ2xlLXNpdGUtdmVyaWZpY2F0aW9uOi[^\?]{0,199}\bfile_put_contents\([^,\)]+,\w+\(\$\1\)[^\?]{1,99}\bunlink\(['"]([^'"]+\.php)['"]\);[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]rm\s+\-[rf]{2}\s+\7[;'"](?<X2215341>))|\$_[GPCSR]\w{2,6}(?:;[^\?]{0,499}\bfile_put_contents\([^\),;]+,\$\1\[[^\?]{0,499}\bunlink\(__FILE__\)(?<X2208121>)|\[[^;]+;(?:[^\?]{0,99}\$(\w+)=fopen\([^,]+\.htaccess['"],[^;]+;(\$\w+)=['"]ReadMeName\s*\$\1['"];fwrite\(\$\10,(?:\w+\()*\11\)+;(?<X2204531>)|putenv\(['"]LD_PRELOAD=['"]?\.\$\1\b[^\?]{1,499}\bfile_get_contents(\(\$\w+\))[^\?]{1,99}\bunlink\13(?<X2215731>))|\[[^\?]{1,99}\b(?:header\(['"][\w\-]+:[^:]{1,99}\);){3,}readfile\(\$\1\);(?:exit|die)\b[^;]{0,19};[^\?]{0,499}=fileperms\((?<X2216031>))|\$ARGV\[(?:[^;]+;(\$\w+)=Net::FTP\->new\(['"]\$\1['"][^;]+;[^;]{0,199}\16\->login\((['"]anonymous['"]),\17(?<X2211641>)|\d+\][^\?]{1,199}\bconnect\(SERVER,[^\);]+\$\1\b[^\?]{1,199}\bexec\{['"]/(?:usr/(?:local/)?)?bin/(?:ba|tc|k)?sh['"](?<X2204641>))|\w+\(['"]https?://(?:[^'"]+\.aspx\?[^;]+;[^\?\{]{1,499}\bif\((stri?pos\()(?:\$\1,[^\{;\(]{1,49}\b\20){4}[^;]{1,999}\{[^\}]{0,199}\becho\s*['"]<script\b[^>]{0,199}>\s*(?:\w+\.){0,3}location(?:\.(?:href|replace))?=[^</]{1,199}</script>['"];exit\b[^;]{0,19};(?<X2216831>)|[^;]+;\$\w+=eval\(['"](?:\?>|<\?)['"]\.\$\1\);(?<X2201651>))|curl_exec\(\$\w+\);[^\?]{0,499}=(\$\w+)\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/['"]\.(\$\w+),\$\1\);[^\?]{0,499}=\23\(\24,\$\1\);\}?[^\?\}]{0,499}\becho\s*\$\w+;\s*\$\w+\(\);\}+add_action\([^;]+;(?:\?>)?\Z(?<X2212482>)|file_get_contents\((?:['"]php://input['"][^\?]{1,499}\$(\w+)=(\w+\()\$\26(,\$\w+\);)(?:\s*\w+:){0,3}\W*eval\(\$\26\);echo\s*\27@?run\(\$\1\)\28(?<X2209872>)|['']https?://[^\?]{1,199}\$(\w+)=fopen\((\$\w+),[^;]+;fwrite\(\$\30,(?:\w+\(){0,9}\$\1\)[^\?]{0,499}\bforeach\([^\{]{1,199}\{[^\}]{0,199}\bcopy\(\31,(?<X2215961>))|glob\(['"]\*['"][^\{\}\?]{1,499}\bforeach\(\$\1\s*as\s*(\$\w+)\)\{[^\?]{1,499}\b[cm]o(?:py|ve_uploaded_file)\([^,;]+,['"]?\33\b(?<X2204771>)|implode\(['"]{2},array_map\(['"]\w+['"],str_split\([^\?]{1,199}\$(\w+)=file_get_contents\(\$\1\b[^\?]{1,499}\becho\s*\$\35;(?<X2216221>)|stream_get_meta_data\([^;]+;\W+[ir](?:nclud|equir)e(?:_once)?\s*\(?(\$\1\[[^\]]+\])[^\?]{1,499}\bunlink\(\37\);(?:die|exit)\b[^;]{0,19};(?<X2209811>))|[\h=]+(?:@?file_get_contents[\s\(]+['"]https?://webr00t\.info/[^;]+;\s*echo\s*\$\1;(?<X1206880>)|['"][^'"]{1,9}['"]\s*\^\s*['"][^'"]+['"];\h*(\$\w+)[\h=]+\$\{\$\1\}\[[^\]]+\];\h*@?eval[\h\(]+(?:['"]{2}[\h\.]+)?\40[\h\)]+;(?<X1216080>))|[\s=]+(?:(?:\$\w+\s*\.){3,}\$\w+;\s*if\s*\([^\{;]+\$_[GPCSR]\w{2,6}\[[^\{;]+\{\s*(?:(\$\w+)[\s=]+\$?\w+[\s\(]+['"]https?://[^/'"]+\.(?:top|xyz|cn|pl)/[^'"]+\.txt['"][\s\)]+;\s*)+(\$\w+)[\s=]+\$_[GCSPR]\w{2,6}\[[^;]+;[^\?]{0,199}\$\1[\s\(]+\43\b[^,;]+\.(?:php|htaccess)['"][\s,]+\42[\s\)]+;\s*\}(?<X1210650>)|(?:\$\w+|str_rot13)[\s\(]+['"]uggcf?://[^;]+;[^\?\{\}]{0,199}\b(curl_)setopt[\s\(]+(\$\w+)[,\s]+CURLOPT_URL[\s,]+\$\1[\s\)]+;[^\?\{\}]{0,199}\$(\w+)\s*=[^;]{0,199}\45exec[\s\(]+\46[\s\)]+;[^\}\{\?]{0,199}\bif\s*\([^\{;]{0,199}\$\47\b[^\{;]{1,199}\{\s*@?eval[\s\(]+\$\47[\s\)]+;\s*\}(?<X1212500>)|(?:\[|Array\s*\()\s*['"]https?://[^/]*\bgithub[^'"/]+/[^\?]{1,499}\bfwrite[\s\(]+\$\w+[,\s]+(\w+)[\s\(]+\$\1\[0\][^\?]{1,499}\bfunction\s+\49\s*\([^\{]{1,99}\{[^\}]+\bcurl_exec\s*\([^\}]+\}(?<X1202001>)|@?(?:(curl_)init[\s\(]+(?:\$?\w+[\s\(]+)*\$_[GPCSR]\w{2,6}\[[^\?\}=]{1,499}\$(\w+)[\s=]+@?\51exec[\s\(]+\$\1[\s\)]+;\s*@?eval\s*\([^\);]*\$\52\b[^;]*;\s*(?:die|exit)\b[^;]{0,19};(?<X1209760>)|\$_[RGPCS]\w{2,6}\[[^;]+;\s*(?:(\$\w+)[\s=]+['"][^;]+;\s*)+\54\s*=[^;]+['"]ukey['"];[^\?]{0,499}\54\s*\([^;]+,\s*@?\$\1[\s\)]+;[\s\}]+else[\s\{]+@?\54\s*\([^;]+,\s*@?\$\1[\s\)]+;(?:\s*\}){1,2}(?!\s*else)(?<X1213900>)|filemtime[\s\(]+['"]([^'"]{0,49}\bwp\-(?:admin|includes)\b[^'"]{0,49})['"][\s\)]+;(?:\s*if\s*\([^\)'"]{0,49}['"]((\56\b[^'"]{0,49})/[^'"/]{0,199})['"][\s\)]+\{\s*@?unlink[\s\(]+['"]\57['"][\s\)]+;\s*@?touch[\s\(]+['"]\58['"][\s,]+\$\1[\s\)]+;\s*\}){5,}(?<X1197910>)|fsockopen[\s\(]+['"][^'"]+\.ngrok\.io['"][,\s]+\d+[\s\)];\s*\$\w+[\s=]+@?proc_open\s*\([^;,]+,\s*(?:array\(|\[|\{)[^,;]*\$\1\b[^\]\}\);]+[\]\}\)][^;]+;(?<X1211180>)|str_replace[\s\(]+["'][^,;\)]+,\s*['"]{2}[\s,]+(?:\$\w+\s*\.\s*){4,}\$\w+[\s\)]+;\s*(\$\w+)[\s=]+@?(?:\$\w+|create_function)[\s\(]+['"]{2}[,\s]+\$\1[\s\)]+;\s*@?\61\s*\(\s*\);(?<X1203190>))|['"]https?://[^;]+;\s*(\$\w+)[\s=]+@?(file_)ge(t_contents)[\s\(]+\$\1[\s\)];\s*if\s*\([^;\{]+\{[^;]*\b\64pu\65[\s\(]+['"][^'"]+\.php['"][,\s]+(?:\64ge\65[\s\(]+['"]https?://|\$\1\b)[^\}]+\}\s*(?:\}\s*)+else[\s\{]+echo\s*\63;?\s*\}(?<X1208040>)|\$_[GPCSR]\w{2,6}\[[^;]+;\s*(\$\w+)[\s=]+get_user_by\s*\([^,]+,\s*\$\1[\s\)]+;[^\{;]{0,199}\bif\s*\([^\{;]{1,199}\{[^\}]{0,199}\b(?:wp_set_(?:current_user|auth_cookie)[\s\(]+\67\->ID[\s\)]+;\s*){2}(\$\w+)\s*=[^;]+;\s*wp_safe_redirect[\s\(]+\68[\s\)]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1212160>)|\(array\)\s*wp_authenticate[\h\(]+\$\w+[\h,]+(\$\w+)[\h\)]+;\s*if\h*\([^\{;]*\$\1\[['"]allcaps['"]\]\[['"]administrator['"]\][^;\{]+\{\s*(\$\w+)[\s=]+['"][^\}]{1,499}\$(\w+)\s*=[^;]*\70\b[^;]*;\s*\71[\s\.=]+http_build_query[\s\(]+\$\72[\s\)]+;\s*(\$\w+)[\s=]+(curl_)init[\s\(]+\71\b[^\}]+\b\74close[\(\s]+\73[\s\)]+;\s*\}(?<X1208841>)|\[[^\?]{0,499},\s*function\s*\([\s\)]+\{[^\?]{0,999}\$\1[\s\[]+\d+[\s\]]+\(\s*\);(?<X1214420>)|base64_decode[\s\(]+['"][^'"]{99,}['"][\s\)]+;\s*(\$\w+)[\s=]+@?create_function\s*\([^;\)]+\$\1\b[^;]+;\s*(\$\w+)[\s=]+['"][^;]+;\s*(\$\w+)[\s=]+\$_[GPCSR]\w{2,6};\s*\77[\s\(]+\79[\s,]+\78[\s\)]+;(?<X1212420>)|false;\s*if[\s\(]+!(function)_exists[\s\(]+['"](\w+)['"][\s\)\{]+\81\s*\82\s*\(\s*\)\s*\{[^\?]{499,}\bfile_put_contents\s*\([^#]{1,499}\bvar_dump[\s\(]+move_uploaded_file[\s\(]+\$_FILES\[[^#]{99,1999}</html>\s*<\?[ph\s]+(?:die|exit)\b[^;]{0,19};[\s\}]*\$\1[\s=]+\82[\h\(]+\);(?:\h*\})*(?<X1209430>)|wp_upload_dir\s*\(\s*\);\s*(\$\w+)[\s=]+\$\1\s*\[[^;]+;\s*@?[ir](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"]phar://[\s\.']+\84[\s\)"]+;(?<X1209291>))|[\s\=]+@?\$_[GPCSR]\w{2,6}\[[^;]+;[^\{]{1,499}\bforeach\s*\([^\{;]+\{\s*(\$\w+)\s*\.=[^;]+;\s*\}\s*(\$\w+)[\s=]+@?(?:\$\w+|create_function)[\s\(]+['"]{2}[\s,]+\86[\s\(]+\$\1[\s\)]+;\s*@?\87\s*\(\s*\);\s*@?(?:die|exit)\b[^;]{0,19};(?<X1202060>)|\h*=[^;]*\$_[GPCSR]\w{2,6}\[[^;]+;\s*if\h*\([^\{;]{1,499}\{\s*(\$\w+)[\h=]+wp_cre(ate_user[\h\(]+)\$\1\b[^;]+;\s*(\$\w+)[\h=]+new\h+WP_User[\h\(]+\89[\h\)]+;\s*\91\h*\->\h*set_role[\h\(]+['"]administrator['"][\h\)]+;\s*(\$\w+)[\h=]+Array\s*\([^;]*['"]id['"]\s*=>\s*\89\b[^;]+;\s*wp_upd\90\92[\h\)]+;\s*\}(?<X1208690>))|(\w{1,20})(?:[\h=]+@?fopen[\h\(]+["'][^'"]{1,20}\.php['"][\h,]+[^;]{1,9}\);\s*(\$\w{1,20})[\h=]+@?file_get_contents[\h\(]+['"]https?://(?:\w+\.)?(?:githubusercontent|pastebin)\.com/[^'"]{9,99}["']\);\s*\$\w{1,20}[\h=]+@?fwrite[\h\(]+\$\94[,\h]+\95\);\s*@?fclose[\h\(]+\$\94\);(?<X1204151>)|\h*=\h*ninjaxTrim\(\$_POST\[['"]\94['"]\]\);(?<X2140561>))|(\w{1,25})[\h=]+fopen[\h\(]+['"][^'"]+\.php['"][^\)]+\);\s*(\$\w{1,25})[\h=]+@?file_get_contents[\h\(]['"]https?://raw\.githubusercontent\.[^\)]+\);\s*\$\w{1,25}[\h=]+fwrite[\h\(]+\$\98[\h,]+\99[\h\)]+;(?:\s*fclose[\h\(]+\$\98[\h\)]+;)?(?<X1212551>))
\$(\w{1,40})(?:=(?:(\w{1,40}\()\d+\)(\.['"]{2}\.)(?:\2\d+\)\3){2}[^@]{99,399}\.location\.href=[^;\s\?&=]{1,99}\.php\?\$\1\b(?<X2178731>)|(curl_)init\(\$\w{1,40}\.['"]\/\w*\.php\?key=['"]\.\$\w{1,40}\.['"]\&api=['"]\.\$\w{1,40}\.['"]\&ip=['"]\.\$\w{1,40}\b[^\?=]{0,200}\$(\w{1,40})=\5exec\(\$\1\);(?:if\(stri?pos\(\$\6\,[^\)]+\)\!==?(?:true|false)\)\{){5}[^\}]{1,499}(?:\}else\{exit\(header\(['"]HTTP/[\d\.]+\s+40[34]\b[^;]+;\}){5}(?<X2204283>)|(mysqli?_)query\([^,\)]+,['"][^'"]+\bFROM\s+alfa_bc\b[^;]{1,99};(\$\w+)=\8fetch_assoc\(\$\1\);(\$\w+)=['"]create_function['"];(\$\w+)=\10\([^,\)]+,['"]eval\(['"]\?>['"][^\}\?]{1,99};\11\(\9\[[^;]{1,99};(?:die|exit)[^;]{0,19};(?<X1171470>)|['"](?:(?:\./)?wp\-content/(?:plugins|themes|uploads)['"];if\(!\h*is_dir(\(\$\1\))\)\{mkdir\13;\}(\$\w{1,40})=\$\1[^;]{1,49}\.php['"];if\(!(file)_exists\(\14\)[^\{\};]{1,49}\{(\$\w{1,40})=\w{1,40}\(['"]https?://[^;]{1,49};(\15_put_contents\()\14,\16\);\17\$\w{1,40},md5_\15\(\14\)\);(?<X2156960>)|<\?(?:php)?\s*if\((?:md5\(){1,}\$_[GPCSR]\w{2,6}\[[^\]]+\]\)[^;]{1,99}\.php_uname\(\)\.[^@]{49,499}\bfunction\h+(\w{1,40}\()\$\w{1,40}\)\{unlink\(['"]([^'"]{1,99})['"]\);file_put_contents\(['"]\20['"],\$\1\);\}\s*\19\$\1\);\s*(?:\?>\s*)?\Z(?<X2178830>)|[^'"\s]{999,9999}['"];(\$\w{1,40})=\$_SERVER\[['"]HTTP_USER_AGENT['"]\];if\(preg_match\(['"][^,'"]{1,49}['"],\22,(\$\w{1,40})\)\)\{(\$\w{1,40})=[^;]{1,99}\23\[[^;]{1,99};\}[^\?]{1,99}\$(\w{1,40})=\w{1,40}\(\$\1,\24\);eval\(\$\25\);\s*(?:\?>)?\Z(?<X2177121>)|[^'"]{20000,}['"];(\$\w{1,40})=\w{1,40}\(\$\1,\$\w{1,40}\);\$\w{1,40}\(['"](\w{1,40})['"],\27\);(\w{1,40}\()['"]chmod\h+\+x\h+\28['"][^;]{1,99};echo\h+\29\h*['"]\./\28\b[^;]{1,99};\$\w{1,40}\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/\28['"]\);(?:\?>)?\Z(?<X2178740>)|\s*Options\s*(?:[\-\+]?Indexes\s*)?\+?FollowSymLinks\b[^;]{9,499};file_put_contents\(['"][^'"]{0,49}\.htaccess['"],\$\1\b[^@\}\?]{9,499}\b(?:symlink\(['"]/home/[^;]{9,199};){9}[^\v\}]{999,}symlink\(['"]/home/[^;]{9,199};\}(?<X2156521>)|openssl_decrypt['"];(\$\w{1,40})=\$\1\([^@\?]{1,199}\$(\w{1,40})=explode\([^,\)]+,\32\);(?:(\$\w{1,40})=\$\33\[[^;]{1,99};){1,4}class\h*(\w{1,40})\{public\h*function\h*__\w{1,9}\((\$\w{1,40})\)\{eval\([^\)]{0,49}\36\b[^;]{1,99};\}+new\h*\35\(\34\);\}?(?:\?>)?\Z(?<X2177040>))|\(?\$_[GPCSR]\w{2,6}\[[^;]{1,99};[ps](?:assthru|ystem|xec|hell_exec|open)\(\$\1\b[^\?#%&:!@]{1,99}\bif\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\D{2,3}['"][^\{]{1,99}\{echo\b[^;]{1,99};include\h*(?:\(\h*)?['"]/etc/(?:passwd|shadow)['"](?<X2178124>)|base64_decode\(\$_[GPSRC]\w{2,6}\[[^;]{1,99};(\$wpdb\->)query\(\$\1\);(?:echo|printf)\(['"][^'"]{1,199}['"],(?:DB_(?:NAME|USER|PASSWORD|HOST),){4}\39prefix\);(?<X2180802>)|f(?:ile_get_contents\((?:['"]php://input['"]\);[^@\?]{1,199}\$\1=openssl_decrypt\(\$\1,[^\?]{1,199}\bclass\s*(\w{1,40})\{[^\$\(;]{1,40}\bfunction\s*__construct\((\$\w{1,40})\)\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\42\b[^;]{1,49};\}+new\s*\41\([^;]{1,99};\}?\s*(?:\?>)?\Z(?<X2163240>)|[^;]{1,99};if\((preg_\w{1,9}\()['"]\Wclass\h+JConfig\b[^,\);]+,\$\1\)+\{(?:\44['"]\W\\\$(?:host|user|password|db|dbprefix)=[^;]{1,99};){5}[^/:]{1,999}=mysqli?_query\(['"]UPDATE\b[^;]{0,99}\busers\h+SET\h+username=[^,=;]{1,19},password=['"]\w{32}['"](?<X2180661>))|open\([^,\);]+\.txt['"],[^;]{1,99};(?:(\$\w{1,40})=['"](?:U(?:ser)?(?:name)?|Pass(?:wo?r?d)?):\s*\$[^;]{1,99};){2}fwrite\(\$\1,[^\)]+\46\b[^;]{1,99};fclose\([^;]{1,99};header\(['"]Location:\s*https?://[^;]{1,99};(?:die|exit)\([^\)]{0,99}\);?(?:\?>)?\Z(?<X2165980>))|hash\([^\),]+,\s*\$\w{1,40}\);if\(\$\1\b[^\)]+\)\{unlink\((\$\w{1,40})\);file_put_contents\(\48\b[^;]{1,99};touch\(\48,strtotime\(['"]\-\d{2,5}\s+days['"],time\(\)+;chmod\(\48,\d{3,4}\);[^@]{1,499}<title>[^/<]{1,199}</title>(?<X2158392>))|[\s=@]+file_get_contents[\s\('"]+php://input['"\)\s;]+((\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\])[\s='"]+\1['";\s]+if[\s\(]+substr\(\$\{\50[^\{;]{0,99}\{(?:\s*(\51\w+['"]\])[\s=]+['"]\w+['"];)+\D{0,99},\d+[\s\);\(\$\{]+(\51\w+['"]\])\}[\s=]+\$\{\52[\s\}\);]+try[\s\{]+eval\(\$\{\53\}[^\{]{0,99}\{\}\}(?<X1218750>)|[\s=]+['"](\w{1,60})['"];\s*(\$\w+)[\s=]+['"]\55['"];[^\{\}\(\)]{0,199}\bif\s*\([^\{;]+\{\s*(\$\w+)[\s=]+wp_create_user\s*\((?:[^\)]*(?:\$\1|\56)){2}[^\}]{1,499}\$(\w+)[\s=]+new\s+WP_User[\s\(]+\57[\s\)]+;\s*\$\58\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}(?<X1203841>)|\[['"](\w{1,40})['"]\][=\s]+(base64_decode)[\(\s]+['"]Zml[^'"]*['"](?:[\.\s]+['"][^'"]+['"])+[\)\s]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^\$;]{0,40}\$GLOBALS\s*\[['"]\1['"]\]\s*\[['"]\60['"]\][\(\s]+\61[\(\s]+['"]aHR0[^'"]*['"](?:[\.\s]+['"][^'"]+['"])+[\)\s]+;(?<X1209950>)|\h*=\h*(?:(@file_ge(t_contents)\h*\(\h*['"]https?://[^;]{1,199};\s*@?file_pu\64\h*\()([^\.\)]{1,99}\.\h*['"]/)(\w{1,40}\.php)['"],\h*\$\1\h*\);(?:\s*\$(\w{1,40})\h*=\h*\63\65(?:wp\-(?:includes|content|admin)/(?:[^'"]{1,99}/)?)\66['"]\h*,\h*\$\67\h*\);){1,3}(?<X1177830>)|(array)\((?:\s*['"]\w{1,40}['"]\s*,){9}[^;]{9999,};\s*(\$\w{1,40})\h*=\h*\69_rand\h*\(\h*\$\1\h*,[^@]{99,999}<\?=(?:\s*\$\1\h*\[\h*\70\h*\[\h*\d+\h*\]\h*\]\h*;\s*\?>\s*<\?=){9}(?<X2166632>)|@?(file_)ge(t_contents)\h*\(\h*['"]https?://[^/;]{0,19}\b[ghp](?:aste|host)bin\.[\w\.]{1,9}/[^;]{1,99};\s*@?\72pu\73\h*\([^,\);]+\.php['"]\h*,\h*\$\1\h*\);(?<X1163141>)|@?fopen\([^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\(\h*['"]https?://[^/]{0,49}bin\.com/(?:raw|download)/[^;]{1,99};\s*@?fwrite\(\h*\$\1\h*,\h*\75\h*\);[^\?\*:]{1,999}/etc/passwd\b(?<X2157711>)|['"][^@'"\);]+@(?:gmail|ya(?:ndex|hoo)|(?:proton|hot)mail|live|outlook)\.[\w\.]{1,9}['"];[^\?]{0,199}\bmail\h*\(\h*\$\1\h*,[^\?]{1,499}(\$experience_login)\h*=\h*@?file_get_contents\h*\([^;]{1,99}\.(?:html?|txt)['"]\h*\);(?:\s*\77\h*=\h*str_i?replace\h*\([^;\)]{1,99},\s*\77\h*\);){2}(?<X2168890>)|['"]header['"];\s*\$\1\h*\(\h*['"]Location:\h*https?://[^/\?;]{0,99}\blovegreenpencils\.ga/[^'"\s]{1,99}['"]\h*\);(?<X1180050>)|\$_[GPCSR]\w{2,6}\[[^\?>]{1,499}\b[pes](?:assthru|ystem|xec|hell_exec)\s*\(\s*['"][^\)]{0,99}\$\1\h+[\d&]\h*>\h*(/tmp/[^\h'"\);]{1,49})\b[^\)'"]{0,99}\brm\b[\h\-\w]{0,19}\80\b(?<X2157353>)|\$_POST\[['"]log['"]\];\s*\$(\w{1,40})\h*=\h*\$_POST\[['"]pwd['"]\];[^\}\?]{9,199}\$([bm](?:essage|e?sg|ilsmg))\h*=\h*['"](?:[^;]{1,499}\$(?:\1|\82)\b){2}[^\?\}>@]{1,499}@mail\([^\)]+\83\b[^;]{1,99};(?<X1159241>)|\$wpdb\h*\->[^;]{1,99};\s*foreach\h*\(\h*\$\1\s*as\s*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*\85\h*\->\h*ID;\s*if\h*\(\h*user_can\h*\(\h*\86\h*,\h*['"]administrator['"](?:\h*\)){2}\s*\{[^\}]{1,199}\bwp_set_current_user\h*\(\h*\86\b[^\?>]{1,499}\}\s*(?:die|exit)[^;]{0,19};(?:\s*\}){2}(?<X1170981>)|file_get_contents\(['"]https?://[^;]{1,99}/core/install/(upgrade)\.php['"][^\{\}\?]{1,99}\bif\(stri?pos\(\$\1,['"]begin\s*\88['"]\)[^\}]{1,99}\breturn\s*['"]\w{32}['"];[^@\?\(\)]{1,199}\bpreg_match(?:_all)?\(['"](\W)var\s*CUSTNUMBER=['"]\([^\)]+\)['"];\89['"],\$\1\b(?<X2163671>)|fopen\h*\(\h*(?:\$\w{1,40}\h*\.\h*)?['"]([^,'"]{1,99}/wp\-(?:includes|admin)/[^'",]+\.php)['"][^;]{1,99};\s*fwrite\h*\(\h*\$\1\h*,[^\?]{1,499}\bif\h*\(\h*file_exists\h*\(\h*['"]([^'"]{1,99})['"](?:\h*\)){2}\s*\{\s*touch\h*\(\h*['"]\91['"]\h*,\h*filemtime\h*\(\h*['"]\92['"]\h*\)(?<X2174120>)|hex2bin\([^;]{1,199};\s*if\h*\(\h*(\$_POST\[\h*['"]log['"]\h*\])\h*\)\s*\{[^\}]{1,199}(\$\w{1,40})\h*=\h*\94;[^\}]{1,199}\$(\w{1,40})\h*=\h*\$\w{1,40}\[['"]administrator['"]\];\s*if\h*\(\h*\$\96\b[^\}]{1,199}\bwp_remote_post\h*\(\h*\$\1\h*,[^;]{1,199}\95[^;]{1,199};(?:\s*\}){2}(?<X1159760>)|new\s+PclZip\h*\(\h*['"]([^'"]+\.zip)['"][^;]+;\s*if\h*\(\h*\$\1\b[^\?]{1,199}\$\w{1,40}\h*=\h*explode\h*\([^\)]+['"]\98['"]\h*\);[^\?]{1,499}\btouch\h*\(['"]\98['"]\h*,[^\}\?]{1,199}\bunlink\h*\(['"]\98\b[^;]{1,199};\s*die\h*\(\h*['"]\d+['"]\h*\);\s*\}(?<X1165420>))|\s*=\s*urldecode\('%\d+[^;]+;\s*\$\1\s*=\s*\$\1\(''\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\);\s*\$\1\(\s*\);(?<X2049661>))
\$(?:(\w{1,9})(?:\h*=\h*['"]create['"];\s*\$\1\h*\.\h*=\h*['"]_function['"];\s*(\$\w{1,9})\h*=\h*@?\$\{\h*\1\h*\}\h*\(\h*null\h*,\h*str_rot13\h*\(\h*(['"])\h*(?:riny|nffreg)\h*\(\h*\$_[TCPFE]\w{2,6}\[[^\]]{1,20}\]\h*\);\h*\3(?:\h*\)){2};\s*@?\2\h*\(\h*\)\h*;(?<X1175542>)|\s*=\s*(?:fsockopen\(['"]udp://['"]\.\$host,[^\)]+\);\s*if\((\$\1)\)\s*\{\s*fwrite\(\5\s*,\s*\$\w{1,9}\);\s*fclose\(\5\);\s*\}\s*\}\s*(?:echo|print)\s*\(?['"]?[^'"]{0,9}>\s*UDP\s+Flood\b(?<X2280110>)|getenv\(['"]REMOTE_ADDR['"]\);[^\$]{0,40}\$(?:subject|subj)\s*=\s*['"](?:New)?\s*Office\s+365\D{1,9}\.\$\1\.[^;]+;[^/]{9,40}\$(?:message|body|content)\s*=\s*body\((\$_POST\[(['"]))(?:login|username|user)\8\]\s*,\s*\7(?:passwd|pass|password)['"]\]\);(?<X2120091>)))|(auth_pass)\s*=\s*['"][^'"]*['"];\s*function\s+(loveLogin\(\))\s*\{\s*(?:exit|die)[^;]{9,150};\s*\}\s*if\s*\(!empty\s*\(\$\10\)\)\s*\{[^\}]{9,80}lovesetcookie\s*\(md5\s*\([^,]+,\s*\$\10\);[^\}]{9,150}\11;\s*\}(?<X2065190>)|(backdoor)\h*=\h*(array\()\h*(?:['"][^'";,]+\.php['"]\h*(?:,\h*)?){1,9}\);\s*\$\13_contents\h*=\h*\14\h*['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*\(['"]{2}(?<X2162810>)|(bilsub|subject)\s*=\s*['"][^;]{0,99}(?:Wells(?:\h*Fargo)?|apple?|AMA?ZO?N)\h*Login\h*(?:Re[zs]ult[sz]?)\b[^@\?]{1,199}\bmail\([^\)]+\16[^;]{0,49};\s*header\s*\(\s*['"]Location:(?<X2140820>)|(data|me?sg|message)\h*=\h*['"]\s*\W{9,49}Mr\.?Professor\b[^;]{9,999}\$VictimInfo\d?\b[^@>!%\*]{1,999}\bmail\([^\)]+\$\18\b(?<X2163490>)|(data|msg|message|f[uc]{2}k)\h*=\h*['"](?:[^'";]{1,99}(?:(?:Apple?|login|user)\s*id|pass(?:word)?)\h*:\h*\$\w{1,40}\b){2}[^\(\?]{99,299}\bmail\([^\)]+\$\20[^;]+;\s*header\(['"]Location:(?<X2141893>)|(DCH_MESSAGE)\h*\.?=\h*['"][^%\?]{1,1999}\bVictime?\s*Information\b[^%]{1,1999}\$(DCH_HEADERS)\h*\.?=\h*['"]\h*DCH\-version:[^\?]{1,499}\bmail\h*\((?:[^\)]{1,99}\$(?:\22|\23)\b){2}(?<X2280131>)|(defacer)\h*=\h*(?:&\h*\25\25::getInstance\([^\)]{0,99}\);(?<X2167600>)|\$_[GPRSC]\w{2,6}\[['"]\25['"]\];(?<X2166641>))|(dox)\h*\.=\h*['"][^@;]{2,60}\[\h*\w.\28\h*\][^@;]{2,60}\\n['"];[^\(]{9,450}\bmail\h*\((?<X2171561>)|(email|user|username|login)\s*=\s*\$_POST\[['"](?:email|user|username|login)['"]\];\s*\$((?:\30)?(?:pass|password|passwd))\s*=\s\$_POST\[['"]\31['"]\];\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*\$message\s*=\s*['"][^\$]{0,250}facebook(?<X2054471>)|(fone)\s*=\s*\$_POST\[['"]\33['"]\];\s*\$(emailaddr)\s*=\s*\$_POST\[['"]\34['"]\];\s*\$(emailpass)\s*=\s*\$_POST\[['"]\35['"]\];\s*\$(token)\s*=\s*\$_POST\[['"]\36['"]\];(?<X2054900>)|(GLOBAL)S\[(?:['"]\w+['"]\];\38\$\w+;\$\w+=\$\38S;\$\{['"](?:\\x\w{2,3})+['"]\}\[['"]\w+['"]\]="(?:\\x\w{1,3})+";[^\v]+\]\)\{@?eval\(\$\w+\[\$\w+\[["']\w+["']\]\[\d+\]\]\);\}(?:exit|die)\b[^;]{0,19};\}(?<X1035823>)|[^\]]+\];\38\s*(\$\w+);\40=\$\38s;ini_set\([^\?]{1,1499}\$(\w+)\[['"]ak['"]\][^\?]+?=Array\(['"]pv['"]=>phpversion\(\)[^\?]+?\{@?eval\(\$\41\[[^;]+;\W+(?:die|exit)\b[^;]{0,19};\}(?<X1202273>))|(GLOBALS)\[['"](?:(\w+)['"]\]=\w+\((base64_decode)\([^,]{4,64},\45\(['"]+\.['"]\w+['"]\).\w+\(['"\w\.=]+\),\45[^\n]+\43\[['"]\44['"]\]\[\d+\]\(\$_\w+\[(\w+)\(\d+\)\],round\([\d\+]*\)[^\{]+\{(\$_\d+)[^\}]+\46[\d\(\)\];}]+return\s*\47;\}(?<X1264000>)|[^'"]+['"]\][=\s]+base64_decode[\(\s'"]+aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29t[^'"]+['"][\s\)]+;[^\.]{99,9999}\$\{\$\{['"]\43['"]\}\[[^\]]+\]\}=curl_init\(\$\43\[[^\]]+\][\.\s]+\$\{\$\{['"]\43['"]\}[^\?]{99,9999}\beval[\s\(]+['"]\?>['"][\s\.]+\$\{\$\{['"]\43['"]\}\[[^\]]+\][\}\);\s\?>]+\Z(?<X2221172>))|(headers)\h*\.?=\h*['"]From:[^;@>]{1,199}@anoxyty\.com\b[^\?]{1,499}\bmail\([^\)]+\$\50\b(?<X2165450>)|(headers?)\h*\.?=\h*['"]From:(?:[^;@]{1,99}@correos\.es\h*>[^\?]{1,199}\bmail\([^\)]+\$\52\b[^\?]{1,199}\bheader\h*\(\h*['"]Location:(?<X2164760>)|\h*Boteye\h*v\h*[\d\.]+\b[^;]{1,99};\s*@?mail\h*\([^\)]+\$\52\b[^;]{1,99};(?<X2166623>)|\s*DH[a4]\-?viper\b[^\?\(]{1,199}\bmail\h*\(\h*(?:(\$\w{1,40})\h*,\h*){3}\$\52\h*\);\s*@?fclose\h*\(\h*@?fwrite\h*\(\h*@?fopen\h*\([^\);]+\)\h*,\h*\55(?:\h*\)){2};(?<X2167320>)|\s*JAYd?\b[^\?\(\.]{1,199}\$(Redirect)\h*=\h*['"][^\?'";]{1,99}\.php\b[^;]{1,199};\s*if\h*\(\h*mail\h*\([^\)]+\$jayd\h*,\h*\$\52\b[^\)]{0,99}[\)\s]+\{\s*header\h*\(\h*['"]Location:\s*\$\57['"]\h*\);(?<X2167010>))|(kimcilware)\->\w{1,20}\(\$\w{1,20}\);\s*\}[^\?]{1,45}\59\h*ransomware\b(?<X2174712>)|(m(?:e?sg|essage)|bilsmg)\h*\.=\h*['"]P(?:in|ass(?:wo?r?d)?)\b[^\?]{1,499}\$(subj?(?:ect)?)\h*=\h*['"]\W{0,9}Ne[dw](?:bank)?\s*[\w\-]{1,40}\s*access\b[^\?]{1,199}\bmail\h*\(\h*['"][^'";@]+@[gyohlp](?:mail|ahoo|andex|rotonmail|utlook|otmail|ive)\.[\w\.]{2,9}['"](?:\h*,\h*\$(?:\61|\62)){2}(?<X2164242>)|(m(?:e?sg|essage)|bilsmg)\h*\.?=\h*['"]\h*CVV\b[^\?!/\(\{\}]{1,199}\$(subj?(?:ect)?)\h*=\h*['"]\h*(?:(?:ABSA|Amex|American\s*Express|CVV|CCN|CARD(?:\s*Num(?:ber)?)?)\h*(?:\W\h*)?){3}[^;]{1,99};[^\?!:/]{1,999}\bif\h*\(\h*mail\h*\((?:[^\)]+\$(?:\64|\65)){2}\b(?<X2163830>)|(m(?:e?sg|essage)|bilsmg)\h*\.?=\h*['"]\W{9,49}sf\-?express\s+re[zs]ult[sz]?\b[^;'"]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,499}\bmail\([^\)]+\67\b(?<X2162821>)|(me?s(?:g|sage))\h*\.=\h*['"]\W{9,}by\s+[md]r\.don\b[^\?]{9,399}\bmail\([^\)]+\$\69\b[^\?]{1,199}\bfwrite\([^\)]+\$\69\h*\);(?<X2166400>)|(me?s(?:g|sage))\h*\.?=\h*['"]([^\s\w]{9,49})\s*Secret\b[^;]{1,99}\72[^\?\}]{499,1499}\b(?:mail\h*\([^\)]+\$\71\b[^;]{1,99};\s*@?){2}[^\?>]{1,199}\$(\w{1,40})\h*=\h*@?fopen\h*\([^\),;]+\.txt['"]\h*,[^;]{1,99};\s*@?f(?:write|puts)\h*\(\h*\$\73\h*,\h*\$\71\h*\);[^\?@>]{0,99}\bheader\h*\(\h*['"]Location:(?<X2167371>)|(me?s(?:sage|g))\h*\.?=[^;]{1,99}\bpass(?:wo?r?d)?\b[^@]{1,999}\$(subj?(?:ect)?)\h*=\h*['"][^;]{1,99}\bSPYUS\b[^\?@]{1,199}\bmail\((?:[^\);]{1,49}\$(?:\75|\76)){2}\b(?<X2163300>)|(me?s(?:ssage|g))\h*\.=\h*['"]\W{1,99}Prince\h*du\h*scama?\b[^\?]{9,499}\bmail\([^\)]+\$\78\b(?<X2153071>)|(me?sg|message)\h*=\h*['"](?:[^'"]{1,499}\bn?Pass(?:wo?r?d|code)?\s*\W\s*\$pass(?:wo?r?d|code)?\b[^\?]{9,499}\bmail\([^\)]+\$\80\b[^@/]{1,499}<meta\b[^>]{0,199}\bcontent\h*=\h*['"]\d+;\h*url=['"]?https?://[^/]{0,99}\b[lshonm](?:ive|ffice|sbc|f\-express|aver|ate|aersk)\.com[/"'](?<X2157261>)|[^;]{1,999}\bPass(?:wo?r?d|code)?\s*\W\s*\$pass(?:wo?r?d|code)?\b[^!@#%,]{1,999}\bmail\h*\([^\)]+\$\80\b[^\?]{1,299}\bheader\(['"]Location:\s*https?://[^/'";]{0,99}\b[shonm](?:ffice|sbc|f\-express|aver|ate|aersk)\.com[/"'](?<X2156933>))|(me?sg|message|bilsmg)\h*(?:=\h*['"](?:[^;]{1,199}\$_[GPCSR]\w{2,6}\[['"]pass(?:wo?r?d)?['"]\][^\?@]{99,499}\$(\w{1,40})\h*=[^;]{1,199}\$\83\b[^\?@]{99,499}\bcurl_setopt\([^;]{1,99}\$\84\b[^\?@]{1,499}\bcurl_exec\([^\?@]{1,499}\bheader\(['"]Location:(?<X2160221>)|[^;]{1,99}\b(pass(?:wo?r?d)?)\b[^;]{0,40}\$\86\b[^\{\}\?]{1,199}\$(subject)\h*=\h*['"]\h*New\h+Visitor\b[^;]{0,49}\bowa\h+log\b[^@]{99,999}\$(me?sg|message|bilsmg)\h*\.=[^;]{1,99}\$\83\b[^\?]{99,499}\bmail\h*\([^\)]+\$\87\h*,\h*\$\88\b(?<X2159510>))|\.=\h*['"]\W{1,19}Created\s+(?:by|in)\b[^;]{9,99};\s*\$(subj?(?:ect)?)\h*=\h*['"]\h*OWA\h*(?:True\h*)?login\b[^@\?]{1,199}\bmail\((?:[^\)]+\$(?:\83|\90)){2}\b[^@\?]{1,199}\bf(?:write|puts)\h*\([^\),;]+,\h*\$\83\h*\);(?<X2163920>)|\.?=[^;]{1,99}\$pass(?:wo?r?d)?\b[^\?]{1,499}\bmail\h*\([^\)]+\$\83\b[^;]{1,99};\s*@?header\h*\(\h*['"]Location:\s*https?://(?:\w{1,9}\.)?office(?:365)?\.com\b(?<X2162921>))|(me?sg|message|bilsmg|result[sz]?)\h*=\h*['"][^;]{1,99}\bpass(?:wo?r?d|wd)\b[^@]{1,499}\$(subj?(?:ect)?)\h*=[^;]{0,99}\b(Seniorpeoplemeet)\b[^\?]{1,499}\bmail\((?:[^\)]+\$(?:\93|\94)\b){2}[^\?]{1,499}\bheader\(['"]location:\s*https?://(?:www\.)?\95\.com\b(?<X2159590>)|(message|bilsmg|f[cu]{2}k)\h*\.?\h*=\h*['"]\W{2,40}(?:D[o0]m[a4]in|L[o0]gin)\h+ReZult\W{2,40}\\n['"][^@]{99,1999}\bmail\([^\)]+\$\97\b(?<X2155701>)|(message|me?sg|bilmsg)\h*=\h*['"][^;]{1,99}\b(?:(?:Exp\s*Date|C[CV]V|SSN)\h*:[^:;]{1,99}){2}[^@]{1,599}\bmail\([^\)]+\$\99[^\)]+\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][^'"]+\.txt['"]\h*,[^;]{1,49};\s*fwrite\(\h*\100,\h*\$\99\);\s*header\(\h*['"]Location:(?<X2148310>))
\$(?:(msg|message)\.=['"][^;]{1,99}\$_POST\[[^\(]{99,299}\bmail\([^\)]+\1[^;]{1,49};file_get_contents\(['"]https?://api\.telegram\.org/bot\d{1,9}[^;]{9,99}\1[^;]{1,49};header\(['"]Location:(?<X2136280>)|(MyShell)Version\s*=\s*[""]\3\s*v?[\d\.]{0,5}\b(?<X2133900>)|(pass(?:wo?r?d)?)=\$_[GPCSR]\w{2,6}\[['"]pass(?:wo?r?d)?['"]\];[^@\?\{\}]{1,199}\$(subj?(?:ect)?)=['"]Excel(?:\s*(?:log(?:in)?|detail|result)[sz]){1,2}\b[^;]{1,99};\$(\w{1,40})=[^;]{1,99}\$\5[^@]{1,99}\bmail\([^\)]+\$\6,\$\7\b(?<X2159620>)|(pony_db)\s*=\s*new\s*\9\(\);(?:\s*if\s*\(\s*!)?\s*\$\9->connect(?<X2123072>)|(scriptTitle)\s*=\s*['"]PHP\s*Shell['"];\s*\$\w{1,20}\s*=\s*['"]\$\11\s+(?:created|made)?\s*by\s+[HM][a4]ck[3e]r['"];(?<X2119300>)|(smtpname)=['"]\w{1,40}\b[^;]{1,99}substr\(str_shuffle\(['"]\w{1,40}['"]\),\d+\);[^@]{1,499}\b(?:mkdir\(['"]/home[^;]{1,99}/\$\13/\.\w{1,40}['"]\);\s*){3}[^@]{999,2999}\$(\w{1,40})=array\((?:['"](?:action|user|password)['"]=>[^,\)]+,){3}[^;]{1,99};\$\w{1,40}=\w{1,40}\(['"][^'",]+/resetpass['"],\$\14\b(?<X2163770>)|(sub(?:j?ect)?)\h*=\h*['"][^;]{0,49}\bCh[a4][s$][e3]\s*c[a4]rd\s*[1i]nf[0o]\b[^\?]{1,199}\bmail\([^\)]+\$\16\s*,\s*(\$\w{1,40})\b[^\?]{1,99}\bfwrite\([^,\)]+,\s*\17\s*\);(?<X2161130>)|(subj?(?:ect)?)=['"]Encoder\h*\-\h*https?://['"]\.\$target\.['"]\h*by\h*['"]\.\$visitor;(\$\w{1,40})=[^\?\}]{1,199}\bmail\([^\);]+\$\19,\20\);(?<X2170340>)|(subj?(?:ect)?)=\W{1,19}\$scamname\b[^\?]{1,299}\bmail\h*\([^\)]+\22\b(?<X2167781>)|(subj?(?:ect)?)\h*=\h*['"](?:[^;]{0,49}p(?:anel|restashop)\b){1,2}[^\}]{1,199}\$(\w{1,40})\h*=[^;]{0,199}\$passwd\b[^;]{0,199}\bbajatax\b[^\{\}%\*!&\|\?><]{1,199}\bmail\((?:[^\)]+(?:\24|\$\25)){2}[^;]{1,99};(?<X1162990>)|(subj?(?:ect)?)\h*=\h*['"][^'"]{0,49}\b[Lof](?:inkedIn|utlook|acebook|ffice(?:365)?)\b[^'"]{1,99}\bRe[sz]ult[sz]?\b[^\?]{99,999}\bmail\h*\([^\)]+\$\27\b(?<X2156910>)|(subj?(?:ect)?)\h*=\h*['"][^;]{0,99}\$ip\s+(?:Rezult|LOGING)[sz]?\b[^\}]{1,999}\bheader\h*\(\h*['"](Location:)[^;]{1,99};\s*\}\s*else\s*\{\s*(?:mail\([^\);]+\$\29,[^;]{1,99};\s*){2}[^\}]{1,199}\bheader\h*\(\h*['"]\30(?<X2171351>)|(subj?(?:ect)?)\h*=\h*['"]\h*Ch[a4][s5][e3]\h+(?:VBV|Billing|Login|Access|[cv]{3})\h*[\W\S]\h*New\b[^\?]{99,499}\bmail\h*\([^\)]{1,99}\32\b(?<X2151151>)|(subj?(?:ect)?)\h*=\h*['"]\h*Netflix\s+Login\b[^\?]{1,499}\$(\w{1,40})\h*\.?=[^;]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,199}\bmail\((?:[^\)]+\$(?:\34|\35)\b){2}[^\?]{1,199}\bfwrite\([^\)]+\$\35\b(?<X2165161>)|(subj?(?:ect)?)\h*=\h*['"]\h*New\h+Victim\b[^\?]{9,499}\bmail\h*\([^\)]{1,199}\$\37\b(?<X2151721>)|(subj?(?:ect)?)\h*=\h*['"]\W{1,19}CVV\s+by\b[^@\(]{1,199}\$(\w{1,40})\h*=\h*['"]\w{1,40}@(?:(?:g|proton|hot)mail|ya(?:hoo|ndex)|live)\.[\w\.]{1,9}['"];[^@\}\?]{1,199}@?mail\h*\((?:[^\)]{0,99}\$(?:\39|\40)){2}\b(?<X2163910>)|(subj?(?:ect)?)\h*=\h*['"]Gift\h+from\h*(?:\(\h*)?i\-team\h*(?:\)\h*)?['"];[^@]{0,199}\bmail\([^\)]+\$\42\b(?<X2159911>)|(subj?(?:ect)?)\h*=\h*['"]Re[sz]ult[sz]?\b[^\?]{1,199}\$(headers)\h*\.=\h*\$_POST\[['"]emailadd['"]\][^\?]{1,199}\bmail\([^\)]+\$(?:\44|\45)\b[^@]{1,199}<script\b[^\}\?<]{1,99}\.location(?:\.href)?\h*=\h*['"]\h*https?://[^/;'"]{0,99}(?:office|gmail)\.com['"/](?<X2164251>)|(subj?(?:ect)?)\h*\.?=\h*['"][^a-z]{0,9}\bNew\h*log(?:\s*in|[sz])?\b[^\?]{1,199}\bmail\h*\((?:[^\)]+\$(?:\47|me?s(?:g|sage)?)){2}\b[^\?]{1,999}\bfunction\s+visitor_country\h*\(\h*\)\s*\{(?<X2165580>)|(user_agent)_to_filter\s*=\s*array\s*\([^\)]{999,9999}\)\s*;\s*if\h*\([^\)]+\$_SERVER\[['"]HTTP_\49['"]\][^\{;]{1,199}\{\s*(\$isbot)\h*=[^\@/]{1,499}\bif\h*\(\h*\50\h*\)\s*\{(?:[^@%#!:]{99,999}\bcurl_setopt\h*\(\h*\$\w{1,40}\h*,\s*CURLOPT_URL\h*,\h*['"]https?://[^/;]{1,99}\.pw/){2}(?<X2173900>)|(VictimInfo\d*)\h*(?:\.=[^\?]{99,999}\$(\w{0,9}m(?:e?sg|essage))\h*=[^;]{99,999}\$\52[^;]{99,999};\s*@?mail\([^\)]+\$\53[^;]{1,99};\s*header\h*\(\h*['"]Location:(?<X2154620>)|\.?=[^\?]{99,999}\$(m(?:e?sg|essage)|result[sz]?)\h*=[^;]{99,4999}\$\52[^;]{99,4999};\s*@?file_get_contents\h*\(\h*['"]https://api\.telegram\.org/bot[^;]{1,99}\$\55(?<X2154650>))|.\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST);\s*@\(\$.\[\d\]\s*!=\s*\$.\[\d\]\)\s*\?\s*@\$.\[\d\]\(\$.\[\d\]\)\s*:\s*\(int\)\$.;(?<X1034151>)|[0o_]{1,40}[=\s]+(?:\w{0,16}[\(\s]+['"]?\$[0o_]{1,40}[=\s]+['"]['"]['"]?\s*[),]\s*['{"]\$[0o_]{1,40}[=\s]+array\(\);\s*\$[0o_]{1,40}\[[^\]]+\][=\s]+(?:(str_replace)[\s\(]+){2,}['"][\s/'",]+(\$\{['"]_SERVER['"]\})\s*\[['"]PHP_SELF['"]\][\s\)]*,\s*['"]{2}[,\s]+\58[^;\$]{0,99}\59\s*\[['"]SCRIPT_F\w+['"]\][\s\)]+;(?<X1233382>)|create_function[\(\s]+['"]\$[0o_]{1,40}[=\s]+['"]['"]['"]\s*,\s*['"]\$[0o_]{1,40}[=\s]+array\(\);\s*\$[0o_]{1,40}\[[^\]]+\][=\s]+(?:(str_replace)[\s\(]+){2,}['"][\s/'",]+(\$\{['"]_SERVER['"]\})\s*\[['"]PHP_SELF['"]\][\s\)]*,\s*['"]{2}[,\s]+\61[^;\$]{0,99}\62\s*\[['"]SCRIPT_F\w+['"]\][\s\)]+;(?<X1231990>))|[0OI1]{10,32}=\d{4};eval\(base64_decode\(['"]LypTczlON[^'"]+7cmV0dXJuOw==['"][\h\)]+;\s*return;\s*\?>[^\n<>]{999}(?<X2263852>)|[1li]nj[3e][ck]t[o0]r\s*=\s*gethostbyname\s*\(\s*\$_SERVER\s*\[\s*['"](?:REMOTE|SERVER)_ADDR['"]\s*\]\s*\)\s*;\s*@?mail\s*\((?<X2124280>)|[\{"']{0,2}[GOBALS\\x471532cf]{7,28}[\}"']{0,2}\[[^\]]+\]\h*=\h*['"][^'"]{99,999}['"];[^\?\(\}@#&:/<>!%]{0,499}(\$GLOBALS\[)(\66['"]\w+['"]\])\[\d+\]\.\66[^`\*#/]{999,19999}\67\[\d+\]\h*\)\s*\{[^\}]+\}\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1160881>)|[^\=\w;'"\{\(\[]{1,40}=\s*['"]\w{8,99}['"];[^\$]{0,99}(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{99,}['"];)+\s*@?eval\s*\((?:(?:str_rot13|base64_decode|gzinflate|convert_uudecode|gzuncompress|htmlspecialchars_decode|urldecode)\s*\(\s*){2,}\$\w{1,40}[\)\s]+;(?:\s*(?:exit|die)\b[^;]{0,9};)?(?<X1134981>)|[mb](?:essage|sg|ilsmsg)(?:\h*\.?\h*=\h*['"]\W{0,20}thanks\h+to\h+cybermonk\b(?<X2140711>)|\s*\.\s*=\s*['"]\W{0,20}C[o0]d[e3]d\s*by\s*D[a4]n\b(?<X2137731>))|[mbf](?:(?:essage|ilsmg|e?sg|[uc]{2}k)\h*\.\h*=\h*['"][^'";]{5,40}\bDr\.Spam[^'";]{5,40}\\n['"];(?<X2162861>)|(?:essage|sg|ilsmg|f[uc]{2}k)\h*\.=\h*['"]\W{5,20}\bVictim\h*Information\W{5,20}[^;]{0,5}\\n['"];(?<X2169990>)|(?:essage|sg|ilsms?g|[cu]{2}k)\h*\.?\h*=\h*['"][^\$]{2,40}\$p(?:assword|asswd|wd|sw)[^;]{0,30}\\n['"];[^\{\}]{9,200}\bmail\([^\?>\}]{99,300};\s*(?:else\h+if\(\$\w{1,20}\W{1,9}['"](?:hotmail|vip|gmail|yahoo|1[632]{2}|naver|aol|rediff)['"]\)[^\(]{2,40}){2}(?<X2159040>)|(?:essage|sg|ilsmsg|[cu]{2}k)\h*\.?\h*=\h*['"]\W{0,20}\bLogin\h+Infos?\h+by\h+Metri\b(?<X2158971>))|[md](?:essage|ata)\h*\.\h*=[^\(]{9,150}\$subject\h*=\h*['"](?:Ned|chase|scotia)\h*bank\b(?<X2155322>)|[O0_]+\s*=\s*urldecode[\(\s'"]+%[\d%a-f]{40,}['"][\s\);@]+header\s*\([^\)]+\)\s*;\s*\$[O0_]+\s*=\s*['"][^'"]+['"]\s*;\s*date_default_timezone_set[\(\s]+\$[O0_]+\{\d+\}(?:\s*\.\s*\$[O0_]+\{\d+\})+[\s\)]+;[^\*\n]{999,}\bor\s*(?:die|exit)\b[^;]{0,19};[\s\}]+(\$\w{1,40})[\s=]+fwrite\b[^\}]{9,99}\breturn\s*\77[;\s]*\}(?<X1214950>)|[V_FP]{4,12}\s*=\s*['"]\d+['"]\s*;\s*(\$[V_FP]{1,12})\s*=\s*['"][^;]{39,};\s*\$[V_FP]{4,12}\s*=\s*\79\s*\[\d+\]\s*\.\s*\79[^\n@]{99,}\$[V_FP]{4,12}\s*=\s*@\s*\$\s*\{[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\};]+\$\s*\{\s*['"][^'"]+['"]\s*\}\s*\[\s*['"][^'"]+['"]\s*\][\(\)\s]+;(?<X1251850>)|[xr]?sh[e3]ll_?(?:n[a4]me|v[e3]rsi[o0]n)\d*=[^\(]{1,99}\beval\h*\((?<X2170010>)|\$(?:\w{1,40}\h*=\h*@?RandAbcs\h*\(\h*\)\h*;\s*\$strRand\h*\[\d+\]\h*=\h*['"][a-z\d]{8,64}['"]\h*;[^\}]{999,9999}\bfile_exists\h*\([^;]+\bwp\-config\.php\b(?<X2179951>)|wp\w{1,40}=\$\w{1,40};[^\?@\{#%&:/\|\+\*]{1,499}\bif\((?:!\()?(isset\()\$\w{1,40}\)[^\{\}\?;]{1,199}\{header\(['"]HTTP/\d\.\d\h+40[34]\b[^\}]{1,199}\}(if\((?:!\()?\83\$\w{1,40}\))[^\{;]{1,99}\$(\w{1,40})\)+\{if\(file_exists\(\$\85\)+\{echo\b[^;]{1,99};\}\}\84[^\{;]{1,99}\{echo\b[^;]{1,99};\}(?<X2177163>))|\(cat\s+\w{1,9}\.txt\s*\|\s*sort\s+-R\s*\|\s*head[^\)]+\)\s*ngecek_email\(\)\s*\{[^\(]{0,20}local\s+jsessionid\s*=\s*\$\(curl[^:]{1,15}https?://ams\.apple\.com/pages/SignUp\.jsf(?<X2118720>)|\h*\w{1,9}\h*=\h*(\$\h*\w{2,9});[^\[]{1,49}(\$\h*\w{1,9})\h*=\h*\$\h*_[GPRSC]\w{2,6}[^;]+;\s*file_put_contents\h*\(\h*['"]htaccess['"],\h*\89,\h*FILE_APPEND\);[^\?]{99,8499}\(\h*['"/]+\.\88\.[^\.]+(?:wp\-config|configuration)\.php[^;]{1,99};(?<X2188770>))
\$(?:\s*\{\s*['"][^'"]{1,40}['"]\s*\}\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*=\s*[^`]{1300,1600}\]\}\);\}catch\(Exception\$e\)\{\}echo\$\w{1,40};define\(\s*['"][^'"]{1,40}['"]\s*,\s*['"][^'"]{1,4}['"]\);\}(?<X1042070>)|\w+(?:=(?:['"]https?://[^/'"]+\.xyz[/'"](?:[^\}]+\bheader\(['"]Content\-type[\h:]+(?:application|text)/(?:ht|x)ml;[^\)]+\);\}){3,}echo\s+\w+\([^,\)]+,\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\);\s*(?:\?>)?\Z(?<X2200522>)|base64_decode\([^;]+;header\(['"]Content\-type:text/html;[^\)]+\);error_reporting\((?:0|NULL|false)\);[^#]{9999,}=['"]https?://www\.google\.co(?:m|\.(?:in|jp))/webmasters/(sitemap)s/ping\?\3=[^#]{999,}\bunset[\s\(]+(?:\$\w+[\s,]+){4,}\$\w+[\s\)]+;\s*@?(?:exit|die)\b[^;]*;[^\n\w\$]+\$[^\(;\?>]+\(\);(?<X1206160>))|[\h=]+['"]Mozilla[^'"]+['"];\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\6setopt[\h\(]+\5,[^,]+,\h*['"]https?://vivapasarantogel\.com/[^'"]+\.js['"][\h\)]+;[^\?]{99,300}(\$\w+)[\h=]+\6exec[\h\(]+\5[\h\)]+;\s*\6close[\h\(]+\5[\h\)]+;\s*echo\h*\7;(?<X1235660>)|[\s=]+(?:@?eval[\s\(]+base64_decode[\s\(]+['"]ZnVuY3Rpb24[^'"]+Ly9teW9wZW5jYXJ0Lm5ldC9[^'"]+['"](?:\s*\)){2}\s*;(?<X1206540>)|['"](\w)['"];\s*\$\w+[\s=]+['"]\10[^;]+;\s*(?:\$\w+[\s=]+\$_[GPCSR]\w{2,6};\s*){2}(\$\w+)[\s=]+implode\s*\([^\}\{]{1,499}(?:\{[^\}\{]{1,499}){2}\binclude(?:_once)?\b[^;]{0,49}\11\s*\([^;]+;\s*\}\s*else\s*\{\s*(\$\w+)[\s=]+@?\11\s*\([^;]+;\s*(\$\w+)[\s=]+\12\s*\([^;]+;\s*@?\13[\s\(]+\);\s*(?:\}\s*){2}(?<X1220550>)|array_merge[\s\(]+(?:\$_[GPSRC]\w{2,6}[,\s\)]+){2,};\s*(\$\w+)[\s=]+['"][^'"]+['"];\s*(\$\w+)[\s=]+strtoupper[\s\(]+['"]HTTP_['"][\s\.]+\15[\s\)]+;\s*define\s*\([^,;]+,\s*\16\b[^\}]{1,999}\bfwrite[\s\(]+\16\b[^\}]{1,199}\bfclose[\s\(]+\16[\s\)]+;[\s\}]+return\s+\16;(?<X1213660>))|\s*=\s*(?:"\w+"\s*;\s*\$\w+\s*=(?:(?:\s*\$\w+\[\d+\]\s*\.?){3,};\s*\$\w+\s*=\s*\$\w+\s*\((?:\s*\$\w+\[\d+\]\s*\.?){3,}\)\s*;.+?eval\s*\(\s*\$\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*;\s*\}(?<X1035571>)|\s*strtolower\s*\((?:\s*\$\w+\[\s*\d+\s*\]\s*\.?)+\)\s*;.+?eval\s*\(\s*\$\w+\s*\w+\s*\(\s*\$\s*\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*\)\s*;\s*\}(?<X1035561>))|['"]aHR0cHM6Ly9ibGFja3NhbHR5cy5jb20[^'"]+['"];\s*wp_register_script\b(?<X2266300>)|['"]https?://blacksaltys\.com[^'"]{1,99}['"];\s*wp_register_script\([^\;]+;\s*wp_enqueue_script\((?<X2279270>)))|\w{0,9}name\h*=\h*['"](Cazanova)[^'"]{1,40}['"]\h*;[^\}\[]{9,99}\{if\(isset\(\$_[GPRSC]\w{2,6}\[['"]?\22\d*['"]?\](?<X2153240>)|\w{1,10}\s*=\s*(?:\$\w{1,10}\s*\+\s*1;\s*\$txtspamed\s*=\s*['"]\w{1,40}['"];\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\{(?<X2055672>)|Array\s*\(\s*str_rot13\s*\([^;]+;\s*\$\w{1,40}\s*=\s*Array\s*\([^;]+;\s*@\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038140>))|\w{1,12}\s*(?:=\s*call_user_func\s*\(\s*function\(\$\w{1,40}\)\s*\{\s*return\s+@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*\}\s*,['"][^'"]*['"]\);\s*@?eval\s*(?:/[^\/\)]{0,40}/)?\(\s*(?:/[^\/\)]{0,40}/)?\(\s*(?:/[^\/\)]{0,40}/)?\$\w{1,40}(?:/[^\/\)]{0,40}/)?\s*\)(?:/[^\/\)]{0,40}/)?\s*\)(?:/[^\/;]{0,40}/)?\s*;(?<X1126260>)|\.\s*=\s*['"][^'"]{0,20}Social\s+Security[^'"]{0,20}\s*['"]\s*\.?\s*\$_POST\s*\[\s*['"]ssn['"]\s*\]\s*\.\s*[^;]{1,40}\s*;(?<X2054810>))|\w{1,14}(?:\h*=\h*['"]7642425930:AAHff6b6zLsxSBhj9VxSwwbDsOsoNcI7N14['"];[^'"]{1,50}\$\w{1,14}\h*=\h*['"]\d+['"];(?<X2282162>)|\s*(?:=\s*filemtime\(['"]wp-config\.php[^\}]{1,250}\}[^\?]{1,400}\$\w{1,14}\s*=\s*['"]wp-content/uploads/wp['"][^<]{1,1650}\$\w{1,14}\s*=\s*['"]wp_frmfunct['"];[^\}]{1,120}substr\(pack\(['"]H\*['"],(?<X2285670>)|\/\*\s*\w{1,14}\s*\*\/\s*=\s*\/\*\s*\w{1,14}\s*\*\/\s*['"]?\d{1,5}['"]?;(?:(?!/)(?<X2265102>)|(?<X2264925>))))|\w{1,15}(?:\h*=\h*(?:['"](?:[^\$]{9,150}(\$\w{1,15})\h*=\h*['"]/tmp/sess_[^\{]{9,99}function\h*(\w{1,9}\(\))\h*\{\s*\$\w{1,9}\h*=\h*@?file_get_contents\([^\?]{99,300}echo\h*['"]<script>window\.location[^\{]{9,99}if\(file_exists\(\32\)\)\h*\{[^\?]{9,150}else\h*\{\s*\33;\s*\}(?<X1138963>)|Shell\h*with\h*Exploit\h*by[^\(]{9,250}@?mail(?<X2140910>))|getenv\h*\(['"]REMOTE_ADDR['"]\);[^\?]{1,450}\bsubject\h*=\h*[""]Keylogger\h+Wordpress[^;]{0,40};\s*mail\h*\(\h*\$\w{1,15}[^\)]{1,40}\);(?<X1163692>))|\s*=\s*['"][^'"]{1,99}['"][^\(]{9,40}foreach\(\[(?:\d{1,3},?){4}\]\s*as\s*(\$\w{1,15})\)\{[^\}]{9,50}\}\s*if\(isset\(\$(REQUEST)[^\{]{9,200}\{\s*(\$\w{1,15})\s*=\s*\$_\38[^\?]{99,999}\37\s*=\s*\$\w{1,15}\(['"\.creat_funio]{20,}\);\s*\$\w{1,15}\s*=\s*\37\(['"]{2},\s*\$\w{1,15}\(\39\)\);\s*\}(?<X1134811>)))
\$\w{1,20}(?:=(?:['"](?:defe?xploit\w{2,15}\.com['"];\$x.?path=['"]http://(?<X2179490>)|Hacked\h+by\b[^\{]{20,200}\{\s*(\$\w{1,20})=curl_init\(['"]https?://(?:www\.)zone\-h\.com/[^=\}&]{20,150}\bcurl_setopt\(\2,curlopt_postfields,['"]defacer=\$(?<X2195430>)|xsec(?:shell|team)['"];\$\{['"]GLOBALS\b(?<X2146870>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\([^\$]{0,20}\$\w{1,20}[^/]{9,300}\bhttps://github\.com/[^/]{9,300}<title>[^/]{0,9}(?:web\h*shell|backdoor)[^/]{0,9}</(?<X2217630>))|[\h=]+(?:['"]\.\w{1,20}['"];[^\(\)\{\}]{0,150}\$ransom(?:ware)?[\h=]+['"](?<X2194110>)|[^;]{9,60}\.(?:php|htaccess)['"];\s*(?:\$bk(?:index|ht)[\h=]+[^;]{9,60}\.(?:png|ico|jpe?g|gif|tiff)['"];\s*){2,}(?:if\((\$\w{1,20})[^\{]{9,40}\)[\s\{]+if\([^\{]{9,99}\)[\{\s]+@?chmod\(\7,\d+\);\s*@?(file_)pu(t_contents)\(\7,\8ge\9\(\$bk\w{1,20}\)\);\s*@?chmod\(\7,\d+\);[\s\}]+){1,4}(?<X1210600>)|getcwd\(\);\s*\$\w{1,20}[\h=]+explode\h*\([^\?><#]{50,150}(\$\w{1,20})[\h=]+fopen\h*\([^,]{2,30}/(?:\.cpanel|\$?user)/(?:contactinfo|.contactemail)['"]\h*,\h*['"]w+?['"]\);\s*fwrite\h*\(\11[\h,]+\$\w{1,20}\);[^\?\{#]{0,90}\bfclose\h*\(\11\);(?<X1190550>))|\[[^\]]+\]\s*=\s*['"]Xgr[0o]upVn\s*[5S]h[e3][l1]{2}\b(?<X2127110>)|\h*(?:=\h*(?:(?:getenv|\$_SERVER)(?:\(|\[)['"]?REMOTE_ADDR['"]?(?:\)|\]);\s*\$subject\h*=\h*['"]Apple\h*(?:Account)?\s*(?:info(?:rmation)?|details?|login)\b(?<X2138760>)|(\$_SERVER\[['"]DOCUMENT_ROOT['"]\])\.['"]/upload/tmp\w/['"];\s*if\(!file_exists\([^\?@]{99,500}(\$\w{1,20})\h*=\h*\15;\s*\$\w{1,20}\h*=\h*['"]<\?(?:php|=)?\h*@?\binclude(?:_once)?\h*\(\h*['"]['"]?\.\16\.['"]/bitrix/images/iblock/ib\.\w{2,4}['"]\h*\)\h*;[^@!&%]{99,500}include_once\([^\)]+\);(?<X1163325>)|@\$_POST\[['"]recipient['"]\];[^\*\+`]{300,15000}>\s*&copy;\h*Scotia\h*Bank\h*Canada\h*(?:202\d\s*)?<(?<X2169760>)|['"](?:alcustomer19814|preciousdestinyontheway|jbroughton49)@(?:gmail|usa)\.com\b(?<X2167751>)|['"]1nb0x[l1i]\w{1,3}\b[^#%&\*]{99,400}\becho\h+["']b[1i]tch(?<X2184290>)|['"]<html>\s*<head>\s*<title>\h*Rz[l1][3e]{2}[7t]</(?<X2154430>)|['"]?<<<EOD[^\.@/;]{9,200}\W{1,4}\h*FUD\h*Scripts\b[^;@#&%]{1,40}\b(?:ICQ|Jabber|Skype)\b(?<X2192060>)|['"][^'";]{0,30}\balcustomer19814@gmail\.com\b(?<X2175730>)|['"][^'";]{5,40}['"];\s*(\$\w{1,20})\h*=\h*['"];\)[^';"]{1,99}\bynir['"];\s*(\$\w{1,20})\h*=\h*strrev\h*\(\h*\24\h*\);\s*(\$\w{1,20})\h*=\h*str_rot13\h*\(\h*\25\h*\);\s*@?eval\h*\(\h*\26\h*\);(?<X1187631>)|['"][^'"]{9,99}['"];\s*(\$\w{1,20})\h*=\h*['"];[\)]{3}\w{1,20}\$\((?:\w{1,20}\()+\w{1,20}['"];\s*(\$\w{1,20})\h*=\h*strrev\h*\(\28\);\s*\29\h*=\h*str_rot13\h*\([^\)]+\);\s*@?eval\h*\(\29\);(?<X1185660>)|['"][^'"]{9,99}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2156050>)|['"][^\$]{1,30}<(method)call>\s*<(\32name)>\s*wp\.getUsersBlogs\s*</\33>\s*<params>\s*(?:<(param)>\s*<(value)>\s*<string>['"]\.htmlspecialchars\((?:\$user|\$username|\$pass|\$password)\)\.['"]</string></\35>\s*</\34>\s*){2}(?<X2149970>)|['"][^\$]{9,99}\$(?:email|user|login|username|uname)\b[^\$]{2,30}\$(?:password|pass|pwd|passwd)\b[^\(]{9,200}\bmail\([^\)]+\);\s*\?>\s*<meta\h+http-equiv\h*=\h*['"]Refresh['"]\h+content\h*=\h*['"]0;(?<X2158900>)|['"][Filesma?n\.'"]{10,20};[^\}]{99,999}\}\s*if\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*\$_[GPRSC]\w{2,6}\b(?<X2145930>)|['"]\W{1,30}\bIndramayu\h*Cyber\W{1,30}['"];(?<X2159650>)|['"]Amazone\h+billing[^'"]{0,9}spyus\b(?<X2140383>)|['"]cardservices@natwest\.co\.uk['"];(?<X2172430>)|['"]cmd\.exe['"];\s*//\W{0,20}\bphpspy\b(?<X2158290>)|['"]From:(?:[^<]{2,20}<\w{1,20}@spyus\.org>(?<X2173020>)|[^@]{3,30}@sidshell\.com['"];(?<X2143030>)|\h*Paypal\h+RZLT\h*<paypal@support\.com\b(?<X2141560>))|['"]kefiex63@gmail\.com['"];(?<X2175140>)|['"]lanadelraa@yahoo\.com['"];(?<X2140010>)|['"]logmx2013@gmail\.com['"];(?<X2163090>)|['"]magatrust-3D@server\d\.cn['"];(?<X2150290>)|['"]moban['"];[^\{]{9,99}\bget\h*\(\$url\h*,\h*(\$dir)\);\s*if\h*\(file_exists\h*\(\50\)(?<X2181490>)|['"]Office\h*365['"];\s*(?:\$\w{1,20}\h*=\h*\$_POST\[['"](?:login|u[ser]{0,3}name|pass[wor]{0,3}d)['"]\];\s*){2}(?<X2140450>)|['"]UPDATE\h[^=\\]{9,99}\bset\h+(\w{1,20})\h*=\h*CONCAT\(\53\h*,\h*\\['"]<(script)[^>]{1,150}src\h*=\h*["']https?://[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|or\.id|ga|ml)/\w{1,20}\.js\?\w=[a-z]{2,3}\d['"][^>]{1,150}>\s*</\54>\\['"]\)[^\?]{9,300}\bfunction\h+search_\w{1,20}\((?<X2164210>)|[fch][tiu](?:le_get_contents|rl_init|tp_request)\(['"]https?://api\.indoxploit\.(?<X2139092>)|\$_GET\[['"](?:email|username)['"]\];\s*\$\w{1,20}\h*=\h*\$_GET\[['"](?:password|passwd|pass|pwd)['"]\];[^\{]{9,99}\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\(]{9,99}\bfile_get_contents\(['"]https?://api\.db-ip\.[^;]{1,99};[^\$]{1,49}\$subject\h*=\h*['"]\s*Office365(?<X2142011>)|\$_POST\[['"]veio['"]\];(?<X2147252>)|\$_SERVER\[['"]REMOTE_ADDR['"]\];[^%\*\{]{20,400}\$\w{1,20}\h*=\h*array\((?:['"]\d{1,2}['"]=>['"].['"]\h*,?\h*){5}[^\)]{99,300}\);[^\?\\%]{99,999}\bmail\h*\([^\)]+\);\s*header\h*\(['"]Location:(?<X2149162>)|\$this->get\(['"]https?://api\.indoxploit\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw|or\.id)/bin/(?<X2158140>)|\176\h*s([^\w\s])\(\\\{mn\\\-fakeip\\\}\)\61\$ipinicial\61g;(?<X2168541>)|array\s*\(\s*(?:['"][\h\w\-\+]{0,30}(?:cialis|viagra|levitra|kamagra|priligy|propecia|lasix|amoxil|clomid|stromectol|vidalista)[\h\w\-\+]{0,30}['"],\s*){5}[^\?@]{4000,}(?:(\$\w{1,20})\[\d+\]=['"][^\$]+\.\$\w{1,20}\[[^;]+;\s*){20}[^\?@]{4000,}\$keywords?\h*=\h*\63\[\h*rand\((?<X2186630>)|file(?:\h*\(dirname\(__FILE+__\)\.['"]/pills\.txt['"]\);[^&#@]{999,3000}\bheader\h*\(\h*['"]Location\h*:\h*https?://[^;]{2,70}/\.\w{1,20}['"]\)\.['"]/\?\w{1,20}=(?:no_)?pill\b(?<X2183241>)|_get_contents\h*\(['"]https?://pastebin\.com/raw\.php\?i=PcrgRMTp['"]\);(?<X1186501>))|fopen\h*\(['"]b0x/b0x\.shtml\b(?<X2179570>)|new\h+phpsploit\(\);(?<X2187641>))|\.=\h*['"][^'"]{2,20}\b(?:log|result|full|detail)z['"];[^:/]{9,999}\bheader\h*\(\h*['"]Location:(?<X2170450>)|\.?\h*=\h*['"](?:\W{0,20}Yahoo\h*Scampage\b(?<X2140510>)|\W{1,30}\b(?:Created|phish|made)\h+by\h+(?:venza|jokamer)\b(?<X2143691>)|From:[^<]{2,20}<mailru@mailruphish\.com>(?<X2159130>)|Powered\h+by\b[^;"']{2,20}\bphpnuke\.ir\b(?<X2162401>))|\.\h*=\h*\$_POST\[['"]eMailAdd['"]\][^;]{0,9};[^\(]{9,99}\b(mail)\([^\)]+\);[^\$]{1,30}\b\74\([^\)]+[\)\h]+\s*\{\s*\?>\s*<(script)[^>]*>[^/]{9,99}window\.location\h*=\h*['"]\w{1,20}\.(?:php|html)['"];\s*</\75>(?<X2143310>)))
\$(?:\w{1,20}\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;[^@]{1,200}(?:(?:\$(?:message|msg|blismsg)\s*\.?=\.?[^\$]{1,40}\$_POST\[['"](?:email|pass)['"]\][^;]{1,80}\s*;\s*){2}[^/\?]{9,400}@?\bmail\([^\?]{9,99}\$\w{1,20}\s*=\s*fopen\(["'][^\.]+\.txt['"]\s*,\s*['"]a['"]\);(?<X2138051>)|\$\w{1,20}\h*=\h*['"](?:Yahoo|Office365|Hotmail|Gmail|Aol)['"];[^@]{1,200}(?:\$\w{1,40}\s*\.?=\.?[^\$]{1,40}\$_POST\[['"](?:passwd|oldpass)['"]\][^;]{1,80}\s*;\s*){2,}[^/]{9,400}@?\bmail\((?<X2138790>))|(?:getenv|\$_SERVER)(?:\(|\[)['"]?REMOTE_ADDR['"](?:\)|\]);[^%]{9,300}(?:\$(?:message|msg|bilsmsg|addss)\s*\.\s*=\s*['"](?:CARD(?:number|no)|cvv|exp|(?:atm)?pin)\b[^\.]{1,20}\.\$_POST\[[^;]{1,20};\s*){2,4}[^\/]{99,999}mail\((?<X2138420>)|(?:getenv|\$_SERVER)\h*(?:\(|\[)['"]REMOTE_ADDR['"](?:\)|\]);[^&]{9,400}(?:(?:\$(?:mess[ae]ge|msg|bilsmg|f[cua]{2}k)\s*\.\s*=\s*['"][^;]{1,150};\s*){2,}[^&#%\?]{0,1499}\bmail\h*\([^%\?!@]{9,1500}\b(?:header\h*\(['"]Location:|echo\s*['"](?:(?:<Script>\s*)?location\.(?:replace\(|href=)|<meta\s+http-equiv\h*=\h*['"]refresh))(?<X21360022>)|(?:\$(?:mess[ae]ge|msg|bilsmg|f[cua]{2}k)\s*\.\s*=\s*['"][^;]{1,150};\s*){2,}[^&#%\?]{0,1499}\btelegram_send\h*\([^%\?!@]{9,1500}\b(?:header\h*\(['"]Location:|echo\s*['"](?:(?:<Script>\s*)?location\.(?:replace\(|href=)|<meta\s+http-equiv\h*=\h*['"]refresh))(?<X2239490>))|(base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s]+;\s*\$\w{1,40}\h*=[^;]{0,99}\6[^;]{0,99};[^\}\{<>!\*,/:%&\^]{0,250}(\$\w{1,20})\s*=\s*(?:imap_)?mail\s*\([^;]{9,99}\);\s*if\s*\(\s*\7\s*\)\s*\{[^\}]{9,79}\}\s*else\s*\{\s*(?:echo|print)\s+['"][^'"]{1,16}['"]\s*\.\s*\7;\s*\}(?<X1064947>)|['"](?:\\x30|0)(?:\\x62|b)(?:\\x79|y)(?:\\x74|t)(?:\\x33|e|3)(?:\\x6d|m)(?:\\x31|1|i)(?:\\x6e|n)(?:\\x31|i|1)['"](?<X2063491>)|['"][^<]{9,60}<\s*(?:sohai\s+hacker|\w{1,20}@billybill\.com)\s*>['"];(?<X2129881>)|['"]\w{32}['"];\s*if\s*\(\s*\!\s*empty\s*\(\s*\$_SERVER\[.HTTP_USER_AGENT.\]\)\)\s*\{[^\}]+\}\s*\}\s*(?:@(?:ini_set|set_time_limit)\([^\)]+\);\s*){3,5}[^\\]{99,900}<form[^>]{1,50}method=\\['"]POST\\['"][^//]{1,50}type=\\['"]file\\['"][^;]+;\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1062053>)|['"]cmd\.exe['"];[^@]{9,200}@extract\s*\(\$_[GPRSC]\w{2,6}(?<X2126140>)|['"]Vshell\s+v[\d\.]{2,4}['"];(?<X2127080>)|\$\w{1,20}\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;\s*@?eval\s*\(\s*\$\w{1,20}\s*\)\s*;\s*\}\s*else\s*\{(?<X2046051>)|\$_SERVER\[['"]REMOTE_ADDR['"]\];(?:[^\?]{99,500}\$\w{1,20}\s*=\s*['"]From:\s*(?:Itunes|Apple)(?:ID)?\b[^\(]{9,99}mail\([^\)]+\);\s*header\s*\(['"]Location:(?<X2135270>)|\s*\}\s*\$email\w{0,9}\s*=\s*['"][^'"]{1,20}['"];\s*(?:\$(message|msg|bilsmsg)\s*\.?\s*=\s*['"](?:email|pass|password|pwd)[^;]{1,99}\.\s*\$_POST\[[^\]]+\]\s*\.\s*['"]\\n['"];\s*){2}[^\(\}\{]{1,199}\bmail\s*\([^\);]+\16\s*\);(?<X2137752>))|array\s*\(\s*['"]file['"]\s*=>\s*['"]@\$shell['"],\s*['"]name['"]\s*=>\s*\$nama_shell,\s*\);(?<X2125680>)|fsockopen\s*\(['"]udp://[^\)]+\);[^\?]{99,300}\}\s*(?:else\s+)?if\s*\(\s*\$_GET\[[^\]]+\]\s*==\s*['"]slowloris['"]\)(?<X2063860>)|getenv\s*\(['"]REMOTE_ADDR['"]\);(?:[^?]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|(?:PIN|CC)\s*(?:number)?|(?:Expir(?:ation|y)|EX)?\s*(?:date|month|year)|CVV|Card\s*(?:Number|Code))[^'"]{0,50}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){2}[^\?]{50,900}mail\((?<X2239740>)|[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|(?:PIN|CC)\s*(?:number)?|(?:Expir(?:ation|y)|EX)?\s*(?:date|month|year)|CVV|Card\s*(?:Number|Code))[^'"]{0,50}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){2}[^\?]{50,900}mail\((?<X2133821>)|[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|FULL\s*(?:number|name)?|CVV|Card\s*(?:Number|Code)|Exp\-(?:MM|YY))[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2133870>)))|\w{1,25}[\h=]+['"][^'"]+['"];\s*(\$\w{1,25})[\h=]+['"][^'"]+\.php['"];\s*(\$\w{1,25})[\h=]+['"]\./wp\-admin/images/[^'"]+['"];\s*if\(file_exists\(\24[\s\)\{]+[^\}]{9,299}\}\s*(\$\w{1,25})[\h=]+gzinflate\((file_)get(_contents)\(\24[\h\)]+;\s*\26put\27\(\23,\h*\25\);\s*chmod\(\23,\h*\d+\);\s*\}\s*\}(?<X1223130>)|\w{1,30}\s*=\s*(?:@?file\s*\(['"]/etc/passwd['"]\);[^></]{50}(?<X20496111>)|str_ireplace\(\s*"\w{1,30}"\s*,\s*""\s*,\s*"[^"]+"\s*\);\s*\$\w{1,30}\s*=\s*"[^"]+"\s*;\s*function\s+\w{1,30}\(\s*\$(err)no\s*,\s*\$\30str\s*,\s*\$\30file\s*,\s*\$\30line\s*\)\s*\{\s*array_map\(\s*create_function\s*\(\s*''\s*,\s*\$\30str\)\s*,\s*array\s*\(\s*''\s*\)\s*\);\s*\}\s*set_error_handler\(\s*'\w{1,30}'\s*\);\s*\$\w{1,30}\s*=\s*\$\w{1,30}\(\s*\$\w{1,30}\s*\)\s*;\s*(?:user|trigger)_error\(\s*\$\w{1,30}\s*,\s*E_USER_ERROR\s*\);(?<X2045931>))|\w{1,40}(?:-\s*>\s*\w+\s*=@file_get_contents\s*\(\s*\$\w{1,40}-\s*>\s*\w+\s*,\s*false\s*,\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}-\s*>\s*\w+\s*===\s*false\s*\)\s*\{\s*\$\w{1,40}\s*=\s*[^;]+\s*;(?<X2046530>)|=(?:"(?:\s*";\$\w=substr\(0,1\);for\(\$i=0;\$i<\d+;\$i=\$i\+\d+\)\s*{\$\w+\.=chr\(bindec\(str_replace\(chr\(9\),1,str_replace\(chr\(32\),0,substr\(\$d,\$i,\d+\)\)\)\)\);}eval\(\$s\);(?<X1036100>)|\w{1,20}";if\(!empty\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\){\$[^@]+@\$\w+\(stripslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);}else\s*@unlink\(__FILE__\);(?<X1036631>)|create.+?return\([^}]+};for\(\$\w+=-\d+;\+\+\$\w+<\d+;\$\w+\('','}'\.\$\w+\[\s*\$\w+\s*\]\s*\.\s*'{'\)\);};unset\(\$\w+\);(?<X1035611>))|'(?:[^']{1,40}'\^'[^']+';\s*\$\w+='[^']+';\s*(?:\$\w+='[^']+'|\$\w+=\d+);(?<X2045473>)|[^;]+;\$\w{1,40}=(?:\$\w{1,40}\[\d+\]\.?){4,};if\(isset\(\$\{(?:\$\w+\[\w+\]\.?)+}\[(?:\$\w+\[\w+\]\.?)+\]\)\){eval\(\$\w{1,40}\(\$\{(?:\$\w+\[\w+\]\.?)+\}\[(?:\$\w+\[\w+\]\.?)+\]\)\);\}(?<X1039560>)|\w+\(\!\w+\("\w+"\)\).*?;return\s+\$module->content\.html;\}(?<X1034901>)|base64_decode';\$\w+=\$\w+\(\$_[POST|GET]+\['\w+'\]\);file_put_contents\('\w+','<\?php\s*'\.\$\w+\);include\('\w+'\);unlink\('\w+'\);(?<X1034852>))|@gzinflate\(\$\w+\)\){\$\w+=create_function\('',\$\w+\);unset\(\$\w+,\$\w+\);\$\w+\(\);}}(?<X2045461>)|['"](?:[\w\-]{2,16}\.pw['"];(?:\$\w{1,40}=\$_[GPCSR]\w{2,6}\[[^;]{1,49};)?(if\(isset\(\$_)[GPRSC]\w{2,6}\[[^\]]+\]\)+\{\h*echo\h*['"]<form\b[^@]{99,499}\b[mc]o(?:ve_uploaded_file|py)\(\$_FILES\[[^@]{9,199}\b\41[GPCSR]\w{2,6}\[[^\]]+\]\)+\{unlink\(__FILE__\);(?<X2152051>)|[^'"]+['"];\s*\$\w{1,20}=(?:\$\w{1,40}\[\d+\]\s*\.?){5,};\s*\$\w{1,20}=[^;]+;\$\w{1,20}=['"][^'"]+['"];\s*\$\w{1,20}=\$\w{1,20}\.['"](?<X2045532>)|[^'"]{1999,4500}['"];(?:\$\w{1,40}=['"](?:\\x?[0-9a-f]{2,3}){1,9}['"];){2,5}(?:(\$\w{1,40})\.?=['"][^'"]{1,99}['"];)+@(?:\$\w{1,40}\(){2,5}+\44\)+;(?<X1123530>)|[^'"]{999,9999}['"];\$\w{1,40}=['"][^'"]{9,99}['"];(?:\$\w{1,40}\.?=['"][\\a-z0-9\+]{1,99}['"];){5,}@(?:\$\w{1,40}\(){3,}\$\w{1,40}\){4};(?<X1132930>)|https?://[^/]{0,9}\bbin(?:lists?|codes|db)\.\w{2,3}/[^@]{99,499}(\$\w{1,40})=fopen\(['"][^'"]{1,99}\.txt['"][^;]{1,99};(\$\w{1,40})=['"][^'"]{1,49}\bNew\s+OTP\b[^'"][^;]{1,99};fputs\(\47,\48\);(?<X2147390>))|\$_(?:[GPCSR][a-z]{2,6};\s*\$\w+\s*=\s*\$\w+\[\s*\w+\s*\];\s*if\s*\(\s*\$\w+\s*\)\s*\{\s*\$\w+=\s*\$\w+\s*\(\$\w+\s*\[\s*\w+\s*\]\s*\);\s*\$\w+\s*=\s*\$\w+\s*\(\s*\$\w+\s*\[\s*\w+\s*\]\s*\);\s*\$\w+\s*=\s*\$\w+\s*\(""\s*,\s*\$\w+\s*\);\s*\$\w+\s*\(\s*\);\s*\}(?<X1035732>)|COOKIE;\h*if\(\$GLOBALS\[[^\]]+\]\[\d+\]\(\w+\(\w+\),[^;]+;\s*\$\w+=\w+\(\d+\);\h*if[\(\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-]+\s*\d+(?:\.\d+)?[^\n]{99,}\*/(?:\v*\$GLOBALS\[[^\]]+\]\[\d+\][^\n]{99,}\*/)+(?<X1257480>))|strrev\('edoced_46esab'\);\$\w+=gzinflate\(\$\w+\('[^']+'\)\);create_function\('',"}\$\w+//"\);(?<X1035980>))|[=\s@]+(?:strtolower[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s;]+if[\(\s]+stri?pos[\(\s]+\$\w{1,40}[,\s'"]+(?:bing|yahoo|google)['"][^;]+(\$\w{1,40})[=\s]+['"]aHR0c[^'"]{3,99}['"][\s;]+\53[=\s]+base64_decode[\(\s]+\53[\)\s;]+\$\w{1,40}[=\s]+\$\w{1,40}[^\}]{9,499}\becho\b[^;\$]+\$\w{1,40}[^\}]+\}(?<X1220640>)))
\$\w{1,40}[=\s]+(?:(\$\w{1,40})[\(\s]+\$\w{1,40}[\)\s]*\|\|\s*\1[\(\s]+\$\w{1,40}[\)\s;]+(\$\w+)[=\s]+\$_REQUEST[\s;]+\$\w+[=\s]+(\$_FILES)[\s;]+\$\w+[=\s]+(!empty[\(\s]+)\2[\)\s]*\|\|\s*\4\$\w+[\)\s;]+if[\(\s]+!\$\w+\s*&&\s*\$[^;\{]+\{\s*(?:\$_[GPRSC]\w{2,6}[=\s]+)+\3[=\s]+array[^\+]{1,199}['"]w\+['"\)\s]+;(?<X1278870>)|(function)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(?:@?(?:eval|assert)[\(\s]+\7[\)\s;\}]+\b\6\s*\w{1,40}[\(\)\s]+\{\s*return\s*['"]\w+['"]\s*;\s*\}[^\+]{0,999}\$\w{1,40}\s*\[[\s\(]*\d+(?:\s*[\*\+/\-][\s\(\)]*\d+){2}[\s/\)\(\-\+\*]+\d[^\}]{0,999}\}(?<X1214130>)|eval[\(\s]+\7[\)\s;]+(\$\w{1,40})[\s=]+['"][^'"\$]+['"][\s;]+(return)\s*\9[\s;\}]+\$\w{1,40}[=\s]+\6[\(\s]+(?:\$\w{1,40}[\)\s,]+)+\{\s*\10\s*['"][^'"\$]+['"][\s;\}]+(\$\w{1,40})[\s=]+['"][^'"]{99,}['"]\s*;(?:\s*(?:\11[=\s]+)?\$\w{1,40}[\(\s]+\11[\)\s]+;)+(?<X1214640>))|(OPENSSL_)RAW_DATA;\s*(\$\w{1,40})[=\s]+\13cip\w+[\(\s]+\$\w{1,40}[=\s]+['"]AES[^'"]*['"]\.[^;]+;\s*\$\w{1,40}[=\s]+(substr\()(\$\w{1,40})[,\s]+\d+[,\s]+\14[\)\s;]+(\$\w{1,40})[=\s]+\15\16[,\s]+\14[^\{\}]{0,499}(\$\w+)[=\s]+hash_equals[\(\s]+\17[^;]*;\s*if[\(\s]+\18[\)\s\{@]+eval[\(\s]+\$\w+[\)\s]+;(?<X1260790>)|['"](?:['"]\s*;\s*(\$\w{1,40})\s*=[^;]{3,99}\.aspx['"]\s*;\s*(\$\w{1,40})[=\s@]+(file_get_contents)[\(\s]+\20[^%]{999,}(\$\w{1,40})[=\s@]+\22[\(\s]+\21[^\?]+(\$\w{1,40})\s*=[^;]+\23[^>]{9,}(\$\w{1,40})[\s=@]+\22[\s\(]+\24[^>]{9,}\becho\s*\25;(?<X1221460>)|\d+['"];\s*(\$\w{1,40})[=\s]+['"][^'"]{40,}['"]\s*;(?:\s*\$\w{1,40}[=\s]+\27\[\d+\](?:[\s\.]+\27\[\d+\])+\s*;)+\s*if[\(\s]+!function_exists[\(\s]+['"][^\n]{999,}\bunset\s*\([^\)]+\)\s*;\s*\b(?:exit|die)\b[^;]*;[\};\s'"\)]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1228381>)|http(?:s://[^'"]{8,40}\.(?:xyz|top)/?['"]\s*;\s*function\s*\w{1,40}\s*\([\)\s]+\{[^\}\{]{0,40}\bif[\(\s]+isset[\(\s]+\$_SERVER[\)\s]+\{[^@<]{999,}\bif[\(\s]+strlen[\(\s]+\$\w{1,40}[\)\s\d<>]+\{[^\}]{9,999}Not\s*Found['"][\)\s;]+(?:exit|die)\b[^;]{0,40};\s*\}\s*echo\s*\$\w{1,40}[^;]*;(?<X1206080>)|s?://(?:[^'"/]{4,}/[fz][^"']+['"]\s*;\s*function\s*(\w+)\s*\([^;\{\}]*\{\s*\$\w{1,40}[=\s]+['"](?:exit|die)['"][^<]{99,}<\?xml[^\*]{9,}\bpreg_match\b[^;\{\}]+\{\s*echo\s*\w+\s*\([^;]+;\s*\30[\s\(\)]+;\s*\}(?<X1261520>)|[^'"]+['"][\s;]+(\$\w{1,40})[=\s]+\w{1,40}[\(\)\s;]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^;\|]+\|\|\s*\32[^;]+empty[\s\(]+\$_[GPRSC]\w{2,6}\[[^/]{9,999}(\$\w{1,40})[=\s]+\32\b[^;]+;\s*(\$\w{1,40})[=\s]+\w+[\s\('"]+https?://[^;\$]+\33[^;]+;[^\}]{0,99}echo\s*\34;[^\}]{0,99}\}\s*\}(?<X1203570>)|[fz][^'"]+\.[a-z]{2,9}\b[^'"]*['"][\s;]+function\s*\w+[^\{;]+\{[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1258141>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"][\s;]+function\s*\w+[^\{;]+\{[^\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]*\}\s*\w+[\s\(\)]+;(?<X1258361>)|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[fz][^'"/]+/['"];\s*function\s*is_crawler\s*\([^\n]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]+\b\w+[\(\s]+\$\w+[,\s]+\38[\s\)]+;[^\}]+\}(?<X1268991>)|cdn[^;]+;\s*(\$\w{1,40})[=\s]+(curl_)init[\(\s]+\$\w+[\)\s;]+\41setopt[\s\(]+\40[^;]+;\s*(\$\w+)[=\s]+\41exec[\(\s]+\40[\)\s;]+\41close[\s\(]+\40[\s\);]+\$\w+[=\s]+tempnam[\(\s]+sys_get[^;]+;\s*if[\s\(]+\42\s*&&\s*file_put[^;\{\}]+\42[\s\)\{]+include\((\$\w+)[\s\);]+unlink\(\43[\s\);]+\}(?<X1284700>)))|wp\-[^'"]+\.php['"];\s*\$\w+\[\][=\s]+(\$\w+);\s*if[\(\s]+strlen[\(\s]+\45[^;]+\45[=\s]+dirname[\(\s]+__FILE__[\)\s;\}]+if[^,;]+PHP_OS[^\{'";]+['"]WIN['"\)\s]+\{[^#]{99,9999}\bexplode['"\s\(/#\*]+,[^\[]{1,40}(\$\w{1,40})[\s=]+(\$\w{1,40})\[\d+\][^\[]+\46[\.\s]+\47\s*\[[\d\]\s\)]+;\s*/\*\*/(?<X1232980>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"]perl\s+bc\.pl['"\s\.]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2223800>)|\$\w{1,40}(?:[\(\s]+\$\w{1,40}(?:[\)\s]+;\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+\$\w{1,40}[\)\s;]+\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;\s*function\s*\w{1,40}[\(\s]+(\$\w{1,40})[\)\s]+\{\s*@?eval[\(\s]+\50[\)\s]+;[^\[]{0,499}(\$\w{1,40})[\.=\s]+\$\w{1,40}\[\d+\][^\}]+\breturn\s*\51[\(\s]+\$\w{1,40}[\);\s]*\};(?<X1211300>)|\(\)[,\s]+\$\w{1,40}[\(\s]+0,100[\)\s]+;\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+['"]\\n['"]\s*;\s*\53[=\s]+\53[\.\s]+\$\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+;(?<X1220340>))|\s*;\s*if[\(\s]+!\h*\$\w{1,40}[\)\s]+\{\s*class\s*(\w+)\s*\{[^\{\}]+__construct[\(\)\s]+\{[^\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\55[\(\)\s]+;\s*\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248490>))|\$GLOBALS\[[^\]]+\][\.\s]+(\$_SERVER\[\$GLOBALS)[^\]]+\]\];\s*\$\w{1,40}[=\s]+curl_init[\(\s]+\$\w{1,40}[^\n]{99,1999}\bfile_put_contents[\(\s]+\57[^\]]+\]\s*\][\.\s]+\$GLOBALS\[[^\]]+\][,\s]+fopen[\(\s]+\$\w{1,40}[,\s]+\$GLOBALS\[[^\]]+\][\)\s;]+\}(?<X1232320>)|\[(?:\]\s*;\s*while[\(\s]+(\$\w{1,40})\s*<\s*sizeof[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+\60\[\59\]\[\d+\]\s*==\s*['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}\s*\[\59\]\s*;[^\{\}]{0,499}\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*['"]://[^:]+\61\s*;[^\176]{99,}\beval\(.?\$_POST\[[^\]]+\](?<X2221770>)|\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}[,\s]+(\$\w{1,40})[=\s]+['"][^'"]*['"][,\s]+(\$\w{1,40})[=\s]+['"][^'"]*['"][,\s]+[\(\s]+\$\w{1,40}[=\s]+function[^<\n]{99,999}(\$\w{1,40})[=\s]+empty[\(\s]+\63\s*\[[^\]]+\][\)\s]+\?[^;]+;[^:\n]{9,99}file_put_contents[\s\(]+(?:\64|\65)[,\s]+\66[^;]+;(?<X1217660>))|array(?:[\(\)\s;]+(?:(\$\w+)[=\s]+json_encode[\(\s]+\$_[GPRSC]\w{1,6}[^\?\+]{1,99}for[^\{]+\{\s*\68[=\s]+curl_init[^>]{1,350}\$\w+[=\s]+curl_exec[\(\s]+\68[^:]{1,550}if[\(\s]+is_array[\(\s]+\68[^<]{1,150}header[^\{]{1,99}if[\(\s]+isset[\(\s]+(\$\w+)[^;]+echo\s*\69;\s*exit;[^\}]*\}\s*break;(?:\s*\}){2}(?<X1253655>)|if[\(\s]+isset[\(\s]+\$\w{1,40}\s*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})[\s=]+(['"])<\\[xa-f\d\\]{2}[^\}]{9,299}\72[\s;]+(\$\w{1,40})[\s=]+['"]/tmp/\.['"\s\.]+time[\(\)\s;@]+file_put_contents[\(\s]+\73[,\s]+\71[\)\s]+;\s*@include(?:_once)?[\(\s]+\73[\)\s;@]+unlink[\(\s]+\73[\)\s;]+\}(?<X1210830>))|[\(\s]+['"]title['"]\s*=>\s*['"]B[4a@]TM[4a@]N\s+SH[3e]LL['"][,\s]+['"]subtitle\b(?<X2220160>))|base64_decode[\(\s]+['"]aHR0[^'"]+['"][\)\s;]+function\s*(\w{1,20})_uri[\(\s\)]+\{[^/\n]{9,999}://['"][^\*]{99,999}\bsitemap[^\?]+\{\s*(\$\w{1,40})\s*=\s*strtolower\s*\([^;]+;\s*if[\s\(]+!empty[\s\(]+\77[\s\)]+\{[^\?]{999,}\}\s*\76_init\s*\(\s*\)\s*;(?<X1208611>)|isset[\(\s]+(?:(?:\$_SERVER\[['"](?:\79USER_AGENT|\79REFERER|\79HOST|REMOTE_\w+|(HTTP_)ACCEP\w+)['"]\][\)\s\?"':]+){2,};\s*if[\(\s]+is_http[^\+\n]{99,}\b(sitemap)[^:\}]+(\$\w{1,40})\s*=[^\?;]+/\?\80[^;]+;[^\(]{0,99}(\$\w{1,40})[=\s]+\w+[\s\(]+\81[^#@\n]{99,}\82[\s=]+@file_g[^\}]+\}\s*return\s*\82;\s*\}(?<X1220000>)|(\$_SERVER\[['"]HTTP_USER_AGENT['"]\])[\)\s]+\?\s*(urlencode)[\(\s]+\84[^\}/]+(\$\w{1,40})[=\s'"]+https?://[^/]{4,30}\.ru/[^\?\.;'"]{1,30}\.php\?\w+[='"\s\.]+\85\s*\([^\}]{0,199}(\$\w{1,40})[=\s]+(curl_)init[\s\(]+\86[^\}]+(\$\w{1,40})[=\s]+\88exec[\s\(]+\87[^\?]{0,499}\becho\s*\89;(?<X1214070>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*:\s*\d+\s*;\s*if[\(\s]+!(function)_exists[\(\s]+['"](isHttps?)['"][\)\s]+\{\s*\91\s*\92[^\+]{99,9999}(\$\w{1,40})[=\s]+['"]PD9[^'"]{999,}['"][^\?]{99,9999}file_put_contents[^;]+\93[^;]+;(?<X2222480>))|md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{0,499}(\$\w{1,40})[\s=]+\$\w{1,40}[\.\s]+(\$_FILES)\[[^\]]+\]\[[^\]]+\][;\s]+if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+\96\[[^\]]+\]\[[^\]]+\][,\s]+\95[\)\s\{]+echo[^\}]+\}\s*else[\{\s]+echo\b[^;]+;[\s\}]+echo[\s'"]+<form[^\}]+\}(?<X1225770>)|substr[\(\s]+(?:@\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE[^;]+;[^\(\):]{0,199}\b(curl_)init[\s\(\);]+\98setopt[\s\(]+(\$\w{1,40})[^!\{\}]+(\$\w{1,40})[=\s]+\98exec[\(\s]+\99[\)\s;]+\98close[\(\s]+\99[\)\s;]+if[\(\s]+\100[^;]+;[\s\}]*else[\s\{]+header[\s\('"]+Location[^\}]+\}\s*(?:exit|die)[^;]*;\s*\}(?<X1233790>)|md5[\(\s]+microtime[\(\)\s,]+rand[\(\s,\d\)]+;\s*\$\w{1,40}[=\s]+['"]<\?[ph\s]*(\$\w{1,40})\s*=\$_COOKIE\s*;[\(\s]+count[\(\s]+\$\w{1,40}[\)\s]+==\s*['"][^;]+\bin_array[\(\s]+gettype[\(\s]+\102\b(?<X2204440>)))
\$\w{1,40}(?:[=\s]+urldecode[\(\s]+['"](?:\d[^;]+;\s*\$\w{1,40}[=\s]+is_https[\(\)\s]+\?[^\*]+\$\w+\s*=\s*['"]User\-agent:\s*\*[^>]+\bfunction\s+doutdo\s*\([^\?]+\?\s*['"]pingok[^\}]+\}\s*return\s*\$\w+[;\s]*\}(?<X1283950>)|\s*\d+\s*(?:[\+\-/\*]+\s*\d+\s*)*['"][\)\s]+;\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;[^\-]{9,9999}(\$\w{1,40})[=\s]+['"]http://['"][\.\s]+\2[^;]+;\s*(\$\w{1,40})[=\s]+\w+[\s\(]+\3[^\|]{0,1499}\becho\s*\4\s*;\s*(?:exit|die)\b[^;]{0,40};\s*\}(?<X1229830>))|[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;\s*(\$\w{1,40})[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;(?:\s*(\$\w{1,40})[\.\s]+=\s*['"]['"\h\.base64_dco]{1,12}['"]\s*;)?\s*(\$\w{1,40})[=\s]+['"][a-z\d\+/]{999,}={0,2}['"][\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:\6|\7)[\(\s]+(?:\7|\8)[\)\s]+;(?<X1212291>)|[\h=]+class_exists[\(\s]+['"]([^'"]+)['"][\)\s]+;[^\{\n]{0,99}\{\s*class\h*\10[\s\{]+private\h*\$\w+;[^\{]+\{\s*(\$\w+)[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;\s*\$\w+[\h=]+@\11\[substr\(\10::[^\n]{99,1199}\bnew\h*\10\(\);\s*\$\w+[\h=]+NULL;\s*\}(?<X1238723>)|[\s=]+(?:['"](?:c[urlint_\.'"\s]{8,};\s*\$\w{1,40}[\s=]+['"]c[urlintseop_\.'"\s]{9,};\s*(\$\w{1,40})[\s=]+['"]c[urlex_\.'"\s]{8,}c['"]\s*;[^\?]{0,99}if[\(\s]+isset[\(\s]+\$_[GPC]\w{2,6}[^\?]{0,199}(\$\w{1,40})[\s=]+\13[\(\s]+\$\w{1,40}[\)\s;]+eval[\(\s'"]+\?>['"][\.\s]+\14[\)\s;@]+(?:exit|die)\b[^;]*;\s*\}(?<X1210910>)|f\w{2,9}['"]\s*;\s*\$\w{1,40}[\s=]+['"]http[^;'"]+\.(?:top|zyx)[^;]*;\s*function\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}[=\s]+curl_init[\(\)\s]+;[^\*\\]{499,}\becho\s*\$\w{1,40}(?:[\s;]+(?:exit|die)\b[^;]*;)?[\s\};]+else\s*\{\s*header[\(\s]+['"][^'"]*Not\h*Found['"][\)\s]+;\s*\}(?<X1206040>))|\$_[GPRSC]\w{2,6}[\s;]+\$\w{1,40}[\s=]+\w+[\(\s]+\d+[\)\(\s;]+round[\(\s]+\d+\s*[\+\*/%][^\n\?]{0,999}\?(\$GLOBALS\[)[^\]]+\]\[\d+\][\(\s]+\$\w{1,40}[,\s]+(?:\$_[GPRSC]\w{2,6}[,\s\):]+)+\17[^\]]+\]\[\d+\][\(\s]+round[^@]{9,9999}\17[^\]]+\]\[\d+\]\(\$_[GPRSC]\w{2,6}\);\$\w+[=\s]+round\([^\)]+\);(?<X1229300>)|function[\s\(]+(\$\w{1,40})[\)\{\s]+EVaL[\s\(]+\19[\);\s]+(\$\w{1,40})[\s=]+['"]\w{40,}['"][;\s]+return\s*\20[^\?\-\+\*%/]{1,440}\$\w{1,40}\[\d+\s*[\-\+\*%/][^\?@\^]{1,440}(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;(?:\s*\21[\s=]+\$?\w+[\s\(]+\21[\s\)]+;)+\s*\$\w{1,40}[\s\(]+\21[\s\)]+;(?<X1213770>))|\((?:(?:\([^\)]{1,9}\^[^\)]{1,9}\)\.){3}[^@]{1,999}<title\b[^>]{0,99}>40[34]\h+(?:Not\h+found|forbidden)</title>(?<X2183701>)|\$\w{1,40}\);(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);if\([^\n]{0,16}\$\w{1,40}\(@\$\w{1,40}\[\$\w{1,40}\][^\n;\{\}]{1,99}\)\{?\24\(\);\}?(?<X1132530>)|\);\s*\}\s*\}\s*\?>\s*<html>\s*<head><title>404\s+Not\s+Found(?<X2053831>)|\s*''\s*,\s*'\}'\s*\.\s*\$\w{1,40}\s*\.\s*'//'\s*\);\s*\Z(?<X2051581>))|\.=\$\w+\(\$\w+\(\$\w+\)&0xFF\);}eval\(\$\w+\);exit\(\);\s*$(?<X2044751>)|\[(?:['"]\\[^'"]+['"]\]\s*=\s*isset[\(\s]+\$\{['"]\\[^'"]+['"]\}\[[^\]]+\][^;]+;[^<\n@]{9,}@gzuncompress[\(\s]+base64_decode[\(\s]+\$[^\n]+\bheader[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1252580>)|\w{1,40}\]\s*=\s*['"][^'"]{1,40}['"];(?:\s*(?:system|shell_exec|exec|popen|passthru)\s*\(\)\s*;){3}(?<X2056071>))|\h*(?:=\h*(?:(\$\w{1,40})\h*\(\h*['"]Sy5KTSxJjU8rzUsuyczPAwA=+['"]\h*\)\h*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\h*\(\h*(?:['"]{2}|null)\h*,\h*\31\h*\(\h*\$\w{1,40}[\h\)]+;\s*\$\w{1,40}\h*\(\h*\)\h*;\s*@?\w{1,40}\(\h*['"]\w{2,40}['"]\h*,\h*['"]\w{2,40}['"]\h*\)\h*;(?<X1159250>)|['"]@?[eval\h'"\.]{7,40}\([^;\v/\+]{1,99}\(['"][^"'\v]{99,9999}['"][\h\)]+;\h*['"]\h*;(\$\w{1,40})\h*=\h*['"]['"\h\.creat_funio]{17,40}['"];\h*@?(\$\w{1,40})\h*=\h*\33\h*\([^\)]+\);\h*@?\34\h*\([^\)]*\);(?<X1159140>)|['"][a-z]{2}_\d+\w{0,40}\.(?:doc|exe)['"]\h*;\s*\$\w{1,40}\h*=\h*['"]application/[^'"]+['"]\h*;[^\$\-=]{0,99}\bheader\h*\(\h*\$this\->(?<X2161470>)|['"]get_data_ya['"];[^\?]{99,9999}\bfunction\h*wp_v?cd\([^\}]+\}[^\?][^\?]{99,9999}<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;[^\?@=\{\}]{9,99}(\{\$\w{1,40}\})[^;]+;[^\?=]{0,99}\btouch\(['"]\37['"][,\h]+\$\w{1,40}[\s\)]+;(?<X1191600>)|['"]gz(?:inflate|uncompress)['"];(?:\s*\$\w{1,40}\h*=\h*['"](?:base64_decode|create_function)['"]\h*;){2}\s*\$\w{1,40}\h*=(?<X2177931>)|['"]https?://[^'"]{5,99}\b(?:css\d*|ima?ge?s?\d*)[^'"]{0,40}['"];\s*@?[efsp](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|xec)\(\s*['"]cd\h+/tmp;\h*(?:w?get|curl|lwp\-download|fetch|lynx)[^;]{1,99}['">]\h*([^;'">]{1,40}\.txt);\h*perl\h+\40(?:[^\)\v]{1,199}\)\h*)?;(?<X1168650>)|['"]spamtools\.be[^\v]{0,9}['"]\h*.\h*mt_rand\h*\(\d+,\d+\)\h*;(?<X2167280>)|['"]str_rot['"]\h*\.\h*3\.25\h*\*\h*4\b(?<X2172351>)|\$_[GPRSC]\w{2,6}\h*\[(base64_decode)[\h\('"]+\w{1,99}['"\h\]\)]+;\s*if[\s\(]+(?:preg_match[\h\(]+(?:\$\w{1,40}[,\s\)\|\(\{]+)+)+(\$\w{1,40})[\s=]+\44[\s\(]+['"]aHR0[^'"]{4,99}['"][\s\)]+;\s*@?header[\s\(]+\44[\s\(]+['"][^'"]+['"][\s\)\.]+\45[\s\)]+;\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1190010>)|\$_SERVER(?:\[\h*strrev\h*\(\h*strtoupper\h*\(\h*['"](?:iru_tseuqer|tnega_resu_ptth)['"](?:\h*\)){2}\s*\];[^@]{99,999}@setcookie\h*\(\h*['"]?\$?\w{1,40}['"]?\h*,[^;]+\);(?:\h*(?:exit|die)[^;]{0,9};)?(?:\h*\}){3}(?<X1160351>)|\h*\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp-(?:includes?|admin|content)/[^'"]{1,99}\.php['"];\s*\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*['"]https?://[^'"]+/(?:wso|c99|r57|b374k)(?:\\?\h*[-_]?shell)?\.txt['"]\h*\)\h*;\s*\$\w{1,40}\h*=\h*@?fopen\h*\((?<X2147161>))|\d+;\s*\$GLOBALS\[[^\?]{99,999}(\$\w{1,40})\h*=\h*Array\(\s*['"]\w+['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\49\h*\);\s*\}\s*elseif\s*\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*@?eval\h*\(\h*\50[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1160831>)|array\(\$\w{1,40}\(\h*['"]tmhapbzcerff['"][^\?\}]{1,199}\$(\w{1,40})\h*=\h*str_i?replace\(['"]//(<\?php)['"],\h*['"]\53['"],\h*\$\52\);[^\?]{1,499}\bfile_put_contents(\((\$\w{1,40}),\h*\$\52\);)[^\}\?;><=]{0,99};?\bunlink\(\55\);\s*@?unset\54\s*\}(?<X1162490>)|base64_decode[\(\s]+['"]fHstLi0hISF9fA['"][\)\s]+;\s*@?mkdir\h*\(\h*\$\w{1,40}\h*\.\h*['"](?:images|css|inlcudes|update|upgrade|upload)/?['"]\h*\)\h*;\s*\$\w{1,40}\h*=\h*['"][^'"]{1,40}\.(?:png|jpe?g|ico|gif)['"]\h*;(?<X2188610>)|chr\(\d+\)[^/]+?@\$\w{1,30}\(\s*@\$\w{1,30}\(\s*['"][^\)]{999,}\)\)\)?;(?<X2045974>)|explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=\h*\(\h*\d+\h*\-\h*\d+\h*\)\h*;\s*\$[a-z]{4,15}\h*=\h*\59\h*\-\h*1;[^\$\?\{\}]{0,499}(?=\?>)(?<X1280230>)|file_get_contents\((['"]\./wp\-load\.php['"])\h*,\h*['"]r['"]\h*\)\h*;\s*if\h*\(\h*@?strpos\(\$\w{1,40}\h*,\h*['"](\w{1,40}\.php)['"]\h*\)[^@\;\{]{1,40}@?filesize\([^;]{1,99}\62['"]\h*\)\h*>\h*\d+\s*and[^\*]{999,9999}(\$\w{1,40})\h*=\h*@?fopen\(\61\h*,\h*['"]a\+?['"][^\}]+\63\);(?:\s*\}){2}(?<X1160100>)|implode[\h\(]+['"]{2}[\h,]+array_keys[\h\(]+\$_[GPRSC]\w{2,6}[\)\s]+;\s*if[\(\s]+preg_match\s*\([^;]+;[^&]{99,9999}\bif[\s\(]+\$isHuman\h*&&[^;]+;[^\?]{0,199}\bgetHtml\d*[\s\('"]+https?://[^;]*(?:bingstyle|saleforyou|zctrack)[^\+]{9,1999}\{\h*setcookie\h*\([^;]+time\(\)[\h\+]+3600[^;]+;\h*\}(?<X1193980>)|md5\h*\(\h*\$\w{1,40}\h*\.\h*['"][^'"]{1,40}['"]\h*\);(?:\s*(\$\w{1,40})\h*=\h*str_rot13\h*\(['"](?:tmhapbzcerff|fge_ebg13|onfr64_qrpbqr)['"]\);){3}\s*@?(?:eval|preg_replace)\b[^;]{1,299}\66\h*\(\h*['"][^;]{9999,}['"](?:\s*\)\s*){4}[^;]{0,40};(?<X1148320>)|str_replace(?:\(basename\((\$_SERVER\[['"]SCRIPT_(FILE)NAME['"]\]\))[\s,]+['"]{2}[,\s]+\68\h*\.\h*['"]/['"];\s*if\s*\(\h*\69_exists\((['"]index\.php['"])\)+\s*\{\s*@?touch\(\h*__\69__\h*,\h*\69mtime\(\70\)+;\s*\}(?<X1177180>)|\h*\([^\$\[\.;]{0,19}(\$_SERVER\[)[^\]]+\][\h\.]+\72[^\]]+\][\h\)]+;\s*\$\w{1,20}[\h=]+['"]_shaesx_['"];\s*\$\w{1,20}[\h=]+['"]get_data_ya['"];[^@]{99,999}@require_once[\h\(]+\72[^;]+;[^\*,\{\}]{99,999}\bmysqli_connect\h*\([^\[@]{99,999}=\h*\w{1,40}\h*\([^;\[]+\72[^;]+;(?:\s*\}){3}(?<X1190370>)))|\->\h*\w{1,40}\h*\(\h*['"]SELECT\b[^;]{1,99}\border\s*by\s*deface\b(?<X2165321>)|\.?=\h*['"]From:\h*Neww\h*one\h*\176<Troj>(?<X2142490>)))
\$\w{1,40}\s*/\*(?:[^\*]+\*/\s*=\s*/\*[^\*]+\*/\s*\$\w{1,40}\s*/\*[^\*]+\*/\s*\([^\n]{999,9999}/\*[^\*]+\*/\s*@\$\w{1,40}\(['"][^'"=]{999,}=?=?['"][\s\)]+;(?<X1225010>)|[^\*]{0,40}\*/\s*=\s*/\*[^\*]{0,40}\*/\s*\$\w{1,40}\s*/\*[^\*]{0,40}\*/\s*\[[^\]]*\][^\n]{99,9999}@\$\w+[\s\(]+['"][^'"]{999,}['"][\s\)]+;(?<X1257940>))
\$\w{1,40}\s*=(?:"[^"]*"\s*;\s*(?:\$\w{1,40}\s*=\s*str_ireplace\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=.{3000,30000}\$\w{1,40}\s*=\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*user_error\s*\(\s*\$\w{1,40}\s*,\s*E_USER_ERROR\s*\)\s*;(?<X2050890>)|echo\s*\$\w{1,40}\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\$\w{1,40}\s*=\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*(?<X2046080>))|(?:\s*\$\w{1,40}\s*\.)?\s*['"]https?://(?:[fz](?:[\d_]+\.[^'"]+\.\w{2,9}/?['"][^;]*;(?:[^,]{0,199}\bfunction\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\3[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1252890>)|[^\{\}]{0,199}\bfunction\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\5[^\}\n]{1,199}\}(?:[^\{\}\n]{0,199}\})?(?<X1248023>))|\w+\.[^'"]+\.\w{2,9}/?['"][^;]*;[^\{\}]{0,199}\bfunction\s*\w{1,40}\s*\([^\}!]*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+(\$\w{1,40})\[['"]http_user_agen[^;]+;\s*echo\s*getSer\w+[\(\s]+\$\w{1,40}[,\s]+\7[^\n\}]{0,199}(?:exit|die|return)?\b(?:[^\}\{\n]*\}){1,2}(?:\s*(?:exit|die|return)\b[^;]*;)?(?<X1254321>))|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]+['"][^;]*;[^\{\}]{0,199}\bfunction\s*\w{1,40}(?:[\s\(]+\$\w{1,40}[\s\)]+\{\s*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+(\$\w{1,40})\[['"]http_user_agen[^;]+;\s*echo\s*getSer\w+[\(\s]+\$\w{1,40}[,\s]+\9[^\n\}]{0,199}(?:exit|die|return)\b(?:[^\}\{\n]*\}){1,2}(?<X1247782>)|\s*\([^\}!]*\$\w{1,40}[=\s]+curl_init\b[^\n\*]{99,}if[\(\s]+\$\w{1,40}[^;]+\$?\w{1,40}\[['"]http_user_agen[^;]+;(?:[^\}\n\*@/]{0,199}\}){2}(?:\s*@?\w+[\s\(\)]+;)?(?<X1254312>)))|[\(\s]*isset[\(\s]+\$_[GPRSC]\w{2,6}(?:\[[^\]]+\][\.\s]+(\$\w{1,40})\[\d+\][\.\s]+\12\[\d+\][^;]+;[^\*&]{999,}\bif[\(\s]+\$\w{1,40}\s*!=+\s*['"][^'"]*['"]&&\s*preg_match\b[^\?]{9,9999}\?header[\s\(]+\12\[\d+\][\.\s]+\12\[\d+\][^;]+;(?:[^\}\n\[:>\*]{0,149}\}){5}(?<X1217670>)|\s*\[\s*(\$\w{1,40})\s*[\[\{]\d+[\]\}](?:\s*\.\s*\14\s*[\[\{]\d+[\]\}])+\s*\][^\*\n\\]{999,}\bheader[\s\(]+\14\s*[\[\{]\d+[\]\}](?:\s*\.\s*\14\s*[\[\{]\d+[\]\}])+[\s\)]+;\s*\}(?<X1207262>))|[\s\(]*isset[\(\s]+(?:(\$_SERVER[\[\s'"]+HTTPS)['"\]\)\s]*&&\s*\16['"\]\s]+!==\s*['"]off['"\)\s]+\?\s*["']https?://['"]\s*:\s*['"]https?://[\)\s'"]+;[^\n]{99,}(\$\w{1,40})\s*\[['"]http_user_agent['"]\][^\{\}]{0,199}\b\w+[\s\(]+\$\w{1,40}\s*,\s*\17[^\}]+\}[^\n\?\{\}\(\)]{0,40}\b\w+\s*\(\s*\)\s*;(?<X1264250>)|\$_SERVER\[(\$\w+)\[\d+\][\.\s]+\19\[\d+\][^\|]{9,999}\|\|\s*\$\w{1,40}\s*==+\s*\19\[\d[^\*\%\\]{99,9999}explode[\s\('"]+\\n['"][,\s]+\$\w{1,40}[^:]{0,9999}:\s*(?:print|echo)\s*\$\w{1,40}[\s\;]+((?:exit|die)\b[^;]{0,40};)[\s\}]+else[^\}]+echo\s*\$\w{1,40}[\s;]+\20(?:\s*\}){3,6}(?<X1232310>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*;\s*if\s*\(\s*in_array\s*\(\s*"wp-config\.php"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*file_put_contents\((?<X2046240>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*if\s*\(\s*\$\w{1,40}!='[^']*'\s*\)\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@eval\s*\(\s*"[^"]*"\s*\)\s*;\s*\}(?<X1036801>)|\s*!empty[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+\?\s*\24\s*:\s*['"]index\.html?['"][\s;]+function\h*(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)]+\{\s*\$\w{1,40}[\s=]+file_get_contents[\s\(]+\26[^\176]{99,}\b(preg_match)[^\*]+\27[^;]+;[^:]{0,999}(\$\w{1,40})[\s=]+\25[^;]+;[^\}]+\becho\s*\28;[^\}]{0,40}\}(?<X1196040>)|\s*""\s*;\s*(?:\$\w{1,40}\s*\.=\s*"[^"]{0,2000}"\s*;\s*){3}.{100,7000}\$\w{1,40}\s*=\s*create_function\s*\(\s*null\s*,\s*\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;(?<X1041141>)|\s*".{32}";\s*if\(isset\(\$_REQUEST\['\w+'\]\)\)\s*{\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*eval\(\$\w+\);\s*exit\(\);\s*}\s*if\(isset\(\$_REQUEST\['\w+'\]\)\)\s*{\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*\$\w+\s*=\s*\$_REQUEST\['\w+'\];\s*\$\w+\s*=\s*fopen\(\$\w+,\s*'w'\);\s*\$\w+\s*=\s*fwrite\(\$\w+,\s*\$\w+\);\s*fclose\(\$\w+\);\s*echo\s*\$\w+;\s*exit\(\);\s*}(?<X1034551>)|\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*strtoupper\s*\([^)]{1,100}\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*(?:assert|eval)\s*\(\s*\$\s*\{\s*\$\w{1,40}\s*\}\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\}(?<X1040670>)|\s*"[preg_replace\s\.\"]+";\s*\$\w+\("/\[discuz\]/e",\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['\w+'\],"[^\"]+"\);(?<X1035341>)|\s*"\w+";\s*(?:@?preg_replace\(['"](?:\\x?[a-f0-9]{2,3})+['"]\s*,['"](?:\\x?[a-f0-9]+)+['"]\s*,['"](?:\\x?[a-f0-9]{2,3})+['"]\);(?<X1034332>)|\$\w+\s*\s*\.=\s*"\w+";\s*@\$\w+\(\$\w+\(\'[a-zA-Z0-9/=+]{100,200}(?<X2045511>))|\s*"\w+"\s*;\s*\$\w+\s*=\s*strtolower\s*\(\s*(?:\s*\$\w+\[\d+\]\s*\.?\s*)+\)\s*;\s*.+?eval\s*\(\s*\$\w+\s*\(\s*\$\{\s*\$\w+\s*\}\s*\[\s*'\w+'\s*\]\s*\)\s*\);\s*\}(?<X1034743>)|\s*"\w{1,40}";\s*\$\w{1,40}\s*=\s*"c[^;]+;\$\w{1,40}=@\$\w{1,40}\([^@]+@\$\w{1,40}\("[^"]{2000,}"\s*,\s*\$\w+\);(?<X1039710>)|\s*'['\s\.aceglpr_]{12,40}';\s*\$call_user_func_array\(\s*\$\w+\s*,\s*array\('/\[\w+\]/\w+'\s*,\s*(\$_REQUEST)\["\w+"\]\s*,\s*"[^"]+"\s*\)\);@?\w+\(\s*\38\s*\)(?:\s*;)?(?<X1045324>)|\s*'[^']*'\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*;\s*if\s*\(\s*@?md5\s*\(\s*\$_REQUEST\s*\[\s*'[^']*'\s*\]\s*\)\s*==\s*'[^']*'\s*\)\s*@?\$\w{1,40}\s*\(\s*\$_FILES\[\s*'\w+'\s*\]\s*\[\s*'\w+'\s*\]\s*,\s*\$_POST\s*\[\s*'\w+'\s*\]\s*\.\s*\$_FILES\[\s*'\w+'\s*\]\s*\[\s*'\w+'\s*\]\s*\)\s*;(?<X1040563>)|\s*'[^']+'\s*(?:;\s*\$\w{1,40}\s*=\s*create_function\s*\(\s*''\s*,\s*(?:\$\w{1,40}\{\s*\d+\s*\}\s*\.\s*)+'.{1,300}?'\s*\)\s*;\s*\$\w{1,40}\(\s*\)\;(?<X1039641>)|\^\s*'[^']+'\s*;\s*\$\w{1,40}\(""\s*,\s*"};"\s*\.\s*\$\w{1,40}\(\s*preg_match\(\s*"[^"]+"\s*,\s*\$\w{1,40}\(\s*""\s*,\s*file\(\s*__FILE__\s*\)\s*\)\s*,\s*\$match\)\s*\?\s*\(\s*\$match\[1\]\s*\)\s*:\s*""\s*\)\s*\.\s*"//"\s*\);(?<X2050580>))|\s*'[^;]+;(?:\$\w{1,40}\s*=\s*(?:\$\w{1,40}\[\d+\]\.?){3,};)+.+?;\$\{(?:\$\w{1,40}\[\d+\]\.?)+\}\(\);\}(?<X1038582>)|\s*'[assert\'\.\s]+';\s*\$\w+\s*=\s*sprintf\('[\!\(\)evalbase64_decode\s\.\']+\("%s"\)\)'\s*,\s*\$\w+\);\s*\$\w+\(stripslashes\(\$\w+\)\);(?<X2045361>)|\s*(@\$_SERVER\[)['"]HTT\w+['"]\][\s\.]+\45['"]PH\w+['"]\][\.\s]+\45['"]QUE\w+['"]\];[^@\+]{0,999}\$\w+\s*=\s*['"]Mozilla[^;]+\bcompatible;[^\{\}]+if[\s\(]+function_exists[\('"\s]+curl_init['"\)\s]+\{\s*try\s*\{[^#]{99,9999}\becho\s*\$\w+[\(\s]+\$ur\w+[\);\s]+\}\s*\}(?<X1262350>)|\s*(\$_SERVER\[)['"]REMOTE_ADDR['"]\];\s*\$\w{1,40}\s*=\s*['"](https?://)[^;]{0,49}\47[^;]{1,49};[^\{\?\}]{9,199}\{\s*(\$\w{1,40})\s*=\s*array\([^;]{1,99};\s*\$\w{1,40}\s*=\s*stream_context_create\(\49\);\s*@file_get_contents\(['"]\48[^;]{1,99};\s*\}\s*setcookie\(['"]haircki['"][^;]{1,49};(?<X1144850>)|\s*(base64_decode\()[^\(]{9,99}(\$\w{1,40})\s*=\s*\51['"]PHNjcmlwdD[^'"]{99,599}['"]\);\s*(\$\w{1,40})\s*=\s*\52[^\{]{1,99}(DIR_CATALOG)[^\{]+\{\s*(\$\w{1,40})\s*=\s*\54[^;]+;\s*if\s*\(strpos\((file_ge(t_contents\(\55)\))[^\{]+\{\s*file_pu\57,\s*str_replace\([^,]+,\s*\53,\s*\56\)+;(?:\s*\}){2}(?<X1131381>)|\s*(str_replace)[\s\(]+['"][^'"]*['"][\s,]+['"][^'"]*['"][\s,]+['"][^'"]{15,}['"][\)\s;]+(\$\w{1,40})[\s=]+\59[\s\(]+['"][^,]*['"][\s,]+['"][^'"]*['"][\s,]+(?:\$\w{1,40}(?:\s*\.)?\s*){3,}\)[\s;]+(\$\w{1,40})[\s=]+\$\w{1,40}[\(\s]+['"]{2}[\s,]+\60[\)\s;]+@?\61\s*\(\)\s*;(?<X1201591>)|\s*1;\s*\$\w+\s*=\s*get_userdata\(\$\w+\);\s*\$\w+\s*=\s*\$\w+->\w+;\s*wp_set_current_user\(\$\w+\s*,\s*\$\w+\);\s*wp_set_auth_cookie\(\$\w+\);\s*do_action\('wp_login'\s*,\s*\$\w+\);(?<X2045201>)|\s*@?\$_SERVER\[[^\]]+\];\s*if[\s\(]+\$\w+\s*==+\s*['"]\w+['"][\)\s]+\{\s*\$\w+\s*=\s*@?\$_REQUEST\[[^\]]+\];[^%<]+\bexit\s*\([^#]+if[\(\s]+strstr[\(\s]+(\$\w+)\s*,[^\*]+\64[\s\);\(]+\b(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1283430>)|\s*@?fopen\s*\(\s*['"]\w{1,40}://['"]\s*\.\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1126280>))
\$\w{1,40}\s*=(?:\s*@?getcwd\s*\(\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*@chdir\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*@?getcwd\s*\(\s*\)\s*;(?<X2046101>)|\s*@?urldecode[\s\(]+['"]\-%[^\{\}!:]{0,499}\{\s*global\s*\$\w{1,40};\s*if[\s\(]+!preg_match\b[^\[;\{\}]+\{\s*if[\s\(]+isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^>]+\bsocket_read\b[^>]{999,}\becho[\s'"\(]+(\$\w{1,40})[\s'"\);]*unset[\s\(]+\2[^;]+;\s*(?:exit|die)[^;]{0,19};[\s\}]+\w+\(\);(?<X1197230>)|\s*@\$\w{1,40}\(''\s*,\s*strrev\(';\)\)\]\w{1,40}\[REVRES_\$\(edoced_46esab\(lave'\s*\)\s*\);\s*@\$\w{1,40}\(\s*\);(?<X1040800>)|\s*@\$_COOKIE\['\w+'\];\s*if\s*\(\$\w+\) {\s*\$\w+\s*=\s*\$\w+\(@\$_COOKIE\['\w+'\]\);\s*\$\w+=\$\w+\(@\$_COOKIE\['\w+'\]\); \$\w+\("/\w+/e",\$\w+,\w+\);}(?<X1034491>)|\s*["']<\?php\s*\(["']\s*;.+?\$\w{1,40}\s*=\s*@fopen\s*\(\s*["'][^'"]*["']\s*,\s*["'][^'"]*["']\s*\)\s*;\s*@fwrite\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;(?<X1037540>)|\s*["']<FilesMatch\s*\\['"]\.\(py\|exe\|phtml\|php\|PhP\|php5\|suspected\)\$\\['"]>\\n\s*Order\s+Allow,Deny\\n\s*Deny\s+from\s+all\\n\s*</FilesMatch>\s*\\n\s*<FilesMatch\s*\\['"]\s*\^[\(\s'"]*index\.php['"]\s*;(?<X2217320>)|\s*["']https?://(?:[fz]\w+\.\w+\.[a-z]{2,9}/*["']\s*;\s*function\s*getSe\w+\s*\([^\n\*]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\b\w+\(\$\w+[,\s]+\8[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1257681>)|\d{1,3}(?:\.\d{1,3}){3}/[fz][^'"]*['"]\s*;\s*function\s*getSer\w+\s*\([^\n]{99,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\b\w+\(\$\w+[,\s]+\10[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1257770>))|\s*['"](?:\|wp\-[\w\.\-]+\.php)+['"];\s*\$\w{1,40}\s*=\s*['"]https?://\w{1,5}\.[\w\-]+\.[a-z]{2,9}/?['"];\s*\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*chdir[\(\s]+\$\w{1,40}[\)\s]+;[^\*]+\bshell\b(?<X2227870>)|\s*['"][^'"]*['"](?:;\s*if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*if\s*\(\s*md5\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\D{2,3}\s*\$\w+\s*\)\s*@?eval\s*\(\s*base64_decode\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\);\s*exit;\s*\}\s*if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*phpinfo\(\s*\);\s*\}(?<X1035722>)|\s*;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*=\s*>\s*\$\w{1,40}\s*\)\s*\{\s*if.{1,200}\s*echo\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}(?<X1041680>))|\s*['"][^'"]{1,9}(?:xml|map)\d*['"];[^#]{9999,19999}@?header\(['"]HTTP/\d\.\d\s+404\s+Not\s+Found['"]\);\s*(?:exit|die)[^;]{0,19};[^#]{99,499}\bfunction\s+\w{1,40}is_?bot\(\)\s*\{[^@]{99,499}\bfunction\s+\w{1,40}other_?bot\(\)\s*\{[^#]{999,1999}return\s*\$\w{1,40};\s*\}(?<X1194532>)|\s*['"][^;]+['"];(?:\s*\$\w{1,40}\s*=(?:\$\w{1,40}\[\d+\]\s*\.\s*){2}[^;]{1,99}\$\w{1,40}\[\d+\];\s*){2}if\s*\(\s*isset\s*\(\s*\$\{\s*\$\w{1,40}\[\d+\][^\}]+\}[^\{]{99,200}\{\s*@?eval\s*\(\s*\$\{\s*\$\w{1,40}\[\d+\]\s*\.[^\}]+\}\[\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\[\d+\]\s*\.[^\)\};]+\)\s*\]\s*\);\s*\}(?<X1037891>)|\s*['"]\*/['"]\s*\.\s*['"]@?eval[\(\s]+file_get_contents[\(\s]+base64_decode[\(\s]+['"]\$\w{1,40}['"][\)\s]+;\s*/\*+['"]\s*;[^\?]{0,999}\$\w{1,40}\s*\.?=\s*['"]<\?[ph\s]+['"][^@]{9,999}\bFront\s+to\s+the\s+WordPress(?<X2217460>)|\s*['"]\w+['"];(\$\w+)[^\.;]{1,64}\.['"/ind\.exph]{9,};\s*\$\w{1,40}\s*=\s*\$_SERVER[^\.]{4,16}\]\.['"/\.htaces'"]{9}[^%]{1,399}file_put_contents[\(\s]+\18[,\s]+\w+[^\{\}\n>\?]{1,999}\b\w+\s*\(\18[^\%\n]{9,256}\bchmod[\(\s]+\$\w+[\s,]+['"]\d+['"][\s\);]+\}\s*\}(?<X1263291>)|\s*['"]a:1:{s:13:"administrator";b:1;}['"];\s*if\s*\(\s*isset\(\s*\$_GET\[['"][^'"]{1,40}['"]\]\s*\)\s*\)\s*\{\s*echo\s*['"]<!--\s*Silence\s*is\s*golden\.?\s*-->['"];\s*\}(?<X2055820>)|\s*['"]https?://(?:[^'"]+\.txt['"]\s*;\s*\$\w+\s*=\s*\[\s*CURLOPT_[^!]+=\s*tempnam[\(\s]+sys_get_temp_dir\b[^;]+;\s*if[\s\(]+file_put_contents[\(\s]+(\$\w+)\s*,\s*\$\w+[\)\s]*!=+\s*false[\)\s]+\{\s*include\s*\21[;\s]+unlink[\s\(]+\21[^=\*\?]+\}\s*curl_close[\(\s]+\$\w+[\)\s]+;(?<X1283420>)|[fz][^'"\.]+\.[^'"\$]+\.[a-z]{2,12}/?['"][^:]*;\s*function\s*\w+[\(\s]+\$[^\n]{99,}\$\w+\s*\[['"]http_user_agent['"]\][^\}\{\n]+\}(?<X1272540>)|[fz]\w+\.[^'"]+['"]\s*;[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\24[\s\)]+;[^\}]+\$\w{1,40}\s*=\s*['"][^'"]*['"]\s*;\s*\}(?<X1279290>)|[zf]\w+\.[\w\-]+\.[a-z]{2,9}[^'"]*['"]\h*;\h*(function)\s*(\w+)[\(\)\s\{]+(?:(?:return|echo|print)[\s;]*(?:(?:exit|die)\b[^\}]*)?)?\}\s*\26\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\28[\)\s;<\?>ph]+(?:\27[\(\)\s;]+|(?:exit|die)\b[^\}]+)?\}(?<X1248874>)|\d{1,3}(?:\.\d{1,3}){3}/(?:[^'"]+['"]\s*;\h*function\s*\w+[\s\(]+\$\w+[\)\s]+\{\s*\$\w+\s*=\s*curl_init\b[^\}\n]+\}[^\n]{999,}(\$\w{1,40})\[['"]http_user_agent['"]\][^\}]*\30[^\}]{1,199}\}(?<X1248040>)|[zf]\w+/?['"\s;]+function\s*(\w+)[\s\(\)\{]+(?:return\s*)?(?:exit|die)[^;]*;\s*\}[^\n]{99,}\bif[\(\s]+\$\w{1,40}[\)\s\{]+(\$\w{1,40})\s*\[['"]http_user_agent['"]\][=\s]+\$\w{1,40}[\s;]+echo\s*\w+[\(\s]+\$\w{1,40}[,\s]+\33[\)\s;\?><ph]+\32[\(\)\s;]+\}(?<X1248521>))|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/(?:[fz][^'"]+['"]\s*;[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\35[\s\)]+;[^\}]+\$\w{1,40}\s*=\s*['"][^'"]*['"]\s*;\s*\}(?<X1279490>)|[zf][^'"]+['"]\h*;(?:[^,]{0,499}function\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\37[\)\s;<\?>ph]+(?:exit|die|return)\b[^\}\?;]*;(?<X1249490>)|\h*(function)\s*(\w+)[\(\)\s\{]+(?:(?:return|echo|print)[\s;]*(?:(?:exit|die)\b[^\}]*)?)?\}\s*\39\s*\w+[\(\s]+\$\w+[\)\s\{]+\$\w+[=\s]+curl_init\b[^\n]{99,}(\$\w+)[\['"\s]+http_user_agent[^\}\n]+\becho\s*\w+[\(\s]+\$\w{1,40}[,\s]+\41[\)\s;<\?>ph]+(?:\40[\(\)\s;]+|(?:exit|die)\b[^\}]+)?\}(?<X1248883>))))|\s*['"]unlink['"]\s*;\s*\$\w+\s*=\s*['"]base64_decode['"]\s*;\s*\$\w+\s*=\s*\$_SERVER\s*\[['"]D[^\]]+\][^!\n]{9,499}\bif[\(\s]+!\$\w+[\(\s]+(\$\w+)\s*\)[^@]{9,499}@(\$\w+)[\s\(]+\43\s*,[^\}]+@\44[\s\(]+\43[,\s]+\d?444[\);\s]+\}\s*\}(?<X1272310>)|\s*['"]wp_v?cd['"]\s*;\s*\$\w{1,40}\s*=\s*__FILE__\s*;[^\\]{99,9999}\bif[\(\s]+fwrite[\(\s]+\$\w{1,40}[,\s"'']+<\?[ph\s]+\\n[^\*>]{999,9999}\bextract[\(\s]+\w{1,40}[\(\s]+\$\w{1,40}[\s\);]+\}(?:\s*\}){1,2}(?<X1217291>)|\s*[^;]{1,99};\s*if\s*\(\s*[^\$]{40,99}(\$\w{1,40})\s*\)\s*and\s*isset\s*\(\s*\47[^!]{20,400}?(\$\w{1,40})\s*=\s*[^;]+;\s*if\(\s*!\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\49(?:e|\\x65)\w?.?['"]\s*,\s*\48[^\)]{1,9}\)\s*\)\s*;\s*die\s*\([^\)]{0,40}\)\s*;?(?<X1059542>)|\s*\$\w+\((?:'[^']+'\);\s*\$\w+=\$\w+\(\$\w+\(\)\);\$\w+\(\);\s*\$\w+\(\$\w+,"\$\w+\((?<X2045352>)|\s*""\s*,\s*\$\w+\(\s*\$\w+\(\s*array\(\$\w+\{\d+\}\s*,\s*"\\n"\s*\),\s*"",\s*"[^"]+"\s*\)(?<X2045331>))|\s*\$\w{1,40}\(\s*null\s*\.\s*\$\w{1,40}\s*\((?<X2050620>)|\s*\$\w{1,40}\s*(?:\(\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*,\s*'[^']*'\s*\)\s*;(?<X2046310>)|\.\s*['"]\d{1,3}(?:\.\d{1,3}){3}/[fz]\w+/?['"];[^\*\n]{99,}\$\w+\[['"]http_user_agent['"]\][^\}]+\}[^\?>\n]{0,199}\b\w+\s*\(\s*\)\s*;(?<X1263310>)|\[\s*\(int\)rOuND\s*\([\-\s]*\d+\.\d+\s*[\+\-/\*][^;]+;[^\n]{99,}(\$\w+)\s*=\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+;\s*if[\(\s]+!empty[\(\s]+\56[\)\s]+\{\s*echo\56\s*;\s*(?:exit|die)[^\}=\n\$]*\}\}\}\}(?<X1253320>))|\s*\$_(?:GET|POST|COOKIE|REQUEST);.{100,300}var_dump\(\$\w{1,40}\(\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\);\s*\}\s*\?>(?<X1040481>)|\s*\$_[GPRC]\w{2,6}\s*;[\s\(]*count[\s\(]+\$\w{1,40}\s*\)[^;\(]*in_array\s*\(\s*gettype\s*\(\s*(\$\w{1,40})[\s\)\.]+count[\s\(]+\59[^:;]{40,999}:\s*\59\s*;(?<X1205550>))
\$\w{1,40}\s*=(?:\s*\$_[GPRSC]\w{2,6}(?:\[[^\]]+\](?:;(?:\s*\$\w{1,40}\s*=\s*['"][^"']*['"];){2}\s*(\$\w{1,40})\s*=\s*array\((?:\d+,){2,}\s*\d+\);\s*foreach\(\1\s*as\s*(\$\w{1,40})\)\{\s*(\$\w{1,40})\s*\.\s*=\s*\$\w{1,40}\[\2\];\s*\}\s*(\$\w{1,40})\s*=\s*strrev\([^)]+\);\s*\$\w{1,40}\s*=\s*\4\("[^"]*",\s*\3\(\$\w{1,40}\)\);\s*\$\w{1,40}\(\);\s*return;(?<X1037061>)|\s*;\s*echo\s*(\$\w{1,40})\s*=\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\?\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*[^\?]{9,99}ob_start\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\6\s*\)\s*\{\s*echo\s*\6\s*;\s*\}\s*ob_end_flush\s*\(\s*\)\s*;(?<X1037571>))|\s*;\s*\$\w{1,40}[=\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-\*]\s*\d[^\n\*]{99,}/\*\s*<(?:[^@#\?]{9,9999}\?\s*\$GLOBALS\s*\[)+[^@#!]{99,}!=[^@#!]{99,}\bif[\(\s]+!\s*\$\w+\s*\[[^\>\?]{99,}\bwhile[\(\s]+round[\(\s]+\d+(?:\.\d+)?\s*[\+\-\*]\s*\d[^;\{\}]+;(?<X1258430>)|\s*\['\w+'\]\s*\(\s*''\s*,\s*\$_[GPRSC]\w{2,6}\s*\[\s*'\w+'\s*\]\s*\(\s*\$_POST\[\s*'\w+'\s*\]\s*\)\s*\)\s*;[^`]+?iterator_apply\s*\(\s*\$\w+\s*,\s*\$\w+,\s*array\s*\(\s*\$\w+\s*\)\s*\)\s*;(?<X2036192>)|\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*iconv\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*,\s*file_get_contents\s*\(\s*"http://[^"]*"\s*\)\s*\)\s*;(?<X1038171>))|\s*\$_COOKIE(?:[;\s\(\)]*(\$\w{1,40})[\s\)]*=+\s*\d+[\s&]+in_array[\s\(]+serialize[\s\(]+\11[\s\)\.]+count[\s\(]+\11[^;\?]+\?[\s\(]+\11\[\d+\]\s*=[^;:]+:\s*\11\s*;(?<X1248390>)|\s*;(?:\s*\$\w{1,40}\s*=\s*round\s*\(\s*\d+(?:\.\d+)?\s*[\+\-\*/][^:]+;)+\s*if[\s\(]+round[\s\(]+\d+(?:\.\d+)?\s*[\+\-\*/][^;]+;[^@#%]{999,}\$GLOBALS\[[^\]]+\]\[[^\]]+\]\(\$_COOKIE,[^:]+;\s*\}(?<X1261220>))|\s*\$_SERVER(?:\[['"]HTTP_HOST['"]\];\s*if[\s\(]+\$\w{1,40}\s*==+\s*['"][^'"]+['"][\)\s]*\{\s*\$\w{1,40}\s*=\s*@\$_REQUEST\[[^\]]+\];[^#]{99,9999}\$\w+\s*=\s*str_replace[\(\s]+['"]\[[^\*]{9,9999}\}\h*/\*[^\*\n]{0,32}\*/(?<X1259041>)|\s*\[['"]HTTP_ACCEPT_LANGUAGE['"]\];\s*\$\w{1,40}\s*=\s*['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^;\?]+\?\w+=['"]\s*\.\s*\$\w+;\s*(\$\w+)\s*=\s*curl_init\(\);[^!]{1,999}(\$\w+)\s*=\s*curl_exec[\(\s]+\15[^\}]+\bheader[\(\s]+['"]Location\s*:\s*\16['"][\);\s]+\}(?<X1284970>))|\s*\$dir\.DIRECTORY_SEPARATOR;\s*chmod\(\$\w+\.DIRECTORY_SEPARATOR\.'index\.php', 0644\);\s*\$\w+\s*=\s*fopen\(\$\w+\.DIRECTORY_SEPARATOR\.'index\.php'\s*,\s*"r"\);(?<X2046770>)|\s*\$GLOBALS\s*\[\s*\w+\s*\(\s*['"][^;%]{0,19}%[^;]+(\$\w+)[^;]+;[^\{\}]{0,999}\{\s*\$\w+\s*=\s*\$\w+\s*\[\s*\19\s*\]\s*;[^\{\}]+(\$\w{1,40})\s*=\s*\$\w{1,40}\s*;\s*include(?:_once)?[\(\s]+\20[\)\s]+;[^\{\}]{0,99}\}(?<X1255300>)|\s*\(\s*mktime\s*\(\s*\)\s*-\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\|\|\s*\$\w{1,40}\s*\)\s*\{\s*return\s*array\s*\(\s*'NO'\s*,\s*\$\w{1,40}\s*,\s*implode\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*else\s*\{(?<X2048210>)|\s*\d{1,10};\s*\$GLOBALS\[['"](\w{1,40})['"]\]\s*=\s*Array\(\);\s*global\s*\$\23;[^\176]{9,199}(?:[^;]{0,49};\$\23\[['"]\w+['"]\]\h*=\h*\$_[GPRSC]\w{2,6};[^\{]{1,499}\{\s*define\s*\(\s*['"]ALREADY_RUN_\w*['"]\s*,\s*\d\s*\);[^`]{99,999}eval[^\}]{1,40}\}\s*(?:exit|die)[\s\(\)\};\d]{5,19}(?<X1128098>)|[^;]{0,999};(?:\$\23\[)+['"]\w+['"]\]\[\d+\][^;]+;[^\*]{9,}\{@?eval/\*[^\*]+\*/\(\$\w+\[\$\w+\[[^\]]+\]\[[^\]]+\]\]\);\}@?exit\(\);\}\}(?<X1263803>))|\s*\w{1,40}[\(\s]+(base64_decode)[\(\s]+['"]aHR0cHM6Ly90Lm1lL3[^'";]+['"][\s\)]+;(?:\s*if[\s\(!]+\$\w+[\)\s]*\{\s*\})?\s*if[\s\(!]+(\$\w+)[\)\s]*\{\s*(\$\w+)[=\s]+fopen[\s\(]+\$\w+[\s,]+\26[\s\(]+['"]dy[^'"]+['"][\s\);]+fwrite[\s\(]+\28[,\s]+base64_encode[\s\(]+\27[\s\);]+fclose[\s\(]+\28[^\}]+\}(?<X1259180>)|\s*Array\((?:[^;]+;\$\w{1,40}\s*=\s*Array\([^;]+;\s*@\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*\$\w{1,40}\s*\[\s*chr\s*\(\s*\d+\s*\)\s*\]\s*\(\s*"[^"]*"\s*\)\s*\)\s*;(?<X1038290>)|\s*(?:(?:'\w'\s*=>\s*'\w'\s*,\s*){25}[^\)]{9,999}\);\s*@?eval(?:/\*[^\*]{0,40}\*)?/\(\s*\w{1,40}\(\$\w{1,40}\s*,\s*\$\w{1,40}\)\s*\);(?<X2262951>)|[^;]+;\s*\$\w+\[chr\(\s*\d+\s*\)\s*]\(bd\(\s*['"][^'"]+['"]\s*\)\s*\);\s*\$\w+\[\s*chr\(\s*\d+\s*\)\s*\]\(\s*\w+\(\s*['"][^'"]+['"]\s*\)\s*\);(?<X2046180>)))|\s*array\s*\((?:[^)]+\)\s*;\s*\$\w{1,40}\s*=\s*implode\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;(?<X1038590>)|[^;]{1,499}\b[cpv](?:ialis|iagra|enis)\b[^;]{1,499};[^\{\}\?:/]{1,499}\bwhile\s*\([^\?#%>]{1,1499}\bheader\s*\(\s*['"]location\s*:[^;]{1,199};[^@#%><]{1,999}\b(?:die|exit)[^;]{0,19};[\}\s]+\$\w{1,40}\s*\++;\s*\}(?<X1188554>))|\s*base64_decode(?:[\('"\s]+aHR0[^;]+;\s*\$\w{1,40}\s*\[[^\]]+\][=\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]*\?[^;]+;[^\n%]{99,}\$\w{1,40}[=\s]+["']https?://%s/ping\?[^\n@]{99,}@gzuncompress\s*\([^\n]+\$\w+\+\+;\s*\}(?<X1253050>)|[\(\s]+["']aHR0c[^;]+;\s*\$\w+\[[^\]]+\]\s*=\s*isset[\(\s]+(?:\$_SERVER\s*\[[^\]]+\][\s\)\?:]*){2,};[^@\n]{0,999}(\$\w+)[=\s]+@preg_split[\(\s]+['"](.)\{\\\|\}\37\w+['"]\s*,[^@\n]{1,999}@header[\s\(]+\36\[[^\}]+\b(?:die|exit)\b[^;]*;[\s\}]*\$\w+\+\+[;\s]*\}(?<X1276850>)|\s*\(\s*\$(?:\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*substr\s*\(\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*,\s*0\s*,\s*strlen\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*md5\s*\(\s*\$\w{1,40}\s*\)\s*\.\s*\$\w{1,40}\s*;\s*\$\w{1,40}\s*=\s*'gzinflate'\s*;(?<X2047430>)|_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*header\s*\(\s*"Pragma: hack"\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\.\s*\(\s*string\s*\)\s*\(\s*filesize\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*;\s*header\s*\(\s*'[^']*'\s*\.\s*\$\w{1,40}\s*\.\s*'[^']*'\s*\)\s*;\s*header\s*\(\s*"[^"]*"\s*\)\s*;\s*readfile\s*\(\s*\$\w{1,40}\s*\)\s*;\s*exit\s*;(?<X1037600>)))|\s*class_exists(?:[\(\s]+\$\w+[\)\s]+;(?:(?:\s*\$\w{1,40}[=\s]+(?:['"][^'"]+['"]|\$\w+|false)\s*;)*\s*if[\s\(]+\$\w+\s*==+\s*\$\w+[\s\)]+\{[^:\n]{0,499}\bclass\s*(\w+)\s*\{[^\*\n]+\}\s*\$\w+\s*=\s*new\s*/\*[^\*\n]*\*/\s*\41\s*\([^\}\n]{0,199}\}(?<X1258270>)|[^\n\*]{9,}\$\w{1,40}\s*=\s*new\s*/\*[^\*\n]*\*/\s*\w+\s*\([^\n<]{99,}\}\h*\w+[\h\(\);]+\}(?<X1265510>))|\(\$\w+\);(?:[^\n\*]{0,499}\$\w+\h*=\h*new\h*/\*[^\*]*\*/\h*\w+\h*\([^\?\n]{9,19999}\b\w+[\(\);\s]+\}(?<X1265821>)|\s*(?:\$\w+\s*=\s*(?:['"][^'"]+['"]|\$\w+|false|0|null|!1)[\s;]*)*\bif[\s\(]+\$\w{1,40}\s*==+\s*\$\w{1,40}[\s\)]+\{[^\n\*]{99,}\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\$?\w+\s*\([^;]+;[^\}]*\}(?<X1258642>)))|\s*count[\s\(]+\$\w{1,40}[\)\s]+;\s*if[\s\(]+\$\w{1,40}[^\)]*\)\s*\{\s*@?header[\s\(]+(\$\w+)\[\d+\]\s*\.\s*\46\[\d+\][^;]+;[^\n]{9,}\46\[\d+\]\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1256160>)|\s*date\("D M d, Y g:i a"\);\s*\$ip\s*=\s*getenv\(\s*"REMOTE_ADDR"\s*\);\s*\$username\s*=\s*\$_POST\[\s*['"][^"']+['"]\s*\];\s*\$password(?<X2047840>)|\s*explode(?:\(\s*["']\|["']\s*,\s*(?:\s*base64_decode\(){3,}\s*\$\w+\s*(?:\)\s*)+;(?<X2046291>)|\s*\(\s*'\|'\s*,\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*mail\s*\(\s*stripslashes\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*,(?<X2048630>))|\s*fopen\(\s*"temp1-1\.php"\s*,\s*"w"\s*\);\s*fputs\(\$\w+\s*,\s*"<\?php(?<X2047180>)|\s*fsockopen\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*30\s*\)\s*;\s*if\s*\(\s*!\$\w{1,40}\s*\)\s*\{\s*print(?:it|r)?\s*\(\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*exit\s*\(\s*\d?\s*\)\s*;\s*\}\s*//\s*Spawn\s+shell\s+process(?<X2054380>))
\$(?:\w{1,40}\s*=(?:\s*get(?:cwd\(\);\s*(\$\w{1,40})\s*\=\s*['"\s\.base64_dco]{13,40}\s*;\s*\$\w{1,40}\s*=\s*['"]/app/code/core/Mage['"];\s*\$\w{1,40}\s*=\s*\1\(['"][^'"]{1,40}['"]\);(?<X2055490>)|env\("SCRIPT_NAME"\);\s*\$\w+\s*=\s*getenv\("SCRIPT_FILENAME"\);\s*\$\w+\s*=\s*substr\(\$\w+,\s*0,\s*strpos\(\$\w+,\s*\$\w+\)\);\s*\$\w+\s*=\s*\$\w+\s*\.\s*'/xm1rpc\.php';\s*if\s*\(!file_exists\(\$\w+\)\s*\|\|\s*file_exists\(\$\w+\)\s*&&\s*\(filesize\(\$\w+\)\s*<\s*3000\)\s*\|\|\s*file_exists\(\$\w+\)\s*&&\s*\(time\(\)\s*-\s*filemtime\(\$\w+\)\s*>\s*60\s*\*\s*60\s*\*\s*1\)\)\s*{\s*file_put_content.+?\$enc1\s*=\s*\$enc2\s*=\s*\$enc3\s*=\s*\$enc4\s*=\s*"";\s*}\s*while\s*\(\$i\s*<\s*strlen\(\$\w+\)\);\s*return\s*\$\w+;\s*}(?<X1035640>))|\s*glob[\(\s]+['"]/home\d*/\*['"]\s*,\s*\w+[\)\s]+;[^\?]+\$\w{1,40}[=\s]+['"]<\?php[^#]{999,}@?file_put_contents[\(\s]+(\$\w+)\s*,\s*\$\w+[\)\s]+;\s*@?include(?:_once)?\s*\4\s*;\s*@?unlink[\(\s]+__FILE__[\)\s]+;(?<X1279530>)|\s*http_get\s*\('https://pastebin\.com/raw(?<X2049000>)|\s*JOkEr7\('https://www\.paypal\.com/(?<X2048150>)|\s*MIME::Base64::decode\s*\(\s*\$cheataer\s*\)\s*;(?<X2051910>)|\s*new\s*(?:Get_links\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}-\s*>\s*return_links\s*\(\s*\$\w{1,40}\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*(?<X1037800>)|PclZip\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}-\s*>\s*extract\s*\(\s*\)\s*==\s*\d+\s*\)\s*\{\s*die\s*\(\s*"[^"]*"\s*\.\s*\$\w{1,40}-\s*>\s*errorInfo\s*\(\s*true\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*die\s*\(\s*"[^"]*"\s*\)\s*;\s*\}\s*\?>(?<X2046280>))|\s*pack[\(\s]+['"]H\*['"]\s*,\s*(?:[\$'"]\w{1,40}['"]?|['"]\d+['"])\s*\.[^;]+\)\s*;\s*if[\(\s]+isset[\(\s]+(\$_POST)\[(\$\w+)+\][\)\s]+\{\s*\12[=\s]+pack[\(\s]+['"]H\*['"]\s*,\s*\11\[\12\][\)\s]+;(?:[^\}]+\$\w+[\(\s]+\12[\);\s]+\})+\s*(?:exit|die)\b[^;]*;\s*\}(?<X1284451>)|\s*posix_getpwuid\(@?fileowner\(['"]/etc/valiases/['"]\.\$domains?\[\d\]\[\d\]\)\);\s*echo(?<X2052740>)|\s*range[\(\s]+['"]\w{1,2}['"]\s*,\s*['"]\w{1,2}['"][\)\s]+;\s*\$\w{1,40}[=\s]+explode[\(\s]+['"],['"],\s*['"]\d{1,2},\d{1,2},[^;]+;\s*(\$\w{1,40})[=\s]+['"]{2}\s*;[^,]{0,999}(?:(\$\w{1,40})[=\s]+\15\s*\([^;]+;\s*)+@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\b[^;]*\16\s*;(?<X1274690>)|\s*str(?:len\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*for\s*\(\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*<\s*\$\w{1,40}\s*;\s*\$\w{1,40}\+\+\s*\)\s*\$\w{1,40}\s*\.\s*=\s*chr\s*\(\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\^\s*\$\w{1,40}\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X2047990>)|rev\s*\(\s*"(?:[^"]*"\s*\)\s*;\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*"[^"]*"\s*\)\s*;\s*eval\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*\)\s*\)\s*;\s*eval(?<X2047600>)|edoced_46esab"\s*\)\s*;\s*include_once\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;(?<X1038890>))|rev\s*\(\s*'(?:[^']*'\s*\)\s*;\s*\$\w{1,40}\s*=\s*create_function\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*new\s*ArrayIterator\s*\(\s*array\s*\(\s*'[^']*'\s*\)\s*\)\s*;\s*iterator_apply\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*array\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1039040>)|[^)]*'\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST)\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*"[^"]*"\s*\)\s*;\s*error_reporting\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*str_replace.+?\s*\{\s*echo\s*\$\w{1,40}\s*;\s*\}\s*die\s*;\s*\}(?<X1038901>)))|\s*system\("wget\s+http:.+?;chmod\s+\d+\s+\w+;\./\w+"\);\s*echo\s+\$\w+;\s*system\("rm\s+\w+"\);(?<X2044251>))|\w{1,9}(?:[\s=]+\w{1,9}[\s\(]+@?\$_SERVER\[['"]HTTP_ACCEPT_LANGUAGE['"]\][^\}]+curl_setopt[\s\(]+\$\w{1,40}[,\s]+CURLOPT_URL[,'"\s]+https?://['"]\s*\.\s*\$cl\d+ip\s*\.[^\]>]{9,999}header[\s\(]+['"]Refresh[:\s]+\d+;[^?>!\]\(]{9,99}exit[;\s\}]+(?<X1259371>)|\h*(?:=\h*(?:((?:pwd|password|passwd|pass)\h*\(\));[^\}]{1,99}\}\s*(?:copy|move_uploaded_file)\h*\(\$_files\[['"]\w+['"]\]\[['"]tmp_name['"]\],[^\?]{9,799}function\h*\25\s*\{\s*(\$\w{1,9})\h*=\h*getcwd\h*\(\);\s*if\h*\(\$\w{1,9}\h*=\h*strrpos\h*\(\26,\h*['"]/['"]\)\)(?<X2178701>)|['"](\$\w{1,9})\h*=\h*fopen\(['"]\w{1,20}\.php['"],\h*['"]w['"]\);\s*fputs\h*\(\28,\h*['"]<\h*\?\h*php\s*error_reporting[^\{]{1,99}\{\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*=\h*stripslashes\h*\(\29\);[^;]{0,49};\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\29\);\s*\?>(?<X2185740>)|['"](rcs\-castore)['"];\s*\$\w{1,20}[\h=]+(array)[\s\(]+["']\31['"][\h=>]+\32\h*\((?<X2191230>)|['"]\w{1,20}['"];[^\(]{0,30}(\bif\h*\(isset\h*\(\h*)\$_COOKIE\[[^\.;\}]{1,99}\.\h*getcwd\h*\(\h*\)[^\}]{1,99}\}\s*(?:\34(\$_[GPRSC]\w{2,6}\[[^\)]+\)\))\s*\{\s*[@&]?eval\h*\(\h*base64_decode\h*\(\h*\35;[^\}]{0,49}\}\s*){2,4}(?<X1188282>)|\$header\.\$(?:password|pass|pwd)\.['"].(\$\w{1,9})\h*=\h*['"\\\._creatfunio]{17,39};.(\$b374k)\h*=\h*.\37\([^,]{5},['"eval\.]{4,11}[^\}]{1,30}\38(?<X2178403>)|\d+\h*;\s*(@?chmod[\h\(]+(['"]\./index\.php['"])[,\h]+)\d{3,4}[\)\h]+;[^#\*]{99,1999}\$\w{1,9}\h*=\h*@?(file_get_contents[\h\(]+)\41[\)\h]+;\s*\$\w{1,9}\h*=\h*@?\42['"]https?://api\.\w{0,49}\.xyz[^\?]{1,599}\}\s*\40\d{3,4}[\)\h]+;(?<X1189615>)|create_function\h*\(\$\w{1,9},['"](\$\w{1,9})\h*=\h*\(!empty\((\$_FILES\[['"]\w+['"]\])[\h\)]+\?file_get_contents\(\45\[['"]tmp_name['"]\]\)\s*\:\$_COOKIE[^#]{1,129}(\$\w{1,9})\h*=\h*(base64_decode)\(\44\)\^\47[^;]{1,40};\s*eval\(\46\);(?<X2184670>)|isset\h*\((\$_[GPRSC]\w{2,6})(\[['"]f_pp['"]\])\)\h*\?\h*\49\50\h*:\h*\(isset\((\$_COOKIE)\50\)\h*\?\h*\51\50\h*:\h*(?:null|0)\);[^\?>]{9999,25000}(\$\w{1,20})\h*=\h*create_function\h*\(['"]{2},[^\)]+\);\s*unset\h*\([^\)]+\);\s*\52\(\);(?<X2185711>)|pathinfo\h*\(\$\w{1,9}\h*=\h*strtok\h*\(\$\w{1,9}\h*=\h*@\$_SERVER\[[^#/]{99,999}(\$\w{1,9})\h*=\h*curl_getinfo\h*\([^\)]+\);\s*if\h*\(\54\h*\D{2,3}\d{3}\)\h*\{[^#]{99,500}\54\h*==\h*30\d+[\s\)]+\{\s*header\h*\(['"]Location:[^;]{0,40}\54\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1146222>))|\.=\h*['"]\W{1,40}priv(?:8|ate)\h*paypal\b(?<X2185353>))|\s*=\s*(?:(?:getenv\(|\$_SERVER\[)\s*['"]REMOTE_ADDR['"]\s*[\)\]][^\?]{1,999}(\$\w{1,20})\s*\.=\s*['"]\W{0,9}(?:CVV|CSC|SSN|CVN)\d?[^'"]{0,50}:[^;]{1,29}\$_POST\s*\[\s*['"](?:cvv|ssn)\d?['"]\s*\][^\{\}]{99,999}\bmail\s*\([^\)]{0,99}\57[^\)]{0,99}\)\s*;(?<X2134405>)|@ARGV;\s*print\s+['"]\W{0,9}ConnectBack\s+Backdoor\s+by\s+Rocu(?<X2120470>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*=\s*getenv\s*\(['"]REMOTE_ADDR['"]\);[^@]{99,1500}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|Card\s*(?:number|CVV|Exp)?|SSN)[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,900}mail\((?<X2133880>)|\\['"][a-z0-9=/\+]{16,8192}\\['"];\s*(?:\$\w{1,9}\s*=\s*\\['"][a-z0-9=/\+]{16,8192}\\['"];\s*){2,5}(?:@?file_put_contents\s*\((base64_decode\()[^\)]+\),\61[^\)]+\)\s*\);\s*){3,5}@?unlink\(__FILE__\);[^\)]+\);(?<X1061502>)|array\s*\(['"]Files['"]=>['"]FilesMan['"]\s*,\s*['"]Console(?<X2125530>)|getenv\s*\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,9}\s*=\s*json_decode\s*\(\s*file_get_contents\s*\([^\(]{9,250}(?:\$\w{1,40}\s*\.?=\s*['"](?:Username|Password):\s*['"]\.\$(?:login\[')?(?:username|password)(?:["']\])?\.['"]\\\w['"];\s*){2}[^\}]{9,999}(curl_)exec(\(\$\w{1,20}\);)\s*\64close\65(?<X1060043>)|MDgetIp\(\);[^@]{9,300}(?:\$\w{1,20}\s*\.\s*=\s*['"]\W{0,9}(?:CC|CVV|SSN|PIN|Exp)[^'"]{0,50}['"]\s*\.\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2134061>))|panel\h*=\h*['"]\s*try\s*\{\s*\$\w{1,40}\h*=\h*apply_filters\(\s*\\?['"]wp_authenticate_user\\?['"]\h*,[^;]+\);\s*if\(wp_check_password\([^\}]{9,499}\}\s*\}\s*catch\h+\(\h*Exception\h+\$\w{1,40}\)\s*\{(?<X2162930>))|\w{1,}\s*=\s*[\s_.GET"']+;\s*if\s*\((?:!empty|isset)\(\s*\$\{\s*\$\w+\s*\}\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*preg_replace\(\s*[^,]+\s*,\s*[\s"e.'Val]+\(\s*\$['"]\s*\.\s*\$\w+\s*\.\s*['"]\[\s*['"]\w+['"]\s*\]\)['"]\s*,\s*['"]['"]\);(?<X1036591>)|\w{2,16}\.=['"][\\xa-f0-9_]{4,99}['"];\s*if\s*\(\s*function_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*@?\$\w{1,40}\s*\(\s*['"]{2}\s*,\s*@?\$\w{1,40}\s*\(\s*@?\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)+;(?:\s*if\s*\([^;\}\{]+\{?\s*)?@?\70\(\)\s*;(?:\s*\})?(?:\s*else\s*\{[^\}]+\})?(?:\s*;)?(?<X1133590>))
\$(?:\w{200,4999}\s*=\s*['"][^'"]+['"]\s*;(?:\s*\$\w{200,4999}\s*=\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev|convert_uudecode)\s*\([^\$]{0,99}\$\w{200,4999}\s*\)\s*;){2}[^\?{\}]{0,65000}\beval\s*\(\s*\$\w{200,4999}\s*\)\s*;(?<X1126391>)|\{(?:"(?:[^"]+"\}\["[^"]+"\]="[^"]+";\$\{"[^"]+"\}\["[^"]+"\]="[^"]+";\$\{"[^"]+"\}\["[^"]+"\]="[^"]+";(?:\$\w+="[^"]+";){2,}\$\{\$\w+\}.+"\)\);return;(?<X1035951>)|\\x\d+\\x[^;]+;\$\{\$\{.+\]\}\["\w"\]\);\}\}(?<X1054912>))|['"](?:(?:\\x47|G)(?:[^'"]{7,16}['"]\}\[[^\*]{1000,8000}\]\}\(\$\{\$\{["'][^'"]{1,40}["']\}\[["'][^"']{1,40}["']\]\}\);break;\}CASE\s+\d+:\{call_user_func_array\(["'][^"']{1,40}["'],array\(\$_REQUEST\[["'][^'"]{1,40}["']\]\)\);break;\}\}\}\}(?<X1042031>)|[^\}]+\}\[[^\]]+\]\s*=\s*['"][^'"]+['"];[^@]{400,3000}@ob_start\(\);\s*error_reporting\([^\)]*\);\s*(?:@ini_set\([^\)]+\);\s*){2,3}[^\?]{99,1500}</[^>]+>['"];\s*move_uploaded_file\s*\(\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\s*\}\s*,\s*\$\{\$\w{1,20}\}\);\s*\}(?<X1124740>))|GLOBALS['"]\}\[(?:['"]\w{4,9}['"]\]=['"]crack_?ftp['"];(?<X2123680>)|[^\]]+\]=['"](?:[^'"]+['"];\$\w{1,20}=['"]default_action['"];\$\{[^\}]+\}\[[^\]]+\]=['"](?:auth|s)_pass['"];(?<X2134383>)|auth_pass['"];\$[^=]{1,40}=['"]root['"];[^@%\?]{399,999}\bfunction\s+is_?(?:joomla|drupal|wp|wordpress)_?root\h*\((?<X2151861>))|[^\]]+\][=\s]+['"]_HEADERS['"]\s*;\s*(\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\])\s*\}[=\s]+getallheaders[\(\)\s;]+if[\(\s]+isset[\(\s]+\9\s*\}\s*\[[^\]]+\][\s\)]+\{[^\?<]{0,499}\}[\s=]+['"]<\?[^\}]+@eval[\(\s]+\$_HEADERS\[[^\]]+\][\)\s;]+["']\s*;[^=]+=\s*['"]/tmp/\.["']\s*\.\s*time[\(\)\s]+;(?<X2228010>)))|\$(?:\w{1,40}\}=unserialize\(\w+\(base64_decode\([^;]+;if\(isset\(\$\{\$\w{1,40}\}\[['"]ak['"]\]\)[^\?]{99,199}(\$\{\$\{['"]GLOBALS['"]\}\[)['"]\w+['"]\]\}=Array\(['"]pv['"]=>phpversion\(\),[^\?]{9,99}eval\(\11['"]\w+['"]\]\}\[['"]\w+['"]\]\);\}\}(?:\?>)+\Z(?<X2131860>)|\{['"](?:[^'"]{1,60}['"]\}\[['"][^'"]{1,60}['"]\]\}=['"]/['"]\.uniqid\(\)\.uniqid\(\);(?<X2052550>)|[GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[=\s]+curl_init\s*\(\);\h*curl_setopt[\(\s]+\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[,\s]+CURLOPT_URL[,\s]+['"]https?://\w+\.[a-z]{2,3}/[^'"]+\.txt['"][\s\)]+;[^\n\?]{99,999}\becho\s*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\};(?<X1231810>)|GLOBALS['"]\}\[[^\]]+\]\}\s*=\s*['"]FilesMan['"];\s*\$\{(?<X2129462>))))|_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[.p1.\]\); else @unlink\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?<X2043862>)|(GET|POST|REQUEST|COOKIE)\[\s*"\w{1,40}"\s*\]\s*\?\s*\$_\17\[\s*"\w{1,40}"\s*\]\s*\(\s*\$_\17\[\s*"\w{1,40}"\s*\]\s*\)\s*:\s*null;(?<X1040380>))|_+\s*=\s*"[^;]+;\s*eval\(\$_+\(\$_+\)\);(?<X2049640>)|_?(?:passw?o?r?d?|auth_pass)\h*=\h*["']\w{32}['"];[^\$]{0,60}\$h[ea]c?ker\h*=(?<X2172170>)|_(?:[GPRSC]\w{2,6}\s*\[(?:'\w+'\]\(\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\(\s*'',\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\['\w+'\]\s*\)\s*\)\s*\)\s*;(?<X1036031>)|[^\]]+\]\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\(["']["']\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\);(?<X1035581>))|[O0]*="[a-f0-9]{32}";\$_[O0]*=str_rot13\(.*?eval\(strrev\('.*?'.*?eval\(_[0O]*\(_[0O]*\(".*"\),\$_[0O]*\)\);eval\(_[0O]*\(\$_[0O]*\)\);\$\w+='.*?';(?<X1034831>)|\d=\$_(?:REQUEST|GET|POST)\['id'\];\s*(?:\$_\d=["']\w{1,5}['"];\s*)?\$_\d=curl_init\(\);\s*\$_\d='http(?<X2050041>)|\w{1,40}\s*=\s*basename\s*\(\s*trim\s*\(\s*preg_replace\s*\(\s*rawurldecode\s*\(\s*"[^"]{1,200}"\s*\)\s*,\s*''\s*,\s*__FILE__\s*\)\s*\)\s*\)\s*;(?<X2055011>)|_=hex2ascii\(\$_+\);\s*\$.="\$_+";\s*\$.=[eval\."'\s]+\(\$.\)';\s*assert\(\$.\);(?<X2045401>)|COOKIE\s*=\s*WSOstripslashes(?<X2043911>)|F(?:=__FILE__;\$_X='P2lCPz5NY2VXKDxlbk1bVV85TTJPOU0oJzhDcjA5Qy5(?<X2047500>)|ILES\[[^\]]+\]\[[^\]]+\][\);\s@]+passthru[\(\s@\\]+\$_GET\s*\[(?:\s*['"])?\s*cmd[\]\s\)'"]+;(?<X2259610>))|POST(?:\[(?:"pwd"\]="Weak\s*Liver(?<X2048420>)|(['"]botID['"])\]\)\)\s*\$id\s*=\s*filterString\(\$_POST\[\31\]\);\s*if\s*\(\s*isset\s*\(\s*\$_POST\[['"]track['"]\](?<X2056460>)|['"](?:c(?:v[vc]|ardnumber)['"]\][^\?]{1,999}/sendMessage\?.{0,499}?\$_POST\[['"]otp['"]\](?<X2226520>)|password['"]\][^\?]{499,1999}\$(headers)\h*=\h*['"][^;]{1,999}\bx\-mailer\h*:\h*PHP/['"]\h*\.\h*@?phpversion\(\);\s*@?mail\h*\([^\)]+\$\34\b[^;]{1,99};\s*(?:\?>\s*|echo\s*['"])<meta\b[^>]{1,99}\bhttp\-equiv=['"]refresh['"][^>]{1,99}\bcontent=['"]\d{1,5};\h*URL=[^\s]{0,9}\bthanks\.html?['"](?<X2155571>)|ssn1['"]\]\s*(?:\.\s*['"][^'"]*['"]\s*)?\.\s*\$_POST\[['"]ssn2['"]\]\s*(?:\.\s*['"][^'"]*['"]\s*)?\.\s*\$_POST\[['"]ssn3['"]\][^;]{0,99};[^\(]{1,2999}mail\s*\((?:\s*\$\w{1,40}\s*,?){4}\)\s*;(?<X2129900>)))|\h*\[['"]P(?:asswo?r?d|a?s?wd?)['"]\][^\?]{1,499}\bExcel\b(?:[^\?>]{1,499}\$\w{1,40}\->(?:ip|city|region|countryName|countryCode)\b){2}(?<X2166420>))|proxify\s*=\s*array\s*\([^\)]+\);\s*\$_version\s*=\s*['"]Ketika\s+Sahabat Menjadi\s+BANGSAT['"];(?<X2063320>)|REQUEST\[.\]\s*\?\s*eval\(\s*base64_decode\(\s*\$_REQUEST\[.\]\s*\)\s*\)\s*:\s*exit;(?<X1034441>)|S(?:=".{3000,20000}\);\$\w{1,40}=strrev\([^)]+\)[^(]+\("[^)]+\);\$\w{1,40}=\$\w{1,40}\('\$_S',\$_X\);\$\w{1,40}\(\$_S\);(?<X1039620>)|E(?:RVER\[['"](?:HTTP_USER_AGENT['"]\]\)\)\s*\{\s*header\(['"]HTTP/\d\.\d\h+404\h+Not\h*Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}\s*\?>[^/]{9,50}<title>[^/<]{0,40}\bUploader\b(?<X2158260>)|SERVER_NAME['"]\]\s*\.\s*['"]\W{0,9}PHP\s+Uploader(?:\s+by)?\s+M[0o]J[0o]['"];(?<X2121440>))|SSION\['(?:_ip_'\];\s*//+\s*\$LOGS\s*=\s*"\["\s*\.\s*date\(\s*'Y-m-d[^;]+;\s*file_put_contents\(\s*'[^']+'\s*,\s*\$LOGS\s*\.\s*PHP_EOL\s*,\s*FILE_APPEND\s*\);(?<X2046340>)|codeMethod'\]\['singleencoder'\]\s*=\s*'on';(?<X2261740>))|SSION\[['"]_LOOKUP_CNTRCODE_['"]\]\h*\.[^;]{1,99};\s*\?>(?<X2183522>))))|_{4,}[=\s]+['"]\d+['"];\s*(\$_{4,})[\s=]+['"][^\$'";]{40,}['"]\s*;\s*\$\w{1,40}[\s=]+['"][^'"\$]{9999,}['"]\s*;\s*@?(?:eval|assert)[\s\(]+html_entity_decode[\s\(]+(?:gz(?:inflate|uncompress))[\s\(]+base64_decode[\s\(]+\46[\s\)]+;(?<X1217110>))
\$(?:a(?:\s*=\s*[\.\sbase64decode_"]+;\s*assert\(\$a\((?<X2044811>)|D(?:conn\s*=\s*new\s*adLDAP;\s*if\(\$ADconn->existingUser\(\$user\['username'\]\)\){\s*section\("Active\s*Directory",2\);\s*content\(\);(?<X2046740>)|min\[['"]p(?:ass(?:wo?r?d)?|wd?)['"]\]\h*=\h*['"]\w{1,60}['"];[^\(]{0,20}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*['"]ZXJyb3JfcmVwb3(?<X2159901>))|l(?:fa(?:\w{0,9}\->exec[\s\('"]+cmd\.exe(?<X2222470>)|_P(?:ass)?(?:wo?r?d)?\h*=\h*['"][a-f\d]{32}['"]\h*;[^\?]{1,999}\$\w{1,40}\h*=\h*file_get_contents\h*\(\h*__FILE__\h*\)\h*;(?<X2168670>))|lowed_referers\h*=\h*array\(["']m4st3r['"]\h*,\h*["']m1st3r['"]\);(?<X2171550>))|p(?:iurl=['"]https?://(?:[\d\.]{1,99}/\176x|ex\-)robotos(?:\.com)?/[^'"]{1,99}\.php['"];\$titlesArray=array\((?:['"](?:Verify|Confirm|(?:sign|log)\s*in\s*to)\s*your\b[^'"]{1,99}['"],){3}(?<X2177691>)|p=JFactory::getApplication\(\);\s*\$option5=\$app.+\(\$layout5=='default'\)\){echo\s*base64_decode\('[^']+'\);\s*}(?<X1038550>))|R(?:GC\s*!\s*=\d+\s*\)\s*\{\s*print\s+['"]\\n\+\s*mazacrew-bot\\n";(?<X2123660>)|r\s*=\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER);\s*foreach\s*\(\s*\$arr\s*as\s*\$\w{1,40}\s*=>\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*\$\w{1,40}\s*==\s*"\w{1,40}"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*end\(\$\w{1,40}\);.{1,100}echo\s*\$\w{1,40};\s*\}\s*\}(?<X1040461>))|su="move_";\s*\$asu\.="uploaded_";\s*\$asu\.="file";(?<X2048960>)|uth_pass(?:\h*=\h*(?:['"]|base64_decode\h*\()[^%\\\*]{999,2500}\bfunction\h+login_shell\h*\(\)\s*\{(?<X2180030>)|\s*=(?:.+;eval\("\\x65(?<X2045770>)|\s*"[^"]*"\s*;\s*\$color\s*=\s*"[^"]*"\s*;\s*\$default_use_ajax\s*=\s*true\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*="[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*eval\s*\(\s*"[^"]*"\s*\)\s*;(?<X1041440>)|\s*['"][^'"]*['"];[^\$]{1,600}(\$\w{1,40})\s*=\s*['"][^'"]{99,9999}['"];[^\$]{1,600}@?eval\(\s*gz(?:uncompress|inflate)\(\s*base64_decode\(\15\)\s*\)\s*\);(?<X2123180>)|\s*md5\s*\([^;]+;(?:\s*(\$\w{1,40})\h*=\h*str_rot13\h*\(\h*\\['"](?:tmhapbzcerff|fge_ebg13|onfr64_qrpbqr)\\['"]\h*\)\s*;){3}\s*@eval\s*\([^;'"]+\17\s*\(\s*['"][a-z\d\+/]{9999,}['"][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};(?<X1196410>))))|b?cc\h*=\h*['"]chiziahu['"]\h*\.\h*['"]@['"]\h*\.\h*['"]yandex\.com['"];(?<X2165900>)|b(?:ackdoor\h*=\h*['"]<\?php\h+goto\b(?<X2156260>)|c+\s*=[^;:]{1,199}https?://rei\.my\.id/(?<X2222420>)|ilsmg\h*\.\h*=\h*['"][^:]{0,20}\bwells\h*(?:fargo|card|email|[3e]pin|fullz)[^:]{1,40}\b(?:login|password|re[zs]ult)\b[^\*&]{99,999}mail\((?<X2155372>)|keyword_bez\h*=\h*['"][^'"]{3,199}['"];(?:\s*\$nick[1-4]\h*=\h*['"][^'"]{3,12}['"];){4}\s*\$date01\h*=(?<X2149340>)|lo(?:cked_words\s*=\s*array\([^\)]{99,900}\);[^/]{99,400}header\s*\(['"]\S{1,9}\s+(404\s+Not\s+Found)['"]\);\s*die\(['"]\S{1,9}\24[^\)]{9,60}\);\s*\}\s*\}\s*\$Bot\s*=\s*array\([^\)]{2000,9000}\);(?<X2065332>)|ginAttemptCaptured\(\$curPeriodEndingDate,\$quota_info\);(?<X1220330>))|ot\[['"]server['"]\]=\$servban\[rand\(0,count\((?<X2106251>))|c(?:a(?:che\w{0,9}\h*=\h*['"]wtuds['"]\h*;(?<X2171090>)|m(inhoMailer)\)\{include\s*\$cam\29;[^@]{99,499}\$mail->password=\$SendSenha;(?<X2125191>))|gish[3e]{1,2}ll\)\);\s*fclose\(\$wtf2\);\s*chmod\(\$file,0755\);(?<X2118831>)|heck_copyright\s*=\s*create_function[^\{\}]{0,599}\$global_version\s*=\s*array_walk\b(?<X2048292>)|o(?:de\s*=\s*'\s*<\?php\s*\$user_agent_to_filter = array\( \\'#Ask\\s\*Jeeves(?<X2046020>)|lor\s*=\s*"#df5";(?:.+?ololo_VERSION.+'\)\)\);\s*exit;(?<X1038730>)|\s(?<X2043552>))|nfig(?:\[['"]title['"]\]\h*=\h*['"][s5]h[e3]ll\h+C[o0]ntr[o0]ll[e3]r\h*['"]\h*\.(?<X2176080>)|\s*=\s*array\(\s*['"]title['"]\s*=>\s*['"]B[A4]TM[A4]N\s+SH[e3]LL['"]\s*,(?<X2064280>))|ntent(?:\h*=\h*gethttpcnt\h*\(\h*['"]https?://[^;]{1,99};\s*if\h*\(\h*stri?str\h*\(\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{\};]{99,199}\{\s*echo\h*\$content;\s*\}(?<X2154250>)|\s*=\s*http_request\(\s*"http://"\.\$_SERVER\['SERVER_NAME'\]\s*\.\s*"/\w+"\);\s*\$content\s*=\s*str_replace\(\s*"/\w+"\s*,\s*\$uri\s*, \$content\s*\);\s*exit\(\s*\$content\s*\);(?<X2047780>)|_mb=(?:getHTTPS?(?:Page)?|file_get_contents|Gethtml)\(\$\w{1,16}\.['"]/index\.(?:(?:x|p)?html?|php)\?(?:host|type)\b(?<X2045586>))|pyright\h*=\h*['"]&copy;\h*Rush\h*Security\h*Team\b(?<X2182100>)))|d?doss(?:tr)?;\s*\}\s*while\s*\(\s*\w{1,40}\s*\)\s*\{\s*\$[o0]{5,60}\s*=\s*@?include(?:_once)?\s*\(?\$[o0]{5,60}\)?;\s*if\s*\(\s*\$[o0]{5,60}\s*==\s*['"][^'"]{0,60}['"]\s*\)\s*\{\s*\$[o0]{5,60}\+\+;(?<X2052960>)|d(?:ata(?: = curl_get_from_webpage_one_time\(\$url(?<X2045601>)|(?:Table)?\s*=\s*\$LokiDbCon->(?<X2051771>)|\s*=\s*file_get_contents\('php://input'\);\s*if\s*\(strlen\(\$data\)\s*<=\s*4\)\s*d\('e0'\);(?<X2047690>))|efault_(?:action(?:=[FilesMan'\.]+;\s*\$color=['#df5\.]+;\s*\$default_use_ajax=true;(?<X2045341>)|\s*=\s*(?:['"\.]{0,4}['"]FilesMan['"];\s*(?:[^/]{1,199}\s*header\(['"]HTTP/1\.\d*\s*404\s+Not\s+Found['"]\);(?<X2125430>)|\$default_use_ajax\s*=\s*(?:true|1);(?<X2046892>))|['"]FilesMan['"];[^\(]{0,40}preg_replace\s*\(['"](.)[^'"]{1,5}\49e['"]\s*,(?<X2123430>)))|charset.*=\h*\.*\$dc\.\$dc2(?<X2043703>)|use_ajax\s*=\s*(?:true|1);(?:[^;]{0,50};\s*\$default_action\s*=\s*['"\.]{0,4}['"]FilesMan['"];(?<X2063440>)|\s*\$default_(?:action\s*=\s*['"][FilesMan'"\.]{9,25}['"];\s*\$default_charset\s*=\s*['"]['"\.Windows\-\d]{10,30}['"];(?<X2126921>)|charset\s*=\s*['"]['"\.Windows\-\d]{10,30}['"];\s*\$default_action\s*=\s*['"][Brutefoc'"\.ilsMan]{8,25}['"];(?<X2130261>))))|F[s5]Cmd\d*\s*=\s*array[\s\('"]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?<X2251050>)|ir\.[\'"]/[\'"]\.\$f\.[\'"]/wp\-config\.php(?<X2102781>)|l(?:\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['dl'\][\)\s]+;\s*\$cp\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['cp'\][\)\s]+;\s*\$cd\s*=\s*urldecode[\(\s]+\$_COOKIE\s*\['cd'\][\)\s]+;(?<X2047711>)|e['"]\s*\.\s*['"]_lic\s*=\s*['"]@E[^\n;]+;[^\}]+\$dle['"]\s*\.\s*['"]_conf\s*=\s*\$\w+['"]\s*\.\s*['"]\w+['"]\s*\.\s*['"]\w+\s*\(\s*\\?['"]\\?['"]\s*,\s*['"]\$dle_lic;?['"][\);\s]+\$dle_['"]\s*\.\s*['"]conf[\(\s]+\\?['"]\\?['"][\)\s]+;(?<X1212520>))|o(?:mains_dir\s*=\s*estimate_current_path\(\s*\);\s*process\s*\(\s*\$domain\s*,\s*\$domains_dir\s*\);\s*foreach\s*\(get_valid_dirs(?<X2049010>)|or(?:id|url)[\h=]+md5\h*\([^\$]{2,50};\s*\$door(?:id|url)\h*=(?<X2194201>)|p_query\s*=\s*@?file_get_contents\s*\(\s*\$\w{1,40}[^,\);]+\.ini['"]\s*,\s*FILE_IGNORE_NEW_LINES\s*\)\s*;(?<X2124420>)|uble\s*=\s*1;\s*}\s*\$email\s*=\s*urlencode\(\$email\);\s*if\s*\(!empty\(\$_SERVER\["HTTP_CF_CONNECTING_IP(?<X2049020>))|root=\$_SERVER\['DOCUMENT_ROOT'\];\s*\$link="<\?php\s*setcookie.{500,}?unlink\(\s*\$path\s*\.\s*"/footer\.php"\s*\);\s*rmdir\s*\(\s*\$path\s*\);(?<X1039680>))|e(?:mailusr\s*\.?=\s*['"][^@]{1,40}@protonmail\.com['"]\s*;\s*\{?\s*@?mail\([^\;]{1,200}\)\s*;\s*\}?\s*\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2053960>)|n(?:coder57txt\h*=\h*['"]ZXZhbC[^'"]{99,300}['"];\s*\$r57txt\h*=(?<X2140250>)|gines\)\s*\{\s*if\s*\(preg_match\(\s*"/\$engines/"\s*,\s*\$_SERVER\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*echo\s*file_get_contents\(\$target(?<X2051250>))|x(?:_links\h*=\h*['"][^'"]{5,15}['"];[^\*`\^]{200,25000}\$\w{1,20}\h*=\h*['"]https?://promogoogledos\.\w{2,6}/['"];\$\w{1,20}\h*=\h*['"]https?://[^\?'";]{5,20}\?\w=\d['"];\s*\$\w{1,20}\h*=\h*['"]https?://[^/]{2,15}\.ru/\w{1,20}\.txt\b(?<X2159430>)|py\s*=\s*\$_POST\['expy'\];\s*\$cvv\s*=\s*\$_POST\['cvv'\];\s*\$ip\s*=\s*\$_SERVER\['REMOTE_ADDR'\];(?<X2048170>)|tention\s*==\s*'js'\s*\)\s*\)\s*\{\s*\$content\s*=\s*@file_get_contents\(\$dirname\s*\.\s*\$sobs(?<X2049370>))))
\$(?:f(?:f\s*=\s*\$f1\s*\.\s*\$f2\s*\.\s*\$f3;\s*if\s*\(file_exists\(\$ff\)\)\s*chmod\s*\(\$ff\s*,\s*0777\);(?<X2047390>)|il(?:e(?:\s*=\s*(?:"N-Cool-\$date\.sql\.gz";\s*\$gzip\s*=\s*TRUE;\s*\$silent\s*=\s*TRUE;(?<X2050830>)|\$exec_path\.\$drop_name;\s*drop_file\(\$file\s*,\s*\$\w{1,40}\);\s*\}\s*@chmod\(\$file\s*,\s*0777\);(?<X2051200>))|_content\s*=\s*httpget3\(REMOTE_FILE\s*,\s*\$context\);\s*\$file_name_array\s*=\s*explode(?<X2049870>)|_path = dirname\(__FILE__\) \. '/' \. basename\(\$_FILES\["file"\]\["name"\]\);\s*move_uploaded_file\(\$_FILES\["file"\]\["tmp_name"\], \$file_path\);\s*\$file_name = basename\(\$file_path\);(?<X2044591>)|sMan[\h=]+[^;]+;\s*if[\h\(]+\$_GET\[['"]hackncorp['"]\][^\{]+\{\s*if[\h\(]+isset[\h\(]+\$_POST\[['"]uploaded['"]\][\)\{\s]+\$file[\h=]+\$_FILES\[['"][^\n]{899,1200}\bUploader\h*Hidden\h*\W*</\w*>\h*<form\h*action=[^\n\?\}]{9,199}</html>['"];\h*\}(?<X1265741>))|ter\s*=\s*['"][^'"]{0,40}['"];\s*\$\w{1,40}\s*=\s*['"]\s*From\s*:\s*kay\s*<\s*mailist@mailist\.com\s*>\s*['"];(?<X2055750>))|inish_result\s*=\s*array_unique\(\$finish_result\);\s*foreach\s*\(\$finish_result(?<X2048510>)|older = str_replace\(\$_SERVER.+ http_build_query.+function http_parse_headers.+\$s \.= \$m\[2\]\.\$m\[3\];(?<X2044671>)|rom(?:\h*=\h*['"]ani-shell\b\$\w{1,20}@fbi\.gov['"];(?<X2140120>)|\s*=\s*['"][^'"]{1,40}['"]\s*;\s*\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:user|username|login))\s*=\s*\$_POST\[['"]\11['"]\];\s*\$((?:yahoo|gmail|outlook|aol|office365|adobe)(?:pass|password|passwd))\s*=\s*\$_POST\[['"]\12['"]\];(?<X2054801>))|u(?:ck_crawler\h*=\h*['"]\w{1,40}['"]\h*;[^\?\{\}\[\]>]{0,9999}\bfunction\h+\w{1,40}\h*\(\h*\)\s*\{\s*date_default_timezone_set\h*\((?<X2168391>)|llurl\s*=\s*""\s*\.\s*\$\w+\s*\.\s*"<br><p>Emails:<br><TEXTAREA.*?>"\s*\.\s*\$\w+\s*.\s*"</TEXTAREA></p><p>Engenharia:<br><TEXTAREA.*?>"\s*\.\s*\$mensagem\[\d+\]."</TEXTAREA>(?<X2045111>)))|g(?:___g_\s*=\s*\$(?<X2043571>)|et_size_of_file[\h=]+['"\h\.filesz]{5,35};[^\n]{99,200}(\$change_mode)[\h=]+['"\.\hchmod]{5,35};[^\n]{999,2000}\bcall_user_func[\h\(]+\17,\h*\$ht_path,\h*[\d\+\h]+\);\}\}(?<X1218040>)|if=file\(dirname\(__FILE__\)\.'/images/\w+\.gif',2\);\$gif=\$gif\[\d+\]\("",\$gif\[\d+\]\(\$gif\[\d+]\)\);\$gif\(\);(?<X1034501>)|LOBALS(?:\[(?:'(?:\w+'\]\s*=\s*\$_SERVER;\s*function\s+\w+\(\$\w+\)\s*{\s*\$\w+\s*=\s*"";\s*global\s*\$\w+;\s*for\(\$\w+=intval\('\w+'\);.+?\${\w+\([^}]+}\s*\s*=\s*@?\${\w+\([^}]+}\(\$\w+,\s*FALSE,\s*\${\w+\([^}]+}\);\s*return\s*\${\w+\(\s*[^}]+};\s*}(?<X1036110>)|_\d+_'\]\[\d+\]\(\$default_charset,\$auth_pass,\$color,\$default_charset\)(?<X2044541>)|Alfa_Protect_Shell'\](?<X2046070>))|['"](?:\w{1,13}["'\]\s=]+https?://(?:\w+\.)?(?:rorories|dermaxot|winbigprize)\.top['"];(?<X2284460>)|\w{1,9}['"]\]\[['"]b374k['"]\]\s*=\s*['"](?<X2124451>)|_XML_['"]\]\s*=\s*(Array)\s*\([^\)]{99,999}\);\s*\?>\s*<\?\s*function\s*XML\s*\(\$\w{1,20}\)\s*\{\s*\$\w{1,9}\s*=\s*\25\(['"](?:md\d|sha\d{1,3})['"]\s*,[^,]+,['"][^'"]{20,64}['"],\s*['"]ivanov['"],['"]vasil(?<X2122500>)|resources['"]\]\[['"](?:mime|gping\.c|xhide\.c|logs\.c|system_so_x64|system_so_x32)['"]\]\h*=\h*['"][^'"]{700,6000}['"];(?<X2266270>)|ver['"]\]\h*=\h*['"][\d\.]{1,9}['"];\s*\$GLOBALS\[['"]title['"]\]\h*=\h*['"]b374k['"];(?<X2151791>)|WP[_\-][VC]?CD(?:_CODE|_CD)?['"]\][\s\)]{1,40}\{\s*if\h*\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"]wp[_\-]v?cd['"]\h*\)(?<X2157221>))|(?:[^\?]{47500,48000}>404\s+Not\s+Found[^\?]{900,1000}\)\)\);\}else\{echo\s*\w{1,40}\(\d+\);\}\s*\Z(?<X2052480>)|[^\]]+\]=Array\(base64_decode\((?:[^#\n\\]{999,9999}\[round\(0\+[^\)]+\)\]\s*\.\s*\w{1,40}\s*\(\d+\)\s*,\s*\d+\s*\);\s*\}(?<X1126950>)|[^;]+;\s*(?:\?>\s*<\?(?:php|=)?\s*)?function\s*(\w{1,40})\((\$\w{1,40})\)\{(\$\w{1,40})=Array\([^;]+;\s*return\s*base64_decode\(\34\[\33\][^;]+;\s*\}\s*(?:\?>\s*<\?(?:php|=)?\s*)?\$\w{1,40}=[^;]+\32[^\n]+\32\(\d+\)[^;\n]+;(?:die|exit)[^;]{0,9};[^\}\n]{0,40}\}(?:endif;)?(?<X1124150>))|[^\]]+\]\h*=\h*(?:md|sha)\d+\(['"]aghacker['"]\);(?<X2162880>)|[^\]]+\]\s*=\s*(Array\()(?:base64_decode\([^\)]+\),?){9}[^;]{99,999}\);\s*(?:\?>\s*<\?)?\s*function\s+(\w{1,20})\((\$\w)\)\s*\{\s*(\$\w)\s*=\s*\37[^\)]{99,999}\);\s*return\s+base64_decode\(\40\[\39\]\);\s*\}[^\-]{999,3500};\s*(?:echo|print)[^;]+\38\(\d+\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\}(?<X1119631>)|[^]]+\]\s*=\s*\$_SERVER;\s*function\s*\w+\(\$\w+\)\s*{\s*\$\w+\s*=\s*["']['"]\s*;\s*global.+?\(\s*\$url\s*,\s*FALSE\s*,\s*\${\s*\w+\(\s*[^)]+\)\s*}\s*\);\s*return\s*\${\s*\w+\(\s*[^)]+\)\s*}\s*;\s*}(?<X1037220>)))|\h*\[\h*(\w{1,40})\h*\(\d+\)\h*\]\h*=\h*\43\h*\(\h*\d+\h*\)\h*;[^\?]+\$\w{1,40}\h*=\h*\43\h*\(\h*\d+\h*\)\h*;\s*\$\w{1,40}\h*=\h*\w{1,40}\h*\([^;]+\$pathtodor\h*,(?<X1177920>))|oweb\s*=\s*['"][\w\-\.]{4,}\.[a-z]{2,6}['"]\s*;\s*(\$\w{1,40})\s*=\s*(?:md5[\s\(@]+)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*if[\(\s]+\45\s*\S{2,3}\s*['"][a-f\d]{32}['"][\)\s]+\{[^%]{999,}\$\w{1,40}(?:\[\d+\])?\s*%[^\}]+\}[^\*]{9,}\breturn\s*\$file_contents[;\s]*\}(?<X1210950>)|roup_num[=\s]+['"][^'"]+['"];[^:]{0,199}\$\w{1,40}[=\s]+['"]https?://\d{1,3}(?:\.\d{1,3}){3}/?['"][^\n]{999,9999}\becho\s*\$\w{1,40}[;\s]+\b(?:exit|die|return)\b[^;]{0,40};(?:\s*\})+(?:\s*else\s*\{[^\}]*\})?(?<X1223372>))|h(?:eader(?:\h*=\h*[^\}\(;]{1,20}<(title>)['"]\.getenv\(['"]http_host['"]\)\.[^<;]{1,20}\w{1,40}\h+shell\h*v[\d\.]+\h*</\48(?<X2173271>)|\s*\.?\s*=\s*quoted_printable_encode\s*\(\s*\$\w{1,40}\)\s*\.?['"]?(?:\\r)?\\n['"];\s*mail\s*\([^\)]{1,40}\);\s*print\s*['"]Spammed(?<X2052410>)|s\h*(?:=\h*['"]From:(?:[^<]{0,20}<codewizard@approject\.com\b(?<X2139320>)|\h*xAmericans\b[^\(\)]{9,99}\bmail\h*\((?<X2164380>))|\.?=\h*['"]From:(?:\h*C33\-O44\h*<(?<X2175150>)|\W{1,9}\bBGfullz\h*<(?<X2173680>))|\.?\h*=\h*['"]From:\h*myhack@hacks\.com['"](?<X2153630>))|s\s*=\s*(?:"From:\s*MafioZo0(?<X2046750>)|['"](?:[^'"]{0,40}DHL['"];\s*(\$\w{1,40})\s*=\s*array\s*\(\s*(\$\w{1,40})\s*\)\s*;\s*foreach\s*\(\s*\57\s*as\s*\58\s*\)\s*if\s*\(\s*mail\s*\(\s*\58\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*!=\s*false\s*\)\s*\{\s*header\s*\(\s*['"]Location:(?<X2054600>)|From:\s*Office['"];\s*\$str=array\((?:\$send)\);\s*foreach(?<X2054871>)))|s\s*\.?=\s*['"]From:\s*[^'"]{0,40}(?<!\$)Spam[^'"]{0,40}['"];(?<X2056128>))|ost\h*=\h*['"]https?://[^;]+;\s*(\$\w{1,15})\h*=\h*\d;\s*\$goshop\h*=\h*empty\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{999,2999}\bif\((\$_SERVER\[)[^\]]+\]\h*==\h*['"]/['"]&&\62\)\s*\{\s*header[^<]{0,199}\becho\h*['"]<script[^#]{99,999}\bunlink[\(\s]+\63['"]DOCUMENT_ROOT['"]\]\h*\.\h*["']/xmlrpc\.php['"][\s\)]+;(?<X1197160>)|t(?:access\s*=\s*"https://pastebin\.com/raw/\w+";\s*\$file\s*=\s*file_get_contents\(\$htaccess(?<X2051290>)|ml\s*=\s*curl_exec\s*\(\$ch\);\s*curl_close\(\$ch\);\s*if\s*\(strstr\(\$id\s*,\s*"\.css"\s*\)\s*\)\{\s*header\('Content(?<X2049321>))))
\$(?:i(?:=strpos\(\$im,'\[UPD_CONTENT-'\);(?<X2044461>)|mgData\s*=\s*@\$p2\(@\$p1\(\$imgData\)\);(?<X2044261>)|n(?:dex[\h=]+(\$_SERVER\[[^\]]+\]\.['"]/)index\.php['"];\h*(\$\w{1,25})[\h=]+\3\.htaccess['"];\h*\$\w{1,25}[\h=]+[^;]+;\h*(\$\w{1,25})[\h=]+\3wp\-[^'"]+\.(?:gif|png|jpe?g)['"];[^\n]{0,599}\b(file_)put(_contents)[\h\(]+\4,\h*\6get\7[\h\(]+\5[\h\)]+;\h*\@?chmod[\h\(]+\4,\h*\d+[\h\)]+;\h*\}\h*\}(?<X1218870>)|stall_code\s*=\s*str_replace\s*\(\s*'\{\$PASSWORD\}'\s*,\s*\$install_hash\s*,\s*base64_decode\s*\(\s*\$install_code\s*\)\s*\);(?<X2048136>)|ter_domain(?:[\h=]+['"]https?://[^;]+;\$\w+[\h=]+['"][^'"]*['"];function\s*curl_get_contents\([^\?\n]{99,9999}\bbots[\h=]+['"]googlebot\|[^\n]{999,3000}=(getServerCont)\(\$\w+,\$\w+\);\h*header\([^\)]+\);[^\n]{99,}\b\10\(\$\w+,\$\w+\);\h*return;\}\h*echo\h*['"]<!DOCTYPE\h*html>['"];(?<X1233193>)|\s*=[^;]{9,};\s*function\s+\w+\s*\([^\}]+\}\s*function\s*(\w+)\s*\(\s*\$\w{1,40}[^\n]{999,}\$\w{1,40}\s*=\s*\12\s*\([^\n]{9,999}\}(?<X1232460>)))|p(?:[\h=]+getenv[\h\(]+[^\)]+\);\h*(\$\w+)[\h=]+isset[\h\(]+\$_POST\[['"]log['"]\]\)[^;]+;[^\n\{]{0,199}\{\s*(\$\w+)[\h=]+(curl_)init[\h\(\)]+;\s*\16setopt[\h\(]+\15,[^,]+,\s*(base64_)decode\([^\)]+\)[\h\.]+\17encode[\h\(]+[^\)]{0,99}:\14\|[^\n]{0,199}\b\16close[\h\(]+\15[\h\)];\s*\}(?<X1236820>)|\s*=\s*(?:(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])(?:;(?:.{0,600}(\$(?:message|spam|bilsmg))\s*\.?=\s*['"][\[\]<>\!\*\&\s\:\|+\.=_\w\$'"]{7,99}\\n['"]\s*;(?:\s*\19\s*\.?=\s*['"]\s*(?!(?:Subscr|news))[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){1,12}\s*\19\s*\.?=\s*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{9,99}\\n['"]\s*;(?<X2052079>)|\s*.{0,600}\s*(\$data)\s*\.?=\s*['"][-\s\w]{10,90}\\n['"]\s*;(?:\s*\21\s*\.?=\s*['"](?:Email|Password|IP(?:Address)?)[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){2,3}\s*\21\s*\.?=\s*['"][-\s\w]{10,90}\\n['"]\s*;(?<X2056011>)|\s*//\s*\w{1,40}\s*(?:\s*\$\w{1,40}\s*=\s*\$_POST\[['"][^'"]{1,40}['"]\];){2,16}\s*\$fw2\s*=\s*fopen\((?<X2052161>)|\s*[^\?]{200,600}Social\s*Security\s*Number\s*:\s*\$ssn(?<X2054461>)|\s*\$(?:\w{1,40}\s*=\s*\$_SERVER\[['"]HTTP_USER_AGENT['"]\];\s*\$\w{1,40}\s*=\s*date\(['"][^'"]{1,40}['"]\);\s*(\$message)\s*\.?=\s*['"]Email[^\n]{1,40}\\n['"];\s*\25\s*\.?=\s*['"]Password(?<X2054060>)|datamasii\s*=\s*date\(['"][^'"]{1,40}['"]\);\s*\$(user|userid|login|email)\s*=\s*\$HTTP_POST_VARS\s*\[\s*['"]\27['"]\s*\]\s*;\s*\$(pass|password|pwd)\s*=\s*\$HTTP_POST_VARS\s*\[\s*['"]\28['"]\s*\]\s*;\s*[^\?]{1,600}\s+@?mail\s*\((?<X2053971>)|from\s*=\s*['"]From:\s*\w{0,39}\s*<?hacker@(?<X2054640>))|\s*\}(?:\s*session_destroy\(\);)?\s*(\$fp)\s*=\s*fopen\(['"][^'"]{1,40}['"],\s*['"]a\+?['"]\);\s*fwrite\(\31[^;><\?'"]{1,40}['"]<\?[ph\s]*echo\b[^\?]+\bcv[vc]\d*(?<X2052221>))|\s*;\s*(?:\$\w{1,40}\s*\.?=\.?\s*[^;]{1,80}\s*;\s*){4,8}\s*@?mail\([^)]{1,80}\)\s*;\s*header\s*\(\s*['"]Location\s*:[^)]+\);\s*exit;\s*\?>(?<X2052360>))|\$_SERVER\['REMOTE_ADDR'\];\s*\}\s*\$referrer = urlencode\(@\$_SERVER\['HTTP_REFERER'\]\);\s*\$url = "http://\d+\.\d+\.\d+\.\d+/api\.php\?is_api=1&action=get&api_key(?<X2049770>)|get(?:_?Client_?Ip\h*\(\)\h*;.{0,600}(\$(?:message|spam|bilsmg))\s*\.?=\s*['"][\[\]<>\!\*\&\s\:\|+\.=_\w\$'"]{9,99}\\n['"]\s*;(?:\s*\35\s*\.?=\s*['"]\s*(?!(?:Subscr|news))[^\n]{1,60}(?:['"]?\\n['"]|['"]/['"]);){1,12}\s*\35\s*\.?=\s*['"][\[\]<>\!\*\&\-\s\:\|+\.=_\w]{9,99}\\n['"]\s*;(?<X2193371>)|env\((?:"REMOTE_ADDR"\);\s*\$\w{1,40}\s*=\s*json_decode\(file_get_contents\([^\)]{1,99}\)[^\}]{99,499}(\$\w{1,9})=array\((?:['"][^'"]{1,3}['"]=>['"][^'"]{1,3}['"],){9}[^\);]{99,150}\);(\$\w{1,9})=(?:\37\[['"][^'"]{1,3}['"]\]\.){9}[^;]+;[^\}\(\)\{,\->\s]+mail\(\38,[^\)]+\);(?<X1124070>)|['"]REMOTE_ADDR['"]\)(?:;(?:[^\.]{0,90}(\$message\s*\.)\s*=\s*['"][^\\]+\\n['"];[^/]{1,200}\40\s*=\s*['"](?:Password|pwd|pass|psw)[^/]{1,200}\40\s*=\s*['"][^/]{0,30}https?://www\.geoiptool\.com[^'"]+["'];[^\(]{9,300}@?mail\s*\([^\)]+\);[^\{]{30,150}\{\s*header\s*\(['"]Location:[^\)]+\);(?<X2065041>)|\s*\$file\s*=\s*fopen\("[^'"]{0,9}ip\.txt","a"\);\s*fwrite\(\$file,\$ip\."\s*-\s*"\.gmdate\s*\("Y-n-d"\)\."\s*@\s*"\.gmdate\s*\("H:i:s"\)\."\\n"\);\s*(?:\?>|\$)(?<X2118580>))|\s*;\s*\$(country)\s*=\s*\w{0,40}\43\(\);\s*\$(region)\s*=\s*\w{0,40}\44\(\);\s*\$(city)\s*=\s*\w{1,40}\45\(\);(?:\s*\$\w{1,40}\s*=\s*date\(['"][^'"]{1,40}['"]\);)?\s*\$\w{1,40}\s*=\s*\$_POST\[['"]username['"]\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"]password['"]\];(?<X2054390>))|\s*"REMOTE_ADDR"\s*\);\s*\$browser\s*=\s*getenv\s*\(\s*"HTTP_USER_AGENT"\s*\);\s*\$message\s*\.=\s*"(?:-+\|\s*Full\s*Infos(?<X2047080>)|\s*-+\|\s*CC\s*Infos(?<X2047050>)))))|\w{0,20}\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];\s*\$(?:from_)?sh[e3]llcode\s*\.?=\s*['"]?[^\(]{0,20}gethostbyname\s*\((?<X2055191>)|s?\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"\]\s;]+\$\w{1,40}[\s=]+['"]https?://[^;]+;\s*\$\w{1,40}\s*=(?:[^;\[]*\$_[GPRSC]\w{2,6}\[[^\]]+\])+[^;\[]*;\s*if[\s\(]+![^>;]+(\$\w{1,40})[\s=]+array\s*\([^;]+;\s*(\$\w{1,40})[\s=]+stream_context_create[\s\(]+\50[\s\)@;]+file_get_contents[\s\(]+['"]http[^;]+\51[\s\)]+;(?<X1201140>))|s(?:_human\)\h*foreach\((\$stop_agents_mask)s\h+as\h+\53\h*\)\h*if\h*\(\h*preg_match\h*\(\h*['"]/['"]\h*\.\h*\53\h*\.\h*['"]/i['"]\h*,\h*@\$server_user_agent\h*\)\h*\)\h*\{(?<X2162510>)|human\h*=\h*(detectbot)\d*\h*\([^\}]{9,499}\}\s*function\h+\55\h*\([^\)]+\)\s*\{\s*\$stop_ips_masks\h*=\h*array\s*\((?<X2162542>)))|J(?:hon_?Coders\s*=\s*['"][^'"]{99,300}['"];\s*\$Black_?Coders\s*=\s*['"](?<X2137810>)|SubMenuHelper\s*=\s*create_function\('',\s*\$JSubMenu\);\s*unset\(\$\w+,\s*\$JSubMenu\);\s*\$JSubMenuHelper\(\s*\);(?<X2048770>))|l(?:ang\[['"]SSN['"]\]\s*=\s*['"][^\)]{300,1500}jQuery\(function\([^\)]+\)\s*\{\s*(?:\$\(['"]\.cc-(?:number|exp|cvc|cvv|ssn|vbv)['"]\)\.payment\([^\)]+\);\s*){2,4}(?<X2063113>)|eaf\[(?:'version'\]="2\.7";\s*\$leaf\['website'\]="leafmailer\.pw";(?<X2045860>)|['"]website['"]\]\h*=\h*['"]leafmailer\.pw['"]\h*;(?<X2153690>))|i(?:cense\s*=\s*\$_POST\s*\[\s*'[^']*'\s*\]\s*\(\s*''\s*,\s*\$_POST.+?;\s*\$License\s*\(\s*\)\s*;(?<X2048850>)|nks(?:0000\h*=\h*@?file_get_contents\h*\(\h*\$cache_dir\h*\.\h*\$md5_url\h*\.\h*['"]\.tmp['"]\h*\)\h*;(?<X2162481>)|\s*=\s*new\s+Get_links\(\);\s*\$links\s*=\s*\$links->get_remote\(\);\s*echo\s*\$links;(?<X1041430>)))|o(?:calpath(?:=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$root_path=substr\(\$absolutepath,\d+,strpos\(\$absolutepath,\$localpath\)\);\$\w+=\$root_path\.'/\w.+touch\(dirname\(\$\w+\)\s*,\s*time\(\)\s*-\s*mt_rand\(\d+\*\d+\*\d+\*\d+, \d+\*\d+\*\d+\*\d+\)\);\s*}(?<X1035890>)|\s*=\s*getenv\("SCRIPT_NAME"\);\s*\$absolutepath\s*=\s*getenv\("SCRIPT_FILENAME"\);\s*\$root_path\s*=\s*substr\(\$absolutepath,\s*0,\s*strpos\(\$absolutepath, \$localpath\)\);\s*\$xml\s*=\s*\$root_path\s*\.\s*'/xm1rpc\.php'.*?\$chr1\s*=\s*\$chr2\s*=\s*\$chr3 =\s*"";\s*\$enc1\s*=\s*\$enc2\s*=\s*\$enc3\s*=\s*\$enc4\s*=\s*"";\s*}\s*while\s*\(\$i\s*<\s*\s*strlen\(\$input\)\);\s*return\s*\$output;\s*}(?<X1035850>))|g(?:_file(?:\h*=\h*dirname\h*\(\h*__FILE__\h*\)\h*\.\h*['"]/proxy_log\.txt['"];[^\+\?&]{299,499}\bif\h*\(\h*preg_match\h*\([^\{]{1,99}\{\s*if\s*\(\s*function_exists\s*\(\h*['"](opcache_invalidate)['"][\)\s]+\{\s*\67\h*\(['"](conf\.php)['"]\);\s*\}\s*@?include(?:_once)?\h*\(['"]\68['"]\)\h*;(?<X2155780>)|_name\s*=\s*GetDocRoot\(\)\s*\.\s*"/\s*"\s*\.\s*"\w+\.log"\s*;\s*if\s*\(\s*isset\(\s*\$_POST\[(?<X2048810>))|in="\w+";\s*\$\w+=str_rot13\("\w+"\);\s*\$\w+\s*=\s*str_rot13\('\w+'\);\s*\$\w+="\w{32}";\s*eval\(\$mdh\(\$md\(strrev\('(?<X2045301>)|in\s*=\s*(?:['"][^;]+;(?:\s*//[^\n]+\n)?\s*\$pass\s*=\s*['"][^;]+;(?:\s*//[^\n]+\n)?\s*\$md5_pass\s*=\s*['"][^;]*;(?:\s*//[^\n]+\n)?\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(\s*base64_decode\s*\(\s*['"][^'']{30000,}['"][\s\)]+;(?<X1038941>)|\$_SESSION\['clientemail'\];\s*\$passwd\s*=\s*\$_POST\['passwd'\];\s*\$own\s*=(?<X2050910>)))|kiDBCon\s*=\s*new\s+LokiDB\((?<X2124200>))))
\$(?:m(?:(?:e?sg|essage)\h*\.?=\h*['"][^;]{1,99}\b(oluxshop)\b[^\?]{1,199}\$subj?(?:ect)?\h*=\h*['"][^;]{1,99}\1\b(?<X2160141>)|(e?sg|essage)\h*(?:=(?:[^;]{1,99}\$pass(?:wo?r?d)?\b[^;]{1,99};\s*@?mail\(\h*['"][^@'"]{1,99}@(?:yahoo|yandex|aol|gmail|protonmail)\.[^,\)]+,\h*['"][^'"]+\bPa(xful|ypal)\h*(?:inf[0o]|l[0o]g)[^\)]+\$m\3\b[^;]{1,99};\s*header\(\h*['"]Location:\s*https?://[^/]{0,99}\bpa\4\.(?<X2161660>)|\h*['"][^;]{1,199}\$pass(?:wo?r?d)?\b[^\?]{1,199}\bmail\([^\)]+\$m\3[^;]{1,49};\s*\?>\s*<script[^/]{1,199}\blocation(?:\.href)?\s*=\s*['"]https?://(?:www\.)?[mhlo](?:ive|utlook|otmail|icrosoft|ffice(?:365)?)\.com\b(?<X2154303>))|(?:\.=[^;]{1,49}\$pass(?:wo?r?d)?\b[^@]{1,99}\bmail\([^\)]+\$m\3\b[^@]{99,999}<(title>)\s*Wrong\s*Password\s*</\7(?<X2154600>)|\.?=\h*['"](?:[^;]{1,199}\$pass(?:wo?r?d)?\b[^#!%&\*\}\{]{1,499}\bmail\([^\)]+\$m\3[^;]{1,49};\s*(?:@?f(?:close|open|write)\s*\(\s*){3}[^\)]+\)\s*,\s*\$m\3\)\s*\);\s*[^\?]{1,99}<(script)\b[^/]{0,99}\blocation(?:\.href)?\s*=\s*['"][\w\-/\.]{1,49}\.(?:php|html?)['"]</\9>(?<X2154310>)|\W{1,49}created\s*by\s*\w{1,49}\W{1,49}\\n['"];[^\}\?]{1,499}\bmail\([^\)]+\$m\3[^;]{1,49};[^\?]{1,199}fwrite\([^\)]+\$m\3\);\s*fclose\(\s*\$\w{1,40}\s*\);\s*\?>\s*<(script)\b[^/]{0,199}\blocation(?:\.href)?\s*=\s*['"][\w\-/\.]{1,49}\.(?:php|html?)['"];?\s*</\11>(?<X2154321>))))|ai(?:ler->send\(\$_POST\[[^\]]{1,40}\],\$subject,\$(?:messages?|msgs?)\);\s*\}\s*echo\s*json_encode\(\$\w{1,40}\);\s*\}\s*else\s*\{\s*header\s*\(\s*\$_SERVER\[[^\]]{1,40}\]\s*\.\s*['"]\s+404\s+Not\s+Found['"]\s*\);\s*\}\s*class\s+Mailer\s*\{(?<X2059590>)|n[\h=]+\[\s*['"][A-Z0-9]+['"],\s*['"][A-Z0-9]+['"][^\?]{9,399}\bif[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+\?>\s*<(html)>[^#]{999,2500}\becho\([^/]+\bUpload[ed]*\h*file[^#]{99,799}\b\14>\s*<\?php\s*\}(?<X1206670>))|cdata=array\(\);\$mcdata\[0\]=base64_decode\('[.a-zA-Z0-9_/=]+'\);array_filter\(\$mcdata, base64_decode\('[.a-zA-Z0-9_/=]+'\)\);\?>(?<X2044901>)|essage(?:;\s*\}\s*\?>\s*<\?php\s+system\(\s*['"]chmod\s+\d+\s+(\w{1,40})\.php['"]\s*\);\s*\?>\s*<\?php\s+chmod\(\s*['"]\17\.php['"]\s*,\s*\d+\s*\);\s*\?>(?<X2055691>)|\s*=\s*stripslashes\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\["body"\]\);\s*set_time_limit\s*\(\d+\);\s*@ignore_user_abort\s*\(true\);\s*\$to_ar = explode\(',',\s*\$to\);(?<X2044981>)|\s*=\s*wordwrap\(\$MESSAGE,\d+\)\s*;\s*[#]{50,80}\s*\$SUBJECT\s*=\s*["']\(\$\w{1,40}\)\((?:BILLING|LOGIN)\)\(\$IP\)\(\$(?:nama_negara|country)\)['"];(?<X2054160>)|\s*\.=\s*"(?:-+Vict!m Info-+\\n";(?<X2050230>)|CVV(?::\s*"\s*\.\s*\$_POST\['cvv'\]\s*\.\s*"\\n";\s*\$message\s*\.=\s*"PIN:\s*"\s*\.\s*\$_POST\['cvv0'\]\s*\.\s*"\\n";(?<X2047680>)|\d?\s*:\s*"\s*\.\s*\$_POST\[(?<X2048841>)))|\s*\.?=\s*['"][^\w]{1,15}FUDPAGES\s*\[?\.\]?\s*RU(?<X2062261>))|isterklioProtect\h*=\h*array\((?<X2159720>)|sg\s*\.=\s*"P\s*:\s*"\s*\.\s*\$_POST\['psw'\]\s*\.\s*"\\n";(?<X2050190>))|n(?:content=gethttpcnt\((?<X2103692>)|ombre_\w{1,20}\s*=\s*['"]L[1i]fk[4a]\s+Sh[3e]ll['"];(?<X2119660>))|out\s*\.=\s*['"](?:<title>Config\h*Symlink\h*</title>['"]\h*;(?<X2196650>)|phpddos['"];\s*\}\s*while\([^\)]+\)\s*\{\s*\$packets\+\+(?<X2121390>))|p(?:(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\][^\?]{9,9999}\$\w{1,40}\s*=\s*\$_POST\[['"]\w{0,9}phrase[^\]]+\][^\?]{0,999}\bif[\s\(@]+mail[\s\(]+(?:\$\w{1,40}\s*,?)+\)(?<X1201720>)|=strpos\(\s*\$tx,'{#',\$p2\+2(?<X2043641>)|a(?:ger\s*=\s*new\s*ADODB_Pager\(\s*\);\s*\$pager->render_pagelinks\(\s*\);\s*\Z(?<X2047860>)|sswd\s*=\s*fopen\(\s*'/etc/passwd'\s*,\s*'r'\s*\);(?<X2049620>)|th_(?:to_dor\s*=\s*"(?<X2110691>)|wordpress\[\]\h*=\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\][^;]{0,9};\s*\$\w{1,20}\h*=\h*['"]\s*try\s*\{\s*\$bajatax[^=]{0,4}=\h*apply_filters\h*\(\h*\\['"]wp_authenticate_user\b(?<X2172830>))|tt\s*=\s*['"]\W?(?:(?:safe_mode|open_basedir|(?:r57|c99)shell|[dlrwx-]{10})\|){8}(?<X2126602>)|y(?:load(?:\s*=\s*"[^"]{100,9000}"\s*;\s*preg_replace\s*\(\s*'/.*/e'\s*,\s*"[^"]{1,300}"\s*,\s*'\.'\s*\)\s*;(?<X1040690>)|_file\s*=\s*['"][%\w]{1,99}GLOBALS[%\w]{1,99}Array[%\w]{1,999}\.[^;]{999,}eval[^;]{32,99}(?:exit|die)%\d+%\d+[^'"]{1,128}['"];\s*srand\((?<X2264121>))|tm\w{1,30}\h*=\h*['"]https?://pubg\.\w{1,30}[^/]{0,49}/\w{1,20}\.php['"];(?<X1189880>)))|h_id\(\$backdrop,\$user_ini_filename\);(?<X1220350>)|lugin_key\h*=\h*['"](?:[a-f0-9]{32})?['"];[^\:\^%&@!#\*\|]{499,999}['"]hide_logged_in['"]\)\h*;(?<X2156181>)|ng\w{1,12}\h*\=\h*dirname\(__FILE__\)\h*\.\h*['"]/(\w{1,20}\.(?:png|jpe?g|ico|gif|bmp))['"];[^\.\?>]{0,99}\b@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?\h*['"]\43['"]\);(?<X1163852>)|ostpass=randString\(['"]\d+['"]\);\$res=insertToBD\([^\.;\)\(\[]{1,99}\.urlencode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\.['"]{3},\$wpdb(?<X2126450>)|ra[ga]{0,2}\h*=\h*rand\([^\)]+\);\s*if\(!empty\(\$_POST\[['"](?:username|password)['"]\]\)\)[^\}]{99,600}\bmail\h*\((?:\$\w{1,20},?){4}\);[^\{]{1,99}\bheader\h*\(['"]Location:(?<X2149220>)|wdump2\s*=\s*"TVqQAAMAAAAEAAAA(?<X2049600>))|query\s*=\s*isset\(\$_SERVER\['QUERY_STRING'\]\)\?\s*\$_SERVER\['QUERY_STRING'\]:\s*'';\s*if\s*\(false\s*!==\s*strpos\(\$query,\s*'[\w-]+'\)\)\s*{\s*__\w+_\w+\(\);.+?stream_context_create\(\$options\);\s*\$contents\s*=\s*@file_get_contents\(\$url,\s*false,\s*\$context\);\s*}\s*}\s*}\s*return\s*\$contents;\s*}(?<X1035660>)|r(?:(?:oot|eal)ShellUrl\h*=(?<X2168111>)|an(?:dAddName\h*=[\h\(]+KEYJG\h*\+\h*\$id\d+[\h\)]+%\h*\d+\h*[\+\-]\h*\d+\h*;(?<X2180210>)|som_(?:de|en)crypt\b(?<X2189301>))|card\s*=\s*\$m->getRandcards\(\s*\$id\s*,\s*\$idsum\s*\);(?<X2048030>)|E(?:DIRECT_FILENAME[\s=]+['"]\w+['"];\s*if[\s\(]+(session)(_start)[\s\(]+\)[\s!=]+(?:true|false)[\s\)]+\{\s*(die|exit)\b[^;]{0,19};[^@#%]{99,2999}(?:\$_\53[\s\[]+['"](?:__redirect_was\54|doc_name)["'][\s\]]+=[^;]+;\s*){2}[^%]{99,19999}\bheader[\s\('"]+Content\-disposition[:\s]+attach[^\}]{1,499}\b\55;[\s\}]+(?://\s*)?\55[\s\(]+['"]Try\s+again\.?['"][\s\)]+;(?<X1220371>)|link\s*=\s*['"][^'"]{1,15}file\s*manager\s*(?:r57|c99|wso|b374k)\s*shell\b(?<X2129541>)|port\s*=\s*new Report\(\$DBData,\s*file_get_contents\('php://input'\), intval\(\$_SERVER\['CONTENT_LENGTH'\]\), ENCKEY_, TEMP_\);\s*\$Report = NULL;(?<X2051790>)|q_uri\s*=\s*'http://'\.\$req_uri\."\?req="\.urlencode\(\$full_uri\)\."&gzip="\.\$is_gzip\."&host=\$host&ip=\$ip&rip=\$reverse_ip&ua=\$ua&ref=\$ref";(?<X2045830>)|sult\s*=\s*dns_get_record\(\s*\$domain\s*\.\s*"\.multi\.uribl\.com"\);(?<X2045091>)|turn = smtpmail\(\$smtp_host, \$smtp_port, \$smtp_login, \$smtp_passw, \$email_polucha, \$telo_pisma, \$headers\);(?<X2044601>))|q\s*=\s*\$_GET;\s*\$sid\s*=\s*"\w+";.{2000,3000}?echo\s*"<a\s*href=\\\'\$link\\\'>\$name</a><br>";\s*}\s*}\s*}(?<X1039391>)|un_ioncubetesterplus\s*=\s*create_function(?<X2048560>)))
\$(?:s(?:(?:hell)?_?title\h*=\h*\$s(?:hell)?_?name\h*\.\h*['"][^'"]{0,9}['"]\h*\.\h*\$s(?:hell)?_?ver(?:sion)?\b(?<X2174480>)|_pass\s*=\s*"\w{32}";\s*//\s*password\s*\(.{1,100}\)\s*eval\("\?>"\.gzinflate\(base64_decode\((?<X2050820>)|a(?:lesforce_Desk_1\s*=\s*stristr\(\$finish_result(?<X2048450>)|ndyKey=\$_POST\['SandyKey'\];(?<X2049050>))|c(?:am(?:a(?:url|name)\h*=\h*['"][^\?\[\]\{\}]{99,999}(?:\$fuck_(?:tor|vpn|crawler)\h*=\h*['"][^'"]+['"];\s*){2,3}(?<X2181131>)|name\h*=(?:[^\(\{\?@#%!&\|\}\)]{1,499}\$(?:fuck_\w{1,40}\h*=[^;]{1,99};\s*\$){2}(?<X2167761>)|\h*["'][^'"]{1,40}['"];[^\}]{1,199}\}\s*function\h+\w{1,20}[^\{]{1,49}\{\s*(\$\w{1,9})\h*=\h*['"]https?://api\.telegram\.org/bot[^\)]{1,99}\);\s*\$\w{1,9}\h*=\h*curl_init\h*\(\);\s*\$\w{1,9}\h*=\h*array\h*\(CURLOPT_URL\h*=>\h*\7,(?<X2181970>)))|riptver\s*=\s*["']\s*Private\s*Exploit\s*["']\s*;(?<X2121920>))|e(?:rver\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST).{100,300}exec\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{\s*echo\s*substr_replace\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*0\s*,\s*1\s*\)\s*\.\s*"[^"]*"\s*;\s*\}(?<X1039310>)|ss\s*=\s*md5\(\s*@\$_COOKIE\[ssid\]\);(?<X2044521>)|x\s*\.=\s*[^\n]{40,100}\s*@mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*(\$\w{1,40})\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"][^'"]{1,20}\.html['"]\s*,\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\12(?<X2054731>))|h(?:[e3]ll(?:\h*=\h*base64_decode\h*\(\h*['"]PD9(?<X2187741>)|\s*=\s*base64_decode[\(\s'"]+PD9(?<X2228110>))|_name = base64_decode\(\$sh_id\)\.\$sh_ver;(?<X2044431>)|ell(?:\w+[\s=]+\w+[\s\(]+base64_decode[\s\('"]+aHR0cDovL2hlbGxv[^;]+;(?<X1211380>)|\w{0,9}\h*=\h*pathinfo\h*\(\h*\$_SERVER\h*\[['"]REQUEST_URI['"]\]\h*,\h*PATHINFO_DIRNAME\h*\)\h*;(?<X2160010>)|_?name=[^;]{1,99};\$(?:auth_)?pass(?:word)?=['"]\w{32}['"];(?:\$\w{1,40}=['"]https?://pastebin\.com/(?:raw|download)\b[^;]{1,99};){1,3}[^\?\}\{]{1,499}\$\w{1,40}=['"][^'"]{25000}(?<X2178840>)|_\w{1,20}\s*=\s*\$_[GPRSC]\w{2,6}\[['"]priv(?:8|ate)['"]\];(?<X2133020>)|_data=gz[di][en]flate\(base64_decode\(['"][^'"]{9999}(?<X2174110>)|_mode\s*\)\s*\{\s*\?>\s*[^\?]{1,99}\s*<title>\s*<\?php\s+echo\s*\(?\s*['"]?\s*\$shell_title;(?<X2057242>)|_name\s*=\s*(?:"devilzShell";(?<X2049450>)|['"](?:Mr|ph)[^'"]{1,20}shell['"];(?<X2130341>))|_url\h*=\h*['"]https?://[^/'"]{0,99}\bgithub(?:usercontent)\.[\w\.]{2,9}/[^\?]{99,1499}\bfsockopen\h*\(\h*\$shell\h*,\h*\$port\h*,\h*(?<X2172180>)|Folder\h*=\h*dirname\(\$shellPath\);\s*echo\h*['"]\$shellUrl(?<X2139390>)|Manager->add\(['"]r57['"]\s*,\s*new\s*R57\(\)\);(?<X2121260>)|name=[^\?]{0,199}eval\([^;]{9999}(?<X2224031>)|ololol\h*=\h*['"]PD(?<X2156243>)))|ql\s*=\s*['"][^\?]{1,40}\s*,\s*['"]\s*<\?(?:php)?\s*system\s*\(\\\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\w{1,12}\]\s*\);\s*exit;\s*\?>['"](?<X2052680>)|sn=\$_SESSION\['ssn'\]=\$_POST\['ssn'\];(?<X2049121>)|trFileBody=GetFileContent\(\$strUrl\);\s*\$strFileBody=str_replace(?<X2045790>)|u(?:\s*=\s*str_replace\('\$name'\s*,\s*\$n\s*,\s*stripslashes\(\s*base64_decode\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'z2'\s*\]\s*\)\s*\)\s*\);(?<X2045611>)|b(?:j?(?:ect)?\h*=\h*['"]\h*\w{1,40}\h*Victim\h*info\b[^\?\{\}#!@&\*%\|]{1,199}\bfwrite\h*\([^,\)]+,\h*(\$\w{1,40})\h*\);[^\?\{\}#@!&\*%\|]{1,99}\b[fc](?:ile_get_contents\h*\(\h*|url_setopt\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_URL\h*,\h*)['"]https?://api\.telegram\.org/bot[^;]{1,199}\34\b(?<X2177000>)|ject\h*=\h*(?:["']Billing\h+(?:Netflix|Hotstar|Disney)\b\W{0,4}['"]\.\$xname\.['"][^\(]{99,250}\bmail\h*\((?<X2144220>)|['"](?:[^;'"]{2,20}\blogin\b[^;\\]{5,60}['"];[^\}\[\]]{99,600}\bfopen\h*\(['"][^'"]{2,20}\.txt['"]\h*,\h*['"]a\+?['"]\);[^\[@]{99,600}\bif\h*\(\$send.log[^\)]+\)\s*\{\s*if\h*\(\$Encrypt[^\)]+\)\s*\{\s*@?mail\h*\((?<X2173620>)|\h*Xjok\h*ertn\h+(?:SSN|CC|card)\b(?<X2139150>)|\W{0,5}R3M0T[^;]{9,99};\s*\$headers\h*=\h*['"]From:\h*r3m0t(?<X2143741>)|AMA[Zo]{2}NE?\h*(?:billing|full\h*credit|v[\d\.]+)\b[^\{]{20,250}mail\([^\)]+\);\s*@?fclose\(@?fwrite\(@?fopen\((?<X2138770>)|APPLE(?:ID)?\h+LOGIN:\h*\$\w{1,40}\b(?<X2138400>)))|ject(?:\h*\.?\h*=\h*['"](?:(Mail\.ru|y[a4]h[0o]{2}|VIP163|H[0o][7t]m[4a]il|a[0o]l|Domains)\b[^;]{0,20};\s*\$body\h*=\h*['"]\W{4,20}\42[^\$]{9,50}\$(?:email|username|user|login)\b(?<X2153390>)|Apple\h+(?:VBV|CC|C[CV]V)\b[^;]{0,20};(?<X2140580>))|\s*=\s*"PayPal\s+(?:B(?:ank\s+Info(?<X2049160>)|illing\s+Info(?<X2049170>))|PP\s+LOGIN\s+FROM(?<X2049150>))|\s*=\s*['"](?:[^'"]{0,99}(?:Amazon|Apple|Billing)[^;]{1,99};(?:\s*\$\w{1,40}\s*\.?=[^\?]{1,99};){1,5}[^\$\w\(\)\?\{\};]{999,4999}(\$\w{1,40})\s*=[^;]{1,99};\s*(\$\w{1,40})\s*=\s*fopen\(\48[^;]{1,99};\s*fwrite\(\49(?<X2138240>)|[^\$]{1,40}['"]\.\$ip\.[""]\\n['"];\s*\{?\s*@?mail\([^\;]{1,200}\)\s*;\s*\}?\s*\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054050>))))))|t(?:ags=array\("p","div","span"\);\$tags=\$tags\[rand\(0,count\(\$tags\)-1\)];\s*array_push\(\$body,"%1\$tags%3",\$text,"%2\$tags%3"\);(?<X2047650>)|e(?:stcloack\s*=\s*cloack\(\$ip\);(?<X2259590>)|xt(?:\d+\s*=\s*http_get\('https://ghostbin\.com/paste/\w+/raw(?<X2049400>)|Name\h*=\h*['"]ElZero['"];[^\[\{\?]{1,999}\$(?:fuck_(?:vpn|tor|crawler)=[^;]{0,99};\s*\$){2}(?<X2168301>)))|his(?:->(?:createfile\(['"]\.htaccess['"]\h*,[^\)]+\);[^%&\*@]{999,2500}\bfunction\h+\w{1,20}\([^\)]+\)\s*\{[^\}\[/]{20,450}\$\w{1,20}\h*\.=\h*['"]<title>\h*\h*(?:Hack|pwn|f[uc]{2}k|touch)ed\h+by\b(?<X2183350>)|pluginList\h*=\h*Array\h*\(\s*['"]wp-hps/wp-sph\.php\b(?<X2149490>))|\->(?:log[\(\s]+['"]DD[o0][s5]!?\h+(?:UD|TC)P\h+Fl[o0]{2}d\h*completed['"][\)\s]+;(?<X2193170>)|server\s*=\s*['"]http://['"]\.\$this\->server\.['"]/img/\?q=(?<X2102991>)|test\s*=\s*['"]<div\s*style\s*=\s*['"]display:none;['"]>\w+:\d+</div>['"];\s*if\(isset\((\$_POST)\[[^>]{1,64}>file_put\(\60(?<X2250831>)))|itle(?:="NetworkFileManagerPHP";(?<X2051530>)|[\s=]+['"]cpanel(?:\s*tools?)?\s*[^\x00-\x7F]+['"]\s*;[^\?\}]{0,499}['"]<form\s+action[=\s]+['"]\?(?<X2228041>)|\h*=\h*['"]Security\h*Exploded\s*Shell\s*Backdoor[^\?]{99,350}<title>Hacked\h*By\b(?<X2144061>)|\s*=\s*['"]\s*[^\w]{1,3}MALING\s+SHELL[^\w]{1,3}['"];(?<X2061110>))|ofile='[^']{1,50}';\s*\$\w{1,40}\s*=\s*base64_decode\(strtr\(\$_POST\[[^)]+\)\);\s*\$\w{1,40}='<\?php(?<X2051612>)|ujuanmail\h*=\h*['"][^'"]{2,20}\.\w{2,6}['"];\s*\$x_path\h*=(?<X2181121>))|u?[3e]xp[l1][o0]it\s*=\s*['"][^'"]{9,400}['"];\s*\$An[0o]n_[3]xp[l1][0o]it[3e]r\s*=\s*['"](?<X2063676>))
\$(?:U(?:nixTimeLastEdit\s*=\s*"[^"]{1,100}";\s*\$MenuAcoAuthor\s*=\s*"[^"]{1,100}";.{100,2000}?echo\s*eval\s*\(\s*base64_decode\(\s*\$SystemJoCode\s*\)\s*\);(?<X1039890>)|rl(?:\s*=\s*".*?";\s*if\s*\(isset\(\$_SERVER\['HTTP_REFERER'\]\)\s*AND\s*!isset\(\$_COOKIE\["\w+"\]\)\)\s*{\s*setcookie\("\w+",\s*"1",\s*time\(\)\+\d+\);\s*\$urls\s*=\s*array\("google\.",\s*"yandex\.",\s*"yahoo\.",\s*"aol\.",\s*"msn\.",\s*"rambler\.",\s*"mail\.",\s*"ya\.",\s*"bing\.",\);\s*for\s*\(\$i=0;\s*\$i\s*<\s*count\(\$urls\);\s*\$i\+\+\)\s*if\s*\(strpos\(\$_SERVER\['HTTP_REFERER'\],\s*\$urls\[\$i\]\)!==false\)\s*exit\('<script>document\.location\.href\s*=\s*"'\.\$url\.'";</script>'\);\s*}(?<X1035250>)|_to\s*=\s*['"](?:h|\\x68|chr\(104\))(?:\W{1,3}(?:t|chr\(116\)|\\x74)){2}[^\$]{30,300}(\$\w{1,40})\s*=\s*['"][^/]{1,50}\(\3\s*=\s*['"]/tmp['"][^#]{200,1200}(\$f_res)\s*=\s*\3[^>]{1,400}(\$res)\s*=\s*file_get_contents\(\4\);\s*\}\s*(?:print|echo)\s*['"]?\5['"]?;(?<X2064892>)|s\[\]\s*=\s*trim\(\$domains_for_work\[\$\w{1,40}\]\);\s*\}\s*\$mcurl\s*=\s*new\s+MCurl\(\);(?:\s*\$mcurl->\w{1,40}\([\$\w]{0,9}\);\s*){0,9}\s*\$\w{1,40}\s*=\s*\$mcurl->\w{1,40}\([\$\w]{0,9}\);\s*\$finish_result\s*=\s*array\(\);\s*for(?<X2059631>)|s\s*=\s*array\s*\(.+?\);\s*\$URL\s*=\s*\$urls\[rand\(0,\s*count\(\$urls\)\s*-\s*1\)\];\s*header\s*\("Location:\s*\$URL"\);(?<X1034471>))|ser(?:->set_role\(\s*'administrator'\s*\);\s*\}\s*\}\s*wpb_admin_account\(\);\s*\}\s*\?>\Z(?<X2051460>)|\h*=[^;]{1,49};\s*\$pass\h*=\h*['"]\w{32}['"];[^\^]{39999,}\bswitch\h*\([^\{]{1,49}\{\s*(?:case\h*['"](\w{1,9})['"]:\s*\10\((?:\$_[FGPCSR]\w{2,6}\[[^\]]+\]\h*(?:,\h*)?){0,4}\);\s*break;\s*){15}(?<X2152901>)|\s*-\s*>Authorize\s*\(\s*\$\w{1,40}\[\s*"ID"\s*\]\s*\);\s*LocalRedirect\s*\("/bitrix/[^"]{1,40}"\);(?<X2049460>)|\s*=\s*(shell_exec)\s*\(['"]whoami['"]\);\s*\$host\s*=\s*explode\s*\(['"][^'"]+["'],\s*\13\(["]uname\s+-n['"]\)\s*\);[^\}]{0,80}\}\s*function\s+checkPassword\s*\(\$(?:passwd|password|pwd|pass)(?<X2119350>)|_agent\s*=\s*"ConBot";(?<X2044101>)|ful\s*=\s*array\(['"]gcc['"],['"]lcc['"],['"]cc['"],['"]ld\b(?<X2050391>)|name\s*=\s*['"]\bdeleted\-['"]\s*\.\s*gen_str[^'"]{1,199}(\bmysqli_query)[^;]{1,99}\$prefix['"]\h*\.\h*['"]users[^;]{1,299}(\W{1,4})\s*\17[^;]+\18\s*\17[^'"]+['"]\binsert[^;\}]+\bcapabilities[^;"\}]{1,99}['"]\badministrator(?<X2239301>)))|v(?:ar= \$_SERVER\['PHP_SELF'\];\s*\$form =<<<HTML\s*<form enctype="multipart/form-data" action="\$var" method="POST">\s*<input name="uploadFile" type="file"/><br/>\s*<input type="submit"\s+value="Upload"\s*/>\s*</form>\s*HTML;\s*if \(!empty\(\$_FILES\['uploadFile'.+?print\s*"OK";\s*}\s*else\s*{\s*print\s*\$form;\s*}(?<X1035790>)|ERSION\s*=\s*'Gamma\s+Web\s+Shell(?<X2051550>)|ictimInfo\d*\s*\.?=\s*['"][^@]{499,999}\bmail\(\h*\$\w{1,40}\h*,\h*['"][^'"]{1,49}\bfrom\b[^,\)]{1,19}\$_SERVER\[[^\]]+\]\h*,\h*(\$\w{1,40})\);\s*(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"][^'"]{1,49}\.txt['"][^\)]{1,99}\);\s*fwrite\h*\(\h*\23\h*,\h*\22\h*\);\s*fclose\h*\(\h*\23\h*\);(?<X2154721>))|w(?:eff_client\s*=\s*new\s+TWeffClient\(\);(?<X2045591>)|p(?:_(?:4meta_arr[=\s]+array[\(\s'"]+comment["']\s*=>[^\*]{1,499}(\$\w{1,40})\s*=\s*glob(?:[\(\s\$]+ABSPATH\s*\.\s*['"]\*\.hfm['"][^>]{9,999}\bforeach[\(\s]+\26\s+as\s+(\$\w{1,40})[\)\s]+\{[^@]{9,9999}(\$\w{1,40})\s*\->[^;]+;[\s\}]*@unlink[\s\(]+\27[\s\);\}]+\28\->close[\s\(\);]+unset[\s\(]+\28[^;]+;(?<X1222500>)|[\(\s]+\$ABSPATH\s*\.\s*['"]\*\.hfm['"][^>]{9,999}\bforeach[\(\s]+\26\s+as\s+(\$\w{1,40})[\)\s]+\{[^@]{9,9999}(\$\w{1,40})\s*\->[^;]+;[\s\}]*@unlink[\s\(]+\30[\s\);\}]+\31\->close[\s\(\);]+unset[\s\(]+\31[\s\);]+\}(?<X1222451>))|_wp\s*=\s*\$wp__wp[\(\s]+str_i?replace(?<X2103081>)|enc_file\s*=\s*'<\?php eval\("\?>"\s*\.\s*base64_decode\("'\.\$wp_code\.'"\)\);\s*\?>';(?<X2044621>)|nonce=isset\(\$_POST\[\$_SERVER{\$_SERVER{.+?unset\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*echo\s+\$wp_auth_check;(?<X1036870>))|autop\s*=\s*pre_term_name[\(\s]+\$wp_kses_data\s*,\s*\$wp_nonce[\s\)]+;[^\}]*\$shortcode_unautop\(\);(?<X2045991>)))|X(?:_\w{1,20}\h*=\h*['"]From:[\w-]{1,20}<Xphisher>(?<X2147590>)|BALTI_EMAIL\h*[,=][^;]{6,99}[\)'"]\h*;(?<X2179831>))|z0\s*=\s*\$_REQUEST.{10,300}?(\$\w{1,40})\s*=\s*\$\w{1,40}\(\s*""\s*,\s*\$\w{1,40}\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\39\(\);(?<X1040100>))
\&nbsp\&nbsp\&nbsp\&nbsp\&nbspCant\s+Edit\s+>>(?<X2048110>)
\((?:"/usr/local/apache/bin/httpd -DSSL","/sbin/syslogd","\[eth0\]","/sbin/klogd(?<X1038400>)|(function)\(_[^\{\n]+\{\2\s*(_\w+)\(_[^\}\n]+\}var[^\}]+\}\2[^%\n]+\3[^\^\n]{1,999}\bcatch[^\}\n]+\}{3}[^;\n]+\;\2\s*(_\w+)\([^:\n]+:\_\w+[^\n:]+:\2\(_\w+[^\}]+\},['"]\w+['"]:[^\}\n]+\},['"]\w+['"]:\2[^>\n]+>{2}\([^>\n]+&&\4\(['"]+\);(?<X1257022>)|(function\(\))\s*\{\s*try\s*\{\s*var\s+\w{1,20}\s*=\s*window\.(localStorage);\s*var\s+(\w{1,20})\s*=\s*document\.createElement\([^&]{9,150};\s*\8\.style\.visibility\s*=\s*['"]hidden['"];[^:]{99,999}\.src\s*=\s*["']https?://[^\}]{99,400}\}\s*setTimeout\s*\(\s*\6\s*\{\s*\7\.setItem\([^\s]+\}\)\(\);(?<X1134972>)|<a\s*href\s*=\s*['"](https?://urlzs\.com)[^>]{1,128}\10[^>]{1,256}>\10/\w{1,16}</a>\)(?<X1261891>)|['"](?:https?://[^;]{1,99}/xmlrpc\.php\b[^\}]{1,999}\bisAdmin</name>(?<X2192071>)|safe_mode['"]\)\D{1,4}(?:0|OFF)\)\s*\?\s*\$\w{1,9}\D{1,4}['"](?:0|off)['"]\s*:\s*die\([^\)]+\);\$\w{1,9}\((?:0|NULL)\);\$\w{1,9}=\$\w{1,9}\(['"]/etc/passwd['"],[^\)]+\);(?<X2123291>))|\$(?:\w+\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*'\w+'\s*\]\)\s*&&\s*@preg_replace\('/\w+/e'\s*,\s*'@'\s*\.\s*base64_decode\(\s*"[\w=+/]+"\s*\)\s*\.'\s*\(\s*\$\w+\s*\)'\s*,\s*'\w+'\s*\);(?<X1035221>)|\w{1,40}[\(\s'"]+e['"]\s*\.\s*\$\w{1,40}[\(\s]+\d+[\)\s]+\.\s*['"]\*\./['"][\)\s]+,(?<X2214301>))|\h*(?:[cm]o(?:ve_uploaded_file|py)\s*\(\s*\$_FILES\[[^@]{99,499}<meta\s+http\-equiv\h*=\h*['"]refresh['"]\h+content\h*=\h*['"][^'"]{1,99}\burl=https?://outlook\.office\.com/(?<X2151171>)|[ir](?:nclud|equir)e(?:_once)?\s*['"][^'"]{1,99}\.php['"]\h*\);[^@]{99,999}<(title>)\s*(?:Verizon\b[^/]{1,99}\bconsenting\b[^/]{0,99}|Yahoo!?\s*)</\17(?<X2151183>)|function(?:\(\)\h*\{\s*var\h*(\w{1,40})[\h=]+(document\.)createElement[\('"\h]+script['"][^\}]{0,99}\19\.src[\h=]+['"](?:https?:)?//[^/]{0,15}(?:resolutiondestin|storerightdesicion)\.com/[^<;\}]{0,99};(?:\h*var\h*(\w{1,40})\h*=)?\h*\20getElementsByTagName[^\}\n]+\.(?:appendChild|insertBefore)[\(\h]+\19(?:,\21)?[\h\);]+\}[\h\)]+\(\)\h*;(?<X1163383>)|\h*\(\)\h*\{\s*var\h*(\w{1,40})[\h=]+(document\.)createElement[\('"\h]+(String\.fromCharCode)\(115[,\s]+99[,\s]+114[,\s]+105[,\s]+112[,\s]+116[^\}]+\b\24getElementsByTagName\(\25\(104,101,97,100\)\)\.appendChild\(\23\);\}\)\(\);(?<X1258890>)))|\s*(?:\$(?:_\d+,\d+\s*,\s*array\s*\("IP:\s*{\$_SERVER\[_\d+\(\d+\)\s*]\s*}"\s*\)\s*\)\s*;\s*\$GLOBALS(?<X2048600>)|google_n=0;\s*\$google_n<\d+;\s*\$google_n=\$google_n\+\d+\)\s*{\s*\$ch\s*=\s*curl_init\(\s*\);(?<X2048480>))|function\s*\((?:[a,n_lytics\s]{1,32}\)\s*\{\w\[\[\w+\[\d+\][^:]{1,9999}://www\.google\-analytics\.com/\w+\.js['"\s,]+window[,'"\s]+tecdnaomlrbL9hsiEvHR0[^'"]{1,199}t3q0o3U7['"]\);(?<X1277950>)|\)\s*\{\s*var\s*\w{1,40}\s*=\s*['"]([^'"]+)['"];\s*if[\s\(]+!(window\.\30)\s*\)\s*\{\s*\31[\s=]+\{[^;\}]+,\s*(\w{1,40}):\s*['"]https?://[^'"]+['"][\s,]+\}[\s;]+\}[^\[\]]{0,9999}\b(\w{1,40})\.src[\s=]+\31\.\32[^;]*;\s*var\s*(\w{1,40})\h*=\h*document\.[^;]+;\s*\34\.[^;]+\33\b[^;]+\}\s*\)\s*\(\)\s*;(?<X1195181>))|k[il1]{3}UA(SHk)\s*\|\36\d{3,6}\s*\)\s*\*/(?<X2128770>))|file_exists\([^;]{0,99}(/wp\-load\.php)[^\?]{1,199}\binclude\b[^;]{0,99}\38\b[^\?]{1,999}\$(\w+)=[^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\?]{1,499}\$(\w+)\[['"]post_content['"]\]=\$\39\b[^\?]{0,99}\bwp_update_post\((?:\w+\(){0,5}\$\40\)[^\?]{1,199}\b[de](?:xit|ie)\b[^;]{0,19};(?<X2224011>))
\(function(?:[\(\)\s]+\{try\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*)?\s*\w+\s*=[^;\[]{0,40}\1\s*\[\s*['"][fromChadesting'"\+\.]{20,40}\([^\n!#]{999,9999}\{\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\}\s]*catch[\s\(]+\w+[\)\s]+\{\s*\}[^\}]*\}[\)\s]+\(\)(?:\s*;)?(?<X1250650>)|[\(\h]+parameters[\)\h]+\{\s*const\h+(target)s[=\s]+\[['"]https?://[^/]+/[^'"\$]{3,9}['"](?:[\s,'"]+https?://[^/]+/[^'"\$]{3,9}['"]){3,}\s*\][^\{\}]{39,499}\bconst\h*save\w+[\s=]+\(\3s\)\s*=>[\s\{]+\3s\.forEach[\(\s]+\3[,\s]+index[\)\s]+=>\s*\{[^/]+/\s*ms[^\?]{9,4999}\,\s*globalClick[\s\}\)]+\(\);?(?<X1237571>)|[\(\s]+_0x\w{1,9}[,\s]+_0x\w{1,9}[\)\s]+\{\s*function\s*_0x\w{1,9}[\(\s]+_0x\w{1,9}\s*,[^;]{0,199},\s*_0x\w+[^!]{0,999}\bwhile[\s\(]+!!\[\][\s\)\{]+try[\s\{]+var\s*_0x\w+[\s=]+parseInt\([^\|\n]{9,9999}\[['"]split['"]\]\(['"]\|[^/]{99,}/java[^\]\|\n]{9,999}['"]R_PATH[^\n]+return\s*_0x\w+[\(\);\s]+\}(?<X1228760>)|[\s\(\)]+\{\s*var\s*\w{1,40}[=\s]+['"](\w{1,40})['";\s]+if[\s\(]+!(window\.\6)[\)\s]+\{[^\}/;]+(\w{1,4}PATH)[\s:]+['"]https?://[\w\-\.]+\.\w{2,6}/[\w]{3,9}\b[^\[]{99,}\bvar\s*(\w{1,40})[\s=]+document\.createElement[\(\s'"]+script[^;]+;[^\+]{0,99}\b\9\.src[\s=]+\7\.\8\s*\+[^;]+;[^\},]+\9\s*,[^;]+;(?<X1203450>)|\((\w),(\w)(?:,(\w)\)\{\13\.src=[''](?:https?)?:?//['"]\+\11\+['"]/[^'";\+]+['"]\+\12;\h*try\h*\{\h*\(document\.body\|\|document\.documentElement\)\.appendChild\(\13\)\h*\}\h*catch\h*\(\w+\)\h*\{[\}\)\(\s]+['"][\w\-\.]{3,19}\.[a-z]{2,9}['"],\d+,document\.createElement\(['"]script['"][\)\h]+;(?<X1235610>)|[^\)]+\)\{(?:\11|\12)\[['"]GoogleAnaly\w+['"]\]=(\w+);\s*\w=(\w)\.createEl\w+[\s\(]+\w[\),\s]+\w+=(?:\12|\15|\16)\.getEl\w+\(\w\)\[\d\];if\([^\);]+\b(atob\()\15[^\}]+(\w)\.async=\d+;(?:\17|\18)\.src=['"][^;]+\b(?:\16|\17)[^\}]+\.insertBefore\((?:\17|\18)[^\}]+\}[\s\}\)\(]+\([^;]{0,199}['"](?:aWo|dWI)[^;]+;(?<X1248364>))|\((\w{1,9})\)\{let\s*(\w{1,9})\h*=\h*\20\.createElement\(['"]script['"]\);(?:\h*\21\.async=true;)?\h*\21\.src[=\s]+['"]https://[a-z\-]{3,30}\.[a-z]{2,8}/[^'"\?]{9,99}\.js\?h=[^'"]+['"];\h*\20\.head\.appendChild\(\21\);[\}\)\(\h]+document[\)\s]+;(?<X1235600>)|\((_[01]x[a-f\d]{2,9})[,\s]+_[01]x[a-f\d]{2,9}\)\{var\s*_[01]x[a-f\d]{2,9}=_[01]x[a-f\d]{2,9}[,\s]+_[01]x[a-f\d]{2,9}=\23\(\);while\(!!\[\]\)\{try\{var\s*_[01]x[a-f\d]{2,9}=parseInt\([^!\n]{9,999}while[\s\(]+(?:!!?\[\][^!\n]{9,999}=)+str\(\[[^\*\n]{9,499}=string;return\b[^\}]{1,99}\(null,\w+\);\s*\}(?<X1229870>)|\([^;]{1,64};\w=\w\.createelement[^\{]{1,256}atob[^\}]{1,256}\}{2}\)\s*\(\w+\h*,\h*document\h*[\h,'"]*Ly9saXF1aWR6LmluLm5ldC[^,]+[\h,'"]*script[^\)]{1,99}\);(?<X1252730>)|\(\$,(document)\)\{for\((\$\.\w{1,9})=\$\.\w{1,40};\27<\$\.\w{1,40};\27\+=\$\.\w{1,40}\)\{switch\(\27\)\{case[^\n]{9999,}(?:\(\26\.body\|\|\26\.\26Element\)\.appendChild\(\w+\)[\};][^/'"]{0,299}\(['"][\w\-]{1,40}\.[a-z]{2,3}['"]\h*,[^/;'"]{0,99}['"]script['"]\)\h*,\h*\w{1,40}\h*\)(?<X1194053>)|\breturn\h*_;\}\)\(\26\)\)(?<X1196311>))|\(\)[\s\{]+var\s*\w+=(document\.)createelement\((String\.fromCharCode)\([^\}\[]{1,200}\31\(104,116,116,112,[^;]+\);\s*(\w{1,20})\.append\w+\((\30\w+\(\31)\([^;]+\);[^\}=]{9,150}\33\([^\.]{1,60}\.appendChild\(\32[\}\)\(]+;(?<X1250350>)|\(\)\h*\{\h*var\h*\w{1,9}=document\[(\w{1,40})\(['"]cmVmZXJyZXI=?=?['"]\)[^/\n]{99,999}\b(\w{1,9})\.type=['"]text/javascript['"];[^\{\}\n\[\]]{0,999}\b\36\.src=\35\(['"]aHR[^;]+;[^\}]+\.insert(?:Before|after)\(\36[,\h]+\w{1,9}\);\}\}[^\n/:]{0,999}?;\h*\}\h*\}\h*\)\h*\(\);(?<X1192441>)|\(\)\s*\{\s*var\h*(\w{1,9})\h*=\h*document\.createElement\(['"]script[^\}]{9,60}\38\.src\h*=\h*\(?['"][^'"]{0,25}\b(?:adcdnx\.com|developerstatss\.ga)/\w{1,15}\.js[^'"]{0,15}['"][^\}]{1,90}\.insertBefore\(\38,\h*\w{1,15}\);\s*\}\)\(\);(?<X1161805>)|\(\)\{(?:&?try\s*\{\s*var(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\40\s*\[\s*['"]fromCharCode[^\}]+\}\s*else\s*\{\s*\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}[\}\s\)]+\(\s*\)\s*;(?<X1251290>)|\s*try\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\42\s*\[\s*['"][fromCharCode'"\+]{15,40}\][^;\[]+\+\s*\42\s*\[[^\n]{999,}\{\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\}\s]*catch[\s\(]+\w+[\)\s]+\{\}[^\}]*\}[\)\s]+\(\)(?:\s*;)?(?<X1250552>)|\s*var\s*(?:\w=navigator\[\w\(['"][^"']+['"]\)\];\s*var\s*\w=document\[\w\(['"][^"']+['"]\)\];\s*if\s*\(\s*\w\s*\(\s*\w\s*,\s*\w\s*\([^>]{9,4000};\s*for\s*\(\s*var\s*\w=\w\.length\-1;\s*\w>=0;\s*\w\-\-\s*\)\s*\{\s*\w\+=\w\[\w\];\s*\}\s*return\s*\w;\s*\}\s*\}\s*\)\s*\(\);(?<X1043403>)|\w{1,40}[\s='"]+(\w{1,40})['";\s]+if[\(\s]+!(window\.\45)[\)\s]+\{\s*\46\s*=[^;_/\}]+(R_PATH)[\s:'"]+https?://[^/]+\.\w{2,6}/[\w\-=&,\.]+['"][^\[]{99,9999}\b(\w{1,40})\.src[\s=]+\46\.\47[^;]*;[^;\(]+\(['"]script['"\)\[]+0\][\s;]+(\w{1,40})\.parentNode\.insertBefore\(\48,\49[\}\h\(\)]+;(?<X1204381>))|try\{var\h*(\w{1,9})=\[['"][a-z\d=\+]{9,36}['"],['"][^'"\s=]{9999,19999}={0,2}['"],[^\v]{99,9999}=\51\[\w{1,16}\];if\((\w{1,9})\[[^\]]+\]===undefined\)\{[^\v]+\b(\w{1,9})=atob;(\w{1,9})=\53\([^;]{0,40}\b\52\([^;]+;var\b[^;]+(\w{1,9})=new\h*\w{1,9}\(\54\);\55\(\);\}[\(\);\}]+catch\(e[\(\);\}\{]+;(?<X1180460>)|var\h*\w{1,9}=(document\.)referrer;(?:\h*var\h*\w{1,9}=(?:window\.location\.href|navigator\.userAgent);)+\h*var\h*\w{1,9}=new\h*RegExp\((\w{1,9})\([^\}]+\}\s*var\h*(\w{1,9})=\57createElement\(['"]script[^:\n]{9,199}\59\.src=\58\([^\)]{40,199}\);[^\n,]{9,199}\.insertBefore\(\59[^\n]{0,99}\}\)\(\);(?<X1213970>)|var\s*(?:(\w{1,40})=['"](.)[^'"]{99,999}['"];\s*var\s*(\w{1,40})=unescape\(\61\.replace\(/\62/g,['"]%['"]\)\);eval\(\63\)\}\)\(\);(?<X1122631>)|\w{1,40}=(document\.)head\|\|\65getEle\w+\(['"]head['"]\)\[\d+\],\w+=['"]script['"],\w+=atob\(['"]aHR0[^;]+;\w+\+=[^\(\);]+\(['"]\?['"]\)[\?'"&]+:['"]\?['"];\w+\+=(location\.)[\.\w]+\(\d+\);\w+=\65createEl\w+\(\w+\);\w+\.src=\w+;\w+\.\w+=btoa\(\66origin\);\w+\.appendChild\(\w+\);\}\)\(\);(?<X1274000>)|\w{1,40}=['"]{2},[^\}\n]{1,499}\}[^\,\n]{1,999}(\w{3})=(\w{3})\(['"]rynuunpjqsrkbdte[^'"]{1,99}['"]\)\.substr[^\n]{1,999}\69\[\68\];var\s*\w+[^\n]{1,256}\69\(['"]![^\n]{1,1999};var\s*(\w+)=\w+\([^;]+;\70\(\d+\)\;return\s*\d+[\}\(\)]+\(\)(?:\s*;)?(?<X1257494>)))|\(\){var\s.="\(\w+\(\w+\)f\.\w+,=\w+\/\)\w+\)'\w+\/\)\w+\)'.\)\w+\('=\)\w+\/\[;\(\w+\?\!1=\w+'\)\]\w+\(\w+=\w+,=\w+\.\w+'=\w+\(\w+\(\w+\+\)\w+'.=\w+\+\w+\!'\w+!\w+&\w+\(\w+\)-\{\w+\(\w+\(\w+\.\w+\..+?eval\(\w+\);\}\(\)\);(?<X1042911>)|\(\w,(\w)(?:(?:,\w)+\)\{\w+=\73\.createElement\((\w+)\);\w+=\73\.getElementsByTagName\(\74\)\[[01]\];[^\}]+\}\)\(window,document,['"]script['"],['"]https?://(?:limeerror|emperorplan)\.(?:org|com)[^'"]*['"]\);(?<X1253680>)|,(\w),(\w),(\w),(\w)(?:(?:\w,)?)+\)\{\78=\73\.createElement\(\76\);\79=\73\.getElementsBy\w+\(\76\)\[\d+\];\78\.async=\d+;\78\.src=\77;\79.parentNode\.insert\w+\(\78,\79\);\}\)\s*\((?:(?:\w+|['"]\w+['"])[,"])+['"]https?://(?:eeatgoodx|tnoodlezy)\.com[^'"]+['"][^@]{1,150}\bwindow\.location[^;]+;(?<X1255391>))|\(_0x[a-f\d]{6},(_0x[a-f\d]{6}),[^\)]+\)\{var\h*_0x[a-f\d]{6}=_0x[a-f\d]{4}(?:,_0x[a-f\d]{6}=_0x[a-f\d]{4})+;_0x[a-f\d]{6}=\81\[['"]createElement['"]\]\(_0x[a-f\d]{6}\),(_0x[a-f\d]{6})=[^\}\n]+\82\);\}\s*\(window,document,_0x[a-f\d]{6}\(0x[a-f\d]{2},['"]Y4n5['"]\),_0x[a-f\d]{6}\(0x[a-f\d]{2}\)\)\);(?<X1260550>)|\(window\)\s*{\s*"use\s*strict"\s*;\s*var\s*Miner\s*=\s*function.+miner\.start\(\);(?<X1043262>)|\s*\([^\{;]{1,49}\{\s*var\s+\w+[\s=]+\{[^\}]+\bformat[:\s]+['"]pusher\-universal['"][,\s]+domain[\s:]+['"]([^'"]+)['"][^@\?]{99,1499}\.src[\s=]+['"](?:https?:)?//\85/ntfc\.php\?[^\?#]{1,1499}\bwindow\.opener\.postMessage[\s\(]+['"]popupRunStage#\w['"][^;]+;[\s\}]+catch\b[^\{;]{0,9}\{[\}\s]+\(['"]\{\\['"][^\n]{999,},\h*['"]abcdef\w+['"]\)\);(?<X1220841>)|_exists\(['"]pThumb(\.dbsthru)['"]\)\)\{@?pdb\87\([^\)=\}]{1,199}\bhttps?://pastebin\.com/(?:raw|download)/[^\)]{2,40}\);(?<X2174940>))
\((?:isset\(\$_(?:[GPCSR]\w{2,6}\[[^\]]+\]\)+\{function\s*(\w{1,40})\(\$\w{1,40},(\$\w{1,40})\)\{(\$\w{1,40})=fopen\(\2,[^\}]{1,299}\bcurl_setopt\(\$\w{1,40},CURLOPT_FILE,\3\);[^\}\?]{1,299}\}if\(\1\(['"]https?://[^/;]{0,99}\bgithub(?:usercontent)?\.com/[^,]{1,99},['"][^'"]+\.php['"]\)(?<X2168590>)|POST\['execl'\]\)\)\s*{\s*echo\s*\$_POST\['execl'\]\s*\.\s*'<br>'\s*;\s*echo\s*myshellexec\(\$_POST\['execl'\]\);\s*}\s*if\s*\(isset\(\$_POST\['pcntl_exec'\](?<X2047910>))|mail\([^\)]+\)+\{echo\s*['"][^;]+>Spam+ed\b(?<X2221061>))
\)(?:;(?:\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?://|#|['"])+(?<X1191895>)|\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\(\s*\w+\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*,\s*"[^"]*"\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*(?://?[^/]{0,150}/?\s*)?\Z(?<X2048822>))|\)(?:\s*\{\s*echo\s+'<b>Shell\s+Uploaded(?<X2051430>)|\s*{\s*echo\s*PHP_OS\.\$(?<X2043871>))|\s*(?:(\w{1,9})\s*=\s*['"]options\s+Indexes\s+FollowSymLinks[^'"]{9,40}(AddType\s+txt)\s+\.php\\r\\nAddHandler\s+txt\s+\.php\\r\\n\6\s+\.html[^'"]{9,80}['"]\s*\+\s*\w{1,9}\s*(\w{1,9})\s*=\s*['"]echo[^'"]+"'\+\5\+'"\s+>\s+\.htaccess['"]\s*os\.system\(\7\)\s*\w{1,9}\s*=\s*opener\.open\((?<X2063660>)|,\s*array\(\s*\$resf,\s*\$ltime,\s*\$delp\s*\),\s*base64_decode\s*\(\s*['"][^'"]{999,5000}['"]\s*\)\s*\);\s*file_put_contents\s*\((?<X2053463>)|;\s*foreach\s*\(\s*\$blocked_words\s*as\s*\$word\s*\)\s*\{\s*if\s*\(\s*substr_count\s*\(\s*\$hostname\s*,\s*\$\w{1,40}\s*\)\s*>\s*0\s*\)\s*\{\s*header\s*\((?<X2048165>)|\)\s*;\s*\}\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*['"]block-mail\.txt['"],\s*['"]r['"]\);(?<X2053980>)|eval\(gzuncompress\(base64_decode\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?<X2044001>))|\{header\(['"]Content\-type:\s*text/xml\b[^;]{1,99};die\(Mage::app\(\)\->getConfig\(\)\->getNode\(\)\->asXML\(\)\);\}(?<X2169672>))
\*(?:/(?:\s*(?:["'](?:\\x2f|/)[\\\-\*\sa-zA-Z0-9_/\.]+?(?:\.|\\x2e)(?:p|\\x70)(?:h|\\x68)(?:p|\\x70)["'];\s*/\*(?<X1037862>)|\$GLOBALS\['_\d+_'\]=Array\(base64_decode\(.{10000,15000};\$GLOBALS\['_\d+_'\]\[\d+\]\(\$_\d+,\$_\d+\);\$GLOBALS\['_\d+_'\]\[\d+\]\(\$_\d+,\$_\d+\);\}\}\}\s*/\*(?<X1039960>)|preg_replace(?:\(['"]/\[[a-z]{1,40}\]\*\.\+\[[a-z]{1,40}\]\*/ei?['"],str_replace\(['"]\s*['"],['"]\s*['"],['"].{100,2100}"\),'\w+'\);\s*\?>\s*\Z(?<X2052730>)|\s*\(\s*"\\[^"]{10,30}"\s*,\s*"\\[^"]{10,110}"\s*,\s*"\\[^"]+"\s*\)\s*;\s*/\*(?<X1040010>)))|extract\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\)\s*;/\*(?<X1041710>))|\/\s*@\$\w{1,20}\s*\D{2,3}\s*@\$\w{1,20}\s*\(\s*\$\w{1,20}\s*\(\s*\$\w{1,20},\s*\$\w{1,20}\)+;\s*\/\*(?<X1122701>)|\s*\*\s*arkei\s+stealer(?<X2056840>))
\+\+\$o\]\]\)\);}}eval\(\$d\)(?<X2043831>)
\-(?:>(?:is(?:Crawler|Bot)\(\)+\{header\(['"]HTTP/[\d\.]{1,3}\s*40[34]\b[^;]+;(?:die|exit)\b[^;]{0,19};[^@]{1,9999}(?:<form\b[^>]{0,199}\baction=['"][^'"]+\.php['"][^@]{1,9999}\b(?:type=['"]?password|name=['"](?:cvv|pin|ssn))['"](?<X2213091>)|\.(?:text|html)\(['"]Verify\s+your\s+(?:gmail|hotmail|outlook)\b(?<X2213081>))|leak\d*\(\h*\$function_zval\h*,\h*\$\w{1,9}\h*\*\h*8\)\);\s*\}[^\$]{0,99}(\$this->)write\h*\(\h*\3\w{1,40}\h*,\h*\$\w{1,19}\h*\+\h*\d+x\d+\h*\+\h*\d+x\d+,\h*\$zif_system\h*\)\h*;(?<X2138110>))|\-\h*script\-deface\-generator\.prinsh\.com\b(?<X2245460>)|\sWSO\s+['"]\s*\.\s*WSO_VERSION\s*\.\s*['"]\s*</title>(?<X2061933>))
\.(?:(?:chr\(\d+\)\."[a-z0-9/\\ ]*?"\.){5}[^;,]+;(?<X2044874>)|(\$\{\$\{)['"](?:\\x47|G)(?:\\x4c|L)[^\}]+\}\[[^\]]+\]\}\.(\$this->CRLF);\s*\}\s*return\s+(?:false|true);\s*\}\s*fputs\(\$this->smtp_conn\s*,\s*base64_encode\(\2['"](?:\\x47|G)(?:\\x4c|L)[^\}]+\}\[[^]]+\]\s*\}\s*\)\.\3\);(?<X2124680>)|(\$GLOBALS\{[0O]{2}\})\[\wx\w{1,20}\]\);\$global_version=\5\{\wx\w{1,20}\}\(\s*\$register_key,\$check_copyright\);\s*(?:\?>)?\s*\Z(?<X2065061>)|/(?:\*-/\*-\*/"(?<X2046130>)|L(?:1|i)ght_R(?:00|OO)t['"],\s*['"]Indonesian\s+Code\s+Party(?<X2061080>))|['"]getdomain(\.aspx)\?[^;]{1,199};(\$\w+)=\$\w+\.['"]\w+\9\b[^\?]{1,499}\becho\s*['"](<script\b[^>;'"]*>document\.location=)["'\.\s]{0,9}\10\b[^;]+;((?:exit|die)\b[^;]{0,19};)[^\?;]{1,199}(\$\w+)=str_i?replace\(['"]\w+\9['"],['"]{2},\10\)[^;]+;echo\s*['"]\11['"\.\s]{0,9}\13\b[^;]+;\12(?<X2225391>)|[\s@]*file_get_contents[\(\s]+['"]/etc/passwd['"]\s*\)(?<X1199140>)|\$(?:_(?:(?:REQUEST|COOKIE|SERVER|GET|POST)\[['"]rat['"]\];\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:echo|print)\s*\(?['"]php\s+20\d{2}\s+Terminator['"]\)?;(?<X2064360>)|SERVER\[['"]SERVER_ADDR['"]\];\s*if\h*\((file_exists)\h*\(['"]C:/WINDOWS/repair/sam['"]\)\)\s*\{[^\}]{9,150}\}\s*if\h*\(\17\(['"]/etc/passwd['"]\)\)\s*\{(?<X2139100>))|bin\.['"]@MrProfessor\.com\b(?<X2153420>))|\s*(?:/sss\s*\.\s*pl\s*<\s*local_host\s*>\s*<\s*local_port\s*>\s*\[\s*auth_login\s*\(\s*:auth_pass\s*\)\s*\](?<X2046850>)|php_uname\(\s*\)\s*\.\s*['"][^'"]{0,40}['"]\s*\.?\s*getcwd\(\s*\)\s*\.\s*['"][^'"]{0,40}['"];\s*eval\(\$_POST\[['"]?\w{1,40}['"]?\]\);[^`]{1,800}curl_exec\s*\(\$\w{1,40}\);\s*\}?\s*\?>\s*\Z(?<X2052450>))|gethostbyaddr\(getenv\(['"]REMOTE_ADDR['"]\)\)\.['"][^\$]{0,99}\$\w{1,20}\h*=\h*['"]\h*yassinox\b(?<X2141700>)|php(?:['"];\s*[ir](?:nclud|equir)e(?:_once)?\s+['"][^'"]{0,49}\banti(?:bot[sz]?)?\d?\.php['"];[^/]{9,199}<title>\s*Netflix\s*</title>(?<X2153181>)|\?sslchannel=true&(?:amp;)?sessionid=(?<X2166124>)|_uname\(\)\.(?:[^\?]{1,199}\.get(?:myuid|mygid|_current_user)\(\)\.){3}[^@]{1,4999}\(['"](?:SELECT\s+(?:table|schema|column)_name\s+from\s+information_schema\.(?:columns|schemata|tables)\b[^@`]{1,999}\(['"]){3}(?<X2223951>))|se(?:lf::\$(?:file|html)Class\->webShellScan\s*\(\)(?<X2225860>)|nd\h*\(\(['"]b374k\h+shell\h*:\h*connected\b(?<X2184982>))|Visible=true;\s*Bin_H2_Title\.InnerText="File Manager(?<X2050781>))
\<\?[ph\s]+ini_set\(['"]display_errors['"],\d+\);error_reporting\([^\)]+\);(function)\s*(\w+)\(\)\{(return)[^\}]+\}\1\s*(\w+)[^\}]+\}[^\}]+\3[^\}]+\}\1\s*(\w+)[^@]{1,200}\1\s*(\w+)\((\$\w+)\)\{\3\s*base64\w+\(\7\);\}\7\w+=['"][^'"]*['"];\$\w+=\6\(\7\w+\);\$\w+=\2\(\);try\{\$\w+=\4[^;]+;\$\w+=\5[^\{]+eval[^\{]+catch[^\}]+echo[^\}]+\}unlink[^;]+;(?<X2258510>)
\?(?:>(?:<\?php\s*function\s*\w{5,20}\(\$\w{1,10}\)\s*\{\$\w{1,10}\s*=\s*Array\([^g]{1,40}(?:gzinflate|gzuncompress)['"](?:,\s*['"]_f_wp['"]){4}\s*,\s*['"]<form\s*method\s*=\s*['"]?post['"]?\s*action\s*=\s*(?:['"]){2}?\s*>(?<X2122671>)|\s*(?:<\?(?:(?:php)?\s*eval\(base64_decode\(['"][^'"]{1000,3000}['"]\)\);\s*\?>\s*</title>(?<X2053581>)|php(?:\s*(\$\w{1,15})[\h=]+@?\$_FILES\[[^\]]+\];\s*if[\h\(]+\3[^\{]+\{\s*(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\h]+\3[^;]+;\s*if[\h\(]+@?(?:copy|move_uploaded_file)[\h\(]+\3\[[^\]]+\][\h,]+\4[\)\s\{]+echo[^\}]{0,99}\}\s*\}\s*echo\h*['"]<(html)>[^;]{9,250}</\5\>['"];\s*\?>(?<X1201492>)|\s+/\*\s*Obfuscation\s+provided\s+by\s+FOPO(?<X2064770>)))|\|\s+GODSpy\s*</title>(?<X2061892>)))|getlinkofdoor=(?:["']\.urlencode\([^\}\?]+\$_[l1o0]{1,40}\.['"]\?gendomain=['"]\.\$_[l1o0]{1,40}\.[^\}@%]{99,1500}\barray\((?:['"]wp\-[^'"]{2,20}['"],){2,5}(?<X2191670>)|['"]\.urlencode\([^;]+\);\s*if\(isset\(\$_[^:\$]+\):\$\w{1,20}=array\(['"]wp\-(?:config|load|header|settings|blog\-header)\.php['"](?<X2170820>)))
\[['"]?(cmd)['"]?\]\s*\)\s*;\s*@?system\s*\(\s*\$\1\s*\)\s*;\s*echo\s*\(?\s*['"][^'"]{1,40}['"]\s*\)?\s*;\s*if\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]?\1['"]?\]\s*[^\w]{1,2}=\s*['"][^'"]{1,40}['"]\s*\)\s*\{\s*\?>\s*</?pre>(?<X2056470>)
\\(?:n['"]\s*;\s*\$(?:message|data|msg)\s*\.?=\s*['"]\s*(?:Pass|PWD?)[^\n></]{1,60}(?:['"]?\\n['"]|['"]/['"]);[^\*\+%\^#`]{1,1999}\b(?:mail|telegram_send)\s*\([^\?]{1,600};\s*(header\s*\(\s*['"]location:)[^;]{1,99};\s*(?:\}\s*else\s*\{\s*\1|\?>)(?<X2129127>)|x\w\w"\]}=@?unserialize\(sh_decrypt\(@?base64_decode\(\${\$(?<X2047941>))
\](?:\(NULL\);\s*@\$GLOBALS\[(?<X2043771>)|\[\d+\]\(\$_\d+\);include\("\{\$_\d+\}\w{1,40}\.php"\);@?\$GLOBALS\['_(?<X2053312>)|\}=(?:"";class\h+BaseJsonRpcServer\h*\{\h*const\h+ParseError(?<X2048731>)|mail_utf8_html_attch\(\$\{\$\{(?<X2048370>)|pre_term_name\(\$\{\$\{(?<X2050500>)))
\A(?:!\+3v\+!\(%[^\$\n]{9,99}\$\s*cloudav\s+test\s+file\s*\Z(?<X2235100>)|#(?:!/(?:(?:usr/)?bin/perl\b[^&_%@]{99,999}\b(?:symlink\h*\(\h*['"]/home/['"][^\)]{9,99}\);\s*){19}(?<X2155230>)|[^$]+perl\b[^\$]{1,49}\$\w{1,40}\s*=\s*['"]CGI\s*Shell['"];[^;]{9,199};\s*\$(?:Password|pass|pwd?)\s*=(?<X2131942>)|bin/bash\s*(\w+)=['"]x86_64[^'"]{1,99}['"][^\$]{1,299}for\s*(\w+)\s+\w+\$\4\s+\w+\s+\bwget\s+http://\d+\.\d+\.\d+\.\d+/(\w+)\.\$\5[^\-]{1,99}\-O\s*\6\.\$\w+\s+chmod[^\n]{1,99}\s+\bdone\Z(?<X2240181>)|usr/bin/perl(?:[^\$@!]{99,300}\bprint\h+['"]<title>\h*Alfa\h+team\b(?<X2198770>)|\b[^\*/\-]{1,40}\bmy\h+\$\w{1,40}\h*=\h*['"][\*\h/\d]{5,20}python\h+\-c\s*\\{3}['"]import\b\h[^\\\v]{99,999}os\.system\h*\(['"][^'"]{99,9999}['"]\.decode\(['"]base64['"]\)\h*\+\h*eval\([^\v\\>]{99,999}\\{3}['"](?:\h*\d*>&?\d*(?:\h*/dev/null)?)?['"];(?<X2162180>)))|\!/bin/\w+\h*\w+\h*=\$\([^'"]+['"](linuxsys)[^\)]+\)[^\+]+wget[^/]+\10[^;]+;chmod\h*\+x\h\10;\./\10#kill\h*all\b(?<X2256260>))|(<\?[ph\s]+)define[\(\s'"]+PBOX['",\s]+\d+[\)\s;@]+include(?:_once)?[\s\(]+['"]\w*link\w*\.php['"][\s\);]+\?>\s*\12checkpost[\s\(]+\d+[\s\);\s]+\?>(?<X2211192>)|(<\?php)\s*(?:(\$\w{1,40})\h*=\h*['"]header['"];\s*\15\h*\(['"]Location:\h*https?://\w{2,6}\.[\w\-]{1,40}\.ga/\w{1,40}(?:\.php)?\?[\w\.&=]{1,16}['"]\);(?:\s*\?>)?\s*(?:\14\s*)?if[\h\(]+!\h*(class)_exists[\h\(]+['"]([a-f\d]{32,})['"][\h\)]+\{\s*\16\s*\17\s*\{(?<X2179141>)|if\(!(isset\(\$_)[GPRSC]\w{2,6}\[[^\]]+(\]\)\)\{)header\(['"]HTTP/\d\.\d\s+404[^;]{2,19};(?:die|exit)[^;]{0,19};\}\?>(?:\14\s*\?>)?\14\s*(?:if\(\19[GPRSC]\w{2,6}\[[^\]]+\20echo\s*[^;]{0,19};(?:die|exit)[^;]{0,19};\})?\$\w{1,40}=['"][^'"]{1,99}['"];function\s*\w+\(\$\w+,\$\w+,\$\w+\)\{return(?<X2130762>))|(<\?php\s*)(\$\w{1,40})=[^;]+;(\$\w{1,40})=[^;]+;function\s*(\w{1,40})\([^>]{100,600}(\$\w{1,40})=\25[^\?]+(\?>)[^!]{1,150}<form[^>]+action=['"]\22\s*echo\s*\23;[^!]+<input\s*name=['"]\22\s*(echo\s*md5\()\26\);\27['"]\s*value=['"]\22\s*\28\24\);\27['"]>(?<X2127341>)|(?:<\?[ph\s]*\?>\s*){0,3}<\?[ph\s]+eval\(["']\?>['"]\.file_get_contents\(['"]https?://[^/]+/r(?:aw)?/\w+['"]\)+;?(?:\?>\s*){0,5}\Z(?<X2220701>)|(?:<\?[ph\s]+)?if\(!?empty\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(\$\w+)=base64_decode\(['"]PD9[^;]+;(\$\w+)=['"]/[^;]+;function\s+(\w+)\((\$\w+),(\$\w+)\)\{[^\}]+file_put_contents\(\34,\35\);[^\?]{0,99}\b\33\(\32,\31\);[^\?]{0,99}\33\(["'][^'"]{0,99}\.htaccess['"],[^;]{19,};\}+(?:\?>)?\Z(?<X2216490>)|(?:<a\h*style=['"]display:None;?['"]\h*href=['"]https?://[^>]+>[^<]{0,60}(?:togel|slot|gacor)[^<]{0,60}</a>\s*){10,}['"]?;?\Z(?<X2226040>)|(?:\s*<\?php\s*(?:\/\*[^\*]{100,600}\*/)?\s*error_reporting\((?:0|false)\);\s*ini_set\(\s*['"]max_execution_time['"]\s*,\s*(?:0|false)\);\s*eval\(\s*base64_decode\(['"][^\?]{1000,2500}break;\s*\}\s*\}\s*\}\s*eval\(\s*gzinflate\(\s*base64_decode\(\s*\$\w{1,40}\s*\)\s*\)\s*\);\s*\?>){3}(?<X2055501>)|(?:\s*return;[=\s]+function[\(\s]+(\w+)[\)\s]+[\{\s]+\39\.\w+\.insertBefore[\(\s]+\w+,\s*\39\.\w+[^\?]{1,110}\b(elem)\.type[=\s]+(String\.fromCharCode[\(\s]+)(?:\d+[,\)]+)+;\s*\40\.src[=\s]+\41\b104,(?:\d+[,\)\s]+){37,}115[\)\s]+;[^\?]{1,200}\bdocument\.get\w+[\(\s]+\41[^\)]+\)+\[[^\]]+\]\.append\w+[\(\s]+\40[\s\}\);]+\(\s*\);?)+(?<X1225821>)|(Element)\.prototype\.(?:(append)After\h*=\h*(function\()\43\)\h*\{\h*\43\.parentNode\.insert[^\{]{9,99};\h*\(\45\)\h*\{\h*var\s*(\w{1,40})\h*=\h*(String\.fromCharCode\()104,116,116,112[^\)]+\);[^\}]+(\w{1,40})\.src\h*=\h*\46;[^\}]{99,999}\(\47[^\)]+\)+\[\d+\]\.\44Child\(\48\);\h*\}\h*\)\h*\(\);(?<X1184103>)|appendAfter\h*=\h*function\((\w{1,40})\)\s*\{\s*\50\.parentNode[^:]{1,99}var\h*\w{1,40}\h*=\h*https?://\w{1,9}\.\w{9,24}\.\w{2,6}/[^;]+\bvar\h*(\w{1,9})\h*=\h*document\.create\43\(script[^\v#]+else\h*\w{1,9}\(\51,\w{1,9}\)\h*\}\h*\((\w{1,9}),window\.lazyLoadOptions\),\52\}\h*\);(?<X1176350>))|.{0,10}GIF8[79a]+<\?php\s*eval\((?<X2050220>)|<(?:!DOCTYPE HTML><html\h+xmlns=['"][^'"]+['"]><head><title>\h*[cwd](?:iscount|heap|holeSale)[^>/]+Jersey[^>/]*</title>[^:#\?]{1,299}<meta\h+name\h*=\h*['"]description['"]\h*content=['"][^"']{1,499}\bJerseys\b(?<X2148760>)|\!(\-{2})\s*\w{1,10}\s*\56>\s*<\?php\s*(\$\w{2,3})=['"][base64dco_]+[^\)]{1,99}\$_[GPRSC]\w{2,6}[^;]+\bdie\([^=.]{1,99}(\$\w{2,3})=['"][base64dco_]{1,10}['"]\.\57[^;\(]+;eval\(\58\(\$_[GPRSC]\w{2,6}[^;]{1,16};\?>\Z(?<X2239630>)))
\A<\?[ph\s]+(?:(?:(?:includ|requir)e(?:_once)?\b[^;]+\bwp\-(?:blog-header|includes/registration)\.php['"][^;]*;){1,2}(\$\w+)=['"][^;]+;(\$\w+)=['"][^;]+;[^\?]{1,499}(\$\w+)=wp_create_user\(\1,\2\b[^;]{0,49};[^\?]{0,199}(\$\w+)=new\s*WP_User\(\3\);\4\->set_role\(['"]administrator['"]\);[^=\?><\(\)]{0,499}\}(?:\?>)?\Z(?<X2222310>)|(?:(?:ini_set\(['"]display_errors['"],|error_reporting\()0\);){2}(\$\w+)=(?:\(['"][^'"]['"]\^['"][^'"]['"]\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=(?:\6\(\d+\-\d+\)\.?){2,};(\$\w+)=\7\(\8\(['"]eJ[^'"]{65000,}['"]\)+;(\$\w+)=\9\(['"]{2},\10\);\11\(\);\Z(?<X2219990>)|(?:(\$\w+)=['"](?:header|function_exists)['"];){2}if\([^\)]*\13\b[^;\}=:\?]{1,99}tion:\s*https?://[^;\)]+\);\}else\{['"][^\}'"]+\bvar\s*(\w+)[\s=]+String\.fromCharCode\([^;\}]+;(?:(?:window|document)\.location\.(?:href=\14|replace\(\14\));?){2}</script>['"];\s*\}\s*(?:\?>|\Z)(?<X1203931>)|(?:(\$\w+)=file_get_contents\(['"]https?://[^'";\)]+\.txt['"]\);(\$\w+)=fopen\(['"][^'"]+\.php['"],[^;]+;fwrite\(\17,\16\);(?:fclose\(\17\);)?)+(?:\?>)?\Z(?<X2222641>)|(?:error_reporting\([^;]+;)?if\(!((function)_exists\()['"](hex2bin)['"]\)+\{\20\s+\21\([^@]{1,999}\b(?:if\(\19['"]((?:shell_)?exec|passthru|system)['"]\)+\{[^\}]{0,199}\b\22\([^\{]{1,199}){3}\{[^@]{9999,}\bmkdir\([^;]*\bwell\-known/acme\-challenge/[^;]{9,};[^\?]{1,999}\bpreg_match\([^\)]+\)+\{echo\b[^;]+;\}+(?:\?>\s*)+\Z(?<X2220310>)|(?:goto|function)\h*\(?[^\*%@&]{99,300}\bif\(strpos\([^'"]{1,9}["'].{0,3}cl[4a]wm[a4][5s]{2}.{0,3}\)[^,@\*]{9,99}\barray_diff\(scandir\((?<X2203490>)|(?:if\([^\{;]{1,199}\{)?if\(+@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\{;]{1,99}\{?\b(echo|print)\b[^;]{1,99};[\}\)]{0,2}else[\{\(]{0,2}\25\b[^;]{1,199};[\}\)]{0,2}(?:else[\(\{]{0,2}\25\b[^;]{1,199};[\}\)]{0,2})?;?\s*(?:\?>)?\Z(?<X1192121>)|(?:ini_set|error_reporting)\([^\{]{0,200}\bclass\h*\w{1,20}[\{\s]+static\h*private\h*\$\w+=\d+;[^@]+\{if\((\$\w{1,20})[^\)]+doorway\d*['"]\)[\{\s]+[^#&]+\{eval\(\27\[[^\}]+[\}\s]+(\$\w{1,20})=new\h*\w{1,20}\(\);\s*if\(\28\->\w{1,20}\(\)\)[\{\s]+\28[^\}]+\}\s*(?:exit|die)[^;]*;(?:\s*\?>)?\Z(?<X2240100>)|(\$\w+)=(file_)ge(t_contents\()['"]https?://[^;]+;\31pu\32['"][^'"]{0,199}\.php['"],\30\);(?:\?>)?\Z(?<X2212650>)|(\$\w+)=['"]\w+\.zip['"];[^\?=]{0,199}\$(\w+)=new\s+ZipArchive;\$\w+=\$\35\->open\(\34\);[^\?\}/:]{0,99}=\$\35\->extractTo\([^;]+;[^;\?\}/:]{0,99}\bunlink\(\34\);header\(['"]Location:(?<X2205381>)|(\$\w+)=['"]file_get_contents['"];eval\(['"]\?>['"]\.\37\(['"]https?://[^/'"]+\.blogspot\.com/[^;]+;\s*(?:\?>\s*)?\Z(?<X2214550>)|(\$\w+)=['"]{2};[^\{\?]{1,49}(\$\w+)=[^;]{0,49}\39\b[^@#:/\^]{1,1999}(\$\w+)=file_get_contents\([^;]+\.(?:png|jpe?g|gif|bmp)['"]\);[^\?]{1,499}\41=\40\(\41\);[^\?\}]{1,199}(\$\w+)=fopen\(([^,]+),[^\?\}]{1,199}\bf(?:puts|write)\(\42,\41\);[^\?]{1,199}\binclude(?:_once)?\b[^;]{0,9}\43[\)\};]+(?:\?>)?\Z(?<X2221070>)|(\$\w+)=file_get_contents\(['"]https?://[\d\.]+/[^\?\{]{1,499}=fopen\(([^,;]+),[^;]+;fwrite\(\$\w+,\45\);[^\?\{]{1,499}=(\w+\()\46\);[^\{\?]{0,499}\bfunction\s+\47(\$\w+)\)\{(\$\w+)=[^;]+;(?:if\(function_exists\(['"]((?:shell_)?exec|passthru|system)['"]\)+\{[^\}]*\b\50\([^\)]*\48\b[^\}]+\}else){2}[^\?]{1,499}\breturn\s*\49;\}(?:\?>)?\Z(?<X2219961>)|(\$\w+)=fopen\(['"](?:[^"']+\.(?:p?html|php\d*)['"],[^;]+;(\$\w+)=file_get_contents\(['"]https?://[^'"]+/raw['"\?/][^;]+;(?:\$\w+=)?fwrite\(\52,\53\);fclose\(\52\);(?:\?>)?\Z(?<X2222280>)|[^'"]+\.php\d*['"],[^;]+;fputs\(\52,\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:fclose\(\52\);)?(?:\?>)?\Z(?<X2220561>))|(\$\w+)=rand\((?:[^;]+;if\(\56\b[^;\{]+\$\w+(=base64_decode\(['"]PD9)[^@]{999,4999}\bunlink\([^;]+;(\$\w+)\57[^\?]{999,}\$(\w+)=fopen\(([^,]+),[^;]+;fwrite\(\$\59,\58\);[^\?]{1,99},CURLOPT_URL,['"]https?://[^;\)]+\60[^\?]{1,999}\b[pes](?:xec|assthru|hell_exec)\(\60\);?(?:\?>)?\Z(?<X2223700>)|[^\)]+\)\.['"]\.php['"];(\$\w+)=fopen\(\56,[^@]{199,}\bfwrite\(\62,[^;]+;(?:fclose\(\62\);)?header\(['"]Location:\s*['"]\.\56\);\s*(?:\?>|\Z)(?<X2212121>))|(\$\w+)=range\(['"]\W['"],[^;]+;(\$\w+)=(?:\$\{)?(?:\64\[[\d\+\-\*/]+\]\.){3}[^;]+;if\(+in_array\(gettype\(\65\)[^;]+&&\65\(\)+;\}+(?:class\s+(\w+)\{(?:\w+\s+){0,2}function\s+\w+\([^\{;]+\{(\$\w+)=["']range['"];\$\w+=\67\(['"]\W['"],[^@]{99,}\}\66::\w+\(\);?)?(?:\?>\s*)?\Z(?<X2220710>)|(\$\w{1,20})(=["']header["']);\s*\69?\(["'][lo]{0,2}cation:\h*https?://\w{1,20}\.[^/]{2,60}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml)/[^;>]{1,99}\);\s*\?>\s*<\?[ph\s]+\$\w{1,20}\70[^,!]{99,200}\bvar\h+(\w{1,20})[\h=]+[^\?<>]{99,300}\bwindow\.location\.replace\(\71\);\s*</script>['"];[\}\s]+\?>(?<X1203980>)|(\$\w{1,20})=(curl_)init\(['"]https?://[^/]{0,6}\bgithub[^\.]{0,12}\.com/[^'"]{1,20}Shell[^'"]{1,99}\.(?:php|txt)['"]\);[^\?]{9,99}\b\74exec\(\73\);\s*\74close\(\73\);\s*fclose\([^\)]+\);\s*(?:\?>\s*)?\Z(?<X2207311>)|(\$\w{1,20})=["'][^\n]{4999,}['"];\s*class\h*(\w{1,20})[\{\s]+var\h*\$cd_str;\s*function\h*\w{1,20}\(\)[\s\{]+(\$this\->)[^\?!]{499,2700}\78add\([^\?\-]{9,99}(\$\w{1,20})=new\h*\77\(\d+\);\s*eval\(\79\->unport\(\76\)\);(?:\s*\?>)?\Z(?<X2218890>)|(\$\w{1,20})=['"][^'"]+['"];\s*file_put_contents\(\81,base64_decode\(implode\(array_\w{2,9}\(File\([^\)]{0,15}__FILE__\)+,[\d,]+\)+;\s*[ir][ne][cq][lu][ui][dr][e](?:_once)?\h*\81;\s*(?:\?>|\Z)(?<X2221701>)|(\$\w{1,20})=['"][^'"]{1,20}['"]\^['"][^;]{0,9};[^\?>]{99,999}(\$\w{1,20})=array_merge\(\84,\$_[GPRSC]\w{2,6}\);[^\?@#]{99,999}\{\s*(\$\w{1,20})=sprintf\(\.?[^\$]{0,9}\83\([^\}]{99,600}\binclude\(\85\);\s*\$\w{1,20}\(\85\);[\}\s]+(?:exit|die)[^;]{0,9};(?:\s*\}){2}\s*(?:\?>\s*)?\Z(?<X2234063>)|(\$\w{1,20})=['"][^'"]{9,99}\.txt['"];\s*(\$\w{1,20})=['"][^'"]{9,99}\.txt['"];[^\(]{1,20}\bsystem\(['"]kill[^\)]+\);goto[^\(]{1,20}\btouch\(\87,[^\?>#]{99,400}\berror_reporting\([^\)]+\);[^\(]{1,60}\b(file_)pu(t_contents)\(\87,\89ge\90\(\88\)[^@\?]{9,250}\bchmod\(\87,\d+\);[^\?]{1,50}\bgoto\h*\w+;\w+:\h*\w+:\s*(?:\?>|\Z)(?<X1216271>)|(\$\w{1,20})=['"]https?://[^'"]{2,60}\.(?:txt|php)['"];\s*(\$\w{1,20})=['"]/tmp/sess_[^;]{9,99};\s*if\(file_exists\(\93\)\)[\s\{]+include(?:_once)?[\(\h'"]+\93[\)\h'"]+;[^_]{0,29}\b(file_)pu(t_contents)\(\93,\94ge\95\(\92\)\);[^\}]{1,60}\}\s*(?:\?>)?\Z(?<X2202600>)|(\$\w{1,20})=['"]w3bane\h*v\d\.\d['"][^;\$]{9,150}<title><\?php\h*echo\h*\97;(?<X2202590>)|(\$\w{1,20})=['"]{2};\s*if\(isset\([^\\\?!]{300,600}\bcutterimg\([^\{]{9,99}\{\s*\99=['"][^'"]{99,200}['"];\s*if\((\$\w+)=[^\{]{2,20}\{(\$\w+)=["']\};['"]\.gzinflate\(base64_decode\([^;]{9,99};\s*create_function\(['"]{2},\101\);\s*\}[^\?>]{99,200}\bjson_encode\(array\([^\)]+\100\)\);[\}\s]+(?:\?>|\Z)(?<X2227340>)|(\$\w{1,20})=\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]wget[^:]{1,9}https?://(?:raw\.)?pastebin\.[^'"]{9,99}\.\w{2,4}['"]\);\s*if\(\103[^\)]+\)[\{\s]+[^\}]{1,99}[\}\s]+else[\{\s]+[^\}]{1,99}[\}\s]+(?:\?>)?\Z(?<X2208290>)|(\$\w{1,20})=file_get_contents\(['"][^'"]{1,60}\.(?:js|txt)['"]\);\s*\105=base64_decode\(\105\);\s*class\h+(\w{1,20})[\{\s]+public\h+function\h*(\w{1,20})\((\$\w{1,20})\)[\{\s]+eval\(\108\.['"]{2}\);[\}\s]+(\$\w{1,20})=new\h+\106\(\);\s*\109\->\107\(\105\);\s*(?:\?>|\Z)(?<X2207330>)|(\$\w{1,20})=range\(['"]\W['"],['"\h]+\);\s*(\$\w{1,20})=\$\{\111\[[^\}]{9,99}\]\};\s*if\(\(?in_array\(gettype\(\112[^\?]{60,150}\112\(\)\);[\}\s]+class\h*(\w{1,20})[\{\s]+[^<#\*]{400,1500}\b(?:exit|die)[^;]{0,9};\s*(?:endif;)?[\}\s]+\113::\w{1,9}\(\);\s*(?:\?>\s*)?\Z(?<X2216533>)|(\$\w{1,40})=['"]base64_decode['"];if\([^\)]+\$_[GPCSR]\w{2,6}\[[^\}\?]{1,499}(\$\w{1,40})=\115\(\$_[GPCSR]\w{2,6}\[[^\}]{1,499}\b[ri](?:nclud|equir)e\w{0,5}\(?\116\)?;unlink\(\116\);(?:die|exit)[^;]{0,19};\}(?:else\{eval\(\115\(\116\)+;\})?\}(?:else\{[^\};]{0,99};\})?\s*(?:\?>|\Z)(?<X1189490>)|(\$\w{1,40})=['"]range['"];(\$\w{1,40})[=\s]+\118\(['"]\W['"],['"]\W['"]\);include(?:_once)?[\s\('"]{0,5}(?:\119\[[^\]]+\]\.){4,}\119\[[^\]]+\];?\?>\Z(?<X2220763>)|(\$\w{1,60})=['"]\w{5,60}['"];\s*function\h*(\w+)\((\$\w+),(\$\w+)\)[\{\s]+[^\(]{0,99}(\$\w{1,60})=urldecode\(\123\);\s*(\$\w{1,60})=substr\(\124,[^\}]{9,99};\s*return\h*\125\^\126;[^\[]{1,300}\bif\([^\{]+\)[\{\s]+(\$\w{1,60})=\$\w+\[\121\];\s*(\$\w{1,60})=\127\[\122\([^;]{1,50};\s*include\(\128\);[^\}]{0,99}\}\s*(?:\$\w{1,40}=['"][^;]+;)?(?:\?>|\Z)(?<X1232262>))
\A<\?(?:(?:=|php)\s*null;\s*eval\(['"]\?>['"]\.file_get_contents\(base64_decode\(["']aHR0cH[^'"]{1,70}LnR4dA==['"][\);]+\s*\?>(?<X1193740>)|(?:php)?(?:.{0,80}\$ipv?[\h=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\h*\.?=\.?\h*[^;]{1,80};\s*){4,8}@?mail\([^\)]{1,80}\)\s*;\s*header[\h\(]+['"]Location\h*:[^\)]+\);\s*\?>(?<X2052302>)|[^\{]{49,99}(if\(isset\()((\$_[GPCSR]\w{2,6}\[)[^\]]+\][\h\)]+)&&[\(\h]+sha1\((base64_decode\()\4(\^\$\w+\))[^;]+echo[^;]+;\3\5[^\]]+\][\h\)]+\{(\((\$\w+)=[\(\h]+\6\5[^\]]+\][\h\)]+\7[\)\.\h]+\9\(+\6\5[^\]]+\][\h\)]+\7)[^;]+;[\h\}\{els]+\8[\h\)]+;[\h\}]+echo[^;]+;[\h\}\{els]+echo[^;]+;\h*\}(?<X2134143>)|\s*(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{[^\}]{1,199}\b(?:header\(['"]Location:|eval\()[^\)]{1,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(?:die|exit)[^;]{0,19};\}+){2}\s*(?:\?>|\Z)(?<X1181881>)|\s*(\$\w{1,40})=(curl_)init\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:\13setopt\(\12,[^;]{1,199};){1,}(\$\w{1,40})=\13exec\(\12\);(?:eval|assert)\(['"]\?>['"]\.\14\);\s*(?:\?>)?\Z(?<X2178670>)|\s*(\$\w{1,40})=['"](?:\w{32,64}['"];error_reporting\([^;]{1,99};function\h*\w{1,40}\(\)\{global\h*\16;[^@#%/]{4999,9999}\bfile_put_contents\(\16,\$_[GPCSR]\w{2,6}\[[^@#%/]{999,4999}\bforeach\([^\{]+\bas\s*(\$\w{1,40})\)\{header\(\17\);\}\s*(?:\?>|\Z)(?<X1186640>)|https?://[^;/\?=&]{0,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(\$\w{1,40})=file_get_contents\(\16\);(?:echo|print)\(?['"]?\19['"]?\)?;?(?:(?:die|exit)\b[^;]{0,19};)?(?:\?>)?\Z(?<X2185613>))|\s*(\$\w{1,40})=urldecode\([^;]{1,199};\$\w{1,40}=(?:\21\{\d+\}\.){3}[^\v\?@#%&:]{999,4999}\[['"](?:del|trojan|shell_link)['"]\][^\?]{1,199}=(\$\{['"]GLOBALS['"]\}\[)[^\]]+\]\(\$\w{1,40}\);[^\v\?@#%]{1,4999}\22[^\]]+\]\(\d+\);\s*(?:\?>|\Z)(?<X1185970>)|\s*(file_)pu(t_contents\()['"][^'"]+\.php['"],\24ge\25['"]https?://[^'"]{1,99}['"]\)\);?\s*(?:\?>|\Z)(?<X1175170>)|\s*class(?:\h+(\w{1,40})\{function\s*__construct\(\)\{\$\w{1,40}=(\$this\->)\w{1,40}\(\28(\w{1,40})\);[^\?]{199,999}\$(\w{1,40})=(ord\()(\$\w{1,40}(\[\28\w{1,40}\]))\)\s*[\+\-/\*]\s*\31\$\w{1,40}\33\);\32=chr\(\$\30\W[^\?]{19999,29999};var\s*\$\29=['"][^;]{99,999};\}\s*new\h+\27\(\);\s*(?:\?>|\Z)(?<X1188710>)|\s*(\w{1,40})\{\s*(?:var\s*)?\$\w{1,40}=['"][^'"]{25000,}['"];[^\?#@]{9999,35000}\}(\$\w{1,40})=new\s*\35\([^\)]{0,99}\);[^\?]{1,499}\b(eval\(\36\->)\w{1,40}\);\}else\{\37\w{1,40}\);\}+(?:\?>)?\Z(?<X2187100>))|\s*define\(['"](\w+)['"],(\w{1,40}\(\))\);ob_start\(['"](\w+)['"]\);(function\h+)\41\([^\{]{0,99}\{\$\w+=\39;\$\w{1,40}=abs\(crc32\(\$_[GPSRC]\w{2,6}\[[^@]{99,999}\42\40\{\$\w{1,40}(?:\[\])?=['"]<a\b[^>]{0,99}\bhref=['"]\{?https?://[^/'"]{0,19}(?:viagra|cialis|casino|pharm|jersey)[^;]{9999}(?<X2180821>)|\s*error_reporting\([^;]{1,9};header\(['"]Content\-type:\h*text/html\b[^@#]{999,1999}=(['"]https?://[^/;]{1,99}\.xyz/)[^@#%\+]{999,2999}\{(?:if\(\$_[GPCSR]\w{2,6}\[[^\]]+\][^\)]+\)\{echo\h*\44[^@]{99,999}\b){2}=(?:f(?:write|close)\([^;]{1,99};){2}return\b[^;]{1,99};\}(?:\?>)?\Z(?<X2180722>)|\s*if\([^;\{]{0,99}\$_[GPCSR]\w{2,6}\[[^;\{]{1,99}\{header\(['"]HTTP/[\d\.]+\h+40[34]\b[^;]{1,99};(?:(?:die|exit|echo|print)\b[^;]{0,19};)\}else\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}(?:\?>)?\Z(?<X2185630>)|\s*include\s*['"](?:sc|bots?|antibots?|blocker[sz]?){1,2}\.php['"];[^\$]{1,99}if\((?:strpos\([^,]{1,49},['"](?:google|msn|mozilla)['"]\)[^\)\|]{1,49}(?:\|\||\))\s*){1,5}\{header\(['"]HTTP/\d\.\d\s+404\s*Not\s*Found['"]\);(?:die|exit)\([^;]{1,19};\}(?<X2133930>)|\s+define\(['"](\w{1,40})['"],(\w{1,40}\(\))\);ob_start\(['"](\w{1,40})['"]\);(function\h+)\50\(\$\w{1,40}\)\{\$\w{1,40}=\48;\$\w{1,40}=abs\(crc32\(\$_[GCSR]\w{2,6}\[[^@]{1,999}\b\51\49\{\$[^=]{1,99}=['"](?:[^;]{0,99}\b(?:viagra|cialis|online|casino|game|sale|pharm|herb|jersey)\b){5}(?<X2184230>))|(?:php|=)?(?:\h*null;\s*echo\h*['"]<(script)\h+src=['"]https?://[^'"]{9,99}/[^'"]{1,20}\.txt['"]></\53>['"];\s*\?>(?<X1191200>)|\s*(\$[^=\s]{1,40})=\$\{[^a-z0-9;\^]{2,}['"]\^['"][^a-z0-9;]{2,}\};(?:\55\[[^\]]+\]\()+\55\[[^\]]+\]\)+;?(?:\?>)?\Z(?<X2221310>)|\s*null;\s*eval\(['"]\?>['"]\.file_get_contents\(['"]https?://bit\.ly/\w{1,9}['"]\)\);\s*\?>(?<X1198390>))|.{0,40}\$ip[\s=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])[\s;]+\$\w{1,40}[\s=]+date\([^)]{1,40}\)[\s;]+\$\w{1,40}[\s=]+['"][^'"]{80,120}['"][\s;]+(?:\$\w{1,40}[\s\.=]+[^;]{1,80}[\s;]+){2,5}@?mail\([^)]{1,80}\)\s*;\s*header[\s\(]+['"]Location\s*:(?<X2052332>)|=[\s\(]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]+/etc/passwd[\$\}\)'";\?>]*\Z(?<X2222070>)|[\sph=@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}[^;]{1,99}\.(?:bmp|gif|png|jpe?g|ico|pdf|mp[34e]?g?)[\$\}\)'";\s\?>]+\Z(?<X2202893>)|[\sph@]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\s'"\(]+phar:/+home[^;]+;\s*(?:\?>\s*)?\Z(?<X2198690>)|[\sph]*\$shell\w{0,40}\s*=\s*['"][^'"]{0,40}Cyber\s*Team[^'"]{0,40}['"];(?<X2218790>)|[\sph]+class\s*(_?Wp_\w{4,40})\s*\{\s*private\s*(\$\w{1,40})\s*;\s*const\s*(\w{1,40})\s*=[^>@#]{2,10}_[GPRSC]\w{2,6}['"]\s*;\s*public\s*function\s*__construct[\(\s]+\64[\s=]+null\b[^;:\}]+::\65[^\+]{99,499}\$\w{1,40}\++[^\}]+\}[\};\s]+\$\w{1,40}[\s=]+new\s*\63;[\s\?>]*\Z(?<X2199025>)|[hp\s]*function\s*(\w+\()\$\w+\)\{[^\{\}]{1,999}\}(\$\w+)=\67\d+[\-\+\*/%]\d+\)(?:\.\67[^;]{1,299})?;(?:(\$\w+)=\67\d+[\-\+\*/%]\d+\)(?:\.\67[^;]{1,299})?;){1,19}(\$\w+)=\$\{\69\.(?:\$\w+\.)+\$\w+\};[^\{\}\?]{0,299}\beval\(\68\(\70\[\$\w+\]\)+;(?:\?>|\Z)(?<X1234050>)|[ph=\s]*(?:null[;\s]+)?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s\.'"\?>]+file_get_contents[\(\s]+['"]https?://raw\.githubusercontent\.com/[^/]+/(?:d[e3]f[a4]c[e3]|sh[e3]ll|b[a4]ckd[o0][o0]r|expl[o0]it)/[^'"]+\.php['"][\s\);\?>]+\Z(?<X2223750>)|[ph=\s]+null;\s*eval[\s\(]+['"][\?>]{2}['"]\h*\.\h*file_get_contents[\s\('"]+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"\)]+;(?:\s*\?>)?\s*\Z(?<X2193900>)|[ph\h*]+if\(\$_SERVER\[['"]REQUEST_METHOD['"]\]={3}['"]POST['"]\)\{\$\w+=\$_POST[['"]['"](\w+)['"]\];if\(preg_match[^\)]+\74\){2}\{echo\h*shell_exec\(\$\74\);\}else\{\w+\h*[^\}]\w+\h*command[\.'";}]+else\{\w+\h+['"][a-z\h]+\.['"];\}(?<X2253751>)|[ph\h]+(?:/[\*]+\s+\*[^\?]+\$\w+\h+=\h+['"](?:SELECT|UPDATE)\h+(?:\*|\w+)\h+(?:FROM|SET)[^\}]{1,99}(\$\w+)\h+=\h+['"]\w{10}['"];\s*\$\w+\h+=\h+substr\(\76,\h+\d+,\h+\d+\);[^\}]{1,99}hash\(['"]sha256(?<X2279010>)|eval\((?:(rawurldecode)\(['"]%20[^;]{1,256}\.php[^'"]+\78[^;]+file_put_contents[^\)]{1,999}(?:die|exit)[^\)]{1,64}['"]\){2};\h*(?:\?>|\Z)(?<X2256020>)|rawurldecode\(['"][^;]{1,256}\-(?:content|includes|config|settings)[^'"]+\.php[^'"]+file_put_contents[^\)]{1,999}(?:die|exit)[^\)]{1,64}['"]\){2};\h*(?:\?>|\Z)(?<X2255443>)))|[ph\s*]+(?:///\s*coder\h*\w+\h*\w*[^[^\$]+(\$\w+)\h*=\h*fopen[^$]+\(\81[^;]+;\s*header\(['"]location:[^;]+;\s*(?:\?>|\Z)(?<X1252240>)|[^'"]{1,16}['"]fucker\.php['"];\?>(?<X2247631>)|\bsession_start[^\$\+]+\berror_reporting\(0\)[^\?>]{1,999}\$(pass)=['"]\w{8,32}['"][^\?>]{1,99}\bif\(isset\(\$_POST\[\$\84[^\$]+\$data=encode\(base64_decode[^\?>]{1,999}\?>\Z(?<X2240200>)|eval\(\s*base64_decode\(\s*file_get_contents\(['"]\.\w+['"]\),\h*\d+\s*\)\s*\);\Z(?<X1251941>)|goto\h+\w+;\h+\w+:\h+if\h*\(@?\$_GET\[['"abcdefx\d\\]+\][^?]{1,999}file_put_contents[^\}]+\}\s*else[^=]+\(sha1\(sha1\(@?\$_GET[^:]+:\s*\w+\s*pingmap[^:]+:\s*[^\}]+\}[^\?]{1,2999}stristr\(\$\w+[^\?]{1,1999}goto\h+\w+;\h+\w*:\s*//\w{1,8}\h*\?>(?<X1252350>))|[ph\s=]*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:\w+[\(\s]+)*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;\?>]+\Z(?<X2222050>)|[ph\s@]*(?:copy|move_uploaded_file)[\(\s"']+https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][,\s]+['"][^'"$]+\.php['"][\)\s;\?>]+\Z(?<X2208542>)|[ph\s@]+include(?:_once)?[\$\{\('"\s]{1,3}\.+/js\d*/[^;]{1,199}\.(?:js|gif|ico|je?pg|png)[\$\}\)'"]{0,3};(?:\h*\?>)?\s*\Z(?<X2196161>))
\A<\?[ph\s]*(?:(?:(\$\w)[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*){2,}if[\(\s]+!empty[\(\s]+(\$_GET)[\)\s]+foreach[\(\s]+\2\s*as\s*(\$\w)\s*=>\s*(\$\w)[\)\s]+\1\[\3\][=\s]+\4\s*;\s*\$\w{1,40}[=\s]+function[^:]{9,}:\s*['"]PD9[^'"]{99,}['"][\s\);]+touch[\s\(]+(\$\w).+\5[=\s]+\$\w\s*\.\s*\$\w[\s\(]+\$\w\[[^\]]+\][^;]+;\s*\Z(?<X2218580>)|(?:[pes](?:assthru|ystem|xec|hell_exec|open)\(['"][^'":\)]{0,99}\b[cwlf](?:url|get|wp\-download|ynx|etch)\h+[^'";]{9,99}(?:/|>\h*)([^'";]{1,99});\h*[pbskt](?:erl|ython|hp|[ac]?sh|h)[\d\.]*\h+\7\h*;\h*rm\b[^'"\)]{1,99}['"]\);){5}(?<X2178204>)|(?:\$group_num=['"][^;]+;)?\$inter_domain=['"]https?://[\d\.]+/[^;]+;function\s*(\w+\()[^\{;]+\{[^\}=]*=curl_init\([^@]{499,2999}(\$\w+)=['"]https?://www\.google\.co(?:m|\.jp)/ping\?sitemap=[^\?]{1,499}\b(?:file_get_contents\(|\9)\10\)[^;]+\bSubmitting\b[^@]{99,1999}\becho\s*\$get_content;(?:return)?[;\}\s]*(?:\?>|\Z)(?<X1228801>)|(?:echo|print(?:f|_r)?|var_dump|var_export|vprintf|vsprintf|vfprintf|fprintf)[\s\(]*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]+/etc/passwd[\$\}\)'";\?>]*\Z(?<X2222060>)|(\$[O0]+)\s*=\s*urldecode\([^\)]+\);(\$[O0]+)\s*=\s*\13\{\d+}[^;]+;\$[O0]+[^'"]{1,999}\13\{\d+}\h*;\s*eval\(\14\([^\)]+\){2};\?>(?<X1256391>)|(\$\w+)=(function)\([^\)]+\)\{[^\}]*\};\17\s*(\w+)\(\$\w+\)\{[^\}]*\}(\$\w+)=['"][\w/\+=]{499,}['"];(\$\w+)=\17(\(\$\w+\))\{eval\21;[^\}]*\};?(?:\19=(?:\16|\18)\(\19\);){2,}\20\(\19\)[;\?>]+\Z(?<X2228530>)|(\$\w+)=['"][^;]+;(\$\w+)=dirname\(__FILE__\);[^\?\{]{1,499}\bfile_put_contents(\(\24[\./'"]+\23),[^;]+;\bfunction\s+(\w+)\((\$\w+)\)\{[^\}]{0,99}(?:\(function_exists\(['"]([peas](?:assthru|ystem|xec|hell_exec|open|val|ssert))['"]\)+\{[^\}]{0,99}\b\28\(\27\b[^@#\?]{1,99}){3}\(\27\b[^\?]{1,499}\26\25\);unlink\25\);(?:unlink\(\24\.[^;]+;){0,5}(?:\?>)?\Z(?<X2234271>)|(\$\w+)=[^;]+;file_put_contents\([^,;]{0,49}\30[^,;]{0,49},[^;\)]{0,99}\barray_slice\(file\((?:\w+\(){0,3}__file__\)[^;]+;(?:includ|requir)e(?:_once)?\b[^;\?\$]{0,49}\30\b[^\?;\$=]{0,49};?(?:\?>)?\Z(?<X2231871>)|(\$\w+)=base64_decode\(['"]PD9[^@]{9999,}\b(?:if\((strpos\((\$\w+),)['"](<\?(?:php)?)['"][^\{;]{1,99}\b\33['"]COOKIE\[[^\{;]{1,99}\{[^\}=]*\34=str_replace\w*\(['"]\35['"],\32,\34\);(file_put_contents\()[^,]+,\34\);[^\}]*\}+if\([^\}]{1,199}){2}\36[^@]{1,499}\b\36(__FILE__),['"]{2}\);unlink\(\37\)[;\?>]+\Z(?<X2225950>)|(\$\w{1,40})[=\s]+['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\s*;\s*echo\b[^;\$]*\39[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\?>;]+\Z(?<X2222040>)|(\$\w{1,40})[=\s]+['"]range['"][;\s]*(\$\w{1,40})[=\s]+\41[\s\('"]+\176['"][\s,]+['"][^'"]*['"][\s\);]+(\$\w{1,40})[\s=\$\{\(]+\42\[[\s\(]*\d+[\+\*\-/\s\(\)]+\d+[^\]]*\](?:[\s\.]+\42\[[^\]]+\])+[\s\)\}\(;]*(?:count|if)[^;\n]+in_array[\(\s]+gettype[\s\(]+\43[^\n\176]{9,499}\bclass\s*(\w{1,40})\s*\{[^\n]+\44::\w{1,40}[\s\(\);\?>]+\Z(?<X2223251>)|(\$\w{1,40})[=\s]+['"]str_rot13['"\s;]+(\$\w{1,40})[=\s]+['"]base64_decode['"\s;]+(\$\w{1,40})[=\s]+['"]gzinflate['"\s;]+@?error_reporting[\(\s]+\d+[\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:(?:\46|\47|\48)[\(\s]+){3}['"][^'"]{99,}['"][\)\s;\?>]+\Z(?<X2225911>)|(\$\w{1,40})[=\s]+file_get_contents[\(\s]+['"]php://input['"\)\s;]+if[\(\s]+substr[\(\s]+\50[,\s]+\d+[,\s]+\d+[\)\s]*==+['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+gz\w+[\(\s]+substr[\(\s]+\50[,\s]+\d+[\)\s]+;(?:\s*(\$\w{1,40})\b[^;]+\51)?[^\}\?]{0,99}\b(?:eval|assert)[\(\s]+(?:\51|\52)[^=]{0,99}\Z(?<X2228360>)|(\$\w{1,40})[=\s]+range(?:[\s\('"]+\176['"][\s,]+['"][^'"]*['"][\s\);]+(\$\w{1,40})[\s=\$\{\(]+\54\[[\s\(]*\d+[\+\*\-/\s\(\)]+\d+[^\]]*\](?:[\s\.]+\54\[[^\]]+\])+[\s\)\}\(;@]*count[\s\(]+\55[^\(;\n]+in_array[\(\s]+gettype[\s\(]+\55[^\n\176]{9,499}\bclass\s*(\w{1,40})\s*\{[^\n]+\56::\w{1,40}[\s\(\)]+;\s*\?>(?<X1221752>)|[\s\(]+['"]\176['"][\s,]+['"][ ]+['"][\s\);]+(\$\w{1,40})[=\s]+\$\{\54\[\d+\+\d+\](?:[\.\s]+\54\[\d+\+\d+\])+[\}\s;]+if[\s\(]+(?:(?:(?:in_array|gettype)[\(\s]+)+\$\w{1,40}[\)\.\s]+['"]\d+['"][,\s]+\58[\)\s]+\{\s*\58\[\d+\][=\s]+\58\[\d+\][\.\s]+\58[^:\?]{9,}\?[^;]+;[^\?]{9,}\w+::\w+\s*\(\);[\?>\s]*\Z(?<X2217960>)|(?:(?:in_array|gettype)[\(\s]+)+\$\w{1,40}[\)\.\s]+['"]\d+['"][,\s]+\58[\)\s]+\{\s*\58\[\d+\][=\s]+\58\[\d+\][\.\s]+\58[^\?\+%]{9,}\?[^\{]{0,199}\bfunction\s*(\w+)\s*\([^\?]{9,}\w+::\60\s*\(\)[;\?>\s]*\Z(?<X2224440>)))|(\$\w{1,40})\s*=\s*(?:['"]/home\d*/[^;"']+/wp\-(?:admin|includes)/images/['"\s]+;[^\{\}]{0,199}(\$\w{1,40})\s*=\s*\62\s*\.\s*['"][^'"]+\.(?:png|jpe?g|gif)['"]\s*;[^\}]{0,199}\}\s*else\s*\{[^;]+\bfile_get_contents[\s\(]+\63[\s\)]+;(?<X2203800>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*[^1]{1,400}while\s*\(\s*1\s*\)\s*\{[^\d]{1,99}\$\w{1,40}\s*=\s*fsockopen\(['"]\62['"],\s*(?:80|443),[^\?]{99,999}echo\s+['"]HTTP\s+flood[^;]+;(?<X2122211>))|(\$\{['"]GLOBALS['"]\}\[)[^\]]+\][\s=]+['"]_(HEADERS)['"]\s*;\s*\$\{\66[^\]]+\][\}\s=]+getall\67[\(\s]+[\)\s]+;\s*if[\(\s]+isset[\(\s]+\$\{\66[^\]]+\]\s*\}\s*\[[^\]]+\][\)\s]+\{\s*\66[^\]]+\][\s=]+['"][GPRSC]\w{2,6}['"]\s*;\s*\$\w{1,40}[\s=]+['"]_\67['"]\s*;[^\?]{9,499}\66[^\]]+\]\}?\(\)[;\s\}\?>]*\Z(?<X2228330>)|(create_shells_and_report\(\));\s*function\h*\69[\{\s]+[^\?]{0,99}\bini_set\(['"](?:log|error)_(?:errors|log)['"],(?:0|NULL|FALSE)\);[^\{]{99,300}\bif\(function_exists\(['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\)\)(?<X2217610>)|/\*\*[^@]{1,99}@package\h+wordpress\s*\*/\s*eval\(\w+\(\)\);\Z(?<X2265530>)|\$\w+\s*=\s*(base64_decode)\(\72\(['"]Q2dvS0NtbG1LQ0ZwYzNObGRDZ2tYME5QVDB0SlJWc(?<X2266370>)|\$\w{1,40}=['"][^'"]{999,}['"];(\$\w{1,40})=['"]chr['"];(?:(\$\w{1,40})=\74\(\d+\-\d+\)(?:\.\74\(\d+\-\d+\)){3,};){2,}\s*eval\s*\([^'";]+\75[\(\s]+['"][^'"]+['"][\)\s;]+\Z(?<X2218350>)|\$\w{1,40}\s*=(?:[^\(]{0,99}\bchr[\s\(]+\d+\s*[\+\-/%\*]\s*\d+\s*\)[^,]+(\$\w{1,40})[=\s]+array_slice[\(\s]+str_split[\(\s]+str_repeat[\(\s]+\77[^\*]{9,9999}\$\w{1,40}[=\s]+glob[\(\s]+\$\w{1,40}[\.\s]+['"][^'"]+['"][,\s]+GLOB_ONLYDIR[^%]{99,999}?\becho\s*\$[^\}]{0,199}(?:exit|die)\b[\(\);\s\}]+\Z(?<X2220801>)|\s*\$_(?:COOKIE|POST)\s*;\s*(\$\w{1,40})[=\s]+0\s*;\s*(\$\w{1,40})\s*=[\(\s]*\d+(?:\s*[\-\+/\*\(\)]\s*\d+)+[\)\s]*;\s*(\$\w{1,40})[=\s]+array[\(\)\s]+;[^\{\}]{0,99}\bwhile[\s\(]+\80[\s\)]+\{\s*\81\s*\[\s*\79[^\n]+\binclude(?:_once)?[\s\(]+\79[\s\);\?>]+\Z(?<X2238500>))|class\s*(\w{0,4}wp\w{0,40})\s*\{\s*private\s*(\$\w{1,40})\s*;\s*const\s*(\w{1,40})[=\s]+['"][^'"]{0,9}_COOKIE['"]\s*;[^\}\?]{0,400}\?\s*\83\s*::\s*\85\s*:\s*\84\s*;[^\}\?]{0,400}\$this\->\s*\w+\s*\(\s*\)\s*;\s*\}[^\?]{0,999}\bnew\s*\83\s*;[\s\?>]*\Z(?<X2203370>)|define\(['"](\w+)['"],['"][^;]{99,499};function\s*(\w+\()\$\w+\)\{\$\w+=\87;[^\?]{1,499}?\breturn\s*\$\w+;\}function\s*(\w+\()(\$\w+)\)\{[^\}]{0,199}=file_get_contents\(\90\)[^\}]{0,499}(\$\w+)=\88\$\w+\);return\s*\91;\}(\$\w+)=\89[^;]+\.(?:ico|gif|png|jpe?g)['"]\);if\([^;]+\beval\(\92\);\}?\Z(?<X2230130>)|echo\s*['"]<form\b[^;]+;if\(\$_(?:GET|POST|FILES)\)\{if\((?:copy|move_uploaded_file)\((\$_FILES\[['"][^a-z0-9]+['"]\]\[)[^\]]+\],\94[^\]]+\]\)+\{?echo\b[^;]{1,199};\}?(?:else\{echo\b[^;]{1,199};\})?\}\?>(?<X1235920>)|error_reporting(?:[^\{]{1,599}\$config_antibot\[['"]\w+['"]\]\s*=\s*['"]https://(?:activauto\.de|appleunlock\.24\-gute-taten\.de|shahid\-vip\.com)(?<X2256581>)|\(0(?:[\)\s;]+ignore_user_abort[\s;]+sleep[\(\s]+\d+[\)\s;]+\$\w{1,40}[=\(\s]+!empty[\(\s]+\$_SERVER\[[^\]]+\][\)\s]+\?[^\{\}\?]{399,999}\$\w{1,40}[\s='"]+<\?[^='"]{0,199}\$botbotbot\s*=[^\+]+,['"]\?>['"\s\)]+\+\d+[\s\);]+\}[^&]+\bexec[\s\('"]+php\s+\-f[^;]+;\s*unlink[^;]+;[\?>\s]+\Z(?<X2218481>)|\);[^@]{999,9999}(\$\w+)\.=['"][^<;'"]{0,9}<FilesMatch\s*['"]\.\([^\)'"]{0,49}\bsuspected\b[^>]{0,49}>['"];(?:\98\.=['"][\\nr]*(?:Order\s*allow,deny|deny\s*from\s*all)[\\nr]*['"];){2}[^@]{49,999}\bfile_put_contents\((\$\w+),\98\);(?:(?:touch\(\99,[^;]+|\w+\(\)|chmod\(\99,[^;]+);\}*){2,}(?:func[^\}]{0,99}\})?(?:\?>|\Z)(?<X1232912>)))|eval\(['"]\?>['"]\.base64_decode\(['"]PD9waHAgZXZhbCgnPz4nL[^'"]{9999,}['"]\){2}\s*\?>\Z(?<X2265800>))
\A<\?[ph\s]*(?:function(?:\s*(?:(\w{1,40})[\(\s]+(\$\w{1,40})(?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]chr['"\s;]+return\s*\3[\s\(]+\2[\s\);]+\}(?:\s*(\$\w{1,40})[=\s]+\1[\s\(]+\d+[\s\)]+(?:\.\s*\1[\s\(]+\d+[\s\)]*)+;)+\s*(\$\w{1,40})[=\s]+\$\{\1[\s\(]+\d+[^;]+;\s*(\$\w{1,40})[=\s]+\1[^;]+;\s*(?:\2|\4|\5)\b[^;]+\6[;\)\?>\s]*\Z(?<X2237460>)|[\)\s]+\{\s*\2[=\s]+(?:(?:gzinflate|base64_decode)[\(\s]+){2}\2[\)\s;]+for[\(\s]+(\$\w)[=\s]+\d+[\s;]+\8<strlen[^=]+(\2\[\8\])[=\s]+(?:(?:chr|ord)[\(\s]+){2}\9[^=]{0,40}return\s*\2[^\(\)]{0,99}\beval[\(\s]+\1[\(\s]+['"][^'"\$=]{999,}=?=?['"][\)\s;\?>]+\Z(?<X2218650>))|\w{1,40}[\(\s]+(?:\$\w{1,40}[,\s\)]+){2}\{\s*\$\w{1,40}[=\s]+curl_init\s*\(\)[^/\?]{0,999}file_put_contents[\('"\s]+\./[^\\]{0,999}exec[\s\(]+\$\w{1,40}[^/]{0,999}(?:curl|wget)\s+\-o\s*\./[^:]{0,999}://(?:\d{1,3}\.?){4}/(\w+)[^\+]+chmod\s+\+x[^\n]{0,999}unlink[\s\(\./'"]+\11[^=]{0,99}\Z(?<X2218770>)|\w{1,40}[\(\s]+(\$\w{1,40})[,\s]+\$\w{1,40}[\)\s]+\{\s*\13[=\s]+urldecode[\(\s]+\13[\)\s;]+(\$\w{1,40})[^\^]{9,199}\14\[[^\]]+\]\s*\^[^\}]{1,99}\}[^%]{9,999}(?:\$\w{1,40}[\s=]+['"][^'"]{9,}['"][;\s]+){2}(\$\w{1,40})[^\?]{9,199}(?:(?:include_once|unlink)[\s\(]+\15[\s\);]+){2}exit[\s\(\);\?>]+\Z(?<X1220750>))|\s+(?:\w+(\(\$\w+\))\{\$\w+=file_ge(t_contents)\17[^\?]{1,4999}(\$\w+)=['"]<\?[^\?]{1,999}(\$\w+)=[^;]*\19\b[^\?]{1,99}\bfile_pu\18\((\$\w+),\20\)[^\?]{1,199}\bcrontab\s*\-l[&>]+(\w+)[&;]+echo\b[^;]+\21[^;]*>>\22[&;]+crontab\s*\22\b[^@]{999,19999}=writehtaccesstoalldirs\(\);[^\}:]{0,199}\bcase\b[^\?]{1,499}break;\}(?:\?>)?\Z(?<X2227220>)|feedback404\([^\}]{64,256}\}\s*if\s*\(isset\(\$_GET\[['"]\w+['"][\]\)]+\s*\{\s*\$\w+\s*=\s*['"]\w+\.txt['"];(?<X2268653>)))|goto\s*\w{2,6};[^;]{0,99}if[\(\s]+(file_)exists[\(\s]+['""](/tmp/\.\w+)['"][\s\)]+\{\s*goto\s*\w{2,6};\s*\}[^\}\.]{0,99}\b\25pu(t_contents)[\s\(]+['"]\26['"][,\s]+\25ge\27[\s\(]+base64_decode[\s\(]+['"]aHR0[^'"]+['"][\s\)]+;[^\?]{0,499}include(?:_once)?[\s\('"]+\26['";\)\s\?>]+\Z(?<X1203130>)|http_response_code[\(\s]+\d+[\)\s]+;\s*(\$\w{1,40})\s*=\s*(['"])[^\$\n]+?\\?\30\s*;(?:\s*\$\w{1,40}\s*=\s*\29\[\d+\](?:\s*\.\s*\29\[\d+\])+\s*;)+[\?>\s]*\Z(?<X2226550>)|if[^@]{1,99}@(\$_SESSION)\[['"](\w+)['"]\]\)\s*\32\[['"]\33['"]\]\s*=\s*\(!empty\(\$_POST\[[^\(]{1,99}(md5\(){4,}hash\(['"]sha256['"\s,]+(?:\34){3,}\$_POST(?<X2282751>)|if\([^;\?]{1,199}\bfile_put_contents\(['"][^'"]+\.ph(?:p\d*|tml?)['"],[^\)]*\$_[GPCSR]\w{2,6}\[[^\]]+\][^;]{1,49};\}?\s*(?:\?>\s*)?\Z(?<X2200741>)|if\(\$_[GPCSR]\w{2,6}\[[^\]]+\]!=+['"]\w{32,64}['"]\)\{?exit\b[^;]{0,19};\}*function\s*(\w+\()[^@]{19,499}\{(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]+;(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]+;(?:(\$\w+)=(?:\w+\()+(?:\38|\39)\);)?file_put_contents\((?:\40|\38|\39),(?:\40|\38|\39)\);[^\}]{0,199}\b\37[^\)]+[\);\}\?>]+\Z(?<X2228160>)|include(?:_once)?\s*['"]/tmp/sess[^'"]+['"][;\s\?>]*\Z(?<X2226250>))
\A<\?[ph\s]+(?:(define\()[^,]+,['"]\w{32}['"]\);\s*if\(md5\([^\{]+\)[\{\s]+header\([^\}]{9,99}\}\s*\1['"]([^,]+)['"],['"]https?://[^\(]{9,99}\bif\([^\{]+\)[\{\s]+(\$\w{1,20})=\2\.['"]\?file=["'][^;]{1,40}\.txt[^!<]{9,99}\bfile_get_contents\(\3[^#%\*]{200,999}(\$\w{1,20})=(curl_)exec\(([^\)]+)\);\s*\5close\(\6\);return\h*\4;\s*\}(?:\s*\?>)?\Z(?<X2210960>)|(echo)[\h'"]+<[^>]+\bhtml>[\h'"]+;\s*\8\h+eval\(['"]\?>['"][.,]file_get_contents\(['"]https?://bit\.ly/[a-z0-9]{1,40}['"]\)\);\s*(?:\?>|\Z)(?<X1204670>)|(function)\h*(?:file_)?(?:get|put)(?:_contents)?\([^\)]+\)[\{\s]+[^\\//]{9,300}\bfile_[gp][ue]t_contents\([^;]+;[\}\s]+\10\h*(\w{1,20})\([^\{]+\{[^//\\]{9,400}\b[ps](?:assthru|ystem|xec|hell_exec|open)\([^@#]{200,999}(?:\b\11\([""]pkill[^;]+;\s*){2,4}[^@\*]{99,300}\b(?:unlink\([^;]+\);\s*){2,4}(?:\s*\?>)?\Z(?<X2215230>)|(function)\h*(\w+)[\h\(]+[^\{]{1,40}\{\s*\$\w{1,20}=['"][^\$]{20,60}['"];[^,]{9,99}(\$\w{1,20})=Array\(\);[^\(]{0,15}(?:\15\s*\[\]=\14\(Array\([^\;]{1,150}\);\s*){10}[^\?]{99,600}\b\13\h*(\w{1,20})\([^\}]{20,250}[\s\}]+(\$\w{1,20})=[^;]+;\s*\16\(\15,\15\[\d+\]\([^\)]{5,40}\15\[\d+\]\(\17[\)\s]+;\s*\}(?:\s*\?>)?\Z(?<X2249512>)|(function)\h*\w+\(\$\w+\)\s*\{\s*(\$\w+)\s*=\s*rawurldecode\(\$\w+\);\s*(return)\s*\20;[^\^]{1,199}\b\19[^\$]+(\$\w+)[^\w]+eval\(\22\)[^%]+\19[^\$]+(\$\w+)[^\w]+\21\s*array_sum\(\23\);\s*\}\s*\w+\(\);\s*\$\w+\s*=\s*\w+\(\[[\d,\h]{10,32}\]\);\Z(?<X2277761>)|(function)\s*(\w+)\(\)\{(\w+)\(\);\}(\$\w+)=[^;]+\.txt['"];if\(file_exists\(\28\)+\{?include[\s"\(]+\28["\s\)]+;\}?if\(\25_exists\(['"]\27['"]\)+\{(\$\w+)=new\s*\w+\(\);if\(\29\->\w+\(\)+\{add_action\(['"]\w+['"],['"]\26['"]\);\}+\Z(?<X2223521>)|(function)\s*(\w{4,16})\((\$\w+)\)\{\$\w+=\w+\(\33\);\$\w+=\w*\(\33,\$\w+\);return\$\w+;\}\31\s*\w+\((\$\w+)\)\{return\s*array_sum\(\34\);\}\31[^=]{1,64}=hash\(['"]sha256['"],\$\w+,TRUE\);[^\(]{1,99}\31\s*(\w+)\(\$\w+[^\]]+str_pad\([^\\%]+rawurldecode\([^\]]+\$_COOKIE\[[^\\]{1,999}\32\([^\]]{1,999}\35\(\[\d+,\d+,\d+,\d+,\d+,\d+\]\);\Z(?<X2278450>)|(function\s+)\w+\(\$\w+\)\{[^\}\{]{1,199}\{\$\w+\.=[^;]+;\}(return\s*)\$\w+;\}\37(\w+)\(\$\w+,\$\w+\)\{[^\}\{]+\{\38(\$\w+)\^[^;]+;\}[^\{\}]+\{\40\[[^;]+;\}\38\40;\}(\$\w+)=['"][^'"]{9999,}['"];[^\?\(]{0,99}\$(\w+)=\39\(\41,\$\w+\);eval\(\$\42\);(?:\?>)?\Z(?<X2212751>)|(goto)\h*\w{1,20};\h*\w{1,20}:[^,]+(file_)pu(t_contents)\((["']/tmp/[^\.]{0,20}\.(?:txt|config)['"]),\45ge\46\(base64_decode\(['"]aHR0c[^\{]{20,200}\bif\(\45exists\(\47\)\)[\s\{]+[^\?]{1,40}\b\44\h*\w{1,20};\h*\w{1,20}:\s*include\h+\47;\s*(?:\?>|\Z)(?<X2204660>)|(goto)\h*\w{1,9};\w{1,9}:\h*\w{1,9}:\h*\49\h*\w{1,9};[^\{]{9,150}\bif\([^'"]{1,15}['"]\w{32,64}['"]\)\)[\{\s]+[^\\\?]{99,499}\b[mc](?:opy|ove_uploaded_file)\([^\?@\\]{9,150}['"];\s*\49\h*\w{1,9};\h*\w{1,9}:\h*\w{1,9}:\s*(?:\?>\s*)?\Z(?<X2208741>)|(header\()['"]HTTP/[\d\.]+\s+30[21]\b[^;]+;\51['"]Location:\s*https?://[^;]+/wp\-(?:includes|admin)/[^\)]+\);?(?:\?>)?\Z(?<X2220451>)|(if\(isset\()\$_GET\[['"](\w{3})['"\]\)\{\s]+\53(\$_POST)\[['"](\w+)['"\]\)\h&]+trim\(\$_POST\[['"]\56[^;]{1,99}(\$\w+)\h*=\h*trim\(\55\[['"]\56[^_]+\55[^;]{1,32};\s*if\(file_put_contents\(\57,\$\w+[\)\{\s]+echo\h+["']\w+['"];[\s\}]+[^\}]{1,512}\?\54=[^\}]{1,512}</html>['"];\s*(?:exit|die);\s+\}\s*\?>\Z(?<X2279771>)|@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+['"][^'"]{0,499}\b(?:\d+e?xploitercrew|ge14y|backdoor|shell)\b[^'"]{0,499}['"]\);?(?:\?>)?\Z(?<X2222611>)|[^\$]{0,60}(\$\w{1,20})=rand\([^\)]+\);\s*(?:if\(\60\W{1,3}\d+\)[\{\s]*\$\w{1,20}=(?:base64_decode\()+['"][^\)]{400,2500}\)\);\s*){1,4}\$\w{1,20}=fopen\((base64_decode)\([^\?//\\]{999,2500}\bfwrite\(([^,]+),\$\w+\);\s*fclose\(\62\);\s*e(?:val|xec)\(\61[^>]+php>(/dev/null)[\h\d>]+\63&?[^\)]+\);\s*unlink\([^\)]+\);(?:\s*\?>)?\Z(?<X2218830>)|[^\$]{0,99}\$\w{1,20}=['"]unknownsec['"];[^\}]{0,99}\bfunction_exists\(['"][peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)['"]\)\)\s*\{(?<X2217270>)|[^\$]{1,60}\berror_reporting\((?:0|NULL|FALSE)\);[^\$]{0,60}\$auth_pass=['"]\w{32,64}['"];\s*if\(get_magic_quotes_gpc\(\)\)[\{\s]+[^<//\\]{99,200}\bfunction\h+login\(\)[\{\s]+die\([^@\\\*]{999,4500}\btitle=['"][cfhp](?:oded|ucked|acked|wned)\h+by\b(?<X2204050>)|[^\(\{]{0,150}\bfunction\h*(\w+)\([^\)]+\)[\{\s]+[^\^]{1,60}(\$\w+)=urldecode\([^\^]{1,99}\68\^\$\w+;[^\{]{1,99}(\$\w+)=\$\{\67\([^\{]{9,99}\bif\([^\{]+\{\s*(\$\w+)=\69\[[^;]+;[^\[]{1,50}\70\[\67\([^\}]{9,99}\binclude\([^\}]{0,40}\}(?:\$\w+=[^;]+;){0,4}\Z(?<X2251740>)|[^\(]{0,60}(function)\h*(\w{1,40})\(\)[\{\s]+(?:\$\w{1,20}=[^;]{2,40};){1,9}\$\w{1,20}=\$GLOBALS\[(\w+)\([^\{]{1,200}\bif\([^\{]+\{[^\}]{9,99}\$\w{1,20}=\$\w+\[\74\([^\{]{9,150}\b\72\h*\74\([^\}]{99,300}\breturn\h*\$\w+;[^\}]{0,40}\}[^\(]{0,40}\73\(\);(?:\$\w{1,20}=[^;]+;){0,3}\Z(?<X2251672>)|[^\(]{0,60}function\s*(\w{1,40})\([^\{]{0,40}\)[\{\s]+\$\w{1,20}=urldecode\([^\^]{9,150}\^[^\{]{9,150}(\$\w{1,40})=\$\{\76\([^\{]{1,60}\bif\(isset\([^<]{9,99}(\$\w{1,20})=\77[^\(]{9,99}(\$\w{1,20})=\78\[\76\([^;]+;include\(\79\);[^\}]{0,40}\}\Z(?<X2251710>)|[^\.=]{0,60}(\$\w{1,20})=[\('"]+[^;]{1,999}[\)'"]+;\s*(\$\w{1,20})=(?:\81\([^\)]+\)\.?){5}[^;=]+;\s*(\$\w{1,20})=(?:\81\([^\)]+\)\.){5}[^;=]+;[^/\?]{99,600}(\$\w{1,20})=\82\(\83\(['"][^'"]{5000,}['"]\)\);\s*(\$\w{1,20})=\$\w+\(['"]{2},\84\);\85\(\);\s*(?:\?>)?\Z(?<X2220676>)|[^\d]{0,40}(\$\w{1,20})=['"][a-z\d]{5,20}['"];[^\(]{0,60}\bfunction\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}=urldecode\([^\{]{20,200}(\$\w{1,20})=\$\{\88\([^\(]{0,40}\bif\(!?isset\((\89\[\87\])[^\[]{1,99}(\$\w{1,20})=\90;\s*\$\w{1,20}=['"]\w{1,20}['"];\s*(\$\w{1,20})=\91\[\88\([^\(]+;\s*[ir](?:nclude|equire)\(\92\);[^\}]{0,90}\}\s*\Z(?<X2239852>)|[^\{]{0,30}\bfunction\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}=['"][a-z0-9]{5,64}['"];\s*(\$\w{1,20})=['"]base64_decode['"];\s*(\$\w{1,20})=\95\([^\}]{9,99}\}\s*return\h*\96;[\}\s]+(\$\w{1,20})=\94\(file_get_contents\(['"]php://input['"]\)\);\s*eval\(\97\);\s*(?:\?>|\Z)(?<X2232890>)|\$(?:bot){2,}\d*=(?:['"][^'"]+['"];\s*(?:\$\{['"]GLOBALS['"]\}\[[^\]]+\]=['"][^'"]+['"];\s*){5,}\berror_reporting\((?:0|NULL|FALSE)\);[^@>]{1,}[,=](?:CURLOPT_URL,|fsockopen\()[^\?]+/\?useragent=[^\?]{1,999}\becho\s*fgets\([^;]{1,99};\W{0,9}fclose\([^;]{1,99};[\s\}]+(?:\?>|\Z)(?<X1201950>)|[^\?]+(?:(\$\w+)=(?:\w{1,9}\()?\d+\)?;){3,}(\$\w+)=[^;]{1,99};(\$\w+)=['"]https?://[^/'"]+\100/\101\b[^@>]{1,499}[,=](?:CURLOPT_URL,|fsockopen\()\102\b[^\?]+/\?useragent=[^\?]{1,499}\becho\s*fgets\([^;]{1,99};\W{0,9}fclose\([^;]{1,99};\W{1,9}(?:\?>|\Z)(?<X1193200>))|\$\w+(=\$_SERVER\[)[^;]{1,99};\$\w+=(function)\([^\)]+\)\{(\$\w+)=['"]{2};[^\{]{0,99}\bif\(\105_exists\(['"](?:curl|file)[^\->]{99,900}\}return\h*\106;\};(?:(?:\$\w+\104[^;]{1,99};\s*)?if\(strpos\([^\{]+\)\{[^\?]{0,200}(\$\w+)=['"]aHR0[^;]+;\107=base64_decode\(\107\);[^\}]{9,400}\b(?:exit|die)[^;]{0,9};\}+){1,4}\?>(?<X1232241>)|\$\w+[\h=]+['"][^=\$]{1,99};\s*(\$\w+)[\h=]+array\([^\?]{1,4999}=\h*\109\[\d+\]\((?:\$_[GPCSR]\w{2,6}[,\)\h]+)+;[^\?]{1,999}\b[ir](?:nclud|equir)e(?:_once)?\s*\(([^\)]+)\);\s*@?unlink\(\110\);\s*\}\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1201600>)|\$\w{1,20}=['"](\w{1,20})['"];\s*\$\w{1,20}=['"]https?://\112\.[^'"]{1,20}\.(?:pl|jp|in|cn|ru|su|xyz|pw|ga|ml|top)/?['"];\s*function\h+(?:curl|file)_get_contents\([^\\@#%]{1500,5000}\becho\h*\$\w{1,20};\s*(?:exit|die)[^;]{0,9};[\}\s]+else[\{\s]+header\(['"]HTTP/\d\.\d\h*(?:40[43]|500)[^\)]+\);[\}\s]+\s*(?:\?>|\Z)(?<X1205800>)|\$\w{1,20}=\[['"]https?://[^'"]{9,99}/[^'"/]{0,40}(?:\.txt|raw)['"],['"]/tmp/sess\w{1,15}['"]\.md5\([^;]{1,40}\.php\d?['"]\];\s*if\(!?file_exists\([^\?]{200,600}\b(curl_)exec\((\$\w{1,20})\);\s*\114close\(\115\);[\s\}]+(?:\?>)?\Z(?<X2203651>)|\$\w{1,20}=base64_decode\(['"]aHR[^\)]+\);[^\(]{0,20}\b(?:else)?if\(function_exists\(["'](?:curl_version|file_get_contents)['"]\)+[^\{]{0,40}\{[^!<\?]{99,300}\bif\([^\)]+\)[\{\s]+eval\(preg_replace\(['"]/\^?<\\\?php\(\.\*\)[^;]{9,99},\$\w{1,20}\)+;[\}\s]+(?:\?>)?\Z(?<X2204170>))
\A<\?[ph\s]+(?:\$\w{1,40}=(?:['"]?\w[^\.]{1,15}['"]?\.){3}[^;]+;\$\w{1,40}=\d+;[^\{]{9,150}(?:\$\w{1,40}=Array\([^;]+\);(?:\$\w{1,20}=\d+;)?){2}[^\?\}]{99,900}\bif\([^\{]+\{[^\(]{1,70}(\$\w{1,40})=[\w\$]\w+\([^\)]+\);(?:\$\w+=\d+;)?eval\(\1\);(?:\$\w+=\d+;)?(?:exit|die)[^;]{0,9};[\}\s\?>]+\Z(?<X2250400>)|\$\w{1,40}=['"]https?://[^;]{1,199};function\h+(\w{1,40})\([^\?]{9,499}=\3\(\);\?>[^@]{1,499}<input\b(?:[^/]{0,99}\b(?:name|value)=['"]<\?[ph=\s]+(?:echo\s*)?(?:(?:md5|sha1)\(){1,5}\$\w{1,40}\)+;\?>['"]){2}(?<X2190892>)|\bclass\s*(\w+)\{[^\{\}]{0,199}\b(function)\s*__construct\([^\{]+\{[^\}]+\$this\->(\w+\(\));\}[^\{\}]{0,199}\b\6\s*\7\{(\$\w+)=\$GLOBALS\[[^;]+;(\$\w+)=count\(\8\);if\(\9\b[^;\{]+\bin_array\(gettype\(\8\)[^\?]{1,499}\breturn\s*\$\w+\(\);\}+;?\$\w+=new\s*\5;\s*(?:\?>\s*)?\Z(?<X2223530>)|class(?:\h*(\w{1,20})[\{\s]+var(?:\$\w{1,40}[\s=]+['"][^"'\n]{999,}['"];var\$\w{1,40}[\s=]+array[\s\(]+(?:\d+,){9,}\d+[\s\)]+;[^\?\n]{999,}\$\w{1,40}[=\s]+(isset)[\(\s]+\$_[GPRSC]\w{2,6}\[[^;\?]+\?[^&\n]{9,}\12[\(\s]+\$_SERVER\[[^\*]+new\s+\11\s*\(\);[^\n]+eval[\s\(]+\$\w{1,40}\->\w+[\s;\}\)\?>]+\Z(?<X2218911>)|\h*\$cd_str;\s*(function)\h*\w{1,20}\(\)[\{\s]+\$this\->\w{1,30}\(\d+\);[\}\s]+\14\h*\w{1,20}\([^\)]+\)[\{\s]+[^\?#]{999,5000}(\$\w{1,20})=['"][^\n]{4999,}['"];(\$\w{1,20})=rawurldecode\(\15\);(\$\w{1,20})=new\h*\11\(\d+\);\s*eval\(\17\->\w{1,20}\(\16\)\);(?:\s*\?>)?\Z(?<X2218980>))|\s*(\w+)[\s\{]+private\s*static\s*(\$\w{1,40});[^\d]{1,499}\20=array\([^\)]+\);[\s\}]+(\$\w{1,40})=\$_[GPRSC]\w{2,6};\(\21&&isset\(\21\[[^\]]+\b\19::(\w+\()[^#><!%@\*\}\{]{1,1999}\b\19::\22[\d\]\)\s]+&&eval\(\$\w{1,40}\)+\s*:\s*\21;\s*(?:\?>\s*)?\Z(?<X2222934>)|\s+(\w+)\{[^\}]+(function)\s*__construct\(\)\{(\$[^=;]+)=['"][^;]+;(\$[^;=]+)=(\w+)\(\26\);eval\([^\)]*\27\b[^;]+;\}+new\s*\24\(\);\25\s*\28\((?<X2209801>)|\s+(MimeTypeDefinitionService)\{(public\s*function\s*)addData(\(\$\w+),[^\)]+\)\{if\(!is_scalar\32\)[^\}]+\}\31(\w+)[\s\(\)]+\{(\$\w+)=\$_SERVER\[[^;]+;\$\w+=\$this\->(\w+)\(\34\);[^@#]{999,4999}\31\35\(\34\)\{[^\?]{1,399}\}\}(\$\w+)=new\s+\30\(\);\36\->\33\(\);\s*(?:\?>\s*)?\Z(?<X2202760>))|echo(?:[^\;]+;error_\w+\([^\)]+\);(\$\w{1,40})=isset\((\$_[GPRSC]\w{2,6})[^\;]+;\$\w{1,40}=\38\.\39[^\;]+mt_rand\(\d+,\d+\)[^\;]+;\$\w{1,40}[^\;]+;[^\?]+(?:\$\w{1,40}=getCurl\((?:['"]http://ly7\.zqhdya\.\w+[^\;]+;|\$\w{1,40}\);))+(?:(\$\w{1,40})=str_replace\([^\)]+\);)+echo\40;echo[^\;]+</html>['"];\Z(?<X2220771>)|\h*['"]<html>\s*<head>\s*<title>\s*Wordpress\h*Mass\h*User\b[^\|\+]{99,999}[ie](?:rror_reporting\(|ni_set\(['"]error_log['"],)(?:0|NULL|FALSE)\);(?<X1213060>)|\h*eval\(['"]\?>['"]\.file_get_contents\(['"]https?://bit\.ly/\w{3,8}['"]\)\);\s*(?:\?>)?\Z(?<X2202150>)|\s*['"]<title>[^</;]{0,49}\bUploader\b[^;]{1,299}\.php_uname\(\)[^\?:,]{1,499}\b[cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,;\)]+,\44(?<X2222330>))|error_reporting\((?:(?:0|NULLFALSE)\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\{]{1,50}\{\s*(?:\$\w{1,20}=ABSPATH\.['"]wp\-[^'"]{2,40}\.php['"];\s*){3,9}echo\h*['"][^'"]{1,20}E?Xploit[^'"]{1,20}['"];[^\.]{2,40}\.php_uname\(\)\.(?<X2202580>)|(?:0|NULL|FALSE)\);[^'"]{0,40}\bdefine\([^,]+,['"][^'"]{1,10}\b(?:cyb|hack)er\h*team['"]\);[^@%`]{999,3500}<title>\h*40[43]\h*(?:Not\h*Found|Forbidden|UnAuthorized)\b(?<X2203480>)|(?:0|NULL|FALSE)\);[^://]{1,60}\bunlink\(__FILE__\);[^://]{9,99}\bexplode\([^:]+,['"]https?://[^\\@#]{99,1200}\bdefine\([^,]+,(\w{1,4}Wordpress)\(\)\);\bfunction\h+\48\(\)\s*\{[^@#\*\\]{300,1500}\bbase64_encode\(['"]<filesMatch\b(?<X2213530>)|(?:0|NULL|FALSE)\);[^\$\?]{99,300}\bdocument\.write\([^'"]{0,20}['"]anonymousfox\.\w{2,6}['"]\)(?<X2202130>)|(?:0|NULL|FALSE)\);\s*(?:(?:\$(?:MEMEK|JEMBUT|LONTE)_CY(?:BER|NA)=['"][^'"]+['"];\s*){4}(?<X2203880>)|\$(?:bot){3,}=\d+;\$\w{1,20}=(base64_decode)\([^\?#\*]{600,2500}\b\52\([^;]{1,60};(?:\$\w{1,20}=\$\w{1,20}\.[^;]{1,60};|fwrite\([^\}]{9,99}\}\s*fclose\([^;]{1,20}\);\}+)\s*\?>(?<X1203250>)|if\([^\)]+\)[\{\s]+[^\?\.\\]{200,600}\bfile_[pg][ue]t_contents\([^;]+\);\s*chmod\([^\)]+\);\s*(\$\w{1,20})=['"][^>]{1,20}(>/dev/null)\h*\d+\55&['"];\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\54\);[^\}]{0,20}[\}\s]+(?:\?>|\Z)(?<X2204650>))|(?:0|NULL|False)\);function\s+(\w+\(\))\{(\$\w+)=['"][^;]+;(\$\w+)=(?:\58\[\d+\]\.){4}[^;]+;return\s*\59;\}eval\(\57\.['"][^;]{999}(?<X2207451>)|0\);(\$\w+)=[^;]{999,};[^@#:%&]{9999,}\$(\w+)\.=[^;=\)]{0,49}\61=[^;=\)]{0,49}\61\b[^@:%&]{999,4999}\b(file_put_contents\()(\$\w+),\$\62\b[^@#>]{1,999}\b\63\64,["']([^'"]+)['"]\);unlink\(\64\);\}+(?:(?:echo|die|exit)\b[^;]{0,19}['"]\65['"][^;]{0,19};)?(?:\?>)?\Z(?<X2224361>)|0\);[^\?\}]{1,4999}\b(file_)pu(t_contents\()[^,;]+\.htaccess['"],[^\?>]{999,};(\$\w+)=\67ge\68(\$\w+)\);(\$\w+)=fopen\((\$\w+)\b[^,]+,[^;]+;fwrite\(\71,\69\);[^/\?]{1,49}\b[pes](?:assthru|ystem|xec|hell_exec)\(['"][^\)]+\72\b[^;]+;unlink\(['"]?\70['"]?\);(?:\?>)?\Z(?<X2222372>)|0\);[^\?]{0,199}\becho\s*['"]<form\b[^\?]{1,499}\bmove_uploaded_file\(.{1,99}\Z(?<X2213931>)|0\);\$\w+=disk_free_space\(\);if\(!(function)_exists\(['"](\w+)['"]\)+\{\75\s*\76\([^@#>]{1,4999}\bsetcookie\(['"](whatsup)['"],['"]\77man['"],[^;]+;\w+[\s:]+define\(['"]DISALLOW_FILE_MODS['"],[^\)]+\);(?:\?>)?\Z(?<X2220540>)|0\);\s*(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2,}function\h+(\w)\([^\)]+\)[\{\s]+(\$\w{1,20})=['"][^\}\{]{9,60}\80\.=[^;]{1,20};\s*return\h*\80;[\}\s;]+(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2}eval\(\79\(base64_decode\([^\)]{9999,}\),["'][a-z,]+['"]\)\);(?:\$\w{1,20}=['"][a-z]{1,9}['"];\s*){2,}(?:\?>|\Z)(?<X2203791>)|0\);function\s*(\w+\()\$\w+\)\{\$\w+=curl_init\([^@\^]{999,}\$(\w+)=[^;\)]{0,99}\b\82[^@\^]{999,}(file_put_contents\()[^,;]+,\$\83\)[^@\^]{999,}\$(\w+)\.?=['"][^'"<]*<FilesMatch\s*['"]\^\(['"\.]+\$\w+['"\.]+\)\$[^\?]+\b\84(\$\w+),\$\85\);(?:(?:touch|chmod)\(\86,[^;]+;){0,2}\}+\?>\Z(?<X2224340>)|0\)[^\\]{1,999};define\(['"]IS_WIN['"],[^\?]{1,499}=['"][^<>'";]{0,9}<(FilesMatch)\s+\\['"]\^\([^\)]+\)\$\\['"]\s*>(?:\\n|\s){0,9}Order\s+allow,\s*deny(?:\\n|\s){0,9}Allow\s+from\s+(?:all|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?:\\n|\s){0,9}</\88>[^@]{1,4999}\bunlink\(\$\w+\);(?:exit\b[^;]+;\}+){2};?\Z(?<X2216502>)|0\)[^\{\?]{0,499}\bif\(isset\(\$_[GPCSR]\w{2,6}\[[^\{;]+\{(\$\w+)=[^;]{0,199}\$_[GPCSR]\w{2,6}\[[^;]+;for\([^\}]{0,199}\bfile_put_contents\(['"]([^'"]+)['"],[^;]{0,199}\90\);(?:includ|requir)e(?:_once)?[\s\(]*['"]\91['"][\s\)]*;unlink\(['"]\91['"]\);exit;\}+(?:\$\w+\(\);)?(?:\?>)?\Z(?<X2223970>)|[^\-]{9,150}\bheader\(["']content\-type:[^\)]+\);\s*\$\w{1,20}=['"][a-z0-9]{32,64}['"];\s*class\h*\w{1,20}[\{\s]+[^\{]{1,20}\{\s*(\$\w+)=array\([^;]{1,40};\s*eval\(\93[^\{]{9,40}\bfunction\h*(\w+\(\))[\{\s]+\$\w{1,20}=['"][a-z0-9]{9999,}['"];[^\?]{9,150}\94;\s*(?:\?>|\Z)(?<X2233962>)|[^\[]{0,90}(\$\w{1,20})=['"]{2};\s*if\(isset\([^!@]{300,2500}\bfunction\h*\bcutterimg\([^\{]{9,99}\{\s*\96=['"][^'"]{999,}["'];\s*if\((\$\w+)=[^\{]{2,20}\{(\$\w+)=["']\};['"]\.gzinflate\(base64_decode\([^;]{400,2000};\s*create_function\(['"]{2},\98\);\s*\}[^\?>]{99,200}\bjson_encode\(array\([^\)]+\97\)\);[\}\s]+(?:\?>|\Z)(?<X2227351>)))
\A<\?(?:[ph\s]+(?:function(?:\h*(?:(\w+)\([^\{]{1,9}\{\$\w+=['"][^"]{25,60}['"];[^#@]{9,150}(?:\$\w+\s*\[\]=\1\(Array\([^;]{4,150}\);\s*){5}[^#@%\*&]{200,999}\}function\h*(\w{1,20})\([^\!#@]{9,999}\2\([^\(]{1,20}\([^;\)]{1,40}\[\d+\]\([^\)]+[\)\s]++;\s*\}(?:\s*\?>)?\Z(?<X2250680>)|(\w{1,20})\([^\)]+\)[\{\s]+(\$\w{1,20})=md5\([^:<]{1,60}(\$\w{1,20})=urldecode\(\6\);[^\/\\:]{200,800}\}\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(preg_match\(['"][^\.]{1,9}(?:Apple|blackberry|samsung|Android|google|ios)\([^,]+,\7[^\{]{2,9}[\{\s]+(?:\5=[^;]+;\s*){3,9}eval\(\4\(\6,\5\)\);[\}\s]+else[\{\s]+[^\}]{1,50}\}(?:\s*\?>)?\Z(?<X2208140>)|(\w{1,20}\(\))[\{\s]+(\$\w{1,20})=\$_[GPRSC]\w{2,6};\s*\(\10[^\?]{1,20}\?\(\((\$\w{1,20})=(?:\10\[\d+\]\.?)+\)&&\([^\}]{1,99}\((\$\w{1,20})=\12\(\11\(\10\[\d+\]\)\)\)&&eval\(\12\)\)[\h:]+\10;\s*return[^;]+;[\}\s]+\9;(?:\s*\?>)?\Z(?<X2218850>))|\s*(?:(\w+\()\$\w+\)\{(\$\w+)=curl_init\(\)[^\}]{1,499}(\$\w+)=curl_exec\(\15\);(?:curl_close\(\15\);)?return\s*\16;?\}(?:(\$\w+)=['"]\?>['"];)?eval\(['"]?(?:\?>|\17)['"]?\.\14['"]https?://[^\)]+\)+;?\s*(?:\?>\s*)?\z(?<X2223640>)|(\w{1,40})\((\$\w{1,40})[,\)][^\{]{1,199}\{(\$\w{1,40})=curl_init\(\20\);[^\}]{1,499}(\$\w{1,40})=curl_exec\(\21\);[^\}]{0,99}\breturn\s*\22;\}[^\?]{0,99}(\$\w{1,40})=\19\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};echo\s*\23;\s*(?:\?>\s*)?\Z(?<X2191770>))|\s+(?:(\w+)\(\$\w+,\$\w+\)\{[^\?]{1,499}\}return\s*\$\w+;\}(\$\w+)=['"][^'"]{19999,}['"];(\$\w+)=['"]\w+['"];(\$\w+)=\25\(base64_decode\(\26\),\27\);eval\(\28\);(?<X2204311>)|\w+(\(\$\w+\))\{(\$\w+)=base64_decode\30;(\$\w+)=openssl_decrypt\(['"]?\31['"]?,['"]AES\-[^;]+;return\s*\32;\}(?:\?>)?\Z(?<X2221341>)|wp[_\-](clearline+)_start\(\)\{(?:[^\?]{1,999}\binclude(\([^\)]+/wp\-\34/)[^'"]+\.p(?:hp|ot)['"]\);(?:(?:die|exit)\b[^;]{0,19}|unlink\35[^'"]+\.p(?:hp|ot)['"]);){3}[^@]{1,1999}</script>\s*(?:<\?[ph\s]+|['"];)\}(?:add_action\(['"][^'"]+['"],['"](?:wp|save)[_\-]\34_\w+['"]\);){3}(?:\?>)?\Z(?<X2220880>)))|if\(!defined\(['"](DOLLY_WAY)['"]\)+\{define\(['"]\37['"],['"][^'"]{0,19}\bDomination\b[^@]+\bif\((?:md5\()+\$_SERVER\[['"][^\{;]+\{if\(hello_check_sig\([^\)]+\)+\{echo\s*\$\w+;\}+(?:die|exit)\b[^;]{0,19};\}+\Z(?<X2218820>)|if\((?:\w+\()+\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+==+['"][^'"]+['"]\)\{[^\}]{0,499}\b[cm]o(?:py|ve_uploaded_file)\((\$_FILES\[)[^,]+,\39[^;]+;\W*echo\s*['"]\s*<form\b[^;]+;(?:die|exit)\b[^;]{0,19};\}else\{header\(['"]HTTP/[\d\.]+\s*40[34]\b[^\}]{1,499}\b(?:die|exit)\b[^;]{0,19};\}\s*(?:\?>\s*)?\Z(?<X2211130>)|if\([^\{;]+\{add_action\([^,]+,['"](\w+)['"]\);\}function\h+\41\([^\}]{1,499}\$(\w+)=['"][^'"]+\.php\d*['"];(\$\w+)=(?:\w+\()+['"][^'"]{999,}['"]\)+;\$\w+=[^;]{0,99}\bwp\-(?:admin|includes)\b[^;]{0,99};[^\}]{1,199}\bfile_put_contents\([^,]+\$\42,\43\);[^\?:%]{1,499}\bdie\([^;]+\$\42\W+\Z(?<X2194980>)|ini_set\(['"]display_errors['"],0\);error_reporting\(0\);(\$\w+)=['"]chr['"];(\$\w+)=(?:(?:\45\(\d+[\-\+\*/]\d+\)\.)+\45\(\d+[\-\+\*/]\d+\);(\$\w+)=)+\46\([^;]{9999,};(\$\w+)=\$\w+\(['"]{2},\47\);\48\(\);\Z(?<X2212732>)|new\h*(Pwn)\(['"]find[^\)]+\);[^_]{0,40}\bclass\h*\50[\s\{]+const\h*Logging=(?<X2213680>)|parse_str\(['"](?:[\d=%a-f&]{99,200}['"],(\$\w{1,20})\);\s*eval\((?:\52\h*\[\h*\d+\h*\]\(){3,}['"]=[^\)\.\$\s]{15000,}['"]\)\)\.['"]//['"]\)\);\s*(?:\?>\s*)?\Z(?<X2201520>)|[^'"]+['"],(\$\w+)\);eval\((?:\54\[\d+\]\(){2,}['"][^'"]{999,}['"]\)+(?:\.['"]\W{1,9}['"]\)+)?;(?:\?>)?\Z(?<X2194951>))|system\(['"]pwd['"]\)(?:\?>)?\Z(?<X2057921>)|unlink\(__FILE__\);[^'"]{0,40}\bif\h*\(!?function_exists\(['"]file_put_contents['"]\)[\s\)\{]+[^#%]{99,900}(?:\$\w{1,20}[\h=]+['"]/\*\h*@?locale\-joomla\h*\*/["'];\s*|\$\w{1,20}[\h=]+['"]/\*\s*@?class\h*Joomla\h*Locale\h*\*/['"];\s*){1,2}\$\w{1,20}[\h=]+base64_decode\((?<X2203641>))|\s*\$ip\s*=\s*getenv\("REMOTE_ADDR"\);\s*\$message\s*\.=\s*"---------.{100,3000}mail\((?<X2049191>))
\A<\?php(?:(?:\s*[ero_ptings]{7,15}\([^;]{2,29};){2}\s*(eval\()(base64_decode\()['"][^'"]{999,1999}['"]\)\);\s*(\$\w)=str_split\((['"])[^\)]{35000,}\4\);\s*(\$\w{1,40})\s*=['"]{2};\s*foreach\(\3\s+as\b[^\?]{49,149}\1gzinflate\(\2\5\){3};\s*(?:\?>|\Z)(?<X1130630>)|[^/\?]{2,40}<h\d*>\h*IDBTE[A4]M\b(?<X2167710>)|[^\$<]{9,60}\$(?:s|webshell)name=["']<[^;]{1,40}>milw[0o]rm['"];(?<X2199610>)|[^\$\?]{1,99}\b(?:[ir][ne][cq][lu][ui][dr]e(?:_once)\(?['"][^'";]+(?:blocker|anti(?:bot)?)[sz]?\d?\.php['"]\);){2}[^@]{999,3999}(?:\$(msg|message)\.=['"][#!]\h*(?:(?:CC|card)\h*(?:no|number)?|Expir(?:y|ed?)(?:\h*date)?|cvv)\h*:[^;]{0,99}\$_POST\[[^;]{1,99};){3}[^@]{99,4999}\bmail\([^\)]+\$\9(?<X2141030>)|[^\$]{1,49}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^\{]{99,199}(\$\w{1,40})=['"]\w{32}['"];if\(isset\((\$_FILES\[)[^\{]{9,49}\{@?(?:copy|move_uploaded_file)\(\13[^\}]{9,99}\}if\((?:md5\(){1,2}\$_[GPCSR]\w{2,6}[^\)]+\)+\D{2,3}\12[^\}]{99,199}\}else\{[^;]+;\}echo\s*['"]<form\s+action=\11[^;]+;(?:\?>)?\Z(?<X2138000>)|[^\$]{1,49}if\(\$_[GPCSR]\w{2,6}\[[^\)]+\)\{echo\s*['"][^;]{99,499};if\(!empty\((\$_FILES\[['"]\w+['"]\])\)\)\{(\$\w{1,40})=[^;]+;\16=\16\.basename\(\15[^;]+;if\(move_uploaded_file\(\15[^,\)]+,\16\)\)\{echo[^;]{9,99};\}else\{echo[^;]{9,99};\}+(?:\?>)?\Z(?<X2134791>)|[^\$]{1,99}(\$\w{1,40})=['"]{2};(if\(isset\()(\$_[GPCSR]\w{2,6}\[)[^\{]{1,49}\{\18=\20[^;]+;\}\19\20[^\{]{1,49}\{\18=file_get_contents\(\20[^\}]{9,299}\}+if\(strlen\(\18[^\)]*\)\)\{(?:assert|eval)\(\18\);((?:exit|die)[^;]{0,9};)\}(?:header\([^;]{1,49};){2,3}echo[^;]{1,499};\21(?:\?>)?\Z(?<X1134850>)|[^\$]{9,99}if\(empty\(\$_[GPCSR]\w{2,6}\)\)\{echo[^;]+;(?:exit|die)[^;]{0,9};\}else\{(\$\w{1,40})=['"][^'"]+['"];(\$\w{1,40})=strtoupper\((?:\23\[\d+\]\.){4}[^;]+;(\$\w{1,40})=(\$\{\24\}\[)[^\]]+\]\(['"]+,\26[^\]]+\]\(\26[^;]{9,49};\25\(\);\}(?:\?>)?\Z(?<X2134820>)|[^\(\)]{9,99}\berror_reporting\((?:0|NULL|FALSE)\);[^@&\*]{99,300}<option>(?:cpanel\h*reset|b374k|wp\-backdoor|c99|r57)\b(?<X2185090>)|[^\{\?]{1,99}(?:\$\{["']GLOBALS['"]\}\[['"]\w{1,40}['"]\]=[^;]{1,49};){9,}[^/]{1,99}<(title>)WHM\s*Remote\s*(?:shell|access)</\29(?<X2141291>)|\b[^\$/]{1,199};(\$\wname)=[^;]{1,40};(?:\$\w{1,40}=['"](?:getcwd|file_get_contents|scandir|unlink|rmdir)['"];){5}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPSCR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\32\[\33\]=stripslashes\(\34\);\}\}echo\s*['"][^;]{1,199}<(title>)\W+\31\W+</\35(?<X2168910>)|\h*eval\(['"]\?>['"]\.file_get_contents\(['"]/\w+/\w+\/tmp/\w+['"]\){2};\?>\Z(?<X1268281>)|\h*if\(!(class)_exists\(['"]([a-f\d]{32,64})['"]\)\)\{\38\h*\39\{\h*private\h*static\h*\$[a-f\d]{32,64}=null;[^_]{999,1999}\bfunction\h*__construct\(\)\{\$this\->[a-f\d]{32,64}=new\h*std\38\([^/\?\v]{1,19999}=['"]upl?\w{1,16}['"];(?<X2179651>)|\h+(x_iso)\h*\(\)\h*;\h*function\h+\41\h*\(\)\h*\{\h*if\h*\(\h*(isset)\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\h*unlink\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\);\h*(?:exit|die)[^;]{0,9};\h*\}\s*if\h*\(\h*\42\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\h*\$\w{1,40}=\$_[GPRSC]\w{2,6}\[[^\]]+\];(?<X2144630>)|\h+/\*Leafmail\d+\*/goto\h+(\w+)[^%]{999,}\44[^>]{99,}goto\h+\w+;\h+\w+:\h+\w+:\h+\?>(?<X1277250>)|\h+eval\(pack\(['"]H\*['"],['"](?:0a23[a-f0-9]{3999,4300}['"]\)\);\s*(?:\?>|\Z)(?<X1143460>)|2024[67][a-f0-9]{999,9999}['"]\)\);\s*(?:\?>|\Z)(?<X1143374>))|\h+goto\h+\w{2,9};\h*\w{2,9}\h*:\h*if\h*\(\h*!isset\h*\((\$\w{2,9})[\)\h]+\{\h*goto\h+\w[^:]{1,99}:\h*\48\h*=\h*str_rot13[^,]{1,40},\h*strrev\h*\(\48[^\?]{9,499}create_function\h*\(\w{2,9}\([^,]{1,9},\h*\48[^\.]{9,499}\48\h*=\h*\w{2,9}\(\w{2,9}\([^\.]{1,9}\.[^;]+;[^\?]{1,99};(?:\h*\w+:){1,2}\s*\?>(?<X1141690>)|\s*((\$\{['"]GLOBALS['"]\}\[)['"][^'"]{1,40}['"]\])=[^\*]{99,999}=str_rot13\(pack\(['"]\w\*['"],strrev(\(\$\{\50\}\))\){2};if\(isset\(\$\{\51['"]\w+['"]\]\}\){2}\{@?eval\52;\}{2}\s*(?:\Z|\?>)(?<X1130911>)|\s*(?:(?:error_reporting|set_time_limit)\(\d+\);){2}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\54\[\55\]=stripslashes\(\56\);\}\}[^@\*]{999,3999};if\(fwrite\(\$\w+,\54\[[^\]]+\](?<X2130780>)|\s*(?:(\$\w{1,40})=['"][^'"]{0,99}['"];){1,3}\$\w{1,40}=(?:\58[\[\{]\d+[\]\}]\.){5}[^#%&\*!@:/\v]{999,9999}\bheader\(['"]Content\-type:\h*text/html\b[^%\?#&@\*\v]{499,1999},CURLOPT_USERAGENT,\\['"]WHR\\['"][^%@\*\v]{999,9999}\$\{['"]GLOBALS['"]\}\[[^\]]+\]\(\);\s*(?:\?>|\Z)(?<X1181790>)|\s*(?:(\$\w{1,40})=substr\(['"]\w{9,49}['"][^;]{4,9};){3}(\$\w{1,40})=[^;]{1,99}\60[^;]{0,99};(?:(\$\w{1,40})=(?:\61\[\d+\][\.;]){1,5}){1,9}(\$\w{1,40})=[^;]{1,99}\62[^;]{0,99};\63\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\s*(?:\?>)?\Z(?<X2136020>)|\s*(?:(\$GLOBALS\[["'](packer)['"]\]\[)[^\]]+\]=[^;]{1,49};){4}[^\?]{1,499}\$\w{1,40}\.=\66_read_file\(\65(?<X2141280>)|\s*(?:/[/\*][^/\v]{1,199}\s*)?(\$\w{1,40})\s*=\s*(?:strrev\()?['"\.base64_dcogztunmprs13v]{9,52}\)?;\s*eval\(\68\(gz[di][en]flate\(\68\(['"][^'"]{9999,19999}['"][\)\s]{4,9};\s*(?:\?>|\Z)(?<X1132290>)|\s*(?:\$[O0_]{1,40}\s*=[^;]{1,300};+\s*){3,5}.{50000,};exit\(\);\}'\);\$\{"[^"]+"\}\["[^"]+"\]\(\);\$[O0_]{1,40}="[^"]+";\?>(?<X1041510>)|\s*(?:\$\w{1,12}=[^\(\s;'"]{2,12}\([^\)]{4,60}\);){9,}(\$\w{1,12})=\$\w{1,12}\(['"]['"],\$\w{1,12}\(\$\w{1,12}\)+;[^\?\n!><]{1,999}\71\(\);[^\?\n!><]{1,499}\?>\s*\Z(?<X2132742>)|\s*(?:\$\w{1,18}=['"].{1,18}['"];){17}[^\?#>]{99,999}(?:\$\w{3,18}=(?:\$\w{3,18}[\['"]*\d*[\]'"\.]*){1,18};){2,4}\$\w{3,18}=(?:\$\w{3,18}\((?:\$\w{3,18}(?:\[['"]?\d*['"]?\])?[,\.]){9}[^;\s\)\(\*\{\}=/:!%&]+\);)+\Z(?<X20644618>)|\s*(?:\$\w{1,19}\s*=\s*[^'";]{1,40}(?:[\^\|]['"][^\v\$]{1,19}['"])?;\s*)?\$\w{1,40}\s*=\s*['"][^\v]{1,40}['"][\^\|]['"][^\v]{1,40}['"];[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}\s*(?:\)\)\h*[^\w\s]{2,3}\h*\$\w{1,19}\h*)?\.\s*\$\w{1,19}\s*[\)\.](?:[^\{\[\?]{60,199})\);\s*\Z(?<X1142201>)|\s*(?:\$\w{1,30}=['"][a-z0-9]{0,19}['"];){3}[^@]{99,299}\}@?(\$_[GPSCR]\w{2,6}\[[^\]]+\])=\75;(?:if\(!(function)_exists\(['"](getReal)\w+['"]\)\)\{\76\s*\77\w+\([^\|]{9,999}\}{2}\$\w+=\77\w+\(\);){3}[^/]{1,199}(?:(curl_)setopt\([^\)]+\);){4,6}(\$\w{1,40})=\78exec(\([^\)]+\);)\78close\80echo\79;(?<X2129290>)|\s*(?:\$\w{1,40}=['"][_GPCSRETORVQUIK]{1,7}['"];){3,5}(\$\w{1,40})=\$\{(?:\$\w{1,40}[\.\}]){3,5};if\(isset\(\82[^\{]{1,29}\{(?:\$\w{1,40}=(?:\82\[[^\]]+\][\.;]){2,5}){2,5}(\$\w{1,40})=\$\w{1,40}\(['"][^'"]*['"],[^;]{1,99}\);\83\(\);\}(?<X1131140>)|\s*(?:\$\w{1,40}=base64_decode\([^\)]+\);){9}[^\?]{3999,5999}(\$this->)\w+=array\(\);(?:\85\w+=\$\w+\(['"][^'"]{2999,29999}['"]\)\.[^;]{1,49};){2}[^#@]{4999,6999};if\(\w+\([^,]+['"]/\.htaccess['"],['"]\w+['"],['"][^'"]{1,99}(?:Add(?:Type|Handler)\s*[^\\]{1,19}\.php\\n){2}(?<X2131483>)|\s*(?:if\(\$_[GPCSR]\w{2,6}\[[^\{]{1,40}\{(?:echo|move_uploaded_file)\b[^;]{1,299};){2}\$\w{1,40}=\$_FILES\[[^\{]{99,299}mail\((?:\$\w{1,40}[,\)]){3};(?:\Z|\?>)(?<X1129890>)|\s*(?:include|require)(?:_once)?\h*['"][^'"]{0,49}\.php['"];\s*file_put_contents\([^\)]+\);\s*header\(['"]Location:\h*\w{0,15}\.php\?path=['"]\h*\.\h*md5\(time[\(\)]+;\s*\?>(?<X2185160>)|\s*(\$[0o]{1,19})=['"][^'"]+['"];function\s+([0o]{1,19})\([^\)]+\)\{return[^;]+;\}(?:\$[1l]{1,19}=\90\(\89\[\d+\][^;]+;)+(\$[1l]{1,19})=\90\(\90\([^\?]{499,1499}(\$[1l]{1,19})=\90\(\90[^;]{99,499};\91\([^\)]+\92\b[^\)]{1,9}\)\);(?:\?>)?(?<X1136950>)|\s*(\$\w)=[^;]{1,99};\s*(\$\w)=['"]file_ge(t_contents)['"];\s*(\$\w{1,40})=\94\(\95\(['"]https?://[^'"]+\.txt['"][^;]{1,49};file_pu\96\(['"]([^'"]{1,40})['"],['"]<\?php\s*['"]\.\97\);(?:(?:include|unlink)\(['"]\98['"]\);){2}[^@>]{1,499}\binclude(\(\$\w\);)unlink\99(?:die|exit)\(?\)?;\}?(?:\?>)?\Z(?<X2151890>))
\A<\?php(?:\s*(\$\w{1,15})\h*=\h*(?:['"][^'"]{32,99}['"];\s*(\$\w{1,15})\h*=\h*(?:\1\[\d+\]\.){9}[^;]+;\s*@?\2\(\1\[\d+\]\.\1\[[^\(]{0,199}\(['"]\.\1\[\d+\]\.\1\[[^\(]{0,199}\(['"][^'"]{599,2500}['"\)]+;['"],['"]\.['"]\);\s*(?:\?|\Z)(?<X1184780>)|array\((?:['"][^'"]{9,99}['"],\h*){15}(?:[^\)]{999,30000}\);\h*(\$\w{1,15})\h*=\h*(array|strrev)\(['",\s\.base64_dco]{9,70}\);\h*(\$\w{1,15})\h*=\h*\5\(['",\s\.gzinflate]{11,40}\);\h*eval\h*\(\h*\6\h*\(\h*\4\h*\(\h*implode\h*\(\h*["']{2},\h*\1\)+;\h*\?>(?<X1141241>)|[^\)]{999,8000}\);\s*\$\w{1,15}\h*=\h*(array)\(['",\sbase64_dco]{9,70}\);\s*\$\w{1,15}\h*=\h*\8\(['",\sgzuncompres]{9,70}\)[^\?]{9,199}eval\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}\h*\(\h*\$\w{1,15}\h*\(\h*['"]{2},\h*\1[\s\)]+;\s*\?>(?<X1139260>)))|\s*(\$\w{1,40})(?:(=str_rot13\()[^;]{1,49};\$\w{1,40}=['"]\w{32}['"];(\$\w{1,40})\11strrev\(['"]\w{13}['"]\)\)(;eval\(\10\(\12\()[^;]{99,299}\13['"][^'"\);]{40000,50000}['"]\)+;(?:\?>|\Z)(?<X1134040>)|=(?:str_rot13\((?:base64_decode|gzinflate|convert_uudecode|gzuncompress)\(){2}['"][^'"]{1,40}['"]\)+;function\s*\w{1,40}\([^\?\n]{99,4999};\10\(['"](?<X2133071>)|=(curl_)init\(['"]https?://[^;]{1,99};(?:\16\w{1,19}\(\10,[^;]{1,99};){1,9}(\$\w{1,40})=curl_exec\(\10\);(?:eval|assert)\(['"]\?>['"]\h*\.\h*\17\);?(?:\?>)?\Z(?<X2164090>)|=['"][^;]{1,99};(\$\w+)=(fopen\()[^,;]{0,99}\10\b[^\?]{1,299};while\([^\)]+\bfread\(\19\b[^\?]{1,499}\bextract\((\w+)\(\$\w+\)+;function\h+\21\([^\}]{1,499}(\$\w{1,40})=\20(\$\w+),[^;]{1,99};fwrite\(\22,[^\?]{1,99}\b(?:inc|req)\w+\s*\23;unlink\(\23\);return\b[^;]{1,19};\}\s*(?:\?>|\Z)(?<X1187410>)|=['"]https?://(?:[^'"]{9,99}['"];eval\([^\)]{0,9}file_get_contents\(['"]?\10['"]?\)\);\s*(?:\?>|\Z)(?<X1130680>)|[^;]{1,199};(\$\w{1,40})=['"][^'"]+\.php['"];function\s*(\w{1,40})\(\$\w+,(\$\w+)\)\{[^\}]{0,199}\$(\w{1,40})=file_get_contents\(\28\);[^\?]{0,499}\bfwrite\([^,;]{1,99},\$\29\);[^@]{1,499};\}+\27\(\26,\10\);\s*(?:\?>|\Z)(?<X1187420>))|=['"]strrev['"];(\$\w{1,40})=array\([^\)]+\);(?:(\$\w{1,40})=\10\(['"]\w{1,40}['"]\);)+eval\([^;]{0,39}\32\([^;]{0,39}\31\)+;(?:\s*\?>)?\s*\Z(?<X2133671>)|=[^;]{1,99}\.png['"];(\$\w{1,40})=['"][^'"]{4999,}['"];if\(!file_exists\(\10\)\)\{file_put_contents\(\10,(?:(?:base64_decode|gz[di][en]flate|rawurldecode|str_rot13)\(){2,}\34\)+;\}(?:includ|requir)e(?:_once)?\(?\10\)?;(?:\?>)?\Z(?<X2166590>)|=[^\?]{99,2999}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{1,40};chdir\(\w{1,40}\(\36\)\);include\(\36[^\{]{1,40}\{(?:echo|printf?)\10[^\?]{1,40}\?>\Z(?<X2126772>)|=\$_[GPCSR]\w{2,6}\[(?:[^#]{99,999}(?:\$(msg|message)\.=['"]\W{0,5}(?:ID|email|pass(?:word)?|user(?:name)?|pin|cvv)\b[^;]+(?:\$_[GPCSR]\w{2,6}\[|\10)[^;]+;){2}[^#]{999,1999}(\$headers)\.?=\$_POST\[['"]eMailAdd['"]\][^;]{1,49};if\(mail\([^\)]+\$\38,\39\)\)\{mail\([^\)]+\$\38,\39\);(?<X2137820>)|[^;]{1,49};(?:\10=[^;]{1,49};){1,2}if\(class(_exists\()['"]Reflection(Function)['"]\)\)\{[^\}]{1,199}\}(?:elseif\(\42\41['"](\w{1,40})['"]\)\)\{\43\(['"]([peas](?:assthru|ystem|xec|hell_exec|open|val|ssert))['"][^;]{1,49};\}){1,2}else\{\44\(\10\);\}(?:\?>)?\Z(?<X2137950>))|=file_get_contents\([^;]{1,99};\10=(?:\w{1,40}\(){1,3}\10\)+;(?:eval|assert)\(\10\);(?:\?>)?\Z(?<X2174740>)|=fopen\(['"]https?://[\d\.]+/[^;]{1,199};(\$\w{1,40})=['"]{2};while\(false!=\((\$\w{1,40})=fread\(\10,[^\{]{1,99}\{\47\.=\48;\}(?:echo|print)\(eval\(\48=\47\)\);fclose\(\10\);\s*(?:\?>|\Z)(?<X1174070>)|=strrev\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?:assert|eval|system|passthru|shell_exec|exec|popen)\(\10\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\);(?:\?>|\Z)(?<X1131491>)|\s*=\s*(?:passthru|system|(?:shell_)?exec)[^\$]{1,10}(\$_[GPCSR]\w{2,7}\[[^\]]{1,40}\])[^\?]{40,150}\10\(\51\)[^\?]{1,20}(?:\?>|\Z)(?<X2126632>))|\s*(\$\w{1,9})\s*=\s*['"][^'"]{32}['"];\s*if\s*\(\s*md5\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\D{2,3}\s*\53\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\);\s*\}\s*\?>(?<X1135670>)|\s*(\$\w{25,90})\h*=\h*\d{1,3};\s*(\$\w{25,90})\h*=\h*['"][^\n]{99,1999}['"];\s*(\$\w{25,90})\h*=\h*\56;\s*\$\w{25,90}\h*=\h*strlen\(\57\);[^\?]{9,299}\+\)\s*(\$\w{25,90})\h*\.=\h*chr\(ord\(\57\[\$\w{25,40}\]\)\h*\^\h*\55\);\s*eval\(['"]\?>['"]\h*\.\h*\58\.['"]{2}\);\s*\?>\Z(?<X2180771>)|\s*(\$\{['"]GLOBALS['"]\}\[)['"](?:[^'"]{1,40}['"]\]=[^@]{35000,45000}(?:(?:symlink|copy)\([^\)]{1,99}\60[^\)]{1,99}\);){9}(?<X2130850>)|\w{1,40}['"]\]=['"](roin)['"];\60[^<]{999,2999}<(title>)\62[\s\W]{1,9}exploit</\63(?<X2130640>))|\s*(\w{1,40}\(\));function\s*\65\{if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\{(?:\$\w{1,40}=\$_[GPCSR]\w{2,6}\[[^\]]+\];){2,4}[^\}]{99,199}\}else\{(\$\w{1,40})=(file_)ge(t_contents)\([^;]+;\}\67pu\68\([^\)]+,\66\);[^\}]{1,49}(?:die|exit)[^;]{0,19};\}\}(?:\?>)?(?:<!--[\w\s]{1,99}-->)?\Z(?<X2136900>)|\s*(echo)\h*['"](?:[^'"]{1,50}IndoXploit[\w<>'"]{0,25};\s*\70\h*['"]<b>['"]\.php_uname\(\)\.['"]</b>[^\?]{99,700}\{\s*if\(@?(?:copy|move_uploaded_file)\h*\([^{]{1,99}\{\s*(?:echo[^;]{1,99};\s*)?\}\s*else\h*\{\s*(?:echo[^;]{1,99};\s*)?[\}\s]+(?:\Z|\?>)(?<X1141210>)|\h*Auto\h+Exploit[^<]{9,40}<br>[\'"]\.php_uname\(\)\.[\'"]<br>['"];\s*\70\h*['"]<form[^\{]{9,150}if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\h*\{\s*if\h*\(\h*@?array[^\}]{9,99}\}\s*else\s*\{[^\}]{0,35}\}\s*\}\s*\?>(?<X1142511>))|\s*(function)\s*(\w{1,40}\()(\$\w{1,40})\)\{[^\?]{1,499}\{\$\w{1,40}=(file_)ge(t_contents\()\75\);[^\?]{1,499}\b\73\h+(\w{1,40}\()\75[^\{;]{1,99}\{\$\w{1,40}=\76pu\77[^;]{1,99},\75\);[^\?]{1,499}\$(\w{1,40})=\74\$_[GPCSR]\w{2,6}\[[^;]{1,99};\78\$\79,[^;]{1,99};[\s\}]+(?:\?>)?\Z(?<X2173251>)|\s*(goto)\s*\w{1,9};\s*\w{1,9}:\s*header\(['"]\\[\w\d][^\?]{99,799}\$\w{1,9}\h*=\h*file_get_contents\((base64_)decode\(['"]\\[\w\d][^\?]{99,700}\$\w{1,9}\h*=\h*\82encode\(\$_SERVER\[['"][^'"]{9,99}['"]\]\);\s*\81\h*\w{1,9};\s*\w{1,9}:\s*\w{1,9}:\s*(?:\Z|\?>)(?<X1138850>)|\s*@?(?:(unlink)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[^\{]{9,150}(?:(\$\w{1,9})\h*=\h*['"]\w{1,15}\.(?:txt|php)['"];[^\{]{0,50}){3}(\$\w{1,9})\h*=\h*(file_)get(_contents)\(\85\);[^\{]{0,50}@?\84\(\85\);[^\?]{99,400}\87put\88\(\$\w{1,15},\h*\86\)[^\?]{9,150}usleep\(\d{1,7}\);[^\;]{0,50}\};\s*(?:\Z|\?>)(?<X1141112>)|[ero_p]{11}ting\([^%]{3,200}header\(['"]content-type:\s*text/html[^\)]{1,25}\);(\$\w{1,40})=[^\{]{20,200}\{(\$\w{1,40})=['"]\w{60000,}['"];\91=str_rot13\(\91\);(\w{1,40})\(\91\);\}function \92\((\$\w{1,40})\)\{global\90\;(\$\w{1,40})=['"]{2};eval\(\94\.pack\([^,]+,\93\)\.\94\);\}(?<X2127500>)|[eropting_]{15}\((?:0|NULL)\);\$\w{1,40}=[^;]{9,99};\$\w{1,40}=(?:array\(|\[)[\d,]+(?:\)|\]);(\$\w{1,40})=['"][^'"]{9999,65000}['"];[^\}]{1,99}\}assert\(['"]eval\s*\((?:(?:base64_decode|gz[id][ne]flate)\(){3,6}\96\),\d+\){3}["']\);(?:\Z|\?>)(?<X2129281>)|error_reporting\(0\)[^'"]{9,99}(\$\w{1,15})=['"]/[^'"]{9,299}['"];(\$\w{1,15})=['"]/[^'"]{9,299}['"];[^\?]{99,600}\{@?(chmod)\(\99,\d{3,4}\);@?copy\(\98,\99\);@?\100\(\99,\d{3,4}\);\}if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\?]{9,159}\.txt['"],\s*time\(\)\);\}while\(true\);\}\s*(?:\Z|\?>)(?<X1138880>)|system\(['"]cat\s*/etc/passwd\h*>\h*(\w{1,15}\.txt)['"]\);\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]\102['"]\)(?<X2140500>))|\s*[^\$\(]{0,99}(?:\$\w{1,15}\h*=\h*(base64_decode)\s*\([^\;]{9,199}\);\s*){4}[^\{\?]{99,1500}\bif\h*\((\$\w{1,15})\h*\D{2,3}\h*\104\h*\([^\{]{0,99}\{\s*if\h*\(\h*\$\w{1,15}\h*\(\h*\104[^\}]{9,500}\}\s*\}\s*else\s*\{\s*echo\h*\105;\s*\}\s*\?>(?<X1175662>)|\s*[^\$]{9,99}(\$\w{1,9})=['"][^'"]+['"];\s*(\$\w{1,9})=(str(_replace))\(['"](\w{1,5})['"],['"]{2},['"](?:[base64_dco]|\111){9,50}['"]\);\s*(\$\w{1,9})=\109\(['"](\w{1,5})['"],['"]{2},['"](?:[gzinflate]|\113){9,50}['"]\);\s*preg\110\([^\(]{5,50}\(\112\(\108\(\107\)+['"],[^\)]{1,9}\);\s*(?:\?>|\Z)(?<X1134461>)|\s*[^\$]{99,199}\bfunction\s*(\w{1,40})\((\$\w{1,40})\)\{(\$\w{1,40})=(dirname\()\116\);(\$\w{1,40})=min\([^;]+;foreach\(scandir\(\118\117[^\?>]{99,199}return\s*touch\(\116,\119,\119\);\}\$\w{1,40}=[^;]+;(\$\w{1,40})=[^;]+\$_[GPCSR]\w{2,6}\[[^;]+;if\(\115\(\120\)\)\{[^\$\?]{1,99}\b(?:die|exit)[^;]{1,19};+\?>(?<X1137670>))
\A<\?php(?:\s*[^\{]{0,99}(\$\w{1,9})\h*=\h*['"]https?[^\{]{9,150}(\$\w{1,9})\h*=\h*['"][^'"]{1,99}\.php['"][^\{]{9,99}function\s*(donlot)\(\1,\h*\2\)\{[^\}]{9,99}\}\s*while\(\d{1,3}\)\s*\{\s*if\(!file_exists\(\2\)\)\s*\{\s*\3\(\1,\h*\2\);\s*\}\s*sleep\(\d{1,3}\);\s*\}\s*\?>(?<X1138981>)|\s*[^\{]{1,299}(?:\$door_(?:domain|type|folder|file|param|tpl)=[^;]{1,49};){3}[^%#\^\v]{9999,15000}(\$door\w+)=(?:\$door_\w+\.){3}[^;]+;(\$spam\w+)\.?=[^;]+\5\b[^;]+;\}+return\s*\6;(?<X2133456>)|\s*[ir][ne][cq][lu][ui][dr]e(?:(?:_once)?\(?['"](?:block(?:er)?|(?:anti-?)?bot|helper|api|mail|info)\.php['"]\)?;[^\}]{9,2999}<title>[^/]{0,99}DHL\s*(?:\||Express|\s){0,4}Tracking</title>(?<X2129030>)|(?:_once)\((?:[^;]+;function\s+(\w+)\((\$\w+),(\$\w+)\)\{\$\w+=opendir\(\10\);mkdir\(\11\);[^\}]+\}else\{(?:(?:copy|chmod)\((?:\10|\11)[\.'"/]{5}\$\w+,[^\)]+\);){2}[\}]{3}[^\{]{99,499}\9\(\10,\11\);header\(['"]location:[^\)]+\);(?:\?>|\Z)(?<X1129392>)|[^\)]+\);if[^\{]{9,99}\{header\(['"]HTTP/[\d\.]{1,3}\s*404[^\}]{9,29}\}(session)_start\(\);(\$\w+)=\$_[GPCR]\w{2,6}\[['"](\w+)['"]\];\$_\13\[['"]\15['"]\]=\14;(\$\w+)=[^;]{9,49};if\(\16\)\{header\(['"]location:\16[^'"]{9,49}['"]\);\}\?>(?<X1129401>)))|\s*\$\w{1,40}=(?:"[^";\s\.]{30000,}";eval\(base64_decode\("[^"\n\)]+"\)\);return;\s*\?>\Z(?<X2050601>)|'[^']+'\s*\^\s*'[^']+'\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\(\s*'',.{1000,3000}'\);\s*\$\w{1,40}\(\);\s*\Z(?<X1040300>)|['"]['"];[^\n\*\?]{0,1999}do\{[^\n\?@]{3999,9999}(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\)\);\20\(\);(?<X2132864>)|['"][^'"]{9999,19999}['"];[^\?\&]{99,499}function\s*\w+\((\$\w+),&(\$\w+),(\$\w+)[^\)]*\)\{\23=(file_)ge(t_contents\()\22\);\23(=preg_replace\()['"]\W<script[^>\);]+>\s*(document\.body\.innerhtml)=\28[^><\);]+<iframe[^,]+,['"]{2},\23\);if\(\24\)\{\23\27[^\}]+\}return\s*\25pu\26\22,\23\);\}(?<X2134110>)|['"]\w{32}['"];(?:[ero_ptingsml]{14,15}\(\d+\);){2}function\s*\w+\(\)\{[^@]{8999,10999}<!--_{19,49}Recoded?\b[^>]{9,99}_{19,49}-->(?<X2131300>)|['"]https?://(?:[^;]{1,99};\s*(\$\w{1,40})=['"][^'"]{1,49}\.php['"];\s*function\s*_doEvil\(\31,\$\w{1,40}\)\{(?<X2168320>)|pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][^\?]{1,299}\$(?:auth)?_?pass=['"]\w{4,400}['"];(?<X2131900>))|array\([^;]{1,99};if\(isset(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\)\{switch\34\{[^\}]{0,199}\bcase\s*['"](\w{1,40})['"]:\s*if\(\35\(\$_POST\)\)[^\?]{1,399}\bfunction\s*\35\(\$\w{1,40}\)\{[ri](?:equir|nclud)e(?:_once)?[^;]{0,99}\bwp\-load\.php['"];[^\}]{1,299}\bwp_insert_post\((?<X2170541>))|\s*\$\w{1,40}\s*=(?:"[^"]{20000,}"\s*;\s*eval\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\?>\s*\Z(?<X1040070>)|'[^']*'\s*;\s*\$\w{1,40}\s*='[^']*'\s*;\s*@?eval\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*\?>\s*(?<X1040050>))|\s*\$(?:\w{1,9}\h*=\h*\[\s*['"]head['"]\h*=>\h*['"]COVID\-19(?<X2193551>)|\{['"][^`]{1000,4000}['"]\]\};if\(@?file_exists\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\)and\s*empty\(\$_REQUEST\[['"][^`]{1000,4000}\]\}\)\{exit\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\);\}else\{@?header\(['"][^'"]{1,200}['"]\);\}\}\s*\?>(?<X1042040>)|\{['"][^`]{1000,6000}[^\x00-\x7F]{20,25}";[^`]{300,500}mail\(\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^"]{1,40}"\}\["[^"]{1,40}"\]\},\$\{\$\{"[^'"]{1,40}"\}\["[^'"]{1,40}"\]\}\);\s*\?>(?<X1042050>)|_[GPRSC]\w{2,6}\[[^\]]+\]\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*(?:\Z|\?>)(?<X1138890>)|filesman=[^;]{1,99};if\(\$_[GPCSR]\w{2,6}\[[^;\?\}]{1,99}\$(\w{1,40})=(\$_FILES\[)[^;]{1,99};\$(\w{1,40})=\44[^;]{1,99};[^\}\?\{\(]{0,99}\bif\([cm]o(?:ve_uploaded_file|py)\(\$(?:\43|\45),[^\)]{0,99}\$(?:\43|\45)\)(?<X2169650>)|send=['"][^'"]{9,99}['"];[^\?]{9,199}/\w{1,9}\.php['"];function\s+randomCha\(\$\w{1,40}\)(?<X2133234>))|\s*class\s*(?:(\w{1,40})\{(?:const\s*PLATFORM_(?:UNKNOWN|ANDROID|APPLE|LINUX|WINDOWS)=\d+;){5}private\s*\$(\w{1,40})=['"][^'"]{5000,19999}['"];[^%]{1000,4000}(?:header\([^)]+\);){6}return\s*gz(?:in|de)flate\(base64_decode\(\$this->\49[^%]{1,150}(\$\w{1,40})=new\s*\48\(\);echo\s*\50->\w+\((?<X2127371>)|(text_auth)\{var\s*\$n_iter;function\s*\52\(\)\{[^!]{99,2999}(\$\w{1,40})=new\s*\52\(\d{2,4}\);(\$\w{1,40})=\53->decrypt\(\54,['"]\w+['"]\);eval\(\54\);(?:\Z|\?>)(?<X2129170>))|\s*define\(['"]PHPSHELL_VERSION['"],['"][^'"]{1,9}['"]\);\s*\?>\s*<html>(?<X2139741>)|\s*error_reporting\((?:(?:0|NULL)\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h\{]+[^\}]{0,299}\bfile_put_contents\([^\)]+\);\s*(header\(['"]Location:\h*https?://facebook\.com['"]\);)\s*(?:exit|die)[^;]{0,9};\s*\}\s*\57\s*\}\s*\57\s*\?>(?<X2185151>)|(?:0|NULL|False)\);(?:[^\$\?\{=]{1,199}\$(\w{1,40})=['"]https?://[\d\.]{7,15}/[^'"]{1,99}\.php['"];\s*(\w{1,40})\(\$\59\);[^\?\{]{1,199}\bfunction\s*\60\((\$\w{1,40})\)\{[^\}]{1,499}\$(\w{1,40})=file_get_contents\(\61\);[^\?>]{1,499}\becho\s*\$\62;(?:exit|die)[^;]{0,19};(?<X2166001>)|\s*function\h*(\w{1,40}\()(\$\w{1,40})(?:=\d{1,3})?\)\{http_response_code\(\65\);exit;\}(?:if\([^\)]+\$_[GPCSR]\w{2,6}\[[^;]{1,99}\64\d+\);){1,3}if\(copy\(\$_FILES\[[^,\)]{1,99},\$_[GPCSR]\w{2,6}\[[^;\?]{1,99}\64\d+\);(?:\64\);)?(?:\?>)?\Z(?<X2177190>))|[^;]{1,19};function\s*\w+\([^\{]+\{\$\w{1,40}=['"]\w{52,99}['"];[^\?/>!]{99,199}\bif\(stri?pos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],[^\{;]{1,49}\{if\(!isset\(\$_(COOKIE)\[[^\{;]{1,99}\{set\67\([^;]+;header\(['"]Location:\s+https?://[\d\.]{7,15}/[^;]+;\}+;(?:\?>|\Z)(?<X1134020>)|\d\);set_time_limit\(\d\);((\$\w{1,40})=base64_decode\()['"][^'"]{65000,}['"]\)(?:;\70=[ep]reg_replace\([^\)]{6,19},\70\)){3,5};\69\70\);eval\(\70\);(?:\Z|\?>)(?<X1130420>))|\s*f(?:ile_put_contents\s*\(\s*['"]\./index\.back\.php['"],\s*base64_decode\s*\(\s*['"][^'"]{99,1999}['"]\s*\)\);\s*(?:\Z|\?>)(?<X1138590>)|unction(?:\h*(\w{1,15})\(\$\w{1,15}\)\s*\{\s*GLOBAL[^\n]{99,1100}\bget_var\((\$\w)\[\d+\]\.(\$\w)\.\74\[\d+\]\);\$wpdb\->update\(\75,array\(\74\[\d+\]=>\$[^\n]{99,1500}\breturn\h*\$\w;\}add_filter\(['"][^'"]+['"],['"]\73['"]\);(?<X1194450>)|\s*(?:(\w+)\((\$\w+)\)[^\}]{9,99}(\$\w+)=(?:sub(?:str))\(\78,\d+,\$\w+\);\h*return\h*\79;\}function\s*(\w+)\((\$\w+)\)\h*\{(\$\w+)=substr\(strrchr\(\81,['@"]{2,3}\),\d+\);\h*return\h*\82;\h*\}(\$\w+)=\$_[GPCSR]\w{2,6}\[[^\]]{3,40}\](?:;\$\w+=(?:\77|\80|str(?:len|rev))\(\83\)){4};(?<X2128972>)|(\w{1,40})\((\$\w+)\)\{(\$\w{1,40})=sub(str)\(\88rchr\(\86.['"@]{2,3}\),\d+\);return\87;\}(\$\w{1,40})=\$_[GPSCR]\w{2,6}\[[^\]]{3,42}\];(\$\w{1,40})=\85\(\89\);\{header\(['"]Location:\s*https?://\90['"]\);\}\s*(?:\?>|\Z)(?<X2128980>)|(\w{1,40})\((\$\w{1,40})\)\{\93=gzinflate\(base64_decode\(\93\)\);for\([^\{]{9,99}\)\{\93(\[\$\w{1,40}\])=chr\(ord\(\93\94\)\-1\);\}return\93;\}eval\(\92\(['"][^'"]{65000,}['"]\)\);(?:\?>|\Z)(?<X1129630>))))|\s*goto\s+(?:(\w{1,9});(\w{1,9}):\s+function\s*\w+\([^\?]{99,499};\96:\$GLOBALS\[[^\]]+\]=array\((?:['"](?:str_rot13|pack|strrev)['"],?){3}\);goto\s+\97(?<X2131611>)|\w{1,40};[^\?]{49,299}\b\w{1,40}:\s+(exec\((['"])pkill)[^'"]{9,99}\100(\);goto)[^\?]{99,999}\99[^'"]{9,99}\100\101(?<X2131013>)))
\A(?:<(?:\?php(?:\s*if(?:[\(\h]+isset[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?(strrev)[\h\(]+['"]edoced_46esab['"][\h\)]+;\s*(\$\w{1,40})\h*=\h*@?\2[\h\(]+['"]sserpmocnuzg['"][\h\)]+;\s*@?eval[\h\(]+\3[\h\(]+\1[\h\(]+['"]eN[^'"]{999,49999}['"][\h\)]+;\s*\}\s*(?:\?>|\Z)(?<X2181850>)|\(!(function)_exists\(['"]([^'"]+)['"]\)\)\{\5\s*\6\([^\@]{99,499}\}(\$\w{1,40})=[^;]+;(\$\w{1,40})=\6\([^\)]+\$_[GPCSR]\w{2,6}\[[^;]+;file_put_contents\([^\)]+\b(RC4)::De(crypt)\(\7,\8\)[^@]{99,499}\bclass\s*\9\{[^@]{99,499}\b\5\s*de\10(\([^\{]{1,9})\{return\s*\9::en\10\11;\}\}(?:\?)?\Z(?<X2139200>)|\((\$_[GPCSR]\w{2,6})\)\{(\$email)=\13\[[^;]{1,49};(\$pass(?:w(?:or)?d)?)=\13\[[^@]{99,999}\$(m(?:e?sg|essage))=[^;]{1,199}\14[^;]{1,199}\15[^@]{1,1499}\bmail\([^\)]+\$\16[^\(\?\{]{1,199}\bheader\(['"]Location:\s*https?://(?<X2153111>)|\((\$_[GPCSR]\w{2,6}\[[^\]]+\])\)\{?(?:exit|die)\(\18\);[^\?]{1,499}/\*Bloodninja:\s*I\s*lick\s*your\s*earlobe\b[^#@]{999,4999}\*/\]['",]{6}\);\$[^;\.]{99,499}\.['"]{2}[^'"]{20000,30000}['"]{2}[^@]{99,999}\*/(?:\?>)?\Z(?<X2138513>)|\(file_put_contents\(['"][^'"]{1,99}['"],base64_decode\(['"][^'"]{65000,}['"]\)+(?:echo[^;]{1,99};)?(unlink\()__FILE__\);(?:\20[^;]{1,99};){1,3}\s*(?:\?>|\Z)(?<X1136070>)|\(isset(?:(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\)\{(\$\w{1,40})\[['"](\w+)['"]\]=(?:strrev\()?['"](?:tressa|assert)['"]\)?;(\$\w{1,40}\[)\]=\23;\25\d+\]\[['"]\24['"]\]\22;(?:exit|die)[^;]{0,49};\}(?:\?>|\Z)(?<X1133480>)|\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{(\$\w{1,40})=\27;for\((\$\w{1,9})=\d+;\29<strlen\(\28\);\29\+\+\)\{\28\[\29\]=\28\[\29\]-\d+;[^\(]{1,99}\$\w{1,40}=base64_decode\(['"][^'"]{999,9999}['"]\);(\$\w{1,40})\s*=\s*['"][^'"]+['"];for\([^\}]{39,199}\28\[\d+\]\);\}eval\(\30\);(?<X2130621>)|(\$_FILES\[[^\]]+\])\)\)\{\s*\$\w{1,15}=['"]\./['"]\.\32\[['"]\w{1,15}['"]\];\s*if\(@?(?:move_uploaded_file|copy)\(\32[^\}]{9,99}echo\h*['"]\w{1,9}[^<]{9,50}<(form)[^\?]{9,150}</\33><\?php\h*\}\h*\?\>(?<X1142991>)|\$_[GPCSR]\w{2,6}\[(?:[^\]]+\]\){2}\{?die\(\w{1,40}\(\)[\+\-\*\%/]\d+\);\}?(?:\s*\?>)?\s*\Z(?<X2131601>)|[^\{\?;]{1,99}\{(\$\w{1,40});(\$\w{1,40})=explode\(['"]\W["'],\$_[GPCSR]\w{2,6}\[[^;]{1,99};(\$\w{1,40})=\37\[\d+\];(\$\w{1,40})=\37\[\d+\];\38\(\39,\36\);foreach\(\36[^\)]+\)\{[^\};]{1,199};\}\}\s*(?:\?>)?\Z(?<X2172870>))))|\h*\(!(function)_exists\(['"](set_magic_quotes_runtime)['"]\)\)\s*\{\s*\41\h*\42\([^\(]{1,40}(\$\w{1,40})\h*=\h*(str_rot13)\([^\)]{9,25}\);[^;]{9,99};(\$\w{1,40})\h*=\h*\44\(strrev\(['"][^'"]{9,20}['"]\)\);\s*(?:eval\(\43\(\45\(['"][^'"]{99,}['"]\)+;\s*){2}\?>(?<X1139280>)|\h*\(\h*isset\h*\(\h*(\$_FILES\[[^\]]+\])\h*\)\h*\)\s*\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"][^'"]{0,50}\w{1,15}\.php['"][^\{]{9,150}if\h*\(\h*@?(?:move_uploaded_file|copy)\h*\(\47[^\{]{9,50}\{\s*chmod\h*\([^\)]{5,25}777\h*\);\s*\}\s*echo[^\}]{9,70}\}\s*else\s*\{[^\}]{9,70}\}\s*\?>(?<X1142951>))|\s*include(?:_once)?\s*['"][^'"]{0,49}wp\-config\.php['"];[^\$]{99,499}(\$\w{1,40})=new\s*mysqli?\((?:DB_(?:HOST|USER|PASSWORD|NAME)[,\)]){4};[^&\^#]{999,1999}\$\w{1,40}=\49->real_escape_string\(['"]a:1:\{s:13:['"]administrator['"];b:[01];\}['"]\);(?<X2131040>)|\s*namespace(?:[^;]+;\s*class\h*(\w{1,15})\s*\{[^#]{9,2300}\bfunction\h*save\h*\(\$\w{1,15}\)\s*\{\s*(\$\w{1,15})\h*=\h*tempnam\(sys_get_temp_dir\(\),\h*__CLASS[^\}]{0,99}\binclude\h*\52;\s*@?unlink\(\52\)[^\{]{0,99}\{\s*echo\h*<<<HTML[^\\]{0,49}404\h*Not\h*Found</title>[^\?]{0,299}\bnew\h*\51\b(?<X2185531>)|\s*InnStudio\\Prober\\(?<X2158612>))|\s*set_time_limit\(0\);\s*header\([^\$]{9,99}(\$\w{1,15})\h*=\h*['"]https?://[^;]{9,50};\s*(\$\w{1,15})\h*=\h*['"]https?://[^;]{9,50};\s*(\$\w{1,15})\h*=\h*file_get_contents\(\55\.['"][^'"]{1,35}['"]\.\56\.[^;]{9,80};\s*echo\h*\57;\s*(?:\Z|\?>)(?<X1141090>)|\s*unlink\(\s*['"]([^'"]+)['"]\s*\);\s*(\$\w{1,40})\s*=\s*base64_decode\(\s*['"][^'"]{99,500}['"]\s*\)\s*;\s*file_put_contents\s*\(\s*['"]\59['"]\s*,\s*\60\s*\);\s*(?:\?>|\Z)(?<X1129442>)|\s+(?:\w{5,20}\([^\)]+\);\s*)+(?:\$arr\w{1,20}\[\]=['"]\d+['"];\s*){5,20}(?:\$arrBread\[\]=['"][^'"]*['"];\s*){99}(?<X2203601>)|\s+(\$\w{1,20})=(curl_)init\(['"]https?://(?:\d+\.?){4}/[^\)]+\);\s*\64setopt\(\63,[^\)]+\);\s*(\$\w{1,20})=\64exec\(\63\);\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]\?>['"]\.\65\);\s*(?:\Z|\?>)(?<X1153582>)|\s+(\$links)=['"](?:<a\h+href=[^>]{9,99}>[^<]{2,60}</a>\h*){5,15}['"];\s*function\h+\w{1,20}\([^\)]+\)\s*\{\s*global\h*\67;\s*\$\w{1,20}=preg_replace\(["'][^,]+,["']<div\h+style=['"](?:left|right|top|bottom)\s*:\s*\-\d+px;(?<X2193670>)|\s+(function)(?:\h*(\w{1,20})\(\)[\{\s]+[^\}]+[\}\s]+(add_action\(['"]init['"],['"])\70['"]\);[^\|\?]{99,400}\b\69\h+(\w{1,20})\(\)[\{\s]+[^\{]{0,80}\bif\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\{\s]+[^\}]{99,700}\bif\([^\)]+\)[\{\s]+\$\w+=file_put_contents\([^\}]{9,99}\bexit\(\);[\}\s]+\71\72['"]\);(?:\?>|\Z)(?<X2204420>)|\h+(authcode)\([^/\\]{200,600}\b\69\h+(Root_login\d*)\([^\)]+\)[\{\s]+print\h*<<<END\h*<html[^@\\%]{400,1500}\b\75\([^\)]+\);[\s\}]+else[\s\{]+\$\w{1,20}=\74\((?<X2201380>))|\s+\$(?:web)?ShellName=["']Infinity.{0,2}[5s]h[3e][l1]{2}['"];(?<X2202410>)|\s+class\h*(\w{1,6})[\s\{]+private\h+static\h*(\$\w{1,6});\s*static\h+(function)\h*(\w{1,20})\([^\)]+\)[\s\{]+if\(!self::\79\)[^@%\+]{99,500}\);[\}\s]+\80\h*(\w{1,20}\(\))[\s\{]+(\$\w{1,6})=\$_[GPRSC]\w{2,6};\s*\([^@%\*]{200,999}:\83;\s*return(?:\h*.?\78::\81\(\d+\)){5,10};[\s\}]+\82;\s*(?:\?>\s*)?\Z(?<X2201511>)|\s+e(?:cho\h+['"][^'"/]{2,30}<title>\w{0,9}\h*(?:Cpanel|Whm)\h*mass\h*Defacer\b(?<X2168851>)|rror_reporting\((?:0|NULL|FALSE)\);\s*function\h+(\w{1,20})\(([^\)]+)\)[\s\{]+(\$\w{1,20})=base64_decode\(\87\);\s*(\$\w{1,20})=openssl_decrypt\(['"]\88['"],['"]AES\-[^\)]+\);\s*return\h*\89;[\s\}]+\$\w{1,20}=['"][^'"]{9999,}['"];\s*if\(!?function_exists\([^\?#%]{200,500}\beval\(\86\([^\)]+\)\);(?:\s*\?>)?\Z(?<X2198380>))|\s+goto\s+\w+;\s*\w+:\s*curl_setopt\([^\n]{999,2999}\$\w{1,40}\s*=\s*parse_url\(\s*rawurldecode\s*\(\$_[GPCSR]\w{2,6}\[[^\n]{499,999}fwrite\(\s*(\$\w+),\s*(\$\w+)\);[^\n]{499,999}\91\s*=\s*fopen\([^\n]+\92\s*=\s*curl_exec\([^\n\?>]{999,4999}(?:\?>|\Z)(?<X1132321>)|\s+if\(!(function)_exists\(["'](hex2bin)[''"]\)\)[\s\{]+\94\h+\95\((\$\w{1,20})\)[\s\{]+\$\w{1,20}=strlen\(\96\);[^\(]{0,20}\bwhile\([^\}]{2,60}\bpack\(['"]H\*['"],[^@#%]{9,400}\breturn\h*strrev\(gzinflate\([^;]{1,30};[\s\}]+(?:eval\()+\w{1,9}\(['"][^'"]{999,6000}['"][\)\s]+;\s*(?:\?>|\Z)(?<X2202020>)|\s+unlink(?:\(['"](wp\-config\.php)['"]\);\s*copy\(['"][^'"]{2,20}\.php['"],['"]\98['"]\);(?<X2181113>)|\h*\(__FILE__\);[^:]{0,99}\$x.domains?[\h=]+explode\h*\([^\?;]{2,20}(?:pill|med|drug|rxfactory)(?<X2178383>)))|\w[^/]{4,49}>function\h+(\w{1,40})(\(\w{1,40}\))\{var\h+(\w{1,40})=document\.getElementById\102;(\103\.value)=btoa\(\104\)[^\?]{1,99}<\?(?:php)?[^\?]{1,199}\bfwrite\(fopen\([^;]{1,99},\w{1,40}\(\$_[GPSRC]\w{2,6}\[[^\?]{1,199}<form\b[^>]{1,99}\bonsubmit=['"]\101\([^\}]{1,499}</form>['"];\}{1,2}(?<X1175600>)|form\b[^\?]{1,499}<\?[^\?]{0,199}(\$\w+)(=['"]file_)pu(t_contents['"];)(\$\w+)\107ge\108[^\?\}]{1,999}\106(\(\$_FILES\[)[^,;]+,\109\110[^;]+;\s*(?:if\([^\}\{;]+\{echo\b[^;]+;\}else\{echo\b[^;]+;\}+)?(?:\?>\s*)\Z(?<X2220690>)|html>.{100,1500}echo\(""\);\s*\}\s*\$filename = \$_SERVER\[SCRIPT_FILENAME\];\s*\?>\s*</body>\s*</html>\s*\Z(?<X2050250>)|script\s+type="text/javascript">\s*location\.replace\("http://[^"]+"\);\s*</script>\s*\Z(?<X1042541>))|[^<\?]{0,12}<\?php\s+class(_\w+)[\{\s]+function\s*\w+construct\s*\(\)\s*\{[^\}]{99,500}[\}\s]+(?:function\s*_\w+\s*\([^\)]*\)[\{\s]+[^#&\}]+\}?.{0,15}\}\s*){5}[^/\\]{99,899}(?:\b(?:public|private)\s*\$\w+=array\s*\(["'\w,]{9,99}\);){4,}(?:\w*\s*\$\w+[=\h]+['"][^'"]+['"];\s*){2,}\}\s*new\s*\114[\(\);\?>\s]+\Z(?<X2256471>)|[^\n/!\?#]{9,199}(###ex###)[^\n]{8999,}\116\h*(?:<li>\h*<a\b[^>/:]{0,99}\bhref=['"]?https?://[^>]+>[^<#\n]{0,199}</a>\h*</li>\h*){3,}###link###\s*\Z(?<X2219454>))
\A(?:\<\?php\s*(\$\w{1,40})\h*=\h*file_get_contents\(['"]https?://[^'"]{9,99}['"]\);\s*(\$\w{1,40})\h*=\h*fopen\(['"][^'"]{1,99}\.php['"],[^;]{1,9};\s*fwrite\(\2,\h*\1\);\s*fclose\(\2\);\s*(?:\?>|\Z)(?<X1130723>)|\a*<\?php[^\{\?]{0,99}\bby\h*mr\.Combet\h*\W\h*one\h*hat\h*cyber\h*team\b[^\?\{]{9,199}\becho\h*eval\b(?<X2210510>)|\h*<(?:\?[ph\h]*\$\w{1,40}\h*=\h*\d+[;\s]*\$GLOBALS\[[^\?]{99,999}(\$\w{1,40})\h*=\h*Array\(\s*['"]\w+['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\5\h*\);\s*\}\s*elseif\s*\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*@?eval\h*\(\h*\6[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}(?<X2266180>)|script>document\.location=['"]https?://[\w\-]{1,40}\.com/[^/'"]{1,40}/?['"]</script>\h*\Z(?<X2189872>)))
\A\s*(?:#(?:!(?:(/bin/bash)\s+\((?:(?:wget|curl)\s*-(?:U|A)\s*Mozilla/(?:wget|curl)[^:]{0,20}(https?://[^\|]{9,40}\.php)\s*\|\|\s*){1,2}python\s+-c\s+['"]from[^'"]{9,99}['"]\2[^\}]{9,99}\}\s*\)\s*\)\.read\(\)\);\s*['"]\)\s*\|\s*\1\s*rm\s+-rf\s+\$0\Z(?<X1127590>)|(?:/usr)?/s?bin/bash\b[^&\+]{9,99}\bwget\h+\-O\h+(/usr/bin/(\w{1,20}))\h+https?://api\.licensehosts\.com/api/elf/[^>\s]{9,30}\5\h*(?:&\h*>+\h*/dev/null|>+\h*/dev/null\h*\d\h*>\h*&\d);?\s*chmod\h+\w*\+x\h*\4(?<X2180760>)|/[^\.>\?#]{1,99}\./\w{1,40}\b[^\?]{1,499}\bnohup\h+[^\s]{1,40}\h+(?:[^$>&\?\v]{0,99}\-\-(?:donate\-level|http\-(?:host|port))=){3}[^\?\$]{1,99}\becho\h+\$!\h*&?>+\h+[\w\.\-]{1,40}\s*\Z(?<X2181671>)|/bin/bash(?:[^\?%<>]{99,200}cd\h+\$\{[^\}]+\}/[^;]+;\s*rm\h+-f\h+(wp\-(?:class|index\w{0,9})\.txt);\s*wget\b[^:]{0,35}\bhttps?://[^&]{9,60}/\8\h*&&\h*mv\h*\8\h+\w{1,20}\.php;(?<X2191472>)|\s+(?:\w{1,20}\(\)\s*\{[^%]{9,200}\}\s*){4,9}\w{1,20}\(\)\s*\{\s*(?:nohup|screen)[^\(]{1,20}php[^%]{99,999}new\h+Coinhive\.(?:Anonymous|User)\((?<X2137651>))|/usr/bin/p(?:erl(?:[\s#]{3,30}\bPerl\h+Dd?os\h+script\b(?<X2152030>)|[^!]{99,400}chop\s*\(\s*my\s+\$\w{1,40}\s*=\s*['"]darkCrew['"]\);(?<X2064431>)|[^$]{10,150}Xai\s+Syndicate\s+Team(?<X2059573>)|[^:]{0,50}#\s*Coded\s+By\s+General\s+Deir\s+Ezour(?<X2125901>)|[^;]{1,99}#\s*UDP\s+FLOOD(?<X2125101>)|[^>]{99,300}>\s*Ayna\.pro\W{0,4}CGI-Telnet\s*<(?<X2121611>)|[^\$]{0,50}\$\w{1,20}\s*=\s*['"][^;]{0,40}Connect.Back\s*(?:Shell)?(?:\s*mod[iy]f[yi]ed\s+)?by\b(?<X2125551>)|[^\$]{0,99}\$\w{1,20}\s*=\s*['"]CGI[-\s]Telnet\s*Version\b(?<X2126150>)|[^\$]{1,600}if\s*\(\s*length\s*\(\s*\$ENV\{['"]QUERY_STRING['"]\}\s*\)\s*>\s*0\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$ENV\{['"]QUERY_STRING['"]\};[^\.]{1,600};\s*\}\s*\}\s*\$\w{1,40}\s*=\s*\$\w{1,40}\{['"]user['"]\};\s*symlink\([^\),]{1,40},['"][^'"]{1,40}['"]\);(?<X2122821>)|[^\$]{99,400}<title>\W{0,9}Cyb[3e]r\W{0,2}DZ\s*Config\b(?<X2135320>)|[^\(]{9,300}(?:#\s*){4}\s*cgi\s*http\s*shell\b(?<X2134510>)|[^\(]{99,900}opendir\(my\s*(\$\w{1,20})\s*,\s*['"]([^'"]+)['"]\);\s*foreach\([^\)]{0,9}readdir\s+\22\)\s*\{[^\(]{1,60}(\$\w{1,20})\s*=\s*\$\w{1,9};\s*(?:symlink\(['"]\23['"]\.\24\.['"][^\.]+/(?:wp-)?Conf(?:ig|igure|iguration|ig\.inc)?\.php["'],\24\.['"]-[^\.]{1,20}\.txt['"]\);\s*){10}(?<X2134900>)|\b[^%]{99,500}<title>[^%]{99,500}\{\s*\((\$\w{1,20})\)=[^;]+;\s*(\$\w{1,9})=\w{1,9}\{pwd\};\s*\$\w{1,20}=\27\.[^\.]+\.\26;[^\(]{0,20}(?:symlink\([^\)]{9,99}\.txt['"]\);\s*){5}(?<X2133103>)|\b[^:;]{0,40}\b(use)\h*MIME::Base64;\s*\29\h*(Compress::Zlib);\s*eval\(\30::memGunzip\(decode_base64\(['"][^'"]{999,3999}['"]\)\)\);\s*\Z(?<X2174761>)|\b[^\$]{1,499}my\h*\$alfa\w{0,12}\h*=\h*['"]ALFA\w{0,12}['"];\s*eval\h*\(\h*Compress::Zlib::memGunzip\h*\(\h*decode_base64\h*\(\h*['"](?<X2176111>)|\b[^\{\}]{99,400}<title>\h*Priv(?:8|ate)\b[^\?&]{99,400}\bsymlink\h*\((?<X2175810>)|\s*[^;]{1,200}use\s+strict;\s*undef\s+\$modules::Module::var;\s*my\s+\(\$Password,[^\)]{1,200}\$WinNT,\$NTCmdSep,\$UnixCmdSep(?<X2057090>)|\s*[^\(]{1,40}\s*opendir\(\s*my\s(\$\w{1,40})\s*,\s*['"](/var/www/vhosts/)['"]\s*\);\s*foreach\(\s*sort\s*readdir\s*\35\s*\)\s*\{\s*my\s\$\w{1,40}\s*=\s*\d+;\s*\$\w{1,40}\s*=\s*\d+\s*if\s*-d\s*(\$_);\s*(\$\w{1,40})\s*=\s*\37;(?:\s*symlink\(['"]\36['"]\.\38[^\)]+['"]\)\s*;)+\s*\}(?<X2058510>)|\s*use\s+Socket;\s+print\s+['"]Data\s+Cha[o0]s\s*Connect\s+(?:Back\s*)+door(?<X2120500>)|\s+-w\s*my\s+\$Password="\w+";\s*\$\w+\s*=\s*['"](?:\d+;)(?<X2046151>)|\s+use\h+(Socket);\s*\$ARGC\h*=\h*@ARGV;[^\_\-&]{99,300}\b\42\h*\(crazy\h*,\h*PF_INET\h*,\h*SOCK_DGRAM\h*,\h*\d+\);(?<X2168340>))|ython(?:[^:]{1,20}ChickenLittle\s+Shell(?<X2059652>)|[^:]{1,40}sec\s*(?:4|for)ever\s+shell(?<X2060480>)|[^\*\+\[]{99,200}(\w{1,20})\h*=\h*form\.getvalue\([^\)]+\)[^<\+\*]{9,200}\+['"]<pre>['"]\s*(child_std)in,\h*\47out\h*=\h*os\.(?:popen\d?|system|exec\w{0,3})\(base64\.b64decode\(\46(?<X2155151>))))|[^\v]{1,49}/perl[^@]{9,299}\b(socket)\h*\(\h*\49,\h*PF_INET,\h*SOCK_STREAM[^;]{1,49};\s*connect\h*\(\h*\49,[^;]{1,99};\s*(?:open\h*\(\h*STD(?:IN|OUT|ERR),\h*['"]>&\49['"]\h*\);\s*){3}system\h*\(\h*['"][^\s'"]{1,49}/(?:ba)?sh\b(?<X2149380>)|\h*Coded\h*by\h*Sole[^\.]{0,99}\bDirectoryIndex\h*solevisible\.(?:php\d*|p?html?)\b[^#]{0,99}\bReadmeName\b(?<X2227162>))|%pdf[\d\-]+<\?[ph\s]+class\h*(\w{1,20})[\{\s]+function\h*_+construct\(\)[\{\s]+\$\w{1,20}[\h=]+\$this\->[^\-]{1,9}\->(\w{1,20})[^\?#&\*]{4000,}\bvar\h*\$\53[\h=]+['"][^'"]{99,400}['"];[\}\s]+new\h*\52\(\);\s*(?:\?>)?\s*\Z(?<X2225540>)|(<!DOCTYPE (HTML)>)<\56[^>]{1,99}>\s*<(head>)\s*<(body>)\s*<(script)\h+src\h*=\h*['"]https?://goo\.gl/U5ny7C['"]>\h*</\59>\s*</\58\s*</\57\s*</\56>\s*\55[^\}]{99,999}progid:DXImageTransform\.Microsoft\.gradient\(startColorstr(?<X2145241>)|(<\?php)\h+(?:/\*(?:[a-z\h]{5,60}\*/\?>\s*\61[^://]{200,900}\bcurl_setopt\h*\([^,]{1,20},\h*CURLOPT_URL,\h*['"]https?://[^\.]{1,15}(?:pill|med|drug)shop\.\w{2,6}[^\)]+\);[^\+]{200,700}\bfile_put_contents\h*\([^;]+\);\s*\w{1,20}\(['"]chmod\h*\+x\b(?<X2178370>)|\h*\w{20}\h*\*/\s*\?>\s*\61\s*(\$\w{1,20})\h*=\h*\$_(SERVER)\[['"]\64_ADDR['"]\];\s*\63\h*=[^\?\}@]{99,600}\}\s*if\(\$_[GPRSC]\w{2,6}\[\63\]\)\s*\{\s*(\$\w{1,20})=['"]var\h+\w{1,20}\h*=[^"\$#]{400,2000}["];\s*echo\h+['"]\65['"];\s*(?:exit|die)[^;]{0,9};\s*\}\s*echo\h+["']<scr[^;]{9,99};\?>(?<X1163331>))|@?file_put_contents\(['"][^'"]{1,20}['"]\h*,\h*['"]\61\h+@?extract\h*\(\$_[GPRSC]\w{2,6}(?:\[[^\]]+\])?\);\s*\$\w{1,20}\((\$\w{1,20})\h*,\h*\$\w{1,20}\);\s*@?\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]?\67['"]?\)?;\s*\?>['"]\);\s*(?:\Z|\?>)(?<X1155330>))|(<\?php\s*echo\h*['"]\W{1,20}\.(rand\(0,\d+\))\.[^\?]{1,20}\?>)[^#]{1,199}(?:\$\w{1,40}\h*\.=\h*['"]\w{1,9}\d?\s*:\h*['"]\h*\.\h*\$_POST\[["'][^;]+;\s*){3}[^\?]{1,399}\?>\s*\69[^>]{1,49}>\s*window\.top\.location\.href\h*=\h*[^\.]{1,20}\.php\?sessionid[^\(]{1,20}(?:md5|sha[1256]{1,3})\(\70[^#]{1,99}\69(?<X2180742>)|(?:(<\?php)\s*/\*[^\*\n]{1,49}\*/\s*\?>){1,2}\72[^\{]{99,299}if\(\s*\$_[GPCSR]\w{2,6}\[\s*['"]\w+['"]\s*\]\s*\)\s*\{[^\}\{]{1,99}\bcopy\(\s*(\$_FILES\[\s*['"]\w+['"]\s*\]\[)['"]\w+['"]\s*\]\s*,\s*\73\s*['"]\w+['"]\s*\][\)\s]{2,9}(?<X2131200>)|(?:<\?[ph\s]*)?(\w+)\(['"]YTo[^'"]+['"]\);function\s*\75(\(\$\w+\))\{list\([^\)]*(\$\w+)\b[^=]+=unserialize\(base64_decode\76\)+;(\$\w+)=file_get_contents\((\$\w+)\);[^\?]{1,199}(\$\w+)=str_i?replace\([^,]+,[^,]*\77\b[^,]*,\78\b[^\?]{1,199}\bunlink\(\79\);file_put_contents\(\79,\80\);touch\(\79\b[^;]+;\}\s*(?:\?>\s*)?\Z(?<X2226061>)|(?:<a\h+href=['"]?http?://[^>]+>[^</]{0,49}</a>\s*(?:&nbsp;\s*)?){1,10}<\?[ph\s]+(?:\$\w+[\s=]+['"][^'"]+['"];\s*){2,}(\$\w+)[\s=]+base64_decode\s*\([^;]+;\s*\$\w+[\s=]+(?:\82[\[\{]\d+[\]\}]\s*\.\s*){10}[^#]{9999,}\bunset[\s\(]+(?:\$\w+[\s,]+){4,}\$\w+[\s\)]+;\s*@?(?:exit|die)\b[^;]*;[^\n\w\$]+\$[^\(;\?>]+\(\);\s*\?>(?<X1206150>)|(?:<a\s+href=['"](\w{1,40}\.html?)['"]\h*>\s*\84\s*</a>\s*(?:<br\s*/?>\s*)?){9}[^\?:\$\+%!\-\+&\*#@\{\}\(\),\|;]{65000,}<a\s+href=['"](\w{1,40}\.html?)['"]\h*>\s*\85\s*</a>\s*(?:<br\s*/?>\s*)?\Z(?<X2170731>)|(?:window\.location\.(?:replace\(|href=)['"]https?://(?:\w{1,19}\.)?cartoonmines\.com/[^'"]+['"]\)?;){2}(?<X1233550>)|(Order\s+allow[\s,]+deny\s*)Deny(\s+from\s+all)\s*<(FilesMatch)\s+['"]\^\((?:[^\)]{0,199}\.php\d*\|){3}[^>]+>\s*\88\s*Allow\89\s*</\90>\s*(?:ErrorDocument\s+40[43]\s*['"][^\n]{0,499}<meta\s+http\-equiv=['"]?refresh['"]?\s+content=['"]\d+;\s*URL=https?://[^:@]{1,199}>[\s'"]{0,9})+\Z(?<X2216340>)|/(?:/\s*Some\.devices\.are\.designed\b[^@\*]{499,1499}\bfunction\s+setCookie\([^@]{99,999}//\s*Finally,\s*every\b[^/;\*\{\(@=]{1,99}\bsoftware\.patents\.(?<X1155292>)|\*\w{5,50}\*/\s*<\?(?:php|=)?\s*(\$_\w{1,9})\h*=\h*chr\(\d{1,3}\)\.[^;]{9,50};\s*(?:(\$_\w{1,9})\h*=\h*(?:\93\(\d{1,3}\)\.){9}[^;]{9,99};\s*){2}(\$_)\h*=\h*\94\(,\$_\w{1,9}\);\s*@?\95\(\);\s*(?:\?>|\Z)(?<X1156321>))|;\(function\([^\)]+\)\{\w=\w\.createElement\(\w\);\w=\w\.getElementsByTagName\([^\}]{1,99}\}\)\(window,document,['"]script['"],['"]https?://[^/]+\.asi\.services/[^'"]+['"]\);(?<X1234370>))
\A\s*<\?(?:(?:php|=)\s*if\h*\(\h*\$_GET\h*\[[^\]]+\]\h*\D{2,3}\h*['"][\w\s]{1,40}['"][\s\)]+\{\s*@?(?:eval|assert)\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*){1,5}['"][^'"\v\}]{299,999}['"][\h\)]+;\s*\}\s*\?>(?<X1161922>)|(?:php|=)\s+(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\2\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\2\);\s*\}[^\?>]{0,40}\}\s*(?:\?>|\Z)(?<X1153320>)|.{0,40}\$ipv?[\s=]+(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;\s*(?:\$\w{1,40}\s*\.?=[^;]{1,200};\s*){3,8}@?mail\([^)]{1,80}\)\s*;\s*(?:\?>|\Z)(?<X2052314>)|[=ph\s]+@null;\s*(\$\w+)[\h=]+['"](?:\\x[a-z0-9]{2}){100}[^'"]{9999,}['"];\s*(\$\w+)[\h=]+['"](?:\\x[a-z0-9]+){9,99}['"];\s*@?eval[\(\h]+['"]\?>['"]\.\6[\(\h]+\5[\)\h]+;\s*(?:\?>)?\Z(?<X2226940>)|[^;\$\(\{!,\?<>'"]{0,49}\berror_reporting[\h\(]+(?:0|NULL|False)[\h\)]+;[^\n\$\r]{0,199}\bdefine[\h\(]+['"]\w+['"][\h,]+__FILE__[\h\)]+;\h*if[\h\(]+!(function)_exists[\h\(]+['"]([^'"\w]{1,199})['"][\h\)\{]+\8\h+\9\h*\([^\n\r@]{1,4999}\beval\h*\([^\n\r]{19999,};\s*(?:\?>\s*)?\Z(?<X2220320>)|[^;\(\)/]{49,}//[^/'"\$;\(\)\s]{0,19}\b(?:fb\.me|facebook\.com)/chlboo9\b(?<X2213610>)|[^\$;]{0,99}\$(xNot)\d?[=\s]+['"][^\(;]{600,4000};\s*@?eval[\s\(]+(?:\w+[\s\(]+)+\$\12[\s\)]+;\s*(?:\?>\s*)?\Z(?<X2207291>)|[^\$\?><=]{9,99}\?>\s*<(form)\s+method\s*=\s*['"]POST['"][^\?]{69,99}?</\14>\s*<\?[ph\s]+(?:echo\s*)?(?:\(\s*)?@?copy[\s\(]+(\$_FILES\[['"][^'"]{1,40}['"]\]\[)['"][^'"]{1,40}['"]\][\h,]+\15[^;]{9,60};\s*(?:\?>|\Z)(?<X1057081>)|[^\$]{0,199}\berror_reporting[\h\(]+(?:0|Null|False)[\h\)]+;[^\$]{0,499}://github\.com/EagleTube\b(?<X2216280>)|[^\]]{0,600}\$(?:login|user|uname|username|email)\s*=\s*\$_POST\[[^\]]+\];\s*\$(?:pw|passwd|psw|password|pwd)\s*=\s*\$_POST\[[^\]]+\];[^\?]{0,149}\$message\s*[\.\+]?=[^\?]{90,999}\bmail\s*\((?<X2280180>)|[hp\s]*error_reporting[\(\s]+0[\)\s]+;\h*\w+['"]<form\h*method[\h=]+['"]POST['"]\h*enctype[\h=]+["']multipart/form-data['"]>[^\$\?\[]{9,99}<\s*/form>['"][\s;]*@?(?:move_uploaded_file|copy)[\h\(]+\$_FILES\[['"]\w['"]\][^;]*;\s*echo[\s\(]*['"]\s*<a\s*href[\h=]+['"][\h\.]+\$_FILES[^;]*;(?<X2264810>)|[hp\s]+(\$\w+)[\s=]+['"]https?://[^'"]*(?:se(?:ks|xy?)|porno?|escort[sz]?)[^;]+;\s*if\s*\([^\}\{;]+\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;\{\}]+\{[^\}]+\bheader[\s\(]+['"]Location:\s*(?:['"][\s\.]+)?\20['"]?[\s\)]+;\s*(?:exit|die)\b[^;]{0,19};(?:\s*\})+[^\?\{=\$]{0,49}\?>(?<X1202860>)|[hp\s]+@?require(?:_once)?\h*['"](?:images?|imgs?)/\w{1,3}\.(?:png|jpe?g|ico)['"]\h*;\s*(?:\?>|\Z)(?<X1189630>)|[hp\s]+[^\$;]{1,499}\bphpscam\.com\b(?<X2202960>)|[ph=\s]+@?null;[^\(]{0,199}(\$\w{1,15})[\h=]+\$\w{1,15}\([^\)]+\);\s*(\$\w{1,15})[\h=]+(?:\24\{\d+\}\.){3}[^;]+;\s*[^\(]{99,199}\25[\h\.=]+(?:\24\{\d+\}\.){3}[^;]+;\s*eval\(\25\(['"][^'"]{9999,}['"]\)\);\s*(?:\?>|\Z)(?<X1210480>)|[ph=\s]+false;\s*parse_str[\s\(]+['"]\d+=%[^&=;'"]+&[^;]+;\s*(\$\w{1,40})\[\d+\][\s\(]+\27\[\d+\][\s,]+(array)\s*\(\)[,\s]+\28\s*\(\s*['"][^'"]*['"]\s*\.\s*\27\[\d+\][\s\(]+\27\[\d+\][\s\(]+\27\[\d+\][\s\(]+['"]=?=?[a-z\d/\+]{99,}['"][\s\)]+\.\s*['"][^'"]*['"][\s\);]+(?:\?>\s*)?\Z(?<X2202641>)|[ph@\s]*require(?:_once)?\s*__DIR__\s*\.\s*['"]/filter\.php['"][;\s*](?:\?>|\Z)(?<X1273460>)|[ph@\s]+(?:(?:eval|assert|system|shell_exec|exec|popen|passthru|pcntl_exec)\([^\)]+\);){40}\s*[^\?\$=<>\{\}]{9,9999}exit[^;]{0,9};?\s*(?:\?>|\Z)(?<X1061184>)|[ph@\s]+include\s*['"][^'"\.]+\.(?:png|jpe?g|ico)['"]\s*;(?:\s*\?>)?\s*\Z(?<X2198350>)|[ph\h@]*require(?:_once)?[\(\h'"]+/home\d*/[^/\n]+/[^'"\n]+/[^'"\n]{1,40}\.txt['"\)\h]+;\s*/\*\s*[a-f\d]{32,64}\s*\*/\s*\?>(?<X1219571>)|[ph\h]+if[\h\(]+strpos[\h\(]+\$\w+,\h*['"]\.php['"][\s\)]+\{\h*\$(main_shell)[\h=]+\$[^;]+;\h*(\$\w+)\[['"]\34['"]\][\h=]+\$\34;\h*\}\h*else\h*\{\h*\$\34[\h=]+[^\n]{99,599}\bgetServerCont[\h\(]+\$\w+,\h*\35[\h\)];\h*\}[^\?]{0,19}\?>(?<X1238610>)|[ph\s=]*(?:\$_+\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]+['"]\s*;\s*)+(\$\w{1,40})\s*=\s*['"]\\x[a-f\d]{2}[\\x[a-f\d]{999,}['"]\s*;\s*@?eval[\s\(]+['"]\?>['"][\s\.]+\$\{['"][\\xa-f\d]{4,}+[""]\}(?:[\s\(]+\$\{['"][\\xa-f\d]{4,}+['"]\})+\(\37[\s\)]+;[^=]{0,499}\Z(?<X1225190>)|[ph\s=]+(\$\w+)[\h=]+['"]PD9waHAK[^'"]{600,1500}['"];\s*\?>\s*<\?[ph\s=]+@?eval[\h\(]+['"]\?>["'][\h\.]+[\h\(]*base64_decode[\h\(]+\39[\h\)]{2,3};\s*__halt_compiler[\h\(\)]{2,6};\s*\?>\s*\Z(?<X2232021>)|[ph\s@=]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*base64_decode[\s\(]*['"][^'"\$]{2,40}['"][\s\);\?>]*\Z(?<X2266472>)|[ph\s@]*(\$\w{1,40})[=\s]+['"][^\v]{40,199}['"]\s*;\s*(\$\w{1,40})[=\s]+\42\[\d+\](?:[\.\s]+\42\s*\[\d+\])+\s*;\s*(\$\w{1,40})[=\s]+\42\[\d+\](?:[\.\s]+\42\s*\[\d+\])+\s*;\s*@?eval[\s\(]+(?:(?:\43|\44)[\s\(]+){2,}\42\[\d+\](?:[\.\s]+\42\s*\[\d+\])+[\s\)\?>;]+\Z(?<X2221590>)|[ph\s@]*(\$\w{1,40})\s*=\s*strrev\s*\(['"\.base64_dcogztunmprs13v]{9,52}\)?\s*;\s*@?eval\s*\(\46\([^\)]{1,199}\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1132332>)|[ph\s@]*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*__DIR__[\h\.]+['"][^'"\$]+\.txt['"];\s*/\*\s*[a-f\d]{14,64}\s*\*/\s*\?>(?<X1224105>)|[ph\s@]*require_once[\(\s'"]+/tmp/[^'"]+['"][\)\s]*;\s*(?:\?>|\Z)(?<X1209090>)|[ph\s\(@]*include(?:_once)?\s*\176\s*uRlDeCoDe\s*\(\s*['"]%[%a-f\d]{9,}['"][\)\s]+\.\s*__filE__(?<X2266240>)|[ph\s]*(?:(?:error_reporting|set_time_limit|ignore_user_abort)\([^;]+;){0,3}function\s*is_https\(\)\{[^@]{999,3999}(?:\bstri?str\(\$\w{1,40},['"]getcontent(\d{3})page['"]\)+\{[^\}/]{0,499}\bheader\(['"]HTTP/[12\.]+\s+\51\b[^\}]{1,199}\bexit\b[^;]{0,19};\}[^\{;\$\?>]{1,19}){3}\?>(?<X1235460>)|[ph\s]*(?:\$\w{1,20}[\h=]+['"]?(?:\w|\\|chr\(|\.)[^'"]{0,9}['"\)]\.[^;]{9,};\s*){5}[^\^\n]{99,999}\barray_slice\b[^\?#\n]{99,9999}@\$\w{1,20}[\h\(]+(\$\w{1,20})[^\)]+\);\s*echo[^\(]{2,40}\bsubstr[\h\(]+\53[,\h]+strlen[^;]+;\s*(?:exit|die)\b[^;]*;[\}\s\?>]+\Z(?<X2241011>)|[ph\s]*(?:\$\w{1,40}\s*=\s*['"][^'"]+['"]\s*;\s*)?\$\w{1,40}\s*=\s*['"]https?://\d+\.\d+\.\d+\.\d+[^;]+;\s*function\s*\w+\s*\([^\n]{999,}\becho\s*\$\w{1,40}\s*;\s*(?:exit|die)\b[^;]*;[\s\}]+else\s*\{\s*@?header[\(\s]+['"]HTTP/\d+\.\d+\s+404[^'"]*['"][\)\s;\}]+(?:\?>|\Z)(?<X1231140>)|[ph\s]*(\$\w+)=['"]https?://['"]\.\$_SERVER\[['"]HTTP_HOST['"][^;]+;(\$\w+)=file_get_contents\(\56\);(?:\57=preg_replace\([^;]+,\57\);){4}[^#@&]{1,1999}\$\w+=['"](https?://[^'"/]+/)[^;\?]{0,99}\.php\b[^#:/@]{1,499}\becho\s*['"]<script\b[^>]{0,99}\bsrc=['"]?(?!\58)https?://[^;]+;\}else\{echo\s*['"]<script\b[^>]{0,99}\bsrc=['"]?\58(?<X2233392>)|[ph\s]*(\$\w+)=file_get_contents\(['"]/home/[^;]{1,199};(\$\w+)=\w+\([^;]{0,99}\60\b[^;]{1,99};eval\(\61\);(?:\?>|\Z)(?<X1226950>)|[ph\s]*(\$\w+)=range\([^;]+;(\$\w+)=\$\{(?:\63\[\d+\]\.)+\63\[\d+\]\};if\(in_array\(gettype\(\64\)[^;\{]{1,199}\{(?:\64\[\d+\]=\64\[[^;]{1,199};)+\64=\64\[[^;\(\}]{1,199}\(\64\[[^;]{1,199};\64\(\);\}\s*(?:\?>|\Z)(?<X1211460>)|[ph\s]*(\$\w+)=urldecode\(['"][^;]+;\$\w+=(?:\66\[\d+\]\.){3}[^@#:/\*]{999,9999}\66\[\d+\]\.\66\[\d+\];(\$\w+)=['"][^@]{4999,14999}=\w+\(['"]https?://google\.co(?:m|\.jp)['"/][^\?]{1,199}\bheader\(\$\w+[\);\}]+echo\s*\$\w+\[[^;]+;(?:die|exit)\b[^;]*;\}*\w+\(\67\);\s*(?:\?>|\Z)(?<X1228770>)|[ph\s]*(\$\w+)[\h=]+['"][^'"]+['"];\h*function\h*(\w+)[\h\(]+\69[\h\)\{]+\$\w+\h*=[^\?\n]{99,2999}\bforeach[\h\(]+\$_POST\h*as\h*\$\w+\h*=>\h*(\$\w+)[\h\)\{]+[^\{]{0,99}\{\h*\71[\h=]+\70\(\71\);[^\?\n]{0,550}\bdie[\h\(\);\}]+\Z(?<X2259773>)|[ph\s]*(\$\w+)[\h=]+\$(?:\{['"]_COOKIE['"]\};\s*if[\h\(]+isset[\h\(]+\73\h*\[[^\{]+\{\s*\$\w+[\h=]+\73\h*\[[^\}]{0,199}(\$\w+)[\h=]+__DIR__[\h\.]+\$\w+[\h\(]+\$\w+[\h\(]+\73\h*\[[^\]]+\][\h\)]+;\s*\$\w+[\h\(]+\74[\h,]+\$\w+[\h\(]+\$\w+[\h\(]+\73\h*\[[^\]]+\][\h\)]+;\s*include[\h\(]+\74[\h\)]+;[^\}]{0,99}\}\s*\Z(?<X2236972>)|_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\h\(]+\73\h*\W{2,3}['"]\w{32,64}['"][\h\)\{]+[^\n\?]{9,399}\bfile_put_contents[\h\(]+[^\)]+\);\h*(chmod)[\h\(]+[^\n\?]{0,199}\bmkdir[\h\(]+(\$\w+)[\h\)]+;\s*\76[\h\(]+\77,\h*\d+[\h\)]+;[^\}]{0,99}[\}\s]+(?:\Z|\?>)(?<X1251341>)|_COOKIE[\s;]+(\$\w+)[\h=]+['"][^'"]+['"][\s;]+if[\h\(]+\73\[\79\[[^\{]+\{\s*eval[\h\(]+base64_decode[\h\(]+str_rot13[\h\(]+\73[\h\[]+\79[\h\[]+\d+[\]\)\h]+;[\s\}]+(?:\?>|\Z)(?<X2239071>)))
\A\s*<\?(?:[ph\s]*(\$\w{1,15})\h*=\h*(\$_SERVER\[)[^\]]+\];\s*(\$\w{1,15})\h*=\h*['"]<script[^;]+;\s*if\h*\(\h*strpos\h*\(\h*\1,\h*['"]google['"][^\}]{9,499}\}\s*if\h*\(\h*stristr\h*\(\h*\2[^\{]{1,49}\{\s*echo\h*\3;\s*\}\s*(?:\?>|\Z)(?<X1192211>)|[ph\s]*(\$\w{1,25})[\h=]+['"](?:[^'"]+['"];\h*\$inter_domain[\h=]+['"]https?://[\d\.]+/['"][\h\.]+\5[\h\.]+['"/]+;[^\n]{999,4000}\bstr_i?replace\(['"]\.xml["'],['"]{2},(\$\w{1,25})\);\h*\}\h*(\$\w{1,25})\[[^\]]+\][\h=]+\6[^\n]{999,2000}\bgetServerCont\(\$\w{1,25},\h*\7\);\h*echo[^\}]+\}\s*\?>(?<X1226160>)|[^;]+;\s*\$\w{1,25}[\h=]+(?:['"]f|\5[\h\(]+\d+[\h\)]+)[^\?]{0,999}\b_COOKIE;\s*(\$\w{1,25})[\h=]+array_merge[\h\(]+\9[\h,]+\$_[GPRSC]\w{2,6}[\h\)]+;[^\?\}]{0,699}\bphpversion[\h\(\)]+,[^#]{0,499}\5[\h\(]+\d+[^\}]+\}\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230484>))|[ph\s]*(\$\w{1,25})[\h=]array\((base64_decode)\([^\)]+\),\12\([^\)]+\),\12\(strrev\(str_rot13\(explode\(\12\([^\)]+\),file_get_contents\(__FILE__[\)\[\]\d]+;[^\?]{0,199}\beval\(\11\[\d+\]\)\),\11\[\d+\]\);\s*exit\(\);\s*\?>=[0-9A-z/\+\-=:]{6000,20000}\Z(?<X1227530>)|[ph\s]*(\$\w{1,40})[=\s]+explode[\(\s]+(base64_decode)[\(\s'"]+Pz4=?['"\),\s]+file_get_contents[\(\s]+__FILE[_;\s\)]+(\$\w{1,40})[=\s]+array[\(\s]+(?:\15[^,\$;]+,)+\15[\s\(]+(?:str\w+[\(\s]+)+\14\[\d[^\(]{9,99}preg_r\w+[\(\s]+\16\[\d+\][,\s]+(?:(?:serialize|eval)[\(\s]+)+\16\[\d[^;]+;\s*exit[\(\);\s]*\?>\s*=[\w\d\+/]+\s*\Z(?<X2229402>)|[ph\s]*(\$\w{1,40})[=\s]+fopen[\(\s]+['"][^'"]{1,19}\.txt['"][,\s]+['"]a['"][\)\s;]+session_start\s*\(\);\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{0,99}\$\w{1,40}[=\s]+gethostbyaddr[\(\s]+\19[\)\s;]+fputs[\(\s]+\18\s*,[^;]+;\s*fclose[\(\s]+\18[\)\s;]+header[\(\s]+['"][^'"]*['"][\)\s;\?>]+\Z(?<X2226760>)|[ph\s]*(\$\w{1,40})[=\s]+rtrIM[\(\s]+['"][^'"\$]+['"][\)\s]+;\s*@?fiLe_PuT_cOnTeNtS[\(\s]+\21[,\s]+Base64_DecOdE[\(\s]+imPlOde[\(\s]+arRAy_SLIcE[\(\s]+filE[\(\s]+__FIle__[\)\s,\d;]+require(?:_once)?\s*\$\w{1,40}\s*;\s*/\*\s*PD9[^\*]{99,}\*/\s*\Z(?<X2224600>)|[ph\s]*(\$\w{1,40})[\s=]+(?:\w{1,40}\s*)?['"\(]{1,2}[^'"\$]{1,40}['"\)\s;]+(FILe)_pUt_COnteNTS[\(\s]+\23[,\s]+BAsE64_DeCodE[\(\s]+(?:JoIn|implode)[\(\s]+aRRAY_(?:sLicE|map)[\(\s]+\24[\(\s]+__\24__[\)\s]+[,\s]+\d+[,\s]+\d+[\)\s;]+(?:include|require)(?:_once)?\s*\23[\s;]+/\*\s*PD9[^\*]{99,}\*/[\?>\s]*\Z(?<X2211702>)|[ph\s]*(\$\w{1,40})\s*=(?:[\s'"]*create_function['"\s;]+\$\w{1,40}\s*=[\s'"]*;\s*\$\w{1,40}[\s=]+\26[\s\(]+\$\w{1,40}[,'"@]+eval[\s\(]+(array_)pop[^=]{9,199}=\s*\27merge[\s\(]+(?:\$_[GPRSC]\w{2,6}[,\)\s]+){2,};\s*(\$\w{1,40})[\s=]+isset[\s\(]+\$\w{1,40}\[[^\]]+\][^;]+;\s*@?eval\b[^;\)]+\28[\s\)]+;(?:[\s'"\)]+;)?[\s\?>]*\Z(?<X2265910>)|\s*['"]['"\h\.base64_dco]{17,40}['"];\s*(\$\w{1,40})\s*=\s*['"]['"\h\.gzinflate]{12,40}['"]\;\s*@?(error_)reporting[\s\(]+(?:NULL|0)[\)\s;@]+(?:ini_set[\(\s]+['"]\31log['"][,\s]+(?:NULL|0)[\)\s;@]+)?eval[\s\(]+(?:(?:\26|\30)[\s\(]+){2}['"][a-z\d\+/]{99,}={0,2}['"][\s\);\?>]+\Z(?<X1226740>)|\s*['"]range["']\s*;\s*(\$\w{1,40})\s*=\s*\26[\s\(]+['"]\176['"]\s*,\s*['"]\s*['"][\s\)]+;\s*include(?:_once)?\s*\33\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*(?:\.\s*\33\s*\[\s*\d+\s*\+\s*\d+\s*\]\s*)+;[\s\?>]*\Z(?<X2217781>)|\s*\w+[\s\(]+['"][^'"\$]+['"][\s\);@]+(fILE_)PUT_COnTENts[\s\(@]+\26[,\s]+bAse64_DeCODe[\s\(]+join[\s\(]+ArRAy_sLicE[\s\(]+file[\s\(]+\w+[\s\(]+__\35_[\s\),]+\d+[\s,]+\d+[\s\)]+;\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\$\{\('"]{0,9}?\26[\$\}\)'"\h]*;\s*/\*\s*PD9[^\*]+\*/\s*\Z(?<X2223490>))|[ph\s]*(function)\s*(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+strtr[\(\s]+\39[,\s]+array[\(\s]+['"][\w'"=>,\s]{99}[^;]+;\s*\40[\s=]+base64_decode[\s\(]+\40[\s\);]+return\s*\40[\s;]+\}\s*\37\s*\w+[\s\(]+(\$\w{1,40})[^\}]{0,99}\bfile_get_contents[\(\s]+\41[^\}]+\b\38\s*\([^\}]+\}\s*\Z(?<X1223820>)|[ph\s]*[^\!]{0,100}(\$\w{1,40})\s*=\s*(?:\$\w{1,40}\[[\(\h]+(?:\d+[/\-\*\+\)\(]+)+\d+([\)\h]+)\]\s*\.?)+;[^\?@]{4000,9999}(\@\$\w{1,40})[=\h]+\43[\(\h]+['"]{2}\44[\s,]+[^;]{0,16};\s*\45[\h\(\)]+;\s*\?>(?<X1204202>)|[ph\s]*\$\w+[=\h]+[^\{\n]{99,1500}\{\h*if[\h\(]+strlen\b[^\}]{99,450}\}\h*\$\w+[\h=]+implode[\h\(]+['"\h]+,\h*(array_)map[\h\(]+['"][^'"]+['"],\h*\47values[\h\(]+(\$\w+)[\h\)]+,\h*\47keys\b[^\n\?]{99,899}@\$\w+[\h\(]+\$\w+,\h*\48[\h\)];\h*echo[^;]+;\h*(?:exit|die)[^;]{0,9};[\}\h]+\Z(?<X1239651>)|[ph\s]*\$\w+[\h=]+(?:['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\w+/['"];\s*(function)\h*(\w+)[\h\(\)]+\s*\{\s*exit;\s*\}\s*\50\h*curl_[^\n]{999,5000}\b(main_shell)['"]\][\h=]+\$\52;\s*\}\s*\$referer=[^\n]{199,999}\?><\?[ph\s]*\51[\h\(\)]+;\s*\}\s*\?>(?<X1249890>)|[^;]+;\h*\$\w+[\h=]+[^;]+;[^\{\n]{0,199}\{\h*class\h*(\w+)[\h\{]+public\h*function[^\n]{0,500}\b_COOKIE;\h*\$\w+[\h=]+\$_POST;\h*\$\w+[\h=]+@?\$\w+\[substr\(\54::\$\w+[^\n]{99,1500}\bnew\h*\54[\h\(\)]+;[^\?\n]{0,99}\?>(?<X1254563>)|[^;]+;\s*\$\w+[\h=]+['"]class_exists['"];[^\{]{0,199}\bif[\h(]+!\$\w+[\s\)\{]+class\h*(\w+)\h*\{[^\{]{0,199}\{\s*\$\w+[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;[^\?]{0,799}\bif[\h\(]+is_array[\h\(]+\56::\$\w+[^\}]{9,499}[\s\}]+(\$\w+)[\h=]+new\h*\56[\h\(\)]+;\h*\57[\h=]+NULL;[\s\}]+\?>(?<X1247480>)|[^\{\n]{9,599}\b(foreach)[\h\(]+array[\h\(]+(\$\w+),\h*\$_cookie,\h*\$\w+,\h*\$_post,\h*\60[\h\)]+as\h*\$\w+[\h\)]+\{\h*\59[\h\(]+\$\w+[^\n\?]{9,599}\beval[\h\(]+(?:\$\w+|\$\w+\[\d+\][\h\(]\$\w+\[\d+\])[\h\)]+;\h*die[\h\(\)]+;[\h\}]+\Z(?<X2239662>))|[ph\s]*\$\w+\h*=[^\{]{0,350}\{\s*class\h*(\w+)\s*\{[^\{]{0,199}\{\s*(\$\w+)[\h=]+\$_COOKIE;\s*\$\w+[\h=]+\$_POST;\s*\$\w+[\h=]+@?\63\[[^\n]{0,1500}\}\h*(\$\w+)[\h=]+new\h*\62[\(\)\h]+;\s*\64[\h=]+['"\d]+;\s*\}\s*\?>(?<X1249691>)|[ph\s]*\$\w+\s*=[^\?/]{0,199}\bfile_put_contents[\s\(]+[^,;]+,[^;]{0,99}\barray_slice[\s\(]+file[\s\(]+__file__\s*\)[^;]{0,99};\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99};\s*/\*\s*PD9[\w/\+\s=]+(?:\*/\s*)?(?:\?>\s*)?\Z(?<X2229902>)|[ph\s]*\$\w{1,25}[\h=]+(?:(?:['"]\w+['"]|chr\h*\()[^\?]{99,400}\bforeach[\h\(]+array[\h\(]+\$\w{1,25},\$_POST,\$\w{1,25},\$_COOKIE,\$\w{1,25}[\h\)]+as\h*\$\w{1,25}[\s\)]+\{[^\?]{99,500}\beval[\h\(]+\$\w{1,25}[^\)]+[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230991>)|(?:['"]D|chr\(\d+)[^\{]{0,500}\$\w{1,25}[\h=]+['"]phpversion['"];[^\?]{0,999}\bglob[\h\(]+\$\w{1,25}[\h\.'"/\*]+,\h*GLOB_ONLYDIR[\h\)]+;\s*if[\h\(]+count[^\?]{0,500}\bstrlen[\h\(]+\$\w{1,25}[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230490>)|(?:['"]s|chr\(115)[^\{]{0,350}\bforeach[\h\(]+array[\h\(]+\$\w{1,25},\h*\$_[GPRSC]\w{2,6},\h*\$\w{1,25},\h*\$_[GPRSC]\w{2,6},\h*\$\w{1,25}[\h\)]+as[^\?]{0,350}\beval[\h\(]+\$\w{1,25}\[[^\)]+[\h\)]+;\s*exit[\h\(\)]+;[\s\}]+\Z(?<X2230501>))|[ph\s]*\$\w{1,40}[=\s]+['"][^'"@\s]+@[^'"]{2,}\.[a-z]{2,9}['"]\s*;\s*\?>\s*<\?[ph\s]*include(?:_once)?[\(\s]*['"][^'"]+\.(?:jpe?g|png|ico|gif)['"][\)\s;\?>]+\Z(?<X2209030>)|[ph\s]*\$\w{1,40}\h*=[^\(\);]{0,9}chr[^;]+;\h*(?:\$\w+\h*=[^;]+;\h*){9,}foreach[\h\(]+\$_POST\h*as\h*\$\w+[\h=>]+\$\w+[\h\)]+\{[^\}]+\}\s*\$\w+[\h=]+implode\(['"]{2}\h*,\h*array_map[^\?\n]{0,499}GLOB_ONLYDIR[\h\);]+if[\h\(]+count[^\n\?]{0,499}strlen[\h\(]+\$\w+[\h\);]+(?:exit|die)\b[^;]*;[\h\}]+\Z(?<X2241003>)|[ph\s]*\$\w{1,40}\s*=[^;]{0,99}\bchr\s*\((?:[^;]{0,99};[^\{]{0,400}\barray[\h(]+\$\w+,\h*\$_(?:COOKIE|POST),\h*\$\w+,\h*\$_(?:COOKIE|POST),\h*\$\w+[\h\)]+;\s*foreach[\h\(]+\$\w+\h*as\h*\$\w+[\s\)]+\{[^\}]{99,600}\beval[\h\(]+\$\w+[\h\)]+;\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\?>|\Z)(?<X1248972>)|[^\{]{0,999}\bforeach[\h\(]+\$_POST\h*as\h*\$\w+\h*=>\h*(\$\w+)[\s\)]+\{[^\}]{0,499}\}\s*\73[\h=]+implode[\h\(]+['"]{2},\h*(array_)map\b[^,]+,\h*\74values[\h\(]+\73[^\?]{0,1500}\}\s*\$\w+[\h=]+\$_SERVER\[\$\w[^\}]{0,599}\becho\h*\$\w+;\s*die[\(\);\s\}]+\Z(?<X2248981>))|[ph\s]*\$GLOBALS\[['"]HASHTYPE['"]\][=\s]+['"][^'"]*['"]\s*;\s*\$GLOBALS\[['"]PASSHASH['"]\][=\s]+['"]584c19ee1bfab[^'"]+d76['"]\s*;[^`]+\bpassthru[\s\(]+\$\w{1,40}(?<X2218170>)|[ph\s]*class\s*(\S+)\s*\{\s*private\s*\$\S+\s*=\s*['"]cookie['"]\s*;\s*private\s*\$\S+\s*=\s*['"]call['"]\s*;[^\n]{40,}\}\s*(?:\$\w{1,40}\s*=\s*)?new\s*\77[^;]*;[\s\?>]*\Z(?<X2249530>)|[ph\s]*echo\s*@?file_get_contents[\(\s]+['"]https://raw\.githubusercontent\.com/[^/]+/backlink/[^'"]+\.txt['"][\)\s]+;\s*\?>(?<X1221790>))
\A\s*<(?:!DOC(?:\w+\s*(HTML)>\s*<\1\s*lang=[^><]+>\s*<(head>)\s*<meta\s*charset=['"][^<>]+>\s*<meta\s*(http)\-equiv=['"]refresh['"]\s*content=['"]0;\s*url=\3[^<>]+>\s*<(script)[^<>]*>\s*window\.loc[^'";]+['"]\3[^<>]+</\4>\s*<(title>)Loading[^<>]*</\5\s*</\2\s*<body>[<\?ph\s]*header\(['"]Location:\s*\3[^=]{9,99}\Z(?<X2284680>)|TYPE(?: html>\s*<!--\s+saved\s+from\s+url=.{200,600}https?://login\.live\.com(?<X2052000>)|[^>]{0,100}>\s*<html>\s*<head>\s*<title>\s*Hacked\s+By\b(?<X2049632>)|[^\?]{0,99}\bhref\h*=\h*['"]https?://(?:www\.)[^\.]{0,40}(jerseys)[^\.]{0,20}\.com/['"]>\h*cheap\h*(?:\w+)\h*\9[^\?]{1,49}</html>\Z(?<X2184680>)|[^\?]{1,400}<title>\s*(?:Sign\s+In\s*-)?\s*DocuSign\s*</title>(?<X2052863>)|[^\?]{1,99}<title>[^'"\?]{9,50}<form\b[^!\(\?]{9,299}<\?php\s*if\(!empty\((\$_FILES\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,15})\h*=[^=]{1,40}=\h*\13[\h\.]+basename\(\h*\12\[[^\]]+\]\);[^\{]{0,99}if\(@?(?:move_uploaded_file|copy)\(\12\[[^\]]+\],\h*\13[\)\s]+(?:\{\s*echo[^\}]{0,99}\}(?:\s*else)?\s*)+\}\s*\?>\s*\Z(?<X2143179>)|\h+HTML>\s*<html\h+xmlns\h*=\h*['"](http)s?:[^:]{1,99}<(script)\h+src\h*=\h*['"]\15s?://goo\.gl/\w{6,8}['"]>\s*</\16>\s*</body>[^\[#]{9,999}<(title>)\s*[^/]{9,99}</\17[^\[#:!]{9,999}<link\h+href\s*=\s*['"]\15s?://(?:www\.)?[^/]{0,40}(?:jersey|viagra|cialis|pharm|cheap)[^/]{0,40}\.\w{2,9}/(?<X2145982>)))|%\s*(?:Server\.ScriptTimeout=\s*\d+\s*)?UserPass\s*=\s*"[^"']+"[^:]{9,199}mName(?:title)?\s*=\s*"[^"']+"[^:]{1,299}"[^'"]{0,19}7jyewu\.cn(?<X2124911>)|(?:!Doctype\h*)?html\b[^:\\]{9,150}<meta\h+http\-equiv\h*=\h*['"]refresh['"]\s+content\h*=\h*['"]\d;\s*url\h*=\h*https?://cyb3r\-3rr0r\.com\b(?<X2183510>)|(?:\?php)?\s*(\$\w{1,40})\h*=\h*(error_reporting\h*\()\);\s*\22(?:\d|NULL|False)\);[^\|]{1,4999}\$(\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{0,99};[^\?]{1,499}\}\s*else\s*\{\s*@?file_put_contents\h*\([^,\);]+,\h*\$\23\h*\);[^\?]{1,199};\s*@?\22\h*\21\h*\);\s*\}\s*(?:\?>|\Z)(?<X1180840>)|(FilesMatch)\s+['"]\.\(php\|php5\|phtml\)\$['"]\s*>\s*(Order\s+allow[,\s]+deny)\s*Deny\s+(from\s+all)\s*</\25>\s*<\25\s+['"]\^\(index\.php\)\$['"]\s*>\s*(?:#[^</]{0,19})?\b\26\s*Allow\s+\27\s*</\25>\s*\Z(?<X2220781>)|(html>)\s*<div\h+id\h*=\h*['"][^'"]{9,99}['"]\h+style\h*=\h*['"]\h*(?:left|right|top)\h*:\h*\-\d{4,8}px\h*;\h*position\h*:\h*absolute\h*;\h*top\h*:\h*\-\d{4,8}px\h*;\h*['"]\h*>\s*<p>[^\?@\!\*\$\[\{]{99,9999}?(?:viagra|jerseys|pharm|cheap)[^\?@\!\*\$\[\{]{99,9999}?</p>\s*</div>\s*</\29(?<X1147440>)|(script)(?:[^>:\v]{0,60}\bsrc\h*=\h*['"](?:http:)?//[1-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}/[a-z\d]{1,3}\.js['"]\h*>\h*</\31>(?<X1172530>)|\b[^:>\.]{1,60}\bsrc\h*=\h*['"]https?://(?:\d*\.){3}\d*/[^'">]{2,60}/[jw]{0,2}(?:player|query)\.js['"][^>]{0,60}>\s*</\31>(?<X1161202>)|\h+(?:type\h*=\h*['"]text/javascript['"]\h*|async\h*|src\h*=\h*['"]https?://[^\?]{4,30}/\w{1,9}\.min\.js\?\w{1,9}\h*=\h*\w{1,9}&['"]){2,3}></\31\>(?<X1147743>)|\h+(?:type\h*=\h*['"]text/javascript['"]\h*|async\h*|src\h*=\h*['"]https?://[^\?]{4,30}\.(?:pl|jp|pl|in|cn|ru|su|xyz)/\w{1,9}\.js&['"]){2,3}></\31\>(?<X1148232>)|\h+(?:type\h*=\h*text/javascript\h*|src\h*=\h*['"]https?://(?:track|stats)\.[^=\?]{2,30}/\w{1,3}\.js\?\w{1,4}=\d+\h*|async\h*){2,3}['"]>\s*</\31>(?<X1157044>))|(script>)\h*var\h*(\w{1,40})[\h=]+['"]https?://(?:www\.)?sale\w+\.\w{2}/\?\w{1,9}=\w+['"];\h*window\.location\.href[\h\=]+\38;\h*</\37(?<X1192521>)|(span)\h*class[\s=]+['"][^/?]{1,150}\b(?:height|width):\h*(?:0|1)px[^\?]{1,150}\bhref[\h=]+['"]https?://(?:\w*\.)?xpsoccer\.\w*[^>]{1,5}>important\s*source[^\?]{1,20}</\40>(?<X1209161>)|(title>)[^/<]{0,20}\bRansomware\h*</\42(?<X2174990>))
\A\s*<\?(?:(?:=NULL;|php)\s*\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\][\h=]+['"][^'"]{1,90}['"];\s*\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\}[\h=]+['"][^'"]{400,2500}['"];\s*@?eval[\h\(]+(?:(?:htmlspecialchars_decode|gzinflate|base64_decode)\(){1,5}['"][^'"]{99,400}['"][\)\h]+;\s*(?:\?>\s*)?\Z(?<X2221292>)|(?:=|php)[^;]{1,40}\bnull;\s*echo\h*(@null);\s*goto[^\(]{200,900}\beval\([^\)]{9999,}[\)\h]+;\s*\2;\s*(?:\?>)?\Z(?<X2206680>)|(?:php)?[ ]{200,}if\s*\(\s*!\s*isset\s*\(\s*\$_[^\?]{40,150}\s*\?>\s*<\?(?:php)\s*\$\{[^\?]{60000,64000}['"],['"](?:\\x2e|\.)['"]\s*\);\s*\?>\s*\Z(?<X2055930>)|(?:php)?[^@]{150,350}\bJ7-@live\.com[^\(]{15,45}\bsession_start\(\);(?<X2144240>)|(?:php)?[^\?]{0,199}\bscam\h*was\h*created\h*by[^\n]{1,25}\boreoo(?<X2173161>)|(?:php)?[^\{]{1,1200}class\s+pBot\s*\{\s*var\s*\$(?<X2057294>)|(?:php)?\h*(\$\w{1,40})\h*=\h*['"][^'"]+['"];\h*function\h*(\w{1,40})\([^\)]+\)\{return[^;]{1,40};\}(?:\h*\$\w{1,40}\h*=\h*\9\((?:\8\{\d+\})[^;]{1,99};){4}[^\?\v]{999,1999}(\$\w{1,40})\h*=(?:\h*\9\h*\(){2}[^;]+\.\9\h*\(\h*\8\{\d+\}[^;]{1,49};\h*\$\w{1,40}\h*\([^\)]+\10\h*\.['"]//['"]\)+;\h*\?>(?<X1141070>)|(?:php)?\s*(?:(?:/(?:\*|/)[^\n/]{0,20}(?:/|\n))|\s+)\s*\$[O0]{6,12}=urldecode\(['"]%[^'"]{1,200}['"]\);(?:\s*\$[O0]{6,12}\.?=\$[O0]{6,12}\{?\d*\}?\.[^;]{2,};){2,9}\s*\$_\w{1,20}=__FILE__;\s*\$\w{1,40}=['"][^'"]{60000,}['"];\s*@?eval\(\$[O0]{6,12}\(['"]JF9[^'"]{1,999}['"]\)\);\s*(?:\?>|\Z)(?<X1057871>)|(?:php)?\s*(?:/[/\*][^\$;=]{1,999})?(\$\w{1,40})\s*=\s*file_get_contents\h*\(\h*['"]https?://[^;]{1,99};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"](?:\?>|<\?)[^'"]{0,19}['"]\h*\.\h*\13\h*\);\s*(?:\?>|\Z)(?<X1185400>)|(?:php)?\s*(?:@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]+/(?:anti)?b(?:ot|locker)[sz]\d*\.php['"];\s*){2}[^\?]{1,499}\bfunction\s+recurse_copy\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{(?<X2171261>)|(?:php)?\s*(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){2}[^@]{9,1499}<title\h*>[^/<>]{1,99}(?:Apple?|Samsung|Ama?zo?n)\h*(?:ID|Secure)[^/]{0,49}<\h*/title\h*>(?<X2141051>)|(?:php)?\s*(?:\$\w{1,40}\s*=\s*['"]\w{24,40}['"];)?\s*(\$\w{1,40})\s*\=\s*['"\s\.aceglpr_]{13,40}\s*\;\s*\17\s*\(\s*['"](.).{0,40}\18e\w?['"]\s*,[^\)]{30000,50000}(?:\s*\)\s*){1,5};[^;]{1,40};\s*\?>\s*\Z(?<X2055630>)|(?:php)?\s*(?:echo\b[^;]{1,99};\s*)?(\$\w{1,40})(\h*=\h*@?(file_)ge(t_contents)\h*\(\h*['"])[^'"]+(\.php['"]\h*\);\s*@?\22pu\23\h*\(\h*\$_SERVER\[\h*['"]DOCUMENT_ROOT['"]\h*\]\h*\.\h*['"])(/[^'"\./]+\.php['"]\h*,\h*)\20\h*\);\s*(\$\w{1,40})\21[^'"]+\24[^'"]+\25\26\h*\);\s*(?:\?>|\Z)(?<X1179631>)|(?:php)?\s*(?:echo|error_reporting|print(?:_r)?|var_dump)\s*['"\(][^;]{1,99};\s*(?:(?:(?:echo|print)\h*(?:\(?\h*)?)?@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*){1,5}(?:(?:echo|error_reporting|print(?:_r)?|var_dump)\s*['"\(][^;]{1,99};\s*)?\?>\s*\Z(?<X2172081>)|(?:php)?\s*(\$\w{1,40})\h*=\h*(?:@?fopen\([^;]{1,99};\s*@?fwrite\(\h*\29\h*,\h*['"](?:(?:[H][4a]|fu)ck|st[o0a4]mp|t[ou]ch)[3e]d\s+by\b[^;]{1,99};\s*@?fclose\(\h*\29\h*\);\s*(?:echo\b[^;]{1,99};\s*)?(?:\?>|\Z)(?<X1161180>)|['"]email:[^;]{1,99};\s*(?:(\$\w{1,40})\h*=\h*fopen\h*\(\h*['"][^'"]{1,99}/\.(?:cpanel/)?contact(?:info|email)['"][^;]{1,99};\s*(?:(?:echo|var_dump|print_r)\h*[\('"][^;]{1,99};\s*)?fwrite\h*\(\h*\31\h*,\h*\29\h*\);\s*fclose\h*\(\h*\31\h*\);\s*){1,2}(?:\?>|\Z)(?<X1173400>)|['"]https?://[^;]{1,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\29\h*\);\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*(?:\(\h*)?(?:@?\w{1,40}\h*\(\h*){1,4}\33[\)\h]+;\s*(?:\?>|\Z)(?<X1171240>)|\$_SERVER\[[^;]{1,99};\s*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*(\$target)\h*=\h*['"]https?://(?:[^;]{1,99}(?:\29|\35)){2}[^;]{0,99};\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\36\h*\);\s*(?:echo|print)\s*\37;\s*(?:\?>|\Z)(?<X1170630>)|file_get_contents\(\h*['"][^'"]{1,99}['"]\h*\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\h*\(\h*\29\h*\)\h*\)\h*;\s*(?:\?>|\Z)(?<X1149821>)|popen\h*\(\h*(?:\w{1,40}\h*\(\h*){1,3}\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*echo\h*fread\h*\(\h*\29\h*,\h*\d+\h*\);\s*pclose\h*\(\h*\29\h*\);\s*(?:\?>|\Z)(?<X1177280>))|(?:php)?\s*(\$\w{1,40})\s*=\s*(?:(file_)ge(t_contents)\h*\(\h*['"]https?://raw\.githubusercontent\.com/[^'"]{1,99}['"]\h*\);\s*@?\42pu\43\h*\(\h*(?:['"][^'"]+\.php['"]|\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*,\h*\41\h*\);\s*(?:\?>|\Z)(?<X1141882>)|@?file_get_contents\s*\(\s*['"]https?://[^'"]{1,99}['"]\s*\)\s*;\s*(?:var_dump|print_r|echo|eval|assert)\s*\(\s*\41\s*\)\s*;\s*(?:echo\b[^;]{0,99};\s*)?\?>(?:\s*<a\h*href[^<]{0,50}</a>)?\s*\Z(?<X2140793>)|\$_POST\[[^\]]+\];\s*if\s*\(\s*\41\s*[^\w]{2,3}\s*['"]\w{1,40}['"]\s*\)\s*\{[^\{\}]{1,600}\s*if\s*\(\s*move_uploaded_file\s*\(\s*\$_FILES\[[^\]]+\][^<]{250,999}<form\s+action=[^=]{1,40}method\s*=\s*['"]post[^\?]{300,600}</form>\s*\Z(?<X2061920>))|(?:php)?\s*(\$GLOBALS\[)(['"][^'"]{1,29}['"]\])=Array\([^\$]{1,999}function\s+(\w{1,40})\(\$\w{1,40}\)\s*\{[^:]+:\s*\47\s*\49\([^\)]{1,40}\)\s*\][^\?]+\47\s*\49\([^\)]{1,40}\)\s*\]\[[^\]]+\]\s*\((\$\w{1,40}),\50,\$_POST\);\s*\50=\47\48\[[^\]]{1,40}\]\([^;]{1,40}\);?\s*(?:\?>|\Z)(?<X1061330>)|(?:php)?\s*/[\*/][^\$\(\{;]{1,49}\bShell\b[^/\$\(;\.]{1,99}//[^/\s]{0,99}\bgithub(?:usercontent)?\.[\w\.]{2,9}/(?:n00py|leonjza)\b(?<X2172110>)|(?:php)?\s*/\*(?:[^/]{1,499}\bBypass\s+Shell\b(?<X2171520>)|[^\$\(;]{0,199}\bOffice\h+Scam(?:page)?\b[^\$\(;]{0,499}\berror_reporting\((?:0|NULL|False)\);\s*include(?:_once)?\(?['"][^'";]{0,99}\b[ab](?:ntibot|locker)[sz]?\d*\.php['"]\h*\);(?<X2178800>))|(?:php)?\s*@?(file_)pu(t_contents)\h*\(\h*['"](?:[^'"]{1,99}\.ph(?:p|tml?)\d*[^,]{0,99},\h*\55ge\56\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)\b[^;]{1,99};\s*(?:\?>|\Z)(?<X1177290>)|[^\),'"]{1,99}['"]\h*,\h*base64_decode\h*\(\h*['"]PD9[^;]{1,99};\s*(?:echo|print(?:_r)?)\h+\55ge\56\h*\(\h*['"][^;]{1,99};\s*(?:\?>\s*)?\Z(?<X1173880>))|(?:php)?\s*@?eval[\s\(]+base64_decode[\s\(]+['"]?bW92ZV91cGxvYWRlZF9maWxlKCRfRklMRVNb[^\)]+[\s\)]+(?:\?>|\Z)(?<X1197880>)|(?:php)?\s*[^\?]{1,200}=\s*@?file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);\s*\s*@?(?:eval|assert|system)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}\s*\(?\s*\$\w{1,40}\s*\)?(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1054543>)|(?:php)?\s*[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,49}\b[ab](?:locker|ntibot)[sz]?\.php['"]\h*\);(?:[^@]{99,999}<title>\s*Sign\s+in\s+to\s+your\s+M(?:i|&icirc;)crosoft\s+account\s*</title>(?<X2151201>)|[^\$]{9999,49999}&copy;\s*20\d{2}\h+Microsoft(?:\h+Corp(?:oration)?)?\b(?<X2151210>))|(?:php)?\s*[ri](?:equir|nclud)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,19}\b[ba](?:lock(?:er|_detector)|ntibot)[sz]?\.php['"]\h*\)?;\s*\$\w{1,40}\h*=\h*glob\h*\([^\?@#:&%\|<]{1,499}\bfunction\h+recurse_copy\h*\((?<X2170841>)|(?:php)?\s*\$\w{1,40}\h*=\h*['"][^\v]{999,9999}(?://[\w\-\h]{0,19}\bscp\-\d{3}\s*(?:\?>|\Z)(?<X1179273>)|\$\w{1,40}\h*\(\h*\$\w{1,40}\h*,\h*array\h*\(\h*['"]{2}\h*,\h*['"]\}['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]//['"][\)\h]+;\h*//wp\-blog\-header\h*(?:\?>\s*)?\Z(?<X2180061>))|(?:php)?\s*error_reporting(?:\((?:(?:0|NULL)\);\s*/\*\s*Loader(?:['"]?[sz])?\s*(?:Web\s*shell|pro\-hack\.ru)\b(?<X2142300>)|0\);\s*ini_set\(['"]display_errors[^\(]{5,15}if\(isset\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]\)\)\s*\{[^\$]{1,80}(\$\w{1,9})=array_pop\(@?preg_split\([^\)]{1,20}\)\);\s*echo\s*eval[^\)]{1,25}file\(['"][\w/]{9,19}\67['"]\)\)[^\}]{1,15}(?:die|exit)[^;]{0,9};\s*\}(?:\Z|\?>)(?<X1128531>))|\h*\(\h*(?:0|NULL|False)\h*\);[^@>#<%\^\+]{99,999}\bfunction\s+get.?Html\([^@>#<%\^\+]{99,999}\b[ed](?:xit|ie)[^;]{0,19};\s*(?:\}\s*)?(?:define\h*\(\h*['"]DISALLOW_FILE_\w{1,9}['"]\h*,\h*\w{1,5}\h*\);\s*){2}\s*(?:\?>|\Z)(?<X1174982>)))
\A\s*<\?(?:(?:php)?\s*function\s*(isInString1)[\s\(]+(\$\w{1,40})[\s,]+(\$\w{1,40})[\s\)]+\{\s*\2[\s=]+['"][^'"]*['"][\s\.]+\2;\s*return[\s\(]+bool[\s\)]+strpos[\s\(]+\2[\s,]+\3[\s\)]+;\s*\}\s*(\$\w{1,40})[^;\$]+\$_SERVER\[[^\]]+\][\s\)]+;\s*if[\s\(]+\1[\s\(]+\4[\h,]+['"]googlebot['"][\)\s\{\}]+else\s*\{(?<X2178222>)|(?:php)?\s*header\s*\(["'][^'"]{0,60}['"]\);\s*(?:if\s*\((\$_(?:P|G|S|C|R)\w{2,6}\[['"]\w{1,20}['"]\])\s*\D{2,3}\s*[^;]+base64_decode\(\6\);\s*\}\s*@?eval\(\6\);\s*\}\s*){0,3}if[^\{]+\{\s*@?include(?:_once)?\s*["'][^'"]{5,50}\.php['"];\s*\}\s*(?:\Z|\?>)(?<X1122431>)|(?:php)?\s*if\((?:(?:strpos\([^,]+,['"](?:google|mozilla)['"]\)\s*!?==?\s*(?:true|false)\s*\D{2,3}){1,3}[^/]{1,99}google[^<]+\bsh[3e]ll\b[^<]+</title(?<X2132451>)|isset\(\$_[GPSCR]\w{2,6}\[[^\{]{1,99}\{\bini_set\(strrev\(['"]gnitroper_rorre['"][^\?]{1,199}\bheader\(['"]Content\-type:\h*text/html\b[^@\v]{1,999}\binclude\h*\$\w{1,40}\b[^;]{0,99};(?:\s*echo\b[^;]{1,99};)?[\s\}]{0,19}(?:\?>|\Z)(?<X1184460>))|(?:php)?\s*if(?:\h*\(\h*isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\v\b@\}\?]{1,99}\bpopen\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\v\?>]{1,199}(?:\?>|\Z)(?<X1173040>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]{1,12}\]\s*==\s*['"](?:clear|remove|delete)['"]\s*\)\s*\{?\s*(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\(\s*['"][^']{0,40}[^\w]b(?:o|0)t[^\w][^']{0,40}['"]\s*\);\s*echo(?<X2052621>))|(?:php)?\s*session_start\(\);[^\$]{0,49}(?:(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){3}[^%]{999,8999}\$subject\h*=\h*['"][^'"]{0,99}\bNEW\h+(?:APPLE?|AMA?ZO?N?)\h+LOGIN\b(?<X2141080>)|(?:@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+(?:blocker|anti(?:bot)?|sc)[sz]?\d?\.php['"]\)?;\s*){3}[^\*%\|]{9999,19999}function\s*\w{1,40}\s*\(\s*(cardnumber)\s*\)\s*\{\s*(?:var\s*\w{1,40}\s*=\s*\13\.charAt\s*\(\s*\d+\s*\)\s*;\s*){4}(?<X2141041>))|(?:php)?\s+(?:@eval\h*\(\h*\$_[GPRSCH]\w{2,6}\[[^\]]+\]\h*\);\s*){2,4}(?:\?>\s*)?\Z(?<X1177220>)|(?:php)?\s+(?:\$\w{1,40}=[^;]{1,9}\^[^=]{1,9};){1,}(\$\w{1,40})=(?:\([^\)]{1,9}\^[^\)]{1,9}\)\.){2}[^=]{1,99};(\$\{\16\}\[)\$\w{1,40}\]\(\17\$\w{1,40}\]\);\s*(?:\?>|\Z)(?<X1183690>)|(?:php)?\s+(?:echo\s*[^;]{1,99};\s*)?\s*\$\w{1,40}\s*=\s*getcwd\(\);\s*echo\s*['"][^'";]{1,40}<form\s+method\s*=\s*['"]post['"][^;]{1,255}['"];\s*if\s*\(\s*!empty\s*\(\s*(\$_FILES\[[^\]]{1,40}\])\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\19[^\}]{1,600}\19\[[^\]]{1,40}\];\s*\}\s*(?:\?>|\Z)(?<X1060090>)|(?:php)?\s+(\$\w{1,40})\s*=\s*(['"])[^\}]{1,400}\22;\s*(\$\w{1,40})\s*=(?:\s*\.?\s*\21\[\d+\]){90,150}\s*;[^\?]{420,600}(\$\w{1,40})\s*=\s*\23\s*;[^\?]{1,200}\24\)\);\$\w{1,40}\s*;\s*(?:\?>|\Z)(?<X1056560>)|(?:php)?\s+(\$to)\s*=\s*['"][^'"@]{1,40}@[^'"]{1,40}['"];\W{1,99}\$\w{1,40}\s*=\s*\$_POST\[['"](?:username|login|user|email)['"]\];\s*\$\w{1,40}\s*=\s*\$_POST\[['"](?:password|pwd|pw|pass|cvv2?|ssn|passwd)['"]\];[^\?]{1,600}mail\s*\(\s*\26(?<X2118521>)|(?:php)?\s+/\*\s*\*\s*MySQL\s+Web\s+Interface\s+By(?<X2056600>)|(?:php)?\s+@?error_reporting\((?:0|NULL)\);\s*(?:\$\w{1,9}\s*=\s*\(isset\((\$_SERVER\[[^\]]+\])\)\s*\?\s*\29:\$\w{1,20}\);\s*){7}[^\.]{99,300}\$\w{1,9}\s*=\s*['"]/\?['"](?:\.base64_encode\(\$\w{1,9}\)\.['"][^_]{1,3}['"]){7}[^\?]{99,500}@?eval\([^\)]+\);\s*\}\s*;\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X1121301>)|(?:php)?\s+\$GLOBALS\[[^\]]+]=Array\((?:base64_decode\(['"][^\)]{9,99}\),?){2,9}\);(?:\s*\?>\s*<\?(?:php)?)?\s*function\s+(\w{1,40})\((\$\w{1,32})\)\s*\{(\$\w{1,40})[^;]{99,600};return\s+base64_decode\(\33\[\32\]\);\}(?:\s*\?>\s*<\?(?:php)?)?[^\?]+echo\s+\31\(\d+\);else\s+echo\s+\31\(\d+\);\s*\?>(?<X1064290>)|(?:php)?\s+error_reporting\((?:0|NULL)\);\s*(\$\w{1,20})\s*=\s*['"][^'"]+['"];\s*(?:\$\w{1,20}\s*=\s*\(isset\((\$_[GPRSC]\w{2,6}\[['"]([^\]]+)['"]\])\)\h*\?\h*\36\h*:\h*\$\37\);\s*){5}[^>]{99,500}['"]\.\35['"];\s*if\h*\(+include\((base64_decode)\([^>]{20,150}\.\38\([^\}]{1,50}\}\s*(?:\?>|\Z)(?<X1137701>)|(?:php)?\s+function\s+long2str\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\{[^\?]{50000,};\s*@?eval\s*\(\s*\w{1,9}_decrypt\(\s*base64_decode\(\s*\$\w{1,40}\s*\),\s*['"]\w{1,40}['"]\s*\)\s*\)\s*;\s*(?:\?>)?\s*\Z(?<X2055242>)|(?:php)?\s+if\(!(define)d\(['"](REMOTING_INJECTED)['"]\)+\{\41\(['"]\42['"],(?:true|false|\d)\);\41\(['"]RK_DEBUG.?['"],strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],(?<X2183721>)|(?:php\b)?[^\(\{\}\?@=\$]{0,199}(\$\w{1,40})\s*=\s*\$_[GPCSR]\w{2,6}\[[^;]{1,199};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\44\s*\);[^\?\}\{]{0,99}\becho\s*['"]<\w[^;]{9,299}\w>['"];\s*if\s*\([^\?=;\{]{0,99}\{\s*[cm]o(?:py|ve_uploaded_file)\s*\(\s*\$_FILES\[[^\}]{1,499}\}\s*(?:\?>|\Z)(?<X1188940>)|(?:php|=)(?:\s*\$\w{1,40}\h*=\h*['"][\w=\-\+/]{1,99}['"];){3,}\s*(\$\w{1,40})\h*=\h*str_replace\h*\([^\)]+\)\h*;(?:\s*\$\w{1,40}\h*=\h*\46\h*\(\h*['"]\w{1,40}['"]\h*,\h*['"]{2}\h*,\h*['"]\w{1,99}['"]\h*\)\h*;){2}\s*(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\([""]{2},[^;]+\46\([^\)]+\)+;\s*@?\47\(\);\s*(?:\?>|\Z)(?<X1161930>)|(?:php|=)?[^\$]{1,99}(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\s*\49\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*[^\}\{\?]+(\$\w{1,40})\s*=\s*['"]?\49['"]?\s*;\s*(\$\w{1,40})\s*=\s*@?fopen\s*\(\s*\50\s*,[^\);]+\)\s*;[^\}\{\?]+fpassthru\(\s*\51\s*\)\s*;\s*exit[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1124460>)|(?:php|=)?\s*(\$\w{1,40}\+)=\h*base64_decode\h*\(\h*['"][^'"]{999,4999}['"]\h*\);\h*@?(eval)\h*\(\h*['"]return\h*@?\54\h*\(\h*(\\['"])\53\55\h*\);\h*['"]\h*\)\s*\?>(?<X1141670>)|(?:php|=)?\s*//XMPP/Jabber\h*:\h*PhishingFarm@(?<X2149430>)|(?:php|=)?\s*/\*[^/\w]{1,99}\bPHISH(?:ER)?(?:\h+by)?\h+\S{1,40}\s[^/\w]{3,40}\*(?<X2149421>)|(?:php|=)?\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"][^'"]{0,499}\b(?:wget|curl|lynx)\h+https?://(?:www\.)?pastebin\.com/(?:raw|download)/[^'";]{1,99}\.p[hly][p\d]?\h*['"]\h*\);\s*(?:\?>|\Z)(?<X1140072>)|(?:php|=)?\s*@?error_reporting\((?:0|false|NULL)\);\s*if\s*\(\s*isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{[^\}]{1,500}echo\s*\(?['"]\s*<form\s+method\s*=\s*['"]?post\b[^\}@]{1,500}if\s*\(\s*@copy\(\$_FILES\[[^\?]{1,500}\?>(?<X1124390>)|(?:php|=)?\s*\$\w{1,9}\h*=\h*rawurldecode\(['"][^'"]{99,500}(title)(?:>|%3E)Monkey[^<]{0,5}Albino(?:</|%3C%2F)\61[^'"]{99,999}php_uname%(?<X2153042>)|(?:php|=)?\s*echo\h*['"]<link\b[^\.\(;]{1,99}href=[^>;]{0,99}base64_decode\h*\(\h*['"]Ly9zaGVsb[^'"]{4,99}['"]\h*\)(?:\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])+[^;]*;\s*function\h*\w{1,40}\h*\((?<X2155980>)|(?:php|=)?\s*if\h*\(\h*(?:(\$_FILES\h*\[['"]\w{1,9}['"]\])[\s\)]+\{?\s*@?[mc]o(?:ve_uploaded_file|py)\s*\(\s*\64\h*\[['"][^'"]+['"]\]\s*,\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*;(?:\s*echo\h*['"][^'"]{1,99}['"](?:\h*;)?)?\s*\}?(?:\s*else\s*\{?\s*echo\h*['"][^'"]{1,99}['"](?:\h*;)?\s*\}?)?\s*(?:\?>|\Z)(?<X1142540>)|(file_)exists\h*\(\h*(dirname)\h*\(__\66_\)\h*\.\h*(['"]/wp[\-_][cv]?cd\.php['"])\h*\)\s*\)\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(\h*\67\h*\(\h*['"]?__\66_['"]?\h*\)\s*\.\s*\68\s*\)\s*;\s*(?:\?>|\Z)(?<X1062166>))|(?:php|=)?\s+@?[spe](?:ystem|assthru|hell_exec|open|xec)\h*\(\h*base64_decode\h*\(\h*['"]cGVyb[^'"]{99,499}['"]\h*\)\h*\);\h*(?:\?>|\Z)(?<X1140370>)|(?:php|=)?\s+\$(?:user|username|login|email)\h*=\h*(\$_POST\[)['"](?:user|username|login|email)['"]\];\s*\$(?:password|pass|secret|pwd|passwd)\h*=\h*\71['"](?:password|pass|secret|pwd|passwd)['"]\];[^#]{99,999}<title>\h*Free\h+Auto\h+Like\h+Facebook(?<X2160540>)|(?:php|=)\s*(function)\s+(\w{1,40})\h*\([^\{]{1,99}\{\s*\$\w{1,40}\h*=\h*hex2bin\h*\(\h*['"]687474703a2f2f636f6e6e6563742e61706965732e6f7267[^\?]{1,499}\b\73\s+(\w{1,40})\h*\(\h*\)\s*\{[^\}]{1,199}\b\74\h*\([^\?]{1,499}\}\s*\75\h*\(\h*\);\s*(?:\?>|\Z)(?<X1171461>)|(?:php|=)\s*\$[\{'"]{0,2}(GLOBALS)[\}'"]{0,2}\[[^\]]+\]\h*=\h*['"].{49,199}['"];\s*(?:\$[\{'"]{0,2}\77[\}'"]{0,2}\[[^\]]+\]\[\d+\]\.){2}[^\?\v]{9999,}\beval\(\$\w{1,40}\[\$\77\[[^\]]+\]\[\d+\]+\);\h*\}\h*(?:exit|die)\b[^;]{0,9};(?:\h*\})+(?:\s*\?>)?\s*\Z(?<X2160313>))
\A\s*<\?(?:[ph\s]*error_reporting[\(0\)\h]+;\s*(\$\w{1,25})[\h=]+['"]range['"];\s*(\$\w{1,25})[\h=]+\1[\h\(]+['"]\176['"][^\)]+\);\s*(\$\w{1,25})[\h=]+\$\{\2\[\d[^;]+;\s*\(count[\h\(]+\3[\h\)][\h=\(\)\d&\+]+in_array[\h\(]+gettype[^;:]+:\h*\3;\s*class\h*(\w+)\h*\{\s*[^#]{999,1700}\4::\w+[\h\(\)]+;\s*\?>(?<X1227833>)|[ph\s]*eval[\(\s]+base64_decode[\(\s]+str_rot13[\(\s]+\$_POST\s*\[[^\]]+\][\)\s;]+(?:exit|die)[;\s]*\Z(?<X2279541>)|[ph\s]*extract\(\$_[GPCSR]\w{2,6}\);if\(function_exists\((\$\w+)\)+\{\7\((\$\w+)\);\}else\{(\$\w+)=\8;[^\}]{0,499}\$(\w+)=popen\(\9,[^\}]{1,499}\$(\w+)\.?=fread\(\$\10,[^\?]{0,199}\becho\s*\$\11;\}*(?:die|exit)\b[^;]{0,19};\?>(?<X1229580>)|[ph\s]*function(?:\h*\w+[\s\(\)\{]+echo\h*\d+;\s*\}\s*\$\w+[\h=]+['"][^\}]{99,999}[\s\}]+return\h*\$\w+;[\s\}]+(\$\w+)[\h=]+\$_COOKIE;\s*(\$\w+)[\h=]+\$_POST;\s*\$\w+[\h=]+array_merge\(\14,\h*\13\)[^\}]+\}\s*elseif\h*\([^\{]+\{\s*(\$\w+)[\h=]+sprintf\([^\}]{9,399}\$\w+\(\15\);\s*\}\s*exit[\s\(\);\}]+\Z(?<X2238712>)|\s*(\w+)[\(\s]+(\$\w{1,40})[\)\s\{]+\18[=\s]+gzinflate[\(\s]+@base64_decode[\(\s]+\18[\)\s;]+for[\(\s]+(\$\w{1,9})[=\s]+\d+;\s*\19<strlen[\(\s]+\18[\)\s;]+\19\++[\)\s\{]+\18\[\19\][=\s]+chr[\(\s]+ord[^=]{0,99}return\s*\18[;\s\}]+define[^;\$]+;\s*@?eval[\(\s]+\17[\(\s]+['"][^'"]{999,}['"][\)\s;>\?]+\Z(?<X2225891>)|\s*(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s\{]+(\$\w{1,40})[=\s]+(curl_)init[\s\(\);]+\24setopt[\s\(]+\23[\s,]+CURLOPT_URL[,\s]+\22[^=]{1,199}\$\w{1,40}[=\s]+\24exec[\s\(]+\23[^=:]+\}\s*\22[\s='"]+http://[^/]{1,40}/[^'"]{1,199}\.txt['"\s;]+(\$\w{1,40})[=\s]+base64_decode[\s\(]+\21[\s\(]+\22[\s\);]+eval[\s(]+\25[\s\);]+\?>(?<X1221930>))|[ph\s]*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{(\$\w+)=fopen\(['"][^'"]+\.php['"],[^;]+;fwrite\(\27,file_get_contents\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+;fclose\(\27\);\}\s*(?:\?>|\Z)(?<X1226900>)|[ph\s]*require(?:_once)?[\(\s]+['"][^'"\$]+\.mo['"][\)\s;\?>]+\Z(?<X2234560>)|[ph\s]+(/\*[\s\w]+\*/)\s*(\$user_auth_cookie)[\s=]+['"][^;]{64000,};\s*@?(?:assert|eval)[\s\(]+\31[\s\)]+;\s*\30\s*(?:\?>\s*)?\Z(?<X2212250>)|[ph\s]+(?:@?(?:error_reporting|set_time_limit)[\s\(]+(?:0|NULL|False)[\s\)]+;\s*)+(function)\s+(\w+)\s*\([^:/]{1,499}\}\s*@?header[\s\(]+['"]Content\-type[\s:]+text/html\b[^\)]+\);\s*(\$\w+)[\s=]+\34\s*\([^;]{999,};[\}\)\s'";]+(\$\w+)[\s=]+create_\33[\s\(]+['"]{2}[,\s]+\35[\s\)]+;\s*\36\(\);\s*(?:\?>|\Z)(?<X1210660>)|[ph\s]+(?:@?(?:ignore_user_abort|set_time_limit)[\s\(]+\d+[\s\)]+;\s*){2}[^%!<>\+]{1,1999}\b(?:if\(stri?str\(\$\w+\[[^;\{]{1,499}\{[^\}]{1,199}\bexit;[\s\}]+){3}[^\?]{1,499}['"]Sitemap\s+Notification\b[^\?]{1,1499}\bfunction\s+\w+\s*\([^\{;]+\{\s*@?file_put_contents\s*\([^;]+;[\s\}]+(?:/[/\*][^;\?]{1,99})?(?:\?>|\Z)(?<X1213920>)|[ph\s]+(?:\$\w{1,20}[\h=]+['"]?(?:\\\d|chr|\\x|\w|\.)[^\.]{0,10}['"]?\.[^;]{4,200};\s*){5}[^\?&!]{999,2500}@\$\w{1,20}[\h\(]+(\$\w{1,20})[^\)]+\);\s*(\$\w{1,20})[\h=]+[^\(]{1,40}\bsubstr[\h\(]+\39[,\h]+strlen[\h\(]+[^;]{1,40}\);\s*echo\h*\40;\s*(?:exit|die)[^;]{0,9};[\}\s]+\Z(?<X2249821>)|[ph\s]+(?:\$\w{1,25}[\h=]+['"][^'"]{2,150}['"];\s*){1,3}\$\w{1,25}[\h=]+\$_POST;\s*\$\w{1,25}[\h=]+\$_COOKIE;\s*(?:\$\w{1,25}[\h=]+['"][^'"]{2,150}['"];\s*){1,3}(\$\w{1,25})[\h=]+implode\([^\)]+[\h\)]+;[^#]{99,799}\binclude[\h\(]+\42[\h\(]+[^\{]{1,99}\{\s*\$\w{1,25}[\h=]+\@?\42[\h\(]+[^\?]{0,99}\?>(?<X1226680>)|[ph\s]+(?:if[\s\(]+!?(file_)exists[\s\(]+['"]([^'"]{0,49}/wp\-\w{1,9}/[^'"]+)['"][\s\)]+\{\s*(\$\w+)[\s=]+@?\44ge(t_contents[\s\(]+)['"]https?://[^;]{1,99};\s*@?\44pu\47['"]\45['"][\s,]+\46\s*\);[\s\}]+){3,}(?:\?>|\Z)(?<X1190521>)|[ph\s]+(?:if\s*\([^;\{]{0,99}\$_SERVER\[["']HTTP_USER_AGENT['"][^\{;]+\{\s*){2}class\s+(\w+)\s*\{[^\?]+\bfunction\s+(\w+)\s*\([^\{;]+\{\s*(\$\w+)[\s=]+\$_COOKIE;[\s\(]+\51\s*&&[^;]+&&\s*@?eval[\s\(]+\$\w+[\s\)]+:\s*\51;\s*return\s+\49::\w+\s*\([^;]{19,};[\s\}]+\50\(\);\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1222680>)|[ph\s]+(\$\w+)=(?:array\(|\[)[^\?]{0,499}\$(\w+)=curl_exec\([^;]+;(\$\w+)=[^;]*\$\54\b[^\?]{0,499}\53\[[^\]]+\]\(['"]{2},[^\)]*\55\b[^;]+;(?:die|exit)\b[^;]{0,19};\W*(?:\?>|\Z)(?<X1208460>)|[ph\s]+(\$\w+)=ABSPATH\.['"]/?wp\-(?:admin|includes)/[^'"]+\.php['"];if\(file_exists\(\57\)+\{?(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?\57\s*(?:\)\s*)?;\s*(?:\}\s*)?(?:\?>\s*)?\Z(?<X2210701>)|[ph\s]+(\$\w+)[=\s]+['"][^'"]+\.php['"];\s*\$\w+[\s=]+@?(file_)ge(t_contents)[\s\(]+\59[\s\)]+;\s*(\$\w+)[\s=]+['"]/[^;]+;[^\}\?]{0,499}(?:\$(\w+)\s*\.?=[^;]*(?:\$\63|\62)\b[^;]*;\s*){2}if\s*\([^\{\};]+\{\s*(@?chmod[\s\(]+\59\s*,)[^;]+;\s*@?\60pu\61[\s\(]+\59[,\s]+\$\63[\s\)]+;\s*\64[^;]+;[\s\}]+(?:\?>|\Z)(?<X1211080>)|[ph\s]+(\$\w+)[\h=]+["'](?:[base64_dco'"\.]{16,40}|[stro13'"\._]{12,25});[^\(]{0,40}\berror_reporting[\h\(]+(?:0|NULL|FALSE)[\h\)]+;\s*@?eval[\h\(]+(?:\$\w+\()?\66[\h\(]+['"][^'"]{400,1500}['"][\h\)]+;\s*(?:\?>|\Z)(?<X2227290>)|[ph\s]+(\$\w+)[\h=]+[^;]+;[^\{]{9,699}\{\s*global\s*\68;\s*(\$\w+)[\h=]+[^\}]{0,399}[\}\s]+return\s*\69;\s*\}\s*(\$\w+)[\h=]+\$_COOKIE;\s*\70[\h=]+array_merge\(\70,\s*\$_POST\);[^\?]{99,1100}\((\$\w+),\h*['"]<\?[^\}]{0,199}\binclude\(\71\);\s*\$\w+\(\71\);\s*\}\s*exit[\(\)\h]+;[\s\}]+(?:\?>)?\Z(?<X2233462>)|[ph\s]+(\$\w+)[\h=]+\$_COOKIE;\s*\((count)\(\73\)==\d+&&in_array\(gettype\(\73\)\.\74\(\73\),[^:]{99,699}:\73;\s*\?>(?<X1207440>)|[ph\s]+(\$\w+)[\s=]+@?file[\s\(]+['"]https?://[^;]+;\s*echo\b[^;]*\76\b[^;]*;\s*(?:\?>|\Z)(?<X1197801>)|[ph\s]+(\$\w+)[\s=]+['"][^'"]{1,199}['"][\s;]+@?file_put_contents[\s\(]+\78\s*,[^;]{0,199}\barray_slice[\s\(]+file[\s\(]+(?:\w+[\s\(]+){0,9}__file__\s*\)[^;]{0,199};\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}\78[^;]{0,99};\s*/\*\s*PD9[\w\s/\+=]+(?:\*/\s*)?(?:\?>\s*)?\Z(?<X2215442>)|[ph\s]+(\$\w+)[\s=]+\$_(?:[GPCSR]\w{2,6}\[[^;]+;\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+['"]wget\b[^;]{0,19}\80\b[^;]+;\s*(?:\?>|\Z)(?<X1221280>)|SERVER\[['"]HTTP_USER_AGENT['"]\];\s*if[\s\(]+preg_match\s*\([^\),]+,\s*\80[\s\)\{]+header[\s\(]+['"]Location:[^;]+;\s*(?:die|exit)\b[^;]*;[\s\}]+else\s*\{[^\?]{1,999}\$(\w+)[\s=]+['"]https?://kppli\.com/[^\?]{4999,}<i?frame\b[^>]+\bsrc=[^>=]*\$\82\b[^\?]{1,99}(?:\?>|\Z)(?<X1206110>))|[ph\s]+(\$\w+)[\s=]+range(?:[\s\(]+chr\s*\([^;]+;\s*(\$\w+)[\s=]+\$\{\84\[[^;]+;\s*if[\s\(]+in_array[\s\(]+gettype[\s\(]+\85\s*\)[^\{;]+\{[^;\?]{1,199}\85[\s\(\)]+;\s*\}\s*(?:\?>|\Z)(?<X1214380>)|\s*\([^;]{1,99};\s*@?(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?(?:\84[\h\[]+\d+[\h\]]+\.\h*){4,}\84[\h\[]+\d+[\h\]]+(?:\)\s*)?;\s*(?:\?>|\Z)(?<X1210671>))|[ph\s]+(\$\w+)[\s=]+urldecode\s*\([^;]{9,499};\s*header[\s\(]+['"]Content\-type:\s*text/html\b[^\?\{]{1,999}\{\s*global\h+\88;[^\n]{9999,};\h*unset[\h\(]+\$\w+\h*,[^;]{1,999};\h*(?:die|exit)\b[^;]{0,19};[\}\h]+[0o1li]+[\h\(\)]+;\s*\?>(?<X1196920>)|[ph\s]+(\$\w+\[)\]\s*=[^;]+;\s*(?:\90\]\s*=[^;]+;\s*)+if\s*\([^;\{]{0,199}\90\d+(\]\[\90)[^\{;]{1,199}\{\s*(\$\w+)[\s=]+(?:\90\d+\91[^;]+\(\s*){2}\90\d+\91\d+[\s\]\)]+;[^\}]{0,999}\b[ir](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?\92\[[^;]+;\s*\92\[[^\]]+\][\s\(]+\92\[[^\]]+\][\s\)]+;\s*\}\s*(?:\?>|\Z)(?<X1212140>)|[ph\s]+(\$\w{1,20})[\h=]+[^\$]{0,20}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)?;\s*(\$\w{1,20})[\h=]+fopen\(['"][^'"]{1,20}shell\.php\d?['"][,\h]+['"]w['"]\)[^;]*;\s*fwrite\(\95[,\h]+\94\);\s*fclose\(\95\);\s*(?:\?>)?\Z(?<X2226890>)|[ph\s]+(\$\w{1,25})[\h=]+(curl_)init\((base64_decode)\(['"]aHR0cHM6Ly9wYXN0ZWJpbi5jb20[^\)]+[\)\h]+;\s*\98setopt\(\97,[^\)]+\);\s*(\$\w{1,25})[\h=]+\98exec\(\97\);\s*eval\(\99\([^\)]+\)[\h\.]+\100\);\s*\?>(?<X1204580>)|[ph\s]+(\$\w{1,25})[\h=]+function[\s\(]+\$\w{1,25}[\s\)]+[\s\{]+(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*\$\w{1,25}[\h\=]+\103[\h\[\(]+\d+[\h\-\+]+\d+[\h\)]+[\h/\*]+\d+[\s\]\.]+\103[^\?]{999,6000}=\102[\h\(]+(\$\w{1,25})[\h\)]+;\s*\$\w{1,25}[\h\(]+\104[\s\);]+\?>(?<X1214250>)|[ph\s]+(\$\w{1,9})\s*=\s*['"]https?://[^;]+;\s*(\$\w{1,9})\s*=\s*['"]base64_decode['"];\s*(\$\w{1,9})[^@]{1,20}(\@?file_)put_(contents)\s*\(\s*\108,[^\.]+\.\s*\107\s*\(\s*(\109get_\110\s*\(\106\))[^@]+@?unlink\s*\(\108\);\s*@?eval\s*\(\s*\107\s*\(\111\)\s*\)\s*;?\s*(?:\Z|\?>)(?<X1059742>))
\A\s*<\?php\s*(?:((\$\{['"]GLOBALS['"]\}\[)['"]\w{1,20}['"]\])\h*=\h*(['"][^'"]{1,40}['"]);\s*(\2['"]\w{1,20}['"]\])\h*=\h*\3;\s*\$\{\s*\1\s*\}\s*=\s*@?file_get_contents\h*\(\h*['"]https?://[^/]{0,19}\bpastebin\.com/(?:raw|download)\b[^;]{1,99};\s*@?eval\s*\(\s*\$\{\s*\4\s*\}\s*\);\s*(?:\?>|\Z)(?<X1167381>)|(/\*\h*generated\hby\hjetpack\hprotect\b)[^\/]{1,20}/\s*(function)\h*\w{1,10}\((\$\w{1,10})\)\s*\{\s*if\h*\(\h*!?is_writable\h*\(\h*['"]?\8['"]?\h*\)\h*\)\s*\{\s*return\b[^;]{1,99};[^\?@<>\|%\+:,]{99,999}\b\7\h*get_text_fr_serv\([^\)]+\)\s*\{[^\}\?]{1,500}\}\s*\6\b[^\/]{1,20}/\s*(?:\?>|\Z)(?<X1168261>)|(?:(?:error_reporting|set_time_limit)\((?:0|NULL)\);\s*){2}if\s*\(\s*isset\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*echo\s*['"]<font color=#000000>\[uname\]['"]\.php_uname\(\)[^\{]{9,250}\{if\(@?copy\(\$_FILES\[(?<X2035971>)|(?:(?:goto\s+|\w{1,6}:\s+)\s*[^;]{1,199};\s*[\)\]\}]?\s*){5}[^#]{99,1499}(?:(?:goto\s+|\w{1,6}:\s+)\s*[^;]{1,199};\s*[\)\]\}]?\s*){3}(?:\?>|\Z)(?<X1126434>)|(?:(?:session_start\(|error_reporting\((?:0|NULL|False))\);\s*){1,2}class\s*BrowserDetection\s*\{[^%]{999,9999}\$(subj?(?:ect)?)\h*=\h*['"]New\s+Log(?:\s*in)?(?:\s*details?)?\s+From\s+Visitor\b[^;]{0,99};[^\?]{99,1999}\bmail\([^\)]+\$\12\b[^\?]{1,499}\bheader\h*\(\h*['"]Location:(?<X2164502>)|(?:(\$\w{1,9})\s*=\s*pack\(['"]\w\d{1,2}['"],(?:\d{1,3},){4}[^\)]+\);\s*){3}if\(@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,3}['"][^'"]+['"]\)\{\s*\14\(['"](?:\\x[\w\d]+){4}[^\)]+\);\s*\}\s*else\s*\{\s*header\(['"]HTTP/1\.[01]\s*(?:404|403)[^'"]{9,50}['"]\);\s*(?:exit|die)\s*\([^;]{0,9};\}\s*\?>(?<X1134441>)|(?://header\s*\(\s*['"][^"']*['"]\s*\);)?\s*\$\w{1,40}\s*=['"][^"']*['"]\s*;\s*\$\w{1,40}=['"][^"']*['"]\s*;\s*\$\w{1,40}\s*=['"][^"']*['"]\s*;\s*\$\w{1,40}\s*=\s*urldecode\s*\([^#]{9999,30000};\$\{['"](?:\\x[0-9a-f]{2,3})+['"]\}\s*\[['"](?:\\x[0-9a-fA-F]{2,3})+['"]\]\(\);\s*(?:\?>|\Z)(?<X1037511>)|(?:/\*[^\$=\?%\{'"]{1,350}\*/\s*)?\$[^=]{1,25}\h*=\h*['"](?:dupmetbo_s5irfc64aly|5aecm6fdousrlb4t_ipy)['"];\$[^\n]{99,1599}\beval\((?<X2166484>)|(?:@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]cd\s*\w{1,9};\s*mv\s+\w{1,9}\.ico\s+\w{1,9}\.php;\s*['"]\s*\);\s*){1,9}(\$\w{1,40})\s*=[^;]{1,50};\s*(\$\w{1,40})\s*=\s*['"]\w{1,20}@\w{1,7}\.\w{2,6}['"]\s*;[^?]{1,50}mail\s*\(\19,\$\w{1,20},\18\s*\);?\s*(?:\?>|\Z)(?<X1059171>)|(?:@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*file_get_contents\s*\(\s*['"]https?://['"]\s*\.\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;\s*){2,}(?:\Z|\?>)(?<X1127510>)|(?:@?(?:session_start|error_reporting|set_time_limit)\s*\([^\)]{0,5}\);\s*){2,3}[^\?:]{9,150}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*(?:\?>|\Z)(?<X1121752>)|(?:@?unlink\h*\([^\)]{1,199}\);\s*){9}[^\$\{\}\?=>]{9999,29999}(?:\?>|\Z)(?<X1150570>)|(?:\$(?:title|title_dop|logo_alt|keywords|descr|bkeyword|keyword_bez)\h*=\h*["'][^'"]{1,499}['"];\s*){7}\$bkeyword_bez\h*=\h*['"](?<X2146236>)|(?:\$(\w{1,40})=visitor_\25\(\);){3}[^@]{99,999}\$(me?sg|message)=[^;]{9,999}\$p(?:ass(?:wo?r?d)?|wd)[^@]{1,499}\bmail\([^\)]{1,49}\$\26\b[^\)]{1,49}\);(\$\w{1,40})=fopen\(['"][^'"]+\.(?:html?|txt)['"][^\)]{1,49}\);fwrite\(\27,\$\26\);(?<X2155841>)|(?:\$[_0o]{1,40}\s*=\s*['"]\w+['"]\s*;\s*){3,}[^;]{1,9};\s*\$\{['"][GOBALS\\x47cf2153]{7,28}['"]\}\[['"][0o_\\x4f530]{1,160}['"]\]\(\);\s*\?>(?<X1139370>)|(?:\$\w{1,15}\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*){2}(\$\w{1,15})\h*=\h*['"]New\s*Logger[^;]+;\s*(\$\w{1,15})\h*\.?\h*=\h*[""]Powered\h*by[^;]+;[^\?]{0,99}\bmail\(\$\w{1,15},\h*\30,\h*\31\);\s*\?>(?<X1186540>)|(?:\$\w{1,19}\s*=\s*[^'";]{1,40}(?:[\^\|]['"][^\v\$]{1,19}['"])?;\s*)?\$\w{1,40}\s*=\s*['"][^\v]{1,40}['"][\^\|&](?:['"]|\w)[^\v]{1,40}['"]?;[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}[\.\)=,\|]+\$\w{1,19}\s*[\)\.](?:[^\t]{60,199})\);(?:\s*\?>)?\s*\Z(?<X2142241>)|(?:\$\w{1,20}\s*=\s*['"])?@?riny\s*\(tmvasyngr\s*\(onfr64_qrpbqr\s*\([^\?]{9999,30000}(?:\)\s*)+;\s*['"]\);[^\?]{0,15}\?>(?<X1134620>)|(?:\$\w{1,20}\s*=\s*\d+;)?[^\{]{1,50}\{(\$\w{1,20})\s*=[^\}]{25,200}\}\s*(\$\w{1,20})\s*=\s*['"]['"\s\.base64_dco]{13,40}['"]\s*;\s*return\s+\36\s*\(\s*\35\s*\)\s*;\s*\}\s*\$\w{1,20}\s*=(?:\s*['"][\w\-\+/=]{10,500}["']\s*(?:\.)){9}[^;]{65000,};\s*(?:\?>|\Z)(?<X2126995>)|(?:\$\w{1,40}=(\$_[GPCSR]\w{2,6}\[)[^;]{1,99};){1,5}(?:if\(\38[^\)]+\)\{[^\}]{1,99}\}(?:else)?){0,5}\$(\w{1,40})=['"]https?://traodoisub\.com/[^@]{1,199}\b(curl_)setopt\([^,;]+,CURLOPT_URL,\$\39\);[^\}]{99,499}(\$\w{1,40})=\40exec\([^;]+;(\$\w{1,40})=json_decode\(\41\b[^;]+;if\(\42\b(?<X2160612>)|(?:\$\w{1,40}\s*=\s*['"][^'"]*['"];\s*){2,9}@eval\s*\(\s*base64_decode\s*\(\s*['"][^'"]{20000,}['"]\s*\)\s*\)[\s;]*(?:\?>|\Z)(?<X1059882>)|(?:\$\w{1,40}\s*=\s*\$_POST\[[^;]{1,49};\s*){3}[^@]{9999,19999}<(title>)\h*Amazon\h+Billing\h+Center\h*</\45(?<X2142720>)|(?:\$\w{1,5}\s*=\s*['"][\.\w]{1,5}['"];\s*){3}(\$\w{1,5})\s*=\s*[^\(]{9,99}(\(file_exists\(\47\)+)\s*chmod\s*\(\47,\s*\d{4}\);\s*if\s*\48\s*unlink\s\(\47\)[^\/]{9,999}(\$bot\w{1,9})\s*=\s*[^\$]{1,99}\$_(?:P|G|S|C|R)\w{2,6}\[HTTP_USER_AGENT\]\s*\);\s*if\s*\(\s*\(\s*strpos\(\49(?<X2120381>)|(?:\$\w{32,40}\s*=\s*implode\s*\((?:['"]\.['"])?,(?:\s*@?array_flip\s*\(\s*)?\$_[GPRSC]\w{2,6}\)+;\s*){3,9}\$\w{32,40}\s*=\s*@?file_get_contents\s*\(['"]php:/(?<X2124652>)|(?:\$\{['"](?:\\x47|G)(?:\\x4c|L)(?:\\x4f|O)[^'"]{4,24}['"]\}[^\$]{9,99}){16}@?set_time_limit\((?:0|NULL)\)[^\|]{999,65000}create_function\([^;]{9,99};\s*unset\([^;]{9,99};\s*echo(?<X2121571>)|(?:\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]=['"][^'"]+['"];){2,4}function\s+(\w{1,20})\((\$\w{1,20})[^:]{99,200}=(curl_)init\(['"]\54['"]\);\55setopt\((\$\{\$\{)[^\?]{99,1500}=\53\(['"](?:\\x68|h)(?:t|\\x74){2}[^\)]+\);eval\(['"](?:\?|\\x3f)(?:>|\\x3e)['"]\.\56[^\}]+\}\[[^\]]+\]\}\);\s*(?:\?>|\Z)(?<X1131420>)|(?:\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]=['"][^'"]{1,30}['"];){5}[^@]{99,1500}@unlink\(__FILE__\);[^\n\?]{999,4000}@curl_exec\s*\(\$\{\$\{['"](?:G|\\x47)[^\n]{999,4000}join\s*\([^\$]{1,5},[\$\{]{4}['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]\}\);\s*exit\s*\(\);\s*\?>(?<X1131001>)|(?:\w{1,40}\(\d?\);|\$(?:auth_pass|pass(?:word)?)?=['"]\w{1,40}['"];){2,5}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(file_get_contents\(['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)/[^'"]{1,49}['"]\)\);\s*(?:\?>)?\Z(?<X2145440>)|(?:die\s*\(\s*)?@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X2054534>)|(?:echo\b['"\(\s]+\w{1,19}['"\)\s]+;\s*)?@?system\s*\(\s*['"]wget\s+https?://[^/"']{9,60}/[^'"]{0,60}(?:language|inlcudes|ima?ge?s?|css\d*)/[^'"]{0,60}\.(?:txt|jpe?g|png|gif|ico)\s*\-O\h+[\w\-\.]{1,40}\.php\h*['"]\h*\)\s*;\s*(?:\?>|\Z)(?<X1186030>)|(?:echo\h+[peas](?:assthru|ystem|xec|hell_exec)\h*\(\h*['"](?:curl|lwp\-download|wget|fetch|lynx)\b[^\)]{9,99}\);\s*){9}[^\?]{999,4999}\?>(?<X1152310>)|(?:echo\s*['"][^\?=]{1,99};\s*){1,3}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\);\s*(?:\?>|\Z)(?<X1146640>)|(?:echo|print)\s*['"][^'"]+['"];\s*\?>\s*<\?php\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]wget\s*https?:\/\/[^\s]{1,99}\s+-O\s+\w{1,40}\.php['"]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059021>)|(?:eval|assert|system|popen|exex|shell_exec|passthru)\s*\(['"]rm[^;]{1,9}\.htaccess[^'"]+['"]\);\s*(?:\Z|\?>)(?<X1124993>)|(?:if\s*\(file_exists\(['"](\./wp-includes/[^\"']{1,15}\.php)['"]\)\)\s*require(?:_once)?\s*['"]\66['"];\s*)+\?>(?<X1128391>)|(?:include\h*['"][^\.]{1,20}\.php['"];){2}@?eval\(file_get_contents\(call_user_func\(function\h*[^\(]{0,20}\(\)\s*\{\s*(\$\w{1,9})\h*=\h*array\(['"][^;]{1,99};\s*return\h*\68\[\d+\]\h*\.[^;]{1,99};(?<X2182672>)|(?:session_start|error_reporting)\([^\?\[\{\}]{0,60}\$_[GPRSC]\w{2,6}[\[\s]+['"]h4sh['"]\](?<X2204112>)|(\$\w)\h*=\h*['"](?:\w\||\d\|){50}[^'"]{999,28000}['"];\h*\71\h*=\h*str_replace\(['"]\|['"],\h*[""]{2},\h*\71\);\h*@?eval\(base64_decode\(\71\)\);\h*unset\(\71\);\s*(?:\?>|\Z)(?<X1176230>))
\A\s*<\?php\s*(?:(\$\w{1,15})=md5\((rand)\(\d+,\d+\)\);\s*\$\w{1,15}=\2\(\d+,\d+\);\s*header\s*\(['"]Location:\s*https?://[^'"]+\.\1\.[^'"]+['"]\);\s*\?>(?<X2133960>)|(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(?:(\$\w{1,15})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*)?(\$\w{1,15})\h*=\h*['"][^'"]+(?:\4|\5)[^\?]{9,99}\bmail\(\$\w{1,15},\h*\$\w{1,15},\h*\6[^\?]{1,99}\becho['"]<(script)[^\?]{9,299}\bwindow\.location\.href\h*=[^;]{1,49};\s*</\7>['"];\s*\?>(?<X2198014>)|(\$\w{1,15})\h*=\h*['"](?:<\?php\s*(\$(?:bot){2,4})\h*=\h*['"][^\?]{99,299}\d{1,3}/\w{1,15}/\?useragent=\10&domain=[^#]{99,2500}\bfwrite\((\$\w{1,15}),\h*\9\);[^\?]{9,199}\bfclose\(\11\);[^\?]{9,150}\bunlink\(['"]\w{1,15}\.php['"]\);\s*\?>(?<X1171280>)|aHR0cH[^'"]{0,99}['"];\s*(\$\w{1,15})\h*=\h*(file_)get(_contents)\((base64_decode)\(\9\)\);\s*\14put\15\(['"][^'"]{1,40}\.php[""],\h*\16\(\13\)\);\s*\?>(?<X1186880>)|header['"];\s*\9\h*\(['"]Location:\h*https?://[^/'"]{0,19}\b[dtls](?:ravelfornamewalking|alkingaboutfirms|ovegreenpencils|inetoadsactive|owerthenskyactive|ransandfiestas|trongcapitalads|aryinformtrand|eclarebusinessgroup)\.ga/[^\)]{0,49}\);\s*\?>(?<X1184121>))|(\$\w{1,15})\h*=\h*\d+;\s*(\$\w{1,15})\h*=\h*explode\(['"];['"],\h*['"][\d;]{999,11000}['"]\);\s*(\$\w{1,15})\h*=\h*['"]{2};\s*foreach\(\20\h*as[^\?]{0,99}\21\h*\.=\h*chr\(\$\w{1,15}\^\19\);\s*eval\(\21\);\s*\?>(?<X1191300>)|(\$\w{1,20})\s*=\s*['"][^'"]{20,150}['"];\s*\$\w{1,20}\s*=\s*['"][^'"]{999,6000}['"];\s*@?eval\s*\(htmlspecialchars_decode\s*\(gzinflate\s*\(base64_decode\s*\(\23\)+;\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X1133061>)|(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*\$inter_domain[\h=]+['"]https?://[\h'"\.]+\25[^;]+;\s*function\s*curl_get_contents[^#]{999,7000}\bis_crawler\(\$\w{1,25}\);\s*if[\h\(]+\$res_crawl&&\$bot[^\?]{99,450}\becho\h*\$get_content;\s*(?:exit|die)[^;]{0,9};[\s\}]+\?>(?<X1217210>)|(\$\w{1,40})=['"]['"\s\.base64_dco]{6,40}\([\d/\*]{1,13}\)['"\s\.base64_dco]{9,40}['"];(?:\$\w{1,40}\.?=['"][^'"]{1,40}['"];){1,9}(?:assert|eval|system|passthru|shell_exec|exec|popen)\(\27\(['"](?<X2132151>)|(\$\w{1,40})=['"][^'"]{1,99}['"];\h*(\$\w{1,40})=(strto)lower\((?:\h*\29\[\d+\]\h*\.){1,99}\29\[\d+\]\h*\);\h*(\$\w{1,40})=\$\{\31upper\((?:\h*\29\[\d+\]\h*\.){1,99}\29\[\d+\]\h*\)\}\[['"]\w{1,40}['"]\];\h*if\(isset\(\32\)\)\{\s*(?:eval|assert)\(\30\(\32\)\);\s*\}\s*(?:\?>|\Z)(?<X1159830>)|(\$\w{1,40})=\(?['"][^'"]{40,99}['"]\)?;(?:\((?:\34\[\d+\]\.){2,40}\34\[\d+\]\)(?:\(|,|\))){2,9}[\)]{1,4};?\s*(?:\?>)?\s*\Z(?<X2062461>)|(\$\w{1,40})=explode\(['"]\w{1,9}['"],['"]\w{99,999}['"]\);foreach\(\36\h*as\b[^\v#%]{8999,19999}\bfunction\h+(\w{1,40})\(\)\{@(?:eval|assert)\(\$\w{1,40}\[['"]\w{1,40}['"]\]\);\w{1,40}\(\);\}\37\(\);\s*(?:\?>|\Z)(?<X1142100>)|(\$\w{1,40})\h*=\h*(?:(curl_)init\h*\(\h*['"]https?://[^\./'";]+\.github\.io/[^;]{1,99};[^\?]{1,199}\$(\w{1,40})\h*=\h*\40exec\h*\(\h*\39\h*\);\s*@?(?:eval|assert)\h*\(\h*['"]\?>\h*(?:['"]\h*\.\h*)?\$\41\h*(?:['"]\h*)?\);[^\?\$\(\{=]{1,99}(?:\?>|\Z)(?<X1167000>)|['"][^'"]{0,99}\bwget\h+[^'";]{0,99}\bhttps?://[^\?\v]{1,99}/dev/null\h+(?:2\h*>+\h*&1|&>+)[^'"]{0,99}['"];\s*@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\39\b[^;]{0,99};\s*(?:\?>|\Z)(?<X1184690>)|['"][^\.:\176!#]{9,99};\s*\$\w{1,40}\h*=(?:\h*\39\[\d+\]\h*\.){3}[^\?]{499,1999}\bfunction\s+\w{1,40}\h*\(\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{\s*global(?:\h*\39\h*,){2}[^;]{19,99};[^\?]{999,9999}\binclude\s+\$\{(?:\h*\39\[\d+\]\h*\.){5}[^;]{1,99};\s*\}\s*\?>(?<X1168690>)|['"]\w{1,19}['"];\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/[^;]{4,99};\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\39\h*\(\h*\45\h*\)\h*\);\s*(?:\?>|\Z)(?<X1163231>)|['"]\w{32}['"];(?:\h*if\(md5(\(\$_[GPSRC]\w{2,6}\[)[^\]]+(\]\))\h*\D{2,3}\h*\39\)\{\h*assert_options\([^\)]+\);(?:\h*(\$\w{1,40})\h*=\h*strval\47[^\]]+\48;\h*){3}\h*\$\w{1,40}\h*\(\h*\49\b[^\}]{1,49}\}\h*else\h*\{\h*echo\s*phpinfo\(\);\s*\}\s*(?:\?>|\Z)(?<X1146830>)|\s*(\$b374k)\h*=\h*@?create_function\h*\([^@]{1,99};\s*@?\51\h*\(\h*['"][^'"]{20000,}['"]\h*,\h*\39\h*\);\s*(?:\?>|\Z)(?<X1152290>)|\s*if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*(\$\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\];\s*if\(md5\(\53\)\h*\D{2,3}\h*\39\)\s*\{\s*(?:echo\s*)?(?:system|passthru|eval|(?:shell_)?exec)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);[\}\s]+(?:\?>|\Z)(?<X1152260>))|['"]https?://[^'"]{1,99}['"];\s*(\$\w{1,40})\h*=\h*['"file_gtcons\.\h]{19,49};\s*\55\h*=\h*\55\h*\(\h*\39\h*\);\s*(\$\w{1,40})\h*=\h*strrev\h*\(\h*['"]stnetnoc_tup_elif['"]\h*\);\s*\56\h*\(\h*['"][^'"]{1,99}\.php['"]\h*,\h*\55\h*\);\s*(?:\?>|\Z)(?<X1152820>)|array(?:[\(\h]+(?:base64_decode\([^,]+,\h*)+(file_)get_contents[\(\h]+__\58_[\)\h]+\[\d+\][\)\h]+;\s*@?preg_replace[\(\h]+\39\[\d+\][\h,]+serialize[\(\h]+@?eval[\(\h]+\39\[\d+\][\)\h]+,\h*\39\[\d+\][\h\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\?>\s*[a-z\d\+/]{999,9999}\s*\Z(?<X2182080>)|\(['"asertvl,\h]{8,49}\);\s*(\$\w{1,40})\h*=\h*['"]{2};\s*for\([^\{]{1,49}\{\s*\60\h*\.=\h*\60\.\39\[[^\]]+\];\s*\}\s*\60\h*=\h*substr\(\h*\60[^;]{1,49};\s*\60\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,49};[^\?\$=>]{1,99}\?>(?<X1150820>))|base64_decode\h*\(['"][^'"]{9999,}['"]\);\s*@?file_put_contents\h*\(\h*['"](\w{1,40}\.zip)['"],\h*\39\h*\)\h*;\s*if\h*\(\h*!\h*defined\h*\(\h*['"]PCLZIP_[^`]{50000,}(\$\w{1,40})\h*=\h*new\h+PclZip\(['"]\62['"]\)\h*;\s*if\h*\(\63\->extract\(\)(?<X2140722>))|(\$\w{1,40})\s*=\s*(?:"e/\*\./";\s*preg_replace\(strrev\(\65\),"[^"]{2000,12000}","\."\);\s*\?>\s*\Z(?<X1041990>)|@?create_function\s*\([^\?\n]{9,200}?\)\s*;\s*@?\65\s*\(\s*\)\s*(?:;\s*)?(?:\?>|\Z)(?<X1040592>)|@?file_get_contents\s*\(["']https?://[^;]{0,199}\badzones\h*=\h*[\d,]+["']\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*\65\);\s*\?>(?<X1184052>)|['"][^'"]{99,256}['"];(?:\s*\65\s*\.=\s*['"][^'"]{9,256}['"];){9,}\s*(\$\w{1,40})\s*=\s*\65\s*;\s*function\s*(\w{1,40})\s*\([^@]{99,399}@?\65\s*=\s*\70\s*\(\s*\69\s*,\s*['"][^'"]*['"]\s*\);\s*@?eval\s*\(\s*@?gz(?:uncompress|inflate)\s*\(\s*\65\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1126340>)|['"][^'"]{999,}['"];(?:\s*\65\s*=\s*str_replace\(['"][^'"]{1,8}['"],\s*['"][\w=\+/]['"],\s*\65\s*\);)+\s*\65\s*=\s*base64_decode\s*\(\s*\65\s*\)\s*;\s*@?eval\s*\(\s*\65\s*\)\s*;\s*(?:\?>|\Z)(?<X1135080>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\];\s*if\s*\(\s*isset\s*\(\s*\65\s*\)\s*\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*base64_decode\s*\(\s*\65\s*\)\s*\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1059122>)|\$_[GPRSC]\w{2,6}\s*\[[^\]]+\];\s*if\s*\(\s*(?:\65\s*\D{2,3}\s*['"][^'"]*['"]\s*\)\s*\{[^\{]{1,999}\s*while\((\$\w{1,40}\[[^\]]+\])\)\s*\{[^\(\{\}]{1,99}\(?\s*@?mail\(\74(?<X2124100>)|isset\s*\(\s*\65\s*\)\s*\)\s*\{\s*echo\s*@?system\(\s*\65\s*\);\s*\}(?:\s*else\s*\{[^\}]+\})+(?:\s*\})?\s*(?:\?>|\Z)(?<X1124501>))|\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^;]{0,99};\s*if\(stri?pos\(\65\b[^;\{]{1,499}\{\s*header\([^\)]+\);\s*(\$\w{1,40})\h*=[^;]+;\s*(\$\w{1,40})\h*=\h*@?file_get_contents\(\s*(?:base64_decode\([^\)]+\)\s*\.\s*){2,5}\77[^;]+;\s*echo\s*\78;\s*return\s*;\s*\}\s*(?:\?>|\Z)(?<X1159670>)|array(?:\(\);\s*\65\[\]\s*=\s*pack\(['"]H\*['"]\s*,\s*(\w{1,40})\s*\(['"]https?://[^'"]{1,99}['"]\)\);[^\^]{999,5000}function\s+\80\s*\((\$\w{1,40})[^%]{999,1500}file_get_contents\(\81\);\s*\}\s*\}return\s+(?:trim\(\s*){2}\$\w{1,40},\s*['"][^'"]+['"]\)\);\s*\}\s*(?:\?>|\Z)(?<X1061900>)|\s*\(\s*['"]http://[^,]{5,99},\s*\);\s*shuffle\(\65\);\s*header\(['"]HTTP/1\.\d+\s*302\s*Found['"]\);\s*header\(['"]Location:\s*['"]\s*\.\s*trim\(\65\[\d+\][\s\)]+;\s*(?:\?>)?\s*\Z(?<X2124190>))|file_get_contents\(['"][^'"]{1,40}['"]\);\s*eval\(\65\);\s*\?>(?<X1042130>)|str_i?replace\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"][^'"]{0,40}['"]\s*,\s*['"]\w{20,80}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*['"][^'"]{999,25000}['"]\s*;\s*@?eval\s*\(\s*\65\s*\(\s*\85\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057780>)|wp_create_user\([^;]{1,99};\s*(\$\w{1,40})\s*=\s*new\s+WP_User\s*\(\s*\65\s*\);\s*\87\s*->\s*set_role\(\s*['"]administrator['"]\s*\);\s*\?>(?<X1134581>)))
\A\s*<\?php\s*(?:(\$\w{1,4})\s*=\s*fopen\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]w\+?['"]\s*\);\s*fwrite\(\s*\1,\s*['"]['"]\s*\);\s*fclose\(\s*\1\s*\);\s*\$ip\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\]);\s*\$\w{1,40}\s*=\s*rand\(1\s*,\s*\d+\);(?<X2052230>)|(\$\w{1,5})=\$_[GPRSC]\w{2,6}\[[^\]]+\];(\3==\w{1,9})&&@?eval\(base64_decode\(substr\(\$_[GPRSCF]\w{2,6}\[[^\]]+\],\d\)\)\);\4&&(?:die|exit)[^;]{0,9};(?:\Z|\?>)(?<X1128521>)|(\$\w{1,5})\s*=\s*\w{1,10};\s*if\s*\(\(isset(\(\$_(?:G|P|S|R|C)\w{2,6}\[[^\]]+\]\))\s*\W{2,3}\s*\(\s*md5\7\s*\W{2,3}\s*['"]\w{20,32}['"][\)\s]+\6\s*=\s*\w{1,10};[^\7]{1,250}@?eval\(gz(?:inflate|uncompress)\(base64_decode\(rawurldecode\(\$_(?:G|P|S|R|C)[^;]{1,50};\s*(?:\Z|\?>)(?<X1118294>)|(\$\w{1,9})\h*=\h*(?:(['"](?:TRUE|FALSE)['"]);[^\{]{1,99}\{\s*\bif\(preg_match\([\'"]#wordpress_logged_in\|admin\|pwd[^,]{1,70},\h*\$_SERVER\[['"]HTTP_COOKIE[^\}]{1,99}\}\s*\bif\(\9\h*==\h*\10[^>]{1,99}src\h*=\h*['"]https?://[^/'";]{1,49}\.com/[^'"\?;]{1,49}\.js['"]>[^\?]{1,49}\?>(?<X1179370>)|(\bfile_)(?:ge|pu)(t_contents)\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\);\s*(\$\w{1,9})\h*=\h*['"]/tmp[^\.]{1,20}\.(?:md5|sha[1256]{1,3})[^;]{1,49};\s*\bif\(file_exists\(\14[^\?]{1,75}\{\s*\12(?:ge|pu)\13\(\14,\h*\9\);\s*\}(?<X2181160>)|(curl)_init\h*\(['"]https?://[^/'"]{1,49}\.com/[^'"\?;]{1,49}\.txt['"]\);\s*\16_setopt\h*\(\9,[^;]{1,49};\s*(\$\w{1,9})\h*=\h*\16_exec\h*\(\9\);\s*eval\h*\(['"]\?>['"]\h*\.\h*\17\);\s*\?>(?<X1183022>)|['"][^\$]{9,199};\h*\$\w{1,9}\h*=\h*(?:\9\{\d{1,3}\}\.){15}[^\(]{99,14000}function\h*(\w{1,9})\([^\)]+\)\s*\{[^\}]{0,99}\}\s*\$\w{1,9}\h*=\h*\19\(\9\{\d{1,3}\}[^\)]{0,50}\);\s*\$\w{1,9}\h*=\h*\19\(\9[^\?]{0,1500}array\(['",\}]+\.\$\w{1,9}\.['"/]+\)\);\s*\?>(?<X1144992>)|['"]\w{1,99}['"];\s*(\$\w{1,9})\h*=\h*explode\h*\(\h*['"]\w['"]\h*,\h*\9\);\s*(\$\w{1,9})\h*=(?:\h*\21\[\h*\d\h*\]\h*\.){4}[^;]{1,99};\s*\22\h*\(\h*(?:urldecode\h*\(\h*){1,5}\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;\s*(?:\?>|\Z)(?<X1176972>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{99,350}function\s*\w{1,15}\((\$\w{1,9}),\$\w{1,9}\)\{\s*if\(!file_exists\(\24\)\)\h*\{\s*\$\w{1,9}\h*=\h*@fopen\(\24,\h*['"]w['"]\)[^\176]{99,1200}<a\h*href=['"]\?path=<\?php\h*echo\h*\9['"/\.]{1,9}\24;[^\}]{9,55}\}\s*\?>\s*</form>(?<X1147211>)|create_(function)\h*\(['"]\$\w{1,9}['"],implode\h*\([\h'"]+,array_(?:map|walk)\h*\(\s*\26\h*\((\$\w{1,9})\)\s*\{\s*return\h+chr\h*\(\27\);[\s\}]+,\s*\[\d+[^\{]+\{\9\(\$_POST\[['"]\w{1,15}['"]\]\);\s*(?:exit|die)[^;]{0,9};\}\s*\Z(?<X2183981>))|(\$\w{1,9})\s*=[^;]{1,20}\.php['"];\s*if[^\}]{9,150}\}\s*if\s*\((\$_FILES)\)\s*\{\s*\$\w{1,9}\s*=\s*(\30\[[^\]]+\]);\s*(\$\w{1,9})\s*=\s*@?(?:move_uploaded_file|copy)\(\31[^\)]{1,25}\29\);\s*if\s*\(\32\)\s*\{\s*echo[^;]+;\s*\$\w{1,40}\s*=[^\?=]{99,400}echo[^;]{9,50};\s*\}\s*(?:\Z|\?>)(?<X1132091>)|(\$\w{1,9})\s*=\s*(?:(\$_REQUEST\[)[^\]]+\];\s*(\$\w{1,9})\s*=\s*\35['"]DATA['"]\];\s*(\$\w{1,9})\s*=\s*fopen\(\34,\s*['"]a['"]\);\s*fputs\(\37,\s*\36\);\s*fclose\(\37\);\s*\?>(?<X1134010>)|['"][A-z;0-9]{9,99}['"](?:;\s*(\$\w{1,9})\s*=\s*(?:\34\{\d+\}\s*\.\s*){5}[^;]+){3};\s*\$\w{1,9}\s*=\s*\39\([^\[]{1,299}\);\s*(\$\w{1,9})\s*=\s*\39\([^\[]+\$_COOKIE\[[^\]]+\]\s*\)\s*\);\s*\40\(\);\s*\?>(?<X1133941>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\34\D{2,3}['"]\d['"]\)\s*\{\s*echo\s*['"]Shell[^\?]+(?:\?\((?:is_uploaded_file|@?copy)\(\$_FILES\[[^\)]+\)\s*){2}(?<X2134651>)|str_replace\([^\)]+\);\s*(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\(\43\D{2,3}NULL\)\s*header\([^\)]+\);\s*else[^\?]{1,20}\34\(\43\);\s*(?:\Z|\?>)(?<X1124841>))|(\$\w{2,20})\s*=\s*"\\[\\\w]{8,32}"\s*;\s*(\$\w{2,20})\s*=\s*"\\[\\\w]{8,40}";[^`]{29999,65000}\)\)\)\.(?:\45\(\46\(){0,5}[^`]+die\(\$\w{1,40}\);\s*\}\s*\}\s*\}\s*(?:\?>|\Z)(?<X1036324>)|(\$\{['"]GLOBALS['"]\}\[['"]\w{32,99}['"]\])\h*=\h*['"]_[GPRSC]\w{2,6}['"];[^\}\{]{1,99}if[\h\(]+isset[\h\(]+\$\{\48[^\?]{9,999}(?:copy|move_uploaded_file)[\h\(]+(\$_FILES\[[^\]]+\])\[[^\]]+\][\h,]+['"]{2}\h*\.\h*\49(?<X2179292>)|(\$GLOBALS\[[^\]]{1,15}\])=array\((?:['"]\w{1,35}['"],\s*){15}[^\)]{99,9900}\);\s*eval(?:\(\51\[\d{1,4}\]){2}[^\{]{9,199}\{\s*foreach\(\51[^\}]{9,99}return\s*\51;\s*\}\s*(?:\Z|\?>)(?<X2128491>)|(\$REALL_SHELL_SOURCE)\h*=\h*['"][^'"]{999,12000}['"];\s*(?:eval\(['"]?)?\$\w{1,15}\h*=\h*str_replace\h*\([^\}]{0,9}\53\);[^\?]{9,299}\bfwrite\h*\(\$\w{1,15},\h*\$\w{1,15}\);(?:\s*['"]?\);)?\s*\?>(?<X1174082>)|(\bif\h*\(\h*(?:isset\h*\(\h*))?\$_[GPRSC]\w{2,6}\[['"][^\]]+['"]\][\)\s]+\{\s*\55?\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\])?[\)\s]+\{\s*if\h*\(\h*@?(?:copy|move_uploaded_file)\h*\([^;]{0,40}(\$_FILES\h*\[[^\]]+\])[^\{]{1,35}\.basename\(\s*\56[^\?]{1,999}(?:exit|die)\b[^;]{0,19};\s*\}\s*(?:\?>|\Z)(?<X1172251>)|(error_reporting)\((?:0|NULL|FALSE)\);\s*@?clearstatcache\(\);[^#]{99,999}\b(xploitsecid)\h*=\h*['"][^'"]{999,14000}['"];\s*\58[^\?]{9,59}\?>['"]\.(?:str_rot13\(|gzinflate\(|base64_decode\(){4}\$\59[\)]+;\s*\?>(?<X1153511>)|(function)\h*(\w{1,15}\(\))\{\s*(\$\w{1,15})\h*=\h*file_get_contents\(['"]https?://(?:\d{1,3}[\./]){4}[^'"]{1,50}\.txt['"]\);\s*(\w{1,15})\(\63\);\s*\}\s*\61\h*\64\(\$[^\}]{9,40}\beval\(\$[^\}]{1,40}\}\s*\62;\s*\?>(?<X1153190>)|(function)\h+(_{0,2}[ec](?:xec?|md|ommand)\d*(?:ute)?)\h*\(\h*(\$\w{1,40})[\)\s]+\{\s*if\h*\(\h*\66_exists\h*\(['"]([spe](?:assthru|ystem|xec|hell_exec|open))['"][\s\)]+\{[^\}]{1,99}\b\69\h*\(\68\);[^\?]{99,9999}\b\67\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^;]{0,40};(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1165540>)|(function)\s+(\w{1,40})\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*file_get_contents\(['"]php://input['"][^@]{1,499}=\h*\72\([^;]{1,99};\s*\71\s+(\w{1,40})\([^\?]{499,1999}\$(\w{1,40})\h*=\h*\73\([^;]+;\s*(\$\w{1,40})\h*=\h*create_\71\(\h*null,\h*\$\74\h*\);\s*\75\(\);\s*\}\s*(?:\?>|\Z)(?<X1164260>)|(goto)\h*(\w{1,9});\h*\78:\h*error_reporting\((?:0|NULL|FALSE)\);\s*\77[^\n]{9,599}(\$url)\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*if\h*\(!empty\(\79\)\)\h*\{[^\}]{9,199}\bfile_get_contents\(trim\(\79\)\);[^\n]{9,199}\bexec\(\$\w{1,15}\);\h*echo\h*['"][^\}]{0,49}\}\h*\}\s*(?:\?>|\Z)(?<X1169031>)|(goto)\h*\w{1,15};\h*\w{1,15}:\h*\$color\h*=\h*['"](?:[\\x\d]{5,15}|#df5)['"];\h*\81[^\?]{9999,}\bdefault_action\h*=\h*['"](?:[\\x\d]{9,40}|FilesMan)['"];[^\?]{1,250}\81\h*\w{1,15};\h*\w{1,15}:\s*\?>(?<X1163750>)|(goto)\h*\w{1,19};\h*(\w{1,9}):\h*header\(['"]\\x\d[^\?]{99,499}(\$\w{1,9})\h*=\h*file_get_contents\(base64_decode\(['"]\\x\d[^\}]{99,900}\}\h*\83\h*\84;\h*\w{1,9}:\h*echo\h*\85;\h*\83\h*\w{1,9};\h*\w{1,9}:\h*\w{1,9}:\s*\?>(?<X1145340>)|(goto)\h*\w{1,9};\h*(?:(\w{1,9}):\h*if\h*\(!\(strpos\(\$\w{1,9},\h*['"]\\[x\d]\d{2}[^\n]{99,900}\$\w{1,9}\h*=\h*file_get_contents\(base64_decode\(['"]\\[x\d]\d{2}[^\n]{99,600}\$_SERVER\[[^\]]+\]\);\h*\87\h*\88;\h*\w{1,9}:\h*\w{1,9}:\s*\?>(?<X1147042>)|\w{1,9}:\h*chmod\([^\?]{99,999}(\$\w{1,9})\h*=\h*file_get_contents\(\$\w{1,9}\h*\.\h*base64_decode\([^\)]+\)\h*\.\h*\$\w{1,9}\h*\.\h*['"][^'"]{1,99}['"]\h*\.\h*\$_SERVER\[[^\)]{1,99}\);\h*\87\h*(\w{1,9});\h*\91:\h*echo\h*\90;\s*\?>(?<X1145380>))|(goto)\s*(\w{1,40});\s*(\w{1,40}):exec\(['"][^'"]+['"]\);\s*\93\s*(\w{1,40});[^%]{999,1500}@?unlink\([^\)]+\);\s*\93\s*\95;\s*\96:exec\([^%]{99,400}\94:error_reporting\((?:0|NULL)\);\s*\93\s+\w{1,40};\w{1,40}:\w{1,20}:\s*(?:\Z|\?>)(?<X1127630>)|(goto)\s*(\w{1,7});\s*\99:\s*echo\s*['"][^'"]{1,180}['"];\s*\98\s*\w{1,7}[^i]{99,200}include\s*\$_[PGSCR]\w{2,6}\[['"][^'"]+['"]\][^\?]{500,1100}curl_exec\(\$\w{1,7}\);\s*\98[^\{]{9,99}\{\s*file_put_contents\([^\}]{9,99}\}\s*\98\s*\w{1,7};\s*\w{1,7}:\s*\w{1,7}:(?:\Z|\?>)(?<X2123381>)|(goto)\s*(\w{1,9});[^\$]{1,40}\102:\s+\$GLOBALS\[['"](?:\\[\dx]\d{1,2}){3}[^'"]{1,30}['"]\]\s*=\s*array\([^\(]{9,199}@?eval\((\$\w{1,9})\)[^\101]{9,150}\101\s*(\w{1,9});\s*\104:\s*\103\s*=\s*\$GLOBALS\[[^\101]{99,799}\101\s*\w{1,9};(?:\s+\w{1,9}:){2}\s*(?:\Z|\?>)(?<X2128071>)|(goto)\s*\w{1,5};\s*\w{1,5}:\s*\$\w{1,5}\s*=\s*fopen\(['"][^@]{9,150}@?ini_set\(['"][^'"]{9,70}['"],\s*0\);\s*\106[^\?]{99,2000}return\s*curl_exec[^\?]{99,2500}move_uploaded_file\(\$_FILES[^\?]{99,3000}file_get_contents\(['"][\\x\d]{9,19}[^\?]{9,350}\106\s*\w{1,5};\s*(?:\w{1,5}:\s*){2}(?<X1128780>))
\A\s*<\?(?:[ph\s]+(\$_[GPRSC]\w{2,6}\[['"]shellurl['"]\])[\h=]+['"]https?://[^'"]+['"];[^\?]{9,399}\bfunction\h+(\w+)[\h\(]+\$\w{1,25}[\h\)]+\s*\{[^\}]{9,350}\bcurl_close\(\$\w+\);\s*\}[^\?]{99,699}\becho\h*\2[\h\(]+\1[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1212960>)|[ph\s]+(\$group_num)[=\s]+[^;]{0,50};\$inter_domain[=\s]+['"]https?[^'"]+['"]\.\4[^;]{1,50};[^\@]{1,300}\bfunction\s*(\w+)[^\%]{1,3800}(\$\w{1,40})[=\s]+(?:\$\w{1,40}[\.;])+\$\w{1,40}[\[\s]+['"]main_shell['"][\]\s]+[=\s]+\6[^\%]{1,500}(\$\w{1,40})[=\s]+\5[^;]+;[^\%]{1,200}echo\s*\7;(?:exit|die);[\}\s]+else[^\}]+\}\s*\?>\Z(?<X1221655>)|[ph\s]+(\$group_num)[\h=]+['"]\w+['"];\h*\$inter_domain[\h=]+['"]https?://[\d\.]+/[^;]{0,49}\9\b[^\n]{499,}\b(?:header[\h\(]+['"]HTTP/[\d\.]+\s+(?:500|40[43])\b[^\?\n]{1,199}){3,}(?:\?>|\Z)(?<X1225630>)|[ph\s]+(\$wp_hash_calc)[\h=]+pack\h*\(['"]H\*['"],['"][a-f0-9]{9999,}['"]\);\s*@?eval\h*\(\11\);\s*\$_\w{24,60}[\h=]+\d+;\s*(?:\?>)?\Z(?<X2202460>)|[ph\s]+(function)\h*(\w{1,20})\([^\)]+\)[\s\{]+[^\}]{9,99}\}\s*\13\h*(\w{1,20})\([^\)]+\)[\{\s]+\$\w{1,20}[\h=]+\14\([^'"]{99,400}\}\s*(\$\w{1,20})[\h=]+['"][^'"]{9999,}['"];\s*(\$\w{1,20})[\h=]+['"]\w+['"];\s*(\$\w{1,20})[\h=]+\15[\(\h]+\16,\17\);\s*@?eval[\h\(]+\18\);\s*(?:\?>\s*)?\Z(?<X2210972>)|[ph\s]+(global)\s+\$(zym_decrypt);(?:\h*\$\21\[[^\]]+\][\h=]+base64_decode\h*\([^;]{1,199};){3,}\s*\?>\s*<\?[ph\s]+(?:(\$\20s\[['"]\21['"]\]\[)[^\]]+\]\([^\n]{4999,}\}\h*function\h+\w+[\h\(]+(\$\w+)[\h\)]+\{\h*return\h+\22[^\]]+\][\h\(]+\23[\h\)]+;[\h\}]+(?:\?>|\Z)(?<X1198931>)|\$\w+[\h=]+(\$\20s\[['"]\21['"]\]\[)[^\]]+\]\([^\n]{4999,}\25[^\]]+\]\([^;]{1,199}\b(?:return\h+(?:true|false);[\h\}]+){1,5}\h*(?:\?>|\Z)(?<X1198940>))|[ph\s]+(if\(isset\()(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+)\{file_put_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\.['"]\.\w+['"],(base64_decode)\(\28;\}\27(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+)\{unlink\(\29\(\30;\}\?>\Z(?<X2223193>)|[ph\s]+//\h*Silence\h*is\h*golden\.?[^;\$=]{1,99}@?error_reporting[\(\h]+(?:0|NULL|FALSE)\);[^\{]{1,40}\bfunction\h+(?:login|web).shell\(\)\s*\{(?<X2212340>)|[ph\s]+//\s*\w{0,19}AdsenseInject[^%#\*]{1,999}\$(\w+)[\s=]+['"]https?://[^'"]+\.zip['"];[^\?]{0,199}\b(\w+)\s*\([^\)]*\$\33\b[^#]{9999,}\bfunction\s+\34\w{0,9}[\s\(]+(\$\w+)[,\s]+(\$\w+)[\)\s]+\{[^\}\{]*\bfile_put_contents[\s\(]+\35\s*,[^;]*\36\b[^\}\{]+\}\s*(?:\?>|\Z)(?<X1211240>)|[ph\s]+/[\s\*]+@link\s+https?://[^/]*\bz0n51\.[\w\.]+\b[^;\$\(\)\{=]{0,199}\bfacebook\.com/z0n51\b(?<X2200610>)|[ph\s]+/[\s\*]+Plugin\s+Name[\s:]+(\w+)[\s\*]+/\s*function\s+(\w+)[\s\(\)]+\{\s*if[\s\(]+isset[\s\(]+(\$_[GPCSR]\w{2,6}[\s\[]+['"]\39['"]\s*\])[\s\)]+\{\s*@?echo\s+\41;\s*(@?(?:die|exit)\b[^;]{0,19};)[\s\}]+(add_action[\s\(]+['"]\w+['"][\s,]+['"])\40['"][^\?]{499,}\becho\s+\$\w+;\s*\42[\s\}]+\43[^;]+;\s*(?:\?>\s*)?\Z(?<X2211100>)|[ph\s]+/\*\*(?:[\s\*]+Plugin\h*Name:\h*(\w{1,20})\s*\*/\s*(function)\h+\w{1,20}\(\)[\{\s]+if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[['"]\45['']\]\)\)[\{\s]+[^\?>\*]{400,1200}\b\46\h+\w{1,20}\(\)[\{\s]+\$\w{1,20}[\h=]+['"]\45['"];[^@\?\*]{200,900}\bfile_put_contents\([^\?>]{600,1500}\}\s*add_action\([^\;]+;\s*(?:\?>|\Z)(?<X2205540>)|\s*\*[^\$\{\(]{0,150}Responsive\h*Webshell[^\$]{1,40}\$\w{1,20}[\h=]+\[(?<X2203531>)|\s+\*\s+PANEL\s+PRIV8\s+LIVE\b(?<X2208781>))|[ph\s]+@?(?:set_time_limit|error_reporting)\([^\n]{999,3500}\b(goto)\h*\w+;\h*\}\h*header\([^\)]+\);\h*echo\h*\$\w+\[\d+\];\h*exit[^\n]{999,3000}\b\50\h*\w+;\h*\w+:\h*\}\s*\?>(?<X1215910>)|[ph\s]+@?(file_)pu(t_contents)[\s\(]+['"][^'"]+\.php\d*['"][,\s]+@?\52ge\53[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;?\s*(?:\?>|\Z)(?<X1220430>)|[ph\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:[\(\s]+['"](?:curl|wget)\s*https?://(?:\w{1,40}\.){4,}oast\.me/[^\?]{1,40}\.txt[^\)]{0,40}['"]\);\s*(?:\?>|\Z)(?<X1233941>)|[\s\(]+['"](?:/bin/)?bash\h*\-i\h*>&\h*/dev/tcp/[\d\.]{5,20}/\d{3,5}\h*0>&1[\h'"]+\);\s*(?:\?>)?\Z(?<X2205793>))|[ph\s]+@?error_reporting[\s\(]+(?:0|NULL|False)[\s\)]+;\s*(?:@?session_start[\s\(\)]+;\s*)?class\s+(\w+)[\s\{]+(?:[pf]\w+\s*)?\$\w+[\s=]+['"]https?://[^/'"]*\bgovniku\.site\b[^@<%]{999,}\}\s*(\$\w+)[\s=]+new\s+\57[\s\(\)]+;\s*\58\s*\->\s*doAction[\s\(\)]+;\s*(?:\?>|\Z)(?<X1210160>)|[ph\s]+@?eval[\h\(]+gzuncompress[\h\(]+['"]x\\xda\\xe5\\xbd\\xedv[^\n]{15000,}\\xd9.A\\x7f["']\)\);(?:\s*\?>)?\Z(?<X2218900>)|[ph\s]+@?file_put_contents[\(\h]+['"][^\.]{1,40}\.php\d*['"][,\h]+['"]<\?[ph\s=]+echo\h*phpinfo\(\);['"\h\)]{2,5};\s*(?:\?>)?\Z(?<X1232571>)|[ph\s]+[^\$]{0,99}\$[KLP_O0]+[\h=]+['"]\d+['"];\s*(\$[KLP_O0]+)[\h=]+['"][^'"]{32,64}['"];\$\w{1,25}[\h=]+(?:\62\[\d+\]\.){15}[^\n]{999,14000}\bCURLOPT_CONNECTTIMEOUT,\h*\$[KLP_O0]+\);[^\n]{999,25000}\bexit[\(\)\}\h;]+\$\{['"][GOBALS\\x471532cf]{9,30}['"]\}\[[^\]]+\]\(\);\?>\z(?<X2223311>)|[ph\s]+[^\(]{0,20}\bfunction\h*(\w{1,15})\([^#]{9,350}\}\s*(\$\w{1,15})[\h=]+['"][^;]{999,4000}['"];\s*(\$\w{1,15})[\h=]+Array\([^\)]{99,650}\);\s*(\$\w{1,15})[\h=]+\64\(\65,\h*\66\);\s*(\$\w{1,15})[\h=]+['"creat_funio\.\\x\dh\(\)]{16,99};\h*\68\([^\$]{1,20}\67[^;]{1,20};\s*(?:\Z|\?>)(?<X2129814>)|[ph\s]+[ir](?:nclud|equir)e(?:_once)\s*(?:\(\s*)?['"][^"']+/images?/[^'"]{0,199}\.[^/'"]+['"]\);\s*\?>(?<X1212210>)|[ph\s]+\$(?:bot){2,4}[\h=]+[^;]+;\s*error_reporting\((?:0|NULL)\);[^\{\?]{999,5500}\bfopen\((\$\w+)\.(base64_decode)\([^\)]+\),\h*\72[^\?]{99,1200}\bfile\(\72\(\72[^\?]{99,999}\bchmod\(\71\.\$\w+[^\?]{999,2000}\bexec\(\72[^>]+>\h*/dev/null[^\)]+\);\s*@?unlink\([^\)]+\);\s*\?>(?<X1208370>)|[ph\s]+\$\w+=['"][^;]{1,19};(\$\w+)=['"]https?://[^;]+;\$\w+=\74\.['"]/jump\w+\.php['"];(?:\$\w+=\74\b[^;]+;){2}[^#@]{999,}\bfile_put_contents\([^;]+\brobots\.txt['"][^#@]{1,499}\?header\(['"]HTTP/[\d\.]+\s+40[34]\b[^\?#]{1,499}\becho\s*\$\w+;exit\b[^;\}]{0,19};[\};]+\?>(?<X1223940>)|[ph\s]+\$\w+[\h=]+['"](file_)put(_contents)['"];[^\}]{99,599}[\s\}]+return\h*\$\w+;[\s\}]+(\$\w+)[\h=]+\$_COOKIE;\s*\78[\h=]+array_merge[\h\(]+\78,\h*\$_POST[\h\)]+;[^\{]{0,99}\bforeach[\h\(]+\78\h*as\h*\$\w+\h*=>\h*(\$\w+)[^\?]{0,499}\b\76put\77[\h\(]+\$\w+,[^\$]+\79\[[^\}]+\}\s*exit[\s\(\)\};]+\Z(?<X2238850>)|[ph\s]+\$\w+[\s=]+(function)\s*\([\s\)]+\{[^\}]{1,499}\};\s*\$(\w+)[\s=]+\81[\s\(]+(\$\w+)[\s\)]+\{[^\}]{0,499}\beval\s*\([^\)]*\83\b[^\?]{999,}\$\82[\s\(]+\$\w+[\s\)]+;\s*(?:\?>|\Z)(?<X1209771>)|[ph\s]+\$\w{1,25}\h*=[^\?:]{0,99}\b(http)s?://[^'"]+\.top['"];\s*\$\w{1,25}[\h=]+['"]['"\.base64_ncod]+;[^\n\^#%]{999,2999}\bheader\(['"]\85/\d\.\d\h*404\h*not\h*found['"][^\n\^%#]{99,999}\b\85_build_query\(\$\w{1,25}\);(\$\w{1,25})[\h=]+@?file_get_contents\(\$\w[^\?]{0,399}\breturn\h*\86;\}\s*\?>(?<X1212571>)|[ph\s]+\$botbotbot[\h=]+['"]\d+['"];\s*error_reporting\h*\([^@]{2000,9000}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+[^;]{9,99}\);\s*@?unlink[\h\(]+[^\)]+\);(?:\s*\?>)?(?<X1208310>)|[ph\s]+class\s*(\w+)(?:\s*\{(?:[^\}]{1,499}(?:\}\s*)+\$(\w+)[\s=]+new\s+\89\s*\(\s*\);\s*(\$\w+)[\s=]+\$\90\s*\->[^;]+;\s*@?eval[\s\(]+\91[\s\)]+;\s*(?:\?>|\Z)(?<X1209850>)|\s*(?:const\s*platform_\w{5,10}\s*=\s*\d{1,2};\s*){2,9}(private)\s*\$(\w+)\s*=\s*["'][^'"]{60000,}["'];\s*\93[^<\\]{999,2500}gzinflate\(base64_decode\(\$\w+->\94\)\);[^;]{10,100};\s*\}\s*(\$\w+)\s*=\s*new\s*\89[^;]{1,9};\s*echo\s*\95\->execute\(\);\s*(?:\?>|\Z)(?<X1118745>))|\{private\s*static\s*(\$\w+);\s*static\s*function\s*(\w+\()[^;\{]+\{if\(!self::\97\)[\s:]+self::\w+\(\)[^@]{999,29999}\bfile_get_contents\(\$_FILES\[\89::\98[^\176]{999,}\breturn\s*\$\w+[\s\.]+\89::\98[^\)]+\);[\s\};]+(?:\?>|\Z)(?<X1228090>))|[ph\s]+define\(['"]PBOX['"][^;]+;[ri](?:nclud|equir)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*\bdelayedlinks\.php['"](?:\)\s*)?;\s*\?>\s*(?:<\?[ph\s]+checkpost[\s\(]+\d+[\s\)]+;\s*\?>\s*)?<!DOCTYPE\s*html>(?<X2202451>)|[ph\s]+echo(?:\s*@?file_get_contents[\(\s]+['"]https://raw\.githubusercontent\.com/(Bozarov)/[^'"]{1,60}\101\d+\.txt['"]\);?\s*\?>(?<X1214871>)|\s+['"]<form\b[^\},]{99,}\$(\w+)[\s=]+\$_FILES\[[^\}\?]{1,199}\b[mc]o(?:py|ve_uploaded_file)\s*\([^\)]*\$\103\b[^\?]{0,199}\b__halt_compiler\s*\(\s*\);?\s*(?:\?>|\Z)(?<X1205392>)))
\A\s*<\?(?:[ph\s]+error_reporting(?:[\(\h]+(?:0|NULL)[\s\);]+if[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*(\$\w{1,25})[\h=]+(\$_FILES\[)[^;]+;\s*(\$\w{1,25})[\h=]+\2[^;]+;\s*echo\h*['"]<form[^;]+;\s*@?(?:copy|move_uploaded_file)[\h\(]+(?:\1|\3|,){3}[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1204590>)|\((?:0|NULL)\);\s*(\$\w{1,25})[\h=]+(base64_decode)\([^\)]+\)\.\$_SERVER\[\6\([^\)]+\)\];\s*\5[\h=]+str_replace\(\6[^\?]{9,1500}\bGET\s*\$\w{1,25}\h*HTTP/\d\.\d\\[^\?]{9,1999}\bcurl_close\(\$\w{1,25}[\);\}\s]+\$(bot)\7+[\h=]+['"]\d+['"];\s*\?>(?<X1207680>)|\((?:0|NULL|False)\);(?:(?:set_time_limit\(0\);)?header\(['"]Content\-type:\s*text/html\b[^\)]+\);function\s+(\w+)\([^\{;]+\{[^\}]{0,499}=pack\([^;]+;\}?return\s*\$\w+;\}(\$\w+)=\9\(['"]{2}\.[^;]+;['"];\$\w+=eval\(\10\);\s*(?:\?>\s*)?\Z(?<X2211411>)|[^\$]{0,40}\bdefine\([^,]{1,20},\h*['"][^'"]{1,20}(?:shell|back\h*door)['"]\);\s*\$\w{1,20}[\h=]+['"]scandir['"];(?<X2204070>)|\s*if\([^:]{1,150}(\$\w{1,20})=['"]https?://pastebin\.com/raw/\w+['"];\s*(\$\w{1,20})=(curl_)init\(\13\);[^\?>]{9,250}(\$\w{1,20})=\15exec\(\14\);[^\?]{9,99}\bfwrite\([^,]+,['"]<\?[ph\s]+file_get_contents\([^\)]+\);\h*\?>['"]\.\16\);\s*fclose\([^\)]+\);\s*(?:\?>)?\Z(?<X2226050>))|\(0\);(\$\w+)=\$_[GPCSR]\w{2,6}\[[^;]{1,199};if\([^\$\{;]{0,99}\18\b[^\{;]{1,499}\{[^\}]{0,999}(\$\w+)(=\$_FILES\[base64_decode\()[^;]{1,199};(\$\w+)\20[^\}]{0,999}\b[cm]o(?:py|ve_uploaded_file)\((?:\21|\19),(?:\21|\19)\);\}\s*(?:\?>|\Z)(?<X1225090>)|\([^\?]{9,99}(\$\w{1,15})[\h=]+['"][^'"]+['"];\s*(\$\w{1,15})[\h=]+urldecode\(\23\);\s*date_default_timezone_set\([^\)]+\);[^#]{4999,6999}\bfunction\s*\w{1,15}\(\24,[^\?]{99,250}(\$\w{1,15})[\h=]+fopen\(@?\$_SERVER\[[^\?]{9,150}\bfclose\(\25\);\s*return[^;]+;\s*\}\s*\?>(?<X1203900>))|[ph\s]+function(?:\h*(?:([a-z0-9]{1,20})\([^\)]+\)[\{\s]+(\$\w{1,20})[\h=]+['"]{2};\s*for[\h\(]+[^\{]{9,99}\{\s*\28\h*\.=\h*pack\(['"]H\*["'][\h,]+substr\([^\}]{1,20}\}\s*return\h+\28;[\}\s]+(\$\w{1,20})[\h=]+\27\([^\)]+\);\s*(\$\w{1,20})[\h=]+\27\([^\)]+\);\s*(\$\w{1,20})=\29\(['"]{2}[\h,]+\30\([^\)]{200,999}\)\);\s*\31\(\);\s*/\*\h*[a-z0-9]{32,64}\h*\*/(?<X1209690>)|(\w+)[\h(]+\$[^\}]+\}\s*return\h*\$\w+;\s*\}\s*(\$\w+)[\h=]+Array[\(\)\h]+;\s*\34[\[\]\h]+[\h=]+\33[\h\(]+Array\h*\([^\}]{99,999}\bforeach[\h\(]+\34\[\d+\][\h\(]+\$_COOKIE,\h*\$_POST[\h\)]+as\h*\$[^\?]{99,599},\h*\34\[\d+\][\h\(]+\$\w+[\h\)]+;\s*\}\s*\Z(?<X2238702>))|\s*(?:(\w+)[\s\(](\$\w+)\s*\)\s*\{[^\n\?]{0,199}\b[ae](?:val|ssert)[\s\(]+\37[\s\)]+;[^\?\n]{0,99}\b\36[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+;\s*(?:\?>|\Z)(?<X1194930>)|(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})[\s=]+gz(?:inflate|uncompress)[\s\(]+base64_decode[\s\(]+\40[\s\);]+for[\s\(]+(\$\w{1,40})[\s=]+\d+;\s*\42[^;]+\41[^\}]+(\41\[\42\])\s*=[^;]+\43[^;]+;[\s\}]+return\s*\41;\s*\}\s*@?eval[\s\(]+\39[\s\('"]+[^'"]{99,1200}['"\)\s]+;\s*(?:\?>|\Z)(?<X1193861>))|\s+(\w+)(?:[\s\(]+(\$\w+)[\s\)]+\{[^\?]{1,999}\$(\w+)[\s=]+@?file_get_contents[\s\(]+\46[\s\)]+;[^\?]{0,499}\breturn\s+\$\47;\s*\}\s*echo\s*@?\45[\s\(]+['"]https?://[^'"]+/raw/[^;]+;\s*(?:\?>|\Z)(?<X1213480>)|\s*\([^#%]{1,999}\bpreg_match[\s\(]+['"]\W[^'"]{0,49}\(\.\*\)[^'"]+['"][\s,]+\$_SERVER\[["']HTTP_USER_AGENT['"]\][\s,]+(\$\w+)\s*\)[^\?]{0,199}\$(\w+)[\s=]+\49\[[^\?%]{1,199}\$(\w+)[\s=]+['"][^'"]{999,}['"];\s*@?eval[\s\(]+\45[\s\(]+\$\51[\s,]+\$\50[\s\)]+;\s*(?:\?>|\Z)(?<X1220240>))|\s+(\w{1,9})\s*\((\$\w{1,9})\)\s*\{\s*\$\w{1,9}\s*=\s*\!\s*empty\s*\((\$_GET\[\54\])\)\s*\?\s*\55[^\{]{9,99}\{\s*@?eval\s*\(\$_POST\[[^\)]+\);\s*exit;\s*(?:\}\s*if\s*\(\53\([^\}]+\})?\s*(?:[/\w]+)?\s*(?:\?>|\Z)(?<X1060183>))|[ph\s]+header\(\h*['"]Content\-type\h*:\h*text/html?;[^\n]{99,4500}\$perms\h*&\h*0x\d[^\n]{999,};\h*(\$\w{1,40})\h*=\h*['"]?__FILE__['"]?;[^\};]{1,199}\bunlink\h*\(\h*\57\h*\)\h*;[\}\h]+(?:else\s*\{[\}\s]+)?(?:\?>|\Z)(?<X11894514>)|[ph\s]+if[\s\(]+\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\s\)]+\{\s*@?eval[\s\(]+@?base64_decode[\s\(]+['"][^'"]*cmF3LmdpdGh1YnVzZXJjb250ZW50LmNvb[^;]+;\s*\}\s*else\s*\{\s*@?header[\s\(]+['"]HTTP/[^;]+;\s*\}\s*\?>(?<X1202010>)|[ph\s]+if\(file_exists\(['"](/(?:\.|[^'"]+/\.[^'"]+))['"]\)+\{?(?:(\$\w{1,40})=(?:\w{1,40}\(){1,}file_get_contents\(['"]\60['"]\)+;)?(?:eval|assert)\((?:\61|file_get_contents\(['"]\60['"])\)+;\}?\s*(?:\?>\s*)\Z(?<X2191761>)|[ph\s]+if\h*\([^\)]{0,99}(\$_[GPCSR]\w{2,6}\[)[^\?><#%:\r\n]{1,999}\b(file_)pu(t_contents)\h*\([^\)]{0,19}\63[^\?><#%:\r\n]{1,999}\becho\h+\64ge\65\h*\([^\)]{0,19}\63[^;]{1,99};\h*(?:die|exit)\b[^;]{0,19};\h*\}\s*(?:\?>|\Z)(?<X1189680>)|[ph\s]+if\s*\((?:[^\)]*(\$_[GPSCR]\w{2,6}\[)[^;\{]+\{\s*(\$\w+)[\s=]+fopen[\s\(]+['"]([^'"]+)['"][^;]+;\s*@?fwrite[\s\(]+\68\s*,[^;]*\67[^;]+;\s*fclose[\s\(]+\68[\s\)]+;[\s\}]+if\s*\([^;]+\becho\s+(file_get_contents[\s\(]+)['"]+\69['"\)\s]+;[\s\}]+if\s*\([^\{;]+\{[^\}]+\bfwrite\s*\([^,;]+,\s*\70\67[^\}]+\}\s*\?>(?<X1223120>)|[^\)]{0,99}\$_[GPCSR]\w{2,6}\[[^;\?]{0,99}\b(?:exit|die)[\s\(]+@?eval[\s\(]+\$_[GPSRC]\w{2,6}\[[^\]]+\][\s\)]+(?:;\s*)?(?:\}\s*)?(?:\?>|\Z)(?<X1216160>)|[^\{;:]+\$_[GPCSR]\w{2,6}\b[^\{;:]{1,49}\{\s*(\$\w+)[\h=]+\$_[GPCSR]\w{2,6};\h*\([^\{;:\?]*\73[^\;\{\}\?\n]+\?[\h\(]+(?:\73(?:\[\d+\])?[\s=]+\73\[[^\?\n;\{\}:]{1,49}){3}[^\?\n;\{\}:]{1,199}\73\h*\([\s\)]+:\h*\73;\s*\}\s*(?:\?>|\Z)(?<X1203280>))|\s+(\$GLOBALS\[[^\]]{1,40}\])=Array\(base64_decode\([^\+]{999,1500}CURLOPT_RETURNTRANSFER,round\([^\?]{300,999}\{\75\[\d+\]\([^\)]+\)\);\}echo\s+\$\w{1,40};\s*(?:\?>|\Z)(?<X1061000>)|echo\s+\d+\s*[+*/-]\s*\d+;\?>\Z(?<X1036490>)|php(?:\s*(\$\w{1,40})\h*=\h*\$_POST\[['"]?\w{1,40}['"]?\]\h*;){4,9}\s*(\$\w{1,40})\h*=\h*@?mail\h*\([^\)]{0,99}\78[^\)]{0,99}\)\h*;\s*if\h*\(\h*\79\h*\)\s*\{[^\}]{1,99}\}(?:\s*else\s*\{[^\}]{1,99}\})?\s*(?:\?>|\Z)(?<X1141410>)|php(?:\s*@\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST|FILES)\[[^\;]{1,40}\];){4}[^\?]{0,999}\?>[^/]{1,400}<title>\D{0,40}Mailer[^/]{0,40}</title>(?<X2121210>)|php(?:\s*\$\w\s*=\s*['"][\w:/\?\.=]{1,9}['"]\s*;\s*){5,16}\s*\$\w{1,40}\s*=\s*(?:\s*\.?\s*\$\w){5,16}\s*;\s*(\$\w{1,40})\s*=\s*curl_init\s*\(\s*\)\s*;[^\?]{1,600}?\s*\$\w{1,40}\s*=\s*@?curl_exec\s*\(\s*\82\s*\)\s*;\s*@?eval\s*\(\s*\$\w{1,40}\s*\)\s*;\s*(?:\?>|\Z)(?<X1059930>)|php(?:\s*\$\w{1,40}\h*=(?:\h*strtolower\()?\h*\$_SERVER\[[^\]]+\](?:\h*\))?\h*;){3}\s*if\h*\([^>]{99,499}\$\w{1,40}\h*=\h*array\h*\(\s*['"][^'"]{1,40}['"]\h*=>[^\*]{999,9999}if\(\$from_search_engine\)\s*\{\s*header\(['"]Location:\h*https?://[^'"]{9,299}['"]\);\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*\?>(?<X1152250>)|php(?:\s*echo\s*[^`]{1,250};){0,3}\s*if\s*\(\$_POST\[['"]\w{1,40}['"]\]\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[\s*['"][^'"]{1,40}['"]\s*\]\s*\[\s*['"][^'"]{1,40}['"]\s*\][^`]{1,200}\s*\}\s*else\s*\{\s*echo\s*['"][^`]{0,40}gagal[^`]{0,40}['"]\s*;\s*\}\s*\}\s*(?:\?>|\Z)(?<X1042240>)|php(?:\s*function\s*\w{1,40}\(\$\w{1,40},\$\w{1,40},\$\w{1,40}\)\s*\{return\s*str_replace\(\$\w{1,40},\$\w{1,40},\$\w{1,40}\);\}){3}[^\?]{200,1500}['"]\)\);['"]\);\s*\$\w{1,40}\(['"]ZXZhbChiYXNlNjRfZGVjb2Rl[^'"]{1500,5000}['"]\);\s*(?:\?>|\Z)(?<X1042370>)|php(?:\s+@?session_start\(\);|\s+@?error_reporting\(0\);){2}[^\{]{1,300}(\$\w{1,9})\s*=\s*\$_SESSION\[[^\]]+\][^;]{0,20};\s*function\s+(\w{1,16}copy)\((\$\w{1,9}),\s*\87\)\s*\{[^@]{1,40}\89\);\s*@?mkdir\(\87\);[^\}]{1,199}\88\(\89[^\?]{1,300}\88\(\89,\s*\87\)[^\?]{1,40}unset\(\87\);\s*(?:\?>)?\s*\Z(?<X2064270>)|php[ ]+(?:(\$\w{1,40})[ ]*\=[ ]*['"\s\.gzuncompres]{20,99};[ ]*(\$\w{1,40})[ ]*\=[ ]*['"\s\.base64_dco]{20,99}[ ]*;[^\n\?]{999,9999}eval\s*\((?:[^;]{0,40}(?:\91|\92)){2}[^;]+;\s*(?:\?>|\Z)(?<X1133690>)|if\(!isset\(\$\w{1,40}\)\)\{function[ ]+(\w{1,40})\(\$\w{1,40}\)\{if\(preg_match_all\(['"][^`]{999,1500}\94[^;]+;\s*@?eval\(base64_decode\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);[ ]*\?>(?<X1124232>)))
\A\s*<\?(?:php[ ]{200,}(?:(\$\w{0,20})\s*=\s*['"][^'"]+['"];\s*(\1\w{1,20})\s*=\s*strtoupper\s*\(\s*(?:\1\[[^\]]+\]\.?){3,7}\);\s*if\s*\(\s*isset\s*\(\s*(\$\{\2\}\[[^\]]+\])\)\s*\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|passthru)\s*\(\s*\3\);\s*\}\s*(?:\?>|\Z)(?<X1063741>)|\s*(?:\$\w{1,40}\s*=\s*array\s*\(\s*[^\)]+\s*\);\s*){1,5}(\$\w{20,99})\s*=\s*['"](?:ZXZhb|IGV2YW)[^"']+["'];\s*if\s*\(\s*\!function_exists\s*\(\s*['"](\w{1,40})['"]\s*\)\s*\)\s*\{\s*function\s*\6\s*\([^\?]{100,500}\(\s*\$\w{1,40}\s*,[^\?]+\5\s*\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1058750>))|php[ ]{300,}(?:(\$\w{1,40})\s*=\s*['"][^'"]*['"];\s*\8\s*=\s*str_replace\s*\([^$]+,\8\);\s*){2,4}\$\w{1,40}\s*=\s*[^;]+;\s*(\$\w{1,40})\s*=\s*\$[^;]+;['"]\);\s*\9\s*\(['"][^'"]{4000,30000}['"]\);\s*\?>(?<X1063420>)|php[ ]{999,9999}@?error_reporting\h*\((?:0|NULL|False)\);[^#%\v\*\176]{999,9999}\}\s*[ed](?:ie|xit)[^;]{0,19};\s*define\h*\(\h*['"](LIC_CODE)['"]\h*,[^\)]+\);\s*echo\s*\$?\11;\s*(?:\?>|\Z)(?<X1165250>)|php[/\*\s]+Moodle\s+[^\w]{1,3}\s+\d+\.\d+\.\d+\s+Remote\s+code\s+execution[/\*\s]+\$\w{1,20}\s*=\s*['"]https?://(?<X2062650>)|php[^#\{]{0,2599}\berror_reporting\(0\);\s*(?:ignore_user_abort|set_time_limit)\([^\{]{9,99}\b(?:define\(['"]__(?:STATISTIC_URL|DOMAIN_NAME|SEC_VALUE)__['"],[^\)]{1,49}\);\s*){3}[^\{]{0,300}\bfunction\h*GetContents\(\$\w{1,9}(?<X2182641>)|php[^#]{0,99}(\$\w{1,15})\h*=\h*(base64_decode)\((?:(?:chr\(\d{1,3}\)|['"]\w['"])\.){9,15}[^\;]{0,99};\s*eval\h*\(\h*\16\((?:(?:chr\(\d{1,3}\)|['"]\w['"])[\.\)]){1,9}\.\15\(\16\((?:(?:chr\(\d{1,3}\)|['"]\w['"])\.){7,15}[^\?]{1,250}(?:\?>|\Z)(?<X1168990>)|php[^#]{9,99}error_reporting\((?:0|NULL)\);\s*#{5,20}\s*.{1,3}Dexter\s*.{0,3}#{5,20}\s*include\((?<X2063051>)|php[^$]{0,400}error_reporting\s*\(0\);\s*(\$\w{1,40})\s*=\s*(file_)get(_contents)\s*\(['"]https?://dl\.dropboxusercontent\.com/[^/]+/\w{1,40}/\w{1,20}\.php['"]\);\s*@?\20put\21\([^,]+,\s*\19\);\s*@?unlink\s*\(__FILE__\);\s*(?:\?>|\Z)(?<X1061680>)|php[^&\$\(\.]{1,200}\bTeam\s*:\s*Dreamhackers\s*.\s+.\s+m(?:o|a)de\s*:\s*in\s+Moroccan\s+spamer\s+.\s+.\s+create?\s*:\s*dexter\b(?<X2063082>)|php[^'"]{0,99}\becho\h*['"][^;'"]{2,99}\bbypass\h*e?xploit[^;]{2,60};\s*mkdir\h*\((?<X2173911>)|php[^'"]{1,40}(\$\w{1,9})\s*=\s*['"](\\x66\\x69\\x6c\\x65\\x5f)[^'"]{5,50}['"];\s*(\$\w{1,9})\s*=\s*['"]\26[^'"]{5,50}['"];\s*var_dump\((\$_[GPRSC]\w{2,6})\[[^\]]+\]\(\28\[[^\]]+\]\)+;\s*@?\27\(\28\[[^\]]+\],\s*@?\25\(\28\[[^\]]+\]\)+;\s*(?:\Z|\?>)(?<X1124901>)|php[^']{9,99}Script\s+Resetpass\s+(?:CP|CPANEL)\s+20\d{2}(?<X2061070>)|php[^/]{9,300}/\*\s*Bloodninja:\s*I\s+lick\s+your\s+earlobe,?\s*and\s+undo\s+your\s+watch\.\s*\*/(?<X2262941>)|php[^://]{9,99}\$\w{1,20}=['"]https?://pastebin\.com/(?:raw|download)/[^\\@&\*]{99,300}<meta\h+name=['"]description['"]\h+content=['"][^'"]{1,30}\bransomware['"]>(?<X2186150>)|php[^:/]{9,70}Title\s*:\s*Con(?:t|7)ext\s+(?:Mini|web)\s+Shell(?<X2060881>)|php[^:=;\$]{0,99}\bL[3e]{2}bo\h+Phishers\h*=\h*(?:ICQ|jabber):(?<X2151402>)|php[^:\$@=\(\{]{1,99}\bSearch\h+Engine\h+Doorway\h+Generator\b(?<X2164520>)|php[^;]{0,99}error_reporting\s*\((?:0|NULL)\);\s*define\s*\([^\)]+\);\s*goto\s+(\w{1,20});\s*function\s+(\w{1,20}\(\))\s*\{\s*@?preg_replace\s*\(\s*.?['"](.).{0,60}\38e['"]\s*,\s*strrev\s*\(['"](?:\\x\w{2}|\\\d{1,3}){1,15}['"][^'"]{999,5000}['"][^\}]{9,150}\}\s*\36:\s*\37;[^\)]+\);.\w{999,}\Z(?<X1064540>)|php[^;]{99,300}(?:(?:error_reporting|set_time_limit)\((?:0|NULL)\);\s*){2}[^\{]{50,150}function\s*(\w{1,20})\((\$\w{1,9})\)\{\s*@?eval\(str_rot13\(gzinflate\(str_rot13\(base64_decode\(\41\)+;\s*\}\s*(\$\w{1,9})=['"][^'"]{9999,35000}['"];\s*\40\(\42\);\s*(?:\Z|\?>)(?<X2127550>)|php[^=]{1,99}(\$\w{1,20})\h*=\h*[^\.;]{1,99}\.php['"];\s*(\$\w{1,20})\h*=\h*[^\.;]{1,99}\.php['"];[^\?\[]{1,250}if\h*\((hash\h*\(['"]sha\d+['"][,\h]+file_get_contents\h*\()\44\D{2,9}\46\45[\)\s]+\{[^\}]{1,99}\bchmod\h*\(\45,\d{3,4}\);[^\?]{2,99}\}\s*while\h*\((?:true|false|0|1)\);\s*(?:\?>|\Z)(?<X1172714>)|php[^>]{0,199}\berror_reporting\((?:0|NULL|FALSE)\);\s*[^\{]{9,699}\bRansomWeb\h+r[0o]{2}t</title>(?<X2181020>)|php[^\$\(;\{=]{1,199}\bby\s+(Shem3a)(?:\.scripts)?[^\$\(;\{=]{1,199}\bfacebook\.com/\49\.scripts\b(?<X2171800>)|php[^\$\(\{;]{1,99}\bconfig\s+grabber\b[^\$\{;]{1,199}\bXai\s*syndicate\b(?<X2161880>)|php[^\$\(\{;]{2,99}\bby\s+vrs\-hck\b(?<X2161700>)|php[^\$\(\};]{1,99}\bCon[t7]ext\h+(?:mini|web)\h+shell\b(?<X2182151>)|php[^\$\{]{1,499}\bclass\s+(\w{1,40})\h*\{[^\?]{1999,4999}(?:\}\s*){2}(\$\w{1,40})\h*=[^;]{1,99};\s*(\$\w{1,40})\h*=\h*file_get_contents\h*\(\h*\55\h*\);\s*(\$\w{1,40})\h*=\h*new\h+\54\h*\(\h*\d+\h*\);\s*\56\h*=\h*\57\->decode\h*\(\h*\56\b[^\)]+\);\s*@?(?:eval|assert)\h*\(\h*\56\h*\);\s*(?:\?>|\Z)(?<X1144171>)|php[^\$]{0,300}(\$blackie)\s*=\s*['"][^'"]{9,300}['"];\s*\$Black_Scorpion\s*=\s*['"][^'"]{30000,}['"];\s*@?eval\s*\(\s*htmlspecialchars_decode\s*\(\s*urldecode\s*\(\s*base64_decode\s*\(\59(?:\)\s*){4};\s*(?:exit|die)[^;]{0,9};[^\?]{9,200}@?eval\s*\([^\)]+\)\s*\);?\s*(?:\?>|\Z)(?<X1064711>)|php[^\$]{0,30}(?:(?:\$\w{1,20}\s*=\s*['"][^;]*\w{0,30}(?:\.htaccess|\.png|\.jpe?g|\.php)['"];\s*){8}[^:]{999,2000}if\s*\(!file_exists\s*\((\$\w{1,20})\)\)\s*\{\s*@(file_)put(_contents)\(\61,\62get\63\((\$\w{1,20})\)\);\s*@chmod\([^\)]+\);[^\?]{99,1200}@touch\(\64,[^\)]+\);\s*\}[^\?]{0,20}(?:\?>|\Z)(?<X1120251>)|(\$\w{1,20})\h*=\h*\$_SERVER\[['"]PHP_SELF['"]\];\s*(\$\w{1,20})\h*=\h*substr\h*\(\66[^;]+\);\s*chmod\h*\(\67,[^\?>]{9,400}(\$\w{1,20})\h*=\h*file_get_contents\h*\([^;]{9,150}\);\s*echo\h+\68;\s*\?>\s*\Z(?<X2183530>))|php[^\$]{0,40}\$\w{1,20}\s*=\s*['"][^'"]{20,99}['"];\s*\$\w{1,20}\s*=\s*array\([^\)]+\);\s*\$\w{1,40}\s*=\s*['"][^'"]{20000,}['"];\s*(\$\w{1,20})\s*=\s*['"]['"];\s*for\s*\([^\)]+\)\s*\{[^\}]{0,50}\70[^\}]{0,50}\}\s*\70\(['"](?:\\x(?:\w{2,3})){9,99}['"]\);\s*(?:\?>|\Z)(?<X1064482>)|php[^\$]{0,60}(?:(\$\w{40,170})\s*=\s*['"][^'"]{30000,}['"];\s*(\$\w{40,170})\s*=\s*base64_decode\(\72\);\s*\$\w{40,170}\s*=\s*str_replace\s*\(array\s*\([^\)]+\),[^,]+,\s*\73\);[^\?]{99,700}@?eval\((?:base64_decode\()+\$\w{40,170}[\)\s]+;[^\?]{0,60}(?:\?>|\Z)(?<X1118493>)|\b(?:hacker|(?:web\h*)?shell)[^<\?]{99,300}\berror_reporting\h*\((?:0|NULL|FALSE)\);[^\{]{2,99}\bif\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$\w{1,20})=>(\$\w{1,20})\)\s*\{\s*\75\[\76\]\h*=\h*stripslashes\h*\(\77\);(?<X2179330>))|php[^\$]{0,90}\$[0O]{1,20}\s*=\s*__FILE__;\s*\$[0O]{1,20}\s*=\s*urldecode\s*\([^\)]+\);[^\(]{99,300}eval\s*\(\(\$\$[0O]{1,20}\s*\(['"][^'"]{9,200}(?:YmFzZTY0X2RlY29kZShzdHJ0cihmcmVh|c2U2NF9kZWNvZGUoc3RydHIoZnJlYWQo|YXNlNjRfZGVjb2RlKHN0cnRyKGZyZWFk)[^\)]+\)\)\);\s*return;\s*\?>\s*[^\n]{30000,}\s*\Z(?<X1123350>)|php[^\$]{0,99}\$(?:(?:auth|s)?_?pass\h*=\h*['"]\w{32}['"];\s*@?(eval)\(['"].(\$\w{1,9})\h*=\h*[gzinflate\."']{10,25}\([base64_dco\."']{14,25}\([^\)]{9999,40000}[\);'"]+@?\80\(['"]\?>['"]\.\81\);\s*(?:\?>|\Z)(?<X1147011>)|(?:x?name|shell|title)\s*=\s*['"]Fox\s+Shell\b(?<X2121590>))|php[^\$]{1,199}(\$\w{1,40})\s*=\s*@?file_get_contents\s*\(\s*['"]https?://[^'"]{1,99}\.(?:pdf|gif|png|ico|sql|jpe?g|log|ini|js|txt)['"]\);\s*@?(?:eval|assert)\s*\((?:\s*['"][\?>]{2}['"]\s*\.)?\s*(?:\s*(?:base64_decode|str_rot13|gz(?:inflate|uncompress))\s*\(){0,5}\s*\84[\s\)]+;[^\?\$=\(\{]*(?:\?>|\Z)(?<X1120981>)|php[^\$]{1,200}(?:\$[0O_]{1,12}\s*=\s*['"][^'"]{1,40}['"];\s*){2}[^%]{1,600}\$[0O_]{1,12}\s*=\s*urldecode\s*\(['"]%\w{2,3}%[^;]{1,999}\)\s*;[^#]{35000,65000}\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]{1,99}['"]\]\(\);\s*(?:\?>|\Z)(?<X1128240>)|php[^\$]{1,400}(?:(?:(\$\w{1,40})=['"][^'"]{999,}['"];|(\$\w{1,40})=['"][^'"]{99,600}['"];){2}@?eval(?:\(gzuncompress|\(gzinflate){2}\(base64_decode\((?:\87|\88)\)\)\)\);\s*(?:\?>|\Z)(?<X1062411>)|\$\w{1,20}\s*=['"][^'"]{999,2000}['"]\s*;\s*(\$\w{1,20})\s*=['"][^'"]{10000,20000}['"]\s*;\s*\$\w{1,20}\s*=__FILE__\s*;\s*eval\s*\(\s*base64_decode\s*\(\s*\90\s*\)\s*\)\s*;\s*return\s*;\s*\?>(?<X1065231>)))
\A\s*<\?(?:php[^\$]{1,40}(?:(\$[O0_]{1,40})\s*=\s*urldecode\(['"][^'"]{1,199}['"]\);\s*\$[O0_]{1,40}\s*=\s*\1(?:\{|\[)\d+(?:\}|\])\s*\.\s*\1[^\?]{999,5000}@?eval\(\$[O0_]{1,40}\);['"]\);\$\{['"](?:G|\\x47)[^'"]{6,24}['"]\}\[['"][^'"]{9,40}['"]\]\(\);(?:[\?>\s]*\Z(?<X2266211>)|\s*(?:\?>|\Z)(?<X1060950>))|\$\w{1,40}\s*=__FILE__\s*;\s*\$\w{1,40}\s*=__LINE__\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*eval\s*\(\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\)\s*\)\s*\)\s*;\s*return\s*;\s*\?>(?<X1037873>))|php[^\$]{1,600}(?:(?:\s*\$\w{1,40}\s*=\s*(?:strrev)?\s*\(?\s*(?:['"(?:\s\.base64_dco]{15,40}|['"\s\.aceglpr_]{15,40})\s*\)?\s*;){1,2}\s*(\$\w{1,40})\s*=\s*['"][^'"]+['"]\s*;[^\?]+,\s*[^\$]{1,199}\5[^;]+;\s*exit\(\)\s*;\s*(?:\?>|\Z)(?<X1057790>)|\$(?:auth)?_?pass=['"]\w{24,40}['"];(?:[^\$]{0,20}\$\w{1,40}=['"][^'"]{50000,}['"];)?[^\$]{0,20}(?:eval|assert|system|shell_exec|exec|popen|passthru)\((?:(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\(){1,5}(?<X2062193>)|\s*\$\w{0,9}pass\s*=\s*['"]\w{20,40}['"]\s*;\s*\$\w{1,40}\s*=\s*[^;]{1,99};\s*if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]{1,40}\][^\?]{500,999}\}\s*@?(?:eval|assert)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(){0,5}['"][^'"]+['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057720>))|php[^\$]{1,80}\$\w{1,9}\h*=\h*['"][^'"]{3,40}['"];[^\$]{0,40}\$url\h*=\h*base64_decode\(['"]aHR0cHM6Ly9wYXN0ZWJpbi5jb20(?<X2151851>)|php[^\$]{1,99}\$(?:[0O_]{5,10}=['"]\d+['"];[^\(]{1,99}base64_decode[^\{]{1,99}(?:\$[0O_]{5,10}\{\d+\}\.){19}[^\\]{1,9999}(?:\\x\w{2}){7}[^\{]{1,99}\{\s*function\s*str_ireplace[^\>]{1,25000}\$[0O_]{5,10}\)>\d+[^\?]{1,15000}exit\(\);\}\}['"]\);\$\{['"]\\x47[^\}]{1,60}\}\[[^\]]{1,60}\]\(\);\s*(?:\?>|\Z)(?<X1119741>)|\w{1,40}=[^\v]{65000,}return;\s*[/\*#]{1,2}[^/\?>\$]{1,99}\b(?:pers|iran)(?:ian)?\s*Hackers[^/\*\?>\$]{1,99}[/\*#]{1,2}\s*(?:\?>\s*)?\Z(?<X2134841>))|php[^\$]{60,150}Recoded\s+From\s+IndoXploit\s+Shell[^\$]{40,200}\$auth_user\s*=\s*['"][^'"]*['"];\s*\$auth_pass\s*=(?<X2063330>)|php[^\$]{9,99}\$[^=;]{1,20}\s*=\s*['"][^'"]{0,32}['"];[^\$]{0,49}(?:(\$\w{1,20})\s*=\s*base64_decode\([^\)]+\);\s*){4,5}@?(?:eval|assert|exec|system|passthru)(?:\s*\(\s*\$\w{1,20}){3,4}\s*\(\s*\(\13\)(?:\s*\)){4,5};\s*(?:\?>|\Z)(?<X1063642>)|php[^\$]{99,200}BoffMax\s+v\d\.?\d?\s+Web\s+Shell\s+by\s+The-C[O0]de\s+Team(?<X2061450>)|php[^\%]{1,99}\$sh\w{0,9}\s*=\s*['"]https?://[^'"]+['"];[^`]{999,9999}\{\s*return\s*<<<STR\s+CREATE TRIGGER\s+`[^\\]{99,999}['"]a:1:\{s:13:\\['"]administrator\\['"];s:1:\\['"]1\\['"];\}['"][^\?]{999,9999}['"]\s*\.\s*PHP_EOL;\s*\}\s*mysqli_close\(\$\w{1,40}\);\s*\?>(?<X1131321>)|php[^\(=\$]{1,600}function\s+\w{1,40}\s*\(\s*\$email,\s*\$(?:pw|pwd|pass|password)\s*\)\{\s*[^\.]{1,80}(\$message)\s*\.?=\s*['"]Email\s*:[^;]+;\s*\17\s*\.=\s*['"](?:pw|pwd|pass|password)\s*:(?<X2061031>)|php[^\(\$]{0,99}\bif\h*\(\h*md5\([^=]{2,40}\)\W{2,4}['"]\w{32}['"]\)\s*\{[^\}\?]{99,300}\{\s*echo\h+['"]e?xploiting\h+(?:done|finished|completed)['"];\s*\}[^\}]{2,40}(?:\}\s*){3}\s*(?:\Z|\?>)(?<X1175450>)|php[^\(]{0,300}(?:@?(?:(session_start)|(error_reporting)|(set_time_limit))\([^\)]*\);\s*){3}[^/]{99,300}(\$\w{1,20})\s*=\s*['"][^'"]{99,300}['"];(?:\s*@?(?:\20|\21|\22)\((?:0|NULL)\);){0,3}\s*@?Eval\s*\(gz(?:inflate|uncompress)\s*\(str_rot13\s*\(base64_decode\s*\(\23(?:\)\s*){4};\s*(?:\Z|\?>)(?<X1121531>)|php[^\(]{0,99}\berror_reporting\((?:0|NULL)\);[^\{]{0,99}\bif\(!(define)d?\(['"](bmbhwkhs)['"]\)\)\h*\{\25\(["']\26['"],__FILE__\);\h*if\(!function_exists(?<X2169320>)|php[^\(]{2,30}(?://|/\*)[^\;\(\$]{2,9}(?:php|web)\h*(?:Shell|backdoor)\s*error_reporting\h*\([^\)]+\);[^\{\}]{0,30}\bif\h*\(get_magic_quotes_gpc\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$\w{1,20})=>(\$\w{1,20})\)\s*\{\s*\28\[\29\]\h*=\h*stripslashes\(\30\);(?<X2179510>)|php[^\(]{9,99}@?preg_replace\s*\(\s*.?['"](.).{0,40}\32e\w?.?['"]\s*,['"](?:(?:\\|\\x)\w{2,3}){9}[^'"]{1,999}['"]\s*,\s*['"]\.['"]\);\s*(?:\?>|\Z)(?<X1127431>)|php[^\*\$\(@/]{0,40}/\*\*[^\(]{0,40}\*\h*@author\h+(shutdown\d+)\h*<\h*indonesianpeople\.\34@\w{1,40}\.\w{2,6}\b(?<X2151962>)|php[^\./]{0,99}(?:\b(?:include|require)\h*['"][^'"]{2,9}bot[^\.]{2,20}\.php['"];\s*){5}[^:@]{1,300}\b(?:exit|die)\h*\(header\h*\(['"]Location:\h*https?://[^'"]{0,20}\bChase\.com/(?<X2175710>)|php[^\.]{0,99}(\$\w{1,20})=['"][^'"]*['"];\s*(?:\$\w{1,20}=(?:\37\{\d+\}\.?)+;\s*){20}[^\(]{99,2000}header\([^\)]+\);\s*if\(!(function)_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*\38\s+\39\([^\)]+\)\s*\{\s*return\s+trim\(preg_replace\([^\n]{999,15000}\$\{['"](?:\\x47|G)[^\}]+\}\[[^\]]+\]\(\);\s*(?:\Z|\?>)(?<X1124671>)|php[^\:]{9,150}https?://www\.scriptphish?ing\.ga(?<X2061622>)|php[^\;]{0,199}\$[0oi1]{1,20}\h*=\h*__FILE__;\$[0oi1]{1,20}\h*=\h*\d{1,4};@?eval\(base64_decode\(['"]LypuanAzWTR6ZH[^'"]{99,699}['"]\)\);return;\?>(?<X2173380>)|php[^\?><]{99,900}(?:(\$\w{1,20})\s*=\s*\43\s*\.\s*['"]\W{0,9}(?:Card\s*(?:Number|Holder\s*Name)?|CVV|FullnameCard|Exp(?:iration\s*Date)?)[^'"]{0,50}['"]\s*\.\s*\$_POST\[[^\]]+\]\s*\.[^;]+;\s*){3}[^\?]{99,1500}mail\((?<X2134081>)|php[^\?]{1,40}@?eval\(['"]\?>['"]\.file_get_contents\(['"]https?://(?:raw\.githubusercontent\.com/[^\.]{1,40}\.php['"]|pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40})\)+;[^=]{1,99}\$\w{1,40}=array\([^;]{1,600}hack(?<X2122651>)|php[^\n]{1,199}\$\w{1,40}=['"][^'"]{1,19}['"]\^['"][^'"]{1,19}['"];\s*\$\w{1,20}\s*=\s*['"][^\^]{1,30}['"]\^['"][^;]{1,30};\$\w{1,20}\s*=\s*['"][^\^]{1,30}['"]\^['"][^;]{1,30};(?<X2123392>)|php[^\w]{1,600}/(?:\*|/)\s*PHP\s+D?D[0O]S\s+v\d+(?<X2064020>)|php[^\w]{1,90}Email\s+Extractor\s+\d\.\d[^\$]{99,200}\$the_url(?<X2065350>)|php[^\{]{0,99}\{\h*(\$\w{1,20})\h*=\h*(strrev)\([^\)]+\);\s*(\$\w{1,20})\h*=\h*\50\([^\)]+\);\s*\$\w{1,20}\h*=\h*\(\51\(\49\(['"][^'"]{999,40000}['"][\)\s]+;\s*(\$\w{1,20})\h*=\h*\50\([^\)]+\);\s*\52\(\50\([^\)]+\),\50\(['"];\)\s*\w{1,20}\$[^\)]+\),['"]{2}\);\s*\}\s*(?:\?>|\Z)(?<X1140400>)|php[^\{]{9,99}(?:\b(function)\h+\w{1,20}\((\$\w{1,20})\)\s*\{[^\}]{9,99}\bunlink\(\55\);[^\(]{1,40}\bregister_shutdown_\54\([^\}]{9,99}\}\s*(\$\w{1,20})=['"]gzinflate['"];\s*(\$\w{1,20})=['"]base64_decode['"];\s*eval\(\56\(\57\(['"][^'"]{4000,}['"][\)\h]+;(?:\s*\?>)?(?<X2186420>)|\{\s*if\s*\(\s*isset\s*\(\s*(\$_(GET|POST|COOKIE|REQUEST)\[[^\]]+\]),\s*(\$_\60\[[^\]]+\]\)\s*\))\s*\{\s*if\s*\(\s*sprintf\s*\([^,]+,\s*crc32\s*\(\61\s*[^\w]{2,3}\59\)\s*\{\s*@?eval\s*\(\s*(?:gzuncompress|gzinflate)\s*\(\s*base64_decode\s*\(\61\);[^;]{9,99};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1060743>))|php[^a-z]+\b(v3n0m)\h*[s5]h[3e]ll[^:]+:\h*https?://t\.me/\63h[4a]ck\b[^\(\$]{0,99}\$\w{1,20}[\s=]+array\(base64_decode\((?<X2224390>)|php\b[^\(;\$=]{1,99}\bbiskut\s+Tiger\s*/\s*fxp0\b[^\(;\$=]{1,99}\b(?:[se][er](?:t_time_limit|ror_reporting)\h*\(\h*0\h*\);\s*@?){2}(?<X2166790>)|php\h*if\h*\(\h*strpos\h*\(\h*(?:\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\v\{]{1,99}\{\h*header\h*\(\h*['"]HTTP/1\.[01]\s+40[34][^\?\v]{99,499}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\h*(?:\?>|\Z)(?<X1143930>)|strtolower\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*,\h*['"][^\]]{1,20}['"][\s\)]+\{\s*include\h*\(\h*getcwd\h*\(\)\h*\.\h*['"]/\w{1,20}\.php['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*\?>(?<X1166231>))|php\h+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"](?:wget|curl|lwp-download|lynx|fetch|GET)\h+https?://raw\.githubusercontent\.[^;\)]{2,40}/shell\-v\d*\.php['"]\);\s*\?>(?<X1162300>)|php\h{200,}\S[^\v\$\{\};]{1,1499};\s*(function)\h+xmail\h*\(\)\h*\{\h*(\$\w{1,40})\h*=\h*func_get_args\(\);\h*file_put_contents\(['"][^'"]{1,199}['"]\h*,\h*(\w{1,40})\(\$_[GPCSR]\w{2,6}\[[^;]{1,49};\h*return\h+mail\((?:\h*\70\[\d+\]\h*[\),]){3,4};\h*\}\h*\69\h+\71\h*\([^\?\v]{9,199}(?:\?>|\Z)(?<X1150552>))
\A\s*<\?php\s*(?:(goto)\s*\w{1,9};\s*\w{1,9}:\s*if\s*\(!\(strpos\(\$key,\s*['"]\\[^#]{99,450}file_get_contents\((?:base64_decode\(['"][^'"]{9,199}['"]\)\s*\.\s*){2}[^#]{99,699}header\(['"]\\[^'"]{9,199}['"]\);\s*\1\s*\w{1,9};\s*\w{1,9}:\s*\w{1,9}:\s*\?>(?<X1137770>)|(if\(isset)(\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\))\h*&&\h*md5\4\h*==\h*['"]\w{32}['"]\)\h*\{\3\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\h*\{[^\}]{99,499};\h*(@?include\((\$\w{1,40})\);\h*@?unlink\(\6\);)[^\v\?]{1,99}\5(?:die|exit)\([^;]+;\h*\}\h*else\h*\{\h*echo[^;]+;\h*(?:die|exit)\([^;]+;\}\}\s*(?:\?>|\Z)(?<X1142031>)|//[^\v]{0,99}Created?\h+by\h+Pst[4a@]r(?:8|ate)\b[^;]{0,199}\berror_reporting\([^\)]+\);[^;]{0,199}\bsession_start\(\);[^\{]{0,199}if[\h\(]+\b(?:get_magic_quotes_gpc|md5)\((?<X2178880>)|/[/\*][^\(\$;]{1,99}\b(seodor)\s*cloaker\s*script\s*define\h*\(\h*['"]\9['"](?<X2159580>)|/[/\*]\s*(install_code)[^\$\(;]{1,199}\berror_reporting\((?:0|NULL|False)\);[^\{\}\?]{1,499}\$(GLOBALS\[)['"]WP_CD(?:_CODE)?['"]\]\h*=[^;]{1,99};\s*\$\12[^\]]+\]\h*=\h*(?:Array\(|\[)[^\?]{999,4999}/[/\*]\s*\11\w{1,9}\s*(?:\?>|\Z)(?<X1164360>)|/[/\*]\s*[\-=]+\s*created?\h*by\h+\S{1,40}\s[^\$\{\}=\[\]><\?]{9,499}\bif[\h\(]+get_magic_quotes_gpc[\s\(\)]+\{\s*foreach[\h\(]+(\$_[GPRC]\w{2,6})\h*as\h*(\$\w{1,40})=>(\$\w{1,40})[\s\)]+\{\s*\14\[\15\]\h*=[^;]+\16[\)\h]{0,4};(?:\s*\}){2}\s*echo[\h\(]+['"][^'"]{1,40}\bhtml>(?<X2179930>)|/[\*/][^\$=;\?]{1,99}\bPhishing\s+\d{2,4}\b[^\$=;\?]{1,99}://[^/\s]{0,40}\btechybd\.com\b(?<X2170030>)|/[\*/]\h*Respect\h+C0d[e3]rs\W?\h*(?:\*/)?\s*(\$\w{1,40})\h*=\h*file\h*\(\h*__FILE__\h*\);\s*@?(eval\h*\(\h*base64_decode\h*\()[^;]{1,499};\s*@?\20\h*(\w{1,40})\h*\(\h*\19\[[^;]{1,99};\s*@?eval\h*\(\h*\w{1,40}\h*\(\h*\21\h*\(\h*\19\[[^;]{1,99};\s*__halt_compiler\h*\(\);(?<X2173302>)|/[\*/]\s*Coded\s+By\s+[^\?]{0,99}(?:Cyber404|GanDrunX|Mister\s+Spy|IndoXploit|priv8)(?<X2062210>)|/[^/]{2,34}/\s*@?error_reporting\((?:0|false|NULL)\);\s*\$\w{1,40}\s*=\s*['"](?:\d{1,3}\.){3}\d{1,3}['"];[^\?]+(\$\w{1,40})\s*\.=\s*socket_read\s*\(\s*\$\w{1,40}\s*,\s*\$[\w\-]{1,40}\s*\(\s*\24\s*\)\s*\);\s*break;[^\(]{1,99}@?eval\s*\(\s*\24\s*\);\s*(?:die|exit)[^\;]{0,9};\s*(?:\?>|\Z)(?<X1062881>)|/[^;\{\$]{0,199}\bhexid\h*shell\b(?<X2175901>)|/[^\$\(=;\{@\[]{1,999}\bfacebook\.com/H4rD3n\b(?<X2165682>)|/\*[\*\s]+Plugin\s+name\s*:[^\$\(\{]{9,999}\bdefined\h*\(\h*['"]ABSPATH['"]\h*\)\h*or\h*(?:die|exit)[^;]{0,19};\s*if\h*\(\h*!\h*(class)_exists\h*\(\h*['"](WP_WORDPRESSDESC)['"]\h*\)\h*\)\s*\{\s*\28\s+\29\s*\{(?<X2163601>)|/\*[^*]{32}\*/\s*eval\(base64_decode\("[^"]{500,2000}"\)\);\s*\?>\s*\Z(?<X1040250>)|/\*[^/\$\(;]{1,99}\bcoded\s+by\s+x\-ph[1i][s$]h[e3]r\b(?<X2155220>)|/\*[^/]{0,99}\bPHP\s*Encode\s*Sh[e3\*][l1]{2}\s*(?:Auto\s*)?(?:v\d\s*)?Fox\b[^/]{0,19}/\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\([^\)\v]{35000,}\)+;\s*(?:\?>)?\s*\Z(?<X2151880>)|/\*[^\$;\(/]{1,499}\bAut[0o]\s+e?Xpl[0o]it[3e]r\b(?<X2164330>)|/\*[^\$=;\(\{/]{99,499}@package\s+WordPress\s*\*/\s*function\s+\w{1,40}\h*\(\h*(\$\w+)\h*\)\s*\{[^\}]{1,99}\$(\w{1,40})\h*=\h*preg_replace\h*\(\h*['"](\W)\[\^[lvaemsa\$\\\(\);]{12,49}\]\37['"]\h*,\h*['"]{2}\h*,\h*\$\36\h*\);[^\}]{1,99}=\h*\$\w{1,40}\h*\(\h*['"]\35['"]\h*,\h*\$\36\h*\);(?<X2170530>)|/\*[^\$\w]{999,9999}\*/\s*(?:[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"][^'";]+v[i1!]rus(?:\s*v)?\d{0,3}\.php['"];\s*){5}(?<X2141170>)|/\*[^\(;\$/]{0,199}\bauthor\h*:\h*(\w{1,40})\b[^/]{1,199}/\s*@?error_reporting\h*\(\h*(?:0|Null|False)\h*\);[^\}\{]{1,199}\bclass\h+(\40\w{0,9})\h*\{[^%\*\|]{999,9999}\}\s*new\h+\41\h*\(\h*\);\s*(?:\?>\s*)?\Z(?<X2176951>)|/\*[^\*\n]{1,16}\*/\s*(\$GLOBALS\[)['"]([^'"]+)['"]\]\s*=\s*['"][^'"]{999,65000}['"];\s*if\s*\(\s*!(function)_exists\s*\(\s*['"](\w+)['"][\s\)]+\{\s*\45\s*\46\s*\([^\)]*\)\s*\{\s*\$\w{1,40}\s*=\s*\43['"]\44['"]\];[^\}]{40,99}\};?\s*@?eval\s*\(\s*\46\s*\([^\)]*\)[\s\)]+;\s*\};?\s*(?:\?>|\Z)(?<X1131240>)|/\*[^\*]{0,40}\*/\s*@?eval\(base64_decode\(['"](?:aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFy|ZihmdW5jdGlvbl9leGlzdHMoJ29iX3N0YXJ0)[^'"]{99,2000}(?:QGd6aW5mbGF0ZShAc3Vic3Ry|emluZmxhdGUoQHN1YnN0|Z3ppbmZsYXRlKEBzdWJzdHIo)[^'"]{99,1500}(?:b2Jfc3RhcnQo|X3N0YXJ0|Yl9zdGFy)[^'"]+['"]\)\);\s*\?>(?<X1119414>)|/\*[^\*]{0,99}Mini\s+Shell\.?\s+(?:@\s+c[o0]ded\s+)?by\s+:\s+shutdown57(?<X2059370>)|/\*[^\*]{1,16}\*/\s*\$GLOBALS\[[^\]]+\]=['"][^'"]{64000,}['"];\s*if\s*\(\s*!\s*function_exists\s*\(\s*['"](\w{1,40})['"][\s\)]+\{\s*function\s+\50\([^\)]+\)\s*\{\$\w{1,40}=\$GLOBALS\[[^\]]+\];\$\w{1,40}=pack\([^\{\}]+\};@?eval\(\50\(\d+,\d+\)\);\};\s*(?:\?>|Z)(?<X1122290>)|/\*[^\-]{9,30}X-SHADOW\s*\*/(?<X2133251>)|/\*\*\s*\W{1,99}Leaf\h+PHP\h+Mailer\h+by\h+\[?leafmailer\.pw\b(?<X2144290>)|/\*\h*Respect\h+C0ders\.?\h*\*/\h*\$\w{1,40}\h*=\h*@?file\h*\(\h*__FILE__\h*\);\h*@?eval\h*\(\h*base64_decode\h*\([^\v]{999,}\Z(?<X2171780>)|/\*\h*yanzboss\h*\*/\s*(\$\w{1,15})[\h=]+urldecode\([^\)]+\);\s*(\$\w{1,15})[\h=]+(?:\55\{\d+\}\.){3}[^\?]{99,600}\b__FILE__;\s*\$\w{1,15}[\h=]+0x\w{2,8};\s*eval\(\56\(['"][^'"]{99,999}['"][\)\h]+;\s*return;\s*\?>(?<X2202242>)|/\*\s*\w{16,99}\s*\*/\s*\?>\s*<\?php\s+(\$\w{1,40})\s*=\s*['"][^'"]{9,99}['"]\s*;\s*function\s*(\w{1,40})\s*\([^\)]{1,40}\)\s*\{return\s+[^\}]{1,40}\}(?:\s*\$\w{1,40}\s*=\s*\59\((?:\58\[\d+\][,\.]\s*){2}[^;]+\);){3}(?<X2120871>)|/\*\s*Black\s+Eagle\s+Team\s+Shell\b(?<X2161150>)|/\*\w{1,40}\*/\s*\?>\s*<\?php\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*\)\s*\)\s*\{\s*[^\{]{1,200}\{\s*return\s*\$\w{1,40}\.\$\w{1,40}.\$\w{1,40};\s*\}[^\{]{15000,30000}['"],\$\w{1,40}\)\.['"][^'"]*['"]\);\s*(?:\?>|\Z)(?<X1057431>)|/\*\w{25,80}\*/\s*if\h*\(\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*\)\s*\{\s*exit\h*\(\h*\63\h*\);\s*\}\s*/\*\w{25,80}\*/\s*\?>(?<X1145070>)|@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:(?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev|urldecode)\s*\(){0,5}\s*['"][^'"]{15,600}jHlWmpGf0vFDI1gBalH['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1055950>)|\s*['"][^'"]{1,144}['"]\s*\);\s*(?:\?>\s*<\?php)?\s*phpinfo\(\);\s*\?>\s*\Z(?<X2055940>))|@?(?:include|require)(?:_once)?\s*\(?['"](?:blocke?r?|bots|antibots)\.php['"]\)?;\s*function\s+random[^\?]{99,800}if\s*\(\s*!\s*@?copy\s*\(\s*\$\w{1,40},\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2118561>)|@?(?:s?printf?|echo)\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1060731>)|@?(echo)\s*['"][^\;]{15,250}['"]\s*\;\s*if\s*\(\s*\$_POST\[['"]_upl['"]\]\s*[^\w]{2,3}\s*['"]\w['"]\s*\)\s*\{\s*if\s*\(\s*@?copy\s*\(\s*\$_FILES\[[^\]]{1,40}\]\s*\[[^\{]{1,40}\s*\{\s*\69\s*['"].{1,40}['"]\;\s*\}\s*else\s*\{\s*\69[^\}]{1,40}(?:\s*\}\s*){2}\s*(?:[^;]{1,99};\s*)?(?:\?>|\Z)(?<X1041752>)|@?(file_)pu(t_contents)\h*\(\h*['"][^'",]{1,99}\.html['"]\h*,\h*@?\71ge\72\h*\(\h*['"]https?://[^'"]{1,99}\.txt['"](?:\h*\)){2}\h*;\s*(?:\?>\s*)?\Z(?<X2170430>)|@?(session)_start\s*\(\s*\)\s*;\s*if\s*\(\s*!\s*isset\s*\(\s*\$_\74\s*\[['"]\w{1,9}['"]\][\s\)]+\{\s*echo\s+['"]<(script)[^>]{0,30}>window\.location\.assign\(['"]https?://(?:www\.)?google\.[^'"]{99,299}['"]\)\s*</\75>\s*['"]\s*;\s*(?:die|exit)\b[^;]{0,9};\s*\}(?:\s*\?>)?\s*\Z(?<X2133170>)|@?[^\{]{0,99}if\h*\(\h*@?(\$_COOKIE\[)[^\]]+\]\h*\)\s*\{\s*(\$\w{1,15})\h*=\h*\77[^\]]+\]\h*\(\h*['"]{2}\h*,\h*@?\77[^\]]+\]\h*\(\h*@?\77[^\]]+\][\)\h]+;\s*\78\h*\(\h*\)(?:\h*;)?\s*\}\s*(?:\?>|\Z)(?<X1146482>)|@?[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]wget\b[^;:]{1,99}\bhttps?://[^/;]{0,49}\bgithub(?:usercontent)?\.com/indoxploit\-coders/[^;]{1,99};\s*(?:\?>|\Z)(?<X1161820>))
\A\s*<\?php\s*(?:@?error_reporting(?:\((?:(?:0|NULL)\);[^\?]{0,199}\{\s*\$\w{1,15}\h*=\h*\$_SESSION\[[^\]]+\];\s*\$\w{1,15}\h*=\h*file_get_contents\(['"]php:[^\?]{0,499}\bclass\h*(\w+)\h*\{public\h*function\h*[^\{]{0,49}\{\s*eval\(\$[^\}]{0,99}\}\}\s*@?new\h*\1\(\$\w{1,15}\);\s*\}\s*\?>(?<X1186510>)|(?:0|NULL|FALSE)\);[^\?]{9,199}\bregister_shutdown_function\([^,]+,\h*__FILE__\);[^\}]{9,99}\}\s*(\$\w)\h*=\h*['"\.\hgzinflate]{9,25};\s*(\$\w)\h*=\h*['"\.\h*base64_dco]{13,40};\s*@?eval\(\3\(\4\(['"][^'"]{999,7500}['"][\)\h]+;(?:\Z|\?>)(?<X1170671>)|0\);@?ini_set\([^\{\n]{1,99}if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{[^\?=@\n]{0,99}@?eval\((?:(?:base64_decode|str_rot13|urldecode|strrev)\(){0,5}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)+;[^\?@\n]{99,999}fclose\(\$\w{1,40}\);\}+(?:exit|die)\b[^;]{0,9};\?>(?<X1124380>)|0\);\s*@?set_time_limit\(0\);\s*\$\w{1,40}\h*=\h*['"]Multiple\h+UPDx\h+v\d+\.\d+\h*build[^'"]{1,40}['"];(?<X2176641>))|\s*\((?:0\);\s*ini_set\s*\(['"]display_errors['"],0\);\s*eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*['"][^'"]{9000,13000}['"]\)\)\);(\$\w{1,40})[^\?]{9,150}mail\(\8[^\)]+\);\s*print\s*\([^\)]+\);?\s*(?:\?>|\Z)(?<X1058971>)|[^\)]+\);\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;)+\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:Y2xhc3M|IGNsYXNz)[^'"]{5000,9999}(?:aWYgKChpbmNsdWRl|ZiAoKGluY2x1ZGU|ICgoaW5jbHVkZQ)[^'"]{1,2000}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058911>)|[^\)]+\);\s*\$\w{1,40}\s*=\s*['"][^'"]{0,40}['"]\s*;\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:Y2xhc3M|IGNsYXNz)[^'"]{5000,9000}(?:IUBpbmNsdWRlX29uY2UoYg|ZighQGluY2x1ZGVfb25jZShi|KCFAaW5jbHVkZV9vbmNlKGI)[^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058831>)))|@?eval\(['"](?:(?:\?|\\x3f)\\x3e['"]\.base64_decode\(['"](?:PD9|\\x3c\\x3f)[^'"]{65000,}['"]\)\);\s*(?:\Z|\?>)(?<X1131021>)|\?>['"]\s*\.\s*base64_decode\(['"](?:[^'"]{9,99}(?:UkVNT1RFX0FE|RU1PVEVfQURE|TU9URV9BRERS)[^'"]{99,600}(?:bWFpbCgk|YWlsKCR|aWwoJA)[^"']{9,200}['"]\)+;\s*(?:\Z|\?>)(?<X1120993>)|PD9waHAgaW5jbHVkZSA[^'"]{9,50}['"]\)+;\s*(?:\Z|\?>)(?<X1120882>)))|@?eval\s*\(\s*(?:['"]\?>['"]\.base64_decode\s*\(\s*['"](?:PD9waH|IDw\/cGhw|PD8|IDw\/)[^'"]{9,300}(?:PT0gIlpldVMi|PSAiWmV1UyI|ICJaZXVTI|IlpldVMi)[^'"]{200,1500}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058880>)|base64_decode\s*\(\s*(?:(?:ZXZhbCAoIGJhc2U2NF8|ZXZhbCAoYmFzZTY0Xw|ZXZhbChiYXNlNjRf|QGV2YWwoYmFzZTY0X|QGV2YWwgKGJhc2U2NF8|QGV2YWwgKCBiYXNlNjRf|QGV2YWwoIGJhc2U2NF8)[^?]{50,999}\)\s*\)\s*;?\s*\?>(?<X1059181>)|['"][^'"]{9,300}(?:Y3VybF9leGVjKC|dXJsX2V4ZWMo|cmxfZXhlYyg)[^'"]{1,30}(?:ZXZhbC|dmFsKA|YWwo)[^'"]{1,20}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059082>)|['"][^'"]{999,3500}(?:PHRpdGxlPldvcmRwcmVzcyBDb250ZW50IEZpbGU|dGl0bGU\+V29yZHByZXNzIENvbnRlbnQgRmlsZQ|aXRsZT5Xb3JkcHJlc3MgQ29udGVudCBGaWxl)[^'"]+['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058821>)|['"]JG[^'"]{1,40}PWV4cGxvZGUo[^'"]{16000,32000}O2V2YWwo[^'"]{1,99}['"]\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058271>)))|@?ignore_user_abort\(true\);@?set_time_limit\(0\);@?error_reporting\(0\);define\([^\)]+\);[^@]{1,400}gzinflate\(substr\(.{999,9999}\}\}return\s+(\$[^\$\s\{\[,]{1,40}[\{\[][^\}\]]+[\}\]])\(\20\(\$[^\$\s\{\[,]{1,40},\$[^\$\s\{\[,]{1,40}[\{\[][^\}\]]+[\}\]]\)\);[^;]{1,40};\}\s*(?:\?>|\Z)(?<X1061860>)|@?ini_set\(['"](?:(?:error_log|log_errors)['"],\s*(?:NULL|0)\)[^\{]{9,199}function\s*(\w{1,20})[^\?]{9,399}return\s*@?file_get_contents[^\?]{9,499}curl_exec\([^\?]{9,699}\$\w{1,9}\s*=\s*['"]https?://[^;]{5,55}\.php['"][^\{]{9,99}\{\s*(\$\w{1,9})\s*=\s*\22[^\?]{9,99}die\(\23\[\d\]\);\}(?<X2129610>)|display_errors['"],\h*0\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^#]{99,600}\bfunction\h*\w{1,15}\(\$\w{1,9}\)\{\s*\$\w{1,9}\h*=\h*curl_init\(\)[^#]{99,500}\bmkdir\h*\([^\{\}]{1,99}['"]moban\.html\h*['"]\h*;[^\?]{99,999}\bchmod\(['"]\.htaccess['"],\d{3,4}\);\s*\}(?<X2152650>))|@?preg_replace\s*\(\s*['"](.).{0,40}\26e['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*,\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X1042150>)|@?session_start\(\);\s*(\$\w{2,10})\s*=\s*@\$_(?:P|G|S|C|R)\w{2,6}\[["'](?:password|pass|pwd|pw|passwd)['"]\]\s*;[^;]{9,99};\s*(\$\w{1,40})[^\$]{9,50}\28\s*\D{2,3}\s*\29[^\?]{99,350}(\$\w{1,40})\s*=\s*@?\$_FILES[^<]{50,200}move_uploaded_file\(\30[^\?]{99,250}/form>['"];\s*\}\s*(?:\?>|\Z)(?<X2119402>)|@?unlink\h*\(\h*['"]\w{1,40}\.php['"]\h*\)\h*;[^\{]{1,99}\{\s*\$\w{1,9}\h*=\h*rand\h*\(\d+,\d+\);[^;]{1,99};\s*array_push\h*\([^\(]{0,49}\.\h*basename\h*\(dirname\h*\(__FILE__\)\)\h*\.\h*['"]\.php['"]\);[^\?]{1,99}\Z(?<X2185300>)|@session_start\(\);\s*\$\w{1,40}\s*=\s*\$_SERVER\[["']HTTP_USER_AGENT["']\];\s*if\s*\(!\(isset\((\$_SESSION\[["']pplRand["'])\]\)\)\)\s*\{\s*\$(rand)\s*=\s*\34\(\d+,\d+\);\s*\33\]\s*=\s*\$_SERVER\[["']REMOTE_ADDR["']\]\.["']\[["']\.\$\34\.["']\]["'];\s*\}(?<X2123780>)|[/\*\s]{0,199}\W{0,5}xShell(?<X2173830>)|[^/]{1,9}\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"](?:aWYgKGlzc2V0|aWYoaXNzZXQ|IGlmIChpc3NldA)[^'"]{1500,1900}(?:bWFpbCg|YWlsKA|aWwo)[^'"]{20,300}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058851>)|[^;\)\}]{1,20}\);\s*function\h+(\w{1,20})\h*\(\$\w{1,10},[^;]{1,40};\s*curl_setopt\h*\(\$\w{1,10},[^\}]{1,199}\}\s*(\$\w{1,10})\h*=\h*base64_decode\h*\(['"]\w{32,50}[^;]{1,20};[^\{]{1,99}\{\s*\$\w{1,10}\h*(=\h*\38\h*\(\39\h*\.)[^\?]{1,249}(\$\w{1,10})\h*\40[^;]{1,99};\s*echo\41;\s*\}\s*\?>(?<X2173530>)|[^;]+error_reporting\((?:0|NULL)\);[^?]{9,250}(\$\w{1,9})\s*=\s*['"](?:(?:wget|curl)\s*\-(?:0|o)\s*/tmp/(\w{1,9})\s*https?://[^;]{9,50}/\44;\s*){2}perl\s*/tmp/\44;\s*rm\s*-rf\s*/tmp/\44[^\}]{9,150}\};\s*/bin/bash\s*\-c\s*['"]{2}\.\43[^?]{99,350}die\([^\)]+\)\s*\?>\s*(?:\Z|\?>)(?<X2127880>)|[^;]{9,20}session_start\s*\(\);\s*error_reporting\s*\((?:0|NULL)\);\s*include\s*\(['"][^'"]{9,25}\.php['"]\);\s*header\s*\(['"]LOCATION:\s*myaccount\/signin[^;]{9,150}\);(?:\s*\?>)+(?<X1126042>)|[^;]{9,50};\s*@?(\$_?\w{1,9})\s*=\s*\$_[PGSCR]\w{2,6}\[['"]\w{1,9}['"]\][^b]{9,99}[eval'"\.]{5,10}\([base64_decode'"\.]{5,25}\(['"]\{\47[^\?]+(?:\Z|\?>)(?<X1123251>)|[^\$\(;]{0,499}(?:(\$shell_)(?:(?:fake_)?name|version|title|password|color|(?:fav_)?port)\h*=[^;]{1,99};\s*){5,9}\49code\h*=\h*['"][^'"]{9999}(?<X2147660>)|[^\$]{0,99}\$(?:auth)?_?pass\s*=\s*['"]\w{0,40}['"];\s*[^\$]{0,99}\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"];)?\s*\$\w{1,40}\s*=\s*['"]FilesMan['"];[^\}]{1,200}header\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);\s*exit(?<X2055712>)|[^\$]{1,600}(\$\w{0,9}pass)\s*=\s*['"]['"]*['"];\s*if\s*\(\s*isset\s*\(\s*\$_POST\s*\[\s*([^\}]{1,40})\s*\][^\{]+\{\s*@?mail\s*\(\s*['"][^'"]*['"]\s*,\s*['"][^'"]*['"]\s*,\s*__FILE__\s*\.\s*['"][^'"]*['"]\s*\.\s*\52\s*\.\s*['"][^'"]*['"]\s*\.\s*\$_POST\s*\[\s*\53\s*\]\s*\)\s*;\s*\}\s*\?>(?<X1057831>)|[^\$]{1,99}(\$\w{1,20})=['"](?:\\x\w{2}){10}[a-fx0-9\\]{1,99}['"];\s*@?eval\(\55\(['"](?:\\x\w{2}){10}[^"']{99,500}["][\s\)]+;\s*(?:\?>|\Z)(?<X1118711>)|[^\$]{40,99}\$\w{1,40}\s*=\s*['"][^'"]{20,99}['"];function\s+(\w{1,40})\(\$\w,\$\w,\$\w\)\{return\s+\$\w\.\$\w\.\$\w[^'"]{1,600}(\$\w{1,40})\s*=\s*\57\((?:\$\w{1,40}(?:\.?|,?)){3,9}\)[^\?]{999,9999};\58\(['"]['"]\s*,\s*[^\);]+\);?\s*(?:\?>|\Z)(?<X1061872>)|[^\$]{9,50}(\$globals\[)[^\]]+\]\s*=\s*['"][^'"]{99,4000}['"];\s*if\s*\(!function_exists\(['"](\w{1,24})['"]\)+\s*\{function\s*\61\([^\)]{1,40}\)\s*\{\s*\$\w{1,40}=\60[^\}]{50,150}\};\s*@?eval\(\61\(\d+,\d+\)+;\};\s*(?:\?>|\Z)(?<X1121081>)|[^\$]{9,99}(\$config_password)=[^;]{1,49};(?:(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]{1,99};){2}if\(\64\D{2,3}\63\)\{[^@]{9,499}\bfwrite\((\$\w+),\$\w+\);fclose\(\65\);[^\}]{1,99}\}+function\s*(\w{1,40}\()(\$\w+)\)\{[^\}]{1,99}\66dirname\(\67\)+;mkdir\(\67\,\d?777\);\}+(?:\?>)?\Z(?<X2145200>)|[^\(\$]{1,99}\bPlugin\s+Name:\s+Monitization\b[^\}\?]{99,499}\badd_options_page\([^;]{9,99};\s*remove_submenu_page\(\h*['"]options\-general\.php['"],\h*['"]monit['"]\h*\);(?<X2148022>))
\A\s*<\?php\s*(?:[^\(]{1,25}session_start\s*\(\);\s*error_reporting\s*\((?:0|NULL)\)[^'"]{1,150}(?:include\s*['"][^'"]+antibots\d\.php['"];\s*){1,5}[\/\-]{1,150}(?:(?:\s*\?>){0,2}\Z(?<X1126062>)|(?:\s*if\s*\(strpos[^\{]{1,99}\{\s*header\s*\(['"][^'"]{1,15}404\s*Not\s*Found['"]\);\s*exit\s*\(\);\s*\}\s*){1,3}[\/\-]{1,150}(?:\s*\?>){0,2}\Z(?<X1126104>))|[^\?:]{1,450}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}['"][^'"]+['"][\s\)]+;\s*(?:\?>|\Z)(?<X1122261>)|[^\?]{0,3000}error_reporting\((?:0|NULL)\)[^\{]{9,40}if\s*\(!empty\(\$_SERVER\[["']HTTP_USER_AGENT['"]\]\)\)\s*\{\s*(\$\w{1,15})\s*=\s*array\(\s*(?:['"](?:rogerbot|exabot|MJ12bot|AhrefsBot)['"],?\s*){2}[^\(]{9,99}if\s*\(preg_match\([^\)]+\4\)(?<X2127942>)|[^\{]+\{\s*header\(['"][^'"]{9,99}['"]Upload\s*File[^\{]{9,99}shell\s*if\(\$_[GPRSCF]\w{2,6}\)\s*\{\s*if\(@?copy\((\$_FILES\[['"](\w{1,9})['"]\])\[[^\]]+\],\6\[[^\]]+\][^\?]{9,99}<form\s*method=post[^<]{9,99}<input\s*type=file\s*name=\7[^\}]{9,99}\}\s*(?:\Z|\?>)(?<X1127801>)|[^\{]{0,199}\{\s*(\$\w{1,25})[\h=]+array[\h\(]+['"\hcopy\.mve_upladfi]{1,40}\);\s*echo\h*@?\9\[[^\]]+\]\(\$_FILES\[[^\}]{0,199}\}\s*\?>\s*<(form)[^\?]{9,199}\btype[\h=]['"]submit['"]/>\s*</\10>\s*\Z(?<X2220060>)|[^\{]{1,600}try\s*\{\s*\$\w{1,40}\s*=\s*base64_decode\s*\(\s*['"][^'"]{1,5000}['"]\s*\)\s*;\s*function\s+scan\s*\([^\?]{999,3000}=\s*explode\s*\(['"]<\?php['"],[^\?]+\?\s*['"]https?['"][^\?]+unlink[^;]{1,40};\s*\}\s*catch\s*\(\s*Exception\s*\$\w{1,40}\s*\)\s*\{\s*[^\}]{1,40}\s*\}\s*\?>(?<X1057410>)|[ir](?:nclud|equir)e(?:_once)?(?:\(?['"]antibot[sz]?\d?\.php['"]\)?;[^@]{1,199}<title>Redirecting\.{1,3}</title>(?<X2148990>)|\(['"](?:blocker|antibot)[sz]?d?\.php['"]\);(?<X2156670>)|\(['"]blocker[sz]?\d?\.php['"]\);[^\?\}]{9,199}<title>404\s+Not\s+Found</(title>)[^@\$]{99,499}<\15Sign\s+In</\15(?<X2153590>))|[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]python\b[^\$\?]{9,199}\.ngrok\.io\b[^\$\?]{9,199}\\['"]{2}\);\s*(?:\?>|\Z)(?<X1145420>)|\$(?:auth|s)?[_\-]{0,2}pass\h*=\h*['"]\w{16,64}['"];(?:\s*\$\w{1,40}\h*=\h*str_rot13\h*\((?:\h*strrev\h*\()?\h*['"]\w{9,17}['"][\)\h]+;){3,}\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:\$\w{1,40}\h*\(\h*){3,}['"][^'"]{9999,}['"][\h\)]+;\s*(?:\?>|\Z)(?<X1143340>)|\$[0_oO]{1,9}\s*=\s*['"]?__FILE__['"]?\s*;\s*\$[0_oO]{1,9}\s*=\s*['"][^'"]+['"]\s*;\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}\s*\(?\s*['"][^'"]+['"](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057860>)|\$[0o_]{1,15}\h*=\h*['"][^'"]+['"];\s*\$[0o_]{1,15}\h*=\h*urldecode\h*\(['"][^#]{99,1699}\$([0o_]{1,15})\h*=\s*function\h*\(\$[0o_]{1,15}\h*=\h*\)[^#]{99,1400}\beval\(\(['"\+if\(/gole|yahbn]{9,90}\)[^\?]{9,299}\$\{['"]GLOBALS['"]\}\[['"]\20['"]\]\s*\(\);\s*\?>(?<X1152860>)|\$[0o_]{4,12}=urldecode\(['"][^'"]+['"]\);if\(!(function)_exists\(['"](str_i?replace)['"]\)\)\{\22\h*\23[^\n]{999,4000}\bunset\((\$[0_O]{4,12})\);\}\}unset\([^\n]{999,6000}\becho\h*\24\[['"]data['"]\];die\(\);\}\};\$\{['"]GLOBALS['"]\}\[['"][0o_]{4,12}['"]\]\(['"][^'"]{9,99}['"]\);\s*(?:\?>|\Z)(?<X1154453>)|\$[^=]{1,40}\s*=\s*['"][^'"]{99,199}['"];\s*/\*Bloodninja:\s*I\s*lick(?<X2142420>)|\$[^\s=;]{1,40}\s*=\s*['"]\w{32}['"];\s*/\*\s*Pass\b[^/]{1,99}\*/\s*\$(\w{1,40})\h*=\h*file\(__FILE__\);\s*((eval\()base64_decode\()[^\)]+\)\s*\);\s*\28(\27\(\$\27\[\d+\],)\d+\)+;\29\w{1,40}\(\30\d+\),\30\d+\),\$\27\)\);\s*__halt_compiler\(\);(?<X2158631>)|\$[DCU0]+[\h=]+['"]\d+['"];\s*(\$[DUC0]+)[\h=]+\(?['"][^'"]+['"]\)?;[^\{]{0,50}\$[DC0U]+[\h=]+(?:\32\{\d+\}\.){15}[^#]{9999,36000}\bunset\(\$[DU0C]+,\h*\$[^\)]{9,99}\);\s*exit[\(\)\s;\}'"]+\$\{['"][GOBALS\\x471532cf]{9,30}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1197821>)|\$[i1l]{1,12}\s*=\s*["'][^;]{99,299};\s*(\$\w+)\s*=\s*['"][^;]+;\s*(\$\w+)\s*=\s*['"][^;]+;\s*(\$\w+)\s*=\s*['"][^;]+;\s*\$\w+\s*=\s*\35\(\34\(\36\(['"](?:SMGWLdZ6RRH|QpkOpbVjSNQDV)/[^'"]+['"]\)+;\s*@?eval\(\34\([^\)]+@?riny\(tmvasyngr\(onfr64_qrpbqr\(\$\w{1,9}\)[^\?]{0,15}(?:\Z|\?>)(?<X1132232>)|\$[O0_]{1,12}\s*=\s*['"][^'"]{1,99}['"];[^\?]{99,999}\|stream_socket_client\|[^\?]{99,999},CURLOPT_USERAGENT,['"](WHR)['"]\);[^\*]{999,4999}\$[O0_]{1,12}\[\]=['"]Connection:Close['"];\$[O0_]{1,12}\[\]=['"]User\-Agent:\38['"];[^@]{999,}\$\{['"][GOBALS\\x471532cf]{7,28}['"]\}\[[^\]]+\]\(\);\s*\?>(?<X1131574>)|\$\s*\{\s*\$\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\s*\)\s*\}\s*\}\s*;?\s*(?:\Z|\?>)(?<X1060720>)|\$\w{0,5}pass\h*=\h*['"]\w{32,40}['"];\s*\$\w{0,5}ver\h*=\h*['"]\d{1,2}\.\d{1,2}['"];[^\$]{0,25}\$\w{0,5}title\h*=\h*['"][^'"]{0,15}shell(?<X2148980>)|\$\w{0,9}_pass\s*=\s*['"](?:\w{1,40}['"]\s*;\s*(?:\?>\s*<\?php\s*)?\s*@?eval\s*\(['"][^'"]{0,20}['"]\s*\.\s*base64_decode\s*\(\s*['"][^'"]+['"]\)\s*\)\s*;\s*\?>(?<X1057530>)|\w{20,40}['"]\s*;(?:\s*\$\w{1,40}\s*=\s*\s*['"][^'"]{1,40}['"]\s*;)\s*\$\w{0,9}title\s*=\s*['"]\s*b374k(?<X2057511>))|\$\w{1,10}\s*=\s*'[^;]+;\s*\$\w{1,10}\s*\.=.+eval\(\$\w{1,10}\(\$\w{1,10}\)\);\s*\?>\s*\Z(?<X1039010>)|\$\w{1,15}=['"]Hacked\s*by\s*Entrika['"];(?<X2124870>)|\$\w{1,15}\s*=\s*['"][^'"]{999,65000}['"];\s*(?:(\$\w{1,15})\s*=\s*['"][^'"]{99,299}['"];\s*(\$\w{1,15})\s*=\s*(?:\46\[\d{1,3}\]\.){5}[^\?\n<>]{99,2000}){2}(\$\w{1,15})\s*=\s*\46\[\d[^\(\n]{9,99}\(\47\);\s*\48;\s*\?>(?<X2135152>)|\$\w{1,19}\s*=\s*['"](?:[^'";]{1,40}['"][\^\|\.]['"][^\v\$]{1,19}['"];[^\t]{99,999}(?:\|\||or)\s*(?:exit|die)[^;]{0,9};\s*(?:\$\w{1,19}\s*[\(\.,=]\s*){3}[^\?]{40,199};\s*\Z(?<X2142222>)|[^\v\$]{1,19}['"][\^\|][^\v\$;]{1,40};[^\t]{99,999}if\((?:!?\$\w{1,19}\()?(?:\$\w{1,19}\s*\(\s*){2}\$\w{1,19}\s*(?:\)\)\h*[^\w\s]{2,3}\h*\$\w{1,19}\h*)?\.\s*\$\w{1,19}\s*[\)\.](?:[^\{\[\?]{60,199})\);\s*\Z(?<X2142210>))|\$\w{1,25}[\h=]+(function)[\h\(]+\$\w{1,25}[\s\)\{]+\};\s*\52\h*(\w{1,25})[\h\(]+\$\w{1,25}[\s\)]+\{[^\}]+\}\s*(\$\w{1,25})[\h=]+['"][^'"]{999,3000}['"];\s*(\$\w{1,25})[\h=]+\52[^\{]+\{\s*eval[\h\(]+\$\w{1,25}[^\}]{99,199}\};\s*\54[\h=]+\$\w{1,25}\(\54\);\s*\54[\h=]+\53\(\54\);\s*\55\(\54\);\s*\?>(?<X1222650>)|\$\w{1,40}="[^"]+";\s*\$\w{1,40}='[^']+';\s*(?:\$\w{1,40}=(?:\$\w{1,40}\[\d+\]\.?)+;\s*){4,10}\s*\$\w{1,40}=\$\w{1,40}\(['"]{2},\$\w{1,40}\("[^"]+",\$\w{1,40}\(\$\w{1,40}\(\$\w{1,40}\)+;\s*\$\w{1,40}\(\$\w{1,40},\$\w{1,40}\(\$\w{1,40}\),\$\w{1,40}(?:,\d)?\);\s*(?:\?>|\Z)(?<X1041631>)|\$\w{1,40}=(visitor_country)\(\);\$\w{1,40}=\58[^@\?\}\{]{9,499}\$(\w{1,40})=(?:['"]https?://[^;]{1,199};(\$\w{1,40})=[^;]{1,999}\$pass(?:wo?r?d)?\b[^@]{1,499}\bmail\([^\)]+\60\b[^;]{1,99};\s*header\(['"]Location:\s*(?:https?://|\$\59)(?<X2161550>)|[^;]{1,999}\$pass(?:wo?r?d)?\b[^@]{1,499}\bmail\([^\)]+\$\59\b[^;]{1,99};\s*header\(['"]Location:\s*https?://(?<X2161540>))|\$\w{1,40}=\s*'';if\(!empty\(\$_COOKIE\)\){foreach.{100,1000}Cookie'\s*\)\s*!==\s*false\s*\)\s*header\(\$\w{1,40}\);\s*return\s*strlen\(\$\w{1,40}\);\s*\}\s*\?>\s*\Z(?<X1040700>)|\$\w{1,40}\h*=\h*['"](?:(?:localhost|127\.0\.0\.1)['"];[^!\{:]{1,99}(?:(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];+\s*){1,4}(\$\w{1,40})\h*=\h*(mysqli_)connect\s*\([^\);\[]{0,99}\64\h*\);[^\?\-]{99,999}\s*\$\w{1,40}\h*=\h*\66query\h*\(\65,\$\w{1,40}\);[\s\}]+\66close\h*\(\h*\65\h*\);\s*\?>(?<X2142900>)|[^'"]{1,99}['"];[^\s/\*]{1,299};(?:/\*|#)[^\v]{9,499}\n\$\w{1,40}\h*=\h*['"][^'"]{1,99}['"];.{1,299}?['"]\h*\^\h*['"][^\t]{1999,3299}/\*[^\v]{9,299}:[^'"]{1,40}['"];\s*(?:\?>|\Z)(?<X1142750>)))
\A\s*<\?php\s*(?:\$\w{1,40}\h*=\h*(?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*require_once\h*\(\h*['"]geoplugin[^\?]{9,499}(?:\$\w{1,40}\h*\.?=[^;]{0,99}\$_POST\h*\[[^\]]+\][^;]{0,99};\s*){2}[^\?]{9,999}\bmail\h*\([^\)]+\)\h*;(?:\s*header\h*\(['"]Location:[^;\)]+\)\h*;)?(?:\s*(?:exit|die)\b[^;]{0,9};)?\s*\?>(?<X2157240>)|base64_decode\h*\(\h*['"]PD9waHAg[^'"]{1,999}['"]\h*\);\s*(\$\w{1,40})\h*=\h*@?fopen\h*\(\h*['"][^'"]+\.php['"][^;]{1,199};\s*(?:echo\s*)?fwrite\h*\(\h*\2\h*,[^;]{1,99};\s*fclose\h*\(\h*\2\h*\);\s*(?:\?>|\Z)(?<X1173132>)|getenv\(['"]REMOTE_ADDR['"]\);(?:\s*\$\w{1,40}\h*=\h*\$_POST\[[^\]]+\];){2}(?:\s*\$\w{1,40}\h*=\h*['"][^'"]{1,60}['"]\h*\.\h*\$\w{1,40}[^;]{0,40};){4}[^\|\?\(\[]{1,199}\|['"]\h*\.\h*\$\w{1,40};\s*@?mail\h*\([^\);]+\);\s*header\h*\(['"]Location:[^'"]+['"]\);(?<X2157750>))|\$\w{1,40}\s*=(?:(?:\s*'[^\n\v]{77}'\.\v{1,2}){3}(?<X2048363>)|\s*<<<EOT.{20000,60000}EOT;\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST)\["\w{1,10}"\];\s*//[^\v]{0,199}\v\s*\$\w{1,40}\s*=\s*create_function\b(?<X2048572>)|\s*["']livingstonecole@aol\.com['"];\s*\$\w{1,40}\s*=\s*visitor_country\(\);\s*\$\w{1,40}\s*=\s*\$_POST\[(?<X2065520>)|\s*['"](?:[\w\-\.]{2,22}\.[a-z]{2,7}\s*,?\s*)+['"];\s*function\s*(\w{1,40})\s*\((\$\w{1,40})\)\s*\{[^\(\}\{]+return\s*\$\w\(\$\w\(\9\)\);\s*\}\s*eval\(\8\(['"][^'"]{999,9999}['"]\)+;(?:\s*\?>)?\s*\Z(?<X2125993>)|\s*['"][^'"]{1,100}['"]['"];\s*\$\w{1,40}\s*=\s*['"][^'"]{2000,4000}['"]\)\)['"];\s*(\$\w{1,40})\s*=\s*['"][^'"]{1,100}['"];\s*\s*(\$\w{1,40})\s*=\s*['"](.).{0,40}\13e\w?['"];\s*\11\s*\(\s*\12\s*,\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*,\s*['"][^'"]{0,40}['"]\);\s*(?:\Z|\?>)(?<X1042430>)|\s*['"][^;]{99,499}\bhttps?://[^/]{0,49}\bxlegion\.com/(?<X2155801>)|\s*['"]\s*find\s*/\s*-type\s*f\s*-name\s*['"]\*['"]\s*\|\sxargs\sgrep\s-rl\s['"]<head['"]['"]\s*;\s*\$\w{1,40}\s*=(?<X2051840>)|\s*['"]find\s[^;]{1,99}<head['"]{1,3};\s*\$\w{1,40}\s*=\s*['"]\s*<script\s[^>]{1,99}>\s*</script>\s*['"]\s*;\s*\$\w{1,40}\s*=\s*shell_exec\s*\((?<X2057901>)|\s*[^;]{0,20};\s*\$\w{1,40}\s*=\s*[^;]{20,80};\s*\$\w{1,40}\s*=\s*\w{1,40}\(\)\s*;\s*[^\?]{60000,}function\s*\w{1,40}\s*\(\s*\)\s*\{(?:\s*\$\w{1,40}\s*=['"][^'"]{20,80}['"]\s*;\s*){2}return\s*['"](?:\s*\{\s*\$\w{1,40}\s*\}\s*){2}['"]\s*;\s*\}\s*(?:\?>|\Z)(?<X1057540>)|\s*[^;]{1,40};\s*\$\w{1,40}\s*=\s*['"]?\$?_SERVER['"]?;[^\}]{1,200}\}\s*\}\s*(\$\w{1,40})\s*=\s*['"]curl_init['"]\s*;\s*[^\{]{99,999}if\s*\(\s*is_callable\(\19\)\s*\)(?<X2056313>)|\s*\$_SERVER\[[^>#<]{999,2999}\s*if\s*\(\s*strpos\s*\(\s*\$\w{1,40},\s*['"]google['"]\s*\)[^\}]{99,499}(\$\w{1,40})\s*=\s*(\w+)\(['"]http[^;]+;\s*echo\s*\21;\s*exit;\s*\}[^#]{999,2999}function\s+\22\([^\?]+return\s*@?file_get_contents\([^;]{1,99};[\s\}]+\?>(?<X1135681>)|\s*\d+;\s*(\$[li1o0]{1,15})\s*=\s*urldecode\(['"][^'"]{9,150}['"]\);\s*(\$\w{1,15})=(?:\24\{\d{1,2}\}\.){3}[^\(]{99,350}eval\(\25\(['"][^'"]{999,30000}['"]\)\);\s*(?:\Z|\?>)(?<X1128500>)|\s*\w{1,40};\s*[^:]{1,600}://[^/]{1,40}/[^`]{9000,15000}];for\((\$[O_0]{1,40})\s*=\s*0;\27<\$[O_0]{1,40};\$[O_0]{1,40}\+\+\)\{(\$[O_0]{1,40})\s*\.=\s*\$[O_0]{1,40}\[\$[O_0]{1,40}\[[^\]]{1,9}\]\(0,\$[O_0]{1,40}\)];}return\s*\28;}\s*(?:\?>|\Z)(?<X1057560>)|\s*array(?:\(['"\d\.,\s]{4999,19999}\);\s*\$\w{1,40}\s*=\s*file_get_contents\([^\!]+if\s*\(\s*!\$isbot\)\s*\{\s*\$\w{1,40}\s*=\s*\$_SERVER\[['"]HTTP_REFERER['"]\];\s*\$\w{1,40}\s*=\s*stristr\(\$\w{1,40},\s*['"](?:google|yahoo)['"]\);(?<X2124110>)|\s*\((?:(?:\s*['"][^'"]{24,96}['"]\s*,?){50,70}\s*\)\s*;.{0,284}eval\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*['"]['"]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;\s*\?>(?<X1041820>)|\s*['"]#google#i['"]\s*\)\s*;[^@]{99,999}if\s*\(\s*@?\$isbot\s*\)\s*\{[^\}]{9,999}(\$\w{1,40})\s*=\s*curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*curl_close\s*\(\s*\$\w{1,40}\)\s*;\s*echo\s*\(?\s*\32\s*\)?\s*;\s*\}\s*(?:\?>|\Z)(?<X1126300>))))|\$\w{1,9}\h*=\h*['"]base64_decode['"];[^\(]{0,49}(\$\w{1,9})\h*=\h*\$\w{1,9}\(\$\w{1,9}\(['"]https?:\s*//\w{1,9}\.trackstatisticsss\.com/\w{1,9}\.txt['"]\)\);\s*file_put_contents\(['"]([^'"]{1,15})['"],\h*['"]<\?php\s*['"]\h*\.\h*\34\)[^\?]{0,49}\bunlink\(['"]\35['"]\);\s*\?>(?<X1176740>)|\$\w{1,9}\s*=\s*(?:['"][^'"]{20,150}['"];\s*(\$\w{1,9})\s*=[^\.]{9,99}@?touch\(['"]\w{1,20}\.html?['"]\);[^\}]{99,300}\}\s*\}\s*@?system\(['"]kill[^\.]+\.\37\);[^%]{30000,}\}\s*sleep\(\d+\);\s*\}\s*@?system\(['"][^'"]{0,15}(\w{1,9}\.sh)['"]\);\s*@?unlink\(["']\38['"]\);\s*\?>(?<X1133150>)|\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]{9,99}/(bot\.txt)['"];(?:\s*(?:if|elseif)\(function_exists\(['"]((?:eval|system|assert|popen|exec|shell_exec|passthru))['"]\)\)\{\s*@?\41\(["'](?:wget|curl|lwp-download|lynx|fetch|GET)[^;]+\40;[^\}]+\}){2,9}\s*(?:\Z|\?>)(?<X1134920>)|__file__;\s*(\$\w{1,9})\s*=\s*['"][^'"]{500,2000}['"];\s*\43\s*=\s*base64_decode\s*\(\43\);\s*\43\s*=\s*strtr\s*\(\43[^;]{5,50};\s*(\$\w{1,9})\s*=\s*@?[ep]reg_replace\s*\(['"]__FILE__[^;]{5,50};\s*eval\s*\(\44\);(?<X2121061>)|array\(['"][^@]+@(?:[\w\-\.]+)\.(?:[a-z]{2,5})['"]\);\s*(?:\$\w{1,9}=['"][^']*['"];|\$\w{1,9}=array\([^\)]+\);){1,5}for\s*\((\$\w)=0;\46<\d;\46\+\+\)\s*\{\s*(\$\w{1,9})=\$\w{1,9}\[\46\]\s*;\s*(\$\w{1,9})\s*\.=\s*\$\w{1,9}\[\47\]\s*;\s*\}\s*\48\([^\)]{1,400}['"]\);\s*\?>\s*\Z(?<X2058450>))|\$\{['"](?:G|\\x47)(?:[^&]{999,6000}/\\x74(?:i|\\x69)(?:t|\\x74)(?:l|\\x6c)(?:e|\\x65)\\x3e[^`]+\)\);return\$\{\$\{['"](?:G|\\x47)[^'"]{9,18}['"]\}\[['"][^'"]+['"]\]\};\}echo\s*\(?\s*['"][^;]*['"]\s*\)?\s*;\s*(?:\?>|\Z)(?<X1058480>)|[^'"]{1,40}['"]\}[^:]{99,999}(?:h|\\x68)(?:t|\\x74){2}(?:p|\\x70)(?:s|\\x73)?://[^!]{99,600}if\s*\(\s*strcasecmp\s*\(\s*\$_SERVER[^?]{99,5000}curl_exec\s*\(\$\{\$\{['"](?:G|\\x47)[^'"]{1,40}['"]\}\[[^\]]{1,40}\]\}\);[^;]{0,99};?\}?exit\(\d*\);?\s*(?:\Z|\?>)(?<X1059281>))|\$\{['"][^%]{30000,50000},sprintf\(['"]%[^\^]+preg_match\(\s*['"].\^[^\$]{1,9}\$\{\$\{['"](?:\\(?:x47|107)|G)[^%]+['"]\s*;\s*\}\s*exit\s*;\s*(?:\?>|\Z)(?<X1057670>)|\$\{['"][^'"]{1,40}['"]\}\[["][^`]{40000,64000}\}=create_function\(['"]['"],@?gzuncompress\(\$\{\$\{['"][^'"]{1,40}['"]\}\[['"][^'"]{1,40}['"]\]\}\)\);\$\{\$\w{1,40}\}\(\);\s*\?>\Z(?<X1042400>)|\$\{['"][^\*]{99,999}@?preg_replace\s*\(\s*.?['"](.).{0,40}\54(?:e|\\(?:x65|101))\w?.?['"]\s*,[^\)]+\);\s*(?:\?>|\Z)(?<X1057680>)|\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*=[^\.]{4000,9999}return\h*['"][^'"]{0,99}['"]\h*\.\h*\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}[^/]{4000,9999}['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\h*\},['"]{2,}\),\$\{\$\w{1,40}\}\)\)\.['"]{2,}(?<X2138650>)|\$arrId\s*=\s*array\(['"]\d+\-\d+['"]\s*,(?<X2045555>)|\$auth_pass\h*=\h*['"]\w{32}['"];\s*(?://[^\$]{1,49}\s*)?(\$\w{1,40})\h*=\h*['"][^'"]{999,4999}['"];\s*@?(?:eval|assert)\h*\(\h*(?:(?:base64_decode|gz[id][ne]flate|str_rot13)\h*\(\h*){3,5}['"]?\58['"][\)\h]+;\s*(?:\?>|\Z)(?<X1147780>)|\$blocks\[['"](\w{1,49})\-\w[^\]]{0,99}\]\h*=\h*array\s*\(\s*['"](?:\60|\w+@)[^\n]{9,9999}\b(?:redito\.net|go\-links\.org)/\w{1,15}[^'"]{0,50}['"]\);\s*\?>(?<X1182696>)|\$GLOBALS\[[^\%]{60000,}%[^\?]{999,3000}\?\s*[^\&]{1000,1500}\.\./wp-config\.php(?<X2056980>)|\$pathToDor\h*=[^;]{1,99};[^\(]{1,199}\beval\h*\(\h*gz(?:uncompress|deflate)\h*\(\h*base64_decode\h*\(\h*['"][^\)'"]{999,}['"]\s*(?:\)\s*){3};\s*(?:\?>|\Z)(?<X1173080>)|\$s{1,9}ecret\h*=\h*['"]\w{1,199}['"];[^\}@]{1,199}\bif\h*\(\h*(?:\(\h*strpos\h*\(\h*\$_SERVER\[['"]HTTP_REFERER['"]\]\h*,\h*['"](?:google|yahoo|bing)['"]\h*\)\h*\)\h*\D{2,3}\h*){3,5}\{[^\}]{99,199}\bheader\(['"]Location:\h+https?://(?<X2151530>)|\$s{3,9}ecret=['"]\w{99,199}['"];[^@\{\?]{1,499}\bif\(+strpos\(\$_SERVER\[['"]HTTP_REFERER['"]\],["'][gby](?:oogle|ing|ahoo!?|andex)['"]\)+[^;\{]{1,99}\{[^\}]{9,999}\bheader\(['"]location:\s*https?://(?<X2159540>)|\@?set_time_limit[^\{]{9,99}if\((md5)\(\66\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\D{2,3}['"]\w{32}['"]\h*\D{2,3}\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\}]{9,199}eval\(\67\);\s*(?:die|exit)\(\)[^\{]{9,99}\{\s*echo\h*['"][^\}]{9,299}404\h*not\s*found[^\}]{9,199}\}\s*(?:\Z|\?>)(?<X1146860>))
\A\s*<\?php\s*(?:\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(((?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev))\(file_get_contents\(\1\(['"]aHR0cHM6Ly9zZW9oYWNrLm5ldC9[^\?]{1,99}\?>(?<X1188790>)|class\h*(?:(\w{1,15})\h*\{\s*function[^\?]{1,1999}\b(?:var\h*\$\w{1,9}\h*=\h*array\(['",gzinflatecruobs64_dp\h]+\);\s*){3}(var)\h*\$\w{1,15}\h*=\h*['"][^'"]{999,}['"];\s*\4\h*\$\w{1,15}\h*=\h*['"][^'"]{99,}['"];\s*\}\s*new\h*\3\(\);\s*\?>(?<X1186693>)|_[^\{]{5,45}\{private[^\n]{9,299}/\*Bloodninja\b(?<X2146902>))|class(?:\s*(\w{1,40})\{[^\{\(]{1,499}\b(function)\s*getPlatform\(\)\{[^@%&\|/\*]{499,1999}\b\8\s*(\w{1,40}\(\))\{[^@%\*]{999,1999}\$(content)Type=['"]application/msword['"];[^@]{1,499}\$(\10data)=['"][^'"]{49999,}['"];return\b[^;]{1,99}\$\11\)+;\}+echo\(new\s*\7\)\->\9;\s*(?:\?>)?\Z(?<X2162241>)|\s+(authkey)\s*\{\s*var\s*\$hsstr;\s*function\s+__construct\h*\(\h*\)\s*\{\s*\$this\h*\->\h*setister\h*\(\h*\d+\h*\);\s*\}[^\?]{999,9999}\$(\w{1,40})\h*=\h*new\s+\13\h*\(\h*\d+\h*\);\s*(\$\w{1,40})\h*=\h*\$\14\h*\->\h*uncode\h*\([^\)]+\);\s*@?eval\h*\(\h*\15\h*\);\s*(?:\?>|\Z)(?<X1165940>))|echo(?:[^;]{1,199};\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{[^\{]{0,199}\{\s*(\$\w{1,15})\h*=\h*\$\w{1,15};\s*@?(?:copy|move_uploaded_file)\([^\)]+\17\h*\)\h*;[^\}]{1,199}\}\s*\};?\s*echo[^;]{4,199}['"]\h*;\s*\?>(?<X1172541>)|\b[^;]{1,99};\s*if\h*\(\h*file_exists\h*\(\h*['"]([^'"]{1,199}\.php)['"]\h*\)\h*\)\h*\{\h*@?touch\h*\(\h*['"]\19['"]\h*,[^;]{2,99};\h*\}\h*unlink\h*\(\h*__FILE__\h*\);\s*(?:/\*\s*\w{1,40}\s*\*/\s*)?(?:\?>|\Z)(?<X1169340>)|\h*['"]<form[^\{]{9,99}\bif\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\{[^\?]{99,600}\becho\s*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*echo\h*['"][^;]{1,40};\s*\}\s*\}\s*(?:\?>|\Z)(?<X1160270>)|\s*(?:base64_decode\()?["'][^;/]{1,99}['"][\)]?;\s*(?:@?include\(['"][^'"]{9,99}['"]\);\s*)?(?:@?(?:system|exec|passthru|shell_exec|popen|proc_open)\(['"][^@\?]{9,150}['"]\);=?\s*){3}[^\?]{9,9999}\?>(?<X1121834>)|\s*['"]<form\s*action[^;]{1,99};\s*if\s*\(isset\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{1,150}\$\w{1,9}\s*=\s*fopen\s*\(['"]([^'"]{1,15}php)['"][^=]{1,99}(\$\w{1,9})\s*=[^#]{1,599};\s*file_put_contents\s*\(['"]\23['"],\s*\24\);\s*\}\s*\}\s*(?:\Z|\?>)(?<X2125004>)|\s*['"][^/;@#&\*=\$!%\|:\{\[\(]{1,99}<(title)\b[^>]{0,99}>\s*404\s*Not\s*Found\s*</\26>[^\?\}@#&\*:%\|\+]{1,499}\b[mc]o(?:py|ve_uploaded_file)\h*\((?<X2170660>)|\s*['"][^\{\(=]{1,199}\b(?:echo\s*['"][^;]{1,99}\.\h*(\w{1,40})\h*\(\h*['"]https?://[^;]{1,199};\s*){1,9}function\s+\28\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\29\h*\);[^\?]{1,199}\breturn\h+\30;\s*\}\s*(?:exit|die)[^;]{0,19};\s*(?:\?>|\Z)(?<X1172790>)|\s*['"]Privet\s+bot\s+by\b(?<X2162800>)|\s*eval\(base64_decode\((?:str_replace\(\s*'.'\s*,\s*'.'\s*,\s*){3}(?<X2049671>)|\s+base64_decode\s*\(['"]PGh0bWw\+PGJvZHk[^'"]{9,999}(?:L3dwLWNvbnRlbnQvcGx1Z2lucy9jb250YWN0LWZvcm0tNy|d3AtY29udGVudC9wbHVnaW5zL2NvbnRhY3QtZm9ybS03|cC1jb250ZW50L3BsdWdpbnMvY29udGFjdC1mb3JtLTcv)[^'"]{1,999}['"]\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*(?:\?>|\Z)(?<X1124490>)))
\A\s*<\?php\s*(?:error_reporting(?:[\h\(]+(?:0|NULL)[\h\)]+;[^#]{99,2500}\b(echo)\h*['"]\h*window\.location\.href[\h=]+['"]https?://[^/]+\bsaleforyou\.org/[^;]+;\s*\1\h*['"]</script>['"][^#]{9,399}(\$\w{1,15})[\h=]+str_replace[\h\(]+['"]\.html['"],\h*['"]{2},\h*\2[^\?]{0,150}\?>(?<X1198200>)|\((?:0|NULL)\);(?:\h*(?:\$[0O]+[\h=]+\d+;\h*)?(\$[0O]+)[\h=]+['"][A-z0-9\+]{99,200}['"];\h*\4[\h=]+str_replace\([^\)]+\);\h*\$[o]+[\h=]+base64_decode\(\4\);[^\n]{999,12000}\b(?:exit|die)[^;]{0,9};\h*fwrite\(\$[0O]+,\h*\$[0O]+\);\h*fclose\(\$[0O]+\);\}\s*\?>(?<X1199091>)|\s*echo[^;]{1,40};\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\?]{9,70}\belse\s*\{\s*(\$\w{1,9})\h*=\h*file_get_contents\(\6\);[^#]{9,200}\beval\(\7\);\s*\}\s*function\h*\w{1,9}\(\$\w{1,9}\)\s*\{\s*(\$\w{1,9})\h*=\h*curl_init[^\?]{9,499}\8\);\s*\}\s*\?>(?<X1154271>)|\s*function\h*(\w{1,40})\([^\)]+\)\s*\{\s*http_response_code\([^\}]{0,99}\}\s*if\h*\(is_null\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\?]{0,250}\bif\h*\(\h*@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{0,99}\b\10\(\);\s*(?:\?>|\Z)(?<X1186980>))|\((?:(?:0|NULL)\)[^\?]{1,99}IndoXploit(?<X2125020>)|(?:0|NULL|FALSE)\);[^\?\{]{1,99}\$\w{1,40}\h*=\h*['"][^'"]{1,2999}[ja](?:G5hbWU9Im1vYmFuIj|kbmFtZT0ibW9iYW4iO)[^@]{999,9999}\bunlink\h*\(\h*['"]\./[^'"]{1,40}\.php['"]\h*\);\s*(?:\?>|\Z)(?<X1149900>)|(?:0|NULL|False)\);\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*file_get_contents\h*\(\h*['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^'"]{0,49}['"](?:\h*\)){3};\s*(?:\?>|\Z)(?<X1155920>)|(?:0|NULL|FALSE)\)[^,]{9,150}if\s*\(@?move_uploaded_file\s*\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^/]{99,300}(\$\w{1,20})\s*=\s*fopen\([^\)]+,['"]w\+['"]\);\s*fwrite\(\15,[^\)]+\);\s*fclose\(\15\);\s*(?:\}\s*)+(?:\?>|\Z)(?<X1135240>)|(?:NULL|0)\);(\s*\$GLOBALS\[['"])pass['"]\]=['"]\w{36,40}['"];\s*\17[^\)]{9,50}\beval['"]\);\s*\17ver[^;]{5,20};\s*\17title['"]\]=['"]\w{1,15}['"];\s*@?ob_start\b(?<X2131622>)|0\);[^\?]{99,450}eval\(base64_decode\(['"]JGNvbj1bIkEi[^'"]{99,1450}['"]\)\);\s*(\$\w{1,2})=str_split\(["][^"]{999,30000}["]\);\s*(\$\w{1,9})=['"]{2};\s*foreach\(\19[^\}]{9,200}\}\s*\}\s*\}\s*eval\(['"]\?>['"]\.gzinflate\(base64_decode\(\20\)+;\s*(?:\Z|\?>)(?<X2128433>)|0\);\s*if\s*\(\s*!\s*defined\s*\(\s*['"]WP_OPTION_KEY['"]\s*\)\s*\)\s*\{\s*function\s*\w{1,40}[^`]{29000,33000}\$this-\s*>\s*\w{1,40}\s*=\s*(\$\w{1,40})\s*;\s*\22\s*%\s*=\s*\$\w{1,40}\s*;\s*return\s*\22\s*;\s*\}\s*\}\s*(?:\?>|\Z)(?<X1057801>)|0\);\s*ini_set\(['"]display_errors\b[^\{]{9,250}(\$\w{1,15})\h*=\h*['"]https?://aztemplates\.com[^\{]{9,150}\{(\$\w{1,15})\h*=\h*(file_)(get)(_contents)\(\24\);\s*\$\w{1,15}\h*=\h*\26put\28\((\$\w{1,15}),\h*\25\);\s*\}\s*echo\h*\26\27\28\(\29\);\s*\?>(?<X1149040>)|0\);\s*session_start\(\);\s*\$myHost\s*=\s*['"]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}['"];\s*\$pathOnMyHost\s*=\s*['"]{2};\s*\$pathToDor\s*=\s*['"][^'"]{1,99}['"];\s*\$template\s*=\s*["'][^'"]{1,99}['"][^\}]{1,500}header\(['"][^'"]{1,20}404\s*Not\s*Found['"]\)(?<X2129270>)|[^\)]+\);define\([^\)]+\);(\$GLOBALS)\[(\w{1,9})\]\h*=\h*explode\([^#]{999,4600}(function)\h*tcget\(\$[0o]+[^#]{999,1500}\34\h*rdFile\([^\{]{5,15}\{(\$[0o]+)=&\32\{\32\{\33\}\{[^#]{9,199}(\$[0o]+)\h*=\h*\35\{[^#]{9,99}return\h*\36;\s*\}\s*\}\s*(?:\Z|\?>)(?<X1144360>)|\d\);[^\?]{300,600}</form>['"];\s*if\(\$_POST\[['"]?[^'"]{1,40}['"]?]\s*[^\w]{1,2}=\s*"home"\s*\)\s*\{\s*if\s*\(\s*@?copy\(\$_FILES\[['"]?[^'"]{1,40}['"]?\][^\?]{40,200}\s*else\s*\{\s*[^\}]{1,40}\s*\}\s*\}\s*exit;\s*\}\s*\?>\s*\Z(?<X2053722>))|\h*\((?:0|null|false)\);(?:[^/'"\?]{0,99}\$\w{1,9}[\h=]+['"]http://[^/'";]{1,49}\.xyz/[^'"\?;]{1,49}\.(?:txt|html|php|pl)['"];[^\?]{9,999}\$\w{1,9}[\h=]+['"]\w{1,9}:['"]\.strtolower\(\$_SERVER\[['"](?:HTTP_USER_AGENT|HTTP_REFERER)['"]\]\);[^\?]{99,1999}return\h*\$\w{1,40}[;\}\s]+\?>(?<X1189641>)|[^\$]{0,20}(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\];\s*(\$\w{1,20})\h*=\h*\41\[[^\(\)]{9,250}</form>['"];\s*(\$\w{1,20})\h*=\h*move_uploaded_file\h*\(\40,\42\);\s*if\h*\(\43\)\s*\{[^\?]{1,99}\}\s*(?:\?>\s*)?\Z(?<X2184503>)|[^\(\?]{1,75}\$\w{1,9}\h*=\h*curl_init\h*\(\);[^#]{9,499}\bfunction\h*(\w{1,15})\h*\((\$\w{1,15})\)\s*\{\s*\$\w{1,15}\h*=\h*file_get_contents\h*\(\46\);[^#]{99,799}\$\w{1,9}\h*=\h*\45\h*\(['"]https?://\w{1,5}\.topsale4you\.rocks/[^\}]{9,350}\}\s*\?>(?<X1183130>))|\h*\(\h*(?:0|NULL|False)\h*\);(?:[^\?=\$]{1,199}\$\w{1,40}\h*=\h*['"]DragonE?Xploit(?:er)?['"];(?<X2170420>)|[^\?@#!%&\*]{0,199}\$(\w{1,40})\h*=\h*\$_[GPCSR]\w{2,6}\[[^\]]+\];\s*[pes](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*\$\49\h*\);[^\?@#!%&\*,\|\\\+]{0,499}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\?@#!%&\*\|\\\+]{1,199}(?:\?>|\Z)(?<X1170310>)|\s*if\h*\([^\}\?]{1,299}\bfunction\s+(getHtml)\h*\([^\?]{99,}\$(\w{1,40})\h*=\h*\51\h*\(\h*['"]https?://[^;]{1,99};\s*(?:\$\52\h*=\h*str_i?replace\h*\([^;]{1,99};\s*){0,3}echo\s*\$\52;\s*(?:exit|die)[^;]{0,19};\s*(?:\}\s*){0,4}(?:\?>|\Z)(?<X1170300>)))|eval\s*\(\s*base64_decode\s*\(\s*(?:"aWYoaXNzZXQoJF9SRVFVRVNUWy[^"]{400,1000}"\s*\)\s*\)\s*;\s*\?>(?<X1041250>)|['"](?:ZXJyb3JfcmVwb3J0aW5nKDAp|cnJvcl9yZXBvcnRpbmcoMCk|cm9yX3JlcG9ydGluZygwKQ)[^'"]{50,1000}(?:X2V4aXN0cygnc2hlbGxfZXhlYw|ZXhpc3RzKCdzaGVsbF9leGVj|eGlzdHMoJ3NoZWxsX2V4ZWM)[^'"]{400,1500}['"]\s*\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1058960>)|['"][^;]{1,15}(?:Z290bw|b3Rv|IGdvdG8)[^;]{9999,24000}(?:ZXZhbA|dmFs|IGV2YWw)[^;]{9,99}(?:aHRtbHNwZWNpYWxjaGFyc19kZWNvZGUodXJsZGVjb2RlKGJhc2U2NF9|dG1sc3BlY2lhbGNoYXJzX2RlY29kZSh1cmxkZWNvZGUoYmFzZTY0Xw|bWxzcGVjaWFsY2hhcnNfZGVjb2RlKHVybGRlY29kZShiYXNlNjRf)[^;]{9,600}['"]\)\s*\);\s*(?:\?>|\Z)(?<X1059400>))|file_pu(?:(t_contents\()['"][^'"\),]+\.php['"],file_ge\57['"]https?://[\d\.]+/[^'"\);\.]+\.txt['"]\)\);\s*(?:\?>)?\Z(?<X2171860>)|t_contents\s*\(\s*['"]\w+\.php['"]\s*,\s*base64_decode\s*\(\s*['"][^\;]{1,200}['"]\s*\)\s*\)\s*;\s*\?>\s*\Z(?<X2054360>))|for\s*\((\$\w{1,40})=\d+;[^\)]+\)\s*\{[^\$]{0,40}(\$\w{1,40})\s*=\s*(?:posix_get(?:pw|e)?[gu]id|getmy[gu]id|get_current_user)\s*\(\60\);\s*if\s*\(!empty\s*\(\61[\)\s]+\{\s*while\s*\(list\s*\(\$\w{1,40},(\$\w{1,40})\)\s*=\s*each\s*\(\61[\)\s]+\{\s*(?:echo|print)[^;]+\62\b[^;]+;\s*\}[^\?]{1,19}(?:\?>)?\Z(?<X2137122>)|foreach(?:\h*\(\h*\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,15}\h*=>\h*(\$\w{1,15})\h*\)[^\?]{99,1500}\}\s*(\$\w{1,15})\h*=\h*\$_SERVER\[[^\[\?\}]{1,199}(\$\w{1,15})\h*=\h*\$[^\;]{1,99}\.php['"];\s*@?file_put_contents\(\66,\h*\64\);\s*echo\h*['"]http://[^;]{1,99}\65[\)\h]+;\s*exit\(\);[\s\}]+(?:\?>|\Z)(?<X1192320>)|\s*\(\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,9}\D{2,4}(\$\w{1,9})\)\{\s*\$\w{1,9}\s*=\s*(base64_decode\()\68\);\s*\}\s*(\$\w{1,9})\s*=\s*explode[^\{]{1,50}(\$\w{1,9})\s*=\s*mail\((?:\69\70\[\d+\]\),){2,3}[^\{]{0,99}if\(\71\)\{\s*echo[^\}]{0,99}\}\s*else\s*\{echo[^\}]{0,99}\71;\}\s*(?:\Z|\?>)(?<X1133791>)))
\A\s*<\?php\s*(?:function(?:[^\{]{9,70}\{\s*global\s*(\$modx)[^\?]{99,3200}if\s*\(\$_[GPRSCF]\w{2,6}\[[^\]]+\]\)\s*\{[^\}]{9,250}case\s*['"]\w{1,5}['"]:\s*wp_content_show\(\1\)[^\}]{9,100}@?wp_functions_content\(\1\)(?<X2128840>)|[^`]{999,1500}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\3e\w?.?['"]\s*,\s*['"](?:\\x\w{2}){40,78}['"]\s*,\s*['"]\.['"]\s*\);\s*(?:\?>|\Z)(?<X1042312>)|\h*(\w{1,15}\(\))\{\s*\$\w{1,9}\h*=\h*curl_init\(\);[^\}]{0,150}\bindoxploit\-coders/[^'"]{0,49}\.php['"]\);[^\?]{0,300}\bfwrite\(\$\w{1,15},\h*\5\);[^\?]{0,99}\binclude\(['"][^'"]{1,25}\.php[""]\);\s*\?>(?<X1172980>)|\h*wpb_admin_account\h*\(\h*\)\s*\{\s*(\$user)\h*=\h*['"][^'"]+['"];\s*\$pass\h*=[^\}]{1,250}\7\h*=\h*new\h*WP_User[^#]{99,999}\btranslate_user_role\h*\(['"]Administrator['"]\)[^\?]{1,250}\breturn\h*\$\w{1,15};\s*\}\s*\?>(?<X1173502>)|\h+(\w{1,40})\h*\([^\{]{1,99}\{\s*\$\w+\h*=\h*explode\h*\(\h*['"]([^'"]{1,40})['"][^\}]{1,499}\}\s*(\$\w+)\h*=\h*\$_[GPSRC]\w{2,6}\[[^;]{1,99};\s*\$\w+\h*=\h*\9\h*\(\h*['"](?:[asertvl]|\10){4,49}['"]\h*,\h*\11\h*\);[^\}\(\{\?]{1,99}\barray_map\h*\([^;]{1,99};\s*(?:\?>|\Z)(?<X1173790>)|\h+ob_gzhandlers3\((\$\w{1,40})\)\s*\{\s*@error_reporting\(0\);\s*(preg_)match\(['"](/\\<ul\.\*\?\\>/i)['"], \13,\h*(\$\w{1,40})\h*\);\s*return\h+\14replace\h*\(['"]\15['"],\s*\16\[\d+\]\.['"]\s*<li>\h*<a\h+href\h*=\h*['"][^'"]{1,99}(?:viagra|online|casino|pharma|cheap|sale)(?<X2140961>)|\s*(?:Ex)?tor\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*['"][^'"]*['"];\s*if\s*\(\s*function_exists\s*\(\s*['"]exec['"]\s*\)\s*\)\s*\{\s*@exec\s*\(\s*\$\w{1,40},\$\w{1,40}\s*\);(?<X2126320>)|\s*(\w{1,9})\((\$\w{1,9})[^\}]{9,150}return\s*\20;\}\s*function\s*(\w{1,9})[^\?]{99,500}isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^<]{9,99}fwrite\((\$\w{1,9})[^\.]{9,99}\.str_replace\([^\(]{9,40}\19\(\21\(['"]\w+['"]\),\22\)+;\s*fclose\(\23\);\s*include\s*(\$\w{1,9});\s*unlink\(\24\);\s*\}(?<X2125881>)|\s*(\w{1,9})\([^\}]{9,250}return\s*curl_exec[^\}]{1,50}\}\s*(\$\w{1,9})\s*=\s*\$_[PGSCR]\w{2,6}[^;]{9,99}\.php['"]\s*;\s*(\$\w{1,9})\s*=\s*\26\(['"]https?[^'"]{9,99}\.txt['"]\);\s*(\$\w{1,9})\s*=\s*fopen\(\27[^;]{1,20};\s*fwrite\(\29,\s*\28\);\s*fclose\(\29\)(?<X2280140>)|\s+(\w{1,40})\b[^\?]{99,499}\bfile_put_contents\([^;]{1,49};\s*\}\s*(\$\w{1,40})\h*=[^;]{1,99};\s*if\h*\(\h*\32\b[^\{]{1,49}\{\s*(\31\(['"]https?://[\d\.]{7,15}/)[^\?]{99,499}\}\s*else\s*\{\s*\33[^\}]{9,199}\}\s*(?:@?unlink\h*\([^;]{1,99};\s*){2,3}(?:\?>|\Z)(?<X1155960>)|\s+(CoreLibrariesHandler)\(\)\s*\{\s*(\$\w{1,20})=['"]\s*['"];\s*foreach\((str_)split\(\36,\d+\)[^\{]{1,20}\{\s*\$\w{1,20}\s*=\s*\37replace\(['"]\s*['"],[^,]+,\37replace\([^\?]{9,150}\}\s*register_shutdown_function\(['"]\35['"]\);\s*\?>(?<X1138671>)|\s+pre_term_name\h*\([^\}<\?>]{1,499}\breturn\s*@?\$\w{1,19}\h*\(\h*\$\w{1,19}\h*\);\s*\}\s*\$\w{1,19}\h*=\h*['"]<img\s*src=['"]data:(?<X2171120>))|GIF8(?:7|9)?\w?[^\s]{0,2}\s*[^\;]{0,80};(?<X2055424>)|global(?:\h*\$(\w{1,15});\$\41\[[^\]]+\][\h=]+(base64_decode\()[^\n]{999,2000}=\42[^\)]+\);\s*\?>\s*<\?php\s*(\$GLOBALS)\[['"]\41['"]\][^\n]{999,5000}\43\[['"]\41['"]\]\[[^\]]+\]\(\$httpAcceptLanguage[^\?]{1,99}\?>(?<X1198550>)|\s*(\$\w{1,10});\s*if\(\!\45\)\s*\{[^;]{5,15};\s*(\$\w{1,10})\s*=\s*['"][^'"]{1,99}['"];\s*if\(\!@?\$_(?:P|G|S|C|R)\w{2,6}\[\46[^\?]{9,250}@?setcookie\(\46[^y]{50,500}foreach\(array\((?:\d{1,3},){20}[^\{]{9,1500}\{(\$\w{1,10})[^\}]{9,99}\}\s*eval\(\47\);\s*exit;\s*\}\s*(?:\Z|\?>)(?<X1121800>)|\s*(\$\w{1,20});\s*if\s*\(!?\49\)\s*\{\s*\49\s*=\s*['"][^'"]+['"];\s*(\$\w{1,20})\s*=\s*(?:(?:base64_encode|str(?:rev|_replace))\s*\(){4}[^:]{99,200}(\$\w{1,20})\s*=\s*['"]https?://[^;]+;\s*\50\s*=\s*@?file_get_contents\s*\(['"]\51\?[^\?]{99,1500}(?:exit|die)[^;]{0,9};\s*(?:\}\s*){3}\?>(?<X1127173>))|goto\s+\w{1,9};\s\w{1,9}:\s*fclose\([^\n]{99,300}fopen\([^\n\(]{99,200}\$\w{1,20}\s*=\s*(getcwd\(\))\s*\.\s*DIRECTORY_SEPARATOR;[^@\n]{300,999}@ini_set\([^\)]+,\s*(?:0|NULL)\);[^\n]{999,5000}['"](?:\\x?\w{1,3})+['"]\s*\.\s*php_uname\(\)\s*\.[^;]{30,150}\(\$\w{1,20}\s*=\s*\53\);(?<X1130280>)|header(?:\(['"]Location:\s*\w{1,19}\.php['"]\);(?:\$(u(?:ser)?(?:name)?|pass(?:wo?r?d)?)=\$_POST\[[^;]{1,99};){2}[^@]{99,199}\$(\w{1,40})=[^;]{0,49}\$\55\b[^@]{1,199}\bmail\([^\)]+\56\b[^\?\{\}!&]{1,299}\bfwrite\([^\);]+\$\55\b(?<X2163000>)|\h*\(['"]Location:[^;]+;\s*\$\w{1,20}\s*=\s*(?:getenv\(|\$_SERVER\[)['"]REMOTE_ADDR['"](?:\)|\])\s*;[^@]{9,99}(?:\$\w{1,40}\s*\.?=\.?[^\$]{1,40}\$_POST\[[^\]]+\][^;]{1,80}\s*;\s*){2,}[^/]{99,299}@\bmail\([^;]{9,99}\);\s*(?:exit|die)\b[^;]{0,9};\s*\?>(?<X1144331>)|\s*\(['"]Location:\s*http://[^'"]{0,40}(?:med|pharm|cialis|viagra|canadian)[^'"]{0,40}\.\w{2,9}/?['"]\);\Z(?<X2125571>))|if[\(\h]+isset[\(\h]+\$_[GPRSC]\w{2,6}[^>]{1,299}(\$\w{1,9})\h*=\h*(file)_get_contents\(\$\w{1,9}\);\s*eval\([^\.]{1,49}\.\h*\60\);[^\?]{1,49}\bif[\h\(]+@(?:copy|move_uploaded_\61)[\h\(]+(\$_\61s\[['"]\w{1,9}['"]\])\[[^\]]+\][\h,]+\62[^\?]{1,99}\becho\b[^\.]{1,99}\.\h*php_uname\h*\(\)\h*\.(?<X2181321>)|if[\h\(]+isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)\{]+(\$\w{1,15})\h*=\h*(curl_)init[\h\(]+base64_decode[\h\(]+\64[\h\)]+;\s*[^\}]{1,99}(\$\w{1,15})\h*=\h*\66exec[\h\(]+\65[\h\)]+;\s*eval[\h\(]+['"]\?>['"]\h*\.\h*\67[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1193380>)|if\(!(?:@?(\$\w{1,15})\)\{if\(preg_match\([^\)]+\)\)\{echo\s*["']<a\s*href=['"][^'"]+\.php['"][^\}]+\}@?\69=true;\}\?>(?<X1132681>)|\s*(class)_exists\(['"](WPPlugingsOptions)['"]\)\)\{\71\s*\72\{[^\}]{9,999}\bfunction\s*__construct\([^\)]+\)\{\s*\$this\->baseUrl=hex2bin\([^@]{9999,29999}\b(?:\72::\w{1,40}\(\);){3}\}+catch\(Exception\s*\$\w{1,40}\)\{\}\s*\Z(?<X2160022>)|isset\((?:(\$\w{1,15})\)\)\{\$\w{1,15}[^\n]{99,2800}\bif\((\$[0o]{4,9})\D{2,3}['"]have(?:door|donor)[^\n]{99,2500}\bif\(stristr\(\75,['"]nodonor['"]\)\)\{\}\}\74=\d{1,3};\}\?>(?<X1155880>)|\$_[GPRSC]\w{2,6}\[([^\]\$\)\.]+)\]\)\)\s*\{\s*setcookie\(\77[^;]{9,50}\);\s*header\(['"]Location:\s*https?://[^\)]{9,50}\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:\Z|\?>)(?<X1130321>)))|if\(\$_[GPRSCF]\w{2,6}\[[^\]]+\][^\{]{1,20}\{if\((\$_[GPRSCF]\w{2,6}\[[^\]]+\])==['"]['"]\)\s*\{\s*echo[^;]{1,40};(?:exit|die)[^;]{0,9};\}\s*eval\(\79\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*(?:\Z|\?>)(?<X1128451>)|if\(\h*isset\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*if\(\h*function_exists\(\h*['"](unlink)['"][\)\s]+\{\s*(?:@?\82\(\81\);\s*){1,9}\}\s*(\$\w{1,40})\h*=\h*@?fopen\(\h*\81,[^\);]+\);\s*@?fwrite\(\h*\83,[^;]{1,99};\s*@?fclose\(\h*\83\h*\);\s*\}\s*(?:\?>|\Z)(?<X1163900>)|if\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{\s*error_reporting\(0\);\s*unlink\(['"][\./]{0,20}cpanel/contactinfo['"]\);\s*unlink\((['"][\./]{0,20}contactemail['"])\);\s*(\$\w{1,9})\s*=\s*fopen\(\86[^;]{1,9};\s*fwrite\(\87,\85\)[^\}]{9,199}fclose\(\87[^\?]{5,25}(?:\Z|\?>)(?<X2132190>)|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\)\)\{\$\w{1,40}=strrev\([^\}\s]{1,150}\}\s*\?>(?<X1121030>)|\$_REQUEST\[['"](\w{1,40})['"]\]\)\)\{\s*echo\s*['"][^"]{1,40}['"];\s*\$\90\s*=\s*\(?\$_REQUEST\[['"]\90['"]\]\s*\)\s*;\s*(?:system|shell_exec|passthru|exec|popen)\(\$\90\);\s*echo\s*['"][^"]{1,40}['"];\s*die;\s*\}\s*\?>(?<X1042191>))|if\h*\(\h*!\h*(?:(class)_exists\h*\(\h*['"](?:([a-f0-9]{33})['"](?:\s*\)){2}\s*\{\s*\92\s*\93\s*\{[^\(]{999,4999}\bfunction\s*__construct\h*\(\h*\)\s*\{\s*(\$this\h*\->\h*)[a-f0-9]{33}\h*=\h*new\s*std\92\(\);(?:\s*\94[a-f0-9]{33}\h*\(\);){9}[^\?#%\*\+]{999,5499}\breturn\s*php_uname\(\);(?<X2168982>)|(\w{33})['"](?:\h*\)){2}\s*\{\s*\92\h+\96\s*\{\s*(?:p(?:rivate|ublic)\h+(?:static\h+)?\$\w{33}[^;]{0,9};\s*){5}[^#@!%&\?\*]{999,4999}\breturn\h+array\h*\(\s*(?:(\$this\h*\->)\h*\w{33}\h*\(\h*@?\97\h*\w{33}\h*\[\h*\97\h*\w{33}\h*\]\h*\)\h*,\s*){4}(?<X2179282>))|(function)_exists\h*\(\h*['"]((tmp_)\w{1,40})['"][^\?!]{1,199}\bif\h*\(\h*!\h*defined\h*\(\h*['"](\101\w{1,40})['"]\h*(?:\)\h*){2}define\h*\(\h*['"]\102['"]\h*,[^;]{999,4999};\s*\99\s+\100\s*\([^%]{99,999}\$GLOBALS\[['"]\102['"]\]=\$\w{1,40};\s*\101\w{1,40}\h*\(\h*\);\s*(?:\?>|\Z)(?<X1166450>)))
\A\s*<\?php\s*(?:if\h*\(\h*!(?:class(_exists)\h*\(\h*['"](WPTemplatesOptions)['"][\s\)]+\{\s*class\h+\2\s*\{[^\-]{99,999}(private\h+(function))\h+(\w{1,19})\(\)\s*\{\s*(\$this->)\5\h*=\h*\6(\w{1,40})\([^<\*]{2999,4999}\3\h*\7\(\)\s*\{[^\}]+\4\1\(\h*['"]\w{1,40}['"][\s\)]+\{\s*return\h+wp_upload_dir\(\);\s*\}(?<X2155343>)|file_exists\h*\(\h*['"]([^'"]{1,199}/\.[^'"/]+)['"]\h*\)\h*\D{2,3}\h*(?:hash|(?:md|sha)\d)_file\h*\(\h*['"]\9['"]\h*\)[^\{\v\?]{1,99}\{\s*@?chmod\h*\(\h*['"]\9['"][^;]{1,99};\s*@?(?:copy|move_uploaded_file)\h*\([^,\);]+,\h*['"]\9['"]\);\s*@?chmod\h*\(\h*['"]\9['"][^;]{1,99};\s*\}\s*(?:\?>|\Z)(?<X1173370>)|isset\h*\(\$_[GPRSC]\w{2,6}\[[^\}]{1,150}\bcase\h*['"]inj['"]:\s*(\w{1,15}\(\));[^&]{0,1999}\bfunction\h*\11\{\s*\w{1,15}\(\);\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\[['"]path_inj['"]\]\)\s*\{[^\?]{0,1199}\$isInjected\h*=\h*file_put_contents\([^#]{0,799}\breturn;\s*\}\s*(?:\?>|\Z)(?<X1186020>))|if\h*\(\h*(?:\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\s*\{\s*eval\h*\(\h*(?:(?:gzinflate|gzuncompress|base64_decode|str_rot13)\h*\(){2,5}\h*file_get_contents\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\)+;\s*\}\s*(?:\?>|\Z)(?<X1160801>)|isset\h*\(\h*(?:(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\s\)]+\{[^\}\?]{1,199}\b(file_put_contents\h*\([^,\);]+),\h*['"]<\?php\b[^'"]{1,19}['"]\h*\);\s*@?\15\h*,\h*\14\h*,\h*(FILE_APPEND)\h*\);\s*@?\15\h*,\h*['"][^'"]{1,9}\?>['"]\h*,\h*\16\h*\);[^\}\?>\{]{1,199}\}\s*\?>(?<X1163961>)|(\$_[GPSRC]\w{2,6}\[[^\]]+\])(?:\h*\)){2}\s*\{\s*@?(?:eval|assert)\h*\(\h*file_get_contents\h*\(\h*['"]https?://['"]\h*\.\h*\18(?:\h*\)){2};\s*\}\s*(?:\?>\s*)?\Z(?<X2170550>)|\$_[GPCSR]\w{2,6}\[(?:[^\]]+\]\h*\)\s*\)\s*\{\s*(?:(\$\w{1,40})\h*\.?=[^;]{0,49}\$_POST\[['"][UPL](?:ser(?:name|id)?|ass(?:wo?r?d)?|ogin)['"]\][^;]{0,40};\s*){2}[^\}]{0,199}\bfwrite\h*\([^,\)]+,\h*\20\h*\);[^\}]{0,99}\}\s*\?>\s*<(?:!DOCTYPE\s*)?html\b(?<X2171110>)|\h*['"]0.?day['"]\h*\][^\}\?]{1,499}\b[cm]o(?:ve_uploaded_file|py)\h*\(\h*(\$_FILES\[)[^,\)]+,\h*\22[^\?]{1,999}\b[ed](?:xit|ie)[^;]{0,19};\s*(?:\}\s*)?(?:\?>|\Z)(?<X1180542>))|\$_[GPRSC]\w{2,6}\[[^\]]+\](?:[\)\s]+\{\s*(?:die|exit)\b[^\}]{0,99}\}\s*(\$\w{1,15})\h*=\h*__(FILE_)_\h*\.\h*['"]\.css['"];[^\?]{1,99}(\$\w{1,15})\h*=\h*['"][^'"]{999,7000}['"];[^\?]{9,150}\b\25put_contents\([^\)]+\26[\)\s]+;\s*include\h*\24;\s*unlink\(\24\);\s*(?:\?>|\Z)(?<X1166692>)|\h*\)\h*\D{2,3}\h*substr[^\{]{9,90}\{\(@?copy\(\$_FILES\[[^\]]+\][^;]{9,50};\h*(\$\w{1,15})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\h*if\(isset\(\28[^\{]{9,25}\{eval\(urldecode\(\28\)\);\h*(?:exit|die)[^;]{0,9};\}\}\s*\?>(?<X1144280>))))|if\s*\(!(?:(function)_exists\s*\(['"](\w{1,20})['"]\)\)\s*\{\s*\30\s+\31\s*\(\$\w{1,20}\)\s*\{\s*if\s*\(\s*preg_match_all\s*\(['"]#<(?:script|iframe)[^%]{300,2000}\$\w{1,20}\s*=\s*@?set_error_handler\s*\([^\;]+;\s*@?eval\s*\(\s*base64_decode\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\?>(?<X1124891>)|defined\(['"]frmDs['"]\)[^\}]{9,40}function\s*(\w{1,9})\s*\([^\}]{9,250}curl_close[^\?]{9,350}\33\(['"]https?://\d{1,3}[^'"]{9,50}\.js['"]\)[^#]{9,600}if\(!isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{9,250}fputs\((\$\w{1,5})[^\}]{1,40}fclose\(\34\);\s*(?:\}\s*){4}(?:\Z|\?>)(?<X1129340>)|isset\((\$\w{1,9})\)\)\s*\{\s*global\s*\36;\s*\36\s*=\s*\d{1,2}(?:;\s*error_reporting\(0\)[^\?]{99,800}print\(['"]<script>['"]\.base64_decode\(['"][^'"]{99,5000}['"]\)[^\{]{1,99}\{\s*fputs\((\$\w{1,5})[^\}]{1,30}fclose\(\37\);(?:\s*\})+\s*(?:\?>|\Z)(?<X1128362>)|[^\?]{99,800}error_reporting\(0\);\s*print\(gzinflate\(base64_decode\(['"][^'"]{99,5000}['"]\)[^\{]{1,99}\{\s*fputs\((\$\w{1,5})[^\}]{1,30}fclose\(\39\);(?:\s*\})+\s*(?:\?>|\Z)(?<X1130410>))))
\A\s*<\?php\s*(?:if\s*\((?:(isset)\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\?]{99,350}\s*(\$\w{1,9})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\s*\(\1\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,5})=\3;\s*(\$\w{1,9})=['"]From[^\?]{9,600}mail\(\$\w{1,5},\s*\2,\s*\4,\s*\5[^\?]{1,50}(?:die|exit)\(0\);\s*\}\s*(?:\Z|\?>)(?<X2129231>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\D{2,3}\s*['"]\w{32}['"]\)\s*\{\s*error_reporting\([^#]{999,6000}(\$shell)Path\s*=\s*pathinfo\(\$_SERVER\[[^\}]{9,150}\}\s*\7Dir\s*=\s*dirname(\(__FILE__\))[^\?]{999,1999}if\s*\(!\$\w{1,9}\)\s*\{\s*unlink\8;\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1135120>)|\s*!@?(\$\w{1,40})\s*!=\s*false\s*\|\|\s*!@?\10\s*!=\s*null\s*\)\s*[^j]{5000,6000}\s*file_put_contents\([^,]{9,99},\$[li]{1,40}\)\s*;\s*endif\s*;\s*endif\s*;\s*endif\s*;\s*\$\w{1,40}\s*=\s*true\s*;\s*\$\w{1,40}\s*=\s*true\s*;\s*\}\s*\?>(?<X1053892>)|\s*!defined\s*\(['"](?:\w{1,9}['"]\)\)\s*\{\s*define[^;]+;\s*@?error_reporting\s*\(0\);[^#]{2999,9999}function\s*(\w{1,9})\s*\((\$\w{1,9})\)\s*\{\s*if\s*\(\s*!\w{1,9}\s*\([^\}]{1,600}die\s*\(['"][^\.]{1,99}document\.location=\s*\(\\['"]https?://[^#]+if\s*\(\s*\13\s*\)\s*\12\s*\(\13\);\s*\}\s*\?>(?<X1125141>)|frm\w{1,9}['"]\)\)\s*\{\s*define[^;]+;[^#]{3000,5500}(?:exit|die)\b[^;]{0,9};\s*\}\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{(?:\s*@?error_reporting\s*\(0\);)?\s*print\s*\(\s*frm_getcache\s*\(\s*\$\w{1,40}\s*,\s*['"]https?://[^;]+;\W{0,20}\}\W{0,20}\}\W{0,20}\}\s*\?>(?<X1125201>))|\s*!function_exists\s*\(\s*['"](\w{1,40})['"].{300,450}\$\w{1,40}\s*=\s*['"]\16['"]\s*;\s*(\$\w{1,40})\s*=\s*(\$\w{1,40})\s*\(\s*['"][^'"]{1,40}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\17\s*\(\s*['"]['"]\s*,\s*\18\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\19\s*\(\s*\)\s*;\s*\}\s*\?>(?<X1041880>)|\s*@?preg_match\s*\(\s*['"]/?(?:checkout|admin|\|){1,3}/?['"]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,20}['"]\s*\]\s*\)\s*\)\s*\{\s*@?file_put_contents\s*\(\s*.{1,200}\s*\?>(?<X1041860>)|\s*\!\s*class_exists\s*\([^@]{250,600}const\s*\w{1,40}\s*=\s*['"][ ]{200,}\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]{1,40}\]\s*\)\s*;\s*['"]\s*;(?<X2057620>)|\s*\$_[GPCSR]\w{2,6}\[[^\)]+\)\s*(?:\{\s*)?\b(?:die|exit)\h*\(\h*['"]baja?tax['"]\h*\);\s*header\h*\(\h*['"]Location:[^;]{1,99};\s*(?:\?>|\Z)(?<X1165330>)|\s*is_file\(\s*['"]/[^'"]+\.php['"]\s*\)\s*\)\s*\{\s*include(?:_once)?\s*\(\s*['"]/[^'"]+/wp\-[\w\-]{1,20}\.php['"]\s*\);\s*\}\s*\?>(?<X1058440>)|\s*isset\s*\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]{1,40}['"]\s*\]\s*\)\s*\)\s*die\s*\(\s*.{400,500}\s*\(\s*(\$\w{1,40})\s*\)\s*\)\s*\)\s*;\s*if\s*\(\s*isset\s*\(\s*\25\s*\)\s*\)\s*\{\s*@?eval\s*\(\s*\25\s*\)\s*;\s*exit\s*\(\s*\)\s*;\s*\}\s*\}\s*\Z(?<X2051970>)|[GPCSR]\w{2,6}\[[^\]]+\]\s*(?:\)\s*){2}\{\s*(?:@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]+/(?:anti)?b(?:ot|locker)[sz]\d*\.php['"];\s*){2}(?<X2171250>)|[GPRSC]\w{2,6}\s*\[[^\]]+\][^\?]{1,200}\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|str_rot13|urldecode)\s*\(){0,5}\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?:\s*\)\s*){1,6};?[^\?]{0,199}(?:\?>|\Z)(?<X1124581>)|POST\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\$_SERVER\s*\[['"]?DOCUMENT_ROOT['"]?\]\s*\.\s*base64[^;]+;\s*\$\w{1,40}\s*=\s*curl_init\(\);[^&]+\{@?unlink\(\29\);\}@?file_put_contents\(\29,\$\w{1,40}\);@?touch\(\29,strtotime[^\}]{1,99}\}\s*(?:\?>|\Z)(?<X1059942>))|\s*md5\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w{1,40}['"]\]\s*\)\s*==\s*['"][^'"]{1,40}['"]\)\s*\(\$\w{1,40}\s*=\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w['"]\]\s*\)\s*\.@?\$_\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"]\w['"]\]\s*\);\s*\?>(?<X1042140>)|\s*sha1\s*\(\s*md5\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w['"]\s*\]\s*\)\s*\)\s*===\s*['"][^'"]{24,40}['"]\s*\)\s*\{\s*eval\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"]\w['"]\s*\]\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]{1,40}['"]\s*;\s*\}\s*\?>(?<X1042170>)|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*if\s*\(stristr\([^\{]{5,50}\{echo\s*\(['"]<a\s*href=['"][^'"]{1,40}\.php['"]\s*style=[^\?]+hidden;\s*(?:(?:width|height):\s*\dpx;\s*){2}[^\}]{0,55}\}\s*(?:\Z|\?>)(?<X1129510>)|strpos\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]{1,30}\{\s*header\(['"]HTTP/\d\.\d\s*301[^\}]{9,99}\}\s*if\s*\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*@?eval\(base64_decode\(\34\)\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1132911>))|include(?:\(['"][^'"]{9,50}['"]\);\s*(\$\w{1,9})\h*=\h*wp_remote_get\(['"]https?://[^'"]{9,50}['"]\);\s*if\h*\(\h*file_put_contents\(\h*['"][^'"]{9,50}\.php['"],\s*(base64_decode)\([^\)]+\)\.\37\(\36\[[^\]]+\]\)\)\)\s*echo\h*[^;]{9,50};\s*unlink\(__FILE__\);\s*(?:exit|die)[^;]{0,9};\s*\?>(?<X1144940>)|\h*['"][^'"]{0,49}\.php['"]\h*;\s*\$\w{1,15}\h*=\h*['"][^'"]{0,25}\bvictim\h*on\h*sms[^'"]{0,25}['"];(?<X2183430>))|ini_set\(['"]allow_url_include['"]?\s*,\s*['"]?1['"]\);[^;\$"':\*\{\}\?]{1,199}include\(['"]php://input['"]\);[^;\$"':\*\{\}\?]{1,199}(?:\?>|\Z)(?<X1124981>)|require\s*['"]call\.php['"];\s*\$user\s*=\s*\$_POST\[['"]user['"]\];\s*\$pass(?:word)?\s*=\s*\$_POST\[['"]pass(?:word)?['"]\];(?<X2046992>)|session_start\(\);(?:[^\?]{1,99}\bgetenv\([^\)]+\);[^\}\{]{0,99}(\$\w{1,15})\h*=\h*['"][^;]{1,99}\b(?:card|sms|cvv|cvc):\h*['"]\.\h*\$_SESSION\[[^\]]+\]\h*\.['"][^\?]{9,499}\b\w{1,15}\(\42,\h*\$\w{1,15}\);\s*header\(['"]Location:[^\)]{1,50}\);\s*(?:\?>|\Z)(?<X2192540>)|\s*class\s*BrowserDetection\s*\{[^%]{999,9999}\$(subj?(?:ect)?)\h*=\h*['"][^'"]{0,99}([^\s\w])\s*Normal\s*\dd\s*\45[^;]{1,49};[^!\}]{499,2999}\bmail\([^\)]+\$\44\b[^;]{1,99};\s*header\(['"]Location:(?<X2160130>)|\s*error_reporting\(0\);[^\.]{1,80}(?:include(?:_once)?\s*['"][^'"]{1,40}\.php['"];\s*){1,9}(\$\w{1,40})\s*=\s*fopen\s*\(\s*['"][^'"]+\.txt['"]\s*,\s*['"]a\+?['"]\s*\)\s*;\s*fwrite\s*\(\s*\47\s*,[^;]+\);\s*header\(\s*['"]LOCATION:[^\)]+\);?(?:\s*\?>)?\s*\Z(?<X2060511>))|set_time_limit\(0\);(?:[^\{]{9,400}(\$\w{1,15})=['"\.eval]{9,15};(\$\w{1,15})=['"\.gzinflate]{9,25};[^\n]{99,2200}(\$\w{1,15})\h*=\h*\$\w{1,15}\([^,]{1,9},\49\.['"\(]{1,9}\.\50[^\?]{9,60}\);\51\(['"][^'"]{9999,}['"]\);\?>(?<X2152801>)|\s*if\((isset\()(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\53(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\{\s*if\((\w{1,15})\(\54,\h*\55[^\?]{9,150}\bfunction\s*\56\((\$url,\h*\$file)=[^#]{9,299}\bcurl_init\(\);[^\?]{9,600}\bif\(@?copy\(\57[^\?]{9,120}\bfalse;[\s\}]+\?>(?<X1153171>))|system(?:\(['"](?:echo\s+\w{1,40}\s*>\s*index\.html['"]\);\s*(?:system\(['"]c[pd][^'"]{1,99}['"]\);\s*){2,}echo\s*['"][^'"]*['"]\s*;(?:\s*\?>)?\s*\Z(?<X2125580>)|id['"]\);\s*[^\{\}]{1,400}function\s+selfpatch\(\)\s*\{\s* \$maps\s*=\s*read_proc_maps\(\);(?<X2126210>)|rm\h*(?:\.htaccess|php\.ini)['"]\);\s*\?>\Z(?<X1146341>))|\s*\(\s*['"]wget\s+https?://\S{1,40}/\w{1,9}\.txt\s+-O\s+\w{1,40}\.php;?\s*['"]\s*\);\s*(?:\?>|\Z)(?<X1132161>))|use\s+PHPMailer\\[^\$]{99,499}\bfunction\s*generateRandomString\([^@]{999,9999}<title>XasTr[oO]\s*Mailer</title>(?<X2156011>))
\A\s*<\?php\s+(?:(?:(?:(?:else)?(?:if)?)\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*){1,2}if\s*\(isset\s*\(\1\)\s*\)\s*\{\s*@?eval\s*(?:\(\s*str_rot13|\(\s*base64_decode|\(\s*gzinflate){1,3}\s*\(\s*\1\s*\)\s*\)\s*\);\s*die\(\s*\);\s*\}\s*(?:\Z|\?>)(?<X1042381>)|(?:(?:error_reporting|ini_set|set_time_limit)\([^\)]+\);\s*){4,9}if\(isset\(((\$_SERVER\[)[^\]]+\])[\)\h]+\4['"]REMOTE_ADDR['"]\]\h*=\h*\3;\s*if\(isset\([^\{]+\{@?eval\(base64_decode\([^/]{9,150}\bfile_get_contents\(['"]php://input['"]\);[^\?]{99,400}\}(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1142660>)|(?:(?:print|echo)\s*[^;]{1,99}?\s*;)?\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057940>)|(?:/\*[^<]+\*/\s*)?echo\s+['"]<html><title>\s*Importer\s+T[0O]{2}lz\s+v\.\d(?<X2060171>)|(?:/\*[^\*]{0,39}\*/)?\s*@?eval\s*\(\s*base64_decode\s*\(\s*['"]IGlmKGZ1bmN0aW9uX2V4aXN0cygnb2Jfc3RhcnQ[^'"]{2500,2700}['"]\s*\)\s*\)\s*;\s*\?>(?<X1056810>)|(?:@?(?:eval|assert|system|(?:shell_|pcntl_)?exec|passthru|popen)\s*\(['"](?:w|\\x77)(?:g|\\x67)(?:e|\\x65)(?:t|\\x74)(?:\s|\\x20)[^\)]+\);){8,14}(?:exit|die)[^;]{0,9};\s*\?>\s*\Z(?<X1062341>)|(?:@?(?:set_time_limit|error_reporting)\((?:0|NULL|FALSE)\);\s*){1,2}if\h*\(\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[^\)]+\)\s*\{\s*@?eval\h*\(base64_decode\h*\(\10[\h\)]+;\s*\}[^\}]{1,150};\s*\}\s*(?:\?>|\Z)(?<X1137840>)|(?:@\$\w{1,20}\s*=\s*\$_POST\[[^\]]+\];\s*|@\$\w{1,20}\s*=\s*\$_FILES\[[^\]]+\]\[[^\]]+\];\s*){5,15}\?>[^\$]{9,150}<title>\s*PHP\s+Mailer\b(?<X2126620>)|(?:@\w{1,40}\([^\)]{1,40}\);\s*){2,9}if\s*\(?\s*isset\s*\(\s*\$_(?:G|P|C|S|R)[^\{]{1,600}\{\s*@?eval\s*\(\s*base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*['"][^'"]*['"]\s*\]\s*\)\s*\)\s*;\s*\}\s*exit\(?\)?;\s*(?:\?>|\Z)(?<X1058471>)|(?:[ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"](?:blocker|bots|antibots|banned)\.php['"];\s*){3,5}function\h+getloginIDfromlogin\([^\)]+\)\s*\{\s*[^\?]{99,999}(\$\w{1,20})\h*=\h*ucfirst\(\14\);\s*\?>(?<X1141950>)|(?:\$(?:user|username|uname|login|email|password|pass|psw|pwd|passwd)\s*=\s*\$_[GPRSC]\w{2,6}\[['"](?:user|username|uname|login|email|password|pass|psw|pwd|passwd)['"]\];\s*){2}[^,]{99,800}<form\s+method\s*=\s*['"]post['"]\s+action\s*=\s*['"]\w{1,20}\.php['"](?<X2123612>)|(?:\$\w{1,20}\s*=\s*'(?!print)[^']{1,99}'\s*;\s*){6}[^%]{200,6000}(?:\$\w{1,20}\[\s*['"]?\d+['"]?\s*\]\s*\.?\s*){5,}\);(?<X1036545>)|(?:\$\w{1,20}\s*=\s*['"][^'"]+['"];\s*){1,4}\$\w{1,20}\s*=\s*isset\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{]{9,99}preg_match\(['"]/(?:googlebot|bingbot|slurp|Baiduspider)\|[^\?]{99,300}base64_decode\(['"]aHR0cD[^\)]{9,150}\)[^\?]{9,99}header\s*\(['"]Location:[^\)]+\);\s*(?:\?>|\Z)(?<X1136940>)|(?:\$\w{1,20}\s*=\s*\$_(?:P|G|S|R|C)\w{2,6}\[[^\]]+\];\s*){1,5}if\s*\(\s*isset\s*\(\$_[^\.]{99,500}(\$\w{1,20})\s*=\s*generateRandomString\(mt_rand\([^\)]+\)\)\s*\.\s*['"]\.php['"];[^>]{99,350}file_put_contents\(\19\s*,\s*\$\w{1,20}\);[^\]]{9,99}\s*unlink\(\19\);\s*(?:\Z|\?>)(?<X1118441>)|(?:\$\w{1,3}\h*=\h*['"][^\*]{10,200}['"];\s*){4,9}(\$\w{1,4})\h*=\h*(str_replace)\(['"][^'"]+['"]\h*,\h*['"]['"],['"][^'"]{15,30}['"]\);\s*(\$\w{1,4})\h*=\h*\22\(['"][^'"]+['"]\h*,\h*['"]['"]\h*,\h*(?:\$\w{1,4}\.)+\$\w{1,4}\);\s*(\$\w{1,3})\h*=\h*\21\(['"]['"],\23\);\24\(\);\s*(?:\?>|\Z)(?<X1161730>)|(?:\$\w{1,40}\s*=\s*(?:__FILE__|dirname\(\$\w{1,40}\))\s*;\s*){1,3}\s*do\s*\{\s*if\s*\(\s*file_exists\s*\(\s*[^'"]{1,40}[wp\-config\.h'/\s]{15,40}\)\s*\)\s*\{(?<X2059580>)|(?:\$\w{1,40}\s*=\s*['"]?\w{1,40}['"]?\s*;\s*){1,9}@?error_reporting\((?:0|false)\);[^\{]{1,99}function\s+\w{1,40}\(\s*\$\w{1,40}\s*\)\s*\{[^\?]{55000,65000}\)\)\);['"];\s*(\$\w{1,40})\s*=\s*Create_Function\s*\(\s*['"]['"]\s*,\s*\$\w{1,40}\s*\)\s*;\s*\27\s*\(\s*\)\s*;\s*(?:\?>|\Z)(?<X1060351>)|(?:\$\w{1,40}\s*=\s*['"][^'"]{1,150}['"];)?\s*if\s*\(\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[base64_decode\(['"][^'"]{1,40}['"]\)\]\s*[^\w]{1,2}=[^`]{200,600}\s*\{\s*@?eval\s*\(\s*\$_POST\[['"][^'"]{1,40}['"]\]\s*\);\s*\}\s*(?:\?>|\Z)(?<X1055890>)|(?:\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*;\s*){2}\?>[^!\{\}%\+]{1,600}<title>\s*(?:American\s+Express|Wells\s+Fargo|Bank\s+of\s+America)(?<X2122320>)|(?:\$\{['"](?:\\x47|G)[^'"]{6,24}['"]\}\[[^\]]+\]=['"][^'"]{1,99}['"];){3}[^\?]{1,999}\bfSockOpen\(\$\{\$\{['"](?:\\x47|G)[^'"]{6,24}['"]\}\[[^\]]+\]\},(?:80|443),[^\?]{1,999}require_once\s*['"][^"']+['"];\}else\{echo\s*['"][^\?]{1,999}[^\\]['"];\s*(?:die|exit)[^;]{0,9};\s*\}?\s*(?:\?>|\Z)(?<X1122530>)|(?:\$\{['"](?:G|\\x47)[^'"]{4,24}['"]\}\[[^\]]+\]=[^;]{1,40};){2}[^\)]{99,999}\);function\s+\w{1,40}\([^\)]+\)\{[^\?]{9,999}return\s*isset\s*\(\s*@?\$_(?:P|G|S|C|R)\w{2,6}\s*\[[^\]]+\]\s*\)\s*\?[^\?]{9,999}@eval\(\$\{\$\{['"](?:G|\\x47)[^;]{1,99};(?:die|exit)[^;]{0,9};\}+\s*(?:\?>|\Z)(?<X1122401>)|(?:\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*=\s*['"][^'"]+['"];\s*){2,9}[^@]{99,1500}if\h*\(@?file_put_contents\h*\(\$\{[^\?]{9,99}\{\s*@?include\$\{\$\{[^\{]{9,99}\}\s*@?unlink\(\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\s*\}\s*\);\s*\?>(?<X1137661>)|(?:echo\h+['"]<pre>[""];)?\s*(\$xmlrpc)\h*=\h*['"]pZJa[^'"]{99,999}['"];\s*@?(?:echo|eval)\h*\(?(?:(?:str_rot13|gzinflate|base64_decode)\h*\(){3,6}\(\34(?:\)\h*)+;\s*(?:\Z|\?>)(?<X1157450>)|(?:echo|print)\s*\(?\s*['"][\!\s\-\w'"\^]{1,40}['"]\s*\)?\s*;\s*\?>(?:\s*<\?php\s+(?:system|chmod)\s*\(\s*(?:['"]?(?:chmod|\w{1,40}\.php|\d{3,4})\s*['"]?\s*,?){2,3}\s*\)\s*;\s*\?>){2}(?<X1059490>)|(?:echo|print)\s+['"]Priv(?:8|ate)\s+Up[l1][0O][a4]d[3e]r.?['"];(?<X2065380>)|(?:Error_Reporting\(0\);)?\s*\$\w{1,40}=['"][^'"]{7000,8000}['"];\s*preg_replace\(['"]/\.\*/e['"],['"][^"']{1,120}['"][^'"]{1100,1600}['"][^'"]{1,40}['"],['"]\.['"]\);\s*return;\s*\?>\s*\Z(?<X1042000>)|(?:function\s+\w{1,20}\((\$\w{1,20})\)\s*\{\s*return\s+@?(?:base64_decode|gzinflate|eval)\s*\(\39(?:,\d)?\);\s*\}\s*){1,3}\$\w{1,20}\s*=\s*['"][^'"]{99,500}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\40e\w?.?['"]\s*,\s*['"][^\)]+\);\s*(?:\Z|\?>)(?<X1119640>)|(?:function\s+\w{1,20}\(\$[^\)]+\)\s*\{[^\}]+\}\s*){0,2}function\s+(\w{1,20})\s*\(\$\w{1,9}\s*=\s*[^\)]+\)\s*\{\s*\$\w{1,20}\s*=\s*(?:isset\()?\$_GET\[[^\]]+\][^}]{9,}\$\w{1,20}\s*=\s*@?(?:curl_exec|file_get_contents)\([^\)]+\);[^}]{1,99};\s*echo\s+[^;]{1,20};\s*\}\s*\42\(\);\s*\?>(?<X1062751>)|(\$[li1]{1,15})\s*=\s*urldecode\(['"][^'"]{9,150}['"]\);\s*(\$\w{1,15})=(?:\44\{\d{1,2}\}\.){3}[^\(]{99,350}eval\(\45\(['"][^'"]{999,30000}['"]\)\);\s*(?:\Z|\?>)(?<X1128168>)|(\$\w{1,16})\s*=\s*['"][^'"]{20,99}['"];\s*(\$\w{1,16})\s*=(?:\s*\47\s*\[\d+\]\s*\.\h*){3}[^'"]{999,9999}(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\([^;\+]{0,99}\48[^;\)]{999,9999}['"][\)\h]+;\h*@?\49\(\);\s*(?:\?>|\Z)(?<X1064471>)|(\$\w{1,20})=[eval\.'"]{5,15}\(([^\)]+)\);\s*['"];\s*(\$\w{1,20})=create_function\(['"]\52['"]\h*,\h*\51\);\s*(\$\w{1,20})=[base64_dco'"\.]{14,35};\s*(\$\w{1,20})\h*=\h*['"\.gzinflate]{10,25};\s*\53\(\55\(\54\(\54\(['"][^'"]{999,9000}["'](?:\)\s*)+;[^\(;]{0,40}\b(?:unlink\(__FILE__\);\s*){1,2}(?<X1168360>))
\A\s*<\?php\s+(?:(\$\w{1,20})\h*=\h*(?:(?:['"]{2}\.|chr\(\d+\)\.|['"]\w[""]\.){20}[^;]{99,999};\$\w{1,20}\h*=\h*\1\([^\?\\%&\*]{999,6000}\)\h*,\h*\$\w{1,20}\h*,\h*(\$\w{1,20})\(\2\(\$\w{1,20}\)\)\)\h*,\h*['"]\\\d['"]\)\);\s*\$\w{1,20}\(\);\s*(?:exit|die)[^;]{0,9};\s*(?:\?|\Z)(?<X1165101>)|(image)createfrompng\h*\(['"]\w{1,20}\.png['"]\);\s*header\h*\([^\)]+\);\s*\4png\h*\(\1\);\s*\4destroy\(\1\);\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{[^\.]{9,99}\.txt['"]\);(?<X2141370>)|@\$_COOKIE\[[^\]]+\];\s*if\h*\(\1\W{2,4}['"][^'"]+['"]\)\s*\{\s*@?header\h*\(['"]HTTP/1\.\d\h+404\h*Not\h*Found['"]\);\s*die\h*\(['"]<(html>)<meta\h+http\-equiv\h*=\h*['"]refresh['"]\h+content\h*=['"]0;\s*url\h*=\h*https?://[^>]+>\s*</\6['"]\);\s*\}\s*\?>\Z(?<X2169770>)|["'][^\.]{2,20}\.txt['"];\s*for\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(\$\w{1,20})\h*=\h*\8\h*\.\h*['"]\.php['"];\s*if\h*\(!?copy\h*\(\1\h*,\h*\9\)\)\s*\{[^\}]{9,99}(?:\}\s*)+\s*(?:\?>|\Z)(?<X1184930>)|['"]([^'"]+)['"];\s*if\h*\(is_writable\h*\(\1\)\)\s*\{[^\\]+\}\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\((?:['"]\11['"]|\1)\);\s*\12\h*=\h*str_replace\h*\(['"]<\?php['"]\h*,\h*['"]['"],\12\);[^\(]{0,20}\bunlink\h*\([^\)]+\);\s*(?:\Z|\?>)(?<X1180511>)|\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if\h*\(strlen\(\1\)!=32\)\s*\1\h*=\h*md5\(\1\);\s*if\h*\(\1\W{2,4}['"][a-z0-9]{32}['"]\)\s*\{\s*\$\w{1,20}\h*=\h*['"]eng['"];\s*(\$\w{1,20})\h*=\h*base64_decode\h*\(['"]ZXJy[^'"]{15000,}['"]\);\s*@?eval\h*\(['"]?\14['"]?\);\s*\}\s*(?:\?>|\Z)(?<X1167510>)|base64_decode;\s*(\$\w{1,20})\h*=\h*\1\h*\([^\)]{3,20}\);\s*\16\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(?:\?>)?\Z(?<X1185641>)|strrev\s*\(['"][stro13_\.'"]{12,25}['"]\);\s*(\$\w{1,20})\h*=\h*\$\{\1\h*\([^\)]+\)\h*\};\s*\(count\h*\(\18[^a-z]{1,9}\bin_array\h*\(gettype\h*\(\18\)\.[^<\v]{9,150}\)\h*\&+\18\(\)\):\18;\s*(?:\Z|\?>)(?<X1145331>)|substr\h*\(md5\h*\([^,]+,\h*rand\h*\([^;]+\);\s*(\$\w{1,20})\h*=\h*file_get_contents\h*\(['"]\w{1,20}\.txt['"]\h*,\h*true\);\s*header\h*\(['"]Location\h*:\h*['"]\.['"]https?://['"]\.['"]\20['"]\.['"]\1['"]\);\s*(?:exit|die)\h*\(\);\s*(?:\?>|\Z)(?<X1184940>))|(\$\w{1,20})\s*=\s*['"](?:[^'"]{99,200}['"];\s*\$\w{1,20}\s*=\s*array\([^\)]+\);\s*\$payload\s*=\s*['"][^'"]{9000,40000}['"];\s*(\$\w{1,20})\s*=\s*["'][^'"]*['"];[^\}]{9,50}\23\.=\s*\22\[[^\]]+\]\s*;\s*\}\s*\23\(['"](?:\\x[a-fA-F0-9]{1,2}){9}[^\)'"]{9,999}['"]\);\s*(?:\Z|\?>)(?<X1123361>)|chr['"];\s*\$\w{1,20}\s*\.=\s*\22\(36\)\.\22\(95\)\.(?:\22\(82\)\.|\22\(71\)\.|\22\(80\)\.|\22\(83\)\.|\22\(67\)\.)[\d\(\)\.\$a-z]{15,45};(?<X2124830>))|(\$\w{1,20})\s*=\s*(?:file(?:\s*\([^\)]+\);[^\$]{0,99}(\$\w{1,20})\s*=\s*count\s*\(\26\);[^\$]{0,99}(\$\w{1,20})\s*=\s*rand\s*\(\d+,\27[^\)]{0,9}\);[^\$]{0,99}(\$\w{1,20})\s*=\s*trim\s*\(\26\[\28\]\);[^\$]{0,99}\?>\s*<html>[^=]+<meta[^\d]+=['"]refresh['"][^>]+<\?php\s+echo\s+\29;\s+\?>\s*['"]>(?<X1061751>)|_get_contents\s*\(['"]https?://[^'"]+\.(?:css|jpg|png|jpeg|ico)['"]\);\s*@?eval\s*\(\s*gzuncompress\s*\(\s*base64_decode\s*\(\26\)\s*\)\s*\);\s*(?:\?>|\Z)(?<X1061281>))|gz(?:inflate|uncompress)\s*\(base64_decode\s*\(['"][^'"]{60000,}['"]\)\s*\);\s*(\$\w{1,20})\s*=\s*create_function\(['"][^'"]*['"]\s*,\s*\26\);\s*\32\(\);\s*(?:\Z|\?>)(?<X1121070>)|str_replace\s*\(['"][^'"]*['"],\s*[^,]+,\s*['"][^'"]+['"]\);\s*\26\s*\(\s*.?['"](.)(.{0,40})\34e\w?.?['"]\s*,\s*\$_(?:GET|POST|REQUEST|SERVER|COOKIE)\[[^\]]+\],\s*['"]\35['"]\);\s*\?>(?<X1062860>)|substr\s*\([^\)]+\);\s*foreach\s*\(\s*array\s*\([^\)]+\)[^\?]{99,700}@?eval\s*\(urldecode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(\$\w{1,20})\[[^\)]+\)\s*\);\s*\}\s*\}\s*(?:(?:exit|die)[^;]{0,9};\s*)?\}\s*unset\s*\(\26\);\s*unset\s*\(\37\);\s*(?:\Z|\?>)(?<X1063190>))|(\$\w{1,40})\s*=\s*(?:@\$_FILES\[[^\]]{1,40}\];\s*if\s*\(\s*\39\[[^\]]{1,40}\]\s*[^\w]{2,3}\s*['"]['"]\s*\)\s*\{[^\}\(]{1,99}if\s*\(\s*move_uploaded_file\s*\(\s*\39\[[^\}]+\}\s*\}?[^\(\?]{1,200}exit[^;]{0,9};\s*(?:\?>|\Z)(?<X1061250>)|['"].{100,200};\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\s*=\s*\39.{6000,8000}\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\(\39,\s*\$GLOBALS\[['"][^'"]{1,40}['"]\]\(\39,\s*\$\w{1,40}\[\$\w{1,40}\]\)\);\s*\?>(?<X2053511>)|['"][\w\.\-]{1,40}\.(?:jpg|gif|ico)['"]\s*;\s*(\$\w{1,40})\s*=\s*curl_init\(['"]https?://[^'"]{1,99}\.php['"]\s*\)\s*;[^>]{1,600}>['"]@?\39['"][^=]{1,99}\$\w{1,40}\s*=\s*curl_exec\(\42\);[^\?]{1,99}(?:\?>|\Z)(?<X1059270>)|['"][^`]{25000,35000}(\$\w{1,40})\s*=\s*["'\.strev\s]{10,40};\s*@?eval[^\(]{0,9}\(\s*\44\s*\(\s*@?preg_replace\s*\(\s*[^,]{1,40}\s*,\s*['"]['"]\s*,\s*\39\s*\)\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057120>)|['"]\\[xa-f\d\\]{9,99}[^'"]{1,60}['"];\s*@?error_reporting\(0\);\s*\39\(['"][^'"]*['"],\s*['"]\\[xa-f\d\\]{9,99}[^'"\)]{6000,16000}\\[xa-f\d\\]{9,99}['"]\);\s*\?>(?<X1063593>)|base64_encode\(['"][^\%]{99,600}(\$\w{1,40})\s*=\s*urldecode\(['"]%[^\)]{1,99}\);(\$[^=;\s]{1,40})\s*=\s*(?:(?:\39|\47)\[\d+\]\.){2}[^;]{0,999};[^_]{99,600}\$\w{1,40}\s*=\s*__FILE__;\s*@?eval\(\s*\48\s*\(['"][^'"]{99,3000}['"]\)\s*\)\s*;\s*return[^;]{0,9};\s*\?>(?<X1063711>)|str_replace\s*\(\s*['"](\w{1,9})['"]\s*,\s*['"][^'"]*['"]\s*,\s*['"](?:\50|[asertvl])+['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*@?\39\s*\(\s*\51\[[^\]]{1,40}\]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059510>))|(\$\w{1,9})\h*=\h*strrev\(['"\.stro13_]{10,20}\);\s*(\$\w{1,9})\h*=\h*\53\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\53\([^:\?<%]{99,200}(\$\w{1,9})\h*=\h*\55\(['"]{2},\54\([^\)]+\)\)\)\?\56\(\):['"]{2};\s*(?:\?>|\Z)(?<X1153550>)|(\$\w{1,9})\s*=\s*(?:['"]\w{32}['"];[^\$]{0,20}(\$\w{1,9})\s*=\s*['"]\w{32}['"];[^\$]{0,20}if\s*\(\s*md5\s*\(\s*\$_GET\[[^\]]+\]\s*\)\s*[^\w]{2,3}\s*(?:\58|\59)\s*&&\s*md5\s*\(\s*\$_GET\[[^\]]+\]\s*\)\s*[^\w]{2,3}\s*(?:\58|\59)\s*\)\s*\{\s*@?eval\s*\(\s*\$_[^\)]+\)\s*;?\s*\}?\s*(?:\?>|\Z)(?<X1059301>)|substr\([^\)]+\);\s*foreach\(array\([^\)]+\)\sas\s([^\)]+)\)\s*\{\s*\58\.\s*=\s*chr\(\61\);\s*\}[^/]{99,800}(?:@(?:unlink|rename)\([^\)]{9,200}\);\s*){1,4}(\$\w{1,9})\s*=\s*['"]https?://[^@]{9,99}@header\(['"]Location:\s*\62['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*\?>(?<X1121270>))|(\$\w{10,80})\s*=\s*[^;]{1,20};[^\t]{999,3000}\)\^\64\);\s*@?eval\s*\(['"]\?>['"]\s*\.\s*\$\w{10,80}\s*\.\s*['"]<\?\s*['"]\);\s*(?:\?>|\Z)(?<X2124932>)|(\$\w{20,60})=(\w{20,60})\([^\)]+\);\s*(\$\w{20,60})=\67\([^\)]+\);\s*(\$\w{20,60})=\67\([^\)]+\);\s*(\$\w{20,60})=new\s+\66\(\67\([^\)]+\)+;\s*error_reporting\(0\);\s*@?eval\(\68\(\70->\69\([^\)]{30000,}\)+;\s*Class\s+\w{1,20}[^#@\\]{4000,15000}return\s+\$\w{1,60};\s*\}\s*(?:\?>|\Z)(?<X1120121>)|(\$\{['"]GLOBALS['"]\}\[[^\]]+\])=[^\(]{9,99}\bArray\((?:['"](?:str_rot13|pack|strrev)['"],?){2,3}\);\s*function[^%&\?]{99,300}return\h+isset\(\$_[GPRSC]\w{2,6}\[[\$\{]+['"][^%&@\*]{99,999}\bif\(isset\(\$\{\72\}\)\)\s*\{\s*eval\(\$\{\72\}\);\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\?>|\Z)(?<X1151340>)|(\$GLOBALS\[)['"](?:pass|password|psw|pwd)['"]\]\s*=\s*['"][^'"]*['"];\s*\74[^\]]+\]\s*=\s*array\s*\((?:['"](?:explorer|terminal|eval)['"]\s*,?\s*){3}\);[^;]+;\s*\74['"]title['"]\]\s*=\s*['"]nu[l1]{2}[5s]['"];\s*@?ob_start\(\);\s*@?set_time_limit\((?:0|NULL)\);(?<X2065430>)|(\$GLOBALS\[['"][^'"]{1,40}['"]\])=Array\(base64_decode\([^`]{20000,25000}false;\}if\(!empty\((\$\w{1,40})\)\)\{if\(\76\[\d+\]\(\$\w{1,40},\77\)\)\{(\$\w{1,40})=false;\}\}return\s+\78;\}\s*(?:\?>|\Z)(?<X1056610>)|(file_)put(_contents)\h*\(['"][\./]+wp\-[^'"]{2,30}['"]\h*,\h*\80get\81\h*\(['"]https?://[^/]{2,30}/\w{1,20}\.php['"]\)\);\s*(?:exit|die)[^;]{0,15};\s*\?>(?<X1172840>)|(goto)\h+\w{1,20};\s*\w{1,20}:\s*if\h*\(\h*!?isset\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\)\)\s*\{\s*[^\}]{0,20}\}[^\('"]{0,50}\b(?:create_function|eval\h*\(base64_decode)\((?:null\h*,\h*)?\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s;]+[^\?>]{0,30}\83\h+(\w{1,9});\s*\84:\h+\w{1,9}:\s*(?:\Z|\?>)(?<X1169460>)|(goto)\h+\w{1,9};\h*\w{1,9}:\s*(\$\w{1,20})\h*=[^/\?%]{99,400}\b\86\h+(\w{1,9});\h*\88:\h*register_shutdown_function\h*\(\87\h*\(['"]{2}\h*,\h*\$\w{1,20}\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\](?:\)\s*){3};\s*(?:\?>|\Z)(?<X1157810>))
\A\s*<\?php\s+(?:(goto)\s+(\w{1,20});[^//]{1,900}\2:\s*error_reporting\((?:0|NULL)\);\s*\1\s+\w{1,20};[^\('"\$]{9,99}\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\((?<X2121133>)|(goto)\s+(\w{2,20});[^/]{1,1999}\5:\s*\$GLOBALS\[[^\]]+\][^\)]{1,399}\);[^\?]{1,999}\4\s+\w{2,20};\s*\w{2,20}:[^;]{0,99};?(?:\s*\?>)?\s*\Z(?<X2120683>)|(goto)\s+\w+;\s*\w+:[^=]{99,199}\$\w+\s*=\s*create_function\s*\([^;]+;\s*\7\s+\w+;[^=]{49,99}\$\w+\s*=\s*str_rot13\s*\(\s*@?pack\s*\([^,]+,\s*strrev\s*\([^;]+;\s*goto\s+\w+;\s*\w+:[^\n]{499,999}goto\s+\w+;\s*\w+:\s*echo\s*[^;]{1,99};\s*(?:\Z|\?>)(?<X1132241>)|(gzinflate)=['"]\9['"];\s*(base64_decode)=['"]\10['"];\s*eval\(\9\(\10\(['"][^'"]{99,400}['"]\)\)\);\s*(?:\?>|\Z)(?<X1174950>)|(header)\s*\(['"]HTTP/1\.1\s+302\s+Found['"]\);\s*\12\s*\(['"]Location:\s*https?://[^\?]{9,20}/\?\w=1nxr&[^'"]{1,15}['"]\);\s*\?>(?<X1130831>)|//\h+\w{2,20}[^\.]{0,20}\bCracker[^@]{0,9}\bcode\-security\.com\b(?<X2163281>)|/[/\*]\s*(?:<!--\s*)?SCAM\s+PAGE\s+(?:PPL|PayPal)\b(?<X2134730>)|/[\*\s]+\h*Plugin\h*name:\h*(\w{1,20})\s*\*/\s*(function)\h+(\w{1,20})\(\)[\s\{]+if[\h\(]+isset[\h\(]+\$_[GPRSC]\w{2,6}\[["']\16['"]\]\)\)[\{\s]+[^,]{9,99}\b(add_action)\([^\)]+['"]\18['"]\);\s*\17\h+\w{1,20}\([^:@&]{99,600}\}\s*\17\h+(\w{1,20})\(\)[\{\s]+[^<\?]{700,2000}\bexit\(\);[\}\s]+\19\([^\)]+['"]\20['"]\);\s*(?:\Z|\?>)?\Z(?<X1209720>)|/\*[\*\s]+Scam(?:page)?\h+by\h+\S{3,40}\s(?<X2151651>)|/\*[\*]*\*/\s*@?eval\(base64_decode\(['"][^'"]{1,9}ZnVuY3Rpb25fZXhpc3Rz[^'"]{1,500}KCRHTE9CQUxTWy[^'"]{1,999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058730>)|/\*[^/]{1,20}404\s+error\s+Web\s+Shell\s+(?:Recoded\s+)?by\s+XG[3e]n[o0][5s][^/]{1,4}\*/\s+\$auth_pass\b(?<X2124790>)|/\*[^\(\$;\{]{2,}\b(?:Facebook:\h*facebook\.com/(Ex\.Robotos)\s*|ICQ:\h*@\25)(?<X2165650>)|/\*[^\(]{9,99}\(\s*ORVX\h+Shell\b[^\(]{99,200}\beval\(base64_decode\((?<X2153600>)|/\*[^\*]{1,99}\*/\s+\?>\s*<\?php\s*\$\w{1,40}\s*=[^\?]{1,99}function\s+(\w{1,40})\s*\([^\?]{200,999}(\$\w{1,40})\s*=\s*\28\(\s*['"]\s*['"][\.\,][^\?]{21000,26000},\29\)[^\)]{0,9}\)\s*;\s*(?:\?>|\Z)(?<X1056801>)|/\*[^\*]{1,99}\bMr\s*Trovaz\b[^\?]{1,499}\?id=100010413816341\b(?<X1132830>)|/\*[^a-z0-9\$\*@]{99,500}(?:\\\h*)+By\h*Xbalti\h*/[^a-z0-9\$]{99,300}\bsession_start\(\);(?<X2138951>)|/\*\*?\s*(?:0|zero)\h*b\h*y\h*[t7]\h*[3e]\h*(?:m\h*[i1]\h*n\h*[i1]|s\h*h\h*[3e]\h*l)\b(?<X2155930>)|/\*\*[^<@/]{9,99}@author\h+(shutdown57)\h*<\h*indonesianpeople\.\34@\w{1,20}\.com\b(?<X2162410>)|/\*\*[^\$_\[]{2,40}@\h+author\h*:\h*shutdown57\b(?<X2170460>)|/\*\*[^\{\$;]{0,99}\bclass\h+RemoteAdmin\s*\{\s*[^/:]{1,40}\bconst\h+PCLZIP_URL\h*=\h*['"]https?://(?:www\.)?pastebin\.com/(?<X2155471>)|/\*\*\s*\*(?:\h*Front\h+to\h+the\h+wordpress\h+application\.[^\{\}]{99,500}\bclass\h+wordpress_migrations?\s*\{[^\};\[\]]{9,200}\bif\((?:sha|md)\d\([^=]{2,20}\W{2,4}['"]\w{32,60}['"]\)(?<X2183280>)|\s*Plugin\s+Name:\s+CMSmap\s+\-\s+WordPress\s+Shell(?<X2059960>))|/\*\s*WHM(?:CS?)?\s+(?:KILL|BRUT|CRACK)(?<X2059870>)|<script\s*src\s*=\s*https?:\s*//r00t\.info/(?<X2125320>)|@(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\([^\)]{9,999}\)\s*;?\s*(?:\?>)?\s*\Z(?<X2061551>)|@?(?:(?:set_time_limit|error_reporting)\s*\((?:0|NULL)\);\s*){1,2}(\$\w{1,20})\s*=\s*['"][^'"]{99,999}['"];\s*@?eval\s*\(\s*(?:(?:gz(?:inflate|uncompress)|str_rot13|base64_decode)\s*\(){3}\43(?:\)){4}\s*;\s*(?:\?>|\Z)(?<X1126860>)|@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:['"]cd\s+/tmp;[^;]{1,20};\s*(?:curl|wget)\s+https?://[^;]{9,20}/(\w{1,20});\s*perl\s+\45;\s*rm\s+-r?f\s+\45\*;\s*mkdir[^'"]{1,20}['"]\);?\s*(?:\Z|\?>)(?<X1062181>)|\s*base64_decode\s*\(\s*['"](?:QGV2YWwoJF9QT1NUW|ZXZhbCgkX1BPU1R)[^'"]{1,99}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1057950>))|@?(?:session_start\(\);\s*|error_reporting\s*\((?:0|NULL)\);\s*){2}if\(strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\{]{1,30}\)\s*\{\s*header\s*\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);[^\$]{9,150}(\$\w{1,9})\s*=\s*['"][^;]+;\s*header\s*\(['"]Location:\s*\48['"]\);\s*(?:\?>|\Z)(?<X1064232>)|@?(?:system|eval|assert|popen|shell_exec|exec)\(['"]cmd\.exe\s+/c\s+(?:START\s+)?\S{0,90}\\?powershell\.exe[^'"]{300,1500}['"]\);\s*(?:\?>|\Z)(?<X1122391>)|@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\(['"]whoami['"]\);\s*(?:\?>)?(?:\s*[^\?]{0,40}\s*<\?php\s+phpinfo\s*\(\);\s*\?>)?\s*\Z(?<X1058012>)|@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\s*\(\s*base64_decode\s*\(['"](?:aWYgKCRfR0VUWy|aWYgKCRfUE9TVF)[^'"]{99,3000}['"]\)\s*\)\s*(?:\?>|\Z)(?<X1058050>)|@?(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name["']\];\s*@?(\$\w{1,20})\h*=\h*basename\(\54\[[^\]]+\]\);\s*if\h*\(\h*!?empty\h*\(\55[\)\{\s]+echo\h+['"]<form[^\?\*]{99,400}\b(?:copy|move_uploaded_file)\(\53,\55\)[^\?\*%]{9,99}[\}\s]+(?:\Z|\?>)(?<X1149870>)|@?create_function\s*\(\s*['"]['"]\s*,\s*base64_decode\s*\([^\)]+\)\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059602>)|@?error_reporting(?:\((?:(?:0|FALSE|NULL)\);[^\$\{;]{9,200}\bCon7ext\-Security\.com\b(?<X2156040>)|(?:0|NULL)\);[^\?]{1,600}echo\s+['"]DarkCrew[^\}]{9,30}\}\s*\?>(?<X1064451>)|(?:0|NULL)\);\s*(\$\w{1,9})\h*=\h*['"][^'"]{99,999}['"];\s*(\$\w{1,9})\h*=\h*(strrev)\(['"]esab['"][^;]{1,30}\);\s*(\$\w{1,9})\h*=\h*\61\([^\)]+\);\s*(\$\w{1,9})\h*=\h*\62\([^;]+\);\s*(\$\w{1,9})\h*=\h*\64\(['"]\60['"],\63\);\s*\65\(\60\);[^\(]{0,90}\$\w{1,9}\(\);\s*(?:\?>|\Z)(?<X1146060>)|(?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*(\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\];\s*(\$\w{1,20})\h*=\h*\68\[[^\]]+\];\s*echo\s*(['"])[^\?]{20,150}\70;\s*@?(?:copy|move_uploaded_files)\(\67,\69\);\s*(?:\Z|\?>)(?<X1153801>)|(?:0|NULL|FALSE)\);\s*(\$\w{1,20})\h*=\h*['"]safe_mode\h*=\h*Off[^'"]{9,99}shell_exec\h*=\h*On[^'"]{0,99}['"];\s*fwrite\(fopen\(['"]php\.ini['"]\h*,\h*['"]w\+?['"]\),\72\);\s*(?:\Z|\?>)(?<X1153661>)|0\);[^/]{1,600}(?:header\(['"]\S{1,19}\s*404\s+Not\s+Found['"]\);\s*)+(?:exit|die)[^;]{0,9};\s*\}else\s+setcookie\(['"]\w{1,40}['"],\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\);\s*\?>(?:\s*<\?php\s+[^\?]{1,40}\?>)?\s*<\?php\b[^\?]{1,99}function\s+\w{1,32}\((?<X2064851>)|0\);\s*(\$\w{1,40})\h*=\h*['"][\w\.\-]{2,40}@\w{2,40}\.\w{2,9}['"];\s*\$\w{1,40}\h*=\h*getenv\(['"]REMOTE_ADDR['"]\)[^\?]{1,999}(\$\w{1,40})\h*=\h*fopen\([^;/]+/\w{2,40}\.txt['"]\h*,\h*['"]a\+?['"]\);\s*fwrite\(\76,[^;]+;[^\?>]{1,199}\bmail\(\75\h*,[^;]+;\s*\?>\s*<scr(?<X2142182>)|0\);\s*function\s+(\w{1,40})\(\)\s*\{[^\}]{1,600}chdir\(\s*\$\w{1,40}\s*\);\s*if\s*\(\s*is_readable\s*\(\s*['"]?(shadow|passwd)['"]?\s*\)\s*\)\s*\{\s*link\(\s*['"]?\79['"]?\s*,\s*['"][^\]]{1,400}\];\s*unlink\(\s*['"]?\79['"]?[^\}]+(?:\}\s*){2,6}\78\(\s*\);\s*(?:\?>|\Z)(?<X1062370>))|\h*\((?:(?:0|false|null)\);[^:/]{9,99}(\$_SERVER\[['"]REQUEST_URI['"]\])\h*=\h*str_replace\h*\(['"]\?reboot=yes['"],\h*['"]{2}\h*,\h*\81\);\s*(?:system|assert|eval|shell_exec)\h*\(['"]echo\h+['"][\*\h]{0,15}\bwget\h+https?://['"][^;]{2,25}\81(?<X2180531>)|(?:0|NULL|FALSE)\);[^/\*]{0,99}/\*\*\s*\*\h+Plugin\h*Name:\h*Cmsmap\W{0,4}\bWordpress\h*shell\b(?<X2174430>)|(?:0|NULL|FALSE)\);[^\)\{]{9,99}\bfile_exists\h*\([^\)]{0,20}\bwp\-(?:admin|content|includes)[^\{]{12,200}\{\s*\$\w{1,20}[\h=]+['"]<\?php\s+/\*\*\s*\*\s*Front\h+to\h+the\h+Wordpress\h+application\b(?<X2191960>))|\s*\((?:0|NULL)\);\s*(?:(?:\$\w{1,20}\s*=\s*['"]wp-(?:admin|content|includes)/['"];\s*){1,3}[^\t\?]{20000,};\s*file_put_contents\s*\([^\)]+\);\s*chmod\s*\(([^,]+),0777\);\s*unlink\s*\(\85\);\s*\}\s*(?:unlink\([^\)]+\);\s*){1,3}(?:exit|die)[^;]{0,9};\s*(?:\?>|\Z)(?<X1127540>)|\$\w{1,20}\s*=\s*['"][^'"]{1,99}/\w{1,20}\.php['"];\s*(\$\w{1,20})\s*=\s*\(['"]<\?(?:php)?\s+@?eval\s*\(\s*base64_decode\s*\(['"][^'"]+['"]\)\s*\);\s*\?>['"]\);[^\?]{0,99}fwrite\s*\(\$\w{1,9},\87\);\s*\$\w{1,20}\s*=\s*fclose\([^\)]+\);\s*\?>(?<X1063771>))))
\A\s*<\?php\s+(?:@?eval\((?:\s*['"]\?>['"]\s*\.\s*(?:gzuncompress|gzinflate)?\s*\.?\s*\(?\s*base64_decode\s*\(\s*['"][^'"]{1,40000}['"](?:\s*\)\s*){1,6};\s*\?>\s*<\?php\s*\/\*[^\*]*\*/\s*\?>(?<X1057971>)|gz(?:inflate\(base64_decode\(base64_decode\(['"][^'"]{999,2500}['"]\)\)\)\);?\s*\?>\s*\Z(?<X1058981>)|uncompress\(base64_decode\(['"]\\[\\xabcdef0-9]{65000,}['"]\)\)\);(?:\s*\?>)?\s*\Z(?<X1064170>)))|@?eval\s*\((?:['"]\?>['"]\s*\.\s*base64_decode\s*\(['"][^'"]{99,500}(?:VXBsb2FkZXIgYnkgeFMxbGVuYzNk|cGxvYWRlciBieSB4UzFsZW5jM2Q|IFVwbG9hZGVyIGJ5IHhTMWxlbmMzZA)[^'"]{99,1600}['"]\)\s*\);?\s*(?:\?>|\Z)(?<X1062380>)|\s*(?:(?:['"][\?>]{0,2}['"]\s*\.\s*)?base64_decode\s*\(\s*['"][^'"]{1,40}(?:KCdibG9jay5wa|J2Jsb2NrLnBo|YmxvY2sucGhw|ImJsb2NrLnBocA)(?<X2059751>)|['"]\?>['"]\s*\.\s*base64_decode\s*\(\s*['"]PD9waHANCmhlYWRlcignTG9jYXRpb246IHRva2Vu[^'"]{999,1999}['"]\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1058210>)|base64_decode\s*\((?:['"](?:ZXJyb3JfcmVwb3J0aW5n|IGVycm9yX3JlcG9ydGluZw)[^'"]{1,20}(?:JHsiRw|OyAkeyJ(?:H|ceDQ3)|ICR7I(?:kc|lx4ND))[^'"]{99,500}(?:QGV2YWwo|ZXZhbC|QGV2YW)[^'"]{99,1500}(?:ZXhpdD|IGV4aXQ7)[^'"]+['"]\)\s*\);?\s*(?:\?>|\Z)(?<X1061700>)|\s*['"][^\)]{1,9}(?:aHR0c|dHRw)[^\)]{1,50}(?:YXJyYXko|cnJheSg)[^\)]{99,200}(?:O3Blcmw|cGVybA)[^\)]{99,500}(?:LnR4d|IC50eHQ)[^\)]{40,150}(?:c2hlbGxfZXhlYy|aGVsbF9leGVjK)[^'"]{20,99}['"]\)\s*\);?\s*(?:\Z|\?>)(?<X1060711>))))|@?preg_replace\s*\(\s*.?['"](.).{0,40}\9(?:['"]\s*\.\s*['"])?e\w?.?['"]\s*,[^\),]+\)\s*\)\s*\)\s*\s*;[^\;]{0,40};\s*(?:\?>|\Z)(?<X1058620>)|@?unlink\h*\(['"][^\.]{2,30}\.php['"]\);\s*(?:require|include)\h*\(['"]wp\-blog\-header\.php["'"]\);\s*(\$\w{1,20})\h*=[^\{]{9,150}\{\s*wp_set_current_user\h*\([^,]{0,40},\h*\11\);[^\}/]{2,40}\bdo_action\h*\([^\)]+\);\s*\}\s*header\h*\(['"]Location:\h*/wp\-admin['"]\);\s*(?:\?>|\Z)(?<X1174730>)|@['"]\$\s*\w{1,9}\s*=\s*[^;]+['"];\s*(\$\w{1,20})\s*=\s*explode\([^\)]+\);\s*foreach\s*\(\13\s+as(\$\w{1,20})\s*=>\s*(\$\w{1,20})\)\s*\{\s*\15[^\)]+\);\s*\13\[\14\]\s*=\s*implode\(['"][^'"]*['"],array_reverse\(\15[^%]{5000,}function\s+(\w{1,9}\(\))\s*\{[^%]+\}\16;(?<X1064951>)|@error_reporting\(0\);\s*@set_time_limit\(0\);\s*(\$\w{1,20})\s*=\s*\$_[^;]+;\s*(\$\w{1,20})\s*=\s*\$_[^;]+;\s*if\s*\(isset\s*\(\18\)\)\s*\{\s*@?eval\s*\((?:gzinflate|gzuncompress)\s*\(base64_decode\s*\([^\}]+\}\s*elseif\s*\(isset\s*\(\19\)\)\s*\{[^\?]{300,1500}\)\)\);\s*\}\s*(?:\Z|\?>)(?<X1062330>)|[/\*\s]+@\s*PHP\s*Web\s*shell(?<X2060060>)|[/\*\s]{2,9}Plugin\h+name:\h*(\w{1,40})[/\*\s]{2,9}[^//\.\{]{1,50}\{\s*echo\h+['"]\22['"];\s*\$\w{1,20}\h*=\h*getcwd\(\)\.(?<X2152840>)|[/\*]{1,4}\s*PAKISTAN\s+CYBER\s+ATTACKER(?<X2060472>)|[^,]{1,600}\$\w{1,40}\s*=\s*tempnam\(sys_get_temp_dir\(\),\s*['"][^'"]*['"]\);\s*switch\(\$\w{1,40}\)\s*\{\s*case\s+['"]\w{1,40}['"]:[^,]{1,40},\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\)\)\)(?<X2064041>)|[^\$\(;]{0,69}error_reporting\(0\);[^\(]{1,40}\s*if\s*\(\s*isset\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\][\s\)]+\{[^\}]{1,600}if\s*\(\s*@?move_uploaded_file\(\$_FILES\[[^\-]{250,500}<form\s+[^\>]+method\s*=\s*\\?['"]POST\\?['"][^/]+/form>['"];\s*\}\s*(?:\?>|\Z)(?<X1118870>)|[^\$]{1,200}\s*(\$\w{1,9}(?:code|payload|evi?l))\s*=\s*['"][^'"]{30000,60000}['"]\s*;\s*\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13|strrev)\s*\(){0,5}\s*\(?\s*\27(?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1057760>)|[^\$]{1,400}(\$\w{1,40})\s*=\s*['"]https?://[^'"]{1,99}['"];[^\?]{1,999}(\$\w{1,40})\s*=\s*http_build_query\s*\(\s*array\s*\([^\?]{1,400}file_get_contents\s*\(\s*\29\s*\.\s*["']\?["']\s*\.\s*\30\s*,\s*false\);\s*\}\s*(?:\?>)?\s*\Z(?<X1062561>)|[^\$]{1,400}\$\w{1,40}\s*=\s*['"]b374k['"];\s*/[/\*]\s*shell(?<X2062131>)|[^\$]{1,600}\$\w{0,9}(?:pw|pwd|pass|password)\s*=\s*['"]\w{20,40}['"]\s*;\s*@?eval\(\s*['"]\?>['"]\s*\.\s*gzinflate\s*\(\s*base64_decode\s*\(['"][^'"]{9999,}['"]\s*\)\s*\)\s*\)\s*;\s*(?:\?>|\Z)(?<X1060541>)|[^\$]{9,200}Act-Shell\s+V\.(?<X2060392>)|[^\?]{1,400}@system\(['"][^'"]{0,40}wget\s+https?://\d+\.\d+\.\d+\.\d+/\w{1,40}\s+-O\s*(\w{1,40});[^\.]{1,40}\./\35\s*>\s*/dev/null[^;]{0,40}\Z(?<X2056500>)|\$(?:password|pass|passwd|pwd|pasMarion\d{0,3})\s*=\s*['"][^'"]*['"]\s*\?>\s*<\?php[^\$]{1,40}(\$\w{1,20})\s*=\s*['"][^'"]{99,400}['"];\s*@?eval\s*\(gz(?:inflate|uncompress)\s*\(base64_decode\s*\(\37\)\s*\)\s*\);\s*\?>(?<X1121410>)|\$(?:pass|password|pwd|ps|pw)\s*=\s*['"][^'"]{1,40}['"];\s*@?session_start\(\);\s*\?>\s*<!DOCTYPE[^\+]{900,999}<\?php\s*if\s*\(\s*!empty\s*\(\s*\$_FILES\s*\[[^,]{99,300}@?move_uploaded_file\(\$_FILES\[[^\?]{850,900}echo\s*\(?['"]</table>['"]\)?;\s*(?:\?>|\Z)(?<X1118210>)|\$(?:username|user)\s*=\s*\$_POST\[['"](?:username|user)['"]\];\s*(?:\$(?:password|pass)\s*=\s*\$_POST\[['"](?:password|pass)['"]\];\s*)?\?>\s*<!DOCTYPE\s+html>[^?]{99,700}<title>\s*(?:(?:Scotia|RBS|HSBC|Tangrine|CitiUnion)\s*(?:Online|Net|Internet|Mobile)?\s*Bank)(?<X2063020>)|\$(?:username|user|login)\s*=\s*\$_POST\[['"](?:username|user)['"]\];\s*(?:\$(?:password|pass|pwd|pw)\s*=\s*\$_POST\[['"](?:password|pass)['"]\];\s*)?\?>\s*<!DOCTYPE\s+html>[^?]{99,700}<title>\s*(?:(?:Answer\s+)?Your\s+(?:Security|Secret)\s+Questions|(?:Online|Net|Internet)\s+Banking)(?<X2063012>)|\$\S{1,40}\s*=\s*['"][^'"]{1,40}['"];[^\$]{1,40}function\s+(\w{1,40})\s*\(\s*(\$\w{1,40})\s*\)\s*\{\s*\43\s*=\s*gzinflate\s*\(\s*base64_decode\s*\(\s*\43\s*\)\s*\);\s*for\([^\}]+\}\s*return\s+\43;\s*\}\s*@?eval\s*\(\s*\42\s*\(\s*['"][^'"]{999,65000}['"](?:\s*\)\s*)+;\s*(?:\?>|\Z)(?<X1065100>)|\$\w{1,20}\h*=\h*['"](?:[^@'";]{2,20}@(?:gmail|protonmail|yandex)\.\w{2,6}['"];\s*\$\w{1,20}\h*=\h*(\$_POST\[)['"](?:email|u(?:ser)?(?:name)?|login)['"]\];\s*\$\w{1,20}\h*=\h*\45['"](?:password|pass|pwd|passwd)['"]\];(?<X2155891>)|\w{32}['"];\s*(\$(?:b374k|c99|r57|wso))\h*=\h*@?create_function\h*\([^,]+,['"]['"eval\.]{5,15}\([gzinflate\.'"]{10,25}\(['"\.base64_dco]{14,25}\([^\)]+\)\)\);\s*['"]\);\s*@?\47\h*\(['"][^'"]{9999,}['"]\);\s*(?:\?>)?\Z(?<X2185080>))|\$\w{1,20}\h*=\h*(?:\$_SERVER\[['"]HTTP_USER_AGENT['"]\];[^\{]{9,150}\{\s*(\$\w{1,20})\h*=\h*['"]\w{32}['"];\s*(\$\w{1,20})\h*=\h*file_get_contents\(['"]http://adrotate\.[^\)]+\)\.\49;\s*echo\(['"]<iframe\h+src=['"]\.\50\.[^\)]+\);\s*\}\s*(?:\?>|\Z)(?<X1151380>)|array\(\s*(?:['"]/[^'"]+['"]\h*=>\h*['"][\h\w\-\+]{0,30}(?:cialis|viagra|levitra|kamagra|priligy|propecia|lasix|amoxil|clomid)[\h\w\-\+]{0,30}['"],\s*){9}[^\)\};]{999,9999}\);(?<X2146321>)))
\A\s*<\?php\s+(?:\$\w{1,20}\s*=\s*(?:["'][^'"]+['"];\s*if\s*\(isset\s*\((\$_[GPRSC]\w{2,6}\[\$\w{1,20}\]\))\s*\)\s*\{\s*\$\w{1,20}\s*=\s*str_rot13\s*\(\1;\s*(\$\w{1,20})\s*=\s*['"]['"];[^:]{9,99}str_split\(@?file_get_contents\(["']php://input['"]\)[^\}]{9,99}\}\s*@?eval\(\2\);\s*\}(?<X1130250>)|['"][^'"]*['"];[^%]{99,200}\$[0o_]{1,20}\s*=\s*urldecode\s*\([^\)]+\);\s*\$[0o_]{1,20}[^\:]{3000,13000}\{\s*return\s+trim\(preg_replace\(['"][^'"]*['"]\.addcslashes\s*\([^#]{20000,};\s*unset\([^\)]+\);\s*(?:exit|die)[^;]{0,9};\s*\}['"]\);\s*\$\{[^\}]+\}\[[^\]]+\]\(\);\s*\?>(?<X1123300>)|['"][^'"]{0,40}['"];\s*(\$\w{1,20})\s*=\s*array\([^=]{1,99}\);\s*(\$\w{1,20})\s*=\s*create_function\s*\([^\[]{0,9}(?:\5\[[^\]]+\]\.){20}[^\)]{1,65000}\);\s*\6\(['"][^'"]{999,13000}['"]\);\s*(?:\Z|\?>)(?<X1121431>)|['"]http://\w{1,20}\.touchpadz\.com/[^'"]{9,70}['"];[^\{]{9,150}\{\s*if\s*\(\s*function_exists\s*\(['"]fsockopen['"]\)\)[^%]{99,999}flush\(\);\s*@?eval\s*\(\s*urldecode\s*\(\$\w{1,20}\)\s*\);\s*\}\s*(?:exit|die)[^;]{0,9};\s*(?:\Z|\?>)(?<X1124000>)|\$_(?:G|P|R|S|C)\w{2,6}\[[^\]]+\];[^\{]{9,40}\{\s*(\$\w{1,20})\s*=\s*['"][^'"]*['"];\s*(\$\w{1,20})\s*=\s*\9\s*\.\s*basename\((\$_FILES\[[^\]]+\]\[[^\]]+\])\);\s*if\s*\(isset\(\11\)\)\s*\{\s*if\s*\(\s*@?move_uploaded_file\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\]\s*,\s*\10(?<X2118690>)|array\((?:['"][^'"]{9,30}['"]\s*,\s*){40}[^\)]{999,19000}['"]\);\s*@?(?:eval|system|assert|popen|exex|shell_exec)\(['"](?:e|\\x65)(?:v|\\x76)(?:a|\\x61)(?:l|\\x6C)(?:\(|\\x28)(?:g|\\x67)(?:z|\\x7A)[^"']{99,200}['"]\);\s*\?>(?<X1122001>)|getcwd\(\);[^\(]{1,50}(\$\w{1,20})\s*=\s*@?file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);\s*(\$\w{1,20})\s*=\s*@?fopen\s*\([^\)]+\);\s*@?fwrite\s*\(\15\s*,\s*['"]?\14['"]?\);\s*(?:\Z|\?>)(?<X1118330>))|\$\w{1,40}\h*=\h*getenv\h*\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,40}\h*=\h*date\h*\([^\)']+\);(?:\s*\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];){2}(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{9,199}['"];\s*){3}@?mail\h*\((?:\$\w{1,40},?){3,}\);\s*@?header\h*\(['"]Location:[^'"]+['"]\);\s*\?>\s*\Z(?<X2157341>)|\$\w{1,40}\s*=\s*['"](?:[^'"]{1,40}['"];\s*(\$\w{1,40})\s*=\s*dirname\(__FILE__\)[^;]{1,40};\s*\$\w{1,40}\s*=\s*time\(\);\s*\$\w{1,40}\s*=\s*file_exists\(\18\);[^@]{1,600}@fopen\(\18,[^\?]{999,5000}header\s*\(\s*base64_decode\s*\(\s*['"][^'"]*['"]\s*\)\s*\.\s*\$\w{1,40}\s*\)\s*;\s*(?:\?>|\Z)(?<X1063850>)|\w{32}['"];\s*\$\w{1,40}\s*=\s*array\([^\[]{40,99}\);\s*(\$\w{1,40})\s*=\s*create_function\([^\)]+\);\s*\20\(['"][^'"]{999,}['"]\);\s*\?>(?:\s*<\?php\s*/\*[^\*]{0,40}\*/\s*@?eval\(gz(?:inflate|uncompress)\(base64_decode\(['"][^'"]{999,5000}['"]\)\)\);)?\s*(?:\?>|\Z)(?<X1118683>))|\$\w{1,40}\s*=\s*(?:\d+;\s*function\s*(\w{1,40})\s*\(\$\w{1,40},\s*\$\w{1,40}\)\s*\{\s*\$\w{1,40}\s*=\s*['"]['"];[^\n]{999,4000};echo/\*[^\*]{1,99}\*/\(\22\(\$\w{1,40}\s*,\s*\$\w{1,40}\)\)\s*;\s*\?>(?<X2051051>)|array(?:\(['"]eN[^\);=]{999,9999}=?=?['"]\);(?:\s*\$\w{1,40}\s*=\s*array\s*\((?:['"\s,base64_dco]{20,60}|['"\s,gzuncompres]{20,60})\)\s*;){2}\s*(\$\w{1,40})\s*=[^\?]{99,499}eval\s*\([^;]{0,40}\24\b[^;]{0,40};\s*(?:\?>|\Z)(?<X1133661>)|\s*\((?:(?:["'][^'"]+['"],){39,}['"][^'"]+['"]\);\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\26e\w?.?['"]\s*,\s*['"](?:\\x\w{2,3}){2,39}[^'"]{2,400}['"]\s*,\s*['"]\.['"]\);?\s*(?:\?>|\Z)(?<X1062013>)|[^\)]+\)\s*;[^/]{99,300}if\s*\(\$isbot\)\s*\{\s*(\$\w{1,9})\s*=\s*curl_init\(\);[^\}]{99,999}(\$\w{1,20})\s*=\s*curl_exec\s*\(\28\);\s*(?:echo|print)\s+['"]?\29['"]?;\s*\}\s*@?eval\s*\(['"][^\)]{999,6000}['"]\)\s*;\s*(?:\Z|\?>)(?<X1065211>)|\s*(?:['"][^'"]{20,80}['"],){39}[^\)]{9,9999}\);\s*@?eval\s*\(\s*['"]\\x65\\x76(?:\\x61|\\x69)\\x6C[^'"]{99,999}(?:\\x29){4}\\x3B['"]\s*\)\s*;\s*(?:\?>|\Z)(?<X1058072>)))|dirname\(__FILE__\);[^<]{1,299}(fclose)\s*\(\$\w{1,40}\);\s*(\$\w{1,40})\s*=\s*<<<\s*['"]EOS['"]\s*<\?[^\?]+\?>\s*EOS;[^\$]{1,299}\s*(\$\w{1,40})\s*=\s*fopen\([^\.]{1,40}\.\s*['"]/?index\.php['"]\s*,[^,]+fwrite\(\34,\33\s*\.\s*\$\w{1,40}\s*\);\s*\}\s*\32\s*\(\34\);\s*\?>(?<X1060930>))|\$\{['"](?:\\x47|G)[^\}]{7,18}['"]\}\[[^\]]+\][^//]{99,1500}(?:h|\\x68)(?:t|\\x74){2}(?:p|\\x70)(?:s|\\x73)?://[^\*]{999,3500}['"]\.urlencode\((@php_uname\(\))\)\.[^\(]{9,90}\.substr\(\36[^#]{2000,20000};return\s*\$\{\$\{['"](?:G|\\x47)[^\}]+\}\[[^\]]+\]\s*\}\s*;\s*\}\s*(?:\?>|\Z)(?<X1121820>)|\$\{['"](?:G|\\x47)(?:[^\?]{2500,3500}\$twigboi[^%]{12000,15000}://['"]\.\$\{\$\w{1,40}\}\[\d+\]\.\$\{\$\{['"](?:G|\\x47)[^'"]{1,28}['"]\}\[['"][^'"]{1,40}['"]\]\};echo\$\{\$\w{1,40}\}\.['"][^'"]{1,40}['"];\}\}\s*(?:\?>|\Z)(?<X1060970>)|[^\?]{2500,5500}\?\)[^\?]{500,1999};\}\}\}\}(GetDomains)\(scandir\(\$[^!]{200,999}\39\(\$\{\$\{['"](?:G|\\x47)[^'"]{6,28}['"]\}\[[^\]]+\]\},\$\{\$\{['"](?:G|\\x47)[^'"]{6,28}['"]\}\[[^\]]+\]\}\[\d+\],\$\{\$\w{1,40}\}\[\d+\],\$\{\$\w{1,40}\}\);\}\s*(?:\?>|\Z)(?<X1060980>))|\$admin\[['"](?:password|pass|pwd|passwd)['"]\]\s*=\s*['"][^'"]*['"];\s*\$notice\s*=\s*['"]<FONT\s+color[^\(]{1,99}@?eval\(gzinflate\(base64_decode\(['"][^'"]{9000,40000}['"]\)\)\);\s*(?:\?>|\Z)(?<X1119710>)|\$auth_pass=['"]\w{32}['"];\s*if\(!(function)_exists\(['"](\w{1,20})['"]\)\)\{\42\h+\43\(\$(?<X2152960>)|\$GLOBALS\[(?:[^\]]+\]\s*=\s*(?:(Array)\s*\(\s*(?:base64_decode\s*\([^\)]+\)\s*,?\s*){4,9}\);\s*(?:\?>\s*<\?(?:php)?\s+)?function\s*(\w{1,32})\(\s*\$\w{1,32}\s*\)\s*\{\s*\$\w{1,32}\s*=\s*\45\([^%]{99,1300}\{\s*(\$\w{1,9})\s*=\s*\$_[^;]+;echo\s+\46\(\d+\)\s*\.\s*\47\s*\.\s*\46\(\d+\);\s*\}\s*\?>(?<X1064911>)|Array\((?:(base64_decode)\s*\([^\)]+\)\s*,\s*){9,50}\49\([^\)]+\)\);\s*function\s+_\w{1,20}\((\$\w)\)\s*\{\s*(\$\w)\s*=\s*Array\([^\)]+\);\s*return\s+\49\(\51\[\50\]\);[^:]{99,1500}eval\s*\(\s*\49[^\?]{99,1500}\$GLOBALS\[[^\)]{1,40}\);\s*(?:echo|print)[^;]+;\s*\?>(?<X1062691>))|[^`]{2200,2700}\}\}(\$\w{1,40})\s*=\s*['"\s\.creat_funio]{21,60}\s*;\s*(\$\w{1,40})\s*=\s*\53\([^;]{40,100};['"]\);\54\(['"][^\?]{60000,}['"]\);\?>(?<X1056510>))|\$ip\s*=\s*\$_SERVER\[['"]REMOTE_ADDR['"]\];\s*(\$\w{1,40})\s*=\s*json_decode\(file_get_contents\([^\)]+\)+;\s*\$(negara|country)\s*=\s*\56(->country)_code;\s*\$nam[ae]_\57\s*=\s*\56\58;\s*\$[ck]ode_\57\s*=\s*strtolower\(\$\57\);(?:\s*\?>)?\s*\Z(?<X2120490>)|\$shellname[\h=]+["'][^'";]{1,15}\bshell['"];[^\\%!\*]{99,2500}\$\w{1,20}[\h=]+@?(?:\w{1,20}|\$[^\(]{1,20})\(['"]/etc/named\.conf['"](?<X2193681>)|\/\*[^\$//]{0,20}\b(?:shell|backdoor)[^\-\/]{2,20}\bprivate\-node\.\w{2,6}\b(?<X2179940>)|\{@?(?:eval|assert|shell_exec|exec|popen|system|passthru)\(\$\{\$\w{1,9}\}\[['"]\w{1,15}['"]\]\);\}\s*\?>(?<X1133711>)|call_user_func\s*\(\s*create_function\s*\(\s*['"]['"],\s*['"][^'"]{30000,40000}["'](?:\s*\)\s*){1,3};\s*['"](?:\s*\)\s*){1,3};\s*(?:\?>|\Z)(?<X2055861>)|class(?:\h+WPBrute\s*\{[^\}]{9,150}\}\s*function\h+brute\((?<X2152930>)|\s+(\w{1,9})\s*\{\s*var\s*\$\w{1,9};\s*function[^#]{9999,15000}\65::(\w{1,9})\(\$\w{1,9},\65::\66\(\)\);@mkdir\(\$\w{1,9}\);\s*\}\};\s*\};[^\=]+(\$\w{1,9}).=mysql_query\(\67.\);\s*if\(quotemeta\([^;]{1,60};\s*define\(['"]DEBUG_MODE['"],false\);\s*session_write_close\(\);\}\s*\}\s*(?:\?>|\Z)(?<X1061714>)|\s+SAPE_base\s*\{[^`]{23000,25000}\bwp_\w{1,9}\(\)\s*\{\s*@?error_reporting\(0\);\s*function\s+(\w{1,40})\([^\)]{1,40}\)\s*\{[^\}]{1,99}\}[^%]{999,5000}\69\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],\s*['"](?:google|yandex)['"]\);[^&]+sape\s*=\s*new\s*SAPE_client\([^\}]+(?:\}\s*){2,5}\?>(?<X1064672>))|define\(['"][^'"]+['"],\s+isset\(\$_REQUEST\[(['"]DEBUG['"])\]\)\s*\?\s*\$_REQUEST\[\71\]\s*:[^%]{9999,12000}%\[\[:\w{1,40}:\]\]\{\d+\}[^`]+,\s*500\);\s+\}\s*ob_end_flush\(\);\s*session_write_close\(\);\s*exit\(\);\s*(?:\?>|\Z)(?<X1061021>))
\A\s*<\?php\s+(?:echo(?:[^;]{1,99}(?:php_uname|getcwd)\(\)[^/]{1,99}\s*<form\s+method\s*=\s*['"]post['"][^;]{99,999}['"];\s*if\s*\(\s*!\s*empty\s*\(\s*\$_FILES\s*\[[^\]]+\][\s\)]+\{\s*@?move_uploaded_file\s*\(\s*\$_FILES\s*\[[^\]]+\](?<X2122040>)|\b[^i]{1,40}IndoXploit\b(?<X2121050>)|\h+['"][^'"]+['"];\s*(\$\w{1,20})\h*=\h*['"]\w{1,20}\.txt['"];[^\(]{9,99}\bif\h*\(!?file_exists\(\3\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(fopen)\(\3,[^\?]{99,999}\b\5\h*\(\3,[^\)]+\);\s*fwrite\(\4,[^\)]+\);\s*fclose\(\4\);\s*@?(?:eval|system|passthru)\(\$_[^\?]{9,150};\s*\}\s*(?:\Z|\?>)(?<X1144530>)|\s*['"]\s*Priv8\s+Home\s+Root\s+Uploader.{500,1000}echo\s*['"]gagal\s+upload['"];\s*}\s*\}\s*\}\s*\?>(?<X1041650>)|\s*base64_decode\([^\)]+\);\s*(?:(\$\w{1,9})\h*=\h*(?:chr\(\d+\)\.?){5}[^;]{2,400};){1,6}\$\w{1,9}\h*=\h*\8\.\$\w{1,9}\(\$_REQUEST\[[^\]]+\]\);\s*@?(array)_diff_ukey\((@?\9\(\([^\)]+\)\()(\$\w{1,9})\)[^\)]+\),\s*\10[^;]+;\s*@?include(?:_once)?\(\11\);\s*@?unlink\(\11\);\s*(?:\?>|\Z)(?<X1061313>)|\s+(base64_decode)\s*\([^\)]{1,40}\);\s*(\$\w{1,40})\s*=\s*\13\s*\(['"][^'"]+['"]\);\s*(\$\w{1,40})\s*=\s*@?fopen\s*\(['"][^\.]+\.php?[2-6]?(?:t|tml)?['"],\s*['"]w\+['"]\);\s*@?fputs\s*\(\15,\s*\14\);\s*@?fclose\s*\(\15\);\s*@?unlink\s*\(__FILE__\);?\s*(?:\?>|\Z)(?<X1061572>)|\s+base64_decode(?:\(['"](?:[^'"]{1,99}['"]\)\s*;(?:\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(\s*str_rot13\s*\(\s*base64_decode\s*\(\s*['"][^'"]{9,999}['"]\s*\)\s*\)\s*\)\s*\)\s*;\s*echo\s+base64_decode\(['"][^'"]{9,999}['"]\)\s*;){3,9}\s*(?:\?>|\Z)(?<X1062870>)|PD9waHAgJ[^'"]{499,700}(?:PSI7IGV2YWwoYmFzZTY0X2RlY29kZSg|IjsgZXZhbChiYXNlNjRfZGVjb2RlKC|OyBldmFsKGJhc2U2NF9kZWNvZGUoJ)[^'"]{1,60}['"]\);\s*exit\b[^;]{0,9};\s*(?:\?>\s+)?\Z(?<X2127031>))|\s*\(['"][^'"]{1,40}['"]\);\s*@include(?:_once)?\s*\(\s*['"]https?:\/\/[^\)]+['"]\s*\)\s*;?\s*(?:\?>|\Z)(?<X1059011>)))|Error_Reporting(?:\((?:(?:0|false)\);\s*\$\w{1,40}\s*=\s*['"][^'"]{9999,15000}['"];\s*@?preg_replace\s*\(\s*.?['"](.).{0,40}\20(?:e|\\x65|\\145)\w?.?['"]\s*,\s*['"][^,]+,[^\)]+\);\s*return[^\;]*\;\s*(?:\?>|\Z)(?<X1057360>)|0\);[^{]{9,150}\{\s*(\$\w{1,40})\s*=\s*curl_init\(\);\s*(?:(?:curl_setopt)\s*\(\22[^;]+;\s*){3}curl_exec\s*\(\22\);[^%]{600,3000}unlink\s*\(\s*basename\s*\(\s*\$_SERVER\[[^\]]+\]\)\s*\);\s*(?:\Z|\?>)(?<X1061091>)|0\);\h*\$\w{1,40}\h*=\h*(?:chr\h*\(\d+\)\h*\.\h*)+chr\h*\(\d+\);\s*\h*\$\w{1,40}\h*=\h*\$\w{1,40}\h*\(['"](?:edoced_46esab|etalfnizg|ecalper_rts)['"]\)[^!\[]{9999,30000}(\$\w{1,40})\h*=\h*ob_get_clean\(\);\h*@?eval\(\w{1,40}\(\24\)\);\s*\?>(?<X1138380>)|0\);\s*set_time_limit\(0\);\s*@?ini_set\('memory_limit',\s*'\d+M'\);\s*if\s*\([^\)]{1,20}\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\)\s*,\s*'\w+'\)\)\s*\{\s*header\(['"]HTTP/1\.1 301 Moved Permanently['"]\);\s*exit\(?\)?;\s*\}[^%]+\}\s*/\*\s+@hash:\s+\w{16,40}\s+-\s+\w{1,9}\s+\*/\s*\Z(?<X2058400>)|[^\)]+\);[^\$]+(\$\w{1,40})\s*=[^\}]+;function\s+(\w{1,40})\((\$\w{1,20}),\s*(\$\w{1,20}),\s*(\$\w{1,20})\)\s*\{return\s+\29\.\30\.\31;\s*\}\s*(?:\$\w{1,40}\s*=\s*\28\((?:\27\[\d+\],?\s*){1,}\);){3,7}[^%]+@?file_put_contents\((\$\w{1,40}),\29[^?]+\}\s*unlink\(\32\);\s*exit;\s*\}\s*\?>(?<X1061580>))|\h*\((?:0|null|false)\);\s*(\$\w{1,20})\h*=\h*['"]['"\.asert]{7,20}['"];\s*\$(\w{1,20})\h*=\h*\34\h*\(strrev\h*\(['"];\)\)\)['"][^'"]{9999,}['"]\(edoced_46esab\h*\(etalfnizg\h*\(lave["']\)\);\s*\$\{['"]\35['"]\};\s*(?:\?>)?\Z(?<X2180600>)|\s*\((?:0|NULL)\);\s*(\$\w{1,20})\s*=\s*(curl_)init\(\);[^:]{9,99}(?:https?://|aHR0c)[^\?]{9,99}(\$\w{1,20})\s*=\s*\38exec\(\37\);\s*@?eval\s*\(\39\);\s*(?:\?>|\Z)(?<X1130900>))|for\s*\((\$\w{1,9})\s*=\d+,(\$\w{1,9})\s*=\s*['"][^a-z0-9]{999,6000}['"],\s*(\$\w{1,9})\s*=\s*['"][^'"]*['"];\s*@?ord\s*\(\42\[\41\]\);\s*\41\+\+\)\s*\{[^\?]{99,700}\}\s*\43\s*=\s*@?decrypt\(\43\s*,\s*\$\w{1,9}\);\s*echo\(\43\);\s*(?:\?>|\Z)(?<X1124141>)|foreach\s*\(explode\(['"]\\x\w{2}['"],['"]\\x[\\xa-f0-9\|]{99,999}['"]\)\s*as\s*\$\w{1,40}\s*=>\s*(\$\w{1,40})\s*\)\s*\{\s*if\s*\(strpos\s*\(strtolower\(\s*\$_SERVER\[[^\]]{17,70}\]\s*\)\s*,\s*\45\s*\)\s*\D{2,3}\s*false\s*\)\s*\$GLOBALS\[['"]\\x[\\xa-f0-9]+['"]\]=1;\s*\}\s*(?:\?>|\Z)(?<X1132590>)|function(?:\h+(\w{1,20})(?:\((\$\w{1,20})\)\s*\{\s*\48\h*=\h*substr\(\48,\(int\)\(hex2bin\([^\[\]]{99,300}\breturn\h+strrev\(gzinflate\((?:\$\w{1,20}|base64_decode)\(\47\([^\;]+\);\s*\}\s*(?:eval\(){15,30}\w{1,20}\(['"][^'"]{999,7000}['"](?:\s*\)){15,30};\s*(?:\?>|\Z)(?<X1174921>)|\h*\((\$\w{1,20})\)\s*\{[^\}]{9,99}\breturn\h+\50;\s*\}\s*(\$\w{1,20})[\h=]+['"][^'"]{99,3000}['"];\s*(\$\w{1,20})[\h=]+['"]\47['"];\s*(\$\w{1,20})[\h=]+\52\h*\([^\)]+\);\s*(\$\w{1,20})[\h=]+\53\h*\(['"]{2},\52\h*\(\51\)\);\s*\54\(\);(?:\s*\?>)?\Z(?<X2191982>))|(?:\s*(\w{1,40})\(\$\w{1,40}\)\{\$\w{1,40}=Array\(['"]Ly4vZQ[=]{0,2}['"],[^\}]{80,150}\}\s*preg_replace\(\56\(\d+\),[^\?]{5000,}\56\(\d+\)\);\s*\?>(?<X1056640>)|\s+(?:generate_?)?random_?number\s*\(\s*\)\s*\{\s*\$\w{1,20}\s*=\s*array\([^\)]+\);[^\}]{9,99}\}[^\?\}\{%\*]{1,2999}header\s*\(['"]Location:\s+(?:sign|log)in\.php\?action=\w{0,9}Login[^;]{1,199}['"]+\s*\)\s*;\s*(?:\?>|\Z)(?<X1132081>)|\s+(\w{1,20})\s*\((\$\w{1,20})\)\s*\{\s*if\s*\(\s*function_exists\s*\(['"](curl_init)['"]\)\)\s*\{\s*\$\w{1,9}\s*=\s*\61\s*\(\60\);[^\[]{99,300}(\$\w{1,9})\s*=\s*\$_(?:G|P|S|R|C)\w{2,6}\[[^\]]+\];\s*if\s*\(\62\)\s*\{\s*print\s*\(\s*\59\s*\(['"]https?://[^\)]+\)\);\s*\}\s*(?:\?>|\Z)(?<X1121222>)|\s+(\w{1,22})\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][^'"]{22,99}['"];\s*(\$\w{1,40})\s*=\s*['"]['"];\s*for\s*\([^\)]{1,40}\$i\++\)\s*\{\s*\66\s*=\s*\66\s*\.\s*\65\[rand\(\d+,\d+\)\];\s*\}\s*return\s*\66;\s*\}\s*header\(['"]location:[^;]{1,99}\64\(\)\s*\);\s*@?session_start\(\);(?<X2123750>)|\s+(\w{1,40})\([^\?]{999,2000}\s*(\$\w{1,40})\s*=\s*\68\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;\s*(\$\w{1,40})\s*=\s*fopen\(\s*\$\w{1,40}\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*;\s*fwrite\(\s*\70\s*,\s*\69\s*\);[^\?]{1,400}\s*(?:\?>|\Z)(?<X1057070>)|\s+(\w{1,40})\(\s*\$\w{1,40}\s*\)\s*\{\s*(\$\w{1,40})\s*=[^\}]{1,99}\}\s*return\s*\73\s*;\s*\}\s*(\$\w{1,40})\s*=\s*\72\(['"][^'"]{1,99}['"]\);\s*(\$\w{1,40})\s*=\s*\72\(['"][^'"]{1,99}['"]\);\s*@?eval\(\s*(?:\75|\74)\s*\.\s*['"][^'"]{60000,}['"]\s*\.\s(?:\75|\74)\s*\);\s*(?:\?>|\Z)(?<X1056730>)|\s+is_bitch\s*\(([^\)]+)\)\s*\{\s*(\$bitche?s)\s*=\s*array\([^\)]+\);\s*foreach\s*\(\78\s+as\s+(\$\w{1,20})\)\s*\{\s*if\s*\(\s*stripos\s*\(\s*\77,\s*\79\s*\)[^;]+;\s*\}[^\}]{1,20}\}\s*(?:\?>)?\s*\Z(?<X1063071>)))|goto\s+(?:\w{1,40};\s*(\w{1,40}):\s+function\s+(\w{1,40})\([^\?]{9999,65000};\s*\w{1,40}:\s*\$\w{1,40}\s*=\s*isset\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\)\?[^;]+;\s*[^\(=\$]{1,99}goto\s*\81;\s*\w{1,40}:\s*\82\(\);(?<X2131560>)|\w{1,9};\s*\w{1,9}:\s*function\s+\w{1,9}\((\$\w{1,9})\)\s*\{\s*(\$\w{1,9})\s*=\s*array\([^\)]+\);\s*return\s+\85\[\84\];\s*\}[^\?]+@?eval\s*\((\$\w{1,9})\);[^\}]{9,300}@\$_(?:G|P|RC|S)\w{2,4}\[[^\]]+\];\s*\}[^\(]+if\s*\(\s*!isset\(\86\)\)\s*\{[^\}]+\}[^:]+:\s*\w{1,9}:\s*(?:\?>|\Z)(?<X1065141>))|header\([^\)]+\);(?:\s*\$[O0_]{1,40}\s*=\s*[^;]{1,40};\s*){2,7}\$[O0_]{1,40}\s*=\s*urldecode\(['"][^`]{65000,};unset\([^\)]+\);exit\(\);\}['"]\);\$\{['"][^'"]+['"]\}\[['"][^'"]+['"]\]\(\);?\s*\?>(?<X1061201>)|if\(!function_exists\("(\w{1,40})"\)\){function\s\w+\(\$\w+\)\{\$\w+=base64_decode\(\$\w+\);\$\w+=0;\$\w+=0;\$\w+=0;\$\w+=\(ord\(\$\w+\[1\]\)<<8\)\+ord\([^\?]{1500,3000}\?"\.">"\.\$\w+;return\s\$\w+;\}\}\}\}eval\(\89\("QAIAPD9waHAgABEkY29sb3Ig(?<X2057930>)|if\(isset\([^\}]{9,99}\}\s*if\(isset\((\$_[GPRSC]\w{2,6}\[?[^\]]*\]?)\)\)\s*\{\s*(\$\w{1,29})\h*=\h*\91;\s*\([^\{]{9,150}\92\(\)\):\92;\s*\}\s*if\(!isset\(\$_[^\}]{9,60}\}\s*\$\w{1,20}\[\d+\]\h*=\h*['"][^\n]{30000,};[^\?]{99,600}\beval\(trim\((?:base64_decode\()+\$\w{1,9}[\)\s]+;\s*(?:\Z|\?>)(?<X1155810>))
\A\s*<\?php\s+(?:if\h*\((?:!@?([ir](?:nclud|equir)e(?:_once)?)\h*\(?['"][\./]{0,9}(cloak\.php)['"]\)?\h*\)\s*\{?\s*@?\1\h*\(?['"][\./]{0,9}\2['"]\)?;\s*if\h*\(function_exists\h*\(['"](getredir)['"]\)\)\s*\{\s*@?\3\h*\((?<X2168181>)|[^\{]+\)\s*\{\s*(\$\w{1,20})\h*=\h*['"][htps:/\.'"]{8,15}[^;]{9,99}[\.'"]{1,3}(?:jpe?g|bmp|gif|png|ico)['"];\s*\$\w{1,20}\h*=\h*file_get_contents\h*\(\5\);[^\}%\*]{99,400}\b(?:include|require)[^\$]{1,6}(\$\w{1,20})[^;]{1,4};[^@]{0,30}@?unlink\(\6\);(?:\s*\}){2}\s*(?:\?>|\Z)(?<X1170510>)|\h*isset\h*\(\h*(?:(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\]\h*\)\h*\D{2,3}\h*\8\h*\[[^\]]+\]\h*\D{2,3}\h*['"][^'"]*['"]\h*\)\s*\{\h*(\$\w{1,40})\h*\=\h*['"\s\.creat_funio]{16,40};\s*(\$\w{1,40})\h*=\h*\9\s*\([^=]+\10\([^\)]+\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*(?:\?>|\Z)(?<X1059922>)|\$_[GPRSC]\w{2,6}\[['"]test_url['"]\]\h*\)\h*\)\s*\{(?<X2138503>))|isset\h*\((?:(\$_[GPRSC]\w{1,20}\[[^\]]+\])\)\)\s*\{\s*\$\w{1,20}\h*=\h*\13;\s*if\h*\((\$\w{1,20})\h*=\h*curl_init\(\)\)\s*\{\s*(curl_)[^&%\{]{20,200}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\15exec\(\14\)\);\s*\15close\(\14\);\s*(?:exit|die)[^;]{0,9};\s*(?:\}\s*){2}(?:\?>|\Z)(?<X1155171>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"][^;"]{9,150}['"];\s*@copy\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\17\[[^\]]+\]\);\s*\}\s*(?:\?>)?\Z(?<X2180100>)))|if\s*\(!(?:function_exists\s*\((?:['"](tmp_\w{1,20})['"]\)\s*\)\s*\{\s*if\s*\(\s*isset\s*(\(\s*\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[['"]\19\d['"]\]\s*\))\s*\)\s*eval\s*\20[^%]{999,2500}@?set_error_handler\s*\(['"]\19\d['"]\)\s*\)[^\w]{2,3}['"]\19\d['"]\)\s*[^;]{9,40};\s*\19\d\(\);\s*(?:\?>|\Z)(?<X1062680>)|[^\)]+\)\)\s*\{\s*function\s+\w{1,20}\s*\([^\)]+\)\s*\{\s*global\s*(\$god_?mode);[^%]{999,2000}if\s*\(\$\w{1,20}\s*\W{1,4}(?:false|true)\)\s*\{\s*(\$\w{1,20})\s*=\s*['"]<script[^>]*>[^>]{99,999}>['"];\s*\22\s*=\s*\23;\s*\}\s*\}\s*\?>(?<X1122190>))|isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*echo[^;]{0,33};\s*\}\s*\$\w{1,19}\s*=\s*@?eval\(["'](?:/[^/]{1,40}/)?(\$\w{1,19})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?eval\(base64_decode\(\25\)\);['"]\);(?:(\$\w{1,19})\s*=\s*['"]\w{1,40}['"];\26\([^\;]{1,99};)?\s*(?:\?>)?\s*\Z(?<X2124210>))|if\s*\(\s*(?:!defined\s*\(\s*['"](?:([^'"]{1,40})['"]\s*\)\s*\)\s*\{\s*define\(\s*['"]\28[^@]{99,999}\}function\s*([^\(]{1,40})\(&\$[^=]{1,40}=['"][^'"]*['"]\)\{global[^\?]{999,9999}\.=\29\((\$\29)(?:\)){3,6}['"],['"]\w{16,48}['"]\.\(\30=['"][^'"]{1,999}['"]\)\);\s*return\s+true;\s*\?>\w{16,40}(?<X1059150>)|(ALREADY_RUN_\w{9,33})['"]\s*\)\s*\)\s*\{\s*define\s*\(\s*['"]\32[']\s*,\s*1\s*\);(?<X2061851>))|(?:md5\()?\s*\$_POST\[['"]?\w{1,40}['"]?\]\s*\)?\s*[^\w]{1,2}=\s*['"]\w{1,40}['"]\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_POST\[['"]?\w{1,40}['"]?\];\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\(\s*stripslashes\s*\(\s*\34\s*\)\s*\);\s*\}\s*(?:\?>|\Z)(?<X1054351>)|\!empty\s*\(\$_FILES\)\s*\)\s*\{\s*(\$\w{1,20})\s*=\s*\$_FILES\[[^\]]+\]\[['"]\w{1,9}['"]\];[^:]{9,300}(\$\w{1,40})\s*=\s*str_replace\([^\{]+if\s*\(\s*move_uploaded_file\s*\(\s*\36,\37\)\s*\)\s*\{\s*[echotrulsfa\s;\}\{]{9,40}\}\s*\}\s*(?:\?>|\Z)(?<X1060132>)|\$_(?:P|G|S|C|R)\w{2,6}(?:\s*\[[^\]]+\])?\s*\)\s*\{\s*if\s*\(\s*@?copy\(\s*\$_FILES\s*\[[^\]]+\][^\?%&:\*]{9,300}<form\s*method\s*=\s*['"]?post['"]?[^\?%&:\*]{9,200}echo\b[^;]{1,200};\s*(?:\Z|\?>)(?<X2122271>)|is_(?:file\s*\(\s*(['"]/home/[^/]{1,40}/public_html/[\w\/\-\.\{\$\}\\[\]\(\)]{9,99}['"])\s*\)+\s*\{\s*include_once\s*\(\s*\40\s*\);\s*\}\s*(?:\Z|\?>)(?<X1121092>)|uploaded_file\s*\(\s*(\$_FILES)\s*\[[^\]]{1,40}\]\s*\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*\42\s*\[[^\]]{1,40}\]\s*\[[^\]]{1,40}\]\s*,\s*\42\s*\[[^\}]{1,600}\s*\}\s*(?:\?>|\Z)(?<X1059970>))|isset\s*\((?:(\$_(?:GET|POST|REQUEST|COOKIE)\[[^\]]+\]\))\s*&&\s*\(md5\s*\(\44\s*[^\w]{2,3}\s*['"][^\)]+\)[^\{]{9,99}\{\s*(\$\w{1,40})\s*=\s*['".preg_lac]{13,20};\s*(\$\w{1,40})\s*=\s*['"](.)[^,]{0,40}\47e['"];\s*\45\(\46,['".eval]{5,9}\([base64_dco'".]+\([^\}]{1,99}\}\s*(?:\?>|\Z)(?<X1061381>)|\$_POST\[[^\]]+\]\)\s*\)\s*\{[^\{\}<>!]{9,200}if\s*\(\s*isset\s*\(\s*\$_FILES\[['"]\w{1,20}['"]\]\[[^\]]+\]\)\s*\)\s*\{\s*(\$\w{1,20})\s*=\s*\$[^@]{9,50}@?move_uploaded_file\s*\(\$\w{1,20},\s*\49\);[^&]+>\s*<\/form>['"];\s*\}\s*(?:\Z|\?>)(?<X1060073>)|\s*(\$_FILES\[[^\]]{1,40}\])\[[^\]]{1,40}\]\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*getcwd\s*\(\s*\)\s*\.\s*['"][^'"]*['"];\s*(\$\w{1,40})\s*=\s*\52\s*\.\s*basename\s*\(\s*\51\[[^\]]{1,40}\]\);[^\)]{1,99}move_uploaded_file\s*\(\s*\51[^\$]+\53[^\?]{400,600}</form>['"];\s*\?>(?<X1059550>)|\s*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\[[^\)]+\)\s*\)\s*\{[^;]{0,40};\s*if\s*\(isset\s*\((\$_(?:GET|POST|REQUEST|COOKIE|SERVER))\[[^\]]+\]\)\s*\)\s*\{\s*file_put_contents\s*\(\55\[[^\]]+\],base64_decode\s*\(\55\[[^\]]+\]\)\s*\);\s*\}(?:die|exit)[^\;]{0,9};\s*\}\s*\?>(?<X1063430>)|\s*\$_(?:GET|POST|SERVER|REQUEST)\[['"]?[^'"]{1,40}['"]?\]\s*\)\s*\)\s*\{\s*[^;]{20,60};\s*(\$\w{1,40})\s*=\s*(\$_SERVER)\[['"]HTTP_HOST['"]\];\s*(\$inj)\s*=\s*\58\[['"]REQUEST_URI['"]\];\s*\$\w{1,40}\s*=\s*rawurldecode\(\57\.\59\);\s*\$\w{1,40}\s*=\s*@?mail\s*\((?<X2056300>))|strtolower\s*\(\s*\$_SERVER\[['"]REQUEST_METHOD['"]\]\)\s*\!=\s*['"]post['"]\s*\)\s*\{[^\}]+\}\s*if\s*\(\s*array_key_exists\s*\((['"]\w{1,40}['"]),(\$_FILES)\)\s*\)\s*\{[^\}]{9,200}move_uploaded_file\s*\(\62\[\61\]\[[^\]]+\],\s*\$\w{1,40}\);\s*\}\s*exit;\s*(?:\Z|\?>)(?<X1060111>))|if\s*\((?:function_exists\(['"](exec|shell_exec|system|passthru)['"]\)\)\s*\{\s*(?:@\64\(['"][^\)]+\);\s*){15}(?<X2120031>)|isset\((\$_(?:G|P|C|S|R)\w{2,6})\[[^\]]+\]\)\)\s*\{\s*if\s*\(\s*\66\[[^\]]+\][^\w]{2,3}[^\}]{1,99}if\s*\(move_uploaded_file\(\$_FILES\[[^\]]+\][^\(]{1,99}if\s*\(\66\[[^\]]+\][^\(]+=\s*fopen\(\66\[[^\]]+\]\s*,\s*['"](?:a|w)\+?['"]\);[^\}]+(?:\s*\}\s*){1,3}else\s*\{[^\}]+\}\s*\?>(?<X1064010>))|include\(['"]\w{1,40}\.php['"]\s*\)\s*\?>\s*<\?php\s+if\s*\(\s*isset\s*\(\s*\$_POST\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*move_uploaded_file\s*\(\s*(\$_FILES\[)[^\),]{1,40},\s*\68[^\),]{1,40}\)\s*;\s*\}\s*(?:\?>|\Z)(?<X1059980>)|session_start(?:\(\);(?:[^&]{0,40}if\s*\((isset\s*\(\$_POST\[)['"](?:cc|card)(?:num|card)?['"]\]\)\s*(?:&&\s*\70['"](?:expiry|exp|valid)(?:MM|YY)?['"]\]\)\s*){1,2}&&\s*\70['"](?:cvv|pin)['"]\](?<X2125970>)|[^\$]{0,600}\$\w{1,20}\s*=\s*(pack\(\s*['"][nvchslvq]\*['"]\s*,[^\)]{1,40}\))\s*;\s*(\$GLOBALS)\s*=\s*array\(\s*(['"]\w['"])\s*=>\s*\72\s*,[^\{]{300,600}\s*(\$_SESSION)[^%]{60,200}\%\w['"]\s*,\s*\73\[\74\]\(['"]\w\*['"],\75\[['"]\w['"]\](?:\s*\)\s*){1,6};\s*(?:\?>|\Z)(?<X1059204>)|\s*/\*\W{9,99}\b(?:priv(?:ate?|8)\h+)?(?:paypal|pp|gaypal)\h+scama?\b(?<X2142871>))|\s*\(['"]login['"]\);\s*(\$\w{1,20})\s*=\s*(\$_POST\[)[^\]]+\];\s*\$(?:login|email|user|username)\s*=\s*\79['"](?:login|email|user|username)['"]\];\s*\$(?:password|passwd|pass|pwd)\s*=\s*\79['"](?:password|passwd|pass|pwd)['"]\][^\{]{9,99}if\s*\(isset\s*\(\78\)\)\s*\{(?<X2123810>))|system\((?:['"]pwd['"]\)[^\(]{1,40}system\(['"]cat\s+/etc/passwd[^\?]{1,600}define\(['"][^'"]{1,40}['"]\s*,\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*;(?<X2057061>)|[^\)]{1,99}\)\s*;\s*system\(["']mkdir\s+[^\)]{1,40}/sok['"]\)\s*;\s*system\(["']mkdir\s+[^\)]{1,40}com_jooomlas['"]\)\s*;(?:\s*system\([^\)]{1,99}\)\s*;\s*){1,9}echo\s*\(?\s*['"][^'"]*['"]\s*\)?\s*;\s*(?:\?>|\Z)(?<X1058180>))|system\s*\(\s*['"][^'"]{1,40}['"]\s*\);\s*unlink\s*\(\s*__FILE__\s*\);(?:\s*\?>)?\s*\Z(?<X2120200>))
\A(?:\s*(?:<(?:div(?:\b(?:[^>]{0,499}\b(?:style=['"](?:(?:height|width):\h*0\w{0,2};?\h*){2}['"]|data\-key=['"]\w{32}['"]|class=['"]?coinhive\-miner['"])){3}[^>]{0,499}>\s*(?:<[^>]{1,19}>[^>]{0,99}\bdisable\h+Adblock\W?\s*</[^>]{1,19}>\s*)?</div>(?<X1181070>)|\h+style\h*=\h*['"][^>]+['"]>[^://]{3,99}<a\h+href=['"]https?://(?:nulled\d+\w|iwpnulled)\.com/['"]>[^\-\$\*\(\)\[\]]{99,200}</div>\s*\Z(?<X1180500>)|\s+style=[""](?:[^'"\n]{0,199}\b(?:height|width)[\s:]+[0-3]p[tx];){2}[^>]{0,199}>\h*(?:<a\b[^>]{0,199}\bhref=['"]https?://[^>]+>[^</]{0,99}</a>[\h,\.]{0,19}){2,}</div>(?<X1215450>))|F(?:ilesMatch\s+['"]\.\((?:[^\)]{0,99}\bphp\d*\|){2}[^>]{0,199}>\s*Order\s+Allow[,\s]+deny\s*Deny\s+From\s+all\s*</(FilesMatch)>\s*<\4\s*['"]\((?:\^[^\)\|]{1,29}\|){25,}\^[^\)\|]{1,29}\)\$['"]>+\s*Order\s+allow[,\s]+deny\s*Allow\s+from\s+all\s*(?:Deny\s*from\s*66\.249\.79[\d\.\s]*)?</\4>(?<X1233761>)|orm\b(?:[^;\?]{99,499}<\?php\h*(\$\w{1,40})\h*=\h*basename\h*\(\h*(\$_FILES\h*\[)[^;]+;\s*if\h*\(\h*@?[cm]o(?:py|ve_uploaded_file)\h*\(\h*\7[^,]+,\h*\6[\)\s]+\{\s*echo\b[^;]+;\h*\}\s*else\s*\{[^\}]{0,199}\}\s*(?:\?>|\Z)(?<X1178270>)|[^\v\?]{99,199}<\?(?:php)?\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\)]+\)\h*;\h*(?:\?>|\Z)(?<X1147420>)))|head(?:>\s*(<meta)\h+name=['"]description['"][^>]{2,40}>\s*\10\h+http\-equiv=['"]refresh['"]\h+content=['"]0;\h*url=http://\w{2,4}\.[^\.]{3,20}\.su\b[^\$&\*]{9,99}</body>\s*\Z(?<X2183491>)|\b[^>]*>\s*<meta\b(?:[^>]*(?:\bhttp\-equiv=['"]?refresh|content=['"][0-2];\s*url=https?://[^/'"]*dates[^/'"]*\.ru)\b){2}[^>;/]{0,99}/?>\s*</head>\s*\Z(?<X2202090>))|html>(?:[^:]{0,70}<(script)[^>]*>\s*window\.location\.replace[\h\(]+['"]https?://hello\.turnedpro\.xyz/xxxd\?[^\)]{9,400}['"]\);\s*</\13>[^:]{0,70}</html>\s*\Z(?<X2252150>)|[^\{]{1,99}<script>\s*alert\(['"]Hacked\s+by\b(?<X2137741>)|\s*<!--\s*Mirrored\s+from\s+file\.hackersb\.cn/webshell(?<X2126422>)|\s*<(title)>\s*(?:Webshell|backdoor|hacked|fucked)\h*by\b[^/<]{6,20}</\17>(?<X2152950>)|\s*<(title>)([^<]{0,3}deadcode\d+[^<]{0,3})</\19<center>\s*<h\d*>\20<[^>]+>\s*<\?[ph\s]+[^\{]{99,400}\bif[\(\h]+\$_FILES[\)\h]+[\{\s]+if[\(\h]+!?empty[\(\h]+(\$_FILES\[[^\]]+\])[\h\)]+\{\s*@?[cm](?:ove_uploaded_file|opy)[\(\h]+\21[^\?@]{5,200}(?:\?>)?\s*\Z(?<X2232751>)|\s*<body>\s*<div\s*id\s*=\s*['"]\w{1,40}['"]\s*style\s*=\s*['"]display\s*:\s*none['"]>\s*if\s*\(\s*!\s*window\.done\s*\)\s*\{\s*window\.AddonManager\.getInstallForURL\(\s*['"]https?://[^,]{1,99}\.xpi['"],\s*function\(\s*install\s*\)(?<X2123551>))|php\s*@?(?:include|require)(?:_once)?\s*\(?['"](?:blocke?r?|bots|antibots)\.php['"]\)?;[^:/]{1,99}\s*json_decode\s*\(\s*file_get_contents\s*\(\s*['"]https?://[^;]{1,99};[^\?]{1,99}\?>\s*\<(?:\?php|html)(?<X2118553>)|script(?:[^>]*>\s*parent\.window\.opener\.location\s*=\s*['"]https?://[^>]{20,200}>\s*(?:<meta\h+http-equiv\s*=\s*['"]refresh['"]\h+content\s*=\s*['"]\d+;\s*URL\s*=\s*['"]?https?://[^'"]{9,150}['"]\s*/?>\s*){1,4}(?<X1138061>)|\b[^>]{0,199}>\s*\(\s*(function\s+)\([^<]{1,499}\b\26(globalClick)[\s\(]+\w+[\s\)]+\{\s*((?:const|var)\s+)?\w+[\s\=]+location\.host\s*\28(\w+)[\s=]+['"](?:https?://|[\./]{0,9}ois\.is/images/)[^<]{1,999}\bwindow\.open[\s\(]+\29\b[^\)]{0,199}\);?[\s\}]+document\.addEventListener[\s\(]+['"]\w+['"][,\s]+\27[\s\)]+;[\}\)\s]+\(\);\s*</script>(?<X1215241>)|\h+[^:]{1,40}src\h*=\h*['"]https?://(?:\w{1,5}\.)?sitekodlari\.com/\w{1,40}\.js['"]\h*>\h*</script>(?<X1145872>)|\h+src\h*=\h*['"]http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/js\.js\b[^'"]{0,9}['"]\h*>(?<X1169710>))|title>(?:\h*Wordpress\h*Mass\h*Defacer?\b(?<X2181700>)|\W{2,9}[Dhf](?:efac|ack|uck)ed\h+by\b(?<X2168171>)))|[^\w]?PNG.{3000,6000}?<\?php(?<X2055704>)|\(new\s*Function\(\(function\(s\)\{var\s*d=\{\},a=\(s\+""\)\.split\(""\),cc=a\[0\],o=cc,r=\[cc\],c=256,p;for\(var\s+i=1;i<a\.length;i\+\+\)\{var\s+cd=a\[i\]\.charCodeAt[^%]{200,300}%r\.length\)\)\}\)\.join\(['"]{2}\)\}\)\(atob\("[^"]{20000,}"\),.+"\)\)\)\)\)\)\(\);(?<X2052900>)|\<\?php\s*(?:/[\*/]\s*Moonafic\s*\-\s*(?:Mini|Web)?Shell\b[^\$\?\{=]{1,99}\$\w{1,40}\s*=\s*\[\s*['"]\w{1,40}['"],[^\]]{499,999}\];(?<X2156150>)|if\s*\(\s*isset\s*\(\s*\$\{\s*(\$\w{1,9})\s*\}\s*\[\s*['"](\w{1,9})['"]\s*\]\s*\)\s*\)\s*\{\s*(?:eval|system|assert|popen|exec|shell_exec|passthru)\s*\(\s*\$\{\s*\38\s*\}\s*\[\s*['"]\39['"]\s*\]\s*\)\s*;\s*\}\s*(?:\Z|\?>)(?<X1127720>)|system\([^\{]{1,}if\s*\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\{[^\{]{1,}\{\s*(\$\w{1,9})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w{1,9}\s*=\s*(?:eval|system|assert|popen|exec|shell_exec|passthru)\(['"]\41['"]\)[^\{]{9,50}\{\s*echo\s*['"]<form[^\}]{9,150}\}\s*(?:\Z|\?>)(?<X1128472>))|\?>\s*<\?[ph\s]*@?eval[\(\s]+rawurldecode[\(\s]+['"]%20%2[04](?![^/;]{0,19}(?:unlink|foreach))[^'"]{99,}['"][\s\)]+;\s*\?>\s*\Z(?<X2259383>)|\w{0,40}\s*<\?php\s*\$\w{1,40}\s*=\s*getcwd\b[^;]{0,9};\s*if\h*\(\h*isset\h*\(\h*(\$_FILES\[)['"]?(\w{1,40})['"]?\][\s\)]+\{\s*\$\w{1,40}\s*=\s*basename\h*\(\s*\44['"]\w{1,40}['"]\]\[['"]\w{1,40}['"]\][\h\)]+;\s*if\s*\(\h*@?move_uploaded_file[\h\(]+\44['"]?\45['"]?\][^j]{1,300}</form>['"];\s*(?:\?>|\Z)(?<X1053822>)|a:2:{s:4:"data";s:\d+:"a:2:{s:18:"users_can_register";s:1:"1";s:12:"default_role";s:13:"administrator";}";s:8:"checksum";s:32:"[a-z,0-9]{32}";}\s*\Z(?<X2061390>)|eval\(\s*String\.fromCharCode\((?:\d+\s*,\s*){3}[^\)]+\)\s*\)\s*;(?<X1043463>)|function(?:\s*\w+\(\)\{if\((isset)\((\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)+(?:\{\$\w{1,40}=\50[^;]+;\}else(?:if\49)?[^\)]+\)+)+;return\$\w+\[\d+\];\}function\w+\(\$\w+,\$\w+=\d+[^%]{1,2500}(\$\w+)=['"]//server\w+\.\w+\.com[^%]{1,100}[^%]{1,100}(\$\w+)=\w+\(\51[^%]{1,50}die\(\52\);[^;]+;(?<X1224992>)|\s+\w*bank\w*\s*\([^\)]{1,99}\)\s*\{\s*(?:(?:var\s+\w+\s*=[^;]+;\s*){2}\s*if\s*\([^\{]{9,199}\{\s*(?:document\.getElementById\s*\(\s*['"]bank(?:name|login|log|pass)['"]\s*\)\s*\.\s*\w[^;]{9,399};\s*){4,9}[\s\}]{2,9}(?<X2131671>)|if\s*\([^\{]{99,}\{\s*(?:document\.getElementById\s*\(\s*['"]bank(?:name|login|log|pass)['"]\s*\)\s*\.\s*\w[^;]{9,399};\s*){4,9}[\s\}]{2,9}(?<X2131653>)))|GIF(?:8(?:[9786]\w?[^\s]{0,2}\s*[^<]{0,200}\s*<\?(?:php|=)?\s*@?(?:\$\w{1,40}\s*=|\w{1,40}\s*[\('"\[]|\h+\?>)[\x00-\x7F]{3,199}[;\(](?<X20524214>)|\d[^`]{2000,6000}?<\?php(?<X2045903>)|\d\w?[^\s]{0,2}\s*[^\?]{0,80}\s*<\?\s*@?(?:system|exec|passthru|shell_exec|popen|eval|assert)\s*\((?<X2054342>))|[\d\s]+<\?[ph\s]+(\$\w{1,20})[\h=]+(curl_)init[\h\(]+['"]https?://[^'"]{9,99}\.(?:php|txt)['"]\);\s*(\$\w{1,20})[\h=]+fopen[\h\(]+[^\?>]{99,300}\}\s*\60close[\h\(]+\59\);\s*fclose[\h\(]+\61\);\s*(?:\?>)?\s*\Z(?<X2211660>))|IDBTE[4A]M\s*<(?<X2204621>)|Options\s+Indexes\s+FollowSymLinks\s+DirectoryIndex\s+(con7ext\.)html?\s+HeaderName\s+\64txt\s+Satisfy\s+Any\s+IndexOptions\s+IgnoreCase[^=\*\n]{9,199}(?:(?:NameWidth|DescriptionWidth)=\*\s+)+SuppressHTMLPreamble\s+IndexIgnore\s+\*\s*\Z(?<X2223240>)|RewriteEngine(?:\s*On\s*RewriteRule\s*\^\([^\)]+\)\.html\$\s*\w{1,10}\.php\?xxx=\d{1,5}[^\[]+\[L\]\Z(?<X1122940>)|\s+On\s*RewriteBase\s+/\w+\s*RewriteCond %{REQUEST_FILENAME}\s+!-..+?\s*RewriteRule\s*\^\(\.\*\)\s+index\.php\?id=\$1\s*\Z(?<X1042752>))|var(?:\h+(\w{1,20})[\h=]+getUrlVars\(\)\[['"](frommobi)['"]\];\s*if\(\68\)[\s\{]+s(etCookie)\(['"](frommobile)['"],\68\);[\s\}]+var\h+\69[\h=]+g\70\(['"]\71['"]\);\s*if\(\69!=\d+\)[\s\{]+\(function\([^\)]+\)[\s\{]+if\(/android\.[^\{]{400,2500},['"]https?://[^\)]+\);(?<X2150851>)|\s*(\w{1,9})\s*=\s*String\s*;\s*var\s*(\w{1,9})\s*=\s*\73\.fromCharCode\s*\([^\)]{9,99},46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,[^\)]{99,999},41,91,48,93,46,97,112,112,101,110,100,67,104,105,108,100,40,[^;]+;\s*eval[\s\(]+/\*\d+\*/\s*\74[\s\)]+;(?<X1230470>)|\s*(_0x\d+)=\[(?:[^,]{0,400}",?){5,30}\];document\[\76[0-9\[\]\(\)_x]+;\s*\Z(?<X1043412>))|X5O.{25}EICAR-STANDARD-ANTIVIRUS-TEST-FILE[^\s]{1,9}\s*\Z(?<X2050572>))|\W{1}PNG\s+[^?%]+\?php[^\}]+file_put_contents\((?<X2283030>)|a:\d:\{s:\d+:['"]enabled[^/]+//(wpglobalstats\.\w{3,3}\b)/['"][^'"]+['"]postback_url[^/]+.//\80[^\}]{1,299}force_redirect_offer['"];\w:\d:[^\}]{1,99}\}(?<X1255323>))
\A(?:function\h*(_0x\w+)\(\)[\{\s]+const\h*(_0x\w+)=\[[^\?\\]{0,650}["']devtools(?:change)?['"][^\?\\]{0,2400}['"]sendbeacon['"][^\?\\]{0,2400}\];\1=function\(\)[\{\s]+return\h*\2;\s*\}[^@]{999,}(?:['"](?:c[ard]*num[ber]*|exp[iry]*|cvv|ccv?)['"]:["']?(?:_0x|#)[^\}]+['"]?,?){2,6}[^\?\\]{999,}\(\)[\};\s]+setInterval\([^\)]+\);\s*\}[\(\)]{4};\Z(?<X2231750>)|gif89;\w<\?(?:php)?\s*(?:(?:error_reporting|set_time_limit|session_start)\([^\)]{0,9}\);){3,4}[^@]{99,999}if\(get_magic_quotes_gpc\(\)\)\{foreach\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{\4\[\5\]=stripslashes\(\6\);\}(?<X2130880>)|H[a4@]?ck[3e]d!?\s+by\s*\S{1,40}[^\v]*\Z(?<X2228023>)|JHJlcV91cmkgPS[a-z\d/\+=\s]{4000,}\Z(?<X2277732>)|var(?:\h*(_0x\w{1,9})\h*=\h*\[['"]fromCharCode['"],\h*['"]GET['"],\h*['"]open['"][^#]{99,1100}\s*var\s*(\w{1,15})\h*=\h*document\[\10\[[^#]{9,99}\bif\(\11\[\w\]\[\10\[\d{1,3}\]\]\h*\D{2,3}\h*\10\[\d{1,3}\]\)\s*\{(\w)\h*=\h*false\}\};\s*if\(\12\h*\D{2,3}\h*true\)\{\s*\w\(\)\s*\}\s*\}(?<X1166321>)|\s*\w[^!\n\[\}/\\\*\|\?]{1,40}\bwhile\(!!\[[^|\n:\?]{1,999}var\s*\w{1,9}=['"]ht+['"]\+(\w{1,6}\[\w{1,9}\(\w{1,5}\)\])[^\[]+\14[^!\n\*]{1,999}\!\[\]\)\{var\s*\w{1,9}=document[^;]{1,99}\([\'"sc\+ript]{9}[^|\n/\*/\}]+\}(?<X1237451>)))
\b(?:(?:(?:assert_options|error_reporting)\h*\([^\)]+\);\s*){3}[^\$]{0,99}(?:(\$\w{1,40})\h*\.?=\h*['"asert]{3,18};\s*){2,9}\1\h*\(\h*str_rot13\h*\(\h*['"]riny\h*\(\h*(?:\w{1,40}\h*\(\h*)?['"][^'"]{999,}['"]\h*\)\h*\)\h*;\h*['"]\h*\)\h*\)\h*;(?<X1142131>)|(?:(include)(?:_once)?\s*['"]bots/anti\d+\.php['"];\s*){2,}\3\s*['"]config\.php['"]\s*;\s*(\$\w{1,40})[=\s]+getenv[\(\s'"]+REMOTE_ADDR['"][\)\s]+;\s*(\$\w{1,40})[=\s]+fopen[\(\s]+['"][^'"]+['"][,\s]+['"][^'"]+['"][\)\s]+;\s*fwrite[\(\s]+\5[,\s]+\4[^\?]{9,9999}\bheader[\("'\s]+Location\s*:(?<X2213741>)|(?:[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,19}\b(?:prevents|anti)/(?:anti|bot|blocker|princeduscam){1,2}[sz]*\d*\.php['"];\s*){3}(?<X2171793>)|(?:anonymousfox|smtpfox)\-\w+:[^:]{1,128}:\d+:{5}(?<X1250512>)|(?:CreateTools\s*\(\s*['"][^'"]+['"]\s*,\s*["']https?://[^;]{1,199};\s*){5}(?<X2187062>)|(?:define[\(\s'"]+(IFRAME_URL\w*)[',"\s]+https?://[^:;]+;\s*)+if[\s\(]+isset[\s\(]+\$_SERVER\s*\[['"]HTTP_USER_AGENT['"]\][^\{;]+\{\s*if[\s\(]+!\h*isset[\s\(]+\$_COOKIE\s*\[[^\{;=]+\{\s*setcookie\s*\([^\}]+\b\10[\s\);]+\}[^\}]*\b(?:exit|die)\b[^;]*;[^\}]*\}\s*\}(?<X1258350>)|(?:eval[\s\(]+){16,}\w+[\s\(]+\$GLOBALS\s*\[[^\]]+\]\s*\[[^\]]+\][\s\)]+;(?<X2238550>)|(?:function\h*\w{1,40}\h*\(\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*\)\s*\{\h*return\h*str_replace\(\h*(?:(?:\13|\14|\15)\h*,?){3}\);\h*\}\h*){2,}(\$\w{1,40})\h*=\h*['"][^\{\}\*/\+\?><@\.]{99,999}(\$\w{1,40})\h*=\h*[^;]+\16[^;]+;[^=]{0,9}\17[\(\h]+['"][^'"]{999,}['"][\s\)]+;(?<X1188753>)|(?:function\h+([a-z]{1,40})\d*[\h\(]+\)[\s\{]+(\$\w+)\h*=[^;]{499,1999};\s*(\$\w+)[\h=]+fopen[\h\(]+['"][^'"]{1,99}\.php['"][^;]{1,99};\s*\$\w+[\h=]+fwrite[\h\(]+\21[\h\,]+base64_decode[\h\(]+\20[\h\)]+;\s*fclose[\h\(]+\21\h*\);[\s\}]+){2,5}(?:\19\d*[\h\(]+\);\s*){1,5}(?<X1176943>)|(?:goto\s+\w{1,9};(?:\s*\w{1,9}\s*:){1,2}\s*){2}\$\w{1,40}\h*=\h*['"][^'"]{0,99}\b(?:botnet|covid)\d{0,9}[^@'"]{1,49}@(?:gmail|hotmail|live)\.com['"];[^@]{1,999}\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*['"]https?://[^/]{0,99}\bpaste(?:bin)?\.(?:se|com)/(?:raw|download)\b(?<X2151910>)|(?:if[\(\s]+\$\w{1,40}\s*\S{2,3}\s*\d+[\)\s]+(\$\w{1,40})[\s=]+['"][\./]{2,}['"];\s*){2,}(\$\w{1,40})[\s=]+rand\s*\(\s*1\s*,\s*2\s*\)\s*;(?:\s*if[\(\s]+\25\s*\S{2,3}\s*\d+[\s\)]+\$\w{1,40}[\s=]+base64_decode[\s\(]+['"]PD9[^'"]+['"][\s\)]+;)+\s*\$\w{1,40}[\s=]+fopen[\s\(]+\24\s*\.[^;]+\.php[^;]+;(?<X2210901>)|(?:if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*){2,}if[\s\(]+@(?:copy|move_uploaded_file)[\s\(]+\$_FILES\h*\[[^;\{]+\{\s*(?:echo|print)\b[^;]+;(?:\s*\})+\s*(?:echo|print)[\s\('"]+<form\h*method\h*=\h*['"]post\b[^;]+</form>['"]\s*;\s*\}(?<X1197080>)|(?:if\(!(function)_exists\(['"](\w+)['"]\)+\{\28\s+\29\([^\)]{0,99}\)\{){2,}[^\?@\+\-]{1,999}[;\}\{](\$\w+)=fsockopen\([^\}]{1,499};fputs\(\30,[^;]+;while\(!feof\(\30\)[^@]{999,}[;\{\}](\$\w+)=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]+;eval\(\31\);[^\?]{99,}\b\28\s+(\w+)\([^\?]{99,}\breturn\b[^;]+</html>['"];\}+(\$\w+)=['"]\32['"];ob_start\(\33\);\}+(?<X1218800>)|(?:if\((AntiBomb_)\w{1,40}(\(\$\w{1,40}\))[^\{\};]{1,99}\b(?:\35\w{1,40}\36;)?header\(['"]HTTP/\d\.\d\h+40[34]\b[^;]{1,99};(?:die|exit)[^;]{0,49};(?:\}?else)?){3}(?<X2173261>)|(?:if\(file_exists(\(\$[^\)]+\.['"]css['"]\.[^\)]+\))\)\{(?:[ir](?:nclud|equir)e(?:_once)|unlink)\38;[^\}]{0,99}\}){2}(?<X2201081>)|(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\{?(?:echo\h*)?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\);\}?){3}(?<X2180831>)|(?:if\(strpos\([^,]+,['"]google['"]\)\s*!?==?\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}\s*(\$\w{1,9})\s*=\s*md5[^;]+;\s*echo\s*['"][^>]+\41['"]>['"];(?:exit|die)[^;]{0,9};(?<X1132850>)|(?:include\s*\(?['"][^'"]{1,12}anti\d{1,2}\.php['"]\)?;\s*){2,}[^\{]{0,99}(?:if\(strpos\([^,]{1,99},['"]google['"]\)\s*\D{2,3}\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}(?<X1132841>)|(?:md5\(){2,}\$_[GPSRC]\w{2,6}\[['"][^"']*bajatax(?<X2205951>)|(?:PRIVMSG\b[^;]{1,99};\s*print\s+\$sock\s+['"]){3}PRIVMSG\b(?<X2163970>)|(?:push\(@vars\s*,[^;]{1,20}\);\s*){3,6}Handle\(['"]whmcs_crack_Clients(?:Root|info)\b(?<X2143782>)|(?:unlink\([^\);]{1,99}/\.c(?:panel/contactinfo|ontactemail)['"]\h*\);\s*){2}(\$\w{1,40})\h*=\h*fopen\h*\([^\);,]{1,99}/\.c(?:panel/contactinfo|ontactemail)['"]\h*,[^;]{1,199};\s*fwrite\h*\(\h*\47\h*,\h*['"][^;]{1,99};\s*fclose\h*\(\h*\47\h*\);(?<X2175921>)|(\w)=(document)\.createElement[\('"\h]+script['"\)\h]+;\s*\49\.src=atob[\('"\h]+aHR0cHM6Ly9jb2Rl[^'"\)]{1,99}['"\)]+;\s*\50\.head\.appendChild[\h\(]+\49[\h\)]+;(?<X1209970>)|(add_action)\h*\(\h*['"]pre_current_active_plugins['"]\h*,\h*['"]validate[^'"]{1,99}['"]\h*\)\h*;\s*\52\h*\(\h*['"]init['"]\h*,\h*['"]upload\d*Fsociety\d+['"]\h*\)\h*;(?<X2143381>)|(AntiBomb)Res\w{0,3}\([^\(]+\);[^\}]{0,99}.?\54.block\([^;]{0,99};\s*die\(redirec?t\(['"]\./[a-z0-9]{5,15}\.php(?<X2185872>)|(array)_flip\(\$_links_override\);[\s\}]+\bif\(\$\w{1,20}\h*&&\h*!?isset\((\$_config\[['"]passover_urls?['"]\])[\)\s\{]+\57\h*=\h*\56\(['"][^-]{1,9},\h*['"]/wp-(?:admin|content|includes)\b(?<X2146360>)|(base64_encode)\(\$\w+\)\);unlink\(\$\w+\[\(int\)round[^\n]{99,512}\.\59\(\w+\(\w+::\w{2,3}\(['"][^;]{1,64};return\s+mail\([^\}]+\}function\s*[^\{]+\{\$\w+\s*=\s*explode[^\)]+\)\s*,\s*\$\w{1,2}\);\s*return\s*trim\(\$\w+\[array_rand\((?<X2266121>)|(define)(?:[\(\s]['"](?:API|SHOP)_\w+['"][\s,]+str_i?replace\(['"](\.keyworddomain\.com)['"][\s,]+(MAINDOMAIN)[\s,\$'"]+(?:API|SHOP)_\w+[\s'"\)]+;\s*\61[\(\s]['"](?:API|SHOP)_\w+['"][\s,]+str_i?replace\(['"]\62['"][\s,]+\63[\s,\$'"]+(?:API|SHOP)_\w+[\s'"\)]+;(?<X1211060>)|\((['"]__NET['"])\h*,\h*True\);\s*if\h*\(!\61d\h*\(\65\)\)\s*\{\s*error_reporting\h*\([^/:]{9,99}\bfunction_exists\h*\([^\-\?\*]{9,200}\$\w{1,20}_\d\h*=\h*['"]https?://tds\-(?:err|narod)\.(?:com|ru)/[^`%]{999,7000}\bif\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\h*\)\s*\{[^\}>]+;(?:\s*\}){2}(?<X1168231>)|\h*\(['"](PLUGIN_NAME)['"]\h*,\h*['"]monit\.php['"]\);[^\(]{0,40}\b\61\h*\(['"]HEADER_\67['"]\h*,\h*['"]Plugin\h+Name:\h*Monitization['"]\);(?<X2148092>))|(document\.)addEventListener\(['"]DOMContentLoaded['"],function\(\)\{const\s*_[01]x[a-f\d]{1,39}=atob\(['"]aHR0[^\.\n]{1,999}\69createElement\(['"]script[^\}]+\}[^\.]{1,999}\bnew\s+ethers\.JsonRpcProvider\(atob\(['"]aHR0(?:[^\?\n]+\b(?:Promise|load)\?)+[^\\]+\.error\(['"]BSC\s+Response[^\}]+\}[^\}]+\}\);(?<X1280470>)|(document\.writeln)\h*\(['"]\h*<(script)\b[^>]+>['"]\);\s*\71\h*\(['"]var\h+(\w{1,9})\h*=\h*document\.referrer["']\);\s*\71\h*\(['"]if\(\73\.indexof\(\\['"](?:baidu|yahoo|bing|google)\b[^;]{20,250}\);\s*\71\h*\(["']location\.href=\\['"]https?://[^/]{2,20}/\d/\w{1,20}\.html\b[^\(]+;\s*\71\(['"]</\72>['"]\);(?<X1190592>)|(echo)\h*['"]<[^\{]{9,199}<input[^>]{0,99}\bname\h*=\h*['"](\w{1,40})['"][^>]{0,99}>[^\{]{0,99}\bif\((\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)\s*\{\s*\75\h*['"]<([^>]{0,15}>)['"]\h*\.?\h*exec\(\77['"]\76['"]\]\)\h*\.?\h*['"]</\78[""];\s*\}(?<X1180330>)|(Element)\.prototype\.appendAfter(?:[\s=]+(function)[\s\(]+\80[\)\s]+\{\s*\80\.parentNode\.insertBefore\(this[,\s]+\80\.nextSibling[\);\}\s,]+false[;\(\s]+\81[\(\)\s\{]+var\s*\w{1,40}[=\s]+(String\.fromCharCode\()104,[1256,]{1,40},58,47,47,[^;]+;\s*var\s*(\w{1,40})[\s=]+document\.create\80\(\82[^\*\n]+\[0\]\.appendChild\(\83\);\}\)\(\);(?<X1211720>)|\s*=\s*function\(\80\)\s*\{\s*\80\.parentNode\.insertBefore\(this,\s*\80\.nextSibling\);\s*\}\s*,\h*false\h*;[^;=]+var\h*(?:(\w{1,40})(?:\.(?:type|src))?\h*=[^;\)]*String\.fromCharCode\([^;]+;\s*){2,}\85(\.append)[^\}]{9,499}\86child\(\85\);\s*\}\s*\)\s*\(\);(?<X1194704>))|(error_reporting\()0\);(?:\88[^;]+;)+if\(!(function)_exists\(['"](hex2bin)['"]\)+\{\89\s*\90\([^@]{999,4999}=['"]<\?[ph\s]*define\(['"]WP_USE_THEMES['"],true\);\s*require\s*__DIR__\s*\.\s*['"]/wp\-blog\-header\.php['"];['"];[^@]{499,1999}\b(unlink\(__FILE__\);)(?:\?>)+\91+(?<X1233000>)|(exec)\s+master\.dbo\.(xp_cmdshell)\s+[^&>\$]+([&>\$])\s*(?:\94\s*\93|request\.form\s*\(\s*(['"])[^'"]+\96\s*\)\s*\95|(?:quot;\s*\.\s*\$)?_[GPCSR]\w+\[[^\]]{3,50}\]|\w+\.\w+\s*\95)(?<X2128382>))
\b(?:(file_)(?:get(_contents)\((\$\w{1,20})\);\s*\$\w{1,20}\h*=\h*filemtime\(\3\);\s*if\(preg_match_all\(\h*[\'"]\|(?:\(\.\*\))?<\\!--\h*(?:\\/)?js-tools\b[^;]{9,99}\);\s*\1put\2\h*\(\3,(?<X2158230>)|put(_contents)\(['"]\w+\.php['"],\h*\1get\5\(['"]https?://[^'"]+\bYudas1337/(?:ninja_shell|ExorLock_Ransomware)/[^'"]+\.(?:php|txt)['"]\)\);(?<X1203591>))|(file_put_(content)s)\h*\(\h*(\$_SERVER\[['"]DOCUMENT_ROOT['"]\])[\h\.]+['"](/wp\-\8/)db\-cache\.php['"][\h,]+(\$\w{1,40})[\h\)]+;\s*(?:\$\w{1,40}\h*=\h*array\h*\(\)\h*;|\7\h*\(\h*\9[\h\.]+['"]\10plugins/[\w\-]{1,40}\.php['"][\h,]+\11[\h\)]+;)(?<X2168311>)|(file_put_contents\()(dirname\(__FILE__\)\.['"]/)\.htaccess['"],[^;]{1,99};(?:\bif\(!is_dir(\((\14wp\-)(?:admin|content|includes)/['"])\)\)\{?mkdir\15,[^;]{1,99};\}?){3}[^\{\}\?@#%\*!&:<>\+]{1,999}(\$\w{1,40})(?:\d=\16[^'"]{1,99}\.php['"];\17){3}[^\{]{1,199}\b(?:if\([^\{]{1,199}\{\13\17\d,['"]{2}\);\}){3}(?<X2172770>)|(find_admin)\((\$\w{1,20}),(\$\w{1,20})\);\s*\}\s*function\h+s_xhell\(\21\)\s*\{\s*\20\h*=\h*array\((?:["']/[a-z0-9-_]{0,15}\.?(?:txt|php|phtml|pl)?["'],){10}[^\)]{99,999}\);\s*\19\(\20,\21\);(?<X2139130>)|(for[\h\(]+)(\$\w{1,9})\h*=\h*0;\h*\24\h*(<strlen)[\h\(]+(\$\w{1,9})[\s\);\{]+\23(\$\w{1,9})[\h=]+0;[\h\(]*\27\h*\25[\h\(]+(\$\w{1,9})\D{2,9}\$\w{1,9}\25[\h\(]+\$\w{1,9}[\h\)]+;\s*\$\w{1,9}\+{2},[^\.\^%]{9,199}\.=\h*(?:\26|\28)\{(?:\24|\27)\}\h*\^\h*(?:\26|\28)\{(?:\24|\27)\}[^:%/]{9,199}\bpreg_replace\h*\((?<X2177145>)|(foreach)[\s\(]+\$\w{1,40}\s+as\s+(\$\w{1,40})[\s\)]+\{(?:\s*\31\s*=\s*strrev[\s\(]+\31[\s\)]+;)?\s*if[\s\(]+strpos[\s\(]+\$\w{1,40}[,\s]+\31[\s\)]+!=+\s*false[\s\)\{]+setcookie[^;]+;\s*\$\w{1,40}\s*=\s*false;(?:\s*break;)?[\s\};]+\30[^;\{]+\31[\s\)]+\{[^\}]+\$\w{1,40}\s*=\s*true;(?:\s*break;)?\s*\}\s*\};(?<X1234721>)|(foreach\()\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{\33\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=ftp_connect\([^;]{1,99};if\(ftp_login\(\36,(?:\w{1,40}\()?\34\)?,(?:\w{1,40}\()?\35\)?\)\)\{[^\}]{0,99}\bftp_put\(\36,(?<X2167210>))
\b(function)(?:(\w+)\(+\w+,\w+\)\{var\w+=\w+\(\);return\2=\1\(\w+,\w+\)[^%]{1,1100}(R_PATH)[^%]{1,2150}['"]\w+['"]:(\w+)\((?:\-\w+[,\)])+[^%]{1,12200}\3['"]\]\)+;\1\4[^%]{1,50}\2[^%]{1,1810}\4[\(\s]+(?:\-\w+[,\)])+[^\;]+;[^\;]+;\}\(\)+;(?<X1235002>)|\h*(?:((_0x[a-z0-9]+)\([^\)]+\))[\{\s]+var\h*_0x[a-z0-9]+=(_0x[a-z0-9]+)\(\);[^\}]{9,150}\},\6;\s*\}[^\[]{9,150}\1\h*\8\(\)[\{\s]+var\h*(\w+)=\[[^\]]+\];\s*\8=\1\(\)[\{\s]+(return)\h*\9;[^\n\$\t]{999,6000}\}(scriptz\w+)\[[^\]]+\]=[^'"]{9,99}\10\h*\7\([^\[]+\bdocument\[[^;\t\.]{9,60}\[\w+\([^\)]+\)\]\(\11\);(?<X1215080>)|(\w+)(?:[\h\(\)\{]+var\h*\w=\[[^\]]+\];\h*\13=\1\(\)\{return\h*\w;\};\h*return\h*\13\(\);[^\n]{99,1200}\bscreen,\w=window,\w[^\n]{99,999}\bnew\h*httpClient\(\),\w=\w\[\w\([^\n]{9,299}\breturn\h*\w\[\w[^;]{0,99}0x1[^;]+;\}\}\(\)\);\}(?<X1273350>)|[\s\(\)]+\{\s*(\$\w{1,25})[\h=]+['"]aHR0cHM6Ly95b2FzdC1zY2hlbWEtZ3JhcGguY29t[^'"]+['"];\s*\$\w{1,25}[\h=]+base64_decode[\h\(]+\15[\h\)]+;\s*if[\h\(]+\1_exists[\h\(]+['"]curl_init['"][\s\)]+\{[^\?]{99,500}\badd_action[\h\(]+[^,]+,\s*['"]\13['"][\h\)]+;(?<X1230051>))|(\w{1,25})\(\)\s*\{\s*unlink\([^\)]+\);\s*\}\s*add_action\([^\{]{0,199}\{\s*\1\h*\w{1,25}\(\)\s*\{\s*echo\h*['"]<img\h*style=['"]display:\h*none;['"]\h*src=['"]https?://[^'"]{1,59}\.jpg\?\w{1,9}=['"][\h\.]+\$_SERVER\[[^\}]{0,199}\}\s*\}\s*register_shutdown_function\(['"]\17['"]\);(?<X1200980>)|(\w{1,30})\(\)\s*\{\s*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*\1\h*(\w{1,30})\(\)\s*\{\s*return\h+['"][^'"]{1,40}['"];\s*\}\s*echo\h+\20\(\);\s*(?:exit|die)\b[^;]{0,19};[\}\s]+(add_action\(['"]init['"]\h*,)\h*['"]\19['"]\h*\);\s*\21\h*['"]glo[^'"]{9,40}['"]\h*\)\h*;\s*\Z(?<X1174582>)|(\w{1,40})\h*\(\)\s*\{\s*var\s*(\w{1,40})\h*=\h*\[\h*['"]createElement['"]\h*,(?:[^\]\+:/]{0,499}?,\h*['"](?:charCodeAt|charAt)['"]\h*,){2}[^\]\+:/]{0,499}?['"]onload['"][^\]\+:/]{0,499},\h*['"]https://['"]\h*,[^;\]]+\];\h*\23=\1\(\)[;\{\}\h]+return\h*\24[;\}\h]+return\h*\23\(\)[;\s]+\}(?<X1196341>)|(\w{1,40}\(\))\s*\{\s*(\w{1,40}\(\));\s*\}[^%&\|!]{0,9999}\1\h*\27\s*\{[^=\}]+\b(\w{1,40}\(\));[^%&!]{0,9999}\1\h*\28(?:[^=\}]*\$_[GPRSC]\w{2,6}[=\s]+&\$HTTP_[GPRSC]\w{2,6}_VARS;)+\s*\}[^%\|]+\b\26;[^!]+!\1[^\}]+\}\s*call_user_func[\s\(]+create_\1[^;]{0,19}\\x65\b(?<X2196610>)|(_0x)\w+\(+\30\w+,\30\w+\)\{var\h*\30\w+=\30\w+\(\);return\h*\30\w+=\1\(\30\w+[^\n]{999,3000}\bencodeURIComponent\(window\[\30\w+\([^\)]+\)\]\[['"]R_PATH['"]\]\),void[^\n]{99,999}\binsertBefore['"]\]\(\30\w+,\30\w+\);\}[\h\(\)]+;(?<X1235540>)|(_0x\w+)\([^\)]+\)\{const[^;]+;return\h*\32=\1\([^\n]{999,9999}\bconst\h*_0x\w+=\[['"](?:https?://|\\x68\\x74\\x74\\x70\\x3a)[^\n]{999,1999}\bwindow\[['"]mobileCheck['"]\]\(\)[^\n]{99,999}\bdocument\[[^\]]+\][^;]+;\}[\(\)]+;(?<X1277962>)|(isBot\(\))\s*\{\s*\$botAgents\h*=\h*['"][^\}]{9,399}\}\s*\1\h*(\w{1,40})\(\)\s*\{[^\?]{99,250}\bif\h*\(\h*\34\h*\)\s*\{\s*(echo\h*\$link);\s*\}\s*\}\s*else\s*\{\s*\36;[\s\}]+add_action\(["'][^'"]+['"],\s*['"]\35['"]\);(?<X1195560>)|\w{1,40}\h*\(\h*\$\w{1,20}[^\)]{1,99}\)\s*\{\s*(\$\w{1,40})\h*=\h*preg_split\([^;]+;\s*array_walk\(\s*\38\h*,[^\?]{1,200}(\$\w{1,20})\h*=\h*chr[\h\(]+ord[\h\(]+\39\)\h*\^\h*ord[\h\(]+[^;]{1,99};[^\?]{9,999}(\$\w{1,40})\h*=\h*\w{1,40}\([^;]+;\s*(\$\w{1,20})\h*=\h*create_\1\(\h*null\h*,\h*\40\h*\);\s*@?\41\(\);(?<X1167112>))|\h+(?:(\w+)[\s\(]+(\$\w+)[\s\)]+\{\s*if[\h\(]+\1_exists[\h\(]+['"](curl_)exec['"\)\s\{]+\$\w+[\h=]+\45init\(\44\);[^\?]{99,999}\breturn\s*\$\w+;\s*\}\s*(\$\w+)[\h=]+\43\((?:['"]https?://[^'"]+\.txt['"]\);\s*eval\h*\(['"]\?>['"]\.\46\);(?<X1201150>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(\$\w+)[\h=]+eval\h*\(['"]\?>['"]\.\46\);\s*header[\h\(]+['"][^:]+:\s*\48\h*['"]\);(?<X1201160>))|(\w+\(\))[\s\{]+\w+[\s=]+\[[\d\,\s]+\];[^>]{1,499}\b(\w+)[\s=]+new\s+XMLHttpRequest\(\);[^>/]{0,199}\b(\w+)[\s=]+\51\.responseText;[^>/]{0,199}(?:\b(\w+)\s*=[^;\}=]{0,49}(?:\52|\53)[^>\*!]{0,199}){2,}\b(\w+)[\s=]+new\s*\1[\s\(]+\53[\s\)]+;\s*\54\(\);[^>]{0,199}\51\.open\([^>/]{0,199}\bwindow\.onload[\s=]+\50;(?<X1211392>)|(\w{1,20})\((?:(\$\w{1,20})\)[\s\{]+(\$\w{1,20})=array\([^\)]+\);\s*return\h*\58\[\57\];[\s\}]+\1\h*\w{1,20}\([^\}]{99,200}\{\s*session_get_cookie_params\(\$_[GPRSC]\w{2,6},[^%@#&]{99,200}\bif\([^\{]+\)[\s\{]+(\$\w{1,20})=create_\1\(\56\(\d+\),[^\)]+\);\s*\59\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1200800>)|\$\w{1,20}\)[\s\{]+(\$\w{1,20})=['"]{2};\s*for\([^\}]{9,99}\breturn\h*\61;[\}\s]+\$\w{1,20}=['"]\1_exists['"];\s*(\$\w{1,20})=(?:str_replace\([^\)]+\)|create_\1);\s*(\$\w{1,20})=['"]base64_decode['"];\s*(\$\w{1,20})=\56\(\63\([^\)]+\)\);\s*call_user_func\(\62\(['"]{2},\64\)\);(?<X1202570>))|(\w{1,20}\(\))\s*\{[^\}]{9,40}(\$\w{1,20})\h*=\h*(\w{1,20}\(\));\s*@?eval\(['"][^\$]+\67[^\)]+\);\s*\}\s*\1\h+\68\s*\{\s*(\$\w{1,20})\h*=\h*str_replace\(['",\s]{5,9}\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*return\h+['"][^\$]+\69[^;]+;\s*\}\s*\66;(?<X1147871>)|(\w{1,30})\h*\(\h*(\$\w{1,40})\h*,[^\{]{1,99}\{\s*for\h*\([^\{]{1,99}\{\s*(\72\[[^\]]+\])\h*=\h*chr\h*\(\h*ord\h*\(\h*\73\h*\)\h*\^\h*ord\h*\([^;]{1,99};\s*\}\s*return\s+\72;[^\?]{1,999}\$(\w{1,40})\h*=\h*\71\([^;]{1,99};\s*(\$\w{1,40})\h*=\h*create_\1\h*\(\h*null\h*,\h*\$\74\h*\);\s*@?\75\(\);(?<X1166902>)|(\w{1,40})\h*\(\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*;\s*return\h*@?(?:\(\h*)?\78\h*\[[^\]]+\][\h\)]{0,9};\s*\}\s*@?(extract)\h*\(\h*(array)\h*\(\h*(\w{1,40})\s*=>\s*create_\1\h*\(\h*(?:NULL|['"]{2})\h*,\h*\77[\s\(\)]+;\s*@?\79\h*\(\h*\80\h*\(\h*\w{1,40}\s*=>\h*(?:\$\81|\78)[\s\(\)]+;(?<X1169230>)|(get_str)\((\$\w{1,12})\)\s*\{\s*\84\h*=\h*str_rot13\(\84\);\s*return\h*\84;\s*\}\s*\1\h*(\w{1,40})\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][a-z\d]{999,}['"];\s*\86\h*=\h*\83\(\86\);[^@]{0,999}@eval\h*\([^;]+\86\b[^;]{0,40};\s*\}\s*\85\(\);(?<X1182240>)|[a-f0-9]{8,32}\([a-f0-9]{8,32}\)\h*\{\h*var\h+[a-f0-9]{8,32}\h*=\h*\d+;\h*return\(parseInt\([a-f0-9]{8,32},[a-f0-9]{8,32}\)\);\}\h*\1\h*([a-f0-9]{8,32})\([a-f0-9]{8,32}\)\{[^/>\+]{9,299}\+=\w{1,40}\(\)+\{[^'"]{99,299}\88\(['"][a-f0-9]{99,999}['"]\);(?<X1158521>)|aHR\h*\([^\)]+\)\s*\{[^\}\{]{99,400}\breturn\h+\$\w{1,20}\h*\(\$\w{1,20}\h*,\h*array\(\),[^\);]{9,99}\);\s*\}\s*if\h*\(\1_exists\h*\([^\)]+\)\s*\)\s*\{\s*\1\h+get_data_yo\h*\((?<X2168460>)|shell\((\$\w{1,20})\)\s*\{[^\}]{1,40}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\91[^\?:#]{9,600}\b\1\h*perms\([^\)]+\)\s*\{\s*[^&]{0,50}(?:(?:else)?if\(\(\$perms&(0x[A-Z0-9]{3,5})\)\W{1,4}\92\)\s*\{\s*\$\w{1,20}=['"].['"];\s*\}\s*){5}(?<X2186600>)))
\b(?:(function)(?:\s*(?:(\w)\s*\([^\{;]+\{\s*var\s*\w+[\s=]+(\w+)[\(\)\s]+;\s*return\s*\w+[\s=]+\1\s*\([^\{;]+\{[^\}]+\}[,\s]+\2[^;]+;\s*\}\s*\1\s*\3[^=;]{0,40}(\w+)[\s=]+\[[^\]]{99,}\]\s*;\s*\w+[\s=]+\1[\s\(\)]+\{\s*return\s*\4[;\s]*\}[;\s]*return\s*\3[\(\);\s]*\}\W+\Z(?<X12144816>)|(\w+)\(\)[\{\s]+(\$\w{1,40})[=\s]+['"]aHR0c[^'";]{9,60}['"];\s*\7[=\s]+base64\w+[\(\s]+\7[\)\s]+;\s*if[\s\(]+\1_exists[\(\s]+['"]curl_init['"][^%]{1,150}(\$\w{1,40})[=\s]+[^%]{1,130}\7[^%]{1,100}echo\s*\8;[\}\s]+add_action[\(\s]+['"]\w+['"],\s*['"]\6['"][\)\s]+;(?<X1232611>)|(\w{1,20})[\(\s]+\$\w{1,9}[,\s]+\$\w{1,9}[\s=]+array[\(\)]+[^\}]+(\$\w{1,20})[\s=]+curl_exec[^\}]+return\s*\11[^%\|]+\1\s*(\w{1,20})[^\}]+google\|yahoo\|bing\|aol\|apple[^%+]{99,2999}\bif[\s\(]+\12[^\}]+echo\s*\10[^\?><]{9,99}\}(?<X1260981>)|(\w{1,40})[\(\)\s\{]+(\w{1,40})[\(\)\s;\}]+(\$\w{1,40})[=\s]+(__DIR__)[\.\s]+['"]/[^'"]+\.php['"][\s;]+if[\(\s]+file(_exists)[\(\s]+\16[\)\s\{]+include[\(\s]+\17[\.\s]+['"]/\w{1,4}['"](?:[\.\s]+['"][\w\.]{1,5}['"][\.\s]+['"])+[\.\w]{0,5}p['"][\)\s;\}]+if[\(\s]+\1\18[\(\s'"]+\15['"\)\s\{]+(\$\w{1,40})[=\s]+new\s*\w+[\(\)\s;]+if[\(\s]+\19\->\w+[\(\)\s\{]+add_action[\(\s'"]+init['",\s]+\14['"\)\s;]+\}\s*\}(?<X1259261>)|(_[01]x[a-f\d]+)\(\)\{var\s*_[01]x[a-f\d]+=\[['"]{2}\];\21=\1\(\)\{return\b[^\n]{14999,}=window\[[^;]+;\s*function\s*_[01]x[a-f\d]+\s*\([^;]+;\s*\}(?<X1251620>)|(_[10]x[\da-f]+)\s*\([^;\}=]{0,40}const\s*_[10]x[\da-f]+[=\s]+(_[10]x[\da-f]+)[\(\)\s;]+return\s*\23[=\s]+\1\s*\((?:[^\}i]+\})+\s*\1\s*\24[^\[]{1,999}\[['"]userAgent['",\s]+(?:\\x\d|http)[^!\n]+\bwhile[\(\s]+!!\[\][^`%\|\n]{1,1999}\bvar\s*(_[10]x[\da-f]+)[=\s]+\[[^\n<]{99,5999}\bdocument\[\25\[[^\)]+\)[\}\(\);]*;(?<X1249836>)|(loc\w+)\(\)\h*\{\h*var\h*\w+\h*=\h*(document)\h*,\h*\w+\h*=\h*\[['"][^\]]+\]\s*;\s*\w+\h*=\h*setInterval[\(\s]+\1[\(\)\s]+\{[^\?]{9,999}\}\h*['"]loading['"]\h*==+\h*\28\.readyState\?\28\.addEventListener\(['"]DOMContentLoaded['"],\27\):\27\(\);(?<X1258301>)|\w{1,40}(?:[\(\)\s\{]+if[\s\(]+strpos[\(\s]+\$_SERVER\[[^\]]+\][\s,]+['"]wp\-[^\}]+\}\s*if[\(\s]+(curre\w+[\('"\s]+admin\w+)[^=]{0,99}\$\w{1,40}[\s=]+['"]aHR0[^!]+\1\s*(\w+)[\(\)\s\{]+if[\s\(!]+\30[^:]{99,}::\w+[^\{]{99,}\{(?:[^\}]{0,199}\}){1,5}\s*register_ac\w+[\s\(]+__FILE__[,\s'"]+\31['"\s\)]+;(?<X1259270>)|[\(\s]+\w{1,40}[,\s]+\w{1,40}[\)\s\{]+var\s*\w+=\w+\(\);return \w+=\1\(\w+,\w+\)\{\w+=\w+\-\w+;var\s*\w+=\w+\[\w+\];if[\(\s]+\w{1,20}\[[^\]]+\]\s*==+\s*undefined\b(?:[^\[\]\n]{1,499}\[['"](?:charAt|fromCharCode)['"]\]){2}[^\n@]{1999,}\bgetElementsByTagName[^\}]+\}\(window,docum[^;]+;(?<X1253590>))|\w{1,9}\(\)\{header\(['"]HTTP/1\.[01]\s+40[34]\b[^;]{1,49};echo[^;]{1,199};(?:exit|die)[^;]{0,19};\}\1\s*\w{1,9}\((\$\w{1,9})\)\{@?unlink\(\34\);if\((\$\w{1,9})=@?fopen\(\34,[^\{;]+\{(\$\w{1,9})=['"]<IfModule\s+mod_rewrite\.c>[^;]{99,199};@?fwrite\(\35,\36\);(?<X2144300>)|_0x(?:\w+\([^=]{1,99}[\s=]{1,8}(_0x\w+)[^\}]+[\}\s,\w]+\(\w+[^:\n]{1,999}atob\(_0x\w+\(0x\w+\)\+_0x\w+\([^\}]+[\}\s\(]+document[\s\);]+\1\s*\38[\(\{\)\s]+var\s*[^\]]+36078SWzeyE['"]\];\38[^\}]+\};return\s*\38[\(\)\s;]+\}(?<X1279960>)|\w{1,9}\(_0x\w{1,9},_0x\w{1,9}[\s\)]+\{\s*var\s*_0x\w{1,9}=_0x\w{1,9}\(\);\s*return\s*_0x\w{1,9}=\1\([^;]+;\s*var\s*_0x\w{1,9}=_0x\w{1,9}\[[^\]]+\];[^\[\n]{9,999}\[[^\]=]+,['"]aHR0c[^'"]+['"],[^\]]+\];[^!\n]{9,}\bwhile\(!!\[[^\n:]{9,}:[^/\n]{9,}=btoa\([^;]+appendChild['"\]\(]+\w+[;\}\(\)]+;(?<X1210230>))|_(?:[01]x\w{1,9}[\(\s]+_[01]x\w{1,9}[,\s]+_[01]x\w{1,9}[\)\s]+\{\s*var\s*_[01]x\w{1,9}[\s=]+_[01]x\w{1,9}\([^\(]{0,40}\1\s*\([^:\n]{99,999}://[\w\-]*cdn[\w\-]*\.[a-z]{2,9}/\w[^\*\n@]{9,999}\*[\s\(]+parseInt[^\n]{99,9999}\[['"]insertBefore['"]\]\(_[01]x\w{1,9}[,\s]+_[01]x\w{1,9}\);\}\(\)\)\);(?<X1230000>)|\w{6}\s*\([^\{]{1,32}\{\s*var\s*\w+\s*=\s*\w+[\(\)\s]+;[^%\n]{1,9999}var\s*(_\w+)[^\{]+\{['"]\w+['"]:\1[^!\n]{1,9999}\!document\[\42[^\}\n]+atob[^\)\n]+\42\(\w+\)\]\);\w+=\w+\[\42\(\w{4}\)[^\]]+\42[^\}]+\}\(document\){2};\1\s*_\w+\(\)\{\}(?<X1257362>))|activate_(\w+)\s*\(\s*\)\s*\{\s*\}\s*\1\s*(deactivate)_\44[\(\s]+[\)\s]+\{\s*require(?:_once)?[\s\(]*plugin_dir_path[\(\s]+__FILE__[\)\.\s]+['"][^'"]+\.php['"]\s*;\s*\44_\w+::\45[\(\)\s;]+\}(?<X2234311>)|suicide\(\)\{if\(\1_exists\([^\}]{1,199}\}else\{(unlink\()__FILE__\);\}(?:\47[^\)]{1,49}\);){5}(?<X2149480>))|\s+(?:(\w+)[\(\)\s\{]+(?:(\$\w+)[=\s'"]+https?://[^'"\.]+\.com['";\s]+)+if[\(\s]+\1_exists[\('"\s]+(file_get_contents)['"\)\s]+\{[^\{\}&]+(\$\w{1,40})[=\s'"]+@\51[\s\(]+\50[^,]{9,499}\becho['"\s]+<script\s*src[="'\s.]+esc_url[\(\s]+\52[^;]+;(?:\s*\})+\s*add_action[\('"\s]+wp_head['",\s]+\49['"\)\s]+;(?<X1253363>)|(\w{1,40})(?:(\(\)\{)\s*\1\s+\w{1,40}\(\$\w+\)\s*\{\s*\$\w{1,40}\h*=\h*curl_[^#]{9,9999}\1\s+(\w{1,40})\55\s*if\s*\(\s*isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]+\{\s*\1\h+(\w{1,40})\(\)\s*\{\s*echo\h+[^;]{1,60};\s*\}\s*\57[^'"]{1,299}(?:add_action\(['"]init['"],\s*['"](?:\54|\56)['"]\);\s*){2}(?<X1145160>)|\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*if\h*\(\h*\1_exists\h*\(\h*['"](curl_)\w+['"](?:\h*\)){2}\s*\{\s*\$\w+\h*=\h*\60init\h*\(\h*\59\h*\);[^\?\.]{1,999}\breturn\b[^;]{1,49};\s*\}\s*(\$\w{1,40})\h*=\h*\54\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;]{1,99};\s*@?eval\h*\(\h*['"]\?>['"]\h*\.\h*\61\h*\);(?<X1171480>)))|_exists\h*\(['"](ZM5j2q0shf_pirogok)['"]\)\h*\)\s*\{\s*\1\h+\63\(\)\s*\{(?<X2151761>))|(function\h+)(\w{1,40})[\h\(\)]+\{\s*(\$\w{1,40})\h*=\h*(\w{1,40})\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\?<>]{1,499}\bget_user_by\([^\)]+\67\b[^\?\}/<]{1,299}\bdo_action\h*\(\h*['"]wp_login['"][^\?]{1,299}\b\65\68\h*\([^\}]{1,499}\}\s*if\h*\([^\{=;]{1,99}\{\s*\66\h*\([^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1179221>)|(getcwd\(\))\s*\.[^!\{\}]{199,999}\bif\(isset(\((\$_[GPCSR]\w{2,6}\[['"]\w+['"]\])\))\)\{(?:if\(!(?:file_exists|is_dir)\71\)\s*die\(\72[^;]+;){2}chdir\71(\s*or\s*die\()[^;]+;(\$\w{1,40})=scandir\71\73[^;]+;foreach\(\74\s*as[^\;]+\70[^;]+;if\(file_put_contents\(\$\w+,\$_[GPCSR]\w{2,6}\[['"]\w+['"]\]\)\)(?<X2131311>)|(global\h+)(\$[o01li_]+);\h*\77[\h=]+(@?create_(function)\h*\()[^;]+;\h*if[\h\(]+!\h*\79_exists[\h\(]+['"]([o01li_]+)['"][\s\)]+\{\h*\79\s*\80[\h\(\)]+\{\s*\76\77\h*;\s*return\s*(call_user_func[\h\(]+)\77[\h,]+['"][^'"]+['"][\h,]+\d+[\h\);]+\}\h*\81\78[\h'"]+,\h*['"][^'"]+['"][\h\)]+;\h*\}(?<X1196870>)|(goto)(?:\h*(\w{1,9});\s*\84:\s*class\h*(\w{1,9})\h*\{\s*(public)\s*(function)\h*\w{1,9}\h*\(\)\s*\{\s*return\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*\}\s*\86\s*\87\h*\w{1,9}\h*\(\$\w{1,9}\)\s*\{\s*\83[^\?]{9,15999}\bnew\s*\85\h*\(\);\s*\83\h*(\w{1,9});\s*\88:\s*\$\w{1,9}\->\w{1,9}\h*\(\);(?<X1178490>)|\h+(?:\w{1,9};\w{1,9}:\h*chmod\((\$\w{1,40}),\d+\);[^\?]{99,299}\83\s+\w{1,9};\w{1,9}:\s*\$\w{1,9}=base64_decode\(['"]aHR0c[^;]{9,49}(?:Ojgw|ODA|MDA)[^'"]{1,40}['"]\);\83\s+\w{1,9};\w{1,9}:\s*\90\h*=\$_SERVER\[['"]SCRIPT_FILENAME['"]\];(?<X2144700>)|\w{3,9};\h*\w{3,9}:\h+(?:(?:exit|die)\b[^;]{0,9};\h*\83\h+\w{3,9}\h*;\h*\w{3,9}\h*:\h*\$\w{3,9}\h*=\h*str_replace\h*\(['"][^\|\v]{999,19999}\bif\h*\(\h*!\(empty\(\h*\$\w{1,40}\h*\)\h*\|\|\h*\$\w{1,40}\h*\D{2,3}\h*200[\s\)]+\{\h*\83\h+\w{3,9};\h*\}\h*\83\h+\w{3,9};\h+\w{3,9}:\h*define\h*\([^\)]+\)\h*;(?<X1167400>)|\$\w{3,9}\h*=\h*\$\w{3,9}\h*\.\h*\$\w{3,9};\h*\83\h+\w{3,9};\h*\w{3,9}:\h+\$\w{3,9}\h*=\h*@?curl_exec\(\$\w{3,9}\);\h*\83\h+\w{3,9};\h*\w{3,9}:\h*@?error_reporting\(0\);[^\v>@/]{9999,15000}\b\83\h+\w{3,9};\h*\w{3,9}:\h+define\(['"\\,xa-f\d\h]{19,99}\)\h*;(?<X1162900>)))|\s*(\w{5});(?:\s*(?:\83\s*)?\w{5}:)+\s*(\$\w+)[=\s]+md5\(\$_[GPRSC]\w{2,6}\[['"]\\[\\xa-f\d]+['"]\]\);\s*\83[^=]{16,64}=\s*\$_[GPRSC]\w{2,6}\[['"][\\xa-f\d]+[^\(]+\(!\(\95\s*=+\s*['"][^\)]+\)[\s\)\{]+\83[^\n]{9,199}\94:[^\n]{9,9999}!move_uploaded_file[^:]+:\s*echo\s*['"][^;]+;\s*\83\s*\w{5};(?:\s*\w{5}:)+(?<X1261311>))|(header\()['"]HTTP/[12\.]+\h+40[34]\b[^@#%&\\\|]{1,999}(\$\w{1,40})=['"]https?://['"]\.\w{1,40}\([^\^\)]{1,99}\^\(?ord\([^@#%&/\\\|]{1,299}\bfile_get_(content)s\(\98\);[^@#%&\\\|]{1,299}\b\97['"]\99\-Disposition:\h*attachment\b[^\?#%\+/&\\\|]{1,299}\becho\h*\$\w{1,40};(?:exit|die)[^;]{0,19};(?<X2186390>))
\b(?:(if[\(\s]+is_null[\(\s]+\$_[GPRSC]\w{2,6})\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[\s=]+['"]['"]\s*;\s*\1\[[^\]]+\][^\n:]{9,9999}\b\w{1,40}\(['"]https?://\w+\.[\w\-]{3,40}\.[a-z]{2,6}/[^;'"\?]+\.\w{2,4}\?[^\?]{99,}\$\w{1,40}[\s=]+\$\w{1,40}[\.\s'"]+\?[^'"]+['"][\.\s]+urlencode\s*\([^;]+\$_[GPRSC]\w{2,6}\[[^\]]+\];(?<X1217411>)|(if[\(\s]+isset[\(\s]+(\$_[GPRSC]\w{2,6}\[))[^\]]+\][\)\s]+[\{\s]+\3(['"]\w+['"])[\]\s]+[\)\s]+include\s*\4\5[\]\s]+;\s*\3(['"]\w+['"]\])[\)\s]+[\{\s]+\$\w{1,40}[=\s]+file_get_contents[\(\s]+\4\6[\)\s]+;\s*file_put[^\}]{1,200}\}\s*\3['"](\w+)['"][\]\s]+[\)\s]+echo\s*['"]\7['"];[\s\}]+(?<X1235020>)|(if\(isset\()\$_[GPRSCH]\w{2,6}\[[^\]]+\]\)\)[\{\s]+(\$\w+)=fopen\((['"][^'"]+['"]),[^\)]+\);\s*fwrite\(\10,[^\}]{9,99}\}\s*if\(is_file\(\11\)\)[\{\s]+echo\h*(file_get_contents)\(\11\);[\}\s]+\9\$_[GPRSCH]\w{2,6}\[[^\}]{1,60}\b\12\([^;]{1,40};\s*fclose\(\10\);\s*\}(?<X1224550>)|(if\(strcmp\(__CMS_NAME__,)['"](wordpress)['"]\)[^\)]+\)\s*\{\s*(\$\w{1,20})=str(_replace)\(['"][ir][ne][cq][lu][ui][dr]e(?:_once)?\s*\(?['"]class\.wp\-includes\.php['"]\);[^\$]+\16\);\s*\16=preg\17\(['"]/\(package\\s\+\15\b[^\?>]{9,99}\14['"]joomla\b[^\?#&]{99,900}\bfwrite\(\$\w{1,20},\16\);(?<X2186401>)|(if\(stristr\((\$links),)\h*['"](JSLINKS)['"]\)\)\s*\{\s*\20\h*=\h*str_replace\(\h*['"]\21['"]\h*,\h*['"]{2}\h*,\h*\20\h*\);\s*\19\h*['"]JSCYCUPDATE['"][\s\)]+\{\s*dscs_upgrade\h*\(\20\);\s*return\s*['"]{2};\s*\}\s*\$\w{1,40}\h*=\h*@?fopen\([^;]+cache\.txt['"](?<X2162461>)|(if\(strpos\()\$_SERVER\[['"]REQUEST_URI['"]\],['"][^\{]{9,99}\)\{[^\{]{9,99}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*(\$\w{1,20})=>\$\w{1,20}\)\{\23\24,['"]wordpress_logged_in['"][^\?\\]{99,400}(\$\w{1,20})=ob_g[^\}\{]{9,150}\bfile_put_contents\(\$\w{1,20},\25\)[^\n]{0,20}\becho\h*\25;\}[^;]{9,99}\bheader\.php['"]\);(?<X1178541>)|(moban\.html?)\h*['"]\h*;[^\{\}\?]{0,199}\bfile_put_contents\h*\([^;]+/\27\b(?<X2172380>)|(pwn)\h*\(\h*['"][^'"]{1,40}['"]\h*\)\h*;\s*function\h+\29\(\h*\$\w{1,40}\h*\)\s*\{\s*global\h*\$\w{1,40}\h*,\h*\$\w{1,40}(?:\h*,\h*\$\w{1,40})?\h*;\s*(?:class|function)\h+(?:Vuln|str2ptr)\s*[\{\(](?<X2138103>)|(Rewrite)Engine(?:\h+On\s*\31Base\h+/\s*(\31Cond\h+%\{[^\}]{1,25}\})\h+android[^\n]{99,320}\s*\32\s*\^\(\d{1,4}\|\d{1,4}[^\n]{199,1699}\s*\31Rule\h+\^\$\h*https?://[^\[]{1,49}/\w{1,20}\.php[^\[,]{0,20}\[R,\h*L\](?<X1168191>)|\s+on\s*\31Cond\s+%\{HTTP_USER_AGENT\}\s+android\s+\[[^\*]+?windows\-media\-player\)\s+\[NC\]\s*\31Rule\s+\^\(\.\*\)\$\s+https?://[\S]+\s+\[L,R=302\](?<X1042712>)|\s+On\s+(\31Cond)\s+%\{HTTP:X\-Wap\-[^\}]+\}\s+\^\.\+\$\s+\[OR\]\s+\35\s+%\{HTTP_ACCEPT\}\s+\([^\|\.]+vnd\.wap\.[^\)]+\)\s+\[NC,OR\][^!]+\35\s+%\{REQUEST_URI\}\s+!\\\\\.\((?:(?:jpe?g|gif|png|bmp|ico)\|?){3,}\)\$\s+\[NC\]\s+\31Rule\s+\^\(\.\*\)\$\s+https?://tinyurl\.com/\w{3,16}\s+\[L,R=3\d{2}\](?<X1218760>))|(RewriteCond)(?:\s*%\{HTTP_USER_AGENT\}\s*\((?:(?:google|yahoo|msn|aol|bing)\|?){3,}\)\s*\[OR\]\s*\37\s*%\{HTTP_REFERER\}\s*\((?:(?:google|yahoo|msn|aol|bing)\|?){3,}\)\s*RewriteRule\s*\.\s*\S{1,40}\.php\s*\[L,S=\d+\](?<X1269400>)|\s+(%\{HTTP_USER_AGENT\})\s+\(android\|[^\n\[\],]{40,399}\b\s+\[NC,OR\]\s+\37\s+\39\s+\^\(\d+\|[\w\|\-\[\]\\\h\(\)/\.]{999,1999}\)\s+\[NC\]\n\s*RewriteRule\s+\^\$\s+https://tinyurl\.com/[a-z\d]{3,12}\s+\[R,L\](?<X1218270>))|(rndtext)\h*=\h*(md5\(microtime\(\)\));(?:\s*\$\w{1,15}\h*=\h*rand\(\d+,\d+\);){2}\s*\$\41\h*=\h*\42\.\42;\s*(?:header\(['"]Location:\h*\w{1,15}\.(?:html?|php)|function\h*validate_cc_number)(?<X2192531>)|(scriptTitle)\h*=\h*['"]PHPShell['"];\s*\$\w{1,15}\h*=\h*['"]\$\44\h*by(?<X2146160>)|(search_file_js)\h*\(\h*(\$\w{1,40})\h*,\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?scandir\h*\(\h*\47\h*\)\h*;[^@\}]{9,199}@?\46\h*\(\h*\47\h*,\h*['"]\.js\b(?<X2151660>)|(socket)\.\49\(\49\.AF_INET\h*,[^\?]{9,9999}(?:Attack|flood)(?<X2150783>)|(string)\[\]\h+(\w{1,40})\h*=\h*new\h*\51\[\d+\];\s*foreach\h*\(\h*Management(Object)\h+(\w{1,40})\h+in\h+\w{1,40}\h*\(\h*['"]SELECT\h+\S{1,40}\h+from\h+Win32_Process\b[^\{]{1,99}\{\s*\54\.InvokeMethod\h*\(\h*['"]GetOwner['"]\h*,\h*\(\h*\53\h*\[\]\h*\)\h*\52\h*\);\s*\}\s*return\h+\52\[\d+\];\s*\}(?<X2172360>)|(title)></\56>[^\?]{0,99}<\?php\s*if[\h\(]+\$_[GPRSC]\w{2,6}[^\?]{9,99}\bmove_uploaded_file\(\$_FILES[^<]{0,99}<form\b(?<X2198051>)|(to)\h*=\h*['"][^\.]{0,49}@app88\.vn['"];[^\?]{9,150}\bmail\(\$\58(?<X2170130>)|(unlink\()[^\);]{0,99}(\.htaccess)['"]\);[^\?@#%:/]{1,499}\bfile_put_contents\([^,]{1,99}\61['"],[^\?@#%:]{1,499}\b\60[^\);@#%:]{0,99}\.user\.ini['"][^\?@#%]{1,499}(?:\$(\w{1,40})\.?=str_replace\(['"](?:<\?|\?>)[^;]{1,199};){1,}eval\(\$\62\)(?<X2186221>)|(unlink\h*\()[^\)]+\);(?:\s*\}\s*)+if\h*\(\$_[GPRSC]\w{2,6}\[['"](bajatax)['"]\]\W{1,4}['"]\65['"]\)\s*\{\s*(?:@?\64[^\)]+\);\s*){1,5}(?<X2176180>)|(var)(?:\h+\w{1,20}\h*=\h*\d;\s*\67\h+(\w{1,9})\h*=\h*(document);\s*\67\h+(\w{1,9})\h*=\h*\68\.createElement\(['"](script)['"]\);\s*\70\.type[^\(]{9,60}\s*\67\h+\w{1,9}\h*=\h*String\.fromCharCode\([\d,]{99,299}\);\s*\70\.[^\.]{9,24}\69\.current\71[^\[]{9,199}\[0\]\.appendChild\(\70\);[^\}]{0,99}\}(?<X1143046>)|\s*(?:(\w{1,16})\s*=\s*\w+;\(function\(\w{1,16},\w{1,16}\)\{\67[^\}]{1,499}\}catch[^;]+;}{3}\((\w{1,16})[^\)]+\){2};;[^=]+=\74[^\}]{1,199}undefined\)[^}]{1,199}/=['"];\67[^\}]{1,399}\}for[^\}]+\}return\s*decodeURIComponent[^\+]+\+{2}[^\.]{1,2700}\(window,document,\73[^\]]{1,99}\{\67\s*(\w{1,16})\s*=\[['"]Aw5Zzxj0qMvMB3jL[^\]]+\];\74\s*=\w+[^;]+\75;\};return\s*\74\(\);\}(?<X1249913>)|_[01]x[a-f\d]+\s*=\s*(_[01]x[a-f\d]+);\((\w+)[^!\n]{1,256}while\(!!\[\][^\}]+\}catch[^\}]+\}[^\n&\176]{999,9999}\b\77\b(?:[^\}\n]+\})+\67\s*\w+=\{['"]\w+['"]:\78[^&]+\77[^!]+!\[\]&&\(\w+\[['"]currentScr['"]\+\w+[^\{]+\{\67[^\]]+\];if[^\)]+undefined\)[^\}]{1,99}\77[^\}]+\}for\(\w+\s*(\w+)[^\]]{1,256}\];\79(?<X1251372>)))|(var\s*)(\w{1,9})[\h=]+(document)\.getElementsByTagName\(['"]script['"\);\h]+\81\w{1,9}[\h=]+false;\s*for[\h\(]+\81(\w{1,9})[\h=]+0;[^=\n]+\bif[\s\(]+\82\[\84\]\.id[^\}\n]+\}[^;]+\b\81(\w{1,9})=\83;\s*\81(\w{1,9})=\85\.creat[^:\n]+\86\.src=(?:["']https?://[^'"\?]+\.js\?|String\.fromCharCode\()[^\[\]\n]+\[\d+\]\.appendChild\(\86\);(?:\s*\}){1,2}(?<X1208992>)|(visitor_country)\(\);[^\?]{9,999}\$\w+=\$_POST\[['"](?:password|pwd?|e?pass|passwd)['"]\];[^@]{99,1999}(header\()['"](location:)[^'"]{1,99}['"]\);\}else\{@?mail\((?:\$\w{1,40}(?:,|\))){4};\89['"]\90[^'"]{1,99}['"]\);\}(?:\?>|\Z|function\s*\88)(?<X2129002>)|(while\()!feof\((\$handle)\)\)\{\s*(\$\w{1,40})\s*=\s*fgets\(\93\);\s*(\94count)\+\+;\s*\}\s*fclose\(\93\);\s*file_put_contents\(getcwd\(\)\s*\.\s*['"]/['"]\s*\.\s*\$fold\s*\.\s*['"]/\w{1,40}\.txt',\95\);\s*\92\$\w{1,40}\s*<\s*\95\)\s*\{\s*\$\w{1,40}\s*=\s*(?:getCPUUsage|getFreeRAM)\(\);(?<X2135220>)|(window\.)(?:([a-z]+)\s*\|\|\s*\(\s*\97addEventListener[\(\s'"]+message['"][,\s]+(function)[\(\s]+(\w{1,5})[\)\s]+\{\s*\100\.[^\?]{9,999}\?\s*setTimeout[\s\(]+\99\s*\([^/]+\97\98[\s\('"]+https?://[^/]+\.[a-z]{2,7}/[^'"]+\.html?['"][\s\),]+\97\98[\s\('"]+https?://[^/]+\.[a-z]{2,7}/[^;]+;(?<X1220600>)|stop\s*\([;\h\)]+var\s+(\w{1,9})[=\s]+['"]https?://[a-z\d]{1,5}\.[\w\-]{9,}\.ga/track/\w+\.php\?\w{1,9}=\d+(?:&\w{1,3}=\d+)+['"]\s*;\s*document\.(location)\.href=\102;\s*\97\103\.replace\(\102\);(?<X1220930>))|(window\.location\.)replace[\("'\s]+https?://(cartoonmines\.com)/\d+["'\)\s]+;\s*\105href\s*=\s*['"]https?://\106/\w+['"]\s*;(?<X1238801>)|(wp_s(?:afe|ecuri)ty\w{0,9})[\s\(\)]+;\s*function\s+\108\s*\([^@]{1,1999}\$(\w+)[\s=]+curl_exec\s*\([^\?@]{1,499}\breturn\s+\108\s*\([^;]+;[\s\}]+@?eval[\s\(]+\$\109[\s\)]+;\s*\}(?<X1213800>)|22xploitercrew\b[^>]{0,99}</(?:font|div|title|h\d*)>(?<X2175431>)|3MS(?:RC|HELL)\w{1,9}\.c?inc\W?\s*\-\->(?<X2170603>)|662865921\)\s*</i>\s*</center>\s*</pre>\s*</body>\s*</html>(?<X2064090>)|[AS](?:dmin|hell)\h+Find(?:er)?\b[^@:%&]{99,1999}\bini_get\h*\(\h*['"]disable_functions['"](?<X2180260>)|[BE](?:lackhat|xploit)(?:er)?[^\w</]{0,9}</(?:h\d|title)>[^@#\}%\*&!\+\|,]{1,99}\becho\s*['"]<form\b[^\}]{1,299}\bif\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169590>)|[cm](?:opy|ove_uploaded_files)\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\116\[[^\?]{99,400}\becho\h+['"]\h*&copy;[^/]{0,9}\bUploader\h+by\b(?<X2178720>))
\b(?:[ep](?:cho|rint)\h+['"](?:[^'"]{9999,49999}['"]\h*\|\h*base64\h*\-(?:d|\-decode)\h*\|\h*(?:python|perl|php|ruby|(?:ba|tc|k)?sh)\b[^%#]{1,4999}\b[ep](?:cho|rint)\h+['"]ssh\-rsa\h+[^'"]{1,4999}['"]\h*>+\h*[^\s]*\.ssh/authorized_keys\b(?<X2181711>)|\s*#!/[^'"]{1,999}['"]\h*>+\h*(\w{1,40})\b[^\?#]{1,999}\bwrmsr\h+\-(?:a|\-all|(?:p|\-processor)\h+\d)\h+0x[^\?]{1,999}\bchmod\h+[ugo\+\dx]{3,9}\h+\2\b[^\?#]{0,199}\./\2\b(?<X2181650>))|[esp](?:cho|p?rintf?)\h*@?file_get_contents\h*\(\h*['"]/etc/passwd['"]\h*\)\h*;(?<X1159993>)|[ir][ne][cq][lu][ui][dr]e(?:_once)?(?:[\h\(]*['"]wp\-(?:includes|uploads|admin)/pomo\.php\d*['"][\h\)]*\);(?<X1194540>)|\h*\(?['"]/(?:home|var)/[^'"]+/\.cpdd\.ini['"]\)?;(?<X1206692>)|\h*\(\h*\$\w{1,20}\h*\.\h*['"]wp-blog-header\.php['"]\);[^\?@:]{99,299}['"]user_pass['"]\h*=>\h*['"][a-f\d]{32}['"]\h*,[^\?\}\|]{1,499}(\$\w{1,40})\h*=\h*new\h+WP_User\(\$\w{1,40}->ID\);\s*\7->set_role\h*\(\h*['"]administrator['"]\h*\)\h*;(?<X1142920>))|[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"](?:wget|curl)\h*\-o\h*[\.](\w{1,20})\h*['"]\.\$\w{1,9}\.['"\s]+\);\s*\bif\(file_exists\((realpath\(['"\s]+\)\.['"]/\.)\9['"][\)\s\{]+chmod\(\10\9['"],\h*\d{3,4}\);\s*include\h+\10\9['"];\s*\}(?<X2187192>)|[ri](?:equir|nclud)e(?:_once)?\s*(?:\(\s*)?['"][^'"]*/\.cagefs/[^'"]+['"](?:\s*\))?\s*;(?<X1197310>)|__alfa_set_cookie\(['"](AlfaUser)['"],\h*\$\w{1,15}\[['"]\13['"]\]\)[^\?]{99,999}\btitle>\W{1,4}ALFA\h*Team\h*shell(?<X2196820>))
\ba(?:ction=['"][^'"]{1,40}/xREPORT/Sinus/[^'"]+\.php['"](?<X2128811>)|d(?:d(?:(?:Type|handler)\h+application/x\-httpd\-php\h+\.zip\b(?<X1250673>)|_(?:action)\(['"]\w+['"],\h*['"](\w+)['"]\);\s*function\h*\3\(\$\w+\)\s*\{\s*global\h*\$current_user;[^\?<]{99,350}(\$\w{1,15})[\h=]+\$\w{1,15}\[[^\]]+\]\[['"]administrator['"]\][\h\-]+\d;[^\}]{99,450}\b(span)\h*class[\h=]+['"][^'"]+['"]>\(['"\.\h]+\4['"\.\h]+\)</\5>[^\?]{9,190}\breturn\h*\$\w{1,15};\s*\}(?<X1197813>)|_action(?:[\(\s'"]+init(?:['",\s]+(?:aioseoex\w+['"\s\)]+;(?<X1248160>)|function[\s\(\)]+\{\s*(\$\w+)[=\s]+['"][^'"\$]+['"][;\s]+\$\w+[=\s]+['"][^'"\$]+['"][^\}\{\(\)]{0,99}(\$\w+)[=\s]+get_user_by[\(\s'"]+login['",\s]+\8[\s\);]+if[\s\(]+\9\s*AND\s*\9\->roles\[\d+\][!=\s]+['"]administrator['"\s\)]+\{[^\}]+\}\s*if[^\{]+\{[^\}]+\}\s*\}[\s\)]+;(?<X1255640>))|['"][,\s]+['"]([^'"]+)['"][\)\s]+;\s*function\s*\11[\(\)\s]+\{\s*\$\w{1,40}[=\s]+new\s*(\w+)[\(\)\s]+;\s*\}\s*class\s*\12\s*\{[^\+]{999,}\bif[\(\s@]+preg_match[\(\s]+['"][^'"]*administrator/i['"][^;\{]+\{\s*setcookie\s*\((?<X2207401>))|[\(\s]+['"](?:[^'"]+['"][\s,]+function[\s\(\)]+\{[^\}]{1,499}(\$\w+)[\s=]+wp_create_user\s*\([^;]{1,199};\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\14[\s\)]+;\s*\15\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[\s\}]+\);(?<X1193090>)|wp_(?:(?:head|footer)['"][,\s]+function\(\)\s*\{\s*if[\s\(]+md5[\(\s]*\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]+['"][\s\)\{]+require['"\s\(]+wp\-includes/reg[^\}]+(\$\w{1,40})[\h=]+wp_create_u[^;]+;\s*(\$\w{1,40})[\h=]+new\h*WP_User[\(\s]+\17[^;]+;\s*\18\->[^;]+;[^!@<]{0,499}?\}\s*\)\s*;(?<X1194880>)|h\w+['"][,\s]+['"]([^'"\$]+)['"][\s\)]+;\s*function\s*\20[\(\)\s\{@]+require[\(\s]+['"]wp\-includes/r[\w\.]+['"][\s\);]+(\$\w+)[=\s]+wp_cre\w+[\(\s]+['"][^'"\$]+['"](?:[\s,]+['"][^'"\$]+['"])+[\s\);]+(\$\w+)[=\s]+new\s*WP_User[\(\s]+\21[\s\);]+\22\->set_role[\(\s'"]+admi\w+['"\s\);]+\}(?<X1262130>)))|[\s\('"]+init['"\s,]+\w{1,40}[\(\)\{\s]+(\$\w{1,40})[\s=]+['"][^'"]*['"];\s*(\$\w{1,40})[\s=]+['"][^'"]*['"]\;\s*(\$\w{1,40})[\s=]+['"][^'"]*['"];\s*if[\s\(]+username_exists[\s\(]+(?:(?:\24|\25|\26)[^;]+){2,4};\s*(\$\w{1,40})[^\}]+\}\s*else\s*\{[^\}]+\27\->set_role[\s\('"]+adminis[^;]+\;[\s\}\)]+\;(?<X1203520>)|[\s\(]+['"]\w+['"](?:[,\s]+['"](insert_theme_link)['"][\s\)]+;\s*function\s+\29\s*\(\)\s*\{\s*global\s*\$wpdb;\s*if\s*\(\s*\$wpdb->get_var\s*\([^;]{1,99}\b(link_url)\s*=\s*['"](http://[^'"\)]+)['"]+\)\s*==\s*\d+\)\s*wp_insert_link\s*\([^;]+['"]\30['"]\s*=>\s*['"]\31['"]+\)+;\s*\}(?<X1126001>)|[\s,]+['"](\w+)['"\s\)]+;\s*function\s+\33[\s\(\)\{]+if\s*\([^\};]{1,299}\b[ri](?:equir|nclud)e(?:_once)?[\s\(]+['"][^'"]*\bwp\-includes/registration\.php['"][\s\)]*;\s*if\s*\([^;\}]{0,99}=\s*wp_create_user[\s\(]+['"][^'"]+['"][^;]{1,199};(?:\s*\}){3}(?<X1194321>))|\(['"](?:[^'"]+['"],\h*['"](\w+)['"]\);\s*function\h*\35\(\)\s*\{\s*(\$\w{1,15})[\h\=]+['"](wordpress)['"];\s*(\$\w{1,15})[\h=]+['"]\w+@\37\.com['"];[^\{]{9,150}\{\s*\$\w{1,15}[\h=]+wp_create_user[\(\h]+\36,\s*\$\w{1,15},\h*\38[\h\)]+;[^\}]{9,199}\bset_role[\h\('"]+administrator['"\)\h]+;[\s\}]+(?<X1201841>)|init['"],\h*(?:['"](\w{1,20})['"]\);\s*\bfunction\h*\40\(\)[\s\{]+\bif\(\$_[GPRSC]\w{2,6}\[['"]key['"]\]\h*\W{2,3}['"]uploadupdate[^\?]{1,49}file_(?:ge|pu)t_contents\(\$\w{1,9},\h*['"]<\?php[^#]{1,199}(\$\w{1,9})[^;]{1,49};\w{1,20}\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\][^,]{0,49},\h*\41\);\}\}(?<X1189031>)|\bcreate_function\b[^;]{1,40}\bimplode\b[^;]{1,40}\barray_(?:map|walk)\h*\(['"]base64_decode['"],\h*\bunserialize\(get_option\([^;]{0,49};(?<X1184900>)))|\((?:[^;]{1,64}\)[;\s]{99,512}function\h*\w*\(\)\s*{[^\)]{1,199}aHR0cHM6Ly9hcGkuc3[^\)]{16,64}\);(?<X2264240>)|\h*['"]init['"]\h*,\h*function\h*\(\)\s*\{(?:\s*(\$\w{1,40})\h*=[^;]+;|\s*if\s*\([^!]+\})+\s*if[\h\(]+!\h*\45\b[^,]{0,99}\([^;]*\$\w{1,40}\h*=\h*wp_create_(user)[\h\(]+(?:\$\w{1,40}(?:\h*,)?\h*)+\)\h*;\s*(\$\w{1,40})\h*=\h*new\h+WP_\46\h*\([^;]+;\s*\47\->set_role\(\h*['"]administrator['"\);\s\}]+\)\s*(?:;|\Z)(?<X1191410>)|\s*['"]wp_head['"]\s*,\s*['"](\w{1,40})['"]\);\s*function\s+\49\(\s*\)\s*\{\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\D{2,3}\s*['"]\w{1,40}['"]\s*\)\s*\{(?:[^\?]{499,999}(\$\w{1,40})\s*=\s*['"]<\?[^\?]{499,999}file_put_contents\([^\)]+\50\);[^\}]{9,199}exit;(?:\s*\}){2}(?<X1134550>)|[^\}]{99,999}echo[^;]{1,99}\.str_replace\(\s*(\$_SERVER\[)[^\]]+\]\s*,\s*\52[^\]]+\]\s*,[^;]{9,199};\s*exit;\s*\}\s*\}(?<X1134570>)))|\h*\(\h*['"](?:\w{1,15}['"],\h*['"](\w{1,15})['"]\h*\);\s*function\h*\54\(\)\h*\{\h*if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\s*\{[^\}]{9,199}\bset_role\h*\(\h*['"]administrator['"][\);\}\s]+\}(?<X1191691>)|admin_head\h*['"]\h*,\h*['"]dolly_\w{1,9}['"]\h*\);\W{0,5}@eval\h*\(\$lyrics\h*\((?<X2174610>))|\s*\((?:['"]init['"],\s*['"](wp[_\-]\w{1,20}\d)['"]\);\s*(function)\s+\57\(\)\s*\{\s*if\s*\(\s*(?:isset\s*\()?\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\}]{1,99}\s*\58\s+wp[_\-]\w{1,20}\d\((\$\w{1,20})[^\?]{1,99}file_put_contents\(\59,\s*['"]<\?php\s[^;]+;\s*\}\s*\$\w{1,20}\s*=\s*curl_init\(\);(?<X2135762>)|[^,;]+,\s*function\s*\(\s*\)\s*\{[^\}]{1,499}\$(\w+)[\s=]+new\s+WP_User\s*\([^;]+;\s*\$\61\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;[^,\?#@%:/&]{0,149}?\}\s*\);(?<X1203730>)))|_filter(?:[\(\s]+['"]login(_redirect)['",\s_]+NAMESPACE[_\.\s]+['"][^;]+;\s*function\s*wp\63\w+[\s\(\)\{]+if[\s!\(]+file_exists[\s\(]+['"]([^'"]+\.js)['"\)\s]+\{\s*copy\s*\([^;:,]+\64["']\s*,\s*['"]\64['"\s\)]+;[^<]{0,9999}\becho\h*['"]<script>[^\n:/<>]{0,499}\.createElement[\(\s'"]+script(?<X2238391>)|[\h\(]+[^\)]+\);\s*function\s*\w+\((\$\w+),\h*(\$\w+),[^\{]+\{\s*if[\h\(]+wp_get_current_user[\h\(\)]+\->\h*user_login\h*\W{2,3}\h*base64_decode[\h\(]+[^\)]+[\s\)]+\{\s*\$\w+[\h=]+array[\h\(]+[^\)]+\);\s*if[\h\(]+!empty[\h\(]+\67[^\{]+\{\s*\66\[\67[^\}]+[\s\}]+return\h*\66;\s*\}(?<X1263890>)|\(['"]the_content['"]\h*,\h*['"](_[^'"]{1,9})['"]\h*,\h*\d{5,9}\);\s*function\h+\69\((\$\w{1,40})\)\s*\{\s*global\h*\$post;\s*if\h*\(\h*is_single\(\)\h*&&\h*\((\$\w{1,9})\h*=\h*@eval\(get_option\(['"][^'"]{1,99}['"][\h\)]+[!==]{2,3}\h*false\)\s*\{\s*(return)\h+\71;\s*\}\s*else\s+\72\h+\70;\s*\}(?<X1038391>))|Type(?:\h*application/x-httpd-(?:php|cgi)\h*\.nakanosec\b(?<X1222661>)|\s+application/x\-httpd\-cgi\s+(\.(?:con7ext|Index_Unknown1337))(?:\s*AddHandler\s+cgi\-script\s+\75\b)+(?<X1221531>)))|min_url\h*\(\h*['"]\h*options\-general\.php\?page=monit\h*['"\=]\h*\)[^#%`]{999,15000}\bfunction\h+hide_plugin_trickspanda\(\)\s*\{(?<X2169870>)|spect_x_forwarded_for\s*\(\s*\)\s*;(?<X2225351>))|ffiche\h+de\h*(Hack[^>]{0,150})['"]>\s*<(center)>\79</\80>\s*</a>(?<X2153063>)|l(?:ert\(['"](Anon[^\s\)'";]{1,40})\s+was\s+here['"]\);?</script\b[^@]{99,999}<title>\s*[thpf](?:ouch|[au]ck|wn)[e3]d\s+by\s+\82\b(?<X2159811>)|l(?:mediacloud\.com/\w{1,40}\.php\?['"];\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\{[^\}\{]{99,499}\$\w{1,40}\s*=\s*wp_insert_post\s*\(\s*\$\w{1,40}\s*,\s*true\s*\);(?<X2127060>)|ow\s+from\s+all\s+RewriteEngine\s+off\s+<Files\s+\*\.php\s*>\s*allow\s+from\s+all\s*</Files>\s*\Z(?<X1233081>)))|nonymous\h*Cyber[^;]{0,99};\s*(\$\w{1,15})\h*=\h*["']Office365[^\?]{9,250}\bmail\(\$\w{1,15},\h*\86,\h*\$\w{1,15}\);(?<X2170120>)|p(?:iKey:\h*['"]AIzaSyBwo8TUSo0k9ApBL6FfD-pBKY80F_leY-s["'][^\}]{1,99}\.firebase(?:app|io)\.com\b(?<X2145921>)|PLE\h+VBV:\h*['"]\h*\.\h*\$_SESSION\[['"]cc_name['"]\](?<X2138390>)))
\b(?:a(?:rr(?:2html\(\$_REQUEST\['\w+'\]\);(?<X1035211>)|_php_file\s*=\s*findshells\s*\(\s*\$_SERVER(?<X2048500>)|ay\((?:["']wp\-[^'"]+['"],){4}[^\*]{1,194}\barray\((?:["']wp\-[^'"]+['"],)+[^\?]{1,50}\bget([\(\s]+)['"]\w+://[^\/]+/\d\.txt['"]([\)\s]+)[^\*]{1,477}\bfile_get\w+[\(\s]+['"]\w+://hello\.(?:\w+\.)+xyz/\w+\.txt['"][\)\s]+[^\-]{1,5}str_replace\3(?:['"]\w*['"],)+\$\w{1,40}\4;(?<X2211041>)|ay\(['"]find\s+all\s+suid\s+files\b(?<X2050951>)|ay\s*\(\s*\(\s*string\s*\)\s*stripslashes\s*\(base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*=>2\s*\),\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\);(?<X1036212>)|ay_map\s*\(\s*['"]\w+['"]\s*,\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*['"]\w+['"]\s*\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*\)\s*;(?<X1036231>)|ay_walk[\s\(]+\$\w{1,40}[,\s]+['"][^'"]+['"][\)\s]+;\s*if[\(\s]+isset[\(\s]+\$_[GPRC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:echo\s*)?file_put_contents\s*\([^;\[]*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}=]{0,40}\}[^%]{0,999}(?:<form|\bfilemtime)\b(?<X2227910>))|ssert\(['"]\\x65\\x76\\x61\\x6C\\x28[^'"\);\s]{9,199}['"][^'"\);\s]{999,9999}['"](?:\\x[a-f0-9]{2})+['"]\);(?<X1124510>)|tOptions[=\s]+\{\s*['"]\w+['"][\s:]+['"][a-f\d]{32}['"][,\s]+['"]\w+['"][:\s]+['"]iframe\b[^;\.]+;\s*document\.write[\(\s'"]+<[scr'"\+\sipt]{9,}type[=\s]+['"][^\+:;>\?]+src[=\s]+['"]https?[^:><]{9,99}https?:['"]\s*\?[^/><]+//[^/]{1,40}\.com/\w{32}/invoke\.js['"][^>]{0,99}></[scr'"\+\sipt]{9,}>['"\s\);]+\Z(?<X1230270>))|B(?:[a4@]ckD[o0][o0]r\s*</title>(?<X2222430>)|a(?:ckdoor\s+Destroyer[^'"]{1,30}['"]\s*//(?:\w+\.)?exploit\-db\.com\/search\?q=Linux\h*Kernel(?<X2278281>)|nk:[^\;]{1,99};\s*\$\w+\s*=\s*fopen\(['"](?:../){3}\w+\.txt['"](?<X2266320>)|se(?:64_decode\('ZXJyb3JfcmVwb3J0aW5n'\),base64_decode\('Y3Vyb(?<X2055000>)|['"]\.\(32\*2\)\s*\.\s*['"][_deco'"\.]{6,}['"]\s*;(?<X2043843>)|name\(\$file\)\s*==\s*"configuration\.php"\s*\|\|\s*basename\(\$file\)\s*==\s*"wp-config\.php"\s*\)\s*\)(?<X2049860>)))|londe\s+girl\s+dressed\s+undressed\s*<a\s+href\s*=\s*['"]https?://merky\.de[^<]{1,64}</a>\s*biggest\s+mature\s+swingers\s+party\s+dreams\s+gentlemen\s+club\s+melbourne\b(?<X1261880>)|o(?:dy>[^\{\}]{9,199}\becho\h*[base64_dco'"\h]{9,25}\(\$_COOKIE\[[^\]]+\]\)[^\{\}]{99,599}w</html>(?<X2188930>)|ndishee\d*\.php['"]\h*(?:\)\h*)?;(?:\s*[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^'"]{0,99}\bbondishee\d*\.php['"]\h*(?:\)\h*)?;){2}(?<X2157881>)|t(?:admin\.php['"]\h*\);\s*echo\s*['"]<script\b[^\$,\|\+#%&]{9,999}<title\b[^>]{0,99}>\s*Boteye\s*(?:\w{1,40}\s*)?v\s*[\d\.]+\b(?<X2166670>)|net\h*Panel[^\{]{9,199}\bprint\h*['"][^<]+Bots\?\h*<y/n>(?<X2196760>)))|rute\h*force\h*Attack\h*tool\h*for\h*wordpress[^:]{1,80}(.)n00py\23\s*['"]+\s*print\b(?<X2152760>)|u(?:g7sec::w[0o][0o]t\((?<X2193593>)|y\s*zydena\s*online\s*<a\s*href=['"]https?://[^<]+<.a>\s*no\s*prescription\b(?<X1251380>))|y(?:\h+Haxor\S*</title>(?<X2265940>)|pass\s*phpsuhosin\b[^@\{\?]{99,499}\$\w{1,40}\h*=\h*\$_[GPCSR]\w{2,6}\[(?<X2155940>)))|c(?:a(?:ll_user_func(?:[\(\h]+(function)[\h\(\)\{]+(?:(\$\w+)(?:\->\w+){0,2}[\h=]+new\h+\\stdClass[\s\(\)]+;){4}[^\?\n]{1,999};\h*(\$\w+)[\h=]+(\29[\h\(\)]+use[\h\(]+\30)[\h\)]\{[^\n]{9999,}\(\h*['"][^'"]*['"][\h,]+\32[\h,]+\31\h*\)[^\n\?]{999,}\31[\h\(]+(?:false|true)[,\h]+['"][^'"]+['"][\h\);\}]+;(?<X1201731>)|\s*\(\s*create_function\s*\(\s*\w{1,40}\s*\,\s*str_rot13\s*\(\s*strrev\s*\(\s*['"][^']{1,400}'\)\)\)\);(?<X1041690>))|se\h+['"](?:mass.?deface['"]:[^\{]{1,199}\{\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\}]+\bwhile\h*\([^\)]+\breaddir\h*\([^\}]{1,199}\b[cm]o(?:ve_uploaded_file|py)\h*\(\35,\h*\$\w{1,9}(?<X2179680>)|shell['"]:\s*(\$cmd(?:exec)?\d*)\h*=\h*\$_[GPRC]\w{2,6}\h*\[[^\]]+\];[^\[]{0,499}=\h*\w{1,40}\(\h*\37\h*,(?<X2182900>))|se\s*(?:'exesys':\s*\$content\s*\.=\s*\$shell->exesysform\(\);(?<X2050760>)|["']update["']\s*:\s*if\s*\(\s*file_put_contents\s*\(\s*__FILE__\s*,\s* base64_decode\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\s*['"]\w+['"]\s*\]\s*\)\s*\)\s*\)\s*echo\s*['"]OK['"];(?<X2045920>)|['"]hijack['"]\s*:\s*\$title\s*=\s*['"]cPanel(?<X2223600>))|se(?:\s+['"]((?:shell_)?exec|passthru|popen)['"]:[^;]{1,99}\b\42\h*\([^\?]{1,999}\bfunction\s+lock\w{1,19}\h*\([^\}]{1,199}\bfile_put_contents\h*\(\h*(\$\w{1,40})\h*,[^;]{1,99};\s*@?touch\h*\(\h*\43\h*,(?<X2171180>)|\s[^:]{1,9}:(\$\w{1,40})(=isset\()(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)&&!is_array\(\47\)\?\47\s*:\s*['"]{2};(\$\w{1,40})=fopen\([^;]+;[^\?\{\}]{1,99}\45\46\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\?(base64_decode\(\45\))\s*:\s*myconv\(\49[^;]+;if\(!?fputs\(\48,\45\)[^#%\^\?]{999,1999}<title>[^/<]{1,49}\bshell\b(?<X2134050>))|tch\(Exception(\$\w{1,40})\)\{[^=]{1,40}array\(['"]success['"]=>false,['"]msg['"]=>\51->getMessage\(\),?\)+;\}+public\s*static\s*function\s*\w{1,40}\(\)\{\$\w{1,40}=(?:str_replace\([^\(]{1,40}){3},dirname\(__FILE__\)+;\$\w{1,40}=htmlspecialchars\(sprintf\(['"]//%s%s['"](?<X2130840>))|cc=str_rot13\(gzinflate\(base64_decode\(\$code_(?<X2051170>)|d\s*\./\h*;\s*(?:curl|wget)\b[^:\n;]{1,199}http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/[^\&\n]{1,999}chmod\s+\+x\s+(\w+)\h*;\s*\./\54[^\n\|]+\brm\s*\-r?f\s*\./\54\h*;(?<X2242312>)|h(?:a(?:nge_files\((\$\w{1,20})\.['"][^\.]{1,20}\.html['"]\h*,[^/'"]{2,40}\56\.['"]/bajatax['"]\);(?<X2165280>)|rCode\(\$\w+\);\s*function charCode\(\$\w+\)\{\s*\$\w+\s*=\s*array\(.+?\$\w+\[\d+\];return\s+EvAl\(\$\w+\);\s*\}(?<X2044402>)|rset\s*=\s*UTF-8['"]>\s*<title>\s*Google\s+Drive\s*-\s*Google\s+Drive\s*</title(?<X2052020>))|mod\((?:(\$\w{1,20}),\d+\);\s*file_put_contents\(\60,[^\)]+\);\s*\$\w{1,20}=fopen\(\60,[^\)]+\)[^;]{0,40};\s*\$\w{1,20}=['"][^'"]{999,}['"];[^/<]{50,200}\becho\h+["']<[^>]+>[^/<]{0,20}\bshell\b(?<X2198760>)|\s*dirname\(__FILE__\).+?{\$a=Array\("/\.\*/e.+?_\d+\(\d+\)\);(?<X2044161>))|mod\h*\(\h*['"][^'"]{1,99}/(wp\-[^'"/]{1,99}\.php)['"]\h*,\h*\d{3,4}\h*\);\s*@?file_put_contents\h*\(\h*['"][^;]{1,99}\b\63['"]\h*,\h*base64_decode\h*\([^;]{1,99};\s*@?[ir](?:nclud|equir)e(?:_once)?\h*(?:\(\h*)?['"][^;]{1,99}\b\63['"](?:\)\h*)?;\s*@?unlink\h*\([^\)]{1,99}\b\63['"]\h*\);(?<X1158671>)|r[\(\s]+hexdec[\(\s]+(?:\$\w{1,40}\[[^\]]+\][\s\.\)]+)+;[^=]{0,199}\bfunction\s*perms[\s\(]+(\$\w{1,40})[\s\)\{]+\$\w{1,40}[=\s]+fileperms[\s\(]+\65(?<X2225581>))))
\bclass(?: PluginJoomla.+\$\w+\s*=\s*@?\$_COOKIE\[\'\w+\'\]\;\s*.*\$\w+\s*=\$\w+\(@?\$_COOKIE\[\'\w+\']\)\;.+\$\w+\s*=\s*new\s*PluginJoomla;(?<X2044911>)|\h*(\S{1,40})\h*\{\s*function\h*__destruct\h*\(\)\h*\{\s*@?(\$\w{1,40})\h*=\h*['"][^;]{12,};\s*@?\3\h*=\h*\3\h*\(\h*['"]{2}\h*,\h*\$this\->(\w{1,40})\h*\)\h*;\s*return\h*@/?\3\h*\(\h*\)\h*;(?:\s*\}){2}\s*@?(\$\w{1,40})\h*=\h*new\h+\2\(\);\s*@?\5\->\4\h*=\h*&\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;(?<X1161590>)|\h*(\w+)\{[^\?]{9,399}\bpassword[\h=]+\w+[\h\(]+addslashes[\h\(]+['"]password['"]\.\$_POST\[['"]ftp['"][^\?]{9,199}\bif[\h\(]+md5\(@?eval[\h\(]+\$\w+\h*\->\h*call[\s\(]+new\h*\7[\h\(\)]+\->\h*getUsername[\s\(\)\{]+sprintf[\h\('"]+hello['"\)]+;\s*\}\s*\}\s*\}(?<X1273360>)|\h*(\w{1,15})(?:\b[^\?]{99,499}(\$\w{1,15})[\h=]+\$_COOKIE;[^\(]{0,20}\(count\(\10\)[\h=]+\9::\w\(\d\)[^\n]{0,250}\beval\(\$\w{1,15}\)\)[\h:]+\10;(?<X2210400>)|\s*\{\s*private[^;]+;\s*public\s*static\h*function\h*(\w{1,15})\([^\?]{9,4999}\b(header\(\9::\12\()[^\;]+;\s*@?\13[^#]{9,3000}\bfputs\(\$_\w{1,15},\s*\$_\w{1,15}\);(?<X2198182>))|\h*(\w{1,9})\h*\{\s*(public)\h*(function)\h*root\(\)\s*\{\s*return\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\];\s*\}\s*\16\h*\17\h*executebin\(\$\w\)\s*\{[^\?]{99,7999}(\$\w{1,9})\h*=\h*new\h*\15;\s*\18\->run\(\);(?<X1178520>)|\h*(_[^\x00-\x7F]{1,20})\h*\{[^\*\}]{9,999}return\h+BasE64_DecODE\(self::\$[^;]+;\h*(/\*Bloodninja:)[^#!]{99,9999}if\h*\(\h*!\h*(?:isset|empty)\h*\21[^\}\{><!#]{99,999}\20::[^;\v]+;(?<X1160400>)|\h*(shellmanager)[\s\{]+private\s*\$shells\b[^\?]{0,250}function\s*loadshells[\s\(\)\{]+global\h*\$\23;(?<X2146101>)|\h*(so_\w+)\{\s*private\h*\$(\w+);\s*public\h*function[^\{]+\{\s*(\$\w+)\->\26=base64_decode\([^\?]{99,4000}\$_SESSION\[['"]shell['"]\]=\27\->get_api\([^\?]{99,3500}\bnew\h*\25\(\);(?<X1252520>)|\h*=\h*['"](shell)['"]>\s*<\?php\h*echo\h*htmlspecialchars\h*\(\h*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\$_[GPRSC]\w{2,6}\[['"]\29['"]\]\h*\)\h*\);(?<X2167950>)|\h*\w{1,25}\{\h*public\h*static\h*function[^\n]{999,4500}\bempty\(\$_SESSION\[(base64_decode\()[^\)]+\)\]\[\31[^\)]+[\)\]]+\{\$\w{1,15}[\h=]+explode\([^\n]{99,399}\b(?:exit|die)[^;]{0,9};\}\}(?<X1198560>)|\h*indoxploit\h*\{\s*public\h*\$dork\h*;(?<X2169371>)|\h+(\w+)(?:\h*\{\s*private[^#]{20000,45000}\bforeach[\s\(\[,]+(?:['"][\./]+['"],\s*){4}[^\]]+\]\h*as\h*(\$\w+)[\s\)\{]+if[\h\(]+file_exists[\h\(]+\35[\h\.]+[^'"]+['"]wp\-load\.php['"][^\?]{99,199}\berror_reporting[\h\(]+(?:0|NULL)[\h\)]+;[^\?]{99,650}\belse[\s\{]+\34::init[\h\(\)]+;(?<X2210242>)|\{[^\?]{1,999}\bfunction\h+(\w+)\(\)\{(\$\w+)=\$_[GPCSR]\w{2,6};\(\38\b(?:[^;]{0,99}\38\[\34::\w+\(\d+\)\]){2}[^;:]+:\38;\s*return\s*\34::\w+\(\d+\);\}\s*\37\(\);\s*(?:\?>|\Z)(?<X2211992>))|\h+(\w{1,40})(?:\h*\{\h*public\h*function\h+__invoke\h*\(\h*(\$\w{1,40})\h*\)\h*\{\h*@?eval\h*\(\h*\41\b[^\)]+\);(?:\h*\}){2}\s*@?call_user_func\h*\(\h*new\h+\40\h*\(\h*\)\h*,\h*\$\w{1,40}\h*\);(?<X1171450>)|\s*\{\s*public\h*\$(\w{1,40})\h*=[^;]+;\s*\bfunction\h*__destruct\h*\(\h*\)\s*\{\s*@?(?:eval|assert)\h*\(\h*\\?['"]?\$this\->\w{1,40}\\?['"]?\h*\)\h*;(?:\s*\}){2}\s*(\$\w{1,40})\h*=\h*new\h*\40\h*\(\);\s*(\$\w{1,40})\h*=\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\];\s*\44\->\43\h*=\h*\45\h*;(?<X1169292>))|\h+(conectBase)\s*\{[^\{]{9,99}\bfunction\h+get_content_code\([^%`]{999,6000}\}\s*\$\47\h*=\h*new\h+\47\(['"][^'"]{1,20}(?:cGl6ZGVjLW5lYXIu|emRlYy1uZWFyLndz|aXpkZWMtbmVhci53)[^'"]{2,30}['"]\);(?<X1161760>)|\h+[a-f\d]{33}\s*\{(?:\s*p(?:ublic|rivate)\h*\$[a-f\d]{33}\h*;){9,}\s*public\h+function\h*__construct\h*\(\)\s*\{(?:\s*\$this\->[a-f\d]{33}\h*\(\)\h*;){9}(?<X2169491>)|\h+deRanSomeware\s*\{[^\{\)]{0,20}\bfunction\h+shcpackInstall\(\)\s*\{(?<X2181270>)|\h+KuzuluyArt[\s\{]+(?:public\h*)?\$\w{1,20}=['"]https?://[^'"]{9,40}\.id["'];(?<X2198650>)|\h+Macros\h*\{[^#]{4999,9999}\}\s*echo\h+serialize\h*\(\h*array\h*\((?:\h*["'](?:total|sent|success|error)['"]\h*=>\h*[^,;]{0,49},){4}\h*["']rcpt['"]\h*=>\h*\$\w{1,40}\h*\)\h*\);\s*(?:\?>\s*)?\Z(?<X2178772>)|\h+Spammer\((thread)ing\.\53\):\s*def\h+__init__\(\h*self\h*,\h*url,\h*number\h*,\h*proxy\h*\):(?<X2150800>)|\s*(\w+)[\{\s]+(?:private|public)\s*static\s*\$\w+;[^\(]{0,15}function\h*(\w+)\([^_]{9,400}\}\}\s*function\s*(\w+)\([^\)]+\)[\{\s]+(\$\w+)=\$_[GPRSC]\w{2,6};\s*\(\58[^\[]+\58\[\55::\56\([^\}]{99,400}\beval\([^\}]+\}\s*\57\(\);(?<X1256480>)|\s*(\w{1,40})\s*\{\s*(?:\[\w+\(\w+\)\]\s*=\s*null;[^\}\{:]{0,499}=\s*['"]https?://cdnreport\.net[^'"]*['"]\s*;[^\n\?]{99,9999}\]\(['"]href['"],this\[['"][^'"]+['"]\]\+['"]\?[^\n<]{9,999}\bwindow\[[^\]]+\]\h*=\h*new\s*\60\h*\([^\}\{\n]{1,499}\}\},\w+\);(?<X1259451>)|function\s*\w{1,40}\s*\(\s*(\$\w{1,40})(?:[\s,]+&?\$\w{1,40}){3}[\s\)]+\{\s*(\$\w{1,40})[\s=]+parse_url[\s\(]+\62[\s\);]+(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\(]+['"]['"][\s,]+\63\[[^\]]+\][\s\);]+\64\s*\(\)[^\}]+\}[\s\}]+stream_wrapper_register[\s\(]+['"][^'"]+['"][\s,]+['"]\60['"][\s\)]+;(?<X1194810>))|\s*(colorize)\{(private\s+static)\s*\$\w{1,40}=array\(\);(\67\s+function)\s*swap\(&(\$\w{1,9}),&(\$\w{1,9})\)\{(?:(?:\69|\70)=\69\^\70;){3}\}\68\s*KSA\([^&\?]{99,999}\$\w{1,40}=new\s*\66;(?<X2134940>)|\s*\=\s*['"]tit['"]>\s*Mailer\s*Inbox(?<X2051730>)|\s*\w{1,40}\s*\{\s*(?:static\s*(function)\s*\w{1,40}[\(\)\s\{]+eval[\(\s]+(self::)(\$\w{1,40})[\)\s;]+\}\s*\73\s*__construct[\(\s]+\$\w{1,40}[\)\s\{]+\74\75[=\s]+\$\w{1,40}[^\?]{99,9999},['"]\w+['"][\);\s]+(\$\w+)[=\s]+new\s*\w+[\(\s]+\$\w+[\);\s]+call_user_func[\(\s]+array[\(\s]+\76[,\s]+['"]\w*['"][\)\s]+;(?<X1248830>)|var\s*\$\w{1,40}[\s;]+function\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)\{]+(\$\w{1,40})[\s=]+\$_SERVER\[['"]HTTP_USER_A[^\]]+\][\s;]+if[\s\(]+preg_match[\s\('"/]+Apple[^'"]*['"][\s,]+\78[\s,]+(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})[\s=]+str_replace[^;\[\]]+\79\[[^\]]+\][\s\);]+\80[\s=]+explode\b(?<X2198741>))|\s*\w{1,40}\{private\s*static\s*(\$\w+);\s*public\s*static\s*function\s*\w+[\(\s]+\$\w+[,\s]+\$\w+[\)\{\s]+if[\(\s]+!\s*self::\82\s*\)[^\n]{999,}@touch\(\$_SERVER\[\w+::\w+\([^;\n]+\),\$\w+\);(?<X1252640>)|\s*_keys\s*\{[^\{\},]{0,99}\bfunction\s*_dekr[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{[^\}\+]{9,999}\+\+(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})\[\84\][=\s]+chr[\s\(]+ord[\s\(]+\85\[\84\][\s\)]*\^\s*ord[\s\(]+\$\w{1,40}\[\84%\$\w{1,40}\][\s\)]+;[^\^]+\bpreg_replace\b(?<X2223221>)|\s*Foo\s*\{\s*function\s*__construct[\(\)\s]+\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\->\w+[\(\s]+\$\w{1,40}\->\w+[\)\s]+;[^\^]{0,999}\$\w{1,40}\[\$\w{1,40}\]\s*\^\s*\$\w{1,40}\[\$\w{1,40}%[^_]+\barray[\(\s]+['"]['"\h\,creat_funio]{15,40}['"][\s\)]+;[^\}]{99,}['"][;\s]+\}[^\(]{0,40}\bnew\s*Foo\(\);(?<X1211270>)|\s*Get_?(link)s\s*\{\s*var\s*\$host\s*=[^`]{499,3999}?(?:return\s*['"]<!\-\-\88\s*error\-\->['"];|\$data\s*=\s*file_get_contents\(\$file\);\s*return\s*\$data;|\$this\->\88s\s*=\s*file_get_contents\(\$this\->\w{1,40}\);)(?:\s*\}){2,3}(?<X1037794>)|\s*Ma\w+\s*extends\s*Mage_\w+\s*\{\s*public\s*function\s*indexAction\s*\(\s*\)\s*\{\s*@?eval\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*\w+\s*\]\s*\)\s*;\s*\}\s*\}(?<X1037400>)|\s*pony_db\s*\{\s*public\s*\$db_link;\s*protected\s+\$database;(?<X2123142>)|\s*wppl(?:loadcontent|aginload)\s*\{(?:(?<X2157201>)|[^\}]{99,499}\bconst\s*\w{1,40}\s*=\s*(?:['"]\s*)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPCSR]\w{2,6}\[(?<X2157190>))|\s+(\w+)[\s\{]+[^;\(\{=\}]*function\s+__(?:con|de)struct[\s\(\)]+\{\s*((\$\w+)[\s=]+(\$this\s*\->\s*))\w+[\s\(]+\97(\w+)[\s\)]+;\s*\95\w+[\s\(]+\97\w+[\s\(]+\96[\s\)]+;\s*\95\w+[\s\(]+\96[\s\)]+;[^\?#:/]{499,4999}\$\w+[\s=]+['"][^'"]{9999,}['"];[^;=\$]{0,19}\$\98\s*=[^;]{99,};\s*\}\s*new\s+\94[\s\(\)]+;(?<X1196991>)|\s+(\w{1,20})\s*\{\s*public\s*(function)\s*__cons\w+[\(\)\s]+\{[^=]{9,999}(\$\w{1,9})[=\s]+sys_get_t\w+[^\}]+file_put_contents[\(\s]\102[^=]*\w{1,30}[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\$_[GPRSC]\w{2,6}\[[^!]{9,999}\101\s*\w{1,50}[\s\(\)\{]+(\$\w{1,9})[\s=]+['"]\w*['"];\s*return\s*\103[^!<]*\100[\s\(\)]+;(?<X1257071>))
\bc(?:lass(?:\s+(\w{1,40})\s*\{(?:(?:\s*var\s*\$\w{1,40};){4}[^%]{3000,15000}(\$\w{1,40})\s*=\s*\$\w{1,40}\s*\.\s*(base64_decode)\s*\([^;]{99,599};[^!@]{1,99}!@?include_once\s*\(\3\s*\(['"]aHR0cDovLw=?=?['"]\)\s*\.\s*\2\)[^!@]{1,99}\1[^\}]+\2[\)\s]+\{(?:\s*\}){2}(?<X1126883>)|[^\{\}]+\b(function\s+)__construct[\s\(]+(\$\w+)[^\{;]+\{\s*(self::\$\w+)[\s=]+\6;\s*@?eval\b[^\(;]{0,99}\(\s*(?:null\.)*\7\s*\);\s*\}\s*\}\s*\5(\w+)\s*\([^\}]{99,499}\}\s*(\$\w+)[\s=]+(?:null\.)*\8[\s\(]+@?\$_[GPCSR]\w{2,6}\b[^;]+;[^;\(]{0,99}\bnew\s+\1[\s\(]+\9[\s\)]+;(?<X1196330>))|\s+(\w{1,40})\{[^\(\{]{9,499}\bfunction\s*__construct\(\)\{\$this\->\w{1,40}=hex2bin\(['"]68747470(?:73)?3a2f2f636f6e6e6563742e61706965732e6f72672f['"]\);[^@]{999,4999}\bnew\s*\11\(\);\s*(?:\?>\s*)?\Z(?<X2152551>)|\s+(CM_base)\s*\{[^\}\{]{99,999}function\s+\13\(\$options\s*=\s*null\)\s*\{(?<X2135010>)|\s+\w+\{(?:(?:public|private|static)\s*)*\$(\w+)=['"]{2};function\s*__(?:con|de)struct\(\)\{[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(['"]?\$this\->\15['"]?\);\}\}(?<X2196801>)|\s+bb_press2.+?const\s*SCRIPT_SRC\s*=\s*'data:text/javascript;base64,(?<X2046170>)|\s+Get_?links\s*\{\s*var\s*(\$(?:host|path))\h*=[^%!]{899,1599}(\$\w{1,40})\h*=\h*@?file_get_contents\h*\([^;]+\18[^;]+\);\s*preg_match\h*\([^;]+\19\h*\)\h*;\s*\19\h*=\h*@?\19\[\d+\]\h*;\s*return\h+\19;\s*\}(?:\s*return[^;]{0,50};)?(?:\s*\}){2}(?<X1155552>)|\s+PlgSystemXcalendarJoomlaBase[^\{]{0,40}\s*\{(?<X2044512>))|o(?:de(?:';\$vvv=\$vvv\(str_replace\("\\n"(?<X2044271>)|\.google\.com/p/b374k-shell(?<X2043581>)|_inject_sape\h*=\h*['"]\h*class\h*_[^\n]{9,99}/\*Bloodninja\b(?<X2146890>)|d.by.azerakhsh.hunter\s*\-\->\s*<script\b(?<X2172900>))|lor=.FFF5EE>"\.shell_exec\('ls -la'\)(?<X2050210>)|n(?:f\s*=\s*@file_get_contents\(\s*\$isSecureProtocol\s*\.\s*\$this->normalizedTag\s*\.\s*\$configNormalize\s*\.\s*\$this->normalizeTagPattern(?<X2050290>)|st\s*(_0x\w+)\s*=\s*_0x\w+;\s*\(function\b[^<>\n]{1,4096}\batob\([']aHR0[^'"]{1,32}['"]\+[^<\n]{1,1024}\28;console\[_0x[^;]+;\}\);(?<X1263281>)|tent(?:="0;data:text/html;base64,DQo8IURPQ1RZUEUgaHRtbD48aHRtbCB4bWxucz(?<X2050420>)|\h*=\h*['"]Hacked\h*By\h*Mr\.xBarakuda[^#]{99,500}<title>#IndonesianAttacker</title>(?<X2138691>))|toh\h*kamus\h*bot[^\{]{9,99}\$\w{1,15}\h*=\h*array\((?<X2171910>))|py(?:[\(\s]+\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*["']/wp\-(?:includes|admin)/(?:[^/]+/){0,9}class[\.\-][^'"]+\.php['"]\s*,\s*\$_SERVER\h*\[['"]DOCUMENT_ROOT['"]\]\s*\.\s*['"]/(?:index|wp\-blog\-header)\.php['"][\)\s]+;(?<X1210030>)|\('http://.+?'\s*,\s*'\w+\.php'\);exit;(?<X1034271>)|\((\$_FILES\[[^\]]+\])\[[^\]]+\]\h*,\h*\35\[[^\]]+\]\)\h*\);[^\{]{20,99}\$\w{1,20}\[[^\]]+\]\h*=\h*['"]toolz\.gq['"];(?<X2141800>)|\(\$_FILES\[[^@#]{99,2999}\bunlink\(\$_[GPCSR]\w{2,6}\[[^@#%:]{99,2999}\bfunction\h+perms\((\$\w{1,40})\)\{[^\}]{1,199}(\$\w{1,40})=fileperms\(\37\);[^\}]{1,199}\bif\(\(\38\h*&\h*(0x\w{4})\)==\39\)(?<X2182402>)|\(\$link,\$path\.\$name\);\s*if\(shell_exec\('echo\s*index'\)\s*==\s*'index'\s*\)\s*\{\s*shell_exec\(\s*'touch(?<X2049480>)|\(\s*\$\w{1,9}\s*\.\s*\$\w{1,9}\s*,\s*\$\w{1,9}\s*\.\s*\$\w{1,9}\s*\)\s*;\s*\}\s*\}\s*function\s+system_custom\s*\(\s*\$\w{1,40}\)\s*\{\s*\$[^\\}]{1,40}\s*if\s*\([^\(]{1,40}\(\s*['"]exec['"](?<X2057280>)|\h*\(\h*['"]/etc/passwd['"]\h*,\h*['"][^'"]{1,40}['"]\h*\)\h*;(?<X2192691>)))|r(?:eate(?:_symlink':\s*if\s*\(!empty\(\$_POST\['destination'\]\)\)\s*\{\s*\$dest\s*=\s*relative2absolute\(\$_POST(?<X2050842>)|d\h*by\h*\w{2,9}\s*(?:\\[rn]){1,2}\W{9,99}['"];\s*\$\w{1,20}\h*=\h*['"]From:[^<]{2,30}<\h*re[sz]ults?@[^;]{2,20};\s*mail\h*\([^\)]+\);\s*@?header\h*\((?<X2174151>))|ontab\h+\-l\h*>[^;\n]{9,99}file_get_contents\(\\['"]\\\\150\\\\164\\\\164\\\\160\\\\163\\\\72\\\\57\\\\57[^;]{40,199};(?<X2205850>))|ur(?:l_(?:close\([^\)]{1,40}\);\}\w{1,40}\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);(?<X2122560>)|exec(?:[\(\s]+['"]>?https?://javaterm1\.pw/[^'"]+['"]\s*\)(?:\s*;)?(?<X1255702>)|[^%<>]{8,499}From\:\s\w+\<yochchasedemonsyochchaser\.xyz\>(?<X2233814>)|\([^\{]{9,99}<form[^;]{1,15}\bmethod=['"]post['"][^\{]{20,300}\{\s*if\(copy\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^\-]{99,300}(\$\w{1,20})=[^;]{1,30}/wp\-(?:content|includes)/\w{1,20}\.php['"];[^\(]{2,20}\bfopen\(\50,['"]\w\+?['"]\);[^\?]{99,700}\bunlink\(__FILE__\);(?<X2186431>))|getinfo\(\s*\$\w{1,40},\s*CURLINFO_CONTENT_TYPE\s*\)\s*\);\s*(\$\w{1,40})\s*=\s*preg_replace\(['"]#\^\.\*\?\\<html#si['"],\s*['"]<html['"],\s*\52\s*\);\s*\$\w{1,40}\s*=\s*\52;\s*\$\w{1,40}\s*=\s*\$_SERVER\[['"]?SCRIPT_NAME['"]?\];(?<X2052950>)|init\("file:///"\.\$m\."\\x00/\.\.(?<X2051020>)|multi_(?:close\h*\(\h*\$\w{1,40}\h*\);\s*(\$sendClear)\h*=\h*@?json_encode\h*\(\$ccServerResponce\);\s*(?:echo\h*['"][%!]+['"]\h*\.\h*\55\h*\.|file_put_contents\h*\([^;]+['"]\h*\,\h*\55\h*\,)(?<X2144802>)|exec\([^\?:=]{1,499}\$(\w+)=(TaskGenerator::)\w+\(\$_[GPCSR]\w{2,6}\[[^\?:]{1,499}\$(\w+)=\58\w+\(\$\57\);\$\59=TaskExecutor::[^;]+;(\$\w+)=Array\(\);foreach\(\$\59\s*as\s*(\$\w+)\)\{\$\w+=\61\->\w+\(\);[^;]+\60\[\]=[^;]+;[\s\}]+echo[^;]{0,199}\60[^;]+\.PHP_EOL;\Z(?<X2212891>)|init\(\);\s*if\s*\(version_compare\(PHP_VERSION,\s*['"][57]\.\d+\.\d+['"]\)<0\)\s*\{(?:\s*echo\s*['"]%%[^'"%]{5,40}%%['"];\s*exit[^;]{0,9};\s*\}\s*){2,}\}\s*\}\s*class\s+TaskGenerator\s*\{(?<X2123993>))|setopt(?:[\(\s]+\$(?:\S{1,40}\s*,\s*CURLOPT_URL\s*,\s*['"]https?://['"]\s*\.\s*\$_GET\h*\[['"]looping['"]\]\s*\.\s*(?:['"]\.\d+\.\d+\.\d+/|\s*['"]/['"]\s*\.\s*\$_GET\[[^\]]+\][^;]+)(?:\w+\.txt['"][\)\s]+|['"]\s*\.\s*\$_GET\[[^\]]+\][^;]+|=\s*\$_GET\[[^\]]+\]\s*['"]\s*\)\s*);(?<X2200953>)|\w{1,40}\s*,\s*CURLOPT_URL\s*,\s*str_rot13[\(\s]+['"]uggc://ebv777\.[^'"]+\.cuc['"\s\)]+;(?<X1195490>)|\{\$\{['"]GLOBALS["']\}\[[^\]]+\]\}\s*,\s*CURLOPT_URL\s*,\s*(['"])https://gitlab\.com/jasonrondiguez/[^'"]{9,199}\.txt\66[\s\)]+;(?<X1224570>))|\((?:(\$\w{1,40}),CURLOPT_URL,['"]https?://[\d\.]{7,15}/[^;]{1,99};[^\?>\{\}=]{99,999}\$(\w{1,40})=curl_exec\(\68\);file_put_contents\(['"]([^'"]{1,99})['"],(?:\w{1,40}\(){1,3}\$\69\)+;[^>\?]{0,199}\b\w{1,40}\(['"]\./\70\b[^;]{1,99};unlink\([^;]{1,199}\b\70['"]\);(?:\?>)?\Z(?<X2174700>)|\$ch\s*,\s*CURLOPT_URL\s*,\s*"file:file:///(?<X2050741>))|\h*\(\$(?:\w{1,20}\h*,\h*CURLOPT_COOKIEFILE\h*,\h*\$GLOBALS\[['"]coki['"]\]\);[^://]{99,900}(\$\w{1,20})\h*=\h*(?:url|file)_get_contents\h*\(['"]https?://[^'"\-]{9,99}/php.backdoor/[^\.]{9,99}\.php['"]\);\s*@?eval\h*\(['"]\?>['"]\.\73\);(?<X2180550>)|hydracurl\b[^\\\}\?@]{9,150}\$\w{1,20}\h*=[^/;]{2,40}/TempCookiesFuck/(?<X2183500>))|(?:\h*\(\h*\$\w{1,40}\h*,\h*CURLOPT_URL\h*,\h*['"]ftp://[^@]{499,999}\b[pe](?:rint|cho)\b[^;]{9,199}\b[CH]r?ack(?:ing|ed)\s*success(?:ful(?:ly)?)?\b(?<X2151030>)|\s*\(\s*(\$cu)\s*,\s*CURLOPT_RETURNTRANSFER\s*,\s*\d\s*\)\s*;\s*(\$\w{1,40})\s*=\s*curl_exec\s*\(\s*\77\s*\)\s*;\s*curl_close\s*\(\s*\77\s*\)\s*;\s*@?\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\78\s*\)\s*;\s*\}\s*;\s*die\s*\(\s*\)\s*;\s*\?>\s*\Z(?<X2054274>)|\s*\(\s*\$\w+[,\s]+CURLOPT_URL[,\s]+base64_decode\s*\(\s*['"]aHR0cHM6Ly9naXRsYWIuY29tL0JsYWNrSGF4b3IxMzM3L3[^;]+;(?<X1257830>))))|(?:LOPT_URL,['"]https?://spox\-coder\.\w(?<X2235084>)|sor:url\(['"]https?:///?(?:\w{1,9}\.)?elhacker\.net/\w{1,20}\.cur['"]\)(?<X2152832>)))|ustom\h*shell\h*\w{1,15}</title>[^#]{9,499}<\?php\s*echo\h*\$_[GPRSC]\w{2,6}\[['"]command['"]\](?<X2169860>)|yber(?:\h*team_[^\{]{99,350}_Hacked\h*by[^\}]{99,499}\}\s*else[\s\{]+mail\h*\([^\)]+\);\s*header\h*\((?<X2150742>)|\s*Team[^<>]{0,40}</title>[^\^%@#`]{9,9999}<\?php\s*if\(isset\(\$_[GPRSC]\w{2,6}\[['"]command\b(?<X2220792>)|\s+Team\b[^</]{0,49}</title>[^@#]{999,}\$(\w+)=fileperms\([^;]+;(?:if\(+\$\86&0x[^\}]{0,199}\}else){4}(?<X2206260>)))
\bd(?:=Date;d=new\h+d\(\);(\w{1,9})=\-parseInt\(['"]\d+['"]\)/\d+;if\(window\.document\)\h*try\h*\{[^\}\.]+\.prototype\.\w{1,9}\h*\}[^\*\b]{999,9999}\(\-\1\*\([^;]+;\}\h*if\h*\([^;]+=\w{1,12};\h*if\(\w{1,12}\)\h*\w{1,12}\h*\(["']{2}\+\w{1,12}\);(?<X1158321>)|at(?:a\-savepage\-src=['"]?[^\s=]+/sed\-(alpha)bank\-\w+\.js\b[^<>]+>\s*</script>\s*<(title)\b[^>]*>\s*my\3\s*web\s*(?:on\s*\3farm\d*\s*)?</\4>(?<X2211521>)|e_default_timezone_set[\(\s]+(?:(?:(\$\w{1,40})\{\d+\}\.?)+[\)\s]+;\s*\$\w{1,40}\s*=\s*@\$_SERVER\s*\[(?:\s*\6\s*\{\d+\}\s*\.)+\6\s*\{\d+\}\s*\]\s*;[^\?\*]{999,}\breturn(?:\s*\6\s*\{\d+\}\s*\.)+\s*\6\s*\{\d+\}\s*;(?:\s*\})+(?<X1201180>)|(?:\$\w{1,40}\{\d+\}\s*\.\s*){2,}\$\w{1,40}\{\d+\}[\s\)]+;(?:\s*\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\8\d+\}\s*\];)+[^\*]{999,}\$\w{1,40}\s*=\s*(?:(?:fopen|fwrite|fclose)\s*\([^;]+;\s*){3}\}(?<X1203150>)|(?:\$\w{1,40}\{\d+\}\s*\.\s*){2,}\$\w{1,40}\{\d+\}[\s\)]+;(?:\s*\$\w{1,40}\s*=\s*@\$_SERVER\[(?:\s*(\$\w{1,40}\{)\d+\}\s*\.){3,}\10\d+\}\s*\];)+[^\n]{999,}\$\w{1,40}\s*=[^=]+=\s*(?:(?:fopen|fwrite|fclose)\s*\([^;]+;\s*){3}\}(?<X1200940>)|\$\w{1,40}\s*\[\d+\](?:[\.\s]+(\$\w{1,40})\s*\[\d+\])+[\)\s;]+\$\w{1,40}[\s=@]+\$_SERVER\s*\[\s*\12\s*\[\d+\]\s*\.[^<]{999,}\bif[\(\s]+strlen[\(\s]+(\$\w{1,40})[\)\s<]+\d+\s*&&\s*function_exists[\(\s]+\12\s*\[\d+\]\s*\.[^\}]+\}[^;]+\breturn\s*\13[\s;]+\}(?<X1211030>)))|e(?:_array\h*\(\h*base64_decode\h*\(\h*file_get_contents\h*\(\h*\$ob_cachedir\h*\.\s*\$ob_listfile\b(?<X2174541>)|clare(?:[^\(]{0,49}\((tick)s\h*=\h*\d+\h*\)\h*;\s*[^\?]{0,49}@?register_\16_function\h*\(\h*@?(\$_[GPRSC]\w{2,6})\s*\{[^\}]+\}\h*,\h*@?\17[^;]{1,99};(?<X1176573>)|\(ticks=\d\);\s*register_tick_function\(\$\{['"]_[GPRSC]\w{2,6}['"]\}\s*\{[^\}]+\},\$\{['"]_[GPRSC]\w{2,6}['"]\}\{[^\}]+\}\);(?<X1150581>))|f\h+(?:__init__[\(\h]*self[^)]+\)\h*:[^=]+=\h*self.decode_hostname[^=]+=\h*self.decode_port[^=]+=\h*socket\.socket[\h(]+socket\.AF_INET[,\h]+socket\.SOCK_STREAM[\h\)]+(?<X2255430>)|ins\(\):\s*if\h+len(\(sys\.argv)\)[^:]{0,9}:(?:\s+\w{1,40}\h*=\h*str\21\[\d+\]\)){2}\s+(Archer)(Prepare)Main\h*=\h*\23\22\(\)(?<X2162200>)|shellMessage\(shellName\):\s*print\h*['"][^\?]{9,99}\bRemote\h+Shell(?<X2160550>))))
\bde(?:f(?:\s+(CMSmap)Update\([^\$]{9,499}=\h*['"]Example:\s*git\s+clone\s+https?://github\.com/Dionach/\1\b(?<X2153120>)|acer\W{1,19}</title>[^@\*]{999,4999}\bftp_put\((?<X2182512>)|ault_action\h*=\h*["']FilesMan['"];[^\{]{0,199}\{\s*header\(['"]HTTP/\d\.\d\h*40[34]\h*(?:Forbidden|Not\h*Found)['"]\);\s*(?:exit|die)[^;]{0,9};\s*}(?<X2169880>)|ine([\h\(]+)['"](WdnmdServer)['"][^\n]{1,999}=((\w{1,40})\5\6)\b[^\n]{1,999}\{\h*@?(echo\h*)\7\b[^;]{0,99};(?:die|exit)[^;]{0,19};[\h\}]+else[\h\{]+\9\8\5['"]https?://[^\?\n]{1,999}\bfunction\h*\8\5(\$\w{1,40})[^\}]{0,499}(\$\w+)[\h=]+@?file_get_contents\5\10\b[^\}]{1,99}\breturn\h*\11;\}\}(?<X1192151>)|ine(\s*\()[^\?\{\}]{1,299}\bini_set\13[^\{\}\?]{1,299}\b(function\h+)\w+\13(\$\w+)\s*,[^\}=]{1,99}=\s*unpack\13[^,\)]+,\s*\15[\s\.]+str_repeat\13['"]\\0['"][^\?#:]{499,2999}\b\14\w+\13[^\{]+\{\s*(return)\b(?:[^;]+\^[^;]+){2};\s*\}\s*\14\w+\13(\$\w+)\)[\s\{]+if\13count\(\17\)[^\}]{1,199}\}[\s\}]+\16\h*\17;\s*\}(?<X1191900>)|ine[\(\s"'"]+Yp["'][,\s]+['"][^'"]*['"][\)\s]+;[^\{\}]{0,9999}\bif[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{(?<X2221560>)|ine[\(\s'"]+(?:(GS_ALIAS)['"][,\s]+['"]https?://[^'"]+['"][^%]{99,15999}\$\w{1,40}[\s=]+['"]LyogY3VzdG9[^'"]{99,}['"][^\176]{999,}\$\w{1,40}[\s=]+['"][^;]+;[^/]{99,9999}function\s*\w+\(\)\s*\{\s*\$\w{1,40}[=\s]+\20[\s\.]+["'][^'"]+\.php['"];\s*(\$\w{1,40})[\s=]+\w+\([^\*]{99,2999}\breturn\s*\21[;\s]*\}(?<X1223391>)|UPLOAD_SHELL['"]\s*,\s*\d+[\)\s]+;[^@]{0,199}\$shPath\s*=\s*['"]https?://[^#]{9999,}?\bfunction\s*\w+[\(\s]+(\$url\d*)[\)\s]*\{\s*(\$\w{1,40})[=\s]+parse_url[\(\s]+\23[,\s]+PHP_URL_HOST[\)\s]+;\s*return\s*str_i?replace[\(\s]+['"]www\.['"][,\s]+['"]['"][,\s]+\24[\)\s]+;\s*\}(?<X1211620>))|ine[\(\s]+['"](?:(\w{1,40})['"][,\s]+base64_decode[\("'\s]+L3dwLWNvbnRlbnQvcGx1Z2luc[^'"]{4,199}['"][\s\)]+;\s*@?include(?:_include)?\s*__dir__\s*\.\s*\26\s*;(?<X1238652>)|(OBJECT_\w)['"][,\s]+['"]\28['"][\)\s]+;\s*define[\(\s]+['"](ARRAY_\w)['"][,\s]+['"]\29['"][\)\s]+;\s*define[\(\s]+['"](ARRAY_\w)['"][,\s]+['"]\30['"][\)\s]+;[^&]{9,9999}(\$\w{1,40})[=\s]+str_replace[\(\s'"]+<!--['"][,\s]+['"]<!--['",\s]+\31[\)\s]+;(?<X2222550>)|[a-f\d]{8,64}['"][,\s]+['"]eN[^'"]{999,}['"][\s\)]+;\s*define[\s\(]+['"][a-f\d]{8,64}['"][,\s]+chr[\s\(]+101[\s\)]+\.\s*chr[\s\(]+118[\s\)]+\.\s*chr[\s\(]+97[\s\)]+\.\s*chr[\s\(]+108[\s\)]+\.\s*chr[\s\(]+40[\s\)]+\.[chr\(\)\d\.\h]{99,};(?<X1236460>)|\w['"]\s*,\s*['"][^'"]+['"][\s\)]+;\s*/\*[^\*]*\*/\s*@?eval\s*/\*[^\*]*\*/\s*\([^\);\n]+\)[^;\{\}=\$\n]{1,40};\s*function\s*\w+[^\{\};]+\{[^\{\};\(\)\n]+\bcurl_init\b[^;]*;[^\{\}\n]+\}(?<X1283910>)|FILE_NAME['"]\s*,\s*['"](?:ch[a4]s[e3]|w[3e]lls|next|ver(?:\d*|ify\d*)?|\w{0,9}bank|\w{1,4})\.php['"][\)\s]+;[^\}:]{40,99}\$\w{1,40}\s*=\s*file_get_contents[\s\('"]+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\s\)]+;(?<X2203761>)|PATH_TO_BACK_SHELL['"][,\s]+['"][^'"\$]+['"][\)\s]+;(?<X1247710>)|WORKDIRs?['"][,\s]+['"][^'"]*['"][\)\s]+;\s*define[\(\s]+['"]AUTHCODEs?['"][^;]+;\s*function\s*aios\w+\s*\([^#]+\bclass\s*aios\w+\s*\{[^\(\)\}]+\}\s*\Z(?<X1248851>)|Yp['"][,\s]+['"][^'"]{0,40}[s5]H[e3]LL[^'"]{0,40}['"][\)\s]+;(?<X2206050>))|ine[\s\(]+['"](?:(?:PACKNAME|DATACENTER)['"]\s*,\s*['"][a-z\d\+/=]{40,}['"][\)\s]+;\s*define[\s\(]+['"](?:PACKNAME|DATACENTER)['"]\s*,\s*['"][a-z\d\+/=]{40,}['"][\)\s]+;(?<X2203031>)|SECRET_MD5['"][,\s]+['"]\w{32}['"][\s\)]+;\s*class\s+(\w+)\s*\{[^#]{99,3499}\bfunc(tion_exists)(?:[\s\(]+['"]([pes](?:assthru|ystem|xec|hell_exec|open))['"][\s\)]+\{[^\}]{0,49}\b\42\s*\([^\{@#\?]{1,99}\bfunc\41){2}[^\?]{1,1999}\}\s*new\s+\40[\s\(]+\);(?<X1216140>)|startTime['"][,\s]+getTime\([\s\)]+;\s*if[\s\(]+!\h*(function)_exists[\s\(]+['"](shellexec)['"][\s\)]+\{\s*\44\s*\45[\s\(]+\$cmd\d*[\s\)]+\{(?<X2057263>))|ine\((?:"USER_AGENT", "Mining Cacher(?<X2048690>)|'SHELL_PASSWORD'\s*,\s*\$hashed_password\)\s*;\s*define\('MAX_UP_LEVELS',\s*\d+\)\s*;\s*if\(empty\(\$_COOKIE(?<X2047260>)|['"](AUTH_CODE)['"],['"]\w{32,64}['"]\);add_filter\(['"]all_plugins['"],['"](\w+)['"]\);function\s*\50\([^\}]{1,199}\bunset\([^\?]{1,2999}\$(\w{1,40})=hash\([^,;]+,\$_SERVER\[['"]PHP_AUTH_PW['"]\]\);if\((?:\$\51|\49)[!=]=+(?:\49|\$\51)(?:[^@#%]{499,4999}\bcall_user_func\(['"]assert['"],\$_[GPCSR]\w{2,6}\[)(?<X2235651>)|['"][^'"]+['"],['"]Br[0o]kenbrain['"]\);\s*\$\w{1,20}=['"]scandir['"];\s*\$\w{1,20}=array\((?<X2221690>)|['"]DOLLY_WAY['"],['"]World\s+domination['"](?<X2214611>)|['"]self['"],['"]sellex\.pw['"]\)(?<X2228702>)|['"]shell_?name['"],[^\?]{1,499}\$(\w{1,40})\h*=\h*str_i?replace\h*\(\h*['"]?(\w{1,40})['"]?\h*,\h*['"]{2}\h*,\h*['"](?:[evalsrt]{1,6}\57{0,9}){1,99}['"]\h*\);\s*\$\56\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\);\s*(?:die|exit)[^;]{0,19};(?<X2165090>)|['"]VERSION['"],['"]Bypass\s*waf\b(?<X2130650>)|['"]webshell_number[^\?]{99,399}\bfunction\s*shell\(\$\w+\)\h*\{\s*\$\w+[\h=]+base64_decode\b(?<X2206900>)|\h*['"]?__TDS_URL__['"]?[,\h]+['"]https?://webcontrol1\.[^'"]+\.cgi['"]\h*\)\h*;[^\{\}]{0,999}\bfunction\h+\w{1,40}\([^\)]*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\((?<X2183070>)|\s*['"]startTime['"]\s*,\s*getTime\(\)\s*\);\s*if\s*\(\s*!(function)_exists\s*\(\s*['"](shellexec)['"]\s*\)\s*\)\s*\{\s*\62\s+\63\b(?<X2137042>))|ine\h*\(['"](?:[^'"]+['"],\h*['"][^'"]+\b(?:shell|backdoor)['"]\);(?:\s*\$\w{1,15}\h*=\h*['"]scandir['"];)?\s*\$\w{1,15}\h*=\h*array\s*\([^\)]+\);(?<X2187431>)|[^\)]{1,20}\);\s*if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[['"]ups__['"]\]\)\)\s*\{[^\{]{1,49}\{\s*if\h*\(@?(?:copy|move_upload_file)\h*\(\$_files\[['"]file['"]\]\[[^\}]{1,99}\}\s*\}\s*print\h*['"]<(form)\h*method\h*=[^\;]{1,150}/\66>['"];\s*\}(?<X1168931>)|\w{1,20}['"]\h*,\hh*["']https?://(?:www\.)?google-statik\.(?:pl|jp|pl|in|cn|ru|su|xyz|pw)/[^\.]{1,20}\.php['"]\);(?<X2154590>))|ine\h*\((?:[^,]+,\h*['"]Byp[a4][s5]{2}['"]\);[^\{\}]{9,200}\bfunction\h+\b\w{0,40}cmd\h*\((?<X2181731>)|[^\-\{\}]{1,200}\bif[\h\(]+['"]\h*secupress\-backdoor\-user\.php['"](?<X2194180>)|\h*['"]GI_GATE_URL['"]\h*,\h*['"]https?://[^/]{3,40}/\w{1,40}\.cgi['"]\h*\)\h*;[^\$]{99,999}class\h+GiHttpClient\h*\{(?<X2155140>)|\h*['"]HASH_KEY(?:['"]\h*,\h*['"][a-f\d]{32}['"]\h*\)\h*;\s*if\h*\(\h*!\h*(class)_exists\h*\(\h*['"](\w{1,40})['"][\s\)]+\{\s*\72\h+\73\h*\{[^\176\^]{999,9999}\bpreg_replace\h*\(\h*array\h*\([^;]+;[^#]{999,9999}\$\w{1,40}\h*=\h*new\h+\73\h*;[^\}]{1,99}\}\}[^\?]{1,499}\bJSON_ERROR_NONE\h*\)\h*;\s*\}(?<X1168030>)|[''"]\h*,\h*['"][a-f0-9]{32}['"]\h*\);\s*if\h*\(\h*!\h*class_exists\h*\(\s*['"](\w{1,40})['"][\s\)]+\{\s*class\h+\75\s*\{\s*function\h*\75\h*\([^`]{30000,40000}\bif\h*\(\h*\w{1,9}[\(\)\{\s]{1,9}(?:\w{1,9}\h*\(\h*REQUEST_URI\h*\)\h*;\s*){2}\}(?:\s*\}){4}(?<X1164900>))|\h*['"]KEEV_MIN['"]\h*,\h*\d+\h*\)\h*;\h*(?:if\h*\(\h*\d+\h*<\h*mt_rand\h*\(|while\b)(?<X2175290>)|\h*['"]SHELL_?PA?S?S?WO?R?D['"]\s*,\s*['"][^'"]+['"]\s*\)\s*;\s*define\s*\(\s*['"]MAX_UP_LEVELS\b(?<X2196000>))|ine\s*\(\s*(?:'[^']*'\s*,\s*class_exists\s*\(\s*['"]COM['"]\s*\)\s*\?\s*1\s*:\s*0\s*\)\s*;\s*define\s*\(\s*'PHPINFO_IS'\s*,\s*\(\s*!eregi\s*\(\s*"[^"]*"\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\?\s*1\s*:\s*0\s*\)\s*;(?<X1037810>)|['"](\w+)['"],\s*['"]\w+['"][^;]{1,49};\s*function\s*(\w{1,40})[^\{]{1,9}\{\s*if\s*\(\s*@?md5\s*\(\s*(\$_[GPCSR]\w{2,6}\[)[^\)]+\)\s*\D{2,3}\s*\80[^\(]{20,60}if\s*\(\s*isset\s*(\(\s*\82[^\)]+\))\s*\D{2,3}@?\81[^\;]{1,40}@?eval\s*\([^\)]+\83\)+;\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1135772>)))|lete\h*\([^\)]+\)\h*;[^\?\->]{1,99}echo\h+\$\w{1,40}\->getColoredString\([^;]+;\s*attack\h*\(\h*\$host\h*,(?<X2150760>)|scription"\s+content="Hacked\s+By(?<X2049830>))
\bd(?:ie(?:\((?:'ERROR-400-BAD-REQUEST'\);\s*if\s*\(isset\(\$_FILES\['\w+'\]\)\){\s*if\s*\(isset\(\$_REQUEST\['\w+']\)\)(?<X2046920>)|['"][^'"/;\)]{0,49}>H3NING_MAL4M</[^\?]{1,499}\bfunction\s+VEsetcookie\([^\?]{1,499}==\$auth_pass\)(?<X2220030>)|file_get_contents\(\$urlSQLServerPage(?<X2048040>))|(?:\b[^;]{0,9};if\(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\D{2,3}['"][^'"]*['"]\)\{(\$\w{1,40})=file_get_contents\(['"]http://[^'"]{1,40}/\w{1,3}\.txt['"]\);if\(preg_match\(['"](.)(?:(?:cgi|admin)\|?)+\5i['"],(\$\w{1,9})\)[^\(]{1,40}if\(file_put_contents\(['"]\{\6\}[^,]+,\4\)\)(?<X2131793>)|\h*\(['"][^\\,\$;]{9,150}<title>\h*Laudanum\h*PHP\h*shell\h*access\b(?<X2182460>)))|i(?:rectoryIndex(?:\s*solevisible\.(?:php\d*|p?html?)\b(?<X2226831>)|\s+(?:index\.php\s*RewriteEngine\s+On\s*RewriteBase\s+/\w+/\s*(RewriteCond)\s+(%{REQUEST_FILENAME})\s+!\-d\s*\10\s*\11\s*!\-f\s*(RewriteRule)\s+(index\.php)\.\*\s+\-\s*\[L\]\s*\10\s*\11\s*!\-d\s*\10\s*\11\s*!\-f\s*\12\s*\^\(\.\*\)\s+\13\?id=\$1(?<X1042553>)|s{4,}\.html?\b[^\?@#%\?&\*\[\]]{1,1999}[;\}\{\)](?:(?:eval[\(\s]+['"](?:ln\s+\-s|cp)\s+/home/\$\w+/[^'"]+\.php\b[^'"]+/Fox\-(?:Sym|Co?py)/[^'"\s]+['"];@?){20}){2}(?<X2206831>)))|sk_free_space\(\s*dirname\(__FILE__\)\) , disk_free_space(?<X2043631>)|v\s+id="content"><textarea\s+rows="20%"\s+cols="50%">\\'\.\$[O0_]{5,20}\.\\'</textarea(?<X2050670>))|o(?:_passreturn\(\$_POST\['path'\],\$_POST\['code'\],\$_POST\['return'\](?<X2047850>)|cu(?:ment(?:[\.\s]+write[\(\s]+String[\.\s]+fromCharCode[\(\s]+60,115,99,114,105,112,116,62,40,102,117,110,99,116,105,111,110,32,40,[\d,]{1,99}102,101,116,99,104,40,39,104,116,116,[\d,]{99,499}119,105,110,100,111,119,46,108,111,99,97,116,105,111,110,46,104,111,115,116,110,97,109,101,[^\)]{99,9999}\)\);(?<X1253371>)|\.write(?:[\(\s]+['"]\s*<\s*iframe\s*['"]\s*\+\s*['"]\s*s['"]\s*\+\s*['"]r['"]\s*\+\s*['"]c['"][^;\?><]+\.(?:cgi|php|js)\?[^;]+;[^>\-\n]{0,199}\-\d{3,}p[xt]\s*;[^>]+>\s*<\s*/\s*iframe\s*>(?<X1248920>)|\((?:(['"])<['"\+iframe]{12,40}\s+['"]?s[rc\+'"]{2,}=[^;:<>]+://[^;:<>]+position:absolute[^\-<>]+\-['"][^<>]+>\s*</['"\+iframe]{6,40}>\21\);(?<X1280210>)|['"]<script\h+(?:src\h*=\h*['"]https?://[^/]{1,20}\.\w{2}/[^\?]{0,9}/?\w{1,20}\.php\?id=\d+['"]\h*|type\h*=\h*['"]text/javascript['"]){2}>[<>'"/\+script\s]{10,25}\);(?<X1147361>)|['"]>tpircs/<>['"][^'"]{1,40}(?:=i\?php\.|/)(?:war|daolnwod)/moc\.nibetsap//:s?ptth['"]\s*=\s*crs\s*tpircs<['"]\.split\(['"]['"]\)\.reverse\(\)\.join\(['"]['"]\)\s*\);?(?<X1126942>)|atob\(['"]PHNjcmlwdD52YXI[^'"\);\$\n=]{999,9999}(?:PSBhdG9iK|IGF0b2I|YXRvYi)[^'"\);\$\n=]{9,199}(?:PC9zY3JpcH|L3NjcmlwdD|c2NyaXB0P)[^'"]{0,40}['"][\s\)]+;(?<X1242540>)|unescape\(['"]%3C(?:%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%[a-f%\d]{40,199}%73%74%79%6C%65%3D%22%64%69%73%70%6C%61%79%3A%6E%6F%6E%65%22%3E%3C%2F%69%66%72%61%6D%65%3E['']\)\);(?<X1185010>)|(%73%63%72%69%70%74)%[%a-f\d]{0,499}%3D%20%6E%65%77%20%43%6F%69%6E%48%69%76%65%2E%[%a-f\d]{0,999}%3C%2F\27%3E['"]\)\);?(?<X1184411>))))|_ROOT['"]\]\s*\.\s*['"][^'"]{1,40}['"]\s*;\s*(\$\w{1,40})\s*=\s*\w{1,40}\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\s*[^'"]{1,40}['"](?:a|w)\+?['"]\)\s*;\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\29\s*\)\s*;(?<X2057662>))|SignXML\.aspx\?logevent=\d+&action=['"][^<]{1,999}</script>\s*<title>\s*(?:Sign\s+In\s*-)?\s*DocuSign\s*</title>(?<X2143010>))|ORWAYISWORKTITLE['"]\)\)[\s\{]+\$\w{1,40}=['"](?:yes|no)[^\?]{1,199}drupal(?<X2133082>))|r(?:[\-\.]avira\b[^/]{1,199}\bhttps://(?:www\.)?facebook\.com/x\.hassan\b[^@\?:%]{9,999}<title\b[^>]{0,99}>\s*HN\s*Mailer\b(?<X2163710>)|opbox+\s*By[^#]{9,99}(?:\$msg\s*\.=\s*['"](?:Email|Password)[^\[]{0,50}\$_POST\[['"](?:Email|Password)['"]\][^;]{0,20};\s*){2}(?<X2137281>)))
\becho(?: "<html><head>.*?Safe mode:</span>.*?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[\'\w+\'\]\s*===\s*\'uploadFile\'\).*?echo \"</body><\/html>\";(?<X2044941>)|"<center>.+?</center>\s*";\s*echo\s*'uname:'\.php_uname(?<X2046910>)|['"][^;]{0,49}\banonymousfox\.(?:co|txt|pw|io)\h*['"];\s*(\$\w{1,9})\h*=\h*['"]https?://['"]\h*\.\h*\$_[GPRSC]\w{2,6}\[[^\?]{1,99}(\$\w{1,9})\h*=\h*file_get_contents\h*\(\3\);[^\}]{1,99}\}\s*\4\h*=\h*str_replace\h*\(['"]<\?php[^\}]{1,99}\beval\h*\(\4\);\s*\}(?<X2188520>)|[\(\s]+['"]<script>['"]\s*\.\s*base64_decode[\(\s]+['"]d2luZG93LmFkZEV2ZW50TGlzdGVu[^'";]+['"][\s\)]+\.\s*['"]</script>['"][\s\)]+;(?<X1252090>)|[\(\s]+['"]\s*<\s*(script)\s*>\s*if\((document)\.referrer\s*!=\s*['"]{2}[\)\s]+\{\s*\8\.location\.href\s*=\s*['"]https?://[^/'"]+\.[a-z]{2,9}/[^'"\s]+['"]\s*\}\s*<\s*/\s*\7\s*>\s*['"][\)\s]+;(?<X1250630>)|[\(\s]+base64_decode[\("'\s]+Ijxmb[^;]+;\s*@(?:copy|move_uploaded_file)[\s\(]+\$_FILES\s*\[[^\]]+\]\[[^\]]+\][,\s]+\$_FILES\s*\[[^\]]+\]\[[^\]]+\][\s\);]+echo\s*\([^;]+;\s*@?(?:exit|die)\b[^;]*;(?<X1259650>)|[\h\(]+(exploit_db)[\(\h]+[^\}]{99,200}[\}\s]+function\h+\11\([^\)]+\)[\{\s]+\$\w{1,20}[\h=]+@file_get_contents[\h\(]+[\h'"]+https?://(?:www\.)?exploit\-db\.com/(?<X2204160>)|[\s'"\(]+<h1>\s*<a\h+href\h*=\h*['"](?:\\)?\$fullpath['"]>OK\-Click\h+here!\s*</a>(?<X2264830>)|[\s'"]+<[^'"]{0,49}\bshell\h*upload[er]*</[^>]+>\s*<form\b(?<X2184961>)|[\s\('"]+<title>[^\w\n\b]{0,15}\b(?:Upl[0o][a4]d[e3]r|h[a4]ck[e3]d|pwned)\h*By[\h\./]*\w{1,40}\b[^</>]{0,99}[</>]{2}(?<X2210942>)|[^;]{9,499}\b403\s+Forbidden\b[^;]{9,499};\s*if\s*\(isset\s*\(\$_[GPSCR]\w{2,6}\[[^\]]+\]\)\)\{[^\}]{1,199}\b(?:copy|move_uploaded_file)\((?<X2136560>)|\('<form\s+method="post"\s*enctype="multipart/form-data"><b>UPLOAD FILE:</b>\s*<input type="file" size="25" name="upload"><br><b>FILE NAME:</b> <input type="text" name="filename" size="25"> <input type="submit" value="UPLOAD"></form>'\);\s*if\(isset\(\$_FILES\['upload'\]\)\s*and\s*isset\(\$_POST\['filename'\]\)\)\s*{\s*if\(copy\(\$_FILES\['upload'\]\['tmp_name'\]\s*,\s*\$_POST\['filename'\]\)\)\s*{\s*echo\('[^']+'\.\$_POST\['filename'\]\);\s*}\s*else\s*{\s*echo\('[^']+'\);\s*}\s*}(?<X1036120>)|\(['"]<(script)>\s*if\((document)\.[^\)]{1,32}['"]+\)\s*\{\s*\19\.location\.href\s*=\s*['"]https?://whatnow\d?\.\w+/\w+['"]\s*\}\s*</\18>['"]\);(?<X1250520>)|\b[\s\(]+['"]\?>['"][\.;]?['"]?https?://bit\.ly/(?<X2200812>)|\b[^;]{1,99}<[ht](?:\d|itle)[^>]{0,99}>\s*IDBT[3e][a4]m\b[^;]{1,99}\bphp_uname\(\)(?<X2159361>)|\h*(\$[a-z_]{1,40})\d*=([peas](?:assthru|ystem|xec|hell_exec|open)\()['"][^\);]{1,99}/(wp\-[\w\-]{1,40}\.php)['"]\);(?:echo\h*\23\d*=\24['"][^\);]{1,99}/\25['"]\);){4}(?<X2177092>)|\h*(\$GLOBALS)\h*\[[^\]]+\]\h*\.\h*php_uname\h*\(\)[^\}]{0,499}\bif[\s\(]+(?:copy|move_uploaded_file)[\s\(]+\$_FILES\[\27\[(?<X2196521>)|\h*<[<\h]+(ES?O[DT])\b[<\h]+script[^;]+\29;[^\v\*%]{0,999}(\$con\w{0,9})\h*=\h*get\w{0,9}\h*\(['"]https?://[^;]+;\h*\30\h*=\h*str_replace\b[^;]+\30\);[^\v\+]{99,499}\}\s*echo\h*\30;\s*(?:die|exit)\b[^;]{0,19};(?:\s*\}){2}(?<X1184160>)|\h*@?eval[\s\(]+["']\?>['"][\s\.]+@?file_get_contents[\s\(]+['"]https?://bit\.ly/[a-z0-9]{4,9}['"][\s\)]+;(?<X1212353>)|\h*['"](?:<a\h*style[\h=]+['"]display:none;?['"]\h*href[\h=]+['"]https?://[^'"]+['"]>[^<]+</a>\s*){3,10}['"];(?<X1237070>)|\h*['"](?:<a\h*style[\h=]+['"]display:none;['"]\h*href[^>]{0,99}>[^<]{0,40}\bslot\b[^<]{0,40}</a>\s*){3,9}['"];(?<X1223140>)|\h*['"](?:<a\h*style[\h=]+['"]display[\h:]+none;?['"]\h*href[\h=]+['"](https?://[^'"]+)['"]>[^<]{0,40}(?:slot|togel|\35)[^<]{0,40}</a>\s*){5,15}['"];(?<X1223550>)|\h*['"](?:<a\h*style[\h=]+['"]display[\h:]+none;?['"]\h*href[\h=]+['"]https?://[^'"]+['"]>(?:slot\h*gacor|rodaslot)</a>\s*){1,9}['"];(?<X1227310>)|\h*['"]<(?:(div)\h*style\h*=\h*['"](?:display|visibility):(?:none|hidden)['"]>\w{0,25}<(iframe)[^\?]{9,60}\.(?:php|cgi)?\?[^>]{0,50}></\39>\h*</\38>\h*['"];(?<X1142561>)|(script)\h*src[\h=]+['"]https:?//(?:[^\.]+\.)?jquery\-uii\.com/[^\.]+\.js['"]></\41>['"];(?<X1209960>)|(title)>\h*newnight\h*-\h*shell</\43>[^\(]{9,50}\.php_uname\(\)\.['"]</?br>(?<X2141491>)|(title)>b[a@]?ckd[0o]{2}r\b[^<]{1,40}</\45>['"];(?<X2176033>)|(title)>x?Mailer\h+[\w\-]{4,24}(?:\.[a-z]{2,6})+\b[^\<]{0,15}</\47>['"];(?<X2167201>)|[^>]+>\h*back\W{1,2}connect[^/]{0,20}(?:tool|shell)(?<X2216101>)|center(?:>[^/]{0,40}\bSecDevil13\h*Mini\h*Upl[o0]ader(?<X2153450>)|[^;]{0,99};\s*exec\([^\)]+\);\s*system\([^\)]+\);\s*\$\w{1,15}\h*=\h*php_uname\(\);[^#]{0,399}\bfile_get_contents\(['"]https?://api\.telegram[^'"]{0,49}['"]\h*\.\h*http_build_query\(\$\w{1,15}\)\h*\);(?<X2185460>))|html>\h*</html>['"];\h*error_reporting\((?:0|NULL)\);[^\$]{0,99}\beval(?:[\h\(]+\$\w+){3,5}[\h\(]+['"][^'"]{99,399}['"][\h\)]+;(?<X1236670>)|title>(?:\s*Mass\h*(?:Cleaner[\h\w]+\bby\s*\W{1,4}RECODED\b[^#]{99,750}\b_POST\[['"]defpage\w{0,9}['"]\];(?<X2202221>)|Delete[\h\-]+By\b[^\{]{99,299}\bfunction\h*\w{1,15}\([^\)]+\)\s*\{\s*if\([^\{]+\{\s*\$\w{1,15}[\h=]+scandir\s*\((?<X2202211>))|\W{0,9}WordPress\h*MassDeface(?<X2175670>)))|\h*['"][^'"]{1,25}\bLokomedia\h+(?:Auto\h*Tanem\h*Shell|\(SQL\h*Injection)\b(?<X2151091>)|\h*['"][^/;]{1,40}<title>\h*M[@a4]ss\h*d[e3]f[a@4]c[e3]r?\b(?<X2168131>)|\h*['"][^;]{0,50}\bphpshell\.xyz\h*/\h*shell\d+\.com(?<X2156560>)|\h*['"]\h*Craigs\h*Backdoor\h*Wordpress\h*Admin[^;]+['"];(?<X2198021>)|\h*['"]\s*(?:(?:<a\h*style[\h=]+['"]display:none;\s*['"]\s*href[\h=]+['"]https?://[^'"]{1,90}['"]>[^<]{1,99}(?:slot|gacor|escort)[^<]{0,99}</a>\s*){3,}['"];\s*\Z(?<X1227560>)|(?:<script[^>;]{1,150}>\s*</script>\s*<a\h*href[^>]{1,150}>[^<;]{1,50}</a>\s*){2,4}['"];\Z(?<X1193270>)|GIF8\d[a-z];\s*<html\b[^;\?]{1,99}<\?\s*\$[^\}\?]{99,499}\b[cm]o(?:py|ve_uploaded_File)\s*\(\s*\$_FILES\h*\[[^\?]{9,499}\?>[^;]{1,1999}['"];(?<X1173730>))|\h*['"]\W{0,2}PhyRo\W{0,2}['"];[^\(]{0,15}\bif\(\$_[GPRSC]\w{2,6}\[[^\)]{1,20}['"]upload['"]\)\s*\{[^\./]{9,150}\bif\((\$\w{1,20})[^\)]+\)[\{\s]+if\(@?[cm](?:opy|ove_uploaded_files)\(\$_FILES\[[^\)]{1,40}\.\63\)\)[^\?]{99,250}\becho\h*["']?[^;]{1,40};\s*\}(?<X1214840>)|\h*['"]Priv8[^'"]{0,25}\buploader\h*by\b(?<X2173450>)|\h*`/bin/(?:ba)?sh\h*\-\w[^/]+/dev/tcp/\d+\.\d+\.\d+\.\d+/\w+\h*0>&\d['"]?`;(?<X1207981>)|\h*file_get_contents[\h\(]+['"]https?://(?:codeigniter\.icu/[^'"]+\.php['"]\);(?<X1268310>)|slot\-gacor\b[^'"]+\.txt['"][\h\)];(?<X1236681>))|\h*php_uname\(\);[^\(]{0,20}\bif\(\$_POST\)[\{\s]+if\([cm](?:opy|ove_uploaded_files)\((\$_FILES\[[^\]]+\]\[)[^\]]+\],(\69[^\]]+\])\)\)[\{\s]+echo\h*['"][^\.]{0,40}\.\70[^\?]{1,99}\becho\h*['"]<form\h*method=post[^\};]{9,99}>['"];\s*\}(?<X1222690>)|\h+"Uploader\h+By\h+Psyco\b(?<X2051381>)|\h+(\w{1,40})\h*\(\h*['"]https?://[^;]{1,99};\s*function\h+\73\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*@?file_get_contents\h*\(\h*\74\h*\);\s*if\h*\(\h*!\75\h*\)\s*\{[^\}]{1,499}\}\s*return\h+\75;\s*\}\s*(?:die|exit)[^;]{0,19};(?<X1171750>)|\h+(chr\h*\(\h*60\h*\)\h*\.\h*)((?:chr\h*\(\h*(?:115|99|114|105|112|116)\h*\)\h*\.\h*){6})[chr\(\)\h\.;\d]{99,999}\.\77chr\h*\(\h*47\h*\)\h*\.\78chr\h*\(\h*62\h*\);(?<X1183841>)|\h+@?[peas](?:assthru|ystem|xec|hell_exec|open)\h*\(\h*['"]cd\h+/tmp;[^:\)\v]{4,40}\bhttps?://[^\?\v\)]{9,99};\h*perl\h+\S{1,40};\brm\h*\-r?f[^\.;\v]{1,40}\.(?:txt|php|perl|pl)[^;\v]{1,20};(?<X1174262>))
\becho(?:\h+['"]<(?:!\-\-\h*\d\h*\-\->['"];\h*\$to\h*=\h*['"]https?://([\w\-\.]{1,40}\.\w{2,3})/\?\w{1,3}=['"];(?:\s*if\h*\(\h*preg_match\h*\(\h*['"][^\}]{9,199}\})+\s*echo\h+['"]<!\-\-\h*\d\h*\-\->['"];[^\{\}]{99,399}\{\s*header\h*\(\h*['"]Location:\h*https?://\1/?['"]\h*\)\h*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1156070>)|(script)[^:]{1,60}src\h*=\h*['"](?:https?:)?/?/?zerobyte\-id\.github\.io/PHP\-Backdoor/[^'"]{1,40}['"]\h*>\s*</\3>['"]\h*;\s*echo\h*['"]</(?:body|html)>(?<X2152411>)|(script)\h+src\h*=\h*["']+\h*\.\h*(?:(?:gz(?:uncompress|inflate)|base64_decode|strrev|str_rot13)\h*\(\h*){2,}['"][^'"]{9,99}['"][\h\)]+\.\h*["'][^>;\.\v\$]{1,99}>\s*</\5>['"]\h*\.\h*PHP_EOL\h*;(?<X1152660>)|[^;/\$]{99,200}>\s*(?:<(?:td|font)[^';]{4,35}>\h*(?:N4m3|S1z3|P3rm15ion|4ct1on)\h*<[^;'"]{4,35}>\s*){3}(?<X2168481>)|[^>]*html>[^\$\(\)]{99,500}<title>\h*pst[a4]r(?:8|ate)\h*(?:web)?\h*shell\b(?<X2174320>))|\h+['"][^\[\]\{]{9,200}<font[^>]+>\h*Error\h*People\h*Squad\b(?<X2172820>)|\h+['"]\W{0,4}<(html>)\s*<div\h+style=\\['"](?:(?:left|right):\h*-\d{3,5}px;\h*|position:\h*absolute;\h*|(?:top|bottom):\h*-\d{3,5}px){3}\\['"]>\s*(?:<a\h+href=[^>]{3,99}>[^<]{2,99}</a>\s*){5,30}</div>\s*</\10\s*['"];(?<X1145861>)|\h+['"]GIF\d{2}[a-z]?;\s*<(?:title|h(?:tml|\d|ead)|!DOCTYPE)\b[^;]{1,99};\s*echo\b[^;]{1,99}\.php_uname\(\)\.(?<X2176920>)|\s*"<form\s*action\s*=\s*'"\s*\.\s*\$current\s*\.\s*"&mode=copy&src="\s*\.\s*\$src\s*\.\s*"'\s*method\s*=\s*'POST'>(?<X2047920>)|\s*"This\s*shit\s*works!";\s*if\s*\(isset\(\$_FILES(?<X2051710>)|\s*'<title>Upload\s*Files\s*xSecurity(?<X2049560>)|\s*(@null\s*;)\s*goto\s*\w+\s*;[^\n\?]{99,}\16(?<X1259660>)|\s*@?(?:eval|assert)\s*\(\s*['"]\\77\\76['"]\s*\.\s*@?file_get_contents[\s\(]+['"]\\(?:x68|104)(?:\\(?:x74|116)){2}[^'"\.]{31}\\(?:x2e|46)\\(?:154|108)\\(?:x79|121)[a-f\dx\\]{30,40}['"][\s\)]+;(?<X1212370>)|\s*['"](?:<a\s+style\s*=\s*['"]display\s*:\s*none;\s*['"]\s+href\s*=\s*['"]https?://[^'"]+/['"]\s*>\w{3,16}(?:\s+\w{1,16})*\s*</a>\s*){3,}['"]\s*;[\s\?>]*\Z(?<X1222511>)|\s*['"]<(?:[^\?/]{0,99}//(?:www\.)?(?:facebook\.com|fb\.me)/anonsecteam['"\s](?<X2224351>)|a\s*href=['"]\?(\w{1,40})=(\w{1,40})['"][^@]{999,19999}\bif\(\$_[GPCSR]\w{2,6}\[['"]\21['"]\]==["']\22['"]\)\{unlink(\(__FILE__)\);(\$\w{1,40})=fopen\23,[^;]{1,99};fwrite\(\24,['"]\21['"]\);fclose\(\24\);\}\s*(?:\?>)?\Z(?<X2169820>)|div\s*style=[^>]+>['"];\s*@?error_reporting[\(\s]+\d[\)\s]+;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][=\s]+['"](Mr\.\s*0T4KU)['"][^>]+>[^\?]{1,300}\bNameless\s*Security\s*Hackers\b[^@%\*]{499,2900}\26[^\};'"]{1,499}['"];\s*\}\s*echo\s*['"]</div>['"];(?<X1225401>)|form(?:\s*action[^;]{9,99};\s*error_reporting\(0\);\s*(\$\w{1,9})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\28=stripslashes\(\28\);\s*eval\(\28\);(?<X1128465>)|\s+action\s*=[^;]{99,}</form>['"];\s*\{\s*@?(?:move_uploaded_file|copy)[\s\(]+\$_FILES\[[^\]]+\]\[[^\]]+\][,\s'"\.]+\$_FILES\[[^\]]+\]\[[^\]]+\][\s\)]+;[^=\{\}]{0,199}\}(?<X1223870>))|pre>['"];\s*system\(\$_REQUEST\['c'\]\);\s*die;(?<X2053920>)|script>\s*['"]\s*\.\s*base64_decode[\(\s]+['"]ZnVuY3Rpb24[^'"]{99,9999}P(?:T09dW5kZWZpbmVk|T11bmRlZmluZWQ|XVuZGVmaW5lZA)[^'"\n]{99,}['"][\)\.\s]+['"]\s*</script>['"]\s*;(?<X1258650>))|\s*['"][^_]{9,99}<title>\s*x3_V\s*(?:mini|web)\s*shell\b(?<X2134101>)|\s*['"]\s*<meta[^>]{0,99}>\s*<(title)>SHELLIZM[^<]+</\34>[^;]{99,400};\s*(\$\w{1,25})[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*pwn\(\35\);(?<X2201230>)|\s*['"]\|OK\d+\|['"]\s*;\s*\$\w{1,40}\s*=\s*['"]<script\b[^!\n\+]+(?:while\h*\(!!\[\]\)\h*\{\h*try\h*\{\h*var\s*\w{1,40}\s*=\s*parseInt\s*\(|window\.atob\(\\?['"][^;]+;[^\n!\+]{0,99}\.appendChild\(\w+\)\h*;)(?<X2203811>)|\s*['"]FoxAuto\s*V\d[^;]+anonymous[^;]*;(?<X2222820>)|\s*['"]google\-site\-verification:\s*google['"]\.\$_GET(?<X2117161>)|\s*['"]RxR\s+H[a4]Ck[E3]r!?['"]\s*;(?<X2250280>)|\s*['"]This\s*server\s*has\s*been\s*infected\s*by\s*\$\w{1,40}['"];(?<X2172210>)|\s*['"]window\.location\.href[\s=]+['"]https?://[^\.'";\s]{1,5}\.saleforyou\.org/[^'"]+['"]\s*['"]\s*;(?<X1199040>)|\s*\$USER\s*->\s*Update\s*\(\s*\d+,\s*array\(\s*"PASSWORD"\s*=>\s*'[^']+'\s*\)\s*\)\s*;(?<X2049580>)|\s*\("<<OK>>"\s*\.\s*join\s*\("\\n"\s*,\s*\$injected\s*\)\s*\.\s*"<</OK>>"\s*\);(?<X2049350>)|\s*\(\s*(?:gzinflate\s*\(\s*base64_decode\s*\(\s*['"]tVVNb5tAEP0t5WKoh[^'"]{500,900}['"](?:\s*\)\s*){3};(?<X1065202>)|php_logo_guid\s*\(\s*\)\s*\)\s*;\s*@?copy\s*\(\s*\$\w{1,40}\s*\[\s*fl\s*\]\s*\[\s*[^]]+\]\s*,\s*'[^']+'\s*\)\s*;\s*\$\w{1,40}\s*='[^;]+;\s*@\$\s*\{\s*a\s*\}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*;(?<X1039590>))|\s*`\$_[GPCSR]\w{2,6}\[[^\]]+\]`;(?<X1234082>)|\s*`\{\$_GET\h*\[[^\]]+\]\}`\s*;(?<X1204970>)|\s*basename[\(\s]+__FILE__[,\s]+['"]\.php['"][\)\s]+\.\s*['"]\.php['"]\s*;(?:\s*@?file_put_contents[\(\s]+['"]\w\.php['"][,\s@]+file_get_contents[\(\s]+['"]https?://[^'"]{9,}\.php['"][\)\s]+;)+(?:\s*echo\s*['"][^'"]*['"]\s*;)?(?<X1258821>)|\s*eval\('\?>'\s*\.\s*join\(\s*""\s*,\s*file\(\s*"\$c/\$p\.html(?<X2049820>)|\s*file_get_contents(?:[\('"\s]+https?://api\.blinku12\.us/\w+\.txt["'\)\s]+;(?<X1214860>)|[\(\s"]+https://[a-z]{1,9}(\d)\52\.[a-z]{2,3}/[a-z]{1,9}(\d)\53\.txt["'\)\s;]+\Z(?<X1219050>)|\(['"]https?://(?:raw|user\-images)\.githubusercontent\.com/[^'"]{0,199}backlink[^'"]{0,199}\.txt['"]\);?(?<X1236650>))|\s*php_uname\b[^;]+;\s*(\$\w{1,40})[=\s]+(\$_FILES\[)[^\]]+\]\[[^;]+;\s*(\$\w{1,40})[=\s]+\57[^\]]+\]\[[^;]+;\s*echo\s*['"]<form\s+method[=\s'"]+P[^;]+;(?:\s*(\$\w{1,40})[=\s]+['"][move_uplad_fi]{2,12}['"][\s;]+){2}(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+\59;\s*\60[\s\(]+\56[,\s]+\58[\s\)]+;(?<X1232330>)|\s*shell_exec[\(\s]+\$_GET\h*\[['"]?(?:root|cm?d?)[^\]]*\][\)\s]+;(?<X1248300>)|\s*strpos[\(\s]+strtolower[\(\s]+\$_SERVER\[(base64_decode)[\(\s]+['"]SFRUUF9VU0VSX0FHRU5U["'][\)\s]+\][\)\s]*,\s*\63[\(\s]+['"]Z29vZ2xlYm90['"][\s\)]+!=+\s*(?:true|false)\?\63[\(\s]+['"]P[^"']{99,}['"][\s\)]+:\s*['"]{2}\s*;(?<X1217690>)|\s+@?eval[\(\s]+['"]\\77\\76['"]\s*\.\s*@?file_get_contents[\(\s]+['"]\\[a-fx\d\\]{30,199}['"][\s\)]+;(?<X1220130>)|\s+@?file_get_contents\s*\(\s*['"]index\.html(?:\.bak)+['"]\s*\)\s*;?(?<X1036511>)|\s+["']<title>[^;]+;\s*function\s+(http_get)\(\$\w{1,40}\)\{[^\}]{99,999}\}(\$\w{1,40})=[^;]{1,99}/wp\-(?:content|admin)/[^'"]{1,99}\.php['"];(?:chmod\(\68,0777\);)?(\$\w{1,40})=\67\(['"]https?://[^;]{1,99};(\$\w{1,40})=fopen\(\68[^;]{1,99};fwrite\(\70,\69\);(?<X2148631>)|\s+['"]<b(?:>\s*stats\s*</b>\s*-\s*Displays?\s+statistics\s+about\s+your\s+spam(?<X2060580>)|r><[^>]+>\s*NGH\s*sh[3e]ll\s+(?:[\w\.]{2,5})?\s+by\s+Cr[a4]sh\s*<(?<X2119390>))|\s+['"]<font\s+color\s*=\s*[^>]+>\s*TheM[o0]n[e3]yT[3e][4a]m(?<X2121120>)|\s+['"]No\DQRQR\s*\|[^\|]{0,30}\|\s*(?:Thanks\s+to|Vreated\s+By)\s*:\s*Sn[1i]p[e3]r\s*H[a4]ck\s*\D\s*Dr\.Kr[0o]{1,5}z\s*\D\s*H[a4]ck[3e]r_s[a4]['"];(?<X2119090>)|\s+file_get_contents\('/home/'\.\$user\.'/\.my\.cnf(?<X2051680>)|\s+mail\(\$to,\$them,\$mss,\$head\)\?_\d+\(\d+\):_\d+\(\d+\)(?<X2046210>)|\s+null;[^=]{0,40}\beval\b[^=:\?]{0,40}\([^=:\?]{0,40}['"]\?>['"]\s*\.\s*\w+[\s\('"]+https?://\w{1,5}\.\w{3,20}\.[a-z]{2,8}/[^'"]{1,199}\.(?:png|jpe?g|gif)['"][\s\)]+;(?<X1220120>)|\swelcome\sto\sr57\sshell(?<X2044191>))
\bE(?:l(?:ement\.prototype\.(append)After\h*=\h*(function\()(\w{1,40})\)\h*\{\h*\3\.parentNode\.insert[^\{]{9,99};\h*\(\2\)\h*\{[^\}]{0,499}\b\3\.src\h*=\h*(String\.fromCharCode\()104,116,116,112[^\)]+\);[^\}]{99,999}\(\4[^\)]+\)+\[0\]\.\1Child\(\3\);?\h*\}\h*\)\h*\(\);(?<X1185111>)|se\s*(?:\{\s*(?:(\$\w{1,40})\h*=\h*create_function\h*\(\h*(?:['"]{2}|null)\h*,\h*base64_decode\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\h]+;\h*@?\6\h*\(\h*\)\h*;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}(?<X1185590>)|\$[^\}\{]{0,99}(?:(?:\s*(\$to)\s*=\s*EMAIL;)|(?:\s*\$ip\s*=\s*getenv\(['"]REMOTE_ADDR['"]\);)){2}[^\}\{]{0,999}if\s*\(\s*mail\s*\(\s*\8\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2052091>)|echo\s*['"]indata_error['"]\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\b(?<X2046932>))|if\("shell"\s*==\s*substr\(\$action\s*,\s*0\s*,\s*5\)\)\{\s*\?>(?<X2050350>))|se(?:\{print "preg_fail";\}\}else\{print "preg_empty"(?<X2055020>)|if[\(\s]+@\$_[GPRC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*['"][^'"\$]+['"][\)\s]+\{\s*if[\(\s]+wp_delete_post[\(\s@]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][,\s]+(?:true|1)[\)\s]+\{\s*(?:echo|die|exit|print)[\s'"\(]+[^'"\(\)]*['"\)\s]*;\s*\}\s*\}(?<X1205940>)|if\((?:(function)_exists\(['"](shell_exec)['"]\)\)\{\$\w{1,40}=\15\(\$\w{1,40}\);(return)\s*\$\w{1,40};\}\16\b[^;]{1,40};\}\14\s*command\(\)\{(?<X2055922>)|strtolower\(\$cmd\)\s*==\s*"etcpasswdfile"\)\s*\{\s*\$pw\s*=\s*file\('/etc/passwd/'\);(?<X2050750>))|if\s*\(\s*(?:\$current_blog\s*===\s*'active'\s*\)\s*\{\s*file_put_contents\s*\(\s*\$destination\s*,\s*\$blog_id\s*\)\s*;\s*\}(?<X2047900>)|has_passthru\s*\)\{\s*x_passthru(?<X2050260>)|isset\(\s*\$_COOKIE\[\s*'\w+'\s*\]\s*\)\s*&&\s*!empty\(\s*\$_COOKIE\[\s*'\w+'\s*\]\s*\)\s*\)\s*{\s*echo\s*htmlentities\(\s*\(\s*string\s*\)(?<X2046680>))))|Nq(?:1fflvU2f677/iieaqQDPhb(?<X2053170>)|VWvtTFFfa/lc6VGoDSrC7p(?<X2053130>)))
\bError_reporting(?:[\(0\);\s]+set_time_limit[\(0\);\s]+header\(['"]HTTP\/\d+\.\d+\s*404\s*Not\s*Found['"\);\s]+echo\s*['"]<!DOCTYPE\s*HTML><html><head><title>[^\|]+\|\|\s*\$dir(?<X2284420>)|[\(\h]+(?:0|NULL)[\)\h]+;\s*(function)\h*(\w{1,25})[\(\h]+\$\w{1,25}[\)\s]+\{\s*if[\(\h]+\2_exists[\(\h]+['"]curl_exec[^\?]{99,999}\}\s*(\$\w{1,25})[\h=]+\3[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\h]+;\s*(\$\w{1,25})[\h=]+eval[\(\h]+['"]\?>['"][\h\.]+\4[\)\h]+;\s*header\(['"][^:]+:\h*\5['"]\);(?<X1197260>)|[\(\h]+(?:0|NULL)[\)\h];[^\?]{9,99}\$\w+[\h=]+['"]<\?xml[^\176]{999,3500}\bfile_get_contents\(['"]php://input['"]\);[^\176]{999,4200}\bord\(\$\w+\[\$\w+\]\);\s*(?:\$\w+\+\+;\s*)?\}\s*return\s*\$\w+;\s*\}(?<X1207011>)|[\(\s]+(?:0|null)[\)\s]+;\s*if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\S{2,3}\s*(base64_decode)[\(\s]+['"][^'"]*['"][\)\s]+\{(?:\s*(\$\w{1,40})\s*=\s*\$_FILES\s*\[[^\]]+\]\s*\[\s*\8\b[^;]+;){2}[^\}]{0,499}(?:move_uploaded_file|copy)\s*\([^;]+\9[\s\)]+;[^\}]{0,99}\}(?<X1205750>)|[\(\s]+(\w+::\w+)\(\d+\)\s*[-\+\*/]\s*\11\(\d+\)[\)\s]+;(?<X1227620>)|[\(\s]+0[\)\s;@]+mkdir[\(\s]+['"]([^'"\$]+)['"][,\s]+0?7\d+[^;]+;\s*(\$\w{1,40})[=\s@]+(file_)ge(t_contents)[\(\s'"]+https?://[^'"]+\.(?:txt|php)['"\);\s]+(\$\w{1,40})[=\s@]+['"]\13/[^'"]+\.php['";\s]+if[\s\(]+\15pu\16[\s\(]+\17[,\s]+\14[^\?\n]{9,199}(\$\w{1,40})\s*=[^\n\}]{9,499}\18[\);\s]+\}(?<X1208520>)|[\(\s]+0[\)\s;]+http_response_code[\(\s]+4\d+[^\{\}\[]{1,499}(\$\w{1,40})[=\s]+\[['"][a-f\d]{4,64}['"](?:[,\s]+['"][a-f\d]{4,64}['"])+\][^<\+]{0,999}if[\(\s]+(\$\w{1,40})\s*<\s*count[\(\s]+\20[\)\s]+\{\s*\20\[\21\]\s*\.?=[^!]{0,999}\bif[\(\s]+!\20\[\d+\][\(\s]+\$_FILES\[[^\]]+\]\[[^\]]+\]\[\21\](?<X2228051>)|[\(\s]+0[\)\s]+;\s*@?set_time_limit[\(\s]+0[\)\s;]+(\$\{\$\{['"]GLOBALS['"]\}\[)([^\]]+\]\})[=\s]+curl_init[\(\s\);]+curl_setopt[\(\s]+\23\24[,\s]+CURLOPT_URL[,\s]+base64_decode[\(\s]+['"]aHR0c[^;]+;[^\?\n]{0,499}\beval[\(\s]+base64_decode\s*\([^;]*\23[^\]]+\][\}\)\s]+;(?<X1257281>)|[\(\s]+\d+[\)\s;]+http_response_code[\(\s]+\d+[\)\s;]+define[\(\s]+['"]\w{2,5}['"][,\s]+['"][^'"]*['"][\)\s;]+\$\w{1,40}[\s=]+['"]scandir['"]\s*;\s*\$\w{1,40}[=\s]+array[\(\s]+['"][\s,'"a-f\d]{99,1999}\)\s*;[^><]{0,999}\bwhile[\s\(]+\$\w{1,40}\s*<\s*count[\s\(]+\$\w{1,40}(?<X2228390>)|[\h\(]+(?:0|NULL)[\h\)]+;\s*(\$\w{1,15})[\h=]+(?:@?file_get_contents[\h\(]+str_rot13[\h\(]+[^;]+;\s*eval[\h\(]+['"]\?>['"][\.\h]+\27[\h\)]+;(?<X1212170>)|['"]https?://(?:www\.)?bestmarijuanaguide\.com[^'']+['"];[^\^]{999,3999}\bstr_replace\(\$\w+\.\27,\h*\$[^@]{99,1200}\bsetcookie\(['"]haircki['"],\h*['"]haircooki['"],[^;]+;(?:define\(['"]\w+['"],true\);){2,4}(?<X1203860>))|[\h\(]+(?:0|NULL)[\h\)]+;\s*header[\h\(]+[^\)]+\);\s*if[\h\(]+\$_SERVER\[[^\]]+\][^\{]+\{\s*(\$\w{1,25})[\h=]+array_shift[\h\(]+\$_[GPRSC]\w{2,6}[\h\)]+;\s*eval[\h\(]+gzinflate[\h\(]+base64_decode[\h\(]+\30[\h\)]+;\s*\}(?<X1207976>)|[\h\(]+[^\{]{9,699}\bclass\s+(KillBot)\s*\{[^#]{99,1999}(\$\w+)[\s=]+new\s+\32;\s*\33\s*\->\s*apikey[\s\(]+(\$\w+\h*\[)[^;]+;\s*if[\s\(]+\33\s*\->\s*\w+\s*\([^\{;]{1,99}\{\s*(@?die[\s\(]+header[\s\(]+['"]Location:[^;]{0,9}\34)[^;]+;[\s\}]+(?:else[\s\{]+\35[^;]+;[\s\}]+)?(?<X1222603>)|[\s\(]+0[\s\)]+;[^\$\?]{0,99}\bif[\s\(]+isset\s*\([^\{;\?]{1,99}\{\s*\?>[^\?]{0,1499}<\?[ph\s]+if[\s\(]+(\$_FILES)[\s\)]+\{\s*(?:if[\s\(]function_exists[\s\(]+['"](move_uploaded_file|copy)['"][\s\)]+\{[^\}]*\b\38[\s\(]+\37\[[^,\);]+,\s*\37\[[^\n]{0,499}){2}\}\s*(?:\}\s*)*(?:\?>\s*)?\Z(?<X1210351>)|\((?:0|FALSE)\);(?:[^\{\}]{1,50}\$xmlname=['"]mapss?\.xml['"];[^_]{0,20}\$(sitemap)[^=]{0,15}=["']\40[^@#]{999,6000}\b(?:get|file_get_contents)\(['"]https?://[^\);]{4,60}\.txt['"]\);[^\?>@]{30,400}\bfile_put_contents\([^,]+\.php['"],\$shell.load\)[^@#]{5000,9000}\{(\$\w{1,20})\[\]=[^\[\?]{1,30}\}return\41;\}(?<X1188000>)|\s*if\s*\(\s*eregi\s*\(\s*['"]mainlink\|\w{1,40}['"],\s*@?\$_SERVER\[['"]HTTP_REFERER['"]\]\s*\)\s*&&\s*!\$_COOKIE\[['"](\w{1,40})['"]\]\s*\)\s*\{\s*@?setcookie\(\s*['"]\43['"],\s*['"]\w{1,40}['"]\s*\);\s*\}(?<X1055981>))|\((?:0|FALSE|NULL)\);(?:[^\./]{9,30}<(title>)(\./\w{1,20})</\45[^\@\\]{300,2000}>\46</font>[^\@\*%]{400,2000}(\$\w{1,20})=scandir\([^\)]+\);\s*foreach\(\47\h*as\b(?<X2189440>)|\s*(\$\w{1,20})=\$\{['"]_[GPRSC]\w{2,6}['"]\};\s*\([^_]{1,20}\bin_array\(gettype\(\49\)\.count\(\49\)[^=]{1,20}\49\[\d+\]=[^\?#@]{200,999}\bcurl_exec\([^\)]+\);\s*if\(empty\((\$\w{1,20})\)\)\s*\50=file_get_contents\h*\([^\)]+\);\s*return\h*\50;\s*\}(?<X1187890>)|\s*\$\w{1,40}\s*=\s*strrev\s*\(\s*['"]/?(?:wordpress|wp|ptth)/?['"]\s*\)\s*;[^\?]{999,9999}(file_)pu(t_contents)\s*\(\s*ABSPATH\s*\.\s*WPINC\s*\.\s*['"]/ID3/\w{1,40}\.dat['"],\s*\52ge\53\s*\(\s*\$style.css\s*\.\s*['"]\w{1,40}['"]\s*\)\s*\)\s*;(?:\s*\}){5}(?<X1130470>))|\((?:0|NULL)\);(?:[^\n]{0,99}\bfilesMatch\b[^;]+;\h*\$\w{1,15}=+@?fopen\(['"]\.htaccess['"],[^\n]{99,2500}\bif\(\!isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\)]+\{login_shell\(\);\}\}(\$\w{1,15})=['"]<img\h*src[^\n\)]{99,1999}\)['"]>#['"],\55,(\$\w{1,15})\);\$\w{1,15}=\56\[\d+\];(?<X1202100>)|[^\{\n]+\{\h*\$\w{1,25}[\h=]+@?file_get_contents\(\$\w{1,25}\);[^\n]{99,1500}\bLove=['"],\h*(\$\w{1,25})\);\h*\58[\h=]+str_replace\(['"]\.Lovehtml['"],\h*['"]\.html['"],\h*\58\);\h*echo\h*\58;\h*(?:exit|die)[^;]{0,9};(?<X1201805>)|\$_\w{1,20}\s*=\s*__FILE__;\$_\w{1,9}\s*=\s*['"][^'"]{999,}['"];\s*@?eval\(base64_decode\(['"][^'"]{1,30}(?:YmFzZTY0X2RlY29k|c2U2NF9kZWNvZGUo|YXNlNjRfZGVjb2Rl)[^'"]{1,90}(?:ZXJlZ19yZXBsYWNlKCdfX0ZJTEVf|ZWdfcmVwbGFjZSgnX19GSUxF|cmVnX3JlcGxhY2UoJ19fRklMRV9f)[^'"]+['"]\)\s*\);(?<X2065012>)|\h*function\h*(\w{1,15})\(\$\w{1,15}\)\h*\{[^\{]{1,99}\{\h*(\$\w{1,15})\h*\.=\h*pack\(['"]\w['"],\h*hexdec\(substr\(\$\w{1,15}[^\}]+\}\h*return\h*\62;\h*\}\h*eval\(\61\(['"][^'"]{1,99}['"]\)\h*\.\h*['"][^'"]{999,60000}['"][\);'"]+;(?<X1195761>)|\s*(\$\w{1,15})[\h=]+['"][^'"]+['"];\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]+\{\s*if\(\65[^\{]+\{setcookie\(\64,\h*\65,[^\^]{99,999}\bX0MB13</title><[^\^]{999,14000}\{\h*header\(['"]Location:\h*['"]\.basename\(__FILE__[\);}\s]+print\h*\$end;(?<X2202201>)|\s*(\$\w{1,25})[\h=]+(base64_)decode\([^\)]{0,99}\);\s*if[^\{]+\{\s*(\$\w{1,25})[\h=]+\67[\h\.]+\68encode\(\$_SERVER[^\?]{0,350}\{@?(\$\w{1,25})[\h=]+file_get_contents\(\69\);\s*\}\s*echo\h\70;[\s\}]+if[^\{]+\{\s*echo\h*['"]<div[^\}]{0,99}\}(?<X1214740>)|\s*[^\?]{0,199}\becho\h*['"]<!DoCTYPE\h*HTML>[^\|]{999,6500}\bmass_deface['"]><font[^>]{0,99}>AUTO\h*MASS</[^%\^]{99,7000}\bperms\h*&\h*0x\d+\)[^\)]+\)\);\s*return\h*\$\w{1,15};\s*\}(?<X1196031>)|\s*\$\w{1,20}=['"]https?://[^\.]{2,20}key[sz][^'"]{0,15}/(?:windows|antivirus|os|game)[^'"]{1,20}key[sz]?/?['"];[^#%\*]{20,150}(\$\w{1,20})=(curl_)init\(\);[^\(]{0,30}\74setopt\(\73,[^:]+https?://[^'"]{9,99}\.txt['"]\);[^\{]{99,250}\{\s*\$\w{1,20}=['"]https?://[^\}]{9,99}\}(?<X1196100>)|\s*\$\w{1,20}\s*=\s*strrev\s*\(\s*['"]/wordpress/['"]\s*\);[^\{]{30,300}if\s*\(\s*is_dir\s*\(\s*(ABSPATH\s*\.\s*WPINC)\s*\)\s*\)\s*\{\s*(\$\w{1,20})[^\?]{99,7000}\{\s*(file_)put(_contents)\s*\(\s*\76\s*\.\s*[^\(]{9,40},\s*\78get\79\s*\(\s*\77\s*\.\s*["']json["']\s*\)\s*\);(?:\s*\})+(?<X1133271>)|\s*define\(['"]__SEC_VALUE__['"],[^\{]{199,240}function\s*CheckSecureValue\s*\(\s*\)\s*\{\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\](?<X2064681>)|\s*function\h*\w+\((\$\w+)\)\s*\{\s*\$\w+[\h=]+@?(curl_)init\(\82\);[^\}]{9,400}\bGLOBALS\[['"]coki['"]\]\);\s*(\$\w+)[\h=]+@?\83exec\([^\?]{0,99}\breturn\h*\84;\s*\}(?<X1213240>))|\((?:0|NULL)\)[^\?\{]{0,199}\{(\$\w{1,15})[\h=]+['"]/tmp/[^\.]+\.txt['"];[^\?]{99,399}\bfunction\h*(\w+)\([^\{]+\{\s*\$\w{1,15}[\h=]+['"]https?://(?:\w+\.)?classicpartnerships\.com/[^\?]{99,499}\bfile_put_contents\(\86,[^\?]{9,299}\badd_filter\(['"][^'"]+['"],['"]\87['"][;\)\}]+(?<X1204230>))
\bError_reporting(?:\((?:0|NULL|FALSE)\);(?:(\$\w{1,20})=['"]strrev['"];(?:\$\w{1,20}=\1\([^\)]+\);){5}[^\\]{99,1500};\$\w{1,20}\(\$\{['"]_FILES['"]\}\[[^\]]+\]\[['"]tmp_name['"]\],[^\?]{99,700}['"]</textarea>['"]\);\}(?:exit|die)[^;]{0,19};\h*\}(?<X1135251>)|[^'"]{0,30}\bdefine\([^,]{1,20},['"]G[3e][l1][14]y\h*(?:Mini|web)\h*shell['"]\);[^\d]{9,40}\$\w{1,20}=array\((?<X2200890>)|[^\$]{0,60}(\$\w{1,20})[=\s]+["']chr['"];\s*(\$\w{1,20})[\s=]+\4\h*\(\h*\d+\h*[\-\+/\*][^'"]{99,1500};\s*(\$\w{1,20})=\5\([^'"]*['"][^\)]{5000,}['"]\s*\)[\)\s]+;\s*(\$\w{1,20})[=\h]+(?:create_function|\$\w{1,20})[\(\s]+['"]{2}[,\s]+\6[\)\s]+;\s*@?\7[\(\)\s]+;(?<X2235373>)|[^\(\)]{2,50}\$\w{1,20}=['"]\w{20,40}['"];\s*foreach\([^@\?]{99,700}\$\w{1,20}=file_get_contents\(['"]https?://[^\)]+/(\w{1,20}\.txt)['"]\);\s*\$\w{1,20}=fopen\(['"]\9['"],[^@]{999,3000}(\$\w{1,20})=fopen\(\$\w{1,20}\.['"]\.tpl['"][^;]+;\s*fwrite\(\10[^\)]+\);\s*fclose\(\10(?<X2185041>)|[^\(]{0,30}(\$pathdor)=dirname\(__FILE__\);\s*\$pathsrv=\12\.['"]/files["'];[^\(]{9,150}\(str_replace\(['"]\.pdf['"](?<X2172692>)|[^\?=\$]{1,199}\bif\(\$_[GPCSR]\w{2,6}\[[^\)]+\)\{echo\b[^;]{1,99}\.php_uname\(\)\.[^\?\}@]{1,499}\b[cm]o(?:ve_uploaded_file|py)\((\$_FILES\[)[^\),]{1,99},\14(?<X2174890>)|[^\?]{1,199}\bfunction\s*\w{1,40}\((\$\w{1,40})\)\{if\(stri?pos\(\16,['"](\.\w{1,40})['"]\)[^\?]{1,99}\bfile_pu(t_contents\()\16\.['"]\17['"],\w{1,40}\(file_ge\18\16\)[^;]{1,99};unlink\(\16\);(?<X2165871>)|[^\?]{9,400}\$(?:pass|passwd|psw|pwd|password|auth|auth_pass)\s*=\s*['"][^'"]*['"];[^\?]{9,200}header\(['"]HTTP/1\.\d\s+(?:401|404)\s+(?:Unauthori[zs]ed|Not\s+Found)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X2125014>)|[^\{\}\?]{0,99}\$ex_links\h*=[^@]{99,1499}\bif\h*\(file_exists\h*(\([^\)]+\))\s*\)\s*\{[^@]{99,599}\bunlink\21;[^\`]{999,4999}\bfopen\(([^\,]+),[^\?]{1,99}\b[ir](?:nclud|equir)e(?:_once)?\(\22\);\}(?<X2144685>)|[^\{]{0,40}\bif\(get_magic_quotes_gpc\(\)\)\{foreach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,29}=>\$\w{1,20}\)\{[^'"]{0,40}\$s?name=['"]\w{1,9}Shell['"];(?<X2178940>)|[^\{]{9,99}\{\s*function\h+(\w{1,20})\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\(['"](tmp)['"]\h*,[^\)]+\);[^\?>]{99,1500}\b\25\([^\)]+\);\s*include\(['"]\26['"]\);\s*\}(?<X2174280>)|\s*(?:\$\w+[\h=]+(?:gzdecode\()?(base64_decode)\(['"][^'"]{999,5000}['"]\)+;[^\[]{0,60}\$\w+[\h=]+(\$_SERVER\[)[^\]]+\];\s*){2}[^\\<#]{999,1500}(\$\w+)[\h=]+strrev[\h\(]+['"][^'"]{9,40}//:sptth['"]\)[^<]{9,150}\b\28[\h\(]+[^\)]+\)[\.\h]+\30[\W\h]+\29[^\}]{1,60}\b(?:exit|die)[^;]{0,9};\s*\}(?<X1227280>)|\s*(\$\w{1,20})=sys_get_temp_dir\(\)\.[^;]{9,99}\.dummy['"];\s*if\(isset\([^\{]+\{\s*unlink\(\32\);[^\}]{1,70}\}[cm]o(?:py|ve_uploaded_file)\(\$_[GPRSC][^,]+,\32\);\s*(\$\w{1,20})=file_get_contents\(\32[^\)]*\);\s*eval\(["']\?>['"]\.\33\.['"]<\?['"]\);(?<X1235380>)|\s*\$\w{1,20}\h*=\h*\$_SERVER\[['"]SCRIPT_NAME['"]\];\s*(\$\w{1,20})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\{]{9,99}\{\s*if\((file_exists)\(\35\)\)\s*\{\s*\$\w{1,20}\h*=\h*htmlentities\(file_get_contents\(\35\)\);[^\?]{99,300}if\(\36\(\35\)\)\s*\{\s*if\(unlink\(\35\)\)(?<X2280170>)|\s*\bif\(\$_[GPRSC]\w{2,6}\[[^\?]{1,79}\{(\$\w{1,20})[^;]{1,199};\s*(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*\bif\(!empty\(\39\)\)[\s\{]+\bunlink\(\38\);\bexec\(['"]pkill\s+[^\)]{1,40}\bstealth["']\);[^\?]{1,99}file_put_contents\(\38,\$\w{1,20}\);\s*chmod\(\38,\d+\);(?<X2186011>)|function\b[^\{]{1,99}\{if\((\$_[GPCSR]\w{2,6})\)\{if\(isset\((\41\[chr\()[^\}@\?#!/:]{1,499}\beval\(\w{1,40}\(\)\s*\?[^;:]{1,99}\42[^;:]{1,99}:\42(?<X2183630>)|header\(['"]Content\-type[:\h]+text/html;[^@]{999,}\bSubmitting\s*Google\s*Sitemap\b[^@]{999,};\$\w+=function\((\$htName),(\$htContents)\)\{(\$\w+)=fopen\(\44,[^;]+;fwrite\(\46,\45\);fclose\(\46\);\};\$\w+\(\);(?<X1211200>))|\((?:\d|FALSE|NULL)\);\s*(\$\w{1,20})\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*declare\h*\(ticks=\d\);\s*register_tick_function\h*\(\48\h*,\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1178240>)|\((?:\d|NULL|FALSE)\);[^/:]{9,99}<title>Bypass\h*Shell\b(?<X2177591>)|\(0\).{100,1000}?sprintf\("%c"\s*,\s*\$\w{1,40}\s*\^\s*ord\(\$\w{1,40}\[\$\w{1,40}\]\)\);\s*\$\w{1,40}\s*=\s*\$\w{1,40}\("\s*"\s*\s*,\s*\$\w{1,40}\([^)]{1,300}\)\);\s*\$\w{1,40}\(\s*\);(?<X1039690>))
\bError_reporting(?:\(0\);(?:(?:[^\?\{]{1,200}(\$\w{1,25})\h*=\h*base64_decode\(['"][^'"]{999,35000}['"]\);\s*(\$\w{1,25})\h*=\h*(file_)get(_contents)\([^\)]+\);\s*if\(md5\(\2\)\h*\D{2,3}\h*md5\(\1\)\)\s*\{[^\}]{1,99}\b\3put\4\((\$\w{1,25}\.['"][^'"]+['"]),\s*\1\);\s*@?chmod\(\5,\h*\d+\);\s*\}){1,2}(?<X1194632>)|@?ini_set\(["']display_errors["']\s*,\s*0\);\$var=\s*\$_SERVER\[["']PHP_SELF["']\]\."\?";\$form\s*=["']<form\s*enctype="multipart/form-data"\s*action=["']["']\.\$var\.["']["']\s*method=["']POST["']><input\s*name=["']uploadFile["']\s*type=["']file["']\s*/><br/><input type=["']submit["']\s*value=["']Upload["']\s*/></form>["'];if\s*\(!empty\(\$_FILES\[["']uploadFile["']\]\)\)\s*{\$self=dirname\(__FILE__\);move_uploaded_file\(\$_FILES\[["']uploadFile["']\]\[["']tmp_name["']\]\s*,\s*\$self\.DIRECTORY_SEPARATOR\.\$_FILES\[["']uploadFile["']\]\[["']name["']\]\);\$time\s*=\s*filemtime\(\$self\);print\s*["']OK["'];\s*}\s*else\s*{\s*print\s*\$form;\s*}(?<X1035860>)|[^\n\$\*!@&='"]{1,99}if\h*\(\h*isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{\h*\$\w{1,40}\h*=\h*(\$_FILES)\h*\[[^\n\?@:&\*]{99,999}\{\h*if\h*\(\h*@(?:copy|move_uploaded_file)\h*\(\h*\8\h*\[[^\n\?@&\*!]{99,999}echo[^;]{1,99};[\h\}]{1,9}(?<X1137992>)|\$c_='[^']+';\$c0='[^']+';\$c1='[^']+';\$c2='(?<X2051150>)|\s*(\$\w{1,25})[\h=]+['"]stristr['"];[^\{]{9,99}\bfunction\h*(httpGet)\([^\{]+\{\s*header\([^\)]+\);\s*\$\w{1,25}[\h=]+curl_init\([^\{]{9,750}\bdefine\(['"](\w+)['"],\h*\11\(\w+,[^\{]{0,500}\{\s*if\h*\(\13\)\s*\{\s*echo\h*\12\([^\?]{9,350}\bif\h*\(\13[^\}]{0,99}\bexit;\s*\}(?<X1208980>)|\s*(\$\w{1,40})\h*=\h*new\h+\w{1,40};\s*if[\(\h]+(isset)[\(\h]+(\$_[GP]\w{2,6}\[)[^\]]+\][\)\s]+(?:\{\s*)?\15\->proxy\(\);\s*(elseif)[\(\h]+\16[\(\h]+\17[^\]]+\][\)\s]+(?:\{\s*)?\15\->check_a\w+\(\);\s*\18[\(\h]+\16[\(\h]+\$_[GP]\w{2,6}\[[^\]]+\][\)\s]+(?:\{\s*)?\15\->update_c\w+\(\);(?<X2188300>)|\s*\$name\s*=\s*'[^']+'\s*;\s*\$text=.+fopen \(\s*"\$name"\s*,\s*"w"\);\s*fwrite\(\s*\$fp\s*,\s*\$text\s*\);\s*fclose\(\s*\$fp\s*\);\s*}(?<X1039170>)|\s*\$strings = "as";.+?\)\);'\)\);(?<X1034261>)|\s*\$wp_\w{1,40}\s*=\s*strrev\s*\([^\)]{1,40}ptth['"]\s*\);(?:\s*if\s*\(\s*(?:is_file|stripos)\s*\([^\{]{1,99}\s*\{[^\}]{1,999}\}\s*\}?){4,9}(?<X1063841>)|\s*date_default_timezone_set\((\$_[GPRSC]\w{2,6}\[)[^\]]+\][^\?]{99,600}if\h*\(\h*mail\(\23[^\]]+\]\h*,\h*\23[^\]]+\]\h*,\h*base64_decode\(\23[^\]]+\]\)\h*,\h*implode\([^\}]{99,200}\}\s*else\s*\{\s*\$\w{1,15}\h*=\h*json_encode\([^\}]{9,99}['"]Gagal(?<X2144601>)|\s*defined?\(['"]__DIR['"],\s*['"][^'"]{1,40}/wp-(?:admin|include)/(?:\w{1,40}/)?\.\w{1,40}/['"]\s*\);(?<X2134990>)|\s*echo\s*['"]AnonymousFox(?<X2050181>)|\s*eval\("if\s*\(\s*isset\(\s*\\\$_REQUEST\[['"]\w+['"]\]\)\s*&&\s*\(md5\(\\\$_REQUEST\[['"]ch['"]\]\)\s*==\s*['"]\w+['"]\s*\)\s*&&\s*isset\(\\\$_REQUEST\[['"]\w+['"]\]\)\)\s*{\s*eval\(stripslashes\(\\\$_REQUEST\[['"]\w+['"]\]\)\);\s*exit\(\);\s*}"\s*\);(?<X1035880>)|\s*goto\h*\w{3,9};\s*\w{3,9}:\h+file_put_contents\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*,\h*FILE_APPEND\h*\)\h*;[^\[\]\{\}\(\)]{0,99}\bset_time_limit\b[^\[\]\{\}]{0,99}\bgoto\h*\w{3,9};\s*\w{3,9}:\h+mkdir\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X2161990>)|\s*if\s*\(\s*!(function)_exists\s*\(['"](\w+)['"]\)\)\s*\{\s*\29\s+\30\s*\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"]http[^;]+['"];[^\?]{99,2999}(\$\w{1,40})\s*=\s*file_get_contents\s*\(\s*\31\s*,[^\?]{99,499}eval\s*\(\32\);[\s\}]+\30\s*\(\);(?<X1133312>)|\s*ini_set\(\s*(?:chr\(\d+\)\s*\.?)+,\s*\d+\);\s*echo\s+@?file_get_contents\(\s*(?:chr\(\d+\)\s*\.?)+\);(?<X1041601>)|header\(['"]Content\-type[\h:]+text/html;[^#]{499,}\bif\(preg_match\(['"][^;\{]+\{(\w+)\(\$\w+,['"]google\-site\-verification\s*:[^;]+;\s*(?:exit|die)\b[^;]{0,99};[^#]{499,}\bfunction\s+\35\s*\([^;\{]+\{[^\}]{0,499}\bfwrite\([^;]+;fclose\([^;]+;[\s\}]+\w+\(\);(?<X1218590>)|ini_set\("display_errors", 0\);\$localpath=getenv\("SCRIPT_NAME"\);\$absolutepath=getenv\("SCRIPT_FILENAME"\);\$root_path=substr\(\$absolutepath,0,strpos\(\$absolutepath,\$localpath\)\);include_once\(\$root_path\."/SESS_\w{32}\.php"\);(?<X1035800>))|\(0\)[\s;]+function\s*(\w{1,40})\s*\(\)\s*\{\s*(\$\w{1,40})\s*=\s*['"][^'"]+['"];\s*(\$\w{1,40})\s*=\s*(?:\39\[\d+\][\s\.]+){3,}['"]\s*\(\s*\\?['"]?['"]\s*\.[^;]+;\s*return\s*\40;\s*\}\s*eval[\s\(]+\38[\(\)\s]+\.\s*['"]e[^\\'"]{999,}\\['"][\s\)]+;\s*['"]\s*\)\s*;(?<X1199852>)|\([01]\);@?header\(['"]Con[^\)]+\);(?:\h*\$[0o_]{1,12}[\h=]+(?:['"]\w{1,40}['"]|\d+);)?\h*(\$[0o_]{1,12})[\h=]+['"]%[^'"]{99,9999}['"];\h*(\$[0o_]{1,12})[\h=]+urldecode\(\42\)[^\*]{4999,}(\$\w{1,40})[\h=]+fopen[^;]+\43[\{\[]\d+[\}\]][\h\)]+or\h+(?:die|exit)\([^\v\?]{1,99}fclose\(\44\);(?:\h*return\h*\$\w{1,40};)?\h*\}(?<X1172076>)|\([^;]+;\$(?:bot){3,}=[^\n]{499,1999}\bfwrite(\(\$\w+)[^;]+;[^\?\n]{1,499}\becho\s+(?:f(?:gets|close)\46\b[^;]+;\}+){2}(?<X1205631>)|\(E_ALL\h*\^\h*E_[^#]{9,499}\b(curl_)setopt\(\$\w{1,15},\h*CURLOPT_URL,\h*['"]https?://[^/]+\bfingerling\.org/[^\?]{9,199}=\h*\48exec\(\$\w{1,15}\);(?<X1198190>)|\(round\(\d+\)\);mb_internal_encoding\(_\w+\(\d+\)\);mb_regex_encoding\(_\w+\(\d+\)\);mb_http_output\(_\d+\(\d+\)\);mb_http_input(?<X2045181>)|\h*\((?:0|null)\);\s*if\h*\(\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*\)\s*@?eval\h*\(\h*(?:base64_decode\h*\()?[^\$;]{0,9}\51[\)\h]+;(?<X1173691>)|\h*\((?:0|null|false)\);(?:[^;]{1,49};\s*(\$\w{1,9})\h*=\h*getenv\h*\(['"]REMOTE_ADD[^\?]{1,129}(\$\w{1,9})\h*=[^\?]{1,199}(\$\w{1,9})\h*=\h*array\h*\(\54,\h*\53\);\s*foreach\s*\(\s*\55\s*as\s*\54\)(?:\s*if\s*\()?\s*mail\s*\([^;]{1,49};(?<X1185690>)|[^\?@%\{\}]{0,200}\$scamname\h*=(?<X2171742>)|\s*add_action\h*\(\h*['"][^'"]+['"],\h*['"](\w{1,20})['"]\h*\);\s*if\h*\(!isset\h*\([^@%]{9,300}\}\s*function\h+\58\(\)\s*\{[^\}\-]{99,500}\$\w{1,20}\->set_role\h*\(["']administrator['"]\);(?:\s*\}){4}(?<X1174271>))|\h*\((?:0|NUL|FALSE)\);[^&#@]{99,600}\bif\h*\(get_magic_quotes_gpc\h*\(\)\)\s*\{\s*foreach\h*\(\$_POST\h+as\h+\$\w{1,20}\h*=>\h*\$\w{1,20}\)\s*\{[^<>]{2,640}\becho\h+['"][^/=]{2,70}<title>\h*(?:(?:web\h*)?Shell|D[a4][s5]hb[o0][a4]rd\h+M[a4]in\h+[a4]r[e3][4a])\b(?<X2172141>)|\h*\((?:\d|NULL|FALSE)\);\s*(?:(\$\w{1,20})\h*=\h*['"]\w{32}['"];\s*function\h+\w{1,20}\h*\(\$\w{1,20}\h*,\h*\61\)\s*\{[^\}]{9,99}\}\s*\$kses_str\h*=[^\}]{99,200}(\$\w{1,20})\h*=\h*strrev\h*\([^\)]+\);\s*return\h+@?\62\([^\)]+\);\s*\}(?<X1177560>)|(if\h*\(isset\h*\(\$_[GPRSC]\w{2,6}\[)[^\]]+\]\)\)\s*\{[^\}]{2,99}\}\s*\64[^\{]{0,9}\{\s*echo\h+['"]<form[^\{]{9,250}\b(?:copy|move_uploaded_file)\h*\(\$_FILES\[[^\]]+\]\[['"]tmp_name['"]\][^&\?]{5,99}\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1177880>))|\h*\(\h*(?:0|NULL|False)\h*\)(?:;\s*if\h*\(\h*!isset\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\{]{1,199}\{\s*function\s+(\w{1,40})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*(?:unset\h*\(\h*\67\[[^;]{1,99};\s*){1,5}return\h+\67;\s*\}\s*add_action\h*\(\h*['"]all_plugins['"]\h*,\h*['"]\66['"]\h*\);\s*\}(?<X1174901>)|[^#]{9,350}<title>\h*(?:Shell\h*|Mini\h*|web\h*){2,3}\h*</title>(?<X2151952>))|\s*\((?:0|NULL)\);\s*i(?:gnore_user_abort\s*\([^\)]+\);\s*if\s*\(\s*eregi\s*\([^,]+,\s*(\$_SERVER\[[^\]]+\])\)\s*\)\s*\{\s*@?(?:eval|assert|exec|shell_exec)\s*\(\s*str_replace\s*\(['"][^'"]+['"],\s*['"]['"],\s*\70\)\s*\);\s*(?:die|exit)[^\;]{0,9};\s*\}(?<X1063560>)|ni_set\s*\(\s*['"]display_errors['"]\s*,\s*0\)\;\s*include_once\s*\(\s*sys_get_temp_dir\s*\(\s*\)\s*\.\s*"/SESS_[a-f0-9]{32}['"]\);(?<X1035261>))|\s*\(0\);\s*(\$\w{1,40})\s*=\s*headers_sent\s*\(\);\s*if\s*\(\!\73\)\s*\{\s*(?:(\$\w{1,40})\s*=\s*(\$_SERVER\[["']HTTP_)REFERER['"]\];\s*|(\$\w{1,40})\s*=\s*\75USER_AGENT['"]\];\s*){2}if\s*\((?:\74|\76)\)\s*\{[^\}]+(?:\74|\76),[^\(]{1,40}header\s*\(['"]Loc[^;]+;\s*exit[^;]{0,9};(?:\s*\}){4}(?<X1127312>))
\bE(?:rror_reporting(?:\s*\([^;]+;\s*\$(?:\w+[\s=]+@?file_get_contents[\s\(]+['"]https?://[^/]+/raw/[^\?]+?\bif[\s\(]+extension_loaded[\s\(]+['"]suhosin['"][^\{;]+\{\s*(\$\w+)[\s=]+create_function[\s\(]+['"]{2}[\s,]+(\$\w+)[\s\)]+;\s*\1[\s\(\)\\]+;[^=;]+eval[\s\(]+\2[\s\)]+;[\s\}]+(?:die|exit)\b[^;]{1,19};(?<X1202991>)|\w{1,40}\s*=[\(\s]*isset[\s\(]+\$_SERVER\s*\[[^\]]+\][^!]{99,999}://[^'"/]{9,}/['"];\s*if[\s\(]+!is_null\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^%]{99,9999}\bmt_rand\s*\([^!]+(\$\w{1,40})[^\^]{99,9999}<title>[^/\n]+</[^\?]+<\?[ph\s]+echo\s*\4(?<X2221001>))|\s*\(\s*\d+\s*\)\s*;\s*@define\s*\(\s*urldecode\s*\(\s*'[^']*'\s*\)\s*,\s*'[^']*'\s*\)\s*;\s*@include_once\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*'[^']*'\s*\.\s*urldecode\s*\(\s*'[^']*'\s*\)\s*\);(?<X1038690>))|val(?:[\(\s]+Str(?:ing\.fromCharCode[\(\s]+118,97,114,[^\)]{0,99}61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,[^\)\*/]{9,9999}/\*[^\*]+\*/[\)\s]+;(?<X1228070>)|rev[\(\s]+htmlspecialchars_decode[\(\s]+gzinflate[\(\s]+base64_decode[\(\s]+\$\w{1,40}\b(?<X2198411>))|\("\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E[^\)]{9999,}(?<X2047662>)|\((?:(?:base64_decode|gzinflate|str_rot13|convert_uudecode|gzuncompress)\s*\(\s*){6,18}\(?\$\w{1,40}(?:\s*\))+(?:\s*;)(?<X1131590>)|\((\w+\()(?:['"]https?://[^/'"]+\.(?:xyz|top)/[^;]+;\s*\}[^\{\?\}]{1,99}\{\s*eval\(\11){5}(?<X2201221>)|\((function)\(p,a,c,k(?:,e,d\)\{\w=\13\(\w\)\{[^\n\?]{9,299}//\d+\-\d+\.\d+/\d+\?\d+=\d+[^\n\|]{9,199},\h*['"]\w+\|document\|[^;\.]{9,199}\|head\|appendChild\|addEventListener['"]\.split\([^\)]+\),\d+,\{\}\)\)(?<X1197701>)|[^\)]+\)\s*\{\s*(\w{1,9})\h*=\h*\13\([^\)]+\)\s*\{\s*return\([^\(]{1,9}\15\(parseInt\([^\n@#]{400,800};\d+\.\w{1,9}\([^\)]+\);\s*['"],\d+,\d+,['"][^\)]{1,200}\byadro\|[^\)]{1,200}\|ru\|[^\.]{2,200}\.split\(['"]\|['"]\),\d+,\{\}\)\)(?<X1155131>))|\([^;\)]*\$(?:love(?:you)?fanny|ramdan|rmdn(?:maulana)?|danbella|(?:lonte|memek|jembut)_cyber)\b(?<X2201902>)|\(\$\w{1,15}\[\\['"]payload\\['"]\]\)[^\?]{9,199}/\*Bloodninja\b(?<X2146982>)|\(\(['"\+if\(/gole|yahbn]{9,90}\)/i[^=]{9,150}=['"\+htp:/musicy\.xz]{9,50}[^\)]{9,150}\d{1,3}\)['"\+\}\)]{1,9}\.replace\([^\)]{1,15}\)\)(?<X1152523>)|\(\s*"return\s+eval\(\\\"\$code\\\"\);"\)\s+\?>(?<X2044032>)|\(\s*'error_reporting\(E_ERROR\);\$out(?<X2048610>)|\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:.pass.\]\);\s*exit\(\);(?<X2043591>)|pass(?<X2043561>))|\(\s*\$(?:_g\(\s*\$_b\(\$_r(?<X2044061>)|gzc\(\s*\$b64\(\s*\$r13(?<X2043531>))|\(\s*x\(\$x(?<X2043751>)|\(base64_decode\((?:"aWYgKCFkZWZpbmVkKCdBTFJFQURZX1JVTl[^"]+"\)\);(?<X1040750>)|'(?:JGY9|JGYgP)[^'"]+?'\)\);(?<X1034662>)|@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['[a-zA-Z0-9]+'\]\)\);(?<X1034231>)|['"][^'"]{9,99}(?:IWRlZmluZWQo|ZGVmaW5l|ZWZpbmVk)[^'"]{99,700}(?:c3RyZWFt|dHJlYW1f|cmVhbV9j)[^'"]{1,99}(?:ZmlsZV9nZXRfY29udGVudHMo|aWxlX2dldF9jb250ZW50|bGVfZ2V0X2NvbnRlbnRz)[^'"]{1,99}['"]\)\);(?<X1120142>)|['"]ZXZhbChAZmlsZV9nZXRfY29udGVudHMoImh0dHA6[^'"]{1,99}(?:eHQiKSk7|dCIpKTs|dHh0IikpOw)=+['"]\)\);(?<X1128651>)|[^;]{9,250}\);error_reporting\((?:0|NULL|FALSE)\);\s*(?:\$\w{1,20}=\(isset\(\$_SERVER\[[^;]{9,99}:\$\w{1,20}\);\s*){3,6}(\$\w{1,20})=base64_encode\([^;]{0,150}\);\s*if\(\((include_once\(base64_decode\([^\$]{9,99}\32)\)\)\)\s*\{[^\{]+\belse\s*\{\33\);\s*\}(?<X1183901>)|\$_REQUEST\['\w{1,40}'\]\)\);\s*else\s*eval\(\$_REQUEST\['\w{1,40}'\]\);\s*break;(?<X2050340>))|\(decodeURI\(['"]function%20[^\+\n\{\}\176]{9,499}['"]%5D\h*===\h*undefined\s*\)[^\n@#]{999,}%7D['"]\)\)(?:\s*;)?(?<X1258830>)|\(function\((?:(\w)(?:,\w)+\)\s*\{(?:\h*var\s*\w+[\s=]+0;)+(?:\s*var\s*\w+[\s=]+\[\];)+\s*while[^;]+if\([^;\.]+\.push\(\37\.charAt\(\w+[\)\s;]+else\s*if\(\w+<\37\.length\)\w+\.push\([^\{\}]+\}[^\n%]{0,499}if[\(\s]+\w+\.(charCode)At\(\w+\)%[^\)]+\)[^\-\+\{\}\n]+\.from\38\([^'"]+.join[\('"\);}]+\(['"][\w,'"]{9999,}\)+;(?<X1263112>)|p,a,c,k,e,(?:d\)\s*\{(?:(\w)=function\(\w\)\s*\{return\h*\(\h*\w<a\?['"]{2}:\40\(parseint\(\w[^\n]{99,3500}\bbase64\|\|document[^\}\n]{99,999}\bxyz\|msxml\d\|[^\}\n]{9,299}\.split\(['"]\|['"]\),\d,\{\}\)\)(?<X1195141>)|\w=function\(\w\)\s*\{[^:]{9,250}\breturn\h+\w\}\(["'][^\{]{1,5}\{\\[^:]+:\\["']//[\d\.'",\\:]{10,40}\};(?:[^a-zA-Z;]{1,150};){10,40}['"][\d,]+['"]\|\|[^'"]{99,500}\|php\|[^'"]{9,60}\|eval\|stringify\|[^'"]{1,150}['"],\d+,\{\}\)\)(?<X1193753>))|(?:d\)\{e=function\(\w\)\{return\([^\n]{599,999}['"],\d+,\d+,['"][^'"\d]{1,999}\bsAdsUrl\d+\|[^'"]+['"]\.split\(['"]\|['"]\),\d+,\{\}\)\);?(?<X1131463>)|r\)\{[^\&]{99,999}tongjii[^\{]{1,99}?\.split\(['"]\|['"]\),0,\{\}\)\)(?<X1043193>)|r\)\{e=function\(c\)\{[^\v\*&]{99,499}&&[^\;\v]+;['"],\d+,\d+,['"]\|+indexOf\|if\|rc\|length\|msn\|yahoo\|referrer\|altavista\|ogo\|bi\|hp\|var\|aol\|query[^\.;\}\)]{9,99}go\|window\|location['"]\.split\(['"]\|['"]\),\d+,\{\}\)\)(?<X1161831>))))|\(gz(?:inflate\((?:\$\{\$\{['"](?:\\x\w{2,8}){4,}['"]\}\[['"](?:\\x\w{2,8}){4,}['"]\]\}\)\);\s*(?:\?>|\Z)(?<X2266360>)|str_rot13\(base64_decode\(\$backdoor(?<X2049800>))|uncompress\(base64_decode\('eNqs/fuPK9tWH47(?<X2047290>))|\(Stri(?:ng\.fromCharCode\((?:118(?:,\s*97,(\s*114,)(\s*32,)[^\)]{99,500}83,\s*116,\49\s*105,\s*110,\s*103,\s*46,\s*102,\49\s*111,\s*109,\s*67,\s*104,\s*97,\49\s*67,\s*111,\s*100,\s*101,\s*40,\s*[^\)]{99,199}52,\s*55,(\s*44,)\50\s*57,\s*57,\51\50(\s*49,)(\s*48,)\53\51\50\52\52\53\51\50\s*52,\s*54,\51[^\)]+41,\s*59,\s*10,\s*125\)\);(?<X1064250>)|[,\s]+97[,\s]+114,[^\)]{1,99},\s*111[,\s]+99[,\s]+117[,\s]+109[,\s]+101[,\s]+110[,\s]+116[,\s]+46[,\s]+99[,\s]+114[,\s]+101[,\s]+97[,\s]+116[,\s]+101[,\s]+69[,\s]+108[,\s]+101[,\s]+109[,\s]+101[,\s]+110[,\s]+116[,\s]+40[,\s]+39[,\s]+(115[,\s]+99[,\s]+114[,\s]+105[,\s]+112[,\s]+116)[^\)]{99,}\55[^;]+;(?<X1258850>))|(?:[^\)]{100,2000}\)\);\s*\Z(?<X1043392>)|[^\)]{199,399}46,115,101,116,65,116,116,114,105,98,117,116,101,40,34,115,114,99,34,44,34,104,116,116,112,(?:\d+,)?58,47,47,[^\)]{1,99}58,51,49,50,57,47,106,115[^\)]{99,999}\)\);(?<X1124223>)))|pslashes\(array_pop\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\)\)\)(?<X2045251>))|\(strrev\(file_get_contents\('[\-\w.]+'\)\)\);(?<X1035230>)|\(unescape\(['"]%77%69%6e%64%6f%77%2e%73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%6e%61%6d%65%3d[^'"]{99,999}%3d%5c%27%64%69%73%70%6c%61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f%69%66%72%61%6d%65%3e%27%29['"]\)\);(?<X1124251>)|\h*\(\h*(base64_decode)\h*\(\h*file_get_contents\h*\(\h*\62\h*\(\h*['"]aHR0cHM6Ly9zZW9oYWNrL[^'"]{9,99}['"][\h\)]+;(?<X1189520>)|\h*\(function\h*\(p,a,c,k,e,d\)\s*\{\s*(\w)=function\((\w)\)\s*\{\s*return\h*\(\65[^:]{1,9}:\64\(parseint\(\65[^\.]{2,40}\b(String)\.fromCharCode\([^:]{1,9}:\65\.to\66\([^@`]{3000,9999}\|babn\|blocker\|pointer\|backgroundColor\|[^/<\?\n]{3000,9999}['"]\.split\(['"]\|['"]\),\d,\{\}\)\);(?<X1171372>)|\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\(\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\$\w{1,14}\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\)\;\;\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*die\s*\/\*\s*\w{1,10}\s*\*\/\s*\(\s*(?:\/\*\s*\w{1,10}\s*\*\/)?\s*\)\s*;(?<X2265900>)|\s*\((chr)\(115(\)\.\69)\(121\70\(115\70\(116\70\(101\70\(109\70\(40\)[^'"]{9,400}\69\(99\70\(117\70\(114\70\(108\)[^;]{9,40}\69\(104\)\.(?:\69\(116\)\.){2}\69\(112\)(?:\.\69\(115\))?\.\69\(58\)(?:\.\69\(47\)){2}[^;]{99,350}\.\69\(46\70\(112\70\(104\70\(112\70\((?:39|34)\70\(41\70\(59\)\);(?<X1124260>)|\s*\(['"](?:\\u000a(?:\\u0020)+\\u0076\\u0061\\u0072\\[\\u\da-f]{9,999}\\u002e\\u0073\\u0072\\u0063(?:\\u0020)*\\u003d(?:\\u0020)*\\u0022\\u0068\\u0074\\u0074\\u0070\\[^\)]+\)\h*;(?<X1263471>)|\s*function\s*(\w{1,9})[^\}]{1,9}return\s*file_get_contents[^!\?>]{99,499}\73\s*\([^\?\)]{1,99}\.php\?\w{1,9}=[\s'"\.]+\$_SERVER\[['"]\w{1,30}['"]\][^;]+;(?<X1255970>))|\s*\(\$\w{999,}\);(?<X2132990>)|\s*\(\s*@file_get_contents\s*\(\s*['"]https?://[^'"]{9,99}\.txt['"][\s\)]{2,5};(?<X1131062>)))
\b(?:Ex(?:\h*\(['"]\((crontab\h+\-)l[^\-\v]{1,60}wget[^:;\v]{1,60}https?://[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\h+\-O[^;\v]+\1['"]\);(?:\s*(?:exit|die)[^;]{0,9};){2}(?<X1153141>)|e(?:\h*\(\h*["'](?:wget|curl|lynx)\h+https?://[^\?]{1,499}\bexe\h*\(\h*\$_[GPCSR]\w{2,6}\[(?<X2177820>)|c[\(\s]+(['"](?:rm\h*\-\w[^;]+;\h*)?(?:wget\b[^:;]{1,199}\b(httpS?://[^;]+);\h*curl\b[^:;]{1,199}\b\5;\h*){1,2}chmod\h*\+x[^;]+;(?:(?:perl|\./)\h*[/\w]+;\h*){1,2}rm\h*\-[^'"]+['"])[\)\s]+;(?:\h*@?[esp](?:xec|ystem|hell_exec|assthru|open|cntl_exec)[\(\s]+\4[\)\s]+;){4,}(?:\s*@?(?:exit|die)\b[^;]{0,19};)?(?<X1210794>)|c\("cat /etc/passwd(?<X2046861>)|c\(['"]wget\s+-O\s+/dev/shm/[^\.\s]{1,40}\.(?:php|ini)\s+https?://[\d\.]{8,16}/[^'"]{1,40}['"]\s*\);(?<X1131440>)|c\(\$_(?:GET|POST|COOKIE)\["\w+"\],\$\w{1,40}\);print_r\(\$\w{1,40}\);\}\}if\(\$_(?:GET|POST|COOKIE|REQUEST)(?<X2051400>)|c\(\\?['"]unzip\s+\w{1,40}\.zip\\?["']\);\s*\?>['"];\s*\$\w{1,4}\s*=\s*fopen\(['"][^'"]{0,40}wp-login\.php['"],\s*['"]\w['"]\);(?<X2052640>)|c\h*\(\h*['"]pkill\h+\-9\h+\-f\h+stealth['"][\)\h]+;\s*exec\h*\(\h*['"]pkill\h+\-f\h+\-9\h+stealth['"][\)\h]+;(?<X1189810>)|cl[\(\s'"]+/bin/sh['"]\s*,\s*['"]/bin/sh['"]\s*,\s*['"]\-i['"]\s*,\s*0\s*\)(?<X2101521>))|it(?:[\s\(]+[ir][ne][cq][lu][ui][dr]e(?:_once)?\176(?:raw)?urlDeCOde[\s\(]+['"]%[^'"]{9,}['"][\s\)]+\.\s*__FiLE__\s*\.\s*['"]/['"][^;]+;\s*__HALT_COMPILER\s*\(\s*\)(?<X2227920>)|\s*\(\);\s*\}?\s*if\s*\(\$_POST\[['"]?[^\?]{1,40}['"]?\]\)\s*@?eval\(\$_POST\[['"]?[^\?]{1,40}['"]?\]\);\s*if\s*\(\s*\$_POST\[['"]?[^'"]{0,20}up[^'"]{0,20}['"]?\]\s*[^\w]=\s*['"][^'"]{0,40}['"](?<X2052840>)|\s*\(\s*\)\s*;\s*\}\s*\}\s*if\s*\(\s*(\$_POST)\s*\[\s*('_evalText')\s*\]\s*\)\s*@?eval\s*\(\s*\15\s*\[\s*\16\s*\]\s*\)\s*;\s*if\s*\(\s*\15\s*\[\s*'_upl'\s*\]\s*[^\w]{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*if\s*\(\s*@copy\s*\(\s*\$_FILES\s*\[\s*[^\)]+\s*\)\s*\)\s*\{[^\}]+\}\s*else\s*\{[^\}]+\}\s*\}(?<X2058221>))|plode\(['"]public_html['"],\$\w{1,40}\);\s*\$\w{1,40}\.=\s*['"][^\.]{0,30}Deface\s*['"]\s*\.\s*file_get_contents\s*\(\s*\$\w{1,40}\s*\.\s*str_replace\s*\(['"]/blog['"],['"]['"],\$\w{1,40}\[\d+\]\)\);(?<X2132420>)|tract(?:\(\$_(?:(?:COOKIE|GET|POST|SERVER|REQUEST)\);\s*if\s*\(\$\w\)\s*\{\s*@\$\w\(\$\w\s*,\s*\$\w\)\s*;\s*@?\$\w\(\$\w\(\$\w\s*,\s*\$\w\)\)\s*;\s*\}(?<X1041660>)|[GPCSR]\w{2,6}\);\h*if\(md5\(\$\w{1,9}\)[^\)]+\)\h*\{\h*(?:die|exit)[^;]{0,19};\h*\}\h*\$\w{1,9}\(\h*(\$\w{1,9})\h*,\h*\$\w{1,9}\h*\);\h*(?:includ|requir)e(?:_once)?\s*([\("]{0,2})\20\21\s*;(?<X1149251>)|REQUEST\);\s*if\(md5\(\$\w{1,9}\)\W{2,3}['"]\w{32}['"]\)\s*\{\s*\$\w{1,9}\(\$\w{1,9}\h*,\h*\$\w{1,9}\);\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*\(?['"]?\$\w{1,9}['"]?\)?;\s*\}(?<X1160990>))|\h*\((?:\$_[GPRSC]\w{2,6}\);\h*\$\w{1,3}\((\$\w{1,3})\h*,\h*\$\w{1,3}\);\h*include\h+\24;(?<X1147110>)|\h*\$_[GPCSR]\w{2,6}\h*\);\s*if\h*\(\h*(?:md|sha)[15]\h*\(\h*\$\w{1,40}\h*\)\h*\D{2,3}\h*['"]\w{32,40}['"]\h*\)\s*\{\s*\$\w{1,40}\h*\(\h*(\$\w{1,40})\h*,\h*\$\w{1,40}\h*\);\s*(?:includ|requir)e(?:_once)?\h*\26;\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1166130>))|\s*\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\)\s*;\s*if\s*\(\s*(\$\w{1,40})\s*\)\s*\{\s*\28\s*\(\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}(?<X1041180>)|[GPRSC]\w{2,6}\s*\)\s*;\s*@\$\w{1,40}\s*\(\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X1041191>))))|f(?:\((?:(\w{1,4})===undefined\)\{[^%`]{99,1999}\bvar\s*\31[\s=]+(?:!!\[\]|true|!0)[\s,]+(HttpClient)[\s=]+(function)\s*\(\)\s*\{[^#\?]{1,1999}\bvar\s*(\w+)[\s=]+new\s*\32[\s\(]+\)[^;]+;\s*\34\[[^\]]+\]\([^\)]+\33\s*\([^\{;]+\{[^\}]+\b(\w+\()[^;]+;[\s\}\);]+\33\s*\35[^\)]+\)\s*\{[^\}]+[\s\}]+\(\)+[\s\};]*\Z(?<X1284110>)|typeof\h*(\w+)===undefined\)\{\(function\([^\)]+\)\{(var)\h*_0x[^\n]{99,1999}\b\38\h*\37=[!\[\]]+,(HttpClient)=function\(\)\{\38\h*_0x[^\n]{99,1999}\bvar\h*(\w+)=new\h*\39\(\)._0x[^;]+;\40\[_0x[^;]+;(\w+)\(\w+,\w+\([^;]+[;\)\}]+function\h*\41\(\w+,\w+\)\{\38[^\}]{9,99}0x1;[\}\(\)]+;\};(?<X1281180>))|a(?:lse\)\s*\{\s*if\(is_mobile2\(\)\)\s*exit\('<script[^<]{1,500}</script>'\);\s*}(?<X2049470>)|vicon\d+\.png['"]>\s*</head>\s*<body\h+id=['"]phpbb['"][^\+]{999,9999}<(noindex>)\s*<a\h*class\h*=\h*['"]postlink['"]\h+rel=['"]nofollow['"]\h+href=['"][^'"]+['"]\h+onclick\h*=\h*['"]window\.open\(['"]https?://['"]\+['"][^'"]{2,40}['"][\h\+'"\.]+['"]\w{2,3}['"][^;]+;['"]>[^<>/\s]{1,40}</a>\s*</\44(?<X2156112>))|close(?:\(\$(?:\w{1,20}\);\s*echo\h+['"]<(script>)window\.location\h*=\h*['"]\?indoxploit['"];</\46['"];(?<X2158150>)|\w{1,40}\);\s*(?:exit|die)\b[^;]{0,9};\s*\}[^/]{1,199}\s*<title>\s*Google\W+Docs\s*</(?<X2065500>)|f\);\s*echo\s*['"]o\.k\.['"](?<X2101501>))|\h*\(\h*\$\w{1,40}\h*\)\h*;\s*[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;\s*\}\s*else\s*\{\s*\$random(?<X2159311>)|\s*\(\s*@?fwrite\s*\(\s*@?fopen\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\)\s*,\s*\$\w{1,40}\s*\.\s*['"][^'"]{1,40}['"]\s*\)\s*\)\s*;(?:\s*\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;){0,3}\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$headers\s*\)(?<X2054611>))|eshow="shell_exec"(?<X2050990>)))
\bf(?:ile(?:[\(\s]+['"]/etc/named\.conf["'][^\?]{9,9999}\?\s*substr[\(\s@]+php_uname\s*\(\s*\)[^;]+;(?<X2226610>)|_get_contents(?:\((?:['"]https?://['"]\.\$_[GPRSC]\w{2,6}\[['"]looping['"]\]\.['"]\.\d{1,3}\.\d{1,3}\.\d{1,3}/story\d{0,4}\.php\?pass=\$apass&\w=\$_[GPRSC]\w{2,6}\[[^\]]+\]['"]\)(?<X2172861>)|\h*['"]https://api\.telegram\.org/[^@]{99,499}<(title>)Netflix</\3(?<X2155181>))|(?:\h*\((?:['"]https?://api\.bincodes\.com/[^\)]+\);[^%]{99,600}(?:\$(?:message|msg|f[uc]{2}k)\h*\.?\h*=\h*['"][^\[]+\.\$_POST\[[^\]]+\]\.[^;]+;\s*){3}(?<X2141140>)|\h*['"]/etc/passwd['"]\h*\)\h*;[^\-]{1,9999}\bwp\-(?<X2140540>)|\h*['"]https?://[^\?]{9,399}\b(header)\h*\.?=\h*['"]From:\h*sh[e3]ll[^\}\?]{9,99}\bmail\h*\(\h*[^\)]+\$\7\);(?<X2188010>)|dirname\(__FILE__\)\.['"][^'"]{2,20}/\.\w{1,20}['"]\)\.['"]/(?:pharma?|pills)\.php\?[^\?&\*#]{9,150}\$(?:pills?|pharma?)\h*=\h*explode\h*\([^,]+,\h*\$(?:pills?|pharma?)\b(?<X2183250>))|\s*\((?:\$cachelink\);if\s*\(!\$\w{1,40}\)\s*\{header\(['"]HTTP/1\.1\s+404\s+Not\s+Found['"]\);\s*header\s*\((?<X2137300>)|\s*@?sys_get_temp_dir\s*\([^\{\}]{1,599}foreach\h+\(\h*\$\w{1,40}\h+as\h+(\$\w{1,40})\h*=>\h*(\$\w{1,40})[\s\)]+\{\s*(\$\w{1,40})\s*=\s*explode\s*\([^\)]{0,20}\12[\s\)]+;\s*\$\w{1,40}\[\11\]\[[^\]]+\]\s*=\s*['"]https?://[^;]{1,40}\13\[\d+\]['"\s\)\./]+wp-login\.php['"](?<X2136770>)|\s*\$\w{1,14}\(\s*['"]Lmh0YQ==['"],\s*\d\s*\)(?<X2276601>))))|_put_(?:(content)s\h*\(\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/wp\-\16/db\-cache\.php['"]\h*,(?<X2167641>)|cONTEnts(?:[\(\s]+(?:(?:Utf8_deCODE|trim|chop|hebrev)[\(\s]+)?(\$\w{1,40})[\),\s]+BAse64_decoDe[\(\s]+ImpLoDE[\(\s]+ArRaY_sLICe[\(\s]+fILE[\(\s]+(?:\w+[\(\s]+)?__FiLE__[\),\s]+\d+[,\s]+\d+[\)\s]+;\s*(?:require|INcludE)(?:_once)?[\s\(]*(?:\w+[\(\s]+)?\18[\s\)]*;\s*/\*\s+PD9[^\*]{999,}\*/\s*\Z(?<X1225742>)|[\s\('"]+/home\d*/[^'"]+\.php['"][,\s]+['"][>@]?file_get_contents[\s\(\\'"]+https?://filestack\.live/[a-f\d]+\.html?[\\'"\s\)<]+\)(?:\s*;)?(?<X1238640>)|\('\w+','<\?php '\.\$m\);include\('\w+'\);\s*$(?<X2044891>)|\(((\$this->)workpath)\s*\.\s*['"]\w{1,20}\.txt['"],[^,]+,\s*FILE_APPEND\);\s*fclose\(\$\w{1,20}\);\s*unlink\(\$\w{1,20}\);[^%]{99,500}=\s*\22;\s*(?:(\$\w{1,20})\[[^\]]+\]\s*=\s*(?:function_exists|ini_get)\([^\)]+\)[^;]{1,20};\s*){3,9}\23\w{1,20}\(serialize\(\24\)\);\s*(?:exit|die)[^;]{0,9};(?<X2135511>)|\((strrev\(hex2bin\()[^\}\{%]{9,99}\$_[GPRSC]\w{2,6}\[["'](priv_)\w{1,20}['"]\][\h=]+\26['"][^'"]{9,99}['"]\)\);\s*\$_[GPRSC]\w{2,6}\[['"]\27msg['"]\][\h=]+\26(?<X2192300>)|\(['"](?:[^'"]+\.php['"],file_get_contents\(base64_decode\(['"]aHR0c[^\)]+\)[^\)]{0,499}\$_[GPCSR]\w{2,6}\[[^;]+;(?:echo\s*['"][^;]{1,199};)?(?:die|exit)\b[^;]{0,19};(?<X1235430>)|[^'"]{5,15}\.txt['"][^\)]{9,60}\);\s*(\$\w{1,9})\s*=\s*['"][^'"]{9,50}["'][^\$]+(\$\w{1,9})\s*=\s*['"](?:[^\]]{1,99}(?:Card|Pass|CCV2)){2}[^\]]{9,159}file_get_contents\(['"][^\$]{1,40}bot\30[^'"]{1,40}['"]\.urlencode\(\31\)\);(?<X2123342>)|\w+\.txt['"]\,\s*\$\w+\,\s*FILE_APPEND\);\s*header\(['"]location:\shttps?://[^;]{1,99};(?<X2242520>))|\([^,\)]{0,99}\$_[GPCSR]\w{2,6}\[[^,]{1,99},\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}\?]{0,99}\b[pes](?:assthru|ystem|xec|hell_exec|open)\(['"]rm\s[^;]{1,99};\}?\s*(?:\?>\s*)?\Z(?<X2182970>)|\([^\),]+,\$(?:shells?|wso)\)[^\?]{1,499}\bunlink\(__FILE__\)(?<X2209511>)|\(\$(?:\w{1,20},\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*\$htaccess\w{0,20}=['"]<FilesMatch\h+['"]\.\([^\\\{]{9,150}\block360\.php\b[^\)]{0,40}\)\$(?<X2198370>)|\w{1,40},\h*['"]<\?php\h*/\*['"]\.rand\([^\)]{0,99}\)\.['"]\*/\h*\?>['"]\.\$\w{1,40}\);[^%&#]{99,500}\bcurl_exec\((?<X2149710>)|\{\${"GLOBALS"}\["\w+"\]},\$\w+\,LOCK_EX\);(?<X1247431>)|_SERVER\[['"]DOCUMENT_ROOT['"]\]\.['"]/[^'"]{1,20}\.php['"],<\?php[^\^]{1,9}["']\^['"][^;]{1,40};\s*eval\(["']{2}\.[^;]{1,60}\);\s*\?>\)(?<X1205900>)|path\s*,\s*\$this->get_backdoor_code(?<X2051190>)|rfn,file_get_contents\('pid\.php(?<X2048440>))|\(\s*(?:'err_class/sape\.php(?<X2047720>)|['"]((?:/var)?/tmp/[^'"]+)['"]\s*,\s*['"][^;]+\);\s*(?:echo\s*)?@?(?:eval|system|assert|popen|exec|shell_exec|passthru)\(\s*['"]\s*crontab\s+\43\s*['"]\s*\);(?<X1131450>)|\$\w{1,10}\s*\.\s*["']/\w+\.(?:png|gif|jpg)["']\s*,\s*["']<\?php\s*["']\s*\.\s*get\(\s*\$\w{1,10}\(\$\w{1,10}\)\)\);(?<X2047561>))|\(__FILE__,['"]<\?[^'"]{0,19}['"]\);unlink\(__FILE__\);(?<X2227091>)|\(str_rot13\("[^"]+"\), file_get_contents\(str_rot13\("uggc://[^"]+"\)\)\);.+@\$strings\(str_rot13\(file_get_contents(?<X2044681>)|\h*\(['"](?:(?:\.\./){0,9}wp[\-_][^'"]{3,16}\.(?:php|js)['"]\h*,\h*base64_decode\h*\(\h*['"]PD9[^;\v'"]{499,}['"](?:\h*\))+;?(?<X1139812>)|[\w\-]{1,15}\.php['"]\h*,\h*base64_decode\h*\(['"](?:PD9waHANCkBlcnJvcl9yZXBvcnRpbmcoMCk7|PD8gZnVuY3Rpb24gXzE4OTY1NTAzMzQ)[^'"\);\v]{599,9999}['"]\)\);(?<X1139851>)|\.default/timing/['"]\h*\.\h*microtime\h*\((?<X2161240>))|\h*\((?:[^,\)]+/wp\-(?:admin|contents|includes)/[^'",\)]+\.(?:php|js)['"]\h*,[\h\w\(]{0,49}['"][^\s'"]{39999,}['"][\h\)]+;(?<X1143890>)|[^,\)]{1,49}/wp\-(?:admin|contents|includes)/[^'",\)]{1,49}\.(?:php|js)['"][\h,]+['"]\{\$username\}:\{\$password\}[^,]+,\h*FILE_APPEND\);(?<X1216890>)|[^;,\)]{1,99}/accesson\.php['"]\h*,\h*base64_decode\h*\([^\);]{99,4999}(?:\)\h*){2};?(?<X1168643>)|\h*['"][^'"]{0,19}\.htaccess['"][^;]{1,99};\s*(\$\w{1,40})\h*=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]{1,49};\s*foreach\h*\(\h*\54\h+as\h+\$\w{1,40}\h*\)\s*\{[^;]{0,99};(?:\s*@?[cs](?:ymlink|opy)\h*\([^;]{1,99};){9}(?<X2151050>)|\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*['"]/(?:['"]\h*\.\h*\$_[GPRC]\w{2,6}\h*\[[^\]]+\](?:\h*\.\h*['"]\.php['"])?\h*,\s*\$\w{1,40}(?:\h*\[[^\]]+\])?\h*\)\h*;(?<X1157590>)|wp[\-_]?te?mp(?:\.php)?['"]\h*,\h*@?urldecode\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\)\h*;(?<X1157580>)))|\s*\((?:(?:\$\w{1,20}|\$_SERVER\[['"]DOCUMENT_ROOT['"]\])\s*\.\s*['"]/wso(?:.domain.hack|.?webshell|.shell)\.php['"]\s*,\s*\$\w{1,20}\);(?<X2125500>)|[^\)]+\);\s*header\s*\(['"]Location:[^'"]+['"]\);[^\?]{0,150}\?>\s*<!DOCtYPE\s+html>[^/]{9,99}<title>\s*(?:Accedi\s*o\s*registrati|Login\s*or\s*register)(?<X2125980>)|\\['"]wp-[^\.]{1,30}\.php\\['"],\s*base64_decode\(\\['"](?:PD9waHA|IDw.cGhw)[^"']{99,400}(?:bW92ZV91cGxvYWRlZF9maWxl|IG1vdmVfdXBsb2FkZWRfZmlsZ)[^\\]+\\['"]\)\s*\);(?:\s*/[/\*]['"]\);)?(?<X1061791>)|\s*['"]([^'"]{1,40})['"]\s*,\s*base64_decode\s*\(\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\)\s*\)\s*\)\s*;\s*include\s*\(\s*['"]\61['"]\s*\)\s*;(?<X1054500>)|\s*['"][^,]{1,120},\s*base64_decode\s*\(\s*['"]PD9waHANCmVjaG8gIlRoaXMgc2hpdCB3b3JrcyEiOw0KaWYgKGlzc2V0KCRfRklMRVNbImZpbGVuYW1lIl0pK[^,]{500,510};(?:\s/\*['"]\);)?(?<X1041641>)))))|lush\s*\(\);\s*@mail[\(\s]+\$_GET\[['"]\w+['"]\]\s*,\s*\$subject\s*,\s*\$message\s*,\s*@?\$header[\)\s]+;\s*@?sleep[\(\s]+\$_GET\[['"]\w+['"]\][\)\s]+;(?<X2050311>)|m_theme\s*=\s*['"]\d+['"][^\$]{0,99}\$\w{1,40}\s*=\s*['"]http://pingserver\.org[^;]+;[^\$]{0,99}\$\w{1,40}\s*=\s*['"]wp_old_cache['"];[^\$]{0,99}\$\w{1,40}\s*=\s*['"]wp_old_lcache['"];(?<X2128620>))
\bfo(?:ld in folder\.SubFolders '-->FOLDERz(?<X2050790>)|pen\((?:['"](?:/['"]\.\$\w{1,40}\.['"]/['"]\.\$\w{1,40}\.['"]/\.contactinfo['"],['"]w\+?['"]\);[^:\n]{0,199}['"]:208[23]/resetpass\b(?<X2136871>)|[\w\.-]{1,20}\.txt['"]\h*,\h*['"][aw]\+?['"]\);\s*fwrite\([^\?]{99,200}\bheader\(['"]Location:\h*https?://(?:netflix|paypal|bank|gmail)\b(?<X2147270>)|[^'"]+\.txt['"],['"]a+?['"]\);\s*fwrite\([^\)]+\);\s*fclose\([^\)]+\);\s*@?mail\([^\)]+\);\s*header\(['"]Location:\h*https?://my\.ebay\.(?<X2142290>)|[^'"]{1,20}\.txt['"]\h*,\h*['"][aw]\+?['"]\);[^\d]{9,99}\bfclose\([^\)]+\);\s*header\(['"]HTTP/\d\.\d\h+403\h+forbidden['"]\);\s*(?:die|exit)\(['"]<[^\)]{9,99}<title>\h*404\h+Not\h+Found\b(?<X2151992>)|\.htaccess['"],['"]w['"]\)[^%]{4999,9999}str\(\$\w{1,40},['"]class-wp-mobile\.php['"]\);(?<X2127460>))|\$s1\.'accesson\.php(?<X2050680>))|pen(?:\b\h*\(['"][^\.]{2,30}\.txt['"]\h*,\h*['"]a\+?["']\);[^\*@]{9,200}\bmail\h*\(\$\w{1,20}\h*,\h*['"]Wells\h*(?:fargo)?\h+(?:login|complete|fullz)\b(?<X2176150>)|\h*\(['"][^'"]{2,20}\.txt['"],\h*['"]a\+?['"]\);[^\{\}]{9,400}\bexit\h*\(\h*header\h*\(['"]Location:\h*https?://[^'"]{9,99}=\{(\$praga)\}\{\9\}['"]\)\);[^\?>]{99,500}\9\h*=\h*(?:md5|rand)\h*\((?<X2177230>)|\s*\(['"](?:(r[0o]{2}t\.pl)['"],\s*['"](?:a|w)\+?['"]\);\s*if\s*\(\s*(\$\w{1,40})\s*!=\s*FALSE\)\s*\{\s*fwrite\s*\(\12,\s*base64_decode\s*\(\$\w{1,40}\)\s*\);\s*\$\w{1,40}\s*=\s*exec_all\s*\(['"]perl\s+\11;['"](?<X2121950>)|\w{1,9}\.txt['"],\s*['"]a\+?['"]\);[^=]{1,99}\$\w{1,40}\s*=\s*md5\s*\(\s*rand\s*\(\d+,\d+\)\s*\)[^\(]{1,99}\brecurse_copy\s*\((\$\w{1,40}),\s*(\$\w{1,40})\)\s*\{\s*\$\w{1,40}\s*=\s*opendir\s*\((?:\14|\15)\)\s*;\s*@?mkdir\s*\((?:\14|\15)\)(?<X2130400>))|\s*\(\s*(?:["'][^'"]*["']\s*,\s*['"][^"']*['"]\s*\)\s*;\s*\}\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*rawurldecode\s*\(\s*\$\w{1,40}\s*\[\s*\d+\s*\]\s*\)\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*@?include\s*\(\s*"[^"]*"\s*\)\s*;(?<X2046540>)|['"]/etc/passwd['"]\s*,\s*['"]\w\+?['"]\s*\)[^\{]{1,999}while\s*\(\s*\$\w{1,40}\s*=\s*fgets\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{(?<X2132283>)))|r[\h\(]+(?:(\$\w{1,40})[\h=]+0;\h*\19(<strlen)[\h\(]+(\$\w{1,40})[\h\)]+;[\s\)]+\{(?:\s*\$\w{1,40}[\h=]+['"][^'"]{1,99}['"];)?\s*for[\s\(]+(\$\w{1,40})[\h=]+0;[\h\(]+\22\20[\h\(]+(\$\w{1,40})\D{2,9}\19\20[\h\(]+\21[\h\)]+;\s*(?:\19|\22)\+{2},[^\.\^]{0,199}\.=(?:\h*(?:\21|\23)\{(?:\19|\22)\}\h*\^?){2};[^@]{9,199}@exec\((?<X2178010>)|(\$\w{1,9})[\h=]+0;\h*\25\h*<\h*\d+;\h*\25\++[\s\)]+\{\s*(\$\w{1,40})[\h=]+str_repeat\([^\)]+\25[\h\)]+;\s*if[\h\(]+(file_)exists[\h\(]+\26[\h\.]+['"]wp\-load(\.php)["'][\s\)]+\{break;[\}\s]+if[\h\(]+\27put_contents[\h\(]+\26[\h\.]+['"]wp\-\w{1,9}\28['"][\h,]+base64_decode\(['"][^'"]{9999,}['"][\)\h]+;?(?<X1177960>))|r(?:[\s\(]+[^<]+<(\w{1,9})\.length[^=]+(\w{1,9})\+=String\.fromCharCode[\s\(]+\30\.charCodeAt[\(\w\)]+-\d{1,9}[\)\s]+;\s*document\.write[\(\s]\31[\)\s];(?<X1262341>)|\([^\{\?]{2,40}\)\{(\$\w{1,20})\.?=(\$\w{1,20})\[mt_rand\(\d,strlen\(\34\)[^\];]+\];\}(\$\w{1,20})=['"]<\?php\h*/\*['"]\.\33\.['"]\h*\*/\?>['"]\.\35;(\$\w{1,20})=\$_SERVER\[[^\]]+\]\.['"]/[^\.]{2,20}\.php['"];file_put_contents\(\36,\35\);\}function\h+\w{1,60}\(\35\)\{\$\w{1,20}=array\((?<X2178331>)|\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(?:(\$logins)\h*=\h*str_replace\h*\(['"\h][^'"]+['"]\h*,\h*['"]{2}\h*,\h*\39\);\s*){2,4}(?:echo\h+nl2br\h*\(Execute\h*\(['"]\h*ln\h+\-s[^'"]{2,60}\39\[\38\]\-[^\.]{2,20}\.txt['"]\)\);\s*){10}(?<X2180730>)|\h*\(\h*(\$\w{1,40})\h*=\h*\d;\h*\41\h*\D{1,3}\h*strlen\h*\(\h*['"](\w{199,499})['"]\h*\);\h*\41\h*[\+\-]=\h*(\d+)\h*\)\h*(\$\w{1,40})\h*\.=\h*chr\h*\(\h*hexdec\h*\(\h*substr\h*\(\h*['"]\42['"]\h*,\h*\41\h*,\h*\43(?:\h*\)){3};\h*eval\h*\(\h*\44\h*\);(?<X1170750>)|\s*\(\$i\s*=\s*2\s*;\s*\(\s*\$i\s*<=\s*20\s*\)\s*;\s*\$i\+\+\)\s*{\s*\$newfile\s*=\s*"\$i\.php";(?<X2048460>)|\s*\(\s*(\$\w)\s*=\s*0;\s*\47\s*<\s*strlen\s*\(\s*\$wp_file_descriptions\[['"]md5_check\.php['"]]\s*\);\s*\47\s*=\s*\47\s*\+\s*\d+\s*\)\s*\$search\s*\.?=\s*['"]%['"]\s*\.\s*substr\s*\(\s*\$wp_file_descriptions\[['"]md5_check\.php['"]]\s*,\s*\47,\s*\d+\s*\);\s*\$wp_template\s*=\s*@?preg_replace\s*\((?<X2058430>)|\s*\(\s*(\$\w{1,40})\s*=\s*\d+;\s*\49\s*<\s*\$\w{1,40}\s*;\s*\49\+\+\s*\)\s*\{\s*[^\}]{1,400}flush\s*\(\s*\);\s*\$\w{1,40}\s*=\s*new\s+PHPMailer\s*\(\s*\);(?<X2055221>)))
\bfunction(?:\([^\)]+\)\s*\{\s*show(BankLogoSpinner\(\);)[^\}\{]{2,499}\bhide\1(?<X2172912>)|\h*(?:wsoExGently|pwn)\([^\)]+\)[\{\s]+define\(['"]Logging['"],[^\[]{9,300}\$\w{1,20}\[\][\h=]+Pwn::alloc\((?<X2206661>)|\h*(\w+)[\(\)\{\s]+if[\h\(]+isset[\h\(]+\$_SERVER\[[^\]]+\][\h\)]+\W{2}\h*preg_match[\h\(]+['"]/Googlebot[^\{]{9,99}\{\s*(\$\w{1,15})[\h=]+['"\.\h\*\dbase_dco]+;\s*(\$\w{1,15})[\h=]+['"][^'"]{399,999}['"];\s*echo\h*\5[\h\(]\6[\h\)];[\}\s]+add_action\(['"][^'"]+['"],\h*['"]\4['"]\);(?<X1203660>)|\h*(\w+)[\h\(]+\$\w+[\s\)\{]+(\$\w+)[\h=]+['"]/(?:var|homed*)/[^'"]{0,99}/etc/ssess_\w{32,64}['"];\s*if[\h\(]+file_exists[\h\(]+\9[\s\)]+[ir][ne][cq][lu][ui][dr]e(?:_once)?[\h\(]+\9[\h\)]+;[^\}]{0,199}\}\s*ob_start[\h\(]+['"]\8['"][\h\)]+;(?<X1258370>)|\h*(\w+)[\s\(\)]+\{\s*echo\s*base64_decode[\h\(]+['"]PHNjcm[^'"]{99,400}['"][\h\)]+;\s*\}\s*add_action[\h\(]+['"][^'"]+['"][\h,]+['"]\11['"][^\)]*\);(?<X1230510>)|\h*(\w+)\((?:(\$\w+)\)\{\s*\14[\h=]+base64_decode\(\14\);\s*eval\(\14\);\s*\}[^\?]{9,199}if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*==[^\{]+\{\s*\14[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\13\(\14\);\s*return;\s*\};(?<X1266440>)|(\$\w{1,15})[^\{]+\{\s*return[^\{\}]{9,199}\{\s*\$\w{1,15}[\h=]+@?fopen\(\16[^\?]{9,199}\bchmod\(\16,[^\?]{99,299}\b\13\((\$\w+)[\h\.]+['"]/\w+\.txt['"],[^#]{99,799}\bfile_put_contents\(\17[\h\.]+['"]/wp\-(?:includes|admin|content)/[^\.]+\.php['"],\h*['"]<\?[ph\s]+\?>['"]\);\s*\}(?<X1204520>)|(\$\w{1,20})\)[\{\s]+(\$\w{1,20})=["']base64_decode['"];\s*\19=\20\(\19\);[^\}]{1,40}\}\s*if\((?:md5\()+\$_[^\}\\]{99,500}\becho\h*\13\([^\}]+\);[\}\s]+if\([^\$]{0,20}\$_FILES\[\13[^\{]+\)[\{\s]+[cm]o(?:py|ve_uploaded_file)\([^\}]{9,99}\}\s*echo\h*\13\([^\}]+\);[^\?]{9,99}\bheader\(\13\([^;]+\);(?:exit|die)[^;\}]*;\}(?<X1220661>)|\)[\s\{]+echo\h*['"]\s*<p[^>]+>\s*(?:<a\h*href[\h=]+['"]https?://[^>]{1,99}>[^<]{0,50}\bescort[^<]{0,50}</a>\s*){5}[^\};]{999,};[\}\s]+add_action\(['"]\w+['"][,\h]+['"]\13['"]\);(?<X1209681>)|\)\s*\{\s*(\$\w+)=['"][^\{]{0,199}\{\s*if[\h\(]+update_option[\h\(]+['"]primary_domain['"][\h,]+['"]https?://[^\.]+\.(?:abcd1|2024a)\.ru['"][\s\)]+\{[^\?]{99,1500}\?>\s*<div[^\?]{9,99}<\?[ph\s]*_e[\h\(]+\23[^\}]{9,199}\}\s*add_action[\h\(]+['"]\w+['"][\h,]+['"]\13['"][\h\)]+;(?<X1252530>)|\)\{if\(class_exists\([^\{]{1,99}\{\?><meta[^\n]{9999,45000}\bdocument\[_0x[\d\w]+\(0x[^\n]{9,700}\bwc_add_notice\(['"]<[^>]+>(?:CVV|CVC)/[^\n\?]{99,299}\badd_action\(['"][^'"]+['"],\h*['"]\13['"]\);(?<X1203160>))|\h*(\w{1,15})\(\$\w{1,15}\)\{(\$\w{1,15})\h*=\h*array\([^\)]+\);\h*for\([^\}]{9,199}\}\h*return\h*\27\[\d\];\h*\}\h*(\$\w{1,15})\h*=\h*['"][^'"]{999,5000}['"];\h*(\$\w{1,15})\h*=\h*['"]\26['"];\h*(\$\w{1,15})\h*=\h*\29\([^\)]+\);\h*(\$\w{1,15})\h*=\h*\30\(['"]{2},\29\(\28\)\);\h*\31\(\);(?<X1196370>)|\h*(\w{1,15}\(\))\s*\{\s*(\$\w{1,15})\h*=\h*file_get_contents\(str_rot13\(['"]uggcf://[^\)]+\)\h*(?:\.\h*\$_SERVER\[[^\]]+\])?\);\s*echo\h*\34;\s*\}\s*\33;\s*\?>(?<X1195272>)|\h*(\w{1,25})[\(\)\{\s]+echo\h*['"]<[^>]{0,99}\bdisplay:\h*none[^\}\{]{0,150}<a[^>]{0,99}>[^<]+\b(?:escort|sex|seks)\h*</a>[^\}\{]{0,999}\}\s*add_action\(['"][^'"]+['"],\h*['"]\36['"]\);(?<X1211310>)|\h*(\w{1,25})\(\)\h*\{\s*\$(\w{1,25})\h*=\h*get_option\(['"]\39['"]\);\s*\$\w{1,25}\h*=\h*array\(\s*['"]monit\.php['"]\s*\)[^\?]{99,1100}\bfile_put_contents\(\$\w{1,15},\h*\$\w{1,15}\);\s*\}[^\(]{0,50}\badd_action\(['"]init['"],\h*['"]\38['"]\);(?<X1155870>)|\h*(\w{1,25})\s*\(\s*\)\s*\{\s*(\$(?:alt)?sayfa)\h*=[^\}\{]{1,499}(\$\w{1,40})\s*=\s*(?:['"]<div\b[^>]{0,99}\bstyle=['"]display:none\b[^;]{999,}|curl_exec\s*\([^\}]{1,99});\s*if\s*\([^\)]{0,99}\42\b[^\{]{1,99}\{(?:[^\}]{1,199}\becho\s*\43;[\s\}]+){2,}add_action\s*\([^,]+,\s*['"]\41['"]\s*\);(?<X1190721>)|\h*(\w{1,40})[\(\h]+(\$\w{1,40})[\s\)]+\{\s*@?eval[\(\h]+\46[\s\)]+;\s*\}\s*@?\s*\45[\(\h]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;(?<X1194790>)|\h*(\w{1,40})\(\)\s*\{[^\}\{]{0,99}(\$\w{1,40})\h*=\h*\[(?:\h*['"]https?://xn\-\-\w{2,32}\.xn\-\-p1ai['"]\h*,?){2,}\]\h*;[^\{]{0,99}\{\s*header\(['"]Location:\h*['"]\.\49\[array_rand\(\49\)[^\?]{0,199}\badd_action\(\h*['"][^'"]+['"],\h*['"]\48['"]\h*\);(?<X2263690>)|\h*(\w{1,40})\h*\(\h*\$\w{1,40}\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*list\h*\(\h*(\$\w{1,40})\h*,\h*\$\w+\h*\)\h*=\h*explode\h*\([^;]{1,99}\52\b[^;]{1,99};\s*return\s*openssl_decrypt\h*\(\h*\53\b[^;]{1,99};\s*\}\s*@?eval\h*\(\h*\51\h*\(\h*\$_[GPCR]\w{2,6}\[[^\]]+\]\h*,\h*['"][^;\s_'"]{9999,}['"]\h*\)\h*\)\h*;(?<X1167963>)|\h*(\w{1,40})\s*\(\)\s*\{\s*echo[\s'"\(]+<p\h+style[\s=]+['"]overflow:\h*auto;\h*position:\h*fixed;(?:\h*(?:height|width):\h*0p[tx];?\s*)+['"]\s*>(?:\s*<a\h+rel[\h='"]+dofollow['"]\h+href=['"]https?://[^'"]+['"][^/><]{1,99}>[^\n<]{1,99}</a>){9}[^;]{99,9999}['"][\s\)\};]+add_action[\s\('"]+wp_footer['",\s]+\55['"\)\s]+;(?<X1194310>)|\h*(\w{1,40}\(\))[\{\s]+return\h*\$_[GPRSC]\w{2,6}\[[^\]]+\];[\}\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\57[\)\s]+;(?<X1242620>)|\h*(\w{1,9}(_footer))\(\)\s*\{\s*@?error_reporting\(0\);\s*(\$\w{1,40})\h*=[^;]{9,99}\b(?:aHR0|cggu)[^;]+;\s*if\(preg_match\([^\}]{9,199}(\$\w{1,40})\h*=[^;]+\61\b[^;]+base64_encode\(\$_SERVER\[[^,\}]+,\h*CURLOPT_URL,\h*\62\);[^\}]+\}[^,]{9,199}\badd_filter[\(\h]+['"]wp\60['"][\h,'"]+\59['"][\h\)]+;(?<X1179230>)|\h*(\w{1,9})\(\$to[^\}]+\}\s*else[^\}]+return\s*mail\([^\}]{1,40}\}\s*(?:(\$\w{1,15})\h*=\h*base64_decode\(\$_POST\[[^\]]+\]\);\s*){5}(\$\w{1,15})\h*=\h*\64\([^\)]+\65\);\s*if\(\66\)\s*\{\s*echo[^\}]{1,40}\}\s*else\s*\{\s*echo[^\}]{1,40}\66;\s*\}(?<X1151803>)|\h*(escorik)[\s\(\)]+\{\s*echo\s*['"]\s*<(?:div|p)[^>]{0,99}\b(?:height|width):\h*(?:0|1)\h*pt[^>]{0,99}>(?:\s*<a\h*href[\h=]+['"]https?://[^>]{0,99}>[^<]{0,99}</a>){5}[^\?;]{4000,};\s*\}\s*add_action\(['"][^'"]{0,50}['"],\h*['"]\68['"]\);(?<X1214240>)|\h*(fwss)\([^\(]{0,40}(if[\(\h]+file_exists[\(\h]+(\$\w+)\)\))\s*@?unlink[\(\h]+\72\);\71\s*chmod[\(\h]+\72,\d+\);[^\n#]{9,400}\b\70[\(\h]+['"][^'"]{1,90}\.htaccess['"][,\h]+base64_decode[\(\h]+['"][^'"]{9,150}['"]\)\)(?:;\s*\}|exit[^;]+;)(?<X1220950>)|\h*(get_contents)\h*\((\$\w{1,10})[\)\s]+\{\s*(\$\w{1,10})\h*=\h*(curl)_init\(['"]\75['"]\);\s*\77_setopt\(\76,[^\}]{1,499}\}\s*(\$\W{1,40})\h*=\h*\74\(['"]https?://[^/'";]{1,49}\.com/[^'"\?;]{1,49}\.php['"]\);\s*@?eval\h*\(['">\?]{4}\.\h*\78\h*\);(?<X1173242>)|\h*(get_test_html_ads)[\h\(]+\$\w+[\h\)]+\s*\{[^\}]{9,400}\bcurl_close[\h\(]+\$\w+[\h\)]+;[^\?]{99,299}\bfile_put_contents[\h\(]+\$\w+,\h*\80[\h\(]+base64_decode[\h\(]+[^\)]+[\h\)]+;\s*\}(?<X1212971>)|\h*(login)_(\d{1,4})_merdekaataoemati\(\)\s*\{\s*echo\h*['"][^/]{1,59}>\83v\d{1,4}\h*\-\h*\82(?<X2174550>)|\h*(R\(\))\{\s*var\h+ref\h*=\h*(document\.)referrer;if\(Ref\.indexOf\(['"]\.google\.['"]\)!=[^;\v\}\{]{9,999}\{\s*\86write[\h\(]+['"]<(?:script)[^>;\v\}\{]+>[document\+\h'"]+\.location\h*=\h*['"]https?://[^'"]{9,99}['"][^\.;\v]+\86write\([^\)]{0,9}\)\}+\s*\85;(?<X1133433>)|\h*(wp\w{1,40})\h*\(\)\s*\{\s*@?unlink\h*\(\h*(__file__)\h*\)\h*;[^#!:\*\%]{1,999}\b__halt_compiler[\h\(\)]{0,9};[^\$=]{1,99}\$backdoor\h*=\h*['"][^'"]{999,}['"]\h*;[^\?]{1,499}\bregister_activation_hook\h*\(\h*\89\h*,\h*['"]\88['"]\h*\)\h*;(?<X1171941>)|\h*[0o1]+\((\$url),\$[0o1]+[\h=]+\d+,[^\n]{999,6500}\bfile_get_contents\(\91\);\}\}unset\(\$[o01]+,[^\n]{9999,13000}\bchmod\(\$[0o1]+,\h*\d+\);\h*file_put_contents\(\$[0o1]+[^\n]{999,2000}\b(?:exit|die)[^;]{0,9};[\}\h]+[0o1]+\(\);(?<X1199081>)|\h*\(\h*\)\s*\{\s*add_object_page\h*\(\h*['"]\h*antibots\d\h*shell(?<X2175890>)|\h*\w+[\s\(\)\{]+(\$\w+)[\h=]+['"\hbase64_dco]+;\s*\$\w+[\h=]+['"\hfile_gtcons]+;\s*(\$\w+)[\h=]+str_replace\(['"\h,]+\94\);[^\?\}]{9,250}\b(return)\h*!empty\((\$\w+)\)[\h\?]+\95\(\97,[^\)]+\)[\h:'"]+;[\s\}]+\96[^;]+;\s*\}(?<X1278310>)|\h*\w+\(\)\s*\{\s*(\$\w{1,15})[\h=]+(?:array\((?:(base64_decode\()[^\)]+\)=>\100[^\)]+\),){3}[^;]{1,199};\s*\$\w{1,15}[\h=]+wp_insert_user\(\99\);\s*return[^\}]{1,99}\}\s*(?:add_action\(\100[^\)]+\),\h*\100[^\)]+\)\);\s*){2}(?<X1203670>)|get_user_by\((base64_decode\()[^\)]+\),\h*\102[^\)]+\)\);\s*(\$\w{1,15})[\h=]+\99\->ID;\s*echo\h*\102[^\)]+\)\.\103\.\102[^\)]+\);\s*\}(?<X1203680>)))
\bforeach(?:(?:\s*/\*[^\*/]{0,9}\*/)*\s*\((?:\s*/\*[^\*/]{0,9}\*/)*\s*(\$\w{1,40})(?:\s*/\*[^\*/]{0,9}\*/)*\s*\[\d+\](?:\s*/\*[^\*/]{0,9}\*/)*\s*\([^;>=]*\$_(?:COOKIE|POST)[^\{;]+\{[^\?\^]{99,9999}\b\w{1,40}(?:\s*/\*[^\*/]{0,9}\*/)*\s*\((?:\s*/\*[^\*/]{0,9}\*/)*\s*\1[^;\^]+\^[^;]+;(?:\s*/\*[^\*/]{0,9}\*/)*\s*\}(?<X2266170>)|[\(\s]+\$\w{1,40}\s*as\s*(\$\w{1,40})(?:[\)\s\{]+\3[=\s]+ABSPATH[\.\s'"/]+\3['"\s;]+if[\(\s]+!(file)_exists[\(\s]+\3[\)\s\|]+\4size[\(\s]+\3[\)\s<]+\d+[\)\s\{]+if[\(\s]+!(\$\w{1,40})[\)\s]+\5[=\s]+base64_decode[\("']+PD9[^'"]{99,}['"][\s\);]+if[\(\s]+\5[\)\s]+\4_put_contents[\(\s]+\3[,\s]+\5[\)\s;]*\}\s*\}(?<X1228651>)|[\)\s]+\{\s*\$\w{1,40}\s*=\s*doutdo[\(\s]+\3[\);\s]+(\$\w{1,40})\s*=\s*strpos[\(\s]+\$\w+\s*,\s*['"]\\[^'"]+['"][^;\?:\{\}]+\?[^;\?:\{\}]+:[^;\?:\{\}]+;\s*(\$\w{1,40})\s*\.=\s*htmlspecialchars[\(\s]+\$\w{1,40}\s*,[^;\$]+\7[^;]+;\s*return\s*\8[;\s]*\}(?<X1283940>)|[\)\{\s]+(\$\w+)[=\s]+\$\w+[\(\s]+\3[,\s]+chr[\(\s]+(\$\w+)[\),\s]+\10[\);\s]+\+\+\11[;\}\s]+(?:(\$\w+)[=\s]+(?:chr[\(\s]+\d+\s*[\-\+\*/%]\s*\d+[\)\.\s]+){4,};\s*){2,}\12\s*\([^;]*\10[\s\)]+;(?<X1249170>))|[\(\s]+Array(?:[\(\s]+\$\w{1,40}[,\s]+\$_[GPRSC]\w{2,6}[,\s]+\$\w{1,40}[,\s]+\$_[GPRSC]\w{2,6}[,\s]+\$\w{1,40}[\)\s]+as\s*\$\w{1,40}[\)\s]+\{\s*foreach[\(\s]+\$[^\{\}]{1,99}\{\s*(\$\w{1,40})\s*=[^,;]+['"]\w?\*['"][,\s]+\14[^\^]{1,499}(\$\w{1,40})\s*=\s*\14\s*\^[^\[\}]+\{\s*eval[\s\(]+\15\[\d+\][\s\(]+\15\[(?<X2230460>)|\s*\([^\)]{0,99}?\$_(?:COOKIE|POST)[^\}\^]{9,9999}(\$\w{1,40})[=\s]+\$\w{1,40}\s*\^\s*\$\w{1,40}[^\[]{1,199}(\$\w{1,40})[=\s]+\17\s*\[[^;]+;[^\}]+(\$\w{1,40})[=\s]+\18[^;]+;\s*@?eval[\s\(]+\19[\s\)]+;\s*(?:exit|die)\b[^;]*;[\s\}?>]+\Z(?<X2238530>))|[\s\(]+\$_[GCPSR]\w{2,6}\s*as\s*(\$\w+)\s*=>\s*(\$\w+)[\s\)]+\{\s*if\s*\([^;]*(?:\21|\22)\b[^;\{]+\{[^\}]*\bfile_put_contents[\s\(]+(\$\w+)[\s,]+['"]<\?[^;\)]*(?:\21|\22)\b[^;]+;\s*(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?\23(?:\s*\))?;(?:\s*(?:(?:die|exit);\s*)?\}){2}(?<X1207420>)|[\s\(]+\$_COOKIE\s*as\s*(\$\w{1,40})\s*=>\s*(\$\w{1,40})[\)\s]+\{\s*(\$this\->\w+)\[\25\][=\s]+\26;\s*\}\s*isset[\(\s]+\27\[[^\]]+\][\s)]+&&\s*\27\[[^\]]+\]\s*==+\s*['"]\w+['"]\s*\?[\s\(]*function\s*\([^\};]+var_export[\(\s]+call_user_func_array[^\}]+\}\s*\)\s*\(\s*(?:\27[^\]]+\][,\s\)]*){2}:[^;]{0,40};(?<X1225300>)|\((\$_[GPCSR]\w{2,6})\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{(?:[^;]{0,99};?\29\[\30\]=stripslashes\(\31\);\}[^/]{1,99}<(title>)(?:\W+sh[3e][1il]{2}\s+[re][en]coded?[^/]{1,99}|file\s*manager)</\32(?<X2133921>)|\29\[\30\]=(?:\w{1,40}\(\31\);\}+echo\s*\(?['"]<(?:!DOCTYPE\s*)?html>[^;]{1,99}\bBackdoor\b(?<X2165730>)|stripslashes\(\31\);\}\}echo\s*['"][^;]{9,99}<title>[^/]{1,49}\bh[a4e3]x[o0e3]r\b(?<X2133371>)|stripslashes\(\31\);\}\}echo\s*['"][^;]{9,99}<title>[^/]{1,49}\bmini\s+shell</title>(?<X2130921>)))|\((\$_[GPRSC]\w{2,6})\s*as\s*\$\w{1,20}\s*=>\s*(\$\w{1,20})\)\s*if\(ord\(substr\(current\(array_keys\s*\(\37\)[^\{]{20,200}\{\s*(define\(['"])(\w{1,40})['"],[^\)]+\);\s*\39(\w{1,40})['"],[^\)]+\);\s*(\$\w{1,40})\s*=\s*(strrev\()['"](?:\\x65|e)(?:\\x64|d)[^;]+;\s*preg_replace\(\40,\43\41\),\42\(\38\)\);\s*\}(?<X1133810>)|\(\$\w+\s*as\s*(?:\$\w+=>)?(\$\w+)\)\{[^=;\}]{1,49}=curl_init\(\);[^\}]{0,199}\bcurl_setopt\([^,]+,CURLOPT_USERPWD,[^\);:]{0,49}:[^;\$]{0,9}\45\);(?<X2194240>)|\(\$\w{1,40}\s*as\s*\$\w{1,40}=>(\$pat)\)\{\s*if\(\47\s*==\s*['"]['"]\s*&&\s*\$\w{1,40}\s*==\s*\d+\)\{\s*\$\w{1,40}\s*=\s*true;(?:[^`]{2000,3500})<br\s*/>['"];\s*\}\s*\}\s*elseif\s*\(\s*(\$_POST\[)['"]type['"]\]\s*==\s*['"]file['"]\s*\)\s*\{\s*if\(unlink\(\48['"]path['"]\]\s*\)\s*\)\s*\{(?<X2056365>)|\(\$_[GPCSR]\w{1,40}\s*as\s*(\$\w{1,40})=>(\$\w{1,40})\)\{(\$\w{1,40})\.=(?:[^;]{1,49}(?:\50|\51)){2}\b[^\?]{1,199}\bmail\([^\)]+\52\b[^\?]{1,199}\$(\w{1,40})=fopen\([^;]{1,99};fwrite\(\$\53,\52\);[^\?]{0,199}\b[he](?:eader\(['"]Location:|cho\s*['"]<meta\b[^>;]{1,99}\bhttp\-equiv=['"]?refresh\b)(?<X2164732>)|\(\$_COOKIE\s*as\s*\$\w{1,40}=>(\$\w{1,40})\)\{\$\w{1,40}=\55;[^/\?]{99,499}function\s*(\w{1,40}\()(\$\w+),(\$\w+)\)\{return\s*\57\^\58;\}if\(!?(\$\w{1,40})\)[^/\?]{99,899}if\(!?isset\((\59\[['"]\w+['"]\]\))\s*\|\|\s*!\(\56[^,]+,[^\)]+\)\)==\60\{\59=Array\(\);\}else\{switch\(\59\[['"]\w+['"]\]\)\{(?<X2132060>)|\(\$_POST(?:\h*as\h*\$key=>(?:(\$value)\)\{\$\w{1,20}=\62;\}\$\w{1,20}=['"]aes\-[^\}]{9,199}\butf8_encode\((\$\w{1,20})\);\$\w{1,20}=base64_decode\(\63\);[^\}]{9,99}\bmail\([^\)]+\);if\((\$\w{1,20})\)\{[^:]{2,50}:\s*['"]\.\64;\h*\}(?<X1148342>)|(\$x_value)\)\s*\{\s*(\$\w{1,20})=base64_decode\(\66\);\s*\$\w{1,20}=explode\(['"][^'"]+['"],\67\);[^\(]{0,300}(\$[a-z]{5,20})=mail(?:to)?\(\$[^\)]+\);[^\(]{0,20}if\(\68\)\s*\{\s*echo\b(?<X2157950>))|\h+as\h*\$key=>(\$value)\)\{(\$\w{1,40})=(?:(base64_decode\()+\70\)+;\}(\$\w{1,40})=explode\(['"]\|['"],\71\);(\$\w{1,40})=stripslashes\(\72\73\[\d+\]\)+;[^>\?]{99,299}\bif\(strlen\((\$\w{1,40})\)>\d+\)\h*\{\$\w{1,40}=@?mail\(\74,(?:\$\w{1,24},){2}\75\);(?<X2153881>)|(base64_decode\(){2,}\70\)+;\}(\$\w{1,40})=explode\(['"]\|['"],\71\);(\$\w{1,40})=stripslashes\(\77\78\[0\]\)+;[^\?]{99,999}(\$\w{1,40})=@?mail\(\79(?:,\$\w{1,24}){3}\);[^\?]{0,99}if\(\80\)\{echo\b(?<X2154220>)))|\(array_merge\(\$_COOKIE,\$_POST\)\s*as\s*\$\w{1,40}=>(\$\w{1,40})\)\{\82=unserialize\(\w{1,40}\(\w{1,40}\(\82\),\$\w{1,40}\)\);if\(isset\(\82\[[^\]]+\]\)\D{2,3}\$\w{1,40}\D{2,3}\82\[[^\]]+\]\)\{if\(\82\[[^\]]+\]\D{2,3}['"]\w{1,40}['"]\)\{\$\w{1,40}=Array\(['"]pv['"]=>phpversion\(\),['"]sv['"]=>(?<X2125300>)|\h*\(\$\w{1,15}\h*as\h*(\$\w{1,15})\)\s*\{\s*echo[^;]+\bunder\h+attack\h+is\h+\84[^\{]{9,99}\{\s*\$finalpass\h*=\h*trim\(\$password\);(?<X2160500>)|\h*\(\$\w{1,20}\h+as\h+(\$\w{1,20})\h*=>\h*\$\w{1,20}\)\s*\{\s*(unset\h*\(\h*\$\w{1,20})\[[^\]]+\]\[\86\]\);[^\\//]{9,400}\b\87\h*\);\s*\}\W{0,40}function\h+[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\d*\([^\)]+\)\s*\{[^\}]{9,150}\breturn\h+stream_get_contents\h*\((?<X2176271>)|\h*\(\$blocked_words\b[^\)]+\)\s*\{[^\{]{0,50}\{\s*header\(['"]HTTP/\d\.\d\h+Shopping['"]\);\s*\$\w{1,20}\h*=\h*getenv\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,20}\s*=\s*fopen\((?<X2141380>)|\h*\(\h*(\$_[GPRSC]\w{2,6})\h*as\h*(\$key)\h*=>\h*(\$\w{1,15})\h*\)\h*\{\s*\90\[\91\]\h*=\h*stripslashes\h*\(\h*\92\);\s*\}\s*\}\s*echo\h*['"][^#]{0,199}\b(title)>Hidayat.Shell</\93>(?<X2167430>)|\h*\(\h*\$_[GPCSR]\w{2,6}\h*as\h*(\$\w{1,40})\h*=>\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*\.=(?:[^;]{0,49}(?:\95|\96)){2}[^;]{0,49};\s*\}[^\?]{1,199}\bmail\h*\([^\)]+\97\b[^\?]{1,199}\bfopen\h*\([^,\);]+\.txt['"]\h*,[^;]{1,40};\s*@?fwrite\h*\([^,\)]+,\h*\97\h*\);(?<X2164940>)|\h*\(new\h+Recursive(?:Iterator)+\([^\}@%]{99,150}\bif\h*\((stripos)\h*\((\$\w{1,20})\h*,\h*['"](?:htaccess|functions)['"]\)\W{2,4}!?\99\(\100\h*,\h*['"](?:wp-content|themes)['"]\)\)\s*\{\s*@?chmod\h*\(\100\h*,\h*0?777\);\s*file_put_contents\h*\(\100,\h*base64_decode\((?<X2167560>)|\s*\(\s*\$(?:_COOKIE\s*as\s*(\$\w{1,40})[\s=>]+(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\[\102\][=\s]+\103[\s;]+\}\s*isset[\s\(]+\104\[[^\?:;]+\?\s*\(\s*function[\s\(]+(\$\w{1,40})[,\s]+(\$\w{1,40})[\s\)]+\{[^;]{0,40}\bcall_user_func_array\b[^;]+\105[^;:\?]+\106[^\}]{0,199}\}\)\(\s*(?:\104\[[^\]]+\][,\s\)]+){2}:[^\?:;]+;(?<X1219040>)|RandomNum\s*as\s*\$key\s*\)\s*\{\s*\$Keys\s*\.\s*=\s*chr\s*\(\s*bindec\s*\(\s*\$\w{1,40}\s*\*\s*\d+\s*-\s*\d+\s*\)\s*\)\s*;\s*\}\s*@?(?:eval|echo)\s*\(\s*\$\w{1,40}\s*\)\s*;(?<X1038812>))|\s*\(\s*explode\s*\(\s*['"][^'"]+['"]\s*,\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*as\s*(\$\w{1,40})\s*\)\s*\{\s*(\$\w{1,40})\s*\.=\s*chr\s*\(\s*strlen\s*\(\s*\109\s*\)\s*\W\s*\d+\s*\)\s*;\s*\}\s*(\$\w{1,40})\s*=\s*substr\s*\(\s*\110\s*,\s*\d+\s*,\s*\d+\s*\)\s*;\s*@\111\s*\(\s*\110\s*\)\s*;(?<X1195880>))
\bfunction(?:\s*(\w{1,40})[\(\)\s]+\{\s*(?:\$\w{1,40}[=\s]+\$\s*\{\s*['"]\\x5f\\x50\\x4f\\x53\\x54["'][\s\}]*;[^\n>\*]{999,}\b(?:exit|die)\b[^;]*;[\s\}]+\1[\s\(\)]+;(?<X1239800>)|define[\(\s]+['"][^'"]{1,40}['"]\s*,\s*['"]aHR0c[^;]+;(?:\s*\$\w+[=\s]+(\$_SERVER)\s*\[['"]HTTP_[RUH][^'"]+['"]\];){2,}[^\{\}]+\3[^;]+;[^@\?]{0,999}@file_put_contents\b[^|\?]+\becho\s*\w+\s*\([^;]+;[^:]{0,999}\bheader[\(\s]+['"]Content\-Type:[^\}]+\}\s*\}\s*\1[\s\)\(]+;(?<X1273990>))|\s*(\w{1,40})[\(\s]+(\$\w{1,40})(?:[\)\s\{]+(\$\w{1,40})[=\s]+['"]base64_decode['"\s;]+\6[=\s]+\7[\(\s]+\6[\)\s;]+\7[=\s]+['"][^'"]*['"][\s;]+return\s*\7[\(\s]+\6[\)\s;\}]+if[\(\s]+(?:md5[\(\s]+){2,}\$_[GPRSC]\w{2,6}\s*\[\s*\5[^;]+;[^\?]+header[\(\s]+\5[\(\s]+['"][^\}]+\b(?:exit|die)\b[^;]*;[\s\}]+\Z(?<X2221041>)|[\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+['"]['"\h\.gzinflate]{9,40}['"][\s;]+(\$\w{1,40})[^\(\}]+\6[=\s]+\9[\(\s]+\10[\(\s]+\6[\)\s;]+return\s*\6[^,]{0,99}(\$\w{1,40})[=\s]+['"]\5['"\s;]+(\$\w{1,40})[\s=]+\11[\(\s]+['"]S[^;]+;\s*(\$\w{1,40})[=\s]+\12\(['"]{2},\11[^;]+;\s*@?\13\(\);(?<X1211210>)|\s*\.?=\s*['"][^'"]{1,40}['"]\s*;[^\-\+]{0,99}\9\[[\s\(]{0,9}\d+\s*[\-\+\*/]+[\s\(]*\d[^\}]+\breturn\s*\$?\w{1,40}[\s\(]+\6[\s\);]*\}[^\*\-]*(\$\w{1,40})[=\s@]+\5[\(\s]+\15[\)\s;@]+(?:eval|assert)[\(\s]+@?\15[\)\s]+;(?<X1212510>))|[\)\s]+\{\s*(?:@[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\6(?:[\)\s;]+\}[^:\{\}]{0,499}(\$\w{1,40})[=\s]+str_replace\s*\([^;:\{\}]+['"]php://[^;]+;\s*(\$\w{1,40})\s*=[^;]*\17[^;]*;[^\?]{0,499}\5\s*\([^;]+\18\[[^;]+;(?<X1240700>)|[\)\s]+;\s*\}\s*\5[\(\s]+(?:\w+[\(\s]+)+['"][a-z/\+\d]{999,}=?=?['"][,\s]+\$\w{1,40}[\)\s]+;(?<X1220200>))|\6[=\s]+gzinflate[\(\s]+base64_decode[\(\s]+\6[\)\s;]+for[\(\s]+(\$\w{1,40})[=\s]+\d+[\s;]+\21\s*<\s*strlen[\(\s]+\6[^\{]{0,40}\{\s*\6\[\21\][=\s]+chr[\(\s]+ord[\(\s]+\6\s*\[\21[^\}]+\}\s*return\s*\6[\s;\}@]+eval[\(\s]+\5[\(\s]+['"][^'"\$]{99,}['"][\);\s]+;(?<X1240041>)))|\s*(\w{1,40})[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][^'"\$]{1,40}['"]\s*;\s*(\$\w{1,40})\s*=\s*\24\s*\[[\(\s]*\d+\s*\-\s*\d+[^;]*;[^\}]{0,299}\breturn\s*\25[\(\s@]+\$\w{1,40}[\)\s]+;\s*\}[^\?]{0,999}(\$\w{1,40})[=\s]+\23[\s\(]+\26[\s\)]+;[\s@]*\$\w{1,40}[\s\(]+\26[\s\)]+;(?<X1211610>)|\s*(\w{1,40})[\s\(\)]+\{\s*(?:echo\s*['"]\s*<(\w+)\b[^>]{0,99}\bstyle=['"](?:[^'"]{0,99}\b(?:height|width)\s*:\s*0(?:px|em|pt|in)\b){2}[^>]{0,99}>\s*(?:<a\b[^<]{0,199}</a>\s*){1,}</\29>\s*['"];\s*\}\s*add_action\s*\([^,\)]+,\s*['"]\28['"]\s*\);(?<X1194011>)|if[\s\(]+isset[\(\s]+(\$_SERVER\[['"]HTTP_REFERER['"]\])[\s\)\{]+\$\w{1,40}[=\s]+\31[^\n,\?:]{1,299}\barray[\s\('"]+\.(?:msn|google|yahoo|bing|baidu)[^;]+;\h*foreach[^\n<>/]{9,499}if[\s\(]+\28[\(\s\)]+\{[^;<]+\becho[^\}:]+refresh['"]\s+content=['"]\d+;url=https?://[^\}]+\}(?<X1236748>))|\s*(\w{1,40})[\s\(]+(\$\w{1,40})[\s\)]+\{\s*(?:(\$\w{1,40})\s*=\s*['"]/tmp/ssess_[^;]{1,32}['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\35[\)\s@]+include(?:_once)?[\(\s]+\35[\s\);]+return\s*class_exists[\(\s'"]+phpupdate[^\};]+\34\s*;\s*\}\s*ob_start[\(\s'"]+\33['"\)=]+;(?<X1250821>)|\34[\s=]+gzinflate[\s\(]+base64_decode[\s\(]+\34[\s\);]+for[\s\(]+(\$\w{1,40})[\s=]+\d+;\s*\37<strlen[\s\(]+\34[\s\);]+\37[\+\s\)]+\{\s*\34\[\37\][\s=]+(?:(?:chr|ord)[\s\(]+){2}\34\[\37\][\s\)]+-\d+[\s\);\}]+return\s*\34;\s*\}\s*@?eval[\s\(]+\33[\s\(]+['"][^'"]{999,9999}['"][\s\)]+;(?<X1194360>))|\s*(\w{1,40})\(\)\{var\s*\w{1,40}=\[['"][a-z\d]+['"],[^\]]+\];\39=[^\n!]{9,}\bwhile\(!!\[\]\)\{try\{var\s*\w+=parseInt\s*\([^\n]{99,}\}\(window,document,[^;]+\)\);(?<X1253600>)|\s*(\w{1,40})\s*\((?:[^\{;=,]{1,40}\{\s*\$\w+[=\s]+['"]{2}\s*;\s*if[\s\(]+function_exists[\('"\s]+(file_get_contents)['"\)\s]+\{\s*\$\w+[=\s]+\42[^\n\?]{1,999}(\$\w+)[=\s]+\41[\s\(]+str_rot13[\s\(]+base64_decode[\s\(]+['"]dWdnY2Y6Ly[^'"]+['"][\s\)]+;\s*@?eval[\s\(\?'">\.]+\43[\s\)]+;(?<X1261620>)|\)\s*\{(?:[\s;]*(\$\w{1,40})\s*=\s*!\s*(define)d[\s\(]+['"](\w+)[^\}>]{0,999}\bforeach[\s\(]+\$_[GPRSC]\w{2,6}\s*as\s*\$\w{1,40}[\s=>]+\$\w{1,40}[\)\s]+\{\s*if[\s\(]+\46d[\s\(]+['"]\47\b[^,]{9,999}\bif[\s\(]+\45[^\}]{0,199}\beval[\s\(]+\$\w{1,40}[^\}]+(?:\}\s*)+(?:eval[\s\('"]+)?\46[\s'"\(]+\47\b[^\}]{0,199}\41[\s\(\)]+;(?<X2198922>)|\s*(\$\w{1,40})\s*=\s*['"][base'"\.\h]{4,}\d+[/\*]\d+\s*\.\s*['"]_['"]\s*\.\s*['"][deco'"\.\h]{6,}['"];\s*echo[\s\(]+\49[\s\(]+['"][^'"]{99,9999}['"][\s\)]+;\s*\}\s*add_action[\s\(]+['"]wp_(?:head|footer)['"][\s,]+['"]\41['"][\s\)]+;(?<X1195020>)))|\s*(\w{1,40}\(\))\{\s*return\s*hex2bin\(['"]68747470(?:73)?3a2f2f636f6e6e6563742e61706965732e6f72672f['"]\);\s*\}[^\(\$\{]{1,19}\bfunction\s*\w{1,40}\([^\)]+\)\{[^\$\(]{1,19}(\$this\->)_?wp_remote_post\(\52\51(?<X2152561>)|\s*(\w{1,9})[\(\s]+(\w{1,9})[\)\s]+\{\s*var\s*\w{1,9}\s*=['"]['"]\s*;(?:\h*var\s*\w{1,9}\h*(?:,\h*\w{1,9})+;)+\h*var\s*(\w{1,9})=0;\s*while[\s\(]+\56<\55\.length[^\}\n]+\}[^\}]{0,99}\.fromCharCode\([^\n]{40,999}this\[\54\(['"][^'"]+['"][\s\)]+\]\s*\([^\)]+\)\][\s;\)]+\}(?<X1213720>)|\s*(\w{1,9})\([^\{]{1,20}\{(\$\w{1,9})\s*=\s*array\([^\?]{9,99}strlen\(\59[^\}]{9,50}chr\(ord\(\59\[[^\}]{9,99}\}\s*return\s*\59\[\d{1,3}\];\}\s*(\$\w{1,9})\s*=\s*['"][^'"]{9,99}['"];\s*(\$\w{1,9})\s*=\s*['"]\58['"];[^\n]{9,99}(\$\w{1,9})\s*=\s*\$\w{1,9}\(["']{2},\s*\61\(\60\)\);\s*\62\(\);(?<X1135032>)|\s*(\w{1,9})\s*\((\w)\)\s*\{\s*var\s*\w\s*=\s*\65\.length,\w=\d+,[\w,=0]{3,40}Array\((?:\d+,){9}[^\}]{299,499}\}else\s*\{\s*\w=\d+\s*\}\s*\}\s*\}\s*eval\(\w\);\s*\}\s*\}\s*\64\(\\?['"][^'"\\]+\\?['"]\);?(?<X1124621>)|\s*(_0x\w{1,9})\([^\}]{9,499}\bif[\(\s]+\67\[[^\]]+\]===undefined[\)\s]+\{[^#\.\$]{999,3999}\bvar\s*\w{1,9}[\s=]+atob[\s\(]+['"]aHR[^'"]+['"]\+(_0x\w{1,9})[^?#\.]{99,999}\bdocument\[\s*\68[^\[]+[\s\[]+['"]\w{1,9}['"][\s\]\(\)]+;(?<X1259001>)|\s*(_\d{5,10})\(\$\w{1,5}\)\{[^\}]{1,90}\}[^\(]{1,25}function\s*([l_0]{1,5})\((\$_\d)\)\{return\s*isset\(\$_[GPRSCF]\w{2,6}\[\72\][^\}]{9,150}\}\s*(\$_\d)=\71\(\70\(\d{1,2}\)\)[^;]{9,99};\s*if\(!empty\(\73\)\)\{[^\{]{9,99}\{(\$_\d)=create_function\(\70\(\d\),\73\);\74\(\);exit\(\);\}\}(?<X1129110>)|\s*(fetch_by_curl)[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{\s*\$\w{1,40}\s*=[\(\s!]*empty[\s\(]+(\$_SERVER)\s*\[[^@]{999,}@strtolower[\s\(]+\77\s*\[[^<]{999,}\becho\s*\76[\(\s]+\$\w{1,40}[,\s]+\77\s*\[['"]HTTP_USER_AGENT['"]\][\)\s]+;(?<X1205520>)|\s*(getS\w+)\s*\([^\}]+\}[^\n\*]{999,}(\$\w+)\[['"]http_user_agent['"]\][^\}]+\79\s*\([^;]+\80[^;]+;[^\}]+\}\s*function\s*\w+[\(\)\s]+\{[^\}]*\}\s*\w+[\(\)\s]+;(?<X1257350>)|\s*(globalClick)[\(\s]+event[\)\s]+\{\s*const\s*\w{1,40}[=\s]+(location)[\.\s]+host\s*const\s*(\w{0,9}\83)[=\s]+['"]https?://bit\.ly/\w+['"](?:[^\}]+window\.open[\(\s]+\84[,\s'"]+_blank['"\)\s]+\}\s*\})+\s*document\.addEventListener[\(\s'"]+click['"][,\s]+\82[\)\s]+\}\s*\)\s*\(\)(?<X1238790>)|\s*(init\(\))\{var\h*f=navigator\.userAgent;[^\n]{1,99}\bvar\h*\w=['"][^\.]{1,50}/\w{1,40}\.jpg\?js['"];[^\n]{99,200}\bvar\h*(\w)=(document)\.getElementsByTagName\(['"]head['"]\)\[\d{1,2}\];\87\.appendChild\([^\n]{99,400}\b\88\.cookie=\w\+['"]=['"]\+\w\}\}\86;(?<X1157062>)|\s*(isbot)\(\)\s*\{\s*\$bot\w{1,9}\s*=\s*['"][^\}]{99,299}\}\s*if\s*\(\90\(\)\)\s*\{\s*echo\s*@?file_get_contents\(base64_decode\([^\}]{9,99}\}\s*else\s*\{\s*\}(?<X1130702>)|\s*(isInString1)\((\$\w{1,15}),\s*\$\w{1,15}\)\s*\{\s*\93\s*=\s*['"][^'"]{1,19}['"]\s*\.\s*\93;\s*return\s*\(bool[^\}]{9,99}\}\s*(\$\w{1,15})\s*=\s*strtolower\(\$_SERVER[^;]{9,50};\s*if\(\92\(\94[^\}]{1,50}\}\s*else\{\s*header\(['"]Location[^#]{9,199}<html(?<X2134741>)|\s*(nemoViewState\(\))\s*\{\s*var\s*\w{1,40}\s*=[^/]{99,399}\}\s*document\.write\([^\)]+\);\s*\}\s*\96;(?<X1131751>)|\s*(updatefile)\h*\([^\)]+\)\s*\{\s*\$\w{1,15}\h*=\h*['"]http[^;]{0,49};\s*\$\w{1,15}\h*=\h*['"]<(title)>40[43]\h*(?:Not\h*Found|Forbidden)</\99>['"];[^\}]{9,400}\bfile_put_contents\h*\(\$\w{1,15},\h*\$\w{1,15}\);[^\?]{9,400}\}\s*\98\h*\(\h*\);(?<X1179542>)|\s*[O0_]{1,40}[\(\s]+\$url\s*,[^\.]+\$\w{1,40}\s*\.=\s*\$url[^\}]+\}[^#]{999,}\bif[\(\s]+\$\s*\{\s*['"]GLOBALS['"]\s*\}\s*\[[^\]]+\][\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\*]{999,}\b(?:die|exit)\b[^;]{0,40};(?:\s*\})+\s*@?[O0_]{1,40}[\s\(]+\$[O0_]{1,40}[\s\)]+;(?<X1212100>))
\bf(?:p(?:\s*=\s*@fsockopen\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\d+\s*\)\s*;\s*if\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*@fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*connect3\s*\(\s*\$\w{1,40}\s*\.\s*["'][^"']*["']\s*\.\s*urlencode\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;\s*\}\s*(?:exit|die)[^;]{0,9};(?<X2046351>)|assthru\([^@]{1,199}<title\b[^>]{0,99}>\h*X14ob\h*(?:\-\h*)?[S$]h[e3][l1]{2}\b(?<X2163420>)|uts\s*\(\s*\$fp\s*,\s*['"][^'"]{60,99}SimAttacker\s*\d+\.\d+\s*ready(?<X2123561>))|rom:\h*(?:(?:jokamerrez|losyavlaton)\d*@(?:gmail|yahoo|prontonmail|yandex)\.com['"][^;]{0,9};\s*mail\((?<X2171831>)|\w{1,20}\h*sp[@4a]m<[^>]+>['"];\s*\$\w{1,20}\h*\.?\h*=\h*\$(?<X2153021>))|sockopen\(['"]udp://\$\w{1,20}['"],[^\)]+\);[^/]{99,300}\becho\h+['"]DD?OS\h+attack\h+against\h+udp://(?<X2149761>)|unction (?:__\w{1,40}\(\$\w{1,40}\)\{\$\w{1,40}=[base64_decode.']+;return\s*\$\w\(\$\w{1,40}\);\}\}\$\w+=[create_function.']+;\$_(?<X2050320>)|arr2html\(\$array,\s*&\$arr\s*=\s*'\s*',\$ztabhtml='',\$zheaderarray=''\)\s*{\s*\$array\s*=\s*"as"\s*\.\s*\$_REQUEST\['array'\];\s*\$sort\s*=\s*array\(\$_REQUEST\['sort'\]\);(?<X2045980>)|check_commands\s*\(\)\s*\{\s*if\s*\(\s*array_key_exists\s*\(\s*'delete'\s*,\s*\$_REQUEST\s*\)\s*\)\s*\{\s*unlink\(\s*__FILE__\s*\);(?<X2050610>)))
\bfunction(?:\s*start(?:_work\(\s*\$off\s*,\s*\$unto\s*\)(?<X2046950>)|Web\s*\(\s*\)\s*\{\s*try\s*\{\s*define[\(\s]+['"]URI['"][,\s]+self::getURI\s*\([\)\s]+;[^%@\+]{99,9999}\+['"]\?MainFileExplorer\b(?<X2223210>))|\s*xcalendarBufferEnd\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*xcalendarWPBase::getInstance\s*\(\s*\)\s*;(?<X2047160>)|\s*xr\(\$text,\$key\){\$out="";for\(\$i=0;\$i(?<X2044081>)|\s+(\w+)[\s\(\)\{]+(\$\w+)\s*=[^\?]{1,499}\6\s*\.=[^;]*(?:\$_SERVER\[[^;]+){2,};[^\?]{0,499}\breturn\s+\6;\s*\}\s*\$subject[\s=]+['"][^;]+;\s*\$m(?:essage|e?sg)[\s=]+\5[\s\(\)]+;\s*@?eval[\s\(]+pack[\s\(]+['"]H\*['"][,\s]+['"]6d61696c28[^;]+;(?<X1210360>)|\s+(\w+)[\s\(\)]+\{\s*(\$\w+)(?:[\s=]+get_option[\s\(]+['"][^'"]+['"][\s\)]+;\s*@?file_put_contents[\s\(]+['"][^'"]+\.php['"][,\s]+['"]<\?[^\)]*\9[^\)]*\);\s*\}\s*add_action[\s\(]+['"]\w+['"][\s,]+['"]\8['"][\s\)]+;(?<X1197690>)|[\s\.=]+['"][^\}]{1,499}(\9[\s\.=]+['"])script\.src[\s=]+['"]https?://[^/'"]*\bnagishly\.co/[^\$]{1,199};\s*(?:\11[^\$]+){19,};\s*echo\s*\9;\s*\}\s*add_action[\s\(]+['"]\w+['"][,\s]+['"]\8['"][\s\)]+;(?<X1202110>))|\s+(\w+)[\s\(\)]+\{\s*(?:(document\.write(?:ln)?[\s\(]+)['"]<script\b[^>]{0,99}\bsrc=['"](?:https?:)?//[^'"/]*\bcryptaloot\.pro/[^\{\}]{0,199}\b\14['"](\w+)[\s\.]+start[\(\)\s]+;[^\{\}]{0,199}\}\s*var\s*\15[\s=]+\13\s*\(\s*\);?(?<X1197390>)|if\s*\([^;]{1,199}\b[de](?:xit|ie)[\s\(]+['"]<form\b[^#]{1,999}\$(\w+)[\s=]+@?(file_)ge(t_contents)\s*\([^\);]*\$_[GPCSR]\w{2,6}\[[^\?]{1,499}\b\18pu\19\s*\([^,;]+,\s*\$\17\b[^&]{999,}</html>['"];\s*(?:die|exit)\b[^;]{0,9};\s*\}\s*\13\(\);(?<X1213430>))|\s+(\w+)[\s\(]+(\$\w+)[\s\)]+\{[^;\}]{1,99}\bfile_get_contents[\s(]+\22[\s\)]+;[^\n\?>\*#%\^]{99,999}(\$\w+)\s*=\s*\21[\s\(]+["']https?://[^;]+;[^\n\?]{0,99}\23[\s=]+str_replace[\(\s]+['"]\.(?:html|xml)['"][\s,]+['"]{2}[\s,]+\23[\)\s;]+echo\s*\23;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1199810>)|\s+(\w+)\(\)\{(\$\w+)=['"](?:(?:https?://|ahr0c)[^;]+;[^\}]+(\$\w+)=curl_exec\([^\?]{1,499}\27=file_get_contents\(\26\)[^\?]{0,199}\becho\s*\27;\}(?:header\([^;]+;)+add_action\(['"][^'"]+['"],['"]\25['"]\);(?<X1229170>)|[^;]+;(\$\w+)=strrev\(\26\);if\([^\)]*(\$_[GPSRC]\w{2,6}\[\29\])[^\{;]+\{(\$\w+)=\w+\([^;]*\30[^;]+;\$\w+=explode\(['"]\W{3,}['"],\31\);[^\}]+\}+add_action\(["']\w+['"],['"]\25['"]\);\s*(?:\?>|\Z)(?<X2204371>))|\s+(\w{1,20})\s*\((?:(\$\w{1,20})\s*,\s*(\$\w{1,20})\)\s*\{[^=]{0,200}\$\w{1,20}\s*=\s*str_replace\s*\(\s*array\s*\([^;]+,\s*\34\);\s*\$\w{1,20}\s*=\s*['"][base64_dco\.\s']{16,30}['"];[^:]{99,999}\35\s*=\s*isset\s*\([^;]+\);\s*\34\s*=\s*['"][^'"]{3000,9000}['"];\s*\$\w{1,20}\s*=\s*\33\(\34\s*,\s*\35\);(?<X2064721>)|\)\s*\{\s*\$\w{1,20}\s*=\s*\$_SERVER\[[^\]]+\];\s*\$\w{1,20}\s*=\s*str_replace\s*\(array\s*\(['"]https?://[^\}]{99,350}curl_exec\s*\([^\)]+\);[^%]{9,99}\}\s*add_action\s*\(['"]wp_footer['"]\s*,\s*['"]\33['"]\);(?<X1126200>))|\s+(\w{1,40})[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\$\w{1,40}\s*=\s*wp_remote_get[\(\s]+\39[^:]{1,499}\}\s*(\$\w{1,40})[=\s]+['"]https?://[^'"]+\.txt['"]\s*;\s*\38[\s\(]+\40[\s\)]+;(?<X1283400>)|\s+(\w{1,40})[\s\(]+(\$\w{1,40})(?:[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"][chr\s\.'"]{4,9}['"]\s*;\s*return\s*\44[\(\s]+\43[\)\s]+;\s*\}(?:\s*(\$\w{1,40})[=\s]+\42[\s\(]+\d+[\s\)]+(?:\.\s*\42[\s\(]+\d+[\s\)]+)+;)+[^,\n]{1,99}\45[\s\(]+\$\w{1,40}\s*,\s*\$\w{1,40}\s*\([^;]+;(?<X1232000>)|[\s\)]+\{[^;\}]{1,99}\bfile_get_contents[\s(]+\43[\s\)]+;[^\?]{9,2499}(?:(\$\w+)[\s=]+\42[\s\(]+['"]https?://[^\}\{]{1,499}\b(echo\s*\47;)\s*(?:die|exit)\b[^;]*;(?:\s*\})+[^\+]{0,999})+\b\48\s*(?:die|exit)\b[^;]*;(?:[\s\}]*\$\w{1,40}\++;)+\s*\}(?<X1197373>))|\s+(\w{1,40})\(\)\s*\{\s*if\s*\(\s*stripos\s*\(\s*@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*(\w+)\s*\(\s*'[^']*'\s*,\s*\d+\s*\)\s*\]\s*,\s*\51\s*\(\s*['"][^'"]*['"]\s*,\s*\d+\s*\)\s*\)\s*===\s*false\s*\)\s*\{[^&]+add_action\s*\(\s*\51\s*\(\s*['"][^'"]*['"]\s*,\s*\w+\s*\)\s*,\s*["']\50["']\s*\)\s*;(?<X1037851>)|\s+(\w{1,40})\s*\((?:[\s\)]+\{\s*\$\w{1,40}[\s=]+['"]\w{1,3}['"]\s*\.[^;\(\)]{0,40}\.\s*chr[\s\(]+\d+[\s\)]+\.\s*chr[\s\(]+\d[^;]+;[^\n\*\?]{9,399}\$\w{1,40}[\s=]+\$\w{1,40}[\s\('"]+PHNjcmlw[^'"]{99,}['"][\s\);]+/\*\d+\*/\s*try\s*\{[^\n]{99,}\}\s*add_action[\(\s'"]+wp_head['"][,\s]+['"]\53['"][\)\s]+;(?<X1231800>)|\)\s*\{\s*(?:(\$\w{1,40})\s*=\s*\$_COOKIE\s*;[\s\(]*\55\s*&&\s*isset[\s\(]+\55\[[^&;]+(\$\w{1,40})\s*=\s*\55\[[^\?:\}]{0,199}(\$\w{1,40})\s*=[^;:]+\56[\s\(]+\55\[[^;]+\beval[\s\(]+\57[\s\)]*:\s*\55\s*;\s*return\s*\d+[\s;]+\}\s*\53\s*\(\)\s*;(?<X1222390>)|echo\s*["']\s*<(?:p|div)\s+style[\s=]+['"][^\}>]{0,999}(?:display[\s:]+none|(?:(?:height|width)[\s:]+0pt[\s;]*){2})['"][^\}>]{0,999}>(?:\s*<h\d+\b[^>\n]+>)?(?:\s*<a\s+[^:]{0,99}(?:href|rel)\s*=\s*['"]https?://\w[^>]+>[^<>]{3,99}</a>)+\s*(?:</div>\s*)?['"\s;]+\}\s*add_action[\s\('"]+wp_(?:head|footer)['"][\s,]+['"]\53['"][\s\)]+;(?<X1218570>)|register_shutdown_function\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\(\s*[^\}]{1,199}\s*\}\s*(\$\w{1,40})\s*=\s*function\s*\(\)\s*\{\s*\}\s*;\s*session_set_save_handler\s*\(\s*['"]\53['"]\s*,(?:\s*\60\s*,?)+\)\s*;\s*@?session_start\s*\(\s*\)\s*;(?<X2118230>))|\h*\)\s*\{\s*(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\s*;\s*if[\(\s@]+(?:(?:substr|md5)[\(\s@]+)+\62\s*\[[^\]]+\][^\{\};]+\{\s*(\$\w{1,40})[=\s]+!empty[\s\(]+\62\[[^\]]+\][\s\)]*\?\s*\62\[[^\]]+\]\s*:\s*['"][^\.'"\$]+\.php['"][^:\}]+file_put_contents[\s\(]+\63[^\}]+\}[\s\};]+\53[\s\(\)]+;(?<X1214650>))|\s+(\w{1,40}\()(\$\w{1,40})\)(?:\h*\{[^;=]{1,99}(\$\w{1,40})\h*=\h*scandir\(\66\);\s*foreach\(\67\s+as\b[^\}]{1,99}\b\65\66[^;]{1,49};\s*@?(rmdir\(\66)[^;]{1,49};\s*\}\s*else\s*\{[^\}]{1,99}[\}\s]+\65\66\);\s*do\h*\{\s*@?\68\);[^\}]{0,99}\}\s*while\(true\);(?<X1151940>)|\s*\{\s*if[\h\(]+(empty\()\h*\66[\)\s]+return\h+\S{2,5};\s*if[\h\(]+is(_uploaded_(file))\(\h*(\66\h*\[)[^;]+\{\s*if[\h\(]+!\70\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*if\s*\(\s*@?(?:move\71|copy)\(\h*\73[^\?]{9,499}\bif[\h\(]+!\70(\$_\72S\[[^\]]+\])[\)\s]+\{\s*\65\74\);\s*\}(?<X1133291>))|\s+(\w{1,9}_admin_acc\w{1,9})[\s\(\)]+\{\s*if\s*\([^;]{0,99}\$_[GPCSR]\w{2,6}\[[^\}]{1,299}(?:\bwp_(?:delete|create)_user\s*\([^\?]{1,299}\b){2,}->\s*set_role[\s\(]+['"]administrator['"][^\?]{1,999}\}\s*add_action[\s\(]+['"]\w+['"][,\s]+['"]\76['"][\s\)]+;(?<X1193130>)|\s+(\w{40,199})\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\79\h*=\h*(?:[gsb](?:z[di][en]flate|tr_rot13|ase64_decode)\h*\(\h*){3}\79(?:\h*\)){3};\s*for\h*\([^\{\}]{1,99}\{\s*\79\b[^;]{1,199};\s*\}\s*return\s+\79;\s*\}\s*(\$\w{1,40})\h*=\h*['"][^'"]{9,999}['"];\s*@?eval\h*\(\h*\78\h*\(\h*\80(?:\h*\)){2};(?<X1160210>)|\s+(\w{8,16})\(\w+\)\s+\{\s*(var)\s*\w+\s*=\s*['"][a-z0-9\+/=]{65}['"];\s*\83\s*\w+\s*[^,]+0x0,\s*(\w+)[^&]+&{2}\s*\(\84[^\?]{1,99}\?\s*\84\s*\*\s*0x\d+[^\[]+\[['"]fromCharCode['"]\]\(0xff\s*\&\s*\84[^\}]+\}\s*for\s*\(\83[^\}]{1,512}\}\s*[^\.]+\.indexOf\(\82\([^/]+/checkout/[^%]{1,9999}\w\h*\^\h*crypto\[\82[^;]{1,99}\82\([^;]+;\s*\};(?<X1268960>)|\s+(get_text_fr_serv)\h*\(\h*(\$\w{1,40})\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*curl_[^\$]{6,40}\89\h*,[^\)]+\87\h*\)\h*;[^\}]+\bfile_put_contents\h*\(\h*\88\h*,\h*\$\w{1,40}\h*\)\h*;\h*\}[^\}\?\{]{1,299}(?:\s*\86\([^\)]+\)\h*;){2,}(?<X1165460>)|\s+(globalclick)[\s\(]+\w+[\s\)]+\{\s*(?:(const|var)\s+\w+[\s=]+location\.host;?\s*\92\s+(\w+)[\s=]+\\?['"]https?://(?:[^\}]{1,999}\bwindow\.open[\s\(]+\93\b[^;]+;[\s\}]+\}\s*){2,}document\.addEventListener[\s\(]+\\?['"]click\\['"][,\s]+\91\s*\);?(?<X1214521>)|(var|const)\s+\w+\s*=[^='"/\(\)\{\}]{1,49}\95\s+(\w+)[\s=]+['"]https?://bit\.ly/[^\?<]{1,699}(?:\bwindow\.open[\s\(]+\96\b[^;]+;\s*(?:\}\s*){2}(?:else\s*\{[^\}]{1,499})?){2}document\.addEventListener[\s\(]+['"]click['"][\s,]+\91[\s\)]+;(?<X1225710>))|\s+(http_get)\s*\(\s*\$\w{1,40}\s*\)\s*\{[^\}]{1,499}\}\s*(?:echo\b[^;]{1,199};\s*)?(\$\w{1,40})\s*=[^;]{1,99}\.php['"]\s*;\s*(\$\w{1,40})\s*=\s*\98\s*\(\s*['"]https?://[^\?\}]{1,199}\bfwrite\s*\(\s*(\$\w+)\s*,\s*\100\s*\);\s*fclose\s*\(\s*\101\s*\);\s*if\s*\(\s*file_exists\s*\(\s*\99[\)\s\{]+\}(?<X1173671>)|\s+[ut][dc]p_flood\s*\([^/]{9,999}\bfsockopen\h*\((?<X2142481>)|\s+\w{1,20}\([^\)]+\)\s*\{\s*var\s+\w{1,9}\s*=\s*['"]\W{0,4}Minishell\b(?<X2135310>))
\bfunction(?:\h*\w{0,3}scan(?:dir|path|foler)\w{1,9}\([^\)]+\)[\s\{]+\$\w{1,20}=Array\(\);\s*foreach\([^@\?<]{9,120}\}\s*function\h*upload.?shell\([^\)]+\)[\{\s]+\$payload\w{0,20}=['"]<\?php\b(?<X2202610>)|\h*\w{1,20}\(\)\h*\{[^(]{50,200}(\$\w{1,14})\h*=\h*strrev\([^{]{50,200}strpos\(\$_SERVER\[\2[^{]{50,150}\{[^{]{50,400}require\([strevph\('"\.noiag\/dulc\-w\)]{20,100};[^}]{100,400}new\h*WP_User[^}]{10,150}set_role\(\2\(['"]YWRtaW5pc3RyYXRvcg={2}['"][\)\s]+;\s*echo\h+['"]license\s*set\b(?<X2266532>)|\h*\w{1,25}\(\)\s*\{\s*(\$\w{1,25})[\h=]+['"\.\hbase64_dco]+;\s*(\$\w{1,25})[\h=]+['"][^'"]+['"];\s*(\$\w{1,15})[\h=]+\$_SERVER\[[^\]]+\][\h\.]+['"]/wp\-includes/\w{1,25}\.php['"];[^\}]{0,250}wp_is_mobile\(\)['"],\s*\4\(\5\)[^;]+;\s*@?file_put_contents\(\6,[^\?]{0,150}\breturn\h*false;\s*\}(?<X1200970>)|\h*adduser[\s\(\)\{]+global\h*\$[^;]+;\s*\$\w{1,25}[\h=]+file_get_contents\(['"]wp\-config\.php['"]\);\s*preg_match\b(?<X2203351>)|\h*decipherLong\(\$\w[^\?]{9,599}(\$\w{1,15})\h*=\h*['"][^'"]{999,6000}['"];\s*\$\w{1,15}\h*=\h*base64_decode\(\9\);(?<X2160150>)|\h*file_get_contents_curl\h*\(\$\w{1,15},\h*\$\w{1,15}\h*=\h*\d\h*\)\s*\{\s*goto\h*\w{1,9};\s*\w{1,9}:(?<X2178002>)|\h*get(?:_http_response_code\(\$\w{1,15}\)\s*\{[^\}]{9,199}if\h*\(\$\w{1,15}\h*\D{2,3}\h*=\h*\d{3}\)\s*\{\s*\$\w{1,15}\h*=\h*\$_SERVER\[[^\]]+\];\s*\$\w{1,15}\h*=\h*['"](?:shell:|wso:|IndoXploit:|Priv8:|private:){1,3}[^'"]{0,199}['"];(?<X2141221>)|ip[\h\(\)]+\{\h*(goto)\h*\w+;\h*\w+:\h*\$\w+[\h=]+explode\b[^\n]{99,6000}\b\13\h*\w+;\h*\w+:\h*\$\w+[\h=]+getip\(\);\s*\13\h*\w+;\h*\w+:\h*\}\h*_action\(\);(?<X1213040>)|Links\(\)\s*\{[^;]{0,199}//seohack\.[^;]+;(?<X2192660>))|\h*r572exec\(\$[^\}]{9,350}\bpost\h*=\h*['"]php_eval\h*=['"]\h*\.[^;]{9,99}\burlencode\(base64_encode\(\$\w{1,15}\)\);(?<X2160180>)|\h*wp(?:_?v?cd\([^\)]+\)\s*\{[^\^]{9,999}\breturn\h*\$\w{1,40}\h*\^\h*\$\w{1,40}\h*;\s*\}[^\?]{99,9999}\bfwrite\h*\([^\[]{0,99}\$mtchs\[\d+\][^\)]+\)\s*;[^\?\*!]{9,999}\$npD\w+\s*=\s*['"][^'"]+['"][;\s]+\}(?<X1284120>)|_v?cd[\(\h]+\$\w{1,9}\h*,(?:[^\]]+(\$\w{1,40})[\h=]+\$_SERVER\[[^\]]+\];)?[^#!@/]{9,599}\bif[\h\(]+file_exists\(['"]\$\w{1,9}/\.bt['"][^;]{0,40};[^\?\\]{999,9999}<\?php\\+\w\W?\$\w{1,40}\[\d+\][^;]+;[^=\?]{0,99}\}(?:[^\?>]{0,999}(\$\w{1,9})\h*=[^;]+\18\b[^\}]{0,40}\}\s*echo[\h\('"]+\19[\h\)]*;)?(?<X1190915>))|\h*Write\w{0,40}BackD[o0]+r\s*\((?<X2195681>)|\h+(?:spawn)(?:mini|big)\h*\(\)\s*\{\s*\$\w{1,20}\h*=\h*['"]https?://(?:raw\.githubusercontent|github)\.com/[^'"]{5,99}\.php['"];[^\?\*#]{99,1500}\$\w{1,20}\h*=\h*ini_get\h*\(["']disable_functions['"]\);(?<X2187780>)|\h+(\w{1,20})\((?:(\$\w{1,20})\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:\24\h*\^?\h*|\([^\)]+\)\h*\^?\h*){2};\s*\$\w{1,20}\h*=\h*\25\h*\((?:\24\h*\^?\h*|\([^\)]+\)\h*\^?\h*){2},\h*['"]\w\+?['"]\);[^\}]{99,999}\$\w{1,20}\h*\(\h*\25\h*\([^\)]+\)\h*,\h*\$\w{1,20}\);\s*\}\s*\23\([^\)]+\);(?<X1146711>)|\)[\{\s]+(\$\w{1,20})=file_get_contents\(str_rot13\(['"]uggcf://[^\)]{9,99}\)\);\s*echo\h*\27;[\}\s]+\23\(\);(?<X1197750>))|\h+(\w{1,20}\(\))\s*\{\s*(\$\w{1,20})\h*=\h*file_get_contents\(['"]wp-(?:includes|admin|content)/\w{1,20}\.json['"]\);\s*(\$\w{1,20})\h*=\h*json_decode\(hex2bin\(\30[^/]{99,300}\{\s*if\((\31->\w{1,20})\)[^\?]{99,400}header\h*\(\h*['"]Location:\h*\{\32\}[^\)]+\);\s*(?:exit|die)[^;]{0,9};[\s\}]+\29;(?<X1146590>)|\h+(\w{1,33}_init)\((\$\w{1,40})[\s\)]+\{(?:\s*(\$\w{1,40})\h*=\h*['"](?:['"\h\.gzinflate]{12,40}|['"\h\.base64_dco]{15,40})['"];){2}\s*\35\h*=[^;]{0,40}\36\b[^\}]+\}\s*(\$\w{1,40})\h*=[^\$\v]{99,}(\$\w{1,40})\h*=\h*['"]\34['"];[^\v]{2,99}(\$\w{1,40})=\h*\$\w{1,40}\(['"]{2},\38\(\37\)+;\h*@?\39\(\);(?<X1158960>)|\h+(\w{1,40})[\s\(\)]+\{\s*if[\s\(]+isset[\s\(]\$_[GPRSC]\w{2,6}\[[^\]]+\][^\};]{0,99}(\$\w{1,40})[\s=]+wp_create_user[\s\('"]+[^\$'"]+['"][\s,]+['"][^\$'"]+['"]\s*(?:,\s*['"][^\$'"]*['"]\s*)?\)\s*;\s*(\$\w{1,40})[\s=]+new\s*WP_User[\s\(]+\42[\)\s;]+\43\->set_role[\s\('"]+administrator['"\s\)]+;[^;]+add_action\h*\([^;]+\41['"\)\s]+;(?<X1193620>)|\h+(\w{1,40})[\s\(]+\$\w+[\s,]+(\$\w+)\b[^\)]+\)\s*\{[^\}]{0,199}(\$\w{1,40})[\s=]+decrypt[\s(]+['"][^\?]{1,999}(\$\w{1,40})[\s\.=]+['"][^;]{1,999}\46\b[^\}]{1,999}\bwp_mail[\s\(]+\47\s*,[^,\);]+,\s*\48\b[^\?]{1,199}\}\s*add_filter[\s\(]+['"]check_password['"][,\s]+['"]\45['"][^;]{1,99};(?<X1191950>)|\h+(\w{1,40})\(\)\s*\{\s*(?:\$\w{1,40}\h*=\h*(get_)option\(['"]active_plugins['"]\);\s*\$\w{1,40}\h*=\h*(array)\s*\(\s*['"](\w{1,40}\.php)['"]\s*\);[^\+\?]{99,499}\bif\h*\(in_\52\(['"]\53['"][^\-]{99,600}\bfile_\51contents\([^\}]+['"]['"]\);(?:\s*\}){2}\s*add_action\(['"]init['"]\h*,\h*['"]\50['"]\);(?<X1156201>)|global\h+(\$wp_list_table);\s*\$\w{1,20}\h*=\h*array\([^\)]+\.php['"]\);\s*\$\w{1,20}\h*=\h*\55->(items);[^\}]{9,99}\bunset\(\55->\56\[\$\w{1,20}\]\);(?:\s*\}\s*){3}add_action\(['"]pre_current_active_plugins['"]\h*,\h*['"]\50['"]\);(?<X1148102>))|\h+(\w{1,40})\h*\((?:(?:\h*\$\w{1,40}\h*,){3}\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?create_function\h*\(\h*['"]+\h*,\h*\$\w{1,40}\h*\)\h*;\s*array_(?:map|walk)\h*\(\h*\$\w{1,40}\h*,\h*array\(['"]+\)\);\s*\}\s*set_error_handler\h*\(['"]\58['"]\);(?<X1140340>)|\)\s*\{(?:[^\(\)]{0,40}\$\w{1,40}\h*=\h*base64_decode[\h\(]+['"]aHR0[^'"]{9,99}['"][\)\h]+;[^:]{0,499}(\$\w{1,40})\h*=\h*['"]<div\h+style[\h=]+['"]display\h*:\h*none['"]>[^;]{9,19999}</div>['"];[^\?,]{9,999}echo\h*\60;[\s\}]+add_action[\h\(]+['"]wp\w{1,40}['"][\h,]+['"]\58['"][\h\)]+;(?<X1190670>)|\s*(\$\w{1,40})[\h=]+['"][^'"]{1,40}['"\s;]+(\$\w{1,40})[\h=]+['"][^'"]{1,40}['"\s;]+(?:(\$\w{1,40})[\h=]+['"][^'"]{0,40}['"\s;]+)?if[^;]+(\$\w{1,40})[\h=]+wp_create_user(?:[\h,\(]+(?:\62|\63|\64)){2,}(?:[\s,]+\$\w{1,40})?[\s\);]+(\$\w{1,40})[\h=]+new\h*WP_User[\s\(]+\65[\s\);]+\66\->set_role[\s\('"]+administ[^\}]+\}[\s\}]*add_action[\(\s]+['"][^'"]+['"][\s,]+['"]\58['"\)\s]+;(?<X1193993>)|\s*\$_+\h*=\h*['"]{2};\h*if\h*\(\h*!\h*isset\h*\([^\;]{1,199}(?:[ms](?:d|ha)[1256]{1,3}\h*\(){2}[^@]{999,9999}\58\h*\(\)\h*;\s*@eval\h*\([^;]{9999,};\s*(?:die|exit)[^;]{0,19};(?<X1172411>))|\h*\)\s*\{\s*(?:\$\w{1,40}\h*=\h*\d{10};\s*\$\w{1,40}\h*=\h*['"][^'"]{1,99}\.php['"];\s*@?preg_[^\}]+\}\s*\$\w{1,40}\h*=\h*explode\h*\([^\}]{1,999}@include(?:_once)?\h*\(\h*['"][^'"]{1,99}\.php['"]\h*\)\h*;\s*\}\s*add_action\h*\(\h*['"]template_redirect['"]\h*,\h*['"]\58['"]\h*\)\h*;(?<X1171400>)|echo\h+['"]<\h*(script)\b[^>]{0,99}\bsrc=['"]\h*(?:['"]\h*\.)?(?:\h*chr\h*\(\h*\d+\h*\)\h*\.){5}[^\v'"></]{1,499}['"]\h*['"]\h*>\s*<\h*/\70\h*>\s*['"];\s*\}(?:\s*add_action\h*\(\h*['"]\w{1,40}_head['"]\h*,\h*['"]\58['"]\h*\);){2}(?<X1178810>)))|\h+(\w{1,40}\h*\(\))\s*\{\s*(\$\w{1,40})\h*=[^;]{0,49}\$_[GPCSR]\w{2,6}\[[^;]{1,99};[^\}]{1,99}\$(\w{1,40})\h*=[^;]{0,49}\73\b[^;]{1,99};\s*return\h*\(\h*\$\74\h*\);[^\?]{1,199}\$(\w{1,40})\h*=[^;]{0,49}\72[^;]{1,99};\s*include\h*(?:\(\h*)?\$\75\b[^;]{1,99};\s*@?eval\h*\([^\)]{0,19}\72[^;]{1,99};(?<X1177200>)|\h+(\w{1,40}\s*\(\s*\))\s*\{\s*var\h+(\w{1,40})\s*=\s*(document\.)referrer;\s*if\s*\(\s*(?:\78\.indexOf\s*\([^;\}\{\v]{1,29}\b){5}[^\{\v;/:]{1,599}\s*\{\s*\79write\s*\(\s*['"]<script\b[^;]{19,299};\s*\}\s*(?:else\s*\{[^\}]{1,199}\}\s*)?\}\s*\77;(?<X1190923>)|\h+(\w{1,6}backdoor)\(\)[\s\{]+if\h*\([^#%\*//]{99,400}\bwp_create_user\h*\([^\-//]{2,250}\->set_role\(['"]administrator['"]\);[^\\\?><]{99,400}[\}\s]+add_action\h*\(['"]wp_(?:head|foot)e?r?['"][\h,]+['"]\81['"][^\)]{0,4}\);(?<X1196780>)|\h+(\w{1,9})\h*\(\h*\)\h*\{\w{1,40}\h*=\h*false;\h*var\h*(\w{3,9})\h*=\h*new\h+\w{1,40}\(\);\h*Object\.defineProperty\h*\(\h*\84\h*,[^\\&\v]{1,199}\{\h*\w{1,40}\h*=\h*\[[\d,]{40,99}\];[^!\v>]{99,999}decodeURIComponent\(escape\(\w{1,40}\)[^;]+;[^<\v\{]{9,199}\bsetTimeout\(\83\(\),\d+\);(?<X1172321>)|\h+(\w{1,9}\(\))\h*\{\h*var\h+(\w{1,9})=((document)\.referrer);\h*if\(\87\.indexOf\([^;\{\}]{99,199}\)\h*\{\h*\89\.write\(['"]<[script\+'"\h]{6,16}\b[^>]{0,40}>[docu'\+"ment]{8,18}\.location=['"]https?://[^\.]{2,9}\.pw/[^/;\}><]+\88[^/;\}]+["'][script\+'"\h/<>]{9,36}\)\}[^;\v]{0,40}\86;(?<X1149691>))
\bfunction(?:\h+(\w{2,24})\h*\(\h*\$url\d*\b[^;]{1,24}\{\s*\$\w{1,40}\h*=\h*curl_init\h*\([^<@\?]{199,999}(\$\w{1,40})\h*=\h*\1\h*\(\h*['"]?(?:https?|\$_[GPRSC]\w{2,6})\b[^;]+;\s*@?(?:eval|assert)\s*\(\s*['"]\?>['"]\h*\.\h*\2\h*\)\h*;(?:(?:exit|die)[^;]{0,9};)?(?<X1172023>)|\h+(adminer)\(\$\w{1,20},+(\$\w{1,20})\)\s*\{\s*\$\w{1,20}=fopen\(\5,[^\)]+\);\s*(\$\w{1,20})=(curl_)init\(\);[^\}\{]{99,250}\b\7exec\(\6\);[^\}\{]{2,50}\b(?:ob_)?flush\(\);\s*\}\s*if\(\4\(['"]https?://[^'"]{1,20}/\w{1,20}["'],basename\(__FILE__[\)\h]+\{\s*header\([^\?\*@&#]{9,99};\s*\}(?<X1191210>)|\h+(adminer)\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\h*\([^\)]+\);\s*(\$\w{1,20})\h*=\h*(curl_)init\(\);\s*\11setopt\h*\(\10\h*,[^\?#@]{9,250}\11exec\h*\(\10\);[^\{]{9,150}\b\9\(['"]https?://[^\)]+\)[^\?@#%&]{9,45}\becho\h+['"][^'"]+['"];\s*\}(?<X1191713>)|\h+(dalilaescort_system_update)\h*\(\)\s*\{\s*\$\w{1,20}\h*=\h*\d+;[^\?@#]{200,4500}\becho\h+\$\w{1,20};\s*[\s\}]+add_action[\h\(]+['"]wp_(?:footer|header)['"][\h,]+['"]\13['"]\h*\);(?<X1189770>)|\h+(decrypt_SO)\h*\([^\)]+\)\s*\{\s*\$\w{1,40}\h*=\h*mcrypt_[^\}]{9,999}\ssubstr\h*\([^;]+;\s*\}\s*foreach\h*\(\h*\$_[GPRSC]\w{2,6}\h+as\h+\$\w{1,40}\h*=>\s*(\$\w{1,40})[\s\)\{]+(\$\w{1,40})\h*=\h*\16\h*;\s*\}\s*(\$\w{1,40})\h*=\h*\15\h*\(\h*\17\h*,[^\?]{1,99}\b(?:echo|\w?print\w?)\h*\(\h*\18\h*\)\h*;(?<X1168751>)|\h+(file_put_contentz)\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{[^\-\?@]+\20\h*\(\h*BASE_FOLDER\h*\.\h*['"]/\{\$\w{1,40}\}\.txt['"]\h*,\h*\$linkdata\h*\)\h*;(?<X2162680>)|\h+(get)\h*\(\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\(\);[^:]{99,999}\22\h*\(['"]https?://(?:\d{1,3}\.?){4}/\w{1,40}['"]\h*,\h*["']([^;]{1,40})['"]\);\s*\$\w{1,40}\h*=\h*exec\(['"]chmod\h+\+x\h*\23(?:[^\+]{99,999}\+x\h+\w{1,40}){2}[^\}]{1,49}\}(?<X1144721>)|\h+(get\w{0,12})\b\h*\(\h*\$url[\)\s]+\{[^@\^]{999,9999}(\$con\d*)\h*=\h*\25\(['"]http://(?:\w{1,9}\.)?\w{3,24}\.\w{2,9}/[^\}]{9,499}\becho\h*\26;\s*(?:exit|die)\b[^;]{0,19};\s*\}\s*(define\(['"]DISALLOW_FILE_)EDIT(['"][\h,]+true\);)\s*\27MODS\28(?<X1176530>)|\h+(get\w{0,20})\((\$\w{1,9}),(\$\w{1,9})\)[^\}]{0,99}\}\s*(\$\w{1,9})\h*=\h*(curl)_init\(\);\s*\34_setopt\(\33,\34opt_url,\31\);[^#]{99,999}\32\h*=\h*\30\(\31,[^\}]{0,99}\}\s*\32\h*=\h*explode\(['"]\W+['"],\32\);[^\}]{0,99}\}(?<X2186081>)|\h+(get_?http\w{0,9})\h*\(\h*\$\w{1,40}[^\)]{0,40}\)\s*\{\s*\$\w{1,40}\h*=\h*curl_init\h*\((?:[^:\?<]{99,999}(\$\w{1,40})\h*=\h*\36\h*\(\h*['"]https?:[^'"]{1,99}(?:viagra|cialis|online|casino|game|sale|pharm|herb|jersey|jordan|yeezy)[^;]+;)+\s*echo\h+\37\h*;\s*\}(?<X1168601>)|\h+(R\(\))\h*\{\h*var\h+(\w{1,9})\h*=\h*((document\.)(referrer));\h*if\(\40\.indexOf\(['"]\.(?:google|bing|yahoo|rambler|yandex)\.['"]\)!=[^;\}\v/:\?<>\{]+\{\h*(\42write)\h*\(\h*['"]<script\b[^:]{1,99}\bsrc=['"]http://[^\v\?'"]+\?se_\43=[^\.>\}]+\41[^\.>\}]+\.title\)[^\.]{1,99}\44[^;]{1,9}\39;(?<X1164491>)|\h+(R\(\))\s*\{\s*var\h+(\w{1,12})\h*=\h*(document\.)referrer;\s*if\h*\(\h*\47\.indexOf\(['"]\.google\.[^;\{\}]+\{\h*\48write\(['"]<(script)\b[^;:]+\bsrc\h*=\h*['"]https?://[^/'"]+/\w{1,40}/?['"]>\s*</\49>['"]\h*\)\s*\};\s*\}\s*\46;(?<X1183400>)|\h+(random\w{1,40}\h*\(\))\s*\{\s*\$\w{1,40}\h*=\h*array\h*\(\h*\d+\h*,[^\}]{1,999}\}\s*\$\w{1,40}\h*=(?:\h*\51\h*\.){3}[^/]{1,9999}<title>\h*Sign\h*in[^/]{0,99}</(?<X2140621>)|\h+(Search\()(\w)\)\{\s*js\h*=\h*['"](https?://)[^/]{4,40}/\w{1,9}\.js['"]\h*;\s*if\(\54==['"]['"]\)\{\s*var\h+\w{1,9}\h*=\h*document\.referrer;[^/\v]{99,499}\)\):['"]\55(search_on_form/\?)[^:\v]{99,499}\55\56[^\}]{40,99}\}\}\h*\53['"]?['"]?\);(?<X1151500>)|\h+(wampserver)\(([^\)]+)\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:chr\([^\)]+\)\.?){5,20};(\$\w{1,20})\h*=\h*(?:chr\([^\)]+\)\.?){5,20};\s*\59=\60\(\61\(\59\)[^\(]{999,3000}\60=['"]\58['"];\s*\61=\60\((?:chr\([^\)]+\)\.?){5,25}\);\s*(\$_\58)\h*=\h*@?\61\(["']{2},\60\(\59\)\);\s*\62\(\);(?<X1142710>)|\h+(wordpre\w{0,33})[\s\(\)]+\{[^\(\)]{0,40}(\$\w{1,40})\h*=\h*base64_decode\h*\(['"]aHR[^'"]{9,99}['"][\h\)]+;[^\},]{1,99}(\$\w{1,40})[\h,]+CURLO[^;]+\65[\h\)]+;[^\}]+(\$\w{1,40})\h*=\h*curl_exec\h*\(\h*\66[^\}]+echo\h+\67;[^=\(\)]{1,99}add_action\(["']wp_(?:footer|header)['"][\h,]+['"]\64['"][\h\)]+;(?<X1174220>)|\h+(WP_URL_CD)\h*\(\h*(\$\w{1,40})[\)\s]+\{\s*if\h*\(\h*\(\h*(\$\w{1,40})\h*=\h*@?(file_get_contents)\h*\(\h*\70\h*\.[^#:\*]{999,9999}if\h*\(preg_match\(['"][^\$]{9,99}\71\h*,[^\}]+\69\h*\([^\;]{9,99};(?:\s*\})+\s*if\h*\(\h*\71\h*=\h*@?\72\h*\(__FILE__\)+\s*\{[^\}]+\}\s*\}(?<X1162451>)|\h+\w{0,9}plugin_install\(\)[\s\{]+\$\w{1,20}=str_replace\(['"]/wp\-content/themes[',"]+\bget_theme_root\(\)\);[^\?%&\*]{99,500}\bwp_remote_get\(hex2bin\([^\}#%]{99,200}\b(?:exit|die)[^;]{0,9};[\}\s]+\$\w{1,20}=['"][a-z0-9]{99}(?<X2192330>)|\h+\w{1,16}\(\w{1,40}\)\s*\{\s*var\h+\w{1,40}=\d\h*,\h*\w{1,40}\h*=\h*\d;\s*var\h+\w{1,40}\h*=\h*['"]\d+\-\d+,(?:[^/]{99,1999}=\h*parseInt\([^\)]+\)/\w{1,40};[^/]{99,999}(\.replace\(/)[^;]+;){4}\s*\}[^/]{99,999}\75[^\.]{9,499}(\.getElementById\()['"][^\.]{9,499}document\76[^\)]{1,40}\);\s*\}(?<X1141441>)|\h+\w{1,20}[\h\(]+(\$\w{1,9})[\h,]+\$\w{1,50}[\s\)]+\{[^\(\{\}]{9,99}(\$\w{1,50})[\s=]+['"]urldecode['"][\s;]+(\$\w{1,50})[\s=]+\79[\h\(]+\78[^\(\{\}]{1,99}(\$\w{1,50})[\s=]+substr\s*\([^\)\(\n]+strlen[\h\(]+\80[^\(\{]{9,99}\80\^\81\h*;(?<X2254831>)|\h+\w{1,20}\((?:([^\)]+)\)\{if\(strpos\(\83,['"]\.xploiter\b(?<X2179160>)|[^\)]+\)\s*\{\s*\$\w{1,20}=base64_decode\([^\)]+\);\s*if\(!(file_)exists\([^\)]+/(wp\-[^\.]{2,20}\.php)['"]\)\)\{\s*(\85)pu(t_contents\()[^\)]+/\86['"],[^@#]{999,6000}\{\s*\$\w{1,20}=['"]<script\h+type=['"]text/javascript['"]\h*src=['"][^\?]{2,15}\?n=nb5['"][^;]+;\s*\$\w{1,20}=\87ge\88(?<X2187160>)|\)[\s\{]+(\$\w{1,20})=(array)\((?:['"]https?://bit\.ly/[^,]+,?){2,4}\);\s*shuffle\(\90\);\s*(\$\w{1,20})=\91_pop\(\90\);[^@%\*]{200,1500}\92=get_url\(\);[\s\}]+if\([^\{]{2,40},\92\)\)[\s\{]+\90=\91\((?:['"]https?://[^'"]{1,15}(?:herbal|rx|pill|drug)(?:caring|store|shop)\.\w{2,4}['"],){2,6}(?<X2193082>)|\)\s*\{\s*if\([^\{]+\)[\s\{]+(?:\$\w{1,20}=[^;]{1,60};\s*){5,20}[^:#&%]{99,400}(\$\w{1,20})=(?:\$\w{1,20}\.)+\$\w{1,20};\s*(\$\w{1,20})=[^;]{1,30};\s*(\$\w{1,20})=[^;]{1,30};\s*if\b[^\}]{9,99}\bwp_create_user\(\95,\96,\94\);[^\}]{1,40}\95\->set_role\(['"]administrator['"]\);[\}\s]{3}(?<X1192991>))|\h+\w{1,40}\((\$\w{1,40})\)\{(\$\w{1,40})=(file_)ge(t_contents\()\98\);[^\?@#%:/&\*]{1,199}(\$\w{1,40})=base64_decode\(['"]dmFyIF8weD[^'"]{999,}['"]\);\100pu\101\98,\102\.\99\);(?<X2184190>)|\h+\w{1,40}\h*\(\h*\$\w{1,40}\h*\)\h*\{\h*\$\w{1,40}\h*=\h*['"][^'"]{36,99}['"];\h*(?:\$\w{1,40}\h*=\h*){2,}['"]{2};[^\v@#%]{99,999}\beval\h*\(\h*\$\w{1,40}[^\s\w]{1,9}\s*\$\w{1,40}\h*=[^;]{99,999};@?preg_replace\h*\(\h*['"](\W)[^,;\)]+\104e['"]\h*,\h*['"]\\x\w{2}[^;]{1,299};\h*$(?<X1188270>)|\h+_sm_shutdown_function\(\$html_content\)\s*\{(?<X2165001>)|\h+alfaMassDefacer\h*\(\h*\)\s*\{\s*alfahead\h*\(\h*\);(?<X2192110>)|\h+AnonymousFox\h*\((?<X2182142>)|\h+curPageURL\(\)\s*\{\s*(\$\w{1,40})\h*=\h*['"](http)['"];\s*if\h*\(\s*\$_SERVER\[['"]\110S['"]\][^'"]{2,9}['"]on['"]\)\s*\{\s*\109\h*\.=\h*['"]s['"][^\$]+\109\h*\.=\h*['"]://['"];[^@]{9,499}@getenv\(['"]REMOTE_ADDR['"]\)[^/\|]{1,999}(\$\w{1,40})\h*\.=\h*['"]Victim[^\?]{9,499}mail\([^\)]+\111[^\)]+\);(?<X1150870>)|\h+detectBot\h*\([^\)]+\)\s*\{\s*\$stop_ips_masks\h*=\h*array\s*\([^\}]{99,9999}\$is_human\h*=\h*(?:false|true);(?<X2162622>)|\h+enc(?:File\(([^\)]+)\)\s*\{\s*if\h*\(strpos\h*\(\114\h*,\h*['"]\.(\w{0,9}crypt\w{0,20})['"]\)[^\}\.]{9,99}\}\s*file_put_contents\h*\(\114\h*\.\W{0,9}\115['"](?<X2166661>)|odeSource\([^@#%]{999,9999}\$urlToRedirect==["']shell["'](?<X2178921>)))
\bfunction(?:\h+ge(?:nerate.doorway\((?<X2183260>)|t(Cookie)\((\w{1,40})\)\s*\{\s*var\h+\w{1,40}\h*=\h*(document\.)\2\.match\(new\h+RegExp\([^\)]+\)['"\s\+]+\3\.replace\(\W{9,}g[^;]+;[^\+]{9,499}\4write\(['"][<iframe'\+"]{9,}\h[^:]{1,40}['"]https?://[^/]{4,60}/[^'"]+\.html?\b[^\)]+[/><iframe'\+"]{9,}\);(?:\s*\}){2}(?<X1162392>)|t_text_fr_serv_wrm\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*curl_init\(\);[^\}\{]{99,300}\bfile_put_contents\h*\([^\)]+\);\s*\}\s*if\h*\(\$_[GPRSC]\w{2,6}\[['"]activatewrm['"]\][^\)]+\)\s*\{[^\}\{\?>]{99,200};\s*\}(?<X1157000>)|tHtml\d*\(\$\w{1,40}\)\s*\{[^@%]{999,9999}\bsetcookie\h*\(['"]haircki['"],[^;]+\);(?<X1154376>)|thttpcnt\(\$url\s*,\s*\$timeout[^\)]+\)\s*\{[^\\\*@]{999,9999}(echo\h+['"])<(script)\b[^>]{0,40}>[^;]{0,9}['"]\h*;\s*\8location\.href\h*=\h*['"]https?://[^;]{1,99}['"];\s*\8</\9>['"]\h*;(?:\s*\}){2}(?<X1161281>)|tMagentoByConfig\h*\(\h*\$\w{1,40}\h*,\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*\11\h*==\h*\d+\h*\?\h*URL_BACK_HOST(?<X2176330>))|\h+gorila\h*\([^\)]+\)\s*\{[^\}]{99,400}\}\s*if\h*\(!?isset\h*\([^\}\?\*]{20,200}\bif\h*\(preg_match\h*\(['"]/(?:Wordpress|Joomla|Magento)/i['"]\h*,\h*\$(?<X2159220>)|\h+HTTP_404_Not_Found\((\$\w{1,20})\)\s*\{\s*(\$\w{1,20})=['"][gzinflate\.'"]{10,25}['"];\s*(\$\w{1,20})=['"][base64_dco\.'"]{13,30}['"];\s*\14=\15\(\16\(\14\)\);[^=]{1,20}(\$\w{1,20})\h*=\h*['"][^'"]{999,4000}['"];[^\?]{9,99}(\$\w{1,20})\h*=\h*@?\$\w{1,20}\(['"]{2},\$\w{1,20}\(\17\)\);\s*\18\(\);(?<X1142670>)|\h+j4nc0x\((\$\w{1,20})\)\s*\{\s*\$\w{1,20}\h*=\h*file_get_contents\h*\(\20\);[^\}]{9,200}\bbackscan\h*\(\20\)(?<X2166561>)|\h+login_(shell)\(\)\s*\{\s*if\h*\(\$_[GPRSC]\w{1,20}\[[^\]]+\]\W{1,3}['"]\22['"]\)\s*\{(?<X2154570>)|\h+mainbottom\h*\(\h*\)\s*\{\s*echo\h*['"]<[^\}\(\$@]{1,499}\bFileBox\h+Version\b[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X2184110>)|\h+pwn\((\$cmd)\)\s*\{[^#@^]{999,4000}\(\$\w{1,20}\->\w{1,20}\)\(\25\);\s*(?:exit|die)[^;]{0,9};\s*\}[^:\\]{9,99}(\$\w{1,20})=\(['"]https://github\.com/[^\)]+\);\s*(\$\w{1,20})=file_get_contents\(\26\);\s*eval\([^\(]{0,5}\(?\$\w{1,20}\(\27\)(?<X2187380>)|\h+rdFile\([^\?]{99,2000}\breturn\h+\$[^;]{2,20};(?:\s*\}\s*){1,2}function\h+tcget\h*\(\$[^\$,]{2,20},\$[^\$,]{2,20}=['"]{2}\)\s*\{(?<X2162830>)|\h+re(?:adZips\(\)\s*\{[^\}]{99,300}\barray_push\h*\([^:\\]{99,500}<title>\h*unz[i!]p[3e]r\h*by\b(?<X2183190>)|thta\h*\(\)\s*\{(?<X2153711>))|\h+themefunc\(\)\s*\{[^\!&\*]{9,99}\bif\(!class_exists\(['"](WP_GHOST)['"]\)\)[\s\{]+class\h+\32\s*\{[^\}%\*]{99,400}\badd_action\(["']plugins_loaded['"],array\(&\$this,['"]shellaccess['"]\)\);(?<X2195961>)|\h+tulis_file\((\$(?:nam[ea]|file)),[^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*fopen\(['"]\34(?<X2151980>)|\h+wp(?:(_set_charset_)vars\h*\((\$\w{1,20})\)\s*\{[^\}]{99,250}\breturn\h+\37;\s*\}\s*(\$mysql\36prefix)\h*=[^\?]{999,15000}(\$\w{1,20})\h*=\h*\37\h*\(['"]{2}\h*,\h*\$\w{1,20}\(\38\)\);\s*\39\(\);(?<X2170101>)|\w{1,16}\((\$\w{1,16})\)\s*\{\s*(\$\w{1,40})[\h=]+['"]['"\h\.gzinflate]{9,40}['"]\;\s*(\$\w{1,40})[\h=]+['"]['"\h\.base64_dco]{13,60};\s*(\$\w+)[\h=]+(?:(?:\43|\42)[\h\(]+)+\41[\)\h]+;[^=]{0,40}\44[^\$]{999,}(\$\w+)[^\(]{0,99}(\$\w+)[^,]{9,999}(\$\w+)[\h=]+\46\(['"]{2}[\h,]+\45[^;]+;\s*@?\47\(\);(?<X1177970>)|_scan_dir\h*\([^\)]+\)\s*\{[^\?>\\]{99,900}\$fake_dirs\h*=\h*array\h*\((?<X2179440>))|\h+xu\(\)\s*\{\s*\$api_url\h*=\h*['"]https?://[^'"]{1,99}/api\.php['"];\s*\$api_key\h*=\h*['"][a-f0-9]{32}['"];(?<X2150991>)|\s*(\w)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s]+['"]base64_decode['"]\s*;\s*\52[=\s]+\53[\(\s]+\52[\)\s]+;\s*\53[=\s]+['"]gzinflate['"]\s*;\s*return\s*\53[\(\s]+\52[\)\s;]+\}\s*@?session_start\s*\(\)[;\s]+header[\s\(]+\51[\s\(]+['"][^'"\$]{9,199}['"][\s\)]+;[^\}]{99,499}\b(?:exit|die)\b[^;]*;\s*\}(?<X2223500>)|\s*(\w+)[\(\)\s]+\{\h*return\s*['"]https?://(?:[fz]\w+\.[^'"]+['"][;\s]+\}\s*\$\w{1,40}[=\s]+\55[\(\)\s]+;[^\n\*#]{99,}(\$\w+)\[['"]http_user_agent['"]\]\s*=[^;]*;\s*echo\s*\w+\s*\([^;]+\56[\s\)]*;[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1254770>)|\d+(?:\.\d+){3}/[fz]\w[^'"]+['"][;\s]+\}\s*\$\w{1,40}[=\s]+\55[\(\)\s]+;[^\n\*#]{99,}(\$\w+)\[['"]http_user_agent['"]\]\s*=[^;]*;\s*echo\s*\w+\s*\([^;]+\58[\s\)]*;[^\}]*\}\s*(?:exit|die)\b[^;]*;(?<X1254940>))|\s*(\w+)[\(\s]+(?:(\$\w{1,40})[\)\s]+\{\s*(\$\w{1,40})[=\s'"]+base64_decode[^\}]{9,99}\breturn\s*\62[\s\(]+\61[^!]{0,999}if[\(\s]+!defined[\(\s]+\60[\(\s]+['"][^'"]{1,40}['"][\s\)]+\{[^\.]+\$\w{1,40}[=\s]+\$\w{1,40}[\.\s]+md5[\(\s]+str_ireplace[\(\s]+\60[^\}]+\}(?:[^\}]+\}){2}\s*@?eval[\s\(]+\60[^;]+;\s*\Z(?<X2221031>)|\$\w{1,40}[,\s]+\$\w{1,40}[\)\s]+\{[^\^\}]{0,99}(\$\w{1,40})[=\s]+urldecode[\(\s]+\$\w{1,40}[^\^\}]{0,99}(\$\w{1,40})[=\s]+substr[\(\s]+\$\w{1,40}[,\s]+0[,\s]+strlen[\(\s]+\64[^\^\}\^]{0,99}return\s*\64\s*\^\s*\65;(?:[^\%\^]{0,499}(\$\w+)\s*=\s*\$\w*[\{\[]\60[\(\s]+['"][^:;]+;){1,2}[^\%\^]{0,499}include(?:_once)?[^;]+\66(?<X2232434>))|\s*(\w+)[\s\(\)]+[\{\s]+echo\s*['"]<div\s*style[=\s]+['"]display:none['"]>\s*<h2[^>]+display:none['"]>\s*<a[^:]+href[=\s]+['"]https?://[^'"]+['"][^<]+</a>\s*</div>['"];[\s\}]+add_action[\(\s]+['"][^'"]*['"],['"]\68['"][\)\s]+;(?<X1217642>)|\s*(\w+)\(\)\{(?:(\$\w+)=['"][^'"]{32,64}['"];(?:\$\w+=['"]base64_[den]{2}code['"];){2,}[^\?]{1,499},(\$\w+\(\71,)\d+,\d+\)=>['"][^'"]{64,}['"],\72\d+,\d+\)=>[^;]+;(\$\w+)=['"]{2};foreach\([^\{;]+\{(\$\w+)=\$\w+\(\$\w+\)\^\$\w+\([^;]+;\73=\73\.\74;\}\$\w+\(\73\);\}*add_action\(['"]\w+['"],['"]\70['"]\);(?<X1229601>)|\s*echo\s*[pes](?:assthru|ystem|xec|hell_exec|val)\((?:\w+\(){0,4}\$_[GPCSR]\w{2,6}\[[^;]+;\}add_action\(['"]\w+['"],['"]\70['"]\);(?<X1229610>))|\s*(\w+)\(\){\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\){2}\{\s*if\(\78==['"](\w+)['"]\)\{\s*die\(md5\(['"]\79['"]\){2};[\s}]+add_action\(['"]init['"],\s*['"]\77['"]\);(?<X1257031>)|\s*(\w+)\s*\(\w+\)\s*{\s*(const)\s*\w+\s*=["'a-z0-9]{64};[^\}]{1,256}\}return\s*\w+\}\s*\82\s*\w+\s*=\81\(\d+\);\w+\s*(\w+)[^\}]+https?://hostpdf\.co/[^\}]+urlencoded[^<]+\83\([^\)]+\)\}{2}\){2};(?<X1264110>)|\s*(\w+\()\$\w+\)\{if\(!?is_user_logged_in\(\)[^\}]{0,199}\bwp_set_current_user\(\$\w+\->ID\)[^\?]{1,999}\bif\([^\{;]{0,199}\$_[GPCSR]\w{2,6}\[[^\]]+\]==+['"][^\{;]+\{(\$\w+)=[^;]+;(\$\w+)=get_users\(\86\);foreach\(\87\s*as\s*(\$\w+)\)\{(\$\w+)=\88\->caps;if\(\89\[['"]admin\w+["']\][^\{;]+\{(\$\w+)=\88\b[^\}]+\}\s*\}\s*\85\90\);\s*\}(?<X1229230>)|\s*(\w+\()\)\{file_pu(t_contents\()['"][^'"]+\.php['"],file_ge\93['"]https?://[^;]+;echo\b[^;]{0,199};\}if\(isset\(\$_[GPSRC]\w{2,6}\[[^\]]+\]\)+\{\92\);\}(?<X1229390>)|\s*(\w{1,15})\(\)\s*\{\s*if\s*\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\))\s*\{\s*@?eval\(base64_decode\(\96;\s*\}\s*return;\s*\}\s*add_action\(['"][^'"]{9,50}['"],\s*['"]\95['"]\);(?<X1135591>)|\s*(\w{1,20}\(\))\s*\{\s*(?:die|exit)\s*\(?['"][^\?]{99,400}\98;\s*\}[^%]+move_uploaded_file\s*\((\$_FILES\[[^\]]+\])\[tmp_?name\][^\[]{0,40}\99\[[^\]]+\]\);(?<X2134070>)|\s*(\w{1,40})(\(\$\w+\))\{(\$\w+)=(curl_)init\102[^\}]{99,299}return\s*\104exec\(\103\);[^\}]{9,99}\}(?:\$\w{1,40}=[^;]{9,99};\$\w{1,40}=\101\(['"]https?://[^\)]{9,99}\);\$\w{1,40}=fopen\(\$\w+,[^\)]+\);(?:(?:fwrite|fclose)\([^;]{4,29};){2}if\(file_exists\(\$\w{1,40}\)\)\{\}echo\s*['"][^;]+['"];){3}(?<X2130990>)|\s*(\w{1,40})[\(\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+\$_REQUEST\s*\[[^\]]+\]\s*;\s*\$\w+[=\s]+\[\s*['"](?:themes|admin|uploads|includes)['"]\s*=>[^\]]+\]\s*;\s*\$\w+[=\s]+\[\];\s*switch[\s\(]+\107[\)\s]*\{\s*case\s*['"]login[^;]+administrator['"]\]\)\[\d+\][^\+]+\$\w+[\+\s\)]+\{(?:[^\}]*\})*\s*\106[\(\)\s]+;(?<X1252830>)|\s*=\s*['"]https://[^'"]{1,40}\.txt['"][\s;]+\$\w{1,40}[=\s]+curl_init[\(\s]+\107[\)\s]+;[^<#\\%]{99,9999}\bif[\(\s!]+empty[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{[^\}]{0,9999}\{\s*\106\b[\s\(\);]+\}\s*\}(?<X1203200>)))
\bfunction(?:\s*[o0_]{1,40}[\s\(]+\$\w{1,40}(?:[,\s]+(\$\w{1,40}))+[\s\)]+\{\s*\$\w{1,40}[=\s]+['"]https?://%s/ping\?[^'"]+['"];[^\n]{99,}\1\[[^\]]+\][=\s]+isset[^;]+\[['"]HTTP_ACCEPT_LANGUAGE['"]\]:['"]{2};(?<X1249500>)|\s*\(\s*\)\s*\{\s*\$_GET\[(\$\w{1,40})[=\s]+implode[\(\s]+['"][^;]+;\s*(\$\w{1,40})[=\s]+\$_GET\[\3\][\s\(]+['"]L2hvbW[^'"]+['"][\s\)]+;\s*try\s*\{[^;]+@include(?:_once)?[\s\(]+\4[\s\)]+;[^\{]{0,199}\{[^\}]+FILE_APPEND[\)\s;]+\}\s*\}(?<X1231860>)|\s*\w*\((\$\w+)\)[^@]{1,400}(curl_setopt)\([^\)]+\6['"]\);(?:\7[^;]+;)+[^@]{1,100}curl_close[^;]+;if\([^\)]+\)\{(?:return\s*\$?\w+[;\}]+)+function\s*(\w+)\(\6[^@]{1,1130}\$\w+=\(+isset\(\$_[GPRSC]\w{2,6}[^;]+;(\$\w+)=[^;]+;[^@]+\9;(\$\w+)=\$\w+\.['"]/\w+\.php['"];[^@]{1,200}(\$\w+)\[\]=array\(\);[^@]+\8\(\10,\11\);echo[^>]+;(?<X1260761>)|\s*\w+[\s\(\)]+\{\s*;\s*if\s*\([^\?]{1,999}\bdo[\s\{]+if\s*\([^\)]*\b(wp\-)config\.php\b[^\?]{1,999}\bmysqli?_connect\s*\([^\?]+\bdefine[\s\(]+['"]\w+['"][\s,]+['"](?:\13(?:includes|admin)/[^'"]+;){2,}[^'"]+['"][\s\)]+;[^\?]+\bif[\s\(]+strlen[\s\(]+(\$\w+)\b[^;]+\beval[\s\(]+\14[\s\)];\s*\}(?<X1197480>)|\s*\w+\s*\(\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*gzuncompress\s*\(\s*base64_decode\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*for\s*\(.+?eval\(\w+\("[^)]+\)\);(?<X1038790>)|\s*\w{1,15}\((\w{1,15})\)\{var\s*(\w{1,15})=['"]["'];var\s*(\w{1,15})=0;var\s*(\w{1,15})=0;for\(\19=0;\19<\17\.length/\d{1,3};\19\+\+\)\{\18\+=String\.fromCharCode\(\17\.slice\(\20,\s*\20\+\d+\)\);\20=\20\+\d{1,3};\}return\s*\18;\}(?<X1127012>)|\s*\w{1,39}\s*\(\s*(\$\w{1,39})[\)\s]+\{\s*(\$\w+)\s*=\s*['"]{2};\s*if[\s\(]+function_exists[\s\('"]+(file_get_contents)['"\)\s]+\{\s*\23\s*=\s*\24[\s\(]+\22[\)\s;]+\}\s*if[\(\s]+empty[\(\s]+\23[^\?\n]{99,}return\s*\23[;\s]*\}\s*(\$\w+)\s*=[^'";]*\(\s*['"][^'"]*=['"][\s\);@]+eval\s*\([^;]+\25[\s\)]+;(?<X1257890>)|\s*\w{1,40}[\(\)\s]+\{\s*(?:(?:global\s*\$\w{1,40}\s*;\s*)+(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]PD9[^'"]{999,}['"][\s\);]+\$\w{1,40}[=\s]+substr[\(\s]+str_shuffle\b[^,;]{40,},\s*\dx\d{3,4}[\)\.\s'"]+\.php['"]\s*;\s*if\s*\([^\);]+['"]wp\-admin[^;]+\27[\)\s]+;[^<]{0,199}\becho\b[^;]{1,19}[""];\s*\}(?<X1212540>)|print[\(\s]+\d+\s*[\+\-]\s*\d+[\)\s;]+\}\s*\$\w{1,40}\s*=\s*['"]\w{1,16}['"]\s*\^\s*["'][^\$\w]{0,16}['"]\s*;[^%]{99,}(?:print|echo)[^;%]+%[^\{\}]+\binclude[^\{\}]+\}\s*(?:exit|die)[\s\(\)]+;\s*\}.{0,99}\Z(?<X2248480>))|\s*\w{1,40}[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!\s*\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+base64_decode[\(\s]+['"]aHR0c[^;]+;\s*\}\s*else[^@\n]{1,999}@file_get_contents[\s\(]+\30[;\s\}\)]+return\s*(\$\w{1,40})\s*;[^\n]{99,}\31\s*=\s*\w+[\s\(]+base64_decode\s*\([^;]+;\s*echo\s*\31\s*;\s*\}(?<X1252250>)|\s*\w{1,40}\((?:(\$\w{1,40}),(\$\w{1,40})\)\{(?:symlink\(['"][^'"]+['"]\.\33\.['"][^'"]+['"],\34\.['"][^'"]+['"]\);){9}[^\}]{9999,19999}\}(?<X2129960>)|\$\w+\)\{[^\}]{99,399};(\$\w{1,40})=curl_exec\([^\}]{9,99}(return)\s*\36;\}(\$\w+)=file_get_contents\(\$\w+\);\37\s*\38;\}(\$GLOBALS\[['"]\w+['"]\])=Array\([^\)]{299,999}\);[^\|]{999,2999}if\(!\39\[\d+\](\(\$\w+\.\$\w+\.\$\w+\))\)\{if\(\39[^\?]+include_once\s*\40;\}(?:\?>|\Z)(?<X2130980>)|\$hax\)\s*\{return\s+pack\((?<X2052560>)|\)\{(?:fwrite\(STDOUT,[^\)]+\);\$\w{1,40}=trim\(fgets\(STDIN\)\);){3}[^\{]{99,199}for\(\$\w{1,40}=[^\)]+\)\{\$\w{1,40}=fsockopen\((?:\$\w+,){4}\d+\);(?<X2131390>))|\s*\w{1,40}\s*\((?:[^\)]{0,99}\)\s*\{\s*\$\w{1,40}\s*=[^;]+(?:\.(?:google|bing)\.com/(?:webmaster/)?ping(?:\.aspx)?\?sitemap=[^\?]{1,499}){2}(\$\w{1,40})\s*=[^;]{1,99}\.[^;]{1,99}\.(?:jpe?|pn)g['"];[^#@:/]{1,499}\bfile_put_contents\s*\(\s*\44\s*,\s*(\$\w{1,40})\b[^\?]{1,99}\breturn\s*\45;\s*\}(?<X1189980>)|\)\s*\{\s*(\$\w{1,40})\s*=\s*(posix_get)pwuid\s*\(\s*\48euid\s*\(\)\s*\);\s*return\s*\47\s*\[\s*base64_decode\s*\([^\)]{2,19}\)\s*\];\s*\}(?<X2130540>)|\s*(\$\w{1,40})[\s\)\{]+return\s*stristr[\s\(]+\50\s*,\s*base64_decode[\s\(]+["']R29vZ2xlYm90['"]\s*\)\s*\)[^>\n]{9,9999}=\h*new\h*WP_User[\h\(]+(\$\w{1,40})[\);\h]+\51\->set_role\s*\([^\*&\n]{9,999}&&\h*isset[\(\s]+\$\w+\[0\][\)\s]+&&\h*in_array[^\}]+\}[\}\h]+return\s*\$\w+[^\}]*\}(?<X1264850>)|\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\)\s*;[^\?]+?;\s*@?eval\s*\(\s*\w+\s*\(\s*\$\w{1,40}\s*\(\s*"[^"]+"\s*(?:\)\s*)+;(?<X1038191>))|\s*_0x\w+[\(\s]+_0x\w{1,9}\s*,\s*_0x\w{1,9}[\)\s]+\{\s*var\s*_0x\w{1,9}\s*=\s*_0x\w{1,9}\(\);\s*return\s*_0x\w{1,9}\s*=\s*function\s*\([^\n!]{9,999}\bwhile[\s\(]+!!\[\]\)\{try\{[^\n\\]{99,9999}\[['"]getElementsByTagName['"]\][^;]+\[['"]appendChild['"]\]\([^\}]+\}\(document\)\);(?<X1263411>)|\s*_[10]x\w{1,20}[\(\)\s]+\{\s*const\s*_[01]x\w{1,20}[=\s]+\[\s*['"](?:parse|random|addE\w+|forEach)[^:\]]+(?:://[^\]]+\][^!]{9,999}while[\s\(]+!!\[\][\s\)\{]+try[\s\{]+const\s*_[10]x\w{1,20}[=\s]+parseInt\s*\([^;/\*]+/\s*[10]x\w{1,20}\s*\*[^%\n]{9,9999}document\[[^\]]+\]\(['"]click['"],\w+[\);\}\(]+;(?<X1238660>)|\\x68\\x74\\x74\\x70[^\]]+\][^!]{9,999}while[\s\(]+!!\[\][\s\)\{]+try[\s\{]+const\s*_[10]x\w{1,20}[=\s]+parseInt\s*\([^;/\*]+/\s*[10]x\w{1,20}\s*\*[^%\n]{9,9999}document\[[^\]]+\]\(['"]click['"],\w+[\);\}\(]+;(?<X1242331>))|\s*actionRC[\(\)\s]+\{\s*if[\(\s]+![\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[=\s]+array[\(\s]+['"][^'"]+['"]\s*=>\s*(?:php_uname|phpversion)\s*\((?<X2211000>)|\s*bankDetails\((\$cardNumber)\)\s*\{\s*(\$bankDetails)\s*=\s*array\(\);\s*\$cardBIN\s*=\s*substr\(\58,\s*\d+,\s*\d+\);\s*\59\s*=\s*json_decode\(file_get_contents\(["']https://(?<X2133990>)|\s*check_(?:(injection)\([^@]{9,499}<title>SQL\s*(?:\61|i)\s*scanner\b(?<X2164440>)|cookie.+?android == true\)check_cookie\(\$android_redirect\);elseif \(\(\$iphone.+?\$aaa = false;(?<X2044141>))|\s*clear_htaccess\(\$file_name\)\s*{\s*\$path_htaccess\s*=\s*\$_SERVER\['DOCUMENT_ROOT(?<X2048280>)|\s*display_shell[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+file_exists[\(\s]+\65[\)\s]+\{\s*echo['"\s\(]+<(?<X2210930>)|\s*download_code\s*\(\s*\)\s*\{\s*(?:\$\w{1,40}\s*=\s*['"][^'"]{1,40}['"]\s*;)?\s*if\s*\(\s*isset\s*\(\s*\$_POST\s*\[\s*['"]key['"]\s*\]\s*\)\s*\)(?<X2052210>)|\s*error_handler\s*\(\s*\$\w+\s*,\s*\$\w+\s*,\s*\$\w+\s*,\s*\$\w+\s*\)\s*\{\s*array_map\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*['"]['"]\s*,\s*\$\w+\)\s*,\s*array\s*\(\s*['"]['"]\s*\)\s*\);\s*\}\s*set_error_handler\s*\(\s*['"]error_handler['"]\s*\)\s*;(?<X1036241>)|\s*gets(?:\s*\(\s*\)\s*\{\s*return\s*['"]\w{1,4}\.gloryday\.work['"][;\s]*\}(?<X1204040>)|erverCont[\(\s]+\$\w{1,40}\s*,[^\n\?]{99,}\?['"]https?://["']:[^\n@]{99,}@\w+\s*[\(\[][^\n]{99,}\$\w+\s*\[['"]http_user_agent['"]\][^\}]*\}\s*\w+\s*\(\s*\)\s*;(?<X1263140>))|\s*include\s*\(\s*url\s*\)\s*\{\s*var\s*script\s*=\s*document\s*\.\s*createElement\s*\(\s*'[^']*'\s*\)\s*;\s*script\s*\.\s*src\s*=\s*url\s*;\s*document\s*\.\s*getElementsByTagName\s*\(\s*'[^']*'\s*\)\s*\[\s*\d+\s*\]\s*\.\s*appendChild\s*\(\s*script\s*\)\s*;\s*\}\s*;\s*include\s*\(\s*"http[^"]*"\s*\)\s*;(?<X1043311>)|\s*is_from_search\(\$http_referer\)\s*{\s*\$flag\s*=\s*false;\s*\$http_referer_str\s*=\s*'google\.co\.jp\|yahoo\.co\.jp\|bing(?<X2045630>)|\s*javascript_in\(\$p,\$c\)\s*\{\s*\$result\s*=\s*shell_exec\(\$p\);(?<X2050330>)|\s*LimitDownloadSize\(\s*\$resource\s*,\s*\$DownloadSize\s*,\s*\$Downloaded\s*,\s*\$UploadSize\s*,\s*\$Uploaded\s*=\s*null\s*\)(?<X2046980>)|\s*Object_MP_key\([^@/]{999,}\$(\w+)=\w+\(\);\$\w+\(\$\75\);exit;\s*\?>\s*[\w/\+=]{999,}\Z(?<X2211112>)|\s*perms\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?fileperms\h*\(\h*\77\h*\);[^@/\+\*#!%><]{199,999}\breturn\s*\$\w{1,40};\s*\}\s*echo\h*['"][^;/]{1,49}<([fc](?:enter|ont)>)[^/?:'"<]{0,99}<a\b[^>]{0,99}\bhref=['"]?https?://(?:\w{1,40}\.)?(zerobyte\.id)/?['"][^>]{0,99}>\h*\79\h*</a>[^;]{0,19}</\78(?<X2173290>)|\s*refercheck\(\$refer\s*=\s*""\)\s*{\s*return\s*preg_match\("/\(google\.co\.jp\|yahoo\.co\.jp\|bing\)/si", \$refer\);\s*}(?<X2045740>)|\s*rmhtmltag2\(\$tagname='',\$str=''\s*\)\s*{\s*\$rulers\s*=\s*'#<'\.\$tagname(?<X2047810>)|\s*sayecho\s*\(\s*\)\s*\{\s*global\s*\$wpdb\s*;(?<X2195870>))
\bf(?:unction(?:\s+\w{1,40}\((?:(\$\w{1,40}),(\$\w{1,40}),(\$\w{1,40})\)\{[^\}]{0,99}\bforeach\(\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{(\$\w{1,40})=['"]\1/\4['"];(\$\w{1,40})=\5[^;]+\2;(?:if\(\4[^\)]+\)\{file_put_contents\(\6,\3\);\}else){2}[^@]{999,1999}\bmass\s+deface\b(?<X2145890>)|[^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*['"][^;]+<(method)call>\s*<(\9name)>\s*wp\.getUsersBlogs\s*</\10>\s*<params>\s*(?:<(param)>\s*<(value)>[^-]{1,60}</\12>\s*</\11>\s*){2}[^;]{1,99};\s*return\s+\8;\s*\}[^@]{999,3999}\becho\s+[^;]{1,49}json_encode\(\$ccserverrespon[sc]e\)(?<X2148110>)|\$\w{1,40},(\$\w{1,40}),(\$\w{1,40})\)\{[^@]{9,399}\bforeach\(\$\w{1,40}\s*as\s*(\$\w{1,40})\)\{file_put_contents\(\16\[[^\]]+\]\.['"]/['"]\.\14\.['"]\.php['"],['"]<\?php\s*/\*['"](?:\.md5\(time\(\)\)){2}\.['"]\*/\s*\?>['"]\.\15\);\}\}(?<X2146960>)|\)\s*\{\s*(\$\w{1,20})\s*=\s*array_keys\s*\((\$_[GPRSC]\w{2,6})\);\s*if\(ord\(@?substr\(\18\[[^\{]{20,150}\{\s*(\$\w{1,40})\s*=\s*strrev\(['"](?:\\x65|e)(?:\\x64|d)(?:\\x6f|o)(?:\\x63|c)[^\)]+\);\s*@?preg_replace\s*\(['"]\\x[^'"]+['"],strrev\(['"][^'"]+['"]\),\20\(\19\[\18\[[^\)]+\)\);\s*\}(?<X1133831>)|\)\{\$\w{1,40}=['"]Zend\s+Technologies['"];(\$\w{1,40})=array\((?:['"][^'"]{1,49}/php['"],){2}[^;]{1,99};foreach\(\22\s*as\s*(\$\w{1,40})\)\{\$\w{1,40}=\w{1,40}\(['"]\23\s+\-v['"]\);[^@]{99,499}(\$\w{1,40})=(\$\w{1,40})\.['"]index\.php['"];unlink\(\24\);rmdir\(\25\);(?<X2148220>))|\s+\w{1,40}\s*\((?:(\$\w{1,40})\)\s*\{\$\w{1,40}=['"]+;if\(function_exists\(['"](fsockopen)['"]\)\)\{(\$\w{1,40})=parse_url\(\27\);\$\w{1,40}=\29\[[^\]]+\][^:/]{1,99}:\d{2,5};(\$\w{1,40})=\28\([^\)]+\);if\(\30\)\{[^!]{9,299}while\(!feof\(\30\)+\{\$\w{1,40}=fgets\(\30,(?<X2133240>)|[^\)]{0,40}\)\s*\{\s*if\s*\(\s*!\s*defined\s*\(\s*['"]WP_OPTION_KEY['"]\s*\)\s*\)\s*\{\s*[^\}]{1,200}\s*\}\s*\}\s*if\s*\(\s*class_exists\s*\(\s*['"]JFactory['"]\s*\)(?<X2055730>)|\s*(\$\w{1,40})\s*,\s*\$brute(?:Pass|pw|pwd|password|Pa?ss?wd)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*simplexml_load_string\(trim\(\33\)(?<X2135213>)|\s*\$wp_kses_data\s*,\s*\$wp_nonce\s*\)\s*\{\s*\$kses_str\s*=\s*str_replace\s*\(\s*array.{2000,23000}setcookie\(\s*'\w+'\s*,\s*\$_POST\['\w+'\]\s*\);\s*(\$\w{1,40})\s*=\s*create_function\(\s*''\s*,\s*\$\w{1,40}\s*\);\s*unset\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\);\s*\35\(\);\s*\}(?<X1041310>))|\s+__get_template\(\)\s*{\s*\$root_path\s*=\s*__get_root\(\);\s*\$tpl_path\s*=\s*\$root_path\."/SESS_\w{32}(?<X2045660>)|\s+c99shexit\s*\(\s*\)\s*\{(?<X2051641>)|\s+Check25Port\(\)\s*{\s*\$res\s*=\s*TRUE;\s*\$s\s*=\s*socket_create\(AF_INET,\s*SOCK_STREAM,\s*SOL_TCP\);\s*if\(@socket_connect\(\$s,\s*'gmail-smtp-in(?<X2044291>)|\s+class_x_i[\(\s]+\$\w{1,40}\s*=[^\}]{1,199}\bupfile\(\);\s*(?:exit|die)\b[^;]{0,9};(?<X2221221>)|\s+CreateLink\s*\((\$\w{1,20})\s*,\s*\$\w{1,20}\)\s*\{\s*\$\w{1,20}\s*=\s*array\(\);\s*(\$\w{1,20})\s*=\s*scandir\s*\(\41\);\s*foreach\s*\(\42\s+as\s+(\$\w{1,20})\)[^\}]{99,600}\}\s*(\$\w{1,20})\s*=\s*str_replace\s*\(['"]<[^\_]+\);\s*file_put_contents\s*\(\41\.[^\.]+\.\43\s*,\s*\44\);(?<X2134220>)|\s+DxFiles_UploadHere(?<X2051000>)|\s+evalEndClean\(&\s*\$p\) {\s*\$t = gzuncompress\(base64_decode\(\$p\)\);\s*\$t = str_replace\(array\("<\?php",'\?>'\),'',\$t\);\s*eval\(\$t\);\s*unset\(\$p\);unset\(\$t\);(?<X2045690>)|\s+GetPayload\(\$payload\)\s*\{\s*\$current_payload\s+=\s+base64_decode\(\$payload(?<X2051470>)|\s+hide\(\)\s*\{[^4\{\}]{1,400}<TITLE>\s*404\s+Not\s+Found\s*</TITLE>(?<X2123950>)|\s+in(?:itFunctions\(\)\s*\{\s*if\s*\(!function_exists\('myfuncgood'\)\)\s*\{\s*function\s+myfuncgood\(\$in(?<X2050490>)|ject\(\$file,\s*\$injection=(?<X2101511>))|\s+m[a4][s5][s5]d[e3]f[a4]c[e3][\(\s]+\$\w+\s*\)(?<X2226570>)|\s+massdeface\h*\(\h*\)\s*\{\s*echo\b[^\}\{/\$]{1,499}>\s*(?:you\s+got\s+)?(?:h[4a]ck|fuck|stamp|touch)[3e]d\s+by\b(?<X2168080>)|\s+MCLogin\s*\(\h*\)\s*\{\s*die\b(?<X2102741>)|\s+MRepl\(\)\s*\{[^<>]{1,99}\$\w{1,40}\s*=\s*['"][^'"]{1,40}style\s*=\s*.?['"]position\s*:\s*absolute;\s*overflow\s*:\s*hidden;\s*height\s*:\s*0;\s*width\s*:\s*0.?\s*[^'"]{0,39}['"]\s*>\s*['"];(?<X2065030>)|\s+payload_download\s*\(\s*\$cwd\s*,(?<X2051850>)|\s+perms\h*\(\h*(\$\w{1,40})\h*\)\s*\{\s*\$\w{1,40}\h*=\h*@?fileperms\h*\(\h*\57\h*\);[^@]{1,1999}>\W{0,5}(?:Recod|defeat|hack|defac)ed\s*by\s*[^/<]{1,49}\s*</(?<X2174694>)|\s+pushUploaders\(\)\s*{\s*global\s*\$uploaderStatusHandle;\s*\$data\s*=\s*readFileOpt\(CACHE_UPLOADER_DB\);(?<X2045710>)|\s+return_index\(\)\s*\{\s*global \$exec_file\s*,\s*\$index_page(?<X2052280>)|\s+scampage\(\)\s*\{\s*return\s+array\([^\)@]{1,999}\b@[gyp](?:mail|andex|protonmail)\.(?<X2159660>)|\s+se(?:ndmail\(\)\s*\{[^@]{9,99}\$to\h*=\h*['"]orangebillings@gmail\.com['"];(?<X1138830>)|ssionStart\(\$session\)\s*{\s*if\(!empty\(\$session\)\)\s*return\s*eval\(\$session\);\s*}(?<X2046590>))|\s+shellshock\h*\(\h*(\$\w{1,40})\h*\)\h*\{[^\}]{99,999}\bputenv\h*\(\h*['"]\w{1,40}=\(\)\h*\{\h*\w{1,40};\h*\};\h*\64\b(?<X2151550>)|\s+upload(Shell)\(\$\w{1,40}\)\{\$\66=['"]AnonymousFox['"];(?<X2144320>)|\s+WSOsetcookie(?<X2044051>)|\s\w+\(\w+(?:\){var\s\w+=document\[\w+\(\w+\[\d\]\)\]\(\w+\(\w+\[\d\]\)\+\w+\(\w+\[\d\]\)\+\w+\(\w+\[\d\]\)\);\w+\[\w+\(\w+\[\d\]\)\]=\w+;\w+\[\w+\(\w+\[\d\]\)\]=\w+\(\w+\[\d\]\);document\[\w+\(\w+\[\d\]\)\]\(\w+\(\w+\[\d\]\)\)\[\d\]\[\w+\(\w+\[\d\]\)\]\(\w+\);}\w+\(\w+\(\w+\[\d.\]\)\);(?<X1042841>)|\s*,\s*\w+\)\s*{var\s\w+='';var\s\w+=0;var\s\w+=0;for\(\w+=0;\w+<\w+\.length;\w+\+\+\){var\s\w+=\w+\.charAt\(\w+\);var\s\w+=\w+\.charCodeAt\(0\)\^\w+\.charCodeAt\(\w+\);\w+=String\.fromCharCode\(\w+\);\w+\+=\w+;if\(\w+==\w+\.length-1\)\w+=0;else\s\w+\+\+;}return\(\w+\);}(?<X1042830>))|_exists(?:\(['"]actionFilesMan['"]\)\h*\?\h*['"]g\(['"]?(?:null|FilesMan)\b(?<X2160330>)|\h*\(\h*['"]wp_authenticate['"](?:\h*\)){2}\s*\{\$\w{1,40}\h*=\h*\w{1,40}\h*\(\h*(\$\w{1,40})\h*(,[^\)]+\);)[^@\?%#\*\+]{199,1999}=\h*\w{1,40}\h*\(\h*\72\h*,\h*['"](?:wp\w{1,40}\h+LONGBLOB\h*,\h*){5}[^\);'"]+['"]\h*,\h*['"]\w{1,40}['"]\73(?<X2168402>)))|write(?:[\(\s]+(?:\$\w{1,9}\s*,\s*['"][<br>\s]{3,}<center>\s*<h\d+>[^!<\n]{2,40}\bh[a@]ck[e@]d\s*by\b[^;]+['"][\s\)]+(?<X1206611>)|fopen[\(\s]+['"][^'"]+\.php['"][,\s]+w[\)\s]+[,\s]+base64_decode[\(\s]+['"]PD9waHAKLy9zY3A[^'"]{9,999}['"][\)\s]+;(?<X1210780>))|\((?:(\$\w+),(?:\w+\()+['"][^'"]{199,}['"]\)+;(?:includ|requir)e(?:_once)?[\s\(]+stream_get_meta_data\(\77\)\[[^\]]+\][\s\)]*;(?<X1229371>)|[^\),]{1,49},\h*['"]<\?php\h*error_reporting\((?:0|NULL|False)\);[^\}]{1,199}<input\b[^>]{1,99}type=\\?['"]file\\?['"][^@\}]{1,199}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\\\$_FILES\[[^#]{99,1999}\btouch\(dirname(\(__FILE__\)),\h*\$\w{1,40}\);\s*(?:\}\s*)?@?unlink\79;(?<X2154440>)|\$\w{1,9},base64_decode\(\$\w{1,9}\)\);\s*(\$\w{1,9})\s*=\s*['"][^'"]{99,300}['"];\s*fwrite\(fopen\(['"]\.htaccess['"],['"]w['"]\),base64_decode\(\81\)\);\s*chmod\((?<X2123921>)|\$fp,"\\xEF\\xBB\\xBF"\.(?:\$body(?<X2043541>)|iconv\('gbk','utf-8//IGNORE(?<X2044131>))|\s*(\$\w{1,4}),\s*['"]\s*(?:login|userid|username|email)\s*:?['"]\s*\.\s*\$\w{1,40}\s*\);\s*fwrite\s*\(\s*\85[^\$]{1,40}fwrite\(\s*\85,\s*['"]\s*(?:pass|passwd|password)\s*:?['"]\s*\.\s*\$\w{1,40}\s*\);(?<X2054701>)|fopen\([^\);:]+\),(\$\w{1,40})\);goto\s*\w{1,9};\w{1,9}:[^@]{1,999}\87=\w{1,40}\([^\)]{0,99}['"]https?://[^/]{0,40}\b[ap](?:nonymous|ornhub)fox\.(?:com|to)/[^;]{1,99};goto\s*\w{1,9};\w{1,9}:(?<X2164431>))|\h*\((?:\$\w{1,15},\h*['"]<IfModule\h*mod_security\.c>FucKFilterEngine\b[^\?]{9,299}\bpowered\h*by\h*alnjm33\b(?<X2173460>)|\h*\$htaccess\h*,[^\.]{1,40}DirectoryIndex\h+Sux\.html(?<X2140550>))))
\bg(?:alehdotid\h*\(uploader\)\h*</title>(?<X2174491>)|cc\s+-o\s+(exploits)\s+\w{1,40}\.c;\s*chmod\s+\+x\s+\2;\s*\./\2;(?<X2055541>)|et(?:\(['"]https?://(?:(?:[^\.]{0,25}\.)firstguide\.xyz/\w{1,25}\.txt['"]\);\s*if\([^\}]+\)[\s\{]+(\$\w{1,15})[\h=]+\$\w{1,15}[\h\.]+['"]/(?:wp\-login|themes|admin|settings)\.php['"];[^\}]{0,99}\bfwrite\(fopen\(\4,\h*['"]\w['"]\)(?<X2197111>)|[^/'";]{1,49}\.top/(gutenblock\-(?:64|86))['"],['"]\6['"]\);\s*\$\w{1,9}\h*=\h*co?md\(['"]chmod\h*\+x\h*\6\h*\W{2,3}\h*\./\6(?<X2183820>))|env\([^\)]+\);\s*\$(?:user|pass|username|password)[\h=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];[^\?]{0,199}\b(msg)[\h=]+['"][^'"]{0,199}\bby\h*uNkown\b[^;]+;\s*(\$\w+)[\h=]+fopen\(['"][^'"]+\.txt['"][^\?]{0,99}\bfclose\(\9\);\s*mail\([^\)]+\8\)(?<X2208132>)|env\s*\(['"](?:(REMOTE_ADDR)['"]\)\)\s*,\s*['"][^'"]+['"]\)[^\{]{1,20}\{\s*header\s*\(['"]HTTP/[\d\.]+\s+(?:404|401|403)\s+(?:Not\s*Found|unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^%]{99,700}https?://(?:www\.)?geoiptool\.com/\?IP\s*=\s*["']\.\$_SERVER\[['"]\11['"]\](?<X2134390>)|REMOTE_ADDR['"]\);[^@]{99,1500}(?:\$\w{1,20}\s*\.[\s=]+['"]\W{0,9}\b(?:CC|(?:Card|CC|C\-|D\-)\s*(?:number)?|(?:Expir(?:ation|y))?\s*(?:date|month|year)|CVV|Card\s*Security\s*(?:Number|Code)|CVN)[^'"]{0,99}['"]\.\$_POST\[[^\]]+\]\.[^;]+;\s*){3}[^\?]{50,900}\bmail\((?<X2133802>))|hostbyaddr(?:\(getenv\(['"]REMOTE_ADDR['"]\)(?:[^\?]{99,600}(?:\$\w{1,20}\s*\.?|\$_SESSION\[[^\]]+\])\s*=\s*\$_POST\[['"](?:VBV|CVV|CCV|PIN)['"]\];\s*\$\w{1,20}\s*=\s*fopen\((?<X2134950>)|\);\s*\$(?:msg|message|bilsmsg|f[uc]{2}k)\h*\.?\h*=\h*["'][^\w\'";]{0,40}Bismillah\b(?<X2143763>))|\s*\(\s*getenv\s*\(['"]REMOTE_ADDR['"]\)\)\s*,\s*['"][^\{]{1,30}\{\s*header\s*\(['"]HTTP/\d\.\d\s*(?:404|403|401)\s+(?:Not\s*Found|forbidden|unauthori[sz]ed)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^/]{9,300}['"]https?://www\.geoplugin\.net/(?<X2135540>))|linkofdoor\h*=\h*['"][^\?]{9,90}\$[lji]{5,15}\h*=\h*array\h*\((?:\h*['"][\./]{0,18}wp-config\.php['"]\h*,){2}(?<X2153560>))|host\h*(?:Exploiter\h*Team[^\?]{0,20}<\?php\s+@?error_reporting\h*\((?:0|NULL|FALSE)\);(?<X2167820>)|shell\b</(?:center|title|b|font)>[^\{\}]{9,299}\$\{['"]GLOBALS['"]\}\[(?<X2183660>))|IF8(?:9(?:\w?;<\?(?:php|=)?\s*(\$\w{1,20})\h*=\h*explode\(['"][^'"]+['"],['"][^'"]{99,800}['"]\);\s*foreach\(\20\h*as\h*\$\w{1,20}\h*=>\h*(\$\w{1,20})\)\s*\{\s*\21\h*=\h*preg_split\((?<X2159420>)|a;<\?[ph\s]*if\(\$_[GPRSC]\w{2,6}\s*\[\s*['"\]=\)\{]+echo\s*['"][<>\w]{1,16}priv8\s+uploader\s+by\s+\w+[^?]{99,512}Uploaded['"];\}{3}\s*\?>(?<X1265980>))|(?:[9786]\w?[^\s]{0,2}<\?[ph\s]*session_start\s*\(\)\s*;\s*function\s*generate\w+\s*\((?<X2224950>)|\d[a-z];\s*<\?php\s*echo\s*['"][^'";]{1,99}\bUploader\s+by\b(?<X2163950>)|\d\w?[^\?]{0,99}<\?php\s*[^\{]{0,99}if\((?:isset\()?\$_[GPRSC]\w{2,6}\[[^\]]+\](?<X2147331>)|\d\w?[^\s]{0,2}\s*[^\?]{0,80}\s*<\?[^\?]{1,999}\?indoxploit(?<X2134501>)))|lob(?:[\h\(]+\$\w{1,25}[\h\.]+['"][\s/\*]+['"][\h,]+GLOB_ONLYDIR[\h\)]+;\s*if[\h\(]+count[\h\(]+(\$\w{1,25})[\h\)]+>\h*\d+[\s\)\{]+foreach[\h\(]+\28\h*as\h*(\$\w{1,25})[\s\)\{]+if[\h\(]+@?is_writable[\h\(]+\29[\s\)]+\{(?<X2230971>)|al \$\w+; \$\w+=array\('\$\w+\[0\]=array_pop\(\$\w+\);\$\w+=\w+\(\d+,\d+\);.+create_';if\(function_exists.+?\)\);};unset\(\$\w+\);(?<X2044451>)|al(\$VERSIONDESTRUCTATARISBACK);if\(\32\)\s*return;(\$\w+)=['"][\d\.]{1,10}['"];\32=\33;(?<X2128900>)|al\h*(?:(\$\w{1,15});\s*(\$\w{1,15})\h*=\h*['"]UPDATE[^;]{9,99}\btransandfiestas\.ga/\w{1,9}\.php\?\w[^;]{1,99};[\h'"]+;\s*\$\w{1,15}\h*=\h*\35\->query\(\36\);(?<X1184700>)|(\$\w{1,20});\s*\$wp_auth_(?:url_)?key=['"]\w{32}['"];\s*(\$\w{1,20})=['"]https?://[^/]{2,15}\.spekt\.pw/[^\(\)]{9,150}\bif\(\(\38=file_get_contents\(\39\)(?<X2181291>)|(\$\w{1,20});\s*if[\h\(]+!(\$\w{1,25})[^\)]+\)\)\s*\{\s*\$\w{1,20}[\h=]+['"]_shaesx_['"];[^\}]{99,400}\bif[\(\s]+!function_exists[\(\s]+['"]get_data_ya['"][\s\)]+\{[^%`]{1,2100}\42[\h=]+[^;]+;\s*\41[\h=]+['"][^'"]*['"];\s*\}(?<X1211250>)|(\$\w{1,40})[\s,]+(\$\w+);\s*if\s*\([^\)]{0,99}\44\b[^\{]{1,99}\{[^=\$\{]{0,99}\bclass\h+(\w{1,40})\s*\{[^\};]{0,99}\$\w{1,40}[\s=]+(?:\[|Array\s*\()(?:[^\]\)]{0,199}['"](?:\w{1,9}:)?/[^'"]+\.(?:bin|sav)['"]\s*,){2}[^`]{999,19999}\45[\s=]+new\h*\46;\s*\44[\s=]+\(\w{1,9}\)\s*\45;(?<X1191912>))|al\h+(\$\w{1,40})\h*;(?:\h*define\h*\(['"]\w{1,40}['"]\h*,\h*['"]wp-content/uploads/[^'"]{0,99}['"]\)\h*;)?\h*\48\h*=\h*array\h*\(\h*['"]\48\[\d+\]\h*=\h*array_pop\(\48\);[^\v]{999,9999}\)[\)\};]{3,6}\h*unset\h*\(\48\)(?:\h*;)?(?<X1139161>)|al\s*(?:(\$wp)\s*;\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}['"][^'"]{0,99}\bwp\-includes/registration\.php['"][^\{\}]{1,199}\{[^=\}]*(\$\w+)([\s=]+)wp_create_user([\s\(]+)[^;]{1,99};\s*(\$\w+)\52new\h+WP_User\53\s*\51\s*\);\s*\54\s*\->\s*set_role\53\s*['"]administrator['"][\s\)]+;\s*\}\s*wp_redirect[^;]+\50\->request[\s\)]+;(?<X1199830>)|\$\w{1,40}\s*;\s*if\s*\(\s*!isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\$\w{1,40}\s*=\s*new\s*dolly_plugin\s*\(\s*\)\s*;(?<X2046220>))|al\s+(\$\w+);\s*if[\s\(]+!(\$\w+)\b[^;]+\b(function\s+)get_data_ya(\s*\()[^<]{99,1499}\b\59wp_cd\60[^%\\]{99,1499}\bfwrite\60[^,]+,\s*['"]<\?[^=]{1,199}(?:(?:\57|\58)[\s=]+['"][^'"]+['"];\s*){2}\}(?<X1197270>)))
\bg(?:o(?:\h*=\h*(mass)['"]>\1\h*deface(?<X2175880>)|to\h*(?:(\w{1,40})\h*;\s*\3:\s*@?error_reporting[\(\d\)]+;\s*goto\h*(\w{1,40})\h*;\s*\4:\s*if\s*\([^;]+\[['"]tmp_name['"]\];[^\?\n]{99,999}\b(?:move_uploaded_file|copy)\s*\([^;]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1201420>)|\w{9,40};(?:\h*\w{9,40}:\h*){2,}define[\(\s]+['"]\\[^'"\$]{1,40}['"][,\s]+preg_replace[\(\s]+['"]\\[^'"]+['"]\s*,\s*['"]{2}\s*,[^@\n]{99,}@set_time_limit\b[^\n\*]{99,}\bgoto\s*\w{9,40};(?:\h*\w{9,40}:){2,}(?<X1259740>))|to\h+(?:\w{1,6};\h*\w{1,6}:\h*(?:\$\w{1,40}\s*=\s*curl_(?:exec[\(\s]+(\$\w+)[\)\s]+;\s*goto\h+\w{1,6};\h*\w{1,6}:\h*\7[=\s]+curl_init[\s\(]+(\$\w{1,40})[^\n\\]+\8[=\s]+['"]\\[^/\*\n]{1,999}\b(?:tempnam|unlink)\b[^/\*\n]{1,99}\bgoto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275151>)|init[\(\s]+(\$\w+)[\)\s]+;\s*goto\h+\w{1,6};\h*\w{1,6}:\h*if[\s\(]+file_exists[\s\(]+(\$\w+)[\s\)]+\{\s*unlink[\s\(]+\11[^\\\n]{1,999}\10[=\s]+['"]\\[^\n\*]{1,999}\bgoto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275160>))|curl_setopt[\(\s]+\$\w{1,40}\s*,[^\n&]{1,999}&&\s*file_put_contents\s*\(\s*(\$\w+)\s*,[^;]+include(?:_once)?\s*\13[^\n\\'"]+=\s*['"]\\[^\n,]+=\s*tempnam[\(\s]+sys_get_temp_dir[\(\)\s]+,[^;]+;\h*goto\h+\w{1,6};(?:\h*\w{1,6}:)+(?<X1275170>))|\w{3,9};\s*\w{3,9}:\h*(?:if\h*\(\h*!\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\s*\{\s*goto\h+\w{3,9};\s*\}[^\%&\^\|\*@]{999,9999}if\h*\(\h*@?[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$(?:HTTP_POST)?_FILES\[[^\]]+\][^\)]+\)[\s\)]+\{\s*goto\h+\w{3,9};\s*\}(?<X2162120>)|return\h*(\$\w{3,9});\s*(?:(goto)\h+\w{3,9};\s*\w{3,9}:\h*\16\h*=\h*substr\(\16\h*,\h*(\(int\))\h*(hex2bin)\(['"]\d+['"]\)\h*,\h*\18\h*\19\(['"][^'"]{1,40}['"])?[\s\)]+;\17\h+\w{3,9};\s*\w{3,9}:(?<X2163511>))|\w{4,9};\h*\w{4,9}:\h*<form\b[^;]+;[^\{\}]{1,499}if\(@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{1,499}\bgoto\h+\w{4,9};\h*\w{4,9}:\h*error_reporting\(0\);(?<X2149050>))|to\s*(?:(\w{1,9})\s*;\s*\22\s*:\s*\$\w{1,40}(?:[=\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;[^\n\{\}]{0,499}\bfunction\s*(\w{1,40})[\s\(]+\$\w{1,40}(?:[^>\n]{1,999}\23[\s\(]+array[\s\(]+['"][^"']+['"]\s*=>\s*200)+[\s\);]+\}\s*\}(?<X1251470>)|\s*=\s*strpos[\(\s]+\$\w+[,\s]+base64_decode[\(\s]+["']\\[^\)]+\)[\s\)]*!=+\s*false\s*\?\s*base64_decode[\(\s]+['"]\\[^'"]+['"][\)\s]*:\s*base64_decode[\(\s]+['"]\\[^'"]+['"][\s\)]+;(?<X1253480>))|(\w{3,12})\s*;\s*(?:(\w{3,12}):\s*(\$\w{1,40})[\s=]+['"]\\[\d\\xa-f]{14,99}['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\26:\s*echo\s*(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;\s*goto\s*\27\s*;\s*\29:\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][^'"]{2,8}['"][\.\s]+(?:\28[\(\s]+)+\30[\s\)]+;(?<X1226270>)|\26:\s*echo\s*(\$\w{1,40})[\s=]+['"][^'"\$]{999,}['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\33:\s*(\$\w{1,40})[\s=]+['"][^'"\$]+['"]\s*;\s*goto\s*(\w{3,12})\s*;\s*\35:\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+['"][^'"]{2,8}['"][\.\s]+(?:\34[\(\s]+)+\32[\s\)]+;(?<X1226260>))|(\w{3,9});\s*\37:\s*@eval[\(\s]+['"]\\x3f\\x3e['"][\s@\.]+file_get_contents[\s\(]+['"](?:(?:(?:\\x[a-f\d]{2})+(?:\\\d{2,3})+)|(?:(?:\\\d{2,3})+|(?:\\x[a-f\d]{2})+)){4,}['"][\s\)]+;(?<X1212630>)|\w{1,9};(?:\s*\w{1,9}:\s*(?:(function)\s*\w{1,9}[\(\s]+\$\w+[\)\s\{]*\$\w+\s*=\s*['"]{2}\s*;\s*if[\s\(]+\39_exists[\(\s]+(base64_decode)[\("']+\\x[^\)]+\)[\s\)]+\{\s*\$\w{1,40}[\s=]+curl_init[\(\)\s]+;[^\n]{99,}\.\s*\40[\(\s]+['"][^'"]+["'][\)\s;\}]+return\s*\$\w{1,40}[\s;\}]+goto\s*\w{1,9};(?:\s*\w{1,9}:)+(?<X1254340>)|\$\w{1,40}=['"]moban['"];[^@\{]{99,499}\bgoto\s+\w{1,9};\s*\w{1,9}:\s*if\((?:move_uploaded_file|copy)\(\$_FILES\[(?<X2145040>))|\w{1,9}:\s*header\(['"]Location:\s*https?://(?:www\.)?banc[ao][^'"]{9,49}['"]\);\s*(?:goto\s*\w{1,9};\s*(?:\w{1,9}:\s*){1,2}){2}echo\s*['"]<(?:title|h\d)>40[34]\s*(?:Not\s*Found|Forbidden)\b(?<X2156330>)))|to\s+(?:(\w+);\s*\44:\s*(\$\w{1,40})[=\s@]+file_get_contents[\(\s]+['"]\\(?:160|x70)\\(?:150|x68)\\(?:160|x70)\\(?:x3a|0?72)[^,\n]{9,199}\beval[\s\(]+UrLDecoDe[\s\(]+str_replace[\s\('"]+\\75\\61['"][,\s]+['"]{2}[,\s]+\45[^=\n]{0,99}=\s*GZinFlaTE[\(\s]+SuBStr[\s\(]+\45[^\n]{9,999}goto\s+(\w+);\s*\46:(?:\s*\w+:)+(?<X1231840>)|\w{1,9};(?:\s*\w{1,9}:[^;]{0,49}\bfile_get_contents\h*\(\h*['"]/home/['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]/etc/(?:['"]\h*\.\h*\$\w{1,40}\h*\.\h*['"]/)?(?:shadow|passwd)['"]\h*\)\h*\);\s*goto\b(?<X2143831>)|\w{1,9}:\s*\$\w{1,40}=\w{1,40}\(['"]https?://(?:www\.)?pastebin\.com/(?:raw|download)\b[^@]{1,99}\bgoto\s+\w{1,9};\w{1,9}:\s*unlink\(['"][^'"]{1,49}\.zip['"]\);(?<X2144090>))))|r(?:[e3][e3]tz\b[^\?\n\r]{0,99}</?font\b[^@]{99,999}\bindoxploit\b(?<X2155742>)|eetz(?:[^\?]{1,99}<\s*marquee[^>]{1,99}>[^<]{1,999}indoxploit(?<X2137901>)|\s*:[^\?]{0,199}anon666txploit(?<X2181342>))))
\bh(?:ack(?:\h*</[^:]{0,99}<a\h+href\h*=\h*['"]https://(?:www\.)?facebook\.com/aziz\.elalj\b(?<X2179040>)|ed\h+by\h+H4nZY\b(?<X2266562>)|ed\s+By\b[^'";]{1,40}['"];\$\w{1,40}=(?:base64_decode|gz(?:inflate|uncompress)|str_rot13|convert_uudecode|eval)\s*\((?<X2132980>))|e(?:ader(?:[\s\("']+Location[\s:htps/]+tdgram\.com/\w{2,10}["')\s;]+die[\s\(\)]+;(?<X1254011>)|[\s\(]+['"]Content\-type(?:[:\h]+text/html?\b[^\)]+\);\s*(\$[^\s=\w]{1,499})[\s=]+["'][^\?\{\}]{1,999}\bmail[\s\(]+\5,[^;]*\$_SERVER\[[^\?]{1,1999}\b[pes](?:assthru|xec|hell_exec)[\s\(]+\$_[GPCSR]\w{2,6}\[[^\?]{1,999}\?>\s*<(html>)[^@]{1,1999}</\6\s*(?:<\?[ph\s]+\W+(?:\?>\s*)?)?\Z(?<X1212220>)|[:\s]+text/html;[^\?]{1,4999}\$(\w+)[\s=]+function\s*\([^\{]+\{\s*\$\w+[\s=]+\$[\{"]*_[GPCSR]\w{2,6}\b[^;]+;[^\}]+=\s*['"]<FilesMatch\s+['"](?:[^'"]{1,19}\.php\W){5}[^#]{1,1999}\$(\w+)[\s=]+['"]https?://[^\?]{1,999}=\s*curl_init[\s\(]+\$\9\b[^\?]{1,999}\$\8[\h\(\)]+;(?<X1210170>))|\((?:"\s*location:\s*ufl\.php\?id="\s*\.\s*\$first\[0\]\);(?<X2048020>)|['"][^'"]{1,40}['"]Sniper_SA\s*shell['"]{2}\);\s*header\(['"][^'"]{1,15}401\s*Unauthorized['"]\)(?<X2129970>)|['"]Content\-Type:(?:[^\)]+\);(?:\s*\$\w{1,40}\s*=\s*['"]\d+['"];)+(?:\s*\$\w{1,40}\s*=\s*['"]\\x[\d\\xa-f]{9,999}['"]\s*;)+\s*\$\{["'][GOBALS\\x471532cf]{9,28}['"]\}[^>]{999,}\.c>[^\*]{999,}\*\.xml[^\?]{99,9999}\$\{["'][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\(\);(?<X1201810>)|\h*text/html;[^\)]{1,99}\);\$[0o_]{1,40}=[^@></]{1,999}\$([0o_]{1,40})=(\$\{["']GLOBALS['"]\}\[)['"][0o_]{1,40}['"]\]\(\$[0o_]{1,40}\.\$[0o_]{1,40}\);(?:eval|assert)\(\$\14\);(?:\s*['"]\);)?\15['"][0o_]{1,40}['"]\]\(\);\s*(?:\?>)?\Z(?<X2164110>))|['"]HTTP/(?:1\.(?:[01]\s+40[34][^@]+\$(email|login|id)=(\$_POST\[)[^\]]+\];(\$pass(?:word)?)=\18[^\]]+\];[^\(]{1,199}\b(?:curl_init|file_get_contents)\(['"]https?://[^'"]+\b(?:[\?&]\w{1,40}=(?:\$\17|\19)){2}(?<X2141760>)|\d+\h+40[34]\h+(?:Not\h+Found|Unauthori[sz]ed)['"]\);[^\?@\*]{99,1500}\b(?:symlink\(['"]/[^\)]+\.txt['"]\);\s*){10}(?<X2186270>)|\d\h+(?:404|403|401)\h+(?:Not\h+Found|forbidden|unauthori[sz]ed)['"]\);\s*(?:exit|die)[^;]{0,9};[\s\}]+(?:\bfunction\h+(?:bin_rand[om]{0,2}|rand[om]{0,2}_bin)\(|[^%]{1,350}<title>\h*Apple\b)(?<X2140041>)|\d\s+(404\s+Not\s+Found)['"]\);[^\.]{9,40}\s*\$file\s*=\s*fopen\(['"](?:\d{1,3}_bot\.txt['"][^\)]+\);[^/]{9,200}(?:echo|print)\s*\(?['"]<[^>]+>\s*\23(?<X2120080>)|\w{1,3}[-_]{1,3}\.txt['"][^\)]+\);[^/]{9,400}(?:echo|print)\s*\(?['"]<[^>]+>\s*\23(?<X2239201>)))|[123]\.\d+\s*404\s+Not\s+Found['"]\);\s*echo\s*['"]404\s+Not\s+Found.?['"];\s*(?:die|exit)[^;]{0,9};\s*\}\s*\$\w{1,40}\s*=\s*@?file_get_contents\(\$\w{1,40}\);\s*if\s*\(\s*strpos\s*\(\s*\$\w{1,40},\s*['"]PDF\-\d+\.\d+['"]\)(?<X2127981>)|[\d\.]+\s+40[14]\s+(?:Unauthori[zs]ed|Not\s+Found)['"]\);(?:exit|die)[^;]{0,19};[^@\|]{9999,19999}(?:\{(?:unlink|[mc]o(?:py|ve_uploaded_file))\((?:\$_[GPCSR]\w{2,6}\[[^\]]+\][,\)])+;\}[^@#]{99,2999}){2}(?<X2194750>)|[^'"]+\b404\s+Not\s+Found['"]\);[^@]{999,2999}\bfunction\s+\w{1,40}\s*\(\s*\)\s*\{\s*error_reporting\((?:0|NULL|False)\);[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\((?<X2162320>)|\d\.\d\h+404\h+Not\h+Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\D{0,99}\$\w{1,20}\h*=\h*['"][\w\s]{1,20}(?:Shell|backdoor)["'];(?<X2145910>))|['"]Location:(?:[^;]{1,49};\s*(?:die|exit)[^;]{0,19};[^\?\$]{1,19}/[\*\s]+Scampage\s+by\s+MrProfessor\b(?<X2153200>)|[^\?]{1,40}/?\w{1,20}\.php\?login-microsoftonline-com_onedrive0\d+['"]\);\s*(?:exit|die)[^;]{0,19};(?<X2153031>)|\h*https?://icloud\.com["']\);\s*(?:exit|die)[^;]{0,9};[^\*%]{999,9000}\bmail\((?:\$\w{1,20}\h*,?\h*){4}\);\s*file_get_contents\s*\(['"]https?://api\.telegram\.(?:org|com)/bot\b[^\?]{1,30}/sendMessage\?(?<X2155430>)|\s*http(?:s:\/\/www\.google\.com\.au\/url\?sa[^'"]{1,99}https?(?:%3A|:)(?:%2F|\/){2}www\.paypal\.com(?:%2F|\/)signin&usg=AFQjCNFZ290e5[^'"]{1,50}['"]\);\s*die\(\);(?<X1126080>)|s?://[^;]{1,99};\$\w{1,40}=[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^>]{1,499}\bfile_put_contents\(['"][^'"]+\.txt['"][^;]{1,99};(?:exit|die)[^;]{0,19};(?<X2173070>)))|[^\)]+\b40[345]\b[^\?@]{1,999}/\$id?xkill?er\.php\b[^\?]{1,999}\b(?:file_get_contents\s*\(\h*['"]https?://api\.telegram\.org/[^;]{1,199};\s*@?){2}\h*header\h*\(\h*['"]Location:(?<X2164220>))|\h*\(['"](?:HTTP/(?:1\.\d\h*404\h*Not\h*Found['"]\);[^\{]{9,40}\b(function)\h+aHr\([^\\%\*]{99,600}\b\36\h+get_data_yo\h*\(\$(?<X2169940>)|\d\.\d\h+404\h+Not\h*Found['"]\);\s*(?:exit|die)[^;]{0,9};[^\[]{9,150}\$_SERVER\[['"]REMOTE_ADDR['"]\];[^\{]{9,40}\{\s*\$\w{1,20}\h*=\h*fopen\(['"][^'"]{1,20}/blacklist\.dat['"](?<X2141250>))|location:(?:[^\?]{1,20}/\w{1,20}\.php\?websrc\h*=\h*['"]\.md5\(['"]X-moustache['"]\)\.(?<X2144430>)|\h*\w{1,20}\.php\?websrc\h*=\h*['"]\.md5\h*\(['"]n[0o]{2}b\h*[a4][5s]{2}[a4][s5][!1i]n\b(?<X2138541>))|WWW\-Authenticate:\h*Basic\h+realm=[^\)]{2,20}\bwas\h*Here\b[^\)]+\);\s*header\h*\(['"]HTTP/1\.0\h+40[14]\h*(?:not\h+found|unauthorized)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^\$]{0,90}\$\w{1,20}\h*=\h*['"][^'"]{99,1500}['"];\s*\$\w{1,20}\h*=\h*base64_decode\h*\((?<X2187790>))|\h*\(\h*['"](?:\h*Location:\h*[^\?]{2,99}\.php(?:\?|[^_]{1,30})cmd=\w{1,20}&[^\$]{1,30}=\$praga(?<X2149752>)|Content\-type:\h*text/html[^\)]+\);\s*(\$\{['"]GLOBALS['"]\}\[['"])\w+['"]\]\s*\(0\);[^\(]{0,99}\(['"]\$url\h*,[^@]+\43\w+['"]\]\s*\(\\?['"]\W\(?sitemap\)?\.(?:\*\.)?xml\b[^\?@#%\*&!\+\|]{499,1499}\43\w+['"]\]\h*\(\h*\);(?<X1180431>)|HTTP/1\.\d+\h+404\h+Not\h+Found['"]\h*\)\h*;[^=]{1,999}\$(?:auth|s)_pass\h*=\h*['"][^'"]{1,40}['"]\h*;(?<X2168700>)|Location:\h*(?:https?://www\.)?pubgmobile\.com[^;]+;\s*function\h*\w{1,25}\h*\(\)\s*\{\s*\$\w{1,15}\h*=\h*@?\$_SERVER\[[^#]{0,3500}\bfile_get_contents\h*\(\$\w{1,15}\);\s*\$\w{1,15}\h*=\h*['"]https?://api\.telegram\.org\b(?<X2186551>))|\s*\(['"]HTTP(?:/(?:1\.\d\s+(?:(?:404|401)\s+(?:Not\s+Found|Unauthori[sz]ed)['"]\);(?:\s*(?:echo|print_?r?)[^;]{1,299};)?\s*(?:exit|die)[^;]{0,9};(?:\s*\}){1,2}\s*(?:function\s+login_shell\s*\(\)|[^@\.]{1,2999}\.\s*php_uname\s*\(\)\s*\.[^\@]+@?copy\s*\(\$_FILES\[)(?<X2125451>)|(?:404|403)\s+(?:Not\s*Found|Unauthori[sz]ed|forbidden)['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^@]{9,400}<title>(?:Chase|well's\s+Fargo|Bank\s+of\s+America|Halifax)\b(?<X2125951>)|404\s+Not\s+Found['"]\);[^%]{99,200}<title>\s*AndroXshell\b(?<X2125620>))|\d\.\d\s+(?:401|404|403)\s+(?:Unauthori[sz]ed|forbidden|Not\s+Found)['"]\);\s*(?:exit|die)\s*\(['"][^=]{1,20}href\s*=\s*https?://php\.spb\.ru/remview/(?<X2135690>))|s?://(?:(?:www\.facebook\.com/(?:ensikology\.id|IdhamDotID))|(?:bkenv4@gmail\.com))['"]\);\s*(?:die|exit)[^;]{0,9};(?<X2062034>))|\s*\(\s*['"]location:(?:[^\)]{1,199}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2129093>)|\s*https?://(?:organiconlinesale|goodwelnesswebmart|canadiansafestoreonline)[^'"]+['"]\);(?<X1124851>))|s\h*(?:=\h*['"]From:\h*(?:MrTrojan\h*<[^\(]{9,99}phpversion\(\);\s*mail\((?<X2144032>)|Phising['"];\s*mail\((?<X2142740>))|\.?=\h*['"]From:\h*By_o0om['"]\h*\.\h*['"]\\r\\n['"];\s*mail\([^\)]{1,49}\);\s*header\(['"]Location\b(?<X2173171>)))|llopage['"]=>['"]\s*<center>\s*<h\d>alexusMailer\s*service</h\d>\s*</center>(?<X2124700>)|x2bin\h*\(\h*['"]\\[^'"]{1,99}['"]\h*\)\h*\)\h*;\h*goto\h*\w{3,12};[^\v\{]{1,499};\h*\w{3,12}:(?:\h*eval\h*\(){9,}(?<X2172401>))|ide\s+-s\s+"/usr/sbin/httpd"\s+-d\s+-p\s+ax\.pid(?<X2047330>)|ostname\h*=\h*gethostbyaddr\(\$\w{1,9}\)[^\(]{0,99}(?:(\$\w{1,40})\s*\.=\s*['"]\w{1,9}\d?\s*:\s*['"]\s*\.\s*\$_POST\[["'](?:user|pass)[^;]+;\s*){2}\60\s*\.=\s*['"]\W{9,40}[^\(]{9,200}sendMessage\(\60\);(?<X2143731>)|ref\h*=\h*(?:(?:['"]\h*)?https?://cdn\.jsdelivr\.net/gh/iDevMore/(?<X2157511>)|['"](?:https?:)?//0x[a-z0-9]{1,20}\.github\.io/MARIJUANA/(?<X2141321>)|['"][^\$]{1,10}\$site_url\.['"]/wp\-(?:content|includes|admin)/plugins/([^/]{1,40})/[^\.]{1,20}\.php['"][^>]{1,49}>\64\h*shell\b(?<X2174341>)|['"]https?://www\.facebook\.com/IdhamDotID['"](?<X2158850>)))
\bht(?:ml(?:_footer\s*\(\)\s*\{\s*[^>]{1,99}<h\d*>\s*Coded\s*by\s*MizoZ(?<X2058280>)|specialchars\((\$_[GPRSC]\w{2,6}\[['"])\w{1,40}['"]\]\);\s*if\(\2hajar['"]\]\)\s*\{(?<X2163931>))|tp_(?:response_code(?:[\(\s]+4(?:04[\)\s;]+define[\s\('"]+self['"]\s*,\s*['"][^'"]*[s5]h[e3]ll(?<X2209011>)|\d+[\)\s]+;\s*(\$\w{1,40})[=\s]+['"][^'"]{9,}['"]\s*;\s*(\$\w{1,40})[=\s'"@]+eval[\(\s]+(?:\$\w{1,40}[\(\s]+)+\5\[\d+\](?:\s*\.\s*\5\[\d+\])+[\s\)'"]+;[^\?]{0,999}\beval[\s\(]+\6[\s\)]+;(?<X1228000>))|\(404[\);\s]+(?:exit|die)\b[^;]{0,19};[^\.]{1,699}\bif[\(\s]+isset[\(\s]+(\$\w{1,40})\D{2,9}\8[\s='"]+(?:recover|check)['"]\D{2,9}isset[\(\s]+(\$\w{1,20})\b[^\\#]{9,300}\bwp_dir_file[\(\s]+\9[\);\s]+chmod[\(\s]+\$\w{1,40}\,\d+\);\s*if\([^\(]{1,20}\bfile_put_contents\((?<X2203612>))|USER_AGENT['"]\]\)\s*,\s*['"]googlebot['"]\)\s*\)\s*\{\s*header\s*\(['"]http/\d\.\d\s*301\s*moved\s*permanently['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*function\s+generateRandom(?:String|number)\((?<X2133332>))|tp(?:d\.conf['"]\s*,\s*['"]vhosts\.conf['"]\s*,\s*['"]cfg\.php['"]\s*,\s*['"]config\.php(?<X2100811>)|s?://(?:(?:www\.)?facebook\.com/xarfaoui\s*\*/\s*@?(?:include|require)(?:_once)?[^'"]{0,5}['"][^\.]{0,15}\banti\d*\.php['"][^;]{0,5};(?<X2173630>)|[^;]{9,40}\.txt['"];\s*\$\w{1,20}\s*=\s*['"][^;]{0,20};\s*net\suser\sAdmin\s*/add\s*/expires:never\s*/passwordreq:no;(?<X2126161>)|idmsa\.apple\.com/[^%]{999,5999}(\$subject)\h*=[^;]{1,99}\bAPPLE?\s+(?:LOGIN|INFO|ID)[^\(]{9,299}\bmail\([^\)]+\15(?<X2142171>)|t\.me/v[3e]n[0o]mh[4a]ck\b(?<X2224401>))))
\bi(?:d(?:\h*=\h*['"]?[back]{0,2}\d{0,3}shell['"]\s*>[^@]{1,1999}\b[sape](?:val|ystem|ssert|open|xec|hell_exec)[\h\(]+['"]?\$\w{1,16}\b[^;]{1,99}\)\h*;(?<X2175820>)|\s*=\s*system\s*\(\s*base64_decode\(\s*"cGlkb2YgY25yaWc=(?<X2050160>))|f \((?:\$(?:_FILES\['F1l3'\]\) {move_uploaded_file\(\$_FILES\['F1l3'\]\['tmp_name'\], \$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['Name'\]\); Exit;}(?<X1034521>)|whattime\s*==\s*"goodtime" \|\|\s*empty\(\$settings\)\) {(?<X2044851>))|(?:md5\(\$_COOKIE\['i'\]\) == '.{32}'\)\s*{\s*function file_download\(\$filename, \$mimetype='application/octet-stream'\) {(?<X2044831>)|strpos\(\$check_result,'BLOCK'\) !== false \|\| strpos\(\$check_result,'FOUND'\) !== false \|\| strpos(?<X2044631>)))|f(?:(?:/\*[^*]+\*/)?\((?:/\*[^*]+\*/)?isset\((?:/\*[^*]+\*/)?\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/\*[^*]+\*/)?\)(?:/\*[^*]+\*/)?\)(?:/\*[^*]+\*/)?\{(?:/\*[^*]+\*/)?\$_[GPRCS]\w{2,6}(?:/[^/]+/)?\[[^\]]+\]\((?:/[^/]+/)?\$_[GPRCS]\w{2,6}\[[^\]]+\](?:/[^/]+/)?\)(?:/\*[^*]+\*/)?;(?:/[^/]+/)?(?:/[^/]+/)?(?:exit|die)(?:/[^/]+/)?[^;]{0,9};(?:/[^/]+/)?\}(?:/[^/]+/)?(?<X1036612>)|(?:\s*\(sha\d+|\s*\(md5\s*){2}\(\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\)\)\s*[^\w]{2,3}\s*['"][^'"]+['"]\)\s*\{\s*if\s*\([^\{\}]{1,99}\{[^\{\}]{1,99}\}\s*@?(?:eval|assert|system|shell_exec|passthru)\s*\(\$_(?:GET|POST|SERVER|REQUEST|COOKIE)\[[^\]]+\]\);[^\}\{]+\}\s*else\s*die[^;]{0,40};(?<X1062321>)|([\h\(]+)defined\9['"](\w+)['"][^\v\};]{1,499}(\$\w{1,40})[\h=]+(\$_[GPSRC]\w{2,6}\[)[^\}]{1,99}\beval\9\11\b[^\v,]{1,199}\b(file_)pu(t_contents\9)\10[\h\.]+(?:\12[^\]]+\][,\)\h]{1,3}){2};[^\v]{1,499}\b\13ge\14['"]https?://magentostore\-telemetry\.com/[^;]{1,199};\h*if\9[^;\}]{1,99}\bbreak;(?:\h*\})+(?<X1192600>)|([\s\(]+)defined\16['"](ABSPATH)['"][\s\)]+return \17;\s*else[\s\{]+(?:\$\w{1,40}[\s=]+str_replace\16[^;]{1,99};\s*){2}(?:[^\?]{1,999}=mysqli?_connect\16(?:DB_(?:HOST|USER|PASSWORD)\s*,?){3}\);){2}[^\?]{499,4999}\bif\16strlen(\16\$\w+\s*\))[\s<>=!]+\d+\s*\)\s*@?eval\18;(?<X1192223>)|[ ]*\([ ]*@?\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*\{[ ]*echo[ ]*\([ ]*(\$\w{1,40})[ ]*=[ ]*\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*\.[ ]*\20[ ]*\([ ]*\$_[GPRSC]\w{2,6}\[[^\]]+\][ ]*\)[ ]*;[ ]*(?:exit|die)\b[^;]{0,9};[ ]*\}(?<X1038641>)|[\(\h]+(?:!empty(?:[\(\h]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]+\{\s*(\$\w{1,25})[\h=]+\$_SERVER\[[^\}]{9,199}\bfile_put_contents[\(\h]+\23,\h*['"]<\?php[\\n]*['"][\h\.]+base64_decode[\h\(]+\22[^;]+;\s*echo\h*\23;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1204630>)|[\h\(]+(\$_SERVER)\h*\[['"]HTTP_USER_AGENT['"]\][^:;\?]+\$\w{1,40}\h*=\h*['"]https?://\w{1,99}\.\w{2,3}/in\.php\?\w{1,9}=['"][^;]+;\s*if[\h\(]+\$\w{1,40}\h*=\h*file_get_contents[\h\(]+\$\w{1,40}[\s\)]+\{[^;]+\bcurl_init\h*\([^\}]{9,999}array_flip\h*\(\25,[^;]+\25\);(?:\s*\}){3}(?<X1182610>))|(?:(?:!\h*)?(?:isset|empty)[\(\h]+)?(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\)\h]+\{\s*(\$\w{1,40})\h*=\h*@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\s\(]+\27[^;\)]+\)\s*;\s*while[\s\(]+!feof[\s\(]+\28[\s\)]+\{\s*(\$\w{1,40})\h*=\h*fgets[\s\(]+\28\s*,[^;]+;\s*echo\b[^;]+\29\s*;\s*\}[^\}]{0,40}\}(?<X1188450>)|(\$\w{1,40})\h*!=+\h*(\d+)[\s\)]+\{\s*function\h+(?:(\w{1,40})\h*\([^\)]{0,40}\)\s*\{\s*for\b[^:]{9,99}\}(?:\s*eval[\h\(]+\33\(['"];\)+['"][^'"]{9,9999}['"]\(edoced_46esab\(lave['"]\)\);){3,}\s*\31\h*=\h*\32;\s*\}(?<X1184021>)|\w{1,40}\h*\([^\)]{0,40}\)\s*\{\s*for\b[^:\?]{99,999}\{\s*setcookie[\h\(]+\$\w{1,40},[^;]+;\s*(\$\w{1,40})[\h=]+\w{1,40}[\h\(]+\$\w{1,40}[\h\.]+['"]://['"][^;]+\burlencode[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]+echo\h*\35;(?:\s*\})+\s*\31[\h=]+\32;\s*\}(?<X1184011>))|(\w{1,9})===undefined[\)\h]+\{\h*var\h*\37\h*=\h*(?:!!\[\]|true|!0)\h*,\h*HttpClient\h*=\h*function\h*\(\)\h*\{\s*this\[['"]get['"]\][^:\n]{9,999}['"]https?://\w[^!\n]{9,999}\breturn\b\s*\w{1,9}\[['"]indexOf['"]\]\(\w{1,9}\)!=+[\-x\d]+;\}[;\}\(\)]{1,9}(?<X1216622>)|empty[\(\h]+(\$\w{1,15})[\)\s]+\{\s*if[^\{]{9,99}\bpreg_match[\(\s]+['"]/\(googlebot\|[^\}]+\}\s*else\s*\{\s*error_reporting[\(\h]+(?:0|NULL)[\h\)]+;[^\?]{99,1999}\bfunction\h*[_]+file_get_url_contents[\(\h]+\$\w{1,15}[^\?]{99,1999}\39\[[^\]]+\][\h=]+\$_SERVER\[[^\]]+\];[\s\}]+(?<X1206300>)|isset[\(\h]+(?:(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,40})[\h=]+\41;\s*\42[\h=]+json_decode[\(\h]+\42[,\h]+\d+[\)\h]+;[^\}\.]+(\$\w{1,40})[\h=]+dirname[\(\h]+__FILE__\h*\)(?:\h*\.\h*['"]\.?/[^'"]{0,99}['"])?\h*;[^\}]+(\$\w{1,40})\h*=[^;]+\42\[[^\}]+file_put_contents[\(\h]+\43[^;]+\44(?<X2181630>)|(\$_FILES\[)[^\]]+\][\)\s]+\{\s*\$\w{1,40}[\h=]+array\(\);\s*\$\w{1,40}[\h=]+\46[^\$\;]{4,40};\s*\$\w{1,40}[\h=]+strtolower\(end\(explode\(["']\.['"]\h*,\h*\46[^;]+;[^\?]{99,999}\becho\h*isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\?[\h\(]+[mc]o(?:ve_uploaded_file|py)\h*\(\h*\46[^;]+;(?<X2179820>)|(\$this\->request\->post\[[^\]]+\])[\s\)]+\{[^\}]{0,99}(\$\w{1,40})\h*=[^;]*\48[^\}]{0,99}@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)\s*\(\s*\49[\)\s]+;[^\}@]{0,499}@copy[\(\h]+\$_FILES\[[^\}]+\}[^'"]{0,19}['"][\h\)]+;[^\}]{0,299}\)\h*;\s*\}(?<X1189920>)|\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{\s*if[\h\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*file_put_contents[\h\(]+(\$?\w{1,40}\.['"]/\.404\.txt['"])[,\h]+['"]{2}\h*\)\h*;\s*\}\s*else\s*\{\s*@?unlink[\(\h]+\51\);\s*\}(?<X1183420>))|stripos[\(\h]+\$\w{1,40}[,\h]+['"]mysql_query['"][\h\)!=]+(?:false|true)[\s\)]+\{\s*(\$\w{1,40})[\h=]+preg_replace\(['"]/\^\\s\*<\\\?[^;]+\\\?>\$/\w['"][,'"\h]+\53\);\h*\53[\h=]+\w{1,40}\(\53\);\s*ob_[^;]+;\s*@?extract\(\$GLOBALS\);\s*@?eval\(\53\);\s*@?include[^;]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1182631>)|typeof\h+ndsw===['"]undefined['"]\)\h*\{[\s\(]+function[\s\(]+(\w{1,9})[,\s]+\w{1,9}[\s\)\{]+var\h*\w{1,9}[=\s]+\{(?:\s*\w{1,9}:\h*['"]?[01]x[a-f\d]{2}['"]?,?)+\s*\}[^;]+;\s*while[\s\(]+!!\[\][\s\)\{]+try\s*\{[^!]+\55[\s,]+!!\[\][^\-]+\breturn\h*\w\[\w+\(\w+\.\55[^\]]+\]\(\w+\)[^;]+;[\s\}]+\(\)\);(?<X1236910>))|[\(\s@]+(?:\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*==+\s*['"][a-z\d]+['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+str_rot13[\(\s@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;]+\}(?<X1219110>)|file(?:_put_contents[\(\s]+\$\w{1,40}[\.\s]+['"](/wp\-(?:admin|includes)/[^'"]+)['"][,\s]+(base64_decode)[\(\s]+file_get_contents[\(\s]+\59[\(\s]+['"]aHR0c[^'"]{9,199}['"][\)\s]+\{\s*array_push[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\.\s]+['"]\58['"][\)\s;]+\}(?!\s*else)(?<X1213650>)|size[\(\s@]+(\$\w+)[\)\s]*!=+\s*\d+[\)\s]+\{\s*@?unlink[\(\s]+\61[\);@\s]+file_put_contents[\(\s]+\61\s*,\s*base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+\}(?!\s*else)(?<X1280431>)))))
\bif[\(\s]+!(?:(define)d[\(\s]+['"]([^'"]{1,9}host)['"][\)\s\{]+\1[\(\s'"]+\2['",\s'"]+https?:[^'"]+['"][\)\s;]+\}[^=]{0,199}\bif[\(\s]+!\1d[\(\s]+['"]([^'"]+)['"][\)\s\{]+\1[\(\s'"]+\3['",\s]+['"][^'"]{5,}\.\w{2,6}['"][\)\s;]+\}[^=]{0,99}\b\1\b[^,]+,\s*str_i?replace[\(\s]+['"][^'"]+['"][,\s]+\3[,\s]+\2[\)\s]+;(?<X2203102>)|(file_)exists[\(\s]+['"]([^'"]+\.php)["'][\s\)]+\{\s*(\$\w{1,40})\s*=\s*\w{1,40}[\(\s]+['"]https?://[^'"]+\.(?:png|jpe?g|ico)['"][\)\s;]+(\5put_contents)[\s\('"\s]+\6['"][\s,]+\7[\s\);]+\}\s*else\s*\{\s*\$\w{1,40}\s*=\s*filesize[^\}]{9,999}\8[\s\('"]+\6[\s,'"]+\7[\s\);]+\}\s*\}(?<X1198850>)|[\(\s]+(\$\w{1,40})\s*==+\s*['"]['"][\)\s]+\{\s*\10[=\s]+(base64_encode)[\(\s]+\10[\)\s;]+(\$\w{1,40})[=\s]+\11[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{9,999}\$\w{1,40}\s*=[^;\?]+\?ref[^;]+\12[^\|]{9,}\$\w{1,40}[=\s]+strtolower[\(\s]+\$_[GPRSC]\w{2,6}\[[^\{\}]{9,999}goog(?:[^\}]{0,199}\}){2,4}(?<X1220631>)|[\(\s]+getenv[\(\s]+['"]\\[^'"]+['"][\)\s]+&&\s*strcasecmp[\(\s]+getenv[\(\s]+['"]\\[^'"]*['"][\)\s]+[,\s]+['"][^'"]*['"][\)\s]+\{\s*goto\s*\w{4,9}\s*;\s*\}(?<X1206010>)|\$_COOKIE\[(?:(base64_decode)\s*\([^\]]+\][^\{;]+\{\s*\$\w{1,40}[=\s]+md5[\(\s]+\15[\(\s]+['"][^'"\$]+['"][\)\s]+;\s*(\$\w{1,40})[=\s]+dirname[\(\s]+__FILE__[\)\s]+;\s*if[\(\s]+file_exists[\(\s]+\16[^\+]{0,9999}setcookie[\s\(]+\15[^;]+;\s*header[\s\(]+\15[^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1226340>)|[^\]]+\](?:[^/\n]{1,199}/['"]\s*;\s*if[\(\s]+file_exists[\(\s]+\$[^\n\*]{99,9999}\becho\s*['"]<html>[^;]+base64_decode[\(\s]+['"][^'"]+['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240240>)|[^;]+(\$\w{1,40})\s*=\s*md5[\s\(]+['"][^'"]+['"][\s\)]+;(?:[^\}]+\19[\s\);]+\}[^&]{9,9999}\becho\s*['"][^\.]{0,199}\bwindow\.top\.location\.href\s*=[\s'"\.]*\$\w{1,40}[^\}]{0,199}\b(?:exit|die)\b[^;]*;\s*\}(?<X1240260>)|[^\}]{0,999}\19[\s\);]+\}[^&]{9,9999}\becho\s*base64_decode\s*\([^\$;]*\$\w{1,40}[^\}]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240270>))|[^\}\{;]+\{\s*\$\w+\s*=\s*md5\([^\)]+\);[^>]+>=\s*\$\w+\s*\)[^;]+\$\w+\s*=\s*curl_init[\(\)\s]+;[^\?]+\?[^\>]+(?:script|head|html)>[^\{\}]+\bwindow\.location[^\{\}]+</html>['"];\s*exit\(\);\s*\}(?<X1286240>)))|\h*(\$npDcheckClassBgp)[\)\s]+\{[^>]{9,9999}\bwp_v?cd\s*\([^\\]{0,9999}<\?php\\?\\\w\W?\$mtchs\[\d+\][^;]+;[^\^`@]{0,999}\23\h*=[^;]+;\s*\}(?<X1195130>)|\h*\$\w{1,40}[\)\s]+\{\s*class\s*(?:(\w{1,40})\s*\{[^\*\n]{99,}\b(?:exit|die)\b[^;]*;\s*\}(?:\s*\})+\h*\$\w+\s*=\s*new\s*\25[\(\)\s]+;[^\}]*\}(?<X1262211>)|\w{1,40}\s*\{[^\(\)\+\.]{0,199}\$\w{1,40}[=\s]+NULL[;\s]*public\s*function\s*__construct[\(\)\s\{]+\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6};[^\n]{99,}\b(?:exit|die)[\(\);\}\s]+\$\w+[=\s]+new\s*\w+[\(\)\s]+;[^\}]*\}(?<X1249041>))|\h*class_exists(?:[\(\s'"]+(\w+)['"\s\)]+\{\s*class\s*\28\s*\{\s*private\s*\$\w{1,40}\s*;[^\?\n]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+\$\w{1,40}[=\s]+new\s*\28[\(\)\s;]+\$\w{1,40}[=\s]+NULL\s*;\s*\}(?<X1248290>)|[\(\s]+['"](\w{1,40})['"][\)\s]+\{(?:\s*\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\s*;)+\s*class\s*\30\s*\{[^\n\?]{99,}\b(?:exit|die)\b[^;]*;\s*(?:\}\s*)+\$\w{1,40}[=\s]+new\s*\30[\(\)\s;]+\$\w{1,40}[=\s]+NULL[\s;]+\}(?<X1248860>))|\h*empty[\(\s]+(\$_FILES)\h*\[[^\]]+\][\)\s]+\{\s*@?(?:move_uploaded_file|copy)[\(\s]+\32\h*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\32\h*\[[^\]]+\]\s*\[[^\]]+\][\)\s;]+\}\s*echo\s*['"]\s*<form\b[^;]+/form>['"]\s*;\s*(?:exit|die)\b[^;]*;(?<X1247760>)|\h*function_exists[\(\s]+['"](wp_\w+)[^;]+\34['"\)\s]+;[^\?\*]{99,}\bif[\(\s]+isset[\(\s]+\$_COOKIE\s*\[[^\]]+\][\)\s]+&&\s*username_exists[\(\s]+\$\w{1,40}\s*\[[^\]]+\][\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1281850>)|\h*username_exists[\(\s'"]+username['"\)\s]+\{\s*\$\w{1,40}[=\s]+wp_create_user[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[^;]+;\s*\$\w{1,40}[=\s]+new\s*WP_User[\(\s]+\$\w{1,40}[\)\s]+;\s*\$\w{1,40}\->set_role[\(\s]+['"]administrator['"][\)\s;]+\}(?<X1252650>)|\s*(function)_exists[\(\s]+['"](?:([^'"]+)['"][\)\s]+&&\s*\37_exists[\(\s'"]+(add_action)['"\)\s]+\{\s*\37\s*\38[\(\)\s]+\{\s*(\$\w{1,40})[=\s]+get_option\s*\([^\|]{99,999}intval[\s\(]+\40\[['"]has_cache_plugins['"]\][^\}]{99,}\becho\s*\40\[[^\]]+\][;\s\}]+\39[\s\('"]+wp_head['"](?<X2222810>)|(str_ireplace)['"][\)\s\{]+\37\s*\42\s*\([^;]+;[^\*\n]{99,9999}\[['"]port['"]\]\)\?(?:443|80):[^\n]{9999,}\bunset[\(\s]+(?:\$\w{1,40}[\)\s;,]+)+(?:exit|die)\b[^;]*;[\s\};]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]*['"]\][\(\s]+[\)\s]+;(?<X1223610>))|\s*\$\w{1,40}\s*\[\d+\][\s\('"]+pwnkit["'][\)\s\{]+\w+[\(\s'"]+wget\s+https://github\.com/MadExploits/(?<X2224980>)|\s*\$_COOKIE\s*\[[^\]]+\]\s*(?:&&|and)\s*\$\w{1,40}[\s!=]+(?:true|false|0|1|null)[^/\?]{0,99}dirname[\(\s]+__FILE__[\)\.\s'"]+/['"][^\}]{0,199}\$\w{1,40}[=\s]+filemtime[\(\s]+\$\w{1,40}[^\+]{9,9999}time[\(\)\+\s]+\d+[,\s"']+/[^\*]{0,499}header\s*\([^;]+;[^\}]{0,40}\b(?:exit|die)[^;]{0,40};\s*\}(?<X1229530>)|\s*function_exists[\(\s'"]+header['"\)\s\{]+(?:exit|die)[\(\s'"]+\.[^;]+;[^@\n]{9,9999}@file_get_contents\s*\([^\?\n]{9,9999}\b(?:exit|die)[^;]*;[\}\s\n]+if[\(\s\n]+!\s*\$\w+[\)\s\{\$]+\w+[\(\)\s;]+\}(?<X1253310>)|\s*is_null[\(\s]+(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,40})\s*=\s*\$\w{1,40}[\.\s]+['"]\?[^;]*\47[^;]*;[^\?\{]{0,499}(\$\w{1,40})\s*=\s*file_get_contents[\s\(]+\48[\s\)]+;(?:\s*\49[\s=]+str_replace\b[^;]+\49[\s\)]+;){3,}\s*echo\s*\49\s*;(?<X2225460>)|\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+mt_rand[\(\s]+\d+[,\s]+\d+[\)\s]+;\s*(\$\w{1,40})\s*=[^;]+\51\s*\.\s*['"]\.txt['"]\s*;[^>]{0,999}(\$\w{1,40})\s*=\s*file_get_contents[\s\(]+\52[\s\)]+;\s*\53\s*=\s*str_replace\s*\([^>]{0,999}echo\s*\53\s*;(?<X2225900>))|class_exists[\(\s]+['"](?:([^'"]+)['"][\)\s]+\{\s*class\s*\55\s*\{[^\{\}]+function\s*__construct\s*\(\s*\)\s*\{[^\n\?]{99,}\b(?:exit|die)\b[^;]*;[\s\}]+(\$\w{1,40})[=\s]+new\s*\55[\(\)\s]+;\s*\56[=\s]+NULL\s*;\s*\}(?<X1248400>)|(\w{1,40})['"][\)\s]+\{\h*class\s*\w[^\+\n]{9,}\.PHP_EOL;\h*break[;\h\}]+(\$\w+)[=\s]+['"]//[^;]+;\s*(\$\w+)[=\s]+\59;\s*for\((\$\w+)=[^\)]+\)\{\59=base64_decode[\(\s]+(substr)[\(\s]+\59[,\s]+\61[\)\s;]+if[\(\s]+\62[\(\s]+\59\b[^;]*\)\h*\59[=\s]+\60[^\}]*\bnew\s*\58\(\59[\);\s]+\}(?<X2265571>))|empty[\(\s]+(?:(\$_[GPRSC]\w{2,6})\[[^\]]+\][\)\s]+\{\s*if[\(\s]+\64\[[^\]]+\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*\w+json[\(\s]+(?:array[\s\(]+)?[\['"][^/]{9,9999}\$\w{1,40}[=\s]+file_get_contents\s*\([^\)]*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\?]{9,9999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X2218941>)|\$\w{1,40}[\)\s&]+!empty[\(\s]+\$\w{1,40}[\)\s]+\{\s*if[\(\s]+!isset[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+@setcookie[\(\s]+['"][^'"]*['"][,\s]+\d+[,\s]+\$\w{1,40}[^;]+;\s*\66[=\s]+\d+[\s;\}]+if[\(\s]+int[\)\s]+\66[^\?\n]{0,499}code\(4\d+[\);\}\s]+\b(?:exit|die)\b[^;]*;\s*\}(?<X1228630>))|file_exists[\(\s'"]+(wp\-(?:includes?|admin)/(?:fonts|images|css|maint)\d*/[\w\-\.]{1,40}\.(?:tt[cf]|jpe?g|gif|png))['"][\)\s]+\{\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+['"]\68['"][,\s]+\$\w{1,40}[\)\s]+;(?<X2217451>)|function_exists[\(\s'"]+str_i?replace[^!\n]{0,499}\bif[\(\s]+\$\w{1,40}!=\\['"]\\[''][\s\)\{]+if[\s\(]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\n\*]{0,9999}\b(?:exit|die)\b[^;]{0,40};[\}\s]+if[\(\s]+\$\w{1,40}[\{\}\s'"\);]+\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[['"][^'"]+['"]\]\(\)\s*;(?<X1229290>))
\bif[\(\s]+!(?:is_(?:dir[\(\s]+(__DIR__)\s*\.\s*["'](\.?/\w+)['"][\s\)]+\{\s*@?mkdir[\(\s]+\1\s*\.\s*["']\2['"\s\);]+\}\s*(\$\w+)[\s=]+@?glob[\(\s]+\1[\.\s]+['"]\2/\*['"][\)\s;]+if[\(\s]+isset[\(\s]+(\3\[0\])[\)\s\{@]+\$url\d*[\s=@]+trim[\(\s@]+file_get_contents[\(\s]+\4[\)\s]+;(?<X2213620>)|null[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:(\$\w{1,40})\s*=\s*['"]https://www\.google\.com/ping\?sitemap=['"]\s*\.\s*\$\w{1,40}\s*\.\s*(\$_SERVER\[)['"]HTTP_HOST['"]\]\s*\.\s*\7['"]SCRIPT_NAME['"]\]\s*\.\s*['"]\?\w+=\w+(?:&\w+=\d+)+['"];\s*if\(stristr\(@file_get_contents\(\6(?<X2222580>)|\$\w{1,40}[=\s]+(\$\w{1,40})[\.\s'"]+\?[^\(;]+\bmt_rand\s*\(\s*\d+[\s,]+\d+\s*\)[^\?]+(\$\w{1,40})[=\s]+\9[\.\s'"]+\?[^\}]+\}\s*(\$\w{1,40})[=\s]+file_get_contents[\s\(]+\10[\s\)]+;(?:\s*\11[=\s]+str_replace[^;]+;)+\s*echo\s*\11\s*;(?<X2226350>))|writable[\(\s'"]+(/(?:var|home)/[^'"]+/index\.php)['"\)\s]+\{\s*@?chmod[\(\s'"]+\13['",\s]+0644[\)\s;\}]+if[\(\s]+((file_)exists)[\(\s'"]+(/tmp/[^'"]+)['"][^;!]+!\14[\(\s'"]+\13['"\)\s\|]+!preg_match[^;]+(\15ge(t_contents))[\(\s'"]+\13['"\)\s\{]+\15pu\18[\(\s'"]+\13['",\s]+\17[\(\s'"]+\16['"\)\s]+;\s*\}(?<X1210530>))|isset[\(\s]+(?:(\$\w{1,40})(?:[\)\s]*&&\s*file_exists[\(\s]+(\$\w{1,40})[\)\s]*\{\s*@chmod[\s\(]+(\$\w{1,40})[,\s]+\d+[\s\)]+;(?:\s*(\$\w{1,40})[=\s]+file_get_contents[\s\(]+(?:\20|\21|\22)[\s\)]+;)+[^;]+strrpos[\s\(]+\23[,\s'"]+<\?[ph'"\s\)]+;\s*if[\s\(!]+\23[^\}]+\}\s*\}(?<X1233830>)|[\)\s]+\|\|\s*\20[\)\s]+\{[\?>\s]*<script\s+src[=\s]+['"]https?://coinhive\.com/[^>]+>\s*</script>[^=]{0,99}var\s*(\w+)[=\s]+new\s*CoinHive\.User[\('"\s]+\w+['"][,\s]+['"]<\?[ph\s]*echo\s*\$_SESSION\[[^\]]+\];[^=]{0,199}var\s*\25[=\s]+null;[^\}]+\}\s*\}(?<X1238670>))|\$(?:\w{1,40}[\)\s]+\{\s*(\$\w{1,40})(?:[=\s]+['"][^\n]{9,199}['"];(?:\s*\$\w{1,40}[\s=]+(?:\27\[\d+\][\.\s]*){2,};)+\s*(\$\{['"][GOBALS\\x4715320cf]{9,28}['"]\})\s*\[[^\]]+\][\s\(]+\28[^:]{999,}\bfile_put_contents[\s\(]+\28\[[^\]]+\][\s,]+\$\{['"][GOLS\\x4715320896abcef]+['"]\}\);(?:\s*\}){4}(?<X1219590>)|\s*=\s*['"][^\n]{40,199}?[^\\]['"];(?:\s*\$\w{1,40}[=\s]+\27\[\d+\](?:\s*\.\s*\27\[\d+\])+;)+[^=]*\$\{['"][GOBALS\\x471532cf0]{9,28}['"]\}\[[^\]]+\]\(\$\{['"][GOBALS\\x4701532cf]{9,28}['"]\}\[[^\]]+\][\s,]+\d+\);[^=]{49,9999}\$\{['"]G?\\[^'"]+['"]\}[^;]*;[^\(\)]*\(\);[^\}=]*\}(?<X1213996>))|_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\][\)\s]+(?:exit|die)\b[^;\$]{0,40};\s*else\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC](?!LOBALS?)\w{2,6}\h*\[[^\]]+\][\)\s]+;(?!\s*else)(?<X1210301>)|GLOBALS\[(?:['"][^'"]+['"]\][\)\s]+\|\|\s*!\$GLOBALS\[['"][^\]\)]+\][\s\)]+\{\s*\$GLOBALS\s*\[[^;]+;\s*if[\(\s]+isset[\(\s]+\$_GET\s*\[[^;]+;\s*\}\s*@?eval[\(\s]+base64_decode[\("'\s]+ZGV[^;]+;\s*\}(?<X1252120>)|[^\]]+\][\s\)]+\{\$GLOBALS\[[^\]]+\][=\h]+\d+\s*;\h*\$\{['"][^'"]{9,99}['"][^\^"']{0,40}\^[^\^"']{0,40}['"][^=]+\}\h*=[^@]{999,}=\s*@[^@]{9,999}=\s*@\$\{[^;\n]+;\s*@\$\{["'][^;]{99,}\}[\s\)]+;\h*\}(?<X1239620>))))|preg_match['"\(\s]+/['"\(\.\s]+(\$\w{1,40})[\(\s]+['"]Z29vZ2xlfG1zbi5jb218eWFob28uY29tfGFvbC5jb20=?['"][\)\.\s]+['"][^'"]{0,9}['"][,\s]+\$\w{1,40}[\)\s]+return\s*;\s*\$\w{1,40}[=\s]+\w{1,40}[\(\s]+\34[\(\s'"]+aHR0cDovL2Fwa[^&;]{9,99}&\w{1,40}=['"][\s\.]+urlencode[\s\(]+\$\w{1,40}[\s\)'"]+;(?<X1215010>))
\bif[\(\s]+(?:(?:(?:md|sha)\d+[\(\s@]+)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\S{2,3}\s*['"][^'"]+['"][\)\s]+\{\s*(\w+)[\s\(@]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*\w+[\s\(]+['"]https?://['"][\s\.]+\$\w{1,40}\s*\.[^\}]+\}[^\*]{0,4999}\bfunction\s*\1\s*\([^;\}]+f(?:open|ile_get_contents)\s*\([^;]+;[^\}]{0,150}\}(?<X1202510>)|(?:is_dir[\(\s'"]+wp\-(?:admin|includes|content)['"\)\s&]+){3}\{\s*(\$\w{1,40})[\s=]+base64_decode[\(\s'"]+XDE2N1wxNjBcNTVc[^'"]{9,199}['"][\s\);@]+(file_put_contents)[\s\('"]+wp\-(?:admin|includes|content)/[^'"]+\.txt['",\s]+\$\w{1,40}[\s\);@]+\4[^\?;]+<\?[ph\s]*include\(.?["']\3[^\}\w]{0,40}\}(?<X2223791>)|(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}(?:\h*\[['"]\\[^\]]+\][\s\)]+\{\s*if[\(\s]+(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[['"][^\]]+\][\s\)\{]+echo\s*bin2hex\s*\([^;]+__FILE__\s*\)[\s\)]+;[^\n]{99,}\bob_start[\(\s]+['"][^""]+['"][\);\s]+\}(?<X1254790>)|\s*\[['"]\\[^'"]+['"]\][\s\)]+\{\s*if[\(\s]+(?:isset|empty)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[['"]\\[^;]+\bbin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+__FILE__[\s\);]+\}\s*else\s*\{[^\n]{999,}unset[\(\s]+\$\w+[\);\s]+\}(?<X1235830>))|(\$\w{1,40})!=\s*['"]['"][\)\s]+\{\s*if[\(\s]+!file_exists[\(\s]+(\8[\.\s]+DIRECTORY_SEPARATOR[\.\s]+['"][^'"\$]+\.php)['"][\)\s\{]+(\$\w{1,40})[=\s@]+fopen[\(\s]+\9['",\s]+w['"\)\s;@]+fputs[\(\s]+\10[,\s]+\$\w{1,40}[\)\s;@]+fclose[\(\s]+\10[^\}]+\}\s*@?include(?:_once)?[\(\s]+\9['"][\)\s]+;(?<X2226330>)|(\$\w{1,40})[\s=@]+\$\s*\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\][^;\{\}]+\12\s*\[\s*\d+\s*\][\(\s]+\$\s*\{\s*\12\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\12\s*\[\s*\d+\s*\][\(\s]+\12\s*\[\s*\d+\s*\][\)\s]+;(?!\s*else)(?<X1212080>)|(\$\w{1,40})[\s=]+@\s*\$\s*\{\s*['"]_[GPRSC]\w{2,6}['"]\s*\}\s*\[[^\]]+\][^\$;\n]{0,40}\14\s*\[[^\]]+\][\(\s]*\$\s*\{\s*\14\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\14\s*\[\s*\d+\s*\][\(\s]+\14\s*\[\s*\d+\s*\][;\s\}\)]+(?:exit|die)\b[^;]{0,40};(?<X1211590>)|(\$\w{1,40})\s*=\s*@\$\{['"]_REQUEST['"]\}\[[^\]]+\][\)\s]*(?:&&|and)[\(\s]*\d+\s*\*\s*\d+[\)\s]*\{\s*\16\s*\[\s*\d+\s*\][\(\s]+\$\s*\{\s*\16\s*\[\s*\d+\s*\]\s*\}\s*\[\s*\d+\s*\][,\s]+\16\s*\[\s*\d+\s*\][\(\s]*\16\s*\[\s*\d+\s*\][\)\s;]+\}(?:\s*;)?(?<X1233680>)|(\$\w{1,40})\s*\[\d+\][\(\s'"]+(/etc/passwd)['"\)\s]+\{\s*\$\w{1,40}[=\s]+\18\s*\[\d+\][\(\s]+['"]\19['"][\)\s]+;[^\?]{0,999}/\.htaccess\b(?<X2226640>)|(\w{1,40})\s*\[\d+\]\s*===\s*['"](?:backconnect|bc)\.(?:perl|pl)['"]\s*&&\s*\21\.length\s*[<>=!]\s*\d+[^><;]+<ip>(?<X2218160>)|(call_user_func)[\(\s]+(\$\w{1,40})[,\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+!\23[\(\s]+\24[,\s]+\$\w{1,40}[^;]+\{\s*if[\(\s]+\23[\(\s]+\24[,\s]+\25[\)\s]+\{(?:\s*@\23[\(\s]+\$\w[^;]+;){3,}\s*@\23[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[,\s]+\d+[\s\)]+;(?:\s*\}){3}(?<X1225701>)|(file_exists)[\('"\s]+(wp\-includes)['"\)\s\{]*if[\(\s]+!\s*\27[\('"\s]+\28['"]\s*\.[^;]{1,199}\bcurl_init[^@!]{99,9999}(\$\w{1,40})[=\s]+@file_get_contents[\(\s]+\$\w{1,40}[\.\s]+['"][^'"]+\.php['"][^\*]{0,999}fputs[\(\s]+\$\w+[,\s]+\29[^!]{0,999}\bif[\s\(]+\27[\s\('"]+\28[^:;]+(?:exit|die)\b[^;]*;(?<X1252500>)|(file_exists)[\(\s]+(\$\w{1,40})[\)\s]+\{\s*if[\(\s]+\31[\(\s]+\$\w{1,40}[\)\s]+\{\s*@chmod[\(\s]+\32[,\s]+\d{3,4}[\)\s]+;\s*if[\(\s]+(md5_file)[\(\s]+\32[\)\s]+=+\s*\33[\s\(]+\$\w{1,40}[\s\)]+\{[^,]{9,199}file_put_contents[\s\(]+\32\s*,[^\?]{9,399}\btouch[\s\(]+\32[,\s]+\$\w{1,40}[\s\)]+;(?:\s*\}){3}(?<X1224500>)|(isset)[\(\s]+(\$passwd)[\)\s]+\{\s*(\$\w{1,40})[\s=]+\36[;\s]+\}\s*else(?:if[\(\s]+\35[\(\s]+(\$plaintextPassword)[\)\s]+)?\{\s*\37[\s=]+\38[;\s]+\}[^\?>]{0,999}\bif[\(\s]+strlen[\(\s]+\37[\)\s]+>\s*\d+[\)\s]+\{\s*(?:Tools::)?file_get_contents[\(\s'"]+https?://['"]\s*\.[^;]+;\s*\}(?<X1201970>)|(ndsj)===undefined[\s\)]+\{\s*(function)\s*\w{1,9}\([^=;]+\bvar\s*\w{1,9}=\w{1,9}\(\)[^\n:\?]{9,499}\bvar\s*\40=true[,\s]*HttpClient=\41\([^\+\n]+XMLHttpRequest\(\);[^\?\-\n]+\]\(\w{1,9}[^\{\n]{0,99}\41\s*(\w{1,9}[\s\(\)]+)\{\s*var\s*\w{1,9}=\[[^\]]+\][^\}]{0,40}(return)\s*\w+[;\}\s]{1,9}\43\s*\42;\}+;(?<X1197610>)|(strlen)[\(\s]+(Tools::)getValue[\('"\s]+(passw\w+)['"][\s\)]+>\s*\d+[\s\)]+\{\s*(\$\w{1,40})\s*=\s*\46getValue[\s\('"]+\47['"][\s\);]+\}[^\?]{99,999}\bif[\(\s]+\45[\(\s]+\48[\s\)]+>\d+[\s\)]+\{\s*\46?file_get_contents[\s\('"]+https?://['"]\s*\.[^;]+;\s*\}(?<X1201960>)|@(\$\w{1,40})\s*[!=]{2,3}\s*['"](\d+)['"\)\s]+\{\s*\$\w{1,40}[=\s]+['"][^'"]{1,9}['"];\s*\$\w{1,40}[\s=]+['"][a-f\d]{32}['"];\s*\$\w{1,40}[\s=]+time\(\);[^\n\*<]{999,}\bendif;\s*\50[\s=]+['"]\51['"\s;]+\}(?<X1215270>)|\$\w+\s*==+\s*(?:(\$\w+)\h*\[\d+\]\s*\.\s*\53\h*\[\d+\]\s*\.[^;]+;[^\+/\*>\n]{99,9999}\53\h*\[\d+\]\s*=>\s*\$\w+\s*,[^;\)\n\?\*]{99,9999}['"][\)\s]+;(?<X1240531>)|\$\w+\s*\[[\s\(]+int[\)\s]*ROUNd\s*\([\-\s]*\d+\s*[\+\-/\*][^;]+;\s*(?:exit|die)\b[^;]*;[^\n]{99,}\bif[\(\s]+!\s*empty[\(\s]+(\$\w+)[\)\s]*\{\s*echo\s*\55[;\s]*(?:exit|die)\b[^:]*;(?:\s*\}){4}(?<X1252560>))|\$\w\s*\S{2,3}\s*['"](?:ok|cmd|upl?)\d*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+(?:\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+;\s*(?:exit|die)\b[^;]*;\s*\}(?!\s*else)(?<X1213110>)|\$\w{1,40}==\d+[\)\s]+\{\s*(\$\w{1,40})\s*=(?:\s*chr\(9\)\s*\.){9,}\s*chr\s*\([^;]+;\s*\$\w{1,40}\s*=(?:\s*chr\(\d+\)\s*\.)+\s*chr\s*\(\s*\d+[\s\)]+;\s*(\$\w{1,40})\s*=\s*\58[^;]+;\s*echo\s*\59;\s*\}(?<X1214180>)|\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})\s*=\s*\w+[\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\61\s*==+\s*(\$\w{1,40})\s*\[[\(\s]+int[\)\s]+RoUnd[\(\s]+\d+\.\d+\s*[\+\-/\*][^\n]{99,}\62\[\(int\)roUnD\([^\)]+\)[\]\s;\)]+\}(?:\s*;)?(?<X1261380>)|\$\w{1,40}\s*!=\s*['"][a-f\d]+['"][\)\s\{]+(?:exit|die)[\(\s]+['"]\.[^;]+;(?:[^><\n]{9,999}\barray[\(\s"']+code['"]\s*=>\s*200[,\s\)]+;){2,}\s*\}\s*\}(?<X1253300>)|\$\w{1,40}\s*&&[\(\s]*\$\w{1,40}[=\s]+filesize[\(\s]+\$\w{1,40}[^;\{\}]*\{\s*(\$\w{1,40})[=\s]+filemtime[\(\s]+(\$\w{1,40})[\)\s]+;\s*(\$\w{1,40})\s*=\s*\$\w{1,40}\s*[\-\+/\*]\s*\65[^;]*;\s*\$\w{1,40}[=\s]+fopen[\(\s]+\66[,\s]+base64_decode\b[^\}]+\}\s*if[\s\(]+\67[^;\{\}]+\{[^\};]+;\s*\}(?<X1253520>)|\$\w{1,40}\s*==+\s*(?:['"]{2}[\)\s]+\{\s*@?unlink[\(\s]+__FILE__[^\}]{9,499}\bsitemap[^a-z](?<X2224591>)|\$\w{1,40}[\)\s]+\{\s*(?:\$\w+\s*=\s*(?:['"][^'"]*['"]|\$\w+|false)[\s;]*)*class\h*(\w+)\s*\{[^\*\n]{9,9999}\}\s*\$\w+\s*=\s*new\s*/\*[^\*\n/]*\*/\s*\70[\(\)\s]+;[^\}]{0,199}\}(?<X1255763>))|\$\w{1,40}\s*[^\w\s]{2,3}\s*\d+[\)\s]+\{\s*(\$\w{1,40})\s*=\s*['"]\s*<(script)>var\s*\73s\s*=\s*document\.getElementsByTagName\(['"]\73['"]\);[^\}\n]{0,199}\}[^\[]{0,499}\(['"]head['"]\)\[0\]\.appendChild\(\w+\);[\}\s]+</\73>['"]\s*;\s*(\$\w{1,40})\s*=\s*\72[^;]+;\s*echo\s*\74\s*;\s*\}(?<X1214170>)|\$\w{1,40}\s*\[\s*\d+\s*\][\(\s]+['"]/etc/passwd['"][\)\s]+\{\s*echo\s*['"][^;]+/etc/passwd(?<X2227781>))
\bif[\(\s]+(?:\$_[GPRSC]\w{2,6}(?:[\s\)]+\{\s*(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;]+(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w{1,40}[\s=]+wp_authenticate\s*\((?:\s*(?:\1|\2)[,\s\)])+;\s*(\$\w{1,40})\b[^:]{0,199}str_rot13\(['"]uggcf:/[^\}]{99,999}array_keys[\s\(]+\3[\)\s]+;[^\}]{0,99}\}\s*\}(?<X1195470>)|\[[^\]]+\][\)\s]+(?:print|echo)(?:_?\w)?[\(\s]+scandir[\(\s]+\$_REQUEST\[[^\]]+\][,\s]+\d+[\)\s]+;(?!\s*else)(?<X1235740>)|\[[^\]]+\]\s*(?:!=\s*['"][a-f\d]{16,64}['"][\)\s]+\{\s*(?:exit|die)[\s\('"]+\.?[\s'"\)]+;\s*\}\s*function\s*\w+[\(\s]+\$\w{1,40}[\)\s]+\{\s*echo\s*json_encode[\(\s]+\$\w{1,40}[\)\s]+;\s*\}(?<X2228241>)|==+\s*['"](?:[^'"]*['"][\)\s]+\{\s*(?:\$\w{1,40}[=\s]+file_get_contents[\(\s]+__DIR__[\.\s'"]+/['"\.\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\|]{0,499}\$\w{1,40}[=\s]+scandir[\(\s]+__DIR__[\)\s;]+foreach[\(\s]+\$\w{1,40}\s*as\s*(\$\w{1,40})[\)\s\{]+if[!\(\s]+\7[^!]{9,499}>\s*200(?<X2225451>)|echo[\(\s]+\$\w{1,40}[\)\s;]+if[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*\$\w{1,40}\s*/\*[^\}]+\}\s*(?:exit|die)\b[^;]*;[^><]{99,999}\becho\b[^\);]+FILE[\s\);]+(?:exit|die)\b[^;]*;\s*\}(?<X1249440>))|[^'"]+['"][\)\s\{]+@mkdir[\(\s]+(\$\w{1,40})[,\d+[\)\s;]+@chdir[\(\s]+\10[\)\s;]+(\$\w{1,40})[\s='"]+PD9[^'"]{999,}['"][\s;]+(\$\w{1,40})[\s=]+fopen[\("'\s]+index\.php['"\s,]+[wa]\+?[^\(]{1,199}fwrite[\s\(]+\12[,\s]+base64_decode[\s\(]+\11[\s\);]+fclose\(\12\);(?<X2222770>)|[^'"]+['"][\)\s]+\{\s*require[\(\s'"]+wp\-includes/regi[^;]+;\s*if[\(\s]+!username_exists[\(\s]+['"]([^'"\$]+)['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+wp_create_user[\(\s'"]+\14['"][^\}]{9,99}(\$\w{1,40})[=\s]+new\s*WP_User[\(\s]+\15[\)\s;]+\16\->set_role[\(\s'"]+administrator['"\)\s;]+wp_redirect[^;]+;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1217150>))|[^\s\(\)\{\}]{2,3}\s*['"][^'"]*['"]\s*[^\s\(\)\{\}]{2,3}\s*isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s@]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*wp_set_auth_cookie[\(\s]+\18[\)\s]+;\s*wp_redirect[\(\s'"]+/wp\-admin['"\)\s;]+(?:exit|die)\b[^;]*;\s*\}(?<X1217140>))|\h*\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{\s*@?(?:mkdir|file_put_contents)[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]*;\s*@?chmod[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+;\s+\w{1,40}\s*\(\s*[\[\{]\s*['"][^"']{1,40}['"]\s*=>\s*(?:200|['"]OK['"])\s*,\s*[\]\}]\s*\)\s*;\s*\}(?<X1194020>)|\s*\[[^\]]+\]\s*(?:==+\s*['"]upl?['"][\)\s]+\{\s*(file_)pu(t_contents)[\(\s'"]+\w{1,19}\.php['",\s]+\21ge\22[\(\s]+['"]http[^'"]+\.txt['"\)\s;]+\}(?!\s*else)(?<X1210340>)|[=]{2,3}\s*['"][^'"\$]+['"][\)\s]+\{\s*(\$\w{1,40})\s*=\s*(\$_FILES)\s*\[[^\]]+\]\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*\25\s*\[[^\]]+\]\s*\[[^\]]+\]\s*;\s*echo\s*['"]<form\b[^;]{9,499}\bform>['"]\s*;\s*@?(?:move_uploaded_file|copy)[\(\s]+\24[,\s]+\26[\)\s]+;(?<X1218010>)))|\$_GET\s*\[\s*['"]mod['"]\s*\]\s*==+\s*['"]X0X['"]\s*OR\s*\$_GET\s*\[\s*['"]mod['"]\s*\]\s*==+\s*['"]00X['"]\s*\)(?<X2047731>)|\$_POST\s*\[[^\]]+\]\s*==+\s*['"][^'"]*['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+fopen[\(\s'"]+bc\.pl['"][,\s]+['"]w\+?['"][\)\s]+;\s*if[\(\s]+fwrite[\(\s]+\29[,\s]+base64_decode\b(?<X2224580>)|\$_SERVER(?:\[(?:(\$GLOBALS\[)[^\]]+\]\[[^\]]+\][\s\(]+['"]UkVRVUVTVF9NRVRIT0Q=?['"][\)\s]+\]\D{2,9}\31[^\(]+\(['"]R0VU['"][^\}]{0,499}\31[^\(]+\(['"]Location:\$\w{1,40}['"\s\)]+;[^\}]{0,40}\}[^>]+\b(?:(?:die|exit)\s*\([^;]+;\s*)+\}[^>]{0,999}(\$\w{1,40})[\s\)]*>\d+[\s\)]+\{[^\}]+echo\s*\32;[^\}]*\}\s*\}(?<X1200920>)|['"]HTTP_USER_AGENT['"]\]\s*==+\s*['"][^'"]+['"][\)\s]+\{\s*@?eval[\(\s]+base64_decode[\(\s]+file_get_contents[\(\s]+base64_decode[\("'\s]+aHR0cHM6Ly\w{4,199}['"][\)\s]+;\s*(?:die|exit)\b[^;]*;\s*\}[\s\?>]*\Z(?<X1238830>))|\s*\[(?:['"]REQUEST_METHOD['"]\]\s*===\s*['"]POST['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+array_shift[\(\s]+\$_[GPRSC]\w{2,6}[\)\s]+;[,'"\s@]*gzinflate[\s\(]+base64_decode[\s\(]+\35[\s\)]+;\s*\$\w{1,40}[\(\);\s]*\}(?<X1210370>)|\s*(\$\w{1,40})\[\d+\](?:\s*\.\s*\37\[\d+\])+\s*\][^\n]{999,}\bheader[\s\(]+\37\[\d+\](?:\s*\.\s*\37\[\d+\])+[\s\)]+;[^>]{0,499}echo\s*\$\w{1,40}\s*;\s*\b(?:exit|die)\b[^;]*;(?:\s*\}){2,4}(?<X1223380>)))|\$shell\w{0,9}\s*[!=]{2,3}\s*\$\w{1,40}\[['"]\w+['"]\][\)\s\{@]+chmod[^:]+:\s*\$\w{1,40}[\s=\.]+\w+[\s\('"]+https?://\w{1,9}\.[^'"/]+\.(?:top|cc|bid|xyz|pl)/[^'"]+\.txt[\s'"\)]+;(?<X2218301>)|cookie\s*==\s*undefined[\)\s]+\{\s*setCookie[\(\s]+['"]\w{2}['"](?:\+['"]\w{2,3}['"]){3,}\s*,\s*true\s*,\s*\d+[\s\)]+;\s*document\.write[\s\(]+['"]<[iframe'"\+\h]{9,}[src\s'"\+]{5,}=[^:;]{0,40}:?//[^/"']+\.[a-z]{2,3}/[^\)]+\)[\s;]+\}(?<X1222110>)|count[\(\s]+(?:(\$_[GPRSC]\w{2,6})[\)\s]+==+\s*\d+\s*[\+\*/\-][^\$;=]+(\$\w{1,40})[\s=]+\41\s*;\s*if[\s\(!]+(?:empty|isset)[\s\(]+\42\s*\[[^;]+;[^\?]{9,1999}\?[^\}]{9,999}(\$\w{1,40})\s*=[^:]+\42\s*\[[^\]]+\][\s\)]+;\s*\43[\s\(\)]+;\s*\}\s*\}\s*\}(?<X1239280>)|(\$_FILES)\[[^\}]{0,40}foreach[\(\s]+\45\[[^;\{>]+as\s*\$\w{1,40}[\s=>]+(\$\w{1,40})[\)\s\{]+if[\(\s]+\46[^\};]+(\$\w{1,40})[=\s]+\45\[[^;]+;\s*(\$\w{1,40})[=\s]+\45\[[^\}]+(?:copy|move_uploaded_file)[\s\(]+\47[^;]+\48(?:[\s\);]*\}){3}(?<X1221610>)|\$_(?:[GPRSC]\w{2,6}[\)\s]*==+[^\{;]{0,40}\{\s*(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\s*;\s*if[\(\s!]+(?:(?:empty|isset)[\s\(]+)?\50\h*\[[^\}]+\}(?:\s*(?:while|shuffle)\s*\([^\}]+\})+[^\}\n]{99,999}(\$\w{1,40})\s*=\s*\$\w{1,40}[\s\(]+\50\[[^\}\n]+\51\(\)(?:[;\s]*\}){3}(?<X1238600>)|COOKIE[\)\s]*==+\s*\([^:;\{\}]+\(int\)ROuND\s*\([^\)]+\)[^:;\{\}]*:\s*(\$\w{1,40})\s*=\s*\$_COOKIE[^:;\{\}]*;[^\n]{99,}\beval\s*\([^;\)]*\53\[[^;]+;(?:\s*endif\s*;)+(?<X1251320>)))|empty[\(\s]+(?:(\$\w{1,40})[\)\s]+\|\|\s*\$\w{1,40}\s*[^\sw]{2,3}\s*200[\)\s]+\{\s*\55[=\s]+['"]https?://extsuantdiallomon\.com/[^'"]+['"][\s;]+\}(?<X1214140>)|\$_[GPRSC]\w{2,6}\[(base64_decode)[^\$;\{]+(\$\w{1,40})[\)\s]+\{\s*\58[=\s]+\58[\.\s]+\57[^;]+;\s*setcookie[\(\s]+(?:\57[\(\s]+)+['"][^\+;]+\+\d+,(?:\57[\(\s]+)+['"][^:]+;\s*echo\s*(?:\57[\(\s]+)+['"][^\$;]+\$\w{1,40}[\.\s]+(?:\57[\(\s]+)+[^\$;]+\$\w{1,40}[\.\s]+(?:\57[\(\s]+)+['"][^;]+;\s*\}(?<X1253530>))|file_exists(?:[\(\s'"]+(?:(\.htaccess)(?:['"\)\s\{@]+unlink[\(\s'"]+\60['"\)\s;\}]+(\$\w{1,40})[=\s'"]+RedirectPermanent[/\s]+h\w+://develryllc\.com[/\?'"\s;]+(\$\w{1,40})[=\s]+@?fopen[\(\s'"]+\60[^'"]*['"][,\s]+['"][aw]\+?['"][\)\s;@]+fwrite[\(\s]+\62[,\s]+\61[\)\s;@]+fclose[\(\s]+\62[\)\s;]+(?:exit|die)[^;]*;(?<X1242790>)|['"\)\s]+\{\s*unlink[^,]{1,499}\$\w{1,40}\s*=\s*fopen[\s\('"]+\60[,'"\s]+w[^;]+;[^\+]{0,499}(\$\w{1,40})[=\s]+['"]PD9[^;]+;[^\?]{0,499}\bfwrite[\(\s]+(\$\w{1,40})[,\s]+base64_decode[\(\s]+\64[\)\s;]+fclose[\(\s]+\65[\)\s;]+(?:exit|die)\b[^;]*;(?<X1247940>))|/etc/passwd['"\)\s\{]+\$\w{1,40}[=\s]+file_get_contents[\(\s'"]+/etc/passwd['"](?<X2224310>))|[\(\s]+(?:(\$\w{1,40})(?:[\)\s]+\{\s*(?:(\$\w+)\s*=\s*['"][^'"]+\.php['"];\s*(\$\w+)[=\s@]+(file_)ge(t_contents)[\(\s]+\69[\)\s;]+if[\(\s]+strpos[\(\s]+\70[,\s]+\68[\)\s]*==+\s*(?:false|true)[\)\s\{@]+unlink[\(\s]+\69[\)\s;@]+\71pu\72[\(\s]+\69[,\s]+base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+\}\s*\}(?<X1280440>)|(\$\w{1,40})[=\s]+\$\w{1,40}[\(\s]+\68[\)\s]+;\s*(\$\w{1,40})[=\s]+md5[\(\s]+\74[\)\s]+;\s*if[\s\(]+\75![^@\}]{0,499}(@chmod[\(\s]+\68)[^;]+;[^\}]{20,}\}[\s\}]*else\s*\{\s*\$\w{1,40}\s*=[^\}]+\76[^\}]+\}\s*\}(?<X1249570>))|[\.\s]+['"](\.htaccess)['"][\)\s]+\{\s*(\$\w{1,40})[=\s]+base64_encode[\(\s]+file_get_contents[\(\s]+\68[\.\s]+['"]\78['"][\)\s]+;\s*if[\(\s]+md5[\(\s]+\79[\)\s]+!=\s*md5[\(\s]+\$\w{1,40}[\)\s]+\{\s*chmod[\(\s]+\68[\.\s]+['"]\78[^=]{99,199}\$\w{1,40}[\s=]+['"]PD9(?<X2223810>))|['"](wp\-config\.php)['"][\)\s]+\{\s*\$\w{1,40}[=\s]+array[\(\s]+['"]\w+['"]\s*=>\s*base64_encode[\(\s]+file_get_contents[\(\s]+['"]\81['"][\)\s]+,[^@]{9,999}\$\w{1,40}[\s=]+['"]https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\w+\.php[^\}]{1,199}\}(?<X2211281>)))|file_put_contents[\(\s]+['"]\.\./[^'"]{1,40}\.php['"][,\s]+file_get_contents[\(\s]+["']https?://[a-z]{2,5}bin\.com?(?:/[^'"]{1,40})?/(?:raw|download)(?:\.php\?i=|/)?[^'"]{0,40}["'][\)\s]+\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}(?<X1233270>))
\bif[\(\s]+(?:fUNctIoN_eXiSTs(?:[\(\s'"]+get_magic_quotes_gpc['"][^\}]+\}[^\?]{9,9999}\bcase\s*['"]upl\w+['"][:\s]*if[\(\s]+!(?:MoVE_UPLOADeD_FIle|copy)[\(\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][,\s]+\$_FILES\s*\[[^\]]+\]\s*\[[^\]]+\][\)\s\{]+echo[\s\(]*['"][^;]+;(?<X2211961>)|[\(\s]+(?:\$_[GPSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*\$\w{1,40}[=\s]+\$_[GPSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*@\$\w{1,40}[\(\s]+\$_[GPSC]\w{2,6}\s*\[[^\]]+\][\s\);]+\}[\?>\s]*\Z(?<X1208860>)|\w+[\(\s]+['"]c3lzdGVt['"][\)\s]+\{\s*ob_start[\(\s]+[\)\s]+;\s*system[\(\s]+\$\w{1,40}[\)\s]+;[^\?]{0,9999}\bstrtoupper[\(\s]+PHP_OS[\)\s,]+\d+[,\s]+\d+[\)\s]*[=!]+\s*\w{1,40}[\(\s]+['"]\w+['"][\)\s]+\?(?<X2226590>)))|get_(?:magic_quotes_gpc[\(\)\s]+\{\s*foreach[\(\s]+(\$_POST)\s*as\s*(\$\w{1,40})\s*=>\s*\$\w{1,40}[\)\s]+\{\s*\4\s*\[\5\][=\s]+stripslashes[\(\s]+\$\w{1,40}[\);\s\}]+echo\s*['"]<!DOCTYPE\s*HTML>[^%]{0,9999}\b[s5]h[e3]l+\b(?<X2211980>)|option[\(\s'"]+coinimp_runonmobile['"][^\d'";]{1,9}['"]Disabled['"][\)\s]+\{\s*\$\w{1,40}[=\s]+str_replace[\(\s'"]+@?stopmobilemining\b(?<X2225941>))|int[\)\s]+\$_COOKIE\[[^\]]+\]\s*<\s*\d+[\)\s]+\{\s*@header[\(\s]+['"]Location:\s*https?://[^'"]{9,}['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1240300>)|is_file[\(\s]+(?:(\$\w+)[\)\s]+\{\s*\$\w{1,40}[=\s]+\$\w+\(\9[\);\s]+\}\s*else\s*\{\s*(\$\w+)=\$\w+\(['"]aHR0c[^'"]+['"][\)\s]+;\s*(\$\w+)[=\s]+\$\w+\(\10[\);\s]+if[\(\s]+trim[\(\s]+\11[\)!="'\)\(\s]+\{\s*\$\w+[\(\s]+\9[,\s]+\11[\);\s]+\}[\}\s@]*eval[\(\s]+['"]\?>['"][\.\s]+\11[\)\s]+;(?<X1273930>)|(ABSPATH)[\.\s]+['"]([^'"]+\.php)['"][\)\s]+\{\s*@?(require(?:_once)?)\s*\13[\.\s'"]+\14['"]\s*;\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=@(file_)ge(t_contents)[\(\s]+sprintf[\(\s'"]+http[^;]{9,};\s*@\16pu\17[\(\s]+\13[\.\s'"]+\14['"][,\s]+\$\w{1,40}[\)\s;@]+\15\s*\13[\.\s]+['"][^'"]*['"]\s*;\s*\}(?<X1212710>))|is_https(?:[\(\)\s]+\{\s*\$\w{1,40}[\s=]+['"]https?['"\s;\}]+else[\{\s]+(\$\w{1,40})[\s=]+['"]https?['"\s;\}]+\$\w{1,40}[\s=]+['"](?:https?|\19)://\$go_domain/\d+\.php\?[^;]+;[^\?]{9,499}\$\w{1,40}[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\?\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]:['"\s]+;[^>]{9,9999}\{(?:\s*return\s*(?:true|false)[;\s]+\}){2}(?<X1225792>)|\s*\(\)[\)\s]+\{\s*\$\w{1,40}\[['"]http['"]\][\s=]+['"]https?['"];\s*\}\s*else\s*\{\s*\$\w{1,40}\s*\[['"]http['"]\][\s=]+['"]https?['"];\s*\}\s*\$\w{1,40}\s*\[['"]smuri_tmp['"]\][\s=]+smrequest_uri\([^;]+;(?<X1204990>)))
\bif[\(\s]+isset(?:[\(\s@]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[\s=]+(\$_FILES)\s*\[[^;]+;\s*(\$\w{1,40})[\s=]+\2\s*\[[^;]+;\s*if[\(\s@]+(?:move_uploaded_file|copy)[\(\s]+(?:\3|\1)[,\s]+(?:\3|\1)[\)\s]+\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*else\s*\{\s*echo\s*['"][^'"]*['"]\s*;\s*\}\s*\}\s*\}(?<X1206720>)|[\(\s]+((\$_[GPRSC]\w{2,6}\[)[^\]]+\])[,\s]+(\6[^\]]+\])[\)\s]+\{\s*if[\(\s]+(?:\5|\7)\D{2,3}['"][^'"]*['"][\)\s]+\{\s*try\s*\{\s*if[\(\s]+isset[\(\s]+\6[^\{]+\{\s*@?(?:eval|assert)[\(\s]+(?:\5|\7)[\)\s;]+\}(?:[^\{\}]*\{[^\}]+\})+\s*\}\s*catch\b[^;\{]+\{(?:[^\}]{0,99}\}){3}(?<X1206770>)|[\(\s]+(\$\w{1,40})\[(\$\w{1,40})\]\D{2,9}\9\[\10\]\s*[!=]+\s*['"]['"][\)\s\{]+if[\(\s]+substr[\(\s]+\10[,\s]+strpos[\(\s]+\10[,\s]+['"](wp\-(?:admin|include))['"][\)\s]*[!=]+\s*['"]\11['"][\)\s\{]+\$\w{1,40}[=\s]+str_replace[\(\s]+['"]\{#\w+\}['",\s]+index\.php\|[\w\_\-\.\|]{40,}['"]\.\9\[\10(?<X2226360>)|[\(\s]+(\$_[GPRC]\w{2,6}\s*\[[^\]]+\])[\)\s]+\{\s*if[\(\s]+md5[\(\s]+\13[^;'"]{0,9}['"][^'"\$]*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s@]+file_get_contents[\(\s]+\$_[GPRC]\w{2,6}\[[^\]]+\][\)\s]+;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}\s*\}(?!\s*else)(?<X1217120>)|[\(\s]+(\$_[GPRSC]\w{2,6})\[[^\]]+\](?:[\)\s]*&&\s*isset[\(\s]+\15\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})\s*=\s*\15\s*;\s*(\$\w{1,40})[=\s]+\d+\s*;[^!\n]{1,9999}\bif[\s\(]+!\h*\16\s*\[[^,\n]+,[^\n\}]+\16\[\d+\][\s\);]+\}\s*@?[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\17[\$\)'";]{1,3}\}(?<X1280930>)|[\)\s]+\{\s*if[\(\s]+(?:empty[\(\s]+\15\[[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+__FILE__[\s\);\}]+else[\s\{]+(\$\w{1,40})\s*=\s*filemtime\s*\([^\n]{99,}\bunset[\s\(]+\19\s*,[^;]+;\s*\}(?<X1233670>)|md5[\(\s]+\15\[[^\]]+\]\D{2,9}['"][^'"]*['"][\)\s\{]+require[\s\('"]+wp\-includes/reg[^,\}]{0,199}wp_create_user[\(\s]+['"][^'"\$]+['"](?:[,\s]+['"][^'"\$]+['"])+[^=\}]+=\s*new\s*WP_User[^=\}]{0,40}set_role[\(\s"']+administrator(?:[^\}]{1,40}\}){3}(?<X1225290>)))|[\(\s]+(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\)\s][^;\}]+(\$\w{1,40})\h*=\h*\22\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*\22\[[^\]]+\]\h*;\s*(\w{1,40})[\h\(]+(?:(?:\24|\23)[\h,\)]+)+;\s*\}\s*function\h*\25[^=\};]+=\h*wp_insert_user\h*\([^\);]+['"]role["']\h*=>\h*['"]administrator['"\h;\)]+\}(?<X1192560>)|[\(\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\](?:[\)\s\{]+if[\(\s]+md5[\(\s]+\27\s*\[[^\]]+\][^\{\};]+\{[^:]+\bif[\(\s]+isset[\(\s]+\27\s*\[[^\]]+\][\)\s\{]+(var_dump)[\(\s]+(\$\w{1,40})[\)\s;]+\29[=\s]+\w+[\(\s]+['"]https?:[^'"]+['"][\)\s;]+\28[\(\s]+\29[\)\s;]+(?:exit|die)\b[^;]*;[\}\s]*\29[^;]+\29[\)\s]+;(?<X1281860>)|[\s\)\{]+if[\(\s]+empty[\(\s]+\27\s*\[[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gzdeflate[\(\s]+file_get_contents[\(\s]+(__FILE__)[^\*\n!]{1,999}\31[,\s]+gzinflate[\(\s]+pack[^>\n<]+(\$\w+)[\)\s\{]+return\s*str_replace[\(\s'"]+<?\\[^\}]+\32[;\s\)]+\}[^\}\n]*\}(?<X1252551>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\)\s\{]+if[\(\s]+(?:\34[^\]]+\][\s=]=['"][^'"]+['"][\)\s\{]+((?:exit|die))[^;]*;[\s\}]+if[\(\s]+md5[\(\s]+\34[^\]]+\][^@\n]{9,9999}@[ir][ne][cq][lu][ui][dr]e(?:_once)?[\s\(]+stream_get_meta_data[\s\(]+(\$\w{1,40})[^;]+;\s*fclose[\s\(]+\36[\s\);]+(?:\35[^\}]{0,40}\}){2}(?<X1229660>)|empty[\(\s]+\34[^\]]+\][\)\s\{]+echo\s*bin2hex[\(\s]+gz\w+[\(\s@]+(file_)ge(t_contents)[\(\s]+__\38[^\[]{1,499}strval[\(\s]+\38pu\39[\(\s]+__\38_[,\s]+gz\w+[\(\s]+pack[\(\s]+['"][^'"]+['"][,\s]+\34[^;]+;\s*touch[^\n]{99,}ob_start\b[^\}]+\}\s*\}(?<X1229360>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[['"]sh[3e]ll['"]\])[\)\s]+\{\s*if[\s\(]+\41[^<]{99,1999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\](?<X2221161>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s&]+md5[\(\s]+\43[^\{\};]+\{\s*require(?:_once)?[\(\s]+ABSPATH[\.\s]+['"]wp\-in[^'"]+\.php['"][\)\s;]+if[\(\s]+!usern\w+[\(\s]+['"]([^'"]+)['"][\)\s\{]+\$\w{1,40}[=\s]+wp_crea\w+[\(\s'"]+\44[^>\}]+>set_role[\(\s]+['"]admin[^\}]+\}\s*e[^\}\{]+\{(?:[^\}\{]+\}){2}(?<X1280680>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+(\$\w{1,40})[=\s]+(?:['"]//['"\.\s]+\46[\s;]+(\$\w{1,40})[=\s@]+file_get_contents[\(\s;]+\47[\)\s;]+if[\(\s]+empty[\(\s]+\48[\)\s\{]+\$\w{1,40}[=\s]+(\w+)[\(\s]+\47[\)\s;\}]+\48[=\s]+str_replace[\(\s'"]+<\?php[^\{\}]{0,99}eval[\(\s]+\48[\)\s;]+function\s*\49(?<X2225850>)|\46[^:]{0,99}(?:(?:sha|md)\d+[\(\s]+)+\47[^=]{0,40}(\$\w{1,40})[\s=]+unpack\b[^;]+\51[\)\s;]+(\$\w{1,40})[\s=]+(file_)ge(t_contents)[\('"\s]+php://input[^\{\}]{0,199}\53pu\54[^;]+(\$\w{1,40})[,\s]+\52[^=]{0,199}unlink[\s\(]+\55[\s\)]+;(?<X1225330>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+try[\s\{]+if[\(\s]+\57\s*==+[^=]{0,99}if[\(\s]+(?:md5[\(\s]+)+\57[^\{\}]+\{\s*\$\w{1,40}[=\s]+sys_get_temp_dir[^@]+@file_put_contents[\(\s]+(\$\w{1,40})[^\}]+@unlink[\(\s]+\58[\)\s;]+(?:exit|die)\b[^;]*;[^"']{0,99}\becho\s*'\s*<(script)[^\n']+\59>['"];(?<X1255360>)|[\(\s]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{(?:(?:\s*print\s*['"]<[^'"]{1,40}>['"]\s*;)+\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\61[\)\s]+;(?:\s*print\s*['"]<[^'"]{1,40}>['"]\s*;)*\s*\}(?!\s*else)(?<X1218680>)|\s*(\$\w{1,40})[@=\s]+[peas](?:assthru|ystem|xec|hell_exec|open)[\(\s]+\61[\.\s]+['"][^'"]+['"][,\s'"]+r['"\)\s;]+(\$\w{1,40})[=\s]+fread[\(\s]+\63[,\s]+\d+[\)\s;]+echo\s*\64[^\}=]{0,40}close[\(\s]+\63[\)\s;]+\}(?!\s*else)(?<X1215160>)|\s*switch[\(\s]+\61[\)\s]+\{\s*case\s*['"][^'"\$]+['"]:\s*(\$\w{1,40})[=\s]+(\$\w{1,40})\s*;\s*\67[=\s]+str_replace[\(\s]+['"]\W{1,3}index\.php[^\$]+\67[^\}]+file_put_contents[\(\s]+['"]css/\.htaccess['"][,\s]+\66[^=]{1,499}\bbreak;(?:\s*\}){2}(?<X1221640>))|[\(\s]+(\$_[GPRSC]\w{2,6}\[base64)[^\]]+\][\)\s\{]+(\$\w{1,40})[\s=]+\69[^\]]+\][\s;]+\$\w{1,40}[\s=]+\69[^\]]+\][\s;]+(\$\w{1,40})[=\s@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+['"][^'"]*['"][\)\s;]+if[\(\s]+preg_match[\(\s'"/]+\70['"/,\s]+\71[\)\s]+\{(?<X2221550>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\s*=\s*['"]https?://(?:pornhubfox|box\.fingerling)\.[a-z]{2,6}/[^;]+;\s*if[\s\(]+chref[\s\(]+\$[^;\{]+\73[\s\)]+\{[^;]+\74[\s\)]+;[^\}]{0,40}\}[^\}:]{0,499}(\$\w{1,40})[\s=]+str_replace[\s\('"]+https?://[^;]+\75[\s\);]+echo\s*\75;[^=\$\}]{0,40}\}(?<X1200910>)|[\(\s]+(\$_[GPRSC]\w{2,6}\s*\[\s*(\w+::\w+\s*\())\s*['"][^'"]+['"]\s*(?:,\s*['"][^'"]+['"]\s*)+\)\s*\][\s\)\{]+(?:\$\w{1,40}[=\s]+\78[^:]+;\s*)+\$\w{1,40}[=\s]+base64_decode[\s\(]+\77[^\)]+\)[\s\]\);]+file_put_contents[\s\(]+\78[^;]+;[^\}\{]*\}(?<X2253840>)|[\(\s]+(\$_GET\s*\[[^\]]+\])[\)\s]+\{(?:\s*\$\w{1,40}\s*=\s*['"]{2}\s*;)?\s*(\$\w+)\s*=\s*\80\s*;\s*\$\w+\s*=\s*["']https?://["']\.\$[Oo0]+\.['"]\.\w+\.\w+/[^\?;]+\?\w+=['"]\.\81\.[^;]+;[^\+\*\^\?]+\?['"][^;]+['"];\s*(?:exit|die)\b[^:]*;\s*\}(?<X1253950>)|[\(\s]+(\$_POST)\[[^\]]+\][\)\s]+\{\s*\$\w+\s*=\s*\83\[[^\]]+\];\s*\$\w+\s*=\s*\$\w+\s*\.\s*basename[\(\s]+(\$_FILES\[)[^;]+;\s*if[\s\(@]+(?:move_uploaded_file|copy)[\(\s]+\84[^,;]+,\s*\$\w+[\)\s]*\{\s*echo\s*basename[\(\s]+\84[^;]+;\s*\}\s*else\s*\{[^\}]*\}\s*\}(?<X1257440>)|[\(\s]+(\$_POST\s*\[\$\w+\])[\)\s]+\{\s*(\$_SESSION\s*\[\$\w+\])=trim[\(\s]+\86[\);\s]+\}\s*if[\(\s!]+empty[\(\s]+\87[\)\|\s]+\87\s*!=+\s*\$\w+[\)\s]+\{\s*echo\s*\$\w+[;\s]+(?:exit|die)\b[^;]*;\s*\}(?<X1273920>)|[\(\s]+\$\{\$_+\}\[[^\]]+\][\)\s\{]+\$\{\$_+\}\[[^\]]+\][\(\s]+\$\{\$_+\}\[\$_+\][\s,]+\$\{\$_+\}\[[^\]]+\][\);\s]+\b(?:die|exit)[\(\);\s\}]+else\s*if[\(\s]+isset[\(\s]+\$\{\$_+\}\[[^\]]+\][\)\s\{]+echo\s*\$\{\$_+\}\[[^\]]+\][\(\s]+\$\{\$_+\}\[[^\]]+\][\);\s]+(?:die|exit)\b[^\{\}]*\}(?<X1273970>))
\bif[\(\s]+isset(?:[\(\s]+\$_(?:[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRC]\w{2,6}\s*\[[^\]]+\][\)\s;\?\}>]+\Z(?<X1213280>)|[GPRSC](?!LOBALS?)\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*\$article\->text[\.\s]*=\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC](?!LOBALS?)\w{2,6}\s*\[[^\]]+\][\)\s;]+\}(?!\s*else)(?<X1210292>)|[GPRSC]\w{2,6}\[(\w+::\w+)[\s\(]+['"][^'"\$]+['"](?:[\s,\.]+["'][^'"]+['"])+[^\{]{9,199}\{\s*\$\w{1,40}[\s=]+null;[^\}]{9,999}case\s*\3[\s\(]+['"][^'"]+['"][^:;]+:\s*\$\w{1,40}\->\w+[\s\(]+__FILE__[\s\);]+(\$\w{1,40})[^\}]{0,99}\}\s*(?:exit|die)\b[^;]*\4[^\}]{0,40}\}(?<X2223060>)|[GPRSC]\w{2,6}\[[^\]]+\](?:(?:[\s,]+\$_[GPRSCF]\w{2,6}\[[^\]]+\])?[\)\s]+echo\s*['"][^;\(]+\((?:file_put_contents|move_uploaded_file|copy|unlink)[\(\s]+\$_[GPRSCF]\w{2,6}\[[^;/]+['"]/['"][^;\$]+\$_[GPRSCF]\w{2,6}\[[^\[;]{0,40}(?:\[[^\]]+\][\)\s]*)?\?['"][^'"]+['"]:['"][^'"]+['"][^;]*;(?<X1211420>)|[\)\s\{+\$'"]+GLOBALS['"]\}\[[^\]]+\][\(\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^;]*;[\}\s]+if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s\{]+if[^;]+\$\{['"]_GET['"\}\[]+sitem\w*['"][^\?]{99,}header[\(\s]+\$\w{1,40}[\)\s;\}]+echo\s*\$\w{1,40}[;\s]+(?:exit|die)[^\}]*\}(?<X1248550>)|[\)\s]*(?:&&|==+)[\(\s]*md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*(?:&&|==+)\s*['"][^'"]*['"][\)\s]+echo\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:raw)?urldecode[\(\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?!\s*else)(?<X1217160>)|[\)\s]+\{[^=]{0,40}(?:(\$\w{1,40})[=\s]+['"][\w@\.]+['"][\s;]+){3}if[\(\s!]+(user)name_exists[\(\s]+\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[=\s]+wp_create_\10\b[^;]+\9[^;]+;\s*(\$\w{1,40})[=\s]+new\s*WP_\10[\(\s]+\11[\)\s;]+\12\->set_role[\(\s]+['"]admini[^\}]+\}\s*\}(?<X1202170>)|[\)\s]+\{\s*(\$\w{1,40})[=\s]+(?:(\$_FILES\[)[^\]]+\]\[[^\]]+\][;\s]+(\$\w{1,40})[=\s]+\15[^\]]+\]\[[^\]]+\][;\s]+(\$\w{1,40})[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}\{]{0,499}\b(?:move_uploaded_file|copy)[\(\s]+(?:(?:\14|\16|\17)[^;]{0,99}){2};\h*echo\s*['"]<script[^\}]{0,99}\}(?<X2262461>)|array[\(\s]+(?:['"][\da-z/\+=]{3,66}['"][,\s\)]+){9,};\s*(\$\w{1,40})[=\s]+array[\(\s]+(?:['"]\w['"][,\s\)]+)+;(?:\s*(\$\w{1,40})[=\s]+\19\[\d+\](?:\s*\.\s*\19\[\d+\])+\s*;)+\s*eval(?:[^;]*(?:\14|\20)){2}[^;]*;\s*(?:exit|die)[^\}]*\}(?<X1247740>))|[\)\s]+\{\s*(?:(\$\w{1,9})[=\s]+strrev[\('"]+edoced_46esab[^\}]{30,999}\bcurl_setopt\(\$\w{1,9},\d{1,9},\22\(['"][^>\[/]+\bhttps?://[\s"\^.]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\.\s]+str_replace[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,'"]+\$\w{1,9}[\);\}]+exit;\}(?<X1255721>)|(function)\s*(\w{1,40})[\(\s]+(\$\w{1,40})[^\}\-]+preg_split[\(/'",\s]+\26[,\s]+\-\d+[,\s]+\d[^\?]{9,999}(\$\w{1,40})[\s=]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,40})[\s=]+\25[^;]+\27[\s\);]+(\$\w{1,40})[\s=]+create_\24[^;]+\28[\s\);@]+\29[\(\);\s]+\}(?<X1212610>)|\$\{\$\{['"]\\[GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[=\s]+\$_FILES\[[^;]+;\s*(\$\w{1,40})\s*=\s*['"][^"']{9,}['"]\s*;\s*\$\{\31\}\s*=\s*\$_FILES\[[^;]+;[^\n]{99,}shell_exec[\(\s]+['"]\$\w+['"][\)\s]+;\s*echo\s*['"][^;]+;(?:\s*\}){3}(?<X1240290>)|echo(?:\b[^;\.]+\.\s*php_uname\s*\(\)[^;]*;(?:[^@]{0,999}\bif[\(\s]+@(?:copy|move_uploaded_file)[\(\s]+\$_FILES(?:\s*\[[^\]]+\])+[,\s]+\$\w{1,40}[\)\s]+\{)+[^,]+(\$\w{1,40})\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\][\s;@]*fwrite\s*\([^;]+\33[\s\);]+\}\s*\}(?<X1205560>)|\s*['"]<form[^;]+;\s*(\$\w{1,40})[\s=]+["'][^'"]{1,40}\.zip['"]\s*;\s*(\$\w{1,40})[\s=]+new\s+ZipArchive;\s*if[\s\(]+\36\->open[\s\('"]+\35['"\)\s]+\{[^\-]+\36\->extractTo[\(\s]+\$\w{1,40}[\)\s]+;[^\}]{1,40}\}\s*else\s*\{\s*echo\b[^;]{1,40};\s*\}(?<X1206710>)|\s*['"]<form\s*method=['"]post['"][^\}@]+if[\s\(]+@(?:copy|move_uploaded_file)[\s\(]+(?:\$_FILES(?:\[[^\]]+\])+[,\s\)]+)+\{\s*(\$\w{1,40})[\s=]+new\s*ZipArchive;\s*if[\s\(]+\38\-[^\}]+\}(?:\s*else\s*\{\s*ech[^;]+;[\s\}]+)+\b(?:exit|die)[^\}]*\}(?<X1209020>))|if[\(\s]+!(?:\s*isset[\(\s]+\$GLOBALS\[[^\]]+\][\)\s]+\{\s*@?var_dump[\(\s]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;\s*\$\w{1,40}[=\s]+(?:True|1)\s*;\s*\}\s*\}(?<X1232510>)|isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*echo\s*['"]<form\b[^\}]+\}\s*else\s*\{\s*(\$\w{1,40})[=\s]+(\$_[GPRSC]\w{2,6})\[[^\]]+\][\s;]+(\$\w{1,40})[=\s]+\42\[[^\]]+\][\s;]+fwrite[\(\s]+fopen[\(\s]+(?:(?:\41|\43)[^;\$]+){2}[\)\s;]+\}\s*\}(?<X1214820>)))|[\)\s]+echo[\(\s]+(?:['"]<pre>['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:stripcslashes[\(\s]+)?\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]+;(?!\s*else)(?<X1216820>)|[\)\s]+return\s*;\s*if[\(\s]+file_exists[\(\s]+(\$\w{1,40})[\)\s]+\{\s*\$\w{1,40}[=\s]+filemtime\s*\(\s*(\$\w{1,40})[^\}@]{0,199}@unlink[\(\s]+\47[^;,]+\46[\s\)]+;[^\|]+\|\|\s*current_user_can[\s\('"]+administrator['"]\s*\)(?<X2228370>))|[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if[\(\s]+@?(?:move_uploaded_file|copy)[\(\s]+\$_FILES\h*\[[^\]]+\][^;]+;\s*\}[^\[]{5,99}if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{[^\{\}]{0,99}if\(function_exists\(['"](?:(?:shell_)?exec|popen|system|passthru)['"][\)\s]+\{(?<X2192790>)|[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]*(?:&&|and)\s*!\h*empty[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(?:echo\s*['"][^'"]*['"][\.\s]+)?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\.\s]+(?:exit|die)\b[^;]*;\s*\}(?<X1238230>)|[\)\s]+\{\s*(?:(\$\w{1,40})[=\s]+base64_decode[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\51[\)\s;@]+(?:exit|die)\b[^;]{0,40};\s*\}(?<X1214290>)|@?phpinfo[\(\)\s]+;[^%]{9,99}<form\b[^\*]{99,999}\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+;(?<X2223200>)|date_default_timez[^;]+;\s*\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\s*\[[^\]]+\][\s=]+['"][^'"]+['"];[^/]{0,999}\b(?:move_uploaded_file|copy)[\s\(]+(?:\$\{\$\{['"][GOBALS\\x471532cf]{9,28}['"]\}\[[^\]]+\]\}[,\s]*)+\)[;\s]*\}\s*(?!else)(?<X1203420>)|echo[\s\('"]+<form\b[^;]+;[^\}]{0,499}\bif[\(\s]+move_uploaded_file[\(\s]+\$_FILES\[[^\]]+\]\s*\[\s*['"][^'"]*['"]\s*\][,\s]+\$\w{1,40}[\)\s]+\{(?:\s*\}){3}(?!\s*else)(?<X1211560>))|\D{2,9}md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][^'"]*['"][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+(?:stripcslashes|base64_decode)[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s;@]+(?:exit|die)\b[^;]{0,19};\s*\}(?!\s*else)(?<X1217530>))|[GPRSC]\w{2,6}\s*\[\s*(get_option)[\(\s]+['"]dolly\w+['"][\)\s]*\][\)\s]+\{\s*[sape](?:val|ssert|ystem|hell_exec|xec|open|roc_open|assthru)\s*\((?:\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)[\s\('"]+){0,5}\57[\(\s]+['"][^'"]*['"][\)\s]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X2206340>)|[PR](?:OST|EQUEST)\s*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+base64_decode[\(\s]+substr[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][,\s]+\d+[\)\s]+;\s*\}(?!\s*else)(?<X1217170>)|GET\[['"]m[a4]ss[_\-\s]*d[e3]f[a4]c[e3]['"]\][\s\)]+\{[^/]{0,499}\bfunction\s*mass\w*\s*\((?<X2228340>)|REQUEST\[[^\]]+\][^;]+\bstr_replace[\(\s]+\$\w+[,\s]+['"]{2}[,\s]+\$\w[^\}\{]+\b(?:die|exit)[\(\)\s;\}]+(\$\w+)[=\s]+tmpfile\(\);[^;]*\bfwrite[\(\s]+\61[,\s]+\$\w+[\);\s]+\$\w+[=\s]+stream_g\w+[\(\s]+\$\w+[\);\s]+require[\s\(]+\$\w[^:]+;\s*fclose\(\$\w+[\);\s]+\b(?:die|exit)\b[^;]*;(?<X1276810>)|SERVER\[['"]HTTP_(?:REFERER|USER_AGENT)['"]\][\)\s]+&&\s*!\h*isset[\(\s]+\$_COOKIE\[['"]dataserk['"]\][^:]{999,9999}\}\s*xser:\s*\}(?<X1192450>))|[\s\(]+(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\s\)]+(?:print|echo)[\s\(\s@]+file_put_contents[\s\(]+\64\h*\[[^\]]+\][\s,]+\64\h*\[[^\]]+\][\s\)]+;(?!\s*else)(?<X1199060>)|[\s\(]+\$_GET\[['"](\w{1,40})['"]\][\)\s]+&&\h*\$_GET\[['"]\66['"]\]\h*\S{2,3}\h*['"]([^'"]{1,40})['"]\)\s*\{\s*echo\h*['"]\67\h*online[^;]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}[^#%]{999,9999}\bgetCurl[\s\(]+\$\w+\h*,\h*['"]http://['"][^\?;]+\.php\?[^;]+;(?<X1194690>))
\bif(?:[\(\s]+(?:md5[\(\s]+(?:@\$_[GPRSC]\w{2,6}\[[^\]]+\]\D{2,9}['"][a-f\d]{32}['"][\)\s]+\{\s*(\$\w{1,40})[=\s\(]+@\$_FILES\[[^\]]+\][\)\s;]+if[\(\s]+!empty[\(\s]+\1[\)\s]+\{\s*(\$\w{1,40})[=\s\(]+\1\[[^\]]+\][\s;]+@(?:move_uploaded_file|copy)[\s\(]+\1\[[^\]]+\][\s,]+\2[\s\)]+;[^\}]{0,199}echo\s*\2[;\s]*\}\s*\}(?<X1215000>)|\$_SERVER\[['"]HTTP_USER_AGENT['"]\][\)\s]*==+\s*['"][^'"]+['"][\)\s\{]+if[\(\s]+md5[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*==+\s*['"][^'"]*['"][^:]+(\$\w{1,40})[=\s]+(file_)ge(t_contents)[\(\s]+\$_FILES\[[^\]]+\]\[[^<\?>,]{9,499}\5pu\6\b[^,;]+\.php['"][\s,]+\4(?:[^\}]{0,299}\}){3}(?<X1234820>)|trim[\(\s]+\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]*==+\s*['"][^'"]+['"][\)\s]+\{\s*(?:exit|die)\b[^;]*;\s*\}\s*\}\s*\}\s*[O_0]+[\(\s]+\$[O_0]+[\)\s]+;(?<X1231090>))|preg_match(?:[\(\s'"]+/[^,;]+/\w+['"][,\s]+\$_SERVER\s*\[\s*['"]HTTP_USER_AGENT['"]\]\s*,\s*\$\w{1,40}[^\%]{0,299}(\$\w{1,40})\s*=\s*openssl_decrypt[\s\(]+\$\w{1,40}\s*,[^\}]{9,999}\beval[\s\(]+\9[\s\)]+;(?<X2238490>)|[\(\s]+['"]/(?:(?:(?:google|bing|yahoo)\|*)+/\w{1,2}['"][,\h]+\$\w{1,40}[\)\s]+\$\w{1,40}\h*=\h*\d+\h*;\s*\$\w{1,20}\h*=\h*['"]_shaesx_['"];\s*\$\w{1,20}\h*=\h*['"]get_data_ya['"]\h*;(?<X2152921>)|[a-z\d]{1,40}/si['"][,\s]+preg_replace[^;:]+,\s*urldecode[\(\s@]+(file_get_contents[\(\s]+['"]php://input['"])[\)\s]+&&\s*!preg_match[\(\s]+['"]/\w{1,40}/\w{0,9}['"][,\s]+\12[\)\s]+\{\s*header[\(\s]+['"][^'"]*50[0123][^'"]*['"][\)\s]+;[^\{\}=]{0,99}(?:exit|die)\b[^;]*;\s*\}(?<X1225310>)))|stripos[\(\s]+\$(?:\w{1,40}[,\s'"@]+eval[\(\s]+file_get_contents[\(\s]+base64_decode['"]\D{3,9}false[\)\s]+\{\s*\$\w{1,40}[=\s\(]+(?:(?:substr|strrpos)[\(\s]+\$\w{1,40}[\(\s,]+)+['"]<\?[ph\s]*['"][\)\s;@]+chmod[\(\s]+(\$\w{1,40})\s*,[^@]{9,999}\btouch[\s\(]+\14[,\s]+\$\w{1,40}[\s\)]+;(?:\s*\}){2}(?<X1214030>)|_SERVER\[["']REQU\w+['"][\],\s]+['"][^"']+['"][\)!=\h]+false[\)\s\{]*echo[^\}\{]+;\s*@?(?:exit|die)[^\}]*\}\s*if[\(\s]+strstr[\(\s]+(\$\w+)[,\s]+['"][^'"]+['"][\)\s\{]+(\$\w+)[=\s]+explode[\(\s]+['"][^'"]+['"][,\s]+\16[\)\s;]+if[\(\s]+\17[^><]{0,999}\becho\s*\$(?:[^\}]{0,99}\}){3}(?<X1256090>))|strlen[\(\s]+\$_(?:GET|POST|REQUEST)\s*\[[^\]]+\][\)\s]+>\s*\d+[\)\s]+\{\s*@?eval[\(\s]+(?:(?:raw)?urldecode[\(\s]+)?base64_decode[\(\s]+\$_(?:GET|POST|REQUEST)\s*\[[^\]]+\][\s\);]+\}(?!\s*else)(?<X1217490>)|strpos(?:[\(\s'"]+\w{1,2}['",\s]+ping(sitemap)['"\)\s!=]+(?:false|true)[\)\s\{]+(\$\w{1,40})[=\s]+explode[\('",\s]+\w+[\(\s'"/]+\20[^'"]*['"][,\s]+(\$\w{1,40})[\)\s;]+foreach[\s(]+\21\s*as[^>]+?echo\s*\$[^/]{0,199}(\$\w{1,40})[=\s]+\w+[\(\s'"]+/['",\s]+\22[\)\s;]+if[\(\s]+\23[\)\s\{]+(?:exit|die)[^\}]+\}(?<X1243530>)|[\(\s]+\$\w{1,40}(?:[,\s]+\$\w{1,40}[\)\s]+==+\s*true[\)\s]+\{\s*\$\w{1,40}\s*=\s*['"]https?://\w+\.[^'"]+\.icu['"]\s*;[^@]{0,9999}@\$_SERVER\[['"]HTTP_REFERER['"]\];[^\}]{0,499}\becho\s*['"]<script>location\.href[^/;]+['"]</script>['"]\s*;\s*(?:exit|die)\b[^;]*;\s*\}\s*\}(?<X1240120>)|[\s,]+['"]baidu['"][^\|]{0,19}\|[^;]+;[^:]{0,99}://['"\s\.]+\$_(SERVER)\[['"]\26_NAME['"]\][^;]*;[^\.]{0,99}\$\w{1,40}[\s=]+(base64_decode)[\s\(]*['"]aHR[^\.;]+\.\s*\27[\s\(]+['"][^;]+;\s*(\$\w{1,40})[\s=]+(curl_)init[^=]*(\$\w{1,40})[\s=]+\29exec\s*\(\28\);[^=]{0,40}echo\s*\30;(?<X1201990>)))|strstr[\(\s]+(\$\w{1,40})[,\s]+['"]\.?/?wp\-(?:admin|includes)['"\)\s]+\|\|\s*strstr[\(\s]+\32[,\s]+['"]\.?/?wp\-(?:admin|includes)['"\)\s]+\|\|\s*count[\(\s]+explode\s*\([^\{;\}]+\{\s*if[\s\(]+!in_array[\s\(]+\32[^;]+@unlink[\(\s]+\32[^\*]{9,999}if[\(\s]+\$\w+>=[\(\s]+\$\w+[\-\+]\d+\*[^\}]+\}\s*\}(?<X1255600>)|substr[\(\s]+(\$\w{1,40})[,\s]+\-\d+[\)\s]*==+\s*['"]\.xml['"\)\s]+\{\s*sitemap[\w\(\s]+\$\w{1,40}[,\s]+\$\w{1,40}[,\s]+\34[,\s]+\$\w{1,40}[\)\s;]+(?:exit|die)[^;]*;[^\*]{0,9999}\bif[\(\s]+preg_match[\(\s]+['"]/[^;=]{9,9999}\$\w{1,40}[=\s]+\$\w{1,40}[^;\?]+\.php\?[^\}]+(?:exit|die)[^\}]*\}\s*\}(?<X1248410>)|trim[\(\s]+\$\w{1,40}\s*\[\d+\][\)\s]*!=\s*['"][^'"]*['"]&&!is_dir[\(\s]+trim\s*\(\s*(\$\w{1,40})\s*\[\d+\][\s\)]+\{\s*mkdir[\s\(]+trim\s*\(\s*\36\s*\[\d+\][\s\)]+;\s*\}\s*\$\w{1,40}\s*=\s*sprintf[\s\(]+(?:\$\w{1,40}\s*,\s*)+urlencode\s*\([^\.]+file_put_contents\(trim\(\36\[[^\]]+\]\)\.[^\}]{0,99}\}(?<X1217700>)|typeof(?:\h*(\w+)\s*==+\s*undefined\s*\)\s*\{[\(\s]*function\s*\([^\)]+\)\s*\{\s*var\s*_0x[^\*!]{99,1999}\bwhile[\(\s]+!!\[\][\)\s]+\{\s*try\s*\{[^!]+\bvar\s*\38\s*=\s*!!\[\][,\s]+HttpClient\s*=[^/<>\-]+\breturn\b\s*\w+\s*\[[^;\-]+\-\w+[^;]*;\s*\}\s*\}\s*\([\)\s]+;\s*\}(?<X1266260>)|\s*(?:nd|zq)\w{2}(?:==+(?:['"]|&quot;)undefined(?:['"]|&quot;)[\h\)\{\(]+function\h+\w\(\)\{var\h+(\w)=\[[^\]]+\];\w=function\(\)\{return\h+\40\}[^!\n]{0,999}\bwhile\(!!\[\]\)\{[^&\n]{9,999}&&[^><\|\?%\*\n]{9,9999}!==\-[01]x\d+\}\}\(\)\)\};(?<X1274980>)|\s*==+\s*(?:['"]|&quot;)undefined(?:['"]|&quot;)[\s\)\{\(]+function[\h\(]+\w+[\h\(\)]+\{\s*var\s*\w+\s*=\s*\[['"][^\]]{40,}\];[^\\<>]{99,11999}\}\s*\}\s*\(\)\);\s*\}(?<X1266161>))|\s*(ndsj)===['"]undefined["'][\s\)]+\{\s*(function)\s*(\w{1,9})[\(\)\{\s]+var\s*\w{1,9}\s*=\s*\[[^]]+\];[^:]{9,99}return\s*\45[\(\)\s]+;[^\n\?]{9,1999}\bvar\s*\43=!!\[\][,\s]*HttpClient=\44\([^\+\n]+XMLHttpRequest[^>\n]{9,8999}(?:\}\}|\)\));\};(?<X1254450>)|\s*ndsw\s*==+\s*['"]undefined['"\)\s]*\{[\s\(]*(function)[\(\s]+\w+[,\s]+\w+[\)\s\{]+var\s*\w+[\s=]+\{[^\}]+\}[^;]+;\s*while[\s\(]+!!\[\][\)\s\{]+try[\s\{]+var\s*\w+[\s=]+parseI[^;]+;\s*if[^,\{]+\{[^\?\n]{99,}\?[^\]\n]+\];\s*(\w+)[=\s]+\47[\(\)\s\{]+(return)\s*\w+[\}\s;]+\49\s*\48[^\}]*\}\s*\}(?<X1253550>))|version_compare[\(\s]+PHP_VERSION[,\s]+['"][\d\.]+['"][,\s]+['"][<>=]+['"][\)\s\{]+error_reporting[\(\s]+(?:E_\w+[\^\(\s\|\)]+){9,};[\s\}]+(\$\w{1,40})[=\s]+str_ireplace[\(\s]+['"]\w+['",\s]+\$\w{1,40}[\)\s;]+(\$\w{1,40})[=\s]+['"]Lyp[^'"]{9999,}['"][\s;]+(?:eval|assert)[\(\s]+\51[\(\s]+\52[\)\s]+;(?<X1229341>)|window\.location\.href\.includes[\(\s]+atob[\(\s]+['"]Y2hlY2tvd[^'"]*['"][\)\s]+\{\s*let\s*\w{1,40}[\s=]+(document\.)createElement\(['"]script['"]\);[^\{\}\(\)]+\b(\w+)\.async[=\s]+!\d+[,\s]+\55\.src[=\s]+atob\(['"]aHR0c[^;,]+,\s*\54[^!]+\.getElementById\(['"]\w+!['"]\)\.remove\(\),[^\}]*\}(?:\s*;)?(?<X1271970>))|[\h\(!]+(function)_exists[\('"]+([^'"]+)['"\)]+\s*\{\s*\57\h+\58\h*\([^\}://]{99,400}(\$\w{1,20})[\h=]+[^;]{0,9}\bwp_authenticate\([^\)]+\);\s*if\h*\(isset\h*\(\59\[[^\]]+\]\[['"]administrator['"]\]\)\)\s*\{[^\?:/]{0,999}\$\w{1,20}[\h=]+['"]https?://[^\}]{99,300}(?:\s*\})+;?\s*add_action[\h\(]+[^,]+[,'"\h]+\58[^\)]+\);\s*\}(?<X1189823>)|[\h\(]+!(function)(?:(_exists)[\h\(]+['"]([\w\-]{1,40})['"][\)\s]+\{\s*\61\h*\63\h*\(\)[\s\{]+\$\w{1,40}[\h=]+['"][a-f\d]{32}['"];\s*if[\h\(!]+array_key\62[\h\(]+md5[\h\(]+(\$_SERVER)[^,;\h]+,(\$_POST)[^\?]{9,99}(\$\w{1,40})\h*=[^;]+\65\[md5[\h\(]+\64[^\?/\*&:]{499,999}\bserialize[\h\(]+\66[\h\)]+;(?:\s*\}){2}(?<X1177421>)|_exists(?:[\h\(]+['"](\w+)['"](?:[\h\)]+&&[^\{]+\{\s*add_action[\h\(]+['"]\w+['"]\h*,\h*['"]\68['"][\h\)]+;[^\{]+\61\h*\68\([^\}]{9,299}\bWHERE\h*1=1['"]\s*,\s*['"]WHERE[^,]+,\s*\$user_search\->[^\?]{99,1500}\bif[\h\(]+isset[\h\(]+\$_COOKIE\[[^\{]+\{\s*die[^;]*;\s*\}\s*\}(?<X1278931>)|[\s\)\{]+\61\h*(\68\(\))\s*\{[^\?]{99,999}\berror_reporting\((?:0|NULL)\);[^\?]{999,7000}\bvar_dump\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\h*\[[^#]{99,1999}\bexit;\s*\}\s*\$\w+[\h=]+\70;\s*\}(?<X1209340>))|[\h\(]['"]is_https['"][\s\)\{]+(?:\61\h*(\w+)[\h\(]+[^\)]+\)\s*\{[^\}]{9,399}\}\s*return\h*\$\w+(?:[\h\(]+[^\)]+\))?;\s*\}\s*){3}\72[\h\(]+['"][^'"]{6000,10000}['"][\h\)]+;\s*\}(?<X1235040>)))|[\h\(]+!?(?:empty\h*\(\h*\$redirect[^'"]{2,25}['"]wp\-admin/['"][^\{]{9,99}\{\s*\$\w{1,20}=['"]https?://[^/\\&]{99,700}(\$\w{1,20})=base64_decode\(['"]aHr0[^\)]{9,99}\)\.[^@\{]{9,150}\$\w{1,20}\h*=\h*@?file_get_contents\(\74\);[^,]{0,40}\bfunction\h+(\w{1,20})\([^\};]+\bcurl_init\([^\}]+\}\s*\75\(\74\);\s*\}(?<X1174291>)|isset[\h\(]+[^\{]{1,40}\{\s*(\$\w{1,20})[\h=]+\$_FILES\[[^\]]+\];\s*if[\h\(]+move_uploaded_file[\h\(]+\77\[["']tmp_name['"]\][^\{]{1,40}\)[\{\s]+echo\h*['"][^\}]{0,40}(?:(?:exit|die)[^;]{0,9};[\}\s]+){1,3}(?<X1242630>)))
\bif[\h\(]+!(?:\h*(function)_exists[\h\('"]+(\w+)['"\s\)]+\{\s*\1\h*\2[^\{]+\{\s*\$\w{1,25}[\h=]+['"][^'"]+['"];\s*(\$\w{1,25})[\h=]+strtr[\h\(]+\3[^\?]{99,300}(\$\w{1,25})[\h=]+\$_POST;\s*if[\h\(]+isset[\h\(]+\4\[[^\}]{0,400}\binclude[\h\(]+\$\w{1,25}[\h\)]+;\s*\}\s*\}(?<X1220281>)|class_exists[\h\(]+['"](\w+)['"][\s\)\{]+if[\h\(]+@function_exists[\h\(]+['"]is_user_logged_in['"][^&]{999,7000}\bif[\h\(]+substr[\h\(]+(\$\w+\[[^\]]+\])[,\h\d]+\)\W{2,4}['"]<script['"][\s\)\{]+print\h*\7;[\s\}]+setcookie\(['"]WPSESSID['"][^\?]{99,999}(\$\w+)[\h=]+new\h*\6;\s*\8\->init\(\);\s*\}(?<X1273340>)|defined\(['"]determinator['"][\)\s]+\{\s*function\s*\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+\{\s*(\$\w{1,40})[\s=]+['"]curl['"]\s*;\s*\$\w{1,40}[\s=]+\10\s*\.\s*['"]_init['"][^\n]{99,9999}\binclude_once[\s\(]+(\$\w{1,40})[\s\);]+\}[^\?\n:]{9,199}\11[,\s]+['"][htps\.:/'"]+[^;\?]+\.php\?[^;]+\)\s*;(?:\s*\}){3}(?<X1216792>)|empty\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\{\s*(\$\w{1,25})[\h=]+(base64_decode)\(['"][^'"]{999,5000}['"]\);\s*(\$\w{1,25})[\h=]+['"][^'"]+\.php['"];\s*function\h*(\w+)\(\15,\h*\13\)\s*\{[^\}]+\bfile_put_contents\(\15,\s*\13\);[^\?]{9,199}\b\16\(['"][^'"]+\.htaccess['"],\h*\14\([^\)]+[\h\)]+;\s*\}(?<X1216991>)|file_exists[\h\(]+['"](?:(/home/[^'"]{9,99}\.ph(?:tml|p))['"]\)\)\s*\{\s*(@?copy[\h\(]+['"]/home/[^'"]{9,99}['"][\h,]+['"]\18['"]\);)\s*\}\s*else\s*\{[^\{]{9,150}\{\s*@?unlink[\(\h]+['"]\18['"]\);\s*\19(?:\s*\}){1,3}(?<X1189781>)|(/tmp/\.\w+)['"][^\{]+\{\s*@?(file_)put(_contents)[\h\(]+['"]\21['"][\h,]+@?\22get\23[\h\(]+base64_decode[\h\(]+['"][^'"]{0,99}['"][\h\)]+;\s*\}\s*@?include_once[\h\(]+['"]\21['"][\h\)]+;(?<X1214370>))|function_exists[\h\(]+__NAMESPACE__[\h\.\\'"]+(\w+)['"][\h\)\{]+function\h*\25[\h\(]+\$\w+[\h\)\{]+static\h*(\$\w+)\h*=[^\?]{99,1200}\breturn\h*base64_decode[\h\(]+\26\[[^\?]{99,1900}\barray[\h\(]+\$GLOBALS\[\25[\(\)\d,\h\]]+\25[\(\)\d\h]+;[\h\}]+(?<X1260660>))
\bif[\h\(]+(?:(?:\bfile_exists[\h\(]+['"]wp\-(?:admin|content|includes)['"]\D{2,9}){3}\bfilesize\(['"](index\.php)['"]\)>\d+[\)\s]+\{[^\}\.]{0,499}\bunlink\(['"]\1['"]\);\s*\$orig_index\h*=\h*['"]<\?php\s*/\*\*\s+\*\h+Front\h+to\h+the\h+WordPress\h+application\b(?<X2176581>)|(?:md5[\h\(]+){1,5}\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+==+\h*['"]\w{32}['"][\h\)]+\{\h*@?file_put_contents\h*\([^,;]+\$_[GPCSR]\w{2,6}\[[^,;]+,\h*\w+[\h\(@]+\$_[GPCSR]\w{2,6}\[[^;]+;\h*(?:(?:echo|print(?:_r)?)\b[^;]{0,199};\h*)?\}(?<X1229730>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\)]+\)[\{\s]+(\$\w{1,20})[\h=]+['"][creat_funcio'"\.]{5,30}['"];[^\(]{1,150}(\$\w{1,20})[\h=]+@?\5[\h\(]+['"](\$\w+)['"][,\h]+[^;]{0,20}\7\);['"\s]+\);\s*\6[\h\(]+\4\);\s*\}(?<X1224130>)|(\$_POST)\b[\h\)]+\{\h*(\$\w{1,40})=\9\[[^\]]+\];(\$\w{1,40})=\9\[[^\]]+\];[^\}]+(\$\w{1,40})=wp_authenticate\(\10,\11\);\h*(\$\w{1,40})=\12\->allcaps;\h*\$\w{1,40}=\13\[['"]administrator['"][^\}]+curl_close\(\$\w{1,40}\);\h*\}\h*else[^\};\v]+file_get_c[^\$;]+\$\w{1,40}[\)\h]+;(?:\h*\}){3}(?<X1179200>)|(file)(_exists)[\h\(]+(\$\w{1,40})\h*=\h*(dirname)[\h\(]+(__\15__)[\h\)\.]+DIRECTORY_SEPARATOR[\h\)\.'"]+basename[\h\(]+\18[\h\(]+\19[\h\)\.]+['"]\.php['"][\h\)]+\D{2,3}[\h!]+class\16[\h\(]+['"]WPTemplatesOptions['"][\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\('"]{1,3}\17[\)'"]{1,3}\h*;\s*\}(?<X1155351>)|(file_)exists[\h\(]+(\$\w{1,25})[\s\)]+\{\s*(\$\w{1,25})[\h=]+\21get_contents[\h\(]+\22[\h\)]+;[^\{]{0,199}\{\s*(\$\w{1,25})[\h=]+['"][\h\*/]+['"][\h\.]+\23[^;]+;[^\}]{0,999}(\$\w{1,25})[\h=\.]+\24[\h\.]+['"]\\n['"];[^\?]{0,999}\b\21put_contents[\h\(]+\$\w{1,25},\h*gzinflate\(\23\)\.\25,[^\}]{0,50}\}(?<X1213450>)|(file_)put(_contents)[\h\(]+(\$\w+),\h*@?\27get\28[\h\(]+['"]https?://cdn\-jsdelivr\.googledv\-hostinged\.com/[^'"]+\.txt['"][\s\)\{]+include[\h\(]+\29[\h\)]+;\s*unlink[\h\(]+\29[\h\)]+;\s*\}(?<X1277280>)|(isset)[\h\(](\$act)[\h\)&]+\32\s*\D{2,3}\s*\$\w{1,40}[\h\)&]+\31[\h\(]+(\$redate_file)[\)\s]+\{\s*if[\h\(]+file_exists[\h\(]+\33[\)\s]+\{\s*echo\s*\w{1,40}\(\33\);[\s\}]+function\h*RandAbc[\h\(]+\$length\h*=\h*['"]{2}[\)\s]+\{(?<X2176730>)|\$\w{1,15}\h*==\h*['"]\.js['"]\h*\)[\s\{]+@?chmod\((\$\w{1,15})[\h,]+\d+\);\s*if[^\{]{0,99}\{\s*(\$\w{1,15})[\h=]+base64_decode\(['"][^'"]{999,4000}['"]\);[^\{]{0,299}\{\s*(\$\w{1,15})[\h=]+\36[\h\.]+\$\w{1,15};\s*@?file_put_contents[\h\(]+\35[\h,]+\37[\h\)]+;(?<X2196841>)|\$\w{1,40}\h*\S{2,3}\h*['"]{2}[\)\s]+\{\s*if[\h\(]+\$\w{1,40}[\)\h]+\{\s*(\$\w{1,40})[\h=]+['"][\./]*ht[ace]+['"][;\s]+\39[\h\.=]+['"][ace]+ss['"][;\s]+if[\h\(]+\39\D{2,9}['"]{2}[\)\s]+\{\s*@?chmod[\(\h]+\39\b[,\h]+\d+[\)\h]+;\s*(\$\w{1,40})[\h=]+(?:@?file_(?:ge|pu)t_contents\b[^;]+(?:\39|\40)\b[^\}]+?){2}\}(?:\s*\}){3}(?<X1191100>)|\$_[GPRSC]\w{2,6}\[(?:['"](backconnect)['"]\]\W{2,4}['"](?:php|ruby|perl|python)['"]\)\s*\{[^#\*]{99,700}\bfwrite[\h\(]+\$\w{1,20}[,\h]+['"][^@]{1,99}\42.{1,9}\bby\b[^<//]{99,900}\bpreg_match[\h\(]+['"]/indoxploit\b(?<X2216110>)|[^\]]+\][^\{]+\{\s*if[\h\(]+!isset[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*echo\h*['"]<form[^\?]{99,299}\b@?(?:copy|move_uploaded_file)[\h\(]+\$[^\}]{9,199}\}\s*\}(?<X1206445>)|[^\]]+\]\D{2,3}['"][^\{]{0,50}\{\s*echo\h*['"]<form[^;]{9,199};\s*@?(?:copy|move_uploaded_file)[\h\(]+\$_FILES\[['"][^\)]{0,99}\);\s*\}(?<X1227822>)|[^\]]+\]\W{2,4}['"][^'"]+['"]\)[\s\{]+(\$\w{1,20})[\h=]+file_get_contents[\h\(]+['"]https?://[^'"]{9,99}/[^'"]{1,20}\.txt['"]\);\s*@?eval[\h\(]+["']\?>['"][\h\.]+\46\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1194770>))|\w+[\(\h]+\$_FILES[\)\h]*==+\h*[01][\h\)]+\{\s*\w+[\s\(\)]+;[^;\?]+\bfile_get_contents[\s\('"]+php://input[^;]+\$_POST[^\}/]{1,999}(\$\w{1,40})\s*=\s*curl_init[\(\)\s]+;[^\}]+(\$\w+)\h*=\s*curl_exec[\s\(]+\48[^\}]+\}[^\(\)]{0,99}\beval[\(\s]+\49[\);\s]*\}(?<X1251891>)|count[\h\(]+(\$_FILES\[[^\]]+\])[\h\)]+>\h*0[\)\{\s]+\$\w{1,40}\h*=\h*@getcwd\(\);\s*@chdir\h*\(['"]/home[^'"]+/wp\-(?:includes|admin)[^'"]*['"]\);\s*isset[\h\(]+\51[\)\s]+\?[\s\(]+is(_uploaded_file)[\s\(]+(\51\[[^\]]+\])[\s\)]+\?[\h\(]+@?(?:copy|move\52)[\h\(]+\53\h*,\h*\51\[[^\]]+\][\s\)]+:[^;]{4,9};\s*\}(?<X1180361>)|empty[\h\(]+(\$\w{1,40})[\s\)]+\{\s*if[\h\(]+substr[\h\(]+trim[\h\(]+(\$_SERVER\[)['"]REMOTE_A[^;]{99,199}\belse\s*\{\s*@?error_reporting[\h\(]+0[\h\)]+;\s*@ini_set\([^@]{99,999}@stream_context_create\([^\?]{999,2999}(?:\55\[[^\]]+\][=\h]+\56[^;]+;\s*)+\55\h*=\h*trim[\h\(]+\55[\h\)]+;(?:\s*\}){2}(?<X1178130>)|file_exists[\h\(]+(?:(\$\w{1,20})[\h=]+base64_decode[\h\(]+['"][^'"]{9,150}['"]\)\)\)\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\(?['"]?\58['"]?\)?;\s*else\s*echo\h*__FILE__;(?<X1215620>)|\$png\w{1,12}[\h\)]+require_once\(['"][\./]{0,2}screen[\w\-]{0,40}\.(?:png|jpe?g|ico)['"]\);(?<X1179700>))|function_exists[\h\(]+(\$\w{1,40})[\h\)]+\{\s*\$\w{1,40}[\h=]+@\61[\h\(]+['"][^'"]*['"][\h,]+(?:\$\w{1,40}[\h\(\)]+)+;\s*if[\h\(]+\$\w{1,40}[\h\)]+@?\$\w{1,40}[\h\(=][^\}]{2,99}\}\h*else\h*\{\s*(\$\w{1,40})\h*\.?=\h*['"]\\[^\}@\v]{99,999};\h*@\$\w{1,40}[\h\(]+\62[\h\)]+;\};(?<X1187682>)|isset(?:[\(\h]+\$_(?:[GPRSC]\w{2,6}\[['"]sitemap['"]\][\h\)]+\S{2,3}\h*isset[\(\h]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\{\s*\$\w{1,40}[\h=]+['"]file['"];\h*@?header\([^\)]+\);\h*(\$\w{1,40})[\h=]+find_file_in_folders\([^\}]+\}\s*else\s*\{[^\}]+\}\s*\}\s*fclose\(\64\);\s*\}\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1181931>)|POST\[[^\]]+\][\s\)]+\{\s*if[\h\(]+is_writable[\h\(]+\$(?:w[e3]b)?r[o0]{2}t[\s\)]+\{\s*(if[\(\h]+@copy\h*\(\h*\$_FILES\[[^\]]+\]\[[^\]]+\]\h*,)[^\}]{9,499}\}\s*else\s*\{\s*echo[^;]+;(?:\s*\}){2}\s*else\s*\{\s*\66[^\}]{9,499}\}\s*else\s*\{\s*echo[^;]+;(?:\s*\}){3}(?<X2176680>))|[\h\(@]+\$_GET\s*\[[^\]]+\][\s\)\{]+(\$\w+)\s*=[@\sfile_putcons\.'"]{15,};\s*(\$\w+)\s*=[@\s'"\.file_gtcons]{15,};\s*\68[\h\(]+['"][^,]+,\h*\69[\h\(]+['"]['"\.htps:/]+[^\);]+\)[\h\)]+;\s*\}(?<X1259501>)|[\h\(]+(\$_[GPR]\w{2,6}\[[^\]]+\])[\s\)\{]+(echo)\h*['"]<(\w+)>['"];\s*\72\h*system[\h\(]+\71[\h\)]+;\s*\72\h*['"]</\73>['"];\s*\}(?<X1259780>)|[\h\(]+(\$_[GPRC]\w{2,6}\[[^\]]+\])[\h\)&]+\75[\h=]+[^\{]+\{\s*eval[\h\(]+(?:hex2bin[\h\(]+){1,2}\$_[GPRC]\w{2,6}\[[^\]]+\][\h\)]+;\s*\}(?<X1259990>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\)]+\])\)(?:[^\$]{1,15}\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\)[^,]{1,99}(\$\w{1,20})[\h=]+array\w{0,6}[\h\(]+[\h\)]+;\s*parse_str[\h\(]+base64_decode[\h\(]+\77\)[,\h]+\78\);\s*echo\h*(\78\[)\d+\][\h\(]+\79\d\][\h,]+\79\d+\]\);\s*(?:die|exit)[^;]{1,9};\s*\}(?<X1227940>)|[^_]{1,15}\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\)[^,]{1,99}\b(?:parse_str|ccontrollerclient::RunCommand)[\(\h]+hex2bin[\(\h]+str_rot13[\h\(]+\77\)[^\?]{0,20}\b(?:die|exit)[^;]{1,99};\s*\}?(?<X1227930>))|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s\{]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\h=]+trim[\h\(]\82\);[\}\s]+if[\h\(]+isset[\h\(]+\83\)\)\s*\{\s*@?eval[\h\(]+base64_decode[\h\(]+\83\)\);\s*\}(?<X1190790>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\{]{9,40}\)[\s\{]+(\$\w{1,20})=\85;\s*\86[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[\}\s]+else[\{\s]*echo\h+[^;]{9,99};(?<X1198520>)|[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)[^\{]{1,40}\{\s*if[\h\(]+!?isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\)]+)[\h\)]+\s*\89[\h=]+array\(\);\s*(\$\w{1,20})[\h=]+\88;\s*\90\h*\(\89\);\s*\}(?<X1195630>)|[\h\(]+(\$_[GPRSC]\w{2,6}\h*\[['"]\w{32}['"]\])[\h\)]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:\s*\(\s*(?:stripslashes|base64_decode|gzuncompress))+[\s\(]+\92[\)\s]+;(?<X1181901>)|[\h\(]+(\$_COOKIE)\[\d+\][^\{]+\{(\$\w+)=\94;(\$\w+)=0;[^\n\?]{0,300}\]\(\95\[\d+\][\h\)]+;\}\h*include[\h\(]+\96[\h\)]+;\h*\}(?<X1254550>)|[\h\(]+[^\{=]{2,40}[!=]{1,3}\h*['"](anons\d+)['"]\)\s*die\h*\(["']\98shellworks['"]\);[^\}\?]{9,99}@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+\$_[GPRSC]\w{2,6}\[(?<X2189530>)|[\h\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)\{]+if[\h\(]+(\$\w+)[\h=]+@?file_get_contents[\h\(]+['"]https?://[^/]+/[^'"]+\.txt['"][^\{]+\{\s*eval[\('"\?>\h\.]+\100[\h\)]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*else\s*\{[^\}]+\}\s*\}(?<X1266430>)))
\bif(?:[\h\(]+(?:md5[\(\h]+@\$_COOKIE\[[^\]]+\][\)\h]+\S{2,3}\h*['"]\w{32}['"][\h\)]+\{\s*@?error_reporting[\(\h]+(?:0|null|false|round)\b[^;]{0,19};\s*@\barray_(?:map|walk)\h*\([^;]+\)\h*;\s*\}(?<X1034211>)|preg_match(?:[\(\h]+['"]/[bajtx\h'"\.]{7,40}/i['"][\h,]+\$email[\s\)\{]+\$\w{1,40}[\h=]+Db::getInstance\(\)\-[^;]+;\s*(\$passwd)[\h=]+['"][bajtx\h'"\.]{7,40}['"];[^\}]+\}[^\(/&\{]{1,199}\bfile_get_contents\(['"][^;]+\burlencode\((\$\w+)\b[^;]{0,99};(?:\s*\2[\h=]+null;|\s*mail\([^;]+\3\b[^;]+;)?(?<X1181502>)|[\h\(]+['"][^\$;\{\}=,]{1,40},\h*\$_SERVER\h*\[\h*['"]REQUEST_URI[^\}]{0,499}\bfunction\h+(\w{1,40})[\h\(]+(\$\w{1,40})[^\{]{1,40}\{\s*\$\w{1,40}[\h=]+@?file_get_contents[\h\(]+\6[^\?]{999,9999}\{\s*(\$\w{1,40})[\h=]+\5[\h\(]+['"]https?:[^;]+;[^\}]+echo\h+\7;(?:[^\}]{0,99}\}){2,3}(?<X1174180>)))|[\h\(]isset[\h\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)[\{\s]+(echo)\h*['"]<[^\.]{1,9}\.(\$\w{1,20})[\h=]+\(\9\);\s*\10\h*`\11`\.['"]<[^>]+>['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1212990>)|[\s\(!]+isset[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]*&&[^\{]{9,99}\{\s*\$\w{1,20}\s*=\s*['"]wp[_-]vcd['"];\s*switch\s*\(\s*\13[\)\s]*\{[^%]{400,4000}(?:\}\s*){3}break;\s*default\s*:\s*print\s*['"]ERROR_WP_ACTION\s+WP_V_CD\s+WP_CD['"];\s*\}\s*(?:die|exit)\b[^;]{0,40};\s*\}(?<X1131262>)|[\s\(]*(\$_POST)[\s\)]*\{(?:\s*(\$\w{1,40})\s*=\s*\15\[[^\]]+\]\s*;)+\s*\$\w{1,40}[\s=]+wp_aut[^;]+\16[^;]*;\s*(\$\w{1,40})\b[^;]*;\s*if[\s\(!]+empty[\s\(]+\17[\s\)]+\{\s*\$\w{1,40}[\s=]+curl_ini[^;]*;(?:\s*(\$\w{1,40})[\s=]+str_rot13\b[^;]+;)+\s*\$\w{1,40}\s*=[^;]*\18[^;]*;[^\}]*curl_close[^;]*;\s*\}\s*\}(?<X1201400>)|[\s\(]+!(?:(file_)exists[\s\(]+['"](/tmp/[^'"/]{1,40})['"][\s\)]+\{\s*@?\20pu(t_contents)[\s\(]+['"]\21['"][\s,]+\20ge\22[\s\(]+base64_decode[\s\(]+['"]aHR0[^'"]{1,199}['"][\s\)]+;\s*\}\s*@?include(?:_once)?[\s\(]+['"]\21['"][\s\)]+;(?<X1198710>)|(function)_exists(?:[\(\s]+['"](\w+)['"][\)\s\{]+\24\s*\25(?:[\(\)\s\{]+\$\w+[=\s]+\$_SERVER\[['"]SER[^\]]+\];\s*\$\w+[=\s]+['"]127[\.01]+['"][^\n>\?:]{9,}curl_setopt[^;\{\}]+['"]https?://['"](?:[\s\.]+\$cl\d+ip[\.\s]+['"]/?['"])+\s*\.[^\n>]{9,}header[\('"\w:\s]+404\s*Not\s*Found['"\)\s;\}]+else[\s\{]+\}(?<X1262400>)|[^\$]+\$_SERVER\[[^\]]+\][^\n>\?:]{9,}curl_setopt[^;\{\}]+['"]https?://['"](?:[\s\.]+\$cl\d+ip[\.\s]+['"]/?['"])+\s*\.[^\n>]{9,}\bheader[^;]+404\s*Not\s*Found[^\}]{1,99}\}\s*else[^\}]+\}(?<X1262410>))|[\s\('"]+(\w+)[\)'"\s\{]+\24\s+\28[\s\(\)\{]+(?:[^;=\(]+=\s*(call_user_func(?:_array)?\s*\()[^;]{1,99};){2}[^\?]{1,499}(?:=\s*\29[^;]{1,199};[^=;\(\}]{0,19}){5}[^\?]{1,299}\b(?:die|exit)[\s\(]+\29[^;]{99,};[\s\}]+\28[\s\(\)]+;\s*\}(?<X1193600>))))
\bif[\s\(]+(?:!?username_exists[\s\(]+['"]([^'"]+)['"][^;\{]+\{\s*(\$\w+)[\s=]+get(_user)_by\s*\([^,\)]+,\s*['"]\1['"][^\}]+\2(\s*\->\s*set_role[\s\(]+['"]administrator['"][^;]+;)[\s\}]+else[\s\{]+(\$\w+)[\s=]+wp_create\3[\s\(]+['"]\1['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP\3[\s\(]+\5[\s\)]+;\s*\6\4\s*\}(?<X1207630>)|!\h*class_exists[\(\s]+['"](\w{1,40})['"\)\s]+\{\s*if[\s\(]+@function_exists[\('"\s]+(is_user_logged_in)['"\)\s]+\{\s*if[\s\(]+\9[\(\)\s]+\{[^<]{99,}<\s*script['"][^>]{1,9999}\->cookie[^=]+(\$\w+)\s*=\s*new\s*\8;\s*\10\->\w+[\(\);\s]+\}(?<X1281270>)|!\h*file_exists[\s\(]+(['"][^'"]+\.txt['"])[\)\s]+\{\s*(\$\w{1,40})[=\s]+\$\w{1,40}[\.\s]+['"]://['"][\.\s]+\$_SERVER\s*\[['"]HTTP_HOST['"\]\.\s]+/\w+['"][\s;]+(\$\w{1,40})[=\s]+(file_get_contents)[\s\(]+\13[\s\);]+if[\s\(]+empty[\s\(]+\14[\s\)]+\{\s*\$\w{1,40}[=\s]+curl_i[^!]+\15[\s\(]+\12[\s\);]+\}(?<X1283410>)|!\w+\([\)\s\{]+var\s*(\w{1,40})[=\s]+\w+[\s\(]+['"]\w['"](?:[\h\+]+['"]\w['"])+[\)\s;]+if[\s\(]+\17[\s=]+undefined[\)\s\{]+setCookie[\s\(]+['"]\w['"](?:[\h\+]+['"]\w['"])+[,\s]+\w[^;]+;\s*document\.write[\(\s'"]+<[iframe'"\+]{6,}\s+[src'"\+]{3,}=[^;:>]*http://[^<\-]+\-\d{4,}p[xt];[^/<]+<[^\}]+\}\s*\}(?<X1263611>)|!class_exists[\(\s]+['"](?:([^'"]{1,40})['"][\)\s]+\{\s*if[\s\(]+function_exists[\(\s]+['"]is_user_logged_in['"][\)\s]+\{[^\176]{9,9999}if[\(\s]+@preg_match[\(\s]+['"]\176[^\\]{9,4999}(\$\w{1,40})\s*=\s*new\s*\19;\s*\20\->init[\s\(]+\$\w+[,\s]+\$\w+[\s\);]+\}(?<X1271940>)|(\w+)['"][\)\s\{]+if[\s\(]+@(function_exists)[\(\s]+['"](is_user_logged_in)['"\)\s]*\{\s*if[\s\(]+\24[^#]{1,999}\$\w+[=\s'"]+#\(\w+\|[^>]+\bif[\(\s]+!@\23[\(\s'"]+getallheaders['"\)\s]+\{[^\\]+\bclass\s*\22[^;]+\$\w+[=\s]+['"]\\[^\*]+=\.\*\?[^!]+\22;\s*\$\w+\->\w+[\(\);\s]+\}(?<X1279000>))|!empty(?:[\(\s]+\$_REQUEST\s*\[['"][^'"]+['"]\][\)\s]*\|\|\s*!empty\(\$_REQUEST\s*\[['"][^'"]+['"]\][\)\s]*\|\|[^;]+\btrim[\(\s]+ini_get[\(\s]+['"]disable_functions['"]\)+;\s*\}[^\n]{99,}\bfile_put_contents[\(\s]+\$_REQUEST\s*\[[^;\n]+;[^\}]+\b(?:exit|die)\b[^;]*;\s*\}(?<X1264610>)|[\s\(]+(\$_POST\s*\[[^\]]+\])[\)\s]+\{\s*\$\w{1,40}\s*=\s*array[\s\(]+(?:['"](?:(shell_exec)|exec|system|popen|passthru|proc_open)['"][\s,\)]+){4,};\s*\$\w{1,40}[=\s]+ini_get[\(\s'"]+disable_functions[^\[]{1,999}\28[\s\(]+\27[^<>]+while[\(\s]+!feof[\(\s]+\$[^;]+;\s*\}[^\}\{]{0,99}\}\s*\}(?<X1255150>))|!isset[\s\(]+((\$roles\[)['"]\w+['"]\])[\s\)\|]+!NUMBER\D{0,9}\30[\s\)]+\{\s*function[^=@]{0,99}\}\s*else[\s\{]+switch[\s\(]\31['"]\w+['"]\][\s\)]+\{\s*case\h*['"]\w+['"]:\s*echo[\h\(@]+serialize[^;]+phpversion\([^\}]+@eval[\h\(]+\31['"]\w+['"]\][\s\)]+;[^\}]{0,40}\}\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1191250>)|(?:(?:sha|md)[12456]{1,3}[\s\(]+){2,}\$\w{1,40}\D{2,9}['"][^'"]{32,64}['"][\s\)]+\{\s*(\$\w{1,40})\s*=(?:\s*isset)?[\s\(]*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;]*;\s*(?:if[\s!@\(]+(?:isset|empty)[\s\(]+\33[^;]+;[\s\}]+)?@?[sae](?:ystem|xec|open|val|ssert)[\s\(]+\33[\s\);]+(?:die|exit)\b[^;]{0,19};\s*\}(?<X1201391>)|(?:md5[\s\(]+)+\$_[GPCSR]\w{2,6}\[[^;\{]{1,199}\{\s*@?\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\([^\)]*\$_[GPSRC]\w{2,6}\[[^;]+;\s*@?(?:die|exit)\b[^;]*;\s*\}(?<X1207430>)|(?:md5[\s\(]+){2,}\$\w{1,40}[\s\)]+\S{2,3}\s*['"]\w{32,}['"][\s\)]+\{\s*(\$\w{1,40})\s*=\s*(?:isset[\s\(]+)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]*;[^@>]{0,499}(\$\w{1,40})\s*=\s*base64_decode[\s\(]+\36[\s\)]+;\s*@?eval[\s\(]+\37[\s\)]+;[^\}=]{0,40}\}(?<X1200850>)|(?:md5[\s\(]+){2,}getenv[\s\(]+['"]HTTP_USER_AGENT['"][\s\)]+\S{2,3}\s*['"][^'"]{32,}['"][\s\)]+\{\s*@?chmod[\(\s]+['"](\.htaccess)['"][\s,]+\d+[\s\);@]+unlink[\s\(]+['"]\39['"\s\);@]+file_put_contents[\s\(]+['"][^'"]+\.php['"][\s,]+base64_decode[\(\s]+['"]PD9[^'"]+['"][\s\);]+(?:die|exit)\b[^;]{0,19};\s*\}(?<X1200840>)|\!function_exists[\(\\\s]+['"]\w{1,40}\\?['"][^\{\};]*\{\s*try[^\n@/:]{9,999}if[\s\(]+(?:\$[a-z\d]+[\s\(]+){2,}\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s=\\]+['"][a-f\d]{32}[^:<@]{1,999}@\$\w[^:<]{1,999}<(script>)[^:<]{0,9999}</\41[\\'";\}\s]+add_action\(\\?['"]wp_[hf][^\}]+\}[\}\s]+catch\s*\([^\}]+\}\s*\}(?<X1264903>)|\$\w{1,40}\s*==+\s*(?:(\$\w{1,40})\[\(\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^;]+;\s*(?:exit|die)\b[^;]*;[\s\{\}]*if[\(\s]+\$\w{1,40}\s*==\s*\$\w{1,40}\s*\[[\(\s]+int[\)\s]+rounD[\(\s]+\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^\n]{99,}\43\[[\(\s]+int[\)\s]+rounD[\(\s]+\d+(?:\.\d+)?\s*(?:[\+\-]\s*)+\s*\d[^;]+;(?<X1260630>)|\$\w{1,40}\)\{\s*function\s*(\w+)[\s\(\)]+\{\s*\$\w+\s*=\s*new\s*/\*[^\*]*\*/\s*\w+\s*\([^\*\n]+\bbase64_decode\(md5\(\$\w+\[\w[^\}]+\}\s*\}[^\}]+\}\s*\45[\s\(\);]+\}(?<X1280920>))|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\]\s*\S{2,3}\s*\$GLOBALS\[[^\]]+\]\[[^\]]+\][\)\s]+\{\s*function\h*hide_plugins\h*\((?<X2196501>)|\s*\[['"]vf[^\]]{2,9}\]\s*\S{2,3}\s*['"]online\d+['"\)\s]+\{\s*echo\b[^;:]+https?://[^;:/]+\.(?:top|xyz|ga)/[^;:\?]+\?domain[^;:\?]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1196700>)|\s*\[[^\]]+\]\D{2,9}['"][^'"]{1,40}['"][\s\)]+\{\s*\$\w{1,40}\[[^\]]+\][\s=]+['"]post['"\s;]+\$\w{1,40}\[[^\]]+\][\s=]+['"]page\w*['"];[^\{\},]{0,199}(?:\$\w{1,40}[\s=]+@?\w{1,40}[\s\(]+['"][^'"]{1,99}['"][\s\)]+;\s*)+\$\w{1,40}[\s=]+curl_init\s*\(\);[^!]+if[\(\s]+!empty(?:[^\}]{0,499}\}){3}(?<X1198310>))|\d+\s*[\*\-\+]\s*\d+[\)\s]+ANd[\(\s]+(\$\w{1,40})\s*=\s*@\s*\$\s*\{\s*['"]\\(?:x5fR|137)\\(?:x45Q|122)[^'"]{1,15}(?:T|\\x54)['"]\}\s*\[['"][^'"]+['"]\][\s\)]+\{\s*\50\s*\[\d+\][\s\(]+\$\s*\{\s*\50\s*\[\s*\d+\s*\]\s*\}\s*\[\d+\][,\s]+\50\s*\[\d+\][\s\(]+\50\s*\[\s*\d+\s*\][\s\)]+;\s*\}\s*;(?<X1250731>)|current_us(?:\w+[\s\(]+(base64_decode)[\s\(]+['"][^'"]+['"][\s\)&]+!array_k\w+[\s\(]+\52[^;\)]+\)[,\s]+\$_[GPRSC]\w{2,6}[\s\)\{]+(add_action)[\s\(]+\52[^@]{99,}(\$\w{1,40})[=\s]+@dns_get_r\w+[\(\s]+\$\w{1,40}\b[^\}]+\}\s*else[^\}]+wp_red\w+[\s\(]+\54[\s\);@]+(?:exit|die)[^;]*;[\s\}]*\53[\s\(]+\52[^\}]+\}(?<X1260511>)|er_can(?:[\s\('"]+(administrator)[^=]+if[\s\(]+!(function)_exists[\s\('"]+(_?\w{1,9})[^\|@]+(\$\w{1,40})[=\s]+new\s*WP_User[^;]+;\s*\59\->set_role\(['"]\56['"]\);[^<?:]+\57\s*\58[\s\(]+[^#%]+(\$\w{1,9})[\s=]+['"]dns_[^;]+;[^;]+\60[^;]+DNS_TXT[^>?:]+add_action[^;]+\58['"][\)\s]+;\s*\}(?<X1260871>)|[\s\(]+(base64_decode)[\s\('"]+YWRtaW5pc3RyYXRvcg=*['"][^\+%#\.]{99,1399}\b\62[\s\('"]+LyhhbmRyb2lkfHdlYm9zfG[^\+%#]{99,2299}(\$\w{1,9})[\s=]+dns_get_record[\s\(]+\$\w{1,9}[\s,]+DNS_TXT[^\+%#]{9,999}\bwp_redirect[\s\(]+\63[\s\);]+(?:exit|die)[;\}\s]+add_action[\s\(]+\62[^;]+;\s*\}(?<X1257921>)))|get_magic_quotes_gpc\s*\(\)[\s\)]+\{\s*foreach[\s\(]+\$_[GPRC]\w{2,6}\s*as\s*(\$\w{1,40})\s*=>\s*\$\w{1,40}[\s\)]+\{\s*\$_POST\[\65[^;]+;\s*\}\s*\}[^\{\}]{0,999}function\s*perms[\s\(]+\$\w{1,40}[\s\)]+\{[^\?\.]{0,999}(\$\w{1,40})\s*\.=[\s\(]+\$\w{1,40}[^;\?]+\?\s*['"][rw][^\}]+\breturn\s*\66;\s*\}(?<X1198950>)|is_file[\s\(]+['"]\{\$\w+\}/\.w3\-cache/[^:]{9,999}\b\w{1,40}[\s\(]+['"]https?://\w(?<X2223630>)|isset[\(\s]+(?:(\$_REQUEST\s*\[[^\]]+\])[\s\)@]+system[\s(]+\69[\s\)]+;(?!\s*else)(?<X1279250>)|\$_(?:GET\[[^\]]+\][\)\s]*\{\s*(\$\w{1,40})[=\s]+__DIR__;\s*\$\w{1,40}[=\s]+\$_POST\[[^\]]+\][^\{\}]{0,499}\bif[\(\s]+(\$\w{1,40})[=\s]+opendir[\(\s]+\71[\s\)\{]+while\s*\([^\}]+\bfopen[\(\s]+\71[^\}]*\}(?:[^\{\}\$]*\})+\s*closedir[\s\(]+\72(?:[^\{\}\$]{0,40}\}){2}(?<X1259980>)|POST\s*\[['"](pw_\w+)['"]\][\)\s]*\{\s*if[\s\(]+\$_POST\s*\[['"]\74['"]\][\)\s]+==+\s*\$\w+[\)\s]+\{\s*setcookie[\(\s]+["']\74[^;]+;\s*(\$\w+)\s*=[^;]+;[\s\}]+if[\s\(]+!\75[\s\)\{]+(?:die|exit)\b[\s\('"]+<form\s+action=['"]\?(?<X2269931>))))
\bif(?:[\s\(]+(?:isset[\s\(]+(?:((\$\w{1,40})\[['"]ak['"]\])[\s\)&]+\$\w{1,40}[\s=]+\1[\s\)]+\{\s*if[\s\(]+\2\[[^\]]+\][\s=]+['"]\w+['"\s\)\{]+(\$\w{1,40})[\s=]+Array[\s\('"]+pv['"]\s*=>\s*phpversion[\s\(]+\)[,\s]+['"]sv['"]\s*=>[^\}]+serialize[\s\(]+\3[\s\);]+\}\s*elseif[\s\(]+\2[^\}]{0,99}eval[\s\(]+\2\[[^\]]+\][\s\);]+\}\s*exit\b[^;]*;\s*\}(?<X2266380>)|(\$+\w+\[[^\]]+\])[\s\)]+\{\s*(\$\w+)[\s=]+\5;\s*(\$\w+)[\s=]+fopen\s*\([^;]+;\s*(fwrite[\s\(]+\7)[,\s]+['"]<\?[^;]+;\s*\8[,\s]+stri?_replace[\s\(]+['"](\W{1,5})\s*\w{1,64}\s*\9['"][^;]*\6\b[^;]+;\s*fclose[\s\(]+\7[\s\)]+;\s*\}(?<X1212430>)|\$_(?:[GPCSR]\w{2,6}[\s\[]+['"][^'"]+["']\s*\][\s\)]+\{\s*echo.{1,1999}?\}\s*else\s*\{\s*@?move_uploaded_file[\s\(]+\$\w{1,40}[\s\[]+["'][^'"]+["'][\s\]]+\[\s*["'][^'"]+["'][\s\]]+,\s*["'][^"']*["']\s*\.\s*\$\w{1,40}[\s\[]+["'][^"']+["'][\s\]]+\[\s*["'][^'"]+["'][\s\]]+\)\s*;\s*echo[^\$]+\$_FILES[\s\[]+["'][^"']+["'][\s\]]+\[\s*["'][^"']+["'][\s\]]+;\s*echo\s*["'][^'"]+["']\s*;\s*\}\s*\}(?<X1037391>)|[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*@?(\$\w{1,40})\h*=\h*str_replace[\s\(]+['"]\(\)['"]\h*,\h*['"]['"]\h*,(?:\s*['"][\w\+/]{1,40}\(\);['"]\.)+\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\}]{9999,}@?(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*['"]{2}\h*,[^;,\)]*\12[\)\s]+;\s*@?\13\(\);\s*\}(?<X1194820>)|[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)@]+array_map[\(\s]+(\$_[GPRSC]\w{2,6})\s*\[[^\]]+\]\s*,\s*\15\s*\[[^\]]+\][\s\)]+;(?!\s*else)(?<X1201765>)|COOKIE\[[^\]]+\][\)\{@]+eval[\s\(]+substr[\s\(]+file_get_contents[\s\(]+['"]https?://bit\.ly/[^:'"]+['"][\s\)\d,]+;\s*@?(?:exit|die)[\(\)\s]+;\s*\}(?<X1250801>)))|md5[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]*\S{2,3}\h*['"][^'"]+['"][\s\)]+\{\s*require[\(\s]+['"]wp\-includes/reg[^;]+;\s*if[\s(]+!(user)name_exists[\s\(]+['"]([^'"]+)['"][\s\)]+\{\s*(\$\w{1,40})[\s=]+wp_create_\18[\s\(]+['"]\19['"][\s,]+['"][^'"\$]+['"][\s\)]+;\s*(\$\w{1,40})[\s=]+new\h*WP_\18[\s\(]+\20[\s\);]+(\21\->set_role[\s\('"]+admini[^;]+;)\s*\}[^\}]+\22\s*\}\s*\}(?<X1197100>)|preg_match[\('"\s/]+[^,](?:(?:Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|AmazonBot|YandexBot|paloaltonetworks)\|){2,}[^,]+[\s,]+\$_server\[[^\]]+\][\s\)\{]+header[\s\('"]+[HTP/1\.02\s]+403\s*Forbidden['"\);exit\(\s]+\}(?<X1261073>)|strpos[\(\s]+\$(?:[o0]+[,\s]+(\$[o0]+)\s*\[[^\]]+\](?:[\s\.]+\25\s*\[[^\]]+\])+[\)\s]+\{\s*\$[o0]+\s*=[^:]+;\s*if[\s\(]+empty[\(\s]+\$[o0]+[\)\s\{@]+header[\(\s]+\25\s*\[[^\]]+\]\s*\.[^\*@\n]{9,9999}\bif[\(\s]+!\s*empty[\(\s]+(\$[o0]+)[\)\s\{]+echo\s*\26[;\s]+@?(?:exit|die)\b[^;]*;\s*\}\s*\}\s*\}\s*\}(?<X1261750>)|user_agent\s*,\s*['"]Googlebot['"][\)\s]*!==+\s*false[^\};@]+include(?:_once)?\s*['"]wp\-\w+\.html?['"];\s*(?:exit|die)\b[^:]*;\s*\}\s*\}(?<X1264021>))|strstr(?:[\(\s]+(\$\w{1,40})[,\s]+['"]\w{1,9}map\w*['"][\)\s]+\{\s*\$\w{1,40}[\s=]+dirname[\(\s]+\29[\)\s]+;[^=]{1,999}\bif[\s\(]+strstr[\(\s]+\29[,\s]+['"]\.[xh]t?ml['"][^#]{9,6999}\bif[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;\{\}]+\{\s*echo\b[^;]+\29[^;]+;[^\}]{0,499}\}\s*@?\w{1,40}[\h\(]+[^;]+\29[^;]+;(?<X1186482>)|[\s\(]+(\$\w{1,40}),['"]\.php['"\)\s]*\{\s*if[\s\(]+(?:(?:sha|md)\d+[\s\(]+)+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]*==[^;:\{\}]+[\$\w]+[\s\.]+['"]:?//['"]\s*\.[^\{\};]+\{\s*(\$\w+)[=\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*if[\s\(]+file_put_contents[\s\(]+\$\w+[\s/\.'"]+\31,\32[\)\s]*\{[^\}]+\}\s*\}\s*\}(?<X1255740>))|substr[\(\s]+\$\w+,\s*\-\d+[\)\s]*==+\s*['"]robots['"][\)\s]+\{\s*define[\(\s]+['"]BASE_PATH['"][,\s]+\$_SERVER\s*\[['"]DOCUMENT_ROOT['"]\][\);\s]*\$\w+\s*=\s*@?file_get_contents\s*\([^\n]{99,}\$\w+\s*\[["']http_user_agent['"]\][^;]*;[^\}]*\}\s*\w+[\s\(\)]+;(?<X1262320>))|\(!(?:(class)_exists\(['"](\w{1,40})['"]\)+\{[^\}\v]{1,999}\}+if\(@preg_match\([^,]{99,999},\$_SERVER\[['"]HTTP_USER_AGENT['"]\][^\v]{99,999}\b\35\h+\36\{[^;]{0,99}\$\w{1,40}\h*=\h*['"](?:\\x\d+|https?://)[^\v]{999,9999}\bunset\(\$links\[[^\v]{1,199}(\$\w{1,40})=new\h+\36;\37\->\w{1,40}\([^;]{1,99};\}(?<X1181910>)|(function)_exists\(['"](CoreLibrariesHandler)['"]\)\)\s*\{[^\{\(]{0,19}\b\39\h*\40\(\)\s*\{[^\{\(]{0,19}(\$\w{1,25})\h*=\h*['"][^\?]{99,999}\becho\h*\41;\s*\}[^\}]{0,19}\bregister_shutdown_\39\(['"]\40['"]\);[^\}=\$\(;\{]{0,99}\}(?<X1174372>))|\(!?(?:((function)_exists)\(['"](\w{1,20})['"]\)\)[\s\{]+\44\h+\45\(\)[\s\{]+\$\w{1,20}=array\(\);\s*foreach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,20}=>[^@#\*]{99,300}\43\(['"](is_user_logged_in)["']\)\)\s*\{\s*if\(\46[^@&]{999,6000}\bcurl_exec\([^\}]+[\}\s]+(\$\w{1,20})=new\h+curlopt_request;\47\->init\(\);\s*\}(?<X1194070>)|empty\(\s*\$_COOKIE\[['"]client_check['"]\][\s\)]+die\(\s*\$_COOKIE\[['"]client_check['"]\]\s*\);[^\n]{99,999}\becho\h*file_get_contents\(['"]https?://[^\n\{]{99,450}\{\s*assert\(\$_REQUEST\[[^\]]+\][\);\s*]+\}(?<X1201362>)|file_exists\(([^\{\}]{9,99}/compat\.php)['"]\)\)\s*\{function\h+(\w{1,20}\(\))\s*\{\s*\$\w{1,20}=str_replace\([^\\%&]{99,600}\$\w{1,20}=['"]https?://[^\?/]{2,20}/\w{1,20}\.txt\b[^\}\{]{99,400}\bcurl_close\([^\)]+\);\s*file_put_contents\(\50['"],\$\w{1,20}\);\s*\}\51;\s*\}(?<X1182160>)|isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(\$\w{1,40})\h*=\h*\53;\s*(\$\w{1,20})\h*=\h*['"]{2};[^\}"']{9,99}\}\s*(\$\w{1,20})\h*=\h*strrev\h*\(['"creatfunio\._]{16,35}\);\s*(\$\w{1,20})\h*=\h*\56\(['"]{2}\h*,\h*\55\(\54\)\);[^\$\}]{0,15}\57\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1164051>)|\$_COOKIE\[['"]wordpress_cf_adm_use_adm['"]\]\)[^\{]{0,99}\{(\$\w{1,40})=@?file_get_contents\([^\)]+\);if\(stri?pos\(\59,\$_[GPCSR]\w{2,6}\[[^\}]{9,99}\b(?:add_(?:filter|action)\([^\)]+\);){2}[\}\s]+(?:\?>\s*)?\Z(?<X2131193>)))|\(!(?:empty\((?:(\$\w+)\)\)\{(\$\w+)=['"]{2};exec\(['"]nslookup\.exe\s*\-type=MX\s*\61\.['"],\62\);\$\w+=\-\d+;[^\?]{999,2999}(\$\w{1,40})=\$_[GPCSR]\w{2,6}\[[^;]+;(?:\$\w+=[^;]+;){2}(\$\w+)=['"][^;]+;(?:\64\.=['"][^;]+;){5}[^\{\?]+if\((?:smtp_)?mail\([^\)]+\64,\63\)\)\{echo[^;]+;\}else\{echo[^;]+;\}(?:\?|\Z)(?<X2045012>)|(\$_FILES\['\w+'\]\['\w+'\])\)\s*&&\s*\(md5\(\$_POST\['\w+'\]\)\s*==\s*'[0-9a-f]{32}'\)\)\s*\{\s*(\$security_code)\s*=\s*\(empty\((\$_POST\['security_code'\])\)\)\s*\?\s*'\.'\s*:\s*\68;\s*\67\s*=\s*rtrim\(\67,\s*"/"\);\s*@move_uploaded_file\(\$_FILES\['\w+'\]\['tmp_name'\],\s*\67\."/"\.\66\)\s*\?\s*[^#]{99,500}';(?://\d+)?(?<X1036291>)|\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\)\)\{(\$\w{1,40})=base64_decode\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\]\);(\$\w{1,40})=create_function\(['"]['"],\70\);(?:\70|\71)\(\);(?:die|exit)\b[^;]{0,9};\s*\}(?<X1064320>)|FILES\['\w*'\]\['\w*']\)\sAND\s\(md5\(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\['nick'\]\)\s==\s'\w{32}'\)\)\s{(?<X2044111>)|GET\[['"](get_?links)['"]\]\)\)\s*\{\s*\$links\s*=\s*array\(\);[^\[\]]{1,400}\$\w{1,40}\s*=\s*\(int\)\$_GET\[['"]\74['"]\];(?<X2123370>)))|function_exists\((?:'(\w+)'\)\)\s*{\s*function\s*\76\(\)\s*{\s*\$host\s*=\s*'http://';\s*echo\(wp_remote_retrieve_body\(wp_remote_get\(\$host\.'ui'\.'jquery\.org/jquery-1\.6\.3\.min\.js'\)\)\);\s*}\s*add_action\('wp_footer',\s*'\76'\);\s*}(?<X1036260>)|['"](\w+)['"]\){2}\{\w+\s*\78\([^\}]{1,299}\}\s*if\([^\.]+aHR0cH[^'"]+['"]\)\.[^\(]{1,32}\(['"]PHNjcmlwdD4=['"]\)\.\$\w+\.\s*\$\w+[^\}]+[\}\s]+catch\([^\;]+add_action\(['"]\w+['"],\s*['"]\78['"]\s*\)\s*;\s*\}(?<X1270290>))|is_win\(\)+\{(\$\w{1,40})=array\([^\);]+/etc/passwd['"],[^;\)]+\);foreach\(\80\s+as(\$\w{1,40})\)\{if\((?:is_file\(\81\)\D{2,3})?is_readable\(\81\)(?<X2132410>)|isset\(\$GLOBALS\[['"]\\[^'"]+['"][^\v]{5000,11000}['"];\s*\$\w{1,40}\h*=\h*explode\h*\(\h*chr\s*\([^\?]{999,3000};\s*(\$[a-z]{4,15})\h*=\h*\(\h*\d+\h*\-\h*\d+\h*\)\h*;\s*\$[a-z]{4,15}\h*=\h*\83\h*\-\h*1;(?<X1279690>)))
\bif(?:\((?:(?:\h*strpos\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*,\h*['"](?:iP(?:hone|od)|Android|webOS|BlackBerry|Symbian|j2me|windows[^'"]{5,9}|midp)['"]\)\h*(?:\|\|)?)+\)\s*\{\s*@?header\h*\(\h*['"]Location:\h*http[^'"/]+//(?:pill|viagra|cialis|herb|drug|levitra)[^'"]+['"][\)\h]+;\s*\}(?<X1187820>)|(?:is_dir\([^\)]+/(?:administrator|components|(includes))/['"]\)\s*\D{2,3}\s*){3}[^@]{1,999}\bgoto\h+\w{1,9};\w{1,9}:\h+if\((?:\s*is_dir\([^\)]+/wp\-(?:content|admin|\2)/['"]\)\s*\D{2,3}){3}(?<X2152530>)|(?:md5\()+(?:getenv\(|\$_SERVER\[)['"]HTTP_USER_AGENT['"][\]\)][^\{;]{1,99}\{(?:header\([^;]+;)+(?:exit|die)\b[^;]{0,19};\}if\((\$\w+)=\$_[GPCSR]\w{2,6}\[[^;\{]{1,99}\{\4\[[^\]]+\]\(\4\[[^;]+;(?:(?:exit|die)\b[^;]{0,19};)?\}(?<X1224370>)|(?:md5\()+(\$_[GPCSR]\w{2,6}\[)[^\{;]+\{(\$\w+)=[^;]*\6[^;]+;(\$\w+)=base64_decode\(['"]PD9[^\{\}]+\{\7=\8\.[^;]*\7;\}if\([^\{;]*\6[^\{;]+\{[^\}]+\$\w+\(\7\);(?:die|exit)\b[^\}]+\}[^\{\}]{0,199}\bfwrite\((\$\w+),\7\);(?:includ|requir)e(?:_once)?\(?[^;]*\9\b[^\}\{]{0,199}\b(?:die|exit)\b[^\}]{1,19}\}(?<X1229380>)|(?:md5\(){2,4}[^=]{1,40}[\h=]+['"]\w{32,64}['"]\W{1,4}\$[^=]+[\h=]+['"]wp\-[^\)]+\)[\{\s]+if\([^\{]+\)[\{\s]+@?[cm](?:opy|ove_uploaded_file)\(\$_FILES\[[^\)]+\);[\}\s]+echo\h*['"]<(form)[^;]{9,150}</\11>['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1210980>)|(?:md|sha)\d+\([^\)]+\)\W{2,4}['"]\w{32,64}['"]\)\s*\{\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})=\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,20})=\13\(['"]{2},\14\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\15\(\);\s*\}(?<X1186140>)|(?:move_uploaded_file|copy)\(\$_FILES\[[^://]{99,400}\bif\(isset\(\$_[GPRSC]\w{2,6}\[['"]shell['"]\]\)\)\s*\{[^:\(]{2,30}\bfile_get_contents\(['"]https?://(?:paste|ghost)bin\.\w{2,4}(?<X2181360>)|(\$\w{1,20})=\$\{['"]_[GPRSC]\w{2,6}['"]\}\[[^\]]+\]\)\18\h*\[[^\]]+\]\(\$\{\18\h*\[[^\]]+\]\}\h*\[[^\]]+\],\18\h*\[[^\]]+\]\(\18\h*\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?<X1187390>)|(\$\w{1,40})\D{2,3}str_i?replace\(['"](function\s*wp_mail\(\s*\)\s*\{\s*\})['"],\s*['"]\w{1,40}[gylohp](?:mail|andex|ahoo|rotonmail|ive|outlook|otmail)\.[\w\.]{2,5}['"],\20\)+\{file_put_contents\([^\),;]+\bwp\-config\.php['"],['"]\21[^@]{1,199}\bunlink\([^;\?\{\}=\$]{0,99}__FILE__\)(?<X2163731>)|(\$\w{1,40})\h*\D{2,3}\h*["']{2}\)\{\h*(?:exit|die)[^;]{0,19};\}\h*\23=preg_replace_callback\(['"][^'"]{1,49}\\\?yumingid\\\=([^'"]{1,19})\\\&lineid\\\=\24[^'"]{1,19}['"],['"]\w{1,40}['"],\23\);\h*echo\h*['"]?\23['"]?;\h*(?:exit|die)[^;]{0,19};(?<X2149150>)|(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)\s*eval\(base64_decode\(\26\)\);(\$href)=[^;]{1,99};\$words=array\((?:['"][^'"]{1,49}['"],){5}[^;]{1,99};if\(preg_match\(['"][^'"]{1,199}['"],\$_SERVER\[['"]HTTP_USER_AGENT['"][^\?]{1,499}\barray_push\([^,\)]{1,99},['"]<a\b[^;]{1,99}\27(?<X2141631>)|(\$_[GPRSC]\w{2,6})\)\s*\{\s*if\(\29\[[^\]]+\][^\)]+\)\s*\{\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(base64_decode\(\29\[[^\]]+\]\)\);\s*(?:exit|die)[^;]{0,9};(?:\s*\})+(?<X1186261>)|(\$_REQUEST\["key"\])\s*!=\s*""\s*\)\s*\{\s*if\s*\(\s*\31\s*==\s*"[^\{]{1,99}\{\$\w{1,40}\s*=\s*@?copy\((\$_SERVER\["DOCUMENT_ROOT"\])\s*\.\s*"[^\}]{1,99}/restore\.php"\s*,\s*\32\s*\.\s*"[^"]{1,99}"\)\s*;\s*if\(\$\w{1,40}\)\s*\{\s*die\(\s*"ok"\s*\)\s*;\s*\}\s*else\s*\{\s*die\s*\(\s*"fail"\s*\)\s*;(?:\s*\}\s*){3};(?<X1040331>)|(\w{1,4})===undefined\)\{[^%`]{99,1999}\bvar\s*\34[\s=]+(?:!!\[\]|true|!0)[\s,]+(HttpClient)[\s=]+(function)\s*\(\)\s*\{[^#\?]{1,1999}\bvar\s*(\w+)[\s=]+new\s*\35[\s\(]+\)[^;]+;\s*\37\[[^\]]+\]\([^\)]+\36\s*\([^\{;]+\{[^\}]+\b(\w+\()[^;]+;[\s\}\);]+\36\s*\38[^\)]+\)\s*\{[^\}]+[\s\}]+\(\)+[\s\};]*\Z(?<X1226012>)|(function)_exists\(['"](\w{1,40})['"]\)\)\{\40[^\n]{9,299}\becho\h*file_get_contents\(['"](?:https:?//)?word(?:pressping|lpress)\.(?:com|net)/[^'"]{0,40}['"]\);\}\}add_action\(['"]\41['"],['"]\41['"]\);\}(?<X1186441>)|(isset)\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\43\(\44[^\{]{9,70}\{\s*(\$\w{1,9})\h*=\h*['"\._creatfunio]{9,30};\s*(\$\w{1,9})\h*=\h*@?\45\(['"](\$\w{1,5})['"],\h*['"\.eval\(base64_dco]{9,40}\47\)\);['"]\);\s*\46\(file_get_contents\(['"]https?://pastebin[^\)]{9,19}\)\);\s*\}(?<X1140991>)|(ndsw)\W{2,3}undefined\)\s*\{\s*var\h*\49[^\?]{1,599}var\h*(\w{1,9})[\h=]+new\h*httpclient\(\),\h*(\w{1,9})[\h=]+[^\.]{0,49}\.\w{2,6}/[^\?]{0,99}\.php\?id=['"]\+token\(\);\s*\50\[['"]get['"]\]\(\51,function\((\w{1,9})[^\[]+\[['"]eval['"]\]\(\52\);\s*\}\);\s*\}[^\}]{1,99}\}\s*\}\(\)\)(?:\s*;)?\s*\}(?:\s*;)?(?<X1186652>)|(Tools::getValue\()['"]\w{1,40}['"]\)\h*\D{2,3}\h*['"]admin['"]\h*\)\s*\{\s*echo\h*['"]COOKIE_KEY\h*:[^\-\}]+\$\w{1,40}\h*=\h*Db::getInstance\(\)\->executeS\(['"][^!]{99,1999}\bif\(!\$\w{1,40}\->checkHash\((\54['"]password['"]\))[^\-]{9,499}\->[^;]+\55\h*;(?:\s*\}){2}(?<X1162340>))|\(+(?:(?:file_exists|is_dir)\(['"][^\)'";]{1,199}/(?:named\.conf|\.cagefs)['"][^\?]{1,199}\bif\(+){2}(?<X2215741>))
\bif\((?:@?md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\D{2,3}['"][\w\d]{32}['"]\)\s*preg_replace\([^,]{0,15},\s*['"eval\.\(bs64_dco\s]+\$_[GPRSC'"\.]{1,9}[^\?]{9,25}\);(?<X1132602>)|@\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]+\{\s*\$token[\h=]+[^#&\*\^%]{99,700}\bforeach[\h\(]+\[['"]name['",\h]+txt['",\h]+path['"\]\h]+as[^#\^@]{299,1800}(\$\w+)[\h=]+@move_uploaded_file\(\$_FILES\[['"]file['"]\][^\?]{9,199}\becho[\h\(]+\2\h*\?\h*['"][^\.]+\.[\h'"]+<a\h*href=[^;]+;\s*\}(?<X1232720>)|[^!\$_]{1,9}\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\D{2,3}\s*['"]\w{9,45}['"]\)\s*\{\s*@?eval\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*echo\s*["'][^'"]{9,99}['"];\s*\}\s*else\s*die\([^\)]{1,50}\);(?<X1128481>)|[^\$]{0,15}\$_[GPRSC]\w{2,6}\[['"]xboomber['"]\][^\{]{1,40}\)\s*\{\s*(\$\w{1,20})=fopen\(['"]class\-[^'"]{1,40}\.php\d*['"][^\)]+\);\s*fwrite\(\5,base64_decode\(['"][^\)]{9999,}['"]\)\);\s*\}(?<X1228541>)|[^\$_]{0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^\)]*[\)\s]+\{\s*echo[\s\(]*['"]<form\b[^\?\*]{99,400}\bif\h*\(empty\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{[^\}]{0,99}\}\s*else\s*\{\s*(\$\w{1,20})\h*=\h*\7;\s*echo\h*\(?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\8\)\h*;\s*\}\s*;?(?<X1188133>)|[^\(]{1,16}\((base64_decode)\(['"](\w+==)['"][^\{\n]{1,64}\{error_reporting\(0[^\{\n]+\{return\s*preg_match\(\10\(['"]LyhhbmRyb2[^\n@\*]{1,9999}LmNsb3VkLXN0YXRzLmNvbQ[^\}\n]{1,999}\}\s*else[^\}\n]+wp_redirect[^\}\n]+exit[;\}\s\n]+add_action\(\10\(['"][^;\n]+\10\(['"]\11['"][\);\n]+\}(?<X1257571>)|[^\)]+\)[\{\s]+if[\h\(]+(file_)pu(t_contents)[\h\(]+['"][^,]{1,20}\.php['"][,\h]+\13ge\14[\h\(]+['"]https?://inject0r\.[^\{]{1,60}\)[\{\s]+echo\h*['"][^\?]{1,150};(?:\s*\}){1,2}(?<X1214830>)|[^\)]+\)\s*(\w{1,9})=['"val\+]{4,8};\s*try\s*\{[^\[]{9,99}\{\s*(\w{1,9})\s*=\s*window;\s*if\([^\)]+\)\s*(\w{1,9})=\17\[['"]e['"]\.concat\(\16\)\];\s*(?:\}\s*){3}if\([^\)]+\)\s*\{\s*(\w{1,9})=new\s+Array\([^\)]{300,1500}\);\s*\}\s*\17=\19;[^<]{99,200}\(\)\}\s*catch\([^\)]+\)\s*\{\s*\18\([^\)]+\);\s*\}(?<X1123941>)|[^\)]+\)\{scookie\(['"]phpspypass\b(?<X2134531>)|[^\{;]*\$_[GPCSR]\w{2,6}\[[^;\{]+\{if\((file_)exists\(([^\)]+)\)+\{((?:includ|requir)e(?:_once)?[\s\(]*\23[\s\)]*;(?:exit|die)\b[^;]{0,19};)\}else\{(\$\w+)=['"]\22pu(t_contents)['"];(\$\w+)=['"]base64_decode['"];\25\([^,\);]+\.php['"],\27\(\22ge\26\([^;]+;\24\}\}(?<X2211142>)|[^\{]{1,32}\{\$\w+\s*=\s*(\$_SERVER)\[['"]PHP_SELF[^\{]{1,16}\{\$\w+\s*=\w+\(['"]\?['"]\s*,\s*\29\[['"]\w+[^!]+!(\$\w+)\)\30\s*=\s*\29[^\)]{1,99}\30\)\30\s*=\s*\29[^\)]{1,99}\30\)\s*,\s*\w+\);\}\s*(\$\w+)\s*=\s*file_get_contents\(['"]\w+://[^\)]+\);\s*\31[^\?]{1,99}\w+;\s*include(?:_once)?\(['"]\w+\.txt['"]\);(?<X1265020>)|\$\w+===0\){@\${\w+}\(\$\w+\);}(?<X1036530>)|\$\w+=@gzinflate\(\$\w+\)\)\{if\(isset\(\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\)\)@setcookie\(["']\w+["']\s*,\s*\$_[GPRSC]\w{2,6}\s*\[["']\w+["']\]\);\$\w+=create_function(?<X2045452>)|\$\w{1,20}\)\s*\{[^\{\}]{9,99}\bmysql_query\(['"]UPDATE\s+(.)[^\h]{2,15}\busers\35\h++SET\h+\35(user_)login\35\h*=\h*['"](?:admin|administrator)['"]\h*,\h*\35\36pass\35\h*=\h*['"]\w{32}['"]\h+WHERE\h+\35ID\35\h*=\h*1['"]\);(?<X2152910>)|\$\w{1,9}\(@\$\w{1,9}\[[^\]]+\]\)\W{2,4}\$\w{1,9}\)\{(\$\w{1,9})=\$\w{1,9}\(['"]{2},\$\w{1,9}\(\$\w{1,9}\)\);\38\(\);\}(?<X1164800>)|\$_[GPCSR]\w{2,6}\[(?:[^\)]+\)\{?@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}?\$\w{1,40}=['"]error_reporting\((?:0|NULL|False)\);(?:\\[rn]){0,2}\\\$\w{1,40}=DIR_WS_MODULES(?<X2163840>)|[^\]]+\]\)\{(?:echo[^\}\$]{1,299}['"]\.(\w+)\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)[^;]+;\}[^@]{4999,6999}\bfunc(tion)\s*\41\((\$\w+)\)\{(?:(?:else)?if\(func\42_exists\(['"](system|passthru|shell_exec|exec)['"]\)\)\{[^\}]*\44\(\43[^\}]{9,99}\}(?:return\s*\$\w+;\})?){4}(?<X2131341>)|switch\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(?:case\s*['"](\w{1,40})['"]:\s*(deransome?ware::)shcdirs\(\47locate\(\),['"]\46['"],\$_[GPCSR]\w{2,6}\[[^\]]+\]\);break;){2}\}\}(?<X2170321>))|[^\{]{1,99}\{(\$\w+)=file_get_contents\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};(eval\()\49\);(?:exit|die)[^;]{0,19};[^@#%\*:]{99,1999}\b[cm]o(?:ve_uploaded_file|py)\(\$_FILES\[[^@%\*&:]{1,999}\b\50\w{1,19}\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};\}?(?:exit|die)[^;]{0,19};(?<X2182340>))|\$_[GPRSC]\w{2,6}(?:[\s\)]+\{\s*(\$\w{1,40})\h*=\h*strrev\(['"\s\.base64_dco]{17,40}\);\s*\$\w{1,40}\h*=\h*\$_[GPRSC]\w{2,6}\[\52\(['"][^'"]{3,99}['"]\)\];[^\}]{99,999}\52\(['"][^'"]{3,99}['"]\)\h*=>\h*\$\w{1,40}[,\s\)]+;\s*\$\w{1,40}\h*=\h*(curl_)exec([\h\(]+\$\w{1,40}[\s\)]+;)\s*\53close\54(?:\s*\}){2}(?<X1155450>)|[^\{\}]{3,60}\)\s*\{\s*if\h*\(!?(function_exists)\(['"]wp_authenticate['"]\)\)\s*\{\s*include\(ABSPATH\.['"]wp-includes/\w{1,20}\.php['"]\)[^\*@]{300,999}(@?\$\w{1,20})\h*=\h*(file_get_contents)(\(\$\w{1,29}\);)\s*\}\s*\}\s*elseif\h*\(\56\(['"]\58['"]\)\)\s*\{\57\h*=\h*\58\59(?:\s*\}\s*){3}(?<X1160160>)|\[['"]Ghost['"]\]=+['"](?:Send|transfer|upload)['"]\)[\{\s]+[^,]{9,99}\b[cm](?:opy|ove_uploaded_file)\([^\?]{99,400}\baction=['"]\?(?:Ghost=(?:Send|transfer|upload)|ghost\.php)['"](?<X2208300>)|\[[^\]]+\]\)\s*\{\s*(\$\w{1,9})\s=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*(\$\w{1,9})\s=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*@?rmdir_recursive\(['"]\62['"]\);\s*unlink\(['"]([\./]{1,20}contactemail)['"]\)[^\(]{1,20}fopen\(['"]\64[^;]{5,50};\s*fwrite\(\$\w{1,9},\s*\63\);(?<X2132220>))|\$_GET\[[^\]]+\]\[(?:[^\]]+\]\(\$_POST\[\$_GET\[[^\]]+\]\[[\dx]+\]\],\$perms?\)+\{echo\h*\$_GET\[[^\]]+\]\[[^\]]+\];\$\w+=!0;\}(?<X2221871>)|[x\da-f]+\][^\n!]{9,999}\bif\(!\$_SERVER\[[^\n]+upload(?<X2221900>))|\$_POST\[[^\]]+\][^\)]+\)\s*\{\s*if\(!?empty\((\$_FILES\[[^\]]+\])\)[^\(]{1,7}\b(?:md5\()+\$_[GPRSC]\w{2,60}\[[^\]]+\]\)\)\)\W{2,4}['"]\w{32}['"]\)\s*\{\s*move_uploaded_file\(\68\[['"]tmp[^\]]+\],[^\$]{0,6}(\68\[[^\]]+\])\);\s*echo\h+['"][^\$]{0,40}\69;\s*\}\s*else\s*\{(?:(?:exit|die)[^;]{0,9};\s*\}){2}(?<X1185860>)|\$GLOBALS\[[^\]]+\]\[\d+\]\(\$\w{1,40},['"]!defined\([^\)]{1,9}\)['"],round\(\d+\)\)>round\(\d+\)\)\{echo\s*[^;]{0,99}\bINJECT\s+OK\b(?<X2128681>)|\(new RegExp\('onepage\|checkout\|onestep','gi'\)\)\.test\(window\.location\)\){(?<X2043522>)|\d+<mt_rand\([^\)]+\)\)create_function\((\$\w{1,9})[^;]{1,9};if\(!?\73\)\{(\$\w{1,9})=(\$_SERVER\[)['"]?HTTP_REFERER['"]?\];\$\w{1,9}=\75[^;]+;if\((?:(stristr\(\74),['"]\w{1,40}['"]\)\D{2,3}\h*){3}[^\{;]{99,499}\{if\(!?\76[^;\}]{1,49}\bheader\(['"]Location:\h*http://[^;]+;(?:exit|die)[^;](?<X2140330>)|\h*!\h*empty\([^\{\};]{0,99}\$(password)\b[^\{;]{1,99}\{\s*(\$\w{1,40})\h*=[^;]{1,99}\$\78\b[^;]{1,99};\s*@?file_get_contents\h*\(\h*['"]https?://api\.telegram\.org/[^;]{9,199}\79\b[^;]{1,99};\s*\}(?<X1162432>)|\h*function_exists\(\h*['"](file_get_contents)['"]\h*(?:\)\h*){2}\{\s*try\s*\{\s*\81\(\h*['"](https?://api\.telegram\.org/)[^;]{1,99}\bc(hat_id=\d+)[^;]{1,99}\$_SERVER\[['"]REMOTE_ADDR['"]\][^;]{1,99};\s*@?\81\(\h*['"]\82[^;]{1,99}\bc\83[^;]{1,99};\s*\}\s*catch\b[^\{\}]{0,49}\{(?:\s*\}){2}(?<X1162441>)|\s*!\$os_name\s*=\s*@?php_uname\(\)\)\s*\{\s*if\s*\(\s*function_exists\(\s*['"]posix_uname['"]\s*\)\s*\)\s*\{[^`]{600,1500}if\(!empty\(\$_POST\[(['"]?php['"]?)\]\)\)\{\s*ob_start\(\);\s*@?eval\(\$_POST\[\85\]\);(?<X2280381>)|\s*isInString1?\(\$(?:[a-zA-Z0-9_]+,[\'"]googlebot['"]\)\)\s*\{\s*\}[^\(]{2,20}header\s*\(['"]Location:[^\176]{20000,}\176[^'"\n\s]{1,99}\.php['"]>(?<X2133002>)|\w+,['"]google(?<X2105942>))|\s*isset\(\s*\$_(?:[GPRSC]\w{2,6}\[['"]test_url['"]\]\s*\)\s*\)\s*\{\s*echo\s*['"]file\s*test\s*okay['"];\s*\}.+\$f\s*=\s*\$a\(['"]['"],\s*\$array_name\(\$string\)\);\s*\$f\(\);(?<X1036471>)|POST\[\s*'Submit'\s*\]\s*\)\s*\)\s*{\s*\$filedir\s*=\s*""\s*;\s*\$maxfile\s*=\s*'\d+';\s*\$userfile_name\s*=\s*\$_FILES\['image'\]\['name'\];.{300,}?Submit" value="Submit"></form>';\s*}(?<X1039600>))|\w{1,40}\[["']\w{1,40}['"]\]\h*===\h*undefined[\)\s]+\{\s*var\s*\w{1,40}=function\h*\(\w{1,40}\)\s*\{\s*var\s*\w{1,40}=['"][^'"]{65}['"];[^\n]{99,9999}___that___\h*\[[^\]]+\]\s*\(\s*___xmlhttp___\h*\[[^;]+\]\);(?<X1213761>))
\bif\((?:cookie\s*==+\s*undefined[\s\)]+\{\s*setCookie\s*\([^;]+;\s*document\.write[\s\(]+['"]<iframe\s+src=['"]https?://[^/]{1,199}\.ru/[^>\}]{0,499}\bstyle=['"](?:[^'"]{0,49}[ltbr](?:eft|ight|op|ottom)[\s:]+\-\d{3,}p[tx]\b){2}[^>]+>\s*</iframe>['"]\);?\s*\}(?<X1235161>)|count\(\$_GET\)>0\){\$c_=0;\$c0=explode\('&',\$_SERVER\['QUERY_STRING'\]\);.+?}}}}if\(\$c_==1\){unset\(\$_GET\[\$c1\]\);\$c4=false;\$c5='';\$c6='';include 'class-wp-filesystem-admin\.php';exit\(0\);}};(?<X1038780>)|empty\(\$wpdbpass\)\)\{echo['"]<[^\/]{1,9}Wrong\s*include\s*place\s*or\s*it\s*is\s*not\s*a\s*WP<[^'"]{1,9}['"];(?:die|exit)\(\);(?<X2128700>)|file_exists\((?:(\$\w{1,40})\)\)\{\$\w{1,40}=file_get_contents\(\4\);\}\$\w{1,40}=['"]https?://(?:\d{1,3}\.){3}\d{1,3}/tds[^/]{0,9}/out/stat\.cgi(?<X2125630>)|['"]([^'"]{9,99})['"]\)\)\s*\{\s*(\$\w{1,20})=base64_decode\(file_get_contents\(['"]\6['"]\)\);\s*@?eval\(['"]\?>['"]\.\7\);\s*\}(?<X1191700>)|['"](\w{1,40}\.php)['"]\)\)\{unlink\(['"]\9['"]\);\}if\(function_exists\(['"](eval|assert|system|shell_exec|exec|passthru)['"]\)\)\{if\(\10\(['"]wget\s+https?://\S{1,99}(\S{5})\s+\-O\s+((?:/var)?/tmp/[^;]{0,19}\11);perl\s+\12[^\}]{1,99}\}elseif\(\10\((?<X2126850>))|filter_input\(INPUT_(?:[GPSCE]\w{2,6},(?:[^\{\}]{1,99}\{\s*(\$\w{1,40})\s*=\s*get_users\s*\(\s*array\s*\(\s*(strrev)\s*\(\s*['"]elor['"]\s*\)\s*=>\s*\15\s*\(\s*['"]rotartsinimda['"][^;]{1,49};\s*foreach\s*\(\s*\14[^\}][^\}]{9,499}\bwp_set_auth_cookie\([^;]{1,49};\s*(?:break|exit)[^;]{0,9};(?:\s*\}){3}(?<X1155190>)|[^\{]{9,70}\{\s*require\(\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\.(strrev\()['"]php\.[^\)]{5,25}\)\);\s*(\$\w{1,40})\h*=\h*array\h*\([^\)]+['"]role['"]\h*=>\h*\17['"]rotartsinimda['"]\)\s*,\s*\)\h*;\s*\17['"]resu_tresni_pw['"]\)\h*\(\h*\18\h*\)\h*;\s*\}(?<X1154340>))|GET\h*,\h*(strrev\()[^\{]{1,99}\{[^\}]{1,99}\$\w{1,40}\h*=\h*\20['"]\w{1,40}['"]\)\(\h*(array\()\20[^=]{1,40}=>\h*(\20['"]\w{1,40}['"]\))[\)\h]+;\s*foreach\h*\([^\)]+(\$\w{1,40})\)\h*\{\s*if\(in_\21\22[^\}]{1,99}(?:wp_set_(?:current_user|auth_cookie)\(\23->ID\);\s*){2}break;(?:\s*\}){3}(?<X1153411>))|function_exists\(['"]passthru['"]\)\)\{goto\s+\w+;\}\h*if\(function_exists\(['"]shell_exec['"]\)\)\{goto\s+\w+;\}[^\(]{1,60}ob_start\(\);passthru\(\$\w+\);(?<X2278291>)|fwrite\(fopen\(['"]\.htaccess['"],[^\)]+\),["']#Bug7sec\s*team\b(?<X2169610>)|get_magic_quotes_gpc\(\)\)[\s\{]+foreach\(\$_POST\h*as\h*\$key=>\$value\)\s*\{[^'"]{9,99}\becho\h+['"]<(?:!DOCTYPE|html)[^\\#\$]{99,400}<meta[^>]{1,40}\bcontent=['"]haxor['"]>(?<X2201010>)|in_array\((\$\w{1,40}),\$\w{1,40}[\)]+\{echo\s+['"]<(script)[^>]{0,30}>window\.location\.assign\(['"]https?://(?:www\.)?google\.[^'"]{99,299}['"]\)</\29>['"];(?:(\$\w{1,40})=fopen\(['"]ips?\.txt['"],['"]a\+?['"]\);fwrite\(\30,\28[^\)]{0,9}\);fclose\(\30\);(?:(?:die|exit)\b[^;]{0,9};)?\}?){2}(?<X2133190>)|ini_get\(['"]allow_url_fopen['"]\)\)\{function\h+gets?_data_yo\(\$\w{1,20}\)\{[^\v]{999,4999}if\(!empty\(\$\{(\$\{['"]GLOBALS['"]\}\[)([^\]]+\])(\}\[1\]\))\)(?:(\{\32['"][^'"]+['"]\])=['"][^'"]+['"];)?\{?(?:die|exit)\(\$\{?(?:\35\34|\32\33\34);\}{3}(?<X1154391>)|is_file\((\$\w{1,40})\)+\{(\$\w+)=trim\(file_get_contents\(\37\)+;if\(\38\!=['"]+\)[\{\s]+\38=substr\(\38,\d+,(?:\-|\+|\*|/)?\d+\);[^\@]{1,300}\b(chmod)\(([^,]+)[^;]+;unlink\(\40\);file_put_contents\(\40[^\}]+\b\39\(\40,\d+\);\}+(?<X1256172>)|is_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\]\)\)\s*\{\s*move_uploaded_file\(.{100,400}\$filename\s*=\s*\$_SERVER\[SCRIPT_FILENAME\];\s*\$time\s*=\s*time\(\)\s*-\s*\d+;\s*touch\(\$filename\s*,\s*\$time\);(?<X1040650>)|isBotDetected\(\)\)\{[^\)]{2,50}\b404\h*Not\h*Found['"]\)[^\?>]{20,250}\bforeach\(\$_[GPRSC]\w{2,6}\h*as\h*\$\w{1,20}=>(\$\w{1,20})\)\{(\$\w{1,20})=(?:(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\()+\43\)\)\);[^\(]{0,40}\beval\(\44\);\}(?<X2177460>))
\bif\((?:isset\((?:(?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:['"][^'"]*['"]=+(?:sha1|md5|\(\!?strcmp)?\((?:\1|\$\{[^\}]+\})\[[^\]]+\])(?:[^@]{1,100})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252305>)|(\$\w{1,20}\[[^\]]+\])\)&&\3\W{2,4}['"][^'"]+['"]\)[\{\s]+include\(['"]/tmp/\.[^\.]+\./[^'"]{1,20}['"]\);\s*\}(?<X1215630>)|(\$_[GPCSR]\w{2,6}\[[^\]]+\])\)(?:\)\s*\{\s*if\([^\}]{1,499}\}\s*echo\b[^;]{1,99}\5[^;]{1,99};\s*\w{1,40}\(\s*[pes](?:assthru|ystem|xec|hell_exec|open)\(\5,\h*(\$\w{1,40})\)+;\s*foreach\(\6\b[^\)]+\)\s*\{\s*echo\b[^;]{1,99};\s*(?:\}\s*){1,2}else\s*\{\s*@?phpinfo\(\);\s*\}(?<X1162760>)|\D{2,3}\5\D{2,3}\$\w{1,40}\)\{(?:if\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\)\{(?:eval|system|passthru|assert|(?:shell_)?exec)\(base64_decode\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\);\}){2,5}[^\{]{9,50}\{global\s*\$(?<X2152211>))|(\$_[GPRSC]\w{2,6}\[['"]joke['"]\]\))\)\s*\{\s*if\(trim\(\9[^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*file_get_contents\((__FILE__)\);\s*(\$\w{1,20})\h*=\h*[^\{\-:]{9,99}(\$\w{1,20})\h*=\h*fopen\(\10\h*,\h*['"]w\+?['"]\);\s*fwrite\(\12\h*,\h*\11(?<X2152780>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)(?:[\s\{]+[^\$]{0,20}(\$\w{1,20})=\14;\s*\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\(\15\);[^\}]{0,20}\}(?<X1199760>)|\h*echo\h*@?[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(base64_decode\(\14\)\);(?<X1138711>))|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*&&\h*\18[^\)]+\)\s*\{\s*(\$\w{1,20})\s*=\s*['"]["'creat_funio\.\s]{17,36}['"];\s*(\$\w{1,20})\s*=\s*\19\s*\([^:]{9,70}\)\s*\);\s*['"]\);\s*\20\s*\(['"][^'"]{999,20000}['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1147670>)|(\$_[GPRSC]\w{2,6}\[[^\]]{1,3}\])\)\)@?eval\(\22\);(?<X1174500>)|(\$_[GRPSC]\w{2,6}\[[^\]]+\]\))[^;]{1,49};\s*echo\h*(base64_decode\(\24);[^\.]{1,99}\.htmlspecialchars\(file_get_contents\(\25\)\)[^%\?]{99,999}\bname\h*=\h*['"]perm(?:issions?)?['"](?<X2179092>)|(\$_SERVER\[)['"]?REQUEST_URI['"]?\]\)+\{\$\w{1,40}=\27['"]?REQUEST_URI['"]?\];\}(?:\$\w{1,40}=['"]https?://(?:monogooglelinux|tds-(?:err|narod))\.\w{2,9}[^;]{1,40};)+[^<]{99,999}wp\-config\.php(?<X2146661>)|(\$_SERVER\[['"]HTTP_[^'"]+['"]\])\)+\{die\([peas](?:assthru|ystem|xec|hell_exec|val|ssert)\(\29\)+;\}(?<X1229620>)|(\$_SESSION\[)['"]([^'"]{1,40})['"]\][^\[\]]{1,40}\31['"]\32['"]\];\s*(\$\w{1,40})\s*=\s*@\$_POST\[[^\]]+\];\s*if\(@\33\[['"]?cc_[^\]]+\]\s*\D{2,3}\s*strlen\(@\33\[[^\]]+\]\)[^\)]{1,40}\)\s*\{[^,]{199,699}\}\s*\}\s*\$\w{1,40}\s*=\s*(base64_decode\()['"][^;]+\);\s*@?eval\(gzinflate\(\34[^;]+;\s*\}(?<X1125730>)|[^\)]+\)\)(?:[\{\s]+(\$\w{1,20})[\h=]+popen\(\$_[GPRSC]\w{2,6}\[[^\]]+\],['"]\w\+?['"]\);\s*while[\s\(]+[^\{]{1,15}\{\s*(\$\w{1,20})[\h=]+fgets[\(\h]+\36[,\s]+\d+\);\s*(\$\w{1,20})\s*\.=\s*['"]<[^\$]{1,20}\37[^\}]{1,30}\}\s*pclose\(\36\);\s*echo\h+\38;\s*\}(?<X1213371>)|\s*\{\s*(?:move_uploaded_file|copy)\h*\((\$\w{1,20}\[[^\]]+\])\[['"]tmp_name['"]\],\40\[[^\}]{2,40}\};\s*if\(isset\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*file_put_contents\(['"][^,]{2,20}\.php['"],\41\);\s*\}\s*;(?<X1187400>))|\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:[^\]]+\]\)\)\s*\$to\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\];\s*else\s*\{\s*echo\s*['"]404\s+error['"];\s*(?:exit|die)\b[^;]{0,9};\s*\}\s*if\(\s*\$curl\s*=\s*curl_init\(\)\s*\)\s*\{(?<X2045022>)|\w+\]\)\){echo\s*'<form .+?echo'\+';}else{echo'-';}}}(?<X1034691>))|\$_[GPRSC]\w{2,6}\[(?:(base64_decode)\(['"][a-z0-9=]+['"]\)\]\)\)\{\.['"][a-z0-9=]+['"]\)\.php_uname\(\)\.[^\n]{999,4999}(\$\w{1,40})=\$\w{1,40}\(['"]['"],\$\w{1,40}\(\$\w{1,40}\(\45\(['"][a-z0-9=]+['"]\)[^;]+;\46\(\)(?<X2132540>)|["'][^'"]*["']\]\)===true\)\s*\{\s*Check\(\);\s*exit;\s*\}\s*if\(isset\(\$_[GPRSC]\w{2,6}\[["'][^"']*["']\]\)===true\)\s*\{\s*Send\(\);\s*exit;(?<X2046093>)|[^\]]+\](?:[\)\s\{]+echo\h*['"]<font[^\.]{0,49}\.\h*php_uname\(\)\h*\.['"][^\{]{1,299}\{\s*if\h*\(\h*@?(?:copy|move_uploaded_file)\h*\(\h*\$_FILES\[[^\]]+\]\[[^\{]{0,49}\{\s*echo[^#]{0,99}\b(?:exit|die)[^;]{0,9};\s*\}(?<X1187460>)|[\)\{\s]+echo\h*['"]<form\h+method\h*=\h*post\h+enctype\b[^\{]{9,250}\{\s*@copy\h*\((\$_FILES\[[^\]]+\])\[['"]tmp_name['"]\]\h*,\h*\50\[[^\]]+\]\);(?:\s*\}){1,2}(?<X1149451>)|[\s\)]+\{\s*\$\w{1,9}\h*=\h*file_get_contents\(['"]https?://(?:[a-z]{2,5}bin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]|sites\.google\.com/site/\w{1,40}/\w{1,9}\.txt['"])\);\s*\$\w{1,40}\h*=\h*fopen\(['"](\w{1,9}\.(?:php|html?)['"]),['"]w[^\}]+\52\);\s*\}(?<X1146143>)|\)+\{(\$\w{1,40})=array\(['"]\w{1,9}['"]=>['"][\\1-7xbase_dcof]{15,49}['"],[^\)\}]{999,1999}\);(\$\w{1,40})=['"][^'"]{1,40}['"];\55\(\54\);(\$\w{1,40})=\$\w{1,40}\(['"]+,\$\w{1,40}\(\$\w{1,40}\)+;\56\(\);\}(?<X1132791>)|\)\)\s*(?:\{\s*)?file_put_contents\(['"]\w{1,40}\.txt['"]\s*,[^;]{1,99}FILE_APPEND\);(?:\s*\})?[^\{\}]{99,499}function\s*recurse_copy\(\$src,(\$dst)\)\s*\{[^@]{1,99}@?mkdir\s*\(\58\);while\((?<X2132100>)|\)\)\{(?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\(@?stripslashes\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\};(?<X1035373>)|echo['"]<form(?:[^;]{99,150};if\(is_uploaded_file\((\$_FILES\[[^\]]+\])[^\{]{5,25}\{@?move_uploaded_file\(\61[^\)]{9,99}\);(\$\w{1,9})=\61\[[^\]]+\];echo['"]<a\h*href=[^<]{0,25}\62\.['"]</a>['"];\}\}(?<X1142000>)|\s*method\s*=\s*["']post['"]\s*enctype\s*=\s*['"]multipart/form-data['"]><input\s*type\s*=\s*['"]file['"][^#]{99,650}\.php['"]\);echo['"]ok['"];\}exit;\}(?<X1039001>))|if\(isset\(\$_FILES\['(\w+)'\]\)\){(\$\w+)=getcwd\(\)\.'/';(\$\w+)=\$_FILES\['\65'\];@?move_uploaded_file\(\67\['tmp_name'\],\s*\66\.\67\['name'\]\);.*?<form\s*method="POST"\s*enctype="multipart/form-data"><input\s*type="file" name="\65"/><input\s*type="Submit"/></form><\?php\s*\}\}(?<X1034972>))|\)\D{2,3}\(md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)==(\$\w{1,15})[^\:]{9,999}else\{\h*(file)_pu(t_contents)\(\$\w{1,19}[\h\.]+['"]/['"][\h\.]+\$\w{1,9}[\h,]+\70_ge\71\(\$_\70S\[[^\]]+\]\[[^\]]+\]\)+;[^\?:]+\(md5\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)==\69\)[^\v\?]{9,999}\?(\$\w{1,9}):[^\}]{9,499}\}[^\}]{0,99}rmdir\(\72\);\h*\}(?<X1182212>)))|\$_[GPRSC]\w{2,6}(?:\h*\[[^\]]+\][\s\)]+\{\s*if\h*\(\h*!isset\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*echo\h+['"]<form\h+method\h*=\h*['"]POST['"][^;]+;\s*\}[^\?]{99,999}(else\s*\{)\s*if\(@copy\(\$_FILES\[[^\v]{9,99}\74\s*echo\h+['"]\w{1,40}['"];(?:\s*\}){4}(?<X1144370>)|\s*\[\w+\]\)\)\{\s*\$d=substr\(8,1\);foreach\(array\((?:\d+,)+.+?eval\(\$d\);\s*\}(?<X1034462>))|\$_(?:COOKIE\[[^]]+]\)\s*&&\s*isset\(\$_COOKIE\[[^]]+\]\)\)\s*{.+include\(\$f\);\s*\}\s*(?:else)?(?<X1036521>)|GET\[(?:'bataboom.{100,300}Submit"/></form><\?php\s*\}\}(?<X1040860>)|[^\]]{1,40}\]\)\)\{echo['"]<form\s+method=['"]post['"][^\$]+[^\}]{99,200}\}if\(isset\(\$_GET\[[^\]]{1,40}\]\)\)\{(\$\w{1,40})=\$_GET\[[^\]]{1,40}\];(\$\w{1,40})=\79\[\d+\]\(['"]['"],\79\[\d+\]\(\79\[\d+\]\)\);\80\(\);\}exit[^;]{0,9};\}(?<X1061010>))|POST\[['"]__bscode(?<X2102931>)))|md5\((?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\)[^\)]+\)\s*\{\s*if\(isset\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*\{\s*function\h+(\w{1,20})\([^\?]{20,150}\}\s*(?:(\$\w{1,20})\h*=\h*@?\83\(@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*){2}[^\}]{9,150};(\$\w{1,20})\h*=\h*@?\84\(['"]{2},[^;]{9,40};@?call_user_func\(\85\);[\s\}]+(?<X1141720>)|[^\$\[]{0,20}\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\W{2,4}['"](?:\w{32}|\w{64})['"]\)\s*\{[^\}]+\}\s*\$\w{1,20}=array\((?:['"]wp\-[^'"]+\.php['"],?){5,15}\);\s*function\h+make.urls?\((\$\w{1,20})\)\s*\{\s*(?:\87=\w{1,20}\([^\$]*\87\);){10}(?<X2183090>)|\$bannermass\)==\$get_url_var\)\s*\{\s*\$set_cookie\(stripslashes\(\$check_category\)\);\s*\}(?<X1041390>))|nds\w\W{2,3}undefined\)[\s\{]+(function)\h*(\w{1,9}\([^\)]+\))[\s\{]+var\h*\w=(\w{1,9}\(\))[^\}]{9,99}\},\91[\}\s\(;]+\90\h*[^\{]+\(?\)?[\{\s]+var\h*\w[\h=]+[^\\]{99,999}\w{1,20}=\90\(\)[\{\s]+(return)\h*(rand\(\))\+\94;[\}\s;]+\90\h*\92[\{\s]+var\h*\w=\[[^\]]+http[^\$]{200,1200}\}\90\h*\w\((\w),(\w)\)\{[^\[]+\93\h*\95\[[^\]]+\]\(\96\)[^\}]+\}\}\(\)\)[;\}]{1,3}(?<X1214800>))
\bif\((?:ndsw\W{2,3}undefined\)[\s\{]+(function)\h*(\w{1,9}\([^\)]+\))[\s\{]+var[^\}]{9,99}\},\2[\}\s]+\1\h*(\w{1,9})\(\)[\{\s]+var\h*\w[\h=]+[^\}\s]{1,300}\.php[^\}\s]{1,300}\3=\1\(\)[^=]{0,20}\b(return)\h*\3\(\)[\}\h]+\(\1\([^\$\n]{99,1200}\}\)\}\1\h*\w\((\w),(\w)\)\{var[^;]+;\4\h*\5\[[^\]]+\]\(\6\)[^\}]+\}\}\(\)\)\};?(?<X1210801>)|PLATFORM\s*==\s*WORDPRESS\)\s*{\s*if\(strpos\(\$file\s*,\s*'wp-content'\)\s*===\s*false\s*&&\s*strpos\(\$file\s*,\s*'wp-admin'\)(?<X2045850>)|smtp_mail\(\$email,\s*\$subject,\s*\$message,\s*\$Header,\s*\$from_email\)\)\s*{\s*echo\s*"good";\s*}\s*else\s*{\s*echo\s*"Some error occured";\s*}\s*\?>(?<X2045061>)|stri?pos\((\$\w{1,40}),['"]([^'"]+)['"]\)[^\{]{0,49}\{(?:return;\})?(\$\w{1,40})=\w{1,40}\((file_)ge(t_contents\()\10\)\);\13pu\14(?:sub)?str_replace\(['"]\11['"],['"]{2},\10\),\12\);(?:unlink\(['"]?(?:[^'"]+\.php|\.htaccess|\10)['"]?\);){3}(?<X2179860>)|strlen\(\$_POST\[['"]emailLogin['"]\]\)[^\{]+\{\s*tulis_file\(['"][^'"]+\.dat['"],[^\)]+\);\s*header\(['"]HTTP/\d\.\d+\h+40[43]\h+(?:forbidden|not\h+found)['"]\);\s*die\([^\)]+\);\s*(?:exit|die)[^;]{0,9};(?<X2142050>)|strpos\((?:'\w{1,40}','\w{1,40}'\)!==false\)mssql_query\(\$_\d+,\$_\d+\);\s*curl_setopt\(\$_\d+,\d+,\$_\d+\);(?<X2050070>)|\s*'fff'.\$file,'home'\)>0 or strpos\('fff'\.\$file,'admin(?<X2044171>))|typeof(?:\h+(ndsw)===['"]undefined['"][^%]{1,399}\19\h*=\h*\w+,\h*\w+[^\%]{1,599}\},(\w+)[^\}]+\}\)\)\}\w+[^\{]+\{var\h*\w+=\20[^\{]+\{\w+\h*\w+=\h*(\w+\(\))[^%]{1,99}\21\{\w+[^\}]{1,256}\.php[^\}]+\};return\s*\21\}{2}(?<X1253040>)|\s*(\w+)=+undefined\)\{var\s*\23(?:=(?:true|false);\(function\((\w+),\w+\)\{var\s*\w+=\{(?:\w+:[^,]+[,\}])+\w+=\w+,\w+=\24\(\);while\([^\)]+\)[^@\n\?]{1,7000}\bfunction\s*(\w+)\(\)\{var\s*(\w+)[^@\]\n]{1,500}\23[^@\n\*]{1,999}\bfunction\(\)\{return\s*\26;\};return\s*\25\(\);\}+;(?<X1261141>)|\s*=\s*(?:true|false);\(function\((\w+),\w+\)\{var\s*\w+=\{(?:\w+:[^,]+[,\}])+\w+=\w+,\w+=\28\(\);while\([^\)]+\)[^@\n\?]{1,7000}\bfunction\s*(\w+)\(\)\{var\s*(\w+)[^@\]\n]{1,500}\23[^@\n\*]{1,999}\bfunction\(\)\{return\s*\30;\};return\s*\29\(\);\}+;(?<X1278321>))|\s*(\w{1,4})={3}['"](undefined)['"]\)\{(function)\s*(\w+)[^\}]{1,999}\}[^!]{0,999}!{2}[^!]{0,99}!\w\?[^)]+\33[^%]{1,199}(while\(!!\[\]\))[^!]+\32=!![^!]+\36[^!]+!!\[\]\);[^%]{1,499}\w=\35;[^\%]{1,299}\34\s+(\w)\(\)\{var\s*\w=\[['\w\,:/\+\.]+\];\37=\34[^!\?\n]+\w\[\w[^\}]+\}\);\}\34[^\}]+\}{2}\(\){2};\};(?<X1248031>))|window\.document\)if\(parseInt\([^)]+\)===\d+\)try\{Boolean\(\)\.prototype\.\w\}catch\(\w{1,40}\)\{\w=\[[^]]+\]\[0\].+?\);}if\(\w\)\w=\w;\w\(\w\);(?<X1043341>))
\bif\h*(?:(?:\(\h*){1,2}\$_POST\[[^\]]+\]\h*(?:\)\h*)?[^\d\s]{2,3}\h*\$shra00p\h*\)\h*\{\h*\$yeacmd\b(?<X2162711>)|\(!(file_)exists\h*\(['"](/tmp/[^'"]+)['"]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*\2get(_contents)\h*\(['"]https?://[^\)]+\);\s*(\2put\5\h*\(['"]\3['"]\h*,\h*\4\);)[^\?]{99,400}\6[^\}]{1,99}\}(?<X1187860>)|\(!?(function)_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*\8\s+\9\([^\)]+\)\s*\{\s*\$\w{1,20}\s*=\s*array\([^/]{99,400}\}\s*(\$\w{1,20})\s*=\s*['"][^'"]{15,150}['"];\s*(\$\w{1,20})\h*=\h*['"]\9['"];\s*(\$\w{1,20})\h*=\h*\11\([^\)]+\);\s*(\$\w{1,20})\h*=\h*\12\(['"]{2},\11\(\10\)\);\s*\13\(\);\s*\}(?<X1138630>)|\(!?[ie](?:mpty|sset)\(\h*(\$_[GPRSC]\w{2,6})\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\15\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*\{\h*(\$\w{1,40})\h*=\h*@?\15\h*\[[^\]]+\]\h*;\h*\16\(\h*\15\h*\[[^\]]+\]\h*\)\h*;\h*\}(?<X1153521>)|\(!?empty\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*(?:(?:\$\w{1,20}\.?\h*=\h*(?:\$\w{1,9}\(\d+\)\.?)+;\s*){3,9}(\$\w{1,20})\.?\h*=[^\}]{9,250}\18\h*=\h*\19\(\$\w{1,20}\);\s*\}[^@]{9,150}@?eval\h*\((?:\$\w{1,20}|\w{4,20})\(\18\)\);(?<X1177851>)|(\$\w{1,20})\h*=\h*@\$\w{1,20}\h*\(\$reverse\h*\(\18\)\);\s*if\h*\(!?empty\h*\(\21\)\)\s*\{\s*\21\h*=\h*@\$\w{1,20}\(\21\);\s*if\h*\(!?empty\h*\(\21\)\)\s*\{\s*(\$\w{1,20})\h*=\h*@\$\w{1,20}\(['"]{2},\h*\21\);\s*\22\(\);(?:\s*\}){3}(?<X1157641>))|\(!?function_exists\(['"](\w{1,20})['"]\)\)\s*\{\s*add_filter\(\h*['"]wp_footer['"]\h*,\h*['"]\24['"]\);\s*function\h+\24\(\)\s*\{\s*(\$\w{1,20})\h*=\h*["']PGRpd[^'"]{99,400}['"];\s*echo\h+base64_decode\(\25\);(?:\s*\}){2}(?<X1157830>)|\(!empty\((?:(\$_[GPCSR]\w{2,6}\[['"]\w{1,40}['"]\])[\)\{\s]+[^\}]{99,299}(curl_)setopt(\(\$\w{1,40}),\h*curlopt_url,\h*\27\);[^=]{99,299}(\$\w{1,40})\h*=\h*\28exec\29\);\s*\28close\29\);\s*\30\h*=\h*preg_replace\(['"]\W<(?:script|style)[^#]{1,299}echo\s*['"]<(\w{1,40})>['"][\h\.]+\30[\h\.]+['"]</\31>['"];\s*\}(?<X2129945>)|\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1153530>))|\(!isset(?:\(\$[O_\d]{2,12}\)\)\{global\$[O_\d]{2,12};\$[O_\d]{2,12}=\d+;\$[O_\d]{2,12}=strtolower\((\$_SERVER\[)[^\}]{99,999}if\(isset\(\34['"]REMOTE_ADDR['"]\]\)==true[^\{]{1,60}\{(\$[O_\d]{2,12})=base64_decode\(['"]aHR0[^\}]+(\$[O_\d]{2,12})=(curl_)init\(\35\);\}\}[^\}]{9,199}\}\37close\(\36\);\}(?<X1157651>)|\h*\(\$_COOKIE\[['"](dolly_password)['"]\]\)\)\s*\{\s*echo\h+['"]<(script)\h+src\h*=\h*[^_]{2,20}/\39\.php>\s*</\40>['"];\s*(?:die|exit)[^;]{0,9};\s*\}\s*function\h+decode\h*\((?<X2175990>))|\((?:\h*[ms](?:d|ha)[1256]{1,3}\h*\(){2,}\h*(?:\w{1,40}\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+\{\s*setcookie\h*\(\h*['"](\w{1,40})['"]\h*,\h*[ms](?:d|ha)[1256]{1,3}\h*\([^\176]{99,999}['"]\42['"][\s\)]+\{\s*@[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^;]+;\s*\}(?<X1172420>)|\((?:\h*\$_GET\h*\[\h*['"](?:main_page|action)['"]\h*\]\h*\D{2,3}\h*['"](?:login|process)['"](?:\h*\D{2,3})?\h*){2}\)\s*\{[^\}]+(\$\w{1,40})\h*\.?=[^;]{0,40}\$_POST\h*\[['"]password['"]\h*\][^;]{0,40};[^\}]+(\$\w{1,40})\h*=[^;]{0,99}\44[^;]{0,99};\s*@?mail\h*\([^;\)]+,\h*['"]?\45['"]?\h*\)\h*;\s*\}(?<X1163390>)|\((?:\h*stri?str\h*\(\h*\$_SERVER\[['"]HTTP_REF[^\]]+\][\h,]+['"](?:goo|bin|yah|msn|bai)\w{0,6}['"][\h\)]+\|{0,2})+\)\s*\{\s*(echo)\h+['"]<(script)(?:\h+language\h*=\h*\S{1,40})?\h*>[^;]{0,9};\s*\47\h+['"]location\.href\h*=\h*['"]http[^;"']{1,99}/\w{1,40}\d+\.js\b[^;]+;\s*\47\h*['"]\h*</\48>[\h'"]+;\s*\}(?<X1168630>)|\((?:isset\()?\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)?\s*\{\s*echo\h*['"][^'"]{1,50}['"]\h*\.php_uname\(\)\h*\.['"][^\{]{9,299}\bif\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\D{2,3}\h*['"]?upload['"]?\h*\)\s*\{\s*if\(@?(?:copy|array)\(\$_FILES\[[^\}]{9,99}\}\s*else\s*\{\s*echo\h*['"][^'"]{0,50}['"];\s*\}\s*\}\s*\}(?<X1157632>)|\((\$_[GPRSC]\w{2,6})\)\s*\{\s*(\$\w{1,20})\h*=\h*\51\[[^\]]+\];\s*(\$\w{1,20})\h*=[^\(]{20,150}(\$\w{1,20})\h*=\h*wp_authenticate\(\52\h*,\h*\53\);\s*\$\w{1,20}\h*=\h*\54->allcaps;[^%#\^&\*]{99,600}\bfunction_exists\(['"](file_get_contents)['"][\)\{\s@]+\$\w{1,20}\h*=\h*\55\([^\)]+\);(?:\s*\}){3}(?<X1152891>)|\((\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\s*\{\s*(\$\w{1,15})\h*=\h*\57;\s*(\$\w{1,15})\h*=\h*md5\(sha1\(\58\)\);\s*if\h*\(\h*\59\h*\D{2,3}\h*['"]\w{32}['"]\)\{\s*\$_SESSION\[[^\]]+\]\h*=\h*\d;\s*\}\s*\}(?<X1157680>)|\((array)_key_exists\h*\(['"]article['"],\h*\$_[GPRSC]\w{2,6}\)\)\s*\{\s*\$(\w{1,9})\h*=\h*get_load_path\h*\(\);\s*require_once\h*\(\$\62\);[^\{]{1,99}(\$\w{1,9})\h*=\h*wp_insert_post\h*\(\61[^\{\}]{0,499}\{\$\w{1,9}\h*=\h*get_permalink\(\63\);[^\?]{0,499}echo\h*['"][^;\$]+\$\w{1,40}#\\n['"];\s*\}\}(?<X1189022>)|\((file\h*\(['"]/etc/(?:passwd|shadow)['"]\))\)\s*\{\s*\$\w{1,20}\h*=\h*\65;[^\?>#\*]{99,600}\bif\h*\((\$\w{1,20})[^\)]+\)\s*\{\s*(r_scandir)\h*\(\$\w{1,20},\66\);[\s\}]+\bfunction\h+\67\((?<X2189410>)|\((isset)\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\W{2}\h*\69\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[^\}]{9,150}(\$_\w{1,15})\h*=\h*tempnam\h*\(['"]/tmp['"],[^\?]{99,1500}\bfopen\h*\(\71,\h*['"]\w['"]\h*\);\s*fwrite\h*\(\$_\w{1,15},\h*['"]<\?php\h*['"][\h\.]+gzuncompress\h*\(base64_decode\h*\(\70(?<X2196751>)|\((isset\h*\()(\$_SERVER\[)[^\]]+\]\)\W{2,4}!?\73\$_COOKIE\[['"]dataserk?["']\]\)[^\{]{9,40}\{\s*\$\w{1,20}\h*=\h*\74[^\(\)]{9,99}\$\w{1,20}\h*=\h*(base64_decode)\h*\([^<\*\\]{999,5000}\bheader\h*\(\75\h*\([^;]{9,50}\);(?:\s*\}){3}(?<X1170081>)|\(@(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\)@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(@\77\);(?<X1157441>)|\([^;\{]*\bmd5[\h\(]+\$_[GPCSR]\w{2,6}\[[^\{;]+\{[^\}\{]+\busername_exists[\h\(]+['"]([^'"]+)['"][\s\)]+\{\s*(\$\w+)[\s=]+wp_create_user[\h\(]+['"]\79['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\80[\s\)]+;\s*\81\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;(?:\s*\};?){2}(?<X1208700>)|\([^\);=\{\}]{0,99}\$_[GPCSR]\w{2,6}\[[^\]]+\][\h\)]+@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\(\h*@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*\)\h*;(?<X1189280>)|\([^\)]+\)\s*\{\s*\$\w{0,5}bot\h*=\h*['"]Is\h*Cloak\W{2,5}\bto\h*scam\b[^\}]{9,99}\}\s*if\h*\(isset\h*\((\$_[GPRSC]\w{1,20}\[['"]keyword['"]\])\)\)\s*\{\s*\$\w{1,20}\h*=\h*\84(?<X2183370>)|\([^\)]{0,99}\$(_[GPCSR]\w{2,6}\[[^\]]+\])\h*\)\s*[^\s\d]{2,3}\s*function_exists\h*\(([^\)]{0,99}\$\86)\h*\)\s*\)\s*call_user_func\h*\(\87\h*\);\s*(?:die|exit)[^;]{0,19};(?<X1165552>)|\([^\)]{0,99}\$_[GPCSR]\w{2,6}\[[^\};]{1,99}\bunlink\h*\(\h*__FILE__\h*\);[^\?]{1,999}\bif\h*\([^\)]{0,99}(\$_FILES\[)[^\}]{1,499}\b[cm]o(?:py|ve_uploaded_file)\h*\(\h*\89(?<X2184210>)|\([^\{;]{0,99}\$_[GPCSR]\w{2,6}\b[^\{;]{1,99}\)\h*(?:\{\h*)?@?call_user_func(?:_array)?\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*,\h*(?:\[|array\h*\()?(?:\$_[GCPSR]\w{2,6}\[[^\]]+\][\h,]*){1,}[\]\)\h]+;(?<X1192342>)|\([^\{\}]{1,99}\{\s*header\(['"]HTTP/1\.[01]\h+40[34]\b[^;]{1,99};\s*(?:die|exit)[^;]{0,19};[^@]{9,199}\$[^=]{1,40}=\h*['"]FilesMan\b(?<X2153461>)|\(\$(anonym)ouse?\)\s*\{\s*@?(?:include|require)[^;\.]{2,9}\93\.php[^;]{0,9};\s*\$\w{1,20}\h*=\h*rand\93\((?<X2170440>)|\(\$_[GPRSC]\w{2,6}\[[^\]]+\](?:\)\{\s*if\h*\(@?(?:copy|move_uploaded_file)\(\$_FILES\[[^#]{99,400}\bPavPal</title>(?<X2156570>)|\W{2,4}['"]?([^'"\)]+)['"]?\)\s*\{\s*\$_SESSIOn\[['"]rootkit['"]\]\h*=\h*\96;(?<X2164820>)|\W{2,4}['"]wp_ajax_try_\d+_v\d+['"]\)\s*\{\s*if\h*\(!?empty\h*\((\$_[GPRSCF]\w{2,6}\[[^\]]+\])\)[^@\};]{9,200}@?[mcf](?:ove_uploaded_file|opy|ile_get_contents)\(\98[^\)]*\);[^\?>]{9,300}\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1165570>))|\(\$xCheck_login\)\s*\{[^\{]{0,99}\$xPassword\)\s*\{\s*die\(['"]\D{9,99}<title>\h*404\h*Not\h*Found\b(?<X2145900>)|\(\h*!((\$this\h*\->)\h*\w{33}\h*\->\h*)bot\h*(\D{2,3})\h*!\101unbot\h*\103\h*!\102\h*\w{33}\h*\(\h*\)\h*\)\s*\{\s*echo\h+\101\h*data\h*\->\h*script\h*\->\h*data\h*;[^#%\*]{999,9999}\bnew\h+\w{33}\h*\(\h*\);\s*\}\s*//\h*\w{32,33}\s*\Z(?<X2179311>))
\bif\h*(?:\(\h*!(function)_exists\h*\((?:['"](logthishit)['"]\)\)\s*\{[^\{]{0,150}\b\1\h+\2\h*\([^\)]+\)\s*\{[^#%`]{999,20000}\$\w{1,20}\h*=\h*['"]\w{1,20}@yandex\.(?:com|ru)['"];(?<X1165830>)|\h*['"](\w{1,40})['"][\h\)]+\{\1\h+\4\([^;\}]+;\s*for\h*\([^\}]+\}[^\}]{0,99}\}\s*(\$\w{1,40})[\h=]+['"][^'"]{999,}['"];\s*(\$\w{1,40})[\h=]+['"]\4['"];\s*(\$\w{1,40})[\h=]+\6\(['"][^'"]{3,99}[=\+]['"]\);\s*(\$\w{1,40})[\h=]+\7\(["']{2}\h*,\h*\6\(\5[^;]+;\s*@?\8\(\);\s*\}(?<X1187851>))|\(\h*!?\h*(?:(function)_exists\h*\(['"](sorry_\10)['"]\)\)\s*\{\s*\10\h+\11\h*\(\h*\$\w{1,20}\h*\)\h*\{\s*if\h*\(\h*is_user_logged_in\h*\([\)\s]+\{[^\-\?\[\]]{9,150}\}\s*add_filter\h*\(\h*['"][^'"]{1,20}['"]\h*,\h*['"]\11['"]\h*\);\s*\}(?<X1164041>)|isset\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+\S{2,3}?[^;\{]{1,99}\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;(?:\s*(?:die|exit)\b[^;]{0,19};)?\s*\}(?<X1173491>))|\(\h*!?file_exists\h*\(['"](/(?:home|var|www)[^\)'"]+\.html?)['"]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(file_)ge(t_contents)\h*\(['"]https?://(?:paste|ghost)bin\.com/raw/[^'"]{1,40}['"]\);\s*\16pu\17\h*\(\h*['"]\14['"]\h*,\h*\15\);\s*\}\s*else\s*\{[^\}]{0,60}\}(?<X1188481>)|\(\h*!?isset\h*\((\$_[GPRSC]\w{2,6}\[['"](?:pass|password|passwd|psw|pwd)['"]\])\)\)\h*([^;&=!]{3,40})\h*=\h*md5\(\19\);\s*if\h*\(!\(\20\)\)\s*die\(\);\s*@?eval\(cipher\(base64_decode\((?<X2152090>)|\(\h*!\$(?:_(COOKIE)\s*\[\s*(base64_decode)\s*\(\s*['"][^'"]*['"]\s*\)\s*\]\s*\)\s*\{\s*set\22\s*\(\s*\23\s*\([^;]+;\s*echo\s*\23\s*\(\s*['"]PHNjcmlwdD53aW5kb3cubG9jYXRpb24ucmVwbG[^'"]+['"]\s*\)\s*\.\s*['"]http[^'"]+['"]\s*\.[^;]+;\s*\}(?<X1188630>)|IS_CONFIGURED\h*\)\h*\{\s*\?>\s*<!DOCTYPE\h*html>[^\?]{1,150}<(title)>\h*Web\h*Console\h*\</\25>(?<X2170691>))|\(\h*!\h*(?:(file_)exists(?:[\(\h]+['"]([\./]*[^'"/]{1,40}\.php)['"\s\)]+\{\s*(\$\w{1,40})[\h=]+(\27ge(t_contents))[\h\(]+['"](http[^'"]{9,40}\.(?:txt|html))['"\)\s]+;\s*\27pu\31[\h\('"]+\28['",\h]+\29[\)\h]+;[\s\}]+else\s*\{[^\}]+\29[=\h]+\30[\h\('"]+\32['"\)\h]+;\s*\27pu\31[\('"\h]+\28['",\h]+\29[\)\h]+;(?:\s*\}){2}(?<X1189160>)|\h*\(\h*(['"]/home\d*/[^'"]{4,99}\.php['"])(?:\s*\)){2}\s*\{\h*\27put(_contents)\h*\(\h*\34\h*,\h*\27get\35\h*\(\h*['"]https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"][\s\)]+;\s*\}(?<X1164532>))|(function)_exists(?:[\s\(]+['"](sorry_\37)['"][\s\)]+\{\s*\37\s*\38[\s\(]+\$\w{1,40}[\s\)]+\{\s*if[\s\(]+is_user_logged_in\(\)[\h\)]+\{[\s\}]+else[\s\{]+if[\h\(]+is_[ps][^;]+\becho\h*['"]\\[\d\\xa-f]{99,999}['"]\h*;(?:\s*\}){3}\s*add_action[\h\(]+['"]wp_footer['"]\h*,\h*['"]\38['"][^;]{0,9};\s*\}(?<X1178910>)|\h*\(\h*['"](?:(\w{1,40})['"][\s\)\{]+\37\h*\40\h*\([^;\{\}]{0,49}\{[^\}]{9,999}\}\s*return[^\}]+\}\s*(\$\w{1,40})[\h=]+['"][^'"]{99,}['"];\s*(\$\w{1,40})[\h=]+['"]\40[^\}]+(\$\w{1,40})[\h=]+\42[\h\(]+['"][^\}]+(\$\w{1,40})[\h=]+\43[\h\(]+['"]{2}[^;'"]+\41[^;]+;\s*@?\44[\(\)\h]+;\s*\}(?<X1189190>)|(DSAGdfg_)['"][\s\)\{]+\37\h*\46\h*\(\)\s*\{[^\?:>]{599,3500}\beval\h*\(\h*\46\w{1,15}\h*\(\h*\$\w{1,15}\h*\[\d\][\)\h]+;\s*break;(?:\s*\}){4,}(?<X1189122>)|(sorry_\37)['"]\)\)\s*\{\s*\37\h*\48\((\$\w{1,15})\)\s*\{\s*if\h*\(\h*is_user_logged_in\([^\?]{99,1500}\belse\s*\{\s*(\$\w{1,15})\h*=\h*\49;\s*\}\s*return\h*\50;[\s\}]+\}(?<X1173851>)))|\(\h*preg_match\h*\(\h*['"]/resetpass/['"]\h*,[^;]{1,99}\)[^@]{1,99}\$\w{1,40}\h*=\h*@?getcwd\(\);[^\?\*\>]{1,999}(?:\s*\$\w{1,40}\h*=\h*@?(?:get_current_user|getmyuid|getmygid|posix_get\w{4})\b[^;]+;){2}(?<X2163070>)|class(?:(_exists)\h*\(\h*['"](?:[^'"]{1,40}['"][\s\)]+\{\s*if\h*\(\h*@file\53\h*\(['"](/home\d*/[^'";]{9,99}\.(?:jpe?g|gif|png|ico))['"][\s\)]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\54[\$\}\)'"]{1,3};(?:\s*\}){2}(?<X1155580>)|WPPlugingsOptions['"]\h*\)\s*&&\h*file\53\h*\(\h*([^\}\{;]{9,99})\)\h*\)\s*\{\s*@?include_once\h*\(\h*\56\h*\);\s*\}(?<X1157970>))|_exists\h*\(\h*['"](RMSActivationRemoteHandler)['"]\h*\)\h*\)\s*\{\s*class\h+\58\s*\{(?<X2157800>))|empty\h*\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*)(?:\)\s*){2}\{\s*(\$\w{1,40})\h*=\h*@?popen\h*\(\h*\60\h*,[^;]{1,49};\s*echo\h*fread\h*\(\h*\61\h*,\h*\d+\h*\);\s*pclose\h*\(\h*\61\h*\)\h*;\s*\}(?<X1165140>)|function_exists\h*\(\h*['"]do_rms_activation_task['"]\)\)\s*\{\s*[^\[]{0,99}\$GLOBALS\[['"]rms_report_to['"]\]\h*=\h*['"]https?://managerly\.org/[^'"]{1,50}['"];(?<X2157790>)|isset\h*\(\h*(\$_session\h*\[[^\]]+\])[\)\s]+\{\s*(\$\w{1,10})\h*=\h*(curl)_init\h*\(\h*\)\h*;\s*\66_setopt\h*\(\h*\65\h*,\h*\66opt_url\h*,[^\}]{1,150}\s*\64\h*=\h*\66_exec\h*\(\h*\65\h*\)\h*;[^\}]{0,20}\}\s*@?eval\h*\(\h*(?:base64_decode\h*\(\h*)?\64\h*\)\h*;(?<X1173092>))|\(\h*!class(_exists)[\h\(]+['"]WPTemplatesOptions['"][\h\)]+[^\d\s_]{2,3}\h*function\68[\h\(]+['"](wp_get_theme)s['"][\s\)]+\{[^\;\{]+\{\s*(\$\w{1,40})\h*=[^;]+\{\$\69\-\>\w+\}\.php['"];\s*if[\h\(]+file\68[\h\(]+\70[\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?[\('"\h]{0,3}\70[\)'"\h]{1,3};(?:\s*\}){3}(?<X1155400>)|\(\h*!defined(?:(\(['"]WP_LOAD_CHECK_MODULES)['"][\)\s]+\{[^\}]{1,499}\bdefine\72['"][\h,]+1[\h\)]+;[^\?]{999,1499}@file_put_contents\([^;]+\.\h*\$wp_write[,\h]+FILE_APPEND[\)\h]+;\s*\}(?<X1176620>)|\(['"]WP\w{0,40}['"][\h\)]+\{\s*@?include_once\h+['"]\w{1,40}\.(?:png|jpe?g|ico)['"];\s*\}(?<X1183080>)|\h*\(\h*['"]REMOTING_INJECTED['"][\s\)]+\{[^%]{999,14500}\bexit\h*\(\h*str_replace\h*\(\h*['"]<[RESPON_]+>['"],\h*['"]{2},\h*\$\w{1,15}[\s\)]+;\s*\}[^\\]{999,8500}\bget_s_contents\h*\([^\);]+\burlencode\h*\(\h*\$client[\)\s;\}]+\}(?<X1194925>))|\(\h*!function_exists\h*\(['"](?:(themes_\w{1,40})['"]\)\)\h*:[^\$]{1,499}\$\w{1,40}\h*=\h*array_merge\h*\((?:\h*\$_[RSC]\w{2,6}\h*,?){3}\)\h*;[^@]{99,999}(\$\w{1,40})\h*=\h*\77\(\h*['"]{2}\h*,\h*@?\$\w{1,40}\([^\)]+\)+;[^\-]{99,499}\badd_action\h*\(\h*\$\w{1,40}\h*,\s*['"]\76['"]\h*,[^;]{1,40}\);\s*endif;(?<X1160381>)|(wp[\-_]v?cd)['"][\)\s]+\{[^\^]{999,9999}\bfunction\h+\79\h*\([^@]{999,1599}@isset\h*\(\h*\$mtchs\h*\[\d+\]\)+\s*\{\s*@?fwrite\h*\([^@]{1,99}if\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*@include\h*\(\h*\$\w{1,40}\h*\)\h*;(?:\s*\}){2}(?<X1140440>))|\(\h*!isset\h*\(\h*(?:(\$GLOBALS\h*\[['"]VfQ9EN['"]\])[\s\)]+\{\s*\81\h*=\h*\d;\s*\$\{[^\n]{9999,20000};@\$\{[^\}]{9,150}\}\(\$\{[^\}]{9,99}\}\);\}(?<X1189600>)|(\$GLOBALS\h*\[[^\]]+\])[\s\)]+\{\s*\83\h*=\h*\d[\s;]+function\h*(\w{1,15})\h*\([^\?]{999,2999}(\$_\d{1,3})\h*=\h*\84[^\}\?]{1,999}\bfile_put_contents\h*\(\85,\h*['"]WP\+\+[^\?]{99,3000}\bunset\(['"]wp_setting_init_global['"][^\)\}]{99,899}\bmt_rand['"][\)\s;]+;\s*\}(?<X1189551>))|\(\h*(!?isset\h*\(\h*\$_[GPRSC]\w{2,6})\h*\[[^\]]+\][\)\h]+\W{2,4}\h*\87\[[^\]]+\][\)\s]+\{\s*@?setcookie[^;]{1,99};\s*@?header\h*\(\h*['"]location:\h*https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[^'"\?;]{0,49}/\?\w{1,9}\h*=[^;]{1,16};\s*\}(?<X1173712>)|\(\h*((\$_[GPCSR]\w{2,6})\[[^\]]{1,40}\])[\h=!]{2,9}\89\h*\)\h*\{\h*extract\h*\(\h*\90\h*\)\h*;\h*u[ak]?sort\h*\(\h*\$\w{1,40}\h*,\h*\$\w{1,40}\h*\)\h*;\h*\}(?<X1134180>)|\(\h*(?:!?\h*[ie](?:sset|mpty)\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\h*@?preg_replace\h*\(\h*.?['"](.).{0,40}\92(?:\\x65|e|\\145)\w?.?['"]\h*,\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*,\h*['"][^'"]{0,9}['"]\h*\)\h*;(?:\h*(?:exit|die)\b[^;]{0,9};)?\h*\}(?<X1164310>)|\(\h*(?:(?:md|sha)[1256]\h*\(\h*){3,}@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\D{2,3}\h*['"][^'"]*['"][\s\)]+\{[^\}]+(?:\s*echo)?\s*@?(?:eval|assert)\s*\(\s*\w{4,24}\s*\(\s*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;[^\.]{1,999}\.\h*php_uname\h*\((?<X2166410>)|\(\h*(?:(?:md|sha)[2561]{1,3}\s*\(\s*)+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\S{2,3}\h*['"][^'"]{1,40}['"][\)\s]+(?:die|exit)\s*\(\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)(?:\s*\(\s*(?:stripslashes|base64_decode|gzuncompress)){1,}\s*\(\s*\$_[GPCSR]\w{2,6}\s*\[[^\]]+\][\s\)]+;(?<X1186310>))
\bif\h*(?:\(\h*(?:isset\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]{0,99}\{[^,]{0,99}(file_)pu(t_contents)[\h\(]+['"](?:/home\d*/[^/]+/[^'"]+/)?[\w\-]{1,12}\.php['"\h,]+\1ge\2[\h\('"]+https?://raw\.githubusercontent\.com/[^'"]{1,99}(?:shell|xploit|cmd|root|shell|crack|anon|fake)[^'"]{1,99}\.php['"][\)\h]+;\s*\}(?<X1185552>)|\(\h*(?:md5\h*\(\h*)?\$_[GPRSC]\w{1,20}\[[^\]]+\]\h*\W{2,4}\h*['"]\w{20,50}["']\h*\)@?eval\h*\(\h*base64_decode\h*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\)\h*\)\h*;(?<X1164673>)|\(\h*(?:md|sha)[1256]{1,3}\h*\(\h*(?:trim\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\W{3,9}['"]\w{1,40}['"][\s\)]+\{\s*(?:echo\h+)?@?(?:eval|assert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][^;]+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1165610>)|\(\h*(\$\w{1,40})\h*==\h*['"]root['"][\)\s]+\{\s*(\$\w{1,40})\h*=\h*['"]/['"][\h\.]+\6[\h\.]+['"]/\.accesshash['"]\h*;\s*(\$\w{1,40})\h*=\h*getcwd[\h\(\)]+;\s*(\$\w{1,40})\h*=\h*\6[\h\.]+['"][^'"]{1,40}['"]\h*;\s*if\h*\(\h*is_readable\h*\(\7[\s\)]+\{\s*copy\h*\(\h*\7\h*,[^;]{0,40}\8[^;]{1,40}\9[^;]+;(?<X2158691>)|\(\h*(\$\w{1,40}\[)[^\)]+\)\s*\{\s*(\$\w{1,40})\h*=\h*Array\(\s*['"]\w{1,9}['"]\h*=>\h*@?phpversion\(\)[^;]{1,99};\s*echo\s*@?serialize\h*\(\h*\12\h*\);\s*\}\s*elseif\s*\(\h*\11[^\)]+\)\s*\{\s*@?eval\h*\(\h*\11[^;]{1,99};\s*\}\s*(?:die|exit)[^;]{0,19};\s*\}\s*(?:\?>\s*)?\Z(?<X2160641>)|\(\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])\h*\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*@?(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*\(\h*\14[^;\$\(\v]{1,16};\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1140891>)|\(\h*(\$_[GPRSC]\w{2,6})\s*\)\s*\{\s*(\$\w{1,40})\h*=\h*\16\[[^\]]+\];\s*(\$\w{1,40})\h*=\h*\16\[[^\]]+\];[^\}\->\{]+(\$\w{1,40})\h*=\h*wp_authenticate\((?:\h*(?:\17|\18)\h*,?){2}\);\s*(\$\w{1,40})\h*=\h*\19\->allcaps;\s*\$\w{1,40}\h*=\h*\20\[[^\}]+\}\s*\}(?:\s*else[^\}\{]{1,99}\{[^\}]+\}(?:\s*\})+)?(?<X1161690>)|\(\h*(\$_[GPRSC]\w{2,6}\[['"])\wshell['"]\]\h*\D{2,3}\h*['"]\d{1,3}['"]\h*\)\s*\{\s*if\h*\(\h*\22[^\]]+\]\h*\D{2,3}\h*['"]\d{1,3}['"]\h*\)\s*\{\s*\$\w{1,15}\h*=\h*file_get_contents\([^\)]+\.php['"]\);(?<X2174560>)|\(\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*(?:!=\h*(?:['"]{2}|null)\h*\)\s*\{\s*@?eval\h*\(\h*\24\h*\)\h*;(?:\s*(?:die|exit)\b[^;]{0,9};)?\s*\}(?<X1164910>)|\W{2,4}\h*md5\(\24\)\h*\D{2,3}\h*['"]\w{32}['"]\h*\)\h*\{\h*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\)\h*;\h*\}(?<X1164612>))|\(\h*(\$_FILES\[['"]\w{1,9}['"]\])\s*\)\s*\{\s*@?[cm]o(?:ve_uploaded_file|py)\h*\(\s*\27\s*\[\s*['"][^'"]+['"]\s*\]\s*,\s*\$_[GPRC]\w{2,6}\[[^\]]+\]\h*\)\s*;[^;]{1,49};\s*(?:exit|die)\b[^;]{0,19};\s*\}(?:\s*;)?(?<X1184381>)|\(\h*(isset)\h*\(\h*(\$_([GPRSC]\w{2,6})\[)([^\]]+)\]\h*\)\h*or\h[^\{]{1,40}\{\s*if\h*\(\h*!\29\h*\(\h*\30[^\]]+\][\)\s]+set\31\(\32,[^;]+;\s*@?eval\h*\(\h*(?:@?(?:gz(?:inflate|uncompress)|base64_decode|str_rot13)\h*\(\h*){1,5}file_get_contents\h*\(\h*['"]https?://\w[^;]+;\s*(?:die|exit)\b[^;]{0,9};\s*\}(?<X1162751>)|\(\h*@?(?:copy|move_uploaded_file)\(\$_FILES\[[^\?]{9,299}\bif\h*\(\h*isset\(\$_[GPRSC]\w{2,6}\[['"]cmd['"]\][\)\s]+\{\s*echo\h*['"](?<X2173610>)|\(\h*@?(?:md|sha)[1256]{1,3}\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*\D{2,3}\h*['"][a-f0-9]{32,128}['"][^/\}]{1,199}\b[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?:\s*echo[^;]+;)?(?:\s*(?:die|exit)\b[^;]{0,9};)?\s*\}(?<X1167103>)|\(\h*@?[mc]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^\?]{1,199}\becho\s*['"]<script\b[^>]{0,99}>\s*alert\h*\([^\?]{1,199}\becho\s*['"][^;]{1,99}['"]\h*\.\h*php_uname\(\h*\)(?<X2168610>)|\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\S{2,3}\h*['"]\w{0,40}['"][\s\)]+\{\s*@?[ps](?:assthru|ystem|hell_exec)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\h]+;\s*\}(?<X1185101>)|\(\h*@?\bcopy\(\$_FILES\[['"][^&]{99,4000}\b(?:paste|ghost)(?:bin)?\.(?:com|se)[^#]{9,60}\bDownload\h*Mini\s*Shell(?<X2153441>)|\(\h*@?mail\h*\((?:\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])\h*,){2}[^;]{1,99}\bimplode\h*\([^>_@]{1,99}\{\s*\$\{\$\{['"]GLOBALS['"]\}\[[^\]]+\]\s*\}\s*=\h*json_encode\s*\(\s*array\s*\(\s*['"]subject['"]\s*=>\s*\39(?<X2142962>)|\(\h*@\$_[GPSRC]\w{2,6}\[[^\]]+\]\h*==+\h*['"]login['"]\h*\)\s*(?:\{\s*@?mail\h*\(\h*['"][^'"@,\);]+@(?:(?:g|proton|hot)mail|ya(?:hoo|ndex)|live|aol)\.[^;]{1,99};\s*header\h*\(\h*['"]Location:\s*\w{1,19}\.html?['"]\h*\);\s*\}\s*(?:else\s*)?){2}(?:\?>\s*)?\Z(?<X2167420>)|\(\h*@is_file\h*\(\h*(?:(['"]\./tmp/['"]\h*\.\h*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*\.\h*\$\w{1,15})[\)\s]+\{\s*(include)\h*['"]\w{1,15}\.txt["'];\s*\43\(\42\);[^\?]{0,199}\?>\s*<!doctype\h*html>(?<X2177471>)|['"]([^'"]{5,49}\.(?:gif|jpe?g|png|ico|bmp|txt))['"][\)\h]+\{\h*@(?:require|include)_once\h*\(\h*['"]\45['"]\h*\);\h*\}(?<X1176541>))|\(\h*\$_[GPRSC]\w{2,6}\[(?:[^\]]+\]\W{2,4}['"]shell\d['"]\h*\)\s*\{\s*echo\h*["'][^\*%@]{99,400}\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\h*\$_[GPRSC]\w{2,6}\[[^\]]+\][^\)]{0,9}\);\s*foreach\h*\([^\)]+\)\s*\{[^\(\)]{9,99}['"];\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1164771>)|[^\{]+\{\s*\w{1,40}[\h\(]+['"](/tmp/bc\d*\.pl)['"][^;]+;\s*\$\w{1,20}\h*=\h*\S{1,99}[\h\(]+['"]perl\h*\48\b(?<X2183761>))|\(\h*\$_(?:[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\h\)]+\{\h*@?extract\h*\(\h*\$_[GPRSC]\w{2,6}\h*\)\h*;\h*(?:die|exit)\h*\(\h*\$\w{1,40}\h*\(\h*\$\w{1,40}[\)\h]+;\h*\}(?<X1174650>)|\h*<>\h*['"]{2}\h*\)\s*(?:die|exit)\h*\(\h*['"](\w{1,9})['"]\h*\)\h*;[^;]{1,199}\bfile_put_contents\h*\(\h*['"][^'"]{1,40}\.php['"]\h*,\h*['"](?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])+['"]\h*\)\h*;[^\?]+echo\h*['"]\51\w{0,9}['"];[^\}]{0,40}\}\s*else\s*\{\s*echo[^\}]{1,99}\}(?<X1174020>)|\W{2,5}['"][^'"]{1,40}['"][\s\)]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"]wget\h+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"\s]{1,40}\b\h+\-O\h+([^\s'"]{1,40})['"][\h\)]+;\s*\$\w{1,40}\h*=\h*fopen\h*\(\h*['"]\53['"](?<X2167981>))|SERVER\[['"]REQUEST_METHOD['"]\]\h*[^\s\d]{1,3}\h*['"]GET['"]\h*\)\s*\{\s*(?:echo|print)\s*(?:\(\s*)?['"][^;]{1,199}<title\b[^>]{0,99}>\s*40[345]\b[^;]{1,199};\s*(?:die|exit)[^;]{0,19};\s*\}[^\?><]{1,1500}=\h*new\h+geoPlugin\h*\(\h*\)\h*;(?<X2165532>))|\(\h*\$bannermass\h*==+\h*\$get_url_var[\h\)]+\{\s*\$set_cookie\h*\(\h*(?:stripslashes\h*\(\h*)?\$check_category\h*(?:\)\h*){2};[^\}\$\(;@]{1,19}\}(?<X1164301>)|\(\h*\$cloacked_page\h*\)\s*\{\s*if\h*\(\h*\$is_bot\h*\)\s*\{\s*(?:@?send_nocache_headers\h*\(\h*\)\h*;\s*)?showDoorPage\h*\(\h*\$page_file\h*\)\h*;(?<X2144021>)|\(\h*\$ip(?:hone|od)(?:\h*\|\|\h*\$\w{1,40}\h*)+===\h*true\h*\)\s*\{\s*@?header\h*\(\h*['"]Location:\h*https?://[\w\-\.]{2,40}\.ws/?['"]\h*\)(?:\h*;)?\s*\}(?<X1156090>)|\(\h*do_backdoor\h*\(\h*\$\w{0,9}path[\)\s]+\$\w{1,40}\h*=\h*(?:true|false|null)\h*;(?<X2179760>))
\bif\h*(?:\(\h*fil(?:e_exists(?:\(\h*['"](wp\-login\.php)['"][\s\)]+\{\s*(\$\w{1,40})\s*=\s*file_get_contents\(\h*['"]\1['"]\h*\);\s*(\$\w{1,40})\h*=[^;]{999,4999};\s*\2\s*=\s*str_replace\h*\(\h*['"]wp_safe_(redirect)\(\$\4_to\);['"]\h*,\h*base64_decode\(\h*\3\h*\)\h*,\h*\2\h*\)\h*;(?<X2143440>)|\h*\(\h*(?:(((?:plugin_dir_path)\h*\(\h*__file__\h*\)|get_template_directory\h*\(\h*\))\h*\.\h*['"]/\.['"]\h*\.\h*basename\h*\(\h*\7\h*\)\h*\.\h*['"]\.php['"])\h*\)\h*\)\s*\{\s*(?:includ|requir)e(?:_once)?\h*(?:\(\h*)?\6\h*(?:\)\h*)?;\s*\}(?<X1169352>)|(get_template_directory\h*\(\))\h*\.\h*(DIRECTORY_SEPARATOR)[\.\h'"\.]+(basename)\h*\(\9\)[\.\h'"\.]+php['"][\)\s]+\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\('"]{0,3}\9\h*\.\h*\10[\.\h'"]+\11\h*\(\9\)[\.\h'"\.]+php[\)'"]{1,3};\s*\}(?<X1155390>)|['"](/(?:var/)?tmp/\w{1,12}\.pl)['"][\s\)]+\{\s*unlink\h*\(['"]\13['"]\);\s*\}\s*\$\w{1,40}\h*=\h*fopen\h*\(['"]\13['"]\h*,\h*['"][aw]\+?['"]\h*\)\h*;[^\.&]{1,99}[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(['"]perl\h+\13\h*\$\w{1,9}\h*\$\w{1,9}\h*&(?<X2156891>)))|ter_(input)\h*\(\h*\15_[GPSCE]\w{2,6},[^\{]{9,70}\{\s*require\h*\(\h*\$_SERVER\[['"]DOCUMENT_ROOT['"]\]\h*\.\h*(strrev)\h*\(\h*['"]php\.[^\)]{5,25}\)[\h\)]+;\s*\16\h*\(\h*['"]eikooc_htua_tes_pw['"]\h*\)\h*\(\h*\d+\h*[^\s\w]\h*\d+\h*\)\h*;\s*\}(?<X1168800>))|\(\h*function_exists\h*\((?:['"]((curl_)init)['"][\)\s]+\{\s*(\$\w{1,20})\h*=\h*\18\h*\((['"]https?://www\.\w{1,20}\.\w{2,6}/\w{1,10}\.php[^;]{99,499};)\s*\19setopt\h*\(\20,\w+,[^;]+;[^\{]{1,299}\{\s*echo\h*file_get_contents\h*\(\21[^\{]{1,99}\{\s*assert\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?:\s*\}){2}(?<X1172921>)|\h*['"](is_user_logged_in)['"][\s\)]+\{\s*if\h*\(\h*!\h*\23\h*\([\s\)]+(@?add_action\h*\()\h*(?:(\w{1,40})\h*\([^\)]+\)\h*,\h*){2}mt_rand\h*\(\h*(?:round\h*\(\h*0(?:\h*\+\h*(?:\d+\.)?\d+\h*)+\)(?:\h*,)?\h*)+\)[\h\)]+;\s*\}(?:\s*else\s*\24(?:\25\h*\([^\)]+\)\h*,\h*){2}[^;]+;)?(?<X1161870>))|\(\h*ini_get\h*\(\h*(?:['"]allow_url_fopen['"][\)\s]+\{\s*function\h+(gets?_data_yo)\h*\([^\+\-]+\27\h*\(\h*wp[_\-][vc]?cd\h*\([^;]+(\$\w{1,40})[\)\h]+;\h*(\$\w{1,40})\h*=\h*@?explode\h*\([^\)]+\28\h*\)\h*;[^\}]{1,40}\29\h*\[\d+\][\)\h]+;(?:\s*\}){4,5}(?<X1149182>)|\\?['"]allow_url_fopen\\?['"]\h*\)\h*\)\s*\{\s*function\h+get_data_ya\h*\([^@]{99,1500}fwrite\h*\(\h*(\$\w{1,40})\h*,\h*\\?['"]\h*<\?php\s*\\?\\\w\W?\$mtchs\h*\[\d+\][^;]+;\s*fclose\h*\(\h*\31\h*\)\h*;\s*@?include\h*(\([^\)]{1,60}\))\h*;\s*@?unlink\h*\32\h*;(?<X1139603>))|\(\h*is(?:_https\s*\(\)\s*\)[^\(]{0,99}\}\s*\$\w{1,40}[=\h]+smrequest_uri\h*\(\);[^\?]{9,499}(\$\w{1,40})['"=\h\.base64_dnco]{20,40};\s*\$\w{1,40}[\h=]+\34\(\$\w{1,40}\);[^#]{99,50000}\bfunction\h*smoutdo\h*\(\h*\$\w{1,40}[\)\s]+\{\s*(\$\w{1,40})[^\}]+\}\s*return\h*\35;\s*\}(?<X1193840>)|set\((?:((\$_[GPRSC]\w{2,6})\h*\[[^\]]+\])(?:\h*\)){2}\s*\{\s*@?(array)_diff_ukey\h*\(@?\39\h*\(\h*(\(string\))\h*@?\38\[[^\]]+\]=>\d\)\h*,\h*@\39\h*\(\h*\40(?:stripslashes)\(@?\38[^\]]+\]\h*\)=>\d\)\h*,\h*@?\37\);\s*\}(?<X1163861>)|\h*(\$_[GPCSR]\w{2,6}\[['"]\w{32}['"]\])\){2}\h*preg_replace\(\h*['"][^'"\v]+['"]\h*,\h*str_rot13\h*\(['"riny\.\h]{6,49}\)\h*\.\h*['"]?\h*\(\h*\42\h*\)\h*['"]?\h*,\h*["'][^'"\v]+['"]\h*\)\h*;(?<X1134131>)|\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*&&\h*substr\h*\(\h*md5\h*\(\h*@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*,\h*\d+\h*,\h*\d+\h*\)\h*==\h*['"]\w{4,64}['"]\h*\)\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;(?<X1153490>))|set\h*\((?:((\$_[GPRSC]\w{2,6}\[)[^\]]+\])\)\W{2,9}(?:\(\s*)?md5\h*\(\45\)\W{2,9}['"]\w{32}['"](?:\h*\))?\W{2,4}isset\h*\((\46[^\]]+\])(?:\s*\)){2}\s*\{?\s*@?eval\h*\(\h*base64_decode\h*\(\h*\47(?:\h*\)){2};\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1164591>)|(\$_[GPRSC]\w{1,20}\[[^\]]+\])\)\W{2,4}isset\h*\((\$_[GPRSC]\w{2,6}\[[^\]]+\])[\s\)]+\{\s*@?array_(?:map|walk)\h*\(\h*(?:\49|\50)\h*,\h*(?:\50|\49)\h*\);\s*\}(?<X1165062>)|(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)\{]+eval\h*\(\h*\w{1,9}\h*\(\h*\52[^\]]+\][\s\)]+;[^\?]{0,99}\binclude\h*['"]\$\w{1,9}/\$_[GPRSC]\w{2,6}\[['"]?SHOWWSO['"]?\]\.php['"];(?<X2196850>)|(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{?\s*@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\(stripslashes\h*\(urldecode\h*\(\h*\54\)\)\);(?<X1164570>)|\$\w{1,40}\h*\[['"]i?s?door\w{0,30}['"]\][\)s]+\{[^\}]{1,299}\becho\h*\$i?s?door\w{0,30}\h*;(?<X2159001>)|\$_[GPRSC]\w{2,6}\[(?:['"][^'"]{0,9}shell[^'"]{0,9}['"]\]\)\)\s*\{[^\{]{9,99}\b\bif\h*\(\h*isset\h*\(\$_[GPRSC]\w{2,6}\[['"]htaccess['"]\]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*["'][^;'"]{9,99}\bDirectoryIndex\h+Sux\.html\s*['"];\s*file_put_contents\h*\(['"]\.htaccess['"],\h*\57\);(?<X2190500>)|[^\]]+\]\)\)\s*\{\s*echo\h*['"][^'"]{1,49}\bXploiter['"];\s*echo[^\.]{0,15}\.\h*php_uname\(\)\h*\.[^\{]{9,199}\{\s*if\h*\(\h*@?\h*(?:array|copy|move_uploaded_file)\h*\(\h*\$_FILES[^\}]{1,99}\}\s*else\s*\{\s*echo\h*['"]gagal['"];\s*\}\s*\}\s*\}(?<X1160440>))|\h*(\$_[GPCSR]\w{2,6}\[)[^\]]+\]\h*\)\h*[^\v\d;\$]{2,3}\h*\60[^\]]+\]\h*==+\h*['"][^'"]+['"][^\)]{0,99}[\)\h]+@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*(?:base64_decode\h*\(\h*)?\60[^\]]+\][\h\)]+;(?<X1185032>)|\h*(\$_[GPCSR]\w{2,6}\[[^\]]+\])[\h\)]+(?:[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*(?:\(\h*(?:stripslashes|base64_decode|gz(?:uncompress|inflate)|str_rot13|convert_uudecode|strrev)\h*){2,5}\(\h*\62[\h\)]+;\h*$(?<X1139841>)|\{\s*if\h*\([^;\{\}%#@!/]{1,99}\{\s*(\$\w{1,40})\h*=\h*\62;\s*@?preg_replace\h*\(\h*['"](\W)[^'"]+\65e['"],[^\),;]+\bstr_rot13\(\h*['"]riny['"]\h*\)[^\);,]+\64\b[^;]{1,99};\s*(?:die|exit)[^;]{0,19};(?:\s*\}){2}(?<X1161740>))|\h*(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s\)]+\{\s*@error_r[^\}]{0,99}if[\s\(]+isset[\s\(]+\67[^\}]{0,99}\}\s*else\s*\{[^:\{\}]{0,99}(\$\w{1,40})[\h=]+file_get_contents\(['"]php:[^;]+;[^@]{0,999}(\$\w{1,40})\h*=[^;]+\68[^\{\}]{0,99}(\$\w{1,40})[\h=]+\69[^@]{9,99}@new\h+\w{1,40}\(\70\);(?:\s*\}){2}(?<X1185320>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])[\)\s]+\{\s*ini_set\(['"]display_errors['"][\h,]+['"](?:Off|0)['"]\);[^\}]{0,499}\$\w{1,40}[\h=]+json_encode\(\$_COOKIE[\h,]+256\b[^\\\}]{0,999}(curl)_setopt\((\$\w{1,40})[\h,]+\73OPT_URL[,\h]+['"]\\[^;]+\72[\}'"\)\h]{3,9};[^\}]+\73_close\(\74\);[^\}]{0,40}\}(?<X1188320>)|\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\D{2,3}\h*\76[^\{]{1,50}\{\s*die\h*\(\h*[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\h*\(\h*file_get_contents\h*\(\h*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\){3};\s*\}(?<X1162051>)|\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\s\)\(\{]+(\$\w{1,40})\s*=\s*\78[\)\s]+\S{2,3}\s*@preg_replace[\(\s]+['"](.)[^'"]{0,9}\80e['"][,\s]+['"]@['"][\s\.]+str_rot13[\s\(]+['"]riny['"][\)\.\s]+['"]\(\79\)['"][\s,]+['"]\w{1,40}['"][\s;\)]+(?:exit|die)\b[^;]{0,19};\s*\}(?<X1034123>)|\h*(\$_[GPRSC]\w{2,6}\h*\[[^\]]+\])[\s\)]+\{\h*(\$\w{1,40})\h*=\h*['"]\h*\};\s*['"][\h\.]+(urldecode\()gz(?:inflate|uncompress)\(\84\$\w{1,40}[\h\.]+\82[\h\.]+\$\w{1,40}(?:\h*\)){3}[\h\.]+['"]\h*\{\h*['"]\h*;\s*create_function\h*\(\h*(?:["']{2}|null|false)\h*,\h*\83[\h\)]+;\s*\}(?<X2118573>)|\h*(\$_[GPRSC]\w{2,6}\s*/\*[^\*]+\*/\s*\[[^\]]+\])[\s\)]+\{\s*(\$\w{1,40})\s*=\s*\86\s*;(?:[^\}]+\$\w{1,40}\h*\.=\h*\$\w{1,40}\[\$\w{1,40}\];\s*\})+[^,\}]+(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\(\h*(?:['"]['"]|null)[\h,]+\$\w{1,40}\(\87[\)\h]+;\s*@?\88\(\);\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1186710>)|\h*(\$_COOKIE\[[^\]]+\]\))\)\s*@\$_COOKIE\[[^\]]+\]\(\90;(?<X1191660>)|\h*(\$_REQUEST\[['"]\{\$\w{1,15}\}['"]\])[\)\s\{]+(\$\w{1,15})\h*=\h*\92;\s*(\$\w{1,15})\h*=\h*['"]{2};[^\?]{99,700}(\$\w{1,15})\h*=\h*\$\w{1,15}\(['"\.\_\hcreatfunio]+\);\s*(\$\w{1,15})\h*=\h*\95\(['"]{2},\h*\94\(\93[\h\)]+;\s*\96\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1194960>)|\h*(\$config\[['"]request['"]\])[\)\s]+\{\s*error_reporting\(0\);\s*eval\(\h*\98\h*\)\h*;\s*\}(?<X1171430>)|\h*\$\h*_\h*[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+\{[^/]{9,50}<title>[^\w]{0,9}Hidden\h+Uploader[^<]{0,9}</title>(?<X2140781>))))
\bif\h*(?:\(\h*isset\h*\(\h*\$_(?:[GPCSR]\w{2,6}\[[^\]]+\](?:(?:\h*\)){2}\h*\{\s*echo\s*['"]<form\b[^\}\{:#%\*\+!&\?,@]{1,499}\b(?:(?:if\h*\(\h*[cm]o(?:py|ve_uploaded_file)\h*\(\h*\$_FILES\[[^;\{\}]{1,99}|else\s*)\{\s*echo\b[^;]{1,99};\s*(?:exit|die)[^;]{0,19};\s*\}){1,2}\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1169520>)|(?:\s*\)){2}\s*\{\s*if\h*\([^\}]{1,99}\b[cm]o(?:py|ve_uploaded_File)\h*\(\h*\$_FILES\[[^;]{1,99};[\s\}]+\?>[^/]{1,199}<(title)\b[^>]{0,99}>\s*ImageSurfer\s*</\2>(?<X2171321>)|[\)\s]{1,9}\{\s*error_reporting\((?:0|NULL)\);\s*(\$\w{1,40})\h*=[^\}]{9,99}(\$\w{1,40})\h*=\h*file_ge(t_contents\()\$_[GPSCR]\w{2,6}\[[^;]{1,49};\s*(?:\}\s*)?@?file_pu\6\h*\4\h*,\h*\5\h*\);(?:\s*echo\b[^;]{1,49};)?\s*(?:exit|die)[^;]{0,19};\s*\}(?<X1152020>)|[\h\)]+\{\s*@?ini_set\(['"]error_reporting['"]\h*,\h*(?:0|Null|false)\h*\);[^\$\{=\}]{1,99}\b(function)\s+(\w{1,40})\b[^\?]{999,9999}\bregister_shutdown_\8\([^\)]+(\$\w{1,40})\);[^\*]{99,499}\bfile_put_contents\(\h*\10\b[^\?/\*]{1,499}\9\(\);\s*\}(?<X1158350>))|[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{(?:(?:\s*(\$\w{1,40})[\h=]+\$_[GPRSC]\w{2,6}\[[^;]+;)+\s*(function)\h*(\w{1,40})[^\}]{4,99}\breturn[^;\^]{3,99}\^[^\v]{3,99};[\s\}]+(\$\w{1,40})[\h=]+\14[^;]+\12[^;]+;\s*(\$\w{1,40})[\h=]+create_\13\((?:['"]{2}|null)[\h,]+\15[\h\)]+;\s*@?\16[\(\)\h]+;\s*\}(?<X1186190>)|\s*(\$\w{1,40})(?:[\s=]+@?[sape](?:val|ssert|ystem|hell_exec|xec|open|assthru)[\s\(]+(?:base64_decode[\s\(]+)?['"@]?\$_[GPRSC]\w{2,6}\[[^\}]{0,40}while[\s\(]+\$\w{1,40}[\s=]+fgets[\s\(]+\18[\s\)]+\{[^\}=]{6,99}\}(?:\s*@?\w{3,19}[\s\(]+\18[\s\)]+;)?\s*\}(?<X1186230>)|\h*=\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\h*;\s*if\h*\(\h*\18\h*\D{2,3}\h*['"]port[^'"]{0,9}['"][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?fsockopen\(['"][^'"]{9,40}['"]\h*,\h*(?:110|143)\h*,[^\*\?&%]{99,9999}fclose\(\20\);(?:[^\}]{1,99}\}){2}(?<X1163130>))|\s*(?:@?extract[\s\(]+\$_[GPRC]\w{2,6}\b[\s\)]+;\s*(?:die|exit)[\s\(]+\$\w{1,40}[\s\(]+\$\w{1,40}[\s\)]+;\s*\}(?<X1186241>)|if[\h\(!]+file(_exists)\h*\(['"][^'"]+['"][\s\)]+\{\s*if\h*\(\h*function\23\h*\(['"]((?:shell_)?exec|system)['"][\s\)]+\{\s*(\$\w{1,40})\h*=\h*@?\24\(['"]w?GET\b[^:]{1,60}https?://[a-z]{2,5}bin\.com?/[^\?\*\|\[]{399,999}eval\(\25\);[^\}]{0,24}\}(?<X1161220>)))|[GPRSC]\w{2,6}\[[^\]]+\][^\{]{5,99}\{\s*if\h*\(\h*md5\h*\((\$_REQUEST\[)[^\]]+\]\)\h*\D{2,3}\h*['"]\w{32}['"]\)\s*\{\s*@?eval\(\27[^\]]+\]\);\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1160590>)|[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\)\s]+\{\s*(?:@?preg_replace\s*\(\s*.?['"](.).{0,40}\29e\w?.?['"]\s*,\s*['"]['"eval\.\h]{7,}\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*['"]\s*,\s*['"][^'"]{0,40}['"]\s*\)\s*;(?:\s*(?:exit|die)\b[^;]{0,19};)?\s*\}(?<X1174030>)|echo\h*\(?['"]<form\b[^;]+;\s*if\h*\(\h*(?:isset\h*\(\h*)?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*if\h*\(\h*@?[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\)]+\)[\)\s]+\{[^\*\(\)\[\]\?]{1,499}\}\s*(?:die|exit)\b[^;]{0,9};\s*\}(?<X1163311>)|echo\h*\(?[''"]<form\b[^;]+;\s*if\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+\{\s*if\h*\(\h*@[mc]o(?:ve_uploaded_file|py)\h*\(\h*\$_FILES\h*\[[^\)]+\)[\s\)]+\{[^\}]+\}\s*else\s*\{[^\}]+\}(?:\s*\}){2}(?<X1163520>))|[\s\)]+\{\s*(?:(?:\?>|echo\h*\(?\h*['"])\s*<form\b[^\}]{9,99}\bfile\h*\(\h*['"]/etc/passwd['"]\h*\)\h*;\s*foreach\h*\([^;]+=\h*explode\h*\(\h*['"]:['"](?<X2157480>)|(\$\w{1,40})\h*=\h*['"]['"\h\.base64_dco]{16,40}['"]\h*;\s*(\$\w{1,40})\h*=\h*\34\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\)\h*;[^\}]{1,299}\beval\h*\(\h*\35[\s\)]+;\s*\}(?<X1161250>)|(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*;\s*(\$\w{1,40})\h*=\h*(?:\37|\38)\h*\(\h*['"]+\h*,\h*(?:\37|\38)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\h\)]+;\s*@?\39[\h\(\)]+;\s*\}(?<X1166950>)|echo\h+['"][^;]{9,199}\.\h*php_uname\(\)\h*\.[^:]{299,499}echo\h+'<form\h+enctype\h*=\h*['"]multi[^'"]{1,40}['"]\h+method\h*=\h*['"]POST['"]\h*>[^']+';[^\{]{1,99}\{\s*if\h*\(\s*@?copy\s*\(\s*\$_FILES\h*\[[^\?]{1,999}/>['"];(?:\s*\}){3}(?<X1142460>))|\h*\)\h*\)\s*\{\s*[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*[\$\{\('"]{1,3}\h*\bdirname\h*\(__FILE__\)\h*\.\h*['"]/wp-load\.php[\$\}\('";]{1,3}\h*\)\h*;\s*\$\w{1,40}\h*=[^\?]{99,999}((?:die|exit)\b[^;]{0,9};)\s*\}\s*else\s*\{?\s*\42(?:\s*\}){1,2}(?<X1140050>)))|\(\h*key\h*\(\h*\$_[GPRSC]\w{2,6}\h*\)\h*\S{2,3}\s*['"]\w{0,40}['"]\s*\)\s*\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+;\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1189340>)|\(\h*md5\h*\((?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\)\h*\W{2,4}\h*['"]\w{32}['"]\h*\W{2,4}\h*(\$_[GPRSC]\w{2,6}\h*\[)['"]([^\]]+)['"]\]\h*\)@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*base64_decode\h*\(\h*\45['"]\46['"]\]\h*\)\h*\)\h*;(?<X1164692>)|\h*['"][&\^\*#%\$]{3,}\w{1,40}[&\^\*#%\$]{3,}['"]\h*\.\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\](?<X2187021>))|\(\h*move_uploaded_file\(\$\w{1,15}[^\?]{9,999}>\W{0,5}\d{1,4}uploader\h*hidden\W{0,5}</[^>]+><[^\>]+>\W{0,5}coded\h*by\b(?<X2188470>)|\(\h*preg_match\h*\((?:[^\),]+,\h*\$_SERVER\[['"]HTTP_USER_AGENT['"]\]\h*(?:\)\h*){2}\{\s*if\h*\(\h*@?\w{1,40}\h*\(\h*\$_[GPCSR]\w{2,6}\[[^;\{\}]{1,99}\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\([^\)]{1,99}\$_[GPCSR]\w{2,6}\[[^;]{1,99};(?:\s*\}){2}(?<X1161970>)|\h*["']/\(mobile[^'"]{9,350}\)/i['"],\h*\$_SERVER\[[^\{]{0,99}\{\s*@?setcookie\([^\}]{1,49};\s*@?header\(strrev\([^\)]{1,99}/[/:htp'"\.]{5,15}[^:]{0,5}[:Locatin'"\.]{15,25}\)\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1168121>))|\(\h*strpos\h*\(\h*\$\w{1,40}\h*,\h*['"][gole'"\h\.]{8,40}['"]\)\h*\S{2,3}\h*["']?(?:True|False)['"]?\h*\|\|[^;]+;[^\?/]{0,999}\$\w{1,40}[=\h]+(\w{1,40})[\h\(]+['"]https?://\w[^;]+;[^\*#\+]{99,1999}\bfunction\h+\52[\h\(]+\$\w{1,40}\b[^\?>]{9,999}\breturn\h+curl_exec[\h\(]+\$\w{1,40}[\)\h]+;\s*\}\s*\}(?<X1190110>)|\(__FILE__\h*==\h*\$_SERVER\[['"]SCRIPT_FILENAME['"]\]\)\s*\{\s*@?\b(?:[ir](?:nclud|equir)e(?:_once)?\h*\(\h*)?['"][^\.]{2,20}\.(?:jpe?g|gif|svg|png|bmp|tiff)['"]\h*\)?;\s*\}(?<X1171920>)|\(document\.cookie\.split\([^\{]+\{\s*throw\h*new\h*Error\([^\}]+\}\s*class\h*(\w+)\h*\{\s*constructor\(\)\h*\{\s*(this\.)url[\h=]+['"]https?://(?:\w+\.)?damblodor\.com/tmp/[^'"]+\.php['"];\s*\56ua[\h=]+[^#]{999,4999}\bconst\h*(\w+)[\h=]+new\h*\55\(\);\s*\57\.init\(\);(?<X1268330>)|\(get_magic_quotes_gpc\h*\(\)\)\s*\{\s*foreach\h*\((\$_POST)\h*as\h*(\$key)\h*=>\h*(\$value)\)\s*\{\s*\59\[\60\]\h*=\h*stripslashes\h*\(\61\);[^/;\?]{2,200}\becho\h+['"][^/;]{2,40}<title>[^/>]{0,40}\b(?:web)?(?:shell|backdoor|uploader)\h*</(?<X2167700>)|\(isset\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\h*\W{2,4}\h*\63\h*\!=\h*(?:null|void|0|false|empty)\)\s*\{\s*@?exec\(\63,\h*(\$\w{1,20})\);\h*\w+\(\64\);\s*\}(?<X1172960>)|\$_[GPRSC]\w{2,6}(?:\[['"](\w{1,15})['"]\]\)\)[\s\{]+\bsystem\(['"]ln\h+\-s\h*[^?]{1,299};\s*(\$\w{1,9})\h*=\h*fopen\(['"]\.htaccess['"],['"]w\+['"]\);\s*\$\w{1,9}\h*=\h*fwrite\h*\(\67[\h,]+base64_decode\([^;]{1,49};\s*\$\66\h*=\h*symlink\(['"]/['"],['"]\66['"]\);(?<X1188911>)|\s*\[[^\]]+\]\)\)\s*\{\s*function\h+stripslashes_for_array\(&\$\w{1,40}\)\s*\{[^/\*@#<]{1999,2500}else\s*echo\h+\$\w{1,40}\h*\.\h*['"]_bad\h*['"]\h*\.\h*(\$\w{1,40})\h*\.\h*['"]_bad['"]\h*\.\h*\69\h*\.\h*['"]_error_hash['"]\h*\.\h*\$\w{1,40};\s*\}(?<X1139290>))))
\bif(?:\h*(?:\(isset\h*\((?:([^\)]+)(?:[\)\s]+\{\s*(\$\w{1,20})\h*=\h*\1;\s*(\$\w{1,20})\h*=\h*['"]{2};[^\}]{99,300}\}\s*(\$\w{1,20})\h*=\h*strrev\h*\(['"][creat_funio'"\.]{16,35}\);\s*(\$\w{1,20})\h*=\h*\4\(['"]{2}\h*,\h*\3\(\2\)\);\s*\5\(\);\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1187590>)|\)\)\s*\{\s*if\h*\((?:md|sha)\d+\h*\(\1\)[^\)]+\)\s*\{[^\}]{1,30}\}\s*function\h+run\h*\(\$\w{1,20},\h*\$\w{1,20}\h*=\h*['"][peas][ayxhovs]\w{2,4}['"]\)[^\?\*/]{99,2500}(\$\w{1,20})\h*=\h*\$\w{1,9}\(['"]{2},\h*\$\w{1,9}\);\s*@\7\(\);\s*(?:die|exit)[^;]{0,9};\s*\}(?<X1167030>))|(\$_[GPRSC]\w{2,6}\[[^\]]+\])(?:\)\h*\)\s*\{\s*(\$\w{1,20})\h*=\h*create_function\h*\(\h*NULL,\9\);\h*\10\(\);\h*\}(?<X1173941>)|\h*,\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\h*,\h*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{\s*@?[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\h*\((?:\9|\12|\13)\);\s*\}(?<X1175210>))|(?:[^\)]+\)\)\s*\{\s*\$\w{1,20}\h*=\h*getcwd\(\);\s*echo\h+['"][^=]{0,20}<form\h+method=["']post['"][^;]{9,200}['"];\s*if\h*\([^\$]{0,16}(\$_FILES\[[^\]]+\])\)\)\s*\{\s*@?[cm](?:opy|ove_uploaded_file)\(\15\[['"]tmp_name['"]\],\15\[[^\}]{40,150}\15\[[^;]{1,9};\s*\}\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1188090>)|\$_[GPRSC]\w{2,6}\[(?:(?:(chr)\(\d+\)\.){5}[^;]{0,299}\17\(\d+\)\]\)\W{2,4}md5\h*\(\$_[GPRSC]\w{2,6}\[(?:\17\(\d+\)\.){5}[^;]{0,299}\17\(\d+\)\]\)[^\?]{99,999}@?include\((\$\w{1,20})\);\s*@?unlink\(\18\);\s*((?:exit|die)[^;]{0,9});\s*\}[^\}]{9,150}base64_decode\([^\)]+\);\s*\}\s*\19;\s*\}(?<X1138552>)|['"]cgishell['"]\][\)\s]+\{\s*\$\w{1,20}\h*=\h*getcwd\(\);(?<X2141350>)|['"]upl['"]\]\)\)\s*\{\s*echo\h+['"]<form\h+method\h*=\h*['"]post['"][^;]{9,250}['"];\s*if\h*\([^\$]{2,15}(\$_FILES\[[^\]]+\])\)\)\s*\{\s*@?(?:copy|move_uploaded_file)\h*\(\22\[['"]tmp_name['"]\]\h*,\h*\22\[[^\]]+\]\);[^\}]{0,99}(?:\}\s*){2}(?<X1180120>)|[^\]]+\]\)\)\s*\{\s*(\$\w{1,20})\h*=\h*(?:['"]\w{32}['"];\s*(\$\w{1,20})\h*=[^;]{1,20};\s*if\h*\(\24\W{2,4}md5\(\25\)\)\s*\{[^\}]{0,99}\b[ir][ne][cq][lu][ui][dr]e(?:_once)?\h*['"]?[^;]{0,30}/\w{1,20}\.(?:jpe?g|png|gif)['"];\s*(?:exit|die)[^;]{0,8};(?:\s*\}){3}(?<X1178900>)|fopen\h*\(['"]\w{1,20}\.php['"]\h*,\h*['"]w\+?['"]\);\s*fputs\h*\(\24\h*,\h*file_get_contents\h*\(['"]https?://(?:paste|ghost)bin\.[^;]+\);\s*header\h*\(['"]Location:[^\)]+\);\s*\}(?<X1179550>)))|\$_[GRPSC]\w{2,6}\[['"]\w{1,9}['"]\][^\?]{1,199}(\$\w{1,9})\h*=\h*[^\(]{0,10}\(sys_get_temp_dir\h*\(\),[^;]{1,20};\s*(\$\w{1,9})\h*=\h*(?:\h*(?:base64_|(?:raw)?url)(?:de|en)code\h*\((?:\h*\()?){3}[^;]{1,99};[^\}]{1,149}\}\s*file_put_contents\h*\(\28,\29\);[^\?]{1,99}\}(?<X1179360>)|\$_REQUEST\[['"]cm9yX3JlcG9ydG['"]\]\)\)\s*\{\s*die\h*\(pi\(\)\h*\*\h*\d+\);\s*\}\s*if\h*\(!?class_exists\h*\(['"](CURLOPT_REQUEST)['"]\)\)\s*\{[^&`]{999,6000}\bprint\h+\$this\->\w{1,20};\s*\}\s*\}\s*(\$\w{1,20})\h*=\h*new\h+\31;\s*\32\->init\(\);\s*\}(?<X1166532>)))|\(navigator\.userAgent\.indexOf\h*\([^\{]+\)\s*\{[^,\n]{9,99}\w{1,20}\h*=\h*\[(?:['"][^'"]+['"],?){9,30}\];[^\n]{999,4000}\bfunction\(\)\s*\{\s*(window\[\w{1,9}\[)[^=]+\]\h*=\h*new\h+CoinHive\[\(\w{1,9}\([^\]]+\]\((?:\34[^,]+\],){2,5}\{['"]throttle["']:\34[^\}]+\]\}\);\s*\34[^\(]+\]\(\);\s*\}\s*;\s*\}(?<X1141791>)|\(PatchPayload[^\{]+\{\s*echo\h*['"]URL#http://['"][^;]+;\s*(?:exit|die)[^\}]{1,8}\}\s*\$max_tries[^\}]{1,8}\}\s*echo\s*['"]STATUS_CANTUPLOAD['"];\s*(?:exit|die)\(\);\Z(?<X2255482>)|\(strstr\h*\((\barray_reverse\h*\(explode)\h*[^\[]+\[\d+\],\h*\37[^\?\{]{0,99}\{\s*(\$wp_list_table->[^\.]{0,49}\.\h*=\h*)['"]\(shell\)['"];[\s\}]+else[\s\{]+\38['"]\(hidden\)['"];(?<X2186831>))|\s*\(!(?:@?ereg\((\$\w{1,40})\s*,\s*(\$\w{1,40})\)\s*\)\s*\{\s*\41\s*=\s*\40;\s*\}\s*\}\s*\$\w{1,40}\s*=\s*\41;\s*if\s*\(@?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\](?<X2125700>)|\$_COOKIE\[(base64_decode)\([^\{]+\{\s*setcookie\(\43[^\}]+echo\s*\43\(['"]PHNjcmlwdD53aW5k[^\)]+\)\s*\.\s*\$\w+\s*\.\w*\s*\43\(['"]Iik7d2luZG93LmxvY2[^\)]+\)\s*\.\s*\$\w*\s*\.\s*\43\(['"]Ijs8L3NjcmlwdD4[='\";\)]{1,4}\s*\}(?<X1250910>)|\(!\$_COOKIE\["\\x[0-9A-Fa-f]+"\]\s*\|\| !\$_COOKIE\["\\x[0-9A-Fa-f]+"\]\)\)\s*\{\s*goto\s*\w{1,40};\s*\}(?<X2050360>)|Anon_true\(\s*\$em\s*,\s*\$ps\s*,\s*\$_SERVER\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*{\s*die\((?<X2049140>)|class_exists\(['"]Controller['"]\)\)\s*\{\s*(\$\w{1,9})\s*=\s*new\s*\w{9,25}\(\);\s*\47->fpc\s*=\s*\47->dispatch\(['"]GIF8\d\w?[^\s]{0,2}\^[^;]+;(?<X2125801>)|defined\(['"]ALREADY_RUN.+eval\s*(?:/\*\w+\*/)?\s*\(\s*\w+\s*\(\$\w+\s*,\s*\$\w+\)\s*\);\s*\}(?<X1036551>)|empty\(\$_REQUEST\['ch2'\]\)\s*&&\s*\$_REQUEST\['ch2'\]\s*==.{400,650};fclose\(\$fp\);include\([^)]+\);\s*\}\s*\}(?<X1040840>)|file_exists\s*\((\$\w{1,20})\)\s*\)\s*\{?\s*mkdir\s*\(\51\s*,\s*0?777\s*,\s*true\);\s*\}\s*(?:(?:echo|print)\s+['"][^'"]{1,40}['"];)?\s*echo\s+@copy\s*\(\$_FILES\[[^\]]+\]\[[^\]]+\]\s*,\s*\$\w{1,9}\)(?<X2118591>)|function_exists\s*\(['"](wpfc_footer_credits_global)['"]\)\)\s*\{\s*function\s*wpfc_footer_credits_global\s*\(\s*\)\s*\{\s*error_reporting\s*\(0\);[^\?]{999,4999}/get_?links?/\?[^\?]{9,1999}/get_?links?/\?[^\?]{1,999}\}\s*\}\s*add_action\s*\(['"]wp_footer['"],\s*['"]\53['"]\s*\);\s*\}(?<X1125400>)))
\bif\s*\((?:(?:(\$file)\s*==\s*(getcwd\(\))\.['"]/(?:index|blocker|robot|delete)\.(?:php|txt)['"]\s*\|?\|?\s*){2,4}\)\s*\{[^\}]+\}\s*else\s*\{\s*(?:echo|print)\s*\(?['"]?\1['"]?\)?;\s*@?unlink\(\2\.[^\.]+\.\1(?<X2120110>)|(?:\h*!)?\h*(?:isset|empty)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\)\s]+\{\s*(?:(\$\w{1,40})\h*=\h*)?@?(?:(?:shell_)?exec|system|passthru)\h*\(\h*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\](?:\h*,\h*(\$\w{1,40}))?[^;]{1,9};[^\}]{0,199}\b(?:echo|\w?print\w{0,2}|var_dump)\s*\(\s*(?:\4|\5)\s*\)\h*;[^\}]{0,199}\}(?<X1173430>)|@?\$_[GPRSC]\w{2,6}\[[^\]]+\]==\d+\)\s*\{(exit)\('\d+'\);\}\s*if\s*\(!empty\(\$_GET\['(\w+)'\]\)\s*&&\s*!empty\(\$_GET\['\w+'\]\)\)\s*\{\s*if\s*\(!\$(\w+)\s*=\s*fopen\(\$_GET\['\8'\],\s*'a'\)\)\s*(\{\7;\}\s*)if\s*\(fwrite\(\$\9,\s*file_get_contents\([^\}]{9,30}\10fclose\(\$\9\);\s*\7\('OK'\);\s*\}(?<X1036271>)|[\s\(]*\d+[\s\(\)]*(?:aNd|&&)[\(\s]*(?:\$\w+\s*=\s*)?@\$\s*\{[^;]+;\s*\}[^@]{0,9999}@opcache_reset[\(\)\s]+;[^\n<]{99,}\breturn\s*str_replace[\("'</\s\w]+\\[^"']+['"]\s*,[^,;]+,\s*\$\w+[\s\);]+\}\s*ob_start\s*\(["'][^'"\$]+['"][\);\s]+\}(?<X1254190>)|[^\);]{0,99}\$_[GPCSR]\w{2,6}\[[^\{;]{1,199}\{[^\};]{0,99}/registration\.php["']\s*\);\s*if\s*\([^;\{]{1,99}\{\s*(\$\w+)[\s=]+wp_create_user[\s\(]+(?:['"][^'"]{1,99}['"][\s,\)]+){2,4};\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\13[\s\)]+;\s*\14\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;(?:\s*\}){2}(?<X1194581>)|[^\)]{0,99}\$_[GPCSR]\w{2,6}\[(?:[^\]]+\][^\{;]+\{\s*@?(?:includ|requir)e(?:_once)?\b[^;]{0,99}['"][^'"]{0,99}\bwp\-includes/registration\.php['"][^\{\}]{1,199}\{[^=\}]*(\$\w+)([\s=]+)wp_create_user([\s\(]+)[^;]{1,99};\s*(\$\w+)\17new\h+WP_User\18\s*\16\s*\);\s*\19\s*\->\s*set_role\18\s*['"]administrator['"]\s*\);(?:\s*\}){2}(?<X1192254>)|[^\{;]{1,199}\{\s*function\h+(\w+)\s*\(\s*(\$\w+)\s*\)\s*\{\s*(\$\w+)\s*=\s*@?file_get_contents\s*\(\s*\22\s*\);[^\?:/]{1,499}\breturn\h+\23;\s*\}\s*@?\21\s*\(\s*['"]https?://[^;]{1,199};\s*\}(?<X1190090>)|[^\{;]{1,99}\{\s*(?:\$\w+\s*=[^;]{1,99};[^\{\}=]*){3,}if\s*\([^\{]{1,99}\{\s*\$\w+[\s=]+wp_create_user\s*\([^;]{1,99};\s*(\$\w+)[\s=]+new\s+WP_User\s*\([^;]{1,99};\s*\25\s*\->\s*set_role[\s\('"]+administrator['"\s\)]+;(?:[^\}]*\}\s*else\s*\{)?(?:[^\}]*\}){2}(?<X1193181>))|[^\)]{0,99}\b(?:md5|sha1)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\{;\?></:]{1,199}\{[^\(\[\);]{1,199};\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\s*\(\s*\$?\w{1,40}\s*\(\s*\$_[GPSRC]\w{2,6}\[[^\]]+\][\s\)]+;\s*@?(?:die|exit)[^;]{0,19};\s*\}(?<X1190875>)|[^\{;]{0,49}\$_[GPCSR]\w{2,6}\[[^\{;]{1,199}\{\s*require\w*\b[^;]{0,19}\bwp\-includes/reg[^;]+;\s*\$(\w+)[\s=]+wp_create_user[\s\(]+['"][^'"]+['"][\s\,]+['"][^'"]+['"][^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\$\28[\s\)]+;\s*\29\s*\->\s*set_role[\s\(]+['"]administrator['"][\s\)]+;\s*\}(?<X1214670>)|[^\{\};@=\[\]]{9,}\b(function)_exists[\s(]+['"]([^"']+)['"][^#\*></\\\?]{9,9999}\b\31\s*\32[^\{\};]*\{[^`#!>\?<%]{9,999}@fsockopen[^`/#\*\-]{9,999}\b\31\s*(\S+)[^`\*#\?><\\]{9,199}(\$[^=\s]+)=\32[^`\}\{]{9,499}if[\s(]*\34[^`\}]*ob_start[\s('"]+\33[\s)"';]+\}\s*\}(?<X1247971>)|\!is_wp_error\(\$\w{1,14}\)\)\s*\{\s*\$\w{1,14}\s*=\s*['"][^'"]{20,60}['"];\s*(\$\w{1,14})\s*=\s*\$[^;]{1,60}get_site_url\(\);\s*\36\s*=\s*\36\s*\^\s*[^;]{1,60};\s*\36\s*=\s*bin2hex\(\36\);\s*(\$\w{1,14})[^\}]{100,500}update_option[^\}]{1,80}array_unique\(\37[\);\s]+\}(?<X1278920>)|\$(?:isbot|bot)\)\s*\{\s*\$\w{1,20}\s*=\s*basename\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*['"]\.php['"]\);[^@]{99,200}\{\s*(\$\w{1,20})\s*=\s*rand\(\d+,\d+\);\s*\$\w{1,20}\s*=\s*@file\(['"][^\$]{0,9}\39\.html['"]\);(?<X2125390>)|\$_FILES\[.F1l3.+?\$_POST\[.Name.\]\);\s*echo\s*.OK.; Exit;}(?<X1034091>)|\$_REQUEST\[.param1.\]&&\$_REQUEST\[.param2.\]\)\s*{\$f.+?array\(\$_REQUEST\[.param2.\]\);.+?array_filter.+?OK.;\s*Exit;}(?<X1034101>)|\$else_dot\)\s*\{\s*\$new_v_f=fopen\(['"]\$f_creat_name\.\$else_dot['"],['"](?:w|a)\+?['"]\);\s*\}(?<X2054121>)|\$mode(?:=='upload'\)\s*{\s*if\(is_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\]\)\)\s*{\s*move_uploaded_file\(\$_FILES\["filename"\]\["tmp_name"\],\s*\$_FILES\["filename"\]\["name"\]\);\s*echo \$_FILES\["filename"\]\["name"\];\s*}\s*}(?<X1035081>)|_work\s*==\s*['"]cngbot['"]\s*\)\s*\{(?<X2054130>))|\$newsletter\)\s*\{\s*\$mail->set\(['"]List-Unsubscribe['"],[^\*]{9,999}\$mail->addCustomHeader\(['"]X-Virus-Status:\s+Clean['"]\);(?<X2123630>)|\$query\s*===\s*'checker-page'\)\s*{\s*if \(\s*_fetch_url\(\s*_get_rev\(\s*\)\s*\)\s*>\s*0\)\s*{(?<X2049090>)|\$upload\s*&&\s*\$user\s*&&\s*wp_check_password\(\$passwd,\s*\$user->data->user_pass,\s*\$user->ID\)\s*&&\s*is_super_admin(?<X2045151>)|\((\$\w{1,20})\s*=\s*(md5\s*\(date\s*\(['"]\w{1,20}['"]\)\))\)[^_]{9,30}isset\s*\(\$_[GPRSC]\w{2,6}\[\49\]\)\)\s*register_shutdown_function\s*\(['"](\w{1,20})['"]\);\s*function\s+\51\(\)\s*\{\s*die\s*\(\s*@?eval\s*\(\s*\$_[GPRSC]\w{2,6}\[\50\][\s\)]+;\s*\}(?<X1127101>)|\s*!\s*(?:(function)_exists\s*\(\s*['"](?:(sorry_\53)['"]\s*\)\s*\)\s*\{\s*\53\s*\54\s*\(\s*(\$\w{1,10})[^=]{1,200}(\$\w{1,10})\h*=\h*[^\}]{1,500}\$\w{1,20}\h*=\h*\56\h*\.\h*\55\h*\.[^\176]{1,150}(?:@|#|//)?add_filter\s*\(\s*['"][^'"]{1,40}['"]\s*,\s*['"]\54['"]\s*\)\s*;\s*\}(?<X1169842>)|(wp_func_jquery)['"]\s*\)\s*\)\s*(?:\{\s*if\s*\(\s*!\s*current_user_can\(\s*['"]read['"]\s*\)\))?\s*\{\s*\53\s*\58\s*\(\s*\)\s*\{\s*\$host\s*=\s*['"]https?://['"]\s*;[^!<>%&\*\}\|]{99,500}?(?:\s*\}\s*){0,3}add_action\(['"]wp_footer['"]\s*,\s*['"]\58['"]\s*\);\s*\}\s*\}(?<X1041611>))|defined\s*\(\s*['"]ALREADY_RUN_[^@\*]{999,19999}\bheader\s*\(\s*['"]Content\-type:\s*text/html\b[^;]{1,99};\s*echo\s*(\$\w{1,40}\[)(?:[^\?]{1,999}\bf(?:ile_put_contents|write)\s*\([^,\);]+,[^;\)]+\60){2}[^\?]{1,999}\bexit[^;]{0,19};[\}\s]{1,40}\}(?<X1186071>)|empty(?:\(\s*\$_[GPCSR]\w{2,6}\[['"]?\w{1,40}['"]?\]\s*\)\s*\)\s*include(?:_once)?\s*\(\s*\$_[GPCSR]\w{2,6}\[['"]?\w{1,40}['"]?\]\s*\);\s*(\$\w{1,40})\s*=\s*getcwd\(\);\s*if\s*\(\s*strpos\(\s*\62\b(?<X2053684>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\{[^\(\}]{0,99}@?\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;[^\(\}]{0,99}(?:die|exit)\b[^;]{0,9};\s*\}(?<X1136531>))|function_exists\s*\(\s*['"](verify_wp)['"]\s*\)\s*\)\s*\{\s*function\s*\65\s*\(\)\s*\{\s*global\s*\$\w{1,40};[^\*<\+]+\s*\(\s*\$exception\s*\)\s*\{\s*\}\s*\}\s*\65\s*\(\);(?<X1125770>))|\s*!class_exists\s*\(\s*(?:'[^']*'\s*,\s*false\s*\)\s*\)\s*:\s*class(?:\s*bb_pres\d+\s*\{\s*public\s*static\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*public\s*static\s*\$\w{1,40}\s*=\s*'[^']*'\s*;.+data:text/javascript;base64(?<X2046190>)|\s+\w+\s*{.+?const\s*SCRIPT_SRC\s*=\s*'data:text/javascript;base64,.+?MRT_ALL_TRAFFIC(?<X2046480>))|['"](Ratel)['"]\s*\)\s*\)\s*\{.{9000,10500}\s*\)\s*;\s*\}\s*\}\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}\s*return\s*TRUE\s*;\s*\}\s*\}\s*(\$\w{1,40})\s*=\s*new\s*\69\s*;\s*\70->init\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X1041873>))|\s*!defined\s*\(\s*['"](ALREADY_RUN_\w{9,33})['"]\s*\)\s*\)\s*\{\s*define\s*\(\s*['"]\72[']\s*,\s*1\s*\);\s*[a-zA_Z0-9\+]{999,8000}\s*\}(?<X1198492>))
\bif\s*\((?:\s*!empty(?:\(\s*\$_[GPRSC]\w{2,6}[\s\)\{;\(]+\{\$\w+\s*=\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*["']["']\s*,\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\(\s*["']\w+["']\s*,\s*["']["']\s*,\s*@\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+;\s*\$\w+\s*\(\)\s*;\s*\}(?<X1036221>)|\s*\(\s*(\$_(?:GET|POST|COOKIE|REQUEST))\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\2\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*;\s*if\s*\(\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\)\s*;\s*if\s*\(\s*!empty\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\(\s*''\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*\(\s*\)\s*;\s*\}\s*\}\s*\}(?<X1040712>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*(?:\)\s*\)\s*{\s*extract\s*\(\s*\$_[GPRSC]\w{2,6}\s*\)\s*;\s*\$\w+\s*=\s*\$\w+\(\s*['"]['"]\s*,\s*\$\w+\(\s*\$\w+\(\s*['"]\w+['"]\s*,\s*['"]['"]\s*,\s*\$\w+\)\s*\)\s*\)\s*;\s*\$\w+\s*\(\s*\)\s*;\s*}(?<X1036071>)|\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*["'][^"']*["']\s*;\s*if\s*\(\s*!empty\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*\.\s*=\s*["']\s*AND\s*#__content\.title\s*LIKE(?<X2046361>)))|\s*!function_exists(?:\(\s*'jquery_GetAllWritableDirs'\s*\)\s*\)\s*{\s*function\s*jquery_GetAllWritableDirs\(\s*\$params\s*\)\s*{\s*global\s*\$jquery_dr\s*,\s*\$dirList(?<X2047200>)|\s*\(\s*'(wp_func_jquery)'\s*\)\s*\)\s*\{\s*function\s*\7\s*\(\s*\)\s*\{\s*\$host\s*=\s*'https?://'\s*;[^\}]{1,999}(?:\}\s*if\s*\(\s*[^\{]{1,40}\s*\)\s*\{)?\s*\}?\s*\}?\s*(add_action\('wp_)footer'\s*,\s*'\7'\);\s*\}(?:\s*else\s*\{\s*\8head',\s*'\7'\);\s*\}\s*\})?(?<X1039793>))|\s*!isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*header\s*\(\s*'[^']*'\s*\)\s*;\s*exit\s*;\s*\}\s*\?>\s*<\s*\?\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*=\s*Array\s*\(\s*base64_decode\s*\(\s*'[^']*'\s*\.\s*'[^']*'\s*\)\s*,\s*base64_decode\s*\(\s*[^{]+{\s*\$\w{1,40}\s*=\s*Array\([^>]+>\s*<\?php\s*\$\w{1,40}\s*=_\d+\s*\(\s*\d+\s*\)\s*;\s*.+?\s*,\s*\$\w{1,40}\s*,\s*_\d+\s*\(\s*\d+\s*\)\s*\)\s*;(?<X1037490>)|\s*((document\.)cookie)\.replace\([^\,]+\b(doSomethingOnlyOnce)\b[^\{]{9,399}\{\s*\12getElementById\s*\([^\)]+\)\.innerHTML\s*=\s*['"]\s*<iframe[^/><]{1,49}\bsrc=['"]https?://[^'"\?\s]{1,49}/go\.php\b[^;]{9,999};\s*\11\s*=\s*['"]\13\s*=\s*true;\s*path\s*=\s*/;\s*expires\s*=[^;\}]{1,99};\s*\}(?<X1141062>)|\s*(?:\w{1,40}\s*\(\s*){0,9}\$_[GPCSR]\w{2,6}\[[^\]]+\][\s\)]{0,19}[=!a-z]+\s*['"]?[^'"\s\)]+['"]?\s*\)\s*\{\s*\b(?:includ|requir)e(?:_once)?\s*(?:\(\s*)?['"]/[^'"]+/\.[^/'"]{1,19}['"]\s*(?:\)\s*)?;\s*\}(?<X1190080>)|\s*(?:copy|move_uploaded_file)\s*\(\s*\$\w{1,40}\s*\[[^\]]+\]\s*\[[^\]]+\]\s*,\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*\)\s*exit;(?<X1038421>)|\s*(\$title_full)\s*==\s*["']["']\s*\)\s*\{\s*header\s*\(['"]HTTP/1\.\d+\s+404\s+Not\s+Found['"]\);\s*exit\s*\([^\}]+\}\s*\17_array\s*=\s*@?explode\s*\(\s*['"]-['"],\s*\17\s*\);(?<X2125411>)|\s*(isset)\s*\(\s*(?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\W{2,9}\19[\s\(]+(\$_[GPRSC]\w{2,6}\[[^\]]+\])\W{2,9}in_(array)[\s\(]+(?:\21|\21)[\s,]+\22[\s\(]+['"][^\)]+\)[\s\)]+@?(file_)put_contents\b[^;,]{0,19}\bwp\-(?:admin|includes)[^'"]+\.php['"][\s,]+base64_d?en?code[\s\(]+(?:\20|\21)[^;]+\b\23APPEND['"]?[\s\)]+;(?<X1186560>)|\$_([RC]\w{2,6})\h*\[[^\]]+\][\s\)]+(\$\w{1,40})\s*=\s*\$_\25\[[^\]]{1,40}\];\s*elseif[\s\(]+\19[\s\(]+\$_[RC]\w{2,6}\h*\[[^;]{9,49};\s*if[\s\(]+\19[\s\(]+\26[\s\)]+\{\s*@?eval\s*\((?:\s*(?:str_rot13|base64_decode)[\s\(]+){1,2}\26[\s\)]{3,};\s*(?:die|exit)\b[^;]{0,19};\s*\}(?<X1057392>))|\s*@!isset\s*\(\s*@?\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]{1,9}\]\s*\)\s*\)\s*\{\s*exit\s*\([^;\}]+;\s*\}\s*@?(\$\w{1,9})\s*=\s*str_replace\s*\([^;]+;\s*@?(\$\w{1,9})\s*=\s*str_replace\s*\([^;]+;[^@]+@?(\$\w{1,9})\s*=\s*(?:\28|\29)\s*\(\s*['"][^'"]*['"]\s*,\s*(?:\28|\29)\s*\);\s*@?\30\(\);(?<X1060430>)|\s*@?(\$_(?:GET|POST|REQUEST|COOKIE)\[[^\]]+\]\))\s*\{[^\{\}\(\)=]{9,50}@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\32;[^\}]{9,99}\}(?<X1060753>)|\s*@?\$_(?:(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\)\s*\(\s*(\$\w{1,9})\s*=\s*@?\$_(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\)\s*\.\s*@?\34\s*\(\s*\$_(?:COOKIE|GET|POST|REQUEST|SERVER)\[[^\]]+\]\s*\);?(?<X1061491>)|[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\D{2,3}\s*['"][^"]*['"]\s*\)\s*\{\s*@?error_reporting\s*\(\s*\d+\s*\)\s*;\s*@?array_map\s*\(\s*\([^)]+\)\s*,\s*\(\s*array\s*\)\s*\$_[GPRSC]\w{2,6}\s*\[\s*HTTP_X\s*\]\s*\)\s*;\s*\}(?<X1036891>))|\s*\!(function)_exists\s*\(\s*['"](\w+)['"]\s*\)\)\s*(?::|\{)[^\(\{]{0,99}\37\s+\38\s*\(\s*\$\w+\s*\)\s*\{[^\{\}]+foreach\s*\([^\)]+=>\s*(\$\w+)\s*\)\s*\{[^\&,]{49,149}\{\s*(\$\w+)\s*=\s*\39\s*\(\s*\40\s*\);[\s\}]+return\s*\40;\s*\}[^\(]{1,40}array_(?:map|walk)\s*\(\s*['"]\38['"],\s*\$_[GPCSR]\w{2,6}\);?(?<X1131703>)|\s*\$\w{1,40}\s*[^\w]{1,2}=\s*['"]CheckCrd['"]\)\s*\{\s*(?:\?>\s*<\?php)?\s*function\s+work.hard\(\$\w{1,40}\)\s*\{(?<X2055970>)|\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)(?:\[\w{1,40}\]\s*==\s*['"]stop['"]\s*\)\s*\{\s*(?:@|#)?shell_exec\s*\(\s*['"]killall\s*bot\.pl['"]\);(?<X2054170>)|\s*\[[^\]]+\]\s*\)\s*\{\s*(?:eval|assert)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*;\s*echo\s*['"][^'"]*['"]\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?:\s*;)?(?<X1039111>))|\s*\$_[GPRSC]\w{2,6}(?:\[[^\]]+\](?:\)\s*\{\s*\$\w{1,30}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,30}\s*=\s*fopen\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*'w\+'\)\s*;\s*fwrite\(\s*\$\w{1,30}\s*,\s*\$\w{1,30}\s*\)\s*;\s*\}(?<X1036332>)|\s*!='[^']*'\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*\}\s*if\s*\(\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*\}(?<X1041171>)|\s*\D{2,3}\s*['"][^'"]*['"]\)\s*\{\s*if\s*\(\s*@?copy\((\$_FILES\[[^\]]+\])\[[^\]]+\]\s*,\s*\47\[[^\]]+\]\s*\)\)\s*\{[^\}]{9,99}\}\s*echo\s+['"]<form\s+action\s*=\s*['"][^'"]*['"]\s+method\s*=\s*['"]post['"][^\}]{9,150}\}(?<X1123671>))|\h*\[[^\]]+\]\s*(?:==+\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_FILES\s*\[[^\]]+\]\s*;\s*(\$\w{1,40})\s*=\s*\49\s*\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*@?(?:copy|move_uploaded_file)\s*\(\s*\49\s*\[[^\]]+\]\s*,\s*\50\s*\)\s*;[^\}]{0,99}\}\s*else\s*\{\s*header\b[^;]+;\s*\}(?<X1196210>)|\S{2,3}\s*['"][^'"]*['"]\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*['"](?:assert|eval|system)['"]\s*;\s*\52\s*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1186530>))|\s*\[[^\]]+\]\s*(?:[^\w]{1,2}=\s*['"]?[^'"]{0,40}['"]?\s*\)\s*\{\s*\$\w{1,40}\s*=\s*file_get_contents\s*\(\s*['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}['"]\s*\);(?<X2055651>)|\)\s*\{\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)(?:\s*;)?(?:\s*(?:exit|die)\b[^;]{0,9};)?\s*\}(?<X1124443>)|\S{2,3}\s*['"][^"']*['"]\s*\)\s*\{\s*@?eval\s*\(\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1038162>)))|\s*\$_GET(?:\[['"]?cmd['"]?]\s*[^\w]{1,2}=\s*['"]eval['"]\)\s*\{\s*@?eval\(\$_POST\[['"]?exec['"]?\]\);\s*exit;\s*\}\s*(?://[^\n]{1,80})?\s*if\s*\(\s*\$_GET\[['"]?cmd['"]?\]\s*==\s*['"]GetArticleById['"](?<X2054192>)|\s*\[\s*'google'\s*\]\s*!="[^"]*"\s*\)\s*\{\s*echo\s*'[^']*'\s*\.\s*\$_GET\s*\[\s*'google'\s*\]\s*\.\s*'[^']*'\s*;\s*exit\s*;\s*\}(?<X2048050>)))
\bif\s*\((?:\s*\$_(?:POST(?:\[['"][^'"]{1,40}['"]\]\s*==\s*['"][^'"]{1,40}['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\s*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*['"]wget\s*https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)\w{1,40}(?<X2055610>)|\s*\[\s*['"]phoneNumber['"]\s*\]\s*!=['"]\s*['"]\s*\|\|\s*\$_POST\s*\[\s*['"]recEmail['"]\s*\]\s*!=['"]\s*['"]\s*\)\s*\{\s*\$\w{1,40}\s*=\s*mail\s*\(\s*[^\)]{1,40}\s*\$message\s*,\s*\$headers\s*\)\s*;(?<X2054420>))|REQUEST\[(?:"\w+"\]\s*\)\s*{\s*@assert\(\s*base64_decode\(\s*\$_REQUEST\[\s*"\w+"\s*\]\)\);\s*//[\w\s]+\s*echo\s*"[\w\s]+";\s*exit\(\s*\);\s*}(?<X1035380>)|\s*['"]\w{1,20}['"]\s*\]\s*\)\s*{\s*//\s*debug\s*message.+?preg_replace\("/\w{1,30}/e", "[eval'"\.]+\s*\('"\.\$_REQUEST\[['"]\w{1,20}['"]\]\."'\)"\s*,\s*['"].+?['"]\s*\);(?<X1036350>))|SERVER\[['"]REQUEST_URI['"]\]\s*!=\s*['"]/404['"]\)\s*\{\s*\$(bot)\s*=\s*['"]['"];[^\{]{9,999}if\(!empty\(\$\5\)\)\s*\{[^@]{1,99}@mkdir\(\$\w{1,40}\[[^\]]+\]\s*\.\s*DIRECTORY_SEPARATOR\s*\.\s*['"]\5['"]\);(?<X2123400>))|\s*\$dataSize\s*<\s*BOTCRYPT_MAX_SIZE\s*\)\s*rc4\s*\(\s*\$data,\s*\$cryptkey(?<X2101591>)|\s*\$pa(?:rams\s*[^\w]{1,2}=\s*false\s*\|\|\s*substr\(\$_SERVER\[['"]HTTP_USER_AGENT['"]\],\s*\d+,\s*\d+\)\s*[^\w]{1,2}=\s*['"]Spark['"]\)\s*\{\s*header\(['"]Status:\s*404\s*Not\s*Found['"]\);[^`]{2000,2500}botid\s*=(?<X2056450>)|ss\s*==\s*'\w{32}'\s*\)\s*\{\s*if\s*\(\s*!\$\w{1,40}\s*=\s*fopen\s*\(\s*"[^"]*"\s*,\s*"[^"]*"\s*\)\s*\)\s*\{\s*exit\s*;\s*\}\s*if\s*\(\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*"[^"]*"\s*\)\s*==\s*FALSE\s*\)\s*\{\s*exit\s*;\s*\}(?<X2046700>))|\s*\$re(?:directAllow\s*\)\s*\{\s*if\s*\(\s*isMobile\s*\(\s*\$\w{1,40}\s*\)\s*\D{2,3}\s*isDesktop\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*setcookie\s*\(\s*\$\w{1,40}\s*,\s*['"][^'"]*['"]\s*,[^;]+\)\s*;\s*header\s*\(\s*['"]Location:\h*\$redirTo['"]\s*\)\s*;\s*(?:die|exit)\b[^;]{0,9};\s*\}\s*\}(?<X1166460>)|qPwd\s*!==\s*vpsp_pwd\s*\)\s*\{\s*\$\w{1,40}\s*=(?<X2051720>))|\s*\([\s\(]*\d+[\s\(\)]*(?:[\+\-\*/%]\s*\d|(?:aNd|&&)[\(\s]*(?:\$\w+\s*=\s*)?@\$\{)[^;]+;\s*\}[^@]{0,9999}@opcache_reset[\(\)\s]+;[^\n<]{99,}\breturn\s*str_replace[\("'</\s]+\\[^"']+['"]\s*,[^,;]+,\s*\$\w+[\s\);]+\}\s*ob_start\s*\(["'][^'"\$]+['"][\);\s]+\}(?<X1253961>)|\s*\(\s*(?:(\$plog)\s*=\s*@fopen\(\s*ARQUIVO_DE_LOG,\s*['"]wb['"]\s*\)\s*\)\s*\D{2,3}\s*FALSE\s*\)\s*\{\s*@fputs\(\s*\13,\s*['"]['"]\);\s*@fclose\(\13\);(?<X2123760>)|\$\w{1,40}\s*==+\s*['"]\d{1,3}(?:\.\d{1,3}){3}[^\{;\}]+\{\s*header[^\}]+\}[^\{\}]{0,199}if[\s\(]+!file_exists[\s\(]+['"]([^'"]+\.txt)['"][\)\s\{]+\$\w+[=\s]+\$\w+[\s\.'"]+://["'\.\s]+\$_SERVER\[[^\]]+\][^\}]+(file_)pu(t_contents)[\s\(]+['"]\15['"][^;]+;[^\}]*\}(?:[^\}]*\}){2}[^\}]+\16ge\17[\s\('"]+\15[^\}]+\}(?<X1257210>)|md5\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\D{2,3}\s*["'][^'"]{0,500}["]\s*\)\s*\)\s*\{\s*@?error_reporting\s*\(\s*\d+\s*\)\s*;\s*@?array_map\s*\(\s*\([^)]+\)\s*,\s*\(\s*array\s*\)\s*\$_[GPRSC]\w{2,6}\s*\[\s*HTTP_X\s*\]\s*\)\s*;\s*\}(?<X1039501>)|substr[\(\s]+(\$\w+)[,\s]+\-1[\)\s]+==+\s*['"]e['"\)\s]+\{\s*(\$\w{1,40})[=\s]+gethostbyn[^;]+;\s*\$\w{1,40}[=\s]+\20[\(\s]+AF_INET[,\s]+SOCK_STREAM[,\s]+0[\)\s;]+if[\(\s]+(socket_)con[^\{\};]+\{\s*\22wr[^;]+;\s*while[\(\s]+\$\w{1,40}[=\s]+\22read[^;]+;[^\{]{99,299}unset[\s\(]+\21[\s\)]+;\s*\}(?<X1259130>))|\s*checkWords?List\s*\(((\$_(?:GET|POST|SERVER|REQUEST|COOKIE))\[[^\]]+])\s*,\s*\25\[[^\]]+\]\s*,\s*\25\[[^\]]+\]\)\s*\)\s*\{\s*(\$brutePass)\s*=\s*createBrutePass\s*\(\24\s*,\s*\25\[['"]domain['"]\]\s*,\s*\25\[['"]login["']\][^\)]+\);\s*if\s*\(\26\)\s*\{(?<X2065180>)|\s*count\s*\(\s*\$_POST\s*\)\s*\S{2,3}\s*\d+\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*multi_implode_data\(['"]['"],\s*\$_POST\s*,\s*\d+\);[^>]{99,899}(curl_)setopt\((\$\w{1,40}),[^\)\(]{20,40}\(array\(\s*['"]\w{1,40}['"]\s*=>\s*base64_encode\(\28\),[^\}\{]{9,499}\29exec\s*\(\30\);\s*\29close\s*\(\30\);\s*\}(?<X1125610>)|\s*defined\s*(\([^\)]+)\)\s*\)\s*\{\s*define\32\s*,\s*__DIR__[^\}]+\}\s*else\s+if\s*\(\s*empty\s*\((\$_POST)\)\s*\)\s*\{[^\}]+\}[^\(]{0,50}function\s+\w{1,20}\s*\([^\)]+\)\s*\{\s*preg_replace_callback\s*\([^<]{30,200}throw\s+new\s+exception\s*\(\33\[[^\]]+\]\s*\(\s*\33\s*\[[^\]]+\]\)\s*\)\s*;(?<X1064163>)|\s*empty\s*\(\s*\$_(COOKIE)\s*\[['"](haircki)['"]\][\s\)]+\{[^\+\*]{99,9999}(?:\s*\}){2,4}\s*@?set\35\h*\(['"]\36['"],[^;]+\);(?:\s*\})?(?<X1160761>)|\s*file(?:_exists(?:\(\s*"config/settings\.inc\.php"\s*\)\s*or\s*\(\s*"\.\./config/settings\.inc\.php"\s*\)\s*or\s*\(\s*"\.\./\.\./config/settings\.inc\.php"\s*\)(?<X2046802>)|\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*scandir\s*\(\s*"[^"]*"\s*\)\s*;\s*foreach\s*\(\s*\$\w{1,40}\s*as\s*\$\w{1,40}\s*\)\s*\{\s*if\s*\(\s*\(\s*is_dir\s*\(\s*"[^"]*"\s*\)\s*\)\s*AND\s*\(\s*\$\w{1,40}\s*!==\s*"[^"]*"\s*\)\s*AND\s*\(\s*\$\w{1,40}\s*!==\s*"[^"]*"\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*"[^"]*"\s*\)\s*\)\s*\{(?<X2046450>))|size\s*\(\s*(MAGENTO_ROOT)\s*\.\s*['"]/includes/config\.php['"]\)\s*!=\s*\d+\s*\)\s*\{\s*(\$\w{1,40})\s*\=\s*['"\s\.base64_dco]{13,40}\s*;\s*(\$\w{1,40})\s*=\s*\41\s*\([^\$]{1,400}copy\(\s*\42\s*\.\s*[^,]{1,40}\s*,\s*\40[^\}]{1,400}\s*\}(?<X1055520>))|\s*hide\w{0,5}?\s*\(\s*\)\s*\)\s*document\.writeln\s*\(\s*['"]<div\s+style\s*=\s*\\['"]display\s*:\s*none\\['"]\s*>\s*['"]\s*\)\s*;\s*<\s*/script>\s*(?:<\?php)?\s+define\s*\(\s*['"]_SAPE_USER['"]\s*,(?<X2060560>)|\s*intval\s*\(\s*\$_GET\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\$\w{1,40}\s*=\s*octdec\s*\(\s*intval\s*\(\s*\$_GET\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*;\s*else\s*\$\w{1,40}\s*=\s*\d+\s*;\s*if\s*\(\s*chmod_R\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*echo\s*"[^"]*"\s*\.\s*\$\w{1,40}\s*;\s*\}(?<X2047150>)|\s*is_(?:bitch(?:\(\s*\$_SERVER(?<X2051240>)|\s*\(\s*\$_SERVER(?<X2280222>))|file\s*\(\s*'[^']*'\s*\)\s*\)\s*\{\s*include_once\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*@ini_set\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*error_reporting\s*\(\s*\d+\s*\)\s*;\s*if\s*\(\s*!\$(\w{1,40})\s*\)\s*\{.{1500,2500}?include\("\{\$\w+\}\.\$\w+"\);\s*unlink\("\{\$\w+\}\.\$\w+"\);\s*\$\48\s*=\s*'[^']*'\s*;\s*}(?<X1039930>)))
\bif\s*\(\s*isset(?:[\(\s]+\$this\->request\->post\[[^\]]+\][\s\)]+\{(?:\s*echo\h*['"][^'"]{1,99}['"];)?\s*(\$\w{1,40})[=\h]+(\$_[GPRSC]\w{2,6}\[)[^\]]+\][\s;]+(\$\w{1,40})[=\h]+\2[^\]]+\][\s;]+(\$\w{1,40})[=\h]+(?:\1|\3)[\s\(]+['"]{2}[\h,]+(?:\1|\3)[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+;\s*@?\4\h*\(\);(?<X1193850>)|\(\$_(?:[GPRSC]\w{2,6}\s*\[['"].{300,2000}switch\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\{\s*case\s*['"]upload['"]:\s*echo\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*;\s*echo\s*['"][^']*['"]\s*;\s*break\s*;\s*\}\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1039342>)|REQUEST\['\w+']\s*\)\s*\)\s*die\(\s*pi.+eval\(\s*\${\s*\$\w+\s*}\s*\["[^"]+"\s*\]\s*\)\s*;\s*}\s*exit\(\s*\);\s*}(?<X1038560>))|\(\s*\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[['"][^'"]{1,40}['"]\]\s*\)\s*\)\s*\{\s*exit\s*\(['"]?[^'"]{0,40}['"]?\);\s*\}\s*else(?:if)?\s*\{\s*header\(['"]HTTP/1\.0\s+404\s+Not\s+Found['"]\);\s*exit\(['"]?[^'"]{0,40}['"]?\);\s*\}\s*[^\?]{1,40}\?>\s*\Z(?<X2055361>)|[GPRSC]\w{2,6}(?:\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:\s*/\*\w+\*/)?@?preg_replace\(\s*['"]/\(\.\*\)/e['"]\s*,\s*@?\$_REQUEST\[\s*['"]\w+['"]\s*\]\s*,\s*['"]['"]\s*\);\s*(?:/\*\w+\*/)?\s*\}(?<X1035682>)|\s*\[\s*"test_url"\s*\]\s*\)\s*\)\s*\{\s*echo\s+"file test okay";\s*\}\s*\$\w{1,10}="\w+";\s*\$\w{1,10}='\w+';\s*\$\w{1,10}="\w+";(?<X2045761>)))|\(\s*\${\s*[^}]+\s*}\s*\[[^\]]+\]\s*\)\s*\)\s*{\s*\$\w{1,40}\s*=\s*["'evalbs64srtprglc\s\.]+;\s*\$\w{1,40}\s*\(\s*\${[^}]+}\s*\[[^\]]+\]\s*\);\s*exit;\s*}(?<X1037640>)|\h*\(\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\h*\[[^\]]+\][\)\s]+\{\s*@?[peas](?:assthru|ystem|xec|hell_exec|val|ssert)\h*\((?:\h*@?(?:base64_decode|gz(?:uncompress|inflate)|str_rot13|strrev)\h*\(){0,9}[^;]{0,9}?\$_[GPRSC]\w{2,6}\[[^\]]+\][\h\)]+;(?:\s*(?:die|exit)\b[^;]{0,19};)?\s*\}(?<X1174010>)|\s*\((?:(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\s*\)\s*\{\s*(\$_FILE)\s*=\s*\$_[GPRSC]\w{2,6}\[['"]\w{9,32}['"]\]\s*\(['"](\$_)['"]\s*,\s*\13\.['"]\(\15\);['"]\);\s*\14\s*\(stripslashes\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\);\s*\}(?<X1129701>)|(\$_FILES\[[^\]]+\])\)\)\s*\{\s*move_uploaded_file\s*\(\17\[['"]tmp(?:_name)?['"]\]\s*,\s*\$_(?:POST|GET|REQUEST|SERVER|COOKIE)\[['"][^\]]+\]\);\s*(?:echo|print)[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*;?(?<X1063630>)|\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\W{1,4}!defined\s*\(([^\)]+)\)\)\s*\{\s*define\s*\(\19,\s*(?:true|false)\);\s*if\s*\(stristr\s*\(getcwd\(\),\s*['"]wp-admin['"]\)\)\s*\{[^\\]{400,1500}(\$\w{1,20})\s*=\s*unserialize\(\20\);\s*@?eval\(dec\(\20\[[^\)]+\)+;\s*\}\s*(?:exit|die)\(\);\s*\}(?<X1133730>)|\s*((\$this->)request->[^\]]+\])[\)\s]{1,4}\{\s*echo\s*(?:\d{1,9}[\+;\s]){1,2}\s*(\$\w{1,40})\s*=\s*\(\s*\22\s*\)\s*;[^=]{0,99}(?:eval|(?:shell_)?exec|passthru)\s*\(\s*\24\s*\)\s*;\s*(\$\w{1,40})\s*=[^=]{9,99}=\s*fopen\s*\(\s*\25\s*\.[^>]{0,99}\23db->query\s*\(\s*['"]DELETE\s+FROM[^\)]{1,99}\);\s*\}(?<X1129053>)|\s*(\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\[[^\]]+\])\s*\)\s*&&\s*\27\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*new\s+PclZip\(\s*\27\s*\);\s*if\s*\(\s*\(\s*\$\w{1,40}\s*=\s*\28->extract\(\)\s*\)\s*==\s*0\)\s*\{\s*(?:die|exit)\((?<X2118470>)|\s*(\$_[GPCSR]\w{2,6})\s*\[\s*['"](\w{1,40})['"][\]\)\s]+\{\s*@?\s*[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\s*\(\s*(?:\w{1,40}\s*\(\s*)?\30\s*\[\s*['"]\31['"][\s\]\)]+;\s*(?:die|exit)[^;]{0,19};\s*\}(?<X1184774>)|\s*(\$_[GPRSC]\w{2,6}\[[^\]]+\])\)\)\s*\{[^\}]{1,299}(\$\w{1,20})\s*=\s*\(\s*\33\s*\);\s*@?(?:system|eval|exec|shell_exec|passthru|assert|popen)\s*\(\s*\34\s*\);[^\}]{9,99}\}(?<X1121176>)|\s*@?\$_(?:[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\s\)]+\{(?:\s*echo\s*['"][^;]+['"]\s*;)+\s*(\$\w{1,40})\s*=[\s\(@'"\{]{0,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)'"\}]{0,9};\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+\36[\s\)]+;[^\}]{0,99}(?:die|exit)\b[^;]{0,19};\s*\}(?<X1191274>)|\s*\)\s*\)\s*\{\s*@?[sape](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\h\(]+(?:(?:base64_decode|str_rot13)[\h\(]+){0,5}@?\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*\}\s*else\s*\{\s*echo\s*['"][^;]*;\s*\}\s*(?:exit|die|__halt_compiler)\b[^;]{0,19};(?<X1195360>))|GET\[[^\]]{1,40}\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*DirFilesR\s*\(\s*@?\$_SERVER\[['"]DOCUMENT_ROOT['"]]\s*\)\s*;(?<X2057731>))|\s*\$\s*\{\s*["'][^'"]*["']\s*\}\s*\[\s*['"][^"']*['"]\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=["'][^"']*["']\s*;\s*\$\w{1,40}\s*\(\s*'[^']*'\s*,\s*\$\s*\{\s*["'][^"']*["']\s*\}\s*\[\s*'[^']*'\s*\]\s*,\s*['"][^']*['"]\s*\)\s*;\s*exit\s*;\s*\}(?<X1053260>)|\s*\$\w{1,40}\s*\)\s*&&\s*\$act\s*==\s*'redate'\s*&&\s*isset\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*rdFile\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*\}(?<X2047610>)|\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[(?:[^\]]+\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*="[^;]+;\s*\$\w{1,40}\s*=\s*\42\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[[^\]]+\]\s*\)\s*;\s*\}(?<X1039021>)|\s*(?:"[^"]*"\s*\]\s*\)\s*\)\s*(?:\{\s*echo\s*"[^"]*"\s*;\s*\}\s*\$\w{1,40}\s*=\s*'[^;]+;\s*@eval\s*\(\s*\$\w{1,40}\s*\(\s*'[^']*'\s*\)\s*\)\s*;(?<X1038600>)|die\s*\(\s*(?:eval|assert|passthru|exec|system|shell_exec)\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*;(?<X1040510>))|'([^']*)'\s*\]\s*\)\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*'\46'\s*\]\s*;\s*(?:eval|assert)\s*\(\s*\47\s*\)\s*;\s*(?:exit[^;]{0,9};\s*)?\}(?<X1039061>)|'[^']*'\s*\]\s*\)\s*\)\s*\{\s*error_reporting\s*\(\s*E_ALL\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*TRUE\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*@set_time_limit\s*\(\s*\d+\s*\)\s*;.+?http_build_query\s*\(\s*array\s*\(\s*'[^']*'\s*=\s*>\s*\$\w{1,40}\s*\)\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*stream_context_create\s*\(\s*\$\w{1,40}\s*\)\s*;\s*return\s*file_get_contents\s*\(\s*\$\w{1,40}\s*,\s*false\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X1037260>)|\d+\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*;\s*\$\w{1,10}\[\d+\]\(\s*\$\w{1,10}\[\d+\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1038961>)))))
\bif\s*\((?:\s*isset\s*\(\s*\$_(?:[GPCSR]\w{2,6}\[[^\]]{3,42}\][\s\)]{2,5}\{\s*(array_map)\s*\(\s*\$_[GPCSR]\w{2,6}\[[^\]]{3,42}\]\s*,\s*\1\s*\(\s*['"]stripslashes['"]\s*,\s*\$_[GPCSR]\w{2,6}\[[^\]]{3,42}\][\s\)]{2,4};\s*\}(?<X1128870>)|[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\$_[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*(\$\w{1,40})\s*=\s*\$_[GPRCS]\w{2,6}\s*\[\s*'[^']*'\s*\]\s*;\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*\3\s*,\s*'(?:w|a)\+?'\s*\)\s*;\s*\$\w{1,40}\s*=\s*fwrite\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*(?:echo\s*\$\w{1,40}\s*;)?\s*(?:exit[^;]{0,9};)?\s*\}(?<X1039071>)|[GPRSC]\w{2,6}\[[^\]\^]+['"]\^['"][^"']+['"]\)\.[^\{\}]{9,99}\{\s*\$\w{1,40}[\h=]+wp_authenticate\(\$_[GPRSC]\w{2,6}\[[^\]\^]+['"]\^[^\}]{9,499}\$\w{1,40}[\h=]+\$\w{1,40}\(['"]uggcf://[^\}]{9,999}(curl_)setopt['"];\s*\$\w{1,40}\((\$\w{1,40})[^\}]{9,999}\5close\(\6\);(?:\s*\}){1,2}(?<X1186900>)|[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*(?:&&\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*fopen\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*"[^"]*"\s*\)\s*;\s*fputs\s*\(\s*\$\w{1,40}\s*,\s*base64_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;\s*fclose\s*\(\s*\$\w{1,40}\s*\)\s*;\s*print\s*"[^"]*"\s*;\s*\}(?<X1038061>)|\)\s*\{\s*\$\w{1,40}\s*=\s*(?:['"][^'"]*['"]\s*\.\s*)?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*;\s*\$\w{1,40}\s*=\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*@array_filter\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*echo\s*['"][^'"]*['"]\s*;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1037171>)|\D{2,3}\s*isset\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*\{\s*(?:echo|print)\s*\(?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*[\*\+/\-\^]\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)?\s*;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1037252>))|[GPRSC]\w{2,6}\[\s*"test_url"\s*\]\s*\)\s*\)\s*\{\s*echo\s*"[^"]+";\s*\}[^#]+PCLZIP_READ_BLOCK_SIZE(?<X2045751>)|[GPRSC]\w{2,6}\h*\[[^\]]+\](?:[\s\)]+\{\s*(?:(\$\w{1,40})\h*=[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*@\12[\s\(]+\$_[GPRSC]\w{2,6}\h*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1194670>)|[^\$]{0,40}(?:\$\w{1,40}\s*=\s*chr\h*\(\d+\)\s*\.[chr\(\)\d\.\h]{6,}chr\h*\(\d+\)\h*;\s*|\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\s*;\s*){2,9}[^\}]{1,40}(?:\s*(?:die|exit)\b[^;]{0,19};){2}\s*\}(?<X1118161>))|\s*\)\D{2,9}\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]\D{2,9}['"][^'"]*['"][\s\)]+\{\s*echo\h*@?(?:eval|assert|system|shell_exec|exec|popen|passthru)\s*\(\s*(?:base64_decode\s*\(){0,5}\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\s\)]+;\s*(?:exit|die)\b[^;]{0,19};\s*\}(?<X1174351>))|[GPRSC]\w{2,6}\s*\[[^\]]+\](?:[\)\s]+\{\s*echo\s*['"]<form[^\?]{99,350}@?(?:copy|move_uploaded_file)\((?:(\$_FILES\[['"]\w{1,9}['"]\])[^;]{9,50};\s*chmod\(['"][^,]{9,50}\16\[[^\]]+\],\s*\d{3,4}\);(?:\s*\}\s*\})?(?<X1136081>)|\s*(\$_FILES)\s*\[[^\]]+\]\[[^\]]+\]\s*,\s*\18\s*\[[^\]]+\]\[[^\]]+\][\s\)]+\{(?:\s*echo[^;]{9,199};){1,3}[\s\}]+(?:exit|die)[^;]{0,9};\s*\}(?<X1136092>))|[^\}\{]{0,99}\{\s*(?:echo|print)\b[^;]{1,99};\s*@?\b[peas](?:val|ystem|ssert|open|xec|hell_exec|assthru)\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^;\v\}\{]+;[^\}\{]{0,99}@?(?:(?:die|exit|echo|print)\b[^;]{0,19};)?\s*\}(?<X1136554>)|\)\)\s*\{\s*@?eval\s*\(\s*gz(?:inflate|uncompress)\s*\(base64_decode\s*\(strtr\s*\(\s*(?:\(\s*)?\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\),[^\)]+\)+;\s*(?:exit|die)\b[^;]{0,9};\s*\}(?<X1131782>)|\s*\)\s*(?:[^\)]{0,40}\)\s*\{\s*if\s*\(\s*@(?:move_uploaded_file|copy)\s*\(\s*\$_FILES\s*\[\s*[^\)]{9,99}\)\s*\)\s*\{\s*echo\s+['"][^"']{1,99}['"]\s*;\s*\}\s*else\s*\{\s*echo\s+['"][^"']{1,99}['"]\s*;\s*\}\s*\}(?<X1136880>)|\)\s*array_map\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*/\*[^*]+\*/\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;(?<X1039371>)|\)\s*echo\s*file_get_contents\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*;(?<X1039091>)))|COOKIE\[['"](\w{1,20})['"]\]\)\s*\)[^\(]{1,60}if\s*\(\s*\(\s*preg_match\s*\(['"]/(?:(?:admin|wp-login\.php|wp-admin|administrator)\|?){4}/\w{1,3}['"],\s*\$_SERVER\[[^\{]{9,99}\{\s*setcookie\s*\(['"]\25['"](?<X2063612>)|REQUEST\s*\[\s*"\w+"\s*\]\s*\)\s*\)\s*{.+?@arsort\s*\(\s*\$\w{1,40}\s*\)\s*;\s*@\$\w{1,40}\s*\(\s*\$\w{1,40}\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*exit\s*\(\s*\)\s*;\s*\}(?<X1038750>))|\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{(?:\s*\s*mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;){2,4}\s*header\(\s*['"]Location:(?<X2054041>)|\s*md5(?:\(\s*reset\(\s*\$_COOKIE\s*\)\s*\)\s*==\s*'\w+'\s*&&\s*count\(\s*\$_COOKIE\s*\)\s*>\s*\d+\s*\)\s*{\s*\$_sessions_debug_data.+?unlink\(\s*\$_session_debug_stream\s*\);\s*}(?<X1038430>)|\s*\(\s*(?:@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*==\s*['"][^'"]*['"]\s*\)\s*\(\s*\$\w{1,40}=@\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\.\s*@\$\w{1,40}\s*\(\s*stripslashes\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*\)\s*;(?<X1037243>)|@\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*"[^"]*"\s*\]\s*\)\s*==\s*"[^"]*"\s*\)\s*\{\s*print\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*\$\w{1,40}\s*\.\s*basename\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*\)\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*if\s*\(\s*move_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*'[^']*'\s*\]\s*\[\s*'[^']*'\s*\]\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*\}(?<X1038120>)))|\s*me_file_put_contents\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*@chmod\s*\(\s*\$\w{1,40}\s*,\s*0444\s*\)\s*;\s*echo\s*"[^"]*"\s*;\s*\}\s*;\s*\}\s*\}\s*else\s*if\s*\(\s*\$\w{1,40}\s*==\s*'[^']*'\s*\)\s*\{\s*if\s*\(\s*file_exists\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*echo\s*me_file_get_contents\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*else\s*\{\s*echo\s*"[^"]*"\s*;\s*\}(?<X2046380>)|\s*preg_match\s*\(\s*'[^']*'\s*,\s*\$_SERVER\s*\[\s*'HTTP_USER_AGENT'\s*\]\s*\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*curl_init\s*\(\s*\)\s*;\s*\$\w{1,40}\s*=\s*\d+\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_URL\s*,\s*'[^']*'\s*\)\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_RETURNTRANSFER\s*,\s*1\s*\)\s*;\s*curl_setopt\s*\(\s*\$\w{1,40}\s*,\s*CURLOPT_CONNECTTIMEOUT\s*,\s*\$\w{1,40}\s*\)\s*;\s*\$\w{1,40}\s*=\s*curl_exec\s*\(\s*\$\w{1,40}\s*\)\s*;\s*curl_close\s*\(\s*\$\w{1,40}\s*\)\s*;\s*echo\s*\$\w{1,40}\s*;\s*\}(?<X1038030>)|\s*screen\.(?:width|height)\s*[<=]{1,2}\s*\d+\s*\)\s*\{\s*window\.location\s*=\s*['"]https?://[^/]{4,40}\.pw/[a-z]{4,8}['"];\s*\}(?<X1133421>)|\s*socket_listen\s*\(\s*\$sock\s*,\s*\d+\s*\)\s*===\s*false\s*\)\s*\{\s*echo\s*['"]HaHa(?<X2051820>)|\s*str(?:pos(?:\(\s*strtolower\(\s*\$_SERVER\[\s*'REQUEST_URI'\s*\]\s*\)\s*,\s*'\w+'\s*\)\s*\)\s*{\s*include\s*\(\s*getcwd\s*\(\s*\)\s*\.\s*'/\w+\.php'\s*\);\s*exit;\s*}(?<X1035670>)|\s*\(\s*\$_SERVER\[['"]REQUEST_URI['"]\]\s*,\s*['"]checkout['"]\s*\)\s*!==\s*false\s*\)\s*\{\s*if[\s\(]+!isset[\s\(]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\)]+\{\s*if[\s\(]+\d[\s\)]+if[\s\(]+\d[\s\)]+echo\s*file_get_contents[\s\(]+base64_decode[\s\(]+['"]aHR0[a-z\d]{9,199}=+['"][\s\)]+;\s*\}\s*\}(?<X1186790>)|\s*\(\s*gethostbyaddr\s*\([^,]+,\s*['"]google['"]\s*\)[^\{]{1,49}\{\s*header\s*\(\s*['"]HTTP/1\.[01]\s+40[134][^#@\?]{9,499}(\$\w{1,40})\s*=\s*\$_POST\[['"]pass(?:word)?['"]\];[^\{\}\?]{9,999}\$(msg|message)\s*\.=\s*['"][^;]+\38[^\(\{\}\?]{9,999}\bmail\s*\([^\)]+\39(?<X2134611>))|str\s*\(\s*\$_SERVER\s*\[\s*'[^']*'\s*\]\s*,\s*"[^"]*"\s*\)\s*\)\s*\{\s*echo\s*"[^"]*"\s*;\s*\}\s*foreach\s*\(\s*\$_COOKIE\s*as\s*\$\w{1,40}\s*=\s*>\s*\$\w{1,40}\s*\)\s*\{(?<X2047970>))|\s*substr\s*\(\s*(?:key|md5)\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\),\s*\d+,\s*\d+\)\s*\D{2,3}\s*['"][^'"]{1,40}['"]\)\s*\{\s*@?eval\s*\(\s*@?\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*\)\s*;\s*\}(?<X1137710>))
\bi(?:f(?:\s*\((?:\s*typeof\s*_popwnd\s*==\s*'[^']*'\s*\)\s*\{\s*var\s*_popwnd\s*=\s*-1\s*;\s*function\s*_popwnd_open\s*\(\s*\)\s*\{\s*if\s*\(\s*_popwnd!=-1\s*\)\s*return\s*;\s*_popwnd\s*=\s*window\s*\.\s*open\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*;\s*_popwnd\s*\.\s*blur\s*\(\s*\)\s*;\s*window\s*\.\s*focus\s*\(\s*\)\s*;\s*\}\s*\}\s*;\s*window\s*\.\s*addEventListener\s*\(\s*'[^']*'\s*,\s*_popwnd_open\s*\)\s*;(?<X1043131>)|crawlerDetect\(\$_SERVER\[['"]?HTTP_USER_AGENT['"]?\]\)\)\s*\{\s*header\(['"]HTTP/1\.\d\s+404\s+Not\s+Found['"]\);\s*die\(['"][^'"]{1,100}['"]\);\s*\}\s*\$IP_Connected\s*=\s*\$_SERVER\[['"]?REMOTE_ADDR['"]?\];(?<X2052850>)|eregi\s*\(['"](?:Linux|windows)['"]\s*,\s*\$\w{1,20}\)\)\s*\{[^//]{9,99}\$\w{1,20}\s*=\s*['"]https?://milw0rm.com/(?<X2125090>)|file_exists\((?:\$htaccessPath\)\)\s*{\s*chmod\(\s*\$htaccessPath\s*,\s*0777\);\s*if\s*\(is_writable\(\$htaccessPath\)\)\s*{\s*\$htaccessData\s*=\s*file_get_contents\(\$htaccessPath\);\s*\$htaccessTime\s*=\s*filemtime\(\$htaccessPath\);(?<X2048180>)|\s*['"](?:\.\./)+\w+\.php\.suspected['"]\s*\)\s*\)\s*rename\(\s*['"](?:\.\./)+\w+\.php\.suspected['"]\s*,\s*['"](?:\.\./)+\w+\.php['"]\s*\);(?<X2045641>))|is_object\(\$_SESSION\["__default"\]\["user"\]\)\s*&&\s*!\(\$_SESSION\["__default"\]\["user"\]->id\)\)\s*{echo\s*"\s*<script\s*language=JavaScript\s*id=onDate\s*>\s*</script>\s*<script\s*language=JavaScript\s*src=[^>]+>\s*</script>\s*"\s*;?\s*\}\s*;?(?<X1047172>)|isInString\d?\(\$\w{1,20}\s*,\s*['"]googlebot['"]\)\)\s*\{\s*\}[^\(]{2,20}header\s*\(['"]Location:[^\\]{9999,35000}(?:<li[ ][^>]{9,150}>\s*<a\s*href=['"]https?://[^>]+>[^<]{9,99}</a>\s*</li>\s*){2,7}(?<X2133771>)|isset\(\$_(?:(?:GET|POST|COOKIE|SERVER|REQUEST)\[(?:'check'\]\)\) {\s*echo "ok";\s*}\s*else\s*{\s*if\(\s*\$curl\s*=\s*curl_init\(\)\s*\)\s*{(?<X2044701>)|str_rot13\(pack\("H\*",\s*"\w+"\)\)]\)\)\s*{\$_(?<X2044371>))|(?:FILES\['\w+'\]\['name'\]\)\)\s*{\s*\$abod\s*=\s*\$filedir\.\$userfile_name;\s*@move_uploaded_file\(\$userfile_tmp,\s*\$abod\);\s*echo"<center><b>Done\s*==>\s*\$userfile_name</b></center>";\s*}\s*}\s*else{(?<X2045421>)|GET\['\w+'\]\)\)\s*{\s*header\(\s*'Content-Type: image/jpeg'\s*\);\s*readfile\('[^']+'\);\s*exit\(\);\s*}\s*header\('Location: [^']+'\);\s*exit\(\);(?<X1036280>)|REQUEST\['action'\]\).{5000,}?@file_get_contents_tcurl\s*\(\s*"[^"]*"\s*\)\s*\)\s*AND\s*stripos\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*!==\s*false\s*\)\s*\{\s*extract\s*\(\s*theme_temp_setup\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*\}\s*\}(?<X1039530>)))|isset(?:\(\s*\$_GET\['\w{1,10}'\]\)\)\s*{\s*header\('Content-Type:\s*text/html;\s*charset=windows-1251'\);\s*\$\w{1,10}=\$_GET\['\w{1,10}'\];\s*echo\s*eval/\*\*/\('\?>'\.join\("",file\("[^"]+"\)\)\.'<\?'\);\s*die;\s*}(?<X1038980>)|\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*(?:\{\s*(?:\$str\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\];\s*\$\w+[\/\*/\-]*\([/\*\/\-]*\$_[GPRSC]\w{2,6}\[[^\]]+\][/\*\/\-]*\);\s*\}(?<X1034782>)|eval\s*\(file_get_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\};(?<X1038101>))|echo\s+shell_exec\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);if\s*\(isset\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\)\s*echo\s+@?eval\s*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);(?<X1034942>)))|sha1\(md5\(\$_POST\["\w{1,40}"\]\)\)==="\w{40}"\)\s*move_uploaded_file\(\$(?<X2051600>)|str(?:istr\(\$_SERVER\['HTTP_USER_AGENT'\],\s*'(?:google|yandex)'\)\)\s*\{echo\s*\("<a href='[\w/]+' ?(?:style='[^']+')>\w+</a>\s*<br>"\);}\s*@?include\(\$_REQUEST\['\w+'\]\);(?<X1036251>)|len\(strval\(key\(\$_GET\)\)\)\)\s*\$m\s*=\s*'sub_id_1='\s*\.\s*strval\s*\(\s*key\(\s*\$_GET\s*\)\s*\);(?<X2047640>)|len\h*\(\h*\$link\h*\)\s*>\s*\d+\)\s*\{\s*\$fp\s*=\s*@?fopen\h*\(\s*\$cache\s*,\s*['"]w\+?['"]\h*\)\h*;(?<X2116962>)|pos\((?:\$_SERVER\['REQUEST_URI'\]\s*,\s*'[^']+'\)\s*!==\s*false\)\s*{\s*error_reporting\(0\);\s*ini_set\('display_errors',\s*0\);\s*set_time_limit\(0\);.+add_filter\( 'wp_title',\s*'\w+'\s*\);\s*}\s*}(?<X1035830>)|gethostbyaddr\(getenv\(['"]REMOTE_ADDR['"]\)\)[^\{]{1,30}\)\s*\{\s*header\s*\(['"]HTTP/1\.\d\s+404\s+Not\s+Found['"]\);\s*(?:exit|die)[^;]{0,9};\s*\}[^\(]{0,150}(?:include\s*\(?['"][^'"]{1,50}\.php['"]\)?;\s*){3}(?<X2123521>)))|void\s*\d\s*\D{1,3}\s*(\w{1,20})\)\s*\{\s*var\s+\23\s*=\s*\{\s*(config):\s*\{[^-]{20,150}\{\s*\23\.load\(\)\s*\}\s*,\s*this\.\24\.[^\n]{99,400}=\s*new\s+c[rol](?:inHive|ient|LT)\.Anonymous\s*\(['"]\w{32,64}['"],[^\?]{20,150}\};\s*\23\.init\(\)\s*\}(?<X1127961>)|wp_check_password\(\$_REQUEST\[['"]wpnonce['"]\]\s*,\s*['"][a-f\d]+['"]\)!==\s*true\s*\)\s*\{\s*\$\w{1,14}\s*=\s*[^\{]{1,500}\{\s*\$_SESSION\[['"]loggedin['"]\]\s*=\s*1;(?<X2278741>))|\s+!\s+pgrep\s+-f\s+"minmon(?<X2050460>)|rame_window\.scrollto\([^\)]+\);[\s\}]+write_to_iframe[\h\(]+get_boxed_text[\h\(]+['"]\h*WSO\h*shell\h*backdoor\b(?<X2204060>))|gnore_user_abort(?:\(true\);\s*set_time_limit\(0\);\s*@ini_set\('error_log',NULL\);\s*@ini_set\('log_errors',0\);\s*class\s*MCurl(?<X2048520>)|\s*\(\s*true\s*\)\s*;\s*set_time_limit\s*\(\s*\d+\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*NULL\s*\)\s*;\s*@ini_set\s*\(\s*'[^']*'\s*,\s*0\s*\)\s*;\s*function\s*getURL.+?getURL\s*\(\s*\$\w{1,40}\s*\)\s*;\s*\}\s*exit\s*;(?:\s*\}){1,4}(?<X1038151>))|mp(?:lode(?:[\s\(]+['"]_['"]\s*,\s*array[\(\s]+["']move['"][\s,]+['"]uploaded['"][,\s]+['"]file['"][\)\s]+;(?<X2196391>)|\(".r.n",array\("%1html%3","%1head%3",head\(\),"%2head%3","%1body%3(?<X2043971>)|\(\$\{\$\{['"](GLOBALS)['"]\}\[[^\]]+\]\}\)\.['"]\.module['"];file_put_contents\(\$\{\$\w{1,40}\},['"]<\?(?:php|=)?\h*(unlink\()__FILE__\);(?:\\r)?\\n['"]\.\$\{\$\w{1,40}\}\);include(?:_once)?\(\$\{\$\{['"]\33['"]\}\[[^\]]+\]\}\);\34\$\{\$\{['"]\33['"]\}\[[^\]]+\]\}\);(?:exit|die)\b[^;]{0,9};(?<X2152161>))|ortScripts[\s\(]+['"](?:https?:)?//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"]+\.js['"][\s\)]+;?(?<X1223580>)))
\bi(?:n(?:clude(?:(?:_once)?(?:[\s\(]+['"][^'"]*\bwp\-load\.php['"][\s\)]*;\s*(?:(\$\w+)[\s=]+['"][^;]+;\s*){2,3}if\s*\([^\{;]+\{\s*(\$\w+)[\s=]+@?wp_create_user\s*\([^;]+\1\b[^;]+;\s*(\$\w+)[\s=]+new\s+WP_User[\s\(]+\2[\s\)]+;\s*\3\->set_role[\s\(]+['"]admin\w+['"][\s\)]+;\s*\}\s*(?:exit|die)\b[^;]{0,9};(?<X1213350>)|\(?['"][^'"]{0,4}antibots\.php['"]\)?;[^<]{0,200}\b(?:if\(strpos\((?:\$_SERVER\[|gethostbyaddr\(getenv\()['"](?:HTTP_USER_AGENT|REMOTE_ADDR)['"][\)\]\h,]{1,4}['"]GoogleBot['"]\)[^\)]+\)\s*\{\s*header\(['"]HTTP/\d\.\d\h+404\h+Not\h+Found["']\);\s*(?:exit|die)[^;]{0,9};\s*\}\s*){2}(?<X2142831>)|\(\s*\$\w{1,40}\s*\.\s*\$_(?:GET|POST|COOKIE|REQUEST|SERVER)\s*\[\s*['"]\w+['"]\s*\]\s*\)\s*;\s*(?:exit|die)\b[^;]{0,9};(?<X1038661>)|\h*(?:\(\h*)?['"][^'"\$]{0,99}/\.(?:[^'"/]{1,49}\.txt|\.{2,})['"]\h*(?:\)\h*)?;(?<X1174885>)|\h*['"]\./View_files/validate_form\.js['"]\h*;[^{\}]{1,199}@?\$reg_username\h*=\h*addslashes\h*\(\h*\$_POST\h*\[(?<X2171680>)|\h*[\$\{\('"]{1,3}zip://[^;{}\$]+['"]\s*;(?<X1273911>)|\s*['"\(][^'"\(]{0,20}cssisma[^/]{0,20}/\w{1,40}\.php['"\(];(?<X2055111>))|(?:[\h\(]+['"]cc_validator\.php['"][\h\)]*;[^\$]{1,99}\$\w{1,40}\h*=\h*getenv\h*\(['"]REMOTE_ADDR['"]\h*\)\h*;[^\.]{1,99}include[\h\(]+['"]Email\.php['"][\h\)]*;(?<X2143000>)|\h*\(?['"][^'"]{1,40}/xREPORT/Sinus/[^'"]+\.php['"](?<X2128822>)|\h+['"]404\.php['"];\s*\}[^\.]{99,200}(\$\w{1,20})\h*=\h*new\h+\w{1,20};\s*\13->load_stop\([^\.]+\.\h*['"]/[^'"]+stops?\.txt['"](?<X2146390>)|\s*'antibots\.php';\s*\$mail\s*=\s*\$_SESSION\['mail'\]\s*=\s*\$_POST\['mail'\];(?<X2049280>)|\s*\(?['"][^'"]+bots?[^'"]+['"]\)?;[^\{]{0,199}(?:if\(strpos\([^,]+,['"]google['"]\)\s*!?==?\s*(?:true|false)\s*\)\s*\{\s*header\(['"]HTTP/\d.\d\s*404\s+[^\}]{1,49}\}\s*){1,2}(?<X2285650>)|\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*'/includes/_bb_press_plugin.class.php'\s*\)\s*;\s*register_activation_hook\s*\(\s*__FILE__\s*,\s*array\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*;\s*//\s*M\s*register_deactivation_hook\s*\(\s*__FILE__\s*,\s*array\s*\(\s*'[^']*'\s*,\s*'[^']*'\s*\)\s*\)\s*;\s*add_filter\s*\(\s*'[^']*'\s*,\s*array\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\)\s*,\s*10\s*,\s*3\s*\)\s*;\s*add_action\s*\(\s*'[^']*'\s*,\s*array\s*\(\s*\$\w{1,40}\s*,\s*'[^']*'\s*\)\s*\)\s*;(?<X1037050>)|_once(?:\([ ]+dirname\([ ]+__FILE__[ ]+\)[ ]+\.[ ]+['"]/config/class\.php['"][ ]+\)\h*;(?<X1155410>)|\s*\(\s*\$_SERVER\s*\[\s*'[^']*'\s*\]\s*\.\s*'/bitrix/[^']*\.(?:gif|jpg|jpeg|png|ico)'\s*\)\s*;(?<X1039441>))))|doxploit\b[^@]{99,999}<(h\d>)\h*Victim\s+Result\s+will\s+be\s+there\h*</\20(?<X2148261>)|fo[^'"\v;=\$]{1,99}\s*Card\h+Number\h*:\h*['"]\h*\.\h*(\$_SESSION\h*\[)['"]dftCN2['"]\]\h*\.\h*['"]\s*Expiration\h+Date\h*:\h*['"]\h*\.\h*\22['"]datex2['"]\]\h*\.\h*['"]\s*(?:Card\h+Verifi(?:cation)?\h+Number|CVV)\h*:\h*['"]\h*\.\h*\22['"]dftVC2['"]\](?<X1139061>)|i_set(?:[\(\s]+['"]display_errors['"](?:,\s*['"]Off['"][^\$]+(\$\w+)[^\$]+(\$\w+)[^%]{1,30}filemtime[\(\s]+\24[^\w]+if\(md5\((\$_[GPRSC]\w{2,6})[^\$]+\$\w+=array[^%]{1,120}if\(isset\(\26[^\$]+(\$\w+)=[^;]+;\$\w+=file_get\w+\(\27[^%]{1,110}chmod\(\27[^%]{1,919}(\w+)\(\25,\$\w+[^%]{1,8150}(\$\w+)=ltrim[^@]{1,7040}\28\(\25,\29\);die;\}+(?<X1218452>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227660>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227672>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227681>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227701>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227691>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^'"]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227711>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227770>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\$\w{1,40}[=\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227891>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,199}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*['"]<html>[^\}]{0,199}\bwindow(?:\.top)?\.location(?:\.\w+)?[^\}]{0,499};\s*\b(?:exit|die)\b[^;]*;\s*\}(?<X1227733>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^/\+]{0,99}\bbase64_decode[\(\s]+['"][^<]{999,50000}\bheader\s*\([^;]+;\s*(?:exit|die)\b[^;]*;\s*\}(?<X1227740>)|[,\s]+['"]Off['"][\)\s;@]+error_reporting[\(\s]+0[^\+/]{0,199}\bbase64_decode[\(\s]+['"][^<]{999,50000}echo\s*base64_decode\s*\([^;]+;[^\}]{0,99}\b(?:exit|die)\b[^;]*;\s*\}(?<X1227722>))|\('display_errors','Off'\);\s*error_reporting\('E_ALL'\);\s*if\(isset\(\$_FILES\['u'\]\)\s*&&\s*isset\(\$_POST\['n'\]\)\)\s*move_uploaded_file\(\$_FILES\['u'\]\['tmp_name'\],\$_POST\['n'\]\);\s*setcookie\('server',1,time\(\)\+1e6\);\s*\$s=\$_SERVER;\s*if\(\$server!=1\s*&&\s*\$s\['HTTP_REFERER'\]\s*&&\s*strpos\(\$s\['HTTP_REFERER'\],\$s\['HTTP_HOST'\]\)===false\s*&&\s*\$_COOKIE\['server'\]!=1\)\s*{\s*\$server=1;\s*eval\(file_get_contents\(base64_decode\('\w+'\)\.\$s\['HTTP_HOST'\]\)\);\s*}(?<X1036450>)|\(['"](?:display_errors|error_reporting)['"],['"](?:off|0|NULL|FALSE)['"]\);[^\$]{0,99}\$\w+=(base64_decode)\([^@\*<]{2000,9999}\bif\([^\)]+\)[\{\s]+(\$\w{1,20})=file_get_contents\(['"][^'"]{0,60}\bsistermoon\.\w{1,20}/[^\\@]{99,600}\bwindow\.location\.href=[^\$]{0,20}\44\.\43\([^\;]+;\s*(?:exit|die)[^;]{0,9};\s*\}(?<X1227100>)|\(['"]cgi\.fix_pathinfo['"],[^\)]{1,19}\);\$\w{1,40}=new\s+(\w{1,40})\(\$_[GPCSR]\w{2,6}\);unlink\(__FILE__\);(?:exit|die)[^;]{0,19};class\s+\46\{(?<X2151810>)|\(['"]display_(?:(error)s['"],['"]0['"]\);\48_reporting\(0\);[^\[]{0,999}(\$\w{1,40})[\h=]+(\$_SERVER\[)['"]HTTP_HOST['"]\][\h\.]+\50['"]REQUEST_URI['"]\];[^%\\]{0,999}\bif[\h\(]+\$\w{1,40}[!=\h]+\49[^;]+;[^\?\\]{99,1999}\becho\h*\$\w{1,40};[\h\}]+register_(shutdown)_function\(['"]\51['"]\);[^\}]{0,99}\}(?<X1184180>)|errors['"],(?:0|Null|False)\);[^\{\$]{1,499}\bfunction\s+(\w{1,40}\()[^\}]{99,499}\breturn\s+curl_exec\([^\}]{1,99}\}(\$\w{1,40})=[^;]{1,99}/wp\-[^;]{1,99}\.php['"];(\$\w{1,40})=\53['"]https?://[^/]{3,99}bin\.com?/[^;]{1,199};(\$\w{1,40})=fopen\(\54[^;]{1,9};@?fwrite\(\56,\55\);(?<X2158710>))|\([^\)]+\);\s*error_reporting\([^\)]+\);\s*setcookie\([^\{]{0,150}\bif\((isset)\((\$_FILES\[)[^\]]+\]\)\h*\D{2,3}\h*\58\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\{]{9,99}\{\s*(?:move_uploaded_file|copy)\(\59[^\}]{0,99}\}\s*elseif\([^\{]{0,99}\{\s*eval\(file_get_contents\([^\}]{0,99}\}(?<X1179500>))|jUrl[=\h]+['"]https?://toremanc\.com/[^'"]+\.txt['"]\s*(injFile)[\h=]+['"]\w+\.php['"][^&]{599,1500}\becho\h*['"]\$\w{1,25}/wp\-(?:includes|admin|content)/\$\61\h*\|\h*\$\w{1,25}['"](?<X2207800>))|octl\s*\(\s*\$listen_socket\s*,\s*0x8004667e(?<X2049880>)|p\h*=\h*getenv\(['"]REMOTE_ADDR['"]\);\s*\$\w{1,9}\h*=\h*[""]Mini\s*shell['"];(?<X2146150>))
\b(?:is(?:_readable\s*\(\s*['"]/etc/passwd['"]\s*\)\s*\?[^\?]{100,600}php_uname\(\)(?<X2056371>)|set\((?:(?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:['"][^'"]*['"]=+(?:sha1|md5|\(\!?strcmp)?\((?:\2|\$\{[^\}]+\})\[[^\]]+\])(?:[^@]{1,100})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252771>)|(\$_REQUEST)[^\]]{1,32}[\]\)]+\{(\$\w+)=['"]\\x[^;]+;\$\{\5\}=\4\[['"]\w+['"]\];echo\h*executecommand\(\$\{\$\{['"]\\x(?<X2265351>))|set\s*\((?:\$_[GPRSC]\w{2,6}\[['"]get(?:(?:web)?shell\d?|backdoor)['"]\]\)\)\s*\{\s*@?(?:exec|shell_exec|system|assert|popen|pcntl_exec|eval|file_get_contents)\(['"][^:]{0,20}https?://\w{1,20}\.paste\.se/(?<X2135280>)|\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*&&\s*\(\$\w{1,40}\s*=\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*&&\s*@preg_replace\(['"][^'"]*e['"],\s*[^,]+,\s*['][^"']*[']\);(?<X1037581>)))|json_decode\(file_get_contents\(['"]https?://www\.geoplugin\.net/[^\[]{99,999}\bfunction\h+country_sort\(\)\s*\{[^\(]{9,40}\$\w{1,20}\h*=\h*array\((?:\d+,?)+\);[^\?]{99,200}\bheader\(['"]Location:(?<X2147521>)|kirim_mail\h*\([^;]+;[^\?:]{1,499}\bheader\h*\(\h*['"]Location:(?<X2163812>)|L(?:[O0]GZ(?:xx)?\h*\$country[^#]{9,250}\$msg\h*=\h*['"][^'"]{9,59}_ONE\h*WITH\h*GOD_[^\}]{99,599}\}\s*else\h*\{\s*mail\([^\)]+\);\s*header\((?<X2167831>)|e(?:afMailCheck\h*\(\h*\$\w{1,40}[\s\)]{1,9}\{(?<X2157470>)|t\s*\w{1,14}\s*=\s*localStorage[^\{]{1,200}let\s*(\w{1,14})[=\s'"htps:/]+jatesmetrics\.xyz[^\{]{1,250}\{[^\{]{1,150}\{[^\{\}]+CVC[^\{]{1,999}\{[^\}]{1,999}\bgetElementById\(['"]cvv["']\)[^\}]+\};\s*fetch\(\13[^\!]{1,999}\![^\!]{1,300}\![^\!]{1,300}\![^\!]{1,400}\![^\}]{1,300}\}\s*\}\s*,\s*\d+\);(?<X1273591>))|ist(?:\((?:\$tobuf,\$from,\$frompwd,\$fromname,\$subject,\$message\)= split \(':::',\s*\$conar\);\s*\$toar = split\('\\\|\\\|',\$tobuf\);\s*foreach \(\$toar\s*as\s*\$to\)\s*{\s*list\(\$fromlogin,\$fromhost\)=split\('@',\$from\);(?<X2046620>)|\s*\$tobuf\s*,\s*\$from\s*,\s*\$subject\s*,\s*\$messagefile\s*\)=\s*explode\s*\(\s*':::'\s*,\s*\$conar\s*\);(?<X2046670>))|\s*\(\s*\$tobuf\s*,\s*\$from\s*,\s*\$subject\s*,\s*\$messagefile\s*\)\s*=\s*split\s*\(\s*':::'\s*,\s*\$conar\s*\)\s*;(?<X2047950>))|ite\W{0,5}\bSimple\s*(?:shell\h*|backdoor\h*){1,2}\h*\](?<X2175691>)|o(?:ad_(template)[\s\(]+strrev[\s\(]+['"]//:piz['"][\s\)]+\.\s*locate_\19[\s\(]+['"][^'"]+\.\19['"][\s\)]+\.\s*['"]#\19['"][,\s]+true[\s\)]+;(?<X1221270>)|cation\.replace\(url\+['"][^'"]{1,99}\.php\?p=['"]\h*\+\h*imei_c\h*\+['"]\|?Injection(?<X2151541>))))
\bM(?:[a4@][s5][s5]\h*D[e3]f[a4]c[e3](?:\h*1Dir)?\h*Tools</(?:h\d|title)(?<X2156511>)|a(?:de(?:\h*by\h*cyborg[^\?]{0,399}\berror_reporting\b(?<X2183210>)|_by="Bl0od3r";(?<X2050970>))|g(?:e::getModel\(['"]admin/rules['"]\)\h*((\->set)Role)Id(\(\$\w{1,40}\->getId\(\)\))\h*\5Resources(\(array)\(['"]all['"]\)\)\h*(\->saveRel)\(\);[^\?]{99,499}\$(\w{1,40})\h*\4Ids\7\6\)\h*\4UserId\(\$\9\->getUserId\(\)\)\h*\8ations\(\);\h*\}\h*catch\b[^\}]{9,99}\}\h*echo\b[^;]+;\h*(?:unlink\(__FILE__\);)?(?:\?>)?\Z(?<X2158584>)|icboom\(\$_GET\["y"\]\);\$f\s*=\s*\$_GET(?<X2048310>))|il(?:[\h\(]+\$\w{1,16}\h*\,\h*['"]Ll[o0]yds\b[^;]+\.\h*\$_SERVER\[[^\]]+\][^;]+(\$\w{1,40})\h*\)\h*;\s*(\$\w{1,40})\h*=\h*fopen\h*\([^;]+/[\w\-]{1,40}\.txt['"][\h,]+['"][aw]\+?['"]\h*\)\h*;\s*@?fwrite\h*\(\h*\13\h*,\h*\12\h*\)\h*;(?<X2179561>)|\(['"]{2},\h*\$headers\h*,\h*(\$\w{1,40})\b[^;]{1,99};\s*(\$\w{1,40})\h*=\h*fopen\h*\([^\),;]{1,99}\.txt['"]\h*,[^;]{1,99};\s*@?fwrite\h*\(\h*\16\h*,\h*\15\h*\);[^#]{99,299}\bfaceb[^\so</t]{1,9}ok</title>(?<X2166891>)|\([^,;]+,['"][^'"]+\bRezult[sz]?\b(?<X2215331>)|\([^;]{1,99};\s*\?>\s*<!\-\-\s*Powered\s+by\s+sadflix\b(?<X2162940>)|\([^\);'"@]{9,40}\);\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][^\)\$\(]{0,24}\)\s*\{\s*echo\s+['"]<form\s+action\s*=\s*['"][^'"]*['"]\s+method\s*=\s*['"]post['"][^@]{99,300}@copy\(\s*(\$_FILES\[[^\]]+\])\[[^\]]+\],\s*\20(?<X2124241>)|\([^\)]+\$(?:(m(?:e?sg|essage)?)\b[^\?]{1,199}\bfwrite\([^\)]+\$\22\h*\);\s*header\h*\(\h*["']Location:\h*https?://[^/]{0,99}\bcorreos\.es/(?<X2160200>)|(me?s(?:g|sage))\b[^;]{1,99};(\$\w{1,40})=fopen\([^;]{1,99};fwrite\(\25,\$\24\);[^@=]{1,199}<script\b[^>]{0,99}>[^;\(='"]{1,99}\blocation\.href\h*=\h*['"][^\?'";&=]{1,99}\?sslchannel=true&(?:amp;)?sessionid=(?<X2166360>))|\([^\)]+\);(?:[^\(]{1,20}\bfopen\(['"][^'"]+\.txt['"]\h*,\h*['"]a['"]\);\s*fwrite\([^\)]+\);\s*header\(["]Location:[^/]+/verification-card\.php\?cmd=(?<X2142070>)|\s*\$\w{1,20}\h*=\h*fopen\(['"][^/]+/Paype/hell\.php\b(?<X2142060>)|\s*echo\h+\$[^>]{3,35}>\h*H[4a]ck[5S]n[i!]p\b(?<X2143080>)|\s*header\(['"]Location:[^\?]{1,99}\?websrc=['"][^\)\(]{1,29}['"]\.md5\([^;&]{2,30}&dispatch\h*=\h*(?<X2151010>))|\([^\)]{1,60}\);\s*\?>\s*<\?php(?:\s*\$\w{1,40}\s*=\s*@?(?:system\(id\)|php_uname\(\)|PHP_OS);){3}(?<X2120570>)|\(\$\w{1,9},\h*['"]New[^#]{99,300}<title>Bullbank\h*Online(?<X2143720>)|\(\$_POST\['email'\]\s*,\s*\$_POST\['subject'\]\s*,\s*\$_POST\['content'\]\s*,\s*\$headers\);\s*}\s*\?>\s*<title>BOOM</title>(?<X2045890>)|\(\$emailusr,\s*(\$subj),\s*(\$data)\);\s*mail\(\$cc,\s*\34,\s*\35\s*\);\s*header\(['"]Location:[^'"]{1,40}\.scotiabank\.com/[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054880>)|\(\s*\$\w{1,40},\s*\$\w{1,40},\s*(\$message)\s*\);\s*(\$\w{1,4})\s*=\s*fopen\(\s*['"]\w{1,40}\.?\w{1,10}['"]\s*,\s*['"](?:a|w)\+?['"]\s*\);\s*fputs\(\s*\38,\s*\37\);(?:\s*fclose\(\s*\38\s*\);)?\s*header\s*\(\s*['"]Location\s*:[^\)]{1,100}\);\s*(?:exit\(\);)?\?>(?<X2054430>)|\h*\(['"](?:[^@]{2,20}@\w{3,15}\.com['"]\h*,\h*['"]Byna\h*Alert['"]\h*,\h*\$\w{1,20}\);\s*header\h*\((?<X2171570>)|[^@]{4,30}@(?:protonmail|yandex|gmail)\.\w{2,6}["'],[^\)]+\);\s*(?:file_put_contents|fopen)\h*\(['"][^'",]{0,9}\b\w{1,20}\.txt['"],[^\)]+['"]?(?:a|file_append)['"]?\);[^\{_]{99,200}\bfunction\h+Redirect\(\)\s*\{\s*(window\.)parent\.\41location\.href\h*=\h*['"]https?://(?<X2164371>)|suspiciousmail@googlemail\.com['"],(?<X2168520>)|th3\.pr0@(?:yandex|protonmail)\.(?:com|ru)(?<X2156760>))|\h*\([^;]{5,150}\);\s*echo\h+['"][^'"]{2,20}\bAuto\h+E?Xploiter['"];(?<X2182360>)|\h*\([^;]{9,40}\$XBALTI_(?:email|message|SUBJECT|HEADERS)\b(?<X2180110>)|\h*\([^\)]+\);\s*header\h*\(['"]Location:[^\.]{1,15}carding\.php\b(?<X2144040>)|\h*\([^\)]{9,90}\);\s*(\$\w{1,9})\h*=\h*['"]Array\s*gans['"];\s*\$__\w{1,9}\h*=\h*['"]getcwd['"][^#]{99,500}<(title)>['"]\h*\.\h*\48\h*\.\h*['"]</\49>(?<X2153340>)|\h*\([^\)]{9,99}\)\h*;[^=\v]{0,99}\bsetcookie\h*\([^;]+;\h*\$\w{1,40}\h*=\h*(__FILE__)\h*;\h*(\$\w{1,40})\h*=\h*['"][^'"]{9999,}['"];\h*(\$\w{1,40})\h*=\h*base64_decode\(\52\)\h*;\h*\53\h*=\h*strtr\h*\(\h*\53\h*,[^;]+;\h*(\$\w{1,40})\h*=\h*[pe]reg_replace\(\h*['"]\51['"]\h*,[^;]+;\s*eval\(\54\)\h*;(?<X2164481>)|\h*\(\$\w{1,20}(?:,\$subject,\$fuck,[^\)]+\);\s*header\h*\(['"]Location:(?<X2140681>)|\h*,\h*['"](?:Amazon|Netflix|Disney|Spotify)\h+Fullz\b(?<X2176010>))|\h*\(\h*(?:(?:\$\w{1,40}\h*,?\h*){4}\);\s*(\$\w{1,40})\h*=\h*fopen\h*\(['"][^'"]{1,40}\.txt['"]\h*,\h*['"]a\+?['"]\h*\);\s*@?fwrite\h*\(\h*\58\h*,\h*\$\w{1,40}\h*\);[^\$]{1,99}(\$\w{1,40})\h*=\h*['"]https://connect\.secure\.wellsfargo\.com/auth/[^;]+['"];\s*header\h*\(\s*"Location:\h*\59"\h*\);(?<X2142122>)|['"][^@'"\);]+@(?:gmail|ya(?:ndex|hoo)|(?:proton|hot)mail|live|outlook)\.[\w\.]{1,9}['"]\h*,[^\?]{1,499}\$experience_login\h*=\h*@?file_get_contents\h*\([^;]{1,99}\bInternetBanking[^'"]{0,99}\.(?:html?|txt)['"]\h*\);(?<X2164870>))|\s*\((?:\$\w{1,20},?\s*|\$\{\$\{['"]G[^\}]+\}\[[^\]]+\]\},?){4}\);\s*header\s*\([""]Location:\h*https?://(?:www\.)?(?!qbank)[^/]{0,20}(?:bank|paypal|gmail|yahoo|microsoft|amazon|ebay)\.\w{2,6}/(?<X2146532>)|\s*\((?:\s*['"]?\$\w{1,40}['"]?\s*,?){3,4}\);\s*(\$\w{1,40})\s*=\s*@?mail\s*\((?:\s*['"]?\$\w{1,40}['"]?\s*,?){3,4}\);\s*if\s*\(\s*\63\s*\D{2,3}\s*\S+?\s*\)\s*\{\s*header\s*\(['"]Location:[^;\)'"]{1,99}(?:loan|bank|wealth|amazon|gmail|aol|pay|microsoft|bing|azure|google|yahoo)(?<X2130020>)|\s*\([^\)]+\);\s*\}[^\(]{9,99}\s*\}\s*setcookie\s*\([^\)]+\);\s*\$backdoor\s*=(?<X2124010>)|\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*(?:['"][^'"]{0,40}['"]\s*,\s*\$\w{1,40}\s*\)\s*;\s*print\s*['"]OK(?:\s*By\s*King)?<br>['"]\s*;\s*flush\s*\(\s*\)\s*;(?<X2054001>)|\$\w{1,40},\s*\$\w{1,40}\s*\)\s*\)\s*\{\s*header\s*\(\s*['"]Location\s*:[^\?!]{1,500}\?>\s*<!DOCTYPE\b[^\?!]{1,500}<title>\s*(?:404\s+)?Error\b(?<X2126120>)))|ke(?:botlist\s*\(\s*(\$BotList)\s*\)\s*\{\s*if\s*\(\s*!file_exists\(\s*\68(?<X2057250>)|hide\('action', 'backconnect'\);\s*p\('<p>'\);\s*p\('Your IP:'\);\s*makeinput\(array\((?<X2046730>))|ss\s*(?:exploiter\s*</title>[^\?]{99,499}<\?php\s*(?:(?:error_reporting|set_time_limit)\h*\(\h*(?:0|NULL|False)\h*\);\s*){2}\s*function\s*\w{1,40}\b[^\{]{1,199}\{\s*\$\w{1,40}\h*=\h*curl_init\h*\(\h*\);(?<X2170990>)|Revslider\h*exp?l[0o][i1]t[1i]?n?g?</title>(?<X2176440>)))|d5(?:\(\$\w{1,15}\[['"]AlfaPass['"]\]\)\);\s*header\([^\?]{99,299}\btitle>\W{0,5}\bAlFA\h*team\h*shell\h*\-\h*v\h*['"]\h*\.\h*__ALFA_VERSION__(?<X2189150>)|\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\)\s*===\s*__PASSWORD__\s*\)\s*\{\s*\$\w{1,40}\s*=\s*array\s*\(\s*filemtime\s*\(\s*__FILE__\s*\)\s*,\s*filemtime\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*basename\s*\(\s*\$\w{1,40}\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\[\s*_\d+\s*\(\s*\d+\s*\)\s*\]\s*\)\s*;\s*if\s*\(\s*move_uploaded_file(?<X2046370>))|eta\h*http\-equiv\h*=\h*['"]Refresh['"][^#]{99,199}<\?php\s*\$\w{1,15}\h*=\h*(\$_[GPRSC]\w{2,6}\[['"])username['"]\];\s*\$\w{1,15}\h*=\h*\75password['"]\];\s*(\$to)\h*=[^\?]{9,250}\bmail\h*\(\h*\76(?<X2167871>)|INI\h+SHELL\h*</title>(?<X2149111>))
\b(?:M(?:kdir(?:[\(\s]+['"](\w+)['"\)\s;@]+eval\(['"fileput_cons\.\s]{19,}\(['"]\1[^'"]{1,40}\.php['"][\s,]+['"fopen\.\s]{6,}\(['"]http[^'"]{9,99}['"][\s,]+['"]\w\+?['"\s\);]+(\$\w{1,40})[\s=]+(curl_)init\b[^\+]{0,999}(\$\w{1,40})[\s=@]+fopen\b[^;]+;(?:(?:[^\?=\n]{0,99}(?:\3close|fclose))[\s\(]+(?:\2|\4)[\s\)]+;){2}(?<X1201300>)|[\s\(]+['"]([^'"]+)['"][\s\)]+;\s*@?(file_)pu(t_contents)[\s\(]+['"]\6/[^'"]+\.php['"][\s,]+\7ge\8[\s\(]+['"]https?://[^/;'"]*\bgithub(?:usercontent)?\.[^;]+;(?<X1207390>)|\(['"](?:([^'"]{1,49})['"],0?777\);symlink\(['"]/['"],['"]\10/[^'"]{0,49}['"]\);(\$\w{1,40})=['"][^'"]{1,99}\b(?:Add(?:Type|Handler)\s*text/plain\s*\.php\s*){2}[^'"]{1,99}['"];file_put_contents\(['"]\10/\.htaccess['"],\11\);(?<X2147980>)|(\w{1,20})['"],\h*\d{3,4}\);\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*(\$\w{1,9})\h*=\h*\$_[GPRSC]\w{2,6}\[[^;]+;\s*\bsystem\(['"]ln\h+\-s\h*['"]\.\14\.['"]\h*\13/['"]\.\15\);\s*symlink\(\14,['"]\13/['"]\.\15\);\s*\$\w{1,9}\h*=\h*fopen\(['"]\13/\.htaccess['"],\h*['"]w['"]\);(?<X2188840>)|(\w{1,40})['"][^;]{1,99};chdir\(['"]\17['"]\);(symlink\()['"]/['"],[^\}\?]{1,499};file_put_contents\(['"]\.htaccess['"],[^\}\?]{1,199}\b\18(?:['"]/home\d*/['"]\.(\$\w{1,40})\.['"]/public_html/[^'";\)]+['"],\19\.['"][^'";\)]+\.txt['"]\);\18){9}(?<X2170400>)|page/['"]\.mb_substr\(md5\((?:(\$key)\)\h*,[^\}]{9,199}\bfile_put_contents\(['"]sitemap[^\.]{0,12}\.(?:txt|xml)['"]\h*,\h*\21\b[^;]+;\s*\}(?<X2178890>)|\$key\)(?<X2110651>))|XDz-config['"],0777\);\s*\$\w{1,20}\h*=\h*['"]Options\h+all\h+\\n(?<X2162870>))|\h*\((?:(\$\w{1,29}\.\$doorpath\.[^\$]{1,6}\.\$\w{1,20})\);\s*if\h*\(\h*is_writable\h*\(\25\)\)\s*\{[^\}\?]{9,99}\bif\h*\(!?\$\w{1,20}\h*=\h*fopen\(\25\.['"]/writedoor\d+\.php['"],['"]w['"]\)(?<X2182600>)|[^\{\}]{1,99}['"]moban\.html\h*['"]\h*;(?<X2146751>))|\s*\(\s*['"]\w{1,40}['"]\s*\);\s*\$\w{1,40}\s*=\s*@?file_get_contents\s*\(['"]https?://phpshell\.[^'"]{1,99}['"]\s*\);\s*[^\(]{1,40}@?touch\s*\(\s*['"][^\.]{1,40}\.php['"]\s*\)\s*;(?<X2122311>)|\s+[./]{1,9}/(\w{1,20})\s*(?:echo\s+['"]?(?:Options|DirectoryIndex|AddType|AddHandler|ReadmeName)[^>]{1,40}>{1,2}\s*[./]{1,9}/\29/\.htaccess\s*){5}[^;]{99,400}for\s+\w\s+in\s*.cd\s+/etc\s*;\s*cat\s+passwd[^;]{9,50};\s*do\s*(?:eval\s+['"]ln\s+-s\s+/[^'"]{9,99}['"];\s*){20}(?<X2118822>))|o(?:iyan8@gmail\.com['"];[^\(]{1,40}(?:getenv|mail)\((?<X2121783>)|ve_uploaded_file\s*/\*;\*/(?<X2043731>))|sg\(['"]compiling\s*shell\s*in\s*/tmp['"]\)\s*ret\s*=\s*os.system\(['"]gcc(?<X2128181>)|t_rand\(\s*0\s*,\s*count\(\s*\$not_android_urls\)-1\)(?<X2043821>)|u(?:ltiple\h*config\h*fucker[^>]{0,99}</?(?:title|font|br?)>(?<X2181551>)|nmap\s*\(args\.thp_map\s*,\s*MAP_SIZE\);\s*if\s*\((\w{1,20})\)\s*\{\s*fprintf\s*\(stderr\s*,\s*['"]\D{0,4}Exploit\s+Failed\D{0,4}['"]\);\s*\}\s*return\s+\36;(?<X2122370>))|y(?:\h*(\$\w{1,15})\h*=\h*['"][^'"]{0,99}\bcasper\h*rfi\h*crack\h*bot\b[^'"]{0,150}['"];\s*print\(\38\);(?<X2184750>)|\h+\$\w{1,20}\h*=\h*join\h*\(['"]{2},@victims\);\s*print\h+['"]OOM.Killer\h*Victims\b(?<X2179530>)|\s*(?:%\w{1,9}\s*=\s*\(\);\s*my\s*(\$\w{1,40})\s*=\s*['"]/etc/passwd['"];\s*open\s*\(\s*PASSWD,\s*['"]\s*<\s*\41(?<X2057600>)|\$\w{1,40}\s*;\s*\$\w{1,40}\s*\.\s*=\$\w{1,40}\s*while\s*\(\s*<\s*DATA\s*>\s*\)\s*;\s*eval\s*\(\s*unpack\s*\(\s*'[^']*'\s*,\s*\$\w{1,40}\s*\)\s*\)\s*;(?<X2048200>)|\$fakeproc\s*=\s*"/usr/local/apache/bin/httpd\s*-KKD"(?<X2046970>))|\s+(\$\w{1,40})='';\45\.=\$_\s+while\(<DATA>\);\45=unpack\(['"][\w\s]{1,5}\*['"],\45\);\45=[^;]{32,75};@?eval\(\45\);\s+__DATA__\s*\w\(.{7500,8000}\s*\Z(?<X2062895>)|dir->close\(\);\s*@chmod\("\$deldir",0777\);\s*echo\s+@rmdir\(\$deldir\)(?<X2050860>)|sql(?:_error\(\);\s*\}\s*\}\s*(?:else)?if\s*\(\s*isset\s*\(\s*\$_REQUEST\[['"]?([^'"]{1,40})['"]?\]\s*\)\s*\)\s*\{\s*\$_REQUEST\[['"]?\48['"]?\]\s*\.?=\s*\$\w{1,40}\s*\.\s*\$_REQUEST\[['"]?[^'"]{1,40}['"]?\];\s*if\s*\(\s*@?unlink\(\s*\$_REQUEST\[['"]?\48['"]?\](?:\s*\)\s*){1,5}\{(?<X2055681>)|i_query[\h\(]+\$con[,\h]+\$sql\d[\)\h]+;\s*file_put_contents\h*\(['"]\.//application//extra//\w{1,40}\.php['"][,\h]+(?:gz(?:uncompress|inflate)\()?base64_decode[\(\h]+['"][^'"]{999,}['"][\)\h]+;\s*(?:touch|exit|die)\h*\((?<X2177782>))|Upload\->uploadFile\h*\(\h*\)(?<X2044012>)))|n(?:ame\s*===\s*"webconsole"\)\s*\$get\s*=\s*array\(['"]https?\:\/\/pastebin\.com\/raw(?<X2051740>)|ew(?:\h+Hello[_\-]?Dolly\h*\(\h*\)\h*;(?<X2171011>)|\s*\w+\(atob\(['"]c2V0VGltZW91[^'"]{1,256}(?:Y29tL3V0aWxz|b20vdXRpbHMv|LmNvbS91dGlscy8)[^'"]+(?:fSwyMDAwKQ|LDIwMDAp|MjAwMCk)[=\+/]{0,2}['"]\){2}\(\)(?:\s*;)?(?<X1254421>)|\s*function\s*\(\s*atob\s*\(\s*['"]c2V0VGltZW91dChmdW5jdGlvbigpe2pRdWVyeS5nZXRTY3JpcH[^\)]{0,199}(?:LGZ1bmN0aW9uKCl7alF1ZXJ5K|ZnVuY3Rpb24oKXtqUXVlcnk|dW5jdGlvbigpe2pRdWVyeS)[^\)]{0,199}(?:KS5yZW1vdmVBdHRyKCJvbmxvYWQiKX0pf|LnJlbW92ZUF0dHIoIm9ubG9hZCIpfSl|cmVtb3ZlQXR0cigib25sb2FkIil9KX)[^\)]+\){2}\(\)(?<X1249181>))|otify_me\h*\(\h*\)\h*;[^\v\*\^]{99,1999}\bfile_put_contents\h*\(\h*(?:\$_[GPRSC]\w{2,6}\h*\[[^\]]+\]|strrev)\h*\(\h*hex2bin\h*\([^\v\*]{99,1999}\bsetcookie\h*\(\h*['"]priv[^;\v]{9,99}['"]\h*\)\h*;(?:\h*\}){2}(?<X2139790>))|o(?:b(?:_(?:end_clean\(\);\s*(\$\w{1,15})[\h=]+str_replace\(array\(\s*(?:WPSecurityValidateKey\([^\)]+\),?\s*){4}\),\h*['"]{2},\h*\57\);\s*echo\h*\57;\s*exit\(\);[\s\}]+function\h*\w+\(\)\s*\{\s*if[\h\(]+is_404\(\)[\s\)\{]+WPSecurityAnalyseRequest\(\);(?<X2203540>)|start[\(\)\s]+;\s*phpinfo[\(\s]+\d+[\)\s]+;\s*\$\w{1,40}[=\s]+ob_get_contents[\(\)\s]+;[^\?]+\bphp_sapi_name[\(\)\s]+\?[^\?<\|]{99,9999}\$\w{1,40}[=\s]+['"](?:index\.php|\.htaccess)['"]\s*;\s*\$\w{1,40}[=\s]+['"](?:index\.php|\.htaccess)['"]\s*;(?<X1227862>))|fuscated\s*by\s*Yak\s*Pro\b[^;\$]{9,499}\bgoto\s*\w{1,9};\s*\w{1,9}:[^@]{99,499}\$(\w{1,40})\h*=\h*['"][^'"]{1,49}[pg](?:mail|rotonmail)\.com['"];[^@]{9,99}\bmail\h*\(\h*\$\60\b(?<X2157990>))|n(?:error\s*=\s*['"]eval[\s\(]+/\*[^;\*\n/]{0,40}\*/\s*String\.fromCharCode\s*\([\d,\s]{99,999}[\s\)]+['"](?<X1197350>)|mouseover=['"](this\.)stop\(\)['"]\h*onmouseout=['"]\63start\(\)['"]>[^_]{0,20}\bcyb[3e]r_[i1]d[3ei1][0o][t7]\b(?<X2142152>))|p(?:en(?:\((?:my\s*)?(\w+),[^\)]*\$ARGV\[[^\?]{1,499}\bwhile\(<\65>\)\{(?:(\$\w+)=\$_;)?[^\?]{1,499}\bsystem\(['"]p(?:erl|ython|hp)\b[^'"]{1,199}(?:\66|\$_)\b(?<X2211631>)|\h*FILE,[^\?:,@%&\*]{1,199}\bmy\h*(\$\w{1,40})=new\h*Parallel::Forkmanager\([^\?]{1,999}\bsendmail\([^\)]{1,199}\);\68\->finish;(?<X2181810>)|\s*\((d[o0]mains),\s*['"]/etc/named\.conf['"]\s*\)[^;]+;\s*@?\w{1,9}\s*=\s*<\70>;\s*close\s*\70\s*;\s*if\s*\(\s*\$err\s*\)\s*\{(?<X2132641>)|ssl_(decrypt)\([^@%&:\\\+]{1,999}\$(\w{1,40})=new\h+\72\b[^\?@#%&\\\+]{1,999}\$\73\->removeDeface\((?<X2184990>))|tion\s*value=['"]cat\s*/etc/passwd['"]>(?<X2050881>))|s\.system\(['"]ln\h+-s\W{0,9}\w{1,20}\.txt['"]\)\s*(\w{1,9})\h*=\h*['"]Options\h+indexes\h+FollowSymLinks\\n[^'"]{9,99}['"]\s*(\w{1,9})\h*=\h*open\(['"]\.htaccess['"],['"]w\+['"]\)\s*\77\.write\(\76\)\s*\77\.close\(\)(?<X2158700>)))
\bp(?:(?:ass|wd?)(?:wo?r?d)?s?\h*=\h*\$_POST\h*\[[^\]]+\][^@]{9,99}\b(mail_to)\h*=\h*['"][^\}]{0,399}\bmail\(\$\1,\h*['"]Logs\d\h*Attemt\b(?<X2169021>)|ath_throwgh_files.+burlywood(?<X2046140>)|cntl_exec\(['"][^\s'"]{0,49}\bperl\b[^=]{1,199}=(\w{1,9}(\(\$\w{1,40}\);))\W{0,9}(unlink)\5[^@#%&\|]{99,999}=new\h*COM\(['"]WScript\.Shell['"]\);\$\w{1,40}\->Run\(['"]c:[^\s'"]+\.exe\b[^=]{1,199}=\4\W{0,9}\6\5(?<X2180710>)|h(?:ishers\h+is\h+against\h+abusive\h+form[^\$]{9,99}['"];\s*\$bad_words\h*=\h*array\((?<X2150560>)|p(?:_uname(?:\(\)(?:,\s*['"][^'"]{1,40}['"]=>phpversion\(\),['"][^'"]{1,40}['"]=>['"]\d+\.\d+['"],[^\?/\]]{1,599}/json['"]\);echo\s*json_encode\((?<X2130820>)|[^\?]{1,300}<title>[^<]{0,25}\bSh[e3]ll\b[^<]{0,25}</title>(?<X2133121>))|\h*\(\)\h*(?:;\s*\$\w{1,40}\h*=\h*@?ini_get\h*\(\h*['"]disable_functions['"]\)\h*;(?<X2167091>)|\.\h*base64_decode\h*\((?<X2259600>))|\s*\(\s*\)\s*\.[^\(]{1,99}getcwd\s*\(\s*\)\s*;?[^\(;]{1,499};\s*if\s*\(\s*!\s*empty\s*\(\s*\$_FILES\[[^\]]+\][\s\)]+\{\s*@?(?:move_uploaded_file|copy)\s*\(\s*\$_FILES\s*\[(?<X2127210>))|ddos\.com[^'"]{0,40}['"];\s*echo\s*['"]\s*SYN\s*Flood(?<X2052770>)|info\s*\(\);\s*break;[^\?]{9,9999}<form\s+action=['"]\?[^`]{999,19999}\bshell_exec[\(\s]+\$\w{1,40}[\)\s]+;(?<X2222102>)|shell[^\?]{0,49}\buse\h*\w{1,15};\s*my\h*\(\h*\$\w{1,15},\h*%FORM\h*\);(?<X2172650>)|version\s*\(\s*\)\s*;\s*@?mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*@?mail\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*header\s*\(\s*['"]Location:[^'"]{1,40}['"]\s*\)\s*;\s*\?>(?<X2054481>)))|l(?:\(\$s_cwd\)\.['"]&x=upload['"](?:\.['"]+)?>upl\b(?<X2049361>)|ugin\h*name:\s*(\w+)[^\?]{0,99}\bclass\h*\19\s*\{\s*var\h*\$\w+[\h=]+['"][^'"]{2999,}['"];\s*var\h*\$\w+[\h=]+array\(\d+,[^\?]{999,59999}\bisset\((\$_SERVER\[\$\w+\])\)[\h\?]+\20[^#]{999,4999}\beval\(\$\w+\->\w+\);\s*\}\s*\}(?<X2209700>))|o(?:ison\h*Shell\s*</title>\s*['"]\s*;\s*(\$\w{1,40})\s*=\s*php_uname\s*\([^;]{1,49};\s*\$\w{1,40}\s*=\s*['"]https?://(?:www\.)?exploit\-db\.com/search/[^;]{0,499}\22(?<X2140590>)|rt_c="I2luY2x1ZGUgPHN0ZGlvLm(?<X2051070>)|wered\s+by\s+Mr\.Alsa3ek\s+@\s+TeaM\s+HacKer\s+Egypt\b(?<X2265380>))|r(?:e(?:>';\s*if\s*\(\$_POST\[['"](cmd)['"]\]\)\{\s*\$\26\s*=\s*\$_POST\[['"]\26['"]\];\s*passthru\(\$\26\);(?<X2052710>)|g_match(?:(?:_all)?\([^,]+,file_Get_contents\((?:['"]php://input|\$_[GPCSR]\w{2,6}\[)[^,]+,(\$\w+)\b[^@]{1,499}\beval\([^;]{0,199}\28\[(?<X2214591>)|\((?:['"]/\d+xbeast[^\};#]{9,99}\$\w{1,20}=['"]anonymousfox\-['"]\.substr\(str_shuffle\((?<X2192010>)|['"]?/sape/i['"]?\s*,\s*\$_SERVER\[['"]?HTTP_REFERER(?<X2111512>)|['"]\Wdefine[^'"]{0,99}\bDB_PASSWORD\b[^@#%:!<>\|&]{1,1999}\bmysqli?_query\([^\)]*['"]update\b[^;]{1,99}\busers\s+set\b[^;]{0,99}\buser_pass=(?<X2206241>)))|g_replace(?:\((?:['"]\\x2f(?:\\x..)+['"]\s*,\s*['"](?:\\x..)+['"],['"]['"]\);(?<X1034172>)|\"\\043\\056\\052\\043\\145(?<X2044201>)|\$\w+.\$\w+,"(?:\\x[a-z0-9]+){3}.{3000,}\?>(?<X2044712>))|(?:\h*\(\h*['"](\W)[^'",]{1,99}\36e['"]\h*,\h*@?str_rot13\h*\(\h*['"]\h*@?(?:nffreg|riny)\h*\(\h*\$_[TCPFE]\w{2,6}\[[^\]]+\]\h*\)\h*;\h*['"]\h*\)\h*,[^;\)]{1,99}\)\h*;(?<X1175191>)|\s*\(\s*(?:.?['"](.).{0,40}\38e\w?.?['"]\s*,\s*(?:['"]\\x(?:65\\x76\\x61\\x6C\\x28\\x62\\x61\\x73\\x65\\x36\\x34\\x5F\\x64\\x65\\x63\\x6F\\x64\\x65\\x28[^'"]{99,300}['"]\s*,\s*['"]\.["']\);(?<X1125040>)|[^'"]{9,199}['"][^'"]+['"][^'"]{9,199}['"]\s*,\s*['"][^'"]*['"]\s*\)\s*;(?<X1125280>))|str_replace\s*\(['"]\s+['"],['"]\s*['"],\s*["'](?:\\x[\d\w]{2,4}){9}[^'"]{9,999}['"][^'"\n]{9999,30000}['"](?:\\x[\d\w]{2,4}){1,9}['"]\)\s*,\s*['"]\.['"]\);(?<X1134662>))|\$exif\[\s*\\['"]Make\\['"]\s*\]\s*,\s*\$exif\[\s*\\['"]Model\\['"]\s*\](?<X2101491>))))|g_split\("//",\$\w+,-1,PREG_SPLIT_NO_EMPTY\);\$\w+=implode\("",array_reverse\(\$\w+\)\);};\$\w+=__FILE__;(?<X2046040>))|int(?:\([_]*\);[fspe](?:tp_exec|ystem|hell_exec|assthru|open|roc_open|val|xec)\(base64_decode\(\$_SERVER\[HTTP_CMD[\]\)]+;(?:exit|die)[^;]{0,9};(?<X1206800>)|\h*['"](?:[^;]{9,99}\bcgi\h*command\h*run[^;]{0,15}\bninjacr\d{0,1}</h\d>(?<X2172550>)|\$_SERVER\[[^\]]+\]\h*not\h*found<[^;]+;\s*(?:exit|die)[^;]{0,9};\s*\}\s*\$\w{1,15}[\h=]+['"]https?://\$\w{1,15}:\$\w{1,15}/\$\w{1,5}['"];\s*print_dbg\b(?<X2198420>)|\h*\W{0,25}SQL\h*Scanner[^;]+;\s*print\h*['"]\h*\W{0,25}Coded\h*by[^\-]{0,25}\-\h*IndoXploit(?<X1143910>))|\h+['"](?:(?:https?://)?twitter\.com/Reckz0r\b(?<X2153400>)|[^'"]{5,60}\bCode\h*Execution\h*(?:exploit|vulnerability)\h*by\b(?<X2179320>)|document\.write\(['"]<script\h+src=\\['"]http?://[^\);]{9,150}\);\s*['"];\s*\$\w{1,20}\h*=\h*fopen\((__FILE__),[^#%]{300,999}\btouch\(dirname\(\50\),\h*\$\w{1,20}\);\s*\}\s*@?unlink\(\50\);(?<X2159520>)|Slowloris[^;]+\\n['"];(?<X2150711>))|\s*"(?:<form enctype=multipart/form-data[^"]*"\s*;\s*if\s*\(\s*isset\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*gogogo\s*\]\s*\)\s*\)\s*\{\s*if\s*\(\s*is_uploaded_file\s*\(\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*tmp_name\s*\]\s*\)\s*\)\s*\{\s*@copy\s*\(\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*tmp_name\s*\]\s*,\s*\$\w{1,40}\s*\[\s*[^\]]+\s*\]\s*\[\s*name\s*\]\s*\)\s*;\s*\}\s*\}\s*;(?<X1039150>)|Sending\s*Mail\s*To\s*\$to\.\.\.\.";\s*flush\(\);\s*\$header\s*=\s*"From:\s*\$realnamenew(?<X2047350>))|\s*'<form\s*enctype=multipart/form-data\s*method=post><input\s*name=\w+\s*type=file><input\s*type=submit\s*name=g>\s*</form>';\s*if\(\s*isset\(\s*\$_POST\['\w+'\]\s*\)\s*\)\s*{\s*if\s*\(\s*is_uploaded_file\(\s*\$_FILES\['\w+'\]\['tmp_name'\]\s*\)\s*\)\s*{\s*@?copy\(\$_FILES\['\w+'\]\['tmp_name'\]\s*,\s*\$_FILES\['\w+'\]\['name'\]\);\s*}\s*}\s*exit;(?<X1036010>)|\s*['"](?:\W{0,9}\s*ConnectBack\s+Backdoor\s+Shell\b[^;]{1,99};(?<X2118641>)|At+a[quck]{2}e?:\s*\$ip\s+on\s+port\s+\$rand[^'"]*['"];[^\(\{]{1,99}\s*for\((\$\w)=0;\57<65535;\57\+\+\)\s*\{\s*\$out\s*\.=\s*['"][^'"]{1,40}['"];\s*\}\s*while\(1\)\s*\{[^:/]{1,99}\s*\$\w{1,40}\s*=\s*fsockopen\(['"](?:udp|tcp)://(?<X2124082>))|\s*\$\w{1,9}\s*['"]PRIVMSG\s*['"]\.\$\w{1,9}\.['"]\s*:\s*Bot\s*genol(?<X2128190>)|\s*\(\s*shell_exec\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)\[['"]ex[3e]c['"]\]\s*\)[^\)]{0,9}\);[^\(]{9,50}(\$\w{1,40})\s*=\s*['"][^'"]*['"];\s*if\s*\(\s*isset\s*\(\s*(\$_FILES\[[^\]]+\])\)\)[^\}]{99,250}if\s*\(\s*move_uploaded_file\s*\(\s*\61\[[^\]]+\],[^\)]+\)\)\s*\{\s*\60\s*=\s*['"](?<X2065311>)|\s+['"](?:(?:IHS\s+BACK\D{0,3}CONNECT\s+BACKDOOR|Av[3e]l[0o]x[1i][5s]\s+backconnect\s+tool)\b(?<X2123281>)|\W{0,5}Dr\.S[a4]M[!i]M_\d{1,4}\s+Pr[!i]v(?:ate|8)\s+L[o0]c[a4][l1](?<X2122350>))|\W{0,9}(?:hack|own|fuck|defac|pwn|cod|mass)ed\h*by\h*th[3e]\h*k[i!]ll[3e]r\h*dz(?<X2183603>)|_r(?:[\h\(]+glob[\h\(]['"][^'"]+['"][\h\)]+;\s*die[\h\(]+file_get_contents[\h\(]+['"][^'"]+\bindex\.php['"][\)\h]+;(?<X1257810>)|\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*;(?<X1041111>)|\s*\(\s*call_user_func_array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*,\s*array\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[[^\]]+\]\s*\)\s*\)\s*\)\s*;(?<X1041101>))|f\("Usage: findsock ip port(?<X2050730>)|f\h*['"][^'"]{1,999}\bflood[^\?]{0,799}\bif\h*\(\$ARGV\[\d+\]\h*\D{2,3}[^\{]{1,49}\{\s*system\((?<X2280190>))|iv(?:(?:8|ate)\b[^'"]{1,99}['"]\s+(\w{1,40})\h*=\h*open\(\h*['"]/etc/passwd['"][^\)]{1,49}\)\s+\71\h*=\h*\71\.read\(\)\s+\71\h*=\h*re\.find\w{1,9}\(\h*['"]/home/[^\,]{1,49},\h*\71\h*\)\s+for\h+\w{1,40}\h+in\h+\71:(?<X2147890>)|8</title>[^\?]{9,200}<\?php\s*\$\w{1,15}\h*=\h*file\h*\(\h*['"]\h*/etc/passwd\h*['"]\h*\);(?<X2160070>)|8\s+MAILER\s*<\s*/title\s*>(?<X2049032>)|ate(?:\s*\$\w{1,40}\s*=\s*(?:'[^']{10,200}'\s*;\s*private\s*\$\w{1,40}\s*=\s*'application/msword'\s*;\s*public\s*function\s*execute\s*\(\s*\)(?<X2048950>)|['"]https?://(?:govniku|norauto)\.site/?['"]\s*;(?<X1210202>))|\s+function\s+backdoorFiles\s*\(\s*\$\w{1,40}\s*\)(?<X2051750>)))|oftpd[^`\176]{1,9999}?eval\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)(?<X2045493>)))
\b(?:pu(?:blic(?:\h+(?:(function)\h+\w{1,40}\h*\(\h*\$\w{1,40}\h*\)\s*\{\s*(\$\w{1,40})\h*=\h*['"]\1['"]\h*;\s*(\$\w{1,40})\h*=\h*\$\w{1,40}\h*\.\h*['"]return\h+true;\h*['"]\h*;\s*(\$\w{1,40})\h*=\h*\$this\->\w{1,40}\h*\.\h*['"]_['"]\h*\.\h*\2\h*;\s*\$\w{1,40}\h*=\h*\4\h*\(\h*(?:['"]{2}|null)\h*,\h*\3\h*\)\h*;(?<X2159822>)|function[^\{]{1,40}\{\s*(\$\w{1,25})\h*->\h*baseUrl\h*=\h*hex2bin\(\h*['"]68747[^'"]{5,40}672f['"]\h*\);\s*\6\h*->\h*script\h*=\h*['"]Wordpress['"];(?<X2157780>)|static\h+function\h+wp_login\(\)\s*\{\s*(\$\w{1,20})\h*=\h*hex2bin\([^\)]{9,99}\);\s*if\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\s*\{\s*(\$\w{1,20})\h*=\h*['"]https?://[^\(]{9,200}\bwp_authenticate\([^\)]+\);[^\{]{9,99}\{\s*\$\w{1,20}\h*=\h*wp_remote_post\(\8\.[^\];]{99,200}=>\h*\9,[\s\]\}\);]{10,40}(?<X1146431>))|\s*function\s*root_vuln\s*\(\s*\)\s*\{\s*\$\w{1,40}\s*=\s*php_uname(?<X2051981>)|\s+(?:function\s+setLinksToDbJm\(\)(?<X2048930>)|string\s+sessionName\s*=\s*['"]ASPXSpy['"];(?<X2123870>)))|sh\s*\(@\w{1,20}\s*,\s*['"]https?://www\.milw0rm\.com/exploits/(?<X2129380>)|tenv(?:\(['"]\w{1,40}=\(\)\{\w{1,40};\};[^\)]{1,99}\);mail\([^\)]+\);(\$\w{1,40})=file_get_contents\((\$\w{1,40})\);unlink\(\16\);return\s*\15;\}function\s*\w{1,40}\(\$\w{1,40}\)\{\$\w{1,40}=['"][^'"]{65000,}['"];(?<X2137720>)|\h*\(\h*['"]PHP_LOL=\(\)\h*\{\h*\w{1,40};\h*\};\h*\$\w{1,40}\h*>\h*\$\w{1,40}\h*2>&1['"](?<X2155831>))|tincache\(\$urlhash\."::::"\.codedata(?<X2050640>))|R(?:(ewriteRule\s*\^\w{1,3})/\w*\-\.\*\-\(\\d\+\)\.(\w?html?\$)\s*(\w*\/index\\\.php\?)\w{1,3}=\$\d+\&\%(\{QUERY_STRING\}\s*\[L\])\s*R\20\/\(\.\*\)[\-\w]+\\d\+\.\21\s*\22\w{1,3}=\$\d+\&\%\23(?<X1203621>)|and(?:\h*\([^\)]+\);\s*\$victim.creds\h*=(?<X2168860>)|o?m?keywords?\.php\?\w{1,20}=['"]\.md5\([^/\{]{9,99}\bif\([^\{]{1,60}\bsitemap\.xml['"]\)[^\\#\*]{200,1300}\bif\(isBot\(\)\)[\{\s]+[^=]{9,99}\}\s*include\h*cache\w{1,20}\(\);\s*(?:die|exit)[^;]{0,9};\s*function\h+\w{1,20}\(\$x5had\b(?<X2210611>))))
\bR(?:e(?:alpath\([^\)]+\);[^\(]{0,50}if\s*\(\s*isset\s*\(\s*(\$_POST\[['"](eval)['"]\]\)\s*\))\s*\{\s*\2\s*\(\s*base64_decode\s*\(\s*\1;\s*\}[^\d\?\}]{9,99}file_get_contents\((\$\w{1,9})\);[^\}]{9,300}chmod\s*\(\3,\s*0?777\);\s*if\s*\(function_exists\s*\(['"]mb_ereg_replace(?<X2060821>)|c(?:oded\h*by\h*BabyMoon[^#]{1,149}\bif\(@?@?(?:copy|move_uploaded_file)\(\$_FILES(?<X2173390>)|urse_copy(?:\((?:\$\w{1,40},(\$\w{1,40})\);if\(!?isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)+\s*(?:\{\s*)?header\(['"]Location:['"]\.\6\b[^\}\?]{1,499}\b[cm]o(?:py|ve_uploaded_File)\([^\?]{1,499}\bmail\([^;]{1,99};(?:echo\b[^;]{1,99};)?(?:die|exit)[^;]{0,19};(?:unset\(\6\);)?(?:\?>)?\Z(?<X2183711>)|\s*\$src\s*,\s*\$dst\s*\);\s*header\(\s*['"]location:\s*\$dst['"]\s*\);(?<X2115451>))|(?:\h*\(\h*\$[^,]{1,40},\h*\$[^\)]{1,40}\)\h*;\s*header\h*\(\h*['"]location:(?:(?<X2171991>)|[^;]+;\s*(\$\w{1,40})\h*=\h*@?fopen\h*\(\h*['"]\w{1,6}\.txt['"]\h*,\h*['"]a\+?['"]\h*\)\h*;\s*fwrite\h*\(\h*\10\h*,(?<X2172010>))|\s*\(\s*\$src\s*,\s*\$dst\s*\);[^:]{0,99}header\s*\(\s*['"]location:\s*\$dst\??(?:['"]\s*\);[^\.]{1,99}\$\w{1,40}\s*=\s*fopen\(['"][^'"]{1,19}\.txt['"]\s*,\s*['"][aw]\+?['"]\);[^\?]{0,99}fwrite\(|[^\?]{1,40}(?:\?>|\Z)|[^;]{1,40};\s*\}\s*else)(?<X2120317>))))|direct(?:\h*\d+\h*/slot/\w+\.php\h*https?://[^/]+/slot\b[^/]+/\w+\.php(?<X1236340>)|\s+301\s+/slot\-gacor/\s+https://[\w\.\-/]+$(?<X1229260>)|Permanent\s+/\s+https?://develryllc\.com/\?(?<X1242800>))|fresh['"]\s*content=['"]\d+;\s*url=(http://(?:bestselect2019|fastsmartassist|globalmedsreward|goodfastquality|herbal(?:drugsvalue|genericinc)|luckybestmart|newhealthprogram|online(?:firsttrade|hotprice|smartmall)|organicfirstdeal|pure(?:first|organice)shop|the(?:aidoutlet|pillsupply))\.[senbrut]{1,3})/?['"]\s*>\s*<script\s*type=['"]text/javascript['"]>\s*window\.location\.href\s*=\s*['"]\16[^\?]{80,300}\s*</body>\s*</html>\s*\Z(?<X2058373>)|giSTer_sHUtdoWN_fUNCtiOn(?:[\s\('"\\]+unlink[,'"\)\s]+(\$\w{1,40})[,'"\)]+;[^\}\?,]{0,99}\18[\h=]+implode[\s\(]+['"][^"']+['"][^;]+;\s*unset[\s\('"\\]+\18[,'"\);\s]+endif;\s*(\$\w{1,40})[\h=]+fopen[\s\(]+\18[^;]+;\s*fwrite[\s\(]+\19[^;\$]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\s\);]+fclose[\s\(]+\19[\s\);]+include\h*\18;(?<X2197010>)|\s*\(\s*'[^']*'\s*\)\s*;\s*\}\s*\}\s*\}\s*\}\s*\$\w{1,40}\s*=\s*new\s*Ratel\s*;\s*\$\w{1,40}-\s*>\s*init\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X2048220>)|\s*\(\s*\$\w{1,40}\s*\(\s*['"]{2}\s*,\s*\$\w{1,40}\s*\(\s*\$_[GPCSR]\w{2,6}\[(?<X2144791>))|name(?:\h*\(\h*['"]/[^'"]{3,199}['"]\h*,\h*['"]/[^'"]{3,199}\d+['"]\h*\)\h*;\s*(\$\w{1,40})\h*=\h*['"]%[^'"]{9999,}['"];(?:\s*(\$\w{1,40})\h*=\h*@?(?:urldecode|strrev|str_rot13)\h*\(\h*\23\h*\)\h*;)+\s*@?eval\h*\(\h*\24\h*\)\h*;(?<X1187150>)|\s*\(\s*(\$\w{1,20})\s*\.\s*"\.php\.suspected"\s*,\s*\26\."\.php"\s*\);(?<X2047670>))|quire(?:(?:_once)?(?:[ ]+dirname\([ ]+__FILE__[ ]+\)[ ]+\.[ ]+['"]/config/class\.php['"]\h*;(?<X1158020>)|\h*__DIR__\h*\.\h*['"]\.{0,2}/wp\-includes/(IXR)/class\-\29\-cookie\.php['"]\h*;(?<X1238750>))|(?:[\s\('"\./]+wp\-includes/reg[^;]+;\s*\$\w{1,40}\h*=[^\{]{9,99}\{\s*(\$\w{1,40})[\s=]+wp_create_user[\s\('"]+[^'"\$]+['"](?:\s*,\s*['"][^'"\$]*['"])+[\s\)]+;\s*(\$\w{1,40})[\s=]+new\s*WP_user[\s\(]+\31[\s\);]+(\32\->set_role[\s\(]+)['"](administrator)['"][\s\);]+\}[^\}]{0,999}\33\s*['"]\34['"\)\s;]+\}(?<X1191580>)|[\s\(]*['"][^'"]*\bwp-includes/reg\w+\.php['"][\s\)]*;\s*if\s*\([^;\{]+\{\s*\$\w+[\s=]+wp_create_user[\s\(]+['"]([^'"]+)['"][\s,]+['"]([^'"]+)['"][^\}]{1,499}\->\s*set_role[\s\(]+['"]admin\w+['"][^\}]+\}\s*else[\s\{]+\$\w+[\s=]+get_user_by\s*\([^,;]+,\s*['"]\36['"][^\}]+\bwp_set_password[\s\(]+['"]\37['"][^;]+;\s*\}(?<X1212583>)|\s*__DIR__\s*\.\s*'[^']*'\s*;\s*\$\w{1,40}\s*=\s*new\s*Clue\\Psocksd\\App\s*\(\s*\)\s*;\s*\$\w{1,40}-\s*>\s*run\s*\(\s*\)\s*;(?<X2046420>)|_once(?:[\h\(]+[^\)]+[\h\)]+;(?:\s*(\$\w+)[\h=]+base64_decode[\h\(]+[^\)]+[\h\)]+;){3}\s*if[\h\(]+!username_exists[^\{]+\{\s*(\$\w+)[\h=]+wp_create_user\([^\)]+\40\);\s*if[\h\(]+is_int[\h\(]+\41[\s\)]+\{[^\}]*\}\s*\}(?<X1263880>)|\h*\(\h*(?:["']rms\-[\w\-]{1,40}\.php['"]\);\s*rms_\w{4,40}\h*\(\h*['"]?__FILE__['"]?\h*,\h*['"]rms\-[\w\-]{1,40}\.php['"],[^\);]+\);(?<X1158830>)|['"]\.\./\.cagefs/[^'"]{1,99}\.(?:ico|jpe?g|gif|png)['"]\h*\)\h*;(?<X1185570>)))))|turn(?:\h+(?:['"]Mr\.Tenar.shell:<(?<X2175530>)|mail\((?:\$\w{1,40},?)+\);\}(\$\w{1,40})=base64_decode\(\$_POST\[[^\]]+\]\);[^\|\?<?]{99,499}\$\w{1,40}=\w{1,40}\([^\|]{4,40}\|\h*mail\h+\-s[^\);]+\46\);(?<X2153890>)|new\h*\w{1,9}\((\$this\->)\w{1,9}\(['"]tds['"]\),\48\w{1,9}\(\),new\h*\w{1,9}\(\),[^\),>\-]+\->\w{1,9}\(['"]tds\.params\b[^\)]+\)+;(?<X2180941>))|\s*(?:@?file_get_contents\(\w{1,40}\s*::\s*\$\w{1,40}\s*\.\s*\$\w{1,40}\s*\[array_rand\(\$\w{1,40}\)\]\);\s*\}\s*static\b(?<X2265890>)|['"]seo\d*\.gloryplan\.(?:life|ws|jp|pl|ga)['"];(?<X1207790>)|\$c0\[\$c_\];}\$GLOBALS\['_\d+_'\]\[0\]\(a_\(0\),a_\(1\),a_\(2\)\);\s*}(?<X2044571>)|file_put_contents\(\$_[GPRSC]\w{2,6}\[[^\]]+\][^\}]{1,15}\}\s*echo\s*['"]<[^/]{9,25}Shell\s*Password(?<X2135330>)|proc_open[\s\(]+(?:\$\w{1,40}[,\s\)]*)+;[\s\}]*(?:(?:public|static|private)\s*)+function\s*\w+[\(\s]+\$\w{1,40}[^;:]+(\$\w{1,40})[\s=]+self::\w+\s*\(\)\s*;\s*\$\w{1,40}[\s=]+\54\[\d+\]\[\d+\][^\?/]{9,999}\$\w{1,40}\s*\.=\s*chr[\(\s]+octdec[\(\s]+\$\w{1,40}[\)\s;\}]+foreach\b(?<X2225840>)|true;\s*\?><\?php\s*function\s*\w{1,40}\(\$\w{1,40}\){\$\w{1,40}="";if\(isset\(\$_GET\["v1"\](?<X2048530>))|\s+RC4::Encrypt\([^\)]+\);\s*\}\s*\Z(?<X2043623>))|write(?:Cond(?:\h+%\{HTTP_USER_AGENT\}\h+\S{0,99}\bgooglebot\b\S{0,99}(?:\h+\[[^\]]+\])?\s*RewriteRule\h+\S{1,19}\h+https?://casinoslotu\.club/\S{1,9}\b(?:\h+\[[^\]]+\])?(?<X1187361>)|\s+%\{HTTP_(?:HOST\}\s+\^\.\*\$\s+RewriteRule\s+\^/\?\$\s+['"]https?\\:\\/\\/accounts\\\.binance\\\.\w+\\/\w+\\/register\\\?ref\\=\w+['"]\s+\[R=30\d+,L\](?<X1232450>)|USER_AGENT\}\s+Googlebot\s+\[NC\]\s+RewriteRule\s+\(\.\*\)\s+https?://[^'"\n]{0,99}escorts[^'"\n]{0,99}\.(?:html|php)\??\s+\[R=30\d+[,\s]+L\](?<X1232440>)))|Engine(?:\h*on\s*(?:RewriteRule\h*\(\[[^\]]+\]\*\.(?:exe|png|dll|jpe?g|doc|vbs|zip|rar|dat|dat2)\)\h*\w{1,15}\.php\h*\[\w+\]\s*){5,10}(?<X1198430>)|\h+On\s*RewriteRule\s+\^\(\.\*\),\(\.\*\)\$\h+\$2\.php\?rewrite_params=\$1&page_url=\$2(?<X1042701>)|\s+On\s*(?:(?:RewriteCond\s*%\{HTTP_REFERER\}\s*\.\*[^\.]+\.\*\$\s*\[NC(?:,OR)?\]\s*)+RewriteRule\s*\.\*\s*http://[^\[]+\[R,L\](?<X1042676>)|RewriteRule\s+\^\(\[A-Za-z0-9-\]\+\)\.html\$\s+\w+\.php\?br=\$1\s+\[L\](?<X1042661>))|\s+on\s+Rewrite(?:Cond\s+%\{HTTP_USER_AGENT\}\s+acs[^\*]+RewriteRule\s+\^\(\.\*\)\$[^\[]+\[L,R=302\](?<X1042622>)|Rule\s+lilly/\(\.\+\)\$\s+https?://[^\n\$]{4,99}\$\d+&slog=lilly\s+\[R=30[12],L\](?<X1232700>)))|Rule\h*\^(?:/\?\$\h*['"]https?\\?:[\\/]+foodclique\\?\.org\\?/[^'"]+['"]\h*\[R=301,L\](?<X1233580>)|\(\.\*\)\$\h*https?://[^\$]{1,40}/slot\-gacor/\$\d+\h*\[[^\]]+\](?<X1237510>))|Rule\h+\^(?:[\.\w\*\(\[]+(?:\\d\+\)|\-/\]\w)[^\$]{3,25}[\.\*]*\$\h*manager/index\\\.php\?id=\$\d+[&%\-\$\d]*{QUERY_STRING\}\h*\[L\](?<X1263920>)|[a-z\d]{9,}/\(\.\*\)\$\h+/wp\-includes/assets/\w+\.php\?\w+=\$1\h+\[L\](?<X1221621>)|\(\.\*\)\$\h+https?://iofan\.com/\h+\[L\h*,\h*R=301\](?<X1217890>))|Rule\s*\^(?:/\?\$\s*["']https?[\\:/]+satudata\\\.polmankab\\\.go\\\.id\\/["']\s*\[R=30\d+[,\s]+L\](?<X1226140>)|\$\s*https?://pub\-\w+\.r2\.dev/\w*\.html\s*\[L,R=(?:301|302)\](?<X1265560>)|\(\.\*\)\$\s*/wp\-includes/[\w\-\.]+\.php\s+\[L,QSA\](?<X1229880>)|\.\*\\\.\[p+\]\[h+\]\.\*\s*\-\s*\[L\]\s*RewriteRule\s*\^\.\*\\.\[s+\]\[u+\]\[s+\]\[p+\]\[e+\]\[c+\]\[t+\]\[e+\]\[d+\]\s*\-\s*\[L\]\s*<FilesMatch\s*['"]\\\.\((?:ph\w+\|)+suspected\)\$['"]>\s*Deny\s*from\s*all\s*</FilesMatch>(?<X1259560>))|Rule\s+\^(?:(?:\.\*[\-\(]+(?:itm|site|sitemap)|catalog[\-\(]+)[^\?\n]{1,99}\\\.(?:php|xml)[\?\)\$]{1,3}[^\n\$]{1,40}[=/]\$1(?:&%\{QUERY_STRING\})?\s+\[L\](?<X1221860>)|/\?\$\s+['"]https\\:\\/\\/(?:dilettantiarezzo\\\.it|indogal\\\.co\\\.id)\\/[rcus]+\\/ibxkey[\\/]*['"]\s+\[R=301,L\](?<X1222151>))))|iny\(tmhapbzcerff\(onfr64_qrpbqr\('(?<X2044650>))
\b(?:R(?:m\h+\-f\h+([^\s\.]{1,40}\.txt);\h*wget(?:\h+\-[qo])+\h+\1\h+https?://[a-z\.]{0,9}turnedpro\.(?:com?|xyz)/\S{1,60}\h[^\n;]{1,99};(?<X1193360>)|oottn\$?['"]\)?;[^@]{9,399}(\$\w{1,40})\s*=\s*@?str_replace\s*\(\s*['"]www\.['"]\s*,\s*['"][^'"]*['"]\s*,\3\s*\)\s*;(?<X2126310>)|un[\(\h'"]+curl\h+\-s\h+https?://golang666\.(?<X2205840>))|S(?:\.H\.E\.L\.L[^</]{0,99}</title>(?<X2225211>)|afe_mode\h*=\h*OFF[^\[\]%&]{99,200}\$\w{1,20}\h*=\h*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)\h*\(\h*['"]cat\h+/etc/passwd\h*>\h*\w{1,20}\.txt\b(?<X2158111>)|c(?:andir\((\$\w{1,20})\);\s*foreach\([^\)]+\)[\s\{]+[^:\\]{99,200}(\$\w{1,20})(=array\()(?:['"]\d+['"]=>['"]https?://[^'"]{9,99}/\w{1,20}\.txt['"],){1,4}\);\s*\$\w{1,20}\10[^\?@#%\*]{200,1500}\bif\(is_writable\(dirname\(\8\)[^\}]{2,40}\bfwrite\(\$\w{1,20},file_get_contents\(\9\[(?<X2191812>)|otiabank\s+(?:colpatria|global\s*site|Canada)[^<>/]{0,40}</title>(?<X2221733>)|ript\.src\s*=\s*['"]https?://accessibeapp\.com\b[^'"]+['"]\s*;(?<X1205370>))|e(?:lf(?:\.header\h*=\h*\{\s*['"]User\-Agent['"]\h*:\h*['"][a@]rch[e3]rGh[o0]st\d*['"]\h*,(?<X2162190>)|Test\s*\(\s*\)\s*\)\s*;\s*elseif[^\}]{1,60}\{\s*\$\w{1,40}\s*=\s*json_decode\s*\(\s*\$_[GPRSC]\w{2,6}\[[^\]]+\]\s*,\s*true\s*\)\s*;\s*(print)\s*(json_encode)\s*\(\s*alexusMailer\s*\(\s*\$\w{1,40}\s*\)\s*\)\s*;\s*\}\s*else\s*\{\s*\15\s*\16\s*\(\s*array\s*\((?<X2046331>))|nd(?:\((flood)\h*,\h*(pack)\(['"][^'"]+['"]\h*,\h*['"]\18['"]\)\h*,\h*\d+\h*,\h*\19_sockaddr_in\((?<X2152040>)|packet\((\$\w{1,40}),0,0,0\);\21=['"]POST\s*['"]\.\$\w{1,40}\.['"]/index\.php\?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20\s+HTTP/\d+\.\d+(?:\\r)?\\n['"];(?<X2132170>)|raw\(\$IRC_cur_socket\s*,\s*"PRIVMSG(?<X2050140>))|rver\s+d3ifff(?<X2049180>)|ssion_start(?:\(\);(?:[^\?]{0,199}\s*(\$\w{1,25})\h*=\h*['"]http://['"]\.\$_SERVER\[[^\?]{9,299}\bfunction\h*(random_number\(\))\s*\{\s*[^\}]{9,300}\}\s*\25\h*=\h*(?:\26\.){3,6}(date\([^\)]+\))\.md5\(\27\)[^;]{0,49}\26;(?<X2178991>)|\s*include\(['"]\.+/[\w\-]{1,5}bots\.php['"]\);(?:\s*if\h*\(strpos\((?:gethostbyaddr\(getenv\(|\$_SERVER\[)['"](?:HTTP_USER_AGENT|REMOTE_ADDR)['"][\]\)]{1,2},\h*['"]GoogleBot['"]\)\h*\D{2,3}\h*false\)\s*\{\s*@?header\(['"]HTTP/\d+\.\d+\h+404\h+Not\h+Found['"]\);\s*@?(?:exit|die)\b[^;]{0,9};\s*\}){2}(?<X2139960>))|\h*\(\);\s*set_time_limit\h*\(0\);\s*\$\w{1,15}\h*=\h*md5\h*\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\);\s*(\$\w{1,15})\h*=\h*['"]\w{32}['"];[^#]{999,9999}\bmd5\h*cracker['"],[^\?]{9,999}\broot\h*sh[e3]ll</a>\]\h*\[<a\h*href\h*=\h*['"]{1,2}\.\30\.[^\n]{999,12999}\bprint\h*\$\w{1,15};\s*(?:exit|die)[^;]{0,9};(?<X1188210>))|t(?:_time_limit\((?:0\);(?:\s*ignore_user_abort\(\);\s*if\s*\(\s*filesize\(\s*"\.htaccess"\s*\)\s*>\s*\d+\s*\)\s*{\s*\$\w+\s*=\s*fopen.+?\(\s*sys_get_temp_dir\(\)\s*\.\s*"/\$\w+"\s*\);\s*}(?<X1035770>)|function\s+Root_GP\(&(\$\w{1,40})\)\{while\(list\(\$key,\$var\)=each\(\33\)\)\{if\(\(strtoupper\((?<X2132552>))|\d+\);\s*error_reporting\(\d+\);\s*preg_replace\(['"]\\x[^'"]+['"],['"].{50000,}['"],['"].{2,5}\);(?<X1041590>))|cookie\((?:'f_wp'\s*,\s*\$_POST(?<X2050510>)|['"]b374k['"],\$\w{1,40},time\(\)\s*\+\s*\$\w{1,40}\);\s*\$\w{1,40}\s*=\s*(?:true|false);(?<X2132801>))|cookie(?:\h*\(['"](whatsup)["']\h*,\h*['"]\38man["']\h*,\h*time\(\)\+\d+\*\d+\*\d+\h*(?:,\h*['"][^'"]+['"])?\);(?<X1174305>)|\s*\((?:['"](cvv2?|ssn\d?)['"]\s*,\s*\$_POST\['\40'\](?<X2052250>)|\s*['"]haircki['"]\s*,\s*['"]haircooki['"]\s*,\s*time\s*\(\)\s*\+\s*3600\s*\*\s*24\s*\*\s*\d{2,3}\s*\)\s*;(?<X1206001>)))|Interval\(['"]\w{1,20}\(\)['"],\d+\);\s*\w{1,20}\h*=\h*['"]\W{0,9}Hacked\h+by\b(?<X2141831>)|Timeout(?:[\h\(]+function[\(\)\h\{]+window\.location\.href[\h=]+['"]https?://(?:\w+\.)?gabrielpidello\.com/\w+/[^'"]+['"]\h*\}[\h,]+\d*[\h\)]+;(?<X1259711>)|\(function\((\w{1,14})\)\{\s*return\s*\45\.split[^;]{1,50}const\s*(\w{1,14})\s*=\s*char\.charCodeAt\(\d+\);return\s*String.fromCharCode\(\46[^,]{1,30}atob\(['"][^'"]{1,550}['"]\)\).\d\);(?<X1281311>)|\s*\(\s*\w+[\(\)\s\{]{1,99}\w+\.location\.\w+['"\s=]+https?://hanovertdo\.org[^;]+;\s*\}[,\s]+\d+\s*\);(?<X1283920>))))|h(?:[e3]ll+\s+byp[a4@][s5][5s][^<>/]{0,40}</title>(?<X2221820>)|\s+-c\s+\./cnrig\s+-a\s+cryptonight\s+-o(?<X2051100>)|ell(?:\s*</title>[^%]{1,150}<meta\h+(?:name\h*=\h*['"][^'"]+['"]\h+|content\h*=\h*['"]IndoXploit['"]){2}>(?<X2142260>)|domain:\]['"],\h*ucfirst\h*\(\$_\d{1,3}\[round\h*\(\d{1,3}\)\]\),\h*\$_[GPRSC]\w{2,6}\[[^\]]+\]\);[^\{]{9,199}\bif\h*\(!is_file\h*\(\$_FILES(?<X2156680>)|name\h*=\h*['"][^'"]{0,49}['"];[^\{]{0,99}\bfunction\h*Class_UC_key\b(?<X2175681>)))|l(?:eep\s*\(\d+\)\s*;\s*\$\w{1,40}[\s=]+(\w+)[\s\(]+\$\w{1,40}[^;]+;\s*function\s+\54[\s\(]+(\$\w{1,40})[\s\)]+\{[^\}]+\b[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\s\(]+\55[^;]+;[^!]{0,1999}\bwhile[\s\(]+!@?feof\s*\((?<X2223030>)|ider_option\w{0,40}\(\$\w{1,40}\)\s*\{\s*if\s*\(is_single\(\)\s*\)\s*\{\s*[^\}<>\{]{1,40}\$\w{1,40}\s*=\s*['"]\s*(?:<script[^\.>]{1,90}go\.(?:oclasrv|mobisla)\.com/[^>]+></script>\s*){2}(?<X2123490>))|ocket(?:(\(flood,)\h*PF_INET,\h*SOCK_DGRAM,\s*\d{1,3}\);[^@]{99,999}\bsend\58[^\)\(\$;]{0,99}\bpack\(['"][^'"]{1,40}['"],\h*['"][^'"]{999}(?<X2159730>)|(\(socket,)[^;]+;connect\60[^#@]{1,499}\bsystem\(['"](?:unset\s*(?:HISTFILE|SAVEHIST)\b[^'"]{0,19}\b){2}(?<X2226822>)|\((?:flood|crazy),[^\{\\]{9,99}\bprintf\h*['"]udp\h*(?:flood|crazy)\h*\-\h*\w{1,25}\\n['"];(?<X2184423>)|_setopt\([^\)]+\);\s*\}\s*\}\s*define\(['"]PAYLOAD_UUID['"]\s*,\s*['"](?:\\x[a-fA-F0-9]{1,3}){9,30}['"]\);\s*define\(['"]SESSION_GUID['"]\s*,\s*['"]\\x00(?<X2123010>))|p(?:ider.record\(\);\s*echo\h*\$\w{1,20};\s*(?:exit|die)\(\);[^<\*#]{99,800}\bforeach\(\$xml\w{0,15}\b[^\*#\\]{99,300}\bsitemap\-[^;]{0,20}\.xml['"];(?<X2183890>)|rintf\s*\(\s*"%c"\s*,\s*\$\w{1,40}\s*\^\s*ord\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*\)\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*for\b(?<X2048301>))|r(?:and\(seed\(\)\);\s*\$additional=array\("%1meta name=\\"description\\"\s*content=\\"\$description\\"%3","%1meta(?<X2051500>)|c=(?:(['"])//ber2g8e3keley\.com\b[^'"]+/\w+\.js\67(?<X1203080>)|['"]https?://b\-i\-t\-l\-y\.[^'"]+['"](?<X1235251>))|c(?:[=\h]+['"]https?://webcstore\.pw/[^'"]+\.js['"](?<X1238250>)|\h*=\h*['"](?:data\s*:\s*text/javascript;\s*base64\s*,\s*CiAgICAoZnVuY3Rpb24oKSB7CiA[a-z\d\+/]{99,9999}(?:IT09ICd1bmRlZmluZWQ|ICd1bmRlZmluZWQ|bmRlZmluZWQ)[a-z\d\+/]{99,9999}={0,2}["'](?<X1195172>)|https?://(?:www\.)?web\-not404foundcyberteam\.\w{2,6}/(?<X2161561>))))))
\bS(?:t(?:at(?:\s*\(\$\w{1,40}\);\s*(\$\w{1,40})\s*=\s*(dirname\((__FILE__)\))[^;]+;\s*(@touch)\s*\(\1[^;]+;\s*\4\(\2[^;]+;\s*\4\(\3[^%]{200,600}(\$\w{1,40})\s*=\s*file_get_contents[^\{]+\{\s*(\$\w{1,40})\s*=\s*check_spider\((\$\w{1,40})[^\[]+\6\s*=\s*de_get\(\5,\7\);[^\}]+\6\s*=\s*(?:true|false);\s*\}\s*\}(?<X2060803>)|ic\s*public\s*function\s*\w+\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*\{\s*\$\w{1,40}\s*=\s*\w+\s*\(\s*["'][^"']*=["']\s*\)\s*;\s*return\s*\$\w{1,40}\s*\(\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*,\s*\$\w{1,40}\s*\)\s*;\s*\}(?<X2046580>))|r_(?:i?replace[\s\(]+['"]AnonymousFox['"](?<X2197511>)|replace\('define\("PRENAME","\d+"\);'\s*,\s*'define\("PRENAME"(?<X2045571>))|r(?:atum\+tcp://pool\.minexmr\.com:(?<X2048340>)|eam_select\((\$\w{1,40}),[^;]{9,99};(?:if\(in_array\(\$[^,]{1,40},\13\)\)\{(if\(\$\w{1,40}\)\s*\w{1,40}\()['"](?:SOCK|STDOUT|STDERR)\s*read['"]\);(\$\w{1,40})=fread\(\$[^;]{5,99};\14['"](?:SOCK|STDOUT|STDERR):\s*\15['"]\);fwrite\(\$[^,]{1,40},\15\);\}){3}(?<X2130660>)|i?pos\([^\),]+,['"]?\$(?:bot){3}[^\?]{1,4999}\bchmod\(([^\),]+['"][^'"]+?['"]),[^;]+;unlink\(\17\);[^\?:]{1,9999}\bheader\(['"]Location[:\s]+https?://[^/'"]+\.(?:top|xyz)['"/](?<X2210321>)|ipos\(\$path\s*,\s*'/httpdocs/'\s*\)\s*\+\s*strlen\(\s*'/httpdocs/(?<X2047230>)|pos\((\$\w{1,40}),['"]<\?[^@#%&/\*]{1,499}\bfile_put_contents\((\$\w{1,40}),\20\);register_shutdown_(function)\((?:array\(|\[)\$\w{1,40},\h*['"](\w{1,40})['"][\)\]],\21,\$\w{1,40}\);[^@#%\{]{1,199}\b\22\h+\23\((\$\w{1,40}),(\$\w{1,40})\)\{[^\}]{1,499}\bunlink\(\24\);\}?touch\(dirname\(\24\),\25\);(?<X2184130>)|rev\(['"][^'"]{1,80}moc\.tnetnocresubuhtig\.war//:sptth['"]\)\)[^\{]{1,50}\{\s*(\$\w{1,14})\s*=\s*curl_init[^\}]{1,300}(\$\w{1,14})\s*=\s*curl_exec\(\27\);\s*curl_close\(\27\);\s*return\s*\28(?<X2280531>)|str[\(\s]+\$\w{1,40}[,\s]+['"]xiaoxiannv['"][^\}]{0,999}\$\w{1,40}[\s\=]+['"]xiaoxiannv['"](?<X2225360>))|ylesheet[^/]{1,40}href[^/]{1,40}\.?/cssisma[^\?]{1,200}Anonisma(?<X2055101>))|u(?:b(?:\s+[tu][dc]p_?flood(?:er)?\s*\{[^@]{99,499}\bsub\s+[tu][dc]p_?flood(?:er)?\s*\{(?<X2142981>)|ject\h*=\h*['"]BANk\(SANT\-ANDER\)\h*\W[^#]{99,250}@?mail\(\$(?<X2143640>)|str\(\$__lp,\s*0x\w+-0x\w+\)\)\);break;\}\}\}eval\(\$__ln\);return 0;\}\s*else\s*\{die\((?<X2048830>)|str_count\([^,]+,['"]Linux['"]\)[^\{]{1,9}[\{\s]+\$\w{1,20}=base64_decode\([^\\@\?]{4000,8000}\bsystem\(['"]gcc[^\)]{1,15}\bdirty(?:c|cow)?\.c\b(?<X2202140>))|ccessfully\s*opened\s*reverse\s*shell\s*to\$\w{1,40}:\$\w{1,40}['"]\);while\(\d+\)(?<X2126781>))|witch(?:[\(\s]+@\$_[GPRSC]\w{2,6}\s*\[[^\]]+\][\)\s]+\{\s*case\s*['"\w\s]+:\s*(\$\w{1,40})[\s=@]+\$_FILES\s*\[[^\]]+\][^\},]+if[\s\(]+(?:(move_uploaded_file)|copy)[\s\(]+\37\[[^\?\*\n]{9,999}case\s*['"\w\s]+:\s*@?(?:copy|\38)\s*\(['"]http[^'"]+\.(?:png|jpe?g|gif)['",\s]+['"][^'"]+\.php['"][\)\s;]+break[\s;]+\}(?<X1208010>)|\(\$_[GPCSR]\w{2,6}\[[^\]]+\]\)\{(?:case\h*['"][^'"]{1,49}\bshell['"]:\s*echo\s*\w{1,40}\(['"]https?://[^;]{1,99};break;){5}(?<X2141550>)|\h*\(\h*\$_[GPCSR]\w{2,6}\[[^\]]+\]\h*\)\s*\{\s*case\b[^\}]{1,99}\bglobal\s*\$vbulletin;[^\}]{0,499}<(?:h\d|title)[^>]{0,99}>\s*L[o0]g[1il]n\s*Sh[3e][1il]{2}\b(?<X2160620>))|y(?:mlink(?:\(['"]/home\d*/['"]\s*\.\s*\$[^\s\.;]{1,40}\s*\.\s*['"]/public_html[^;]+\.txt['"]\);(?:\s*symlink\(['"]/home\d*/['"]\s*\.\s*\$[^\s\.;]{1,40}\s*\.\s*['"]/public_html[^;]+\.txt['"]\);){2,3}(?<X1199880>)|\s*\(\s*['"]/home[^\)]{20,99}['"]\);\s*\}\s*(\$d[0o]mains)\s*=\s*@file\s*\(['"]/etc/\w{1,20}\.conf['"]\);\s*if\s*\(\43\)\s*\{\s*@?mkdir\((?<X2118771>))|s(?:_get_temp_dir\(\)[^;]{1,9};((file_)put(_contents)(\((\$\w{1,40})\.['"]tmp['"]),\$\w{1,40}\);if\(md5\(\46get\47\48[\)=]{4}\$\w{1,40}\)\{unlink\48\);)\$\w{1,40}=\49;\}else\{\49=['"](?:/var/)?tmp/['"];\45(?<X2130152>)|tem\(['"]ln\h+-s[^\)]+\);(\$htaccess)=['"]\s*Options\h+Indexes\h+FollowSymLinks[^'";]{9,90}['"];@?file_put_contents\(['"]\.htaccess['"],\51\);(?<X2156251>)|tem\h*\(\h*['"]cd\h*/tmp;\h*wget\h*['"]?http://\d{1,3}\.[\d\.]{3,11}/([^;\)]+\.gz)['"]?;\h*tar\h+\-[^;\)]+\53;\h*\./\w{1,40}\b\h+\-[^;:\)]+tcp://[^:;]{1,40}\.mine[^;'"\)]{9,199}['"]\h*\)\h*;(?<X2175740>)|temctl\h*stop\h*c3pool_miner\.service[^\?]{999,10000}\bgrep\h*['"]monero['"][\h\|]+awk(?<X2222021>)|temInfo\(\$_SERVER\[['"]REMOTE_ADDR['"]\]\)[^\?]{99,499}MrProfessor\s*\-{9}[^\;]{99,499};\s*mail\(\$receiverEmail(?<X2134000>))))
\bt(?:e(?:legram\W{1,4}@Coder_Seller\b[^\$\(\{\*]{1,199}\*/(?<X2176021>)|mpnam\h*\(\h*base64_decode\h*\(\h*['"]L3RtcA[^'"]{0,2}['"](?:(?<X2168291>)|\)\h*,[^;]+;\s*\$\w{1,40}\h*=\h*fopen\h*\(\h*(\$\w{1,40})\h*,[^;]+;[^\}]{1,99}\binclude(?:_once)?\h*\3\h*;\s*unlink\h*\(\h*\3\h*\)\h*;\s*return\h+get_defined_vars\h*\(\);(?<X2168280>)))|itle(?:=['"](?:A|Ira)nonymous\h*(?:checker|bypasser|backdoor|webshell)['"][^/]{0,60}/>[^\?]{1,20}<\?[ph\s]+(?:(?:set_time_limit|error_reporting)\((?:0|NULL|FALSE)\);\s*){1,3}[^\?]{200,1500}\bforeach\((\$_POST)\h*as\h*(\$\w+)=>(\$\w{1,20})\)[\{\s]+\5\[\6\]=stripslashes\(\7\);(?<X2217040>)|>['"];\s*(\$\w{1,15})\h*=\h*new\h*backdoor\(\);(?:\s*\9\h*\->\h*(\w{1,15})\h*=\h*\$\10;){4,}\s*\becho\b(?<X2189750>))|o(?:ol(?:s::file_get_contents[\s\('"]+https?://ferreteriasimancas\.com/[^;\)]+=['"]\s*\.\s*Tools::getServerName\(\)[^\)]{0,99}\);(?<X1229720>)|s?\s*by\s*hitman\b[^\?]{9,499}\bmail\([^\)]+\$([mb](?:essage|e?sg|ilsmg))\b[^\?]{9,499}\bfwrite\([^\)]+\$\13\h*\);(?<X2159070>))|p4top\.(?:io|net)/(?:p|m)_[^>]{1,99}>[^\?]{0,999}\b(?:touched|Hacked|heked|Owned|Ghost|pwned)\b(?<X2161035>)|uch\((?:['"]?\$path['"]?,\s*\$time_path\);\s*\}\s*if\s*\(\s*\$\w{1,40}\s*\W{2,3}\s*true\)\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*unlink\(\$_SERVER\[['"]SCRIPT_FILENAME['"]\]\);\s*\}\s*\}\s*else\s*\{\s*echo\s*['"][^'"]{1,40}['"];\s*\}\s*function\s+scan\((?<X2064840>)|\s*__FILE__\s*,\s*filemtime\(\s*['"]index\.php['"]\s*\)\s*\);\s*\}\s*\$\w{1,40}\s*=\s*(?:['"\s\.base64_dco]{13,40}|['gz\s"\.inflate]{10,40}|['"\s\.gzuncompres]{12,40})\s*;(?<X2064761>)|__FILE__,(mktime\([^;]{1,99};)[^\?/:]{1,499}\$(\w{1,40})=(file_)ge(t_contents\()['"]php://input['"]\);[^@#%]{499,1999}\b\20pu\21\$\w{1,40},\$\19[^;]{1,99};touch\(\$\w{1,40},\18(?<X2179101>))|uch(?:\h*\((?:\h*(\$\w{1,40})\h*,\h*strtotime\h*\(\h*['"]\-\d+\h+days['"]\h*,\h*time\h*\(\)[\h\)]+;\s*file_put_contents\h*\(\h*\23\h*,(?<X2176802>)|__FILE__,[^\)]+\);\s*mk(?:dir|folder)\([^\)]+\);[^\{\}]{9,200}\$\w{1,20}\h*=\h*['"]rss\.xml['"];\s*\$\w{1,20}\h*=\h*['"]sitemap\w{0,15}\.xml['"];\s*if\h*\([^\)]+\)\s*\{\s*\$\w{1,20}\h*=\h*['"]https?://(?<X2181521>))|\s*\(\s*\$curfile\s*,\s*\$time\s*,\s*\$time\b(?<X2113332>)))|ry(?:[\s\{]+if[\s\(]+(isset)[\s\(]+\$_GET\[['"]\w+['"\]\)&]+!\27\(\s*(\$_POST)[^\{]+\{die\(md5\([^!&]{1,999}@unlink\(\$\w+\);die\([^_%]{1,99}\28\[[^\}]+\}\s*array\(['"]wp_(?:head|footer)[^\}]+[\}\s]+catch\(\w+\s*\$\w+[\)\{\}\s]+\}(?<X1286231>)|\h*\{\s*(\$\w{1,15})\h*=\h*array\h*\([^\)]+\);\s*(?:\$\w{1,15}\h*=\h*\30\[\d+\]\h*\.\h*['"]\w[^;]{3,250};\s*){9}[^\(]{9,999}(\$\w{1,15})\h*=\h*isset\(\$_SERVER\[\$\w{1,15}\]\)[^#]{9,1700}\bcurlopt_httpheader,\h*array\([^\)]{0,150}\31[^\}]{9,399}\becho\h*\([^\{]{0,199}\bcatch\h*\([^\)]+\)\s*\{\s*\}(?<X1185451>)|\h*\{\s*\$(bajatax)\w{1,40}\h*=[^\}]{1,299}\$(message\d+)\h*=\h*['"]\33\|:[^;]{1,199};\s*@?(file_get_contents\h*\(\h*['"]https?://)[^;]{1,199}\$\34[^;]{1,99};[\}\s]+(catch\h*\()[^\{]{1,99}\{\s*if\h*\([^\{\}]{1,199}\{\s*try\s*\{(?:\s*\35[^;]{1,199};){1,2}\s*\}\s*\36[^\)]+\)\s*\{(?:\s*\}){3}(?<X1175500>)|\h*\{\s*if\h*\(\h*md5\h*\([^\}]{1,199}\$(\w{1,40})\h*=\h*['"][^;]{1,19}\bbajatax\b(?:[^\}]{1,199}\bfwrite\h*\([^\);]+\$\38\);){1,2}\s*@?fclose\([^;]+;[\s\}]+catch\s*\(Exception\h*\$\w{1,40}\h*\)\s*\{\s*\}(?<X1163400>)|\s*\{\s*(?:var|let)(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*(?:(String)\h*;(?:\s*(?:var|let))?\s*\w+\s*=[^;\[]{0,499}\40\s*\[\s*['"][from\+\h'"]+\41\.fromCharCode\s*\((?:\s*/\*[^\*]*\*/)*\s*\d[^:\n]{999,4999}\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\h]+if[^\}\n]+\]\.remove[\(\);\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}(?<X1250221>)|String\h*;(?:(?:\s*(?:var|let))?\s*\w+\s*=\s*\40\s*\[\s*['"][fromCharCode'"\+]{15,40}\][^;\[]+\+\s*\40\s*\[[^\n!#]{999,9999}\bremove\(\);\}\}\}\s*catch\s*\(\w+\)\s*\{\}\s*/\*[a-f\d]*\*/(?<X1250570>)|(?:\s*(?:var|let))?\s*\w+\s*=\s*\40\s*\[\s*['"][fromCharde'"\+]{15,40}\][^;\[]+\+\s*\40\s*\[[^\n!#]{999,9999}\[['"][cu'\+"rentSip]{16,40}['"]\]\.remove\(\);[\}\s]+catch\s*\(\w+\)\s*\{\s*\}(?<X1250581>)))|\s*\{\s*(\$\w{1,40})[=\s]+(?:['"][^'"\$]{4,15}['"][\s;]+if[\(\s]+!is_array[\(\s]+(\$\w{1,40})[\)\s]+\46[=\s]+explode[\(\s'"]+,['"][,\s]+\46[\)\s;]+(\$\w{1,40})[=\s]+\[\s*0(?:[,\s]+\d)+\s*\][^\+]{0,199}if[\s\(]+\46\[\47\[\d+\][^;]+\]\((\$\w{1,40})\)[\s\)]+\{[^\|\?]{0,499}@\45\(\48[,\s]+\48[^>]+\$\w{1,40}\->\w+\((?<X2226730>)|wp_remote_get[\(\s]+get_option[\(\s]+['"][^'"\$]+['"][\),\s]+\$\w{1,40}[\)\s]+;\s*return\s*@?[peas](?:assthru|ystem|xec|hell_exec|open|val|ssert)[\(\s]+\45\s*\[['"]body['"]\][\)\s]+;\s*\}\s*catch[\(\s]+Throwable\s*\$\w{1,40}[\)\s]+\{\s*\}(?<X1239170>))|\s*\{\s*(\$\w{1,40})\h*=\h*@file_get_contents[\h\(]+['"]http://\w{1,9}\.mapsplugin\.com/bro/[^'"]{0,40}['"][^;]+;\s*\}\s*catch[\s\(]+Exception\s+\$\w{1,40}[\s\)]+\{\s*\}\s*echo\s+\51\s*;\s*define[\(\h]+['"][a-z]+['"][\h,]+['"][a-z]+['"][\)\h]+;(?<X1185061>)|\s*\{\s*@(\$\w{1,40})[\s=]+getcwd\(\);\s*@(\$\w{1,40})[\s=]+\53\.base64_decode[\(\s]+['"][^;]+;[^<]{0,999}if[\s\(]+\$\w{1,40}<[^\{\}]{0,99}\{\}[^=]+@touch[\s\(]+\54[^=]{0,99}@\$\w{1,40}[\s=]+['"]PD9[^'"]{999,}['"];(?:[^:]{0,9999}://wordpresstheme\.live/){1,9}[^;]+\$_SERVER\[['"]SERVER_NAME[^=]{0,99}\)\{\}(?<X1218780>)|\s*\{\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][^;]*;\s*if[\(\s]+isset[\(\s]+\$_[GPRSC]\w{2,6}\[[^\]]+\][\)\s]+\{\s*(\$\w{1,40})[=\s]+uniqid[\(\s]+rand[\(\)\s]+,[^;]+\.js['"][\s;]+@?(file_put_contents)[\(\s]+\56[^\}]+\57[\s\(]+\56[^;]+;[^\}]*\}[\s\}]*catch[\s\(]+Exception\s*\$\w+[\s\)]+\{[^\}]*\}(?<X1258660>)|\s*\{\s*var(?:\s*/\*[^\*]*\*/)*\s*(\w+)\h*=\h*String\h*;(?:\s*(?:var|let))?\s*\w+\s*=\s*\59\s*\[\s*['"][fromChade'"\s\+]{12,}['"]\]\s*\(\s*\d[^;]+;[^:\n]{999,4999}\w+\[\w+\]\(\w+\)\[\d+\]\[\w+\]\(\w+\)[;\h]+if[^\}\n]+\]\.remove[\(\);\}\s]+catch[\(\s]+\w+[\)\s]+\{\s*\}(?<X1250240>)|\{\s*\$bajatax_\w+[\h=]+apply_filters\([^\}]{99,600}[\s\}]+(catch[\h\(]+Exception)\h*\$e\)\s*\{[^\}]{9,400}\bfile_get_contents\(['"]https:?//api\.telegram\b[^\}]{9,199}\}\s*\61\h*\$e\d\)[\s\{]+\}\s*\}\s*\}(?<X1213250>))|ulis_file\(['"][^\'"]{0,20}\b(?:total|block|log)_?(?:bot|visitor|email|photocc)\.(?:txt|dat)['"],['"]?[^'"]{0,9}\$ip\b(?<X2151971>)|V12hsJy_\s*\(\s*'[^']*'\s*,\s*\d+\s*\)\s*\)\s*array_shift\s*\(\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*\)\s*;\s*\}\s*\}\s*else\s*\{\s*\$\w{1,40}\s*\[\s*\$\w{1,40}\s*\]\s*=\s*microtime\s*\(\s*true\s*\)\s*;\s*\}\s*\}(?<X2046392>))
\bvar(?:\s(\w+)/\*\w+\*/[^;]+eval;\/\*\w+\*\/var\s*\w+[^=][\*/\w=]+atob;\1\(\w+\((?:[&\*;/\w+\+"']{1,1999}\)\);(?<X1255651>)|[\*;/\w+\+"']{1,1999}\)\);(?<X1254331>))|\s*(\w)=\bString;eval\((\4\.(fromcharcode)\()[\d\+,\)]+\5[\d\+,\)]+\5[\d\+,\)]+\5[\d\+,\)]+\5[\d\+,\)]+\5[^\*]+\*\d+\*/(var)[^]}]+\]\)\{try[^\}]+\}\w+[^\}]+\}{3}[^;]+;(function)\s*[^\{]+\{\7[^\+]+[\+scripx0-9\(\)"\]'];\}+\8[^\}]+\}\7[^\}]+\}\8\s\w\(\)\s*\{\7[^\}]+\6[^\}]+\};return\s*\w\(\);\}(?<X1241430>)|\s*(\w+)\s*=\s*(?:(document\.cookie)\.match\(new\s*RegExp\([^!]+var\s+(SM_CNT)\s*=\s*\10\s*\?\s*decodeURIcomponent\(\10[^\{]+if\s*\(\s*\12\s*\D{1,2}\s*\d[^\}]{49,199}eval\(function\((?:\w,){5}\w\)\{[^\n]+['"](?:\w+\|){9,29}\w+['"][^@!%#&/]+\12\s*=\s*\12\s*\+\s*\d+;\s*\11\s*=\s*['"][^;]+\+\12\+[^\n]+;\s*\}(?<X1131122>)|\w+\.createElement\(['"]script['"]\);\s*\10\.\w+\s*=\s*['"]https?://climedballon\.org[^;]+appendchild\(\10\);(?<X1251490>))|\s*(\w+)\s*=document\s*,\s*\w+\s*=\15\.createelement\(['"scr\+ipt]{11,40}\);\s*\w+\.\w+\s*=\s*['"]https?://(?:\w+\.)?gocloudmaps\.com['"];\s*\15\.\w+\.appendchild\(\w+\);(?<X1257881>)|\s*(\w{0,4})(_0x\w{1,9})\h*=\h*\[(?:['"][^'"]+['"],){15}[^\]]+\];\((function)\(_0x\w{1,9},\18\w{1,5}\)\{[^\n]{99,1999}\bvar\h*(\17_0x\w{1,9})\h*=\h*\19\(_0x\w{1,9},\18\w{1,5}\)\{[^\n]{99,14500}\bwindow(?:\[\20\([^\)]+\)\]){2}\(\20\([^\)]+\)\);\}\}(?<X1189591>)|\s*(\w{1,10})=\s*new\s*Object\(\);\22\[(\w+)\[\d+\]\]=[^;]{1,200}(?:ie:/msie/\[\23|opera:/opera/\[\23|moz:/gecko/\[\23|safari:/safari/\[\23)[^\|\n]{50,200}load:function[^\*<\n]{999,1400}return\s*unescape\(document\[\23\[\d+\]\][^\*\n]{50,250}\(\23\[\d+\],function[\(\)\{\}]+;(?<X1254053>)|\s*(\w{1,14})(\/\*\w{1,14}\*\/)?=\26?eval;\26?var\s*\w{1,14}\26?=\26?atob;[^\(]{1,160}\25\([^:]{1,1800}\+\26?(?:\/\*\w{1,14}\*\/)?['"&quot;]+\w{1,14}['"&quot;]+[^\)]{0,200}\)\);(?<X1281282>)|\s*(\w{1,40})=Element;\s*\28\.prototype(\.append)\w+=(function)\((\w{1,40})\)[\s\{]+\31\.parentNode\.insert\w+\(this[\s,]+\31\.nextSibling[\);\s]+\}[^;]{0,40};[\s\(]+\30[\(\)\{\s]+var\s*(\w{1,40})=document\.createElement\(['"]script\b[^:]+://\w{1,5}\.\w+\.\w{2,3}/[^;]+;[^\}]+\[0\]\29Child\(\32\);[\}\(\)\s]+;(?<X1206334>)|\s*(\w{1,40})=String;\s*var\s*(\w{1,40})=\34[\.\['"]+fromCharCode['"\]\(\s]+118[,\s]+97[,\s]+114[,\s]+32[,\s]+95,[^\);\(]{149,299}119,104,105,108,101,40,33,33,91,93,41,123,116,114,121,123[^\)]+\)\s*;\s*eval[\s\(]+\35[\s\)]+;?(?<X1250501>)|\s*(\w{1,40})[=\s]+['"]https?://raw\.githubusercontent\.com/[^;]+;\h*fetch[\s\(]+\37[\s\)]+\.then[\s\(]+(\w+)\s*=>\s*\38\.\w+\(\)\)\.then\(\w+\s*=>\s*\{\s*var\s*(\w+)[=\s]+(document\.)creat\w+\(['"]script['"]\);\s*\39\.src[=\s]+data\.trim\(\);\40getEl\w+\(['"]head['"]\)\[\d+\]\.appendChild\(\39\);\}\);(?<X1274010>)|\s*(\w{1,40})[\s=]+\w+\.split\(['"][^'"]+['"]\),\s*\w+[=\s]+(parseInt)\(\42\[[\d\],\s\)]+\w+[=\s]+\43\(\42\[[\d\],\s\);]+var\s*\w+[\s=\[\];]+for[\s\(]+var\s*\w+[=\s]+\d+[;\s]+\w+[<>!=\s]+\42\[\d+\]\.length;[^\{\};]+\{\s*\w+\.push\(\42\[[^\}]+\}\s*var\s*(\w+)[=\s]+['"][^\{\}]{0,199}Function\(\44\)\.call\(\);(?<X1263100>)|\s*(\w{1,40})\s*=\s*(?:(document\.)createElement\((String\.fromCharCode\()115,99,114,105,112,116[\)\s]+;\s*\46\.type[\h=]+\48[\d,]{9,99}\);\s*\46\.src[\h=]+\48[\d,]{9,999}\)\h*\+\h*\48[^;]+;\s*\47\w+\(\48[^;\.\[]+\[\d+\]\.appendChild\(\46\);(?<X1197710>)|(Element);\s*\46\.prototype(\.append)\w+[=\s]+(function)\((\w{1,40})\)[\s\{]+\53\.parentNode\.[^\;\)]+\53\.nextSibling[^\n\{</]{1,99}\52[\(\)\{\s]+var\s*(\w{1,40})[=\s]+document\.create\50\((?:['"]script|String\.fromCharCode\(115,99,114,105,112,116)\b[^\n\}]+?\.fromCharCode\(104,[1265,]+,(?:58,)?47,[^;]+;[^\}]+\[0\]\51Child\(\54\);[\}\(\)\s]+;(?<X1207701>)|atob[\(\s]+['"]aHR0[^'"]+['"][\s\)]+;\s*var\s*(\w{1,40})[=\s]+(document)[;\s]*var\s*(\w{1,40})[=\s]+\56\.createElement[\("'\s]+script["'\)\s]+;\s*\58\.src\s*=\s*\46;\s*\58\.type=['"]text/javascript['"];\s*\57(\.currentScript)\.parentNode\.insertBefore\(\58,\s*\57\59[\);\s]+\57\59\.remove\(\);(?<X1255070>)|document\.createElement\(['"](\w{1,40})['"]\)\;\s*\46\.type\s*=\s*['"]text/javascript['"]\;\s*\46\.src\s*=\s*String\.fromCharCode\([^\)]{20,500}\);\s*var\s*scripts\s*=\s*document\.getElementsByTagName\(['"]\61['"]\);(?<X1043482>))|\s*(\w{1,5})\s*=\s*jQuery\.noConflict[^\/]{50,199}\63\.getScript\(['"]https?:\/\/firefoxstabs[^\{]{5,99}\{flag\s*=\s*2;[\}\);]{1,9}\);(?:var\s*(\w{1,9})\s*=\s*\[['"]\\x\d{2}[^\}]{99,1200}=function\s*\(\)\{if\(this[^\?]+\64\[\d{2}\][^\?]{9,30}\)\(\);)?(?<X1125233>)|\s*(\w{1,9})=this;\h*function\h*\w{1,9}\(\)\h*\{\h*\66\.(\w{1,9})=\h*new\h*\66\[(\w{1,9})\(['"][^'"]{1,40}['"]\)\][^\n/]{9,199}\bfunction\s*\68\s*\([^\n!]{9,999}if[\s\(]+(\w+)[&!=]{2}[^;]+\.fromCharCode\(\69\);[^\n]{9,199}\bthis\s*\[\s*\68\s*\([^\]]+\][\(\s]+\67\s*\[\s*\68\s*\([^\]]+\][\)\s]+;(?<X1213940>)|\s*(\w{1,9})[=\s]+(document)[\s;]+var\s*(\w{1,9})[=\s]+\71\.createElement\(['"](script)['"\);\s]+\w{1,9}\.src[=\s]+['"]https?://[^/]{6,18}/[a-z\d]{4,12}\?se_referrer\s*=[^;]+;\s*if[\s\(]+\72\.(current\74)[\s\)]+\{[^;\(\)\}]{0,99}\.insertBefore\(\73[,\s]+\72\.\75[\);\s]+\}[^;]+\[0\]\.appendChild\(\73[\);\s]+\}(?<X1205180>)|\s*(\w{1,9})[=\s]+document(?:[\.\s]+createElement[\(\s]+['"]script['"][\)\s]+;\s*\77\.src[=\s]+['"](?:http)?s?:?//sportfactory\.press\b[^;]+;\s*document\.head\.appendchild\(\77\);(?<X1261421>)|\.createElement[^#<]+\77\.src[=\s]+atob[\s\('"]+aHR0cHM6Ly9zdGF0aWM1LWpxdWVyeS5jb20[='"\s\)]+[^#<]+insertBefore[\(\s]+\77,\w{1,9}[\s\)]+;(?<X1263870>))|\s*(\w{1,9})[\s=]+atob;[^=]{1,99}\bvar\s*(\w{1,9})[\s=]+[^;]+;[^=]{1,99}\b(\w{1,9})[\s=]+eval;[^=]{1,99}\b\82[\s\(]+\80[\s\(]+\81[\s\)]+;(?<X1258990>)|\s*(\w{1,9})[\s=]+String\.fromCharCode\(118,97,114,[^\)]{0,99}61,32,100,111,99,117,109,101,110,116,46,103,101,116,69,108,101,109,101,110,116,115,66,121,84,97,103,78,97,109,101,40,34,115,99,114,105,112,116,34,41,[^\)\*/]{9,9999}/\*[^\*]+\*/\);[^\(\)]{0,40}\beval[\s\(]+\84[\s\)]+;(?<X1227613>)|\s*(\w{1,9})\s*=\s*(?:(document)\.createElement[\(\s]+['"]script['"][\)\s;]+\86\.(setAttribute)[\(\s]+['"]async['"][\s,]+['"\)\s]+;\s*\86\.\88\(['"]src['"][\s,]+((window\.)atob)[\(\s\\]+['"]Ly9hcGl1anF1ZXJ5L[^'"\\]+\\?['"][\)\s\+]+\90location\.href[\s\+]+\89[^;]+;\s*\87\.head\.appendChild[\(\s\\]+\86[\)\s\\]+;(?<X1202430>)|\[(?:['"]\d+['"],?)+\];\s*function\s*(\w{1,9})\(\w{1,9}\)\{return\s*\w{1,9}\(\w{1,9}\(\w{1,9}\),['"]\w+['"]\);\}\w{1,9}\(\92\(\86\[\d+\]\)\);(?<X1042963>)|document;\s*var\s*(\w{1,9})\s*=\s*\86\.createElement\(['"]script['"]\);[^:\n]{9,99}\94\.src[=\s]+['"]https?://[^/]{9,60}/[^'"]{1,40}\.js['"];[^\[]{0,199}else\s*\{\s*\86\.getElementsByTagName[\(\s]+['"]head['"][\)\s]+\[0\]\.appendChild[\(\s]+\94[\)\s]+;\s*\}(?<X1224061>)|function\(\)\s*\{\s*var\s*_\w{1,9}\s*=\s*String\[[^\]]{1,99}\]\((?:\d+,\s*)+\d+\s*\);\s*var\s*_\w{1,9}[^<>]{1,999}<\s*(scripts)\[[^\]]{1,99}\];\s*i\+\+\s*\)\s*\{\s*if\s*\(\s*\96[^\)]{1,99}\)\{\s*n\s*=\s*false\s*\}\s*\}\s*;\s*if\s*\(\s*n\s*[^\w]{1,3}\s*true\);?\{?\86\(\)\}?(?<X1059683>))|\s*(\w{10,30})=['"][^#]{99,1500}\)(\w{10,30})\W{2}\98\.charAt\(\s*\w{5,30}\s*\)\s*\}\s*eval\(\s*\99\s*\);(?<X1043032>)|\s*(_0x\w+)\s*=\s*\[[^]]+\];function\s*\w+\(\)\s*{\s*\w+\s*_0x\w+=(?:\101\[\d+\]\s*\+?\s*)+;window\[\101\[\d+\]\]\(_0x\w+\s*\+\s*key\);\s*}(?<X1043161>)|\s*(_0x\w{1,9})\s*=\s*(_0x\w{1,9});[\(\s]+function[\(\s]+_0x\w{1,9}[\s,]+_0x\w{1,9}[\)\{\s]+var\s*_0x\w{1,9}=\104[^%><]{9,1999}["']aHR0cHM6Ly9jZG4uanF1ZXJpLmF0L3I=*["'][^%>]{9,1999}[\(\s]+window[\s\['"]+(\w{1,9})[\s\]'"]+=[\s\{'"]+\w{1,9}[\s'":]+\103[^%\n]{9,2999}atob[\s\(]+\105[^%>]{9,99}\105[^;]+;(?<X1254470>)|\s*(_[01]x[a-f\d]{1,9})\s*=\s*document\[(?:\s*_[01]x[a-f\d]{1,9}\(['"]?\w+['"]?,[^\)]+\)(?:\s*\+)?)+\]\(\s*_[01]x[a-f\d]{1,9}\[\s*_[01]x[a-f\d]{1,9}[^;]+;\s*\107\[_[01]x[a-f\d]{1,9}\([^\)]+\)\]\[['"][insertBfo'"\+]{12,40}['"]\]\(\w+,\107\);\}\(\)+;(?<X1250260>)|\s*(_[10]x[a-f\d]{1,40})\s*=\s*(_[10]x[a-f\d]{1,40})[;\s\(]*function\s*\([^;\}\{]+\{[^;]+;\s*while[\s\(]+!!\[\][\s\)]*\{\s*try\s*\{[^&]{9,999}\[['"](getElementsByTagName)['"]\][^;]+;\s*\}[\s\(]+(window[,\s]+document['",\s]+script['",\s]+\109)[^;]+;\s*function\s*\110\s*\([^@]+\111[^;]+;\s*\}\s*\(\112[^;]+;(?<X1249332>))
\bvar(?:\s*(_\wx\w{1,9})=\[(?:(?:['"][^'"]{1,99}['"],?){1,9}['"]\s*(?:c|\\x63)(?:o|\\x6f)(?:n|\\x6E)(?:s|\\x73)(?:t|\\x74)[^\]]{1,40}((?:h|\\x68)(?:t|\\x74)(?:t|\\x74)(?:p|\\x70))[^\]]+\2[^\]]+\2[^\]]+\2[^\]]+\];var\s*(_\wx\w{1,9})=\[\1\[[^\?]+\3\[\d+\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\)\(\);?(?<X1057910>)|['"]{2},['"](?:\\x41|A)(?:\\x42|B)(?:\\x43|C)(?:\\x44|D)[^\]]{99,999}['"]\];\s*function\s*(_\wx\w{1,9})\([^\./]+if\s*\(navigator\[\1\[\d+\]\]\)\s*\{\s*if\s*\(\s*\w{1,9}\(\1\[\d+\]\)\s*\W{2,3}\s*\d+\)\{\}\s*else\s*\{\s*\w{1,9}\s*\([^\(]{99,199}\(\1\[\d+\]\)\s*\+\s*\5\(\)[\s\}]+;(?<X1118460>))|\s*(_\wx\w{1,9})\s*=\s*\[(?:"","[^\]]{1,999}(?:\?|\\x3F)(?:k|\\x6B)(?:e|\\x65)(?:y|\\x79)(?:=|\\x3D)"\];function\s*(makeid\(\))\{var\s*_\wx\w{1,9}\s*=\s*\7\[[^\?]{1,600}\?\7\[[^\?]{400,750}\7\[\d+\]\s*\+\s*\8\}\};?(?<X1057990>)|['"](?:s|\\x73)[^\?]{350,3800}\];var\s*(?:_\wx\w{1,9})=\[\7\[[^@]{500,4000}?\[0x0\];_\wx\w{1,9}\[_\wx\w{1,9}\[0\w{1,2}\]\]\[_\wx\w{1,9}\[0\w{1,2}\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\(\)\);?(?<X1058712>)|['"][^\?]{2048,8096}\];var\s*_\wx\w{1,9}=\[\7\[[^@]{4000,5096}\[0x0\];_\wx\w{1,9}\[_\wx\w{1,9}\[0\w{1,2}\]\]\[_\wx\w{1,9}\[0\w{1,2}\]\]\(_\wx\w{1,9},_\wx\w{1,9}\)\}\(\)\);?(?<X1059232>))|\s*(_\w{1,9})=\[(?:(?:['"](?:\\x\w{2}){2,35}['"],){5}[^\]]{99,999}\];\s*element=document\[\12\[\d\]\][^\?\n\}\{]{1,40}\{[^\?\n\}\{]{99,499}head\[\12\[\d{1,3}\]\]\(js\);\}\s*;(?<X1125362>)|['"][^\^]{99,4999}['"]\];\s*eval\((function)\s*\((?:_\w{1,9},?\s*)+\)\s*\{\s*_\w{1,9}=\14\s*\(_\w{1,9}\)\s*\{\s*return\s*_\w{1,9}\.to(String)\(36\);\s*\}\s*;\s*if\s*\(\s*!\s*_\w{1,9}\[\d+\][^\^]{1,40}\^/,\s*\15\)\)\s*\{\s*while[^\n]{99,599}\12\[\d+\]\),\d+,\{\}\)\);(?<X1131372>))|\s*(_\w{1,9})\s*=\s*\[(?:"",[^\]]{1,200}(?:\\x73|s)(?:\\x6A|j)(?:\\x2E|\.)(?:\\x79|y)(?:\\x72|r)(?:\\x65|e)(?:\\x75|u)(?:\\x71|q)(?:\\x6A|j)(?:\\x2F|/)[^\]]{1,99}(?:\\x2F|/)(?:\\x2F|/)[^\]]{1,200}\];document\[\17\[[^;]{1,99}?\17\[\d+\]\)\);?(?<X1057104>)|(?:\s*['"][^'"]{2,99}['"]\s*,){9}[^\]\n\$]{999,9999}\]{2}[^\n]{60000,},\s*CryptoLoot\[\s*\17[^=]{1,12}=\s*URL\[\17[^\(]{1,12}\(\s*new\s*Blob\s*\(\s*\[\17\[\d+[\]\)\s]{4,12}(?:$|\Z)(?<X1128912>))|\s*(cookie)\s*=\s*get\20[\(\s]+['"](\w+)['"][\)\s]+;\s*if[\(\s]+\20\s*==\s*undefined[\)\s]+\{\s*set\20[\s\(]+['"]\21[^;]+;\s*document\.write\(['"]<[iframe\s\+'"]{6,}\s[src'\+"]{6,}=['"]https?:[^:<]{9,}style=['"][^<\-]+\-['"]\+[^/<\n]+</[iframe\s\+'"]{6,}>["'][\s\);]+\}(?<X1249211>)|\s*(script)=document\.createElement\(['"]\23[^"]{0,99}\23\.src[=\s]+['"](?:https?)?:/+adsnet\.\w+/\w+/\w+\.js[^%]{1,200}\bhttps?://\w+\.[a-z]{2,8}/\w+\.js[^%]{1,80}appendChild[\(\s]+\23[\)\h]+;(?<X1235264>)|\s*[a-z\d]{1,9}\s*=\s*\d+;\s*eval\(String\.fromCharCode\(118,\s*97,(\s*114,)(\s*32,)[^\)]{99,500}83,\s*116,\25\s*105,\s*110,\s*103,\s*46,\s*102,\25\s*111,\s*109,\s*67,\s*104,\s*97,\25\s*67,\s*111,\s*100,\s*101,\s*40,\s*[^\)]{99,199}52,\s*55,(\s*44,)\26\s*57,\s*57,\27\26[^\)]+41,\s*59,\s*10,\s*125\)\);(?<X1064801>)|\s*\w+="[^"]+"\s*,\s*\w+=""\s*,\s*\w+=""\s*,\s*\w+;\s*\w+=\w+\[\s*'length'\s*\]\s*;\s*for\(\s*i=0;\s*i<\w+;\s*i\+\+\s*\)\s*{\s*\w+\+=String\['fromCharCode'\]\s*\(\w+\['charCodeAt'\]\(i\)\+2\)\s*}\s*\w+=this\['unescape'\]\(\w+\);\s*this\['eval'\]\(\w+\);(?<X1043002>)|\s*\w+[=\s]+\w+;[^!]+while[\s\(]+!!\[\][^!]{0,999}\bvar\s+(\w+)[=\s]+document\[\w+\(\w+\)\](?:\(\w+)+[\),\s]+(\w+)[=\s]+!\[\];[^<\+]+\bfor[\s\(]+var\s*(\w+)[=\s]+\w+;[^\{]+\{\s*\30\[\32\][^!;]+\31[\s=]+!!\[\][\s\);\}]+function\s*\w+[\(\)\s\{]+var\s*\w+[=\s]+\[['"]script[^&]{40,999}\31[\s=]*!\[\][\s&]*\w+\(str\(\[[^\]]+\][\s\)]+;(?<X1228080>)|\s*\w+[\h=]+['"]{2};(function)\h*(\w+)\(\)\{\34\h*\w+\(\w+,\w+\)\{for\(var\h*\w+,\w+[\h=]+\[\],\w+[\h=]\([\-\+\d]+\),[^\n\?]{999,3999}\bwindow\[\([^\)]+\)\]\[\([^\)]+\)\]\(\(['"][^'"]+['"]\+\w+\+['"][^\)]+\),\([^\)]+\)\),\w+\(\w+[\)\}]+\35\(\);(?<X1222030>)|\s*\w\s*=\s*\w\s*;\((function)[^\{]+\{var[^;]+;while\(!!\[\]\)\{try\{var\s*\w\s*=\-[parseInto\('x\)/\*\+0-9\-cbd]+;if\([^\}]+\}[^\}]+\}{3}\(\w+,\w{7,16}\){2};\37[^\n\*]{9,99}\}\37\s*\w{1,16}\(\w\)\{var[^\]]+\]\([^\n\*]{99,}appendChild[^;]+fromcharcode[^\}\n]+;\w=\37\(\)\{return\s*\w;\};return\s*\w\(\);\}(?<X1248813>)|\s*\w{1,15}\s*=\s*['"]{2};\s*setTimeout\(\d+\);\s*var\s*default_keyword\s*=\s*encodeURIComponent\([^\?]{9,300}/jquery\.min\.php['"];\s*var\s*\w{1,15}[^\{]{50,299}\{document\.write\(['"]<(script)[^\}]{9,99}/\39>['"]\);\}(?<X1133863>)|\s*\w{1,40}\s*=\s*['"][^'"]{9,99}[=\.]\d{1,3}InboxLight\.?aspx\??n[\.=]\d{4,9}(?<X2129305>)|\s*\w{5,10}\s*=\s*\d+;\s*var\s*(\w{1,2})[^\(]{1,49}createElement\(['"]script['"]\)[^\(]{9,99}fromCharCode\(104,\s*116,\s*116,\s*112,\s*(?:\d{2,3},\s*){10}[^\)]{9,150}\);\s*(\w{1,20})\.src\s*=[^\?&;]{1,40}\.js[^\]\}]{99,200}\}\s*else\s*\{\s*\42\.[^\}\.]+\]\.appendChild\(\43\);\s*\}(?<X1122665>)|\s*_0x(?:\w{1,40}=\['.{6000,7000}miner\.start\(CRLT\.\w+\);(?<X1043371>)|\w{1,9}=_0x\w{1,9};\(function\((_0x\w{1,9}),_0x\w{1,9}\)\{var\h*_0x\w{1,9}=_0x\w{1,9},_0x\w{1,9}=\46\(\);while\(!!\[\]\)\{try\{var\b[^<\n\}]{99,}\}\h*catch\s*\([^<]{1,999}\bvar\s*_0x\w{1,9}=\[['"]script['"],['"]currentScript['"],[^\]]+\][^\}]+\}[;\h]*return\s*\w+[\(\);\s]+\}(?<X1264131>))|\s*key=['"]\w{1,40}['"];var\s*site=['"][^'"]{1,40}['"];eval\(function\(w,i,s,e\)\{var\s*[lI1]{2,40}=\d+;[^\%]{500,600}%\d+\)[lI1]{2,40}=\d+;[lI1]{2,40}\.push\(String\.fromCharCode\(parseInt\([^\+]{1,40}\+\+;if\([^\)]{1,40}\)[lI1]{2,40}=\d+;\}return\s*[lI1]{2,40}\.join\(['"]['"]\);\}\([^\)]{9000,11000}\)\);(?<X1056232>)|\s*r\s*=\s*document\s*\.\s*referrer\s*;\s*var\s*c\s*=\s*document\s*\.\s*cookie\s*;.+?//google-analyzing.com/urchin\.js"\s*;\s*var\s*t\s*=\s*document\s*\.\s*getElementsByTagName\s*\(\s*"script"\s*\)\s*\[\s*\d+\s*\]\s*;t\.parentNode\.insertBefore\(e,t\)}(?<X1043222>)|\s+(\w+)[\s=]+(document\.)create(?:(Element)[\s\(]+['"]script['"][\s\)]+;\s*\50\.src[\s=]+['"](?:https?:)?//\w+\.(?:xjs\.lol|(?:jsfile|rnv)\.life)/[^'"]+\.js['"];\s*\51get\52sby[^\.;=\$]{1,49}?\.appendChild[\s\(]+\50[\s\)]+;?(?<X1223571>)|Element(?:([\s\(]+['"]script['"][\s\)]+);[^\?]{0,99}\b\50\.src[\s=]+['"](?:https?:)?//(?:course\.netpickstrading|community\.backpacktrader|shipwrecks\.ggentile)\.com/[^;]+;\s*var\s+(\w+)[\s=]+(\51getElementsByTagName\54\[\d+\]);\s*(?:\55|\56)\.\w+\.insert(?:After|Before)[\s\(]+\50[,\s]+\56[\s\)]+;(?<X1221540>)|[\s\(]+['"]script['"][\s\)]+;\s*\50.src[\s=]+['"](?:https?:)?//adogeevent\.com/[^;]+;\s*\51[^;]+\.appendChild[\s\(]+\50[\s\)];(?<X1213151>)))|\s+(\w+)[\s=]+document;\s*var\s+(\w+)[\s=]+\59\.createElement\(['"](script)['"]\);\s*\60\.type[\s=]+['"][^'"]{4,9}\61['"];\s*\60\.async[\s=]+true;\s*var\s+(\w+)[\s=]+String\.fromCharCode[\s\(]+(?:(?:104|11[265]|58|47)[,\s]+){7}[^;]+;\s*\60\.src[\s=]+\62;\s*if\s*\([^;]+;[^\['"]{1,99}['"]head['"]\)\[0\]\.appendChild\((?:\59|\60)\);\s*\}(?<X1206940>)|\s+(\w{1,40})\s*=\s*(document\.)createElement\(['"]script['"]\);\s*\64(\.setAttribute\(['"])async['"][^;]*;\s*\64\66src['"]\h*,\s*window\.atob\(['"][^;]{40,199};\s*\65[^;]*\(\64\);(?<X1195381>)|\s+(\w{1,9})=document\.createElement[\(\s'"]+script['"\)\s]+;\h*\68\.src=['"]https?://[^/]+\.[a-z]{2,9}/\w+['",\s]+document\.getElementsByTagName[\("'\s]+head['"\)\s]+\[\d+\]\.appendChild\(\68\);\s*\Z(?<X1234760>)|\s+(_0x\w{1,9})[\s=]+_0x\w{1,9}\s*;\s*function\s*_0x\w{1,9}[\(\)\s]+\{\s*var\s*_0x\w{1,9}[\s=]+\[['"]srcdoc[^\]]+\][^>#\n]{99,4999},(\w{1,9})\[['"]\w{1,9}['"]\][\s=]+document[^#\$\n]{9999,}\71\[\70[^;\n]*;(?<X1256561>)|\s+(_[01]x[a-f\d]{1,39})\h*=\h*\[['"]\\[^\]]{9,}\];\h*var\h+(\w+)\h*=\h*(document)\[\73\[\d+\]\]\([^;]+;\74\[\73\[\d+\]\]\h*=\h*\73\[\d+\];\s*\75\[\73\[\d+\]\]\(\73\[\d+\]\)\[\d+\]\[\73\[\d+\]\]\(\74\)(?:\s*;)?(?<X1274680>)|\s+\w+=\[["']0\d{2,}["'],[^]]+\];function.+?String\.fromCharCode\(\w+\.slice\(\w+,[^\}]+\}return\s*(?:\(\w+\)|\w+);\s*\}(?:function \w+\(\w+\)\s*\{\s*return \w+\(\w+\(\w+\),["']\w+["']\);})?(?<X1043112>)|\s+\w{1,40}=\d+;\s*(\w{1,40})=\w{1,40};\s*(\w{1,40})=\w{1,40}\.split\(['"]o13['"]\)\s*,\s*\w{1,40}\h*=\h*(parseInt\()\79\[[^;]+;\s*var\s+(\w{1,40})\h*=\h*\[\];\s*for\h*\([^\}\{]{0,99}\{\s*\81\.push\(\79\[\d+\]\.substring\([^\^]{0,199}\80\81\[[^;\^]+\^[^;]+;\s*function\(\78\)\.call\(\);(?<X1195322>))
\bu(?:n(?:link(?:[\(\h]+['"](index\.php)['"][\)\h]+;\s*@?(file_)pu(t_contents)[\(\h]+['"]\1['"][,\h]+\$orig_index[\)\h]+;[^\\]{99,999}(\$\w{1,40})\h*=\h*(?:fopen|fread|str_replace|\2ge\3)\h*\([^;]+;\s*if[\h\(]+strpos[\(\h]+\4[\h,]+['"]?\$(?:b[o0]t\d*){2,}(?<X2181960>)|[\(\s"']+(\.contactemail)["'\)\s;]+fwrite[\(\s]+fopen[\(\s]+['"]([^'"]+)['"][,\s]+['"]w['"][\),\s]+['"][^'"\$@]+@(?:yopmail|mailinator)\.com[^:]+;\s*@?rename[\s\(]+['"]\7['"][,\s]+['"]\6['"][\s\)]+;(?<X2260030>)|[\(\s]+\w+[\(\s]+['"]sitemap\.xml['"][^!]{1,999}\bwhile[\(\s]+!feof[\(\s]+(\$\w{1,40})[\)\s\{]+\$\w{1,40}\s*\.=\s*fread[\(\s]+\9[,\s]+1024[\)\s]+;\s*\}\s*pclose[\s\(]+\9[\s\)]+;(?<X2226600>)|\((?:(\$\w{1,40})\);touch\(\11,strtotime\(['"]\-\d+\h+days['"],time\(\)+;file_put_contents\(\11,\$\w{1,40}\);chmod\(\11,[^;]{1,9};(?:echo\b[^;]{1,99};)?[ed](?:ie|xit)\b[^;]{0,99};(?<X2177570>)|\$[^\)]+\);(?:(?:([pes](?:assthru|ystem|xec|hell_exec|open)\()['"]pkill\b[^'"]+\bstealth['"]\);){2}(\$[^=]{1,99})=(file_)ge(t_contents\()[^;]{1,99};\15pu\16(\$[^\),]{1,99}),\14\);chmod\(\17,[^;]{1,99};(\$[^=]{1,99})=['"]\./\{?\17\}?[^;]{1,99};\13\18\);(?:[^\}]{0,99}\}+)?(?:\?>)?\Z(?<X2180642>)|([pes](?:assthru|ystem|xec|hell_exec)\()['"]p?kill\b[^'"]+\bstealth['"][^\?]{1,199}(\$[^=]{1,99})=(file_)ge(t_contents\()[^;]{1,199};\22pu\23(\$\w{1,40}),\21\);[^\?]{1,199}=['"]./\{?\24\}?\s*[12&]?>\s*/dev/null\b[^'"]{0,99}['"];\20[^\)]+\);[^\}\?]{0,99}\}+\s*(?:\?>\s*)?\Z(?<X2189830>))|\$_SERVER\[[^\]]{1,40}\]\);[^5\}]{1,99}\s*\}\s*function\s+md5_brute\((?<X2122800>)|__FILE__\)[^\?]{1,999}>imambro</(?<X2216011>)|basename\(\$_[GPCSR]\w{1,40}\[[^\]]+\]\)\);echo\s*['"][^'"]{1,99}was\s*here['"];(?<X2128660>))|\h*\(['"][^\.]{2,20}\.php['"]\);(?:\s*\}\s*)+(\$titlelist)\h*=\h*(array)\h*\([^\)]{30,200}\);\s*\$\w{1,20}\h*=\h*\29\[\30_rand\(\29,[^\)]+\)\];\s*\$urls\h*=\h*\30\(['"][0-9a-z]{15,45}['"]\);(?<X2169790>))|serialize\h*\(string_cpt\h*\(base64_decode\s*\([^@%\*]{999,3500}\$\w{1,20}\h*=\h*explode\([^\$]{2,20},\h*\$(setcook)\);\s*\32ie\((?<X2162280>)|zip\("archive\.zip"\);\s*@unlink\('archive\.zip'\);\s*@unlink\('\w+\.php'\);(?<X2047700>))|p(?:[l1][0o][a4]d3r</title>(?<X2215751>)|l[0o][4a]d[3e]r\s*(?:\S\s*)?</(?:font|h\d|title)>[^@]{1,199}\.php_uname\(\)[^\?]{1,499}\bif\(isset\(\$_[GPCSR]\w{2,6}\[[^\]]+\](\)\)\{)if\(is_writable\(\$\w{1,40}\36if\([cm]o(?:py|ve_uploaded_file)\(\$_FILES\[(?<X2169931>))|rl\s*=\s*https://bank\.westpac\.co\.nz/(?<X2049980>)|se(?:\h*MIME::Base64;\s*\$\w{1,15}\h*=\h*['"](?:Shell|backdoor)\h+By\b(?<X2142531>)|\h+\\WordPress\\Api;[^\?\{\(]{0,99}\$(\w{1,40})=new\h+Api\(\);[^@#%&:\?<!\\]{499,1999}\$(\w{1,40})=base64_decode\(['"]ahr0c[^\?\}>:#%&]{99,999}\$(\w{1,40})=\$\40\->get\("?\$\41["\.']*/wp\-(?:admin|includes)/[^'"]+\.php['"]\);[^\?#%&!:]{1,199}\bfile_put_contents\(\$\w{1,40},['"]?\$\42\b(?<X2180811>)|r\.'/etc/'\.\$t\.'/shadow','ab(?<X2134351>)))
\bv(?:a(?:lue="<\?\s*passthru\("pwd"\);\s*\?>(?<X2049650>)|r\h*(\w)(?:=\w;\s*(?:(function)\h*(\w)\(\)[\{\s]+var\h*(\w)=\[[^\]\n]{0,299}(?:createElement|fromCharcode)[^=]{0,299}=\3\b[^;]+return\h*(?:\5|\4\(\));[^\?\n]{99,600}var\h*(\w+)=[^\[]{0,9}String\[\2[^\n\*]{99,999}(\w)=\w\[\2[^\]]+\]\(['"][script\+\s'"]{6,19}['"]\);\7\[['"]src['"]\]=\6[^\}/]{1,199}\[\2\([^\]]+\]\(\7\);\s*\}(?<X1237914>)|\((function)\([^!\n]{0,40}\bwhile\(![^\{]+\{try[^\?\n]{9,999}\bvar\h*(\w+)=[^\[]{0,9}String\[\2[^\?\n]{9,999}\b(\w)[^;]+var\h*(\w)=\[[^\]]{0,299}(?:createElement|fromCharcode)[^=\}\n]+\11=\9[^;]+(?:return\h*(?:\12|\11\(\));[^/\n]{0,99})+(\w)=\w\[\2[^;]+;\13\[\2[^\]]+\]=\10[^/;]{1,199}\13\);\s*\}(?<X1237903>))|[\h=]+string;\h*var\h*(\w)[\h=]+\2\.fromCharCode\(118,97,114,32,100,61,100,111,99,117,109,101,110,116,59,118,97,114,32,115,61,100,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,32,10,115,46,115,114,[^\)]+\);\h*eval\((?:/\*[^/]+/)?\15\);(?<X1231162>))|r\h*(\w+)[\h=]+(?:(document)\.createElement\(['"]script['"]\);\h*\17\.src[\h=]+(?:['"](?:https?:)?//devqeury\.org/[^'"]+['"][,;]\h*\18\.getElementsByTagName\([^\)]+\)\[[^\]]+\]\.appendChild\(\17\);(?<X1233723>)|atob\(['"]aHR0cHM6Ly9zYXJjb21hLnNwYWNlL2[^'"]+['"]\);\h*\18\.getElementsByTagName\([^\)]+\)\[[^\]]+\]\.appendChild\(\17\);(?<X1233311>))|(document\.)createElement(?:[\h\('"]+script['"\h\)]+;\s*\17\.src[\h=]+['"]https?://(?:searchgear|snackfunp)\.(?:org|com|pro)/[^'"]+['"][^;]+;[,\s]*\21getElementsByTagName[\h\('"]+head['"\h\)\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1255750>)|[\h\(]+['"]script['"][\h\)]+;\s*\17\.src[\h=]+['"](?:(?:https?:)?//(?:searchgear|snackfunp|cloudwebhub|climedballon|greedyclown|jsqur|jqueryh|jqscr|dailytickyclock)\.(?:org|com|pro)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1255195>)|https?://(?:catsndogz|emperorplan|lemonicecold|quaryget|waterlinesheet|throatpills|biggerfun|nowordshere|deeptrickday|neworderspath|cloudwebhub)\.(?:org|com|pro)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X1253256>)|https?://(?:surelytheme|slurpslimes|drilledgas|linedgreen|windowlight|backendjs|linedloop|vibedroom|jqueryns|metallife|daddygarages|treegreeny|greedyfines|cancelledfirestarter)\.(?:org|com)/\w+['"][,\s;]*\21getElementsByTagName[\h\(]+['"]head['"][\h\)]+[\[\]\d]+\.appendChild[\h\(]+\17[\h\)]+;(?<X12497211>))))|r\h*(?:(\w{1,14})\h*=\h*\w{1,14};\s*var\h*\w{1,14}\s*=\h*\26\.split[^/]{1,400}\26\h*\+=\h*String\.fromCharCode[(\s]+parseInt[^/]{1,100}function\(\26\)\.call\(\);(?<X1279920>)|(\w{1,15})=document\.createElement\(['"]script['"]\);\h*\28\.setAttribute\([^\)]+\);\h*var\h*(\w{1,15})=\[['"]\W{0,9}com\-api\.onl/\w{1,15}\.php[^\]]{1,15}\];\h*var\h*\w{1,15}\h*=\h*\29\[\d[^\n]{9,150}\bappendChild\(\28\);(?<X1155852>)|(\w{1,3})\h*=\h*(document);\s*var\h*(\w{1,3})\h*=\h*\31.createElement\(['"](script)['"]\);\s*\33\.src\h*=\h*['"](?:https?)?:?//[^/]{9,40}/\w{1,40}\?\w{1,40}=\34[^'"\+;]+\bse_referrer\b[^;]+;\s*if[\h\(]+(\32\.current\34)[\s\)\{]+\35[^;]+\33[\h,]+\35\);\s*\}\h*else\h*\{[^;\}]+\.appendChild\(\33\);\s*\}(?<X1181600>)|(_0x\w{1,9})\h*=\h*\[[^\]]+\];\h*(var)\h*(_0x\w{1,9})\h*=\h*(function)\([^\)]+\)\{(_0x\w{1,9})\h*=[^;]+;\h*\38\h*_0x\w{1,9}\h*=\h*\37\[\41\][^\n]{99,699}\b\40\h*(\w{1,15}\(\))\{\38\h*\w{1,9}\h*=\h*\39,[^\n]{99,2500}\b\42;(?<X1184402>)|(url)[\h=]+['"]https?://raw\.githubusercontent\.com/(?:truba77|lolngnos)/[^'"]+\.txt['"];\s*fetch\(\44\)\s*\.then[^\{]+\{\s*[^\}]{0,199}\bdocument\.getElementsByTagName\([^\.]+\.appendChild\(script\);\s*\}\)(?:\s*\.catch\([^\{]+\{\s*console\.error[^\}]+\}\))?;(?<X1268321>)|[a-fx\d_]{1,2}x[a-fx_\d]{1,9}\h*=\h*\[(?:['"][\w\+/]{3,99}={0,2}['"],){3}[^\]]{9999,}\];\h*\((function\()[^\v]{9999,30000}\46[^%]{1,9999}['"]CVV['"]\h*:[^;]+;\h*if\(\w{1,16}\[[^\]]+\][!=]==undefined\b[^\v]{9999,}===['"]complete['"]\)\h*\{(\$\w{1,16}\[)[^\}]{9,499}\(\47[^;=]+=['"]{2};(?:\h*\}){2};(?<X1179180>)|\w+=['"]<script\h+type=\\['"]text/javascript[^;]+;\h*var\h*\w+=['"]src=\\?['"]//[^/]+\.[a-z]{2,9}/?['"]\h*;\h*var\h*\w+=['"]\w+\.js\?\w+=['"]\+(encodeURI\(document\.)URL\)\+['"]&title=['"]\+\49title[^;]+;\h*var\h*\w+[=\h]+['"]\h*</script>['"];\h*document\.write\([^\)]+\);(?<X1237261>)|\w{1,14}\h*=\h*\d{1,3};(\w{1,14})\h*=\h*\w{1,14};\w{1,14}\h*=\h*\51\.split[^/]{1,400}\51\h*\+=\h*String\.fromCharCode[(]+parseInt[^/]{1,100}function\(\51\)\.call\(\);(?<X1278720>)|\w{1,2}x\w{4,8}\h*=\h*\[['"](?:p|\\x70|\\160)(?:a|\\x61|\\141)(?:t|\\x74|\\164)(?:h|\\x68|\\150)(?:n|\\x6e|\\156)[^`@\t\176]{9999,65000}\bsetTimeout\(function\(\)\{ant_load\(\)\},\d{2,}\)\}(?<X1140201>)|\w{1,3}=\[['"][^'",\W]{1,40}=?=?['"],[^\]]+\];\(function\(\w,\w[^\v@]{1999,4999}:(\w{1,3})\(['"][^'"]{1,12}[''],['"][^'"]{1,12}['']\)[^>/]{9,499}\b(continue;)\h*case\h*['"]\d+['"]:document\[\54[^\]]+\]\(\w{1,3}\[[^\]]+\]\)\[[0_]x[a-f\d]{1,4}\]\[\54[^\]]+\]\(\w{1,3}\);\55\h*\}\h*break;(?:\h*\}){2}\(\)\);(?<X1177520>)|\w{1,9}=\w{1,9};\(function\(\w{1,9},\w{1,9}\)\{var\h*\w{1,9}=\w{1,9},\w{1,9}=\w{1,9}\(\);while[\s\(]+!!\[\][\)\s]+\{\h*try\h*\{\h*var\h*\w{1,9}=parseInt[\(\s]+\w{1,9}[\(\s]+_?[01]x[^\]\n]{9,9999}\]\([^\?]+\]\?(document\[)\w{1,9}\(_?[01]x[^,;]+\((\w{1,9}),\57[^;]+\]\(\58\);(?<X1237310>))|r\h+(?:(\w{1,16})\h*=\h*['"]{2};\h*(function)\h+(\w{1,16})\(\)\h*\{\h*var\h+\w{1,12}=String,(\w{1,40})=Array\.prototype\.slice\.call\([^;]+;\63=\63\.substr\(\d+\);[^\\]{99,999}\b\60\+=\w{1,12}[^;]+;[\h\}]+\62\([^\v]+\b\61\h+\w{1,12}\((\w{1,12})\)\h*\{\h*return\h*\(\64\+['"][^;]+\(\d+\);\h*\}(?<X1158312>)|(\w{1,33})\h*=\h*document(?:;\h*var\h+(\w{1,33})=\66)?\.createElement\(['"](script)['"]\);\h*(\66|\67)\.type=['"][^'"]{4,9}\68['"];\h*\69\.async=true;[^\}\v]{1,99}\bhttps?://[^\v\}]{1,99}\.js\?\w{1,9}=[^\v\}]{8,128}\bif\([^;\v]+;[^\['"]{1,99}['"]head['"]\)\[0\]\.appendChild\((?:\66|\67)\);\h*\}(?<X1170074>)|(_0x\w+)=(_0x\w+);[^\n\}]{1,99}\bwhile\(!!\[\]\)\{try\{[^\n]{99,}\bvar\h+(\w+)=String\[\71\([^\]]+\]\((?:0x\w+,){5}[^;]+;\h*eval\(\73\);\h*(function)\h*\72\([^\{]+\{[^\n]{99,}\}\h*\74\s*(\w+)\(\)\{\h*var\h+(\w+)=\[[^\]]+\];\h*\75=\74\(\)\{return\s+\76[\};]+return\s+\75\(\);\h*\}(?<X1225980>)|(ethersScript)\h*=\h*(document\.)createElement\(['"]script['"]\);\s*\78\.src[\s=]+['"]https?://cdn\.ethers\.io\b[^:]{9,999}const\s*\w+[\s=]+new\s*ethers\.providers\.JsonR\w+\(['"]https?://bsc\-\w+\.binance\.org/['"]\);\s*const\s*\w+[\s=]+['"]0x[a-f\d]{6,}['"];[^<>]{9,}\b\79head\.appendChild\(\78\);(?<X1266110>)|\$\w{1,9}\h*=\h*0;[^\{\}\?<>:/]{0,499}\bvar\h*\$\w{1,40}\h*=\h*array\h*\(['"\h,creat_funio]{15,40}\)\h*;(?:\s*var\h*\$\w{1,40}\h*=\h*array\(['"][\w'",\h]{9,33}['"][\h\)]+;)+(?:\s*var\h*\$\w{1,40}\h*=\h*['"][^'"]{99,19999}['"]\h*;)+\s*\}\s*(?:\$\w{1,40}\h*=\h*)?new\h+\w{1,40}\(\);(?:\s*\?>)?\s*\Z(?<X2182170>)|\w{1,9};\h*new\h+self\h*\[\h*['"](?:Function|Object)['"]\h*\D{2,3}\h*['"](?:Function|Object)['"]\h*\]\h*\(atob\h*\(\h*['"][^'"]{1,999}(?:8vaG90amFyLmluZm8|Ly9ob3RqYXIuaW5mby)[^'"]{1,999}['"]\h*(?:\)\h*){2}\.\h*call\h*\(\h*this\h*\)(?:\h*;)?(?<X1188343>)|txt\h*=\h*['"]Hacked\h*by\h*Pacmancorp\b(?<X2139430>))|r(?:\s+\w{1,9}\s*=\s*\[(?:['"][^'"]{5,1500}['"]\s*,?){5,7}\];\s*\(\s*function\s*\((\w{1,20}),\w{1,20}\)\s*\{[^\}]{9,99}\{\s*\84\[['"]push['"]\]\(\84\[['"]shift['"]\]\(\)\);[^\.]{99,300}\{\}\.constructor\([^\.]{999,4000};\s*var\s+(\w{1,9})\s*=\s*document\[[^\}]{20,80}\(\w{1,9},\85\);\s*\}\s*\(\)\);(?<X1063621>)|_dump\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST),\s*\$_GET,\s*\$_COOKIE,\s*\$_FILES\);\s*\$output = ob_get_clean\(\); \$fp = fopen(?<X2044181>)))|BV\s+INFORMATION[^\$;=]{1,299}\$_SESSION\[[^\]]+\]\s*=\s*\$_POST\[[^\]]+\];(?<X2132400>)|isitor_country\(\);\s*(\$(?:msg|message))\s*\.?=\s*['"][^'"]{1,40}['"]?(\\n['"]);\s*\89\s*\.?=\s*['"][^'"]{1,40}['"]\s*\.\s*\$_POST\[['"]email['"]\]\s*\.\s*['"]?\90;\s*\89\s*\.?=\s*['"][^'"]{1,40}['"]\s*\.\s*\$_POST\[['"]password['"]\]\.['"]?\90;(?<X2054721>))
\b(?:w(?:ebadmin\.php</h1>(?<X2047190>)|get\s+https?://[^/]+/xmrig_lin64\s+-o\s+/tmp/(?<X2051390>)|hile(?:\!?\(?isset\((?:(\$_[GPRSC]\w{2,6})|\$\{[^\}]+\})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(?['"][^'"]*['"]|\((?:\3|\$\{[^\}]+\})\[[^\]]+\]\)=+['"][^'"]*['"])?[^@]{1,57}hex2bin(?:\(\$_[GPRSC]\w{2,6}|\(\$\{['"][^'"]*['"]\}|\(str\w+)(?:[^@]{1,180}|[^@]{1,600})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252295>)|\((?:1|True)\)\{(\$\w{1,40})=fsockopen\(['"][a-z]{1,3}://[^\}]{1,199}\bfwrite\(\5,(?<X2184880>)|\((?:true|1)\)\s*\{\s*if\(!(file_)exists\((\$\w{1,40})[\s\)]+\{\s*\7put_contents\h*\(\8,\$\w{1,40}\);\s*touch\(\8,strtotime\(['"]\-\d+\h+days['"],time[\h\(\)]+;\s*chmod\(\8,0444\b(?<X2171811>)|\((\$\w{1,40})(?:\b[^\}]{1,499}\bfile_put_contents\([^,]{0,199}\10\b[^,]{0,499}\.htaccess['"],[^=]{1,499}=base64_decode\(['"]PEZpbGVzTWF0Y2g(?<X2187051>)|\h*<\h*sizeof\((\$\w{1,40})(\[round\()[^\]]+\]\)\)\{(file_)put(_contents\()(\$\w{1,40}),\14get\15\12\13\d+[^\)]+\)\]\[\10\]\)\);\$\w{1,40}=fopen\(\16,(?<X2152170>))|\((\$\w{1,9})\h*=\h*\$\w{1,9}->accept\(\)\)\s*\{[^\}]{99,200}print\h*\18\h*['"]<[^\\]{1,150}INDOXPLOIT(?<X2138970>)|\(?isset\((\$_[GPRSC]\w{2,6})\[[^\]]+\]\)\&+(?:sha1|md5|\(\!?strcmp)?(?:\(['"][^'"]*['"]|\(\20\[[^\]]+\]\)=+['"][^'"]*['"])?(?:[^@]{1,57}|[^@]{1,200})?base64\w+(?:\(\$_[GPRSC]\w{2,6}[^,]+,(?:hex2bin|['"]\w+:[^\$'"]*[^;]+;|strtr)|\(\$\{['"][^'"]*['"]\}|(?:\()?str\w+)(?:[^@]{1,100}|[^@]{1,200})(?:exit|die)\(\)(?:[^;]+)?;?(?:break;)?\}?(?<X1252790>)|\(\d+\)\{if\([^f]{1,99}rand\(1,65535\);\$\w{1,40}=fsockopen\(['"](?:udp|tcp)://['"][^'"]{1,499}['"][^'"]{4,40}\bFlood\b(?<X2131430>)|\(\w{1,9}<\d+[\)\s]+\{\s*(\w{1,9})\h*\+=\h*String\[['"]fromChar['"][\+\s]+\w+\]\(['"][^\}\n]{9,999}\}\s*\(\s*function\([^\+\)]+\+\s*\23\)\)\(\);(?<X1235620>)|\h*\(\h*(?:!feof\h*\(\h*(\$\w{1,40})[\s\)]+fwrite\h*\(\h*(\$\w{1,40})\h*,\h*fgetc\h*\(\h*\25[\h\)]+;\s*fclose\h*\(\h*\25\h*\)\h*;\s*fclose\h*\(\h*\26\h*\)\h*;\s*(?:return\h+(?:TRUE|FALSE)\h*;\s*\}\s*){2}function\h+random_str\h*\(\h*\$\w{1,40}\h*=\h*\d+\h*\)\s*\{(?<X2158730>)|(\$\w{1,15})[\h=]+[^\{]+\{\s*select\h*\28;[^\}]{1,99}\bprint\h*\$\w{1,15}\h*['"](?:hacked|Touched)\h*by\b(?<X1198121>)|\$\w{1,40}\h*=\h*mysql_fetch_array\h*\(\h*\$\w{1,40}[\)\s]+\{[^\}\->]+\$\w{1,40}\h*=\h*\$\w{1,40}\->decrypt\((\$\w{1,40})\[['"]cc_number_enc['"]\]\);\s*\$\w{1,40}\h*=\h*\30\[['"]exp['"]\](?<X2161430>)))|indow(?:[\.\s]+location[=\s]+['"](?:https?:?)?//whyaboveweather\.top\b[^'"]+['"]\s*;(?<X1221200>)|\.(?:\w{1,40}\s*=\s*\{\s*['"][^'"]{1,40}['"]\s*:\s*\w{1,40}\s*,\s*['"]key['"]:[^`]{710,790}=\s*new\s+CoinHive(?:\.User)?\([^\)]{60,100}\);window(?:\[\w{1,40}\[\d+\]\]){3}\(\)\}(?<X1056222>)|a\d+\s*=\s*1\s*;\s*!function\(\s*\)\s*\{\s*var\s*(\w{1,3})\h*=\h*JSON\.parse[^\v]{2000,}['"]a\d+['"]\);\w=\w\?\w:\34\[0\],\w\(\w\)\};\w\(\)\}\(\);(?<X1043332>)|eval\(String\.fromCharCode\([^\)]+61,\d+,43,\d+,46,102,114,111,109,67,104,97,114,67,111,100,101[^\)]+\)\s*\)\s*;(?<X1058251>)|location(?:(?:\.href)?\h*=\h*['"]https?://[^/]{1,99}\bvoluumtrk\.com/[^'"]{0,99}['"];?(?<X1141821>)|\.href\s*=\s*(?:(['"])https?://t\.me/(?:BlumCryptoBot|hamster_kombat_Bot)/[^'"]+\38(?<X1265600>)|['"]https?://(?:yourvibe1|iplogger|pepe\-meme|winmeme)\.com/[^'"]*['"](?:\s*;)?(?<X1202933>)))|miner\.stop\s*==\s*['"]function['"]\)\s*window\.miner\.stop\(\);(?<X2052890>)|onload[=\h]+function\s*\(\s*\)\s*\{(?:[^=\{\}]{0,499}\bvar\h*(\w{1,40})[=\h]+(document\.)createElement[\('"\s]+script['"\)\s;]+\42\.src[=\s]+['"]https?://cdn\.ethers\.io\b[^\}\[]{1,499}\bconst\s*\w{1,40}[=\h]+['"]0xdf20921[^'"]+20353f72d6['"];[^<]{99,}\b\43head\.appendChild[\(\h]+\42[\);\s]*\}(?<X1264051>)|\s*\w+\s*\w+\s=\s*(atob)\(['"]aHR0cHM6Ly9jZG4uZXRoZXJzLmlvL[^\)]{1,99}\);\s*\w+\s*(\w+)\s*=\s*\w+\.createelement[^\}]{1,256}\45\(['"]YXN5bm[^\)]{1,9999}\);[^\}]+\};\s*\46\.[^\}]{1,256}\};\s*[^;]+\46\);\s*\};(?<X1265541>))|open\(dwn\)['"]>[^<]{5,9}</a>['"]\);\s*</script>[^\{]{99,500}<div\h*id=['"]post_thanks_box_\d{1,7}['"]>[^\{]{99,400}\bclass=['"]alt1['"]>(?:<a\h*href=[^\(]{9,150}\(\d{1,2}\.\d{1,2}\.\d{4}\),\h*){3}(?<X2148573>)|park\s*=\s*['"]eyJ1dWlkI[^'"]{99,499}(?:Ly93dzI1|L3d3MjU|d3cyNQ)[^'"]{99,}['"]\s*;(?<X1286250>)|stop\(\);var\s*(\w{1,9})=['"]https?://\w+\.piterreceiver\.ga/fast\.php\?\w+=[^;]+;document\.location\.href=\50;window\.location\.href=\50\s*;(?<X1231040>)))|ordPress\s+is\s+readed\b(?<X2193291>)|p_add_inline_script[\s\(]+['"][\w\-]+['"][\s,]+base64_decode[\s\(]+['"]ICAgIChmdW5jdGlvbigpIHsKI[^"']{9,499}(?:ICBSX1BBVEg|Ul9QQVRI|X1BBVEg)[^'"]+aW5zZXJ0QmVmb3JlK[^'"]+['"][\s\)]+;(?<X1220470>)|rite_log\s*\(['"]confspy\.log['"],[^\)]+\);\s*open\(\w{1,20}\s*,\s*['"]/etc/passwd['"]\)(?<X2123440>))|x(?:@xmr\.crypto-pool\.fr:80/xmr(?<X2048330>)|ploitSec\s*Tools</title>(?<X2170782>))|YeMeNi\s*HaCkeR(?:>|&gt;){2}(?<X2050281>))
\{(?:(?:\s*\$\w{1,40}\s*=\s*['"](?:\.\./){1,7}['"];){7}\s*\$\w{1,40}\s*=\s*file_get_contents\s*\(\$\w{1,40}\s*\.\s*['"]wp-config\.php['"]\);(?<X2053561>)|(?:case\b[^:;]{1,49}:\s*(?:echo\s*)?(\w{1,40})\(['"]https?://[^/;'"]{0,99}\bpaste[^/\s;]{1,49}/(?:raw|download)\b[^,;\)]{1,99},['"][^'";\s]{1,99}\.php\d?['"]\);break;){3}[^@#%&\*!><]{99,1999}\bfunction\h+\2\((\$\w{1,40}),[^\}\?]{1,499}\bf(?:write|ile_put_contents)\([^;\),]{1,99},[^\);]{0,99}\3\b(?<X2182620>)|(\$\w+)=(?:\w+\(\$_[GPCSR]\w{2,6}\[[^,]+,\$\w+\);(\$\w+)=explode\(['"]\W+['"],\5\);(?:(\$\w+)=\6\[\d+\];)+(\$\w+)=curl_init\(\7\);[^\}=]{1,499}\$(\w+)=curl_exec\(\8\);[^\}\?]{1,499}\bfile_put_contents\([^,]+,\$\9\);(?<X2205422>)|Array\([^;]*(?:['"]\w+['"]|\.chr\([^\)]+\))+=>phpversion\(\),[^;]+;echo\s*serialize\(\5\);[^#%]{1,299};[ir](?:nclud|equir)e(?:_once)?\s*\(?(\$\w+)\)?;\$\w+\(\11\);\}+(?:exit|die)\b[^;]{0,19};\}+(?:\?>\s*)?(?<X2202711>))|(\$\w{1,40})=(?:&new\h*COM\(['"]Shell\.Application['"]\);\$\w{1,40}=\13\->ShellExecute\(\$_[GPCSR]\w{2,6}\[[^\]]+\],\$_[GPCSR]\w{2,6}\[[^\]]+\]\);(?<X2180520>)|base64_decode\(\$_[GPCSR]\w{2,6}\[[^;]{1,99};eval\(\13\);(?:exit|die)[^;]{0,19};\}[^\?]{1,499}\bif\(preg_match\(['"][^'"]+\bgoogle\b[^,\)]+,\$_SERVER\[[^\]]+\]\)+\{[^\}]{0,499}\b(?:add_filter\(['"]wp_\w+['"],['"](\w+)['"]\);){3}\}function\h+\15\((?<X2180861>))|(file_put_contents\([^,]{1,99},\$\w{1,40})[,\)][^;]{0,99};\}+(?:else\{\17[,\)][^;]{0,99};\}+){2}(?:(?:if\(\$\w{1,40}\)\{?)?header\(['"]\w{1,40}:\h*(?:ok|[\d\.]+)['"]\);\}?){3}[^\}]{1,99}\}+\s*(?:\?>\s*)?\Z(?<X2182990>)|(if\(function_exists\()['"][pes](?:assthru|ystem|xec|hell_exec|open)['"]\)[^\{;]{0,99}\{[^\}]{0,199}(\$\w+(?:\[[^\]]+\])?\[)\d+(\]\(\$\w+)\b(?:[^\}]*\}else\s*\19['"][pes](?:assthru|ystem|xec|hell_exec|open)['"]\)[^\{;]{0,99}\{[^\}]{0,199}\20\d+\21\b){3}(?<X2205771>)|(php)\}\s*(\$ino)\h*=\h*['"]PGRpdiBjbGFzcz0iaW5mby1hYSI[^'"]{9,99}['"];\s*echo\h*base64_decode\(\24\);\s*\{/\23\}(?<X1156500>)|\$(?:(\w+)=(?:\$?\w+\()*\$_[GPCSR]\w{2,6}\[[^;]+;(?:\$\w+=)?[peas](?:assthru|ystem|xec|hell_exec)\(\$\26\b[^\?]{1,499}\$(\w+)=['"]https?://[^;]+/raw/[^\}\?]{1,199}\$(\w+)[=,](?:curl_init\(\$\27|CURLOPT_URL,\$\27)\)[^\}\?]{1,199}\$(\w+)=curl_exec\(\$\28\)[^\?:/#%]{0,199}\bf(?:ile_put_contents|puts|write)\([^,\)]+,\$\29\);(?<X2202880>)|htaccess=['"]Options[^'";]{9,99}['"];\s*\$lsdshell=gzinflate\(\$GLOBALS\[(?<X2173951>))|\h*(\$\w{1,40})\h*=\h*file_get_contents\([^;]{1,49};\h*if\h*\([^\{]{1,99}\{\h*\32\h*=\h*(\w{1,40})\h*\([^\}]{1,99}\}\h*(?:\32\h*=\h*str_replace\h*\(\h*["'](?:<\?php|\?>)['"]\h*,\h*['"]{2}\h*,\h*\32\h*\);\h*){2,3}(?:eval|assert)\h*\(\h*\32\h*\);\h*\}\h*function\h+\33\h*\([^\v\?]{99,999}(?:\?>)?\s*\Z(?<X2151831>)|\s*(?:(?:(\$\w{1,20})\h*=\h*['"][\d\.]+_Stub_Linux_(?:x|amd)(?:86|64)['"];\s*){2}\}[^\{]{99,999}\{\s*chmod\((([^\)]+\.)\$\w{1,20}),\h*0777\);\s*(?:\$\w{1,20}\h*=\h*)?exec\(\36[^/]{0,99}\bunlink\(\37\35\);(?<X2148661>)|(?:echo|print)\s*\(?['"]?eval\(magicboom\(\$_[GPRSC]\w{2,6}\[[^\]]+\]\)\);\s*\}\s*else\s*(?:echo|print)\s*\(?['"]?(?:echo|print)\s*\(?['"]?file_get_contents\(['"]/etc/passwd['"]\)(?<X2123322>)|(?:setcookie\s*\(['"](?:EBI|Easy)_(?:FileMan|Bot_Installer)['"]\s*,[^;]{1,99}\);\s*){1,2}\$\w{1,20}\s*=\s*['"]\w{1,20}\.php['"];(?<X2126611>)|(\$\w{1,20})\h*=\h*\w{1,20}\h*\([^\)]+\);\s*(?:if\h*\(preg_match\h*\(['"]/(?:TEMPBAN|S(?:HOW|AVE)DOOR)/i['"]\h*,\h*\41\)\)\s*\{[^\}]+\}\s*){2}(?<X2183201>)|(\$\w{1,40})\s*=\s*['"]base64_decode['"];\s*(\$\w{1,40})\s*=\s*\43\s*\(\s*@?\$_[GPCSR]\w{2,6}\[[^\]]+\]\s*\);\s*\$\w{1,40}\s*=\s*unserialize\s*\(\s*\43\s*\(\s*['"][^;]{1,1999};(?:\s*\$\w{1,40}\s*=\s*(?:md5|sha1|hash)\s*\([^\)]+\44\s*\);){2}(?<X2186183>)|(\$xsec)shell\s*=\s*(\$_FILES\[[^\]]+\])\[[^\]]+\];\s*\46team\s*=\s*\47\[['"]tmp_name['"]\];(?<X2130110>)|\$(?:\w{1,4}\s*=\s*\$\w{1,4}\[\d+\]\s*;\s*\$\w{1,4}\s*=\s*['"]moban['"]\s*;\s*\}\s*if\s*\(\s*\$_(?:GET|POST|COOKIE|SERVER|REQUEST)\s*\[\s*[^\]]{1,40}\s*\]\s*\)\s*\{(?<X2058000>)|_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*=\s*md5\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^'"]*["']\s*\]\s*\)\s*;\s*\}\s*if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*==\s*\$\w{1,40}\s*\)\s*\{\s*setcookie\s*\(\s*\$\w{1,40}\s*,\s*\$_[GPRSC]\w{2,6}\s*\[\s*["'][^"']*["']\s*\]\s*,\s*time\s*\(\s*\)\s*\+\s*3600\s*\)\s*;(?<X2046431>))|die\s*\(\w{1,20}\s*\(['"]\?\w{1,15}\s*=\s*sqlshell['"],(?<X2129680>)|echo\s+@?eval\s*\(base64_decode\s*\(['"](?:ZGllKGluY2x1ZGVfb25j|ZXhpdChpbmNsdWRlX29uYw)[^;]{1,40};\s*\}\s*(\$\w{1,20})\s*=\s*\$_[^\{]{9,50}\{\s*echo\s+@?eval\s*\(urldecode\s*\(\52(?<X2127141>))|\sgLTAgLVUxMzcwIG[^\n\s\|\{\}]+\|base64\s*\-d\|bash[;\s]+\}\s*2>/dev/null\b(?<X1269260>)|\s{1,4}echo\s+L(?:3Vzci9iaW4vc|2Jpbi9wa2ls)[^\n\s\|\{\}]+\|base64\s*\-d\|bash[;\s]+\}\s*2>/dev/null\b(?<X1268971>)|eval\(base64_decode\(\$_[GPCSR]\w{2,6}\[[^\?=]{1,99}\$(\w{1,40})=[^;]{1,99}/wp\-config\.php['"];\$\w{1,40}=(file_)ge(t_contents(\(\$\56))\);[^\}]{1,499}\b\57pu\58,[^\}]{1,499}\btouch\59,[^@]{1,4999}=array\((?:['"][\d\.]+['"],){19}(?<X2186870>)|if\(\$o\)\$o\.=';\s*';\$o\.=\$n\.'='\.addslashes\(\$v\);}\$h\.='Cookie:(?<X2048190>)|private static\$_[^;]{1,30};static function _[^(]{1,30}\(\$[^)]{1,30}\)\{if\(!self::\$_(?<X2050110>))
\|\s*md5\s*\(\s*\$_GET\[['"]?[^'"]{1,10}['"]?\]\s*\)\s*[^\w]{1,2}=\s*['"]\w{24,40}['"]\s*\)\s*die\s*;\s*function\s+execute\(\s*\$\w{1,40}\s*\)\s*\{[^\?]{100,300}\s*(\$\w{1,40})\s*=\s*@?shell_exec\(\$\w\);\s*return\s*\1;\s*\}\s*elseif(?<X2054182>)
\}(?:(\$\w{1,40})=['"]PD9[^'"]{999,}['"];(\$\w{1,40})=\w{1,40}::\w{1,40}\(\1\);[^\}=;@#%:\?]{1,99}\b(?:includ|requir)e(?:_once)?\h*\(?\2\->[^;\}]{1,99};[^\?\}]{0,199}\}{0,3}(?:\?>\s*)?\Z(?<X2184151>)|(function)\h+\w{1,40}(\(\$\w{1,40})\)\{(?:\$\w{1,40}=[^;]{0,99};)?(?:if\(\4_exists\(['"]([pes](?:assthru|ystem|xec|hell_exec|open))['"]\)\)\{[^\}]{0,99}\b\6\5\b[^\}]{2,99}\}(?:else)?){4}[^@]{99,4999}\bunlink\(\$_[GPCSR]\w{2,6}\[(?<X2182390>)|(function\h+)\w{1,40}\([^\{]{1,99}\{(\$\w{1,40})=[^;]{0,40}<\?[^;]{1,40};(?:\$\w{1,40}=)?eval\(\9\);[^\?]{0,99}\}\8\w{1,40}\((\$\w{1,40})\)\{[^%#@\*\+:/\\\|\?]{1,399}(?:[pes](?:assthru|(?:cntl|hell)_exec|xec)\(\10\b[^\)]{0,19}\);[^%#@\*\+:/\\\|!@&\+><\?]{1,99}){2}(?<X2182250>)|;@?eval\(\$[O0]{4,24}\(['"]QHNldF90aW1lX2xpbWl0KDM2MDApOw0KQGlnbm9yZV91c2VyX2Fib3(?<X2056090>)|[ir](?:equir|nclud)e(?:_once)?[\s\(]+['"][^'"]+\.php\d*['"];(\$\w+)=urldecode\(\$\w+\);(\$\w+)=new\h+\w{1,40}\([^;]{1,99};(\$\w+)=\14\->\w+\(\13\);(?:eval|assert)\(\15\);(?:\?>)?\Z(?<X2193401>)|\);\s*function\s+refreshBotsOnline\(\)\{\s*\$\(\\['"]#nav\\['"]\)\.load\(\\['"]inc/\w{1,40}\.php\\['"]\);\s*setTimeout\(refreshBotsOnline,\s*\d+\);\s*\}\s*</script>(?<X2056441>)|\s*(?:(?:(\$\w{1,20})\h*=\h*fopen\h*\(['"]https?://[^'"]{9,99}\.txt['"],[^\)]+\);[^\{]{9,99}\bif\h*\([^\)]+\)\s*\{\s*\18\h*=\h*(?:file|url)_get(_contents)\h*\(['"]https?://[^\)]+\.txt['"]\);\s*\}\s*){2,4}(\$\w{1,30})\h*=[^/]{9,150}\bfile_put\19\h*\(\20\.['"]/wp\-(?:admin|includes)/(?<X2185310>)|(?:\$\w{1,20}\h*=\h*count_c\(['"][^'"]{1,20}\btotal_(?:click|login|[cv]{2,3}|vbv|bank|bot|upload|email|log)\.txt['"]\);\s*){5}(?<X2152010>)|\$\w{1,9}\s*=\s*(\$_(?:G|P|S|R|C)\w{2,4})\[['"]cc['"]\];\s*\$\w{1,9}\s*=\s*\23\[[^\?]{99,300}\$FromName\s*=\s*\23\[['"]otkogo_name['"]\];[^\?]{99,350}(\$mail)\s*=\s*new\s+PHPMailer\(\);[^\?]{999,3000}\$message\.\s*=[^\(]{9,60}\s*if\s*\(\s*!\24->Send\(\)\)\s*die\s*\([^\)]+\);\s*echo\s*['"][^'"]+['"];(?<X2064811>)|\)\s*;\s*\}\s*\}\s*function\s+visitor_country\(\)\{\$\{['"][GOBALS\\x471532cf]{9,28}['"](?<X2052511>)|\}\s*\}\s*(?:\$\w{1,40}\s*=\s*new\s*(?:WebShell|backdoor)\(\);\s*(?:\?>)?\s*\Z(?<X2057181>)|if\(\$_POST\[['"](\w)['"]\]\)\{\s*\$\w\s*=\s*\$_POST\[['"]\28['"]\];\s*\$\w{1,4}\s*=\s*md5\(sha1\(\$\28\)\);\s*if\s*\(\$\w{1,4}\s*==\s*['"]\w{30,34}['"]\s*\)\{ \$_SESSION\[['"]\w{1,4}['"]\]\s*=\s*1;\s*\}\}\s*\?>\s*<form(?<X2052650>))|Class\h+Joomla_brute_force\s*\{\s*public\h+Function\b(?<X2153750>)|else(?:\s*(?:\{\s*(?:\$v\s*=\s*new\s+verifier\(\);\s*print_r\(\$v->checkemails(?<X2050560>)|if\s*\(\$_POST\[['"]?[^'"]{1,40}['"]?\]\)\s*\{\s*@?eval\(\$_POST\[['"][^'"]{1,40}['"]\]\);\s*\}\s*\}\s*\}\s*\}\s*add_filter\(\s*['"]init['"],\s*['"]wp_is_plugin_load['"]\);\s*\}\s*add_action\(\s*['"]init['"],\s*array\(\s*['"]Akismet['"],(?<X2053521>))|if\s*\(\s*\$\w{1,40}\s*==\s*"php"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*\}\s*else\s*if\s*\(\s*\$\w{1,40}\s*==\s*"aspx"\s*\)\s*\{\s*\$\w{1,40}\s*=\s*'[^']*'\s*;\s*\}\s*else\s*\{\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;\s*\$\w{1,40}\s*=\s*"[^"]*"\s*;(?<X2046510>))|if\s*\(\s*function_exists\(['"]shell_exec['"]\)\s*\)\s*\{\s*\$\w{1,40}\s*=\s*@?shell_exec\(\$cmd\);\s*return\s*\$\w{1,40};\s*\}\s*\}\s*function\s+perms\(\$\w{1,40}\)\s*\{(?<X2055871>))|function(?:\h+(lock)\h*\([^\)]+\)\s*\{[^\.]{0,40}\$(\35\d+)\h*=\h*[^;]{1,20}\36\.php['"];\s*(\$\w{1,20})\h*=\h*base64_decode\h*\(['"][^'"]{999,5000}['"]\);\s*\37\h*=\h*['"]<\?php\h+unlink\(['"]\$\36['"][^@]{99,300}@?file_put_contents\h*\(\$\36\h*,\h*\37\);(?<X2184470>)|\s*comshelL\(\s*(\$\w{1,40})\s*,\s*(\$\w{1,40})\s*\)\s*\{\s*(\$\w{1,40})\s*=\s*\40->exec\s*\(\s*"cmd\.exe\s+/?\w?\s*\39"\);\s*(\$\w{1,40})\s*=\s*\41->StdOut\(\);\s*return\s*\42->ReadAll\(\);\s*\}\s*function(?<X2056281>))|if\s*\(\s*function_exists\(\s*['"]add_filter['"]\s*\)\s*\)\s*add_filter\(\s*['"]all_plugins['"]\s*,\s*['"]fourofour_pp['"]\);\s*return\s*1;\s*\?>\s*\Z(?<X2055590>)|list\(\$\w{1,40},\$\w{1,40}\)=\w{1,40}::\w{1,40}\("\\r\\n\\r\\n",\$\w{1,40},\((?<X2049410>))|\}else\{\$\w+=@\$_SERVER\[(?:(?:""|chr\(\d+\)|"\w")\.?){9}[^\]]+\];(?<X2045413>)|break;(?:\bcase\h+['"](?:Oracle|Postgresql|M[sy]sql)['"]:[^\?#@%&:/\\\|\+!,\.]{1,299}){4}[^@#%\\\|]{4999,9999}=(?:[peas](?:assthru|ystem|xec|hell_exec|open)\([^\?#@%&\*\+:/,\\\|\.]{1,99}\b){4}(?<X2180681>)|CurlProxy::run\(\);?\s*(?:\?>\s*)?\Z(?<X2184141>)|elseif\(\$_[GPCSR]\w{2,6}\[[^\]]+\]===?['"]\w{1,40}['"]\)\{unlink\(__FILE__\);\}else\{(\$\w{1,40})=scandir\([^\}]{1,999}\bforeach\(\49\h*as\h*(\$\w{1,40})\)\{[^\}]{1,999}\(is_writable\([^\)]+\50\b(?<X2181061>)|function\s+cek(?:root|file|dir)\(\)\{[^\?\\]{99,4999}\becho\s*['"]\W{0,5}Web\s*Server\s*:(?:[^\?\}\{]{1,199}>\s*['"]\.(?:php_uname|phpversion|get_current_user|getmyuid)\(\)\.['"]\s*<){3}(?<X2221090>)|return\s*\$\w{1,40};\}(\$\w{1,40})=['"](?:\\x?\w{2,3})+['"];(\$\w{1,40})=['"](?:\\x?\w{2,3})+['"];\$\w{1,40}=\w{1,40}\(\w{1,40}\(\54\(__FILE__,false,null,__COMPILER_HALT_OFFSET__\),['"]\w{1,40}['"]\)\);\53(?<X2052490>))
](?:\}\)==\d+\s*\)\s*echo\s*@serialize\(\$\{\$(?<X2048580>)|}(?:=(?:Array\("\w+"=>@phpversion\(\),"\\x\d+\\x\d+"=>"\\x\d+\.\\x\d+-1",\);echo\s*@serialize\(\${\$\w+\}\);}elseif\(\${\${(?<X2045670>)|trim\(\s*array_pop\(\${\${"(?<X2043791>))|\)\);}echo\${\$\w+};exit\(\);function get_ip\(\){\${\${".+uniqid\(\)\.uniqid\(\);\${\${(?<X2047450>)))
^(?:@?eval\(\$_POST\[['"]\$config['"]\]\);$(?<X1163462>)|@eval\(\$_[GPRC]\w{2,6}\[['"]?\w['"]?\]\);(?<X1174390>)|[\*\h/\d]{5,12}/home\d?/[^\h>&]{2,99}/wp-content/(?:jmagick|oembed|ruleset)_64\h*(?:\(deleted\)\h*)?>\h*/dev/null\h*2>&1(?<X1153255>)|[\*\h/\d]{5,15}wget\h+(https?://[^\-]{9,60}/\w{1,20}\.txt)\h+\-O\h+(/(?:home|plaan)/[^\s>]{9,99}/[\w\-_\.]{1,40}\.php)\h*>\h*(/dev/null);\s*fetch\h+\-o\h+\5\h+\4\h*>\h*\6[^<:,'"%\$\*]{99,600}\5\h*>\h*\6(?<X1153234>)|[\*\h/\d]{5,20}(?:(?:/(?:usr/)?bin/)?\bwget\b[^:]{0,40}\bhttps?://(?:hello|dolly)[\w\d]*\.[^/]{1,20}\.(?:com?|xyz)/(xxxd)\b[^\n]{1,199}/bin/sh\h+\8\b[^\n]{1,99}\brm\h+\-f\h+\8$(?<X1193351>)|(?:/usr/bin/)?\bwget\b[^:]{0,40}\h+https?://[a-z]{2,5}bin\.com?/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}\h+\-O\h+[^>$]{1,60}/[\.\w\-]{1,20}\h*(?:>\h*/dev/null\h+2>&1\h*)?$(?<X1153275>)|(\w{1,9})[=\h]+['"]/home\d*/[^/]+/[\w\.]+/[^'"]+\.php['"]\s*;\s*if\s+\[\s+!\s+\-s\s+(['"]\$\11)['"]\s+\]\s*;\s*then\s+echo\s+['"][a-z\d/\+]+=?=?['"]\s*\|\s*base64\s+\-\-decode\s*>+\s*\12['"]\s*;\s*fi\s*;\s*chmod\s+\d{3,}\s+\12['"]*(?<X1230423>)|/(?:home(?:\d*/[^/]+/[^\-\n]+\-content/(?:themes|plugins)[^>]{1,99}config_ads\h*>\s*/dev/null\h*2>\&1(?<X1242321>)|\d?/[^\h>&]{9,99}/wp-content/plugins/apikey/\w{1,9}\h*>\h*/dev/null\h*2>&1(?<X1153312>))|usr/(?:(?:local/)?bin/php\s*\-r\s*['"]eval\(gzinflate\(base64_decode\(['"][^'"]{200,800}['"][\)\s]+;['"]$(?<X1210590>)|local/lsws/lsphp[78]\d/bin/php\s+/home/[^/]+/[^\v$]{9,199}/wp\-includes/(?:css\d*|ima?ge?s?|blocks?|maint?)/[\w\-\.]+\.php$(?<X1224970>))|var/tmp/[a-z]{2,12}\h*>\h*/dev/null\h+2>&1(?<X1154711>))|cd\h+((?:/var)?/tmp/?)(\h*&&\h*)\19?(chmod)\h+[57]{3}\h+(\w{1,9}\.php)\20(?:/usr/bin/)?php\h+\19?\22\20\21\h+[0]{3,4}\h+\19?\22[^\v]+/dev/null\h+2>&1\Z(?<X1154741>)|echo(?:\h+['"]PD9[^'"\$=\|]{1,999}(?:KSkgJiYgQGV2YWwoJF9|KSAmJiBAZXZhbCgk|ICYmIEBldmFsKCR)[^'"|\$]+['"]\h*\|\h+base64\h*\W\Wdecode\h*>\h*/home\d*/[^/]+/[\w\.\-]+/\S{1,16}\.php(?<X1240021>)|\s*['"]PD[^'"]{0,19}(?:NsYXN|Y2xhc|bGFzc)[^'"]{9,299}(?:YXJyYXk|cnJhe|cmF5)[^'"]{9,299}(?:JF9DT09LSUU|X0NPT0tJRQ|Q09PS0lF)[^'"]{1,99}(?:Y291bnQ|b3VudA|dW50)[^'"]{9,399}['"]\s*\|\s*base64\s+\-\-decode\s*>+\s*/home\d*/[^/]+/public_html/[^\v]{1,199}?\.php\b(?<X1210770>))|perl\h+/var/tmp/[a-z]{2,12}\h*>\h*/dev/null\h+2>&1(?<X1153283>))|\$(\w+)[\h=]+['"][^\$=\n]+;\$\w+[\h=]+&\$+\27;[^\n]{1,999}\$\w+[\h=]+\$\w+[\h\(]+\$\w+[\h\)]+;\h*(\$\w+)[\h=]+\$\w+[\h\(]+['"]{2}[,\h]+\$\w+[\h\)]+;\h*if\h*\([^;\)]+\)\h*\28\(\);$(?<X1215570>)|\(function\h*\(\h*\w{1,9}\h*,\h*(\w{1,9})\h*\)\s*\{\s*if\h*\(\h*\W(?:[^\{\};\v]{0,49}\b(?:android|meego)){2}[^\v]{999,2499}\.location\h*=\h*\30\h*;\h*\}\h*\)\h*\([^,\)\v;='"]{1,199},\h*['"]https?://super\W?tds\.[^'"/]{1,49}/go\.php\?[^'"]{1,99}['"]\h*\)\h*;\h*$(?<X1179883>)|\*/\d{1,2}[\*\h]{5,20}\bcurl\h+\-so\h+(\S{1,40})\h+https?://[^/]{9,40}\.(?:xyz|top)/\S{4,40}\h+&&\h+/bin/sh\h+\32[^\n&]{1,99}&&\h+rm\h+\-f\h+\32(?<X1205830>)|\w{1,40}\s*<\?php\s*echo\s*php_uname\(\);\s*if\s*\(isset\(\$_POST\['\w+'\]\)\)\s*{(?<X2048870>)|A[dp][dp]Type\h+application/x\-httpd\-php[5678]?\d?\s+\.(?:root|jpe?g|png|ico)\b(?<X1226424>)|if\h*\(count\h*\(\h*(\$_[GPCSR]\w{2,6})\h*\)[^\?\v]{1,999}\$(\w{1,40})\h*=\h*\d;[^\v\?\(\{]{1,199}\bif\h*\(\h*\$\37\b[^\{]{1,99}\{\h*unset\h*\(\h*\36\[[^\}\v]{1,499}\binclude\h*\(?\h*['"][^'"]+\.php['"]\h*\)?;\h*(?:exit|die)\b[^;]{0,9};[\}\h]+;\h*(?:\?>|\Z)(?<X1180950>))
_(?:_create_initial_settings[^#]+#google.+?__obfuscate_write(?<X2045620>)|BLANK\s*>\{\$_FILES\["userfile"\]\["name"\]\}</a><br><br>"\s*;\s*echo\s*getcwd\(\)(?<X2049890>)|d(?:oEvil\h*\([^\)]+\)\s*\{[^\}]{1,999}\$r(?:oot|eal)ShellUrl\h*=(?<X2168551>)|uis_is_wp\s*</WORDPRESS>\s*[^'"]{1,40}['"]\s*;\s*echo\s*\(?\s*['"]\s*<EVAL_ENABLED>\s*\$_duis_eval_enabled(?<X2126870>))|POST\[\(chr\(\d+\).chr\(\d+\)\)(?<X2043711>))
A(?:CCOUNT\s+PAYPAL\s+FULLZ</font(?<X2048970>)|dd(?:Handler\s*cgi-script\s*\.shell[^?]{99,399}file_get_contents\s*\(['"]https?://pastebin\.com/(?:raw|download)(?:\.php\?i=|/)[^'"]{1,40}['"]\);(?<X2122461>)|Type\s+application/x-httpd-cgi\s+\.alfa(?<X2058330>)))
By[ ]+th[3e][ ]+Err[0o]r[^\$]{9,99}\$auth_pass(?<X2130750>)
C(?:GI\-Telnet\s*\-\s*S[e3]c[7t][o0]r\W{1,9}\s*(?:</\w{1,40}>\s*){1,2}['"];(?<X2122571>)|o(?:ded(?:\s*by\s*:\s*</font><font\s*color="red">\s*TrenggalekTeam(?<X2048980>)|\s+By\s+<font color="red">Little\s+Wei(?<X2048780>))|ffeeCup Web Form Builder\s*-->\s*<title>Yahoo\s+Update</title>(?<X2052060>)|m(?:ic\s*Sans\s*MS['"]>[^\$]{1,99}if\s*\(\s*\$_[GPRSC]\w{2,6}\s*\)\s*\{\s*if\s*\(\s*@(?:copy|move_uploaded_file)\s*\(\s*\$_FILES\s*\[(?<X2127250>)|munity\s*priv8\s*WebShell(?<X2049920>))|nfigs\s+Grabber\s+By\s+AnonCoders\s+Team(?<X2046600>)))
D(?:ir(?:Contents\(\$rest\);\}else\{getDirContents(?<X2051591>)|ECTORY_SEPARATOR\s*\.\s*\$[A-Za-z0-9]+;\s*if\s*\(@\$GLOBALS\['[a-z0-9]+'\]\(\$[A-Za-z0-9]+(?<X2043681>))|onSkippo[^<]{0,20}</[^\(\{\);]{9,99};\s*if\h*\(\h*!?empty\h*\(\$(?:email|username|uname|user|login)\)\W{2,4}!?empty\h*\(\$(?:password|pass|pwd|psw)\)(?<X2165410>)|r(?:\.\s*Nova\s+Login\s+To\s+Shell</title>(?<X2048990>)|mNurHxXATBjbLkSGpOQnIzco(?<X2053160>)))
E(?:OF\s*<html>\s*<head>[ ]{200,}<script>\s*window\.location\s*=\s*['"][^'"]{1,100}['"]\s*;\s*</script>\s*</head>\s*<body>\s*<[^>]{1,40}>\$\w{1,40}</[^>]{1,40}>\s*</body>\s*</html>\s*EOF;?\s*\}\s*else\s*\{\s*\$GLOBALS[^\w][^\}]{1000,2000}\}\s*(?:\?>)?\s*\Z(?<X2052920>)|xec_Run\("rm\s*-rf\s*"\.\$filename\);(?<X2048400>))
f(?:\(typeof\h*(\w+)===['"]undefined['"]\)\{(function)\h*\w[\(\)\{\h]+var\h*\w=\[[^\n]{599,1500}\bvar\h*\1=[!\[\]]+,(httpClient)=\2\(\)\{var\h*\w=[^\n]{599,1500}var\h*\w+=new\h*\3\(\),\w+=\w+\(\w+.\w+\)[^\]]+\]\(\w+,\2\([^\n]{9,199};\};\Z(?<X1283981>)|akeSender\s*by\s*POCT(?<X2045481>))
H(?:acked\s*BY\s*(?:MR\.GREEN|Khunerable|Mikel\s*Pratama)\b\s*<\s*/(?:center|title)\s*>(?<X2127583>)|eader\s*\(['"]HTTP/1\.\d\s+(?:401|403)\s+(?:Unauthorized|Forbidden)['"]\);\s*exit\([^\)]+\);[^/]{9,99}<title>\s*(?:r57|c99|b37k|Dx|sim|c100|IndoXploit|Antichat|Cyber)\s*(?:web)?\s*shell\b(?<X2124030>)|TTP_HOST"\)\.'(?: - FaTaL Shell(?<X2051060>)|\s*-\s*Antichat\s*Shell</title>(?<X2050770>)))
i(?:f(?:[\(\s]+(isset)[\(\s]+(\$_[GPRSC]\w{2,6})(\[[^\]]+\])[\s\)]+\&+\2\3[=\s]+['"][^'"]*['"]\&+\1[\s\(]+\2(\[[^\]]+\])[\)\s]+eval[\(\s]+base64_decode[\(\s]+strtr[\(\s]+\2\4,(?:['"][^'"]*['"](?:,|\)))+[\s\)]+;(?<X1220151>)|[\s\(]+file_exists[\s\(]+dirname\(__FILE__\)[\s\.]+['"]/wp-config\.php['"][\s\)]+[^!><]+if[\s\(]+!is_user_logged_in[\s\(]\)+\{\s+(\$\w{1,9})[\s=]+get_userdatabylogin[^;]+;\s*(\$\w{1,9})[\s=]+\6->ID[^\}]+wp_set_auth_cookie[\s\(]+\7[\s\)]+;\s*wp_redirect\((?:get_)?admin_url[\(\)]+;(?<X2257740>))|nd(?:aramayu\s+Cyber\W{0,9}['"];\s*@?mail\s*\([^,]{1,40},(?<X2121861>)|oXploit[^!]{1,50}Re-?coded?\s+by[^\*]{9,99}(?:\*/|//)(?<X2059444>)))
Kakak\s+._.\s*\.?</font><br\s*/>['"];\s*\}\s*else(?:if)?\s*\{(?<X2056040>)
L(?:D_PRELOAD=\s*\./libworker.so(?<X2043781>)|OGIN'\s*=>\s*\$_POST\['login'\]\s*,\s*'ACTIVE'\s*=>\s*'Y',\s*'GROUP_ID'\s*=>\s*array\([^)]+\),\s*'PASSWORD'\s*=>\s*\$_POST\['pwd1'\],(?<X2051330>)|y9OT(?:HRScS9mcjJYRzZhM3FPd3l(?<X2053220>)|mhOOVUrMkRuVUkrTm9mdnhWV2RRV(?<X2053190>)))
MAILER(?:\s*INBOX\s*SENDING\s*(</font>)[^/]{10,50}RFX\1</p>(?<X2127650>)|\s+by\s+Sphinx</title>(?<X2046110>))
OK\s*COK\s*SUKSESS(?<X2046550>)
P(?:hpFileAdmin.+?<a\s*href="index\.php\?dir=<\?=\$_GET\['dir']\?>">(?<X2046690>)|lgSystemXcalendarHelper::getInstance\(\s*\);(?<X2046960>)|o(?:pping\s*root\s*shell[^\w]{1,40}Don[^\w]t\s*forget\s*to\s*restore\s*/tmp/bak(?<X2055080>)|ST\s*=\s*WSOstripslashes(?<X2043801>)))
R(?:e(?:write(?:Engine\s+On\s*(?:(?:RewriteCond\s+%\{REMOTE_ADDR\}\s+\^(?:\d{1,4}\.){3}\d{1,4}\$\s*RewriteRule\s+\.\*\s+https?://www\.paypal\.com\s+\[R,L\]\s*){5,10}(?<X2061952>)|RewriteCond(?: %{HTTP_ACCEPT} "text/vnd\.wap\.wml\|application/vnd\.wap\.xhtml\+xml"\s*\[NC,OR\].+?RewriteCond\s*%{HTTP_USER_AGENT}\s*!windows-media-player\s+\[NC\]\s*RewriteRule\s+\^\(\.\*\)\$\s+http[^]]+\[L,R=302\](?<X1042641>)|\s+%{HTTP_USER_AGENT}\s+android\|avantgo\|bada.+?zeto\|zte\\-\)\s*\[NC\]\s+RewriteRule\s*\^\$\s+http://.+?\[R,L\](?<X1035350>)))|Rule\s+\^\(\[A-Za-z0-9-\]\+\)\.html\$\s+\w+\.php\?hl=\$1\s+\[L\](?<X1035760>))|z\s+by\s+\[\s+bajatax\s+--\s+Sniper(?<X2047320>))|xR\s+HaCkEr\s*<\?\s*\$cwd(?<X2050700>))
S(?:CAM\s+PAYPAL\s+V.{10,100}SHADOW\s+Z118(?<X2051230>)|i(?:gn\s+on\s+to\s+Scotia\s+OnLine(?<X2047020>)|ndbad\s*File\s*Manager\s*Version(?<X2046810>)))
Tr(?:ojan\s+Shell\s*</title>(?<X2127950>)|y\s+a\s+different\s+payment\s+method\s+this\s+time\s+\-\s+PayPal</title>\s*<meta(?<X2049260>))
U(?:7TiM4T3_H4x0R\s*Mini\s*Shell\s*</(?<X2051670>)|pload\s*is\s*<b>\s*<color>\s*WORKING(?<X2046820>)|ser-Agent: SEoDOR-Client \(pathOnMyHost-\$pathOnMyHost(?<X2048270>))
VnXO8\$1_HU8nnjePnU8P8\$e_njsP8\$V(?<X2053200>)
W(?:ahib\s+Mkadmi\s+Priv8\s+Mail3R(?<X2047300>)|IN\s*&&\s*IS_COM\)\s*\{\s*if\s*\(\s*(\$\w{1,40})\s*&&\s*(\$\w{1,40})\s*\)\s*\{\s*(\$shell)\s*=\s*new\s*COM\s*\(['"]Shell\.Application['"]\);\s*\$\w{1,40}\s*=\s*\4->ShellExecute\s*\(\2,\3\);[^\{]{1,400}makehide\s*\(['"]action['"],['"]shell['"]\);(?<X2064082>)|ritePayload\(\s*\$local_payload_path\s*,\s*\$payload_file\s*\);(?<X2047280>))
XgroupVN[^\_]{1,100}add_submenu_page\s*\(['"]xgroup['"][^;]{59,300};\s*echo\s*plugins_url\s*\(['"]\w+\.php['"]\s*,\s*__FILE__\s*\);(?<X2065303>)
Z(?:GVmYXVsdF91c2VfYWpheCA9IHRydWU(?<X2044021>)|XJyb3JfcmVwb3J0aW5nKD(?:ApO2lmKGlzc2V0KCRfUkVR(?<X2053180>)|cpOw0KQ(?<X2053150>)))
{(?:\s*(?:\$\s*{\s*passthru\s*\(?\s*\$\w{1,32}\s*\)\s*}\s*}(?<X2100741>)|echo\s+"Files\s+Extracted\s+MbroOk(?<X2047510>))|keyword}\s*</h1>\s*</big>\s*</h1>\s*{manytext_bing}\s*</div>\s*</div>(?<X2047101>))
}(?:\["[^"]+"\]}=mail_utf8_html_attch\(\${\$\w{1,20}},\${\${(?<X2047750>)|\s*(?:=\s*@unserialize\(\s*sh_decrypt\(\s*@base64_decode\(\s*\${\s*\$\w+\s*}\)\s*,\s*\${\s*\${\s*"[^"]+"\s*}(?<X2046200>)|e(?:cho\s*\w{1,40}\s*\(\s*"[^"]{1,80}"\s*\)\s*;\s*sleep\s*\(\s*\d+\s*\)\s*;\s*\$\w{1,40}\s*=\s*str_ireplace\s*\(\s*"[^"]+"\s*,\s*""\s*,\s*"[^"]*"\s*\)\s*;\s*unlink\s*\(\s*str_replace\s*\(\s*""(?<X2048470>)|lse\s*{\s*syswrite\(\$client\s*,\s*"\\x05\\xFF"\s*,\s*2\s*\);\s*}\s*;(?<X2047130>))|function [a-z0-9]{10,}\(\){}\sfunction [a-z0-9]{10,}\(\){\$.+?array\(\d+,\d+(?<X2044351>)|if(?:\(\w+::\w+\(\w+\("[a-zA-Z0=9/]+=="\)(?<X2046570>)|\s*\(\s*\$_POST\s*\)\s*\{\s*file_put_contents\s*\(\s*MAILER_CONFIG_FILE\s*,\s*json_encode\s*\(\s*\$\w{1,40}\s*=\s*\(\s*object\s*\)\s*\$_POST\s*\)\s*\)\s*;(?<X2048080>))|}\s*eval[\s\(]+gzuncompress[\s\(]+_\w{1,40}::\w{1,40}[\s\(]+'[^']{1,100}'[\s\)]+;(?<X2049431>))|}}}if\(\$q=="this-is-the-test-of-door"\){\$page="DOORWAYISWORKTITLE(?<X2045441>))