gfwleak/tango-maat
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
This repository has been archived on 2025-09-14. You can view files and clone it, but cannot push or open issues or pull requests.
Files
refactor-separate-scan-and-stat-compile
tango-maat/test/benchmark/regex_rules/REGEX_2K

2001 lines
155 KiB
Plaintext
Raw Permalink Normal View History

[PATCH]add regex benchmark
2023-08-03 08:48:12 +00:00
2000
1 1 User-Agent:\s.*.abc.net 2 0 0 1
2 2 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5 2 0 0 1
3 3 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980 2 0 0 1
4 4 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E 2 0 0 1
5 5 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333 2 0 0 1
6 6 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C 2 0 0 1
7 7 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E 2 0 0 1
8 8 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E 2 0 0 1
9 9 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E 2 0 0 1
10 10 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E 2 0 0 1
11 11 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08 2 0 0 1
12 12 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42 2 0 0 1
13 13 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4 2 0 0 1
14 14 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980 2 0 0 1
15 15 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3 2 0 0 1
16 16 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980 2 0 0 1
17 17 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB 2 0 0 1
18 18 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E 2 0 0 1
19 19 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E 2 0 0 1
20 20 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664 2 0 0 1
21 21 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C 2 0 0 1
22 22 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980 2 0 0 1
23 23 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E 2 0 0 1
24 24 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
25 25 (EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters) 2 0 0 1
26 26 (SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
27 27 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
28 28 (ReadMolFile|SaveasMolFile) 2 0 0 1
29 29 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
30 30 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
31 31 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C 2 0 0 1
32 32 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
33 33 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1
34 34 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000 2 0 0 1
35 35 file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt) 2 0 0 1
36 36 [0-9]{3,} 2 0 0 1
37 37 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194 2 0 0 1
38 38 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2 2 0 0 1
39 39 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510 2 0 0 1
40 40 (setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch) 2 0 0 1
41 41 param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20} 2 0 0 1
42 42 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C 2 0 0 1
43 43 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
44 44 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79 2 0 0 1
45 45 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD 2 0 0 1
46 46 (Text|EditSelText|EditText|CellFontName|Archive) 2 0 0 1
47 47 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
48 48 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c 2 0 0 1
49 49 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B 2 0 0 1
50 50 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA 2 0 0 1
51 51 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted) 2 0 0 1
52 52 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam) 2 0 0 1
53 53 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1
54 54 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8 2 0 0 1
55 55 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E 2 0 0 1
56 56 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726 2 0 0 1
57 57 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598 2 0 0 1
58 58 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E 2 0 0 1
59 59 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E 2 0 0 1
60 60 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E 2 0 0 1
61 61 (exe|bat|com|dll|ini) 2 0 0 1
62 62 (exe|bat|com|dll|ini) 2 0 0 1
63 63 (exe|bat|com|dll|ini) 2 0 0 1
64 64 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E 2 0 0 1
65 65 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7 2 0 0 1
66 66 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91 2 0 0 1
67 67 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980 2 0 0 1
68 68 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02 2 0 0 1
69 69 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3 2 0 0 1
70 70 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90 2 0 0 1
71 71 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E 2 0 0 1
72 72 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E 2 0 0 1
73 73 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112 2 0 0 1
74 74 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1 2 0 0 1
75 75 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 2 0 0 1
76 76 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F 2 0 0 1
77 77 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1
78 78 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA 2 0 0 1
79 79 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258 2 0 0 1
80 80 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B 2 0 0 1
81 81 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1 2 0 0 1
82 82 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7 2 0 0 1
83 83 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D 2 0 0 1
84 84 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61 2 0 0 1
85 85 (Src|Background|PackageXml) 2 0 0 1
86 86 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters) 2 0 0 1
87 87 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1
88 88 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
89 89 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
90 90 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1
91 91 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755 2 0 0 1
92 92 (Save|SaveLayoutChanges|SaveMenuUsageData) 2 0 0 1
93 93 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61 2 0 0 1
94 94 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1
95 95 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
96 96 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1
97 97 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
98 98 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0 2 0 0 1
99 99 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3 2 0 0 1
100 100 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679 2 0 0 1
101 101 (SaveFile|ExportToXML) 2 0 0 1
102 102 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE 2 0 0 1
103 103 (SnapShotToFile|SnapShotX) 2 0 0 1
104 104 (SnapShotToFile|SnapShotX) 2 0 0 1
105 105 (SnapShotToFile|SnapShotX) 2 0 0 1
106 106 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
107 107 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28 2 0 0 1
108 108 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003 2 0 0 1
109 109 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
110 110 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
111 111 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
112 112 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1
113 113 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE 2 0 0 1
114 114 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB 2 0 0 1
115 115 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile) 2 0 0 1
116 116 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD 2 0 0 1
117 117 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA 2 0 0 1
118 118 (Run|SetRegistryValueAsString|PerformUpdateAsync) 2 0 0 1
119 119 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
120 120 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1
121 121 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084 2 0 0 1
122 122 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6 2 0 0 1
123 123 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF 2 0 0 1
124 124 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5 2 0 0 1
125 125 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C 2 0 0 1
126 126 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA 2 0 0 1
127 127 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020 2 0 0 1
128 128 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020 2 0 0 1
129 129 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B 2 0 0 1
130 130 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356 2 0 0 1
131 131 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520 2 0 0 1
132 132 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C 2 0 0 1
133 133 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26 2 0 0 1
134 134 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0 2 0 0 1
135 135 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF 2 0 0 1
136 136 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142 2 0 0 1
137 137 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB 2 0 0 1
138 138 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7 2 0 0 1
139 139 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747 2 0 0 1
140 140 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456 2 0 0 1
141 141 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0 2 0 0 1
142 142 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999 2 0 0 1
143 143 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899 2 0 0 1
144 144 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5 2 0 0 1
145 145 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E 2 0 0 1
146 146 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F 2 0 0 1
147 147 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9 2 0 0 1
148 148 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F 2 0 0 1
149 149 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448 2 0 0 1
150 150 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92 2 0 0 1
151 151 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F 2 0 0 1
152 152 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED 2 0 0 1
153 153 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB 2 0 0 1
154 154 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305 2 0 0 1
155 155 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7 2 0 0 1
156 156 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B 2 0 0 1
157 157 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C 2 0 0 1
158 158 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627 2 0 0 1
159 159 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E 2 0 0 1
160 160 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE 2 0 0 1
161 161 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496 2 0 0 1
162 162 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0 2 0 0 1
163 163 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E 2 0 0 1
164 164 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C 2 0 0 1
165 165 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53 2 0 0 1
166 166 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014 2 0 0 1
167 167 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
168 168 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1
169 169 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741 2 0 0 1
170 170 (SaveToBMP|SaveToFile) 2 0 0 1
171 171 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2 2 0 0 1
172 172 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667 2 0 0 1
173 173 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
174 174 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
175 175 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1
176 176 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D 2 0 0 1
177 177 (SaveBarCode|SaveEnhWMF) 2 0 0 1
178 178 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B 2 0 0 1
179 179 <object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>) 2 0 0 1
180 180 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000 2 0 0 1
181 181 (exe|bat|com|dll|ini) 2 0 0 1
182 182 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E 2 0 0 1
183 183 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E 2 0 0 1
184 184 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87 2 0 0 1
185 185 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
186 186 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
187 187 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
188 188 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
189 189 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1
190 190 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E 2 0 0 1
191 191 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344 2 0 0 1
192 192 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C 2 0 0 1
193 193 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30 2 0 0 1
194 194 (Packagefiles|SaveDna|SetIdentity|AddFile) 2 0 0 1
195 195 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9 2 0 0 1
196 196 (_DOWText)|(_MonthText) 2 0 0 1
197 197 (SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour) 2 0 0 1
198 198 classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE 2 0 0 1
199 199 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
200 200 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1
201 201 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F 2 0 0 1
202 202 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5 2 0 0 1
203 203 [\w\W]{2500,} 2 0 0 1
204 204 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3 2 0 0 1
205 205 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8 2 0 0 1
206 206 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04 2 0 0 1
207 207 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue) 2 0 0 1
208 208 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356 2 0 0 1
209 209 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E 2 0 0 1
210 210 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574 2 0 0 1
211 211 (WriteIniFileString|ShellExecute) 2 0 0 1
212 212 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906 2 0 0 1
213 213 (txt|ini|com|exe|bat|dll|dat) 2 0 0 1
214 214 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8 2 0 0 1
215 215 42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733 2 0 0 1
216 216 (Save|ExportImage) 2 0 0 1
217 217 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790 2 0 0 1
218 218 (DeleteFile|write) 2 0 0 1
219 219 (SaveAsBMP|SaveAsWMF) 2 0 0 1
220 220 (SaveAsBMP|SaveAsWMF) 2 0 0 1
221 221 (SaveAsBMP|SaveAsWMF) 2 0 0 1
222 222 (SaveAsBMP|SaveAsWMF) 2 0 0 1
223 223 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967 2 0 0 1
224 224 WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext) 2 0 0 1
225 225 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9 2 0 0 1
226 226 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 2 0 0 1
227 227 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6 2 0 0 1
228 228 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1
229 229 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1
230 230 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24 2 0 0 1
231 231 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9 2 0 0 1
232 232 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA 2 0 0 1
233 233 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec) 2 0 0 1
234 234 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5 2 0 0 1
235 235 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
236 236 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
237 237 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1
238 238 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83 2 0 0 1
239 239 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA 2 0 0 1
240 240 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566 2 0 0 1
241 241 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
242 242 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1
243 243 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B 2 0 0 1
244 244 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F 2 0 0 1
245 245 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
246 246 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1
247 247 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED 2 0 0 1
248 248 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619 2 0 0 1
249 249 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E 2 0 0 1
250 250 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258 2 0 0 1
251 251 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196 2 0 0 1
252 252 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E 2 0 0 1
253 253 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD 2 0 0 1
254 254 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4 2 0 0 1
255 255 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118 2 0 0 1
256 256 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616 2 0 0 1
257 257 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
258 258 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
259 259 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1
260 260 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11 2 0 0 1
261 261 (ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1 2 0 0 1
262 262 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020 2 0 0 1
263 263 (PostURL|AddSeperator|AddString|Post) 2 0 0 1
264 264 (SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF) 2 0 0 1
265 265 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>) 2 0 0 1
266 266 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\> 2 0 0 1
267 267 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\> 2 0 0 1
268 268 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\> 2 0 0 1
269 269 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1
270 270 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
271 271 (Buildpath|GetDriveName|DriveExists|DeleteFile) 2 0 0 1
272 272 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
273 273 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
274 274 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1
275 275 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>) 2 0 0 1
276 276 \x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission] 2 0 0 1
277 277 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\> 2 0 0 1
278 278 000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F 2 0 0 1
279 279 (javascript|http|ftp|vbscript) 2 0 0 1
280 280 (SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen) 2 0 0 1
281 281 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000 2 0 0 1
282 282 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407 2 0 0 1
283 283 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414 2 0 0 1
284 284 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
285 285 (AddAttachment|SubmitToExpress) 2 0 0 1
286 286 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6 2 0 0 1
287 287 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0 2 0 0 1
288 288 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D 2 0 0 1
289 289 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile) 2 0 0 1
290 290 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\> 2 0 0 1
291 291 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\> 2 0 0 1
292 292 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC 2 0 0 1
293 293 src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape 2 0 0 1
294 294 (LogFile|ClearLogFile|SaveToFile) 2 0 0 1
295 295 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext) 2 0 0 1
296 296 User-Agent\x3a Downloader \d\.\d\r 2 0 0 1
297 297 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P 2 0 0 1
298 298 ^((\r?\n\r?\n).)*?\r?\n\r?\nMZ 2 0 0 1
299 299 instructions\/\d{2}\.xml 2 0 0 1
300 300 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp 2 0 0 1
301 301 \/updatestats\/update\d+?\.xml$ 2 0 0 1
302 302 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab 2 0 0 1
303 303 ctxad-\d+\.sig 2 0 0 1
304 304 /user\d+/counter\.htm 2 0 0 1
305 305 (cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr 2 0 0 1
306 306 (discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe 2 0 0 1
307 307 loaderadv\d+\.jar 2 0 0 1
308 308 \/adv\/\d+\/win32\.exe 2 0 0 1
309 309 \/Message\/\S+\/\S+\.xml 2 0 0 1
310 310 \/abt\?data=\S{150} 2 0 0 1
311 311 User-Agent\x3a.+ZangoToolbar.+\r 2 0 0 1
312 312 User-Agent\:[^\n]+wbi_v\d/iH 2 0 0 1
313 313 User-Agent\x3a[^\n]+AskBar/iH 2 0 0 1
314 314 \/tbrequest\d+\.php 2 0 0 1
315 315 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
316 316 sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
317 317 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
318 318 cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
319 319 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
320 320 UID=\d 2 0 0 1
321 321 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1
322 322 REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P 2 0 0 1
323 323 victim\.php\?\d\d\d\d\d 2 0 0 1
324 324 \/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d 2 0 0 1
325 325 \/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+ 2 0 0 1
326 326 &ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d 2 0 0 1
327 327 \/sd\?s=\d+&f=\d&C=\d 2 0 0 1
328 328 \.txt$ 2 0 0 1
329 329 \.cfg$ 2 0 0 1
330 330 User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H 2 0 0 1
331 331 Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r 2 0 0 1
332 332 \x00[\x02-\x1E][0-9]{2,30}\x02cn\x00 2 0 0 1
333 333 \x00[\x02-\x1E][0-9]{2,30}\x02ru\x00 2 0 0 1
334 334 ^[A-F0-9]+$ 2 0 0 1
335 335 \/sd\?s=\d+&f=\d 2 0 0 1
336 336 loadadv\d+\.exe 2 0 0 1
337 337 \/ms\d\d\dcfg\.jsp 2 0 0 1
338 338 ^0x[0-9a-f]+$ 2 0 0 1
339 339 ^[^a-z]*?[0-9]{2,30}\.ru$ 2 0 0 1
340 340 filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe 2 0 0 1
341 341 ^MM \d\.\d+$ 2 0 0 1
342 342 ^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4} 2 0 0 1
343 343 ^\w+pcsetup_\w+ 2 0 0 1
344 344 \x2Fv[0-9]{3,4}[\x2F\x3F] 2 0 0 1
345 345 [a-f0-9]{32}\?v= 2 0 0 1
346 346 ^\/[a-z]{2}\x3Fv\x3D[0-9]$ 2 0 0 1
347 347 ^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$ 2 0 0 1
348 348 ^\/entrance\?s1=[a-f0-9]{100,}$ 2 0 0 1
349 349 ^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report= 2 0 0 1
350 350 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
351 351 ^[0-9][a-z]+ 2 0 0 1
352 352 \.php$ 2 0 0 1
353 353 ^\/([^\x2f]+\/)*log\/\?[bc]= 2 0 0 1
354 354 ^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/)) 2 0 0 1
355 355 ^\/\?pcrc=\d+&v=[\d.]+$ 2 0 0 1
356 356 ^\/\?v=[\d.]+&pcrc=\d+$ 2 0 0 1
357 357 \/v\d\/[^.]+\.asp$ 2 0 0 1
358 358 \/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$ 2 0 0 1
359 359 \/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$ 2 0 0 1
360 360 ^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$ 2 0 0 1
361 361 ^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$ 2 0 0 1
362 362 \?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4}) 2 0 0 1
363 363 ^Downloader\s\d+\.\d+$ 2 0 0 1
364 364 ^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100} 2 0 0 1
365 365 \/get_xml\?(file_id|stb)= 2 0 0 1
366 366 (_[a-z]{2}){1,3}_[a-z]{3}_install\.exe 2 0 0 1
367 367 \d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows 2 0 0 1
368 368 ^[a-zA-Z0-9_-]+$ 2 0 0 1
369 369 ^\/([a-zA-Z0-9]|%2[fb]){400,}$ 2 0 0 1
370 370 User-Agent\:[^\n]+searchengine 2 0 0 1
371 371 User-Agent\:[^\n]+SurferPlugin 2 0 0 1
372 372 User-Agent\:[^\n]+THNALL[^\n]+\.EXE 2 0 0 1
373 373 User-Agent\:[^\n]+XupiterToolbar 2 0 0 1
374 374 User-Agent\:[^\n]+spywareaxe 2 0 0 1
375 375 User-Agent\:[^\n]+iMeshBar 2 0 0 1
376 376 User-Agent\:[^\n]+Oemji 2 0 0 1
377 377 ^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$ 2 0 0 1
378 378 ^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$ 2 0 0 1
379 379 ^\/(get|install)\/\?q= 2 0 0 1
380 380 ^\/[a-f0-9]{50,}$ 2 0 0 1
381 381 ^\/[\w-]{50,}$ 2 0 0 1
382 382 ^\/\?pcrc=[0-9]{7,10}$ 2 0 0 1
383 383 ^Downloader \d\.\d$ 2 0 0 1
384 384 \/Socks[45]\.txt$ 2 0 0 1
385 385 ^Feat[^\r\n]+(Install|Updat)er 2 0 0 1
386 386 User-Agent\:[^\n]+host(ie|oe|oi|ol) 2 0 0 1
387 387 User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2} 2 0 0 1
388 388 ^BWL(\sToplist|\d_UPDATE) 2 0 0 1
389 389 ^\x2F[A-F0-9]{25,40}$ 2 0 0 1
390 390 ^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$ 2 0 0 1
391 391 ^\d+\sHTTP/1.1$ 2 0 0 1
392 392 ^[a-zA-Z0-9_-]+ 2 0 0 1
393 393 [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12} 2 0 0 1
394 394 \/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id= 2 0 0 1
395 395 \{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\} 2 0 0 1
396 396 CN=([^\r\n]+?\.)?showmypc\.com(\.) 2 0 0 1
397 397 ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$ 2 0 0 1
398 398 (SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk) 2 0 0 1
399 399 (DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog) 2 0 0 1
400 400 \d{13}$ 2 0 0 1
401 401 ^[a-f0-9]{32} 2 0 0 1
402 402 ^[a-f0-9]{32}\" 2 0 0 1
403 403 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
404 404 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12} 2 0 0 1
405 405 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1
406 406 ^[A-F0-9]{12} 2 0 0 1
407 407 ^[A-Z0-9]{9} 2 0 0 1
408 408 ^\d+[^\r\n\s]+ 2 0 0 1
409 409 ^ SQL[-_ ]Server 2 0 0 1
410 410 ^ \d+ Driver 2 0 0 1
411 411 ORA-\d{4} 2 0 0 1
412 412 Warning.*\Woci_ 2 0 0 1
413 413 Warning.*\Wora_ 2 0 0 1
414 414 CLI Driver.*DB2 2 0 0 1
415 415 bdb2_\w+\( 2 0 0 1
416 416 Exception.*Informix 2 0 0 1
417 417 Warning.*SQLite3:: 2 0 0 1
418 418 SQL error.*POS\([0-9]+\) 2 0 0 1
419 419 Warning.*maxdb 2 0 0 1
420 420 i?Warning.*sybase 2 0 0 1
421 421 Warning.*ingres_ 2 0 0 1
422 422 Warning.*sqlite_ 2 0 0 1
423 423 Ingres\W.*Driver 2 0 0 1
424 424 Exception (condition )\d+\. Transaction rollback\. 2 0 0 1
425 425 SQL Server.*?error \x27[0-9a-f]{8} 2 0 0 1
426 426 ^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$ 2 0 0 1
427 427 ^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll 2 0 0 1
428 428 ^...\x30\x82..\x02\x82...{256,257} 2 0 0 1
429 429 \/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php 2 0 0 1
430 430 \/notify\/(single|mass)$ 2 0 0 1
431 431 a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1
432 432 Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a 2 0 0 1
433 433 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1
434 434 [-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10} 2 0 0 1
435 435 ^\d+(\+|\-|\\|\*)\d+ 2 0 0 1
436 436 ^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9 2 0 0 1
437 437 ^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u 2 0 0 1
438 438 ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b 2 0 0 1
439 439 ^\d{4}[01] 2 0 0 1
440 440 ^\d{4}[01] 2 0 0 1
441 441 ^\d{4}[01] 2 0 0 1
442 442 ^\d{4}[01] 2 0 0 1
443 443 ^\d{4}[01] 2 0 0 1
444 444 ^\d{4}[01] 2 0 0 1
445 445 ^\d{4}[01] 2 0 0 1
446 446 ^\d{4}[01] 2 0 0 1
447 447 ^\d{4}[01] 2 0 0 1
448 448 ^\d{4}[01] 2 0 0 1
449 449 ^\d{4}[01] 2 0 0 1
450 450 ^\d{4}[01] 2 0 0 1
451 451 ^\d{4}[01] 2 0 0 1
452 452 ^\d{4}[01] 2 0 0 1
453 453 ^\d{4}[01] 2 0 0 1
454 454 ^\d{4}[01] 2 0 0 1
455 455 ^\d{4}[01] 2 0 0 1
456 456 ^\d{4}[01] 2 0 0 1
457 457 ^\d{4}[01] 2 0 0 1
458 458 ^\d{4}[01] 2 0 0 1
459 459 ^\d{4}[01] 2 0 0 1
460 460 ^\d{4}[01] 2 0 0 1
461 461 ^\d{4}[01] 2 0 0 1
462 462 ^\d{4}[01] 2 0 0 1
463 463 ^\d{4}[01] 2 0 0 1
464 464 ^\d{4}[01] 2 0 0 1
465 465 ^\d{4}[01] 2 0 0 1
466 466 ^\d{4}[01] 2 0 0 1
467 467 ^\d{4}[01] 2 0 0 1
468 468 ^\d{4}[01] 2 0 0 1
469 469 ^\d{4}[01] 2 0 0 1
470 470 ^\d{4}[01] 2 0 0 1
471 471 ^\d{4}[01] 2 0 0 1
472 472 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
473 473 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
474 474 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
475 475 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
476 476 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
477 477 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
478 478 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
479 479 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
480 480 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
481 481 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
482 482 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
483 483 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
484 484 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
485 485 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
486 486 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
487 487 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
488 488 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
489 489 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
490 490 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
491 491 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
492 492 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
493 493 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
494 494 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
495 495 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
496 496 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
497 497 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
498 498 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
499 499 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
500 500 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
501 501 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
502 502 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
503 503 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
504 504 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
505 505 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
506 506 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
507 507 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
508 508 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
509 509 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
510 510 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
511 511 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
512 512 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
513 513 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
514 514 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
515 515 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
516 516 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
517 517 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
518 518 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
519 519 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
520 520 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
521 521 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
522 522 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
523 523 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
524 524 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
525 525 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
526 526 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
527 527 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
528 528 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
529 529 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
530 530 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
531 531 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
532 532 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
533 533 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
534 534 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
535 535 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
536 536 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
537 537 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
538 538 ^\d{4}[01] 2 0 0 1
539 539 ^\d{4}[01] 2 0 0 1
540 540 ^\d{4}[01] 2 0 0 1
541 541 ^\d{4}[01] 2 0 0 1
542 542 ^\d{4}[01] 2 0 0 1
543 543 ^\d{4}[01] 2 0 0 1
544 544 ^\d{4}[01] 2 0 0 1
545 545 ^\d{4}[01] 2 0 0 1
546 546 ^\d{4}[01] 2 0 0 1
547 547 ^\d{4}[01] 2 0 0 1
548 548 ^\d{4}[01] 2 0 0 1
549 549 ^\d{4}[01] 2 0 0 1
550 550 ^\d{4}[01] 2 0 0 1
551 551 ^\d{4}[01] 2 0 0 1
552 552 ^\d{4}[01] 2 0 0 1
553 553 ^\d{4}[01] 2 0 0 1
554 554 ^\d{4}[01] 2 0 0 1
555 555 ^\d{4}[01] 2 0 0 1
556 556 ^\d{4}[01] 2 0 0 1
557 557 ^\d{4}[01] 2 0 0 1
558 558 ^\d{4}[01] 2 0 0 1
559 559 ^\d{4}[01] 2 0 0 1
560 560 ^\d{4}[01] 2 0 0 1
561 561 ^\d{4}[01] 2 0 0 1
562 562 ^\d{4}[01] 2 0 0 1
563 563 ^\d{4}[01] 2 0 0 1
564 564 ^\d{4}[01] 2 0 0 1
565 565 ^\d{4}[01] 2 0 0 1
566 566 ^\d{4}[01] 2 0 0 1
567 567 ^\d{4}[01] 2 0 0 1
568 568 ^\d{4}[01] 2 0 0 1
569 569 ^\d{4}[01] 2 0 0 1
570 570 ^\d{4}[01] 2 0 0 1
571 571 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
572 572 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
573 573 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
574 574 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
575 575 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
576 576 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
577 577 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
578 578 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
579 579 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
580 580 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
581 581 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
582 582 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
583 583 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
584 584 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
585 585 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
586 586 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
587 587 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
588 588 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
589 589 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
590 590 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
591 591 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
592 592 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
593 593 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
594 594 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
595 595 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
596 596 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
597 597 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
598 598 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
599 599 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
600 600 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
601 601 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
602 602 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
603 603 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
604 604 ^\d{4}[01] 2 0 0 1
605 605 ^\d{4}[01] 2 0 0 1
606 606 ^\d{4}[01] 2 0 0 1
607 607 ^\d{4}[01] 2 0 0 1
608 608 ^\d{4}[01] 2 0 0 1
609 609 ^\d{4}[01] 2 0 0 1
610 610 ^\d{4}[01] 2 0 0 1
611 611 ^\d{4}[01] 2 0 0 1
612 612 ^\d{4}[01] 2 0 0 1
613 613 ^\d{4}[01] 2 0 0 1
614 614 ^\d{4}[01] 2 0 0 1
615 615 ^\d{4}[01] 2 0 0 1
616 616 ^\d{4}[01] 2 0 0 1
617 617 ^\d{4}[01] 2 0 0 1
618 618 ^\d{4}[01] 2 0 0 1
619 619 ^\d{4}[01] 2 0 0 1
620 620 ^\d{4}[01] 2 0 0 1
621 621 ^\d{4}[01] 2 0 0 1
622 622 ^\d{4}[01] 2 0 0 1
623 623 ^\d{4}[01] 2 0 0 1
624 624 ^\d{4}[01] 2 0 0 1
625 625 ^\d{4}[01] 2 0 0 1
626 626 ^\d{4}[01] 2 0 0 1
627 627 ^\d{4}[01] 2 0 0 1
628 628 ^\d{4}[01] 2 0 0 1
629 629 ^\d{4}[01] 2 0 0 1
630 630 ^\d{4}[01] 2 0 0 1
631 631 ^\d{4}[01] 2 0 0 1
632 632 ^\d{4}[01] 2 0 0 1
633 633 ^\d{4}[01] 2 0 0 1
634 634 ^\d{4}[01] 2 0 0 1
635 635 ^\d{4}[01] 2 0 0 1
636 636 ^\d{4}[01] 2 0 0 1
637 637 ^\d{4}[01] 2 0 0 1
638 638 ^\d{4}[01] 2 0 0 1
639 639 ^\d{4}[01] 2 0 0 1
640 640 ^\d{4}[01] 2 0 0 1
641 641 ^\d{4}[01] 2 0 0 1
642 642 ^\d{4}[01] 2 0 0 1
643 643 ^\d{4}[01] 2 0 0 1
644 644 ^\d{4}[01] 2 0 0 1
645 645 ^\d{4}[01] 2 0 0 1
646 646 ^\d{4}[01] 2 0 0 1
647 647 ^\d{4}[01] 2 0 0 1
648 648 ^\d{4}[01] 2 0 0 1
649 649 ^\d{4}[01] 2 0 0 1
650 650 ^\d{4}[01] 2 0 0 1
651 651 ^\d{4}[01] 2 0 0 1
652 652 ^\d{4}[01] 2 0 0 1
653 653 ^\d{4}[01] 2 0 0 1
654 654 ^\d{4}[01] 2 0 0 1
655 655 ^\d{4}[01] 2 0 0 1
656 656 ^\d{4}[01] 2 0 0 1
657 657 ^\d{4}[01] 2 0 0 1
658 658 ^\d{4}[01] 2 0 0 1
659 659 ^\d{4}[01] 2 0 0 1
660 660 ^\d{4}[01] 2 0 0 1
661 661 ^\d{4}[01] 2 0 0 1
662 662 ^\d{4}[01] 2 0 0 1
663 663 ^\d{4}[01] 2 0 0 1
664 664 ^\d{4}[01] 2 0 0 1
665 665 ^\d{4}[01] 2 0 0 1
666 666 ^\d{4}[01] 2 0 0 1
667 667 ^\d{4}[01] 2 0 0 1
668 668 ^\d{4}[01] 2 0 0 1
669 669 ^\d{4}[01] 2 0 0 1
670 670 ^\d{4}[01] 2 0 0 1
671 671 ^\d{4}[01] 2 0 0 1
672 672 ^\d{4}[01] 2 0 0 1
673 673 ^\d{4}[01] 2 0 0 1
674 674 ^\d{4}[01] 2 0 0 1
675 675 ^\d{4}[01] 2 0 0 1
676 676 ^\d{4}[01] 2 0 0 1
677 677 ^\d{4}[01] 2 0 0 1
678 678 ^\d{4}[01] 2 0 0 1
679 679 ^\d{4}[01] 2 0 0 1
680 680 ^\d{4}[01] 2 0 0 1
681 681 ^\d{4}[01] 2 0 0 1
682 682 ^\d{4}[01] 2 0 0 1
683 683 ^\d{4}[01] 2 0 0 1
684 684 ^\d{4}[01] 2 0 0 1
685 685 ^\d{4}[01] 2 0 0 1
686 686 ^\d{4}[01] 2 0 0 1
687 687 ^\d{4}[01] 2 0 0 1
688 688 ^\d{4}[01] 2 0 0 1
689 689 ^\d{4}[01] 2 0 0 1
690 690 ^\d{4}[01] 2 0 0 1
691 691 ^\d{4}[01] 2 0 0 1
692 692 ^\d{4}[01] 2 0 0 1
693 693 ^\d{4}[01] 2 0 0 1
694 694 ^\d{4}[01] 2 0 0 1
695 695 ^\d{4}[01] 2 0 0 1
696 696 ^\d{4}[01] 2 0 0 1
697 697 ^\d{4}[01] 2 0 0 1
698 698 ^\d{4}[01] 2 0 0 1
699 699 ^\d{4}[01] 2 0 0 1
700 700 ^\d{4}[01] 2 0 0 1
701 701 ^\d{4}[01] 2 0 0 1
702 702 ^\d{4}[01] 2 0 0 1
703 703 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
704 704 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
705 705 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
706 706 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
707 707 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
708 708 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
709 709 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
710 710 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
711 711 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
712 712 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
713 713 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
714 714 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
715 715 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
716 716 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
717 717 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
718 718 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
719 719 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
720 720 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
721 721 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
722 722 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
723 723 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
724 724 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
725 725 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
726 726 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
727 727 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
728 728 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
729 729 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
730 730 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
731 731 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
732 732 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
733 733 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
734 734 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
735 735 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
736 736 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
737 737 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
738 738 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
739 739 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
740 740 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
741 741 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
742 742 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
743 743 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
744 744 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
745 745 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
746 746 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
747 747 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
748 748 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
749 749 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
750 750 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
751 751 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
752 752 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
753 753 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
754 754 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
755 755 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
756 756 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
757 757 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
758 758 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
759 759 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
760 760 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
761 761 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
762 762 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
763 763 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
764 764 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
765 765 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
766 766 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
767 767 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
768 768 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
769 769 ^\d{4}[01] 2 0 0 1
770 770 ^\d{4}[01] 2 0 0 1
771 771 ^\d{4}[01] 2 0 0 1
772 772 ^\d{4}[01] 2 0 0 1
773 773 ^\d{4}[01] 2 0 0 1
774 774 ^\d{4}[01] 2 0 0 1
775 775 ^\d{4}[01] 2 0 0 1
776 776 ^\d{4}[01] 2 0 0 1
777 777 ^\d{4}[01] 2 0 0 1
778 778 ^\d{4}[01] 2 0 0 1
779 779 ^\d{4}[01] 2 0 0 1
780 780 ^\d{4}[01] 2 0 0 1
781 781 ^\d{4}[01] 2 0 0 1
782 782 ^\d{4}[01] 2 0 0 1
783 783 ^\d{4}[01] 2 0 0 1
784 784 ^\d{4}[01] 2 0 0 1
785 785 ^\d{4}[01] 2 0 0 1
786 786 ^\d{4}[01] 2 0 0 1
787 787 ^\d{4}[01] 2 0 0 1
788 788 ^\d{4}[01] 2 0 0 1
789 789 ^\d{4}[01] 2 0 0 1
790 790 ^\d{4}[01] 2 0 0 1
791 791 ^\d{4}[01] 2 0 0 1
792 792 ^\d{4}[01] 2 0 0 1
793 793 ^\d{4}[01] 2 0 0 1
794 794 ^\d{4}[01] 2 0 0 1
795 795 ^\d{4}[01] 2 0 0 1
796 796 ^\d{4}[01] 2 0 0 1
797 797 ^\d{4}[01] 2 0 0 1
798 798 ^\d{4}[01] 2 0 0 1
799 799 ^\d{4}[01] 2 0 0 1
800 800 ^\d{4}[01] 2 0 0 1
801 801 ^\d{4}[01] 2 0 0 1
802 802 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
803 803 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
804 804 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
805 805 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
806 806 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
807 807 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
808 808 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
809 809 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
810 810 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
811 811 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
812 812 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
813 813 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
814 814 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
815 815 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
816 816 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
817 817 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
818 818 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
819 819 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
820 820 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
821 821 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
822 822 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
823 823 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
824 824 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
825 825 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
826 826 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
827 827 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
828 828 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
829 829 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
830 830 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
831 831 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
832 832 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
833 833 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
834 834 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
835 835 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
836 836 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
837 837 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
838 838 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
839 839 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
840 840 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
841 841 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
842 842 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
843 843 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
844 844 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
845 845 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
846 846 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
847 847 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
848 848 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
849 849 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
850 850 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
851 851 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
852 852 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
853 853 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
854 854 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
855 855 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
856 856 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
857 857 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
858 858 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
859 859 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
860 860 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
861 861 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
862 862 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
863 863 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
864 864 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
865 865 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
866 866 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
867 867 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1
868 868 ^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
869 869 ^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1
870 870 \x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,} 2 0 0 1
871 871 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
872 872 appid\x3a\s+2 2 0 0 1
873 873 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1
874 874 \x22mining\x2E(subscribe|authorize)\x22 2 0 0 1
875 875 ^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start 2 0 0 1
876 876 ^\/api\/(bit|lite)coin\/balance\/ 2 0 0 1
877 877 miner[^a-z] 2 0 0 1
878 878 (\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22) 2 0 0 1
879 879 (\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22) 2 0 0 1
880 880 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1
881 881 \/tmp\/[^\/]+\.swf$ 2 0 0 1
882 882 name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22 2 0 0 1
883 883 name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22 2 0 0 1
884 884 =[0-9a-f]{8}\.jar/H 2 0 0 1
885 885 ^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\? 2 0 0 1
886 886 ^\/[a-z0-9]{32}\?s=1$ 2 0 0 1
887 887 ^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s]))) 2 0 0 1
888 888 ^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>] 2 0 0 1
889 889 ^(mous)?\.class 2 0 0 1
890 890 \/chrome\/google_chrome_(update|installer)\.exe$ 2 0 0 1
891 891 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1
892 892 ^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P 2 0 0 1
893 893 findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$ 2 0 0 1
894 894 ^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m 2 0 0 1
895 895 \.php\?cashe=\d+$ 2 0 0 1
896 896 \.jar\?m=[1-2]$ 2 0 0 1
897 897 \.pdf\?p=1&s=[1-2]$ 2 0 0 1
898 898 Host\x3a [^\r\n]+?\.bit\r\n 2 0 0 1
899 899 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$ 2 0 0 1
900 900 \/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$ 2 0 0 1
901 901 \/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
902 902 \/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1
903 903 \/tds\/[a-f0-9]{32}$ 2 0 0 1
904 904 ^[a-f0-9]{32}[\x22\x27] 2 0 0 1
905 905 Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi 2 0 0 1
906 906 (\.\.\/)+kboxwww\/tmp\/ 2 0 0 1
907 907 ^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22 2 0 0 1
908 908 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
909 909 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1
910 910 \/\?[0-9a-f]{60,66}[\;\d\x2c]*$ 2 0 0 1
911 911 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15} 2 0 0 1
912 912 \/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php 2 0 0 1
913 913 debugenableplugins=[a-zA-Z0-9]+?\x3b 2 0 0 1
914 914 ^\/[a-z0-9]+\/load\.php$ 2 0 0 1
915 915 ^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1
916 916 ^\/xteas\/code$ 2 0 0 1
917 917 \/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash= 2 0 0 1
918 918 =\w{8}\.pdf/Hi 2 0 0 1
919 919 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$ 2 0 0 1
920 920 User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n) 2 0 0 1
921 921 Host\x3a\s.+\.in 2 0 0 1
922 922 name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22 2 0 0 1
923 923 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
924 924 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1
925 925 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
926 926 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1
927 927 Location\x3a\x20[a-f0-9]{32}\/e\.html 2 0 0 1
928 928 ^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket)) 2 0 0 1
929 929 ^(\/updates|\/license\/eula|\/docs\/office|\/software-activation) 2 0 0 1
930 930 ^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google)) 2 0 0 1
931 931 ^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b 2 0 0 1
932 932 ^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2) 2 0 0 1
933 933 \/api\/v1\/user\/(512|124)\/avatar 2 0 0 1
934 934 ^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01] 2 0 0 1
935 935 ^\/v1\/(queue|profile|docs\/wsdl|pull) 2 0 0 1
936 936 ^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/) 2 0 0 1
937 937 ^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check) 2 0 0 1
938 938 ^[^\n]*[\x00-\x08\x0e-\x1f] 2 0 0 1
939 939 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
940 940 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
941 941 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
942 942 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
943 943 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
944 944 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR)) 2 0 0 1
945 945 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
946 946 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
947 947 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
948 948 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
949 949 (TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
950 950 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
951 951 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
952 952 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
953 953 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
954 954 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
955 955 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
956 956 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
957 957 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
958 958 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
959 959 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
960 960 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
961 961 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
962 962 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
963 963 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
964 964 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
965 965 \[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\" 2 0 0 1
966 966 User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER 2 0 0 1
967 967 \x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20) 2 0 0 1
968 968 PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20) 2 0 0 1
969 969 \x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A 2 0 0 1
970 970 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000 2 0 0 1
971 971 filename\s*=\s*"WU_Details_.....\.zip 2 0 0 1
972 972 filename\s*=\s*MySpace_document_[0-9]{5}\.zip 2 0 0 1
973 973 filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22 2 0 0 1
974 974 filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22 2 0 0 1
975 975 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E 2 0 0 1
976 976 MyValue=[a-f0-9]{32} 2 0 0 1
977 977 \x0d\x0aUser-Agent\: 0\:0\:[^\n]{120} 2 0 0 1
978 978 User-Agent\: 0\:0\:[^\x0a|\x0d]{128} 2 0 0 1
979 979 01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20 2 0 0 1
980 980 (\.\.\/){1,} 2 0 0 1
981 981 \/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172} 2 0 0 1
982 982 03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C 2 0 0 1
983 983 4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B 2 0 0 1
984 984 php\?r=\d+&p= 2 0 0 1
985 985 \/socks\.php\?name=[^&]+&port=\d{1,5}$ 2 0 0 1
986 986 SELECT.+FROM 2 0 0 1
987 987 UNION\s+SELECT 2 0 0 1
988 988 INSERT.+INTO 2 0 0 1
989 989 DELETE.+FROM 2 0 0 1
990 990 ASCII\(.+SELECT 2 0 0 1
991 991 UPDATE.+SET 2 0 0 1
992 992 EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 2 0 0 1
993 993 BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5 2 0 0 1
994 994 6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41 2 0 0 1
995 995 index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3) 2 0 0 1
996 996 (file=\|.+\|) 2 0 0 1
997 997 SELECT.+FROM 2 0 0 1
998 998 UNION\s+SELECT 2 0 0 1
999 999 INSERT.+INTO 2 0 0 1
1000 1000 DELETE.+FROM 2 0 0 1
1001 1001 ASCII\(.+SELECT 2 0 0 1
1002 1002 UPDATE.+SET 2 0 0 1
1003 1003 SELECT.+FROM 2 0 0 1
1004 1004 UNION\s+SELECT 2 0 0 1
1005 1005 INSERT.+INTO 2 0 0 1
1006 1006 DELETE.+FROM 2 0 0 1
1007 1007 ASCII\(.+SELECT 2 0 0 1
1008 1008 UPDATE.+SET 2 0 0 1
1009 1009 SELECT.+FROM 2 0 0 1
1010 1010 UNION\s+SELECT 2 0 0 1
1011 1011 INSERT.+INTO 2 0 0 1
1012 1012 DELETE.+FROM 2 0 0 1
1013 1013 ASCII\(.+SELECT 2 0 0 1
1014 1014 UPDATE.+SET 2 0 0 1
1015 1015 (TOP|//)\Wsecret[^\w/a] 2 0 0 1
1016 1016 filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22 2 0 0 1
1017 1017 \x2FU3D\x2FLength\x20172[0-5][0-9]{2} 2 0 0 1
1018 1018 \/000[a-z][0-9]{3}\x2Eso 2 0 0 1
1019 1019 \/000[a-z][0-9]{3}\x2Eexe 2 0 0 1
1020 1020 UPDATE.+SET 2 0 0 1
1021 1021 PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F] 2 0 0 1
1022 1022 ^FOLD\s[^\n]{256} 2 0 0 1
1023 1023 ^FOLD\s+\/ 2 0 0 1
1024 1024 ^Username\:[^\n]{100} 2 0 0 1
1025 1025 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1026 1026 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1027 1027 ^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\} 2 0 0 1
1028 1028 ^file\x3a\x2f\x2f[^\n]{400} 2 0 0 1
1029 1029 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65) 2 0 0 1
1030 1030 OS 4_[0-3]_[1-4] like/H 2 0 0 1
1031 1031 [a-f0-9]{16}$ 2 0 0 1
1032 1032 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1
1033 1033 (/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration) 2 0 0 1
1034 1034 \x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02 2 0 0 1
1035 1035 \x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02 2 0 0 1
1036 1036 NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A 2 0 0 1
1037 1037 \x3a.4\x7c.12.\x3a.4 2 0 0 1
1038 1038 (cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta) 2 0 0 1
1039 1039 keepalive([0-9]{4}|\x7c[0-9]{4}) 2 0 0 1
1040 1040 User-Agent\x3a[^\n]+sbu-hb- 2 0 0 1
1041 1041 User-Agent\:[^\n]+Peer Points/iH 2 0 0 1
1042 1042 User-Agent\:[^\n]+zbu-hb-/Hi 2 0 0 1
1043 1043 User-Agent\:[^\n]+HSN/iH 2 0 0 1
1044 1044 User-Agent\:[^\n]+Wildtangent/iH 2 0 0 1
1045 1045 ^RMD\s+\x2f$ 2 0 0 1
1046 1046 User-Agent\x3A[^\n]+TheWorld/H 2 0 0 1
1047 1047 ^Max-dotdot[\s\r\n]*\d{3,} 2 0 0 1
1048 1048 ^Authorization\x3a Basic\s+= 2 0 0 1
1049 1049 ^Authorization\x3a Basic\s+= 2 0 0 1
1050 1050 Host\x3a\s[a-z]{16}\.ru/H 2 0 0 1
1051 1051 CREATE.+ENDPOINT 2 0 0 1
1052 1052 \/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir= 2 0 0 1
1053 1053 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
1054 1054 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1
1055 1055 \x00[0-9]{4,7}\x02co\x00 2 0 0 1
1056 1056 \x2fsogou(config)?\x2f 2 0 0 1
1057 1057 \/\d{8,}\/\d{4,}\/\d{4,}\.jsp 2 0 0 1
1058 1058 adv\d+\.php 2 0 0 1
1059 1059 a=\%[0-9a-fA-F]{2}\&b 2 0 0 1
1060 1060 \Wcustomer\slist(s)?\W 2 0 0 1
1061 1061 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1062 1062 \Wcredit\shistor(y|ies)\W 2 0 0 1
1063 1063 \Wannual\sincome(s)?\W 2 0 0 1
1064 1064 \Wpayment\shistory\W 2 0 0 1
1065 1065 \Waccount\sbalance(s)?\W 2 0 0 1
1066 1066 \Wappraisal(s)?\W 2 0 0 1
1067 1067 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1068 1068 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1069 1069 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1070 1070 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1071 1071 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1072 1072 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1073 1073 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1074 1074 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1075 1075 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1076 1076 \Winternal\suse\sonly\W 2 0 0 1
1077 1077 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1078 1078 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1079 1079 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1080 1080 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1081 1081 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1082 1082 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1083 1083 (//)\Wconfidential[^\w/] 2 0 0 1
1084 1084 (//)\Wrestricted[^\w/] 2 0 0 1
1085 1085 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1086 1086 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1087 1087 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1088 1088 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1089 1089 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1090 1090 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1091 1091 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1092 1092 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1093 1093 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1094 1094 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1095 1095 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1096 1096 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1097 1097 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1098 1098 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1099 1099 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1100 1100 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1101 1101 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1102 1102 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1103 1103 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1104 1104 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1105 1105 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1106 1106 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1107 1107 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1108 1108 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1109 1109 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1110 1110 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1111 1111 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1112 1112 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1113 1113 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1114 1114 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1115 1115 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1116 1116 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1117 1117 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1118 1118 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1119 1119 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1120 1120 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1121 1121 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1122 1122 (//)\Wrestricted[^\w/] 2 0 0 1
1123 1123 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1124 1124 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1125 1125 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1126 1126 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1127 1127 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1128 1128 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1129 1129 \Winternal\suse\sonly\W 2 0 0 1
1130 1130 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1131 1131 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1132 1132 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1133 1133 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1134 1134 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1135 1135 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1136 1136 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1137 1137 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1138 1138 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1139 1139 \Wappraisal(s)?\W 2 0 0 1
1140 1140 \Waccount\sbalance(s)?\W 2 0 0 1
1141 1141 \Wannual\sincome(s)?\W 2 0 0 1
1142 1142 \Wcredit\shistor(y|ies)\W 2 0 0 1
1143 1143 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1144 1144 \Wcustomer\slist(s)?\W 2 0 0 1
1145 1145 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1146 1146 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1147 1147 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1148 1148 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1149 1149 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1150 1150 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1151 1151 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1152 1152 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1153 1153 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1154 1154 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1155 1155 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1156 1156 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1157 1157 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1158 1158 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1159 1159 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1160 1160 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1161 1161 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1162 1162 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1163 1163 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1164 1164 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1165 1165 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1166 1166 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1167 1167 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1168 1168 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1169 1169 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1170 1170 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1171 1171 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1172 1172 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1173 1173 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1174 1174 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1175 1175 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1176 1176 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1177 1177 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1178 1178 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1179 1179 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1180 1180 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1
1181 1181 (//)\Wrestricted[^\w/] 2 0 0 1
1182 1182 (//)\Wconfidential[^\w/] 2 0 0 1
1183 1183 (//)\Wtop\ssecret[^\w/a] 2 0 0 1
1184 1184 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1
1185 1185 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1
1186 1186 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1
1187 1187 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1
1188 1188 \Wlaw\senforcement\ssensitive\W 2 0 0 1
1189 1189 \Winternal\suse\sonly\W 2 0 0 1
1190 1190 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1
1191 1191 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1
1192 1192 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1
1193 1193 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1
1194 1194 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1
1195 1195 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1
1196 1196 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1
1197 1197 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1
1198 1198 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1
1199 1199 \Wappraisal(s)?\W 2 0 0 1
1200 1200 \Waccount\sbalance(s)?\W 2 0 0 1
1201 1201 \Wpayment\shistory\W 2 0 0 1
1202 1202 \Wannual\sincome(s)?\W 2 0 0 1
1203 1203 \Wcredit\shistor(y|ies)\W 2 0 0 1
1204 1204 \Wtransaction\shistor(y|ies)\W 2 0 0 1
1205 1205 \Wcustomer\slist(s)?\W 2 0 0 1
1206 1206 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1
1207 1207 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1
1208 1208 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1
1209 1209 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1
1210 1210 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1
1211 1211 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1
1212 1212 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1
1213 1213 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1
1214 1214 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1
1215 1215 //((NATO\sSECRET)|NS)//MR 2 0 0 1
1216 1216 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1
1217 1217 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1
1218 1218 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1
1219 1219 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1220 1220 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1221 1221 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1222 1222 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1223 1223 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1224 1224 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1
1225 1225 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1226 1226 //FGI[\s\w,/-]*(//X5) 2 0 0 1
1227 1227 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1
1228 1228 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1229 1229 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1230 1230 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1231 1231 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1232 1232 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1233 1233 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1234 1234 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1235 1235 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1236 1236 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1
1237 1237 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1238 1238 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1239 1239 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1240 1240 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1
1241 1241 User-Agent\x3a \d{6}\x0d\x0a/H 2 0 0 1
1242 1242 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping 2 0 0 1
1243 1243 \.dyndns\.((biz|info|org|tv))\x0d\x0a/iH 2 0 0 1
1244 1244 \.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH 2 0 0 1
1245 1245 \.jpg\?t\x3d\d\.\d 2 0 0 1
1246 1246 [0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$ 2 0 0 1
1247 1247 ^Content-Length\x3a\s*-\d+ 2 0 0 1
1248 1248 \W[0-9]{5}\.jar 2 0 0 1
1249 1249 machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+} 2 0 0 1
1250 1250 [0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$ 2 0 0 1
1251 1251 ^[a-z0-9]{6}..\x00\x00 2 0 0 1
1252 1252 ^[a-z0-9]{7}..\x00\x00 2 0 0 1
1253 1253 \sLOGIN\s[^\n]*?% 2 0 0 1
1254 1254 ({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+})) 2 0 0 1
1255 1255 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1256 1256 [a-z]{9}[0-9]\.exe/H 2 0 0 1
1257 1257 \.php\?inst_result=.+&hwid= 2 0 0 1
1258 1258 ^.{1,5}[a-f0-9]{100} 2 0 0 1
1259 1259 \/scr5\.php\?p=\d+&id=\d 2 0 0 1
1260 1260 ^User-Agent\: App\d/Hmi 2 0 0 1
1261 1261 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1
1262 1262 \x00\x07[a-z]{7}\x02eu\x00 2 0 0 1
1263 1263 REGISTER.{400} 2 0 0 1
1264 1264 \/content\/jav\d?\.jar$ 2 0 0 1
1265 1265 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1266 1266 \.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}& 2 0 0 1
1267 1267 ^HTTP\x2f1\.[01] 200 2 0 0 1
1268 1268 \.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])& 2 0 0 1
1269 1269 IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
1270 1270 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$ 2 0 0 1
1271 1271 \.(jpg|png|gif|cgi)\?pr= 2 0 0 1
1272 1272 ^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$ 2 0 0 1
1273 1273 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1274 1274 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1275 1275 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1276 1276 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1277 1277 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1278 1278 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1279 1279 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1280 1280 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1281 1281 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1282 1282 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1283 1283 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1284 1284 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl 2 0 0 1
1285 1285 \x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$ 2 0 0 1
1286 1286 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1287 1287 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1288 1288 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1
1289 1289 ^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/ 2 0 0 1
1290 1290 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
1291 1291 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1
1292 1292 applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27] 2 0 0 1
1293 1293 code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22 2 0 0 1
1294 1294 \x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D 2 0 0 1
1295 1295 \x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$ 2 0 0 1
1296 1296 ^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
1297 1297 \.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$ 2 0 0 1
1298 1298 ^\d+?.\x00\x00\x00 2 0 0 1
1299 1299 \/[0-9a-f]{32}\.jar$ 2 0 0 1
1300 1300 \/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1301 1301 ^[^OGHPDTCMLUVRBAS] 2 0 0 1
1302 1302 &s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi 2 0 0 1
1303 1303 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1
1304 1304 AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1
1305 1305 DELETE.+FROM 2 0 0 1
1306 1306 UNION.+SELECT 2 0 0 1
1307 1307 UPDATE.+SET 2 0 0 1
1308 1308 ASCII\(.+SELECT 2 0 0 1
1309 1309 DELETE.+FROM 2 0 0 1
1310 1310 INSERT.+INTO 2 0 0 1
1311 1311 UNION\s+SELECT 2 0 0 1
1312 1312 SELECT.+FROM 2 0 0 1
1313 1313 UPDATE.+SET 2 0 0 1
1314 1314 ASCII\(.+SELECT 2 0 0 1
1315 1315 DELETE.+FROM 2 0 0 1
1316 1316 INSERT.+INTO 2 0 0 1
1317 1317 SELECT.+FROM 2 0 0 1
1318 1318 \/\S+\.cab 2 0 0 1
1319 1319 User-Agent\x3a[^\n]+AskTB/iH 2 0 0 1
1320 1320 (<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q) 2 0 0 1
1321 1321 (<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q) 2 0 0 1
1322 1322 ^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$ 2 0 0 1
1323 1323 \/gate\.php\?cmd=urls$ 2 0 0 1
1324 1324 \/gate\.php\?cmd=getexe$ 2 0 0 1
1325 1325 ^User-Agent\x3a[^\r\n]*?\sMSIE\s/H 2 0 0 1
1326 1326 ^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email) 2 0 0 1
1327 1327 [^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00 2 0 0 1
1328 1328 [^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00 2 0 0 1
1329 1329 [^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00 2 0 0 1
1330 1330 \x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7} 2 0 0 1
1331 1331 \.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1332 1332 \.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$ 2 0 0 1
1333 1333 ^\/[A-Za-z0-9]{7,8}\/index\.html?$ 2 0 0 1
1334 1334 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$ 2 0 0 1
1335 1335 ^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1336 1336 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1337 1337 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1338 1338 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1339 1339 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1340 1340 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1
1341 1341 ^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$ 2 0 0 1
1342 1342 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
1343 1343 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1
1344 1344 \/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$ 2 0 0 1
1345 1345 ^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2} 2 0 0 1
1346 1346 ^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1
1347 1347 Server\: nginx/[a-zA-Z] 2 0 0 1
1348 1348 ^\x23\d\d\d\x2f\x21 2 0 0 1
1349 1349 XPantivirus20\d{2}_v\d{6}\.exe 2 0 0 1
1350 1350 \d\d\d\d\d\d\x0a 2 0 0 1
1351 1351 PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S 2 0 0 1
1352 1352 [0-9A-Z]{240,} 2 0 0 1
1353 1353 \x26[\x00-\xff]\x09\x00 2 0 0 1
1354 1354 \x26[\x00-\xff]\x09\x00 2 0 0 1
1355 1355 \.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt= 2 0 0 1
1356 1356 OS 4_[0-3]_[1-4] like/H 2 0 0 1
1357 1357 \.php\?f=\d+$ 2 0 0 1
1358 1358 Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H 2 0 0 1
1359 1359 User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H 2 0 0 1
1360 1360 \.php\?t=\d{2,7}$ 2 0 0 1
1361 1361 filename=.*facebook.*\.(rar|exe|zip) 2 0 0 1
1362 1362 filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip) 2 0 0 1
1363 1363 flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe 2 0 0 1
1364 1364 \x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D 2 0 0 1
1365 1365 MalvRem_\d{3,4}\.exe 2 0 0 1
1366 1366 avdistr_\d{3,4}\.exe 2 0 0 1
1367 1367 RunAV_\d{3,4}\.exe 2 0 0 1
1368 1368 installer\.\d{4}\.exe 2 0 0 1
1369 1369 \/stetement_id\.\d+\/ 2 0 0 1
1370 1370 ^\/stream\?\d$ 2 0 0 1
1371 1371 loads2\.php\?r=[0-9]{2}\.[0-9] 2 0 0 1
1372 1372 ^[\x20-\x7e]{5}.{4}\x7c\x01 2 0 0 1
1373 1373 (\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1 2 0 0 1
1374 1374 &cid=\d+$ 2 0 0 1
1375 1375 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1
1376 1376 ^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi 2 0 0 1
1377 1377 ^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/ 2 0 0 1
1378 1378 ^Content-Length\x3a 2\d{2}\r?$/Hmi 2 0 0 1
1379 1379 \/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$ 2 0 0 1
1380 1380 \.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r]) 2 0 0 1
1381 1381 \x2B\x22l\x22(\x3B|\x5D) 2 0 0 1
1382 1382 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1383 1383 ^Referer\x3a[^\r\n]+\.swf/Hmi 2 0 0 1
1384 1384 \.jpg\?id=\d+$ 2 0 0 1
1385 1385 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
1386 1386 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
1387 1387 ^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$ 2 0 0 1
1388 1388 ^\/h[a-z]{3}\.html?$ 2 0 0 1
1389 1389 ^\/[0-9]{8}\.html$ 2 0 0 1
1390 1390 ^\/lists\/\d{15}(\d{5})?$ 2 0 0 1
1391 1391 ^\/[a-z0-9]{2}\.jar$ 2 0 0 1
1392 1392 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1
1393 1393 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
1394 1394 ^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1
1395 1395 ^\/0[a-z0-9]{13}$ 2 0 0 1
1396 1396 ^\/[-a-zA-Z0-9_]{70,75}==?$ 2 0 0 1
1397 1397 ^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi 2 0 0 1
1398 1398 \/[a-f0-9]{32}\.eot$ 2 0 0 1
1399 1399 ^\/0[a-z0-9]{13}$ 2 0 0 1
1400 1400 ^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\?? 2 0 0 1
1401 1401 ^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00 2 0 0 1
1402 1402 ^(\x62|\x1b) 2 0 0 1
1403 1403 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$ 2 0 0 1
1404 1404 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$ 2 0 0 1
1405 1405 ^(\x8b|\xf2) 2 0 0 1
1406 1406 ^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$ 2 0 0 1
1407 1407 ^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi 2 0 0 1
1408 1408 GRANT.{1,5}TO 2 0 0 1
1409 1409 ^\/\?[a-f0-9]{32}$ 2 0 0 1
1410 1410 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$ 2 0 0 1
1411 1411 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$ 2 0 0 1
1412 1412 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$ 2 0 0 1
1413 1413 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$ 2 0 0 1
1414 1414 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$ 2 0 0 1
1415 1415 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$ 2 0 0 1
1416 1416 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$ 2 0 0 1
1417 1417 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$ 2 0 0 1
1418 1418 \/\w{1,2}\/\w{1,2}\.class$ 2 0 0 1
1419 1419 User-Agent\:[^\n]+zb-hb-/Hi 2 0 0 1
1420 1420 ^[^\r\n]*\/[0-9a-f]{78}\sHTTP 2 0 0 1
1421 1421 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi 2 0 0 1
1422 1422 Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1423 1423 ^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$ 2 0 0 1
1424 1424 Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H 2 0 0 1
1425 1425 &id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$ 2 0 0 1
1426 1426 \/pd\.php\?id=[a-f0-9]+$ 2 0 0 1
1427 1427 ^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D 2 0 0 1
1428 1428 ^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm 2 0 0 1
1429 1429 ^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27]) 2 0 0 1
1430 1430 filename=\x22\d+?\x22/P 2 0 0 1
1431 1431 ^\/log\.php\?f=[0-1](\.[a-z]+)?$ 2 0 0 1
1432 1432 (<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q) 2 0 0 1
1433 1433 ^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi 2 0 0 1
1434 1434 ^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H 2 0 0 1
1435 1435 ^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\} 2 0 0 1
1436 1436 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1437 1437 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1438 1438 \/j[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
1439 1439 \/f[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1
1440 1440 \.php$ 2 0 0 1
1441 1441 \.php$ 2 0 0 1
1442 1442 GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n 2 0 0 1
1443 1443 ^\d{4}\r$ 2 0 0 1
1444 1444 ^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi 2 0 0 1
1445 1445 \/form\/submit\/$ 2 0 0 1
1446 1446 pch\.php\?f=\d+$ 2 0 0 1
1447 1447 hcp_vbs\.php\?f=\d+&d=\d+$ 2 0 0 1
1448 1448 \.php\?e=\w+&f=\w+$ 2 0 0 1
1449 1449 pch2.php?c=\d+$ 2 0 0 1
1450 1450 \.jar\?t=\d+&h=[^&]+$ 2 0 0 1
1451 1451 \/adp\d\.php\[0-9a-z]{2,6} 2 0 0 1
1452 1452 attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1453 1453 attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1454 1454 attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1455 1455 attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1456 1456 hhcp.php?c=[a-f0-9]{5}$ 2 0 0 1
1457 1457 attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1
1458 1458 \/content\/jav\d?\.jar$ 2 0 0 1
1459 1459 \.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d] 2 0 0 1
1460 1460 =.*[a-f].*$ 2 0 0 1
1461 1461 <title>[a-f0-9]{10}<\/title> 2 0 0 1
1462 1462 =[0-9a-f]{8}\.jar/H 2 0 0 1
1463 1463 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$ 2 0 0 1
1464 1464 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$ 2 0 0 1
1465 1465 display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E 2 0 0 1
1466 1466 (\x3D|\x5B\x22])e\x22\x2B\x22va 2 0 0 1
1467 1467 (\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a 2 0 0 1
1468 1468 (\x3D|\x5B\x22])ev\x22\x2B\x22a 2 0 0 1
1469 1469 \x2B\x22al\x22(\x3B|\x5D) 2 0 0 1
1470 1470 \x2B\x22val\x22(\x3B|\x5D) 2 0 0 1
1471 1471 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1472 1472 \.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1
1473 1473 ^.{1,5}[a-f0-9]{100} 2 0 0 1
1474 1474 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1475 1475 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1476 1476 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1477 1477 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1478 1478 \.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$ 2 0 0 1
1479 1479 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$ 2 0 0 1
1480 1480 \/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php 2 0 0 1
1481 1481 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1
1482 1482 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php 2 0 0 1
1483 1483 ^\/[0-9a-f]{16}\/q\.php$ 2 0 0 1
1484 1484 ^\/[0-9a-f]{16}\/q\.php 2 0 0 1
1485 1485 ^\/[0-9a-f]{32}\/ff\.php$ 2 0 0 1
1486 1486 ^\/[0-9a-f]{32}\/ff\.php 2 0 0 1
1487 1487 ^\/[0-9a-f]{16}\/ff\.php$ 2 0 0 1
1488 1488 ^\/[0-9a-f]{16}\/ff\.php 2 0 0 1
1489 1489 ^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php 2 0 0 1
1490 1490 &jopa=\d+$ 2 0 0 1
1491 1491 \.php\?jnlp=[a-f0-9]{10}(,|$) 2 0 0 1
1492 1492 \/[0-9a-f]{32}\/a\.php$ 2 0 0 1
1493 1493 \/[0-9a-f]{32}\/a\.php 2 0 0 1
1494 1494 \/[0-9a-f]{16}\/a\.php$ 2 0 0 1
1495 1495 \/[0-9a-f]{16}\/a\.php 2 0 0 1
1496 1496 \.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}& 2 0 0 1
1497 1497 \/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$ 2 0 0 1
1498 1498 ^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q) 2 0 0 1
1499 1499 \.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}& 2 0 0 1
1500 1500 \.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?& 2 0 0 1
1501 1501 \.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?& 2 0 0 1
1502 1502 ^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$ 2 0 0 1
1503 1503 @\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.] 2 0 0 1
1504 1504 ^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
1505 1505 ^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
1506 1506 ^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm 2 0 0 1
1507 1507 ^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1
1508 1508 ^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1
1509 1509 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1
1510 1510 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1511 1511 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1
1512 1512 ^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm 2 0 0 1
1513 1513 ^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22 2 0 0 1
1514 1514 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1515 1515 Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi 2 0 0 1
1516 1516 Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi 2 0 0 1
1517 1517 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1
1518 1518 ^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1) 2 0 0 1
1519 1519 ^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
1520 1520 ^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1
1521 1521 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
1522 1522 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1
1523 1523 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
1524 1524 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1
1525 1525 ^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27] 2 0 0 1
1526 1526 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1527 1527 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1528 1528 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
1529 1529 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1
1530 1530 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
1531 1531 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27] 2 0 0 1
1532 1532 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1
1533 1533 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1
1534 1534 \/m[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1
1535 1535 ^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P 2 0 0 1
1536 1536 ^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P 2 0 0 1
1537 1537 \x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*? 2 0 0 1
1538 1538 =%25[0-9A-F]{2}%25[0-9A-F]{2}/P 2 0 0 1
1539 1539 ^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1540 1540 ^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1541 1541 ^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1542 1542 ^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1543 1543 \/r[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
1544 1544 \/f[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1
1545 1545 ^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$ 2 0 0 1
1546 1546 \/b[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
1547 1547 \/v[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1
1548 1548 ^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$ 2 0 0 1
1549 1549 ^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$ 2 0 0 1
1550 1550 ^[\r\n\s]*?\, 2 0 0 1
1551 1551 \bdig\.dll\b 2 0 0 1
1552 1552 ^\/[a-z]+?\?[a-z]+[a-z]+$ 2 0 0 1
1553 1553 ^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1554 1554 ^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$ 2 0 0 1
1555 1555 ^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true 2 0 0 1
1556 1556 ^\/1[a-z0-9]{13}$ 2 0 0 1
1557 1557 ^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
1558 1558 ^\/1[a-z0-9]{13}$ 2 0 0 1
1559 1559 ^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1
1560 1560 ^\/3[a-z0-9]{13}$ 2 0 0 1
1561 1561 \/4[a-z0-9]{13}\?&xkey= 2 0 0 1
1562 1562 ^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27] 2 0 0 1
1563 1563 ^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27] 2 0 0 1
1564 1564 ^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27] 2 0 0 1
1565 1565 ^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname) 2 0 0 1
1566 1566 ^[a-zA-Z0-9]+\*\/ 2 0 0 1
1567 1567 [a-z0-9]+?\*\/ 2 0 0 1
1568 1568 ^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script> 2 0 0 1
1569 1569 ^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+ 2 0 0 1
1570 1570 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
1571 1571 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1
1572 1572 ^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm 2 0 0 1
1573 1573 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H 2 0 0 1
1574 1574 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H 2 0 0 1
1575 1575 ^\W 2 0 0 1
1576 1576 ^\W 2 0 0 1
1577 1577 ^\/[a-z]{3}\?[A-F0-9]{8}$ 2 0 0 1
1578 1578 ^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm 2 0 0 1
1579 1579 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
1580 1580 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1581 1581 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi 2 0 0 1
1582 1582 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1
1583 1583 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1
1584 1584 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1
1585 1585 ^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe 2 0 0 1
1586 1586 ^(\x4c|\x35) 2 0 0 1
1587 1587 ^(\x76|\x0f) 2 0 0 1
1588 1588 \/wp-(content|admin|includes)\/ 2 0 0 1
1589 1589 ^\d\x00\d 2 0 0 1
1590 1590 \.php\?$ 2 0 0 1
1591 1591 \?showforum=$ 2 0 0 1
1592 1592 ^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00 2 0 0 1
1593 1593 \x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_] 2 0 0 1
1594 1594 (\.\.\/){1,} 2 0 0 1
1595 1595 (\.\.\/){1,} 2 0 0 1
1596 1596 =(https?|ftps?|php)\:\/.{0,100}cmd= 2 0 0 1
1597 1597 MEAS\.TYPE=((link|class)&) 2 0 0 1
1598 1598 url=.{8000} 2 0 0 1
1599 1599 \/ssp\/files\/annonce\.pdf$ 2 0 0 1
1600 1600 \/ssp\/loadjavad\.php$ 2 0 0 1
1601 1601 \/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$ 2 0 0 1
1602 1602 \/xml\/p\.php\?id=\d{2,} 2 0 0 1
1603 1603 ts\/in\.cgi\?pepsi\d+ 2 0 0 1
1604 1604 cs_base_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1
1605 1605 \x0d\x0aHost\: (www\.)?nacha\.org\. 2 0 0 1
1606 1606 \x26n\x3d[a-z]{5}\d{4} 2 0 0 1
1607 1607 name=(https?|ftps?|php) 2 0 0 1
1608 1608 \/script\.php?\d{8} 2 0 0 1
1609 1609 Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a 2 0 0 1
1610 1610 \/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$ 2 0 0 1
1611 1611 UPDATE.+SET 2 0 0 1
1612 1612 ASCII\(.+SELECT 2 0 0 1
1613 1613 DELETE.+FROM 2 0 0 1
1614 1614 INSERT.+INTO 2 0 0 1
1615 1615 UNION\s+SELECT 2 0 0 1
1616 1616 SELECT.+FROM 2 0 0 1
1617 1617 UPDATE.+SET 2 0 0 1
1618 1618 ASCII\(.+SELECT 2 0 0 1
1619 1619 DELETE.+FROM 2 0 0 1
1620 1620 INSERT.+INTO 2 0 0 1
1621 1621 UNION\s+SELECT 2 0 0 1
1622 1622 SELECT.+FROM 2 0 0 1
1623 1623 ver=[v\d]+ 2 0 0 1
1624 1624 \/Setup_[0-9]{3}([A-Z][0-9])?\.exe$ 2 0 0 1
1625 1625 \/\d+\/installer\/Installer(Clean)?\.exe$ 2 0 0 1
1626 1626 \/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1
1627 1627 ^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c 2 0 0 1
1628 1628 =sent$ 2 0 0 1
1629 1629 \.php\?get[^=]*=\d_\d{5,}$ 2 0 0 1
1630 1630 \.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$ 2 0 0 1
1631 1631 Host\x3A\x20[^\r\n]*.rr.nu/H 2 0 0 1
1632 1632 ^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10)) 2 0 0 1
1633 1633 \.tar$ 2 0 0 1
1634 1634 \x2Fjs\x2F[\r\n]*\x2Eexe$ 2 0 0 1
1635 1635 ^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$ 2 0 0 1
1636 1636 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
1637 1637 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1
1638 1638 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
1639 1639 \/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1
1640 1640 <iframe.*?src.*.*?<\/iframe> 2 0 0 1
1641 1641 [a-z]{4,10}\x08velodrivve\x03biz\x00 2 0 0 1
1642 1642 PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help) 2 0 0 1
1643 1643 \/[A-Z]Setup_[0-9]{4}\.exe$ 2 0 0 1
1644 1644 \.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https? 2 0 0 1
1645 1645 \/[a-f0-9]{16}\/.+?\.(exe|zip)$ 2 0 0 1
1646 1646 ^\s?\+x=[0-9]*\;\ +y=[0-9] 2 0 0 1
1647 1647 User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H 2 0 0 1
1648 1648 ^\/load.php\?showforum=(ato|obe|rhino|lib)$ 2 0 0 1
1649 1649 ^[a-z]{5}\d=\x5f\d\x5f 2 0 0 1
1650 1650 index.php\?[0-9a-f]{32}$ 2 0 0 1
1651 1651 o/\d{9}\/[0-9a-f]{32}\/[0-9]$ 2 0 0 1
1652 1652 \/out.php\?id=\d$ 2 0 0 1
1653 1653 \/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$ 2 0 0 1
1654 1654 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1
1655 1655 \/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$ 2 0 0 1
1656 1656 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$ 2 0 0 1
1657 1657 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$ 2 0 0 1
1658 1658 ^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$ 2 0 0 1
1659 1659 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$ 2 0 0 1
1660 1660 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$ 2 0 0 1
1661 1661 \.png$ 2 0 0 1
1662 1662 ^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$ 2 0 0 1
1663 1663 \/\d+\.mp3\x3frnd\x3d\d+$ 2 0 0 1
1664 1664 (Is|CheckRemote)DebuggerPresent 2 0 0 1
1665 1665 (Create|Connect|Peek)NamedPipe 2 0 0 1
1666 1666 ftp(open|get)file 2 0 0 1
1667 1667 ^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1668 1668 ^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1
1669 1669 ^\/[a-f0-9]{32}\.eot$ 2 0 0 1
1670 1670 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$ 2 0 0 1
1671 1671 \.gif$ 2 0 0 1
1672 1672 \/(w(hite|orld)|step)\/\d+$ 2 0 0 1
1673 1673 \.psd$ 2 0 0 1
1674 1674 \.jpeg$ 2 0 0 1
1675 1675 \/(w(hite|orld)|step)\/mypic\.dll$ 2 0 0 1
1676 1676 getqq\.jpg$ 2 0 0 1
1677 1677 ^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q) 2 0 0 1
1678 1678 \.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1679 1679 ([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24} 2 0 0 1
1680 1680 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+ 2 0 0 1
1681 1681 \.php\?spl=[A-Z]{3} 2 0 0 1
1682 1682 \.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1683 1683 \.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1684 1684 ^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1685 1685 \.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1
1686 1686 \.php\?doit[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1687 1687 ^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1
1688 1688 (-?\d+\x3a-?\d+\x3a){100} 2 0 0 1
1689 1689 \x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$ 2 0 0 1
1690 1690 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9] 2 0 0 1
1691 1691 value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23 2 0 0 1
1692 1692 \x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$ 2 0 0 1
1693 1693 \/\d+\.js\?\d+&[a-f0-9]{16}$ 2 0 0 1
1694 1694 ^\/[a-z0-9_\-]{48}$ 2 0 0 1
1695 1695 \.php\?e=[^&]+?$ 2 0 0 1
1696 1696 \/[a-z]\/[0-9]\/[0-9a-f]{32}$ 2 0 0 1
1697 1697 archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1
1698 1698 ^\/[a-z]+\/$ 2 0 0 1
1699 1699 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$ 2 0 0 1
1700 1700 \/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$ 2 0 0 1
1701 1701 \/(w(hite|orld)|step)\/get(a+|n+)\.jpg 2 0 0 1
1702 1702 \.php\?usernms=[^@]+@[^\r\n]+$ 2 0 0 1
1703 1703 ^(\x3a\d{1,5})?$ 2 0 0 1
1704 1704 ^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip 2 0 0 1
1705 1705 desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre 2 0 0 1
1706 1706 ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$ 2 0 0 1
1707 1707 ^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain 2 0 0 1
1708 1708 d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))| 2 0 0 1
1709 1709 ((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$ 2 0 0 1
1710 1710 ^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)| 2 0 0 1
1711 1711 ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)| 2 0 0 1
1712 1712 h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$ 2 0 0 1
1713 1713 ^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape 2 0 0 1
1714 1714 |per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$ 2 0 0 1
1715 1715 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1
1716 1716 [a-z]{8}.(:?tif|gif) 2 0 0 1
1717 1717 ^.{2}[a-zA-Z0-9]+\x2e[01] 2 0 0 1
1718 1718 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1
1719 1719 ^\w+?\[[^\]]+?\]\.src[\r\n\s]*= 2 0 0 1
1720 1720 (\/(php)?|\.php)\?[\s\+]*\-[A-Za-z] 2 0 0 1
1721 1721 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1
1722 1722 ^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
1723 1723 ^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1
1724 1724 [^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class 2 0 0 1
1725 1725 ^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea 2 0 0 1
1726 1726 \/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$ 2 0 0 1
1727 1727 ^[\x11\x21-\x26\x41\x45\x70-\x79] 2 0 0 1
1728 1728 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1729 1729 ^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22 2 0 0 1
1730 1730 ^..[\x81\x82\x83\x84\x85\x86\x87]\x81 2 0 0 1
1731 1731 ^..[\x81\x82\x83\x84\x85\x86\x87]\x83 2 0 0 1
1732 1732 ^..[\x81\x82\x83\x84\x85\x86\x87]\x84 2 0 0 1
1733 1733 ^..[\x81\x82\x83\x84\x85\x86\x87]\x85 2 0 0 1
1734 1734 REGISTER.{400} 2 0 0 1
1735 1735 SELECT.+geometrycollectionfromwkb 2 0 0 1
1736 1736 SELECT.+WHERE.+SELECT.+\x60 2 0 0 1
1737 1737 ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA 2 0 0 1
1738 1738 ^Authorization\x3A Basic.{120}/Hmi 2 0 0 1
1739 1739 ^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi 2 0 0 1
1740 1740 ^[^\x00]+?\x00 2 0 0 1
1741 1741 ^[^\x00]+?\x00 2 0 0 1
1742 1742 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E 2 0 0 1
1743 1743 ^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$ 2 0 0 1
1744 1744 ^\/\?id=[0-9]{13}&msg= 2 0 0 1
1745 1745 ^13\d{11} 2 0 0 1
1746 1746 ^Callback\x3a\x20<http[^>]+><http 2 0 0 1
1747 1747 ^[^\r\n]*uuid\x3a[^\r\n\x3a]{181} 2 0 0 1
1748 1748 ^[^\r\n]+#[^\x22\r\n]{2049} 2 0 0 1
1749 1749 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
1750 1750 ^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181} 2 0 0 1
1751 1751 ^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1
1752 1752 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181} 2 0 0 1
1753 1753 M-SEARCH\s+[^\n]{500} 2 0 0 1
1754 1754 (\/\.){70,} 2 0 0 1
1755 1755 [\w]{70,} 2 0 0 1
1756 1756 \xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF] 2 0 0 1
1757 1757 ^.{27} 2 0 0 1
1758 1758 [0-9a-zA-Z]{200,} 2 0 0 1
1759 1759 (GET).\/%.{1586,} 2 0 0 1
1760 1760 ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE) 2 0 0 1
1761 1761 [^a-zA-Z0-9]+\.message 2 0 0 1
1762 1762 \x3d[^\x26]{720} 2 0 0 1
1763 1763 ENTER\x20LANGUAGE\x20\x3D.{55} 2 0 0 1
1764 1764 [a-zA-Z0-9]{1000,} 2 0 0 1
1765 1765 \xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
1766 1766 \xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2 2 0 0 1
1767 1767 [\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5] 2 0 0 1
1768 1768 [\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1
1769 1769 Cookie\:\ +REMOTE_ADDR= 2 0 0 1
1770 1770 Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}== 2 0 0 1
1771 1771 \x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a 2 0 0 1
1772 1772 \/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+& 2 0 0 1
1773 1773 \.php\?sex=\d+&children=\d+&userid= 2 0 0 1
1774 1774 ^SSH-\s[^\n]{200} 2 0 0 1
1775 1775 value\x22[^\x22]*\x2Eswf\x3finfo\x3D 2 0 0 1
1776 1776 ^(CLIENT|MACHINE)_INFO 2 0 0 1
1777 1777 Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H 2 0 0 1
1778 1778 \/tmp\/[^\/]+\.pdf$ 2 0 0 1
1779 1779 \/tmp\/[^\/]+\.jar$ 2 0 0 1
1780 1780 ^Directory 2 0 0 1
1781 1781 ^HEAD[^s]{432} 2 0 0 1
1782 1782 ^PUT[^s]{432} 2 0 0 1
1783 1783 ^POST[^s]{432} 2 0 0 1
1784 1784 ^TRACE[^s]{432} 2 0 0 1
1785 1785 ^DELETE[^s]{432} 2 0 0 1
1786 1786 ^LOCK[^s]{432} 2 0 0 1
1787 1787 ^MKCOL[^s]{432} 2 0 0 1
1788 1788 ^COPY[^s]{432} 2 0 0 1
1789 1789 ^MOVE[^s]{432} 2 0 0 1
1790 1790 \x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000} 2 0 0 1
1791 1791 ^\/[0-9]{5}\.jar$ 2 0 0 1
1792 1792 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
1793 1793 ^\/[0-9]$ 2 0 0 1
1794 1794 ^\/[a-z]{13,14}\.jar$ 2 0 0 1
1795 1795 ^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$ 2 0 0 1
1796 1796 ^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$ 2 0 0 1
1797 1797 T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T 2 0 0 1
1798 1798 [0-9a-zA-Z]{10} 2 0 0 1
1799 1799 [0-9a-zA-Z]{10} 2 0 0 1
1800 1800 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1
1801 1801 ^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$ 2 0 0 1
1802 1802 SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22] 2 0 0 1
1803 1803 [a-zA-Z0-9]{5} 2 0 0 1
1804 1804 [0-9a-zA-Z]{50} 2 0 0 1
1805 1805 \x90{200} 2 0 0 1
1806 1806 ^\s+A{500} 2 0 0 1
1807 1807 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
1808 1808 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1
1809 1809 \.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,} 2 0 0 1
1810 1810 [\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run 2 0 0 1
1811 1811 ^((>>).)+?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1
1812 1812 ^\s*?fun\s*?\( 2 0 0 1
1813 1813 [\?&]mail=[^&]+?[\x3b\x2c\x7c\x27] 2 0 0 1
1814 1814 WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe 2 0 0 1
1815 1815 ^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160) 2 0 0 1
1816 1816 \/\??[a-f0-9]{60,}(\x3b\d+){1,4}$ 2 0 0 1
1817 1817 \/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$ 2 0 0 1
1818 1818 ^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$ 2 0 0 1
1819 1819 ^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801 2 0 0 1
1820 1820 ^Referer\x3a[^\r\n]+\/gate.php\r$/Hm 2 0 0 1
1821 1821 Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm 2 0 0 1
1822 1822 ^( Systems|\.com\/techsupport) 2 0 0 1
1823 1823 ^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2) 2 0 0 1
1824 1824 ^[0-9][^=] 2 0 0 1
1825 1825 ^\s*?\d[\d\x2e]{255} 2 0 0 1
1826 1826 ^\s*?\d[\d\x2e]{255} 2 0 0 1
1827 1827 \s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+? 2 0 0 1
1828 1828 ^..[^\x00]+\x00 2 0 0 1
1829 1829 ^..[^\x00]+\x00 2 0 0 1
1830 1830 ^..[^\x00]+\x00 2 0 0 1
1831 1831 ^..[^\x00]+\x00 2 0 0 1
1832 1832 ^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27] 2 0 0 1
1833 1833 ^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1) 2 0 0 1
1834 1834 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1835 1835 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1836 1836 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1
1837 1837 Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true 2 0 0 1
1838 1838 ^=\s*\x22\s*[^\s\x22\x28]{1000} 2 0 0 1
1839 1839 ^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300} 2 0 0 1
1840 1840 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$ 2 0 0 1
1841 1841 ^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4} 2 0 0 1
1842 1842 ^[^\x00]+\x00\x00\x01 2 0 0 1
1843 1843 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1844 1844 ^.{6}[^\x00]+ 2 0 0 1
1845 1845 ^.{6}[^\x00]+ 2 0 0 1
1846 1846 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1847 1847 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1
1848 1848 ^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a 2 0 0 1
1849 1849 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1850 1850 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1851 1851 ^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?) 2 0 0 1
1852 1852 ^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00 2 0 0 1
1853 1853 ^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b 2 0 0 1
1854 1854 ^\S+?drivestoredirect 2 0 0 1
1855 1855 ^\s*(f0VMR|9FTE|\/RUxG) 2 0 0 1
1856 1856 ^\s*=\s*[\x27\x22]\s*POST 2 0 0 1
1857 1857 ^.*?[\x24\x60] 2 0 0 1
1858 1858 ^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/ 2 0 0 1
1859 1859 ^\s*(\x28|\%28)s 2 0 0 1
1860 1860 ^\s*\d*[^\x20-\x7e\r\n\t] 2 0 0 1
1861 1861 ^[\x30-\x3f\x7D] 2 0 0 1
1862 1862 ^[\x30-\x3f\x7D] 2 0 0 1
1863 1863 AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s 2 0 0 1
1864 1864 ^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1
1865 1865 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
1866 1866 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1
1867 1867 errordict\s+\x2Finvalidfileaccess 2 0 0 1
1868 1868 errordict\s+\x2Finvalidfileaccess 2 0 0 1
1869 1869 \x2Ebindnow[^\x7D]*\x7D\s*stopped 2 0 0 1
1870 1870 \x2Ebindnow[^\x7D]+\x7D\s*stopped 2 0 0 1
1871 1871 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1872 1872 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1873 1873 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1874 1874 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1
1875 1875 ^\s* 2 0 0 1
1876 1876 ^\s* 2 0 0 1
1877 1877 ^\s* 2 0 0 1
1878 1878 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5} 2 0 0 1
1879 1879 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
1880 1880 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1
1881 1881 Template=.*\.\. 2 0 0 1
1882 1882 act\x3D[^\x26\s\r\n]{257} 2 0 0 1
1883 1883 app\x3D[^\x26\s\r\n]{257} 2 0 0 1
1884 1884 [\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,} 2 0 0 1
1885 1885 ^[\x50-\x59] 2 0 0 1
1886 1886 ^[^\r\n]*?\x60[^\x60]*?\$\{IFS\} 2 0 0 1
1887 1887 \bsolusvmc-node\b 2 0 0 1
1888 1888 ^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100} 2 0 0 1
1889 1889 ^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b 2 0 0 1
1890 1890 ^(\x25(25)*?20|\s)*?runmumaa\W 2 0 0 1
1891 1891 ^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22 2 0 0 1
1892 1892 ^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n]) 2 0 0 1
1893 1893 ^\s*\x28\s*[\x22\x27]\s*message 2 0 0 1
1894 1894 ^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28 2 0 0 1
1895 1895 ^[^\r\n]+\.hta\r?\n 2 0 0 1
1896 1896 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1897 1897 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1898 1898 ^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value) 2 0 0 1
1899 1899 ^[(\x60|%60)(\x27|%27)] 2 0 0 1
1900 1900 ^\/(home\/a3user|root)\/agile3\/patches\/ 2 0 0 1
1901 1901 ^.*?\x26 2 0 0 1
1902 1902 (\x0a|\\n)\/s1Caa6 2 0 0 1
1903 1903 ^(\\r\\n|\x0d\x0a)C 2 0 0 1
1904 1904 ^\d{3} 2 0 0 1
1905 1905 ^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8}) 2 0 0 1
1906 1906 ^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$ 2 0 0 1
1907 1907 ^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1
1908 1908 [\?\&]cmd_param=[^\&\r\n]{500} 2 0 0 1
1909 1909 (%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))) 2 0 0 1
1910 1910 ^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF])) 2 0 0 1
1911 1911 ^[^\x22]*[\x24\x60]+ 2 0 0 1
1912 1912 ^[^\x22]*[\x24\x60]+ 2 0 0 1
1913 1913 ^[a-z0-9\-_\.\/]+\x00 2 0 0 1
1914 1914 ^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f] 2 0 0 1
1915 1915 \/dev-report-overview\.html[^\"]*?\x3b 2 0 0 1
1916 1916 ^\s*\x22{2} 2 0 0 1
1917 1917 ^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d) 2 0 0 1
1918 1918 ^Host\x3a[^\n]{0,50}?\x3b 2 0 0 1
1919 1919 ^[\s>] 2 0 0 1
1920 1920 ^[\s>] 2 0 0 1
1921 1921 ^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f 2 0 0 1
1922 1922 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1923 1923 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1924 1924 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1925 1925 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1
1926 1926 ^\s*?\x29 2 0 0 1
1927 1927 ^\s*?\(x\s*,\s*1,\s*24000\s*\x29 2 0 0 1
1928 1928 ^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e 2 0 0 1
1929 1929 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1
1930 1930 =\s*\x25\s*\{\s*.+?\bProcessBuilder\b 2 0 0 1
1931 1931 ^[ a-zA-Z0-9+_]*[\x27\x3b] 2 0 0 1
1932 1932 destination=[^&]*\x24\x28 2 0 0 1
1933 1933 name=[^&]*\x24\x28 2 0 0 1
1934 1934 ^[^&]+\x2527(UNION|SELECT) 2 0 0 1
1935 1935 [^&]*(\x60|\x24) 2 0 0 1
1936 1936 (\x60|\x24) 2 0 0 1
1937 1937 (\/GponForm\/diag_FORM\?images\/|\.html\?images\/) 2 0 0 1
1938 1938 ^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1
1939 1939 ^(www\.)?(cisco|linksys)\.com\/jnap\/ 2 0 0 1
1940 1940 ^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) 2 0 0 1
1941 1941 (\%3C){1000} 2 0 0 1
1942 1942 A{1000} 2 0 0 1
1943 1943 id\=[^\r\n]*?(select|delete|union|update|insert) 2 0 0 1
1944 1944 ^\d{2,5}(\&|\d) 2 0 0 1
1945 1945 ^(8=|9BQQ==)\r?\n? 2 0 0 1
1946 1946 =\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b 2 0 0 1
1947 1947 ^[0-9]+ 2 0 0 1
1948 1948 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W 2 0 0 1
1949 1949 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W 2 0 0 1
1950 1950 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W 2 0 0 1
1951 1951 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W 2 0 0 1
1952 1952 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W 2 0 0 1
1953 1953 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W 2 0 0 1
1954 1954 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1955 1955 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1956 1956 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W 2 0 0 1
1957 1957 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W 2 0 0 1
1958 1958 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W 2 0 0 1
1959 1959 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
1960 1960 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W 2 0 0 1
1961 1961 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
1962 1962 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1963 1963 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1964 1964 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W 2 0 0 1
1965 1965 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W 2 0 0 1
1966 1966 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W 2 0 0 1
1967 1967 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W 2 0 0 1
1968 1968 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W 2 0 0 1
1969 1969 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W 2 0 0 1
1970 1970 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1971 1971 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1972 1972 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W 2 0 0 1
1973 1973 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W 2 0 0 1
1974 1974 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W 2 0 0 1
1975 1975 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1
1976 1976 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W 2 0 0 1
1977 1977 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1
1978 1978 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1
1979 1979 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1
1980 1980 ping_addr=[\d.]*[^\d.] 2 0 0 1
1981 1981 \?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b 2 0 0 1
1982 1982 ^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
1983 1983 ^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1
1984 1984 pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1
1985 1985 ^[^=]{1,}$ 2 0 0 1
1986 1986 ^\x22[^\x22]*\x3b[^\x22]*\x22/P 2 0 0 1
1987 1987 ^\s*[\x22\x27] 2 0 0 1
1988 1988 \.hta([?&]|$) 2 0 0 1
1989 1989 ^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e] 2 0 0 1
1990 1990 \%(25)?temp\% 2 0 0 1
1991 1991 ^[a-zA-Z0-9]+$ 2 0 0 1
1992 1992 [^&]*(\x60|\x24) 2 0 0 1
1993 1993 ^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi 2 0 0 1
1994 1994 (localhost|127\.0\.0\.1)/W 2 0 0 1
1995 1995 ^[^\r\n]{128,}\r\n 2 0 0 1
1996 1996 ^[^\+]+\+0A 2 0 0 1
1997 1997 ^[^\+]+(\+[A-F0-9]{2}){4,} 2 0 0 1
1998 1998 ^.{0,100}\+0A.{0,100}\x40 2 0 0 1
1999 1999 ^[^\r\n]{50,} 2 0 0 1
2000 2000 ^\S{0,7}\/(meeting|fb\/smb|namedusers|metric) 2 0 0 1
Reference in New Issue Copy Permalink