10000 1 1 User-Agent:\s.*.abc.net 2 0 0 1 2 2 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5 2 0 0 1 3 3 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980 2 0 0 1 4 4 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E 2 0 0 1 5 5 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333 2 0 0 1 6 6 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C 2 0 0 1 7 7 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E 2 0 0 1 8 8 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E 2 0 0 1 9 9 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E 2 0 0 1 10 10 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E 2 0 0 1 11 11 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08 2 0 0 1 12 12 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42 2 0 0 1 13 13 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4 2 0 0 1 14 14 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980 2 0 0 1 15 15 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3 2 0 0 1 16 16 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980 2 0 0 1 17 17 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB 2 0 0 1 18 18 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E 2 0 0 1 19 19 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E 2 0 0 1 20 20 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664 2 0 0 1 21 21 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C 2 0 0 1 22 22 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980 2 0 0 1 23 23 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E 2 0 0 1 24 24 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1 25 25 (EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters) 2 0 0 1 26 26 (SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1 27 27 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1 28 28 (ReadMolFile|SaveasMolFile) 2 0 0 1 29 29 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 30 30 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 31 31 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C 2 0 0 1 32 32 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 33 33 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 34 34 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000 2 0 0 1 35 35 file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt) 2 0 0 1 36 36 [0-9]{3,} 2 0 0 1 37 37 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194 2 0 0 1 38 38 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2 2 0 0 1 39 39 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510 2 0 0 1 40 40 (setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch) 2 0 0 1 41 41 param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20} 2 0 0 1 42 42 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C 2 0 0 1 43 43 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1 44 44 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79 2 0 0 1 45 45 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD 2 0 0 1 46 46 (Text|EditSelText|EditText|CellFontName|Archive) 2 0 0 1 47 47 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1 48 48 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c 2 0 0 1 49 49 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B 2 0 0 1 50 50 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA 2 0 0 1 51 51 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted) 2 0 0 1 52 52 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam) 2 0 0 1 53 53 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1 54 54 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8 2 0 0 1 55 55 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E 2 0 0 1 56 56 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726 2 0 0 1 57 57 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598 2 0 0 1 58 58 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E 2 0 0 1 59 59 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E 2 0 0 1 60 60 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E 2 0 0 1 61 61 (exe|bat|com|dll|ini) 2 0 0 1 62 62 (exe|bat|com|dll|ini) 2 0 0 1 63 63 (exe|bat|com|dll|ini) 2 0 0 1 64 64 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E 2 0 0 1 65 65 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7 2 0 0 1 66 66 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91 2 0 0 1 67 67 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980 2 0 0 1 68 68 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02 2 0 0 1 69 69 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3 2 0 0 1 70 70 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90 2 0 0 1 71 71 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E 2 0 0 1 72 72 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E 2 0 0 1 73 73 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112 2 0 0 1 74 74 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1 2 0 0 1 75 75 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 2 0 0 1 76 76 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F 2 0 0 1 77 77 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1 78 78 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA 2 0 0 1 79 79 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258 2 0 0 1 80 80 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B 2 0 0 1 81 81 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1 2 0 0 1 82 82 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7 2 0 0 1 83 83 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D 2 0 0 1 84 84 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61 2 0 0 1 85 85 (Src|Background|PackageXml) 2 0 0 1 86 86 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters) 2 0 0 1 87 87 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1 88 88 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 89 89 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 90 90 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 91 91 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755 2 0 0 1 92 92 (Save|SaveLayoutChanges|SaveMenuUsageData) 2 0 0 1 93 93 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61 2 0 0 1 94 94 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1 95 95 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1 96 96 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1 97 97 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1 98 98 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0 2 0 0 1 99 99 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3 2 0 0 1 100 100 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679 2 0 0 1 101 101 (SaveFile|ExportToXML) 2 0 0 1 102 102 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE 2 0 0 1 103 103 (SnapShotToFile|SnapShotX) 2 0 0 1 104 104 (SnapShotToFile|SnapShotX) 2 0 0 1 105 105 (SnapShotToFile|SnapShotX) 2 0 0 1 106 106 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1 107 107 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28 2 0 0 1 108 108 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003 2 0 0 1 109 109 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 110 110 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 111 111 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 112 112 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 113 113 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE 2 0 0 1 114 114 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB 2 0 0 1 115 115 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile) 2 0 0 1 116 116 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD 2 0 0 1 117 117 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA 2 0 0 1 118 118 (Run|SetRegistryValueAsString|PerformUpdateAsync) 2 0 0 1 119 119 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1 120 120 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1 121 121 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084 2 0 0 1 122 122 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6 2 0 0 1 123 123 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF 2 0 0 1 124 124 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5 2 0 0 1 125 125 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C 2 0 0 1 126 126 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA 2 0 0 1 127 127 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020 2 0 0 1 128 128 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020 2 0 0 1 129 129 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B 2 0 0 1 130 130 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356 2 0 0 1 131 131 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520 2 0 0 1 132 132 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C 2 0 0 1 133 133 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26 2 0 0 1 134 134 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0 2 0 0 1 135 135 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF 2 0 0 1 136 136 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142 2 0 0 1 137 137 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB 2 0 0 1 138 138 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7 2 0 0 1 139 139 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747 2 0 0 1 140 140 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456 2 0 0 1 141 141 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0 2 0 0 1 142 142 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999 2 0 0 1 143 143 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899 2 0 0 1 144 144 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5 2 0 0 1 145 145 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E 2 0 0 1 146 146 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F 2 0 0 1 147 147 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9 2 0 0 1 148 148 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F 2 0 0 1 149 149 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448 2 0 0 1 150 150 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92 2 0 0 1 151 151 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F 2 0 0 1 152 152 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED 2 0 0 1 153 153 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB 2 0 0 1 154 154 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305 2 0 0 1 155 155 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7 2 0 0 1 156 156 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B 2 0 0 1 157 157 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C 2 0 0 1 158 158 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627 2 0 0 1 159 159 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E 2 0 0 1 160 160 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE 2 0 0 1 161 161 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496 2 0 0 1 162 162 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0 2 0 0 1 163 163 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E 2 0 0 1 164 164 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C 2 0 0 1 165 165 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53 2 0 0 1 166 166 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014 2 0 0 1 167 167 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1 168 168 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1 169 169 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741 2 0 0 1 170 170 (SaveToBMP|SaveToFile) 2 0 0 1 171 171 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2 2 0 0 1 172 172 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667 2 0 0 1 173 173 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 174 174 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 175 175 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1 176 176 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D 2 0 0 1 177 177 (SaveBarCode|SaveEnhWMF) 2 0 0 1 178 178 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B 2 0 0 1 179 179 ]*\s*classid\s*=\s*(.+\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>) 2 0 0 1 180 180 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000 2 0 0 1 181 181 (exe|bat|com|dll|ini) 2 0 0 1 182 182 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E 2 0 0 1 183 183 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E 2 0 0 1 184 184 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87 2 0 0 1 185 185 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 186 186 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 187 187 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 188 188 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 189 189 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 190 190 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E 2 0 0 1 191 191 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344 2 0 0 1 192 192 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C 2 0 0 1 193 193 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30 2 0 0 1 194 194 (Packagefiles|SaveDna|SetIdentity|AddFile) 2 0 0 1 195 195 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9 2 0 0 1 196 196 (_DOWText)|(_MonthText) 2 0 0 1 197 197 (SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour) 2 0 0 1 198 198 classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE 2 0 0 1 199 199 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1 200 200 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1 201 201 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F 2 0 0 1 202 202 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5 2 0 0 1 203 203 [\w\W]{2500,} 2 0 0 1 204 204 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3 2 0 0 1 205 205 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8 2 0 0 1 206 206 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04 2 0 0 1 207 207 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue) 2 0 0 1 208 208 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356 2 0 0 1 209 209 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E 2 0 0 1 210 210 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574 2 0 0 1 211 211 (WriteIniFileString|ShellExecute) 2 0 0 1 212 212 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906 2 0 0 1 213 213 (txt|ini|com|exe|bat|dll|dat) 2 0 0 1 214 214 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8 2 0 0 1 215 215 42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733 2 0 0 1 216 216 (Save|ExportImage) 2 0 0 1 217 217 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790 2 0 0 1 218 218 (DeleteFile|write) 2 0 0 1 219 219 (SaveAsBMP|SaveAsWMF) 2 0 0 1 220 220 (SaveAsBMP|SaveAsWMF) 2 0 0 1 221 221 (SaveAsBMP|SaveAsWMF) 2 0 0 1 222 222 (SaveAsBMP|SaveAsWMF) 2 0 0 1 223 223 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967 2 0 0 1 224 224 WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext) 2 0 0 1 225 225 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9 2 0 0 1 226 226 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 2 0 0 1 227 227 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6 2 0 0 1 228 228 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 229 229 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1 230 230 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24 2 0 0 1 231 231 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9 2 0 0 1 232 232 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA 2 0 0 1 233 233 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec) 2 0 0 1 234 234 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5 2 0 0 1 235 235 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 236 236 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 237 237 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 238 238 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83 2 0 0 1 239 239 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA 2 0 0 1 240 240 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566 2 0 0 1 241 241 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1 242 242 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1 243 243 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B 2 0 0 1 244 244 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F 2 0 0 1 245 245 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1 246 246 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1 247 247 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED 2 0 0 1 248 248 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619 2 0 0 1 249 249 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E 2 0 0 1 250 250 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258 2 0 0 1 251 251 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196 2 0 0 1 252 252 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E 2 0 0 1 253 253 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD 2 0 0 1 254 254 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4 2 0 0 1 255 255 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118 2 0 0 1 256 256 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616 2 0 0 1 257 257 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 258 258 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 259 259 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 260 260 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11 2 0 0 1 261 261 (ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1 2 0 0 1 262 262 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020 2 0 0 1 263 263 (PostURL|AddSeperator|AddString|Post) 2 0 0 1 264 264 (SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF) 2 0 0 1 265 265 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>) 2 0 0 1 266 266 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\> 2 0 0 1 267 267 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\> 2 0 0 1 268 268 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\> 2 0 0 1 269 269 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1 270 270 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 271 271 (Buildpath|GetDriveName|DriveExists|DeleteFile) 2 0 0 1 272 272 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 273 273 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 274 274 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 275 275 ]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>) 2 0 0 1 276 276 \x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission] 2 0 0 1 277 277 ]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\> 2 0 0 1 278 278 000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F 2 0 0 1 279 279 (javascript|http|ftp|vbscript) 2 0 0 1 280 280 (SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen) 2 0 0 1 281 281 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000 2 0 0 1 282 282 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407 2 0 0 1 283 283 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414 2 0 0 1 284 284 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1 285 285 (AddAttachment|SubmitToExpress) 2 0 0 1 286 286 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6 2 0 0 1 287 287 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0 2 0 0 1 288 288 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D 2 0 0 1 289 289 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile) 2 0 0 1 290 290 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\> 2 0 0 1 291 291 ]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\> 2 0 0 1 292 292 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC 2 0 0 1 293 293 src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape 2 0 0 1 294 294 (LogFile|ClearLogFile|SaveToFile) 2 0 0 1 295 295 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext) 2 0 0 1 296 296 ^User-Agent\x3a Downloader \d\.\d\r?$/Hm 2 0 0 1 297 297 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P 2 0 0 1 298 298 ^((\r?\n\r?\n).)*?\r?\n\r?\nMZ 2 0 0 1 299 299 instructions\/\d{2}\.xml 2 0 0 1 300 300 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp 2 0 0 1 301 301 \/updatestats\/update\d+?\.xml$ 2 0 0 1 302 302 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab 2 0 0 1 303 303 ctxad-\d+\.sig 2 0 0 1 304 304 /user\d+/counter\.htm 2 0 0 1 305 305 (cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr 2 0 0 1 306 306 (discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe 2 0 0 1 307 307 loaderadv\d+\.jar 2 0 0 1 308 308 \/adv\/\d+\/win32\.exe 2 0 0 1 309 309 \/Message\/\S+\/\S+\.xml 2 0 0 1 310 310 \/abt\?data=\S{150} 2 0 0 1 311 311 ^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi 2 0 0 1 312 312 User-Agent\:[^\n]+wbi_v\d/iH 2 0 0 1 313 313 User-Agent\x3a[^\n]+AskBar/iH 2 0 0 1 314 314 \/tbrequest\d+\.php 2 0 0 1 315 315 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 316 316 sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 317 317 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 318 318 cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 319 319 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 320 320 UID=\d 2 0 0 1 321 321 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 322 322 REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P 2 0 0 1 323 323 victim\.php\?\d\d\d\d\d 2 0 0 1 324 324 \/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d 2 0 0 1 325 325 \/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+ 2 0 0 1 326 326 &ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d 2 0 0 1 327 327 \/sd\?s=\d+&f=\d&C=\d 2 0 0 1 328 328 \.txt$ 2 0 0 1 329 329 \.cfg$ 2 0 0 1 330 330 User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H 2 0 0 1 331 331 ^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi 2 0 0 1 332 332 \x00[\x02-\x1E][0-9]{2,30}\x02cn\x00 2 0 0 1 333 333 \x00[\x02-\x1E][0-9]{2,30}\x02ru\x00 2 0 0 1 334 334 ^[A-F0-9]+$ 2 0 0 1 335 335 \/sd\?s=\d+&f=\d 2 0 0 1 336 336 loadadv\d+\.exe 2 0 0 1 337 337 \/ms\d\d\dcfg\.jsp 2 0 0 1 338 338 ^0x[0-9a-f]+$ 2 0 0 1 339 339 ^[^a-z]*?[0-9]{2,30}\.ru$ 2 0 0 1 340 340 filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe 2 0 0 1 341 341 ^MM \d\.\d+$ 2 0 0 1 342 342 ^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4} 2 0 0 1 343 343 ^\w+pcsetup_\w+ 2 0 0 1 344 344 \x2Fv[0-9]{3,4}[\x2F\x3F] 2 0 0 1 345 345 [a-f0-9]{32}\?v= 2 0 0 1 346 346 ^\/[a-z]{2}\x3Fv\x3D[0-9]$ 2 0 0 1 347 347 ^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$ 2 0 0 1 348 348 ^\/entrance\?s1=[a-f0-9]{100,}$ 2 0 0 1 349 349 ^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report= 2 0 0 1 350 350 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 351 351 ^[0-9][a-z]+ 2 0 0 1 352 352 \.php$ 2 0 0 1 353 353 ^\/([^\x2f]+\/)*log\/\?[bc]= 2 0 0 1 354 354 ^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/)) 2 0 0 1 355 355 ^\/\?pcrc=\d+&v=[\d.]+$ 2 0 0 1 356 356 ^\/\?v=[\d.]+&pcrc=\d+$ 2 0 0 1 357 357 \/v\d\/[^.]+\.asp$ 2 0 0 1 358 358 \/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$ 2 0 0 1 359 359 \/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$ 2 0 0 1 360 360 ^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$ 2 0 0 1 361 361 ^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$ 2 0 0 1 362 362 \?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4}) 2 0 0 1 363 363 ^Downloader\s\d+\.\d+$ 2 0 0 1 364 364 ^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100} 2 0 0 1 365 365 \/get_xml\?(file_id|stb)= 2 0 0 1 366 366 (_[a-z]{2}){1,3}_[a-z]{3}_install\.exe 2 0 0 1 367 367 \d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows 2 0 0 1 368 368 ^[a-zA-Z0-9_-]+$ 2 0 0 1 369 369 ^\/([a-zA-Z0-9]|%2[fb]){400,}$ 2 0 0 1 370 370 User-Agent\:[^\n]+searchengine 2 0 0 1 371 371 User-Agent\:[^\n]+SurferPlugin 2 0 0 1 372 372 User-Agent\:[^\n]+THNALL[^\n]+\.EXE 2 0 0 1 373 373 User-Agent\:[^\n]+XupiterToolbar 2 0 0 1 374 374 User-Agent\:[^\n]+spywareaxe 2 0 0 1 375 375 User-Agent\:[^\n]+iMeshBar 2 0 0 1 376 376 User-Agent\:[^\n]+Oemji 2 0 0 1 377 377 ^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$ 2 0 0 1 378 378 ^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$ 2 0 0 1 379 379 ^\/(get|install)\/\?q= 2 0 0 1 380 380 ^\/[a-f0-9]{50,}$ 2 0 0 1 381 381 ^\/[\w-]{50,}$ 2 0 0 1 382 382 ^\/\?pcrc=[0-9]{7,10}$ 2 0 0 1 383 383 ^Downloader \d\.\d$ 2 0 0 1 384 384 \/Socks[45]\.txt$ 2 0 0 1 385 385 ^Feat[^\r\n]+(Install|Updat)er 2 0 0 1 386 386 User-Agent\:[^\n]+host(ie|oe|oi|ol) 2 0 0 1 387 387 User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2} 2 0 0 1 388 388 ^BWL(\sToplist|\d_UPDATE) 2 0 0 1 389 389 ^\x2F[A-F0-9]{25,40}$ 2 0 0 1 390 390 ^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$ 2 0 0 1 391 391 ^\d+\sHTTP/1.1$ 2 0 0 1 392 392 ^[a-zA-Z0-9_-]+ 2 0 0 1 393 393 [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12} 2 0 0 1 394 394 \/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id= 2 0 0 1 395 395 \{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\} 2 0 0 1 396 396 CN=([^\r\n]+?\.)?showmypc\.com(\.) 2 0 0 1 397 397 ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$ 2 0 0 1 398 398 (SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk) 2 0 0 1 399 399 (DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog) 2 0 0 1 400 400 \d{13}$ 2 0 0 1 401 401 ^[a-f0-9]{32} 2 0 0 1 402 402 ^[a-f0-9]{32}\" 2 0 0 1 403 403 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1 404 404 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12} 2 0 0 1 405 405 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1 406 406 ^[A-F0-9]{12} 2 0 0 1 407 407 ^[A-Z0-9]{9} 2 0 0 1 408 408 ^\d+[^\r\n\s]+ 2 0 0 1 409 409 ^ SQL[-_ ]Server 2 0 0 1 410 410 ^ \d+ Driver 2 0 0 1 411 411 ORA-\d{4} 2 0 0 1 412 412 Warning.*\Woci_ 2 0 0 1 413 413 Warning.*\Wora_ 2 0 0 1 414 414 CLI Driver.*DB2 2 0 0 1 415 415 bdb2_\w+\( 2 0 0 1 416 416 Exception.*Informix 2 0 0 1 417 417 Warning.*SQLite3:: 2 0 0 1 418 418 SQL error.*POS\([0-9]+\) 2 0 0 1 419 419 Warning.*maxdb 2 0 0 1 420 420 i?Warning.*sybase 2 0 0 1 421 421 Warning.*ingres_ 2 0 0 1 422 422 Warning.*sqlite_ 2 0 0 1 423 423 Ingres\W.*Driver 2 0 0 1 424 424 Exception (condition )\d+\. Transaction rollback\. 2 0 0 1 425 425 SQL Server.*?error \x27[0-9a-f]{8} 2 0 0 1 426 426 ^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$ 2 0 0 1 427 427 ^([a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll 2 0 0 1 428 428 ^...\x30\x82..\x02\x82...{256,257} 2 0 0 1 429 429 \/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php 2 0 0 1 430 430 \/notify\/(single|mass)$ 2 0 0 1 431 431 a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1 432 432 Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a 2 0 0 1 433 433 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 434 434 [-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10} 2 0 0 1 435 435 ^\d+(\+|\-|\\|\*)\d+ 2 0 0 1 436 436 ^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9 2 0 0 1 437 437 ^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u 2 0 0 1 438 438 ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b 2 0 0 1 439 439 ^\d{4}[01] 2 0 0 1 440 440 ^\d{4}[01] 2 0 0 1 441 441 ^\d{4}[01] 2 0 0 1 442 442 ^\d{4}[01] 2 0 0 1 443 443 ^\d{4}[01] 2 0 0 1 444 444 ^\d{4}[01] 2 0 0 1 445 445 ^\d{4}[01] 2 0 0 1 446 446 ^\d{4}[01] 2 0 0 1 447 447 ^\d{4}[01] 2 0 0 1 448 448 ^\d{4}[01] 2 0 0 1 449 449 ^\d{4}[01] 2 0 0 1 450 450 ^\d{4}[01] 2 0 0 1 451 451 ^\d{4}[01] 2 0 0 1 452 452 ^\d{4}[01] 2 0 0 1 453 453 ^\d{4}[01] 2 0 0 1 454 454 ^\d{4}[01] 2 0 0 1 455 455 ^\d{4}[01] 2 0 0 1 456 456 ^\d{4}[01] 2 0 0 1 457 457 ^\d{4}[01] 2 0 0 1 458 458 ^\d{4}[01] 2 0 0 1 459 459 ^\d{4}[01] 2 0 0 1 460 460 ^\d{4}[01] 2 0 0 1 461 461 ^\d{4}[01] 2 0 0 1 462 462 ^\d{4}[01] 2 0 0 1 463 463 ^\d{4}[01] 2 0 0 1 464 464 ^\d{4}[01] 2 0 0 1 465 465 ^\d{4}[01] 2 0 0 1 466 466 ^\d{4}[01] 2 0 0 1 467 467 ^\d{4}[01] 2 0 0 1 468 468 ^\d{4}[01] 2 0 0 1 469 469 ^\d{4}[01] 2 0 0 1 470 470 ^\d{4}[01] 2 0 0 1 471 471 ^\d{4}[01] 2 0 0 1 472 472 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 473 473 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 474 474 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 475 475 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 476 476 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 477 477 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 478 478 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 479 479 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 480 480 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 481 481 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 482 482 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 483 483 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 484 484 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 485 485 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 486 486 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 487 487 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 488 488 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 489 489 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 490 490 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 491 491 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 492 492 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 493 493 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 494 494 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 495 495 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 496 496 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 497 497 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 498 498 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 499 499 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 500 500 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 501 501 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 502 502 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 503 503 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 504 504 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 505 505 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 506 506 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 507 507 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 508 508 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 509 509 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 510 510 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 511 511 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 512 512 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 513 513 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 514 514 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 515 515 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 516 516 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 517 517 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 518 518 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 519 519 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 520 520 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 521 521 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 522 522 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 523 523 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 524 524 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 525 525 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 526 526 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 527 527 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 528 528 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 529 529 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 530 530 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 531 531 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 532 532 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 533 533 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 534 534 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 535 535 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 536 536 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 537 537 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 538 538 ^\d{4}[01] 2 0 0 1 539 539 ^\d{4}[01] 2 0 0 1 540 540 ^\d{4}[01] 2 0 0 1 541 541 ^\d{4}[01] 2 0 0 1 542 542 ^\d{4}[01] 2 0 0 1 543 543 ^\d{4}[01] 2 0 0 1 544 544 ^\d{4}[01] 2 0 0 1 545 545 ^\d{4}[01] 2 0 0 1 546 546 ^\d{4}[01] 2 0 0 1 547 547 ^\d{4}[01] 2 0 0 1 548 548 ^\d{4}[01] 2 0 0 1 549 549 ^\d{4}[01] 2 0 0 1 550 550 ^\d{4}[01] 2 0 0 1 551 551 ^\d{4}[01] 2 0 0 1 552 552 ^\d{4}[01] 2 0 0 1 553 553 ^\d{4}[01] 2 0 0 1 554 554 ^\d{4}[01] 2 0 0 1 555 555 ^\d{4}[01] 2 0 0 1 556 556 ^\d{4}[01] 2 0 0 1 557 557 ^\d{4}[01] 2 0 0 1 558 558 ^\d{4}[01] 2 0 0 1 559 559 ^\d{4}[01] 2 0 0 1 560 560 ^\d{4}[01] 2 0 0 1 561 561 ^\d{4}[01] 2 0 0 1 562 562 ^\d{4}[01] 2 0 0 1 563 563 ^\d{4}[01] 2 0 0 1 564 564 ^\d{4}[01] 2 0 0 1 565 565 ^\d{4}[01] 2 0 0 1 566 566 ^\d{4}[01] 2 0 0 1 567 567 ^\d{4}[01] 2 0 0 1 568 568 ^\d{4}[01] 2 0 0 1 569 569 ^\d{4}[01] 2 0 0 1 570 570 ^\d{4}[01] 2 0 0 1 571 571 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 572 572 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 573 573 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 574 574 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 575 575 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 576 576 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 577 577 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 578 578 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 579 579 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 580 580 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 581 581 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 582 582 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 583 583 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 584 584 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 585 585 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 586 586 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 587 587 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 588 588 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 589 589 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 590 590 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 591 591 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 592 592 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 593 593 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 594 594 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 595 595 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 596 596 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 597 597 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 598 598 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 599 599 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 600 600 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 601 601 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 602 602 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 603 603 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 604 604 ^\d{4}[01] 2 0 0 1 605 605 ^\d{4}[01] 2 0 0 1 606 606 ^\d{4}[01] 2 0 0 1 607 607 ^\d{4}[01] 2 0 0 1 608 608 ^\d{4}[01] 2 0 0 1 609 609 ^\d{4}[01] 2 0 0 1 610 610 ^\d{4}[01] 2 0 0 1 611 611 ^\d{4}[01] 2 0 0 1 612 612 ^\d{4}[01] 2 0 0 1 613 613 ^\d{4}[01] 2 0 0 1 614 614 ^\d{4}[01] 2 0 0 1 615 615 ^\d{4}[01] 2 0 0 1 616 616 ^\d{4}[01] 2 0 0 1 617 617 ^\d{4}[01] 2 0 0 1 618 618 ^\d{4}[01] 2 0 0 1 619 619 ^\d{4}[01] 2 0 0 1 620 620 ^\d{4}[01] 2 0 0 1 621 621 ^\d{4}[01] 2 0 0 1 622 622 ^\d{4}[01] 2 0 0 1 623 623 ^\d{4}[01] 2 0 0 1 624 624 ^\d{4}[01] 2 0 0 1 625 625 ^\d{4}[01] 2 0 0 1 626 626 ^\d{4}[01] 2 0 0 1 627 627 ^\d{4}[01] 2 0 0 1 628 628 ^\d{4}[01] 2 0 0 1 629 629 ^\d{4}[01] 2 0 0 1 630 630 ^\d{4}[01] 2 0 0 1 631 631 ^\d{4}[01] 2 0 0 1 632 632 ^\d{4}[01] 2 0 0 1 633 633 ^\d{4}[01] 2 0 0 1 634 634 ^\d{4}[01] 2 0 0 1 635 635 ^\d{4}[01] 2 0 0 1 636 636 ^\d{4}[01] 2 0 0 1 637 637 ^\d{4}[01] 2 0 0 1 638 638 ^\d{4}[01] 2 0 0 1 639 639 ^\d{4}[01] 2 0 0 1 640 640 ^\d{4}[01] 2 0 0 1 641 641 ^\d{4}[01] 2 0 0 1 642 642 ^\d{4}[01] 2 0 0 1 643 643 ^\d{4}[01] 2 0 0 1 644 644 ^\d{4}[01] 2 0 0 1 645 645 ^\d{4}[01] 2 0 0 1 646 646 ^\d{4}[01] 2 0 0 1 647 647 ^\d{4}[01] 2 0 0 1 648 648 ^\d{4}[01] 2 0 0 1 649 649 ^\d{4}[01] 2 0 0 1 650 650 ^\d{4}[01] 2 0 0 1 651 651 ^\d{4}[01] 2 0 0 1 652 652 ^\d{4}[01] 2 0 0 1 653 653 ^\d{4}[01] 2 0 0 1 654 654 ^\d{4}[01] 2 0 0 1 655 655 ^\d{4}[01] 2 0 0 1 656 656 ^\d{4}[01] 2 0 0 1 657 657 ^\d{4}[01] 2 0 0 1 658 658 ^\d{4}[01] 2 0 0 1 659 659 ^\d{4}[01] 2 0 0 1 660 660 ^\d{4}[01] 2 0 0 1 661 661 ^\d{4}[01] 2 0 0 1 662 662 ^\d{4}[01] 2 0 0 1 663 663 ^\d{4}[01] 2 0 0 1 664 664 ^\d{4}[01] 2 0 0 1 665 665 ^\d{4}[01] 2 0 0 1 666 666 ^\d{4}[01] 2 0 0 1 667 667 ^\d{4}[01] 2 0 0 1 668 668 ^\d{4}[01] 2 0 0 1 669 669 ^\d{4}[01] 2 0 0 1 670 670 ^\d{4}[01] 2 0 0 1 671 671 ^\d{4}[01] 2 0 0 1 672 672 ^\d{4}[01] 2 0 0 1 673 673 ^\d{4}[01] 2 0 0 1 674 674 ^\d{4}[01] 2 0 0 1 675 675 ^\d{4}[01] 2 0 0 1 676 676 ^\d{4}[01] 2 0 0 1 677 677 ^\d{4}[01] 2 0 0 1 678 678 ^\d{4}[01] 2 0 0 1 679 679 ^\d{4}[01] 2 0 0 1 680 680 ^\d{4}[01] 2 0 0 1 681 681 ^\d{4}[01] 2 0 0 1 682 682 ^\d{4}[01] 2 0 0 1 683 683 ^\d{4}[01] 2 0 0 1 684 684 ^\d{4}[01] 2 0 0 1 685 685 ^\d{4}[01] 2 0 0 1 686 686 ^\d{4}[01] 2 0 0 1 687 687 ^\d{4}[01] 2 0 0 1 688 688 ^\d{4}[01] 2 0 0 1 689 689 ^\d{4}[01] 2 0 0 1 690 690 ^\d{4}[01] 2 0 0 1 691 691 ^\d{4}[01] 2 0 0 1 692 692 ^\d{4}[01] 2 0 0 1 693 693 ^\d{4}[01] 2 0 0 1 694 694 ^\d{4}[01] 2 0 0 1 695 695 ^\d{4}[01] 2 0 0 1 696 696 ^\d{4}[01] 2 0 0 1 697 697 ^\d{4}[01] 2 0 0 1 698 698 ^\d{4}[01] 2 0 0 1 699 699 ^\d{4}[01] 2 0 0 1 700 700 ^\d{4}[01] 2 0 0 1 701 701 ^\d{4}[01] 2 0 0 1 702 702 ^\d{4}[01] 2 0 0 1 703 703 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 704 704 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 705 705 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 706 706 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 707 707 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 708 708 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 709 709 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 710 710 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 711 711 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 712 712 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 713 713 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 714 714 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 715 715 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 716 716 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 717 717 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 718 718 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 719 719 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 720 720 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 721 721 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 722 722 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 723 723 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 724 724 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 725 725 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 726 726 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 727 727 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 728 728 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 729 729 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 730 730 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 731 731 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 732 732 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 733 733 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 734 734 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 735 735 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 736 736 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 737 737 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 738 738 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 739 739 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 740 740 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 741 741 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 742 742 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 743 743 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 744 744 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 745 745 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 746 746 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 747 747 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 748 748 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 749 749 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 750 750 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 751 751 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 752 752 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 753 753 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 754 754 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 755 755 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 756 756 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 757 757 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 758 758 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 759 759 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 760 760 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 761 761 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 762 762 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 763 763 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 764 764 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 765 765 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 766 766 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 767 767 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 768 768 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 769 769 ^\d{4}[01] 2 0 0 1 770 770 ^\d{4}[01] 2 0 0 1 771 771 ^\d{4}[01] 2 0 0 1 772 772 ^\d{4}[01] 2 0 0 1 773 773 ^\d{4}[01] 2 0 0 1 774 774 ^\d{4}[01] 2 0 0 1 775 775 ^\d{4}[01] 2 0 0 1 776 776 ^\d{4}[01] 2 0 0 1 777 777 ^\d{4}[01] 2 0 0 1 778 778 ^\d{4}[01] 2 0 0 1 779 779 ^\d{4}[01] 2 0 0 1 780 780 ^\d{4}[01] 2 0 0 1 781 781 ^\d{4}[01] 2 0 0 1 782 782 ^\d{4}[01] 2 0 0 1 783 783 ^\d{4}[01] 2 0 0 1 784 784 ^\d{4}[01] 2 0 0 1 785 785 ^\d{4}[01] 2 0 0 1 786 786 ^\d{4}[01] 2 0 0 1 787 787 ^\d{4}[01] 2 0 0 1 788 788 ^\d{4}[01] 2 0 0 1 789 789 ^\d{4}[01] 2 0 0 1 790 790 ^\d{4}[01] 2 0 0 1 791 791 ^\d{4}[01] 2 0 0 1 792 792 ^\d{4}[01] 2 0 0 1 793 793 ^\d{4}[01] 2 0 0 1 794 794 ^\d{4}[01] 2 0 0 1 795 795 ^\d{4}[01] 2 0 0 1 796 796 ^\d{4}[01] 2 0 0 1 797 797 ^\d{4}[01] 2 0 0 1 798 798 ^\d{4}[01] 2 0 0 1 799 799 ^\d{4}[01] 2 0 0 1 800 800 ^\d{4}[01] 2 0 0 1 801 801 ^\d{4}[01] 2 0 0 1 802 802 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 803 803 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 804 804 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 805 805 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 806 806 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 807 807 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 808 808 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 809 809 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 810 810 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 811 811 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 812 812 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 813 813 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 814 814 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 815 815 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 816 816 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 817 817 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 818 818 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 819 819 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 820 820 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 821 821 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 822 822 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 823 823 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 824 824 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 825 825 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 826 826 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 827 827 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 828 828 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 829 829 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 830 830 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 831 831 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 832 832 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 833 833 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 834 834 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 835 835 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 836 836 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 837 837 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 838 838 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 839 839 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 840 840 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 841 841 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 842 842 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 843 843 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 844 844 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 845 845 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 846 846 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 847 847 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 848 848 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 849 849 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 850 850 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 851 851 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 852 852 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 853 853 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 854 854 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 855 855 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 856 856 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 857 857 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 858 858 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 859 859 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 860 860 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 861 861 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 862 862 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 863 863 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 864 864 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 865 865 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 866 866 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 867 867 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 868 868 ^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1 869 869 ^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1 870 870 \x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,} 2 0 0 1 871 871 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1 872 872 appid\x3a\s+2 2 0 0 1 873 873 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1 874 874 \x22mining\x2E(subscribe|authorize)\x22 2 0 0 1 875 875 ^\s*([a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start 2 0 0 1 876 876 ^\/api\/(bit|lite)coin\/balance\/ 2 0 0 1 877 877 miner[^a-z] 2 0 0 1 878 878 (\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22) 2 0 0 1 879 879 (\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22) 2 0 0 1 880 880 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 881 881 \/tmp\/[^\/]+\.swf$ 2 0 0 1 882 882 name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22 2 0 0 1 883 883 name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22 2 0 0 1 884 884 =[0-9a-f]{8}\.jar/H 2 0 0 1 885 885 ^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\? 2 0 0 1 886 886 ^\/[a-z0-9]{32}\?s=1$ 2 0 0 1 887 887 ^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s]))) 2 0 0 1 888 888 ^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>] 2 0 0 1 889 889 ^(mous)?\.class 2 0 0 1 890 890 \/chrome\/google_chrome_(update|installer)\.exe$ 2 0 0 1 891 891 ^[^\x22\x27\x3b]*?[\x22\x27]([0-7]{1,3})([^0-9a-f])([0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)((((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1 892 892 ^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P 2 0 0 1 893 893 findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$ 2 0 0 1 894 894 ^[^=]+[^\x22\x27\x3b]*?([\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m 2 0 0 1 895 895 \.php\?cashe=\d+$ 2 0 0 1 896 896 \.jar\?m=[1-2]$ 2 0 0 1 897 897 \.pdf\?p=1&s=[1-2]$ 2 0 0 1 898 898 ^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi 2 0 0 1 899 899 ^\/\?[A-Za-z0-9]+=([^&]+)&(=v1)=[^\/\.]+$ 2 0 0 1 900 900 \/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$ 2 0 0 1 901 901 \/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1 902 902 \/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1 903 903 \/tds\/[a-f0-9]{32}$ 2 0 0 1 904 904 ^[a-f0-9]{32}[\x22\x27] 2 0 0 1 905 905 Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi 2 0 0 1 906 906 (\.\.\/)+kboxwww\/tmp\/ 2 0 0 1 907 907 ^(.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22 2 0 0 1 908 908 ^Host\x3a (\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1 909 909 ^Host\x3a (\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1 910 910 \/\?[0-9a-f]{60,66}[\;\d\x2c]*$ 2 0 0 1 911 911 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15} 2 0 0 1 912 912 \/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php 2 0 0 1 913 913 debugenableplugins=[a-zA-Z0-9]+?\x3b 2 0 0 1 914 914 ^\/[a-z0-9]+\/load\.php$ 2 0 0 1 915 915 ^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1 916 916 ^\/xteas\/code$ 2 0 0 1 917 917 \/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash= 2 0 0 1 918 918 =\w{8}\.pdf/Hi 2 0 0 1 919 919 ^\/\?[A-Za-z0-9]+=([^&]+)&(=v1)=[A-Za-z0-9]+$ 2 0 0 1 920 920 ^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H 2 0 0 1 921 921 ^Host\x3a\s.+\.in\r?$/Hmi 2 0 0 1 922 922 name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22 2 0 0 1 923 923 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*(([^=&]+)=(=var1))?))$ 2 0 0 1 924 924 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*(([^=&]+)=(=var1))?))$ 2 0 0 1 925 925 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1 926 926 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1 927 927 ^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm 2 0 0 1 928 928 ^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket)) 2 0 0 1 929 929 ^(\/updates|\/license\/eula|\/docs\/office|\/software-activation) 2 0 0 1 930 930 ^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google)) 2 0 0 1 931 931 ^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b 2 0 0 1 932 932 ^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2) 2 0 0 1 933 933 \/api\/v1\/user\/(512|124)\/avatar 2 0 0 1 934 934 ^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01] 2 0 0 1 935 935 ^\/v1\/(queue|profile|docs\/wsdl|pull) 2 0 0 1 936 936 ^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/) 2 0 0 1 937 937 ^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check) 2 0 0 1 938 938 ^[^\n]*[\x00-\x08\x0e-\x1f] 2 0 0 1 939 939 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 940 940 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 941 941 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 942 942 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 943 943 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 944 944 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR)) 2 0 0 1 945 945 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1 946 946 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 947 947 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 948 948 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 949 949 (TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 950 950 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 951 951 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 952 952 (TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 953 953 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 954 954 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 955 955 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 956 956 (TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 957 957 (CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 958 958 (TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 959 959 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 960 960 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 961 961 (TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 962 962 (TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 963 963 (TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 964 964 (TOP|//)\Wsecret[^\w/a] 2 0 0 1 965 965 \[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\" 2 0 0 1 966 966 User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER 2 0 0 1 967 967 \x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20) 2 0 0 1 968 968 PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20) 2 0 0 1 969 969 \x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A 2 0 0 1 970 970 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000 2 0 0 1 971 971 filename\s*=\s*"WU_Details_.....\.zip 2 0 0 1 972 972 filename\s*=\s*MySpace_document_[0-9]{5}\.zip 2 0 0 1 973 973 filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22 2 0 0 1 974 974 filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22 2 0 0 1 975 975 ]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E 2 0 0 1 976 976 MyValue=[a-f0-9]{32} 2 0 0 1 977 977 \x0d\x0aUser-Agent\: 0\:0\:[^\n]{120} 2 0 0 1 978 978 User-Agent\: 0\:0\:[^\x0a|\x0d]{128} 2 0 0 1 979 979 01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20 2 0 0 1 980 980 (\.\.\/){1,} 2 0 0 1 981 981 \/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172} 2 0 0 1 982 982 03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C 2 0 0 1 983 983 4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B 2 0 0 1 984 984 php\?r=\d+&p= 2 0 0 1 985 985 \/socks\.php\?name=[^&]+&port=\d{1,5}$ 2 0 0 1 986 986 SELECT.+FROM 2 0 0 1 987 987 UNION\s+SELECT 2 0 0 1 988 988 INSERT.+INTO 2 0 0 1 989 989 DELETE.+FROM 2 0 0 1 990 990 ASCII\(.+SELECT 2 0 0 1 991 991 UPDATE.+SET 2 0 0 1 992 992 EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5 2 0 0 1 993 993 BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5 2 0 0 1 994 994 6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41 2 0 0 1 995 995 index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3) 2 0 0 1 996 996 (file=\|.+\|) 2 0 0 1 997 997 SELECT.+FROM 2 0 0 1 998 998 UNION\s+SELECT 2 0 0 1 999 999 INSERT.+INTO 2 0 0 1 1000 1000 DELETE.+FROM 2 0 0 1 1001 1001 ASCII\(.+SELECT 2 0 0 1 1002 1002 UPDATE.+SET 2 0 0 1 1003 1003 SELECT.+FROM 2 0 0 1 1004 1004 UNION\s+SELECT 2 0 0 1 1005 1005 INSERT.+INTO 2 0 0 1 1006 1006 DELETE.+FROM 2 0 0 1 1007 1007 ASCII\(.+SELECT 2 0 0 1 1008 1008 UPDATE.+SET 2 0 0 1 1009 1009 SELECT.+FROM 2 0 0 1 1010 1010 UNION\s+SELECT 2 0 0 1 1011 1011 INSERT.+INTO 2 0 0 1 1012 1012 DELETE.+FROM 2 0 0 1 1013 1013 ASCII\(.+SELECT 2 0 0 1 1014 1014 UPDATE.+SET 2 0 0 1 1015 1015 (TOP|//)\Wsecret[^\w/a] 2 0 0 1 1016 1016 filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22 2 0 0 1 1017 1017 \x2FU3D\x2FLength\x20172[0-5][0-9]{2} 2 0 0 1 1018 1018 \/000[a-z][0-9]{3}\x2Eso 2 0 0 1 1019 1019 \/000[a-z][0-9]{3}\x2Eexe 2 0 0 1 1020 1020 UPDATE.+SET 2 0 0 1 1021 1021 PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F] 2 0 0 1 1022 1022 ^FOLD\s[^\n]{256} 2 0 0 1 1023 1023 ^FOLD\s+\/ 2 0 0 1 1024 1024 ^Username\:[^\n]{100} 2 0 0 1 1025 1025 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1 1026 1026 ^http\x3a\x2f\x2f[^\n]{400} 2 0 0 1 1027 1027 ^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\} 2 0 0 1 1028 1028 ^file\x3a\x2f\x2f[^\n]{400} 2 0 0 1 1029 1029 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65) 2 0 0 1 1030 1030 OS 4_[0-3]_[1-4] like/H 2 0 0 1 1031 1031 [a-f0-9]{16}$ 2 0 0 1 1032 1032 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1 1033 1033 (/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration) 2 0 0 1 1034 1034 \x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02 2 0 0 1 1035 1035 \x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02 2 0 0 1 1036 1036 NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A 2 0 0 1 1037 1037 \x3a.4\x7c.12.\x3a.4 2 0 0 1 1038 1038 (cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta) 2 0 0 1 1039 1039 keepalive([0-9]{4}|\x7c[0-9]{4}) 2 0 0 1 1040 1040 User-Agent\x3a[^\n]+sbu-hb- 2 0 0 1 1041 1041 User-Agent\:[^\n]+Peer Points/iH 2 0 0 1 1042 1042 User-Agent\:[^\n]+zbu-hb-/Hi 2 0 0 1 1043 1043 User-Agent\:[^\n]+HSN/iH 2 0 0 1 1044 1044 User-Agent\:[^\n]+Wildtangent/iH 2 0 0 1 1045 1045 ^RMD\s+\x2f$ 2 0 0 1 1046 1046 User-Agent\x3A[^\n]+TheWorld/H 2 0 0 1 1047 1047 ^Max-dotdot[\s\r\n]*\d{3,} 2 0 0 1 1048 1048 ^Authorization\x3a Basic\s+= 2 0 0 1 1049 1049 ^Authorization\x3a Basic\s+= 2 0 0 1 1050 1050 Host\x3a\s[a-z]{16}\.ru/H 2 0 0 1 1051 1051 CREATE.+ENDPOINT 2 0 0 1 1052 1052 \/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir= 2 0 0 1 1053 1053 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1 1054 1054 MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w 2 0 0 1 1055 1055 \x00[0-9]{4,7}\x02co\x00 2 0 0 1 1056 1056 \x2fsogou(config)?\x2f 2 0 0 1 1057 1057 \/\d{8,}\/\d{4,}\/\d{4,}\.jsp 2 0 0 1 1058 1058 adv\d+\.php 2 0 0 1 1059 1059 a=\%[0-9a-fA-F]{2}\&b 2 0 0 1 1060 1060 \Wcustomer\slist(s)?\W 2 0 0 1 1061 1061 \Wtransaction\shistor(y|ies)\W 2 0 0 1 1062 1062 \Wcredit\shistor(y|ies)\W 2 0 0 1 1063 1063 \Wannual\sincome(s)?\W 2 0 0 1 1064 1064 \Wpayment\shistory\W 2 0 0 1 1065 1065 \Waccount\sbalance(s)?\W 2 0 0 1 1066 1066 \Wappraisal(s)?\W 2 0 0 1 1067 1067 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1 1068 1068 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1 1069 1069 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1 1070 1070 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1 1071 1071 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1 1072 1072 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1 1073 1073 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1 1074 1074 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1 1075 1075 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1 1076 1076 \Winternal\suse\sonly\W 2 0 0 1 1077 1077 \Wlaw\senforcement\ssensitive\W 2 0 0 1 1078 1078 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1 1079 1079 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1 1080 1080 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1 1081 1081 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1 1082 1082 (//)\Wtop\ssecret[^\w/a] 2 0 0 1 1083 1083 (//)\Wconfidential[^\w/] 2 0 0 1 1084 1084 (//)\Wrestricted[^\w/] 2 0 0 1 1085 1085 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1 1086 1086 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1 1087 1087 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1 1088 1088 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1 1089 1089 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1 1090 1090 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1 1091 1091 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1 1092 1092 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1 1093 1093 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1 1094 1094 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1 1095 1095 //((NATO\sSECRET)|NS)//MR 2 0 0 1 1096 1096 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1 1097 1097 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1 1098 1098 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1 1099 1099 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1100 1100 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1101 1101 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1102 1102 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1103 1103 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1104 1104 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1 1105 1105 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1106 1106 //FGI[\s\w,/-]*(//X5) 2 0 0 1 1107 1107 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1 1108 1108 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1109 1109 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1110 1110 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1111 1111 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1112 1112 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1113 1113 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1114 1114 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1115 1115 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1116 1116 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1117 1117 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1118 1118 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1119 1119 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1120 1120 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1121 1121 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1 1122 1122 (//)\Wrestricted[^\w/] 2 0 0 1 1123 1123 (//)\Wtop\ssecret[^\w/a] 2 0 0 1 1124 1124 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1 1125 1125 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1 1126 1126 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1 1127 1127 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1 1128 1128 \Wlaw\senforcement\ssensitive\W 2 0 0 1 1129 1129 \Winternal\suse\sonly\W 2 0 0 1 1130 1130 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1 1131 1131 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1 1132 1132 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1 1133 1133 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1 1134 1134 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1 1135 1135 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1 1136 1136 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1 1137 1137 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1 1138 1138 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1 1139 1139 \Wappraisal(s)?\W 2 0 0 1 1140 1140 \Waccount\sbalance(s)?\W 2 0 0 1 1141 1141 \Wannual\sincome(s)?\W 2 0 0 1 1142 1142 \Wcredit\shistor(y|ies)\W 2 0 0 1 1143 1143 \Wtransaction\shistor(y|ies)\W 2 0 0 1 1144 1144 \Wcustomer\slist(s)?\W 2 0 0 1 1145 1145 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1 1146 1146 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1 1147 1147 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1 1148 1148 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1 1149 1149 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1 1150 1150 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1 1151 1151 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1 1152 1152 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1 1153 1153 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1 1154 1154 //((NATO\sSECRET)|NS)//MR 2 0 0 1 1155 1155 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1 1156 1156 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1 1157 1157 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1 1158 1158 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1159 1159 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1160 1160 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1161 1161 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1162 1162 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1163 1163 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1 1164 1164 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1165 1165 //FGI[\s\w,/-]*(//X5) 2 0 0 1 1166 1166 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1 1167 1167 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1168 1168 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1169 1169 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1170 1170 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1171 1171 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1172 1172 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1173 1173 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1174 1174 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1175 1175 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1176 1176 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1177 1177 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1178 1178 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1179 1179 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1180 1180 \Wprivate\W(/(25)?X[1-9]) 2 0 0 1 1181 1181 (//)\Wrestricted[^\w/] 2 0 0 1 1182 1182 (//)\Wconfidential[^\w/] 2 0 0 1 1183 1183 (//)\Wtop\ssecret[^\w/a] 2 0 0 1 1184 1184 \Wsealed\W(/(25)?X[1-9]) 2 0 0 1 1185 1185 (law\senforcement)\Wsensitive\W(/(25)?X[1-9]) 2 0 0 1 1186 1186 \Wproprietary\W(/(25)?X[1-9]) 2 0 0 1 1187 1187 \Wprotected\W(/(25)?X[1-9]) 2 0 0 1 1188 1188 \Wlaw\senforcement\ssensitive\W 2 0 0 1 1189 1189 \Winternal\suse\sonly\W 2 0 0 1 1190 1190 [^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8}) 2 0 0 1 1191 1191 \Whcpcs\W[\s\w,/-]*([a-z][0-9]{10}) 2 0 0 1 1192 1192 \Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2}) 2 0 0 1 1193 1193 \Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2})) 2 0 0 1 1194 1194 \Wada\W[\s\w,/-]*(d[0-9]{4}) 2 0 0 1 1195 1195 \Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2}))) 2 0 0 1 1196 1196 \Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5}) 2 0 0 1 1197 1197 \Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11}) 2 0 0 1 1198 1198 \W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W 2 0 0 1 1199 1199 \Wappraisal(s)?\W 2 0 0 1 1200 1200 \Waccount\sbalance(s)?\W 2 0 0 1 1201 1201 \Wpayment\shistory\W 2 0 0 1 1202 1202 \Wannual\sincome(s)?\W 2 0 0 1 1203 1203 \Wcredit\shistor(y|ies)\W 2 0 0 1 1204 1204 \Wtransaction\shistor(y|ies)\W 2 0 0 1 1205 1205 \Wcustomer\slist(s)?\W 2 0 0 1 1206 1206 //([A-Z]{3}\s)+RESTRICTED//X5 2 0 0 1 1207 1207 //([A-Z]{3}\s)+CONFIDENTIAL//X5 2 0 0 1 1208 1208 //([A-Z]{3}\s)+TOP\sSECRET//X5 2 0 0 1 1209 1209 //([A-Z]{3}\s)+(TOP\s)SECRET//X5 2 0 0 1 1210 1210 //((NATO\sRESTRICTED)|NR)//MR 2 0 0 1 1211 1211 //((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR 2 0 0 1 1212 1212 //((NATO\sCONFIDENTIAL)|NC)//MR 2 0 0 1 1213 1213 //((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR 2 0 0 1 1214 1214 //((NATO\sSECRET\sATOMAL)|NSA)//MR 2 0 0 1 1215 1215 //((NATO\sSECRET)|NS)//MR 2 0 0 1 1216 1216 QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n) 2 0 0 1 1217 1217 QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n) 2 0 0 1 1218 1218 QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n) 2 0 0 1 1219 1219 (CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1220 1220 (TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1221 1221 (UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1222 1222 (CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1223 1223 (TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1224 1224 (TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR) 2 0 0 1 1225 1225 (TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1226 1226 //FGI[\s\w,/-]*(//X5) 2 0 0 1 1227 1227 (UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO) 2 0 0 1 1228 1228 (CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1229 1229 (TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1230 1230 (CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1231 1231 (TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1232 1232 (UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1233 1233 (CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1234 1234 (TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1235 1235 (CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1236 1236 (TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR) 2 0 0 1 1237 1237 SAMI[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1238 1238 (CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1239 1239 (TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1240 1240 (TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9]) 2 0 0 1 1241 1241 User-Agent\x3a \d{6}\x0d\x0a/H 2 0 0 1 1242 1242 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping 2 0 0 1 1243 1243 \.dyndns\.((biz|info|org|tv))\x0d\x0a/iH 2 0 0 1 1244 1244 \.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH 2 0 0 1 1245 1245 \.jpg\?t\x3d\d\.\d 2 0 0 1 1246 1246 [0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$ 2 0 0 1 1247 1247 ^Content-Length\x3a\s*-\d+ 2 0 0 1 1248 1248 \W[0-9]{5}\.jar 2 0 0 1 1249 1249 machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+} 2 0 0 1 1250 1250 [0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$ 2 0 0 1 1251 1251 ^[a-z0-9]{6}..\x00\x00 2 0 0 1 1252 1252 ^[a-z0-9]{7}..\x00\x00 2 0 0 1 1253 1253 \sLOGIN\s[^\n]*?% 2 0 0 1 1254 1254 ({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+})) 2 0 0 1 1255 1255 ^\/\?[a-f0-9]{32}$ 2 0 0 1 1256 1256 [a-z]{9}[0-9]\.exe/H 2 0 0 1 1257 1257 \.php\?inst_result=.+&hwid= 2 0 0 1 1258 1258 ^.{1,5}[a-f0-9]{100} 2 0 0 1 1259 1259 \/scr5\.php\?p=\d+&id=\d 2 0 0 1 1260 1260 ^User-Agent\: App\d/Hmi 2 0 0 1 1261 1261 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1 1262 1262 \x00\x07[a-z]{7}\x02eu\x00 2 0 0 1 1263 1263 REGISTER.{400} 2 0 0 1 1264 1264 \/content\/jav\d?\.jar$ 2 0 0 1 1265 1265 ^\/\?[a-f0-9]{32}$ 2 0 0 1 1266 1266 \.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}& 2 0 0 1 1267 1267 ^HTTP\x2f1\.[01] 200 2 0 0 1 1268 1268 \.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])& 2 0 0 1 1269 1269 IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 1270 1270 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$ 2 0 0 1 1271 1271 \.(jpg|png|gif|cgi)\?pr= 2 0 0 1 1272 1272 ^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$ 2 0 0 1 1273 1273 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1274 1274 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1275 1275 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1276 1276 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1277 1277 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1278 1278 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1279 1279 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1280 1280 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1281 1281 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1282 1282 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1283 1283 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1284 1284 (POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl 2 0 0 1 1285 1285 \x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$ 2 0 0 1 1286 1286 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1287 1287 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1288 1288 ^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H 2 0 0 1 1289 1289 ^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/ 2 0 0 1 1290 1290 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1 1291 1291 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$ 2 0 0 1 1292 1292 applet\/code=[\x22\x27]([a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27] 2 0 0 1 1293 1293 code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22 2 0 0 1 1294 1294 \x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D 2 0 0 1 1295 1295 \x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$ 2 0 0 1 1296 1296 ^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1 1297 1297 \.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$ 2 0 0 1 1298 1298 ^\d+?.\x00\x00\x00 2 0 0 1 1299 1299 \/[0-9a-f]{32}\.jar$ 2 0 0 1 1300 1300 \/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1 1301 1301 ^[^OGHPDTCMLUVRBAS] 2 0 0 1 1302 1302 &s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi 2 0 0 1 1303 1303 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1 1304 1304 AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 1305 1305 DELETE.+FROM 2 0 0 1 1306 1306 UNION.+SELECT 2 0 0 1 1307 1307 UPDATE.+SET 2 0 0 1 1308 1308 ASCII\(.+SELECT 2 0 0 1 1309 1309 DELETE.+FROM 2 0 0 1 1310 1310 INSERT.+INTO 2 0 0 1 1311 1311 UNION\s+SELECT 2 0 0 1 1312 1312 SELECT.+FROM 2 0 0 1 1313 1313 UPDATE.+SET 2 0 0 1 1314 1314 ASCII\(.+SELECT 2 0 0 1 1315 1315 DELETE.+FROM 2 0 0 1 1316 1316 INSERT.+INTO 2 0 0 1 1317 1317 SELECT.+FROM 2 0 0 1 1318 1318 \/\S+\.cab 2 0 0 1 1319 1319 User-Agent\x3a[^\n]+AskTB/iH 2 0 0 1 1320 1320 (

[0-7]{3})([0-7]{3})(=p)(=d)([0-7]{3}){10}([0-7]{3})[0-7]{3}([0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q) 2 0 0 1 1321 1321 (

[0-7]{2,4})([^0-7])(((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}([0-7]{2,4})(=sep)[0-7]{2,4}(=sep)([0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q) 2 0 0 1 1322 1322 ^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$ 2 0 0 1 1323 1323 \/gate\.php\?cmd=urls$ 2 0 0 1 1324 1324 \/gate\.php\?cmd=getexe$ 2 0 0 1 1325 1325 ^User-Agent\x3a[^\r\n]*?\sMSIE\s/H 2 0 0 1 1326 1326 ^.{2}(([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email) 2 0 0 1 1327 1327 [^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00 2 0 0 1 1328 1328 [^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00 2 0 0 1 1329 1329 [^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00 2 0 0 1 1330 1330 \x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7} 2 0 0 1 1331 1331 \.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 1332 1332 \.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$ 2 0 0 1 1333 1333 ^\/[A-Za-z0-9]{7,8}\/index\.html?$ 2 0 0 1 1334 1334 ^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$ 2 0 0 1 1335 1335 ^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1 1336 1336 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1337 1337 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1338 1338 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1339 1339 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1340 1340 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 1341 1341 ^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$ 2 0 0 1 1342 1342 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1 1343 1343 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1 1344 1344 \/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$ 2 0 0 1 1345 1345 ^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2} 2 0 0 1 1346 1346 ^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1 1347 1347 Server\: nginx/[a-zA-Z] 2 0 0 1 1348 1348 ^\x23\d\d\d\x2f\x21 2 0 0 1 1349 1349 XPantivirus20\d{2}_v\d{6}\.exe 2 0 0 1 1350 1350 \d\d\d\d\d\d\x0a 2 0 0 1 1351 1351 PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S 2 0 0 1 1352 1352 [0-9A-Z]{240,} 2 0 0 1 1353 1353 \x26[\x00-\xff]\x09\x00 2 0 0 1 1354 1354 \x26[\x00-\xff]\x09\x00 2 0 0 1 1355 1355 \.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt= 2 0 0 1 1356 1356 OS 4_[0-3]_[1-4] like/H 2 0 0 1 1357 1357 \.php\?f=\d+$ 2 0 0 1 1358 1358 Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H 2 0 0 1 1359 1359 User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H 2 0 0 1 1360 1360 \.php\?t=\d{2,7}$ 2 0 0 1 1361 1361 filename=.*facebook.*\.(rar|exe|zip) 2 0 0 1 1362 1362 filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip) 2 0 0 1 1363 1363 flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe 2 0 0 1 1364 1364 \x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D 2 0 0 1 1365 1365 MalvRem_\d{3,4}\.exe 2 0 0 1 1366 1366 avdistr_\d{3,4}\.exe 2 0 0 1 1367 1367 RunAV_\d{3,4}\.exe 2 0 0 1 1368 1368 installer\.\d{4}\.exe 2 0 0 1 1369 1369 \/stetement_id\.\d+\/ 2 0 0 1 1370 1370 ^\/stream\?\d$ 2 0 0 1 1371 1371 loads2\.php\?r=[0-9]{2}\.[0-9] 2 0 0 1 1372 1372 ^[\x20-\x7e]{5}.{4}\x7c\x01 2 0 0 1 1373 1373 (\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1 2 0 0 1 1374 1374 &cid=\d+$ 2 0 0 1 1375 1375 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1 1376 1376 ^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi 2 0 0 1 1377 1377 ^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/ 2 0 0 1 1378 1378 ^Content-Length\x3a 2\d{2}\r?$/Hmi 2 0 0 1 1379 1379 \/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$ 2 0 0 1 1380 1380 \.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r]) 2 0 0 1 1381 1381 \x2B\x22l\x22(\x3B|\x5D) 2 0 0 1 1382 1382 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 1383 1383 ^Referer\x3a[^\r\n]+\.swf/Hmi 2 0 0 1 1384 1384 \.jpg\?id=\d+$ 2 0 0 1 1385 1385 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1 1386 1386 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1 1387 1387 ^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$ 2 0 0 1 1388 1388 ^\/h[a-z]{3}\.html?$ 2 0 0 1 1389 1389 ^\/[0-9]{8}\.html$ 2 0 0 1 1390 1390 ^\/lists\/\d{15}(\d{5})?$ 2 0 0 1 1391 1391 ^\/[a-z0-9]{2}\.jar$ 2 0 0 1 1392 1392 ^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$ 2 0 0 1 1393 1393 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])([a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 1394 1394 ^([a-zA-Z]{0,119}[0-9])([a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 1395 1395 ^\/0[a-z0-9]{13}$ 2 0 0 1 1396 1396 ^\/[-a-zA-Z0-9_]{70,75}==?$ 2 0 0 1 1397 1397 ^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi 2 0 0 1 1398 1398 \/[a-f0-9]{32}\.eot$ 2 0 0 1 1399 1399 ^\/0[a-z0-9]{13}$ 2 0 0 1 1400 1400 ^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\?? 2 0 0 1 1401 1401 ^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00 2 0 0 1 1402 1402 ^(\x62|\x1b) 2 0 0 1 1403 1403 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])3((=sep)|\d)*?$ 2 0 0 1 1404 1404 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])4((=sep)|\d)*?$ 2 0 0 1 1405 1405 ^(\x8b|\xf2) 2 0 0 1 1406 1406 ^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$ 2 0 0 1 1407 1407 ^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi 2 0 0 1 1408 1408 GRANT.{1,5}TO 2 0 0 1 1409 1409 ^\/\?[a-f0-9]{32}$ 2 0 0 1 1410 1410 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])0((=sep)|\d)*?$ 2 0 0 1 1411 1411 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])1((=sep)|\d)*?$ 2 0 0 1 1412 1412 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])2((=sep)|\d)*?$ 2 0 0 1 1413 1413 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])5((=sep)|\d)*?$ 2 0 0 1 1414 1414 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])6((=sep)|\d)*?$ 2 0 0 1 1415 1415 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])7((=sep)|\d)*?$ 2 0 0 1 1416 1416 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])8((=sep)|\d)*?$ 2 0 0 1 1417 1417 ^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}([\x2c\x3b])9((=sep)|\d)*?$ 2 0 0 1 1418 1418 \/\w{1,2}\/\w{1,2}\.class$ 2 0 0 1 1419 1419 User-Agent\:[^\n]+zb-hb-/Hi 2 0 0 1 1420 1420 ^[^\r\n]*\/[0-9a-f]{78}\sHTTP 2 0 0 1 1421 1421 Referer\x3a\x20http\x3a\x2f+([^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi 2 0 0 1 1422 1422 Host\x3a\x20([^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1 1423 1423 ^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$ 2 0 0 1 1424 1424 Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H 2 0 0 1 1425 1425 &id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$ 2 0 0 1 1426 1426 \/pd\.php\?id=[a-f0-9]+$ 2 0 0 1 1427 1427 ^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D 2 0 0 1 1428 1428 ^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm 2 0 0 1 1429 1429 ^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27]) 2 0 0 1 1430 1430 filename=\x22\d+?\x22/P 2 0 0 1 1431 1431 ^\/log\.php\?f=[0-1](\.[a-z]+)?$ 2 0 0 1 1432 1432 (

[0-9a-f]{2,4})([\x2e\x2c\x3b\x3a])(((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}((((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)((((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q) 2 0 0 1 1433 1433 ^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi 2 0 0 1 1434 1434 ^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H 2 0 0 1 1435 1435 ^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\} 2 0 0 1 1436 1436 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1 1437 1437 \/j[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1 1438 1438 \/j[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1 1439 1439 \/f[a-z]+?\?f[a-z]+[a-z]+$ 2 0 0 1 1440 1440 \.php$ 2 0 0 1 1441 1441 \.php$ 2 0 0 1 1442 1442 GET\s[^\r\n]*?(\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n 2 0 0 1 1443 1443 ^\d{4}\r$ 2 0 0 1 1444 1444 ^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi 2 0 0 1 1445 1445 \/form\/submit\/$ 2 0 0 1 1446 1446 pch\.php\?f=\d+$ 2 0 0 1 1447 1447 hcp_vbs\.php\?f=\d+&d=\d+$ 2 0 0 1 1448 1448 \.php\?e=\w+&f=\w+$ 2 0 0 1 1449 1449 pch2.php?c=\d+$ 2 0 0 1 1450 1450 \.jar\?t=\d+&h=[^&]+$ 2 0 0 1 1451 1451 \/adp\d\.php\[0-9a-z]{2,6} 2 0 0 1 1452 1452 attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1 1453 1453 attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1 1454 1454 attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1 1455 1455 attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1 1456 1456 hhcp.php?c=[a-f0-9]{5}$ 2 0 0 1 1457 1457 attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi 2 0 0 1 1458 1458 \/content\/jav\d?\.jar$ 2 0 0 1 1459 1459 \.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d] 2 0 0 1 1460 1460 =.*[a-f].*$ 2 0 0 1 1461 1461 [a-f0-9]{10}<\/title> 2 0 0 1 1462 1462 =[0-9a-f]{8}\.jar/H 2 0 0 1 1463 1463 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$ 2 0 0 1 1464 1464 \x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$ 2 0 0 1 1465 1465 display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E 2 0 0 1 1466 1466 (\x3D|\x5B\x22])e\x22\x2B\x22va 2 0 0 1 1467 1467 (\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a 2 0 0 1 1468 1468 (\x3D|\x5B\x22])ev\x22\x2B\x22a 2 0 0 1 1469 1469 \x2B\x22al\x22(\x3B|\x5D) 2 0 0 1 1470 1470 \x2B\x22val\x22(\x3B|\x5D) 2 0 0 1 1471 1471 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1472 1472 \.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}= 2 0 0 1 1473 1473 ^.{1,5}[a-f0-9]{100} 2 0 0 1 1474 1474 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1475 1475 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1476 1476 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1477 1477 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1478 1478 \.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$ 2 0 0 1 1479 1479 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$ 2 0 0 1 1480 1480 \/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php 2 0 0 1 1481 1481 \/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$ 2 0 0 1 1482 1482 \/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php 2 0 0 1 1483 1483 ^\/[0-9a-f]{16}\/q\.php$ 2 0 0 1 1484 1484 ^\/[0-9a-f]{16}\/q\.php 2 0 0 1 1485 1485 ^\/[0-9a-f]{32}\/ff\.php$ 2 0 0 1 1486 1486 ^\/[0-9a-f]{32}\/ff\.php 2 0 0 1 1487 1487 ^\/[0-9a-f]{16}\/ff\.php$ 2 0 0 1 1488 1488 ^\/[0-9a-f]{16}\/ff\.php 2 0 0 1 1489 1489 ^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php 2 0 0 1 1490 1490 &jopa=\d+$ 2 0 0 1 1491 1491 \.php\?jnlp=[a-f0-9]{10}(,|$) 2 0 0 1 1492 1492 \/[0-9a-f]{32}\/a\.php$ 2 0 0 1 1493 1493 \/[0-9a-f]{32}\/a\.php 2 0 0 1 1494 1494 \/[0-9a-f]{16}\/a\.php$ 2 0 0 1 1495 1495 \/[0-9a-f]{16}\/a\.php 2 0 0 1 1496 1496 \.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}& 2 0 0 1 1497 1497 \/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$ 2 0 0 1 1498 1498 ^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q) 2 0 0 1 1499 1499 \.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}& 2 0 0 1 1500 1500 \.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?& 2 0 0 1 1501 1501 \.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?& 2 0 0 1 1502 1502 ^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$ 2 0 0 1 1503 1503 @\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.] 2 0 0 1 1504 1504 ^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1 1505 1505 ^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1 1506 1506 ^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm 2 0 0 1 1507 1507 ^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27] 2 0 0 1 1508 1508 ^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27] 2 0 0 1 1509 1509 ^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$ 2 0 0 1 1510 1510 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1 1511 1511 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1 1512 1512 ^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm 2 0 0 1 1513 1513 ^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22 2 0 0 1 1514 1514 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1 1515 1515 Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi 2 0 0 1 1516 1516 Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi 2 0 0 1 1517 1517 ^\s*?<\/body>\s*?\s*?<\/html>\s*?$ 2 0 0 1 1518 1518 ^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1) 2 0 0 1 1519 1519 ^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1 1520 1520 ^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$ 2 0 0 1 1521 1521 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1 1522 1522 ^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27] 2 0 0 1 1523 1523 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1 1524 1524 ^\s*=\s*[\x22\x27][a-z]+[\x22\x27] 2 0 0 1 1525 1525 ^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27] 2 0 0 1 1526 1526 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1 1527 1527 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1 1528 1528 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1 1529 1529 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space) 2 0 0 1 1530 1530 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1 1531 1531 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27] 2 0 0 1 1532 1532 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space) 2 0 0 1 1533 1533 ^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space) 2 0 0 1 1534 1534 \/m[a-z]+?\?l[a-z]+[a-z]+$ 2 0 0 1 1535 1535 ^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P 2 0 0 1 1536 1536 ^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P 2 0 0 1 1537 1537 \x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*? 2 0 0 1 1538 1538 =%25[0-9A-F]{2}%25[0-9A-F]{2}/P 2 0 0 1 1539 1539 ^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$ 2 0 0 1 1540 1540 ^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$ 2 0 0 1 1541 1541 ^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$ 2 0 0 1 1542 1542 ^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$ 2 0 0 1 1543 1543 \/r[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1 1544 1544 \/f[a-z]+?\?j[a-z]+[a-z]+$ 2 0 0 1 1545 1545 ^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$ 2 0 0 1 1546 1546 \/b[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1 1547 1547 \/v[a-z]+?\?n[a-z]+[a-z]+$ 2 0 0 1 1548 1548 ^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$ 2 0 0 1 1549 1549 ^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$ 2 0 0 1 1550 1550 ^[\r\n\s]*?\, 2 0 0 1 1551 1551 \bdig\.dll\b 2 0 0 1 1552 1552 ^\/[a-z]+?\?[a-z]+[a-z]+$ 2 0 0 1 1553 1553 ^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1 1554 1554 ^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$ 2 0 0 1 1555 1555 ^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true 2 0 0 1 1556 1556 ^\/1[a-z0-9]{13}$ 2 0 0 1 1557 1557 ^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1 1558 1558 ^\/1[a-z0-9]{13}$ 2 0 0 1 1559 1559 ^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n 2 0 0 1 1560 1560 ^\/3[a-z0-9]{13}$ 2 0 0 1 1561 1561 \/4[a-z0-9]{13}\?&xkey= 2 0 0 1 1562 1562 ^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27] 2 0 0 1 1563 1563 ^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27] 2 0 0 1 1564 1564 ^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27] 2 0 0 1 1565 1565 ^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname) 2 0 0 1 1566 1566 ^[a-zA-Z0-9]+\*\/ 2 0 0 1 1567 1567 [a-z0-9]+?\*\/ 2 0 0 1 1568 1568 ^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script> 2 0 0 1 1569 1569 ^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+ 2 0 0 1 1570 1570 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1 1571 1571 ^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$ 2 0 0 1 1572 1572 ^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm 2 0 0 1 1573 1573 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H 2 0 0 1 1574 1574 Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H 2 0 0 1 1575 1575 ^\W 2 0 0 1 1576 1576 ^\W 2 0 0 1 1577 1577 ^\/[a-z]{3}\?[A-F0-9]{8}$ 2 0 0 1 1578 1578 ^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm 2 0 0 1 1579 1579 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1 1580 1580 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1 1581 1581 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi 2 0 0 1 1582 1582 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi 2 0 0 1 1583 1583 Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi 2 0 0 1 1584 1584 ^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi 2 0 0 1 1585 1585 ^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe 2 0 0 1 1586 1586 ^(\x4c|\x35) 2 0 0 1 1587 1587 ^(\x76|\x0f) 2 0 0 1 1588 1588 \/wp-(content|admin|includes)\/ 2 0 0 1 1589 1589 ^\d\x00\d 2 0 0 1 1590 1590 \.php\?$ 2 0 0 1 1591 1591 \?showforum=$ 2 0 0 1 1592 1592 ^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00 2 0 0 1 1593 1593 \x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_] 2 0 0 1 1594 1594 (\.\.\/){1,} 2 0 0 1 1595 1595 (\.\.\/){1,} 2 0 0 1 1596 1596 =(https?|ftps?|php)\:\/.{0,100}cmd= 2 0 0 1 1597 1597 MEAS\.TYPE=((link|class)&) 2 0 0 1 1598 1598 url=.{8000} 2 0 0 1 1599 1599 \/ssp\/files\/annonce\.pdf$ 2 0 0 1 1600 1600 \/ssp\/loadjavad\.php$ 2 0 0 1 1601 1601 \/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$ 2 0 0 1 1602 1602 \/xml\/p\.php\?id=\d{2,} 2 0 0 1 1603 1603 ts\/in\.cgi\?pepsi\d+ 2 0 0 1 1604 1604 cs_base_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 1605 1605 \x0d\x0aHost\: (www\.)?nacha\.org\. 2 0 0 1 1606 1606 \x26n\x3d[a-z]{5}\d{4} 2 0 0 1 1607 1607 name=(https?|ftps?|php) 2 0 0 1 1608 1608 \/script\.php?\d{8} 2 0 0 1 1609 1609 Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a 2 0 0 1 1610 1610 \/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$ 2 0 0 1 1611 1611 UPDATE.+SET 2 0 0 1 1612 1612 ASCII\(.+SELECT 2 0 0 1 1613 1613 DELETE.+FROM 2 0 0 1 1614 1614 INSERT.+INTO 2 0 0 1 1615 1615 UNION\s+SELECT 2 0 0 1 1616 1616 SELECT.+FROM 2 0 0 1 1617 1617 UPDATE.+SET 2 0 0 1 1618 1618 ASCII\(.+SELECT 2 0 0 1 1619 1619 DELETE.+FROM 2 0 0 1 1620 1620 INSERT.+INTO 2 0 0 1 1621 1621 UNION\s+SELECT 2 0 0 1 1622 1622 SELECT.+FROM 2 0 0 1 1623 1623 ver=[v\d]+ 2 0 0 1 1624 1624 \/Setup_[0-9]{3}([A-Z][0-9])?\.exe$ 2 0 0 1 1625 1625 \/\d+\/installer\/Installer(Clean)?\.exe$ 2 0 0 1 1626 1626 \/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1 1627 1627 ^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c 2 0 0 1 1628 1628 =sent$ 2 0 0 1 1629 1629 \.php\?get[^=]*=\d_\d{5,}$ 2 0 0 1 1630 1630 \.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$ 2 0 0 1 1631 1631 Host\x3A\x20[^\r\n]*.rr.nu/H 2 0 0 1 1632 1632 ^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10)) 2 0 0 1 1633 1633 \.tar$ 2 0 0 1 1634 1634 \x2Fjs\x2F[\r\n]*\x2Eexe$ 2 0 0 1 1635 1635 ^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$ 2 0 0 1 1636 1636 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1 1637 1637 ^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED) 2 0 0 1 1638 1638 ^(\\r\\n|\x0d\x0a)C 2 0 0 1 1639 1639 \/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1 1640 1640 <iframe.*?src.*.*?<\/iframe> 2 0 0 1 1641 1641 [a-z]{4,10}\x08velodrivve\x03biz\x00 2 0 0 1 1642 1642 PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help) 2 0 0 1 1643 1643 \/[A-Z]Setup_[0-9]{4}\.exe$ 2 0 0 1 1644 1644 \.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https? 2 0 0 1 1645 1645 \/[a-f0-9]{16}\/.+?\.(exe|zip)$ 2 0 0 1 1646 1646 ^\s?\+x=[0-9]*\;\ +y=[0-9] 2 0 0 1 1647 1647 User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H 2 0 0 1 1648 1648 ^\/load.php\?showforum=(ato|obe|rhino|lib)$ 2 0 0 1 1649 1649 ^[a-z]{5}\d=\x5f\d\x5f 2 0 0 1 1650 1650 index.php\?[0-9a-f]{32}$ 2 0 0 1 1651 1651 o/\d{9}\/[0-9a-f]{32}\/[0-9]$ 2 0 0 1 1652 1652 \/out.php\?id=\d$ 2 0 0 1 1653 1653 \/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$ 2 0 0 1 1654 1654 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1 1655 1655 \/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$ 2 0 0 1 1656 1656 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$ 2 0 0 1 1657 1657 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$ 2 0 0 1 1658 1658 ^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$ 2 0 0 1 1659 1659 \/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$ 2 0 0 1 1660 1660 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$ 2 0 0 1 1661 1661 \.png$ 2 0 0 1 1662 1662 ^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$ 2 0 0 1 1663 1663 \/\d+\.mp3\x3frnd\x3d\d+$ 2 0 0 1 1664 1664 (Is|CheckRemote)DebuggerPresent 2 0 0 1 1665 1665 (Create|Connect|Peek)NamedPipe 2 0 0 1 1666 1666 ftp(open|get)file 2 0 0 1 1667 1667 ^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1 1668 1668 ^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php 2 0 0 1 1669 1669 ^\/[a-f0-9]{32}\.eot$ 2 0 0 1 1670 1670 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$ 2 0 0 1 1671 1671 \.gif$ 2 0 0 1 1672 1672 \/(w(hite|orld)|step)\/\d+$ 2 0 0 1 1673 1673 \.psd$ 2 0 0 1 1674 1674 \.jpeg$ 2 0 0 1 1675 1675 \/(w(hite|orld)|step)\/mypic\.dll$ 2 0 0 1 1676 1676 getqq\.jpg$ 2 0 0 1 1677 1677 ^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q) 2 0 0 1 1678 1678 \.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1 1679 1679 ([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24} 2 0 0 1 1680 1680 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+ 2 0 0 1 1681 1681 \.php\?spl=[A-Z]{3} 2 0 0 1 1682 1682 \.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1 1683 1683 \.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1 1684 1684 ^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1 1685 1685 \.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$ 2 0 0 1 1686 1686 \.php\?doit[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1 1687 1687 ^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$ 2 0 0 1 1688 1688 (-?\d+\x3a-?\d+\x3a){100} 2 0 0 1 1689 1689 \x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$ 2 0 0 1 1690 1690 [\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9] 2 0 0 1 1691 1691 value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23 2 0 0 1 1692 1692 \x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$ 2 0 0 1 1693 1693 \/\d+\.js\?\d+&[a-f0-9]{16}$ 2 0 0 1 1694 1694 ^\/[a-z0-9_\-]{48}$ 2 0 0 1 1695 1695 \.php\?e=[^&]+?$ 2 0 0 1 1696 1696 \/[a-z]\/[0-9]\/[0-9a-f]{32}$ 2 0 0 1 1697 1697 archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 1698 1698 ^\/[a-z]+\/$ 2 0 0 1 1699 1699 \/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$ 2 0 0 1 1700 1700 \/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$ 2 0 0 1 1701 1701 \/(w(hite|orld)|step)\/get(a+|n+)\.jpg 2 0 0 1 1702 1702 \.php\?usernms=[^@]+@[^\r\n]+$ 2 0 0 1 1703 1703 ^(\x3a\d{1,5})?$ 2 0 0 1 1704 1704 ^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip 2 0 0 1 1705 1705 desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre 2 0 0 1 1706 1706 ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$ 2 0 0 1 1707 1707 ^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain 2 0 0 1 1708 1708 d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))| 2 0 0 1 1709 1709 ((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$ 2 0 0 1 1710 1710 ^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)| 2 0 0 1 1711 1711 ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)| 2 0 0 1 1712 1712 h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$ 2 0 0 1 1713 1713 ^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape 2 0 0 1 1714 1714 |per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$ 2 0 0 1 1715 1715 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 1716 1716 [a-z]{8}.(:?tif|gif) 2 0 0 1 1717 1717 ^.{2}[a-zA-Z0-9]+\x2e[01] 2 0 0 1 1718 1718 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1 1719 1719 ^\w+?\[[^\]]+?\]\.src[\r\n\s]*= 2 0 0 1 1720 1720 (\/(php)?|\.php)\?[\s\+]*\-[A-Za-z] 2 0 0 1 1721 1721 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1 1722 1722 ^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1 1723 1723 ^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20} 2 0 0 1 1724 1724 [^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class 2 0 0 1 1725 1725 ^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea 2 0 0 1 1726 1726 \/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$ 2 0 0 1 1727 1727 ^[\x11\x21-\x26\x41\x45\x70-\x79] 2 0 0 1 1728 1728 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 1729 1729 ^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22 2 0 0 1 1730 1730 ^..[\x81\x82\x83\x84\x85\x86\x87]\x81 2 0 0 1 1731 1731 ^..[\x81\x82\x83\x84\x85\x86\x87]\x83 2 0 0 1 1732 1732 ^..[\x81\x82\x83\x84\x85\x86\x87]\x84 2 0 0 1 1733 1733 ^..[\x81\x82\x83\x84\x85\x86\x87]\x85 2 0 0 1 1734 1734 REGISTER.{400} 2 0 0 1 1735 1735 SELECT.+geometrycollectionfromwkb 2 0 0 1 1736 1736 SELECT.+WHERE.+SELECT.+\x60 2 0 0 1 1737 1737 ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA 2 0 0 1 1738 1738 ^Authorization\x3A Basic.{120}/Hmi 2 0 0 1 1739 1739 ^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi 2 0 0 1 1740 1740 ^[^\x00]+?\x00 2 0 0 1 1741 1741 ^[^\x00]+?\x00 2 0 0 1 1742 1742 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E 2 0 0 1 1743 1743 ^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$ 2 0 0 1 1744 1744 ^\/\?id=[0-9]{13}&msg= 2 0 0 1 1745 1745 ^13\d{11} 2 0 0 1 1746 1746 ^Callback\x3a\x20<http[^>]+><http 2 0 0 1 1747 1747 ^[^\r\n]*uuid\x3a[^\r\n\x3a]{181} 2 0 0 1 1748 1748 ^[^\r\n]+#[^\x22\r\n]{2049} 2 0 0 1 1749 1749 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1 1750 1750 ^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181} 2 0 0 1 1751 1751 ^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181} 2 0 0 1 1752 1752 ^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181} 2 0 0 1 1753 1753 M-SEARCH\s+[^\n]{500} 2 0 0 1 1754 1754 (\/\.){70,} 2 0 0 1 1755 1755 [\w]{70,} 2 0 0 1 1756 1756 \xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF] 2 0 0 1 1757 1757 ^.{27} 2 0 0 1 1758 1758 [0-9a-zA-Z]{200,} 2 0 0 1 1759 1759 (GET).\/%.{1586,} 2 0 0 1 1760 1760 ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE) 2 0 0 1 1761 1761 [^a-zA-Z0-9]+\.message 2 0 0 1 1762 1762 \x3d[^\x26]{720} 2 0 0 1 1763 1763 ENTER\x20LANGUAGE\x20\x3D.{55} 2 0 0 1 1764 1764 [a-zA-Z0-9]{1000,} 2 0 0 1 1765 1765 \xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1 1766 1766 \xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2 2 0 0 1 1767 1767 [\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5] 2 0 0 1 1768 1768 [\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4] 2 0 0 1 1769 1769 Cookie\:\ +REMOTE_ADDR= 2 0 0 1 1770 1770 Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}== 2 0 0 1 1771 1771 \x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a 2 0 0 1 1772 1772 \/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+& 2 0 0 1 1773 1773 \.php\?sex=\d+&children=\d+&userid= 2 0 0 1 1774 1774 ^SSH-\s[^\n]{200} 2 0 0 1 1775 1775 value\x22[^\x22]*\x2Eswf\x3finfo\x3D 2 0 0 1 1776 1776 ^(CLIENT|MACHINE)_INFO 2 0 0 1 1777 1777 Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H 2 0 0 1 1778 1778 \/tmp\/[^\/]+\.pdf$ 2 0 0 1 1779 1779 \/tmp\/[^\/]+\.jar$ 2 0 0 1 1780 1780 ^Directory 2 0 0 1 1781 1781 ^HEAD[^s]{432} 2 0 0 1 1782 1782 ^PUT[^s]{432} 2 0 0 1 1783 1783 ^POST[^s]{432} 2 0 0 1 1784 1784 ^TRACE[^s]{432} 2 0 0 1 1785 1785 ^DELETE[^s]{432} 2 0 0 1 1786 1786 ^LOCK[^s]{432} 2 0 0 1 1787 1787 ^MKCOL[^s]{432} 2 0 0 1 1788 1788 ^COPY[^s]{432} 2 0 0 1 1789 1789 ^MOVE[^s]{432} 2 0 0 1 1790 1790 \x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000} 2 0 0 1 1791 1791 ^\/[0-9]{5}\.jar$ 2 0 0 1 1792 1792 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1 1793 1793 ^\/[0-9]$ 2 0 0 1 1794 1794 ^\/[a-z]{13,14}\.jar$ 2 0 0 1 1795 1795 ^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$ 2 0 0 1 1796 1796 ^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$ 2 0 0 1 1797 1797 T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T 2 0 0 1 1798 1798 [0-9a-zA-Z]{10} 2 0 0 1 1799 1799 [0-9a-zA-Z]{10} 2 0 0 1 1800 1800 Host\x3a \d{4,}[^A-Za-z\.] 2 0 0 1 1801 1801 ^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$ 2 0 0 1 1802 1802 SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22] 2 0 0 1 1803 1803 [a-zA-Z0-9]{5} 2 0 0 1 1804 1804 [0-9a-zA-Z]{50} 2 0 0 1 1805 1805 \x90{200} 2 0 0 1 1806 1806 ^\s+A{500} 2 0 0 1 1807 1807 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1 1808 1808 ^[\r\n\s]*?\x28[^\x29]*?shellcode 2 0 0 1 1809 1809 \.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,} 2 0 0 1 1810 1810 [\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run 2 0 0 1 1811 1811 ^((>>).)+?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1 1812 1812 ^\s*?fun\s*?\( 2 0 0 1 1813 1813 [\?&]mail=[^&]+?[\x3b\x2c\x7c\x27] 2 0 0 1 1814 1814 WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe 2 0 0 1 1815 1815 ^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160) 2 0 0 1 1816 1816 \/\??[a-f0-9]{60,}(\x3b\d+){1,4}$ 2 0 0 1 1817 1817 \/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$ 2 0 0 1 1818 1818 ^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$ 2 0 0 1 1819 1819 ^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801 2 0 0 1 1820 1820 ^Referer\x3a[^\r\n]+\/gate.php\r$/Hm 2 0 0 1 1821 1821 Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm 2 0 0 1 1822 1822 ^( Systems|\.com\/techsupport) 2 0 0 1 1823 1823 ^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2) 2 0 0 1 1824 1824 ^[0-9][^=] 2 0 0 1 1825 1825 ^\s*?\d[\d\x2e]{255} 2 0 0 1 1826 1826 ^\s*?\d[\d\x2e]{255} 2 0 0 1 1827 1827 \s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+? 2 0 0 1 1828 1828 ^..[^\x00]+\x00 2 0 0 1 1829 1829 ^..[^\x00]+\x00 2 0 0 1 1830 1830 ^..[^\x00]+\x00 2 0 0 1 1831 1831 ^..[^\x00]+\x00 2 0 0 1 1832 1832 ^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27] 2 0 0 1 1833 1833 ^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1) 2 0 0 1 1834 1834 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1 1835 1835 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1 1836 1836 ^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH) 2 0 0 1 1837 1837 Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true 2 0 0 1 1838 1838 ^=\s*\x22\s*[^\s\x22\x28]{1000} 2 0 0 1 1839 1839 ^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300} 2 0 0 1 1840 1840 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$ 2 0 0 1 1841 1841 ^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4} 2 0 0 1 1842 1842 ^[^\x00]+\x00\x00\x01 2 0 0 1 1843 1843 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1 1844 1844 ^.{6}[^\x00]+ 2 0 0 1 1845 1845 ^.{6}[^\x00]+ 2 0 0 1 1846 1846 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1 1847 1847 ^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c) 2 0 0 1 1848 1848 ^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a 2 0 0 1 1849 1849 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1850 1850 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1851 1851 ^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?) 2 0 0 1 1852 1852 ^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00 2 0 0 1 1853 1853 ^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b 2 0 0 1 1854 1854 ^\S+?drivestoredirect 2 0 0 1 1855 1855 ^\s*(f0VMR|9FTE|\/RUxG) 2 0 0 1 1856 1856 ^\s*=\s*[\x27\x22]\s*POST 2 0 0 1 1857 1857 ^.*?[\x24\x60] 2 0 0 1 1858 1858 ^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/ 2 0 0 1 1859 1859 ^\s*(\x28|\%28)s 2 0 0 1 1860 1860 ^\s*\d*[^\x20-\x7e\r\n\t] 2 0 0 1 1861 1861 ^[\x30-\x3f\x7D] 2 0 0 1 1862 1862 ^[\x30-\x3f\x7D] 2 0 0 1 1863 1863 AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s 2 0 0 1 1864 1864 ^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 1865 1865 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1 1866 1866 legal[^x7B]*\x7B[^\x7D]*restore 2 0 0 1 1867 1867 errordict\s+\x2Finvalidfileaccess 2 0 0 1 1868 1868 errordict\s+\x2Finvalidfileaccess 2 0 0 1 1869 1869 \x2Ebindnow[^\x7D]*\x7D\s*stopped 2 0 0 1 1870 1870 \x2Ebindnow[^\x7D]+\x7D\s*stopped 2 0 0 1 1871 1871 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1 1872 1872 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1 1873 1873 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1 1874 1874 16#[^s]\d+\s*\x3E\x3E\s*setpattern 2 0 0 1 1875 1875 ^\s* 2 0 0 1 1876 1876 ^\s* 2 0 0 1 1877 1877 ^\s* 2 0 0 1 1878 1878 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5} 2 0 0 1 1879 1879 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1 1880 1880 ^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7} 2 0 0 1 1881 1881 Template=.*\.\. 2 0 0 1 1882 1882 act\x3D[^\x26\s\r\n]{257} 2 0 0 1 1883 1883 app\x3D[^\x26\s\r\n]{257} 2 0 0 1 1884 1884 [\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,} 2 0 0 1 1885 1885 ^[\x50-\x59] 2 0 0 1 1886 1886 ^[^\r\n]*?\x60[^\x60]*?\$\{IFS\} 2 0 0 1 1887 1887 \bsolusvmc-node\b 2 0 0 1 1888 1888 ^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100} 2 0 0 1 1889 1889 ^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b 2 0 0 1 1890 1890 ^(\x25(25)*?20|\s)*?runmumaa\W 2 0 0 1 1891 1891 ^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22 2 0 0 1 1892 1892 ^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n]) 2 0 0 1 1893 1893 ^\s*\x28\s*[\x22\x27]\s*message 2 0 0 1 1894 1894 ^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28 2 0 0 1 1895 1895 ^[^\r\n]+\.hta\r?\n 2 0 0 1 1896 1896 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1 1897 1897 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1 1898 1898 ^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value) 2 0 0 1 1899 1899 ^[(\x60|%60)(\x27|%27)] 2 0 0 1 1900 1900 ^\/(home\/a3user|root)\/agile3\/patches\/ 2 0 0 1 1901 1901 ^.*?\x26 2 0 0 1 1902 1902 (\x0a|\\n)\/s1Caa6 2 0 0 1 1903 1903 ^(\\r\\n|\x0d\x0a)C 2 0 0 1 1904 1904 ^\d{3} 2 0 0 1 1905 1905 ^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8}) 2 0 0 1 1906 1906 ^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$ 2 0 0 1 1907 1907 ^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 1908 1908 [\?\&]cmd_param=[^\&\r\n]{500} 2 0 0 1 1909 1909 (%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))) 2 0 0 1 1910 1910 ^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF])) 2 0 0 1 1911 1911 ^[^\x22]*[\x24\x60]+ 2 0 0 1 1912 1912 ^[^\x22]*[\x24\x60]+ 2 0 0 1 1913 1913 ^[a-z0-9\-_\.\/]+\x00 2 0 0 1 1914 1914 ^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f] 2 0 0 1 1915 1915 \/dev-report-overview\.html[^\"]*?\x3b 2 0 0 1 1916 1916 ^\s*\x22{2} 2 0 0 1 1917 1917 ^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d) 2 0 0 1 1918 1918 ^Host\x3a[^\n]{0,50}?\x3b 2 0 0 1 1919 1919 ^[\s>] 2 0 0 1 1920 1920 ^[\s>] 2 0 0 1 1921 1921 ^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f 2 0 0 1 1922 1922 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1923 1923 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1924 1924 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1925 1925 ^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78} 2 0 0 1 1926 1926 ^\s*?\x29 2 0 0 1 1927 1927 ^\s*?\(x\s*,\s*1,\s*24000\s*\x29 2 0 0 1 1928 1928 ^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e 2 0 0 1 1929 1929 ^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start 2 0 0 1 1930 1930 =\s*\x25\s*\{\s*.+?\bProcessBuilder\b 2 0 0 1 1931 1931 ^[ a-zA-Z0-9+_]*[\x27\x3b] 2 0 0 1 1932 1932 destination=[^&]*\x24\x28 2 0 0 1 1933 1933 name=[^&]*\x24\x28 2 0 0 1 1934 1934 ^[^&]+\x2527(UNION|SELECT) 2 0 0 1 1935 1935 [^&]*(\x60|\x24) 2 0 0 1 1936 1936 (\x60|\x24) 2 0 0 1 1937 1937 (\/GponForm\/diag_FORM\?images\/|\.html\?images\/) 2 0 0 1 1938 1938 ^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1 1939 1939 ^(www\.)?(cisco|linksys)\.com\/jnap\/ 2 0 0 1 1940 1940 ^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) 2 0 0 1 1941 1941 (\%3C){1000} 2 0 0 1 1942 1942 A{1000} 2 0 0 1 1943 1943 id\=[^\r\n]*?(select|delete|union|update|insert) 2 0 0 1 1944 1944 ^\d{2,5}(\&|\d) 2 0 0 1 1945 1945 ^(8=|9BQQ==)\r?\n? 2 0 0 1 1946 1946 =\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b 2 0 0 1 1947 1947 ^[0-9]+ 2 0 0 1 1948 1948 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W 2 0 0 1 1949 1949 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W 2 0 0 1 1950 1950 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W 2 0 0 1 1951 1951 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W 2 0 0 1 1952 1952 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W 2 0 0 1 1953 1953 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W 2 0 0 1 1954 1954 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W 2 0 0 1 1955 1955 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1 1956 1956 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W 2 0 0 1 1957 1957 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W 2 0 0 1 1958 1958 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W 2 0 0 1 1959 1959 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1 1960 1960 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W 2 0 0 1 1961 1961 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1 1962 1962 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1 1963 1963 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1 1964 1964 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W 2 0 0 1 1965 1965 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W 2 0 0 1 1966 1966 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W 2 0 0 1 1967 1967 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W 2 0 0 1 1968 1968 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W 2 0 0 1 1969 1969 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W 2 0 0 1 1970 1970 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W 2 0 0 1 1971 1971 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1 1972 1972 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W 2 0 0 1 1973 1973 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W 2 0 0 1 1974 1974 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W 2 0 0 1 1975 1975 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W 2 0 0 1 1976 1976 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W 2 0 0 1 1977 1977 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W 2 0 0 1 1978 1978 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W 2 0 0 1 1979 1979 (^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W 2 0 0 1 1980 1980 ping_addr=[\d.]*[^\d.] 2 0 0 1 1981 1981 \?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b 2 0 0 1 1982 1982 ^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1 1983 1983 ^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\} 2 0 0 1 1984 1984 pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 1985 1985 ^[^=]{1,}$ 2 0 0 1 1986 1986 ^\x22[^\x22]*\x3b[^\x22]*\x22/P 2 0 0 1 1987 1987 ^\s*[\x22\x27] 2 0 0 1 1988 1988 \.hta([?&]|$) 2 0 0 1 1989 1989 ^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e] 2 0 0 1 1990 1990 \%(25)?temp\% 2 0 0 1 1991 1991 ^[a-zA-Z0-9]+$ 2 0 0 1 1992 1992 [^&]*(\x60|\x24) 2 0 0 1 1993 1993 ^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi 2 0 0 1 1994 1994 (localhost|127\.0\.0\.1)/W 2 0 0 1 1995 1995 ^[^\r\n]{128,}\r\n 2 0 0 1 1996 1996 ^[^\+]+\+0A 2 0 0 1 1997 1997 ^[^\+]+(\+[A-F0-9]{2}){4,} 2 0 0 1 1998 1998 ^.{0,100}\+0A.{0,100}\x40 2 0 0 1 1999 1999 ^[^\r\n]{50,} 2 0 0 1 2000 2000 ^\S{0,7}\/(meeting|fb\/smb|namedusers|metric) 2 0 0 1 2001 2001 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 2002 2002 ^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\) 2 0 0 1 2003 2003 ^form(Ping|Tracert)$ 2 0 0 1 2004 2004 ^form(Ping|Tracert)$ 2 0 0 1 2005 2005 ^.{1,50}\/uapi-cgi\/ 2 0 0 1 2006 2006 ^.{1,50}\/uapi-cgi\/ 2 0 0 1 2007 2007 ^[^&]{150,} 2 0 0 1 2008 2008 ^[^&]{150,} 2 0 0 1 2009 2009 \bexec\b 2 0 0 1 2010 2010 parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1 2011 2011 oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1 2012 2012 [^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1 2013 2013 ^\s+?[^\s\>]+?\s+?SYSTEM\s 2 0 0 1 2014 2014 ^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1 2015 2015 ^[A-Z]{8}\x3a 2 0 0 1 2016 2016 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d 2 0 0 1 2017 2017 ^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d 2 0 0 1 2018 2018 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2019 2019 ^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2020 2020 ^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\) 2 0 0 1 2021 2021 ^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt) 2 0 0 1 2022 2022 ^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o) 2 0 0 1 2023 2023 ^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\. 2 0 0 1 2024 2024 ^form(RebootCheck|Wsc)$ 2 0 0 1 2025 2025 ^[^&]{42,} 2 0 0 1 2026 2026 ^[^&]{512,} 2 0 0 1 2027 2027 ^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi 2 0 0 1 2028 2028 ^[^&]{90,} 2 0 0 1 2029 2029 ^\d[012345] 2 0 0 1 2030 2030 ^\d[012345] 2 0 0 1 2031 2031 ^\d[012345] 2 0 0 1 2032 2032 ^\d[012345] 2 0 0 1 2033 2033 ^\d[012345] 2 0 0 1 2034 2034 ^\d[012345] 2 0 0 1 2035 2035 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1 2036 2036 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e) 2 0 0 1 2037 2037 ^[^&\x0d\r]+[\n\x0a] 2 0 0 1 2038 2038 ^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3) 2 0 0 1 2039 2039 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2040 2040 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2041 2041 ^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2042 2042 ^(%[a-f0-9]{2}){5,} 2 0 0 1 2043 2043 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2044 2044 ^%(3b|0a|26|60|7C|24) 2 0 0 1 2045 2045 ^\/(icons|cgi-bin) 2 0 0 1 2046 2046 ^\/(icons|cgi-bin) 2 0 0 1 2047 2047 ^\/(icons|cgi-bin) 2 0 0 1 2048 2048 [^\r\n]*true 2 0 0 1 2049 2049 \x2f(FURUKAWA|APROS)\x2f 2 0 0 1 2050 2050 [^\r\n]*(\x60|\x24|\x7c|\bsh\b) 2 0 0 1 2051 2051 ^[^\r\n=]*(union|select) 2 0 0 1 2052 2052 ^[^&=]*(union|select) 2 0 0 1 2053 2053 ^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var) 2 0 0 1 2054 2054 ^[^\x22]+\.jsp\x22 2 0 0 1 2055 2055 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2056 2056 ^[\s\x22\x27]*check_ping\b 2 0 0 1 2057 2057 ^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class) 2 0 0 1 2058 2058 [^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24] 2 0 0 1 2059 2059 ([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2060 2060 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2061 2061 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1 2062 2062 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1 2063 2063 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2064 2064 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2065 2065 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2066 2066 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2067 2067 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2068 2068 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2069 2069 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2070 2070 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2071 2071 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2072 2072 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2073 2073 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2074 2074 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2075 2075 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2076 2076 ^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d) 2 0 0 1 2077 2077 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2078 2078 ^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d)) 2 0 0 1 2079 2079 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1 2080 2080 ^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d) 2 0 0 1 2081 2081 \.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc)) 2 0 0 1 2082 2082 ^[^&]{100,} 2 0 0 1 2083 2083 ^[a-zA-Z0-9]+\.(zip|7z|gz) 2 0 0 1 2084 2084 ^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60) 2 0 0 1 2085 2085 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1 2086 2086 ^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr) 2 0 0 1 2087 2087 ^[0-9]{1,10}\x3b 2 0 0 1 2088 2088 ^(%2e|\.)exec 2 0 0 1 2089 2089 ^[a-zA-Z0-9]{5,40} 2 0 0 1 2090 2090 ^[a-zA-Z0-9]{7,200} 2 0 0 1 2091 2091 ^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError= 2 0 0 1 2092 2092 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1 2093 2093 ^[^&=]*(union|select|update|insert|delete) 2 0 0 1 2094 2094 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1 2095 2095 ((%2F|\/)(\.|%2E){2}(%2F|\/)) 2 0 0 1 2096 2096 ^(%2E%2E%2F|\.\.\/) 2 0 0 1 2097 2097 ^[a-zA-Z0-9]{5,45} 2 0 0 1 2098 2098 ^([A-Z]\x00){20}\x00\x00 2 0 0 1 2099 2099 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1 2100 2100 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1 2101 2101 (InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI) 2 0 0 1 2102 2102 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2103 2103 ^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm 2 0 0 1 2104 2104 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2105 2105 ^[a-zA-Z0-9+/]{1000,} 2 0 0 1 2106 2106 \We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W 2 0 0 1 2107 2107 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2108 2108 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2109 2109 ^[^<]{30,}<\/NewMACAddress> 2 0 0 1 2110 2110 ^0+(&|$) 2 0 0 1 2111 2111 ^0+(&|$) 2 0 0 1 2112 2112 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2113 2113 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2114 2114 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2115 2115 ^(\x3b|\x0a|\x26|\x60|\x7c|\x24) 2 0 0 1 2116 2116 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2117 2117 ^(\x3b|\x0a|\x26|\x60|\x7C|\x24) 2 0 0 1 2118 2118 ^\/(icons|cgi-bin) 2 0 0 1 2119 2119 ^\/(icons|cgi-bin) 2 0 0 1 2120 2120 ^\/(icons|cgi-bin) 2 0 0 1 2121 2121 ^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2122 2122 (yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H 2 0 0 1 2123 2123 ^(CREATE|SELECT|INSERT|UPDATE|EXEC) 2 0 0 1 2124 2124 ^["']\s*:\s*["']\s*[^0-9]+ 2 0 0 1 2125 2125 ^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24)) 2 0 0 1 2126 2126 ^\s*=\s*[\x22\x27]\s*ms-msdt\x3a 2 0 0 1 2127 2127 (\x2e|%2e)(\x2e|%2e)(\x2f|%2f) 2 0 0 1 2128 2128 myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2129 2129 ^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f 2 0 0 1 2130 2130 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2131 2131 ^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28)) 2 0 0 1 2132 2132 [^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar 2 0 0 1 2133 2133 ^\s?(file|https?)\x3a 2 0 0 1 2134 2134 ^(\/?\.\.?\/){2} 2 0 0 1 2135 2135 \b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK 2 0 0 1 2136 2136 ^[\r\n\s\+]*.+?\}[\r\n\s]*?catch 2 0 0 1 2137 2137 ^(application\/(x-)?|text\/)xml 2 0 0 1 2138 2138 ^(application\/(x-)?|text\/)xml 2 0 0 1 2139 2139 \/((index|toc)\.html?)?\?\/\/ 2 0 0 1 2140 2140 ^.{0,10}[\x3b\x0a\x26\x60\x7c\x24] 2 0 0 1 2141 2141 [?&]ap= 2 0 0 1 2142 2142 ^\d+\s*[^\r\n]{50,} 2 0 0 1 2143 2143 (web|decorators|seraph-config)\x2exml$ 2 0 0 1 2144 2144 com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$ 2 0 0 1 2145 2145 ^[^\x3c]{,100}\x27 2 0 0 1 2146 2146 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 2147 2147 ^(Begin|End)\=/P 2 0 0 1 2148 2148 \/\?[a-f0-9]{64}\;\d\;\d 2 0 0 1 2149 2149 \x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16} 2 0 0 1 2150 2150 \/[a-z]\/[0-9a-f]{32}$ 2 0 0 1 2151 2151 \/dl\/\w{1,4}\.php\?[0-9]$ 2 0 0 1 2152 2152 \/[a-f0-9]{60,}_js\? 2 0 0 1 2153 2153 \/[a-f0-9]{60,}_jar$ 2 0 0 1 2154 2154 \/[a-f0-9]{60,}_exe$ 2 0 0 1 2155 2155 ,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+, 2 0 0 1 2156 2156 ^\/showthread\.php\?t=\d+$ 2 0 0 1 2157 2157 function\x20booom[1-3]{1}\x28\x29 2 0 0 1 2158 2158 var\x20Cute(Money|Power|Shine) 2 0 0 1 2159 2159 iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml 2 0 0 1 2160 2160 ^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$ 2 0 0 1 2161 2161 \.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$ 2 0 0 1 2162 2162 \/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$ 2 0 0 1 2163 2163 \/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$ 2 0 0 1 2164 2164 \/indigo\?\d+ 2 0 0 1 2165 2165 ^\/\?[a-f0-9]{32}$ 2 0 0 1 2166 2166 =[.\"]\w{8}\.jar/Hi 2 0 0 1 2167 2167 \.php\?showtopic=[0-9]{6}$ 2 0 0 1 2168 2168 \/[0-9]\.html$ 2 0 0 1 2169 2169 ^\?[a-f0-9]{32}\" 2 0 0 1 2170 2170 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1 2171 2171 ^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$ 2 0 0 1 2172 2172 ^\/t\/[a-f0-9]{32} 2 0 0 1 2173 2173 \/[A-Z]{20,}\?[A-Z]=\d$ 2 0 0 1 2174 2174 ^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$ 2 0 0 1 2175 2175 ^\/Applet\.jar$ 2 0 0 1 2176 2176 \/beacon\/[a-f0-9]{8}\.htm$ 2 0 0 1 2177 2177 \/t\/[a-f0-9]{32}$ 2 0 0 1 2178 2178 ^\/[0-9]{3}\.jar$ 2 0 0 1 2179 2179 ^[\r\n\s]*[\d\x5b] 2 0 0 1 2180 2180 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$ 2 0 0 1 2181 2181 ^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$ 2 0 0 1 2182 2182 \/[0-9]{3}\.pdf 2 0 0 1 2183 2183 \(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body> 2 0 0 1 2184 2184 ^[a-f0-9]{32} 2 0 0 1 2185 2185 ^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h 2 0 0 1 2186 2186 ^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27] 2 0 0 1 2187 2187 ^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q) 2 0 0 1 2188 2188 ^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1) 2 0 0 1 2189 2189 ^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/ 2 0 0 1 2190 2190 EGYPACK_CRYPT\d 2 0 0 1 2191 2191 \/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$ 2 0 0 1 2192 2192 ^(ckwm)*?(Exp|cc)\.class 2 0 0 1 2193 2193 ^\/command\/[a-zA-Z]{6}$ 2 0 0 1 2194 2194 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1 2195 2195 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1 2196 2196 ^(a(ttack|dEx[xp])|([a-z]))\.class 2 0 0 1 2197 2197 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10}) 2 0 0 1 2198 2198 ^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C 2 0 0 1 2199 2199 ^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$ 2 0 0 1 2200 2200 ^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$ 2 0 0 1 2201 2201 \.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$ 2 0 0 1 2202 2202 &k=\d{16}(&|$) 2 0 0 1 2203 2203 ^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20} 2 0 0 1 2204 2204 ^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1 2205 2205 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1 2206 2206 if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot) 2 0 0 1 2207 2207 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27] 2 0 0 1 2208 2208 ^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\) 2 0 0 1 2209 2209 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1 2210 2210 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27] 2 0 0 1 2211 2211 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27] 2 0 0 1 2212 2212 \/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php 2 0 0 1 2213 2213 \.php\?e=\d+(&|$) 2 0 0 1 2214 2214 ^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e) 2 0 0 1 2215 2215 \/cod\/[^\x2f]+\.vbs$ 2 0 0 1 2216 2216 [a-f0-9]{32}\.jar 2 0 0 1 2217 2217 ^[^a-z0-9] 2 0 0 1 2218 2218 \.php\?dwl=[a-z]+$ 2 0 0 1 2219 2219 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a 2 0 0 1 2220 2220 ^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t 2 0 0 1 2221 2221 ^\/ep\/cl\.php$ 2 0 0 1 2222 2222 ^[\r\n\s]*?[\x22\x27]<applet 2 0 0 1 2223 2223 =\d+&e=\d+$ 2 0 0 1 2224 2224 \/\d+\/\d\.zip$ 2 0 0 1 2225 2225 (<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a) 2 0 0 1 2226 2226 (<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot) 2 0 0 1 2227 2227 ^[\r\n\s]*?\( 2 0 0 1 2228 2228 \/[a-z0-9]{32}\.jar$ 2 0 0 1 2229 2229 ^[^\s]*?\s*?\/[^\r\n\s]*?\?src= 2 0 0 1 2230 2230 ^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$ 2 0 0 1 2231 2231 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27] 2 0 0 1 2232 2232 ^\/([\/_]*?[a-f0-9][\/_]*?){32}$ 2 0 0 1 2233 2233 ^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$ 2 0 0 1 2234 2234 ^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$ 2 0 0 1 2235 2235 ^((<\/applet>).)+?[\x22\x27]687474703a2f2f 2 0 0 1 2236 2236 \.html\?sv=[1-5](\,\d+?){1,3}$ 2 0 0 1 2237 2237 \/(d|xie|fla)\.php\?[a-z]+687474703a2f2f 2 0 0 1 2238 2238 \.html\?jar$ 2 0 0 1 2239 2239 ^\/\d{4,5}\/\d{7}$ 2 0 0 1 2240 2240 \/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$ 2 0 0 1 2241 2241 ^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\( 2 0 0 1 2242 2242 ^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep) 2 0 0 1 2243 2243 ^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r) 2 0 0 1 2244 2244 ^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$ 2 0 0 1 2245 2245 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1 2246 2246 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1 2247 2247 ^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x) 2 0 0 1 2248 2248 \/[A-Z]\.xml$ 2 0 0 1 2249 2249 ^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep) 2 0 0 1 2250 2250 \.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$ 2 0 0 1 2251 2251 \.php\?a=(dw[a-z0-9]|[hr][2-7])$ 2 0 0 1 2252 2252 (PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4} 2 0 0 1 2253 2253 ^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash) 2 0 0 1 2254 2254 ^\d+u\d+s\d+h\d 2 0 0 1 2255 2255 ^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#) 2 0 0 1 2256 2256 ^\s*?\d 2 0 0 1 2257 2257 ^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20} 2 0 0 1 2258 2258 ^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76 2 0 0 1 2259 2259 ^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*? 2 0 0 1 2260 2260 ^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$ 2 0 0 1 2261 2261 \.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)& 2 0 0 1 2262 2262 (\0[a-z]{3}\.classPK.{43}){4} 2 0 0 1 2263 2263 ^[\x22\x27] 2 0 0 1 2264 2264 ^\s*\s*?window\.document\.createElement 2 0 0 1 2265 2265 ^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep) 2 0 0 1 2266 2266 \/3\/[a-f0-9]{32}\/http\x3a\x2f 2 0 0 1 2267 2267 \/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$ 2 0 0 1 2268 2268 ^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$ 2 0 0 1 2269 2269 ^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$ 2 0 0 1 2270 2270 ^\x2Fmodules\x2F(1|2)\x2Ejar$ 2 0 0 1 2271 2271 ^\s*?\(\s*?[\x22\x27]Flash[\x22\x27] 2 0 0 1 2272 2272 ^\s*?[\x22\x27][A-Za-z0-9\s]{500} 2 0 0 1 2273 2273 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var 2 0 0 1 2274 2274 ^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300} 2 0 0 1 2275 2275 ^\/[a-z]\?[a-z]=[0-9]{5,}$ 2 0 0 1 2276 2276 [^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a 2 0 0 1 2277 2277 ^[\x22\x27] 2 0 0 1 2278 2278 ^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27] 2 0 0 1 2279 2279 ^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\( 2 0 0 1 2280 2280 ^[\x22\x27] 2 0 0 1 2281 2281 ^[\x22\x27] 2 0 0 1 2282 2282 ^[\x22\x27] 2 0 0 1 2283 2283 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27] 2 0 0 1 2284 2284 ^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u" 2 0 0 1 2285 2285 ^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet) 2 0 0 1 2286 2286 ^[\w.]*?\.class 2 0 0 1 2287 2287 ^\s*\s*?[\x22\x27]\- 2 0 0 1 2288 2288 ^\s*\s*?[\x22\x27]\- 2 0 0 1 2289 2289 \/Fqxzdh\.jar$ 2 0 0 1 2290 2290 ^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\( 2 0 0 1 2291 2291 ^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps 2 0 0 1 2292 2292 [^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P 2 0 0 1 2293 2293 \.php\?spl=[\w_]+$ 2 0 0 1 2294 2294 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1 2295 2295 Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm 2 0 0 1 2296 2296 ^\s*?[\x3a\x3d]\s*?[\x22\x27]?\- 2 0 0 1 2297 2297 ^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$ 2 0 0 1 2298 2298 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1 2299 2299 ^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s 2 0 0 1 2300 2300 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W 2 0 0 1 2301 2301 ^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+ 2 0 0 1 2302 2302 ^\/(pruncd)?flashhigh\.swf$ 2 0 0 1 2303 2303 ^\/(pruncd)?flashlow\.swf$ 2 0 0 1 2304 2304 ^\/(pruncd)?silverapp1\.xap$ 2 0 0 1 2305 2305 \?action=lnd$ 2 0 0 1 2306 2306 \?action=(pld|exp)&exp= 2 0 0 1 2307 2307 ^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm 2 0 0 1 2308 2308 \/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$ 2 0 0 1 2309 2309 \/k\?t[a-z]*=\d{5,}$ 2 0 0 1 2310 2310 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1 2311 2311 ^\/[^\x2f]*?flashhigh\.swf$ 2 0 0 1 2312 2312 ^\/[^\x2f]*?flashlow\.swf$ 2 0 0 1 2313 2313 ^\/[^\x2f]*?iebasic\.html$ 2 0 0 1 2314 2314 ^\/[^\x2f]*?silverapp1\.xap$ 2 0 0 1 2315 2315 \/[a-z]{3,7}\.php$ 2 0 0 1 2316 2316 \/([a-z0-9]{1,7}\.php)?\?zho= 2 0 0 1 2317 2317 ^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$ 2 0 0 1 2318 2318 ^\/Drop2(-\d+)\.swf$ 2 0 0 1 2319 2319 ^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n 2 0 0 1 2320 2320 ^Content-Disposition\x3a[^\r\n]+\.swf/Hm 2 0 0 1 2321 2321 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1 2322 2322 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi 2 0 0 1 2323 2323 ^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b 2 0 0 1 2324 2324 ^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+ 2 0 0 1 2325 2325 ^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm 2 0 0 1 2326 2326 ^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$ 2 0 0 1 2327 2327 ^\/AwoVG[A-Za-z0-9_]+$ 2 0 0 1 2328 2328 ^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E 2 0 0 1 2329 2329 ^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi 2 0 0 1 2330 2330 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi 2 0 0 1 2331 2331 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1 2332 2332 ^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500} 2 0 0 1 2333 2333 ^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f 2 0 0 1 2334 2334 nb[\d+]=Yes 2 0 0 1 2335 2335 ^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27] 2 0 0 1 2336 2336 ^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm 2 0 0 1 2337 2337 ^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\. 2 0 0 1 2338 2338 ^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27] 2 0 0 1 2339 2339 ^\W 2 0 0 1 2340 2340 ^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28 2 0 0 1 2341 2341 ^\s*?\d+,\s*?\d 2 0 0 1 2342 2342 ^\s*?\d+,\s*?\d 2 0 0 1 2343 2343 \/14\d{8}(\.jar)?$ 2 0 0 1 2344 2344 ^[a-z0-9]*\r\n/H 2 0 0 1 2345 2345 ^[a-z0-9]*\r\n/H 2 0 0 1 2346 2346 filename=[a-z0-9]*\r\n/H 2 0 0 1 2347 2347 \/\??4c2H($|[&?]utm_source=) 2 0 0 1 2348 2348 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1 2349 2349 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1 2350 2350 (Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P 2 0 0 1 2351 2351 \/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$ 2 0 0 1 2352 2352 ^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200} 2 0 0 1 2353 2353 \/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f 2 0 0 1 2354 2354 ^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f 2 0 0 1 2355 2355 ^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm 2 0 0 1 2356 2356 ^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27] 2 0 0 1 2357 2357 ^\/[a-f0-9]{32}\/e\.html$ 2 0 0 1 2358 2358 Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H 2 0 0 1 2359 2359 \.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$ 2 0 0 1 2360 2360 \/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$ 2 0 0 1 2361 2361 \/\d\/?[A-Z]+\/[a-f0-9]{40}\/$ 2 0 0 1 2362 2362 \/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$ 2 0 0 1 2363 2363 \?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$ 2 0 0 1 2364 2364 ^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1 2365 2365 &cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$ 2 0 0 1 2366 2366 \x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e] 2 0 0 1 2367 2367 ^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b] 2 0 0 1 2368 2368 ^\s*? 2 0 0 1 2369 2369 ^\/[0-9a-f]{32}\.html$ 2 0 0 1 2370 2370 ^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$ 2 0 0 1 2371 2371 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1 2372 2372 ^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$ 2 0 0 1 2373 2373 \.jpg$ 2 0 0 1 2374 2374 ^\s+\d+\x3b\s*\} 2 0 0 1 2375 2375 ^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$ 2 0 0 1 2376 2376 ^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$ 2 0 0 1 2377 2377 ^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi 2 0 0 1 2378 2378 \.js\?chebstr=0\.\d+$ 2 0 0 1 2379 2379 \.js\?chbstr=0\.\d+$ 2 0 0 1 2380 2380 ^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b 2 0 0 1 2381 2381 ^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$ 2 0 0 1 2382 2382 ^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27] 2 0 0 1 2383 2383 ^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div> 2 0 0 1 2384 2384 ^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback 2 0 0 1 2385 2385 ^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27] 2 0 0 1 2386 2386 Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H 2 0 0 1 2387 2387 ^[^\n]*\x29\x3b$ 2 0 0 1 2388 2388 ^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$ 2 0 0 1 2389 2389 ^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S 2 0 0 1 2390 2390 ^.{16}[a-z]{3}\.dll 2 0 0 1 2391 2391 ^.{16}[a-z]{4}\.dll 2 0 0 1 2392 2392 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm 2 0 0 1 2393 2393 \.php\?setup=d&s=\d+&r=\d+$ 2 0 0 1 2394 2394 \/\?[a-z0-9]{65,}\x3b \d\x3b \d 2 0 0 1 2395 2395 ^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$ 2 0 0 1 2396 2396 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1 2397 2397 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1 2398 2398 \/\?nbVykj$ 2 0 0 1 2399 2399 ^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\} 2 0 0 1 2400 2400 ^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29 2 0 0 1 2401 2401 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$ 2 0 0 1 2402 2402 ^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi 2 0 0 1 2403 2403 ^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$ 2 0 0 1 2404 2404 ^\/[a-z]+\/$ 2 0 0 1 2405 2405 ^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body> 2 0 0 1 2406 2406 ^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm 2 0 0 1 2407 2407 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1 2408 2408 ^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a) 2 0 0 1 2409 2409 ^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span> 2 0 0 1 2410 2410 \/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$ 2 0 0 1 2411 2411 \/view.php\?i=\d&key=[0-9a-f]{32}$ 2 0 0 1 2412 2412 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$ 2 0 0 1 2413 2413 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$ 2 0 0 1 2414 2414 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$ 2 0 0 1 2415 2415 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$ 2 0 0 1 2416 2416 ^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$ 2 0 0 1 2417 2417 ^\/[a-z]+\/$ 2 0 0 1 2418 2418 \.php\?j=1&k=[0-9](i=[0-9])?$ 2 0 0 1 2419 2419 ^\/[a-zA-Z]{7}\.jar$ 2 0 0 1 2420 2420 \/lpdf\.php\?i=[a-zA-Z0-9]+&?$ 2 0 0 1 2421 2421 [a-z0-9]{32}\.jar 2 0 0 1 2422 2422 \/inf\.php\?id=[a-f0-9]{32}$ 2 0 0 1 2423 2423 ^\s*=\s*[\x22\x27] 2 0 0 1 2424 2424 \/vd\/\d+\x3b[a-f0-9]{32} 2 0 0 1 2425 2425 \.php\?pprec$ 2 0 0 1 2426 2426 \.php\?c002$ 2 0 0 1 2427 2427 [a-f0-9]{32}\.jar 2 0 0 1 2428 2428 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1 2429 2429 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1) 2 0 0 1 2430 2430 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1 2431 2431 ^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1) 2 0 0 1 2432 2432 [a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$ 2 0 0 1 2433 2433 \?(s|page|id)=\d+$ 2 0 0 1 2434 2434 ^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func) 2 0 0 1 2435 2435 \/FlashPlayer\.cpl$ 2 0 0 1 2436 2436 ^((<\/applet>).)+?[\x22\x27]1337\.exe 2 0 0 1 2437 2437 filename=[a-z]{4}\.txt\x0D\x0A/H 2 0 0 1 2438 2438 &p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$ 2 0 0 1 2439 2439 ^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q) 2 0 0 1 2440 2440 ^\x2Fclicker\x2Ephp$ 2 0 0 1 2441 2441 ^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+ 2 0 0 1 2442 2442 \?(s|page|id)=\d+&text=\d+$ 2 0 0 1 2443 2443 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm 2 0 0 1 2444 2444 ^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm 2 0 0 1 2445 2445 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1 2446 2446 \/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$ 2 0 0 1 2447 2447 ^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\? 2 0 0 1 2448 2448 ^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)? 2 0 0 1 2449 2449 ^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?) 2 0 0 1 2450 2450 [a-z] 2 0 0 1 2451 2451 \.exe\?(e=)?\d+$ 2 0 0 1 2452 2452 \/j\d{2}\.php\?i= 2 0 0 1 2453 2453 \/\?whole=\d+$ 2 0 0 1 2454 2454 ^\/search\/[0-9]{64} 2 0 0 1 2455 2455 \/m1[1-6]\.jar$ 2 0 0 1 2456 2456 \/[0-9]{4}\.html$ 2 0 0 1 2457 2457 \/\d+\.pkg$ 2 0 0 1 2458 2458 \/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$ 2 0 0 1 2459 2459 \/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$ 2 0 0 1 2460 2460 amor\d{0,2}\.jar 2 0 0 1 2461 2461 [a-f] 2 0 0 1 2462 2462 =(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$ 2 0 0 1 2463 2463 (<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d) 2 0 0 1 2464 2464 ^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t 2 0 0 1 2465 2465 \/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$ 2 0 0 1 2466 2466 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$ 2 0 0 1 2467 2467 \.jar\?java=\d+$ 2 0 0 1 2468 2468 ^((<\/applet>).)+?\.jar\?java=\d+ 2 0 0 1 2469 2469 ^((<\/applet>).)+?[\x22\x27]aHR0cDov 2 0 0 1 2470 2470 ^[a-f0-9]{32}=\d{1,10}\r\n/H 2 0 0 1 2471 2471 \/1[34]\d{8}\.tpl$ 2 0 0 1 2472 2472 ^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27] 2 0 0 1 2473 2473 ^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$ 2 0 0 1 2474 2474 \/java\.php\?eid=[a-f0-9]{32}& 2 0 0 1 2475 2475 \/pdf\.php\?pdf=[a-f0-9]{32}& 2 0 0 1 2476 2476 [&?]type=\d+($|&) 2 0 0 1 2477 2477 ^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm 2 0 0 1 2478 2478 ^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27] 2 0 0 1 2479 2479 \/13[89]\d{7}.swf$ 2 0 0 1 2480 2480 \/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$ 2 0 0 1 2481 2481 ^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20 2 0 0 1 2482 2482 ^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname) 2 0 0 1 2483 2483 [&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)= 2 0 0 1 2484 2484 \/1(3[89]\d{7}|4\d{8})\.xap$ 2 0 0 1 2485 2485 &dr=\d+$ 2 0 0 1 2486 2486 &nrk=\d+$ 2 0 0 1 2487 2487 ^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm 2 0 0 1 2488 2488 ^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29 2 0 0 1 2489 2489 ^\s*?[A-Z0-9a-z\+]+?\s*?\x7d 2 0 0 1 2490 2490 ^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$ 2 0 0 1 2491 2491 ^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head> 2 0 0 1 2492 2492 \/14\d{8}(\.swf)?$ 2 0 0 1 2493 2493 \/14\d{8}(\.pdf)?$ 2 0 0 1 2494 2494 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm 2 0 0 1 2495 2495 ^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm 2 0 0 1 2496 2496 \/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$ 2 0 0 1 2497 2497 ^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28 2 0 0 1 2498 2498 \/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1 2499 2499 \/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1 2500 2500 \/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1 2501 2501 ^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[ 2 0 0 1 2502 2502 \/1\.php\?r$ 2 0 0 1 2503 2503 ^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68 2 0 0 1 2504 2504 ^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?, 2 0 0 1 2505 2505 \/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1 2506 2506 \/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$ 2 0 0 1 2507 2507 \/main\.html$ 2 0 0 1 2508 2508 \.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$ 2 0 0 1 2509 2509 ^\/tdstest\/[a-f0-9]{32,}\/?$ 2 0 0 1 2510 2510 \/content\/dl\.php\?sl=vbs[a-z0-9]{32}$ 2 0 0 1 2511 2511 \/content\/getvbslink\.php\?d=[a-z0-9]{32}$ 2 0 0 1 2512 2512 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1 2513 2513 ^[a-z0-9]*\r\n/H 2 0 0 1 2514 2514 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1 2515 2515 ^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22 2 0 0 1 2516 2516 \/street[1-5]\.php$ 2 0 0 1 2517 2517 \/XV-\d+\.exe$ 2 0 0 1 2518 2518 \/bad\/[A-Z0-9]+\.swf$ 2 0 0 1 2519 2519 \/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$ 2 0 0 1 2520 2520 ^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\} 2 0 0 1 2521 2521 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm 2 0 0 1 2522 2522 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1 2523 2523 \b[a-z]{2}\d+\s*\s*?Yes 2 0 0 1 2524 2524 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f 2 0 0 1 2525 2525 ^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$ 2 0 0 1 2526 2526 ^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H 2 0 0 1 2527 2527 ^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f 2 0 0 1 2528 2528 ^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm 2 0 0 1 2529 2529 ^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27] 2 0 0 1 2530 2530 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1 2531 2531 Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H 2 0 0 1 2532 2532 \/e\.html$ 2 0 0 1 2533 2533 ^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)--> 2 0 0 1 2534 2534 [&?]t=[a-f0-9]{32}(&|$) 2 0 0 1 2535 2535 \/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$ 2 0 0 1 2536 2536 ^\s*?[_$]+\x28\x29 2 0 0 1 2537 2537 ^\s*?[_$]+\x28\x29 2 0 0 1 2538 2538 Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi 2 0 0 1 2539 2539 ^\s*?\w+\s*?\.\s*?charCodeAt 2 0 0 1 2540 2540 ^\/\?[a-f0-9]{32,64}$ 2 0 0 1 2541 2541 ^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100} 2 0 0 1 2542 2542 Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm 2 0 0 1 2543 2543 Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H 2 0 0 1 2544 2544 \.php\?id=[0-9A-F]{32,}&rnd=\d+$ 2 0 0 1 2545 2545 ^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+ 2 0 0 1 2546 2546 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep) 2 0 0 1 2547 2547 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep) 2 0 0 1 2548 2548 ^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep) 2 0 0 1 2549 2549 ^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27] 2 0 0 1 2550 2550 ^Host\x3a[^\r\n]*?\.pw\r$/Hmi 2 0 0 1 2551 2551 ^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm 2 0 0 1 2552 2552 ^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr 2 0 0 1 2553 2553 ^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)--> 2 0 0 1 2554 2554 ^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$ 2 0 0 1 2555 2555 ^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20} 2 0 0 1 2556 2556 ^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$ 2 0 0 1 2557 2557 ^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs= 2 0 0 1 2558 2558 ^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$ 2 0 0 1 2559 2559 Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H 2 0 0 1 2560 2560 ^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$ 2 0 0 1 2561 2561 ^#?\d+ 2 0 0 1 2562 2562 ^#?\d+ 2 0 0 1 2563 2563 ^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1 2564 2564 ^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n)) 2 0 0 1 2565 2565 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1 2566 2566 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi 2 0 0 1 2567 2567 ^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=) 2 0 0 1 2568 2568 ^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f 2 0 0 1 2569 2569 (value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF 2 0 0 1 2570 2570 ^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90} 2 0 0 1 2571 2571 ^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b 2 0 0 1 2572 2572 ^[a-z]\d{3}\(new Array\( 2 0 0 1 2573 2573 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*= 2 0 0 1 2574 2574 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF 2 0 0 1 2575 2575 ^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22 2 0 0 1 2576 2576 ^\d{1,2}\.php$ 2 0 0 1 2577 2577 &b=[a-f0-9]{7}&k=[a-f0-9]{32} 2 0 0 1 2578 2578 ^\/[a-z]+\/$ 2 0 0 1 2579 2579 ^\/[a-z]+\/$ 2 0 0 1 2580 2580 ^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\. 2 0 0 1 2581 2581 ^[0-9a-fA-F]{25}$ 2 0 0 1 2582 2582 ^[-_\w]+$ 2 0 0 1 2583 2583 \/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$ 2 0 0 1 2584 2584 ^\d+$ 2 0 0 1 2585 2585 \x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$ 2 0 0 1 2586 2586 ^\/[a-z]{15}[0-9]\.php$ 2 0 0 1 2587 2587 ^\d$ 2 0 0 1 2588 2588 \/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$ 2 0 0 1 2589 2589 ^\/\d{5}$ 2 0 0 1 2590 2590 \/[0-9]{2}\.html$ 2 0 0 1 2591 2591 \.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$ 2 0 0 1 2592 2592 \x2F[0-9]{3}\.pdf$ 2 0 0 1 2593 2593 ^\d{1,2}=[a-zA-Z0-9+=]{100} 2 0 0 1 2594 2594 ^\/[a-z]\.jar$ 2 0 0 1 2595 2595 \/[a-f0-9]+\.zip$ 2 0 0 1 2596 2596 ^\/\d{2,}\.[a-z0-9]+$ 2 0 0 1 2597 2597 ^\/\?[a-f0-9]{32}$ 2 0 0 1 2598 2598 \/(java(db|im|rh)|silver|flash|msie)\.php\?id= 2 0 0 1 2599 2599 ^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s* 2 0 0 1 2600 2600 ^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n 2 0 0 1 2601 2601 \/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$ 2 0 0 1 2602 2602 \/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$ 2 0 0 1 2603 2603 ^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$ 2 0 0 1 2604 2604 (\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$ 2 0 0 1 2605 2605 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1 2606 2606 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n 2 0 0 1 2607 2607 ^\/\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1 2608 2608 \x20filename=\r\n(\r\n)?$ 2 0 0 1 2609 2609 PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$ 2 0 0 1 2610 2610 ^\/index\.php\?[A-Za-z0-9_-]{15}=l3S 2 0 0 1 2611 2611 \w_\.jar\?[a-f0-9]{8}$ 2 0 0 1 2612 2612 ^\d+[\r\n\x2f] 2 0 0 1 2613 2613 ^\d+[\r\n\x2f] 2 0 0 1 2614 2614 ^\d+[\r\n\x2f] 2 0 0 1 2615 2615 ^\d+[\r\n\x2f] 2 0 0 1 2616 2616 ^\d+[\r\n\x2f] 2 0 0 1 2617 2617 ^\d+[\r\n\x2f] 2 0 0 1 2618 2618 ^\d+[\r\n\x2f] 2 0 0 1 2619 2619 ^\d+[\r\n\x2f] 2 0 0 1 2620 2620 ^\d+[\r\n\x2f] 2 0 0 1 2621 2621 ^\d+[\r\n\x2f] 2 0 0 1 2622 2622 Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n 2 0 0 1 2623 2623 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$ 2 0 0 1 2624 2624 ^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$ 2 0 0 1 2625 2625 ^\/\d{9,10}\/\d{4,5}$ 2 0 0 1 2626 2626 \/index\.html\?p=\d+$ 2 0 0 1 2627 2627 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9] 2 0 0 1 2628 2628 ^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi 2 0 0 1 2629 2629 ^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b 2 0 0 1 2630 2630 ^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\. 2 0 0 1 2631 2631 \.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$ 2 0 0 1 2632 2632 ^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27] 2 0 0 1 2633 2633 ^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27] 2 0 0 1 2634 2634 ^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+ 2 0 0 1 2635 2635 ^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body> 2 0 0 1 2636 2636 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1 2637 2637 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1 2638 2638 ^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html 2 0 0 1 2639 2639 ^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$ 2 0 0 1 2640 2640 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 2641 2641 ^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40} 2 0 0 1 2642 2642 ^\/([\/_]*?[a-f0-9][\/_]*?){64}$ 2 0 0 1 2643 2643 src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f] 2 0 0 1 2644 2644 ^[a-f0-9]{32}$ 2 0 0 1 2645 2645 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/ 2 0 0 1 2646 2646 [=\"]\w{8}\.jar 2 0 0 1 2647 2647 ^[a-z]{2}\. 2 0 0 1 2648 2648 \/jdb\/[^\/]+\.class$ 2 0 0 1 2649 2649 \/lib\/adobe\.php\?id=[a-f0-9]{32}$ 2 0 0 1 2650 2650 \/i.php?token=[a-z0-9]+$ 2 0 0 1 2651 2651 \x2Fjerk\x2Ecgi\x3F[0-9]$ 2 0 0 1 2652 2652 ^(\?[^=]{1,10}=[^&\r\n]{100,})?$ 2 0 0 1 2653 2653 \.php\?e=[^&]+?$ 2 0 0 1 2654 2654 \.txt\?e=\d+(&[fh]=\d+)?$ 2 0 0 1 2655 2655 ^\x2F\x3Fwps\x3D[0-9]$ 2 0 0 1 2656 2656 ^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp= 2 0 0 1 2657 2657 ^\/[a-z0-9]{1,4}\.jnlp$ 2 0 0 1 2658 2658 \.php\?id=[a-f0-9]{32}$ 2 0 0 1 2659 2659 ^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$ 2 0 0 1 2660 2660 \.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}& 2 0 0 1 2661 2661 \/[A-F0-9]{8}\.js\?cp= 2 0 0 1 2662 2662 ^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$ 2 0 0 1 2663 2663 \.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$ 2 0 0 1 2664 2664 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1 2665 2665 ^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$ 2 0 0 1 2666 2666 \/\d{6}\.mp3$ 2 0 0 1 2667 2667 \/14\d{8}(\.xap)?$ 2 0 0 1 2668 2668 \.swf\?myid=[a-zA-Z0-9]+$ 2 0 0 1 2669 2669 \.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$ 2 0 0 1 2670 2670 \/(Flash[23]?|Ink|New|One|HQ).exe$ 2 0 0 1 2671 2671 Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n 2 0 0 1 2672 2672 Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r] 2 0 0 1 2673 2673 \/\d{2,}\.xap$ 2 0 0 1 2674 2674 \.php\?rnd=\d+&id=[0-9A-F]{32,}$ 2 0 0 1 2675 2675 \/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$ 2 0 0 1 2676 2676 ^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$) 2 0 0 1 2677 2677 ^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe 2 0 0 1 2678 2678 ^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO 2 0 0 1 2679 2679 =[a-f0-9]{32,}(&|$) 2 0 0 1 2680 2680 \&e=(cve|flash) 2 0 0 1 2681 2681 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$ 2 0 0 1 2682 2682 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$ 2 0 0 1 2683 2683 ^(0x[a-f0-9]{1,2}, ){500} 2 0 0 1 2684 2684 ^[0-9_,{AbZwP&-]{2000} 2 0 0 1 2685 2685 ^[A-F0-9]+ 2 0 0 1 2686 2686 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1 2687 2687 ^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_ 2 0 0 1 2688 2688 ^[a-z0-9]{13}\.[a-z]{3}$ 2 0 0 1 2689 2689 ^\d+$ 2 0 0 1 2690 2690 Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/? 2 0 0 1 2691 2691 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a) 2 0 0 1 2692 2692 ^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$ 2 0 0 1 2693 2693 ^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$ 2 0 0 1 2694 2694 ^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$ 2 0 0 1 2695 2695 (.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1 2696 2696 (.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$) 2 0 0 1 2697 2697 ^[HX3][^&]Q[cdM][^&]{3}[ab]R 2 0 0 1 2698 2698 ^\/\?[a-f0-9]{114}$ 2 0 0 1 2699 2699 Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n 2 0 0 1 2700 2700 ^\/[a-f0-9]{16}$ 2 0 0 1 2701 2701 ^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$ 2 0 0 1 2702 2702 ^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$ 2 0 0 1 2703 2703 \/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$ 2 0 0 1 2704 2704 ^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$ 2 0 0 1 2705 2705 ^\d$ 2 0 0 1 2706 2706 ^[A-F0-9]{16}\x22> 2 0 0 1 2707 2707 ^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$ 2 0 0 1 2708 2708 ^[A-F0-9]{16}(&|&\x3b)id=\d+(&|&\x3b)gid=[A-F0-9\-]+\x22> 2 0 0 1 2709 2709 ^[^>]*?\> 2 0 0 1 2710 2710 ^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P 2 0 0 1 2711 2711 ^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100} 2 0 0 1 2712 2712 ^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c 2 0 0 1 2713 2713 ^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d 2 0 0 1 2714 2714 ^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s 2 0 0 1 2715 2715 ^[a-z]{10}\.[a-z]{3}\r?$/Hm 2 0 0 1 2716 2716 Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H 2 0 0 1 2717 2717 ^\d+\x3b 2 0 0 1 2718 2718 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1 2719 2719 ^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f 2 0 0 1 2720 2720 ^[^\x27]+[\x27]\s* 2 0 0 1 2721 2721 ^\d+\x3b 2 0 0 1 2722 2722 ^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{ 2 0 0 1 2723 2723 ^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500} 2 0 0 1 2724 2724 ^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\> 2 0 0 1 2725 2725 ^[^A-Za-z0-9] 2 0 0 1 2726 2726 ^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s) 2 0 0 1 2727 2727 ^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var) 2 0 0 1 2728 2728 ^[^<]+\x0d\x0a<\/script> 2 0 0 1 2729 2729 \?src=[a-z]+snet$ 2 0 0 1 2730 2730 ^[0-9a-f]{6} 2 0 0 1 2731 2731 ^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f 2 0 0 1 2732 2732 ^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+ 2 0 0 1 2733 2733 (NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp) 2 0 0 1 2734 2734 ^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d] 2 0 0 1 2735 2735 ^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$ 2 0 0 1 2736 2736 ^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-) 2 0 0 1 2737 2737 SELECT.+FROM 2 0 0 1 2738 2738 DELETE.+FROM 2 0 0 1 2739 2739 INSERT.+INTO 2 0 0 1 2740 2740 UPDATE.+SET 2 0 0 1 2741 2741 UNION.+SELECT 2 0 0 1 2742 2742 INTO.+OUTFILE 2 0 0 1 2743 2743 ^SITE\s+EXEC\s[^\n]*?%[^\n]*?% 2 0 0 1 2744 2744 ^PASS\s[^\n]{100} 2 0 0 1 2745 2745 ^MKD\s[^\n]{100} 2 0 0 1 2746 2746 ^REST\s[^\n]{100} 2 0 0 1 2747 2747 ^DELE\s[^\n]{100} 2 0 0 1 2748 2748 ^RMD\s[^\n]{100} 2 0 0 1 2749 2749 ^RMDIR\s[^\n]{100} 2 0 0 1 2750 2750 ^SITE\s+NEWER\s[^\n]{100} 2 0 0 1 2751 2751 ^SITE\s+ZIPCHK\s[^\n]{100} 2 0 0 1 2752 2752 ^USER\s+w0rm 2 0 0 1 2753 2753 ^ALLO\s[^\n]{100} 2 0 0 1 2754 2754 ^CEL\s[^\n]{100} 2 0 0 1 2755 2755 ^CMD\s[^\n]{100} 2 0 0 1 2756 2756 ^CWD\s[^\n]{100} 2 0 0 1 2757 2757 ^SITE\s+CPWD\s[^\n]{100} 2 0 0 1 2758 2758 ^SITE\s+NEWER 2 0 0 1 2759 2759 ^STAT\s+[^\n]*\x3f 2 0 0 1 2760 2760 ^APPE\s[^\n]{100} 2 0 0 1 2761 2761 ^CWD\s+~ 2 0 0 1 2762 2762 ^MODE\s+[^ABSC]{1} 2 0 0 1 2763 2763 ^SITE\s[^\n]{100} 2 0 0 1 2764 2764 ^SITE\s+CHOWN\s[^\n]{100} 2 0 0 1 2765 2765 ^SITE\s+EXEC 2 0 0 1 2766 2766 ^XCWD\s[^\n]{100} 2 0 0 1 2767 2767 ^STOR\s[^\n]{100} 2 0 0 1 2768 2768 ^SITE\s+CHMOD\s[^\n]{100} 2 0 0 1 2769 2769 ^LIST\s[^\n]{100,} 2 0 0 1 2770 2770 ^RENAME\s[^\n]*?%[^\n]*?% 2 0 0 1 2771 2771 ^MKDIR\s[^\n]*?%[^\n]*?% 2 0 0 1 2772 2772 ^PASS\s[^\n]*?%[^\n]*?% 2 0 0 1 2773 2773 ^USER\s[^\n]*?%[^\n]*?% 2 0 0 1 2774 2774 ^MDTM\s[^\n]{100} 2 0 0 1 2775 2775 ^RETR\s[^\n]*?%[^\n]*?% 2 0 0 1 2776 2776 ^CWD\s[^\n]*?\.\.\. 2 0 0 1 2777 2777 ^CWD\s+~root 2 0 0 1 2778 2778 ^NLST\s[^\n]{100} 2 0 0 1 2779 2779 ^PORT 2 0 0 1 2780 2780 REST\s+[0-9]+\n 2 0 0 1 2781 2781 ^RETR\s[^\n]{100} 2 0 0 1 2782 2782 ^RNFR\s[^\n]{100} 2 0 0 1 2783 2783 ^RNTO\s[^\n]{100} 2 0 0 1 2784 2784 ^STAT\s[^\n]{100} 2 0 0 1 2785 2785 ^STOU\s[^\n]{100} 2 0 0 1 2786 2786 ^XMKD\s[^\n]{100} 2 0 0 1 2787 2787 \s+.*?%.*?% 2 0 0 1 2788 2788 ^530\s+(Login|User) 2 0 0 1 2789 2789 ^PASS\s*\n 2 0 0 1 2790 2790 ^LIST\s+\x22-W\s+\d 2 0 0 1 2791 2791 ^USER\x20[^\x00\x20\x0a\x0d]{100} 2 0 0 1 2792 2792 ^STAT\s+[^\n]*\x2a 2 0 0 1 2793 2793 ^MDTM \d+[-+]\D 2 0 0 1 2794 2794 ^[^\r\n]+\.jar 2 0 0 1 2795 2795 ^\d\.\d(_\d+)?\@\r\n 2 0 0 1 2796 2796 \x5csecure\x5c[^\x00]{50} 2 0 0 1 2797 2797 \x5C[^\x5C\x00]{257} 2 0 0 1 2798 2798 ^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s] 2 0 0 1 2799 2799 (a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash 2 0 0 1 2800 2800 ^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}] 2 0 0 1 2801 2801 ^[^\r\n]*win 2 0 0 1 2802 2802 ^[^\r\n]*-PC 2 0 0 1 2803 2803 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1 2804 2804 ^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl) 2 0 0 1 2805 2805 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1 2806 2806 ^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb) 2 0 0 1 2807 2807 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1 2808 2808 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3) 2 0 0 1 2809 2809 User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1 2810 2810 User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi 2 0 0 1 2811 2811 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0 2 0 0 1 2812 2812 ^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3 2 0 0 1 2813 2813 ^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d 2 0 0 1 2814 2814 \d*?\.bin 2 0 0 1 2815 2815 ^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista) 2 0 0 1 2816 2816 ^\d+/V 2 0 0 1 2817 2817 ^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c] 2 0 0 1 2818 2818 ^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00 2 0 0 1 2819 2819 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1 2820 2820 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1 2821 2821 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1 2822 2822 U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud 2 0 0 1 2823 2823 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1 2824 2824 (UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH) 2 0 0 1 2825 2825 \bshell\b 2 0 0 1 2826 2826 \benable\b 2 0 0 1 2827 2827 ^[^\r\n]+\.(t(ar|gz)|exe|zip) 2 0 0 1 2828 2828 ^([\x7f-\xff]){100}/Hi 2 0 0 1 2829 2829 ^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27] 2 0 0 1 2830 2830 ^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00 2 0 0 1 2831 2831 \/[0-9]{1,2}\.dat$ 2 0 0 1 2832 2832 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1 2833 2833 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1 2834 2834 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1 2835 2835 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1 2836 2836 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1 2837 2837 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1 2838 2838 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1 2839 2839 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1 2840 2840 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1 2841 2841 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1 2842 2842 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 2843 2843 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 2844 2844 Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27] 2 0 0 1 2845 2845 \.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$ 2 0 0 1 2846 2846 ^[\d\s] 2 0 0 1 2847 2847 ^USER [^\r\n]*?\x22 2 0 0 1 2848 2848 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 2849 2849 ^(\x3a\d{1,5})?$ 2 0 0 1 2850 2850 \.(gif|jpe?g|png)$ 2 0 0 1 2851 2851 ^((jp|pn)g|bmp) 2 0 0 1 2852 2852 ^(logins|c(cdata|ookie)) 2 0 0 1 2853 2853 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 2854 2854 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 2855 2855 \/winhost(32|64)\.(exe|pack)$ 2 0 0 1 2856 2856 \/pony\.(exe|pack)$ 2 0 0 1 2857 2857 ^[^>]+url=sms\x3a 2 0 0 1 2858 2858 \/[^\x2f]+\.[^\x2f]+\.wsf$ 2 0 0 1 2859 2859 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1 2860 2860 ^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4}) 2 0 0 1 2861 2861 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 2862 2862 ^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz) 2 0 0 1 2863 2863 ^((jp|pn)g|bmp) 2 0 0 1 2864 2864 ^(logins|c(cdata|ookie)) 2 0 0 1 2865 2865 ^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*) 2 0 0 1 2866 2866 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1 2867 2867 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1 2868 2868 ^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$ 2 0 0 1 2869 2869 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1 2870 2870 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1 2871 2871 ^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$ 2 0 0 1 2872 2872 ^[a-f0-9]{8,}\.duckdns\.org$ 2 0 0 1 2873 2873 ^[^\x3b\x2f\x28]+$ 2 0 0 1 2874 2874 ^[^\r\n]{100,} 2 0 0 1 2875 2875 ^[^\r\n]{100,} 2 0 0 1 2876 2876 ^[^\r\n]{100,} 2 0 0 1 2877 2877 ^[^\r\n]{100,} 2 0 0 1 2878 2878 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 2879 2879 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2880 2880 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2881 2881 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2882 2882 [a-z]{8}.[a-z]{3} 2 0 0 1 2883 2883 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$ 2 0 0 1 2884 2884 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$ 2 0 0 1 2885 2885 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$ 2 0 0 1 2886 2886 ^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$ 2 0 0 1 2887 2887 CN=ssl\d{1,2}.ovh.net($|,) 2 0 0 1 2888 2888 (\.[a-z]{2}|$) 2 0 0 1 2889 2889 [a-f0-9]{32}$ 2 0 0 1 2890 2890 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P 2 0 0 1 2891 2891 ^(\x3b|\r\n) 2 0 0 1 2892 2892 CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.) 2 0 0 1 2893 2893 ^[a-f0-9]+ 2 0 0 1 2894 2894 ^[a-f0-9]+ 2 0 0 1 2895 2895 ^[a-f0-9]+ 2 0 0 1 2896 2896 ^Agent\d{5,6}$ 2 0 0 1 2897 2897 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2898 2898 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2899 2899 (Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX) 2 0 0 1 2900 2900 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2901 2901 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2902 2902 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2903 2903 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2904 2904 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2905 2905 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2906 2906 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2907 2907 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2908 2908 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2909 2909 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2910 2910 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2911 2911 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2912 2912 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2913 2913 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2914 2914 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2915 2915 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2916 2916 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2917 2917 (R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG) 2 0 0 1 2918 2918 .*[^A-Za-z0-9]edu\.rf\.gd$ 2 0 0 1 2919 2919 \x2edoc[xm]?$ 2 0 0 1 2920 2920 \x2exls[xm]?$ 2 0 0 1 2921 2921 \/\d+$ 2 0 0 1 2922 2922 function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi 2 0 0 1 2923 2923 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2924 2924 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2925 2925 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2926 2926 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2927 2927 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2928 2928 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2929 2929 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2930 2930 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 2931 2931 \sLOGIN\s[^\n]*?\s\{ 2 0 0 1 2932 2932 \sLSUB\s[^\n]*?\s\{ 2 0 0 1 2933 2933 \sRENAME\s[^\n]{100} 2 0 0 1 2934 2934 \sFIND\s[^\n]{100} 2 0 0 1 2935 2935 \sFETCH\s[^\n]{500} 2 0 0 1 2936 2936 \sLOGIN\s[^\n]{100} 2 0 0 1 2937 2937 \sAUTHENTICATE\s[^\n]{100} 2 0 0 1 2938 2938 \sLIST\s[^\n]*?\s\{ 2 0 0 1 2939 2939 \sPARTIAL.*BODY\[[^\]]{1024} 2 0 0 1 2940 2940 AUTH\s[^\n]{100} 2 0 0 1 2941 2941 \sCREATE\s*\{ 2 0 0 1 2942 2942 \sRENAME\s[^\n]*?\s\{ 2 0 0 1 2943 2943 \sLIST\s[^\n]{100} 2 0 0 1 2944 2944 \sCREATE\s[^\n]{1024} 2 0 0 1 2945 2945 \sLSUB\s[^\n]{100} 2 0 0 1 2946 2946 \sAUTHENTICATE\s[^\n]*?\{ 2 0 0 1 2947 2947 \sPARTIAL.*BODY\.PEEK\[[^\]]{1024} 2 0 0 1 2948 2948 \sUNSUBSCRIBE\s[^\n]{100} 2 0 0 1 2949 2949 \sUNSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1 2950 2950 \sSUBSCRIBE\s[^\n]{100} 2 0 0 1 2951 2951 \sSUBSCRIBE\s[^\n]*?\s\{ 2 0 0 1 2952 2952 \sSTATUS\s[^\n]{100} 2 0 0 1 2953 2953 \sSTATUS\s[^\n]*?\s\{ 2 0 0 1 2954 2954 \sFETCH\s[^\n]*?\s\{ 2 0 0 1 2955 2955 \sEXAMINE\s[^\n]{100} 2 0 0 1 2956 2956 \sEXAMINE\s[^\n]*?\s\{ 2 0 0 1 2957 2957 \sAPPEND\s[^\n]{256} 2 0 0 1 2958 2958 \sCOPY\s[^\n]*?\{ 2 0 0 1 2959 2959 \sDELETE\s[^\n]*?\{ 2 0 0 1 2960 2960 \sDELETE\s[^\n]{100} 2 0 0 1 2961 2961 \sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?% 2 0 0 1 2962 2962 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b 2 0 0 1 2963 2963 ^RETR\s+[^\r\n]+?\x2eexe\r?$ 2 0 0 1 2964 2964 \<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf 2 0 0 1 2965 2965 SELECT @@version_compile_os\s*?\x3b 2 0 0 1 2966 2966 ^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7]))) 2 0 0 1 2967 2967 ^Server\x3a[^\r\n]*Intel SDK for UPnP devices 2 0 0 1 2968 2968 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1 2969 2969 ^[8-9]\.0 2 0 0 1 2970 2970 ^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var) 2 0 0 1 2971 2971 ^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi 2 0 0 1 2972 2972 ^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi 2 0 0 1 2973 2973 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E 2 0 0 1 2974 2974 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1 2975 2975 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1 2976 2976 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1 2977 2977 ^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20} 2 0 0 1 2978 2978 ^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e 2 0 0 1 2979 2979 ^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e 2 0 0 1 2980 2980 for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29 2 0 0 1 2981 2981 ^User-Agent\x3a[^\r\n]*?Googlebot/Hmi 2 0 0 1 2982 2982 ^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\} 2 0 0 1 2983 2983 ^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=) 2 0 0 1 2984 2984 \x00[0-9]{4,7}\x02in\x00 2 0 0 1 2985 2985 ^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3] 2 0 0 1 2986 2986 ^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27] 2 0 0 1 2987 2987 ^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement 2 0 0 1 2988 2988 ^((<\/title).)*\x26\x23x1F512 2 0 0 1 2989 2989 ^\/tmp\/.+\.exe$ 2 0 0 1 2990 2990 ^(&). 2 0 0 1 2991 2991 ((\?|&))pasa=(&). 2 0 0 1 2992 2992 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$ 2 0 0 1 2993 2993 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1 2994 2994 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1 2995 2995 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1 2996 2996 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1 2997 2997 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$ 2 0 0 1 2998 2998 \.jpg(\?\d+)?$ 2 0 0 1 2999 2999 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3000 3000 ^[^0-9] 2 0 0 1 3001 3001 ^(\x3a\d{1,5})?$ 2 0 0 1 3002 3002 \.(arm(5n|7)?|m(ips|psl))$ 2 0 0 1 3003 3003 \.dyndns\.(biz|info|org|tv)$ 2 0 0 1 3004 3004 (at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com 2 0 0 1 3005 3005 ^[^&=?]*\/wp-content\/themes\/ 2 0 0 1 3006 3006 ^(\x3a\d{1,5})?$ 2 0 0 1 3007 3007 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1 3008 3008 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1 3009 3009 ^\x22(v(mware|irtual|irtualbox|m\x20ware|box)) 2 0 0 1 3010 3010 ^[a-z0-9.]+\.kali\.org 2 0 0 1 3011 3011 \.(d(ns(d(ynamic\.(com|net)|\.(info|me))|api\.info|get\.org|53\.biz)|dns01\.com)|(f(lashserv|e100|tp21)|adultdns|mysq1|wow64)\.net|((ima|voi)p01|(user|ole)32|kadm5)\.com|t(tl60\.(com|org)|empors\.com|ftpd\.net)|s(sh(01\.com|22\.net)|ql01\.com)|http((s443|01)\.com|80\.info)|n(s360\.info|tdll\.net)|x(ns01\.com|64\.me)|craftx\.biz)(\x3a\d{1,5})?$ 2 0 0 1 3012 3012 \.(i(s(-(a(-(((h(ard-work|unt)e|financialadviso)r|d(e(mocrat|signer)|octor)|t(e(acher|chie)|herapist)|r(epublican|ockstar)|n(ascarfan|urse)|anarchist|musician)\.com|c(((ubicle-sla|onservati)ve|pa)\.com|a(ndidate\.org|terer\.com)|hef\.(com|net|org)|elticsfan\.org)|l(i(ber(tarian|al)\.com|nux-user\.org)|(a(ndscap|wy)er|lama)\.com)|p((ersonaltrain|hotograph|lay)er\.com|a(inter\.com|tsfan\.org))|b(((ookkeep|logg)er|ulls-fan)\.com|ruinsfan\.org)|s(o(cialist\.com|xfan\.org)|tudent\.com)|g(eek\.(com|net|org)|(reen|uru)\.com)|knight\.org)|n-(a(c(t(ress|or)|countant)|(narch|rt)ist)|en(tertain|gine)er)\.com)|(into-((car(toon)?|game)s|anime)|((not-)?certifie|with-theban)d|uberleet|gone)\.com|(very-((goo|ba)d|sweet|evil|nice)|found)\.org|s(aved\.org|lick\.com)|l(eet\.com|ost\.org)|by\.us)|a-(geek\.(com|net|org)|hockeynut\.com)|t(eingeek|mein)\.de|smarterthanyou\.com)|n-the-band\.net|amallama\.com)|f(rom-((i[adln]|w[aivy]|o[hkr]|[hr]i|d[ce]|k[sy]|p[ar]|s[cd]|t[nx]|v[at]|fl|ga|ut)\.com|m([adinost]\.com|e\.org)|n([cdehjmv 2 0 0 1 3013 3013 \.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or(-(((mor|som|th)e|better)\.biz|our\.info)|got\.h(er|is)\.name)|uettertdasnetz\.de|tpaccess\.cc)|s(e(l(ls(-(for-(less|u)\.com|it\.net)|yourhome\.org)|fip\.(info|biz|com|net|org))|rve(bbs\.(com|net|org)|ftp\.(net|org)|game\.org))|(aves-the-whales|pace-to-rent|imple-url)\.com|crapp(er-site\.net|ing\.cc)|tuff-4-sale\.(org|us)|hacknet\.nu)|d(o(es(ntexist\.(com|org)|-it\.net)|ntexist\.(com|net|org)|omdns\.(com|org))|yn(a(lias\.(com|net|org)|thome\.net)|-o-saur\.com|dns\.ws)|ns(alias\.(com|net|org)|dojo\.(com|net|org))|vrdns\.org)|h(o(me(linux\.(com|net|org)|unix\.(com|net|org)|(\.dyn)?dns\.org|ftp\.(net|org)|ip\.net)|bby-site\.(com|org))|ere-for-more\.info|am-radio-op\.net)|b(log(dns\.(com|net|org)|site\.org)|(uyshouses|roke-it)\.net|arrel?l-of-knowledge\.info|oldlygoingnowhere\.org|etter-than\.tv)|g(o(tdns\.(com|org)|\.dyndns\.org)|ame-(server\.cc|host\.org)|et(myip\.com|s-it\.net)|roks-th(is|e)\.info)|e(st-((a-la-ma(is|si)|le-patr)on|mon-blogueur 2 0 0 1 3014 3014 \.com|ndof(internet\.(net|org)|theinternet\.org))|l(e(btimnetz|itungsen)\.de|ikes(candy|-pie)\.com|and-4-sale\.us)|m(i(sconfused\.org|ne\.nu)|yp(hotos\.cc|ets\.ws)|erseine\.nu)|w(ebhop\.(info|biz|net|org)|ritesthisblog\.com|orse-than\.tv)|t(eaches-yoga\.com|raeumtgerade\.de|hruhere\.net)|k(icks-ass\.(net|org)|nowsitall\.info)|o(ffice-on-the\.net|n-the-web\.tv)|(neat-url|cechire)\.com|podzone\.(net|org)|at-band-camp\.net|readmyblog\.org)(\x3a\d{1,5})?$ 2 0 0 1 3015 3015 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3016 3016 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3017 3017 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3018 3018 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3019 3019 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3020 3020 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3021 3021 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3022 3022 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3023 3023 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3024 3024 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3025 3025 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3026 3026 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3027 3027 ^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3028 3028 ^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3029 3029 ^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3030 3030 ^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3031 3031 ^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3032 3032 ^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3033 3033 ^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3034 3034 ^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3035 3035 ^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3036 3036 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3037 3037 ^\d 2 0 0 1 3038 3038 ^User-Agent\x3a\x20iTunes\/10\.6\.[0-1] 2 0 0 1 3039 3039 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3040 3040 (/d{6}) 2 0 0 1 3041 3041 CN=([^\r\n]+?\.)?hizliresim\.com(\.) 2 0 0 1 3042 3042 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3043 3043 ^ip[23]?\.bablosoft\.com$ 2 0 0 1 3044 3044 ^[A-Z]=[A-Za-z/+0-9=]{200,400}$ 2 0 0 1 3045 3045 CN=([^\r\n]+?\.)?sharepointin\.com(\.) 2 0 0 1 3046 3046 CN=([^\r\n]+?\.)?templatern\.com(\.) 2 0 0 1 3047 3047 CN=([^\r\n]+?\.)?prizegives\.com(\.) 2 0 0 1 3048 3048 CN=([^\r\n]+?\.)?shareholds\.com(\.) 2 0 0 1 3049 3049 CN=([^\r\n]+?\.)?mesharepoint\.com(\.) 2 0 0 1 3050 3050 CN=([^\r\n]+?\.)?prizewings\.com(\.) 2 0 0 1 3051 3051 CN=([^\r\n]+?\.)?doctricant\.com(\.) 2 0 0 1 3052 3052 CN=([^\r\n]+?\.)?sharession\.com(\.) 2 0 0 1 3053 3053 CN=([^\r\n]+?\.)?sharepointle\.com(\.) 2 0 0 1 3054 3054 CN=([^\r\n]+?\.)?mcsharepoint\.com(\.) 2 0 0 1 3055 3055 CN=([^\r\n]+?\.)?officenced\.com(\.) 2 0 0 1 3056 3056 CN=([^\r\n]+?\.)?templatent\.com(\.) 2 0 0 1 3057 3057 CN=([^\r\n]+?\.)?sharepointen\.com(\.) 2 0 0 1 3058 3058 CN=([^\r\n]+?\.)?officence\.com(\.) 2 0 0 1 3059 3059 CN=([^\r\n]+?\.)?templateau\.com(\.) 2 0 0 1 3060 3060 CN=([^\r\n]+?\.)?sharesbyte\.com(\.) 2 0 0 1 3061 3061 CN=([^\r\n]+?\.)?officences\.com(\.) 2 0 0 1 3062 3062 CN=([^\r\n]+?\.)?officentry\.com(\.) 2 0 0 1 3063 3063 CN=([^\r\n]+?\.)?officested\.com(\.) 2 0 0 1 3064 3064 CN=([^\r\n]+?\.)?prizemons\.com(\.) 2 0 0 1 3065 3065 CN=([^\r\n]+?\.)?prizewel\.com(\.) 2 0 0 1 3066 3066 CN=([^\r\n]+?\.)?sharestion\.com(\.) 2 0 0 1 3067 3067 CN=([^\r\n]+?\.)?attemplate\.com(\.) 2 0 0 1 3068 3068 CN=([^\r\n]+?\.)?windocyte\.com(\.) 2 0 0 1 3069 3069 CN=([^\r\n]+?\.)?logodownload\.org(\.) 2 0 0 1 3070 3070 ^[0-9a-f]{32} 2 0 0 1 3071 3071 # \d+d \d+dh \d+m # 2 0 0 1 3072 3072 \x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B 2 0 0 1 3073 3073 ^\x23\d\d\d\x2f\x21 2 0 0 1 3074 3074 \x06\x00?$ 2 0 0 1 3075 3075 \.php\?i=\w+_[0-9A-F]{8}&k=\d+$ 2 0 0 1 3076 3076 .asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition= 2 0 0 1 3077 3077 \/smain\?scout=acxc[a-z]{3}$ 2 0 0 1 3078 3078 \?sid=[0-9A-F]{180} 2 0 0 1 3079 3079 .asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2}) 2 0 0 1 3080 3080 \/chr\/\d+\/e\/t\d+\?lid= 2 0 0 1 3081 3081 mac=([0-9A-F]{2}:){5}([0-9A-F]{2}) 2 0 0 1 3082 3082 mac=([0-9A-F]{2}:){5}([0-9A-F]{2}) 2 0 0 1 3083 3083 cmd=give&pcname=.+&status=\d+$ 2 0 0 1 3084 3084 \?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$ 2 0 0 1 3085 3085 Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} 2 0 0 1 3086 3086 \/[0-9A-Z]+\/[0-9A-Z]+\.bin$ 2 0 0 1 3087 3087 \x2fpeca\d+\x2eexe 2 0 0 1 3088 3088 \.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$ 2 0 0 1 3089 3089 si\x5F[a-z]{5}[0-9]{5}\x2Ecb 2 0 0 1 3090 3090 seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb 2 0 0 1 3091 3091 &si=\d+&si=\d+&rd=20\d{11} 2 0 0 1 3092 3092 \x2f\x3fdata\x3d[a-fA-F0-9]{60} 2 0 0 1 3093 3093 \S{20,40}\'\> 2 0 0 1 3094 3094 \.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$ 2 0 0 1 3095 3095 c\x3d[0-9a-f]{100} 2 0 0 1 3096 3096 ^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload) 2 0 0 1 3097 3097 ^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|) 2 0 0 1 3098 3098 hash=\{[a-f0-9]+- 2 0 0 1 3099 3099 \/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$ 2 0 0 1 3100 3100 \.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$ 2 0 0 1 3101 3101 (\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$ 2 0 0 1 3102 3102 ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3}) 2 0 0 1 3103 3103 floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 3104 3104 \.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f 2 0 0 1 3105 3105 (ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn)) 2 0 0 1 3106 3106 \x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02 2 0 0 1 3107 3107 (ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn)) 2 0 0 1 3108 3108 ((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s) 2 0 0 1 3109 3109 \.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r]) 2 0 0 1 3110 3110 ((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action)) 2 0 0 1 3111 3111 ((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 2 0 0 1 3112 3112 PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server ) 2 0 0 1 3113 3113 \x7Cddos\x7C(syn|http)\x7C 2 0 0 1 3114 3114 \?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20 2 0 0 1 3115 3115 \?aid=\d{9}&url=[\w\.\-]{23}$ 2 0 0 1 3116 3116 \?subid=\d{9}&u=[\w\.\-]{23}$ 2 0 0 1 3117 3117 FileName\x3D[^\r\n]*\x2E(dll|exe) 2 0 0 1 3118 3118 Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe 2 0 0 1 3119 3119 download\x2FAntivirus_\d+\x2Eexe 2 0 0 1 3120 3120 \/installer\.\d+\.exe 2 0 0 1 3121 3121 \/installer_\d+\.exe 2 0 0 1 3122 3122 \x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend) 2 0 0 1 3123 3123 Setup_20\d+\x2Eexe 2 0 0 1 3124 3124 \/dl\/AcroIEHelpe(r)?(\d)?\.dll 2 0 0 1 3125 3125 mac=[0-9A-Fa-f]{12}& 2 0 0 1 3126 3126 \?type=slg&id=[0-9A-Z]{18} 2 0 0 1 3127 3127 phid=[A-F0-9]{64} 2 0 0 1 3128 3128 mode=\d+D[0-9A-F]{150} 2 0 0 1 3129 3129 ^x=[0-9a-zA-Z]{50}/P 2 0 0 1 3130 3130 \/x\/\?0\w{35}$ 2 0 0 1 3131 3131 \/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20 2 0 0 1 3132 3132 \?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$ 2 0 0 1 3133 3133 \?spl=MS[0-9]{2}-[0-9]{3}$ 2 0 0 1 3134 3134 \.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$ 2 0 0 1 3135 3135 [1-3]\x2Finstaller\x2FInstaller\x2Eexe 2 0 0 1 3136 3136 \x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F 2 0 0 1 3137 3137 MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\: 2 0 0 1 3138 3138 \/(ucleaner|udefender|ufixer)\.com\/demo\.php\? 2 0 0 1 3139 3139 \.php\?1=[a-z0-9]+_[a-z0-9_]+&i= 2 0 0 1 3140 3140 ^User-Agent\:[^\n]+PassSickle/Hmi 2 0 0 1 3141 3141 \/cd\/un\.php.id=[A-F0-9\-]+&ver= 2 0 0 1 3142 3142 &os=[a-f0-9]{50} 2 0 0 1 3143 3143 ^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+ 2 0 0 1 3144 3144 ^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D 2 0 0 1 3145 3145 Content-Length\x3a [1-9] 2 0 0 1 3146 3146 Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm 2 0 0 1 3147 3147 gameover(\d+)?\.php 2 0 0 1 3148 3148 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D 2 0 0 1 3149 3149 \.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]= 2 0 0 1 3150 3150 \.php\?s=\d&m=[A-F0-9]{16}$ 2 0 0 1 3151 3151 \?id=[A-Za-z]+_[A-Za-z0-9]+& 2 0 0 1 3152 3152 \/index.dat\?\d{5,9}$ 2 0 0 1 3153 3153 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D 2 0 0 1 3154 3154 ^User-Agent\x3a [a-z0-9]{92}/Hmi 2 0 0 1 3155 3155 \/crack\.\d+\.exe$ 2 0 0 1 3156 3156 ^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$ 2 0 0 1 3157 3157 ^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$ 2 0 0 1 3158 3158 \.txt$ 2 0 0 1 3159 3159 ^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d 2 0 0 1 3160 3160 \.php\?cmd=getFile&counter=\d 2 0 0 1 3161 3161 codec=\d+D\d+D\d 2 0 0 1 3162 3162 (\.aim\w*|ascanall)\s+\w 2 0 0 1 3163 3163 report=\d+&pid=\d+&wv=[A-Za-z0-9]/P 2 0 0 1 3164 3164 User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H 2 0 0 1 3165 3165 .php\?gd=\d+_\d+_\d+$ 2 0 0 1 3166 3166 \x2f\d+?\x2erar$ 2 0 0 1 3167 3167 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$ 2 0 0 1 3168 3168 ^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/ 2 0 0 1 3169 3169 ^KEEPALIVE\x7c?\d 2 0 0 1 3170 3170 kill\-\d+.\d+.\d+.\d+\:\d+%\d 2 0 0 1 3171 3171 \x0d\x0aMagic-Number\x3a\s+\d+\|\d 2 0 0 1 3172 3172 \/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F] 2 0 0 1 3173 3173 \x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s] 2 0 0 1 3174 3174 Host\: \d+\.\d+\.\d+\.\d 2 0 0 1 3175 3175 \?n=\d+&id=.+&t=.+&i=\d 2 0 0 1 3176 3176 id=[a-f0-9-]+& 2 0 0 1 3177 3177 ID=.{40}&.{6} 2 0 0 1 3178 3178 (web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi 2 0 0 1 3179 3179 ((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi 2 0 0 1 3180 3180 \/search\?q\=\d+&aq=\d 2 0 0 1 3181 3181 \x7C(NEW|Awaiting commands) 2 0 0 1 3182 3182 \x7C(NEW|Awaiting commands) 2 0 0 1 3183 3183 \x7C(NEW|Awaiting commands) 2 0 0 1 3184 3184 ^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e 2 0 0 1 3185 3185 ^\d+\s*--> 2 0 0 1 3186 3186 ^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n--> 2 0 0 1 3187 3187 \&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\- 2 0 0 1 3188 3188 ^Accept-Encoding\x3a\s+([a-z]){3}/Hmi 2 0 0 1 3189 3189 user=[a-f0-9]{32}& 2 0 0 1 3190 3190 \/tlog\.php\?logn=[^\s]+&pss=[^\s] 2 0 0 1 3191 3191 ntarg\.php\?[^\s]*(notdoing|howme|uname)= 2 0 0 1 3192 3192 \/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s] 2 0 0 1 3193 3193 updatea\.php\?p=\d 2 0 0 1 3194 3194 &d=.{44}$ 2 0 0 1 3195 3195 filename=j[a-f0-9]{23}\.jar/H 2 0 0 1 3196 3196 ^hello\/[0-9]\.[0-9]\/[0-9]{3} 2 0 0 1 3197 3197 ^[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1 3198 3198 ^[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1 3199 3199 NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z] 2 0 0 1 3200 3200 ^\d+\w+\/\d+\w+ free \(\d+% used\) 2 0 0 1 3201 3201 ^[A-Z]\x3a\x5f 2 0 0 1 3202 3202 filename=e[a-f0-9]{23}\.exe/H 2 0 0 1 3203 3203 ^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm 2 0 0 1 3204 3204 ^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\| 2 0 0 1 3205 3205 ^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}) 2 0 0 1 3206 3206 ^[a-z0-9\+\/]+={0,2}$ 2 0 0 1 3207 3207 ^(\r\n|$) 2 0 0 1 3208 3208 ^\d+?\x5d 2 0 0 1 3209 3209 ^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA]) 2 0 0 1 3210 3210 ^(4\x00[1-9a-f]|5\x00[\da]) 2 0 0 1 3211 3211 ^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm 2 0 0 1 3212 3212 data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt 2 0 0 1 3213 3213 ^\d+?\x7cOnConnect\x7c 2 0 0 1 3214 3214 ^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01 2 0 0 1 3215 3215 ^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01 2 0 0 1 3216 3216 ^[0-9a-f]{22,46} 2 0 0 1 3217 3217 ^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS) 2 0 0 1 3218 3218 ^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a 2 0 0 1 3219 3219 ^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$ 2 0 0 1 3220 3220 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3221 3221 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3222 3222 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3223 3223 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3224 3224 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3225 3225 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3226 3226 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3227 3227 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3228 3228 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3229 3229 ^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl]) 2 0 0 1 3230 3230 ^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 3231 3231 ^[^\x00]+?\x00 2 0 0 1 3232 3232 Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi 2 0 0 1 3233 3233 ID=\d{24}($|&) 2 0 0 1 3234 3234 ^[a-z0-9_-]*?\.class 2 0 0 1 3235 3235 name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22 2 0 0 1 3236 3236 ^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01 2 0 0 1 3237 3237 ^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration) 2 0 0 1 3238 3238 ^\d+?\.\d+?\sstarted 2 0 0 1 3239 3239 ^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$ 2 0 0 1 3240 3240 MyValue=[a-f0-9]{32} 2 0 0 1 3241 3241 ^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n] 2 0 0 1 3242 3242 ^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op) 2 0 0 1 3243 3243 name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22 2 0 0 1 3244 3244 \/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$ 2 0 0 1 3245 3245 adobe-flash\.v\.\d{5}\.exe 2 0 0 1 3246 3246 \x2Finvoice\x2Escr$ 2 0 0 1 3247 3247 forum\/\?[0-9a-f]{8}$ 2 0 0 1 3248 3248 ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip 2 0 0 1 3249 3249 Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi 2 0 0 1 3250 3250 User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H 2 0 0 1 3251 3251 \/xxxx_\d+\/ 2 0 0 1 3252 3252 ^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi 2 0 0 1 3253 3253 \x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00 2 0 0 1 3254 3254 ^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9]) 2 0 0 1 3255 3255 ^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c 2 0 0 1 3256 3256 ^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01 2 0 0 1 3257 3257 ^\d 2 0 0 1 3258 3258 [^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33 2 0 0 1 3259 3259 ^\x2d?\d 2 0 0 1 3260 3260 My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A 2 0 0 1 3261 3261 ^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b 2 0 0 1 3262 3262 ^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]R|CO|EX|HL|KD|OZ|RT|TQ|US|WI)|S(L[BEV]|[DEH]N|[JOP]M|G[PS]|V[KN]|W[EZ]|Y[CR]|[MU]R|AU|RB|SD|TP)|B(L[MRZ]|R[ABN]|E[LN]|G[DR]|H[RS]|[FW]A|DI|IH|MU|OL|TN|VT)|C(O[DGKLM]|H[ELN]|A[FN]|Y[MP]|[IP]V|[MX]R|CK|RI|UB|ZE)|A(R[EGM]|T[AFG]|L[AB]|N[DT]|U[ST]|BW|FG|GO|IA|SM|ZE)|G(R[CDL]|U[FMY]|I[BN]|N[BQ]|[AM]B|BR|EO|GY|HA|LP|TM)|T(U[NRV]|C[AD]|K[LM]|[GT]O|[HZ]A|[OW]N|JK|LS)|P(R[IKTY]|A[KN]|[HO]L|CN|ER|LW|NG|SE|YF)|N([CPZ]L|I[CU]|[EO]R|AM|FK|GA|LD|RU)|L(B[NRY]|[CKV]A|[AS]O|IE|TU|UX)|I(R[LNQ]|S[LR]|[DM]N|ND|OT|TA)|K([AG]Z|[IO]R|EN|HM|NA|WT)|E(S[HPT]|CU|GY|RI|TH)|V([ACU]T|EN|GB|IR|NM)|D([MZ]A|EU|JI|NK|OM)|F(R[AO]|IN|JI|LK|SM)|H([MN]D|KG|RV|TI|UN)|U([GS]A|KR|MI|RY|ZB)|J(AM|EY|OR|PN)|R([EO]U|US|WA)|Z(AF|MB|WE)|W(LF|SM)|OMN|QAT|YEM)\b 2 0 0 1 3263 3263 ^[a-z0-9_-]*?\.class 2 0 0 1 3264 3264 ^.\x00\x00\x00[a-z0-9]+?\x00 2 0 0 1 3265 3265 ^\d+[\r\n]*?$ 2 0 0 1 3266 3266 ^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F) 2 0 0 1 3267 3267 ^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood) 2 0 0 1 3268 3268 ^[a-z]{12} 2 0 0 1 3269 3269 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$ 2 0 0 1 3270 3270 ^[a-z]{16} 2 0 0 1 3271 3271 \/get\/get\.php$ 2 0 0 1 3272 3272 ^[A-Za-z0-9\s/+]{100} 2 0 0 1 3273 3273 ^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net) 2 0 0 1 3274 3274 ^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)> 2 0 0 1 3275 3275 ^[^\r\n]+?\n$ 2 0 0 1 3276 3276 \x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 3277 3277 \x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 3278 3278 \x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 3279 3279 \x21\x20SCANNER\x20(ON|OFF)\x0A 2 0 0 1 3280 3280 \x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 3281 3281 ^[a-z][a-f0-9]{33} 2 0 0 1 3282 3282 ^[a-z][a-f0-9]{33} 2 0 0 1 3283 3283 ^[a-z][a-f0-9]{33} 2 0 0 1 3284 3284 ^[a-z][a-f0-9]{33} 2 0 0 1 3285 3285 ^[a-z][a-f0-9]{33} 2 0 0 1 3286 3286 ^[a-z][a-f0-9]{33} 2 0 0 1 3287 3287 ^[a-z][a-f0-9]{33} 2 0 0 1 3288 3288 ^[a-z][a-f0-9]{33} 2 0 0 1 3289 3289 ^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi 2 0 0 1 3290 3290 ^[a-f0-9]+$ 2 0 0 1 3291 3291 ^[0-9A-F]{12}$ 2 0 0 1 3292 3292 ^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n? 2 0 0 1 3293 3293 ^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$ 2 0 0 1 3294 3294 ^(ON|OFF) 2 0 0 1 3295 3295 ^\d+MHz\x00 2 0 0 1 3296 3296 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$ 2 0 0 1 3297 3297 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$ 2 0 0 1 3298 3298 ^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var) 2 0 0 1 3299 3299 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3300 3300 ^[\x53\x54] 2 0 0 1 3301 3301 ^[a-z0-9]{50} 2 0 0 1 3302 3302 ^[a-z0-9]{50} 2 0 0 1 3303 3303 ^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$ 2 0 0 1 3304 3304 ^\d+\]\r\n$ 2 0 0 1 3305 3305 ^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n 2 0 0 1 3306 3306 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d 2 0 0 1 3307 3307 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d 2 0 0 1 3308 3308 ^[A-F0-9]{8,12} 2 0 0 1 3309 3309 ^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$ 2 0 0 1 3310 3310 ^[\x01\x03\x08\x09\x0b]\x00 2 0 0 1 3311 3311 ^\d{1,3}[0-2] 2 0 0 1 3312 3312 \.tar$ 2 0 0 1 3313 3313 ^[a-zA-Z0-9]{8} 2 0 0 1 3314 3314 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 3315 3315 \x7c[a-f0-9]{16}\x7c\d+\x7c$ 2 0 0 1 3316 3316 [^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28 2 0 0 1 3317 3317 \x00\x05value$ 2 0 0 1 3318 3318 ^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 3319 3319 ^\d{1,5} 2 0 0 1 3320 3320 ^.{2}[a-z]{5,}\.[a-z]{2}\x30 2 0 0 1 3321 3321 ^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10} 2 0 0 1 3322 3322 ^(in|out) 2 0 0 1 3323 3323 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3324 3324 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3325 3325 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3326 3326 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3327 3327 ^[0-9A-F]{12} 2 0 0 1 3328 3328 ^\d{1,6}\x00pl\x7c 2 0 0 1 3329 3329 ^\d{1,6}\x00sc\x7e\x7c 2 0 0 1 3330 3330 ^\d{1,6}\x00scPK\x7c 2 0 0 1 3331 3331 ^\d{1,6}\x00rn\x7c 2 0 0 1 3332 3332 ^\d{1,6}\x00ret\x7c 2 0 0 1 3333 3333 ^\d{1,6}\x00cap\x7c 2 0 0 1 3334 3334 ^\d{1,6}\x00kl\x7c 2 0 0 1 3335 3335 ^\d{1,6}\x00fm\x7c 2 0 0 1 3336 3336 ^\d{1,6}\x00proc\x7c 2 0 0 1 3337 3337 ^\d{1,6}\x00rg\x7c 2 0 0 1 3338 3338 ^\d{1,6}\x00srv\x7c 2 0 0 1 3339 3339 ^\d{1,6}\x00rs\x7c 2 0 0 1 3340 3340 ^\d{1,6}\x00mic\x7c 2 0 0 1 3341 3341 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 3342 3342 ^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a 2 0 0 1 3343 3343 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3344 3344 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3345 3345 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3346 3346 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3347 3347 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3348 3348 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3349 3349 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3350 3350 ^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var) 2 0 0 1 3351 3351 ^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$ 2 0 0 1 3352 3352 ^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$ 2 0 0 1 3353 3353 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3354 3354 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3355 3355 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3356 3356 ^\d+ 2 0 0 1 3357 3357 ^.{2}[a-z]{5,}\.[a-z]{2,3}[01] 2 0 0 1 3358 3358 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1 3359 3359 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1 3360 3360 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1 3361 3361 ^.{2}[a-z]{5,}\.[a-z]{2}[01] 2 0 0 1 3362 3362 ^.{2}[a-z]{25}\.[a-z]{2,3}[01] 2 0 0 1 3363 3363 ^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2}) 2 0 0 1 3364 3364 \/\?[A-Z]{10,}$ 2 0 0 1 3365 3365 ^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm 2 0 0 1 3366 3366 \/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$ 2 0 0 1 3367 3367 \.php$ 2 0 0 1 3368 3368 ^KEEPALIVE\d+$ 2 0 0 1 3369 3369 \x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd) 2 0 0 1 3370 3370 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14} 2 0 0 1 3371 3371 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14} 2 0 0 1 3372 3372 \.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$ 2 0 0 1 3373 3373 ^[a-f0-9]{7,}$ 2 0 0 1 3374 3374 ^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01] 2 0 0 1 3375 3375 ^[^\x00]+(\xff\xd9)?$ 2 0 0 1 3376 3376 ^0103F\x00[^\x00]+(\xff\xd9)?$ 2 0 0 1 3377 3377 ^0103F\x00[^\x00]+(\xff\xd9)?$ 2 0 0 1 3378 3378 ^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01] 2 0 0 1 3379 3379 ^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27] 2 0 0 1 3380 3380 ^[a-z]{12} 2 0 0 1 3381 3381 ^[a-f0-9]{14}$ 2 0 0 1 3382 3382 ^\d 2 0 0 1 3383 3383 \.php\?id=\d+&magic=(-)?\d+$ 2 0 0 1 3384 3384 ^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01] 2 0 0 1 3385 3385 ^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3} 2 0 0 1 3386 3386 ^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2} 2 0 0 1 3387 3387 ^KEEPALIVE\x7c?\d 2 0 0 1 3388 3388 ^[a-f0-9]{13,30}$ 2 0 0 1 3389 3389 ^[a-f0-9]{13,30}$ 2 0 0 1 3390 3390 ^[a-f0-9]{13,30}$ 2 0 0 1 3391 3391 ^[a-f0-9]{13,30}$ 2 0 0 1 3392 3392 ^[a-f0-9]{13,30}$ 2 0 0 1 3393 3393 ^[a-f0-9]{13,30}$ 2 0 0 1 3394 3394 ^[a-f0-9]{13,30}$ 2 0 0 1 3395 3395 ^[a-f0-9]{13,30}$ 2 0 0 1 3396 3396 ^[a-f0-9]{13,30}$ 2 0 0 1 3397 3397 ^[a-f0-9]{13,30}$ 2 0 0 1 3398 3398 ^[a-f0-9]{13,30}$ 2 0 0 1 3399 3399 ^[a-f0-9]{13,30}$ 2 0 0 1 3400 3400 ^[a-f0-9]{13,30}$ 2 0 0 1 3401 3401 ^[a-f0-9]{13,30}$ 2 0 0 1 3402 3402 ^[a-f0-9]{13,30}$ 2 0 0 1 3403 3403 ^[a-f0-9]{13,30}$ 2 0 0 1 3404 3404 ^[A-F0-9]+\x00 2 0 0 1 3405 3405 Cookie\x3a mstshash=[a-zA-Z]\r\n 2 0 0 1 3406 3406 ^[^A-Za-z0-9] 2 0 0 1 3407 3407 ^(FM|SM|CP|CM|MC|NF|CH|PS|PT) 2 0 0 1 3408 3408 ^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c 2 0 0 1 3409 3409 ^(\x40|\x21|\x23|\x7e|\x24) 2 0 0 1 3410 3410 \bnethelper\b/Vi 2 0 0 1 3411 3411 ^\d 2 0 0 1 3412 3412 [\x04\x06]\x88\x4d\x76$ 2 0 0 1 3413 3413 [\xb0\xb2]\x63\x70\x7b$ 2 0 0 1 3414 3414 ^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2})(.{0,50}[A-Za-z0-9]{5})((<b1>.).{0,53}(=b1).{0,52}(=b1).{0,51}(=b1).{0,50}(=b1))(.(<b2>.).{0,52}(=b2).{0,51}(=b2).{0,50}(=b2).{0,49}(=b2))(..(<b3>.).{0,51}(=b3).{0,50}(=b3).{0,49}(=b3).{0,48}(=b3))(...(<b4>.).{0,50}(=b4).{0,49}(=b4).{0,48}(=b4).{0,47}(=b4))(....(<b5>.).{0,49}(=b5).{0,48}(=b5).{0,47}(=b5).{0,46}(=b5))(.....(<b6>.).{0,48}(=b6).{0,47}(=b6).{0,46}(=b6).{0,45}(=b6))(......(<b7>.).{0,47}(=b7).{0,46}(=b7).{0,45}(=b7).{0,44}(=b7))(.......(<b8>.).{0,46}(=b8).{0,45}(=b8).{0,44}(=b8).{0,43}(=b8))(........(<b9>.).{0,45}(=b9).{0,44}(=b9).{0,43}(=b9).{0,42}(=b9))(.........(<b10>.).{0,44}(=b10).{0,43}(=b10).{0,42}(=b10).{0,41}(=b10)) 2 0 0 1 3415 3415 \r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H 2 0 0 1 3416 3416 ^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H 2 0 0 1 3417 3417 name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a 2 0 0 1 3418 3418 ^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$ 2 0 0 1 3419 3419 ^[acdefghijlmopqrtwz]{16}\.mynumber\.org$ 2 0 0 1 3420 3420 ^Host\x3a (\d+\.){3}\d+$ 2 0 0 1 3421 3421 ^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1} 2 0 0 1 3422 3422 ^(_|Keylogger) 2 0 0 1 3423 3423 [^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12 2 0 0 1 3424 3424 ^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$ 2 0 0 1 3425 3425 ^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=) 2 0 0 1 3426 3426 itwm=[A-Za-z0-9\-\_]{29,35} 2 0 0 1 3427 3427 &itwm=[A-Za-z0-9\-\_]{29,35} 2 0 0 1 3428 3428 [A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp 2 0 0 1 3429 3429 Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a 2 0 0 1 3430 3430 ^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0 2 0 0 1 3431 3431 ^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi 2 0 0 1 3432 3432 ^\x00+?[\x20-\x7f]+?\x00+?$ 2 0 0 1 3433 3433 ^\x00+?[\x20-\x7f]+?\x00+?$ 2 0 0 1 3434 3434 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1 3435 3435 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1 3436 3436 ^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi 2 0 0 1 3437 3437 ^[\x22\x27][a-z][\x27\x22] 2 0 0 1 3438 3438 ^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03. 2 0 0 1 3439 3439 ^[0-9]{3}\x7cx 2 0 0 1 3440 3440 ^[0-9]{2}\x7cx 2 0 0 1 3441 3441 ^[a-f0-9]{40,}$ 2 0 0 1 3442 3442 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3443 3443 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps 2 0 0 1 3444 3444 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps 2 0 0 1 3445 3445 ([0-9A-F]{8}\-){5}\-SH 2 0 0 1 3446 3446 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1 3447 3447 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1 3448 3448 ^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8}) 2 0 0 1 3449 3449 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3450 3450 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3451 3451 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3452 3452 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3453 3453 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3454 3454 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3455 3455 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3456 3456 ^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?f([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?a([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?u([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?l([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?t([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?#([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?V([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?M([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?L[\x22\x27] 2 0 0 1 3457 3457 ^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff] 2 0 0 1 3458 3458 ^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$ 2 0 0 1 3459 3459 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1 3460 3460 \/js\/bin\.exe\\d+$ 2 0 0 1 3461 3461 ^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 3462 3462 ^.{2}[a-z]+@[a-z]+\.com[01] 2 0 0 1 3463 3463 ^.{2}[a-z]+@[a-z]+\.com[01] 2 0 0 1 3464 3464 ^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01] 2 0 0 1 3465 3465 \x00[0-9]{4,7}\x02in\x00 2 0 0 1 3466 3466 ^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2} 2 0 0 1 3467 3467 ^[\x08-\xFF]([a-f0-9]{2})*?dc978a97 2 0 0 1 3468 3468 ^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz) 2 0 0 1 3469 3469 ^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz) 2 0 0 1 3470 3470 ^(0+30)[0-9A-Z]+30[^0-9] 2 0 0 1 3471 3471 [a-z]{4,10}\.velodrivve\.biz$ 2 0 0 1 3472 3472 [a-z]{4,10}\.bedrifg\.org$ 2 0 0 1 3473 3473 [a-z]{4,10}\.fedbook\.org$ 2 0 0 1 3474 3474 [a-z]{4,10}\.goodbird\.biz$ 2 0 0 1 3475 3475 [a-z]{4,10}\.verekt\.biz$ 2 0 0 1 3476 3476 [a-z]{4,10}\.barrout\.org$ 2 0 0 1 3477 3477 [a-z]{4,10}\.biojart\.biz$ 2 0 0 1 3478 3478 [a-z]{4,10}\.benefin\.org$ 2 0 0 1 3479 3479 \.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f 2 0 0 1 3480 3480 \/operator\/login\.php$ 2 0 0 1 3481 3481 ^.{8}[\x20-\x7e]+?\x7b\x9e 2 0 0 1 3482 3482 ^Subject\x3a [^\r\n]+?Foi Instalado 2 0 0 1 3483 3483 ^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe 2 0 0 1 3484 3484 \x00\x07[a-z0-9]{7}\x02eu\x00 2 0 0 1 3485 3485 [^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00 2 0 0 1 3486 3486 ^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6} 2 0 0 1 3487 3487 ^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$ 2 0 0 1 3488 3488 ^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi 2 0 0 1 3489 3489 ^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi 2 0 0 1 3490 3490 ^Keylogger\r$ 2 0 0 1 3491 3491 ^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a 2 0 0 1 3492 3492 ^[A-F0-9]{48}\.bin\r\n 2 0 0 1 3493 3493 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$ 2 0 0 1 3494 3494 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$ 2 0 0 1 3495 3495 ^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi 2 0 0 1 3496 3496 ^Host\x3a[^\r\n]+\.asia\r\n/Hmi 2 0 0 1 3497 3497 ^Host\x3a[^\r\n]+\.ru\r\n/Hmi 2 0 0 1 3498 3498 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$ 2 0 0 1 3499 3499 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1 3500 3500 ^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D)) 2 0 0 1 3501 3501 ^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$ 2 0 0 1 3502 3502 ^\s*\s*?[\x22\x27]javax.naming.InitialContext 2 0 0 1 3503 3503 \x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$ 2 0 0 1 3504 3504 ^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$ 2 0 0 1 3505 3505 (JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n 2 0 0 1 3506 3506 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$ 2 0 0 1 3507 3507 ^(:?[78]|XP) 2 0 0 1 3508 3508 \.php\?\d{1,4}$ 2 0 0 1 3509 3509 \.php\?\d{1,4}$ 2 0 0 1 3510 3510 \/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1 3511 3511 ^AuthToken=[A-Za-z0-9+/]{43}=$ 2 0 0 1 3512 3512 \.[^\x3F]+\?id=\d+&act=\d+$ 2 0 0 1 3513 3513 ^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01] 2 0 0 1 3514 3514 ^[0-9A-Z]+232A 2 0 0 1 3515 3515 ^\d{1,3}$ 2 0 0 1 3516 3516 ^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n 2 0 0 1 3517 3517 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3518 3518 ^(likes|check|login_status)\.json\? 2 0 0 1 3519 3519 ^[0-9A-F]{16}$ 2 0 0 1 3520 3520 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3521 3521 ^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/ 2 0 0 1 3522 3522 ^[a-z0-9/%=]{100,}$ 2 0 0 1 3523 3523 ^(-[0-9]+|[A-F0-9]{32})=1$ 2 0 0 1 3524 3524 ^(-[0-9]+|[A-F0-9]{32})=1&type=zip$ 2 0 0 1 3525 3525 ^(-[0-9]+|[A-F0-9]{32})=1&type=filter$ 2 0 0 1 3526 3526 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u= 2 0 0 1 3527 3527 ^[A-Za-z0-9\/\.=]{250,}$ 2 0 0 1 3528 3528 ^\d+\x0a$ 2 0 0 1 3529 3529 ^[A-Za-z0-9]{25,}$ 2 0 0 1 3530 3530 ^\d{2,4}$ 2 0 0 1 3531 3531 ^[a-z0-9]{6}$ 2 0 0 1 3532 3532 ^=?[a-z0-9]{6}$ 2 0 0 1 3533 3533 ^(pe|pp|s)$ 2 0 0 1 3534 3534 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3535 3535 ^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a 2 0 0 1 3536 3536 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi 2 0 0 1 3537 3537 &p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$ 2 0 0 1 3538 3538 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3539 3539 ^[A-F0-9]{8}$ 2 0 0 1 3540 3540 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$ 2 0 0 1 3541 3541 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3542 3542 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1 3543 3543 ^[a-z]{200,}$ 2 0 0 1 3544 3544 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3545 3545 ^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday) 2 0 0 1 3546 3546 ^[a-f0-9]{32}$ 2 0 0 1 3547 3547 ^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$ 2 0 0 1 3548 3548 ^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\. 2 0 0 1 3549 3549 ^88[a-fA-F0-9]{38}b9\. 2 0 0 1 3550 3550 ^8b[a-fA-F0-9]{46}b9\. 2 0 0 1 3551 3551 &uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1 3552 3552 ^[a-z]{256}$ 2 0 0 1 3553 3553 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3554 3554 \x2Fu\x2Fupd\x5F(cb|.+\x2Ecb) 2 0 0 1 3555 3555 ^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$ 2 0 0 1 3556 3556 \x2F(data|main|patch)\x2Ecfg 2 0 0 1 3557 3557 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3558 3558 c\x3d[0-9a-f]{100} 2 0 0 1 3559 3559 \.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$ 2 0 0 1 3560 3560 ^(0-9]{1,3}\.){3}\d{1,3}$ 2 0 0 1 3561 3561 ^[^?#]+?\.php\?f=\w+&e=\d+$ 2 0 0 1 3562 3562 id=[A-F0-9]{20} 2 0 0 1 3563 3563 ^(x\d{1,2}){5,} 2 0 0 1 3564 3564 \?ca[sc]hingDeny=[0-9A-Za-z]{16}& 2 0 0 1 3565 3565 ^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1 3566 3566 ^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1 3567 3567 ^\d+$ 2 0 0 1 3568 3568 ^\d+$ 2 0 0 1 3569 3569 ^\d+$ 2 0 0 1 3570 3570 ^[a-z0-9]{60} 2 0 0 1 3571 3571 ^[A-F0-9\-]+&ver= 2 0 0 1 3572 3572 ^[A-F0-9\-]+&ver= 2 0 0 1 3573 3573 \/task.php\?id=[^&]{32,64}&task=\d 2 0 0 1 3574 3574 ^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a= 2 0 0 1 3575 3575 c\x3d[0-9A-F]{100} 2 0 0 1 3576 3576 ^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com 2 0 0 1 3577 3577 \.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$ 2 0 0 1 3578 3578 ^\d{5,9}$ 2 0 0 1 3579 3579 \x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212 2 0 0 1 3580 3580 ^[a-z]{3,6}\x3d[A-F0-9]{50} 2 0 0 1 3581 3581 ^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F]) 2 0 0 1 3582 3582 verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d 2 0 0 1 3583 3583 ^\d+$ 2 0 0 1 3584 3584 ^(\d+|x.+) 2 0 0 1 3585 3585 ^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$ 2 0 0 1 3586 3586 id=x.+_[0-9A-F]{8}&build_id=. 2 0 0 1 3587 3587 ^[A-Za-z0-9+\/=]+?$ 2 0 0 1 3588 3588 v=\d+&rnd=\d 2 0 0 1 3589 3589 \?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id= 2 0 0 1 3590 3590 p4=\d+&p5=\d+&hs=\d 2 0 0 1 3591 3591 ^[a-f0-9] 2 0 0 1 3592 3592 ^\d 2 0 0 1 3593 3593 \x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D 2 0 0 1 3594 3594 \.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d 2 0 0 1 3595 3595 id=\d+&bid=[^&]+&query=\w+&data=\w 2 0 0 1 3596 3596 ^[a-z]{1,4}\x3d[a-z0-9]+?$ 2 0 0 1 3597 3597 ^\d{5}\x2eddns[a-z0-9]\x2eeu$ 2 0 0 1 3598 3598 ^\/[A-Z]+\.php\?php=receipt$ 2 0 0 1 3599 3599 ^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5} 2 0 0 1 3600 3600 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3601 3601 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3602 3602 ^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$ 2 0 0 1 3603 3603 ^(id|key)= 2 0 0 1 3604 3604 User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$ 2 0 0 1 3605 3605 &userid=\d{4}&other=[MF] 2 0 0 1 3606 3606 ^[A-Z]{10}$ 2 0 0 1 3607 3607 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1 3608 3608 \/[a-z0-9]+$ 2 0 0 1 3609 3609 ^[a-z0-9]{196} 2 0 0 1 3610 3610 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 3611 3611 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 3612 3612 ^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 3613 3613 \/[a-z]\/$ 2 0 0 1 3614 3614 ^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$ 2 0 0 1 3615 3615 ^[a-z]{15}$ 2 0 0 1 3616 3616 ^[a-z]{3,4}\/\d{1,4}$ 2 0 0 1 3617 3617 ^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data 2 0 0 1 3618 3618 ^\d+?\x22 2 0 0 1 3619 3619 ^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$ 2 0 0 1 3620 3620 ^[^\r\n]+?\$ 2 0 0 1 3621 3621 ^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$ 2 0 0 1 3622 3622 =[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1 3623 3623 ^[a-f0-9]{32}\/[0-9]$ 2 0 0 1 3624 3624 \/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$ 2 0 0 1 3625 3625 \/crypt_[^\/]*?sell[^\/]*?\d\.exe$ 2 0 0 1 3626 3626 \/[A-F0-9]+$ 2 0 0 1 3627 3627 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1 3628 3628 ^[^\x22\x2f\r\n]+?\x22\r\n 2 0 0 1 3629 3629 ^[^&]+?&\d+$ 2 0 0 1 3630 3630 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3631 3631 ^id=[A-Z0-9]+?&info=[A-Z0-9]+?$ 2 0 0 1 3632 3632 ^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3} 2 0 0 1 3633 3633 ^\x2F(policy|cache)$ 2 0 0 1 3634 3634 ^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid) 2 0 0 1 3635 3635 (\?|&)guid=[^!&]+?\! 2 0 0 1 3636 3636 ^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$ 2 0 0 1 3637 3637 ^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1= 2 0 0 1 3638 3638 \.((jp|pn)g|cgi|gif)\?tq= 2 0 0 1 3639 3639 ^\/[b-u][A-Za-z0-9]{6,25}\.php$ 2 0 0 1 3640 3640 ^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}), 2 0 0 1 3641 3641 ^\d{5,}$ 2 0 0 1 3642 3642 \?[0-9a-f]{6}$ 2 0 0 1 3643 3643 \?ID=[A-Z]{10}$ 2 0 0 1 3644 3644 ^[0-9A-F]{12,24} 2 0 0 1 3645 3645 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1 3646 3646 \.cgi\?s(id)\d{1,12}&r= 2 0 0 1 3647 3647 \/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$ 2 0 0 1 3648 3648 ^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$ 2 0 0 1 3649 3649 \/\/?$ 2 0 0 1 3650 3650 ^(\x3a\d{1,5})?$ 2 0 0 1 3651 3651 ^(\x3a\d{1,5})?$ 2 0 0 1 3652 3652 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$ 2 0 0 1 3653 3653 ^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$ 2 0 0 1 3654 3654 \/0\/$ 2 0 0 1 3655 3655 ^[^\x2f]+\/[a-z0-9]+$ 2 0 0 1 3656 3656 \/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$ 2 0 0 1 3657 3657 ^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_ 2 0 0 1 3658 3658 ^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$ 2 0 0 1 3659 3659 ^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$ 2 0 0 1 3660 3660 ^\/[\/a-z0-9]+$ 2 0 0 1 3661 3661 ^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$ 2 0 0 1 3662 3662 ^\/UID\d+\.jsp\? 2 0 0 1 3663 3663 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1 3664 3664 \.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d 2 0 0 1 3665 3665 ^[0-9A-F]{550,}\.html 2 0 0 1 3666 3666 \/Setup_\d+\.exe$ 2 0 0 1 3667 3667 \?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8= 2 0 0 1 3668 3668 &ver=\d\.\d$ 2 0 0 1 3669 3669 ^\/([A-Fa-f0-9]+|index\.php)$ 2 0 0 1 3670 3670 ^(c(omment|_id)|m(jdu)?)= 2 0 0 1 3671 3671 ^\/1+$ 2 0 0 1 3672 3672 (MSIE|rv\x3a11) 2 0 0 1 3673 3673 \/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1 3674 3674 &data=([a-z]\d){7,}$ 2 0 0 1 3675 3675 ^([a-z]\d){7,}\.zip\x22 2 0 0 1 3676 3676 (MSIE|rv\x3a11\.0) 2 0 0 1 3677 3677 ^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1 3678 3678 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 3679 3679 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$ 2 0 0 1 3680 3680 =0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$ 2 0 0 1 3681 3681 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 3682 3682 0[0-2]0000[a-fA-F0-9]{16,}$ 2 0 0 1 3683 3683 ^\d+$ 2 0 0 1 3684 3684 ^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+ 2 0 0 1 3685 3685 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$ 2 0 0 1 3686 3686 ^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s= 2 0 0 1 3687 3687 ^[a-zA-Z0-9+/]{43} 2 0 0 1 3688 3688 ^winver=\d+&ver=\d+$ 2 0 0 1 3689 3689 ^\/\?0=([^&]+?&\d+)+?[^=&]+?$ 2 0 0 1 3690 3690 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 3691 3691 ^[a-z]{2,}=(%[A-F0-9]{2})+& 2 0 0 1 3692 3692 ^[a-z]{2,}=(%[A-F0-9]{2})+& 2 0 0 1 3693 3693 ^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$ 2 0 0 1 3694 3694 ^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$ 2 0 0 1 3695 3695 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n 2 0 0 1 3696 3696 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n 2 0 0 1 3697 3697 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n 2 0 0 1 3698 3698 ^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n 2 0 0 1 3699 3699 ^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$ 2 0 0 1 3700 3700 \?uid=\d+&context=\w+&mode=text&data=\w+$ 2 0 0 1 3701 3701 ^\/\d+$ 2 0 0 1 3702 3702 ^\/sys\/(who|genid|data|upload|update) 2 0 0 1 3703 3703 ^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$ 2 0 0 1 3704 3704 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3705 3705 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 3706 3706 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3707 3707 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3708 3708 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 3709 3709 ^\/[a-z]+\/[a-z]+\.exe$ 2 0 0 1 3710 3710 \.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$ 2 0 0 1 3711 3711 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 3712 3712 ^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4} 2 0 0 1 3713 3713 \/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$ 2 0 0 1 3714 3714 ^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$ 2 0 0 1 3715 3715 ^[C-J]\r\n 2 0 0 1 3716 3716 ^[A-Z]+$ 2 0 0 1 3717 3717 ^(32|64)$ 2 0 0 1 3718 3718 \/$ 2 0 0 1 3719 3719 ^[a-f0-9]+(\x20[a-f0-9]+)+$ 2 0 0 1 3720 3720 ^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$ 2 0 0 1 3721 3721 &_=\d+$ 2 0 0 1 3722 3722 &_=\d+$ 2 0 0 1 3723 3723 &_=\d+$ 2 0 0 1 3724 3724 ^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$ 2 0 0 1 3725 3725 ^\d+$ 2 0 0 1 3726 3726 ^[a-z]=[a-f0-9]{80,}$ 2 0 0 1 3727 3727 \/[a-f0-9]{32}\.png$ 2 0 0 1 3728 3728 &(un)?key=[A-Z]+$ 2 0 0 1 3729 3729 \.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$ 2 0 0 1 3730 3730 ^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$ 2 0 0 1 3731 3731 ^\/p\?\d+(\x3b\d+){4}$ 2 0 0 1 3732 3732 ^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$ 2 0 0 1 3733 3733 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3734 3734 \/[a-f0-9]{8}\/archive\/\d{8,10}\.html$ 2 0 0 1 3735 3735 \?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$ 2 0 0 1 3736 3736 iid=[a-fA-F0-9]{32}&kernel= 2 0 0 1 3737 3737 iid=[a-fA-F0-9]{32}&username= 2 0 0 1 3738 3738 ^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$ 2 0 0 1 3739 3739 ^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$ 2 0 0 1 3740 3740 ^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D 2 0 0 1 3741 3741 \/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3742 3742 ^filename=[a-z]+?\.[a-z]+?&data= 2 0 0 1 3743 3743 ^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)? 2 0 0 1 3744 3744 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 3745 3745 ^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a 2 0 0 1 3746 3746 _W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$ 2 0 0 1 3747 3747 x20InfoPath\x2e\d[^\x29]+$ 2 0 0 1 3748 3748 \/\d{4,}\.txt$ 2 0 0 1 3749 3749 \/([a-z]+|\d+)\.jpg 2 0 0 1 3750 3750 \?[a-z0-9]{32}$ 2 0 0 1 3751 3751 [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 3752 3752 \.[a-z]{3,4}$ 2 0 0 1 3753 3753 \/[A-Za-z]{4,9}\.dot$ 2 0 0 1 3754 3754 \/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$ 2 0 0 1 3755 3755 \/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$ 2 0 0 1 3756 3756 ^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$ 2 0 0 1 3757 3757 \/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$ 2 0 0 1 3758 3758 ^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$ 2 0 0 1 3759 3759 ^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$ 2 0 0 1 3760 3760 ^\/[a-f0-9]+000[a-f0-9]{37}$ 2 0 0 1 3761 3761 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3762 3762 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P 2 0 0 1 3763 3763 \.php\?check=\d$ 2 0 0 1 3764 3764 ^tekst=\w+$ 2 0 0 1 3765 3765 ^User-Agent\x3a MSIE \d+\.\d+\r\n 2 0 0 1 3766 3766 \/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$ 2 0 0 1 3767 3767 \/[0-9]{2}\.exe\?[0-9]$ 2 0 0 1 3768 3768 ^\/0[a-f0-9]{48}$ 2 0 0 1 3769 3769 path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog= 2 0 0 1 3770 3770 ^(Connection\x0d\x0a)?\x0d\x0a$ 2 0 0 1 3771 3771 ^[a-z0-9]{10,}$ 2 0 0 1 3772 3772 \?sid=[a-f0-9]{40}&cid=[0-9]$ 2 0 0 1 3773 3773 [A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8} 2 0 0 1 3774 3774 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3775 3775 \/[A-Za-z]+\.php\?((id|token1|token2|C)=[A-Za-z0-9\/=+%]*={0,2}&?){4}$ 2 0 0 1 3776 3776 ^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30} 2 0 0 1 3777 3777 ^[a-z]{256}$ 2 0 0 1 3778 3778 ^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa 2 0 0 1 3779 3779 ^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(Referer\x3a[^\r\n]+[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11) 2 0 0 1 3780 3780 \.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$ 2 0 0 1 3781 3781 ^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8} 2 0 0 1 3782 3782 &m=\d$ 2 0 0 1 3783 3783 ^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$ 2 0 0 1 3784 3784 \?q=[a-f0-9]{32}$ 2 0 0 1 3785 3785 ^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA 2 0 0 1 3786 3786 ^version=\d{4}-\d{1,2}-\d{1,2}$ 2 0 0 1 3787 3787 [\x80-\xff] 2 0 0 1 3788 3788 (xyz|pw)$ 2 0 0 1 3789 3789 ^[A-Z0-9_-]+\.analytics-akadns\.com$ 2 0 0 1 3790 3790 ^[A-Z0-9_-]+\.akamai-analytics\.com$ 2 0 0 1 3791 3791 ^[A-Z0-9_-]+\.akamai-information\.com$ 2 0 0 1 3792 3792 ^[A-Z0-9_-]+\.akamai-technologies\.com$ 2 0 0 1 3793 3793 ^[A-Z0-9_-]+\.sync-akamai\.com$ 2 0 0 1 3794 3794 ^\/[^\r\n]+\.php\?[a-f0-9]{32}(=(%3D|\x3d)*[A-Za-z0-9%\/]+&[a-f0-9]{32}){4,}=(%3D|\x3d)*[A-Za-z0-9%\/]+$ 2 0 0 1 3795 3795 ^.{0,15}[^\x20-\x7e\r\n] 2 0 0 1 3796 3796 \?---[A-Z]$ 2 0 0 1 3797 3797 ^\/help(me)?\.bmp$ 2 0 0 1 3798 3798 \/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3799 3799 (BrowsingHistoryView|WebBrowserPassView)\.exe$ 2 0 0 1 3800 3800 [\x80-\xff] 2 0 0 1 3801 3801 \.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$ 2 0 0 1 3802 3802 =8ACEFC[0-9A-F]{150,}$ 2 0 0 1 3803 3803 \?[a-f0-9]{32}$ 2 0 0 1 3804 3804 ^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=) 2 0 0 1 3805 3805 \.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$ 2 0 0 1 3806 3806 ^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\. 2 0 0 1 3807 3807 \/(tr(_w)?|ft)\.so$ 2 0 0 1 3808 3808 ^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$ 2 0 0 1 3809 3809 ^\/v\d+\/lady_[ix] 2 0 0 1 3810 3810 \/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$ 2 0 0 1 3811 3811 \?action=\d(&botId=[A-F0-9]{32})?$ 2 0 0 1 3812 3812 ^[^&]+?\.html\?s=[^&]+?&d=$ 2 0 0 1 3813 3813 \/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3814 3814 \/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3815 3815 \/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$ 2 0 0 1 3816 3816 ^[A-F0-9]{8}$ 2 0 0 1 3817 3817 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)? 2 0 0 1 3818 3818 ^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$ 2 0 0 1 3819 3819 ^\/kb\/\d{4,8}$ 2 0 0 1 3820 3820 \.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3821 3821 ^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$ 2 0 0 1 3822 3822 END\x20CERTIFICATE-----$ 2 0 0 1 3823 3823 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1 3824 3824 ^get=\d+($|&) 2 0 0 1 3825 3825 ^(Mozilla\/|Shockwave) 2 0 0 1 3826 3826 =11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$ 2 0 0 1 3827 3827 (\x20MSIE\x20|rv\x3a11) 2 0 0 1 3828 3828 ^id=[0-9A-Z]+&count= 2 0 0 1 3829 3829 ^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$ 2 0 0 1 3830 3830 \.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3831 3831 ^machine=[^&]+$/Pi 2 0 0 1 3832 3832 \.(arm(5n|7)?|m(ips|psl))$ 2 0 0 1 3833 3833 [a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$ 2 0 0 1 3834 3834 ^\/oscp\/[a-z]+$ 2 0 0 1 3835 3835 \/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$ 2 0 0 1 3836 3836 \.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$ 2 0 0 1 3837 3837 \.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$ 2 0 0 1 3838 3838 ^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n 2 0 0 1 3839 3839 \/[a-z]+2\.php\?jpg=[^&]+$ 2 0 0 1 3840 3840 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$ 2 0 0 1 3841 3841 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$ 2 0 0 1 3842 3842 \.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$ 2 0 0 1 3843 3843 \.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$ 2 0 0 1 3844 3844 ^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4} 2 0 0 1 3845 3845 \.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$ 2 0 0 1 3846 3846 \.php\?string=[a-zA-Z0-9+=]+$ 2 0 0 1 3847 3847 ^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$ 2 0 0 1 3848 3848 ^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$ 2 0 0 1 3849 3849 ^([a-f0-9]{30,60})$ 2 0 0 1 3850 3850 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3851 3851 \x26affid\x3D[0-9]{4,7}$ 2 0 0 1 3852 3852 [\x80-\xff]{16} 2 0 0 1 3853 3853 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1 3854 3854 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3} 2 0 0 1 3855 3855 ^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$ 2 0 0 1 3856 3856 ^[A-Z0-9]{18}$ 2 0 0 1 3857 3857 ^[a-z]{3,4}\x2F[a-f0-9]{24}$ 2 0 0 1 3858 3858 ^\/[a-z0-9]{1,10}\/?\?.+?$ 2 0 0 1 3859 3859 \/[a-z0-9A-Z]\.exe$ 2 0 0 1 3860 3860 ^\d+$ 2 0 0 1 3861 3861 ^\d+$ 2 0 0 1 3862 3862 ^\/[a-z0-9+\/=]{16,400}$ 2 0 0 1 3863 3863 &s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$) 2 0 0 1 3864 3864 ^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$ 2 0 0 1 3865 3865 ^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$ 2 0 0 1 3866 3866 =\d+$ 2 0 0 1 3867 3867 \/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$ 2 0 0 1 3868 3868 \.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$ 2 0 0 1 3869 3869 \?action=\w+gen&v=\d 2 0 0 1 3870 3870 \/counter(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$) 2 0 0 1 3871 3871 ^[^\r\n]+\.(jpe?g|gif|png)\r\n 2 0 0 1 3872 3872 ^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted))) 2 0 0 1 3873 3873 \/[a-z]+\.php\?[A-F0-9]{250,}$ 2 0 0 1 3874 3874 ^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$ 2 0 0 1 3875 3875 ^[A-F0-9]{250,}$ 2 0 0 1 3876 3876 ^\d+?$ 2 0 0 1 3877 3877 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 3878 3878 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3} 2 0 0 1 3879 3879 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 3880 3880 ^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$ 2 0 0 1 3881 3881 ^\/[a-z]+\.php\?num=\d+&rev= 2 0 0 1 3882 3882 ^[A-Za-z0-9]{14,15}$ 2 0 0 1 3883 3883 ^\d{2}$ 2 0 0 1 3884 3884 \.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d 2 0 0 1 3885 3885 ^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n 2 0 0 1 3886 3886 \/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$ 2 0 0 1 3887 3887 ^[0-9a-f]{32}\.php 2 0 0 1 3888 3888 ^[A-F0-9]{30} 2 0 0 1 3889 3889 ^[a-f0-9]{24}$ 2 0 0 1 3890 3890 ^\x00\x00\x00[\x72-\x74] 2 0 0 1 3891 3891 (\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS) 2 0 0 1 3892 3892 ^\d+[\x22\x27] 2 0 0 1 3893 3893 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3894 3894 ^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$ 2 0 0 1 3895 3895 ^(-[0-9]+|[A-F0-9]{32})=1&type=txt$ 2 0 0 1 3896 3896 ^([a-f0-9]{2}-){5}[a-f0-9]{2} 2 0 0 1 3897 3897 ^[a-f0-9]{18}\x22 2 0 0 1 3898 3898 ^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28} 2 0 0 1 3899 3899 ^[A-Za-z0-9]{10,}[\-\)\(]{1,2} 2 0 0 1 3900 3900 data=[a-zA-Z0-9\+\/]{64}/P 2 0 0 1 3901 3901 <root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P 2 0 0 1 3902 3902 \d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F 2 0 0 1 3903 3903 ^X-ID\x3a\x20\d+\r?$/Hm 2 0 0 1 3904 3904 \/ff\.ie\?rnd=\x2d?\d 2 0 0 1 3905 3905 c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2} 2 0 0 1 3906 3906 ^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org) 2 0 0 1 3907 3907 ^\d{1,6}\x00msg\x7c 2 0 0 1 3908 3908 ^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$ 2 0 0 1 3909 3909 [^A-Za-z0-9+/]TVqQA 2 0 0 1 3910 3910 \/im(age|g)\.php\?id=\d+$ 2 0 0 1 3911 3911 ^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l 2 0 0 1 3912 3912 ^(-[0-9]+|[A-F0-9]{32})=1$ 2 0 0 1 3913 3913 ^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$ 2 0 0 1 3914 3914 ^.{0,15}[^\x20-\x7e\r\n] 2 0 0 1 3915 3915 ^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$ 2 0 0 1 3916 3916 (\d{1,3}\.){3}\d{1,3} 2 0 0 1 3917 3917 ^[a-zA-Z0-9/+]{171}= 2 0 0 1 3918 3918 ms-?office 2 0 0 1 3919 3919 ^(Connection\r\n)?\r\n$ 2 0 0 1 3920 3920 ^(Connection\r\n)?\r\n$ 2 0 0 1 3921 3921 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3922 3922 ^[0-9]+lu[0-9]+d[0-9]+$ 2 0 0 1 3923 3923 ^[a-f0-9]{16}$ 2 0 0 1 3924 3924 ^[a-z0-9_\/+-]{1000} 2 0 0 1 3925 3925 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3926 3926 ^\d{4,8}$ 2 0 0 1 3927 3927 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3928 3928 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3929 3929 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3930 3930 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3931 3931 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3932 3932 ^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3} 2 0 0 1 3933 3933 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3934 3934 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3935 3935 ^[\x00-\x01]\x00.\x00{3} 2 0 0 1 3936 3936 ^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3} 2 0 0 1 3937 3937 ^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$ 2 0 0 1 3938 3938 ^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$ 2 0 0 1 3939 3939 ^[a-z0-9]+\.(biz|com|net|org) 2 0 0 1 3940 3940 \/wp-(content|admin|includes)\/ 2 0 0 1 3941 3941 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3942 3942 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3943 3943 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3944 3944 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3945 3945 ^[A-Za-z0-9\/\-\+]{40,}\.=auth\. 2 0 0 1 3946 3946 ^[A-Za-z0-9\/\-\+]{10,}\.=connect\. 2 0 0 1 3947 3947 ^[A-Za-z0-9\/\-\+]{10,}AAAA--\. 2 0 0 1 3948 3948 ^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$ 2 0 0 1 3949 3949 ^[a-z0-9]{8} 2 0 0 1 3950 3950 ^(\d{1,3}\.)\d{1,3}$ 2 0 0 1 3951 3951 ^\/[a-z]\.php\?query=[a-f0-9]{32}$ 2 0 0 1 3952 3952 ^[A-F0-9]{50,}$ 2 0 0 1 3953 3953 ^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$ 2 0 0 1 3954 3954 ^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$ 2 0 0 1 3955 3955 ^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 3956 3956 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 3957 3957 ^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3} 2 0 0 1 3958 3958 ^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3} 2 0 0 1 3959 3959 ^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$ 2 0 0 1 3960 3960 ^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1 3961 3961 ^[a-z0-9]{3,10}$ 2 0 0 1 3962 3962 ^[a-z0-9]{5,30}$ 2 0 0 1 3963 3963 ^\d{3,15}$ 2 0 0 1 3964 3964 ^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3965 3965 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1 3966 3966 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1 3967 3967 ^[a-z]{3,10}=[a-z0-9]+$ 2 0 0 1 3968 3968 ^\.(space|press|website)$ 2 0 0 1 3969 3969 ^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$ 2 0 0 1 3970 3970 ^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 3971 3971 ^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar) 2 0 0 1 3972 3972 ^lessie(\/[0-9]\.0)?$ 2 0 0 1 3973 3973 ^Cakle(\/[0-9]\.0)?$ 2 0 0 1 3974 3974 ^Damien(\/[0-9]\.0)?$ 2 0 0 1 3975 3975 ^Solar(\/[0-9]\.0)?$ 2 0 0 1 3976 3976 ^muhstik(-scan)?(\/[0-9]\.0)?$ 2 0 0 1 3977 3977 ^Shaolin(\/[0-9]\.0)?$ 2 0 0 1 3978 3978 ^Rift(\/[0-9]\.0)?$ 2 0 0 1 3979 3979 ^Tsunami(\/[0-9]\.0)?$ 2 0 0 1 3980 3980 ^Yowai(\/[0-9]\.0)?$ 2 0 0 1 3981 3981 ^Yakuza(\/[0-9]\.0)?$ 2 0 0 1 3982 3982 ^Hentai(\/[0-9]\.0)?$ 2 0 0 1 3983 3983 \/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$ 2 0 0 1 3984 3984 ^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$ 2 0 0 1 3985 3985 ^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$ 2 0 0 1 3986 3986 ^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$ 2 0 0 1 3987 3987 ^CN=((justin|digest)\.)?drinkeatgood\.space$ 2 0 0 1 3988 3988 ^\d 2 0 0 1 3989 3989 ^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$ 2 0 0 1 3990 3990 ^\/(<n>\d)(=n){1,2}$ 2 0 0 1 3991 3991 \/\d+$ 2 0 0 1 3992 3992 ^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$ 2 0 0 1 3993 3993 ^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$ 2 0 0 1 3994 3994 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 3995 3995 _[A-F0-9]{12}\.jpg$ 2 0 0 1 3996 3996 _[A-F0-9]{12}&filename=\w{1,20}\.jpg$ 2 0 0 1 3997 3997 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 3998 3998 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 3999 3999 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 4000 4000 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4001 4001 ^[0-9]{3}$ 2 0 0 1 4002 4002 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4003 4003 ^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6) 2 0 0 1 4004 4004 \.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 4005 4005 ^\/[^\x2f]+\/pops[a-z]?\.php$ 2 0 0 1 4006 4006 \.php\?s=\d+&cn= 2 0 0 1 4007 4007 ^[a-z]{4,10}\.freemooon\.org$ 2 0 0 1 4008 4008 [a-z]{4,10}\.olimpian\.org$ 2 0 0 1 4009 4009 [a-z]{4,10}\.sunsay\.biz$ 2 0 0 1 4010 4010 [a-z]{4,11}\.feellgood\.org$ 2 0 0 1 4011 4011 [a-z]{4,11}\.kinomix\.org$ 2 0 0 1 4012 4012 [a-z]{4,10}\.beneton\.biz$ 2 0 0 1 4013 4013 [a-z]{4,10}\.bigdoggi\.biz$ 2 0 0 1 4014 4014 [a-z]{4,10}\.bjksfohseaguu\.org$ 2 0 0 1 4015 4015 [a-z]{4,10}\.closedoors\.net$ 2 0 0 1 4016 4016 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4017 4017 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4018 4018 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4019 4019 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4020 4020 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1 4021 4021 ^(www|bbs|cms|down|up|file|ftp) 2 0 0 1 4022 4022 \/log\/proc\.php.key=[a-z0-9]{11} 2 0 0 1 4023 4023 code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2} 2 0 0 1 4024 4024 x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1 4025 4025 mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2} 2 0 0 1 4026 4026 ^RAV\d\.\d\d 2 0 0 1 4027 4027 ^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$ 2 0 0 1 4028 4028 ^[a-zA-Z0-9]{20} 2 0 0 1 4029 4029 \x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D 2 0 0 1 4030 4030 \/\?rnd=\d+&id=\d+$ 2 0 0 1 4031 4031 port=[1-9]{1,5} 2 0 0 1 4032 4032 \/getfile\.php\?r=-?\d+&p= 2 0 0 1 4033 4033 \/manda\.php\?id=(-)?\d{8,10}&v=\w 2 0 0 1 4034 4034 \/\?id(\d+)?&rnd=\d+$ 2 0 0 1 4035 4035 \.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$ 2 0 0 1 4036 4036 ^\/\d+\.functions$ 2 0 0 1 4037 4037 \/\d{10}$ 2 0 0 1 4038 4038 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4039 4039 ^[A-F0-9]{100,}$ 2 0 0 1 4040 4040 ^\d 2 0 0 1 4041 4041 ^\/[a-z-_]+?\.(php|html)$ 2 0 0 1 4042 4042 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4043 4043 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 4044 4044 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4045 4045 ^data=[a-zA-Z0-9+\/]{64} 2 0 0 1 4046 4046 ^\d{4}$ 2 0 0 1 4047 4047 \.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq= 2 0 0 1 4048 4048 ^\/[mp]od[12]\/[^\/]+?\.exe$ 2 0 0 1 4049 4049 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 4050 4050 \/[0-9]{2}\.exe$ 2 0 0 1 4051 4051 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 4052 4052 [\x80-\xff] 2 0 0 1 4053 4053 \.(me|net)$/W 2 0 0 1 4054 4054 \/[A-Z]?[a-z]{1,3}[0-9]?\.exe$ 2 0 0 1 4055 4055 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4056 4056 ^[a-z]\. 2 0 0 1 4057 4057 ^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$ 2 0 0 1 4058 4058 ^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$ 2 0 0 1 4059 4059 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4060 4060 ^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 4061 4061 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$ 2 0 0 1 4062 4062 \/[0-9]{10}.php1$ 2 0 0 1 4063 4063 ^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$ 2 0 0 1 4064 4064 ^[A-F0-9]{10,}$ 2 0 0 1 4065 4065 ^[A-F0-9]{10,}$ 2 0 0 1 4066 4066 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 4067 4067 ^\/d[0-9]?\.php\?check$ 2 0 0 1 4068 4068 ^\/d[0-9]?\.php\?servers$ 2 0 0 1 4069 4069 ^\/[a-z]\.php\?check=[a-f0-9]{32}$ 2 0 0 1 4070 4070 ^[a-f0-9]{8}$ 2 0 0 1 4071 4071 \.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$ 2 0 0 1 4072 4072 ^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$ 2 0 0 1 4073 4073 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4074 4074 ^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$ 2 0 0 1 4075 4075 ^[A-F0-9]{16}$ 2 0 0 1 4076 4076 \/rpt\d 2 0 0 1 4077 4077 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4078 4078 ^\/fbot\.arm\d{1}\.u$ 2 0 0 1 4079 4079 ^\/[A-F0-9]{30,60}\/1\/0\/0$ 2 0 0 1 4080 4080 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4081 4081 ^[A-F0-9]+$ 2 0 0 1 4082 4082 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1 4083 4083 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1 4084 4084 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1 4085 4085 ^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n 2 0 0 1 4086 4086 ^[a-z0-9\-\.]{1,60}\.ssmailer\.com$ 2 0 0 1 4087 4087 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4088 4088 ^[a-z]=[a-f0-9]{80,}$ 2 0 0 1 4089 4089 ^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$ 2 0 0 1 4090 4090 ^php.{0,500}[\x80-\xff] 2 0 0 1 4091 4091 ^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$ 2 0 0 1 4092 4092 ^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$ 2 0 0 1 4093 4093 ^[A-F0-9]{8}_[A-F0-9]{8}\.sql 2 0 0 1 4094 4094 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 4095 4095 \/[a-z-_]{75,}\.php$ 2 0 0 1 4096 4096 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4097 4097 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4098 4098 ^[^\x20-\x7e\r\n]{2}$ 2 0 0 1 4099 4099 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 4100 4100 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4101 4101 ^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4102 4102 ^[a-zA-Z0-9=/&?\x2e-]+$ 2 0 0 1 4103 4103 ^\d{5,10}$ 2 0 0 1 4104 4104 ^[a-z0-9/%=]{100,}$ 2 0 0 1 4105 4105 \/[a-z0-9]+\/[a-z0-9]+\.exe$ 2 0 0 1 4106 4106 ^[a-zA-Z0-9]+$ 2 0 0 1 4107 4107 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+? 2 0 0 1 4108 4108 ^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$ 2 0 0 1 4109 4109 (^|\.)en-content\.com$ 2 0 0 1 4110 4110 ch=1$ 2 0 0 1 4111 4111 ^\/\?ptrxcz_[a-z0-9A-Z]{30}$ 2 0 0 1 4112 4112 [a-z]{2}\.CAB.bin 2 0 0 1 4113 4113 \.php\?(print_)?receipt=(s00|\d{3})_\d+$ 2 0 0 1 4114 4114 ^sleep \d+[\r\x2c] 2 0 0 1 4115 4115 \.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id= 2 0 0 1 4116 4116 \.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr 2 0 0 1 4117 4117 \(b\x3a\d+?\x3bc\x3aAMD- 2 0 0 1 4118 4118 \(b\x3a\d+?\x3bc\x3aINT- 2 0 0 1 4119 4119 ^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4120 4120 user=[a-f0-9]{31,32}& 2 0 0 1 4121 4121 ^$ 2 0 0 1 4122 4122 \/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$ 2 0 0 1 4123 4123 \(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b 2 0 0 1 4124 4124 \(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b 2 0 0 1 4125 4125 \?hostid=[0-9A-F]+?& 2 0 0 1 4126 4126 ^\/[a-z0-9]{3,}\/upload\/img\.jpg$ 2 0 0 1 4127 4127 \.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$ 2 0 0 1 4128 4128 \.php\?ver=\d\&cver=\d\&id=\d{5}$ 2 0 0 1 4129 4129 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4130 4130 ^\x2Flts\x2Etxt$ 2 0 0 1 4131 4131 \/\d\d[A-F0-9]{4}0000\/log$ 2 0 0 1 4132 4132 \/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$ 2 0 0 1 4133 4133 \/cp\/\?(logo\.jpg|adm) 2 0 0 1 4134 4134 \x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$ 2 0 0 1 4135 4135 ^g=[A-Z0-9]+&cmd= 2 0 0 1 4136 4136 &arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$) 2 0 0 1 4137 4137 filename=[a-f0-9]{13}\.file\r\n 2 0 0 1 4138 4138 \/monitor\.php\?resp=ID\x3a[A-Za-z]{15} 2 0 0 1 4139 4139 \/gate\.php\?cmd=(get(installconfig|exe)|urls)$ 2 0 0 1 4140 4140 \.php\?(q|name)= 2 0 0 1 4141 4141 ^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$ 2 0 0 1 4142 4142 ^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$ 2 0 0 1 4143 4143 \.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$ 2 0 0 1 4144 4144 &HD=[A-F0-9]{32}& 2 0 0 1 4145 4145 &id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os= 2 0 0 1 4146 4146 \.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$ 2 0 0 1 4147 4147 \/log\?(start|install)\x7caid= 2 0 0 1 4148 4148 \.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&) 2 0 0 1 4149 4149 ^\/post\.aspx\?[^&]+=[0-9]{9,10}$ 2 0 0 1 4150 4150 ^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$ 2 0 0 1 4151 4151 ^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$ 2 0 0 1 4152 4152 ^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$ 2 0 0 1 4153 4153 \.php\?m=[A-F0-9]{12} 2 0 0 1 4154 4154 &rvz1=\d+&rvz2=\d+?$ 2 0 0 1 4155 4155 ^\/getc(loud|onf)\/\?c= 2 0 0 1 4156 4156 ^\/home\/index\.asp\?typeid=(1[13]?|[3579])$ 2 0 0 1 4157 4157 \/tasksz\.php\?(dc|load) 2 0 0 1 4158 4158 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse) 2 0 0 1 4159 4159 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D 2 0 0 1 4160 4160 ^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D 2 0 0 1 4161 4161 \.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$ 2 0 0 1 4162 4162 ^OPC=\d 2 0 0 1 4163 4163 ^\/[^\x2f]+?\.hlp$ 2 0 0 1 4164 4164 ^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$ 2 0 0 1 4165 4165 &build_id=[A-F0-9]+$ 2 0 0 1 4166 4166 ^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&) 2 0 0 1 4167 4167 \/vtris\d?\.php\?srs=\d{1,10}$ 2 0 0 1 4168 4168 \/soft(32|64)\.dll$ 2 0 0 1 4169 4169 \/ord\/[^\x2f]+?\.exe$ 2 0 0 1 4170 4170 \/zConfig\/\d+$ 2 0 0 1 4171 4171 \/zImprimer\/\d+- 2 0 0 1 4172 4172 \/enc\/1$ 2 0 0 1 4173 4173 ^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz) 2 0 0 1 4174 4174 [a-z]\d{2}$ 2 0 0 1 4175 4175 \/images2\/[0-9a-fA-F]{500} 2 0 0 1 4176 4176 ^(u(wf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik)|celgos|ggifym|mpefan|qlahaf)|s(u(t(fasof|imjy)|kbewli)|i(ttanyg|webheb|hemuj)|e(suhror|xjereh)|o(haxim|qvaqo)|axyjuw)|r(i(zsebym|firac|sytfa|trios)|e(bfelqi|kvyfo)|u(xymqic|jfeag)|y(buhoq|kafeh)|acadpuh)|j(y(meegom|vvozoz|kyvca|torqu)|a(mwazer|ibzup)|e(btelyx|dytlu)|o(dkymy|kenqi))|o(t(geguuz|xolpow|pipug)|q(lapjim|jogxi)|cgaextu|gdowkys|jpaxlam|vquqaip|smuryf)|i(r(ojvuqu|hegre)|v(kikcop|nuvuk)|hmytog|kevzaq|mgohut|pdehas|wvahin|zxirfy)|b(y((cmolh|vbym)y|gotbys|jlegta)|i(pulte|wuvba)|o(pwyeb|wbaiv))|p(e(dugtap|gyrgun|vhyvys)|y(nxomoj|ykxug)|a(gube|waha)v|ogwytfy)|d(e(afesqy|hjujuq)|o(hwapih|xilik)|a(lwoza|rabub)|inymak)|t(a(hfifak|ixcih)|i(wciwu|koqo)x|ecviqir|ozfyma|uriwil)|g(i(jevsog|nnyjyb)|olhysux|ywilhof|azuzoz|edopan|ubahvi)|y((n(japru|kicy)|kocna)r|bsahov|dabxag|xyqwiz|zsabuq)|h(a(hsekju|poneg)|e(ztymut|dybih)|uquqxov|itakat)|w(a(pifnu|rkafo)c|e(tifjam|fecfo)|ibveces|yjenqo)|a(d(nedat|tesok)|qzepylu|baxhad|smukuf|wewsip)|l(u((fseki|pylz 2 0 0 1 4177 4177 )m|ditla)|eqgugom|opoqyv)|z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu)|v(u(njuet|ohsub)|ijsixem|otqygiq|euwhyz)|m(u(zupdyg|hipew|wosiv)|osjinme|abuhos)|x(o(fsimi|gitaj|moqol)|ikmonej|enacoz)|f(e(vnotow|tucxo)|i(dedhah|xavpu))|k(u(btyhuz|irfufo)|ejejib|ycufvy)|n((iliqri|obzeky)x|eluzjiv)|c(ylqiduh|aqxaro|itsibe)|q(aijroke|iquzcy|uohdit)|e(gnisje|stesgo|vdyvaz))\.ru$ 2 0 0 1 4178 4178 \/[a-z]\.htm\?[A-Za-z0-9]+$ 2 0 0 1 4179 4179 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 4180 4180 Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 4181 4181 \/p?2p\/[a-z]{3}$ 2 0 0 1 4182 4182 \/\d\.php\?sid=[0-9A-F]{32}$ 2 0 0 1 4183 4183 ^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$ 2 0 0 1 4184 4184 ^\/mod_jshoppi(-|ng|\/) 2 0 0 1 4185 4185 ( MSIE |rv\x3a11) 2 0 0 1 4186 4186 ( MSIE |rv\x3a11) 2 0 0 1 4187 4187 ( MSIE |rv\x3a11) 2 0 0 1 4188 4188 ( MSIE |rv\x3a11) 2 0 0 1 4189 4189 \/[a-z]+\.k(ey)?btc$ 2 0 0 1 4190 4190 &id=[A-F0-9]+$ 2 0 0 1 4191 4191 \/images\/view\.php$ 2 0 0 1 4192 4192 \/txt\/read\.php$ 2 0 0 1 4193 4193 ^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func= 2 0 0 1 4194 4194 \/[A-Za-z0-9-_]{75,}\.html$ 2 0 0 1 4195 4195 filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n 2 0 0 1 4196 4196 ^\/me\/(get(ref|ua)\.php|videos\.txt)$ 2 0 0 1 4197 4197 \/infect(-\d)?\.php$ 2 0 0 1 4198 4198 &hash=[^&]+$ 2 0 0 1 4199 4199 ^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$ 2 0 0 1 4200 4200 \.exe\?dummy=\d+$ 2 0 0 1 4201 4201 ^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3} 2 0 0 1 4202 4202 \.png$ 2 0 0 1 4203 4203 \x26enckey\x3D[A-F0-9]+$ 2 0 0 1 4204 4204 ^\/action\.php\?action=get_(mails|red)$ 2 0 0 1 4205 4205 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 4206 4206 \/data\.cfg$ 2 0 0 1 4207 4207 \/bn_versions\/\d+?\.exe$ 2 0 0 1 4208 4208 ^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 4209 4209 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4210 4210 &user=\d+$ 2 0 0 1 4211 4211 ^Host\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 4212 4212 \/web_[0-9A-F]{12}\.jpg$ 2 0 0 1 4213 4213 ^Mozilla(\/4\.0)?$ 2 0 0 1 4214 4214 Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion) 2 0 0 1 4215 4215 ^\/([^\x2f]+\/)?rp\?[a-z]= 2 0 0 1 4216 4216 ^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 4217 4217 ^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n 2 0 0 1 4218 4218 ^Host\x3a[^\r\n]+bagacavoltou\.ru 2 0 0 1 4219 4219 ^Host\x3a[^\r\n]+bagacaveia\.ru 2 0 0 1 4220 4220 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4221 4221 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4222 4222 \/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$ 2 0 0 1 4223 4223 ^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ 2 0 0 1 4224 4224 ^\/[^\x2f]+?\.exe$ 2 0 0 1 4225 4225 ^[A-F0-9]+$ 2 0 0 1 4226 4226 \/redirect\.php\?loc=mail$ 2 0 0 1 4227 4227 &(uid|name|file)=[a-f0-9]+$ 2 0 0 1 4228 4228 \?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$ 2 0 0 1 4229 4229 \/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$ 2 0 0 1 4230 4230 \/\?check$ 2 0 0 1 4231 4231 ^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$ 2 0 0 1 4232 4232 [A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$ 2 0 0 1 4233 4233 ^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200} 2 0 0 1 4234 4234 (&(boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID|v|PageNumber|num|view|read|action|page|mode|idx|cateId|bbsId|pType|pcode|index|tbl|idx_num|act|bbs_id|bbs_form|bid|bbscate|menu|tcode|b_code|bname|tb|borad01|borad02|borad03|mid|newsid|table|Board_seq|bc_idx|seq|ArticleID|B_Notice|nowPage|webid|boardDiv|sub_idxa)=[^&]+){3}$ 2 0 0 1 4235 4235 \/setup\/[a-zA-Z0-9!-]{100,}$ 2 0 0 1 4236 4236 \/app\.exe$ 2 0 0 1 4237 4237 ^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1 4238 4238 =c3NoOi8v[A-Za-z0-9+/]+={0,2}$ 2 0 0 1 4239 4239 \.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$ 2 0 0 1 4240 4240 \?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$ 2 0 0 1 4241 4241 &version=\d+$ 2 0 0 1 4242 4242 ^[A-Za-z0-9/_]+={0,2}$ 2 0 0 1 4243 4243 \/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14} 2 0 0 1 4244 4244 ^\d{4} 2 0 0 1 4245 4245 ^\d{4} 2 0 0 1 4246 4246 ^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1 4247 4247 \/lns.txt$ 2 0 0 1 4248 4248 ^\/[a-z]+?\.*?ini\?\d+$ 2 0 0 1 4249 4249 \/[a-f0-9]{8}\/page_\d{8,10}\.html$ 2 0 0 1 4250 4250 ^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4251 4251 SSID=[0-9]{5}[0-8][01][a-f0-9]{36} 2 0 0 1 4252 4252 SSID=[0-9]{5}[0-8][01][a-f0-9]{36} 2 0 0 1 4253 4253 ^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s] 2 0 0 1 4254 4254 ^s?\x3a\x2f+[^\r\n\s]+\.exe 2 0 0 1 4255 4255 \.jpg\?vid=\d+$ 2 0 0 1 4256 4256 ^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a 2 0 0 1 4257 4257 \.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$ 2 0 0 1 4258 4258 ^[0-9a-f]+$ 2 0 0 1 4259 4259 \/r\.php\?[A-F0-9]+=?$ 2 0 0 1 4260 4260 ^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA== 2 0 0 1 4261 4261 \/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$ 2 0 0 1 4262 4262 ^\d+\x20 2 0 0 1 4263 4263 ^\d+\x20 2 0 0 1 4264 4264 ^\d+\x20 2 0 0 1 4265 4265 ^\d+\x20 2 0 0 1 4266 4266 ^\d+\x20 2 0 0 1 4267 4267 ^\d+\x20 2 0 0 1 4268 4268 ^\d+\x20 2 0 0 1 4269 4269 ^\d+\x20 2 0 0 1 4270 4270 \.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&a2=[a-f0-9]{32}&a3=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4271 4271 \/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$ 2 0 0 1 4272 4272 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4273 4273 \.php\?hwid=[A-F0-9]{16}$ 2 0 0 1 4274 4274 ^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$ 2 0 0 1 4275 4275 ^\/\d+$ 2 0 0 1 4276 4276 ^[\x2fa-z\d]+\.exe$ 2 0 0 1 4277 4277 \.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&) 2 0 0 1 4278 4278 \.(gif|jpe?g)\.zip$ 2 0 0 1 4279 4279 ^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n 2 0 0 1 4280 4280 (,0x[0-9a-f]{2}){10}$ 2 0 0 1 4281 4281 \/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4282 4282 ^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$ 2 0 0 1 4283 4283 \/\d{8,10}\.html$ 2 0 0 1 4284 4284 ^\x40\x24[^\x20-\x7e\r\n]+$ 2 0 0 1 4285 4285 ^\/[A-F0-9]+$ 2 0 0 1 4286 4286 ^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$ 2 0 0 1 4287 4287 \.png\x3f[0-9a-f]{4,8}\x3d\d+?$ 2 0 0 1 4288 4288 ^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1 4289 4289 (\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe) 2 0 0 1 4290 4290 \.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4291 4291 \.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4292 4292 \.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4293 4293 \.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4294 4294 ^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$ 2 0 0 1 4295 4295 ^(www\.)?google(\.[a-z]{2,3})+$ 2 0 0 1 4296 4296 \.log$ 2 0 0 1 4297 4297 \/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$ 2 0 0 1 4298 4298 ^\/pm\.sh\?\d+$ 2 0 0 1 4299 4299 \.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}& 2 0 0 1 4300 4300 \?ver=\d+$ 2 0 0 1 4301 4301 ^\/(i686|arm|mips(el)?)\?ver=\d+$ 2 0 0 1 4302 4302 &u=[a-f0-9]{16}&p= 2 0 0 1 4303 4303 \/[a-f0-9]{16}\.down$ 2 0 0 1 4304 4304 \.php\/data$ 2 0 0 1 4305 4305 \/catalog\/\d{3,}$ 2 0 0 1 4306 4306 \.php\?cookie=1$ 2 0 0 1 4307 4307 ^\/[A-Za-z0-9]+?\/file\.php$ 2 0 0 1 4308 4308 \/tor\/[^\x2f\x2e]+(32|64)\.dll$ 2 0 0 1 4309 4309 \.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4310 4310 ^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$ 2 0 0 1 4311 4311 ^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2} 2 0 0 1 4312 4312 \.php\?uuid=[a-z0-9]{32}$ 2 0 0 1 4313 4313 ^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$ 2 0 0 1 4314 4314 \.exe\?$ 2 0 0 1 4315 4315 ^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$ 2 0 0 1 4316 4316 \/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4317 4317 \.php\?cn(ame) 2 0 0 1 4318 4318 ^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$ 2 0 0 1 4319 4319 \.php\?file=(64|86)$ 2 0 0 1 4320 4320 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4321 4321 meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$ 2 0 0 1 4322 4322 ^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$) 2 0 0 1 4323 4323 (^|=)[A-F0-9]{70,}($|&) 2 0 0 1 4324 4324 ^[A-Za-z0-9+/]{64}\x0a 2 0 0 1 4325 4325 \/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$ 2 0 0 1 4326 4326 \?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d 2 0 0 1 4327 4327 ^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n] 2 0 0 1 4328 4328 \.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$ 2 0 0 1 4329 4329 myguy\.(xls(\.hta)?|exe)$ 2 0 0 1 4330 4330 \/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$ 2 0 0 1 4331 4331 \/[\x2f\x2bA-Za-z0-9]{59}AAA==$ 2 0 0 1 4332 4332 ^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$ 2 0 0 1 4333 4333 \.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$ 2 0 0 1 4334 4334 \/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$ 2 0 0 1 4335 4335 \.exe\?\.\d+$ 2 0 0 1 4336 4336 ^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$ 2 0 0 1 4337 4337 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4338 4338 ^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$ 2 0 0 1 4339 4339 \/stat\d+\.php 2 0 0 1 4340 4340 \?url=[0-9]&affid=[0-9]{5} 2 0 0 1 4341 4341 \.php\?id=[0-9a-f]{8}$ 2 0 0 1 4342 4342 ^6\.[0-2]\x20\d\d\x3a\d\d\x20 2 0 0 1 4343 4343 ^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3}) 2 0 0 1 4344 4344 (1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq= 2 0 0 1 4345 4345 [\?&]p=\d&t=\d(&|$) 2 0 0 1 4346 4346 ^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$ 2 0 0 1 4347 4347 ^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$ 2 0 0 1 4348 4348 ^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$ 2 0 0 1 4349 4349 ^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$ 2 0 0 1 4350 4350 ^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$ 2 0 0 1 4351 4351 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4352 4352 ^\/[A-Za-z0-9-_]{30,}\/$ 2 0 0 1 4353 4353 ^build\d 2 0 0 1 4354 4354 ^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\. 2 0 0 1 4355 4355 ^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\. 2 0 0 1 4356 4356 ^[a-zA-Z0-9]{5}6464(3[0-9]){4}\. 2 0 0 1 4357 4357 ^[a-zA-Z0-9]{5}6664(3[0-9]){4}\. 2 0 0 1 4358 4358 ^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\. 2 0 0 1 4359 4359 ^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\. 2 0 0 1 4360 4360 ^[a-zA-Z0-9]{5}7164(3[0-9]){4}\. 2 0 0 1 4361 4361 ^[a-f0-9]{8}$ 2 0 0 1 4362 4362 ^\d{1,3}$ 2 0 0 1 4363 4363 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 4364 4364 ^[A-Za-z0-9\/\+\=]{100,}$ 2 0 0 1 4365 4365 \.(txt|gif|exe|bmp)$ 2 0 0 1 4366 4366 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4367 4367 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4368 4368 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4369 4369 ^[A-F0-9]{128}$ 2 0 0 1 4370 4370 ^DEMONS((\/|\s)[0-9]\.0)?$ 2 0 0 1 4371 4371 ^Hakai((\/|\s)[0-9]\.0)?$ 2 0 0 1 4372 4372 ^Messiah((\/|\s)[0-9]\.0)?$ 2 0 0 1 4373 4373 ^Liquor((\/|\s)[0-9]\.0)?$ 2 0 0 1 4374 4374 ^Nija((\/|\s)[0-9]\.0)?$ 2 0 0 1 4375 4375 ^Gemini((\/|\s)[0-9]\.0)?$ 2 0 0 1 4376 4376 ^Kayla((\/|\s)[0-9]\.0)?$ 2 0 0 1 4377 4377 ^Sector((\/|\s)[0-9]\.0)?$ 2 0 0 1 4378 4378 ^OSIRIS((\/|\s)[0-9]\.0)?$ 2 0 0 1 4379 4379 ^lessie(\/[0-9]\.0)?$ 2 0 0 1 4380 4380 ^Cakle(\/[0-9]\.0)?$ 2 0 0 1 4381 4381 ^Damien(\/[0-9]\.0)?$ 2 0 0 1 4382 4382 ^Solar(\/[0-9]\.0)?$ 2 0 0 1 4383 4383 ^muhstik(-scan)?(\/[0-9]\.0)?$ 2 0 0 1 4384 4384 ^Shaolin(\/[0-9]\.0)?$ 2 0 0 1 4385 4385 ^Rift(\/[0-9]\.0)?$ 2 0 0 1 4386 4386 ^Tsunami(\/[0-9]\.0)?$ 2 0 0 1 4387 4387 ^Yowai(\/[0-9]\.0)?$ 2 0 0 1 4388 4388 ^Yakuza(\/[0-9]\.0)?$ 2 0 0 1 4389 4389 ^Hentai(\/[0-9]\.0)?$ 2 0 0 1 4390 4390 ^[a-zA-Z/+=]$ 2 0 0 1 4391 4391 \?uid=[A-F0-9]{15,}&pid=\d+$ 2 0 0 1 4392 4392 \.php\?[A-F0-9]{15,25}$ 2 0 0 1 4393 4393 ^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$ 2 0 0 1 4394 4394 ^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.0\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1 4395 4395 ^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$ 2 0 0 1 4396 4396 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4397 4397 ^\/[a-z]\.php 2 0 0 1 4398 4398 ^\d{1,6}$ 2 0 0 1 4399 4399 ^[A-Z0-9]{8} 2 0 0 1 4400 4400 ^\d{15} 2 0 0 1 4401 4401 ^(winload(32)?|cmms)\x0d\x0a 2 0 0 1 4402 4402 ^\d$ 2 0 0 1 4403 4403 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4404 4404 ^\/[a-z]+\/\?ip= 2 0 0 1 4405 4405 ^(\d{1,3}\.){3}\d{1,3} 2 0 0 1 4406 4406 ^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1 2 0 0 1 4407 4407 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4408 4408 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4409 4409 ^(update_hash|js|key|arsiv_(hash|link))$ 2 0 0 1 4410 4410 \/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$ 2 0 0 1 4411 4411 ^[a-z0-9]{11}=\d{16}$ 2 0 0 1 4412 4412 ^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$ 2 0 0 1 4413 4413 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4414 4414 ^Hello, World((\/|\s)[0-9]\.0)?$ 2 0 0 1 4415 4415 \/cgi\/[a-z0-9]{1,31}\.bin$ 2 0 0 1 4416 4416 ^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4} 2 0 0 1 4417 4417 \?id=\d+&act=[12]$ 2 0 0 1 4418 4418 \?id=\d+&act=\d$ 2 0 0 1 4419 4419 ^([A-F0-9]{2}%3A){5}[A-F0-9]{2}& 2 0 0 1 4420 4420 \/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$ 2 0 0 1 4421 4421 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$ 2 0 0 1 4422 4422 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1 4423 4423 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1 4424 4424 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1 4425 4425 ^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3} 2 0 0 1 4426 4426 ^\d\.\d_(64|32)_\d\x3a 2 0 0 1 4427 4427 (^|\.)15438\.xyz$ 2 0 0 1 4428 4428 (^|\.)12724\.xyz$ 2 0 0 1 4429 4429 (^|\.)21736\.xyz$ 2 0 0 1 4430 4430 ^[a-f0-9]+\x08\x00$ 2 0 0 1 4431 4431 ^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$ 2 0 0 1 4432 4432 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4433 4433 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4434 4434 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4435 4435 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4436 4436 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4437 4437 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4438 4438 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4439 4439 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4440 4440 \x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a 2 0 0 1 4441 4441 ^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$ 2 0 0 1 4442 4442 ^[A-Z]+$ 2 0 0 1 4443 4443 ^\d+$ 2 0 0 1 4444 4444 ^(64|86)$ 2 0 0 1 4445 4445 \/counter\/(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$) 2 0 0 1 4446 4446 ^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40}(%3D){0,2}){1,4}$ 2 0 0 1 4447 4447 ^\d{5,10}\x7d 2 0 0 1 4448 4448 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 4449 4449 \/\d{8,10}\.html$ 2 0 0 1 4450 4450 ^\d{1,3}= 2 0 0 1 4451 4451 (Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$ 2 0 0 1 4452 4452 \/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4453 4453 ^\d+$ 2 0 0 1 4454 4454 ^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$ 2 0 0 1 4455 4455 [&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$) 2 0 0 1 4456 4456 ^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$ 2 0 0 1 4457 4457 \.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ 2 0 0 1 4458 4458 ^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$ 2 0 0 1 4459 4459 ^[a-f0-9]{32}\x3b$ 2 0 0 1 4460 4460 ^\/(kas|ser|mac)[0-9]+\.png$ 2 0 0 1 4461 4461 ^\/s\.php\?id=[a-z0-9]{2,6}$ 2 0 0 1 4462 4462 \.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4463 4463 ^[a-z0-9!\x22#%&'()*,.\/\x3a\x3b<=>?@\[\] ^_`{|}~\s-]+?downloading\.?\s*Please wait\x2e*<\/div\>\s*<iframe src\s*=\s*[\x22\x27]http\:\/\/[^\x22\x27]+\.php[\x22\x27]\s*style\s*=\s*[\x22\x27]display\x3a\s*none\x3b\s*[\x22\x27]>\s*<\/iframe\>\s*$ 2 0 0 1 4464 4464 ^[a-f0-9]{16}$ 2 0 0 1 4465 4465 ^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4}) 2 0 0 1 4466 4466 ^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 4467 4467 [a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$ 2 0 0 1 4468 4468 ^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20 2 0 0 1 4469 4469 ^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n] 2 0 0 1 4470 4470 ^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$ 2 0 0 1 4471 4471 (^|&)id=\d+($|&) 2 0 0 1 4472 4472 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 4473 4473 ^\d?\.dll$ 2 0 0 1 4474 4474 ^(32|64)$ 2 0 0 1 4475 4475 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$ 2 0 0 1 4476 4476 \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$ 2 0 0 1 4477 4477 ^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 4478 4478 \/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$ 2 0 0 1 4479 4479 ^SESSIONID=[A-Z0-9]{16} 2 0 0 1 4480 4480 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 4481 4481 ^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$ 2 0 0 1 4482 4482 ^\d+$ 2 0 0 1 4483 4483 ^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n 2 0 0 1 4484 4484 [=\"]\w{8}\.jar 2 0 0 1 4485 4485 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4486 4486 filename\x3D\x22[^\r\n]*security[^\n]+\.exe 2 0 0 1 4487 4487 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4488 4488 ^[A-F0-9]{30}$ 2 0 0 1 4489 4489 \.php\?cx=[A-F0-9]+&b=[A-F0-9]+>=[A-F0-9]+&tx=[A-F0-9]+$ 2 0 0 1 4490 4490 ^\/ucD[A-Za-z0-9_\/\-+]{171}$ 2 0 0 1 4491 4491 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1 4492 4492 ^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$ 2 0 0 1 4493 4493 ^[a-zA-Z0-9\/+_-]{171}$ 2 0 0 1 4494 4494 \/\d+\/\d+\.exe$ 2 0 0 1 4495 4495 ^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n 2 0 0 1 4496 4496 ^fn=[^&]*\.gif&code=\d+$ 2 0 0 1 4497 4497 ^[A-F0-9]+$ 2 0 0 1 4498 4498 ^log=save&session_id=[^&]+&value=[^&]+$ 2 0 0 1 4499 4499 %comSpec%\s\/c\s((\\x50)|(\\x70)|[Pp])\^?((\\x4f)|(\\x5f)|[Oo])\^?((\\x57)|(\\x77)|[Ww])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x52)|(\\x72)|[Rr])\^?((\\x53)|(\\x73)|[Ss])\^?((\\x48)|(\\x68)|[Hh])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x2e)|\.)\^?((\\x45)|(\\x65)|[Ee])\^?((\\x58)|(\\x78)|[Xx])\^?((\\x45)|(\\x65)|[Ee])\^?\s 2 0 0 1 4500 4500 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4501 4501 ^([a-f0-9]{2}){23,60}$ 2 0 0 1 4502 4502 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4503 4503 ^[0-9]*?[a-z]/P 2 0 0 1 4504 4504 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$ 2 0 0 1 4505 4505 ^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt 2 0 0 1 4506 4506 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1 4507 4507 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+ 2 0 0 1 4508 4508 ^[a-zA-Z0-9=/&?\x2e-]+$ 2 0 0 1 4509 4509 ^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,} 2 0 0 1 4510 4510 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 4511 4511 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 4512 4512 ^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$ 2 0 0 1 4513 4513 ^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$ 2 0 0 1 4514 4514 ^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?) 2 0 0 1 4515 4515 ^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}[\d_]+\.(jpg|png)\x22\x0d\x0a 2 0 0 1 4516 4516 ^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$ 2 0 0 1 4517 4517 ^\/[^\x2f]+?\.htm$ 2 0 0 1 4518 4518 ^\d{2,7}$ 2 0 0 1 4519 4519 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$ 2 0 0 1 4520 4520 ^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$ 2 0 0 1 4521 4521 ^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$ 2 0 0 1 4522 4522 (\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$) 2 0 0 1 4523 4523 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1 4524 4524 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 4525 4525 ^[a-zA-Z0-9\/+_-]{171}$ 2 0 0 1 4526 4526 ^cnc\.[a-fA-F0-9]{14}.xyz$ 2 0 0 1 4527 4527 ^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$ 2 0 0 1 4528 4528 ^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4529 4529 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4530 4530 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4531 4531 _aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9) 2 0 0 1 4532 4532 ^\/[a-f0-9]+$ 2 0 0 1 4533 4533 ^[A-Z]{4} 2 0 0 1 4534 4534 \.php\?host=[^&]+&password=[a-f0-9]{32}$ 2 0 0 1 4535 4535 ^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$ 2 0 0 1 4536 4536 ^\x2F[a-f0-9]{40,60}$ 2 0 0 1 4537 4537 ^[^\r\n]+\.exe(\x3b)?$ 2 0 0 1 4538 4538 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4539 4539 \r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1 4540 4540 Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n 2 0 0 1 4541 4541 Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n 2 0 0 1 4542 4542 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4543 4543 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4544 4544 ^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$ 2 0 0 1 4545 4545 ^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$ 2 0 0 1 4546 4546 ^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$ 2 0 0 1 4547 4547 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$ 2 0 0 1 4548 4548 =[a-z0-9\(_~\-\.\x00]{300,}\x00$ 2 0 0 1 4549 4549 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm 2 0 0 1 4550 4550 ^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm 2 0 0 1 4551 4551 ^[A-Z0-9\-]{30,42}$ 2 0 0 1 4552 4552 ^\d+?\r\n 2 0 0 1 4553 4553 ^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20__io_vl=[0-9]_[0-9]{6}_[0-9]{3}_[0-9]{2}\x3b\x20__io_bl=[0-9]{1,2}:[0-9]:[0-9]{4,5}:[0-9]{2}\x3b\x20Session_id=[0-9A-F]{12}\x3b\x20__io_uniq=[0-9A-F]{8,22}_[0-9A-F]{12,20}\x3b\x20__io_f=[0-9]{2}::[0-9]{10}::[0-9]{9,10}::[0-9]{9,10}$ 2 0 0 1 4554 4554 \.php\?c=[a-f0-9]{160}$ 2 0 0 1 4555 4555 Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$ 2 0 0 1 4556 4556 ^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$ 2 0 0 1 4557 4557 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4558 4558 ^dkv=[a-f0-9]{32}\x3bYSC=\d+$ 2 0 0 1 4559 4559 ^(resp|onl|pr)= 2 0 0 1 4560 4560 ^id=\d+&cred=[a-z]+\x7c 2 0 0 1 4561 4561 [\x80-\xff] 2 0 0 1 4562 4562 (retdl|fb|step) HTTP\/1\.1$ 2 0 0 1 4563 4563 ^\/[0-9]{6,16}-(pro|xl2|us1)$ 2 0 0 1 4564 4564 ^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$ 2 0 0 1 4565 4565 ^\/[0-9a-f]{16}$ 2 0 0 1 4566 4566 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4567 4567 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4568 4568 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4569 4569 ^[A-F0-9]{24} 2 0 0 1 4570 4570 ^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4571 4571 ^\/[a-z0-9]{32}\/\d\/$ 2 0 0 1 4572 4572 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4573 4573 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4574 4574 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4575 4575 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi 2 0 0 1 4576 4576 ^transfer=[A-Za-z0-9/+=]+$ 2 0 0 1 4577 4577 ^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64)\x3b\s_ga=\d\.\d+\.\d+\.\d+\x3b\s_u=[0-9A-F]+:[0-9A-F]+\x3b\s__io=\d{2}_\d{9,10}_\d{9,10}_\d{9,10}\x3b\s_gid=[0-9A-F]{12}$ 2 0 0 1 4578 4578 ^[A-Z]{256}$ 2 0 0 1 4579 4579 ^[0-9]{90,180}\r\n 2 0 0 1 4580 4580 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n 2 0 0 1 4581 4581 ^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$ 2 0 0 1 4582 4582 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4583 4583 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4584 4584 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4585 4585 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4586 4586 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4587 4587 ^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4588 4588 ^(id|tfzT)= 2 0 0 1 4589 4589 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4590 4590 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 4591 4591 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12} 2 0 0 1 4592 4592 ^[a-zA-Z0-9]{32}\.dot$ 2 0 0 1 4593 4593 ^[0-9A-F]{21,22}\x20HTTP\/1\.1$ 2 0 0 1 4594 4594 ^[0-9A-F]+$ 2 0 0 1 4595 4595 ^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ]|S[ABCEGHIJKLMNRTUVZ]|C[ACFHIKLMNORSVXYZ]|T[CDFGHJKMNOPRTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRTUZ]|K[EGHIMNRWYZ]|L[ACIKSTUVY]|I[DELMNOST]|E[CEGHRST]|F[IJKMORX]|U[AGKMSYZ]|V[ACEGINU]|D[EJKMOZ]|H[KMNRTU]|R[EOSUW]|J[EMOP]|W[FS]|Y[ET]|Z[AM]|OM|QA),\sST=((M[ADEINOST]|N[CDEHJMVY]|A[KLRZ]|I[ADLN]|W[AIVY]|C[AOT]|O[HKR]|[GLP]A|K[SY]|S[CD]|T[NX]|V[AT]|[HR]I|DE|FL|UT))[A-Z]{2},\sL=[A-Z][a-z]{2,15}(\s[A-Z][a-z]{2,10})?,\sO=[A-Z][a-z]{2,25}\s[A-Z][a-z]{2,25}(\s[A-Z][a-z]{2,25})?(\s[A-Z][a-z]{2,25})?(\s(Inc|LLC)\.)?,\sCN=[a-z]{4,11}\.[a-z]{2,4}$ 2 0 0 1 4596 4596 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4597 4597 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4598 4598 \x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in) 2 0 0 1 4599 4599 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4600 4600 ^[a-zA-Z0-9/+]{171}=$ 2 0 0 1 4601 4601 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4602 4602 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4603 4603 ^OSID=[a-zA-Z0-9\/+]{171}=$ 2 0 0 1 4604 4604 \=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4605 4605 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4606 4606 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4607 4607 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4608 4608 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4609 4609 ^[a-z0-9_]{6}[^a-z0-9_] 2 0 0 1 4610 4610 ^[a-z0-9]{5}\.com$ 2 0 0 1 4611 4611 ^[a-z]{3,15}\x3a\x20 2 0 0 1 4612 4612 ^[a-zA-z]{5,10}_[A-F0-9]{12}$ 2 0 0 1 4613 4613 ^[a-zA-z]{5,10}_[A-F0-9]{12}$ 2 0 0 1 4614 4614 ^[^\"]+\x7c\x22\x2c\x22 2 0 0 1 4615 4615 ^[a-z0-9]{32} 2 0 0 1 4616 4616 ^[a-z0-9]{32} 2 0 0 1 4617 4617 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4618 4618 ^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$ 2 0 0 1 4619 4619 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4620 4620 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4621 4621 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4622 4622 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 4623 4623 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4624 4624 ^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4625 4625 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4626 4626 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4627 4627 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4628 4628 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4629 4629 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4630 4630 ^[a-f0-9]{5,12}&a= 2 0 0 1 4631 4631 CN=([^\r\n]+?\.)?hotjar\.info(\.) 2 0 0 1 4632 4632 ^\/\?d=[a-f0-9]{16}$ 2 0 0 1 4633 4633 ^[a-z]{1} 2 0 0 1 4634 4634 ^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20 2 0 0 1 4635 4635 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 4636 4636 ^[A-P]{256}$ 2 0 0 1 4637 4637 ^[a-f0-9]{32}\r\n\r\nPK 2 0 0 1 4638 4638 ^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$ 2 0 0 1 4639 4639 ^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$ 2 0 0 1 4640 4640 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1 4641 4641 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1 4642 4642 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$ 2 0 0 1 4643 4643 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 4644 4644 ^\.(93joshua|purrple|black)$ 2 0 0 1 4645 4645 Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22 2 0 0 1 4646 4646 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 4647 4647 ^[A-Za-z0-9_-]+$ 2 0 0 1 4648 4648 (\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|o(sts?\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\d{1,2})|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|vchost[^\x2f]*|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|in(voice(\/[^\x2f]+|[^\x2f]*)|st\d+|fos?)|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|[\x2f\s]order|keem)\.exe$) 2 0 0 1 4649 4649 ^CN=www\.[0-9a-z]{8,20}\.net$ 2 0 0 1 4650 4650 ^[A-F0-9]+$ 2 0 0 1 4651 4651 \.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$ 2 0 0 1 4652 4652 ^[a-zA-z]{8}\. 2 0 0 1 4653 4653 ^[a-zA-z]{8}\. 2 0 0 1 4654 4654 [^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12][\x20\x21\x28-\x2f\x70-\x77\x79-\x7f\x60-\x63\x65\x66\x67-\x6f\x50-\x5f\x40-\x42\x46-\x4f\x30\x31\x35\x36\x38\x3e\x39\x3b]{1,14}\x18 2 0 0 1 4655 4655 ^[A-F0-9]{32} 2 0 0 1 4656 4656 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4657 4657 ^tt[cf]$ 2 0 0 1 4658 4658 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4659 4659 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4660 4660 ^([1-3]?)\/download\.php\?filename=ccom 2 0 0 1 4661 4661 ^[a-z]$ 2 0 0 1 4662 4662 \/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe 2 0 0 1 4663 4663 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 4664 4664 ^User-Agent\x3a\x20(Mozilla\/|Shockwave) 2 0 0 1 4665 4665 id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512} 2 0 0 1 4666 4666 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1 4667 4667 ^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4668 4668 ^[a-z0-9]{32} 2 0 0 1 4669 4669 ^[\x20-\x7e]+?.{8}\x7d\x9f 2 0 0 1 4670 4670 ^[\x20-\x7e]+?.{8}\x7a\x9f 2 0 0 1 4671 4671 ^[\x20-\x7e]+?.{8}\x78\x9a 2 0 0 1 4672 4672 ^[\x20-\x7e]+?.{8}\x7f\x9f 2 0 0 1 4673 4673 ^[\x20-\x7e]+?.{8}\xc3\x70 2 0 0 1 4674 4674 ^[\x20-\x7e]+?.{8}\x7c\x9e 2 0 0 1 4675 4675 ^.{4}[\x20-\x7e]+?.{4}\x78\x9c 2 0 0 1 4676 4676 ^[\x20-\x7e]+?.{8}\x7c\x99 2 0 0 1 4677 4677 ^[\x20-\x7e]+?.{8}\x7f\x9b 2 0 0 1 4678 4678 ^[\x20-\x7e]+?.{8}\x31\xd9 2 0 0 1 4679 4679 ^[\x20-\x7e]+?.{8}\x70\x9b 2 0 0 1 4680 4680 ^[\x20-\x7e]+?.{8}\xda\x41 2 0 0 1 4681 4681 ^[\x20-\x7e]+?.{8}\x7a\x9a 2 0 0 1 4682 4682 ^[\x20-\x7e]+?.{8}\x3f\xa6 2 0 0 1 4683 4683 ^[\x20-\x7e]+?.{8}\x70\x9b 2 0 0 1 4684 4684 ^[\x20-\x7e]+?.{8}\x39\xdd 2 0 0 1 4685 4685 ^.{4}[\x20-\x7e]+?.{4}\x78\x9c 2 0 0 1 4686 4686 ^[\x20-\x7e]+?.{8}\x3b\xd8 2 0 0 1 4687 4687 ^[\x20-\x7e]+?.{8}\x79\x9b 2 0 0 1 4688 4688 ^[\x20-\x7e]+?.{8}\x7c\x9c 2 0 0 1 4689 4689 ^[\x20-\x7e]+?.{8}\x79\x95 2 0 0 1 4690 4690 ^[\x20-\x7e]+?.{8}\x71\x95 2 0 0 1 4691 4691 ^[\x20-\x7e]{5,}.{8}\x78\x9c 2 0 0 1 4692 4692 ^[\x20-\x7e]+?.{8}\x7b\x95 2 0 0 1 4693 4693 ^[\x20-\x7e]+?.{8}\x79\x9f 2 0 0 1 4694 4694 ^[A-Z]{14}$ 2 0 0 1 4695 4695 ^.{4}[\x20-\x7e]+?.{4}\x71\x94 2 0 0 1 4696 4696 ^[\x20-\x7e]*?.{8}\x79\x9e 2 0 0 1 4697 4697 ^.{4}[\x20-\x7e]+?.{4}\x7c\x9c 2 0 0 1 4698 4698 ^[\x20-\x7e]+?.{8}\x7f\x9d 2 0 0 1 4699 4699 ^[\x20-\x7e]+?.{8}\x49\xa5 2 0 0 1 4700 4700 ^[\x20-\x7e]+?.{8}\x79\x94 2 0 0 1 4701 4701 ^.{8}[\x20-\x7e]+?.{5}\x7b\x9e 2 0 0 1 4702 4702 ^.{4}[\x20-\x7e]+?.{4}\x7d\x94 2 0 0 1 4703 4703 ^[\x20-\x7e]+?.{8}\x7d\x94 2 0 0 1 4704 4704 ^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$ 2 0 0 1 4705 4705 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 4706 4706 ^[\x20-\x7e]+?.{8}\x7b\x98 2 0 0 1 4707 4707 ^[\x20-\x7e]+?.{8}\x31\xad 2 0 0 1 4708 4708 ^[\x20-\x7e]+?.{8}\x40\xa3 2 0 0 1 4709 4709 ^[\x20-\x7e]+?.{8}\x7d\x98 2 0 0 1 4710 4710 ^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a 2 0 0 1 4711 4711 ^[\x20-\x7e]+?.{8}\x71\x9d 2 0 0 1 4712 4712 ^[\x20-\x7e]+?.{8}\x7a\x9b 2 0 0 1 4713 4713 ^.{8}\x70\x94[\x20-\x7e] 2 0 0 1 4714 4714 ^[\x20-\x7e]+?.{8}\x79\xda 2 0 0 1 4715 4715 ^[\x20-\x7e]+?.{8}\x30\xa5 2 0 0 1 4716 4716 ^[\x20-\x7e]+?.{8}\x70\x9a 2 0 0 1 4717 4717 ^[\x20-\x7e]+?.{8}\x79\x9b 2 0 0 1 4718 4718 ^[\x20-\x7e]+?.{8}\x31\xd9 2 0 0 1 4719 4719 ^[\x20-\x7e]+?.{8}\x79\x9c 2 0 0 1 4720 4720 ^[\x20-\x7e]+?.{8}\x7d\x99 2 0 0 1 4721 4721 ^[\x20-\x7e]+?.{8}\x7b\x9d 2 0 0 1 4722 4722 ^[\x20-\x7e]+?.{8}\x2e\x96 2 0 0 1 4723 4723 ^[\x20-\x7e]+?.{8}\x78\x9c 2 0 0 1 4724 4724 ^[\x20-\x7e]+?.{8}\x70\x98 2 0 0 1 4725 4725 ^[\x20-\x7e]+?.{8}\x4a\xae 2 0 0 1 4726 4726 ^[\x20-\x7e]+?.{8}\x71\x9e 2 0 0 1 4727 4727 ^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c 2 0 0 1 4728 4728 ^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c 2 0 0 1 4729 4729 ^.{8}[\x20-\x7e]+?\x79\x94 2 0 0 1 4730 4730 ^[\x20-\x7e]+?.{8}\x84\x60 2 0 0 1 4731 4731 ^[\x20-\x7e]+?.{8}\x40\xd8 2 0 0 1 4732 4732 ^[\x20-\x7e]+?.{8}\x7f\x94 2 0 0 1 4733 4733 ^[\x20-\x7e]+?.{8}\x79\x9c 2 0 0 1 4734 4734 ^[\x20-\x7e]+?.{8}\x7a\x9c 2 0 0 1 4735 4735 ^[\x20-\x7e]+?.{8}\x7e\x9c 2 0 0 1 4736 4736 ^[\x20-\x7e]+?.{8}\x39\x99 2 0 0 1 4737 4737 ^[\x20-\x7e]+?.{8}\x49\xa2 2 0 0 1 4738 4738 ^[\x20-\x7e]+?.{8}\x79\x9d 2 0 0 1 4739 4739 ^[\x20-\x7e]+?.{8}\x7b\x9f 2 0 0 1 4740 4740 ^[\x20-\x7e]+?.{8}\x79\x9a 2 0 0 1 4741 4741 ^[\x20-\x7e]+?.{8}\x70\x94 2 0 0 1 4742 4742 ^[\x20-\x7e]+?.{8}\x44\xdf 2 0 0 1 4743 4743 ^.{4}[\x20-\x7e]+?.{4}\x7b\x9e 2 0 0 1 4744 4744 ^[\x20-\x7e]+?.{8}\x7b\x9e 2 0 0 1 4745 4745 ^[\x20-\x7e]+?.{8}\x83\x7f 2 0 0 1 4746 4746 ^.{8}[\x20-\x7e]+?\x7c\x9f 2 0 0 1 4747 4747 ^[\x20-\x7e]+?.{8}\x7d\x9a 2 0 0 1 4748 4748 ^.{9,28}\x78\x9c 2 0 0 1 4749 4749 ^.{8}[\x20-\x7e]{5}\x78\x9c 2 0 0 1 4750 4750 ^[\x20-\x7e]+?.{8}\x4a\xd5 2 0 0 1 4751 4751 ^[\x20-\x7e]+?.{8}\x79\xdd 2 0 0 1 4752 4752 ^[\x20-\x7e]+?.{8}\x70\x9e 2 0 0 1 4753 4753 ^[\x20-\x7e]+?.{10}\x7a\x5d 2 0 0 1 4754 4754 ^.{8}[\x20-\x7e]+?.{5}\x7c\x9e 2 0 0 1 4755 4755 ^[\x20-\x7e]+?.{8}\x7d\x9e 2 0 0 1 4756 4756 ^[\x20-\x7e]+?.{8}\x70\x9c 2 0 0 1 4757 4757 ^[\x20-\x7e]+?.{8}\x3b\xdf 2 0 0 1 4758 4758 ^[\x20-\x7e]+?.{8}\x47\xd9 2 0 0 1 4759 4759 ^[\x20-\x7e]+?.{8}\x79\x99 2 0 0 1 4760 4760 ^.{8}[\x20-\x7e]+?.{2}\x78\x9c 2 0 0 1 4761 4761 ^.{4}[\x20-\x7e]{5}.{4}\x96\x71 2 0 0 1 4762 4762 ^[\x20-\x7e]+?.{8}\x7b\x9b 2 0 0 1 4763 4763 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4764 4764 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4765 4765 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4766 4766 ([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4767 4767 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4768 4768 ^[a-f0-9]{32} 2 0 0 1 4769 4769 >\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}> 2 0 0 1 4770 4770 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4771 4771 ^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$ 2 0 0 1 4772 4772 \/[a-z0-9]{1,31}\.bin$ 2 0 0 1 4773 4773 ^[A-Za-z0-9\-_~]{75,}$ 2 0 0 1 4774 4774 (JmJ1aWxkP|YnVpbGQ9|ZidWlsZD) 2 0 0 1 4775 4775 ^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00 2 0 0 1 4776 4776 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4777 4777 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4778 4778 ^[A-Za-z0-9]{16,32}$ 2 0 0 1 4779 4779 ^[a-zA-Z0-9_-]{171}$ 2 0 0 1 4780 4780 (Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X|C(Qwh2E|RQxxF)|J(DCHYT|FDHEW)|R(UYIcB|kIJcR)|GQglxE|ZCCXEQ) 2 0 0 1 4781 4781 (fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI) 2 0 0 1 4782 4782 (I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I) 2 0 0 1 4783 4783 ^[0-9a-f]{64}$ 2 0 0 1 4784 4784 ^[0-9a-f]{64}$ 2 0 0 1 4785 4785 ^[\x01-\x4c]$ 2 0 0 1 4786 4786 CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.) 2 0 0 1 4787 4787 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4788 4788 ^key=\w+\&data= 2 0 0 1 4789 4789 ^\d+$ 2 0 0 1 4790 4790 \.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$ 2 0 0 1 4791 4791 ^[0-9D]+$ 2 0 0 1 4792 4792 \.(dll|exe|zip|json)$ 2 0 0 1 4793 4793 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4794 4794 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4795 4795 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4796 4796 ^\/[a-zA-Z0-9]{9,12}\/t\.html$ 2 0 0 1 4797 4797 ^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4798 4798 ^[a-z]{256}$ 2 0 0 1 4799 4799 ^[0-9]&(index|pi|serv)= 2 0 0 1 4800 4800 ^[0-9]&(index|pi|serv)= 2 0 0 1 4801 4801 ^[0-9]&(index|pi|serv)= 2 0 0 1 4802 4802 ^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$ 2 0 0 1 4803 4803 ^(\d{1,3}\.){3}\d{1,3}$ 2 0 0 1 4804 4804 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})([\r\n]([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$ 2 0 0 1 4805 4805 ^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$ 2 0 0 1 4806 4806 (IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I) 2 0 0 1 4807 4807 (IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi) 2 0 0 1 4808 4808 (ifQ==|In0=|J9)$ 2 0 0 1 4809 4809 ^[a-z]{256}-\.jpg$ 2 0 0 1 4810 4810 ^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI) 2 0 0 1 4811 4811 ^[a-f0-9]{5,12}&a= 2 0 0 1 4812 4812 ^[a-zA-Z0-9]{12}\.onion 2 0 0 1 4813 4813 ^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$ 2 0 0 1 4814 4814 ^[a-z]{256}\.gif$ 2 0 0 1 4815 4815 (JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQSU0RCU2NSU2RCU2RiU3MiU3OSUzQSUyM|lMEQlMEElMEQlMEElNEQlNjUlNkQlNkYlNzIlNzklM0ElMj) 2 0 0 1 4816 4816 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$ 2 0 0 1 4817 4817 ^\/[a-zA-Z0-9]{9,12}\/x\.html$ 2 0 0 1 4818 4818 ^[0-9]+$ 2 0 0 1 4819 4819 ^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$ 2 0 0 1 4820 4820 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4821 4821 ^[\x01-\x04] 2 0 0 1 4822 4822 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4823 4823 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4824 4824 [a-z]{8}.(:?psd|dib) 2 0 0 1 4825 4825 [a-z]{8}.(:?dib|psd) 2 0 0 1 4826 4826 https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.[a-z]{3,12}.com\/[a-z]{3,4}\/[a-z0-9]{6}_[a-z0-9]{32} 2 0 0 1 4827 4827 ^[a-z0-9]{6}_[a-z0-9]{32} 2 0 0 1 4828 4828 \.php\?[a-z]{3}=(baby|child|adult) 2 0 0 1 4829 4829 ^[a-f0-9=]{5,12}&ap= 2 0 0 1 4830 4830 ^[0-9]{8}$ 2 0 0 1 4831 4831 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4832 4832 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4833 4833 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4834 4834 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4835 4835 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4836 4836 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4837 4837 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4838 4838 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4839 4839 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4840 4840 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4841 4841 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1 4842 4842 ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ 2 0 0 1 4843 4843 ^(update|designs)$ 2 0 0 1 4844 4844 ^\d$ 2 0 0 1 4845 4845 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$ 2 0 0 1 4846 4846 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4847 4847 \*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\* 2 0 0 1 4848 4848 ^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$ 2 0 0 1 4849 4849 ^[A-Za-z0-9-_]{176}$ 2 0 0 1 4850 4850 ^\/\.x\/irq\d$ 2 0 0 1 4851 4851 ^\/\.x\/\dsh$ 2 0 0 1 4852 4852 ^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c 2 0 0 1 4853 4853 \x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b 2 0 0 1 4854 4854 ^\/[A-Za-z0-9]{10,11}\/ 2 0 0 1 4855 4855 \.php\?serial=[a-z0-9]{16} 2 0 0 1 4856 4856 ^[0-3]{2}_[0-2]{2}\.php$ 2 0 0 1 4857 4857 ^dBrowser\x20\d\x20CallGetResponse\x3a\d$ 2 0 0 1 4858 4858 ^\/\w$ 2 0 0 1 4859 4859 ^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$ 2 0 0 1 4860 4860 ^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$ 2 0 0 1 4861 4861 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4862 4862 ^\/wp-includes\/[A-Za-z0-9]{10}\/$ 2 0 0 1 4863 4863 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1 4864 4864 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1 4865 4865 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1 4866 4866 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1 4867 4867 ^.\d{1,2}\.\d+\.\d+ 2 0 0 1 4868 4868 ^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n] 2 0 0 1 4869 4869 ^[A-Za-z0-9]{16,32}$ 2 0 0 1 4870 4870 ^[A-Za-z0-9]{16,32}$ 2 0 0 1 4871 4871 ^\d+$ 2 0 0 1 4872 4872 ^\/[A-Za-z0-9]{30}\.php$ 2 0 0 1 4873 4873 ^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})[a-f0-9]{2}-v[a-f0-9]{2}\x0a\x22\x3e\x0a\x3c 2 0 0 1 4874 4874 ^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$ 2 0 0 1 4875 4875 ^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$ 2 0 0 1 4876 4876 ^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$ 2 0 0 1 4877 4877 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4878 4878 ^[a-z0-9]{8}\r\n 2 0 0 1 4879 4879 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 4880 4880 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4881 4881 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4882 4882 ^[0-9]{6,10}\. 2 0 0 1 4883 4883 ^\/[a-zA-z]{14}\/ 2 0 0 1 4884 4884 ^\/[a-zA-z]{14}\/ 2 0 0 1 4885 4885 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4886 4886 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4887 4887 ^[A-Z]{16}$ 2 0 0 1 4888 4888 ^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$ 2 0 0 1 4889 4889 ^[A-Z]{16}$ 2 0 0 1 4890 4890 ^[A-Z]{16}$ 2 0 0 1 4891 4891 ^([A-F0-9]\x00){12} 2 0 0 1 4892 4892 ^([A-F0-9]\x00){12} 2 0 0 1 4893 4893 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4894 4894 ^[A-F0-9]{12} 2 0 0 1 4895 4895 ^([A-F0-9]\x00){12} 2 0 0 1 4896 4896 ^[A-F0-9]{12} 2 0 0 1 4897 4897 ^(<letter>[a-z])(=letter)\, 2 0 0 1 4898 4898 O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,) 2 0 0 1 4899 4899 [eE]mail(Address)admin@ 2 0 0 1 4900 4900 ^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email) 2 0 0 1 4901 4901 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1 4902 4902 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1 4903 4903 ^[A-F0-9]{12} 2 0 0 1 4904 4904 ^\d 2 0 0 1 4905 4905 ^\x2F[a-z]{1}\x2Ehtm$ 2 0 0 1 4906 4906 \/index.dat\?\d{5,9}$ 2 0 0 1 4907 4907 ^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 \x28compatible\x3b MSIE 7\.0\x3b Windows NT 5\.1\x3b SV1\x29\r\nHost\x3a\x20[^\r\n]+?(\x3a(443|8080|900[0-9]))?\r\n(Connection\x3a\x20Keep-Alive\r\n)?\r\n$ 2 0 0 1 4908 4908 ^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H 2 0 0 1 4909 4909 ^[a-zA-Z0-9\+\/]+={0,2}$/P 2 0 0 1 4910 4910 filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi 2 0 0 1 4911 4911 ^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?\x2e\x00t\x00x\x00t 2 0 0 1 4912 4912 ^[a-z]\x29 2 0 0 1 4913 4913 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title 2 0 0 1 4914 4914 ^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var) 2 0 0 1 4915 4915 ^\/[a-z]$ 2 0 0 1 4916 4916 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4917 4917 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4918 4918 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4919 4919 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4920 4920 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4921 4921 ^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x07.{2}(=fake_loc) 2 0 0 1 4922 4922 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4923 4923 ^[a-z0-9/=\+]$ 2 0 0 1 4924 4924 ^[a-z0-9/=\+]$ 2 0 0 1 4925 4925 ^\/d\/[a-z]+\d+\.jpg$ 2 0 0 1 4926 4926 \/p?2p\/[0-9]{1,2}\.exe$ 2 0 0 1 4927 4927 ^\/2p\/[a-z]{1,2}\.exe$ 2 0 0 1 4928 4928 \/[a-z0-9]{3,}\.gz$ 2 0 0 1 4929 4929 \/mss\d+\.exe$ 2 0 0 1 4930 4930 ^\/download\/ftp\/(grabftp|grabftp64)\.bin$ 2 0 0 1 4931 4931 ^\/image\/(data|flags)\/[^\x2f]+\.exe$ 2 0 0 1 4932 4932 (\x20MSIE\x20|rv\x3a11) 2 0 0 1 4933 4933 ^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n] 2 0 0 1 4934 4934 ^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$ 2 0 0 1 4935 4935 ^[A-Z]{2}-[0-9]{1,5}\x3aBegin$ 2 0 0 1 4936 4936 ^[A-Z]{2}-[0-9]{1,5}\x3aStartU$ 2 0 0 1 4937 4937 ^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$ 2 0 0 1 4938 4938 ^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK> 2 0 0 1 4939 4939 ^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$ 2 0 0 1 4940 4940 ^[A-Za-z0-9_-]{171}$ 2 0 0 1 4941 4941 ^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$ 2 0 0 1 4942 4942 ^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\nReferer\x3a\x20http:\/\/(\d{1,3}\.){3}\d{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n 2 0 0 1 4943 4943 ^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$ 2 0 0 1 4944 4944 [A-Za-z0-9]{62} 2 0 0 1 4945 4945 ^(php)?Yuok\\\d\d 2 0 0 1 4946 4946 Data\\\d\d 2 0 0 1 4947 4947 ^[a-zA-Z0-9\/+]{171}=$ 2 0 0 1 4948 4948 ^\/\?id\=[A-Z]{12,28}[0-9]$ 2 0 0 1 4949 4949 ^\/\?id\=[A-Z]{12,28}[0-9]$ 2 0 0 1 4950 4950 \/\?p=p52dcW[A-Za-z]{4} 2 0 0 1 4951 4951 ^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var) 2 0 0 1 4952 4952 ^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 4953 4953 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 4954 4954 ^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var) 2 0 0 1 4955 4955 ^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname) 2 0 0 1 4956 4956 [^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36][\x20-\x27\x2c\x2d\x30\x31\x33-\x36\x38\x3b-\x3d\x40-\x47\x4a-\x4d\x4f\x50-\x5f\x60\x68\x6b-\x6f\x70-\x74\x76-\x7f]{1,14}\x15 2 0 0 1 4957 4957 ^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n 2 0 0 1 4958 4958 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4959 4959 ^[A-Za-z0-9\/_\-\+]{171}=$ 2 0 0 1 4960 4960 [a-zA-Z0-9]{8}\/ 2 0 0 1 4961 4961 ^[a-z]\.(tech|online)$ 2 0 0 1 4962 4962 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1 4963 4963 ^[a-zA-Z0-9-_]{171}$ 2 0 0 1 4964 4964 [a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$ 2 0 0 1 4965 4965 updateb\.php\?p=\d 2 0 0 1 4966 4966 &os=[0-9a-z]{40} 2 0 0 1 4967 4967 &(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9] 2 0 0 1 4968 4968 ^[1-z]{13}=[0-9]{16}$ 2 0 0 1 4969 4969 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4970 4970 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4971 4971 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 4972 4972 ^\/[A-F0-9]{33}$ 2 0 0 1 4973 4973 ^\d+?\x00 2 0 0 1 4974 4974 %(USERPROFILE|APPDATA)% 2 0 0 1 4975 4975 %(USERPROFILE|APPDATA)% 2 0 0 1 4976 4976 %(USERPROFILE|APPDATA)% 2 0 0 1 4977 4977 %(USERPROFILE|APPDATA)% 2 0 0 1 4978 4978 ^[0-9]{10}$ 2 0 0 1 4979 4979 ^key=[A-F0-9]{32}$ 2 0 0 1 4980 4980 ^[a-f0-9]{60}\x0d\x0a 2 0 0 1 4981 4981 ^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 4982 4982 [0-9]{1,2} 2 0 0 1 4983 4983 \d{1,2} 2 0 0 1 4984 4984 [0-9]{1,2} 2 0 0 1 4985 4985 [0-9]{1,2} 2 0 0 1 4986 4986 [0-9]{1,2} 2 0 0 1 4987 4987 [0-9]{1,2} 2 0 0 1 4988 4988 CN=([^\r\n]+?\.)?supportmicrohere\.com(\.) 2 0 0 1 4989 4989 CN=([^\r\n]+?\.)?jbdelmarket\.com(\.) 2 0 0 1 4990 4990 [0-9]{1,3} 2 0 0 1 4991 4991 [0-9]{1,3} 2 0 0 1 4992 4992 ^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n 2 0 0 1 4993 4993 ^([0-9]{1,3}\.){3}[0-9]{1,3}$/W 2 0 0 1 4994 4994 [a-f0-9]{60}$ 2 0 0 1 4995 4995 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 4996 4996 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 4997 4997 ^[a-z0-9]{33} 2 0 0 1 4998 4998 ^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\. 2 0 0 1 4999 4999 ^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\. 2 0 0 1 5000 5000 ^5\.[0-2]\x20\d\d\x3a\d\d\x20 2 0 0 1 5001 5001 ^\d{1,5}\x00ll 2 0 0 1 5002 5002 ^LIST-[A-Za-z0-9]{16}\. 2 0 0 1 5003 5003 ^LS-[A-Za-z0-9]{16}\. 2 0 0 1 5004 5004 ^SIZE-[A-Za-z0-9]{16}\. 2 0 0 1 5005 5005 ^LD-[A-Za-z0-9]{16}\. 2 0 0 1 5006 5006 ^CB-[A-Za-z0-9]{16}\. 2 0 0 1 5007 5007 ^CD-[A-Za-z0-9]{16}\. 2 0 0 1 5008 5008 ^EX-[A-Za-z0-9]{16}\. 2 0 0 1 5009 5009 ^ALIVE-[A-Za-z0-9]{16}\. 2 0 0 1 5010 5010 ^EXIT-[A-Za-z0-9]{16}\. 2 0 0 1 5011 5011 ^finito-[A-Za-z0-9]{16}\. 2 0 0 1 5012 5012 ^.{4}(R(k(Z(GQkBG|CQEY)|BCRUVG)|0FFRkFH|UJDQUE)|Q(U(V(CQ0FB|GQUc)|NCRkI)|kFDQkZC|EJFRUY)|(Z(AQkVF|GRkJA)R|JBQ0JGQ)g|FFQkNBQQ|dBRUZBRw) 2 0 0 1 5013 5013 \/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$ 2 0 0 1 5014 5014 \/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$ 2 0 0 1 5015 5015 ^(send|receive) 2 0 0 1 5016 5016 ^(send|receive) 2 0 0 1 5017 5017 ^(send|receive) 2 0 0 1 5018 5018 ^(send|receive) 2 0 0 1 5019 5019 ^[0-9a-zA-Z]{32} 2 0 0 1 5020 5020 ^\/\.x\/var\/run\/tty\d$ 2 0 0 1 5021 5021 ^\/var\/(run|tmp)\/pty$ 2 0 0 1 5022 5022 ^\/[a-z0-9]{45,60}\/[a-z0-9]{35,65}\/[a-z0-9]{38,60}\.php\?data=active$ 2 0 0 1 5023 5023 ^\/\?m=[abcde]&p1=[a-f0-9-]{8,40}(&p2=[^&]+)?(&p3=[^&]+)?$ 2 0 0 1 5024 5024 ^sg\x3a\x20[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}[\r\n]+$ 2 0 0 1 5025 5025 \/\?m=[a-z]&p1=[a-z0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$ 2 0 0 1 5026 5026 ^[A-Za-z0-9+=/]{172}$ 2 0 0 1 5027 5027 ^(FileManager|PortScan|ExecuteCommand|DatabaseManager) 2 0 0 1 5028 5028 ^[A-Za-z]{15,20}$ 2 0 0 1 5029 5029 ^PHPSESSID=[a-z0-9]{26}$ 2 0 0 1 5030 5030 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5031 5031 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5032 5032 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5033 5033 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5034 5034 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5035 5035 ^[\da-z]{11} 2 0 0 1 5036 5036 ^[A-Z]{2} 2 0 0 1 5037 5037 ^[A-Z]{2} 2 0 0 1 5038 5038 ^\/admin[0-9]?\/client\.php$ 2 0 0 1 5039 5039 ^\/[a-z0-9]{16}\/ 2 0 0 1 5040 5040 ^(\d{1,3}\.){3}\d{1,3}\|\| 2 0 0 1 5041 5041 ^\/[a-zA-Z0-9]{1,25}\-[a-f0-9]{8}$ 2 0 0 1 5042 5042 ^[a-f0-9]{32} 2 0 0 1 5043 5043 ^[A-Z]{2}[A-F0-9]{16} 2 0 0 1 5044 5044 ^Referer\x3a\x20[a-zA-Z0-9_\-.]+\x28[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\x29\w+\x0d\x0a 2 0 0 1 5045 5045 ^[A-Z0-9]{18}$ 2 0 0 1 5046 5046 ^[A-Za-z0-9+/=]{730,} 2 0 0 1 5047 5047 ^[a-f0-9]{32} 2 0 0 1 5048 5048 ^[a-f0-9]{32} 2 0 0 1 5049 5049 \/([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{5}=|[a-zA-Z0-9+/\x20]{4})([a-zA-Z=]{4}?)$ 2 0 0 1 5050 5050 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5051 5051 ^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$ 2 0 0 1 5052 5052 ^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$ 2 0 0 1 5053 5053 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 5054 5054 (([a-zA-Z0-9]\0){10,}) 2 0 0 1 5055 5055 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 5056 5056 ^\/([a-zA-Z0-9]{280,408})$ 2 0 0 1 5057 5057 ^\/([a-zA-Z0-9=]{60,408})$ 2 0 0 1 5058 5058 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 5059 5059 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 5060 5060 (TWljcm9zb2Z0IENvcnBvcmF0aW9uL|1pY3Jvc29mdCBDb3Jwb3JhdGlvbi|NaWNyb3NvZnQgQ29ycG9yYXRpb24u)[a-zA-Z0-9\x2f\x2b]{25,35}(Cg0KQzpc|oNCkM6XD|KDQpDOlw\x2b) 2 0 0 1 5061 5061 ^[0-9]{3}$ 2 0 0 1 5062 5062 (www\.((b(an(co(dobrasil|hsbc)|espa)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(antander(banespa|net)?|erasa(experian)?)|uolhost)\.com\.br|c((aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov))\.br|redicard\.com(\.br)?)|itau(p(ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(ricanexpress\.com(\.br)?|x\.com\.br))|((b(an(co(dobrasil|hsbc)|risul)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(erasa(experian)?|antander)|uolhost)\.com|c(aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov)|redicard\.com))\.br|itau((p(ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(ricanexpress.com(\.br)?|x\.com\.br)|\*(linhadefensiva*|hsbc*)) 2 0 0 1 5063 5063 ^\/(GetProDownConfig|downservers|ShopIp)\.aspx\?ShopId=[0-9]+$ 2 0 0 1 5064 5064 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 5065 5065 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 5066 5066 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$ 2 0 0 1 5067 5067 ^\x5b[A-Z]{2}\x5d\x20[A-Z0-9]{32}\x20\x5b[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{4}\x20[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{2}\x5d\x5bsplit\x5d 2 0 0 1 5068 5068 Subject\x3a[0-9]{1,2}\x2f[0-9]{1,2}\x2f[0-9]{4}\x20[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{2}\x20[AP] 2 0 0 1 5069 5069 ^\d{3,6}$ 2 0 0 1 5070 5070 ^.{2}([A-Z]{0,32}[^A-Z01])(<var>[^01]{4,33}[01]).+?\x06\x03\x55\x04\x08.{2}(=var) 2 0 0 1 5071 5071 ^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{16}\.php$ 2 0 0 1 5072 5072 ^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{48}\.mp3$ 2 0 0 1 5073 5073 [A-Za-z0-9]{16}\x0d\x0a/Content|2d|Disposition|3a 2 0 0 1 5074 5074 ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12} 2 0 0 1 5075 5075 ^[A-Za-z0-9=/+]{100} 2 0 0 1 5076 5076 ^[A-Za-z0-9=/+]{100} 2 0 0 1 5077 5077 CN=([^\r\n]+?\.)?edou\.me(\.) 2 0 0 1 5078 5078 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\} 2 0 0 1 5079 5079 ^###\d+###[a-zA-Z0-9\-\.]{2,63}###\x00+$ 2 0 0 1 5080 5080 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 5081 5081 ^([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})$ 2 0 0 1 5082 5082 ^[A-Za-z0-9=+/\x22\x00]{100,1000}$ 2 0 0 1 5083 5083 ^([A-F0-9]\x00){12} 2 0 0 1 5084 5084 ^[A-Za-z0-9]{262}$ 2 0 0 1 5085 5085 ^[a-f0-9]{32} 2 0 0 1 5086 5086 ^(\x3a\d{1,5})?$ 2 0 0 1 5087 5087 ^[A-Za-z0-9-_]{171}$ 2 0 0 1 5088 5088 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5089 5089 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5090 5090 \|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\| 2 0 0 1 5091 5091 ^(([a-z0-9])()){33,}\.ru$ 2 0 0 1 5092 5092 ^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01 2 0 0 1 5093 5093 ^(0\x3d\w\x261\x3d\d{3}\x262\x3d\d{3})$ 2 0 0 1 5094 5094 ^\d{6} 2 0 0 1 5095 5095 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5096 5096 ^.(<servercert>[\x00-\xff][\x20-\x7f]{1,50})\x30.+?\x55\x04\x03.(=servercert)\x30 2 0 0 1 5097 5097 [a-f0-9]{24}\.[a-f0-9]{16} 2 0 0 1 5098 5098 ^[a-z]{4}\x3d 2 0 0 1 5099 5099 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 5100 5100 ^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12} 2 0 0 1 5101 5101 ^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12} 2 0 0 1 5102 5102 ^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12} 2 0 0 1 5103 5103 ^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12} 2 0 0 1 5104 5104 ^[a-f0-9]{32}\x7c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x7c 2 0 0 1 5105 5105 ^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3} 2 0 0 1 5106 5106 ^(ct_start|chr_start|moz_start|grb_start|upl_start) 2 0 0 1 5107 5107 ^(sqlite|mozglue|nss3|freebl3|softokn3) 2 0 0 1 5108 5108 \{[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\} 2 0 0 1 5109 5109 \.jpg\?id=\d+$ 2 0 0 1 5110 5110 ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12} 2 0 0 1 5111 5111 ^([A-Za-z0-9\x2b\x2f\x3d]){15,25}$ 2 0 0 1 5112 5112 ^([A-Za-z0-9\x2b\x2f\x3d]){10,30}$ 2 0 0 1 5113 5113 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5114 5114 ^\/[a-zA-Z0-9]{32}$ 2 0 0 1 5115 5115 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5116 5116 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 5117 5117 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 5118 5118 ^[A-F0-9]{8}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{12}$ 2 0 0 1 5119 5119 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5120 5120 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5121 5121 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5122 5122 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5123 5123 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5124 5124 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5125 5125 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5126 5126 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5127 5127 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5128 5128 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5129 5129 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5130 5130 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5131 5131 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5132 5132 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5133 5133 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5134 5134 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5135 5135 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5136 5136 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66) 2 0 0 1 5137 5137 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5138 5138 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5139 5139 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5140 5140 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5141 5141 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5142 5142 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5143 5143 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5144 5144 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5145 5145 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5146 5146 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5147 5147 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66) 2 0 0 1 5148 5148 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5149 5149 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5150 5150 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5151 5151 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5152 5152 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5153 5153 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66) 2 0 0 1 5154 5154 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5155 5155 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5156 5156 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5157 5157 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5158 5158 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5159 5159 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5160 5160 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5161 5161 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5162 5162 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5163 5163 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5164 5164 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5165 5165 ^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P 2 0 0 1 5166 5166 ^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb) 2 0 0 1 5167 5167 ^\d{4}\/\w{2,8}_\w{8}\.bmp 2 0 0 1 5168 5168 \.(bmp|png|jpe?g)$ 2 0 0 1 5169 5169 \.(bmp|png|jpe?g)$ 2 0 0 1 5170 5170 \.(bmp|png|jpe?g)$ 2 0 0 1 5171 5171 \.(bmp|png|jpe?g)$ 2 0 0 1 5172 5172 \.(bmp|png|jpe?g)$ 2 0 0 1 5173 5173 \/\d{6,8}\/\w{2,5}_\w{8}\.bmp$ 2 0 0 1 5174 5174 ^[0-9]{15,16}\x7d$ 2 0 0 1 5175 5175 ^[a-z0-9]{19} 2 0 0 1 5176 5176 ^[a-f0-9]{32}\.gif\" 2 0 0 1 5177 5177 ^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 5178 5178 ^[a-f0-9]{32} 2 0 0 1 5179 5179 ^\d{14}\.jpg\x22/P 2 0 0 1 5180 5180 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 5181 5181 ^((([a-f0-9]){2}){16}) 2 0 0 1 5182 5182 ^[A-Z0-9]{12}$ 2 0 0 1 5183 5183 ^[A-Z0-9]{10}\x22 2 0 0 1 5184 5184 ^images[a-f0-9]{8}\. 2 0 0 1 5185 5185 ^[a-f0-9]{12} 2 0 0 1 5186 5186 ^[A-F0-9]{32} 2 0 0 1 5187 5187 ^([A-Za-z0-9~\+\/]{4})*([A-Za-z0-9~\+\/]{2}==|[A-Za-z0-9~\+\/]{3}=|[A-Za-z0-9~\+\/]{4})$ 2 0 0 1 5188 5188 ^\d+\.\d+\.\d{3,5} 2 0 0 1 5189 5189 ^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\x7c 2 0 0 1 5190 5190 ^([0-9A-F]{2}(-)?){16}\x7c 2 0 0 1 5191 5191 ^http|3a 2f 2f|[a-z]{5,10}.(com|org|net)\/$ 2 0 0 1 5192 5192 ^[a-f0-9]{8}\-[a-f0-9]{8}\x22\x0d\x0a 2 0 0 1 5193 5193 ^AUTHINFO\s+USER\s[^\n]{200} 2 0 0 1 5194 5194 ^SEARCH\s+[^\n]{1024} 2 0 0 1 5195 5195 --backup-dir\s+\x2e\x2e\x2f 2 0 0 1 5196 5196 ^200\s[^\n]{64} 2 0 0 1 5197 5197 ^Location\x3a[^\n]{128} 2 0 0 1 5198 5198 ^newgroup\x3a[^\n]{21} 2 0 0 1 5199 5199 ^XAT\s+[^\n]{1024} 2 0 0 1 5200 5200 ^sendsys\x3a[^\n]{21} 2 0 0 1 5201 5201 ^checkgroups\x3a[^\n]{21} 2 0 0 1 5202 5202 ^ihave\x3a[^\n]{21} 2 0 0 1 5203 5203 ^rmgroup\x3a[^\n]{21} 2 0 0 1 5204 5204 ^sendme\x3a[^\n]{21} 2 0 0 1 5205 5205 ^senduuname\x3a[^\n]{21} 2 0 0 1 5206 5206 ^version\x3a[^\n]{21} 2 0 0 1 5207 5207 Enter User Name\x3a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*\s*(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*f(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*c(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*t(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*o(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*r(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*y(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*[\r\n] 2 0 0 1 5208 5208 \x2FHiShowServlet\x2Fservlet.+(InstalNum|UserActivation) 2 0 0 1 5209 5209 Host\x3A[^\n\r]*jiao.com/Hi 2 0 0 1 5210 5210 imei=\d{2}-?\d{6}-?\d{6,}-?\d{1,} 2 0 0 1 5211 5211 ^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27] 2 0 0 1 5212 5212 ^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27] 2 0 0 1 5213 5213 \/kt\/JpNx9n$ 2 0 0 1 5214 5214 ^\d{15}\r\n$ 2 0 0 1 5215 5215 ^[a-f0-9] 2 0 0 1 5216 5216 ^[a-f0-9] 2 0 0 1 5217 5217 ^(update|startcharge) 2 0 0 1 5218 5218 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 5219 5219 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 5220 5220 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 5221 5221 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 5222 5222 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} 2 0 0 1 5223 5223 ^((sear|wat)ch|results|close|find|open)\/\?[a-zA-Z]{2,8}= 2 0 0 1 5224 5224 ^bot_id=[a-f0-9]{32}& 2 0 0 1 5225 5225 \/RequestActionsToExecute$ 2 0 0 1 5226 5226 \/n\/\d{15}$ 2 0 0 1 5227 5227 \/ad-(strat|devi)\/$ 2 0 0 1 5228 5228 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4} 2 0 0 1 5229 5229 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4} 2 0 0 1 5230 5230 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4} 2 0 0 1 5231 5231 ^[a-f0-9]{30,35}&app_package_name= 2 0 0 1 5232 5232 ^\/flash\/api\.php\?id=\d 2 0 0 1 5233 5233 ^Host\x3a[^\r\n]+?dmp\.[^\r\n]+?\r?$ 2 0 0 1 5234 5234 ^\/gac\/[a-f0-9]{15}$ 2 0 0 1 5235 5235 &game=[a-f0-9]{40}$ 2 0 0 1 5236 5236 &id=\d{15}$ 2 0 0 1 5237 5237 ^Host\x3a\x20[a-z0-9.]+\.bb800\.com 2 0 0 1 5238 5238 ^Host\x3a\x20[a-z0-9.]+\.bb800\.com 2 0 0 1 5239 5239 \/NotifyLog$ 2 0 0 1 5240 5240 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5241 5241 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5242 5242 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5243 5243 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5244 5244 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5245 5245 ^d(id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$ 2 0 0 1 5246 5246 &data=(([A-Za-z0-9]|%2[FB]){4})*(([A-Za-z0-9]|%2[FB]){2}==|([A-Za-z0-9]|%2[FB]){3}=|([A-Za-z0-9]|%2[FB]){4})$ 2 0 0 1 5247 5247 ^Host\x3a[^\n\r]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\r\n]+$ 2 0 0 1 5248 5248 \.php\?id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&type= 2 0 0 1 5249 5249 \?id=([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$ 2 0 0 1 5250 5250 \/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)= 2 0 0 1 5251 5251 Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r) 2 0 0 1 5252 5252 (^|&|\x22|\{\x22)id(=|\x22\x3a\x22)([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(&|\x22|$) 2 0 0 1 5253 5253 ^\{\x22(os|type)\x22\x3a 2 0 0 1 5254 5254 ^[a-z]{15}\.(com|ru|cn|su)$/W 2 0 0 1 5255 5255 ^[a-z]{15}\.(com|ru|cn|su)$/W 2 0 0 1 5256 5256 ^[a-z]{15}\.(com|ru|cn|su)$/W 2 0 0 1 5257 5257 \.php\?m=[abcdefgh]&p1=[a-f0-9]{16}&p2=[^\r\n]+$ 2 0 0 1 5258 5258 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5259 5259 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5260 5260 \.php\?m=[abcdefgh]&p1=[a-f0-9]{16}$ 2 0 0 1 5261 5261 ^[a-z]{15}\.(ru|su|cn)$ 2 0 0 1 5262 5262 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 5263 5263 ^([0-9]{15})$ 2 0 0 1 5264 5264 (\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$ 2 0 0 1 5265 5265 (\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$ 2 0 0 1 5266 5266 ^.{4} 2 0 0 1 5267 5267 ^.{4} 2 0 0 1 5268 5268 ^.{4} 2 0 0 1 5269 5269 ^.{27} 2 0 0 1 5270 5270 ^.{27} 2 0 0 1 5271 5271 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5272 5272 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5273 5273 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5274 5274 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5275 5275 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5276 5276 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5277 5277 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5278 5278 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5279 5279 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5280 5280 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5281 5281 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5282 5282 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5283 5283 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5284 5284 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5285 5285 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5286 5286 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5287 5287 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5288 5288 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5289 5289 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5290 5290 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5291 5291 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5292 5292 ^.{27} 2 0 0 1 5293 5293 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5294 5294 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5295 5295 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5296 5296 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5297 5297 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5298 5298 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5299 5299 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5300 5300 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5301 5301 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5302 5302 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5303 5303 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5304 5304 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5305 5305 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5306 5306 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5307 5307 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5308 5308 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5309 5309 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5310 5310 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5311 5311 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5312 5312 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5313 5313 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5314 5314 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5315 5315 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5316 5316 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5317 5317 ^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74) 2 0 0 1 5318 5318 ^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74) 2 0 0 1 5319 5319 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5320 5320 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5321 5321 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5322 5322 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5323 5323 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5324 5324 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5325 5325 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5326 5326 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5327 5327 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5328 5328 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5329 5329 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5330 5330 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5331 5331 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5332 5332 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5333 5333 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5334 5334 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5335 5335 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5336 5336 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5337 5337 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5338 5338 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5339 5339 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5340 5340 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5341 5341 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5342 5342 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5343 5343 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5344 5344 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5345 5345 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5346 5346 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5347 5347 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5348 5348 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5349 5349 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5350 5350 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5351 5351 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5352 5352 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5353 5353 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5354 5354 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5355 5355 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5356 5356 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5357 5357 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5358 5358 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5359 5359 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5360 5360 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5361 5361 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5362 5362 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5363 5363 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5364 5364 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5365 5365 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5366 5366 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5367 5367 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5368 5368 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5369 5369 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5370 5370 ^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74) 2 0 0 1 5371 5371 ^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74) 2 0 0 1 5372 5372 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5373 5373 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5374 5374 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5375 5375 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5376 5376 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5377 5377 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5378 5378 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5379 5379 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5380 5380 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5381 5381 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5382 5382 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5383 5383 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5384 5384 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5385 5385 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5386 5386 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5387 5387 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5388 5388 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5389 5389 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5390 5390 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5391 5391 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5392 5392 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5393 5393 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5394 5394 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5395 5395 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5396 5396 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5397 5397 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5398 5398 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5399 5399 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5400 5400 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5401 5401 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5402 5402 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5403 5403 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5404 5404 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5405 5405 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5406 5406 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5407 5407 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5408 5408 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5409 5409 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5410 5410 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5411 5411 ^.{4} 2 0 0 1 5412 5412 ^.{4} 2 0 0 1 5413 5413 ^.{4} 2 0 0 1 5414 5414 ^.{4} 2 0 0 1 5415 5415 ^.{4} 2 0 0 1 5416 5416 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5417 5417 ^.{4} 2 0 0 1 5418 5418 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5419 5419 ^.{4} 2 0 0 1 5420 5420 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5421 5421 ^.{4} 2 0 0 1 5422 5422 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5423 5423 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5424 5424 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5425 5425 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5426 5426 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5427 5427 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5428 5428 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5429 5429 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5430 5430 ^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5431 5431 ^.{4} 2 0 0 1 5432 5432 ^.{4} 2 0 0 1 5433 5433 ^.{4} 2 0 0 1 5434 5434 ^.{4} 2 0 0 1 5435 5435 ^.{4} 2 0 0 1 5436 5436 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5437 5437 ^.{4} 2 0 0 1 5438 5438 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5439 5439 ^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f) 2 0 0 1 5440 5440 ^.{4} 2 0 0 1 5441 5441 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5442 5442 ^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74) 2 0 0 1 5443 5443 ^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f) 2 0 0 1 5444 5444 ^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74) 2 0 0 1 5445 5445 ^PRIVMSG\s+[^\s]+\s+\x3a\s*\x01SENDLINK\x7c[^\x7c]{69} 2 0 0 1 5446 5446 ^\s*?\d+?\s*?\)https\x3a\x2f 2 0 0 1 5447 5447 \/tslyphper([A-Za-z0-9+/-_]{4})*([A-Za-z0-9+/-_]{2}==|[A-Za-z0-9+/-_]{3}=|[A-Za-z0-9+/-_]{4})\.html$ 2 0 0 1 5448 5448 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22|\x27 2 0 0 1 5449 5449 \.php$ 2 0 0 1 5450 5450 \.php$ 2 0 0 1 5451 5451 \.php$ 2 0 0 1 5452 5452 \.php\?usernms=[^@]+@[^\r\n]+$ 2 0 0 1 5453 5453 ^\s*\.\s*location\s*\.\s*href\s*=\s*redirect_url 2 0 0 1 5454 5454 ^[a-z0-9_]{50,} 2 0 0 1 5455 5455 ^(www(1\.masterconsultas\.com\.ar|\.linkedin\.com)|(tools\.google|facebook)\.com|cfspart\.impots\.gouv\.fr) 2 0 0 1 5456 5456 ^\s*?\d+?\s*?\)https\/\/[^/]+\.edu\/ 2 0 0 1 5457 5457 ^\s*?\d+?\s*?\)(https://(w(ww(\.((bankofamerica|paypal|ups|wellsfargo)\.com|a(dobecloud\.com|mazon\.co\.jp)|tax\.service\.gov\.uk|cibc\.mobi)|1\.royalbank\.com)|ebmail\.(i(llinois|ndstate)\.ed|optusnet\.com\.a)u)|(s(i(tekey\.bankofamerica|gnin\.ebay)|ecure(\.bankofamerica|05c\.chase))|login\.((microsoftonlin|liv)e|verizonwireless|alibaba)|my\.screenname\.aol)\.com|((ex(change\.(louisvill|purdu)|mail\.oregonstat)e|owa\.uaa\.alaska)\.ed|ib\.nab\.com\.a)u|voscomptesenligne\.labanquepostale\.fr|auth\.centurylink\.net)|/logon/logon/chaseOnline|#www\.kucoin\.com) 2 0 0 1 5458 5458 ^[^/]+(xfinity|comcast)\.(com|net) 2 0 0 1 5459 5459 ^\s*\.\s*style\s*\.\s*visibility\s*=\s*[\x22\x27]visible[\x22\x27] 2 0 0 1 5460 5460 ^["']?post 2 0 0 1 5461 5461 ^((\.php).+)\.php\x22 2 0 0 1 5462 5462 \.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$ 2 0 0 1 5463 5463 \.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or 2 0 0 1 5464 5464 ))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$ 2 0 0 1 5465 5465 \.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils 2 0 0 1 5466 5466 .in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$ 2 0 0 1 5467 5467 ^[^\x22]+<\s*?script\s*?.+data\x3atext/html\x3bbase64, 2 0 0 1 5468 5468 =[A-Za-z0-9._+-]+%40[A-Za-z0-9.-]+\.[A-Za-z]{2,6}&data 2 0 0 1 5469 5469 [A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$ 2 0 0 1 5470 5470 \/usaa\.com(\.|-)(sec(ure)?|inet|ent)(\.|-) 2 0 0 1 5471 5471 ^\s*?\d+?\s*?\)https?\x3a\x2f 2 0 0 1 5472 5472 ^(l(o(ading|gin)|imited)|(proccess|card)ing|b(illing|ank)|success)\.php 2 0 0 1 5473 5473 \x3b[a-f0-9]{32} 2 0 0 1 5474 5474 Content\-Length\x3a\x20\d{3}\x0d\x0a 2 0 0 1 5475 5475 \.asp$ 2 0 0 1 5476 5476 \/[a-f0-9]{32}\/\?\d$ 2 0 0 1 5477 5477 \/[a-f0-9]{32}\/\?\d$ 2 0 0 1 5478 5478 \s*(<var>[^)]+)\s*\).+window\s*\.\s*location\s*=\s*\(\s*(=var) 2 0 0 1 5479 5479 \/webapps\/[a-f0-9]{5}\/websrc 2 0 0 1 5480 5480 \.asp$ 2 0 0 1 5481 5481 (\/mpp\/[0-9a-f]{32}\/|\/[0-9a-f]{32}\/mpp\/) 2 0 0 1 5482 5482 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$ 2 0 0 1 5483 5483 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$ 2 0 0 1 5484 5484 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4} 2 0 0 1 5485 5485 ^[a-z]*?[0-9]{3,9}\.[a-z]{2,4} 2 0 0 1 5486 5486 ^[a-f0-9]{32}\??\x0d\x0a 2 0 0 1 5487 5487 ^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 5488 5488 \/submit$ 2 0 0 1 5489 5489 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 5490 5490 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 5491 5491 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 5492 5492 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 5493 5493 ((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$ 2 0 0 1 5494 5494 (udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$ 2 0 0 1 5495 5495 (udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$ 2 0 0 1 5496 5496 ^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\) 2 0 0 1 5497 5497 ^\d{5,20}\x22/Q 2 0 0 1 5498 5498 ^[^\x22|\x27]+<\s*?script((<\s*?\/\s*?script).)+?data\x3atext\/html\x3b(charset=UTF-8\x3b)?base64\x2c 2 0 0 1 5499 5499 ^[a-z]+\-[a-z]+\-[a-z0-9]{8,11}\.glitch\.me$ 2 0 0 1 5500 5500 ^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4} 2 0 0 1 5501 5501 ^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}$ 2 0 0 1 5502 5502 ^\s*?\(\s*?unescape\s*?\( 2 0 0 1 5503 5503 ^[a-z0-9]{15}\. 2 0 0 1 5504 5504 ^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\) 2 0 0 1 5505 5505 ^ui=[^&]+&pw= 2 0 0 1 5506 5506 ^id=[^&%]+%40[^&]+&pass= 2 0 0 1 5507 5507 ^\s*(\./|\.\./)*(s(e(curity(-check|cvv)|rver|condpage)|uccess)|l(o(ad(ing|er)|g(off))|iamg)|d(e(livery|tails)|one|hl)|i(d(entity)?|ndex2|i)|p(ro(cess(ing)?|file)|hone|ass|in|ayment)|w(e(iter|bsc)|ait)|t(hanky[o0]u|racking)|v(alidate|erify?|bv)|L(oginVerification|L1|2|ogin2)|f(orward|irst|in(al|ish))|b(illing2?|ank)|e(rror|xcel|nd)|questions|1loader|account|recova|confirm|outlook|update(bill|card)?|good|SS|verification|qes|upgrade2?|activation|check(ing)?|ex|indexx|warning|re(name|try))\. 2 0 0 1 5508 5508 ^id=[^&]+&ps= 2 0 0 1 5509 5509 \.(ga|gq|cf|ml|gdn|tk|icu)$ 2 0 0 1 5510 5510 ^mail=[^\x25]+\x2540[^&]+&pass=[^&]+$ 2 0 0 1 5511 5511 ^a=[^\x25]+\x2540[^&]+&b=[^&]+ 2 0 0 1 5512 5512 ^email=[^\x25]+\x2540[^&]+&epass=[^&]+ 2 0 0 1 5513 5513 ^(s)?\x3a\/\/[^\/]*((a(m(ericanexpress|azon)|(dob|ppl)e|libaba|ol)|r(e(gions|max)|bcroyalbank)|f(irst-online|acebook|edex)|m(icrosoft(online)?|atch)|u(s(bank|aa|ps)|ps)|(technologyordi|googl)e|na(twest|ver)|d(ropbox|hl)|yahoo(mail)?|1(26|63)|keybank|qq)\.com|i(n(t(ertekgroup\.org|uit\.com)|vestorjunkie\.com|g\.nl)|c(icibank\.com|scards\.nl)|mpots\.gouv\.fr|rs\.gov)|c((h(ristianmingl|as)e|apitalone(360)?|ibcfcib|panel)\.com|om(mbank\.com\.au|cast\.net)|redit-agricole\.fr)|b(a(nkofamerica\.com|rclays\.co\.uk)|(igpond|t)\.com|luewin\.ch)|o((utlook|ffice)\.com|range\.(co\.uk|fr)|nline\.hmrc\.gov\.uk)|s(((aatchiar|untrus)t|c)\.com|ecure\.lcl\.fr|parkasse\.de)|h(a(lifax(-online)?\.co\.uk|waiiantel\.net)|otmail\.com)|p((rimelocation|aypal)\.com|ostbank\.de)|l(i(nkedin|ve)\.com|abanquepostale\.fr)|we(llsfargo\.com|stpac\.co\.nz)|etisalat\.ae)\/? 2 0 0 1 5514 5514 ^ud=[^&]*&pd=[^&]* 2 0 0 1 5515 5515 ^uname=[^&]+&psw= 2 0 0 1 5516 5516 =[a-f0-9]{32}&session=[a-f0-9]{40}$ 2 0 0 1 5517 5517 ^password=[^&]*&submit=Next$ 2 0 0 1 5518 5518 \?rid=[a-f0-9]{64}$ 2 0 0 1 5519 5519 \?rid=[a-f0-9]{64}\x0d\x0a 2 0 0 1 5520 5520 \x0d\x0aReferer\x3a\x20[^\r\n]+[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\r\n 2 0 0 1 5521 5521 \/\?email=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}\x0d\x0a 2 0 0 1 5522 5522 ^Editbox1=[^%]+(@|%40)[^&]+& 2 0 0 1 5523 5523 ^EM=[^%]+(@|%40)[^&]+& 2 0 0 1 5524 5524 ^e=[^%]+(@|%40)[^&]+& 2 0 0 1 5525 5525 \.(tk|gq|ga|xyz|ml|cf)$ 2 0 0 1 5526 5526 ^userid=[^&]*&passid=[^&]*&Token=$ 2 0 0 1 5527 5527 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5528 5528 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5529 5529 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5530 5530 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5531 5531 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5532 5532 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5533 5533 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5534 5534 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5535 5535 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5536 5536 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5537 5537 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5538 5538 ^[^\r\n]+(s(e(rvic|cur)e|c(otia|ure)|antander|ign\-?in|napchat)|c(h(eck(out)?|a(in|se))|ustomer|onfirm|loud)|p(ay(pa[il]|ment)|(hon|ost)e|rivacy)|i(n(terac|sta)|cloud|phone|tunes)|re(solution|covery|fund|port|dir)|a(pp(id|le)|ccount|mazon)|n(otification|etflix|terac)|l(o(cked|gin)|imited)|(etransf|twitt|ord)er|d(ocusign|ropbox)|f(acebook|orgot)|veri(tas|f)|upd(ate|t)|yahoo|bofa|hmrc) 2 0 0 1 5539 5539 ^(s)?\x3a\/\/[^\/]*(ebay\.co\.uk|singtel\.com|blockchain\.com)\/? 2 0 0 1 5540 5540 ^(s)?\x3a\/\/[^\/]*(s(ocietegenerale\.com|parkasse\.at|ina\.com\.cn|wisscom\.ch|ec\.gov)|b(bva(compass\.com|\.com\.co)|anque-accord\.fr|mo\.com)|g(o((ogle\.co|v)\.uk|daddy\.com)|mail\.com)|(z(illow|oosk)|images\.kw|office365)\.com|t(el(stra\.com\.au|ekom\.com)|-online\.de)|c(reditmutuel\.fr|panel\.net|iti\.com)|((realestate|nab)\.com\.a|unc\.ed)u|d(esjardins\.c(om|a)|iscover\.com)|e(arthlink\.net|ftel\.com\.au|bay\.de)|a(bl\.com\.pk|liyun\.com|nz\.co\.nz)|w(estpac\.com\.au|ikimedia\.org)|v(isaeurope\.ch|erizon\.net)|h(blibank\.com\.pk|sbc\.com)|paypal\.co\.uk)\/? 2 0 0 1 5541 5541 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5542 5542 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5543 5543 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5544 5544 ^POST\x20(?<var>[^\x20]+).+Referer\x3a\x20[^\r\n]+(=var)[\r\n]+ 2 0 0 1 5545 5545 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5546 5546 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5547 5547 ^s?\x3a\/\/[^\/]*(goo(gle(\.(c(om\.[en]g|a)|r[ou])|apps\.com)|\.gl)|c(iovaccocapital\.com|entrin\.net\.id|artasi\.it)|s((antander\.com\.b|fr\.f)r|tandardbank\.co\.za)|(aliexpress|vanguard|tdbank|ibm)\.com|e(xperienceasb\.co\.nz|im\.ae)|n((avy)?fcu\.org|wolb\.com)|unicredit\.it|mbna\.co\.uk|oney\.fr|zkb\.ch)\/? 2 0 0 1 5548 5548 ^[a-z]{36,38}\-dot\-[a-z]+\-[a-z]+\-\d{6}\.[a-z]{2}\.[a-z]\.appspot\.com$ 2 0 0 1 5549 5549 ^[a-f0-9]{32}(\/index\.php)?\x0d\x0a 2 0 0 1 5550 5550 ^[^\r\n]+\.edu 2 0 0 1 5551 5551 ^(s)?\x3a\/\/[^\/]*((t(dcanadatrust|escobank|radekey)|r(ealtyexecutive|bcd)s|x(finity|oom)|ourtime)\.com|a(s(perasoft\.com|b\.co\.nz)|(ccesbankplc|nz)\.com|mazon\.co\.uk|ruba\.it)|m((icrosoftstore|organstanley|sn)\.com|a(de-in-china\.com|il\.ru))|s((eniorpeoplemeet|cotiabank)\.com|antander\.co\.uk|uddenlink\.net)|c(o((ldwellbankerpreviews|x)\.com|mpresso\.co\.th)|fapubs\.org)|w(e(althmanagement\.com|bmail\.sfr\.fr)|ww-01\.ibm\.com)|l((endingtree|loydsbank)\.com|abanquepostale\.mobi)|v((aluewalk|ideotron)\.com|erifyemailaddress\.org)|n(a(tionwide\.co\.uk|vyfederal\.org)|etsuite\.com)|b(a(nquepopulaire\.fr|9hus\.in)|iztree\.com)|i(nternetbanking\.caixa\.gov\.br|cloud\.com)|d(iscoverbank\.com|hl\.co\.uk)|k(iwibank\.co\.nz|eybank\.com)|fidelitybank\.ng|paypal\.fr|ebay\.it)\/? 2 0 0 1 5552 5552 ^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc) 2 0 0 1 5553 5553 ^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc) 2 0 0 1 5554 5554 <title>\s*(log\s*in|sign\s*in) 2 0 0 1 5555 5555 <title>\s*(s(e(nd money, pay online or set up a merchant|cure) account|uspicious (transaction |activities))|con(firm card security information|to limitato)|(profile updat|mot de pass)e|login)\s*-\s*paypal\s*<\/title> 2 0 0 1 5556 5556 ^\/v0\/b\/(send|hit|few|lik|mtn|eli|rfda)\d.*\.appspot\.com\/ 2 0 0 1 5557 5557 ^em=[^&]*&ps=[^&]*$ 2 0 0 1 5558 5558 https\/\/[^/]+\.edu 2 0 0 1 5559 5559 ^[a-z0-9]{24,28}\.php\?client_id= 2 0 0 1 5560 5560 \.php\?template=[^\r\n]+&valid=[^\r\n]+&session=[a-f0-9]{32,}$ 2 0 0 1 5561 5561 ^uname=[^&]*&pass 2 0 0 1 5562 5562 ^emid=[^&]*&epass 2 0 0 1 5563 5563 (verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}tiktok(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}(\.ml|\.ga|\.cf|\.gq|\.tk|\.xyz$) 2 0 0 1 5564 5564 ^[a-f0-9]{42}\.js\x27\x29\.then\x28(.{1,1000}themes\/js\/[a-f0-9]{42}\.js\x27\x29\.then\x28){5,} 2 0 0 1 5565 5565 \w{1,255}\/\w{1,255}'\]\s*==\s*"\w{1,255}\" 2 0 0 1 5566 5566 ^[a-f0-9]{42}\.css\x27\x29\.then\x28(.{1,1000}themes\/css\/[a-f0-9]{42}\.css\x27\x29\.then\x28){5,} 2 0 0 1 5567 5567 [\w\d]{8}\. 2 0 0 1 5568 5568 [\w\d]{8} 2 0 0 1 5569 5569 \.(jpe?g|png|svg)$ 2 0 0 1 5570 5570 \.(css|ttf|woff2?|js)$ 2 0 0 1 5571 5571 ^[a-f0-9]{8}-([a-f0-9]{4}-){3}a-f0-9]{12} 2 0 0 1 5572 5572 [a-z0-9]{32} 2 0 0 1 5573 5573 ^\s*?\.\s*?Ctr\s*?\.\s*?decrypt 2 0 0 1 5574 5574 ^\s*?\.\s*?Ctr\s*?\.\s*?decrypt 2 0 0 1 5575 5575 \.php\?e=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$ 2 0 0 1 5576 5576 ^1=[^%]+(@|%40)[^&]+& 2 0 0 1 5577 5577 ^username=[^%]+(@|%40)[^&]+& 2 0 0 1 5578 5578 ^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash) 2 0 0 1 5579 5579 \.php 2 0 0 1 5580 5580 ^([^0-9][a-zA-Z0-9_]{1,254}),\s*([^0-9][a-zA-Z0-9_$]{1,254}),\s*256\)\x3b 2 0 0 1 5581 5581 \/nrp=[a-f0-9]{32}$ 2 0 0 1 5582 5582 \/nrp=[a-f0-9]{32}$ 2 0 0 1 5583 5583 nrp=[a-f0-9]{32} 2 0 0 1 5584 5584 (outlook|helpdesk|help desk) 2 0 0 1 5585 5585 Set-Cookie\x3a\x20[a-z0-9]{4}=\x22\x22\x3b 2 0 0 1 5586 5586 ^/?username=[a-zA-Z0-9.-]+@[a-zA-Z0-9.]+.[a-zA-Z]{2,3}$ 2 0 0 1 5587 5587 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$ 2 0 0 1 5588 5588 [a-f0-9]{8}. 2 0 0 1 5589 5589 [a-f0-9]{8}. 2 0 0 1 5590 5590 [a-f0-9]{8}. 2 0 0 1 5591 5591 [a-f0-9]{8}. 2 0 0 1 5592 5592 [a-f0-9]{8}. 2 0 0 1 5593 5593 [a-f0-9]{8}. 2 0 0 1 5594 5594 [a-f0-9]{8}. 2 0 0 1 5595 5595 [a-f0-9]{8}. 2 0 0 1 5596 5596 [a-f0-9]{8}. 2 0 0 1 5597 5597 [a-f0-9]{8}. 2 0 0 1 5598 5598 [a-f0-9]{8}. 2 0 0 1 5599 5599 &a_failed=[01]$ 2 0 0 1 5600 5600 &a_failed=[01]$ 2 0 0 1 5601 5601 ^[0-9]{3,4} 2 0 0 1 5602 5602 ^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\. 2 0 0 1 5603 5603 ^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\. 2 0 0 1 5604 5604 ^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\. 2 0 0 1 5605 5605 ^(php|html)$ 2 0 0 1 5606 5606 ^(php|html)$ 2 0 0 1 5607 5607 (6011|5[1-5]\d{2}|4\d{3}|3\d{3}) \d{4} \d{4} \d{4} 2 0 0 1 5608 5608 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})-\d{4}-\d{4}-\d{4} 2 0 0 1 5609 5609 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{12} 2 0 0 1 5610 5610 (3[4|7]\d{2}|2014|2149|2131|1800)\d{11} 2 0 0 1 5611 5611 (3[4|7]\d{2}|2014|2149|2131|1800) \d{4} \d{4} \d{3} 2 0 0 1 5612 5612 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{4}-\d{4}-\d{3} 2 0 0 1 5613 5613 (30[0-5]\d|36\d{2}|38\d{2})\d{10} 2 0 0 1 5614 5614 (30[0-5]\d|36\d{2}|38\d{2}) \d{4} \d{4} \d{2} 2 0 0 1 5615 5615 (30[0-5]\d|36\d{2}|38\d{2})-\d{4}-\d{4}-\d{2} 2 0 0 1 5616 5616 (3[4|7]\d{2}|2014|2149|2131|1800) \d{6} \d{5} 2 0 0 1 5617 5617 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{6}-\d{5} 2 0 0 1 5618 5618 filename=\s*[^\n]+\.exe 2 0 0 1 5619 5619 \d\d-\d{7} 2 0 0 1 5620 5620 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])-\d{2}-\d{4} 2 0 0 1 5621 5621 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2]) \d{2} \d{4} 2 0 0 1 5622 5622 SSN ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 2 0 0 1 5623 5623 SSN# ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 2 0 0 1 5624 5624 User-Agent\x3a[^\n]+McAfee AutoUpdate 2 0 0 1 5625 5625 User-Agent\x3a[^\n]+Winamp/Hi 2 0 0 1 5626 5626 (gif|car(d|tao)|jpe?g)\.exe$ 2 0 0 1 5627 5627 \.exe$ 2 0 0 1 5628 5628 User-Agent\x3a[^\n]+Windows-Update-Agent 2 0 0 1 5629 5629 ((\?|&))password=(&) 2 0 0 1 5630 5630 ((\?|&))passwd=(&) 2 0 0 1 5631 5631 ((\?|&))pass=(&) 2 0 0 1 5632 5632 ((\?|&))pwd=(&) 2 0 0 1 5633 5633 ((\?|&))pw=(&) 2 0 0 1 5634 5634 ((\?|&))passphrase=(&) 2 0 0 1 5635 5635 ((\?|&))pword=(&) 2 0 0 1 5636 5636 \x3C\x3C[^>]*\x2FJavaScript 2 0 0 1 5637 5637 Location\: (http\:\/\/)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/ 2 0 0 1 5638 5638 \.png$ 2 0 0 1 5639 5639 \.jpeg$ 2 0 0 1 5640 5640 \.bmp$ 2 0 0 1 5641 5641 ^User-Agent\:[^\n]+Java\/\d\.\d/Hmi 2 0 0 1 5642 5642 ^Content-Type\x3a\s*([av])(video\/x\-ms\-(w[vm]x|asf)|a(udio\/x\-ms\-w(m[av]|ax)|pplication\/x\-ms\-wm[zd]))/Hi 2 0 0 1 5643 5643 \.exe\b 2 0 0 1 5644 5644 ^(ANONYMOUS|PASSDSS-3DES-1)\r\n 2 0 0 1 5645 5645 ((\x0d|\x05)Admin(istrator)?|\x04root|\x06USERID) 2 0 0 1 5646 5646 ^[^/s]*(eth_(g(et(B(lock(TransactionCountBy(Number|Hash)|By(Number|Hash))|alance)|Transaction(By(Block(Number|Hash)AndIndex|Hash)|(Receip|Coun)t)|Uncle(ByBlock(Number|Hash)AndIndex|CountByBlock(Number|Hash))|(Filter(Change|Log)|Log)s|Co(mpilers|de)|StorageAt|Work)|asPrice)|((new(PendingTransaction|Block)?|uninstall)Filt|blockNumb)er|s((end(Raw)?Transactio|ig)n|ubmit(Hashrate|Work)|yncing)|c(o(mpile(S(olidity|erpent)|LLL)|inbase)|all)|(estimateGa|account)s|protocolVersion|hashrate|mining)|shh_(new(Identity|Filter|Group)|get(FilterChan|Messa)ges|uninstallFilter|hasIdentity|addToGroup|version|post)|db_(get(String|Hex)|put(String|Hex))|net_(listening|peerCount|version)|web3_(clientVersion|sha3)) 2 0 0 1 5647 5647 \x3C\x3C[^>]*\x2FEmbeddedFile 2 0 0 1 5648 5648 &|#|\+|! 2 0 0 1 5649 5649 [0-9a-f]{40}[^0-9a-f]/P 2 0 0 1 5650 5650 ^.\x04[^\x08\x10\x14\x20\x30\x40] 2 0 0 1 5651 5651 ^[\x80-\xff] 2 0 0 1 5652 5652 ^[67]\.[01235] 2 0 0 1 5653 5653 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$ 2 0 0 1 5654 5654 ^\d\d?\.\d 2 0 0 1 5655 5655 OS 4_2_[0-9] like 2 0 0 1 5656 5656 \/\?v=\d 2 0 0 1 5657 5657 ^\d+\.\d 2 0 0 1 5658 5658 ((command(statu)?|bookmark|shortcut)s|h(omepage|istory)|eula(status)?|installation|activate|dumplog) 2 0 0 1 5659 5659 ^(\x3a\d{1,5})?$ 2 0 0 1 5660 5660 ^(\x3a\d{1,5})?$ 2 0 0 1 5661 5661 filename\x3d[\x27\x22][a-z0-9]{1,3}\x2Eexe 2 0 0 1 5662 5662 select[^\r\n]+from 2 0 0 1 5663 5663 \x26Phone(Number\x3D|\x5FNumber\x3D|\x2DNumber\x3D) 2 0 0 1 5664 5664 ^(\x3a\d{1,5})?$ 2 0 0 1 5665 5665 ^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]\x7d 2 0 0 1 5666 5666 User-Agent|3a|[^\n]+Windows-Update-Agent/Hsmi 2 0 0 1 5667 5667 \x0d\x0aContent-Length\x3a \d{0,6}\x0d\x0a 2 0 0 1 5668 5668 ^(sh|lu|to) 2 0 0 1 5669 5669 ^(\x3a\d{1,5})?$ 2 0 0 1 5670 5670 [0-9a-f]{40}[^0-9a-f] 2 0 0 1 5671 5671 ^[^\r\n]+showip\.[a-z]+(\x3a\d{1,5})?$ 2 0 0 1 5672 5672 ^(\x3a\d{1,5})?$ 2 0 0 1 5673 5673 ^[a-z0-9\-\.]{1,60}\.dns-report\.com$ 2 0 0 1 5674 5674 ^\/(text|json|xml)?$ 2 0 0 1 5675 5675 ^\/changelog\/(appversion|changelog|help)$ 2 0 0 1 5676 5676 \d/\d+.jpg 2 0 0 1 5677 5677 ^(com|io|host) 2 0 0 1 5678 5678 ^[A-Z]=([A-Za-z0-9+/])+=?$ 2 0 0 1 5679 5679 ^[0-9]{18}\/[0-9]{18}\/[a-zA-Z0-9]{5,7}$ 2 0 0 1 5680 5680 [A-F0-9]{96}$ 2 0 0 1 5681 5681 ^CN=www\.[0-9a-z]{8,20}\.net$ 2 0 0 1 5682 5682 ^(\x01|\x02)(\x4b|\x4c|\x4d) 2 0 0 1 5683 5683 ^[A-Za-z0-9+\/]{50,}={0,2} HTTP\/ 2 0 0 1 5684 5684 CN=([^\r\n\,]+?[\.-])?app\d 2 0 0 1 5685 5685 ^[a-z0-9]{40,} 2 0 0 1 5686 5686 OS 4_2_[0-9] like 2 0 0 1 5687 5687 ^AUTH\s[^\n]{50} 2 0 0 1 5688 5688 ^LIST\s[^\n]{10} 2 0 0 1 5689 5689 ^XTND\s[^\n]{50} 2 0 0 1 5690 5690 ^APOP\s[^\n]{256} 2 0 0 1 5691 5691 ^PASS\s[^\n]{50} 2 0 0 1 5692 5692 ^USER\s+[^\n]*?% 2 0 0 1 5693 5693 ^UIDL\s+-\d 2 0 0 1 5694 5694 ^DELE\s+-\d 2 0 0 1 5695 5695 ^RSET\s[^\n]{10} 2 0 0 1 5696 5696 ^DELE\s[^\n]{10} 2 0 0 1 5697 5697 ^STAT\s[^\n]{10} 2 0 0 1 5698 5698 ^TOP\s[^\n]{10} 2 0 0 1 5699 5699 ^CAPA\s[^\n]{10} 2 0 0 1 5700 5700 ^APOP\s+USER\s[^\n]{256} 2 0 0 1 5701 5701 ^PASS\s+[^\n]*?% 2 0 0 1 5702 5702 ^USER\s[^\n]{50} 2 0 0 1 5703 5703 \x64\x12\x54\x6a[\x20\x10\x02]\x00\x00\x00\xf4\x1f\x00\x00 2 0 0 1 5704 5704 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D25FCAFC-F795-4609-89BB-5F78B4ACAF2C 2 0 0 1 5705 5705 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BD9E5104-2F20-4A9F-AB14-82D558FF374E 2 0 0 1 5706 5706 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9 2 0 0 1 5707 5707 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9 2 0 0 1 5708 5708 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9 2 0 0 1 5709 5709 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2 2 0 0 1 5710 5710 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2 2 0 0 1 5711 5711 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3310FA24-A027-47B3-8C49-1091077317E9 2 0 0 1 5712 5712 ^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*?083B40D3-CCBA-11D2-AFE0-00C04F7993D6 2 0 0 1 5713 5713 ^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*083B40D3-CCBA-11D2-AFE0-00C04F7993D6 2 0 0 1 5714 5714 ^PASS\s+PRO(-|\s)*search\s+Crawler 2 0 0 1 5715 5715 ^\x2f 2 0 0 1 5716 5716 ^Authorization\x3a\s*Basic\s+YWRtaW46cGFzc3dvcmQ/Hi 2 0 0 1 5717 5717 \x20AND\x20[0-9]{6}\x3D[0-9]{4} 2 0 0 1 5718 5718 Range\x3a\s?bytes=[-0-9,\x20]{100}/iH 2 0 0 1 5719 5719 530\s+(Login|User|Failed|Not) 2 0 0 1 5720 5720 ^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/ 2 0 0 1 5721 5721 ^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/ 2 0 0 1 5722 5722 Arachni\/v?\d\.\d\.\d$ 2 0 0 1 5723 5723 User-Agent\:[^\n]+WHCC 2 0 0 1 5724 5724 ^.+\x3a\s(test.)?C\:\/WINDOWS\/system32\/calc\.exe(.test)?\r$ 2 0 0 1 5725 5725 \x2Frandom\w+?\x2E(c(f[cm]|gi)|ht(ml?|r)|(ws|x)dl|a(sp|xd)|p(hp3|l)|bat|swf|vbs|do) 2 0 0 1 5726 5726 ^DEMONS((\/|\s)[0-9]\.0)?$ 2 0 0 1 5727 5727 ^Hakai((\/|\s)[0-9]\.0)?$ 2 0 0 1 5728 5728 ^Messiah((\/|\s)[0-9]\.0)?$ 2 0 0 1 5729 5729 ^Liquor((\/|\s)[0-9]\.0)?$ 2 0 0 1 5730 5730 ^Nija((\/|\s)[0-9]\.0)?$ 2 0 0 1 5731 5731 ^Gemini((\/|\s)[0-9]\.0)?$ 2 0 0 1 5732 5732 ^Sector((\/|\s)[0-9]\.0)?$ 2 0 0 1 5733 5733 ^Kayla((\/|\s)[0-9]\.0)?$ 2 0 0 1 5734 5734 ^OSIRIS((\/|\s)[0-9]\.0)?$ 2 0 0 1 5735 5735 ^Hello, World((\/|\s)[0-9]\.0)?$ 2 0 0 1 5736 5736 (%U([0-9a-f]{2})){6} 2 0 0 1 5737 5737 (%U([0-9a-f]{4})){6} 2 0 0 1 5738 5738 writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2} 2 0 0 1 5739 5739 \x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4} 2 0 0 1 5740 5740 var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x25u[a-f,0-9]{2,4}\x25u[a-f,0-9]{2,4} 2 0 0 1 5741 5741 var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4} 2 0 0 1 5742 5742 \x220\x22\x20\x2B\x20\x22[a-d]\x22\x20\x2B\x20\x22 2 0 0 1 5743 5743 \x7Cu0[a-d](\x7Cu0|0)[a-d]/\x7Cu0[a-d](\x7Cu0|0)[a-d] 2 0 0 1 5744 5744 \x5Cu0[a-d](\x5Cu0|0)[a-d]/\x5Cu0[a-d](\x5Cu0|0)[a-d] 2 0 0 1 5745 5745 var\x20[^\n\r]*\x3D[^\n\r]*heap\x2E 2 0 0 1 5746 5746 u0[a-d]u0[a-d]u0[a-d]u0[a-d] 2 0 0 1 5747 5747 u0[a-d]0[a-d]u0[a-d]0[a-d] 2 0 0 1 5748 5748 unescape.+\x25u[0-9,a-f]{2,4}\x25u[0-9,a-f]{2,4} 2 0 0 1 5749 5749 unescape\x28(\x22|\x27)\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2} 2 0 0 1 5750 5750 ^[a-f0-9]{4} 2 0 0 1 5751 5751 ^[a-f0-9]{4} 2 0 0 1 5752 5752 filename\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s] 2 0 0 1 5753 5753 ^expn\s+\*@ 2 0 0 1 5754 5754 ^expn\s+decode 2 0 0 1 5755 5755 ^expn\s+root 2 0 0 1 5756 5756 ^vrfy\s+decode 2 0 0 1 5757 5757 ^vrfy\s+root 2 0 0 1 5758 5758 ^RCPT TO\x3a\s[^\n]{300} 2 0 0 1 5759 5759 ^EXPN[^\n]{255} 2 0 0 1 5760 5760 ^[A-Za-z0-9\/\+\x0D\x0A]+?(LnBpZ|5waW|ucGlm) 2 0 0 1 5761 5761 ^(<boundary>[\x20\x27-\x29\x2b-\x2f0-9\x3a\x3d\x3fA-Z\x5fa-z]{0,69}?[^\x2d])--(\x0d\x0a(--|\x2e|RSET)[^\r\n]*?)*\x0d\x0a--(=boundary)\x0d\x0a 2 0 0 1 5762 5762 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*package_prefix[\r\n\s]*=>[\r\n\s]*|package_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*procedure_prefix[\r\n\s]*=>[\r\n\s]*|procedure_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5763 5763 TO_CHAR\s*\(\s*SYSTIMESTAMP\s*,\s*(\x27[^\x27]{256}|\x22[^\x22]{256}) 2 0 0 1 5764 5764 CREATE\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512}) 2 0 0 1 5765 5765 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\d+\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5766 5766 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5767 5767 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})) 2 0 0 1 5768 5768 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{128,}\x27|\x22[^\x22]{128,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})|\(\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})) 2 0 0 1 5769 5769 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5770 5770 numtoyminterval\s*\(\s*\d+\s*,\s*(\x27[^\x27]{32}|\x22[^\x22]{32}) 2 0 0 1 5771 5771 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*qt_name[\r\n\s]*=>[\r\n\s]*|qt_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5772 5772 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5773 5773 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5774 5774 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5775 5775 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*destination[\r\n\s]*=>[\r\n\s]*|destination\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5776 5776 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*dblink[\r\n\s]*=>[\r\n\s]*|dblink\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5777 5777 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5778 5778 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5779 5779 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5780 5780 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5781 5781 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5782 5782 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5783 5783 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5784 5784 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5785 5785 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5786 5786 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5787 5787 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5788 5788 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5789 5789 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5790 5790 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5791 5791 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5792 5792 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5793 5793 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5794 5794 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5795 5795 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5796 5796 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5797 5797 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5798 5798 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5799 5799 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5800 5800 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5801 5801 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5802 5802 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5803 5803 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5804 5804 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5805 5805 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5806 5806 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5807 5807 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5808 5808 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5809 5809 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5810 5810 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5811 5811 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5812 5812 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5813 5813 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5814 5814 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5815 5815 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5816 5816 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5817 5817 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5818 5818 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5819 5819 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5820 5820 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5821 5821 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5822 5822 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5823 5823 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5824 5824 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5825 5825 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5826 5826 \(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}) 2 0 0 1 5827 5827 (\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5828 5828 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5829 5829 (\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5830 5830 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5831 5831 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5832 5832 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5833 5833 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5834 5834 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5835 5835 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5836 5836 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5837 5837 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5838 5838 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5839 5839 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5840 5840 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5841 5841 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5842 5842 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5843 5843 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5844 5844 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5845 5845 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5846 5846 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5847 5847 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5848 5848 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5849 5849 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*SCHEMA_NAME[\r\n\s]*=>[\r\n\s]*|SCHEMA_NAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5850 5850 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5851 5851 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5852 5852 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5853 5853 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5854 5854 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5855 5855 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5856 5856 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5857 5857 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5858 5858 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5859 5859 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5860 5860 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5861 5861 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5862 5862 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5863 5863 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5864 5864 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5865 5865 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5866 5866 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5867 5867 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5868 5868 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5869 5869 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5870 5870 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5871 5871 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5872 5872 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5873 5873 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5874 5874 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5875 5875 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5876 5876 (\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5877 5877 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*CANON_GNAME[\r\n\s]*=>[\r\n\s]*|CANON_GNAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5878 5878 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5879 5879 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*tst[\r\n\s]*=>[\r\n\s]*|tst\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*\d+\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5880 5880 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*repgrpname[\r\n\s]*=>[\r\n\s]*|repgrpname\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})) 2 0 0 1 5881 5881 \(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}) 2 0 0 1 5882 5882 TIME_ZONE\s*=\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,})) 2 0 0 1 5883 5883 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5884 5884 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5885 5885 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22 ]{1000}))) 2 0 0 1 5886 5886 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5887 5887 \(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){4}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))) 2 0 0 1 5888 5888 \((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5889 5889 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))) 2 0 0 1 5890 5890 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5891 5891 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5892 5892 \(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))) 2 0 0 1 5893 5893 \((\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))) 2 0 0 1 5894 5894 \(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))) 2 0 0 1 5895 5895 \(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,(\s*(true|false)\s*,\s*){3}((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5896 5896 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5897 5897 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5898 5898 \((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5899 5899 \(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5900 5900 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5901 5901 \(\s*TIMESTAMP\s*(\s*(\x27[^\x27]+'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5902 5902 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5903 5903 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5904 5904 \(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})) 2 0 0 1 5905 5905 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5906 5906 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5907 5907 ALTER\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512}) 2 0 0 1 5908 5908 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5909 5909 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5910 5910 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5911 5911 \(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}) 2 0 0 1 5912 5912 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5913 5913 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5914 5914 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5915 5915 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5916 5916 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5917 5917 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){10}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5918 5918 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){8}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5919 5919 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5920 5920 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5921 5921 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5922 5922 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5923 5923 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5924 5924 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5925 5925 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5926 5926 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5927 5927 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5928 5928 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5929 5929 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5930 5930 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5931 5931 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5932 5932 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5933 5933 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5934 5934 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5935 5935 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5936 5936 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5937 5937 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5938 5938 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5939 5939 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5940 5940 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5941 5941 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5942 5942 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5943 5943 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5944 5944 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5945 5945 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5946 5946 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5947 5947 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5948 5948 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5949 5949 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5950 5950 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5951 5951 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gowner|gname)[\r\n\s]*=>[\r\n\s]*|(gowner|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5952 5952 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5953 5953 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5954 5954 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5955 5955 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5956 5956 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5957 5957 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5958 5958 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5959 5959 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5960 5960 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5961 5961 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5962 5962 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*fname[\r\n\s]*=>[\r\n\s]*|fname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5963 5963 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5964 5964 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname)[\r\n\s]*=>[\r\n\s]*|(gname|fname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5965 5965 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5966 5966 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5967 5967 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5968 5968 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5969 5969 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5970 5970 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5971 5971 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5972 5972 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5973 5973 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5974 5974 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5975 5975 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5976 5976 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 5977 5977 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5978 5978 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5979 5979 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5980 5980 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5981 5981 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5982 5982 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5983 5983 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5984 5984 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5985 5985 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5986 5986 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5987 5987 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5988 5988 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5989 5989 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5990 5990 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5991 5991 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5992 5992 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5993 5993 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5994 5994 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5995 5995 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5996 5996 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5997 5997 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5998 5998 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 5999 5999 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6000 6000 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6001 6001 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6002 6002 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6003 6003 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6004 6004 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6005 6005 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6006 6006 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6007 6007 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6008 6008 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6009 6009 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6010 6010 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6011 6011 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6012 6012 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6013 6013 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6014 6014 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6015 6015 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6016 6016 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6017 6017 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6018 6018 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6019 6019 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6020 6020 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6021 6021 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1073,}\x27|\x22[^\x22]{1073,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,})|\(\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,})) 2 0 0 1 6022 6022 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6023 6023 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6024 6024 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6025 6025 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6026 6026 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6027 6027 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6028 6028 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6029 6029 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6030 6030 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6031 6031 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6032 6032 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(object_type|user_name)[\r\n\s]*=>[\r\n\s]*|(object_type|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6033 6033 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6034 6034 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6035 6035 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})) 2 0 0 1 6036 6036 \(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}) 2 0 0 1 6037 6037 \(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}) 2 0 0 1 6038 6038 \(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}) 2 0 0 1 6039 6039 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6040 6040 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6041 6041 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6042 6042 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6043 6043 ((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})) 2 0 0 1 6044 6044 username=[^&\x3b\r\n]{250} 2 0 0 1 6045 6045 ^(\r\n)* 2 0 0 1 6046 6046 ^User-Agent\:[^\n]+WHCC/Hmi 2 0 0 1 6047 6047 User-Agent\:[^\n]+http\:\/\/ 2 0 0 1 6048 6048 \(compatible[^\)]+\n 2 0 0 1 6049 6049 User-Agent\:[^\n]+sgrunt/Hi 2 0 0 1 6050 6050 [\/\?][a-z0-9]{60,66}[\;0-9] 2 0 0 1 6051 6051 ^[0-9][0-9]?\.[0-9][0-9]?$ 2 0 0 1 6052 6052 \)ver\d 2 0 0 1 6053 6053 ^\d 2 0 0 1 6054 6054 ^x\w\wx\w\w\!x\w\wx\w\wx\w\w 2 0 0 1 6055 6055 ^Downloader\d+\.\d 2 0 0 1 6056 6056 ^dBrowser\x20\d\x20CallGetResponse\x3a\d$/V 2 0 0 1 6057 6057 00\d+$ 2 0 0 1 6058 6058 \r?\n\r?\n 2 0 0 1 6059 6059 ^a\x3D[^\n]{1000,} 2 0 0 1 6060 6060 ^\/g($|[?#]) 2 0 0 1 6061 6061 (launch\x28.+-J-jar -J|-J-jar -J.+launch\x28) 2 0 0 1 6062 6062 <body\s+[^>]*onUnload\s*=\s*[\x22\x27]?\(\) 2 0 0 1 6063 6063 <img\s+[^>]*onEnd\s*=\s*[\x22\x27]?\(\) 2 0 0 1 6064 6064 <body\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\) 2 0 0 1 6065 6065 <img\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\) 2 0 0 1 6066 6066 <[^>%]*% 2 0 0 1 6067 6067 (((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*vbscript[\:] 2 0 0 1 6068 6068 (((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:] 2 0 0 1 6069 6069 (((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:] 2 0 0 1 6070 6070 (((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:] 2 0 0 1 6071 6071 expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*[\d]+[\s]*,){20} 2 0 0 1 6072 6072 expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*0x[\da-fA-F]+[\s]*,){20} 2 0 0 1 6073 6073 ftp\://[^\' \"]*%0a 2 0 0 1 6074 6074 String\x2EFromCharCode\x28[0-9]{1,3} 2 0 0 1 6075 6075 (window|w)\x2Estop 2 0 0 1 6076 6076 <object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\> 2 0 0 1 6077 6077 <object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\> 2 0 0 1 6078 6078 \x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2} 2 0 0 1 6079 6079 String.fromCharCode|28|[a-z,0-9]{1,20}\x2EcharCodeAt\x28 2 0 0 1 6080 6080 <object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1 6081 6081 src\s*\x3d\s*\x22res\x3a\x2f\x2fmshtml\x2edll 2 0 0 1 6082 6082 stream(\x0D\x0A|\x0A)CWS 2 0 0 1 6083 6083 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^OpenAction](O|#4F)(p|#70)(e|#65)(n|#6E)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E) 2 0 0 1 6084 6084 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JS](J|#4A)(S|#53) 2 0 0 1 6085 6085 \x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^EmbeddedFile](E|#45)(m|#6D)(b|#62)(e|#65)(d|#64)(d|#64)(e|#65)(d#64)(F|#46)(i|#69)(l|#6C)(e|#65) 2 0 0 1 6086 6086 \x3C\x3C[^>]*\x2F[^Type](T|#54)(y|#79)(p|#70)(e|#65) 2 0 0 1 6087 6087 \x3C\x3C[^\n]*\x2F[^Javascript](J|#4A)(a|#61)(v|#76)(a|#61)(S|#73|#53)(c|#63)(r|#72)(i|#69)(p|#70)(t|#74) 2 0 0 1 6088 6088 \x3C\x3C[^>]*\x2F[^URL](U|#55)(R|#52)(L|#4C) 2 0 0 1 6089 6089 (\<\;).+(\>\;) 2 0 0 1 6090 6090 (this|doc)\x2EprintSeps 2 0 0 1 6091 6091 ^Content-Type\x3a\s*application\x2fsmi.*?<area[\s\n\r]+href=[\x22\x27]file\x3ajavascript\x3a 2 0 0 1 6092 6092 ^BM 2 0 0 1 6093 6093 IHDR(.*LTE).*?tRNS 2 0 0 1 6094 6094 <OBJECT\s+[^>]*type\s*=[\x22\x27]\x2f{32} 2 0 0 1 6095 6095 (\x5c[^\x5c]{16,}|\x2f[^\x2f]{16,})\.cda$ 2 0 0 1 6096 6096 ^Location\x3a\s*URL\s*\x3a 2 0 0 1 6097 6097 <<[^>]*\x2FU3D\x2FLength\x20172[0-5][0-9]{2} 2 0 0 1 6098 6098 \x2F(Subtype)(S|#53)(u|#75)(b|#62)(t|#74)(y|#79)(p|#70)(e|#65) 2 0 0 1 6099 6099 \x2F(Action)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E) 2 0 0 1 6100 6100 \x2F(Pages)(P|#40)(a|#61)(g|#67)(e|#65)(s|#73) 2 0 0 1 6101 6101 \x2F(Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe 2 0 0 1 6102 6102 code=\"[a-z]\.[a-z][\.\"][ c] 2 0 0 1 6103 6103 \/info.php\?n=\d 2 0 0 1 6104 6104 \/n\.php\?h=\w*?&s=\w{1,5}$ 2 0 0 1 6105 6105 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1 6106 6106 ^\/50a[a-f0-9]{21}\/(((\d+,)+\d+)|null)\/ 2 0 0 1 6107 6107 \/[0-9]{6}\.js\?[0-9]{6}&[0-9a-f]{16}$ 2 0 0 1 6108 6108 ^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script> 2 0 0 1 6109 6109 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1 6110 6110 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1 6111 6111 ^[\r\n\s]*[\r\n\s]*?[\x22\x27]?[a-f0-9]{100} 2 0 0 1 6112 6112 ^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc) 2 0 0 1 6113 6113 ^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc) 2 0 0 1 6114 6114 ^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc) 2 0 0 1 6115 6115 \/(app|info)\.php\?message=[A-Za-z0-9\+\/]+={0,2}$ 2 0 0 1 6116 6116 filename=[^\x3b\x3a\r\n]*(\x2e\x2e|\x25\x32\x65) 2 0 0 1 6117 6117 ^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r$ 2 0 0 1 6118 6118 Host\x3a\x20[a-z]{6}\.best.lt\.ua\r$/Hm 2 0 0 1 6119 6119 ^[\r\n\s]*?[\x22\x27](<sp>[^\x22\x27]+)[\x22\x27].+?eval\([^\)\(]+?\([\x22\x27]\d{2,3}(=sp)\d{2,3}(=sp) 2 0 0 1 6120 6120 \/\?flow_id=\d+?&\d+\d+?\/case_id=\d+$ 2 0 0 1 6121 6121 ^\s+?(<vname>[^\s=]+)\s*\s*?(<q>[\x22\x27])(((=q)).)+?\.exe(=q).+?<applet((<\/applet>).)+?value\s*\s*?(\x22\x27|\x27\x22)\s*?\+\s*?(=vname)\s*?\+\s*?(\x22\x27|\x27\x22) 2 0 0 1 6122 6122 ^\s*?\( 2 0 0 1 6123 6123 \.php\?b=[A-F0-9]{6}&css=[a-z]+$ 2 0 0 1 6124 6124 ^[A-Za-z0-9\+\/]+((LmVvdA=|5lb3Q)=|uZW90)[\x22\x27] 2 0 0 1 6125 6125 Referer\x3a\x20[^\r\n]+?\/1\.html[\x3a\r]/Hi 2 0 0 1 6126 6126 \x3Cvalue\x3D\x22([a-z0-9+/]{4})*([a-z0-9+/]{2}==|[a-z0-9+/]{3}=) 2 0 0 1 6127 6127 ^((<\/script>).)*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]+?\/[a-z0-9A-Z]{8}\.php\?id=\d{6,9}[\x22\x27] 2 0 0 1 6128 6128 ^Host\x3a\x20[^\r\n]+(\r\n)?\r\n$/Hi 2 0 0 1 6129 6129 ^\/assets\/js\/jquery-[0-9]\.[0-9]\.[0-9]\.min\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$ 2 0 0 1 6130 6130 ^\/[0-9]{2,3}x[0-9]{2,3}\/[a-z]+\.php\?[a-z]{2}=[0-9a-z]+$ 2 0 0 1 6131 6131 ^\/js\/metrika\/watch\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$ 2 0 0 1 6132 6132 ^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script> 2 0 0 1 6133 6133 ^((<table>).)+?<tr[\r\n\s\>]((<\/tr>).)*?<span[\r\n\s\>]((<\/span>).)*?<([QU]|S(TR(IKE|ONG)|U[BP]|MALL|AMP)?|B(LINK|DO|IG)?|A(CRONYM|BBR)|R([PT]|UBY)|(NOB|VA)R|C(IT|OD)E|D(EL|FN)|I(NS)?|KBD|EM|TT)[^>]*?\bid[\r\n\s]* 2 0 0 1 6134 6134 ^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script> 2 0 0 1 6135 6135 ^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script> 2 0 0 1 6136 6136 (<e>\d{2})(<t>((=e))\d{2})(=e)\d{2}(=t)\d{6}(=e)\d{12}(<q>(((=e)|(=t)))\d{2})\d{2}(<dot>(((=e)|(=t)|(=q)))\d{2})\d{2}(=dot)\d{2}(=q) 2 0 0 1 6137 6137 ^\d+&w=\d+&ua=.+&e=1$ 2 0 0 1 6138 6138 ^\s*?(<var1>[^\x29\x5b]+)\x5b\s*?(<cntr>[^\x5d]+)\s*?\x5d\s*?\+\s*?(=var1)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*?16\s*?\x29\s*?\^\s*?parseInt\x28\x28\s*?(<var2>[^\x29\x5b]+)\x5b\s*?(=cntr)\s*?\x5d\s*?\+\s*?(=var2)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*16\s*?\x29\x29\s*?\x3b\s*?(=cntr)\s*?\+=\s*?2\s*?\x3b 2 0 0 1 6139 6139 ^(687474703a2f2f)(<h>[a-f0-9]{2})(<t>[a-f0-9]{2})(=t)(<p>[a-f0-9]{2})(<colon>[a-f0-9]{2})(<slash>[a-f0-9]{2})(=slash) 2 0 0 1 6140 6140 ^(25)?20(\x25(25)?20|\s)*reserve 2 0 0 1 6141 6141 \x3C\x3C[^>]*\x2FEmbeddedfile 2 0 0 1 6142 6142 ^\/[a-z]{10}\/[a-z]{10}\.html$ 2 0 0 1 6143 6143 ^[^\x2f\x22]+?\x22> 2 0 0 1 6144 6144 ^\s*?\w+\s*\s*?[\x22\x27]UEsDB 2 0 0 1 6145 6145 ^[^\r\n]+?\.html?\r?$ 2 0 0 1 6146 6146 ^[^\x27]*?2[^\x27]*?7[^\x27]*?c[^\x27]*?d[^\x27]*?b[^\x27]*?6[^\x27]*?e[^\x27]*?-[^\x27]*?a[^\x27]*?e[^\x27]*?6[^\x27]*?d[^\x27]*?-[^\x27]*?1[^\x27]*?1[^\x27]*?c[^\x27]*?f[^\x27]*?-[^\x27]*?9[^\x27]*?6[^\x27]*?b[^\x27]*?8[^\x27]*?-[^\x27]*?4[^\x27]*?4[^\x27]*?4[^\x27]*?5[^\x27]*?5[^\x27]*?3[^\x27]*?5[^\x27]*?4[^\x27]*?0[^\x27]*?0[^\x27]*?0[^\x27]*?0 2 0 0 1 6147 6147 ^([a-z]{0,7}[A-Z])([A-Z]{0,7}[a-z])[A-Za-z]{8}\x22[^>]+[A-Za-z]{70} 2 0 0 1 6148 6148 ^\s*?\(\s*?[\x22\x27]chrome\x3a\/\/ 2 0 0 1 6149 6149 http\x3a -J-jar -J\x5C\x5C\x5C\x5C\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x5C\x5C[^\n]*\.jar 2 0 0 1 6150 6150 ^[a-f0-9]{500} 2 0 0 1 6151 6151 ^[a-f0-9]{500} 2 0 0 1 6152 6152 (obj.data|object.data).+file\x3A\x2F\x2F127\x2E[0-9] 2 0 0 1 6153 6153 ^\/in\/\?_BC=\d+,\d+,\d+,[0-9,-]+,$ 2 0 0 1 6154 6154 \x2A[a-z0-9]{10}\x2A\x2Fwindow\x2Eeval\x28String\x2EfromCharCode\x28[0-9]{1,3}\x2C[0-9]{1,3}\x2C 2 0 0 1 6155 6155 <title>[a-f0-9]{10}<\/title> 2 0 0 1 6156 6156 value=.[a-f0-9]{100} 2 0 0 1 6157 6157 ^\s*\([^\)]*\)\s*\.\s*prototype\s*\.\s*(hasFeature|isPrototypeOf) 2 0 0 1 6158 6158 ^[\x52\x5c\x64\x65\x90\x93] 2 0 0 1 6159 6159 ^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert 2 0 0 1 6160 6160 \x0d\x0aHost\x3a\x20[a-f0-9]{20}-[a-f0-9]{32}\.r[0-9]{1,2}\.cf[0-9]\.rackcdn\.com\x0d\x0a/H 2 0 0 1 6161 6161 document\s*\.\s*location\s*?\x3d\s*?[\x27\x22]help\x3a\/\/\/[^\x3b]+?\%25252f\.\.\%25252f\.\.\%25252f\.\.\%25252f 2 0 0 1 6162 6162 ^Referer\x3a[^\r\n]+\/b.swf\r$/Hm 2 0 0 1 6163 6163 ^\s*?\( 2 0 0 1 6164 6164 ^\s*\.\s*cookie 2 0 0 1 6165 6165 ^\s*\(\s*force\s*\?\s*true\s*\x3a\s*false\s*,\s*\d+\s*,\s*\d+\s*,\s*[\x22\x27][^\x22\x27]+\.exe[\x22\x27] 2 0 0 1 6166 6166 ^(\]|, 3\.3\])\x3b 2 0 0 1 6167 6167 ^\s*?\[\s*?\d 2 0 0 1 6168 6168 ^[\x22\x27+\s]*\/[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[\x22\x27+\s]*> 2 0 0 1 6169 6169 stream(\x0D\x0A|\x0A)FWS 2 0 0 1 6170 6170 ^\s*[^\s]+\x5b\s*?[^\x5d\x7c]+\x7c\s*?0\s*?\x5d\s*?\x7c\s*?0\s*?\x3b 2 0 0 1 6171 6171 \s+?(<var2>[^\s\x3d]+?)\s*\s*?this\.addField.+?(=var2)\s*\x2e\s*setAction\s*?\x28\s*?[\x22\x27]\s*?OnFocus[^\x29]+popupOpen\s*\s*?true 2 0 0 1 6172 6172 (<obj>[^\s]{1,25})\s*=\s*document\s*\.\s*createElement.*?(<func>[^\s]{1,25})\s*=\s*function\s*\x28\s*e\s*\x29\s*{[^}]*this\s*\.\s*style\s*\.\s*cssText.*?(=obj)\s*\.\s*addEventListener\s*\x28\s*[\x22\x27]\s*DOMAttrModified\s*[\x22\x27]\s*\x2c\s*(=func) 2 0 0 1 6173 6173 \.php\?cid=[0-9]+?-w[A-Z0-9]{23}$ 2 0 0 1 6174 6174 &clickid=w[A-Z0-9]{23}$ 2 0 0 1 6175 6175 ^\/scan[A-Z][a-z]?\/?$ 2 0 0 1 6176 6176 ^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\/$ 2 0 0 1 6177 6177 ^\s*?\.\s*?decode\s*?\(\s*?msgencoded\s*?\)\s*?\.\s*?replace 2 0 0 1 6178 6178 ^\s*?\(\s*?[\x22\x27]ip[\x22\x27] 2 0 0 1 6179 6179 &clickid=w[A-Z0-9]{23}$ 2 0 0 1 6180 6180 ^\s*?\{\s*?setInterval\s*?\(\s*?function 2 0 0 1 6181 6181 ^[^\r\n]+autoplay=[\x22\x27]autoplay 2 0 0 1 6182 6182 ^[^\r\n]+autoplay=[\x22\x27]autoplay 2 0 0 1 6183 6183 ^\s*?\(\s*?function\s*?\(\s*?\)\s*?\{\s*?alert\s*?\( 2 0 0 1 6184 6184 ^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert\s*\([\x22\x27]\s*Warning 2 0 0 1 6185 6185 ^\s*\(\s*0\s*,\s*0\s*,\s*total\s*\) 2 0 0 1 6186 6186 \x2E\x2E\x2F\x2E\x2E\x2F.+C\x3A\x5C[a-z] 2 0 0 1 6187 6187 \x3Clocation\x3D.+smb\x3A\x2F\x2F.{1000}.+\x3C\x2Flocation\x3E 2 0 0 1 6188 6188 eval\x28(String\x2EfromCharCode\x28|[a-z,0-9]{1,20}\x28String\x2EfromCharCode\x28) 2 0 0 1 6189 6189 util.printf\x28\x22\x25[^\x2C\x29]*f\x22\x2C 2 0 0 1 6190 6190 <<[^>]*\x2FPredictor[^>]*\x2FColors\x201073741838 2 0 0 1 6191 6191 \x5clistoverride\x5c((\x5cls\d{1,4}\s*\}).)+?\x5clistoverride\x5c 2 0 0 1 6192 6192 ^\s*?\(\s*?[\x22\x27]script[\x22\x27].+?\s(<vname>[^\s]+)\.onpropertychange\s*=.+?\s(<vname2>[^\s\x3d]+)\s*\s*?[^\s]*?createElement\s*?\(\s*?[\x22\x27]select[\x22\x27].+?(=vname)\.appendChild\(\s*?[\x22\x27]?(=vname2)[\x22\x27]? 2 0 0 1 6193 6193 ^.+?\bEMET\.DLL 2 0 0 1 6194 6194 ^\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b(=var)\s*?\<\s*?(0x)?\d{3,4}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b[^\x7d]+?\[\s*?(=var)\s*?\]\s*\s*?document\.createElement\([\x22]div[\x22]\)[^\x7d]+?\[\s*?(=var)\s*?\] 2 0 0 1 6195 6195 ^(0*?[19]\d|[^190]) 2 0 0 1 6196 6196 ^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=CWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27] 2 0 0 1 6197 6197 ^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=FWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27] 2 0 0 1 6198 6198 ^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=ZWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27] 2 0 0 1 6199 6199 ^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text/vbscript[\x22\x27]((<\/script>).)+?\WShellExecute) 2 0 0 1 6200 6200 ^\W 2 0 0 1 6201 6201 ^\s*\s*?(undefined|false|null|-?0|NaN|\x22\x22|\x27\x27) 2 0 0 1 6202 6202 [^.]*\.\s*src\s*\=[\x22\x27][^\x22\x27]*\.php\?[ -~]+?\=[\x22\x27]\s*\+localStorage\. 2 0 0 1 6203 6203 \b(<varname>[^\s\x3d]+)\s*\x3d\s*open\s*\x28\s*[^\x29]+parent-tab:\/\/.+(=varname)\s*\.\s*document\s*\.\s*body\s*.\s*innerHTML\s*= 2 0 0 1 6204 6204 (?<var1>[^=\s]*)\s*=\s*0x1000000.+?\x28\s*\x28\s*\x28\s*\w+\s*<<\s*12\s*\x29\s*\|\s*0\s*\x29\s*\+\s*(=var1)\s*\x29\s*\|\s*0 2 0 0 1 6205 6205 \s*?Default\s+Property((end\s*property).)*?ReDim\s+Preserve\s+array 2 0 0 1 6206 6206 ^\/[a-z]+\.dill\/$ 2 0 0 1 6207 6207 ^[\x22\x27]\s*content\s*=\s*[\x22\x27]\s*IE\s*=\s*10 2 0 0 1 6208 6208 ^[a-z]{2,3}\.dll 2 0 0 1 6209 6209 \/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$ 2 0 0 1 6210 6210 ^\s*\-\s* 2 0 0 1 6211 6211 ^\s*reserve\s*?(<var1>[a-z]\w{0,254})\s*?\x28\s*?[^\x29]+?\x29.*?redim\s*reserve\s*?(=var1) 2 0 0 1 6212 6212 Shell.*%0a\s*IconFile\s*=\s*\x5c\x5c 2 0 0 1 6213 6213 <iframe.*?src.*.*?<\/iframe> 2 0 0 1 6214 6214 <iframe.*?src.*.*?<\/iframe> 2 0 0 1 6215 6215 ^\s*[\x22\x27]\s*file\x3a\x2f\x2f\x2f\x5c\x5c[^\x20]+\x5cC\$\x5c\s*[\x22\x27] 2 0 0 1 6216 6216 ^Referer\x3a[^\r\n]+\.swf/Hmi 2 0 0 1 6217 6217 ^[^>\r\n<]+>[A-Za-z]{70} 2 0 0 1 6218 6218 ^[^\r\n]+?\.html?\r?$/Hmi 2 0 0 1 6219 6219 ^[^\r\n]+\.html\r?$/Hmi 2 0 0 1 6220 6220 ^\s*=\s*\x5c\x5c 2 0 0 1 6221 6221 ^\s*\.\s*cookie 2 0 0 1 6222 6222 ^((<\/script>).)+?powershell\.exe 2 0 0 1 6223 6223 ^((<\/script>).)+?powershell\.exe 2 0 0 1 6224 6224 ^[^\r\n]+\/\?pcl=([a-zA-Z0-9_-]{86}|[a-zA-Z0-9_-]{43})\x2e{1,2}&cid= 2 0 0 1 6225 6225 ^[a-z0-9]{6,15}$ 2 0 0 1 6226 6226 ^https\/\/ 2 0 0 1 6227 6227 ^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4}) 2 0 0 1 6228 6228 ^WWW-Authenticate\x3a\x20Basic\x20realm=[\x22\x27][^\r\n]*Error[^\r\n]*- 2 0 0 1 6229 6229 ^\/[a-z]{7,11}\.js\?[a-f0-9]{16}$ 2 0 0 1 6230 6230 \/([a-zA-Z\d]{0,6}[a-z][A-Z])[A-Za-z\d]{8}\.php\?id=\d{6,9}$ 2 0 0 1 6231 6231 ^((<\/xsl).)+?src\s*=\s*[\x27\x22](<loc>[^\x22\x27]+?)[\x27\x22].+?Content-Location\x3a\s+(=loc) 2 0 0 1 6232 6232 ^[2'][2h'+][2hl'+][2hlY'+][2hlY2'+][2hlY2t'+][2hlY2tv'+][2hlY2tvd'+][2hlY2tvdX'+][2hlY2tvdXQ'+]([2hlY2tvdXQ='+]){1,10} 2 0 0 1 6233 6233 &name=[a-z0-9\x20]+$ 2 0 0 1 6234 6234 ^[A-Z0-9_\-.]{20,300}\x3b 2 0 0 1 6235 6235 ^\s*[a-f0-9]{32}\s*\x2a\x2f 2 0 0 1 6236 6236 [A-Za-z0-9]{10,20}_14[0-9]{8,}\/index\.html$ 2 0 0 1 6237 6237 ^[^\r\n\s>]+\/[a-z]{4,5}\.html\>\<\/iframe\> 2 0 0 1 6238 6238 ^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+ 2 0 0 1 6239 6239 ^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+ 2 0 0 1 6240 6240 ^[A-Z0-9_\-.]{20,300}\x3b 2 0 0 1 6241 6241 <DIV\s*?id[\s\r\n]*?\x3d[\s\r\n]*?(<divid>[^>]+).+?<img\s*id=\s*?\x22(<imgid>[^\x22]+).+?\<a\s*?href=\x22javascript\x3a(<firstfunction>[^\x28]+)\(\).+?\>.*?\<div[^\>]+?id=\x22(=imgid)\x22[^>]+?on[A-Za-z]+?\s*\s*?\x22(<secondfunction>[^\x28]+)\(\)\x3b\s*?\x22.+?function[\s\r\n]*?(=firstfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?(=divid)\x2einnerHTML\s*?\x3d\s*?(=divid)\x2einnerHTML[\s\r\n]*?\x3b.*?\x7d.*?function[\s\r\n]*?(=secondfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?\x28\x22(=imgid)\x22\x29\x2esrc\s*?\x3d 2 0 0 1 6242 6242 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1 6243 6243 (\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\( 2 0 0 1 6244 6244 ^[\r\n\s]*[\x22\x27]selectAll 2 0 0 1 6245 6245 clsid\s*\x3a\s*\x7B?\s*f5078f3(2|3)-c551-11d3-89b9-0000f81fe221 2 0 0 1 6246 6246 ^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\| 2 0 0 1 6247 6247 ^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\| 2 0 0 1 6248 6248 ^[\r\n\s\+\>]((<\/bdo>).)*?<fieldset[\r\n\s\+\>]((<\/fieldset>).)*?<\/bdo> 2 0 0 1 6249 6249 ^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.body.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q) 2 0 0 1 6250 6250 ^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(function)(<func>[^\r\n\s]+)\b.+?function[\r\n\s]+(=func)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\) 2 0 0 1 6251 6251 ^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?function[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{.*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?.*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\) 2 0 0 1 6252 6252 [\x22\x27\<]hr[\x22\x27\>] 2 0 0 1 6253 6253 ^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q).+?CollectGarbage\(.+?\b(=var)\. 2 0 0 1 6254 6254 ^[\r\n\s]+(<func>[^\r\n\s]+)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\).+?onlosecapture(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(=func)\b 2 0 0 1 6255 6255 ^[\r\n\s]*?[\x27\x22]Unselect[\x27\x22] 2 0 0 1 6256 6256 node=.*\|.+\| 2 0 0 1 6257 6257 \x0a\x0dCookie\x3a[^\n]+UNION.+SELECT 2 0 0 1 6258 6258 \x0d\x0aCookie\x3a[^\n]+SELECT.+FROM 2 0 0 1 6259 6259 \x0a\x0dCookie\x3a[^\n]DELETE.+FROM 2 0 0 1 6260 6260 \x0a\x0dCookie\x3a[^\n]INSERT.+INTO 2 0 0 1 6261 6261 \x0a\x0dCookie\x3a[^\n]INTO.+OUTFILE 2 0 0 1 6262 6262 \x0a\x0dCookie\x3a[^\n]SELECT.+INSTR 2 0 0 1 6263 6263 \x0a\x0dCookie\x3a[^\n]SELECT.+SUBSTR 2 0 0 1 6264 6264 \x2FOvCgi\x2FMain\x2FSnmp\x2Eexe.+id\x3D.{600} 2 0 0 1 6265 6265 ^Authorization|3A|\s*Basic\s+TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE= 2 0 0 1 6266 6266 ([\w\x25]+=[\w\x25]*&){500}/Psmi 2 0 0 1 6267 6267 (\r\nContent-Disposition\x3a\s+form-data\x3b[^\r\n]+\r\n\r\n.+?){250}/Psmi 2 0 0 1 6268 6268 \x0a\x0dCookie\x3a[^\n]+xp_cmdshell 2 0 0 1 6269 6269 >.*?\'\s*?\)\s*?\)*?\s*?\;/P 2 0 0 1 6270 6270 \bSELECT.*?\bPRIV 2 0 0 1 6271 6271 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1 6272 6272 ^Accept-Language\:[^\n]*?[^,\;\n]{17} 2 0 0 1 6273 6273 ^User-Agent\x3a[^\r\n]+?Googlebot[^\-].+?\r$/Hmi 2 0 0 1 6274 6274 (script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 6275 6275 [\?\=\x3a\s\x2f] 2 0 0 1 6276 6276 [\?\=\x3a\s\x2f] 2 0 0 1 6277 6277 [\?\=\x3a\s\x2f] 2 0 0 1 6278 6278 [\?\=\x3a\s\x2f] 2 0 0 1 6279 6279 [\?\=\x3a\s\x2f] 2 0 0 1 6280 6280 [\?\=\x3a\s\x2f] 2 0 0 1 6281 6281 [\?\=\x3a\s\x2f] 2 0 0 1 6282 6282 [\?\=\x3a\s\x2f] 2 0 0 1 6283 6283 [\?\=\x3a\s\x2f] 2 0 0 1 6284 6284 [\?\=\x3a\s\x2f] 2 0 0 1 6285 6285 [\?\=\x3a\s\x2f] 2 0 0 1 6286 6286 [\?\=\x3a\s\x2f] 2 0 0 1 6287 6287 [\?\=\x3a\s\x2f] 2 0 0 1 6288 6288 [\?\=\x3a\s\x2f] 2 0 0 1 6289 6289 [\?\=\x3a\s\x2f] 2 0 0 1 6290 6290 [\?\=\x3a\s\x2f] 2 0 0 1 6291 6291 [\?\=\x3a\s\x2f] 2 0 0 1 6292 6292 [\?\=\x3a\s\x2f] 2 0 0 1 6293 6293 [\?\=\x3a\s\x2f] 2 0 0 1 6294 6294 [\?\=\x3a\s\x2f] 2 0 0 1 6295 6295 [\?\=\x3a\s\x2f] 2 0 0 1 6296 6296 [\?\=\x3a\s\x2f] 2 0 0 1 6297 6297 [\?\=\x3a\s\x2f] 2 0 0 1 6298 6298 [\?\=\x3a\s\x2f] 2 0 0 1 6299 6299 [\?\=\x3a\s\x2f] 2 0 0 1 6300 6300 [\?\=\x3a\s\x2f] 2 0 0 1 6301 6301 [\?\=\x3a\s\x2f] 2 0 0 1 6302 6302 [\?\=\x3a\s\x2f] 2 0 0 1 6303 6303 [\?\=\x3a\s\x2f] 2 0 0 1 6304 6304 [\?\=\x3a\s\x2f] 2 0 0 1 6305 6305 http\x3A\/\/127\.0\.0\.1\/.*\.asp 2 0 0 1 6306 6306 date=\d{8}\)\;. 2 0 0 1 6307 6307 migrate\s*=\s*\| 2 0 0 1 6308 6308 (f=.+\|) 2 0 0 1 6309 6309 (f=\.\..+) 2 0 0 1 6310 6310 file=.*\| 2 0 0 1 6311 6311 file=.+\.\..+\| 2 0 0 1 6312 6312 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6313 6313 BaseTarget=.*?\" 2 0 0 1 6314 6314 src=.*\"><\/FRAMESET>.*<script>.*<\/script> 2 0 0 1 6315 6315 (showenv|parsequery|rwservlet)\?.*CUSTOMIZE=\/ 2 0 0 1 6316 6316 (showenv|parsequery|rwservlet)\?.*destype=file.*desformat=\/ 2 0 0 1 6317 6317 (showenv|parsequery|rwservlet)\?.*report=.*\.(rdf|rep) 2 0 0 1 6318 6318 \x2Ephp\x3F.{0,300}\x3Dhttp\x3A\x2F[^\x3F\x26]+\x3F 2 0 0 1 6319 6319 \x2F\x2A.+\x2A\x2F 2 0 0 1 6320 6320 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6321 6321 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6322 6322 <?(java|vb)?script>? 2 0 0 1 6323 6323 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6324 6324 ^[\r\n\s]*?\x28[\r\n\s]*?base64_decode 2 0 0 1 6325 6325 ^[\r\n\s]*?\x28[\r\n\s]*?gzinflate 2 0 0 1 6326 6326 ^[\r\n\s]*?\x28[\r\n\s]*?str_rot13 2 0 0 1 6327 6327 ^[\r\n\s]*?\x28[\r\n\s]*?gzuncompress 2 0 0 1 6328 6328 ^[\r\n\s]*?\x28[\r\n\s]*?convert_uudecode 2 0 0 1 6329 6329 c99shcook 2 0 0 1 6330 6330 ^[^\r\n]*?HTTP\/1((\r?\n\r?\n)[\x20-\x7e\s]){1,50}\n[\x20-\x7e]{1,100}\x3a[\x20-\x7e]{0,50}\x28\x29\x20\x7b 2 0 0 1 6331 6331 (\x2a\x3f){700} 2 0 0 1 6332 6332 UserName\x3d[^\x26]+\x2500 2 0 0 1 6333 6333 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 6334 6334 ^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|javascript) 2 0 0 1 6335 6335 name=(<q>[\x22\x27])a(=q)[^\r\n]*\r\n[\r\n\s]+(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1 6336 6336 \?id=[0-9]{13}&msg=[^&]+$ 2 0 0 1 6337 6337 (%3C%21|\<\!)--[\r\n\s]*?mfunc 2 0 0 1 6338 6338 (%3C%21|\<\!)--[\r\n\s]*?mclude 2 0 0 1 6339 6339 (%3C%21|\<\!)--[\r\n\s]*?dynamic-cached-content 2 0 0 1 6340 6340 ^[0-9]{2,3}\)char\([^\x0d\x0a\x20]{98} 2 0 0 1 6341 6341 ^\b 2 0 0 1 6342 6342 <%[\x00-\x7f]{20} 2 0 0 1 6343 6343 ^\s*\s*?[\x22\x27]?(f(ile|tp)|gopher|https?|mailto)\s*?\x3a 2 0 0 1 6344 6344 ^[a-z0-9\.\_]{5}hC[a-z0-9\.\_]{50} 2 0 0 1 6345 6345 [&?]cmd=[^\x26\x28]*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp) 2 0 0 1 6346 6346 (%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))) 2 0 0 1 6347 6347 net(%(25)?20|\s)+user 2 0 0 1 6348 6348 ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\x3a\d{1,5})?$ 2 0 0 1 6349 6349 ^\s*\-\s* 2 0 0 1 6350 6350 \${\s*?%{ 2 0 0 1 6351 6351 ^If\x3a\x20\x3c[^\r\n>]+?([\x7f-\xff]) 2 0 0 1 6352 6352 ^[^\n]+([^ -~\x0d\x0a]|,\x20*,) 2 0 0 1 6353 6353 var wow\s*=\s*\x22[^\x22\n]+?\x22\x3b[^\x3b\n]*?Date[^\x3b\n]*?\x3b 2 0 0 1 6354 6354 SELECT[^a-z]+USER 2 0 0 1 6355 6355 \x2Fcgi\x2Dbin\x2F\x3B.+[a-z] 2 0 0 1 6356 6356 \WUPDATE\s+[A-Za-z0-9_].*?\WSET\s+[A-Za-z0-9$_].*?\x3d 2 0 0 1 6357 6357 ViewState\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 6358 6358 (script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 6359 6359 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 6360 6360 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange).+Apply\x3DApply 2 0 0 1 6361 6361 (start|stop|continue|pause|querystate) 2 0 0 1 6362 6362 xp_reg(read|write|delete) 2 0 0 1 6363 6363 (xp_enumdsn|xp_enumgroups|xp_ntsec_enumdomains) 2 0 0 1 6364 6364 \x2Ephp\x3F.{0,300}\x3Dhttps\x3A\x2F[^\x3F\x26]+\x3F 2 0 0 1 6365 6365 \x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F 2 0 0 1 6366 6366 \x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F 2 0 0 1 6367 6367 ^\s+(database|procedure|table|column) 2 0 0 1 6368 6368 ^\s+(database|procedure|table|column) 2 0 0 1 6369 6369 ^\s+(database|procedure|table|column|directory) 2 0 0 1 6370 6370 ^(DATE|TIME) 2 0 0 1 6371 6371 BENCHMARK\x28[0-9].+\x29 2 0 0 1 6372 6372 SELECT.+CONCAT 2 0 0 1 6373 6373 [^\w]REVERSE[^\w]?\( 2 0 0 1 6374 6374 cid0\x3d.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 6375 6375 \x7C\x7C.+[a-z] 2 0 0 1 6376 6376 SELECT.+INSTR 2 0 0 1 6377 6377 SELECT.+SUBSTR 2 0 0 1 6378 6378 ([\*\?]~1|~1\.?[\*\?]|\/~1\/) 2 0 0 1 6379 6379 ^net[0-4]{2}net\.net$ 2 0 0 1 6380 6380 Transfer-Encoding\x3a[^\r\n]*?chunked 2 0 0 1 6381 6381 \ballow_url_include\s* 2 0 0 1 6382 6382 \bsafe_mode\s* 2 0 0 1 6383 6383 \bopen_basedir\s* 2 0 0 1 6384 6384 \bauto_prepend_file\s* 2 0 0 1 6385 6385 \bsuhosin\.simulation\s* 2 0 0 1 6386 6386 \bdisable_functions[\s\+]* 2 0 0 1 6387 6387 \.asp\?action=(txt(edit|view)|upload|info|del)(&|$) 2 0 0 1 6388 6388 [\n\r](content-(type|length)|set-cookie|location)\x3a 2 0 0 1 6389 6389 \/\$\{[^\}\x2c]+ 2 0 0 1 6390 6390 filename[\r\n\s]*[\r\n\s]*?[\x22\x27]?[^\r\n\x22\x27\x3b]+?\.[\r\n\x3b\x22\x27] 2 0 0 1 6391 6391 [&\?]_SERVER\[[^\]]+?\][^=]* 2 0 0 1 6392 6392 [&\?]_GET\[[^\]]+?\][^=]* 2 0 0 1 6393 6393 [&\?]_POST\[[^\]]+?\][^=]* 2 0 0 1 6394 6394 [&\?]_COOKIE\[[^\]]+?\][^=]* 2 0 0 1 6395 6395 [&\?]_SESSION\[[^\]]+?\][^=]* 2 0 0 1 6396 6396 [&\?]_REQUEST\[[^\]]+?\][^=]* 2 0 0 1 6397 6397 [&\?]_ENV\[[^\]]+?\][^=]* 2 0 0 1 6398 6398 ([&\?\r\n]|^)_SERVER\[[^\]]+?\][^=]* 2 0 0 1 6399 6399 ([&\?\r\n]|^)_GET\[[^\]]+?\][^=]* 2 0 0 1 6400 6400 ([&\?\r\n]|^)_POST\[[^\]]+?\][^=]* 2 0 0 1 6401 6401 [&\?]_COOKIE\[[^\]]+?\][^=]* 2 0 0 1 6402 6402 [&\?]_SESSION\[[^\]]+?\][^=]* 2 0 0 1 6403 6403 [&\?]_REQUEST\[[^\]]+?\][^=]* 2 0 0 1 6404 6404 [&\?]_ENV\[[^\]]+?\][^=]* 2 0 0 1 6405 6405 [?&]isn_getlog 2 0 0 1 6406 6406 ^[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\))) 2 0 0 1 6407 6407 ^\s+?[^\s\>]+?\s+?SYSTEM\s 2 0 0 1 6408 6408 ^[^\r\n]*?boundary\s*\s*?[^\r\n] 2 0 0 1 6409 6409 [&?]c99shcook\[ 2 0 0 1 6410 6410 (^|&)c99shcook\[ 2 0 0 1 6411 6411 ^[\r\n\s]*?\x28[\r\n\s]*?base64_decode 2 0 0 1 6412 6412 \/server_sync.php\?(.+?&)?c= 2 0 0 1 6413 6413 (:?(:?\x5e|%5e)|(:?[=?&]|\x25(:?3d|3f|26)))\s*?(:?%28|\x28)(:?%29|\x29)(:?%20|\x20)(:?%7b|\x7b)(:?%20|\x20) 2 0 0 1 6414 6414 (^User-Agent\x3a)\bcurl\s[^\r\n]*?-([Oo]|-(remote-name|output))[^\r\n]+(\x3b|&&) 2 0 0 1 6415 6415 (^User-Agent\x3a)\bwget\s[^\r\n]+(\x3b|&&) 2 0 0 1 6416 6416 (^User-Agent\x3a)\blwp-download\s[^\r\n]+(\x3b|&&) 2 0 0 1 6417 6417 [=?&\x2f]\s*?\x28\x29\x20\x7b 2 0 0 1 6418 6418 (:?(\x5e|%5e)|([=?&]|\x25(3d|3f|26)))\s*?\(\)(%20|\x20)(%7b|\x7b) 2 0 0 1 6419 6419 ^User-Agent\x3a[^\r\n]*?Heimdallbot 2 0 0 1 6420 6420 [?&]isn_logdel 2 0 0 1 6421 6421 [?&]isn_logpath 2 0 0 1 6422 6422 \.war\?cmd=[a-zA-Z0-9+/=]+&winurl=[a-zA-Z0-9+/=]*&linurl=[a-zA-Z0-9+/=]* 2 0 0 1 6423 6423 ^\s*https?\x3a\/\/ 2 0 0 1 6424 6424 ^\s*\x3a\s*[./] 2 0 0 1 6425 6425 ^\s*\x3a\s*[./] 2 0 0 1 6426 6426 ^\s*\x3a\s*\x40 2 0 0 1 6427 6427 https\x3a.+(\x5c)(:[\x22\x27]|\\x2[27])\s*?[\x3b&\x7c><].*?(:[\x22\x27]|\\x2[27]) 2 0 0 1 6428 6428 xlink\s*?\x3a\s*?href\s*\s*?(:[\x22\x27]|\\x2[27])https.+?"\s*?\x3b(\x7c|&([gl]t|amp)\s*?\x3b) 2 0 0 1 6429 6429 ^Range\x3a[^\r\n]*?18446744073709551615 2 0 0 1 6430 6430 \x2Flevel\x2F15\x2Fexec\x2F\x2D\x2F[a-z] 2 0 0 1 6431 6431 ^\s*=\s*([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[^\x26\x0D\x0A]*\x3B) 2 0 0 1 6432 6432 ^(set|get) 2 0 0 1 6433 6433 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 6434 6434 ^(1|on|true) 2 0 0 1 6435 6435 (^|[=?&])\s*?\x28\x29\x20\x7b 2 0 0 1 6436 6436 (is|mx|info|co)$ 2 0 0 1 6437 6437 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6438 6438 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6439 6439 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6440 6440 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6441 6441 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6442 6442 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6443 6443 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6444 6444 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6445 6445 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6446 6446 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6447 6447 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6448 6448 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6449 6449 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6450 6450 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6451 6451 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6452 6452 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6453 6453 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6454 6454 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6455 6455 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6456 6456 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6457 6457 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6458 6458 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6459 6459 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6460 6460 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6461 6461 ^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) 2 0 0 1 6462 6462 <(<tname>[^\s]+)[^>]*?\stype\s*=\s*(<q>[\x22\x27])yaml(=q)((<\/(=tname)).+?)!ruby 2 0 0 1 6463 6463 ^[^\r\n]*?[\x27\x22\t\\%\x00\x08\x26] 2 0 0 1 6464 6464 [\?&]redirect\x3a 2 0 0 1 6465 6465 [\?&]redirectAction\x3a 2 0 0 1 6466 6466 [\?&]action\x3a 2 0 0 1 6467 6467 (^|[\n\&])name=(%\d{2}|[^%&]){12} 2 0 0 1 6468 6468 (^|[\n\&])pwd=(%\d{2}|[^%&]){25} 2 0 0 1 6469 6469 (^|[\n\&])sess_sid=(%\d{2}|[^%&]){21} 2 0 0 1 6470 6470 (^|[\n\&])ACT=(%\d{2}|[^%&]){21} 2 0 0 1 6471 6471 \bredirect\x3a 2 0 0 1 6472 6472 \bredirectAction\x3a 2 0 0 1 6473 6473 \baction\x3a 2 0 0 1 6474 6474 rdsPasswordAllowed[\r\n\s]*[\r\n\s]*?(true|1) 2 0 0 1 6475 6475 \/proxy\.php(\?|.*[\x26\x3B])url=[^&\;\x0D\x0A]*[<>\"\'] 2 0 0 1 6476 6476 \<a href="[^"]*(script|about|applet|activex|chrome)\s*\: 2 0 0 1 6477 6477 \<br \/\>_________________\<br \/\>\<a href="[^"]*(script|about|applet|activex|chrome)\s*\: 2 0 0 1 6478 6478 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6479 6479 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6480 6480 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5622772D-6C27-11D3-95E5-006008D14F3B 2 0 0 1 6481 6481 LICMGR_ADDLICENSE&[^\x00\n\r@&]{450} 2 0 0 1 6482 6482 SELECT.+FROM 2 0 0 1 6483 6483 UNION\s+SELECT 2 0 0 1 6484 6484 INSERT.+INTO 2 0 0 1 6485 6485 DELETE.+FROM 2 0 0 1 6486 6486 ASCII\(.+SELECT 2 0 0 1 6487 6487 UPDATE.+SET 2 0 0 1 6488 6488 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6489 6489 .+UNION\s+SELECT 2 0 0 1 6490 6490 .+INSERT.+INTO 2 0 0 1 6491 6491 .+DELETE.+FROM 2 0 0 1 6492 6492 .+ASCII\(.+SELECT 2 0 0 1 6493 6493 .+UPDATE.+SET 2 0 0 1 6494 6494 (art=\|.+\|) 2 0 0 1 6495 6495 \/index\.php(\?|.*\x26)imgdir=([^\x26\x3B\x0D\x0A]*[\x2F\x5C])?\.\.[\x2F\x5C] 2 0 0 1 6496 6496 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6497 6497 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6498 6498 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6499 6499 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6500 6500 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6501 6501 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6502 6502 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6503 6503 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6504 6504 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6505 6505 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6506 6506 page_include=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6507 6507 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6508 6508 theme_directory=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6509 6509 theme_directory=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6510 6510 forumspath=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6511 6511 sitepath=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6512 6512 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6513 6513 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6514 6514 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6515 6515 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6516 6516 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6517 6517 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6518 6518 loadadminpage=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6519 6519 SELECT.+FROM 2 0 0 1 6520 6520 UNION\s+SELECT 2 0 0 1 6521 6521 INSERT.+INTO 2 0 0 1 6522 6522 DELETE.+FROM 2 0 0 1 6523 6523 ASCII\(.+SELECT 2 0 0 1 6524 6524 UPDATE.+SET 2 0 0 1 6525 6525 UPDATE.+SET 2 0 0 1 6526 6526 \+UNION\+SELECT 2 0 0 1 6527 6527 class_dir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6528 6528 mj_config\[src_path\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6529 6529 page=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6530 6530 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6531 6531 dir\[plugins\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6532 6532 dir\[plugins\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6533 6533 sIncPath=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6534 6534 SELECT.+FROM 2 0 0 1 6535 6535 UNION\s+SELECT 2 0 0 1 6536 6536 INSERT.+INTO 2 0 0 1 6537 6537 DELETE.+FROM 2 0 0 1 6538 6538 ASCII\(.+SELECT 2 0 0 1 6539 6539 UPDATE.+SET 2 0 0 1 6540 6540 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6541 6541 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6542 6542 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6543 6543 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6544 6544 SELECT.+FROM 2 0 0 1 6545 6545 UNION\s+SELECT 2 0 0 1 6546 6546 INSERT.+INTO 2 0 0 1 6547 6547 DELETE.+FROM 2 0 0 1 6548 6548 ASCII\(.+SELECT 2 0 0 1 6549 6549 UPDATE.+SET 2 0 0 1 6550 6550 id_menu\x3d.+DELETE.+FROM 2 0 0 1 6551 6551 id_menu\x3d.+UPDATE.+SET 2 0 0 1 6552 6552 (file=\|.+\|) 2 0 0 1 6553 6553 (graph_start=%0a.+%0a) 2 0 0 1 6554 6554 UNION\s+SELECT 2 0 0 1 6555 6555 INSERT.+INTO 2 0 0 1 6556 6556 DELETE.+FROM 2 0 0 1 6557 6557 UPDATE.+SET 2 0 0 1 6558 6558 script>?.*<.*script 2 0 0 1 6559 6559 script>?.*<.+\/script>? 2 0 0 1 6560 6560 script>?.*<.+\/script>? 2 0 0 1 6561 6561 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6562 6562 script>?.*<.+\/script>? 2 0 0 1 6563 6563 script>?.*<.+\/script>? 2 0 0 1 6564 6564 script>?.*<.+\/script>? 2 0 0 1 6565 6565 script>?.*<.+\/script>? 2 0 0 1 6566 6566 GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6567 6567 mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6568 6568 mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6569 6569 GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6570 6570 GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6571 6571 GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6572 6572 mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6573 6573 minsoft_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6574 6574 minsoft_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6575 6575 DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6576 6576 DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6577 6577 DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6578 6578 DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6579 6579 DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6580 6580 script>?.*<.+\/script>? 2 0 0 1 6581 6581 script>?.*<.+\/script>? 2 0 0 1 6582 6582 script>?.*<.+\/script>? 2 0 0 1 6583 6583 script>?.*<.+\/script>? 2 0 0 1 6584 6584 sections_file=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6585 6585 INSERT.+INTO 2 0 0 1 6586 6586 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6587 6587 SELECT.+FROM 2 0 0 1 6588 6588 UNION\s+SELECT 2 0 0 1 6589 6589 INSERT.+INTO 2 0 0 1 6590 6590 ASCII\(.+SELECT 2 0 0 1 6591 6591 UPDATE.+SET 2 0 0 1 6592 6592 \/ping\?.+(script|alert|on(mouse[a-z]+|key[a-z]+|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 6593 6593 footer_file=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6594 6594 SELECT.+FROM 2 0 0 1 6595 6595 UNION\s+SELECT 2 0 0 1 6596 6596 INSERT.+INTO 2 0 0 1 6597 6597 DELETE.+FROM 2 0 0 1 6598 6598 ASCII\(.+SELECT 2 0 0 1 6599 6599 UPDATE.+SET 2 0 0 1 6600 6600 script>?.*<.+\/script>? 2 0 0 1 6601 6601 SECURITY_FILE=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6602 6602 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6603 6603 SELECT.+FROM 2 0 0 1 6604 6604 SELECT.+FROM 2 0 0 1 6605 6605 UNION\s+SELECT 2 0 0 1 6606 6606 INSERT.+INTO 2 0 0 1 6607 6607 DELETE.+FROM 2 0 0 1 6608 6608 ASCII\(.+SELECT 2 0 0 1 6609 6609 UPDATE.+SET 2 0 0 1 6610 6610 SELECT.+FROM 2 0 0 1 6611 6611 &TYPEOF\:.+system\s*\( 2 0 0 1 6612 6612 (..\\) 2 0 0 1 6613 6613 script>?.*<.+\/script>? 2 0 0 1 6614 6614 script>?.*<.+\/script>? 2 0 0 1 6615 6615 dle_config_api\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6616 6616 script>?.*<.+\/script>? 2 0 0 1 6617 6617 script>?.*<.+\/script>? 2 0 0 1 6618 6618 script>?.*<.+\/script>? 2 0 0 1 6619 6619 root=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6620 6620 =\s*(https?|ftps|php)\:\/ 2 0 0 1 6621 6621 SELECT.+FROM 2 0 0 1 6622 6622 UNION\s+SELECT 2 0 0 1 6623 6623 INSERT.+INTO 2 0 0 1 6624 6624 DELETE.+FROM 2 0 0 1 6625 6625 ASCII\(.+SELECT 2 0 0 1 6626 6626 UPDATE.+SET 2 0 0 1 6627 6627 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6628 6628 script>?.*<.+\/script>? 2 0 0 1 6629 6629 script>?.*<.+\/script>? 2 0 0 1 6630 6630 SELECT.+FROM 2 0 0 1 6631 6631 SELECT.+FROM 2 0 0 1 6632 6632 UNION\s+SELECT 2 0 0 1 6633 6633 INSERT.+INTO 2 0 0 1 6634 6634 DELETE.+FROM 2 0 0 1 6635 6635 ASCII\(.+SELECT 2 0 0 1 6636 6636 UPDATE.+SET 2 0 0 1 6637 6637 FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6638 6638 FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6639 6639 dir\[classes\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6640 6640 SELECT.+FROM 2 0 0 1 6641 6641 UNION\s+SELECT 2 0 0 1 6642 6642 INSERT.+INTO 2 0 0 1 6643 6643 DELETE.+FROM 2 0 0 1 6644 6644 ASCII\(.+SELECT 2 0 0 1 6645 6645 UPDATE.+SET 2 0 0 1 6646 6646 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6647 6647 SELECT.+FROM 2 0 0 1 6648 6648 UNION\s+SELECT 2 0 0 1 6649 6649 INSERT.+INTO 2 0 0 1 6650 6650 DELETE.+FROM 2 0 0 1 6651 6651 ASCII\(.+SELECT 2 0 0 1 6652 6652 UPDATE.+SET 2 0 0 1 6653 6653 API_HOME_DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6654 6654 abspath=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6655 6655 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6656 6656 CFG\[PREPEND_FILE\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6657 6657 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6658 6658 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6659 6659 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6660 6660 SELECT.+FROM 2 0 0 1 6661 6661 SELECT.+FROM 2 0 0 1 6662 6662 UNION\s+SELECT 2 0 0 1 6663 6663 INSERT.+INTO 2 0 0 1 6664 6664 DELETE.+FROM 2 0 0 1 6665 6665 ASCII\(.+SELECT 2 0 0 1 6666 6666 UPDATE.+SET 2 0 0 1 6667 6667 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6668 6668 root_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6669 6669 cur_module=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6670 6670 proxystylesheet=\s*(https?|ftps?|php) 2 0 0 1 6671 6671 location=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6672 6672 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6673 6673 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6674 6674 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6675 6675 _settings\[pluginpath\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6676 6676 \/horde((2|3|-3\.(0\.[1-9]|1\.0)))?\/{1,2}README 2 0 0 1 6677 6677 phpbb_root_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6678 6678 phpbb_root_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6679 6679 CONFIG\[LANGUAGE_CPATH\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6680 6680 CONFIG\[BASE_PATH\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6681 6681 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6682 6682 SELECT.+FROM 2 0 0 1 6683 6683 UNION\s+SELECT 2 0 0 1 6684 6684 INSERT.+INTO 2 0 0 1 6685 6685 DELETE.+FROM 2 0 0 1 6686 6686 ASCII\(.+SELECT 2 0 0 1 6687 6687 UPDATE.+SET 2 0 0 1 6688 6688 SELECT.+FROM 2 0 0 1 6689 6689 UNION\s+SELECT 2 0 0 1 6690 6690 INSERT.+INTO 2 0 0 1 6691 6691 DELETE.+FROM 2 0 0 1 6692 6692 ASCII\(.+SELECT 2 0 0 1 6693 6693 UPDATE.+SET 2 0 0 1 6694 6694 SELECT.+FROM 2 0 0 1 6695 6695 UNION\s+SELECT 2 0 0 1 6696 6696 INSERT.+INTO 2 0 0 1 6697 6697 DELETE.+FROM 2 0 0 1 6698 6698 ASCII\(.+SELECT 2 0 0 1 6699 6699 UPDATE.+SET 2 0 0 1 6700 6700 SELECT.+FROM 2 0 0 1 6701 6701 UNION\s+SELECT 2 0 0 1 6702 6702 INSERT.+INTO 2 0 0 1 6703 6703 DELETE.+FROM 2 0 0 1 6704 6704 ASCII\(.+SELECT 2 0 0 1 6705 6705 UPDATE.+SET 2 0 0 1 6706 6706 SELECT.+FROM 2 0 0 1 6707 6707 UNION\s+SELECT 2 0 0 1 6708 6708 INSERT.+INTO 2 0 0 1 6709 6709 DELETE.+FROM 2 0 0 1 6710 6710 ASCII\(.+SELECT 2 0 0 1 6711 6711 UPDATE.+SET 2 0 0 1 6712 6712 SELECT.+FROM 2 0 0 1 6713 6713 UNION\s+SELECT 2 0 0 1 6714 6714 INSERT.+INTO 2 0 0 1 6715 6715 DELETE.+FROM 2 0 0 1 6716 6716 ASCII\(.+SELECT 2 0 0 1 6717 6717 UPDATE.+SET 2 0 0 1 6718 6718 SELECT.+FROM 2 0 0 1 6719 6719 UNION\s+SELECT 2 0 0 1 6720 6720 INSERT.+INTO 2 0 0 1 6721 6721 DELETE.+FROM 2 0 0 1 6722 6722 ASCII\(.+SELECT 2 0 0 1 6723 6723 UPDATE.+SET 2 0 0 1 6724 6724 script>?.*<.+\/script>? 2 0 0 1 6725 6725 SELECT.+FROM 2 0 0 1 6726 6726 UNION\s+SELECT 2 0 0 1 6727 6727 INSERT.+INTO 2 0 0 1 6728 6728 DELETE.+FROM 2 0 0 1 6729 6729 ASCII\(.+SELECT 2 0 0 1 6730 6730 UPDATE.+SET 2 0 0 1 6731 6731 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6732 6732 SELECT.+FROM 2 0 0 1 6733 6733 UNION\s+SELECT 2 0 0 1 6734 6734 INSERT.+INTO 2 0 0 1 6735 6735 DELETE.+FROM 2 0 0 1 6736 6736 ASCII\(.+SELECT 2 0 0 1 6737 6737 UPDATE.+SET 2 0 0 1 6738 6738 =\s*(https?|ftps|php)\:\/ 2 0 0 1 6739 6739 SELECT.+FROM 2 0 0 1 6740 6740 UNION\s+SELECT 2 0 0 1 6741 6741 INSERT.+INTO 2 0 0 1 6742 6742 DELETE.+FROM 2 0 0 1 6743 6743 ASCII\(.+SELECT 2 0 0 1 6744 6744 UPDATE.+SET 2 0 0 1 6745 6745 SELECT.+FROM 2 0 0 1 6746 6746 UNION\s+SELECT 2 0 0 1 6747 6747 INSERT.+INTO 2 0 0 1 6748 6748 DELETE.+FROM 2 0 0 1 6749 6749 ASCII\(.+SELECT 2 0 0 1 6750 6750 UPDATE.+SET 2 0 0 1 6751 6751 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6752 6752 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6753 6753 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6754 6754 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6755 6755 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6756 6756 mosConfig_absolute_path=(https?|ftps?|php)\:\/ 2 0 0 1 6757 6757 SELECT.+FROM 2 0 0 1 6758 6758 UNION\s+SELECT 2 0 0 1 6759 6759 INSERT.+INTO 2 0 0 1 6760 6760 DELETE.+FROM 2 0 0 1 6761 6761 ASCII\(.+SELECT 2 0 0 1 6762 6762 UPDATE.+SET 2 0 0 1 6763 6763 include_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6764 6764 processName\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 6765 6765 help\x2Findex\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 6766 6766 content\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 6767 6767 appMVCPath=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6768 6768 CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 6769 6769 appMVCPath=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 6770 6770 CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 6771 6771 ASCII\(.+SELECT 2 0 0 1 6772 6772 _SESSION\[SCRIPT_PATH\]=\s*(https?|ftps?|php)\x3a\/ 2 0 0 1 6773 6773 top_graph_header\.php\?.*=(http|https)\x3a\/ 2 0 0 1 6774 6774 config_settings\.php\?.*=(http|https)\x3a\/ 2 0 0 1 6775 6775 UNION.+SELECT 2 0 0 1 6776 6776 =\s*(https|ftps|php|http|ftp)\x3A\x2F 2 0 0 1 6777 6777 \/filediff\?((&?v\d[\d.]+?)+?&f\x3d|f\x3d.+?(&v\d[\d.]+?)+?).+?\x3b.+?\x3b 2 0 0 1 6778 6778 (configdir|update|pluginmode)=.*(\|.+\||system) 2 0 0 1 6779 6779 template=[./] 2 0 0 1 6780 6780 template=[./] 2 0 0 1 6781 6781 _CONF\[.*\]=(data|https?|ftps?|php)\:\/ 2 0 0 1 6782 6782 (\.\.\/){1} 2 0 0 1 6783 6783 IP=\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 6784 6784 commandId\x3D[a-z] 2 0 0 1 6785 6785 search\?q=(ht|f)tp?\:\/ 2 0 0 1 6786 6786 module=[^\;]*\;.*\" 2 0 0 1 6787 6787 ASCII\(.+SELECT 2 0 0 1 6788 6788 UNION\s+SELECT 2 0 0 1 6789 6789 ^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/Hmi 2 0 0 1 6790 6790 Cookie: .*admin-access= 2 0 0 1 6791 6791 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 6792 6792 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 6793 6793 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}) 2 0 0 1 6794 6794 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6795 6795 FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6796 6796 read_xml_include=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6797 6797 root=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6798 6798 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6799 6799 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6800 6800 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6801 6801 CLASSES_ROOT=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6802 6802 .*\[.*\].*\; 2 0 0 1 6803 6803 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6804 6804 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6805 6805 oe_classpath=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6806 6806 GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6807 6807 GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6808 6808 .+SELECT.+FROM 2 0 0 1 6809 6809 .+UNION\s+SELECT 2 0 0 1 6810 6810 .+INSERT.+INTO 2 0 0 1 6811 6811 .+DELETE.+FROM 2 0 0 1 6812 6812 .+ASCII\(.+SELECT 2 0 0 1 6813 6813 .+UPDATE.+SET 2 0 0 1 6814 6814 .+SELECT.+FROM 2 0 0 1 6815 6815 .+UNION\s+SELECT 2 0 0 1 6816 6816 .+INSERT.+INTO 2 0 0 1 6817 6817 .+DELETE.+FROM 2 0 0 1 6818 6818 .+ASCII\(.+SELECT 2 0 0 1 6819 6819 .+UPDATE.+SET 2 0 0 1 6820 6820 .+SELECT.+FROM 2 0 0 1 6821 6821 .+UNION\s+SELECT 2 0 0 1 6822 6822 .+INSERT.+INTO 2 0 0 1 6823 6823 .+DELETE.+FROM 2 0 0 1 6824 6824 .+ASCII\(.+SELECT 2 0 0 1 6825 6825 .+UPDATE.+SET 2 0 0 1 6826 6826 include_path=\s*(ftps?|https?|php)\:/ 2 0 0 1 6827 6827 include_path=\s*(ftps?|https?|php)\:/ 2 0 0 1 6828 6828 include_path=\s*(ftps?|https?|php)\:/ 2 0 0 1 6829 6829 highlight=.*?(\'|\%[a-f0-9]{4})(\.|\/|\\|\%[a-f0-9]{4}).+?(\'|\%[a-f0-9]{4}) 2 0 0 1 6830 6830 phpbb_root_path=(ftps?|https?|php) 2 0 0 1 6831 6831 (\?|&)id= 2 0 0 1 6832 6832 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6833 6833 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6834 6834 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6835 6835 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6836 6836 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6837 6837 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6838 6838 (text\.ctrl\.php|common\.function\.php)\?level=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6839 6839 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6840 6840 DataDirectory=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6841 6841 .+SELECT.+FROM 2 0 0 1 6842 6842 .+UNION\s+SELECT 2 0 0 1 6843 6843 .+INSERT.+INTO 2 0 0 1 6844 6844 .+DELETE.+FROM 2 0 0 1 6845 6845 .+ASCII\(.+SELECT 2 0 0 1 6846 6846 .+UPDATE.+SET 2 0 0 1 6847 6847 .+SELECT.+FROM 2 0 0 1 6848 6848 .+UNION\s+SELECT 2 0 0 1 6849 6849 .+INSERT.+INTO 2 0 0 1 6850 6850 .+DELETE.+FROM 2 0 0 1 6851 6851 .+ASCII\(.+SELECT 2 0 0 1 6852 6852 .+UPDATE.+SET 2 0 0 1 6853 6853 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6854 6854 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6855 6855 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6856 6856 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6857 6857 confdir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6858 6858 (argv[1]=\|.+) 2 0 0 1 6859 6859 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6860 6860 UNION.+SELECT 2 0 0 1 6861 6861 <\s*SCRIPT\s*> 2 0 0 1 6862 6862 file=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6863 6863 includedir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6864 6864 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6865 6865 GLOBALS\x5bFarmD\x5d\x3d 2 0 0 1 6866 6866 SELECT.+FROM 2 0 0 1 6867 6867 UNION\s+SELECT 2 0 0 1 6868 6868 INSERT.+INTO 2 0 0 1 6869 6869 DELETE.+FROM 2 0 0 1 6870 6870 ASCII\(.+SELECT 2 0 0 1 6871 6871 UPDATE.+SET 2 0 0 1 6872 6872 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6873 6873 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6874 6874 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6875 6875 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6876 6876 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6877 6877 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6878 6878 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6879 6879 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6880 6880 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6881 6881 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6882 6882 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6883 6883 .+SELECT.+FROM 2 0 0 1 6884 6884 .+UNION\s+SELECT 2 0 0 1 6885 6885 .+INSERT.+INTO 2 0 0 1 6886 6886 .+DELETE.+FROM 2 0 0 1 6887 6887 .+ASCII\(.+SELECT 2 0 0 1 6888 6888 .+UPDATE.+SET 2 0 0 1 6889 6889 PATH_TO_CODE=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6890 6890 includepath=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6891 6891 lib=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6892 6892 _px_config\x5bmanager_path\x5d=(https?|ftps?|php)\: 2 0 0 1 6893 6893 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6894 6894 sourceFolder=\s*(ftps?|https?|php)\:/ 2 0 0 1 6895 6895 CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6896 6896 CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6897 6897 qte_web_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6898 6898 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6899 6899 path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6900 6900 INC_DIR=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6901 6901 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6902 6902 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6903 6903 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6904 6904 GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6905 6905 GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6906 6906 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6907 6907 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6908 6908 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6909 6909 .+SELECT.+FROM 2 0 0 1 6910 6910 .+UNION\s+SELECT 2 0 0 1 6911 6911 .+INSERT.+INTO 2 0 0 1 6912 6912 .+DELETE.+FROM 2 0 0 1 6913 6913 .+ASCII\(.+SELECT 2 0 0 1 6914 6914 .+UPDATE.+SET 2 0 0 1 6915 6915 (\.\.\/){1,} 2 0 0 1 6916 6916 SELECT.+FROM 2 0 0 1 6917 6917 UNION\s+SELECT 2 0 0 1 6918 6918 INSERT.+INTO 2 0 0 1 6919 6919 DELETE.+FROM 2 0 0 1 6920 6920 ASCII\(.+SELECT 2 0 0 1 6921 6921 UPDATE.+SET 2 0 0 1 6922 6922 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6923 6923 .+SELECT.+FROM 2 0 0 1 6924 6924 .+UNION\s+SELECT 2 0 0 1 6925 6925 .+INSERT.+INTO 2 0 0 1 6926 6926 .+DELETE.+FROM 2 0 0 1 6927 6927 .+ASCII\(.+SELECT 2 0 0 1 6928 6928 .+UPDATE.+SET 2 0 0 1 6929 6929 .+SELECT.+FROM 2 0 0 1 6930 6930 .+UNION\s+SELECT 2 0 0 1 6931 6931 .+INSERT.+INTO 2 0 0 1 6932 6932 .+DELETE.+FROM 2 0 0 1 6933 6933 .+ASCII\(.+SELECT 2 0 0 1 6934 6934 .+UPDATE.+SET 2 0 0 1 6935 6935 _page_css=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6936 6936 _page_javascript=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6937 6937 _page_content=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6938 6938 SELECT.+FROM 2 0 0 1 6939 6939 UNION\s+SELECT 2 0 0 1 6940 6940 INSERT.+INTO 2 0 0 1 6941 6941 DELETE.+FROM 2 0 0 1 6942 6942 ASCII\(.+SELECT 2 0 0 1 6943 6943 UPDATE.+SET 2 0 0 1 6944 6944 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6945 6945 IP=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6946 6946 .+SELECT.+FROM 2 0 0 1 6947 6947 .+UNION\s+SELECT 2 0 0 1 6948 6948 .+INSERT.+INTO 2 0 0 1 6949 6949 .+DELETE.+FROM 2 0 0 1 6950 6950 .+ASCII\(.+SELECT 2 0 0 1 6951 6951 .+UPDATE.+SET 2 0 0 1 6952 6952 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6953 6953 slogin_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 6954 6954 SELECT.+FROM 2 0 0 1 6955 6955 UNION\s+SELECT 2 0 0 1 6956 6956 INSERT.+INTO 2 0 0 1 6957 6957 DELETE.+FROM 2 0 0 1 6958 6958 ASCII\(.+SELECT 2 0 0 1 6959 6959 UPDATE.+SET 2 0 0 1 6960 6960 SELECT.+FROM 2 0 0 1 6961 6961 UNION\s+SELECT 2 0 0 1 6962 6962 DELETE.+FROM 2 0 0 1 6963 6963 ASCII\(.+SELECT 2 0 0 1 6964 6964 UPDATE.+SET 2 0 0 1 6965 6965 SELECT.+FROM 2 0 0 1 6966 6966 UNION\s+SELECT 2 0 0 1 6967 6967 INSERT.+INTO 2 0 0 1 6968 6968 DELETE.+FROM 2 0 0 1 6969 6969 ASCII\(.+SELECT 2 0 0 1 6970 6970 UPDATE.+SET 2 0 0 1 6971 6971 SELECT.+FROM 2 0 0 1 6972 6972 UNION\s+SELECT 2 0 0 1 6973 6973 INSERT.+INTO 2 0 0 1 6974 6974 DELETE.+FROM 2 0 0 1 6975 6975 ASCII\(.+SELECT 2 0 0 1 6976 6976 UPDATE.+SET 2 0 0 1 6977 6977 g_pcltar_lib_dir=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6978 6978 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6979 6979 SELECT.+FROM 2 0 0 1 6980 6980 UNION\s+SELECT 2 0 0 1 6981 6981 INSERT.+INTO 2 0 0 1 6982 6982 DELETE.+FROM 2 0 0 1 6983 6983 ASCII\(.+SELECT 2 0 0 1 6984 6984 UPDATE.+SET 2 0 0 1 6985 6985 SELECT.+FROM 2 0 0 1 6986 6986 UNION\s+SELECT 2 0 0 1 6987 6987 INSERT.+INTO 2 0 0 1 6988 6988 ASCII\(.+SELECT 2 0 0 1 6989 6989 UPDATE.+SET 2 0 0 1 6990 6990 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6991 6991 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6992 6992 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6993 6993 inc_dir=\s*(https?|ftps?|php)\:\/ 2 0 0 1 6994 6994 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 6995 6995 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6996 6996 UNION.+SELECT 2 0 0 1 6997 6997 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6998 6998 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 6999 6999 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7000 7000 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7001 7001 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7002 7002 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7003 7003 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7004 7004 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7005 7005 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7006 7006 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7007 7007 %INCLUDE\s*{.*rev=\"\d+\|.+\".*}\s*% 2 0 0 1 7008 7008 UNION.+SELECT 2 0 0 1 7009 7009 config\[include_dir\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7010 7010 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7011 7011 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7012 7012 vwar_root=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7013 7013 vwar_root=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7014 7014 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7015 7015 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7016 7016 .+SELECT.+FROM 2 0 0 1 7017 7017 .+UNION\s+SELECT 2 0 0 1 7018 7018 .+INSERT.+INTO 2 0 0 1 7019 7019 .+DELETE.+FROM 2 0 0 1 7020 7020 .+ASCII\(.+SELECT 2 0 0 1 7021 7021 plancia=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7022 7022 include_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7023 7023 include_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7024 7024 include_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7025 7025 include_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7026 7026 \/ws\/(login|get_reminders|get_events)\.php 2 0 0 1 7027 7027 SELECT.+FROM 2 0 0 1 7028 7028 UNION\s+SELECT 2 0 0 1 7029 7029 INSERT.+INTO 2 0 0 1 7030 7030 DELETE.+FROM 2 0 0 1 7031 7031 ASCII\(.+SELECT 2 0 0 1 7032 7032 UPDATE.+SET 2 0 0 1 7033 7033 GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7034 7034 GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7035 7035 GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7036 7036 config_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7037 7037 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7038 7038 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7039 7039 redirect_to=(ht|f)tps?\:\/ 2 0 0 1 7040 7040 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7041 7041 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7042 7042 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7043 7043 web_root=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7044 7044 web_root=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7045 7045 id=-?\d+.+UNION.+SELECT 2 0 0 1 7046 7046 set_menu=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7047 7047 context\[path_to_root\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7048 7048 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7049 7049 .+SELECT.+FROM 2 0 0 1 7050 7050 .+UNION\s+SELECT 2 0 0 1 7051 7051 .+INSERT.+INTO 2 0 0 1 7052 7052 .+DELETE.+FROM 2 0 0 1 7053 7053 .+ASCII\(.+SELECT 2 0 0 1 7054 7054 .+UPDATE.+SET 2 0 0 1 7055 7055 cct_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7056 7056 cct_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7057 7057 cct_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7058 7058 cct_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7059 7059 cct_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7060 7060 mod_root=\s*(https?|ftps?|php) 2 0 0 1 7061 7061 GLOBALS\[prefix\]=\s*(ftps?|https?|php)\:/ 2 0 0 1 7062 7062 .+SELECT.+FROM 2 0 0 1 7063 7063 .+UNION\s+SELECT 2 0 0 1 7064 7064 .+INSERT.+INTO 2 0 0 1 7065 7065 .+DELETE.+FROM 2 0 0 1 7066 7066 .+ASCII\(.+SELECT 2 0 0 1 7067 7067 .+UPDATE.+SET 2 0 0 1 7068 7068 .+SELECT.+FROM 2 0 0 1 7069 7069 .+UNION\s+SELECT 2 0 0 1 7070 7070 .+DELETE.+FROM 2 0 0 1 7071 7071 .+ASCII\(.+SELECT 2 0 0 1 7072 7072 .+UPDATE.+SET 2 0 0 1 7073 7073 .+SELECT.+FROM 2 0 0 1 7074 7074 .+UNION\s+SELECT 2 0 0 1 7075 7075 .+INSERT.+INTO 2 0 0 1 7076 7076 .+DELETE.+FROM 2 0 0 1 7077 7077 .+ASCII\(.+SELECT 2 0 0 1 7078 7078 .+UPDATE.+SET 2 0 0 1 7079 7079 e107path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7080 7080 inc_ordner=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7081 7081 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7082 7082 dirDepth=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7083 7083 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7084 7084 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7085 7085 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7086 7086 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7087 7087 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7088 7088 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7089 7089 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7090 7090 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7091 7091 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7092 7092 fs_jVroot\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7093 7093 fs_jVroot\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7094 7094 fs_jVroot\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7095 7095 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7096 7096 UPDATE\s+SELECT 2 0 0 1 7097 7097 INSERT.+INTO 2 0 0 1 7098 7098 DELETE.+FROM 2 0 0 1 7099 7099 ASCII\(.+SELECT 2 0 0 1 7100 7100 UPDATE.+SET 2 0 0 1 7101 7101 SELECT.+FROM 2 0 0 1 7102 7102 UNION\s+SELECT 2 0 0 1 7103 7103 INSERT.+INTO 2 0 0 1 7104 7104 DELETE.+FROM 2 0 0 1 7105 7105 ASCII\(.+SELECT 2 0 0 1 7106 7106 UPDATE.+SET 2 0 0 1 7107 7107 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7108 7108 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7109 7109 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7110 7110 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7111 7111 .*<?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7112 7112 content=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7113 7113 .+SELECT.+FROM 2 0 0 1 7114 7114 .+UNION\s+SELECT 2 0 0 1 7115 7115 .+INSERT.+INTO 2 0 0 1 7116 7116 .+DELETE.+FROM 2 0 0 1 7117 7117 .+ASCII\(.+SELECT 2 0 0 1 7118 7118 .+UPDATE.+SET 2 0 0 1 7119 7119 _path\[counter\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7120 7120 CFG\[txtsql\]\[class\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7121 7121 <?(java|vb)?script>?.*<.+\/script>? 2 0 0 1 7122 7122 SELECT.+FROM 2 0 0 1 7123 7123 UNION\s+SELECT 2 0 0 1 7124 7124 INSERT.+INTO 2 0 0 1 7125 7125 DELETE.+FROM 2 0 0 1 7126 7126 ASCII\(.+SELECT 2 0 0 1 7127 7127 UPDATE.+SET 2 0 0 1 7128 7128 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7129 7129 target=\w*\; 2 0 0 1 7130 7130 SELECT.+FROM 2 0 0 1 7131 7131 INSERT.+INTO 2 0 0 1 7132 7132 DELETE.+FROM 2 0 0 1 7133 7133 .+SELECT.+FROM 2 0 0 1 7134 7134 DELETE.+FROM 2 0 0 1 7135 7135 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7136 7136 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7137 7137 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7138 7138 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7139 7139 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7140 7140 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7141 7141 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7142 7142 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7143 7143 =\s*(https?|ftps?|php)\:\/ 2 0 0 1 7144 7144 GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7145 7145 apps_path\[themes\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7146 7146 apps_path\[libs\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7147 7147 UPDATE.+SET 2 0 0 1 7148 7148 site_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7149 7149 (\.\.\/){1} 2 0 0 1 7150 7150 (\.\.\/){1} 2 0 0 1 7151 7151 \/[a-z_]+\.php\/[a-z_]+\.php 2 0 0 1 7152 7152 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x0d\x0a 2 0 0 1 7153 7153 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*952E3F80-0C34-48CD-829B-A45913B29670 2 0 0 1 7154 7154 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7155 7155 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7156 7156 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7157 7157 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7158 7158 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7159 7159 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7160 7160 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7161 7161 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7162 7162 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7163 7163 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7164 7164 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7165 7165 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7166 7166 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7167 7167 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7168 7168 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7169 7169 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7170 7170 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7171 7171 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7172 7172 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7173 7173 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7174 7174 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7175 7175 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7176 7176 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7177 7177 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7178 7178 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7179 7179 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7180 7180 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7181 7181 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7182 7182 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7183 7183 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7184 7184 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7185 7185 ^\s*(https?|ftps?|php)\:\/ 2 0 0 1 7186 7186 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7187 7187 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7188 7188 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7189 7189 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7190 7190 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7191 7191 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7192 7192 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7193 7193 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7194 7194 ^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7195 7195 ^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7196 7196 cmd\x3D(filterHelper|getDeviceData\x26group\x3D).+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7197 7197 \x2Ejsp\x3F(clusterName|deviceName)\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7198 7198 ^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7199 7199 ^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7200 7200 ^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7201 7201 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7202 7202 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7203 7203 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7204 7204 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7205 7205 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7206 7206 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7207 7207 ^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7208 7208 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7209 7209 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7210 7210 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7211 7211 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7212 7212 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7213 7213 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7214 7214 ^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7215 7215 ^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7216 7216 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7217 7217 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7218 7218 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7219 7219 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7220 7220 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7221 7221 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7222 7222 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7223 7223 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7224 7224 ^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7225 7225 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7226 7226 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7227 7227 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7228 7228 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7229 7229 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7230 7230 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7231 7231 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D) 2 0 0 1 7232 7232 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D) 2 0 0 1 7233 7233 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7234 7234 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7235 7235 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7236 7236 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D) 2 0 0 1 7237 7237 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7238 7238 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7239 7239 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7240 7240 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7241 7241 (Loging|Hidden)Password\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7242 7242 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7243 7243 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7244 7244 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7245 7245 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7246 7246 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7247 7247 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7248 7248 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7249 7249 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7250 7250 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7251 7251 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7252 7252 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7253 7253 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7254 7254 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7255 7255 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7256 7256 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7257 7257 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7258 7258 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7259 7259 abspath=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7260 7260 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7261 7261 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7262 7262 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7263 7263 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7264 7264 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7265 7265 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7266 7266 basedir_save=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7267 7267 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7268 7268 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|marquee|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7269 7269 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7270 7270 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7271 7271 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7272 7272 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7273 7273 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7274 7274 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7275 7275 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7276 7276 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7277 7277 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7278 7278 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7279 7279 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7280 7280 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7281 7281 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7282 7282 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7283 7283 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7284 7284 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7285 7285 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7286 7286 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7287 7287 ^.{0,300}=(https|ftps) 2 0 0 1 7288 7288 ^-?\d+ 2 0 0 1 7289 7289 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7290 7290 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7291 7291 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7292 7292 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7293 7293 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7294 7294 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D) 2 0 0 1 7295 7295 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange style\x3D) 2 0 0 1 7296 7296 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7297 7297 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7298 7298 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7299 7299 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7300 7300 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7301 7301 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7302 7302 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7303 7303 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7304 7304 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7305 7305 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7306 7306 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7307 7307 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7308 7308 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7309 7309 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7310 7310 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7311 7311 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7312 7312 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7313 7313 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7314 7314 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7315 7315 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7316 7316 ^.*(ftps?|https?|php)\:\/ 2 0 0 1 7317 7317 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7318 7318 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7319 7319 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7320 7320 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7321 7321 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7322 7322 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7323 7323 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7324 7324 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7325 7325 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7326 7326 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7327 7327 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7328 7328 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7329 7329 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7330 7330 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7331 7331 ^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error)) 2 0 0 1 7332 7332 ^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7333 7333 ^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7334 7334 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7335 7335 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7336 7336 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7337 7337 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7338 7338 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7339 7339 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7340 7340 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7341 7341 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7342 7342 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7343 7343 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7344 7344 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7345 7345 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7346 7346 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7347 7347 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7348 7348 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7349 7349 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7350 7350 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7351 7351 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7352 7352 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7353 7353 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7354 7354 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7355 7355 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 7356 7356 id=-?\d+\s+UNION\s 2 0 0 1 7357 7357 output=\w 2 0 0 1 7358 7358 ^\w 2 0 0 1 7359 7359 ^\w 2 0 0 1 7360 7360 ^\w 2 0 0 1 7361 7361 ^\w 2 0 0 1 7362 7362 ^\w 2 0 0 1 7363 7363 ^\w 2 0 0 1 7364 7364 cmd=\w 2 0 0 1 7365 7365 (\?|&)(host|service|opt|end|start)=[^&]+?\x60.+?\x60 2 0 0 1 7366 7366 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7367 7367 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7368 7368 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7369 7369 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7370 7370 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7371 7371 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7372 7372 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7373 7373 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7374 7374 (\x3c|\x253c)dbInfo(\x3e|\x253e)[\r\n\s]*?(\x3c|\x253c)dbInfoRequest(\x3e|\x253e).+?(\x3c|\x253c)searchStr(\x3e|\x253e)(((\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e)).)+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)).+?(\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e) 2 0 0 1 7375 7375 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7376 7376 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7377 7377 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7378 7378 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7379 7379 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7380 7380 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7381 7381 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7382 7382 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=)) 2 0 0 1 7383 7383 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7384 7384 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7385 7385 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=)) 2 0 0 1 7386 7386 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7387 7387 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7388 7388 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7389 7389 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7390 7390 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7391 7391 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7392 7392 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7393 7393 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7394 7394 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7395 7395 ^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=)) 2 0 0 1 7396 7396 ^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=)) 2 0 0 1 7397 7397 ^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=)) 2 0 0 1 7398 7398 ^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=)) 2 0 0 1 7399 7399 ^\/?$ 2 0 0 1 7400 7400 ^\/?$ 2 0 0 1 7401 7401 ^\/?$ 2 0 0 1 7402 7402 ^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=)) 2 0 0 1 7403 7403 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7404 7404 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7405 7405 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7406 7406 ^.+\)\)\}catch\(.+\)\{ 2 0 0 1 7407 7407 a\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7408 7408 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 7409 7409 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 7410 7410 ^(-lncthumb|-sq_button)?\.php 2 0 0 1 7411 7411 [&?]f= 2 0 0 1 7412 7412 ^\s*\s*?[\x22\x27]?[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\))) 2 0 0 1 7413 7413 ^((ht|f)tps?|data|php) 2 0 0 1 7414 7414 [^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC) 2 0 0 1 7415 7415 [&?]highlight=[^&]*?\x2525[a-f0-9]{2} 2 0 0 1 7416 7416 btask\x3d.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error)) 2 0 0 1 7417 7417 &list\[select\]=[^\r\n&]*((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/)? 2 0 0 1 7418 7418 ^\{\d(\|\d){1,}\}\.\{\d(\|\d){1,}\}\{\d(\|\d){1,}\} 2 0 0 1 7419 7419 ^[^\r\n]*filename\s*=\s*[^\x3b\x3a\r\n]*[\x25\x24]\s*\{[^\r\n]{20,}\} 2 0 0 1 7420 7420 ^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d] 2 0 0 1 7421 7421 ^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d] 2 0 0 1 7422 7422 sort\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7423 7423 orderby\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7424 7424 UNION\s+SELECT 2 0 0 1 7425 7425 ((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO) 2 0 0 1 7426 7426 ((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)/Pmi 2 0 0 1 7427 7427 ((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO) 2 0 0 1 7428 7428 (%23|#)(access_callback|pre_render|post_render|lazy_builder) 2 0 0 1 7429 7429 (%(25)?23|#) 2 0 0 1 7430 7430 (%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder) 2 0 0 1 7431 7431 &orderby=([a-zA-Z0-9_])*[\x2c\x22\x27\x28] 2 0 0 1 7432 7432 ^([a-zA-Z0-9_])*[\x2c\x22\x27\x28] 2 0 0 1 7433 7433 ^([a-zA-Z0-9_])*[\x2c\x22\x27\x28] 2 0 0 1 7434 7434 ^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278]) 2 0 0 1 7435 7435 ^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278]) 2 0 0 1 7436 7436 ^([a-zA-Z0-9_])*[\x2c\x22\x27\x28] 2 0 0 1 7437 7437 ^[a-z0-9A-Z]+[^&]+[\x27\x22] 2 0 0 1 7438 7438 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7439 7439 ^[^&]*[\x22\x27\x28] 2 0 0 1 7440 7440 ^\[(%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder) 2 0 0 1 7441 7441 (Y21kIC9jIHBvd2Vyc2hlbGwuZXhl|NtZCAvYyBwb3dlcnNoZWxsLmV4Z|jbWQgL2MgcG93ZXJzaGVsbC5leG) 2 0 0 1 7442 7442 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7443 7443 (f0VM|9FT|\/RU) 2 0 0 1 7444 7444 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7445 7445 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7446 7446 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7447 7447 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7448 7448 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7449 7449 ^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 7450 7450 ^[a-z0-9A-Z]+\x252[270] 2 0 0 1 7451 7451 ^(\.\.\/){2,} 2 0 0 1 7452 7452 action\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7453 7453 url\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7454 7454 fm_includes_special=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7455 7455 UNION\s+SELECT 2 0 0 1 7456 7456 UNION\s+SELECT 2 0 0 1 7457 7457 INSERT.+INTO 2 0 0 1 7458 7458 DELETE.+FROM 2 0 0 1 7459 7459 ASCII\(.+SELECT 2 0 0 1 7460 7460 UPDATE.+SET 2 0 0 1 7461 7461 SELECT.+FROM 2 0 0 1 7462 7462 UNION\s+SELECT 2 0 0 1 7463 7463 INSERT.+INTO 2 0 0 1 7464 7464 DELETE.+FROM 2 0 0 1 7465 7465 ASCII\(.+SELECT 2 0 0 1 7466 7466 UPDATE.+SET 2 0 0 1 7467 7467 SELECT.+FROM 2 0 0 1 7468 7468 UNION\s+SELECT 2 0 0 1 7469 7469 INSERT.+INTO 2 0 0 1 7470 7470 DELETE.+FROM 2 0 0 1 7471 7471 ASCII\(.+SELECT 2 0 0 1 7472 7472 UPDATE.+SET 2 0 0 1 7473 7473 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7474 7474 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7475 7475 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7476 7476 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7477 7477 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7478 7478 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7479 7479 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7480 7480 config\[installdir\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7481 7481 SELECT.+FROM 2 0 0 1 7482 7482 UNION\s+SELECT 2 0 0 1 7483 7483 INSERT.+INTO 2 0 0 1 7484 7484 DELETE.+FROM 2 0 0 1 7485 7485 ASCII\(.+SELECT 2 0 0 1 7486 7486 UPDATE.+SET 2 0 0 1 7487 7487 UNION\s+SELECT 2 0 0 1 7488 7488 UNION\s+SELECT 2 0 0 1 7489 7489 INSERT.+INTO 2 0 0 1 7490 7490 DELETE.+FROM 2 0 0 1 7491 7491 ASCII\(.+SELECT 2 0 0 1 7492 7492 UPDATE.+SET 2 0 0 1 7493 7493 SELECT.+FROM 2 0 0 1 7494 7494 UNION\s+SELECT 2 0 0 1 7495 7495 INSERT.+INTO 2 0 0 1 7496 7496 DELETE.+FROM 2 0 0 1 7497 7497 ASCII\(.+SELECT 2 0 0 1 7498 7498 UPDATE.+SET 2 0 0 1 7499 7499 DELETE.+FROM 2 0 0 1 7500 7500 UNION\s+SELECT 2 0 0 1 7501 7501 DELETE.+FROM 2 0 0 1 7502 7502 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 7503 7503 UNION\s+SELECT 2 0 0 1 7504 7504 INSERT.+INTO 2 0 0 1 7505 7505 SELECT.+FROM 2 0 0 1 7506 7506 UNION\s+SELECT 2 0 0 1 7507 7507 DELETE.+FROM 2 0 0 1 7508 7508 ASCII\(.+SELECT 2 0 0 1 7509 7509 UPDATE.+SET 2 0 0 1 7510 7510 SELECT.+FROM 2 0 0 1 7511 7511 UNION\s+SELECT 2 0 0 1 7512 7512 SELECT.+FROM 2 0 0 1 7513 7513 UNION\s+SELECT 2 0 0 1 7514 7514 INSERT.+INTO 2 0 0 1 7515 7515 DELETE.+FROM 2 0 0 1 7516 7516 ASCII\(.+SELECT 2 0 0 1 7517 7517 UPDATE.+SET 2 0 0 1 7518 7518 SELECT.+FROM 2 0 0 1 7519 7519 UNION\s+SELECT 2 0 0 1 7520 7520 INSERT.+INTO 2 0 0 1 7521 7521 DELETE.+FROM 2 0 0 1 7522 7522 ASCII\(.+SELECT 2 0 0 1 7523 7523 UPDATE.+SET 2 0 0 1 7524 7524 SELECT.+FROM 2 0 0 1 7525 7525 UNION\s+SELECT 2 0 0 1 7526 7526 INSERT.+INTO 2 0 0 1 7527 7527 DELETE.+FROM 2 0 0 1 7528 7528 ASCII\(.+SELECT 2 0 0 1 7529 7529 UPDATE.+SET 2 0 0 1 7530 7530 SELECT.+FROM 2 0 0 1 7531 7531 UNION\s+SELECT 2 0 0 1 7532 7532 INSERT.+INTO 2 0 0 1 7533 7533 DELETE.+FROM 2 0 0 1 7534 7534 ASCII\(.+SELECT 2 0 0 1 7535 7535 UPDATE.+SET 2 0 0 1 7536 7536 SELECT.+FROM 2 0 0 1 7537 7537 UNION\s+SELECT 2 0 0 1 7538 7538 INSERT.+INTO 2 0 0 1 7539 7539 DELETE.+FROM 2 0 0 1 7540 7540 ASCII\(.+SELECT 2 0 0 1 7541 7541 UPDATE.+SET 2 0 0 1 7542 7542 SELECT.+FROM 2 0 0 1 7543 7543 UNION\s+SELECT 2 0 0 1 7544 7544 INSERT.+INTO 2 0 0 1 7545 7545 DELETE.+FROM 2 0 0 1 7546 7546 ASCII\(.+SELECT 2 0 0 1 7547 7547 UPDATE.+SET 2 0 0 1 7548 7548 customer_login.*\"> 2 0 0 1 7549 7549 UNION\s+SELECT 2 0 0 1 7550 7550 SELECT.+FROM 2 0 0 1 7551 7551 UNION\s+SELECT 2 0 0 1 7552 7552 INSERT.+INTO 2 0 0 1 7553 7553 DELETE.+FROM 2 0 0 1 7554 7554 ASCII\(.+SELECT 2 0 0 1 7555 7555 UPDATE.+SET 2 0 0 1 7556 7556 (\.\.\/){1,} 2 0 0 1 7557 7557 INSERT.+INTO 2 0 0 1 7558 7558 SELECT.+FROM 2 0 0 1 7559 7559 site_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7560 7560 mosConfig_live_site=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7561 7561 SELECT.+FROM 2 0 0 1 7562 7562 UNION.+SELECT 2 0 0 1 7563 7563 UPDATE.+SET 2 0 0 1 7564 7564 INSERT.+INTO 2 0 0 1 7565 7565 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7566 7566 intPassedLocationID\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7567 7567 task=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7568 7568 bn\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7569 7569 cat=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7570 7570 gid\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7571 7571 SELECT.+FROM 2 0 0 1 7572 7572 DELETE.+FROM 2 0 0 1 7573 7573 INSERT.+INTO 2 0 0 1 7574 7574 UPDATE.+SET 2 0 0 1 7575 7575 theme_file=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7576 7576 lang_file=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7577 7577 theme_file=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7578 7578 UNION.+SELECT 2 0 0 1 7579 7579 UNION\s+SELECT 2 0 0 1 7580 7580 GLOBALS\[MM_ROOT_DIRECTORY\]=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7581 7581 skin_file=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7582 7582 i\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7583 7583 fm_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7584 7584 mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7585 7585 doc_root=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7586 7586 HomeCurrent_Date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7587 7587 newlangsel=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 7588 7588 UNION.+SELECT 2 0 0 1 7589 7589 INSERT.+INTO 2 0 0 1 7590 7590 UPDATE.+SET 2 0 0 1 7591 7591 idart\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7592 7592 INSERT.+INTO 2 0 0 1 7593 7593 Login=[^\r\n]{300} 2 0 0 1 7594 7594 UNION\s+SELECT 2 0 0 1 7595 7595 (\?|&)pid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 7596 7596 (\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 7597 7597 SELECT.+FROM 2 0 0 1 7598 7598 UNION\s+SELECT 2 0 0 1 7599 7599 INSERT.+INTO 2 0 0 1 7600 7600 DELETE.+FROM 2 0 0 1 7601 7601 ASCII\(.+SELECT 2 0 0 1 7602 7602 UPDATE.+SET 2 0 0 1 7603 7603 UNION\s+SELECT 2 0 0 1 7604 7604 (script|img|src|onmouse|onkey|onload) 2 0 0 1 7605 7605 UNION\s+SELECT 2 0 0 1 7606 7606 UNION\s+SELECT 2 0 0 1 7607 7607 UNION\s+SELECT 2 0 0 1 7608 7608 INSERT.+INTO 2 0 0 1 7609 7609 DELETE.+FROM 2 0 0 1 7610 7610 ASCII\(.+SELECT 2 0 0 1 7611 7611 UPDATE.+SET 2 0 0 1 7612 7612 SELECT.+FROM 2 0 0 1 7613 7613 UNION\s+SELECT 2 0 0 1 7614 7614 INSERT.+INTO 2 0 0 1 7615 7615 DELETE.+FROM 2 0 0 1 7616 7616 ASCII\(.+SELECT 2 0 0 1 7617 7617 UPDATE.+SET 2 0 0 1 7618 7618 UNION\s+SELECT 2 0 0 1 7619 7619 chemin_lib\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7620 7620 SELECT.+FROM 2 0 0 1 7621 7621 DELETE.+FROM 2 0 0 1 7622 7622 UNION.+SELECT 2 0 0 1 7623 7623 INSERT.+INTO 2 0 0 1 7624 7624 UPDATE.+SET 2 0 0 1 7625 7625 Tipo=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7626 7626 UNION\s+SELECT 2 0 0 1 7627 7627 INSERT.+INTO 2 0 0 1 7628 7628 DELETE.+FROM 2 0 0 1 7629 7629 ASCII\(.+SELECT 2 0 0 1 7630 7630 UPDATE.+SET 2 0 0 1 7631 7631 SELECT.+FROM 2 0 0 1 7632 7632 UNION\s+SELECT 2 0 0 1 7633 7633 INSERT.+INTO 2 0 0 1 7634 7634 DELETE.+FROM 2 0 0 1 7635 7635 ASCII\(.+SELECT 2 0 0 1 7636 7636 UPDATE.+SET 2 0 0 1 7637 7637 UNION\s+SELECT 2 0 0 1 7638 7638 INSERT.+INTO 2 0 0 1 7639 7639 DELETE.+FROM 2 0 0 1 7640 7640 ASCII\(.+SELECT 2 0 0 1 7641 7641 UPDATE.+SET 2 0 0 1 7642 7642 phpAds_geoPlugin=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7643 7643 SELECT.+FROM 2 0 0 1 7644 7644 DELETE.+FROM 2 0 0 1 7645 7645 UNION.+SELECT 2 0 0 1 7646 7646 INSERT.+INTO 2 0 0 1 7647 7647 UPDATE.+SET 2 0 0 1 7648 7648 context\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7649 7649 SELECT.+FROM 2 0 0 1 7650 7650 UNION\s+SELECT 2 0 0 1 7651 7651 INSERT.+INTO 2 0 0 1 7652 7652 DELETE.+FROM 2 0 0 1 7653 7653 ASCII\(.+SELECT 2 0 0 1 7654 7654 UPDATE.+SET 2 0 0 1 7655 7655 SELECT.+FROM 2 0 0 1 7656 7656 UNION\s+SELECT 2 0 0 1 7657 7657 INSERT.+INTO 2 0 0 1 7658 7658 DELETE.+FROM 2 0 0 1 7659 7659 ASCII\(.+SELECT 2 0 0 1 7660 7660 UPDATE.+SET 2 0 0 1 7661 7661 UNION.+SELECT 2 0 0 1 7662 7662 UNION.+SELECT 2 0 0 1 7663 7663 UNION.+SELECT 2 0 0 1 7664 7664 SELECT.+FROM 2 0 0 1 7665 7665 UNION\s+SELECT 2 0 0 1 7666 7666 INSERT.+INTO 2 0 0 1 7667 7667 DELETE.+FROM 2 0 0 1 7668 7668 ASCII\(.+SELECT 2 0 0 1 7669 7669 UPDATE.+SET 2 0 0 1 7670 7670 UNION.+SELECT 2 0 0 1 7671 7671 UNION.+SELECT 2 0 0 1 7672 7672 .+UPDATE.+SET 2 0 0 1 7673 7673 .+UNION\s+SELECT 2 0 0 1 7674 7674 UNION\s+SELECT 2 0 0 1 7675 7675 INSERT.+INTO 2 0 0 1 7676 7676 DELETE.+FROM 2 0 0 1 7677 7677 ASCII\(.+SELECT 2 0 0 1 7678 7678 UPDATE.+SET 2 0 0 1 7679 7679 .+SELECT.+FROM 2 0 0 1 7680 7680 .+UNION\s+SELECT 2 0 0 1 7681 7681 .+INSERT.+INTO 2 0 0 1 7682 7682 .+DELETE.+FROM 2 0 0 1 7683 7683 .+ASCII\(.+SELECT 2 0 0 1 7684 7684 .+UPDATE.+SET 2 0 0 1 7685 7685 UNION\s+SELECT 2 0 0 1 7686 7686 UNION\s+SELECT 2 0 0 1 7687 7687 UNION\s+SELECT 2 0 0 1 7688 7688 (\.\.\/){1,} 2 0 0 1 7689 7689 PHPOF_INCLUDE_PATH=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7690 7690 UNION\s+SELECT 2 0 0 1 7691 7691 UNION\s+SELECT 2 0 0 1 7692 7692 UNION\s+SELECT 2 0 0 1 7693 7693 UNION\s+SELECT 2 0 0 1 7694 7694 UNION\s+SELECT 2 0 0 1 7695 7695 UNION\s+SELECT 2 0 0 1 7696 7696 UNION\s+SELECT 2 0 0 1 7697 7697 UNION\s+SELECT 2 0 0 1 7698 7698 UNION\s+SELECT 2 0 0 1 7699 7699 UNION\s+SELECT 2 0 0 1 7700 7700 INSERT.+INTO 2 0 0 1 7701 7701 DELETE.+FROM 2 0 0 1 7702 7702 ASCII\(.+SELECT 2 0 0 1 7703 7703 UPDATE.+SET 2 0 0 1 7704 7704 UNION\s+SELECT 2 0 0 1 7705 7705 UNION\s+SELECT 2 0 0 1 7706 7706 UNION\s+SELECT 2 0 0 1 7707 7707 (\?|&)category_id=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 7708 7708 SELECT.+FROM 2 0 0 1 7709 7709 DELETE.+FROM 2 0 0 1 7710 7710 UNION.+SELECT 2 0 0 1 7711 7711 INSERT.+INTO 2 0 0 1 7712 7712 UPDATE.+SET 2 0 0 1 7713 7713 SELECT.+FROM 2 0 0 1 7714 7714 DELETE.+FROM 2 0 0 1 7715 7715 UNION.+SELECT 2 0 0 1 7716 7716 INSERT.+INTO 2 0 0 1 7717 7717 UPDATE.+SET 2 0 0 1 7718 7718 UNION.+SELECT 2 0 0 1 7719 7719 UNION.+SELECT 2 0 0 1 7720 7720 SELECT.+FROM 2 0 0 1 7721 7721 UNION\s+SELECT 2 0 0 1 7722 7722 INSERT.+INTO 2 0 0 1 7723 7723 DELETE.+FROM 2 0 0 1 7724 7724 ASCII\(.+SELECT 2 0 0 1 7725 7725 UPDATE.+SET 2 0 0 1 7726 7726 SELECT.+FROM 2 0 0 1 7727 7727 UNION\s+SELECT 2 0 0 1 7728 7728 INSERT.+INTO 2 0 0 1 7729 7729 DELETE.+FROM 2 0 0 1 7730 7730 ASCII\(.+SELECT 2 0 0 1 7731 7731 UPDATE.+SET 2 0 0 1 7732 7732 SELECT.+FROM 2 0 0 1 7733 7733 UNION\s+SELECT 2 0 0 1 7734 7734 INSERT.+INTO 2 0 0 1 7735 7735 DELETE.+FROM 2 0 0 1 7736 7736 ASCII\(.+SELECT 2 0 0 1 7737 7737 UPDATE.+SET 2 0 0 1 7738 7738 SELECT.+FROM 2 0 0 1 7739 7739 UNION\s+SELECT 2 0 0 1 7740 7740 INSERT.+INTO 2 0 0 1 7741 7741 DELETE.+FROM 2 0 0 1 7742 7742 ASCII\(.+SELECT 2 0 0 1 7743 7743 UPDATE.+SET 2 0 0 1 7744 7744 SELECT.+FROM 2 0 0 1 7745 7745 UNION\s+SELECT 2 0 0 1 7746 7746 INSERT.+INTO 2 0 0 1 7747 7747 DELETE.+FROM 2 0 0 1 7748 7748 ASCII\(.+SELECT 2 0 0 1 7749 7749 UPDATE.+SET 2 0 0 1 7750 7750 .+SELECT.+FROM 2 0 0 1 7751 7751 .+UNION\s+SELECT 2 0 0 1 7752 7752 .+INSERT.+INTO 2 0 0 1 7753 7753 .+DELETE.+FROM 2 0 0 1 7754 7754 .+ASCII\(.+SELECT 2 0 0 1 7755 7755 .+UPDATE.+SET 2 0 0 1 7756 7756 UNION.+SELECT 2 0 0 1 7757 7757 SELECT.+FROM 2 0 0 1 7758 7758 UNION\s+SELECT 2 0 0 1 7759 7759 INSERT.+INTO 2 0 0 1 7760 7760 DELETE.+FROM 2 0 0 1 7761 7761 ASCII\(.+SELECT 2 0 0 1 7762 7762 UPDATE.+SET 2 0 0 1 7763 7763 SELECT.+FROM 2 0 0 1 7764 7764 UNION\s+SELECT 2 0 0 1 7765 7765 INSERT.+INTO 2 0 0 1 7766 7766 DELETE.+FROM 2 0 0 1 7767 7767 ASCII\(.+SELECT 2 0 0 1 7768 7768 UPDATE.+SET 2 0 0 1 7769 7769 SELECT.+FROM 2 0 0 1 7770 7770 UNION\s+SELECT 2 0 0 1 7771 7771 INSERT.+INTO 2 0 0 1 7772 7772 DELETE.+FROM 2 0 0 1 7773 7773 ASCII\(.+SELECT 2 0 0 1 7774 7774 UPDATE.+SET 2 0 0 1 7775 7775 SELECT.+FROM 2 0 0 1 7776 7776 UNION\s+SELECT 2 0 0 1 7777 7777 INSERT.+INTO 2 0 0 1 7778 7778 DELETE.+FROM 2 0 0 1 7779 7779 ASCII\(.+SELECT 2 0 0 1 7780 7780 UPDATE.+SET 2 0 0 1 7781 7781 UNION.+SELECT 2 0 0 1 7782 7782 UNION.+SELECT 2 0 0 1 7783 7783 UNION.+SELECT 2 0 0 1 7784 7784 UNION.+SELECT 2 0 0 1 7785 7785 pcConfig\[smartyPath\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7786 7786 SELECT.+FROM 2 0 0 1 7787 7787 UNION\s+SELECT 2 0 0 1 7788 7788 INSERT.+INTO 2 0 0 1 7789 7789 DELETE.+FROM 2 0 0 1 7790 7790 ASCII\(.+SELECT 2 0 0 1 7791 7791 UPDATE.+SET 2 0 0 1 7792 7792 SELECT.+FROM 2 0 0 1 7793 7793 UNION\s+SELECT 2 0 0 1 7794 7794 INSERT.+INTO 2 0 0 1 7795 7795 DELETE.+FROM 2 0 0 1 7796 7796 ASCII\(.+SELECT 2 0 0 1 7797 7797 UPDATE.+SET 2 0 0 1 7798 7798 SELECT.+FROM 2 0 0 1 7799 7799 UNION\s+SELECT 2 0 0 1 7800 7800 INSERT.+INTO 2 0 0 1 7801 7801 DELETE.+FROM 2 0 0 1 7802 7802 ASCII\(.+SELECT 2 0 0 1 7803 7803 UPDATE.+SET 2 0 0 1 7804 7804 SELECT.+FROM 2 0 0 1 7805 7805 UNION\s+SELECT 2 0 0 1 7806 7806 INSERT.+INTO 2 0 0 1 7807 7807 DELETE.+FROM 2 0 0 1 7808 7808 ASCII\(.+SELECT 2 0 0 1 7809 7809 UPDATE.+SET 2 0 0 1 7810 7810 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 7811 7811 UNION.+SELECT 2 0 0 1 7812 7812 UNION.+SELECT 2 0 0 1 7813 7813 (\?|&)id=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 7814 7814 UNION.+SELECT 2 0 0 1 7815 7815 DELETE.+FROM 2 0 0 1 7816 7816 ASCII\(.+SELECT 2 0 0 1 7817 7817 UPDATE.+SET 2 0 0 1 7818 7818 sPath\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7819 7819 UNION.+SELECT 2 0 0 1 7820 7820 SELECT.+FROM 2 0 0 1 7821 7821 DELETE.+FROM 2 0 0 1 7822 7822 UNION.+SELECT 2 0 0 1 7823 7823 INSERT.+INTO 2 0 0 1 7824 7824 UPDATE.+SET 2 0 0 1 7825 7825 UNION.+SELECT 2 0 0 1 7826 7826 config\[library_path\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7827 7827 UNION.+SELECT 2 0 0 1 7828 7828 SELECT.+FROM 2 0 0 1 7829 7829 UNION\s+SELECT 2 0 0 1 7830 7830 INSERT.+INTO 2 0 0 1 7831 7831 DELETE.+FROM 2 0 0 1 7832 7832 ASCII\(.+SELECT 2 0 0 1 7833 7833 UPDATE.+SET 2 0 0 1 7834 7834 SELECT.+FROM 2 0 0 1 7835 7835 UNION\s+SELECT 2 0 0 1 7836 7836 INSERT.+INTO 2 0 0 1 7837 7837 DELETE.+FROM 2 0 0 1 7838 7838 ASCII\(.+SELECT 2 0 0 1 7839 7839 UPDATE.+SET 2 0 0 1 7840 7840 SELECT.+FROM 2 0 0 1 7841 7841 UNION\s+SELECT 2 0 0 1 7842 7842 INSERT.+INTO 2 0 0 1 7843 7843 DELETE.+FROM 2 0 0 1 7844 7844 ASCII\(.+SELECT 2 0 0 1 7845 7845 UPDATE.+SET 2 0 0 1 7846 7846 SELECT.+FROM 2 0 0 1 7847 7847 UNION\s+SELECT 2 0 0 1 7848 7848 INSERT.+INTO 2 0 0 1 7849 7849 DELETE.+FROM 2 0 0 1 7850 7850 ASCII\(.+SELECT 2 0 0 1 7851 7851 UPDATE.+SET 2 0 0 1 7852 7852 SELECT.+FROM 2 0 0 1 7853 7853 UNION\s+SELECT 2 0 0 1 7854 7854 INSERT.+INTO 2 0 0 1 7855 7855 DELETE.+FROM 2 0 0 1 7856 7856 ASCII\(.+SELECT 2 0 0 1 7857 7857 UPDATE.+SET 2 0 0 1 7858 7858 UNION.+SELECT 2 0 0 1 7859 7859 UNION.+SELECT 2 0 0 1 7860 7860 UNION.+SELECT 2 0 0 1 7861 7861 .+SELECT.+FROM 2 0 0 1 7862 7862 .+UNION\s+SELECT 2 0 0 1 7863 7863 .+INSERT.+INTO 2 0 0 1 7864 7864 .+DELETE.+FROM 2 0 0 1 7865 7865 .+ASCII\(.+SELECT 2 0 0 1 7866 7866 .+UPDATE.+SET 2 0 0 1 7867 7867 .+SELECT.+FROM 2 0 0 1 7868 7868 .+UNION\s+SELECT 2 0 0 1 7869 7869 .+INSERT.+INTO 2 0 0 1 7870 7870 .+DELETE.+FROM 2 0 0 1 7871 7871 .+ASCII\(.+SELECT 2 0 0 1 7872 7872 .+UPDATE.+SET 2 0 0 1 7873 7873 REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7874 7874 REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7875 7875 UNION.+SELECT 2 0 0 1 7876 7876 UNION.+SELECT 2 0 0 1 7877 7877 SELECT.+FROM 2 0 0 1 7878 7878 UNION\s+SELECT 2 0 0 1 7879 7879 INSERT.+INTO 2 0 0 1 7880 7880 DELETE.+FROM 2 0 0 1 7881 7881 ASCII\(.+SELECT 2 0 0 1 7882 7882 UPDATE.+SET 2 0 0 1 7883 7883 SELECT.+FROM 2 0 0 1 7884 7884 UNION\s+SELECT 2 0 0 1 7885 7885 INSERT.+INTO 2 0 0 1 7886 7886 DELETE.+FROM 2 0 0 1 7887 7887 ASCII\(.+SELECT 2 0 0 1 7888 7888 UPDATE.+SET 2 0 0 1 7889 7889 SELECT.+FROM 2 0 0 1 7890 7890 UNION\s+SELECT 2 0 0 1 7891 7891 INSERT.+INTO 2 0 0 1 7892 7892 DELETE.+FROM 2 0 0 1 7893 7893 ASCII\(.+SELECT 2 0 0 1 7894 7894 UPDATE.+SET 2 0 0 1 7895 7895 SELECT.+FROM 2 0 0 1 7896 7896 UNION\s+SELECT 2 0 0 1 7897 7897 INSERT.+INTO 2 0 0 1 7898 7898 DELETE.+FROM 2 0 0 1 7899 7899 ASCII\(.+SELECT 2 0 0 1 7900 7900 UPDATE.+SET 2 0 0 1 7901 7901 SELECT.+FROM 2 0 0 1 7902 7902 UNION\s+SELECT 2 0 0 1 7903 7903 INSERT.+INTO 2 0 0 1 7904 7904 DELETE.+FROM 2 0 0 1 7905 7905 ASCII\(.+SELECT 2 0 0 1 7906 7906 UPDATE.+SET 2 0 0 1 7907 7907 SELECT.+FROM 2 0 0 1 7908 7908 UNION\s+SELECT 2 0 0 1 7909 7909 INSERT.+INTO 2 0 0 1 7910 7910 DELETE.+FROM 2 0 0 1 7911 7911 ASCII\(.+SELECT 2 0 0 1 7912 7912 UPDATE.+SET 2 0 0 1 7913 7913 SELECT.+FROM 2 0 0 1 7914 7914 UNION\s+SELECT 2 0 0 1 7915 7915 INSERT.+INTO 2 0 0 1 7916 7916 DELETE.+FROM 2 0 0 1 7917 7917 ASCII\(.+SELECT 2 0 0 1 7918 7918 UPDATE.+SET 2 0 0 1 7919 7919 SELECT.+FROM 2 0 0 1 7920 7920 UNION\s+SELECT 2 0 0 1 7921 7921 INSERT.+INTO 2 0 0 1 7922 7922 DELETE.+FROM 2 0 0 1 7923 7923 ASCII\(.+SELECT 2 0 0 1 7924 7924 UPDATE.+SET 2 0 0 1 7925 7925 SELECT.+FROM 2 0 0 1 7926 7926 UNION\s+SELECT 2 0 0 1 7927 7927 INSERT.+INTO 2 0 0 1 7928 7928 DELETE.+FROM 2 0 0 1 7929 7929 ASCII\(.+SELECT 2 0 0 1 7930 7930 UPDATE.+SET 2 0 0 1 7931 7931 SELECT.+FROM 2 0 0 1 7932 7932 UNION\s+SELECT 2 0 0 1 7933 7933 INSERT.+INTO 2 0 0 1 7934 7934 DELETE.+FROM 2 0 0 1 7935 7935 ASCII\(.+SELECT 2 0 0 1 7936 7936 UPDATE.+SET 2 0 0 1 7937 7937 SELECT.+FROM 2 0 0 1 7938 7938 UNION\s+SELECT 2 0 0 1 7939 7939 INSERT.+INTO 2 0 0 1 7940 7940 DELETE.+FROM 2 0 0 1 7941 7941 ASCII\(.+SELECT 2 0 0 1 7942 7942 UPDATE.+SET 2 0 0 1 7943 7943 SELECT.+FROM 2 0 0 1 7944 7944 UNION\s+SELECT 2 0 0 1 7945 7945 INSERT.+INTO 2 0 0 1 7946 7946 DELETE.+FROM 2 0 0 1 7947 7947 ASCII\(.+SELECT 2 0 0 1 7948 7948 UPDATE.+SET 2 0 0 1 7949 7949 SELECT.+FROM 2 0 0 1 7950 7950 UNION\s+SELECT 2 0 0 1 7951 7951 INSERT.+INTO 2 0 0 1 7952 7952 DELETE.+FROM 2 0 0 1 7953 7953 ASCII\(.+SELECT 2 0 0 1 7954 7954 UPDATE.+SET 2 0 0 1 7955 7955 SELECT.+FROM 2 0 0 1 7956 7956 UNION\s+SELECT 2 0 0 1 7957 7957 INSERT.+INTO 2 0 0 1 7958 7958 DELETE.+FROM 2 0 0 1 7959 7959 ASCII\(.+SELECT 2 0 0 1 7960 7960 UPDATE.+SET 2 0 0 1 7961 7961 SELECT.+FROM 2 0 0 1 7962 7962 DELETE.+FROM 2 0 0 1 7963 7963 UNION.+SELECT 2 0 0 1 7964 7964 (\?|&)admin=[^\x26\x3B]*([\x2F\x5C\x00]|\x2E\x2E) 2 0 0 1 7965 7965 _SERWEB\[configdir\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7966 7966 _SERWEB\[functionsdir\]=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7967 7967 UNION.+SELECT 2 0 0 1 7968 7968 UNION.+SELECT 2 0 0 1 7969 7969 cs_base_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 7970 7970 SELECT.+FROM 2 0 0 1 7971 7971 UNION\s+SELECT 2 0 0 1 7972 7972 INSERT.+INTO 2 0 0 1 7973 7973 DELETE.+FROM 2 0 0 1 7974 7974 ASCII\(.+SELECT 2 0 0 1 7975 7975 UPDATE.+SET 2 0 0 1 7976 7976 class_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7977 7977 class_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 7978 7978 SELECT.+FROM 2 0 0 1 7979 7979 UNION\s+SELECT 2 0 0 1 7980 7980 INSERT.+INTO 2 0 0 1 7981 7981 DELETE.+FROM 2 0 0 1 7982 7982 ASCII\(.+SELECT 2 0 0 1 7983 7983 UPDATE.+SET 2 0 0 1 7984 7984 SELECT.+FROM 2 0 0 1 7985 7985 UNION\s+SELECT 2 0 0 1 7986 7986 INSERT.+INTO 2 0 0 1 7987 7987 DELETE.+FROM 2 0 0 1 7988 7988 ASCII\(.+SELECT 2 0 0 1 7989 7989 UPDATE.+SET 2 0 0 1 7990 7990 SELECT.+FROM 2 0 0 1 7991 7991 UNION\s+SELECT 2 0 0 1 7992 7992 INSERT.+INTO 2 0 0 1 7993 7993 DELETE.+FROM 2 0 0 1 7994 7994 ASCII\(.+SELECT 2 0 0 1 7995 7995 UPDATE.+SET 2 0 0 1 7996 7996 SELECT.+FROM 2 0 0 1 7997 7997 UNION\s+SELECT 2 0 0 1 7998 7998 INSERT.+INTO 2 0 0 1 7999 7999 DELETE.+FROM 2 0 0 1 8000 8000 ASCII\(.+SELECT 2 0 0 1 8001 8001 UPDATE.+SET 2 0 0 1 8002 8002 SELECT.+FROM 2 0 0 1 8003 8003 UNION\s+SELECT 2 0 0 1 8004 8004 INSERT.+INTO 2 0 0 1 8005 8005 DELETE.+FROM 2 0 0 1 8006 8006 ASCII\(.+SELECT 2 0 0 1 8007 8007 UPDATE.+SET 2 0 0 1 8008 8008 SELECT.+FROM 2 0 0 1 8009 8009 DELETE.+FROM 2 0 0 1 8010 8010 UNION.+SELECT 2 0 0 1 8011 8011 INSERT.+INTO 2 0 0 1 8012 8012 UPDATE.+SET 2 0 0 1 8013 8013 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8014 8014 SELECT.+FROM 2 0 0 1 8015 8015 UNION\s+SELECT 2 0 0 1 8016 8016 INSERT.+INTO 2 0 0 1 8017 8017 DELETE.+FROM 2 0 0 1 8018 8018 ASCII\(.+SELECT 2 0 0 1 8019 8019 UPDATE.+SET 2 0 0 1 8020 8020 UNION.+SELECT 2 0 0 1 8021 8021 UNION.+SELECT 2 0 0 1 8022 8022 SELECT.+FROM 2 0 0 1 8023 8023 UNION\s+SELECT 2 0 0 1 8024 8024 INSERT.+INTO 2 0 0 1 8025 8025 DELETE.+FROM 2 0 0 1 8026 8026 ASCII\(.+SELECT 2 0 0 1 8027 8027 UPDATE.+SET 2 0 0 1 8028 8028 UNION.+SELECT 2 0 0 1 8029 8029 UNION\s+SELECT 2 0 0 1 8030 8030 SELECT.+FROM 2 0 0 1 8031 8031 UNION\s+SELECT 2 0 0 1 8032 8032 INSERT.+INTO 2 0 0 1 8033 8033 DELETE.+FROM 2 0 0 1 8034 8034 ASCII\(.+SELECT 2 0 0 1 8035 8035 UPDATE.+SET 2 0 0 1 8036 8036 UNION\s+SELECT 2 0 0 1 8037 8037 SELECT.+FROM 2 0 0 1 8038 8038 UNION\s+SELECT 2 0 0 1 8039 8039 INSERT.+INTO 2 0 0 1 8040 8040 DELETE.+FROM 2 0 0 1 8041 8041 ASCII\(.+SELECT 2 0 0 1 8042 8042 UPDATE.+SET 2 0 0 1 8043 8043 SELECT.+FROM 2 0 0 1 8044 8044 UNION\s+SELECT 2 0 0 1 8045 8045 INSERT.+INTO 2 0 0 1 8046 8046 DELETE.+FROM 2 0 0 1 8047 8047 ASCII\(.+SELECT 2 0 0 1 8048 8048 UPDATE.+SET 2 0 0 1 8049 8049 SELECT.+FROM 2 0 0 1 8050 8050 UNION\s+SELECT 2 0 0 1 8051 8051 INSERT.+INTO 2 0 0 1 8052 8052 DELETE.+FROM 2 0 0 1 8053 8053 ASCII\(.+SELECT 2 0 0 1 8054 8054 UPDATE.+SET 2 0 0 1 8055 8055 site_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8056 8056 theme=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8057 8057 UNION.+SELECT 2 0 0 1 8058 8058 SELECT.+FROM 2 0 0 1 8059 8059 UNION\s+SELECT 2 0 0 1 8060 8060 INSERT.+INTO 2 0 0 1 8061 8061 DELETE.+FROM 2 0 0 1 8062 8062 ASCII\(.+SELECT 2 0 0 1 8063 8063 UPDATE.+SET 2 0 0 1 8064 8064 SELECT.+FROM 2 0 0 1 8065 8065 UNION\s+SELECT 2 0 0 1 8066 8066 INSERT.+INTO 2 0 0 1 8067 8067 DELETE.+FROM 2 0 0 1 8068 8068 ASCII\(.+SELECT 2 0 0 1 8069 8069 UPDATE.+SET 2 0 0 1 8070 8070 SELECT.+FROM 2 0 0 1 8071 8071 UNION\s+SELECT 2 0 0 1 8072 8072 INSERT.+INTO 2 0 0 1 8073 8073 DELETE.+FROM 2 0 0 1 8074 8074 ASCII\(.+SELECT 2 0 0 1 8075 8075 UPDATE.+SET 2 0 0 1 8076 8076 SELECT.+FROM 2 0 0 1 8077 8077 UNION\s+SELECT 2 0 0 1 8078 8078 INSERT.+INTO 2 0 0 1 8079 8079 DELETE.+FROM 2 0 0 1 8080 8080 ASCII\(.+SELECT 2 0 0 1 8081 8081 UPDATE.+SET 2 0 0 1 8082 8082 SELECT.+FROM 2 0 0 1 8083 8083 UNION\s+SELECT 2 0 0 1 8084 8084 INSERT.+INTO 2 0 0 1 8085 8085 DELETE.+FROM 2 0 0 1 8086 8086 ASCII\(.+SELECT 2 0 0 1 8087 8087 UPDATE.+SET 2 0 0 1 8088 8088 UNION.+SELECT 2 0 0 1 8089 8089 objects_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8090 8090 objects_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8091 8091 SELECT.+FROM 2 0 0 1 8092 8092 UNION\s+SELECT 2 0 0 1 8093 8093 INSERT.+INTO 2 0 0 1 8094 8094 DELETE.+FROM 2 0 0 1 8095 8095 ASCII\(.+SELECT 2 0 0 1 8096 8096 UPDATE.+SET 2 0 0 1 8097 8097 .+SELECT.+FROM 2 0 0 1 8098 8098 .+UNION\s+SELECT 2 0 0 1 8099 8099 .+INSERT.+INTO 2 0 0 1 8100 8100 .+DELETE.+FROM 2 0 0 1 8101 8101 .+ASCII\(.+SELECT 2 0 0 1 8102 8102 .+UPDATE.+SET 2 0 0 1 8103 8103 \/servlet\/dea\/register\?fwReg=[>\"] 2 0 0 1 8104 8104 \/sgms\/caption\.jsp\?.*scrn_name=.*[>\"] 2 0 0 1 8105 8105 neededFiles\[patForms\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8106 8106 SELECT.+FROM 2 0 0 1 8107 8107 UNION\s+SELECT 2 0 0 1 8108 8108 INSERT.+INTO 2 0 0 1 8109 8109 DELETE.+FROM 2 0 0 1 8110 8110 ASCII\(.+SELECT 2 0 0 1 8111 8111 UPDATE.+SET 2 0 0 1 8112 8112 SELECT.+FROM 2 0 0 1 8113 8113 UNION\s+SELECT 2 0 0 1 8114 8114 INSERT.+INTO 2 0 0 1 8115 8115 DELETE.+FROM 2 0 0 1 8116 8116 ASCII\(.+SELECT 2 0 0 1 8117 8117 UPDATE.+SET 2 0 0 1 8118 8118 UNION.+SELECT 2 0 0 1 8119 8119 UNION.+SELECT 2 0 0 1 8120 8120 SELECT.+FROM 2 0 0 1 8121 8121 UNION\s+SELECT 2 0 0 1 8122 8122 INSERT.+INTO 2 0 0 1 8123 8123 DELETE.+FROM 2 0 0 1 8124 8124 ASCII\(.+SELECT 2 0 0 1 8125 8125 UPDATE.+SET 2 0 0 1 8126 8126 .+SELECT.+FROM 2 0 0 1 8127 8127 .+UNION\s+SELECT 2 0 0 1 8128 8128 .+INSERT.+INTO 2 0 0 1 8129 8129 .+DELETE.+FROM 2 0 0 1 8130 8130 .+ASCII\(.+SELECT 2 0 0 1 8131 8131 .+UPDATE.+SET 2 0 0 1 8132 8132 .+SELECT.+FROM 2 0 0 1 8133 8133 .+UNION\s+SELECT 2 0 0 1 8134 8134 .+INSERT.+INTO 2 0 0 1 8135 8135 .+DELETE.+FROM 2 0 0 1 8136 8136 .+ASCII\(.+SELECT 2 0 0 1 8137 8137 .+UPDATE.+SET 2 0 0 1 8138 8138 .+SELECT.+FROM 2 0 0 1 8139 8139 .+UNION\s+SELECT 2 0 0 1 8140 8140 .+INSERT.+INTO 2 0 0 1 8141 8141 .+DELETE.+FROM 2 0 0 1 8142 8142 .+ASCII\(.+SELECT 2 0 0 1 8143 8143 .+SELECT.+FROM 2 0 0 1 8144 8144 .+UNION\s+SELECT 2 0 0 1 8145 8145 .+INSERT.+INTO 2 0 0 1 8146 8146 .+DELETE.+FROM 2 0 0 1 8147 8147 .+ASCII\(.+SELECT 2 0 0 1 8148 8148 .+UPDATE.+SET 2 0 0 1 8149 8149 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8150 8150 UNION.+SELECT 2 0 0 1 8151 8151 SELECT.+FROM 2 0 0 1 8152 8152 UNION\s+SELECT 2 0 0 1 8153 8153 INSERT.+INTO 2 0 0 1 8154 8154 DELETE.+FROM 2 0 0 1 8155 8155 ASCII\(.+SELECT 2 0 0 1 8156 8156 UPDATE.+SET 2 0 0 1 8157 8157 SELECT.+FROM 2 0 0 1 8158 8158 UNION\s+SELECT 2 0 0 1 8159 8159 INSERT.+INTO 2 0 0 1 8160 8160 DELETE.+FROM 2 0 0 1 8161 8161 ASCII\(.+SELECT 2 0 0 1 8162 8162 UPDATE.+SET 2 0 0 1 8163 8163 SELECT.+FROM 2 0 0 1 8164 8164 UNION\s+SELECT 2 0 0 1 8165 8165 INSERT.+INTO 2 0 0 1 8166 8166 DELETE.+FROM 2 0 0 1 8167 8167 ASCII\(.+SELECT 2 0 0 1 8168 8168 UPDATE.+SET 2 0 0 1 8169 8169 SELECT.+FROM 2 0 0 1 8170 8170 INSERT.+INTO 2 0 0 1 8171 8171 DELETE.+FROM 2 0 0 1 8172 8172 ASCII\(.+SELECT 2 0 0 1 8173 8173 UPDATE.+SET 2 0 0 1 8174 8174 SELECT.+FROM 2 0 0 1 8175 8175 UNION\s+SELECT 2 0 0 1 8176 8176 INSERT.+INTO 2 0 0 1 8177 8177 DELETE.+FROM 2 0 0 1 8178 8178 ASCII\(.+SELECT 2 0 0 1 8179 8179 UPDATE.+SET 2 0 0 1 8180 8180 SELECT.+FROM 2 0 0 1 8181 8181 UNION\s+SELECT 2 0 0 1 8182 8182 INSERT.+INTO 2 0 0 1 8183 8183 DELETE.+FROM 2 0 0 1 8184 8184 ASCII\(.+SELECT 2 0 0 1 8185 8185 UPDATE.+SET 2 0 0 1 8186 8186 SELECT.+FROM 2 0 0 1 8187 8187 UNION\s+SELECT 2 0 0 1 8188 8188 INSERT.+INTO 2 0 0 1 8189 8189 DELETE.+FROM 2 0 0 1 8190 8190 ASCII\(.+SELECT 2 0 0 1 8191 8191 UPDATE.+SET 2 0 0 1 8192 8192 SELECT.+FROM 2 0 0 1 8193 8193 UNION\s+SELECT 2 0 0 1 8194 8194 INSERT.+INTO 2 0 0 1 8195 8195 DELETE.+FROM 2 0 0 1 8196 8196 ASCII\(.+SELECT 2 0 0 1 8197 8197 UPDATE.+SET 2 0 0 1 8198 8198 SELECT.+FROM 2 0 0 1 8199 8199 UNION\s+SELECT 2 0 0 1 8200 8200 INSERT.+INTO 2 0 0 1 8201 8201 DELETE.+FROM 2 0 0 1 8202 8202 ASCII\(.+SELECT 2 0 0 1 8203 8203 UPDATE.+SET 2 0 0 1 8204 8204 SELECT.+FROM 2 0 0 1 8205 8205 UNION\s+SELECT 2 0 0 1 8206 8206 INSERT.+INTO 2 0 0 1 8207 8207 DELETE.+FROM 2 0 0 1 8208 8208 ASCII\(.+SELECT 2 0 0 1 8209 8209 UPDATE.+SET 2 0 0 1 8210 8210 SELECT.+FROM 2 0 0 1 8211 8211 UNION\s+SELECT 2 0 0 1 8212 8212 INSERT.+INTO 2 0 0 1 8213 8213 DELETE.+FROM 2 0 0 1 8214 8214 ASCII\(.+SELECT 2 0 0 1 8215 8215 UPDATE.+SET 2 0 0 1 8216 8216 SELECT.+FROM 2 0 0 1 8217 8217 UNION\s+SELECT 2 0 0 1 8218 8218 INSERT.+INTO 2 0 0 1 8219 8219 DELETE.+FROM 2 0 0 1 8220 8220 ASCII\(.+SELECT 2 0 0 1 8221 8221 UPDATE.+SET 2 0 0 1 8222 8222 SELECT.+FROM 2 0 0 1 8223 8223 UNION\s+SELECT 2 0 0 1 8224 8224 INSERT.+INTO 2 0 0 1 8225 8225 DELETE.+FROM 2 0 0 1 8226 8226 ASCII\(.+SELECT 2 0 0 1 8227 8227 UPDATE.+SET 2 0 0 1 8228 8228 UNION.+SELECT 2 0 0 1 8229 8229 UNION.+SELECT 2 0 0 1 8230 8230 UNION.+SELECT 2 0 0 1 8231 8231 UNION.+SELECT 2 0 0 1 8232 8232 UNION.+SELECT 2 0 0 1 8233 8233 UNION.+SELECT 2 0 0 1 8234 8234 SELECT.+FROM 2 0 0 1 8235 8235 UNION\s+SELECT 2 0 0 1 8236 8236 INSERT.+INTO 2 0 0 1 8237 8237 DELETE.+FROM 2 0 0 1 8238 8238 ASCII\(.+SELECT 2 0 0 1 8239 8239 UPDATE.+SET 2 0 0 1 8240 8240 SELECT.+FROM 2 0 0 1 8241 8241 UNION\s+SELECT 2 0 0 1 8242 8242 INSERT.+INTO 2 0 0 1 8243 8243 DELETE.+FROM 2 0 0 1 8244 8244 ASCII\(.+SELECT 2 0 0 1 8245 8245 UPDATE.+SET 2 0 0 1 8246 8246 SELECT.+FROM 2 0 0 1 8247 8247 UNION\s+SELECT 2 0 0 1 8248 8248 INSERT.+INTO 2 0 0 1 8249 8249 DELETE.+FROM 2 0 0 1 8250 8250 ASCII\(.+SELECT 2 0 0 1 8251 8251 UPDATE.+SET 2 0 0 1 8252 8252 SELECT.+FROM 2 0 0 1 8253 8253 UNION\s+SELECT 2 0 0 1 8254 8254 INSERT.+INTO 2 0 0 1 8255 8255 DELETE.+FROM 2 0 0 1 8256 8256 ASCII\(.+SELECT 2 0 0 1 8257 8257 UPDATE.+SET 2 0 0 1 8258 8258 .+SELECT.+FROM 2 0 0 1 8259 8259 .+UNION\s+SELECT 2 0 0 1 8260 8260 .+INSERT.+INTO 2 0 0 1 8261 8261 .+DELETE.+FROM 2 0 0 1 8262 8262 .+ASCII\(.+SELECT 2 0 0 1 8263 8263 .+UPDATE.+SET 2 0 0 1 8264 8264 .+SELECT.+FROM 2 0 0 1 8265 8265 .+UNION\s+SELECT 2 0 0 1 8266 8266 .+INSERT.+INTO 2 0 0 1 8267 8267 .+DELETE.+FROM 2 0 0 1 8268 8268 .+ASCII\(.+SELECT 2 0 0 1 8269 8269 .+UPDATE.+SET 2 0 0 1 8270 8270 SELECT.+FROM 2 0 0 1 8271 8271 UNION\s+SELECT 2 0 0 1 8272 8272 INSERT.+INTO 2 0 0 1 8273 8273 DELETE.+FROM 2 0 0 1 8274 8274 ASCII\(.+SELECT 2 0 0 1 8275 8275 UPDATE.+SET 2 0 0 1 8276 8276 .+SELECT.+FROM 2 0 0 1 8277 8277 .+UNION\s+SELECT 2 0 0 1 8278 8278 .+INSERT.+INTO 2 0 0 1 8279 8279 .+DELETE.+FROM 2 0 0 1 8280 8280 .+ASCII\(.+SELECT 2 0 0 1 8281 8281 .+UPDATE.+SET 2 0 0 1 8282 8282 .+SELECT.+FROM 2 0 0 1 8283 8283 .+UNION\s+SELECT 2 0 0 1 8284 8284 .+INSERT.+INTO 2 0 0 1 8285 8285 .+DELETE.+FROM 2 0 0 1 8286 8286 .+ASCII\(.+SELECT 2 0 0 1 8287 8287 .+UPDATE.+SET 2 0 0 1 8288 8288 SELECT.+FROM 2 0 0 1 8289 8289 UNION\s+SELECT 2 0 0 1 8290 8290 INSERT.+INTO 2 0 0 1 8291 8291 DELETE.+FROM 2 0 0 1 8292 8292 ASCII\(.+SELECT 2 0 0 1 8293 8293 UPDATE.+SET 2 0 0 1 8294 8294 UNION.+SELECT 2 0 0 1 8295 8295 .+SELECT.+FROM 2 0 0 1 8296 8296 .+UNION\s+SELECT 2 0 0 1 8297 8297 .+INSERT.+INTO 2 0 0 1 8298 8298 .+DELETE.+FROM 2 0 0 1 8299 8299 .+ASCII\(.+SELECT 2 0 0 1 8300 8300 .+UPDATE.+SET 2 0 0 1 8301 8301 highlighter\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8302 8302 UNION.+SELECT 2 0 0 1 8303 8303 SELECT.+FROM 2 0 0 1 8304 8304 UNION\s+SELECT 2 0 0 1 8305 8305 INSERT.+INTO 2 0 0 1 8306 8306 DELETE.+FROM 2 0 0 1 8307 8307 ASCII\(.+SELECT 2 0 0 1 8308 8308 UPDATE.+SET 2 0 0 1 8309 8309 SELECT.+FROM 2 0 0 1 8310 8310 UNION\s+SELECT 2 0 0 1 8311 8311 INSERT.+INTO 2 0 0 1 8312 8312 DELETE.+FROM 2 0 0 1 8313 8313 ASCII\(.+SELECT 2 0 0 1 8314 8314 UPDATE.+SET 2 0 0 1 8315 8315 SELECT.+FROM 2 0 0 1 8316 8316 UNION\s+SELECT 2 0 0 1 8317 8317 INSERT.+INTO 2 0 0 1 8318 8318 DELETE.+FROM 2 0 0 1 8319 8319 ASCII\(.+SELECT 2 0 0 1 8320 8320 UPDATE.+SET 2 0 0 1 8321 8321 SELECT.+FROM 2 0 0 1 8322 8322 UNION\s+SELECT 2 0 0 1 8323 8323 INSERT.+INTO 2 0 0 1 8324 8324 DELETE.+FROM 2 0 0 1 8325 8325 ASCII\(.+SELECT 2 0 0 1 8326 8326 UPDATE.+SET 2 0 0 1 8327 8327 UNION.+SELECT 2 0 0 1 8328 8328 SELECT.+FROM 2 0 0 1 8329 8329 UNION\s+SELECT 2 0 0 1 8330 8330 INSERT.+INTO 2 0 0 1 8331 8331 DELETE.+FROM 2 0 0 1 8332 8332 ASCII\(.+SELECT 2 0 0 1 8333 8333 UPDATE.+SET 2 0 0 1 8334 8334 SELECT.+FROM 2 0 0 1 8335 8335 UNION\s+SELECT 2 0 0 1 8336 8336 INSERT.+INTO 2 0 0 1 8337 8337 DELETE.+FROM 2 0 0 1 8338 8338 ASCII\(.+SELECT 2 0 0 1 8339 8339 UPDATE.+SET 2 0 0 1 8340 8340 SELECT.+FROM 2 0 0 1 8341 8341 UNION\s+SELECT 2 0 0 1 8342 8342 INSERT.+INTO 2 0 0 1 8343 8343 DELETE.+FROM 2 0 0 1 8344 8344 ASCII\(.+SELECT 2 0 0 1 8345 8345 UPDATE.+SET 2 0 0 1 8346 8346 SELECT.+FROM 2 0 0 1 8347 8347 UNION\s+SELECT 2 0 0 1 8348 8348 INSERT.+INTO 2 0 0 1 8349 8349 DELETE.+FROM 2 0 0 1 8350 8350 ASCII\(.+SELECT 2 0 0 1 8351 8351 UPDATE.+SET 2 0 0 1 8352 8352 UNION.+SELECT 2 0 0 1 8353 8353 .+SELECT.+FROM 2 0 0 1 8354 8354 .+UNION\s+SELECT 2 0 0 1 8355 8355 .+INSERT.+INTO 2 0 0 1 8356 8356 .+DELETE.+FROM 2 0 0 1 8357 8357 .+ASCII\(.+SELECT 2 0 0 1 8358 8358 .+UPDATE.+SET 2 0 0 1 8359 8359 .+SELECT.+FROM 2 0 0 1 8360 8360 .+UNION\s+SELECT 2 0 0 1 8361 8361 .+INSERT.+INTO 2 0 0 1 8362 8362 .+DELETE.+FROM 2 0 0 1 8363 8363 .+ASCII\(.+SELECT 2 0 0 1 8364 8364 .+UPDATE.+SET 2 0 0 1 8365 8365 .+SELECT.+FROM 2 0 0 1 8366 8366 .+UNION\s+SELECT 2 0 0 1 8367 8367 .+INSERT.+INTO 2 0 0 1 8368 8368 .+DELETE.+FROM 2 0 0 1 8369 8369 .+ASCII\(.+SELECT 2 0 0 1 8370 8370 .+UPDATE.+SET 2 0 0 1 8371 8371 .+SELECT.+FROM 2 0 0 1 8372 8372 .+UNION\s+SELECT 2 0 0 1 8373 8373 .+INSERT.+INTO 2 0 0 1 8374 8374 .+DELETE.+FROM 2 0 0 1 8375 8375 .+ASCII\(.+SELECT 2 0 0 1 8376 8376 .+UPDATE.+SET 2 0 0 1 8377 8377 .+SELECT.+FROM 2 0 0 1 8378 8378 .+UNION\s+SELECT 2 0 0 1 8379 8379 .+INSERT.+INTO 2 0 0 1 8380 8380 .+DELETE.+FROM 2 0 0 1 8381 8381 .+ASCII\(.+SELECT 2 0 0 1 8382 8382 .+UPDATE.+SET 2 0 0 1 8383 8383 .+SELECT.+FROM 2 0 0 1 8384 8384 .+UNION\s+SELECT 2 0 0 1 8385 8385 .+INSERT.+INTO 2 0 0 1 8386 8386 .+DELETE.+FROM 2 0 0 1 8387 8387 .+ASCII\(.+SELECT 2 0 0 1 8388 8388 .+UPDATE.+SET 2 0 0 1 8389 8389 SELECT.+FROM 2 0 0 1 8390 8390 UNION\s+SELECT 2 0 0 1 8391 8391 INSERT.+INTO 2 0 0 1 8392 8392 DELETE.+FROM 2 0 0 1 8393 8393 .+SELECT.+FROM 2 0 0 1 8394 8394 .+UNION\s+SELECT 2 0 0 1 8395 8395 .+INSERT.+INTO 2 0 0 1 8396 8396 .+ASCII\(.+SELECT 2 0 0 1 8397 8397 .+UPDATE.+SET 2 0 0 1 8398 8398 .+SELECT.+FROM 2 0 0 1 8399 8399 .+UNION\s+SELECT 2 0 0 1 8400 8400 .+INSERT.+INTO 2 0 0 1 8401 8401 .+DELETE.+FROM 2 0 0 1 8402 8402 .+ASCII\(.+SELECT 2 0 0 1 8403 8403 .+UPDATE.+SET 2 0 0 1 8404 8404 .+SELECT.+FROM 2 0 0 1 8405 8405 .+UNION\s+SELECT 2 0 0 1 8406 8406 .+INSERT.+INTO 2 0 0 1 8407 8407 .+DELETE.+FROM 2 0 0 1 8408 8408 .+ASCII\(.+SELECT 2 0 0 1 8409 8409 .+UPDATE.+SET 2 0 0 1 8410 8410 .+SELECT.+FROM 2 0 0 1 8411 8411 .+UNION\s+SELECT 2 0 0 1 8412 8412 .+INSERT.+INTO 2 0 0 1 8413 8413 .+DELETE.+FROM 2 0 0 1 8414 8414 .+ASCII\(.+SELECT 2 0 0 1 8415 8415 .+UPDATE.+SET 2 0 0 1 8416 8416 .+SELECT.+FROM 2 0 0 1 8417 8417 .+UNION\s+SELECT 2 0 0 1 8418 8418 .+INSERT.+INTO 2 0 0 1 8419 8419 .+DELETE.+FROM 2 0 0 1 8420 8420 .+ASCII\(.+SELECT 2 0 0 1 8421 8421 .+UPDATE.+SET 2 0 0 1 8422 8422 UNION.+SELECT 2 0 0 1 8423 8423 UNION.+SELECT 2 0 0 1 8424 8424 SELECT.+FROM 2 0 0 1 8425 8425 UNION\s+SELECT 2 0 0 1 8426 8426 INSERT.+INTO 2 0 0 1 8427 8427 DELETE.+FROM 2 0 0 1 8428 8428 ASCII\(.+SELECT 2 0 0 1 8429 8429 UPDATE.+SET 2 0 0 1 8430 8430 UNION.+SELECT 2 0 0 1 8431 8431 UNION.+SELECT 2 0 0 1 8432 8432 UNION.+SELECT 2 0 0 1 8433 8433 UNION.+SELECT 2 0 0 1 8434 8434 UNION.+SELECT 2 0 0 1 8435 8435 SELECT.+FROM 2 0 0 1 8436 8436 UNION\s+SELECT 2 0 0 1 8437 8437 INSERT.+INTO 2 0 0 1 8438 8438 DELETE.+FROM 2 0 0 1 8439 8439 ASCII\(.+SELECT 2 0 0 1 8440 8440 UPDATE.+SET 2 0 0 1 8441 8441 SELECT.+FROM 2 0 0 1 8442 8442 UNION\s+SELECT 2 0 0 1 8443 8443 INSERT.+INTO 2 0 0 1 8444 8444 DELETE.+FROM 2 0 0 1 8445 8445 ASCII\(.+SELECT 2 0 0 1 8446 8446 UPDATE.+SET 2 0 0 1 8447 8447 SELECT.+FROM 2 0 0 1 8448 8448 UNION\s+SELECT 2 0 0 1 8449 8449 INSERT.+INTO 2 0 0 1 8450 8450 DELETE.+FROM 2 0 0 1 8451 8451 ASCII\(.+SELECT 2 0 0 1 8452 8452 UPDATE.+SET 2 0 0 1 8453 8453 SELECT.+FROM 2 0 0 1 8454 8454 UNION\s+SELECT 2 0 0 1 8455 8455 INSERT.+INTO 2 0 0 1 8456 8456 DELETE.+FROM 2 0 0 1 8457 8457 ASCII\(.+SELECT 2 0 0 1 8458 8458 UPDATE.+SET 2 0 0 1 8459 8459 SELECT.+FROM 2 0 0 1 8460 8460 UNION\s+SELECT 2 0 0 1 8461 8461 INSERT.+INTO 2 0 0 1 8462 8462 DELETE.+FROM 2 0 0 1 8463 8463 ASCII\(.+SELECT 2 0 0 1 8464 8464 UPDATE.+SET 2 0 0 1 8465 8465 page=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8466 8466 page=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8467 8467 Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8468 8468 Filename\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8469 8469 IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8470 8470 ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8471 8471 FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8472 8472 IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8473 8473 ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8474 8474 Dictionary\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8475 8475 Scoring\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8476 8476 MessagePart\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8477 8477 Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8478 8478 FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8479 8479 IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8480 8480 ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8481 8481 SELECT.+FROM 2 0 0 1 8482 8482 UNION\s+SELECT 2 0 0 1 8483 8483 INSERT.+INTO 2 0 0 1 8484 8484 DELETE.+FROM 2 0 0 1 8485 8485 ASCII\(.+SELECT 2 0 0 1 8486 8486 UPDATE.+SET 2 0 0 1 8487 8487 SELECT.+FROM 2 0 0 1 8488 8488 UNION\s+SELECT 2 0 0 1 8489 8489 INSERT.+INTO 2 0 0 1 8490 8490 DELETE.+FROM 2 0 0 1 8491 8491 ASCII\(.+SELECT 2 0 0 1 8492 8492 UPDATE.+SET 2 0 0 1 8493 8493 SELECT.+FROM 2 0 0 1 8494 8494 UNION\s+SELECT 2 0 0 1 8495 8495 INSERT.+INTO 2 0 0 1 8496 8496 DELETE.+FROM 2 0 0 1 8497 8497 ASCII\(.+SELECT 2 0 0 1 8498 8498 UPDATE.+SET 2 0 0 1 8499 8499 SELECT.+FROM 2 0 0 1 8500 8500 UNION\s+SELECT 2 0 0 1 8501 8501 INSERT.+INTO 2 0 0 1 8502 8502 DELETE.+FROM 2 0 0 1 8503 8503 ASCII\(.+SELECT 2 0 0 1 8504 8504 UPDATE.+SET 2 0 0 1 8505 8505 SELECT.+FROM 2 0 0 1 8506 8506 UNION\s+SELECT 2 0 0 1 8507 8507 INSERT.+INTO 2 0 0 1 8508 8508 DELETE.+FROM 2 0 0 1 8509 8509 ASCII\(.+SELECT 2 0 0 1 8510 8510 UPDATE.+SET 2 0 0 1 8511 8511 SELECT.+FROM 2 0 0 1 8512 8512 UNION\s+SELECT 2 0 0 1 8513 8513 INSERT.+INTO 2 0 0 1 8514 8514 DELETE.+FROM 2 0 0 1 8515 8515 ASCII\(.+SELECT 2 0 0 1 8516 8516 UPDATE.+SET 2 0 0 1 8517 8517 .+SELECT.+FROM 2 0 0 1 8518 8518 .+UNION\s+SELECT 2 0 0 1 8519 8519 .+INSERT.+INTO 2 0 0 1 8520 8520 .+DELETE.+FROM 2 0 0 1 8521 8521 .+ASCII\(.+SELECT 2 0 0 1 8522 8522 .+UPDATE.+SET 2 0 0 1 8523 8523 SELECT.+FROM 2 0 0 1 8524 8524 UNION\s+SELECT 2 0 0 1 8525 8525 INSERT.+INTO 2 0 0 1 8526 8526 DELETE.+FROM 2 0 0 1 8527 8527 ASCII\(.+SELECT 2 0 0 1 8528 8528 UPDATE.+SET 2 0 0 1 8529 8529 SELECT.+FROM 2 0 0 1 8530 8530 UNION\s+SELECT 2 0 0 1 8531 8531 INSERT.+INTO 2 0 0 1 8532 8532 DELETE.+FROM 2 0 0 1 8533 8533 ASCII\(.+SELECT 2 0 0 1 8534 8534 UPDATE.+SET 2 0 0 1 8535 8535 SELECT.+FROM 2 0 0 1 8536 8536 UNION\s+SELECT 2 0 0 1 8537 8537 INSERT.+INTO 2 0 0 1 8538 8538 DELETE.+FROM 2 0 0 1 8539 8539 ASCII\(.+SELECT 2 0 0 1 8540 8540 UPDATE.+SET 2 0 0 1 8541 8541 UNION\s+SELECT 2 0 0 1 8542 8542 ABSPATH\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8543 8543 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8544 8544 SELECT.+FROM 2 0 0 1 8545 8545 DELETE.+FROM 2 0 0 1 8546 8546 UNION.+SELECT 2 0 0 1 8547 8547 INSERT.+INTO 2 0 0 1 8548 8548 UPDATE.+SET 2 0 0 1 8549 8549 tagcloud\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8550 8550 SELECT.+FROM 2 0 0 1 8551 8551 UNION\s+SELECT 2 0 0 1 8552 8552 INSERT.+INTO 2 0 0 1 8553 8553 DELETE.+FROM 2 0 0 1 8554 8554 ASCII\(.+SELECT 2 0 0 1 8555 8555 UPDATE.+SET 2 0 0 1 8556 8556 SELECT.+FROM 2 0 0 1 8557 8557 UNION\s+SELECT 2 0 0 1 8558 8558 INSERT.+INTO 2 0 0 1 8559 8559 DELETE.+FROM 2 0 0 1 8560 8560 ASCII\(.+SELECT 2 0 0 1 8561 8561 UPDATE.+SET 2 0 0 1 8562 8562 SELECT.+FROM 2 0 0 1 8563 8563 UNION\s+SELECT 2 0 0 1 8564 8564 INSERT.+INTO 2 0 0 1 8565 8565 DELETE.+FROM 2 0 0 1 8566 8566 ASCII\(.+SELECT 2 0 0 1 8567 8567 UPDATE.+SET 2 0 0 1 8568 8568 SELECT.+FROM 2 0 0 1 8569 8569 UNION\s+SELECT 2 0 0 1 8570 8570 INSERT.+INTO 2 0 0 1 8571 8571 DELETE.+FROM 2 0 0 1 8572 8572 ASCII\(.+SELECT 2 0 0 1 8573 8573 UPDATE.+SET 2 0 0 1 8574 8574 (onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src) 2 0 0 1 8575 8575 (onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src) 2 0 0 1 8576 8576 UNION.+SELECT 2 0 0 1 8577 8577 SELECT.+FROM 2 0 0 1 8578 8578 UNION\s+SELECT 2 0 0 1 8579 8579 INSERT.+INTO 2 0 0 1 8580 8580 DELETE.+FROM 2 0 0 1 8581 8581 ASCII\(.+SELECT 2 0 0 1 8582 8582 UPDATE.+SET 2 0 0 1 8583 8583 include_directory=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8584 8584 SELECT.+FROM 2 0 0 1 8585 8585 UNION\s+SELECT 2 0 0 1 8586 8586 INSERT.+INTO 2 0 0 1 8587 8587 DELETE.+FROM 2 0 0 1 8588 8588 ASCII\(.+SELECT 2 0 0 1 8589 8589 UPDATE.+SET 2 0 0 1 8590 8590 SELECT.+FROM 2 0 0 1 8591 8591 UNION\s+SELECT 2 0 0 1 8592 8592 INSERT.+INTO 2 0 0 1 8593 8593 DELETE.+FROM 2 0 0 1 8594 8594 ASCII\(.+SELECT 2 0 0 1 8595 8595 UPDATE.+SET 2 0 0 1 8596 8596 .+SELECT.+FROM 2 0 0 1 8597 8597 .+UNION\s+SELECT 2 0 0 1 8598 8598 .+INSERT.+INTO 2 0 0 1 8599 8599 .+DELETE.+FROM 2 0 0 1 8600 8600 .+ASCII\(.+SELECT 2 0 0 1 8601 8601 .+UPDATE.+SET 2 0 0 1 8602 8602 UNION\s+SELECT 2 0 0 1 8603 8603 UNION.+SELECT 2 0 0 1 8604 8604 (\?|&)id=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 8605 8605 SELECT.+FROM 2 0 0 1 8606 8606 UNION\s+SELECT 2 0 0 1 8607 8607 INSERT.+INTO 2 0 0 1 8608 8608 DELETE.+FROM 2 0 0 1 8609 8609 ASCII\(.+SELECT 2 0 0 1 8610 8610 UPDATE.+SET 2 0 0 1 8611 8611 SELECT.+FROM 2 0 0 1 8612 8612 UNION\s+SELECT 2 0 0 1 8613 8613 INSERT.+INTO 2 0 0 1 8614 8614 DELETE.+FROM 2 0 0 1 8615 8615 ASCII\(.+SELECT 2 0 0 1 8616 8616 UPDATE.+SET 2 0 0 1 8617 8617 YAPIG_PATH=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8618 8618 cfgIncludeDirectory=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8619 8619 UNION.+SELECT 2 0 0 1 8620 8620 UNION.+SELECT 2 0 0 1 8621 8621 UNION.+SELECT 2 0 0 1 8622 8622 UNION.+SELECT 2 0 0 1 8623 8623 SELECT.+FROM 2 0 0 1 8624 8624 UNION\s+SELECT 2 0 0 1 8625 8625 INSERT.+INTO 2 0 0 1 8626 8626 DELETE.+FROM 2 0 0 1 8627 8627 ASCII\(.+SELECT 2 0 0 1 8628 8628 UPDATE.+SET 2 0 0 1 8629 8629 SELECT.+FROM 2 0 0 1 8630 8630 UNION\s+SELECT 2 0 0 1 8631 8631 INSERT.+INTO 2 0 0 1 8632 8632 DELETE.+FROM 2 0 0 1 8633 8633 ASCII\(.+SELECT 2 0 0 1 8634 8634 UPDATE.+SET 2 0 0 1 8635 8635 SELECT.+FROM 2 0 0 1 8636 8636 UNION\s+SELECT 2 0 0 1 8637 8637 INSERT.+INTO 2 0 0 1 8638 8638 DELETE.+FROM 2 0 0 1 8639 8639 ASCII\(.+SELECT 2 0 0 1 8640 8640 UPDATE.+SET 2 0 0 1 8641 8641 SELECT.+FROM 2 0 0 1 8642 8642 UNION\s+SELECT 2 0 0 1 8643 8643 INSERT.+INTO 2 0 0 1 8644 8644 DELETE.+FROM 2 0 0 1 8645 8645 ASCII\(.+SELECT 2 0 0 1 8646 8646 UPDATE.+SET 2 0 0 1 8647 8647 SELECT.+FROM 2 0 0 1 8648 8648 UNION\s+SELECT 2 0 0 1 8649 8649 INSERT.+INTO 2 0 0 1 8650 8650 DELETE.+FROM 2 0 0 1 8651 8651 ASCII\(.+SELECT 2 0 0 1 8652 8652 UPDATE.+SET 2 0 0 1 8653 8653 SELECT.+FROM 2 0 0 1 8654 8654 UNION\s+SELECT 2 0 0 1 8655 8655 INSERT.+INTO 2 0 0 1 8656 8656 DELETE.+FROM 2 0 0 1 8657 8657 ASCII\(.+SELECT 2 0 0 1 8658 8658 UPDATE.+SET 2 0 0 1 8659 8659 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8660 8660 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8661 8661 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8662 8662 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8663 8663 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8664 8664 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8665 8665 row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8666 8666 SELECT.+FROM 2 0 0 1 8667 8667 UNION\s+SELECT 2 0 0 1 8668 8668 INSERT.+INTO 2 0 0 1 8669 8669 DELETE.+FROM 2 0 0 1 8670 8670 ASCII\(.+SELECT 2 0 0 1 8671 8671 UPDATE.+SET 2 0 0 1 8672 8672 UNION.+SELECT 2 0 0 1 8673 8673 SELECT.+FROM 2 0 0 1 8674 8674 UNION\s+SELECT 2 0 0 1 8675 8675 INSERT.+INTO 2 0 0 1 8676 8676 DELETE.+FROM 2 0 0 1 8677 8677 ASCII\(.+SELECT 2 0 0 1 8678 8678 UPDATE.+SET 2 0 0 1 8679 8679 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8680 8680 UNION.+SELECT 2 0 0 1 8681 8681 SELECT.+FROM 2 0 0 1 8682 8682 UNION\s+SELECT 2 0 0 1 8683 8683 INSERT.+INTO 2 0 0 1 8684 8684 DELETE.+FROM 2 0 0 1 8685 8685 ASCII\(.+SELECT 2 0 0 1 8686 8686 UPDATE.+SET 2 0 0 1 8687 8687 SELECT.+FROM 2 0 0 1 8688 8688 UNION\s+SELECT 2 0 0 1 8689 8689 INSERT.+INTO 2 0 0 1 8690 8690 DELETE.+FROM 2 0 0 1 8691 8691 ASCII\(.+SELECT 2 0 0 1 8692 8692 UPDATE.+SET 2 0 0 1 8693 8693 controller\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8694 8694 .+SELECT.+FROM 2 0 0 1 8695 8695 .+UNION\s+SELECT 2 0 0 1 8696 8696 .+INSERT.+INTO 2 0 0 1 8697 8697 .+DELETE.+FROM 2 0 0 1 8698 8698 .+ASCII\(.+SELECT 2 0 0 1 8699 8699 .+UPDATE.+SET 2 0 0 1 8700 8700 .+SELECT.+FROM 2 0 0 1 8701 8701 .+UNION\s+SELECT 2 0 0 1 8702 8702 .+INSERT.+INTO 2 0 0 1 8703 8703 .+DELETE.+FROM 2 0 0 1 8704 8704 .+ASCII\(.+SELECT 2 0 0 1 8705 8705 .+UPDATE.+SET 2 0 0 1 8706 8706 SELECT.+FROM 2 0 0 1 8707 8707 UNION\s+SELECT 2 0 0 1 8708 8708 INSERT.+INTO 2 0 0 1 8709 8709 DELETE.+FROM 2 0 0 1 8710 8710 ASCII\(.+SELECT 2 0 0 1 8711 8711 UPDATE.+SET 2 0 0 1 8712 8712 .+SELECT.+FROM 2 0 0 1 8713 8713 .+UNION\s+SELECT 2 0 0 1 8714 8714 .+INSERT.+INTO 2 0 0 1 8715 8715 .+DELETE.+FROM 2 0 0 1 8716 8716 .+ASCII\(.+SELECT 2 0 0 1 8717 8717 .+UPDATE.+SET 2 0 0 1 8718 8718 .+SELECT.+FROM 2 0 0 1 8719 8719 .+UNION\s+SELECT 2 0 0 1 8720 8720 .+INSERT.+INTO 2 0 0 1 8721 8721 .+DELETE.+FROM 2 0 0 1 8722 8722 .+ASCII\(.+SELECT 2 0 0 1 8723 8723 .+UPDATE.+SET 2 0 0 1 8724 8724 a_name=' 2 0 0 1 8725 8725 UNION.+SELECT 2 0 0 1 8726 8726 UNION.+SELECT 2 0 0 1 8727 8727 UNION.+SELECT 2 0 0 1 8728 8728 \x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A) 2 0 0 1 8729 8729 SELECT.+FROM 2 0 0 1 8730 8730 UNION\s+SELECT 2 0 0 1 8731 8731 INSERT.+INTO 2 0 0 1 8732 8732 DELETE.+FROM 2 0 0 1 8733 8733 ASCII\(.+SELECT 2 0 0 1 8734 8734 UPDATE.+SET 2 0 0 1 8735 8735 SELECT.+FROM 2 0 0 1 8736 8736 UNION\s+SELECT 2 0 0 1 8737 8737 INSERT.+INTO 2 0 0 1 8738 8738 DELETE.+FROM 2 0 0 1 8739 8739 ASCII\(.+SELECT 2 0 0 1 8740 8740 UPDATE.+SET 2 0 0 1 8741 8741 (\.\.\/){1,} 2 0 0 1 8742 8742 (\.\.\/){1,} 2 0 0 1 8743 8743 (\.\.\/){1,} 2 0 0 1 8744 8744 (\.\.\/){1,} 2 0 0 1 8745 8745 (\.\.\/){1,} 2 0 0 1 8746 8746 (\.\.\/){1,} 2 0 0 1 8747 8747 (\.\.\/){1,} 2 0 0 1 8748 8748 (\.\.\/){1,} 2 0 0 1 8749 8749 (\.\.\/){1,} 2 0 0 1 8750 8750 (\.\.\/){1,} 2 0 0 1 8751 8751 _REQUEST\[read\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8752 8752 .+SELECT.+FROM 2 0 0 1 8753 8753 .+UNION\s+SELECT 2 0 0 1 8754 8754 .+INSERT.+INTO 2 0 0 1 8755 8755 .+DELETE.+FROM 2 0 0 1 8756 8756 .+ASCII\(.+SELECT 2 0 0 1 8757 8757 .+UPDATE.+SET 2 0 0 1 8758 8758 .+SELECT.+FROM 2 0 0 1 8759 8759 .+UNION\s+SELECT 2 0 0 1 8760 8760 .+INSERT.+INTO 2 0 0 1 8761 8761 .+DELETE.+FROM 2 0 0 1 8762 8762 .+ASCII\(.+SELECT 2 0 0 1 8763 8763 .+UPDATE.+SET 2 0 0 1 8764 8764 .+SELECT.+FROM 2 0 0 1 8765 8765 .+UNION\s+SELECT 2 0 0 1 8766 8766 .+INSERT.+INTO 2 0 0 1 8767 8767 .+DELETE.+FROM 2 0 0 1 8768 8768 .+ASCII\(.+SELECT 2 0 0 1 8769 8769 .+UPDATE.+SET 2 0 0 1 8770 8770 .+SELECT.+FROM 2 0 0 1 8771 8771 .+INSERT.+INTO 2 0 0 1 8772 8772 .+DELETE.+FROM 2 0 0 1 8773 8773 .+UPDATE.+SET 2 0 0 1 8774 8774 SELECT.+FROM 2 0 0 1 8775 8775 UNION\s+SELECT 2 0 0 1 8776 8776 INSERT.+INTO 2 0 0 1 8777 8777 (\?|&)GID=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 8778 8778 net2ftp_globals\[application_skinsdir\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8779 8779 UNION\s+SELECT 2 0 0 1 8780 8780 icerikyolu=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8781 8781 sayfaid=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8782 8782 uzanti=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8783 8783 SELECT.+FROM 2 0 0 1 8784 8784 DELETE.+FROM 2 0 0 1 8785 8785 INSERT.+INTO 2 0 0 1 8786 8786 UPDATE.+SET 2 0 0 1 8787 8787 rootagenda=(https?|ftps?|php) 2 0 0 1 8788 8788 (\.\.\/){1,} 2 0 0 1 8789 8789 GLOBALS\[BASE\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8790 8790 [\?&]name=[^&\;\?]+\x27 2 0 0 1 8791 8791 id_livello\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8792 8792 page\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8793 8793 input_file=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8794 8794 lang_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8795 8795 INSERT.+INTO 2 0 0 1 8796 8796 UPDATE.+SET 2 0 0 1 8797 8797 SELECT.+FROM 2 0 0 1 8798 8798 DELETE.+FROM 2 0 0 1 8799 8799 current_user_id=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8800 8800 current_user_id=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8801 8801 SELECT.+FROM 2 0 0 1 8802 8802 fingerprint=\w*\; 2 0 0 1 8803 8803 class_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8804 8804 filter\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8805 8805 SELECT.+FROM 2 0 0 1 8806 8806 DELETE.+FROM 2 0 0 1 8807 8807 INSERT.+INTO 2 0 0 1 8808 8808 UPDATE.+SET 2 0 0 1 8809 8809 date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8810 8810 db_servertype=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8811 8811 (\.\.\/){1,} 2 0 0 1 8812 8812 (\.\.\/){1,} 2 0 0 1 8813 8813 (\.\.\/){1,} 2 0 0 1 8814 8814 mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 8815 8815 UPDATE.+SET 2 0 0 1 8816 8816 ABTPV_BLOQUE_CENTRAL=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8817 8817 forum=.*' 2 0 0 1 8818 8818 shop_this_skin_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8819 8819 pathForArdeaCore=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8820 8820 LibDir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8821 8821 LibDir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8822 8822 SELECT.+FROM 2 0 0 1 8823 8823 UNION\s+SELECT 2 0 0 1 8824 8824 INSERT.+INTO 2 0 0 1 8825 8825 DELETE.+FROM 2 0 0 1 8826 8826 ASCII\(.+SELECT 2 0 0 1 8827 8827 UPDATE.+SET 2 0 0 1 8828 8828 SELECT.+FROM 2 0 0 1 8829 8829 UNION\s+SELECT 2 0 0 1 8830 8830 INSERT.+INTO 2 0 0 1 8831 8831 DELETE.+FROM 2 0 0 1 8832 8832 ASCII\(.+SELECT 2 0 0 1 8833 8833 UPDATE.+SET 2 0 0 1 8834 8834 SELECT.+FROM 2 0 0 1 8835 8835 DELETE.+FROM 2 0 0 1 8836 8836 INSERT.+INTO 2 0 0 1 8837 8837 UPDATE.+SET 2 0 0 1 8838 8838 LibDir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8839 8839 LibDir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8840 8840 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8841 8841 &CONFIG\x5bpath\x5d=(https?|ftps?|php)\: 2 0 0 1 8842 8842 SELECT.+FROM 2 0 0 1 8843 8843 UNION\s+SELECT 2 0 0 1 8844 8844 INSERT.+INTO 2 0 0 1 8845 8845 DELETE.+FROM 2 0 0 1 8846 8846 ASCII\(.+SELECT 2 0 0 1 8847 8847 UPDATE.+SET 2 0 0 1 8848 8848 SELECT.+FROM 2 0 0 1 8849 8849 UPDATE.+SET 2 0 0 1 8850 8850 config_atkroot\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8851 8851 index.template.html.+(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8852 8852 pathtoserverdata\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8853 8853 (script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8854 8854 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8855 8855 UNION\s+SELECT 2 0 0 1 8856 8856 master\[currentskin\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8857 8857 UNION.+SELECT 2 0 0 1 8858 8858 (onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src) 2 0 0 1 8859 8859 UNION\s+SELECT 2 0 0 1 8860 8860 \/cgi-mod\/index\.cgi\?.*backup_username=[^&\;]*[>\"] 2 0 0 1 8861 8861 \/cgi-mod\/index\.cgi\?.*backup_server=[^&\;]*[>\"] 2 0 0 1 8862 8862 \/cgi-mod\/index\.cgi\?.*backup_path=[^&\;]*[>\"] 2 0 0 1 8863 8863 \/cgi-mod\/index\.cgi\?.*backup_password=[^&\;]*[>\"] 2 0 0 1 8864 8864 (script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8865 8865 UNION.+SELECT 2 0 0 1 8866 8866 (alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8867 8867 UNION.+SELECT 2 0 0 1 8868 8868 UNION.+SELECT 2 0 0 1 8869 8869 dest\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8870 8870 (script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8871 8871 (script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8872 8872 (onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src) 2 0 0 1 8873 8873 (script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8874 8874 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8875 8875 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8876 8876 SELECT.+FROM 2 0 0 1 8877 8877 lgsl_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8878 8878 lgsl_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8879 8879 app_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8880 8880 app_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8881 8881 (modname=meta_certificate|modname=certificate|modname=link).+UPTDATE.+SET 2 0 0 1 8882 8882 (modname=meta_certificate|modname=certificate|modname=link).+UNION.+SELECT 2 0 0 1 8883 8883 (modname=meta_certificate|modname=certificate|modname=link).+SELECT.+FROM 2 0 0 1 8884 8884 (modname=meta_certificate|modname=certificate|modname=link).+DELETE.+FROM 2 0 0 1 8885 8885 smarty\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8886 8886 smarty\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8887 8887 _compile_file\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8888 8888 UNION.+SELECT 2 0 0 1 8889 8889 tpl_base_dir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8890 8890 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8891 8891 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8892 8892 (\.\.\/){1,} 2 0 0 1 8893 8893 path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8894 8894 (\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c] 2 0 0 1 8895 8895 (\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c] 2 0 0 1 8896 8896 kal_class_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8897 8897 kal_class_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8898 8898 edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8899 8899 edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8900 8900 site_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8901 8901 BASE_DIR\[jax_formmailer\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8902 8902 (\.\.\/){1,} 2 0 0 1 8903 8903 ADODB_LANG\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8904 8904 config\[gfwroot\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8905 8905 (\.\.\/){1,} 2 0 0 1 8906 8906 servercert\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8907 8907 c_temp_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8908 8908 c_temp_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8909 8909 (\?|&)article_id=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 8910 8910 colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B] 2 0 0 1 8911 8911 test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27] 2 0 0 1 8912 8912 passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22 2 0 0 1 8913 8913 colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B] 2 0 0 1 8914 8914 test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27] 2 0 0 1 8915 8915 passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22 2 0 0 1 8916 8916 (script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8917 8917 searchWord\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8918 8918 maxHits\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8919 8919 scopedSearch\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8920 8920 scope\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick) 2 0 0 1 8921 8921 BaseTarget\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8922 8922 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8923 8923 INDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8924 8924 domain\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8925 8925 slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8926 8926 slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8927 8927 WEBINDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8928 8928 SLOT\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange) 2 0 0 1 8929 8929 UNION.+SELECT 2 0 0 1 8930 8930 mosConfig_live_site=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8931 8931 \x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A) 2 0 0 1 8932 8932 GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8933 8933 GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8934 8934 user_id=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8935 8935 newsid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8936 8936 (\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8937 8937 (\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8938 8938 (\?|&)eid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8939 8939 (\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8940 8940 (\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8941 8941 (\?|&)secid=[^\s\x26\x3B\x2f]*[\s\x2f] 2 0 0 1 8942 8942 (\?|&)catID=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 8943 8943 mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8944 8944 mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8945 8945 mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8946 8946 user_id\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8947 8947 mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8948 8948 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8949 8949 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8950 8950 GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8951 8951 mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8952 8952 DOCUMENT_ROOT\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8953 8953 CONFIG\[AdminPath\]\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8954 8954 cwd=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8955 8955 cfile\s*=\s*(https?|ftps?|php)\:\/ 2 0 0 1 8956 8956 \.php(\?|.*\x26)pathToIndex=(https?|ftps?)\:\/\/[^\x26\x3B]+\?\? 2 0 0 1 8957 8957 name=.+(IMG|SCRIPT|SRC|onkey|onmouse|onload) 2 0 0 1 8958 8958 SELECT.+FROM 2 0 0 1 8959 8959 db_type\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8960 8960 v1\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8961 8961 SELECT.+FROM 2 0 0 1 8962 8962 SELECT.+FROM 2 0 0 1 8963 8963 reflect_base=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8964 8964 (\.\.\/){1,} 2 0 0 1 8965 8965 determined_format\[include\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8966 8966 determined_format\[include\]=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8967 8967 (\?|&)listing_id=[^\x26\x3B]*[^\d\x2D] 2 0 0 1 8968 8968 fm_includes_special=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8969 8969 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8970 8970 (script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8971 8971 SELECT.+FROM 2 0 0 1 8972 8972 SELECT.+FROM 2 0 0 1 8973 8973 SELECT.+FROM 2 0 0 1 8974 8974 SELECT.+FROM 2 0 0 1 8975 8975 SELECT.+FROM 2 0 0 1 8976 8976 SELECT.+FROM 2 0 0 1 8977 8977 UNION\s+SELECT 2 0 0 1 8978 8978 UNION.+SELECT 2 0 0 1 8979 8979 mybloggie_root_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8980 8980 email\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8981 8981 DIR_FILES_BLOCK_TYPES_CORE=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8982 8982 AND.*IF\( 2 0 0 1 8983 8983 DIR_LIBS=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 8984 8984 DIR_LIBS=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 8985 8985 DIR_LIBS=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 8986 8986 DIR_LIBS=\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 8987 8987 f_srch\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8988 8988 client\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8989 8989 file\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8990 8990 tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8991 8991 tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8992 8992 id=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8993 8993 and.*substring\( 2 0 0 1 8994 8994 lang\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8995 8995 basedir=\s*(ftps?|https?|php)\:\/ 2 0 0 1 8996 8996 k\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8997 8997 and.*substring\( 2 0 0 1 8998 8998 showfile\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 8999 8999 PHPCOVERAGE_HOME\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9000 9000 param\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9001 9001 ORDER.+BY 2 0 0 1 9002 9002 mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/ 2 0 0 1 9003 9003 explain\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9004 9004 relocate\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9005 9005 and.*substring\( 2 0 0 1 9006 9006 L_failedopentheme\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9007 9007 and.*substring\( 2 0 0 1 9008 9008 messageString\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9009 9009 stconf.nsf.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D).+unescape 2 0 0 1 9010 9010 \&(width|height)\=([2-9][0-9][0-9][0-9]*) 2 0 0 1 9011 9011 post_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9012 9012 form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9013 9013 form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9014 9014 f\x3Dvsr\x27\x7C\x7C.+(or|and|select|delete|union|delete|update|insert) 2 0 0 1 9015 9015 \x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A) 2 0 0 1 9016 9016 (\.\.\/){1} 2 0 0 1 9017 9017 modname=((meta_)?certificate|link).+?\bINSERT\b.*?INTO\b 2 0 0 1 9018 9018 modname=((meta_)?certificate|link).+?\bUPDATE\b.*?SET\b 2 0 0 1 9019 9019 UNION\s+?SELECT 2 0 0 1 9020 9020 UNION\s+?SELECT 2 0 0 1 9021 9021 ccf_((clear|merge)_im|ex)port 2 0 0 1 9022 9022 and.*substring\( 2 0 0 1 9023 9023 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 9024 9024 ^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd 2 0 0 1 9025 9025 ^[^>]+\x22\s*ftp\x3a\x2f\x2f 2 0 0 1 9026 9026 ^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd 2 0 0 1 9027 9027 lien_2=\s*(ftps?|https?|php)\:\/ 2 0 0 1 9028 9028 root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 9029 9029 root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 9030 9030 root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 9031 9031 fact_num\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9032 9032 sn\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9033 9033 ref\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9034 9034 userId\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9035 9035 having\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9036 9036 view\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9037 9037 query\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9038 9038 [&?]cmd= 2 0 0 1 9039 9039 [&?]src=https?[^&]+\x24\x28 2 0 0 1 9040 9040 ^[^\r\n]*(%2(52e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/)))|\.(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/))) 2 0 0 1 9041 9041 ^\d[\d\x2e]{255} 2 0 0 1 9042 9042 [?&]id=\d*?[^\d]\d*?(&|$) 2 0 0 1 9043 9043 &list\[fullordering\]=([a-zA-Z0-9])*[\x22\x27\x28] 2 0 0 1 9044 9044 \.jsp\/[^\x2f]*$ 2 0 0 1 9045 9045 \.jspx\/[^\x2f]*$ 2 0 0 1 9046 9046 \.shtml\/[^\x2f]*$ 2 0 0 1 9047 9047 \.jsp\/[^\x2f]*$ 2 0 0 1 9048 9048 \.jspx\/[^\x2f]*$ 2 0 0 1 9049 9049 \.shtml\/[^\x2f]*$ 2 0 0 1 9050 9050 new\s+(java|org|sun) 2 0 0 1 9051 9051 \/sem\/\w+\.php.*(\?|&)uniqueid=\d*\; 2 0 0 1 9052 9052 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 9053 9053 ^\s+SELECT 2 0 0 1 9054 9054 (\.\.\/){1,} 2 0 0 1 9055 9055 (\.\.\/){1,} 2 0 0 1 9056 9056 ^([a-zA-Z0-9_])*[\x2c\x22\x27\x28] 2 0 0 1 9057 9057 .+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9058 9058 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9059 9059 ^\s*(ftps?|https?|php)\x3a\/ 2 0 0 1 9060 9060 ^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D) 2 0 0 1 9061 9061 \x2Fwp\x2Dadmin\x2Fadmin\x2Ephp.+page\x3D(\x2Fcollapsing\x2Darchives\x2Foptions\x2Etxt|akismet\x2Freadme\x2Etxt|related\x2Dways\x2Dto\x2Dtake\x2Daction\x2Foptions\x2Ephp|wp\x2Dsecurity\x2Dscan\x2Fsecurityscan\x2Ephp) 2 0 0 1 9062 9062 id\x3d.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 9063 9063 ^[^\r]*?name=[\x22\x27]image_file"\x3b[^(\r\n|\n|\r)]*?(\r\n|\n|\r)(\r\n|\n|\r)?Content-Type: application\/x-httpd-php 2 0 0 1 9064 9064 ^(\x28|%28) 2 0 0 1 9065 9065 ^\x22[^\x22]*\x7b[^\x22]*\x7d[^\x22]*\x22[^\x22]*\x22{2} 2 0 0 1 9066 9066 ^%(3B|0A|26|60|7C|24) 2 0 0 1 9067 9067 ^\s?.{0,100}(SELECT|UNION|CHAR|LONGVARCHAR|SCHEMA|FROM|WHERE|IFNULL|INSERT|UPDATE) 2 0 0 1 9068 9068 ^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)) 2 0 0 1 9069 9069 ^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change)) 2 0 0 1 9070 9070 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 9071 9071 ^\s*((ht|f)tps?|data|php)\x3a\/ 2 0 0 1 9072 9072 ^\s*(ftps?|https?|php)\:\/ 2 0 0 1 9073 9073 UPDATE.+SET 2 0 0 1 9074 9074 source(\x22\x3b\w\x3a|%22%3b\w%3a)\d+(\x3a\x22|%3a%22)((ftps?|%66%74%70(%73)?)|(https?|%68%74%74%70(%73)?)|(php|%70%68%70))(\x3a|%3A)(\x2f|%2f) 2 0 0 1 9075 9075 ^([0-9]{1,3}\.){3}[0-9]{1,3}$ 2 0 0 1 9076 9076 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5 2 0 0 1 9077 9077 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980 2 0 0 1 9078 9078 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E 2 0 0 1 9079 9079 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333 2 0 0 1 9080 9080 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C 2 0 0 1 9081 9081 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E 2 0 0 1 9082 9082 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E 2 0 0 1 9083 9083 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E 2 0 0 1 9084 9084 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E 2 0 0 1 9085 9085 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08 2 0 0 1 9086 9086 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42 2 0 0 1 9087 9087 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4 2 0 0 1 9088 9088 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980 2 0 0 1 9089 9089 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3 2 0 0 1 9090 9090 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980 2 0 0 1 9091 9091 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB 2 0 0 1 9092 9092 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E 2 0 0 1 9093 9093 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E 2 0 0 1 9094 9094 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664 2 0 0 1 9095 9095 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C 2 0 0 1 9096 9096 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980 2 0 0 1 9097 9097 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E 2 0 0 1 9098 9098 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1 9099 9099 (EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters) 2 0 0 1 9100 9100 (SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1 9101 9101 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1 9102 9102 (ReadMolFile|SaveasMolFile) 2 0 0 1 9103 9103 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 9104 9104 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 9105 9105 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C 2 0 0 1 9106 9106 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 9107 9107 new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\) 2 0 0 1 9108 9108 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000 2 0 0 1 9109 9109 file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt) 2 0 0 1 9110 9110 [0-9]{3,} 2 0 0 1 9111 9111 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194 2 0 0 1 9112 9112 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2 2 0 0 1 9113 9113 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510 2 0 0 1 9114 9114 (setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch) 2 0 0 1 9115 9115 param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20} 2 0 0 1 9116 9116 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C 2 0 0 1 9117 9117 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1 9118 9118 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79 2 0 0 1 9119 9119 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD 2 0 0 1 9120 9120 (Text|EditSelText|EditText|CellFontName|Archive) 2 0 0 1 9121 9121 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1 9122 9122 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c 2 0 0 1 9123 9123 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B 2 0 0 1 9124 9124 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA 2 0 0 1 9125 9125 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted) 2 0 0 1 9126 9126 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam) 2 0 0 1 9127 9127 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E 2 0 0 1 9128 9128 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8 2 0 0 1 9129 9129 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E 2 0 0 1 9130 9130 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726 2 0 0 1 9131 9131 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598 2 0 0 1 9132 9132 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E 2 0 0 1 9133 9133 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E 2 0 0 1 9134 9134 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E 2 0 0 1 9135 9135 (exe|bat|com|dll|ini) 2 0 0 1 9136 9136 (exe|bat|com|dll|ini) 2 0 0 1 9137 9137 (exe|bat|com|dll|ini) 2 0 0 1 9138 9138 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E 2 0 0 1 9139 9139 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7 2 0 0 1 9140 9140 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91 2 0 0 1 9141 9141 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980 2 0 0 1 9142 9142 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02 2 0 0 1 9143 9143 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3 2 0 0 1 9144 9144 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90 2 0 0 1 9145 9145 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E 2 0 0 1 9146 9146 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E 2 0 0 1 9147 9147 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112 2 0 0 1 9148 9148 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1 2 0 0 1 9149 9149 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6 2 0 0 1 9150 9150 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F 2 0 0 1 9151 9151 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C 2 0 0 1 9152 9152 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA 2 0 0 1 9153 9153 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258 2 0 0 1 9154 9154 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B 2 0 0 1 9155 9155 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1 2 0 0 1 9156 9156 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7 2 0 0 1 9157 9157 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D 2 0 0 1 9158 9158 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61 2 0 0 1 9159 9159 (Src|Background|PackageXml) 2 0 0 1 9160 9160 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters) 2 0 0 1 9161 9161 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter) 2 0 0 1 9162 9162 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 9163 9163 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 9164 9164 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5 2 0 0 1 9165 9165 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755 2 0 0 1 9166 9166 (Save|SaveLayoutChanges|SaveMenuUsageData) 2 0 0 1 9167 9167 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61 2 0 0 1 9168 9168 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3 2 0 0 1 9169 9169 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1 9170 9170 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D 2 0 0 1 9171 9171 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1 9172 9172 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0 2 0 0 1 9173 9173 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3 2 0 0 1 9174 9174 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679 2 0 0 1 9175 9175 (SaveFile|ExportToXML) 2 0 0 1 9176 9176 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE 2 0 0 1 9177 9177 (SnapShotToFile|SnapShotX) 2 0 0 1 9178 9178 (SnapShotToFile|SnapShotX) 2 0 0 1 9179 9179 (SnapShotToFile|SnapShotX) 2 0 0 1 9180 9180 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1 9181 9181 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28 2 0 0 1 9182 9182 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003 2 0 0 1 9183 9183 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 9184 9184 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 9185 9185 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 9186 9186 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE 2 0 0 1 9187 9187 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE 2 0 0 1 9188 9188 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB 2 0 0 1 9189 9189 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile) 2 0 0 1 9190 9190 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD 2 0 0 1 9191 9191 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA 2 0 0 1 9192 9192 (Run|SetRegistryValueAsString|PerformUpdateAsync) 2 0 0 1 9193 9193 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1 9194 9194 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C 2 0 0 1 9195 9195 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084 2 0 0 1 9196 9196 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6 2 0 0 1 9197 9197 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF 2 0 0 1 9198 9198 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5 2 0 0 1 9199 9199 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C 2 0 0 1 9200 9200 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA 2 0 0 1 9201 9201 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020 2 0 0 1 9202 9202 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020 2 0 0 1 9203 9203 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B 2 0 0 1 9204 9204 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356 2 0 0 1 9205 9205 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520 2 0 0 1 9206 9206 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C 2 0 0 1 9207 9207 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26 2 0 0 1 9208 9208 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0 2 0 0 1 9209 9209 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF 2 0 0 1 9210 9210 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142 2 0 0 1 9211 9211 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB 2 0 0 1 9212 9212 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7 2 0 0 1 9213 9213 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747 2 0 0 1 9214 9214 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456 2 0 0 1 9215 9215 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0 2 0 0 1 9216 9216 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999 2 0 0 1 9217 9217 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899 2 0 0 1 9218 9218 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5 2 0 0 1 9219 9219 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E 2 0 0 1 9220 9220 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F 2 0 0 1 9221 9221 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9 2 0 0 1 9222 9222 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F 2 0 0 1 9223 9223 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448 2 0 0 1 9224 9224 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92 2 0 0 1 9225 9225 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F 2 0 0 1 9226 9226 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED 2 0 0 1 9227 9227 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB 2 0 0 1 9228 9228 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305 2 0 0 1 9229 9229 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7 2 0 0 1 9230 9230 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B 2 0 0 1 9231 9231 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C 2 0 0 1 9232 9232 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627 2 0 0 1 9233 9233 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E 2 0 0 1 9234 9234 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE 2 0 0 1 9235 9235 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496 2 0 0 1 9236 9236 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0 2 0 0 1 9237 9237 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E 2 0 0 1 9238 9238 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C 2 0 0 1 9239 9239 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53 2 0 0 1 9240 9240 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014 2 0 0 1 9241 9241 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1 9242 9242 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A 2 0 0 1 9243 9243 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741 2 0 0 1 9244 9244 (SaveToBMP|SaveToFile) 2 0 0 1 9245 9245 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2 2 0 0 1 9246 9246 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667 2 0 0 1 9247 9247 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 9248 9248 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 9249 9249 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E 2 0 0 1 9250 9250 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D 2 0 0 1 9251 9251 (SaveBarCode|SaveEnhWMF) 2 0 0 1 9252 9252 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B 2 0 0 1 9253 9253 <object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>) 2 0 0 1 9254 9254 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000 2 0 0 1 9255 9255 (exe|bat|com|dll|ini) 2 0 0 1 9256 9256 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E 2 0 0 1 9257 9257 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E 2 0 0 1 9258 9258 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87 2 0 0 1 9259 9259 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 9260 9260 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 9261 9261 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 9262 9262 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 9263 9263 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949 2 0 0 1 9264 9264 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E 2 0 0 1 9265 9265 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344 2 0 0 1 9266 9266 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C 2 0 0 1 9267 9267 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30 2 0 0 1 9268 9268 (Packagefiles|SaveDna|SetIdentity|AddFile) 2 0 0 1 9269 9269 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9 2 0 0 1 9270 9270 (_DOWText)|(_MonthText) 2 0 0 1 9271 9271 (SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour) 2 0 0 1 9272 9272 classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE 2 0 0 1 9273 9273 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1 9274 9274 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004 2 0 0 1 9275 9275 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F 2 0 0 1 9276 9276 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5 2 0 0 1 9277 9277 [\w\W]{2500,} 2 0 0 1 9278 9278 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3 2 0 0 1 9279 9279 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8 2 0 0 1 9280 9280 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04 2 0 0 1 9281 9281 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue) 2 0 0 1 9282 9282 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356 2 0 0 1 9283 9283 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E 2 0 0 1 9284 9284 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574 2 0 0 1 9285 9285 (WriteIniFileString|ShellExecute) 2 0 0 1 9286 9286 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906 2 0 0 1 9287 9287 (txt|ini|com|exe|bat|dll|dat) 2 0 0 1 9288 9288 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8 2 0 0 1 9289 9289 42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733 2 0 0 1 9290 9290 (Save|ExportImage) 2 0 0 1 9291 9291 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790 2 0 0 1 9292 9292 (DeleteFile|write) 2 0 0 1 9293 9293 (SaveAsBMP|SaveAsWMF) 2 0 0 1 9294 9294 (SaveAsBMP|SaveAsWMF) 2 0 0 1 9295 9295 (SaveAsBMP|SaveAsWMF) 2 0 0 1 9296 9296 (SaveAsBMP|SaveAsWMF) 2 0 0 1 9297 9297 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967 2 0 0 1 9298 9298 WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext) 2 0 0 1 9299 9299 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9 2 0 0 1 9300 9300 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 2 0 0 1 9301 9301 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6 2 0 0 1 9302 9302 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C 2 0 0 1 9303 9303 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9 2 0 0 1 9304 9304 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24 2 0 0 1 9305 9305 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9 2 0 0 1 9306 9306 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA 2 0 0 1 9307 9307 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec) 2 0 0 1 9308 9308 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5 2 0 0 1 9309 9309 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 9310 9310 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 9311 9311 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B 2 0 0 1 9312 9312 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83 2 0 0 1 9313 9313 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA 2 0 0 1 9314 9314 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566 2 0 0 1 9315 9315 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1 9316 9316 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000 2 0 0 1 9317 9317 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B 2 0 0 1 9318 9318 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F 2 0 0 1 9319 9319 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1 9320 9320 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289 2 0 0 1 9321 9321 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED 2 0 0 1 9322 9322 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619 2 0 0 1 9323 9323 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E 2 0 0 1 9324 9324 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258 2 0 0 1 9325 9325 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196 2 0 0 1 9326 9326 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E 2 0 0 1 9327 9327 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD 2 0 0 1 9328 9328 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4 2 0 0 1 9329 9329 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118 2 0 0 1 9330 9330 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616 2 0 0 1 9331 9331 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 9332 9332 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 9333 9333 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F 2 0 0 1 9334 9334 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11 2 0 0 1 9335 9335 (ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1 2 0 0 1 9336 9336 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020 2 0 0 1 9337 9337 (PostURL|AddSeperator|AddString|Post) 2 0 0 1 9338 9338 (SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF) 2 0 0 1 9339 9339 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>) 2 0 0 1 9340 9340 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\> 2 0 0 1 9341 9341 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\> 2 0 0 1 9342 9342 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\> 2 0 0 1 9343 9343 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\> 2 0 0 1 9344 9344 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 9345 9345 (Buildpath|GetDriveName|DriveExists|DeleteFile) 2 0 0 1 9346 9346 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 9347 9347 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 9348 9348 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89 2 0 0 1 9349 9349 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>) 2 0 0 1 9350 9350 \x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission] 2 0 0 1 9351 9351 <object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\> 2 0 0 1 9352 9352 000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F 2 0 0 1 9353 9353 (javascript|http|ftp|vbscript) 2 0 0 1 9354 9354 (SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen) 2 0 0 1 9355 9355 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000 2 0 0 1 9356 9356 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407 2 0 0 1 9357 9357 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414 2 0 0 1 9358 9358 .*\.(ini|exe|dll|bat|com|cab|txt) 2 0 0 1 9359 9359 (AddAttachment|SubmitToExpress) 2 0 0 1 9360 9360 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6 2 0 0 1 9361 9361 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0 2 0 0 1 9362 9362 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D 2 0 0 1 9363 9363 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile) 2 0 0 1 9364 9364 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\> 2 0 0 1 9365 9365 <object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\> 2 0 0 1 9366 9366 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC 2 0 0 1 9367 9367 src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape 2 0 0 1 9368 9368 (LogFile|ClearLogFile|SaveToFile) 2 0 0 1 9369 9369 <OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext) 2 0 0 1 9370 9370 ^User-Agent\x3a Downloader \d\.\d\r?$/Hm 2 0 0 1 9371 9371 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P 2 0 0 1 9372 9372 ^((\r?\n\r?\n).)*?\r?\n\r?\nMZ 2 0 0 1 9373 9373 instructions\/\d{2}\.xml 2 0 0 1 9374 9374 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp 2 0 0 1 9375 9375 \/updatestats\/update\d+?\.xml$ 2 0 0 1 9376 9376 (GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab 2 0 0 1 9377 9377 ctxad-\d+\.sig 2 0 0 1 9378 9378 /user\d+/counter\.htm 2 0 0 1 9379 9379 (cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr 2 0 0 1 9380 9380 (discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe 2 0 0 1 9381 9381 loaderadv\d+\.jar 2 0 0 1 9382 9382 \/adv\/\d+\/win32\.exe 2 0 0 1 9383 9383 \/Message\/\S+\/\S+\.xml 2 0 0 1 9384 9384 \/abt\?data=\S{150} 2 0 0 1 9385 9385 ^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi 2 0 0 1 9386 9386 User-Agent\:[^\n]+wbi_v\d/iH 2 0 0 1 9387 9387 User-Agent\x3a[^\n]+AskBar/iH 2 0 0 1 9388 9388 \/tbrequest\d+\.php 2 0 0 1 9389 9389 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9390 9390 sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9391 9391 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9392 9392 cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9393 9393 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9394 9394 UID=\d 2 0 0 1 9395 9395 mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w 2 0 0 1 9396 9396 REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P 2 0 0 1 9397 9397 victim\.php\?\d\d\d\d\d 2 0 0 1 9398 9398 \/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d 2 0 0 1 9399 9399 \/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+ 2 0 0 1 9400 9400 &ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d 2 0 0 1 9401 9401 \/sd\?s=\d+&f=\d&C=\d 2 0 0 1 9402 9402 \.txt$ 2 0 0 1 9403 9403 \.cfg$ 2 0 0 1 9404 9404 User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H 2 0 0 1 9405 9405 ^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi 2 0 0 1 9406 9406 \x00[\x02-\x1E][0-9]{2,30}\x02cn\x00 2 0 0 1 9407 9407 \x00[\x02-\x1E][0-9]{2,30}\x02ru\x00 2 0 0 1 9408 9408 ^[A-F0-9]+$ 2 0 0 1 9409 9409 \/sd\?s=\d+&f=\d 2 0 0 1 9410 9410 loadadv\d+\.exe 2 0 0 1 9411 9411 \/ms\d\d\dcfg\.jsp 2 0 0 1 9412 9412 ^0x[0-9a-f]+$ 2 0 0 1 9413 9413 ^[^a-z]*?[0-9]{2,30}\.ru$ 2 0 0 1 9414 9414 filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe 2 0 0 1 9415 9415 ^MM \d\.\d+$ 2 0 0 1 9416 9416 ^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4} 2 0 0 1 9417 9417 ^\w+pcsetup_\w+ 2 0 0 1 9418 9418 \x2Fv[0-9]{3,4}[\x2F\x3F] 2 0 0 1 9419 9419 [a-f0-9]{32}\?v= 2 0 0 1 9420 9420 ^\/[a-z]{2}\x3Fv\x3D[0-9]$ 2 0 0 1 9421 9421 ^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$ 2 0 0 1 9422 9422 ^\/entrance\?s1=[a-f0-9]{100,}$ 2 0 0 1 9423 9423 ^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report= 2 0 0 1 9424 9424 ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ 2 0 0 1 9425 9425 ^[0-9][a-z]+ 2 0 0 1 9426 9426 \.php$ 2 0 0 1 9427 9427 ^\/([^\x2f]+\/)*log\/\?[bc]= 2 0 0 1 9428 9428 ^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/)) 2 0 0 1 9429 9429 ^\/\?pcrc=\d+&v=[\d.]+$ 2 0 0 1 9430 9430 ^\/\?v=[\d.]+&pcrc=\d+$ 2 0 0 1 9431 9431 \/v\d\/[^.]+\.asp$ 2 0 0 1 9432 9432 \/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$ 2 0 0 1 9433 9433 \/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$ 2 0 0 1 9434 9434 ^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$ 2 0 0 1 9435 9435 ^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$ 2 0 0 1 9436 9436 \?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4}) 2 0 0 1 9437 9437 ^Downloader\s\d+\.\d+$ 2 0 0 1 9438 9438 ^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100} 2 0 0 1 9439 9439 \/get_xml\?(file_id|stb)= 2 0 0 1 9440 9440 (_[a-z]{2}){1,3}_[a-z]{3}_install\.exe 2 0 0 1 9441 9441 \d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows 2 0 0 1 9442 9442 ^[a-zA-Z0-9_-]+$ 2 0 0 1 9443 9443 ^\/([a-zA-Z0-9]|%2[fb]){400,}$ 2 0 0 1 9444 9444 User-Agent\:[^\n]+searchengine 2 0 0 1 9445 9445 User-Agent\:[^\n]+SurferPlugin 2 0 0 1 9446 9446 User-Agent\:[^\n]+THNALL[^\n]+\.EXE 2 0 0 1 9447 9447 User-Agent\:[^\n]+XupiterToolbar 2 0 0 1 9448 9448 User-Agent\:[^\n]+spywareaxe 2 0 0 1 9449 9449 User-Agent\:[^\n]+iMeshBar 2 0 0 1 9450 9450 User-Agent\:[^\n]+Oemji 2 0 0 1 9451 9451 ^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$ 2 0 0 1 9452 9452 ^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$ 2 0 0 1 9453 9453 ^\/(get|install)\/\?q= 2 0 0 1 9454 9454 ^\/[a-f0-9]{50,}$ 2 0 0 1 9455 9455 ^\/[\w-]{50,}$ 2 0 0 1 9456 9456 ^\/\?pcrc=[0-9]{7,10}$ 2 0 0 1 9457 9457 ^Downloader \d\.\d$ 2 0 0 1 9458 9458 \/Socks[45]\.txt$ 2 0 0 1 9459 9459 ^Feat[^\r\n]+(Install|Updat)er 2 0 0 1 9460 9460 User-Agent\:[^\n]+host(ie|oe|oi|ol) 2 0 0 1 9461 9461 User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2} 2 0 0 1 9462 9462 ^BWL(\sToplist|\d_UPDATE) 2 0 0 1 9463 9463 ^\x2F[A-F0-9]{25,40}$ 2 0 0 1 9464 9464 ^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$ 2 0 0 1 9465 9465 ^\d+\sHTTP/1.1$ 2 0 0 1 9466 9466 ^[a-zA-Z0-9_-]+ 2 0 0 1 9467 9467 [a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12} 2 0 0 1 9468 9468 \/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id= 2 0 0 1 9469 9469 \{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\} 2 0 0 1 9470 9470 CN=([^\r\n]+?\.)?showmypc\.com(\.) 2 0 0 1 9471 9471 ^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$ 2 0 0 1 9472 9472 (SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk) 2 0 0 1 9473 9473 (DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog) 2 0 0 1 9474 9474 \d{13}$ 2 0 0 1 9475 9475 ^[a-f0-9]{32} 2 0 0 1 9476 9476 ^[a-f0-9]{32}\" 2 0 0 1 9477 9477 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1 9478 9478 ^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12} 2 0 0 1 9479 9479 ^([A-F0-9]{2}\:){5}[A-F0-9]{2} 2 0 0 1 9480 9480 ^[A-F0-9]{12} 2 0 0 1 9481 9481 ^[A-Z0-9]{9} 2 0 0 1 9482 9482 ^\d+[^\r\n\s]+ 2 0 0 1 9483 9483 ^ SQL[-_ ]Server 2 0 0 1 9484 9484 ^ \d+ Driver 2 0 0 1 9485 9485 ORA-\d{4} 2 0 0 1 9486 9486 Warning.*\Woci_ 2 0 0 1 9487 9487 Warning.*\Wora_ 2 0 0 1 9488 9488 CLI Driver.*DB2 2 0 0 1 9489 9489 bdb2_\w+\( 2 0 0 1 9490 9490 Exception.*Informix 2 0 0 1 9491 9491 Warning.*SQLite3:: 2 0 0 1 9492 9492 SQL error.*POS\([0-9]+\) 2 0 0 1 9493 9493 Warning.*maxdb 2 0 0 1 9494 9494 i?Warning.*sybase 2 0 0 1 9495 9495 Warning.*ingres_ 2 0 0 1 9496 9496 Warning.*sqlite_ 2 0 0 1 9497 9497 Ingres\W.*Driver 2 0 0 1 9498 9498 Exception (condition )\d+\. Transaction rollback\. 2 0 0 1 9499 9499 SQL Server.*?error \x27[0-9a-f]{8} 2 0 0 1 9500 9500 ^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$ 2 0 0 1 9501 9501 ^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll 2 0 0 1 9502 9502 ^...\x30\x82..\x02\x82...{256,257} 2 0 0 1 9503 9503 \/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php 2 0 0 1 9504 9504 \/notify\/(single|mass)$ 2 0 0 1 9505 9505 a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php) 2 0 0 1 9506 9506 Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a 2 0 0 1 9507 9507 ^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$ 2 0 0 1 9508 9508 [-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10} 2 0 0 1 9509 9509 ^\d+(\+|\-|\\|\*)\d+ 2 0 0 1 9510 9510 ^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9 2 0 0 1 9511 9511 ^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u 2 0 0 1 9512 9512 ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b 2 0 0 1 9513 9513 ^\d{4}[01] 2 0 0 1 9514 9514 ^\d{4}[01] 2 0 0 1 9515 9515 ^\d{4}[01] 2 0 0 1 9516 9516 ^\d{4}[01] 2 0 0 1 9517 9517 ^\d{4}[01] 2 0 0 1 9518 9518 ^\d{4}[01] 2 0 0 1 9519 9519 ^\d{4}[01] 2 0 0 1 9520 9520 ^\d{4}[01] 2 0 0 1 9521 9521 ^\d{4}[01] 2 0 0 1 9522 9522 ^\d{4}[01] 2 0 0 1 9523 9523 ^\d{4}[01] 2 0 0 1 9524 9524 ^\d{4}[01] 2 0 0 1 9525 9525 ^\d{4}[01] 2 0 0 1 9526 9526 ^\d{4}[01] 2 0 0 1 9527 9527 ^\d{4}[01] 2 0 0 1 9528 9528 ^\d{4}[01] 2 0 0 1 9529 9529 ^\d{4}[01] 2 0 0 1 9530 9530 ^\d{4}[01] 2 0 0 1 9531 9531 ^\d{4}[01] 2 0 0 1 9532 9532 ^\d{4}[01] 2 0 0 1 9533 9533 ^\d{4}[01] 2 0 0 1 9534 9534 ^\d{4}[01] 2 0 0 1 9535 9535 ^\d{4}[01] 2 0 0 1 9536 9536 ^\d{4}[01] 2 0 0 1 9537 9537 ^\d{4}[01] 2 0 0 1 9538 9538 ^\d{4}[01] 2 0 0 1 9539 9539 ^\d{4}[01] 2 0 0 1 9540 9540 ^\d{4}[01] 2 0 0 1 9541 9541 ^\d{4}[01] 2 0 0 1 9542 9542 ^\d{4}[01] 2 0 0 1 9543 9543 ^\d{4}[01] 2 0 0 1 9544 9544 ^\d{4}[01] 2 0 0 1 9545 9545 ^\d{4}[01] 2 0 0 1 9546 9546 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9547 9547 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9548 9548 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9549 9549 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9550 9550 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9551 9551 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9552 9552 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9553 9553 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9554 9554 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9555 9555 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9556 9556 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9557 9557 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9558 9558 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9559 9559 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9560 9560 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9561 9561 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9562 9562 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9563 9563 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9564 9564 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9565 9565 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9566 9566 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9567 9567 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9568 9568 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9569 9569 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9570 9570 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9571 9571 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9572 9572 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9573 9573 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9574 9574 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9575 9575 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9576 9576 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9577 9577 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9578 9578 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9579 9579 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9580 9580 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9581 9581 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9582 9582 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9583 9583 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9584 9584 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9585 9585 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9586 9586 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9587 9587 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9588 9588 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9589 9589 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9590 9590 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9591 9591 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9592 9592 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9593 9593 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9594 9594 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9595 9595 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9596 9596 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9597 9597 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9598 9598 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9599 9599 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9600 9600 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9601 9601 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9602 9602 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9603 9603 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9604 9604 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9605 9605 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9606 9606 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9607 9607 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9608 9608 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9609 9609 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9610 9610 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9611 9611 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9612 9612 ^\d{4}[01] 2 0 0 1 9613 9613 ^\d{4}[01] 2 0 0 1 9614 9614 ^\d{4}[01] 2 0 0 1 9615 9615 ^\d{4}[01] 2 0 0 1 9616 9616 ^\d{4}[01] 2 0 0 1 9617 9617 ^\d{4}[01] 2 0 0 1 9618 9618 ^\d{4}[01] 2 0 0 1 9619 9619 ^\d{4}[01] 2 0 0 1 9620 9620 ^\d{4}[01] 2 0 0 1 9621 9621 ^\d{4}[01] 2 0 0 1 9622 9622 ^\d{4}[01] 2 0 0 1 9623 9623 ^\d{4}[01] 2 0 0 1 9624 9624 ^\d{4}[01] 2 0 0 1 9625 9625 ^\d{4}[01] 2 0 0 1 9626 9626 ^\d{4}[01] 2 0 0 1 9627 9627 ^\d{4}[01] 2 0 0 1 9628 9628 ^\d{4}[01] 2 0 0 1 9629 9629 ^\d{4}[01] 2 0 0 1 9630 9630 ^\d{4}[01] 2 0 0 1 9631 9631 ^\d{4}[01] 2 0 0 1 9632 9632 ^\d{4}[01] 2 0 0 1 9633 9633 ^\d{4}[01] 2 0 0 1 9634 9634 ^\d{4}[01] 2 0 0 1 9635 9635 ^\d{4}[01] 2 0 0 1 9636 9636 ^\d{4}[01] 2 0 0 1 9637 9637 ^\d{4}[01] 2 0 0 1 9638 9638 ^\d{4}[01] 2 0 0 1 9639 9639 ^\d{4}[01] 2 0 0 1 9640 9640 ^\d{4}[01] 2 0 0 1 9641 9641 ^\d{4}[01] 2 0 0 1 9642 9642 ^\d{4}[01] 2 0 0 1 9643 9643 ^\d{4}[01] 2 0 0 1 9644 9644 ^\d{4}[01] 2 0 0 1 9645 9645 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9646 9646 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9647 9647 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9648 9648 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9649 9649 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9650 9650 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9651 9651 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9652 9652 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9653 9653 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9654 9654 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9655 9655 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9656 9656 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9657 9657 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9658 9658 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9659 9659 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9660 9660 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9661 9661 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9662 9662 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9663 9663 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9664 9664 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9665 9665 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9666 9666 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9667 9667 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9668 9668 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9669 9669 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9670 9670 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9671 9671 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9672 9672 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9673 9673 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9674 9674 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9675 9675 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9676 9676 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9677 9677 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9678 9678 ^\d{4}[01] 2 0 0 1 9679 9679 ^\d{4}[01] 2 0 0 1 9680 9680 ^\d{4}[01] 2 0 0 1 9681 9681 ^\d{4}[01] 2 0 0 1 9682 9682 ^\d{4}[01] 2 0 0 1 9683 9683 ^\d{4}[01] 2 0 0 1 9684 9684 ^\d{4}[01] 2 0 0 1 9685 9685 ^\d{4}[01] 2 0 0 1 9686 9686 ^\d{4}[01] 2 0 0 1 9687 9687 ^\d{4}[01] 2 0 0 1 9688 9688 ^\d{4}[01] 2 0 0 1 9689 9689 ^\d{4}[01] 2 0 0 1 9690 9690 ^\d{4}[01] 2 0 0 1 9691 9691 ^\d{4}[01] 2 0 0 1 9692 9692 ^\d{4}[01] 2 0 0 1 9693 9693 ^\d{4}[01] 2 0 0 1 9694 9694 ^\d{4}[01] 2 0 0 1 9695 9695 ^\d{4}[01] 2 0 0 1 9696 9696 ^\d{4}[01] 2 0 0 1 9697 9697 ^\d{4}[01] 2 0 0 1 9698 9698 ^\d{4}[01] 2 0 0 1 9699 9699 ^\d{4}[01] 2 0 0 1 9700 9700 ^\d{4}[01] 2 0 0 1 9701 9701 ^\d{4}[01] 2 0 0 1 9702 9702 ^\d{4}[01] 2 0 0 1 9703 9703 ^\d{4}[01] 2 0 0 1 9704 9704 ^\d{4}[01] 2 0 0 1 9705 9705 ^\d{4}[01] 2 0 0 1 9706 9706 ^\d{4}[01] 2 0 0 1 9707 9707 ^\d{4}[01] 2 0 0 1 9708 9708 ^\d{4}[01] 2 0 0 1 9709 9709 ^\d{4}[01] 2 0 0 1 9710 9710 ^\d{4}[01] 2 0 0 1 9711 9711 ^\d{4}[01] 2 0 0 1 9712 9712 ^\d{4}[01] 2 0 0 1 9713 9713 ^\d{4}[01] 2 0 0 1 9714 9714 ^\d{4}[01] 2 0 0 1 9715 9715 ^\d{4}[01] 2 0 0 1 9716 9716 ^\d{4}[01] 2 0 0 1 9717 9717 ^\d{4}[01] 2 0 0 1 9718 9718 ^\d{4}[01] 2 0 0 1 9719 9719 ^\d{4}[01] 2 0 0 1 9720 9720 ^\d{4}[01] 2 0 0 1 9721 9721 ^\d{4}[01] 2 0 0 1 9722 9722 ^\d{4}[01] 2 0 0 1 9723 9723 ^\d{4}[01] 2 0 0 1 9724 9724 ^\d{4}[01] 2 0 0 1 9725 9725 ^\d{4}[01] 2 0 0 1 9726 9726 ^\d{4}[01] 2 0 0 1 9727 9727 ^\d{4}[01] 2 0 0 1 9728 9728 ^\d{4}[01] 2 0 0 1 9729 9729 ^\d{4}[01] 2 0 0 1 9730 9730 ^\d{4}[01] 2 0 0 1 9731 9731 ^\d{4}[01] 2 0 0 1 9732 9732 ^\d{4}[01] 2 0 0 1 9733 9733 ^\d{4}[01] 2 0 0 1 9734 9734 ^\d{4}[01] 2 0 0 1 9735 9735 ^\d{4}[01] 2 0 0 1 9736 9736 ^\d{4}[01] 2 0 0 1 9737 9737 ^\d{4}[01] 2 0 0 1 9738 9738 ^\d{4}[01] 2 0 0 1 9739 9739 ^\d{4}[01] 2 0 0 1 9740 9740 ^\d{4}[01] 2 0 0 1 9741 9741 ^\d{4}[01] 2 0 0 1 9742 9742 ^\d{4}[01] 2 0 0 1 9743 9743 ^\d{4}[01] 2 0 0 1 9744 9744 ^\d{4}[01] 2 0 0 1 9745 9745 ^\d{4}[01] 2 0 0 1 9746 9746 ^\d{4}[01] 2 0 0 1 9747 9747 ^\d{4}[01] 2 0 0 1 9748 9748 ^\d{4}[01] 2 0 0 1 9749 9749 ^\d{4}[01] 2 0 0 1 9750 9750 ^\d{4}[01] 2 0 0 1 9751 9751 ^\d{4}[01] 2 0 0 1 9752 9752 ^\d{4}[01] 2 0 0 1 9753 9753 ^\d{4}[01] 2 0 0 1 9754 9754 ^\d{4}[01] 2 0 0 1 9755 9755 ^\d{4}[01] 2 0 0 1 9756 9756 ^\d{4}[01] 2 0 0 1 9757 9757 ^\d{4}[01] 2 0 0 1 9758 9758 ^\d{4}[01] 2 0 0 1 9759 9759 ^\d{4}[01] 2 0 0 1 9760 9760 ^\d{4}[01] 2 0 0 1 9761 9761 ^\d{4}[01] 2 0 0 1 9762 9762 ^\d{4}[01] 2 0 0 1 9763 9763 ^\d{4}[01] 2 0 0 1 9764 9764 ^\d{4}[01] 2 0 0 1 9765 9765 ^\d{4}[01] 2 0 0 1 9766 9766 ^\d{4}[01] 2 0 0 1 9767 9767 ^\d{4}[01] 2 0 0 1 9768 9768 ^\d{4}[01] 2 0 0 1 9769 9769 ^\d{4}[01] 2 0 0 1 9770 9770 ^\d{4}[01] 2 0 0 1 9771 9771 ^\d{4}[01] 2 0 0 1 9772 9772 ^\d{4}[01] 2 0 0 1 9773 9773 ^\d{4}[01] 2 0 0 1 9774 9774 ^\d{4}[01] 2 0 0 1 9775 9775 ^\d{4}[01] 2 0 0 1 9776 9776 ^\d{4}[01] 2 0 0 1 9777 9777 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9778 9778 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9779 9779 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9780 9780 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9781 9781 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9782 9782 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9783 9783 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9784 9784 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9785 9785 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9786 9786 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9787 9787 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9788 9788 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9789 9789 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9790 9790 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9791 9791 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9792 9792 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9793 9793 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9794 9794 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9795 9795 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9796 9796 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9797 9797 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9798 9798 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9799 9799 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9800 9800 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9801 9801 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9802 9802 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9803 9803 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9804 9804 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9805 9805 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9806 9806 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9807 9807 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9808 9808 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9809 9809 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9810 9810 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9811 9811 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9812 9812 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9813 9813 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9814 9814 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9815 9815 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9816 9816 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9817 9817 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9818 9818 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9819 9819 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9820 9820 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9821 9821 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9822 9822 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9823 9823 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9824 9824 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9825 9825 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9826 9826 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9827 9827 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9828 9828 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9829 9829 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9830 9830 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9831 9831 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9832 9832 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9833 9833 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9834 9834 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9835 9835 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9836 9836 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9837 9837 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9838 9838 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9839 9839 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9840 9840 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9841 9841 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9842 9842 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9843 9843 ^\d{4}[01] 2 0 0 1 9844 9844 ^\d{4}[01] 2 0 0 1 9845 9845 ^\d{4}[01] 2 0 0 1 9846 9846 ^\d{4}[01] 2 0 0 1 9847 9847 ^\d{4}[01] 2 0 0 1 9848 9848 ^\d{4}[01] 2 0 0 1 9849 9849 ^\d{4}[01] 2 0 0 1 9850 9850 ^\d{4}[01] 2 0 0 1 9851 9851 ^\d{4}[01] 2 0 0 1 9852 9852 ^\d{4}[01] 2 0 0 1 9853 9853 ^\d{4}[01] 2 0 0 1 9854 9854 ^\d{4}[01] 2 0 0 1 9855 9855 ^\d{4}[01] 2 0 0 1 9856 9856 ^\d{4}[01] 2 0 0 1 9857 9857 ^\d{4}[01] 2 0 0 1 9858 9858 ^\d{4}[01] 2 0 0 1 9859 9859 ^\d{4}[01] 2 0 0 1 9860 9860 ^\d{4}[01] 2 0 0 1 9861 9861 ^\d{4}[01] 2 0 0 1 9862 9862 ^\d{4}[01] 2 0 0 1 9863 9863 ^\d{4}[01] 2 0 0 1 9864 9864 ^\d{4}[01] 2 0 0 1 9865 9865 ^\d{4}[01] 2 0 0 1 9866 9866 ^\d{4}[01] 2 0 0 1 9867 9867 ^\d{4}[01] 2 0 0 1 9868 9868 ^\d{4}[01] 2 0 0 1 9869 9869 ^\d{4}[01] 2 0 0 1 9870 9870 ^\d{4}[01] 2 0 0 1 9871 9871 ^\d{4}[01] 2 0 0 1 9872 9872 ^\d{4}[01] 2 0 0 1 9873 9873 ^\d{4}[01] 2 0 0 1 9874 9874 ^\d{4}[01] 2 0 0 1 9875 9875 ^\d{4}[01] 2 0 0 1 9876 9876 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9877 9877 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9878 9878 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9879 9879 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9880 9880 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9881 9881 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9882 9882 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9883 9883 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9884 9884 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9885 9885 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9886 9886 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9887 9887 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9888 9888 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9889 9889 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9890 9890 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9891 9891 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9892 9892 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9893 9893 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9894 9894 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9895 9895 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9896 9896 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9897 9897 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9898 9898 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9899 9899 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9900 9900 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9901 9901 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9902 9902 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9903 9903 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9904 9904 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9905 9905 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9906 9906 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9907 9907 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9908 9908 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9909 9909 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9910 9910 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9911 9911 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9912 9912 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9913 9913 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9914 9914 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9915 9915 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9916 9916 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9917 9917 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9918 9918 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9919 9919 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9920 9920 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9921 9921 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9922 9922 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9923 9923 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9924 9924 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9925 9925 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9926 9926 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9927 9927 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9928 9928 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9929 9929 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9930 9930 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9931 9931 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9932 9932 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9933 9933 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9934 9934 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9935 9935 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9936 9936 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9937 9937 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9938 9938 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9939 9939 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9940 9940 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9941 9941 ^(\s(co(rp)?|l(lc|td)|inc))?[01] 2 0 0 1 9942 9942 ^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1 9943 9943 ^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22 2 0 0 1 9944 9944 \x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,} 2 0 0 1 9945 9945 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1 9946 9946 appid\x3a\s+2 2 0 0 1 9947 9947 ^\x3c(REQIMG|RVWCFG)\x3e 2 0 0 1 9948 9948 \x22mining\x2E(subscribe|authorize)\x22 2 0 0 1 9949 9949 ^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start 2 0 0 1 9950 9950 ^\/api\/(bit|lite)coin\/balance\/ 2 0 0 1 9951 9951 miner[^a-z] 2 0 0 1 9952 9952 (\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22) 2 0 0 1 9953 9953 (\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22) 2 0 0 1 9954 9954 ([0-9]{1,3}\.){3}[0-9]{1,3} 2 0 0 1 9955 9955 \/tmp\/[^\/]+\.swf$ 2 0 0 1 9956 9956 name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22 2 0 0 1 9957 9957 name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22 2 0 0 1 9958 9958 =[0-9a-f]{8}\.jar/H 2 0 0 1 9959 9959 ^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\? 2 0 0 1 9960 9960 ^\/[a-z0-9]{32}\?s=1$ 2 0 0 1 9961 9961 ^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s]))) 2 0 0 1 9962 9962 ^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>] 2 0 0 1 9963 9963 ^(mous)?\.class 2 0 0 1 9964 9964 \/chrome\/google_chrome_(update|installer)\.exe$ 2 0 0 1 9965 9965 ^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f) 2 0 0 1 9966 9966 ^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P 2 0 0 1 9967 9967 findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$ 2 0 0 1 9968 9968 ^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m 2 0 0 1 9969 9969 \.php\?cashe=\d+$ 2 0 0 1 9970 9970 \.jar\?m=[1-2]$ 2 0 0 1 9971 9971 \.pdf\?p=1&s=[1-2]$ 2 0 0 1 9972 9972 ^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi 2 0 0 1 9973 9973 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$ 2 0 0 1 9974 9974 \/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$ 2 0 0 1 9975 9975 \/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1 9976 9976 \/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$ 2 0 0 1 9977 9977 \/tds\/[a-f0-9]{32}$ 2 0 0 1 9978 9978 ^[a-f0-9]{32}[\x22\x27] 2 0 0 1 9979 9979 Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi 2 0 0 1 9980 9980 (\.\.\/)+kboxwww\/tmp\/ 2 0 0 1 9981 9981 ^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22 2 0 0 1 9982 9982 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1 9983 9983 ^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs 2 0 0 1 9984 9984 \/\?[0-9a-f]{60,66}[\;\d\x2c]*$ 2 0 0 1 9985 9985 ^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15} 2 0 0 1 9986 9986 \/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php 2 0 0 1 9987 9987 debugenableplugins=[a-zA-Z0-9]+?\x3b 2 0 0 1 9988 9988 ^\/[a-z0-9]+\/load\.php$ 2 0 0 1 9989 9989 ^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H 2 0 0 1 9990 9990 ^\/xteas\/code$ 2 0 0 1 9991 9991 \/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash= 2 0 0 1 9992 9992 =\w{8}\.pdf/Hi 2 0 0 1 9993 9993 ^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$ 2 0 0 1 9994 9994 ^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H 2 0 0 1 9995 9995 ^Host\x3a\s.+\.in\r?$/Hmi 2 0 0 1 9996 9996 name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22 2 0 0 1 9997 9997 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1 9998 9998 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$ 2 0 0 1 9999 9999 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1 10000 10000 ^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$ 2 0 0 1